diff --git a/pkgs/applications/audio/opustags/default.nix b/pkgs/applications/audio/opustags/default.nix
index 20fd355fa0bd..895691fde9ef 100644
--- a/pkgs/applications/audio/opustags/default.nix
+++ b/pkgs/applications/audio/opustags/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opustags";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "fmang";
     repo = "opustags";
     rev = version;
-    sha256 = "sha256-vGMRzw46X3DNRIvlI9XEKoDwiJsVL0v9Nfn8pbszRbw=";
+    sha256 = "sha256-qxtTJ4Hl2ccL+rhONeoOfV6ZyJaWaVDPMsXYJkXCWkY=";
   };
 
   buildInputs = [ libogg ];
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index 559fa75e45d4..3603bc13669d 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.111.2";
+  version = "0.111.3";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-UVxE5f+WLIoCEhFh1lbOE8LoXVN/+BzHCpJ61Gqknzc=";
+    hash = "sha256-PgconAixlSgRHqmfRdOtcpVJyThZIKAB9Pm4AUvYVGQ=";
   };
 
-  vendorHash = "sha256-xiysjJi3bL0xIoEEo7xXQbznFzwKJrCT6l/bxEbDRUI=";
+  vendorHash = "sha256-2a6+s0xLlj3VzXp9zbZgIi7WJShbUQH48tUG9Slm770=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/zine/default.nix b/pkgs/applications/misc/zine/default.nix
index a1e22e54f676..939611a5628b 100644
--- a/pkgs/applications/misc/zine/default.nix
+++ b/pkgs/applications/misc/zine/default.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zine";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-54kbSli/cEG8MlbPWC3xauj2VFxru/5haXfHaViUCN8=";
+    sha256 = "sha256-N+0FEZ8TUbMs9cwPmURr39wRA+m7B4UbUOkpNmF1p9A=";
   };
 
-  cargoHash = "sha256-youQoyJURmhPZItvfCSytUBpwRrejRf6EzfvjtgXH5E=";
+  cargoHash = "sha256-2Mc1hrVJ3a1tE/Jo6MYjCfd03889raVTyLBzhCQi8ck=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/version-management/bumpver/default.nix b/pkgs/applications/version-management/bumpver/default.nix
index d32e0154c8ae..fb5e0c832288 100644
--- a/pkgs/applications/version-management/bumpver/default.nix
+++ b/pkgs/applications/version-management/bumpver/default.nix
@@ -20,6 +20,11 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeCheckInputs = [ python3.pkgs.pytestCheckHook git mercurial];
 
+  disabledTests = [
+    # fails due to more aggressive setuptools version specifier validation
+    "test_parse_default_pattern"
+  ];
+
   meta = with lib; {
     description = "Bump version numbers in project files";
     homepage = "https://pypi.org/project/bumpver/";
diff --git a/pkgs/development/python-modules/babel/default.nix b/pkgs/development/python-modules/babel/default.nix
index 09fb69a7658e..0704f1693f92 100644
--- a/pkgs/development/python-modules/babel/default.nix
+++ b/pkgs/development/python-modules/babel/default.nix
@@ -1,8 +1,20 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, pythonOlder, pytz, pytestCheckHook, freezegun }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+
+# tests
+, backports-zoneinfo
+, freezegun
+, pytestCheckHook
+, pytz
+}:
 
 buildPythonPackage rec {
   pname = "babel";
   version = "2.12.1";
+  format = "setuptools";
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
@@ -11,12 +23,29 @@ buildPythonPackage rec {
     hash = "sha256-zC2ZmZzQHURCCuclohyeNxGzqtx5dtYUf2IthYGWNFU=";
   };
 
