diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 49d311ed37b3..83f8d0f34186 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -5,7 +5,7 @@
 
 let
   inherit (builtins) head length;
-  inherit (lib.trivial) mergeAttrs warn;
+  inherit (lib.trivial) isInOldestRelease mergeAttrs warn warnIf;
   inherit (lib.strings) concatStringsSep concatMapStringsSep escapeNixIdentifier sanitizeDerivationName;
   inherit (lib.lists) foldr foldl' concatMap elemAt all partition groupBy take foldl;
 in
@@ -885,15 +885,15 @@ rec {
     # Type
 
     ```
-    cartesianProductOfSets :: AttrSet -> [AttrSet]
+    cartesianProduct :: AttrSet -> [AttrSet]
     ```
 
     # Examples
     :::{.example}
-    ## `lib.attrsets.cartesianProductOfSets` usage example
+    ## `lib.attrsets.cartesianProduct` usage example
 
     ```nix
-    cartesianProductOfSets { a = [ 1 2 ]; b = [ 10 20 ]; }
+    cartesianProduct { a = [ 1 2 ]; b = [ 10 20 ]; }
     => [
          { a = 1; b = 10; }
          { a = 1; b = 20; }
@@ -904,7 +904,7 @@ rec {
 
     :::
   */
-  cartesianProductOfSets =
+  cartesianProduct =
     attrsOfLists:
     foldl' (listOfAttrs: attrName:
       concatMap (attrs:
@@ -913,6 +913,40 @@ rec {
     ) [{}] (attrNames attrsOfLists);
 
 
+  /**
+    Return the result of function f applied to the cartesian product of attribute set value combinations.
+    Equivalent to using cartesianProduct followed by map.
+
+    # Inputs
+
+    `f`
+
+    : A function, given an attribute set, it returns a new value.
+
+    `attrsOfLists`
+
+    : Attribute set with attributes that are lists of values
+
+    # Type
+
+    ```
+    mapCartesianProduct :: (AttrSet -> a) -> AttrSet -> [a]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.attrsets.mapCartesianProduct` usage example
+
+    ```nix
+    mapCartesianProduct ({a, b}: "${a}-${b}") { a = [ "1" "2" ]; b = [ "3" "4" ]; }
+    => [ "1-3" "1-4" "2-3" "2-4" ]
+    ```
+
+    :::
+
+  */
+  mapCartesianProduct = f: attrsOfLists: map f (cartesianProduct attrsOfLists);
+
   /**
     Utility function that creates a `{name, value}` pair as expected by `builtins.listToAttrs`.
 
@@ -1999,4 +2033,8 @@ rec {
   # DEPRECATED
   zip = warn
     "lib.zip is a deprecated alias of lib.zipAttrsWith." zipAttrsWith;
+
+  # DEPRECATED
+  cartesianProductOfSets = warnIf (isInOldestRelease 2405)
+    "lib.cartesianProductOfSets is a deprecated alias of lib.cartesianProduct." cartesianProduct;
 }
diff --git a/lib/default.nix b/lib/default.nix
index 21e4bab2b942..486d412fbb6f 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -86,8 +86,8 @@ let
       zipAttrsWithNames zipAttrsWith zipAttrs recursiveUpdateUntil
       recursiveUpdate matchAttrs mergeAttrsList overrideExisting showAttrPath getOutput
       getBin getLib getDev getMan chooseDevOutputs zipWithNames zip
-      recurseIntoAttrs dontRecurseIntoAttrs cartesianProductOfSets
-      updateManyAttrsByPath;
+      recurseIntoAttrs dontRecurseIntoAttrs cartesianProduct cartesianProductOfSets
+      mapCartesianProduct updateManyAttrsByPath;
     inherit (self.lists) singleton forEach foldr fold foldl foldl' imap0 imap1
       concatMap flatten remove findSingle findFirst any all count
       optional optionals toList range replicate partition zipListsWith zipLists
diff --git a/lib/lists.nix b/lib/lists.nix
index c162f921280d..28fa277b22b1 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -1688,16 +1688,32 @@ rec {
     ## `lib.lists.crossLists` usage example
 
     ```nix
-    crossLists (x:y: "${toString x}${toString y}") [[1 2] [3 4]]
+    crossLists (x: y: "${toString x}${toString y}") [[1 2] [3 4]]
     => [ "13" "14" "23" "24" ]
     ```
 
+    The following function call is equivalent to the one deprecated above:
+
+    ```nix
+    mapCartesianProduct (x: "${toString x.a}${toString x.b}") { a = [1 2]; b = [3 4]; }
+    => [ "13" "14" "23" "24" ]
+    ```
     :::
   */
   crossLists = warn
-    "lib.crossLists is deprecated, use lib.cartesianProductOfSets instead."
-    (f: foldl (fs: args: concatMap (f: map f args) fs) [f]);
+    ''lib.crossLists is deprecated, use lib.mapCartesianProduct instead.
 
+    For example, the following function call:
+
+    nix-repl> lib.crossLists (x: y: x+y) [[1 2] [3 4]]
+    [ 4 5 5 6 ]
+
+    Can now be replaced by the following one:
+
+    nix-repl> lib.mapCartesianProduct ({x,y}: x+y) { x = [1 2]; y = [3 4]; }
+    [ 4 5 5 6 ]
+    ''
+    (f: foldl (fs: args: concatMap (f: map f args) fs) [f]);
 
   /**
     Remove duplicate elements from the `list`. O(n^2) complexity.
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index accceb4ddf9c..cf4a185c1468 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -33,7 +33,7 @@ let
     boolToString
     callPackagesWith
     callPackageWith
-    cartesianProductOfSets
+    cartesianProduct
     cli
     composeExtensions
     composeManyExtensions
@@ -71,10 +71,10 @@ let
     makeIncludePath
     makeOverridable
     mapAttrs
+    mapCartesianProduct
     matchAttrs
     mergeAttrs
     meta
-    mkOption
     mod
     nameValuePair
     optionalDrvAttr
@@ -117,7 +117,6 @@ let
     expr = (builtins.tryEval expr).success;
     expected = true;
   };
-  testingDeepThrow = expr: testingThrow (builtins.deepSeq expr expr);
 
   testSanitizeDerivationName = { name, expected }:
   let
@@ -1415,7 +1414,7 @@ runTests {
     };
 
   testToPrettyMultiline = {
-    expr = mapAttrs (const (generators.toPretty { })) rec {
+    expr = mapAttrs (const (generators.toPretty { })) {
       list = [ 3 4 [ false ] ];
       attrs = { foo = null; bar.foo = "baz"; };
       newlinestring = "\n";
@@ -1429,7 +1428,7 @@ runTests {
         there
         test'';
     };
-    expected = rec {
+    expected = {
       list = ''
         [
           3
@@ -1467,13 +1466,10 @@ runTests {
     expected  = "«foo»";
   };
 
-  testToPlist =
-    let
-      deriv = derivation { name = "test"; builder = "/bin/sh"; system = "aarch64-linux"; };
-    in {
+  testToPlist = {
     expr = mapAttrs (const (generators.toPlist { })) {
       value = {
-        nested.values = rec {
+        nested.values = {
           int = 42;
           float = 0.1337;
           bool = true;
@@ -1686,17 +1682,17 @@ runTests {
   };
 
   testCartesianProductOfEmptySet = {
-    expr = cartesianProductOfSets {};
+    expr = cartesianProduct {};
     expected = [ {} ];
   };
 
   testCartesianProductOfOneSet = {
-    expr = cartesianProductOfSets { a = [ 1 2 3 ]; };
+    expr = cartesianProduct { a = [ 1 2 3 ]; };
     expected = [ { a = 1; } { a = 2; } { a = 3; } ];
   };
 
   testCartesianProductOfTwoSets = {
-    expr = cartesianProductOfSets { a = [ 1 ]; b = [ 10 20 ]; };
+    expr = cartesianProduct { a = [ 1 ]; b = [ 10 20 ]; };
     expected = [
       { a = 1; b = 10; }
       { a = 1; b = 20; }
@@ -1704,12 +1700,12 @@ runTests {
   };
 
   testCartesianProductOfTwoSetsWithOneEmpty = {
-    expr = cartesianProductOfSets { a = [ ]; b = [ 10 20 ]; };
+    expr = cartesianProduct { a = [ ]; b = [ 10 20 ]; };
     expected = [ ];
   };
 
   testCartesianProductOfThreeSets = {
-    expr = cartesianProductOfSets {
+    expr = cartesianProduct {
       a = [   1   2   3 ];
       b = [  10  20  30 ];
       c = [ 100 200 300 ];
@@ -1753,6 +1749,30 @@ runTests {
     ];
   };
 
+  testMapCartesianProductOfOneSet = {
+    expr = mapCartesianProduct ({a}: a * 2) { a = [ 1 2 3 ]; };
+    expected = [ 2 4 6 ];
+  };
+
+  testMapCartesianProductOfTwoSets = {
+    expr = mapCartesianProduct ({a,b}: a + b) { a = [ 1 ]; b = [ 10 20 ]; };
+    expected = [ 11 21 ];
+  };
+
+  testMapCartesianProcutOfTwoSetsWithOneEmpty = {
+    expr = mapCartesianProduct (x: x.a + x.b) { a = [ ]; b = [ 10 20 ]; };
+    expected = [ ];
+  };
+
+  testMapCartesianProductOfThreeSets = {
+    expr = mapCartesianProduct ({a,b,c}: a + b + c) {
+      a = [ 1 2 3 ];
+      b = [ 10 20 30 ];
+      c = [ 100 200 300 ];
+    };
+    expected = [ 111 211 311 121 221 321 131 231 331 112 212 312 122 222 322 132 232 332 113 213 313 123 223 323 133 233 333 ];
+  };
+
   # The example from the showAttrPath documentation
   testShowAttrPathExample = {
     expr = showAttrPath [ "foo" "10" "bar" ];
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a93255f08673..044f545a9666 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13394,6 +13394,12 @@
       fingerprint = "64BE BF11 96C3 DD7A 443E  8314 1DC0 82FA DE5B A863";
     }];
   };
+  mlaradji = {
+    name = "Mohamed Laradji";
+    email = "mlaradji@pm.me";
+    github = "mlaradji";
+    githubId = 33703663;
+  };
   mlatus = {
     email = "wqseleven@gmail.com";
     github = "Ninlives";
@@ -21545,6 +21551,16 @@
       fingerprint = "DA03 D6C6 3F58 E796 AD26  E99B 366A 2940 479A 06FC";
     }];
   };
+  willbush = {
+    email = "git@willbush.dev";
+    matrix = "@willbush:matrix.org";
+    github = "willbush";
+    githubId = 2023546;
+    name = "Will Bush";
+    keys = [{
+      fingerprint = "4441 422E 61E4 C8F3 EBFE  5E33 3823 864B 54B1 3BDA";
+    }];
+  };
   willcohen = {
     github = "willcohen";
     githubId = 5185341;
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 0782b7f3d981..20bcb47dc571 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -575,6 +575,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   and `services.kavita.settings.IpAddresses`. The file at `services.kavita.tokenKeyFile` now needs to contain a secret with
   512+ bits instead of 128+ bits.
 
+- `kavita` has been updated to 0.8.0, requiring a manual forced library scan on all libraries for migration. Refer to upstream's [release notes](https://github.com/Kareadita/Kavita/releases/tag/v0.8.0) for details.
+
 - The `krb5` module has been rewritten and moved to `security.krb5`, moving all options but `security.krb5.enable` and `security.krb5.package` into `security.krb5.settings`.
 
 - `services.soju` now has a wrapper for the `sojuctl` command, pointed at the service config file. It also has the new option `adminSocket.enable`, which creates a unix admin socket at `/run/soju/admin`.
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 3456098073b3..e564fe3b8317 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -203,9 +203,12 @@ in
       apply = pkg: pkg.override {
         tesseract5 = pkg.tesseract5.override {
           # always enable detection modules
+          # tesseract fails to build when eng is not present
           enableLanguages = if cfg.settings ? PAPERLESS_OCR_LANGUAGE then
-            [ "equ" "osd" ]
+            lists.unique (
+              [ "equ" "osd" "eng" ]
               ++ lib.splitString "+" cfg.settings.PAPERLESS_OCR_LANGUAGE
+            )
           else null;
         };
       };
diff --git a/nixos/modules/services/misc/podgrab.nix b/nixos/modules/services/misc/podgrab.nix
index f95d2dc928cd..50dc70e2bd76 100644
--- a/nixos/modules/services/misc/podgrab.nix
+++ b/nixos/modules/services/misc/podgrab.nix
@@ -1,6 +1,8 @@
 { config, lib, pkgs, ... }:
 let
   cfg = config.services.podgrab;
+
+  stateDir = "/var/lib/podgrab";
 in
 {
   options.services.podgrab = with lib; {
@@ -22,28 +24,59 @@ in
       example = 4242;
       description = "The port on which Podgrab will listen for incoming HTTP traffic.";
     };
+
+    dataDirectory = mkOption {
+      type = types.path;
+      default = "${stateDir}/data";
+      example = "/mnt/podcasts";
+      description = "Directory to store downloads.";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "podgrab";
+      description = "User under which Podgrab runs, and which owns the download directory.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "podgrab";
+      description = "Group under which Podgrab runs, and which owns the download directory.";
+    };
   };
 
   config = lib.mkIf cfg.enable {
+    systemd.tmpfiles.settings."10-pyload" = {
+      ${cfg.dataDirectory}.d = { inherit (cfg) user group; };
+    };
+
     systemd.services.podgrab = {
       description = "Podgrab podcast manager";
       wantedBy = [ "multi-user.target" ];
       environment = {
-        CONFIG = "/var/lib/podgrab/config";
-        DATA = "/var/lib/podgrab/data";
+        CONFIG = "${stateDir}/config";
+        DATA = cfg.dataDirectory;
         GIN_MODE = "release";
         PORT = toString cfg.port;
       };
       serviceConfig = {
-        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
         EnvironmentFile = lib.optionals (cfg.passwordFile != null) [
           cfg.passwordFile
         ];
         ExecStart = "${pkgs.podgrab}/bin/podgrab";
         WorkingDirectory = "${pkgs.podgrab}/share";
-        StateDirectory = [ "podgrab/config" "podgrab/data" ];
+        StateDirectory = [ "podgrab/config" ];
       };
     };
+
+    users.users.podgrab = lib.mkIf (cfg.user == "podgrab") {
+      isSystemUser = true;
+      group = cfg.group;
+    };
+
+    users.groups.podgrab = lib.mkIf (cfg.group == "podgrab") { };
   };
 
   meta.maintainers = with lib.maintainers; [ ambroisie ];
diff --git a/nixos/modules/services/x11/display-managers/default.nix b/nixos/modules/services/x11/display-managers/default.nix
index 4c62e964c34c..0f9b712c6df5 100644
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@@ -284,7 +284,7 @@ in
       in
         # We will generate every possible pair of WM and DM.
         concatLists (
-            builtins.map
+            lib.mapCartesianProduct
             ({dm, wm}: let
               sessionName = "${dm.name}${optionalString (wm.name != "none") ("+" + wm.name)}";
               script = xsession dm wm;
@@ -312,7 +312,7 @@ in
                   providedSessions = [ sessionName ];
                 })
             )
-            (cartesianProductOfSets { dm = dms; wm = wms; })
+            { dm = dms; wm = wms; }
           );
   };
 
diff --git a/nixos/tests/paperless.nix b/nixos/tests/paperless.nix
index 3d834b29958d..3ef291ba7e06 100644
--- a/nixos/tests/paperless.nix
+++ b/nixos/tests/paperless.nix
@@ -23,6 +23,7 @@ import ./make-test-python.nix ({ lib, ... }: {
       };
       services.paperless.settings = {
         PAPERLESS_DBHOST = "/run/postgresql";
+        PAPERLESS_OCR_LANGUAGE = "deu";
       };
     };
   }; in self;
diff --git a/nixos/tests/predictable-interface-names.nix b/nixos/tests/predictable-interface-names.nix
index 51d5e8ae59b9..9ac4f8211e6b 100644
--- a/nixos/tests/predictable-interface-names.nix
+++ b/nixos/tests/predictable-interface-names.nix
@@ -5,7 +5,7 @@
 
 let
   inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
-  testCombinations = pkgs.lib.cartesianProductOfSets {
+  testCombinations = pkgs.lib.cartesianProduct {
     predictable = [true false];
     withNetworkd = [true false];
     systemdStage1 = [true false];
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index e70a2eb26f17..597f87337cae 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -6,12 +6,13 @@
 , ncurses
 , openssl
 , Cocoa
-, withALSA ? true, alsa-lib
+, withALSA ? false, alsa-lib
 , withClipboard ? true, libxcb, python3
 , withCover ? false, ueberzug
-, withPulseAudio ? false, libpulseaudio
+, withPulseAudio ? true, libpulseaudio
 , withPortAudio ? false, portaudio
 , withMPRIS ? true, withNotify ? true, dbus
+, withCrossterm ? true
 , nix-update-script
 , testers
 , ncspot
@@ -54,6 +55,7 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optional withPulseAudio "pulseaudio_backend"
     ++ lib.optional withPortAudio "portaudio_backend"
     ++ lib.optional withMPRIS "mpris"
+    ++ lib.optional withCrossterm "crossterm_backend"
     ++ lib.optional withNotify "notify";
 
   postInstall = ''
diff --git a/pkgs/applications/blockchains/btcpayserver/default.nix b/pkgs/applications/blockchains/btcpayserver/default.nix
index a42d94e1f89c..15d033573601 100644
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.12.5";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qlqwIVk8NzfFZlzShfm3nTZWovObWLIKiNGAOCN8i7Y=";
+    sha256 = "sha256-p0GNwwbhsgChlSlPVD/RHhzWF/1URdYp/iYQmJxORU8=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";
diff --git a/pkgs/applications/blockchains/btcpayserver/deps.nix b/pkgs/applications/blockchains/btcpayserver/deps.nix
index 0e5986de9739..2ae9af5a0887 100644
--- a/pkgs/applications/blockchains/btcpayserver/deps.nix
+++ b/pkgs/applications/blockchains/btcpayserver/deps.nix
@@ -8,18 +8,18 @@
   (fetchNuGet { pname = "AWSSDK.S3"; version = "3.3.110.10"; sha256 = "1lf1hfbx792dpa1hxgn0a0jrrvldd16hgbxx229dk2qcz5qlnc38"; })
   (fetchNuGet { pname = "BIP78.Sender"; version = "0.2.2"; sha256 = "12pm2s35c0qzc06099q2z1pxwq94rq85n74yz8fs8gwvm2ksgp4p"; })
   (fetchNuGet { pname = "BTCPayServer.Hwi"; version = "2.0.2"; sha256 = "0lh3n1qncqs4kbrmx65xs271f0d9c7irrs9qnsa9q51cbbqbljh9"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.5.3"; sha256 = "0nn6z1gjkkfy46w32pc5dvp4z5gjnwa9bn7xjkxgh7575m467jpp"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.6.0"; sha256 = "0xcqf7jz5rsi6nawcjfdbbdjlnqbx8xfzw8sn3a9ks8xjqv37krn"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Charge"; version = "1.5.1"; sha256 = "1sb6qhm15d6qqyx9v5g7csvp8phhs6k2py5wmfmbpnjydaydf76g"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.5.1"; sha256 = "13slknvqslxn8sp4dcwgbrnigrd9di84h9hribpls79kzw76gfpy"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.6.0"; sha256 = "1bsmic9i1p2ya5hv1mscv46fxh6ibczfj1srylzwcpgs0mypy5y3"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.21"; sha256 = "042xwfsxd30zgwiz0w14ynb755w5sldkplxgw1fkw68lrz66x5s4"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.5.1"; sha256 = "1jy5k0nd2b10p3gyv8qm3nb31chkpcssrb9sjw2dqbac757nv154"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Eclair"; version = "1.5.2"; sha256 = "1wmj66my2cg9dbz4bf8vrkxpkpl4wfqaxxzqxgs830vdk8h7pp50"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.5.2"; sha256 = "0g2jv712lb3arlpf6j8p0ccq62gz1bjipb9ndzhdk7mwhaznkrwl"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.5.2"; sha256 = "1yfs2ghh7xw4c98hfm3k8sdkij8qxwnfnb8fjw896jvj2jd3p3sr"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.5.4"; sha256 = "0jqxy60msq9rl04lmqyiz9f02mjywypfh3apr9vcbyv2q47maxnd"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.5.2"; sha256 = "09i663w6i93675bxrq5x6l26kr60mafwfr6ny92xrppj8rmd2lzx"; })
   (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins"; version = "1.4.4"; sha256 = "0rk0prmb0539ji5fd33cqy3yvw51i5i8m5hb43admr5z8960dd6l"; })
   (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins.Mvc"; version = "1.4.4"; sha256 = "1kmmj5m7s41wc1akpqw1b1j7pp4c0vn6sqxb487980ibpj6hyisl"; })
-  (fetchNuGet { pname = "BTCPayServer.NTag424"; version = "1.0.20"; sha256 = "19nzikcg7vygpad83lcaw5jvkrp4pgvggnziwkmi95l8k38gkj5q"; })
+  (fetchNuGet { pname = "BTCPayServer.NTag424"; version = "1.0.22"; sha256 = "1gy81kqd745p2sak7yj5phn25k8blwwjzi39s5ikpwyqg3b0arsw"; })
   (fetchNuGet { pname = "CsvHelper"; version = "15.0.5"; sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma"; })
   (fetchNuGet { pname = "Dapper"; version = "2.1.28"; sha256 = "15vpa9k11rr1mh5vb6hdchy8hqa03lqs83w19s3kxzh1089yl9m8"; })
   (fetchNuGet { pname = "DigitalRuby.ExchangeSharp"; version = "1.0.4"; sha256 = "1hkdls4wjrxq6df1zq9saa6hn5hynalq3gxb486w59j7i9f3g7d8"; })
@@ -36,7 +36,7 @@
   (fetchNuGet { pname = "Google.Apis.Core"; version = "1.38.0"; sha256 = "012gslhnx65vqfyzjnqx4bqk9kb8bwbx966q2f9fdgrfcn26gj9j"; })
   (fetchNuGet { pname = "Google.Apis.Storage.v1"; version = "1.38.0.1470"; sha256 = "0mfrz7fmpfbjvp4zfpjasmnfbgxgxrrjkf8xgp9p6h9g8qh2f2h2"; })
   (fetchNuGet { pname = "Google.Cloud.Storage.V1"; version = "2.3.0"; sha256 = "01jhrd6m6md8m28chzg2dkdfd4yris79j1xi7r1ydm1cfjhmlj64"; })
-  (fetchNuGet { pname = "HtmlSanitizer"; version = "8.0.723"; sha256 = "1x621v4ypgd1zrmq7zd7j9wcrc30f6rm9qh0i1sm4yfqd983yf4g"; })
+  (fetchNuGet { pname = "HtmlSanitizer"; version = "8.0.838"; sha256 = "1k05ld36872lzbhlby9m1vf9y7chlijbflbk2pzcni57b9rp2qrg"; })
   (fetchNuGet { pname = "Humanizer.Core"; version = "2.14.1"; sha256 = "1ai7hgr0qwd7xlqfd92immddyi41j3ag91h3594yzfsgsy6yhyqi"; })
   (fetchNuGet { pname = "libsodium"; version = "1.0.18"; sha256 = "15qzl5k31yaaapqlijr336lh4lzz1qqxlimgxy8fdyig8jdmgszn"; })
   (fetchNuGet { pname = "LNURL"; version = "0.0.34"; sha256 = "1sbkqsln7wq5fsbw63wdha8kqwxgd95j0iblv4kxa1shyg3c5d9x"; })
@@ -251,6 +251,7 @@
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "5.0.0"; sha256 = "1kvcllagxz2q92g81zkz81djkn2lid25ayjfgjalncyc68i15p0r"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "6.0.0"; sha256 = "1js98kmjn47ivcvkjqdmyipzknb9xbndssczm8gq224pbaj1p88c"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "7.0.0"; sha256 = "1n9122cy6v3qhsisc9lzwa1m1j62b8pi2678nsmnlyvfpk0zdagm"; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "8.0.0"; sha256 = "0z53a42zjd59zdkszcm7pvij4ri5xbb8jly9hzaad9khlf69bcqp"; })
   (fetchNuGet { pname = "System.Composition"; version = "6.0.0"; sha256 = "1p7hysns39cc24af6dwd4m48bqjsrr3clvi4aws152mh2fgyg50z"; })
   (fetchNuGet { pname = "System.Composition.AttributedModel"; version = "6.0.0"; sha256 = "1mqrblb0l65hw39d0hnspqcv85didpn4wbiwhfgj4784wzqx2w6k"; })
   (fetchNuGet { pname = "System.Composition.Convention"; version = "6.0.0"; sha256 = "02km3yb94p1c4s7liyhkmda0g71zm1rc8ijsfmy4bnlkq15xjw3b"; })
diff --git a/pkgs/applications/blockchains/nbxplorer/default.nix b/pkgs/applications/blockchains/nbxplorer/default.nix
index 6a4b164e5f1c..5f8c0110402e 100644
--- a/pkgs/applications/blockchains/nbxplorer/default.nix
+++ b/pkgs/applications/blockchains/nbxplorer/default.nix
@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "nbxplorer";
-  version = "2.5.0";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "dgarage";
     repo = "NBXplorer";
     rev = "v${version}";
-    sha256 = "sha256-yhOPv8J1unDx61xPc8ktQbIfkp00PPXRlOgdGo2QkB4=";
+    sha256 = "sha256-zfL+VoDfICUtw02KeRghaq3XPOa/YnSh8orhqmo3Auo=";
   };
 
   projectFile = "NBXplorer/NBXplorer.csproj";
diff --git a/pkgs/applications/blockchains/nbxplorer/deps.nix b/pkgs/applications/blockchains/nbxplorer/deps.nix
index 97879b0c4e39..cdf73d5de09a 100644
--- a/pkgs/applications/blockchains/nbxplorer/deps.nix
+++ b/pkgs/applications/blockchains/nbxplorer/deps.nix
@@ -46,7 +46,7 @@
   (fetchNuGet { pname = "NicolasDorier.CommandLine"; version = "2.0.0"; sha256 = "0gywvl0gqs3crlzwgwzcqf0qsrbhk3dxjycpimxqvs1ihg4dhb1f"; })
   (fetchNuGet { pname = "NicolasDorier.CommandLine.Configuration"; version = "2.0.0"; sha256 = "1cng096r3kb85lf5wjill4yhxx8nv9v0d6ksbn1i1vvdawwl6fkw"; })
   (fetchNuGet { pname = "NicolasDorier.StandardConfiguration"; version = "2.0.0"; sha256 = "0058dx34ja2idw468bmw7l3w21wr2am6yx57sqp7llhjl5ayy0wv"; })
-  (fetchNuGet { pname = "Npgsql"; version = "8.0.1"; sha256 = "01dqlqpwr450vfs7r113k1glrnpnr2fgc04x5ni6bj0k6aahhl7v"; })
+  (fetchNuGet { pname = "Npgsql"; version = "8.0.2"; sha256 = "0w1hm3bjh1vfnkzflp1x8bd4d723mpr4y6gb6ga79v5kkf09cmm2"; })
   (fetchNuGet { pname = "RabbitMQ.Client"; version = "5.1.2"; sha256 = "195nxmnva1z2p0ahvn0kswv4d39f5bdy2sl3cxcvfziamc21xrmd"; })
   (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
   (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "1wl76vk12zhdh66vmagni66h5xbhgqq7zkdpgw21jhxhvlbcl8pk"; })
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index d8e8dfe1e554..ac5fe0cc16a1 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -17213,5 +17213,17 @@ final: prev:
     meta.homepage = "https://github.com/jhradilek/vim-snippets/";
   };
 
+  gitignore-nvim = buildVimPlugin {
+    pname = "gitignore-nvim";
+    version = "2024-03-25";
+    src = fetchFromGitHub {
+      owner = "wintermute-cell";
+      repo = "gitignore.nvim";
+      rev = "2455191ec94da8ed222806a4fe3aa358eac1e558";
+      sha256 = "sha256-p6k0NP3Vne6Kl98YodzSruVmJwxyrXziJj8N7u79o1w=";
+    };
+    meta.homepage = "https://github.com/wintermute-cell/gitignore.nvim/";
+  };
+
 
 }
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 66e0351298cd..a9b5e4e9c69c 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -338,6 +338,7 @@ https://github.com/f-person/git-blame.nvim/,,
 https://github.com/akinsho/git-conflict.nvim/,HEAD,
 https://github.com/rhysd/git-messenger.vim/,,
 https://github.com/ThePrimeagen/git-worktree.nvim/,,
+https://github.com/wintermute-cell/gitignore.nvim/,HEAD,
 https://github.com/vim-scripts/gitignore.vim/,,
 https://github.com/ruifm/gitlinker.nvim/,,
 https://github.com/lewis6991/gitsigns.nvim/,,
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
index b06922a90c5b..c5ae57e0f63b 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  nodePackages,
+  pyright,
   vscode-utils,
 }:
 
@@ -12,7 +12,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     hash = "sha256-xJU/j5r/Idp/0VorEfciT4SFKRBpMCv9Z0LKO/++1Gk=";
   };
 
-  buildInputs = [ nodePackages.pyright ];
+  buildInputs = [ pyright ];
 
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/ms-python.vscode-pylance/changelog";
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 5f8b7c9068ac..e977dffc444b 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -9,43 +9,43 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.10.28" else "8.10.30-11.BETA";
+  version = if channel == "stable" then "8.10.30" else "8.10.30-20.BETA";
 
   sources = {
     stable = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-1EfP8z+vH0yRklkcxCOPYExu13iFcs6jOdvWBzl64BA=";
+        hash = "sha256-q1PKFpBgjada7jmeXZYmH8dvy2A4lwfrQ0jQSoHVNcg=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-E4MfpHVIn5Vu/TcDgwkoHdSnKthaAMFJZArnmSH5cxA=";
+        hash = "sha256-Zv/mnykPi9PCDX44JtGi0GPrOujSmjx1BBJuEB81CwE=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-+cXirJyDnxfE5FN8HEIrEyyoGvVrJ+0ykBHON9oHAek=";
+        hash = "sha256-unC1cz5ooSdu4Csf7/daCyPdMy3/Lp3a76B7TBa/VXk=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-zKAgAKYIgy5gZbe2IpskV8DG8AKtamYqq8cF/mTpRss=";
+        hash = "sha256-DS6oCdr6srF+diL68a2gOskS4x+uj1i8DtL3uaaxv/I=";
       };
     };
     beta = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-6zyDZRsk9FZXJuGqqt1kCATcL99PjYP/wQzqE/4e4kg=";
+        hash = "sha256-6I/3o+33sIkfyef8xGUWczaWykHPcvvAGv0xy/jCkKI=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-JwHk6Byqd5LxVWBT/blRVnYhgSeYfaVY3Ax4GkLcFxM=";
+        hash = "sha256-ph6DBBUzdUHtYCAQiA1me3bevtVPEgIxtwbgbdgQcGY=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-h7vJguOEQBEvX9Z9MjdLj0hPnn8hJpeWRoduVowznLg=";
+        hash = "sha256-XzZOj1pfoCTGMTsqZlI8hKTDRJ4w7debAPYHIIwsyyY=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-g6lorMdQ56B6gd4YN4WQSkztwHqIgO7QshM1zocpqTE=";
+        hash = "sha256-s+hnKhI2s6E1ZyJQxs3Wggy60LxCEr+u3tRtjTgjmZk=";
       };
     };
   };
diff --git a/pkgs/applications/misc/systembus-notify/default.nix b/pkgs/applications/misc/systembus-notify/default.nix
index f05c8a0aa074..c059c566fecd 100644
--- a/pkgs/applications/misc/systembus-notify/default.nix
+++ b/pkgs/applications/misc/systembus-notify/default.nix
@@ -17,7 +17,9 @@ let
       Type = "exec";
       ExecStart = "@out@/bin/systembus-notify";
       PrivateTmp = true;
-      ProtectHome = true;
+      # NB. We cannot `ProtectHome`, or it would block session dbus access.
+      InaccessiblePaths = "/home";
+      ReadOnlyPaths = "/run/user";
       ProtectSystem = "strict";
       Restart = "on-failure";
       Slice = "background.slice";
diff --git a/pkgs/applications/misc/writefreely/default.nix b/pkgs/applications/misc/writefreely/default.nix
index fe1d221bd274..d505ae2e380a 100644
--- a/pkgs/applications/misc/writefreely/default.nix
+++ b/pkgs/applications/misc/writefreely/default.nix
@@ -2,16 +2,20 @@
 
 buildGoModule rec {
   pname = "writefreely";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "writefreely";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vOoTAr33FMQaHIwpwIX0g/KJWQvDn3oVJg14kEY6FIQ=";
+    sha256 = "sha256-7KTNimthtfmQCgyXevAEj+CZ2MS+uOby73OO1fGNXfs=";
   };
 
-  vendorHash = "sha256-xTo/zbz9pSjvNntr5dnytiJ7oRAdtEuyiu4mJZgwHTc=";
+  vendorHash = "sha256-6RTshhxX+w/gdK53wCHVMpm6EkkRtEJ2/Fe7MfZ0WvY=";
+
+  patches = [
+    ./fix-go-version-error.patch
+  ];
 
   ldflags = [ "-s" "-w" "-X github.com/writefreely/writefreely.softwareVer=${version}" ];
 
diff --git a/pkgs/applications/misc/writefreely/fix-go-version-error.patch b/pkgs/applications/misc/writefreely/fix-go-version-error.patch
new file mode 100644
index 000000000000..bfe7ba2dd5dc
--- /dev/null
+++ b/pkgs/applications/misc/writefreely/fix-go-version-error.patch
@@ -0,0 +1,36 @@
+diff --git a/go.mod b/go.mod
+index c49d701..601443d 100644
+--- a/go.mod
++++ b/go.mod
+@@ -89,4 +89,6 @@ require (
+ 	gopkg.in/yaml.v3 v3.0.1 // indirect
+ )
+ 
+-go 1.19
++go 1.21
++
++toolchain go1.21.6
+diff --git a/go.sum b/go.sum
+index a9256ea..28ad24f 100644
+--- a/go.sum
++++ b/go.sum
+@@ -72,6 +72,7 @@ github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
+ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
++github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+ github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
+ github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+ github.com/gorilla/csrf v1.7.2 h1:oTUjx0vyf2T+wkrx09Trsev1TE+/EbDAeHtSTbtC2eI=
+@@ -106,9 +107,11 @@ github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVY
+ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+ github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
++github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
++github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+ github.com/kylemcc/twitter-text-go v0.0.0-20180726194232-7f582f6736ec h1:ZXWuspqypleMuJy4bzYEqlMhJnGAYpLrWe5p7W3CdvI=
+ github.com/kylemcc/twitter-text-go v0.0.0-20180726194232-7f582f6736ec/go.mod h1:voECJzdraJmolzPBgL9Z7ANwXf4oMXaTCsIkdiPpR/g=
+ github.com/mailgun/mailgun-go v2.0.0+incompatible h1:0FoRHWwMUctnd8KIR3vtZbqdfjpIMxOZgcSa51s8F8o=
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 5c4b28cc1575..43da2a13d94d 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -103,7 +103,14 @@ let
     "flac"
     "libjpeg"
     "libpng"
+  ] ++ lib.optionals (!chromiumVersionAtLeast "124") [
+    # Use the vendored libwebp for M124+ until we figure out how to solve:
+    # Running phase: configurePhase
+    # ERROR Unresolved dependencies.
+    # //third_party/libavif:libavif_enc(//build/toolchain/linux/unbundle:default)
+    #   needs //third_party/libwebp:libwebp_sharpyuv(//build/toolchain/linux/unbundle:default)
     "libwebp"
+  ] ++ [
     "libxslt"
     # "opus"
   ];
@@ -265,6 +272,15 @@ let
       # Partial revert of https://github.com/chromium/chromium/commit/3687976b0c6d36cf4157419a24a39f6770098d61
       # allowing us to use our rustc and our clang.
       ./patches/chromium-121-rust.patch
+    ] ++ lib.optionals (chromiumVersionAtLeast "124" && !chromiumVersionAtLeast "125") [
+      # M124 shipped with broken --ozone-platform-hint flag handling, which we rely on
+      # for our NIXOS_OZONE_WL (wayland) environment variable.
+      # See <https://issues.chromium.org/issues/329678163>.
+      # This is the commit for the fix that landed in M125, which applies clean on M124.
+      (githubPatch {
+        commit = "c7f4c58f896a651eba80ad805ebdb49d19ebdbd4";
+        hash = "sha256-6nYWT2zN+j73xAIXLdGYT2eC71vGnGfiLCB0OwT0CAI=";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 2597d293ac63..d75b5df53032 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -9,15 +9,15 @@
     };
     deps = {
       gn = {
-        hash = "sha256-JvilCnnb4laqwq69fay+IdAujYC1EHD7uWpkF/C8tBw=";
-        rev = "d4f94f9a6c25497b2ce0356bb99a8d202c8c1d32";
+        hash = "sha256-aEL1kIhgPAFqdb174dG093HoLhCJ07O1Kpqfu7r14wQ=";
+        rev = "22581fb46c0c0c9530caa67149ee4dd8811063cf";
         url = "https://gn.googlesource.com/gn";
-        version = "2024-02-19";
+        version = "2024-03-14";
       };
     };
-    hash = "sha256-7H7h621AHPyhFYbaVFO892TtS+SP3Qu7cYUVk3ICL14=";
-    hash_deb_amd64 = "sha256-tNkO1mPZg1xltBfoWeNhLekITtZV/WNgu//i2DJb17c=";
-    version = "123.0.6312.122";
+    hash = "sha256-apEniFKhIxPo4nhp9gCU+WpiV/EB40qif4RfE7Uniog=";
+    hash_deb_amd64 = "sha256-rSbigG5/xbL32d1ntOn6gnZyxSpgrg1h7lb/RD4YROI=";
+    version = "124.0.6367.60";
   };
   ungoogled-chromium = {
     deps = {
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 956842ca9bcc..5a55476d4b9e 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -44,13 +44,13 @@ rec {
 
   thunderbird-115 = (buildMozillaMach rec {
     pname = "thunderbird";
-    version = "115.9.0";
+    version = "115.10.1";
     application = "comm/mail";
     applicationName = "Mozilla Thunderbird";
     binaryName = pname;
     src = fetchurl {
       url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-      sha512 = "8ff0bed6e6d7f337ebae09011a10b59343ae7a8355ed1da2d72ec0d4218010adfae78e42565e5b784df26cef4702f313dc9616ac5ca5530fb772d77bdf7f2ea4";
+      sha512 = "0324811d3e7e6228bb45cbf01e8a4a08b8386e22d1b52eb79f9a9a3bda940eb9d534ec1230961e9a998a0162c299a1ad49d23c5fbfa8e287896bcc0fd1c398e0";
     };
     extraPatches = [
       # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
diff --git a/pkgs/applications/networking/twingate/default.nix b/pkgs/applications/networking/twingate/default.nix
index c8e218a3fdff..9537ab4c1784 100644
--- a/pkgs/applications/networking/twingate/default.nix
+++ b/pkgs/applications/networking/twingate/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "twingate";
-  version = "2024.63.115357";
+  version = "2024.98.119300";
 
   src = fetchurl {
     url = "https://binaries.twingate.com/client/linux/DEB/x86_64/${version}/twingate-amd64.deb";
-    hash = "sha256-VSm9gnHfo9LPwUvNwLeX7OjqMYgFUgGYSxx/qDndfwo=";
+    hash = "sha256-N0cabYHaF5H1EeriQRQL7bN5UM85oOGrm9pxGr1AlEk=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/office/super-productivity/default.nix b/pkgs/applications/office/super-productivity/default.nix
index eb97565cb760..5a5ff9fc959e 100644
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "super-productivity";
-  version = "8.0.1";
+  version = "8.0.5";
 
   src = fetchurl {
     url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "sha256-BW/4jP4lh3leAcdy3JHET/PUybN+0Cy9wxMSi57dAcw=";
+    sha256 = "sha256-nH7dCrXBhkAYbvb9CPc4zhslFiYtA1ChuYPoHMdBBwQ=";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/science/biology/iqtree/default.nix b/pkgs/applications/science/biology/iqtree/default.nix
index 1f00876b5848..d8e90789f4d5 100644
--- a/pkgs/applications/science/biology/iqtree/default.nix
+++ b/pkgs/applications/science/biology/iqtree/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iqtree";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "iqtree";
     repo = "iqtree2";
     rev = "v${version}";
-    hash = "sha256-GaNumiTGa6mxvFifv730JFgKrRxG41gJN+ci3imDbzs=";
+    hash = "sha256-hAJs48PhIyZSKSRZjQJKQwoJlt6DPRQwaDsuZ00VZII=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/version-management/forgejo/default.nix b/pkgs/applications/version-management/forgejo/default.nix
index 3357309442e9..85613530ba39 100644
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
   pname = "forgejo";
-  version = "1.21.10-0";
+  version = "1.21.11-0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "forgejo";
     rev = "v${version}";
-    hash = "sha256-uCRAT9RiU9S+tP9alNshSQwbUgLmU9wE5HIQ4FPmXVE=";
+    hash = "sha256-Cp+dN4nTIboin42NJR/YUkVXbBC7uufH8EE7NgIVFzY=";
     # Forgejo has multiple different version strings that need to be provided
     # via ldflags.  main.ForgejoVersion for example is a combination of a
     # hardcoded gitea compatibility version string (in the Makefile) and
@@ -65,7 +65,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-pgUSmM2CxYO8DralWoeR2groQxpxo9WtRcToYeaHXGk=";
+  vendorHash = "sha256-OuWNF+muWM6xqwkFxLIUsn/huqXj2VKg8BN9+JHVw58=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/video/anilibria-winmaclinux/default.nix b/pkgs/applications/video/anilibria-winmaclinux/default.nix
index 522c37f3a625..818e3a8e1505 100644
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@@ -18,13 +18,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "1.2.16.1";
+  version = "1.2.16.2";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-QQliz/tLeYsWgh/ZAO7FfbApAEqWhWoaQe9030QZxA8=";
+    hash = "sha256-IgNYJSadGemjclh7rtY8dHz7uSfBHoWEyLlRoZ+st6k=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 3c553f181f0d..5ca5bc3f5eb3 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -8,7 +8,8 @@
 { name ? ""
 , lib
 , stdenvNoCC
-, bintools ? null, libc ? null, coreutils ? null, shell ? stdenvNoCC.shell, gnugrep ? null
+, runtimeShell
+, bintools ? null, libc ? null, coreutils ? null, gnugrep ? null
 , netbsd ? null, netbsdCross ? null
 , sharedLibraryLoader ?
   if libc == null then
@@ -28,7 +29,7 @@
 , isGNU ? bintools.isGNU or false
 , isLLVM ? bintools.isLLVM or false
 , isCCTools ? bintools.isCCTools or false
-, buildPackages ? {}
+, expand-response-params
 , targetPackages ? {}
 , useMacosReexportHack ? false
 , wrapGas ? false
@@ -131,10 +132,6 @@ let
     else if hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
     else "";
 
-  expand-response-params =
-    optionalString (buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null")
-    (import ../expand-response-params { inherit (buildPackages) stdenv; });
-
 in
 
 stdenvNoCC.mkDerivation {
@@ -418,8 +415,10 @@ stdenvNoCC.mkDerivation {
 
   env = {
     # for substitution in utils.bash
+    # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
-    shell = getBin shell + shell.shellPath or "";
+    # TODO(@sternenseemann): rename env var via stdenv rebuild
+    shell = (getBin runtimeShell + runtimeShell.shellPath or "");
     gnugrep_bin = optionalString (!nativeTools) gnugrep;
     wrapperName = "BINTOOLS_WRAPPER";
     inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 11ae9868ce01..4adc1dcb1f8d 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -8,14 +8,15 @@
 { name ? ""
 , lib
 , stdenvNoCC
-, cc ? null, libc ? null, bintools, coreutils ? null, shell ? stdenvNoCC.shell
+, runtimeShell
+, cc ? null, libc ? null, bintools, coreutils ? null
 , zlib ? null
 , nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
 , propagateDoc ? cc != null && cc ? man
 , extraTools ? [], extraPackages ? [], extraBuildCommands ? ""
 , nixSupport ? {}
 , isGNU ? false, isClang ? cc.isClang or false, isCcache ? cc.isCcache or false, gnugrep ? null
-, buildPackages ? {}
+, expand-response-params
 , libcxx ? null
 
 # Whether or not to add `-B` and `-L` to `nix-support/cc-{c,ld}flags`
@@ -112,9 +113,6 @@ let
   # unstable implementation detail, however.
   suffixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
 
-  expand-response-params =
-    optionalString ((buildPackages.stdenv.hasCC or false) && buildPackages.stdenv.cc != "/dev/null") (import ../expand-response-params { inherit (buildPackages) stdenv; });
-
   useGccForLibs = useCcForLibs
     && libcxx == null
     && !targetPlatform.isDarwin
@@ -297,6 +295,9 @@ stdenvNoCC.mkDerivation {
         '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
 
+    # Expose expand-response-params we are /actually/ using. In stdenv
+    # bootstrapping, expand-response-params usually comes from an earlier stage,
+    # so it is important to expose this for reference checking.
     inherit expand-response-params;
 
     inherit nixSupport;
@@ -738,8 +739,10 @@ stdenvNoCC.mkDerivation {
     inherit isClang;
 
     # for substitution in utils.bash
+    # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
-    shell = getBin shell + shell.shellPath or "";
+    # TODO(@sternenseemann): rename env var via stdenv rebuild
+    shell = getBin runtimeShell + runtimeShell.shellPath or "";
     gnugrep_bin = optionalString (!nativeTools) gnugrep;
     # stdenv.cc.cc should not be null and we have nothing better for now.
     # if the native impure bootstrap is gotten rid of this can become `inherit cc;` again.
diff --git a/pkgs/build-support/expand-response-params/default.nix b/pkgs/build-support/expand-response-params/default.nix
index 7ce15e98c8d9..6868ab97d896 100644
--- a/pkgs/build-support/expand-response-params/default.nix
+++ b/pkgs/build-support/expand-response-params/default.nix
@@ -1,4 +1,4 @@
-{ stdenv }:
+{ stdenv, lib }:
 
 # A "response file" is a sequence of arguments that is passed via a
 # file, rather than via argv[].
@@ -25,4 +25,18 @@ stdenv.mkDerivation {
     mkdir -p $prefix/bin
     mv expand-response-params $prefix/bin/
   '';
+
+  meta = {
+    description = "Internal tool used by the nixpkgs wrapper scripts for processing response files";
+    longDescription = ''
+      expand-response-params is a tool that allows for obtaining a full list of all
+      arguments passed in a given compiler command line including those passed via
+      so-called response files. The nixpkgs wrapper scripts for bintools and C
+      compilers use it for processing compiler flags. As it is developed in
+      conjunction with the nixpkgs wrapper scripts, it should be considered as
+      unstable and subject to change.
