diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 5122e40e62e6..cdd92f530988 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -325,7 +325,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 
 # Forgejo
 nixos/modules/services/misc/forgejo.nix @adamcstephens @bendlas @emilylange
-pkgs/by-name/fo/forgejo/package.nix     @adamcstephens @bendlas @emilylange
+pkgs/by-name/fo/forgejo/                @adamcstephens @bendlas @emilylange
 
 # Dotnet
 /pkgs/build-support/dotnet                  @corngood
diff --git a/doc/build-helpers/testers.chapter.md b/doc/build-helpers/testers.chapter.md
index ec659e75bdb5..5c1b704655cf 100644
--- a/doc/build-helpers/testers.chapter.md
+++ b/doc/build-helpers/testers.chapter.md
@@ -339,6 +339,41 @@ once to get a derivation hash, and again to produce the final fixed output deriv
 
 :::
 
+## `runCommand` {#tester-runCommand}
+
+`runCommand :: { name, script, stdenv ? stdenvNoCC, hash ? "...", ... } -> Derivation`
+
+This is a wrapper around `pkgs.runCommandWith`, which
+- produces a fixed-output derivation, enabling the command(s) to access the network ;
+- salts the derivation's name based on its inputs, ensuring the command is re-run whenever the inputs changes.
+
+It accepts the following attributes:
+- the derivation's `name` ;
+- the `script` to be executed ;
+- `stdenv`, the environment to use, defaulting to `stdenvNoCC` ;
+- the derivation's output `hash`, defaulting to the empty file's.
+  The derivation's `outputHashMode` is set by default to recursive, so the `script` can output a directory as well.
+
+All other attributes are passed through to [`mkDerivation`](#sec-using-stdenv),
+including `nativeBuildInputs` to specify dependencies available to the `script`.
+
+:::{.example #ex-tester-runCommand-nix}
+
+# Run a command with network access
+
+```nix
+testers.runCommand {
+  name = "access-the-internet";
+  command = ''
+    curl -o /dev/null https://example.com
+    touch $out
+  '';
+  nativeBuildInputs = with pkgs; [ cacert curl ];
+}
+```
+
+:::
+
 ## `runNixOSTest` {#tester-runNixOSTest}
 
 A helper function that behaves exactly like the NixOS `runTest`, except it also assigns this Nixpkgs package set as the `pkgs` of the test and makes the `nixpkgs.*` options read-only.
diff --git a/lib/customisation.nix b/lib/customisation.nix
index 0e0d79120296..bcdc94f3c4c3 100644
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -455,7 +455,7 @@ rec {
 
       1. Takes a function `p`, or a path to a Nix file that contains a function `p`, which takes an attribute set and returns value of arbitrary type `a`,
       2. Takes an attribute set `args` with explicit attributes to pass to `p`,
-      3. Calls `f` with attributes from the original attribute set `attrs` passed to `newScope` updated with `args, i.e. `attrs // args`, if they match the attributes in the argument of `p`.
+      3. Calls `f` with attributes from the original attribute set `attrs` passed to `newScope` updated with `args`, i.e. `attrs // args`, if they match the attributes in the argument of `p`.
 
       All such functions `p` will be called with the same value for `attrs`.
 
diff --git a/lib/licenses.nix b/lib/licenses.nix
index 67744b499d8a..9b25bd4bcea8 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -728,6 +728,12 @@ lib.mapAttrs mkLicense ({
     redistributable = false;
   };
 
+  databricks-license = {
+    fullName = "Databricks License";
+    url = "https://www.databricks.com/legal/db-license";
+    free = false;
+  };
+
   fair = {
     fullName = "Fair License";
     spdxId = "Fair";
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index e8384a6938fc..cee09791bf54 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -257,6 +257,22 @@ let
         if final.isMacOS then "MACOSX_DEPLOYMENT_TARGET"
         else if final.isiOS then "IPHONEOS_DEPLOYMENT_TARGET"
         else null;
+
+      # Remove before 25.05
+      androidSdkVersion =
+        if (args ? sdkVer && !args ? androidSdkVersion) then
+          throw "For android `sdkVer` has been renamed to `androidSdkVersion`"
+        else if (args ? androidSdkVersion) then
+          args.androidSdkVersion
+        else
+          null;
+      androidNdkVersion =
+        if (args ? ndkVer && !args ? androidNdkVersion) then
+          throw "For android `ndkVer` has been renamed to `androidNdkVersion`"
+        else if (args ? androidSdkVersion) then
+          args.androidNdkVersion
+        else
+          null;
     } // (
       let
         selectEmulator = pkgs:
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 178536efb009..971f6b87364b 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -60,23 +60,23 @@ rec {
   armv7a-android-prebuilt = {
     config = "armv7a-unknown-linux-androideabi";
     rust.rustcTarget = "armv7-linux-androideabi";
-    sdkVer = "33";
-    ndkVer = "26";
+    androidSdkVersion = "33";
+    androidNdkVersion = "26";
     useAndroidPrebuilt = true;
   } // platforms.armv7a-android;
 
   aarch64-android-prebuilt = {
     config = "aarch64-unknown-linux-android";
     rust.rustcTarget = "aarch64-linux-android";
-    sdkVer = "33";
-    ndkVer = "26";
+    androidSdkVersion = "33";
+    androidNdkVersion = "26";
     useAndroidPrebuilt = true;
   };
 
   aarch64-android = {
     config = "aarch64-unknown-linux-android";
-    sdkVer = "33";
-    ndkVer = "26";
+    androidSdkVersion = "33";
+    androidNdkVersion = "26";
     libc = "bionic";
     useAndroidPrebuilt = false;
     useLLVM = true;
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a02b6f0be78f..b3ca1e4b2273 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5484,6 +5484,12 @@
     githubId = 252042;
     keys = [ { fingerprint = "85F3 72DF 4AF3 EF13 ED34  72A3 0AAF 2901 E804 0715"; } ];
   };
+  DrymarchonShaun = {
+    name = "Shaun";
+    email = "drymarchonshaun@protonmail.com";
+    github = "DrymarchonShaun";
+    githubId = 40149778;
+  };
   dsalaza4 = {
     email = "podany270895@gmail.com";
     github = "dsalaza4";
@@ -7283,9 +7289,10 @@
     name = "Gavin Rogers";
   };
   gaykitty = {
+    email = "sasha@noraa.gay";
     github = "gaykitty";
     githubId = 126119280;
-    name = "Kitty Pride";
+    name = "Sashanoraa";
   };
   gazally = {
     email = "gazally@runbox.com";
@@ -8024,6 +8031,13 @@
     githubId = 62279738;
     name = "Håkon Arvidsen";
   };
+  HaskellHegemonie = {
+    name = "HaskellHegemonie";
+    email = "haskellisierer@proton.me";
+    github = "HaskellHegemonie";
+    githubId = 73712423;
+    keys = [ { fingerprint = "A559 0A2A 5B06 1923 3917  5F13 5622 C205 6513 577B"; } ];
+  };
   haslersn = {
     email = "haslersn@fius.informatik.uni-stuttgart.de";
     github = "haslersn";
@@ -11495,6 +11509,12 @@
     githubId = 31388299;
     name = "Leonardo Eugênio";
   };
+  lenivaya = {
+    name = "Danylo Osipchuk";
+    email = "danylo.osipchuk@proton.me";
+    github = "lenivaya";
+    githubId = 49302467;
+  };
   leo248 = {
     github = "leo248";
     githubId = 95365184;
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 972e13852eca..2792f3f2ad8b 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -180,6 +180,8 @@
   `services.forgejo.secrets` is a small wrapper over systemd's `LoadCredential=`. It has the same structure (sections/keys) as
   `services.forgejo.settings` but takes file paths that will be read before service startup instead of some plaintext value.
 
+- `forgejo` and `forgejo-lts` no longer support the opt-in feature [PAM (Pluggable Authentication Module)](https://forgejo.org/docs/latest/user/authentication/#pam-pluggable-authentication-module).
+
 - `services.ddclient.use` has been deprecated: `ddclient` now supports separate IPv4 and IPv6 configuration. Use `services.ddclient.usev4` and `services.ddclient.usev6` instead.
 
 - `teleport` has been upgraded from major version 15 to major version 16.
diff --git a/nixos/lib/make-squashfs.nix b/nixos/lib/make-squashfs.nix
index f28e2c671580..3f26f72c6267 100644
--- a/nixos/lib/make-squashfs.nix
+++ b/nixos/lib/make-squashfs.nix
@@ -10,6 +10,9 @@
 , # Compression parameters.
   # For zstd compression you can use "zstd -Xcompression-level 6".
   comp ? "xz -Xdict-size 100%"
+, # create hydra build product. will put image in directory instead
+  # of directly in the store
+  hydraBuildProduct ? false
 }:
 
 let
@@ -17,7 +20,7 @@ let
   compFlag = if comp == null then "-no-compression" else "-comp ${comp}";
 in
 stdenv.mkDerivation {
-  name = "${fileName}.img";
+  name = "${fileName}${lib.optionalString (!hydraBuildProduct) ".img"}";
   __structuredAttrs = true;
 
   nativeBuildInputs = [ squashfsTools ];
@@ -30,7 +33,13 @@ stdenv.mkDerivation {
       # for nix-store --load-db.
       cp $closureInfo/registration nix-path-registration
 
+      imgPath="$out"
+    '' + lib.optionalString hydraBuildProduct ''
+
+      mkdir $out
+      imgPath="$out/${fileName}.squashfs"
     '' + lib.optionalString stdenv.buildPlatform.is32bit ''
+
       # 64 cores on i686 does not work
       # fails with FATAL ERROR: mangle2:: xz compress failed with error code 5
       if ((NIX_BUILD_CORES > 48)); then
@@ -39,8 +48,12 @@ stdenv.mkDerivation {
     '' + ''
 
       # Generate the squashfs image.
-      mksquashfs nix-path-registration $(cat $closureInfo/store-paths) $out ${pseudoFilesArgs} \
+      mksquashfs nix-path-registration $(cat $closureInfo/store-paths) $imgPath ${pseudoFilesArgs} \
         -no-hardlinks ${lib.optionalString noStrip "-no-strip"} -keep-as-directory -all-root -b 1048576 ${compFlag} \
         -processors $NIX_BUILD_CORES
+    '' + lib.optionalString hydraBuildProduct ''
+
+      mkdir -p $out/nix-support
+      echo "file squashfs-image $out/${fileName}.squashfs" >> $out/nix-support/hydra-build-products
     '';
 }
diff --git a/nixos/modules/programs/regreet.nix b/nixos/modules/programs/regreet.nix
index cec3e0bf5046..1f83f610dbf1 100644
--- a/nixos/modules/programs/regreet.nix
+++ b/nixos/modules/programs/regreet.nix
@@ -27,7 +27,7 @@ in
     package = lib.mkPackageOption pkgs [ "greetd" "regreet" ] { };
 
     settings = lib.mkOption {
-      type = lib.types.either lib.types.path settingsFormat.type;
+      type = settingsFormat.type;
       default = { };
       description = ''
         ReGreet configuration file. Refer
@@ -141,7 +141,7 @@ in
 
     fonts.packages = [ cfg.font.package ];
 
-    programs.regreet.settings = {
+    programs.regreet.settings.GTK = {
       cursor_theme_name = cfg.cursorTheme.name;
       font_name = "${cfg.font.name} ${toString cfg.font.size}";
       icon_theme_name = cfg.iconTheme.name;
@@ -160,9 +160,7 @@ in
         else {text = cfg.extraCss;};
 
       "greetd/regreet.toml".source =
-        if lib.isPath cfg.settings
-        then cfg.settings
-        else settingsFormat.generate "regreet.toml" cfg.settings;
+        settingsFormat.generate "regreet.toml" cfg.settings;
     };
 
     systemd.tmpfiles.settings."10-regreet" = let
diff --git a/nixos/modules/programs/yabar.nix b/nixos/modules/programs/yabar.nix
index 0457f8e76655..ee8370b56914 100644
--- a/nixos/modules/programs/yabar.nix
+++ b/nixos/modules/programs/yabar.nix
@@ -48,6 +48,7 @@ in
         type = lib.types.package;
 
         # `yabar-stable` segfaults under certain conditions.
+        # remember to update yabar.passthru.tests if nixos switches back to it!
         apply = x: if x == pkgs.yabar-unstable then x else lib.flip lib.warn x ''
           It's not recommended to use `yabar' with `programs.yabar', the (old) stable release
           tends to segfault under certain circumstances:
diff --git a/nixos/modules/services/wayland/hypridle.nix b/nixos/modules/services/wayland/hypridle.nix
index 5442802df987..ee35812fd440 100644
--- a/nixos/modules/services/wayland/hypridle.nix
+++ b/nixos/modules/services/wayland/hypridle.nix
@@ -1,4 +1,9 @@
-{ lib, pkgs, config, ... }:
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
 
 let
   cfg = config.services.hypridle;
@@ -10,16 +15,9 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = [
-      cfg.package
-    ];
+    environment.systemPackages = [ cfg.package ];
 
-    systemd.user.services.hypridle = {
-      description = "Hypridle idle daemon";
-      wantedBy = [ "graphical-session.target" ];
-      partOf = [ "graphical-session.target" ];
-      script = lib.getExe cfg.package;
-    };
+    systemd.packages = [ cfg.package ];
   };
 
   meta.maintainers = with lib.maintainers; [ johnrtitor ];
diff --git a/nixos/modules/virtualisation/lxc-container.nix b/nixos/modules/virtualisation/lxc-container.nix
index 0b528496bb33..42c323ee4503 100644
--- a/nixos/modules/virtualisation/lxc-container.nix
+++ b/nixos/modules/virtualisation/lxc-container.nix
@@ -60,6 +60,7 @@
     system.build.squashfs = pkgs.callPackage ../../lib/make-squashfs.nix {
       fileName = "nixos-lxc-image-${pkgs.stdenv.hostPlatform.system}";
 
+      hydraBuildProduct = true;
       noStrip = true; # keep directory structure
       comp = "zstd -Xcompression-level 6";
 
diff --git a/nixos/tests/mongodb.nix b/nixos/tests/mongodb.nix
index 97729e38864c..1a260814f8b8 100644
--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@@ -33,6 +33,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
     nodes = {
       node = {...}: {
         environment.systemPackages = with pkgs; [
+          # remember to update mongodb.passthru.tests if you change this
           mongodb-5_0
         ];
       };
diff --git a/pkgs/applications/audio/mympd/default.nix b/pkgs/applications/audio/mympd/default.nix
index c28eb62d07a4..f96c08577b39 100644
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@@ -12,6 +12,7 @@
 , gzip
 , perl
 , jq
+, nixosTests
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -57,6 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
   # 5 tests out of 23 fail, probably due to the sandbox...
   doCheck = false;
 
+  passthru.tests = { inherit (nixosTests) mympd; };
+
   meta = {
     homepage = "https://jcorporation.github.io/myMPD";
     description = "Standalone and mobile friendly web mpd client with a tiny footprint and advanced features";
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index 96e849b406e2..f020e68baab4 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "7.19";
+  version = "7.20";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
-    hash = if stdenv.isDarwin then "sha256-uxrLtq7rTmsgYHeE1yizHsnuijiL17RkbeBJPRUqRnw=" else {
-      x86_64-linux = "sha256-f38WtxmIbkZpi0P8Cn5jEU7aP2AzEvbnalBg9N/rbMY=";
-      aarch64-linux = "sha256-WTXF/l7Z33LKzjrTQ8YesgJUBVtKUTDkjfO8curuL2o=";
+    hash = if stdenv.isDarwin then "sha256-RtGGGbiEEPXYUqK5qpKcCEfIwhlP7/0bAOPMCG7tqZw=" else {
+      x86_64-linux = "sha256-/6Ee8YCHM9nJhyelEfH62jhkbDwypKXljM305mWY2io=";
+      aarch64-linux = "sha256-YnKlONKCmXeV19oREJnXD5t3nEQZ5hVOOvDPtUIFw1A=";
     }.${stdenv.hostPlatform.system};
   };
 
diff --git a/pkgs/applications/blockchains/ergo/default.nix b/pkgs/applications/blockchains/ergo/default.nix
index 0ab89e9c2709..ba24148ed51e 100644
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, jre }:
+{ lib, stdenv, fetchurl, makeWrapper, jre, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "ergo";
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     makeWrapper ${jre}/bin/java $out/bin/ergo --add-flags "-jar $src"
   '';
 
+  passthru.tests = { inherit (nixosTests) ergo; };
+
   meta = with lib; {
     description = "Open protocol that implements modern scientific ideas in the blockchain area";
     homepage = "https://ergoplatform.org/en/";
diff --git a/pkgs/applications/blockchains/quorum/default.nix b/pkgs/applications/blockchains/quorum/default.nix
index 23e1d92a8314..ca323bba3a7b 100644
--- a/pkgs/applications/blockchains/quorum/default.nix
+++ b/pkgs/applications/blockchains/quorum/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, fetchFromGitHub, buildGoModule, nixosTests }:
 
 buildGoModule rec {
   pname = "quorum";
@@ -20,6 +20,8 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" ];
 
+  passthru.tests = { inherit (nixosTests) quorum; };
+
   meta = with lib; {
     description = "Permissioned implementation of Ethereum supporting data privacy";
     homepage = "https://consensys.net/quorum/";
diff --git a/pkgs/applications/blockchains/wasabibackend/default.nix b/pkgs/applications/blockchains/wasabibackend/default.nix
index 1371be1a9752..59a3c1689b07 100644
--- a/pkgs/applications/blockchains/wasabibackend/default.nix
+++ b/pkgs/applications/blockchains/wasabibackend/default.nix
@@ -6,6 +6,7 @@
   dotnetCorePackages,
   zlib,
   openssl,
+  nixosTests,
 }:
 buildDotnetModule rec {
   pname = "wasabibackend";
@@ -38,6 +39,10 @@ buildDotnetModule rec {
     mv $out/bin/WalletWasabi.Backend $out/bin/WasabiBackend
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) wasabibackend;
+  };
+
   meta = with lib; {
     description = "Backend for the Wasabi Wallet";
     homepage = "https://wasabiwallet.io/";
diff --git a/pkgs/applications/display-managers/lightdm/default.nix b/pkgs/applications/display-managers/lightdm/default.nix
index f5d856ec1770..820477861bb5 100644
--- a/pkgs/applications/display-managers/lightdm/default.nix
+++ b/pkgs/applications/display-managers/lightdm/default.nix
@@ -28,6 +28,7 @@
 , qtbase
 , yelp-tools
 , yelp-xsl
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
@@ -115,6 +116,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = nix-update-script { };
+    tests = { inherit (nixosTests) lightdm; };
   };
 
 
diff --git a/pkgs/applications/display-managers/ly/default.nix b/pkgs/applications/display-managers/ly/default.nix
index 41ecfd40f4b5..24332a10c080 100644
--- a/pkgs/applications/display-managers/ly/default.nix
+++ b/pkgs/applications/display-managers/ly/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, linux-pam, libxcb, makeBinaryWrapper, zig_0_12
-, callPackage }:
+, callPackage, nixosTests }:
 
 stdenv.mkDerivation {
   pname = "ly";
@@ -19,6 +19,8 @@ stdenv.mkDerivation {
     ln -s ${callPackage ./deps.nix { }} $ZIG_GLOBAL_CACHE_DIR/p
   '';
 
+  passthru.tests = { inherit (nixosTests) ly; };
+
   meta = with lib; {
     description = "TUI display manager";
     license = licenses.wtfpl;
diff --git a/pkgs/applications/display-managers/sddm/default.nix b/pkgs/applications/display-managers/sddm/default.nix
index 2708ff060814..45268ae44bdf 100644
--- a/pkgs/applications/display-managers/sddm/default.nix
+++ b/pkgs/applications/display-managers/sddm/default.nix
@@ -16,6 +16,7 @@ runCommand "sddm-wrapped" {
 
   passthru = {
     inherit unwrapped;
+    inherit (unwrapped.passthru) tests;
   };
 
   meta = unwrapped.meta;
diff --git a/pkgs/applications/display-managers/sddm/unwrapped.nix b/pkgs/applications/display-managers/sddm/unwrapped.nix
index 430e62a5ef4a..3a7a73dd9610 100644
--- a/pkgs/applications/display-managers/sddm/unwrapped.nix
+++ b/pkgs/applications/display-managers/sddm/unwrapped.nix
@@ -2,6 +2,7 @@
 , cmake, pkg-config, qttools
 , libxcb, libXau, pam, qtbase, qtdeclarative
 , qtquickcontrols2 ? null, systemd, xkeyboardconfig
+, nixosTests
 }:
 let
   isQt6 = lib.versions.major qtbase.version == "6";
@@ -76,6 +77,8 @@ in stdenv.mkDerivation(finalAttrs: {
     done
   '';
 
+  passthru.tests = { inherit (nixosTests) sddm; };
+
   meta = with lib; {
     description = "QML based X11 display manager";
     homepage    = "https://github.com/sddm/sddm";
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ligo-mode/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ligo-mode/package.nix
index ed8dfd3cece8..045d3f759761 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ligo-mode/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ligo-mode/package.nix
@@ -8,13 +8,13 @@
 
 melpaBuild {
   pname = "ligo-mode";
-  version = "1.7.0-unstable-2024-08-01";
+  version = "1.7.0-unstable-2024-08-14";
 
   src = fetchFromGitLab {
     owner = "ligolang";
     repo = "ligo";
-    rev = "454e4a505212b8bd80ac3c75a1432320b9be2604";
-    hash = "sha256-Z7bv+ulGwnczrSWWC1RIUzSI4wAF9AtObdi5bBfYsOs=";
+    rev = "547da30202972fd9b5114ce82c4b94ddf6c8e8f7";
+    hash = "sha256-kGFV3Ci8F+vK1LCQCsdpxeoLHarfa4dItQkJDihE7eI=";
   };
 
   files = ''("tools/emacs/ligo-mode.el")'';
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
index a44a9d79529e..86687a34b9fb 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
@@ -29,13 +29,13 @@ let
 in
 melpaBuild {
   pname = "lsp-bridge";
-  version = "0-unstable-2024-08-06";
+  version = "0-unstable-2024-08-12";
 
   src = fetchFromGitHub {
     owner = "manateelazycat";
     repo = "lsp-bridge";
-    rev = "49b5497243873b1bddea09a4a988e3573ed7cc3e";
-    hash = "sha256-bGO5DjsetInDyGDHog5QJtAgz499kJEj52iWYIzdp5Y=";
+    rev = "658f08ee51c193f52a0e9723b190e5f6eef77ab7";
+    hash = "sha256-ksKvekDKYdlJULRmALudfduYe1TkW3aG2uBeKdHOokQ=";
   };
 
   patches = [
diff --git a/pkgs/applications/editors/music/tuxguitar/default.nix b/pkgs/applications/editors/music/tuxguitar/default.nix
index 47614b260b82..a602de8a37b7 100644
--- a/pkgs/applications/editors/music/tuxguitar/default.nix
+++ b/pkgs/applications/editors/music/tuxguitar/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, swt, jre, makeWrapper, alsa-lib, jack2, fluidsynth, libpulseaudio }:
+{ lib, stdenv, fetchurl, swt, jre, makeWrapper, alsa-lib, jack2, fluidsynth, libpulseaudio, nixosTests }:
 
 let metadata = assert stdenv.hostPlatform.system == "i686-linux" || stdenv.hostPlatform.system == "x86_64-linux";
   if stdenv.hostPlatform.system == "i686-linux" then
@@ -31,6 +31,8 @@ in stdenv.mkDerivation rec {
       --prefix CLASSPATH : "${swt}/jars/swt.jar:$out/lib/tuxguitar.jar:$out/lib/itext.jar"
   '';
 
+  passthru.tests = { inherit (nixosTests) tuxguitar; };
+
   meta = with lib; {
     description = "Multitrack guitar tablature editor";
     longDescription = ''
diff --git a/pkgs/applications/editors/ox/default.nix b/pkgs/applications/editors/ox/default.nix
index 978f2b2aaa1a..dd213f846073 100644
--- a/pkgs/applications/editors/ox/default.nix
+++ b/pkgs/applications/editors/ox/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ox";
-  version = "0.2.7";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "curlpipe";
     repo = pname;
     rev = version;
-    hash = "sha256-4I6RjSCfNyeSQwGn6zX9AhePkqr+uOuhXdV0tat1LqI=";
+    hash = "sha256-g5M/d6pts4Y17CpWJAsWFL5KCq1YFaACJq6n6BQw7mo=";
   };
 
-  cargoHash = "sha256-VFrN58SRTRGH+RSc59RIdsysR3umnrU2KM5XVCp9u1Q=";
+  cargoHash = "sha256-6+W/guijsb9+ip1cvke8JLVa4h1nU2zQJCrLv64vsa0=";
 
   meta = with lib; {
     description = "Independent Rust text editor that runs in your terminal";
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 5962c50c411f..72703e07139e 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -11256,6 +11256,18 @@ final: prev:
     meta.homepage = "https://github.com/levouh/tint.nvim/";
   };
 
+  tiny-inline-diagnostic-nvim = buildVimPlugin {
+    pname = "tiny-inline-diagnostic.nvim";
+    version = "2024-08-10";
+    src = fetchFromGitHub {
+      owner = "rachartier";
+      repo = "tiny-inline-diagnostic.nvim";
+      rev = "7b212b214aed37d8ae1a26ac6ca9593223a23ddb";
+      sha256 = "0zf3l8fx7vbq352ip3lrvvhrkkwp8n7n5i2lh5ps8j0jqaxswr33";
+    };
+    meta.homepage = "https://github.com/rachartier/tiny-inline-diagnostic.nvim/";
+  };
+
   tlib_vim = buildVimPlugin {
     pname = "tlib_vim";
     version = "2022-07-22";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 4240139d51b2..21553163db90 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -944,6 +944,7 @@ https://github.com/ron89/thesaurus_query.vim/,,
 https://github.com/itchyny/thumbnail.vim/,,
 https://github.com/vim-scripts/timestamp.vim/,,
 https://github.com/levouh/tint.nvim/,HEAD,
+https://github.com/rachartier/tiny-inline-diagnostic.nvim/,HEAD,
 https://github.com/tomtom/tinykeymap_vim/,,tinykeymap
 https://github.com/tomtom/tlib_vim/,,
 https://github.com/wellle/tmux-complete.vim/,,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 496c39c3b416..dee4e0b12f8d 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1213,6 +1213,23 @@ let
         meta.license = lib.licenses.mit;
       };
 
+      databricks.databricks = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "databricks";
+          publisher = "databricks";
+          version = "2.3.1";
+          hash = "sha256-Qa839ygG8Z3aD/ZSshe2hg0ee3ZFU8xRrJ5E0cUjfCU=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
+          description = "Databricks extension for Visual Studio Code";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=databricks.databricks";
+          homepage = "https://github.com/databricks/databricks-vscode";
+          license = lib.licenses.databricks-license;
+          maintainers = [ lib.maintainers.softinio ];
+        };
+      };
+
       davidanson.vscode-markdownlint = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-markdownlint";
@@ -3089,6 +3106,8 @@ let
         };
       };
 
+      mongodb.mongodb-vscode = callPackage ./mongodb.mongodb-vscode { };
+
       moshfeu.compare-folders = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "compare-folders";
@@ -4815,8 +4834,8 @@ let
         mktplcRef = {
           name = "uiua-vscode";
           publisher = "uiua-lang";
-          version = "0.0.44";
-          hash = "sha256-lumK7gcj/NIhiZKT6F++ZsTFKWw7ZVaKZgIsQvZAGs4=";
+          version = "0.0.52";
+          hash = "sha256-zFtu3AYnDxb/aMtkpiaItQtwLpynTVbSRGuqKv3SueM=";
         };
         meta = {
           description = "VSCode language extension for Uiua";
diff --git a/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
new file mode 100644
index 000000000000..f1e2132dc81d
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
@@ -0,0 +1,19 @@
+{ lib, vscode-utils }:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "mongodb-vscode";
+    publisher = "mongodb";
+    version = "1.7.0";
+    hash = "sha256-EDU8kQLTQIe5D905ZVskFt/28Mzv1Zr7auqG4tksQ/o=";
+  };
+
+  meta = {
+    changelog = "https://github.com/mongodb-js/vscode/blob/main/CHANGELOG.md";
+    description = "An extension for VS Code that makes it easy to work with your data in MongoDB";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=mongodb.mongodb-vscode";
+    homepage = "https://github.com/mongodb-js/vscode";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 072c1a1ca5c5..9b1a3642615a 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -15,11 +15,11 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0am2g0vpb2fgqqs9m5v9dx8w47l2xnjy7bf3rr0bjr4yv4qn7g0n";
-    x86_64-darwin = "0520kpdfa2k1qlgnmnzisbbq0n4h119nfgnaljymsviw1ix02v7k";
-    aarch64-linux = "0r6sqyfcj3qs2iqpfhdjcd8jfazkmyxx0f92qpxlc6a5gllm3hlj";
-    aarch64-darwin = "03b0akbkmqp1fm6i61dx09lln8m3598xigi4wr0rkdsy0yq2vpl8";
-    armv7l-linux = "1sdml7bhrrn2qskhzs4ymibq7cw4nhjimxi8fmaj94dk5yri4wd3";
+    x86_64-linux = "1qddnqjq61c8m9klzkf4ic2zjgcwzpa0mjmraqfyga8njqham8z5";
+    x86_64-darwin = "1fkpijnm1z84x1bv9w4qvwrydcv9i2jsldvp96gby7f3gp69asaw";
+    aarch64-linux = "1k8whwqk0di2knld4gxyjwngh5kfa4pa4fr1scg7pfwfx9dnkljd";
+    aarch64-darwin = "0wgag225ji108zdrfbmp3iviyl3ha6gblcxp5ilc39pi50dms4gv";
+    armv7l-linux = "00w4238av273qznbnxdw4vvjj0iv8rrzb15aazvirb22d2slk9hr";
   }.${system} or throwSystem;
 
   sourceRoot = lib.optionalString (!stdenv.isDarwin) ".";
@@ -29,7 +29,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.91.1.24193";
+    version = "1.92.2.24228";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/file-managers/clifm/default.nix b/pkgs/applications/file-managers/clifm/default.nix
index cd263dd2e851..f24445f2a6d2 100644
--- a/pkgs/applications/file-managers/clifm/default.nix
+++ b/pkgs/applications/file-managers/clifm/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clifm";
-  version = "1.19";
+  version = "1.20";
 
   src = fetchFromGitHub {
     owner = "leo-arch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-QNxEvFZ5e4jQV2Tv2/D9KPRDoCoQlrqStFnbKVgcXxg=";
+    hash = "sha256-TKQxNl+RTPQAE7mMALugm3rg8mPZq3eD/uW23DLws8I=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/c3d/default.nix b/pkgs/applications/graphics/c3d/default.nix
index 58af10640484..cce015802302 100644
--- a/pkgs/applications/graphics/c3d/default.nix
+++ b/pkgs/applications/graphics/c3d/default.nix
@@ -1,19 +1,25 @@
-{ lib, stdenv, fetchFromGitHub, cmake, itk_5_2, Cocoa }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  itk,
+  Cocoa,
+}:
 
 stdenv.mkDerivation rec {
-  pname   = "c3d";
-  version = "unstable-2021-09-14";
+  pname = "c3d";
+  version = "1.4.1-unstable-2024-08-07";
 
   src = fetchFromGitHub {
     owner = "pyushkevich";
-    repo = pname;
-    rev = "cc06e6e2f04acd3d6faa3d8c9a66b499f02d4388";
-    sha256 = "sha256:1ql1y6694njsmdapywhppb54viyw8wdpaxxr1b3hm2rqhvwmhn52";
+    repo = "c3d";
+    rev = "9e6174153ab87eae014f5b802413478c8fbc9a1a";
+    hash = "sha256-s2/XRyKoiMnF6cRsxxNUSlNtksbOyKSlk8hAGxJELqw=";
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ itk_5_2 ]
-    ++ lib.optional stdenv.isDarwin Cocoa;
+  buildInputs = [ itk ] ++ lib.optional stdenv.isDarwin Cocoa;
 
   cmakeFlags = [ "-DCONVERT3D_USE_ITK_REMOTE_MODULES=OFF" ];
 
diff --git a/pkgs/applications/misc/fluidd/default.nix b/pkgs/applications/misc/fluidd/default.nix
index c3d5340640b3..1741e5f2d325 100644
--- a/pkgs/applications/misc/fluidd/default.nix
+++ b/pkgs/applications/misc/fluidd/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenvNoCC, fetchurl, unzip }:
+{ lib, stdenvNoCC, fetchurl, unzip, nixosTests }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "fluidd";
@@ -25,6 +25,8 @@ stdenvNoCC.mkDerivation rec {
     cp -r fluidd $out/share/fluidd/htdocs
   '';
 
+  passthru.tests = { inherit (nixosTests) fluidd; };
+
   meta = with lib; {
     description = "Klipper web interface";
     homepage = "https://docs.fluidd.xyz";
diff --git a/pkgs/applications/misc/jotta-cli/default.nix b/pkgs/applications/misc/jotta-cli/default.nix
index b2239298d1a2..4130f7867a75 100644
--- a/pkgs/applications/misc/jotta-cli/default.nix
+++ b/pkgs/applications/misc/jotta-cli/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchzip }:
+{ lib, stdenv, fetchzip, nixosTests }:
 
 let
   arch = "amd64";
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
     $out/bin/jotta-cli completion bash > $out/share/bash-completion/completions/jotta-cli.bash
   '';
 
+  passthru.tests = { inherit (nixosTests) jotta-cli; };
+
   meta = with lib; {
     description  = "Jottacloud CLI";
     homepage     = "https://www.jottacloud.com/";
diff --git a/pkgs/applications/misc/nwg-dock/default.nix b/pkgs/applications/misc/nwg-dock/default.nix
index 3d8e8f82d39d..29880d734000 100644
--- a/pkgs/applications/misc/nwg-dock/default.nix
+++ b/pkgs/applications/misc/nwg-dock/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "nwg-dock";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qmzCjbWmrDJBB2gnhR5hc0sYD3V0i/SKTavfMA2iLyc=";
+    sha256 = "sha256-ZR72QMftR6bWCieJHW3k46Ujdn/W5fulGxYKoNPiPfE=";
   };
 
   vendorHash = "sha256-paRcBQwg2uGouMRX5XF++OyN8Y0JyucXLN0G5O0j3qA=";
diff --git a/pkgs/applications/misc/sc-im/default.nix b/pkgs/applications/misc/sc-im/default.nix
index d4509411dcfe..c8d90823863f 100644
--- a/pkgs/applications/misc/sc-im/default.nix
+++ b/pkgs/applications/misc/sc-im/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sc-im";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "andmarti1424";
     repo = "sc-im";
     rev = "v${version}";
-    sha256 = "sha256-QlnxMe0WsRX9J2xzpf2Udcf9+N3MvQWqmYl2YKsGpYM=";
+    sha256 = "sha256-nNOifSYbmJjuw6c8TerIQRlhCwbs7GnzD2J7O3vs0gI=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/applications/misc/writefreely/default.nix b/pkgs/applications/misc/writefreely/default.nix
index d505ae2e380a..0f8d3b6fac29 100644
--- a/pkgs/applications/misc/writefreely/default.nix
+++ b/pkgs/applications/misc/writefreely/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule rec {
   pname = "writefreely";
@@ -23,6 +23,8 @@ buildGoModule rec {
 
   subPackages = [ "cmd/writefreely" ];
 
+  passthru.tests = { inherit (nixosTests) writefreely; };
+
   meta = with lib; {
     description = "Build a digital writing community";
     homepage = "https://github.com/writefreely/writefreely";
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 1f2e54796c11..3632352383b2 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -6,17 +6,17 @@ callPackage ./make-brave.nix (removeAttrs args [ "callPackage" ])
     if stdenv.isAarch64 then
       rec {
         pname = "brave";
-        version = "1.68.137";
+        version = "1.68.141";
         url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-        hash = "sha256-9HMgLZ/iK5xJByZuvD8n5cv+aK5oZRm2Xbm4NhgWpCk=";
+        hash = "sha256-3Zd1H67rFDar/68ilcxPuAQOllh8SMm//9+h+m1MKes=";
         platform = "aarch64-linux";
       }
     else if stdenv.isx86_64 then
       rec {
         pname = "brave";
-        version = "1.68.137";
+        version = "1.68.141";
         url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-        hash = "sha256-lEW4bv/BWjV8ncB8TMbLMSoQCW960kWP9DaZkEws428=";
+        hash = "sha256-soSwRj8acXA2KDgCpcFZh2AFEVX43ZI7IpmvXKv5mFo=";
         platform = "x86_64-linux";
       }
     else
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 59803dabdf27..e74961dea391 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.12.0";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    hash = "sha256-l2J7inrV82ej8baoY3FTcGeusN5e6WNEZMtzOdE8/WY=";
+    hash = "sha256-mqFQdgzHjht3ipTdjE4IfG9wrV7GZtuvH8T2iosiHMs=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
diff --git a/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix b/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
index 17822e687f7e..baa070a17608 100644
--- a/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
+++ b/pkgs/applications/networking/cluster/kubelogin-oidc/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "1.28.2";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hWGP3/WAS2+/jylytZWo7+N/bWmrkaJDHZ0tYbElLSs=";
+    sha256 = "sha256-fGCllV07YustUIX1XiSvsC42obDOgl2yV5ruQMT2R0c=";
   };
 
   subPackages = ["."];
 
-  vendorHash = "sha256-r9WaS3J0b2yerjOgVLu0g95fwETqOFWoUvSC30gDzH0=";
+  vendorHash = "sha256-wtxSoRSpmRwuIOdKGmCRR+QLwOvONiiltg6KL6t2cf8=";
 
   # Rename the binary instead of symlinking to avoid conflict with the
   # Azure version of kubelogin
diff --git a/pkgs/applications/networking/cluster/nixops/default.nix b/pkgs/applications/networking/cluster/nixops/default.nix
index 5cbd49e2f562..d9d31d94ac96 100644
--- a/pkgs/applications/networking/cluster/nixops/default.nix
+++ b/pkgs/applications/networking/cluster/nixops/default.nix
@@ -22,16 +22,16 @@ let
       nixops-aws = callPackage ./plugins/nixops-aws.nix { };
       nixops-digitalocean = callPackage ./plugins/nixops-digitalocean.nix { };
       nixops-encrypted-links = callPackage ./plugins/nixops-encrypted-links.nix { };
-      nixops-gce = callPackage ./plugins/nixops-gce.nix { };
       nixops-hercules-ci = callPackage ./plugins/nixops-hercules-ci.nix { };
-      nixops-hetzner = callPackage ./plugins/nixops-hetzner.nix { };
-      nixops-hetznercloud = callPackage ./plugins/nixops-hetznercloud.nix { };
-      nixops-libvirtd = callPackage ./plugins/nixops-libvirtd.nix { };
       nixops-vbox = callPackage ./plugins/nixops-vbox.nix { };
       nixos-modules-contrib = callPackage ./plugins/nixos-modules-contrib.nix { };
 
+      nixops-gce = throw "nixops-gce was broken and was removed from nixpkgs";
+      nixops-libvirtd = throw "nixops-libvirtd was broken and was removed from nixpkgs";
+      nixops-hetzner = throw "nixops-hetzner was broken and was removed from nixpkgs";
+      nixops-hetznercloud = throw "nixops-hetznercloud was broken and was removed from nixpkgs";
+
       # aliases for backwards compatibility
-      nixops-gcp = nixops-gce;
       nixops-virtd = nixops-libvirtd;
       nixopsvbox = nixops-vbox;
     };
@@ -109,14 +109,11 @@ in
 
   # Not recommended; too fragile.
   nixops_unstable_full = minimal.withPlugins (ps: [
-    ps.nixops-aws
+    # currently broken
+    # ps.nixops-aws
     ps.nixops-digitalocean
     ps.nixops-encrypted-links
-    ps.nixops-gce
     ps.nixops-hercules-ci
-    ps.nixops-hetzner
-    ps.nixops-hetznercloud
-    ps.nixops-libvirtd
     ps.nixops-vbox
   ]);
 }
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix
index 44671b0809ed..895794d3e0f6 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix
@@ -53,6 +53,7 @@ buildPythonPackage {
     description = "AWS plugin for NixOps";
     homepage = "https://github.com/NixOS/nixops-aws";
     license = licenses.lgpl3Only;
+    broken = true; # fails with `nose-1.3.7 not supported for interpreter python3.12`
     maintainers = nixops.meta.maintainers;
   };
 }
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-gce.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-gce.nix
deleted file mode 100644
index 8f179e6755b4..000000000000
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-gce.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, unstableGitUpdater
-, poetry-core
-, cryptography
-, libcloud
-, nixops
-, nixos-modules-contrib
-}:
-
-buildPythonPackage {
-  pname = "nixops-gce";
-  version = "0-unstable-2023-05-26";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "nix-community";
-    repo = "nixops-gce";
-    rev = "d13cb794aef763338f544010ceb1816fe31d7f42";
-    hash = "sha256-UkYf6CoUrr8yuQoe/ik6vu+UCi3ByJd0BdkS9SLEp0Q=";
-  };
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-    --replace poetry.masonry.api poetry.core.masonry.api \
-    --replace "poetry>=" "poetry-core>="
-  '';
-
-  nativeBuildInputs = [
-    poetry-core
-  ];
-
-  buildInputs = [
-    nixops
-  ];
-
-  propagatedBuildInputs = [
-    cryptography
-    libcloud
-    nixos-modules-contrib
-  ];
-
-  pythonImportsCheck = [ "nixops_gcp" ];
-
-  passthru.updateScript = unstableGitUpdater {};
-
-  meta = with lib; {
-    description = "NixOps Google Cloud Backend";
-    homepage = "https://github.com/nix-community/nixops-gce";
-    license = licenses.mit;
-    maintainers = nixops.meta.maintainers;
-    broken = true; # never built on Hydra
-  };
-}
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetzner.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetzner.nix
deleted file mode 100644
index 092a932a47cc..000000000000
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetzner.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, unstableGitUpdater
-, poetry-core
-, hetzner
-, nixops
-, nixos-modules-contrib
-, typing-extensions
-}:
-
-buildPythonPackage {
-  pname = "nixops-hetzner";
-  version = "1.0.1-unstable-2022-04-24";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "NixOS";
-    repo = "nixops-hetzner";
-    rev = "bc7a68070c7371468bcc8bf6e36baebc6bd2da35";
-    hash = "sha256-duK1Ui4VpbGSgGvfjTOddHSqHZ1FSy4L9Egg+FvZv04=";
-  };
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-    --replace poetry.masonry.api poetry.core.masonry.api \
-    --replace "poetry>=" "poetry-core>="
-  '';
-
-  nativeBuildInputs = [
-    poetry-core
-  ];
-
-  buildInputs = [
-    nixops
-  ];
-
-  propagatedBuildInputs = [
-    hetzner
-    nixos-modules-contrib
-    typing-extensions
-  ];
-
-  pythonImportsCheck = [ "nixops_hetzner" ];
-
-  passthru.updateScript = unstableGitUpdater {
-    tagPrefix = "v";
-  };
-
-  meta = with lib; {
-    description = "Hetzner bare metal NixOps plugin";
-    homepage = "https://github.com/NixOS/nixops-hetzner";
-    license = licenses.mit;
-    maintainers = nixops.meta.maintainers;
-    broken = true; # never built on Hydra
-  };
-}
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetznercloud.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetznercloud.nix
deleted file mode 100644
index 6e9a4b742e30..000000000000
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetznercloud.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, unstableGitUpdater
-, poetry-core
-, hcloud
-, nixops
-, typing-extensions
-}:
-
-buildPythonPackage {
-  pname = "nixops-hetznercloud";
-  version = "0-unstable-2023-02-19";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "lukebfox";
-    repo = "nixops-hetznercloud";
-    rev = "e14f340f7ffe9e2aa7ffbaac0b8a2e3b4cc116b3";
-    hash = "sha256-IsRJUUAfN6YXcue80qlcunkawUtgMiMU8mM6DP+7Cm4=";
-  };
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-    --replace poetry.masonry.api poetry.core.masonry.api \
-    --replace "poetry>=" "poetry-core>="
-  '';
-
-  nativeBuildInputs = [
-    poetry-core
-  ];
-
-  buildInputs = [
-    nixops
-  ];
-
-  propagatedBuildInputs = [
-    hcloud
-    typing-extensions
-  ];
-
-  pythonImportsCheck = [ "nixops_hetznercloud" ];
-
-  passthru.updateScript = unstableGitUpdater {};
-
-  meta = with lib; {
-    description = "NixOps plugin supporting Hetzner Cloud deployments";
-    homepage = "https://github.com/lukebfox/nixops-hetznercloud";
-    license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ lukebfox ];
-    broken = true; # never built on Hydra
-  };
-}
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-libvirtd.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-libvirtd.nix
deleted file mode 100644
index a315a7e2ae9b..000000000000
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-libvirtd.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, unstableGitUpdater
-, poetry-core
-, libvirt
-, nixops
-}:
-
-buildPythonPackage {
-  pname = "nixops-libvirtd";
-  version = "1.0.0-unstable-2023-09-01";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "nix-community";
-    repo = "nixops-libvirtd";
-    rev = "b59424bf53e74200d684a4bce1ae64d276e793a0";
-    hash = "sha256-HxJu8/hOPI5aCddTpna0mf+emESYN3ZxpTkitfKcfVQ=";
-  };
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-    --replace poetry.masonry.api poetry.core.masonry.api \
-    --replace "poetry>=" "poetry-core>="
-  '';
-
-  nativeBuildInputs = [
-    poetry-core
-  ];
-
-  buildInputs = [
-    nixops
-  ];
-
-  propagatedBuildInputs = [
-    libvirt
-  ];
-
-  pythonImportsCheck = [ "nixops_virtd" ];
-
-  passthru.updateScript = unstableGitUpdater {
-    tagPrefix = "v";
-  };
-
-  meta = with lib; {
-    description = "NixOps libvirtd backend plugin";
-    homepage = "https://github.com/nix-community/nixops-libvirtd";
-    license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ aminechikhaoui ];
-    broken = true; # never built on Hydra
-  };
-}
diff --git a/pkgs/applications/networking/cluster/tfautomv/default.nix b/pkgs/applications/networking/cluster/tfautomv/default.nix
index fc9dadbf37b6..efabad7ed89b 100644
--- a/pkgs/applications/networking/cluster/tfautomv/default.nix
+++ b/pkgs/applications/networking/cluster/tfautomv/default.nix
@@ -5,16 +5,19 @@
 
 buildGoModule rec {
   pname = "tfautomv";
-  version = "0.5.4";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "busser";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-irB0Kfd8eqIKq0ooJRxB0X4t2/1aFCNYRwaG6lAw3ic=";
+    hash = "sha256-qUeIbHJqxGkt2esMm4w6fM52ZE16jWnxugVXxqBh1Qc=";
   };
 
