diff --git a/.github/labeler.yml b/.github/labeler.yml
index 34da4f3c8f43..73d0223ee71e 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -445,6 +445,7 @@
         - doc/languages-frameworks/ruby.section.md
         - pkgs/development/interpreters/ruby/**/*
         - pkgs/development/ruby-modules/**/*
+        - pkgs/top-level/ruby-packages.nix
 
 "6.topic: rust":
   - any:
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7ddcc64800c9..6db53e64e92c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1313,7 +1313,6 @@
     name = "Wroclaw";
   };
   amuckstot30 = {
-    email = "amuckstot30@tutanota.com";
     github = "amuckstot30";
     githubId = 157274630;
     name = "amuckstot30";
@@ -1625,6 +1624,12 @@
     githubId = 4194320;
     name = "Anton Schirg";
   };
+  anugrahn1 = {
+    email = "pnanugrah@gmail.com";
+    github = "anugrahn1";
+    githubId = 117428605;
+    name = "Anugrah Naranatt";
+  };
   anytimetraveler = {
     email = "simon@simonscode.org";
     github = "AnyTimeTraveler";
@@ -23353,6 +23358,13 @@
     name = "Vinicius Bernardino";
     keys = [ { fingerprint = "F0D3 920C 722A 541F 0CCD  66E3 A7BA BA05 3D78 E7CA"; } ];
   };
+  vog = {
+    email = "v@njh.eu";
+    github = "vog";
+    githubId = 412749;
+    name = "Volker Diels-Grabsch";
+    keys = [ { fingerprint = "A7E6 9C4F 69DC 5D6C FC84  EE34 A29F BD51 5F89 90AF"; } ];
+  };
   voidless = {
     email = "julius.schmitt@yahoo.de";
     github = "voidIess";
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 5bfd18c9f792..e36f45074be3 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1868,6 +1868,9 @@
   "sec-release-24.11-migration-dto-compatible": [
     "release-notes.html#sec-release-24.11-migration-dto-compatible"
   ],
+  "sec-release-24.11-wiki": [
+    "release-notes.html#sec-release-24.11-wiki"
+  ],
   "sec-release-24.05": [
     "release-notes.html#sec-release-24.05"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index caaaad012e55..ed4e49e876f5 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -915,8 +915,6 @@
 
 - `freecad` now supports addons and custom configuration in nix-way, which can be used by calling `freecad.customize`.
 
-- `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
-
 ## Detailed migration information {#sec-release-24.11-migration}
 
 ### `sound` options removal {#sec-release-24.11-migration-sound}
@@ -978,3 +976,11 @@ To provide some examples:
 | `"foo", "bar"`       | `"baz", "bar"`  | no match           | match            | One compatible string matching is enough   |
 
 Note that this also allows writing overlays that explicitly apply to multiple boards.
+
+## NixOS Wiki {#sec-release-24.11-wiki}
+
+The official NixOS Wiki at [wiki.nixos.org](https://wiki.nixos.org/) was launched in April 2024, featuring
+content initially copied from the community wiki. The wiki enhances the official documentation, linking to
+existing resources and providing a categorization system for easy navigation, and is guided by a new "Manual
+of Style" — a contribution guide and enhanced templates. It offers a wealth of new information, including
+articles on applications, desktop environments, and a growing number of translations in multiple languages.
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 347cbf0d6127..83ad39e636df 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -60,6 +60,6 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index c916839f126c..78251b3721a7 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -384,6 +384,7 @@ in
         preStart = lib.optionalString cfg.stateless ''
           rm -rf /var/cache/cups /var/lib/cups /var/spool/cups
         '' + ''
+            (umask 022 && mkdir -p /var/cache /var/lib /var/spool)
             (umask 077 && mkdir -p /var/cache/cups /var/spool/cups)
             (umask 022 && mkdir -p ${cfg.tempDir} /var/lib/cups)
             # While cups will automatically create self-signed certificates if accessed via TLS,
diff --git a/nixos/tests/scion/freestanding-deployment/bootstrap.sh b/nixos/tests/scion/freestanding-deployment/bootstrap.sh
index 5ecf9f54d312..b321445b3649 100644
--- a/nixos/tests/scion/freestanding-deployment/bootstrap.sh
+++ b/nixos/tests/scion/freestanding-deployment/bootstrap.sh
@@ -5,18 +5,18 @@ mkdir AS{1..5}
 
 # Create voting and root keys and (self-signed) certificates for core ASes
 pushd AS1
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 regular voting cert"}') regular-voting.pem regular-voting.key
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 cp root cert"}') cp-root.pem cp-root.key
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 regular voting cert"}') regular-voting.pem regular-voting.key
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 cp root cert"}') cp-root.pem cp-root.key
 popd
 
 pushd AS2
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 cp root cert"}') cp-root.pem cp-root.key
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=cp-root <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 cp root cert"}') cp-root.pem cp-root.key
 popd
 
 pushd AS3
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 regular voting cert"}') regular-voting.pem regular-voting.key
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=sensitive-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 sensitive voting cert"}') sensitive-voting.pem sensitive-voting.key
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=regular-voting <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 regular voting cert"}') regular-voting.pem regular-voting.key
 popd
 
 # Create the TRC (Trust Root Configuration)
@@ -34,7 +34,7 @@ cert_files = ["AS1/sensitive-voting.pem", "AS1/regular-voting.pem", "AS1/cp-root
 
 [validity]
 not_before = '0'
-validity = "36500d"' \
+validity = "3650d"' \
 > trc-B1-S1-pld.tmpl
 
 scion-pki trc payload --out=tmp/ISD42-B1-S1.pld.der --template trc-B1-S1-pld.tmpl
@@ -51,18 +51,18 @@ rm tmp -r
 
 # Create CA key and certificate for issuing ASes
 pushd AS1
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
 popd
 pushd AS2
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=cp-ca <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 CA cert"}') cp-ca.pem cp-ca.key --ca cp-root.pem --ca-key cp-root.key
 popd
 
 # Create AS key and certificate chains
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 AS cert"}') AS1/cp-as.pem AS1/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 AS cert"}') AS2/cp-as.pem AS2/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 AS cert"}') AS3/cp-as.pem AS3/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:4", "common_name": "42-ffaa:1:4 AS cert"}') AS4/cp-as.pem AS4/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
-scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-11-02T15:41:22Z" --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:5", "common_name": "42-ffaa:1:5 AS cert"}') AS5/cp-as.pem AS5/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:1", "common_name": "42-ffaa:1:1 AS cert"}') AS1/cp-as.pem AS1/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:2", "common_name": "42-ffaa:1:2 AS cert"}') AS2/cp-as.pem AS2/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:3", "common_name": "42-ffaa:1:3 AS cert"}') AS3/cp-as.pem AS3/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:4", "common_name": "42-ffaa:1:4 AS cert"}') AS4/cp-as.pem AS4/cp-as.key --ca AS1/cp-ca.pem --ca-key AS1/cp-ca.key --bundle
+scion-pki certificate create --not-before="1970-01-01T00:00:00Z" --not-after="2124-01-01T00:00:00Z" --profile=cp-as <(echo '{"isd_as": "42-ffaa:1:5", "common_name": "42-ffaa:1:5 AS cert"}') AS5/cp-as.pem AS5/cp-as.key --ca AS2/cp-ca.pem --ca-key AS2/cp-ca.key --bundle
 
 for i in {1..5}
 do
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 8256a1b6e9a3..3c75102d9298 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -32,6 +32,10 @@ in
 , xorg
 , libGL
 
+, libICE
+, libSM
+, libX11
+
 , vmopts ? null
 }:
 
@@ -217,7 +221,13 @@ rec {
         libxml2
         xz
       ];
-
+      extraLdPath = lib.optionals (stdenv.hostPlatform.isLinux) [
+        # Avalonia dependencies needed for dotMemory
+        libICE
+        libSM
+        libX11
+        libGL
+      ];
     }).overrideAttrs (attrs: {
       postInstall = (attrs.postInstall or "") + lib.optionalString (stdenv.hostPlatform.isLinux) ''
         (
diff --git a/pkgs/applications/misc/diffpdf/default.nix b/pkgs/applications/misc/diffpdf/default.nix
index 98f85807806d..41265e61cfc3 100644
--- a/pkgs/applications/misc/diffpdf/default.nix
+++ b/pkgs/applications/misc/diffpdf/default.nix
@@ -49,7 +49,7 @@ mkDerivation rec {
     '';
 
   meta = {
-    homepage = "http://www.qtrac.eu/diffpdfc.html";
+    homepage = "http://www.qtrac.eu/diffpdf.html";
     description = "Tool for diffing pdf files visually or textually";
     mainProgram = "diffpdf";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index e61a6d107440..8131243ef262 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -7,6 +7,7 @@
 , flac
 , libogg
 , libvorbis
+, stdenv_32bit
 , iceSupport ? true, zeroc-ice
 , jackSupport ? false, libjack2
 , pipewireSupport ? true, pipewire
@@ -15,7 +16,7 @@
 }:
 
 let
-  generic = overrides: source: stdenv.mkDerivation (source // overrides // {
+  generic = overrides: source: (overrides.stdenv or stdenv).mkDerivation (source // overrides // {
     pname = overrides.type;
     version = source.version;
 
@@ -95,6 +96,17 @@ let
       ++ lib.optional iceSupport zeroc-ice;
   } source;
 
+  overlay = source: generic {
+    stdenv = stdenv_32bit;
+    type = "mumble-overlay";
+
+    configureFlags = [
+      "-D server=OFF"
+      "-D client=OFF"
+      "-D overlay=ON"
+    ];
+  } source;
+
   source = rec {
     version = "1.5.634";
 
