diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index cec832e4e636..76f7a02dcc94 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -43,9 +43,11 @@
 /pkgs/top-level/stage.nix                        @Ericson2314
 /pkgs/top-level/splice.nix                       @Ericson2314
 /pkgs/top-level/release-cross.nix                @Ericson2314
+/pkgs/stdenv                                     @philiptaron
 /pkgs/stdenv/generic                             @Ericson2314
 /pkgs/stdenv/generic/check-meta.nix              @Ericson2314
 /pkgs/stdenv/cross                               @Ericson2314
+/pkgs/build-support                              @philiptaron
 /pkgs/build-support/cc-wrapper                   @Ericson2314
 /pkgs/build-support/bintools-wrapper             @Ericson2314
 /pkgs/build-support/setup-hooks                  @Ericson2314
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 35ee264175a0..a886d93ae701 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5536,6 +5536,12 @@
     name = "Duncan Dean";
     keys = [ { fingerprint = "9484 44FC E03B 05BA 5AB0  591E C37B 1C1D 44C7 86EE"; } ];
   };
+  dvaerum = {
+    email = "nixpkgs-maintainer@varum.dk";
+    github = "dvaerum";
+    githubId = 6872940;
+    name = "Dennis Værum";
+  };
   dvn0 = {
     email = "git@dvn.me";
     github = "dvn0";
diff --git a/pkgs/README.md b/pkgs/README.md
index 7c99f3f4418f..76c5766d6c39 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -347,7 +347,7 @@ There are a few naming guidelines:
 
 - The `pname` and the `version` attribute _must not_ contain uppercase letters — e.g., `"mplayer"` instead of `"MPlayer"`.
 
-- The `version` attribute _must_ start with a digit e.g., `"0.3.1rc2"`.
+- The `version` attribute _must_ start with a digit e.g., `"0.3.1rc2"` or `"0-unstable-1970-01-01"`.
 
 - If a package is a commit from a repository without a version assigned, then the `version` attribute _should_ be the latest upstream version preceding that commit, followed by `-unstable-` and the date of the (fetched) commit. The date _must_ be in `"YYYY-MM-DD"` format.
 
diff --git a/pkgs/applications/audio/jmusicbot/default.nix b/pkgs/applications/audio/jmusicbot/default.nix
index 7f4d7275959c..1278bcc04523 100644
--- a/pkgs/applications/audio/jmusicbot/default.nix
+++ b/pkgs/applications/audio/jmusicbot/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "JMusicBot";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchurl {
     url = "https://github.com/jagrosh/MusicBot/releases/download/${version}/JMusicBot-${version}.jar";
-    sha256 = "sha256-Jg6/ju3ADBd7fc3njRzoEDVjIL4SzAzlTc02I4Q9hz4=";
+    sha256 = "sha256-7CHFc94Fe6ip7RY+XJR9gWpZPKM5JY7utHp8C3paU9s=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/applications/misc/cobang/default.nix b/pkgs/applications/misc/cobang/default.nix
index 0aca420fc7a4..e20bf9b818ad 100644
--- a/pkgs/applications/misc/cobang/default.nix
+++ b/pkgs/applications/misc/cobang/default.nix
@@ -97,8 +97,8 @@ buildPythonApplication rec {
     description = "QR code scanner desktop app for Linux";
     homepage = "https://github.com/hongquan/CoBang";
     license = licenses.gpl3Only;
-    maintainers = [ ];
+    maintainers = with maintainers; [ aleksana dvaerum ];
     mainProgram = "cobang";
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/browsers/ladybird/default.nix b/pkgs/applications/networking/browsers/ladybird/default.nix
index e6067f1da4aa..033b20dca5ad 100644
--- a/pkgs/applications/networking/browsers/ladybird/default.nix
+++ b/pkgs/applications/networking/browsers/ladybird/default.nix
@@ -8,10 +8,13 @@
 , unicode-emoji
 , unicode-character-database
 , cmake
+, dav1d
 , ninja
 , pkg-config
+, libaom
 , libavif
 , libxcrypt
+, libyuv
 , python3
 , qt6Packages
 , woff2
@@ -118,9 +121,12 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = with qt6Packages; [
+    dav1d
     ffmpeg
+    libaom
     libavif
     libxcrypt
+    libyuv
     qtbase
     qtmultimedia
     skia
@@ -153,7 +159,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # Only Ladybird and WebContent need wrapped, if Qt is enabled.
-  # On linux we end up wraping some non-Qt apps, like headless-browser.
+  # On linux we end up wrapping some non-Qt apps, like headless-browser.
   dontWrapQtApps = stdenv.isDarwin;
 