+    '';
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
 }
diff --git a/pkgs/by-name/ap/api-linter/package.nix b/pkgs/by-name/ap/api-linter/package.nix
index 554c470fe3e5..c3501889915d 100644
--- a/pkgs/by-name/ap/api-linter/package.nix
+++ b/pkgs/by-name/ap/api-linter/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "1.65.0";
+  version = "1.65.1";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     rev = "v${version}";
-    hash = "sha256-j5xvFg7C74sVjISZMWgURVHnJM6HBZtr90b0UXbGbdg=";
+    hash = "sha256-YGawN0mAJHfWkre+0tunPM/psd9aBWtSVsJoar0WVwY=";
   };
 
-  vendorHash = "sha256-Bz7+4iVR2X36vt6wx3nIgWmVL+i9ncwdzYP9tBEpplk=";
+  vendorHash = "sha256-CsOnHHq3UjNWjfMy1TjXy20B0Bni6Fr3ZMJGvU7QDFA=";
 
   subPackages = [ "cmd/api-linter" ];
 
diff --git a/pkgs/by-name/co/codeium/package.nix b/pkgs/by-name/co/codeium/package.nix
index 437df8439ed3..2c0dd84cbbcd 100644
--- a/pkgs/by-name/co/codeium/package.nix
+++ b/pkgs/by-name/co/codeium/package.nix
@@ -13,10 +13,10 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-AHjR6lHszYqZ2yC/uY2DmB67xMUFZliqI29Ptes2SoY=";
-    aarch64-linux = "sha256-2NYlec6gpVMJwZctEqwn5rQiTrb5PmaxEz3lQxF1qmk=";
-    x86_64-darwin = "sha256-OeMbO2lDK6XUF3ht+09ZWOL7UsEEVTrKyXOfhny8DhM=";
-    aarch64-darwin = "sha256-4CQvJkd3kI7XJz46QsSUBtWLmxDu7AcAJwRS3amv0SM=";
+    x86_64-linux = "sha256-6sIYDI6+1/p54Af+E/GmRAFlfDYJVwxhn0qF47ZH+Zg=";
+    aarch64-linux = "sha256-1ImcjAqCZm5KZZYHWhG1eO7ipAdrP4Qjj2eBxTst++s=";
+    x86_64-darwin = "sha256-yHthItxZYFejJlwJJ7BrM2csnLsZXjy/IbzF1iaCCyI=";
+    aarch64-darwin = "sha256-GIx0yABISj/rH/yVkkx6NBs5qF0P8nhpMyvnzXJ92mA=";
   }.${system} or throwSystem;
 
   bin = "$out/bin/codeium_language_server";
@@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "codeium";
-  version = "1.8.22";
+  version = "1.8.25";
   src = fetchurl {
     name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
     url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
diff --git a/pkgs/by-name/cy/cyclonedx-cli/deps.nix b/pkgs/by-name/cy/cyclonedx-cli/deps.nix
new file mode 100644
index 000000000000..7e5ef08ed1f9
--- /dev/null
+++ b/pkgs/by-name/cy/cyclonedx-cli/deps.nix
@@ -0,0 +1,195 @@
+# This file was automatically generated by passthru.fetch-deps.
+# Please dont edit it manually, your changes might get overwritten!
+
+{ fetchNuGet }: [
+  (fetchNuGet { pname = "CoderPatros.AntPathMatching"; version = "0.1.1"; sha256 = "1a9xhigw6bc4gl7qg3d8m9y53bk0mn9kmw07w4y27f32gr6m9b2k"; })
+  (fetchNuGet { pname = "coverlet.collector"; version = "3.1.2"; sha256 = "0gsk2q93qw7pqxwd4pdyq5364wz0lvldcqqnf4amz13jaq86idmz"; })
+  (fetchNuGet { pname = "CsvHelper"; version = "29.0.0"; sha256 = "0x5i3x5jqrxi82sgzfbgyrqqd6nsgb35z5p4rhqzb0fhq9qf6hlw"; })
+  (fetchNuGet { pname = "CycloneDX.Core"; version = "6.0.0"; sha256 = "0lvllq1bb4w2l9va2ayjyd0kkbqyglkgjbha3y2hq71qkviqryd2"; })
+  (fetchNuGet { pname = "CycloneDX.Spdx"; version = "6.0.0"; sha256 = "032q2rp2626hirfhr8q6xhi2hs35ma137fswivsd1lkcz69vvl4h"; })
+  (fetchNuGet { pname = "CycloneDX.Spdx.Interop"; version = "6.0.0"; sha256 = "1c660hpq3bl3zaxyn9dkcn64f97nb1ri1bcdnky39ap4z6fp96ll"; })
+  (fetchNuGet { pname = "CycloneDX.Utils"; version = "6.0.0"; sha256 = "1zf57hppl586x2sc9c3j4n9mqyinfsnj2fp66rxdljgcrlsb1vd1"; })
+  (fetchNuGet { pname = "JetBrains.Annotations"; version = "2021.2.0"; sha256 = "0krvmg2h5ibh6mzs9yn7c8cdxgvr5hm7l884i49hlhnc1aiy5m1n"; })
+  (fetchNuGet { pname = "Json.More.Net"; version = "1.7.0"; sha256 = "0fbmrq88wqbfpngs9vfx03xdbg71liz07nyx620za82f294pcdzk"; })
+  (fetchNuGet { pname = "JsonPointer.Net"; version = "2.2.1"; sha256 = "16fhp2v2cqb9yaxy0nzq5ngmx1b089iz1phqfi0nhdjln3b2win6"; })
+  (fetchNuGet { pname = "JsonSchema.Net"; version = "3.3.2"; sha256 = "0sfp8qvdnxnh93q1vs9f9pjybjkh9jifvhaxjgfksf6zbz8dhp4v"; })
+  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.3.2"; sha256 = "1f05l2vm8inlwhk36lfbyszjlcnvdd2qw2832npaah0dldn6dz00"; })
+  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; sha256 = "0zxc0apx1gcx361jlq8smc9pfdgmyjh6hpka8dypc9w23nlsh6yj"; })
+  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.4.1"; sha256 = "0z6d1i6xcf0c00z6rs75rgw4ncs9q2m8amasf6mmbf40fm02ry7g"; })
+  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.3.2"; sha256 = "0pm06nxqi8aw04lciqy7iz8ln1qm5mx06cpwgqa2dfwvnjp7zxnm"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "5.0.0"; sha256 = "0mwpwdflidzgzfx2dlpkvvnkgkr2ayaf0s80737h4wa35gaj11rc"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.3.2"; sha256 = "0bs38r5kdw1xpbjbi5l82xbhfnfbzr5xhg5520lk05pg914d1ln1"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.3.2"; sha256 = "089nmaxzvm5xcf20pm4iiavz2k6lwh69r51xlbqg0ry605mnl869"; })
+  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
+  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "12.0.3"; sha256 = "17dzl305d835mzign8r15vkmav2hq8l6g7942dfjpnzr17wwl89x"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "9.0.1"; sha256 = "0mcy0i7pnfpqm4pcaiyzzji4g0c8i3a5gjz28rrr28110np8304r"; })
+  (fetchNuGet { pname = "NuGet.Frameworks"; version = "5.11.0"; sha256 = "0wv26gq39hfqw9md32amr5771s73f5zn1z9vs4y77cgynxr73s4z"; })
+  (fetchNuGet { pname = "protobuf-net"; version = "3.2.26"; sha256 = "1mcg46xnhgqwjacy6j8kvp3rylpi26wjnmhwv8mh5cwjya9nynqb"; })
+  (fetchNuGet { pname = "protobuf-net.Core"; version = "3.2.26"; sha256 = "1wrr38ygdanf121bkl8b1d4kz1pawm064z69bqf3qbr46h4j575w"; })
+  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
+  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "1wl76vk12zhdh66vmagni66h5xbhgqq7zkdpgw21jhxhvlbcl8pk"; })
+  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "00j6nv2xgmd3bi347k00m7wr542wjlig53rmj28pmw7ddcn97jbn"; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1ghhhk5psqxcg6w88sxkqrc35bxcz27zbqm2y5p5298pv3v7g201"; })
+  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; sha256 = "0l8xz8zn46w4d10bcn3l4yyn4vhb3lrj2zw8llvz7jk14k4zps5x"; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; sha256 = "02c9h3y35pylc0zfq3wcsvc5nqci95nrkq0mszifc0sjx7xrzkly"; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Extensions"; version = "4.3.0"; sha256 = "0zyri97dfc5vyaz9ba65hjj1zbcrzaffhsdlpxc9bh09wy22fq33"; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.3.0"; sha256 = "0x1mm8c6iy8rlxm8w9vqw7gb7s1ljadrn049fmf70cyh42vdfhrf"; })
+  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "03kickal0iiby82wa5flar18kyv82s9s6d4xhk5h4bi5kfcyfjzl"; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.3.0"; sha256 = "1cqh1sv3h5j7ixyb7axxbdkqx6cxy00p4np4j91kpm492rf4s25b"; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; sha256 = "0bh5bi25nk9w9xi8z23ws45q5yia6k7dg3i4axhfqlnj145l011x"; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "0c3g3g3jmhlhw4klrc86ka9fjbl7i59ds1fadsb2l8nqf8z3kb19"; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; sha256 = "0aqqi1v4wx51h51mk956y783wzags13wa7mgqyclacmsmpv02ps3"; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "0lqhgqi0i8194ryqq6v2gqx0fb86db2gqknbm0aq31wb378j7ip8"; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; sha256 = "03mnvkhskbzxddz4hm113zsch1jyzh2cs450dk3rgfjp8crlw1va"; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Timer"; version = "4.3.0"; sha256 = "0aw4phrhwqz9m61r79vyfl5la64bjxj8l34qnrcwb28v49fg2086"; })
+  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
+  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
+  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
+  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
+  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.3.0"; sha256 = "1vvivbqsk6y4hzcid27pqpm5bsi6sc50hvqwbcx8aap5ifrxfs8d"; })
+  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; sha256 = "1n6rgz5132lcibbch1qlf0g9jk60r0kqv087hxc0lisy50zpm7kk"; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "1b61p6gw1m02cc1ry996fl49liiwky6181dzr873g9ds92zl326q"; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
+  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
+  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1klrs545awhayryma6l7g2pvnp9xy4z0r1i40r80zb45q3i9nbyf"; })
+  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "10yc8jdrwgcl44b4g93f1ds76b176bajd3zqi2faf5rvh1vy9smi"; })
+  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0zcxjv5pckplvkg0r6mw3asggm7aqzbdjimhvsasb0cgm59x09l3"; })
+  (fetchNuGet { pname = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0vhynn79ih7hw7cwjazn87rm9z9fj0rvxgzlab36jybgcpcgphsn"; })
+  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "160p68l2c7cqmyqjwxydcvgw7lvl1cr0znkw8fp24d1by9mqc8p3"; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "15zrc8fgd8zx28hdghcj5f5i34wf3l6bq5177075m2bc2j34jrqy"; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1p4dgxax6p7rlgj4q73k73rslcnz4wdcv8q2flg1s8ygwcm58ld5"; })
+  (fetchNuGet { pname = "runtime.unix.Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0y61k9zbxhdi0glg154v30kkq7f8646nif8lnnxbvkjpakggd5id"; })
+  (fetchNuGet { pname = "runtime.unix.System.Console"; version = "4.3.0"; sha256 = "1pfpkvc6x2if8zbdzg9rnc5fx51yllprl8zkm5npni2k50lisy80"; })
+  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "1lps7fbnw34bnh3lm31gs5c0g0dh7548wfmb8zz62v0zqz71msj5"; })
+  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; sha256 = "14nbkhvs7sji5r1saj2x8daz82rnf9kx28d3v2qss34qbr32dzix"; })
+  (fetchNuGet { pname = "runtime.unix.System.Net.Primitives"; version = "4.3.0"; sha256 = "0bdnglg59pzx9394sy4ic66kmxhqp8q8bvmykdxcbs5mm0ipwwm4"; })
+  (fetchNuGet { pname = "runtime.unix.System.Net.Sockets"; version = "4.3.0"; sha256 = "03npdxzy8gfv035bv1b9rz7c7hv0rxl5904wjz51if491mw0xy12"; })
+  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; sha256 = "1jx02q6kiwlvfksq1q9qr17fj78y5v6mwsszav4qcz9z25d5g6vk"; })
+  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
+  (fetchNuGet { pname = "Snapshooter"; version = "0.7.1"; sha256 = "04sn8pm1fgv8nasa6xi1wnm972xq9sq46lhc1p0945x44yvbrja9"; })
+  (fetchNuGet { pname = "Snapshooter.Xunit"; version = "0.7.1"; sha256 = "1z0v66nnaf7jj9b793x334z0da4llw6d4iddv4iy876q7a656rbx"; })
+  (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; sha256 = "1649qvy3dar900z3g817h17nl8jp4ka5vcfmsr05kh0fshn7j3ya"; })
+  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
+  (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; sha256 = "1ga40f5lrwldiyw6vy67d0sg7jd7ww6kgwbksm19wrvq9hr0bsm6"; })
+  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
+  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "7.0.0"; sha256 = "1n9122cy6v3qhsisc9lzwa1m1j62b8pi2678nsmnlyvfpk0zdagm"; })
+  (fetchNuGet { pname = "System.CommandLine"; version = "2.0.0-beta1.21308.1"; sha256 = "09p3pr8sfx2znlwiig0m74qswziih0gn85y9i6bww5xprk4612np"; })
+  (fetchNuGet { pname = "System.Console"; version = "4.3.0"; sha256 = "1flr7a9x920mr5cjsqmsy9wgnv3lvd0h1g521pdr1lkb2qycy7ay"; })
+  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "0gmjghrqmlgzxivd2xl50ncbglb7ljzb66rlx8ws6dv8jm0d5siz"; })
+  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
+  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.3.0"; sha256 = "0z6m3pbiy0qw6rn3n209rrzf9x1k4002zh90vwcrsym09ipm2liq"; })
+  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1"; sha256 = "19cknvg07yhakcvpxg3cxa0bwadplin6kyxd8mpjjpwnp56nl85x"; })
+  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "0in3pic3s2ddyibi8cvgl102zmvp9r9mchh82ns9f0ms4basylw1"; })
+  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
+  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.0.11"; sha256 = "1pla2dx8gkidf7xkciig6nifdsb494axjvzvann8g2lp3dbqasm9"; })
+  (fetchNuGet { pname = "System.Formats.Asn1"; version = "6.0.0"; sha256 = "1vvr7hs4qzjqb37r0w1mxq7xql2b17la63jwvmgv65s1hj00g8r9"; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
+  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq"; })
+  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; sha256 = "02a5zfxavhv3jd437bsncbhd2fp1zv4gxzakp1an9l6kdq1mcqls"; })
+  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
+  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
+  (fetchNuGet { pname = "System.IO.Abstractions"; version = "13.2.47"; sha256 = "0s7f3cx99k6ci9a32q7sfm3s878awqs2k75c989kl7qx7i0g7v54"; })
+  (fetchNuGet { pname = "System.IO.Compression"; version = "4.3.0"; sha256 = "084zc82yi6yllgda0zkgl2ys48sypiswbiwrv7irb3r0ai1fp4vz"; })
+  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.3.0"; sha256 = "1yxy5pq4dnsm9hlkg9ysh5f6bf3fahqqb6p8668ndy5c0lk7w2ar"; })
+  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; sha256 = "0kgfpw6w4djqra3w5crrg8xivbanh1w9dh3qapb28q060wb9flp1"; })
+  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw"; })
+  (fetchNuGet { pname = "System.IO.FileSystem.AccessControl"; version = "5.0.0"; sha256 = "0ixl68plva0fsj3byv76bai7vkin86s6wyzr8vcav3szl862blvk"; })
+  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.0.1"; sha256 = "1s0mniajj3lvbyf7vfb5shp4ink5yibsx945k6lvxa96r8la1612"; })
+  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; sha256 = "0j6ndgglcf4brg2lz4wzsh1av1gh8xrzdsn9f0yznskhqn1xzj9c"; })
+  (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; sha256 = "1ppg83svb39hj4hpp5k7kcryzrf3sfnm08vxd5sm2drrijsla2k5"; })
+  (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
+  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.1.0"; sha256 = "1gpdxl6ip06cnab7n3zlcg6mqp7kknf73s8wjinzi4p0apw82fpg"; })
+  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"; })
+  (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; sha256 = "1i4gc757xqrzflbk7kc5ksn20kwwfjhw9w7pgdkn19y3cgnl302j"; })
+  (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; sha256 = "15r75pwc0rm3vvwsn8rvm2krf929mjfwliv0mpicjnii24470rkq"; })
+  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; sha256 = "0c87k50rmdgmxx7df2khd9qj7q35j9rzdmm2572cc55dygmdk3ii"; })
+  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.3.0"; sha256 = "1ssa65k6chcgi6mfmzrznvqaxk8jp0gvl77xhf1hbzakjnpxspla"; })
+  (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12"; sha256 = "1sybkfi60a4588xn34nd9a58png36i0xr4y4v4kqpg8wlvy5krrj"; })
+  (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; sha256 = "191p63zy5rpqx7dnrb3h7prvgixmk168fhvvkkvhlazncf8r3nc2"; })
+  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; sha256 = "1js89429pfw79mxvbzp8p3q93il6rdff332hddhzi5wqglc4gml9"; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
+  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.0.1"; sha256 = "0ydqcsvh6smi41gyaakglnv252625hf29f7kywy2c70nhii2ylqp"; })
+  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; sha256 = "11f8y3qfysfcrscjpjym9msk7lsfxkk4fmz9qq95kn3jd0769f74"; })
+  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.0.1"; sha256 = "1pcd2ig6bg144y10w7yxgc9d22r7c7ww7qn1frdfwgxr24j9wvv0"; })
+  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; sha256 = "0w1n67glpv8241vnpz1kl14sy7zlnw414aqwj4hcx5nd86f6994q"; })
+  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.0.1"; sha256 = "1s4b043zdbx9k39lfhvsk68msv1nxbidhkq6nbm27q7sf8xcsnxr"; })
+  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; sha256 = "0ql7lcakycrvzgi9kxz1b3lljd990az1x6c4jsiwcacrvimpib5c"; })
+  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.0.1"; sha256 = "0m7wqwq0zqq9gbpiqvgk3sr92cbrw7cp3xn53xvw7zj6rz6fdirn"; })
+  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; sha256 = "02bly8bdc98gs22lqsfx9xicblszr2yan7v2mmw3g7hy6miq5hwq"; })
+  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4"; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; sha256 = "1bangaabhsl4k9fg8khn83wm6yial8ik1sza7401621jc6jrym28"; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.1.0"; sha256 = "1bjli8a7sc7jlxqgcagl9nh8axzfl11f4ld3rjqsyxc516iijij7"; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.3.0"; sha256 = "0y2ssg08d817p0vdag98vn238gyrrynjdj4181hdg780sif3ykp1"; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1"; sha256 = "0b4i7mncaf8cnai85jv3wnw6hps140cxz8vylv2bik6wyzgvz7bi"; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; sha256 = "02hdkgk13rvsd6r9yafbwzss8kr55wnj8d5c7xjnp8gqrwc8sn0m"; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; sha256 = "0rw4rm4vsm3h3szxp9iijc3ksyviwsv6f63dng3vhqyg4vjdkc2z"; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; sha256 = "1g0zrdi5508v49pfm3iii2hn6nm00bgvfpjq1zxknfjrxxa20r4g"; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; sha256 = "01kxqppx3dr3b6b286xafqilv4s2n0gqvfgzfd4z943ga9i81is1"; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; sha256 = "0q18r1sh4vn7bvqgd6dmqlw5v28flbpj349mkdish2vjyvmnb2ii"; })
+  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
+  (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.1.1"; sha256 = "042rfjixknlr6r10vx2pgf56yming8lkjikamg3g4v29ikk78h7k"; })
+  (fetchNuGet { pname = "System.Security.AccessControl"; version = "5.0.0"; sha256 = "17n3lrrl6vahkqmhlpn3w20afgz09n7i6rv0r3qypngwi7wqdr5r"; })
+  (fetchNuGet { pname = "System.Security.AccessControl"; version = "6.0.0"; sha256 = "0a678bzj8yxxiffyzy60z2w1nczzpi8v97igr4ip3byd2q89dv58"; })
+  (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; sha256 = "0jvfn7j22l3mm28qjy3rcw287y9h65ha4m940waaxah07jnbzrhn"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; sha256 = "1x5wcrddf2s3hb8j78cry7yalca4lb5vfnkrysagbn6r9x6xvrx1"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; sha256 = "1jr6w70igqn07k5zs1ph6xja97hxnb3mqbspdrff6cvssgrixs32"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "6.0.1"; sha256 = "0wswhbvm3gh06azg9k1zfvmhicpzlh7v71qzd4x5zwizq4khv7iq"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Xml"; version = "6.0.1"; sha256 = "15d0np1njvy2ywf0qzdqyjk5sjs4zbfxg917jrvlbfwrqpqxb5dj"; })
+  (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
+  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
+  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "5.0.0"; sha256 = "1mpk7xj76lxgz97a5yg93wi8lj0l8p157a5d50mmjy3gbz1904q8"; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; sha256 = "1dyqv0hijg265dwxg6l7aiv74102d6xjiwplh2ar1ly6xfaa4iiw"; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
+  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; sha256 = "08nsfrpiwsg9x5ml4xyl3zyvjfdi4mvbqf93kjdh11j4fwkznizs"; })
+  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
+  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "7.0.0"; sha256 = "1151hbyrcf8kyg1jz8k9awpbic98lwz9x129rg7zk1wrs6vjlpxl"; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "7.0.2"; sha256 = "1i6yinxvbwdk5g5z9y8l4a5hj2gw3h9ijlz2f1c1ngyprnwz2ivf"; })
+  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.1.0"; sha256 = "1mw7vfkkyd04yn2fbhm38msk7dz2xwvib14ygjsb8dq2lcvr18y7"; })
+  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.0"; sha256 = "1bgq51k7fwld0njylfn7qc5fmwrk2137gdq7djqdsw347paa9c2l"; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; sha256 = "19x946h926bzvbsgj28csn46gak2crv2skpwsx80hbgazmkgb1ls"; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; sha256 = "0nr1r41rak82qfa5m0lhk9mp0k93bvfd7bbd9sdzwx9mb36g28p5"; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.0.0"; sha256 = "1cb51z062mvc2i8blpzmpn9d9mm4y307xrwi65di8ri18cz5r1zr"; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; sha256 = "1xxcx2xh8jin360yjwm4x4cf5y3a2bwpn2ygkfkwkicz7zk50s2z"; })
+  (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; sha256 = "027s1f4sbx0y1xqw2irqn6x161lzj8qwvnh2gn78ciiczdv10vf1"; })
+  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; sha256 = "1nx773nsx6z5whv8kaa1wjh037id2f1cxhb69pvgv12hd2b6qs56"; })
+  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11"; sha256 = "0c6ky1jk5ada9m94wcadih98l6k1fvf6vi7vhn1msjixaha419l5"; })
+  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
+  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11"; sha256 = "0n4lvpqzy9kc7qy1a4acwwd7b7pnvygv895az5640idl2y9zbz18"; })
+  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
+  (fetchNuGet { pname = "xunit"; version = "2.4.2"; sha256 = "0barl6x1qwx9srjxnanw9z0jik7lv1fp6cvmgqhk10aiv57dgqxm"; })
+  (fetchNuGet { pname = "xunit.abstractions"; version = "2.0.3"; sha256 = "00wl8qksgkxld76fgir3ycc5rjqv1sqds6x8yx40927q5py74gfh"; })
+  (fetchNuGet { pname = "xunit.analyzers"; version = "1.0.0"; sha256 = "0p4f24c462z49gvbh3k4z5ksa8ffa6p8abdgysqbbladl96im4c5"; })
+  (fetchNuGet { pname = "xunit.assert"; version = "2.4.1"; sha256 = "1imynzh80wxq2rp9sc4gxs4x1nriil88f72ilhj5q0m44qqmqpc6"; })
+  (fetchNuGet { pname = "xunit.assert"; version = "2.4.2"; sha256 = "0ifdry9qq3yaw2lfxdll30ljx1jkyhwwy3ydw6gd97y3kifr3k60"; })
+  (fetchNuGet { pname = "xunit.core"; version = "2.4.1"; sha256 = "1nnb3j4kzmycaw1g76ii4rfqkvg6l8gqh18falwp8g28h802019a"; })
+  (fetchNuGet { pname = "xunit.core"; version = "2.4.2"; sha256 = "1ir029igwm6b571lcm6585v5yxagy66rwrg26v4a1fnjq9dnh4cd"; })
+  (fetchNuGet { pname = "xunit.extensibility.core"; version = "2.4.1"; sha256 = "103qsijmnip2pnbhciqyk2jyhdm6snindg5z2s57kqf5pcx9a050"; })
+  (fetchNuGet { pname = "xunit.extensibility.core"; version = "2.4.2"; sha256 = "1h0a62xddsd82lljfjldn1nqy17imga905jb7j0ddr10wi8cqm62"; })
+  (fetchNuGet { pname = "xunit.extensibility.execution"; version = "2.4.1"; sha256 = "1pbilxh1gp2ywm5idfl0klhl4gb16j86ib4x83p8raql1dv88qia"; })
+  (fetchNuGet { pname = "xunit.extensibility.execution"; version = "2.4.2"; sha256 = "0r9gczqz4bc59cwl6d6wali6pvlw210i97chc1nlwn2qh383m54p"; })
+  (fetchNuGet { pname = "xunit.runner.visualstudio"; version = "2.4.5"; sha256 = "0y8w33ci80z8k580pp24mfnaw1r8ji0w3az543xxcz6aagax9zhs"; })
+]
diff --git a/pkgs/by-name/cy/cyclonedx-cli/package.nix b/pkgs/by-name/cy/cyclonedx-cli/package.nix
new file mode 100644
index 000000000000..81f6554e9d5d
--- /dev/null
+++ b/pkgs/by-name/cy/cyclonedx-cli/package.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildDotnetModule
+, fetchFromGitHub
+}:
+
+buildDotnetModule rec {
+  pname = "cyclonedx-cli";
+  version = "0.25.0";
+
+  src = fetchFromGitHub {
+    owner = "CycloneDX";
+    repo = "cyclonedx-cli";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kAMSdUMr/NhsbMBViFJQlzgUNnxWgi/CLb3CW9OpWFo=";
+  };
+
+  nugetDeps = ./deps.nix;
+
+  preFixup = ''
+    cd $out/bin
+    find . ! -name 'cyclonedx' -type f -exec rm -f {} +
+  '';
+
+  meta = with lib; {
+    description = "CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions";
+    homepage = "https://github.com/CycloneDX/cyclonedx-cli";
+    changelog = "https://github.com/CycloneDX/cyclonedx-cli/releases/tag/v${version}";
+    maintainers = with maintainers; [ thillux ];
+    license = licenses.asl20;
+    platforms = with platforms; (linux ++ darwin);
+    mainProgram = "cyclonedx";
+  };
+}
diff --git a/pkgs/data/fonts/fira-mono/default.nix b/pkgs/by-name/fi/fira-mono/package.nix
similarity index 100%
rename from pkgs/data/fonts/fira-mono/default.nix
rename to pkgs/by-name/fi/fira-mono/package.nix
diff --git a/pkgs/data/fonts/fira/default.nix b/pkgs/by-name/fi/fira-sans/package.nix
similarity index 69%
rename from pkgs/data/fonts/fira/default.nix
rename to pkgs/by-name/fi/fira-sans/package.nix
index 4b79d14dd94e..c07cc15c97cc 100644
--- a/pkgs/data/fonts/fira/default.nix
+++ b/pkgs/by-name/fi/fira-sans/package.nix
@@ -1,20 +1,16 @@
-{ lib, stdenvNoCC, fetchFromGitHub }:
+{ lib
+, stdenvNoCC
+, fira-mono
+}:
 
-stdenvNoCC.mkDerivation rec {
-  pname = "fira";
-  version = "4.202";
-
-  src = fetchFromGitHub {
-    owner = "mozilla";
-    repo = "Fira";
-    rev = version;
-    hash = "sha256-HLReqgL0PXF5vOpwLN0GiRwnzkjGkEVEyOEV2Z4R0oQ=";
-  };
+stdenvNoCC.mkDerivation {
+  pname = "fira-sans";
+  inherit (fira-mono) version src;
 
   installPhase = ''
     runHook preInstall
 
-    install --mode=-x -Dt $out/share/fonts/opentype otf/*.otf
+    install --mode=-x -Dt $out/share/fonts/opentype otf/FiraSans*.otf
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/fi/fira/package.nix b/pkgs/by-name/fi/fira/package.nix
new file mode 100644
index 000000000000..405189ba2e99
--- /dev/null
+++ b/pkgs/by-name/fi/fira/package.nix
@@ -0,0 +1,23 @@
+{ lib
+, symlinkJoin
+, fira-mono
+, fira-sans
+}:
+
+symlinkJoin rec {
+  pname = "fira";
+  inherit (fira-mono) version;
+  name = "${pname}-${version}";
+
+  paths = [
+    fira-mono
+    fira-sans
+  ];
+
+  meta = {
+    description = "Fira font family including Fira Sans and Fira Mono";
+    homepage = "https://mozilla.github.io/Fira/";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/gt/gtfocli/package.nix b/pkgs/by-name/gt/gtfocli/package.nix
new file mode 100644
index 000000000000..3ce328daa024
--- /dev/null
+++ b/pkgs/by-name/gt/gtfocli/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "gtfocli";
+  version = "0.0.4";
+
+  src = fetchFromGitHub {
+    owner = "cmd-tools";
+    repo = "gtfocli";
+    rev = "refs/tags/${version}";
+    hash = "sha256-fSk/OyeUffYZOkHXM1m/a9traDxdllYBieMEfsv910Q=";
+  };
+
+  vendorHash = "sha256-yhN2Ve4mBw1HoC3zXYz+M8+2CimLGduG9lGTXi+rPNw=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = with lib; {
+    description = "GTFO Command Line Interface for search binaries commands to bypass local security restrictions";
+    homepage = "https://github.com/cmd-tools/gtfocli";
+    changelog = "https://github.com/cmd-tools/gtfocli/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "gtfocli";
+  };
+}
diff --git a/pkgs/by-name/hy/hypridle/package.nix b/pkgs/by-name/hy/hypridle/package.nix
index 0526d741dd9d..32f0982100c1 100644
--- a/pkgs/by-name/hy/hypridle/package.nix
+++ b/pkgs/by-name/hy/hypridle/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hypridle";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hypridle";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YayFU0PZkwnKn1RSV3+i2HlSha/IFkG5osXcT0b/EUw=";
+    hash = "sha256-7Ft5WZTMIjXOGgRCf31DZBwK6RK8xkeKlD5vFXz3gII=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ig/igir/package.nix b/pkgs/by-name/ig/igir/package.nix
index 488febb21a59..820d843dc0ed 100644
--- a/pkgs/by-name/ig/igir/package.nix
+++ b/pkgs/by-name/ig/igir/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "igir";
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchFromGitHub {
     owner = "emmercm";
     repo = "igir";
     rev = "v${version}";
-    hash = "sha256-bJPUGB9fyeOb5W9EzQldh4rRJQBat58MgjjfS1qh66w=";
+    hash = "sha256-0WA+7qw5ZuELHc8P0yizV+kEwSmoUBmgReM8ZosGnqs=";
   };
 
-  npmDepsHash = "sha256-q8gpx5zwiO/7ZBB/YruhCUgukp71sfJju8nmF6SwTrc=";
+  npmDepsHash = "sha256-UfTq7/da1V9ubHh2wGvktP/SiWfyL8yF9iuCOq8Hxwg=";
 
   # I have no clue why I have to do this
   postPatch = ''
diff --git a/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix b/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix
new file mode 100644
index 000000000000..34ec710a9b45
--- /dev/null
+++ b/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitea,
+  makeDesktopItem,
+  copyDesktopItems,
+  makeWrapper,
+  renpy,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "katawa-shoujo-re-engineered";
+  version = "1.4.4";
+
+  src = fetchFromGitea {
+    # GitHub mirror at fleetingheart/ksre
+    domain = "codeberg.org";
+    owner = "fhs";
+    repo = "katawa-shoujo-re-engineered";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-RYJM/wGVWqIRZzHLUtUZ5mKUrUftDVaOwS1f/EpW6Tk=";
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "katawa-shoujo-re-engineered";
+      desktopName = "Katawa Shoujo: Re-Engineered";
+      type = "Application";
+      icon = finalAttrs.meta.mainProgram;
+      categories = [ "Game" ];
+      exec = finalAttrs.meta.mainProgram;
+    })
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    makeWrapper ${lib.getExe' renpy "renpy"} $out/bin/${finalAttrs.meta.mainProgram} \
+      --add-flags ${finalAttrs.src} --add-flags run
+    install -D $src/web-icon.png $out/share/icons/hicolor/512x512/apps/${finalAttrs.meta.mainProgram}.png
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A fan-made modernization of the classic visual novel Katawa Shoujo";
+    homepage = "https://www.fhs.sh/projects";
+    license = with lib.licenses; [
+      # code
+      mpl20
+      # assets from the original game
+      cc-by-nc-nd-30
+    ];
+    mainProgram = "katawa-shoujo-re-engineered";
+    maintainers = with lib.maintainers; [ quantenzitrone ];
+    platforms = renpy.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/li/livekit/package.nix b/pkgs/by-name/li/livekit/package.nix
index 40706a679c2d..b362366e51f6 100644
--- a/pkgs/by-name/li/livekit/package.nix
+++ b/pkgs/by-name/li/livekit/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "livekit";
-  version = "1.5.3";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "livekit";
     rev = "v${version}";
-    hash = "sha256-2MooX+wy7KetxEBgQoVoL4GuVkm+SbTzYgfWyLL7KU8=";
+    hash = "sha256-tgoVHRv8hnDkjFYShZ/3lieknhIobHv27RVvQOCtEWU=";
   };
 
-  vendorHash = "sha256-8YR0Bl+sQsqpFtD+1GeYaydBdHeM0rRL2NbgAh9kCj0=";
+  vendorHash = "sha256-TZ435gu5naFi/JLz6B/1fpvGA3diJp4JIWL1zgNlb4Q=";
 
   subPackages = [ "cmd/server" ];
 
diff --git a/pkgs/by-name/ma/mautrix-meta/package.nix b/pkgs/by-name/ma/mautrix-meta/package.nix
index 198890a4b35a..7de21ab0233c 100644
--- a/pkgs/by-name/ma/mautrix-meta/package.nix
+++ b/pkgs/by-name/ma/mautrix-meta/package.nix
@@ -1,8 +1,14 @@
-{ lib, buildGoModule, fetchFromGitHub, olm, config }:
+{ buildGoModule
+, config
+, fetchFromGitHub
+, lib
+, nixosTests
+, olm
+}:
 
 buildGoModule rec {
   pname = "mautrix-meta";
-  version = "0.2.0";
+  version = "0.3.0";
 
   subPackages = [ "." ];
 
@@ -10,14 +16,21 @@ buildGoModule rec {
     owner = "mautrix";
     repo = "meta";
     rev = "v${version}";
-    hash = "sha256-n0FpEHgnMdg6W5wahIT5HaF9AP/QYlLuUWJS+VrElgg=";
+    hash = "sha256-QyVcy9rqj1n1Nn/+gBufd57LyEaXPyu0KQhAUTgNmBA=";
   };
 
   buildInputs = [ olm ];
 
-  vendorHash = "sha256-GkgIang3/1u0ybznHgK1l84bEiCj6u4qf8G+HgLGr90=";
+  vendorHash = "sha256-oQSjP1WY0LuxrMtIrvyKhize91wXJxTzWeH0Y3MsEL4=";
 
-  doCheck = false;
+  passthru = {
+    tests = {
+      inherit (nixosTests)
+        mautrix-meta-postgres
+        mautrix-meta-sqlite
+        ;
+    };
+  };
 
   meta = {
     homepage = "https://github.com/mautrix/meta";
diff --git a/pkgs/by-name/mc/mcap-cli/package.nix b/pkgs/by-name/mc/mcap-cli/package.nix
index 80ddcd574b02..8f4fd9d7406c 100644
--- a/pkgs/by-name/mc/mcap-cli/package.nix
+++ b/pkgs/by-name/mc/mcap-cli/package.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitHub, nix-update-script
 }:
 let
-  version = "0.0.42";
+  version = "0.0.43";
 in
 buildGoModule {
 
@@ -13,10 +13,10 @@ buildGoModule {
     repo = "mcap";
     owner = "foxglove";
     rev = "releases/mcap-cli/v${version}";
-    hash = "sha256-9fjzMUMWn5j8AJJq+tK+Hq0o8d3HpacitJZ5CfLiaLw=";
+    hash = "sha256-AWmPqymnNZxKbhxiQOO9djQXbP56mNh9Ucmty2jd+4Q=";
   };
 
-  vendorHash = "sha256-Gl0zLBTWscKGtVOS6rPRL/r8KHYHpZwoUDbEyCL4Ijk=";
+  vendorHash = "sha256-YFbfrqu2H7yU6vANH56MnxipDxaJLT76qZkvqLCFTTg=";
 
   modRoot = "go/cli/mcap";
 
diff --git a/pkgs/by-name/ne/nezha-agent/package.nix b/pkgs/by-name/ne/nezha-agent/package.nix
index c10feadd32a5..228810059921 100644
--- a/pkgs/by-name/ne/nezha-agent/package.nix
+++ b/pkgs/by-name/ne/nezha-agent/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "nezha-agent";
-  version = "0.16.4";
+  version = "0.16.5";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-xXv2FVPsl8BR51VMrFreaS3UQLEJwfObY4OeMMb8pms=";
+    hash = "sha256-WRHYI3/6qrVZRa4ANA6VBBJCaINP1N8Xjy0GWO4LqgA=";
   };
 
-  vendorHash = "sha256-ZlheRFgl3vsUXVx8PKZQ59kme2NC31OQAL6EaNhbf70=";
+  vendorHash = "sha256-AtcRfvYBgTZJz9dpsMgacnV8RNi2Ph7QgUrcE6zzTo8=";
 
   ldflags = [
     "-s"
@@ -40,6 +40,6 @@ buildGoModule rec {
     description = "Agent of Nezha Monitoring";
     homepage = "https://github.com/nezhahq/agent";
     license = licenses.asl20;
-    maintainers = with maintainers; [moraxyc];
+    maintainers = with maintainers; [ moraxyc ];
   };
 }
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 8d78e22a0c42..2d1c40e09cdf 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.1.6";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     rev = "v${version}";
-    hash = "sha256-NOPzznopH+PeSEMzO1vMHOSbmy9/v2yT4VC4kAsdbGw";
+    hash = "sha256-AAgkxBbGH45n140jm28+J3hqYxzUIL6IVLGWD9oBexo=";
   };
 
   vendorHash = "sha256-fP6yxfIQoVaBC9hYcrCyo3YP3ntEVDbDTwKMO9TdyDI=";
diff --git a/pkgs/by-name/no/nomore403/package.nix b/pkgs/by-name/no/nomore403/package.nix
new file mode 100644
index 000000000000..074db314f10a
--- /dev/null
+++ b/pkgs/by-name/no/nomore403/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "nomore403";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "devploit";
+    repo = "nomore403";
+    rev = "refs/tags/${version}";
+    hash = "sha256-qA1i8l2oBQQ5IF8ho3K2k+TAndUTFGwb2NfhyFqfKzU=";
+  };
+
+  vendorHash = "sha256-IGnTbuaQH8A6aKyahHMd2RyFRh4WxZ3Vx/A9V3uelRg=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.Version=${version}"
+    "-X=main.BuildDate=1970-01-01T00:00:00Z"
+  ];
+
+  meta = with lib; {
+    description = "Tool to bypass 403/40X response codes";
+    homepage = "https://github.com/devploit/nomore403";
+    changelog = "https://github.com/devploit/nomore403/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "nomore403";
+  };
+}
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index efd92a5da7e5..3537d60cbbfe 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton9-2";
+  version = "GE-Proton9-4";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-NqBzKonCYH+hNpVZzDhrVf+r2i6EwLG/IFBXjE2mC7s=";
+    hash = "sha256-OR4SUqm5Xsycv/KVBW2Ug/lz4Xr6IQBp8gXacorRe3U=";
   };
 
   outputs = [ "out" "steamcompattool" ];
diff --git a/pkgs/by-name/py/pyright/package-lock.json b/pkgs/by-name/py/pyright/package-lock.json
new file mode 100644
index 000000000000..dee0ab51a521
--- /dev/null
+++ b/pkgs/by-name/py/pyright/package-lock.json
@@ -0,0 +1,193 @@
+{
+  "name": "pyright-root",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pyright-root",
+      "hasInstallScript": true,
+      "dependencies": {
+        "glob": "^7.2.3",
+        "jsonc-parser": "^3.2.1"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "node_modules/jsonc-parser": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.1.tgz",
+      "integrity": "sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA=="
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  },
+  "dependencies": {
+    "balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "requires": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+    },
+    "fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+    },
+    "glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "requires": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      }
+    },
+    "inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "requires": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "jsonc-parser": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.1.tgz",
+      "integrity": "sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA=="
+    },
+    "minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "requires": {
+        "brace-expansion": "^1.1.7"
+      }
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg=="
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  }
+}
diff --git a/pkgs/by-name/py/pyright/package.nix b/pkgs/by-name/py/pyright/package.nix
new file mode 100644
index 000000000000..3e264bc20e81
--- /dev/null
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -0,0 +1,75 @@
+{ lib, buildNpmPackage, fetchFromGitHub, runCommand, jq }:
+
+let
+  version = "1.1.359";
+
+  src = fetchFromGitHub {
+    owner = "Microsoft";
+    repo = "pyright";
+    rev = "${version}";
+    hash = "sha256-gqMAfmYjYO6D9sRu+uJv4yJ/+csioFAwsUPBDF29VDs=";
+  };
+
+  patchedPackageJSON = runCommand "package.json" { } ''
+    ${jq}/bin/jq '
+      .devDependencies |= with_entries(select(.key == "glob" or .key == "jsonc-parser"))
+      | .scripts =  {  }
+      ' ${src}/package.json > $out
+  '';
+
+  pyright-root = buildNpmPackage {
+    pname = "pyright-root";
+    inherit version src;
+    npmDepsHash = "sha256-63kUhKrxtJhwGCRBnxBfOFXs2ARCNn+OOGu6+fSJey4=";
+    dontNpmBuild = true;
+    postPatch = ''
+      cp ${patchedPackageJSON} ./package.json
+      cp ${./package-lock.json} ./package-lock.json
+    '';
+    installPhase = ''
+      runHook preInstall
+      cp -r . "$out"
+      runHook postInstall
+    '';
+  };
+
+  pyright-internal = buildNpmPackage {
+    pname = "pyright-internal";
+    inherit version src;
+    sourceRoot = "${src.name}/packages/pyright-internal";
+    npmDepsHash = "sha256-p2KamNFJ3sJHmJm0MEPhI8L/8zAVzfc9NYy24rAdFcQ=";
+    dontNpmBuild = true;
+    installPhase = ''
+      runHook preInstall
+      cp -r . "$out"
+      runHook postInstall
+    '';
+  };
+in
+buildNpmPackage rec {
+  pname = "pyright";
+  inherit version src;
+
+  sourceRoot = "${src.name}/packages/pyright";
+  npmDepsHash = "sha256-U7WdMIYg9U4fJ8YtDruMzloRS2BQAa2QWExle9uwPbU=";
+
+  postPatch = ''
+    chmod +w ../../
+    ln -s ${pyright-root}/node_modules ../../node_modules
+    chmod +w ../pyright-internal
+    ln -s ${pyright-internal}/node_modules ../pyright-internal/node_modules
+  '';
+
+  dontNpmBuild = true;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    changelog = "https://github.com/Microsoft/pyright/releases/tag/${version}";
+    description = "Type checker for the Python language";
+    homepage = "https://github.com/Microsoft/pyright";
+    license = lib.licenses.mit;
+    mainProgram = "pyright";
+    maintainers = with lib.maintainers; [ kalekseev ];
+  };
+}
diff --git a/pkgs/by-name/py/pyright/update.sh b/pkgs/by-name/py/pyright/update.sh
new file mode 100755
index 000000000000..b0a2b2a11184
--- /dev/null
+++ b/pkgs/by-name/py/pyright/update.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused common-updater-scripts jq prefetch-npm-deps
+set -euo pipefail
+
+version=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s https://api.github.com/repos/microsoft/pyright/releases/latest | jq -r '.tag_name | sub("^v"; "")')
+
+update-source-version pyright "$version"
+
+root="$(dirname "$(readlink -f "$0")")"
+FILE_PATH="$root/package.nix"
+REPO_URL_PREFIX="https://github.com/microsoft/pyright/raw"
+TEMP_DIR=$(mktemp -d)
+
+trap 'rm -rf "$TEMP_DIR"' EXIT
+
+# Function to download `package-lock.json` for a given source path and update hash
+update_hash() {
+    local source_root_path="$1"
+    local existing_hash="$2"
+
+    # Formulate download URL
+    local download_url="${REPO_URL_PREFIX}/${version}${source_root_path}/package-lock.json"
+
+    # Download package-lock.json to temporary directory
+    curl -fsSL -o "${TEMP_DIR}/package-lock.json" "$download_url"
+
+    # Calculate the new hash
+    local new_hash
+    new_hash=$(prefetch-npm-deps "${TEMP_DIR}/package-lock.json")
+
+    # Update npmDepsHash in the original file
+    sed -i "s|$existing_hash|${new_hash}|" "$FILE_PATH"
+}
+
+while IFS= read -r source_root_line; do
+    [[ "$source_root_line" =~ sourceRoot ]] || continue
+    source_root_path=$(echo "$source_root_line" | sed -e 's/^.*"${src.name}\(.*\)";.*$/\1/')
+
+    # Extract the current npmDepsHash for this sourceRoot
+    existing_hash=$(grep -A1 "$source_root_line" "$FILE_PATH" | grep 'npmDepsHash' | sed -e 's/^.*npmDepsHash = "\(.*\)";$/\1/')
+
+    # Call the function to download and update the hash
+    update_hash "$source_root_path" "$existing_hash"
+done < "$FILE_PATH"
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index 8128b434ddb0..5e6faa4316ba 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.9.3";
+  version = "3.9.4";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-VTgBwpE5b/OgM7kkzZijmj9H4d8jy0HNMGl5tfmBe4E=";
+    hash = "sha256-ez4D+czYDhs/GNrjRF8Bx999JRW0EigMxc39fOH54V8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ri/rippkgs/package.nix b/pkgs/by-name/ri/rippkgs/package.nix
new file mode 100644
index 000000000000..ef985a970d7f
--- /dev/null
+++ b/pkgs/by-name/ri/rippkgs/package.nix