@@ -118,4 +130,5 @@ let
 in {
   mumble  = lib.recursiveUpdate (client source) {meta.mainProgram = "mumble";};
   murmur  = lib.recursiveUpdate (server source) {meta.mainProgram = "mumble-server";};
+  overlay = overlay source;
 }
diff --git a/pkgs/applications/networking/mumble/overlay.nix b/pkgs/applications/networking/mumble/overlay.nix
deleted file mode 100644
index 40c0d3e4c3ea..000000000000
--- a/pkgs/applications/networking/mumble/overlay.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ stdenv, lib, which, file, mumble, mumble_i686
-}:
-
-let
-  binPath = lib.makeBinPath [ which file ];
-in stdenv.mkDerivation {
-  pname = "mumble-overlay";
-  version = mumble.version;
-
-  inherit (mumble) src;
-  patches = mumble.patches or [];
-
-  installPhase = ''
-    mkdir -p $out/lib
-    ln -s ${mumble}/lib/libmumble.so.1 $out/lib/
-
-    ${lib.optionalString (mumble_i686 != null) ''
-      mkdir -p $out/lib32
-      ln -s ${mumble_i686}/lib/libmumble.so.1 $out/lib32/
-    ''}
-
-    install -Dm755 auxiliary_files/run_scripts/mumble-overlay.in $out/bin/mumble-overlay
-    sed -i "s,/usr/lib,$out/lib,g" $out/bin/mumble-overlay
-    sed -i '2iPATH="${binPath}:$PATH"' $out/bin/mumble-overlay
-  '';
-
-  meta = {
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/applications/networking/onionshare/default.nix b/pkgs/applications/networking/onionshare/default.nix
deleted file mode 100644
index e0b6a80c1749..000000000000
--- a/pkgs/applications/networking/onionshare/default.nix
+++ /dev/null
@@ -1,182 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, meek
-, obfs4
-, python3
-, qt5
-, snowflake
-, substituteAll
-, tor
-}:
-
-let
-  version = "2.6.2";
-
-  src = fetchFromGitHub {
-    owner = "onionshare";
-    repo = "onionshare";
-    rev = "v${version}";
-    hash = "sha256-J8Hdriy8eWpHuMCI87a9a/zCR6xafM3A/Tkyom0Ktko=";
-  };
-
-  meta = with lib; {
-    description = "Securely and anonymously send and receive files";
-    longDescription = ''
-      OnionShare is an open source tool for securely and anonymously sending
-      and receiving files using Tor onion services. It works by starting a web
-      server directly on your computer and making it accessible as an
-      unguessable Tor web address that others can load in Tor Browser to
-      download files from you, or upload files to you. It doesn't require
-      setting up a separate server, using a third party file-sharing service,
-      or even logging into an account.
-
-      Unlike services like email, Google Drive, DropBox, WeTransfer, or nearly
-      any other way people typically send files to each other, when you use
-      OnionShare you don't give any companies access to the files that you're
-      sharing. So long as you share the unguessable web address in a secure way
-      (like pasting it in an encrypted messaging app), no one but you and the
-      person you're sharing with can access the files.
-    '';
-
-    homepage = "https://onionshare.org/";
-
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ bbjubjub ];
-  };
-in
-rec {
-  onionshare = python3.pkgs.buildPythonApplication {
-    pname = "onionshare-cli";
-    inherit version;
-    src = "${src}/cli";
-    patches = [
-      # hardcode store paths of dependencies
-      (substituteAll {
-        src = ./fix-paths.patch;
-        inherit tor meek obfs4 snowflake;
-        inherit (tor) geoip;
-      })
-
-      # Remove distutils for Python 3.12 compatibility
-      # https://github.com/onionshare/onionshare/pull/1907
-      (fetchpatch {
-        url = "https://github.com/onionshare/onionshare/commit/1fb1a470df20d8a7576c8cf51213e5928528d59a.patch";
-        includes = [ "onionshare_cli/onion.py" ];
-        stripLen = 1;
-        hash = "sha256-4XkqaEhMhvj6PyMssnLfXRazdP4k+c9mMDveho7pWg8=";
-      })
-    ];
-    dependencies = with python3.pkgs; [
-      colorama
-      flask
-      flask-compress
-      flask-socketio
-      gevent-websocket
-      packaging
-      psutil
-      pycrypto
-      pynacl
-      pyside6
-      pysocks
-      qrcode
-      requests
-      setuptools
-      stem
-      unidecode
-      waitress
-      werkzeug
-    ] ++ requests.optional-dependencies.socks;
-
-    buildInputs = [
-      obfs4
-      tor
-    ];
-
-    nativeCheckInputs = with python3.pkgs; [
-      pytestCheckHook
-    ];
-
-    preCheck = ''
-      # Tests use the home directory
-      export HOME="$(mktemp -d)"
-    '';
-
-    disabledTests = lib.optionals stdenv.hostPlatform.isLinux [
-      "test_get_tor_paths_linux"  # expects /usr instead of /nix/store
-    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # requires meek-client which is not packaged
-      "test_get_tor_paths_darwin"
-      # on darwin (and only on darwin) onionshare attempts to discover
-      # user's *real* homedir via /etc/passwd, making it more painful
-      # to fake
-      "test_receive_mode_webhook"
-    ];
-
-    meta = meta // {
-      mainProgram = "onionshare-cli";
-    };
-  };
-
-  onionshare-gui = python3.pkgs.buildPythonApplication {
-    pname = "onionshare";
-    inherit version;
-    src = "${src}/desktop";
-    patches = [
-      # hardcode store paths of dependencies
-      (substituteAll {
-        src = ./fix-paths-gui.patch;
-        inherit tor meek obfs4 snowflake;
-        inherit (tor) geoip;
-      })
-
-      # https://github.com/onionshare/onionshare/pull/1903
-      (fetchpatch {
-        url = "https://github.com/onionshare/onionshare/pull/1903/commits/f20db8fcbd18e51b58814ae8f98f3a7502b4f456.patch";
-        stripLen = 1;
-        hash = "sha256-wfIjdPhdUYAvbK5XyE1o2OtFOlJRj0X5mh7QQRjdyP0=";
-      })
-
-      # Remove distutils for Python 3.12 compatibility
-      # https://github.com/onionshare/onionshare/pull/1907
-      (fetchpatch {
-        url = "https://github.com/onionshare/onionshare/commit/1fb1a470df20d8a7576c8cf51213e5928528d59a.patch";
-        includes = [ "onionshare/update_checker.py" ];
-        stripLen = 1;
-        hash = "sha256-mRRj9cALZVHw86CgU17sp9EglKhkRRcGfROyQpsXVfU=";
-      })
-    ];
-
-    dependencies = with python3.pkgs; [
-      onionshare
-      pyside6
-      qrcode
-    ];
-
-    nativeBuildInputs = [ qt5.wrapQtAppsHook ];
-
-    buildInputs = [ qt5.qtwayland ];
-
-    postInstall = ''
-      mkdir -p $out/share/{appdata,applications,icons}
-      cp $src/org.onionshare.OnionShare.desktop $out/share/applications
-      cp $src/org.onionshare.OnionShare.svg $out/share/icons
-      cp $src/org.onionshare.OnionShare.appdata.xml $out/share/appdata
-    '';
-
-    dontWrapQtApps = true;
-
-    preFixup = ''
-      makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-    '';
-
-    doCheck = false;
-
-    pythonImportsCheck = [ "onionshare" ];
-
-    meta = meta // {
-      mainProgram = "onionshare";
-    };
-  };
-}
diff --git a/pkgs/applications/office/activitywatch/default.nix b/pkgs/applications/office/activitywatch/default.nix
index f07a1e9b561d..e488363c2012 100644
--- a/pkgs/applications/office/activitywatch/default.nix
+++ b/pkgs/applications/office/activitywatch/default.nix
@@ -55,6 +55,7 @@ rec {
       description = "Watches keyboard and mouse activity to determine if you are AFK or not (for use with ActivityWatch)";
       homepage = "https://github.com/ActivityWatch/aw-watcher-afk";
       maintainers = with maintainers; [ huantian ];
+      mainProgram = "aw-watcher-afk";
       license = licenses.mpl20;
     };
   };
@@ -83,6 +84,7 @@ rec {
       description = "Cross-platform window watcher (for use with ActivityWatch)";
       homepage = "https://github.com/ActivityWatch/aw-watcher-window";
       maintainers = with maintainers; [ huantian ];
+      mainProgram = "aw-watcher-window";
       license = licenses.mpl20;
       badPlatforms = lib.platforms.darwin; # requires pyobjc-framework
     };
@@ -141,6 +143,7 @@ rec {
       description = "Tray icon that manages ActivityWatch processes, built with Qt";
       homepage = "https://github.com/ActivityWatch/aw-qt";
       maintainers = with maintainers; [ huantian ];
+      mainProgram = "aw-qt";
       license = licenses.mpl20;
       badPlatforms = lib.platforms.darwin; # requires pyobjc-framework
     };
@@ -170,6 +173,7 @@ rec {
       description = "Desktop notification service for ActivityWatch";
       homepage = "https://github.com/ActivityWatch/aw-notify";
       maintainers = with maintainers; [ huantian ];
+      mainProgram = "aw-notify";
       license = licenses.mpl20;
     };
   };
diff --git a/pkgs/by-name/ac/acr-cli/package.nix b/pkgs/by-name/ac/acr-cli/package.nix
new file mode 100644
index 000000000000..51df14afc5a9
--- /dev/null
+++ b/pkgs/by-name/ac/acr-cli/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  nix-update-script,
+  acr-cli,
+}:
+buildGoModule rec {
+  pname = "acr-cli";
+  version = "0.14";
+
+  src = fetchFromGitHub {
+    owner = "Azure";
+    repo = "acr-cli";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-h4vRtxAu/ggEu5HuzaiEoLslOyAXP1rMI1/ua9YARug=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/Azure/acr-cli/version.Version=${version}"
+    "-X=github.com/Azure/acr-cli/version.Revision=${src.rev}"
+  ];
+
+  executable = [ "acr" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = acr-cli;
+    command = "acr version";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command Line Tool for interacting with Azure Container Registry Images";
+    homepage = "https://github.com/Azure/acr-cli";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hausken ];
+    mainProgram = "acr-cli";
+  };
+}
diff --git a/pkgs/by-name/ac/act/package.nix b/pkgs/by-name/ac/act/package.nix
index b81967bec147..9e26c99508b8 100644
--- a/pkgs/by-name/ac/act/package.nix
+++ b/pkgs/by-name/ac/act/package.nix
@@ -2,6 +2,8 @@
   lib,
   fetchFromGitHub,
   buildGoModule,
+  testers,
+  act,
 }:
 
 let
@@ -28,6 +30,10 @@ buildGoModule {
     "-X main.version=${version}"
   ];
 
+  passthru.tests.version = testers.testVersion {
+    package = act;
+  };
+
   meta = {
     description = "Run your GitHub Actions locally";
     mainProgram = "act";
diff --git a/pkgs/by-name/ar/archimede/package.nix b/pkgs/by-name/ar/archimede/package.nix
new file mode 100644
index 000000000000..4db745f62caa
--- /dev/null
+++ b/pkgs/by-name/ar/archimede/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+let
+  version = "0.0.2";
+in
+buildGoModule {
+  pname = "archimede";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "gennaro-tedesco";
+    repo = "archimede";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-7P7PtzYlcNYG2+KW9zvcaRlTW+vHw8jeLD2dEQXmrzc=";
+  };
+
+  vendorHash = "sha256-F74TVp6+UdV31YVYYHWtdIzpbbiYM2I8csGobesFN2g=";
+
+  meta = {
+    homepage = "https://github.com/gennaro-tedesco/archimede";
+    description = "Unobtrusive directory information fetcher";
+    license = lib.licenses.asl20;
+    mainProgram = "archimede";
+    maintainers = [ lib.maintainers.anugrahn1 ];
+  };
+}
diff --git a/pkgs/by-name/bf/bfg-repo-cleaner/package.nix b/pkgs/by-name/bf/bfg-repo-cleaner/package.nix
index 447f9e7d84dc..d2044dd34c78 100644
--- a/pkgs/by-name/bf/bfg-repo-cleaner/package.nix
+++ b/pkgs/by-name/bf/bfg-repo-cleaner/package.nix
@@ -1,4 +1,12 @@
-{ lib, stdenv, fetchurl, jre, makeWrapper }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jre,
+  makeWrapper,
+  testers,
+  bfg-repo-cleaner,
+}:
 
 stdenv.mkDerivation rec {
   pname = "bfg-repo-cleaner";
@@ -23,6 +31,10 @@ stdenv.mkDerivation rec {
     makeWrapper "${jre}/bin/java" $out/bin/bfg --add-flags "-cp $out/share/java/$jarName com.madgag.git.bfg.cli.Main"
   '';
 