-  vendorHash = "sha256-Wc5hpiHL5I01IodcHX0IzeKfthkFS7SuUxmaxOU6WkA=";
+  # checks require unfree programs like terraform/terragrunt
+  doCheck = false;
+
+  vendorHash = "sha256-BZ8IhVPxZTPQXBotFBrxV3dfwvst0te8R84I/urq3gY=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/ndppd/default.nix b/pkgs/applications/networking/ndppd/default.nix
index e5ea298a8dc9..65b5ee1269ee 100644
--- a/pkgs/applications/networking/ndppd/default.nix
+++ b/pkgs/applications/networking/ndppd/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, gzip }:
+{ lib, stdenv, fetchFromGitHub, gzip, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "ndppd";
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
     cp ndppd.conf-dist $out/etc/ndppd.conf
   '';
 
+  passthru.tests = { inherit (nixosTests) ndppd; };
+
   meta = with lib; {
     description = "Daemon that proxies NDP (Neighbor Discovery Protocol) messages between interfaces";
     homepage = "https://github.com/DanielAdolfsson/ndppd";
diff --git a/pkgs/applications/networking/p2p/deluge/default.nix b/pkgs/applications/networking/p2p/deluge/default.nix
index 8c3d76d755f7..241f2a02e803 100644
--- a/pkgs/applications/networking/p2p/deluge/default.nix
+++ b/pkgs/applications/networking/p2p/deluge/default.nix
@@ -8,6 +8,7 @@
 , gobject-introspection
 , librsvg
 , wrapGAppsHook3
+, nixosTests
 }:
 
 let
@@ -87,6 +88,8 @@ let
         done
       '';
 
+      passthru.tests = { inherit (nixosTests) deluge; };
+
       meta = with lib; {
         description = "Torrent client";
         homepage = "https://deluge-torrent.org";
diff --git a/pkgs/applications/networking/remote/xrdp/default.nix b/pkgs/applications/networking/remote/xrdp/default.nix
index 6e2f10ee8e47..ff301d690941 100644
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@@ -21,6 +21,7 @@
 , libjpeg_turbo
 , _experimental-update-script-combinators
 , gitUpdater
+, nixosTests
 }:
 
 let
@@ -159,6 +160,9 @@ let
         { command = ["rm" "update-git-commits.txt"]; }
         (gitUpdater { rev-prefix = "v"; attrPath = "xrdp.xorgxrdp"; })
       ]);
+      tests = {
+        inherit (nixosTests) xrdp;
+      };
     };
 
     meta = with lib; {
diff --git a/pkgs/applications/office/roam-research/common.nix b/pkgs/applications/office/roam-research/common.nix
index 19e51e7b0eae..00cbbf009096 100644
--- a/pkgs/applications/office/roam-research/common.nix
+++ b/pkgs/applications/office/roam-research/common.nix
@@ -1,22 +1,22 @@
 { fetchurl }:
 let
   pname = "roam-research";
-  version = "0.0.19";
+  version = "0.0.22";
 in
 {
   inherit pname version;
   sources = {
     x86_64-darwin = fetchurl {
       url = "https://roam-electron-deploy.s3.us-east-2.amazonaws.com/Roam+Research-${version}.dmg";
-      hash = "sha256-pIH4p7dnmyOgGyruSJ39xB8iJ45wtxcIQmfUeBLlDes=";
+      hash = "sha256-GA9m4z+3Dy87Dz/YPG5MYbREQ1cEAdX/MJvkAJ/fe34=";
     };
     aarch64-darwin = fetchurl {
       url = "https://roam-electron-deploy.s3.us-east-2.amazonaws.com/Roam+Research-${version}-arm64.dmg";
-      hash = "sha256-iQRaaSU033t3WVWZSKuXCPJbMoNpwLnDHBz5QURu6Gw=";
+      hash = "sha256-+lgV5TpTzN7mJvvVEpBbmq+aBOBKy1CpYkMNhfoxhK0=";
     };
     x86_64-linux = fetchurl {
       url = "https://roam-electron-deploy.s3.us-east-2.amazonaws.com/${pname}_${version}_amd64.deb";
-      hash = "sha256-eDN+hrAc+ePRELcXAs5WypzPlJ+Wtg3kUarf8rq5CnA=";
+      hash = "sha256-HVGytdP5fkQQABeL9y869GZioutvnBHrwPprAjfBbFg=";
     };
   };
 }
diff --git a/pkgs/applications/office/roam-research/darwin.nix b/pkgs/applications/office/roam-research/darwin.nix
index 372186f551f1..721e9e8fc7e9 100644
--- a/pkgs/applications/office/roam-research/darwin.nix
+++ b/pkgs/applications/office/roam-research/darwin.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, undmg, fetchurl }:
+{ lib, stdenv, _7zz, fetchurl }:
 let
   common = import ./common.nix { inherit fetchurl; };
   inherit (stdenv.hostPlatform) system;
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   sourceRoot = ".";
 
-  nativeBuildInputs = [ undmg ];
+  nativeBuildInputs = [ _7zz ];
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/version-management/cgit/common.nix b/pkgs/applications/version-management/cgit/common.nix
index b0ed32eb0222..d5dab65bd4a9 100644
--- a/pkgs/applications/version-management/cgit/common.nix
+++ b/pkgs/applications/version-management/cgit/common.nix
@@ -1,5 +1,6 @@
 { pname, version, src, gitSrc, buildInputs ? []
 , homepage, description, maintainers
+, passthru ? {}
 }:
 
 { lib, stdenv, openssl, zlib, asciidoc, libxml2, libxslt
@@ -10,7 +11,7 @@
 }:
 
 stdenv.mkDerivation {
-  inherit pname version src gitSrc;
+  inherit pname version src gitSrc passthru;
 
   separateDebugInfo = true;
 
diff --git a/pkgs/applications/version-management/cgit/default.nix b/pkgs/applications/version-management/cgit/default.nix
index f6a0af102303..0fe86683d5fa 100644
--- a/pkgs/applications/version-management/cgit/default.nix
+++ b/pkgs/applications/version-management/cgit/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, callPackage, luajit }:
+{ lib, fetchurl, callPackage, luajit, nixosTests }:
 
 callPackage (import ./common.nix rec {
   pname = "cgit";
@@ -19,6 +19,8 @@ callPackage (import ./common.nix rec {
 
   buildInputs = [ luajit ];
 
+  passthru.tests = { inherit (nixosTests) cgit; };
+
   homepage = "https://git.zx2c4.com/cgit/about/";
   description = "Web frontend for git repositories";
   maintainers = with lib.maintainers; [ bjornfor ];
diff --git a/pkgs/applications/version-management/delta/default.nix b/pkgs/applications/version-management/delta/default.nix
index 1547632119fd..994af1db8d35 100644
--- a/pkgs/applications/version-management/delta/default.nix
+++ b/pkgs/applications/version-management/delta/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "delta";
-  version = "0.17.0-unstable-2024-08-12";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "dandavison";
-    repo = pname;
-    rev = "a01141b72001f4c630d77cf5274267d7638851e4";
-    hash = "sha256-My51pQw5a2Y2VTu39MmnjGfmCavg8pFqOmOntUildS0=";
+    repo = "delta";
+    rev = "refs/tags/${version}";
+    hash = "sha256-1UOVRAceZ4QlwrHWqN7YI2bMyuhwLnxJWpfyaHNNLYg=";
   };
 
-  cargoHash = "sha256-Rlc3Bc6Jh89KLLEWBWQB5GjoeIuHnwIVZN/MVFMjY24=";
+  cargoHash = "sha256-/h7djtaTm799gjNrC6vKulwwuvrTHjlsEXbK2lDH+rc=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/applications/version-management/glab/default.nix b/pkgs/applications/version-management/glab/default.nix
index 9f3e08464dd3..31af00105113 100644
--- a/pkgs/applications/version-management/glab/default.nix
+++ b/pkgs/applications/version-management/glab/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "glab";
-  version = "1.41.0";
+  version = "1.45.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-DvIp7eMBWKWQ5VW9MW391xnUz8o1KNz1mkJtu7YVILo=";
+    hash = "sha256-jTpddpS+FYSQg2aRxQiVlG+bitiIqmZ4kxOJLPZkICo=";
   };
 
-  vendorHash = "sha256-WM19Kx2b31e4/iA92U9FUuF8R1DMvbKotE2D9HpLQpQ=";
+  vendorHash = "sha256-o0sYObTeDgG+3X3YEnDbk1h4DkEiMwEgYMF7hGjCL3Q=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/version-management/legit-web/default.nix b/pkgs/applications/version-management/legit-web/default.nix
index af340bd22eaf..ae76752f70c3 100644
--- a/pkgs/applications/version-management/legit-web/default.nix
+++ b/pkgs/applications/version-management/legit-web/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -24,6 +25,8 @@ buildGoModule rec {
     cp -r $src/static/* $out/lib/legit/static
   '';
 
+  passthru.tests = { inherit (nixosTests) legit; };
+
   meta = {
     description = "Web frontend for git";
     homepage = "https://github.com/icyphox/legit";
diff --git a/pkgs/applications/version-management/rabbitvcs/default.nix b/pkgs/applications/version-management/rabbitvcs/default.nix
deleted file mode 100644
index 7cc0a92d4c94..000000000000
--- a/pkgs/applications/version-management/rabbitvcs/default.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ fetchFromGitHub, lib, python3Packages, meld, subversion, gvfs, xdg-utils, gtk3 }:
-
-python3Packages.buildPythonApplication rec {
-  pname = "rabbitvcs";
-  version = "0.18";
-  namePrefix = "";
-
-  src = fetchFromGitHub {
-    owner = "rabbitvcs";
-    repo = "rabbitvcs";
-    rev = "v${version}";
-    hash = "sha256-gVrdf8vQWAGORZqlTS/axs4U7aZlS8OAgPM3iKgqAtM=";
-  };
-
-  buildInputs = [ gtk3 ];
-  pythonPath = with python3Packages; [ configobj pygobject3 pysvn dulwich tkinter gvfs xdg-utils ];
-
-  prePatch = ''
-      sed -ie 's|if sys\.argv\[1\] == "install":|if False:|' ./setup.py
-      sed -ie "s|PREFIX = sys.prefix|PREFIX = \"$out\"|" ./setup.py
-      sed -ie 's|/usr/bin/meld|${meld}/bin/meld|' ./rabbitvcs/util/configspec/configspec.ini
-      sed -ie 's|/usr/bin/svnadmin|${subversion.out}/bin/svnadmin|' ./rabbitvcs/ui/create.py
-      sed -ie "s|/usr/share/doc|$out/share/doc|" ./rabbitvcs/ui/about.py
-      sed -ie "s|gnome-open|xdg-open|" ./rabbitvcs/util/helper.py
-    '';
-
-  outputs = [ "out" "cli" ];
-
-  postInstall = ''
-    mkdir -p $cli/bin
-    cp clients/cli/rabbitvcs $cli/bin
-    wrapPythonProgramsIn $cli "$out $pythonPath"
-  '';
-
-  doCheck = false;
-
-  meta = {
-    description = "Graphical tools for working with version control systems";
-    homepage = "http://rabbitvcs.org/";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.mathnerd314 ];
-    # ModuleNotFoundError: No module named 'rabbitvcs'
-    broken = true; # Added 2024-01-28
-  };
-}
diff --git a/pkgs/applications/video/ustreamer/default.nix b/pkgs/applications/video/ustreamer/default.nix
index b612584d8b0f..512e6e8515c8 100644
--- a/pkgs/applications/video/ustreamer/default.nix
+++ b/pkgs/applications/video/ustreamer/default.nix
@@ -12,6 +12,7 @@
 , speex
 , jansson
 , libopus
+, nixosTests
 , withJanus ? true
 }:
 stdenv.mkDerivation rec {
@@ -53,6 +54,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.tests = { inherit (nixosTests) ustreamer; };
+
   meta = with lib; {
     homepage = "https://github.com/pikvm/ustreamer";
     description = "Lightweight and fast MJPG-HTTP streamer";
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 20c390d58dc9..264a8ae288ec 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.29.1";
+  version = "2.29.2";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    hash = "sha256-6GZtKfPBE9Wl6ccwU1OY+9rq+IZr2qpOB4Vlxidhisw=";
+    hash = "sha256-UR2O8xBfoFew9G7RjyfXpdA0BcilKBp9Maj3Z+T7Kbw=";
   };
 
   postPatch = ''
@@ -16,7 +16,7 @@ buildGoModule rec {
     rm -rf e2e/
   '';
 
-  vendorHash = "sha256-CkXCAqHOlSc3jHqVUYovT8YDnlCZewpLv3sC0ADgwL0=";
+  vendorHash = "sha256-5pBpTXayAo/YbZsYwBuEU8CSTQGzKoyQ5QLzh2McCt8=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix b/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
index 17bf63a72753..8553f292dcec 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
@@ -22,24 +22,25 @@
 , util-linux
 , wayland
 , wayland-protocols
-, wayland-scanner
+, hyprwayland-scanner
+, hyprutils
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprpaper";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprpaper";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-l13c8ALA7ZKDgluYA1C1OfkDGYD6e1/GR6LJnxCLRhA=";
+    hash = "sha256-HIK7XJWQCM0BAnwW5uC7P0e7DAkVTy5jlxQ0NwoSy4M=";
   };
 
   nativeBuildInputs = [
     cmake
     pkg-config
-    wayland-scanner
+    hyprwayland-scanner
   ];
 
   buildInputs = [
@@ -62,6 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     util-linux
     wayland
     wayland-protocols
+    hyprutils
   ];
 
   prePatch = ''
diff --git a/pkgs/applications/window-managers/i3/default.nix b/pkgs/applications/window-managers/i3/default.nix
index 6438eee19525..9b66a3279f8d 100644
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@@ -3,6 +3,7 @@
 , yajl, xcb-util-cursor, perl, pango, perlPackages, libxkbcommon
 , xorgserver, xvfb-run, xdotool, xorg, which
 , asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, findXMLCatalogs
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
@@ -78,6 +79,9 @@ stdenv.mkDerivation rec {
 
   separateDebugInfo = true;
 
+  passthru.tests = { inherit (nixosTests) i3wm; };
+
+
   meta = with lib; {
     description = "Tiling window manager";
     homepage    = "https://i3wm.org";
diff --git a/pkgs/applications/window-managers/tinywl/default.nix b/pkgs/applications/window-managers/tinywl/default.nix
index d39373e78192..06d2d8d72f8a 100644
--- a/pkgs/applications/window-managers/tinywl/default.nix
+++ b/pkgs/applications/window-managers/tinywl/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, wlroots, pkg-config, wayland-scanner
 , libxkbcommon, pixman, udev, wayland, wayland-protocols
+, nixosTests
 }:
 
 stdenv.mkDerivation {
@@ -18,6 +19,8 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  passthru.tests = { inherit (nixosTests) tinywl; };
+
   meta = {
     homepage = "https://gitlab.freedesktop.org/wlroots/wlroots/tree/master/tinywl";
     description = ''A "minimum viable product" Wayland compositor based on wlroots'';
diff --git a/pkgs/applications/window-managers/yabar/build.nix b/pkgs/applications/window-managers/yabar/build.nix
index edeeaf5fbf65..25ab000594aa 100644
--- a/pkgs/applications/window-managers/yabar/build.nix
+++ b/pkgs/applications/window-managers/yabar/build.nix
@@ -62,6 +62,8 @@ stdenv.mkDerivation {
     }
   '';
 
+  #passthru.tests = { inherit (nixosTests) yabar; }; # nixos currently uses yabar-unstable
+
   meta = with lib; {
     description = "Modern and lightweight status bar for X window managers";
     homepage    = "https://github.com/geommer/yabar";
diff --git a/pkgs/applications/window-managers/yabar/unstable.nix b/pkgs/applications/window-managers/yabar/unstable.nix
index 47c8f6c5e568..cb43c4e0b95e 100644
--- a/pkgs/applications/window-managers/yabar/unstable.nix
+++ b/pkgs/applications/window-managers/yabar/unstable.nix
@@ -1,4 +1,4 @@
-{ fetchpatch, playerctl, libxkbcommon, callPackage, attrs ? {} }:
+{ fetchpatch, playerctl, libxkbcommon, callPackage, nixosTests, attrs ? {} }:
 
 let
   pkg = callPackage ./build.nix ({
@@ -22,4 +22,11 @@ in pkg.overrideAttrs (o: {
       sha256 = "1q7nd66ai6nr2m6iqxn55gvbr4r5gjc00c8wyjc3riv31qcbqbhv";
     })
   ];
+
+  passthru = (o.passthru or {}) // {
+    tests = (o.passthru.tests or {}) // {
+      inherit (nixosTests) yabar;
+    };
+  };
+
 })
diff --git a/pkgs/build-support/testers/default.nix b/pkgs/build-support/testers/default.nix
index d0d88115003f..ba605adeb9a0 100644
--- a/pkgs/build-support/testers/default.nix
+++ b/pkgs/build-support/testers/default.nix
@@ -1,4 +1,18 @@
-{ pkgs, pkgsLinux, buildPackages, diffoscopeMinimal, lib, callPackage, runCommand, stdenv, substituteAll, testers }:
+{
+  lib,
+  buildPackages,
+  callPackage,
+  pkgs,
+  pkgsLinux,
+
+  diffoscopeMinimal,
+  runCommand,
+  runCommandWith,
+  stdenv,
+  stdenvNoCC,
+  substituteAll,
+  testers,
+}:
 # Documentation is in doc/build-helpers/testers.chapter.md
 {
   # See https://nixos.org/manual/nixpkgs/unstable/#tester-lycheeLinkCheck
@@ -53,7 +67,7 @@
       command ? "${package.meta.mainProgram or package.pname or package.name} --version",
       version ? package.version,
     }: runCommand "${package.name}-test-version" { nativeBuildInputs = [ package ]; meta.timeout = 60; } ''
-      if output=$(${command} 2>&1); then
+      if output=$(${command} 2>&1 | sed -e 's|${builtins.storeDir}/[^/ ]*/|{{storeDir}}/|g'); then
         if grep -Fw -- "${version}" - <<< "$output"; then
           touch $out
         else
@@ -87,6 +101,31 @@
         else salted;
     in checked;
 
+  # See https://nixos.org/manual/nixpkgs/unstable/#tester-runCommand
+  runCommand = testers.invalidateFetcherByDrvHash (
+    {
+      hash ? pkgs.emptyFile.outputHash,
+      name,
+      script,
+      stdenv ? stdenvNoCC,
+      ...
+    }@args:
+
+    runCommandWith {
+      inherit name stdenv;
+
+      derivationArgs = {
+        outputHash = hash;
+        outputHashMode = "recursive";
+      } // lib.removeAttrs args [
+        "hash"
+        "name"
+        "script"
+        "stdenv"
+      ];
+    } script
+  );
+
   # See https://nixos.org/manual/nixpkgs/unstable/#tester-runNixOSTest
   # or doc/build-helpers/testers.chapter.md
   runNixOSTest =
diff --git a/pkgs/build-support/testers/test/default.nix b/pkgs/build-support/testers/test/default.nix
index 48855df91627..cc46e3cf4b71 100644
--- a/pkgs/build-support/testers/test/default.nix
+++ b/pkgs/build-support/testers/test/default.nix
@@ -18,6 +18,29 @@ lib.recurseIntoAttrs {
 
   shellcheck = pkgs.callPackage ../shellcheck/tests.nix { };
 
+  runCommand = lib.recurseIntoAttrs {
+    bork = pkgs.python3Packages.bork.tests.pytest-network;
+
+    dns-resolution = testers.runCommand {
+      name = "runCommand-dns-resolution-test";
+      nativeBuildInputs = [ pkgs.ldns ];
+      script = ''
+        drill example.com
+        touch $out
+      '';
+    };
+
+    nonDefault-hash = testers.runCommand {
+      name = "runCommand-nonDefaultHash-test";
+      script = ''
+        mkdir $out
+        touch $out/empty
+        echo aaaaaaaaaaicjnrkeflncmrlk > $out/keymash
+      '';
+      hash = "sha256-eMy+6bkG+KS75u7Zt4PM3APhtdVd60NxmBRN5GKJrHs=";
+    };
+  };
+
   runNixOSTest-example = pkgs-with-overlay.testers.runNixOSTest ({ lib, ... }: {
     name = "runNixOSTest-test";
     nodes.machine = { pkgs, ... }: {
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index fc6f07fdd11b..686819725d59 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -887,9 +887,8 @@ rec {
   /* An immutable file in the store with a length of 0 bytes. */
   emptyFile = runCommand "empty-file"
     {
-      outputHashAlgo = "sha256";
+      outputHash = "sha256-d6xi4mKdjkX2JFicDIv5niSzpyI0m/Hnm8GGAIU04kY=";
       outputHashMode = "recursive";
-      outputHash = "0ip26j2h11n1kgkz36rl4akv694yz65hr72q4kv4b3lxcbi65b3p";
       preferLocalBuild = true;
     } "touch $out";
 
diff --git a/pkgs/by-name/_2/_2ship2harkinian/package.nix b/pkgs/by-name/_2/_2ship2harkinian/package.nix
index 583e2864a112..2af660495cdd 100644
--- a/pkgs/by-name/_2/_2ship2harkinian/package.nix
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -77,7 +77,7 @@ let
       rev = "v${version}";
       hash = "sha256-HTi2FKzKCbRaP13XERUmHkJgw8IfKaRJvsK3+YxFFdc=";
     };
-    buildInputs = prev.buildInputs ++ [ pkg-config ];
+    nativeBuildInputs = prev.nativeBuildInputs ++ [ pkg-config ];
     patches = (prev.patches or [ ]) ++ [
       (fetchpatch {
         name = "stormlib-optimizations.patch";
diff --git a/pkgs/by-name/ap/api-linter/package.nix b/pkgs/by-name/ap/api-linter/package.nix
index 94214ae85545..9a01c0548e60 100644
--- a/pkgs/by-name/ap/api-linter/package.nix
+++ b/pkgs/by-name/ap/api-linter/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "1.67.1";
+  version = "1.67.2";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     rev = "v${version}";
-    hash = "sha256-nbLaLi3Uh/zU+SPHA2x8cMic/bOKBo9wybK3b1LHNpY=";
+    hash = "sha256-xwRpJKAkZFSpmAQti2EswM6RXlJVwD+nNY9t5oRzU1s=";
   };
 
   vendorHash = "sha256-+dyoWK5iXH480c+akg26BCF/J8lKQoATVqZUfqMa080=";
diff --git a/pkgs/by-name/ar/ardugotools/package.nix b/pkgs/by-name/ar/ardugotools/package.nix
index 833984c9408d..16191343ab64 100644
--- a/pkgs/by-name/ar/ardugotools/package.nix
+++ b/pkgs/by-name/ar/ardugotools/package.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  version = "0.6.0";
+  version = "0.6.1";
 in
 buildGoModule {
   pname = "ardugotools";
@@ -14,12 +14,23 @@ buildGoModule {
   src = fetchFromGitHub {
     owner = "randomouscrap98";
     repo = "ardugotools";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-lYpUb+AiQrcrBGBvnOwzDC4aX1F8o21DUnad56qb7zo=";
+    rev = "v${version}";
+    hash = "sha256-SqeUcYa8XscwaJaCSIoZ9lEtRJ0hN01XJDyCJFX2dTc=";
   };
 
   vendorHash = "sha256-Z9ObsS+GwVsz6ZlXCgN0WlShHzbmx4WLa/1/XLSSAAs=";
 
+  checkFlags =
+    let
+      # Skip tests referencing a non-existing file
+      skippedTests = [
+        "TestRunLuaFlashcartGenerator_CategoriesOnly"
+        "TestRunLuaFlashcartGenerator_FullCart"
+        "TestRunLuaFlashcartGenerator_MakeCart"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
   meta = {
     description = "CLI toolset for Arduboy";
     changelog = "https://github.com/randomouscrap98/ardugotools/releases/tag/v${version}";
diff --git a/pkgs/by-name/ar/argc/package.nix b/pkgs/by-name/ar/argc/package.nix
index 3fceb4af1e46..df9b4f6780e1 100644
--- a/pkgs/by-name/ar/argc/package.nix
+++ b/pkgs/by-name/ar/argc/package.nix
@@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "argc";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchFromGitHub {
     owner = "sigoden";
     repo = "argc";
     rev = "v${version}";
-    hash = "sha256-Oh2vV4Dr4suVEGrwGNyzVlKrOh+lXwdEwDPNzFzqmOo=";
+    hash = "sha256-pOkZmk7boFPqHHBDet/on6Y8V2Ik+hpqN0cUtY0BiR0=";
   };
 
-  cargoHash = "sha256-3zVO0ZAL+npijGg6/Idb7MD80WW5vi1qxbZqCwwhmIU=";
+  cargoHash = "sha256-FxhDnTy/KAeN0Zd5I12EUgXRc0VhHN0lRm5DQyCinyw=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional (!canExecuteHost) buildPackages.argc;
 
diff --git a/pkgs/by-name/ar/arma3-unix-launcher/disable_steam_integration.patch b/pkgs/by-name/ar/arma3-unix-launcher/disable_steam_integration.patch
new file mode 100644
index 000000000000..556c384d5e2f
--- /dev/null
+++ b/pkgs/by-name/ar/arma3-unix-launcher/disable_steam_integration.patch
@@ -0,0 +1,25 @@
+diff --git a/src/arma3-unix-launcher/mainwindow.cpp b/src/arma3-unix-launcher/mainwindow.cpp
+index 66b73cc..f89f66b 100644
+--- a/src/arma3-unix-launcher/mainwindow.cpp
++++ b/src/arma3-unix-launcher/mainwindow.cpp
+@@ -56,6 +56,3 @@ MainWindow::MainWindow(std::unique_ptr<ARMA3::Client> arma3_client, std::filesys
+ {
+-    if (use_steam_integration)
+-        steam_integration = std::make_unique<Steam::SteamIntegration>(ARMA3::Definitions::app_id);
+-    else
+-        steam_integration = std::make_unique<Steam::IntegrationStub>(ARMA3::Definitions::app_id);
++    steam_integration = std::make_unique<Steam::IntegrationStub>(ARMA3::Definitions::app_id);
+ 
+diff --git a/src/dayz-linux-launcher/mainwindow.cpp b/src/dayz-linux-launcher/mainwindow.cpp
+index d9223db..5773593 100644
+--- a/src/dayz-linux-launcher/mainwindow.cpp
++++ b/src/dayz-linux-launcher/mainwindow.cpp
+@@ -56,6 +56,3 @@ MainWindow::MainWindow(std::unique_ptr<DayZ::Client> arma3_client, std::filesyst
+ {
+-    if (use_steam_integration)
+-        steam_integration = std::make_unique<Steam::SteamIntegration>(DayZ::Definitions::app_id);
+-    else
+-        steam_integration = std::make_unique<Steam::IntegrationStub>(DayZ::Definitions::app_id);
++    steam_integration = std::make_unique<Steam::IntegrationStub>(DayZ::Definitions::app_id);
+ 
+
diff --git a/pkgs/by-name/ar/arma3-unix-launcher/dont_fetch_dependencies.patch b/pkgs/by-name/ar/arma3-unix-launcher/dont_fetch_dependencies.patch
new file mode 100644
index 000000000000..947a790c38df
--- /dev/null
+++ b/pkgs/by-name/ar/arma3-unix-launcher/dont_fetch_dependencies.patch
@@ -0,0 +1,115 @@
+diff --git a/cmake/external_dependencies.cmake b/cmake/external_dependencies.cmake
+index 2eb6ec5..9f1d67e 100644
+--- a/cmake/external_dependencies.cmake
++++ b/cmake/external_dependencies.cmake
+@@ -4,7 +4,7 @@ include(FetchContent)
+ 
+ function(setup_library SOURCE_TO_TEST)
+     set(boolArgs HEADER_ONLY)
+-    set(oneValueArgs NAME CXX_FLAGS GIT_REPOSITORY GIT_TAG TEST_DEFINITIONS TEST_LINK_LIBS)
++    set(oneValueArgs NAME CXX_FLAGS URL GIT_TAG TEST_DEFINITIONS TEST_LINK_LIBS)
+     set(multiValueArgs WHEN)
+     cmake_parse_arguments(LIB_SETUP "${boolArgs}" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
+ 
+@@ -27,12 +27,11 @@ function(setup_library SOURCE_TO_TEST)
+     endif()
+ 
+     FetchContent_Declare(${LIB_SETUP_NAME}
+-                         GIT_REPOSITORY ${LIB_SETUP_GIT_REPOSITORY}
+-                         GIT_TAG ${LIB_SETUP_GIT_TAG})
++        URL ${LIB_SETUP_URL})
+     FetchContent_GetProperties(${LIB_SETUP_NAME})
+     set(POPULATED "${LIB_SETUP_NAME}_POPULATED")
+     if (NOT "${POPULATED}")
+-        message("-- Downloading ${LIB_SETUP_NAME} from ${LIB_SETUP_GIT_REPOSITORY}")
++        message("-- Downloading ${LIB_SETUP_NAME} from ${LIB_SETUP_URL}")
+         FetchContent_Populate(${LIB_SETUP_NAME})
+         set(SRCDIR "${LIB_SETUP_NAME}_SOURCE_DIR")
+         set(BINDIR "${LIB_SETUP_NAME}_BINARY_DIR")
+@@ -51,8 +50,7 @@ function(setup_argparse)
+             }")
+     setup_library("${CHECK_SOURCE}"
+                   NAME argparse
+-                  GIT_REPOSITORY https://github.com/p-ranav/argparse.git
+-                  GIT_TAG 45664c4
++                  URL @argparse_src@
+                   HEADER_ONLY
+                   )
+     if (NOT TARGET argparse::argparse)
+@@ -64,7 +62,7 @@ function(setup_curlpp)
+     set(CHECK_SOURCE "#error unimplemented}")
+     setup_library("${CHECK_SOURCE}"
+                   NAME curlpp
+-                  GIT_REPOSITORY https://github.com/jpbarrette/curlpp.git
++                  URL @curlpp_src@
+                   )
+     if (NOT APPLE)
+         set(CURLPP_LIB_PATH1 "${curlpp_BINARY_DIR}/libcurlpp.so" PARENT_SCOPE)
+@@ -79,7 +77,7 @@ function(setup_doctest)
+                       #include <doctest/doctest.h>")
+     setup_library("${CHECK_SOURCE}"
+                   NAME doctest
+-                  GIT_REPOSITORY https://github.com/onqtam/doctest.git
++                  URL @doctest_src@
+                   HEADER_ONLY
+                   )
+     add_library(doctest::doctest ALIAS doctest)
+@@ -100,8 +98,7 @@ function(setup_fmt)
+         }")
+     setup_library("${CHECK_SOURCE}"
+                   NAME fmt
+-                  GIT_REPOSITORY https://github.com/fmtlib/fmt.git
+-                  GIT_TAG 8.1.1
++                  URL @fmt_src@
+                   TEST_LINK_LIBS fmt
+                   )
+ 
+@@ -126,7 +123,7 @@ function(setup_nlohmann_json)
+         add_library(nlohmann_json INTERFACE)
+     else()
+         FetchContent_Declare(nlohmann_json
+-                             URL https://github.com/nlohmann/json/releases/download/v3.7.3/include.zip)
++                             URL @nlohmann_json_src@)
+         FetchContent_GetProperties(nlohmann_json)
+         if (NOT nlohmann_json_POPULATED)
+             FetchContent_Populate(nlohmann_json)
+@@ -146,8 +143,7 @@ function(setup_pugixml)
+         }")
+     setup_library("${CHECK_SOURCE}"
+                   NAME pugixml
+-                  GIT_REPOSITORY https://github.com/muttleyxd/pugixml.git
+-                  GIT_TAG simple-build-for-a3ul
++                  URL @pugixml_src@
+                   TEST_LINK_LIBS pugixml
+                   )
+     get_target_property(TARGET_TYPE pugixml TYPE)
+@@ -188,8 +184,7 @@ function(setup_spdlog)
+ 
+     setup_library("${CHECK_SOURCE}"
+                   NAME spdlog
+-                  GIT_REPOSITORY https://github.com/gabime/spdlog.git
+-                  GIT_TAG v1.x
++                  URL @spdlog_src@
+                   TEST_DEFINITIONS -DSPDLOG_FMT_EXTERNAL
+                   TEST_LINK_LIBS ${FMT_TARGET_NAME}
+                   CXX_FLAGS "-Wno-attributes -Wno-reorder -Wno-redundant-move"
+@@ -198,8 +193,7 @@ endfunction()
+ 
+ function(setup_steamworkssdk)
+     FetchContent_Declare(steamworkssdk
+-        URL https://github.com/julianxhokaxhiu/SteamworksSDKCI/releases/download/1.53/SteamworksSDK-v1.53.0_x64.zip
+-        URL_HASH MD5=322c2c90c3ab76201c92f4a2c443f664
++        URL @steamworkssdk_src@
+         CONFIGURE_COMMAND ""
+         BUILD_COMMAND ""
+         )
+@@ -241,8 +235,7 @@ function(setup_trompeloeil)
+                       int main() { }")
+     setup_library("${CHECK_SOURCE}"
+                   NAME trompeloeil
+-                  GIT_REPOSITORY https://github.com/rollbear/trompeloeil.git
+-                  GIT_TAG 64fd171
++                  URL @trompeloeil_src@
+                   HEADER_ONLY
+                   )
+     add_library(trompeloeil::trompeloeil ALIAS trompeloeil)
diff --git a/pkgs/by-name/ar/arma3-unix-launcher/package.nix b/pkgs/by-name/ar/arma3-unix-launcher/package.nix
new file mode 100644
index 000000000000..49c4e98ceb05
--- /dev/null
+++ b/pkgs/by-name/ar/arma3-unix-launcher/package.nix
@@ -0,0 +1,88 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  curl,
+  curlpp,
+  doctest,
+  fetchFromGitHub,
+  fetchurl,
+  fmt,
+  nlohmann_json,
+  qt5,
+  spdlog,
+  substituteAll,
+  trompeloeil,
+  buildDayZLauncher ? false,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "arma3-unix-launcher";
+  version = "413";
+
+  src = fetchFromGitHub {
+    owner = "muttleyxd";
+    repo = "arma3-unix-launcher";
+    rev = "2ea62d961522f1542d4c8e669ef5fe856916f9ec";
+    hash = "sha256-uym93mYmVj9UxT8RbwdRUyIPrQX7nZTNWUUVjxCQmVU=";
+  };
+
+  patches = [
+    # prevent CMake from trying to get libraries on the internet
+    (substituteAll {
+      src = ./dont_fetch_dependencies.patch;
+      argparse_src = fetchFromGitHub {
+        owner = "p-ranav";
+        repo = "argparse";
+        rev = "45664c4e9f05ff287731a9ff8b724d0c89fb6e77";
+        sha256 = "sha256-qLD9zD6hbItDn6ZHHWBXrAWhySvqcs40xA5+C/5Fkhw=";
+      };
+      curlpp_src = curlpp.src;
+      doctest_src = doctest;
+      fmt_src = fmt;
+      nlohmann_json_src = nlohmann_json;
+      pugixml_src = fetchFromGitHub {
+        owner = "muttleyxd";
+        repo = "pugixml";
+        rev = "simple-build-for-a3ul";
+        sha256 = "sha256-FpREdz6DbhnLDGOuQY9rU17SSd6ngA4WfO0kGHqGJPM=";
+      };
+      spdlog_src = spdlog;
+      steamworkssdk_src = fetchurl {
+        url = "https://github.com/julianxhokaxhiu/SteamworksSDKCI/releases/download/1.53/SteamworksSDK-v1.53.0_x64.zip";
+        sha256 = "sha256-6PQGaPsaxBg/MHVWw2ynYW6LaNSrE9Rd9Q9ZLKFGPFA=";
+      };
+      trompeloeil_src = trompeloeil;
+    })
+    # game won't launch with steam integration anyways, disable it
+    ./disable_steam_integration.patch
+  ];
+
+  nativeBuildInputs = [
+    qt5.wrapQtAppsHook
+    cmake
+  ];
+
+  buildInputs = [
+    spdlog
+    curlpp.src
+    curl
+    qt5.qtbase
+    qt5.qtsvg
+  ];
+
+  cmakeFlags = [ "-Wno-dev" ] ++ lib.optionals buildDayZLauncher [ "-DBUILD_DAYZ_LAUNCHER=ON" ];
+
+  meta = {
+    homepage = "https://github.com/muttleyxd/arma3-unix-launcher/";
+    description = "Clean, intuitive Arma 3 + DayZ SA Launcher";
+    license = with lib.licenses; [
+      # Launcher
+      mit
+      # Steamworks SDK
+      unfree
+    ];
+    maintainers = with lib.maintainers; [ DrymarchonShaun ];
+    mainProgram = "arma3-unix-launcher";
+    platforms = with lib.platforms; linux ++ darwin;
+  };
+})
diff --git a/pkgs/by-name/ar/artalk/package.nix b/pkgs/by-name/ar/artalk/package.nix
index ff2e0be2abdc..a9918059d6ad 100644
--- a/pkgs/by-name/ar/artalk/package.nix
+++ b/pkgs/by-name/ar/artalk/package.nix
@@ -7,6 +7,7 @@
   installShellFiles,
   stdenv,
   testers,
+  nixosTests,
 }:
 buildGoModule rec {
   pname = "artalk";
@@ -56,6 +57,7 @@ buildGoModule rec {
 
   passthru.tests = {
     version = testers.testVersion { package = artalk; };
+    inherit (nixosTests) artalk;
   };
 
   meta = {
diff --git a/pkgs/by-name/ba/baresip/package.nix b/pkgs/by-name/ba/baresip/package.nix
index 866958347f19..c93590ea1678 100644
--- a/pkgs/by-name/ba/baresip/package.nix
+++ b/pkgs/by-name/ba/baresip/package.nix
@@ -1,30 +1,33 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, zlib
-, openssl
-, libre
-, librem
-, pkg-config
-, gst_all_1
-, cairo
-, gtk3
-, mpg123
-, alsa-lib
-, SDL2
-, libv4l
-, celt
-, libsndfile
-, srtp
-, ffmpeg
-, gsm
-, speex
-, portaudio
-, spandsp3
-, libuuid
-, libvpx
-, cmake
-, dbusSupport ? true
+{
+  SDL2,
+  alsa-lib,
+  cairo,
+  celt,
+  cmake,
+  fetchFromGitHub,
+  ffmpeg,
+  glib,
+  gsm,
+  gst_all_1,
+  gtk3,
+  lib,
+  libre,
+  librem,
+  libsndfile,
+  libuuid,
+  libv4l,
+  libvpx,
+  mpg123,
+  openssl,
+  pipewire,
+  pkg-config,
+  portaudio,
+  spandsp3,
+  speex,
+  srtp,
+  stdenv,
+  zlib,
+  dbusSupport ? true,
 }:
 stdenv.mkDerivation rec {
   version = "3.10.1";
@@ -35,83 +38,47 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     hash = "sha256-0huZP1hopHaN5R1Hki6YutpvoASfIHzHMl/Y4czHHMo=";
   };
-  prePatch = lib.optionalString (!dbusSupport) ''
+  prePatch = ''
+    substituteInPlace cmake/FindGTK3.cmake --replace GTK3_CFLAGS_OTHER ""
+  '' + lib.optionalString (!dbusSupport) ''
     substituteInPlace cmake/modules.cmake --replace 'list(APPEND MODULES ctrl_dbus)' ""
   '';
-  nativeBuildInputs = [ pkg-config cmake ];
+  nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
-    zlib
-    openssl
-    libre
-    librem
-    cairo
-    gtk3
-    mpg123
-    alsa-lib
     SDL2
-    libv4l
+    alsa-lib
+    cairo
     celt
-    libsndfile
-    srtp
     ffmpeg
     gsm
-    speex
+    gtk3
+    libre
+    librem
+    libsndfile
+    libuuid
+    libv4l
+    libvpx
+    mpg123
+    openssl
+    pipewire
     portaudio
     spandsp3
-    libuuid
-    libvpx
+    speex
+    srtp
+    zlib
   ] ++ (with gst_all_1; [ gstreamer gst-libav gst-plugins-base gst-plugins-bad gst-plugins-good ]);
 
   cmakeFlags = [
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
     "-Dre_DIR=${libre}/include/re"
+    "-DGL_INCLUDE_DIRS=${lib.getDev glib}/include/glib-2.0"
+    "-DGLIB_INCLUDE_DIRS=${glib.out}/lib/glib-2.0/include"
+    "-DGST_INCLUDE_DIRS=${lib.getDev gst_all_1.gstreamer}/include/gstreamer-1.0"
   ];
 
   makeFlags = [
-    "LIBRE_MK=${libre}/share/re/re.mk"
-    "LIBRE_SO=${libre}/lib"
-    "LIBREM_PATH=${librem}"
     "PREFIX=$(out)"
-    "USE_VIDEO=1"
     "CCACHE_DISABLE=1"
-
-    "USE_ALSA=1"
-    "USE_AMR=1"
-    "USE_CAIRO=1"
-    "USE_CELT=1"
-    "USE_CONS=1"
-    "USE_EVDEV=1"
-    "USE_FFMPEG=1"
-    "USE_GSM=1"
-    "USE_GST1=1"
-    "USE_GTK=1"
-    "USE_L16=1"
-    "USE_MPG123=1"
-    "USE_OSS=1"
-    "USE_PLC=1"
-    "USE_VPX=1"
-    "USE_PORTAUDIO=1"
-    "USE_SDL=1"
-    "USE_SNDFILE=1"
-    "USE_SPEEX=1"
-    "USE_SPEEX_AEC=1"
-    "USE_SPEEX_PP=1"
-    "USE_SPEEX_RESAMP=1"
-    "USE_SRTP=1"
-    "USE_STDIO=1"
-    "USE_SYSLOG=1"
-    "USE_UUID=1"
-    "USE_V4L2=1"
-    "USE_X11=1"
-
-    "USE_BV32="
-    "USE_COREAUDIO="
-    "USE_G711=1"
-    "USE_G722=1"
-    "USE_G722_1="
-    "USE_ILBC="
-    "USE_OPUS="
-    "USE_SILK="
   ]
   ++ lib.optional (stdenv.cc.cc != null) "SYSROOT_ALT=${stdenv.cc.cc}"
   ++ lib.optional (stdenv.cc.libc != null) "SYSROOT=${stdenv.cc.libc}"
@@ -123,6 +90,73 @@ stdenv.mkDerivation rec {
     -DHAVE_INTTYPES_H -D__GLIBC__
     -D__need_timeval -D__need_timespec -D__need_time_t '';
 