@@ -0,0 +1,36 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, sqlite
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rippkgs";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "replit";
+    repo = "rippkgs";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qQZnD9meczfsQv1R68IiUfPq730I2IyesurrOhtA3es=";
+  };
+
+  cargoHash = "sha256-hGSHgJ2HVCNqTBsTQIZlSE89FKqdMifuJyAGl3utF2I=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    sqlite
+  ];
+
+  meta = {
+    description = "A CLI for indexing and searching packages in Nix expressions";
+    homepage = "https://github.com/replit/rippkgs";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ eclairevoyant ];
+    mainProgram = "rippkgs";
+  };
+}
diff --git a/pkgs/by-name/rm/rmenu/Cargo.lock b/pkgs/by-name/rm/rmenu/Cargo.lock
index adcadaa48a1a..33210d3b2f2d 100644
--- a/pkgs/by-name/rm/rmenu/Cargo.lock
+++ b/pkgs/by-name/rm/rmenu/Cargo.lock
@@ -110,7 +110,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f28243a43d821d11341ab73c80bed182dc015c514b951616cf79bd4af39af0c3"
 dependencies = [
  "concurrent-queue",
- "event-listener 5.2.0",
+ "event-listener 5.3.0",
  "event-listener-strategy 0.5.1",
  "futures-core",
  "pin-project-lite",
@@ -118,9 +118,9 @@ dependencies = [
 
 [[package]]
 name = "async-executor"
-version = "1.9.1"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10b3e585719c2358d2660232671ca8ca4ddb4be4ce8a1842d6c2dc8685303316"
+checksum = "5f98c37cf288e302c16ef6c8472aad1e034c6c84ce5ea7b8101c98eb4a802fee"
 dependencies = [
  "async-lock 3.3.0",
  "async-task",
@@ -244,7 +244,7 @@ checksum = "a507401cad91ec6a857ed5513a2073c82a9b9048762b885bb98655b306964681"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -373,9 +373,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.15.4"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "bytemuck"
@@ -489,9 +489,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.90"
+version = "1.0.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cd6604a82acf3039f1144f54b8eb34e91ffba622051189e71b781822d5ee1f5"
+checksum = "2678b2e3449475e95b0aa6f9b506a28e61b3dc8996592b983695e8ebb58a8b41"
 
 [[package]]
 name = "cesu8"
@@ -545,7 +545,7 @@ dependencies = [
  "anstream",
  "anstyle",
  "clap_lex",
- "strsim 0.11.0",
+ "strsim 0.11.1",
 ]
 
 [[package]]
@@ -557,7 +557,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -642,7 +642,7 @@ version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
 dependencies = [
- "getrandom 0.2.12",
+ "getrandom 0.2.14",
  "once_cell",
  "tiny-keccak",
 ]
@@ -772,7 +772,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
 dependencies = [
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -843,7 +843,7 @@ dependencies = [
  "ident_case",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -876,7 +876,7 @@ checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
 dependencies = [
  "darling_core 0.20.8",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -968,7 +968,7 @@ dependencies = [
  "prettyplease",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -1079,7 +1079,7 @@ dependencies = [
  "dioxus-core",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -1183,7 +1183,7 @@ dependencies = [
  "darling 0.20.8",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -1244,9 +1244,9 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "5.2.0"
+version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b5fb89194fa3cad959b833185b3063ba881dbfc7030680b314250779fb4cc91"
+checksum = "6d9944b8ca13534cdfb2800775f8dd4902ff3fc75a50101466decadfdf322a24"
 dependencies = [
  "concurrent-queue",
  "parking",
@@ -1269,7 +1269,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "332f51cb23d20b0de8458b86580878211da09bcd4503cb579c225b3d124cabb3"
 dependencies = [
- "event-listener 5.2.0",
+ "event-listener 5.3.0",
  "pin-project-lite",
 ]
 
@@ -1378,9 +1378,9 @@ dependencies = [
 
 [[package]]
 name = "freedesktop-desktop-entry"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "287f89b1a3d88dd04d2b65dfec39f3c381efbcded7b736456039c4ee49d54b17"
+checksum = "c201444ddafb5506fe85265b48421664ff4617e3b7090ef99e42a0070c1aead0"
 dependencies = [
  "dirs 3.0.2",
  "gettext-rs",
@@ -1495,7 +1495,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -1645,9 +1645,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.12"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1822,7 +1822,7 @@ dependencies = [
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -2872,7 +2872,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d3928fb5db768cb86f891ff014f0144589297e3c6a1aba6ed7cecfdace270c7"
 dependencies = [
  "proc-macro2",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3002,7 +3002,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.12",
+ "getrandom 0.2.14",
 ]
 
 [[package]]
@@ -3050,7 +3050,7 @@ version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd283d9651eeda4b2a83a43c1c91b266c40fd76ecd39a50a8c630ae69dc72891"
 dependencies = [
- "getrandom 0.2.12",
+ "getrandom 0.2.14",
  "libredox",
  "thiserror",
 ]
@@ -3137,7 +3137,7 @@ dependencies = [
 
 [[package]]
 name = "rmenu"
-version = "1.2.0"
+version = "1.2.1"
 dependencies = [
  "cached 0.44.0",
  "clap",
@@ -3168,7 +3168,7 @@ dependencies = [
 
 [[package]]
 name = "rmenu-plugin"
-version = "0.0.1"
+version = "0.0.2"
 dependencies = [
  "bincode",
  "clap",
@@ -3358,7 +3358,7 @@ checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3374,13 +3374,13 @@ dependencies = [
 
 [[package]]
 name = "serde_repr"
-version = "0.1.18"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b2e6b945e9d3df726b65d6ee24060aff8e3533d431f677a9695db04eff9dfdb"
+checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3594,9 +3594,9 @@ checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
 name = "strsim"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee073c9e4cd00e28217186dbe12796d692868f432bf2e97ee73bed0c56dfa01"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "strum"
@@ -3639,9 +3639,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.57"
+version = "2.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11a6ae1e52eb25aab8f3fb9fca13be982a373b8f1157ca14b897a825ba4a2d35"
+checksum = "44cfb93f38070beee36b3fef7d4f5a16f27751d94b187b666a5cc5e9b0d30687"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3789,7 +3789,7 @@ checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3870,7 +3870,7 @@ checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -3946,7 +3946,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
 ]
 
 [[package]]
@@ -4135,7 +4135,7 @@ version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a183cf7feeba97b4dd1c0d46788634f6221d87fa961b305bed08c851829efcc0"
 dependencies = [
- "getrandom 0.2.12",
+ "getrandom 0.2.14",
 ]
 
 [[package]]
@@ -4211,7 +4211,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
  "wasm-bindgen-shared",
 ]
 
@@ -4245,7 +4245,7 @@ checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.57",
+ "syn 2.0.58",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -4268,9 +4268,9 @@ dependencies = [
 
 [[package]]
 name = "webbrowser"
-version = "0.8.13"
+version = "0.8.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1b04c569c83a9bb971dd47ec6fd48753315f4bf989b9b04a2e7ca4d7f0dc950"
+checksum = "dd595fb70f33583ac61644820ebc144a26c96028b625b96cafcd861f4743fbc8"
 dependencies = [
  "core-foundation",
  "home",
@@ -4416,7 +4416,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "window"
-version = "0.0.0"
+version = "0.0.1"
 dependencies = [
  "anyhow",
  "clap",
diff --git a/pkgs/by-name/rm/rmenu/package.nix b/pkgs/by-name/rm/rmenu/package.nix
index 70a31e82e57b..15de597438fa 100644
--- a/pkgs/by-name/rm/rmenu/package.nix
+++ b/pkgs/by-name/rm/rmenu/package.nix
@@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "rmenu";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "imgurbot12";
     repo = "rmenu";
-    hash = "sha256-mzY+M7GGJDxb8s7pusRDo/xfKE/S4uxPy4klRBjVGOA=";
+    hash = "sha256-JHJZfDxrDi0rJSloPdOVdvo/XkrFhvshd7yZWn/zELU=";
   };
 
   nativeBuildInputs = [
@@ -65,14 +65,17 @@ rustPlatform.buildRustPackage rec {
     # fix config and theme
     mkdir -p $out/share/rmenu
     cp -vf $src/rmenu/public/config.yaml $out/share/rmenu/config.yaml
-    sed -i "s@~\/\.config\/rmenu\/themes@$out\/themes@g" $out/share/rmenu/config.yaml
-    sed -i "s@~\/\.config\/rmenu@$out\/plugins@g" $out/share/rmenu/config.yaml
+    substituteInPlace $out/share/rmenu/config.yaml --replace "~/.config/rmenu" "$out"
     ln -sf  $out/themes/dark.css $out/share/rmenu/style.css
   '';
 
   preFixup = ''
+    # rmenu expects the config to be in XDG_CONFIG_DIRS
+    # shell script plugins called from rmenu binary expect the rmenu-build binary to be on the PATH,
+    # which needs wrapping in temporary environments like shells and flakes
     gappsWrapperArgs+=(
       --suffix XDG_CONFIG_DIRS : "$out/share"
+      --suffix PATH : "$out/bin"
     )
   '';
 
diff --git a/pkgs/by-name/sb/sbom-utility/package.nix b/pkgs/by-name/sb/sbom-utility/package.nix
new file mode 100644
index 000000000000..213dc94cff57
--- /dev/null
+++ b/pkgs/by-name/sb/sbom-utility/package.nix
@@ -0,0 +1,32 @@
+{
+  lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "sbom-utility";
+  version = "0.15.0";
+
+  src = fetchFromGitHub {
+    owner = "CycloneDX";
+    repo = "sbom-utility";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tNLMrtJj1eeJ4sVhDRR24/KVI1HzZSRquiImuDTNZFI=";
+  };
+
+  vendorHash = "sha256-EdzI5ypwZRksQVmcfGDUgEMa4CeAPcm237ZaKqmWQDY=";
+
+  preCheck = ''
+    cd test
+  '';
+
+  meta = with lib; {
+    description = "Utility that provides an API platform for validating, querying and managing BOM data";
+    homepage = "https://github.com/CycloneDX/sbom-utility";
+    changelog = "https://github.com/CycloneDX/sbom-utility/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ thillux ];
+    mainProgram = "sbom-utility";
+  };
+}
diff --git a/pkgs/by-name/sn/snapcraft/lxd-socket-path.patch b/pkgs/by-name/sn/snapcraft/lxd-socket-path.patch
new file mode 100644
index 000000000000..4219fcbfa7d4
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/lxd-socket-path.patch
@@ -0,0 +1,13 @@
+diff --git a/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py b/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
+index 5fa4f898..41264ebb 100644
+--- a/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
++++ b/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
+@@ -142,7 +142,7 @@ class LXD(Provider):
+             build_provider_flags=build_provider_flags,
+         )
+         # This endpoint is hardcoded everywhere lxc/lxd-pkg-snap#33
+-        lxd_socket_path = "/var/snap/lxd/common/lxd/unix.socket"
++        lxd_socket_path = "/var/lib/lxd/unix.socket"
+         endpoint = "http+unix://{}".format(urllib.parse.quote(lxd_socket_path, safe=""))
+         try:
+             self._lxd_client: pylxd.Client = pylxd.Client(endpoint=endpoint)
diff --git a/pkgs/by-name/sn/snapcraft/os-platform.patch b/pkgs/by-name/sn/snapcraft/os-platform.patch
new file mode 100644
index 000000000000..0b441ec8d4bc
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/os-platform.patch
@@ -0,0 +1,21 @@
+diff --git a/snapcraft/utils.py b/snapcraft/utils.py
+index 511effe2..4af5a029 100644
+--- a/snapcraft/utils.py
++++ b/snapcraft/utils.py
+@@ -15,6 +15,7 @@
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
+ """Utilities for snapcraft."""
++
+ import multiprocessing
+ import os
+ import pathlib
+@@ -91,7 +92,7 @@ def get_os_platform(
+     release = platform.release()
+     machine = platform.machine()
+ 
+-    if system == "Linux":
++    if system == "Linux" and "NixOS" not in platform.version():
+         try:
+             with filepath.open("rt", encoding="utf-8") as release_file:
+                 lines = release_file.readlines()
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
new file mode 100644
index 000000000000..57e16a1a138c
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -0,0 +1,188 @@
+{
+  fetchFromGitHub,
+  git,
+  glibc,
+  lib,
+  makeWrapper,
+  nix-update-script,
+  python3Packages,
+  squashfsTools,
+  stdenv,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "snapcraft";
+  version = "8.2.0";
+
+  pyproject = true;
+
+  # Somewhere deep in the dependency tree is 'versioningit', which depends
+  # on pydantic 2. Snapcraft will soon migrate to pydantic 2, and disabling
+  # this doesn't seem to affect the functionality of the application.
+  catchConflicts = false;
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "snapcraft";
+    rev = "refs/tags/${version}";
+    hash = "sha256-uRapRL+492FOju83o3OBsYK52hwOOG6b4EbdMVpAlBs=";
+  };
+
+  patches = [
+    # Snapcraft is only officially distributed as a snap, as is LXD. The socket
+    # path for LXD must be adjusted so that it's at the correct location for LXD
+    # on NixOS. This patch will likely never be accepted upstream.
+    ./lxd-socket-path.patch
+    # In certain places, Snapcraft expects an /etc/os-release file to determine
+    # host info which doesn't exist in our test environment. This is a
+    # relatively naive patch which helps the test suite pass - without it *many*
+    # of the tests fail. This patch will likely never be accepted upstream.
+    ./os-platform.patch
+    # Snapcraft will try to inject itself as a snap *from the host system* into
+    # the build system. This patch short-circuits that logic and ensures that
+    # Snapcraft is installed on the build system from the snap store - because
+    # there is no snapd on NixOS hosts that can be used for the injection. This
+    # patch will likely never be accepted upstream.
+    ./set-channel-for-nix.patch
+    # Certain paths (for extensions, schemas) are packaged in the snap by the
+    # upstream, so the paths are well-known, except here where Snapcraft is
+    # *not* in a snap, so this patch changes those paths to point to the correct
+    # place in the Nix store. This patch will likely never be accepted upstream.
+    ./snapcraft-data-dirs.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail 'version=determine_version()' 'version="${version}"' \
+      --replace-fail 'gnupg' 'python-gnupg'
+
+    substituteInPlace requirements.txt \
+      --replace-fail 'gnupg==2.3.1' 'python-gnupg'
+
+    substituteInPlace snapcraft/__init__.py \
+      --replace-fail '__version__ = _get_version()' '__version__ = "${version}"'
+
+    substituteInPlace snapcraft_legacy/__init__.py \
+      --replace-fail '__version__ = _get_version()' '__version__ = "${version}"'
+
+    substituteInPlace snapcraft/elf/elf_utils.py \
+      --replace-fail 'arch_linker_path = Path(arch_config.dynamic_linker)' \
+      'return str(Path("${glibc}/lib/ld-linux-x86-64.so.2"))'
+  '';
+
+  buildInputs = [ makeWrapper ];
+
+  propagatedBuildInputs = with python3Packages; [
+    attrs
+    catkin-pkg
+    click
+    craft-application
+    craft-archives
+    craft-cli
+    craft-grammar
+    craft-parts
+    craft-providers
+    craft-store
+    debian
+    docutils
+    jsonschema
+    launchpadlib
+    lazr-restfulclient
+    lxml
+    macaroonbakery
+    mypy-extensions
+    progressbar
+    pyelftools
+    pygit2
+    pylxd
+    python-apt
+    python-gnupg
+    raven
+    requests-toolbelt
+    simplejson
+    snap-helpers
+    tabulate
+    tinydb
+  ];
+
+  nativeBuildInputs = with python3Packages; [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "docutils"
+    "jsonschema"
+    "pygit2"
+    "urllib3"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/snapcraft --prefix PATH : ${squashfsTools}/bin
+  '';
+
+  nativeCheckInputs = with python3Packages; [
+    pytest-check
+    pytest-cov
+    pytest-mock
+    pytest-subprocess
+    pytestCheckHook
+    responses
+  ] ++ [
+    git
+    squashfsTools
+  ];
+
+  preCheck = ''
+    mkdir -p check-phase
+    export HOME="$(pwd)/check-phase"
+  '';
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  disabledTests = [
+    "test_bin_echo"
+    "test_classic_linter_filter"
+    "test_classic_linter"
+    "test_complex_snap_yaml"
+    "test_get_base_configuration_snap_channel"
+    "test_get_base_configuration_snap_instance_name_default"
+    "test_get_base_configuration_snap_instance_name_not_running_as_snap"
+    "test_get_extensions_data_dir"
+    "test_get_os_platform_alternative_formats"
+    "test_get_os_platform_linux"
+    "test_get_os_platform_windows"
+    "test_lifecycle_pack_components_with_output"
+    "test_lifecycle_pack_components"
+    "test_lifecycle_write_component_metadata"
+    "test_parse_info_integrated"
+    "test_patch_elf"
+    "test_remote_builder_init"
+    "test_setup_assets_remote_icon"
+    "test_snap_command_fallback"
+    "test_validate_architectures_supported"
+    "test_validate_architectures_unsupported"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    "test_load_project"
+  ];
+
+  disabledTestPaths = [
+    "tests/unit/commands/test_remote.py"
+    "tests/unit/elf"
+    "tests/unit/linters/test_classic_linter.py"
+    "tests/unit/linters/test_library_linter.py"
+    "tests/unit/parts/test_parts.py"
+    "tests/unit/services"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    mainProgram = "snapcraft";
+    description = "Build and publish Snap packages";
+    homepage = "https://github.com/canonical/snapcraft";
+    changelog = "https://github.com/canonical/snapcraft/releases/tag/${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch b/pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch
new file mode 100644
index 000000000000..b90f0b4e1df2
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch
@@ -0,0 +1,30 @@
+diff --git a/snapcraft/providers.py b/snapcraft/providers.py
+index a999537a..dcd290a7 100644
+--- a/snapcraft/providers.py
++++ b/snapcraft/providers.py
+@@ -21,6 +21,7 @@ import sys
+ from pathlib import Path
+ from textwrap import dedent
+ from typing import Dict, Optional
++import platform
+ 
+ from craft_cli import emit
+ from craft_providers import Provider, ProviderError, bases, executor
+@@ -178,14 +179,14 @@ def get_base_configuration(
+     # injecting a snap on a non-linux system is not supported, so default to
+     # install snapcraft from the store's stable channel
+     snap_channel = get_managed_environment_snap_channel()
+-    if sys.platform != "linux" and not snap_channel:
++    if snap_channel is None and (sys.platform != "linux" or "NixOS" in platform.version()):
+         emit.progress(
+-            "Using snapcraft from snap store channel 'latest/stable' in instance "
++            "Using snapcraft from snap store channel 'latest/beta' in instance "
+             "because snap injection is only supported on Linux hosts.",
+             permanent=True,
+         )
+         snap_name = "snapcraft"
+-        snap_channel = "stable"
++        snap_channel = "beta"
+     elif is_snapcraft_running_from_snap():
+         # Use SNAP_INSTANCE_NAME for snapcraft's snap name, as it may not be
+         # 'snapcraft' if the '--name' parameter was used to install snapcraft.
diff --git a/pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch b/pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch
new file mode 100644
index 000000000000..1dc4ef6cdcdf
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch
@@ -0,0 +1,26 @@
+diff --git a/snapcraft_legacy/internal/common.py b/snapcraft_legacy/internal/common.py
+index 6017b405..aacd99a5 100644
+--- a/snapcraft_legacy/internal/common.py
++++ b/snapcraft_legacy/internal/common.py
+@@ -34,14 +34,17 @@ from snaphelpers import SnapConfigOptions, SnapCtlError
+ 
+ from snapcraft_legacy.internal import errors
+ 
++# Get the path to the Nix store entry for Snapcraft at runtime
++drv = os.path.realpath(__file__).split("/")[3]
++
+ SNAPCRAFT_FILES = ["parts", "stage", "prime"]
+-_DEFAULT_PLUGINDIR = os.path.join(sys.prefix, "share", "snapcraft", "plugins")
++_DEFAULT_PLUGINDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "plugins")
+ _plugindir = _DEFAULT_PLUGINDIR
+-_DEFAULT_SCHEMADIR = os.path.join(sys.prefix, "share", "snapcraft", "schema")
++_DEFAULT_SCHEMADIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "schema")
+ _schemadir = _DEFAULT_SCHEMADIR
+-_DEFAULT_EXTENSIONSDIR = os.path.join(sys.prefix, "share", "snapcraft", "extensions")
++_DEFAULT_EXTENSIONSDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "extensions")
+ _extensionsdir = _DEFAULT_EXTENSIONSDIR
+-_DEFAULT_KEYRINGSDIR = os.path.join(sys.prefix, "share", "snapcraft", "keyrings")
++_DEFAULT_KEYRINGSDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "keyrings")
+ _keyringsdir = _DEFAULT_KEYRINGSDIR
+ 
+ _DOCKERENV_FILE = "/.dockerenv"
diff --git a/pkgs/by-name/so/solo5/package.nix b/pkgs/by-name/so/solo5/package.nix
index 240c69a40a0f..57ccd1e24b2b 100644
--- a/pkgs/by-name/so/solo5/package.nix
+++ b/pkgs/by-name/so/solo5/package.nix
@@ -63,16 +63,15 @@ in stdenv.mkDerivation {
     runHook postCheck
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Sandboxed execution environment";
     homepage = "https://github.com/solo5/solo5";
-    license = lib.licenses.isc;
-    maintainers = with lib.maintainers; [ ehmry ];
-    platforms = builtins.map ({arch, os}: "${arch}-${os}")
-      (lib.cartesianProductOfSets {
-        arch = [ "aarch64" "x86_64" ];
-        os = [ "freebsd" "genode" "linux" "openbsd" ];
-      });
+    license = licenses.isc;
+    maintainers = [ maintainers.ehmry ];
+    platforms = mapCartesianProduct ({ arch, os }: "${arch}-${os}") {
+      arch = [ "aarch64" "x86_64" ];
+      os = [ "freebsd" "genode" "linux" "openbsd" ];
+    };
   };
 
 }
diff --git a/pkgs/by-name/ss/ssimulacra2/package.nix b/pkgs/by-name/ss/ssimulacra2/package.nix
new file mode 100644
index 000000000000..9e9992f6d936
--- /dev/null
+++ b/pkgs/by-name/ss/ssimulacra2/package.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, ninja
+, cmake
+, libpng
+, libhwy
+, lcms2
+, giflib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ssimulacra2";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "cloudinary";
+    repo = "ssimulacra2";
+    hash = "sha256-gOo8WCWMdXOSmny0mQSzCvHgURQTCNBFD4G4sxfmXik=";
+    rev = "tags/v${finalAttrs.version}";
+  };
+
+  nativeBuildInputs = [
+    ninja
+    cmake
+  ];
+
+  buildInputs = [
+    libpng
+    libhwy
+    lcms2
+    giflib
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  installPhase = ''
+    runHook preInstall
+    install -m 755 -D ssimulacra2 -t $out/bin/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/cloudinary/ssimulacra2";
+    maintainers = [ maintainers.viraptor ];
+    license = licenses.bsd3;
+    description = "Perceptual image comparison tool";
+  };
+})
diff --git a/pkgs/by-name/sy/symfony-cli/package.nix b/pkgs/by-name/sy/symfony-cli/package.nix
index 470a6eaa6cd6..9931e4f59089 100644
--- a/pkgs/by-name/sy/symfony-cli/package.nix
+++ b/pkgs/by-name/sy/symfony-cli/package.nix
@@ -10,14 +10,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.8.14";
-  vendorHash = "sha256-OBXurPjyB2/JCQBna+tk0p3+n8gPoNLXCppXkII3ZUc=";
+  version = "5.8.15";
+  vendorHash = "sha256-rkvQhZSoKZIl/gFgekLUelem2FGbRL9gp1LEzYN88Dc=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    hash = "sha256-rwcULDbdYHZ1yFrGEGsJOZQG7Z29m0MOd79yalFIdkQ=";
+    hash = "sha256-HbBg2oCsogY3X4jgjknqwNe2bszXjylvE+h5/iyg2pM=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/ta/taskchampion-sync-server/package.nix b/pkgs/by-name/ta/taskchampion-sync-server/package.nix
new file mode 100644
index 000000000000..8ddefa8374c1
--- /dev/null
+++ b/pkgs/by-name/ta/taskchampion-sync-server/package.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "taskchampion-sync-server";
+  version = "0.4.1-unstable-2024-04-08";
+  src = fetchFromGitHub {
+      owner = "GothenburgBitFactory";
+      repo = "taskchampion-sync-server";
+      rev = "31cb732f0697208ef9a8d325a79688612087185a";
+      fetchSubmodules = false;
+      sha256 = "sha256-CUgXJcrCOenbw9ZDFBody5FAvpT1dsZBojJk3wOv9U4=";
+    };
+
+  cargoHash = "sha256-TpShnVQ2eFNLXJzOTlWVaLqT56YkP4zCGCf3yVtNcvI=";
+
+  # cargo tests fail when checkType="release" (default)
+  checkType = "debug";
+
+  meta = {
+    description = "Sync server for Taskwarrior 3";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/GothenburgBitFactory/taskchampion-sync-server";
+    maintainers = with lib.maintainers; [mlaradji];
+    mainProgram = "taskchampion-sync-server";
+  };
+}
diff --git a/pkgs/by-name/ta/taskwarrior3/package.nix b/pkgs/by-name/ta/taskwarrior3/package.nix
new file mode 100644
index 000000000000..5b9372189c72
--- /dev/null
+++ b/pkgs/by-name/ta/taskwarrior3/package.nix
@@ -0,0 +1,83 @@
+{
+  rustPlatform,
+  rustc,
+  cargo,
+  corrosion,
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libuuid,
+  gnutls,
+  python3,
+  xdg-utils,
+  installShellFiles,
+}:
+stdenv.mkDerivation rec {
+    pname = "taskwarrior";
+    version = "3.0.0-unstable-2024-04-07";
+    src = fetchFromGitHub {
+      owner = "GothenburgBitFactory";
+      repo = "taskwarrior";
+      rev = "fd306712b85dda3ea89de4e617aebeb98b2ede80";
+      fetchSubmodules = true;
+      sha256 = "sha256-vzfHq/LHfnTx6CVGFCuO6W5aSqj1jVqldMdmyciSDDk=";
+    };
+
+  postPatch = ''
+    substituteInPlace src/commands/CmdNews.cpp \
+      --replace "xdg-open" "${lib.getBin xdg-utils}/bin/xdg-open"
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    libuuid
+    python3
+    installShellFiles
+    corrosion
+    cargo
+    rustc
+    rustPlatform.cargoSetupHook
+  ];
+
+  doCheck = true;
+  preCheck = ''
+    patchShebangs --build test
+  '';
+  checkTarget = "test";
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    name = "${pname}-${version}-cargo-deps";
+    inherit src;
+    sourceRoot = src.name;
+    hash = "sha256-zQca/1tI/GUCekKhrg2iSL+h69SH6Ttsj3MqwDKj8HQ=";
+  };
+  cargoRoot = "./";
+  preConfigure = ''
+    export CMAKE_PREFIX_PATH="${corrosion}:$CMAKE_PREFIX_PATH"
+  '';
+
+  postInstall = ''
+    # ZSH is installed automatically from some reason, only bash and fish need
+    # manual installation
+    installShellCompletion --cmd task \
+      --bash $out/share/doc/task/scripts/bash/task.sh \
+      --fish $out/share/doc/task/scripts/fish/task.fish
+    rm -r $out/share/doc/task/scripts/bash
+    rm -r $out/share/doc/task/scripts/fish
+    # Install vim and neovim plugin
+    mkdir -p $out/share/vim-plugins
+    mv $out/share/doc/task/scripts/vim $out/share/vim-plugins/task
+    mkdir -p $out/share/nvim
+    ln -s $out/share/vim-plugins/task $out/share/nvim/site
+  '';
+
+  meta = with lib; {
+    description = "Highly flexible command-line tool to manage TODO lists";
+    homepage = "https://taskwarrior.org";
+    license = licenses.mit;
+    maintainers = with maintainers; [marcweber oxalica mlaradji];
+    mainProgram = "task";
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/data/fonts/junicode/tests.nix b/pkgs/data/fonts/junicode/tests.nix
index fda7de31670e..831e60796d12 100644
--- a/pkgs/data/fonts/junicode/tests.nix
+++ b/pkgs/data/fonts/junicode/tests.nix
@@ -15,14 +15,13 @@ let
       '');
 in
 builtins.listToAttrs (
-  map
-    texTest
-    (lib.attrsets.cartesianProductOfSets {
+  lib.mapCartesianProduct texTest
+    {
       tex = [ "xelatex" "lualatex" ];
       fonttype = [ "ttf" "otf" ];
       package = [ "junicode" ];
       file = [ ./test.tex ];
-    })
+    }
   ++
   [
     (texTest {
diff --git a/pkgs/data/fonts/nasin-nanpa/default.nix b/pkgs/data/fonts/nasin-nanpa/default.nix
index cd05c667a248..339c89dd9b0b 100644
--- a/pkgs/data/fonts/nasin-nanpa/default.nix
+++ b/pkgs/data/fonts/nasin-nanpa/default.nix
@@ -2,29 +2,18 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nasin-nanpa";
-  version = "2.5.1";
+  version = "3.1.0";
 
-  srcs = [
-    (fetchurl {
-      name = "nasin-nanpa.otf";
-      url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}.otf";
-      hash = "sha256-++uOrqFzQ6CB/OPEmBivpjMfAtFk3PSsCNpFBjOtGEg=";
-    })
-    (fetchurl {
-      name = "nasin-nanpa-lasina-kin.otf";
-      url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}-lasina-kin.otf";
-      hash = "sha256-4WIX74y2O4NaKi/JQrgTbOxlKDQKJ/F9wkQuoOdWuTI=";
-    })
-  ];
+  src = fetchurl {
+    url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}.otf";
+    hash = "sha256-remTvvOt7kpvTdq9H8tFI2yU+BtqePXlDDLQv/jtETU=";
+  };
 
   dontUnpack = true;
 
   installPhase = ''
     mkdir -p $out/share/fonts/opentype
-    for src in $srcs; do
-        file=$(stripHash $src)
-        cp $src $out/share/fonts/opentype/$file
-    done
+    cp $src $out/share/fonts/opentype/nasin-nanpa.otf
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/icons/catppuccin-cursors/default.nix b/pkgs/data/icons/catppuccin-cursors/default.nix
index 20e4718515e6..eeb9dd3227f0 100644
--- a/pkgs/data/icons/catppuccin-cursors/default.nix
+++ b/pkgs/data/icons/catppuccin-cursors/default.nix
@@ -9,9 +9,8 @@ let
     palette = [ "Frappe" "Latte" "Macchiato" "Mocha" ];
     color = [ "Blue" "Dark" "Flamingo" "Green" "Lavender" "Light" "Maroon" "Mauve" "Peach" "Pink" "Red" "Rosewater" "Sapphire" "Sky" "Teal" "Yellow" ];
   };
-  product = lib.attrsets.cartesianProductOfSets dimensions;
   variantName = { palette, color }: (lib.strings.toLower palette) + color;
-  variants = map variantName product;
+  variants = lib.mapCartesianProduct variantName dimensions;
 in
 stdenvNoCC.mkDerivation rec {
   pname = "catppuccin-cursors";
diff --git a/pkgs/data/icons/comixcursors/default.nix b/pkgs/data/icons/comixcursors/default.nix
index 1c4fdc195180..735ff686b49c 100644
--- a/pkgs/data/icons/comixcursors/default.nix
+++ b/pkgs/data/icons/comixcursors/default.nix
@@ -7,14 +7,13 @@ let
     thickness = [ "" "Slim_" ];  # Thick or slim edges.
     handedness = [ "" "LH_" ];   # Right- or left-handed.
   };
-  product = lib.cartesianProductOfSets dimensions;
   variantName =
     { color, opacity, thickness, handedness }:
     "${handedness}${opacity}${thickness}${color}";
   variants =
     # (The order of this list is already good looking enough to show in the
     # meta.longDescription.)
-    map variantName product;
+    lib.mapCartesianProduct variantName dimensions;
 in
 stdenvNoCC.mkDerivation rec {
   pname = "comixcursors";
diff --git a/pkgs/data/themes/orchis-theme/default.nix b/pkgs/data/themes/orchis-theme/default.nix
index 100599b34c3c..75bdf7b07aa9 100644
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@@ -26,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 stdenvNoCC.mkDerivation
 rec {
   inherit pname;
-  version = "2024-04-01";
+  version = "2024-04-18";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    hash = "sha256-gszyUZGWlgrBTQnaz6Ws7jzfTN5KAfX5SjVwmVrP9QE=";
+    hash = "sha256-Kvafbvw1q8F0+l47WshFHPfZEQhFXPPXuI0RjBJnP4s=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
diff --git a/pkgs/development/compilers/crystal/build-package.nix b/pkgs/development/compilers/crystal/build-package.nix
index cb5869392b6b..536ad3acda7b 100644
--- a/pkgs/development/compilers/crystal/build-package.nix
+++ b/pkgs/development/compilers/crystal/build-package.nix
@@ -26,6 +26,9 @@
   # The default `crystal build` options can be overridden with { foo.options = [ "--optionname" ]; }
 , crystalBinaries ? { }
 , enableParallelBuilding ? true
+  # Copy all shards dependencies instead of symlinking and add write permissions
+  # to make environment more local-like
+, copyShardDeps ? false
 , ...
 }@args:
 
@@ -78,7 +81,8 @@ stdenv.mkDerivation (mkDerivationArgs // {
       ++ lib.optional (lockFile != null) "cp ${lockFile} ./shard.lock"
       ++ lib.optionals (shardsFile != null) [
         "test -e lib || mkdir lib"
-        "for d in ${crystalLib}/*; do ln -s $d lib/; done"
+        (if copyShardDeps then "for d in ${crystalLib}/*; do cp -r $d/ lib/; done; chmod -R +w lib/"
+          else "for d in ${crystalLib}/*; do ln -s $d lib/; done")
         "cp shard.lock lib/.shards.info"
       ]
       ++ [ "runHook postConfigure" ]
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
index 1d76cfdbdd80..e48736559fb5 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
@@ -1,22 +1,22 @@
 # Generated by update.sh script
 {
-  "version" = "24.0.0";
+  "version" = "24.0.1";
   "hashes" = {
     "aarch64-linux" = {
-      sha256 = "1hz56nvl7av3xvwm7bxrzyri289h6hbawxsacn4zr7nm1snjn7i0";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.0/graalpy-community-24.0.0-linux-aarch64.tar.gz";
+      sha256 = "09zrp1l80294p4dzkfcvabs7l2hbs6500j1cibhdphcghjwip2l7";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.1/graalpy-community-24.0.1-linux-aarch64.tar.gz";
     };
     "x86_64-linux" = {
-      sha256 = "1ngqwrx1bc22jm12gmwqmqjfhhccpim1pai6885vg5xqsvc94y57";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.0/graalpy-community-24.0.0-linux-amd64.tar.gz";
+      sha256 = "06m4dw0mnhlnm764xzip3nxzzs8yxbbps2f1cs75zfyakmhpa5c2";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.1/graalpy-community-24.0.1-linux-amd64.tar.gz";
     };
     "x86_64-darwin" = {
-      sha256 = "07bh2fgk3l7vpws91ah48dsbrvvlq8wzfq88wq6ywilbikmnp0bw";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.0/graalpy-community-24.0.0-macos-amd64.tar.gz";
+      sha256 = "0x36l03fqkrjdazv4q50dpilx8y0jr27wsgvy8wqbdzjvbcf7rd4";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.1/graalpy-community-24.0.1-macos-amd64.tar.gz";
     };
     "aarch64-darwin" = {
-      sha256 = "00kljb24835l51jrnzdfblbhf2psdfw3wg00rllcdhpmiji40mbz";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.0/graalpy-community-24.0.0-macos-aarch64.tar.gz";
+      sha256 = "1mgpspjxs1s8rzsyw760xlm21zlx7gflgqvcslw3xfq59bf76npw";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-24.0.1/graalpy-community-24.0.1-macos-aarch64.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/compilers/ligo/default.nix b/pkgs/development/compilers/ligo/default.nix
index 9443f7a8cc08..9b57fd0a2e25 100644
--- a/pkgs/development/compilers/ligo/default.nix
+++ b/pkgs/development/compilers/ligo/default.nix
@@ -15,12 +15,12 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "ligo";
-  version = "1.4.0";
+  version = "1.6.0";
   src = fetchFromGitLab {
     owner = "ligolang";
     repo = "ligo";
     rev = version;
-    sha256 = "sha256-N2RkeKJ+lEyNJwpmF5sORmOkDhNmTYRYAgvyR7Pc5EI=";
+    hash = "sha256-ZPHOgozuUij9+4YXZTnn1koddQEQZe/yrpb+OPHO+nA=";
     fetchSubmodules = true;
   };
 
@@ -30,8 +30,6 @@ ocamlPackages.buildDunePackage rec {
   # This is a hack to work around the hack used in the dune files
   OPAM_SWITCH_PREFIX = "${tezos-rust-libs}";
 
-  strictDeps = true;
-
   nativeBuildInputs = [
     ocaml-crunch
     git
@@ -98,7 +96,7 @@ ocamlPackages.buildDunePackage rec {
     bls12-381
     bls12-381-signature
     ptime
-    mtime_1
+    mtime
     lwt_log
     secp256k1-internal
     resto
@@ -112,6 +110,7 @@ ocamlPackages.buildDunePackage rec {
     simple-diff
     seqes
     stdint
+    tezt
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
   ];
diff --git a/pkgs/development/coq-modules/CoLoR/default.nix b/pkgs/development/coq-modules/CoLoR/default.nix
index e275f8be0d7d..618ba3fd0a46 100644
--- a/pkgs/development/coq-modules/CoLoR/default.nix
+++ b/pkgs/development/coq-modules/CoLoR/default.nix
@@ -5,13 +5,14 @@ mkCoqDerivation {
   owner = "fblanqui";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.version [
-    {case = range "8.14" "8.18"; out = "1.8.4"; }
+    {case = range "8.14" "8.19"; out = "1.8.5"; }
     {case = range "8.12" "8.16"; out = "1.8.2"; }
     {case = range "8.10" "8.11"; out = "1.7.0"; }
     {case = range "8.8"  "8.9";  out = "1.6.0"; }
     {case = range "8.6"  "8.7";  out = "1.4.0"; }
   ] null;
 
+  release."1.8.5".sha256 = "sha256-zKAyj6rKAasDF+iKExmpVHMe2WwgAwv2j1mmiVAl7ys=";
   release."1.8.4".sha256 = "sha256-WlRiaLgnFFW5AY0z6EzdP1mevNe1GHsik6wULJLN4k0=";
   release."1.8.3".sha256 = "sha256-mMUzIorkQ6WWQBJLk1ioUNwAdDdGHJyhenIvkAjALVU=";
   release."1.8.2".sha256 = "sha256:1gvx5cxm582793vxzrvsmhxif7px18h9xsb2jljy2gkphdmsnpqj";
diff --git a/pkgs/development/cuda-modules/backend-stdenv.nix b/pkgs/development/cuda-modules/backend-stdenv.nix
index 5d1c0c735806..57219ad607c0 100644
--- a/pkgs/development/cuda-modules/backend-stdenv.nix
+++ b/pkgs/development/cuda-modules/backend-stdenv.nix
@@ -1,11 +1,9 @@
 {
+  cudaVersion,
   lib,
   nvccCompatibilities,
-  cudaVersion,
   pkgs,
-  overrideCC,
   stdenv,
-  wrapCCWith,
   stdenvAdapters,
 }:
 
diff --git a/pkgs/development/cuda-modules/cuda-library-samples/extension.nix b/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
index 456ab8168a45..1184547c7f93 100644
--- a/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
+++ b/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
@@ -1,5 +1,7 @@
-{ hostPlatform, lib }:
+{ lib, stdenv }:
 let
+  inherit (stdenv) hostPlatform;
+
   # Samples are built around the CUDA Toolkit, which is not available for
   # aarch64. Check for both CUDA version and platform.
   platformIsSupported = hostPlatform.isx86_64 && hostPlatform.isLinux;
diff --git a/pkgs/development/cuda-modules/cuda-library-samples/generic.nix b/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
index 4797871731b8..64131ab59b82 100644
--- a/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
+++ b/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
@@ -76,7 +76,7 @@ in
       # CUTENSOR_ROOT is double escaped
       postPatch = ''
         substituteInPlace CMakeLists.txt \
-          --replace "\''${CUTENSOR_ROOT}/include" "${cutensor.dev}/include"
+          --replace-fail "\''${CUTENSOR_ROOT}/include" "${cutensor.dev}/include"
       '';
 
       CUTENSOR_ROOT = cutensor;
diff --git a/pkgs/development/cuda-modules/cuda-samples/extension.nix b/pkgs/development/cuda-modules/cuda-samples/extension.nix
index d41da90cd5d0..0a8a3f9ff6ea 100644
--- a/pkgs/development/cuda-modules/cuda-samples/extension.nix
+++ b/pkgs/development/cuda-modules/cuda-samples/extension.nix
@@ -1,7 +1,7 @@
 {
   cudaVersion,
-  hostPlatform,
   lib,
+  stdenv,
 }:
 let
   cudaVersionToHash = {
@@ -23,6 +23,8 @@ let
     "12.3" = "sha256-fjVp0G6uRCWxsfe+gOwWTN+esZfk0O5uxS623u0REAk=";
   };
 
+  inherit (stdenv) hostPlatform;
+
   # Samples are built around the CUDA Toolkit, which is not available for
   # aarch64. Check for both CUDA version and platform.
   cudaVersionIsSupported = cudaVersionToHash ? ${cudaVersion};
diff --git a/pkgs/development/cuda-modules/cuda-samples/generic.nix b/pkgs/development/cuda-modules/cuda-samples/generic.nix
index a6a382c8a219..7b3a46acea92 100644
--- a/pkgs/development/cuda-modules/cuda-samples/generic.nix
+++ b/pkgs/development/cuda-modules/cuda-samples/generic.nix
@@ -11,6 +11,7 @@
   hash,
   lib,
   pkg-config,
+  stdenv,
 }:
 let
   inherit (lib) lists strings;
@@ -63,7 +64,7 @@ backendStdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    install -Dm755 -t $out/bin bin/${backendStdenv.hostPlatform.parsed.cpu.name}/${backendStdenv.hostPlatform.parsed.kernel.name}/release/*
+    install -Dm755 -t $out/bin bin/${stdenv.hostPlatform.parsed.cpu.name}/${stdenv.hostPlatform.parsed.kernel.name}/release/*
 
     runHook postInstall
   '';
diff --git a/pkgs/development/cuda-modules/cuda/overrides.nix b/pkgs/development/cuda-modules/cuda/overrides.nix
index 9a2360d7f7c1..5d23d8f7f2a1 100644
--- a/pkgs/development/cuda-modules/cuda/overrides.nix
+++ b/pkgs/development/cuda-modules/cuda/overrides.nix
@@ -1,122 +1,178 @@
-{
-  cudaVersion,
-  lib,
-  addDriverRunpath,
-}:
 let
-  inherit (lib) attrsets lists strings;
-  # cudaVersionOlder : Version -> Boolean
-  cudaVersionOlder = strings.versionOlder cudaVersion;
-  # cudaVersionAtLeast : Version -> Boolean
-  cudaVersionAtLeast = strings.versionAtLeast cudaVersion;
+  filterAndCreateOverrides =
+    createOverrideAttrs: final: prev:
+    let
+      # It is imperative that we use `final.callPackage` to perform overrides,
+      # so the final package set is available to the override functions.