+  passthru.tests.version = testers.testVersion {
+    package = bfg-repo-cleaner;
+  };
+
   meta = with lib; {
     homepage = "https://rtyley.github.io/bfg-repo-cleaner/";
     # Descriptions taken with minor modification from the homepage of bfg-repo-cleaner
diff --git a/pkgs/applications/editors/bluej/default.nix b/pkgs/by-name/bl/bluej/package.nix
similarity index 63%
rename from pkgs/applications/editors/bluej/default.nix
rename to pkgs/by-name/bl/bluej/package.nix
index 802bc15fc583..52e46d1f30fd 100644
--- a/pkgs/applications/editors/bluej/default.nix
+++ b/pkgs/by-name/bl/bluej/package.nix
@@ -1,5 +1,19 @@
-{ lib, stdenv, fetchurl, openjdk, glib, dpkg, wrapGAppsHook3 }:
-
+{
+  lib,
+  stdenv,
+  fetchurl,
+  openjdk17,
+  openjfx17,
+  glib,
+  dpkg,
+  wrapGAppsHook3,
+}:
+let
+  openjdk = openjdk17.override {
+    enableJavaFX = true;
+    openjfx_jdk = openjfx17.override { withWebKit = true; };
+  };
+in
 stdenv.mkDerivation rec {
   pname = "bluej";
   version = "5.2.0";
@@ -8,11 +22,16 @@ stdenv.mkDerivation rec {
     # We use the deb here. First instinct might be to go for the "generic" JAR
     # download, but that is actually a graphical installer that is much harder
     # to unpack than the deb.
-    url = "https://www.bluej.org/download/files/BlueJ-linux-${builtins.replaceStrings ["."] [""] version}.deb";
+    url = "https://www.bluej.org/download/files/BlueJ-linux-${
+      builtins.replaceStrings [ "." ] [ "" ] version
+    }.deb";
     sha256 = "sha256-sOT86opMa9ytxJlfURIsD06HiP+j+oz3lQ0DqmLV1wE=";
   };
 
-  nativeBuildInputs = [ dpkg wrapGAppsHook3 ];
+  nativeBuildInputs = [
+    dpkg
+    wrapGAppsHook3
+  ];
   buildInputs = [ glib ];
 
   dontWrapGApps = true;
@@ -36,13 +55,14 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Simple integrated development environment for Java";
     homepage = "https://www.bluej.org/";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    license = licenses.gpl2ClasspathPlus;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    license = lib.licenses.gpl2ClasspathPlus;
     mainProgram = "bluej";
-    maintainers = with maintainers; [ chvp ];
-    platforms = platforms.linux;
+    maintainers = with lib.maintainers; [ chvp ];
+    platforms = lib.platforms.linux;
   };
+
 }
diff --git a/pkgs/by-name/br/breakpad/package.nix b/pkgs/by-name/br/breakpad/package.nix
index 0b5f4e52f39f..249dab01b229 100644
--- a/pkgs/by-name/br/breakpad/package.nix
+++ b/pkgs/by-name/br/breakpad/package.nix
@@ -8,12 +8,12 @@ let
 in stdenv.mkDerivation (finalAttrs: {
   pname = "breakpad";
 
-  version = "2023.01.27";
+  version = "2023.06.01";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/breakpad/breakpad";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8msKz0K10r13TwM3oS6GCIlMdf8k8HBKfKJkPmrUrIs=";
+    hash = "sha256-8AkC/8oX4OWAcV21laJ0AeMRB9G04rFc6UJFy7Wus4A=";
   };
 
   buildInputs = [ zlib ];
diff --git a/pkgs/by-name/ca/caf/package.nix b/pkgs/by-name/ca/caf/package.nix
index b9b067cd684e..4cd5937d2486 100644
--- a/pkgs/by-name/ca/caf/package.nix
+++ b/pkgs/by-name/ca/caf/package.nix
@@ -1,4 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, cmake, openssl }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  openssl,
+}:
 
 stdenv.mkDerivation rec {
   pname = "actor-framework";
@@ -30,6 +36,9 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     platforms = platforms.unix;
     changelog = "https://github.com/actor-framework/actor-framework/raw/${version}/CHANGELOG.md";
-    maintainers = with maintainers; [ bobakker tobim ];
+    maintainers = with maintainers; [
+      bobakker
+      tobim
+    ];
   };
 }
diff --git a/pkgs/by-name/ca/cargo-deb/package.nix b/pkgs/by-name/ca/cargo-deb/package.nix
index 1b3180e33813..59ecbd5bfdc6 100644
--- a/pkgs/by-name/ca/cargo-deb/package.nix
+++ b/pkgs/by-name/ca/cargo-deb/package.nix
@@ -1,8 +1,9 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, makeWrapper
-, dpkg
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  makeWrapper,
+  dpkg,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,10 +23,23 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
-  # This is an FHS specific assert depending on glibc location
   checkFlags = [
+    # This is an FHS specific assert depending on glibc location
     "--skip=dependencies::resolve_test"
     "--skip=run_cargo_deb_command_on_example_dir_with_separate_debug_symbols"
+    # The following tests require empty CARGO_BUILD_TARGET env variable, but we
+    # set it ever since https://github.com/NixOS/nixpkgs/pull/298108.
+    "--skip=build_with_command_line_compress_gz"
+    "--skip=build_with_command_line_compress_xz"
+    "--skip=build_with_explicit_compress_type_gz"
+    "--skip=build_with_explicit_compress_type_xz"
+    "--skip=build_workspaces"
+    "--skip=cwd_dir1"
+    "--skip=cwd_dir2"
+    "--skip=cwd_dir3"
+    "--skip=run_cargo_deb_command_on_example_dir"
+    "--skip=run_cargo_deb_command_on_example_dir_with_variant"
+    "--skip=run_cargo_deb_command_on_example_dir_with_version"
   ];
 
   postInstall = ''
@@ -38,6 +52,9 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "cargo-deb";
     homepage = "https://github.com/kornelski/cargo-deb";
     license = licenses.mit;
-    maintainers = with maintainers; [ Br1ght0ne matthiasbeyer ];
+    maintainers = with maintainers; [
+      Br1ght0ne
+      matthiasbeyer
+    ];
   };
 }
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index 9452224d8390..9c2c21a52044 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.20.9";
+  version = "0.20.10";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-iWANQD5+cn/vUYdy6MXBYIEl5BOiG6WPuYYsOyWzUuM=";
+    hash = "sha256-zAyklIIm6jAhFmaBu3BEysLfGEwB34rpYztZaJEQtYg=";
   };
 
-  cargoHash = "sha256-gagCf81TT+6LsxypHoMZXHU0ux4f8wytwDMGyaDbXyg=";
+  cargoHash = "sha256-fXrw753Hn4fbeX6+GRoH9MKrH0udjxnBK7AVCHnqIcs=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/fi/fishnet/package.nix b/pkgs/by-name/fi/fishnet/package.nix
index 77149af5d26c..faf4a244057f 100644
--- a/pkgs/by-name/fi/fishnet/package.nix
+++ b/pkgs/by-name/fi/fishnet/package.nix
@@ -1,7 +1,10 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, fetchurl
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchurl,
+  testers,
+  fishnet,
 }:
 
 let
@@ -16,7 +19,8 @@ let
     url = "https://tests.stockfishchess.org/api/nn/${nnueSmallFile}";
     sha256 = "sha256-N/GPYtdy8xB+HWqso4mMEww8hvKrY+ZVX7vKIGNaiZ0=";
   };
-in rustPlatform.buildRustPackage rec {
+in
+rustPlatform.buildRustPackage rec {
   pname = "fishnet";
   version = "2.9.4";
 
@@ -37,12 +41,22 @@ in rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-HuVEg8uJ1WbXzYaXCPBobmxhbhk+X8D/xFcM2wE8Lh0=";
 
+  passthru.tests.version = testers.testVersion {
+    package = fishnet;
+  };
+
   meta = with lib; {
     description = "Distributed Stockfish analysis for lichess.org";
     homepage = "https://github.com/lichess-org/fishnet";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ tu-maurice thibaultd ];
-    platforms = [ "aarch64-linux" "x86_64-linux" ];
+    maintainers = with maintainers; [
+      tu-maurice
+      thibaultd
+    ];
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
     mainProgram = "fishnet";
   };
 }
diff --git a/pkgs/by-name/fo/foliate/package.nix b/pkgs/by-name/fo/foliate/package.nix
index 4cd888468eaf..611006cc8299 100644
--- a/pkgs/by-name/fo/foliate/package.nix
+++ b/pkgs/by-name/fo/foliate/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "foliate";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "johnfactotum";
     repo = "foliate";
     rev = "refs/tags/${version}";
-    hash = "sha256-uKxybt8ZZuk2tWSJLKC7Tgw78EfMMgI99VExfgOdHwA=";
+    hash = "sha256-y4c/nlFk0hlr773/O2yvW7VzUx0NZWpcDtk8b9wlL2s=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/gh/ghq/package.nix b/pkgs/by-name/gh/ghq/package.nix
index 8f31cc5e01d9..a096a25db3e7 100644
--- a/pkgs/by-name/gh/ghq/package.nix
+++ b/pkgs/by-name/gh/ghq/package.nix
@@ -1,4 +1,11 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  nix-update-script,
+  ghq,
+}:
 
 buildGoModule rec {
   pname = "ghq";
@@ -24,6 +31,13 @@ buildGoModule rec {
     install -m 444 -D ${src}/misc/bash/_ghq $out/share/bash-completion/completions/_ghq
   '';
 
+  passthru = {
+    tests.version = testers.testVersion {
+      package = ghq;
+    };
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "Remote repository management made easy";
     homepage = "https://github.com/x-motemen/ghq";
diff --git a/pkgs/by-name/ig/ignite-cli/package.nix b/pkgs/by-name/ig/ignite-cli/package.nix
index 0db9b0a99b6f..dc4298bb94ad 100644
--- a/pkgs/by-name/ig/ignite-cli/package.nix
+++ b/pkgs/by-name/ig/ignite-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "ignite-cli";
-  version = "28.5.3";
+  version = "28.6.0";
 
   src = fetchFromGitHub {
     repo = "cli";
     owner = "ignite";
     rev = "v${version}";
-    hash = "sha256-ziuzSV7LjRgR1wNE1QD+OszIeXiip7pPU4/BD8fhV5s=";
+    hash = "sha256-N1Wwy5iWQHREIof4TL6PVpNONSJ6R+OSUiOmdXN6+/4=";
   };
 
-  vendorHash = "sha256-5Z5AuZtPwfENKp8wMYfRqmnkX4W4fWTjWulT5uNusPo=";
+  vendorHash = "sha256-G54QYz1IkbYMQaUTnIAjfhv2Kj6YtKf68CFjqB2GgQ0=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/nb/nb/package.nix b/pkgs/by-name/nb/nb/package.nix
index 9d0b06910433..44239528ccd4 100644
--- a/pkgs/by-name/nb/nb/package.nix
+++ b/pkgs/by-name/nb/nb/package.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, installShellFiles }:
+{ stdenv, lib, fetchFromGitHub, installShellFiles, testers, nix-update-script, nb }:
 
 stdenv.mkDerivation rec {
   pname = "nb";
@@ -25,6 +25,15 @@ stdenv.mkDerivation rec {
     installShellCompletion --cmd nb etc/nb-completion.{bash,zsh,fish}
   '';
 