-  propagatedBuildInputs = lib.optional (pythonOlder "3.9") pytz;
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [
+    pytz
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook freezegun ];
+  nativeCheckInputs = [
+    # via setup.py
+    freezegun
+    pytestCheckHook
+    # via tox.ini
+    pytz
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    backports-zoneinfo
+  ];
+
+  disabledTests = [
+    # fails on days switching from and to daylight saving time in EST
+    # https://github.com/python-babel/babel/issues/988
+    "test_format_time"
+  ];
 
   meta = with lib; {
     homepage = "https://babel.pocoo.org/";
+    changelog = "https://github.com/python-babel/babel/releases/tag/v${version}";
     description = "Collection of internationalizing tools";
     license = licenses.bsd3;
     maintainers = with maintainers; [ SuperSandro2000 ];
diff --git a/pkgs/development/python-modules/flask-caching/default.nix b/pkgs/development/python-modules/flask-caching/default.nix
index 928d5d60478b..08ff5d808f06 100644
--- a/pkgs/development/python-modules/flask-caching/default.nix
+++ b/pkgs/development/python-modules/flask-caching/default.nix
@@ -5,6 +5,7 @@
 , fetchPypi
 , cachelib
 , flask
+, asgiref
 , pytest-asyncio
 , pytest-xprocess
 , pytestCheckHook
@@ -21,12 +22,18 @@ buildPythonPackage rec {
     hash = "sha256-JLYMVS1ZqWBcwbakLFbNs5qCoo2rRTK77bkiKuVOy04=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "cachelib >= 0.9.0, < 0.10.0" "cachelib"
+  '';
+
   propagatedBuildInputs = [
     cachelib
     flask
   ];
 
   nativeCheckInputs = [
+    asgiref
     pytest-asyncio
     pytest-xprocess
     pytestCheckHook
diff --git a/pkgs/development/python-modules/markups/default.nix b/pkgs/development/python-modules/markups/default.nix
index a862566ce30d..163fc2539d2d 100644
--- a/pkgs/development/python-modules/markups/default.nix
+++ b/pkgs/development/python-modules/markups/default.nix
@@ -9,13 +9,14 @@
 , python-markdown-math
 , pythonOlder
 , pyyaml
+, setuptools
 , textile
 }:
 
 buildPythonPackage rec {
   pname = "markups";
   version = "4.0.0";
-  format = "setuptools";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
@@ -25,6 +26,10 @@ buildPythonPackage rec {
     hash = "sha256-Pdua+xxV0M/4EuM5LKM/RoSYwHB6T6iy4F0LoNMsAZ4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     docutils
     markdown
diff --git a/pkgs/development/python-modules/pywlroots/default.nix b/pkgs/development/python-modules/pywlroots/default.nix
index 3489f4951456..8d547239f089 100644
--- a/pkgs/development/python-modules/pywlroots/default.nix
+++ b/pkgs/development/python-modules/pywlroots/default.nix
@@ -9,7 +9,7 @@
 , pixman
 , pythonOlder
 , udev
-, wlroots
+, wlroots_0_16
 , wayland
 , pywayland
 , xkbcommon
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
   propagatedNativeBuildInputs = [ cffi ];
-  buildInputs = [ libinput libxkbcommon pixman xorg.libxcb udev wayland wlroots ];
+  buildInputs = [ libinput libxkbcommon pixman xorg.libxcb udev wayland wlroots_0_16 ];
   propagatedBuildInputs = [ cffi pywayland xkbcommon ];
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/reqif/default.nix b/pkgs/development/python-modules/reqif/default.nix
index 482ddc4177d5..12357587b908 100644
--- a/pkgs/development/python-modules/reqif/default.nix
+++ b/pkgs/development/python-modules/reqif/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , python
 , fetchFromGitHub
-, poetry-core
+, hatchling
 , beautifulsoup4
 , lxml
 , jinja2
@@ -25,12 +25,11 @@ buildPythonPackage rec {
     substituteInPlace ./tests/unit/conftest.py --replace \
        "os.path.abspath(os.path.join(__file__, \"../../../../reqif\"))" \
       "\"${placeholder "out"}/${python.sitePackages}/reqif\""
-    substituteInPlace pyproject.toml --replace "^" ">="
     substituteInPlace requirements.txt --replace "==" ">="
   '';
 
   nativeBuildInputs = [
-    poetry-core
+    hatchling
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ripe-atlas-cousteau/default.nix b/pkgs/development/python-modules/ripe-atlas-cousteau/default.nix
index 73ee2abda8d1..b02f1f9a72f0 100644
--- a/pkgs/development/python-modules/ripe-atlas-cousteau/default.nix
+++ b/pkgs/development/python-modules/ripe-atlas-cousteau/default.nix
@@ -7,6 +7,7 @@
 , python-socketio
 , pythonOlder
 , requests
+, websocket-client
 }:
 
