diff --git a/pkgs/development/python-modules/aioboto3/default.nix b/pkgs/development/python-modules/aioboto3/default.nix
index 231e4bbbe8b2..6b0f79655717 100644
--- a/pkgs/development/python-modules/aioboto3/default.nix
+++ b/pkgs/development/python-modules/aioboto3/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "aioboto3";
-  version = "12.1.0";
+  version = "12.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "terrycain";
     repo = "aioboto3";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CVRDQhymQRi5dyVBLJYTnF3RI4jPBB966dVMT4lOd8g=";
+    hash = "sha256-GDuxy/V+j0LRJ2lbcRHMEAga+pdCbYIWhEt3ItrHMB4=";
   };
 
   nativeBuildInputs = [
@@ -37,8 +37,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiobotocore
-    boto3
-  ];
+  ] ++ aiobotocore.optional-dependencies.boto3;
 
   passthru.optional-dependencies = {
     chalice = [
diff --git a/pkgs/development/python-modules/aiobotocore/default.nix b/pkgs/development/python-modules/aiobotocore/default.nix
index 9b8609c435af..15eeb18989cc 100644
--- a/pkgs/development/python-modules/aiobotocore/default.nix
+++ b/pkgs/development/python-modules/aiobotocore/default.nix
@@ -7,7 +7,10 @@
 , fetchFromGitHub
 , flask
 , flask-cors
+, awscli
 , moto
+, boto3
+, setuptools
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -16,16 +19,16 @@
 
 buildPythonPackage rec {
   pname = "aiobotocore";
-  version = "2.9.1";
-  format = "setuptools";
+  version = "2.11.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "aio-libs";
-    repo = pname;
+    repo = "aiobotocore";
     rev = "refs/tags/${version}";
-    hash = "sha256-cODdmP/O24fNIugzl4AYdf3g4Gzwx3JseYKbZKgEPbc=";
+    hash = "sha256-H9nsLPxjv3H5y6+5piBt6Pb+Wks4vwOitM+WQtyViPs=";
   };
 
   # Relax version constraints: aiobotocore works with newer botocore versions
@@ -34,6 +37,10 @@ buildPythonPackage rec {
     sed -i "s/'botocore>=.*'/'botocore'/" setup.py
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     aiohttp
     aioitertools
@@ -41,6 +48,15 @@ buildPythonPackage rec {
     wrapt
   ];
 
+  passthru.optional-dependencies = {
+    awscli = [
+      awscli
+    ];
+    boto3 = [
+      boto3
+    ];
+  };
+
   nativeCheckInputs = [
     dill
     flask
diff --git a/pkgs/development/python-modules/aws-encryption-sdk/default.nix b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
index b9186ab1779c..7cdcc917c8a8 100644
--- a/pkgs/development/python-modules/aws-encryption-sdk/default.nix
+++ b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
@@ -1,54 +1,62 @@
 { lib
-, buildPythonPackage
-, fetchPypi
 , attrs
 , boto3
+, buildPythonPackage
 , cryptography
-, setuptools
-, wrapt
+, fetchPypi
 , mock
-, pytest
 , pytest-mock
 , pytestCheckHook
+, pythonAtLeast
+, pythonOlder
+, setuptools
+, wrapt
 }:
 
 buildPythonPackage rec {
   pname = "aws-encryption-sdk";
   version = "3.1.1";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-jV+/AY/GjWscrL5N0Df9gFKWx3Nqn+RX62hNBT9/lWM=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     attrs
     boto3
     cryptography
-    setuptools
     wrapt
   ];
 
-  doCheck = true;
-
   nativeCheckInputs = [
     mock
-    pytest
     pytest-mock
     pytestCheckHook
   ];
 
   disabledTestPaths = [
-    # requires networking
+    # Tests require networking
     "examples"
     "test/integration"
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # AssertionError: Regex pattern did not match, https://github.com/aws/aws-encryption-sdk-python/issues/644
+    "test_abstracts"
+  ];
+
   meta = with lib; {
+    description = "Python implementation of the AWS Encryption SDK";
     homepage = "https://aws-encryption-sdk-python.readthedocs.io/";
     changelog = "https://github.com/aws/aws-encryption-sdk-python/blob/v${version}/CHANGELOG.rst";
-    description = "Fully compliant, native Python implementation of the AWS Encryption SDK.";
     license = licenses.asl20;
     maintainers = with maintainers; [ anthonyroussel ];
   };
diff --git a/pkgs/development/python-modules/aws-secretsmanager-caching/default.nix b/pkgs/development/python-modules/aws-secretsmanager-caching/default.nix
index 7e54c030bf1e..90226ddd99e4 100644
--- a/pkgs/development/python-modules/aws-secretsmanager-caching/default.nix
+++ b/pkgs/development/python-modules/aws-secretsmanager-caching/default.nix
@@ -1,25 +1,37 @@
 { lib
+, botocore
 , buildPythonPackage
-, pythonOlder
 , fetchPypi
+, pytestCheckHook
+, pythonAtLeast
+, pythonOlder
 , setuptools
 , setuptools-scm
-, botocore
-, pytestCheckHook
 }:
 
