diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index a2c69ba6bd14..35330305f189 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -1538,6 +1538,16 @@ Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Execut
 Static libraries need to be compiled with `-fPIE` so that executables can link them in with the `-pie` linker option.
 If the libraries lack `-fPIE`, you will get the error `recompile with -fPIE`.
 
+#### `shadowstack` {#shadowstack}
+
+Adds the `-fcf-protection=return` compiler option. This enables the Shadow Stack feature supported by some newer processors, which maintains a user-inaccessible copy of the program's stack containing only return-addresses. When returning from a function, the processor compares the return-address value on the two stacks and throws an error if they do not match, considering it a sign of corruption and possible tampering. This should significantly increase the difficulty of ROP attacks.
+
+For the Shadow Stack to be enabled at runtime, all code linked into a process must be built with Shadow Stack enabled, so this is probably only useful to enable on a wide scale, so that all of a packages dependencies also have the feature enabled.
+
+This is currently only supported on some newer Intel and AMD processors as part of the Intel CET set of features. However, the generated code should continue to work on older processors which will simply omit any of this checking.
+
+This breaks some code that does advanced stack management or exception handling. If enabling this hardening flag it is important to test the result on a system that has known working and enabled CET support, so that any such breakage can be discovered.
+
 #### `trivialautovarinit` {#trivialautovarinit}
 
 Adds the `-ftrivial-auto-var-init=pattern` compiler option. This causes "trivially-initializable" uninitialized stack variables to be forcibly initialized with a nonzero value that is likely to cause a crash (and therefore be noticed). Uninitialized variables generally take on their values based on fragments of previous program state, and attackers can carefully manipulate that state to craft malicious initial values for these variables.
@@ -1554,6 +1564,14 @@ sorry, unimplemented: __builtin_clear_padding not supported for variable length
 
 This flag adds the `-fstack-clash-protection` compiler option, which causes growth of a program's stack to access each successive page in order. This should force the guard page to be accessed and cause an attempt to "jump over" this guard page to crash.
 
+#### `pacret` {#pacret}
+
+This flag adds the `-mbranch-protection=pac-ret` compiler option on aarch64-linux targets. This uses ARM v8.3's Pointer Authentication feature to sign function return pointers before adding them to the stack. The pointer's authenticity is then validated before returning to its destination. This dramatically increases the difficulty of ROP exploitation techniques.
+
+This may cause problems with code that does advanced stack manipulation, and debugging/stack-unwinding tools need to be pac-ret aware to work correctly when these features are in operation.
+
+Pre-ARM v8.3 processors will ignore Pointer Authentication instructions, so code built with this flag will continue to work on older processors, though without any of the intended protections. If enabling this flag, it is recommended to ensure the resultant packages are tested against an ARM v8.3+ linux system with known-working Pointer Authentication support so that any breakage caused by this feature is actually detected.
+
 [^footnote-stdenv-ignored-build-platform]: The build platform is ignored because it is a mere implementation detail of the package satisfying the dependency: As a general programming principle, dependencies are always *specified* as interfaces, not concrete implementation.
 [^footnote-stdenv-native-dependencies-in-path]: Currently, this means for native builds all dependencies are put on the `PATH`. But in the future that may not be the case for sake of matching cross: the platforms would be assumed to be unique for native and cross builds alike, so only the `depsBuild*` and `nativeBuildInputs` would be added to the `PATH`.
 [^footnote-stdenv-propagated-dependencies]: Nix itself already takes a package’s transitive dependencies into account, but this propagation ensures nixpkgs-specific infrastructure like [setup hooks](#ssec-setup-hooks) also are run as if it were a propagated dependency.
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 82d27449c915..84dcdd0e6b84 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -10,6 +10,8 @@
   This also allows configuring runtime settings of AMDVLK and enabling experimental features.
 - The `moonlight-qt` package ([Moonlight game streaming](https://moonlight-stream.org/)) now has HDR support on Linux systems.
 
+- PostgreSQL now defaults to major version 16.
+
 - `authelia` has been upgraded to version 4.38. This version brings several features and improvements which are detailed in the [release blog post](https://www.authelia.com/blog/4.38-release-notes/).
   This release also deprecates some configuration keys, which are likely to be removed in future version 5.0, but they are still supported and expected to be working in the current version.
 
@@ -288,6 +290,8 @@
 
 - The `stackclashprotection` hardening flag has been added, though disabled by default.
 
+- The `pacret` hardening flag has been added, though disabled by default.
+
 - `cargoSha256` in `rustPlatform.buildRustPackage` has been deprecated in favor
   of `cargoHash` which supports SRI hashes. See
   [buildRustPackage: Compiling Rust applications with Cargo](https://nixos.org/manual/nixpkgs/unstable/#compiling-rust-applications-with-cargo)
@@ -307,6 +311,9 @@
   The derivation now installs "impl" headers selectively instead of by a wildcard.
   Use `imgui.src` if you just want to access the unpacked sources.
 
+- Unprivileged access to the kernel syslog via `dmesg` is now restricted by default. Users wanting to keep an
+  unrestricted access to it can set `boot.kernel.sysctl."kernel.dmesg_restrict" = false`.
+
 - The `i18n.inputMethod` module introduces two new properties:
   `enable` and `type`, for declaring whether to enable an alternative input method and defining which input method respectfully. The options available in `type` are the same as the existing `enabled` option. `enabled` is now deprecated, and will be removed in a future release.
 
@@ -322,6 +329,8 @@
   - Nemo is now built with gtk-layer-shell support, note that for now it will be expected to see nemo-desktop
     listed as a regular entry in Cinnamon Wayland session's window list applet.
 
+- The `shadowstack` hardening flag has been added, though disabled by default.
+
 - `restic` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.restic.backups.<name>.inhibitsSleep`](#opt-services.restic.backups._name_.inhibitsSleep).
 
 - Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 8a9d8c210b34..55b3dd282ec4 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -483,7 +483,8 @@ in
 
     services.postgresql.package = let
         mkThrow = ver: throw "postgresql_${ver} was removed, please upgrade your postgresql version.";
-        base = if versionAtLeast config.system.stateVersion "23.11" then pkgs.postgresql_15
+        base = if versionAtLeast config.system.stateVersion "24.11" then pkgs.postgresql_16
+            else if versionAtLeast config.system.stateVersion "23.11" then pkgs.postgresql_15
             else if versionAtLeast config.system.stateVersion "22.05" then pkgs.postgresql_14
             else if versionAtLeast config.system.stateVersion "21.11" then pkgs.postgresql_13
             else if versionAtLeast config.system.stateVersion "20.03" then mkThrow "11"
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index a9f42900addd..3986a06bf3f0 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -244,18 +244,31 @@ rec {
     testScript = ''
       machine.succeed("mount -o remount,rw /boot")
 
-      # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
-      machine.succeed(
-          """
-        find /boot -iname '*boot*.efi' -print0 | \
-        xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot 000.0-1-notnixos ####/' '{}'
-      """
-      )
+      def switch():
+          # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
+          machine.succeed(
+            """
+            find /boot -iname '*boot*.efi' -print0 | \
+            xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot 000.0-1-notnixos ####/' '{}'
+            """
+          )
+          return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")
 
-      output = machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")
+      output = switch()
       assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
       assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
       assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
+
+      with subtest("Test that updating works with lowercase bootx64.efi"):
+          machine.succeed(
+              # Move to tmp file name first, otherwise mv complains the new location is the same
+              "mv /boot/EFI/BOOT/BOOTX64.EFI /boot/EFI/BOOT/bootx64.efi.new",
+              "mv /boot/EFI/BOOT/bootx64.efi.new /boot/EFI/BOOT/bootx64.efi",
+          )
+          output = switch()
+          assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+          assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
+          assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
     '';
   };
 
diff --git a/pkgs/applications/editors/emacs/build-support/elpa.nix b/pkgs/applications/editors/emacs/build-support/elpa.nix
index 6dd0c7f167c9..7ac8d673346a 100644
--- a/pkgs/applications/editors/emacs/build-support/elpa.nix
+++ b/pkgs/applications/editors/emacs/build-support/elpa.nix
@@ -1,10 +1,10 @@
 # builder for Emacs packages built for packages.el
 
-{ lib, stdenv, emacs, texinfo, writeText, gcc }:
+{ lib, stdenv, emacs, texinfo, writeText }:
 
 let
   handledArgs = [ "meta" ];
-  genericBuild = import ./generic.nix { inherit lib stdenv emacs texinfo writeText gcc; };
+  genericBuild = import ./generic.nix { inherit lib stdenv emacs texinfo writeText; };
 
 in
 
diff --git a/pkgs/applications/editors/emacs/build-support/generic.nix b/pkgs/applications/editors/emacs/build-support/generic.nix
index 727b1f03cae4..3b3298cd1468 100644
--- a/pkgs/applications/editors/emacs/build-support/generic.nix
+++ b/pkgs/applications/editors/emacs/build-support/generic.nix
@@ -1,11 +1,11 @@
 # generic builder for Emacs packages
 
-{ lib, stdenv, emacs, texinfo, writeText, gcc, ... }:
+{ lib, stdenv, emacs, texinfo, writeText, ... }:
 
 let
-  inherit (lib) optionalAttrs getLib;
-  handledArgs = [ "buildInputs" "packageRequires" "propagatedUserEnvPkgs" "meta" ]
-    ++ lib.optionals (emacs.withNativeCompilation or false) [ "nativeBuildInputs" "postInstall" ];
+  inherit (lib) optionalAttrs;
+  handledArgs = [ "buildInputs" "nativeBuildInputs" "packageRequires" "propagatedUserEnvPkgs" "meta" ]
+    ++ lib.optionals (emacs.withNativeCompilation or false) [ "postInstall" ];
 
   setupHook = writeText "setup-hook.sh" ''
     source ${./emacs-funcs.sh}
@@ -55,7 +55,8 @@ stdenv.mkDerivation (finalAttrs: ({
     esac
   '';
 
-  buildInputs = [emacs texinfo] ++ packageRequires ++ buildInputs;
+  buildInputs = packageRequires ++ buildInputs;
+  nativeBuildInputs = [ emacs texinfo ] ++ nativeBuildInputs;
   propagatedBuildInputs = packageRequires;
   propagatedUserEnvPkgs = packageRequires ++ propagatedUserEnvPkgs;
 
@@ -73,10 +74,6 @@ stdenv.mkDerivation (finalAttrs: ({
 
 // optionalAttrs (emacs.withNativeCompilation or false) {
 
-  LIBRARY_PATH = "${getLib stdenv.cc.libc}/lib";
-
-  nativeBuildInputs = [ gcc ] ++ nativeBuildInputs;
-
   addEmacsNativeLoadPath = true;
 
   inherit turnCompilationWarningToError ignoreCompilationError;
diff --git a/pkgs/applications/editors/emacs/build-support/melpa.nix b/pkgs/applications/editors/emacs/build-support/melpa.nix
index 6249f4e7f186..20f7e79eb683 100644
--- a/pkgs/applications/editors/emacs/build-support/melpa.nix
+++ b/pkgs/applications/editors/emacs/build-support/melpa.nix
@@ -1,11 +1,11 @@
 # builder for Emacs packages built for packages.el
 # using MELPA package-build.el
 
-{ lib, stdenv, fetchFromGitHub, emacs, texinfo, writeText, gcc }:
+{ lib, stdenv, fetchFromGitHub, emacs, texinfo, writeText }:
 
 let
   handledArgs = [ "meta" "preUnpack" "postUnpack" ];
-  genericBuild = import ./generic.nix { inherit lib stdenv emacs texinfo writeText gcc; };
+  genericBuild = import ./generic.nix { inherit lib stdenv emacs texinfo writeText; };
 
   packageBuild = stdenv.mkDerivation {
     name = "package-build";
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper.nix b/pkgs/applications/editors/emacs/build-support/wrapper.nix
index 59a694286d09..5b325f5e0a9e 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper.nix
@@ -32,7 +32,7 @@ in customEmacsPackages.withPackages (epkgs: [ epkgs.evil epkgs.magit ])
 
 */
 
-{ lib, lndir, makeBinaryWrapper, runCommand, gcc }:
+{ lib, lndir, makeBinaryWrapper, runCommand }:
 self:
 let
   inherit (self) emacs;
@@ -60,7 +60,6 @@ runCommand
     deps = runCommand "emacs-packages-deps"
       ({
         inherit explicitRequires lndir emacs;
-        nativeBuildInputs = lib.optional withNativeCompilation gcc;
       } // lib.optionalAttrs withNativeCompilation {
         inherit (emacs) LIBRARY_PATH;
       })
diff --git a/pkgs/applications/graphics/darktable/default.nix b/pkgs/applications/graphics/darktable/default.nix
index 4d4f00497686..0d19158f4476 100644
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@@ -53,8 +53,6 @@
 , libaom
 , portmidi
 , lua
-, dav1d
-, libyuv
 }:
 
 stdenv.mkDerivation rec {
@@ -108,8 +106,6 @@ stdenv.mkDerivation rec {
     libaom
     portmidi
     lua
-    dav1d
-    libyuv
   ] ++ lib.optionals stdenv.isLinux [
     colord
     colord-gtk
diff --git a/pkgs/applications/networking/browsers/w3m/default.nix b/pkgs/applications/networking/browsers/w3m/default.nix
index acfd83f56086..827202ae3818 100644
--- a/pkgs/applications/networking/browsers/w3m/default.nix
+++ b/pkgs/applications/networking/browsers/w3m/default.nix
@@ -5,7 +5,7 @@
 , x11Support ? graphicsSupport, libX11
 , mouseSupport ? !stdenv.isDarwin, gpm-ncurses
 , perl, man, pkg-config, buildPackages, w3m
-, testers
+, testers, updateAutotoolsGnuConfigScriptsHook
 }:
 
 let
@@ -53,7 +53,9 @@ in stdenv.mkDerivation rec {
     sed -ie 's!mktable.*:.*!mktable:!' Makefile.in
   '';
 
-  nativeBuildInputs = [ pkg-config gettext ];
+  # updateAutotoolsGnuConfigScriptsHook necessary to build on FreeBSD native pending inclusion of
+  # https://git.savannah.gnu.org/cgit/config.git/commit/?id=e4786449e1c26716e3f9ea182caf472e4dbc96e0
+  nativeBuildInputs = [ pkg-config gettext updateAutotoolsGnuConfigScriptsHook ];
   buildInputs = [ ncurses boehmgc zlib ]
     ++ lib.optional sslSupport openssl
     ++ lib.optional mouseSupport gpm-ncurses
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index f60813a7eea6..e6f08bc6dea0 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -21,11 +21,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.8";
+    version = "6.8.1";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-COTQ5dqK8RMrUea8M1AYCtV63Nk18Je20LwRmiwsChA=";
+      hash = "sha256-Aw6Kem1ZDk6utAPuJWdWFc2A0jbzq4oLVtzIQYEViwU=";
     };
 
     format = "other";
@@ -35,7 +35,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      hash = "sha256-mP82UtASD0Fh8ilDDCB6ubY7/MGPoRP6hg6/xRwzwAw=";
+      hash = "sha256-i5AVyi9m7qLLubhV8fBhhZ6/RYOjMdwmv9Bek9pT/xo=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
diff --git a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
index 3bd9c68f2336..7e00d02b0374 100644
--- a/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+++ b/pkgs/build-support/bintools-wrapper/ld-wrapper.sh
@@ -226,12 +226,6 @@ if [[ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 && "$linkType" != static-pie ]]; t
 
 fi
 
-# This is outside the DONT_SET_RPATH branch because it's more targeted and we
-# usually want it (on Darwin) even if DONT_SET_RPATH is set.
-if [ -n "${NIX_COREFOUNDATION_RPATH:-}" ]; then
-  extraAfter+=(-rpath $NIX_COREFOUNDATION_RPATH)
-fi
-
 # Only add --build-id if this is a final link. FIXME: should build gcc
 # with --enable-linker-build-id instead?
 #
diff --git a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
index 51bfeb18f58a..ecbe3d477fa1 100644
--- a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
+++ b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
@@ -6,6 +6,6 @@ for p in "${params[@]}"; do
     esac
 done
 
-if $needsTarget; then
+if $needsTarget && [[ $0 != *cpp ]]; then
     extraBefore+=(-target @defaultTarget@ @machineFlags@)
 fi
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index c59118d6c09e..2c3dc8884023 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -27,8 +27,11 @@ for var in "${var_templates_bool[@]}"; do
     mangleVarBool "$var" ${role_suffixes[@]+"${role_suffixes[@]}"}
 done
 
-# `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld.
-NIX_CFLAGS_COMPILE_@suffixSalt@="-B@out@/bin/ $NIX_CFLAGS_COMPILE_@suffixSalt@"
+# Arocc does not support "-B"
+if [[ -z "@isArocc@" ]]; then
+    # `-B@bintools@/bin' forces cc to use ld-wrapper.sh when calling ld.
+    NIX_CFLAGS_COMPILE_@suffixSalt@="-B@bintools@/bin/ $NIX_CFLAGS_COMPILE_@suffixSalt@"
+fi
 
 # Export and assign separately in order that a failing $(..) will fail
 # the script.
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 0dca3b3347e5..4440d99ccaba 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -32,7 +32,7 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
 fi
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 stackprotector stackclashprotection pie pic strictoverflow format trivialautovarinit zerocallusedregs)
+  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection pacret pie pic strictoverflow format trivialautovarinit zerocallusedregs)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
@@ -75,6 +75,14 @@ for flag in "${!hardeningEnableMap[@]}"; do
           ;;
       esac
       ;;
+    shadowstack)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling shadowstack >&2; fi
+      hardeningCFlagsBefore+=('-fcf-protection=return')
+      ;;
+    pacret)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pacret >&2; fi
+      hardeningCFlagsBefore+=('-mbranch-protection=pac-ret')
+      ;;
     stackprotector)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
       hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index b8d170df01b7..4cc661721f44 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -79,6 +79,11 @@ if [ "$nonFlagArgs" = 0 ]; then
     dontLink=1
 fi
 
+# Arocc does not link
+if [ "@isArocc@" = 1 ]; then
+    dontLink=1
+fi
+
 # Optionally filter out paths not refering to the store.
 if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "$NIX_STORE" ]]; then
     kept=()
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index d842f3fc7090..542accd8fa11 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -15,7 +15,9 @@
 , propagateDoc ? cc != null && cc ? man
 , extraTools ? [], extraPackages ? [], extraBuildCommands ? ""
 , nixSupport ? {}
-, isGNU ? false, isClang ? cc.isClang or false, isCcache ? cc.isCcache or false, gnugrep ? null
+, isGNU ? false, isClang ? cc.isClang or false, isZig ? cc.isZig or false
+, isArocc ? cc.isArocc or false, isCcache ? cc.isCcache or false
+, gnugrep ? null
 , expand-response-params
 , libcxx ? null
 
@@ -304,6 +306,9 @@ stdenvNoCC.mkDerivation {
 
   outputs = [ "out" ] ++ optionals propagateDoc [ "man" "info" ];
 
+  # Cannot be in "passthru" due to "substituteAll"
+  inherit isArocc;
+
   passthru = {
     inherit targetPrefix suffixSalt;
     # "cc" is the generic name for a C compiler, but there is no one for package
@@ -311,7 +316,7 @@ stdenvNoCC.mkDerivation {
     # Binutils, and Apple's "cctools"; "bintools" as an attempt to find an
     # unused middle-ground name that evokes both.
     inherit bintools;
-    inherit cc libc libcxx nativeTools nativeLibc nativePrefix isGNU isClang;
+    inherit cc libc libcxx nativeTools nativeLibc nativePrefix isGNU isClang isZig;
 
     emacsBufferSetup = pkgs: ''
       ; We should handle propagation here too
@@ -391,6 +396,10 @@ stdenvNoCC.mkDerivation {
         ln -s ${targetPrefix}clang $out/bin/${targetPrefix}cc
         export named_cc=${targetPrefix}clang
         export named_cxx=${targetPrefix}clang++
+      elif [ -e $ccPath/arocc ]; then
+        wrap ${targetPrefix}arocc $wrapper $ccPath/arocc
+        ln -s ${targetPrefix}arocc $out/bin/${targetPrefix}cc
+        export named_cc=${targetPrefix}arocc
       fi
 
       if [ -e $ccPath/${targetPrefix}g++ ]; then
@@ -475,7 +484,7 @@ stdenvNoCC.mkDerivation {
     #
     # TODO(@Ericson2314): Remove this after stable release and force
     # everyone to refer to bintools-wrapper directly.
-    + ''
+    + optionalString (!isArocc) ''
       if [[ -f "$bintools/nix-support/dynamic-linker" ]]; then
         ln -s "$bintools/nix-support/dynamic-linker" "$out/nix-support"
       fi
@@ -491,7 +500,7 @@ stdenvNoCC.mkDerivation {
 
       echo "-B${gccForLibs}/lib/gcc/${targetPlatform.config}/${gccForLibs.version}" >> $out/nix-support/cc-cflags
     ''
-    + optionalString useGccForLibs ''
+    + optionalString (useGccForLibs && !isArocc) ''
       echo "-L${gccForLibs}/lib/gcc/${targetPlatform.config}/${gccForLibs.version}" >> $out/nix-support/cc-ldflags
       echo "-L${gccForLibs_solib}/lib" >> $out/nix-support/cc-ldflags
     ''
@@ -517,9 +526,9 @@ stdenvNoCC.mkDerivation {
     ''
     # this ensures that when clang passes -lgcc_s to lld (as it does
     # when building e.g. firefox), lld is able to find libgcc_s.so
-    + concatMapStrings (libgcc: ''
+    + optionals (!isArocc) (concatMapStrings (libgcc: ''
       echo "-L${libgcc}/lib" >> $out/nix-support/cc-ldflags
-    '') (toList (gccForLibs.libgcc or [])))
+    '') (toList (gccForLibs.libgcc or []))))
 
     ##
     ## General libc support
@@ -539,9 +548,10 @@ stdenvNoCC.mkDerivation {
     + optionalString (libc != null) (''
       touch "$out/nix-support/libc-cflags"
       touch "$out/nix-support/libc-ldflags"
+    '' + optionalString (!isArocc) ''
       echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
     '' + optionalString (!(cc.langD or false)) ''
-      echo "-idirafter ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
+      echo "-${if isArocc then "I" else "idirafter"} ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
     '' + optionalString (isGNU && (!(cc.langD or false))) ''
       for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
         echo '-idirafter' ''${dir} >> $out/nix-support/libc-cflags
@@ -597,7 +607,7 @@ stdenvNoCC.mkDerivation {
     # ${cc_solib}/lib64 (even though it does actually search there...)..
     # This confuses libtool.  So add it to the compiler tool search
     # path explicitly.
-    + optionalString (!nativeTools) ''
+    + optionalString (!nativeTools && !isArocc) ''
       if [ -e "${cc_solib}/lib64" -a ! -L "${cc_solib}/lib64" ]; then
         ccLDFlags+=" -L${cc_solib}/lib64"
         ccCFlags+=" -B${cc_solib}/lib64"
@@ -605,7 +615,7 @@ stdenvNoCC.mkDerivation {
       ccLDFlags+=" -L${cc_solib}/lib"
       ccCFlags+=" -B${cc_solib}/lib"
 
-    '' + optionalString cc.langAda or false ''
+    '' + optionalString (cc.langAda or false && !isArocc) ''
       touch "$out/nix-support/gnat-cflags"
       touch "$out/nix-support/gnat-ldflags"
       basePath=$(echo $cc/lib/*/*/*)
@@ -626,7 +636,7 @@ stdenvNoCC.mkDerivation {
     + optionalString propagateDoc ''
       ln -s ${cc.man} $man
       ln -s ${cc.info} $info
-    '' + optionalString (cc.langD or cc.langJava or false) ''
+    '' + optionalString (cc.langD or cc.langJava or false && !isArocc) ''
       echo "-B${zlib}${zlib.libdir or "/lib/"}" >> $out/nix-support/libc-cflags
     ''
 
@@ -667,7 +677,7 @@ stdenvNoCC.mkDerivation {
       hardening_unsupported_flags+=" stackprotector"
     ''
 
-    + optionalString (libc != null && targetPlatform.isAvr) ''
+    + optionalString (libc != null && targetPlatform.isAvr && !isArocc) ''
       for isa in avr5 avr3 avr4 avr6 avr25 avr31 avr35 avr51 avrxmega2 avrxmega4 avrxmega5 avrxmega6 avrxmega7 tiny-stack; do
         echo "-B${getLib libc}/avr/lib/$isa" >> $out/nix-support/libc-crt1-cflags
       done
diff --git a/pkgs/by-name/cm/cmake/000-nixpkgs-cmake-prefix-path.diff b/pkgs/by-name/cm/cmake/000-nixpkgs-cmake-prefix-path.diff
new file mode 100644
index 000000000000..4ebdcced055c
--- /dev/null
+++ b/pkgs/by-name/cm/cmake/000-nixpkgs-cmake-prefix-path.diff
@@ -0,0 +1,28 @@
+diff --git a/Source/cmFindBase.cxx b/Source/cmFindBase.cxx
+index 8840cdcb..c34b7ee9 100644
+--- a/Source/cmFindBase.cxx
++++ b/Source/cmFindBase.cxx
+@@ -280,6 +280,11 @@ void cmFindBase::FillCMakeEnvironmentPath()
+   // Add CMAKE_*_PATH environment variables
+   std::string var = cmStrCat("CMAKE_", this->CMakePathName, "_PATH");
+   paths.AddEnvPrefixPath("CMAKE_PREFIX_PATH");
++  if (this->CMakePathName != "PROGRAM") {
++    // Like CMAKE_PREFIX_PATH except when searching for programs. Programs need
++    // to be located via PATH
++    paths.AddEnvPrefixPath("NIXPKGS_CMAKE_PREFIX_PATH");
++  }
+   paths.AddEnvPath(var);
+ 
+   if (this->CMakePathName == "PROGRAM") {
+diff --git a/Source/cmFindPackageCommand.cxx b/Source/cmFindPackageCommand.cxx
+index 9b51b1ad..6acc676c 100644
+--- a/Source/cmFindPackageCommand.cxx
++++ b/Source/cmFindPackageCommand.cxx
+@@ -2039,6 +2039,7 @@ void cmFindPackageCommand::FillPrefixesCMakeEnvironment()
+ 
+   // And now the general CMake environment variables
+   paths.AddEnvPath("CMAKE_PREFIX_PATH");
++  paths.AddEnvPath("NIXPKGS_CMAKE_PREFIX_PATH");
+   if (this->DebugMode) {
+     debugBuffer = cmStrCat(debugBuffer,
+                            "CMAKE_PREFIX_PATH env variable "
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index c03c1055f724..ca0f1789a110 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -56,6 +56,9 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
+    # Add NIXPKGS_CMAKE_PREFIX_PATH to cmake which is like CMAKE_PREFIX_PATH
+    # except it is not searched for programs
+    ./000-nixpkgs-cmake-prefix-path.diff
     # Don't search in non-Nix locations such as /usr, but do search in our libc.
     ./001-search-path.diff
     # Don't depend on frameworks.
diff --git a/pkgs/by-name/cm/cmake/setup-hook.sh b/pkgs/by-name/cm/cmake/setup-hook.sh
index 29b72ddda435..9ca4a6abeebc 100755
--- a/pkgs/by-name/cm/cmake/setup-hook.sh
+++ b/pkgs/by-name/cm/cmake/setup-hook.sh
@@ -1,5 +1,7 @@
 addCMakeParams() {
-    addToSearchPath CMAKE_PREFIX_PATH $1
+    # NIXPKGS_CMAKE_PREFIX_PATH is like CMAKE_PREFIX_PATH except cmake
+    # will not search it for programs
+    addToSearchPath NIXPKGS_CMAKE_PREFIX_PATH $1
 }
 
 fixCmakeFiles() {
@@ -151,22 +153,22 @@ makeCmakeFindLibs(){
   for flag in ${NIX_CFLAGS_COMPILE-} ${NIX_LDFLAGS-}; do
     if test -n "$isystem_seen" && test -d "$flag"; then
       isystem_seen=
-      export CMAKE_INCLUDE_PATH="${CMAKE_INCLUDE_PATH-}${CMAKE_INCLUDE_PATH:+:}${flag}"
+      addToSearchPath CMAKE_INCLUDE_PATH "${flag}"
     elif test -n "$iframework_seen" && test -d "$flag"; then
       iframework_seen=
-      export CMAKE_FRAMEWORK_PATH="${CMAKE_FRAMEWORK_PATH-}${CMAKE_FRAMEWORK_PATH:+:}${flag}"
+      addToSearchPath CMAKE_FRAMEWORK_PATH "${flag}"
     else
       isystem_seen=
       iframework_seen=
       case $flag in
         -I*)
-          export CMAKE_INCLUDE_PATH="${CMAKE_INCLUDE_PATH-}${CMAKE_INCLUDE_PATH:+:}${flag:2}"
+          addToSearchPath CMAKE_INCLUDE_PATH "${flag:2}"
           ;;
         -L*)
-          export CMAKE_LIBRARY_PATH="${CMAKE_LIBRARY_PATH-}${CMAKE_LIBRARY_PATH:+:}${flag:2}"
+          addToSearchPath CMAKE_LIBRARY_PATH "${flag:2}"
           ;;
         -F*)
-          export CMAKE_FRAMEWORK_PATH="${CMAKE_FRAMEWORK_PATH-}${CMAKE_FRAMEWORK_PATH:+:}${flag:2}"
+          addToSearchPath CMAKE_FRAMEWORK_PATH "${flag:2}"
           ;;
         -isystem)
           isystem_seen=1
diff --git a/pkgs/by-name/gd/gdbm/package.nix b/pkgs/by-name/gd/gdbm/package.nix
new file mode 100644
index 000000000000..91271e71d129
--- /dev/null
+++ b/pkgs/by-name/gd/gdbm/package.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  fetchurl,
+  stdenv,
+  testers,
+  updateAutotoolsGnuConfigScriptsHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gdbm";
+  version = "1.24";
+
+  src = fetchurl {
+    url = "mirror://gnu/gdbm/gdbm-${finalAttrs.version}.tar.gz";
+    hash = "sha256-aV6YJ/33Y1E/EzkQvH5s/bkYeUOk/slD5XRJcj0rjb8=";
+  };
+
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
+
+  configureFlags = [ (lib.enableFeature true "libgdbm-compat") ];
+
+  outputs = [
+    "out"
+    "dev"
+    "info"
+    "lib"
+    "man"
+  ];
+
+  doCheck = true;
+
+  enableParallelBuilding = true;
+
+  # 1. Linking static stubs on cygwin requires correct ordering. Consider
+  #    upstreaming this.
+  #
+  # 2. Disable dbmfetch03.at test because it depends on unlink() failing on a
+  #    link in a chmod -w directory, which cygwin apparently allows.
+  postPatch = lib.optionalString stdenv.buildPlatform.isCygwin ''
+    substituteInPlace tests/Makefile.in \
+      --replace-fail '_LDADD = ../src/libgdbm.la ../compat/libgdbm_compat.la' \
+                     '_LDADD = ../compat/libgdbm_compat.la ../src/libgdbm.la'
+    substituteInPlace tests/testsuite.at
+      --replace-fail 'm4_include([dbmfetch03.at])' ""
+  '';
+
+  # create symlinks for compatibility
+  postInstall = ''
+    install -dm755 ''${!outputDev}/include/gdbm
+    pushd ''${!outputDev}/include/gdbm
+    ln -s ../dbm.h dbm.h
+    ln -s ../gdbm.h gdbm.h
+    ln -s ../ndbm.h ndbm.h
+    popd
+  '';
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "gdbmtool --version";
+    };
+  };
+
+  meta = {
+    homepage = "https://www.gnu.org/software/gdbm/";
+    description = "GNU dbm key/value database library";
+    longDescription = ''
+      GNU dbm (or GDBM, for short) is a library of database functions that use
+      extensible hashing and work similar to the standard UNIX dbm. These
+      routines are provided to a programmer needing to create and manipulate a
+      hashed database.
+
+      The basic use of GDBM is to store key/data pairs in a data file. Each
+      key must be unique and each key is paired with only one data item.
+
+      The library provides primitives for storing key/data pairs, searching and
+      retrieving the data by its key and deleting a key along with its data.
+      It also support sequential iteration over all key/data pairs in a
+      database.
+
+      For compatibility with programs using old UNIX dbm function, the package
+      also provides traditional dbm and ndbm interfaces.
+    '';
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "gdbmtool";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/development/libraries/libtheora/mingw-remove-export.patch b/pkgs/by-name/li/libtheora/mingw-remove-export.patch
similarity index 100%
rename from pkgs/development/libraries/libtheora/mingw-remove-export.patch
rename to pkgs/by-name/li/libtheora/mingw-remove-export.patch
diff --git a/pkgs/by-name/li/libtheora/package.nix b/pkgs/by-name/li/libtheora/package.nix
new file mode 100644
index 000000000000..df49f3988c01
--- /dev/null
+++ b/pkgs/by-name/li/libtheora/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  fetchpatch,
+  autoreconfHook,
+  libogg,
+  libvorbis,
+  pkg-config,
+  testers,
+  validatePkgConfig,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libtheora";
+  version = "1.1.1";
+
+  src = fetchurl {
+    url = "https://downloads.xiph.org/releases/theora/libtheora-${finalAttrs.version}.tar.gz";
+    hash = "sha256-QJUpVsR4EZKNHnkizaO8H0J+t1aAw8NySckelJBUkWs=";
+  };
+
+  patches = [
+    # fix error in autoconf scripts
+    (fetchpatch {
+      url = "https://github.com/xiph/theora/commit/28cc6dbd9b2a141df94f60993256a5fca368fa54.diff";
+      hash = "sha256-M/UULkiklvEay7LyOuCamxWCSvt37QSMzHOsAAnOWJo=";
+    })
+  ] ++ lib.optionals stdenv.hostPlatform.isMinGW [ ./mingw-remove-export.patch ];
+
+  configureFlags = [ "--disable-examples" ];
+
+  outputs = [
+    "out"
+    "dev"
+    "devdoc"
+  ];
+  outputDoc = "devdoc";
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    validatePkgConfig
+  ];
+
+  propagatedBuildInputs = [
+    libogg
+    libvorbis
+  ];
+
+  passthru = {
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [
+        "theora"
+        "theoradec"
+        "theoraenc"
+      ];
+    };
+  };
+
+  meta = {
+    description = "Library for Theora, a free and open video compression format";
+    homepage = "https://www.theora.org/";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ getchoo ];
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+})
diff --git a/pkgs/by-name/me/meson/000-nixpkgs-cmake-prefix-path.patch b/pkgs/by-name/me/meson/000-nixpkgs-cmake-prefix-path.patch
new file mode 100644
index 000000000000..c45106c4f9d1
--- /dev/null
+++ b/pkgs/by-name/me/meson/000-nixpkgs-cmake-prefix-path.patch
@@ -0,0 +1,12 @@
+diff --git a/mesonbuild/dependencies/data/CMakePathInfo.txt b/mesonbuild/dependencies/data/CMakePathInfo.txt
+index 662ec58..4d5f4e4 100644
+--- a/mesonbuild/dependencies/data/CMakePathInfo.txt
++++ b/mesonbuild/dependencies/data/CMakePathInfo.txt
+@@ -5,6 +5,7 @@ list(APPEND TMP_PATHS_LIST ${CMAKE_PREFIX_PATH})
+ list(APPEND TMP_PATHS_LIST ${CMAKE_FRAMEWORK_PATH})
+ list(APPEND TMP_PATHS_LIST ${CMAKE_APPBUNDLE_PATH})
+ list(APPEND TMP_PATHS_LIST $ENV{CMAKE_PREFIX_PATH})
++list(APPEND TMP_PATHS_LIST $ENV{NIXPKGS_CMAKE_PREFIX_PATH})
+ list(APPEND TMP_PATHS_LIST $ENV{CMAKE_FRAMEWORK_PATH})
+ list(APPEND TMP_PATHS_LIST $ENV{CMAKE_APPBUNDLE_PATH})
+ list(APPEND TMP_PATHS_LIST ${CMAKE_SYSTEM_PREFIX_PATH})
diff --git a/pkgs/by-name/me/meson/007-case-sensitive-fs.patch b/pkgs/by-name/me/meson/007-case-sensitive-fs.patch
new file mode 100644
index 000000000000..54d07d85585c
--- /dev/null
+++ b/pkgs/by-name/me/meson/007-case-sensitive-fs.patch
@@ -0,0 +1,87 @@
+From a6fb2c165cda4bbf315424c96165ec9cc7052363 Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Wed, 3 Apr 2024 17:35:56 -0400
+Subject: [PATCH] dependencies: find extraframeworks on case-sensitive
+ filesystems
+
+Fixes a test failure on case-sensitive filesystems when a CMake
+dependency is turned into an Apple framework.
+---
+ mesonbuild/dependencies/framework.py              | 9 +++++++--
+ test cases/osx/11 case sensitive apfs/meson.build | 5 +++++
+ test cases/osx/11 case sensitive apfs/prog.c      | 3 +++
+ test cases/osx/11 case sensitive apfs/test.json   | 5 +++++
+ 4 files changed, 20 insertions(+), 2 deletions(-)
+ create mode 100644 test cases/osx/11 case sensitive apfs/meson.build
+ create mode 100644 test cases/osx/11 case sensitive apfs/prog.c
+ create mode 100644 test cases/osx/11 case sensitive apfs/test.json
+
+diff --git a/mesonbuild/dependencies/framework.py b/mesonbuild/dependencies/framework.py
+index 3c880c7430af..1fbd628235ba 100644
+--- a/mesonbuild/dependencies/framework.py
++++ b/mesonbuild/dependencies/framework.py
+@@ -47,6 +47,7 @@ def detect(self, name: str, paths: T.List[str]) -> None:
+             framework_path = self._get_framework_path(p, name)
+             if framework_path is None:
+                 continue
++            framework_name = framework_path.stem
+             # We want to prefer the specified paths (in order) over the system
+             # paths since these are "extra" frameworks.
+             # For example, Python2's framework is in /System/Library/Frameworks and
+@@ -54,11 +55,15 @@ def detect(self, name: str, paths: T.List[str]) -> None:
+             # Python.framework. We need to know for sure that the framework was
+             # found in the path we expect.
+             allow_system = p in self.system_framework_paths
+-            args = self.clib_compiler.find_framework(name, self.env, [p], allow_system)
++            args = self.clib_compiler.find_framework(framework_name, self.env, [p], allow_system)
+             if args is None:
+                 continue
+             self.link_args = args
+             self.framework_path = framework_path.as_posix()
++            # The search is done case-insensitively, so the found name may differ
++            # from the one that was requested. Setting the name ensures the correct
++            # one is used when linking on case-sensitive filesystems.
++            self.name = framework_name
+             self.compile_args = ['-F' + self.framework_path]
+             # We need to also add -I includes to the framework because all
+             # cross-platform projects such as OpenGL, Python, Qt, GStreamer,
+@@ -74,7 +79,7 @@ def _get_framework_path(self, path: str, name: str) -> T.Optional[Path]:
+         p = Path(path)
+         lname = name.lower()
+         for d in p.glob('*.framework/'):
+-            if lname == d.name.rsplit('.', 1)[0].lower():
++            if lname == d.stem.lower():
+                 return d
+         return None
+ 
+diff --git a/test cases/osx/11 case sensitive apfs/meson.build b/test cases/osx/11 case sensitive apfs/meson.build
+new file mode 100644
+index 000000000000..dd566b185f28
+--- /dev/null
++++ b/test cases/osx/11 case sensitive apfs/meson.build	
+@@ -0,0 +1,5 @@
++project('case-sensitive APFS with extra frameworks test', 'c')
++
++dep = dependency('FoUnDaTiOn')
++
++exe = executable('prog', 'prog.c', install : true, dependencies: dep)
+diff --git a/test cases/osx/11 case sensitive apfs/prog.c b/test cases/osx/11 case sensitive apfs/prog.c
+new file mode 100644
+index 000000000000..9b6bdc2ec2f0
+--- /dev/null
++++ b/test cases/osx/11 case sensitive apfs/prog.c	
+@@ -0,0 +1,3 @@
++int main(void) {
++    return 0;
++}
+diff --git a/test cases/osx/11 case sensitive apfs/test.json b/test cases/osx/11 case sensitive apfs/test.json
+new file mode 100644
+index 000000000000..a883714eaa27
+--- /dev/null
++++ b/test cases/osx/11 case sensitive apfs/test.json	
+@@ -0,0 +1,5 @@
++{
++  "installed": [
++    {"type": "file", "file": "usr/bin/prog"}
++  ]
++}
diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index f05796e20ddc..d817c63708be 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -21,16 +21,19 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.4.1";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-RBE4AUF5fymUA87JEDWtpUFXmVPFzdhZgDI7/kscTx4=";
+    hash = "sha256-BqsEO1a93a8d7/UH232buSPBt+WSNJbw1DGYA2nm9rs=";
   };
 