 buildPythonPackage rec {
@@ -26,13 +27,14 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace 'python-socketio[client]<5' 'python-socketio[client]<6'
+      --replace "websocket-client~=1.3.1" "websocket-client"
   '';
 
   propagatedBuildInputs = [
     python-dateutil
     requests
     python-socketio
+    websocket-client
   ] ++ python-socketio.optional-dependencies.client;
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/setupmeta/default.nix b/pkgs/development/python-modules/setupmeta/default.nix
index d92d81f632a7..ef031de98347 100644
--- a/pkgs/development/python-modules/setupmeta/default.nix
+++ b/pkgs/development/python-modules/setupmeta/default.nix
@@ -50,6 +50,9 @@ buildPythonPackage rec {
     "test_clean"
     "test_scenario"
     "test_git_versioning"
+    # setuptools.installer and fetch_build_eggs are deprecated.
+    # Requirements should be satisfied by a PEP 517 installer.
+    "test_brand_new_project"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/wfuzz/default.nix b/pkgs/development/python-modules/wfuzz/default.nix
index f7a197bcc114..1304b6c1dd79 100644
--- a/pkgs/development/python-modules/wfuzz/default.nix
+++ b/pkgs/development/python-modules/wfuzz/default.nix
@@ -28,6 +28,11 @@ buildPythonPackage rec {
     hash = "sha256-RM6QM/iR00ymg0FBUtaWAtxPHIX4u9U/t5N/UT/T6sc=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pyparsing>=2.4*" "pyparsing>=2.4"
+  '';
+
   propagatedBuildInputs = [
     chardet
     pycurl
diff --git a/pkgs/development/python-modules/yq/jq-path.patch b/pkgs/development/python-modules/yq/jq-path.patch
index ed98ec86aa51..bd2967b6ab02 100644
--- a/pkgs/development/python-modules/yq/jq-path.patch
+++ b/pkgs/development/python-modules/yq/jq-path.patch
@@ -1,26 +1,26 @@
 diff --git a/test/test.py b/test/test.py
-index f25dced..cd308c8 100755
+index db674a4..b6c797e 100755
 --- a/test/test.py
 +++ b/test/test.py
-@@ -105,7 +105,7 @@ class TestYq(unittest.TestCase):
+@@ -130,7 +130,7 @@ class TestYq(unittest.TestCase):
                  tf2.seek(0)
-                 self.assertEqual(self.run_yq("", ["-y", arg, tf.name, self.fd_path(tf2)]), '1\n...\n')
-
+                 self.assertEqual(self.run_yq("", ["-y", arg, tf.name, self.fd_path(tf2)]), "1\n...\n")
+ 
 -    @unittest.skipIf(subprocess.check_output(["jq", "--version"]) < b"jq-1.6", "Test options introduced in jq 1.6")
 +    @unittest.skipIf(subprocess.check_output(["@jq@", "--version"]) < b"jq-1.6", "Test options introduced in jq 1.6")
      def test_jq16_arg_passthrough(self):
-         self.assertEqual(self.run_yq("{}", ["--indentless", "-y", ".a=$ARGS.positional", "--args", "a", "b"]),
-                          "a:\n- a\n- b\n")
+         self.assertEqual(
+             self.run_yq("{}", ["--indentless", "-y", ".a=$ARGS.positional", "--args", "a", "b"]), "a:\n- a\n- b\n"
 diff --git a/yq/__init__.py b/yq/__init__.py
-index 91212d0..ee5a799 100755
+index 0ccb8e8..8342ff0 100644
 --- a/yq/__init__.py
 +++ b/yq/__init__.py
-@@ -146,7 +146,7 @@ def yq(input_streams=None, output_stream=None, input_format="yaml", output_forma
-     try:
+@@ -206,7 +206,7 @@ def yq(
          # Notes: universal_newlines is just a way to induce subprocess to make stdin a text buffer and encode it for us;
          # close_fds must be false for command substitution to work (yq . t.yml --slurpfile t <(yq . t.yml))
--        jq = subprocess.Popen(["jq"] + list(jq_args),
-+        jq = subprocess.Popen(["@jq@"] + list(jq_args),
-                               stdin=subprocess.PIPE,
-                               stdout=subprocess.PIPE if converting_output else None,
-                               close_fds=False,
+         jq = subprocess.Popen(
+-            ["jq"] + list(jq_args),
++            ["@jq@"] + list(jq_args),
+             stdin=subprocess.PIPE,
+             stdout=subprocess.PIPE if converting_output else None,
+             close_fds=False,
diff --git a/pkgs/development/tools/the-way/default.nix b/pkgs/development/tools/the-way/default.nix
index 428bb2f417b6..0a9524b0b02e 100644
--- a/pkgs/development/tools/the-way/default.nix
+++ b/pkgs/development/tools/the-way/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "the-way";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-d4ws5EsYVaxjfDbzoMO3kcJsrk/Htw3Ath3z3UGW7rk=";
+    sha256 = "sha256-jTyKz9ZvA9xJlDQXv2LHrSMeSDbh4AJBxi1WtqUhjgE=";
   };
 