   passthru.tests = {
diff --git a/pkgs/applications/networking/cluster/talosctl/default.nix b/pkgs/applications/networking/cluster/talosctl/default.nix
index 9127b63f2bc7..d7b73979dfb8 100644
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.7.5";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    hash = "sha256-lmDLlxiPyVhlSPplYkIaS5Uw19hir6XD8MAk8q+obhY=";
+    hash = "sha256-uyPnln1Cj4j1oPVERBIHMJXJWR+jPUq6AE7rZXr2yQo=";
   };
 
-  vendorHash = "sha256-8UIey+r1tdVRN1RBK5xxcAzaHb0VFdgenUXSFgoWh1g=";
+  vendorHash = "sha256-ZJGhPT2KYYIMKmRWqdOppvXSD2W8kYtxK/900TdVdUg=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/cluster/yor/default.nix b/pkgs/applications/networking/cluster/yor/default.nix
index e0b08548f787..27e875c76c31 100644
--- a/pkgs/applications/networking/cluster/yor/default.nix
+++ b/pkgs/applications/networking/cluster/yor/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "yor";
-  version = "0.1.198";
+  version = "0.1.199";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-Af/k9O+wIEgBfpa3VffZx4mbjQGypfb5z0GWbhTOLxY=";
+    hash = "sha256-VQzaSWVf8n7/PHW4d0Vu1LBbPjB7EjvJrDp5w2fbl34=";
   };
 
   vendorHash = "sha256-uT/jGD4hDVes4h+mlSIT2p+C9TjxnUWsmKv9haPjjLc=";
diff --git a/pkgs/build-support/replace-vars/default.nix b/pkgs/build-support/replace-vars/default.nix
new file mode 100644
index 000000000000..a6fc94f4f376
--- /dev/null
+++ b/pkgs/build-support/replace-vars/default.nix
@@ -0,0 +1,77 @@
+{ lib, stdenvNoCC }:
+
+/**
+  `replaceVars` is a wrapper around the [bash function `substitute`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute)
+  in the stdenv. It allows for terse replacement of names in the specified path, while checking
+  for common mistakes such as naming a replacement that does nothing or forgetting a variable which
+  needs to be replaced.
+
+  As with the [`--subst-var-by`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute-subst-var-by)
+  flag, names are encoded as `@name@` in the provided file at the provided path.
+
+  Any unmatched variable names in the file at the provided path will cause a build failure.
+
+  Any remaining text that matches `@[A-Za-z_][0-9A-Za-z_'-]@` in the output after replacement
+  has occurred will cause a build failure.
+
+  # Inputs
+
+  `path` ([Store Path](https://nixos.org/manual/nix/latest/store/store-path.html#store-path) String)
+  : The file in which to replace variables.
+
+  `attrs` (AttrsOf String)
+  : Each entry in this set corresponds to a `--subst-var-by` entry in [`substitute`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute).
+
+  # Example
+
+  ```nix
+  { replaceVars }:
+
+  replaceVars ./greeting.txt { world = "hello"; }
+  ```
+
+  See `../../test/replace-vars/default.nix` for tests of this function.
+*/
+path: attrs:
+
+let
+  # We use `--replace-fail` instead of `--subst-var-by` so that if the thing isn't there, we fail.
+  subst-var-by = name: value: [
+    "--replace-fail"
+    (lib.escapeShellArg "@${name}@")
+    (lib.escapeShellArg value)
+  ];
+
+  replacements = lib.concatLists (lib.mapAttrsToList subst-var-by attrs);
+in
+
+stdenvNoCC.mkDerivation {
+  name = baseNameOf (toString path);
+  src = path;
+  doCheck = true;
+  dontUnpack = true;
+  preferLocalBuild = true;
+  allowSubstitutes = false;
+
+  buildPhase = ''
+    runHook preBuild
+    substitute "$src" "$out" ${lib.concatStringsSep " " replacements}
+    runHook postBuild
+  '';
+
+  # Look for Nix identifiers surrounded by `@` that aren't substituted.
+  checkPhase =
+    let
+      regex = lib.escapeShellArg "@[a-zA-Z_][0-9A-Za-z_'-]*@";
+    in
+    ''
+      runHook preCheck
+      if grep -qe ${regex} "$out"; then
+        echo The following look like unsubstituted Nix identifiers that remain in "$out":
+        grep -oe ${regex} "$out"
+        echo Use the more precise '`substitute`' function if this check is in error.
+        exit 1
+      fi
+      runHook postCheck
+    '';
+}
diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
index 28595b7aa2dc..51fdeb6b9712 100644
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -11,13 +11,13 @@
 }:
 