   patches = [
+    # Nixpkgs cmake uses NIXPKGS_CMAKE_PREFIX_PATH for the search path
+    ./000-nixpkgs-cmake-prefix-path.patch
+
     # In typical distributions, RPATH is only needed for internal libraries so
     # meson removes everything else. With Nix, the locations of libraries
     # are not as predictable, therefore we need to keep them in the RPATH.
@@ -72,14 +75,22 @@ python3.pkgs.buildPythonApplication rec {
     # This edge case is explicitly part of meson but is wrong for nix
     ./007-freebsd-pkgconfig-path.patch
 
-    # Find boost via pkg-config
-    # https://github.com/NixOS/nixpkgs/issues/86131
-    # Already merged upstream PR: https://github.com/mesonbuild/meson/pull/13272
-    # FIXME: Will be in meson 1.5.0
     (fetchpatch {
-      name = "find-boost-pkg-config.patch";
-      url = "https://github.com/mesonbuild/meson/commit/c21b886ba8a60cce7fa56e4be40bd7547129fb00.patch";
-      hash = "sha256-uSilNuSx9yd1cxs0XVLcLw4MOXEd2uIe2g+wk+SBqeU=";
+      name = "tests-skip-framework-recasting-if-CMake-unavailable.patch";
+      url = "https://github.com/mesonbuild/meson/commit/8a8a3a0578fd8d5a8720a7a706f6f3b99e857f9c.patch";
+      hash = "sha256-XkwNQ5eg/fVekhsFg/V2/S2LbIVGz3H0wsSFlUT3ZZE=";
+    })
+
+    # Fix extraframework lookup on case-sensitive APFS.
+    # https://github.com/mesonbuild/meson/pull/13038
+    ./007-case-sensitive-fs.patch
+
+    # Fix meson's detection for zig's linker
+    # https://github.com/mesonbuild/meson/pull/12293
+    (fetchpatch {
+      name = "linker-support-zig-cc.patch";
+      url = "https://github.com/mesonbuild/meson/pull/12293/commits/2baae244c995794d9addfe6ed924dfa72f01be82.patch";
+      hash = "sha256-dDOmSRBKl/gs7I3kmLXIyQk3zsOdlaYov72pPSel4+I=";
     })
   ];
 
@@ -133,6 +144,9 @@ python3.pkgs.buildPythonApplication rec {
     ''test cases/linuxlike/14 static dynamic linkage''
     # Nixpkgs cctools does not have bitcode support.
     ''test cases/osx/7 bitcode''
+  ] ++ lib.optionals stdenv.isDarwin [
+    # requires llvmPackages.openmp, creating cyclic dependency
+    ''test cases/common/184 openmp''
   ] ++ lib.optionals stdenv.isFreeBSD [
     # pch doesn't work quite right on FreeBSD, I think
     ''test cases/common/13 pch''
diff --git a/pkgs/by-name/pa/pahole/package.nix b/pkgs/by-name/pa/pahole/package.nix
index 14a31958c0e2..d82c76eb769c 100644
--- a/pkgs/by-name/pa/pahole/package.nix
+++ b/pkgs/by-name/pa/pahole/package.nix
@@ -36,6 +36,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/acmel/dwarves/commit/6a2b27c0f512619b0e7a769a18a0fb05bb3789a5.patch";
       hash = "sha256-Le1BAew/a/QKkYNLgSQxEvZ9mEEglUw8URwz1kiheeE=";
     })
+    (fetchpatch {
+      name = "fix-clang-btf-generation-bug-2.patch";
+      url = "https://github.com/acmel/dwarves/commit/94a01bde592c555b3eb526aeb4c2ad695c5660d8.patch";
+      hash = "sha256-SMIxLEBjBkprAqVNX1h7nXxAsgbwvCD/Bz7c1ekwg5w=";
+    })
   ];
 
   # Put libraries in "lib" subdirectory, not top level of $out
diff --git a/pkgs/by-name/wa/waf/package.nix b/pkgs/by-name/wa/waf/package.nix
index a30c5df8d851..45ab6f7622db 100644
--- a/pkgs/by-name/wa/waf/package.nix
+++ b/pkgs/by-name/wa/waf/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waf";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "waf-${finalAttrs.version}";
-    hash = "sha256-38u8DJ1KLkb7FfeCr+1e5UBE3Qkx1q2FBsm5HDXnunQ=";
+    hash = "sha256-/7V+GA3YBhdaJkDlZ1k4IUYkgh0yuTG09G+frnnMoIw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/misc/publicsuffix-list/default.nix b/pkgs/data/misc/publicsuffix-list/default.nix
index b2c69dff1091..95cab65aa61b 100644
--- a/pkgs/data/misc/publicsuffix-list/default.nix
+++ b/pkgs/data/misc/publicsuffix-list/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenvNoCC, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub, unstableGitUpdater }:
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2024-01-07";
+  version = "0-unstable-2024-06-19";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "5db9b65997e3c9230ac4353b01994c2ae9667cb9";
-    hash = "sha256-kIJVS2ETAXQa1MMG8cjRUSFUn+jm9jBWH8go3L+lqHE=";
+    rev = "92c74a6cde6092a5e80531c0662e1055abeb975e";
+    hash = "sha256-fkfjR2A2nf3/F16Pn0hCwXtAd26TbUVA5gIv+J4DOjc=";
   };
 
   dontBuild = true;
@@ -21,6 +21,8 @@ stdenvNoCC.mkDerivation {
     runHook postInstall
   '';
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with lib; {
     homepage = "https://publicsuffix.org/";
     description = "Cross-vendor public domain suffix database";
diff --git a/pkgs/development/compilers/arocc/default.nix b/pkgs/development/compilers/arocc/default.nix
new file mode 100644
index 000000000000..6d73c2d3562d
--- /dev/null
+++ b/pkgs/development/compilers/arocc/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  fetchFromGitHub,
+  callPackage,
+  zig_0_13,
+}:
+let
+  versions = [
+    {
+      zig = zig_0_13;
+      version = "0-unstable-06-01";
+      src = fetchFromGitHub {
+        owner = "Vexu";
+        repo = "arocc";
+        rev = "55cb6d1b682b83f75ad4f60e34c6fcd2336e8531";
+        hash = "sha256-xs3zNQIC5drrQYT4nxL7Q69xSEdbdMv5+3hQpsX3q5A=";
+      };
+    }
+  ];
+
+  mkPackage =
+    {
+      zig,
+      version,
+      src,
+    }:
+    callPackage ./package.nix { inherit zig version src; };
+
+  pkgsList = lib.map mkPackage versions;
+
+  pkgsAttrsUnwrapped = lib.listToAttrs (
+    lib.map (pkg: lib.nameValuePair "${pkg.version}-unwrapped" pkg) pkgsList
+  );
+  pkgsAttrsWrapped = lib.listToAttrs (
+    lib.map (pkg: lib.nameValuePair pkg.version pkg.wrapped) pkgsList
+  );
+
+  pkgsAttrs = pkgsAttrsWrapped // pkgsAttrsUnwrapped;
+in
+{
+  latest-unwrapped = lib.last pkgsList;
+  latest = (lib.last pkgsList).wrapped;
+}
+// pkgsAttrs
diff --git a/pkgs/development/compilers/arocc/package.nix b/pkgs/development/compilers/arocc/package.nix
new file mode 100644
index 000000000000..edd3316fa638
--- /dev/null
+++ b/pkgs/development/compilers/arocc/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenv,
+  wrapCCWith,
+  overrideCC,
+  zig,
+  version,
+  src,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "arocc";
+  inherit version src;
+
+  nativeBuildInputs = [ zig.hook ];
+
+  passthru = {
+    inherit zig;
+    isArocc = true;
+    wrapped = wrapCCWith { cc = finalAttrs.finalPackage; };
+    stdenv = overrideCC stdenv finalAttrs.passthru.wrapped;
+  };
+
+  meta = {
+    description = "C compiler written in Zig.";
+    homepage = "http://aro.vexu.eu/";
+    license = with lib.licenses; [
+      mit
+      unicode-30
+    ];
+    maintainers = with lib.maintainers; [ RossComputerGuy ];
+    mainProgram = "arocc";
+  };
+})
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index d69ec08a2ac5..fb9e97b15a9a 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -431,6 +431,13 @@ pipe ((callFile ./common/builder.nix {}) ({
       ) "stackclashprotection"
       ++ optional (!atLeast11) "zerocallusedregs"
       ++ optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
+      ++ optional (!(
+        atLeast8
+        && targetPlatform.isLinux
+        && targetPlatform.isx86_64
+        && targetPlatform.libc == "glibc"
+      )) "shadowstack"
+      ++ optional (!(atLeast9 && targetPlatform.isLinux && targetPlatform.isAarch64)) "pacret"
       ++ optionals (langFortran) [ "fortify" "format" ];
   };
 
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index 5fe11e35a434..9d67dde87c2d 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-slKBFq6NyWHQmJq/YR3LmbGnHyZgRg0hej90tZDOGzA=";
   };
 
+  outputs = [ "bin" "out" "dev" ];
+
   # These get set at all-packages, keep onto them for child drvs
   passthru = {
     spirv-tools = spirv-tools;
@@ -33,16 +35,19 @@ stdenv.mkDerivation rec {
 
   # This is a dirty fix for lib/cmake/SPIRVTargets.cmake:51 which includes this directory
   postInstall = ''
-    mkdir $out/include/External
+    mkdir -p $dev/include/External
+    moveToOutput lib/pkgconfig "''${!outputDev}"
+    moveToOutput lib/cmake "''${!outputDev}"
   '';
 
   # Fix the paths in .pc, even though it's unclear if these .pc are really useful.
   postFixup = ''
-    substituteInPlace $out/lib/pkgconfig/*.pc \
-      --replace '=''${prefix}//' '=/'
+    substituteInPlace $dev/lib/pkgconfig/*.pc \
+      --replace-fail '=''${prefix}//' '=/' \
+      --replace-fail "includedir=$dev/$dev" "includedir=$dev"
 
     # add a symlink for backwards compatibility
-    ln -s $out/bin/glslang $out/bin/glslangValidator
+    ln -s $bin/bin/glslang $bin/bin/glslangValidator
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/compilers/llvm/common/clang/default.nix b/pkgs/development/compilers/llvm/common/clang/default.nix
index dde531adf44e..5a6d775804b6 100644
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@@ -138,6 +138,16 @@ let
       isClang = true;
       hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
         [ "fortify3" ]
+        ++ lib.optional (
+          (lib.versionOlder release_version "7")
+          || !targetPlatform.isLinux
+          || !targetPlatform.isx86_64
+        ) "shadowstack"
+        ++ lib.optional (
+          (lib.versionOlder release_version "8")
+          || !targetPlatform.isAarch64
+          || !targetPlatform.isLinux
+        ) "pacret"
         ++ lib.optional (
           (lib.versionOlder release_version "11")
           || (targetPlatform.isAarch64 && (lib.versionOlder release_version "18.1"))
diff --git a/pkgs/development/compilers/llvm/common/llvm/default.nix b/pkgs/development/compilers/llvm/common/llvm/default.nix
index 9f9f91ee2d2e..fdcd40201c0b 100644
--- a/pkgs/development/compilers/llvm/common/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -104,6 +104,7 @@ stdenv.mkDerivation (rec {
 
   hardeningDisable = [
     "trivialautovarinit"
+    "shadowstack"
   ];
 
   nativeBuildInputs = [ cmake ]
diff --git a/pkgs/development/compilers/rust/1_79.nix b/pkgs/development/compilers/rust/1_79.nix
index a749e58c16bc..71f4b0beffa7 100644
--- a/pkgs/development/compilers/rust/1_79.nix
+++ b/pkgs/development/compilers/rust/1_79.nix
@@ -9,52 +9,129 @@
 #    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
 # 3. Firefox and Thunderbird should still build on x86_64-linux.
 
-{ stdenv, lib
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost, pkgsTargetTarget
-, makeRustPlatform
-, wrapRustcWith
-, llvmPackages_18, llvm_18
-} @ args:
+{
+  stdenv,
+  lib,
+  newScope,
+  callPackage,
+  CoreFoundation,
+  Security,
+  SystemConfiguration,
+  pkgsBuildTarget,
+  pkgsBuildBuild,
+  pkgsBuildHost,
+  pkgsTargetTarget,
+  makeRustPlatform,
+  wrapRustcWith,
+  llvmPackages_18,
+  llvm_18,
+  wrapCCWith,
+  overrideCC,
+}@args:
+let
+  llvmSharedFor =
+    pkgSet:
+    pkgSet.llvmPackages_18.libllvm.override (
+      {
+        enableSharedLibraries = true;
+      }
+      // lib.optionalAttrs (stdenv.targetPlatform.useLLVM or false) {
+        # Force LLVM to compile using clang + LLVM libs when targeting pkgsLLVM
+        stdenv = pkgSet.stdenv.override {
+          allowedRequisites = null;
+          cc = pkgSet.llvmPackages_18.clangUseLLVM;
+        };
+      }
+    );
+in
+import ./default.nix
+  {
+    rustcVersion = "1.79.0";
+    rustcSha256 = "sha256-Fy7PPH0fnZ+xbNKmKIaXgmcEFt7QEp5SSoZ1H5YUSMA=";
 
-import ./default.nix {
-  rustcVersion = "1.79.0";
-  rustcSha256 = "sha256-Fy7PPH0fnZ+xbNKmKIaXgmcEFt7QEp5SSoZ1H5YUSMA=";
+    llvmSharedForBuild = llvmSharedFor pkgsBuildBuild;
+    llvmSharedForHost = llvmSharedFor pkgsBuildHost;
+    llvmSharedForTarget = llvmSharedFor pkgsBuildTarget;
 
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_18.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_18.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_18.libllvm.override { enableSharedLibraries = true; };
+    # For use at runtime
+    llvmShared = llvmSharedFor { inherit llvmPackages_18 stdenv; };
 
-  # For use at runtime
-  llvmShared = llvm_18.override { enableSharedLibraries = true; };
+    # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+    llvmPackages =
+      if (stdenv.targetPlatform.useLLVM or false) then
+        callPackage (
+          {
+            pkgs,
+            bootBintoolsNoLibc ? if stdenv.targetPlatform.linker == "lld" then null else pkgs.bintoolsNoLibc,
+            bootBintools ? if stdenv.targetPlatform.linker == "lld" then null else pkgs.bintools,
+          }:
+          let
+            llvmPackages = llvmPackages_18;
 
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackages = llvmPackages_18;
+            setStdenv =
+              pkg:
+              pkg.override {
+                stdenv = stdenv.override {
+                  allowedRequisites = null;
+                  cc = llvmPackages.clangUseLLVM;
+                };
+              };
+          in
+          rec {
+            inherit (llvmPackages) bintools;
 
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.78.0";
+            libunwind = setStdenv llvmPackages.libunwind;
+            llvm = setStdenv llvmPackages.llvm;
 
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "8f3f5d2ab7b609ab30d584cfb5cecc3d8b16d2620fffb7643383c8a0a3881e21";
-    x86_64-unknown-linux-gnu = "1307747915e8bd925f4d5396ab2ae3d8d9c7fad564afbc358c081683d0f22e87";
-    x86_64-unknown-linux-musl = "c11ab908cbffbe98097d99ed62f5db00aa98496520b1e09583a151d36df7fca4";
-    arm-unknown-linux-gnueabihf = "2a2b1cf93b31e429624380e5b0d2bcce327274f8593b63657b863e38831f6421";
-    armv7-unknown-linux-gnueabihf = "fcce5ddb4f55bbdc9a1359a4cb6e65f2ff790d59ad228102cd472112ea65d3fe";
-    aarch64-unknown-linux-gnu = "131eda738cd977fff2c912e5838e8e9b9c260ecddc1247c0fe5473bf09c594af";
-    aarch64-unknown-linux-musl = "f328bcf109bf3eae01559b53939a9afbdb70ef30429f95109f7ea21030d60dfa";
-    x86_64-apple-darwin = "6c91ed3bd90253961fcb4a2991b8b22e042e2aaa9aba9f389f1e17008171d898";
-    aarch64-apple-darwin = "3be74c31ee8dc4f1d49e2f2888228de374138eaeca1876d0c1b1a61df6023b3b";
-    powerpc64le-unknown-linux-gnu = "c5aedb12c552daa18072e386697205fb7b91cef1e8791fe6fb74834723851388";
-    riscv64gc-unknown-linux-gnu = "847a925ace172d4c0a8d3da8d755b8678071ef73e659886128a3103bb896dcd9";
-    x86_64-unknown-freebsd = "b9cc84c60deb8da08a6c876426f8721758f4c7e7c553b4554385752ad37c63df";
-  };
+            libcxx = llvmPackages.libcxx.override {
+              stdenv = stdenv.override {
+                allowedRequisites = null;
+                cc = llvmPackages.clangNoLibcxx;
+                hostPlatform = stdenv.hostPlatform // {
+                  useLLVM = !stdenv.isDarwin;
+                };
+              };
+              inherit libunwind;
+            };
 
-  selectRustPackage = pkgs: pkgs.rust_1_79;
+            clangUseLLVM = llvmPackages.clangUseLLVM.override { inherit libcxx; };
 
-  rustcPatches = [ ];
-}
+            stdenv = overrideCC args.stdenv clangUseLLVM;
+          }
+        ) { }
+      else
+        llvmPackages_18;
 
-(builtins.removeAttrs args [ "llvmPackages_18" "llvm_18"])
+    # Note: the version MUST be one version prior to the version we're
+    # building
+    bootstrapVersion = "1.78.0";
+
+    # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+    bootstrapHashes = {
+      i686-unknown-linux-gnu = "8f3f5d2ab7b609ab30d584cfb5cecc3d8b16d2620fffb7643383c8a0a3881e21";
+      x86_64-unknown-linux-gnu = "1307747915e8bd925f4d5396ab2ae3d8d9c7fad564afbc358c081683d0f22e87";
+      x86_64-unknown-linux-musl = "c11ab908cbffbe98097d99ed62f5db00aa98496520b1e09583a151d36df7fca4";
+      arm-unknown-linux-gnueabihf = "2a2b1cf93b31e429624380e5b0d2bcce327274f8593b63657b863e38831f6421";
+      armv7-unknown-linux-gnueabihf = "fcce5ddb4f55bbdc9a1359a4cb6e65f2ff790d59ad228102cd472112ea65d3fe";
+      aarch64-unknown-linux-gnu = "131eda738cd977fff2c912e5838e8e9b9c260ecddc1247c0fe5473bf09c594af";
+      aarch64-unknown-linux-musl = "f328bcf109bf3eae01559b53939a9afbdb70ef30429f95109f7ea21030d60dfa";
+      x86_64-apple-darwin = "6c91ed3bd90253961fcb4a2991b8b22e042e2aaa9aba9f389f1e17008171d898";
+      aarch64-apple-darwin = "3be74c31ee8dc4f1d49e2f2888228de374138eaeca1876d0c1b1a61df6023b3b";
+      powerpc64le-unknown-linux-gnu = "c5aedb12c552daa18072e386697205fb7b91cef1e8791fe6fb74834723851388";
+      riscv64gc-unknown-linux-gnu = "847a925ace172d4c0a8d3da8d755b8678071ef73e659886128a3103bb896dcd9";
+      x86_64-unknown-freebsd = "b9cc84c60deb8da08a6c876426f8721758f4c7e7c553b4554385752ad37c63df";
+    };
+
+    selectRustPackage = pkgs: pkgs.rust_1_79;
+
+    rustcPatches = [ ];
+  }
+
+  (
+    builtins.removeAttrs args [
+      "llvmPackages_18"
+      "llvm_18"
+      "wrapCCWith"
+      "overrideCC"
+    ]
+  )
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 487de452b01c..ef7b92efc535 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, removeReferencesTo, pkgsBuildBuild, pkgsBuildHost, pkgsBuildTarget, targetPackages
 , llvmShared, llvmSharedForBuild, llvmSharedForHost, llvmSharedForTarget, llvmPackages
-, fetchurl, file, python3
+, runCommandLocal, fetchurl, file, python3
 , darwin, cargo, cmake, rustc, rustfmt
 , pkg-config, openssl, xz
 , libiconv
@@ -24,6 +24,7 @@
 let
   inherit (lib) optionals optional optionalString concatStringsSep;
   inherit (darwin.apple_sdk.frameworks) Security;
+  useLLVM = stdenv.targetPlatform.useLLVM or false;
 in stdenv.mkDerivation (finalAttrs: {
   pname = "${targetPackages.stdenv.cc.targetPrefix}rustc";
   inherit version;
@@ -66,14 +67,16 @@ in stdenv.mkDerivation (finalAttrs: {
        # when linking stage1 libstd: cc: undefined reference to `__cxa_begin_catch'
        # This doesn't apply to cross-building for FreeBSD because the host
        # uses libstdc++, but the target (used for building std) uses libc++
-       optional (stdenv.isLinux && !withBundledLLVM && !stdenv.targetPlatform.isFreeBSD) "--push-state --as-needed -lstdc++ --pop-state"
+      optional (stdenv.isLinux && !withBundledLLVM && !stdenv.targetPlatform.isFreeBSD && !useLLVM)
+        "--push-state --as-needed -lstdc++ --pop-state"
+    ++ optional (stdenv.isLinux && !withBundledLLVM && !stdenv.targetPlatform.isFreeBSD && useLLVM)
+        "--push-state --as-needed -L${llvmPackages.libcxx}/lib -lc++ -lc++abi -lLLVM-${lib.versions.major llvmPackages.llvm.version} --pop-state"
     ++ optional (stdenv.isDarwin && !withBundledLLVM) "-lc++ -lc++abi"
     ++ optional stdenv.isFreeBSD "-rpath ${llvmPackages.libunwind}/lib"
-    ++ optional stdenv.isDarwin "-rpath ${llvmSharedForHost}/lib");
+    ++ optional stdenv.isDarwin "-rpath ${llvmSharedForHost.lib}/lib");
 
   # Increase codegen units to introduce parallelism within the compiler.
   RUSTFLAGS = "-Ccodegen-units=10";
-
   RUSTDOCFLAGS = "-A rustdoc::broken-intra-doc-links";
 
   # We need rust to build rust. If we don't provide it, configure will try to download it.
@@ -152,7 +155,7 @@ in stdenv.mkDerivation (finalAttrs: {
     # Since fastCross only builds std, it doesn't make sense (and
     # doesn't work) to build a linker.
     "--disable-llvm-bitcode-linker"
-  ] ++ optionals (stdenv.isLinux && !stdenv.targetPlatform.isRedox) [
+  ] ++ optionals (stdenv.isLinux && !stdenv.targetPlatform.isRedox && !(stdenv.targetPlatform.useLLVM or false)) [
     "--enable-profiler" # build libprofiler_builtins
   ] ++ optionals stdenv.buildPlatform.isMusl [
     "${setBuild}.musl-root=${pkgsBuildBuild.targetPackages.stdenv.cc.libc}"
@@ -165,6 +168,10 @@ in stdenv.mkDerivation (finalAttrs: {
   ] ++ optionals (stdenv.isDarwin && stdenv.isx86_64) [
     # https://github.com/rust-lang/rust/issues/92173
     "--set rust.jemalloc"
+  ] ++ optionals useLLVM [
+    # https://github.com/NixOS/nixpkgs/issues/311930
+    "--llvm-libunwind=${if withBundledLLVM then "in-tree" else "system"}"
+    "--enable-use-libcxx"
   ];
 
   # if we already have a rust compiler for build just compile the target std
@@ -189,6 +196,7 @@ in stdenv.mkDerivation (finalAttrs: {
     python ./x.py --keep-stage=0 --stage=1 install library/std
     mkdir -v $out/bin $doc $man
     ln -s ${rustc.unwrapped}/bin/{rustc,rustdoc} $out/bin
+    rm -rf -v $out/lib/rustlib/{manifest-rust-std-,}${stdenv.hostPlatform.rust.rustcTargetSpec}
     ln -s ${rustc.unwrapped}/lib/rustlib/{manifest-rust-std-,}${stdenv.hostPlatform.rust.rustcTargetSpec} $out/lib/rustlib/
     echo rust-std-${stdenv.hostPlatform.rust.rustcTargetSpec} >> $out/lib/rustlib/components
     lndir ${rustc.doc} $doc
@@ -248,7 +256,16 @@ in stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ openssl ]
     ++ optionals stdenv.isDarwin [ libiconv Security ]
-    ++ optional (!withBundledLLVM) llvmShared;
+    ++ optional (!withBundledLLVM) llvmShared.lib
+    ++ optional (useLLVM && !withBundledLLVM) [
+      llvmPackages.libunwind
+      # Hack which is used upstream https://github.com/gentoo/gentoo/blob/master/dev-lang/rust/rust-1.78.0.ebuild#L284
+      (runCommandLocal "libunwind-libgcc" {} ''
+        mkdir -p $out/lib
+        ln -s ${llvmPackages.libunwind}/lib/libunwind.so $out/lib/libgcc_s.so
+        ln -s ${llvmPackages.libunwind}/lib/libunwind.so $out/lib/libgcc_s.so.1
+      '')
+    ];
 
   outputs = [ "out" "man" "doc" ];
   setOutputFlags = false;
diff --git a/pkgs/development/compilers/vala/setup-hook.sh b/pkgs/development/compilers/vala/setup-hook.sh
index 53976e5cd0db..5e7bc352718f 100644
--- a/pkgs/development/compilers/vala/setup-hook.sh
+++ b/pkgs/development/compilers/vala/setup-hook.sh
@@ -7,15 +7,6 @@ make_vala_find_vapi_files() {
 
