diff --git a/flake.nix b/flake.nix
index 580f572ff32c..d920d5d0ddda 100644
--- a/flake.nix
+++ b/flake.nix
@@ -27,7 +27,19 @@
               # We set it to null, to remove the "legacy" entrypoint's
               # non-hermetic default.
               system = null;
-            } // args
+
+              modules = args.modules ++ [
+                # This module is injected here since it exposes the nixpkgs self-path in as
+                # constrained of contexts as possible to avoid more things depending on it and
+                # introducing unnecessary potential fragility to changes in flakes itself.
+                #
+                # See: failed attempt to make pkgs.path not copy when using flakes:
+                # https://github.com/NixOS/nixpkgs/pull/153594#issuecomment-1023287913
+                ({ config, pkgs, lib, ... }: {
+                  config.nixpkgs.flake.source = self.outPath;
+                })
+              ];
+            } // builtins.removeAttrs args [ "modules" ]
           );
       });
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 00b16a6cbb2c..e89b81ec0e96 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1743,6 +1743,12 @@
     githubId = 113123021;
     name = "Ashvith Shetty";
   };
+  asininemonkey = {
+    email = "nixpkgs@asininemonkey.com";
+    github = "asininemonkey";
+    githubId = 65740649;
+    name = "Jose Cardoso";
+  };
   aske = {
     email = "aske@fmap.me";
     github = "aske";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 2ad4d0e2b2da..8294ad75613e 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -20,6 +20,14 @@ In addition to numerous new and upgraded packages, this release has the followin
    - This can be disabled through the `environment.stub-ld.enable` option.
    - If you use `programs.nix-ld.enable`, no changes are needed. The stub will be disabled automatically.
 
+- On flake-based NixOS configurations using `nixpkgs.lib.nixosSystem`, NixOS will automatically set `NIX_PATH` and the system-wide flake registry (`/etc/nix/registry.json`) to point `<nixpkgs>` and the unqualified flake path `nixpkgs` to the version of nixpkgs used to build the system.
+
+  This makes `nix run nixpkgs#hello` and `nix-build '<nixpkgs>' -A hello` work out of the box with no added configuration, reusing dependencies already on the system.
+
+  This may be undesirable if nix commands are not going to be run on the built system since it adds nixpkgs to the system closure. For such closure-size-constrained non-interactive systems, this setting should be disabled.
+
+  To disable this, set [nixpkgs.flake.setNixPath](#opt-nixpkgs.flake.setNixPath) and [nixpkgs.flake.setFlakeRegistry](#opt-nixpkgs.flake.setFlakeRegistry) to false.
+
 - Julia environments can now be built with arbitrary packages from the ecosystem using the `.withPackages` function. For example: `julia.withPackages ["Plots"]`.
 
 - A new option `systemd.sysusers.enable` was added. If enabled, users and
diff --git a/nixos/modules/hardware/printers.nix b/nixos/modules/hardware/printers.nix
index 846ff6f3fb4f..4fb6a192cdd2 100644
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@@ -2,18 +2,23 @@
 with lib;
 let
   cfg = config.hardware.printers;
-  ppdOptionsString = options: optionalString (options != {})
-    (concatStringsSep " "
-      (mapAttrsToList (name: value: "-o '${name}'='${value}'") options)
-    );
-  ensurePrinter = p: ''
-    ${pkgs.cups}/bin/lpadmin -p '${p.name}' -E \
-      ${optionalString (p.location != null) "-L '${p.location}'"} \
-      ${optionalString (p.description != null) "-D '${p.description}'"} \
-      -v '${p.deviceUri}' \
-      -m '${p.model}' \
-      ${ppdOptionsString p.ppdOptions}
+
+  ensurePrinter = p: let
+    args = cli.toGNUCommandLineShell {} ({
+      p = p.name;
+      v = p.deviceUri;
+      m = p.model;
+    } // optionalAttrs (p.location != null) {
+      L = p.location;
+    } // optionalAttrs (p.description != null) {
+      D = p.description;
+    } // optionalAttrs (p.ppdOptions != {}) {
+      o = mapAttrsToList (name: value: "'${name}'='${value}'") p.ppdOptions;
+    });
+  in ''
+    ${pkgs.cups}/bin/lpadmin ${args} -E
   '';
+
   ensureDefaultPrinter = name: ''
     ${pkgs.cups}/bin/lpadmin -d '${name}'
   '';
diff --git a/nixos/modules/misc/nixpkgs-flake.nix b/nixos/modules/misc/nixpkgs-flake.nix
new file mode 100644
index 000000000000..8bfe05ca1994
--- /dev/null
+++ b/nixos/modules/misc/nixpkgs-flake.nix
@@ -0,0 +1,105 @@
+{ config, options, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.nixpkgs.flake;
+in
+{
+  options.nixpkgs.flake = {
+    source = mkOption {
+      # In newer Nix versions, particularly with lazy trees, outPath of
+      # flakes becomes a Nix-language path object. We deliberately allow this
+      # to gracefully come through the interface in discussion with @roberth.
+      #
+      # See: https://github.com/NixOS/nixpkgs/pull/278522#discussion_r1460292639
+      type = types.nullOr (types.either types.str types.path);
+
+      default = null;
+      defaultText = "if (using nixpkgsFlake.lib.nixosSystem) then self.outPath else null";
+
+      example = ''builtins.fetchTarball { name = "source"; sha256 = "${lib.fakeHash}"; url = "https://github.com/nixos/nixpkgs/archive/somecommit.tar.gz"; }'';
+
+      description = mdDoc ''
+        The path to the nixpkgs sources used to build the system. This is automatically set up to be
+        the store path of the nixpkgs flake used to build the system if using
+        `nixpkgs.lib.nixosSystem`, and is otherwise null by default.
+
+        This can also be optionally set if the NixOS system is not built with a flake but still uses
+        pinned sources: set this to the store path for the nixpkgs sources used to build the system,
+        as may be obtained by `builtins.fetchTarball`, for example.
+
+        Note: the name of the store path must be "source" due to
+        <https://github.com/NixOS/nix/issues/7075>.
+      '';
+    };
+
+    setNixPath = mkOption {
+      type = types.bool;
+
+      default = cfg.source != null;
+      defaultText = "config.nixpkgs.flake.source != null";
+
+      description = mdDoc ''
+        Whether to set {env}`NIX_PATH` to include `nixpkgs=flake:nixpkgs` such that `<nixpkgs>`
+        lookups receive the version of nixpkgs that the system was built with, in concert with
+        {option}`nixpkgs.flake.setFlakeRegistry`.
+
+        This is on by default for NixOS configurations built with flakes.
+
+        This makes {command}`nix-build '<nixpkgs>' -A hello` work out of the box on flake systems.
+
+        Note that this option makes the NixOS closure depend on the nixpkgs sources, which may add
+        undesired closure size if the system will not have any nix commands run on it.
+      '';
+    };
+
+    setFlakeRegistry = mkOption {
+      type = types.bool;
+
+      default = cfg.source != null;
+      defaultText = "config.nixpkgs.flake.source != null";
+
+      description = mdDoc ''
+        Whether to pin nixpkgs in the system-wide flake registry (`/etc/nix/registry.json`) to the
+        store path of the sources of nixpkgs used to build the NixOS system.
+
+        This is on by default for NixOS configurations built with flakes.
+
+        This option makes {command}`nix run nixpkgs#hello` reuse dependencies from the system, avoid
+        refetching nixpkgs, and have a consistent result every time.
+
+        Note that this option makes the NixOS closure depend on the nixpkgs sources, which may add
+        undesired closure size if the system will not have any nix commands run on it.
+      '';
+    };
+  };
+
+  config = mkIf (cfg.source != null) (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.setNixPath -> cfg.setFlakeRegistry;
+          message = ''
+            Setting `nixpkgs.flake.setNixPath` requires that `nixpkgs.flake.setFlakeRegistry` also
+            be set, since it is implemented in terms of indirection through the flake registry.
+          '';
+        }
+      ];
+    }
+    (mkIf cfg.setFlakeRegistry {
+      nix.registry.nixpkgs.to = mkDefault {
+        type = "path";
+        path = cfg.source;
+      };
+    })
+    (mkIf cfg.setNixPath {
+      # N.B. This does not include nixos-config in NIX_PATH unlike modules/config/nix-channel.nix
+      # because we would need some kind of evil shim taking the *calling* flake's self path,
+      # perhaps, to ever make that work (in order to know where the Nix expr for the system came
+      # from and how to call it).
+      nix.nixPath = mkDefault ([ "nixpkgs=flake:nixpkgs" ]
+        ++ optional config.nix.channel.enable "/nix/var/nix/profiles/per-user/root/channels");
+    })
+  ]);
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d9e95b8207f2..8683af5ed439 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -133,6 +133,7 @@
   ./misc/meta.nix
   ./misc/nixops-autoluks.nix
   ./misc/nixpkgs.nix
+  ./misc/nixpkgs-flake.nix
   ./misc/passthru.nix
   ./misc/version.nix
   ./misc/wordlist.nix
diff --git a/pkgs/applications/audio/snapcast/default.nix b/pkgs/applications/audio/snapcast/default.nix
index d155afb99ba4..782a55864914 100644
--- a/pkgs/applications/audio/snapcast/default.nix
+++ b/pkgs/applications/audio/snapcast/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, cmake, pkg-config
-, alsa-lib, asio, avahi, boost179, flac, libogg, libvorbis, soxr
+, alsa-lib, asio, avahi, boost179, flac, libogg, libvorbis, libopus, soxr
 , IOKit, AudioToolbox
 , aixlog, popl
 , pulseaudioSupport ? false, libpulseaudio
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   # not needed
   buildInputs = [
     boost179
-    asio avahi flac libogg libvorbis
+    asio avahi flac libogg libvorbis libopus
     aixlog popl soxr
   ] ++ lib.optional pulseaudioSupport libpulseaudio
   ++ lib.optional stdenv.isLinux alsa-lib
diff --git a/pkgs/applications/blockchains/ton/default.nix b/pkgs/applications/blockchains/ton/default.nix
index a65a1428df0e..0d4d3826b7e7 100644
--- a/pkgs/applications/blockchains/ton/default.nix
+++ b/pkgs/applications/blockchains/ton/default.nix
@@ -6,21 +6,23 @@
 , pkg-config
 , gperf
 , libmicrohttpd
+, libsodium
 , openssl
 , readline
+, secp256k1
 , zlib
 , nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "ton";
-  version = "2023.10";
+  version = "2024.01";
 