+      inherit (final) callPackage;
 
-  addBuildInputs =
-    drv: buildInputs:
-    drv.overrideAttrs (prevAttrs: {
-      buildInputs = prevAttrs.buildInputs ++ buildInputs;
-    });
-in
-# NOTE: Filter out attributes that are not present in the previous version of
-# the package set. This is necessary to prevent the appearance of attributes
-# like `cuda_nvcc` in `cudaPackages_10_0, which predates redistributables.
-final: prev:
-attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
-  libcufile = prev.libcufile.overrideAttrs (prevAttrs: {
-    buildInputs = prevAttrs.buildInputs ++ [
-      final.libcublas.lib
-      final.pkgs.numactl
-      final.pkgs.rdma-core
+      # NOTE(@connorbaker): We MUST use `lib` from `prev` because the attribute
+      # names CAN NOT depend on `final`.
+      inherit (prev.lib.attrsets) filterAttrs mapAttrs;
+      inherit (prev.lib.trivial) pipe;
+
+      # NOTE: Filter out attributes that are not present in the previous version of
+      # the package set. This is necessary to prevent the appearance of attributes
+      # like `cuda_nvcc` in `cudaPackages_10_0, which predates redistributables.
+      filterOutNewAttrs = filterAttrs (name: _: prev ? ${name});
+
+      # Apply callPackage to each attribute value, yielding a value to be passed
+      # to overrideAttrs.
+      callPackageThenOverrideAttrs = mapAttrs (
+        name: value: prev.${name}.overrideAttrs (callPackage value { })
+      );
+    in
+    pipe createOverrideAttrs [
+      filterOutNewAttrs
+      callPackageThenOverrideAttrs
     ];
-    # Before 11.7 libcufile depends on itself for some reason.
-    autoPatchelfIgnoreMissingDeps =
-      prevAttrs.autoPatchelfIgnoreMissingDeps
-      ++ lists.optionals (cudaVersionOlder "11.7") [ "libcufile.so.0" ];
-  });
+in
+# Each attribute name is the name of an existing package in the previous version
+# of the package set.
+# The value is a function (to be provided to callPackage), which yields a value
+# to be provided to overrideAttrs. This allows us to override the attributes of
+# a package without losing access to the fixed point of the package set --
+# especially useful given that some packages may depend on each other!
+filterAndCreateOverrides {
+  libcufile =
+    {
+      cudaOlder,
+      lib,
+      libcublas,
+      numactl,
+      rdma-core,
+    }:
+    prevAttrs: {
+      buildInputs = prevAttrs.buildInputs ++ [
+        libcublas.lib
+        numactl
+        rdma-core
+      ];
+      # Before 11.7 libcufile depends on itself for some reason.
+      autoPatchelfIgnoreMissingDeps =
+        prevAttrs.autoPatchelfIgnoreMissingDeps
+        ++ lib.lists.optionals (cudaOlder "11.7") [ "libcufile.so.0" ];
+    };
 
-  libcusolver = addBuildInputs prev.libcusolver (
-    # Always depends on this
-    [ final.libcublas.lib ]
-    # Dependency from 12.0 and on
-    ++ lists.optionals (cudaVersionAtLeast "12.0") [ final.libnvjitlink.lib ]
-    # Dependency from 12.1 and on
-    ++ lists.optionals (cudaVersionAtLeast "12.1") [ final.libcusparse.lib ]
-  );
+  libcusolver =
+    {
+      cudaAtLeast,
+      lib,
+      libcublas,
+      libcusparse ? null,
+      libnvjitlink ? null,
+    }:
+    prevAttrs: {
+      buildInputs =
+        prevAttrs.buildInputs
+        # Always depends on this
+        ++ [ libcublas.lib ]
+        # Dependency from 12.0 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.0") [ libnvjitlink.lib ]
+        # Dependency from 12.1 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.1") [ libcusparse.lib ];
 
-  libcusparse = addBuildInputs prev.libcusparse (
-    lists.optionals (cudaVersionAtLeast "12.0") [ final.libnvjitlink.lib ]
-  );
+      brokenConditions = prevAttrs.brokenConditions // {
+        "libnvjitlink missing (CUDA >= 12.0)" =
+          !(cudaAtLeast "12.0" -> (libnvjitlink != null && libnvjitlink.lib != null));
+        "libcusparse missing (CUDA >= 12.1)" =
+          !(cudaAtLeast "12.1" -> (libcusparse != null && libcusparse.lib != null));
+      };
+    };
 
-  cuda_cudart = prev.cuda_cudart.overrideAttrs (prevAttrs: {
-    # Remove once cuda-find-redist-features has a special case for libcuda
-    outputs =
-      prevAttrs.outputs
-      ++ lists.optionals (!(builtins.elem "stubs" prevAttrs.outputs)) [ "stubs" ];
+  libcusparse =
+    {
+      cudaAtLeast,
+      lib,
+      libnvjitlink ? null,
+    }:
+    prevAttrs: {
+      buildInputs =
+        prevAttrs.buildInputs
+        # Dependency from 12.0 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.0") [ libnvjitlink.lib ];
 
-    allowFHSReferences = false;
+      brokenConditions = prevAttrs.brokenConditions // {
+        "libnvjitlink missing (CUDA >= 12.0)" =
+          !(cudaAtLeast "12.0" -> (libnvjitlink != null && libnvjitlink.lib != null));
+      };
+    };
 
-    # The libcuda stub's pkg-config doesn't follow the general pattern:
-    postPatch =
-      prevAttrs.postPatch or ""
-      + ''
-        while IFS= read -r -d $'\0' path ; do
-          sed -i \
-            -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib/stubs|" \
-            -e "s|^Libs\s*:\(.*\)\$|Libs: \1 -Wl,-rpath,${addDriverRunpath.driverLink}/lib|" \
-            "$path"
-        done < <(find -iname 'cuda-*.pc' -print0)
-      ''
-      + ''
+  # TODO(@connorbaker): cuda_cudart.dev depends on crt/host_config.h, which is from
+  # cuda_nvcc.dev. It would be nice to be able to encode that.
+  cuda_cudart =
+    { addDriverRunpath, lib }:
+    prevAttrs: {
+      # Remove once cuda-find-redist-features has a special case for libcuda
+      outputs =
+        prevAttrs.outputs
+        ++ lib.lists.optionals (!(builtins.elem "stubs" prevAttrs.outputs)) [ "stubs" ];
+
+      allowFHSReferences = false;
+
+      # The libcuda stub's pkg-config doesn't follow the general pattern:
+      postPatch =
+        prevAttrs.postPatch or ""
+        + ''
+          while IFS= read -r -d $'\0' path; do
+            sed -i \
+              -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib/stubs|" \
+              -e "s|^Libs\s*:\(.*\)\$|Libs: \1 -Wl,-rpath,${addDriverRunpath.driverLink}/lib|" \
+              "$path"
+          done < <(find -iname 'cuda-*.pc' -print0)
+        ''
         # Namelink may not be enough, add a soname.
         # Cf. https://gitlab.kitware.com/cmake/cmake/-/issues/25536
-        if [[ -f lib/stubs/libcuda.so && ! -f lib/stubs/libcuda.so.1 ]] ; then
-          ln -s libcuda.so lib/stubs/libcuda.so.1
-        fi
-      '';
+        + ''
+          if [[ -f lib/stubs/libcuda.so && ! -f lib/stubs/libcuda.so.1 ]]; then
+            ln -s libcuda.so lib/stubs/libcuda.so.1
+          fi
+        '';
 
-    postFixup =
-      prevAttrs.postFixup or ""
-      + ''
-        moveToOutput lib/stubs "$stubs"
-        ln -s "$stubs"/lib/stubs/* "$stubs"/lib/
-        ln -s "$stubs"/lib/stubs "''${!outputLib}/lib/stubs"
-      '';
-  });
-
-  cuda_compat = prev.cuda_compat.overrideAttrs (prevAttrs: {
-    autoPatchelfIgnoreMissingDeps = prevAttrs.autoPatchelfIgnoreMissingDeps ++ [
-      "libnvrm_gpu.so"
-      "libnvrm_mem.so"
-      "libnvdla_runtime.so"
-    ];
-    # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
-    badPlatformsConditions = prevAttrs.badPlatformsConditions // {
-      "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" =
-        !final.flags.isJetsonBuild;
+      postFixup =
+        prevAttrs.postFixup or ""
+        + ''
+          moveToOutput lib/stubs "$stubs"
+          ln -s "$stubs"/lib/stubs/* "$stubs"/lib/
+          ln -s "$stubs"/lib/stubs "''${!outputLib}/lib/stubs"
+        '';
     };
-  });
 
-  cuda_gdb = addBuildInputs prev.cuda_gdb (
-    # x86_64 only needs gmp from 12.0 and on
-    lists.optionals (cudaVersionAtLeast "12.0") [ final.pkgs.gmp ]
-  );
-
-  cuda_nvcc = prev.cuda_nvcc.overrideAttrs (
-    oldAttrs:
-    let
-      # This replicates the logic in stdenvAdapters.useLibsFrom, except we use
-      # gcc from pkgsHostTarget and not from buildPackages.
-      ccForLibs-wrapper = final.pkgs.stdenv.cc;
-      gccMajorVersion = final.nvccCompatibilities.${cudaVersion}.gccMaxMajorVersion;
-      cc = final.pkgs.wrapCCWith {
-        cc = final.pkgs."gcc${gccMajorVersion}".cc;
-        useCcForLibs = true;
-        gccForLibs = ccForLibs-wrapper.cc;
+  cuda_compat =
+    { flags, lib }:
+    prevAttrs: {
+      autoPatchelfIgnoreMissingDeps = prevAttrs.autoPatchelfIgnoreMissingDeps ++ [
+        "libnvrm_gpu.so"
+        "libnvrm_mem.so"
+        "libnvdla_runtime.so"
+      ];
+      # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
+      badPlatformsConditions = prevAttrs.badPlatformsConditions // {
+        "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" = !flags.isJetsonBuild;
       };
-    in
+    };
+
+  cuda_gdb =
     {
+      cudaAtLeast,
+      gmp,
+      lib,
+    }:
+    prevAttrs: {
+      buildInputs =
+        prevAttrs.buildInputs
+        # x86_64 only needs gmp from 12.0 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.0") [ gmp ];
+    };
 
-      outputs = oldAttrs.outputs ++ lists.optionals (!(builtins.elem "lib" oldAttrs.outputs)) [ "lib" ];
-
+  cuda_nvcc =
+    {
+      backendStdenv,
+      cuda_cudart,
+      lib,
+      setupCudaHook,
+    }:
+    prevAttrs: {
       # Patch the nvcc.profile.
       # Syntax:
       # - `=` for assignment,
@@ -131,38 +187,37 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
       # backend-stdenv.nix
 
       postPatch =
-        (oldAttrs.postPatch or "")
+        (prevAttrs.postPatch or "")
         + ''
           substituteInPlace bin/nvcc.profile \
-            --replace \
-              '$(TOP)/lib' \
-              "''${!outputLib}/lib" \
-            --replace \
+            --replace-fail \
               '$(TOP)/$(_NVVM_BRANCH_)' \
               "''${!outputBin}/nvvm" \
-            --replace \
+            --replace-fail \
               '$(TOP)/$(_TARGET_DIR_)/include' \
               "''${!outputDev}/include"
 
           cat << EOF >> bin/nvcc.profile
 
           # Fix a compatible backend compiler
-          PATH += ${lib.getBin cc}/bin:
+          PATH += "${backendStdenv.cc}/bin":
 
           # Expose the split-out nvvm
-          LIBRARIES =+ -L''${!outputBin}/nvvm/lib
-          INCLUDES =+ -I''${!outputBin}/nvvm/include
-
-          # Expose cudart and the libcuda stubs
-          LIBRARIES =+ -L$static/lib" "-L${final.cuda_cudart.lib}/lib -L${final.cuda_cudart.lib}/lib/stubs
-          INCLUDES =+ -I${final.cuda_cudart.dev}/include
+          LIBRARIES =+ "-L''${!outputBin}/nvvm/lib"
+          INCLUDES =+ "-I''${!outputBin}/nvvm/include"
           EOF
         '';
 
-      propagatedBuildInputs = [ final.setupCudaHook ];
+      # NOTE(@connorbaker):
+      # Though it might seem odd or counter-intuitive to add the setup hook to `propagatedBuildInputs` instead of
+      # `propagatedNativeBuildInputs`, it is necessary! If you move the setup hook from `propagatedBuildInputs` to
+      # `propagatedNativeBuildInputs`, it stops being propagated to downstream packages during their build because
+      # setup hooks in `propagatedNativeBuildInputs` are not designed to affect the runtime or build environment of
+      # dependencies; they are only meant to affect the build environment of the package that directly includes them.
+      propagatedBuildInputs = (prevAttrs.propagatedBuildInputs or [ ]) ++ [ setupCudaHook ];
 
       postInstall =
-        (oldAttrs.postInstall or "")
+        (prevAttrs.postInstall or "")
         + ''
           moveToOutput "nvvm" "''${!outputBin}"
         '';
@@ -170,48 +225,77 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
       # The nvcc and cicc binaries contain hard-coded references to /usr
       allowFHSReferences = true;
 
-      meta = (oldAttrs.meta or { }) // {
+      meta = (prevAttrs.meta or { }) // {
         mainProgram = "nvcc";
       };
-    }
-  );
+    };
 
-  cuda_nvprof = prev.cuda_nvprof.overrideAttrs (prevAttrs: {
-    buildInputs = prevAttrs.buildInputs ++ [ final.cuda_cupti.lib ];
-  });
+  cuda_nvprof =
+    { cuda_cupti }: prevAttrs: { buildInputs = prevAttrs.buildInputs ++ [ cuda_cupti.lib ]; };
 
-  cuda_demo_suite = addBuildInputs prev.cuda_demo_suite [
-    final.pkgs.freeglut
-    final.pkgs.libGLU
-    final.pkgs.libglvnd
-    final.pkgs.mesa
-    final.libcufft.lib
-    final.libcurand.lib
-  ];
+  cuda_demo_suite =
+    {
+      freeglut,
+      libcufft,
+      libcurand,
+      libGLU,
+      libglvnd,
+      mesa,
+    }:
+    prevAttrs: {
+      buildInputs = prevAttrs.buildInputs ++ [
+        freeglut
+        libcufft.lib
+        libcurand.lib
+        libGLU
+        libglvnd
+        mesa
+      ];
+    };
 
-  nsight_compute = prev.nsight_compute.overrideAttrs (prevAttrs: {
-    nativeBuildInputs =
-      prevAttrs.nativeBuildInputs
-      ++ (
-        if (strings.versionOlder prev.nsight_compute.version "2022.2.0") then
-          [ final.pkgs.qt5.wrapQtAppsHook ]
-        else
-          [ final.pkgs.qt6.wrapQtAppsHook ]
-      );
-    buildInputs =
-      prevAttrs.buildInputs
-      ++ (
-        if (strings.versionOlder prev.nsight_compute.version "2022.2.0") then
-          [ final.pkgs.qt5.qtwebview ]
-        else
-          [ final.pkgs.qt6.qtwebview ]
-      );
-  });
-
-  nsight_systems = prev.nsight_systems.overrideAttrs (
+  nsight_compute =
+    {
+      lib,
+      qt5 ? null,
+      qt6 ? null,
+    }:
     prevAttrs:
     let
-      qt = if lib.versionOlder prevAttrs.version "2022.4.2.1" then final.pkgs.qt5 else final.pkgs.qt6;
+      inherit (lib.strings) versionOlder versionAtLeast;
+      inherit (prevAttrs) version;
+      qt = if versionOlder version "2022.2.0" then qt5 else qt6;
+      inherit (qt) wrapQtAppsHook qtwebview;
+    in
+    {
+      nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ wrapQtAppsHook ];
+      buildInputs = prevAttrs.buildInputs ++ [ qtwebview ];
+      brokenConditions = prevAttrs.brokenConditions // {
+        "Qt 5 missing (<2022.2.0)" = !(versionOlder version "2022.2.0" -> qt5 != null);
+        "Qt 6 missing (>=2022.2.0)" = !(versionAtLeast version "2022.2.0" -> qt6 != null);
+      };
+    };
+
+  nsight_systems =
+    {
+      cuda_cudart,
+      cudaOlder,
+      gst_all_1,
+      lib,
+      nss,
+      numactl,
+      pulseaudio,
+      qt5 ? null,
+      qt6 ? null,
+      rdma-core,
+      ucx,
+      wayland,
+      xorg,
+    }:
+    prevAttrs:
+    let
+      inherit (lib.strings) versionOlder versionAtLeast;
+      inherit (prevAttrs) version;
+      qt = if lib.strings.versionOlder prevAttrs.version "2022.4.2.1" then qt5 else qt6;
       qtwayland =
         if lib.versions.major qt.qtbase.version == "5" then
           lib.getBin qt.qtwayland
@@ -223,55 +307,57 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
       # An ad hoc replacement for
       # https://github.com/ConnorBaker/cuda-redist-find-features/issues/11
       env.rmPatterns = toString [
+        "nsight-systems/*/*/lib{arrow,jpeg}*"
+        "nsight-systems/*/*/lib{ssl,ssh,crypto}*"
+        "nsight-systems/*/*/libboost*"
+        "nsight-systems/*/*/libexec"
         "nsight-systems/*/*/libQt*"
         "nsight-systems/*/*/libstdc*"
-        "nsight-systems/*/*/libboost*"
-        "nsight-systems/*/*/lib{ssl,ssh,crypto}*"
-        "nsight-systems/*/*/lib{arrow,jpeg}*"
         "nsight-systems/*/*/Mesa"
-        "nsight-systems/*/*/python/bin/python"
-        "nsight-systems/*/*/libexec"
         "nsight-systems/*/*/Plugins"
+        "nsight-systems/*/*/python/bin/python"
       ];
       postPatch =
         prevAttrs.postPatch or ""
         + ''
-          for path in $rmPatterns ; do
+          for path in $rmPatterns; do
             rm -r "$path"
           done
         '';
       nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ qt.wrapQtAppsHook ];
       buildInputs = prevAttrs.buildInputs ++ [
-        final.cuda_cudart.stubs
-        final.pkgs.alsa-lib
-        final.pkgs.boost178
-        final.pkgs.e2fsprogs
-        final.pkgs.gst_all_1.gst-plugins-base
-        final.pkgs.gst_all_1.gstreamer
-        final.pkgs.nss
-        final.pkgs.numactl
-        final.pkgs.pulseaudio
-        final.pkgs.rdma-core
-        final.pkgs.ucx
-        final.pkgs.wayland
-        final.pkgs.xorg.libXcursor
-        final.pkgs.xorg.libXdamage
-        final.pkgs.xorg.libXrandr
-        final.pkgs.xorg.libXtst
-        qt.qtbase
         (qt.qtdeclarative or qt.full)
         (qt.qtsvg or qt.full)
+        cuda_cudart.stubs
+        gst_all_1.gst-plugins-base
+        gst_all_1.gstreamer
+        nss
+        numactl
+        pulseaudio
+        qt.qtbase
         qtWaylandPlugins
+        rdma-core
+        ucx
+        wayland
+        xorg.libXcursor
+        xorg.libXdamage
+        xorg.libXrandr
+        xorg.libXtst
       ];
 
-      # Older releases require boost 1.70 deprecated in Nixpkgs
-      meta.broken = prevAttrs.meta.broken or false || lib.versionOlder final.cudaVersion "11.8";
-    }
-  );
+      brokenConditions = prevAttrs.brokenConditions // {
+        # Older releases require boost 1.70, which is deprecated in Nixpkgs
+        "CUDA too old (<11.8)" = cudaOlder "11.8";
+        "Qt 5 missing (<2022.4.2.1)" = !(versionOlder version "2022.4.2.1" -> qt5 != null);
+        "Qt 6 missing (>=2022.4.2.1)" = !(versionAtLeast version "2022.4.2.1" -> qt6 != null);
+      };
+    };
 
-  nvidia_driver = prev.nvidia_driver.overrideAttrs {
-    # No need to support this package as we have drivers already
-    # in linuxPackages.
-    meta.broken = true;
-  };
+  nvidia_driver =
+    { }:
+    prevAttrs: {
+      brokenConditions = prevAttrs.brokenConditions // {
+        "Package is not supported; use drivers from linuxPackages" = true;
+      };
+    };
 }
diff --git a/pkgs/development/cuda-modules/cutensor/extension.nix b/pkgs/development/cuda-modules/cutensor/extension.nix
index c41113939ca2..5fdf356df916 100644
--- a/pkgs/development/cuda-modules/cutensor/extension.nix
+++ b/pkgs/development/cuda-modules/cutensor/extension.nix
@@ -15,9 +15,9 @@
 {
   cudaVersion,
   flags,
-  hostPlatform,
   lib,
   mkVersionedPackageName,
+  stdenv,
 }:
 let
   inherit (lib)
@@ -29,6 +29,8 @@ let
     trivial
     ;
 
+  inherit (stdenv) hostPlatform;
+
   redistName = "cutensor";
   pname = "libcutensor";
 
diff --git a/pkgs/development/cuda-modules/flags.nix b/pkgs/development/cuda-modules/flags.nix
index 196b6b9f8f99..93952a66216b 100644
--- a/pkgs/development/cuda-modules/flags.nix
+++ b/pkgs/development/cuda-modules/flags.nix
@@ -7,7 +7,7 @@
   cudaForwardCompat ? (config.cudaForwardCompat or true),
   lib,
   cudaVersion,
-  hostPlatform,
+  stdenv,
   # gpus :: List Gpu
   gpus,
 }:
@@ -20,6 +20,8 @@ let
     trivial
     ;
 
+  inherit (stdenv) hostPlatform;
+
   # Flags are determined based on your CUDA toolkit by default.  You may benefit
   # from improved performance, reduced file size, or greater hardware support by
   # passing a configuration based on your specific GPU environment.
@@ -207,6 +209,11 @@ let
       # E.g. "-gencode=arch=compute_75,code=sm_75 ... -gencode=arch=compute_86,code=compute_86"
       gencodeString = strings.concatStringsSep " " gencode;
 
+      # cmakeCudaArchitecturesString :: String
+      # A semicolon-separated string of CUDA capabilities without dots, suitable for passing to CMake.
+      # E.g. "75;86"
+      cmakeCudaArchitecturesString = strings.concatMapStringsSep ";" dropDot cudaCapabilities;
+
       # Jetson devices cannot be targeted by the same binaries which target non-Jetson devices. While
       # NVIDIA provides both `linux-aarch64` and `linux-sbsa` packages, which both target `aarch64`,
       # they are built with different settings and cannot be mixed.
@@ -270,6 +277,8 @@ assert
       ];
       gencodeString = "-gencode=arch=compute_75,code=sm_75 -gencode=arch=compute_86,code=sm_86 -gencode=arch=compute_86,code=compute_86";
 
+      cmakeCudaArchitecturesString = "75;86";
+
       isJetsonBuild = false;
     };
     actual = formatCapabilities {
@@ -339,6 +348,8 @@ assert
       ];
       gencodeString = "-gencode=arch=compute_62,code=sm_62 -gencode=arch=compute_72,code=sm_72 -gencode=arch=compute_72,code=compute_72";
 
+      cmakeCudaArchitecturesString = "62;72";
+
       isJetsonBuild = true;
     };
     actual = formatCapabilities {
diff --git a/pkgs/development/cuda-modules/generic-builders/manifest.nix b/pkgs/development/cuda-modules/generic-builders/manifest.nix
index 73c34b0c86ee..006abb456cdc 100644
--- a/pkgs/development/cuda-modules/generic-builders/manifest.nix
+++ b/pkgs/development/cuda-modules/generic-builders/manifest.nix
@@ -10,7 +10,6 @@
   markForCudatoolkitRootHook,
   flags,
   stdenv,
-  hostPlatform,
   # Builder-specific arguments
   # Short package name (e.g., "cuda_cccl")
   # pname : String
@@ -40,6 +39,8 @@ let
     sourceTypes
     ;
 
+  inherit (stdenv) hostPlatform;
+
   # Get the redist architectures for which package provides distributables.
   # These are used by meta.platforms.
   supportedRedistArchs = builtins.attrNames featureRelease;
@@ -48,7 +49,7 @@ let
   # It is `"unsupported"` if the redistributable is not supported on the target platform.
   redistArch = flags.getRedistArch hostPlatform.system;
 
-  sourceMatchesHost = flags.getNixSystem redistArch == stdenv.hostPlatform.system;
+  sourceMatchesHost = flags.getNixSystem redistArch == hostPlatform.system;
 in
 backendStdenv.mkDerivation (finalAttrs: {
   # NOTE: Even though there's no actual buildPhase going on here, the derivations of the
@@ -127,7 +128,18 @@ backendStdenv.mkDerivation (finalAttrs: {
   # brokenConditions :: AttrSet Bool
   # Sets `meta.broken = true` if any of the conditions are true.
   # Example: Broken on a specific version of CUDA or when a dependency has a specific version.
-  brokenConditions = { };
+  brokenConditions = {
+    # Unclear how this is handled by Nix internals.
+    "Duplicate entries in outputs" = finalAttrs.outputs != lists.unique finalAttrs.outputs;
+    # Typically this results in the static output being empty, as all libraries are moved
+    # back to the lib output.
+    "lib output follows static output" =
+      let
+        libIndex = lists.findFirstIndex (x: x == "lib") null finalAttrs.outputs;
+        staticIndex = lists.findFirstIndex (x: x == "static") null finalAttrs.outputs;
+      in
+      libIndex != null && staticIndex != null && libIndex > staticIndex;
+  };
 
   # badPlatformsConditions :: AttrSet Bool
   # Sets `meta.badPlatforms = meta.platforms` if any of the conditions are true.
@@ -137,44 +149,43 @@ backendStdenv.mkDerivation (finalAttrs: {
   };
 
   # src :: Optional Derivation
-  src = trivial.pipe redistArch [
-    # If redistArch doesn't exist in redistribRelease, return null.
-    (redistArch: redistribRelease.${redistArch} or null)
-    # If the release is non-null, fetch the source; otherwise, return null.
-    (trivial.mapNullable (
-      { relative_path, sha256, ... }:
-      fetchurl {
-        url = "https://developer.download.nvidia.com/compute/${redistName}/redist/${relative_path}";
-        inherit sha256;
-      }
-    ))
-  ];
-
-  # Handle the pkg-config files:
-  # 1. No FHS
-  # 2. Location expected by the pkg-config wrapper
-  # 3. Generate unversioned names too
-  postPatch = ''
-    for path in pkg-config pkgconfig ; do
-      [[ -d "$path" ]] || continue
-      mkdir -p share/pkgconfig
-      mv "$path"/* share/pkgconfig/
-      rmdir "$path"
-    done
-
-    for pc in share/pkgconfig/*.pc ; do
-      sed -i \
-        -e "s|^cudaroot\s*=.*\$|cudaroot=''${!outputDev}|" \
-        -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib|" \
-        -e "s|^includedir\s*=.*/include\$|includedir=''${!outputDev}/include|" \
-        "$pc"
-    done
+  # If redistArch doesn't exist in redistribRelease, return null.
+  src = trivial.mapNullable (
+    { relative_path, sha256, ... }:
+    fetchurl {
+      url = "https://developer.download.nvidia.com/compute/${redistName}/redist/${relative_path}";
+      inherit sha256;
+    }
+  ) (redistribRelease.${redistArch} or null);
 
+  postPatch =
+    # Pkg-config's setup hook expects configuration files in $out/share/pkgconfig
+    ''
+      for path in pkg-config pkgconfig; do
+        [[ -d "$path" ]] || continue
+        mkdir -p share/pkgconfig
+        mv "$path"/* share/pkgconfig/
+        rmdir "$path"
+      done
+    ''
+    # Rewrite FHS paths with store paths
+    # NOTE: output* fall back to out if the corresponding output isn't defined.
+    + ''
+      for pc in share/pkgconfig/*.pc; do
+        sed -i \
+          -e "s|^cudaroot\s*=.*\$|cudaroot=''${!outputDev}|" \
+          -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib|" \
+          -e "s|^includedir\s*=.*/include\$|includedir=''${!outputDev}/include|" \
+          "$pc"
+      done
+    ''
+    # Generate unversioned names.
     # E.g. cuda-11.8.pc -> cuda.pc
-    for pc in share/pkgconfig/*-"$majorMinorVersion.pc" ; do
-      ln -s "$(basename "$pc")" "''${pc%-$majorMinorVersion.pc}".pc
-    done
-  '';
+    + ''
+      for pc in share/pkgconfig/*-"$majorMinorVersion.pc"; do
+        ln -s "$(basename "$pc")" "''${pc%-$majorMinorVersion.pc}".pc
+      done
+    '';
 
   env.majorMinorVersion = cudaMajorMinorVersion;
 
@@ -233,7 +244,7 @@ backendStdenv.mkDerivation (finalAttrs: {
     # Handle the existence of libPath, which requires us to re-arrange the lib directory
     + strings.optionalString (libPath != null) ''
       full_lib_path="lib/${libPath}"
-      if [[ ! -d "$full_lib_path" ]] ; then
+      if [[ ! -d "$full_lib_path" ]]; then
         echo "${finalAttrs.pname}: '$full_lib_path' does not exist, only found:" >&2
         find lib/ -mindepth 1 -maxdepth 1 >&2
         echo "This release might not support your CUDA version" >&2
@@ -264,9 +275,9 @@ backendStdenv.mkDerivation (finalAttrs: {
   postInstallCheck = ''
     echo "Executing postInstallCheck"
 
-    if [[ -z "''${allowFHSReferences-}" ]] ; then
+    if [[ -z "''${allowFHSReferences-}" ]]; then
       mapfile -t outputPaths < <(for o in $(getAllOutputNames); do echo "''${!o}"; done)
-      if grep --max-count=5 --recursive --exclude=LICENSE /usr/ "''${outputPaths[@]}" ; then
+      if grep --max-count=5 --recursive --exclude=LICENSE /usr/ "''${outputPaths[@]}"; then
         echo "Detected references to /usr" >&2
         exit 1
       fi
diff --git a/pkgs/development/cuda-modules/generic-builders/multiplex.nix b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
index 0b523e56b8c4..ce50653bb5d4 100644
--- a/pkgs/development/cuda-modules/generic-builders/multiplex.nix
+++ b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
@@ -3,7 +3,7 @@
   lib,
   cudaVersion,
   flags,
-  hostPlatform,
+  stdenv,
   # Expected to be passed by the caller
   mkVersionedPackageName,
   # pname :: String
@@ -40,6 +40,8 @@ let
     strings
     ;
 
+  inherit (stdenv) hostPlatform;
+
   evaluatedModules = modules.evalModules {
     modules = [
       ../modules
diff --git a/pkgs/development/cuda-modules/nccl/default.nix b/pkgs/development/cuda-modules/nccl/default.nix
index 8043adae4d1e..dd767d2781f0 100644
--- a/pkgs/development/cuda-modules/nccl/default.nix
+++ b/pkgs/development/cuda-modules/nccl/default.nix
@@ -17,9 +17,10 @@ let
     cuda_cccl
     cuda_cudart
     cuda_nvcc
+    cudaAtLeast
     cudaFlags
+    cudaOlder
     cudatoolkit
-    cudaVersion
     ;
 in
 backendStdenv.mkDerivation (finalAttrs: {
@@ -33,6 +34,7 @@ backendStdenv.mkDerivation (finalAttrs: {
     hash = "sha256-IF2tILwW8XnzSmfn7N1CO7jXL95gUp02guIW5n1eaig=";
   };
 
+  __structuredAttrs = true;
   strictDeps = true;
 
   outputs = [
@@ -46,12 +48,12 @@ backendStdenv.mkDerivation (finalAttrs: {
       autoAddDriverRunpath
       python3
     ]
-    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [ cuda_nvcc ];
+    ++ lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [ cuda_nvcc ];
 
   buildInputs =
-    lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+    lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [
       cuda_nvcc.dev # crt/host_config.h
       cuda_cudart
     ]
@@ -59,25 +61,25 @@ backendStdenv.mkDerivation (finalAttrs: {
     # against other version, like below, it's important that we use the same format. Otherwise,
     # we'll get incorrect results.
     # For example, lib.versionAtLeast "12.0" "12.0.0" == false.
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [ cuda_cccl ];
+    ++ lib.optionals (cudaAtLeast "12.0") [ cuda_cccl ];
 
   env.NIX_CFLAGS_COMPILE = toString [ "-Wno-unused-function" ];
 
-  preConfigure = ''
+  postPatch = ''
     patchShebangs ./src/device/generate.py
-    makeFlagsArray+=(
-      "NVCC_GENCODE=${lib.concatStringsSep " " cudaFlags.gencode}"
-    )
   '';
 
-  makeFlags =
-    [ "PREFIX=$(out)" ]
-    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [
+  makeFlagsArray =
+    [
+      "PREFIX=$(out)"
+      "NVCC_GENCODE=${cudaFlags.gencodeString}"
+    ]
+    ++ lib.optionals (cudaOlder "11.4") [
       "CUDA_HOME=${cudatoolkit}"
       "CUDA_LIB=${lib.getLib cudatoolkit}/lib"
       "CUDA_INC=${lib.getDev cudatoolkit}/include"
     ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+    ++ lib.optionals (cudaAtLeast "11.4") [
       "CUDA_HOME=${cuda_nvcc}"
       "CUDA_LIB=${lib.getLib cuda_cudart}/lib"
       "CUDA_INC=${lib.getDev cuda_cudart}/include"
diff --git a/pkgs/development/cuda-modules/saxpy/default.nix b/pkgs/development/cuda-modules/saxpy/default.nix
index 2a2eedbcb1db..a36cec3e692b 100644
--- a/pkgs/development/cuda-modules/saxpy/default.nix
+++ b/pkgs/development/cuda-modules/saxpy/default.nix
@@ -10,8 +10,9 @@ let
     cuda_cccl
     cuda_cudart
     cuda_nvcc
+    cudaAtLeast
+    cudaOlder
     cudatoolkit
-    cudaVersion
     flags
     libcublas
     setupCudaHook
@@ -24,6 +25,7 @@ backendStdenv.mkDerivation {
 
   src = ./.;
 
+  __structuredAttrs = true;
   strictDeps = true;
 
   nativeBuildInputs =
@@ -31,24 +33,22 @@ backendStdenv.mkDerivation {
       cmake
       autoAddDriverRunpath
     ]
-    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [ cuda_nvcc ];
+    ++ lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [ cuda_nvcc ];
 
   buildInputs =
-    lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+    lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [
       (getDev libcublas)
       (getLib libcublas)
       (getOutput "static" libcublas)
       cuda_cudart
     ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [ cuda_cccl ];
+    ++ lib.optionals (cudaAtLeast "12.0") [ cuda_cccl ];
 
-  cmakeFlags = [
+  cmakeFlagsArray = [
     (lib.cmakeBool "CMAKE_VERBOSE_MAKEFILE" true)
-    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" (
-      with flags; lib.concatStringsSep ";" (lib.lists.map dropDot cudaCapabilities)
-    ))
+    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" flags.cmakeCudaArchitecturesString)
   ];
 
   meta = rec {
@@ -56,6 +56,6 @@ backendStdenv.mkDerivation {
     license = lib.licenses.mit;
     maintainers = lib.teams.cuda.members;
     platforms = lib.platforms.unix;
-    badPlatforms = lib.optionals flags.isJetsonBuild platforms;
+    badPlatforms = lib.optionals (flags.isJetsonBuild && cudaOlder "11.4") platforms;
   };
 }
diff --git a/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh b/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh
index ba04c2e0806a..0abd651005c6 100644
--- a/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh
+++ b/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh
@@ -1,14 +1,25 @@
 # shellcheck shell=bash
 
-# Should we mimick cc-wrapper's "hygiene"?
-[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0
+(( ${hostOffset:?} == -1 && ${targetOffset:?} == 0)) || return 0
 
 echo "Sourcing mark-for-cudatoolkit-root-hook" >&2
 
 markForCUDAToolkit_ROOT() {
-    mkdir -p "${prefix}/nix-support"
-    [[ -f "${prefix}/nix-support/include-in-cudatoolkit-root" ]] && return
-    echo "$pname-$output" > "${prefix}/nix-support/include-in-cudatoolkit-root"
+    mkdir -p "${prefix:?}/nix-support"
+    local markerPath="$prefix/nix-support/include-in-cudatoolkit-root"
+
+    # Return early if the file already exists.
+    [[ -f "$markerPath" ]] && return 0
+
+    # Always create the file, even if it's empty, since setup-cuda-hook relies on its existence.
+    # However, only populate it if strictDeps is not set.
+    touch "$markerPath"
+
+    # Return early if strictDeps is set.
+    [[ -n "${strictDeps-}" ]] && return 0
+
+    # Populate the file with the package name and output.
+    echo "${pname:?}-${output:?}" > "$markerPath"
 }
 
 fixupOutputHooks+=(markForCUDAToolkit_ROOT)
diff --git a/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh b/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
index a4a444fcd241..6e57c7b1072e 100644
--- a/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
+++ b/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
@@ -9,7 +9,7 @@ reason=
 [[ -n ${cudaSetupHookOnce-} ]] && guard=Skipping && reason=" because the hook has been propagated more than once"
 
 if (( "${NIX_DEBUG:-0}" >= 1 )) ; then
-    echo "$guard hostOffset=$hostOffset targetOffset=$targetOffset setupCudaHook$reason" >&2
+    echo "$guard hostOffset=$hostOffset targetOffset=$targetOffset setup-cuda-hook$reason" >&2
 else
     echo "$guard setup-cuda-hook$reason" >&2
 fi
@@ -24,16 +24,19 @@ extendcudaHostPathsSeen() {
     (( "${NIX_DEBUG:-0}" >= 1 )) && echo "extendcudaHostPathsSeen $1" >&2
 
     local markerPath="$1/nix-support/include-in-cudatoolkit-root"
-    [[ ! -f "${markerPath}" ]] && return
-    [[ -v cudaHostPathsSeen[$1] ]] && return
+    [[ ! -f "${markerPath}" ]] && return 0
+    [[ -v cudaHostPathsSeen[$1] ]] && return 0
 
     cudaHostPathsSeen["$1"]=1
 
     # E.g. cuda_cudart-lib
     local cudaOutputName
-    read -r cudaOutputName < "$markerPath"
+    # Fail gracefully if the file is empty.
+    # One reason the file may be empty: the package was built with strictDeps set, but the current build does not have
+    # strictDeps set.
+    read -r cudaOutputName < "$markerPath" || return 0
 
-    [[ -z "$cudaOutputName" ]] && return
+    [[ -z "$cudaOutputName" ]] && return 0
 
     local oldPath="${cudaOutputToPath[$cudaOutputName]-}"
     [[ -n "$oldPath" ]] && echo "extendcudaHostPathsSeen: warning: overwriting $cudaOutputName from $oldPath to $1" >&2
@@ -59,7 +62,7 @@ setupCUDAToolkitCompilers() {
     echo Executing setupCUDAToolkitCompilers >&2
 
     if [[ -n "${dontSetupCUDAToolkitCompilers-}" ]] ; then
-        return
+        return 0
     fi
 
     # Point NVCC at a compatible compiler
@@ -99,7 +102,7 @@ preConfigureHooks+=(setupCUDAToolkitCompilers)
 propagateCudaLibraries() {
     (( "${NIX_DEBUG:-0}" >= 1 )) && echo "propagateCudaLibraries: cudaPropagateToOutput=$cudaPropagateToOutput cudaHostPathsSeen=${!cudaHostPathsSeen[*]}" >&2
 
-    [[ -z "${cudaPropagateToOutput-}" ]] && return
+    [[ -z "${cudaPropagateToOutput-}" ]] && return 0
 
     mkdir -p "${!cudaPropagateToOutput}/nix-support"
     # One'd expect this should be propagated-bulid-build-deps, but that doesn't seem to work
diff --git a/pkgs/development/cuda-modules/tensorrt/fixup.nix b/pkgs/development/cuda-modules/tensorrt/fixup.nix
index 3615284fb080..42359aedac11 100644
--- a/pkgs/development/cuda-modules/tensorrt/fixup.nix
+++ b/pkgs/development/cuda-modules/tensorrt/fixup.nix
@@ -1,12 +1,12 @@
 {
   cudaVersion,
   final,
-  hostPlatform,
   lib,
   mkVersionedPackageName,
   package,
   patchelf,
   requireFile,
+  stdenv,
   ...