+  doInstallCheck = true;
+  # CMake feature detection is prone to breakage between upgrades:
+  # spot-check that the optional modules we care about were compiled
+  postInstallCheck = lib.concatMapStringsSep "\n" (m: "test -x $out/lib/baresip/modules/${m}.so") [
+    "account"
+    "alsa"
+    "aubridge"
+    "auconv"
+    "aufile"
+    "auresamp"
+    "ausine"
+    "avcodec"
+    "avfilter"
+    "avformat"
+    "cons"
+    "contact"
+    "ctrl_dbus"
+    "ctrl_tcp"
+    "debug_cmd"
+    "dtls_srtp"
+    "ebuacip"
+    "echo"
+    "evdev"
+    "fakevideo"
+    "g711"
+    "g722"
+    "g726"
+    "gst"
+    "gtk"
+    "httpd"
+    "httpreq"
+    "ice"
+    "l16"
+    "menu"
+    "mixausrc"
+    "mixminus"
+    "multicast"
+    "mwi"
+    "natpmp"
+    "netroam"
+    "pcp"
+    "pipewire"
+    "plc"
+    "portaudio"
+    "presence"
+    "rtcpsummary"
+    "sdl"
+    "selfview"
+    "serreg"
+    "snapshot"
+    "sndfile"
+    "srtp"
+    "stdio"
+    "stun"
+    "swscale"
+    "syslog"
+    "turn"
+    "uuid"
+    "v4l2"
+    "vidbridge"
+    "vidinfo"
+    "vp8"
+    "vp9"
+    "vumeter"
+    "x11"
+  ];
+
   meta = {
     description = "Modular SIP User-Agent with audio and video support";
     homepage = "https://github.com/baresip/baresip";
diff --git a/pkgs/by-name/ba/bato/package.nix b/pkgs/by-name/ba/bato/package.nix
new file mode 100644
index 000000000000..fd3a2ad5851d
--- /dev/null
+++ b/pkgs/by-name/ba/bato/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  pkg-config,
+  cmake,
+  libnotify,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bato";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    owner = "doums";
+    repo = "bato";
+    rev = "v${version}";
+    hash = "sha256-i2gw8vXiKutq26ACzkVXH3kED7jAngSv2mNo9P3qXnA=";
+  };
+
+  cargoHash = "sha256-cqrSyZjfBSfF015nwOcRy2rkE4XzFPxJCQZGrqZXLEA=";
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+  ];
+
+  buildInputs = [ libnotify ];
+
+  meta = {
+    description = "Small program to send battery notifications";
+    homepage = "https://github.com/doums/bato";
+    changelog = "https://github.com/doums/bato/releases/tag/v${version}";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ HaskellHegemonie ];
+    platforms = lib.platforms.linux;
+    mainProgram = "bato";
+  };
+}
diff --git a/pkgs/by-name/ca/cano/allow-read-only-store-help-page.patch b/pkgs/by-name/ca/cano/allow-read-only-store-help-page.patch
new file mode 100644
index 000000000000..174d15fc82c6
--- /dev/null
+++ b/pkgs/by-name/ca/cano/allow-read-only-store-help-page.patch
@@ -0,0 +1,42 @@
+diff --git a/src/main.c b/src/main.c
+index 993a76f..de5b2c5 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -6,12 +6,8 @@ _Static_assert(sizeof(string_modes)/sizeof(*string_modes) == MODE_COUNT, "Number
+ char *get_help_page(char *page) {
+     if (page == NULL) return NULL;
+ 
+-    char *env = getenv("HOME");
+-    if(env == NULL) CRASH("could not get HOME");
+-
+-    char *help_page = calloc(128, sizeof(char));
+-    if (help_page == NULL) CRASH("could not calloc memory for help page");
+-    snprintf(help_page, 128, "%s/.local/share/cano/help/%s", env, page);
++    char *help_page;
++    asprintf(&help_page, "@help@/%s", page);
+ 
+     // check if file exists
+     struct stat st;
+diff --git a/src/tools.c b/src/tools.c
+index 220d7a1..4ce211e 100644
+--- a/src/tools.c
++++ b/src/tools.c
+@@ -63,6 +63,9 @@ void free_undo_stack(Undo_Stack *undo) {
+ 
+ void handle_save(Buffer *buffer) {
+     FILE *file = fopen(buffer->filename, "w");
++
++    if (file == NULL)
++        return;
+     fwrite(buffer->data.data, buffer->data.count, sizeof(char), file);
+     fclose(file);
+ }
+@@ -72,7 +75,7 @@ Buffer *load_buffer_from_file(char *filename) {
+     size_t filename_s = strlen(filename)+1;
+     buffer->filename = calloc(filename_s, sizeof(char));
+     strncpy(buffer->filename, filename, filename_s);
+-    FILE *file = fopen(filename, "a+");
++    FILE *file = fopen(filename, "r");
+     if(file == NULL) CRASH("Could not open file");
+     fseek(file, 0, SEEK_END);
+     size_t length = ftell(file);
diff --git a/pkgs/by-name/ca/cano/package.nix b/pkgs/by-name/ca/cano/package.nix
index 2c4d148c70e2..5702ce5fb19f 100644
--- a/pkgs/by-name/ca/cano/package.nix
+++ b/pkgs/by-name/ca/cano/package.nix
@@ -1,34 +1,55 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, gnumake
-, ncurses
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  installShellFiles,
+  ncurses,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cano";
-  version = "0.1.0-alpha";
+  version = "0.2.0-alpha";
 
   src = fetchFromGitHub {
     owner = "CobbCoding1";
     repo = "Cano";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BKbBDN7xZwlNzw7UFgX+PD9UXbr9FtELo+PlbfSHyRY=";
+    hash = "sha256-OaWj0AKw3+sEhcAbIjgOLfxwCKRG6O1k+zSp0GnnFn8=";
   };
 
-  buildInputs = [ gnumake ncurses ];
-  hardeningDisable = [ "format" "fortify" ];
+  patches = [ ./allow-read-only-store-help-page.patch ];
+
+  postPatch = ''
+    substituteInPlace src/main.c \
+      --replace-fail "@help@" "${placeholder "out"}/share/help"
+  '';
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = [ ncurses ];
+
+  hardeningDisable = [
+    "format"
+    "fortify"
+  ];
 
   installPhase = ''
-    mkdir -p $out/bin
-    cp build/cano $out/bin
+    runHook preInstall
+
+    install -Dm755 build/cano -t $out/bin
+
+    mkdir -p $out/share
+    cp -r docs/help $out/share
+    installManPage docs/cano.1
+
+    runHook postInstall
   '';
 
   meta = {
-     description = "Text Editor Written In C Using ncurses";
-     homepage = "https://github.com/CobbCoding1/Cano";
-     license = lib.licenses.asl20;
-     mainProgram = "Cano";
-     maintainers = with lib.maintainers; [ sigmanificient ];
-     platforms = lib.platforms.linux;
+    description = "Text Editor Written In C Using ncurses";
+    homepage = "https://github.com/CobbCoding1/Cano";
+    license = lib.licenses.asl20;
+    mainProgram = "Cano";
+    maintainers = with lib.maintainers; [ sigmanificient ];
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ce/certmgr/package.nix b/pkgs/by-name/ce/certmgr/package.nix
index e5579125a2ca..1063b4f61096 100644
--- a/pkgs/by-name/ce/certmgr/package.nix
+++ b/pkgs/by-name/ce/certmgr/package.nix
@@ -1,6 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -18,6 +19,9 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" ];
 
+  passthru.tests = { inherit (nixosTests) certmgr; };
+
+
   meta = with lib; {
     homepage = "https://cfssl.org/";
     description = "Cloudflare's automated certificate management using a CFSSL CA";
diff --git a/pkgs/by-name/cl/clang-uml/package.nix b/pkgs/by-name/cl/clang-uml/package.nix
index 9c037fb30be6..ec1f03499619 100644
--- a/pkgs/by-name/cl/clang-uml/package.nix
+++ b/pkgs/by-name/cl/clang-uml/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "clang-uml";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "bkryza";
     repo = "clang-uml";
     rev = finalAttrs.version;
-    hash = "sha256-ghnbOjVYw0zdFK/SDJ3sOObu6I7ROVNzYl1hovWju/Q=";
+    hash = "sha256-PEzTvwW/wUg8wgKjeNGbpgpP3SH2sVWRYc6o3gFjxx0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cu/cue/package.nix b/pkgs/by-name/cu/cue/package.nix
index b2f8359419e0..d10db99f55ac 100644
--- a/pkgs/by-name/cu/cue/package.nix
+++ b/pkgs/by-name/cu/cue/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "cue";
-  version = "0.9.2";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "cue-lang";
     repo = "cue";
     rev = "v${version}";
-    hash = "sha256-C3BvI43oo71y19ZRflqhKRQF7DwBBOV0yRlutv+W18g=";
+    hash = "sha256-GvReoBP8QCdrKxox8yPLZEk5YvTvwr7kflpS/jN8GTg=";
   };
 
-  vendorHash = "sha256-FsFignBh669E60S8l8siQHLzeSfB5X/XOHBXPMDX3Cg=";
+  vendorHash = "sha256-sLTpra7JwgF4l1UCrUtzQA4xrP4OqxBcZ1qEssBdFtk=";
 
   subPackages = [ "cmd/*" ];
 
diff --git a/pkgs/by-name/da/das/package.nix b/pkgs/by-name/da/das/package.nix
index 3ed340e72edb..8806e9181407 100644
--- a/pkgs/by-name/da/das/package.nix
+++ b/pkgs/by-name/da/das/package.nix
@@ -1,6 +1,7 @@
-{ lib
-, python3
-, fetchFromGitHub
+{
+  lib,
+  python3,
+  fetchFromGitHub,
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -15,17 +16,15 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-WZmWpcBqxsNH96nVWwoepFhsvdxZpYKmAjNd7ghIJMA=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'networkx = "^2.8.4"' 'networkx = "*"' \
-      --replace 'netaddr = "^0.8.0"' 'netaddr = "*"'
-  '';
-
-  nativeBuildInputs = [
-    python3.pkgs.poetry-core
+  pythonRelaxDeps = [
+    "defusedxml"
+    "netaddr"
+    "networkx"
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [ poetry-core ];
+
+  dependencies = with python3.pkgs; [
     dash
     defusedxml
     dnspython
@@ -38,13 +37,12 @@ python3.pkgs.buildPythonApplication rec {
     tinydb
   ];
 
-  pythonImportsCheck = [
-    "das"
-  ];
+  pythonImportsCheck = [ "das" ];
 
   meta = with lib; {
     description = "Divide full port scan results and use it for targeted Nmap runs";
     homepage = "https://github.com/snovvcrash/DivideAndScan";
+    changelog = "https://github.com/snovvcrash/DivideAndScan/releases/tag/v${version}";
     license = licenses.bsd2;
     maintainers = with maintainers; [ fab ];
     mainProgram = "das";
diff --git a/pkgs/by-name/da/davis/package.nix b/pkgs/by-name/da/davis/package.nix
index 58b1bf099fe8..1fa809859387 100644
--- a/pkgs/by-name/da/davis/package.nix
+++ b/pkgs/by-name/da/davis/package.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   php,
+  nixosTests,
 }:
 
 php.buildComposerProject (finalAttrs: {
@@ -25,6 +26,10 @@ php.buildComposerProject (finalAttrs: {
     rm -rf "$out/share"
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) davis;
+  };
+
   meta = {
     changelog = "https://github.com/tchapi/davis/releases/tag/v${finalAttrs.version}";
     homepage = "https://github.com/tchapi/davis";
diff --git a/pkgs/by-name/db/dbgate/package.nix b/pkgs/by-name/db/dbgate/package.nix
index 5a1cea91a228..ab62dee5f391 100644
--- a/pkgs/by-name/db/dbgate/package.nix
+++ b/pkgs/by-name/db/dbgate/package.nix
@@ -7,21 +7,21 @@
 }:
 let
   pname = "dbgate";
-  version = "5.3.1";
+  version = "5.3.4";
   src =
     fetchurl
       {
         aarch64-linux = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-linux_arm64.AppImage";
-          hash = "sha256-Qz0VA2pHT8muw9RdLg7Y3w3mJ3ubFnqf4dmfdZdnJHI=";
+          hash = "sha256-szG0orYBB1+DE9Vwjq0sluIaLDBlWOScKuruJR4iQKg=";
         };
         x86_64-linux = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-linux_x86_64.AppImage";
-          hash = "sha256-H/2Tb6ZnO6LJx+rv/ADdItaRMP95x4G3lPNK0sbZn9I=";
+          hash = "sha256-C0BJ3dydaeV8ypc8c0EDiMBhvByLAKuKTGHOozqbd+w=";
         };
         x86_64-darwin = {
           url = "https://github.com/dbgate/dbgate/releases/download/v${version}/dbgate-${version}-mac_x64.dmg";
-          hash = "sha256-gZrfv9qe2arytVgiYtX9uwfwC4Z30SHEDiBUXcpF968=";
+          hash = "sha256-WwUpFFeZ9NmosHZqrHCbsz673fSbdQvwxhEvz/6JJtw=";
         };
       }
       .${stdenv.system} or (throw "dbgate: ${stdenv.system} is unsupported.");
diff --git a/pkgs/by-name/el/elasticsearch-curator/package.nix b/pkgs/by-name/el/elasticsearch-curator/package.nix
index 6a142aeb1ac5..cb91f3edfb6f 100644
--- a/pkgs/by-name/el/elasticsearch-curator/package.nix
+++ b/pkgs/by-name/el/elasticsearch-curator/package.nix
@@ -9,16 +9,18 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "elasticsearch-curator";
-  version = "8.0.15";
-  format = "pyproject";
+  version = "8.0.16";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "curator";
     rev = "refs/tags/v${version}";
-    hash = "sha256-pW928jT9oL76RJuJgH7nhCvgWPzXixzqBKVYsaJy9xw=";
+    hash = "sha256-nSBsLzem+eZBM0ebhW1Omh+pYYPYdly/VraM89iJe3E=";
   };
 
+  pythonRelaxDeps = [ "es-client" ];
+
   build-system = with python3.pkgs; [ hatchling ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/by-name/fa/fail2ban/package.nix b/pkgs/by-name/fa/fail2ban/package.nix
index 00ea39b40a2b..6425f814f2d5 100644
--- a/pkgs/by-name/fa/fail2ban/package.nix
+++ b/pkgs/by-name/fa/fail2ban/package.nix
@@ -4,6 +4,7 @@
 , fetchpatch
 , python3
 , installShellFiles
+, nixosTests
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -87,6 +88,8 @@ python3.pkgs.buildPythonApplication rec {
       rm -r "${sitePackages}/usr"
     '';
 
+  passthru.tests = { inherit (nixosTests) fail2ban; };
+
   meta = with lib; {
     homepage = "https://www.fail2ban.org/";
     description = "Program that scans log files for repeated failing login attempts and bans IP addresses";
diff --git a/pkgs/applications/graphics/flaca/default.nix b/pkgs/by-name/fl/flaca/package.nix
similarity index 73%
rename from pkgs/applications/graphics/flaca/default.nix
rename to pkgs/by-name/fl/flaca/package.nix
index b2d82b458b49..bec47b7b302c 100644
--- a/pkgs/applications/graphics/flaca/default.nix
+++ b/pkgs/by-name/fl/flaca/package.nix
@@ -1,14 +1,15 @@
-{ lib
-, fetchFromGitHub
-, rustPlatform
-, fetchurl
-, runCommand
-, lndir
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  fetchurl,
+  runCommand,
+  lndir,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "flaca";
-  version = "2.4.6";
+  version = "3.1.6";
 
   src =
     let
@@ -16,11 +17,11 @@ rustPlatform.buildRustPackage rec {
         owner = "Blobfolio";
         repo = pname;
         rev = "v${version}";
-        hash = "sha256-uybEo098+Y92b2P9CniKFmaV8hQZFuOSthgQRGZ/ncc=";
+        hash = "sha256-mNCb9d7/nRWSkiir2bYkslw/F2GmjvE0cPi7HhzEN68=";
       };
       lockFile = fetchurl {
         url = "https://github.com/Blobfolio/flaca/releases/download/v${version}/Cargo.lock";
-        hash = "sha256-xAjpw71HgS6fILg5zNuc43s0fIqYcoUMMbCH65xrlww=";
+        hash = "sha256-tyxTgYEGROCtoiKPX57pF32UcfpDCuMdFSttZu++ju8=";
       };
     in
     runCommand "source-with-lock" { nativeBuildInputs = [ lndir ]; } ''
@@ -29,7 +30,9 @@ rustPlatform.buildRustPackage rec {
       lndir -silent ${source} $out
     '';
 
-  cargoHash = "sha256-w+PeuH6VFIu3iH5EXF6gEwyYoGeqXX0yd5jJs2NqisQ=";
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
+
+  cargoHash = "sha256-YYNWCJT5ZT36v4u4P3gtW/osor6eIvR8leqlQHHZYMk=";
 
   meta = with lib; {
     description = "CLI tool to losslessly compress JPEG and PNG images";
diff --git a/pkgs/by-name/fl/flexget/package.nix b/pkgs/by-name/fl/flexget/package.nix
index e080f4cfdb22..79203498ec6e 100644
--- a/pkgs/by-name/fl/flexget/package.nix
+++ b/pkgs/by-name/fl/flexget/package.nix
@@ -5,7 +5,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.11.42";
+  version = "3.11.43";
   pyproject = true;
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wDZXSQlIE1qQz463roHp3jepSFMZGSJAPOhKpuXTmG8=";
+    hash = "sha256-KX7Bvu4rt+Q7x2XkBiZMngAgqRKYu90EVi2oQ21o5AI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/flip-link/default.nix b/pkgs/by-name/fl/flip-link/package.nix
similarity index 100%
rename from pkgs/development/tools/flip-link/default.nix
rename to pkgs/by-name/fl/flip-link/package.nix
diff --git a/pkgs/by-name/fo/forgejo/generic.nix b/pkgs/by-name/fo/forgejo/generic.nix
index 080789bec45e..a2a1e51850bc 100644
--- a/pkgs/by-name/fo/forgejo/generic.nix
+++ b/pkgs/by-name/fo/forgejo/generic.nix
@@ -17,8 +17,6 @@
 , nix-update-script
 , nixosTests
 , openssh
-, pam
-, pamSupport ? true
 , sqliteSupport ? true
 , xorg
 , runCommand
@@ -68,8 +66,6 @@ buildGoModule rec {
     makeWrapper
   ];
 
-  buildInputs = lib.optional pamSupport pam;
-
   nativeCheckInputs = [
     git
     openssh
@@ -83,8 +79,7 @@ buildGoModule rec {
     substituteInPlace modules/setting/server.go --subst-var data
   '';
 
-  tags = lib.optional pamSupport "pam"
-    ++ lib.optionals sqliteSupport [ "sqlite" "sqlite_unlock_notify" ];
+  tags = lib.optionals sqliteSupport [ "sqlite" "sqlite_unlock_notify" ];
 
   ldflags = [
     "-s"
@@ -115,7 +110,6 @@ buildGoModule rec {
       skippedTests = [
         "Test_SSHParsePublicKey/dsa-1024/SSHKeygen" # dsa-1024 is deprecated in openssh and requires opting-in at compile time
         "Test_calcFingerprint/dsa-1024/SSHKeygen" # dsa-1024 is deprecated in openssh and requires opting-in at compile time
-        "TestPamAuth" # we don't have PAM set up in the build sandbox
         "TestPassword" # requires network: api.pwnedpasswords.com
         "TestCaptcha" # requires network: hcaptcha.com
         "TestDNSUpdate" # requires network: release.forgejo.org
diff --git a/pkgs/by-name/gd/gdm-settings/package.nix b/pkgs/by-name/gd/gdm-settings/package.nix
new file mode 100644
index 000000000000..ab34a2eefb13
--- /dev/null
+++ b/pkgs/by-name/gd/gdm-settings/package.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  appstream,
+  blueprint-compiler,
+  desktop-file-utils,
+  glib,
+  gnome,
+  libadwaita,
+  meson,
+  ninja,
+  pkg-config,
+  wrapGAppsHook4,
+  # gdm-settings needs to know where to look for themes
+  # This should work for most systems, but can be overridden if not
+  dataDirs ? lib.concatStringsSep ":" [
+    "/run/current-system/sw/share"
+    "/usr/local/share"
+    "/usr/share"
+  ],
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "gdm-settings";
+  version = "4.4";
+  pyproject = false;
+
+  src = fetchFromGitHub {
+    owner = "gdm-settings";
+    repo = "gdm-settings";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3Te8bhv2TkpJFz4llm1itRhzg9v64M7Drtrm4s9EyiQ=";
+  };
+
+  nativeBuildInputs = [
+    appstream # for appstream file validation
+    blueprint-compiler
+    desktop-file-utils # for desktop file validation
+    glib # for `glib-compile-schemas`
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [ libadwaita ];
+
+  dependencies = [ python3Packages.pygobject3 ];
+
+  dontWrapGApps = true;
+  makeWrapperArgs = [
+    "\${gappsWrapperArgs[@]}"
+    "--set-default HOST_DATA_DIRS ${dataDirs}"
+  ];
+
+  pythonImportsCheck = [ "gdms" ];
+
+  meta = {
+    description = "Settings app for GNOME's Login Manager";
+    homepage = "https://gdm-settings.github.io/";
+    changelog = "https://github.com/gdm-settings/gdm-settings/releases/tag/v${version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "gdm-settings";
+    inherit (gnome.gdm.meta) platforms;
+  };
+}
diff --git a/pkgs/by-name/ge/gerrit/package.nix b/pkgs/by-name/ge/gerrit/package.nix
index 1a905bd1fc39..c837ce497980 100644
--- a/pkgs/by-name/ge/gerrit/package.nix
+++ b/pkgs/by-name/ge/gerrit/package.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "gerrit";
@@ -30,6 +30,9 @@ stdenv.mkDerivation rec {
       "singleusergroup"
       "webhooks"
     ];
+    tests = {
+      inherit (nixosTests) gerrit;
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/go/godot_4/package.nix b/pkgs/by-name/go/godot_4/package.nix
index 36fe3ff0dd1b..1296da9e48d0 100644
--- a/pkgs/by-name/go/godot_4/package.nix
+++ b/pkgs/by-name/go/godot_4/package.nix
@@ -7,6 +7,7 @@
   fontconfig,
   installShellFiles,
   lib,
+  libdecor,
   libGL,
   libpulseaudio,
   libX11,
@@ -24,6 +25,8 @@
   stdenv,
   udev,
   vulkan-loader,
+  wayland,
+  wayland-scanner,
   withDbus ? true,
   withDebug ? false,
   withFontconfig ? true,
@@ -34,13 +37,15 @@
   withTarget ? "editor",
   withTouch ? true,
   withUdev ? true,
+  # Wayland in Godot requires X11 until upstream fix is merged
+  # https://github.com/godotengine/godot/pull/73504
+  withWayland ? true,
+  withX11 ? true,
 }:
-
 assert lib.asserts.assertOneOf "withPrecision" withPrecision [
   "single"
   "double"
 ];
-
 let
   mkSconsFlagsFromAttrSet = lib.mapAttrsToList (
     k: v: if builtins.isString v then "${k}=${v}" else "${k}=${builtins.toJSON v}"
@@ -101,6 +106,8 @@ stdenv.mkDerivation rec {
     speechd = withSpeechd; # Use Speech Dispatcher for Text-to-Speech support
     touch = withTouch; # Enable touch events
     udev = withUdev; # Use udev for gamepad connection callbacks
+    wayland = withWayland; # Compile with Wayland support
+    x11 = withX11; # Compile with X11 support
   };
 
   enableParallelBuilding = true;
@@ -117,12 +124,15 @@ stdenv.mkDerivation rec {
     installShellFiles
     pkg-config
     scons
-  ];
+  ] ++ lib.optionals withWayland [ wayland-scanner ];
 
   runtimeDependencies =
     [
       alsa-lib
       libGL
+      vulkan-loader
+    ]
+    ++ lib.optionals withX11 [
       libX11
       libXcursor
       libXext
@@ -132,7 +142,10 @@ stdenv.mkDerivation rec {
       libxkbcommon
       libXrandr
       libXrender
-      vulkan-loader
+    ]
+    ++ lib.optionals withWayland [
+      libdecor
+      wayland
     ]
     ++ lib.optionals withDbus [
       dbus
diff --git a/pkgs/by-name/go/got/package.nix b/pkgs/by-name/go/got/package.nix
index 0f1432d4cc21..942e758972ff 100644
--- a/pkgs/by-name/go/got/package.nix
+++ b/pkgs/by-name/go/got/package.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "got";
-  version = "0.101";
+  version = "0.102";
 
   src = fetchurl {
     url = "https://gameoftrees.org/releases/portable/got-portable-${finalAttrs.version}.tar.gz";
-    hash = "sha256-JQZBgscxoMv4Dki77s8tYo4r5BBG+ErsDYnY5/am3MA=";
+    hash = "sha256-qstQ6mZLCdYL5uQauMt7nGlEdPkPneGfu36RbaboN3c=";
   };
 
   nativeBuildInputs = [ pkg-config bison ]
diff --git a/pkgs/by-name/go/gotenberg/package.nix b/pkgs/by-name/go/gotenberg/package.nix
index 40cb1e185bbd..92da454785b2 100644
--- a/pkgs/by-name/go/gotenberg/package.nix
+++ b/pkgs/by-name/go/gotenberg/package.nix
@@ -12,6 +12,7 @@
   makeFontsConf,
   liberation_ttf_v2,
   exiftool,
+  nixosTests,
   nix-update-script,
 }:
 let
@@ -81,6 +82,9 @@ buildGoModule rec {
   '';
 
   passthru.updateScript = nix-update-script { };
+  passthru.tests = {
+    inherit (nixosTests) gotenberg;
+  };
 
   meta = {
     description = "Converts numerous document formats into PDF files";
diff --git a/pkgs/by-name/go/gowall/package.nix b/pkgs/by-name/go/gowall/package.nix
index b32a41769c71..7ec23d59c96b 100644
--- a/pkgs/by-name/go/gowall/package.nix
+++ b/pkgs/by-name/go/gowall/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "gowall";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "Achno";
     repo = "gowall";
     rev = "v${version}";
-    hash = "sha256-BNksshg1yK3mQuBaC4S3HzwfJ8vW0XxfDkG7YJAF00E=";
+    hash = "sha256-R7dOONfyzj6V3101Rp/WhUcFpqrSKWEkVm4a2riXZAI=";
   };
 
-  vendorHash = "sha256-jNx4ehew+IBx7M6ey/rT0vb53+9OBVYSEDJv8JWfZIw=";
+  vendorHash = "sha256-H2Io1K2LEFmEPJYVcEaVAK2ieBrkV6u+uX82XOvNXj4=";
 
   nativeBuildInputs = [ installShellFiles ];
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
diff --git a/pkgs/by-name/gu/guix/package.nix b/pkgs/by-name/gu/guix/package.nix
index 8f9e4e4836b9..d3ea63a41311 100644
--- a/pkgs/by-name/gu/guix/package.nix
+++ b/pkgs/by-name/gu/guix/package.nix
@@ -29,6 +29,7 @@
 , bzip2
 , libgcrypt
 , sqlite
+, nixosTests
 
 , stateDir ? "/var"
 , storeDir ? "/gnu/store"
@@ -134,6 +135,10 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) guix;
+  };
+
   meta = with lib; {
     description = "Functional package manager with a Scheme interface";
     longDescription = ''
diff --git a/pkgs/by-name/ha/handheld-daemon/package.nix b/pkgs/by-name/ha/handheld-daemon/package.nix
index dbd20c286667..c0a289250704 100644
--- a/pkgs/by-name/ha/handheld-daemon/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon/package.nix
@@ -8,14 +8,14 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "handheld-daemon";
-  version = "3.3.7";
+  version = "3.3.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hhd-dev";
     repo = "hhd";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nRI1YrKBg7J14PQbWLLNaCI9p3v6Yl+Q506EOlSqqVc=";
+    hash = "sha256-15vG+e509CEagZ+G9FcfRmsdD8Jex8xUfdvEKlY+FaI=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/ka/kakoune-lsp/package.nix b/pkgs/by-name/ka/kakoune-lsp/package.nix
index 2a2d7a83a175..29e9fb4eef09 100644
--- a/pkgs/by-name/ka/kakoune-lsp/package.nix
+++ b/pkgs/by-name/ka/kakoune-lsp/package.nix
@@ -12,18 +12,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kakoune-lsp";
-  version = "17.1.1";
+  version = "17.1.2";
 
   src = fetchFromGitHub {
     owner = "kakoune-lsp";
     repo = "kakoune-lsp";
     rev = "v${version}";
-    sha256 = "sha256-XBH2pMDiHJNXrx90Lt0IcsbMFUM+X7GAHgiHpdlIdR4=";
+    sha256 = "sha256-NZDp98Ne6z7DlJ2vZiqGzw5ukusOkEjb+eyvmxB+IKI=";
   };
 
   patches = [ (replaceVars ./Hardcode-perl.patch { inherit perl; }) ];
 
-  cargoHash = "sha256-Yi+T+9E3Wvce4kDLsRgZ07RAGLrq7dkinKpvvGeLeS0=";
+  cargoHash = "sha256-QonOqdcdp1vbxzLnF46X0DLVay2Up1LvHZ/ZZ04LqlE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices
diff --git a/pkgs/by-name/li/libmrss/package.nix b/pkgs/by-name/li/libmrss/package.nix
new file mode 100644
index 000000000000..176d65549282
--- /dev/null
+++ b/pkgs/by-name/li/libmrss/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  curl,
+  libnxml,
+  autoreconfHook,
+  pkg-config,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libmrss";
+  version = "0.19.4";
+
+  src = fetchFromGitHub {
+    owner = "bakulf";
+    repo = "libmrss";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-sllY0Q8Ct7XJn4A3N8xQCUqaHXubPoB49gBZS1vURBs=";
+  };
+
+  postPatch = ''
+    touch NEWS # https://github.com/bakulf/libmrss/issues/3
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    curl
+    libnxml
+  ];
+
+  meta = {
+    homepage = "https://github.com/bakulf/libmrss";
+    description = "C library for parsing, writing and creating RSS/ATOM files or streams";
+    license = lib.licenses.lgpl2;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+})
diff --git a/pkgs/by-name/li/libnxml/package.nix b/pkgs/by-name/li/libnxml/package.nix
new file mode 100644
index 000000000000..2e9ddfc91ef0
--- /dev/null
+++ b/pkgs/by-name/li/libnxml/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  curl,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libnxml";
+  version = "0.18.5";
+
+  src = fetchFromGitHub {
+    owner = "bakulf";
+    repo = "libnxml";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-6KI1bsfDgGJ4x8Wv7fcwCKm5AILa3jLnV53JY1g9B+M=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ curl ];
+
+  meta = {
+    homepage = "https://github.com/bakulf/libnxml";
+    description = "C library for parsing, writing and creating XML 1.0 and 1.1 files or streams";
+    license = lib.licenses.lgpl2;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+})
diff --git a/pkgs/by-name/lo/logdy/package.nix b/pkgs/by-name/lo/logdy/package.nix
new file mode 100644
index 000000000000..9b2de9f74fe4
--- /dev/null
+++ b/pkgs/by-name/lo/logdy/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+
+buildGoModule rec {
+  pname = "logdy";
+  version = "0.13.0";
+
+  src = fetchFromGitHub {
+    owner = "logdyhq";
+    repo = "logdy-core";
+    rev = "v${version}";
+    hash = "sha256-HlIl/4C1wheAxc0ReUN8xQrXJ0djoO7E0qhRwyFHEiE=";
+  };
+
+  vendorHash = "sha256-kFhcbBMymzlJ+2zw7l09LJfCdps26Id+VzOehqrLDWU=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  # After the build this derivation will generate two binaries.
+  # The first one is getting renamed based on the documentation
+  # The second one is just to launch a demo. This functionality could be achieved with the first one
+  postInstall = ''
+    mv $out/bin/logdy-core $out/bin/logdy
+    rm -f $out/bin/example-app
+
+    installShellCompletion --cmd logdy \
+      --bash <($out/bin/logdy completion bash) \
+      --fish <($out/bin/logdy completion fish) \
+      --zsh <($out/bin/logdy completion zsh)
+  '';
+
+  checkFlags = [
+    "-skip=^TestClientLoad$" # index out of range
+  ];
+
+  meta = {
+    description = "Web based real-time log viewer";
+    longDescription = ''
+      Web based real-time log viewer.
+      Stream ANY content to a web UI with autogenerated filters.
+      Parse any format with TypeScript
+    '';
+    homepage = "https://github.com/logdyhq/logdy-core";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      sigmanificient
+      ByteSudoer
+    ];
+    mainProgram = "logdy";
+  };
+}
diff --git a/pkgs/by-name/md/mdbook-alerts/package.nix b/pkgs/by-name/md/mdbook-alerts/package.nix
index eda9ce5fe974..10f46976dc1a 100644
--- a/pkgs/by-name/md/mdbook-alerts/package.nix
+++ b/pkgs/by-name/md/mdbook-alerts/package.nix
@@ -7,7 +7,7 @@
   CoreServices ? darwin.apple_sdk.frameworks.CoreServices,
 }:
 let
-  version = "0.6.2";
+  version = "0.6.3";
 in
 rustPlatform.buildRustPackage {
   pname = "mdbook-alerts";
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage {
     owner = "lambdalisue";
     repo = "rs-mdbook-alerts";
     rev = "v${version}";
-    hash = "sha256-wbXBsLOxQPEOzPcTOpG28B8Or74WGiAhgaLwnHAwT0g=";
+    hash = "sha256-MoaV/JRhWKYEzUkzxRTgYjqBw+gb2h+Bjb4mEvWEkp8=";
   };
 
-  cargoHash = "sha256-Q+mq6xu8fK6Jwee3x4hzHmC2zudV9IcGV0JfJRoKNMQ=";
+  cargoHash = "sha256-tHRbeDSK4aULz69jy5MeU4rANVuO2q3GUhDvBA4iQCM=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
new file mode 100644
index 000000000000..b05a66724479
--- /dev/null
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -0,0 +1,131 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  autoPatchelfHook,
+  curl,
+  openssl,
+  testers,
+  mongodb-ce,
+  writeShellApplication,
+  jq,
+  nix-update,
+  gitMinimal,
+  pup,
+}:
+
+let
+  version = "7.0.12";
+
+  srcs = version: {
+    "x86_64-linux" = {
+      url = "https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-${version}.tgz";
+      hash = "sha256-Kgq66rOBKgNIVw6bvzNrpnGRxyoBCP0AWnfzs9ReVVk=";
+    };
+    "aarch64-linux" = {
+      url = "https://fastdl.mongodb.org/linux/mongodb-linux-aarch64-ubuntu2204-${version}.tgz";
+      hash = "sha256-OLxPpAYFicWrqRJo3cNIG5Y0S6MIMd2vW8bluQkqnyk=";
+    };
+    "x86_64-darwin" = {
+      url = "https://fastdl.mongodb.org/osx/mongodb-macos-x86_64-${version}.tgz";
+      hash = "sha256-sKfg1EpRQ7L2rgJArRHQLrawU8bh42liih5GR2/3jok=";
+    };
+    "aarch64-darwin" = {
+      url = "https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${version}.tgz";
+      hash = "sha256-XkFSuKKxgSRoyzzrPYamE/44FV8ol125nqDOB9EnSMM=";
+    };
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mongodb-ce";
+  inherit version;
+
+  src = fetchurl (
+    (srcs version).${stdenv.hostPlatform.system}
+      or (throw "unsupported system: ${stdenv.hostPlatform.system}")
+  );
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  buildInputs = [
+    # This is to avoid the following error:
+    # ./result/bin/mongod: /nix/store/y6w7agm3aw5p96q7vsgzivba0dqq3rd0-curl-8.8.0/lib/libcurl.so.4: no version information available (required by ./result/bin/mongod)
+    # When running `mongod --version`
+    # See https://discourse.nixos.org/t/patchelf-and-libcurl-no-version-information-available/24453
+    (curl.overrideAttrs (old: {
+      configureFlags = old.configureFlags ++ [ "--enable-versioned-symbols" ];
+    })).dev
+    openssl.dev
+    stdenv.cc.cc.lib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm 755 bin/mongod $out/bin/mongod
+    install -Dm 755 bin/mongos $out/bin/mongos
+
+    runHook postInstall
+  '';
+
+  passthru = {
+
+    updateScript =
+      let
+        script = writeShellApplication {
+          name = "${finalAttrs.pname}-updateScript";
+
+          runtimeInputs = [
+            curl
+            jq
+            nix-update
+            gitMinimal
+            pup
+          ];
+
+          text =
+            ''
+              # Get latest version string from Github
+              NEW_VERSION=$(curl -s "https://api.github.com/repos/mongodb/mongo/tags?per_page=1000" | jq -r 'first(.[] | .name | select(startswith("r7.0")) | select(contains("rc") | not) | .[1:])')
+
+              # Check if the new version is available for download, if not, exit
+              AVAILABLE=$(curl -s https://www.mongodb.com/try/download/community-edition/releases | pup 'h3:not([id]) text{}' | grep "$NEW_VERSION")
+
+              if [[ "${version}" = "$NEW_VERSION" ]]; then
+                  echo "The new version same as the old version."
+                  exit 0
+              fi
+            ''
+            + lib.concatStrings (
+              map (system: ''
+                nix-update --system ${system} --version "$NEW_VERSION" ${finalAttrs.pname}
+              '') finalAttrs.meta.platforms
+            );
+        };
+      in
+      {
+        command = lib.getExe script;
+      };
+
+    tests.version = testers.testVersion {
+      package = mongodb-ce;
+      command = "mongod --version";
+    };
+  };
+
+  meta = {
+    changelog = "https://www.mongodb.com/docs/upcoming/release-notes/7.0/";
+    description = "MongoDB is a general purpose, document-based, distributed database.";
+    homepage = "https://www.mongodb.com/";
+    license = with lib.licenses; [ sspl ];
+    longDescription = ''
+      MongoDB CE (Community Edition) is a general purpose, document-based, distributed database.
+      It is designed to be flexible and easy to use, with the ability to store data of any structure.
+      This pre-compiled binary distribution package provides the MongoDB daemon (mongod) and the MongoDB Shard utility
+      (mongos).
+    '';
+    maintainers = with lib.maintainers; [ drupol ];
+    platforms = lib.attrNames (srcs version);
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/mo/moonlight-qt/package.nix b/pkgs/by-name/mo/moonlight-qt/package.nix
index 2f8749c82ca1..a0ca66b61e64 100644
--- a/pkgs/by-name/mo/moonlight-qt/package.nix
+++ b/pkgs/by-name/mo/moonlight-qt/package.nix
@@ -20,6 +20,7 @@
   libvdpau,
   libxkbcommon,
   wayland,
+  libdrm,
   nix-update-script,
 }:
 
@@ -80,6 +81,7 @@ stdenv'.mkDerivation rec {
       libxkbcommon
       qt6.qtwayland
       wayland
+      libdrm
     ]
     ++ lib.optionals stdenv.isDarwin [
       AVFoundation
diff --git a/pkgs/by-name/my/mycelium/package.nix b/pkgs/by-name/my/mycelium/package.nix
index df96ad255fad..04a1714826bf 100644
--- a/pkgs/by-name/my/mycelium/package.nix
+++ b/pkgs/by-name/my/mycelium/package.nix
@@ -4,6 +4,7 @@
 , stdenv
 , openssl
 , darwin
+, nixosTests
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -37,6 +38,8 @@ rustPlatform.buildRustPackage rec {
     OPENSSL_DIR = "${lib.getDev openssl}";
   };
 
+  passthru.tests = { inherit (nixosTests) mycelium; };
+
   meta = with lib; {
     description = "End-2-end encrypted IPv6 overlay network";
     homepage = "https://github.com/threefoldtech/mycelium";
diff --git a/pkgs/by-name/na/nar-serve/package.nix b/pkgs/by-name/na/nar-serve/package.nix
index 5f1f55198fdf..8bd274af659f 100644
--- a/pkgs/by-name/na/nar-serve/package.nix
+++ b/pkgs/by-name/na/nar-serve/package.nix
@@ -1,6 +1,7 @@
 { buildGoModule
 , fetchFromGitHub
 , lib
+, nixosTests
 }:
 buildGoModule rec {
   pname = "nar-serve";
@@ -17,6 +18,8 @@ buildGoModule rec {
 
   doCheck = false;
 
+  passthru.tests = { inherit (nixosTests) nar-serve; };
+
   meta = with lib; {
     description = "Serve NAR file contents via HTTP";
     mainProgram = "nar-serve";
diff --git a/pkgs/by-name/ne/nexus/package.nix b/pkgs/by-name/ne/nexus/package.nix
index 00e4e7325e04..68822ba5dcb8 100644
--- a/pkgs/by-name/ne/nexus/package.nix
+++ b/pkgs/by-name/ne/nexus/package.nix
@@ -5,6 +5,7 @@
   makeWrapper,
   jre_headless,
   gawk,
+  nixosTests,
 }:
 
 stdenv.mkDerivation rec {
@@ -49,6 +50,10 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) nexus;
+  };
+
   meta = {
     description = "Repository manager for binary software components";
     homepage = "https://www.sonatype.com/products/sonatype-nexus-oss";
diff --git a/pkgs/by-name/ni/nix-ld-rs/package.nix b/pkgs/by-name/ni/nix-ld-rs/package.nix
deleted file mode 100644
index d6514033741a..000000000000
--- a/pkgs/by-name/ni/nix-ld-rs/package.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  stdenv,
-  fetchFromGitHub,
-  nixosTests,
-  rustPlatform,
-  lib,
-}:
-
-rustPlatform.buildRustPackage {
-  name = "nix-ld-rs";
-
-  src = fetchFromGitHub {
-    owner = "nix-community";
-    repo = "nix-ld-rs";
-    rev = "f7154a6aedba4917c8cc72b805b79444b5bfafca";
-    sha256 = "sha256-tx6gO6NR4BnYVhoskyvQY9l6/8sK0HwoDHvsYcvIlgo=";
-  };
-
-  cargoHash = "sha256-4IDu5qAgF4Zq4GOsimuy8NiRCN9PXM+8oVzD2GO3QmM=";
-
-  hardeningDisable = [ "stackprotector" ];
-
-  NIX_SYSTEM = stdenv.system;
-  RUSTC_BOOTSTRAP = "1";
-
-  preCheck = ''
-    export NIX_LD=${stdenv.cc.bintools.dynamicLinker}
-  '';
-
-  postInstall = ''
-    mkdir -p $out/libexec
-    ln -s $out/bin/nix-ld-rs $out/libexec/nix-ld-rs
-    ln -s $out/bin/nix-ld-rs $out/libexec/nix-ld
-
-    mkdir -p $out/nix-support
-
-    ldpath=/${stdenv.hostPlatform.libDir}/$(basename ${stdenv.cc.bintools.dynamicLinker})
-    echo "$ldpath" > $out/nix-support/ldpath
-    mkdir -p $out/lib/tmpfiles.d/
-    cat > $out/lib/tmpfiles.d/nix-ld.conf <<EOF
-      L+ $ldpath - - - - $out/libexec/nix-ld-rs
-    EOF
-  '';
-
-  passthru.tests = nixosTests.nix-ld;
-
-  meta = with lib; {
-    description = "Run unpatched dynamic binaries on NixOS (rust version)";
-    homepage = "https://github.com/nix-community/nix-ld-rs";
-    license = licenses.mit;
-    maintainers = with maintainers; [ mic92 ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/no/noto-fonts/package.nix b/pkgs/by-name/no/noto-fonts/package.nix
index f700f8ad121c..b47072549b24 100644
--- a/pkgs/by-name/no/noto-fonts/package.nix
+++ b/pkgs/by-name/no/noto-fonts/package.nix
@@ -2,6 +2,7 @@
 , stdenvNoCC
 , fetchFromGitHub
 , gitUpdater
+, nixosTests
 , variants ? [ ]
 , suffix ? ""
 , longDescription ? ''
@@ -62,6 +63,8 @@ stdenvNoCC.mkDerivation rec {
     rev-prefix = "noto-monthly-release-";
   };
 