 buildPythonPackage rec {
-  pname = "aws_secretsmanager_caching";
+  pname = "aws-secretsmanager-caching";
   version = "1.1.1.5";
-  format = "setuptools";
+  pyprject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "5cee2762bb89b72f3e5123feee8e45fbe44ffe163bfca08b28f27b2e2b7772e1";
+    pname = "aws_secretsmanager_caching";
+    inherit version;
+    hash = "sha256-XO4nYruJty8+USP+7o5F++RP/hY7/KCLKPJ7Lit3cuE=";
   };
 
+  patches = [
+    # Remove coverage tests from the pytest invocation in setup.cfg.
+    ./remove-coverage-tests.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "'pytest-runner'," ""
+  '';
+
   nativeBuildInputs = [
     setuptools-scm
   ];
@@ -29,16 +41,6 @@ buildPythonPackage rec {
     setuptools  # Needs pkg_resources at runtime.
   ];
 
-  patches = [
-    # Remove coverage tests from the pytest invocation in setup.cfg.
-    ./remove-coverage-tests.patch
-  ];
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'pytest-runner'," ""
-  '';
-
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -48,6 +50,21 @@ buildPythonPackage rec {
     "test/integ"
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # TypeError: 'float' object cannot be interpreted as an integer
+    "test_calls_hook_binary"
+    "test_calls_hook_string"
+    "test_get_secret_binary"
+    "test_get_secret_string"
+    "test_invalid_json"
+    "test_missing_key"
+    "test_string_with_additional_kwargs"
+    "test_string"
+    "test_valid_json_with_mixed_args"
+    "test_valid_json_with_no_secret_kwarg"
+    "test_valid_json"
+  ];
+
   pythonImportsCheck = [
     "aws_secretsmanager_caching"
   ];
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 3a48019b2e99..f1ab0c4f28e3 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -1,27 +1,27 @@
 { lib
-, buildPythonPackage
-, pythonOlder
-, fetchFromGitHub
 , botocore
+, buildPythonPackage
+, fetchFromGitHub
 , jmespath
-, s3transfer
-, pythonRelaxDepsHook
-, setuptools
 , pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+, s3transfer
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "boto3";
-  version = "1.34.21"; # N.B: if you change this, change botocore and awscli to a matching version
-  format = "pyproject";
+  version = "1.34.49"; # N.B: if you change this, change botocore and awscli to a matching version
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "boto";
-    repo = pname;
+    repo = "boto3";
     rev = "refs/tags/${version}";
-    hash = "sha256-oOrUVBh1sbaOibU8A+bGZ4z7IEiE4gjHwZ+8889Hv60=";
+    hash = "sha256-/pgbLSL5RJ5RrKUAfQ1QNJykBdICrpqnuziHOVHt1JI=";
   };
 
   nativeBuildInputs = [
@@ -54,14 +54,16 @@ buildPythonPackage rec {
   ];
 
   passthru.optional-dependencies = {
-    crt = [ botocore.optional-dependencies.crt ];
+    crt = [
+      botocore.optional-dependencies.crt
+    ];
   };
 
   meta = with lib; {
+    description = "AWS SDK for Python";
     homepage = "https://github.com/boto/boto3";
     changelog = "https://github.com/boto/boto3/blob/${version}/CHANGELOG.rst";
     license = licenses.asl20;
-    description = "AWS SDK for Python";
     longDescription = ''
       Boto3 is the Amazon Web Services (AWS) Software Development Kit (SDK) for
       Python, which allows Python developers to write software that makes use of
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index bc1454b70ff1..89b6dbe07821 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -1,36 +1,47 @@
 { lib
-, buildPythonPackage
-, pythonOlder
-, fetchPypi
-, python-dateutil
-, jmespath
-, urllib3
-, pytestCheckHook
-, jsonschema
 , awscrt
+, buildPythonPackage
+, fetchPypi
+, jmespath
+, jsonschema
+, pytestCheckHook
+, python-dateutil
+, pythonOlder
+, pythonRelaxDepsHook
+, setuptools
+, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.34.21"; # N.B: if you change this, change boto3 and awscli to a matching version
-  format = "setuptools";
+  version = "1.34.49"; # N.B: if you change this, change boto3 and awscli to a matching version
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IZg7sEc6GRMBksUOxpdNVfDEqkinCUvPQPeILItpuPE=";
+    hash = "sha256-2JQQvGBnPq/xaZ8/H9yw46Xh96agSMDYjDzlw1SUM+w=";
   };
 