 }:
 let
@@ -17,6 +17,7 @@ let
     strings
     versions
     ;
+  inherit (stdenv) hostPlatform;
   # targetArch :: String
   targetArch = attrsets.attrByPath [ hostPlatform.system ] "unsupported" {
     x86_64-linux = "x86_64-linux-gnu";
diff --git a/pkgs/development/libraries/LAStools/default.nix b/pkgs/development/libraries/LAStools/default.nix
index 2f2b3b23ae31..5dfd6570c080 100644
--- a/pkgs/development/libraries/LAStools/default.nix
+++ b/pkgs/development/libraries/LAStools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "LAStools";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "LAStools";
     repo = "LAStools";
     rev = "v${version}";
-    sha256 = "sha256-HL64koe0GNzJzyA0QP4I0M1y2HSxigsZTqOw67RCwNc=";
+    sha256 = "sha256-IyZjM8YvIVB0VPNuEhmHHw7EuKw5RanB2qhCnBD1fRY=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
index f1b4fcb7a847..e1ed990dc0b3 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
@@ -11,7 +11,7 @@
 
 qtModule {
   pname = "qtdeclarative";
-  strictDeps = true;
+  strictDeps = !stdenv.isDarwin; # fails to detect python3 otherwise
   propagatedBuildInputs = [ qtbase qtlanguageserver qtshadertools openssl ];
   nativeBuildInputs = [ python3 ];
   patches = [
diff --git a/pkgs/development/node-packages/main-programs.nix b/pkgs/development/node-packages/main-programs.nix
index ebf1f9ca4af6..90093aaafde1 100644
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@@ -51,7 +51,6 @@
   purs-tidy = "purs-tidy";
   purty = "purty";
   pscid = "pscid";
-  pyright = "pyright";
   remod-cli = "remod";
   svelte-language-server = "svelteserver";
   teck-programmer = "teck-firmware-upgrade";
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index f7015177d57b..c0d021e9f472 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -200,7 +200,6 @@
 , "purescript-psa"
 , "purs-tidy"
 , "purty"
-, "pyright"
 , "remod-cli"
 , "reveal.js"
 , "rimraf"
diff --git a/pkgs/development/ocaml-modules/clap/default.nix b/pkgs/development/ocaml-modules/clap/default.nix
new file mode 100644
index 000000000000..83d420c80f33
--- /dev/null
+++ b/pkgs/development/ocaml-modules/clap/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, fetchFromGitHub
+, buildDunePackage
+}:
+
+buildDunePackage rec {
+  pname = "clap";
+  version = "0.3.0";
+
+  minimalOCamlVersion = "4.07";
+
+  src = fetchFromGitHub {
+    owner = "rbardou";
+    repo = pname;
+    rev = version;
+    hash = "sha256-IEol27AVYs55ntvNprBxOk3/EsBKAdPkF3Td3w9qOJg=";
+  };
+
+  meta = {
+    description = "Command-Line Argument Parsing, imperative style with a consumption mechanism";
+    license = lib.licenses.mit;
+  };
+}
+
diff --git a/pkgs/development/ocaml-modules/data-encoding/default.nix b/pkgs/development/ocaml-modules/data-encoding/default.nix
index db139d2b26ae..f94abebbcbdf 100644
--- a/pkgs/development/ocaml-modules/data-encoding/default.nix
+++ b/pkgs/development/ocaml-modules/data-encoding/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitLab
 , buildDunePackage
 , ppx_hash
+, bigstringaf
 , either
 , ezjsonm
 , zarith
@@ -16,19 +17,12 @@
 
 buildDunePackage rec {
   pname = "data-encoding";
-  version = "0.7.1";
+  inherit (json-data-encoding) src version;
 
-  duneVersion = "3";
   minimalOCamlVersion = "4.10";
 
-  src = fetchFromGitLab {
-    owner = "nomadic-labs";
-    repo = "data-encoding";
-    rev = "v${version}";
-    hash = "sha256-V3XiCCtoU+srOI+KVSJshtaSJLBJ4m4o10GpBfdYKCU=";
-  };
-
   propagatedBuildInputs = [
+    bigstringaf
     either
     ezjsonm
     ppx_hash
@@ -39,14 +33,10 @@ buildDunePackage rec {
     json-data-encoding-bson
   ];
 
-  checkInputs = [
-    alcotest
-    crowbar
+  buildInputs = [
     ppx_expect
   ];
 
-  doCheck = true;
-
   meta = {
     homepage = "https://gitlab.com/nomadic-labs/data-encoding";
     description = "Library of JSON and binary encoding combinators";
diff --git a/pkgs/development/ocaml-modules/index/default.nix b/pkgs/development/ocaml-modules/index/default.nix
index ebc050787555..3cc3643429c7 100644
--- a/pkgs/development/ocaml-modules/index/default.nix
+++ b/pkgs/development/ocaml-modules/index/default.nix
@@ -6,15 +6,14 @@
 
 buildDunePackage rec {
   pname = "index";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "https://github.com/mirage/index/releases/download/${version}/index-${version}.tbz";
-    hash = "sha256-rPwNzqkWqDak2mDTDIBqIvachY1vfOIzFmwaXjZea+4=";
+    hash = "sha256-k4iDUJik7UTuztBw7YaFXASd8SqYMR1JgLm3JOyriGA=";
   };
 
   minimalOCamlVersion = "4.08";
-  duneVersion = "3";
 
   buildInputs = [
     stdlib-shims
diff --git a/pkgs/development/ocaml-modules/irmin/chunk.nix b/pkgs/development/ocaml-modules/irmin/chunk.nix
index 59bd81544945..3e7f3c2a1b70 100644
--- a/pkgs/development/ocaml-modules/irmin/chunk.nix
+++ b/pkgs/development/ocaml-modules/irmin/chunk.nix
@@ -3,7 +3,7 @@
 buildDunePackage rec {
 
   pname = "irmin-chunk";
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   propagatedBuildInputs = [ irmin fmt logs lwt ];
 
diff --git a/pkgs/development/ocaml-modules/irmin/containers.nix b/pkgs/development/ocaml-modules/irmin/containers.nix
index 73cd25f3170d..32677d9604c2 100644
--- a/pkgs/development/ocaml-modules/irmin/containers.nix
+++ b/pkgs/development/ocaml-modules/irmin/containers.nix
@@ -6,7 +6,7 @@
 buildDunePackage {
   pname = "irmin-containers";
 
-  inherit (ppx_irmin) src version strictDeps;
+  inherit (ppx_irmin) src version;
 
   nativeBuildInputs = [
     ppx_irmin
diff --git a/pkgs/development/ocaml-modules/irmin/default.nix b/pkgs/development/ocaml-modules/irmin/default.nix
index d273d19553c1..3f6e551e6713 100644
--- a/pkgs/development/ocaml-modules/irmin/default.nix
+++ b/pkgs/development/ocaml-modules/irmin/default.nix
@@ -7,7 +7,7 @@
 buildDunePackage {
   pname = "irmin";
 
-  inherit (ppx_irmin) src version strictDeps;
+  inherit (ppx_irmin) src version;
 
   minimalOCamlVersion = "4.10";
 
diff --git a/pkgs/development/ocaml-modules/irmin/fs.nix b/pkgs/development/ocaml-modules/irmin/fs.nix
index 1788cf1eda23..8d56e90fad8b 100644
--- a/pkgs/development/ocaml-modules/irmin/fs.nix
+++ b/pkgs/development/ocaml-modules/irmin/fs.nix
@@ -6,7 +6,7 @@ buildDunePackage rec {
 
   pname = "irmin-fs";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   propagatedBuildInputs = [ irmin astring logs lwt ];
 
diff --git a/pkgs/development/ocaml-modules/irmin/git.nix b/pkgs/development/ocaml-modules/irmin/git.nix
index 387fc60a0aa9..1e4397e89298 100644
--- a/pkgs/development/ocaml-modules/irmin/git.nix
+++ b/pkgs/development/ocaml-modules/irmin/git.nix
@@ -9,7 +9,7 @@ buildDunePackage {
 
   pname = "irmin-git";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   propagatedBuildInputs = [
     git
diff --git a/pkgs/development/ocaml-modules/irmin/http.nix b/pkgs/development/ocaml-modules/irmin/http.nix
deleted file mode 100644
index 1b376425bdce..000000000000
--- a/pkgs/development/ocaml-modules/irmin/http.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ lib, buildDunePackage, astring, cohttp-lwt, cohttp-lwt-unix, irmin, webmachine
-, fmt, jsonm, logs, lwt, uri
-, git-unix, irmin-git, irmin-test, irmin-fs, digestif
-, cacert
-}:
-
-buildDunePackage rec {
-
-  pname = "irmin-http";
-
-  inherit (irmin) version src strictDeps;
-
-  propagatedBuildInputs = [ astring cohttp-lwt cohttp-lwt-unix fmt jsonm logs lwt uri irmin webmachine ];
-
-  checkInputs = [
-    digestif git-unix irmin-git irmin-test irmin-fs cacert
-  ];
-
-  doCheck = true;
-
-  meta = irmin.meta // {
-    description = "HTTP client and server for Irmin";
-  };
-
-}
diff --git a/pkgs/development/ocaml-modules/irmin/mirage-git.nix b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
index 09c1820d6094..7528e469913f 100644
--- a/pkgs/development/ocaml-modules/irmin/mirage-git.nix
+++ b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
@@ -6,7 +6,7 @@
 buildDunePackage {
   pname = "irmin-mirage-git";
 
-  inherit (irmin-mirage) version src strictDeps;
+  inherit (irmin-mirage) version src;
 
   propagatedBuildInputs = [
     irmin-mirage
diff --git a/pkgs/development/ocaml-modules/irmin/mirage-graphql.nix b/pkgs/development/ocaml-modules/irmin/mirage-graphql.nix
index bfbe45b39019..1973cde8c3b6 100644
--- a/pkgs/development/ocaml-modules/irmin/mirage-graphql.nix
+++ b/pkgs/development/ocaml-modules/irmin/mirage-graphql.nix
@@ -5,7 +5,7 @@
 buildDunePackage {
   pname = "irmin-mirage-graphql";
 
-  inherit (irmin-mirage) version src strictDeps;
+  inherit (irmin-mirage) version src;
 
   propagatedBuildInputs = [
     irmin-mirage
diff --git a/pkgs/development/ocaml-modules/irmin/mirage.nix b/pkgs/development/ocaml-modules/irmin/mirage.nix
index 9e4bd9330799..eabb1e5874e8 100644
--- a/pkgs/development/ocaml-modules/irmin/mirage.nix
+++ b/pkgs/development/ocaml-modules/irmin/mirage.nix
@@ -3,7 +3,7 @@
 buildDunePackage {
   pname = "irmin-mirage";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   propagatedBuildInputs = [
     irmin fmt ptime mirage-clock
diff --git a/pkgs/development/ocaml-modules/irmin/pack.nix b/pkgs/development/ocaml-modules/irmin/pack.nix
index 9afb40c20766..3a00c5e99f5f 100644
--- a/pkgs/development/ocaml-modules/irmin/pack.nix
+++ b/pkgs/development/ocaml-modules/irmin/pack.nix
@@ -8,7 +8,7 @@ buildDunePackage rec {
 
   pname = "irmin-pack";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   nativeBuildInputs = [ ppx_irmin ];
 
diff --git a/pkgs/development/ocaml-modules/irmin/ppx.nix b/pkgs/development/ocaml-modules/irmin/ppx.nix
index 78207bf009e8..23165099443e 100644
--- a/pkgs/development/ocaml-modules/irmin/ppx.nix
+++ b/pkgs/development/ocaml-modules/irmin/ppx.nix
@@ -2,11 +2,11 @@
 
 buildDunePackage rec {
   pname = "ppx_irmin";
-  version = "3.7.2";
+  version = "3.9.0";
 
   src = fetchurl {
     url = "https://github.com/mirage/irmin/releases/download/${version}/irmin-${version}.tbz";
-    hash = "sha256-aqW6TGoCM3R9S9OrOW8rOjO7gPnY7UoXjIOgNQM8DlI=";
+    hash = "sha256-jgc6vhtf+1ttWMMmBsnX2rwyxTUBdWvoCpLtR3etUaA=";
   };
 
   minimalOCamlVersion = "4.10";
diff --git a/pkgs/development/ocaml-modules/irmin/test.nix b/pkgs/development/ocaml-modules/irmin/test.nix
index 942200bf429a..a0e206cade72 100644
--- a/pkgs/development/ocaml-modules/irmin/test.nix
+++ b/pkgs/development/ocaml-modules/irmin/test.nix
@@ -1,13 +1,13 @@
 { buildDunePackage, irmin, ppx_irmin, mtime, astring, fmt, jsonm, logs, lwt
 , metrics-unix, ocaml-syntax-shims, cmdliner, metrics, alcotest-lwt
-, hex, vector
+, hex, vector, qcheck-alcotest
 }:
 
 buildDunePackage {
 
   pname = "irmin-test";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   nativeBuildInputs = [ ppx_irmin ];
 
@@ -27,7 +27,8 @@ buildDunePackage {
     metrics
   ];
 
-  checkInputs = [ hex vector ];
+  doCheck = true;
+  checkInputs = [ hex qcheck-alcotest vector ];
 
   meta = irmin.meta // {
     description = "Irmin test suite";
diff --git a/pkgs/development/ocaml-modules/irmin/tezos.nix b/pkgs/development/ocaml-modules/irmin/tezos.nix
index 82a89daec359..ec005921c938 100644
--- a/pkgs/development/ocaml-modules/irmin/tezos.nix
+++ b/pkgs/development/ocaml-modules/irmin/tezos.nix
@@ -6,7 +6,7 @@
 buildDunePackage rec {
   pname = "irmin-tezos";
 
-  inherit (irmin) version src strictDeps;
+  inherit (irmin) version src;
 
   propagatedBuildInputs = [
     irmin
diff --git a/pkgs/development/ocaml-modules/json-data-encoding/bson.nix b/pkgs/development/ocaml-modules/json-data-encoding/bson.nix
index c0d1a5260bc7..46810ab1566b 100644
--- a/pkgs/development/ocaml-modules/json-data-encoding/bson.nix
+++ b/pkgs/development/ocaml-modules/json-data-encoding/bson.nix
@@ -5,8 +5,6 @@ buildDunePackage {
 
   inherit (json-data-encoding) version src doCheck;
 
-  duneVersion = "3";
-
   propagatedBuildInputs = [
     json-data-encoding
     ocplib-endian
diff --git a/pkgs/development/ocaml-modules/json-data-encoding/default.nix b/pkgs/development/ocaml-modules/json-data-encoding/default.nix
index c517725c74e2..5bb3f7701bba 100644
--- a/pkgs/development/ocaml-modules/json-data-encoding/default.nix
+++ b/pkgs/development/ocaml-modules/json-data-encoding/default.nix
@@ -1,28 +1,21 @@
-{ lib, fetchFromGitLab, buildDunePackage, uri, crowbar, alcotest }:
+{ lib, fetchFromGitLab, buildDunePackage, hex, uri }:
 
 buildDunePackage rec {
   pname = "json-data-encoding";
-  version = "0.12.1";
+  version = "1.0.1";
   minimalOCamlVersion = "4.10";
-  duneVersion = "3";
   src = fetchFromGitLab {
     owner = "nomadic-labs";
-    repo = "json-data-encoding";
-    rev = version;
-    hash = "sha256-ticulOKiFNQIZNFOQE9UQOw/wqRfygQwLVIc4kkmwg4=";
+    repo = "data-encoding";
+    rev = "v${version}";
+    hash = "sha256-KoA4xX4tNyi6bX5kso/Wof1LA7431EXJ34eD5X4jnd8=";
   };
 
   propagatedBuildInputs = [
+    hex
     uri
   ];
 
-  checkInputs = [
-    crowbar
-    alcotest
-  ];
-
-  doCheck = true;
-
   meta = {
     homepage = "https://gitlab.com/nomadic-labs/json-data-encoding";
     description = "Type-safe encoding to and decoding from JSON";
diff --git a/pkgs/development/ocaml-modules/mirage-kv/default.nix b/pkgs/development/ocaml-modules/mirage-kv/default.nix
index d32a9e3935e5..97eb3128e15b 100644
--- a/pkgs/development/ocaml-modules/mirage-kv/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-kv/default.nix
@@ -1,22 +1,23 @@
 { lib, fetchurl, buildDunePackage
 , fmt
 , lwt
+, optint
+, ptime
 , alcotest
 }:
 
 buildDunePackage rec {
   pname = "mirage-kv";
-  version = "4.0.1";
+  version = "6.1.1";
 
-  duneVersion = "3";
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-kv/releases/download/v${version}/mirage-kv-${version}.tbz";
-    hash = "sha256-p6i4zUVgxtTnUiBIjb8W6u9xRTczVl4WwfFcl5tVqnE=";
+    hash = "sha256-fNXNlaDpb5zUA2rTwi5h1j4v4LQmovxG+Am6u+1guPQ=";
   };
 
-  propagatedBuildInputs = [ fmt lwt ];
+  propagatedBuildInputs = [ fmt lwt optint ptime ];
 
   doCheck = true;
   checkInputs = [ alcotest ];
diff --git a/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix b/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
index 85b741dbc199..e3627431d959 100644
--- a/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-freestanding/default.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.sternenseemann ];
     homepage = "https://github.com/mirage/ocaml-freestanding";
     platforms = builtins.map ({ arch, os }: "${arch}-${os}")
-      (cartesianProductOfSets {
+      (cartesianProduct {
           arch = [ "aarch64" "x86_64" ];
           os = [ "linux" ];
       } ++ [
diff --git a/pkgs/development/ocaml-modules/progress/default.nix b/pkgs/development/ocaml-modules/progress/default.nix
index b714cdf33712..7ca95a088243 100644
--- a/pkgs/development/ocaml-modules/progress/default.nix
+++ b/pkgs/development/ocaml-modules/progress/default.nix
@@ -7,7 +7,6 @@ buildDunePackage rec {
   pname = "progress";
 
   minimalOCamlVersion = "4.08";
-  duneVersion = "3";
 
   inherit (terminal) version src;
 
diff --git a/pkgs/development/ocaml-modules/terminal/default.nix b/pkgs/development/ocaml-modules/terminal/default.nix
index 1700da060689..8daf53abdb50 100644
--- a/pkgs/development/ocaml-modules/terminal/default.nix
+++ b/pkgs/development/ocaml-modules/terminal/default.nix
@@ -5,14 +5,13 @@
 
 buildDunePackage rec {
   pname = "terminal";
-  version = "0.2.1";
+  version = "0.2.2";
 
   minimalOCamlVersion = "4.03";
-  duneVersion = "3";
 
   src = fetchurl {
-    url = "https://github.com/CraigFe/progress/releases/download/${version}/terminal-${version}.tbz";
-    hash = "sha256:0vjqkvmpyi8kvmb4vrx3f0994rph8i9pvlrz1dyi126vlb2zbrvs";
+    url = "https://github.com/CraigFe/progress/releases/download/${version}/progress-${version}.tbz";
+    hash = "sha256-M0HCGSOiHNa1tc+p7DmB9ZVyw2eUD+XgJFBTPftBELU=";
   };
 
   propagatedBuildInputs = [ stdlib-shims uutf uucp ];
diff --git a/pkgs/development/ocaml-modules/tezt/default.nix b/pkgs/development/ocaml-modules/tezt/default.nix
new file mode 100644
index 000000000000..afad07e77917
--- /dev/null
+++ b/pkgs/development/ocaml-modules/tezt/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, fetchFromGitLab
+, buildDunePackage
+, clap
+, ezjsonm
+, lwt
+, re
+}:
+
+buildDunePackage rec {
+  pname = "tezt";
+  version = "4.0.0";
+
+  minimalOCamlVersion = "4.12";
+
+  src = fetchFromGitLab {
+    owner = "nomadic-labs";
+    repo = pname;
+    rev = version;
+    hash = "sha256-waFjE/yR+XAJOew1YsCnbvsJR8oe9gflyVj4yXAvNuM=";
+  };
+
+  propagatedBuildInputs = [
+    clap
+    ezjsonm
+    lwt
+    re
+  ];
+
+  meta = {
+    description = "Test framework for unit tests, integration tests, and regression tests";
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/php-packages/opentelemetry/default.nix b/pkgs/development/php-packages/opentelemetry/default.nix
index 360f4cc43841..6770ecb432a6 100644
--- a/pkgs/development/php-packages/opentelemetry/default.nix
+++ b/pkgs/development/php-packages/opentelemetry/default.nix
@@ -15,6 +15,8 @@ in buildPecl rec {
 
   sourceRoot = "${src.name}/ext";
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-parentheses-equality";
+
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/accuweather/default.nix b/pkgs/development/python-modules/accuweather/default.nix
index 6069d06d9984..e27c61766556 100644
--- a/pkgs/development/python-modules/accuweather/default.nix
+++ b/pkgs/development/python-modules/accuweather/default.nix
@@ -1,30 +1,35 @@
-{ lib
-, aiohttp
-, aioresponses
-, buildPythonPackage
-, fetchFromGitHub
-, orjson
-, pytest-asyncio
-, pytest-error-for-skips
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  buildPythonPackage,
+  fetchFromGitHub,
+  orjson,
+  pytest-asyncio,
+  pytest-error-for-skips,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  syrupy,
 }:
 
 buildPythonPackage rec {
   pname = "accuweather";
-  version = "2.1.1";
-  format = "setuptools";
+  version = "3.0.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "bieniu";
-    repo = pname;
+    repo = "accuweather";
     rev = "refs/tags/${version}";
-    hash = "sha256-hbmeQnxVhBbXKHNdeXzAwRnMKBNvKsdfHg8MzALinhc=";
+    hash = "sha256-hnKwK0I8C8Xh7yn4yk2DqowqgyZYDB22IEllm5MeIGo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     aiohttp
     orjson
   ];
@@ -34,11 +39,10 @@ buildPythonPackage rec {
     pytest-asyncio
     pytest-error-for-skips
     pytestCheckHook
+    syrupy
   ];
 
-  pythonImportsCheck = [
-    "accuweather"
-  ];
+  pythonImportsCheck = [ "accuweather" ];
 
   meta = with lib; {
     description = "Python wrapper for getting weather data from AccuWeather servers";
diff --git a/pkgs/development/python-modules/aiounifi/default.nix b/pkgs/development/python-modules/aiounifi/default.nix
index 6f4b5e2c4f32..05784995f70e 100644
--- a/pkgs/development/python-modules/aiounifi/default.nix
+++ b/pkgs/development/python-modules/aiounifi/default.nix
@@ -1,21 +1,22 @@
-{ lib
-, aiohttp
-, aioresponses
-, buildPythonPackage
-, fetchFromGitHub
-, orjson
-, pytest-aiohttp
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
-, segno
-, setuptools
-, trustme
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  buildPythonPackage,
+  fetchFromGitHub,
+  orjson,
+  pytest-aiohttp,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  segno,
+  setuptools,
+  trustme,
 }:
 
 buildPythonPackage rec {
   pname = "aiounifi";
-  version = "74";
+  version = "75";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = "aiounifi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5xxgpbnTqR8AWUvRQJiXGJECn0neV8QQyjYKw09sqZg=";
+    hash = "sha256-IPm3/i+JJpjVfRFq+Yq1mfajHL/mOARk5koyy/t37NQ=";
   };
 
   postPatch = ''
@@ -35,9 +36,7 @@ buildPythonPackage rec {
     sed -i '/--cov=/d' pyproject.toml
   '';
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     aiohttp
@@ -53,13 +52,9 @@ buildPythonPackage rec {
     trustme
   ];
 
-  pytestFlagsArray = [
-    "--asyncio-mode=auto"
-  ];
+  pytestFlagsArray = [ "--asyncio-mode=auto" ];
 
-  pythonImportsCheck = [
-    "aiounifi"
-  ];
+  pythonImportsCheck = [ "aiounifi" ];
 
   meta = with lib; {
     description = "Python library for communicating with Unifi Controller API";
diff --git a/pkgs/development/python-modules/aiozeroconf/default.nix b/pkgs/development/python-modules/aiozeroconf/default.nix
index bfe406b05364..aba0ed77c731 100644
--- a/pkgs/development/python-modules/aiozeroconf/default.nix
+++ b/pkgs/development/python-modules/aiozeroconf/default.nix
@@ -1,28 +1,35 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, netifaces
-, isPy27
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  netifaces,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "aiozeroconf";
   version = "0.1.8";
-  format = "setuptools";
-  disabled = isPy27;
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "074plydm7sd113p3k0siihwwz62d3r42q3g83vqaffp569msknqh";
+    hash = "sha256-ENupazLlOqfwHugNLEgeTZjPOYxRgznuCKHpU5unlxw=";
   };
 
-  propagatedBuildInputs = [ netifaces ];
+  build-system = [ setuptools ];
+
+  dependencies = [ netifaces ];
+
+  pythonImportsCheck = [ "aiozeroconf" ];
 
   meta = with lib; {
-    description = "A pure python implementation of multicast DNS service discovery";
-    mainProgram = "aiozeroconf";
+    description = "Implementation of multicast DNS service discovery";
     homepage = "https://github.com/jstasiak/python-zeroconf";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Only;
     maintainers = with maintainers; [ obadz ];
+    mainProgram = "aiozeroconf";
   };
 }
diff --git a/pkgs/development/python-modules/argilla/default.nix b/pkgs/development/python-modules/argilla/default.nix
index bd05a3d076f5..d3b87ca99f44 100644
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@@ -65,7 +65,7 @@
 }:
 let
   pname = "argilla";
-  version = "1.26.1";
+  version = "1.27.0";
   optional-dependencies = {
     server = [
       fastapi
@@ -126,7 +126,7 @@ buildPythonPackage {
     owner = "argilla-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7d8zvP06GrHrSEJn2NNv2BUNea1wamf21e+qa1dZU18=";
+    hash = "sha256-CBVP/+XFKnJBMcxsDd7lgQ1JFX7zFlHmdBwkAMmq85g=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 80176e169a9c..97a05b6d10cc 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -366,7 +366,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.84";
+  version = "1.34.87";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -374,7 +374,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-c7u1CaacSsjM4DivsVEGhriDmMvUbV3x4yOPzmbfmvU=";
+    hash = "sha256-fGIC78m332fXc8IYRCcwA/pmx41z7kKE4u9L9rrMCHo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 1edd288f30ac..3a1e67f4a071 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.34.86";
+  version = "1.34.87";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-Lg0XDWJ0VKHYtoXvP07tjArfY08Z6clvGVyjrvc3pi4=";
+    hash = "sha256-Dy67vF7mCc19wz/In6b4i+yLvir8+BSteoi+AOp3QdY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/catkin-pkg/default.nix b/pkgs/development/python-modules/catkin-pkg/default.nix
new file mode 100644
index 000000000000..c9ddf02b05f4
--- /dev/null
+++ b/pkgs/development/python-modules/catkin-pkg/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  docutils,
+  pyparsing,
+  python-dateutil,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "catkin-pkg";
+  version = "0.5.2";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ros-infrastructure";
+    repo = "catkin_pkg";
+    rev = version;
+    hash = "sha256-DjaPpLDsLpYOZukf5tYe6ZetSNTe/DJ2lS9BUsehZ8k=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    docutils
+    pyparsing
+    python-dateutil
+  ];
+
+  pythonImportsCheck = [ "catkin_pkg" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTestPaths = [ "test/test_flake8.py" ];
+
+  meta = {
+    description = "Library for retrieving information about catkin packages.";
+    homepage = "http://wiki.ros.org/catkin_pkg";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+  };
+}
diff --git a/pkgs/development/python-modules/consonance/default.nix b/pkgs/development/python-modules/consonance/default.nix
index b14d965e5629..e13665cd5dc3 100644
--- a/pkgs/development/python-modules/consonance/default.nix
+++ b/pkgs/development/python-modules/consonance/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , dissononce
 , python-axolotl-curve25519
 , transitions
@@ -23,6 +24,15 @@ buildPythonPackage rec {
     hash = "sha256-BhgxLxjKZ4dSL7DqkaoS+wBPCd1SYZomRKrtDLdGmYQ=";
   };
 
+  patches = [
+    # https://github.com/tgalal/consonance/pull/9
+    (fetchpatch {
+      name = "fix-type-error.patch";
+      url = "https://github.com/tgalal/consonance/pull/9/commits/92fb78af98a18f0533ec8a286136968174fb0baf.patch";
+      hash = "sha256-wVUGxZ4W2zPyrcQPQTc85LcRUtsLbTBVzS10NEolpQY=";
+    })
+  ];
+
   propagatedBuildInputs = [
     dissononce
     python-axolotl-curve25519
diff --git a/pkgs/development/python-modules/craft-application/default.nix b/pkgs/development/python-modules/craft-application/default.nix
new file mode 100644
index 000000000000..0b90ccdff058
--- /dev/null
+++ b/pkgs/development/python-modules/craft-application/default.nix
@@ -0,0 +1,114 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  git,
+  craft-archives,
+  craft-cli,
+  craft-grammar,
+  craft-parts,
+  craft-providers,
+  pydantic-yaml-0,
+  pyyaml,
+  setuptools,
+  setuptools-scm,
+  snap-helpers,
+  stdenv,
+  pygit2,
+  pyfakefs,
+  pytestCheckHook,
+  pytest-check,
+  pytest-mock,
+  responses,
+  hypothesis,
+}:
+
+buildPythonPackage rec {
+  pname = "craft-application";
+  version = "2.5.0";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "craft-application";
+    rev = "refs/tags/${version}";
+    hash = "sha256-66Ldo88DJ6v0+ekvDl++eDzhdn95yxq0SMdzQxTGl5k=";
+  };
+
+  postPatch = ''
+    substituteInPlace craft_application/__init__.py \
+      --replace-fail "dev" "${version}"
+
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools==69.4.0" "setuptools"
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    craft-archives
+    craft-cli
+    craft-grammar
+    craft-parts
+    craft-providers
+    pydantic-yaml-0
+    pygit2
+    pyyaml
+    snap-helpers
+  ];
+
+  pythonImportsCheck = [ "craft_application" ];
+
+  nativeCheckInputs = [
+    git
+    hypothesis
+    pyfakefs
+    pytest-check
+    pytest-mock
+    pytestCheckHook
+    responses
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+
+    # Tests require access to /etc/os-release, which isn't accessible in
+    # the test environment, so create a fake file, and modify the code
+    # to look for it.
+    echo 'ID=nixos' > $HOME/os-release
+    echo 'NAME=NixOS' >> $HOME/os-release
+    echo 'VERSION_ID="24.05"' >> $HOME/os-release
+
+    substituteInPlace craft_application/util/platforms.py \
+      --replace-fail "os_utils.OsRelease()" "os_utils.OsRelease(os_release_file='$HOME/os-release')"
+  '';
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  disabledTests = [
+    "test_to_yaml_file"
+    # Tests expecting pytest-time
+    "test_monitor_builds_success"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    # These tests have hardcoded "amd64" strings which fail on aarch64
+    "test_process_grammar_build_for"
+    "test_process_grammar_platform"
+    "test_process_grammar_default"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "The basis for Canonical craft applications";
+    homepage = "https://github.com/canonical/craft-application";
+    changelog = "https://github.com/canonical/craft-application/releases/tag/${version}";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/craft-providers/default.nix b/pkgs/development/python-modules/craft-providers/default.nix
index e3c384f455ba..4f463e628bd6 100644
--- a/pkgs/development/python-modules/craft-providers/default.nix
+++ b/pkgs/development/python-modules/craft-providers/default.nix
@@ -33,6 +33,11 @@ buildPythonPackage rec {
   };
 
   patches = [
+    # This lib will try to inject snaps *from the host system* into the build
+    # system. This patch short-circuits that logic and ensures that snaps are
+    # installed on the build system from the snap store - because there is no
+    # snapd on NixOS hosts that can be used for the injection. This patch will
+    # likely never be accepted upstream.
     ./inject-snaps.patch
   ];
 
diff --git a/pkgs/development/python-modules/craft-providers/inject-snaps.patch b/pkgs/development/python-modules/craft-providers/inject-snaps.patch
index 85dec7f8bd97..37f9f2f82d7e 100644
--- a/pkgs/development/python-modules/craft-providers/inject-snaps.patch
+++ b/pkgs/development/python-modules/craft-providers/inject-snaps.patch
@@ -38,7 +38,7 @@ index 3c914a2..d9c2cf9 100644
 -                        details=error.details,
 -                    ) from error
 +            try:
-+                channel = "latest/edge" if snap.name == "rockcraft" else "latest/stable"
++                channel = "latest/beta"
 +                snap_installer.install_from_store(
 +                    executor=executor,
 +                    snap_name=snap.name,
diff --git a/pkgs/development/python-modules/cytoolz/default.nix b/pkgs/development/python-modules/cytoolz/default.nix
index 64ac6ad9dfd0..afa9152c9bab 100644
--- a/pkgs/development/python-modules/cytoolz/default.nix
+++ b/pkgs/development/python-modules/cytoolz/default.nix
@@ -4,6 +4,7 @@
 , isPyPy
 , pytestCheckHook
 , cython
+, setuptools
 , toolz
 , python
 , isPy27
@@ -12,7 +13,8 @@
 buildPythonPackage rec {
   pname = "cytoolz";
   version = "0.12.3";
-  format = "setuptools";
+  pyproject = true;
+
   disabled = isPy27 || isPyPy;
 
   src = fetchPypi {
@@ -20,7 +22,10 @@ buildPythonPackage rec {
     hash = "sha256-RQPcWfTO1TpUZDJyxh3DBdHbv719a98paUjenzTDooI=";
   };
 
-  nativeBuildInputs = [ cython ];
+  nativeBuildInputs = [
+    cython
+    setuptools
+  ];
 
   propagatedBuildInputs = [ toolz ];
 
@@ -31,6 +36,11 @@ buildPythonPackage rec {
     export PYTHONPATH=$out/${python.sitePackages}:$PYTHONPATH
   '';
 
+  disabledTests = [
+    # https://github.com/pytoolz/cytoolz/issues/200
+    "test_inspect_wrapped_property"
+  ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/dirigera/default.nix b/pkgs/development/python-modules/dirigera/default.nix
index f8618c1e5a89..649c79632a3e 100644
--- a/pkgs/development/python-modules/dirigera/default.nix
+++ b/pkgs/development/python-modules/dirigera/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dirigera";
-  version = "1.1.2";
+  version = "1.1.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Leggin";
     repo = "dirigera";
     rev = "refs/tags/v${version}";
-    hash = "sha256-EOnhkfU6DC0IfroHR8O45eNxIyyNS81Z/ptSViqyThU=";
+    hash = "sha256-60DLNp3mM4LpnmM98JVcKlOxj20jvtsBnYq7tL4WEW8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/fastapi-sso/default.nix b/pkgs/development/python-modules/fastapi-sso/default.nix
index c9a53db0501f..fa4342cf170b 100644
--- a/pkgs/development/python-modules/fastapi-sso/default.nix
+++ b/pkgs/development/python-modules/fastapi-sso/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "fastapi-sso";
-  version = "0.14.0";
+  version = "0.14.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "tomasvotava";
     repo = "fastapi-sso";
     rev = "refs/tags/${version}";
-    hash = "sha256-JFIVmpKsTaL7SYwamW/8zMWaBampmCTweiNz7zcgbco=";
+    hash = "sha256-mkaQY+fIc4zw+ESe3ybxAMgMQOOpjCIJDv+dDj76oAg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index 74ee643bb6d6..a079fffd2510 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -1,47 +1,46 @@
-{ lib
-, buildPythonPackage
-, db-dtypes
-, fetchPypi
-, freezegun
-, google-api-core
-, google-cloud-bigquery-storage
-, google-cloud-core
-, google-cloud-datacatalog
-, google-cloud-storage
-, google-cloud-testutils
-, google-resumable-media
-, grpcio
-, ipython
-, mock
-, pandas
-, proto-plus
-, protobuf
-, psutil
-, pyarrow
-, pytest-xdist
-, pytestCheckHook
-, python-dateutil
-, pythonOlder
-, requests
-, setuptools
-, tqdm
+{
+  lib,
+  buildPythonPackage,
+  db-dtypes,
+  fetchPypi,
+  freezegun,
+  google-api-core,
+  google-cloud-bigquery-storage,
+  google-cloud-core,
+  google-cloud-datacatalog,
+  google-cloud-storage,
+  google-cloud-testutils,
+  google-resumable-media,
+  grpcio,
+  ipython,
+  mock,
+  pandas,
+  proto-plus,
+  protobuf,
+  psutil,
+  pyarrow,
+  pytest-xdist,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  requests,
+  setuptools,
+  tqdm,
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "3.20.1";
+  version = "3.21.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MYqjq6tfGQDuJPY7qL0Cuc2vqpQtc4tNwUpO8swtkl8=";
+    hash = "sha256-YmXDn51b31DxHLganCoGBdKF3zSsE53g0jM7ElCt0P8=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     grpcio
@@ -66,12 +65,8 @@ buildPythonPackage rec {
       pandas
       pyarrow
     ];
-    tqdm = [
-      tqdm
-    ];
-    ipython = [
-      ipython
-    ];
+    tqdm = [ tqdm ];
+    ipython = [ ipython ];
   };
 
   nativeCheckInputs = [
@@ -83,8 +78,7 @@ buildPythonPackage rec {
     google-cloud-storage
     pytestCheckHook
     pytest-xdist
-  ] ++ passthru.optional-dependencies.pandas
-  ++ passthru.optional-dependencies.ipython;
+  ] ++ passthru.optional-dependencies.pandas ++ passthru.optional-dependencies.ipython;
 
   # prevent google directory from shadowing google imports
   preCheck = ''
diff --git a/pkgs/development/python-modules/green/default.nix b/pkgs/development/python-modules/green/default.nix
index 40b4851b0c77..eef23f6ce0df 100644
--- a/pkgs/development/python-modules/green/default.nix
+++ b/pkgs/development/python-modules/green/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "green";
-  version = "4.0.1";
+  version = "4.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-O178HRtyKg/2fYD9jHzfbUfNGPlRpGuEvbx7H7yr0/w=";
+    hash = "sha256-pAZ8P5/CpkTtNfU2ZJUGQzROxGLm0uu1vXS3YpcVprE=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/ipyvue/default.nix b/pkgs/development/python-modules/ipyvue/default.nix
index c2211226f078..2be0ddfe8075 100644
--- a/pkgs/development/python-modules/ipyvue/default.nix
+++ b/pkgs/development/python-modules/ipyvue/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "ipyvue";
-  version = "1.10.2";
+  version = "1.11.0";
   format = "setuptools";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qZc1hvouKWUQ2aJLk1oiokUKzKBXtd6fC6tm7LHDOrQ=";
+    hash = "sha256-ez2ygBvgU12FX/+qDkARlizq50rEgZYp4UH5Sx4E2QA=";
   };
 
   propagatedBuildInputs = [ ipywidgets ];
diff --git a/pkgs/development/python-modules/itemdb/default.nix b/pkgs/development/python-modules/itemdb/default.nix
index 4cc0cf637484..6ac5deae5eaa 100644
--- a/pkgs/development/python-modules/itemdb/default.nix
+++ b/pkgs/development/python-modules/itemdb/default.nix
@@ -5,7 +5,7 @@
 
 buildPythonPackage rec {
   pname = "itemdb";
-  version = "1.1.2";
+  version = "1.2.0";
   format = "setuptools";
 
   # PyPI tarball doesn't include tests directory
@@ -13,7 +13,7 @@ buildPythonPackage rec {
     owner = "almarklein";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-s7a+MJLTAcGv2rYRMO2SAlsDYen6Si10qUQOVDFuf6c=";
+    sha256 = "sha256-egxQ1tGC6R5p1stYm4r05+b2HkuT+nBySTZPGqeAbSE=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/itemloaders/default.nix b/pkgs/development/python-modules/itemloaders/default.nix
index d0fa322791d1..73957e6b0aea 100644
--- a/pkgs/development/python-modules/itemloaders/default.nix
+++ b/pkgs/development/python-modules/itemloaders/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, setuptools
 , w3lib
 , parsel
 , jmespath
@@ -11,18 +12,22 @@
 
 buildPythonPackage rec {
   pname = "itemloaders";
-  version = "1.1.0";
-  format = "setuptools";
+  version = "1.2.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "scrapy";
-    repo = pname;
+    repo = "itemloaders";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jwxxKfr/SI1yfjSQbYqggWxBwusBZNYySHwZXHftgFs=";
+    hash = "sha256-DatHJnAIomVoN/GrDzM2fNnFHcXqo6zs3ucKCOCf9DU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     w3lib
     parsel
@@ -34,18 +39,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # Test are failing (AssertionError: Lists differ: ...)