   src = fetchFromGitHub {
     owner = "ton-blockchain";
     repo = "ton";
     rev = "v${version}";
-    sha256 = "sha256-K1RhhW7EvwYV7/ng3NPjSGdHEQvJZ7K97YXd7s5wghc=";
+    hash = "sha256-nZ7yel+lTNO5zFzN711tLwAvqpf5qaYOxERwApnMVOs=";
     fetchSubmodules = true;
   };
 
@@ -35,14 +37,19 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gperf
     libmicrohttpd
+    libsodium
     openssl
     readline
+    secp256k1
     zlib
   ];
 
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
+    # The build fails on darwin as:
+    #   error: aligned allocation function of type 'void *(std::size_t, std::align_val_t)' is only available on macOS 10.13 or newer
+    broken = stdenv.isDarwin;
     description = "A fully decentralized layer-1 blockchain designed by Telegram";
     homepage = "https://ton.org/";
     changelog = "https://github.com/ton-blockchain/ton/blob/v${version}/Changelog.md";
diff --git a/pkgs/applications/misc/yubioath-flutter/default.nix b/pkgs/applications/misc/yubioath-flutter/default.nix
index ce228abdbb22..4895f749ec8d 100644
--- a/pkgs/applications/misc/yubioath-flutter/default.nix
+++ b/pkgs/applications/misc/yubioath-flutter/default.nix
@@ -13,24 +13,27 @@
 
 flutter.buildFlutterApplication rec {
   pname = "yubioath-flutter";
-  version = "6.3.1";
+  version = "6.4.0";
 
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubioath-flutter";
     rev = version;
-    hash = "sha256-XgRIX2Iv5niJw2NSBPwM0K4uF5sPj9c+Xj4oHtAQSbU=";
+    hash = "sha256-aXUnmKEUCi0rsVr3HVhEk6xa1z9HMsH+0AIY531hqiU=";
   };
 
   passthru.helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
+  gitHashes = {
+    window_manager = "sha256-mLX51nbWFccsAfcqLQIYDjYz69y9wAz4U1RZ8TIYSj0=";
+  };
 
   postPatch = ''
     rm -f pubspec.lock
 
     substituteInPlace linux/CMakeLists.txt \
-      --replace "../build/linux/helper" "${passthru.helper}/libexec/helper"
+      --replace-fail "../build/linux/helper" "${passthru.helper}/libexec/helper"
   '';
 
   preInstall = ''
diff --git a/pkgs/applications/misc/yubioath-flutter/pubspec.lock.json b/pkgs/applications/misc/yubioath-flutter/pubspec.lock.json
index a1973fa9a752..c83c6ffb1caf 100644
--- a/pkgs/applications/misc/yubioath-flutter/pubspec.lock.json
+++ b/pkgs/applications/misc/yubioath-flutter/pubspec.lock.json
@@ -134,11 +134,11 @@
       "dependency": "transitive",
       "description": {
         "name": "build_runner_core",
-        "sha256": "c9e32d21dd6626b5c163d48b037ce906bbe428bc23ab77bcd77bb21e593b6185",
+        "sha256": "4ae8ffe5ac758da294ecf1802f2aff01558d8b1b00616aa7538ea9a8a5d50799",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.2.11"
+      "version": "7.3.0"
     },
     "built_collection": {
       "dependency": "transitive",
@@ -154,11 +154,11 @@
       "dependency": "transitive",
       "description": {
         "name": "built_value",
-        "sha256": "c9aabae0718ec394e5bc3c7272e6bb0dc0b32201a08fe185ec1d8401d3e39309",
+        "sha256": "a3ec2e0f967bc47f69f95009bb93db936288d61d5343b9436e378b28a2f830c6",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.8.1"
+      "version": "8.9.0"
     },
     "characters": {
       "dependency": "transitive",
@@ -264,31 +264,31 @@
       "dependency": "direct dev",
       "description": {
         "name": "custom_lint",
-        "sha256": "dfb893ff17c83cf08676c6b64df11d3e53d80590978d7c1fb242afff3ba6dedb",
+        "sha256": "f89ff83efdba7c8996e86bb3bad0b759d58f9b19ae4d0e277a386ddd8b481217",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.8"
+      "version": "0.6.0"
     },
     "custom_lint_builder": {
       "dependency": "direct dev",
       "description": {
         "name": "custom_lint_builder",
-        "sha256": "8df6634b38a36a6c6cb74a9c0eb02e9ba0b0ab89b29e38e6daa86e8ed2c6288d",
+        "sha256": "9cdd9987feaa6925ec5f98d64de4fbbb5d94248ff77bbf2489366efad6c4baef",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.8"
+      "version": "0.6.0"
     },
     "custom_lint_core": {
       "dependency": "transitive",
       "description": {
         "name": "custom_lint_core",
-        "sha256": "2b235be098d157e244f18ea905a15a18c16a205e30553888fac6544bbf52f03f",
+        "sha256": "9003a91409c9f1db6e2e50b4870d1d5e802e5923b25f7261bf3cb3e11ea9d4fb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.8"
+      "version": "0.6.0"
     },
     "dart_style": {
       "dependency": "transitive",
@@ -402,11 +402,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_riverpod",
-        "sha256": "da9591d1f8d5881628ccd5c25c40e74fc3eef50ba45e40c3905a06e1712412d5",
+        "sha256": "4bce556b7ecbfea26109638d5237684538d4abc509d253e6c5c4c5733b360098",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.9"
+      "version": "2.4.10"
     },
     "flutter_test": {
       "dependency": "direct dev",
@@ -424,11 +424,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "freezed",
-        "sha256": "6c5031daae12c7072b3a87eff98983076434b4889ef2a44384d0cae3f82372ba",
+        "sha256": "57247f692f35f068cae297549a46a9a097100685c6780fe67177503eea5ed4e5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.6"
+      "version": "2.4.7"
     },
     "freezed_annotation": {
       "dependency": "direct main",
@@ -645,11 +645,11 @@
       "dependency": "transitive",
       "description": {
         "name": "mime",
-        "sha256": "e4ff8e8564c03f255408decd16e7899da1733852a9110a58fe6d1b817684a63e",
+        "sha256": "2e123074287cc9fd6c09de8336dae606d1ddb88d9ac47358826db698c176a1f2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.4"
+      "version": "1.0.5"
     },
     "package_config": {
       "dependency": "transitive",
@@ -834,11 +834,11 @@
       "dependency": "transitive",
       "description": {
         "name": "riverpod",
-        "sha256": "942999ee48b899f8a46a860f1e13cee36f2f77609eb54c5b7a669bb20d550b11",
+        "sha256": "548e2192eb7aeb826eb89387f814edb76594f3363e2c0bb99dd733d795ba3589",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.9"
+      "version": "2.5.0"
     },
     "rxdart": {
       "dependency": "transitive",
@@ -1119,11 +1119,11 @@
       "dependency": "direct main",
       "description": {
         "name": "url_launcher",
-        "sha256": "d25bb0ca00432a5e1ee40e69c36c85863addf7cc45e433769d61bed3fe81fd96",
+        "sha256": "c512655380d241a337521703af62d2c122bf7b77a46ff7dd750092aa9433499c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.2.3"
+      "version": "6.2.4"
     },
     "url_launcher_android": {
       "dependency": "transitive",
@@ -1308,12 +1308,13 @@
     "window_manager": {
       "dependency": "direct main",
       "description": {
-        "name": "window_manager",
-        "sha256": "dcc865277f26a7dad263a47d0e405d77e21f12cb71f30333a52710a408690bd7",
-        "url": "https://pub.dev"
+        "path": ".",
+        "ref": "2272d45bcf46d7e2b452a038906fbc85df3ce83d",
+        "resolved-ref": "2272d45bcf46d7e2b452a038906fbc85df3ce83d",
+        "url": "https://github.com/fdennis/window_manager.git"
       },
-      "source": "hosted",
-      "version": "0.3.7"
+      "source": "git",
+      "version": "0.3.8"
     },
     "xdg_directories": {
       "dependency": "transitive",
diff --git a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
index 56bc542d4206..7b9246300c06 100644
--- a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
@@ -1,24 +1,24 @@
 { lib
 , stdenv
 , fetchurl
-, electron_26
+, electron_27
 , makeWrapper
 }:
 