+  passthru.tests = { inherit (nixosTests) noto-fonts; };
+
   meta = {
     description = "Beautiful and free fonts for many languages";
     homepage = "https://www.google.com/get/noto/";
diff --git a/pkgs/by-name/np/nph/lock.json b/pkgs/by-name/np/nph/lock.json
new file mode 100644
index 000000000000..28a56c2087d8
--- /dev/null
+++ b/pkgs/by-name/np/nph/lock.json
@@ -0,0 +1,3 @@
+{
+  "depends": []
+}
diff --git a/pkgs/by-name/np/nph/package.nix b/pkgs/by-name/np/nph/package.nix
new file mode 100644
index 000000000000..897b84d7980a
--- /dev/null
+++ b/pkgs/by-name/np/nph/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildNimPackage,
+  fetchFromGitHub,
+}:
+
+buildNimPackage (finalAttrs: {
+  pname = "nph";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "arnetheduck";
+    repo = "nph";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-9t5VeGsxyytGdu7+Uv/J+x6bmeB5+eQapbyp30iPxqs=";
+  };
+
+  lockFile = ./lock.json;
+
+  checkPhase = ''
+    runHook preCheck
+
+    $out/bin/nph tests/before
+    diff tests/before tests/after -x "*.yaml"
+
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "Opinionated code formatter for Nim";
+    homepage = "https://github.com/arnetheduck/nph";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sigmanificient ];
+    mainProgram = "nph";
+  };
+})
diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
index 6e895ee70b47..a1d1ffbb412b 100644
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nuclei-templates";
-  version = "9.9.2";
+  version = "9.9.3";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PObtdRhj4KaQRHpSSGCZzhFXRYRAJ4mejkYi7SgOqyE=";
+    hash = "sha256-Iw2TbDQWRy3W7eaybtGG3C+RaciKfjWpYblrCPa8SCE=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/nz/nzbhydra2/package.nix b/pkgs/by-name/nz/nzbhydra2/package.nix
index 3cbbb76811ac..2e6303c7a31b 100644
--- a/pkgs/by-name/nz/nzbhydra2/package.nix
+++ b/pkgs/by-name/nz/nzbhydra2/package.nix
@@ -6,6 +6,7 @@
   openjdk17,
   python3,
   unzip,
+  nixosTests,
 }:
 stdenv.mkDerivation rec {
   pname = "nzbhydra2";
@@ -37,6 +38,10 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) nzbhydra2;
+  };
+
   meta = {
     description = "Usenet meta search";
     homepage = "https://github.com/theotherp/nzbhydra2";
diff --git a/pkgs/by-name/op/openfga-cli/package.nix b/pkgs/by-name/op/openfga-cli/package.nix
index 4a0ea0be8876..a1ca9738b61b 100644
--- a/pkgs/by-name/op/openfga-cli/package.nix
+++ b/pkgs/by-name/op/openfga-cli/package.nix
@@ -7,7 +7,7 @@
 
 let
   pname = "openfga-cli";
-  version = "0.5.2";
+  version = "0.5.3";
 in
 
 buildGoModule {
@@ -17,10 +17,10 @@ buildGoModule {
     owner = "openfga";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-tWGklsAsZ+kBTjpA2by3S0fSpUMNkh9dFKJ7DPzXNRA=";
+    hash = "sha256-74wHhVGhLiuszRZBjxGGk9jfN+D6T1eZg8OFEkE3gPE=";
   };
 
-  vendorHash = "sha256-GDYj4KcRK9/J5BTuUsk4f+qBrkT3ofP141mmKIqZAWA=";
+  vendorHash = "sha256-TDjXy5zR5LJWVmIfAolHgzM7JElgyksHbv0NAS97QnU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/op/ophcrack-cli/package.nix b/pkgs/by-name/op/ophcrack-cli/package.nix
deleted file mode 100644
index bbc7b8e19978..000000000000
--- a/pkgs/by-name/op/ophcrack-cli/package.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, fetchpatch
-, autoreconfHook
-, libtool
-, zlib
-, pkg-config
-, openssl
-, freetype
-, expat
-}:
-
-stdenv.mkDerivation rec {
-  pname = "ophcrack";
-  version = "3.8.0";
-
-  src = fetchurl {
-    url = "https://sourceforge.net/projects/ophcrack/files/ophcrack/3.8.0/ophcrack-3.8.0.tar.bz2";
-    hash = "sha256-BIpt9XmDo6WjGsfE7BLfFqpJ5lKilnbZPU75WdUK7uA=";
-  };
-
-  nativeBuildInputs = [
-    autoreconfHook
-    libtool
-    expat
-  ];
-
-  buildInputs = [
-    zlib
-    openssl
-    freetype
-    pkg-config
-  ];
-
-  patches = [
-    (fetchpatch {
-      url = "https://salsa.debian.org/pkg-security-team/ophcrack/-/raw/c60118b40802e1162dcebfe5f881cf973b2334d3/debian/patches/fix_spelling_error.diff";
-      hash = "sha256-Fc044hTU4Mtdym+HukGAwGzaLm7aVzV9KpvHvFUG2Sc=";
-    })
-    (fetchpatch {
-      url = "https://salsa.debian.org/pkg-security-team/ophcrack/-/raw/e19d993a7dbf131d13128366e2aac270a685befc/debian/patches/qmake_crossbuild.diff";
-      hash = "sha256-sOKXOBpAYGLacU6IxjRzy3HCnGm4DFowDL2qP+DzG8M=";
-    })
-  ];
-
-  configureFlags = [
-    "--with-libssl=yes"
-    "--disable-gui"
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    make
-
-    runHook postBuild
-  '';
-
-  postInstall = ''
-    mv $out/bin/ophcrack $out/bin/ophcrack-cli
-  '';
-
-  meta = with lib; {
-    description = "Free Windows password cracker based on rainbow tables";
-    homepage = "https://ophcrack.sourceforge.io";
-    license = with licenses; [ gpl2Plus ];
-    maintainers = with maintainers; [ tochiaha ];
-    mainProgram = "ophcrack-cli";
-    platforms = platforms.all;
-  };
-}
-
diff --git a/pkgs/by-name/op/ophcrack/package.nix b/pkgs/by-name/op/ophcrack/package.nix
new file mode 100644
index 000000000000..13709ad9973a
--- /dev/null
+++ b/pkgs/by-name/op/ophcrack/package.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  libsForQt5,
+  fetchurl,
+  fetchpatch,
+  pkg-config,
+  openssl,
+  expat,
+  enableGui ? true,
+}:
+stdenv.mkDerivation rec {
+
+  pname = "ophcrack";
+  version = "3.8.0";
+
+  src = fetchurl {
+    url = "mirror://ophcrack/ophcrack/${version}/ophcrack-${version}.tar.bz2";
+    hash = "sha256-BIpt9XmDo6WjGsfE7BLfFqpJ5lKilnbZPU75WdUK7uA=";
+  };
+
+  patches = [
+    (fetchpatch {
+      url = "https://salsa.debian.org/pkg-security-team/ophcrack/-/raw/c60118b40802e1162dcebfe5f881cf973b2334d3/debian/patches/fix_spelling_error.diff";
+      hash = "sha256-Fc044hTU4Mtdym+HukGAwGzaLm7aVzV9KpvHvFUG2Sc=";
+    })
+    (fetchpatch {
+      url = "https://salsa.debian.org/pkg-security-team/ophcrack/-/raw/e19d993a7dbf131d13128366e2aac270a685befc/debian/patches/qmake_crossbuild.diff";
+      hash = "sha256-sOKXOBpAYGLacU6IxjRzy3HCnGm4DFowDL2qP+DzG8M=";
+    })
+  ];
+
+  nativeBuildInputs = [ pkg-config ] ++ lib.optional enableGui libsForQt5.wrapQtAppsHook;
+  buildInputs =
+    [ openssl ]
+    ++ (if enableGui then [ libsForQt5.qtcharts ] else [ expat ]) ++ lib.optional stdenv.isDarwin expat;
+
+  configureFlags =
+    [ "--with-libssl" ]
+    ++ (
+      if enableGui then
+        [
+          "--enable-gui"
+          "--with-qt5charts"
+        ]
+      else
+        [ "--disable-gui" ]
+    );
+
+  installPhase = lib.optional stdenv.isDarwin ''
+    mkdir -p $out/bin
+    cp -R src/ophcrack $out/bin
+  '';
+
+  meta = {
+    description = "Free Windows password cracker based on rainbow tables";
+    homepage = "https://ophcrack.sourceforge.io";
+    license = with lib.licenses; [ gpl2Plus ];
+    maintainers = with lib.maintainers; [ tochiaha ];
+    mainProgram = "ophcrack";
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/po/polybar/package.nix b/pkgs/by-name/po/polybar/package.nix
index 7771eec81d2b..520b7753d3f0 100644
--- a/pkgs/by-name/po/polybar/package.nix
+++ b/pkgs/by-name/po/polybar/package.nix
@@ -42,13 +42,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "polybar";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "polybar";
     repo = "polybar";
     rev = finalAttrs.version;
-    hash = "sha256-DX648jY1vewl3ImK84gF6/vtcSCg3wtgq6Ie3fCwZoA=";
+    hash = "sha256-5PYKl6Hi4EYEmUBwkV0rLiwxNqIyR5jwm495YnNs0gI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/pr/private-gpt/package.nix b/pkgs/by-name/pr/private-gpt/package.nix
index 1b717cc2bfb8..4912c42212c8 100644
--- a/pkgs/by-name/pr/private-gpt/package.nix
+++ b/pkgs/by-name/pr/private-gpt/package.nix
@@ -5,8 +5,10 @@
 python3Packages.toPythonApplication (python3Packages.private-gpt.overrideAttrs (oldAttrs: {
   nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ makeBinaryWrapper ];
 
-  passthru.cl100k_base = {
-    inherit (python3Packages.private-gpt.cl100k_base) tiktoken;
+  passthru = (oldAttrs.passthru or {}) // {
+    cl100k_base = {
+      inherit (python3Packages.private-gpt.cl100k_base) tiktoken;
+    };
   };
 
   postInstall = ''
diff --git a/pkgs/by-name/pr/prometheus-restic-exporter/package.nix b/pkgs/by-name/pr/prometheus-restic-exporter/package.nix
index 603650a66ab6..d2dc4875282f 100644
--- a/pkgs/by-name/pr/prometheus-restic-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-restic-exporter/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "prometheus-restic-exporter";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "ngosang";
     repo = "restic-exporter";
     rev = version;
-    hash = "sha256-SC2ZCIQ33RaFI9+l/WI6edNzGEtsxJ2bBdeGNMHuyqY=";
+    hash = "sha256-gXiEts0EY9H01+rs+2o+cbVENotM33uhcQiGDtroSU4=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/qr/qrrs/package.nix b/pkgs/by-name/qr/qrrs/package.nix
new file mode 100644
index 000000000000..c995bf5a6b9a
--- /dev/null
+++ b/pkgs/by-name/qr/qrrs/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  installShellFiles,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "qrrs";
+  version = "0.1.10";
+
+  src = fetchFromGitHub {
+    owner = "lenivaya";
+    repo = "qrrs";
+    rev = "v${version}";
+    sha256 = "sha256-L8sqvLbh85b8Ds9EvXNkyGVXm8BF3ejFd8ZH7QoxJdU=";
+  };
+
+  cargoHash = "sha256-RLxQ7tG5e3q4vqYJU0eNvvcEnnyNc9R9at0/ACLYJiY=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installManPage ./man/*.?
+
+
+    installShellCompletion --cmd qrrs \
+      --bash <(cat ./completions/qrrs.bash) \
+      --fish <(cat ./completions/qrrs.fish) \
+      --zsh <(cat ./completions/_qrrs)
+  '';
+
+  meta = with lib; {
+    maintainers = with maintainers; [ lenivaya ];
+    description = "CLI QR code generator and reader written in rust";
+    license = licenses.mit;
+    homepage = "https://github.com/Lenivaya/qrrs";
+    mainProgram = "qrrs";
+  };
+}
diff --git a/pkgs/by-name/qu/quill-log/package.nix b/pkgs/by-name/qu/quill-log/package.nix
index b988a0f15ae2..22d042828ec7 100644
--- a/pkgs/by-name/qu/quill-log/package.nix
+++ b/pkgs/by-name/qu/quill-log/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "quill-log";
-  version = "6.1.0";
+  version = "6.1.2";
 
   src = fetchFromGitHub {
     owner = "odygrd";
     repo = "quill";
     rev = "v${version}";
-    hash = "sha256-6m3ijZlQ8NB+uGtsxAfLgryKUwlroqexK3IuC2FG3J4=";
+    hash = "sha256-hnSdyaVOPppa6KCgD6NoD4PKn0jI4iGGPg3Tnx0KX3w=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index d564fe1ecf81..b6daf9f26949 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "3.11.4";
+  version = "3.12.2";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-b9koWJunBlbg92/n5Wdvri7TAn9sbscLXasX+isXMHA=";
+    hash = "sha256-G3sdwQ5SqCA5jEDMny7a446wSMrPmgs4q5u1mcNY7SU=";
   };
 
-  cargoHash = "sha256-1N/5HNDN45Y+GSsrxMhVJAGbLUyLjDZaVNHS77x1SKw=";
+  cargoHash = "sha256-zyMXx1CITE0y7RyRirT3o5F8U/9ReXwlGr2nrobwmYI=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/regal/package.nix b/pkgs/by-name/re/regal/package.nix
index 883bc1743b3f..7372fac74436 100644
--- a/pkgs/by-name/re/regal/package.nix
+++ b/pkgs/by-name/re/regal/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   name = "regal";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "StyraInc";
     repo = "regal";
     rev = "v${version}";
-    hash = "sha256-bSu35IfQBoz2YKlEm8e02ahw9FxQfilR3b2WdjbAubs=";
+    hash = "sha256-yhlkvvNkZtpVx2uZVvXjr3eqBFXHDJ5qyO6k5EPNfww=";
   };
 
-  vendorHash = "sha256-2NzBcOQ1TLUsh8wKiGlPogql+6qNou8//XpCiE7eV5I=";
+  vendorHash = "sha256-gZYQEJAlm8qslHGfUsA8np43zdiPDYyhKm8HZIBR3ys=";
 
   meta = with lib; {
     description = "Linter and language server for Rego";
diff --git a/pkgs/by-name/rs/rspamd-trainer/package.nix b/pkgs/by-name/rs/rspamd-trainer/package.nix
index 56e6f9e9ce8e..e00bddcbfbce 100644
--- a/pkgs/by-name/rs/rspamd-trainer/package.nix
+++ b/pkgs/by-name/rs/rspamd-trainer/package.nix
@@ -4,6 +4,7 @@
 , fetchFromGitLab
 , fetchpatch
 , rspamd
+, nixosTests
 }:
 
 python3Packages.buildPythonApplication {
@@ -48,6 +49,8 @@ python3Packages.buildPythonApplication {
     imapclient
   ];
 
+  passthru.tests = { inherit (nixosTests) rspamd-trainer; };
+
   meta = {
     homepage = "https://gitlab.com/onlime/rspamd-trainer";
     description = "Grabs messages from a spam mailbox via IMAP and feeds them to Rspamd for training";
diff --git a/pkgs/development/tools/language-servers/ruff-lsp/default.nix b/pkgs/by-name/ru/ruff-lsp/package.nix
similarity index 66%
rename from pkgs/development/tools/language-servers/ruff-lsp/default.nix
rename to pkgs/by-name/ru/ruff-lsp/package.nix
index be327cae1ba0..c87b90ab5f5a 100644
--- a/pkgs/development/tools/language-servers/ruff-lsp/default.nix
+++ b/pkgs/by-name/ru/ruff-lsp/package.nix
@@ -1,30 +1,25 @@
-{ lib
-, stdenv
-, pythonOlder
-, buildPythonPackage
-, fetchFromGitHub
-, ruff
-, pygls
-, lsprotocol
-, hatchling
-, typing-extensions
-, packaging
-, pytestCheckHook
-, python-lsp-jsonrpc
-, pytest-asyncio
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  stdenv,
+  ruff,
+  nix-update-script,
+  testers,
+  ruff-lsp,
 }:
 
-buildPythonPackage rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "ruff-lsp";
-  version = "0.0.54";
+  version = "0.0.55";
   pyproject = true;
-  disabled = pythonOlder "3.7";
+  disabled = python3.pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff-lsp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VSuEjrRiHWA78DWQgbj0D+GFjhXrREUOHUcQpFqflcw=";
+    hash = "sha256-FFIZ8fDAPK03tnkjd2AUrz7iL8S9FziJQJKOxAisu48=";
   };
 
   postPatch = ''
@@ -32,11 +27,9 @@ buildPythonPackage rec {
     sed -i '/"ruff>=/d' pyproject.toml
   '';
 
-  build-system = [
-    hatchling
-  ];
+  build-system = with python3.pkgs; [ hatchling ];
 
-  dependencies = [
+  dependencies = with python3.pkgs; [
     packaging
     pygls
     lsprotocol
@@ -46,7 +39,7 @@ buildPythonPackage rec {
   # fails in linux sandbox
   doCheck = stdenv.isDarwin;
 
-  nativeCheckInputs = [
+  nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
     pytest-asyncio
     python-lsp-jsonrpc
@@ -63,12 +56,20 @@ buildPythonPackage rec {
     "--unset PYTHONPATH"
   ];
 
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion { package = ruff-lsp; };
+  };
+
   meta = {
     changelog = "https://github.com/astral-sh/ruff-lsp/releases/tag/v${version}";
     description = "Language Server Protocol implementation for Ruff";
     homepage = "https://github.com/astral-sh/ruff-lsp";
     license = lib.licenses.mit;
     mainProgram = "ruff-lsp";
-    maintainers = with lib.maintainers; [ figsoda kalekseev ];
+    maintainers = with lib.maintainers; [
+      figsoda
+      kalekseev
+    ];
   };
 }
diff --git a/pkgs/by-name/sh/shell-gpt/package.nix b/pkgs/by-name/sh/shell-gpt/package.nix
index 6558c612d84f..cafb67f0f0a9 100644
--- a/pkgs/by-name/sh/shell-gpt/package.nix
+++ b/pkgs/by-name/sh/shell-gpt/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "shell-gpt";
-  version = "1.4.3";
+  version = "1.4.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TheR1D";
     repo = "shell_gpt";
     rev = "refs/tags/${version}";
-    hash = "sha256-T37L4U1kOrrIQJ2znq2UupD3pyit9xd8rAsEwUvGiQ8=";
+    hash = "sha256-4/5CLzIq+RXVTJk4chrd65GeazRp8VFKdOMt3fT+mbI=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
index b745582238e4..4fcb7b08d14c 100644
--- a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+++ b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
@@ -1,23 +1,23 @@
 {
-  version = "1.13.2";
+  version = "1.14.0";
 
   x86_64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.13.2/linux/amd64/sysdig-cli-scanner";
-    hash = "sha256-nFQ+xDiB7CA9mfQlRiTH/FvyZMKZ0YH8Gzn4ZuZ/Ucc=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.14.0/linux/amd64/sysdig-cli-scanner";
+    hash = "sha256-EkwfoK/F2bl83J2cCjfC3s9ESpk5yrnv3+sFO94nzvw=";
   };
 
   aarch64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.13.2/linux/arm64/sysdig-cli-scanner";
-    hash = "sha256-IscMTVzEbWImFZa7uXNp2K6Gplnq2LZoVPoAo5oIZ1U=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.14.0/linux/arm64/sysdig-cli-scanner";
+    hash = "sha256-EkhhiV+x7Iv1nYp0+/+mpnVDVT1GpqW3Yh3VPOkM61g=";
   };
 
   x86_64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.13.2/darwin/amd64/sysdig-cli-scanner";
-    hash = "sha256-Xgip9cquafpRuYcXnnCF5ptFi774EocBZ535b/LzXUQ=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.14.0/darwin/amd64/sysdig-cli-scanner";
+    hash = "sha256-VQCvAOTEgdso32XMGqPflYzX3t5GhrzxAjZzft0wuFs=";
   };
 
   aarch64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.13.2/darwin/arm64/sysdig-cli-scanner";
-    hash = "sha256-l/u8UV9O5/mFrNHpyIaKvXbVCQ+Fh6binJLv7MCHrtM=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.14.0/darwin/arm64/sysdig-cli-scanner";
+    hash = "sha256-BELMtP3VRS+xb15LXCx5F/5XwtJn3DF6R5aluq1WHPc=";
   };
 }
diff --git a/pkgs/by-name/ta/tana/package.nix b/pkgs/by-name/ta/tana/package.nix
index d464b55c2a92..d9e37f2b8711 100644
--- a/pkgs/by-name/ta/tana/package.nix
+++ b/pkgs/by-name/ta/tana/package.nix
@@ -55,7 +55,7 @@ let
   ];
   buildInputs = glLibs ++ libs;
   runpathPackages = glLibs ++ [ stdenv.cc.cc stdenv.cc.libc ];
-  version = "1.0.15";
+  version = "1.0.16";
 in
 stdenv.mkDerivation {
   pname = "tana";
@@ -63,7 +63,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-94AyAwNFN5FCol97US1Pv8IN1+WMRA3St9kL2w+9FJU=";
+    hash = "sha256-XLjzvMai5HyxEGK02DfBAKy5jva9wEGcf5A/38jzu+s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tc/tclcurl/package.nix b/pkgs/by-name/tc/tclcurl/package.nix
index 48cd26a7d717..2bcfef25a3bd 100644
--- a/pkgs/by-name/tc/tclcurl/package.nix
+++ b/pkgs/by-name/tc/tclcurl/package.nix
@@ -7,13 +7,13 @@
 
 tcl.mkTclDerivation rec {
   pname = "tclcurl";
-  version = "7.22.0";
+  version = "7.22.1";
 
   src = fetchFromGitHub {
     owner = "flightaware";
     repo = "tclcurl-fa";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FQSzujHuP7vGJ51sdXh+31gRKqn98dV1kIqMKSoVB0M=";
+    hash = "sha256-XQuP+SiqvGX3ckBShUxsGBADjV3QdvYpU4hW6LMbMMQ=";
   };
 
   buildInputs = [ curl ];
diff --git a/pkgs/by-name/te/telescope/package.nix b/pkgs/by-name/te/telescope/package.nix
index 8198bd4750f7..1a4db30c9058 100644
--- a/pkgs/by-name/te/telescope/package.nix
+++ b/pkgs/by-name/te/telescope/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "telescope";
-  version = "0.10";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "omar-polo";
     repo = pname;
     rev = version;
-    hash = "sha256-hkXXM/I7sNFomWamT0q1JH62arX1hFbt68Axcijadug=";
+    hash = "sha256-MVZ/pvDAETacQiEMEXM0gYM20LXqNiHtMfFGqS1vipY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/to/tokyonight-gtk-theme/package.nix b/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
index 70e8d9d37672..2c402c008fa7 100644
--- a/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
+++ b/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
@@ -6,7 +6,12 @@
   sassc,
   gnome-themes-extra,
   gtk-engine-murrine,
-  colorVariants ? [] # default: install all icons
+  unstableGitUpdater,
+  colorVariants ? [ ],
+  sizeVariants ? [ ],
+  themeVariants ? [ ],
+  tweakVariants ? [ ],
+  iconVariants ? [ ],
 }:
 
 let
@@ -15,45 +20,109 @@ let
     "dark"
     "light"
   ];
-
+  sizeVariantList = [
+    "compact"
+    "standard"
+  ];
+  themeVariantList = [
+    "default"
+    "green"
+    "grey"
+    "orange"
+    "pink"
+    "purple"
+    "red"
+    "teal"
+    "yellow"
+    "all"
+  ];
+  tweakVariantList = [
+    "moon"
+    "storm"
+    "black"
+    "float"
+    "outline"
+    "macos"
+  ];
+  iconVariantList = [
+    "Dark-Cyan"
+    "Dark"
+    "Light"
+    "Moon"
+  ];
 in
-lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants
+lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants lib.checkListOfEnum
+  "${pname}: sizeVariants"
+  sizeVariantList
+  sizeVariants
+  lib.checkListOfEnum
+  "${pname}: themeVariants"
+  themeVariantList
+  themeVariants
+  lib.checkListOfEnum
+  "${pname}: tweakVariants"
+  tweakVariantList
+  tweakVariants
+  lib.checkListOfEnum
+  "${pname}: iconVariants"
+  iconVariantList
+  iconVariants
 
-stdenvNoCC.mkDerivation {
-  inherit pname;
-  version = "0-unstable-2024-06-27";
+  stdenvNoCC.mkDerivation
+  {
+    inherit pname;
+    version = "0-unstable-2024-07-22";
 
-  src = fetchFromGitHub {
-    owner = "Fausto-Korpsvart";
-    repo = "Tokyonight-GTK-Theme";
-    rev = "2f566d89856516bef988df3cc32261f752299886";
-    hash = "sha256-oKqLb66N4swHfhjUZJIGryE0D9MkuLdKFQa6j3TFmOg=";
-  };
+    src = fetchFromGitHub {
+      owner = "Fausto-Korpsvart";
+      repo = "Tokyonight-GTK-Theme";
+      rev = "a9a25010e9fbfca783c3c27258dbad76a9cc7842";
+      hash = "sha256-HbrDDiMej4DjvskGItele/iCUY1NzlWlu3ZneA76feM=";
+    };
 
-  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+    propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
-  nativeBuildInputs = [ gnome.gnome-shell sassc ];
-  buildInputs = [ gnome-themes-extra ];
+    nativeBuildInputs = [
+      gnome.gnome-shell
+      sassc
+    ];
+    buildInputs = [ gnome-themes-extra ];
 
-  dontBuild = true;
+    dontBuild = true;
 
-  postPatch = ''
-    patchShebangs themes/install.sh
-  '';
+    passthru.updateScript = unstableGitUpdater { };
 
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/share/themes
-    cd themes
-    ./install.sh -n Tokyonight -c ${lib.concatStringsSep " " (if colorVariants != [] then colorVariants else colorVariantList)} --tweaks macos -d "$out/share/themes"
-    runHook postInstall
-  '';
+    postPatch = ''
+      patchShebangs themes/install.sh
+    '';
 
-  meta = with lib; {
-    description = "GTK theme based on the Tokyo Night colour palette";
-    homepage = "https://github.com/Fausto-Korpsvart/Tokyonight-GTK-Theme";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ garaiza-93 Madouura d3vil0p3r ];
-    platforms = platforms.unix;
-  };
-}
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/share/themes
+      cd themes
+      ./install.sh -n Tokyonight \
+      ${lib.optionalString (colorVariants != [ ]) "-c " + toString colorVariants} \
+      ${lib.optionalString (sizeVariants != [ ]) "-s " + toString sizeVariants} \
+      ${lib.optionalString (themeVariants != [ ]) "-t " + toString themeVariants} \
+      ${lib.optionalString (tweakVariants != [ ]) "--tweaks " + toString tweakVariants} \
+      -d "$out/share/themes"
+      cd ../icons
+      ${lib.optionalString (iconVariants != [ ]) ''
+        mkdir -p $out/share/icons
+        cp -a ${toString (map (v: "Tokyonight-${v}") iconVariants)} $out/share/icons/
+      ''}
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "GTK theme based on the Tokyo Night colour palette";
+      homepage = "https://github.com/Fausto-Korpsvart/Tokyonight-GTK-Theme";
+      license = lib.licenses.gpl3Plus;
+      maintainers = with lib.maintainers; [
+        garaiza-93
+        Madouura
+        d3vil0p3r
+      ];
+      platforms = lib.platforms.unix;
+    };
+  }
diff --git a/pkgs/by-name/ui/uiua/package.nix b/pkgs/by-name/ui/uiua/package.nix
index d2552459474f..20f50b0957a1 100644
--- a/pkgs/by-name/ui/uiua/package.nix
+++ b/pkgs/by-name/ui/uiua/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "uiua";
-  version = "0.11.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "uiua-lang";
     repo = "uiua";
     rev = version;
-    hash = "sha256-bK5Z6aoyZti46GLulpdxGPxHM+EfEVQgeAUY6fRc7YY=";
+    hash = "sha256-w/eB9EN3IrEDdwbMqj2w5YAZK/BImA/Xq2k9oRng7Zk=";
   };
 
-  cargoHash = "sha256-iq5V+FGOcK2opmA4ot0KF9ZToYWC82gRsRyVqftuFPA=";
+  cargoHash = "sha256-/DO/jkYaInoO0nMfflDuu7E08gk9D89m9ubeubHdvd8=";
 
   nativeBuildInputs =
     lib.optionals stdenv.isDarwin [ rustPlatform.bindgenHook ]
diff --git a/pkgs/by-name/ve/veloren/Cargo.lock b/pkgs/by-name/ve/veloren/Cargo.lock
index 6f90da6983ad..f9c58f456565 100644
--- a/pkgs/by-name/ve/veloren/Cargo.lock
+++ b/pkgs/by-name/ve/veloren/Cargo.lock
@@ -6336,9 +6336,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.34"
+version = "0.3.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
+checksum = "ef89ece63debf11bc32d1ed8d078ac870cbeb44da02afb02a9ff135ae7ca0582"
 dependencies = [
  "deranged",
  "itoa",
@@ -6357,9 +6357,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
  "num-conv",
  "time-core",
diff --git a/pkgs/by-name/ve/veloren/package.nix b/pkgs/by-name/ve/veloren/package.nix
index fd2ffc686c51..fff47f2583fa 100644
--- a/pkgs/by-name/ve/veloren/package.nix
+++ b/pkgs/by-name/ve/veloren/package.nix
@@ -50,6 +50,9 @@ rustPlatform.buildRustPackage {
   ];
 
   postPatch = ''
+    # Use our Cargo.lock
+    cp ${./Cargo.lock} Cargo.lock
+
     # Force vek to build in unstable mode
     cat <<'EOF' | tee "$cargoDepsCopy"/vek-*/build.rs
     fn main() {
diff --git a/pkgs/by-name/wa/wastebin/package.nix b/pkgs/by-name/wa/wastebin/package.nix
index 5fcbcfa64259..53f58c5caf39 100644
--- a/pkgs/by-name/wa/wastebin/package.nix
+++ b/pkgs/by-name/wa/wastebin/package.nix
@@ -6,6 +6,7 @@
 , zstd
 , stdenv
 , darwin
+, nixosTests
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -36,6 +37,10 @@ rustPlatform.buildRustPackage rec {
     ZSTD_SYS_USE_PKG_CONFIG = true;
   };
 
+  passthru.tests = {
+    inherit (nixosTests) wastebin;
+  };
+
   meta = with lib; {
     description = "Wastebin is a pastebin";
     homepage = "https://github.com/matze/wastebin";
diff --git a/pkgs/by-name/wa/watchdogd/package.nix b/pkgs/by-name/wa/watchdogd/package.nix
index 34567dbe566d..4781257c88f9 100644
--- a/pkgs/by-name/wa/watchdogd/package.nix
+++ b/pkgs/by-name/wa/watchdogd/package.nix
@@ -6,6 +6,7 @@
 , libite
 , libuev
 , libconfuse
+, nixosTests
 }:
 stdenv.mkDerivation rec {
   pname = "watchdogd";
@@ -21,6 +22,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [ libite libuev libconfuse ];
 
+  passthru.tests = { inherit (nixosTests) watchdogd; };
+
   meta = with lib; {
     description = "Advanced system & process supervisor for Linux";
     homepage = "https://troglobit.com/watchdogd.html";
diff --git a/pkgs/by-name/wo/workout-tracker/package.nix b/pkgs/by-name/wo/workout-tracker/package.nix
index 349048008769..533f85a3f4a3 100644
--- a/pkgs/by-name/wo/workout-tracker/package.nix
+++ b/pkgs/by-name/wo/workout-tracker/package.nix
@@ -3,6 +3,7 @@
   buildGoModule,
   fetchFromGitHub,
   nix-update-script,
+  nixosTests,
   ...
 }:
 
@@ -21,6 +22,10 @@ buildGoModule rec {
 
   passthru.updateScript = nix-update-script { };
 
+  passthru.tests = {
+    inherit (nixosTests) workout-tracker;
+  };
+
   meta = {
     changelog = "https://github.com/jovandeginste/workout-tracker/releases/tag/v${version}";
     description = "Workout tracking web application for personal use";
diff --git a/pkgs/by-name/xw/xwiimote/package.nix b/pkgs/by-name/xw/xwiimote/package.nix
new file mode 100644
index 000000000000..a17299197d27
--- /dev/null
+++ b/pkgs/by-name/xw/xwiimote/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenv,
+  udev,
+  ncurses,
+  pkg-config,
+  fetchFromGitHub,
+  bluez,
+  autoreconfHook,
+}:
+
+stdenv.mkDerivation {
+  pname = "xwiimote";
+  version = "2-unstable-2024-02-29";
+
+  src = fetchFromGitHub {
+    owner = "xwiimote";
+    repo = "xwiimote";
+    rev = "4df713d9037d814cc0c64197f69e5c78d55caaf1";
+    hash = "sha256-y68bi62H7ErVekcs0RZUXPpW+QJ97sTQP4lajB9PsgU=";
+  };
+
+  configureFlags = [ "--with-doxygen=no" ];
+
+  buildInputs = [
+    udev
+    ncurses
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+  ];
+
+  postInstallPhase = ''
+    mkdir -p "$out/etc/X11/xorg.conf.d/"
+    cp "res/50-xorg-fix-xwiimote.conf" "$out/etc/X11/xorg.conf.d/50-fix-xwiimote.conf"
+  '';
+
+  meta = {
+    homepage = "https://xwiimote.github.io/xwiimote/";
+    description = "Userspace utilities to control connected Nintendo Wii Remotes";
+    mainProgram = "xwiishow";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pyrox0 ];
+  };
+}
diff --git a/pkgs/by-name/ya/yandex-cloud/sources.json b/pkgs/by-name/ya/yandex-cloud/sources.json
index a111fdf22649..04ba451895c8 100644
--- a/pkgs/by-name/ya/yandex-cloud/sources.json
+++ b/pkgs/by-name/ya/yandex-cloud/sources.json
@@ -1,25 +1,25 @@
 {
-  "version": "0.130.0",
+  "version": "0.131.0",
   "binaries": {
     "aarch64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.130.0/darwin/arm64/yc",
-      "hash": "sha256-nvEu2aV9ykG9j6p9+kW4bBGOoj5FzJD8eU1M9dFXF5I="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.131.0/darwin/arm64/yc",
+      "hash": "sha256-qbixNy5zjnJRuKtqamCWD7L7SS637sFSkpM24Olle2w="
     },
     "aarch64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.130.0/linux/arm64/yc",
-      "hash": "sha256-qZajFYaDVV+XcxC28MoRtIPaCm2He58p+yRMOrFhQU4="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.131.0/linux/arm64/yc",
+      "hash": "sha256-xW8lh/7L+rp7lBZS2EZGvop1r6Wy75W08Z3tpRJ6K80="
     },
     "i686-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.130.0/linux/386/yc",
-      "hash": "sha256-RhDZ2VnmO+GrKQ0SIFwyCqPxnfUc5VoGlgg8uJncERY="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.131.0/linux/386/yc",
+      "hash": "sha256-h4nO+qokC7yxgFWG/51NRqio0nVlc7y6O0NmpAK5hyE="
     },
     "x86_64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.130.0/darwin/amd64/yc",
-      "hash": "sha256-hGdInZAo+LH6qzoQXDmfSzVb1SdN565XuRGByzJrrfI="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.131.0/darwin/amd64/yc",
+      "hash": "sha256-DFF7XmC/YWxWjDdXpCkeMk7bVUYXSk8ncZF3T3Nf47w="
     },
     "x86_64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.130.0/linux/amd64/yc",
-      "hash": "sha256-0NwGi46WtOV/2oJJPiXIj0+39dKno2LlsVuWEFVycTI="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.131.0/linux/amd64/yc",
+      "hash": "sha256-ZVsMrlCN4nV4LsgLtHvwOMUUKkNdZ654rjM6ixcS94o="
     }
   }
 }
diff --git a/pkgs/by-name/yo/your_spotify/package.nix b/pkgs/by-name/yo/your_spotify/package.nix
index 738d1aefa248..77864788fa19 100644
--- a/pkgs/by-name/yo/your_spotify/package.nix
+++ b/pkgs/by-name/yo/your_spotify/package.nix
@@ -8,6 +8,7 @@
   nodejs,
   makeWrapper,
   callPackage,
+  nixosTests,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -63,6 +64,9 @@ stdenv.mkDerivation (finalAttrs: {
     client = callPackage ./client.nix {
       inherit (finalAttrs) src version offlineCache meta;
     };
+    tests = {
+      inherit (nixosTests) your_spotify;
+    };
   };
 
   meta = {
diff --git a/pkgs/data/fonts/monocraft/default.nix b/pkgs/data/fonts/monocraft/default.nix
index 88680682a7c9..fe3778e6b053 100644
--- a/pkgs/data/fonts/monocraft/default.nix
+++ b/pkgs/data/fonts/monocraft/default.nix
@@ -1,7 +1,7 @@
 { stdenvNoCC, lib, fetchurl }:
 
 let
-  version = "3.0";
+  version = "4.0";
   relArtifact = name: hash: fetchurl {
     inherit name hash;
     url = "https://github.com/IdreesInc/Monocraft/releases/download/v${version}/${name}";
@@ -12,10 +12,9 @@ stdenvNoCC.mkDerivation {
   inherit version;
 
   srcs = [
-    (relArtifact "Monocraft.otf" "sha256-PA1W+gOUStGw7cDmtEbG+B6M+sAYr8cft+Ckxj5LciU=")
-    (relArtifact "Monocraft.ttf" "sha256-S4j5v2bTJbhujT3Bt8daNN1YGYYP8zVPf9XXjuR64+o=")
-    (relArtifact "Monocraft-no-ligatures.ttf" "sha256-MuHfoP+dsXe+ODN4vWFIj50jwOxYyIiS0dd1tzVxHts=")
-    (relArtifact "Monocraft-nerd-fonts-patched.ttf" "sha256-QxMp8UwcRjWySNHWoNeX2sX9teZ4+tCFj+DG41azsXw=")
+    (relArtifact "Monocraft.ttc" "sha256-SBzl/X2PQOq1cY4dlqO89BDwCrP+/LYwZ9X24p2LDCs=")
+    (relArtifact "Monocraft-no-ligatures.ttc" "sha256-jFZ5Fr/cBwGVsdy7lPqLiLlKtzjF5OIWVkwZI6gR3W4=")
+    (relArtifact "Monocraft-nerd-fonts-patched.ttc" "sha256-lYAb8hgmv4VyrzeHr4LnfuSN9L+4fpDEMX/P++fq8Dc=")
   ];
 
   dontUnpack = true;
@@ -24,8 +23,10 @@ stdenvNoCC.mkDerivation {
 
   installPhase = ''
     runHook preInstall
-    find $srcs -name '*.otf' -exec install -Dm644 --target $out/share/fonts/opentype {} +
-    find $srcs -name '*.ttf' -exec install -Dm644 --target $out/share/fonts/truetype {} +
+    for src in "''${srcs[@]}"
+    do
+      install -Dm644 --target $out/share/fonts/truetype $src
+    done
     runHook postInstall
   '';
 
diff --git a/pkgs/desktops/gnome/misc/gnome-flashback/default.nix b/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
index f54860ba19ad..770d389d77d1 100644
--- a/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-flashback/default.nix
@@ -26,6 +26,7 @@
 , writeTextFile
 , xkeyboard_config
 , xorg
+, nixosTests
 , runCommand
 , buildEnv
 }:
@@ -180,6 +181,8 @@ let
           cp -r "${gnome-flashback}/lib/systemd/user/gnome-session@gnome-flashback-metacity.target.d" \
             "$out/lib/systemd/user/gnome-session@gnome-flashback-${wmName}.target.d"
         '';
+
+      tests = { inherit (nixosTests) gnome-flashback; };
     };
 
     meta = with lib; {
diff --git a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
index ccf8b4591d38..1355323d93fd 100644
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@@ -44,7 +44,7 @@ let
   buildInfo = ndkBuildInfoFun stdenv.buildPlatform;
   targetInfo = ndkTargetInfoFun stdenv.targetPlatform;
 
-  inherit (stdenv.targetPlatform) sdkVer;
+  androidSdkVersion = if (stdenv.targetPlatform ? androidSdkVersion && stdenv.targetPlatform.androidSdkVersion != null) then stdenv.targetPlatform.androidSdkVersion else (throw "`androidSdkVersion` is not set during the importing of nixpkgs");
   suffixSalt = lib.replaceStrings ["-" "."] ["_" "_"] stdenv.targetPlatform.config;
 
   # targetInfo.triple is what Google thinks the toolchain should be, this is a little
@@ -77,8 +77,8 @@ rec {
       cp -r ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} $out/toolchain
       find $out/toolchain -type d -exec chmod 777 {} \;
 
-      if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer} ]; then
-        echo "NDK does not contain libraries for SDK version ${sdkVer}";
+      if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion} ]; then
+        echo "NDK does not contain libraries for SDK version ${androidSdkVersion}";
         exit 1
       fi
 
@@ -86,8 +86,8 @@ rec {
       ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.so $out/lib/
       ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.a $out/lib/
       chmod +w $out/lib/*
-      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}/*.so $out/lib/
-      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}/*.o $out/lib/
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}/*.so $out/lib/
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}/*.o $out/lib/
 
       echo "INPUT(-lc++_static)" > $out/lib/libc++.a
 
@@ -130,7 +130,7 @@ rec {
     bintools = binutils;
     libc = targetAndroidndkPkgs.libraries;
     extraBuildCommands = ''
-      echo "-D__ANDROID_API__=${stdenv.targetPlatform.sdkVer}" >> $out/nix-support/cc-cflags
+      echo "-D__ANDROID_API__=${stdenv.targetPlatform.androidSdkVersion}" >> $out/nix-support/cc-cflags
       # Android needs executables linked with -pie since version 5.0
       # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
       echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
@@ -151,9 +151,9 @@ rec {
   # cross-compiling packages to wrap incorrectly wrap binaries we don't include
   # anyways.
   libraries = runCommand "bionic-prebuilt" {} ''
-    lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}
+    lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}
     if [ ! -d $lpath ]; then
-      echo "NDK does not contain libraries for SDK version ${sdkVer} <$lpath>"
+      echo "NDK does not contain libraries for SDK version ${androidSdkVersion} <$lpath>"
       exit 1
     fi
     mkdir -p $out/lib
diff --git a/pkgs/development/compilers/scryer-prolog/default.nix b/pkgs/development/compilers/scryer-prolog/default.nix
index 7a63db530f96..245d48d1a595 100644
--- a/pkgs/development/compilers/scryer-prolog/default.nix
+++ b/pkgs/development/compilers/scryer-prolog/default.nix
@@ -3,9 +3,6 @@
 , fetchFromGitHub
 , pkg-config
 , openssl
-, gmp
-, libmpc
-, mpfr
 , stdenv
 , darwin
 }:
@@ -25,7 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl gmp libmpc mpfr ]
+  buildInputs = [ openssl ]
                 ++ lib.optionals stdenv.isDarwin [
                   darwin.apple_sdk.frameworks.SystemConfiguration
                 ];
diff --git a/pkgs/development/libraries/amdvlk/default.nix b/pkgs/development/libraries/amdvlk/default.nix
index 6e3677431e78..5c58b837b305 100644
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@@ -25,13 +25,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "amdvlk";
-  version = "2024.Q2.3";
+  version = "2024.Q3.1";
 
   src = fetchRepoProject {
     name = "${pname}-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${version}";
-    sha256 = "kNGJWuWN2B4hEyRz2JFGSE8TiIdxujBOxF/T6nNek0A=";
+    sha256 = "IZYv9ZfpIllYUhJ3f7AOFmSl7OfWWY8doaG8pe3GE+4=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/dconf/default.nix b/pkgs/development/libraries/dconf/default.nix
index ab3804dfcf3b..0dddcb5d6482 100644
--- a/pkgs/development/libraries/dconf/default.nix
+++ b/pkgs/development/libraries/dconf/default.nix
@@ -14,6 +14,7 @@
 , gtk-doc
 , docbook-xsl-nons
 , docbook_xml_dtd_42
+, nixosTests
 , withDocs ? true
 }:
 
@@ -73,6 +74,7 @@ stdenv.mkDerivation rec {
       packageName = pname;
       versionPolicy = "odd-unstable";
     };
+    tests = { inherit (nixosTests) dconf; };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libmrss/default.nix b/pkgs/development/libraries/libmrss/default.nix
deleted file mode 100644
index daa66847b408..000000000000
--- a/pkgs/development/libraries/libmrss/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{lib, stdenv, fetchurl, curl, libnxml, pkg-config}:
-
-stdenv.mkDerivation rec {
-  pname = "libmrss";
-  version = "0.19.2";
-
-  src = fetchurl {
-    url = "https://www.autistici.org/bakunin/libmrss/libmrss-${version}.tar.gz";
-    sha256 = "02r1bgj8qlkn63xqfi5yq8y7wrilxcnkycaag8qskhg5ranic507";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  propagatedBuildInputs = [ curl libnxml ];
-
-  meta = {
-    homepage = "http://www.autistici.org/bakunin/libmrss/doc";
-    description = "C library for parsing, writing and creating RSS/ATOM files or streams";
-    license = lib.licenses.lgpl2;
-
-    platforms = lib.platforms.all;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/libraries/libnxml/default.nix b/pkgs/development/libraries/libnxml/default.nix
deleted file mode 100644
index 69ff6a6ebdc5..000000000000
--- a/pkgs/development/libraries/libnxml/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{lib, stdenv, fetchurl, curl}:
-
-stdenv.mkDerivation rec {
-  pname = "libnxml";
-  version = "0.18.3";
-
-  src = fetchurl {
-    url = "https://www.autistici.org/bakunin/libnxml/libnxml-${version}.tar.gz";
-    sha256 = "0ix5b9bxd7r517vhgcxwdviq4m0g0pq46s5g3h04gcqnpbin150g";
-  };
-
-  buildInputs = [ curl ];
-
-  meta = {
-    homepage = "https://www.autistici.org/bakunin/libnxml/";
-    description = "C library for parsing, writing and creating XML 1.0 and 1.1 files or streams";
-    license = lib.licenses.lgpl2;
-
-    platforms = lib.platforms.all;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index d05481a1dc2b..f1b2fbbab4fb 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   };
 