-    "test_nested_css"
-    "test_nested_xpath"
-  ];
-
   pythonImportsCheck = [
     "itemloaders"
   ];
 
   meta = with lib; {
-    description = "Base library for scrapy's ItemLoader";
+    description = "Library to populate items using XPath and CSS with a convenient API";
     homepage = "https://github.com/scrapy/itemloaders";
     changelog = "https://github.com/scrapy/itemloaders/raw/v${version}/docs/release-notes.rst";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/jupyter-server-fileid/default.nix b/pkgs/development/python-modules/jupyter-server-fileid/default.nix
index 300f4bb835dd..9fea67c3faa2 100644
--- a/pkgs/development/python-modules/jupyter-server-fileid/default.nix
+++ b/pkgs/development/python-modules/jupyter-server-fileid/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "jupyter-server-fileid";
-  version = "0.9.1";
+  version = "0.9.2";
 
   disables = pythonOlder "3.7";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "jupyter-server";
     repo = "jupyter_server_fileid";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rEjrfioAmqijyObiK7CMLWhLqVpfcmNYhjdjKjkMp6s=";
+    hash = "sha256-ApCDBVjJqpkC5FGEjU/LxwWBunTkL6i5Ki85M6MMLE0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
index 3b8ccd2a6f3b..46ba1221f383 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-qdrant";
-  version = "0.2.0";
+  version = "0.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_vector_stores_qdrant";
     inherit version;
-    hash = "sha256-eYgp2S4KubjyL0bgaL7nRCyFhvTuLU7c7vjw4tJ+9wA=";
+    hash = "sha256-begHJBxdu+19LIoNgAd3Gnei2TQqpEU3gd6cVrv0zGw=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/matchpy/default.nix b/pkgs/development/python-modules/matchpy/default.nix
index 5b880cfb5b09..259038e7774b 100644
--- a/pkgs/development/python-modules/matchpy/default.nix
+++ b/pkgs/development/python-modules/matchpy/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , hopcroftkarp
 , multiset
 , pytestCheckHook
@@ -22,6 +23,15 @@ buildPythonPackage rec {
     hash = "sha256-n5rXIjqVQZzEbfIZVQiGLh2PR1DHAJ9gumcrbvwnasA=";
   };
 
+  patches = [
+    # https://github.com/HPAC/matchpy/pull/77
+    (fetchpatch {
+      name = "fix-versioneer-py312.patch";
+      url = "https://github.com/HPAC/matchpy/commit/965d7c39689b9f2473a78ed06b83f2be701e234d.patch";
+      hash = "sha256-xXADCSIhq1ARny2twzrhR1J8LkMFWFl6tmGxrM8RvkU=";
+    })
+  ];
+
   postPatch = ''
     sed -i '/pytest-runner/d' setup.cfg
 
diff --git a/pkgs/development/python-modules/nvchecker/default.nix b/pkgs/development/python-modules/nvchecker/default.nix
index 96288f52e493..87f2fcfb43fb 100644
--- a/pkgs/development/python-modules/nvchecker/default.nix
+++ b/pkgs/development/python-modules/nvchecker/default.nix
@@ -21,18 +21,24 @@
 
 buildPythonPackage rec {
   pname = "nvchecker";
-  version = "2.13.1";
+  version = "2.14";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "lilydjwg";
-    repo = pname;
+    repo = "nvchecker";
     rev = "v${version}";
-    hash = "sha256-q+az9oaxxIOv/vLFpkT3cF5GDJsa0Cid4oPWEKg5s7M=";
+    hash = "sha256-QqfF8PGY8sULv1x0blu21ucWxqhOpQ7jyLuRCzDIpco=";
   };
 
+  postPatch = ''
+    # Fix try/except syntax. Remove with the next release
+    substituteInPlace tests/test_jq.py \
+      --replace-warn "except jq" "except ImportError"
+  '';
+
   nativeBuildInputs = [
     setuptools
     docutils
diff --git a/pkgs/development/python-modules/periodiq/default.nix b/pkgs/development/python-modules/periodiq/default.nix
index 478168de30d0..2d14561d120d 100644
--- a/pkgs/development/python-modules/periodiq/default.nix
+++ b/pkgs/development/python-modules/periodiq/default.nix
@@ -26,6 +26,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
+      --replace 'pendulum = "^2.0"' 'pendulum = "*"' \
       --replace 'poetry>=0.12' 'poetry-core' \
       --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
   '';
diff --git a/pkgs/development/python-modules/proxy-py/default.nix b/pkgs/development/python-modules/proxy-py/default.nix
index 7c88211f5d27..72630b722bc4 100644
--- a/pkgs/development/python-modules/proxy-py/default.nix
+++ b/pkgs/development/python-modules/proxy-py/default.nix
@@ -1,26 +1,31 @@
-{ lib
-, stdenv
-, bash
-, buildPythonPackage
-, fetchFromGitHub
-, fetchpatch
-, gnumake
-, httpx
-, openssl
-, paramiko
-, pytest-asyncio
-, pytest-mock
-, pytestCheckHook
-, pythonOlder
-, setuptools-scm
-, typing-extensions
-, wheel
+{
+  lib,
+  stdenv,
+  bash,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+  gnumake,
+  h2,
+  hpack,
+  httpx,
+  hyperframe,
+  openssl,
+  paramiko,
+  pytest-asyncio,
+  pytest-mock,
+  pytest-xdist,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  setuptools-scm,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "proxy-py";
-  version = "2.4.3";
-  format = "pyproject";
+  version = "2.4.4rc5";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -28,51 +33,37 @@ buildPythonPackage rec {
     owner = "abhinavsingh";
     repo = "proxy.py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dA7a9RicBFCSf6IoGX/CdvI8x/xMOFfNtyuvFn9YmHI=";
+    hash = "sha256-ngIskWzN6699C0WjSX/ZbHxV3Eb8ikQPNYZFzfzt7xU=";
   };
 
-  patches = [
-    # this patch is so that the one following it applies cleanly
-    # https://github.com/abhinavsingh/proxy.py/pull/1209
-    (fetchpatch {
-      name = "update-build-dependencies.patch";
-      url = "https://github.com/abhinavsingh/proxy.py/commit/2e535360ce5ed9734f2c00dc6aefe5ebd281cea5.patch";
-      hash = "sha256-eR3R4M7jwQMnY5ob0V6G71jXcrkV7YZvo1JOUG4gnrY=";
-    })
-    # https://github.com/abhinavsingh/proxy.py/pull/1345
-    (fetchpatch {
-      name = "remove-setuptools-scm-git-archive-dependency.patch";
-      url = "https://github.com/abhinavsingh/proxy.py/commit/027bfa6b912745f588d272f1a1082f6ca416f815.patch";
-      hash = "sha256-O2LlSrSrB3u2McAZRY+KviuU7Hv1tOuf0n+D/H4BWvI=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace Makefile \
     --replace "SHELL := /bin/bash" "SHELL := ${bash}/bin/bash"
     substituteInPlace pytest.ini \
-      --replace "-p pytest_cov" "" \
-      --replace "--no-cov-on-fail" ""
+      --replace-fail "-p pytest_cov" "" \
+      --replace-fail "--no-cov-on-fail" ""
     sed -i "/--cov/d" pytest.ini
   '';
 
-  nativeBuildInputs = [
-    setuptools-scm
-    wheel
-  ];
+  build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     paramiko
     typing-extensions
   ];
 
   nativeCheckInputs = [
-    httpx
-    openssl
     gnumake
+    h2
+    hpack
+    httpx
+    hyperframe
+    openssl
     pytest-asyncio
     pytest-mock
+    pytest-xdist
     pytestCheckHook
+    requests
   ];
 
   preCheck = ''
@@ -81,14 +72,17 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Test requires network access
-    "test_http2_via_proxy"
+    "http"
+    "http2"
+    "proxy"
+    "web_server"
+    # Location is not writable
+    "test_gen_csr"
     # Tests run into a timeout
     "integration"
   ];
 
-  pythonImportsCheck = [
-    "proxy"
-  ];
+  pythonImportsCheck = [ "proxy" ];
 
   meta = with lib; {
     description = "Python proxy framework";
diff --git a/pkgs/development/python-modules/pyenphase/default.nix b/pkgs/development/python-modules/pyenphase/default.nix
index b3e4863f2472..45e4b014db72 100644
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -1,24 +1,25 @@
-{ lib
-, awesomeversion
-, buildPythonPackage
-, envoy-utils
-, fetchFromGitHub
-, httpx
-, lxml
-, orjson
-, poetry-core
-, pyjwt
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
-, respx
-, syrupy
-, tenacity
+{
+  lib,
+  awesomeversion,
+  buildPythonPackage,
+  envoy-utils,
+  fetchFromGitHub,
+  httpx,
+  lxml,
+  orjson,
+  poetry-core,
+  pyjwt,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  respx,
+  syrupy,
+  tenacity,
 }:
 
 buildPythonPackage rec {
   pname = "pyenphase";
-  version = "1.20.1";
+  version = "1.20.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -27,7 +28,7 @@ buildPythonPackage rec {
     owner = "pyenphase";
     repo = "pyenphase";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Bxwd8qHsvq9BuBMSu5JI/Yk/KC5aQ7b7lnXuIoNQ6EI=";
+    hash = "sha256-sjZaLqTYoXJ1cpaSuyLNAsUrACOMVah7DKaKxGkG0zE=";
   };
 
   postPatch = ''
@@ -35,9 +36,7 @@ buildPythonPackage rec {
       --replace-fail " --cov=pyenphase --cov-report=term-missing:skip-covered" ""
   '';
 
-  build-system = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
   dependencies = [
     awesomeversion
@@ -61,9 +60,7 @@ buildPythonPackage rec {
     "test_with_7_x_firmware"
   ];
 
-  pythonImportsCheck = [
-    "pyenphase"
-  ];
+  pythonImportsCheck = [ "pyenphase" ];
 
   meta = with lib; {
     description = "Library to control enphase envoy";
diff --git a/pkgs/development/python-modules/python-apt/default.nix b/pkgs/development/python-modules/python-apt/default.nix
new file mode 100644
index 000000000000..5d5a703a1afc
--- /dev/null
+++ b/pkgs/development/python-modules/python-apt/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  apt,
+  buildPythonPackage,
+  fetchgit,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "apt";
+  version = "2.7.6";
+
+  pyproject = true;
+
+  src = fetchgit {
+    url = "https://git.launchpad.net/python-apt";
+    rev = "refs/tags/${version}";
+    hash = "sha256-1jTe8ncMKV78+cfSZ6p6qdjxs0plZLB4VwVtPLtDlAc=";
+  };
+
+  buildInputs = [ apt.dev ];
+
+  nativeBuildInputs = [ setuptools ];
+
+  # Ensure the version is set properly without trying to invoke
+  # dpkg-parsechangelog
+  env.DEBVER = "${version}";
+
+  pythonImportsCheck = [ "apt_pkg" ];
+
+  meta = {
+    description = "Python bindings for APT";
+    homepage = "https://launchpad.net/python-apt";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/python-i18n/default.nix b/pkgs/development/python-modules/python-i18n/default.nix
index d452cde8a0d7..1ae07dfbec6d 100644
--- a/pkgs/development/python-modules/python-i18n/default.nix
+++ b/pkgs/development/python-modules/python-i18n/default.nix
@@ -7,14 +7,20 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "danhper";
-    repo = pname;
+    repo = "python-i18n";
     rev = "v${version}";
     sha256 = "6FahoHZqaOWYGaT9RqLARCm2kLfUIlYuauB6+0eX7jA=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook pyyaml ];
+  # Replace use of deprecated assertRaisesRegexp
+  postPatch = ''
+    substituteInPlace i18n/tests/loader_tests.py \
+      --replace-fail assertRaisesRegexp assertRaisesRegex
+  '';
 
+  nativeCheckInputs = [ pytestCheckHook pyyaml ];
   pytestFlagsArray = [ "i18n/tests/run_tests.py" ];
+  pythonImportsCheck = [ "i18n" ];
 
   meta = with lib; {
     description = "Easy to use i18n library";
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 3ac3baf1525a..abcc25faafdb 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.3.0";
+  version = "4.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kUXi26NhFGS3liGaGHfm0HTRWXlnaIa80lxgLQ/0FyM=";
+    hash = "sha256-SFD+nZVNb90+UVdWmZwnGEGF21zKhE7mfFPn2HluizE=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index 440a5db457ab..5558ce327290 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "9.0.4";
+  version = "9.0.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "twilio";
     repo = "twilio-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-3014wT7DXRlWvRxfqx/wIR9v9uX9QROQICDHXcgtOHs=";
+    hash = "sha256-q7tY44L8KA29HeoLBJf75Xp3IZSiT5DOkhtZ+7BD7Hg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/uarray/default.nix b/pkgs/development/python-modules/uarray/default.nix
index ab22d07049c4..b6070cb8d9e1 100644
--- a/pkgs/development/python-modules/uarray/default.nix
+++ b/pkgs/development/python-modules/uarray/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , fetchpatch
 , setuptools
+, setuptools-scm
 , matchpy
 , numpy
 , astunparse
@@ -13,25 +14,17 @@
 
 buildPythonPackage rec {
   pname = "uarray";
-  version = "0.8.2";
+  version = "0.8.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Quansight-Labs";
     repo = pname;
     rev = version;
-    sha256 = "1x2jp7w2wmn2awyv05xs0frpq0fa0rprwcxyg72wgiss0bnzxnhm";
+    hash = "sha256-wTKqOw64b+/kdZpSYLwCJATOuo807BWCtVHB4pH58fY=";
   };
 
-  patches = [(
-    # Fixes a compile error with newer versions of GCC -- should be included
-    # in the next release after 0.8.2
-    fetchpatch {
-      url = "https://github.com/Quansight-Labs/uarray/commit/a2012fc7bb94b3773eb402c6fe1ba1a894ea3d18.patch";
-      sha256 = "1qqh407qg5dz6x766mya2bxrk0ffw5h17k478f5kcs53g4dyfc3s";
-    }
-  )];
-
+  nativeBuildInputs = [ setuptools setuptools-scm ];
   build-system = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix
index 0527e90f2636..25be1098eb9d 100644
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "unearth";
-  version = "0.15.1";
+  version = "0.15.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hj3rMznA1lpb4NCtLGfUbV9XSnmOdO8FUr8R0pijCrs=";
+    hash = "sha256-OB8+aWnbCyjZ/C+/shaGBXm/NBvWlUcvLGLivM6ebT0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/uuid/default.nix b/pkgs/development/python-modules/uuid/default.nix
deleted file mode 100644
index 571e79a86294..000000000000
--- a/pkgs/development/python-modules/uuid/default.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi }:
-
-buildPythonPackage rec {
-  pname = "uuid";
-  version = "1.30";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0gqrjsm85nnkxkmd1vk8350wqj2cigjflnvcydk084n5980cr1qz";
-  };
-
-  meta = with lib; {
-    description = "UUID object and generation functions (Python 2.3 or higher)";
-    homepage = "http://zesty.ca/python/";
-  };
-}
diff --git a/pkgs/development/python-modules/xmlschema/default.nix b/pkgs/development/python-modules/xmlschema/default.nix
index b8c8be9de2dc..f03f00068600 100644
--- a/pkgs/development/python-modules/xmlschema/default.nix
+++ b/pkgs/development/python-modules/xmlschema/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "xmlschema";
-  version = "3.2.1";
+  version = "3.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "sissaschool";
     repo = "xmlschema";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jhof4C/jbMcvBRTLFdeFq2+ZucoDhbdcLE9IWvgzN0Y=";
+    hash = "sha256-kqaS6h0bJvJQoVa4L2qhkvuZsK4a6vtqek/wWN22R6I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/yowsup/default.nix b/pkgs/development/python-modules/yowsup/default.nix
index bc79ff51823f..a88a296944a5 100644
--- a/pkgs/development/python-modules/yowsup/default.nix
+++ b/pkgs/development/python-modules/yowsup/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, pythonOlder
 , isPy3k
 , fetchFromGitHub
 , appdirs
@@ -7,6 +8,7 @@
 , protobuf
 , python-axolotl
 , six
+, pyasyncore
 , pytestCheckHook
 }:
 
@@ -42,6 +44,9 @@ buildPythonPackage rec {
     protobuf
     python-axolotl
     six
+  ]
+  ++ lib.optionals (!pythonOlder "3.12") [
+    pyasyncore
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/r-modules/bioc-packages.nix b/pkgs/development/r-modules/bioc-packages.nix
index 818fa41a432f..982c6b793749 100644
--- a/pkgs/development/r-modules/bioc-packages.nix
+++ b/pkgs/development/r-modules/bioc-packages.nix
@@ -1730,7 +1730,7 @@ in with self; {
   multiHiCcompare = derive2 { name="multiHiCcompare"; version="1.20.0"; sha256="152h62f41r2lay2zpnllsfamy0m63w5bi5gnyy7q32rhmq9z2k3b"; depends=[aggregation BiocParallel data_table dplyr edgeR GenomeInfoDb GenomeInfoDbData GenomicRanges HiCcompare pbapply pheatmap qqman]; };
   multiMiR = derive2 { name="multiMiR"; version="1.24.0"; sha256="0mxih9nfjmgq3zd2c08ahwhnx3ahynj9phyrii6chllm3jcsfx15"; depends=[AnnotationDbi BiocGenerics dplyr purrr RCurl tibble XML]; };
   multiWGCNA = derive2 { name="multiWGCNA"; version="1.0.0"; sha256="1jp8amw31l45b2h9b138rmbzc43xx2swfs5pnlqladnnzwsbxvn3"; depends=[cowplot data_table dcanr dplyr flashClust ggalluvial ggplot2 ggrepel igraph patchwork readr reshape2 scales stringr SummarizedExperiment WGCNA]; };
-  multicrispr = derive2 { name="multicrispr"; version="1.12.3"; sha256="13ahvfxp5jkjrhdp3bz480h2k3m055brni22dbl3144f9lnyrw5b"; depends=[assertive_base assertive_files assertive_numbers assertive_sets BiocGenerics Biostrings BSgenome CRISPRseek data_table GenomeInfoDb GenomicFeatures GenomicRanges ggplot2 karyoploteR magrittr plyranges Rbowtie reticulate rtracklayer stringi tidyr tidyselect]; };
+  multicrispr = derive2 { name="multicrispr"; version="1.12.9"; sha256="1rqd4l7gh48kviy9r5g5v6iq36p1h3gid9f250ps3zygc809garm"; depends=[BiocGenerics Biostrings BSgenome CRISPRseek data_table GenomeInfoDb GenomicFeatures GenomicRanges ggplot2 karyoploteR magrittr plyranges Rbowtie reticulate rtracklayer stringi tidyr tidyselect]; };
   multiscan = derive2 { name="multiscan"; version="1.62.0"; sha256="09shs3hpa285v3hsbrncljxs02dm10qcbnnx9ss6b16gbs6d34wi"; depends=[Biobase]; };
   multtest = derive2 { name="multtest"; version="2.58.0"; sha256="0s8x2rg2xp6awg2cikybgxrxpi9f91jah7dskk5dnfkazd20di4j"; depends=[Biobase BiocGenerics MASS survival]; };
   mumosa = derive2 { name="mumosa"; version="1.10.0"; sha256="1mmhfy8lh1yd02vgw9bg32850sb5l875as8bv3xgq55c78ishlgv"; depends=[batchelor beachmat BiocGenerics BiocNeighbors BiocParallel BiocSingular DelayedArray DelayedMatrixStats igraph IRanges Matrix metapod S4Vectors ScaledMatrix scran scuttle SingleCellExperiment SummarizedExperiment uwot]; };
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index e2b2e7feea00..cf3cd20a5ed9 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -313,9 +313,9 @@ let
 
   packagesWithNativeBuildInputs = {
     adbcpostgresql = [ pkgs.postgresql ];
-    arrow = [ pkgs.pkg-config pkgs.arrow-cpp ];
     adimpro = [ pkgs.imagemagick ];
     animation = [ pkgs.which ];
+    arrow = with pkgs; [ pkg-config cmake ] ++ lib.optionals stdenv.isDarwin [ intltool ];
     audio = [ pkgs.portaudio ];
     BayesSAE = [ pkgs.gsl ];
     BayesVarSel = [ pkgs.gsl ];
@@ -960,6 +960,7 @@ let
     "paxtoolsr"
     "systemPipeShiny"
     "matlab2r"
+    "GNOSIS"
   ];
 
   packagesToSkipCheck = [
@@ -1017,6 +1018,27 @@ let
   ];
 
   otherOverrides = old: new: {
+    # it can happen that the major version of arrow-cpp is ahead of the
+    # rPackages.arrow that would be built from CRAN sources; therefore, to avoid
+    # build failures and manual updates of the hash, we use the R source at
+    # the GitHub release state of libarrow (arrow-cpp) in Nixpkgs. This may
+    # not exactly represent the CRAN sources, but because patching of the
+    # CRAN R package is mostly done to meet special CRAN build requirements,
+    # this is a straightforward approach. Example where patching was necessary
+    # -> arrow 14.0.0.2 on CRAN; was lagging behind libarrow release:
+    #   https://github.com/apache/arrow/issues/39698 )
+    arrow = old.arrow.overrideAttrs (attrs: {
+      src = pkgs.arrow-cpp.src;
+      name = "r-arrow-${pkgs.arrow-cpp.version}";
+      prePatch = "cd r";
+      postPatch = ''
+        patchShebangs configure
+      '';
+      buildInputs = attrs.buildInputs ++ [
+        pkgs.arrow-cpp
+      ];
+    });
+
     gifski = old.gifski.overrideAttrs (attrs: {
       cargoDeps = pkgs.rustPlatform.fetchCargoTarball {
         src = attrs.src;
@@ -1471,15 +1493,10 @@ let
     });
 
     SICtools = old.SICtools.overrideAttrs (attrs: {
-      preConfigure = ''
-        substituteInPlace src/Makefile --replace "-lcurses" "-lncurses"
-      '';
-    });
-
-    arrow = old.arrow.overrideAttrs (attrs: {
-      preConfigure = ''
-        patchShebangs configure
+      postPatch = ''
+        substituteInPlace src/Makefile --replace-fail "-lcurses" "-lncurses"
       '';
+      hardeningDisable = [ "format" ];
     });
 
     ROracle = old.ROracle.overrideAttrs (attrs: {
diff --git a/pkgs/development/tools/castxml/default.nix b/pkgs/development/tools/castxml/default.nix
index 0547df5d4cc5..bceafd504dcc 100644
--- a/pkgs/development/tools/castxml/default.nix
+++ b/pkgs/development/tools/castxml/default.nix
@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "castxml";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "CastXML";
     repo = "CastXML";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6xeMkqsFchZxrAsE2DLaIzGU4VMwyDckm00s69wahOo=";
+    hash = "sha256-r9Emh2KHjANrg+oWeY8Ags3Gd8k3W68J88bAud+AH6I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/electron/binary/default.nix b/pkgs/development/tools/electron/binary/default.nix
index 4386c7fdf5bc..41b3f1022e06 100644
--- a/pkgs/development/tools/electron/binary/default.nix
+++ b/pkgs/development/tools/electron/binary/default.nix
@@ -15,22 +15,22 @@ rec {
     headers = "009p1ffh2cyn98fcmprrjzq79jysp7h565v4f54wvjxjsq2nkr97";
   };
 
-  electron_27-bin = mkElectron "27.3.10" {
-    armv7l-linux = "bb739ce18a9e09225e8e0e1889cf1ab35fefda4ec7c2b60bdda271e58c921271";
-    aarch64-linux = "f1783e222074de33fea2188a86499d6a9d8b1aceec3bbd85a17913817a5bd356";
-    x86_64-linux = "dcfe17763071f1ec694155176f9156d625e6a69ccc32253b6576ca65111783c0";
-    x86_64-darwin = "5f469975f5ed68001dedc0383b94562c0a29e05b885427f20187625251cb83cb";
-    aarch64-darwin = "cb0e524b14f0f882a61cdcc46d7f3563ce115158501caaf2e8642f647c1eed6d";
-    headers = "12in54rg4dr8lh5dm9xx00w6cvbzgnylq7hjp2jwbj339xsgnqjz";
+  electron_27-bin = mkElectron "27.3.11" {
+    armv7l-linux = "012127a3edf79e0e4623a08e853286e1cba512438a0414b1ab19b75d929c1cf2";
+    aarch64-linux = "ddbfcd5e04450178ca4e3113f776893454822af6757761adc792692f7978e0df";
+    x86_64-linux = "e3a6f55e54e7a623bba1a15016541248408eef5a19ab82a59d19c807aab14563";
+    x86_64-darwin = "357e70a1c8848d4ac7655346bec98dd18a7c0cee82452a7edf76142017779049";
+    aarch64-darwin = "a687b199fcb9890f43af90ac8a4d19dc7b15522394de89e42abd5f5c6b735804";
+    headers = "0vrjdvqllfyz09sw2y078mds1di219hnmska8bw8ni7j35wxr2br";
   };
 
-  electron_28-bin = mkElectron "28.3.0" {
-    armv7l-linux = "aa74e7240929ebfa817d03e025e117f7a0600c99e6ad9bc339eaf22b0144a71c";
-    aarch64-linux = "9ec29245bcbbd0007029b4a3f7976b209968dbaa6443406afbf208b1a5abf094";
-    x86_64-linux = "e5003391ffc5161f6d9987ed29fa97532142544326f15fbf90ee43daabeba639";
-    x86_64-darwin = "7d6a0f6a7ec606d1caa0e63a99e4c6103a3fedb6e05735f81a03aa8da099a420";
-    aarch64-darwin = "a0eb07c006b593be8f76f7f6ad7cb8ac619ec173d341ad4c3ca5e52b38dab8b8";
-    headers = "12z94fz4zyypjkjx5l8n0qxd7r5jsny19i4ray60mn5cd7j019z8";
+  electron_28-bin = mkElectron "28.3.1" {
+    armv7l-linux = "2e22fbab2376a9bbeb8cbdd7d9bb3ca69fda6adeafa2b22ffb67157fcfcdb6ff";
+    aarch64-linux = "3e46c3076041386213f7b9ebc12335889fbad5822ffc306cf7514abb88de8512";
+    x86_64-linux = "e3be93e1a15d61f72e074aee021e12f20465b81f51b8c1170bd9072d7d695c3a";
+    x86_64-darwin = "bd8a220fd906625ad4a8edf92e80e8eff89d51f40c22168e05090daa7c12bd66";
+    aarch64-darwin = "53fc040cd09e955e013254f784cf51712029ded4a574559cf5fa19c9a911d75d";
+    headers = "07iv5fh0yxv17c1akb2j4ab5xhv29d9zsgi6dm2r0n4pnf72wxwr";
   };
 
   electron_29-bin = mkElectron "29.3.0" {
diff --git a/pkgs/development/tools/electron/common.nix b/pkgs/development/tools/electron/common.nix
index 19f0dd427023..9aa3b1c932de 100644
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@@ -216,7 +216,7 @@ in (chromium.override { upstream-info = info.chromium; }).mkDerivation (base: {
     homepage = "https://github.com/electron/electron";
     platforms = lib.platforms.linux;
     license = licenses.mit;
-    maintainers = with maintainers; [ yuka ];
+    maintainers = with maintainers; [ yayayayaka yuka ];
     mainProgram = "electron";
     hydraPlatforms = lib.optionals (!(hasInfix "alpha" info.version) && !(hasInfix "beta" info.version)) ["aarch64-linux" "x86_64-linux"];
     timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index 67708aa5d43b..0304f0bbec43 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -3,10 +3,10 @@
         "deps": {
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-AHiOejVRSeJ14Xn+A6yjfICbERDPr/eCbBq+2qPjGDc=",
+                "hash": "sha256-Y0uNoq5LhlFMxQfqrTjzOokbB7Y6UUAlBCj+Nghiz5w=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v28.3.0"
+                "rev": "v28.3.1"
             },
             "src": {
                 "fetcher": "fetchFromGitiles",
@@ -873,7 +873,7 @@
                 "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
             }
         },
-        "version": "28.3.0",
+        "version": "28.3.1",
         "modules": "119",
         "chrome": "120.0.6099.291",
         "node": "18.18.2",
@@ -895,10 +895,10 @@
         "deps": {
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-vCM74wty0JN4PL9snwa4oFbNebA3cMZ8lorXz5DIVcE=",
+                "hash": "sha256-DmDAKUUyiDASGGylDVQe2OkDVfiA1ficDG+oaMbKqdo=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v27.3.10"
+                "rev": "v27.3.11"
             },
             "src": {
                 "fetcher": "fetchFromGitiles",
@@ -1765,7 +1765,7 @@
                 "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
             }
         },
-        "version": "27.3.10",
+        "version": "27.3.11",
         "modules": "118",
         "chrome": "118.0.5993.159",
         "node": "18.17.1",
diff --git a/pkgs/development/tools/infisical/default.nix b/pkgs/development/tools/infisical/default.nix
index f19b021ed3a3..849144616f92 100644
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
@@ -15,7 +15,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # the version of infisical
-  version = "0.20.1";
+  version = "0.21.1";
 
   # the platform-specific, statically linked binary
   src =
diff --git a/pkgs/development/tools/infisical/hashes.json b/pkgs/development/tools/infisical/hashes.json
index 6b23b59dbf97..728568f1ee1a 100644
--- a/pkgs/development/tools/infisical/hashes.json
+++ b/pkgs/development/tools/infisical/hashes.json
@@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-W5k/xGL6R4ox9XQShWl2PqpvbJYIqeM4Qx3bG+5HpAo="
-, "x86_64-darwin": "sha256-sFGKUh4qkj5EZ5NE6wQqO2TAmHuMH4qgcdJlx92ygr8="
-, "aarch64-linux": "sha256-t80Nt1YXwmcjagZRaPgXH4m7D5sKhwLz9YcX6cOArRQ="
-, "aarch64-darwin": "sha256-INNcqrCy5px9vwh6yM03baSgj2uHgPrbKAatGl84R5M="
+, "x86_64-linux": "sha256-HdjqoT+iDYwQQlNZIPcC4j76bCh1k1+Axz46Hq2FNoE="
+, "x86_64-darwin": "sha256-X3QXlW0yqYuc3MLYesxNiWGz79r/fHO0mdwyZ3DyPKU="
+, "aarch64-linux": "sha256-osy/9dhSme4dyVeBWGjwfMt0YJVPLwV7rYu6ePkhFOs="
+, "aarch64-darwin": "sha256-O/F2xErHSFfeK6mamjFDstHW1yBpnfl/slWa1hQ159s="
 }
diff --git a/pkgs/development/tools/parsing/re-flex/default.nix b/pkgs/development/tools/parsing/re-flex/default.nix
index 3a69cb18803c..2f989d9bfb1e 100644
--- a/pkgs/development/tools/parsing/re-flex/default.nix
+++ b/pkgs/development/tools/parsing/re-flex/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re-flex";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = "RE-flex";
     rev = "v${version}";
-    hash = "sha256-+/Q3lcdV4tEArYmuQN5iL6r5TS0J/zoLQ85bNazpSf8=";
+    hash = "sha256-tWV7HnIeTao3IbT2xxsu+//4aLQLKP/+ySqrvzU139c=";
   };
 
   outputs = [ "out" "bin" "dev" ];
diff --git a/pkgs/development/tools/renderdoc/default.nix b/pkgs/development/tools/renderdoc/default.nix
index f98d9ce201c3..a5bc15ef3165 100644
--- a/pkgs/development/tools/renderdoc/default.nix
+++ b/pkgs/development/tools/renderdoc/default.nix
@@ -32,13 +32,13 @@ let
 in
 mkDerivation rec {
   pname = "renderdoc";
-  version = "1.31";
+  version = "1.32";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${version}";
-    sha256 = "sha256-R9TMkq9bFRyA7oaPPp0zcUf+ovveLCcuxrm7EokyTbc=";
+    sha256 = "sha256-8Q2QMANieY/Bvb50NtlZEN/Nmd6xurU6AJU0Uo8qDTs=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/tools/rust/cargo-show-asm/default.nix b/pkgs/development/tools/rust/cargo-show-asm/default.nix
index 1e313595358f..bd08268d5928 100644
--- a/pkgs/development/tools/rust/cargo-show-asm/default.nix
+++ b/pkgs/development/tools/rust/cargo-show-asm/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-show-asm";
-  version = "0.2.31";
+  version = "0.2.32";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-TjkEzqGFqhVKMmZEcwAoDnHOZWi7+wha228loJjLxgQ=";
+    hash = "sha256-4pMIL/wru9uE8Uyp/qvmo6IJxFcB0HLUHRSSV6DoI3g=";
   };
 
-  cargoHash = "sha256-oUfBpx/hElXMw58Dj09JeG2FKy+biFt+4pb4pYNidxc=";
+  cargoHash = "sha256-N1NZONY8y88diAbWn+UaSHGpd4r7naxFWVmCyJkL3tQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index adbaf7563137..1d8c678a7a21 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.20.8";
+  version = "1.20.9";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ZigvL11M1bxc7cwDExgIdFhXnZE7LoHIu7oS4Ga2hWw=";
+    hash = "sha256-p9vw2BDfCb31nsHvkdW75fYgEV0Nd3xd7hibAvqL+MA=";
   };
 
-  cargoHash = "sha256-ZD56gy4untz5Ey/sopCFjFWsBiwMi+AZCdNch/aJD0c=";
+  cargoHash = "sha256-cLoTMzvJsjFhMZZRp24hacTdPRhWjcM5xc77obp8UGI=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/development/web/function-runner/default.nix b/pkgs/development/web/function-runner/default.nix
index ba1be2863f81..1eb7dff5b2e2 100644
--- a/pkgs/development/web/function-runner/default.nix
+++ b/pkgs/development/web/function-runner/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "function-runner";
-  version = "4.2.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-33UVo7mPD/o3Z/R5PFhosiSLFLLpJ0pHqUbKtX6THJE=";
+    sha256 = "sha256-Li3v3kXze0KgK16XVwdshZWaRF89YSC1Yk9iHXfGWKI=";
   };
 
-  cargoHash = "sha256-TNbGmqITCk1VKVuO46LxO+zjAG7Laguq7EAruuhJIxk=";
+  cargoHash = "sha256-jPiy4ULEfF/aRhWV1j2SOIe2u9uctEsmzWQ6MLXRu7A=";
 
   meta = with lib; {
     description = "A CLI tool which allows you to run Wasm Functions intended for the Shopify Functions infrastructure";
diff --git a/pkgs/misc/screensavers/slock/default.nix b/pkgs/misc/screensavers/slock/default.nix
index 782557625338..e86358d2e4ea 100644
--- a/pkgs/misc/screensavers/slock/default.nix
+++ b/pkgs/misc/screensavers/slock/default.nix
@@ -2,7 +2,10 @@
 , xorgproto, libX11, libXext, libXrandr, libxcrypt
 # default header can be obtained from
 # https://git.suckless.org/slock/tree/config.def.h
-, conf ? null }:
+, conf ? null
+# update script dependencies
+, gitUpdater
+}:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slock";
@@ -25,6 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [ "CC:=$(CC)" ];
 
+  passthru.updateScript = gitUpdater {
+    url = "git://git.suckless.org/slock";
+  };
+
   meta = with lib; {
     homepage = "https://tools.suckless.org/slock";
     description = "Simple X display locker";
@@ -33,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       Simple X display locker. This is the simplest X screen locker.
     '';
     license = licenses.mit;
-    maintainers = with maintainers; [ astsmtl ];
+    maintainers = with maintainers; [ astsmtl qusic ];
     platforms = platforms.linux;
   };
 })
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 6bb931a961fc..5af0a79c4dfd 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -18,11 +18,11 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.7.1";
+  version = "5.7.2";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "da14b415c61d53747a991f12d6209367ef826a13dc6bf4eeaf5d88760294c3a2";
+    hash = "sha256-X2oic5D81MLQqAKKZStVqdhj7HvgEpj+A43x0nP7mg8=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/home-assistant/custom-components/default.nix b/pkgs/servers/home-assistant/custom-components/default.nix
index 1a7f9d47e187..acfcf038f20e 100644
--- a/pkgs/servers/home-assistant/custom-components/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/default.nix
@@ -38,9 +38,15 @@
 
   sensi = callPackage ./sensi {};
 
+  smartir = callPackage ./smartir {};
+
   smartthinq-sensors = callPackage ./smartthinq-sensors {};
 
   waste_collection_schedule = callPackage ./waste_collection_schedule {};
 
+  xiaomi_gateway3 = callPackage ./xiaomi_gateway3 {};
+
+  xiaomi_miot = callPackage ./xiaomi_miot {};
+
   yassi = callPackage ./yassi {};
 }
diff --git a/pkgs/servers/home-assistant/custom-components/smartir/default.nix b/pkgs/servers/home-assistant/custom-components/smartir/default.nix
new file mode 100644
index 000000000000..5dc9eb2473d7
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/smartir/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildHomeAssistantComponent
+, fetchFromGitHub
+, aiofiles
+, broadlink
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "smartHomeHub";
+  domain = "smartir";
+  version = "1.17.9";
+
+  src = fetchFromGitHub {
+    owner = "smartHomeHub";
+    repo = "SmartIR";
+    rev = version;
+    hash = "sha256-E6TM761cuaeQzlbjA+oZ+wt5HTJAfkF2J3i4P1Wbuic=";
+  };
+
+  propagatedBuildInputs = [
+    aiofiles
+    broadlink
+  ];
+
+  dontBuild = true;
+
+  postInstall = ''
+    cp -r codes $out/custom_components/smartir/
+  '';
+
+  meta = with lib; {
+    changelog = "https://github.com/smartHomeHub/SmartIR/releases/tag/v${version}";
+    description = "Integration for Home Assistant to control climate, TV and fan devices via IR/RF controllers (Broadlink, Xiaomi, MQTT, LOOKin, ESPHome)";
+    homepage = "https://github.com/smartHomeHub/SmartIR";
+    maintainers = with maintainers; [ azuwis ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/custom-components/xiaomi_gateway3/default.nix b/pkgs/servers/home-assistant/custom-components/xiaomi_gateway3/default.nix
new file mode 100644
index 000000000000..fd453e0d321c
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/xiaomi_gateway3/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildHomeAssistantComponent
+, fetchFromGitHub
+, zigpy
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "AlexxIT";
+  domain = "xiaomi_gateway3";
+  version = "4.0.3";
+
+  src = fetchFromGitHub {
+    owner = "AlexxIT";
+    repo = "XiaomiGateway3";
+    rev = "v${version}";
+    hash = "sha256-YGaVQaz3A0yM8AIC02CvMKWMJ3tW3OADYgKY8ViIt5U=";
+  };
+
+  propagatedBuildInputs = [
+    zigpy
+  ];
+
+  dontBuild = true;
+
+  meta = with lib; {
+    changelog = "https://github.com/AlexxIT/XiaomiGateway3/releases/tag/v{version}";
+    description = "Home Assistant custom component for control Xiaomi Multimode Gateway (aka Gateway 3), Xiaomi Multimode Gateway 2, Aqara Hub E1 on default firmwares over LAN";
+    homepage = "https://github.com/AlexxIT/XiaomiGateway3";
+    maintainers = with maintainers; [ azuwis ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/custom-components/xiaomi_miot/default.nix b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/default.nix
new file mode 100644
index 000000000000..0c64655d76df
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildHomeAssistantComponent
+, fetchFromGitHub
+, hap-python
+, micloud
+, pyqrcode
+, python-miio
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "al-one";
+  domain = "xiaomi_miot";
+  version = "0.7.17";
+
+  src = fetchFromGitHub {
+    owner = "al-one";
+    repo = "hass-xiaomi-miot";
+    rev = "v${version}";
+    hash = "sha256-IpL4e2mKCdtNu8NtI+xpx4FPW/uj1M5Rk6DswXmSJBk=";
+  };
+
+  propagatedBuildInputs = [
+    hap-python
+    micloud
+    pyqrcode
+    python-miio
+  ];
+
+  dontBuild = true;
+
+  meta = with lib; {
+    changelog = "https://github.com/al-one/hass-xiaomi-miot/releases/tag/${version}";
+    description = "Automatic integrate all Xiaomi devices to HomeAssistant via miot-spec, support Wi-Fi, BLE, ZigBee devices.";
+    homepage = "https://github.com/al-one/hass-xiaomi-miot";
+    maintainers = with maintainers; [ azuwis ];
+    license = licenses.asl20;
+  };
+}
diff --git a/pkgs/servers/home-assistant/parse-requirements.py b/pkgs/servers/home-assistant/parse-requirements.py
index 4a54f351ac49..404120d062ac 100755
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ packaging rich ])" -p nodePackages.pyright ruff isort
+#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ packaging rich ])" -p pyright ruff isort