+  pythonRelaxDeps = [
+    "urllib3"
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
   propagatedBuildInputs = [
-    python-dateutil
     jmespath
+    python-dateutil
     urllib3
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     jsonschema
+    pytestCheckHook
   ];
 
   disabledTestPaths = [
@@ -46,14 +57,16 @@ buildPythonPackage rec {
   ];
 
   passthru.optional-dependencies = {
-    crt = [ awscrt ];
+    crt = [
+      awscrt
+    ];
   };
 
   meta = with lib; {
+    description = "A low-level interface to a growing number of Amazon Web Services";
     homepage = "https://github.com/boto/botocore";
     changelog = "https://github.com/boto/botocore/blob/${version}/CHANGELOG.rst";
     license = licenses.asl20;
-    description = "A low-level interface to a growing number of Amazon Web Services";
     maintainers = with maintainers; [ anthonyroussel ];
   };
 }
diff --git a/pkgs/development/python-modules/s3transfer/default.nix b/pkgs/development/python-modules/s3transfer/default.nix
index 91758650bba8..124b44f097cc 100644
--- a/pkgs/development/python-modules/s3transfer/default.nix
+++ b/pkgs/development/python-modules/s3transfer/default.nix
@@ -1,29 +1,38 @@
 { lib
+, stdenv
 , botocore
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
-, stdenv
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "s3transfer";
   version = "0.10.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "boto";
-    repo = pname;
+    repo = "s3transfer";
     rev = "refs/tags/${version}";
     hash = "sha256-21xycx1+84uY4gFr7N+ra98dpsEwxy9zeSl4QA66nUc=";
   };
 
-  propagatedBuildInputs = [ botocore ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  propagatedBuildInputs = [
+    botocore
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   disabledTestPaths = [
     # Requires network access
@@ -32,12 +41,18 @@ buildPythonPackage rec {
   # There was a change in python 3.8 that defaults multiprocessing to spawn instead of fork on macOS
   # See https://bugs.python.org/issue33725 and https://github.com/python/cpython/pull/13603.
   # I suspect the underlying issue here is that upstream tests aren't compatible with spawn multiprocessing, and pass on linux where the default is still fork
-  lib.optionals stdenv.isDarwin [ "tests/unit/test_compat.py" ];
+  lib.optionals stdenv.isDarwin [
+    "tests/unit/test_compat.py"
+  ];
 
-  pythonImportsCheck = [ "s3transfer" ];
+  pythonImportsCheck = [
+    "s3transfer"
+  ];
 
   passthru.optional-dependencies = {
-    crt = [ botocore.optional-dependencies.crt ];
+    crt = [
+      botocore.optional-dependencies.crt
+    ];
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/thriftpy2/default.nix b/pkgs/development/python-modules/thriftpy2/default.nix
index 6d8c9c9f83d2..092a3d03b602 100644
--- a/pkgs/development/python-modules/thriftpy2/default.nix
+++ b/pkgs/development/python-modules/thriftpy2/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "thriftpy2";
-  version = "0.4.16";
+  version = "0.4.19";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Thriftpy";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-o+h38NREnh14M23gyF2X2UdW7/spmHFo0rqvkKnmSRQ=";
+    hash = "sha256-u5k9dP6llfTjM745fRHvKC2vM7jd9D8lvPUsDcYx0EI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index a60ef454284d..b2c5f8477e81 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.8";
+  version = "3.2.24";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-Hd1YOzIH6v8N/oP2cJRUv6OkgOv9aSe7nkvzpsCN3rc=";
+    hash = "sha256-1v6Mft+FVEGXNQDiulpOvRy3KAD1JPkstjrURlL5r4o=";
   };
 
   patches = [
@@ -20,6 +20,8 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   pythonRelaxDeps = [
+    "boto3"
+    "botocore"
     "bc-detect-secrets"
     "bc-python-hcl2"
     "dpath"