   # bin/psl-make-dafsa brings a large runtime closure through python3
-  outputs = [ "bin" "out" "dev" ];
+  outputs = lib.optional (!stdenv.hostPlatform.isStatic) "bin" ++ [ "out" "dev" ];
 
   nativeBuildInputs = [
     autoreconfHook
@@ -40,14 +40,13 @@ stdenv.mkDerivation rec {
     libidn2
     libunistring
     libxslt
-    python3
-  ];
+  ] ++ lib.optional (!stdenv.hostPlatform.isStatic) python3;
 
   propagatedBuildInputs = [
     publicsuffix-list
   ];
 
-  postPatch = ''
+  postPatch = lib.optionalString (!stdenv.hostPlatform.isStatic) ''
     patchShebangs src/psl-make-dafsa
   '';
 
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index 20ce67456c6a..8a41c60b169f 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -38,6 +38,12 @@ stdenv.mkDerivation (finalAttrs: {
     "-Ddriverdir=${mesa.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri:/usr/lib/x86_64-linux-gnu/dri:/usr/lib/i386-linux-gnu/dri"
   ];
 
+  env = lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17") {
+    NIX_LDFLAGS = "--undefined-version";
+  } // lib.optionalAttrs (stdenv.targetPlatform.useLLVM or false) {
+    NIX_CFLAGS_COMPILE = "-DHAVE_SECURE_GETENV";
+  };
+
   passthru.tests = {
     # other drivers depending on libva and selected application users.
     # Please get a confirmation from the maintainer before adding more applications.
@@ -66,8 +72,4 @@ stdenv.mkDerivation (finalAttrs: {
       lib.systems.inspect.platformPatterns.isStatic
     ];
   };
-} // lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17") {
-  NIX_LDFLAGS = "--undefined-version";
-} // lib.optionalAttrs (stdenv.targetPlatform.useLLVM or false) {
-  NIX_CFLAGS_COMPILE = "-DHAVE_SECURE_GETENV";
 })
diff --git a/pkgs/development/libraries/rapidyaml/default.nix b/pkgs/development/libraries/rapidyaml/default.nix
index 0ba51a86893a..0ab61d3e7178 100644
--- a/pkgs/development/libraries/rapidyaml/default.nix
+++ b/pkgs/development/libraries/rapidyaml/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rapidyaml";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "biojppm";
     repo = pname;
     fetchSubmodules = true;
     rev = "v${version}";
-    hash = "sha256-VpREG75d+Rmfu8B2VTWueJtfEZwKxGUFb8E3OwVy1L4=";
+    hash = "sha256-NUPx/1DkhSeCTt3Y5WpsN3wX7pMNOeku7eHdmFv/OWw=";
   };
 
   nativeBuildInputs = [ cmake git ];
diff --git a/pkgs/development/libraries/sqlitecpp/default.nix b/pkgs/development/libraries/sqlitecpp/default.nix
index e2c0b4ec35b9..a48e9a4ac87a 100644
--- a/pkgs/development/libraries/sqlitecpp/default.nix
+++ b/pkgs/development/libraries/sqlitecpp/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sqlitecpp";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchFromGitHub {
     owner = "SRombauts";
     repo = "sqlitecpp";
     rev = finalAttrs.version;
-    sha256 = "sha256-8l1JRaE7w9vJ4bCSLGAk9zwYHDFeKkBi9pE5fUJfLRc=";
+    sha256 = "sha256-rsVFk4FsonrwpBd3TonkxilwWeOBocH8AyeB+71OBdI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/tdlib/default.nix b/pkgs/development/libraries/tdlib/default.nix
index 3b341cb2eae0..d02bd3b81011 100644
--- a/pkgs/development/libraries/tdlib/default.nix
+++ b/pkgs/development/libraries/tdlib/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation {
   pname = "tdlib";
-  version = "1.8.34";
+  version = "1.8.35";
 
   src = fetchFromGitHub {
     owner = "tdlib";
@@ -11,8 +11,8 @@ stdenv.mkDerivation {
     # The tdlib authors do not set tags for minor versions, but
     # external programs depending on tdlib constrain the minor
     # version, hence we set a specific commit with a known version.
-    rev = "1fa2a372a88c26369dcac2ce476166531df74a77";
-    hash = "sha256-7I2hm3KFtiJwz1tOxh+kSPItFnUcE4ALT865wAyASCA=";
+    rev = "8d08b34e22a08e58db8341839c4e18ee06c516c5";
+    hash = "sha256-RxFiOp3QDpLeikPqd8vstvhdglFLtOmwpcfGvvdgI5Y=";
   };
 
   buildInputs = [ gperf openssl readline zlib ];
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index b1fb3231a2b6..2a045b245e86 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -72,7 +72,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.44.2";
+  version = "2.44.3";
   name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "6.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";
 
   outputs = [ "out" "dev" "devdoc" ];
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Uj9CyP8kgyrdF2Mfbqr+j5MDr+MW7xp+GES5Uqf3Uhs=";
+    hash = "sha256-3ILQQuysqYGkhSNXwG5SNXQzGc8QqUzTatQbl4g6C1Q=";
   };
 
   patches = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/mobile/webos/novacomd.nix b/pkgs/development/mobile/webos/novacomd.nix
index 390b201d93c6..7095dbaf9dfa 100644
--- a/pkgs/development/mobile/webos/novacomd.nix
+++ b/pkgs/development/mobile/webos/novacomd.nix
@@ -1,6 +1,7 @@
 { lib, stdenv,
 fetchFromGitHub, fetchpatch,
 webos, cmake, pkg-config,
+nixosTests,
 libusb-compat-0_1 }:
 
 stdenv.mkDerivation rec {
@@ -36,6 +37,8 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DWEBOS_TARGET_MACHINE_IMPL=host" ];
 
+  passthru.tests = { inherit (nixosTests) novacomd; };
+
   meta = with lib; {
     description = "Daemon for communicating with WebOS devices";
     mainProgram = "novacomd";
diff --git a/pkgs/development/python-modules/aioairzone-cloud/default.nix b/pkgs/development/python-modules/aioairzone-cloud/default.nix
index 56efb548aa09..4f25e486dd93 100644
--- a/pkgs/development/python-modules/aioairzone-cloud/default.nix
+++ b/pkgs/development/python-modules/aioairzone-cloud/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone-cloud";
-  version = "0.6.1";
+  version = "0.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone-cloud";
     rev = "refs/tags/${version}";
-    hash = "sha256-0aqY8Bg/kDSaNGSQ8hrlUQpfwYM3sVxQHm75/khgRTM=";
+    hash = "sha256-ByXSLfcUyj8i6t5guHnJedZrevGm71ad19vA/CxwTJ4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index a217ac383a47..c3b073ba8439 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.10.0";
+  version = "3.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "aiogram";
     repo = "aiogram";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7GTZvYyD6ypaH6PuOoh6TVboyS6nf8BFGgKvD59K6gc=";
+    hash = "sha256-5W7GuWZsUjTwjgKnNs7j4wZhOME1Giz757cM3sKuSQY=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index 03b73922d4f5..8137bd5a4e50 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "3.2.1";
+  version = "3.2.2";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -30,12 +30,12 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = "aiohomekit";
     rev = "refs/tags/${version}";
-    hash = "sha256-bv+xt6rp3cs8FhAw8b8Que5ABeD5+7z+LOb5C1PbzXI=";
+    hash = "sha256-SeK0CZesGatPQdwjr4u28m+ZIojlM02GCftX/q8Dg4g=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiocoap
     aiohappyeyeballs
     async-interrupt
@@ -76,14 +76,14 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python module that implements the HomeKit protocol";
-    mainProgram = "aiohomekitctl";
     longDescription = ''
       This Python library implements the HomeKit protocol for controlling
       Homekit accessories.
     '';
     homepage = "https://github.com/Jc2k/aiohomekit";
     changelog = "https://github.com/Jc2k/aiohomekit/releases/tag/${version}";
-    license = with licenses; [ asl20 ];
+    license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "aiohomekitctl";
   };
 }
diff --git a/pkgs/development/python-modules/aioquic/default.nix b/pkgs/development/python-modules/aioquic/default.nix
index 0b3bc5464ce1..66d429018f1c 100644
--- a/pkgs/development/python-modules/aioquic/default.nix
+++ b/pkgs/development/python-modules/aioquic/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "aioquic";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-p5HFeYuutCoS+ij9Mn2gTQjxh5XpOIkXi0svSf6Lv0M=";
+    hash = "sha256-+RJjuz9xlIxciRW01Q7jcABPIKQW9n+rPcyQVWx+cZk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aioruckus/default.nix b/pkgs/development/python-modules/aioruckus/default.nix
index d78c56e92cc3..bcd1ce1919fe 100644
--- a/pkgs/development/python-modules/aioruckus/default.nix
+++ b/pkgs/development/python-modules/aioruckus/default.nix
@@ -2,19 +2,19 @@
   lib,
   aiohttp,
   buildPythonPackage,
+  cryptography,
   fetchFromGitHub,
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
   setuptools,
-  wheel,
   xmltodict,
 }:
 
 buildPythonPackage rec {
   pname = "aioruckus";
-  version = "0.34";
-  format = "pyproject";
+  version = "0.40";
+  pyproject = true;
 
   disabled = pythonOlder "3.10";
 
@@ -22,33 +22,31 @@ buildPythonPackage rec {
     owner = "ms264556";
     repo = "aioruckus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SPj1w1jAJFBsWj1+N8srAbvlh+yB3ZTT7aDcZTnmUto=";
+    hash = "sha256-oEm0+ktEJHJPg4PUPfSmG9SyVRDrxs7kosQ0tIY+bRc=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "setuptools>=68.1" "setuptools"
+      --replace-fail "setuptools>=68.1" "setuptools"
   '';
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
+    cryptography
     xmltodict
   ];
 
-  pythonImportsCheck = [ "aioruckus" ];
-
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [ "aioruckus" ];
+
   disabledTests = [
-    # these require a local ruckus device
+    # Those tests require a local ruckus device
     "test_ap_info"
     "test_authentication_error"
     "test_connect_success"
diff --git a/pkgs/development/python-modules/aiorussound/default.nix b/pkgs/development/python-modules/aiorussound/default.nix
index 268e791cd0fd..a71111fccc89 100644
--- a/pkgs/development/python-modules/aiorussound/default.nix
+++ b/pkgs/development/python-modules/aiorussound/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "aiorussound";
-  version = "2.3.1";
+  version = "2.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "noahhusby";
     repo = "aiorussound";
     rev = "refs/tags/${version}";
-    hash = "sha256-wFpW+X10dGezMnzjGJsXyWMy6H8PtzhQFRCaf+A2L74=";
+    hash = "sha256-lQDHwm6dpernRYktu6eqV8uP7FHHHAU28viLg0q58+8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aioshelly/default.nix b/pkgs/development/python-modules/aioshelly/default.nix
index ffb496df6973..55356c9f47e5 100644
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "11.1.0";
+  version = "11.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "aioshelly";
     rev = "refs/tags/${version}";
-    hash = "sha256-uCvwqGsQuiFRhpEj9mIBNE8JsG/3uvMptzOXOwUhY3o=";
+    hash = "sha256-+h7xRKTI5S+NQ0IdC2DJywQRIWUUd1mHti6K7VPhBAc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiosql/default.nix b/pkgs/development/python-modules/aiosql/default.nix
index 5afa301ea9ef..5f587ef0159c 100644
--- a/pkgs/development/python-modules/aiosql/default.nix
+++ b/pkgs/development/python-modules/aiosql/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aiosql";
-  version = "10.2";
+  version = "10.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "nackjicholson";
     repo = "aiosql";
     rev = "refs/tags/${version}";
-    hash = "sha256-o88pKxvK7fT+ocemiY58yA6fTmgg8+QsztHU3OvcDAo=";
+    hash = "sha256-TETZxIbC7pdak3m1rBwDg7L1yah/bin6iOZD/uANh48=";
   };
 
   sphinxRoot = "docs/source";
diff --git a/pkgs/development/python-modules/aiounifi/default.nix b/pkgs/development/python-modules/aiounifi/default.nix
index b9c3534c36d6..1d325c1eb803 100644
--- a/pkgs/development/python-modules/aiounifi/default.nix
+++ b/pkgs/development/python-modules/aiounifi/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "aiounifi";
-  version = "79";
+  version = "80";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = "aiounifi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-okyUjHWzm2LKyDSmE93qbc8XK4fMQMr9R0L/W7GSeUw=";
+    hash = "sha256-320ptaKT+6mKUj9y+MvGovp4/XVbYIlDTb9lLXY7c1w=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index d70fc9204241..bdda94a0f499 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.40.3";
+  version = "0.40.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "bellows";
     rev = "refs/tags/${version}";
-    hash = "sha256-JGc5jDvEZtYyYAExRnN1K5hDY3ioS3+mm7jMrR0RyXk=";
+    hash = "sha256-9YReXaD4qmd2gzbGwzhslzT4K3ajCQrCN7TVl/6fOMU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bluetooth-adapters/default.nix b/pkgs/development/python-modules/bluetooth-adapters/default.nix
index 10e5633927e8..4b56028b75d9 100644
--- a/pkgs/development/python-modules/bluetooth-adapters/default.nix
+++ b/pkgs/development/python-modules/bluetooth-adapters/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-adapters";
-  version = "0.19.3";
+  version = "0.19.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "bluetooth-adapters";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yRGlp3hykxdWnJde/VF6CwQgP6cupj1BCW7OmFNQAbM=";
+    hash = "sha256-XpPC7FVWzdEki6kdZDu0vV7iD1DZzGbI1f9VKxsjKUQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bork/default.nix b/pkgs/development/python-modules/bork/default.nix
index 44a8564558e9..9da54dc1ec69 100644
--- a/pkgs/development/python-modules/bork/default.nix
+++ b/pkgs/development/python-modules/bork/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   buildPythonPackage,
+  callPackage,
   fetchFromGitHub,
   pytestCheckHook,
   pythonOlder,
@@ -61,6 +62,8 @@ buildPythonPackage rec {
     "test_repo"
   ];
 
+  passthru.tests = callPackage ./tests.nix { };
+
   meta = with lib; {
     description = "Python build and release management tool";
     mainProgram = "bork";
diff --git a/pkgs/development/python-modules/bork/tests.nix b/pkgs/development/python-modules/bork/tests.nix
new file mode 100644
index 000000000000..7d5c84f2bc35
--- /dev/null
+++ b/pkgs/development/python-modules/bork/tests.nix
@@ -0,0 +1,28 @@
+{
+  testers,
+
+  bork,
+  cacert,
+  git,
+  pytest,
+}:
+{
+  # a.k.a. `tests.testers.runCommand.bork`
+  pytest-network = testers.runCommand {
+    name = "bork-pytest-network";
+    nativeBuildInputs = [
+      bork
+      cacert
+      git
+      pytest
+    ];
+    script = ''
+      # Copy the source tree over, and make it writeable
+      cp -r ${bork.src} bork/
+      find -type d -exec chmod 0755 '{}' '+'
+
+      pytest -v -m network bork/
+      touch $out
+    '';
+  };
+}
diff --git a/pkgs/development/python-modules/captcha/default.nix b/pkgs/development/python-modules/captcha/default.nix
index fae80969824c..b7d7e55ad4e2 100644
--- a/pkgs/development/python-modules/captcha/default.nix
+++ b/pkgs/development/python-modules/captcha/default.nix
@@ -5,24 +5,26 @@
   buildPythonPackage,
   pillow,
   pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "captcha";
-  version = "0.5.0";
+  version = "0.6.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  format = "setuptools";
-
   src = fetchFromGitHub {
     owner = "lepture";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-TPPuf0BRZPSHPSF0HuGxhjhoSyZQ7r86kSjkrztgZ5w=";
+    repo = "captcha";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5d5gts+BXS5OKVziR9cLczsD2QMXZ/n31sPEq+gPlxk=";
   };
 
-  propagatedBuildInputs = [ pillow ];
+  dependencies = [ pillow ];
+
+  nativeBuildInputs = [ setuptools ];
 
   pythonImportsCheck = [ "captcha" ];
 
diff --git a/pkgs/development/python-modules/carbon/default.nix b/pkgs/development/python-modules/carbon/default.nix
index 3cfbf3c213f9..74440cc504de 100644
--- a/pkgs/development/python-modules/carbon/default.nix
+++ b/pkgs/development/python-modules/carbon/default.nix
@@ -7,6 +7,7 @@
   txamqp,
   cachetools,
   urllib3,
+  nixosTests,
 }:
 
 buildPythonPackage rec {
@@ -31,6 +32,10 @@ buildPythonPackage rec {
     urllib3
   ];
 
+  passthru.tests = {
+    inherit (nixosTests) graphite;
+  };
+
   meta = with lib; {
     homepage = "http://graphiteapp.org/";
     description = "Backend data caching and persistence daemon for Graphite";
diff --git a/pkgs/development/python-modules/coinmetrics-api-client/default.nix b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
index c1a62bc2d753..a15b774d40e3 100644
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2024.7.11.18";
+  version = "2024.8.16.10";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-o8SVup50hD2BzQQ3Z5wANHWEhZDOl0FH7iTmYTJnkYw=";
+    hash = "sha256-HYNmDN3gzmQ7gcUSSXI7/TwDDFPDZJUSu9P0Xz1z2Tk=";
   };
 
   pythonRelaxDeps = [ "typer" ];
diff --git a/pkgs/development/python-modules/cyclopts/default.nix b/pkgs/development/python-modules/cyclopts/default.nix
index f28032ead018..e2f866016453 100644
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "cyclopts";
-  version = "2.9.6";
+  version = "2.9.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "BrianPugh";
     repo = "cyclopts";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KXqeCUbSLHzeIMDpfaNj5aVxDtVP6dlctBDbukKPLSA=";
+    hash = "sha256-RLRhZ5WneZ5aiBRtj9H6tPIZfKFd5O7wYKc8BLVPmZ8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index 18270c22331f..1d5c939de414 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -25,16 +25,16 @@
 
 buildPythonPackage rec {
   pname = "distributed";
-  version = "2024.8.0";
+  version = "2024.8.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "dask";
     repo = "distributed";
     rev = "refs/tags/${version}";
-    hash = "sha256-7Z/KKm9C/n4yFKv9KHmGhIUeddwCIZL1A/SBGJKDlbI=";
+    hash = "sha256-LKf0z/xGvMVjoG02G2doS/XOiDN2/PmR72rCmwaQqtM=";
   };
 
   postPatch = ''
@@ -77,7 +77,7 @@ buildPythonPackage rec {
   meta = {
     description = "Distributed computation in Python";
     homepage = "https://distributed.readthedocs.io/";
-    changelog = "https://github.com/dask/distributed/blob/${version}/docs/source/changelog.rst";
+    changelog = "https://github.com/dask/distributed/releases/tag/${version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ teh ];
   };
diff --git a/pkgs/development/python-modules/doorbirdpy/default.nix b/pkgs/development/python-modules/doorbirdpy/default.nix
index 49884c421b7b..acb4fab9c31b 100644
--- a/pkgs/development/python-modules/doorbirdpy/default.nix
+++ b/pkgs/development/python-modules/doorbirdpy/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitLab,
-  fetchpatch2,
   setuptools,
   aiohttp,
   aioresponses,
@@ -12,25 +11,16 @@
 
 buildPythonPackage rec {
   pname = "doorbirdpy";
-  version = "3.0.2";
+  version = "3.0.3";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "klikini";
     repo = "doorbirdpy";
     rev = "refs/tags/${version}";
-    hash = "sha256-6B4EMK41vEpmLoQLD+XN9yStLdxyHHk/Mym9J0o7Qvc=";
+    hash = "sha256-0UvzMFYKM/Sb9B2XwZwl+a9v7lTxAc1H59vR88VwDww=";
   };
 
-  patches = [
-    # https://gitlab.com/klikini/doorbirdpy/-/merge_requests/15
-    (fetchpatch2 {
-      name = "aiohttp-3.10-compat.patch";
-      url = "https://gitlab.com/klikini/doorbirdpy/-/commit/91f417433be36a0c9d2baaf0d6ff1a45042f94eb.patch";
-      hash = "sha256-b/ORH6ygkiBreWYTH7rP8b68HlFUEyLQCzVo1KLffPQ=";
-    })
-  ];
-
   build-system = [ setuptools ];
 
   dependencies = [ aiohttp ];
diff --git a/pkgs/development/python-modules/dvc-task/default.nix b/pkgs/development/python-modules/dvc-task/default.nix
index ea93ceeffda0..63b2ed18e41c 100644
--- a/pkgs/development/python-modules/dvc-task/default.nix
+++ b/pkgs/development/python-modules/dvc-task/default.nix
@@ -49,6 +49,8 @@ buildPythonPackage rec {
   disabledTests = [
     # Test is flaky
     "test_start_already_exists"
+    # Tests require a Docker setup
+    "celery_setup_worker"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ecs-logging/default.nix b/pkgs/development/python-modules/ecs-logging/default.nix
index f95fa5df1be2..9654844075f5 100644
--- a/pkgs/development/python-modules/ecs-logging/default.nix
+++ b/pkgs/development/python-modules/ecs-logging/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ecs-logging";
-  version = "2.1.0";
+  version = "2.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "elastic";
     repo = "ecs-logging-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-Gf44bT3/gmHy+yaQ1+bhCFB33ym2G14tzNqTQyC3BJU=";
+    hash = "sha256-djCEutZqcyRfRme+omiwl3ofBUBli71TnfVu59i7vlE=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/etebase/default.nix b/pkgs/development/python-modules/etebase/default.nix
index ffdad6347628..18d5488bee36 100644
--- a/pkgs/development/python-modules/etebase/default.nix
+++ b/pkgs/development/python-modules/etebase/default.nix
@@ -13,6 +13,7 @@
   Security,
   msgpack,
   fetchpatch,
+  nixosTests,
 }:
 
 buildPythonPackage rec {
@@ -70,6 +71,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "etebase" ];
 
+  passthru.tests = {
+    inherit (nixosTests) etebase-server;
+  };
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     homepage = "https://www.etebase.com/";
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index 3f7d54ac075b..4d15ed1d0d00 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.7.0";
+  version = "1.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "fastai";
     repo = "fastcore";
     rev = "refs/tags/${version}";
-    hash = "sha256-8pbAUemswRP+K8kh23u1AbVfv28+3Ykzla4cWzSFMfc=";
+    hash = "sha256-eb4J5aGrcpOcO0GBI1cwOsRxw0guvDiAPZjdFPB5SVQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/foobot-async/default.nix b/pkgs/development/python-modules/foobot-async/default.nix
index 895bccb33137..dd12bd185a95 100644
--- a/pkgs/development/python-modules/foobot-async/default.nix
+++ b/pkgs/development/python-modules/foobot-async/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "foobot-async";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "foobot_async";
     inherit version;
-    hash = "sha256-+lV6It6SUTnLSiEDT/280B0ovxZsDmgOr4SpkgYyf0A=";
+    hash = "sha256-QQjysk2m8QkOpLBdC8kfuoA9PcljgEwzKyrIAhxHB4c=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/geoparquet/default.nix b/pkgs/development/python-modules/geoparquet/default.nix
new file mode 100644
index 000000000000..ce50e2484c2d
--- /dev/null
+++ b/pkgs/development/python-modules/geoparquet/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pandas,
+  pyarrow,
+  pyproj,
+  shapely,
+  geopandas,
+  pytestCheckHook,
+}:
+
+buildPythonPackage {
+  pname = "geoparquet";
+  version = "0.7.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "darcy-r";
+    repo = "geoparquet-python";
+    rev = "b09b12dd0ebc34d73f082c3d97ccb69a889167e3";
+    hash = "sha256-WGZfDQh7Abh83n8jsCGr41IlKKq7QVDlauuWi20llh8=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    pandas
+    pyarrow
+    pyproj
+    shapely
+    geopandas
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  pythonImportCheck = "geoparquet";
+
+  doCheck = false; # no tests
+
+  meta = {
+    description = "API between Parquet files and GeoDataFrames for fast input/output of GIS data";
+    homepage = "https://github.com/darcy-r/geoparquet-python";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+}
diff --git a/pkgs/development/python-modules/gradio-pdf/default.nix b/pkgs/development/python-modules/gradio-pdf/default.nix
index fc32e80a8c1b..47c175697586 100644
--- a/pkgs/development/python-modules/gradio-pdf/default.nix
+++ b/pkgs/development/python-modules/gradio-pdf/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "gradio-pdf";
-  version = "0.0.11";
+  version = "0.0.13";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "gradio_pdf";
     inherit version;
-    hash = "sha256-HCfjJdd9DIRqm/dS00xlU9AYGM7U/b3zNo2IgZHtasc=";
+    hash = "sha256-lxfbQSJavJQSYMGqxG7zmg/XT8V8TU2I3zGiq+B/dnw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/gradio/client.nix b/pkgs/development/python-modules/gradio/client.nix
index ed2d52c30c39..327a242a6a21 100644
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   nix-update-script,
@@ -27,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "gradio-client";
-  version = "1.2.0";
+  version = "1.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -39,7 +40,7 @@ buildPythonPackage rec {
     # not to be confused with @gradio/client@${version}
     rev = "refs/tags/gradio_client@${version}";
     sparseCheckout = [ "client/python" ];
-    hash = "sha256-l5WHNerSYNXrFGOpAqxxh0JLiFpatxq6a62q83tEavo=";
+    hash = "sha256-UZQWguUN3l0cj2wb2f7A61RTLy9nPYcIEwHIo+F1kR0=";
   };
   prePatch = ''
     cd client/python
@@ -91,6 +92,14 @@ buildPythonPackage rec {
     #"-x" "-W" "ignore" # uncomment for debugging help
   ];
 
+  disabledTests = lib.optionals stdenv.isDarwin [
+    # flaky: OSError: Cannot find empty port in range: 7860-7959
+    "test_layout_components_in_output"
+    "test_layout_and_state_components_in_output"
+    "test_upstream_exceptions"
+    "test_httpx_kwargs"
+  ];
+
   pythonImportsCheck = [ "gradio_client" ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index a25d8baa10d3..076bf7918920 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -47,6 +47,7 @@
 
   # check
   pytestCheckHook,
+  hypothesis,
   altair,
   boto3,
   gradio-pdf,
@@ -63,7 +64,7 @@
 
 buildPythonPackage rec {
   pname = "gradio";
-  version = "4.40.0";
+  version = "4.41.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -71,7 +72,7 @@ buildPythonPackage rec {
   # We use the Pypi release, since it provides prebuilt webui assets
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ChV5E6RfFcOwW6uFqU4/phfHfn27yS8+MKjMVytnlgU=";
+    hash = "sha256-d4li7kQFMzlUVGdm2nTSnj25pTOWIqnZuOvTOtwPLpc=";
   };
 
   # fix packaging.ParserSyntaxError, which can't handle comments
@@ -133,6 +134,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    hypothesis
     altair
     boto3
     gradio-pdf
@@ -187,6 +189,9 @@ buildPythonPackage rec {
 
     # flaky: OSError: Cannot find empty port in range: 7860-7959
     "test_docs_url"
+    "test_orjson_serialization"
+    "test_dataset_is_updated"
+    "test_multimodal_api"
 
     # tests if pip and other tools are installed
     "test_get_executable_path"
@@ -245,8 +250,8 @@ buildPythonPackage rec {
     "test/test_networking.py"
     # makes pytest freeze 50% of the time
     "test/test_interfaces.py"
-  ] ++ lib.optionals stdenv.isDarwin [
-    # Network-related tests that are flaky on darwin (depend on port availability)
+
+    # Local network tests dependant on port availability (port 7860-7959)
     "test/test_routes.py"
   ];
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/graphite-web/default.nix b/pkgs/development/python-modules/graphite-web/default.nix
index 2a861bd8d339..cda30828836d 100644
--- a/pkgs/development/python-modules/graphite-web/default.nix
+++ b/pkgs/development/python-modules/graphite-web/default.nix
@@ -17,6 +17,7 @@
   txamqp,
   urllib3,
   whisper,
+  nixosTests,
 }:
 
 buildPythonPackage rec {
@@ -94,6 +95,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "graphite" ];
 
+  passthru.tests = {
+    inherit (nixosTests) graphite;
+  };
+
   meta = with lib; {
     description = "Enterprise scalable realtime graphing";
     homepage = "http://graphiteapp.org/";
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index 64694b89471c..03f22c61a01b 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -6,6 +6,7 @@
   fetchFromGitHub,
   git,
   jsonschema,
+  mkdocstrings,
   pdm-backend,
   pytestCheckHook,
   pythonOlder,
@@ -13,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "0.47.0";
+  version = "1.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,12 +23,15 @@ buildPythonPackage rec {
     owner = "mkdocstrings";
     repo = "griffe";
     rev = "refs/tags/${version}";
-    hash = "sha256-NkS8cD0G/nbquQfMVcdbTLnJx26PQnqWB8UnBTNIBdE=";
+    hash = "sha256-GRj60qL+gXjUUAxhyTN7f1Jkuucl0+MstbDEqGVx3zs=";
   };
 
   build-system = [ pdm-backend ];
 
-  dependencies = [ colorama ];
+  dependencies = [
+    colorama
+    mkdocstrings
+  ];
 
   nativeCheckInputs = [
     git
diff --git a/pkgs/development/python-modules/imageio-ffmpeg/default.nix b/pkgs/development/python-modules/imageio-ffmpeg/default.nix
index 250f5ea64b18..b000d560a56f 100644
--- a/pkgs/development/python-modules/imageio-ffmpeg/default.nix
+++ b/pkgs/development/python-modules/imageio-ffmpeg/default.nix
@@ -29,15 +29,10 @@ buildPythonPackage rec {
   patches = [
     (substituteAll {
       src = ./ffmpeg-path.patch;
-      ffmpeg = "${ffmpeg}/bin/ffmpeg";
+      ffmpeg = lib.getExe ffmpeg;
     })
   ];
 
-  # https://github.com/imageio/imageio-ffmpeg/issues/59
-  postPatch = ''
-    sed -i '/setup_requires=\["pip>19"\]/d' setup.py
-  '';
-
   build-system = [ setuptools ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/inform/default.nix b/pkgs/development/python-modules/inform/default.nix
index e4397954dd66..ab08f740e674 100644
--- a/pkgs/development/python-modules/inform/default.nix
+++ b/pkgs/development/python-modules/inform/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "inform";
-  version = "1.30";
+  version = "1.31";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "KenKundert";
     repo = "inform";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6Yx9ZdmrFApJ6zBiC8Q++hlATVqjriJLS2KsqC0IBCk=";
+    hash = "sha256-o7yH7jCNn9gbcr7NMJVaYQOJ7hvwaY2ur1FyEP40Cco=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/jupyterhub/default.nix b/pkgs/development/python-modules/jupyterhub/default.nix
index 543564b606ea..38a2fc97a662 100644
--- a/pkgs/development/python-modules/jupyterhub/default.nix
+++ b/pkgs/development/python-modules/jupyterhub/default.nix
@@ -42,7 +42,7 @@
 
 buildPythonPackage rec {
   pname = "jupyterhub";
-  version = "5.0.0";
+  version = "5.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -51,12 +51,12 @@ buildPythonPackage rec {
     owner = "jupyterhub";
     repo = "jupyterhub";
     rev = "refs/tags/${version}";
-    hash = "sha256-YGDbyWe3JSXbluOX6qyLqzl92Z/f5sD/5TPc2LR7W80=";
+    hash = "sha256-3L83FLhLCdTgOuFRgRMbz316cYbai0Z+hJwxXUCYB2Y=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-7G/Y2yaMi9cyf20/o8rLXKIE6SdZ74HSWJ3Wfypl4Cc=";
+    hash = "sha256-b7j6iGYXrwco4YruqRPEEi4yWRF6otTUD2jKCEPcLTE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/langfuse/default.nix b/pkgs/development/python-modules/langfuse/default.nix
index 05b65c0cd137..c5d40d514835 100644
--- a/pkgs/development/python-modules/langfuse/default.nix
+++ b/pkgs/development/python-modules/langfuse/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  anyio,
   backoff,
   httpx,
   idna,
@@ -16,22 +17,22 @@
 
 buildPythonPackage rec {
   pname = "langfuse";
-  version = "2.36.2";
+  version = "2.43.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langfuse";
     repo = "langfuse-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7snmEjRRciYaxUm0wUwQn5HKTvQOPVH5rXVUGZ+BXgk=";
+    hash = "sha256-pS3JF+9AfPkK3EmQOipVs5SJs0fWsZhudg4uNPH+6p8=";
   };
 
   build-system = [ poetry-core ];
 
-
   pythonRelaxDeps = [ "packaging" ];
 
   dependencies = [
+    anyio
     backoff
     httpx
     idna
diff --git a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
index f43cf4c4afee..55bc5da3fd35 100644
--- a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
@@ -11,6 +11,7 @@
   autobahn,
   treq,
   mock,
+  nixosTests,
   pythonOlder,
   pythonAtLeast,
   pytestCheckHook,
@@ -58,6 +59,10 @@ buildPythonPackage rec {
     "src/wormhole_mailbox_server/test/test_web.py"
   ];
 
+  passthru.tests = {
+    inherit (nixosTests) magic-wormhole-mailbox-server;
+  };
+
   meta = {
     description = "Securely transfer data between computers";
     homepage = "https://github.com/magic-wormhole/magic-wormhole-mailbox-server";
diff --git a/pkgs/development/python-modules/minidump/default.nix b/pkgs/development/python-modules/minidump/default.nix
index 1154685e6dda..d50fdfaeedfc 100644
--- a/pkgs/development/python-modules/minidump/default.nix
+++ b/pkgs/development/python-modules/minidump/default.nix
@@ -8,17 +8,17 @@
 
 buildPythonPackage rec {
   pname = "minidump";
-  version = "0.0.23";
+  version = "0.0.24";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-R+tza5C/2egkajScmilp/8qowoSklYVfEB+f0KMNBqQ=";
+    hash = "sha256-964JuUTzsXzPXOzGb5/1p6RbBTR0oTrrAS9MkgRHBDc=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   # Upstream doesn't have tests
   doCheck = false;
@@ -27,10 +27,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python library to parse and read Microsoft minidump file format";
-    mainProgram = "minidump";
     homepage = "https://github.com/skelsec/minidump";
     changelog = "https://github.com/skelsec/minidump/releases/tag/${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "minidump";
   };
 }
diff --git a/pkgs/development/python-modules/mkdocs-material/default.nix b/pkgs/development/python-modules/mkdocs-material/default.nix
index b5f17fbe9cd4..01801998bcff 100644
--- a/pkgs/development/python-modules/mkdocs-material/default.nix
+++ b/pkgs/development/python-modules/mkdocs-material/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-material";
-  version = "9.5.30";
+  version = "9.5.31";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "squidfunk";
     repo = "mkdocs-material";
     rev = "refs/tags/${version}";
-    hash = "sha256-VgOPmOwPAwTqCCDxtiQ3dReTdjfXYL7/1CdSqTgw+uo=";
+    hash = "sha256-fzTyQ4YFBa5mm8bUKWR50d0qoGJoNIVbFobnVpK1FZg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocstrings-python/default.nix b/pkgs/development/python-modules/mkdocstrings-python/default.nix
index fc72540e9d56..60c12fb9c332 100644
--- a/pkgs/development/python-modules/mkdocstrings-python/default.nix
+++ b/pkgs/development/python-modules/mkdocstrings-python/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocstrings-python";
-  version = "1.10.5";
+  version = "1.10.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "mkdocstrings";
     repo = "python";
     rev = "refs/tags/${version}";
-    hash = "sha256-LRBo404TGxWBQdhN3gTyDHjB389hcHCfZK/oEFdjpOY=";
+    hash = "sha256-3fXT2cV9jXkBNqK0LhKh8V11YLz+ulR3yAtq3GVOkTU=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/model-checker/default.nix b/pkgs/development/python-modules/model-checker/default.nix
index f06f4ed471a6..3de3be17c546 100644
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@@ -2,14 +2,15 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  setuptools,
   pythonOlder,
+  setuptools,
+  tqdm,
   z3-solver,
 }:
 
 buildPythonPackage rec {
   pname = "model-checker";
-  version = "0.4.12";
+  version = "0.5.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "model_checker";
     inherit version;
-    hash = "sha256-bgVtOpWx5jytVxSz/WKLqLm+hVKbwIy+Fy5nEj/Nwt4=";
+    hash = "sha256-dt2/1qY0kyD0K0/d1NJa3q0NrwinmWb8Zd/Shtqj9Ow=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail
@@ -26,7 +27,10 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
 
 
-  dependencies = [ z3-solver ];
+  dependencies = [
+    tqdm
+    z3-solver
+  ];
 
   # Tests have multiple issues, ImportError, TypeError, etc.
   # Check with the next release > 0.3.13
diff --git a/pkgs/development/python-modules/molecule/default.nix b/pkgs/development/python-modules/molecule/default.nix
index 67100465874e..834b336f48bc 100644
--- a/pkgs/development/python-modules/molecule/default.nix
+++ b/pkgs/development/python-modules/molecule/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "molecule";
-  version = "24.7.0";
+  version = "24.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2yx/pZkj6b8j1hqSpbGdaIHsnuX+lu2enp1wCwJyPwM=";
+    hash = "sha256-FAc4kE6fF4FXgFaKxAjJ9zu54qxyHjRoWjWebTUH5nc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/myjwt/default.nix b/pkgs/development/python-modules/myjwt/default.nix
index e7c80a480167..78e368360a41 100644
--- a/pkgs/development/python-modules/myjwt/default.nix
+++ b/pkgs/development/python-modules/myjwt/default.nix
@@ -20,23 +20,18 @@
 
 buildPythonPackage rec {
   pname = "myjwt";
-  version = "1.6.1";
+  version = "2.1.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "mBouamama";
     repo = "MyJWT";
     rev = "refs/tags/${version}";
-    hash = "sha256-qdDA8DpJ9kAPTvCkQcPBHNlUqxwsS0vAESglvUygXhg=";
+    hash = "sha256-jqBnxo7Omn5gLMCQ7SNbjo54nyFK7pn94796z2Qc9lg=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "1.6.0" "${version}"
-  '';
-
   pythonRelaxDeps = [
     "cryptography"
     "pyopenssl"
diff --git a/pkgs/development/python-modules/nutils/default.nix b/pkgs/development/python-modules/nutils/default.nix
index 4495a40118be..f8ac839989fa 100644
--- a/pkgs/development/python-modules/nutils/default.nix
+++ b/pkgs/development/python-modules/nutils/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "nutils";
-  version = "8.7";
+  version = "8.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "evalf";
     repo = "nutils";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wxouS0FXrdIhm6nTVBuzkwHceJnZ7f7k8nMFxFsZchE=";
+    hash = "sha256-E/y1YXW+0+LfntRQsdIU9rMOmN8mlFwXktD/sViJo3I=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/openwebifpy/default.nix b/pkgs/development/python-modules/openwebifpy/default.nix
index 086f16fd81de..1dd4ab8a8f2b 100644
--- a/pkgs/development/python-modules/openwebifpy/default.nix
+++ b/pkgs/development/python-modules/openwebifpy/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "openwebifpy";
-  version = "4.2.6";
+  version = "4.2.7";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-znMTbKQlklzOKMmlsPiM1JJ1VMB4HK5uMXoBay2Ow4A=";
+    hash = "sha256-MoTSfoO6km3jAaF9oIDxhxhMI8jqZAyPD6yBYcYxhd4=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/optimum/default.nix b/pkgs/development/python-modules/optimum/default.nix
index 844c6f1e6f98..f3388356962e 100644
--- a/pkgs/development/python-modules/optimum/default.nix
+++ b/pkgs/development/python-modules/optimum/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "optimum";
-  version = "1.21.3";
+  version = "1.21.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "optimum";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eEfKWBwhtDkoAhsLH8P2ybM7aF/d2yREIv7/5RVz0Z8=";
+    hash = "sha256-ElF+RmZjsXhaA8yhTEK2kp5gigGheyJL36R8e0hSgzA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pbs-installer/default.nix b/pkgs/development/python-modules/pbs-installer/default.nix
index fb0068dd31a6..8ab7896ea0d1 100644
--- a/pkgs/development/python-modules/pbs-installer/default.nix
+++ b/pkgs/development/python-modules/pbs-installer/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pbs-installer";
-  version = "2024.4.24";
+  version = "2024.08.14";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "frostming";
     repo = "pbs-installer";
     rev = "refs/tags/${version}";
-    hash = "sha256-a35xQEdo7OOFlXk2vsTdVpEhqPRKFZRQzNnZw3c7ybA=";
+    hash = "sha256-Hitd7Ze8pujkRBoTapP5SekpdiDwJz/0UNe0wW7eaRA=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/prisma/default.nix b/pkgs/development/python-modules/prisma/default.nix
index 1f9b8dff5eeb..db89649a6a63 100644
--- a/pkgs/development/python-modules/prisma/default.nix
+++ b/pkgs/development/python-modules/prisma/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "prisma";
-  version = "0.14.0";
+  version = "0.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "RobertCraigie";
     repo = "prisma-client-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PeKRH+6/D5/VxnhRFhpvtZ85OL8mJDhG7QLn4oRUvfE=";
+    hash = "sha256-F+Up1HHslralt3NvZZ/wT+CKvzKOjhEEuMEeT0L6NZM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/private-gpt/default.nix b/pkgs/development/python-modules/private-gpt/default.nix
index 8c4c1545c350..2824587d7c25 100644
--- a/pkgs/development/python-modules/private-gpt/default.nix
+++ b/pkgs/development/python-modules/private-gpt/default.nix
@@ -17,6 +17,7 @@
   gradio,
   fetchurl,
   fetchpatch,
+  nixosTests,
 }:
 
 buildPythonPackage rec {
@@ -87,6 +88,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "private_gpt" ];
 
+  passthru.tests = {
+    inherit (nixosTests) private-gpt;
+  };
+
   meta = {
     changelog = "https://github.com/zylon-ai/private-gpt/blob/${src.rev}/CHANGELOG.md";
     description = "Interact with your documents using the power of GPT, 100% privately, no data leaks";
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index c8c0a4240260..c87063d78192 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "6.48.0";
+  version = "6.49.0";
 
   pyproject = true;
   build-system = [ setuptools ];
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Q4peAFlwH1th/WZawg0QF5SdKHJkytJoy9aMw0b9Ak4=";
+    hash = "sha256-xsQVPJgO4c42GXgVGkCnZT1Jhve1InEXrt1Fpwc4UX4=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/pure-protobuf/default.nix b/pkgs/development/python-modules/pure-protobuf/default.nix
index 5bbed7bb1b8d..df72926be397 100644
--- a/pkgs/development/python-modules/pure-protobuf/default.nix
+++ b/pkgs/development/python-modules/pure-protobuf/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pure-protobuf";
-  version = "3.1.1";
+  version = "3.1.2";
 
   format = "pyproject";
   # < 3.10 requires get-annotations which isn't packaged yet
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "eigenein";
     repo = "protobuf";
     rev = "refs/tags/${version}";
-    hash = "sha256-xcW6ODL0UqwVesqIUxxzN5EuXK8hE4rY1inatuM1UpI=";
+    hash = "sha256-up/01Q2IdaW41Ple+nCRpWjYnl/IAlOppdGcg4djRZY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/py-synologydsm-api/default.nix b/pkgs/development/python-modules/py-synologydsm-api/default.nix
index 143a3159b8fe..93a5f245ff1b 100644
--- a/pkgs/development/python-modules/py-synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/py-synologydsm-api/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "2.4.4";
+  version = "2.4.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mib1185";
     repo = "py-synologydsm-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-46KoOKBiulTYH2x8ftFPVDF0oeBG1Pe9PkonxIV7528=";
+    hash = "sha256-aVU+E5TwGIH+y7qtS5pBkW14EbZI6kb1Hy2zEqk1nrk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyais/default.nix b/pkgs/development/python-modules/pyais/default.nix
index 9749114a4090..8b8d98d61318 100644
--- a/pkgs/development/python-modules/pyais/default.nix
+++ b/pkgs/development/python-modules/pyais/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyais";
-  version = "2.7.0";
+  version = "2.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "M0r13n";
     repo = "pyais";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6Bv0YE2zQv0mdXNzHkhq4sOJ18nmyxO884Smzwn2c8I=";
+    hash = "sha256-EUbEVhriJAlxr4g+iPzeyftrF+qtdIqvvljKKihK3C8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyannote-audio/default.nix b/pkgs/development/python-modules/pyannote-audio/default.nix
index 7507b56528e0..3a3ee228bcc8 100644
--- a/pkgs/development/python-modules/pyannote-audio/default.nix
+++ b/pkgs/development/python-modules/pyannote-audio/default.nix
@@ -1,30 +1,32 @@
 {
   lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  wheel,
   asteroid-filterbanks,
+  buildPythonPackage,
   einops,
+  fetchFromGitHub,
   huggingface-hub,
-  pytorch-lightning,
+  hydra-core,
+  numpy,
   omegaconf,
   pyannote-core,
   pyannote-database,
   pyannote-metrics,
   pyannote-pipeline,
+  pyscaffold,
+  pythonOlder,
+  pytorch-lightning,
   pytorch-metric-learning,
   rich,
   semver,
+  setuptools,
   soundfile,
   speechbrain,
   tensorboardx,
-  torch,
   torch-audiomentations,
+  torch,
   torchaudio,
   torchmetrics,
-  numpy,
-  pyscaffold,
+  typer,
 }:
 
 buildPythonPackage rec {
@@ -32,6 +34,8 @@ buildPythonPackage rec {
   version = "3.3.0";
   pyproject = true;
 