 #
 # This script downloads Home Assistant's source tarball.
 # Inside the homeassistant/components directory, each integration has an associated manifest.json,
diff --git a/pkgs/servers/home-assistant/update.py b/pkgs/servers/home-assistant/update.py
index c0c3cfdef993..c9b9eb183890 100755
--- a/pkgs/servers/home-assistant/update.py
+++ b/pkgs/servers/home-assistant/update.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=channel:nixpkgs-unstable -i python3 -p "python3.withPackages (ps: with ps; [ aiohttp packaging ])" -p git nurl nodePackages.pyright ruff isort
+#!nix-shell -I nixpkgs=channel:nixpkgs-unstable -i python3 -p "python3.withPackages (ps: with ps; [ aiohttp packaging ])" -p git nurl pyright ruff isort
 
 import asyncio
 import json
diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index ea840413f5ef..b1b228a37ec9 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -10,15 +10,15 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-oZI2nvxvxOiv9F9c2AaP9hEBVd3kV4tjuEmvaR5V0Lc=";
-    arm64-linux_hash = "sha256-Pquc/b/VXJEi4N8uOfvg4X1083JaOdCXg2IPAGZAMV0=";
-    x64-osx_hash = "sha256-HHmx8bI4d+xmL63v/qmUIJDt+laoSs5Iqp+I7OzoU/k=";
-    arm64-osx_hash = "sha256-Us/ZEDlZ96/ybs8lxnl4bSFICwc9xJtXScA+hGEwfWk=";
+    x64-linux_hash = "sha256-eFJ31tZPxzK1Vx2EOZ1AMrzCUL7pXJIb5J1joL/ZIgs=";
+    arm64-linux_hash = "sha256-BtxHBHc2dYYdqZxwga7K49aGfSq5a8Z1TLjMPH4ldlw=";
+    x64-osx_hash = "sha256-GQ8wHU4wWu6fpjiLI9yQyMvhP1DS5FE+YQu2uLFdto4=";
+    arm64-osx_hash = "sha256-AnZ+mGeafJsRb6Koj0+oaER8d6vuDQ0x+Wc1eflzupo=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "radarr";
-  version = "5.3.6.8612";
+  version = "5.4.6.8723";
 
   src = fetchurl {
     url = "https://github.com/Radarr/Radarr/releases/download/v${version}/Radarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/web-apps/kavita/change-webroot.diff b/pkgs/servers/web-apps/kavita/change-webroot.diff
index 30e91134bd56..7c31e6844c63 100644
--- a/pkgs/servers/web-apps/kavita/change-webroot.diff
+++ b/pkgs/servers/web-apps/kavita/change-webroot.diff
@@ -1,5 +1,5 @@
 diff --git a/API/Controllers/FallbackController.cs b/API/Controllers/FallbackController.cs
-index 0c925476..c7b30f39 100644
+index 0c92547..d54abb9 100644
 --- a/API/Controllers/FallbackController.cs
 +++ b/API/Controllers/FallbackController.cs
 @@ -22,7 +22,7 @@ public class FallbackController : Controller
@@ -12,20 +12,20 @@ index 0c925476..c7b30f39 100644
  }
  
 diff --git a/API/Services/DirectoryService.cs b/API/Services/DirectoryService.cs
-index 15afddf9..aff1f230 100644
+index e3dede8..8ec6358 100644
 --- a/API/Services/DirectoryService.cs
 +++ b/API/Services/DirectoryService.cs
-@@ -113,7 +113,7 @@ public class DirectoryService : IDirectoryService
+@@ -117,7 +117,7 @@ public class DirectoryService : IDirectoryService
          ExistOrCreate(SiteThemeDirectory);
          FaviconDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "config", "favicons");
          ExistOrCreate(FaviconDirectory);
 -        LocalizationDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "I18N");
 +        LocalizationDirectory = FileSystem.Path.Join("@out@/lib/kavita-backend", "I18N");
-     }
- 
-     /// <summary>
+         CustomizedTemplateDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "config", "templates");
+         ExistOrCreate(CustomizedTemplateDirectory);
+         TemplateDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "EmailTemplates");
 diff --git a/API/Services/LocalizationService.cs b/API/Services/LocalizationService.cs
-index ab3ad3d8..ac813a69 100644
+index ab3ad3d..f1a068b 100644
 --- a/API/Services/LocalizationService.cs
 +++ b/API/Services/LocalizationService.cs
 @@ -52,8 +52,7 @@ public class LocalizationService : ILocalizationService
@@ -39,7 +39,7 @@ index ab3ad3d8..ac813a69 100644
  
          _cacheOptions = new MemoryCacheEntryOptions()
 diff --git a/API/Startup.cs b/API/Startup.cs
-index 939bfb58..1adb9373 100644
+index 3b872f3..424984c 100644
 --- a/API/Startup.cs
 +++ b/API/Startup.cs
 @@ -36,6 +36,7 @@ using Microsoft.AspNetCore.StaticFiles;
@@ -50,7 +50,7 @@ index 939bfb58..1adb9373 100644
  using Microsoft.Extensions.Hosting;
  using Microsoft.Extensions.Logging;
  using Microsoft.Net.Http.Headers;
-@@ -298,9 +299,6 @@ public class Startup
+@@ -295,9 +296,6 @@ public class Startup
          app.UsePathBase(basePath);
          if (!env.IsDevelopment())
          {
@@ -60,7 +60,7 @@ index 939bfb58..1adb9373 100644
              // Update DB with what's in config
              var dataContext = serviceProvider.GetRequiredService<DataContext>();
              var setting = dataContext.ServerSetting.SingleOrDefault(x => x.Key == ServerSettingKey.BaseUrl);
-@@ -333,6 +334,7 @@ public class Startup
+@@ -341,6 +339,7 @@ public class Startup
  
          app.UseStaticFiles(new StaticFileOptions
          {
@@ -68,7 +68,7 @@ index 939bfb58..1adb9373 100644
              ContentTypeProvider = new FileExtensionContentTypeProvider(),
              HttpsCompression = HttpsCompressionMode.Compress,
              OnPrepareResponse = ctx =>
-@@ -394,7 +396,7 @@ public class Startup
+@@ -410,7 +409,7 @@ public class Startup
          try
          {
              var htmlDoc = new HtmlDocument();
diff --git a/pkgs/servers/web-apps/kavita/default.nix b/pkgs/servers/web-apps/kavita/default.nix
index cf9e80c89d3e..2213b2560ede 100644
--- a/pkgs/servers/web-apps/kavita/default.nix
+++ b/pkgs/servers/web-apps/kavita/default.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kavita";
-  version = "0.7.13";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "kareadita";
     repo = "kavita";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-S4lJTLxNjGmgBJt89i3whBglMU2EQ0VelLG6iP6bY8g=";
+    hash = "sha256-0pVQ/gezi8Hzxrn/1QVFTOXeHRCayYkA3Kh5b81oW34=";
   };
 
   backend = buildDotnetModule {
@@ -51,7 +51,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     npmBuildScript = "prod";
     npmFlags = [ "--legacy-peer-deps" ];
     npmRebuildFlags = [ "--ignore-scripts" ]; # Prevent playwright from trying to install browsers
-    npmDepsHash = "sha256-jseoczC2Ay3D1wDUZbWXTYQJGSWdgobJ3+Z1bp+PQG4=";
+    npmDepsHash = "sha256-yy4vEI+aDgAcCyXyzfPm31oGiTl+Gsycyh69D3yex2I=";
   };
 
   dontBuild = true;
diff --git a/pkgs/servers/web-apps/kavita/nuget-deps.nix b/pkgs/servers/web-apps/kavita/nuget-deps.nix
index b8c8edf8bee3..9a85ef26b24f 100644
--- a/pkgs/servers/web-apps/kavita/nuget-deps.nix
+++ b/pkgs/servers/web-apps/kavita/nuget-deps.nix
@@ -4,37 +4,39 @@
 { fetchNuGet }: [
   (fetchNuGet { pname = "AutoMapper"; version = "12.0.1"; sha256 = "0s0wjl4ck3sal8a50x786wxs9mbca7bxaqk3558yx5wpld4h4z3b"; })
   (fetchNuGet { pname = "AutoMapper.Extensions.Microsoft.DependencyInjection"; version = "12.0.1"; sha256 = "0gjsjgfmfa3xx773idh7nxly4mz9ragiy0dqsc9xfzy7b5mlzw91"; })
+  (fetchNuGet { pname = "BouncyCastle.Cryptography"; version = "2.3.0"; sha256 = "1zdik0ifv2ir958ks7hgm9p11axwlkvbhw7vr98z24a009x4x02c"; })
+  (fetchNuGet { pname = "Cronos"; version = "0.8.4"; sha256 = "0gy75x1jb3ks2i9czb0sl5zdgf7mg14fn8174klb7jfhm5rcpnig"; })
+  (fetchNuGet { pname = "CsvHelper"; version = "31.0.3"; sha256 = "0ldq5715gj1j2w5qr2x28i6kfqfqk1zllhwcy2w1km2d8pvsdf1f"; })
   (fetchNuGet { pname = "Docnet.Core"; version = "2.6.0"; sha256 = "1b1nj984ly4zgj28fri1a6ych9sdiacxkms8pvzsclvyxkf0ri8m"; })
   (fetchNuGet { pname = "DotNet.Glob"; version = "3.1.3"; sha256 = "1klgj9m7i3g8x1yj96wnikvf0hlvr6rhqhl4mgis08imcrl95qg6"; })
   (fetchNuGet { pname = "EasyCaching.Core"; version = "1.9.2"; sha256 = "0qkzaxmn899hhfh32s8mhg3zcqqy2p05kaaldz246nram5gvf7qp"; })
   (fetchNuGet { pname = "EasyCaching.InMemory"; version = "1.9.2"; sha256 = "0ifcnmd3hqy44jvfwy3zzjccsxqalfv6clmj0clp9yln3js51awq"; })
-  (fetchNuGet { pname = "ExCSS"; version = "4.2.4"; sha256 = "04x3kaiywnjih8vrg5qafwvzgcsvshay8v3i2lv2ddkl6lnawh5n"; })
+  (fetchNuGet { pname = "ExCSS"; version = "4.2.5"; sha256 = "0p4456qkkxx9448y16xisj43a7syrq79wii2jnyqp2jm64wz5yb0"; })
   (fetchNuGet { pname = "Flurl"; version = "3.0.6"; sha256 = "1y82lbag0gkfpj361psk5761hn7k0zmrp9cpdvnjyp75bdimiaiy"; })
   (fetchNuGet { pname = "Flurl"; version = "3.0.7"; sha256 = "1i56774jsy2qlk573vzvcpjh5hf22yrhxs694j1c4gwggarnqz16"; })
   (fetchNuGet { pname = "Flurl.Http"; version = "3.2.4"; sha256 = "0vp5a1rrfi28in775d7fac96rcrikzjd2gbz0k3p925y1f2wlw5k"; })
-  (fetchNuGet { pname = "Hangfire"; version = "1.8.7"; sha256 = "11ygahx9bjd1y33cmihk5h7aggwcm7hvnzkg11cq066mrcrlzqr9"; })
-  (fetchNuGet { pname = "Hangfire.AspNetCore"; version = "1.8.7"; sha256 = "0lwvvk3d0rbghdk3k7r1z9a7hi6yagxynmzlp5bmb8raw5qx7q13"; })
-  (fetchNuGet { pname = "Hangfire.Core"; version = "1.6.1"; sha256 = "0rg4lzzckscck9gvjqhcn1yq9qymfs4dfkv6fwgnklyfpvxmsqbq"; })
+  (fetchNuGet { pname = "Hangfire"; version = "1.8.12"; sha256 = "0hbd21smpsb4vzi1y21zx4b51nd5z8isni0s0s2s78msgfh81a9b"; })
+  (fetchNuGet { pname = "Hangfire.AspNetCore"; version = "1.8.12"; sha256 = "1jaiz0nfmfjp9vr3x62qjgkwb2rk0jlzgl74ja089yaq6n3jwrqc"; })
   (fetchNuGet { pname = "Hangfire.Core"; version = "1.6.17"; sha256 = "0kr2hjnl9c4dpk4kf95jxcgsxalvixfm6xis37qn5ja9n9ygqans"; })
   (fetchNuGet { pname = "Hangfire.Core"; version = "1.8.0"; sha256 = "047g50s2nz32dnpqm9lnsvpgz8g3azip2mpc6s15wb78b8c9s48n"; })
-  (fetchNuGet { pname = "Hangfire.Core"; version = "1.8.7"; sha256 = "0f5l55sbw0shp0l9zv2h98l8ghvvhgdgqqwcq3rdlpapcv0w3z5j"; })
-  (fetchNuGet { pname = "Hangfire.InMemory"; version = "0.7.0"; sha256 = "0c6icc14kw5lybk2fqprks37vs3sv4j1acn8z12p3b62cxc2a3bb"; })
+  (fetchNuGet { pname = "Hangfire.Core"; version = "1.8.12"; sha256 = "19bbk3cqd1vw2x94gilvgwfjgl9yr5nvy8y4hjngx93jg563i17y"; })
+  (fetchNuGet { pname = "Hangfire.InMemory"; version = "0.8.1"; sha256 = "1i1j4mysk636dmf0p41w5bvi1i2nmr39svwj8svyqhij4yhih019"; })
   (fetchNuGet { pname = "Hangfire.MaximumConcurrentExecutions"; version = "1.1.0"; sha256 = "181147h5dsbml58ffq1jc7k6012fahi0n20wply9gmn6v1dh8h66"; })
-  (fetchNuGet { pname = "Hangfire.MemoryStorage.Core"; version = "1.4.0"; sha256 = "1hw8dlclxgg21ay1pqj9mxxm3alm03k9wxaz055lb14w3nzyma3c"; })
-  (fetchNuGet { pname = "Hangfire.NetCore"; version = "1.8.7"; sha256 = "09p53pm7z3v549w7bb85qf66wg62nx0gxy6rgkgk2lbyabacyi1a"; })
-  (fetchNuGet { pname = "Hangfire.SqlServer"; version = "1.8.7"; sha256 = "0kzddl3r5rxx1m95skj7hkimzkz9x57b51bhkq1yhvchjd9j5wzj"; })
-  (fetchNuGet { pname = "Hangfire.Storage.SQLite"; version = "0.4.0"; sha256 = "0kyyisvvx8m40wmfay1kcrzqwr3hhdlkppadkwsgk0r892d5drqw"; })
-  (fetchNuGet { pname = "HtmlAgilityPack"; version = "1.11.57"; sha256 = "0brswm659d2vb11021z7xylljlnaf344yf5q093bqxyhbxva8ijq"; })
+  (fetchNuGet { pname = "Hangfire.NetCore"; version = "1.8.12"; sha256 = "19987w1nng7mr5r66y5523q67ig2xb98im4b1ahqsc5s9mwkm0qh"; })
+  (fetchNuGet { pname = "Hangfire.SqlServer"; version = "1.8.12"; sha256 = "0h68hz7bzbypff1sg5hq1b0pfg7ckz506rfsiphqninrpczc9zsa"; })
+  (fetchNuGet { pname = "Hangfire.Storage.SQLite"; version = "0.4.1"; sha256 = "029prxla8mpck49rxk2rygns958xpss5lg1lizws2nm8q547kwil"; })
+  (fetchNuGet { pname = "HtmlAgilityPack"; version = "1.11.60"; sha256 = "0jpv1vry0mfwbswxn70knbkzsrwwz2ijsm5d4rj9jf2kk37m0xga"; })
   (fetchNuGet { pname = "Humanizer.Core"; version = "2.14.1"; sha256 = "1ai7hgr0qwd7xlqfd92immddyi41j3ag91h3594yzfsgsy6yhyqi"; })
+  (fetchNuGet { pname = "MailKit"; version = "4.4.0"; sha256 = "0v0hzvzxw960j7j5y4sns4v9zawhcbs558drrihmhp1a8al0cjk4"; })
   (fetchNuGet { pname = "MarkdownDeep.NET.Core"; version = "1.5.0.4"; sha256 = "0cpshs1lwmyyg40lvnf4b9s1z7yaw6s4a0341qr4ww40791gzvrl"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.Abstractions"; version = "2.2.0"; sha256 = "0vj7fhpk0d95nkkxz4q0rma6pb4ym96mx6nms4603y0l19h0k5yh"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.JwtBearer"; version = "8.0.1"; sha256 = "0519873g49gdbhnqizgxlikifcgswr09ybrh0wcwhbwiqnx49dg9"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.OpenIdConnect"; version = "8.0.1"; sha256 = "0n9x563ihvkp7cncwzlnyzm6zwxm6nsm8hv0j6f66jv7vzmcsq0q"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.JwtBearer"; version = "8.0.4"; sha256 = "1q2ai2jqc4zc2bdrbjng9fb7n0pch4f8bap3drd1v2vrha0d2r3q"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.OpenIdConnect"; version = "8.0.4"; sha256 = "1gscq70xqnv2sv5ka8m754mzq875qp3r45bfl36jfa6ag0ivjxsb"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Authorization"; version = "2.2.0"; sha256 = "1mpq8pmxlxfa625k2ghv6xcyy2wdpwv56xzya9mvmlnh50h1i8rx"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Authorization.Policy"; version = "2.2.0"; sha256 = "1d1zh65kfjf81j21ssmhr465vx08bra8424vgnrb22gdx03mhwd2"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Connections.Abstractions"; version = "2.2.0"; sha256 = "1rl94r8b0zq14f3dhfnvfjj1ivr81iw9zh5kdgs3zkdv0xc9x21j"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.Internal"; version = "8.0.1"; sha256 = "1gc2y4v1cvayy2fai02gsv1z6fr58kxb5jnmbjqxnd0zf49m88j7"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.KeyDerivation"; version = "8.0.1"; sha256 = "0fnvim0rmiw9jm8xvajb5b9w4wawp95szy2dfh2aw1n8jgzs207x"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.Internal"; version = "8.0.4"; sha256 = "0nb87rimc7brciav6ngfcx3g2k0g903fmax3w408m5dm8fan2ysp"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.KeyDerivation"; version = "8.0.4"; sha256 = "1l9lvyw81f6ckby1q3wy1677jdcp46i25m58qpkma7wd1gmg36pg"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Hosting.Abstractions"; version = "2.2.0"; sha256 = "043k651vbfshh3s997x42ymj8nb32419m7q3sjw5q2c27anrhfhv"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Hosting.Server.Abstractions"; version = "2.2.0"; sha256 = "0nz73bwrvhc1n7gd7xxm3p5ww2wx9qr9m9i43y20gh0c54adkygh"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http"; version = "2.2.0"; sha256 = "1fcrafpa57sab3as18idqknzlxkx49n4sxzlzik3sj6pcji5j17q"; })
@@ -43,7 +45,7 @@
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Connections.Common"; version = "1.1.0"; sha256 = "0x3hq0d3bs6n46nfvbd5n4cgi6m4yjfsf3k25xjcc8gcj66072iy"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Extensions"; version = "2.2.0"; sha256 = "118gp1mfb8ymcvw87fzgjqwlc1d1b0l0sbfki291ydg414cz3dfn"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Features"; version = "2.2.0"; sha256 = "0xrlq8i61vzhzzy25n80m7wh2kn593rfaii3aqnxdsxsg6sfgnx1"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Identity.EntityFrameworkCore"; version = "8.0.1"; sha256 = "08pnswpz17pfr923p9iv6imgzb8yfhsi4g31lxrhzglagahv4hiy"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Identity.EntityFrameworkCore"; version = "8.0.4"; sha256 = "17hmg59zk537vvp7vl59xrzjwbnlp6lb42sil7xszw7assb51795"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Routing"; version = "2.2.0"; sha256 = "12kv602j2rxp43l1v3618yz3pdd7hqc3r98ya0bqz6y2ppvhbyws"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Routing.Abstractions"; version = "2.2.0"; sha256 = "0d9wwz1rsh1fslbv1y72jpkvqv2v9n28rl3vslcg0x74lp2678ly"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR"; version = "1.1.0"; sha256 = "16p01hxcrpj7iiwcqmwjfmciyisxp1mr0qa1wcx1ja4i0m0g292l"; })
@@ -60,14 +62,14 @@
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Workspaces.Common"; version = "4.5.0"; sha256 = "1wjwsrnn5frahqciwaxsgalv80fs6xhqy6kcqy7hcsh7jrfc1kjq"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; sha256 = "0zxc0apx1gcx361jlq8smc9pfdgmyjh6hpka8dypc9w23nlsh6yj"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; sha256 = "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"; })
-  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.1"; sha256 = "1ippysjxq97vz4kd0jxiqbcamgd9xxb6n23ias5d4c7gbiwayz0z"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.1"; sha256 = "1k1c63vkzr020q0pb6xxf29xlgxldnzhlqpmpq9fig85y73s84ds"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.1"; sha256 = "1p8c2xfz8kgzswh9kq38mmy8qxfynnkywj9vwx15azbi8wcmh24x"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.1"; sha256 = "0l0fi9kiinj021sfk85qds1rdzavpkl24sjyzfyb8q8jmj5l2i0n"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.1"; sha256 = "1y21lmbnq271q7q1vsq1z5gnz4fy89zca8qzm6bg2qfv8bgqqrny"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.1"; sha256 = "12zmg196mpd0wacwyrckv6l5rl76dzmvr588i437xiwp0iyjcsh9"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.1"; sha256 = "1igwxjmzgzkzyhmg5jbis6hynnzf5vfzl00h053si89h5m6vvhmb"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.1"; sha256 = "0zg7whf02jlpcs72ngiydwd2xwwlvz3nja0xnyxv4k4w56qs8qcj"; })
+  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.4"; sha256 = "03i9b45n2vnsv4wdsk6qvjzj1ga2hcli168liyrqfa87l54skckd"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.4"; sha256 = "14a74ssvklpv9v1x023mfv3a5dncwfpw399larfp9qx7l6ifsjly"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.4"; sha256 = "1xs1cs29csnbahxgikc094xr878i8wp4h4n84xffaxms6wx5c1fb"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.4"; sha256 = "1h2bdh7cyw2z71brwjfirayd56rp3d2dx4qrhmsw573mb5jgvara"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.4"; sha256 = "1ni5qkjgarcjbqvw9cx0481fc99nna7rnp7170wq650jwm0f8c2f"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.4"; sha256 = "17v2wm6wwsl169sq6lawxhn9wvd299n1hdrxih8c3lzvi8igy4sd"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.4"; sha256 = "0h9ib00k54jmsrbhipr33q3sqd3mdiw31qi4g8vak1slal9b70zw"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.4"; sha256 = "0pa0xz96g2f99yj3x3hfj362br3zjcx3qd89ckqmymqpvnhk4bw0"; })
   (fetchNuGet { pname = "Microsoft.Extensions.ApiDescription.Server"; version = "6.0.5"; sha256 = "1pi2bm3cm0a7jzqzmfc2r7bpcdkmk3hhjfvb2c81j7wl7xdw3624"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Caching.Abstractions"; version = "8.0.0"; sha256 = "04m6ywsf9731z24nfd14z0ah8xl06619ba7mkdb4vg8h5jpllsn4"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Caching.Memory"; version = "8.0.0"; sha256 = "0bv8ihd5i2gwr97qljwf56h8mdwspmlw0zs64qyk608fb3ciwi25"; })
@@ -103,8 +105,8 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "2.2.0"; sha256 = "1xc7xr1nq7akfahyl5in9iyxrygap2xi9nxh39rfm37sf8lk55v1"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "3.0.0"; sha256 = "13ijaki0nzlvbwxjxb1hjhzj86jgn23nw34gdwp2l7bf3x2h4hw9"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "8.0.0"; sha256 = "00d5dwmzw76iy8z40ly01hy9gly49a7rpf7k7m99vrid1kxp346h"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Core"; version = "8.0.1"; sha256 = "0gf68x3zxbn3gxzdjmbfcqhm58ybxvpanl4pq8vs5g492qw7h24b"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Stores"; version = "8.0.1"; sha256 = "19c0by2r85jqz6pj8mnr047aasasr7fbzi3ih04gchj8la69ka5h"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Core"; version = "8.0.4"; sha256 = "1k9x667wi3izxjjiprqkdgajfn1slb0w8lyjdp2x441hp4wyzf6c"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Stores"; version = "8.0.4"; sha256 = "0dajblmwx1z7jk08ycsfabv30b28mvazgv3wq6m7pnlrpijkvcp4"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "2.0.0"; sha256 = "1jkwjcq1ld9znz1haazk8ili2g4pzfdp6i7r7rki4hg3jcadn386"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "6.0.0"; sha256 = "0fd9jii3y3irfcwlsiww1y9npjgabzarh33rn566wpcz24lijszi"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "8.0.0"; sha256 = "0nppj34nmq25gnrg0wh1q22y4wdqbih4ax493f226azv8mkp9s1i"; })
@@ -123,7 +125,7 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "2.2.0"; sha256 = "1b20yh03fg4nmmi3vlf6gf13vrdkmklshfzl3ijygcs4c2hly6v0"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "6.0.0"; sha256 = "008pnk2p50i594ahz308v81a41mbjz9mwcarqhmrjpl2d20c868g"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.0"; sha256 = "0p50qn6zhinzyhq9sy5svnmqqwhw2jajs2pbjh9sah504wjvhscz"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.1"; sha256 = "01jsya858i861x6d7qbl3wlr0gp2y7x2m4q6f1r743w360z8zgpn"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.2"; sha256 = "0as39ml1idgp42yvh725ddqp4illq87adzd1ymzx6xjxsxsjadq2"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "6.0.0"; sha256 = "1k6q91vrhq1r74l4skibn7wzxzww9l74ibxb2i8gg4q6fzbiivba"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "8.0.0"; sha256 = "04nm8v5a3zp0ill7hjnwnja3s2676b4wffdri8hdk2341p7mp403"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "2.0.0"; sha256 = "1xppr5jbny04slyjgngxjdm0maxdh47vq481ps944d7jrfs0p3mb"; })
@@ -132,14 +134,14 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; sha256 = "1kjiw6s4yfz9gm7mx3wkhp06ghnbs95icj9hi505shz9rjrg42q2"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "8.0.0"; sha256 = "0aldaz5aapngchgdr7dax9jw5wy7k7hmjgjpfgfv1wfif27jlkqm"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.1.2"; sha256 = "01jdg8b1hi4nx5h1cn9baalfkp4y70kc2wf4lz77kw8w1fvrppa0"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.2.0"; sha256 = "06r0hv7n4v1s751k2032frfh9hkfkxpi42rdz10llcay7lcqjjh6"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.2.0"; sha256 = "17xbqb351xfnniwj2322xyaiajbdilihdp9j9knbr80d8rm62sv2"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.5.1"; sha256 = "0kdxb47rafvk6mx0xkf2pik7b638b2d847jlhzi3fvj6swg3v15b"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.5.1"; sha256 = "1ny97mhld7vzn5xwxvcy1jhfq4mw15wrk9c77z6cg2fydkgawyzx"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.1.2"; sha256 = "1yi7s2pm4f8vl6b0qck0nrfsrf1h4jwamznkzl75n1cwxpbdikp8"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.2.0"; sha256 = "01zfbgg1vcqq36cg5sdrq0fy78fywm7m2v4a79011k5ng9g0ck7z"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.5.1"; sha256 = "1zharnx3vhrfdn761w16ygxyj9ig5zn71346aqkk0nmzlll3gfjf"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols"; version = "7.1.2"; sha256 = "0ql5b7472g7359b1pqh2lfm8s3lym9vyzj1xpvbhsv9syk9czrg8"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols.OpenIdConnect"; version = "7.1.2"; sha256 = "06r9i1m6zhfbbx18p0drpcbswirlq7xg0wm3iqfjgzxyv053033h"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.1.2"; sha256 = "1q70c1ax9f5nggqp4g8nyfaz0481grsaxhp85cmjpmx8l3q35zx9"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.2.0"; sha256 = "17xi2sb041dkigkkvnbg0lb5r1i9gjxv2irncqycg60hl1fcp27l"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.5.1"; sha256 = "14fjr679hwal35mdwdv4w40mnxzfnnx65yc16807zzkyri011zc1"; })
   (fetchNuGet { pname = "Microsoft.IO.RecyclableMemoryStream"; version = "3.0.0"; sha256 = "1zl39k27r4zq75r1x1zr1yl4nzxpkxdnnv6dwd4qp0xr22my85aq"; })
   (fetchNuGet { pname = "Microsoft.Net.Http.Headers"; version = "2.2.0"; sha256 = "0w6lrk9z67bcirq2cj2ldfhnizc6id77ba6i30hjzgqjlyhh1gx5"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Jit"; version = "1.0.2"; sha256 = "0jaan2wmg80lr0mhgfy70kb5cqjwv1a2ikmxgd0glpcxp7wr7pag"; })
@@ -154,26 +156,25 @@
   (fetchNuGet { pname = "Microsoft.NETCore.Windows.ApiSets"; version = "1.0.1"; sha256 = "16k8chghkr25jf49banhzl839vs8n3vbfpg4wn4idi0hzjipix78"; })
   (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.2.3"; sha256 = "07b19k89whj69j87afkz86gp9b3iybw8jqwvlgcn43m7fb2y99rr"; })
   (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.3.1"; sha256 = "0icds4jxz90v156vkbza1s1rqdf737glfddbllkp6y2zcnin99yv"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1"; sha256 = "1n8ap0cmljbqskxpf8fjzn7kh1vvlndsa75k01qig26mbw97k2q7"; })
   (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
   (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "8.0.0"; sha256 = "05392f41ijgn17y8pbjcx535l1k09krnq3xdp60kyq568sn6xk2i"; })
+  (fetchNuGet { pname = "MimeKit"; version = "4.4.0"; sha256 = "107225n55ib9y0y7azarjq3xcf8shsn329fbh5rmpcj5rhcv47kx"; })
   (fetchNuGet { pname = "MimeTypeMapOfficial"; version = "1.0.17"; sha256 = "1l5d42pgfz4cpvgdyxf2crzyv7jycky5mhmrrl5501p3806i3r0y"; })
   (fetchNuGet { pname = "Mono.TextTemplating"; version = "2.2.1"; sha256 = "1ih6399x4bxzchw7pq5195imir9viy2r1w702vy87vrarxyjqdp1"; })
   (fetchNuGet { pname = "Nager.ArticleNumber"; version = "1.0.7"; sha256 = "1lfhr20527xhzql5nsn5c1s5as79haz9xcqan8pqsfk200hc27af"; })
-  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.0"; sha256 = "0nmmv4yw7gw04ik8ialj3ak0j6pxa9spih67hnn1h2c38ba8h58k"; })
   (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
-  (fetchNuGet { pname = "NetVips"; version = "2.4.0"; sha256 = "0q4ghm4d19hl6ilxvvmlgdffp3gjnkrirc5665lc85rvziw6xcx9"; })
-  (fetchNuGet { pname = "NetVips.Native"; version = "8.15.1"; sha256 = "1ah8frrady684nxf3w4iq6gjcmsrmhndhy6mcyrlsw2i4l4wf1lw"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-arm"; version = "8.15.1"; sha256 = "0c4q5wwb7zmz8skzyyg6iag7qlxbc9pklzvi3qlml6c3qwv4b0mi"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-arm64"; version = "8.15.1"; sha256 = "1dwjd780l1b1831x1ksiha0ds6414inwjxcl6mb5k3imzfzfck3a"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-musl-arm64"; version = "8.15.1"; sha256 = "1md5dk905s28n8q2j6c5wp7zglzmcaqy4dim1qgillkk1651pqnl"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-musl-x64"; version = "8.15.1"; sha256 = "1xwlwfidhwdnnw9c9dxag3y90h3l4n408jgq9v25ad8m441134zj"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-x64"; version = "8.15.1"; sha256 = "1905sd6zf8qbsfdbh16i6c5f9dznqdgzhz1fywvjfspsbdj3hilp"; })
-  (fetchNuGet { pname = "NetVips.Native.osx-arm64"; version = "8.15.1"; sha256 = "03gj78ibggm32nr6qpiykq0h463y81rzsawfdp091ikbxmnm98c7"; })
-  (fetchNuGet { pname = "NetVips.Native.osx-x64"; version = "8.15.1"; sha256 = "0r0mqfk9i59nvj15wgzh2rymv6fl0liw5bdcgmk80bfsfjqsrv4d"; })
-  (fetchNuGet { pname = "NetVips.Native.win-arm64"; version = "8.15.1"; sha256 = "1l8qwdw03vbc4dkmvw2iyw7b8w0cm20mydgv6diby48q46g5xgcy"; })
-  (fetchNuGet { pname = "NetVips.Native.win-x64"; version = "8.15.1"; sha256 = "1vriqri1ppk8glmsyxb7cfcsi42kz6skpx5ggqkrxsfp9yz22x46"; })
-  (fetchNuGet { pname = "NetVips.Native.win-x86"; version = "8.15.1"; sha256 = "0p8166fsqmyzy5xvfy2raxp9h38m702mbqf9ab88vxig3i4rsxk8"; })
+  (fetchNuGet { pname = "NetVips"; version = "2.4.1"; sha256 = "1jf0carq4aqw12shl91dbxmc65djhqlm5rlca1dag3aj5h05jzaj"; })
+  (fetchNuGet { pname = "NetVips.Native"; version = "8.15.2"; sha256 = "0jngfr5p37x5mjrrq7rq62nzq2fi9fsvls25i48ra62fscj1skva"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-arm"; version = "8.15.2"; sha256 = "1pcc2vkgjbcx1a88bnwn2vv71k7vv1q3hzcnpwbyaq8drh2q9zsy"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-arm64"; version = "8.15.2"; sha256 = "11wd1fxmipcd897rab9rdvb06ax71qg2zd4vsbdf0bqjq7ja741x"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-musl-arm64"; version = "8.15.2"; sha256 = "16fc3bf5n13yhd03wfdi3g8d9n2qgmbwiwil1vh3vxwb3qrdii03"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-musl-x64"; version = "8.15.2"; sha256 = "0iznsfxg0f3xw36j9rxa37zr7vryvxaj3a303mrsvj47qgxjd1fs"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-x64"; version = "8.15.2"; sha256 = "09zcfx71107wifj2qhvqbjcjsjs7v790mpplq7aczfvj8kccnfdx"; })
+  (fetchNuGet { pname = "NetVips.Native.osx-arm64"; version = "8.15.2"; sha256 = "04ak05razgqcizpbxwfcmb2cgzbq7yw2jgb74p354nkmrs7knwbr"; })
+  (fetchNuGet { pname = "NetVips.Native.osx-x64"; version = "8.15.2"; sha256 = "1028p1iyvp7rhmssr6hk1f5n2z2y7cvslf11kzb826gxd2yvn52m"; })
+  (fetchNuGet { pname = "NetVips.Native.win-arm64"; version = "8.15.2"; sha256 = "0yggh8mqvqidrlhc3756rxsaarhmvvp4yhwj0ffgyzzclcbff4nf"; })
+  (fetchNuGet { pname = "NetVips.Native.win-x64"; version = "8.15.2"; sha256 = "0y8x5w70c7y7xmc8g1b200d2yhkg8nx41k337c2416zfbm268wzg"; })
+  (fetchNuGet { pname = "NetVips.Native.win-x86"; version = "8.15.2"; sha256 = "08p2wbdv1j50s1yllycc1c5cglaimssmn3p1v1qybxmaasj2ff3x"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "11.0.1"; sha256 = "1z68j07if1xf71lbsrgbia52r812i2dv541sy44ph4dzjjp7pd4m"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "11.0.2"; sha256 = "1784xi44f4k8v1fr696hsccmwpy94bz7kixxqlri98zhcxn406b2"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "12.0.2"; sha256 = "0w2fbji1smd2y7x25qqibf1qrznmv4s6s0jvrbvr6alb7mfyqvh5"; })
@@ -199,13 +200,9 @@
   (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
   (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
   (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.0.0"; sha256 = "1ppk69xk59ggacj9n7g6fyxvzmk1g5p4fkijm0d7xqfkig98qrkf"; })
   (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
-  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.1.0"; sha256 = "0d720z4lzyfcabmmnvh0bnj76ll7djhji2hmfh3h44sdkjnlkknk"; })
   (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.3.0"; sha256 = "1vvivbqsk6y4hzcid27pqpm5bsi6sc50hvqwbcx8aap5ifrxfs8d"; })
-  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.0.1"; sha256 = "1hgv2bmbaskx77v8glh7waxws973jn4ah35zysnkxmf0196sfxg6"; })
   (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; sha256 = "1n6rgz5132lcibbch1qlf0g9jk60r0kqv087hxc0lisy50zpm7kk"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography"; version = "4.0.0"; sha256 = "0k57aa2c3b10wl3hfqbgrl7xq7g8hh3a3ir44b31dn5p61iiw3z9"; })
   (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "1b61p6gw1m02cc1ry996fl49liiwky6181dzr873g9ds92zl326q"; })
   (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
   (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
@@ -226,7 +223,7 @@
   (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
   (fetchNuGet { pname = "Scrutor"; version = "3.3.0"; sha256 = "0qdfbp73hbsiqbv0rg6f91hnp1j535iqk8bmp3ickwd7w337m1vi"; })
   (fetchNuGet { pname = "Serilog"; version = "3.1.1"; sha256 = "0ck51ndmaqflsri7yyw5792z42wsp91038rx2i6vg7z4r35vfvig"; })
-  (fetchNuGet { pname = "Serilog.AspNetCore"; version = "8.0.0"; sha256 = "0g1scn1a5paiydxk1nnrwzzqny2vabc3hniy6jwjqycag6ch2pni"; })
+  (fetchNuGet { pname = "Serilog.AspNetCore"; version = "8.0.1"; sha256 = "0vmrbhj9vb00fhvxrw3w5j1gvdx4xzxz8d2cp65hps988zxwykkb"; })
   (fetchNuGet { pname = "Serilog.Enrichers.Thread"; version = "3.2.0-dev-00752"; sha256 = "0d0phxzdpc8xkbyd18s1dcv9xa22gqs2i2x5cpa9qzj0g8zwp641"; })
   (fetchNuGet { pname = "Serilog.Extensions.Hosting"; version = "8.0.0"; sha256 = "10cgp4nsrzkld5yxnvkfkwd0wkc1m8m7p5z42w4sqd8f188n8i9q"; })
   (fetchNuGet { pname = "Serilog.Extensions.Logging"; version = "3.0.1"; sha256 = "069qy7dm5nxb372ij112ppa6m99b4iaimj3sji74m659fwrcrl9a"; })
@@ -239,8 +236,8 @@
   (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.0"; sha256 = "097rngmgcrdfy7jy8j7dq3xaq2qky8ijwg0ws6bfv5lx0f3vvb0q"; })
   (fetchNuGet { pname = "Serilog.Sinks.SignalR.Core"; version = "0.1.2"; sha256 = "16f86661vr7gw8xay1735y551p0z39mks7xagwxb8lxqxwmm4gzf"; })
   (fetchNuGet { pname = "SharpCompress"; version = "0.36.0"; sha256 = "164ikphk4glldr73l247cjb65v064md0ccccm06rh0zvjq5iqlph"; })
-  (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "3.1.2"; sha256 = "0bc0753aczgw9mi9bcgly2x71w4adlr35krgf023vppc36809yhg"; })
-  (fetchNuGet { pname = "SonarAnalyzer.CSharp"; version = "9.17.0.82934"; sha256 = "1hk1fh8zp0ng6q29i2y17jdvbxxl3zgbzzag0dvap4wadqdpad1z"; })
+  (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "3.1.3"; sha256 = "0f36my2lzkgc5fvk6s0lh4gn15vxhbl2zg71rdql7vrzh8b77c6q"; })
+  (fetchNuGet { pname = "SonarAnalyzer.CSharp"; version = "9.23.1.88495"; sha256 = "1mj18mc8k9nq074jksnh71r5cnlr45730n3ww5gi6c17xnar0m6p"; })
   (fetchNuGet { pname = "sqlite-net-pcl"; version = "1.8.116"; sha256 = "0h3s43pfjqgy9amrdj4d7p65hmys895hlkczj62wg974qb4z8l2y"; })
   (fetchNuGet { pname = "SQLitePCLRaw.bundle_e_sqlite3"; version = "2.1.6"; sha256 = "0pzgdfl707pd9fz108xaff22w7c2y27yaix6wfp36phqkdnzz43m"; })
   (fetchNuGet { pname = "SQLitePCLRaw.bundle_green"; version = "2.0.4"; sha256 = "1197ynpm4fl6il9vi0mi1s1pmw3rk3j0a05kwrxpqlfgp7iwhc22"; })
@@ -251,23 +248,20 @@
   (fetchNuGet { pname = "SQLitePCLRaw.provider.dynamic_cdecl"; version = "2.0.4"; sha256 = "084r98kilpm0q1aw41idq8slncpd7cz65g0m1wr0p8d12x8z5g6j"; })
   (fetchNuGet { pname = "SQLitePCLRaw.provider.e_sqlite3"; version = "2.1.6"; sha256 = "1vs1c7yhi0mdqrd35ji289cxkhg7dxdnn6wgjjbngvqxkdhkyxyc"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore"; version = "6.5.0"; sha256 = "0k61chpz5j59s1yax28vx0mppx20ff8vg8grwja112hfrzj1f45n"; })
-  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters"; version = "8.0.0"; sha256 = "13jiyn00cxslrgagkw69h6nxjxrrbyg3pwy8gj5iagk5x5gi6b6f"; })
-  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters.Abstractions"; version = "8.0.0"; sha256 = "1sz2r45z2prglw3svrqy7xzl0z958yip71x6s97xrxsj776sqcf9"; })
+  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters"; version = "8.0.1"; sha256 = "1qs9awkh9jijmrdb0w0j669sn1i5wrl3bk5phpq1kscfa6ywkp5g"; })
+  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters.Abstractions"; version = "8.0.1"; sha256 = "1739p184hihfl6p42bcn66d2wflilhrbsyq0ddbbqxgxi3kdcxn6"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.Swagger"; version = "5.0.0"; sha256 = "1341nv8nmh6avs3y7w2szzir5qd0bndxwrkdmvvj3hcxj1126w2f"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.Swagger"; version = "6.5.0"; sha256 = "1s6axf6fin8sss3bvzp0s039rxrx71vx4rl559miw12bz3lld8kc"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.SwaggerGen"; version = "5.0.0"; sha256 = "00swg2avqnb38q2bsxljd34n8rpknp74h9vbn0fdnfds3a32cqr4"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.SwaggerGen"; version = "6.5.0"; sha256 = "0hq93gy5vyrigpdk9lhqwxglxwkbxa8ydllwcqs4bwfcsspzrs83"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.SwaggerUI"; version = "6.5.0"; sha256 = "17hx7kc187higm0gk67dndng3n7932sn3fwyj48l45cvyr3025h7"; })
-  (fetchNuGet { pname = "System.AppContext"; version = "4.1.0"; sha256 = "0fv3cma1jp4vgj7a8hqc9n7hr1f1kjp541s6z0q1r6nazb4iz9mz"; })
   (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; sha256 = "1649qvy3dar900z3g817h17nl8jp4ka5vcfmsr05kh0fshn7j3ya"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.0.0"; sha256 = "13s659bcmg9nwb6z78971z1lr6bmh2wghxi1ayqyzl4jijd351gr"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.5.0"; sha256 = "1ywfqn4md6g3iilpxjn5dsr0f5lx6z0yvhqp4pgjcamygg73cz2c"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.5.1"; sha256 = "04kb1mdrlcixj9zh1xdi5as0k0qi8byr5mi3p3jcxx72qz93s2y3"; })
   (fetchNuGet { pname = "System.CodeDom"; version = "4.4.0"; sha256 = "1zgbafm5p380r50ap5iddp11kzhr9khrf2pnai6k593wjar74p1g"; })
   (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; sha256 = "1ga40f5lrwldiyw6vy67d0sg7jd7ww6kgwbksm19wrvq9hr0bsm6"; })
   (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
-  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.0.12"; sha256 = "07y08kvrzpak873pmyxs129g1ch8l27zmg51pcyj2jvq03n0r0fc"; })
   (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "6.0.0"; sha256 = "1js98kmjn47ivcvkjqdmyipzknb9xbndssczm8gq224pbaj1p88c"; })
   (fetchNuGet { pname = "System.ComponentModel.Annotations"; version = "4.5.0"; sha256 = "1jj6f6g87k0iwsgmg3xmnn67a14mq88np0l1ys5zkxhkvbc8976p"; })
@@ -277,34 +271,28 @@
   (fetchNuGet { pname = "System.Composition.Hosting"; version = "6.0.0"; sha256 = "0big5nk8c44rxp6cfykhk7rxvn2cgwa99w6c3v2a36adc3lj36ky"; })
   (fetchNuGet { pname = "System.Composition.Runtime"; version = "6.0.0"; sha256 = "0vq5ik63yii1784gsa2f2kx9w6xllmm8b8rk0arid1jqdj1nyrlw"; })
   (fetchNuGet { pname = "System.Composition.TypedParts"; version = "6.0.0"; sha256 = "0y9pq3y60nyrpfy51f576a0qjjdh61mcv8vnik32pm4bz56h9q72"; })
-  (fetchNuGet { pname = "System.Console"; version = "4.0.0"; sha256 = "0ynxqbc3z1nwbrc11hkkpw9skw116z4y9wjzn7id49p9yi7mzmlf"; })
   (fetchNuGet { pname = "System.Console"; version = "4.3.0"; sha256 = "1flr7a9x920mr5cjsqmsy9wgnv3lvd0h1g521pdr1lkb2qycy7ay"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "0gmjghrqmlgzxivd2xl50ncbglb7ljzb66rlx8ws6dv8jm0d5siz"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
-  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.0.0"; sha256 = "1n6c3fbz7v8d3pn77h4v5wvsfrfg7v1c57lg3nff3cjyh597v23m"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.3.0"; sha256 = "0z6m3pbiy0qw6rn3n209rrzf9x1k4002zh90vwcrsym09ipm2liq"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "6.0.0"; sha256 = "0rrihs9lnb1h6x4h0hn6kgfnh58qq7hx8qq99gh6fayx4dcnx3s5"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "8.0.0"; sha256 = "0nzra1i0mljvmnj1qqqg37xs7bl71fnpl68nwmdajchh65l878zr"; })
   (fetchNuGet { pname = "System.Diagnostics.EventLog"; version = "8.0.0"; sha256 = "1xnvcidh2qf6k7w8ij1rvj0viqkq84cq47biw0c98xhxg5rk3pxf"; })
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1"; sha256 = "19cknvg07yhakcvpxg3cxa0bwadplin6kyxd8mpjjpwnp56nl85x"; })
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "0in3pic3s2ddyibi8cvgl102zmvp9r9mchh82ns9f0ms4basylw1"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; sha256 = "1d2r76v1x610x61ahfpigda89gd13qydz6vbwzhpqlyvq8jj6394"; })
   (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
-  (fetchNuGet { pname = "System.Drawing.Common"; version = "8.0.1"; sha256 = "02l7y2j6f2qykl90iac28nvw1cnhic8vzixlq5fznw0zj72knz25"; })
+  (fetchNuGet { pname = "System.Drawing.Common"; version = "8.0.4"; sha256 = "17i50sbv5v9c138gjammn9nf1p0qa0lpmvmw26ffdhmlshjla6fi"; })
   (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.0.11"; sha256 = "1pla2dx8gkidf7xkciig6nifdsb494axjvzvann8g2lp3dbqasm9"; })
+  (fetchNuGet { pname = "System.Formats.Asn1"; version = "8.0.0"; sha256 = "04h75wflmzl0qh125p0209wx006rkyxic1y404m606yjvpl2alq1"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
-  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.0.1"; sha256 = "0bv0alrm2ck2zk3rz25lfyk9h42f3ywq77mx1syl6vvyncnpg4qh"; })
   (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq"; })
-  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.0.1"; sha256 = "0hjhdb5ri8z9l93bw04s7ynwrjrhx2n0p34sf33a9hl9phz69fyc"; })
   (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; sha256 = "02a5zfxavhv3jd437bsncbhd2fp1zv4gxzakp1an9l6kdq1mcqls"; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.2.0"; sha256 = "000sfpv1bjwkwwb65fl85f3ifwvdadzkx93gwsb56vrsh00kd026"; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.5.1"; sha256 = "0priwzi8w2rnspppldl2mhi4fh835dpyyy8f7ri6qbqs7n8l746n"; })
   (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
   (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
-  (fetchNuGet { pname = "System.IO.Abstractions"; version = "20.0.4"; sha256 = "0qdp4522v0k219iixg4zk7vmpyx149rsnqhq3ykzkpd2mdg0f4nx"; })
-  (fetchNuGet { pname = "System.IO.Compression"; version = "4.1.0"; sha256 = "0iym7s3jkl8n0vzm3jd6xqg9zjjjqni05x45dwxyjr2dy88hlgji"; })
+  (fetchNuGet { pname = "System.IO.Abstractions"; version = "21.0.2"; sha256 = "1mp73hkrxb83bs16458qgf7l3n20ddnfkij1pd603dr8w22j7279"; })
   (fetchNuGet { pname = "System.IO.Compression"; version = "4.3.0"; sha256 = "084zc82yi6yllgda0zkgl2ys48sypiswbiwrv7irb3r0ai1fp4vz"; })
-  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.0.1"; sha256 = "0h72znbagmgvswzr46mihn7xm7chfk2fhrp5krzkjf29pz0i6z82"; })
   (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.3.0"; sha256 = "1yxy5pq4dnsm9hlkg9ysh5f6bf3fahqqb6p8668ndy5c0lk7w2ar"; })
   (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; sha256 = "0kgfpw6w4djqra3w5crrg8xivbanh1w9dh3qapb28q060wb9flp1"; })
   (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw"; })
@@ -318,12 +306,9 @@
   (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
   (fetchNuGet { pname = "System.Memory"; version = "4.5.1"; sha256 = "0f07d7hny38lq9w69wx4lxkn4wszrqf9m9js6fh9is645csm167c"; })
   (fetchNuGet { pname = "System.Memory"; version = "4.5.3"; sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a"; })
-  (fetchNuGet { pname = "System.Net.Http"; version = "4.1.0"; sha256 = "1i5rqij1icg05j8rrkw4gd4pgia1978mqhjzhsjg69lvwcdfg8yb"; })
   (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; sha256 = "1i4gc757xqrzflbk7kc5ksn20kwwfjhw9w7pgdkn19y3cgnl302j"; })
   (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; sha256 = "15r75pwc0rm3vvwsn8rvm2krf929mjfwliv0mpicjnii24470rkq"; })
-  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.0.11"; sha256 = "10xzzaynkzkakp7jai1ik3r805zrqjxiz7vcagchyxs2v26a516r"; })
   (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; sha256 = "0c87k50rmdgmxx7df2khd9qj7q35j9rzdmm2572cc55dygmdk3ii"; })
-  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.1.0"; sha256 = "1385fvh8h29da5hh58jm1v78fzi9fi5vj93vhlm2kvqpfahvpqls"; })
   (fetchNuGet { pname = "System.Net.Sockets"; version = "4.3.0"; sha256 = "1ssa65k6chcgi6mfmzrznvqaxk8jp0gvl77xhf1hbzakjnpxspla"; })
   (fetchNuGet { pname = "System.Net.WebSockets.WebSocketProtocol"; version = "4.5.1"; sha256 = "1n0ag9ws6fgyqcz39xyk5dnchskfji8bcgqw90i2ai7lyvd843p6"; })
   (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12"; sha256 = "1sybkfi60a4588xn34nd9a58png36i0xr4y4v4kqpg8wlvy5krrj"; })
@@ -358,25 +343,17 @@
   (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; sha256 = "01kxqppx3dr3b6b286xafqilv4s2n0gqvfgzfd4z943ga9i81is1"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.0.0"; sha256 = "0glmvarf3jz5xh22iy3w9v3wyragcm4hfdr17v90vs7vcrm7fgp6"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; sha256 = "0q18r1sh4vn7bvqgd6dmqlw5v28flbpj349mkdish2vjyvmnb2ii"; })
-  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.0.1"; sha256 = "1y308zfvy0l5nrn46mqqr4wb4z1xk758pkk8svbz8b5ij7jnv4nn"; })
   (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
   (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.1.1"; sha256 = "042rfjixknlr6r10vx2pgf56yming8lkjikamg3g4v29ikk78h7k"; })
   (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; sha256 = "0jvfn7j22l3mm28qjy3rcw287y9h65ha4m940waaxah07jnbzrhn"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.2.0"; sha256 = "148s9g5dgm33ri7dnh19s4lgnlxbpwvrw2jnzllq2kijj4i4vs85"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.2.0"; sha256 = "118jijz446kix20blxip0f0q8mhsh9bz118mwc2ch1p6g7facpzc"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.0.0"; sha256 = "1cwv8lqj8r15q81d2pz2jwzzbaji0l28xfrpw29kdpsaypm92z2q"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; sha256 = "1x5wcrddf2s3hb8j78cry7yalca4lb5vfnkrysagbn6r9x6xvrx1"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.0.0"; sha256 = "0a8y1a5wkmpawc787gfmnrnbzdgxmx1a14ax43jf3rj9gxmy3vk4"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; sha256 = "1jr6w70igqn07k5zs1ph6xja97hxnb3mqbspdrff6cvssgrixs32"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.0.0"; sha256 = "16sx3cig3d0ilvzl8xxgffmxbiqx87zdi8fc73i3i7zjih1a7f4q"; })
   (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.0.0"; sha256 = "0i7cfnwph9a10bm26m538h5xcr8b36jscp9sy1zhgifksxz4yixh"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "8.0.0"; sha256 = "04kqf1lhsq3fngiljanmrz2774x5h2fc8p57v04c51jwwqhwi9ya"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.1.0"; sha256 = "0clg1bv55mfv5dq00m19cp634zx6inm31kf8ppbq1jgyjf2185dh"; })
   (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h"; })
   (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
   (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
@@ -385,6 +362,7 @@
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "6.0.0"; sha256 = "0gm2kiz2ndm9xyzxgi0jhazgwslcs427waxgfa30m7yqll1kcrww"; })
+  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "8.0.0"; sha256 = "1lgdd78cik4qyvp2fggaa0kzxasw6kc9a6cjqw46siagrm0qnc3y"; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; sha256 = "08nsfrpiwsg9x5ml4xyl3zyvjfdi4mvbqf93kjdh11j4fwkznizs"; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
   (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "4.5.0"; sha256 = "0srd5bva52n92i90wd88pzrqjsxnfgka3ilybwh7s6sf469y5s53"; })
@@ -403,14 +381,14 @@
   (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; sha256 = "1xxcx2xh8jin360yjwm4x4cf5y3a2bwpn2ygkfkwkicz7zk50s2z"; })
   (fetchNuGet { pname = "System.Threading.Thread"; version = "4.0.0"; sha256 = "1gxxm5fl36pjjpnx1k688dcw8m9l7nmf802nxis6swdaw8k54jzc"; })
   (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; sha256 = "027s1f4sbx0y1xqw2irqn6x161lzj8qwvnh2gn78ciiczdv10vf1"; })
-  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.0.1"; sha256 = "15n54f1f8nn3mjcjrlzdg6q3520571y012mx7v991x2fvp73lmg6"; })
   (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; sha256 = "1nx773nsx6z5whv8kaa1wjh037id2f1cxhb69pvgv12hd2b6qs56"; })
   (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11"; sha256 = "0c6ky1jk5ada9m94wcadih98l6k1fvf6vi7vhn1msjixaha419l5"; })
   (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11"; sha256 = "0n4lvpqzy9kc7qy1a4acwwd7b7pnvygv895az5640idl2y9zbz18"; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
-  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions"; version = "20.0.4"; sha256 = "16jw4zw8pvck754r6744d11460w1fih8c77r8yzzw2w58iv2mns6"; })
-  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions.Wrappers"; version = "20.0.4"; sha256 = "1c5sf8dva9vswl2qqkc6xcmznia8d5nqw46yvk4b1f9idv53j5nz"; })
+  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions"; version = "21.0.2"; sha256 = "1mc358wlq9y21gzj44af8hxlyjm0ws0i9f5vmsn31dn5wbfh4dy5"; })
+  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions.Wrappers"; version = "21.0.2"; sha256 = "0q3vghssyh6rd7w7n4rjv5ngh5byf1y80i22yw9fx10f4hcsw1az"; })
   (fetchNuGet { pname = "VersOne.Epub"; version = "3.3.1"; sha256 = "1v7ms857yhm38syi4l63g9hzn0y08n8csr4z4i56xmzpj1big2s6"; })
+  (fetchNuGet { pname = "xunit.assert"; version = "2.7.0"; sha256 = "14g5pvv709ykkz3lgqbdisksqfll72792fkrg4qr0s8jcp38kpyc"; })
   (fetchNuGet { pname = "ZstdSharp.Port"; version = "0.7.4"; sha256 = "0087rymvclj96pscd8lbjidsdg1g4p83m6y20bcicz8sx7jnnzyg"; })
 ]
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 1786fce83a1f..3ab2382d0198 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -83,9 +83,9 @@ let
         nativeTools = false;
         nativeLibc = false;
 
-        buildPackages = lib.optionalAttrs (prevStage ? stdenv) {
-          inherit (prevStage) stdenv;
-        };
+        expand-response-params = lib.optionalString
+          (prevStage.stdenv.hasCC or false && prevStage.stdenv.cc != "/dev/null")
+          prevStage.expand-response-params;
 
         extraPackages = [
           prevStage.llvmPackages.compiler-rt
@@ -124,6 +124,7 @@ let
         inherit (prevStage) coreutils gnugrep;
 
         stdenvNoCC = prevStage.ccWrapperStdenv;
+        runtimeShell = prevStage.ccWrapperStdenv.shell;
       };
 
       bash = prevStage.bash or bootstrapTools;
@@ -253,11 +254,12 @@ in
           nativeTools = false;
           nativeLibc = false;
 
-          buildPackages = { };
+          expand-response-params = "";
           libc = selfDarwin.Libsystem;
 
           inherit lib;
           inherit (self) stdenvNoCC coreutils gnugrep;
+          runtimeShell = self.stdenvNoCC.shell;
 
           bintools = selfDarwin.binutils-unwrapped;
 
@@ -461,6 +463,8 @@ in
 
           bintools = selfDarwin.binutils-unwrapped;
           libc = selfDarwin.Libsystem;
+          # TODO(@sternenseemann): can this be removed?