 let
 
   pname = "mattermost-desktop";
-  version = "5.5.1";
+  version = "5.6.0";
 
   srcs = {
     "x86_64-linux" = {
       url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-x64.tar.gz";
-      hash = "sha256-bRiO5gYM7nrnkbHBP3B9zAK2YV5POkc3stEsbZJ48VA=";
+      hash = "sha256-KUF/zH18X+RS8AICBv53JTBpcaokzo92psyoQNmLF/Q=";
     };
 
     "aarch64-linux" = {
       url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-arm64.tar.gz";
-      hash = "sha256-Z4U6Jbwasra69QPHJ9/7WwMSxh0O9r4QIe/xC3WRf4w=";
+      hash = "sha256-Zl5PalAles39qSMtt1cytfu4Mheud4+8TTkt7Ohdf/o=";
     };
   };
 
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
     substituteInPlace $out/share/applications/Mattermost.desktop \
       --replace /share/mattermost-desktop/mattermost-desktop /bin/mattermost-desktop
 
-    makeWrapper ${electron_26}/bin/electron $out/bin/${pname} \
+    makeWrapper '${lib.getExe electron_27}' $out/bin/${pname} \
       --add-flags $out/share/${pname}/app.asar
 
     runHook postInstall
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index 319234289515..704689e20282 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -22,13 +22,13 @@
 }:
 
 let
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-v6k9clKNBNb2MQp0BTrUL9zfY6SUKfzaaOycmV8RKyk=";
+    hash = "sha256-fZ5grVZjCVkCH6doeqBLHPh9mPvHkiz+QXi/OyoJhR4=";
   };
 
   python = python3;
@@ -99,30 +99,12 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = with python.pkgs; [
-    amqp
-    anyio
-    asgiref
-    async-timeout
-    attrs
-    autobahn
-    automat
-    billiard
     bleach
-    celery
-    certifi
-    cffi
-    channels-redis
     channels
-    charset-normalizer
-    click
-    click-didyoumean
-    click-plugins
-    click-repl
-    coloredlogs
+    channels-redis
     concurrent-log-handler
-    constantly
-    cryptography
     dateparser
+    django
     django-allauth
     django-auditlog
     django-celery-results
@@ -132,92 +114,41 @@ python.pkgs.buildPythonApplication rec {
     django-filter
     django-guardian
     django-multiselectfield
-    django
-    djangorestframework-guardian2
     djangorestframework
+    djangorestframework-guardian2
     drf-writable-nested
     filelock
     flower
     gotenberg-client
     gunicorn
-    h11
-    h2
-    hiredis
-    httptools
-    httpx
-    humanfriendly
-    humanize
-    hyperlink
-    idna
     imap-tools
-    img2pdf
-    incremental
-    inotify-simple
     inotifyrecursive
-    joblib
     langdetect
-    lxml
-    msgpack
     mysqlclient
     nltk
     ocrmypdf
-    packaging
     pathvalidate
     pdf2image
-    pikepdf
-    pillow
-    pluggy
-    portalocker
-    prompt-toolkit
     psycopg2
-    pyasn1-modules
-    pyasn1
-    pycparser
-    pyopenssl
     python-dateutil
     python-dotenv
+    python-gnupg
     python-ipware
     python-magic
-    python-gnupg
-    pytz
-    pyyaml
     pyzbar
     rapidfuzz
     redis
-    regex
-    reportlab
-    requests
     scikit-learn
-    scipy
     setproctitle
-    service-identity
-    sniffio
-    sqlparse
-    threadpoolctl
     tika-client
-    tornado
     tqdm
-    twisted
-    txaio
-    tzdata
-    tzlocal
-    urllib3
     uvicorn
-    uvloop
-    vine
     watchdog
-    watchfiles
-    wcwidth
-    webencodings
-    websockets
     whitenoise
     whoosh
-    zipp
-    zope-interface
     zxing-cpp
   ]
   ++ redis.optional-dependencies.hiredis
-  ++ twisted.optional-dependencies.tls
   ++ uvicorn.optional-dependencies.standard;
 
   postBuild = ''
@@ -262,7 +193,6 @@ python.pkgs.buildPythonApplication rec {
     pytest-rerunfailures
     pytest-xdist
     pytestCheckHook
-    reportlab
   ];
 
   pytestFlagsArray = [
@@ -280,7 +210,7 @@ python.pkgs.buildPythonApplication rec {
 
     # Disable unneeded code coverage test
     substituteInPlace src/setup.cfg \
-      --replace "--cov --cov-report=html --cov-report=xml" ""
+      --replace-fail "--cov --cov-report=html --cov-report=xml" ""
   '';
 
   disabledTests = [
diff --git a/pkgs/applications/video/kodi/addons/youtube/default.nix b/pkgs/applications/video/kodi/addons/youtube/default.nix
index 3d3683ed8776..d6bc80d0189e 100644
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@@ -3,13 +3,13 @@
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.0.2.2";
+  version = "7.0.3";
 