+  disabled = pythonOlder "3.9";
+
   src = fetchFromGitHub {
     owner = "pyannote";
     repo = "pyannote-audio";
@@ -40,20 +44,21 @@ buildPythonPackage rec {
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [
+  pythonRelaxDeps = [ "torchaudio" ];
+
+  build-system = [
     pyscaffold
     setuptools
-    wheel
   ];
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "pyscaffold>=3.2a0,<3.3a0" "pyscaffold"
+      --replace-fail "pyscaffold>=3.2a0,<3.3a0" "pyscaffold"
     substituteInPlace requirements.txt \
-      --replace "lightning" "pytorch-lightning"
+      --replace-fail "lightning" "pytorch-lightning"
   '';
 
-  propagatedBuildInputs = [
+  dependencies = [
     asteroid-filterbanks
     einops
     huggingface-hub
@@ -76,6 +81,13 @@ buildPythonPackage rec {
     pytorch-lightning
   ];
 
+  optional-dependencies = {
+    cli = [
+      hydra-core
+      typer
+    ];
+  };
+
   pythonImportsCheck = [ "pyannote.audio" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pybravia/default.nix b/pkgs/development/python-modules/pybravia/default.nix
index b94efc55b3c9..fdb66df306af 100644
--- a/pkgs/development/python-modules/pybravia/default.nix
+++ b/pkgs/development/python-modules/pybravia/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pybravia";
-  version = "0.3.3";
+  version = "0.3.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Drafteed";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Ux9EereKKbgaVQORliW6J5FSBlytLM+m4PVFBk+OW6k=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-1LfYEVclRneU3eD52kvzjLYyGdzYSWVDQ5EADOviglw=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pyenphase/default.nix b/pkgs/development/python-modules/pyenphase/default.nix
index 613fb911c85e..a96386890be1 100644
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -10,6 +10,7 @@
   poetry-core,
   pyjwt,
   pytest-asyncio,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   respx,
@@ -31,10 +32,7 @@ buildPythonPackage rec {
     hash = "sha256-letF0s/zJKdMT2nGnZpMFufja0bsL0zlwG+dCSK5BA4=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail " --cov=pyenphase --cov-report=term-missing:skip-covered" ""
-  '';
+  pythonRelaxDeps = [ "tenacity" ];
 
   build-system = [ poetry-core ];
 
@@ -50,14 +48,15 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest-asyncio
+    pytest-cov-stub
     pytestCheckHook
     respx
     syrupy
   ];
 
-  disabledTests = [
-    # https://github.com/pyenphase/pyenphase/issues/97
-    "test_with_7_x_firmware"
+  disabledTestPaths = [
+    # Tests need network access
+    "tests/test_retries.py"
   ];
 
   pythonImportsCheck = [ "pyenphase" ];
diff --git a/pkgs/development/python-modules/pyhomeworks/default.nix b/pkgs/development/python-modules/pyhomeworks/default.nix
index 5cb1d95c26d1..f21de3ee95dc 100644
--- a/pkgs/development/python-modules/pyhomeworks/default.nix
+++ b/pkgs/development/python-modules/pyhomeworks/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyhomeworks";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9S0SYn4e/qaCRgdwlU4gPaj0eKAQJrYigvAP6eaPzRM=";
+    hash = "sha256-RwaVjOhMztQsKD+F++PLcwa0gqfC+8aQmloMVnQJjv8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pylutron-caseta/default.nix b/pkgs/development/python-modules/pylutron-caseta/default.nix
index 7d5ef3a92258..2bd1368ffb02 100644
--- a/pkgs/development/python-modules/pylutron-caseta/default.nix
+++ b/pkgs/development/python-modules/pylutron-caseta/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pylutron-caseta";
-  version = "0.21.0";
+  version = "0.21.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "gurumitts";
     repo = "pylutron-caseta";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rmf1ydPfA6rCpWB4TZXAK9MDpsPpahsT7xm/dUrMW+0=";
+    hash = "sha256-u2FPWDWBSoS5mJPnYAkLTQR6K8YLDs77djdWL+7840o=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/pyseventeentrack/default.nix b/pkgs/development/python-modules/pyseventeentrack/default.nix
index 8433e5590eea..1029c1f50e53 100644
--- a/pkgs/development/python-modules/pyseventeentrack/default.nix
+++ b/pkgs/development/python-modules/pyseventeentrack/default.nix
@@ -4,7 +4,6 @@
   attrs,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch2,
   lib,
   poetry-core,
   pytestCheckHook,
@@ -13,25 +12,16 @@
 
 buildPythonPackage rec {
   pname = "pyseventeentrack";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "shaiu";
     repo = "pyseventeentrack";
     rev = "refs/tags/v${version}";
-    hash = "sha256-J5pYtJrEvShRXE/NwbYdmcUhCc5dmDZmJWS550NvRD0=";
+    hash = "sha256-AHFJu2z3UWBR6BzwdxAKl3wpqBnsyj8pn16z1rgFVpw=";
   };
 
-  patches = [
-    # https://github.com/shaiu/pyseventeentrack/pull/4
-    (fetchpatch2 {
-      name = "use-poetry-core.patch";
-      url = "https://github.com/shaiu/pyseventeentrack/commit/6feef4fb29544933836de0a9c06bf85e5105c8bf.patch";
-      hash = "sha256-l6lHWRAoRhYouNT43nb7fYA4RMsmC6rCJOKYTJN8vAU=";
-    })
-  ];
-
   build-system = [ poetry-core ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/pytest-ansible/default.nix b/pkgs/development/python-modules/pytest-ansible/default.nix
index 5832ff98e668..12e9d62c9549 100644
--- a/pkgs/development/python-modules/pytest-ansible/default.nix
+++ b/pkgs/development/python-modules/pytest-ansible/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-ansible";
-  version = "24.7.0";
+  version = "24.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "ansible";
     repo = "pytest-ansible";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yrdfVWXcTB6WKDUnm4wDdKZGWq9F7oOT0RP42xyASRw=";
+    hash = "sha256-+kGVSutTKO6eGH6oHSZ86Hp4jLbofYDcvsiJRXSGQHE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytest-docker-tools/default.nix b/pkgs/development/python-modules/pytest-docker-tools/default.nix
new file mode 100644
index 000000000000..59a98ad27152
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-docker-tools/default.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  docker,
+  fetchFromGitHub,
+  fetchpatch,
+  poetry-core,
+  pytest,
+  pytestCheckHook,
+  pythonOlder,
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-docker-tools";
+  version = "3.1.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "Jc2k";
+    repo = "pytest-docker-tools";
+    rev = "refs/tags/${version}";
+    hash = "sha256-6F3aSUyDlBBYG1kwOQvey7rujDdK83uJ3Q1dr8Uo1pw=";
+  };
+
+  patches = [
+    # Switch to poetry-core, https://github.com/Jc2k/pytest-docker-tools/pull/48
+    (fetchpatch {
+      name = "switch-poetry-core.patch";
+      url = "https://github.com/Jc2k/pytest-docker-tools/pull/48/commits/a655e4a32b075e06e89dd907b06bc4ad90703988.patch";
+      hash = "sha256-CwCBld7p+bqBfxV9IyxcCvfxXfnUSzCLF2m0ZduIqkU=";
+    })
+  ];
+
+  build-system = [ poetry-core ];
+
+  buildInputs = [ pytest ];
+
+  dependencies = [ docker ];
+
+  # Tests require a Docker setup
+  doCheck = false;
+
+  pythonImportsCheck = [ "pytest_docker_tools" ];
+
+  meta = with lib; {
+    description = "Opionated helpers for creating py.test fixtures for Docker integration and smoke testing environments";
+    homepage = "https://github.com/Jc2k/pytest-docker-tools";
+    changelog = "https://github.com/Jc2k/pytest-docker-tools/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytest-twisted/default.nix b/pkgs/development/python-modules/pytest-twisted/default.nix
index 29ae8e462498..93e74cf1c01a 100644
--- a/pkgs/development/python-modules/pytest-twisted/default.nix
+++ b/pkgs/development/python-modules/pytest-twisted/default.nix
@@ -1,7 +1,8 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  setuptools,
   greenlet,
   pytest,
   decorator,
@@ -11,17 +12,21 @@
 
 buildPythonPackage rec {
   pname = "pytest-twisted";
-  version = "1.14.1";
-  format = "setuptools";
+  version = "1.14.2";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-qbGLyfykfSiG+O/j/SeHmoHxwLtJ8cVgZmyedkSRtjI=";
+  src = fetchFromGitHub {
+    owner = "pytest-dev";
+    repo = "pytest-twisted";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-1NkKTdk5D36VngJtBEdT42o1MmMT6stBne9KyC17518=";
   };
 
+  build-system = [ setuptools ];
+
   buildInputs = [ pytest ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     decorator
     greenlet
   ];
@@ -34,6 +39,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pytest_twisted" ];
 
   meta = with lib; {
+    changelog = "https://github.com/pytest-dev/pytest-twisted/releases/tag/v${version}";
     description = "Twisted plugin for py.test";
     homepage = "https://github.com/pytest-dev/pytest-twisted";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/pytrydan/default.nix b/pkgs/development/python-modules/pytrydan/default.nix
index f854448f6ae3..90de83155562 100644
--- a/pkgs/development/python-modules/pytrydan/default.nix
+++ b/pkgs/development/python-modules/pytrydan/default.nix
@@ -6,6 +6,7 @@
   orjson,
   poetry-core,
   pytest-asyncio,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   respx,
@@ -29,10 +30,7 @@ buildPythonPackage rec {
     hash = "sha256-OHC+Ul64BYCsgoFDxI1hPjBGkd/pQ0j0c9Pt5lWg1E0=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail " --cov=pytrydan --cov-report=term-missing:skip-covered" ""
-  '';
+  pythonRelaxDeps = [ "tenacity" ];
 
   build-system = [ poetry-core ];
 
@@ -46,6 +44,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest-asyncio
+    pytest-cov-stub
     pytestCheckHook
     respx
     syrupy
diff --git a/pkgs/development/python-modules/pyttsx3/default.nix b/pkgs/development/python-modules/pyttsx3/default.nix
index 8650e0c54fe4..df854d4073f8 100644
--- a/pkgs/development/python-modules/pyttsx3/default.nix
+++ b/pkgs/development/python-modules/pyttsx3/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "pyttsx3";
-  version = "2.90";
+  version = "2.91";
   format = "wheel";
 
   src = fetchPypi {
     inherit pname version format;
-    sha256 = "a585b6d8cffc19bd92db1e0ccbd8aa9c6528dd2baa5a47045d6fed542a44aa19";
+    sha256 = "sha256-jxkhfE1lpGhw4LgvLn6xVw7CssqAUX++7gleVPdvc+I=";
     dist = "py3";
     python = "py3";
   };
diff --git a/pkgs/development/python-modules/quantile-forest/default.nix b/pkgs/development/python-modules/quantile-forest/default.nix
index 4cd74184b89f..3f2e4979f192 100644
--- a/pkgs/development/python-modules/quantile-forest/default.nix
+++ b/pkgs/development/python-modules/quantile-forest/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "quantile-forest";
-  version = "1.3.7";
+  version = "1.3.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "zillow";
     repo = "quantile-forest";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3EcluHUDtAYfaHycgyCAaolRcChecrPRnMaUFrpzMIQ=";
+    hash = "sha256-/BY34xxEWpmUcbITBUX2nGZ8ZOjKDPwiA6Vui0CvsBc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/rstcheck/default.nix b/pkgs/development/python-modules/rstcheck/default.nix
index 259b460e9e09..a403db708681 100644
--- a/pkgs/development/python-modules/rstcheck/default.nix
+++ b/pkgs/development/python-modules/rstcheck/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "rstcheck";
-  version = "6.2.1";
+  version = "6.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "rstcheck";
     repo = "rstcheck";
     rev = "refs/tags/v${version}";
-    hash = "sha256-S04l+x/rIc/XSvq2lSKCQp6KK5mmKI2mOgPgJ3WKe5M=";
+    hash = "sha256-CB8UtYAJpPrUOGgHOIp9Ts0GaID6GdtKHWD/ihxRoNg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/softlayer/default.nix b/pkgs/development/python-modules/softlayer/default.nix
index ecb04654073a..b2238da2916f 100644
--- a/pkgs/development/python-modules/softlayer/default.nix
+++ b/pkgs/development/python-modules/softlayer/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "softlayer";
-  version = "6.2.4";
+  version = "6.2.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "softlayer-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Hl3nW31EoqjziYMeeHip/Ieq8eYLa7//qrENThPa7ns=";
+    hash = "sha256-wDLMVonPUexoaZ60kRBILmr5l46yajzACozCp6uETGY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/systembridgeconnector/default.nix b/pkgs/development/python-modules/systembridgeconnector/default.nix
index 1841c4ee733b..221cca321e04 100644
--- a/pkgs/development/python-modules/systembridgeconnector/default.nix
+++ b/pkgs/development/python-modules/systembridgeconnector/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "systembridgeconnector";
-  version = "4.1.2";
+  version = "4.1.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,15 +25,23 @@ buildPythonPackage rec {
     owner = "timmo001";
     repo = "system-bridge-connector";
     rev = "refs/tags/${version}";
-    hash = "sha256-uqE/KJnuNii2b3geB9jp8IxaeceuZVXdol7s3hP6z/Q=";
+    hash = "sha256-AzAN7reBAI4atEFutgFrdQHFy/Qc90PQxwSaHaftn5Q=";
   };
 
   postPatch = ''
+    substituteInPlace requirements_setup.txt \
+      --replace-fail ">=" " #"
+
     substituteInPlace systembridgeconnector/_version.py \
       --replace-fail ", dev=0" ""
   '';
 
-  build-system = [ setuptools ];
+  build-system = [
+    incremental
+    setuptools
+  ];
+
+  pythonRelaxDeps = [ "incremental" ];
 
   dependencies = [
     aiohttp
@@ -51,6 +59,13 @@ buildPythonPackage rec {
     syrupy
   ];
 
+  disabledTests = [
+    "test_get_data"
+    "test_wait_for_response_timeout"
+  ];
+
+  pytestFlagsArray = [ "--snapshot-warn-unused" ];
+
   meta = {
     changelog = "https://github.com/timmo001/system-bridge-connector/releases/tag/${version}";
     description = "This is the connector package for the System Bridge project";
diff --git a/pkgs/development/python-modules/systembridgemodels/default.nix b/pkgs/development/python-modules/systembridgemodels/default.nix
index 4c6b74a4a62b..ebb8dcea57ad 100644
--- a/pkgs/development/python-modules/systembridgemodels/default.nix
+++ b/pkgs/development/python-modules/systembridgemodels/default.nix
@@ -6,11 +6,12 @@
   setuptools,
   incremental,
   pytestCheckHook,
+  syrupy,
 }:
 
 buildPythonPackage rec {
   pname = "systembridgemodels";
-  version = "4.1.0";
+  version = "4.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -19,21 +20,39 @@ buildPythonPackage rec {
     owner = "timmo001";
     repo = "system-bridge-models";
     rev = "refs/tags/${version}";
-    hash = "sha256-wyTlkbrf9H1mdVyZP234nVDuls/QrFXcv3pXhztp9+A=";
+    hash = "sha256-FjHDd7nI30ChaClL0b1ME9Zv+DV0BiMsfgGOKQF/qBk=";
   };
 
   postPatch = ''
+    substituteInPlace requirements_setup.txt \
+      --replace-fail ">=" " #"
+
     substituteInPlace systembridgemodels/_version.py \
       --replace-fail ", dev=0" ""
   '';
 
-  build-system = [ setuptools ];
+  build-system = [
+    incremental
+    setuptools
+  ];
+
+  pythonRelaxDeps = [ "incremental" ];
 
   dependencies = [ incremental ];
 
   pythonImportsCheck = [ "systembridgemodels" ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    syrupy
+  ];
+
+  disabledTests = [
+    "test_system"
+    "test_update"
+  ];
+
+  pytestFlagsArray = [ "--snapshot-warn-unused" ];
 
   meta = {
     changelog = "https://github.com/timmo001/system-bridge-models/releases/tag/${version}";
diff --git a/pkgs/development/python-modules/torch-audiomentations/default.nix b/pkgs/development/python-modules/torch-audiomentations/default.nix
index 2a9985ce91b4..7a4205268e3e 100644
--- a/pkgs/development/python-modules/torch-audiomentations/default.nix
+++ b/pkgs/development/python-modules/torch-audiomentations/default.nix
@@ -2,13 +2,15 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
-  wheel,
   julius,
   librosa,
+  pytest-cov-stub,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  torch-pitch-shift,
   torch,
   torchaudio,
-  torch-pitch-shift,
 }:
 
 buildPythonPackage rec {
@@ -16,6 +18,8 @@ buildPythonPackage rec {
   version = "0.11.1";
   pyproject = true;
 
+  disabled = pythonOlder "3.8";
+
   src = fetchFromGitHub {
     owner = "asteroid-team";
     repo = "torch-audiomentations";
@@ -23,7 +27,11 @@ buildPythonPackage rec {
     hash = "sha256-0+5wc+mP4c221q6mdaqPalfumTOtdnkjnIPtLErOp9E=";
   };
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [ "torchaudio" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     julius
     librosa
     torch
@@ -31,16 +39,27 @@ buildPythonPackage rec {
     torch-pitch-shift
   ];
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
   ];
 
   pythonImportsCheck = [ "torch_audiomentations" ];
 
+  disabledTestPaths = [
+    # librosa issues
+    "tests/test_mix.py"
+    "tests/test_convolution.py"
+    "tests/test_impulse_response.py"
+    "tests/test_background_noise.py"
+  ];
+
+  disabledTests = [ "test_transform_is_differentiable" ];
+
   meta = with lib; {
-    description = "Fast audio data augmentation in PyTorch. Inspired by audiomentations. Useful for deep learning";
+    description = "Fast audio data augmentation in PyTorch";
     homepage = "https://github.com/asteroid-team/torch-audiomentations";
+    changelog = "https://github.com/asteroid-team/torch-audiomentations/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ matthewcroughan ];
   };
diff --git a/pkgs/development/python-modules/torch-pitch-shift/default.nix b/pkgs/development/python-modules/torch-pitch-shift/default.nix
index f6d35338dad8..910b65c6363a 100644
--- a/pkgs/development/python-modules/torch-pitch-shift/default.nix
+++ b/pkgs/development/python-modules/torch-pitch-shift/default.nix
@@ -3,11 +3,11 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
-  wheel,
   packaging,
   primepy,
   torch,
   torchaudio,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -15,30 +15,35 @@ buildPythonPackage rec {
   version = "1.2.4";
   pyproject = true;
 
+  disabled = pythonOlder "3.8";
+
   src = fetchFromGitHub {
     owner = "KentoNishi";
     repo = "torch-pitch-shift";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-s3z+6jOGC7RfF9TzVZ9HFbIFz2BsBm6Yhx7lgaEKv6o=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
-  ];
+  pythonRelaxDeps = [ "torchaudio" ];
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     packaging
     primepy
     torch
     torchaudio
   ];
 
+  # Module has no tests
+  doCheck = false;
+
   pythonImportsCheck = [ "torch_pitch_shift" ];
 
   meta = with lib; {
     description = "Pitch-shift audio clips quickly with PyTorch (CUDA supported)! Additional utilities for searching efficient transformations are included";
     homepage = "https://github.com/KentoNishi/torch-pitch-shift";
+    changelog = "https://github.com/KentoNishi/torch-pitch-shift/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ matthewcroughan ];
   };
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 91c3deed553d..417280834bde 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.4.4";
+  version = "4.4.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XFP2/gHi+uNXrTO3ltv9tOr+shFDVPRs85YIgGEU7Pg=";
+    hash = "sha256-sOZL8GDI06cXMCT7b+CZ9w56owYwNWiILLrJDmWZ9Fs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix
index 957db7180d59..82c832b6b98f 100644
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "unearth";
-  version = "0.16.1";
+  version = "0.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mIpDQY+gt4rrYooV9qOwIVLBeH9j/m0lTH9OLM+NsKc=";
+    hash = "sha256-dxyicP7IvqJid0oLHOJ1JzkFbmUjRDQCjs6vRmy7oLY=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/webexteamssdk/default.nix b/pkgs/development/python-modules/webexteamssdk/default.nix
index 30eeb64d83a1..373f06b6d046 100644
--- a/pkgs/development/python-modules/webexteamssdk/default.nix
+++ b/pkgs/development/python-modules/webexteamssdk/default.nix
@@ -2,41 +2,34 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  future,
   pyjwt,
   pythonOlder,
   requests,
   requests-toolbelt,
-  setuptools,
-  versioneer,
+  poetry-core,
+  poetry-dynamic-versioning,
 }:
 
 buildPythonPackage rec {
   pname = "webexteamssdk";
-  version = "1.6.1";
+  version = "2.0.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "CiscoDevNet";
     repo = "webexteamssdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xlkmXl4tVm48drXmkUijv9GNXzJcDnfSKbOMciPIRRo=";
+    hash = "sha256-ENAUUicVO/Br7k+RFHCGzQ7BIG0CP7jTYM3tzs5EAZQ=";
   };
 
-  postPatch = ''
-    # Remove vendorized versioneer
-    rm versioneer.py
-  '';
-
   build-system = [
-    setuptools
-    versioneer
+    poetry-core
+    poetry-dynamic-versioning
   ];
 
   dependencies = [
-    future
     pyjwt
     requests
     requests-toolbelt
@@ -45,13 +38,13 @@ buildPythonPackage rec {
   # Tests require a Webex Teams test domain
   doCheck = false;
 
-  pythonImportsCheck = [ "webexteamssdk" ];
+  pythonImportsCheck = [ "webexpythonsdk" ];
 
   meta = with lib; {
     description = "Python module for Webex Teams APIs";
     homepage = "https://github.com/CiscoDevNet/webexteamssdk";
     changelog = "https://github.com/WebexCommunity/WebexPythonSDK/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/wled/default.nix b/pkgs/development/python-modules/wled/default.nix
index da752e20e369..00e3c9e24412 100644
--- a/pkgs/development/python-modules/wled/default.nix
+++ b/pkgs/development/python-modules/wled/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "wled";
-  version = "0.20.1";
+  version = "0.20.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "frenck";
     repo = "python-wled";
     rev = "refs/tags/v${version}";
-    hash = "sha256-n/Ot08x7G4ApHv0BUW106iubXmXeOqDQp7J8Bstgpc4=";
+    hash = "sha256-7P/V83dGkfJJjZxZtiEwQXIY7CeBZ/fmvTdEjDirKj0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/wsgi-intercept/default.nix b/pkgs/development/python-modules/wsgi-intercept/default.nix
index c2644e258232..3a1e587fc106 100644
--- a/pkgs/development/python-modules/wsgi-intercept/default.nix
+++ b/pkgs/development/python-modules/wsgi-intercept/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "wsgi-intercept";
-  version = "1.13.0";
+  version = "1.13.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,12 +22,12 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "wsgi_intercept";
     inherit version;
-    hash = "sha256-daA+HQHdtCAC+1a4Ss0qeo7OJe/dIGREoTqfH7z6k0w=";
+    hash = "sha256-eb1sY5qxH36r5dGK2aIPYu6CocQ1EkqHbP/YA49sJME=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [ six ];
+  dependencies = [ six ];
 
   nativeCheckInputs = [
     httplib2
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module that acts as a WSGI application in place of a real URI for testing";
     homepage = "https://github.com/cdent/wsgi-intercept";
+    changelog = "https://github.com/cdent/wsgi-intercept/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ mikecm ];
   };
diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index f15ebd0f9166..878fbfdc76d1 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "xknx";
-  version = "3.0.0";
+  version = "3.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "XKNX";
     repo = "xknx";
     rev = "refs/tags/${version}";
-    hash = "sha256-QEv8HMK35vr3ozfHu2pUnmgqQ73vLnXzobQNhwRtlsI=";
+    hash = "sha256-JoJvEE21BubAmPm97fk9mbCkkn1dWkZO/uLd6C0DkUQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/zha-quirks/default.nix b/pkgs/development/python-modules/zha-quirks/default.nix
index 17d50b428b7a..d3be6151e7fb 100644
--- a/pkgs/development/python-modules/zha-quirks/default.nix
+++ b/pkgs/development/python-modules/zha-quirks/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "zha-quirks";
-  version = "0.0.118";
+  version = "0.0.119";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -21,14 +21,9 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha-device-handlers";
     rev = "refs/tags/${version}";
-    hash = "sha256-LudwIENP1KCX7+HwyklCUdAu5mRLDcnMEZBzbRH2FM0=";
+    hash = "sha256-QvytImEpDk+3IeWVh9bYaX60u+mx4SVXuRxAd/YjPTE=";
   };
 
-  patches = [
-    # https://github.com/zigpy/zha-device-handlers/pull/3296
-    ./zigpy-0.65.3-compat.patch
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail ', "setuptools-git-versioning<2"' "" \
diff --git a/pkgs/development/python-modules/zha-quirks/zigpy-0.65.3-compat.patch b/pkgs/development/python-modules/zha-quirks/zigpy-0.65.3-compat.patch
deleted file mode 100644
index 0c1f573ae433..000000000000
--- a/pkgs/development/python-modules/zha-quirks/zigpy-0.65.3-compat.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/tests/conftest.py b/tests/conftest.py
-index e64beb2..c1f0785 100644
---- a/tests/conftest.py
-+++ b/tests/conftest.py
-@@ -88,7 +88,6 @@ class MockApp(zigpy.application.ControllerApplication):
- def app_controller_mock():
-     """App controller mock."""
-     config = {"device": {"path": "/dev/ttyUSB0"}, "database": None}
--    config = MockApp.SCHEMA(config)
-     app = MockApp(config)
-     return app
- 
diff --git a/pkgs/development/python-modules/zha/default.nix b/pkgs/development/python-modules/zha/default.nix
index c83e3fb93201..6dd2540bab6f 100644
--- a/pkgs/development/python-modules/zha/default.nix
+++ b/pkgs/development/python-modules/zha/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "zha";
-  version = "0.0.30";
+  version = "0.0.31";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha";
     rev = "refs/tags/${version}";
-    hash = "sha256-4Fpe1us/GS2QVJbbnMcI7bziyW5P2kuJ6+p5L9N7lMY=";
+    hash = "sha256-H1VmB20ldUyKIiMRT8YMgiFIno41WN2bY8rhqFsGYcA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/zigpy/default.nix b/pkgs/development/python-modules/zigpy/default.nix
index c86a79435d28..1ce192040777 100644
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "zigpy";
-  version = "0.65.3";
+  version = "0.65.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zigpy";
     rev = "refs/tags/${version}";
-    hash = "sha256-zE8Hqha1yv7OsaXYrKzf3o2JLO/RcDSAxixWoMj2T3M=";
+    hash = "sha256-+z25W3ubw1TJbrRghsYzcuUZUHaL5xPMeZceJ1aUrKw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 96d4fa32f11f..448ee7c3cb63 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.223";
+  version = "3.2.228";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-NK1Ka3m9XQJish5d8Z0UiaTLEDot+rekEjC5peZ7FV4=";
+    hash = "sha256-9I17CEG5c9nLqfGe2OlOmgRv3zCw7klRhLe9youZEa4=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];
diff --git a/pkgs/development/tools/coder/default.nix b/pkgs/development/tools/coder/default.nix
index 0c040a7cdd90..c191b2e3f439 100644
--- a/pkgs/development/tools/coder/default.nix
+++ b/pkgs/development/tools/coder/default.nix
@@ -6,6 +6,7 @@
 , terraform
 , stdenvNoCC
 , unzip
+, nixosTests
 }:
 
 let
@@ -100,5 +101,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = ./update.sh;
+    tests = {
+      inherit (nixosTests) coder;
+    };
   };
 })
diff --git a/pkgs/development/tools/continuous-integration/gocd-agent/default.nix b/pkgs/development/tools/continuous-integration/gocd-agent/default.nix
index 314dd38c0795..adb2839de1d8 100644
--- a/pkgs/development/tools/continuous-integration/gocd-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/gocd-agent/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, unzip }:
+{ lib, stdenv, fetchurl, unzip, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "gocd-agent";
@@ -9,6 +9,9 @@ stdenv.mkDerivation rec {
     url = "https://download.go.cd/binaries/${version}-${rev}/generic/go-agent-${version}-${rev}.zip";
     sha256 = "sha256-L2MOkbVHoQu99lKrbnsNkhuU0SZ8VANSK72GZrGLbiQ=";
   };
+
+  passthru.tests = { inherit (nixosTests) gocd-agent; };
+
   meta = with lib; {
     description = "Continuous delivery server specializing in advanced workflow modeling and visualization";
     homepage = "http://www.go.cd";
diff --git a/pkgs/development/tools/database/litestream/default.nix b/pkgs/development/tools/database/litestream/default.nix
index fa47959a333c..15c287114750 100644
--- a/pkgs/development/tools/database/litestream/default.nix
+++ b/pkgs/development/tools/database/litestream/default.nix
@@ -1,6 +1,7 @@
 { buildGoModule
 , fetchFromGitHub
 , lib
+, nixosTests
 }:
 buildGoModule rec {
   pname = "litestream";
@@ -21,6 +22,8 @@ buildGoModule rec {
 
   vendorHash = "sha256-sYIY3Z3VrCqbjEbQtEY7q6Jljg8jMoa2qWEB/IkDjzM=";
 
+  passthru.tests = { inherit (nixosTests) litestream; };
+
   meta = with lib; {
     description = "Streaming replication for SQLite";
     mainProgram = "litestream";
diff --git a/pkgs/development/tools/go-mockery/default.nix b/pkgs/development/tools/go-mockery/default.nix
index 551934001bda..b57491d47e38 100644
--- a/pkgs/development/tools/go-mockery/default.nix
+++ b/pkgs/development/tools/go-mockery/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-mockery";
-  version = "2.44.1";
+  version = "2.44.2";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
     rev = "v${version}";
-    sha256 = "sha256-FaQzGkMUgf3QRM3gjlvUEDmnb1mZ8Yd85E4ONB5yCm4=";
+    sha256 = "sha256-zVzCAX52kzugj9LRqnrUZ881sE8EyhLM1QPnJK5O2ak=";
   };
 
   preCheck = ''
diff --git a/pkgs/development/tools/language-servers/nixd/default.nix b/pkgs/development/tools/language-servers/nixd/default.nix
index 504eabcda0c9..b4736c0b6173 100644
--- a/pkgs/development/tools/language-servers/nixd/default.nix
+++ b/pkgs/development/tools/language-servers/nixd/default.nix
@@ -21,13 +21,13 @@
 
 let
   common = rec {
-    version = "2.3.1";
+    version = "2.3.2";
 
     src = fetchFromGitHub {
       owner = "nix-community";
       repo = "nixd";
       rev = version;
-      hash = "sha256-JmDMcxIQ0220O/vWw/9SyB1dH7MSJaPK/CKY44ViVjM=";
+      hash = "sha256-ffHLKHpqgVlYLGQ/Dc/6hW/inA98QdMJiv/fT2IrH7c=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/development/tools/language-servers/typst-lsp/default.nix b/pkgs/development/tools/language-servers/typst-lsp/default.nix
index 59b81f5989f0..d834fd0f371b 100644
--- a/pkgs/development/tools/language-servers/typst-lsp/default.nix
+++ b/pkgs/development/tools/language-servers/typst-lsp/default.nix
@@ -44,12 +44,15 @@ rustPlatform.buildRustPackage rec {
     export HOME=$(mktemp -d)
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Brand-new language server for Typst";
     homepage = "https://github.com/nvarner/typst-lsp";
     mainProgram = "typst-lsp";
     changelog = "https://github.com/nvarner/typst-lsp/releases/tag/${src.rev}";
-    license = with licenses; [ asl20 mit ];
-    maintainers = with maintainers; [ figsoda GaetanLepage ];
+    license = with lib.licenses; [ asl20 mit ];
+    maintainers = with lib.maintainers; [ figsoda GaetanLepage ];
+    # Incompatible with Rust >= 1.80
+    # Fix to be merged upstream: https://github.com/nvarner/typst-lsp/pull/515
+    broken = true;
   };
 }
diff --git a/pkgs/development/tools/leaps/default.nix b/pkgs/development/tools/leaps/default.nix
index 27a6cb95220c..c9eac1db13a8 100644
--- a/pkgs/development/tools/leaps/default.nix
+++ b/pkgs/development/tools/leaps/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, testers, leaps }:
+{ lib, buildGoModule, fetchFromGitHub, testers, leaps, nixosTests }:
 
 buildGoModule rec {
   pname = "leaps";
@@ -16,7 +16,10 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
-  passthru.tests.version = testers.testVersion { package = leaps; };
+  passthru.tests = {
+    version = testers.testVersion { package = leaps; };
+    inherit (nixosTests) leaps;
+  };
 
   meta = with lib; {
     description = "Pair programming tool and library written in Golang";
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index 25bdd45e03b8..a2895a095422 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -1,5 +1,6 @@
 { lib, fetchgit, pkg-config, gettext, runCommand, makeWrapper
 , cpio, elfutils, kernel, gnumake, python3
+, nixosTests
 }:
 
 let
@@ -35,6 +36,7 @@ let
 in runCommand "systemtap-${kernel.version}-${version}" {
   inherit stapBuild;
   nativeBuildInputs = [ makeWrapper ];
+  passthru.tests = { inherit (nixosTests.systemtap) linux_default linux_latest; };
   meta = {
     homepage = "https://sourceware.org/systemtap/";
     description = "Provides a scripting language for instrumentation on a live kernel plus user-space";
diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index 4ddf399f783f..925cffb71eed 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2024-08-05";
-  cargoHash = "sha256-6ZlC/zzPYvBbp2lsl8U2piHxPqCFVQ+AiNFbnPumAXo=";
+  version = "2024-08-12";
+  cargoHash = "sha256-F1DuuBjHCPY3NIwnS1jFMTxcMnc1TGv2KaKttF6FIKs=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-/Bd0VzlutcxTwSNouS/iC6BDv395NoO4XmBJaS2vQLg=";
+    sha256 = "sha256-xAxVDxuvCs8WWkrxVWjCiqxTkHhGj7sSppr1YMuEdT8=";
   };
 
   cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];
diff --git a/pkgs/development/tools/wasmserve/default.nix b/pkgs/development/tools/wasmserve/default.nix
index 530dd613d51e..8369096b78dd 100644
--- a/pkgs/development/tools/wasmserve/default.nix
+++ b/pkgs/development/tools/wasmserve/default.nix
@@ -1,17 +1,18 @@
-{ buildGoModule
-, lib
-, fetchFromGitHub
+{
+  buildGoModule,
+  lib,
+  fetchFromGitHub,
 }:
 
 buildGoModule rec {
   pname = "wasmserve";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "hajimehoshi";
     repo = "wasmserve";
     rev = "v${version}";
-    hash = "sha256-KlCbUre6yIorE1ZM++Rto8vgwVGsC1wZj1xCd3AwQy0=";
+    hash = "sha256-e+pHwk+xJVc+Ki0iJC2B+W8ZN4mEawEQNyGhwITBDlo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/web/mailcatcher/default.nix b/pkgs/development/web/mailcatcher/default.nix
index 17d25378d8cd..a6188fec5dbd 100644
--- a/pkgs/development/web/mailcatcher/default.nix
+++ b/pkgs/development/web/mailcatcher/default.nix
@@ -1,4 +1,4 @@
-{ ruby_3_2, lib, bundlerApp, bundlerUpdateScript }:
+{ ruby_3_2, lib, bundlerApp, bundlerUpdateScript, nixosTests }:
 
 bundlerApp {
   pname = "mailcatcher";
@@ -7,6 +7,7 @@ bundlerApp {
   ruby = ruby_3_2;
 
   passthru.updateScript = bundlerUpdateScript "mailcatcher";
+  passthru.tests = { inherit (nixosTests) mailcatcher; };
 
   meta = with lib; {
     description = "SMTP server and web interface to locally test outbound emails";
diff --git a/pkgs/games/openarena/default.nix b/pkgs/games/openarena/default.nix
index 25b4954cb426..211dbcd25106 100644
--- a/pkgs/games/openarena/default.nix
+++ b/pkgs/games/openarena/default.nix
@@ -18,6 +18,7 @@
 , SDL2
 , speex
 , makeDesktopItem
+, nixosTests
 }:
 
 let
@@ -102,6 +103,8 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  passthru.tests = { inherit (nixosTests) openarena; };
+
   meta = {
     description = "Fast-paced 3D first-person shooter, similar to id Software Inc.'s Quake III Arena";
     homepage = "http://openarena.ws/";
diff --git a/pkgs/games/osu-lazer/bin.nix b/pkgs/games/osu-lazer/bin.nix
index 26256fa329a8..5ab1d50830ba 100644
--- a/pkgs/games/osu-lazer/bin.nix
+++ b/pkgs/games/osu-lazer/bin.nix
@@ -7,22 +7,22 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2024.816.0";
+  version = "2024.817.0";
 
   src = {
     aarch64-darwin = fetchzip {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-      hash = "sha256-i56sgECdFVDcWDqEjKjXEjrlLEdfiBAvriRg7s19W2E=";
+      hash = "sha256-ssyKy9CDN5LcyaQE7o56VoXoYYVU1zksMT3GxdMu2lA=";
       stripRoot = false;
     };
     x86_64-darwin = fetchzip {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-      hash = "sha256-4pzal/ddWGxueOirroyHk+b09YVeaNtE7hmmR8uY9GY=";
+      hash = "sha256-6yGMZ+rMnzuu0NNBD0BBSV5YvuGibIkhBL3HQWqudzo=";
       stripRoot = false;
     };
     x86_64-linux = fetchurl {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-      hash = "sha256-5DlVwDVhiKCm1uwI0roV3Zj0BuXxVWxQsxgr0n95vXs=";
+      hash = "sha256-AruD0XoJJm3+LQ+WH2CqKb+7S/VjG6YmdWhsH5l3/uM=";
     };
   }.${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported.");
 
diff --git a/pkgs/games/osu-lazer/default.nix b/pkgs/games/osu-lazer/default.nix
index 47a669dddc7f..c0f27745280e 100644
--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@@ -17,13 +17,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2024.816.0";
+  version = "2024.817.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     rev = version;
-    hash = "sha256-OzXxvQDCYoHiPj6WzLbNsJXxngg0w02wbU9LNPCkK8Y=";
+    hash = "sha256-X6YaNHwNtHSqjV4oKQmYUd1aadbHSmr3EZDoq6epAkE=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";
diff --git a/pkgs/games/shipwright/default.nix b/pkgs/games/shipwright/default.nix
index 2ee250a703f4..d214e6934b19 100644
--- a/pkgs/games/shipwright/default.nix
+++ b/pkgs/games/shipwright/default.nix
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "shipwright";
-  version = "8.0.5";
+  version = "8.0.6";
 
   src = fetchFromGitHub {
     owner = "harbourmasters";
     repo = "shipwright";
-    rev = finalAttrs.version;
-    hash = "sha256-o2VwOF46Iq4pwpumOau3bDXJ/CArx6NWBi00s3E4PnE=";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-bA+Bm7M6udeZLpFhGa8fCtagfYBeRxWWqFuAj62XwGQ=";
     fetchSubmodules = true;
   };
 
@@ -51,8 +51,8 @@ stdenv.mkDerivation (finalAttrs: {
   # https://github.com/HarbourMasters/Shipwright/blob/e46c60a7a1396374e23f7a1f7122ddf9efcadff7/soh/CMakeLists.txt#L736
   gamecontrollerdb = fetchurl {
     name = "gamecontrollerdb.txt";
-    url = "https://raw.githubusercontent.com/gabomdq/SDL_GameControllerDB/b7933e43ca2f8d26d8b668ea8ea52b736221af1e/gamecontrollerdb.txt";
-    hash = "sha256-XIuS9BkWkM9d+SgT1OYTfWtcmzqSUDbMrMLoVnPgidE=";
+    url = "https://raw.githubusercontent.com/gabomdq/SDL_GameControllerDB/075c1549075ef89a397fd7e0663d21e53a2485fd/gamecontrollerdb.txt";
+    hash = "sha256-atjc0t921l6JSUAd/Yk7uup2R7mCp5ivAh6Dr7HBY7I=";
   };
 
   nativeBuildInputs = [
@@ -95,8 +95,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/lib"
     (lib.cmakeBool "NON_PORTABLE" true)
+    (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "${placeholder "out"}/lib")
   ];
 
   env.NIX_CFLAGS_COMPILE =
diff --git a/pkgs/misc/drivers/xwiimote/default.nix b/pkgs/misc/drivers/xwiimote/default.nix
deleted file mode 100644
index 14f22c9463ed..000000000000
--- a/pkgs/misc/drivers/xwiimote/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ lib, stdenv, udev, ncurses, pkg-config, fetchurl, bluez }:
-
-stdenv.mkDerivation rec {
-  pname = "xwiimote";
-  version = "2";
-
-  src = fetchurl {
-    url = "https://github.com/dvdhrm/xwiimote/releases/download/xwiimote-${version}/xwiimote-${version}.tar.xz";
-    sha256 = "1g9cbhblll47l300zr999xr51x2g98y49l222f77fhswd12kjzhd";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ udev ncurses bluez ];
-
-  configureFlags = [ "--with-doxygen=no" ];
-
-  meta = {
-    homepage = "https://dvdhrm.github.io/xwiimote";
-    description = "Userspace utilities to control connected Nintendo Wii Remotes";
-    mainProgram = "xwiishow";
-    platforms = lib.platforms.linux;
-    license = lib.licenses.mit;
-  };
-
-  postInstallPhase = ''
-    mkdir -p "$out/etc/X11/xorg.conf.d/"
-    cp "res/50-xorg-fix-xwiimote.conf" "$out/etc/X11/xorg.conf.d/50-fix-xwiimote.conf"
-  '';
-}
diff --git a/pkgs/misc/screensavers/xautolock/default.nix b/pkgs/misc/screensavers/xautolock/default.nix
index c7934125a7ae..e0fd83897e80 100644
--- a/pkgs/misc/screensavers/xautolock/default.nix
+++ b/pkgs/misc/screensavers/xautolock/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchFromGitHub
 , imake, gccmakedep, libX11, libXext, libXScrnSaver, xorgproto
+, nixosTests
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -25,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   installTargets = [ "install" "install.man" ];
 
+  passthru.tests = { inherit (nixosTests) xautolock; };
+
   meta = with lib; {
     description = "Launch a given program when your X session has been idle for a given time";
     homepage = "http://www.ibiblio.org/pub/linux/X11/screensavers";
diff --git a/pkgs/misc/screensavers/xss-lock/default.nix b/pkgs/misc/screensavers/xss-lock/default.nix
index 88b4b6b795f3..dfadfedaee9a 100644
--- a/pkgs/misc/screensavers/xss-lock/default.nix
+++ b/pkgs/misc/screensavers/xss-lock/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, docutils, pkg-config, glib, libpthreadstubs
-, libXau, libXdmcp, xcbutil }:
+, libXau, libXdmcp, xcbutil, nixosTests }:
 
 stdenv.mkDerivation {
   pname = "xss-lock";
@@ -15,6 +15,8 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake pkg-config docutils ];
   buildInputs = [ glib libpthreadstubs libXau libXdmcp xcbutil ];
 