+  passthru = {
+    tests.version = testers.testVersion {
+      package = nb;
+      # Setting EDITOR to avoid: "Command line text editor not found"
+      command = "EDITOR=nano nb --version";
+    };
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     description = "Command line note-taking, bookmarking, archiving, and knowledge base application";
     longDescription = ''
diff --git a/pkgs/by-name/no/nodemon/package.nix b/pkgs/by-name/no/nodemon/package.nix
index cc51b9263fc8..4c7c42cc8090 100644
--- a/pkgs/by-name/no/nodemon/package.nix
+++ b/pkgs/by-name/no/nodemon/package.nix
@@ -23,9 +23,9 @@ buildNpmPackage rec {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "Framework for converting Left-To-Right (LTR) Cascading Style Sheets(CSS) to Right-To-Left (RTL)";
-    mainProgram = "rtlcss";
-    homepage = "https://rtlcss.com";
+    description = "Simple monitor script for use during development of a Node.js app";
+    mainProgram = "nodemon";
+    homepage = "https://nodemon.io";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ pyrox0 ];
   };
diff --git a/pkgs/by-name/nv/nvrh/package.nix b/pkgs/by-name/nv/nvrh/package.nix
index eb574a043940..02d24c681d72 100644
--- a/pkgs/by-name/nv/nvrh/package.nix
+++ b/pkgs/by-name/nv/nvrh/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "nvrh";
-  version = "0.1.14";
+  version = "0.1.15";
 
   src = fetchFromGitHub {
     owner = "mikew";
     repo = "nvrh";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ff+ZdUScgAaNHASYAASQ/lfkCyX600kNw2Rjpr3TbBc=";
+    hash = "sha256-FLlSS/ZgoGT4SyBG/sKdrN3eBSJdT0qFeGl01y4P/So=";
   };
 
   postPatch = ''
@@ -26,7 +26,7 @@ buildGoModule rec {
     cp manifest.json src/
   '';
 
-  vendorHash = "sha256-BioDzQMZWtTiM08aBQTPT4IGxK4f2JNx7dzNbcCgELQ=";
+  vendorHash = "sha256-DuGMlRdVUMKwghPQjVP3A+epnsA5a15jl84Y8LTPkTM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/onionshare/fix-paths-gui.patch b/pkgs/by-name/on/onionshare-gui/fix-paths-gui.patch
similarity index 100%
rename from pkgs/applications/networking/onionshare/fix-paths-gui.patch
rename to pkgs/by-name/on/onionshare-gui/fix-paths-gui.patch
diff --git a/pkgs/by-name/on/onionshare-gui/package.nix b/pkgs/by-name/on/onionshare-gui/package.nix
new file mode 100644
index 000000000000..85c3527522b0
--- /dev/null
+++ b/pkgs/by-name/on/onionshare-gui/package.nix
@@ -0,0 +1,85 @@
+{
+  python3Packages,
+  onionshare,
+  substituteAll,
+  meek,
+  obfs4,
+  snowflake,
+  tor,
+  fetchpatch,
+  qt5,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "onionshare";
+  inherit (onionshare)
+    src
+    version
+    build-system
+    pythonRelaxDeps
+    ;
+  pyproject = true;
+
+  sourceRoot = "${src.name}/desktop";
+
+  patches = [
+    # hardcode store paths of dependencies
+    (substituteAll {
+      src = ./fix-paths-gui.patch;
+      inherit
+        meek
+        obfs4
+        snowflake
+        tor
+        ;
+      inherit (tor) geoip;
+    })
+
+    # https://github.com/onionshare/onionshare/pull/1903
+    (fetchpatch {
+      url = "https://github.com/onionshare/onionshare/pull/1903/commits/f20db8fcbd18e51b58814ae8f98f3a7502b4f456.patch";
+      stripLen = 1;
+      hash = "sha256-wfIjdPhdUYAvbK5XyE1o2OtFOlJRj0X5mh7QQRjdyP0=";
+    })
+
+    # Remove distutils for Python 3.12 compatibility
+    # https://github.com/onionshare/onionshare/pull/1907
+    (fetchpatch {
+      url = "https://github.com/onionshare/onionshare/commit/1fb1a470df20d8a7576c8cf51213e5928528d59a.patch";
+      includes = [ "onionshare/update_checker.py" ];
+      stripLen = 1;
+      hash = "sha256-mRRj9cALZVHw86CgU17sp9EglKhkRRcGfROyQpsXVfU=";
+    })
+  ];
+
+  dependencies = with python3Packages; [
+    onionshare
+    pyside6
+    python-gnupg
+    qrcode
+  ];
+
+  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+
+  buildInputs = [ qt5.qtwayland ];
+
+  postInstall = ''
+    mkdir -p $out/share/{appdata,applications,icons}
+    cp $src/desktop/org.onionshare.OnionShare.desktop $out/share/applications
+    cp $src/desktop/org.onionshare.OnionShare.svg $out/share/icons
+    cp $src/desktop/org.onionshare.OnionShare.appdata.xml $out/share/appdata
+  '';
+
+  dontWrapQtApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
+
+  doCheck = false;
+
+  pythonImportsCheck = [ "onionshare" ];
+
+  meta = onionshare.meta // {
+    mainProgram = "onionshare";
+  };
+}
diff --git a/pkgs/applications/networking/onionshare/fix-paths.patch b/pkgs/by-name/on/onionshare/fix-paths.patch
similarity index 100%
rename from pkgs/applications/networking/onionshare/fix-paths.patch
rename to pkgs/by-name/on/onionshare/fix-paths.patch
diff --git a/pkgs/by-name/on/onionshare/package.nix b/pkgs/by-name/on/onionshare/package.nix
new file mode 100644
index 000000000000..4b36c4ca5f01
--- /dev/null
+++ b/pkgs/by-name/on/onionshare/package.nix
@@ -0,0 +1,155 @@
+{
+  lib,
+  stdenv,
+  python3Packages,
+  fetchFromGitHub,
+
+  # patches
+  substituteAll,
+  meek,
+  obfs4,
+  snowflake,
+  tor,
+
+  fetchpatch,
+  versionCheckHook,
+  gitUpdater,
+  onionshare-gui,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "onionshare-cli";
+  version = "2.6.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "onionshare";
+    repo = "onionshare";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-J8Hdriy8eWpHuMCI87a9a/zCR6xafM3A/Tkyom0Ktko=";
+  };
+
+  sourceRoot = "${src.name}/cli";
+
+  patches = [
+    # hardcode store paths of dependencies
+    (substituteAll {
+      src = ./fix-paths.patch;
+      inherit
+        meek
+        obfs4
+        snowflake
+        tor
+        ;
+      inherit (tor) geoip;
+    })
+
+    # Remove distutils for Python 3.12 compatibility
+    # https://github.com/onionshare/onionshare/pull/1907
+    (fetchpatch {
+      url = "https://github.com/onionshare/onionshare/commit/1fb1a470df20d8a7576c8cf51213e5928528d59a.patch";
+      includes = [ "onionshare_cli/onion.py" ];
+      stripLen = 1;
+      hash = "sha256-4XkqaEhMhvj6PyMssnLfXRazdP4k+c9mMDveho7pWg8=";
+    })
+  ];
+
+  build-system = with python3Packages; [
+    poetry-core
+  ];
+
+  pythonRelaxDeps = true;
+
+  dependencies =
+    with python3Packages;
+    [
+      cffi
+      click
+      colorama
+      cython
+      eventlet
+      flask
+      flask-compress
+      flask-socketio
+      gevent
+      gevent-websocket
+      packaging
+      psutil
+      pynacl
+      pysocks
+      qrcode
+      requests
+      setuptools
+      stem
+      unidecode
+      urllib3
+      waitress
+      werkzeug
+      wheel
+    ]
+    ++ requests.optional-dependencies.socks;
+
+  buildInputs = [
+    obfs4
+    tor
+  ];
+
+  nativeCheckInputs =
+    [
+      versionCheckHook
+    ]
+    ++ (with python3Packages; [
+      pytestCheckHook
+    ]);
+
+  preCheck = ''
+    # Tests use the home directory
+    export HOME="$(mktemp -d)"
+  '';
+
+  disabledTests =
+    lib.optionals stdenv.hostPlatform.isLinux [
+      "test_get_tor_paths_linux" # expects /usr instead of /nix/store
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # requires meek-client which is not packaged
+      "test_get_tor_paths_darwin"
+      # on darwin (and only on darwin) onionshare attempts to discover
+      # user's *real* homedir via /etc/passwd, making it more painful
+      # to fake
+      "test_receive_mode_webhook"
+    ];
+
+  __darwinAllowLocalNetworking = true;
+
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
+    tests = {
+      inherit onionshare-gui;
+    };
+  };
+
+  meta = {
+    description = "Securely and anonymously send and receive files";
+    longDescription = ''
+      OnionShare is an open source tool for securely and anonymously sending
+      and receiving files using Tor onion services. It works by starting a web
+      server directly on your computer and making it accessible as an
+      unguessable Tor web address that others can load in Tor Browser to
+      download files from you, or upload files to you. It doesn't require
+      setting up a separate server, using a third party file-sharing service,
+      or even logging into an account.
+
+      Unlike services like email, Google Drive, DropBox, WeTransfer, or nearly
+      any other way people typically send files to each other, when you use
+      OnionShare you don't give any companies access to the files that you're
+      sharing. So long as you share the unguessable web address in a secure way
+      (like pasting it in an encrypted messaging app), no one but you and the
+      person you're sharing with can access the files.
+    '';
+    homepage = "https://onionshare.org/";
+    changelog = "https://github.com/onionshare/onionshare/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ bbjubjub ];
+    mainProgram = "onionshare-cli";
+  };
+}
diff --git a/pkgs/by-name/pb/pbpctrl/package.nix b/pkgs/by-name/pb/pbpctrl/package.nix
index 282fa976def7..782fb1ac926b 100644
--- a/pkgs/by-name/pb/pbpctrl/package.nix
+++ b/pkgs/by-name/pb/pbpctrl/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pbpctrl";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "qzed";
     repo = "${pname}";
     rev = "v${version}";
-    hash = "sha256-V7wfEXJ0tVQNsi1OFU1Dk2d9ImsNFRriGutpJzh2tV8=";
+    hash = "sha256-u5I3Hs00JDPRBwThYTEmNiZj/zPVfHyyrt4E68d13do=";
   };
 
-  cargoHash = "sha256-8D+WD5bOxoUhw4a7SUr+D2gn1NA7OkmoCcALO9HY8Qk=";
+  cargoHash = "sha256-W59TRrFSm/IrStH9YitoG6nLs9pesDmL9+/DHnty3nw=";
 
   nativeBuildInputs = [ pkg-config protobuf ];
   buildInputs = [ dbus ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
     description = "Control Google Pixel Buds Pro from the Linux command line";
     homepage = "https://github.com/qzed/pbpctrl";
     license = with licenses; [ asl20 mit ];
-    maintainers = [ maintainers.vanilla ];
+    maintainers = with maintainers; [ vanilla cafkafk ];
     platforms = platforms.linux;
     mainProgram = "pbpctrl";
   };
diff --git a/pkgs/by-name/po/ponysay/package.nix b/pkgs/by-name/po/ponysay/package.nix
index 0b374e1efba1..f58d78285d7f 100644
--- a/pkgs/by-name/po/ponysay/package.nix
+++ b/pkgs/by-name/po/ponysay/package.nix
@@ -23,6 +23,9 @@ stdenv.mkDerivation rec {
     substituteInPlace setup.py --replace \
         "fileout.write(('#!/usr/bin/env %s\n' % env).encode('utf-8'))" \
         "fileout.write(('#!%s/bin/%s\n' % (os.environ['python3'], env)).encode('utf-8'))"
+    substituteInPlace src/balloon.py --replace-fail \
+        $'\'\'\'\n        Constructor' \
+        $'r\'\'\'\n        Constructor'
     python3 setup.py --prefix=$out --freedom=partial install \
         --with-shared-cache=$out/share/ponysay \
         --with-bash
diff --git a/pkgs/by-name/ra/rainfrog/package.nix b/pkgs/by-name/ra/rainfrog/package.nix
index 38e86fa8e56a..671bda994c1a 100644
--- a/pkgs/by-name/ra/rainfrog/package.nix
+++ b/pkgs/by-name/ra/rainfrog/package.nix
@@ -2,9 +2,11 @@
   lib,
   darwin,
   fetchFromGitHub,
+  testers,
   nix-update-script,
   rustPlatform,
   stdenv,
+  rainfrog,
 }:
 let
   version = "0.2.10";
@@ -31,7 +33,17 @@ rustPlatform.buildRustPackage {
     ]
   );
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests.version = testers.testVersion {
+      package = rainfrog;
+
+      command = ''
+        RAINFROG_DATA="$(mktemp -d)" rainfrog --version
+      '';
+    };
+
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     changelog = "https://github.com/achristmascarl/rainfrog/releases/tag/v${version}";
diff --git a/pkgs/by-name/si/sile/package.nix b/pkgs/by-name/si/sile/package.nix
index d5ba7ee42103..1a64d5981d20 100644
--- a/pkgs/by-name/si/sile/package.nix
+++ b/pkgs/by-name/si/sile/package.nix
@@ -10,6 +10,7 @@
   cargo,
   rustc,
   rustPlatform,
+  luarocks,
 