   src = fetchFromGitHub {
     owner = "anxdpanic";
     repo = "plugin.video.youtube";
     rev = "v${version}";
-    hash = "sha256-BUeE/8oQYBiq4XgIp4nv0hjEQz3nnkDWCnAf4kpptwk=";
+    hash = "sha256-dD9jl/W8RDfYHv13TBniOeRyc4cocj8160BHWz3MKlE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/ar/arcticons-sans/package.nix b/pkgs/by-name/ar/arcticons-sans/package.nix
new file mode 100644
index 000000000000..fb743aceee5c
--- /dev/null
+++ b/pkgs/by-name/ar/arcticons-sans/package.nix
@@ -0,0 +1,29 @@
+{ lib
+, stdenvNoCC
+, fetchzip
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "arcticons-sans";
+  version = "0.580";
+
+  src = fetchzip {
+    hash = "sha256-BRyYHOuz7zxD1zD4L4DmI9dFhGePmGFDqYmS0DIbvi8=";
+    url = "https://github.com/arcticons-team/arcticons-font/archive/refs/tags/${finalAttrs.version}.zip";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Arcticons Sans";
+    homepage = "https://github.com/arcticons-team/arcticons-font";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ asininemonkey ];
+  };
+})
diff --git a/pkgs/by-name/vi/vinegar/package.nix b/pkgs/by-name/vi/vinegar/package.nix
index a20b0ff024ee..19dd30209443 100644
--- a/pkgs/by-name/vi/vinegar/package.nix
+++ b/pkgs/by-name/vi/vinegar/package.nix
@@ -8,37 +8,42 @@
 , xorg
 , wayland
 , vulkan-headers
-, wineWowPackages
+, wine64Packages
 , fetchpatch
 }:
 let
   # wine-staging doesn't support overrideAttrs for now
-  wine = wineWowPackages.stagingFull.overrideDerivation (oldAttrs: {
+  wine = wine64Packages.staging.overrideDerivation (oldAttrs: {
     patches =
-      (oldAttrs.patches or [ ])
+      (oldAttrs.patches or [])
       ++ [
         # upstream issue: https://bugs.winehq.org/show_bug.cgi?id=55604
         # Here are the currently applied patches for Roblox to run under WINE:
         (fetchpatch {
-          name = "vinegar-wine-segrevert.patch";
-          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/8fc153c492542a522d6cc2dff7d1af0e030a529a/patches/wine/temp.patch";
-          hash = "sha256-AnEBBhB8leKP0xCSr6UsQK7CN0NDbwqhe326tJ9dDjc=";
+          name = "vinegar-wine-segregrevert.patch";
+          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/e24cb9dfa996bcfeaa46504c0375660fe271148d/patches/wine/segregrevert.patch";
+          hash = "sha256-+3Nld81nG3GufI4jAF6yrWfkJmsSCOku39rx0Hov29c=";
+        })
+        (fetchpatch {
+          name = "vinegar-wine-mouselock.patch";
+          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/e24cb9dfa996bcfeaa46504c0375660fe271148d/patches/wine/mouselock.patch";
+          hash = "sha256-0AGA4AQbxTL5BGVbm072moav7xVA3zpotYqM8pcEDa4=";
         })
       ];
   });
 in
 buildGoModule rec {
   pname = "vinegar";
-  version = "1.6.1";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "vinegarhq";
     repo = "vinegar";
     rev = "v${version}";
-    hash = "sha256-uRdWE5NwRVSuUZyU5B5u5DfJOxu/gUqwM682eORTDOs=";
+    hash = "sha256-aKL+4jw/uMbbvLRCBHstCTrcQ1PTYSCwMNgXTvSvMeY=";
   };
 
-  vendorHash = "sha256-Ex6PRd3rD2jbLXlY36koNvZF3P+gAZTE9hExIfOw9CE=";
+  vendorHash = "sha256-OaMfWecOPQh6quXjYkZLyBDHZ9TINSA7Ue/Y0sz5ZYY=";
 
   nativeBuildInputs = [ pkg-config makeBinaryWrapper ];
   buildInputs = [ libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wayland vulkan-headers wine ];
diff --git a/pkgs/development/compilers/chez/default.nix b/pkgs/development/compilers/chez/default.nix
index fc7dfa78cefe..c0448a7e6d4f 100644
--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchurl
 , coreutils, cctools
-, ncurses, libiconv, libX11, libuuid
+, ncurses, libiconv, libX11, libuuid, testers
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chez-scheme";
-  version = "9.6.4";
+  version = "10.0.0";
 
   src = fetchurl {
     url = "https://github.com/cisco/ChezScheme/releases/download/v${finalAttrs.version}/csv${finalAttrs.version}.tar.gz";
-    hash = "sha256-9YJ2gvolnEeXX/4Hh4X7Vh5KXFT3ZDMe9mwyEyhDaF0=";
+    hash = "sha256-03GZASte0ZhcQGnWqH/xjl4fWi3yfkApkfr0XcTyIyw=";
   };
 
   nativeBuildInputs = lib.optional stdenv.isDarwin cctools;
@@ -28,18 +28,11 @@ stdenv.mkDerivation (finalAttrs: {
   ** NixOS or in any chroot build.
   */
   patchPhase = ''
-    substituteInPlace ./configure \
-      --replace "git submodule init && git submodule update || exit 1" "true"
-
-    substituteInPlace ./workarea \
-      --replace "/bin/ln" ln \
-      --replace "/bin/cp" cp
-
     substituteInPlace ./makefiles/installsh \
-      --replace "/usr/bin/true" "${coreutils}/bin/true"
+      --replace-warn "/usr/bin/true" "${coreutils}/bin/true"
 
     substituteInPlace zlib/configure \
-      --replace "/usr/bin/libtool" libtool
+      --replace-warn "/usr/bin/libtool" libtool
   '';
 
   /*
@@ -52,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   ** for.
   */
   configurePhase = ''
-    ./configure --threads --installprefix=$out --installman=$out/share/man
+    ./configure --as-is --threads --installprefix=$out --installman=$out/share/man
   '';
 
   /*
@@ -64,12 +57,18 @@ stdenv.mkDerivation (finalAttrs: {
 
   setupHook = ./setup-hook.sh;
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
   meta = {
     description  = "A powerful and incredibly fast R6RS Scheme compiler";
     homepage     = "https://cisco.github.io/ChezScheme/";
     license      = lib.licenses.asl20;
     maintainers  = with lib.maintainers; [ thoughtpolice ];
     platforms    = lib.platforms.unix;
-    badPlatforms = [ "aarch64-linux" "aarch64-darwin" ];
+    mainProgram  = "scheme";
   };
 })
diff --git a/pkgs/development/compilers/sbcl/bootstrap.nix b/pkgs/development/compilers/sbcl/bootstrap.nix
index e23557c5a62f..d796b24e1d7e 100644
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@@ -26,4 +26,6 @@ stdenv.mkDerivation rec {
   postFixup = lib.optionalString (!stdenv.isAarch32 && stdenv.isLinux) ''
     patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $out/share/sbcl/sbcl
   '';
+
+  meta.sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
 }
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 7bb2649ff894..2f24d984c062 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -2,14 +2,14 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , unzip
 , zlib
-, pcre
+, pcre2
 , hdf5
 , boost
+, glib
 , gflags
 , protobuf_21
 , config
@@ -35,6 +35,8 @@
 , eigen
 , enableBlas ? true
 , blas
+, enableVA ? !stdenv.isDarwin
+, libva
 , enableContrib ? true
 
 , enableCuda ? config.cudaSupport
@@ -58,7 +60,11 @@
 , enableFfmpeg ? true
 , ffmpeg
 , enableGStreamer ? true
+, elfutils
 , gst_all_1
+, orc
+, libunwind
+, zstd
 , enableTesseract ? false
 , tesseract
 , leptonica
@@ -85,7 +91,7 @@
 }@inputs:
 
 let
-  version = "4.7.0";
+  version = "4.9.0";
 
   # It's necessary to consistently use backendStdenv when building with CUDA
   # support, otherwise we get libstdc++ errors downstream
@@ -96,21 +102,21 @@ let
     owner = "opencv";
     repo = "opencv";
     rev = version;
-    sha256 = "sha256-jUeGsu8+jzzCnIFbVMCW8DcUeGv/t1yCY/WXyW+uGDI=";
+    hash = "sha256-3qqu4xlRyMbPKHHTIT+iRRGtpFlcv0NU8GNZpgjdi6k=";
   };
 
   contribSrc = fetchFromGitHub {
     owner = "opencv";
     repo = "opencv_contrib";
     rev = version;
-    sha256 = "sha256-meya0J3RdOIeMM46e/6IOVwrKn3t/c0rhwP2WQaybkE=";
+    hash = "sha256-K74Ghk4uDqj4OWEzDxT2R3ERi+jkAWZszzezRenfuZ8=";
   };
 
   testDataSrc = fetchFromGitHub {
     owner = "opencv";
     repo = "opencv_extra";
     rev = version;
-    sha256 = "sha256-6hAdJdaUgtRGQanQKuY/q6fcXWXFZ3K/oLbGxvksry0=";
+    hash = "sha256-pActKi7aN5EOZq2Fpf5mALnZq71c037/R3Q6wJ4uCfQ=";
   };
 