 addEnvHooks "$targetOffset" make_vala_find_vapi_files
 
-disable_incompabile_pointer_conversion_warning() {
-    # Work around incompatible function pointer conversion errors with clang 16
-    # by setting ``-Wno-incompatible-function-pointer-types` in an env hook.
-    # See https://gitlab.gnome.org/GNOME/vala/-/issues/1413.
-    NIX_CFLAGS_COMPILE+=" -Wno-incompatible-function-pointer-types"
-}
-
-addEnvHooks "$hostOffset" disable_incompabile_pointer_conversion_warning
-
 _multioutMoveVapiDirs() {
   moveToOutput share/vala/vapi "${!outputDev}"
   moveToOutput share/vala-@apiVersion@/vapi "${!outputDev}"
diff --git a/pkgs/development/compilers/zig/0.10/default.nix b/pkgs/development/compilers/zig/0.10/default.nix
index 170edafa819c..5c01521f08fd 100644
--- a/pkgs/development/compilers/zig/0.10/default.nix
+++ b/pkgs/development/compilers/zig/0.10/default.nix
@@ -89,6 +89,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     hook = callPackage ./hook.nix { zig = finalAttrs.finalPackage; };
+    cc = callPackage ../cc.nix { zig = finalAttrs.finalPackage; };
+    stdenv = callPackage ../stdenv.nix { zig = finalAttrs.finalPackage; };
     tests = {
       version = testers.testVersion {
         package = finalAttrs.finalPackage;
diff --git a/pkgs/development/compilers/zig/0.11/default.nix b/pkgs/development/compilers/zig/0.11/default.nix
index 0f19f455cbb0..91e753dbf0fe 100644
--- a/pkgs/development/compilers/zig/0.11/default.nix
+++ b/pkgs/development/compilers/zig/0.11/default.nix
@@ -83,6 +83,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     hook = callPackage ./hook.nix { zig = finalAttrs.finalPackage; };
+    cc = callPackage ../cc.nix { zig = finalAttrs.finalPackage; };
+    stdenv = callPackage ../stdenv.nix { zig = finalAttrs.finalPackage; };
     tests = {
       version = testers.testVersion {
         package = finalAttrs.finalPackage;
diff --git a/pkgs/development/compilers/zig/0.12/default.nix b/pkgs/development/compilers/zig/0.12/default.nix
index 88bb0169dd8a..1a730d4c0ce7 100644
--- a/pkgs/development/compilers/zig/0.12/default.nix
+++ b/pkgs/development/compilers/zig/0.12/default.nix
@@ -95,6 +95,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     hook = callPackage ./hook.nix { zig = finalAttrs.finalPackage; };
+    cc = callPackage ../cc.nix { zig = finalAttrs.finalPackage; };
+    stdenv = callPackage ../stdenv.nix { zig = finalAttrs.finalPackage; };
     tests = {
       version = testers.testVersion {
         package = finalAttrs.finalPackage;
diff --git a/pkgs/development/compilers/zig/0.13/default.nix b/pkgs/development/compilers/zig/0.13/default.nix
index 0c72b459facf..43093c822f02 100644
--- a/pkgs/development/compilers/zig/0.13/default.nix
+++ b/pkgs/development/compilers/zig/0.13/default.nix
@@ -95,6 +95,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     hook = callPackage ./hook.nix { zig = finalAttrs.finalPackage; };
+    cc = callPackage ../cc.nix { zig = finalAttrs.finalPackage; };
+    stdenv = callPackage ../stdenv.nix { zig = finalAttrs.finalPackage; };
     tests = {
       version = testers.testVersion {
         package = finalAttrs.finalPackage;
diff --git a/pkgs/development/compilers/zig/0.9/default.nix b/pkgs/development/compilers/zig/0.9/default.nix
index 079773f00e88..72e05c879a59 100644
--- a/pkgs/development/compilers/zig/0.9/default.nix
+++ b/pkgs/development/compilers/zig/0.9/default.nix
@@ -91,6 +91,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     hook = callPackage ./hook.nix { zig = finalAttrs.finalPackage; };
+    cc = callPackage ../cc.nix { zig = finalAttrs.finalPackage; };
+    stdenv = callPackage ../stdenv.nix { zig = finalAttrs.finalPackage; };
     tests = {
       version = testers.testVersion {
         package = finalAttrs.finalPackage;
diff --git a/pkgs/development/compilers/zig/cc.nix b/pkgs/development/compilers/zig/cc.nix
new file mode 100644
index 000000000000..dc94e918814d
--- /dev/null
+++ b/pkgs/development/compilers/zig/cc.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  wrapCCWith,
+  makeWrapper,
+  runCommand,
+  targetPlatform,
+  targetPackages,
+  zig,
+}:
+wrapCCWith {
+  cc =
+    runCommand "zig-cc-${zig.version}"
+      {
+        pname = "zig-cc";
+        inherit (zig) version meta;
+
+        nativeBuildInputs = [ makeWrapper ];
+
+        passthru.isZig = true;
+        inherit zig;
+      }
+      ''
+        mkdir -p $out/bin
+        for tool in ar cc c++ objcopy; do
+          makeWrapper "$zig/bin/zig" "$out/bin/$tool" \
+            --add-flags "$tool" \
+            --run "export ZIG_GLOBAL_CACHE_DIR=\$(mktemp -d)"
+        done
+
+        mv $out/bin/c++ $out/bin/clang++
+        mv $out/bin/cc $out/bin/clang
+      '';
+
+  nixSupport.cc-cflags =
+    [
+      "-target"
+      "${targetPlatform.parsed.cpu.name}-${targetPlatform.parsed.kernel.name}-${targetPlatform.parsed.abi.name}"
+    ]
+    ++ lib.optional (
+      targetPlatform.isLinux && !(targetPackages.isStatic or false)
+    ) "-Wl,-dynamic-linker=${targetPackages.stdenv.cc.bintools.dynamicLinker}";
+}
diff --git a/pkgs/development/compilers/zig/generic.nix b/pkgs/development/compilers/zig/generic.nix
index 3369f5d40c2c..cde1a61e3583 100644
--- a/pkgs/development/compilers/zig/generic.nix
+++ b/pkgs/development/compilers/zig/generic.nix
@@ -71,6 +71,12 @@ stdenv.mkDerivation (finalAttrs: {
     hook = callPackage ./hook.nix {
       zig = finalAttrs.finalPackage;
     };
+    cc = callPackage ./cc.nix {
+      zig = finalAttrs.finalPackage;
+    };
+    stdenv = callPackage ./stdenv.nix {
+      zig = finalAttrs.finalPackage;
+    };
   };
 
   meta = {
diff --git a/pkgs/development/compilers/zig/stdenv.nix b/pkgs/development/compilers/zig/stdenv.nix
new file mode 100644
index 000000000000..e8b29a7c8aba
--- /dev/null
+++ b/pkgs/development/compilers/zig/stdenv.nix
@@ -0,0 +1,6 @@
+{
+  stdenv,
+  overrideCC,
+  zig,
+}:
+overrideCC stdenv zig.cc
diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index c54553d66dc7..f59e9fc93c64 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -150,35 +150,6 @@ assert stdenv.hostPlatform.isWasm -> enableStaticLibraries == false;
 
 let
 
-  # This is a workaround for the 2024-07-20 staging-next cycle to avoid causing mass rebuilds.
-  # todo(@reckenrode) Remove this workaround and remove `NIX_COREFOUNDATION_RPATH`, the related hooks, and ld-wrapper support.
-  nixCoreFoundationRpathWorkaround = stdenv.mkDerivation {
-    name = "nix-corefoundation-rpath-workaround";
-    buildCommand = ''
-      mkdir -p "$out/nix-support"
-      cat <<-EOF > "$out/nix-support/setup-hook"
-      removeUseSystemCoreFoundationFrameworkHook() {
-        unset NIX_COREFOUNDATION_RPATH
-        local _hook
-        for _hook in envBuildBuildHooks envBuildHostHooks envBuildTargetHooks envHostHostHooks envHostTargetHooks envTargetTargetHooks; do
-          local _index=0
-          local _var="\$_hook[@]"
-          for _var in "\''${!_var}"; do
-            if [ "\$_var" = "useSystemCoreFoundationFramework" ]; then
-              unset "\$_hook[\$_index]"
-            fi
-            ((++_index))
-          done
-          unset _index
-          unset _var
-        done
-        unset _hook
-      }
-      addEnvHooks "\$hostOffset" removeUseSystemCoreFoundationFrameworkHook
-      EOF
-    '';
-  };
-
   inherit (lib) optional optionals optionalString versionAtLeast
                        concatStringsSep enableFeature optionalAttrs;
 
@@ -459,8 +430,7 @@ stdenv.mkDerivation ({
   inherit depsBuildBuild nativeBuildInputs;
   buildInputs = otherBuildInputs ++ optionals (!isLibrary) propagatedBuildInputs
     # For patchShebangsAuto in fixupPhase
-    ++ optionals stdenv.hostPlatform.isGhcjs [ nodejs ]
-    ++ optionals (stdenv.isDarwin && stdenv.isx86_64) [ nixCoreFoundationRpathWorkaround ];
+    ++ optionals stdenv.hostPlatform.isGhcjs [ nodejs ];
   propagatedBuildInputs = optionals isLibrary propagatedBuildInputs;
 
   LANG = "en_US.UTF-8";         # GHC needs the locale configured during the Haddock phase.
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 2ee6ff9b13ba..596c778c0ff5 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -173,14 +173,6 @@ let
           export HOME=$TMPDIR
         '';
 
-        # Work around useSystemCoreFoundationFramework hook causing issues with the ld64 upgrade.
-        # This will be fixed on staging in https://github.com/NixOS/nixpkgs/pull/329529
-        preBuild =
-          if lib.versionAtLeast ver.majMin "3.3" && stdenv.isDarwin && stdenv.isx86_64 then
-            "unset NIX_COREFOUNDATION_RPATH"
-          else
-            null;
-
         # fails with "16993 tests, 2229489 assertions, 105 failures, 14 errors, 89 skips"
         # mostly TZ- and patch-related tests
         # TZ- failures are caused by nix sandboxing, I didn't investigate others
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 816afa176754..2a6a5864d25e 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -1,56 +1,57 @@
-{ lib
-, stdenv
-, config
-, fetchFromGitHub
-, nix-update-script
-, pkg-config
-, libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms
-, openglSupport ? libGLSupported
-, libGL
-, alsaSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
-, alsa-lib
-, x11Support ? !stdenv.hostPlatform.isWindows && !stdenv.hostPlatform.isAndroid
-, libX11
-, xorgproto
-, libICE
-, libXi
-, libXScrnSaver
-, libXcursor
-, libXinerama
-, libXext
-, libXxf86vm
-, libXrandr
-, waylandSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
-, wayland
-, wayland-protocols
-, wayland-scanner
-, drmSupport ? false
-, libdrm
-, mesa
-, libxkbcommon
-, dbusSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
-, dbus
-, udevSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
-, udev
-, ibusSupport ? false
-, ibus
-, libdecorSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
-, libdecor
-, pipewireSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid
-, pipewire # NOTE: must be built with SDL2 without pipewire support
-, pulseaudioSupport ? config.pulseaudio or stdenv.isLinux && !stdenv.hostPlatform.isAndroid
-, libpulseaudio
-, AudioUnit
-, Cocoa
-, CoreAudio
-, CoreServices
-, ForceFeedback
-, OpenGL
-, audiofile
-, libiconv
-, withStatic ? stdenv.hostPlatform.isMinGW
+{
+  lib,
+  stdenv,
+  config,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  libGLSupported ? lib.elem stdenv.hostPlatform.system lib.platforms.mesaPlatforms,
+  openglSupport ? libGLSupported,
+  libGL,
+  alsaSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid,
+  alsa-lib,
+  x11Support ? !stdenv.hostPlatform.isWindows && !stdenv.hostPlatform.isAndroid,
+  libX11,
+  xorgproto,
+  libICE,
+  libXi,
+  libXScrnSaver,
+  libXcursor,
+  libXinerama,
+  libXext,
+  libXxf86vm,
+  libXrandr,
+  waylandSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid,
+  wayland,
+  wayland-protocols,
+  wayland-scanner,
+  drmSupport ? false,
+  libdrm,
+  mesa,
+  libxkbcommon,
+  dbusSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid,
+  dbus,
+  udevSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid,
+  udev,
+  ibusSupport ? false,
+  ibus,
+  libdecorSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid,
+  libdecor,
+  pipewireSupport ? stdenv.isLinux && !stdenv.hostPlatform.isAndroid,
+  pipewire, # NOTE: must be built with SDL2 without pipewire support
+  pulseaudioSupport ? config.pulseaudio or stdenv.isLinux && !stdenv.hostPlatform.isAndroid,
+  libpulseaudio,
+  AudioUnit,
+  Cocoa,
+  CoreAudio,
+  CoreServices,
+  ForceFeedback,
+  OpenGL,
+  audiofile,
+  libiconv,
+  withStatic ? stdenv.hostPlatform.isMinGW,
   # passthru.tests
-, testers
+  testers,
 }:
 
 # NOTE: When editing this expression see if the same change applies to
@@ -58,16 +59,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2";
-  version = "2.30.4";
+  version = "2.30.5";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-RhqbmS+mPVlXlo4/jrqPqtyGzvfaPTozlUEeAjHUBoA=";
+    hash = "sha256-ZonlvXAAWCTfDYf/w5RxP1Av67v89kex4H43xkbPYEA=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
-  outputs = [ "out" "dev" ];
+  outputs = [
+    "out"
+    "dev"
+  ];
   outputBin = "dev"; # sdl-config
 
   patches = [
@@ -89,41 +93,74 @@ stdenv.mkDerivation (finalAttrs: {
 
   depsBuildBuild = [ pkg-config ];
 
-  nativeBuildInputs = [ pkg-config ] ++ lib.optionals waylandSupport [ wayland wayland-scanner ];
+  nativeBuildInputs =
+    [ pkg-config ]
+    ++ lib.optionals waylandSupport [
+      wayland
+      wayland-scanner
+    ];
 
-  dlopenPropagatedBuildInputs = [ ]
+  dlopenPropagatedBuildInputs =
+    [ ]
     # Propagated for #include <GLES/gl.h> in SDL_opengles.h.
     ++ lib.optional (openglSupport && !stdenv.isDarwin) libGL
     # Propagated for #include <X11/Xlib.h> and <X11/Xatom.h> in SDL_syswm.h.
     ++ lib.optionals x11Support [ libX11 ];
 
-  propagatedBuildInputs = lib.optionals x11Support [ xorgproto ]
-    ++ finalAttrs.dlopenPropagatedBuildInputs;
+  propagatedBuildInputs =
+    lib.optionals x11Support [ xorgproto ] ++ finalAttrs.dlopenPropagatedBuildInputs;
 
-  dlopenBuildInputs = lib.optionals alsaSupport [ alsa-lib audiofile ]
+  dlopenBuildInputs =
+    lib.optionals alsaSupport [
+      alsa-lib
+      audiofile
+    ]
     ++ lib.optional dbusSupport dbus
     ++ lib.optional libdecorSupport libdecor
     ++ lib.optional pipewireSupport pipewire
     ++ lib.optional pulseaudioSupport libpulseaudio
     ++ lib.optional udevSupport udev
-    ++ lib.optionals waylandSupport [ wayland libxkbcommon ]
-    ++ lib.optionals x11Support [ libICE libXi libXScrnSaver libXcursor libXinerama libXext libXrandr libXxf86vm ]
-    ++ lib.optionals drmSupport [ libdrm mesa ];
+    ++ lib.optionals waylandSupport [
+      wayland
+      libxkbcommon
+    ]
+    ++ lib.optionals x11Support [
+      libICE
+      libXi
+      libXScrnSaver
+      libXcursor
+      libXinerama
+      libXext
+      libXrandr
+      libXxf86vm
+    ]
+    ++ lib.optionals drmSupport [
+      libdrm
+      mesa
+    ];
 
-  buildInputs = [ libiconv ]
+  buildInputs =
+    [ libiconv ]
     ++ finalAttrs.dlopenBuildInputs
     ++ lib.optional ibusSupport ibus
     ++ lib.optionals waylandSupport [ wayland-protocols ]
-    ++ lib.optionals stdenv.isDarwin [ AudioUnit Cocoa CoreAudio CoreServices ForceFeedback OpenGL ];
+    ++ lib.optionals stdenv.isDarwin [
+      AudioUnit
+      Cocoa
+      CoreAudio
+      CoreServices
+      ForceFeedback
+      OpenGL
+    ];
 
   enableParallelBuilding = true;
 
-  configureFlags = [
-    "--disable-oss"
-  ] ++ lib.optional (!x11Support) "--without-x"
-  ++ lib.optional alsaSupport "--with-alsa-prefix=${alsa-lib.out}/lib"
-  ++ lib.optional stdenv.hostPlatform.isWindows "--disable-video-opengles"
-  ++ lib.optional stdenv.isDarwin "--disable-sdltest";
+  configureFlags =
+    [ "--disable-oss" ]
+    ++ lib.optional (!x11Support) "--without-x"
+    ++ lib.optional alsaSupport "--with-alsa-prefix=${alsa-lib.out}/lib"
+    ++ lib.optional stdenv.hostPlatform.isWindows "--disable-video-opengles"
+    ++ lib.optional stdenv.isDarwin "--disable-sdltest";
 
   # We remove libtool .la files when static libs are requested,
   # because they make the builds of downstream libs like `SDL_tff`
@@ -158,7 +195,9 @@ stdenv.mkDerivation (finalAttrs: {
   # list the symbols used in this way.
   postFixup =
     let
-      rpath = lib.makeLibraryPath (finalAttrs.dlopenPropagatedBuildInputs ++ finalAttrs.dlopenBuildInputs);
+      rpath = lib.makeLibraryPath (
+        finalAttrs.dlopenPropagatedBuildInputs ++ finalAttrs.dlopenBuildInputs
+      );
     in
     lib.optionalString (stdenv.hostPlatform.extensions.sharedLibrary == ".so") ''
       for lib in $out/lib/*.so* ; do
@@ -172,10 +211,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     inherit openglSupport;
-    updateScript = nix-update-script { extraArgs = [ "--version-regex" "release-(.*)" ]; };
-    tests.pkg-config = testers.hasPkgConfigModules {
-      package = finalAttrs.finalPackage;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "release-(.*)"
+      ];
     };
+    tests.pkg-config = testers.hasPkgConfigModules { package = finalAttrs.finalPackage; };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/abseil-cpp/202401.nix b/pkgs/development/libraries/abseil-cpp/202407.nix
similarity index 77%
rename from pkgs/development/libraries/abseil-cpp/202401.nix
rename to pkgs/development/libraries/abseil-cpp/202407.nix
index 8352007b3413..49e18c271e64 100644
--- a/pkgs/development/libraries/abseil-cpp/202401.nix
+++ b/pkgs/development/libraries/abseil-cpp/202407.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abseil-cpp";
-  version = "20240116.2";
+  version = "20240722.0";
 
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-cpp";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-eA2/dZpNOlex1O5PNa3XSZhpMB3AmaIoHzVDI9TD/cg=";
+    hash = "sha256-51jpDhdZ0n+KLmxh8KVaTz53pZAB0dHjmILFX+OLud4=";
   };
 
   cmakeFlags = [
@@ -32,11 +32,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gtest ];
 
-  meta = with lib; {
+  meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
-    license = licenses.asl20;
-    platforms = platforms.all;
-    maintainers = [ maintainers.GaetanLepage ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.GaetanLepage ];
   };
 })
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index 8e32ae89502b..a08b93a9b0e5 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.7.8";
+  version = "0.7.9";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    hash = "sha256-h3eMgEaiJsbL+xFPTI4+J8Eht7PczOXLfeRYmSUCdMw=";
+    hash = "sha256-A4bpGNddeX551bFO3QhHFl2LNZ6YEe9XZSwKNWot/PQ=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index d07a7fc52996..cbd997127d7a 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.7.22";
+  version = "0.7.23";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    hash = "sha256-8+SFag3hRQ+1aOK2vuHOV/gXE1qUIlAW5LNJDmUORLs=";
+    hash = "sha256-WQ5mJrPGsjsBGUHGott0wiDbgMbPMgOEt0TkHOvAR9w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/db/clang-4.8.patch b/pkgs/development/libraries/db/clang-4.8.patch
index 0aff87682037..bf0de55fc1bf 100644
--- a/pkgs/development/libraries/db/clang-4.8.patch
+++ b/pkgs/development/libraries/db/clang-4.8.patch
@@ -153,22 +153,42 @@ diff -ur a/dist/aclocal/clock.m4 b/dist/aclocal/clock.m4
 diff -ur a/dist/aclocal/mutex.m4 b/dist/aclocal/mutex.m4
 --- a/dist/aclocal/mutex.m4	1969-12-31 19:00:01.000000000 -0500
 +++ b/dist/aclocal/mutex.m4	2023-06-05 19:14:47.214158196 -0400
-@@ -4,6 +4,7 @@
+@@ -3,7 +3,9 @@
+ # POSIX pthreads tests: inter-process safe and intra-process only.
  AC_DEFUN(AM_PTHREADS_SHARED, [
  AC_TRY_RUN([
++#include <stdlib.h>
  #include <pthread.h>
 +int
  main() {
  	pthread_cond_t cond;
  	pthread_mutex_t mutex;
-@@ -46,6 +47,7 @@
+@@ -24,6 +26,7 @@ main() {
+ 	pthread_mutexattr_destroy(&mutexattr));
+ }], [db_cv_mutex="$1"],,
+ AC_TRY_LINK([
++#include <stdlib.h>
+ #include <pthread.h>],[
+ 	pthread_cond_t cond;
+ 	pthread_mutex_t mutex;
+@@ -45,7 +48,9 @@ AC_TRY_LINK([
+ ], [db_cv_mutex="$1"]))])
  AC_DEFUN(AM_PTHREADS_PRIVATE, [
  AC_TRY_RUN([
++#include <stdlib.h>
  #include <pthread.h>
 +int
  main() {
  	pthread_cond_t cond;
  	pthread_mutex_t mutex;
+@@ -64,6 +69,7 @@ main() {
+ 	pthread_mutexattr_destroy(&mutexattr));
+ }], [db_cv_mutex="$1"],,
+ AC_TRY_LINK([
++#include <stdlib.h>
+ #include <pthread.h>],[
+ 	pthread_cond_t cond;
+ 	pthread_mutex_t mutex;
 diff -ur a/dist/aclocal/sequence.m4 b/dist/aclocal/sequence.m4
 --- a/dist/aclocal/sequence.m4	1969-12-31 19:00:01.000000000 -0500
 +++ b/dist/aclocal/sequence.m4	2023-06-05 19:14:02.007869956 -0400
@@ -183,7 +203,7 @@ diff -ur a/dist/aclocal/sequence.m4 b/dist/aclocal/sequence.m4
  			$db_cv_seq_type l;
  			unsigned $db_cv_seq_type u;
 @@ -59,7 +62,9 @@
-				return (1);
+ 				return (1);
  			return (0);
  		}],, [db_cv_build_sequence="no"],
 -		AC_TRY_LINK(,[
diff --git a/pkgs/development/libraries/db/db-4.8.nix b/pkgs/development/libraries/db/db-4.8.nix
index 4d6029d6d821..81705374381e 100644
--- a/pkgs/development/libraries/db/db-4.8.nix
+++ b/pkgs/development/libraries/db/db-4.8.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchurl, autoreconfHook, targetPlatform, ... } @ args:
+{ lib, stdenv, fetchurl, autoreconfHook, ... } @ args:
 
-import ./generic.nix (builtins.removeAttrs args ["targetPlatform"] // {
+import ./generic.nix (args // {
   version = "4.8.30";
   sha256 = "0ampbl2f0hb1nix195kz1syrqqxpmvnvnfvphambj7xjrl3iljg0";
   extraPatches = [
@@ -9,8 +9,6 @@ import ./generic.nix (builtins.removeAttrs args ["targetPlatform"] // {
     ./darwin-mutexes-4.8.patch
   ];
 
-  drvArgs.configureFlags = lib.optional (targetPlatform.useLLVM or false) "--with-mutex=POSIX/pthreads";
-
   drvArgs.hardeningDisable = [ "format" ];
   drvArgs.doCheck = false;
 })
diff --git a/pkgs/development/libraries/db/generic.nix b/pkgs/development/libraries/db/generic.nix
index ddb4139e116d..d715c1ffc8b1 100644
--- a/pkgs/development/libraries/db/generic.nix
+++ b/pkgs/development/libraries/db/generic.nix
@@ -67,8 +67,7 @@ stdenv.mkDerivation (rec {
       (if compat185 then "--enable-compat185" else "--disable-compat185")
     ]
     ++ lib.optional dbmSupport "--enable-dbm"
-    ++ lib.optional stdenv.isFreeBSD "--with-pic"
-    ++ (drvArgs.configureFlags or []);
+    ++ lib.optional stdenv.isFreeBSD "--with-pic";
 
   preConfigure = ''
     cd build_unix
@@ -93,4 +92,4 @@ stdenv.mkDerivation (rec {
     license = license;
     platforms = platforms.unix;
   };
-} // builtins.removeAttrs drvArgs [ "configureFlags" ])
+} // drvArgs)
diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index a4869184bdc6..f17ef87dd820 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -18,8 +18,8 @@ let
     );
 
   v4 = {
-    version = "4.4.4";
-    hash = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
+    version = "4.4.5";
+    hash = "sha256-GrKNGYI8kO47Yoi82dMV30ymuXSjxo4gH+yB8jIUa2A=";
   };
 
   v6 = {
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 4d73c8ae72be..a49e6bf7cc33 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -34,7 +34,7 @@
 
   # Feature flags
 , withAlsa ? withHeadlessDeps && stdenv.isLinux # Alsa in/output supporT
-, withAom ? withFullDeps # AV1 reference encoder
+, withAom ? withHeadlessDeps # AV1 reference encoder
 , withAppKit ? withHeadlessDeps && stdenv.isDarwin # Apple AppKit framework
 , withAribcaption ? withFullDeps && lib.versionAtLeast version "6.1" # ARIB STD-B24 Caption Decoder/Renderer
 , withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
@@ -45,7 +45,7 @@
 , withBs2b ? withFullDeps # bs2b DSP library
 , withBzlib ? withHeadlessDeps
 , withCaca ? withFullDeps # Textual display (ASCII art)
-, withCelt ? withFullDeps # CELT decoder
+, withCelt ? withHeadlessDeps # CELT decoder
 , withChromaprint ? withFullDeps # Audio fingerprinting
 , withCodec2 ? withFullDeps # codec2 en/decoding
 , withCoreImage ? withHeadlessDeps && stdenv.isDarwin # Apple CoreImage framework
@@ -88,7 +88,7 @@
 , withOpencoreAmrwb ? withFullDeps && withVersion3 # AMR-WB decoder
 , withOpengl ? withFullDeps && !stdenv.isDarwin # OpenGL rendering
 , withOpenh264 ? withFullDeps # H.264/AVC encoder
-, withOpenjpeg ? withFullDeps # JPEG 2000 de/encoder
+, withOpenjpeg ? withHeadlessDeps # JPEG 2000 de/encoder
 , withOpenmpt ? withFullDeps # Tracked music files decoder
 , withOpus ? withHeadlessDeps # Opus de/encoder
 , withPlacebo ? withFullDeps && !stdenv.isDarwin # libplacebo video processing library
@@ -121,7 +121,7 @@
 , withVpl ? false # Hardware acceleration via intel libvpl
 , withVpx ? withHeadlessDeps && stdenv.buildPlatform == stdenv.hostPlatform # VP8 & VP9 de/encoding
 , withVulkan ? withSmallDeps && !stdenv.isDarwin
-, withWebp ? withFullDeps # WebP encoder
+, withWebp ? withHeadlessDeps # WebP encoder
 , withX264 ? withHeadlessDeps && withGPL # H.264/AVC encoder
 , withX265 ? withHeadlessDeps && withGPL # H.265/HEVC encoder
 , withXavs ? withFullDeps && withGPL # AVS encoder
@@ -402,36 +402,6 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   patches = []
-    ++ optionals (versionOlder version "5") [
-      (fetchpatch2 {
-        name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
-        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/031f1561cd286596cdb374da32f8aa816ce3b135";
-        hash = "sha256-agJgzIzrBTQBAypuCmGXXFo7vw6Iodw5Ny5O5QCKCn8=";
-      })
-      (fetchpatch2 {
-        # Backport fix for binutils-2.41.
-        name = "binutils-2.41.patch";
-        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/effadce6c756247ea8bae32dc13bb3e6f464f0eb";
-        hash = "sha256-vLSltvZVMcQ0CnkU0A29x6fJSywE8/aU+Mp9os8DZYY=";
-      })
-      # The upstream patch isn’t for ffmpeg 4, but it will apply with a few tweaks.
-      # Fixes a crash when built with clang 16 due to UB in ff_seek_frame_binary.
-      (fetchpatch2 {
-        name = "utils-fix_crash_in_ff_seek_frame_binary.patch";
-        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/ab792634197e364ca1bb194f9abe36836e42f12d";
-        hash = "sha256-vqqVACjbCcGL9Qvmg1QArSKqVmOqr8BEr+OxTBDt6mA=";
-        postFetch = ''
-          substituteInPlace "$out" \
-            --replace libavformat/seek.c libavformat/utils.c \
-            --replace 'const AVInputFormat *const ' 'const AVInputFormat *'
-        '';
-      })
-      (fetchpatch2 {
-        name = "CVE-2023-51794.patch";
-        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/50f0f8c53c818f73fe2d752708e2fa9d2a2d8a07";
-        hash = "sha256-5G9lmKjMEa0+vqbA8EEiNIr6QG+PeEoIL+uZP4Hlo28=";
-      })
-    ]
     ++ optionals (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2") [
       (fetchpatch2 { # this can be removed post 6.1
         name = "fix_build_failure_due_to_PropertyKey_EncoderID";
diff --git a/pkgs/development/libraries/fribidi/default.nix b/pkgs/development/libraries/fribidi/default.nix
index 768c2185a158..f5d6bcc7df34 100644
--- a/pkgs/development/libraries/fribidi/default.nix
+++ b/pkgs/development/libraries/fribidi/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fribidi";
-  version = "1.0.14";
+  version = "1.0.15";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   # NOTE: Only URL tarball has "Have pre-generated man pages: true", which works-around upstream usage of some rare ancient `c2man` fossil application.
   src = fetchurl {
     url = with finalAttrs; "https://github.com/fribidi/fribidi/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-dq4gSnAnZSrDmBufpYF8CDuiMRQ0AoTFjnVrJZzSJZo=";
+    sha256 = "sha256-C7x/9jO/ogiuMtfjac9afSDV0lV6CwZ8mqmLy/mWdYc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
deleted file mode 100644
index d6ed7d32e701..000000000000
--- a/pkgs/development/libraries/gdbm/default.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{ stdenv, lib, fetchurl, updateAutotoolsGnuConfigScriptsHook }:
-
-stdenv.mkDerivation rec {
-  pname = "gdbm";
-  version = "1.23";
-
-  src = fetchurl {
-    url = "mirror://gnu/gdbm/${pname}-${version}.tar.gz";
-    sha256 = "sha256-dLEIHSH/8TrkvXwW5dblBKTCb3zeHcoNljpIQXS7ys0=";
-  };
-
-  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
-
-  doCheck = true; # not cross;
-
-  # Linking static stubs on cygwin requires correct ordering.
-  # Consider upstreaming this.
-
-  # Disable dbmfetch03.at test because it depends on unlink()
-  # failing on a link in a chmod -w directory, which cygwin
-  # apparently allows.
-  postPatch = lib.optionalString stdenv.buildPlatform.isCygwin ''
-      substituteInPlace tests/Makefile.in --replace \
-        '_LDADD = ../src/libgdbm.la ../compat/libgdbm_compat.la' \
-        '_LDADD = ../compat/libgdbm_compat.la ../src/libgdbm.la'
-      substituteInPlace tests/testsuite.at --replace \
-        'm4_include([dbmfetch03.at])' ""
-  '';
-
-  enableParallelBuilding = true;
-  configureFlags = [ "--enable-libgdbm-compat" ];
-
-  # create symlinks for compatibility
-  postInstall = ''
-    install -dm755 $out/include/gdbm
-    (
-      cd $out/include/gdbm
-      ln -s ../gdbm.h gdbm.h
-      ln -s ../ndbm.h ndbm.h
-      ln -s ../dbm.h  dbm.h
-    )
-  '';
-
-  meta = with lib; {
-    description = "GNU dbm key/value database library";
-    longDescription = ''
-       GNU dbm (or GDBM, for short) is a library of database functions that
-       use extensible hashing and work similar to the standard UNIX dbm.
-       These routines are provided to a programmer needing to create and
-       manipulate a hashed database.
-
-       The basic use of GDBM is to store key/data pairs in a data file.
-       Each key must be unique and each key is paired with only one data
-       item.
-
-       The library provides primitives for storing key/data pairs,
-       searching and retrieving the data by its key and deleting a key
-       along with its data.  It also support sequential iteration over all
-       key/data pairs in a database.
-
-       For compatibility with programs using old UNIX dbm function, the
-       package also provides traditional dbm and ndbm interfaces.
-      '';
-    homepage = "https://www.gnu.org/software/gdbm/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.all;
-    maintainers = [ maintainers.vrthra ];
-  };
-}
diff --git a/pkgs/development/libraries/glibc/2.39-revert-cet-default-disable.patch b/pkgs/development/libraries/glibc/2.39-revert-cet-default-disable.patch
new file mode 100644
index 000000000000..8590581daf0b
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.39-revert-cet-default-disable.patch
@@ -0,0 +1,49 @@
+Revert 55d63e731253de82e96ed4ddca2e294076cd0bc5
+
+--- b/sysdeps/x86/cpu-features.c
++++ a/sysdeps/x86/cpu-features.c
+@@ -110,7 +110,7 @@
+   if (!CPU_FEATURES_CPU_P (cpu_features, RTM_ALWAYS_ABORT))
+     CPU_FEATURE_SET_ACTIVE (cpu_features, RTM);
+ 
++#if CET_ENABLED
+-#if CET_ENABLED && 0
+   CPU_FEATURE_SET_ACTIVE (cpu_features, IBT);
+   CPU_FEATURE_SET_ACTIVE (cpu_features, SHSTK);
+ #endif
+reverted:
+--- b/sysdeps/x86/cpu-tunables.c
++++ a/sysdeps/x86/cpu-tunables.c
+@@ -35,17 +35,6 @@
+       break;								\
+     }
+ 
+-#define CHECK_GLIBC_IFUNC_CPU_BOTH(f, cpu_features, name, len)		\
+-  _Static_assert (sizeof (#name) - 1 == len, #name " != " #len);	\
+-  if (tunable_str_comma_strcmp_cte (&f, #name))				\
+-    {									\
+-      if (f.disable)							\
+-	CPU_FEATURE_UNSET (cpu_features, name)				\
+-      else								\
+-	CPU_FEATURE_SET_ACTIVE (cpu_features, name)			\
+-      break;								\
+-    }
+-
+ /* Disable a preferred feature NAME.  We don't enable a preferred feature
+    which isn't available.  */
+ #define CHECK_GLIBC_IFUNC_PREFERRED_OFF(f, cpu_features, name, len)	\
+@@ -142,13 +131,11 @@
+ 	    }
+ 	  break;
+ 	case 5:
+-	  {
+-	    CHECK_GLIBC_IFUNC_CPU_BOTH (n, cpu_features, SHSTK, 5);
+-	  }
+ 	  if (n.disable)
+ 	    {
+ 	      CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, LZCNT, 5);
+ 	      CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, MOVBE, 5);
++	      CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, SHSTK, 5);
+ 	      CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, SSSE3, 5);
+ 	      CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, XSAVE, 5);
+ 	    }
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 25a83b1dc6d2..382a1eea076d 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -37,6 +37,7 @@
 , profilingLibraries ? false
 , withGd ? false
 , enableCET ? false
+, enableCETRuntimeDefault ? false
 , extraBuildInputs ? []
 , extraNativeBuildInputs ? []
 , ...
@@ -50,6 +51,7 @@ in
 
 assert withLinuxHeaders -> linuxHeaders != null;
 assert withGd -> gd != null && libpng != null;
+assert enableCET == false -> !enableCETRuntimeDefault;
 
 stdenv.mkDerivation ({
   version = version + patchSuffix;
@@ -114,7 +116,8 @@ stdenv.mkDerivation ({
       lib.optional (isAarch64 && isLinux) ./0001-aarch64-math-vector.h-add-NVCC-include-guard.patch
     )
     ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch
-    ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;
+    ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch
+    ++ lib.optional enableCETRuntimeDefault ./2.39-revert-cet-default-disable.patch;
 
   postPatch =
     ''
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 96a08178637d..532dfd58900f 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -3,6 +3,7 @@
 , profilingLibraries ? false
 , withGd ? false
 , enableCET ? if stdenv.hostPlatform.isx86_64 then "permissive" else false
+, enableCETRuntimeDefault ? false
 , pkgsBuildBuild
 , libgcc
 }:
@@ -16,7 +17,7 @@ let
 in
 
 (callPackage ./common.nix { inherit stdenv; } {
-  inherit withLinuxHeaders withGd profilingLibraries enableCET;
+  inherit withLinuxHeaders withGd profilingLibraries enableCET enableCETRuntimeDefault;
   pname = "glibc" + lib.optionalString withGd "-gd" + lib.optionalString (stdenv.cc.isGNU && libgcc==null) "-nolibgcc";
 }).overrideAttrs(previousAttrs: {
 
@@ -41,9 +42,6 @@ in
 
       # Apparently --bindir is not respected.
       makeFlagsArray+=("bindir=$bin/bin" "sbindir=$bin/sbin" "rootsbindir=$bin/sbin")
-    '' + lib.optionalString stdenv.buildPlatform.isDarwin ''
-      # ld-wrapper will otherwise attempt to inject CoreFoundation into ld-linux's RUNPATH
-      export NIX_COREFOUNDATION_RPATH=
     '';
 