   # buildInputs
   lua,
@@ -19,7 +20,6 @@
   libiconv,
   stylua,
   typos,
-  darwin,
   # FONTCONFIG_FILE
   makeFontsConf,
   gentium,
@@ -31,18 +31,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sile";
-  version = "0.15.6";
+  version = "0.15.7";
 
   src = fetchurl {
     url = "https://github.com/sile-typesetter/sile/releases/download/v${finalAttrs.version}/sile-${finalAttrs.version}.tar.zst";
-    sha256 = "sha256-CtPvxbpq2/qwuANPp9XDJQHlxIbFiaNZJvYZeUx/wyE=";
+    sha256 = "sha256-PjU6Qfn+FTL3vt66mkIAn/uXWMPPlH8iK6B264ekIis=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src;
     nativeBuildInputs = [ zstd ];
     dontConfigure = true;
-    hash = "sha256-5SheeabI4SqJZ3edAvX2rUEGTdCXHoBTa+rnX7lv9Cg=";
+    hash = "sha256-m21SyGtHwVCz+77pYq48Gjnrf/TLCLCf/IQ7AnZk+fo=";
   };
 
   nativeBuildInputs = [
@@ -52,21 +52,20 @@ stdenv.mkDerivation (finalAttrs: {
     cargo
     rustc
     rustPlatform.cargoSetupHook
+    luarocks
   ];
+  # luarocks propagates cmake, but it shouldn't be used as a build system.
+  dontUseCmakeConfigure = true;
 
-  buildInputs =
-    [
-      finalAttrs.finalPackage.passthru.luaEnv
-      harfbuzz
-      icu
-      fontconfig
-      libiconv
-      stylua
-      typos
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-    ];
+  buildInputs = [
+    finalAttrs.finalPackage.passthru.luaEnv
+    harfbuzz
+    icu
+    fontconfig
+    libiconv
+    stylua
+    typos
+  ];
 
   configureFlags =
     [
@@ -111,41 +110,48 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   passthru = {
-    luaEnv = lua.withPackages (
-      ps:
-      with ps;
+    # Use this passthru variable to add packages to your lua environment. Use
+    # something like this in your development environment:
+    #
+    # myLuaEnv = lua.withPackages (
+    #  ps: lib.attrVals (sile.passthru.luaPackages ++ [
+    #    "lua-cjson"
+    #    "lua-resty-http"
+    #  ]) ps
+    # )
+    luaPackages =
       [
-        cassowary
-        cldr
-        fluent
-        linenoise
-        loadkit
-        lpeg
-        lua-zlib
-        lua_cliargs
-        luaepnf
-        luaexpat
-        luafilesystem
-        luarepl
-        luasec
-        luasocket
-        luautf8
-        penlight
-        vstruct
+        "cassowary"
+        "cldr"
+        "fluent"
+        "linenoise"
+        "loadkit"
+        "lpeg"
+        "lua-zlib"
+        "lua_cliargs"
+        "luaepnf"
+        "luaexpat"
+        "luafilesystem"
+        "luarepl"
+        "luasec"
+        "luasocket"
+        "luautf8"
+        "penlight"
+        "vstruct"
         # lua packages needed for testing
-        busted
-        luacheck
+        "busted"
+        "luacheck"
         # packages needed for building api docs
-        ldoc
+        "ldoc"
         # NOTE: Add lua packages here, to change the luaEnv also read by `flake.nix`
       ]
       ++ lib.optionals (lib.versionOlder lua.luaversion "5.2") [
-        bit32
+        "bit32"
       ]
       ++ lib.optionals (lib.versionOlder lua.luaversion "5.3") [
-        compat53
-      ]
-    );
+        "compat53"
+      ];
+    luaEnv = lua.withPackages (ps: lib.attrVals finalAttrs.finalPackage.passthru.luaPackages ps);
 
     # Copied from Makefile.am
     tests.test = lib.optionalAttrs (!(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) (
diff --git a/pkgs/by-name/sv/svt-av1-psy/package.nix b/pkgs/by-name/sv/svt-av1-psy/package.nix
index be73ec0bdedc..0b23ad2bb364 100644
--- a/pkgs/by-name/sv/svt-av1-psy/package.nix
+++ b/pkgs/by-name/sv/svt-av1-psy/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "svt-av1-psy";
-  version = "2.2.1-B";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "gianni-rosato";
     repo = "svt-av1-psy";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-3GF60XMKglpU82S5XNyW1DBYtU0KVrfghRVYokZTGoI=";
+    hash = "sha256-qySrYZDwmoKf7oAQJlBSWInXeOceGSeL2Kc09SJ5Zs0=";
   };
 
   cmakeBuildType = "Release";
diff --git a/pkgs/by-name/te/tesh/package.nix b/pkgs/by-name/te/tesh/package.nix
index d4d2c1e0ed71..13284d8e0db4 100644
--- a/pkgs/by-name/te/tesh/package.nix
+++ b/pkgs/by-name/te/tesh/package.nix
@@ -17,5 +17,5 @@ in python3Packages.buildPythonPackage rec {
 
   checkInputs = [ python3Packages.pytest ];
   nativeBuildInputs = [ python3Packages.poetry-core ];
-  propagatedBuildInputs = with python3Packages; [ click pexpect ];
+  propagatedBuildInputs = with python3Packages; [ click pexpect distutils ];
 }
diff --git a/pkgs/by-name/ty/typst/package.nix b/pkgs/by-name/ty/typst/package.nix
index b2a28f741ad8..d77e889a5ea6 100644
--- a/pkgs/by-name/ty/typst/package.nix
+++ b/pkgs/by-name/ty/typst/package.nix
@@ -6,8 +6,6 @@
   pkg-config,
   openssl,
   xz,
-  stdenv,
-  darwin,
   nix-update-script,
   versionCheckHook,
 }:
@@ -33,16 +31,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-      xz
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+    xz
+  ];
 
   env = {
     GEN_ARTIFACTS = "artifacts";
diff --git a/pkgs/by-name/va/vapoursynth-nnedi3/package.nix b/pkgs/by-name/va/vapoursynth-nnedi3/package.nix
index 1fe4b8597d72..a40d9742ba67 100644
--- a/pkgs/by-name/va/vapoursynth-nnedi3/package.nix
+++ b/pkgs/by-name/va/vapoursynth-nnedi3/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   pkg-config,
   vapoursynth,
@@ -19,6 +20,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-jd/PCXhbCZGMsoXjekbeqMSRVBJAy4INdpkTbZFjVO0=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "build-fixes-for-aarch64-apple-silicon.patch";
+      url = "https://github.com/dubhater/vapoursynth-nnedi3/commit/15c15080ed4406929aa0d2d6a3f83ca3e26bc979.patch";
+      hash = "sha256-8gNj4LixfrGq0MaIYdZuwSK/2iyh1E9s/uuSBJHZwx8=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/by-name/va/vapoursynth-znedi3/package.nix b/pkgs/by-name/va/vapoursynth-znedi3/package.nix
index cd5b7f90fa29..fbde9b6d26ef 100644
--- a/pkgs/by-name/va/vapoursynth-znedi3/package.nix
+++ b/pkgs/by-name/va/vapoursynth-znedi3/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
   installPhase = ''
     runHook preInstall
 
-    install -D -t $out/lib/vapoursynth vsznedi3${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -D -t $out/lib/vapoursynth vsznedi3.so
     install -D -m644 -t $out/share/nnedi3 nnedi3_weights.bin
 
     runHook postInstall
diff --git a/pkgs/by-name/va/vapoursynth/editor.nix b/pkgs/by-name/va/vapoursynth/editor.nix
index 25d583148eb2..b426d111c799 100644
--- a/pkgs/by-name/va/vapoursynth/editor.nix
+++ b/pkgs/by-name/va/vapoursynth/editor.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   mkDerivation,
   fetchFromGitHub,
   makeWrapper,
@@ -23,6 +24,11 @@ let
       hash = "sha256-+/9j9DJDGXbuTvE8ZXIu6wjcof39SyatS36Q6y9hLPg=";
     };
 
+    postPatch = ''
+      substituteInPlace pro/vsedit/vsedit.pro \
+        --replace-fail "TARGET = vsedit-32bit" "TARGET = vsedit"
+    '';
+
     nativeBuildInputs = [ qmake ];
     buildInputs = [
       qtbase
@@ -34,14 +40,25 @@ let
 
     preConfigure = "cd pro";
 
-    preFixup = ''
-      cd ../build/release*
-      mkdir -p $out/bin
-      for bin in vsedit{,-job-server{,-watcher}}; do
-          mv $bin $out/bin
-          wrapQtApp $out/bin/$bin
-      done
-    '';
+    preFixup =
+      ''
+        cd ../build/release*
+        mkdir -p $out/bin
+      ''
+      + lib.optionalString stdenv.hostPlatform.isDarwin ''
+        mkdir -p $out/Applications
+        for bin in vsedit{,-job-server{,-watcher}}; do
+            mv $bin.app $out/Applications
+            makeQtWrapper $out/Applications/$bin.app/Contents/MacOS/$bin $out/bin/$bin
+            wrapQtApp $out/Applications/$bin.app/Contents/MacOS/$bin
+        done
+      ''
+      + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+        for bin in vsedit{,-job-server{,-watcher}}; do
+            mv $bin $out/bin
+            wrapQtApp $out/bin/$bin
+        done
+      '';
 
     passthru = {
       inherit withPlugins;
diff --git a/pkgs/by-name/va/vapoursynth/package.nix b/pkgs/by-name/va/vapoursynth/package.nix
index 88f341bfb699..f2b57cddf493 100644
--- a/pkgs/by-name/va/vapoursynth/package.nix
+++ b/pkgs/by-name/va/vapoursynth/package.nix
@@ -12,9 +12,7 @@
   zimg,
   libass,
   python3,
-  libiconv,
   testers,
-  ApplicationServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -33,24 +31,19 @@ stdenv.mkDerivation rec {
     autoreconfHook
     makeWrapper
   ];
-  buildInputs =
-    [
-      zimg
-      libass
-      (python3.withPackages (
-        ps: with ps; [
-          sphinx
-          cython
-        ]
-      ))
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libiconv
-      ApplicationServices
-    ];
+  buildInputs = [
+    zimg
+    libass
+    (python3.withPackages (
+      ps: with ps; [
+        sphinx
+        cython
+      ]
+    ))
+  ];
 
   enableParallelBuilding = true;
-  doInstallCheck = true;
+  doInstallCheck = !stdenv.hostPlatform.isDarwin;
 
   passthru = rec {
     # If vapoursynth is added to the build inputs of mpv and then
@@ -80,7 +73,7 @@ stdenv.mkDerivation rec {
     };
   };
 