 let
-  version = "1.15.1";
+  version = "1.15.2";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     rev = "refs/tags/v${version}";
-    hash = "sha256-x4hSzkVDTbF6CyJttTLbZmnA3Ccs3k9mW90lp2Krk6E=";
+    hash = "sha256-N51wZjhdoNbhHpMrgcEEzd9FIVwKwYs9sU7jyFV2b8g=";
   };
 
   patchedPackageJSON = runCommand "package.json" { } ''
@@ -47,7 +47,7 @@ let
     pname = "pyright-internal";
     inherit version src;
     sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-Kg2y+z1izv3KV83UdUqEdyd8m0geMseb8uSb6tv4c5o=";
+    npmDepsHash = "sha256-RkMgCa7oAPFbTHC5WAcz6b8cUOEORR0sZr2VxhQki1k=";
     dontNpmBuild = true;
     # FIXME: Remove this flag when TypeScript 5.5 is released
     npmFlags = [ "--legacy-peer-deps" ];
@@ -94,7 +94,7 @@ buildNpmPackage rec {
   inherit version src;
 
   sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-0zLSTePWvf3ZB6OE3cmjimYuAkoCmQ0besM2PiEEWao=";
+  npmDepsHash = "sha256-6Zhd5IothE7RoetaITL5MmLIF6YDNk6IiHcfTzbbjLY=";
 
   postPatch = ''
     chmod +w ../../
diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index 291916b24311..2ce474f5969f 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -12,7 +12,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "24.1.3";
+  version = "24.1.4";
 
   src =
     let
@@ -25,10 +25,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-kPpcFkmMzTVo8GYptpp1pyNYsNEFuq6iuEtyewvRA0M=";
-        aarch64-linux = "sha256-hr3TwXIxspgF5my/j7yqPwpcTOTbCcxfd3nVBrEMkJY=";
-        x86_64-darwin = "sha256-pP6BeoSeOzWlsvXLIhMzty4pJ5J1iyokRV191lGM/5w=";
-        aarch64-darwin = "sha256-VjYrq/FyNgLcgMF/eWUmbC9y908qGkMUJ58/rWGXjvs=";
+        x86_64-linux = "sha256-xO9hQxiEtZJyoO3PQrNPuLPBj8iGF9tvpHkj9Z8oMMc=";
+        aarch64-linux = "sha256-4dkR0DR/e+gkMytFGNS5gJ/Eo6ih2pacYMR3LdLMv/E=";
+        x86_64-darwin = "sha256-LUlw7PMP1NpqIJ3qwY3ft+8gsQP8Cu6YqkaiH5Z5qZw=";
+        aarch64-darwin = "sha256-+7SkO6gv8kn4z9ccY5HIfLjnpsv89MBYil3H2zpQSZs=";
       };
     in
     fetchurl {
diff --git a/pkgs/by-name/fl/flarectl/package.nix b/pkgs/by-name/fl/flarectl/package.nix
index bb194bc1ca9e..8aecfc55da8a 100644
--- a/pkgs/by-name/fl/flarectl/package.nix
+++ b/pkgs/by-name/fl/flarectl/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "flarectl";
-  version = "0.99.0";
+  version = "0.101.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflare-go";
     rev = "v${version}";
-    hash = "sha256-Mv9LuNW5qnWuFYEbvv7cuPFM4PFixhgyFO90SBUS5Fg=";
+    hash = "sha256-twQ+my2CZmQDGMZg7bNZwNqSME+HZrWDZkzxKKEKd/0=";
   };
 