+  passthru.tests = { inherit (nixosTests) xss-lock; };
+
   meta = with lib; {
     description = "Use external locker (such as i3lock) as X screen saver";
     license = licenses.mit;
diff --git a/pkgs/os-specific/linux/atop/default.nix b/pkgs/os-specific/linux/atop/default.nix
index 7e191f01fb9b..33a00242989f 100644
--- a/pkgs/os-specific/linux/atop/default.nix
+++ b/pkgs/os-specific/linux/atop/default.nix
@@ -8,6 +8,7 @@
 , findutils
 , systemd
 , python3
+, nixosTests
 # makes the package unfree via pynvml
 , withAtopgpu ? false
 }:
@@ -79,6 +80,8 @@ stdenv.mkDerivation rec {
     rm $out/lib/systemd/system/atopgpu.service $out/bin/atopgpud $out/share/man/man8/atopgpud.8
   '');
 
+  passthru.tests = { inherit (nixosTests) atop; };
+
   meta = with lib; {
     platforms = platforms.linux;
     maintainers = with maintainers; [ raskin ];
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 4a291cc03b8f..4ce47eedba2a 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPackages, fetchurl, fetchFromGitLab
+{ stdenv, lib, buildPackages, fetchurl, fetchpatch, fetchFromGitLab
 , enableStatic ? stdenv.hostPlatform.isStatic
 , enableMinimal ? false
 , enableAppletSymlinks ? true
@@ -75,6 +75,27 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
       sha256 = "sha256-vl1wPbsHtXY9naajjnTicQ7Uj3N+EQ8pRNnrdsiow+w=";
     })
+    (fetchpatch {
+      name = "CVE-2022-48174.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15216
+      url = "https://git.busybox.net/busybox/patch/?id=d417193cf37ca1005830d7e16f5fa7e1d8a44209";
+      hash = "sha256-mpDEwYncpU6X6tmtj9xM2KCrB/v2ys5bYxmPPrhm6es=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-42366.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15874
+      # This patch is also used by Alpine, see https://git.alpinelinux.org/aports/tree/main/busybox/0037-awk.c-fix-CVE-2023-42366-bug-15874.patch
+      url = "https://bugs.busybox.net/attachment.cgi?id=9697";
+      hash = "sha256-2eYfLZLjStea9apKXogff6sCAdG9yHx0ZsgUBaGfQIA=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-42363.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15865
+      url = "https://git.launchpad.net/ubuntu/+source/busybox/plain/debian/patches/CVE-2023-42363.patch?id=c9d8a323b337d58e302717d41796aa0242963d5a";
+      hash = "sha256-1W9Q8+yFkYQKzNTrvndie8QuaEbyAFL1ZASG2fPF+Z4=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-42364_CVE-2023-42365.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15871 https://bugs.busybox.net/show_bug.cgi?id=15868
+      url = "https://git.alpinelinux.org/aports/plain/main/busybox/CVE-2023-42364-CVE-2023-42365.patch?id=8a4bf5971168bf48201c05afda7bee0fbb188e13";
+      hash = "sha256-nQPgT9eA1asCo38Z9X7LR9My0+Vz5YBPba3ARV3fWcc=";
+    })
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;
 
   separateDebugInfo = true;
diff --git a/pkgs/os-specific/linux/fanout/default.nix b/pkgs/os-specific/linux/fanout/default.nix
index 3352f59a05f7..fc6bac80d6cd 100644
--- a/pkgs/os-specific/linux/fanout/default.nix
+++ b/pkgs/os-specific/linux/fanout/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, kernel, kmod }:
+{ lib, stdenv, fetchFromGitHub, kernel, kmod, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "fanout";
@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
     "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
+  passthru.tests = { inherit (nixosTests) fanout; };
+
   meta = with lib; {
     description = "Kernel-based publish-subscribe system";
     homepage = "https://github.com/bob-linuxtoys/fanout";
diff --git a/pkgs/os-specific/linux/hyperv-daemons/default.nix b/pkgs/os-specific/linux/hyperv-daemons/default.nix
index 619318d7e04c..5539e605ca0e 100644
--- a/pkgs/os-specific/linux/hyperv-daemons/default.nix
+++ b/pkgs/os-specific/linux/hyperv-daemons/default.nix
@@ -1,9 +1,20 @@
-{ stdenv, lib, python2, python3, kernel, makeWrapper, writeText
-, gawk, iproute2 }:
+{
+  stdenv,
+  lib,
+  python2,
+  python3,
+  kernel,
+  makeWrapper,
+  writeText,
+  gawk,
+  iproute2,
+}:
 
 let
   libexec = "libexec/hypervkvpd";
 
+  fcopy_name = (if lib.versionOlder kernel.version "6.10" then "fcopy" else "fcopy_uio");
+
   daemons = stdenv.mkDerivation rec {
     pname = "hyperv-daemons-bin";
     inherit (kernel) src version;
@@ -26,7 +37,7 @@ let
     installPhase = ''
       runHook preInstall
 
-      for f in fcopy kvp vss ; do
+      for f in ${fcopy_name} kvp vss ; do
         install -Dm755 hv_''${f}_daemon -t $out/bin
       done
 
@@ -39,11 +50,17 @@ let
 
     postFixup = ''
       wrapProgram $out/bin/hv_kvp_daemon \
-        --prefix PATH : $out/bin:${lib.makeBinPath [ gawk iproute2 ]}
+        --prefix PATH : $out/bin:${
+          lib.makeBinPath [
+            gawk
+            iproute2
+          ]
+        }
     '';
   };
 
-  service = bin: title: check:
+  service =
+    bin: title: check:
     writeText "hv-${bin}.service" ''
       [Unit]
       Description=Hyper-V ${title} daemon
@@ -61,21 +78,30 @@ let
       WantedBy=hyperv-daemons.target
     '';
 
-in stdenv.mkDerivation {
+in
+stdenv.mkDerivation {
   pname = "hyperv-daemons";
   inherit (kernel) version;
 
   # we just stick the bins into out as well as it requires "out"
-  outputs = [ "bin" "lib" "out" ];
+  outputs = [
+    "bin"
+    "lib"
+    "out"
+  ];
 
   buildInputs = [ daemons ];
 
   buildCommand = ''
     system=$lib/lib/systemd/system
 
-    install -Dm444 ${service "fcopy" "file copy (FCOPY)"        "hv_fcopy" } $system/hv-fcopy.service
-    install -Dm444 ${service "kvp"   "key-value pair (KVP)"     "hv_kvp"   } $system/hv-kvp.service
-    install -Dm444 ${service "vss"   "volume shadow copy (VSS)" "hv_vss"   } $system/hv-vss.service
+    install -Dm444 ${
+      service "${
+        fcopy_name
+      }" "file copy (FCOPY)" "/sys/bus/vmbus/devices/eb765408-105f-49b6-b4aa-c123b64d17d4/uio"
+    } $system/hv-fcopy.service
+    install -Dm444 ${service "kvp" "key-value pair (KVP)" "hv_kvp"} $system/hv-kvp.service
+    install -Dm444 ${service "vss" "volume shadow copy (VSS)" "hv_vss"} $system/hv-vss.service
 
     cat > $system/hyperv-daemons.target <<EOF
     [Unit]
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index ae16c3bd7d79..06fbfbd37d13 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.10.1"; #zen
+    version = "6.10.5"; #zen
     suffix = "zen1"; #zen
-    sha256 = "0lr9qjz4hlvx3yc0lj65fnmbciyh6symycbi9ass761l1niswbk5"; #zen
+    sha256 = "08ibz7560xsmlnrm8j13hxf8hjjcxfmnjdrwffqc81g9g6rvpqra"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.9.11"; #lqx
+    version = "6.10.5"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "0i6i0ak10gswlk60pnkn5dlz74g4nd7n1xbnvf24nnwwp69kkd44"; #lqx
+    sha256 = "09rscj20j94qkmvk0hlpjm6v1n1ndnkv2vl035gsp5lwggws2jqm"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/os-specific/linux/libcgroup/default.nix b/pkgs/os-specific/linux/libcgroup/default.nix
index 8f24362b94b2..e86e989ba888 100644
--- a/pkgs/os-specific/linux/libcgroup/default.nix
+++ b/pkgs/os-specific/linux/libcgroup/default.nix
@@ -1,19 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, pam, bison, flex, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, pam, bison, flex, systemdLibs, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "libcgroup";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-x2yBqpr3LedtWmpZ4K1ipZxIualNJuDtC4FVGzzcQn8=";
+    hash = "sha256-CnejQcOyW3QzHuvsAdKe4M4XgmG9ufRaEBdO48+8ZqQ=";
   };
 
   nativeBuildInputs = [ autoreconfHook bison flex ];
-  buildInputs = [ pam ];
+  buildInputs = [ pam systemdLibs ];
 
   postPatch = ''
     substituteInPlace src/tools/Makefile.am \
diff --git a/pkgs/os-specific/linux/trezor-udev-rules/default.nix b/pkgs/os-specific/linux/trezor-udev-rules/default.nix
index e5d20171c5cb..c631b5712733 100644
--- a/pkgs/os-specific/linux/trezor-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/trezor-udev-rules/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "trezor-udev-rules";
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
     cp 51-trezor.rules $out/lib/udev/rules.d/51-trezor.rules
   '';
 
+  passthru.tests = { inherit (nixosTests) trezord; };
+
   meta = with lib; {
     description = "Udev rules for Trezor";
     license = licenses.gpl3;
diff --git a/pkgs/servers/apache-kafka/default.nix b/pkgs/servers/apache-kafka/default.nix
index fd7cd084a60b..815905f76edb 100644
--- a/pkgs/servers/apache-kafka/default.nix
+++ b/pkgs/servers/apache-kafka/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, jdk17_headless, jdk11_headless, makeWrapper, bash, coreutils, gnugrep, gnused, ps }:
+{ lib, stdenv, fetchurl, jdk17_headless, jdk11_headless, makeWrapper, bash, coreutils, gnugrep, gnused, ps, nixosTests }:
 
 let
   versionMap = {
@@ -7,12 +7,14 @@ let
       scalaVersion = "2.13";
       sha256 = "sha256-YqyuShQ92YPcfrSATVdEugxQsZm1CPWZ7wAQIOJVj8k=";
       jre = jdk17_headless;
+      nixosTest = nixosTests.kafka.kafka_3_7;
     };
     "3_6" = {
       kafkaVersion = "3.6.2";
       scalaVersion = "2.13";
       sha256 = "sha256-wxfkf3cUHTFG6VY9nLodZIbIHmcLIR7OasRqn3Lkqqw=";
       jre = jdk17_headless;
+      nixosTest = nixosTests.kafka.kafka_3_6;
     };
   };
 
@@ -54,6 +56,7 @@ let
 
     passthru = {
       inherit jre; # Used by the NixOS module to select the supported jre
+      tests.nixos = versionInfo.nixosTest;
     };
 
     meta = with lib; {
diff --git a/pkgs/servers/birdwatcher/default.nix b/pkgs/servers/birdwatcher/default.nix
index 744be3822484..cca210e4a1bc 100644
--- a/pkgs/servers/birdwatcher/default.nix
+++ b/pkgs/servers/birdwatcher/default.nix
@@ -1,6 +1,7 @@
 { lib
 , fetchFromGitHub
 , buildGoModule
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -18,6 +19,10 @@ buildGoModule rec {
 
   deleteVendor = true;
 
+  passthru.tests = {
+    inherit (nixosTests) birdwatcher;
+  };
+
   meta = with lib; {
     homepage = "https://github.com/alice-lg/birdwatcher";
     description = "Small HTTP server meant to provide an API defined by Barry O'Donovan's birds-eye to the BIRD internet routing daemon";
diff --git a/pkgs/servers/dgraph/default.nix b/pkgs/servers/dgraph/default.nix
index 8a24301d43d8..f5cf357a948d 100644
--- a/pkgs/servers/dgraph/default.nix
+++ b/pkgs/servers/dgraph/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dgraph";
-  version = "24.0.1";
+  version = "24.0.2";
 
   src = fetchFromGitHub {
     owner = "dgraph-io";
     repo = "dgraph";
     rev = "v${version}";
-    sha256 = "sha256-r3HCDgtOsTQJqOxYIF17u5zuryH6OThNU9y31f+GI+U=";
+    sha256 = "sha256-UoiVPZXeiQsgdzsU2i6FEfflJmD9pPqkf6as/3HLt6Y=";
   };
 
   vendorHash = "sha256-bqHYUFBnQEffymZ0nmm0Sli2HjHoUMEbtO8k3Y0sswc=";
diff --git a/pkgs/servers/go-libp2p-daemon/default.nix b/pkgs/servers/go-libp2p-daemon/default.nix
index cca514fcca39..f3d96c665171 100644
--- a/pkgs/servers/go-libp2p-daemon/default.nix
+++ b/pkgs/servers/go-libp2p-daemon/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-libp2p-daemon";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "libp2p";
     repo = "go-libp2p-daemon";
     rev = "v${version}";
-    hash = "sha256-UIiP6Tb0ys1slB4YQ2m7KlrHIZDfUaKs4RAyuxWBhhw=";
+    hash = "sha256-1ZmtUrk5BO5tl5Brcyz6NCD9vdf5XXtbmophXVX05Tk=";
   };
 
-  vendorHash = "sha256-60+JcyVV0uW+T0JZ/keyeYJNWrR3BhLInIgwbpoAe/Q=";
+  vendorHash = "sha256-jT3t7m8wPKejbjCvQzx+PIAl9NYk0rAl6edywvR1FaE=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 2cfa3a5088ac..d688576497c7 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2024.8.1";
+  version = "2024.8.2";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
@@ -665,6 +665,8 @@
     "compensation" = ps: with ps; [
       numpy_1
     ];
+    "concord232" = ps: with ps; [
+    ]; # missing inputs: concord232
     "coned" = ps: with ps; [
     ];
     "config" = ps: with ps; [
diff --git a/pkgs/servers/home-assistant/custom-components/default.nix b/pkgs/servers/home-assistant/custom-components/default.nix
index 74393821e347..5941137e2a45 100644
--- a/pkgs/servers/home-assistant/custom-components/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/default.nix
@@ -12,6 +12,8 @@
 
   better_thermostat = callPackage ./better_thermostat {};
 
+  dwd = callPackage ./dwd { };
+
   elevenlabs_tts = callPackage ./elevenlabs_tts {};
 
   emporia_vue = callPackage ./emporia_vue {};
diff --git a/pkgs/servers/home-assistant/custom-components/dwd/default.nix b/pkgs/servers/home-assistant/custom-components/dwd/default.nix
new file mode 100644
index 000000000000..a7b1da7bddea
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/dwd/default.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildHomeAssistantComponent,
+  defusedxml,
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "hg1337";
+  domain = "dwd";
+  version = "2024.4.0";
+
+  src = fetchFromGitHub {
+    owner = "hg1337";
+    repo = "homeassistant-dwd";
+    rev = version;
+    hash = "sha256-2bmLEBt6031p9SN855uunq7HrRJ9AFokw8t4CSBidTM=";
+  };
+
+  dependencies = [ defusedxml ];
+
+  # defusedxml version mismatch
+  dontCheckManifest = true;
+
+  meta = with lib; {
+    description = "Custom component for Home Assistant that integrates weather data (measurements and forecasts) of Deutscher Wetterdienst";
+    homepage = "https://github.com/hg1337/homeassistant-dwd";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 3a67ab47abd2..1ccd1bb6e9cb 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -471,7 +471,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2024.8.1";
+  hassVersion = "2024.8.2";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -489,13 +489,13 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-sbXfvlQJRRVkvSRJ8v/Su8us9WnoJUF4odAJrewryco=";
+    hash = "sha256-tOh6pCnRTU+JLcog6cEeeCyLOQuX9KPVdWeJfMc8G78=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-VzoH+wrpUAXJRjEZC2x9qjRzTSsiaUm6aI6/uHv6h/4=";
+    hash = "sha256-qEJXO7R+NxZaxpPCJs+SKgZdcB0ZUBKy7nsq9JQ9z1Q=";
   };
 
   build-system = with python.pkgs; [
diff --git a/pkgs/servers/icingaweb2/default.nix b/pkgs/servers/icingaweb2/default.nix
index 25f1a419e0e3..8a16f3afe345 100644
--- a/pkgs/servers/icingaweb2/default.nix
+++ b/pkgs/servers/icingaweb2/default.nix
@@ -1,4 +1,4 @@
-{ stdenvNoCC, lib, fetchFromGitHub, makeWrapper, php }:
+{ stdenvNoCC, lib, fetchFromGitHub, makeWrapper, php, nixosTests }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2";
@@ -21,6 +21,8 @@ stdenvNoCC.mkDerivation rec {
     wrapProgram $out/bin/icingacli --prefix PATH : "${lib.makeBinPath [ php ]}"
   '';
 
+  passthru.tests = { inherit (nixosTests) icingaweb2; };
+
   meta = with lib; {
     description = "Webinterface for Icinga 2";
     longDescription = ''
diff --git a/pkgs/servers/icingaweb2/ipl.nix b/pkgs/servers/icingaweb2/ipl.nix
index 52ce346fd652..254729a31762 100644
--- a/pkgs/servers/icingaweb2/ipl.nix
+++ b/pkgs/servers/icingaweb2/ipl.nix
@@ -1,4 +1,4 @@
-{ stdenvNoCC, lib, fetchFromGitHub }:
+{ stdenvNoCC, lib, fetchFromGitHub, nixosTests }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2-ipl";
@@ -16,6 +16,8 @@ stdenvNoCC.mkDerivation rec {
     cp -r * "$out"
   '';
 
+  passthru.tests = { inherit (nixosTests) icingaweb2; };
+
   meta = {
     description = "PHP library package for Icingaweb 2";
     homepage = "https://github.com/Icinga/icinga-php-library";
diff --git a/pkgs/servers/icingaweb2/thirdparty.nix b/pkgs/servers/icingaweb2/thirdparty.nix
index 552842967fde..6a2a8bebd494 100644
--- a/pkgs/servers/icingaweb2/thirdparty.nix
+++ b/pkgs/servers/icingaweb2/thirdparty.nix
@@ -1,4 +1,4 @@
-{ stdenvNoCC, lib, fetchFromGitHub }:
+{ stdenvNoCC, lib, fetchFromGitHub, nixosTests }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2-thirdparty";
@@ -16,6 +16,8 @@ stdenvNoCC.mkDerivation rec {
     cp -r * "$out"
   '';
 
+  passthru.tests = { inherit (nixosTests) icingaweb2; };
+
   meta = {
     description = "Third party dependencies for Icingaweb 2";
     homepage = "https://github.com/Icinga/icinga-php-thirdparty";
diff --git a/pkgs/servers/irc/solanum/default.nix b/pkgs/servers/irc/solanum/default.nix
index cb4f009e5c7f..e70d6cc0a8e6 100644
--- a/pkgs/servers/irc/solanum/default.nix
+++ b/pkgs/servers/irc/solanum/default.nix
@@ -8,6 +8,7 @@
 , pkg-config
 , sqlite
 , util-linux
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
@@ -63,6 +64,8 @@ stdenv.mkDerivation rec {
   #   make[4]: *** [Makefile:634: solanum] Error 1
   enableParallelInstalling = false;
 
+  passthru.tests = { inherit (nixosTests) solanum; };
+
   meta = with lib; {
     description = "IRCd for unified networks";
     homepage = "https://github.com/solanum-ircd/solanum";
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 06c1df68e3e2..64ce9873f45f 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -5,6 +5,7 @@
 , dotnetCorePackages
 , openssl
 , mono
+, nixosTests
 }:
 
 buildDotnetModule rec {
@@ -38,6 +39,8 @@ buildDotnetModule rec {
   '';
   passthru.updateScript = ./updater.sh;
 
+  passthru.tests = { inherit (nixosTests) jackett; };
+
   meta = with lib; {
     description = "API Support for your favorite torrent trackers";
     homepage = "https://github.com/Jackett/Jackett/";
diff --git a/pkgs/servers/jibri/default.nix b/pkgs/servers/jibri/default.nix
index 9f12ef008251..95d104123ea2 100644
--- a/pkgs/servers/jibri/default.nix
+++ b/pkgs/servers/jibri/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, dpkg, jdk11_headless, makeWrapper, writeText, xorg }:
+{ lib, stdenv, fetchurl, dpkg, jdk11_headless, makeWrapper, writeText, xorg, nixosTests }:
 
 let
   xorgModulePaths = writeText "module-paths" ''
@@ -38,6 +38,8 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = ./update.sh;
 
+  passthru.tests = { inherit (nixosTests) jibri; };
+
   meta = with lib; {
     description = "JItsi BRoadcasting Infrastructure";
     mainProgram = "jibri";
diff --git a/pkgs/servers/mail/mailhog/default.nix b/pkgs/servers/mail/mailhog/default.nix
index a4fe8fb5ea19..02912fbb8a7d 100644
--- a/pkgs/servers/mail/mailhog/default.nix
+++ b/pkgs/servers/mail/mailhog/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule rec {
   pname = "MailHog";
@@ -19,6 +19,8 @@ buildGoModule rec {
 
   ldflags = [ "-s" "-X main.version=${version}" ];
 
+  passthru.tests = { inherit (nixosTests) mailhog; };
+
   meta = with lib; {
     description = "Web and API based SMTP testing";
     mainProgram = "MailHog";
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index ab0b5225ded6..3d0879cecba9 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -21,16 +21,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2024-08-03T04-33-23Z";
+  version = "2024-08-17T01-24-54Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    hash = "sha256-bzEGckelhq5jJGm6dbdPsIBqksv/jY6hQUf/STQUsoE=";
+    hash = "sha256-e3Zti0v+2jfRkVoXOfqW5uw9zvIfoAKhkolfNtyBNaE=";
   };
 
-  vendorHash = "sha256-ytkiQ/g0BwHyr6LY4SGBBmfRRCFTsBtDHClyRBboGCk=";
+  vendorHash = "sha256-diRNxBmWB/aJjS8+/+7Dc/2RmI93SZpmfsqP+2i9X1Q=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/misc/gobgpd/default.nix b/pkgs/servers/misc/gobgpd/default.nix
index b4e1f0cb2ccd..4f653a50a972 100644
--- a/pkgs/servers/misc/gobgpd/default.nix
+++ b/pkgs/servers/misc/gobgpd/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -30,6 +31,8 @@ buildGoModule rec {
     "cmd/gobgpd"
   ];
 
+  passthru.tests = { inherit (nixosTests) gobgpd; };
+
   meta = with lib; {
     description = "BGP implemented in Go";
     mainProgram = "gobgpd";
diff --git a/pkgs/servers/misc/taskserver/default.nix b/pkgs/servers/misc/taskserver/default.nix
index bbd2a4a70da4..a0d13164901a 100644
--- a/pkgs/servers/misc/taskserver/default.nix
+++ b/pkgs/servers/misc/taskserver/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, libuuid, gnutls, makeWrapper }:
+{ lib, stdenv, fetchurl, cmake, libuuid, gnutls, makeWrapper, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "taskserver";
@@ -31,6 +31,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ libuuid gnutls ];
   nativeBuildInputs = [ cmake makeWrapper ];
 
+  passthru.tests = { inherit (nixosTests) taskserver; };
+
   meta = {
     description = "Server for synchronising Taskwarrior clients";
     homepage = "https://taskwarrior.org";
diff --git a/pkgs/servers/monitoring/cadvisor/default.nix b/pkgs/servers/monitoring/cadvisor/default.nix
index dc0d890a429f..a297c85bed3c 100644
--- a/pkgs/servers/monitoring/cadvisor/default.nix
+++ b/pkgs/servers/monitoring/cadvisor/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule rec {
   pname = "cadvisor";
@@ -22,6 +22,8 @@ buildGoModule rec {
     rm $out/bin/example
   '';
 
+  passthru.tests = { inherit (nixosTests) cadvisor; };
+
   meta = with lib; {
     description = "Analyzes resource usage and performance characteristics of running docker containers";
     mainProgram = "cadvisor";
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index c1446b90c870..785c0fecf43f 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, which, coreutils, rrdtool, perlPackages
 , python3, ruby, jre8, nettools, bc
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
@@ -133,6 +134,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests = { inherit (nixosTests) munin; };
+
   meta = with lib; {
     description = "Networked resource monitoring tool";
     longDescription = ''
diff --git a/pkgs/servers/nosql/mongodb/5.0.nix b/pkgs/servers/nosql/mongodb/5.0.nix
index d74bf1e2f3d4..0cb71b57aae1 100644
--- a/pkgs/servers/nosql/mongodb/5.0.nix
+++ b/pkgs/servers/nosql/mongodb/5.0.nix
@@ -1,6 +1,7 @@
 { stdenv, callPackage, lib, sasl, boost
 , Security, CoreFoundation, cctools
 , avxSupport ? stdenv.hostPlatform.avxSupport
+, nixosTests
 }:
 
 let
@@ -29,4 +30,5 @@ buildMongoDB {
     ./asio-no-experimental-string-view-4-4.patch
     ./fix-gcc-Wno-exceptions-5.0.patch
   ] ++ variants.patches;
+  passthru.tests = { inherit (nixosTests) mongodb; };
 }
diff --git a/pkgs/servers/nosql/mongodb/6.0.nix b/pkgs/servers/nosql/mongodb/6.0.nix
index 4e1df2d7a297..839dc5cde024 100644
--- a/pkgs/servers/nosql/mongodb/6.0.nix
+++ b/pkgs/servers/nosql/mongodb/6.0.nix
@@ -22,4 +22,5 @@ buildMongoDB {
       sha256 = "sha256-gWlE2b/NyGe2243iNCXzjcERIY8/4ZWI4Gjh5SF0tYA=";
     })
   ];
+  # passthru.tests = { inherit (nixosTests) mongodb; }; # currently tests mongodb-5_0
 }
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index d1cc3030afd2..47d788b753e3 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -28,6 +28,7 @@
 { version, sha256, patches ? []
 , license ? lib.licenses.sspl
 , avxSupport ? stdenv.hostPlatform.avxSupport
+, passthru ? {}
 }:
 
 let
@@ -59,7 +60,7 @@ let
   inherit (lib) systems subtractLists;
 
 in stdenv.mkDerivation rec {
-  inherit version;
+  inherit version passthru;
   pname = "mongodb";
 
   src = fetchFromGitHub {
diff --git a/pkgs/servers/photoprism/default.nix b/pkgs/servers/photoprism/default.nix
index d7e092943af7..0c39ad8b6b81 100644
--- a/pkgs/servers/photoprism/default.nix
+++ b/pkgs/servers/photoprism/default.nix
@@ -1,4 +1,5 @@
 { pkgs, lib, stdenv, fetchFromGitHub, fetchzip, darktable, rawtherapee, ffmpeg_7, libheif, exiftool, imagemagick, makeWrapper, testers
+, nixosTests
 , librsvg }:
 
 let
@@ -78,6 +79,7 @@ stdenv.mkDerivation {
   '';
 
   passthru.tests.version = testers.testVersion { package = pkgs.photoprism; };
+  passthru.tests.photoprism = nixosTests.photoprism;
 
   meta = with lib; {
     homepage = "https://photoprism.app";
diff --git a/pkgs/servers/plik/default.nix b/pkgs/servers/plik/default.nix
index bcd5ca8c87c8..29ba48487a37 100644
--- a/pkgs/servers/plik/default.nix
+++ b/pkgs/servers/plik/default.nix
@@ -15,7 +15,10 @@ in
 
   inherit (programs) plik plikd-unwrapped;
 
-  plikd = runCommand "plikd-${version}" { nativeBuildInputs = [ makeWrapper ]; } ''
+  plikd = runCommand "plikd-${version}" {
+    nativeBuildInputs = [ makeWrapper ];
+    inherit (programs.plikd-unwrapped) passthru;
+  } ''
     mkdir -p $out/libexec/plikd/{bin,webapp} $out/bin
     tar xf ${webapp} plik-${version}-linux-amd64/webapp/dist/
     mv plik-*/webapp/dist $out/libexec/plikd/webapp
diff --git a/pkgs/servers/plik/programs.nix b/pkgs/servers/plik/programs.nix
index b76d46925557..2b8b5176fb9a 100644
--- a/pkgs/servers/plik/programs.nix
+++ b/pkgs/servers/plik/programs.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper, runCommand }:
+{ lib, buildGoModule, fetchFromGitHub, makeWrapper, runCommand, nixosTests }:
 
 let
   version = "1.3.8";
@@ -25,12 +25,16 @@ let
       --replace '"0.0.0"' '"${version}"'
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) plikd;
+  };
+
 in
 {
 
   plik = buildGoModule {
     pname = "plik";
-    inherit version meta src vendorHash postPatch;
+    inherit version meta src vendorHash postPatch passthru;
 
     subPackages = [ "client" ];
     postInstall = ''
@@ -40,7 +44,7 @@ in
 
   plikd-unwrapped = buildGoModule {
     pname = "plikd-unwrapped";
-    inherit version src vendorHash postPatch;
+    inherit version src vendorHash postPatch passthru;
 
     subPackages = [ "server" ];
     postFixup = ''
diff --git a/pkgs/servers/portunus/default.nix b/pkgs/servers/portunus/default.nix
index 971a6a0967f5..1cbc81afdd97 100644
--- a/pkgs/servers/portunus/default.nix
+++ b/pkgs/servers/portunus/default.nix
@@ -2,6 +2,7 @@
 , buildGoModule
 , fetchFromGitHub
 , libxcrypt
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -19,6 +20,8 @@ buildGoModule rec {
 
   vendorHash = null;
 
+  passthru.tests = { inherit (nixosTests) portunus; };
+
   meta = with lib; {
     description = "Self-contained user/group management and authentication service";
     homepage = "https://github.com/majewsky/portunus";
diff --git a/pkgs/servers/postfixadmin/default.nix b/pkgs/servers/postfixadmin/default.nix
index be879fa03062..26628e13ea08 100644
--- a/pkgs/servers/postfixadmin/default.nix
+++ b/pkgs/servers/postfixadmin/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, stdenv, lib }:
+{ fetchFromGitHub, stdenv, lib, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "postfixadmin";
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
     ln -sf /var/cache/postfixadmin/templates_c $out/
   '';
 
+  passthru.tests = { inherit (nixosTests) postfixadmin; };
+
   meta = {
     description = "Web based virtual user administration interface for Postfix mail servers";
     homepage = "https://postfixadmin.sourceforge.io/";
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 331d1d3c71ac..0186de73fddf 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -7,6 +7,7 @@
 , gst_all_1
 , check, libintl, meson, ninja, m4, wrapGAppsHook3
 , fetchpatch2
+, nixosTests
 
 , x11Support ? false
 
@@ -182,6 +183,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests = { inherit (nixosTests) pulseaudio; };
+
   meta = {
     description = "Sound server for POSIX and Win32 systems";
     homepage    = "http://www.pulseaudio.org/";
diff --git a/pkgs/servers/roundcube/default.nix b/pkgs/servers/roundcube/default.nix
index 6ec9c8c378f2..646379e3e641 100644
--- a/pkgs/servers/roundcube/default.nix
+++ b/pkgs/servers/roundcube/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, buildEnv, roundcube, roundcubePlugins }:
+{ fetchurl, lib, stdenv, buildEnv, roundcube, roundcubePlugins, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "roundcube";
@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
     paths = (f roundcubePlugins) ++ [ roundcube ];
   };
 
+  passthru.tests = { inherit (nixosTests) roundcube; };
+
   meta = {
     description = "Open Source Webmail Software";
     maintainers = with lib.maintainers; [ vskilet globin ma27 ];
diff --git a/pkgs/servers/spicedb/default.nix b/pkgs/servers/spicedb/default.nix
index a7afa073b122..249b2c8d6465 100644
--- a/pkgs/servers/spicedb/default.nix
+++ b/pkgs/servers/spicedb/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "spicedb";
-  version = "1.33.1";
+  version = "1.35.2";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     rev = "v${version}";
-    hash = "sha256-qEEttgo7OqCEuC+mj2e5HW1IpIl5czxScBmaLiJJuUY=";
+    hash = "sha256-r1rrMCeW7NjlMHmNNWIn6EJOLia+9CuI831O5A8kKMA=";
   };
 
-  vendorHash = "sha256-pqHDSQQMvfas9yeyhs5cWokBPISQygz2aHf6W5Zc+co=";
+  vendorHash = "sha256-NOCC34LrJ+7oubL5uOJlSy92GdiVJf3M0yowJ55JNV8=";
 
   ldflags = [
     "-X 'github.com/jzelinskie/cobrautil/v2.Version=${src.rev}'"
diff --git a/pkgs/servers/sql/monetdb/default.nix b/pkgs/servers/sql/monetdb/default.nix
index 6ccddc5faea1..9e9b2b7f95c1 100644
--- a/pkgs/servers/sql/monetdb/default.nix
+++ b/pkgs/servers/sql/monetdb/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, python3, bison, openssl, readline, bzip2 }:
+{ lib, stdenv, fetchurl, cmake, python3, bison, openssl, readline, bzip2, nixosTests }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "monetdb";
@@ -30,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
       $out/bin/Mconvert.py
   '';
 
+  passthru.tests = { inherit (nixosTests) monetdb; };
+
   meta = with lib; {
     description = "Open source database system";
     homepage = "https://www.monetdb.org/";
diff --git a/pkgs/servers/sql/postgresql/ext/pgjwt.nix b/pkgs/servers/sql/postgresql/ext/pgjwt.nix
index 7134c052363d..be088b81f861 100644
--- a/pkgs/servers/sql/postgresql/ext/pgjwt.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgjwt.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, unstableGitUpdater }:
+{ lib, stdenv, fetchFromGitHub, postgresql, unstableGitUpdater, nixosTests }:
 
 stdenv.mkDerivation {
   pname = "pgjwt";
@@ -19,6 +19,8 @@ stdenv.mkDerivation {
 
   passthru.updateScript = unstableGitUpdater { };
 
+  passthru.tests = { inherit (nixosTests) pgjwt; };
+
   meta = with lib; {
     description = "PostgreSQL implementation of JSON Web Tokens";
     longDescription = ''
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index cf75d52e7ac7..0e5651085ea1 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, postgresql, openssl, libkrb5, enableUnfree ? true }:
+{ lib, stdenv, fetchFromGitHub, cmake, postgresql, openssl, libkrb5, nixosTests, enableUnfree ? true }:
 
 stdenv.mkDerivation rec {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
@@ -32,6 +32,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests = { inherit (nixosTests) timescaledb; };
+
   meta = with lib; {
     description = "Scales PostgreSQL for time-series data via automatic partitioning across time and space";
     homepage = "https://www.timescale.com/";
diff --git a/pkgs/servers/trezord/default.nix b/pkgs/servers/trezord/default.nix
index 4055c505daac..247ac6832db3 100644
--- a/pkgs/servers/trezord/default.nix
+++ b/pkgs/servers/trezord/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , fetchpatch
 , trezor-udev-rules
+, nixosTests
 , AppKit
 }:
 
@@ -37,6 +38,8 @@ buildGoModule rec {
     "-X main.githash=${commit}"
   ];
 
+  passthru.tests = { inherit (nixosTests) trezord; };
+
   meta = with lib; {
     description = "Trezor Communication Daemon aka Trezor Bridge";
     homepage = "https://trezor.io";
diff --git a/pkgs/servers/trickster/trickster.nix b/pkgs/servers/trickster/trickster.nix
index 221599065453..d11144a8359a 100644
--- a/pkgs/servers/trickster/trickster.nix
+++ b/pkgs/servers/trickster/trickster.nix
@@ -2,6 +2,7 @@
 , buildGoModule
 , fetchFromGitHub
 , go
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -32,6 +33,8 @@ buildGoModule rec {
   # Tests are broken.
   doCheck = false;
 
+  passthru.tests = { inherit (nixosTests) trickster; };
+
   meta = with lib; {
     description = "Reverse proxy cache and time series dashboard accelerator";
     mainProgram = "trickster";
diff --git a/pkgs/servers/ucarp/default.nix b/pkgs/servers/ucarp/default.nix
index 90cbc562d382..fc9cdf947515 100644
--- a/pkgs/servers/ucarp/default.nix
+++ b/pkgs/servers/ucarp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, libpcap }:
+{ stdenv, lib, fetchurl, libpcap, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "ucarp";
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
   #     `__packed'; ucarp.o:/build/ucarp-1.5.2/src/ip_carp.h:73: first defined here
   env.NIX_CFLAGS_COMPILE = "-fcommon";
 
+  passthru.tests = { inherit (nixosTests) ucarp; };
+
   meta = with lib; {
     description = "Userspace implementation of CARP";
     longDescription = ''
diff --git a/pkgs/servers/web-apps/jirafeau/default.nix b/pkgs/servers/web-apps/jirafeau/default.nix
index bf67125e1dab..96496ee83a64 100644
--- a/pkgs/servers/web-apps/jirafeau/default.nix
+++ b/pkgs/servers/web-apps/jirafeau/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, writeText }:
+{ lib, stdenv, fetchFromGitLab, writeText, nixosTests }:
 let
   localConfig = writeText "config.local.php" ''
     <?php
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
     cp ${localConfig} $out/lib/config.local.php
   '';
 
+  passthru.tests = { inherit (nixosTests) jirafeau; };
+
   meta = with lib; {
     description = "Website permitting upload of a file in a simple way and giving a unique link to it";
     license = licenses.agpl3Plus;
diff --git a/pkgs/servers/web-apps/morty/default.nix b/pkgs/servers/web-apps/morty/default.nix
index b44d2e03bf16..6ee57abc028a 100644
--- a/pkgs/servers/web-apps/morty/default.nix
+++ b/pkgs/servers/web-apps/morty/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule {
   pname = "morty";
@@ -13,6 +13,8 @@ buildGoModule {
 
   vendorHash = "sha256-3sllcoTDYQBAyAT7e9KeKNrlTEbgnoZc0Vt0ksQByvo=";
 
+  passthru.tests = { inherit (nixosTests) morty; };
+
   meta = with lib; {
     description = "Privacy aware web content sanitizer proxy as a service";
     mainProgram = "morty";
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index 62ecc0261ca0..6babb4020395 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -64,7 +64,7 @@ in lib.init bootStages ++ [
         cc = if crossSystem.useiOSPrebuilt or false
                then buildPackages.darwin.iosSdkPkgs.clang
              else if crossSystem.useAndroidPrebuilt or false
-               then buildPackages."androidndkPkgs_${crossSystem.ndkVer}".clang
+               then buildPackages."androidndkPkgs_${crossSystem.androidNdkVersion}".clang
              else if targetPlatform.isGhcjs
                # Need to use `throw` so tryEval for splicing works, ugh.  Using
                # `null` or skipping the attribute would cause an eval failure
diff --git a/pkgs/tools/backup/borgmatic/default.nix b/pkgs/tools/backup/borgmatic/default.nix
index f6f9bcd3c0d3..18318dc8e584 100644
--- a/pkgs/tools/backup/borgmatic/default.nix
+++ b/pkgs/tools/backup/borgmatic/default.nix
@@ -11,6 +11,7 @@
   stdenv,
   systemd,
   testers,
+  nixosTests,
 }:
 python3Packages.buildPythonApplication rec {
   pname = "borgmatic";
@@ -60,7 +61,10 @@ python3Packages.buildPythonApplication rec {
                --replace "sleep " "${coreutils}/bin/sleep "
   '';
 
-  passthru.tests.version = testers.testVersion { package = borgmatic; };
+  passthru.tests = {
+    version = testers.testVersion { package = borgmatic; };
+    inherit (nixosTests) borgmatic;
+  };
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/tools/filesystems/garage/default.nix b/pkgs/tools/filesystems/garage/default.nix
index aa073ab2d5c8..962685c2d537 100644
--- a/pkgs/tools/filesystems/garage/default.nix
+++ b/pkgs/tools/filesystems/garage/default.nix
@@ -11,7 +11,7 @@
 , nixosTests
 }:
 let
-  generic = { version, sha256, cargoHash, eol ? false, broken ? false }: rustPlatform.buildRustPackage {
+  generic = { version, sha256, cargoHash, cargoPatches ? [], eol ? false, broken ? false }: rustPlatform.buildRustPackage {
     pname = "garage";
     inherit version;
 
@@ -29,7 +29,7 @@ let
       rm .cargo/config.toml || true
     '';
 
-    inherit cargoHash;
+    inherit cargoHash cargoPatches;
 
     nativeBuildInputs = [ protobuf pkg-config ];
 
@@ -97,7 +97,8 @@ rec {
   garage_0_8_7 = generic {
     version = "0.8.7";
     sha256 = "sha256-2QGbR6YvMQeMxN3n1MMJ5qfBcEJ5hjXARUOfEn+m4Jc=";
-    cargoHash = "sha256-Q0QyBNPEDrlhgIHD4q7Qb1Pu3xBvzlLOSW7LSWWdoIo=";
+    cargoHash = "sha256-1cGlJP/RRgxt3GGMN1c+7Y5lLHJyvHEnpLsR35R5FfI=";
+    cargoPatches = [ ./update-time-0.8.patch ];
     broken = stdenv.isDarwin;
   };
 
@@ -106,14 +107,16 @@ rec {
   garage_0_9_4 = generic {
     version = "0.9.4";
     sha256 = "sha256-2ZaxenwaVGYYUjUJaGgnGpZNQprQV9+Jns2sXM6cowk=";
-    cargoHash = "sha256-Cssls9csn6qribF+pAAagBydX9e9WTq4K/ehaLCWOOA=";
+    cargoHash = "sha256-1Hrip4R5dr31czOcFMGW4ZvVfVwvdd7LkwukwNpS3o4=";
+    cargoPatches = [ ./update-time.patch ];
     broken = stdenv.isDarwin;
   };
 
   garage_1_0_0 = generic {
     version = "1.0.0";
     sha256 = "sha256-5W5cXylFCrDup+HOOUVPWBJUSphOp8szgtpvRIv82b8=";
-    cargoHash = "sha256-tXO+Vk6bYpayNWi/y4sMtkn2EQ9wiwSAfn79Zbt28q0=";
+    cargoHash = "sha256-zol9P01bwlvl1Wap4EekgVpC45izNCt2uKs7x+EEA/E=";
+    cargoPatches = [ ./update-time.patch ];
     broken = stdenv.isDarwin;
   };
 
diff --git a/pkgs/tools/filesystems/garage/update-time-0.8.patch b/pkgs/tools/filesystems/garage/update-time-0.8.patch
new file mode 100644
index 000000000000..30d3a2207837
--- /dev/null
+++ b/pkgs/tools/filesystems/garage/update-time-0.8.patch
@@ -0,0 +1,111 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 23604c99e5..58355d867e 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -223,7 +223,7 @@
+  "http",
+  "hyper",
+  "ring",
+- "time 0.3.28",
++ "time 0.3.36",
+  "tokio",
+  "tower",
+  "tracing",
+@@ -393,7 +393,7 @@
+  "percent-encoding",
+  "regex",
+  "sha2",
+- "time 0.3.28",
++ "time 0.3.36",
+  "tracing",
+ ]
+ 
+@@ -533,7 +533,7 @@
+  "itoa",
+  "num-integer",
+  "ryu",
+- "time 0.3.28",
++ "time 0.3.36",
+ ]
+ 
+ [[package]]
+@@ -932,9 +932,12 @@
+ 
+ [[package]]
+ name = "deranged"
+-version = "0.3.8"
++version = "0.3.11"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
++checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
++dependencies = [
++ "powerfmt",
++]
+ 
+ [[package]]
+ name = "derivative"
+@@ -2410,6 +2413,12 @@
+ ]
+ 
+ [[package]]
++name = "num-conv"
++version = "0.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
++
++[[package]]
+ name = "num-integer"
+ version = "0.1.45"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+@@ -2747,6 +2756,12 @@
+ ]
+ 
+ [[package]]
++name = "powerfmt"
++version = "0.2.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
++
++[[package]]
+ name = "ppv-lite86"
+ version = "0.2.17"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+@@ -3666,11 +3681,13 @@
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.28"
++version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "17f6bb557fd245c28e6411aa56b6403c689ad95061f50e4be16c274e70a17e48"
++checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
++ "num-conv",
++ "powerfmt",
+  "serde",
+  "time-core",
+  "time-macros",
+@@ -3678,16 +3695,17 @@
+ 
+ [[package]]
+ name = "time-core"
+-version = "0.1.1"
++version = "0.1.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"
++checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.14"
++version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1a942f44339478ef67935ab2bbaec2fb0322496cf3cbe84b261e06ac3814c572"
++checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
++ "num-conv",
+  "time-core",
+ ]
+ 
+
diff --git a/pkgs/tools/filesystems/garage/update-time.patch b/pkgs/tools/filesystems/garage/update-time.patch
new file mode 100644
index 000000000000..405fc5fef282
--- /dev/null
+++ b/pkgs/tools/filesystems/garage/update-time.patch
@@ -0,0 +1,28 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 9cb4b57ee5..b23da31151 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -4082,9 +4082,9 @@
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.34"
++version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
++checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "num-conv",
+@@ -4102,9 +4102,9 @@
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.17"
++version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
++checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+  "num-conv",
+  "time-core",
diff --git a/pkgs/tools/filesystems/moosefs/default.nix b/pkgs/tools/filesystems/moosefs/default.nix
index 48ec4cea7c98..54a78f89c399 100644
--- a/pkgs/tools/filesystems/moosefs/default.nix
+++ b/pkgs/tools/filesystems/moosefs/default.nix
@@ -5,6 +5,7 @@
 , pkg-config
 , libpcap
 , zlib
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
@@ -47,6 +48,8 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  passthru.tests = { inherit (nixosTests) moosefs; };
+
   meta = with lib; {
     homepage = "https://moosefs.com";
     description = "Open Source, Petabyte, Fault-Tolerant, Highly Performing, Scalable Network Distributed File System";
diff --git a/pkgs/tools/filesystems/netatalk/default.nix b/pkgs/tools/filesystems/netatalk/default.nix
index 950d10640bf0..6262de5f94e8 100644
--- a/pkgs/tools/filesystems/netatalk/default.nix
+++ b/pkgs/tools/filesystems/netatalk/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "netatalk";
-  version = "3.1.18";
+  version = "3.1.19";
 
   src = fetchurl {
     url = "mirror://sourceforge/netatalk/netatalk/netatalk-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-htIJ3Hd2pLoXhFFk0uN2pGnO43aiexiuMYmOP0ukFlU=";
+    hash = "sha256-p0pzHwnjNNWPsWRBflgaZB+ijMP5bF99TEdLs4mVKsI=";
   };
 
   patches = [
diff --git a/pkgs/tools/filesystems/orangefs/default.nix b/pkgs/tools/filesystems/orangefs/default.nix
index 235639457a31..0566a8a4c129 100644
--- a/pkgs/tools/filesystems/orangefs/default.nix
+++ b/pkgs/tools/filesystems/orangefs/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch, bison, flex, autoreconfHook
 , openssl, db, attr, perl, tcsh
+, nixosTests
 } :
 
 stdenv.mkDerivation rec {
@@ -60,6 +61,8 @@ stdenv.mkDerivation rec {
     sed -i 's:openssl:${openssl}/bin/openssl:' $out/bin/pvfs2-gen-keys.sh
   '';
 