-  postPatch = ''
+  postPatch = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     # Export weak symbol nixPluginDir to permit override of default plugin path
     sed -E -i \
       -e 's/(VS_PATH_PLUGINDIR)/(nixPluginDir ? nixPluginDir : \1)/g' \
@@ -110,11 +103,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.hostPlatform.isDarwin; # see https://github.com/NixOS/nixpkgs/pull/189446 for partial fix
     description = "Video processing framework with the future in mind";
     homepage = "http://www.vapoursynth.com/";
     license = licenses.lgpl21;
-    platforms = platforms.x86_64;
+    platforms = platforms.all;
     maintainers = with maintainers; [
       rnhmjoj
       sbruder
diff --git a/pkgs/by-name/va/vapoursynth/plugin-interface.nix b/pkgs/by-name/va/vapoursynth/plugin-interface.nix
index 2716c27225cf..a9abdd63abef 100644
--- a/pkgs/by-name/va/vapoursynth/plugin-interface.nix
+++ b/pkgs/by-name/va/vapoursynth/plugin-interface.nix
@@ -51,77 +51,85 @@ let
 
   ext = stdenv.hostPlatform.extensions.sharedLibrary;
 in
-runCommand "${vapoursynth.name}-with-plugins"
-  {
-    nativeBuildInputs = [ makeWrapper ];
-    passthru = {
-      inherit python3;
-      inherit (vapoursynth) src version;
-      withPlugins = plugins': withPlugins (plugins ++ plugins');
-    };
-  }
-  ''
-    mkdir -p \
-      $out/bin \
-      $out/lib/pkgconfig \
-      $out/lib/vapoursynth \
-      $out/${python3.sitePackages}
+if stdenv.hostPlatform.isDarwin then
+  vapoursynth.overrideAttrs (previousAttrs: {
+    pname = "vapoursynth-with-plugins";
+    configureFlags = (previousAttrs.configureFlags or [ ]) ++ [
+      "--with-plugindir=${pluginsEnv}/lib/vapoursynth"
+    ];
+  })
+else
+  runCommand "${vapoursynth.name}-with-plugins"
+    {
+      nativeBuildInputs = [ makeWrapper ];
+      passthru = {
+        inherit python3;
+        inherit (vapoursynth) src version;
+        withPlugins = plugins': withPlugins (plugins ++ plugins');
+      };
+    }
+    ''
+      mkdir -p \
+        $out/bin \
+        $out/lib/pkgconfig \
+        $out/lib/vapoursynth \
+        $out/${python3.sitePackages}
 
-    for textFile in \
-        lib/pkgconfig/vapoursynth{,-script}.pc \
-        lib/libvapoursynth.la \
-        lib/libvapoursynth-script.la \
-        ${python3.sitePackages}/vapoursynth.la
-    do
-        substitute ${vapoursynth}/$textFile $out/$textFile \
-            --replace "${vapoursynth}" "$out"
-    done
+      for textFile in \
+          lib/pkgconfig/vapoursynth{,-script}.pc \
+          lib/libvapoursynth.la \
+          lib/libvapoursynth-script.la \
+          ${python3.sitePackages}/vapoursynth.la
+      do
+          substitute ${vapoursynth}/$textFile $out/$textFile \
+              --replace "${vapoursynth}" "$out"
+      done
 
-    for binaryPlugin in ${pluginsEnv}/lib/vapoursynth/*; do
-        ln -s $binaryPlugin $out/''${binaryPlugin#"${pluginsEnv}/"}
-    done
+      for binaryPlugin in ${pluginsEnv}/lib/vapoursynth/*; do
+          ln -s $binaryPlugin $out/''${binaryPlugin#"${pluginsEnv}/"}
+      done
 
-    for pythonPlugin in ${pythonEnvironment}/${python3.sitePackages}/*; do
-        ln -s $pythonPlugin $out/''${pythonPlugin#"${pythonEnvironment}/"}
-    done
+      for pythonPlugin in ${pythonEnvironment}/${python3.sitePackages}/*; do
+          ln -s $pythonPlugin $out/''${pythonPlugin#"${pythonEnvironment}/"}
+      done
 
-    for binaryFile in \
-        lib/libvapoursynth${ext} \
-        lib/libvapoursynth-script${ext}.0.0.0
-    do
-      old_rpath=$(patchelf --print-rpath ${vapoursynth}/$binaryFile)
-      new_rpath="$old_rpath:$out/lib"
-      patchelf \
-          --set-rpath "$new_rpath" \
-          --output $out/$binaryFile \
-          ${vapoursynth}/$binaryFile
-      patchelf \
-          --add-needed libvapoursynth-nix-plugins${ext} \
-          $out/$binaryFile
-    done
-
-    for binaryFile in \
-        ${python3.sitePackages}/vapoursynth${ext} \
-        bin/.vspipe-wrapped
-    do
+      for binaryFile in \
+          lib/libvapoursynth${ext} \
+          lib/libvapoursynth-script${ext}.0.0.0
+      do
         old_rpath=$(patchelf --print-rpath ${vapoursynth}/$binaryFile)
-        new_rpath="''${old_rpath//"${vapoursynth}"/"$out"}"
+        new_rpath="$old_rpath:$out/lib"
         patchelf \
             --set-rpath "$new_rpath" \
             --output $out/$binaryFile \
             ${vapoursynth}/$binaryFile
-    done
+        patchelf \
+            --add-needed libvapoursynth-nix-plugins${ext} \
+            $out/$binaryFile
+      done
 
-    ln -s ${nixPlugins} $out/lib/libvapoursynth-nix-plugins${ext}
-    ln -s ${vapoursynth}/include $out/include
-    ln -s ${vapoursynth}/lib/vapoursynth/* $out/lib/vapoursynth
-    ln -s \
-        libvapoursynth-script${ext}.0.0.0 \
-        $out/lib/libvapoursynth-script${ext}
-    ln -s \
-        libvapoursynth-script${ext}.0.0.0 \
-        $out/lib/libvapoursynth-script${ext}.0
+      for binaryFile in \
+          ${python3.sitePackages}/vapoursynth${ext} \
+          bin/.vspipe-wrapped
+      do
+          old_rpath=$(patchelf --print-rpath ${vapoursynth}/$binaryFile)
+          new_rpath="''${old_rpath//"${vapoursynth}"/"$out"}"
+          patchelf \
+              --set-rpath "$new_rpath" \
+              --output $out/$binaryFile \
+              ${vapoursynth}/$binaryFile
+      done
 
-    makeWrapper $out/bin/.vspipe-wrapped $out/bin/vspipe \
-        --prefix PYTHONPATH : $out/${python3.sitePackages}
-  ''
+      ln -s ${nixPlugins} $out/lib/libvapoursynth-nix-plugins${ext}
+      ln -s ${vapoursynth}/include $out/include
+      ln -s ${vapoursynth}/lib/vapoursynth/* $out/lib/vapoursynth
+      ln -s \
+          libvapoursynth-script${ext}.0.0.0 \
+          $out/lib/libvapoursynth-script${ext}
+      ln -s \
+          libvapoursynth-script${ext}.0.0.0 \
+          $out/lib/libvapoursynth-script${ext}.0
+
+      makeWrapper $out/bin/.vspipe-wrapped $out/bin/vspipe \
+          --prefix PYTHONPATH : $out/${python3.sitePackages}
+    ''
diff --git a/pkgs/development/libraries/ogre/default.nix b/pkgs/development/libraries/ogre/default.nix
index 2a4007c3ce71..e24fdd9c12a5 100644
--- a/pkgs/development/libraries/ogre/default.nix
+++ b/pkgs/development/libraries/ogre/default.nix
@@ -112,9 +112,9 @@ let
 in
 {
   ogre_14 = common {
-    version = "14.3.1";
-    hash = "sha256-rr8tetBfFdZPVvN3fYRWltf8/e6oLcLL0uhHKWanuVA=";
-    # https://github.com/OGRECave/ogre/blob/v14.3.1/Components/Overlay/CMakeLists.txt
+    version = "14.3.2";
+    hash = "sha256-MOTEI0OyGVCH1CVK/pH51r9QkrGspLC3sBIROYHklyk=";
+    # https://github.com/OGRECave/ogre/blob/v14.3.2/Components/Overlay/CMakeLists.txt
     imguiVersion = "1.91.2";
     imguiHash = "sha256-B7XXQNuEPcT1ID5nMYbAV+aNCG9gIrC9J7BLnYB8yjI=";
   };
diff --git a/pkgs/development/php-packages/xdebug/default.nix b/pkgs/development/php-packages/xdebug/default.nix
index cd340771376e..1fa38229d7a1 100644
--- a/pkgs/development/php-packages/xdebug/default.nix
+++ b/pkgs/development/php-packages/xdebug/default.nix
@@ -1,7 +1,6 @@
 {
   buildPecl,
   lib,
-  php,
   fetchFromGitHub,
 }:
 
@@ -30,6 +29,5 @@ buildPecl {
     homepage = "https://xdebug.org/";
     license = lib.licenses.php301;
     maintainers = lib.teams.php.members;
-    broken = lib.versionAtLeast php.version "8.4";
   };
 }
diff --git a/pkgs/development/python-modules/fido2/default.nix b/pkgs/development/python-modules/fido2/default.nix
index 0dd47d31ed70..e72a8ae55fd8 100644
--- a/pkgs/development/python-modules/fido2/default.nix
+++ b/pkgs/development/python-modules/fido2/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "fido2";
-  version = "1.1.3";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JhAPIm0SztYhymGYUozhft9nt430KHruEoX+481aqfw=";
+    hash = "sha256-45+VkgEi1kKD/aXlWB2VogbnBPpChGv6RmL4aqDTMzs=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
index ac8e29c31132..c0d307c942d6 100644
--- a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datacatalog";
-  version = "3.21.0";
+  version = "3.23.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_datacatalog";
     inherit version;
-    hash = "sha256-JH3WW8v1VrTebNyEy7EDL9nvMaRf2gQTf6fnWbqMbCA=";
+    hash = "sha256-Rpx5+Mv+KTvJdposPJg+J/GNmHoj0I1jBp6YUOlcXmI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/graphrag/default.nix b/pkgs/development/python-modules/graphrag/default.nix
index 0bc8f6f59dc0..bad18d3388ef 100644
--- a/pkgs/development/python-modules/graphrag/default.nix
+++ b/pkgs/development/python-modules/graphrag/default.nix
@@ -29,6 +29,7 @@
   rich,
   tenacity,
   tiktoken,
+  typer,
   typing-extensions,
   umap-learn,
   nbformat,
@@ -38,14 +39,14 @@
 
 buildPythonPackage rec {
   pname = "graphrag";
-  version = "0.3.6";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "graphrag";
     rev = "refs/tags/v${version}";
-    hash = "sha256-H5ITK4m3l+rlIEYXoMIpsE9faCu6rRZuB5zaZQeArOU=";
+    hash = "sha256-QK6ZdBDSSKi/WUsDQeEY5JfxgsmW/vK7yDfjMseAO/k=";
   };
 
   build-system = [
@@ -81,6 +82,7 @@ buildPythonPackage rec {
     rich
     tenacity
     tiktoken
+    typer
     typing-extensions
     umap-learn
   ];
@@ -104,6 +106,7 @@ buildPythonPackage rec {
     "test_find"
     "test_run_extract_entities_multiple_documents"
     "test_run_extract_entities_single_document"
+    "test_sort_context"
     "test_sort_context_max_tokens"
   ];
 