     # The pie, stackprotector and fortify hardening flags are autodetected by
diff --git a/pkgs/development/libraries/gstreamer/rs/Cargo.lock b/pkgs/development/libraries/gstreamer/rs/Cargo.lock
index 52c6518bd51f..7c91f3ef8aee 100644
--- a/pkgs/development/libraries/gstreamer/rs/Cargo.lock
+++ b/pkgs/development/libraries/gstreamer/rs/Cargo.lock
@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.21.0"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
+checksum = "6e4503c46a5c0c7844e948c9a4d6acd9f50cccb4de1c48eb9e291ea17470c678"
 dependencies = [
  "gimli",
 ]
@@ -70,7 +70,7 @@ dependencies = [
  "getrandom",
  "once_cell",
  "version_check",
- "zerocopy 0.7.32",
+ "zerocopy 0.7.34",
 ]
 
 [[package]]
@@ -90,9 +90,9 @@ checksum = "4aa90d7ce82d4be67b64039a3d588d38dbcc6736577de4a847025ce5b0c468d1"
 
 [[package]]
 name = "allocator-api2"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
+checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
 
 [[package]]
 name = "android-tzdata"
@@ -111,47 +111,48 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.13"
+version = "0.6.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
+checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
 dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
+ "is_terminal_polyfill",
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle"
-version = "1.0.6"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
+checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.2"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
+checksum = "ad186efb764318d35165f1758e7dcef3b10628e26d41a44bc5550652e6804391"
 dependencies = [
  "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.2"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
+checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
 dependencies = [
  "anstyle",
  "windows-sys 0.52.0",
@@ -159,9 +160,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.81"
+version = "1.0.86"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0952808a6c2afd1aa8947271f3a60f1a6763c7b912d210184c5149b5cf147247"
+checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
 
 [[package]]
 name = "arbitrary"
@@ -177,7 +178,7 @@ checksum = "0ae92a5119aa49cdbcf6b9f893fe4e1d98b04ccbf82ee0584ad948a44a734dea"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -188,12 +189,11 @@ checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
 
 [[package]]
 name = "async-channel"
-version = "2.2.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f28243a43d821d11341ab73c80bed182dc015c514b951616cf79bd4af39af0c3"
+checksum = "89b47800b0be77592da0afd425cc03468052844aff33b84e33cc696f64e77b6a"
 dependencies = [
  "concurrent-queue",
- "event-listener",
  "event-listener-strategy",
  "futures-core",
  "pin-project-lite",
@@ -201,9 +201,9 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.8"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07dbbf24db18d609b1462965249abdf49129ccad073ec257da372adc83259c60"
+checksum = "cd066d0b4ef8ecb03a55319dc13aa6910616d0f44008a045bb1835af830abff5"
 dependencies = [
  "flate2",
  "futures-core",
@@ -214,13 +214,13 @@ dependencies = [
 
 [[package]]
 name = "async-recursion"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30c5ef0ede93efbf733c1a727f3b6b5a1060bbedd5600183e66f6e4be4af0ec5"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -242,31 +242,31 @@ checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "async-task"
-version = "4.7.0"
+version = "4.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbb36e985947064623dbd357f727af08ffd077f93d696782f3c56365fa2e2799"
+checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
 
 [[package]]
 name = "async-trait"
-version = "0.1.79"
+version = "0.1.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a507401cad91ec6a857ed5513a2073c82a9b9048762b885bb98655b306964681"
+checksum = "c6fa2087f2753a7da8cc1c0dbfcf89579dd57458e36769de5ac750b4671737ca"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "async-tungstenite"
-version = "0.25.1"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cca750b12e02c389c1694d35c16539f88b8bbaa5945934fdc1b41a776688589"
+checksum = "bb786dab48e539c5f17b23bac20d812ac027c01732ed7c7b58850c69a684e46c"
 dependencies = [
  "futures-io",
  "futures-util",
@@ -275,9 +275,15 @@ dependencies = [
  "pin-project-lite",
  "tokio",
  "tokio-native-tls",
- "tungstenite 0.21.0",
+ "tungstenite 0.23.0",
 ]
 
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
 [[package]]
 name = "atomic_refcell"
 version = "0.1.13"
@@ -297,9 +303,9 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "av1-grain"
@@ -337,7 +343,7 @@ dependencies = [
  "fastrand",
  "hex",
  "http 0.2.12",
- "hyper 0.14.28",
+ "hyper 0.14.29",
  "ring",
  "time",
  "tokio",
@@ -547,7 +553,7 @@ dependencies = [
  "aws-types",
  "bytes",
  "http 0.2.12",
- "hyper 0.14.28",
+ "hyper 0.14.29",
  "once_cell",
  "regex-lite",
  "tracing",
@@ -704,12 +710,12 @@ dependencies = [
  "http 0.2.12",
  "http-body 0.4.6",
  "http-body 1.0.0",
- "hyper 0.14.28",
- "hyper-rustls",
+ "hyper 0.14.29",
+ "hyper-rustls 0.24.2",
  "once_cell",
  "pin-project-lite",
  "pin-utils",
- "rustls",
+ "rustls 0.21.12",
  "tokio",
  "tracing",
 ]
@@ -783,9 +789,9 @@ dependencies = [
 
 [[package]]
 name = "backtrace"
-version = "0.3.71"
+version = "0.3.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
+checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
 dependencies = [
  "addr2line",
  "cc",
@@ -804,9 +810,9 @@ checksum = "349a06037c7bf932dd7e7d1f653678b2038b9ad46a74102f1fc7bd7872678cce"
 
 [[package]]
 name = "base32"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23ce669cd6c8588f79e15cf450314f9638f967fc5770ff1c7c1deb0925ea7cfa"
+checksum = "d1ce0365f4d5fb6646220bb52fe547afd51796d90f914d4063cb0b032ebee088"
 
 [[package]]
 name = "base64"
@@ -822,9 +828,9 @@ checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
 name = "base64"
-version = "0.22.0"
+version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "base64-serde"
@@ -875,9 +881,9 @@ checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "bitstream-io"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06c9989a51171e2e81038ab168b6ae22886fe9ded214430dbb4f41c28cf176da"
+checksum = "7c12d1856e42f0d817a835fe55853957c85c8c8a470114029143d3f12671446e"
 
 [[package]]
 name = "block-buffer"
@@ -914,15 +920,15 @@ checksum = "b4ae4235e6dac0694637c763029ecea1a2ec9e4e06ec2729bd21ba4d9c863eb7"
 
 [[package]]
 name = "built"
-version = "0.7.1"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38d17f4d6e4dc36d1a02fbedc2753a096848e7c1b0772f7654eab8e2c927dd53"
+checksum = "c6a6c0b39c38fd754ac338b00a88066436389c0f029da5d37d1e01091d9b7c17"
 
 [[package]]
 name = "bumpalo"
-version = "3.15.4"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "byte-slice-cast"
@@ -932,9 +938,9 @@ checksum = "c3ac9f8b63eca6fd385229b3675f6cc0dc5c8a5c8a54a59d4f52ffd670d87b0c"
 
 [[package]]
 name = "bytemuck"
-version = "1.15.0"
+version = "1.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d6d68c57235a3a081186990eca2867354726650f42f7516ca50c28d6281fd15"
+checksum = "b236fc92302c97ed75b38da1f4917b5cdda4984745740f153a5d3059e48d725e"
 
 [[package]]
 name = "byteorder"
@@ -960,8 +966,8 @@ dependencies = [
 
 [[package]]
 name = "cairo-rs"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "bitflags 2.5.0",
  "cairo-sys-rs",
@@ -972,8 +978,8 @@ dependencies = [
 
 [[package]]
 name = "cairo-sys-rs"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "glib-sys",
  "libc",
@@ -982,12 +988,13 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.91"
+version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd97381a8cc6493395a5afc4c691c1084b3768db713b73aa215217aa245d153"
+checksum = "96c51067fd44124faa7f870b4b1c969379ad32b2ba805aa959430ceaa384f695"
 dependencies = [
  "jobserver",
  "libc",
+ "once_cell",
 ]
 
 [[package]]
@@ -1008,9 +1015,9 @@ dependencies = [
 
 [[package]]
 name = "cea708-types"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd7f33493cb6f19aa19c6e688708f66bf792bc2c75137da2a03c7ebbdf7a44f9"
+checksum = "82b825228dce83e7156c7cd189bcfe5ef8014320deca7dd619787fe594946426"
 dependencies = [
  "env_logger 0.10.2",
  "log",
@@ -1021,9 +1028,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-expr"
-version = "0.15.7"
+version = "0.15.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa50868b64a9a6fda9d593ce778849ea8715cd2a3d2cc17ffdb4a2f2f2f1961d"
+checksum = "d067ad48b8650848b989a59a86c6c36a995d02d2bf778d45c3c5d57bc2718f02"
 dependencies = [
  "smallvec",
  "target-lexicon",
@@ -1037,9 +1044,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.37"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0d04d43504c61aa6c7531f1871dd0d418d91130162063b789da00fd7057a5e"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -1047,7 +1054,7 @@ dependencies = [
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-targets 0.52.4",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -1078,7 +1085,7 @@ dependencies = [
  "anstream",
  "anstyle",
  "clap_lex",
- "strsim",
+ "strsim 0.10.0",
 ]
 
 [[package]]
@@ -1090,7 +1097,7 @@ dependencies = [
  "heck 0.4.1",
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -1127,15 +1134,15 @@ checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
 [[package]]
 name = "colorchoice"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
 
 [[package]]
 name = "concurrent-queue"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d16048cd947b08fa32c24458a22f5dc5e835264f689f4f5653210c69fd107363"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -1148,9 +1155,9 @@ checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
 name = "cookie"
-version = "0.17.0"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7efb37c3e1ccb1ff97164ad95ac1606e8ccd35b3fa0a7d99a304c7f4a428cc24"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
 dependencies = [
  "percent-encoding",
  "time",
@@ -1168,12 +1175,12 @@ dependencies = [
 
 [[package]]
 name = "cookie_store"
-version = "0.20.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "387461abbc748185c3a6e1673d826918b450b87ff22639429c694619a83b6cf6"
+checksum = "4934e6b7e8419148b6ef56950d277af8561060b56afd59e2aadf98b59fce6baa"
 dependencies = [
  "cookie",
- "idna 0.3.0",
+ "idna 0.5.0",
  "log",
  "publicsuffix",
  "serde",
@@ -1219,27 +1226,27 @@ dependencies = [
 
 [[package]]
 name = "crc32c"
-version = "0.6.5"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89254598aa9b9fa608de44b3ae54c810f0f06d755e24c50177f1f8f31ff50ce2"
+checksum = "3a47af21622d091a8f0fb295b88bc886ac74efcc613efc19f5d0b21de5c89e47"
 dependencies = [
  "rustc_version",
 ]
 
 [[package]]
 name = "crc32fast"
-version = "1.4.0"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3855a8a784b474f333699ef2bbca9db2c4a1f6d9088a90a2d25b1eb53111eaa"
+checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.12"
+version = "0.5.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab3db02a9c5b5121e1e42fbdb1aeb65f5e02624cc58c43f2884c6ccac0b82f95"
+checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -1265,9 +1272,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.19"
+version = "0.8.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
+checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
 
 [[package]]
 name = "crypto-bigint"
@@ -1344,9 +1351,9 @@ dependencies = [
 
 [[package]]
 name = "darling"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54e36fcd13ed84ffdfda6f5be89b31287cbb80c439841fe69e04841435464391"
+checksum = "83b2eb4d90d12bdda5ed17de686c2acb4c57914f8f921b8da7e112b5a36f3fe1"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -1354,37 +1361,38 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c2cf1c23a687a1feeb728783b993c4e1ad83d99f351801977dd809b48d0a70f"
+checksum = "622687fe0bac72a04e5599029151f5796111b90f1baaa9b544d807a5e31cd120"
 dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim",
- "syn 2.0.58",
+ "strsim 0.11.1",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "darling_macro"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
+checksum = "733cabb43482b1a1b53eee8583c2b9e8684d592215ea83efd305dd31bc2f0178"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "dash-mpd"
-version = "0.16.0"
+version = "0.16.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cafa2c33eff2857e1a14c38aa9a432aa565a01e77804a541fce7aec3affb8f8"
+checksum = "0f8a6df34a2957e8a164afa9265bcb1ea9a07a0df69c5dcda4909e4f650c0850"
 dependencies = [
- "base64 0.22.0",
+ "base64 0.22.1",
  "base64-serde",
+ "bytes",
  "chrono",
  "fs-err",
  "iso8601",
@@ -1401,19 +1409,6 @@ dependencies = [
  "xattr",
 ]
 
-[[package]]
-name = "dashmap"
-version = "5.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
-dependencies = [
- "cfg-if",
- "hashbrown 0.14.3",
- "lock_api",
- "once_cell",
- "parking_lot_core",
-]
-
 [[package]]
 name = "dasp_frame"
 version = "0.11.0"
@@ -1431,9 +1426,9 @@ checksum = "0c87e182de0887fd5361989c677c4e8f5000cd9491d6d563161a8f3a5519fc7f"
 
 [[package]]
 name = "data-encoding"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e962a19be5cfc3f3bf6dd8f61eb50107f356ad6270fbb3ed41476571db78be5"
+checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
 
 [[package]]
 name = "dav1d"
@@ -1503,9 +1498,9 @@ dependencies = [
 
 [[package]]
 name = "dssim-core"
-version = "3.2.8"
+version = "3.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fafad37c1f4f168243f3ac1b4cae0d358c528ac695670100337314e38d54b486"
+checksum = "0c074fca6cdf5e3faaaf03f71e29cd5d92ea533b1432cf78910dafffc2ce872b"
 dependencies = [
  "imgref",
  "itertools 0.12.1",
@@ -1548,9 +1543,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.10.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
 
 [[package]]
 name = "elliptic-curve"
@@ -1574,9 +1569,9 @@ dependencies = [
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.33"
+version = "0.8.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+checksum = "b45de904aa0b010bce2ab45264d0631681847fa7b6f2eaa7dab7619943bc4f59"
 dependencies = [
  "cfg-if",
 ]
@@ -1614,9 +1609,9 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
+checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -1624,9 +1619,9 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "5.3.0"
+version = "5.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d9944b8ca13534cdfb2800775f8dd4902ff3fc75a50101466decadfdf322a24"
+checksum = "6032be9bd27023a771701cc49f9f053c751055f71efb2e0ae5c15809093675ba"
 dependencies = [
  "concurrent-queue",
  "parking",
@@ -1635,9 +1630,9 @@ dependencies = [
 
 [[package]]
 name = "event-listener-strategy"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "332f51cb23d20b0de8458b86580878211da09bcd4503cb579c225b3d124cabb3"
+checksum = "0f214dc438f977e6d4e3500aaa277f5ad94ca83fbbd9b1a15713ce2344ccc5a1"
 dependencies = [
  "event-listener",
  "pin-project-lite",
@@ -1651,9 +1646,9 @@ checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
 
 [[package]]
 name = "fastrand"
-version = "2.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984"
+checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
 
 [[package]]
 name = "fdeflate"
@@ -1702,9 +1697,9 @@ checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
 [[package]]
 name = "flate2"
-version = "1.0.28"
+version = "1.0.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
+checksum = "5f54427cfd1c7829e2a139fcefea601bf088ebca651d2bf53ebc600eac295dae"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -1831,7 +1826,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -1866,8 +1861,8 @@ dependencies = [
 
 [[package]]
 name = "gdk-pixbuf"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "gdk-pixbuf-sys",
  "gio",
@@ -1877,8 +1872,8 @@ dependencies = [
 
 [[package]]
 name = "gdk-pixbuf-sys"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "gio-sys",
  "glib-sys",
@@ -1889,8 +1884,8 @@ dependencies = [
 
 [[package]]
 name = "gdk4"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "cairo-rs",
  "gdk-pixbuf",
@@ -1903,8 +1898,8 @@ dependencies = [
 
 [[package]]
 name = "gdk4-sys"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "cairo-sys-rs",
  "gdk-pixbuf-sys",
@@ -1919,8 +1914,8 @@ dependencies = [
 
 [[package]]
 name = "gdk4-wayland"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "gdk4",
  "gdk4-wayland-sys",
@@ -1931,8 +1926,8 @@ dependencies = [
 
 [[package]]
 name = "gdk4-wayland-sys"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "glib-sys",
  "libc",
@@ -1941,8 +1936,8 @@ dependencies = [
 
 [[package]]
 name = "gdk4-win32"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "gdk4",
  "gdk4-win32-sys",
@@ -1954,8 +1949,8 @@ dependencies = [
 
 [[package]]
 name = "gdk4-win32-sys"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "gdk4-sys",
  "glib-sys",
@@ -1965,8 +1960,8 @@ dependencies = [
 
 [[package]]
 name = "gdk4-x11"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "gdk4",
  "gdk4-x11-sys",
@@ -1977,8 +1972,8 @@ dependencies = [
 
 [[package]]
 name = "gdk4-x11-sys"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "gdk4-sys",
  "glib-sys",
@@ -2007,9 +2002,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.14"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -2030,14 +2025,14 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.28.1"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
+checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
 
 [[package]]
 name = "gio"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2053,8 +2048,8 @@ dependencies = [
 
 [[package]]
 name = "gio-sys"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -2065,8 +2060,8 @@ dependencies = [
 
 [[package]]
 name = "glib"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "bitflags 2.5.0",
  "futures-channel",
@@ -2086,20 +2081,20 @@ dependencies = [
 
 [[package]]
 name = "glib-macros"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "heck 0.5.0",
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "glib-sys"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "libc",
  "system-deps",
@@ -2113,8 +2108,8 @@ checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
 
 [[package]]
 name = "gobject-sys"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "glib-sys",
  "libc",
@@ -2123,8 +2118,8 @@ dependencies = [
 
 [[package]]
 name = "graphene-rs"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "glib",
  "graphene-sys",
@@ -2133,8 +2128,8 @@ dependencies = [
 
 [[package]]
 name = "graphene-sys"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "glib-sys",
  "libc",
@@ -2155,8 +2150,8 @@ dependencies = [
 
 [[package]]
 name = "gsk4"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "cairo-rs",
  "gdk4",
@@ -2169,8 +2164,8 @@ dependencies = [
 
 [[package]]
 name = "gsk4-sys"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "cairo-sys-rs",
  "gdk4-sys",
@@ -2184,7 +2179,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-audiofx"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "atomic_refcell",
@@ -2206,7 +2201,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-aws"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "async-stream",
  "aws-config",
@@ -2239,7 +2234,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-cdg"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "cdg",
  "cdg_renderer",
@@ -2254,7 +2249,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-claxon"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "atomic_refcell",
  "byte-slice-cast",
@@ -2268,7 +2263,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-closedcaption"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "atomic_refcell",
@@ -2296,7 +2291,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-csound"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "byte-slice-cast",
  "csound",
@@ -2310,7 +2305,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-dav1d"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "dav1d",
  "gst-plugin-version-helper",
@@ -2323,7 +2318,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-fallbackswitch"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "gio",
  "gst-plugin-gtk4",
@@ -2341,7 +2336,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-ffv1"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "byte-slice-cast",
  "ffv1",
@@ -2354,7 +2349,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-file"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "gst-plugin-version-helper",
  "gstreamer",
@@ -2365,7 +2360,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-flavors"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "byteorder",
  "flavors",
@@ -2381,9 +2376,10 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-fmp4"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
+ "bitstream-io",
  "chrono",
  "dash-mpd",
  "gst-plugin-version-helper",
@@ -2402,7 +2398,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-gif"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "atomic_refcell",
  "gif",
@@ -2415,7 +2411,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-gtk4"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "async-channel",
  "gdk4-wayland",
@@ -2423,6 +2419,7 @@ dependencies = [
  "gdk4-x11",
  "gst-plugin-version-helper",
  "gstreamer",
+ "gstreamer-allocators",
  "gstreamer-base",
  "gstreamer-gl",
  "gstreamer-gl-egl",
@@ -2436,7 +2433,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-hlssink3"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "chrono",
@@ -2455,7 +2452,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-hsv"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "byte-slice-cast",
  "gst-plugin-version-helper",
@@ -2470,7 +2467,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-inter"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "futures",
@@ -2488,7 +2485,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-json"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "gst-plugin-version-helper",
  "gstreamer",
@@ -2500,7 +2497,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-lewton"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "atomic_refcell",
  "byte-slice-cast",
@@ -2514,7 +2511,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-livesync"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "gio",
  "gst-plugin-gtk4",
@@ -2530,9 +2527,10 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-mp4"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
+ "bitstream-io",
  "gst-plugin-version-helper",
  "gstreamer",
  "gstreamer-audio",
@@ -2546,7 +2544,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-ndi"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "atomic_refcell",
@@ -2568,7 +2566,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-onvif"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "cairo-rs",
  "chrono",
@@ -2586,7 +2584,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-png"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "gst-plugin-version-helper",
  "gstreamer",
@@ -2599,7 +2597,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-raptorq"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "gst-plugin-version-helper",
  "gstreamer",
@@ -2613,7 +2611,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-rav1e"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "atomic_refcell",
  "gst-plugin-version-helper",
@@ -2626,7 +2624,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-regex"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "gst-plugin-version-helper",
  "gstreamer",
@@ -2637,7 +2635,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-reqwest"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "bytes",
  "futures",
@@ -2646,18 +2644,18 @@ dependencies = [
  "gstreamer-base",
  "headers 0.4.0",
  "http-body-util",
- "hyper 1.2.0",
+ "hyper 1.3.1",
  "mime",
  "once_cell",
  "pin-project-lite",
- "reqwest 0.12.3",
+ "reqwest 0.12.5",
  "tokio",
  "url",
 ]
 
 [[package]]
 name = "gst-plugin-rtp"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "bitstream-io",
  "gst-plugin-version-helper",
@@ -2671,7 +2669,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-rtsp"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "atomic_refcell",
@@ -2686,7 +2684,7 @@ dependencies = [
  "once_cell",
  "rtsp-types",
  "sdp-types",
- "socket2 0.5.6",
+ "socket2 0.5.7",
  "thiserror",
  "tokio",
  "tokio-stream",
@@ -2695,7 +2693,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-sodium"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "clap",
  "gst-plugin-version-helper",
@@ -2715,7 +2713,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-spotify"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "futures",
@@ -2730,7 +2728,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-textahead"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "gst-plugin-version-helper",
  "gstreamer",
@@ -2739,7 +2737,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-textwrap"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "gst-plugin-version-helper",
  "gstreamer",
@@ -2751,7 +2749,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-threadshare"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "async-task",
  "cc",
@@ -2775,14 +2773,14 @@ dependencies = [
  "rand",
  "rustix",
  "slab",
- "socket2 0.5.6",
+ "socket2 0.5.7",
  "waker-fn",
  "winapi",
 ]
 
 [[package]]
 name = "gst-plugin-togglerecord"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "either",
  "gio",
@@ -2799,7 +2797,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-tracers"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "gst-plugin-version-helper",
@@ -2811,7 +2809,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-tutorial"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "byte-slice-cast",
  "gst-plugin-version-helper",
@@ -2825,7 +2823,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-uriplaylistbin"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "clap",
@@ -2843,12 +2841,12 @@ name = "gst-plugin-version-helper"
 version = "0.8.2"
 dependencies = [
  "chrono",
- "toml_edit 0.22.9",
+ "toml_edit 0.22.14",
 ]
 
 [[package]]
 name = "gst-plugin-videofx"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "atomic_refcell",
  "cairo-rs",
@@ -2868,7 +2866,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-webp"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "gst-plugin-version-helper",
  "gstreamer",
@@ -2881,7 +2879,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-webrtc"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -2937,7 +2935,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-webrtc-signalling"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "anyhow",
  "async-tungstenite",
@@ -2959,7 +2957,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-webrtc-signalling-protocol"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "serde",
  "serde_json",
@@ -2967,7 +2965,7 @@ dependencies = [
 
 [[package]]
 name = "gst-plugin-webrtchttp"
-version = "0.12.4"
+version = "0.12.8"
 dependencies = [
  "async-recursion",
  "bytes",
@@ -2978,14 +2976,14 @@ dependencies = [
  "gstreamer-webrtc",
  "once_cell",
  "parse_link_header",
- "reqwest 0.12.3",
+ "reqwest 0.12.5",
  "tokio",
 ]
 
 [[package]]
 name = "gstreamer"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "cfg-if",
  "futures-channel",
@@ -2993,7 +2991,7 @@ dependencies = [
  "futures-util",
  "glib",
  "gstreamer-sys",
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "libc",
  "muldiv",
  "num-integer",
@@ -3008,10 +3006,34 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "gstreamer-allocators"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
+dependencies = [
+ "glib",
+ "gstreamer",
+ "gstreamer-allocators-sys",
+ "libc",
+ "once_cell",
+]
+
+[[package]]
+name = "gstreamer-allocators-sys"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "gstreamer-sys",
+ "libc",
+ "system-deps",
+]
+
 [[package]]
 name = "gstreamer-app"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -3024,8 +3046,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-app-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gstreamer-base-sys",
@@ -3036,8 +3058,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-audio"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "cfg-if",
  "glib",
@@ -3052,8 +3074,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-audio-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -3065,8 +3087,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-base"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "atomic_refcell",
  "cfg-if",
@@ -3078,8 +3100,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-base-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -3090,8 +3112,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-check"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib",
  "gstreamer",
@@ -3100,8 +3122,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-check-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -3112,8 +3134,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-gl"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib",
  "gstreamer",
@@ -3126,8 +3148,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-gl-egl"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib",
  "gstreamer",
@@ -3138,8 +3160,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-gl-egl-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gstreamer-gl-sys",
@@ -3149,8 +3171,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-gl-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -3163,8 +3185,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-gl-wayland"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib",
  "gstreamer",
@@ -3175,8 +3197,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-gl-wayland-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gstreamer-gl-sys",
@@ -3186,8 +3208,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-gl-x11"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib",
  "gstreamer",
@@ -3198,8 +3220,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-gl-x11-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gstreamer-gl-sys",
@@ -3209,8 +3231,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-net"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "gio",
  "glib",
@@ -3220,8 +3242,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-net-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "gio-sys",
  "glib-sys",
@@ -3232,8 +3254,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-pbutils"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib",
  "gstreamer",
@@ -3246,8 +3268,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-pbutils-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -3260,8 +3282,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-rtp"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib",
  "gstreamer",
@@ -3271,8 +3293,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-rtp-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gstreamer-base-sys",
@@ -3283,8 +3305,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-sdp"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib",
  "gstreamer",
@@ -3293,8 +3315,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-sdp-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gstreamer-sys",
@@ -3304,8 +3326,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -3315,8 +3337,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-utils"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "gstreamer",
  "gstreamer-app",
@@ -3327,8 +3349,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-video"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "cfg-if",
  "futures-channel",
@@ -3344,8 +3366,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-video-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -3357,8 +3379,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-webrtc"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib",
  "gstreamer",
@@ -3369,8 +3391,8 @@ dependencies = [
 
 [[package]]
 name = "gstreamer-webrtc-sys"
-version = "0.22.4"
-source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#f2d3128bf9d0170288ce479bea021f0886617fac"
+version = "0.22.7"
+source = "git+https://gitlab.freedesktop.org/gstreamer/gstreamer-rs?branch=0.22#da8c41c6fba41095c94e8d0e8967f051e44bc1ff"
 dependencies = [
  "glib-sys",
  "gstreamer-sdp-sys",
@@ -3381,8 +3403,8 @@ dependencies = [
 
 [[package]]
 name = "gtk4"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "cairo-rs",
  "field-offset",
@@ -3401,21 +3423,19 @@ dependencies = [
 
 [[package]]
 name = "gtk4-macros"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
- "anyhow",
  "proc-macro-crate",
- "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "gtk4-sys"
-version = "0.8.1"
-source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#05d26f6a97a0ccf856b565b4fd796cdf57059084"
+version = "0.8.2"
+source = "git+https://github.com/gtk-rs/gtk4-rs?branch=0.8#cf84b5cd36fc1aa31175bc24ff45e8ceb0710dec"
 dependencies = [
  "cairo-sys-rs",
  "gdk-pixbuf-sys",
@@ -3451,15 +3471,15 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "816ec7294445779408f36fe57bc5b7fc1cf59664059096c65f905c1c61f58069"
+checksum = "fa82e28a107a8cc405f0839610bdc9b15f1e25ec7d696aa5cf173edbcb1486ab"
 dependencies = [
+ "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "futures-util",
  "http 1.1.0",
  "indexmap 2.2.6",
  "slab",
@@ -3476,9 +3496,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.14.3"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 dependencies = [
  "ahash",
  "allocator-api2",
@@ -3559,6 +3579,12 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
+[[package]]
+name = "hermit-abi"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
+
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -3651,12 +3677,12 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
+checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
 dependencies = [
  "bytes",
- "futures-core",
+ "futures-util",
  "http 1.1.0",
  "http-body 1.0.0",
  "pin-project-lite",
@@ -3664,9 +3690,9 @@ dependencies = [
 
 [[package]]
 name = "httparse"
-version = "1.8.0"
+version = "1.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
+checksum = "0fcc0b4a115bf80b728eb8ea024ad5bd707b615bfed49e0665b6e0f86fd082d9"
 
 [[package]]
 name = "httpdate"
@@ -3688,9 +3714,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "0.14.28"
+version = "0.14.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
+checksum = "f361cde2f109281a220d4307746cdfd5ee3f410da58a70377762396775634b33"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -3703,7 +3729,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.5.6",
+ "socket2 0.5.7",
  "tokio",
  "tower-service",
  "tracing",
@@ -3712,14 +3738,14 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.2.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "186548d73ac615b32a73aafe38fb4f56c0d340e110e5a200bcadbaf2e199263a"
+checksum = "fe575dd17d0862a9a33781c8c4696a55c320909004a67a00fb286ba8b1bc496d"
 dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "h2 0.4.4",
+ "h2 0.4.5",
  "http 1.1.0",
  "http-body 1.0.0",
  "httparse",
@@ -3741,7 +3767,7 @@ dependencies = [
  "futures",
  "headers 0.3.9",
  "http 0.2.12",
- "hyper 0.14.28",
+ "hyper 0.14.29",
  "tokio",
  "tower-service",
 ]
@@ -3754,12 +3780,29 @@ checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
 dependencies = [
  "futures-util",
  "http 0.2.12",
- "hyper 0.14.28",
+ "hyper 0.14.29",
  "log",
- "rustls",
+ "rustls 0.21.12",
  "rustls-native-certs",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.24.1",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ee4be2c948921a1a5320b629c4193916ed787a7f7f293fd3f7f5a6c9de74155"
+dependencies = [
+ "futures-util",
+ "http 1.1.0",
+ "hyper 1.3.1",
+ "hyper-util",
+ "rustls 0.23.10",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls 0.26.0",
+ "tower-service",
 ]
 
 [[package]]
@@ -3769,7 +3812,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
 dependencies = [
  "bytes",
- "hyper 0.14.28",
+ "hyper 0.14.29",
  "native-tls",
  "tokio",
  "tokio-native-tls",
@@ -3783,7 +3826,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.2.0",
+ "hyper 1.3.1",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -3793,18 +3836,18 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.3"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca38ef113da30126bbff9cd1705f9273e15d45498615d138b0c20279ac7a76aa"
+checksum = "7b875924a60b96e5d7b9ae7b066540b1dd1cbd90d1828f54c92e02a283351c56"
 dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
  "http 1.1.0",
  "http-body 1.0.0",
- "hyper 1.2.0",
+ "hyper 1.3.1",
  "pin-project-lite",
- "socket2 0.5.6",
+ "socket2 0.5.7",
  "tokio",
  "tower",
  "tower-service",
@@ -3942,7 +3985,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.3",
+ "hashbrown 0.14.5",
  "serde",
 ]
 
@@ -3954,7 +3997,7 @@ checksum = "c34819042dc3d3971c46c2190835914dfbe0c3c13f61449b2997f4e9722dfa60"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -3974,6 +4017,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+
 [[package]]
 name = "iso8601"
 version = "0.6.1"
@@ -4001,6 +4050,15 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.11"
@@ -4009,9 +4067,9 @@ checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "jobserver"
-version = "0.1.28"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab46a6e9526ddef3ae7f787c06f0f2600639ba80ea3eade3d8e670a2230f51d6"
+checksum = "d2b099aaa34a9751c5bf0878add70444e1ed2dd73f347be99003d4577277de6e"
 dependencies = [
  "libc",
 ]
@@ -4066,9 +4124,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.155"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
 
 [[package]]
 name = "libfuzzer-sys"
@@ -4088,7 +4146,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c2a198fb6b0eada2a8df47933734e6d35d350665a33a3593d7164fa52c75c19"
 dependencies = [
  "cfg-if",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -4128,7 +4186,7 @@ dependencies = [
  "futures-util",
  "getopts",
  "hex",
- "hyper 0.14.28",
+ "hyper 0.14.29",
  "librespot-audio",
  "librespot-connect",
  "librespot-core",
@@ -4197,7 +4255,7 @@ dependencies = [
  "hmac 0.11.0",
  "http 0.2.12",
  "httparse",
- "hyper 0.14.28",
+ "hyper 0.14.29",
  "hyper-proxy",
  "librespot-protocol",
  "log",
@@ -4233,7 +4291,7 @@ dependencies = [
  "form_urlencoded",
  "futures-core",
  "hmac 0.11.0",
- "hyper 0.14.28",
+ "hyper 0.14.29",
  "libmdns",
  "librespot-core",
  "log",
@@ -4320,9 +4378,9 @@ dependencies = [
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
+checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
 [[package]]
 name = "livekit-api"
@@ -4365,9 +4423,9 @@ dependencies = [
 
 [[package]]
 name = "lock_api"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -4385,7 +4443,7 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3262e75e648fce39813cb56ac41f3c3e3f65217ebf3844d818d1f9398cfb0dc"
 dependencies = [
- "hashbrown 0.14.3",
+ "hashbrown 0.14.5",
 ]
 
 [[package]]
@@ -4435,9 +4493,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.7.2"
+version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
 
 [[package]]
 name = "memoffset"
@@ -4481,9 +4539,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.2"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
+checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
 dependencies = [
  "adler",
  "simd-adler32",
@@ -4565,11 +4623,10 @@ dependencies = [
 
 [[package]]
 name = "native-tls"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
+checksum = "a8614eb2c83d59d1c8cc974dd3f920198647674a0a035e1af1fa58707e317466"
 dependencies = [
- "lazy_static",
  "libc",
  "log",
  "openssl",
@@ -4638,11 +4695,10 @@ dependencies = [
 