   # Contrib must be built in order to enable Tesseract support:
@@ -121,16 +127,16 @@ let
     src = fetchFromGitHub {
       owner = "opencv";
       repo = "opencv_3rdparty";
-      rev = "a56b6ac6f030c312b2dce17430eef13aed9af274";
-      sha256 = "1msbkc3zixx61rcg6a04i1bcfhw1phgsrh93glq1n80hgsk3nbjq";
+      rev = "0cc4aa06bf2bef4b05d237c69a5a96b9cd0cb85a";
+      hash = "sha256-/kHivOgCkY9YdcRRaVgytXal3ChE9xFfGAB0CfFO5ec=";
     } + "/ippicv";
-    files = let name = platform: "ippicv_2019_${platform}_general_20180723.tgz"; in
+    files = let name = platform: "ippicv_2021.10.0_${platform}_20230919_general.tgz"; in
       if effectiveStdenv.hostPlatform.system == "x86_64-linux" then
-        { ${name "lnx_intel64"} = "c0bd78adb4156bbf552c1dfe90599607"; }
+        { ${name "lnx_intel64"} = "606a19b207ebedfe42d59fd916cc4850"; }
       else if effectiveStdenv.hostPlatform.system == "i686-linux" then
-        { ${name "lnx_ia32"} = "4f38432c30bfd6423164b7a24bbc98a0"; }
+        { ${name "lnx_ia32"} = "ea08487b810baad2f68aca87b74a2db9"; }
       else if effectiveStdenv.hostPlatform.system == "x86_64-darwin" then
-        { ${name "mac_intel64"} = "fe6b2bb75ae0e3f19ad3ae1a31dfa4a2"; }
+        { ${name "mac_intel64"} = "14f01c5a4780bfae9dde9b0aaf5e56fc"; }
       else
         throw "ICV is not available for this platform (or not yet supported by this package)";
     dst = ".cache/ippicv";
@@ -142,7 +148,7 @@ let
       owner = "opencv";
       repo = "opencv_3rdparty";
       rev = "fccf7cd6a4b12079f73bbfb21745f9babcd4eb1d";
-      sha256 = "0r9fam8dplyqqsd3qgpnnfgf9l7lj44di19rxwbm8mxiw0rlcdvy";
+      hash = "sha256-fjdGM+CxV1QX7zmF2AiR9NDknrP2PjyaxtjT21BVLmU=";
     };
     files = {
       "vgg_generated_48.i" = "e8d0dcd54d1bcfdc29203d011a797179";
@@ -179,7 +185,7 @@ let
       owner = "opencv";
       repo = "opencv_3rdparty";
       rev = "8afa57abc8229d611c4937165d20e2a2d9fc5a12";
-      sha256 = "061lsvqdidq9xa2hwrcvwi9ixflr2c2lfpc8drr159g68zi8bp4v";
+      hash = "sha256-m9yF4kfmpRJybohdRwUTmboeU+SbZQ6F6gm32PDWNBg=";
     };
     files = {
       "face_landmark_model.dat" = "7505c44ca4eb54b4ab1e4777cb96ac05";
@@ -191,10 +197,10 @@ let
   ade = rec {
     src = fetchurl {
       url = "https://github.com/opencv/ade/archive/${name}";
-      sha256 = "sha256-TjLRbFbC7MDY9PxIy560ryviBI58cbQwqgc7A7uOHkg=";
+      hash = "sha256-WG/GudVpkO10kOJhoKXFMj672kggvyRYCIpezal3wcE=";
     };
-    name = "v0.1.2a.zip";
-    md5 = "fa4b3e25167319cb0fa9432ef8281945";
+    name = "v0.1.2d.zip";
+    md5 = "dbb095a8bf3008e91edbbf45d8d34885";
     dst = ".cache/ade";
   };
 
@@ -204,7 +210,7 @@ let
       owner = "opencv";
       repo = "opencv_3rdparty";
       rev = "a8b69ccc738421293254aec5ddb38bd523503252";
-      sha256 = "sha256-/n6zHwf0Rdc4v9o4rmETzow/HTv+81DnHP+nL56XiTY=";
+      hash = "sha256-/n6zHwf0Rdc4v9o4rmETzow/HTv+81DnHP+nL56XiTY=";
     };
     files = {
       "detect.caffemodel" = "238e2b2d6f3c18d6c3a30de0c31e23cf";
@@ -260,20 +266,6 @@ effectiveStdenv.mkDerivation {
   patches = [
     ./cmake-don-t-use-OpenCVFindOpenEXR.patch
   ] ++ lib.optionals enableContrib [
-    (fetchpatch {
-      name = "CVE-2023-2617.patch";
-      url = "https://github.com/opencv/opencv_contrib/commit/ccc277247ac1a7aef0a90353edcdec35fbc5903c.patch";
-      stripLen = 2;
-      extraPrefix = [ "opencv_contrib/" ];
-      sha256 = "sha256-drZ+DVn+Pk4zAZJ+LgX5u3Tz7MU0AEI/73EVvxDP3AU=";
-    })
-    (fetchpatch {
-      name = "CVE-2023-2618.patch";
-      url = "https://github.com/opencv/opencv_contrib/commit/ec406fa4748fb4b0630c1b986469e7918d5e8953.patch";
-      stripLen = 2;
-      extraPrefix = [ "opencv_contrib/" ];
-      sha256 = "sha256-cB5Tsh2fDOsc0BNtSzd6U/QoCjkd9yMW1QutUU69JJ0=";
-    })
   ] ++ lib.optional enableCuda ./cuda_opt_flow.patch;
 
   # This prevents cmake from using libraries in impure paths (which
@@ -300,60 +292,104 @@ effectiveStdenv.mkDerivation {
     echo '"(build info elided)"' > modules/core/version_string.inc
   '';
 