-  vendorHash = "sha256-k1JZGkJy5oGI3pEcrStNrsQTh8diNoe4DARqRX4PGS8=";
+  vendorHash = "sha256-gnl5zNNIH1LSAyzrhKIRXvwpUhXEydyDFzNCYtpZEIE=";
 
   subPackages = [ "cmd/flarectl" ];
 
diff --git a/pkgs/by-name/fl/flexget/package.nix b/pkgs/by-name/fl/flexget/package.nix
index 0a620c2098c6..e080f4cfdb22 100644
--- a/pkgs/by-name/fl/flexget/package.nix
+++ b/pkgs/by-name/fl/flexget/package.nix
@@ -5,7 +5,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.11.41";
+  version = "3.11.42";
   pyproject = true;
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZSqkD53fdDnKulVPgM9NWXVFXDR0sZ94mRyV1iKS87o=";
+    hash = "sha256-wDZXSQlIE1qQz463roHp3jepSFMZGSJAPOhKpuXTmG8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/go/goofcord/package.nix b/pkgs/by-name/go/goofcord/package.nix
index 7a02419a78ed..fe510af719e0 100644
--- a/pkgs/by-name/go/goofcord/package.nix
+++ b/pkgs/by-name/go/goofcord/package.nix
@@ -1,148 +1,121 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  autoPatchelfHook,
-  dpkg,
-  makeShellWrapper,
-  wrapGAppsHook3,
-  alsa-lib,
-  at-spi2-atk,
-  at-spi2-core,
-  atk,
-  cairo,
-  cups,
-  dbus,
-  expat,
-  ffmpeg,
-  fontconfig,
-  freetype,
-  gdk-pixbuf,
-  glib,
-  gtk3,
-  libappindicator-gtk3,
-  libdrm,
-  libnotify,
-  libpulseaudio,
-  libsecret,
-  libuuid,
-  libxkbcommon,
-  mesa,
-  nss,
-  pango,
-  systemd,
-  xdg-utils,
-  xorg,
-  wayland,
+  fetchFromGitHub,
+  pnpm,
+  nodejs_22,
+  nix-update-script,
+  electron,
   pipewire,
+  libpulseaudio,
+  makeShellWrapper,
+  makeDesktopItem,
+  copyDesktopItems,
 }:
 
+let
+  pnpm' = pnpm.override { nodejs = nodejs_22; };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "goofcord";
-  version = "1.5.0";
+  version = "1.6.0";
 
-  src =
-    let
-      base = "https://github.com/Milkshiift/GoofCord/releases/download";
-    in
-    {
-      x86_64-linux = fetchurl {
-        url = "${base}/v${finalAttrs.version}/GoofCord-${finalAttrs.version}-linux-amd64.deb";
-        hash = "sha256-T7z8myiNBaoDf04zynNhPekFtzoj435de09PVz8MWDM=";
-      };
-      aarch64-linux = fetchurl {
-        url = "${base}/v${finalAttrs.version}/GoofCord-${finalAttrs.version}-linux-arm64.deb";
-        hash = "sha256-u+qY1UWr9opjTBnIhqw62F9HYTdEnqagevJ+eg8XYr8=";
-      };
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  src = fetchFromGitHub {
+    owner = "Milkshiift";
+    repo = "GoofCord";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-hG8nHAuEHw/tjFnGKhSXwO+2l91OOnQUIAK05SvEquU=";
+  };
 
   nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
+    pnpm'.configHook
+    nodejs_22
     makeShellWrapper
-    wrapGAppsHook3
+    copyDesktopItems
   ];
 
-  dontWrapGApps = true;
-
-  buildInputs = [
-    alsa-lib
-    at-spi2-atk
-    at-spi2-core
-    atk
-    cairo
-    cups
-    dbus
-    expat
-    ffmpeg
-    fontconfig
-    freetype
-    gdk-pixbuf
-    glib
-    gtk3
-    pango
-    systemd
-    mesa # for libgbm
-    nss
-    libuuid
-    libdrm
-    libnotify
-    libsecret
+  buildInputs = lib.optionals stdenv.isLinux [
     libpulseaudio
-    libxkbcommon
-    libappindicator-gtk3
-    xorg.libX11
-    xorg.libxcb
-    xorg.libXcomposite
-    xorg.libXcursor
-    xorg.libXdamage
-    xorg.libXext
-    xorg.libXfixes
-    xorg.libXi
-    xorg.libXrandr
-    xorg.libXrender
-    xorg.libXScrnSaver
-    xorg.libxshmfence
-    xorg.libXtst
-    wayland
     pipewire
+    stdenv.cc.cc.lib
   ];
 