 [[package]]
 name = "num-bigint"
-version = "0.4.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+checksum = "c165a9ab64cf766f73521c0dd2cfdff64f488b8f0b3e621face3462d3db536d7"
 dependencies = [
- "autocfg",
  "num-integer",
  "num-traits",
  "rand",
@@ -4650,9 +4706,9 @@ dependencies = [
 
 [[package]]
 name = "num-complex"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23c6602fda94a57c990fe0df199a035d83576b496aa29f4e634a8ac6004e68a6"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
 dependencies = [
  "num-traits",
 ]
@@ -4671,7 +4727,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -4685,11 +4741,10 @@ dependencies = [
 
 [[package]]
 name = "num-rational"
-version = "0.4.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
 dependencies = [
- "autocfg",
  "num-bigint",
  "num-integer",
  "num-traits",
@@ -4698,9 +4753,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.18"
+version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
  "libm",
@@ -4718,9 +4773,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.32.2"
+version = "0.36.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
+checksum = "576dfe1fc8f9df304abb159d767a29d0476f7750fbf8aa7ad07816004a207434"
 dependencies = [
  "memchr",
 ]
@@ -4769,7 +4824,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -4824,8 +4879,8 @@ dependencies = [
 
 [[package]]
 name = "pango"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "gio",
  "glib",
@@ -4835,8 +4890,8 @@ dependencies = [
 
 [[package]]
 name = "pango-sys"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "glib-sys",
  "gobject-sys",
@@ -4846,8 +4901,8 @@ dependencies = [
 
 [[package]]
 name = "pangocairo"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "cairo-rs",
  "glib",
@@ -4858,8 +4913,8 @@ dependencies = [
 
 [[package]]
 name = "pangocairo-sys"
-version = "0.19.3"
-source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#5e944f2eff8b344591666754f7ea3b359943ee8c"
+version = "0.19.8"
+source = "git+https://github.com/gtk-rs/gtk-rs-core?branch=0.19#4dc6fee85588f0dd6d8defdaa100f1cb22b7b8ae"
 dependencies = [
  "cairo-sys-rs",
  "glib-sys",
@@ -4876,9 +4931,9 @@ checksum = "bb813b8af86854136c6922af0598d719255ecb2179515e6e7730d468f05c9cae"
 
 [[package]]
 name = "parking_lot"
-version = "0.12.1"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -4886,9 +4941,9 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.9"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
  "backtrace",
  "cfg-if",
@@ -4897,7 +4952,7 @@ dependencies = [
  "redox_syscall",
  "smallvec",
  "thread-id",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -4914,9 +4969,9 @@ dependencies = [
 
 [[package]]
 name = "paste"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
 [[package]]
 name = "pbjson"
@@ -4973,9 +5028,9 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "petgraph"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
+checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
 dependencies = [
  "fixedbitset",
  "indexmap 2.2.6",
@@ -4998,7 +5053,7 @@ checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -5050,13 +5105,13 @@ checksum = "c135f38778ad324d9e9ee68690bac2c1a51f340fdf96ca13e2ab3914eb2e51d8"
 
 [[package]]
 name = "polling"
-version = "3.6.0"
+version = "3.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0c976a60b2d7e99d6f229e414670a9b85d13ac305cc6d1e9c134de58c5aaaf6"
+checksum = "a3ed00ed3fbf728b5816498ecd316d1716eecaced9c0c8d2c5a6740ca214985b"
 dependencies = [
  "cfg-if",
  "concurrent-queue",
- "hermit-abi 0.3.9",
+ "hermit-abi 0.4.0",
  "pin-project-lite",
  "rustix",
  "tracing",
@@ -5087,19 +5142,19 @@ dependencies = [
 
 [[package]]
 name = "prettyplease"
-version = "0.2.17"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d3928fb5db768cb86f891ff014f0144589297e3c6a1aba6ed7cecfdace270c7"
+checksum = "5f12335488a2f3b0a83b14edad48dca9879ce89b2edd10e80237e4e852dd645e"
 dependencies = [
  "proc-macro2",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "primal-check"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9df7f93fd637f083201473dab4fee2db4c429d32e55e3299980ab3957ab916a0"
+checksum = "dc0d895b311e3af9902528fbb8f928688abbd95872819320517cc24ca6b2bd08"
 dependencies = [
  "num-integer",
 ]
@@ -5149,9 +5204,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.79"
+version = "1.0.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
+checksum = "22244ce15aa966053a896d1accb3a6e68469b97c7f33f284b99f0d576879fc23"
 dependencies = [
  "unicode-ident",
 ]
@@ -5172,14 +5227,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8021cf59c8ec9c432cfc2526ac6b8aa508ecaf29cd415f271b8406c1b851c3fd"
 dependencies = [
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "prost"
-version = "0.12.4"
+version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0f5d036824e4761737860779c906171497f6d55681139d8312388f8fe398922"
+checksum = "deb1435c188b76130da55f17a466d252ff7b1418b2ad3e037d127b94e3411f29"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -5187,12 +5242,12 @@ dependencies = [
 
 [[package]]
 name = "prost-build"
-version = "0.12.4"
+version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80b776a1b2dc779f5ee0641f8ade0125bc1298dd41a9a0c16d8bd57b42d222b1"
+checksum = "22505a5c94da8e3b7c2996394d1c933236c4d743e81a410bcca4e6989fc066a4"
 dependencies = [
  "bytes",
- "heck 0.4.1",
+ "heck 0.5.0",
  "itertools 0.12.1",
  "log",
  "multimap 0.10.0",
@@ -5202,28 +5257,28 @@ dependencies = [
  "prost",
  "prost-types",
  "regex",
- "syn 2.0.58",
+ "syn 2.0.66",
  "tempfile",
 ]
 
 [[package]]
 name = "prost-derive"
-version = "0.12.4"
+version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19de2de2a00075bf566bee3bd4db014b11587e84184d3f7a791bc17f1a8e9e48"
+checksum = "81bddcdb20abf9501610992b6759a4c888aef7d1a7247ef75e2404275ac24af1"
 dependencies = [
  "anyhow",
  "itertools 0.12.1",
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "prost-types"
-version = "0.12.4"
+version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3235c33eb02c1f1e212abdbe34c78b264b038fb58ca612664343271e36e55ffe"
+checksum = "9091c90b0a32608e984ff2fa4091273cbdd755d54935c51d520887f4a1dbd5b0"
 dependencies = [
  "prost",
 ]
@@ -5281,9 +5336,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -5401,23 +5456,23 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.4.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
+checksum = "c82cf8cff14456045f55ec4241383baeff27af886adb72ffb2162f99911de0fd"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
 ]
 
 [[package]]
 name = "regex"
-version = "1.10.4"
+version = "1.10.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
+checksum = "b91213439dad192326a0d7c6ee3955910425f441d7038e0d6933b0aec5c4517f"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.4.6",
- "regex-syntax 0.8.3",
+ "regex-automata 0.4.7",
+ "regex-syntax 0.8.4",
 ]
 
 [[package]]
@@ -5431,20 +5486,20 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.6"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
+checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.8.3",
+ "regex-syntax 0.8.4",
 ]
 
 [[package]]
 name = "regex-lite"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30b661b2f27137bdbc16f00eda72866a92bb28af1753ffbd56744fb6e2e9cd8e"
+checksum = "53a49587ad06b26609c52e423de037e7f57f20d53535d66e08c695f347df952a"
 
 [[package]]
 name = "regex-syntax"
@@ -5454,9 +5509,9 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
+checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
 
 [[package]]
 name = "reqwest"
@@ -5472,7 +5527,7 @@ dependencies = [
  "h2 0.3.26",
  "http 0.2.12",
  "http-body 0.4.6",
- "hyper 0.14.28",
+ "hyper 0.14.29",
  "hyper-tls 0.5.0",
  "ipnet",
  "js-sys",
@@ -5486,7 +5541,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper",
+ "sync_wrapper 0.1.2",
  "system-configuration",
  "tokio",
  "tokio-native-tls",
@@ -5500,23 +5555,24 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.12.3"
+version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e6cc1e89e689536eb5aeede61520e874df5a4707df811cd5da4aa5fbb2aae19"
+checksum = "c7d6d2a27d57148378eb5e111173f4276ad26340ecc5c49a4a2152167a2d6a37"
 dependencies = [
  "async-compression",
- "base64 0.22.0",
+ "base64 0.22.1",
  "bytes",
  "cookie",
  "cookie_store",
  "encoding_rs",
  "futures-core",
  "futures-util",
- "h2 0.4.4",
+ "h2 0.4.5",
  "http 1.1.0",
  "http-body 1.0.0",
  "http-body-util",
- "hyper 1.2.0",
+ "hyper 1.3.1",
+ "hyper-rustls 0.27.2",
  "hyper-tls 0.6.0",
  "hyper-util",
  "ipnet",
@@ -5531,7 +5587,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper",
+ "sync_wrapper 1.0.1",
  "system-configuration",
  "tokio",
  "tokio-native-tls",
@@ -5593,9 +5649,9 @@ dependencies = [
 
 [[package]]
 name = "rtsp-types"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c5c11e0af63f1ac6057f9029f7ddf1c677bade51e449f75be25c8b29f59474c"
+checksum = "d9eda23daacde59c9e182db0a25e03f51f0108707169c09b4e5d931885470c5c"
 dependencies = [
  "cookie-factory",
  "nom",
@@ -5617,9 +5673,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.23"
+version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
 [[package]]
 name = "rustc_version"
@@ -5656,9 +5712,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.32"
+version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65e04861e65f21776e67888bfbea442b3642beaa0138fdb1dd7a84a52dffdb89"
+checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
  "bitflags 2.5.0",
  "errno",
@@ -5669,16 +5725,29 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.21.10"
+version = "0.21.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
 dependencies = [
  "log",
  "ring",
- "rustls-webpki",
+ "rustls-webpki 0.101.7",
  "sct",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.23.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05cff451f60db80f490f3c182b77c35260baace73209e9cdbbe526bfe3a4d402"
+dependencies = [
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki 0.102.4",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustls-native-certs"
 version = "0.6.3"
@@ -5706,15 +5775,15 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
 dependencies = [
- "base64 0.22.0",
+ "base64 0.22.1",
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.4.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecd36cc4259e3e4514335c4a138c6b43171a8d61d8f5c9348f9fc7529416f247"
+checksum = "976295e77ce332211c0d24d92c0e83e50f5c5f046d11082cea19f3df13a3562d"
 
 [[package]]
 name = "rustls-webpki"
@@ -5727,10 +5796,21 @@ dependencies = [
 ]
 
 [[package]]
-name = "ryu"
-version = "1.0.17"
+name = "rustls-webpki"
+version = "0.102.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
+checksum = "ff448f7e92e913c4b7d4c6d8e4540a1724b319b4152b8aef6d4cf8339712b33e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
 
 [[package]]
 name = "same-file"
@@ -5741,6 +5821,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "scc"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76ad2bbb0ae5100a07b7a6f2ed7ab5fd0045551a4c507989b7a620046ea3efdc"
+dependencies = [
+ "sdd",
+]
+
 [[package]]
 name = "schannel"
 version = "0.1.23"
@@ -5772,6 +5861,12 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "sdd"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b84345e4c9bd703274a082fb80caaa99b7612be48dfaa1dd9266577ec412309d"
+
 [[package]]
 name = "sdp-types"
 version = "0.1.6"
@@ -5798,11 +5893,11 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "770452e37cad93e0a50d5abc3990d2bc351c36d0328f86cefec2f2fb206eaef6"
+checksum = "c627723fd09706bacdb5cf41499e95098555af3c3c29d014dc3c458ef6be11c0"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -5811,9 +5906,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f3cc463c0ef97e11c3461a9d3787412d30e8e7eb907c79180c4a57bf7c04ef"
+checksum = "317936bbbd05227752583946b9e66d7ce3b489f84e11a94a510b4437fef407d7"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -5821,15 +5916,15 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
+checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
 
 [[package]]
 name = "serde"
-version = "1.0.197"
+version = "1.0.203"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
 dependencies = [
  "serde_derive",
 ]
@@ -5845,20 +5940,20 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.197"
+version = "1.0.203"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.115"
+version = "1.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12dc5c46daa8e9fdf4f5e71b6cf9a53f2487da0e86e55808e2d35539666497dd"
+checksum = "455182ea6142b14f93f4bc5320a2b31c1f266b66a4a5c858b013302a5d8cbfc3"
 dependencies = [
  "itoa",
  "ryu",
@@ -5877,9 +5972,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.5"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
+checksum = "79e674e01f999af37c49f70a6ede167a8a60b2503e56c5599532a65baa5969a0"
 dependencies = [
  "serde",
 ]
@@ -5898,11 +5993,11 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.7.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee80b0e361bbf88fd2f6e242ccd19cfda072cb0faa6ae694ecee08199938569a"
+checksum = "0ad483d2ab0149d5a5ebcd9972a3852711e0153d863bf5a5d0391d28883c4a20"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "chrono",
  "hex",
  "indexmap 1.9.3",
@@ -5916,39 +6011,39 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.7.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6561dc161a9224638a31d876ccdfefbc1df91d3f3a8342eddb35f055d48c7655"
+checksum = "65569b702f41443e8bc8bbb1c5779bd0450bbe723b56198980e80ec45780bce2"
 dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "serial_test"
-version = "3.0.0"
+version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "953ad9342b3aaca7cb43c45c097dd008d4907070394bd0751a0aa8817e5a018d"
+checksum = "4b4b487fe2acf240a021cf57c6b2b4903b1e78ca0ecd862a71b71d2a51fed77d"
 dependencies = [
- "dashmap",
  "futures",
- "lazy_static",
  "log",
+ "once_cell",
  "parking_lot",
+ "scc",
  "serial_test_derive",
 ]
 
 [[package]]
 name = "serial_test_derive"
-version = "3.0.0"
+version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b93fb4adc70021ac1b47f7d45e8cc4169baaa7ea58483bc5b721d19a26202212"
+checksum = "82fe9db325bcef1fbcde82e078a5cc4efdf787e96b3b9cf45b50b529f2083d67"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -6022,9 +6117,9 @@ dependencies = [
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.1"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
+checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
 dependencies = [
  "libc",
 ]
@@ -6087,9 +6182,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.5.6"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -6144,6 +6239,12 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
 [[package]]
 name = "subtle"
 version = "2.5.0"
@@ -6157,15 +6258,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
 dependencies = [
  "proc-macro2",
- "quote",
  "unicode-ident",
 ]
 
 [[package]]
 name = "syn"
-version = "2.0.58"
+version = "2.0.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44cfb93f38070beee36b3fef7d4f5a16f27751d94b187b666a5cc5e9b0d30687"
+checksum = "c42f3f41a2de00b01c0aaad383c5a45241efc8b2d1eda5661812fda5f3cdcff5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6178,6 +6278,12 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
+[[package]]
+name = "sync_wrapper"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
+
 [[package]]
 name = "system-configuration"
 version = "0.5.1"
@@ -6257,7 +6363,7 @@ checksum = "7ba277e77219e9eea169e8508942db1bf5d8a41ff2db9b20aab5a5aadc9fa25d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -6270,7 +6376,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -6287,22 +6393,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.58"
+version = "1.0.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
+checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.58"
+version = "1.0.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
+checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -6327,9 +6433,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.34"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
@@ -6348,9 +6454,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
  "num-conv",
  "time-core",
@@ -6373,9 +6479,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.37.0"
+version = "1.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
+checksum = "ba4f4a02a7a80d6f274636f0aa95c7e383b912d41fe721a31f29e29698585a4a"
 dependencies = [
  "backtrace",
  "bytes",
@@ -6385,20 +6491,20 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.5.6",
+ "socket2 0.5.7",
  "tokio-macros",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
+checksum = "5f5ae998a069d4b5aba8ee9dad856af7d520c3699e6159b185c2acd48155d39a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -6417,7 +6523,18 @@ version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
 dependencies = [
- "rustls",
+ "rustls 0.21.12",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
+dependencies = [
+ "rustls 0.23.10",
+ "rustls-pki-types",
  "tokio",
 ]
 
@@ -6460,35 +6577,34 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
+checksum = "9cf6b47b3771c49ac75ad09a6162f53ad4b8088b76ac60e8ec1455b31a189fe1"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
  "pin-project-lite",
  "tokio",
- "tracing",
 ]
 
 [[package]]
 name = "toml"
-version = "0.8.12"
+version = "0.8.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9dd1545e8208b4a5af1aa9bbd0b4cf7e9ea08fabc5d0a5c67fcaafa17433aa3"
+checksum = "6f49eb2ab21d2f26bd6db7bf383edc527a7ebaee412d17af4d40fdccd442f335"
 dependencies = [
  "serde",
  "serde_spanned",
  "toml_datetime",
- "toml_edit 0.22.9",
+ "toml_edit 0.22.14",
 ]
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.5"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
+checksum = "4badfd56924ae69bcc9039335b2e017639ce3f9b001c393c1b2d1ef846ce2cbf"
 dependencies = [
  "serde",
 ]
@@ -6506,15 +6622,15 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.22.9"
+version = "0.22.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e40bb779c5187258fd7aad0eb68cb8706a0a81fa712fbea808ab43c4b8374c4"
+checksum = "f21c7aaf97f1bd9ca9d4f9e73b0a6c74bd5afef56f2bc931943a6e1c37e04e38"
 dependencies = [
  "indexmap 2.2.6",
  "serde",
  "serde_spanned",
  "toml_datetime",
- "winnow 0.6.5",
+ "winnow 0.6.13",
 ]
 
 [[package]]
@@ -6530,7 +6646,6 @@ dependencies = [
  "tokio",
  "tower-layer",
  "tower-service",
- "tracing",
 ]
 
 [[package]]
@@ -6565,7 +6680,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
@@ -6648,6 +6763,25 @@ name = "tungstenite"
 version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http 1.1.0",
+ "httparse",
+ "log",
+ "rand",
+ "sha1",
+ "thiserror",
+ "url",
+ "utf-8",
+]
+
+[[package]]
+name = "tungstenite"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e2ce1e47ed2994fd43b04c8f618008d4cabdd5ee34027cf14f9d918edd9c8"
 dependencies = [
  "byteorder",
  "bytes",
@@ -6707,9 +6841,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-width"
-version = "0.1.11"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
+checksum = "0336d538f7abc86d282a4189614dfaa90810dfc2c6f6427eaf88e16311dd225d"
 
 [[package]]
 name = "untrusted"
@@ -6719,9 +6853,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.0"
+version = "2.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
+checksum = "22784dbdf76fdde8af1aeda5622b546b422b6fc585325248a2bf9f5e41e94d6c"
 dependencies = [
  "form_urlencoded",
  "idna 0.5.0",
@@ -6751,9 +6885,9 @@ checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
 [[package]]
 name = "utf8parse"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
@@ -6824,9 +6958,9 @@ checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
 
 [[package]]
 name = "waker-fn"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c4517f54858c779bbcbf228f4fca63d121bf85fbecb2dc578cdf4a39395690"
+checksum = "317211a0dc0ceedd78fb2ca9a44aed3d7b9b26f81870d485c07122b4350673b7"
 
 [[package]]
 name = "walkdir"
@@ -6858,7 +6992,7 @@ dependencies = [
  "futures-util",
  "headers 0.3.9",
  "http 0.2.12",
- "hyper 0.14.28",
+ "hyper 0.14.29",
  "log",
  "mime",
  "mime_guess",
@@ -6903,7 +7037,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
  "wasm-bindgen-shared",
 ]
 
@@ -6937,7 +7071,7 @@ checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -6982,11 +7116,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
 dependencies = [
- "winapi",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -7001,7 +7135,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.4",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -7019,7 +7153,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.4",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -7039,17 +7173,18 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.4",
- "windows_aarch64_msvc 0.52.4",
- "windows_i686_gnu 0.52.4",
- "windows_i686_msvc 0.52.4",
- "windows_x86_64_gnu 0.52.4",
- "windows_x86_64_gnullvm 0.52.4",
- "windows_x86_64_msvc 0.52.4",
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]
 
 [[package]]
@@ -7060,9 +7195,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -7072,9 +7207,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -7084,9 +7219,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -7096,9 +7237,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -7108,9 +7249,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -7120,9 +7261,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -7132,9 +7273,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 
 [[package]]
 name = "winnow"
@@ -7147,9 +7288,9 @@ dependencies = [
 
 [[package]]
 name = "winnow"
-version = "0.6.5"
+version = "0.6.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dffa400e67ed5a4dd237983829e66475f0a4a26938c4b04c21baede6262215b8"
+checksum = "59b5e5f6c299a3c7890b876a2a587f3115162487e704907d9b6cd29473052ba1"
 dependencies = [
  "memchr",
 ]
@@ -7224,11 +7365,11 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.7.32"
+version = "0.7.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+checksum = "ae87e3fcd617500e5d106f0380cf7b77f3c6092aae37191433159dda23cfb087"
 dependencies = [
- "zerocopy-derive 0.7.32",
+ "zerocopy-derive 0.7.34",
 ]
 
 [[package]]
@@ -7239,22 +7380,22 @@ checksum = "125139de3f6b9d625c39e2efdd73d41bdac468ccd556556440e322be0e1bbd91"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.7.32"
+version = "0.7.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+checksum = "15e934569e47891f7d9411f1a451d947a60e000ab3bd24fbb970f000387d1b3b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn 2.0.66",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.7.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index 9e8d95b77a90..3e8eec7b8a60 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -144,7 +144,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-rs";
-  version = "0.12.4";
+  version = "0.12.8";
 
   outputs = [ "out" "dev" ];
 
@@ -153,7 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "gstreamer";
     repo = "gst-plugins-rs";
     rev = finalAttrs.version;
-    hash = "sha256-Qnp+e1Vww2kWjDG0x2tcigwDdG67I4xnm8+QrBI+o08=";
+    hash = "sha256-AGXKI/0Y2BdaSnpQAt3T/rkYlM8UpQpKm4kMAGd6Dyk=";
     # TODO: temporary workaround for case-insensitivity problems with color-name crate - https://github.com/annymosse/color-name/pull/2
     postFetch = ''
       sedSearch="$(cat <<\EOF | sed -ze 's/\n/\\n/g'
@@ -178,12 +178,12 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "cairo-rs-0.19.3" = "sha256-TjVXdnlYEfPLbUx1pC84rCC2MlNecECMK2Yo9XKwz9M=";
+      "cairo-rs-0.19.8" = "sha256-AdIUcxxuZVAWQ+KOBTrtsvTu4KtFiXkQPYWT9Avt7Z0=";
       "color-name-1.1.0" = "sha256-RfMStbe2wX5qjPARHIFHlSDKjzx8DwJ+RjzyltM5K7A=";
       "ffv1-0.0.0" = "sha256-af2VD00tMf/hkfvrtGrHTjVJqbl+VVpLaR0Ry+2niJE=";
       "flavors-0.2.0" = "sha256-zBa0X75lXnASDBam9Kk6w7K7xuH9fP6rmjWZBUB5hxk=";
-      "gdk4-0.8.1" = "sha256-VPmegFZ/bC8x1vkl3YU208jQ8FCEKLwe6ZDatz4mIvM=";
-      "gstreamer-0.22.4" = "sha256-r5+wOEhTVztDMEu6t47yJ9HIlbXyjdvswUND4l7kPl8=";
+      "gdk4-0.8.2" = "sha256-DZjHlhzrELZ8M5YUM5kSeOphjF7863DmywFgGbZL4Jo=";
+      "gstreamer-0.22.7" = "sha256-vTEDqmyqhj9e7r7N0QfG4uTNBizrU0gTUfLOJ8kU1JE=";
     };
   };
 
diff --git a/pkgs/development/libraries/kde-frameworks/kimageformats.nix b/pkgs/development/libraries/kde-frameworks/kimageformats.nix
index d516081da2d7..5954d56e6cca 100644
--- a/pkgs/development/libraries/kde-frameworks/kimageformats.nix
+++ b/pkgs/development/libraries/kde-frameworks/kimageformats.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules,
-  ilmbase, karchive, openexr, dav1d, libaom, libavif, libheif, libjxl, libraw, libyuv, qtbase
+  ilmbase, karchive, openexr, libavif, libheif, libjxl, libraw, qtbase
 }:
 
 let inherit (lib) getDev; in
@@ -10,7 +10,7 @@ mkDerivation {
   pname = "kimageformats";
 
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ karchive openexr libaom libavif dav1d libheif libjxl libraw libyuv qtbase ];
+  buildInputs = [ karchive openexr libavif libheif libjxl libraw qtbase ];
   outputs = [ "out" ]; # plugins only
   CXXFLAGS = "-I${getDev ilmbase}/include/OpenEXR";
   cmakeFlags = [
diff --git a/pkgs/development/libraries/libavif/default.nix b/pkgs/development/libraries/libavif/default.nix
index ec2c22a247c0..8e7ebeb0a251 100644
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@@ -48,11 +48,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gdk-pixbuf
-    libaom
     zlib
     libpng
     libjpeg
+  ];
+
+  propagatedBuildInputs = [
     dav1d
+    libaom
     libyuv
   ];
 
diff --git a/pkgs/development/libraries/libgit2-glib/default.nix b/pkgs/development/libraries/libgit2-glib/default.nix
index cd2f10d15782..abf15fdec4d8 100644
--- a/pkgs/development/libraries/libgit2-glib/default.nix
+++ b/pkgs/development/libraries/libgit2-glib/default.nix
@@ -13,6 +13,7 @@
 , libgit2
 , glib
 , python3
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -26,6 +27,15 @@ stdenv.mkDerivation rec {
     sha256 = "EzHa2oOPTh9ZGyZFnUQSajJd52LcPNJhU6Ma+9/hgZA=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "support-libgit2-1.8.patch";
+      # https://gitlab.gnome.org/GNOME/libgit2-glib/-/merge_requests/40
+      url = "https://gitlab.gnome.org/GNOME/libgit2-glib/-/commit/a76fdf96c3af9ce9d21a3985c4be8a1aa6eea661.patch";
+      hash = "sha256-ysU8pAixyftensfEC9bE0RUFMPMei0jYT26WKN5uOFE=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/libgit2/default.nix b/pkgs/development/libraries/libgit2/default.nix
index 58212e00d89e..e110ceb67aa8 100644
--- a/pkgs/development/libraries/libgit2/default.nix
+++ b/pkgs/development/libraries/libgit2/default.nix
@@ -8,7 +8,6 @@
 , libssh2
 , openssl
 , pcre
-, http-parser
 , libiconv
 , Security
 , staticBuild ? stdenv.hostPlatform.isStatic
@@ -16,11 +15,14 @@
 , libgit2-glib
 , python3Packages
 , gitstatus
+, llhttp
+, withGssapi ? false
+, krb5
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libgit2";
-  version = "1.7.2";
+  version = "1.8.1";
   # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib
 
   outputs = ["lib" "dev" "out"];
@@ -28,13 +30,14 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
-    rev = "v${version}";
-    hash = "sha256-fVPY/byE2/rxmv/bUykcAbmUFMlF3UZogVuTzjOXJUU=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-J2rCxTecyLbbDdsyBWn9w7r3pbKRMkI9E7RvRgAqBdY=";
   };
 
   cmakeFlags = [
     "-DUSE_HTTP_PARSER=system"
     "-DUSE_SSH=ON"
+    (lib.cmakeBool "USE_GSSAPI" withGssapi)
     "-DBUILD_SHARED_LIBS=${if staticBuild then "OFF" else "ON"}"
   ] ++ lib.optionals stdenv.hostPlatform.isWindows [
     "-DDLLTOOL=${stdenv.cc.bintools.targetPrefix}dlltool"
@@ -44,7 +47,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake python3 pkg-config ];
 
-  buildInputs = [ zlib libssh2 openssl pcre http-parser ]
+  buildInputs = [ zlib libssh2 openssl pcre llhttp ]
+    ++ lib.optional withGssapi krb5
     ++ lib.optional stdenv.isDarwin Security;
 
   propagatedBuildInputs = lib.optional (!stdenv.isLinux) libiconv;
@@ -66,7 +70,7 @@ stdenv.mkDerivation rec {
     )
   '';
 
-  passthru.tests = {
+  passthru.tests = lib.mapAttrs (_: v: v.override { libgit2 = finalAttrs.finalPackage; }) {
     inherit libgit2-glib;
     inherit (python3Packages) pygit2;
     inherit gitstatus;
@@ -80,4 +84,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
-}
+})
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index d3ee9581305c..9d5db75bb121 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -41,6 +41,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
+    icu
     ninja
     perl
     pkg-config
diff --git a/pkgs/development/libraries/libipt/default.nix b/pkgs/development/libraries/libipt/default.nix
index ed88ed8f2828..61ec0ce67d88 100644
--- a/pkgs/development/libraries/libipt/default.nix
+++ b/pkgs/development/libraries/libipt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, cmake, freebsd }:
 
 stdenv.mkDerivation rec {
   pname = "libipt";
@@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
+  buildInputs = lib.optional stdenv.isFreeBSD freebsd.libstdthreads;
 
   meta = with lib; {
     description = "Intel Processor Trace decoder library";
diff --git a/pkgs/development/libraries/libjodycode/default.nix b/pkgs/development/libraries/libjodycode/default.nix
index 2a99ed5feca3..b2ce994dc5b9 100644
--- a/pkgs/development/libraries/libjodycode/default.nix
+++ b/pkgs/development/libraries/libjodycode/default.nix
@@ -1,24 +1,34 @@
-{ lib
-, stdenv
-, fetchFromGitea
+{
+  lib,
+  stdenv,
+  fetchFromGitea,
+  jdupes,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libjodycode";
-  version = "3.1";
+  version = "3.1.1";
 
-  outputs = [ "out" "man" "dev" ];
+  outputs = [
+    "out"
+    "man"
+    "dev"
+  ];
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "jbruchon";
     repo = "libjodycode";
     rev = "v${version}";
-    hash = "sha256-uhWQh5YwLwYRm34nY5HvcEepqlTSDt9s3PSoD403kQM=";
+    hash = "sha256-sVEa2gNvgRJK1Ycmv4inbViTBPQFjzcZ8XHlAdsNzOk=";
   };
 
   env.PREFIX = placeholder "out";
 
+  passthru.tests = {
+    inherit jdupes;
+  };
+
   meta = with lib; {
     description = "Shared code used by several utilities written by Jody Bruchon";
     homepage = "https://github.com/jbruchon/libjodycode";
diff --git a/pkgs/development/libraries/libksba/default.nix b/pkgs/development/libraries/libksba/default.nix
index fdebb9d9dc27..5eb07184c651 100644
--- a/pkgs/development/libraries/libksba/default.nix
+++ b/pkgs/development/libraries/libksba/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libksba";
-  version = "1.6.6";
+  version = "1.6.7";
 
   src = fetchurl {
     url = "mirror://gnupg/libksba/libksba-${version}.tar.bz2";
-    hash = "sha256-XewDPSEVWTOIOMDElXxz39w+6G9zl31ieWQMnNCM5qQ=";
+    hash = "sha256-z3JRC467TrZpPu92V0nYNnegPHkpGjEQQKW/15uqt2M=";
   };
 
   outputs = [ "out" "dev" "info" ];
diff --git a/pkgs/development/libraries/libpipeline/default.nix b/pkgs/development/libraries/libpipeline/default.nix
index 3630980353a5..3aeb79b46af8 100644
--- a/pkgs/development/libraries/libpipeline/default.nix
+++ b/pkgs/development/libraries/libpipeline/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, updateAutotoolsGnuConfigScriptsHook }:
 
 stdenv.mkDerivation rec {
   pname = "libpipeline";
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
 
   patches = lib.optionals stdenv.isDarwin [ ./fix-on-osx.patch ];
 
+  # necessary to build on FreeBSD native pending inclusion of
+  # https://git.savannah.gnu.org/cgit/config.git/commit/?id=e4786449e1c26716e3f9ea182caf472e4dbc96e0
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
+
   meta = with lib; {
     homepage = "http://libpipeline.nongnu.org";
     description = "C library for manipulating pipelines of subprocesses in a flexible and convenient way";
diff --git a/pkgs/development/libraries/libproxy/default.nix b/pkgs/development/libraries/libproxy/default.nix
index 1183f46799ef..59b2966711dd 100644
--- a/pkgs/development/libraries/libproxy/default.nix
+++ b/pkgs/development/libraries/libproxy/default.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libproxy";
-  version = "0.5.6";
+  version = "0.5.7";
 
   outputs = [ "out" "dev" "devdoc" ];
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libproxy";
     repo = "libproxy";
     rev = finalAttrs.version;
-    hash = "sha256-2uDlKjxzrKlyZKV0BSUDzmLSo2voJKDerbZZkamgNYk=";
+    hash = "sha256-VKVazLkmm1BZeGxrQmkpHors27bki0l8US3ZGI6OR0w=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libproxy/hardcode-gsettings.patch b/pkgs/development/libraries/libproxy/hardcode-gsettings.patch
index 22aeb5836f9c..6f4b3ec0e031 100644
--- a/pkgs/development/libraries/libproxy/hardcode-gsettings.patch
+++ b/pkgs/development/libraries/libproxy/hardcode-gsettings.patch
@@ -1,8 +1,8 @@
 diff --git a/src/backend/plugins/config-gnome/config-gnome.c b/src/backend/plugins/config-gnome/config-gnome.c
-index 820827b..338e269 100644
+index 52e812e..a1141c5 100644
 --- a/src/backend/plugins/config-gnome/config-gnome.c
 +++ b/src/backend/plugins/config-gnome/config-gnome.c
-@@ -85,11 +85,60 @@ px_config_gnome_init (PxConfigGnome *self)
+@@ -83,11 +83,60 @@ px_config_gnome_init (PxConfigGnome *self)
    if (!self->available)
      return;
  
@@ -69,7 +69,7 @@ index 820827b..338e269 100644
  
  static void
 diff --git a/tests/config-gnome-test.c b/tests/config-gnome-test.c
-index f80914a..118d429 100644
+index 677a3e9..a28d277 100644
 --- a/tests/config-gnome-test.c
 +++ b/tests/config-gnome-test.c
 @@ -60,11 +60,60 @@ static void
diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index 18927df1f1bc..d05481a1dc2b 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -10,6 +10,7 @@
 , libxslt
 , pkg-config
 , python3
+, buildPackages
 , publicsuffix-list
 }:
 
@@ -32,7 +33,6 @@ stdenv.mkDerivation rec {
     gtk-doc
     lzip
     pkg-config
-    python3
     libxslt
   ];
 