-  cargoSha256 = "sha256-6zphQRhh32iophXSuzbQC5BOuKM92sLS5vXndwF+spg=";
+  cargoSha256 = "sha256-D0H8vChCzBCRjC/S/ceJbuNNAXISiFMZtgu8TMfic+0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/games/anki/default.nix b/pkgs/games/anki/default.nix
index 28bf794a8a97..f4d21256101a 100644
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/games/anki/default.nix
@@ -16,6 +16,7 @@
 , requests
 , markdown
 , matplotlib
+, mock
 , pytest
 , glibcLocales
 , nose
@@ -104,7 +105,7 @@ buildPythonApplication rec {
   ++ lib.optionals stdenv.isDarwin [ CoreAudio ]
   ;
 
-  nativeCheckInputs = [ pytest glibcLocales nose ];
+  nativeCheckInputs = [ pytest glibcLocales mock nose ];
 
   nativeBuildInputs = [ pyqtwebengine.wrapQtAppsHook ];
   buildInputs = [ lame mpv-unwrapped libpulseaudio ];
diff --git a/pkgs/servers/baserow/default.nix b/pkgs/servers/baserow/default.nix
index b64592d98929..92007bd6ee44 100644
--- a/pkgs/servers/baserow/default.nix
+++ b/pkgs/servers/baserow/default.nix
@@ -82,6 +82,7 @@ with python.pkgs; buildPythonApplication rec {
     importlib-resources
     itsdangerous
     pillow
+    pyparsing
     psutil
     psycopg2
     redis
diff --git a/pkgs/servers/calibre-web/default.nix b/pkgs/servers/calibre-web/default.nix
index 66eb2930ff53..e52685f1a208 100644
--- a/pkgs/servers/calibre-web/default.nix
+++ b/pkgs/servers/calibre-web/default.nix
@@ -5,7 +5,21 @@
 , fetchpatch
 }:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (old: rec {
+        version = "1.4.46";
+        src = self.fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          hash = "sha256-aRO4JH2KKS74MVFipRkx4rQM6RaB8bbxj2lwRSAMSjA=";
+        };
+      });
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
   pname = "calibre-web";
   version = "0.6.19";
 
@@ -16,7 +30,7 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-mNYLQ+3u6xRaoZ5oH6HdylFfgz1fq1ZB86AWk9vULWQ=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python.pkgs; [
     apscheduler
     advocate
     chardet
@@ -64,6 +78,7 @@ python3.pkgs.buildPythonApplication rec {
 