-  buildInputs = [ zlib pcre boost gflags protobuf_21 ]
-    ++ lib.optional enablePython pythonPackages.python
-    ++ lib.optional (effectiveStdenv.buildPlatform == effectiveStdenv.hostPlatform) hdf5
-    ++ lib.optional enableGtk2 gtk2
-    ++ lib.optional enableGtk3 gtk3
-    ++ lib.optional enableVtk vtk
-    ++ lib.optional enableJPEG libjpeg
-    ++ lib.optional enablePNG libpng
-    ++ lib.optional enableTIFF libtiff
-    ++ lib.optional enableWebP libwebp
-    ++ lib.optionals enableEXR [ openexr ilmbase ]
-    ++ lib.optional enableJPEG2000 openjpeg
-    ++ lib.optional enableFfmpeg ffmpeg
-    ++ lib.optionals (enableFfmpeg && effectiveStdenv.isDarwin)
-      [ VideoDecodeAcceleration bzip2 ]
-    ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ])
-    ++ lib.optional enableOvis ogre
-    ++ lib.optional enableGPhoto2 libgphoto2
-    ++ lib.optional enableDC1394 libdc1394
-    ++ lib.optional enableEigen eigen
-    ++ lib.optional enableBlas blas.provider
+  buildInputs = [
+    boost
+    gflags
+    glib
+    pcre2
+    protobuf_21
+    zlib
+  ] ++ lib.optionals enablePython [
+    pythonPackages.python
+  ] ++ lib.optionals (effectiveStdenv.buildPlatform == effectiveStdenv.hostPlatform) [
+    hdf5
+  ] ++ lib.optionals enableGtk2 [
+    gtk2
+  ] ++ lib.optionals enableGtk3 [
+    gtk3
+  ] ++ lib.optionals enableVtk [
+    vtk
+  ] ++ lib.optionals enableJPEG [
+    libjpeg
+  ] ++ lib.optionals enablePNG [
+    libpng
+  ] ++ lib.optionals enableTIFF [
+    libtiff
+  ] ++ lib.optionals enableWebP [
+    libwebp
+  ] ++ lib.optionals enableEXR [
+    openexr
+    ilmbase
+  ] ++ lib.optionals enableJPEG2000 [
+    openjpeg
+  ] ++ lib.optionals enableFfmpeg [
+    ffmpeg
+  ] ++ lib.optionals (enableFfmpeg && effectiveStdenv.isDarwin) [
+    bzip2
+    VideoDecodeAcceleration
+  ] ++ lib.optionals (enableGStreamer && effectiveStdenv.isLinux) (with gst_all_1; [
+    elfutils
+    gst-plugins-base
+    gst-plugins-good
+    gstreamer
+    libunwind
+    orc
+    zstd
+  ]) ++ lib.optionals enableOvis [
+    ogre
+  ] ++ lib.optionals enableGPhoto2 [
+    libgphoto2
+  ] ++ lib.optionals enableDC1394 [
+    libdc1394
+  ] ++ lib.optionals enableEigen [
+    eigen
+  ] ++ lib.optionals enableVA [
+    libva
+  ] ++ lib.optionals enableBlas [
+    blas.provider
+  ] ++ lib.optionals enableTesseract [
     # There is seemingly no compile-time flag for Tesseract.  It's
     # simply enabled automatically if contrib is built, and it detects
     # tesseract & leptonica.
-    ++ lib.optionals enableTesseract [ tesseract leptonica ]
-    ++ lib.optional enableTbb tbb
-    ++ lib.optionals effectiveStdenv.isDarwin [
-      bzip2 AVFoundation Cocoa VideoDecodeAcceleration CoreMedia MediaToolbox Accelerate
-    ]
-    ++ lib.optionals enableDocs [ doxygen graphviz-nox ]
-    ++ lib.optionals enableCuda (with cudaPackages; [
-      cuda_cudart.lib
-      cuda_cudart.dev
-      cuda_cccl.dev # <thrust/*>
-      libnpp.dev # npp.h
-      libnpp.lib
-      libnpp.static
-      nvidia-optical-flow-sdk
-    ] ++ lib.optionals enableCublas [
-      # May start using the default $out instead once
-      # https://github.com/NixOS/nixpkgs/issues/271792
-      # has been addressed
-      libcublas.static
-      libcublas.lib
-      libcublas.dev # cublas_v2.h
-    ] ++ lib.optionals enableCudnn [
-      cudnn.dev # cudnn.h
-      cudnn.lib
-      cudnn.static
-    ] ++ lib.optionals enableCufft [
-      libcufft.dev # cufft.h
-      libcufft.lib
-      libcufft.static
-    ]);
+    tesseract
+    leptonica
+  ] ++ lib.optionals enableTbb [
+    tbb
+  ] ++ lib.optionals effectiveStdenv.isDarwin [
+    bzip2
+    AVFoundation
+    Cocoa
+    VideoDecodeAcceleration
+    CoreMedia
+    MediaToolbox
+    Accelerate
+  ] ++ lib.optionals enableDocs [
+    doxygen
+    graphviz-nox
+  ] ++ lib.optionals enableCuda (with cudaPackages; [
+    cuda_cudart.lib
+    cuda_cudart.dev
+    cuda_cccl.dev # <thrust/*>
+    libnpp.dev # npp.h
+    libnpp.lib
+    libnpp.static
+    nvidia-optical-flow-sdk
+  ] ++ lib.optionals enableCublas [
+    # May start using the default $out instead once
+    # https://github.com/NixOS/nixpkgs/issues/271792
+    # has been addressed
+    libcublas.static
+    libcublas.lib
+    libcublas.dev # cublas_v2.h
+  ] ++ lib.optionals enableCudnn [
+    cudnn.dev # cudnn.h
+    cudnn.lib
+    cudnn.static
+  ] ++ lib.optionals enableCufft [
+    libcufft.dev # cufft.h
+    libcufft.lib
+    libcufft.static
+  ]);
 
   propagatedBuildInputs = lib.optionals enablePython [ pythonPackages.numpy ];
 
diff --git a/pkgs/development/python-modules/dask-awkward/default.nix b/pkgs/development/python-modules/dask-awkward/default.nix
index 0875430cc383..c1a944414f6d 100644
--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@@ -2,13 +2,19 @@
 , awkward
 , buildPythonPackage
 , dask
+, dask-histogram
+, distributed
 , fetchFromGitHub
 , hatch-vcs
 , hatchling
+, hist
+, pandas
 , pyarrow
 , pytestCheckHook
 , pythonOlder
 , pythonRelaxDepsHook
+, typing-extensions
+, uproot
 }:
 
 buildPythonPackage rec {
@@ -38,12 +44,23 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     awkward
     dask
+    typing-extensions
   ];
 
+  passthru.optional-dependencies = {
+    io = [
+      pyarrow
+    ];
+  };
+
   checkInputs = [
+    dask-histogram
+    distributed
+    hist
+    pandas
     pytestCheckHook
-    pyarrow
-  ];
+    uproot
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "dask_awkward"
@@ -54,6 +71,8 @@ buildPythonPackage rec {
     "test_remote_double"
     "test_remote_single"
     "test_from_text"
+    # ValueError: not a ROOT file: first four bytes...
+    "test_basic_root_works"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/http-message-signatures/default.nix b/pkgs/development/python-modules/http-message-signatures/default.nix
index bc3351feb3d8..b9ccede6714e 100644
--- a/pkgs/development/python-modules/http-message-signatures/default.nix
+++ b/pkgs/development/python-modules/http-message-signatures/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "http-message-signatures";
-  version = "0.4.4";
+  version = "0.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "pyauth";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-acTziJM5H5Td+eG/LNrlNwgpVvFDyl/tf6//YuE1XZk=";
+    hash = "sha256-Jsivw4lNA/2oqsOGGx8D4gUPftzuys877A9RXyapnSQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/orbax-checkpoint/default.nix b/pkgs/development/python-modules/orbax-checkpoint/default.nix
new file mode 100644
index 000000000000..0f9d467335ce
--- /dev/null
+++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix
@@ -0,0 +1,78 @@
+{ lib
+, absl-py
+, buildPythonPackage
+, cached-property
+, etils
+, fetchPypi
+, flit-core
+, importlib-resources
+, jax
+, jaxlib
+, msgpack
+, nest-asyncio
+, numpy
+, protobuf
+, pytest-xdist
+, pytestCheckHook
+, pythonOlder
+, pyyaml
+, tensorstore
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "orbax-checkpoint";
+  version = "0.5.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchPypi {
+    pname = "orbax_checkpoint";
+    inherit version;
+    hash = "sha256-FXKQTLv+hROSfg2A+AtzDg7y9oAzLTwoENhENTKTi0U=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    absl-py
+    cached-property
+    etils
+    importlib-resources
+    jax
+    jaxlib
+    msgpack
+    nest-asyncio
+    numpy
+    protobuf
+    pyyaml
+    tensorstore
+    typing-extensions
+  ];
+
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "orbax"
+  ];
+
+  disabledTestPaths = [
+    # Circular dependency flax
+    "orbax/checkpoint/transform_utils_test.py"
+    "orbax/checkpoint/utils_test.py"
+  ];
+
+  meta = with lib; {
+    description = "Orbax provides common utility libraries for JAX users";
+    homepage = "https://github.com/google/orbax/tree/main/checkpoint";
+    changelog = "https://github.com/google/orbax/blob/${version}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pillow-heif/default.nix b/pkgs/development/python-modules/pillow-heif/default.nix
index 51c377eb771a..e846109a31de 100644
--- a/pkgs/development/python-modules/pillow-heif/default.nix
+++ b/pkgs/development/python-modules/pillow-heif/default.nix
@@ -57,6 +57,9 @@ buildPythonPackage rec {
     x265
   ];
 