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
     libidn2
     libunistring
     libxslt
+    python3
   ];
 
   propagatedBuildInputs = [
@@ -60,6 +61,7 @@ stdenv.mkDerivation rec {
     "--with-psl-distfile=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
     "--with-psl-file=${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
     "--with-psl-testfile=${publicsuffix-list}/share/publicsuffix/test_psl.txt"
+    "PYTHON=${lib.getExe buildPackages.python3}"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libtheora/default.nix b/pkgs/development/libraries/libtheora/default.nix
deleted file mode 100644
index d529c22c9f67..000000000000
--- a/pkgs/development/libraries/libtheora/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, stdenv, fetchurl, libogg, libvorbis, pkg-config, autoreconfHook, fetchpatch }:
-
-stdenv.mkDerivation rec {
-  pname = "libtheora";
-  version = "1.1.1";
-
-  src = fetchurl {
-    url = "https://downloads.xiph.org/releases/theora/${pname}-${version}.tar.gz";
-    sha256 = "0swiaj8987n995rc7hw0asvpwhhzpjiws8kr3s6r44bqqib2k5a0";
-  };
-
-  patches = [
-    # fix error in autoconf scripts
-    (fetchpatch {
-      url = "https://github.com/xiph/theora/commit/28cc6dbd9b2a141df94f60993256a5fca368fa54.diff";
-      sha256 = "16jqrq4h1b3krj609vbpzd5845cvkbh3mwmjrcdg35m490p19x9k";
-    })
-  ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
-    ./mingw-remove-export.patch
-  ];
-
-  configureFlags = [ "--disable-examples" ];
-
-  outputs = [ "out" "dev" "devdoc" ];
-  outputDoc = "devdoc";
-
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
-  propagatedBuildInputs = [ libogg libvorbis ];
-
-  meta = with lib; {
-    homepage = "https://www.theora.org/";
-    description = "Library for Theora, a free and open video compression format";
-    license = licenses.bsd3;
-    maintainers = [ ];
-    platforms = platforms.unix ++ platforms.windows;
-  };
-}
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 22aab5c66944..0e9a0d54e178 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Dtests=${if doCheck then "enabled" else "disabled"}"
+    "--sysconfdir=/etc"
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index be57d0591005..522283b7226c 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , pkg-config
 , autoreconfHook
 , libintl
@@ -25,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxml2";
-  version = "2.13.2";
+  version = "2.13.3";
 
   outputs = [ "bin" "dev" "out" "devdoc" ]
     ++ lib.optional pythonSupport "py"
@@ -34,28 +33,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor finalAttrs.version}/libxml2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-58j14LVUIVng3cQJwiyRZDBLWB6qmTBlOnb7hFsWkmM=";
+    hash = "sha256-CAXXwYDPCcqtcWZsekWKdPBBVhpTKQJFTaUEfYOUgTg=";
   };
 
-  patches = [
-    # Fix XInclude failing too aggresively.
-    # https://gitlab.gnome.org/GNOME/libxml2/-/issues/772
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/a0330b53c8034bb79220e403e8d4ad8c23ef088f.patch";
-      hash = "sha256-iVAgX8qNF0fw8GYUKsWduudjEuRMEOTAENAIFTjyRjU=";
-    })
-    # Fix error handling
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/ed8b4264f65b1ced1e3b13967dd1cf90102cfa40.patch";
-      hash = "sha256-EvxoUcr+VXBbYvK1PBV+KWcWTDk9rMWf+GXCYvXWDMI=";
-    })
-    # Fix more error handling
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/e30cb632e734394ddbd7bd62b57cee3586424352.patch";
-      hash = "sha256-C0ef17wTRC9rH0dKua/LJwwqTRI5W8sKWmvL7JxzT4o=";
-    })
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
index 1a60c136be56..06efd715c23f 100644
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "24.1.4";
+  version = "24.1.5";
 
   src = fetchurl {
     urls = [
       "https://archive.mesa3d.org/mesa-${version}.tar.xz"
       "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    hash = "sha256-fPfG9mUmOtASKInB1LB2ZUwe7ep6LzjGnIxRV5k3reE=";
+    hash = "sha256-AnYf/ZZd1kuVQh6/yhGR1zckq6APMANACSN1ZPNM+XY=";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 2266716bd9da..6f3f7b45b569 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -139,12 +139,10 @@ in stdenv.mkDerivation {
   patches = [
     ./opencl.patch
 
-    # https://gitlab.freedesktop.org/mesa/mesa/-/issues/11533
-    (fetchpatch {
-      name = "ffmpeg.patch";
-      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/241f70e5a13bb9c13a168282446ad074e16c3d74.patch";
-      hash = "sha256-Cx7OL8iXGAOuDbCQReCCxSrWYvfZVrGoP0txIKSLTvs=";
-    })
+    # Manual backport of https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/30510
+    # Fixes video corruption / crashes when decoding video on AMD iGPUs
+    # FIXME: remove when merged
+    ./vcn-pagefault.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/mesa/vcn-pagefault.patch b/pkgs/development/libraries/mesa/vcn-pagefault.patch
new file mode 100644
index 000000000000..9b8c7b99c564
--- /dev/null
+++ b/pkgs/development/libraries/mesa/vcn-pagefault.patch
@@ -0,0 +1,10 @@
+--- a/src/gallium/drivers/radeonsi/radeon_vcn_dec.c
++++ b/src/gallium/drivers/radeonsi/radeon_vcn_dec.c
+@@ -1390,6 +1390,7 @@ static unsigned rvcn_dec_dynamic_dpb_t2_message(struct radeon_decoder *dec, rvcn
+                            dummy->dpb.res;
+                addr = dec->ws->buffer_get_virtual_address(dummy_res->buf);
+             }
++            dec->ws->cs_add_buffer(&dec->cs, d->dpb.res->buf, RADEON_USAGE_READWRITE | RADEON_USAGE_SYNCHRONIZED, RADEON_DOMAIN_VRAM);
+             dynamic_dpb_t2->dpbAddrLo[i] = addr;
+             dynamic_dpb_t2->dpbAddrHi[i] = addr >> 32;
+             ++dynamic_dpb_t2->dpbArraySize;
diff --git a/pkgs/development/libraries/mpfr/default.nix b/pkgs/development/libraries/mpfr/default.nix
index dec33a63d155..2ba09fc226fd 100644
--- a/pkgs/development/libraries/mpfr/default.nix
+++ b/pkgs/development/libraries/mpfr/default.nix
@@ -3,6 +3,7 @@
 , fetchurl
 , gmp
 , writeScript
+, updateAutotoolsGnuConfigScriptsHook
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -25,6 +26,9 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "doc" "info" ];
 
   strictDeps = true;
+  # necessary to build on FreeBSD native pending inclusion of
+  # https://git.savannah.gnu.org/cgit/config.git/commit/?id=e4786449e1c26716e3f9ea182caf472e4dbc96e0
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
   # mpfr.h requires gmp.h
   propagatedBuildInputs = [ gmp ];
 
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index 2473ee1dd4d8..f1b8c6df4acf 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.101.1";
-  hash = "sha256-KcRiOUbdFnH618MFM6uxmRn+/Jn4QMHtv1BELXrCAX4=";
+  version = "3.101.2";
+  hash = "sha256-i5K47pzQYOiD4vFHBN6VeqXEdPBOM7U1oSK0qSi2M2Y=";
 }
diff --git a/pkgs/development/libraries/pcre/default.nix b/pkgs/development/libraries/pcre/default.nix
index 5b86dc223087..58873ae87557 100644
--- a/pkgs/development/libraries/pcre/default.nix
+++ b/pkgs/development/libraries/pcre/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv, fetchurl, fetchpatch
+{ lib, stdenv, fetchurl, fetchpatch, updateAutotoolsGnuConfigScriptsHook
 , pcre, windows ? null
+  # Disable jit on Apple Silicon, https://github.com/zherczeg/sljit/issues/51
+, enableJit ? !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)
 , variant ? null
 }:
 
@@ -18,11 +20,12 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "dev" "out" "doc" "man" ];
 
-  # Disable jit on Apple Silicon, https://github.com/zherczeg/sljit/issues/51
-  configureFlags = lib.optional (!(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) "--enable-jit=auto" ++ [
+  hardeningDisable = lib.optional enableJit "shadowstack";
+
+  configureFlags = [
     "--enable-unicode-properties"
     "--disable-cpp"
-  ]
+  ] ++ lib.optional enableJit "--enable-jit=auto"
     ++ lib.optional (variant != null) "--enable-${variant}";
 
   patches = [
@@ -37,6 +40,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  # necessary to build on FreeBSD native pending inclusion of
+  # https://git.savannah.gnu.org/cgit/config.git/commit/?id=e4786449e1c26716e3f9ea182caf472e4dbc96e0
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
+
   preCheck = ''
     patchShebangs RunGrepTest
   '';
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index c0540e4080fe..d9ddee2b1022 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -5,7 +5,7 @@
 , meson
 , ninja
 , systemd
-, enableSystemd ? true
+, enableSystemd ? true # enableSystemd=false maintained by maintainers.qyliss.
 , pkg-config
 , docutils
 , doxygen
@@ -27,55 +27,38 @@
 , lilv
 , makeFontsConf
 , nixosTests
-, withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind
 , valgrind
-, libcameraSupport ? true
 , libcamera
 , libdrm
-, gstreamerSupport ? true
 , gst_all_1
-, ffmpegSupport ? true
 , ffmpeg
-, bluezSupport ? true
 , bluez
 , sbc
 , libfreeaptx
 , liblc3
 , fdk_aac
 , libopus
-, ldacbtSupport ? bluezSupport && lib.meta.availableOn stdenv.hostPlatform ldacbt
 , ldacbt
-, nativeHspSupport ? true
-, nativeHfpSupport ? true
-, nativeModemManagerSupport ? true
 , modemmanager
-, ofonoSupport ? true
-, hsphfpdSupport ? true
-, pulseTunnelSupport ? true
 , libpulseaudio
 , zeroconfSupport ? true
 , avahi
 , raopSupport ? true
 , openssl
-, opusSupport ? true
 , rocSupport ? true
 , roc-toolkit
 , x11Support ? true
 , libcanberra
 , xorg
-, mysofaSupport ? true
 , libmysofa
 , ffadoSupport ? x11Support && lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform
 , ffado
 , libselinux
 }:
 
-# Bluetooth codec only makes sense if general bluetooth enabled
-assert ldacbtSupport -> bluezSupport;
-
 stdenv.mkDerivation(finalAttrs: {
   pname = "pipewire";
-  version = "1.2.1";
+  version = "1.2.2";
 
   outputs = [
     "out"
@@ -91,7 +74,7 @@ stdenv.mkDerivation(finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     rev = finalAttrs.version;
-    sha256 = "sha256-CkxsVD813LbWpuZhJkNLJnqjLF6jmEn+CajXb2XTCsY=";
+    sha256 = "sha256-neLQ41p2f2QyOS3r2VxanaHbiVj6nnnkT7kx/On0azM=";
   };
 
   patches = [
@@ -115,35 +98,40 @@ stdenv.mkDerivation(finalAttrs: {
 
   buildInputs = [
     alsa-lib
+    bluez
     dbus
+    fdk_aac
+    ffmpeg
     glib
+    gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer
+    libcamera
     libjack2
+    libfreeaptx
+    liblc3
+    libmysofa
+    libopus
+    libpulseaudio
     libusb1
     libselinux
     libsndfile
     lilv
+    modemmanager
     ncurses
     readline
+    sbc
   ] ++ (if enableSystemd then [ systemd ] else [ udev ])
   ++ (if lib.meta.availableOn stdenv.hostPlatform webrtc-audio-processing_1 then [ webrtc-audio-processing_1 ] else [ webrtc-audio-processing ])
-  ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
-  ++ lib.optionals libcameraSupport [ libcamera ]
-  ++ lib.optional ffmpegSupport ffmpeg
-  ++ lib.optionals bluezSupport [ bluez libfreeaptx liblc3 sbc fdk_aac libopus ]
-  ++ lib.optional ldacbtSupport ldacbt
-  ++ lib.optional nativeModemManagerSupport modemmanager
-  ++ lib.optional opusSupport libopus
-  ++ lib.optional pulseTunnelSupport libpulseaudio
+  ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform ldacbt) ldacbt
   ++ lib.optional zeroconfSupport avahi
   ++ lib.optional raopSupport openssl
   ++ lib.optional rocSupport roc-toolkit
   ++ lib.optionals vulkanSupport [ libdrm vulkan-headers vulkan-loader ]
   ++ lib.optionals x11Support [ libcanberra xorg.libX11 xorg.libXfixes ]
-  ++ lib.optional mysofaSupport libmysofa
   ++ lib.optional ffadoSupport ffado;
 
   # Valgrind binary is required for running one optional test.
-  nativeCheckInputs = lib.optional withValgrind valgrind;
+  nativeCheckInputs =  lib.optional (lib.meta.availableOn stdenv.hostPlatform valgrind) valgrind;
 
   mesonFlags = [
     (lib.mesonEnable "docs" true)
@@ -151,28 +139,29 @@ stdenv.mkDerivation(finalAttrs: {
     (lib.mesonEnable "installed_tests" true)
     (lib.mesonOption "installed_test_prefix" (placeholder "installedTests"))
     (lib.mesonOption "libjack-path" "${placeholder "jack"}/lib")
-    (lib.mesonEnable "libcamera" libcameraSupport)
+    (lib.mesonEnable "libcamera" true)
     (lib.mesonEnable "libffado" ffadoSupport)
     (lib.mesonEnable "roc" rocSupport)
-    (lib.mesonEnable "libpulse" pulseTunnelSupport)
+    (lib.mesonEnable "libpulse" true)
     (lib.mesonEnable "avahi" zeroconfSupport)
-    (lib.mesonEnable "gstreamer" gstreamerSupport)
+    (lib.mesonEnable "gstreamer" true)
+    (lib.mesonEnable "gstreamer-device-provider" true)
     (lib.mesonEnable "systemd" enableSystemd)
     (lib.mesonEnable "systemd-system-service" enableSystemd)
     (lib.mesonEnable "udev" (!enableSystemd))
-    (lib.mesonEnable "ffmpeg" ffmpegSupport)
-    (lib.mesonEnable "pw-cat-ffmpeg" ffmpegSupport)
-    (lib.mesonEnable "bluez5" bluezSupport)
-    (lib.mesonEnable "bluez5-backend-hsp-native" nativeHspSupport)
-    (lib.mesonEnable "bluez5-backend-hfp-native" nativeHfpSupport)
-    (lib.mesonEnable "bluez5-backend-native-mm" nativeModemManagerSupport)
-    (lib.mesonEnable "bluez5-backend-ofono" ofonoSupport)
-    (lib.mesonEnable "bluez5-backend-hsphfpd" hsphfpdSupport)
+    (lib.mesonEnable "ffmpeg" true)
+    (lib.mesonEnable "pw-cat-ffmpeg" true)
+    (lib.mesonEnable "bluez5" true)
+    (lib.mesonEnable "bluez5-backend-hsp-native" true)
+    (lib.mesonEnable "bluez5-backend-hfp-native" true)
+    (lib.mesonEnable "bluez5-backend-native-mm" true)
+    (lib.mesonEnable "bluez5-backend-ofono" true)
+    (lib.mesonEnable "bluez5-backend-hsphfpd" true)
     # source code is not easily obtainable
     (lib.mesonEnable "bluez5-codec-lc3plus" false)
-    (lib.mesonEnable "bluez5-codec-lc3" bluezSupport)
-    (lib.mesonEnable "bluez5-codec-ldac" ldacbtSupport)
-    (lib.mesonEnable "opus" opusSupport)
+    (lib.mesonEnable "bluez5-codec-lc3" true)
+    (lib.mesonEnable "bluez5-codec-ldac" true)
+    (lib.mesonEnable "opus" true)
     (lib.mesonOption "sysconfdir" "/etc")
     (lib.mesonEnable "raop" raopSupport)
     (lib.mesonOption "session-managers" "")
@@ -180,7 +169,7 @@ stdenv.mkDerivation(finalAttrs: {
     (lib.mesonEnable "x11" x11Support)
     (lib.mesonEnable "x11-xfixes" x11Support)
     (lib.mesonEnable "libcanberra" x11Support)
-    (lib.mesonEnable "libmysofa" mysofaSupport)
+    (lib.mesonEnable "libmysofa" true)
     (lib.mesonEnable "sdl2" false) # required only to build examples, causes dependency loop
     (lib.mesonBool "rlimits-install" false) # installs to /etc, we won't use this anyway
     (lib.mesonEnable "compress-offload" true)
diff --git a/pkgs/development/libraries/protobuf/25.nix b/pkgs/development/libraries/protobuf/25.nix
index 782906d0b5b7..a5a6a3419b5f 100644
--- a/pkgs/development/libraries/protobuf/25.nix
+++ b/pkgs/development/libraries/protobuf/25.nix
@@ -1,6 +1,6 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix ({
-  version = "25.3";
-  hash = "sha256-N/mO9a6NyC0GwxY3/u1fbFbkfH7NTkyuIti6L3bc+7k=";
+  version = "25.4";
+  hash = "sha256-dIouv6QaX6Tlahjrdz250DJkKjZ74/EwoQjTs3vBS/U=";
 } // args)
diff --git a/pkgs/development/libraries/qt-6/modules/qtwayland.nix b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
index 512b084a0bf5..8d2fad7cf9da 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@@ -10,6 +10,7 @@
 qtModule {
   pname = "qtwayland";
   propagatedBuildInputs = [ qtbase qtdeclarative ];
+  propagatedNativeBuildInputs = [ wayland ];
   buildInputs = [ wayland libdrm ];
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index f2de9320ce85..27b2e4c993fd 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     fi
 
     # Necessary for FTS5 on Linux
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lm"
+    export NIX_CFLAGS_LINK="$NIX_CFLAGS_LINK -lm"
 
     echo ""
     echo "NIX_CFLAGS_COMPILE = $NIX_CFLAGS_COMPILE"
diff --git a/pkgs/development/libraries/x265/default.nix b/pkgs/development/libraries/x265/default.nix
index 9d485f7d6d2e..b0d6fc09c709 100644
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@@ -2,7 +2,6 @@
 , gccStdenv
 , stdenv
 , fetchurl
-, fetchpatch
 , cmake
 , nasm
 
@@ -31,7 +30,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "x265";
-  version = "3.5";
+  version = "3.6";
 
   outputs = [ "out" "dev" ];
 
@@ -39,40 +38,11 @@ stdenv.mkDerivation rec {
   # whether we fetch a source tarball or a tag from the git repo
   src = fetchurl {
     url = "https://bitbucket.org/multicoreware/x265_git/downloads/x265_${version}.tar.gz";
-    hash = "sha256-5wozNcrKy7oLOiDsb+zWeDkyKI68gWOtdLzJYGR3yug=";
+    hash = "sha256-ZjUx80HFOJ9GDXMOYuEKT8yjQoyiyhCWk4Z7xf4uKAc=";
   };
 
   sourceRoot = "x265_${version}/source";
 
-  patches = [
-    # More aliases for ARM platforms + do not force CLFAGS for ARM :
-    (fetchpatch {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/x265/files/arm-r1.patch?id=1d1de341e1404a46b15ae3e84bc400d474cf1a2c";
-      sha256 = "1hgzq5vxkwh0nyikxjfz8gz3jvx2nq3yy12mz3fn13qvzdlb5ilp";
-    })
-    # use proper check to avoid undefined symbols when enabling assembly on ARM :
-    (fetchpatch {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/x265/files/neon.patch?id=1d1de341e1404a46b15ae3e84bc400d474cf1a2c";
-      sha256 = "1mmshpbyldrfqxfmdajqal4l647zvlrwdai8pxw99qg4v8gajfii";
-    })
-    # More complete PPC64 matches :
-    (fetchpatch {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/x265/files/x265-3.3-ppc64.patch?id=1d1de341e1404a46b15ae3e84bc400d474cf1a2c";
-      sha256 = "1mvw678xfm0vr59n5jilq56qzcgk1gmcip2afyafkqiv21nbms8c";
-    })
-    # Namespace functions for multi-bitdepth builds so that libraries are self-contained (and tests succeeds) :
-    (fetchpatch {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/x265/files/test-ns.patch?id=1d1de341e1404a46b15ae3e84bc400d474cf1a2c";
-      sha256 = "0zg3g53l07yh7ar5c241x50y5zp7g8nh8rh63ad4bdpchpc2f52d";
-    })
-    # Fix detection of NEON (and armv6 build) :
-    ./fix-neon-detection.patch
-  ]
-    # CMake files require a bit of patching to support CMAKE_ASM_COMPILER.
-    # Made by @RossComputerGuy for x265 v3.5.
-    # https://mailman.videolan.org/pipermail/x265-devel/2024-July/013734.html
-    ++ lib.optional (stdenv.cc.isClang && !stdenv.targetPlatform.isDarwin) ./fix-clang-asm.patch;
-
   postPatch = ''
     substituteInPlace cmake/Version.cmake \
       --replace "unknown" "${version}" \
diff --git a/pkgs/development/libraries/x265/fix-neon-detection.patch b/pkgs/development/libraries/x265/fix-neon-detection.patch
deleted file mode 100644
index dbb826e54668..000000000000
--- a/pkgs/development/libraries/x265/fix-neon-detection.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-commit 72489cd0a1c229258abe4f20e4fdfd414dfa88da
-Author: rnhmjoj <rnhmjoj@inventati.org>
-Date:   Sun Oct 2 00:15:24 2022 +0200
-
-    Fix NEON detection
-
-diff --git a/cmake/FindNeon.cmake b/cmake/FindNeon.cmake
-index 0062449..9c436d9 100644
---- a/cmake/FindNeon.cmake
-+++ b/cmake/FindNeon.cmake
-@@ -1,10 +1,11 @@
- include(FindPackageHandleStandardArgs)
- 
- # Check the version of neon supported by the ARM CPU
--execute_process(COMMAND cat /proc/cpuinfo | grep Features | grep neon
--                OUTPUT_VARIABLE neon_version
--                ERROR_QUIET
--                OUTPUT_STRIP_TRAILING_WHITESPACE)
--if(neon_version)
--    set(CPU_HAS_NEON 1)
-+message(STATUS "Detecting NEON support")
-+execute_process(COMMAND sed -n "/Features.* neon/q 1" /proc/cpuinfo
-+                RESULT_VARIABLE CPU_HAS_NEON)
-+if(CPU_HAS_NEON)
-+    message(STATUS "Detecting NEON support - supported")
-+else()
-+    message(STATUS "Detecting NEON support - not supported" )
- endif()
diff --git a/pkgs/development/libraries/xapian/default.nix b/pkgs/development/libraries/xapian/default.nix
index 7a06951f8422..0862fcfe25f6 100644
--- a/pkgs/development/libraries/xapian/default.nix
+++ b/pkgs/development/libraries/xapian/default.nix
@@ -7,6 +7,9 @@
 
 # tests
 , mu
+, perlPackages
+, python3
+, xapian-omega
 }:
 
 let
@@ -43,7 +46,9 @@ let
     '';
 
     passthru.tests = {
-      inherit mu;
+      inherit mu xapian-omega;
+      inherit (perlPackages) SearchXapian;
+      python-xapian = python3.pkgs.xapian;
     };
 
     meta = with lib; {
@@ -59,5 +64,5 @@ in {
   # Don't forget to change the hashes in xapian-omega and
   # python3Packages.xapian. They inherit the version from this package, and
   # should always be built with the equivalent xapian version.
-  xapian_1_4 = generic "1.4.25" "sha256-DJnf3YF1cctWibxBKn4CFAeTgxPzjqOnD6O/hkEGCO4=";
+  xapian_1_4 = generic "1.4.26" "sha256-nmp5A4BpZtFs4iC0k3fJyPrWZ8jw/8sjo0QpRiaTY6c=";
 }
diff --git a/pkgs/development/libraries/xapian/tools/omega/default.nix b/pkgs/development/libraries/xapian/tools/omega/default.nix
index e8c238a24b11..0bfb9c6326aa 100644
--- a/pkgs/development/libraries/xapian/tools/omega/default.nix
+++ b/pkgs/development/libraries/xapian/tools/omega/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://oligarchy.co.uk/xapian/${version}/xapian-omega-${version}.tar.xz";
-    hash = "sha256-L8C1BeYG1eHc3h8iNitvAjfZ6Ef8m2r1OPmbyavR/Ms=";
+    hash = "sha256-pbI4bhsE34TRFJqenFvPxeRyammmnaZBuGxo15ln2uQ=";
   };
 
   buildInputs = [ xapian perl pcre2 zlib libmagic ];
diff --git a/pkgs/development/libraries/xxHash/default.nix b/pkgs/development/libraries/xxHash/default.nix
index c78fc302afe4..f7461c878c23 100644
--- a/pkgs/development/libraries/xxHash/default.nix
+++ b/pkgs/development/libraries/xxHash/default.nix
@@ -22,10 +22,6 @@ stdenv.mkDerivation rec {
   # Using unofficial CMake build script to install CMake module files.
   cmakeDir = "../cmake_unofficial";
 
-  cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
-  ];
-
   meta = with lib; {
     description = "Extremely fast hash algorithm";
     longDescription = ''
@@ -40,5 +36,8 @@ stdenv.mkDerivation rec {
     mainProgram = "xxhsum";
     maintainers = with maintainers; [ orivej ];
     platforms = platforms.all;
+    pkgConfigModules = [
+      "libxxhash"
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index a440e7e480da..29076051578e 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -3,12 +3,12 @@
   stdenv,
   buildPythonPackage,
   callPackage,
-  cargo,
+  setuptools,
+  bcrypt,
   certifi,
   cffi,
   cryptography-vectors ? (callPackage ./vectors.nix { }),
   fetchPypi,
-  fetchpatch2,
   isPyPy,
   libiconv,
   libxcrypt,
@@ -18,39 +18,29 @@
   pytest-xdist,
   pytestCheckHook,
   pythonOlder,
-  rustc,
   rustPlatform,
   Security,
-  setuptoolsRustBuildHook,
 }:
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "42.0.8"; # Also update the hash in vectors.nix
+  version = "43.0.0"; # Also update the hash in vectors.nix
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jQnQVDnOe6qOnpWwfsW2yIb1SN634Pae8l9ks7zoQvI=";
+    hash = "sha256-uIB1raLVGqnxgoNTLJ9g5yFwBBu6iNfzfknLsQJ1KZ4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-PgxPcFocEhnQyrsNtCN8YHiMptBmk1PUhEDQFdUR1nU=";
+    hash = "sha256-TEQy8PrIaZshiBFTqR/OJp3e/bVM1USjcmpDYcjPJPM=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      # skip overflowing tests on 32 bit; https://github.com/pyca/cryptography/pull/10366
-      url = "https://github.com/pyca/cryptography/commit/d741901dddd731895346636c0d3556c6fa51fbe6.patch";
-      hash = "sha256-eC+MZg5O8Ia5CbjRE4y+JhaFs3Q5c62QtPHr3x9T+zw=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "--benchmark-disable" ""
@@ -58,12 +48,11 @@ buildPythonPackage rec {
 
   cargoRoot = "src/rust";
 
-  nativeBuildInputs = [
+  build-system = [
     rustPlatform.cargoSetupHook
-    setuptoolsRustBuildHook
-    cargo
-    rustc
+    rustPlatform.maturinBuildHook
     pkg-config
+    setuptools
   ] ++ lib.optionals (!isPyPy) [ cffi ];
 
   buildInputs =
@@ -74,7 +63,9 @@ buildPythonPackage rec {
     ]
     ++ lib.optionals (pythonOlder "3.9") [ libxcrypt ];
 
-  propagatedBuildInputs = lib.optionals (!isPyPy) [ cffi ];
+  dependencies = lib.optionals (!isPyPy) [ cffi ];
+
+  optional-dependencies.ssh = [ bcrypt ];
 
   nativeCheckInputs = [
     certifi
@@ -82,7 +73,7 @@ buildPythonPackage rec {
     pretend
     pytestCheckHook
     pytest-xdist
-  ];
+  ] ++ optional-dependencies.ssh;
 
   pytestFlagsArray = [ "--disable-pytest-warnings" ];
 
@@ -91,6 +82,10 @@ buildPythonPackage rec {
     "tests/bench"
   ];
 
+  passthru = {
+    vectors = cryptography-vectors;
+  };
+
   meta = with lib; {
     description = "Package which provides cryptographic recipes and primitives";
     longDescription = ''
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 8d1bb48d623a..d0f635df8b9e 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "cryptography_vectors";
     inherit version;
-    hash = "sha256-31ZXNnvAqQw3QwnLJhAJosU8rpGkWHgTOaD3JPgZpGo=";
+    hash = "sha256-XJ0JpzLVQzzt4VQqluzXCoDhIq8EfudAS83x88y45wI=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/email-validator/default.nix b/pkgs/development/python-modules/email-validator/default.nix
index 735496b67645..78463781f75d 100644
--- a/pkgs/development/python-modules/email-validator/default.nix
+++ b/pkgs/development/python-modules/email-validator/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "email-validator";
-  version = "2.1.2";
+  version = "2.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -18,10 +18,10 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "email_validator";
     inherit version;
-    hash = "sha256-FMDz00PEvto3QAQhs5+kEbvjOnXfIIJd9zrVPgap8Ew=";
+    hash = "sha256-y2kPNExhenFPIuZq53FEWhzrRoIRUt+OFlxfmjZFgrc=";
   };
 
-  propagatedBuildInputs = [
+  dependencies = [
     dnspython
     idna
   ];
diff --git a/pkgs/development/python-modules/motor/default.nix b/pkgs/development/python-modules/motor/default.nix
index fa9fc4da9e63..1a8aa99a3679 100644
--- a/pkgs/development/python-modules/motor/default.nix
+++ b/pkgs/development/python-modules/motor/default.nix
@@ -2,6 +2,8 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  hatchling,
+  hatch-requirements-txt,
   mockupdb,
   pymongo,
   pythonOlder,
@@ -9,19 +11,24 @@
 
 buildPythonPackage rec {
   pname = "motor";
-  version = "3.4.0";
-  format = "setuptools";
+  version = "3.5.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "mongodb";
-    repo = pname;
+    repo = "motor";
     rev = "refs/tags/${version}";
-    hash = "sha256-Rj8eYZxmw/cn/vkhLunmHgxMMHIQe80Zhc2p0q3b/AY=";
+    hash = "sha256-mg31FzMF0xEEhfLKAdF2pzEkULESFFGaXnE0uospXqE=";
   };
 
-  propagatedBuildInputs = [ pymongo ];
+  build-system = [
+    hatchling
+    hatch-requirements-txt
+  ];
+
+  dependencies = [ pymongo ];
 
   nativeCheckInputs = [ mockupdb ];
 
@@ -30,10 +37,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "motor" ];
 
-  meta = with lib; {
+  meta = {
     description = "Non-blocking MongoDB driver for Tornado or asyncio";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
     homepage = "https://github.com/mongodb/motor";
-    maintainers = with maintainers; [ globin ];
+    maintainers = with lib.maintainers; [ globin ];
   };
 }
diff --git a/pkgs/development/python-modules/passlib/default.nix b/pkgs/development/python-modules/passlib/default.nix
index 413e6ecb1c94..29d1b111e921 100644
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@@ -28,6 +28,13 @@ buildPythonPackage rec {
     totp = [ cryptography ];
   };
 
+  # Fix for https://foss.heptapod.net/python-libs/passlib/-/issues/190
+  postPatch = ''
+    substituteInPlace passlib/handlers/bcrypt.py \
+      --replace-fail "version = _bcrypt.__about__.__version__" \
+      "version = getattr(getattr(_bcrypt, '__about__', _bcrypt), '__version__', '<unknown>')"
+  '';
+
   nativeCheckInputs =
     [
       pytestCheckHook
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 14ae97ea9686..fc105cbe0aa7 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "9.0.0";
+  version = "9.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-dTEYI3dGu3Q/80lijp0ooApveSL1VWVHwLw7covnYYc=";
+    hash = "sha256-rcL4kwF8aBHy/sxZiQsQGvN3i1geiPFyrv8nRSXUZSA=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pydantic-core/default.nix b/pkgs/development/python-modules/pydantic-core/default.nix
index b0a84ed3fbdb..48e8f7188bce 100644
--- a/pkgs/development/python-modules/pydantic-core/default.nix
+++ b/pkgs/development/python-modules/pydantic-core/default.nix
@@ -18,14 +18,14 @@
 let
   pydantic-core = buildPythonPackage rec {
     pname = "pydantic-core";
-    version = "2.18.4";
+    version = "2.20.1";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "pydantic";
       repo = "pydantic-core";
       rev = "refs/tags/v${version}";
-      hash = "sha256-wt6HG2jQU09Zxhxhzb49HvNnxahfSk2xvNApVZkqqbw=";
+      hash = "sha256-iFyCFkFzvTL6es3L96pyq/s6SS7h1mn+bS0SPcsxXxA=";
     };
 
     patches = [ ./01-remove-benchmark-flags.patch ];
@@ -33,7 +33,7 @@ let
     cargoDeps = rustPlatform.fetchCargoTarball {
       inherit src;
       name = "${pname}-${version}";
-      hash = "sha256-m0xP4fIFgInkUeAy4HqfTKHEiqmWpYO8CgKzxg+WXiU=";
+      hash = "sha256-4v4g9/8ZsQUqkwA29/S/BXn2Ea4eSOnMhEbhDvsGuQU=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pydantic-extra-types/default.nix b/pkgs/development/python-modules/pydantic-extra-types/default.nix
index 39da53345e86..b9da2b299ecf 100644
--- a/pkgs/development/python-modules/pydantic-extra-types/default.nix
+++ b/pkgs/development/python-modules/pydantic-extra-types/default.nix
@@ -4,41 +4,47 @@
   fetchFromGitHub,
   hatchling,
   pydantic,
+  semver,
   pendulum,
   phonenumbers,
   pycountry,
   python-ulid,
+  pytz,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "pydantic-extra-types";
-  version = "2.8.2";
+  version = "2.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-extra-types";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YNr3eKwlPmLpYp0Z4WAOmWNMjta22ZZMuSlONkONxZU=";
+    hash = "sha256-PgytBSue3disJifnpTl1DGNMZkp93cJEIDm8wgKMHFo=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [ pydantic ];
+  dependencies = [
+    pydantic
+    semver
+  ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     all = [
       pendulum
       phonenumbers
       pycountry
       python-ulid
+      pytz
     ];
   };
 
   pythonImportsCheck = [ "pydantic_extra_types" ];
 
-  nativeCheckInputs = [ pytestCheckHook ] ++ passthru.optional-dependencies.all;
+  nativeCheckInputs = [ pytestCheckHook ] ++ optional-dependencies.all;
 
   meta = with lib; {
     changelog = "https://github.com/pydantic/pydantic-extra-types/blob/${src.rev}/HISTORY.md";
diff --git a/pkgs/development/python-modules/pydantic-settings/default.nix b/pkgs/development/python-modules/pydantic-settings/default.nix
index ed94f3da4780..86dd243ac6ae 100644
--- a/pkgs/development/python-modules/pydantic-settings/default.nix
+++ b/pkgs/development/python-modules/pydantic-settings/default.nix
@@ -14,7 +14,7 @@
 let
   self = buildPythonPackage rec {
     pname = "pydantic-settings";
-    version = "2.3.2";
+    version = "2.3.4";
     pyproject = true;
 
     disabled = pythonOlder "3.8";
@@ -23,12 +23,12 @@ let
       owner = "pydantic";
       repo = "pydantic-settings";
       rev = "refs/tags/v${version}";
-      hash = "sha256-1wnTAoF9xi1xLgSWl0FhtIddWPpHgDJPxJlsctJvFQo=";
+      hash = "sha256-tLF7LvsXryhbThaNl6koM0bGM8EOaA+aH2fGqzR8GKE=";
     };
 