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
index dae67d644021..517aeb8fa773 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
@@ -7,7 +7,6 @@
   pgvector,
   poetry-core,
   psycopg2,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -15,8 +14,6 @@ buildPythonPackage rec {
   version = "0.2.6";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchPypi {
     pname = "llama_index_vector_stores_postgres";
     inherit version;
@@ -25,6 +22,10 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [ "psycopg2-binary" ];
 
+  pythonRelaxDeps = [
+    "pgvector"
+  ];
+
   build-system = [
     poetry-core
   ];
@@ -38,10 +39,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "llama_index.vector_stores.postgres" ];
 
-  meta = with lib; {
+  meta = {
     description = "LlamaIndex Vector Store Integration for Postgres";
     homepage = "https://github.com/run-llama/llama_index/tree/main/llama-index-integrations/vector_stores/llama-index-vector-stores-postgres";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/nanobind/default.nix b/pkgs/development/python-modules/nanobind/default.nix
index 76f2e9a58d76..3d2005a1c6aa 100644
--- a/pkgs/development/python-modules/nanobind/default.nix
+++ b/pkgs/development/python-modules/nanobind/default.nix
@@ -27,14 +27,14 @@
 }:
 buildPythonPackage rec {
   pname = "nanobind";
-  version = "2.1.0";
+  version = "2.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wjakob";
     repo = "nanobind";
     rev = "refs/tags/v${version}";
-    hash = "sha256-AO/EHx2TlXidalhPb+xuUchaek4ki7fDExu2foBgUp0=";
+    hash = "sha256-HtZfpMVz/7VMVrFg48IkitK6P3tA+swOeaLLiKguXXk=";
     fetchSubmodules = true;
   };
 
@@ -59,6 +59,13 @@ buildPythonPackage rec {
   dontUseCmakeBuildDir = true;
 
   preCheck = ''
+    # TODO: added 2.2.0, re-enable on next bump
+    # https://github.com/wjakob/nanobind/issues/754
+    # "generated stubs do not match their references"
+    # > -import tensorflow.python.framework.ops
+    # > +import tensorflow
+    rm tests/test_ndarray_ext.pyi.ref
+
     # build tests
     make -j $NIX_BUILD_CORES
   '';
diff --git a/pkgs/development/python-modules/pgvector/default.nix b/pkgs/development/python-modules/pgvector/default.nix
index 208165e65fbc..bb55a3dd5b06 100644
--- a/pkgs/development/python-modules/pgvector/default.nix
+++ b/pkgs/development/python-modules/pgvector/default.nix
@@ -1,10 +1,17 @@
 {
   lib,
-  asyncpg,
   buildPythonPackage,
-  django,
   fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   numpy,
+
+  # tests
+  asyncpg,
+  django,
   peewee,
   postgresql,
   postgresqlTestHook,
@@ -12,37 +19,38 @@
   psycopg2,
   pytest-asyncio,
   pytestCheckHook,
-  pythonOlder,
+  scipy,
   sqlalchemy,
   sqlmodel,
 }:
 
 buildPythonPackage rec {
   pname = "pgvector";
-  version = "0.2.4";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.8";
+  version = "0.3.6";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pgvector";
     repo = "pgvector-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XKoaEwLW59pV4Dwis7p2L65XoO2zUEa1kXxz6Lgs2d8=";
+    hash = "sha256-ho0UgamZxsN+pv7QkpsDnN7f+I+SrexA2gVtmJF8/3Q=";
   };
 
-  propagatedBuildInputs = [ numpy ];
+  build-system = [ setuptools ];
+
+  dependencies = [ numpy ];
 
   nativeCheckInputs = [
     asyncpg
     django
     peewee
-    (postgresql.withPackages (p: with p; [ pgvector ]))
-    postgresqlTestHook
     psycopg
     psycopg2
+    (postgresql.withPackages (p: with p; [ pgvector ]))
+    postgresqlTestHook
     pytest-asyncio
     pytestCheckHook
+    scipy
     sqlalchemy
     sqlmodel
   ];
@@ -55,11 +63,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pgvector" ];
 
-  meta = with lib; {
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
     description = "Pgvector support for Python";
     homepage = "https://github.com/pgvector/pgvector-python";
     changelog = "https://github.com/pgvector/pgvector-python/blob/${src.rev}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ natsukium ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ natsukium ];
   };
 }
diff --git a/pkgs/development/python-modules/pytest-codspeed/default.nix b/pkgs/development/python-modules/pytest-codspeed/default.nix
index f8c88f44065f..edf811929e82 100644
--- a/pkgs/development/python-modules/pytest-codspeed/default.nix
+++ b/pkgs/development/python-modules/pytest-codspeed/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage rec {
 
   build-system = [ hatchling ];
 
-  buildInput = [ pytest ];
+  buildInputs = [ pytest ];
 
   dependencies = [
     cffi
diff --git a/pkgs/development/python-modules/python-socketio/default.nix b/pkgs/development/python-modules/python-socketio/default.nix
index c59201a466cd..0d05971cd2bb 100644
--- a/pkgs/development/python-modules/python-socketio/default.nix
+++ b/pkgs/development/python-modules/python-socketio/default.nix
@@ -1,8 +1,8 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
 
   # build-system
   setuptools,
@@ -29,8 +29,6 @@ buildPythonPackage rec {
   version = "5.11.4";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
-
   src = fetchFromGitHub {
     owner = "miguelgrinberg";
     repo = "python-socketio";
@@ -38,9 +36,9 @@ buildPythonPackage rec {
     hash = "sha256-iWe9IwUR+nq9SAmHzFZYUJpVOOEbc1ZdiMAjaBjQrVs=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bidict
     python-engineio
   ];
@@ -62,7 +60,15 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "socketio" ];
 
-  meta = with lib; {
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Use fixed ports which leads to failures when building concurrently
+    "tests/async/test_admin.py"
+    "tests/common/test_admin.py"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
     description = "Python Socket.IO server and client";
     longDescription = ''
       Socket.IO is a lightweight transport protocol that enables real-time
@@ -70,7 +76,7 @@ buildPythonPackage rec {
     '';
     homepage = "https://github.com/miguelgrinberg/python-socketio/";
     changelog = "https://github.com/miguelgrinberg/python-socketio/blob/v${version}/CHANGES.md";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ mic92 ];
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ mic92 ];
   };
 }
diff --git a/pkgs/development/python-modules/txtai/default.nix b/pkgs/development/python-modules/txtai/default.nix
index 75b50c223a19..2e64c77f1fcb 100644
--- a/pkgs/development/python-modules/txtai/default.nix
+++ b/pkgs/development/python-modules/txtai/default.nix
@@ -1,10 +1,12 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
+
+  # build-system
   setuptools,
-  # propagated build input
+
+  # dependencies
   faiss,
   torch,
   transformers,
@@ -12,61 +14,80 @@
   numpy,
   pyyaml,
   regex,
+
   # optional-dependencies
+  # ann
+  annoy,
+  hnswlib,
+  pgvector,
+  sqlalchemy,
+  sqlite-vec,
+  # api
   aiohttp,
   fastapi,
-  uvicorn,
-  # TODO add apache-libcloud
-  # , apache-libcloud
-  rich,
-  duckdb,
   pillow,
+  python-multipart,
+  uvicorn,
+  # cloud
+  # apache-libcloud, (unpackaged)
+  # console
+  rich,
+  # database
+  duckdb,
+  # graph
+  # grand-cypher (unpackaged)
+  # grand-graph (unpackaged)
   networkx,
   python-louvain,
+  # model
   onnx,
   onnxruntime,
+  # pipeline-audio
+  # model2vec,
+  sounddevice,
   soundfile,
   scipy,
   ttstokenizer,
+  webrtcvad,
+  # pipeline-data
   beautifulsoup4,
   nltk,
   pandas,
   tika,
+  # pipeline-image
   imagehash,
   timm,
+  # pipeline-llm
+  litellm,
+  # llama-cpp-python, (unpackaged)
+  # pipeline-text
   fasttext,
   sentencepiece,
+  # pipeline-train
   accelerate,
+  bitsandbytes,
   onnxmltools,
-  annoy,
-  hnswlib,
-  # TODO add pymagnitude-lite
-  #, pymagnitude-lite
+  peft,
+  skl2onnx,
+  # vectors
+  # pymagnitude-lite, (unpackaged)
   scikit-learn,
   sentence-transformers,
+  skops,
+  # workflow
+  # apache-libcloud (unpackaged)
   croniter,
   openpyxl,
   requests,
   xmltodict,
-  pgvector,
-  sqlite-vec,
-  python-multipart,
-  # native check inputs
-  pytestCheckHook,
-  # check inputs
+
+  # tests
   httpx,
   msgpack,
-  sqlalchemy,
+  pytestCheckHook,
 }:
 let
-  version = "7.4.0";
-  api = [
-    aiohttp
-    fastapi
-    pillow
-    python-multipart
-    uvicorn
-  ];
+  version = "8.0.0";
   ann = [
     annoy
     hnswlib
@@ -74,30 +95,39 @@ let
     sqlalchemy
     sqlite-vec
   ];
+  api = [
+    aiohttp
+    fastapi
+    pillow
+    python-multipart
+    uvicorn
+  ];
   # cloud = [ apache-libcloud ];
   console = [ rich ];
-
   database = [
     duckdb
     pillow
+    sqlalchemy
   ];
-
   graph = [
+    # grand-cypher
+    # grand-graph
     networkx
     python-louvain
+    sqlalchemy
   ];
-
   model = [
     onnx
     onnxruntime
   ];
-
   pipeline-audio = [
     onnx
     onnxruntime
-    soundfile
     scipy
+    sounddevice
+    soundfile
     ttstokenizer
+    webrtcvad
   ];
   pipeline-data = [
     beautifulsoup4
@@ -110,25 +140,40 @@ let
     pillow
     timm
   ];
+  pipeline-llm = [
+    litellm
+    # llama-cpp-python
+  ];
   pipeline-text = [
     fasttext
     sentencepiece
   ];
   pipeline-train = [
     accelerate
+    bitsandbytes
     onnx
     onnxmltools
     onnxruntime
+    peft
+    skl2onnx
   ];
-  pipeline = pipeline-audio ++ pipeline-data ++ pipeline-image ++ pipeline-text ++ pipeline-train;
-
-  similarity = [
-    annoy
+  pipeline =
+    pipeline-audio
+    ++ pipeline-data
+    ++ pipeline-image
+    ++ pipeline-llm
+    ++ pipeline-text
+    ++ pipeline-train;
+  scoring = [ sqlalchemy ];
+  vectors = [
     fasttext
-    hnswlib
+    litellm
+    # llama-cpp-python
+    # model2vec
     # pymagnitude-lite
     scikit-learn
     sentence-transformers
+    skops
   ];
   workflow = [
     # apache-libcloud
@@ -139,7 +184,18 @@ let
     requests
     xmltodict
   ];
-  all = api ++ ann ++ console ++ database ++ graph ++ model ++ pipeline ++ similarity ++ workflow;
+  similarity = ann ++ vectors;
+  all =
+    api
+    ++ ann
+    ++ console
+    ++ database
+    ++ graph
+    ++ model
+    ++ pipeline
+    ++ scoring
+    ++ similarity
+    ++ workflow;
 
   optional-dependencies = {
     inherit
@@ -151,9 +207,11 @@ let
       model
       pipeline-audio
       pipeline-image
+      pipeline-llm
       pipeline-text
       pipeline-train
       pipeline
+      scoring
       similarity
       workflow
       all
@@ -165,17 +223,14 @@ buildPythonPackage {
   inherit version;
   pyproject = true;
 