+  # clang-16: error: argument unused during compilation: '-fno-strict-overflow' [-Werror,-Wunused-command-line-argument]
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
+
   propagatedBuildInputs = [
     pillow
   ];
diff --git a/pkgs/development/python-modules/pyunifiprotect/default.nix b/pkgs/development/python-modules/pyunifiprotect/default.nix
index cc846a024d8e..79b940d5be1d 100644
--- a/pkgs/development/python-modules/pyunifiprotect/default.nix
+++ b/pkgs/development/python-modules/pyunifiprotect/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "pyunifiprotect";
-  version = "4.23.3";
+  version = "4.23.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "briis";
     repo = "pyunifiprotect";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QWIiBuKDhSNYVyEm45QV4a2UxADDrBdiCBeJI+a6v7c=";
+    hash = "sha256-sBdu4XJkEtHf6dlHgJKFQvONp1x89NiS2EgxMiJFX7A=";
   };
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/structlog/default.nix b/pkgs/development/python-modules/structlog/default.nix
index f53e3c90945d..a6c826a00a5e 100644
--- a/pkgs/development/python-modules/structlog/default.nix
+++ b/pkgs/development/python-modules/structlog/default.nix
@@ -11,13 +11,12 @@
 , pythonOlder
 , simplejson
 , twisted
-, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "structlog";
-  version = "23.2.0";
-  format = "pyproject";
+  version = "24.1.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -25,7 +24,7 @@ buildPythonPackage rec {
     owner = "hynek";
     repo = "structlog";
     rev = "refs/tags/${version}";
-    hash = "sha256-KSHKgkv+kObKCdWZDg5o6QYe0AMND9VLdEuseY/GyDY=";
+    hash = "sha256-0Yc28UEeozK2+IqILFTqHoTiM5L2SA4t6jld4qTBSzQ=";
   };
 
   nativeBuildInputs = [
@@ -34,10 +33,6 @@ buildPythonPackage rec {
     hatchling
   ];
 
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
-    typing-extensions
-  ];
-
   nativeCheckInputs = [
     freezegun
     pretend
@@ -47,11 +42,6 @@ buildPythonPackage rec {
     twisted
   ];
 
-  disabledTests = [
-    # _pickle.PicklingError: Only BytesLoggers to sys.stdout and sys.stderr can be pickled.
-    "test_pickle"
-  ];
-
   pythonImportsCheck = [
     "structlog"
   ];
@@ -61,6 +51,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/hynek/structlog";
     changelog = "https://github.com/hynek/structlog/blob/${version}/CHANGELOG.md";
     license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/tools/aws-sam-cli/default.nix b/pkgs/development/tools/aws-sam-cli/default.nix
index 45c3e4c62a7a..5ab92dbe8b18 100644
--- a/pkgs/development/tools/aws-sam-cli/default.nix
+++ b/pkgs/development/tools/aws-sam-cli/default.nix
@@ -10,8 +10,8 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "aws-sam-cli";
-  version = "1.108.0";
-  format = "pyproject";
+  version = "1.110.0";
+  pyproject = true;
 
   disabled = python3.pythonOlder "3.8";
 
@@ -19,7 +19,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "aws";
     repo = "aws-sam-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-k6SXCFkISyfr5/0vhe/Dfzs4qsVfu14lFx/bl53QxR4=";
+    hash = "sha256-FJHHEsdi2uGP9/GxrANsVEuxZiS4M4BPBGoARQBQpkA=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
@@ -28,16 +28,18 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   pythonRelaxDeps = [
+    "aws-lambda-builders"
     "aws-sam-translator"
     "boto3-stubs"
     "cfn-lint"
-    "tzlocal"
     "cookiecutter"
     "docker"
-    "aws-lambda-builders"
-    "tomlkit"
-    "rich"
     "jsonschema"
+    "pyopenssl"
+    "rich"
+    "ruamel-yaml"
+    "tomlkit"
+    "tzlocal"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -86,8 +88,6 @@ python3.pkgs.buildPythonApplication rec {
       --prefix PATH : $out/bin:${lib.makeBinPath [ git ]}
   '';
 
-  doCheck = true;
-
   nativeCheckInputs = with python3.pkgs; [
     filelock
     flaky
@@ -105,22 +105,27 @@ python3.pkgs.buildPythonApplication rec {
 
   pytestFlagsArray = [
     "tests"
-
-    # Disable tests that requires networking or complex setup
-    "--ignore=tests/end_to_end"
-    "--ignore=tests/integration"
-    "--ignore=tests/regression"
-    "--ignore=tests/smoke"
-    "--ignore=tests/unit/lib/telemetry"
-
-    # Disable flaky tests
-    "--ignore=tests/unit/lib/samconfig/test_samconfig.py"
-    "--deselect=tests/unit/lib/sync/flows/test_rest_api_sync_flow.py::TestRestApiSyncFlow::test_update_stage"
-    "--deselect=tests/unit/lib/sync/flows/test_rest_api_sync_flow.py::TestRestApiSyncFlow::test_delete_deployment"
-    "--deselect=tests/unit/local/lambda_service/test_local_lambda_invoke_service.py::TestValidateRequestHandling::test_request_with_no_data"
-
     # Disable warnings
-    "-W ignore::DeprecationWarning"
+    "-W"
+    "ignore::DeprecationWarning"
+  ];
+
+  disabledTestPaths = [
+    # Disable tests that requires networking or complex setup
+    "tests/end_to_end"
+    "tests/integration"
+    "tests/regression"
+    "tests/smoke"
+    "tests/unit/lib/telemetry"
+    # Disable flaky tests
+    "tests/unit/lib/samconfig/test_samconfig.py"
+  ];
+
+  disabledTests = [
+    # Disable flaky tests
+    "test_update_stage"
+    "test_delete_deployment"
+    "test_request_with_no_data"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/tools/continuous-integration/drone-runner-docker/default.nix b/pkgs/development/tools/continuous-integration/drone-runner-docker/default.nix
index 974cd8f464cb..e4fc56d74ff2 100644
--- a/pkgs/development/tools/continuous-integration/drone-runner-docker/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone-runner-docker/default.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
   vendorHash = "sha256-KcNp3VdJ201oxzF0bLXY4xWHqHNz54ZrVSI96cfhU+k=";
 
   meta = with lib; {
-    maintainers = with maintainers; [ endocrimes emilylange ];
+    maintainers = with maintainers; [ endocrimes ];
     license = licenses.unfreeRedistributable;
     homepage = "https://github.com/drone-runners/drone-runner-docker";
     description = "Drone pipeline runner that executes builds inside Docker containers";
diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index 8f726b410000..daa0c81d2e05 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -12,7 +12,7 @@
 , mesa
 , libxkbcommon
 , libxshmfence
-, libglvnd
+, libGL
 , alsa-lib
 , cairo
 , cups
@@ -102,7 +102,7 @@ let
     ++ lib.optionals (lib.versionOlder version "10.0.0") [ libXScrnSaver ]
     ++ lib.optionals (lib.versionAtLeast version "11.0.0") [ libxkbcommon ]
     ++ lib.optionals (lib.versionAtLeast version "12.0.0") [ libxshmfence ]
-    ++ lib.optionals (lib.versionAtLeast version "17.0.0") [ libglvnd ]
+    ++ lib.optionals (lib.versionAtLeast version "17.0.0") [ libGL ]
   );
 
   linux = {
@@ -130,6 +130,11 @@ let
         --set-rpath "${electronLibPath}:$out/libexec/electron" \
         $out/libexec/electron/.electron-wrapped \
         ${lib.optionalString (lib.versionAtLeast version "15.0.0") "$out/libexec/electron/.chrome_crashpad_handler-wrapped" }
+
+      # patch libANGLE
+      patchelf \
+        --set-rpath "${lib.makeLibraryPath [ libGL pciutils ]}" \
+        $out/libexec/electron/lib*GL*
     '';
   };
 
diff --git a/pkgs/development/tools/rojo/default.nix b/pkgs/development/tools/rojo/default.nix
index 1eaeed08316a..0ed91bd18e3e 100644
--- a/pkgs/development/tools/rojo/default.nix
+++ b/pkgs/development/tools/rojo/default.nix
@@ -12,17 +12,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "rojo";
-  version = "7.4.0";
+  version = "7.4.1";
 