-  sourceRoot = ".";
-  unpackCmd = "dpkg-deb -x $src .";
+  pnpmDeps = pnpm'.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-wF7G8rs1Fg7whEftQ554s4C2CixP5/1oFudR5yY07Rk=";
+  };
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm build
+
+    npm exec electron-builder -- \
+      --dir \
+      -c.electronDist="${electron}/libexec/electron" \
+      -c.electronVersion="${electron.version}"
+
+    runHook postBuild
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p "$out/bin"
-    cp -R "opt" "$out"
-    cp -R "usr/share" "$out/share"
-    chmod -R g-w "$out"
+    mkdir -p "$out/share/lib/goofcord"
+    cp -r ./dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/goofcord"
+
+    install -Dm644 "build/icon.png" "$out/share/icons/hicolor/256x256/apps/goofcord.png"
 
     # use makeShellWrapper (instead of the makeBinaryWrapper provided by wrapGAppsHook3) for proper shell variable expansion
     # see https://github.com/NixOS/nixpkgs/issues/172583
-    makeShellWrapper $out/opt/GoofCord/goofcord $out/bin/goofcord \
+    makeShellWrapper "${lib.getExe electron}" "$out/bin/goofcord" \
+      --add-flags "$out/share/lib/goofcord/resources/app.asar" \
       "''${gappsWrapperArgs[@]}" \
-      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer}}" \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath finalAttrs.buildInputs}" \
-      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
-
-    # Fix desktop link
-    substituteInPlace $out/share/applications/goofcord.desktop \
-      --replace /opt/GoofCord/ ""
+      --set-default ELECTRON_IS_DEV 0 \
+      --inherit-argv0
 
     runHook postInstall
   '';
 
-  meta = with lib; {
+  desktopItems = [
+    (makeDesktopItem {
+      name = "goofcord";
+      genericName = "Internet Messenger";
+      desktopName = "GoofCord";
+      exec = "goofcord %U";
+      icon = "goofcord";
+      comment = finalAttrs.meta.description;
+      keywords = [
+        "discord"
+        "vencord"
+        "electron"
+        "chat"
+      ];
+      categories = [
+        "Network"
+        "InstantMessaging"
+        "Chat"
+      ];
+      startupWMClass = "GoofCord";
+      terminal = false;
+    })
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
     description = "Highly configurable and privacy-focused Discord client";
     homepage = "https://github.com/Milkshiift/GoofCord";
     downloadPage = "https://github.com/Milkshiift/GoofCord";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.osl3;
-    maintainers = with maintainers; [ nyanbinary ];
+    license = lib.licenses.osl3;
+    maintainers = with lib.maintainers; [ nyanbinary ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/jr/jrl-cmakemodules/package.nix b/pkgs/by-name/jr/jrl-cmakemodules/package.nix
index 149b25c1aee9..8dc01688de66 100644
--- a/pkgs/by-name/jr/jrl-cmakemodules/package.nix
+++ b/pkgs/by-name/jr/jrl-cmakemodules/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation {
   pname = "jrl-cmakemodules";
-  version = "0-unstable-2024-05-22";
+  version = "0-unstable-2024-08-05";
 
   src = fetchFromGitHub {
     owner = "jrl-umi3218";
     repo = "jrl-cmakemodules";
-    rev = "dd3e4127f2b223496859fe05be02726e9d1a071b";
-    hash = "sha256-ySMfops0Py1U+50LEGwgIwlzPUq/miusTxK7TIpQQXs=";
+    rev = "88d3cb561d1f9faa3c6281da7b2b8d6aa76b04d5";
+    hash = "sha256-3Su/tGtV39/tto1Hs5sgGgjpFWkBCvI2SZKqBIIDAjA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ko/kor/package.nix b/pkgs/by-name/ko/kor/package.nix
index 100ef9c3f5c3..fccf2b208874 100644
--- a/pkgs/by-name/ko/kor/package.nix
+++ b/pkgs/by-name/ko/kor/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kor";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "yonahd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AvywOQnDRzus2yexr+T85i0ztDStEJgYYMI+tr+Q9ZE=";
+    hash = "sha256-ZjFLcxp5keL4N8B7hZC8/x2Xk0c87p44yCfGunjLUNA=";
   };
 