-
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "neuml";
     repo = "txtai";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DQB12mFUMsKJ8cACowI1Vc7k2n1npdTOQknRmHd5EIM=";
+    hash = "sha256-qhbtKZo0C4OcXdKBGBJhfBMmY0DzbEx6n7d4y4MenN0=";
   };
 
-  buildTools = [ setuptools ];
+  build-system = [ setuptools ];
 
   pythonRemoveDeps = [
     # We call it faiss, not faiss-cpu.
@@ -184,12 +239,13 @@ buildPythonPackage {
 
   dependencies = [
     faiss
-    torch
-    transformers
     huggingface-hub
+    msgpack
     numpy
     pyyaml
     regex
+    torch
+    transformers
   ];
 
   optional-dependencies = optional-dependencies;
@@ -203,21 +259,19 @@ buildPythonPackage {
   pythonImportsCheck = [ "txtai" ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-  ] ++ optional-dependencies.ann ++ optional-dependencies.api ++ optional-dependencies.similarity;
-
-  checkInputs = [
     httpx
     msgpack
+    pytestCheckHook
     python-multipart
     sqlalchemy
-  ];
+  ] ++ optional-dependencies.ann ++ optional-dependencies.api ++ optional-dependencies.similarity;
 
   # The deselected paths depend on the huggingface hub and should be run as a passthru test
   # disabledTestPaths won't work as the problem is with the classes containing the tests
   # (in other words, it fails on __init__)
   pytestFlagsArray = [
     "test/python/test*.py"
+    "--deselect=test/python/testagent.py"
     "--deselect=test/python/testcloud.py"
     "--deselect=test/python/testconsole.py"
     "--deselect=test/python/testembeddings.py"
diff --git a/pkgs/development/tools/ocaml/melange/default.nix b/pkgs/development/tools/ocaml/melange/default.nix
new file mode 100644
index 000000000000..c81ca2a6cf56
--- /dev/null
+++ b/pkgs/development/tools/ocaml/melange/default.nix
@@ -0,0 +1,83 @@
+{
+  buildDunePackage,
+  cmdliner,
+  cppo,
+  dune-build-info,
+  fetchurl,
+  jq,
+  lib,
+  makeWrapper,
+  menhirLib,
+  merlin,
+  nodejs,
+  ocaml,
+  ounit2,
+  ppxlib,
+  reason,
+  stdenv,
+  tree,
+}:
+
+let
+  pname = "melange";
+  versionHash =
+    if lib.versionAtLeast ocaml.version "5.2" then
+      {
+        version = "4.0.1-52";
+        hash = "sha256-kUlChqQtLX7zh90GK23ibMqyI/MIp0sMYLjkPX9vdTc=";
+      }
+    else if lib.versionAtLeast ocaml.version "5.1" then
+      {
+        version = "4.0.0-51";
+        hash = "sha256-940Yzp1ZXnN6mKVWY+nqKjn4qtBUJR5eHE55OTjGvdU=";
+      }
+    else
+      {
+        version = "4.0.0-414";
+        hash = "sha256-PILDOXYIyLvfv1sSwP6WSdCiXfpYdnct7WMw3jHBLJM=";
+      };
+  version = versionHash.version;
+  hash = versionHash.hash;
+in
+buildDunePackage {
+  inherit pname;
+  inherit version;
+  minimalOCamlVersion = "4.14";
+  src = fetchurl {
+    url = "https://github.com/melange-re/${pname}/releases/download/${version}/${pname}-${version}.tbz";
+    inherit hash;
+  };
+  nativeBuildInputs = [
+    cppo
+    makeWrapper
+  ];
+  propagatedBuildInputs = [
+    cmdliner
+    dune-build-info
+    menhirLib
+    ppxlib
+  ];
+  doCheck = true;
+  nativeCheckInputs = [
+    jq
+    merlin
+    nodejs
+    reason
+    tree
+  ];
+  checkInputs = [
+    ounit2
+  ];
+  postInstall = ''
+    wrapProgram "$out/bin/melc" --set MELANGELIB "$OCAMLFIND_DESTDIR/melange/melange:$OCAMLFIND_DESTDIR/melange/js/melange"
+  '';
+  meta = {
+    description = "Toolchain to produce JS from Reason/OCaml";
+    homepage = "https://melange.re/";
+    mainProgram = "melc";
+    license = lib.licenses.lgpl3;
+    maintainers = [
+      lib.maintainers.vog
+    ];
+  };
+}
diff --git a/pkgs/tools/misc/depotdownloader/default.nix b/pkgs/tools/misc/depotdownloader/default.nix
index b7c3e1414be9..4c5874e84445 100644
--- a/pkgs/tools/misc/depotdownloader/default.nix
+++ b/pkgs/tools/misc/depotdownloader/default.nix
@@ -6,19 +6,19 @@
 
 buildDotnetModule rec {
   pname = "depotdownloader";
-  version = "2.7.3";
+  version = "2.7.4";
 
   src = fetchFromGitHub {
     owner = "SteamRE";
     repo = "DepotDownloader";
     rev = "DepotDownloader_${version}";
-    sha256 = "TKPUE9PzTUoYmhT1O+Qvb0lukPY6fGs70wSiCdEJUMQ=";
+    hash = "sha256-XcUWNr3l1Bsl8SRYm8OS7t2JYppfKJVrVWyM5OILFDA=";
   };
 
   projectFile = "DepotDownloader.sln";
   nugetDeps = ./deps.nix;
-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = dotnetCorePackages.runtime_9_0;
 
   passthru.updateScript = ./update.sh;
 
diff --git a/pkgs/tools/misc/depotdownloader/deps.nix b/pkgs/tools/misc/depotdownloader/deps.nix
index 998c6a8b5563..a3ebb00b4044 100644
--- a/pkgs/tools/misc/depotdownloader/deps.nix
+++ b/pkgs/tools/misc/depotdownloader/deps.nix
@@ -8,10 +8,10 @@
   (fetchNuGet { pname = "Microsoft.Windows.SDK.Win32Docs"; version = "0.1.42-alpha"; hash = "sha256-6DvzmNzrGVfWmNJNqooj+Ya+7bAQlyeg7pmyKaUlIws="; })
   (fetchNuGet { pname = "Microsoft.Windows.SDK.Win32Metadata"; version = "60.0.34-preview"; hash = "sha256-KdRe73sXipzMvm2BLmwwBZGh+l9isZDC9l8WFyUR1zM="; })
   (fetchNuGet { pname = "Microsoft.Windows.WDK.Win32Metadata"; version = "0.11.4-experimental"; hash = "sha256-b3oKUKbr+3Udfl7RWzUY9BR/XWNsN+VmEkBxk6KiFo0="; })
-  (fetchNuGet { pname = "protobuf-net"; version = "3.2.30"; hash = "sha256-keRy5OWT+/tlZt3D7x+9PEdjTvEJcZdYsf/i1ZBtciE="; })
-  (fetchNuGet { pname = "protobuf-net.Core"; version = "3.2.30"; hash = "sha256-GMpJNecoBfrV2VgpYOhcZnKZaLFDObNLcX2LBTThrwY="; })
+  (fetchNuGet { pname = "protobuf-net"; version = "3.2.45"; hash = "sha256-rWitxe3uP3SOyoG1fwM5n00RpR5IL1V6u1zXMI0p0JA="; })
+  (fetchNuGet { pname = "protobuf-net.Core"; version = "3.2.45"; hash = "sha256-bsMGUmd0yno8g0H0637jJboKJwyyHLHoHg45+bt9pLQ="; })
   (fetchNuGet { pname = "QRCoder"; version = "1.6.0"; hash = "sha256-2Ev/6d7PH6K4dVYQQHlZ+ZggkCnDtrlaGygs65mDo28="; })
-  (fetchNuGet { pname = "SteamKit2"; version = "3.0.0-beta.4"; hash = "sha256-7cXlpCuUD8ZuTMtqsT5MdklkZb+XIGBdoI28anjUXtg="; })
+  (fetchNuGet { pname = "SteamKit2"; version = "3.0.0"; hash = "sha256-bRRdX8WFo9k+QCZWh0KHb3TULpJxpR4Hg9FDXKBW6d4="; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "7.0.0"; hash = "sha256-9an2wbxue2qrtugYES9awshQg+KfJqajhnhs45kQIdk="; })
   (fetchNuGet { pname = "System.IO.Hashing"; version = "8.0.0"; hash = "sha256-szOGt0TNBo6dEdC3gf6H+e9YW3Nw0woa6UnCGGGK5cE="; })
   (fetchNuGet { pname = "System.Security.AccessControl"; version = "5.0.0"; hash = "sha256-ueSG+Yn82evxyGBnE49N4D+ngODDXgornlBtQ3Omw54="; })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7e806f98b32b..1ff9fa0fee89 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -744,6 +744,10 @@ with pkgs;
     propagatedBuildInputs = [ dieHook ];
   } ../build-support/setup-hooks/shorten-perl-shebang.sh;
 
+  sile = callPackage ../by-name/si/sile/package.nix {
+    lua = luajit;
+  };
+
   singularity-tools = callPackage ../build-support/singularity-tools { };
 
   srcOnly = callPackage ../build-support/src-only { };
@@ -9033,10 +9037,6 @@ with pkgs;
 
   eigen2 = callPackage ../development/libraries/eigen/2.0.nix { };
 
-  vapoursynth = callPackage ../by-name/va/vapoursynth/package.nix {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
-  };
-
   vapoursynth-editor = libsForQt5.callPackage ../by-name/va/vapoursynth/editor.nix { };
 
   vmmlib = callPackage ../development/libraries/vmmlib {
@@ -13433,13 +13433,6 @@ with pkgs;
     gtk = gtk3;
   };
 
-  bluej = callPackage ../applications/editors/bluej {
-    openjdk = openjdk17.override {
-      enableJavaFX = true;
-      openjfx_jdk = openjfx17.override { withWebKit = true; };
-    };
-  };
-
   bluejeans-gui = callPackage ../applications/networking/instant-messengers/bluejeans { };
 
   breezy = with python3Packages; toPythonApplication breezy;
@@ -15001,11 +14994,7 @@ with pkgs;
       speechdSupport = config.mumble.speechdSupport or false;
     }).mumble;
 
-  mumble_overlay = callPackage ../applications/networking/mumble/overlay.nix {
-    mumble_i686 = if stdenv.hostPlatform.system == "x86_64-linux"
-      then pkgsi686Linux.mumble
-      else null;
-  };
+  mumble_overlay = (callPackages ../applications/networking/mumble {}).overlay;
 
   mup = callPackage ../applications/audio/mup {
     autoreconfHook = buildPackages.autoreconfHook269;
@@ -15171,8 +15160,6 @@ with pkgs;
 
   omegat = callPackage ../applications/misc/omegat.nix { };
 
-  inherit (callPackage ../applications/networking/onionshare { }) onionshare onionshare-gui;
-
   openambit = qt5.callPackage ../applications/misc/openambit { };
 
   openbox-menu = callPackage ../applications/misc/openbox-menu {
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 6f244496f514..35cb14aff535 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1070,6 +1070,8 @@ let
 
     mec = callPackage ../development/ocaml-modules/mec { };
 
+    melange = callPackage ../development/tools/ocaml/melange { };
+
     memprof-limits = callPackage ../development/ocaml-modules/memprof-limits { };
 
     memtrace = callPackage ../development/ocaml-modules/memtrace { };