   src = fetchFromGitHub {
     owner = "rojo-rbx";
     repo = "rojo";
     rev = "v${version}";
-    sha256 = "sha256-Eh1G0jX9KXVlMZLl8whxULywadblWml232qvcq4JLJ4=";
+    hash = "sha256-7fnzNYAbsZW/48C4dwpMXXQy2ZgxbYFSs85wNKGcu/4=";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "sha256-aKfgylY9aspL1JpdYa6hOy/6lQoqO54OhZWqSlMPZ8o=";
+  cargoHash = "sha256-9kmSNWsZY0OcqaYOCblMwkXTdGXhj7f/2pUDx/L/o2o=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/misc/cups/drivers/foomatic-db/default.nix b/pkgs/misc/cups/drivers/foomatic-db/default.nix
index cb8156b0a0a9..b4be3a143604 100644
--- a/pkgs/misc/cups/drivers/foomatic-db/default.nix
+++ b/pkgs/misc/cups/drivers/foomatic-db/default.nix
@@ -13,15 +13,15 @@
 
 stdenv.mkDerivation rec {
   pname = "foomatic-db";
-  version = "unstable-2023-09-02";
+  version = "unstable-2024-02-09";
 
   src = fetchFromGitHub {
     # there is also a daily snapshot at the `downloadPage`,
     # but it gets deleted quickly and would provoke 404 errors
     owner = "OpenPrinting";
     repo = "foomatic-db";
-    rev = "4e6ab90da63afddee33d80115acb44149d2d292b";
-    hash = "sha256-wtDGJUyViiCenCY4zvr0Ia4ecZpoDsDSWwlYYs3YMT8=";
+    rev = "f8b43644771612f854fecda969440511de784bf0";
+    hash = "sha256-8Pui83Z7g5aHBJk46AYeKil/0++I6zcc5S/BWRuy1WM=";
   };
 
   buildInputs = [ cups cups-filters ghostscript gnused perl ];
diff --git a/pkgs/servers/monitoring/zabbix/agent.nix b/pkgs/servers/monitoring/zabbix/agent.nix
index 4aaeb9f103d6..3f1d80ca4df9 100644
--- a/pkgs/servers/monitoring/zabbix/agent.nix
+++ b/pkgs/servers/monitoring/zabbix/agent.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchurl, pkg-config, libiconv, openssl, pcre }:
 
-import ./versions.nix ({ version, sha256, ... }:
+import ./versions.nix ({ version, hash, ... }:
   stdenv.mkDerivation {
     pname = "zabbix-agent";
     inherit version;
 
     src = fetchurl {
       url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
-      inherit sha256;
+      inherit hash;
     };
 
     nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/monitoring/zabbix/agent2.nix b/pkgs/servers/monitoring/zabbix/agent2.nix
index 718522c8fccf..374a137297f1 100644
--- a/pkgs/servers/monitoring/zabbix/agent2.nix
+++ b/pkgs/servers/monitoring/zabbix/agent2.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchurl, autoreconfHook, pkg-config, libiconv, openssl, pcre, zlib }:
 
-import ./versions.nix ({ version, sha256, vendorHash ? throw "unsupported version ${version} for zabbix-agent2", ... }:
+import ./versions.nix ({ version, hash, vendorHash ? throw "unsupported version ${version} for zabbix-agent2", ... }:
   buildGoModule {
     pname = "zabbix-agent2";
     inherit version;
 
     src = fetchurl {
       url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
-      inherit sha256;
+      inherit hash;
     };
 
     modRoot = "src/go";
diff --git a/pkgs/servers/monitoring/zabbix/proxy.nix b/pkgs/servers/monitoring/zabbix/proxy.nix
index f9088e682bdb..b287ef56c76f 100644
--- a/pkgs/servers/monitoring/zabbix/proxy.nix
+++ b/pkgs/servers/monitoring/zabbix/proxy.nix
@@ -15,14 +15,14 @@ assert sqliteSupport -> !mysqlSupport && !postgresqlSupport;
 let
   inherit (lib) optional optionalString;
 in
-  import ./versions.nix ({ version, sha256, ... }:
+  import ./versions.nix ({ version, hash, ... }:
     stdenv.mkDerivation {
       pname = "zabbix-proxy";
       inherit version;
 
       src = fetchurl {
         url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
-        inherit sha256;
+        inherit hash;
       };
 
       nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/monitoring/zabbix/server.nix b/pkgs/servers/monitoring/zabbix/server.nix
index 3cffedd5aeb0..5abf6a93d55d 100644
--- a/pkgs/servers/monitoring/zabbix/server.nix
+++ b/pkgs/servers/monitoring/zabbix/server.nix
@@ -16,14 +16,14 @@ assert postgresqlSupport -> !mysqlSupport;
 let
   inherit (lib) optional optionalString;
 in
-  import ./versions.nix ({ version, sha256, ... }:
+  import ./versions.nix ({ version, hash, ... }:
     stdenv.mkDerivation {
       pname = "zabbix-server";
       inherit version;
 
       src = fetchurl {
         url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
-        inherit sha256;
+        inherit hash;
       };
 
       nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/servers/monitoring/zabbix/versions.nix b/pkgs/servers/monitoring/zabbix/versions.nix
index cf4d9bc8508b..6fe89a17c357 100644
--- a/pkgs/servers/monitoring/zabbix/versions.nix
+++ b/pkgs/servers/monitoring/zabbix/versions.nix
@@ -1,13 +1,13 @@
 generic: {
   v60 = generic {
-    version = "6.0.21";
-    sha256 = "sha256-hdKPI5UEQvF/URH2eLWW32az3LMEse3UXIELOsfvwzk=";
+    version = "6.0.26";
+    hash = "sha256-MIOKe5hqfDecB1oWZKzbFmJCsQLuAGtp21l2WxxVG+g=";
     vendorHash = null;
   };
 
   v50 = generic {
-    version = "5.0.37";
-    sha256 = "sha256-+C5fI+eMJKsynVnVJIYj27x1iFQwaG9Fnho0BXgENQI=";
-    vendorHash = "sha256-oSZBzIUL1yHXk7PnkSAlhI0i89aGMFrFHmbMN9rDAJ0=";
+    version = "5.0.41";
+    hash = "sha256-pPvw0lPoK1IpsXc5c8Qu9zFhx2oHJz2bwiX80vrYa58=";
+    vendorHash = "sha256-qLDoNnEFiSrWXbLtYlmQaqY8Rv6JaG8WbMYBlry5Evc=";
   };
 }
diff --git a/pkgs/servers/monitoring/zabbix/web.nix b/pkgs/servers/monitoring/zabbix/web.nix
index cbd095e234cc..7267e3046dd7 100644
--- a/pkgs/servers/monitoring/zabbix/web.nix
+++ b/pkgs/servers/monitoring/zabbix/web.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchurl, writeText }:
 
-import ./versions.nix ({ version, sha256, ... }:
+import ./versions.nix ({ version, hash, ... }:
   stdenv.mkDerivation rec {
     pname = "zabbix-web";
     inherit version;
 
     src = fetchurl {
       url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
-      inherit sha256;
+      inherit hash;
     };
 
     phpConfig = writeText "zabbix.conf.php" ''
diff --git a/pkgs/servers/tang/default.nix b/pkgs/servers/tang/default.nix
index 4206973dbd15..e6581921fcb7 100644
--- a/pkgs/servers/tang/default.nix
+++ b/pkgs/servers/tang/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tang";
-  version = "14";
+  version = "15";
 
   src = fetchFromGitHub {
     owner = "latchset";
     repo = "tang";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QKURKb2g71pZvuZlJk3Rc26H3oU0WSkjgQtJQLrYGbw=";
+    hash = "sha256-nlC2hdNzQZrfirjS2gX4oFp2OD1OdxmLsN03hfxD3ug=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 214fd82a327e..3bd7e9174ad6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8952,6 +8952,8 @@ self: super: with self; {
 
   oras = callPackage ../development/python-modules/oras { };
 
+  orbax-checkpoint = callPackage ../development/python-modules/orbax-checkpoint { };
+
   orderedmultidict = callPackage ../development/python-modules/orderedmultidict { };
 
   ordered-set = callPackage ../development/python-modules/ordered-set { };