+  passthru.tests = { inherit (nixosTests) orangefs; };
+
   meta = with lib; {
     description = "Scale-out network file system for use on high-end computing systems";
     homepage = "http://www.orangefs.org/";
diff --git a/pkgs/tools/misc/diffoci/default.nix b/pkgs/tools/misc/diffoci/default.nix
index 6337b2d500c4..b2142cfc227e 100644
--- a/pkgs/tools/misc/diffoci/default.nix
+++ b/pkgs/tools/misc/diffoci/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "diffoci";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "reproducible-containers";
     repo = "diffoci";
     rev = "v${version}";
-    hash = "sha256-BTggky5behIxbVxyDZ09uobw0FBopboE9uUBEVgCgR4=";
+    hash = "sha256-ZVWnfg5uWYuqsNd4X6t1gWBGMfdcirSp7QZZDhqAfaI=";
   };
 
-  vendorHash = "sha256-4C35LBxSm6EkcOznQY1hT2vX9bwFfps/q76VqqPKBfI=";
+  vendorHash = "sha256-qb4HvK4UbJbtP/ypeptV/MMbhOu5UZDaGartq/RGpDM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 57f29a9d103d..b95f6d6d9b3c 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -8,6 +8,7 @@
 , git
 , inetutils
 , stdenv
+, nixosTests
 }:
 
 let
@@ -133,6 +134,7 @@ python.pkgs.buildPythonApplication rec {
   passthru = {
     dashboard = python.pkgs.esphome-dashboard;
     updateScript = callPackage ./update.nix { };
+    tests = { inherit (nixosTests) esphome; };
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/opentelemetry-collector/default.nix b/pkgs/tools/misc/opentelemetry-collector/default.nix
index 05e5f9425462..f372d705491f 100644
--- a/pkgs/tools/misc/opentelemetry-collector/default.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , installShellFiles
 , testers
+, nixosTests
 , opentelemetry-collector
 }:
 
@@ -41,10 +42,13 @@ buildGoModule rec {
       --zsh <($out/bin/otelcorecol completion zsh)
   '';
 
-  passthru.tests.version = testers.testVersion {
-    inherit version;
-    package = opentelemetry-collector;
-    command = "otelcorecol -v";
+  passthru.tests = {
+    version = testers.testVersion {
+      inherit version;
+      package = opentelemetry-collector;
+      command = "otelcorecol -v";
+    };
+    inherit (nixosTests) opentelemetry-collector;
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/plotinus/default.nix b/pkgs/tools/misc/plotinus/default.nix
index 2cd2a74f6fde..f8b50d55cdf4 100644
--- a/pkgs/tools/misc/plotinus/default.nix
+++ b/pkgs/tools/misc/plotinus/default.nix
@@ -7,6 +7,7 @@
 , cmake
 , ninja
 , vala
+, nixosTests
 , wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
@@ -33,6 +34,8 @@ stdenv.mkDerivation rec {
     gtk3
   ];
 
+  passthru.tests = { inherit (nixosTests) plotinus; };
+
   meta = with lib; {
     description = "Searchable command palette in every modern GTK application";
     homepage = "https://github.com/p-e-w/plotinus";
diff --git a/pkgs/tools/misc/tailspin/default.nix b/pkgs/tools/misc/tailspin/default.nix
index 4e837df61c7c..25aba0ebb95d 100644
--- a/pkgs/tools/misc/tailspin/default.nix
+++ b/pkgs/tools/misc/tailspin/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tailspin";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "bensadeh";
     repo = "tailspin";
     rev = version;
-    hash = "sha256-Aqm7Nt+rAu8A2216JCuID1eIpWSdKpoKjILYovr7bYw=";
+    hash = "sha256-STQtWLrRS76sowGOBLZqeE8bYcDUjI5ErQD3D7z98M8=";
   };
 
-  cargoHash = "sha256-uTUowYoLEywGNzPyxq53Si5GSrh/F9kUFIDjw/wfdAQ=";
+  cargoHash = "sha256-gNyegmr7Iv7dRe/bCwxLbhVkhex0D9ylF5Eulix26tg=";
 
   meta = with lib; {
     description = "Log file highlighter";
diff --git a/pkgs/tools/misc/watchexec/default.nix b/pkgs/tools/misc/watchexec/default.nix
index 32ee78ff6cb0..cd7381243cc4 100644
--- a/pkgs/tools/misc/watchexec/default.nix
+++ b/pkgs/tools/misc/watchexec/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "watchexec";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-S0c/UqdbEqhZRkxZonW1TPQLmGbZeiK14yPbW5dpI70=";
+    hash = "sha256-mH670pBxSQQ4mTtX6O71aRRxRVyz0J7r4227UsUJ5LE=";
   };
 
-  cargoHash = "sha256-IuubIEu2mY3h1i9gJgQlyVoGwUYWsdp8+hKYyz0j3is=";
+  cargoHash = "sha256-cBxFaERUDaOxAYfpvBdJa9LxvrG2niJqVovcZDucbUA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [ "--skip=help" "--skip=help_short" ];
 
   postPatch = ''
-    rm .cargo/config
+    rm .cargo/config.toml
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/misc/zitadel-tools/default.nix b/pkgs/tools/misc/zitadel-tools/default.nix
index 83d4cc147205..1837280f9757 100644
--- a/pkgs/tools/misc/zitadel-tools/default.nix
+++ b/pkgs/tools/misc/zitadel-tools/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "zitadel-tools";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "zitadel";
     repo = "zitadel-tools";
     rev = "v${version}";
-    hash = "sha256-r9GEHpfDlpK98/dnsxjhUgWKn6vHQla8Z+jQUVrHGyo=";
+    hash = "sha256-wtCBRsP0b7qPOQfYgvmgDT0t2zZHocokO5J8yLZcsgQ=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorHash = "sha256-y2PYj0XRSgfiaYpeqAh4VR/+NKUPKd1c0w9pPCWsUrY=";
+  vendorHash = "sha256-ql5Qw5Va/wLBKsb9bCmPciuVrgORU8nndRkhjoJBIgs=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/tools/networking/croc/default.nix b/pkgs/tools/networking/croc/default.nix
index 17caf588c3b3..d719c3f9b06a 100644
--- a/pkgs/tools/networking/croc/default.nix
+++ b/pkgs/tools/networking/croc/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, callPackage }:
+{ lib, buildGoModule, fetchFromGitHub, callPackage, nixosTests }:
 
 buildGoModule rec {
   pname = "croc";
@@ -18,6 +18,7 @@ buildGoModule rec {
   passthru = {
     tests = {
       local-relay = callPackage ./test-local-relay.nix { };
+      inherit (nixosTests) croc;
     };
   };
 
diff --git a/pkgs/tools/networking/dae/default.nix b/pkgs/tools/networking/dae/default.nix
index 52adba063ee5..783cf6cc8622 100644
--- a/pkgs/tools/networking/dae/default.nix
+++ b/pkgs/tools/networking/dae/default.nix
@@ -3,6 +3,7 @@
   clang,
   fetchFromGitHub,
   buildGoModule,
+  nixosTests,
 }:
 buildGoModule rec {
   pname = "dae";
@@ -46,6 +47,10 @@ buildGoModule rec {
       --replace /usr/bin/dae $out/bin/dae
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) dae;
+  };
+
   meta = with lib; {
     description = "Linux high-performance transparent proxy solution based on eBPF";
     homepage = "https://github.com/daeuniverse/dae";
diff --git a/pkgs/tools/networking/dnscrypt-proxy/default.nix b/pkgs/tools/networking/dnscrypt-proxy/default.nix
index eeb8696bc8ed..1a3f06ef0cac 100644
--- a/pkgs/tools/networking/dnscrypt-proxy/default.nix
+++ b/pkgs/tools/networking/dnscrypt-proxy/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule rec {
   pname = "dnscrypt-proxy";
@@ -15,6 +15,8 @@ buildGoModule rec {
     sha256 = "sha256-A9Cu4wcJxrptd9CpgXw4eyMX2nmNAogYBRDeeAjpEZY=";
   };
 
+  passthru.tests = { inherit (nixosTests) dnscrypt-proxy2; };
+
   meta = with lib; {
     description = "Tool that provides secure DNS resolution";
 
diff --git a/pkgs/tools/networking/grpc_cli/default.nix b/pkgs/tools/networking/grpc_cli/default.nix
index fc5c996a3a18..0c7454141a2f 100644
--- a/pkgs/tools/networking/grpc_cli/default.nix
+++ b/pkgs/tools/networking/grpc_cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc_cli";
-  version = "1.65.2";
+  version = "1.65.5";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-G9Wo5ySqexxn/Od8qPvmHOhW+X/U6/MMZqtZ6uFKifY=";
+    hash = "sha256-3dMLv4qhZ+X+Now++G8mvp/WIgAIDnMwcZ6rXdVhBjE=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [ automake cmake autoconf ];
diff --git a/pkgs/tools/networking/miniupnpc/default.nix b/pkgs/tools/networking/miniupnpc/default.nix
index b643e472ea62..6942e682a813 100644
--- a/pkgs/tools/networking/miniupnpc/default.nix
+++ b/pkgs/tools/networking/miniupnpc/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  nixosTests,
 }:
 
 stdenv.mkDerivation rec {
@@ -33,6 +34,10 @@ stdenv.mkDerivation rec {
     mv $out/bin/external-ip.sh $out/bin/external-ip
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) upnp;
+  };
+
   meta = with lib; {
     homepage = "https://miniupnp.tuxfamily.org/";
     description = "Client that implements the UPnP Internet Gateway Device (IGD) specification";
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 9a3e039267b6..8f18bfd3cdaa 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -60,11 +60,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.48.6";
+  version = "1.48.8";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    hash = "sha256-5lxJbgZjGkl3x5XA8khZjDnDQOVjXXz1TsMHKsyZiZU=";
+    hash = "sha256-YgDqyPHT/mo+ofLEFYs8lbO5+R50zXBOl7CwUbWlSHg=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
diff --git a/pkgs/tools/networking/oha/default.nix b/pkgs/tools/networking/oha/default.nix
index c25d471abf2e..71bc43135455 100644
--- a/pkgs/tools/networking/oha/default.nix
+++ b/pkgs/tools/networking/oha/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oha";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "hatoo";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-siYJVx5WYveCDpLYp+Bapnr9KSitmBlw9RFkrqPZYCQ=";
+    hash = "sha256-SqspsXVFeYNyTm6Pvt8i/W7MAbary7chs+C+ku8z4Eo=";
   };
 
-  cargoHash = "sha256-ieutZfp1vw3/wVLQ/GQu+W8fEqYS7peHFBrWjZ4qLwU=";
+  cargoHash = "sha256-ks7n/x3RhjQbITL2hxiFkjxpZ5tcYMUyyfR/T7Kq/uU=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
     pkg-config
diff --git a/pkgs/tools/networking/pykms/default.nix b/pkgs/tools/networking/pykms/default.nix
index a8dcbbebe141..b94922d35596 100644
--- a/pkgs/tools/networking/pykms/default.nix
+++ b/pkgs/tools/networking/pykms/default.nix
@@ -4,6 +4,7 @@
 , writeText
 , writeShellScript
 , sqlite
+, nixosTests
 }:
 let
   pypkgs = python3.pkgs;
@@ -83,6 +84,8 @@ pypkgs.buildPythonApplication rec {
     runHook postInstall
   '';
 
+  passthru.tests = { inherit (nixosTests) pykms; };
+
   meta = with lib; {
     description = "Windows KMS (Key Management Service) server written in Python";
     homepage = "https://github.com/Py-KMS-Organization/py-kms";
diff --git a/pkgs/tools/networking/rathole/default.nix b/pkgs/tools/networking/rathole/default.nix
index 1f12ed46b147..8453792e703e 100644
--- a/pkgs/tools/networking/rathole/default.nix
+++ b/pkgs/tools/networking/rathole/default.nix
@@ -4,6 +4,7 @@
 , rustPlatform
 , pkg-config
 , openssl
+, nixosTests
 , CoreServices
 }:
 
@@ -34,6 +35,8 @@ rustPlatform.buildRustPackage rec {
 
   doCheck = false; # https://github.com/rapiz1/rathole/issues/222
 
+  passthru.tests = { inherit (nixosTests) rathole; };
+
   meta = with lib; {
     description = "Reverse proxy for NAT traversal";
     homepage = "https://github.com/rapiz1/rathole";
diff --git a/pkgs/tools/networking/tinc/default.nix b/pkgs/tools/networking/tinc/default.nix
index 2ca679b16c85..6250ec84d9df 100644
--- a/pkgs/tools/networking/tinc/default.nix
+++ b/pkgs/tools/networking/tinc/default.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
   ];
 
+  #passthru.tests = { inherit (nixosTests) tinc; }; # test uses tinc_pre
+
   meta = {
     description = "VPN daemon with full mesh routing";
     longDescription = ''
diff --git a/pkgs/tools/networking/tinc/pre.nix b/pkgs/tools/networking/tinc/pre.nix
index f15f398dc7db..31757dcf4c72 100644
--- a/pkgs/tools/networking/tinc/pre.nix
+++ b/pkgs/tools/networking/tinc/pre.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, texinfo, ncurses, readline, zlib, lzo, openssl }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, texinfo, ncurses, readline, zlib, lzo, openssl, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "tinc";
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
   ];
 
+  passthru.tests = { inherit (nixosTests) tinc; };
+
   meta = with lib; {
     description = "VPN daemon with full mesh routing";
     longDescription = ''
diff --git a/pkgs/tools/package-management/pdm/default.nix b/pkgs/tools/package-management/pdm/default.nix
index 347a78b9af85..234a6265144b 100644
--- a/pkgs/tools/package-management/pdm/default.nix
+++ b/pkgs/tools/package-management/pdm/default.nix
@@ -1,73 +1,65 @@
-{ lib
-, python3
-, fetchPypi
-, nix-update-script
-, runtimeShell
-, installShellFiles
-, testers
-, pdm
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  runtimeShell,
+  installShellFiles,
+  testers,
+  pdm,
 }:
 
-with python3.pkgs;
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "pdm";
-  version = "2.17.3";
+  version = "2.18.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = python3.pkgs.pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-9JIg8iXscSWMv3FIsUp2yurGEnRb7atn+QYjmOpWp6U=";
+  src = fetchFromGitHub {
+    owner = "pdm-project";
+    repo = "pdm";
+    rev = "refs/tags/${version}";
+    hash = "sha256-pCBwt55tu9bEVVHfdPsJ5vaJXVXEZ2+4ft9LathwBt0=";
   };
 
-  nativeBuildInputs = [
-    installShellFiles
-  ];
+  nativeBuildInputs = [ installShellFiles ];
 
-  build-system = [
+  build-system = with python3.pkgs; [
     pdm-backend
     pdm-build-locked
   ];
 
-  dependencies = [
-    blinker
-    dep-logic
-    filelock
-    findpython
-    hishel
-    httpx
-    installer
-    msgpack
-    packaging
-    pbs-installer
-    platformdirs
-    pyproject-hooks
-    python-dotenv
-    resolvelib
-    rich
-    shellingham
-    tomlkit
-    unearth
-    virtualenv
-  ] ++ httpx.optional-dependencies.socks
-  ++ lib.optionals (pythonOlder "3.11") [
-    tomli
-  ]
-  ++ lib.optionals (pythonOlder "3.10") [
-    importlib-metadata
-  ]
-  ++ lib.optionals (pythonAtLeast "3.10") [
-    truststore
-  ];
+  dependencies =
+    with python3.pkgs;
+    [
+      blinker
+      dep-logic
+      filelock
+      findpython
+      hishel
+      httpx
+      installer
+      msgpack
+      packaging
+      pbs-installer
+      platformdirs
+      pyproject-hooks
+      python-dotenv
+      resolvelib
+      rich
+      shellingham
+      tomlkit
+      truststore
+      unearth
+      virtualenv
+    ]
+    ++ httpx.optional-dependencies.socks;
 
-  makeWrapperArgs = [
-    "--set PDM_CHECK_UPDATE 0"
-  ];
+  makeWrapperArgs = [ "--set PDM_CHECK_UPDATE 0" ];
 
+  # Silence network warning during pypaInstallPhase
+  # by disabling latest version check
   preInstall = ''
-    # Silence network warning during pypaInstallPhase
-    # by disabling latest version check
     export PDM_CHECK_UPDATE=0
   '';
 
@@ -80,7 +72,7 @@ buildPythonApplication rec {
     unset PDM_LOG_DIR
   '';
 
-  nativeCheckInputs = [
+  nativeCheckInputs = with python3.pkgs; [
     first
     pytestCheckHook
     pytest-mock
@@ -88,9 +80,7 @@ buildPythonApplication rec {
     pytest-httpserver
   ];
 
-  pytestFlagsArray = [
-    "-m 'not network'"
-  ];
+  pytestFlagsArray = [ "-m 'not network'" ];
 
   preCheck = ''
     export HOME=$TMPDIR
@@ -115,18 +105,17 @@ buildPythonApplication rec {
 
   __darwinAllowLocalNetworking = true;
 
-  passthru.tests.version = testers.testVersion {
-    package = pdm;
-  };
-
-  passthru.updateScript = nix-update-script { };
+  passthru.tests.version = testers.testVersion { package = pdm; };
 
   meta = with lib; {
     homepage = "https://pdm-project.org";
     changelog = "https://github.com/pdm-project/pdm/releases/tag/${version}";
     description = "Modern Python package and dependency manager supporting the latest PEP standards";
     license = licenses.mit;
-    maintainers = with maintainers; [ cpcloud ];
+    maintainers = with maintainers; [
+      cpcloud
+      natsukium
+    ];
     mainProgram = "pdm";
   };
 }
diff --git a/pkgs/tools/security/cloudlist/default.nix b/pkgs/tools/security/cloudlist/default.nix
index 70e09efd747d..c2a998d9814f 100644
--- a/pkgs/tools/security/cloudlist/default.nix
+++ b/pkgs/tools/security/cloudlist/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cloudlist";
-  version = "1.0.8";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cloudlist";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UyZ9KSjFu/NKiz4AZoKwHiWzh+KOARDmveCWcFbOS7A=";
+    hash = "sha256-aXKDSV/+okwO4UbljQr2fS/UcJkb5gC1nPZgpN7GuLY=";
   };
 
-  vendorHash = "sha256-tMrTAbfD+ip/UxrGTaMswgqo94rJZ0lqqxPgYFhZoTY=";
+  vendorHash = "sha256-xRxbLI+CEgMYh3nThUCqcKQR6AQV/J6E98xVTfcD2h4=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/security/doas/default.nix b/pkgs/tools/security/doas/default.nix
index 2864a1edcf4d..3a43a575589a 100644
--- a/pkgs/tools/security/doas/default.nix
+++ b/pkgs/tools/security/doas/default.nix
@@ -4,6 +4,7 @@
 , bison
 , pam
 , libxcrypt
+, nixosTests
 
 , withPAM ? true
 , withTimestamp ? true
@@ -48,6 +49,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional withPAM pam
     ++ lib.optional (!withPAM) libxcrypt;
 
+  passthru.tests = { inherit (nixosTests) doas; };
+
   meta = with lib; {
     description = "Executes the given command as another user";
     mainProgram = "doas";
diff --git a/pkgs/tools/security/ecryptfs/default.nix b/pkgs/tools/security/ecryptfs/default.nix
index 777aaea41ec2..24246a5de9c5 100644
--- a/pkgs/tools/security/ecryptfs/default.nix
+++ b/pkgs/tools/security/ecryptfs/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, perl, util-linux, keyutils, nss, nspr, python2, pam, enablePython ? false
-, intltool, makeWrapper, coreutils, bash, gettext, cryptsetup, lvm2, rsync, which, lsof }:
+, intltool, makeWrapper, coreutils, bash, gettext, cryptsetup, lvm2, rsync, which, lsof, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "ecryptfs";
@@ -58,6 +58,8 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests = { inherit (nixosTests) ecryptfs; };
+
   meta = with lib; {
     description = "Enterprise-class stacked cryptographic filesystem";
     license     = licenses.gpl2Plus;
diff --git a/pkgs/tools/security/jadx/default.nix b/pkgs/tools/security/jadx/default.nix
index 171f36725682..07c9a4a6c29b 100644
--- a/pkgs/tools/security/jadx/default.nix
+++ b/pkgs/tools/security/jadx/default.nix
@@ -5,7 +5,7 @@
   gradle,
   jdk,
   quark-engine,
-  makeWrapper,
+  makeBinaryWrapper,
   imagemagick,
   makeDesktopItem,
   copyDesktopItems,
@@ -23,11 +23,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+F+PHAd1+FmdAlQkjYDBsUYCUzKXG19ZUEorfvBUEg0=";
   };
 
+  patches = [
+    # Remove use of launch4j - contains platform binaries not able to be cached by mitmCache
+    ./no-native-deps.diff
+  ];
+
   nativeBuildInputs = [
     gradle
     jdk
     imagemagick
-    makeWrapper
+    makeBinaryWrapper
     copyDesktopItems
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ desktopToDarwinBundle ];
 
@@ -83,7 +88,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/skylot/jadx/releases/tag/v${finalAttrs.version}";
     description = "Dex to Java decompiler";
+    homepage = "https://github.com/skylot/jadx";
     longDescription = ''
       Command line and GUI tools for produce Java source code from Android Dex
       and Apk files.
diff --git a/pkgs/tools/security/jadx/deps.json b/pkgs/tools/security/jadx/deps.json
index 83dc122c6a39..be81d7a4acee 100644
--- a/pkgs/tools/security/jadx/deps.json
+++ b/pkgs/tools/security/jadx/deps.json
@@ -145,13 +145,6 @@
    "module": "sha256-akesUDZOZZhFlAH7hvm2z832N7mzowRbHMM8v0xAghg=",
    "pom": "sha256-rrO3CiTBA+0MVFQfNfXFEdJ85gyuN2pZbX1lNpf4zJU="
   },
-  "com/thoughtworks/xstream#xstream-parent/1.4.20": {
-   "pom": "sha256-ERiJ4wIWWg9EpU3k23BSUNHeDckbp4oZih0ieDRL7uc="
-  },
-  "com/thoughtworks/xstream#xstream/1.4.20": {
-   "jar": "sha256-h98PC+V8kgN9ARD7siWjC2UXAtwnVlPSha/P7zG8LoE=",
-   "pom": "sha256-c9gezjnpSh0tf80BhGYqo9QQa/6XCbeTlkiS4+f0/cQ="
-  },
   "commons-codec#commons-codec/1.16.0": {
    "jar": "sha256-VllfsgsLhbyR0NUD2tULt/G5r8Du1d/6bLslkpAASE0=",
    "pom": "sha256-bLWVeBnfOTlW/TEaOgw/XuwevEm6Wy0J8/ROYWf6PnQ="
@@ -165,21 +158,9 @@
    "module": "sha256-eYp7cGdyE27iijLt2GOx6fgWE6NJhAXXS+ilyb6/9U8=",
    "pom": "sha256-20U7urXn2opDE5sNzTuuZykzIfKcTZH1p5XZ/2xS3d8="
   },
-  "edu/sc/seis/launch4j#edu.sc.seis.launch4j.gradle.plugin/3.0.5": {
-   "pom": "sha256-Nplw/agsRFMGIjSqxiwBbqw5nY8C2VKdUe28QY0fzPs="
-  },
-  "edu/sc/seis/launch4j#launch4j/3.0.5": {
-   "jar": "sha256-4x62k3vvPwCsxAPkraf7ihY4ATiQ0bNSVmiFBocx7WM=",
-   "module": "sha256-+hiZBJpE2pdEnjoBvCx9rC01t0npPPdsBDSuzjT9ux8=",
-   "pom": "sha256-UvTlC0T2dzuebNq7jmmveQc4IW+8ZxJ1G77tGKFCknk="
-  },
   "io/fabric8#kubernetes-client-bom/5.12.2": {
    "pom": "sha256-6qA8FpVlaNVKa6Q31J1Ay/DdjpOXf5hDGCQldrZQvDs="
   },
-  "io/github/x-stream#mxparser/1.2.2": {
-   "jar": "sha256-ru7iOjMD2BG8qHkOp/JbU0MUhhwDz/Ntr9zCGAlp65c=",
-   "pom": "sha256-I1AiQk4S8zGB9iraGcxEKAGbaXZXw8OSzjVxYKQi+qg="
-  },
   "io/netty#netty-bom/4.1.86.Final": {
    "pom": "sha256-EnFsH+ZM9b2qcETTfROq46iIIbkdR5hCDEanR2kXiv0="
   },
@@ -189,12 +170,6 @@
   "jakarta/platform#jakartaee-api-parent/9.0.0": {
    "pom": "sha256-9l3PFLbh2RSOGYo5D6/hVfrKCTJT3ekAMH8+DqgsrTs="
   },
-  "net/sf/launch4j#launch4j/3.50": {
-   "pom": "sha256-1716EuPm1bR/Ou0p/4g89cTKnie3GWkQZnkzH6N+xy0="
-  },
-  "net/sf/launch4j#launch4j/3.50/core": {
-   "jar": "sha256-2U8eT20fHhl9Es7vpwot75OMzxbig+mjx0Cmb/WGvW8="
-  },
   "org/apache#apache/23": {
    "pom": "sha256-vBBiTgYj82V3+sVjnKKTbTJA7RUvttjVM6tNJwVDSRw="
   },
@@ -619,10 +594,6 @@
   },
   "se/patrikerdes/use-latest-versions#se.patrikerdes.use-latest-versions.gradle.plugin/0.2.18": {
    "pom": "sha256-6DCee4xZSPaNwK2dl7lOwIsfw5lm2eXsrsNOzFbMnnI="
-  },
-  "xmlpull#xmlpull/1.1.3.1": {
-   "jar": "sha256-NOCO5iEWBxy7acDtcNFaelsgjWJ5jFnyEgu4kpMky2M=",
-   "pom": "sha256-jxD/2N8NPpgZyMyEAnCcaySLxTqVTvbkVHDZrjpXNfs="
   }
  },
  "https://repo.maven.apache.org/maven2": {
@@ -905,12 +876,6 @@
   "net/java#jvnet-parent/3": {
    "pom": "sha256-MPV4nvo53b+WCVqto/wSYMRWH68vcUaGcXyy3FBJR1o="
   },
-  "net/sf/launch4j#launch4j/3.50": {
-   "pom": "sha256-1716EuPm1bR/Ou0p/4g89cTKnie3GWkQZnkzH6N+xy0="
-  },
-  "net/sf/launch4j#launch4j/3.50/workdir-mac": {
-   "jar": "sha256-ciYD+rZJnfaTUvdmC5+Y8MSF6aREBAD/f6PWJ/kXOyQ="
-  },
   "net/sf/saxon#Saxon-HE/10.6": {
    "jar": "sha256-bQjfguTthrarsaAse3SiaPz8XgBOg7tP8AbsOlCb01Y=",
    "pom": "sha256-otbdpDjoZKuTXzG0O1MFLE6HEalQVkJxkZBRPnb0Ekg="
diff --git a/pkgs/tools/security/jadx/no-native-deps.diff b/pkgs/tools/security/jadx/no-native-deps.diff
new file mode 100644
index 000000000000..e507c10133fd
--- /dev/null
+++ b/pkgs/tools/security/jadx/no-native-deps.diff
@@ -0,0 +1,68 @@
+diff --git a/jadx-gui/build.gradle.kts b/jadx-gui/build.gradle.kts
+index 09f2c05f..bdb641b0 100644
+--- a/jadx-gui/build.gradle.kts
++++ b/jadx-gui/build.gradle.kts
+@@ -1,7 +1,6 @@
+ plugins {
+ 	id("jadx-kotlin")
+ 	id("application")
+-	id("edu.sc.seis.launch4j") version "3.0.5"
+ 	id("com.github.johnrengelman.shadow") version "8.1.1"
+ 	id("org.beryx.runtime") version "1.13.1"
+ }
+@@ -101,24 +100,6 @@
+ 	}
+ }
+ 
+-launch4j {
+-	mainClassName.set(application.mainClass.get())
+-	copyConfigurable.set(listOf<Any>())
+-	setJarTask(tasks.shadowJar.get())
+-	icon.set("$projectDir/src/main/resources/logos/jadx-logo.ico")
+-	outfile.set("jadx-gui-$jadxVersion.exe")
+-	copyright.set("Skylot")
+-	windowTitle.set("jadx")
+-	companyName.set("jadx")
+-	jreMinVersion.set("11")
+-	jvmOptions.set(application.applicationDefaultJvmArgs.toSet())
+-	requires64Bit.set(true)
+-	initialHeapPercent.set(5)
+-	maxHeapSize.set(4096)
+-	maxHeapPercent.set(70)
+-	downloadUrl.set("https://www.oracle.com/java/technologies/downloads/#jdk17-windows")
+-	bundledJrePath.set(if (project.hasProperty("bundleJRE")) "%EXEDIR%/jre" else "%JAVA_HOME%")
+-}
+ 
+ runtime {
+ 	addOptions("--strip-debug", "--compress", "2", "--no-header-files", "--no-man-pages")
+@@ -137,30 +118,6 @@
+ 	}
+ }
+ 
+-val copyDistWinWithJre by tasks.registering(Copy::class) {
+-	group = "jadx"
+-	dependsOn(tasks.named("runtime"), tasks.named("createExe"))
+-	from(runtime.jreDir) {
+-		include("**/*")
+-		into("jre")
+-	}
+-	from(tasks.named("createExe").get().outputs) {
+-		include("*.exe")
+-	}
+-	into(layout.buildDirectory.dir("jadx-gui-$jadxVersion-with-jre-win"))
+-	duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+-}
+-
+-val distWinWithJre by tasks.registering(Zip::class) {
+-	group = "jadx"
+-	dependsOn(copyDistWinWithJre)
+-	archiveFileName.set("jadx-gui-$jadxVersion-with-jre-win.zip")
+-	from(copyDistWinWithJre.get().outputs) {
+-		include("**/*")
+-	}
+-	into(layout.buildDirectory.asFile)
+-	duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+-}
+ 
+ val addNewNLSLines by tasks.registering(JavaExec::class) {
+ 	group = "jadx"
diff --git a/pkgs/tools/security/slsa-verifier/default.nix b/pkgs/tools/security/slsa-verifier/default.nix
index 0d261fc3a6fd..558d1c74b594 100644
--- a/pkgs/tools/security/slsa-verifier/default.nix
+++ b/pkgs/tools/security/slsa-verifier/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "slsa-verifier";
-  version = "2.5.1";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "slsa-framework";
     repo = "slsa-verifier";
     rev = "v${version}";
-    hash = "sha256-vDzgbE/Cl3TMVzf6H300EtDpGPYBkkSOJBu+0l2fPFw=";
+    hash = "sha256-x9phhfQVeUO7NRjB6n1rdwkpeCu4VMUcJTrkP6PfVyA=";
   };
 
-  vendorHash = "sha256-NkEYr56Wb3EV7TI+0W7w7PdmbZpX3/yQ4TbOebqW9ng=";
+  vendorHash = "sha256-HJ3/RY0Co86y1t2Mas5C+rjwRRG4ZJgxjkz9iWcKf5E=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/tools/system/fakeroot/default.nix b/pkgs/tools/system/fakeroot/default.nix
index f4402a876588..bd04625d44f9 100644
--- a/pkgs/tools/system/fakeroot/default.nix
+++ b/pkgs/tools/system/fakeroot/default.nix
@@ -78,6 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://salsa.debian.org/clint/fakeroot";
     description = "Give a fake root environment through LD_PRELOAD";
+    mainProgram = "fakeroot";
     license = lib.licenses.gpl2Plus;
     maintainers = [ ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/tools/system/hddfancontrol/default.nix b/pkgs/tools/system/hddfancontrol/default.nix
index 64409cbcdba0..7af08d9108bf 100644
--- a/pkgs/tools/system/hddfancontrol/default.nix
+++ b/pkgs/tools/system/hddfancontrol/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3Packages, fetchFromGitHub, hddtemp, hdparm, smartmontools }:
+{ lib, python3Packages, fetchFromGitHub, hddtemp, hdparm, smartmontools, nixosTests }:
 
 python3Packages.buildPythonPackage rec {
   pname = "hddfancontrol";
@@ -25,6 +25,8 @@ python3Packages.buildPythonPackage rec {
     sed -i -e '/EnvironmentFile=.*/d' $out/etc/systemd/system/hddfancontrol.service
   '';
 
+  passthru.tests = { inherit (nixosTests) hddfancontrol; };
+
   meta = with lib; {
     description = "Dynamically control fan speed according to hard drive temperature on Linux";
     homepage = "https://github.com/desbma/hddfancontrol";
diff --git a/pkgs/tools/system/incron/default.nix b/pkgs/tools/system/incron/default.nix
index 5c26235f8452..bf0299de2030 100644
--- a/pkgs/tools/system/incron/default.nix
+++ b/pkgs/tools/system/incron/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, bash }:
+{ lib, stdenv, fetchFromGitHub, bash, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "incron";
@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
     cp incrond incrontab $out/bin/
   '';
 
+  passthru.tests = { inherit (nixosTests) incron; };
+
   meta = with lib; {
     description = "Cron-like daemon which handles filesystem events";
     homepage = "https://github.com/ar-/incron";
diff --git a/pkgs/tools/system/ipmitool/default.nix b/pkgs/tools/system/ipmitool/default.nix
index 407a1f91b3bb..6a098d6ccc54 100644
--- a/pkgs/tools/system/ipmitool/default.nix
+++ b/pkgs/tools/system/ipmitool/default.nix
@@ -29,6 +29,7 @@ in stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Command-line interface to IPMI-enabled devices";
+    mainProgram = "ipmitool";
     license = licenses.bsd3;
     homepage = "https://github.com/ipmitool/ipmitool";
     platforms = platforms.unix;
diff --git a/pkgs/tools/text/shfmt/default.nix b/pkgs/tools/text/shfmt/default.nix
index b2437a01c993..cceda4e15525 100644
--- a/pkgs/tools/text/shfmt/default.nix
+++ b/pkgs/tools/text/shfmt/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "shfmt";
-  version = "3.8.0";
+  version = "3.9.0";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = "sh";
     rev = "v${version}";
-    sha256 = "sha256-2AnSmwl4ID7QxF8k1fl50S47KjKs9PwVpxchUIlhVo0=";
+    hash = "sha256-sYfMMKBqaYf3dfFcxE9awUMW+Hk7ps0/zpVFHul7GWM=";
   };
 
-  vendorHash = "sha256-rWAnWohbQZyPlOWqWwcxPMDABxumCo4M8fBUx54q76c=";
+  vendorHash = "sha256-xm5qKSg7OU++mVtTeRwefL3J1Uf+a0nFdtlD7eulI8s=";
 
   subPackages = [ "cmd/shfmt" ];
 
diff --git a/pkgs/tools/typesetting/tex/texpresso/default.nix b/pkgs/tools/typesetting/tex/texpresso/default.nix
index 38974b9a45dc..8653782da71c 100644
--- a/pkgs/tools/typesetting/tex/texpresso/default.nix
+++ b/pkgs/tools/typesetting/tex/texpresso/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "texpresso";
-  version = "0-unstable-2024-06-22";
+  version = "0-unstable-2024-07-02";
 
   postPatch = ''
     substituteInPlace Makefile \
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "let-def";
     repo = "texpresso";
-    rev = "e1e05f5559751d4b50772cd51d14101be0563ce1";
+    rev = "0e14b1df6269b07c2c985f001e32b48673495a8b";
     hash = "sha256-av1yadR2giJUxFQuHSXFgTbCNsmccrzKOmLVnAGJt6c=";
   };
 
diff --git a/pkgs/tools/typesetting/tex/texpresso/tectonic.nix b/pkgs/tools/typesetting/tex/texpresso/tectonic.nix
index 1848bf26b5b5..34df5c5ed1f4 100644
--- a/pkgs/tools/typesetting/tex/texpresso/tectonic.nix
+++ b/pkgs/tools/typesetting/tex/texpresso/tectonic.nix
@@ -6,8 +6,8 @@ tectonic-unwrapped.override (old: {
       src = fetchFromGitHub {
         owner = "let-def";
         repo = "tectonic";
-        rev = "b38cb3b2529bba947d520ac29fbb7873409bd270";
-        hash = "sha256-ap7fEPHsASAphIQkjcvk1CC7egTdxaUh7IpSS5os4W8=";
+        rev = "5b844105c06e0b16e40b1254359f8c28e8956280";
+        hash = "sha256-RPsXmp+5MF9h+H3wdL1O1hXSRZWjWTY8lXq/dWZIM1g=";
         fetchSubmodules = true;
       };
       cargoHash = "sha256-g4iBo8r+QUOcFJ3CI2+HOi4VHxU7jKnIWlJcKx/6r5E=";
diff --git a/pkgs/tools/virtualization/cri-tools/default.nix b/pkgs/tools/virtualization/cri-tools/default.nix
index b04305c90702..8b87a2de6ecb 100644
--- a/pkgs/tools/virtualization/cri-tools/default.nix
+++ b/pkgs/tools/virtualization/cri-tools/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "cri-tools";
-  version = "1.30.1";
+  version = "1.31.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-mCBGLnNlAfq7qThsbsGsBSEJEI85fg0xAbFENyIRyBU=";
+    hash = "sha256-ruhWuBpPjc0dX7kgiTBFFHriSGYx4XoMNv+M39aIh10=";
   };
 
   vendorHash = null;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8b15f42c3fa9..a6403e6792eb 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1012,6 +1012,7 @@ mapAliases ({
   neoload = throw "'neoload' has been removed as it is broken and unmaintained"; # Added 2024-03-02
   nitrokey-udev-rules = libnitrokey; # Added 2023-03-25
   nix-direnv-flakes = nix-direnv;
+  nix-ld-rs = nix-ld; # Added 2024-08-17
   nix-repl = throw (
     # Added 2018-08-26
     "nix-repl has been removed because it's not maintained anymore, " +
@@ -1257,6 +1258,7 @@ mapAliases ({
 
   ### R ###
 
+  rabbitvcs = throw "rabbitvcs has been removed from nixpkgs, because it was broken"; # Added 2024-07-15
   radare2-cutter = cutter; # Added 2021-03-30
   radicle-cli = throw "'radicle-cli' was removed in favor of 'radicle-node'"; # Added 2024-05-04
   radicle-upstream = throw "'radicle-upstream' was sunset, see <https://community.radworks.org/t/2962>"; # Added 2024-05-04
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4c26167e3528..6168070cc77e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -643,8 +643,6 @@ with pkgs;
 
   firefly-desktop = callPackage ../applications/misc/firefly-desktop { };
 
-  flaca = callPackage ../applications/graphics/flaca { };
-
   frece = callPackage ../development/tools/frece { };
 
   frida-tools = callPackage ../tools/security/frida-tools { };
@@ -7868,8 +7866,6 @@ with pkgs;
 
   flintlock = callPackage ../applications/virtualization/flintlock { };
 
-  flip-link = callPackage ../development/tools/flip-link { };
-
   flips = callPackage ../tools/compression/flips { };
 
   flowblade = callPackage ../applications/video/flowblade { };
@@ -11009,6 +11005,8 @@ with pkgs;
 
   openfec = callPackage ../development/libraries/openfec { };
 
+  ophcrack-cli = ophcrack.override { enableGui = false; };
+
   ophis = python3Packages.callPackage ../development/compilers/ophis { };
 
   open-ecard = callPackage ../tools/security/open-ecard { };
@@ -17382,8 +17380,6 @@ with pkgs;
 
   postgres-lsp = callPackage ../development/tools/language-servers/postgres-lsp { };
 
-  ruff-lsp = python3Packages.callPackage ../development/tools/language-servers/ruff-lsp { };
-
   rune-languageserver = callPackage ../development/tools/language-servers/rune-languageserver { };
 
   svls = callPackage ../development/tools/language-servers/svls { };
@@ -19588,7 +19584,7 @@ with pkgs;
 
   # TODO(@Ericson2314): Build bionic libc from source
   bionic = if stdenv.hostPlatform.useAndroidPrebuilt
-    then pkgs."androidndkPkgs_${stdenv.hostPlatform.ndkVer}".libraries
+    then pkgs."androidndkPkgs_${stdenv.hostPlatform.androidNdkVer}".libraries
     else callPackage ../os-specific/linux/bionic-prebuilt { };
 
   boolstuff = callPackage ../development/libraries/boolstuff { };
@@ -22039,8 +22035,6 @@ with pkgs;
 
   libmp3splt = callPackage ../development/libraries/libmp3splt { };
 
-  libmrss = callPackage ../development/libraries/libmrss { };
-
   libmspack = callPackage ../development/libraries/libmspack { };
 
   libmusicbrainz3 = callPackage ../development/libraries/libmusicbrainz { };
@@ -22077,8 +22071,6 @@ with pkgs;
 
   libnova = callPackage ../development/libraries/science/astronomy/libnova { };
 
-  libnxml = callPackage ../development/libraries/libnxml { };
-
   libodfgen = callPackage ../development/libraries/libodfgen { };
 
   libofa = callPackage ../development/libraries/libofa { };
@@ -33189,8 +33181,6 @@ with pkgs;
 
   qxw = callPackage ../applications/editors/qxw { };
 
-  rabbitvcs = callPackage ../applications/version-management/rabbitvcs { };
-
   rakarrack = callPackage ../applications/audio/rakarrack {
     fltk = fltk13;
   };
@@ -39470,8 +39460,6 @@ with pkgs;
 
   xva-img = callPackage ../tools/virtualization/xva-img { };
 
-  xwiimote = callPackage ../misc/drivers/xwiimote { };
-
   xzoom = callPackage ../tools/X11/xzoom { };
 
   yacreader = libsForQt5.callPackage ../applications/graphics/yacreader { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 710161682328..a2f6d1e2f34a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4911,6 +4911,8 @@ self: super: with self; {
 
   geopandas = callPackage ../development/python-modules/geopandas { };
 
+  geoparquet = callPackage  ../development/python-modules/geoparquet { };
+
   geopy = callPackage ../development/python-modules/geopy { };
 
   georss-client = callPackage ../development/python-modules/georss-client { };
@@ -12556,6 +12558,8 @@ self: super: with self; {
 
   pytest-django = callPackage ../development/python-modules/pytest-django { };
 
+  pytest-docker-tools = callPackage ../development/python-modules/pytest-docker-tools { };
+
   pytest-doctestplus = callPackage ../development/python-modules/pytest-doctestplus { };
 
   pytest-dotenv = callPackage ../development/python-modules/pytest-dotenv { };