-    nativeBuildInputs = [ hatchling ];
+    build-system = [ hatchling ];
 
-    propagatedBuildInputs = [
+    dependencies = [
       pydantic
       python-dotenv
     ];
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index 4644e7949062..5ee65602794b 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -20,15 +20,15 @@
   cloudpickle,
   email-validator,
   dirty-equals,
-  faker,
   pytestCheckHook,
   pytest-mock,
   eval-type-backport,
+  rich,
 }:
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "2.7.4";
+  version = "2.8.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "pydantic";
     repo = "pydantic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-S4FZUnOsKC8J0xyTeXhMmCACCma+VfCSmrE6sYAnpok=";
+    hash = "sha256-9Tbm5Y1wSPa3lTdI8y95csYHua7nKUIYAfxSn+3J5zI=";
   };
 
   buildInputs = lib.optionals (pythonOlder "3.9") [ libxcrypt ];
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     email = [ email-validator ];
   };
 
@@ -61,11 +61,11 @@ buildPythonPackage rec {
     [
       cloudpickle
       dirty-equals
-      faker
       pytest-mock
       pytestCheckHook
+      rich
     ]
-    ++ lib.flatten (lib.attrValues passthru.optional-dependencies)
+    ++ lib.flatten (lib.attrValues optional-dependencies)
     ++ lib.optionals (pythonOlder "3.10") [ eval-type-backport ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index eeb799f32919..80cd4b04b409 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pygit2";
-  version = "1.14.1";
+  version = "1.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7FlYVxuCpjUXhcpkXlOUwxrkXuxThLL6nE4F3eNZetY=";
+    hash = "sha256-pjVSX/x0EoZp3i9jRgqUydVgljSkh1wKr85RD97sF6w=";
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/pymemcache/default.nix b/pkgs/development/python-modules/pymemcache/default.nix
index 829d3863f304..c80f512e7498 100644
--- a/pkgs/development/python-modules/pymemcache/default.nix
+++ b/pkgs/development/python-modules/pymemcache/default.nix
@@ -4,10 +4,10 @@
   faker,
   fetchFromGitHub,
   mock,
-  six,
   pytestCheckHook,
   python-memcached,
   pythonOlder,
+  setuptools,
   zstd,
   stdenv,
 }:
@@ -15,18 +15,18 @@
 buildPythonPackage rec {
   pname = "pymemcache";
   version = "4.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pinterest";
-    repo = pname;
+    repo = "pymemcache";
     rev = "v${version}";
     hash = "sha256-WgtHhp7lE6StoOBfSy9+v3ODe/+zUC7lGrc2S4M68+M=";
   };
 
-  propagatedBuildInputs = [ six ];
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [
     faker
@@ -50,6 +50,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pymemcache" ];
 
   meta = with lib; {
+    changelog = "https://github.com/pinterest/pymemcache/blob/${src.rev}/ChangeLog.rst";
     description = "Python memcached client";
     homepage = "https://pymemcache.readthedocs.io/";
     license = with licenses; [ asl20 ];
diff --git a/pkgs/development/python-modules/pymongo/default.nix b/pkgs/development/python-modules/pymongo/default.nix
index d7e1b35ed742..c64d22d66cb9 100644
--- a/pkgs/development/python-modules/pymongo/default.nix
+++ b/pkgs/development/python-modules/pymongo/default.nix
@@ -2,6 +2,9 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  hatchling,
+  hatch-requirements-txt,
+  setuptools,
   pythonOlder,
   dnspython,
 
@@ -16,17 +19,24 @@
 
 buildPythonPackage rec {
   pname = "pymongo";
-  version = "4.7.3";
-  format = "setuptools";
+  version = "4.8.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Y1SmayKPLNOZvnQpaF+2jgfxkRCjZ5eC7LT9to2gODE=";
+    inherit version;
+    pname = "pymongo";
+    hash = "sha256-RU8ilYdXRNxw8YgeSy65nNrQCKM1dLyKrxIFMPZsDN4=";
   };
 
-  propagatedBuildInputs = [ dnspython ];
+  build-system = [
+    hatchling
+    hatch-requirements-txt
+    setuptools
+  ];
+
+  dependencies = [ dnspython ];
 
   # Tests call a running mongodb instance
   doCheck = false;
@@ -44,10 +54,10 @@ buildPythonPackage rec {
       ;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Python driver for MongoDB";
     homepage = "https://github.com/mongodb/mongo-python-driver";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/sure/default.nix b/pkgs/development/python-modules/sure/default.nix
index 8a8dd2ed1652..45d3c055634f 100644
--- a/pkgs/development/python-modules/sure/default.nix
+++ b/pkgs/development/python-modules/sure/default.nix
@@ -2,17 +2,17 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  nose,
+  setuptools,
+  pytestCheckHook,
   mock,
   six,
   isPyPy,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "sure";
   version = "2.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = isPyPy;
 
@@ -23,26 +23,30 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "rednose = 1" ""
+      --replace "rednose = 1" "" \
+      --replace-fail "--cov=sure" ""
   '';
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+  dependencies = [ six ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
     mock
-    six
   ];
 
-  doCheck = pythonOlder "3.12"; # nose requires imp module
-
-  nativeCheckInputs = [ nose ];
+  disabledTestPaths = [
+    "tests/test_old_api.py" # require nose
+  ];
 
   pythonImportsCheck = [ "sure" ];
 
-  meta = with lib; {
+  meta = {
     description = "Utility belt for automated testing";
     mainProgram = "sure";
     homepage = "https://sure.readthedocs.io/";
     changelog = "https://github.com/gabrielfalcao/sure/blob/v${version}/CHANGELOG.md";
-    license = licenses.gpl3Plus;
-    maintainers = [ ];
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ sigmanificient ];
   };
 }
diff --git a/pkgs/development/python-modules/validators/default.nix b/pkgs/development/python-modules/validators/default.nix
index 4a5e2f7df1cf..1664916710d5 100644
--- a/pkgs/development/python-modules/validators/default.nix
+++ b/pkgs/development/python-modules/validators/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   buildPythonPackage,
+  eth-hash,
   fetchFromGitHub,
   pytestCheckHook,
   pythonOlder,
@@ -9,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "validators";
-  version = "0.28.0";
+  version = "0.33.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,12 +19,16 @@ buildPythonPackage rec {
     owner = "python-validators";
     repo = "validators";
     rev = "refs/tags/${version}";
-    hash = "sha256-r3SQvt96y8e9odWxz0GjVKH3+Pa0Lqs+tbhryeGaZUU=";
+    hash = "sha256-eLujcm2MD1mPjROrBTg9TfU9wts16Jgb+ouNXFHsFZ0=";
   };
 
   build-system = [ setuptools ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  optional-dependencies = {
+    crypto-eth-addresses = [ eth-hash ] ++ eth-hash.optional-dependencies.pycryptodome;
+  };
+
+  nativeCheckInputs = [ pytestCheckHook ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pythonImportsCheck = [ "validators" ];
 
diff --git a/pkgs/development/python-modules/xapian/default.nix b/pkgs/development/python-modules/xapian/default.nix
index 743e7b068bc5..382b67293272 100644
--- a/pkgs/development/python-modules/xapian/default.nix
+++ b/pkgs/development/python-modules/xapian/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "https://oligarchy.co.uk/xapian/${version}/xapian-bindings-${version}.tar.xz";
-    hash = "sha256-BoMU/KP1RSRwFJLfQy+lTEhf1OOWE8os0nXhNpZOgak=";
+    hash = "sha256-VQhzVz7gQBGZ+DX+9R3ficp7wm97jRvcylnaZD+zyoE=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 21dafb9bbce7..7f97eebce157 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -155,7 +155,7 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Plus;
 
     # GDB upstream does not support ARM darwin
-    platforms = with platforms; linux ++ cygwin ++ ["x86_64-darwin"];
+    platforms = with platforms; linux ++ cygwin ++ freebsd ++ ["x86_64-darwin"];
     maintainers = with maintainers; [ pierron globin lsix ];
   };
 }
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index 9b5959d40e47..a43eab5f00e5 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -101,6 +101,9 @@ stdenv.mkDerivation {
       "--enable-perl-xs=no"
       "TI_AWK=${getBin gawk}/bin/awk"
     ]
+    ++ optionals (crossBuildTools && lib.versionAtLeast version "7.1") [
+      "texinfo_cv_sys_iconv_converts_euc_cn=yes"
+    ]
     ++ optional stdenv.isSunOS "AWK=${gawk}/bin/awk";
 
   installFlags = [ "TEXMF=$(out)/texmf-dist" ];
diff --git a/pkgs/development/tools/rust/cargo-c/default.nix b/pkgs/development/tools/rust/cargo-c/default.nix
index 8dbd282555d6..ca0f8a590ebd 100644
--- a/pkgs/development/tools/rust/cargo-c/default.nix
+++ b/pkgs/development/tools/rust/cargo-c/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-c";
-  version = "0.9.31";
+  version = "0.10.2";
 
   src = fetchCrate {
     inherit pname;
     # this version may need to be updated along with package version
-    version = "${version}+cargo-0.78.0";
-    hash = "sha256-RqwUV3e02GykYH/pWHjoent+gix+CD+t3yAQxqUmo54=";
+    version = "${version}+cargo-0.80.0";
+    hash = "sha256-ltxd4n3oo8ZF/G/zmR4FSVtNOkxwCjDv6PdxkmWxZ+8=";
   };
 
-  cargoHash = "sha256-SfKDlcN+PW1twJu3YbmMsQOtFh6JHncAhdrVg+tweAE=";
+  cargoHash = "sha256-UfhIz87s0CLUDbIpWMPzGQ7qVmh14GuiFoquauSbTOw=";
 
   nativeBuildInputs = [ pkg-config (lib.getDev curl) ];
   buildInputs = [ openssl curl ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/web/nodejs/use-correct-env-in-tests.patch b/pkgs/development/web/nodejs/use-correct-env-in-tests.patch
index d2fda8d2cead..070d0e1ddfc3 100644
--- a/pkgs/development/web/nodejs/use-correct-env-in-tests.patch
+++ b/pkgs/development/web/nodejs/use-correct-env-in-tests.patch
@@ -1,12 +1,5 @@
 `/usr/bin/env` is not available.
 
---- old/test/common/assertSnapshot.js
-+++ new/test/common/assertSnapshot.js
-@@ -81,2 +81,2 @@ async function spawnAndAssert(filename, transform = (x) => x, { tty = false, ...
--  const executable = tty ? 'tools/pseudo-tty.py' : process.execPath;
--  const args = tty ? [process.execPath, ...flags, filename] : [...flags, filename];
-+  const executable = tty ? 'python3' : process.execPath;
-+  const args = tty ? ['tools/pseudo-tty.py', process.execPath, ...flags, filename] : [...flags, filename];
 --- old/test/parallel/test-child-process-default-options.js
 +++ new/test/parallel/test-child-process-default-options.js
 @@ -35 +35 @@ if (isWindows) {
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index 1101fbdf725d..ab2edcf5e8c9 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -37,5 +37,14 @@ buildNodejs {
       url = "https://github.com/nodejs/node/commit/534c122de166cb6464b489f3e6a9a544ceb1c913.patch";
       hash = "sha256-4q4LFsq4yU1xRwNsM1sJoNVphJCnxaVe2IyL6AeHJ/I=";
     })
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/87598d4b63ef2c827a2bebdfa0f1540c35718519.patch";
+      hash = "sha256-JJi8z9aaWnu/y3nZGOSUfeNzNSCYzD9dzoHXaGkeaEA=";
+      includes = ["test/common/assertSnapshot.js"];
+    })
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/d0a6b605fba6cd69a82e6f12ff0363eef8fe1ee9.patch";
+      hash = "sha256-TfYal/PikRZHL6zpAlC3SmkYXCe+/8Gs83dLX/X/P/k=";
+    })
   ] ++ gypPatches;
 }
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index bf0e2f7feffb..1688eca1d2da 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -27,5 +27,13 @@ buildNodejs {
       url = "https://github.com/nodejs/node/commit/14863e80584e579fd48c55f6373878c821c7ff7e.patch";
       hash = "sha256-I7Wjc7DE059a/ZyXAvAqEGvDudPjxQqtkBafckHCFzo=";
     })
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/87598d4b63ef2c827a2bebdfa0f1540c35718519.patch";
+      hash = "sha256-efRJ2nN9QXaT91SQTB+ESkHvXtBq30Cb9BEDEZU9M/8=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/d0a6b605fba6cd69a82e6f12ff0363eef8fe1ee9.patch";
+      hash = "sha256-TfYal/PikRZHL6zpAlC3SmkYXCe+/8Gs83dLX/X/P/k=";
+    })
   ] ++ gypPatches;
 }
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index cb1f5242e265..9b3fa4fa0d8b 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -1,4 +1,4 @@
-{ callPackage, openssl, python3, enableNpm ? true }:
+{ callPackage, fetchpatch2, openssl, python3, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
@@ -12,13 +12,17 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.4.1";
-  sha256 = "sha256-ZfyFf1qoJWqvyQCzRMARXJrq4loCVB/Vzg29Tf0cX7k=";
+  version = "22.5.1";
+  sha256 = "924f381a32cf26b6bedbe95feedde348450f4fd321283d3bf3f7965aa45ce831";
   patches = [
     ./disable-darwin-v8-system-instrumentation-node19.patch
     ./bypass-darwin-xcrun-node16.patch
     ./node-npm-build-npm-package-logic.patch
     ./use-correct-env-in-tests.patch
     ./bin-sh-node-run-v22.patch
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/node/commit/d0a6b605fba6cd69a82e6f12ff0363eef8fe1ee9.patch";
+      hash = "sha256-TfYal/PikRZHL6zpAlC3SmkYXCe+/8Gs83dLX/X/P/k=";
+    })
   ] ++ gypPatches;
 }
diff --git a/pkgs/kde/frameworks/kcodecs/default.nix b/pkgs/kde/frameworks/kcodecs/default.nix
index 409666658ddf..be9126712055 100644
--- a/pkgs/kde/frameworks/kcodecs/default.nix
+++ b/pkgs/kde/frameworks/kcodecs/default.nix
@@ -6,6 +6,5 @@
 mkKdeDerivation {
   pname = "kcodecs";
 
-  extraNativeBuildInputs = [qttools];
-  extraBuildInputs = [gperf];
+  extraNativeBuildInputs = [qttools gperf];
 }
diff --git a/pkgs/kde/frameworks/kdoctools/default.nix b/pkgs/kde/frameworks/kdoctools/default.nix
index 996e75c88538..2de9ed21d9c8 100644
--- a/pkgs/kde/frameworks/kdoctools/default.nix
+++ b/pkgs/kde/frameworks/kdoctools/default.nix
@@ -4,12 +4,13 @@
   docbook-xsl-nons,
   perl,
   perlPackages,
+  libxml2,
 }:
 mkKdeDerivation {
   pname = "kdoctools";
 
   # Perl could be used both at build time and at runtime.
-  extraNativeBuildInputs = [perl perlPackages.URI];
+  extraNativeBuildInputs = [perl perlPackages.URI libxml2];
   extraBuildInputs = [docbook_xml_dtd_45 docbook-xsl-nons];
   extraPropagatedBuildInputs = [perl perlPackages.URI];
 }
diff --git a/pkgs/kde/frameworks/ki18n/default.nix b/pkgs/kde/frameworks/ki18n/default.nix
index 02b03f875ffb..9c3bef785298 100644
--- a/pkgs/kde/frameworks/ki18n/default.nix
+++ b/pkgs/kde/frameworks/ki18n/default.nix
@@ -2,9 +2,12 @@
   mkKdeDerivation,
   qtdeclarative,
   python3,
+  gettext,
 }:
 mkKdeDerivation {
   pname = "ki18n";
 
-  extraBuildInputs = [qtdeclarative python3];
+  extraNativeBuildInputs = [python3];
+  propagatedNativeBuildInputs = [gettext];
+  extraBuildInputs = [qtdeclarative];
 }
diff --git a/pkgs/kde/frameworks/kimageformats/default.nix b/pkgs/kde/frameworks/kimageformats/default.nix
index e15c863003a8..21c84cb56992 100644
--- a/pkgs/kde/frameworks/kimageformats/default.nix
+++ b/pkgs/kde/frameworks/kimageformats/default.nix
@@ -4,9 +4,6 @@
   libheif,
   libjxl,
   libavif,
-  dav1d,
-  libaom,
-  libyuv,
   libraw,
   openexr_3,
 }:
@@ -15,5 +12,5 @@ mkKdeDerivation {
 
   extraCmakeFlags = ["-DKIMAGEFORMATS_HEIF=1"];
   extraNativeBuildInputs = [pkg-config];
-  extraBuildInputs = [libheif libjxl libavif dav1d libaom libyuv libraw openexr_3];
+  extraBuildInputs = [libheif libjxl libavif libraw openexr_3];
 }
diff --git a/pkgs/kde/gear/akonadi-mime/default.nix b/pkgs/kde/gear/akonadi-mime/default.nix
index 8796f7220134..9db5272e6b4b 100644
--- a/pkgs/kde/gear/akonadi-mime/default.nix
+++ b/pkgs/kde/gear/akonadi-mime/default.nix
@@ -1,9 +1,10 @@
 {
   mkKdeDerivation,
   shared-mime-info,
+  libxslt,
 }:
 mkKdeDerivation {
   pname = "akonadi-mime";
 
-  extraNativeBuildInputs = [shared-mime-info];
+  extraNativeBuildInputs = [shared-mime-info libxslt];
 }
diff --git a/pkgs/kde/gear/kdenlive/default.nix b/pkgs/kde/gear/kdenlive/default.nix
index cee597bce71f..8c08272cd946 100644
--- a/pkgs/kde/gear/kdenlive/default.nix
+++ b/pkgs/kde/gear/kdenlive/default.nix
@@ -26,6 +26,8 @@ mkKdeDerivation {
     )
   ];
 
+  extraNativeBuildInputs = [ shared-mime-info ];
+
   extraBuildInputs = [
     qtsvg
     qtmultimedia
@@ -34,7 +36,6 @@ mkKdeDerivation {
     qqc2-desktop-style
 
     mlt
-    shared-mime-info
     libv4l
   ];
 
diff --git a/pkgs/kde/gear/kdepim-runtime/default.nix b/pkgs/kde/gear/kdepim-runtime/default.nix
index 56d705f40a5c..a4c2f81afb82 100644
--- a/pkgs/kde/gear/kdepim-runtime/default.nix
+++ b/pkgs/kde/gear/kdepim-runtime/default.nix
@@ -9,11 +9,12 @@
   lib,
   libetebase,
   libkgapi,
+  libxslt,
 }:
 mkKdeDerivation {
   pname = "kdepim-runtime";
 
-  extraNativeBuildInputs = [pkg-config shared-mime-info];
+  extraNativeBuildInputs = [pkg-config shared-mime-info libxslt];
   # FIXME: libkolabxml
   extraBuildInputs = [qtnetworkauth qtspeech qtwebengine cyrus_sasl libetebase];
 
diff --git a/pkgs/kde/gear/knotes/default.nix b/pkgs/kde/gear/knotes/default.nix
index bca10fcf13da..913e7a8b85b4 100644
--- a/pkgs/kde/gear/knotes/default.nix
+++ b/pkgs/kde/gear/knotes/default.nix
@@ -1,4 +1,9 @@
-{mkKdeDerivation}:
+{
+  mkKdeDerivation,
+  libxslt,
+}:
 mkKdeDerivation {
   pname = "knotes";
+
+  extraNativeBuildInputs = [libxslt];
 }
diff --git a/pkgs/kde/gear/konversation/default.nix b/pkgs/kde/gear/konversation/default.nix
index 952b98fff649..ba58215e3093 100644
--- a/pkgs/kde/gear/konversation/default.nix
+++ b/pkgs/kde/gear/konversation/default.nix
@@ -7,6 +7,8 @@
 mkKdeDerivation {
   pname = "konversation";
 
-  extraBuildInputs = [qtmultimedia qt5compat qttools];
+  extraBuildInputs = [qt5compat];
+  extraNativeBuildInputs = [qtmultimedia qttools];
+
   meta.mainProgram = "konversation";
 }
diff --git a/pkgs/kde/gear/mailcommon/default.nix b/pkgs/kde/gear/mailcommon/default.nix
index 44b2b283896e..a82e6adb266c 100644
--- a/pkgs/kde/gear/mailcommon/default.nix
+++ b/pkgs/kde/gear/mailcommon/default.nix
@@ -2,9 +2,11 @@
   mkKdeDerivation,
   qtwebengine,
   qttools,
+  libxslt,
 }:
 mkKdeDerivation {
   pname = "mailcommon";
 
+  extraNativeBuildInputs = [libxslt];
   extraBuildInputs = [qtwebengine qttools];
 }
diff --git a/pkgs/kde/gear/pimcommon/default.nix b/pkgs/kde/gear/pimcommon/default.nix
index ddb467638c65..9ef947dde6fe 100644
--- a/pkgs/kde/gear/pimcommon/default.nix
+++ b/pkgs/kde/gear/pimcommon/default.nix
@@ -1,9 +1,11 @@
 {
   mkKdeDerivation,
   qttools,
+  libxslt,
 }:
 mkKdeDerivation {
   pname = "pimcommon";
 
   extraBuildInputs = [qttools];
+  extraNativeBuildInputs = [libxslt];
 }
diff --git a/pkgs/kde/plasma/kscreenlocker/default.nix b/pkgs/kde/plasma/kscreenlocker/default.nix
index e7ee0a18b8e5..f7321990f0c3 100644
--- a/pkgs/kde/plasma/kscreenlocker/default.nix
+++ b/pkgs/kde/plasma/kscreenlocker/default.nix
@@ -1,10 +1,12 @@
 {
   mkKdeDerivation,
   pam,
+  wayland,
   qqc2-breeze-style,
 }:
 mkKdeDerivation {
   pname = "kscreenlocker";
 
+  extraNativeBuildInputs = [wayland];
   extraBuildInputs = [pam qqc2-breeze-style];
 }
diff --git a/pkgs/kde/plasma/libkscreen/default.nix b/pkgs/kde/plasma/libkscreen/default.nix
index 7f7e5d488d9f..ccd11318e2be 100644
--- a/pkgs/kde/plasma/libkscreen/default.nix
+++ b/pkgs/kde/plasma/libkscreen/default.nix
@@ -3,11 +3,12 @@
   qtwayland,
   qttools,
   jq,
+  wayland,
 }:
 mkKdeDerivation {
   pname = "libkscreen";
 
-  extraNativeBuildInputs = [qttools qtwayland jq];
+  extraNativeBuildInputs = [qttools qtwayland jq wayland];
   extraBuildInputs = [qtwayland];
   meta.mainProgram = "kscreen-doctor";
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libstdthreads.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libstdthreads.nix
new file mode 100644
index 000000000000..2f5fd7c6afd1
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libstdthreads.nix
@@ -0,0 +1,5 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "lib/libstdthreads";
+  extraPaths = [ "lib/libc/Versions.def" ];
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 30081c824378..1cd5afe19301 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -163,17 +163,6 @@ let
 
     propagatedBuildInputs = builtins.attrValues deps;
 
-    # don't use pure CF for dylibs that depend on frameworks
-    setupHook = ./framework-setup-hook.sh;
-
-    # Not going to be more specific than this for now
-    __propagatedImpureHostDeps = lib.optionals (name != "Kernel") [
-      # The setup-hook ensures that everyone uses the impure CoreFoundation who uses these SDK frameworks, so let's expose it
-      "/System/Library/Frameworks/CoreFoundation.framework"
-      "/System/Library/Frameworks/${name}.framework"
-      "/System/Library/Frameworks/${name}.framework/${name}"
-    ];
-
     meta = with lib; {
       description = "Apple SDK framework ${name}";
       maintainers = with maintainers; [ copumpkin ];
diff --git a/pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh
deleted file mode 100644
index b0d5915fc1fc..000000000000
--- a/pkgs/os-specific/darwin/apple-sdk/framework-setup-hook.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-# On macOS, frameworks are linked to the system CoreFoundation but
-# dynamic libraries built with nix use a pure version of CF this
-# causes segfaults for binaries that depend on it at runtime.  This
-# can be solved in two ways.
-# 1. Rewrite references to the pure CF using this setup hook, this
-# works for the simple case but this can still cause problems if other
-# dependencies (eg. python) use the pure CF.
-# 2. Create a wrapper for the binary that sets DYLD_FRAMEWORK_PATH to
-# /System/Library/Frameworks.  This will make everything load the
-# system's CoreFoundation framework while still keeping the
-# dependencies pure for other packages.
-
-fixupOutputHooks+=('fixDarwinFrameworksIn $prefix')
-
-fixDarwinFrameworks() {
-    local systemPrefix='/System/Library/Frameworks'
-
-    for fn in "$@"; do
-        if [ -L "$fn" ]; then continue; fi
-        echo "$fn: fixing dylib"
-
-        for framework in $(otool -L "$fn" | awk '/CoreFoundation\.framework/ {print $1}'); do
-          install_name_tool -change "$framework" "$systemPrefix/CoreFoundation.framework/Versions/A/CoreFoundation" "$fn" >&2
-        done
-    done
-}
-
-fixDarwinFrameworksIn() {
-    local dir="$1"
-    fixDarwinFrameworks $(find "$dir" -name "*.dylib")
-}
-
-
-# This configures the stdenv to use /System/Library/Frameworks/CoreFoundation.framework
-# instead of the nix version by including the system frameworks path
-# as an rpath entry when creating binaries.
-
-useSystemCoreFoundationFramework () {
-  export NIX_COREFOUNDATION_RPATH=/System/Library/Frameworks
-}
-
-addEnvHooks "$hostOffset" useSystemCoreFoundationFramework
diff --git a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 5c593b1488e2..0b7c85b588f2 100644
--- a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
@@ -86,6 +86,5 @@ stdenv.mkDerivation {
       "$out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
 
     mkdir -p "$out/nix-support"
-    substituteAll ${./pure-corefoundation-hook.sh} "$out/nix-support/setup-hook"
   '';
 }
diff --git a/pkgs/os-specific/darwin/swift-corelibs/pure-corefoundation-hook.sh b/pkgs/os-specific/darwin/swift-corelibs/pure-corefoundation-hook.sh
deleted file mode 100644
index d5539f50861a..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/pure-corefoundation-hook.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-usePureCoreFoundation() {
-# Avoid overriding value set by the impure CF
-    if [ -z "${NIX_COREFOUNDATION_RPATH:-}" ]; then
-        export NIX_COREFOUNDATION_RPATH=@out@/Library/Frameworks
-    fi
-}
-addEnvHooks "$hostOffset" usePureCoreFoundation
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index bbfb317d67ac..6fbc10dcecf2 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -702,6 +702,8 @@ let
       SECURITY_APPARMOR                = yes;
       DEFAULT_SECURITY_APPARMOR        = yes;
 
+      SECURITY_DMESG_RESTRICT          = yes;
+
       RANDOM_TRUST_CPU                 = whenOlder "6.2" yes; # allow RDRAND to seed the RNG
       RANDOM_TRUST_BOOTLOADER          = whenOlder "6.2" (whenAtLeast "5.4" yes); # allow the bootloader to seed the RNG
 
diff --git a/pkgs/os-specific/linux/lksctp-tools/default.nix b/pkgs/os-specific/linux/lksctp-tools/default.nix
index f6a91c663a05..5ddf19c96e86 100644
--- a/pkgs/os-specific/linux/lksctp-tools/default.nix
+++ b/pkgs/os-specific/linux/lksctp-tools/default.nix
@@ -1,17 +1,23 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "lksctp-tools";
-  version = "1.0.17";
+  version = "1.0.19";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/lksctp/lksctp-tools-${version}.tar.gz";
-    sha256 = "05da6c2v3acc18ndvmkrag6x5lf914b7s0xkkr6wkvrbvd621sqs";
+  src = fetchFromGitHub {
+    owner = "sctp";
+    repo = "lksctp-tools";
+    rev = "v${version}";
+    hash = "sha256-QEgk9OPFCI5WknUDkqfswApCFeOF+620frQWMyQq2Mk=";
   };
 
+  nativeBuildInputs = [ autoreconfHook ];
+
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Linux Kernel Stream Control Transmission Protocol Tools";
-    homepage = "https://lksctp.sourceforge.net/";
+    homepage = "https://github.com/sctp/lksctp-tools/wiki";
     license = with licenses; [ gpl2Plus lgpl21 ]; # library is lgpl21
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index e5f8fec5acb1..b460348a105d 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -18,10 +18,10 @@ stdenv.mkDerivation rec {
   ];
 
   # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
-  postPatch = if stdenv.buildPlatform.isDarwin && stdenv.buildPlatform != stdenv.hostPlatform then ''
+  postPatch = lib.optionalString (stdenv.buildPlatform.isDarwin && stdenv.buildPlatform != stdenv.hostPlatform) ''
     rm CHANGELOG
     touch ChangeLog
-  '' else null;
+  '';
 
   outputs = [ "out" "doc" "man" /* "modules" */ ];
 
@@ -36,14 +36,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  preConfigure = lib.optionalString (stdenv.hostPlatform.libc == "musl") ''
-      # export ac_cv_search_crypt=no
-      # (taken from Alpine linux, apparently insecure but also doesn't build O:))
-      # disable insecure modules
-      # sed -e 's/pam_rhosts//g' -i modules/Makefile.am
-      sed -e 's/pam_rhosts//g' -i modules/Makefile.in
-  '';
-
   configureFlags = [
     "--includedir=${placeholder "out"}/include/security"
     "--enable-sconfigdir=/etc/security"
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 51d6b091f98f..8ea24064aa09 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -6,7 +6,7 @@
 , pkgsCross
 , fetchFromGitHub
 , fetchzip
-, fetchpatch
+, fetchpatch2
 , buildPackages
 , makeBinaryWrapper
 , ninja
@@ -184,7 +184,7 @@ assert withBootloader -> withEfi;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "256.2";
+  version = "256.4";
 
   # Use the command below to update `releaseTimestamp` on every (major) version
   # change. More details in the commentary at mesonFlags.
@@ -202,7 +202,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd";
     rev = "v${version}";
-    hash = "sha256-fyHzL+oe192YYuwyoTrov10IlrB0NSfY/XKVWzJrQEI=";
+    hash = "sha256-dugBiRgDFpB0eKhhIT3LkA8FhClM0lvvwCMJ+dKtjPM=";
   };
 
   # On major changes, or when otherwise required, you *must* :
@@ -232,17 +232,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
     ./0017-meson.build-do-not-create-systemdstatedir.patch
 