+          runtimeShell = "${bootstrapTools}/bin/bash";
         };
 
         binutils-unwrapped = superDarwin.binutils-unwrapped.override {
@@ -853,9 +857,7 @@ in
 
         # Rewrap binutils so it uses the rebuilt Libsystem.
         binutils = superDarwin.binutils.override {
-          buildPackages = {
-            inherit (prevStage) stdenv;
-          };
+          inherit (prevStage) expand-response-params;
           libc = selfDarwin.Libsystem;
         } // {
           passthru = { inherit (prevStage.bintools.passthru) isFromBootstrapFiles; };
@@ -1068,11 +1070,7 @@ in
         };
 
         binutils = superDarwin.binutils.override {
-          shell = self.bash + "/bin/bash";
-
-          buildPackages = {
-            inherit (prevStage) stdenv;
-          };
+          inherit (prevStage) expand-response-params;
 
           bintools = selfDarwin.binutils-unwrapped;
           libc = selfDarwin.Libsystem;
@@ -1109,9 +1107,7 @@ in
               nativeTools = false;
               nativeLibc = false;
 
-              buildPackages = {
-                inherit (prevStage) stdenv;
-              };
+              inherit (prevStage) expand-response-params;
 
               extraPackages = [
                 self.llvmPackages.compiler-rt
@@ -1148,9 +1144,7 @@ in
               inherit (self.llvmPackages) libcxx;
 
               inherit lib;
-              inherit (self) stdenvNoCC coreutils gnugrep;
-
-              shell = self.bash + "/bin/bash";
+              inherit (self) stdenvNoCC coreutils gnugrep runtimeShell;
             };
           });
           libraries = super.llvmPackages.libraries.extend (_: _:{
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 0e1852805cfd..e1801abcb485 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -185,9 +185,9 @@ let
           name = "${name}-gcc-wrapper";
           nativeTools = false;
           nativeLibc = false;
-          buildPackages = lib.optionalAttrs (prevStage ? stdenv) {
-            inherit (prevStage) stdenv;
-          };
+          expand-response-params = lib.optionalString
+            (prevStage.stdenv.hasCC or false && prevStage.stdenv.cc != "/dev/null")
+            prevStage.expand-response-params;
           cc = prevStage.gcc-unwrapped;
           bintools = prevStage.binutils;
           isGNU = true;
@@ -196,6 +196,7 @@ let
           inherit (prevStage) coreutils gnugrep;
           stdenvNoCC = prevStage.ccWrapperStdenv;
           fortify-headers = prevStage.fortify-headers;
+          runtimeShell = prevStage.ccWrapperStdenv.shell;
         }).overrideAttrs(a: lib.optionalAttrs (prevStage.gcc-unwrapped.passthru.isXgcc or false) {
           # This affects only `xgcc` (the compiler which compiles the final compiler).
           postFixup = (a.postFixup or "") + ''
@@ -260,11 +261,12 @@ in
         name = "bootstrap-stage0-binutils-wrapper";
         nativeTools = false;
         nativeLibc = false;
-        buildPackages = { };
+        expand-response-params = "";
         libc = getLibc self;
         inherit lib;
         inherit (self) stdenvNoCC coreutils gnugrep;
         bintools = bootstrapTools;
+        runtimeShell = "${bootstrapTools}/bin/bash";
       };
       coreutils = bootstrapTools;
       gnugrep = bootstrapTools;
@@ -332,6 +334,14 @@ in
         inherit (prevStage) ccWrapperStdenv coreutils gnugrep gettext bison texinfo zlib gnum4 perl patchelf;
         ${localSystem.libc} = getLibc prevStage;
         gmp = super.gmp.override { cxx = false; };
+        # This stage also rebuilds binutils which will of course be used only in the next stage.
+        # We inherit this until stage3, in stage4 it will be rebuilt using the adjacent bash/runtimeShell pkg.
+        # TODO(@sternenseemann): Can we already build the wrapper with the actual runtimeShell here?
+        # Historically, the wrapper didn't use runtimeShell, so the used shell had to be changed explicitly
+        # (or stdenvNoCC.shell would be used) which happened in stage4.
+        binutils = super.binutils.override {
+          runtimeShell = "${bootstrapTools}/bin/bash";
+        };
         gcc-unwrapped =
           (super.gcc-unwrapped.override (commonGccOverrides // {
             # The most logical name for this package would be something like
@@ -544,13 +554,10 @@ in
       # other purposes (binutils and top-level pkgs) too.
       inherit (prevStage) gettext gnum4 bison perl texinfo zlib linuxHeaders libidn2 libunistring;
       ${localSystem.libc} = getLibc prevStage;
+      # Since this is the first fresh build of binutils since stage2, our own runtimeShell will be used.
       binutils = super.binutils.override {
-        # Don't use stdenv's shell but our own
-        shell = self.bash + "/bin/bash";
         # Build expand-response-params with last stage like below
-        buildPackages = {
-          inherit (prevStage) stdenv;
-        };
+        inherit (prevStage) expand-response-params;
       };
 
       # To allow users' overrides inhibit dependencies too heavy for
@@ -561,15 +568,12 @@ in
         nativeTools = false;
         nativeLibc = false;
         isGNU = true;
-        buildPackages = {
-          inherit (prevStage) stdenv;
-        };
+        inherit (prevStage) expand-response-params;
         cc = prevStage.gcc-unwrapped;
         bintools = self.binutils;
         libc = getLibc self;
         inherit lib;
-        inherit (self) stdenvNoCC coreutils gnugrep;
-        shell = self.bash + "/bin/bash";
+        inherit (self) stdenvNoCC coreutils gnugrep runtimeShell;
         fortify-headers = self.fortify-headers;
       };
     };
@@ -646,7 +650,9 @@ in
         # More complicated cases
         ++ (map (x: getOutput x (getLibc prevStage)) [ "out" "dev" "bin" ] )
         ++  [ linuxHeaders # propagated from .dev
-            binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params gcc.cc.libgcc glibc.passthru.libgcc
+              binutils gcc gcc.cc gcc.cc.lib
+              gcc.expand-response-params # != (prevStage.)expand-response-params
+              gcc.cc.libgcc glibc.passthru.libgcc
           ]
         ++ lib.optionals (localSystem.libc == "musl") [ fortify-headers ]
         ++ [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ]
diff --git a/pkgs/tools/audio/headsetcontrol/default.nix b/pkgs/tools/audio/headsetcontrol/default.nix
index 68a799a55c76..d1d7a7541690 100644
--- a/pkgs/tools/audio/headsetcontrol/default.nix
+++ b/pkgs/tools/audio/headsetcontrol/default.nix
@@ -1,21 +1,29 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , hidapi
 }:
 
 stdenv.mkDerivation rec {
   pname = "headsetcontrol";
-  version = "2.7.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "Sapd";
     repo = "HeadsetControl";
     rev = version;
-    sha256 = "sha256-tAndkfLEgj81JWzXtDBNspRxzKAL6XaRw0aDI1XbC1E=";
+    sha256 = "sha256-N1c94iAJgCPhGNDCGjMINg0AL2wPX5gVIsJ+pzn/l9Y=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/Sapd/HeadsetControl/pull/337.patch";
+      hash = "sha256-18w9BQsMljEA/eY3rnosHvKwhiaF79TrWH/ayuyZMrM=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
   ];
@@ -24,11 +32,6 @@ stdenv.mkDerivation rec {
     hidapi
   ];
 
-  /*
-  Tests depend on having the appropriate headsets connected.
-  */
-  doCheck = false;
-
   meta = with lib; {
     description = "Sidetone and Battery status for Logitech G930, G533, G633, G933 SteelSeries Arctis 7/PRO 2019 and Corsair VOID (Pro)";
     longDescription = ''
diff --git a/pkgs/tools/inputmethods/keymapper/default.nix b/pkgs/tools/inputmethods/keymapper/default.nix
index 5cedfce20198..8886f5b691a6 100644
--- a/pkgs/tools/inputmethods/keymapper/default.nix
+++ b/pkgs/tools/inputmethods/keymapper/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "keymapper";
-  version = "3.5.3";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "houmain";
     repo = "keymapper";
     rev = finalAttrs.version;
-    hash = "sha256-CfZdLeWgeNwy9tEJ3UDRplV0sRcKE4J6d3CxC9gqdmE=";
+    hash = "sha256-a9CuLchSSfS4w3pZylzdiUr/llMsuU2qDR3mJrAupZk=";
   };
 
   # all the following must be in nativeBuildInputs
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index d18f2eda0e0d..efcdce15bf02 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -39,6 +39,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-zTKO3qyS9qZl3p8yPJO3Eq8YWLwuDYjz9xAEaUcKG4o=";
   };
 
+  patches = lib.optionals stdenv.hostPlatform.isMusl [
+    # https://lists.gnu.org/archive/html/bug-coreutils/2024-03/msg00089.html
+    ./fix-test-failure-musl.patch
+  ];
+
   postPatch = ''
     # The test tends to fail on btrfs, f2fs and maybe other unusual filesystems.
     sed '2i echo Skipping dd sparse test && exit 77' -i ./tests/dd/sparse.sh
diff --git a/pkgs/tools/misc/coreutils/fix-test-failure-musl.patch b/pkgs/tools/misc/coreutils/fix-test-failure-musl.patch
new file mode 100644
index 000000000000..2d54dd27ab3f
--- /dev/null
+++ b/pkgs/tools/misc/coreutils/fix-test-failure-musl.patch
@@ -0,0 +1,23 @@
+From 1defda6356c29c7f731bddb9e9231f594e01d9c9
+(adjusted so it can be applied on coreutils to coreutils tarball)
+
+Reported by Adept's Lab via Pádraig Brady at
+<https://lists.gnu.org/archive/html/bug-coreutils/2024-03/msg00086.html>.
+
+diff --git a/gnulib-tests/test-canonicalize.c b/gnulib-tests/test-canonicalize.c
+index 6763a525c9..5d19285c00 100644
+--- a/gnulib-tests/test-canonicalize.c
++++ b/gnulib-tests/test-canonicalize.c
+@@ -394,9 +394,9 @@ main (void)
+     ASSERT (stat ("/", &st1) == 0);
+     ASSERT (stat ("//", &st2) == 0);
+     bool same = psame_inode (&st1, &st2);
+-#if defined __MVS__ || defined MUSL_LIBC
+-    /* On IBM z/OS and musl libc, "/" and "//" both canonicalize to
+-       themselves, yet they both have st_dev == st_ino == 1.  */
++#if defined __MVS__
++    /* On IBM z/OS, "/" and "//" both canonicalize to themselves, yet they both
++       have st_dev == st_ino == 1.  */
+     same = false;
+ #endif
+     if (same)
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index fc9493be5521..27da89ceb31a 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-FTZXfZhLplpjB6QQssz/5hXckNaR9KTdw8NRDLYOvaM=";
+    hash = "sha256-SEt/qw8ixlgRY2+fqyCmhqzLVoAw/BMl//JqQxbuB0s=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index cd18dbf5ee0e..a8adbf7a7d0e 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.56.0";
+  version = "0.57.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FQtbR4tiFRtMwawf9rdsK/U0bwJFvfXmzqM/ZU+Yhi0=";
+    hash = "sha256-TE00xGHe8Dhm9rxD3zlB4Cf8OasPsZQhxoqXFSsSDL8=";
   };
 
-  vendorHash = "sha256-W+H7PxpG3MuioN+nEeX4tArVSDuhQ2LD+927mhPaLas=";
+  vendorHash = "sha256-WtpsgN3zf2fELJ1yXWYSEkqXe1Fx+j3uwoJx6Q17OU8=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index b1e59b455115..50b1860535eb 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "10.12.2";
+  version = "11.0.2";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FpUWCIMpBfJDEQKNwKjDSH5u2dxh9jO97cfmj77IdAc=";
+    hash = "sha256-TSTOhfFNFwuF9kNf1q2HVcoxhKS1pKW4kSorSPyyeQU=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-7Cor+SYujUKdXwWzBNT5POkNnxtnEPE5iffNbFbVfys=";
+  vendorHash = "sha256-Uuz/ghtd/1ol1ugDI7pz5Fyv6U5PpOdcoerU/qx4MPA=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/tools/security/pomerium-cli/default.nix b/pkgs/tools/security/pomerium-cli/default.nix
index cff903021591..328717aca581 100644
--- a/pkgs/tools/security/pomerium-cli/default.nix
+++ b/pkgs/tools/security/pomerium-cli/default.nix
@@ -8,16 +8,16 @@ let
 in
 buildGoModule rec {
   pname = "pomerium-cli";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-0vRLjmzW/U/Kssu4VQO6mFqVH4UovmTGEEfxeWI8Nqo=";
+    sha256 = "sha256-2upvdL8kk0Kbll8UbviyzIX2jdK+tqcHvVlkpz5JjrA=";
   };
 
-  vendorHash = "sha256-dnfJnndYXR6LQKDruLSsDav4DtyaGu5/rNnk69oMhPU=";
+  vendorHash = "sha256-aQo58i+XuCkdjIg/IPf7kNLXXA0NwZbQMhgWyMb45B4=";
 
   subPackages = [
     "cmd/pomerium-cli"
diff --git a/pkgs/tools/security/semgrep/common.nix b/pkgs/tools/security/semgrep/common.nix
index cfc4045457be..9fb3ae427a2e 100644
--- a/pkgs/tools/security/semgrep/common.nix
+++ b/pkgs/tools/security/semgrep/common.nix
@@ -1,9 +1,9 @@
 { lib }:
 
 rec {
-  version = "1.67.0";
+  version = "1.69.0";
 
-  srcHash = "sha256-B+2DgwU+yhU337yZh518Z2Tq0Wbun8WEXX9IpC0Ut/c=";
+  srcHash = "sha256-LA0mRuYJg97tMbmlmJpZ8wQc83S/jXNWBUjcoXSqoVo=";
 
   # submodule dependencies
   # these are fetched so we:
@@ -13,8 +13,8 @@ rec {
     "cli/src/semgrep/semgrep_interfaces" = {
       owner = "semgrep";
       repo = "semgrep-interfaces";
-      rev = "3ee41bc436308a7c12b66247cfcb60df0aeff8ea";
-      hash = "sha256-rlhArVSNJr4AgZw/TOOMPgpBOfHWsAm77YgrRdCjIzI=";
+      rev = "d5b91fa4f6a03240db31e9bbbc5376a99bc8eeea";
+      hash = "sha256-IQ22HvO0gHAfbZrt+bz1yMb/XRZOU+z03X+SOK9iDQs=";
     };
   };
 
@@ -25,19 +25,19 @@ rec {
   core = {
     x86_64-linux = {
       platform = "any";
-      hash = "sha256-iv02L/dvcfI/9XubC+EOeqMaVwdXh0sqLv02j1fn1aM=";
+      hash = "sha256-QFE8NzGW2kkP5xtmbXgxE1OAxz6z7MT8wW/EmIVMgHE=";
     };
     aarch64-linux = {
       platform = "musllinux_1_0_aarch64.manylinux2014_aarch64";
-      hash = "sha256-wFuEcgCuciAOR8MNCxHW8TCoji97g7dXUf06M0T9MWg=";
+      hash = "sha256-E1fGT5TO2DbP4oYtkRs794jXGOp75q3o+xlOao8E7Lk=";
     };
     x86_64-darwin = {
       platform = "macosx_10_14_x86_64";
-      hash = "sha256-wMkOZFvR6HBBTvu8mXRDF2s0Mqp/LkhVH2I+2sIIa94=";
+      hash = "sha256-oWY57rQvxjMIhzjR62cpIVmKynmdF3zQOLMHBjbf1ig=";
     };
     aarch64-darwin = {
       platform = "macosx_11_0_arm64";
-      hash = "sha256-AKNc9SxXbKb6WdFlE6aqzFDdtMGzl+3LhXTbNvFSHYQ=";
+      hash = "sha256-L2eFkahzwfBzPcx7Zq+NhtgJvBq5W1vZ4m1YNQ3dWAo=";
     };
   };
 
diff --git a/pkgs/tools/security/step-kms-plugin/default.nix b/pkgs/tools/security/step-kms-plugin/default.nix
index fd3faedf6128..95a3b85fca63 100644
--- a/pkgs/tools/security/step-kms-plugin/default.nix
+++ b/pkgs/tools/security/step-kms-plugin/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "step-kms-plugin";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FQ9UW1zz+8HMFETZVef7oyh2+Nm5z3ksvmOv/MTiKAU=";
+    hash = "sha256-EkLLhHXvh10tfEY6AY6o3n3JcmCXwauHsQ8VJRBpnnY=";
   };
 
-  vendorHash = "sha256-bpQHe7B7dG1oeGP/V3su0Zc6in7tive7lmh18KqxGfo=";
+  vendorHash = "sha256-kwM5eNeAVtA6DaoFtBhxc7Jnfb7vVkdIGpUxVGjWwC8=";
 
   proxyVendor = true;
 
diff --git a/pkgs/tools/text/d2/default.nix b/pkgs/tools/text/d2/default.nix
index e82ef305a522..d5cef467f507 100644
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-lOZ2JFQG4x4xv/fdTlpOEp9lpdjR0ACyAIUWEZUm6L8=";
+    hash = "sha256-yEYdFpIIY+nAaeMPEwgz0th2rf67LeYK19Ov9QB/7J0=";
   };
 
   vendorHash = "sha256-aoc8KSznkWJpn0Ye7FUOH5sNQ4fslIGJhIaQdGrwcqQ=";
diff --git a/pkgs/tools/text/mdbook-admonish/default.nix b/pkgs/tools/text/mdbook-admonish/default.nix
index 1deaf9bc7c2b..381bf8e6b1ad 100644
--- a/pkgs/tools/text/mdbook-admonish/default.nix
+++ b/pkgs/tools/text/mdbook-admonish/default.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     description = "A preprocessor for mdbook to add Material Design admonishments";
     mainProgram = "mdbook-admonish";
     license = licenses.mit;
-    maintainers = with maintainers; [ jmgilman Frostman ];
+    maintainers = with maintainers; [ jmgilman Frostman matthiasbeyer ];
     homepage = "https://github.com/tommilligan/mdbook-admonish";
   };
 }
diff --git a/pkgs/tools/text/mdbook-cmdrun/default.nix b/pkgs/tools/text/mdbook-cmdrun/default.nix
index 05d27d3e3ad5..3d797479c50e 100644
--- a/pkgs/tools/text/mdbook-cmdrun/default.nix
+++ b/pkgs/tools/text/mdbook-cmdrun/default.nix
@@ -22,6 +22,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-cmdrun";
     homepage = "https://github.com/FauconFan/mdbook-cmdrun";
     license = licenses.mit;
-    maintainers = with maintainers; [ pinpox ];
+    maintainers = with maintainers; [ pinpox matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-d2/default.nix b/pkgs/tools/text/mdbook-d2/default.nix
index afff44b9f473..61176e202020 100644
--- a/pkgs/tools/text/mdbook-d2/default.nix
+++ b/pkgs/tools/text/mdbook-d2/default.nix
@@ -29,6 +29,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/danieleades/mdbook-d2";
     changelog = "https://github.com/danieleades/mdbook-d2/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ blaggacao ];
+    maintainers = with maintainers; [ blaggacao matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-emojicodes/default.nix b/pkgs/tools/text/mdbook-emojicodes/default.nix
index 21c8e48468a2..d57ba39b803c 100644
--- a/pkgs/tools/text/mdbook-emojicodes/default.nix
+++ b/pkgs/tools/text/mdbook-emojicodes/default.nix
@@ -28,6 +28,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/blyxyas/mdbook-emojicodes";
     changelog = "https://github.com/blyxyas/mdbook-emojicodes/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ blaggacao ];
+    maintainers = with maintainers; [ blaggacao matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-epub/default.nix b/pkgs/tools/text/mdbook-epub/default.nix
index 16e3bff73443..830d6f92a8ad 100644
--- a/pkgs/tools/text/mdbook-epub/default.nix
+++ b/pkgs/tools/text/mdbook-epub/default.nix
@@ -37,6 +37,6 @@ in rustPlatform.buildRustPackage {
     mainProgram = "mdbook-epub";
     homepage = "https://michael-f-bryan.github.io/mdbook-epub";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ yuu ];
+    maintainers = with maintainers; [ yuu matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-footnote/default.nix b/pkgs/tools/text/mdbook-footnote/default.nix
index cc140a5b5d83..01777669c4af 100644
--- a/pkgs/tools/text/mdbook-footnote/default.nix
+++ b/pkgs/tools/text/mdbook-footnote/default.nix
@@ -24,6 +24,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-footnote";
     homepage = "https://github.com/daviddrysdale/mdbook-footnote";
     license = licenses.asl20;
-    maintainers = with maintainers; [ brianmcgillion ];
+    maintainers = with maintainers; [ brianmcgillion matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-graphviz/default.nix b/pkgs/tools/text/mdbook-graphviz/default.nix
index 060fd5871d1b..43171c92dc96 100644
--- a/pkgs/tools/text/mdbook-graphviz/default.nix
+++ b/pkgs/tools/text/mdbook-graphviz/default.nix
@@ -23,6 +23,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/dylanowen/mdbook-graphviz";
     changelog = "https://github.com/dylanowen/mdbook-graphviz/releases/tag/v${version}";
     license = [ licenses.mpl20 ];
-    maintainers = with maintainers; [ lovesegfault ];
+    maintainers = with maintainers; [ lovesegfault matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-i18n-helpers/default.nix b/pkgs/tools/text/mdbook-i18n-helpers/default.nix
index e00103b2c4f3..e38da146b1fa 100644
--- a/pkgs/tools/text/mdbook-i18n-helpers/default.nix
+++ b/pkgs/tools/text/mdbook-i18n-helpers/default.nix
@@ -22,6 +22,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/google/mdbook-i18n-helpers";
     changelog = "https://github.com/google/mdbook-i18n-helpers/releases/tag/${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ teutat3s ];
+    maintainers = with maintainers; [ teutat3s matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-katex/default.nix b/pkgs/tools/text/mdbook-katex/default.nix
index cd9534761966..84e04e8e5669 100644
--- a/pkgs/tools/text/mdbook-katex/default.nix
+++ b/pkgs/tools/text/mdbook-katex/default.nix
@@ -18,6 +18,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-katex";
     homepage = "https://github.com/lzanini/${pname}";
     license = [ licenses.mit ];
-    maintainers = with maintainers; [ lovesegfault ];
+    maintainers = with maintainers; [ lovesegfault matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix b/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix
index d419d8b0c116..e69c8185e3c3 100644
--- a/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix
+++ b/pkgs/tools/text/mdbook-kroki-preprocessor/default.nix
@@ -36,6 +36,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-kroki-preprocessor";
     homepage = "https://github.com/joelcourtney/mdbook-kroki-preprocessor";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ blaggacao ];
+    maintainers = with maintainers; [ blaggacao matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-linkcheck/default.nix b/pkgs/tools/text/mdbook-linkcheck/default.nix
index d90b536edc86..b8d19d01e763 100644
--- a/pkgs/tools/text/mdbook-linkcheck/default.nix
+++ b/pkgs/tools/text/mdbook-linkcheck/default.nix
@@ -29,6 +29,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-linkcheck";
     homepage = "https://github.com/Michael-F-Bryan/mdbook-linkcheck";
     license = licenses.mit;
-    maintainers = with maintainers; [ zhaofengli ];
+    maintainers = with maintainers; [ zhaofengli matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-mermaid/default.nix b/pkgs/tools/text/mdbook-mermaid/default.nix
index b69dd103917d..2dafb13d508c 100644
--- a/pkgs/tools/text/mdbook-mermaid/default.nix
+++ b/pkgs/tools/text/mdbook-mermaid/default.nix
@@ -28,6 +28,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/badboy/mdbook-mermaid";
     changelog = "https://github.com/badboy/mdbook-mermaid/blob/v${version}/CHANGELOG.md";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ xrelkd ];
+    maintainers = with maintainers; [ xrelkd matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-pagetoc/default.nix b/pkgs/tools/text/mdbook-pagetoc/default.nix
index 2cd4afee9616..eaeecf764809 100644
--- a/pkgs/tools/text/mdbook-pagetoc/default.nix
+++ b/pkgs/tools/text/mdbook-pagetoc/default.nix
@@ -18,6 +18,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-pagetoc";
     homepage = "https://github.com/slowsage/mdbook-pagetoc";
     license = licenses.mit;
-    maintainers = with maintainers; [ blaggacao ];
+    maintainers = with maintainers; [ blaggacao matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-pdf/default.nix b/pkgs/tools/text/mdbook-pdf/default.nix
index e0c63f595db1..0b3b0bfbc860 100644
--- a/pkgs/tools/text/mdbook-pdf/default.nix
+++ b/pkgs/tools/text/mdbook-pdf/default.nix
@@ -48,6 +48,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/HollowMan6/mdbook-pdf";
     changelog = "https://github.com/HollowMan6/mdbook-pdf/releases/tag/v${version}";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ hollowman6 ];
+    maintainers = with maintainers; [ hollowman6 matthiasbeyer ];
   };
 }
diff --git a/pkgs/tools/text/mdbook-plantuml/default.nix b/pkgs/tools/text/mdbook-plantuml/default.nix
index e07bd812cec9..e5ee827d816e 100644
--- a/pkgs/tools/text/mdbook-plantuml/default.nix
+++ b/pkgs/tools/text/mdbook-plantuml/default.nix
@@ -40,6 +40,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "mdbook-plantuml";
     homepage = "https://github.com/sytsereitsma/mdbook-plantuml";
     license = [ licenses.mit ];
-    maintainers = with maintainers; [ jcouyang ];
+    maintainers = with maintainers; [ jcouyang matthiasbeyer ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3f0a0b7f1143..cb74ff63aa15 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -656,6 +656,8 @@ with pkgs;
 
   evhz = callPackage ../tools/misc/evhz { };
 
+  expand-response-params = callPackage ../build-support/expand-response-params { };
+
   expressvpn = callPackage ../applications/networking/expressvpn { };
 
   faq = callPackage ../development/tools/faq { };
@@ -9778,14 +9780,7 @@ with pkgs;
   ldc = callPackage ../development/compilers/ldc { };
 
   ligo =
-    let ocaml_p = ocaml-ng.ocamlPackages_4_14_janeStreet_0_15.overrideScope (self: super: {
-      zarith = super.zarith.overrideAttrs (o: {
-        src = fetchzip {
-          url = "https://github.com/ocaml/Zarith/archive/refs/tags/release-1.12.tar.gz";
-          hash = "sha256-SQegsMc1+UIod8XeJDE+H5q1huNDQI8CUh7IsHOoVMs=";
-        };
-      });
-    }); in
+    let ocaml_p = ocaml-ng.ocamlPackages_4_14_janeStreet_0_15; in
     callPackage ../development/compilers/ligo {
     coq = coq_8_13.override {
       customOCamlPackages = ocaml_p;
@@ -28710,8 +28705,6 @@ with pkgs;
 
   fanwood = callPackage ../data/fonts/fanwood { };
 
-  fira = callPackage ../data/fonts/fira { };
-
   fira-code = callPackage ../data/fonts/fira-code { };
   fira-code-symbols = callPackage ../data/fonts/fira-code/symbols.nix { };
   fira-code-nerdfont = nerdfonts.override {
@@ -28720,8 +28713,6 @@ with pkgs;
 
   fira-go = callPackage ../data/fonts/fira-go { };
 
-  fira-mono = callPackage ../data/fonts/fira-mono { };
-
   flat-remix-icon-theme = callPackage ../data/icons/flat-remix-icon-theme {
     inherit (plasma5Packages) breeze-icons;
   };
@@ -33446,8 +33437,6 @@ with pkgs;
 
   ptex = callPackage ../development/libraries/ptex { };
 
-  pyright = nodePackages.pyright;
-
   qbec = callPackage ../applications/networking/cluster/qbec { };
 
   qemacs = callPackage ../applications/editors/qemacs { };
diff --git a/pkgs/top-level/cuda-packages.nix b/pkgs/top-level/cuda-packages.nix
index 92960422af44..d34a37294ae0 100644
--- a/pkgs/top-level/cuda-packages.nix
+++ b/pkgs/top-level/cuda-packages.nix
@@ -90,7 +90,7 @@ let
     [
       (import ../development/cuda-modules/setup-hooks/extension.nix)
       (callPackage ../development/cuda-modules/cuda/extension.nix { inherit cudaVersion; })
-      (callPackage ../development/cuda-modules/cuda/overrides.nix { inherit cudaVersion; })
+      (import ../development/cuda-modules/cuda/overrides.nix)
       (callPackage ../development/cuda-modules/generic-builders/multiplex.nix {
         inherit cudaVersion flags mkVersionedPackageName;
         pname = "cudnn";
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 2403b1d57300..529e893894cf 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -56,9 +56,9 @@ let
 
     atdgen-runtime = callPackage ../development/ocaml-modules/atdgen/runtime.nix { };
 
-    awa = callPackage ../development/ocaml-modules/awa { mtime = mtime_1; };
+    awa = callPackage ../development/ocaml-modules/awa { };
 
-    awa-mirage = callPackage ../development/ocaml-modules/awa/mirage.nix { mtime = mtime_1; };
+    awa-mirage = callPackage ../development/ocaml-modules/awa/mirage.nix { };
 
     ### B ###
 
@@ -192,6 +192,8 @@ let
 
     cil = callPackage ../development/ocaml-modules/cil { };
 
+    clap = callPackage ../development/ocaml-modules/clap { };
+
     class_group_vdf = callPackage ../development/ocaml-modules/class_group_vdf { };
 
     cmarkit = callPackage ../development/ocaml-modules/cmarkit { };
@@ -321,11 +323,11 @@ let
 
     dns-certify =  callPackage ../development/ocaml-modules/dns/certify.nix { };
 
-    dns-cli =  callPackage ../development/ocaml-modules/dns/cli.nix { mtime = mtime_1; };
+    dns-cli =  callPackage ../development/ocaml-modules/dns/cli.nix { };
 
-    dns-client =  callPackage ../development/ocaml-modules/dns/client.nix { mtime = mtime_1; };
+    dns-client =  callPackage ../development/ocaml-modules/dns/client.nix { };
 
-    dns-client-lwt = callPackage ../development/ocaml-modules/dns/client-lwt.nix { mtime = mtime_1; };
+    dns-client-lwt = callPackage ../development/ocaml-modules/dns/client-lwt.nix { };
 
     dns-client-mirage = callPackage ../development/ocaml-modules/dns/client-mirage.nix { };
 
@@ -586,7 +588,6 @@ let
 
     git-unix = callPackage ../development/ocaml-modules/git/unix.nix {
       git-binary = pkgs.git;
-      mtime = mtime_1;
     };
 
     github = callPackage ../development/ocaml-modules/github {  };
@@ -639,7 +640,7 @@ let
 
     happy-eyeballs = callPackage ../development/ocaml-modules/happy-eyeballs { };
 
-    happy-eyeballs-lwt = callPackage ../development/ocaml-modules/happy-eyeballs/lwt.nix { mtime = mtime_1; };
+    happy-eyeballs-lwt = callPackage ../development/ocaml-modules/happy-eyeballs/lwt.nix { };
 
     happy-eyeballs-mirage = callPackage ../development/ocaml-modules/happy-eyeballs/mirage.nix { };
 
@@ -669,7 +670,7 @@ let
 
     imagelib = callPackage ../development/ocaml-modules/imagelib { };
 
-    index = callPackage ../development/ocaml-modules/index { mtime = mtime_1; };
+    index = callPackage ../development/ocaml-modules/index { };
 
     inifiles = callPackage ../development/ocaml-modules/inifiles { };
 
@@ -691,29 +692,27 @@ let
 
     iri = callPackage ../development/ocaml-modules/iri { };
 
-    irmin = callPackage ../development/ocaml-modules/irmin { mtime = mtime_1; };
+    irmin = callPackage ../development/ocaml-modules/irmin { };
 
     irmin-chunk = callPackage ../development/ocaml-modules/irmin/chunk.nix { };
 
-    irmin-containers = callPackage ../development/ocaml-modules/irmin/containers.nix { mtime = mtime_1; };
+    irmin-containers = callPackage ../development/ocaml-modules/irmin/containers.nix { };
 
     irmin-fs = callPackage ../development/ocaml-modules/irmin/fs.nix { };
 
-    irmin-git = callPackage ../development/ocaml-modules/irmin/git.nix { mtime = mtime_1; };
+    irmin-git = callPackage ../development/ocaml-modules/irmin/git.nix { };
 
     irmin-graphql = callPackage ../development/ocaml-modules/irmin/graphql.nix { };
 
-    irmin-http = callPackage ../development/ocaml-modules/irmin/http.nix { };
-
     irmin-mirage = callPackage ../development/ocaml-modules/irmin/mirage.nix { };
 
     irmin-mirage-git = callPackage ../development/ocaml-modules/irmin/mirage-git.nix { };
 
     irmin-mirage-graphql = callPackage ../development/ocaml-modules/irmin/mirage-graphql.nix { };
 
-    irmin-pack = callPackage ../development/ocaml-modules/irmin/pack.nix { mtime = mtime_1; };
+    irmin-pack = callPackage ../development/ocaml-modules/irmin/pack.nix { };
 
-    irmin-test = callPackage ../development/ocaml-modules/irmin/test.nix { mtime = mtime_1; };
+    irmin-test = callPackage ../development/ocaml-modules/irmin/test.nix { };
 
     irmin-tezos = callPackage ../development/ocaml-modules/irmin/tezos.nix { };
 
@@ -1065,7 +1064,6 @@ let
 
     metrics-unix = callPackage ../development/ocaml-modules/metrics/unix.nix {
       inherit (pkgs) gnuplot;
-      mtime = mtime_1;
     };
 
     mew = callPackage ../development/ocaml-modules/mew { };
@@ -1122,7 +1120,7 @@ let
 
     mirage-crypto-rng-async = callPackage ../development/ocaml-modules/mirage-crypto/rng-async.nix { };
 
-    mirage-crypto-rng-lwt = callPackage ../development/ocaml-modules/mirage-crypto/rng-lwt.nix { mtime = mtime_1; };
+    mirage-crypto-rng-lwt = callPackage ../development/ocaml-modules/mirage-crypto/rng-lwt.nix { };
 
     mirage-crypto-rng-mirage = callPackage ../development/ocaml-modules/mirage-crypto/rng-mirage.nix { };
 
@@ -1546,7 +1544,7 @@ let
 
     prometheus = callPackage ../development/ocaml-modules/prometheus { };
 
-    progress = callPackage ../development/ocaml-modules/progress { mtime = mtime_1; };
+    progress = callPackage ../development/ocaml-modules/progress { };
 
     promise_jsoo = callPackage ../development/ocaml-modules/promise_jsoo { };
 
@@ -1761,6 +1759,8 @@ let
 
     tezos-base58 = callPackage ../development/ocaml-modules/tezos-base58 { };
 
+    tezt = callPackage ../development/ocaml-modules/tezt { };
+
     theora = callPackage ../development/ocaml-modules/theora { };
 
     thread-table = callPackage ../development/ocaml-modules/thread-table { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 40351281d5c5..4a4a5addeac0 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -518,6 +518,7 @@ mapAliases ({
   update_checker = update-checker; # added 2024-01-07
   uproot3 = throw "uproot3 has been removed, use uproot instead"; # added 2022-12-13
   uproot3-methods = throw "uproot3-methods has been removed"; # added 2022-12-13
+  uuid = throw "uuid is a Python standard module"; # added 2024-04-18
   validictory = throw "validictory has been removed, since it abandoned"; # added 2023-07-07
   vega_datasets = vega-datasets; # added 2023-11-04
   ViennaRNA = viennarna; # added 2023-08-23
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f70995470ccd..2ccfa2087a5f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1932,6 +1932,8 @@ self: super: with self; {
     };
   };
 
+  catkin-pkg = callPackage ../development/python-modules/catkin-pkg { };
+
   catppuccin = callPackage ../development/python-modules/catppuccin { };
 
   cattrs = callPackage ../development/python-modules/cattrs { };
@@ -2484,6 +2486,8 @@ self: super: with self; {
 
   craft-application-1 = callPackage ../development/python-modules/craft-application-1 { };
 
+  craft-application = callPackage ../development/python-modules/craft-application { };
+
   craft-archives = callPackage ../development/python-modules/craft-archives { };
 
   craft-cli = callPackage ../development/python-modules/craft-cli { };
@@ -12181,6 +12185,8 @@ self: super: with self; {
 
   python3-openid = callPackage ../development/python-modules/python3-openid { };
 
+  python-apt = callPackage ../development/python-modules/python-apt { };
+
   python-arango = callPackage ../development/python-modules/python-arango { };
 
   python-awair = callPackage ../development/python-modules/python-awair { };
@@ -16430,8 +16436,6 @@ self: super: with self; {
 
   utils = callPackage ../development/python-modules/utils { };
 
-  uuid = callPackage ../development/python-modules/uuid { };
-
   uvcclient = callPackage ../development/python-modules/uvcclient { };
 
   uvicorn = callPackage ../development/python-modules/uvicorn { };