     substituteInPlace setup.cfg \
       --replace "cps = calibreweb:main" "calibre-web = calibreweb:main" \
+      --replace "APScheduler>=3.6.3,<3.10.0" "APScheduler>=3.6.3" \
       --replace "chardet>=3.0.0,<4.1.0" "chardet>=3.0.0,<6" \
       --replace "Flask>=1.0.2,<2.1.0" "Flask>=1.0.2" \
       --replace "Flask-Babel>=0.11.1,<2.1.0" "Flask-Babel>=0.11.1" \
diff --git a/pkgs/servers/mautrix-facebook/default.nix b/pkgs/servers/mautrix-facebook/default.nix
index 1da6346c1e08..178da1e6ada7 100644
--- a/pkgs/servers/mautrix-facebook/default.nix
+++ b/pkgs/servers/mautrix-facebook/default.nix
@@ -18,6 +18,7 @@ python3.pkgs.buildPythonPackage rec {
   };
 
   propagatedBuildInputs = with python3.pkgs; [
+    commonmark
     aiohttp
     asyncpg
     commonmark
diff --git a/pkgs/servers/mautrix-googlechat/default.nix b/pkgs/servers/mautrix-googlechat/default.nix
index be82fa1eaab0..e9431215b3b1 100644
--- a/pkgs/servers/mautrix-googlechat/default.nix
+++ b/pkgs/servers/mautrix-googlechat/default.nix
@@ -52,6 +52,7 @@
     yarl
     asyncpg
     ruamel-yaml
+    commonmark
     python-magic
     protobuf3
     mautrix
diff --git a/pkgs/servers/mautrix-signal/default.nix b/pkgs/servers/mautrix-signal/default.nix
index ee9ff4031a11..c1dbb84930b7 100644
--- a/pkgs/servers/mautrix-signal/default.nix
+++ b/pkgs/servers/mautrix-signal/default.nix
@@ -26,6 +26,7 @@ python3.pkgs.buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
+    commonmark
     aiohttp
     asyncpg
     attrs
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 04c87d780cb9..f440aa17b464 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -28,11 +28,11 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.27.40"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.27.79"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xP+ugapi6KJE+UokGKmG67ze5dH6nJuJk7BjIr6dtTE=";
+    hash = "sha256-A3MVM5MV+PTwR4W2ALrqEtMaFtVAEt8yqkd4ZLsvHGE=";
   };
 
   # https://github.com/aws/aws-cli/issues/4837
diff --git a/pkgs/tools/admin/awslogs/default.nix b/pkgs/tools/admin/awslogs/default.nix
index af8f427fe2a2..ff4924c1cce5 100644
--- a/pkgs/tools/admin/awslogs/default.nix
+++ b/pkgs/tools/admin/awslogs/default.nix
@@ -30,7 +30,8 @@ python3.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "jmespath>=0.7.1,<1.0.0" "jmespath>=0.7.1"
+      --replace "jmespath>=0.7.1,<1.0.0" "jmespath>=0.7.1" \
+      --replace '>=3.5.*' '>=3.5'
   '';
 
   disabledTests = [
diff --git a/pkgs/tools/misc/ytmdl/default.nix b/pkgs/tools/misc/ytmdl/default.nix
index c2a2a2adf2df..4a117e89f3d2 100644
--- a/pkgs/tools/misc/ytmdl/default.nix
+++ b/pkgs/tools/misc/ytmdl/default.nix
@@ -19,6 +19,7 @@ python3Packages.buildPythonApplication rec {
       --replace "bs4" "beautifulsoup4" \
       --replace "/etc/bash_completion.d" "share/bash-completion/completions" \
       --replace "/usr/share/zsh/functions/Completion/Unix" "share/zsh/site-functions"
+    sed -i '/python_requires=/d' setup.py
   '';
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 3c8fb8fc53bd..6934fa772907 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -55,7 +55,7 @@ mapAliases ({
   class-registry = phx-class-registry; # added 2021-10-05
   codespell = throw "codespell has been promoted to a top-level attribute"; # Added 2022-10-02
   ColanderAlchemy = colanderalchemy; # added 2023-02-19
-  CommonMark = commonmark; # added 2023-02-19
+  CommonMark = commonmark; # added 2023-02-1
   ConfigArgParse = configargparse; # added 2021-03-18
   cozy = throw "cozy was removed because it was not actually https://pypi.org/project/Cozy/."; # added 2022-01-14
   cryptography_vectors = "cryptography_vectors is no longer exposed in python*Packages because it is used for testing cryptography only."; # Added 2022-03-23