-    # https://github.com/systemd/systemd/pull/33258
-    # Remove after 256.3
-    (fetchpatch {
-      url = "https://github.com/systemd/systemd/compare/b268a71069786a45460807967e669d505ba3c5a2..f26b2ec46118a4493608618da2253bb9dfc6b517.patch";
-      hash = "sha256-OmuPDm3NykrDeNTA3NcYt9iTXEUFwKJ5apPP4KqtABg=";
-    })
-
-    # https://github.com/systemd/systemd/pull/33400
-    (fetchpatch {
-      url = "https://github.com/systemd/systemd/compare/051d462b42fe6c27824046c15cd3c84fa5afe05b..5e2d802c018f0b6d5dd58745f64d6958fa261096.patch";
-      hash = "sha256-drGAnx+ECixOjIP0DUSbCG/emUgoVips9WQL5ny3NKQ=";
+    # https://github.com/systemd/systemd/issues/33392
+    (fetchpatch2 {
+      url = "https://github.com/systemd/systemd/commit/f8b02a56febf14adf2474875a1b6625f1f346a6f.patch?full_index=1";
+      hash = "sha256-qRW92gPtACjk+ifptkw5mujhHlkCF56M3azGIjLiMKE=";
+      revert = true;
     })
   ] ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 907646dc722b..1a252f5888e9 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -62,7 +62,7 @@ let
       zlib
       readline
       openssl
-      libxml2
+      (libxml2.override {enableHttp = true;})
       icu
     ]
       ++ lib.optionals (olderThan "13") [ libxcrypt ]
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 8566c8c61749..2338e6ce184b 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1118,11 +1118,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpthreadstubs, libxcb, xtrans, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libX11";
-    version = "1.8.9";
+    version = "1.8.10";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libX11-1.8.9.tar.xz";
-      sha256 = "0qijpp9l6hhwwx22hncrzjpmb5ffcakj6pxa5lzgjkhl3l8qz7bp";
+      url = "mirror://xorg/individual/lib/libX11-1.8.10.tar.xz";
+      sha256 = "0lywvwsz92j7isglvw2227g3na4ghyspvsvblpf43ns7jfnksfrb";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 31ee5d6f1cea..77b7a42eeb0d 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -147,7 +147,8 @@ self: super:
   libX11 = super.libX11.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "man" ];
     configureFlags = attrs.configureFlags or []
-      ++ malloc0ReturnsNullCrossFlag;
+      ++ malloc0ReturnsNullCrossFlag
+      ++ lib.optional (stdenv.targetPlatform.useLLVM or false) "ac_cv_path_RAWCPP=cpp";
     depsBuildBuild = [
       buildPackages.stdenv.cc
     ] ++ lib.optionals stdenv.hostPlatform.isStatic [
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 8305e1574040..fa9f0d33753a 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -173,7 +173,7 @@ mirror://xorg/individual/lib/libICE-1.1.1.tar.xz
 mirror://xorg/individual/lib/libpciaccess-0.18.1.tar.xz
 mirror://xorg/individual/lib/libSM-1.2.4.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.8.9.tar.xz
+mirror://xorg/individual/lib/libX11-1.8.10.tar.xz
 mirror://xorg/individual/lib/libXau-1.0.11.tar.xz
 mirror://xorg/individual/lib/libXaw-1.0.16.tar.xz
 mirror://xorg/individual/lib/libxcb-1.17.0.tar.xz
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 395fffe293fc..b2167b9ef7fa 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -57,15 +57,12 @@ stdenv.mkDerivation rec {
 
   patches = upstreamPatches ++ [
     ./pgrp-pipe-5.patch
-    (fetchurl {
-      name = "fix-static.patch";
-      url = "https://cgit.freebsd.org/ports/plain/shells/bash/files/patch-configure?id=3e147a1f594751a68fea00a28090d0792bee0b51";
-      sha256 = "XHFMQ6eXTReNoywdETyrfQEv1rKF8+XFbQZP4YoVKFk=";
-    })
     # Apply parallel build fix pending upstream inclusion:
     #   https://savannah.gnu.org/patch/index.php?10373
     # Had to fetch manually to workaround -p0 default.
     ./parallel.patch
+    # Fix `pop_var_context: head of shell_variables not a function context`.
+    ./fix-pop-var-context-error.patch
   ];
 
   configureFlags = [
diff --git a/pkgs/shells/bash/bash-5.2-patches.nix b/pkgs/shells/bash/bash-5.2-patches.nix
index 5d5ef94676de..fb4c9c4e3678 100644
--- a/pkgs/shells/bash/bash-5.2-patches.nix
+++ b/pkgs/shells/bash/bash-5.2-patches.nix
@@ -27,4 +27,10 @@ patch: [
 (patch "024" "1hq23djqbr7s9y2324jq9mxr5bwdkmgizn3zgpchbsqp054k85cp")
 (patch "025" "0x9hc4silzl4d3zw4p43i5dm7w86k50j47f87lracwfgwy3z8f2i")
 (patch "026" "1b1fhm1dsi67r8ip17s0xvx2qq31fsxc1g9n3r931dd0k9a1zvln")
+(patch "027" "0fdbhvs9dkf4knncifh98a76q4gylhyvfrffq5p9q3ag5q58jap1")
+(patch "028" "1hdacd6sssjshmry1sscdnxxfb2r51bvdyghlfjaqgc9l85phhk0")
+(patch "029" "11wrlb20w6v89b96krg0gwxipwhvrda6rq1y9f972m32gsrsqp0j")
+(patch "030" "13v9fqgim082dmvkslsr0hs793yzhsij2s91mjswsfhj1qip7zy3")
+(patch "031" "15d7rddj6spwc1fy997lxx6zvzq0zbxgf2h20mhi4wgp5nzbglf2")
+(patch "032" "05ia6yf32hjprmyyxqawhgckxs3684ikfx8xg08zfgx9xkd7g73v")
 ]
diff --git a/pkgs/shells/bash/fix-pop-var-context-error.patch b/pkgs/shells/bash/fix-pop-var-context-error.patch
new file mode 100644
index 000000000000..1b8d5ae20b31
--- /dev/null
+++ b/pkgs/shells/bash/fix-pop-var-context-error.patch
@@ -0,0 +1,17 @@
+Excerpted from <https://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=055a4552c901e43e6a6007f5bc664a33698dbf85>.
+
+Original author: Chet Ramey <chet.ramey@case.edu>
+
+--- variables.c
++++ variables.c
+@@ -5413,7 +5413,9 @@ pop_var_context ()
+   vcxt = shell_variables;
+   if (vc_isfuncenv (vcxt) == 0)
+     {
+-      internal_error (_("pop_var_context: head of shell_variables not a function context"));
++      /* If we haven't flushed all of the local contexts already, flag an error */
++      if (shell_variables != global_variables || variable_context > 0)
++	internal_error (_("pop_var_context: head of shell_variables not a function context"));
+       return;
+     }
+ 
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index 1cbbfeb6d202..62ecc0261ca0 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -75,6 +75,10 @@ in lib.init bootStages ++ [
                then buildPackages.llvmPackages.libcxxClang
              else if crossSystem.useLLVM or false
                then buildPackages.llvmPackages.clang
+             else if crossSystem.useZig or false
+               then buildPackages.zig.cc
+             else if crossSystem.useArocc or false
+               then buildPackages.arocc
              else buildPackages.gcc;
 
         extraNativeBuildInputs = old.extraNativeBuildInputs
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 5cc0b88bc709..57e4a9c4987f 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -433,6 +433,7 @@ in
                 isFromBootstrapFiles = true;
                 hardeningUnsupportedFlags = [
                   "fortify3"
+                  "shadowstack"
                   "stackclashprotection"
                   "zerocallusedregs"
                 ];
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 952b8b66c10c..7da4f4ac8740 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -115,6 +115,8 @@ let
     "format"
     "fortify"
     "fortify3"
+    "shadowstack"
+    "pacret"
     "pic"
     "pie"
     "relro"
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 40bf6554183c..fc748aa12a66 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -12,7 +12,15 @@ fi
 
 shopt -s inherit_errexit
 
-if (( "${NIX_DEBUG:-0}" >= 6 )); then
+# $NIX_DEBUG must be a documented integer level, if set, so we can use it safely as an integer.
+# See the `Verbosity` enum in the Nix source for these levels.
+if ! [[ -z ${NIX_DEBUG-} || $NIX_DEBUG == [0-7] ]]; then
+    printf 'The `NIX_DEBUG` environment variable has an unexpected value: %s\n' "${NIX_DEBUG}"
+    echo "It can only be unset or an integer between 0 and 7."
+    exit 1
+fi
+
+if [[ ${NIX_DEBUG:-0} -ge 6 ]]; then
     set -x
 fi
 
@@ -47,63 +55,105 @@ getAllOutputNames() {
     fi
 }
 
-if [[ -n "${NIX_LOG_FD:-}" ]]; then
-    # Logs arguments to $NIX_LOG_FD, if it exists, no-op if it does not.
-    nixLog() {
-        echo "$@" >&"$NIX_LOG_FD"
-    }
+# All provided arguments are joined with a space then directed to $NIX_LOG_FD, if it's set.
+# Corresponds to `Verbosity::lvlError` in the Nix source.
+nixErrorLog() {
+    if [[ -z ${NIX_LOG_FD-} ]] || [[ ${NIX_DEBUG:-0} -lt 0 ]]; then return; fi
+    printf "%s\n" "$*" >&"$NIX_LOG_FD"
+}
 
-    # Log a hook, to be run before the hook is actually called.
-    # logging for "implicit" hooks -- the ones specified directly
-    # in derivation's arguments -- is done in _callImplicitHook instead.
-    _logHook() {
-        local hookKind="$1"
-        local hookExpr="$2"
-        shift 2
+# All provided arguments are joined with a space then directed to $NIX_LOG_FD, if it's set.
+# Corresponds to `Verbosity::lvlWarn` in the Nix source.
+nixWarnLog() {
+    if [[ -z ${NIX_LOG_FD-} ]] || [[ ${NIX_DEBUG:-0} -lt 1 ]]; then return; fi
+    printf "%s\n" "$*" >&"$NIX_LOG_FD"
+}
 
-        if declare -F "$hookExpr" > /dev/null 2>&1; then
-            nixLog "calling '$hookKind' function hook '$hookExpr'" "$@"
-        elif type -p "$hookExpr" > /dev/null; then
-            nixLog "sourcing '$hookKind' script hook '$hookExpr'"
-        elif [[ "$hookExpr" != "_callImplicitHook"* ]]; then
-            # Here we have a string hook to eval.
-            # Join lines onto one with literal \n characters unless NIX_DEBUG >= 2.
-            local exprToOutput
-            if (( "${NIX_DEBUG:-0}" >= 2 )); then
-                exprToOutput="$hookExpr"
-            else
-                # We have `r'\n'.join([line.lstrip() for lines in text.split('\n')])` at home.
-                local hookExprLine
-                while IFS= read -r hookExprLine; do
-                    # These lines often have indentation,
-                    # so let's remove leading whitespace.
-                    hookExprLine="${hookExprLine#"${hookExprLine%%[![:space:]]*}"}"
-                    # If this line wasn't entirely whitespace,
-                    # then add it to our output
-                    if [[ -n "$hookExprLine" ]]; then
-                        exprToOutput+="$hookExprLine\\n "
-                    fi
-                done <<< "$hookExpr"
+# All provided arguments are joined with a space then directed to $NIX_LOG_FD, if it's set.
+# Corresponds to `Verbosity::lvlNotice` in the Nix source.
+nixNoticeLog() {
+    if [[ -z ${NIX_LOG_FD-} ]] || [[ ${NIX_DEBUG:-0} -lt 2 ]]; then return; fi
+    printf "%s\n" "$*" >&"$NIX_LOG_FD"
+}
 
-                # And then remove the final, unnecessary, \n
-                exprToOutput="${exprToOutput%%\\n }"
-            fi
-            nixLog "evaling '$hookKind' string hook '$exprToOutput'"
+# All provided arguments are joined with a space then directed to $NIX_LOG_FD, if it's set.
+# Corresponds to `Verbosity::lvlInfo` in the Nix source.
+nixInfoLog() {
+    if [[ -z ${NIX_LOG_FD-} ]] || [[ ${NIX_DEBUG:-0} -lt 3 ]]; then return; fi
+    printf "%s\n" "$*" >&"$NIX_LOG_FD"
+}
+
+# All provided arguments are joined with a space then directed to $NIX_LOG_FD, if it's set.
+# Corresponds to `Verbosity::lvlTalkative` in the Nix source.
+nixTalkativeLog() {
+    if [[ -z ${NIX_LOG_FD-} ]] || [[ ${NIX_DEBUG:-0} -lt 4 ]]; then return; fi
+    printf "%s\n" "$*" >&"$NIX_LOG_FD"
+}
+
+# All provided arguments are joined with a space then directed to $NIX_LOG_FD, if it's set.
+# Corresponds to `Verbosity::lvlChatty` in the Nix source.
+nixChattyLog() {
+    if [[ -z ${NIX_LOG_FD-} ]] || [[ ${NIX_DEBUG:-0} -lt 5 ]]; then return; fi
+    printf "%s\n" "$*" >&"$NIX_LOG_FD"
+}
+
+# All provided arguments are joined with a space then directed to $NIX_LOG_FD, if it's set.
+# Corresponds to `Verbosity::lvlDebug` in the Nix source.
+nixDebugLog() {
+    if [[ -z ${NIX_LOG_FD-} ]] || [[ ${NIX_DEBUG:-0} -lt 6 ]]; then return; fi
+    printf "%s\n" "$*" >&"$NIX_LOG_FD"
+}
+
+# All provided arguments are joined with a space then directed to $NIX_LOG_FD, if it's set.
+# Corresponds to `Verbosity::lvlVomit` in the Nix source.
+nixVomitLog() {
+    if [[ -z ${NIX_LOG_FD-} ]] || [[ ${NIX_DEBUG:-0} -lt 7 ]]; then return; fi
+    printf "%s\n" "$*" >&"$NIX_LOG_FD"
+}
+
+# Log a hook, to be run before the hook is actually called.
+# logging for "implicit" hooks -- the ones specified directly
+# in derivation's arguments -- is done in _callImplicitHook instead.
+_logHook() {
+    # Fast path in case nixTalkativeLog is no-op.
+    if [[ -z ${NIX_LOG_FD-} ]]; then
+        return
+    fi
+
+    local hookKind="$1"
+    local hookExpr="$2"
+    shift 2
+
+    if declare -F "$hookExpr" > /dev/null 2>&1; then
+        nixTalkativeLog "calling '$hookKind' function hook '$hookExpr'" "$@"
+    elif type -p "$hookExpr" > /dev/null; then
+        nixTalkativeLog "sourcing '$hookKind' script hook '$hookExpr'"
+    elif [[ "$hookExpr" != "_callImplicitHook"* ]]; then
+        # Here we have a string hook to eval.
+        # Join lines onto one with literal \n characters unless NIX_DEBUG >= 5.
+        local exprToOutput
+        if [[ ${NIX_DEBUG:-0} -ge 5 ]]; then
+            exprToOutput="$hookExpr"
+        else
+            # We have `r'\n'.join([line.lstrip() for lines in text.split('\n')])` at home.
+            local hookExprLine
+            while IFS= read -r hookExprLine; do
+                # These lines often have indentation,
+                # so let's remove leading whitespace.
+                hookExprLine="${hookExprLine#"${hookExprLine%%[![:space:]]*}"}"
+                # If this line wasn't entirely whitespace,
+                # then add it to our output
+                if [[ -n "$hookExprLine" ]]; then
+                    exprToOutput+="$hookExprLine\\n "
+                fi
+            done <<< "$hookExpr"
+
+            # And then remove the final, unnecessary, \n
+            exprToOutput="${exprToOutput%%\\n }"
         fi
-    }
-else
-    nixLog() {
-        # Stub.
-        # Note: because bash syntax, this colon is load bearing. Removing it
-        # will turn this function into a syntax error.
-        :
-    }
-
-    _logHook() {
-        # Load-bearing colon; same as above.
-        :
-    }
-fi
+        nixTalkativeLog "evaling '$hookKind' string hook '$exprToOutput'"
+    fi
+}
 
 ######################################################################
 # Hook handling.
@@ -159,13 +209,13 @@ _callImplicitHook() {
     local def="$1"
     local hookName="$2"
     if declare -F "$hookName" > /dev/null; then
-        nixLog "calling implicit '$hookName' function hook"
+        nixTalkativeLog "calling implicit '$hookName' function hook"
         "$hookName"
     elif type -p "$hookName" > /dev/null; then
-        nixLog "sourcing implicit '$hookName' script hook"
+        nixTalkativeLog "sourcing implicit '$hookName' script hook"
         source "$hookName"
     elif [ -n "${!hookName:-}" ]; then
-        nixLog "evaling implicit '$hookName' string hook"
+        nixTalkativeLog "evaling implicit '$hookName' string hook"
         eval "${!hookName}"
     else
         return "$def"
@@ -481,10 +531,7 @@ done
 
 unset i
 
-if (( "${NIX_DEBUG:-0}" >= 1 )); then
-    echo "initial path: $PATH"
-fi
-
+nixWarnLog "initial path: $PATH"
 
 # Check that the pre-hook initialised SHELL.
 if [ -z "${SHELL:-}" ]; then echo "SHELL not set"; exit 1; fi
@@ -711,7 +758,7 @@ activatePackage() {
     (( hostOffset <= targetOffset )) || exit 1
 
     if [ -f "$pkg" ]; then
-        nixLog "sourcing setup hook '$pkg'"
+        nixTalkativeLog "sourcing setup hook '$pkg'"
         source "$pkg"
     fi
 
@@ -735,7 +782,7 @@ activatePackage() {
     fi
 
     if [[ -f "$pkg/nix-support/setup-hook" ]]; then
-        nixLog "sourcing setup hook '$pkg/nix-support/setup-hook'"
+        nixTalkativeLog "sourcing setup hook '$pkg/nix-support/setup-hook'"
         source "$pkg/nix-support/setup-hook"
     fi
 }
@@ -847,11 +894,10 @@ fi
 PATH="${_PATH-}${_PATH:+${PATH:+:}}$PATH"
 HOST_PATH="${_HOST_PATH-}${_HOST_PATH:+${HOST_PATH:+:}}$HOST_PATH"
 export XDG_DATA_DIRS="${_XDG_DATA_DIRS-}${_XDG_DATA_DIRS:+${XDG_DATA_DIRS:+:}}${XDG_DATA_DIRS-}"
-if (( "${NIX_DEBUG:-0}" >= 1 )); then
-    echo "final path: $PATH"
-    echo "final host path: $HOST_PATH"
-    echo "final data dirs: $XDG_DATA_DIRS"
-fi
+
+nixWarnLog "final path: $PATH"
+nixWarnLog "final host path: $HOST_PATH"
+nixWarnLog "final data dirs: $XDG_DATA_DIRS"
 
 unset _PATH
 unset _HOST_PATH
@@ -1000,14 +1046,11 @@ substituteInPlace() {
 }
 
 _allFlags() {
-    # export some local variables for the awk below
-    # so some substitutions such as name don't have to be in the env attrset
-    # when __structuredAttrs is enabled
+    # Export some local variables for the `awk` below so some substitutions (such as name)
+    # don't have to be in the env attrset when `__structuredAttrs` is enabled.
     export system pname name version
     while IFS='' read -r varName; do
-        if (( "${NIX_DEBUG:-0}" >= 1 )); then
-            printf "@%s@ -> %q\n" "${varName}" "${!varName}" >&2
-        fi
+        nixTalkativeLog "@${varName}@ -> ${!varName}"
         args+=("--subst-var" "$varName")
     done < <(awk 'BEGIN { for (v in ENVIRON) if (v ~ /^[a-z][a-zA-Z0-9_]*$/) print v }')
 }
@@ -1050,7 +1093,7 @@ substituteAllInPlace() {
 # the environment used for building.
 dumpVars() {
     if [ "${noDumpEnvVars:-0}" != 1 ]; then
-        export 2>/dev/null >| "$NIX_BUILD_TOP/env-vars" || true
+        install -m 0600 <(export 2>/dev/null) "$NIX_BUILD_TOP/env-vars" || true
     fi
 }
 
@@ -1603,6 +1646,13 @@ distPhase() {
 showPhaseHeader() {
     local phase="$1"
     echo "Running phase: $phase"
+
+    # The Nix structured logger allows derivations to update the phase as they're building,
+    # which shows up in the terminal UI. See `handleJSONLogMessage` in the Nix source.
+    if [[ -z ${NIX_LOG_FD-} ]]; then
+        return
+    fi
+    printf "@nix { \"action\": \"setPhase\", \"phase\": \"%s\" }\n" "$phase" >&"$NIX_LOG_FD"
 }
 
 
@@ -1635,8 +1685,6 @@ runPhase() {
     if [[ "$curPhase" = installCheckPhase && -z "${doInstallCheck:-}" ]]; then return; fi
     if [[ "$curPhase" = distPhase && -z "${doDist:-}" ]]; then return; fi
 
-    nixLog "@nix { \"action\": \"setPhase\", \"phase\": \"$curPhase\" }"
-
     showPhaseHeader "$curPhase"
     dumpVars
 
diff --git a/pkgs/stdenv/linux/bootstrap-tools/glibc.nix b/pkgs/stdenv/linux/bootstrap-tools/glibc.nix
index 68a1438e3804..a4cc15fb4e0d 100644
--- a/pkgs/stdenv/linux/bootstrap-tools/glibc.nix
+++ b/pkgs/stdenv/linux/bootstrap-tools/glibc.nix
@@ -26,6 +26,8 @@ derivation (
     isGNU = true;
     hardeningUnsupportedFlags = [
       "fortify3"
+      "shadowstack"
+      "pacret"
       "stackclashprotection"
       "trivialautovarinit"
       "zerocallusedregs"
diff --git a/pkgs/stdenv/linux/bootstrap-tools/musl.nix b/pkgs/stdenv/linux/bootstrap-tools/musl.nix
index a3fdcc320718..cc892451b62e 100644
--- a/pkgs/stdenv/linux/bootstrap-tools/musl.nix
+++ b/pkgs/stdenv/linux/bootstrap-tools/musl.nix
@@ -26,6 +26,8 @@ derivation (
     isGNU = true;
     hardeningUnsupportedFlags = [
       "fortify3"
+      "shadowstack"
+      "pacret"
       "zerocallusedregs"
       "trivialautovarinit"
     ];
diff --git a/pkgs/tools/misc/jdupes/default.nix b/pkgs/tools/misc/jdupes/default.nix
index 049b69fa7661..9c6988846990 100644
--- a/pkgs/tools/misc/jdupes/default.nix
+++ b/pkgs/tools/misc/jdupes/default.nix
@@ -1,15 +1,20 @@
-{ lib, stdenv, fetchFromGitea, libjodycode }:
+{
+  lib,
+  stdenv,
+  fetchFromGitea,
+  libjodycode,
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jdupes";
-  version = "1.27.3";
+  version = "1.28.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "jbruchon";
-    repo  = "jdupes";
-    rev   = "v${version}";
-    hash = "sha256-hR5nl8G7TYVm4ol/jgo7iOb4dLr2MovgjKSXCD2UwMg=";
+    repo = "jdupes";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-jRjVuN/FNDpKB+Ibi+Mkm+WhB16cz9c33dOOeiPdgr8=";
     # Unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation. The testdir
     # directories have such files and will be removed.
@@ -20,14 +25,13 @@ stdenv.mkDerivation rec {
 
   dontConfigure = true;
 
-  makeFlags = [
-    "PREFIX=${placeholder "out"}"
-  ] ++ lib.optionals stdenv.isLinux [
-    "ENABLE_DEDUPE=1"
-    "STATIC_DEDUPE_H=1"
-  ] ++ lib.optionals stdenv.cc.isGNU [
-    "HARDEN=1"
-  ];
+  makeFlags =
+    [ "PREFIX=${placeholder "out"}" ]
+    ++ lib.optionals stdenv.isLinux [
+      "ENABLE_DEDUPE=1"
+      "STATIC_DEDUPE_H=1"
+    ]
+    ++ lib.optionals stdenv.cc.isGNU [ "HARDEN=1" ];
 
   enableParallelBuilding = true;
 
@@ -37,16 +41,16 @@ stdenv.mkDerivation rec {
     install -Dm444 -t $out/share/doc/jdupes CHANGES.txt LICENSE.txt README.md
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Powerful duplicate file finder and an enhanced fork of 'fdupes'";
     longDescription = ''
       jdupes is a program for identifying and taking actions upon
       duplicate files. This fork known as 'jdupes' is heavily modified
       from and improved over the original.
     '';
-    homepage = "https://github.com/jbruchon/jdupes";
-    license = licenses.mit;
+    homepage = "https://codeberg.org/jbruchon/jdupes";
+    license = lib.licenses.mit;
     maintainers = [ ];
     mainProgram = "jdupes";
   };
-}
+})
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index b06c9b9ecd38..06130e8add34 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -49,22 +49,16 @@ assert !((lib.count (x: x) [ gnutlsSupport opensslSupport wolfsslSupport rustlsS
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.8.0";
+  version = "8.9.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
       "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-D1i7lfwzDIpG7rPfVwGw2Qydm/zEK9HNCHkdElUdRAA=";
+    hash = "sha256-/wmyeRylbSX9XD86SSfc58ip3EGCIAxIfKiJ+6H91BI=";
   };
 
-  patches = lib.optionals (lib.versionOlder finalAttrs.version "8.7.2") [
-    # https://github.com/curl/curl/pull/13219
-    # https://github.com/newsboat/newsboat/issues/2728
-    ./8.7.1-compression-fix.patch
-  ];
-
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''
@@ -215,7 +209,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = with lib; {
-    changelog = "https://curl.se/changes.html#${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
+    changelog = "https://curl.se/ch/${finalAttrs.version}.html";
     description = "Command line tool for transferring files with URL syntax";
     homepage    = "https://curl.se/";
     license = licenses.curl;
diff --git a/pkgs/tools/package-management/lix/common.nix b/pkgs/tools/package-management/lix/common.nix
index f349e06f54fe..fe9e1d2d2def 100644
--- a/pkgs/tools/package-management/lix/common.nix
+++ b/pkgs/tools/package-management/lix/common.nix
@@ -244,8 +244,11 @@ stdenv.mkDerivation {
     meson test --no-rebuild "''${flagsArray[@]}"
     runHook postInstallCheck
   '';
-  # strictoverflow is disabled because we trap on signed overflow instead
-  hardeningDisable = [ "strictoverflow" ] ++ lib.optional stdenv.hostPlatform.isStatic "pie";
+  hardeningDisable = [
+    "shadowstack"
+    # strictoverflow is disabled because we trap on signed overflow instead
+    "strictoverflow"
+  ] ++ lib.optional stdenv.hostPlatform.isStatic "pie";
   # hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
   # hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
   separateDebugInfo = stdenv.isLinux && !enableStatic;
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index e98371a1e757..50874fef5c6c 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -101,7 +101,9 @@ self = stdenv.mkDerivation {
 
   hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
 
-  hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
+  hardeningDisable = [
+    "shadowstack"
+  ] ++ lib.optional stdenv.hostPlatform.isMusl "fortify";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/text/source-highlight/default.nix b/pkgs/tools/text/source-highlight/default.nix
index d20b3692f31c..07ed74f91c73 100644
--- a/pkgs/tools/text/source-highlight/default.nix
+++ b/pkgs/tools/text/source-highlight/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchpatch, fetchurl, boost }:
+{ lib, stdenv, fetchpatch, fetchurl, boost, updateAutotoolsGnuConfigScriptsHook }:
 
 stdenv.mkDerivation rec {
   pname = "source-highlight";
@@ -43,6 +43,9 @@ stdenv.mkDerivation rec {
   '';
 
   strictDeps = true;
+  # necessary to build on FreeBSD native pending inclusion of
+  # https://git.savannah.gnu.org/cgit/config.git/commit/?id=e4786449e1c26716e3f9ea182caf472e4dbc96e0
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
   buildInputs = [ boost ];
 
   configureFlags = [
diff --git a/pkgs/tools/typesetting/docbook2x/default.nix b/pkgs/tools/typesetting/docbook2x/default.nix
index 3fa76f56d0f0..f964f7633d9e 100644
--- a/pkgs/tools/typesetting/docbook2x/default.nix
+++ b/pkgs/tools/typesetting/docbook2x/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, lib, stdenv, texinfo, perlPackages
-, groff, libxml2, libxslt, gnused, libiconv, opensp
+, groff, libxml2, libxslt, gnused, libiconv, iconv, opensp
 , docbook_xml_dtd_43, bash
 , makeWrapper }:
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   patches = [ ./db2x_texixml-to-stdout.patch ];
 
   nativeBuildInputs = [ makeWrapper perlPackages.perl texinfo libxslt ];
-  buildInputs = [ groff libxml2 opensp libiconv bash ]
+  buildInputs = [ groff libxml2 opensp libiconv iconv bash ]
     ++ (with perlPackages; [ perl XMLSAX XMLParser XMLNamespaceSupport ]);
 
   postConfigure = ''
diff --git a/pkgs/tools/typesetting/xmlto/default.nix b/pkgs/tools/typesetting/xmlto/default.nix
index 848b72eee087..a29ef2aaed69 100644
--- a/pkgs/tools/typesetting/xmlto/default.nix
+++ b/pkgs/tools/typesetting/xmlto/default.nix
@@ -1,11 +1,11 @@
 {
+  autoreconfHook,
   bash,
   coreutils,
   docbook_xml_dtd_45,
   docbook_xsl,
   docbook-xsl-ns,
-  fetchpatch,
-  fetchurl,
+  fetchgit,
   findutils,
   flex,
   getopt,
@@ -22,32 +22,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xmlto";
-  version = "0.0.28";
+  version = "0.0.29";
 
-  src = fetchurl {
-    url = "https://releases.pagure.org/xmlto/xmlto-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-ETDfOnlX659vDSnkqhx1cyp9+21jm+AThZtcfsVCEnY=";
+  src = fetchgit {
+    url = "https://pagure.io/xmlto.git";
+    rev = finalAttrs.version;
+    hash = "sha256-wttag8J1t9cBPBHNY7me2H0IPOzS8IjfCLIHNWq67Do=";
   };
 
-  # Note: These patches modify `xmlif/xmlif.l`, which requires `flex` to be rerun.
-  patches = [
-    # Fixes implicit `int` on `main`, which is an error with clang 16.
-    (fetchpatch {
-      url = "https://pagure.io/xmlto/c/8e34f087bf410bcc5fe445933d6ad9bae54f24b5.patch";
-      hash = "sha256-z5riDBZBVuFeBcjI++dAl3nTIgOPau4Gag0MJbYt+cc=";
-    })
-    # Fixes implicit `int` on `ifsense`, which is also an error with clang 16.
-    (fetchpatch {
-      url = "https://pagure.io/xmlto/c/1375e2df75530cd198bd16ac3de38e2b0d126276.patch";
-      hash = "sha256-fM6ZdTigrcC9cbXiKu6oa5Hs71mrREockB1wRlw6nDk=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs xmlif/test/run-test
 
     substituteInPlace "xmlto.in" \
-      --replace-fail "@BASH@" "${bash}/bin/bash" \
+      --replace-fail "@XMLTO_BASH_PATH@" "${bash}/bin/bash" \
       --replace-fail "@FIND@" "${findutils}/bin/find" \
       --replace-fail "@GETOPT@" "${getopt}/bin/getopt" \
       --replace-fail "@GREP@" "${gnugrep}/bin/grep" \
@@ -64,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
   # `libxml2' provides `xmllint', needed at build-time and run-time.
   # `libxslt' provides `xsltproc', used by `xmlto' at run-time.
   nativeBuildInputs = [
+    autoreconfHook
     makeWrapper
     flex
     getopt
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c9aea4bf5262..c137d964842b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16495,6 +16495,8 @@ with pkgs;
 
     isGNU = cc.isGNU or false;
     isClang = cc.isClang or false;
+    isArocc = cc.isArocc or false;
+    isZig = cc.isZig or false;
 
     inherit cc bintools libc libcxx extraPackages nixSupport zlib;
   } // extraArgs; in self);
@@ -19428,13 +19430,13 @@ with pkgs;
       then overrideSDK stdenv { darwinMinVersion = "10.13"; }
       else stdenv;
   };
-  abseil-cpp_202401 = callPackage ../development/libraries/abseil-cpp/202401.nix {
+  abseil-cpp_202407 = callPackage ../development/libraries/abseil-cpp/202407.nix {
     # If abseil-cpp doesn’t have a deployment target of 10.13+, arrow-cpp crashes in libgrpc.dylib.
     stdenv = if stdenv.isDarwin && stdenv.isx86_64
       then overrideSDK stdenv { darwinMinVersion = "10.13"; }
       else stdenv;
   };
-  abseil-cpp = abseil-cpp_202401;
+  abseil-cpp = abseil-cpp_202407;
 
   accountsservice = callPackage ../development/libraries/accountsservice { };
 
@@ -20294,8 +20296,6 @@ with pkgs;
 
   gdome2 = callPackage ../development/libraries/gdome2 { };
 
-  gdbm = callPackage ../development/libraries/gdbm { };
-
   gecode_3 = callPackage ../development/libraries/gecode/3.nix { };
   gecode_6 = qt5.callPackage ../development/libraries/gecode { };
   gecode = gecode_6;
@@ -22304,8 +22304,6 @@ with pkgs;
 
   libthai = callPackage ../development/libraries/libthai { };
 
-  libtheora = callPackage ../development/libraries/libtheora { };
-
   libthreadar = callPackage ../development/libraries/libthreadar { };
 
   libticables2 = callPackage ../development/libraries/libticables2 { };
@@ -24508,6 +24506,13 @@ with pkgs;
   };
   zig = zig_0_13;
 
+  zigStdenv = if stdenv.cc.isZig then stdenv else lowPrio zig.passthru.stdenv;
+
+  aroccPackages = recurseIntoAttrs (callPackage ../development/compilers/arocc {});
+  arocc = aroccPackages.latest;
+
+  aroccStdenv = if stdenv.cc.isArocc then stdenv else lowPrio arocc.cc.passthru.stdenv;
+
   zimlib = callPackage ../development/libraries/zimlib { };
 
   zita-convolver = callPackage ../development/libraries/audio/zita-convolver { };
@@ -25740,20 +25745,20 @@ with pkgs;
     postgresql_15_jit
     postgresql_16_jit
   ;
-  postgresql = postgresql_15;
-  postgresql_jit = postgresql_15_jit;
+  postgresql = postgresql_16;
+  postgresql_jit = postgresql_16_jit;
   postgresqlPackages = recurseIntoAttrs postgresql.pkgs;
   postgresqlJitPackages = recurseIntoAttrs postgresql_jit.pkgs;
   postgresql12Packages = recurseIntoAttrs postgresql_12.pkgs;
   postgresql13Packages = recurseIntoAttrs postgresql_13.pkgs;
   postgresql14Packages = recurseIntoAttrs postgresql_14.pkgs;
-  postgresql16Packages = recurseIntoAttrs postgresql_16.pkgs;
+  postgresql15Packages = recurseIntoAttrs postgresql_15.pkgs;
   postgresql12JitPackages = recurseIntoAttrs postgresql_12_jit.pkgs;
   postgresql13JitPackages = recurseIntoAttrs postgresql_13_jit.pkgs;
   postgresql14JitPackages = recurseIntoAttrs postgresql_14_jit.pkgs;
   postgresql15JitPackages = recurseIntoAttrs postgresql_15_jit.pkgs;
   postgresql16JitPackages = recurseIntoAttrs postgresql_16_jit.pkgs;
-  postgresql15Packages = postgresqlPackages;
+  postgresql16Packages = postgresqlPackages;
 
   postgresql_jdbc = callPackage ../development/java-modules/postgresql_jdbc { };
 
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 5800376c9153..0f5974d83cb8 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -291,6 +291,8 @@ let
       agdaPackages = packagePlatforms pkgs.agdaPackages;
 
       pkgsLLVM.stdenv = [ "x86_64-linux" "aarch64-linux" ];
+      pkgsArocc.stdenv = [ "x86_64-linux" "aarch64-linux" ];
+      pkgsZig.stdenv = [ "x86_64-linux" "aarch64-linux" ];
       pkgsMusl.stdenv = [ "x86_64-linux" "aarch64-linux" ];
       pkgsStatic.stdenv = [ "x86_64-linux" "aarch64-linux" ];
 
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index dcf177df4365..956f194ffd56 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -203,6 +203,36 @@ let
       };
     };
 
+    pkgsArocc = nixpkgsFun {
+      overlays = [
+        (self': super': {
+          pkgsArocc = super';
+        })
+      ] ++ overlays;
+      # Bootstrap a cross stdenv using the Aro C compiler.
+      # This is currently not possible when compiling natively,
+      # so we don't need to check hostPlatform != buildPlatform.
+      crossSystem = stdenv.hostPlatform // {
+        useArocc = true;
+        linker = "lld";
+      };
+    };
+
+    pkgsZig = nixpkgsFun {
+      overlays = [
+        (self': super': {
+          pkgsZig = super';
+        })
+      ] ++ overlays;
+      # Bootstrap a cross stdenv using the Zig toolchain.
+      # This is currently not possible when compiling natively,
+      # so we don't need to check hostPlatform != buildPlatform.
+      crossSystem = stdenv.hostPlatform // {
+        useZig = true;
+        linker = "lld";
+      };
+    };
+
     # All packages built with the Musl libc. This will override the
     # default GNU libc on Linux systems. Non-Linux systems are not
     # supported. 32-bit is also not supported.
@@ -292,10 +322,21 @@ let
           pkgsExtraHardening = super';
           stdenv = super'.withDefaultHardeningFlags (
             super'.stdenv.cc.defaultHardeningFlags ++ [
+              "shadowstack"
+              "pacret"
               "stackclashprotection"
               "trivialautovarinit"
             ]
           ) super'.stdenv;
+          glibc = super'.glibc.override rec {
+            enableCET = if self'.stdenv.hostPlatform.isx86_64 then "permissive" else false;
+            enableCETRuntimeDefault = enableCET != false;
+          };
+        } // lib.optionalAttrs (with super'.stdenv.hostPlatform; isx86_64 && isLinux) {
+          # causes shadowstack disablement
+          pcre = super'.pcre.override { enableJit = false; };
+          pcre-cpp = super'.pcre-cpp.override { enableJit = false; };
+          pcre16 = super'.pcre16.override { enableJit = false; };
         })
       ] ++ overlays;
     };