   vendorHash = "sha256-rlDaQPR9sReAX4gAlbDGAsA1ei9Fo2sXoU9cbBCexfc=";
diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 0a1087421c41..d075c1882bb9 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -1,5 +1,4 @@
 {
-  callPackage,
   lib,
   stdenv,
   fetchFromGitHub,
@@ -9,6 +8,7 @@
   testers,
   nix-update-script,
   maturin,
+  python3,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -35,7 +35,16 @@ rustPlatform.buildRustPackage rec {
   passthru = {
     tests = {
       version = testers.testVersion { package = maturin; };
-      pyo3 = callPackage ./pyo3-test { };
+      pyo3 = python3.pkgs.callPackage ./pyo3-test {
+        format = "pyproject";
+        buildAndTestSubdir = "examples/word-count";
+        preConfigure = "";
+
+        nativeBuildInputs = with rustPlatform; [
+          cargoSetupHook
+          maturinBuildHook
+        ];
+      };
     };
 
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ma/maturin/pyo3-test/default.nix b/pkgs/by-name/ma/maturin/pyo3-test/default.nix
index 140d7154c6b6..8e0219d396a9 100644
--- a/pkgs/by-name/ma/maturin/pyo3-test/default.nix
+++ b/pkgs/by-name/ma/maturin/pyo3-test/default.nix
@@ -1,10 +1,46 @@
-{ python3, rustPlatform }:
+{
+  lib,
+  fetchFromGitHub,
+  buildPythonPackage,
+  rustPlatform,
 
-python3.pkgs.callPackage ./generic.nix {
-  buildAndTestSubdir = "examples/word-count";
+  # These are always passed as an override or as a callPackage option.
+  nativeBuildInputs,
+  buildAndTestSubdir,
+  format,
+  preConfigure,
+}:
 
-  nativeBuildInputs = with rustPlatform; [
-    cargoSetupHook
-    maturinBuildHook
-  ];
+buildPythonPackage rec {
+  pname = "word-count";
+  version = "0.13.2";
+
+  src = fetchFromGitHub {
+    owner = "PyO3";
+    repo = "pyo3";
+    rev = "v${version}";
+    hash = "sha256-NOMrrfo8WjlPhtGxWUOPJS/UDDdbLQRCXR++Zd6JmIA=";
+  };
+
+  cargoDeps = rustPlatform.importCargoLock { lockFile = ./Cargo.lock; };
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  inherit
+    buildAndTestSubdir
+    format
+    nativeBuildInputs
+    preConfigure
+    ;
+
+  pythonImportsCheck = [ "word_count" ];
+
+  meta = {
+    description = "PyO3 word count example";
+    homepage = "https://github.com/PyO3/pyo3";
+    license = lib.licenses.asl20;
+    maintainers = [ ];
+  };
 }
diff --git a/pkgs/by-name/ma/maturin/pyo3-test/generic.nix b/pkgs/by-name/ma/maturin/pyo3-test/generic.nix
deleted file mode 100644
index aed3e8a00770..000000000000
--- a/pkgs/by-name/ma/maturin/pyo3-test/generic.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-# Derivation prototype, used by maturin and setuptools-rust
-# passthrough tests.
-
-{
-  lib,
-  fetchFromGitHub,
-  python,
-  rustPlatform,
-
-  nativeBuildInputs,
-
-  buildAndTestSubdir ? null,
-  format ? "pyproject",
-  preConfigure ? "",
-}:
-
-python.pkgs.buildPythonPackage rec {
-  pname = "word-count";
-  version = "0.13.2";
-
-  src = fetchFromGitHub {
-    owner = "PyO3";
-    repo = "pyo3";
-    rev = "v${version}";
-    hash = "sha256-NOMrrfo8WjlPhtGxWUOPJS/UDDdbLQRCXR++Zd6JmIA=";
-  };
-
-  cargoDeps = rustPlatform.importCargoLock { lockFile = ./Cargo.lock; };
-
-  postPatch = ''
-    ln -s ${./Cargo.lock} Cargo.lock
-  '';
-
-  inherit
-    buildAndTestSubdir
-    format
-    nativeBuildInputs
-    preConfigure
-    ;
-
-  pythonImportsCheck = [ "word_count" ];
-
-  meta = {
-    description = "PyO3 word count example";
-    homepage = "https://github.com/PyO3/pyo3";
-    license = lib.licenses.asl20;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/by-name/mu/mullvad-browser/package.nix b/pkgs/by-name/mu/mullvad-browser/package.nix
index 93853396564c..876cf96d5077 100644
--- a/pkgs/by-name/mu/mullvad-browser/package.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -90,7 +90,7 @@ let
       ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "13.5.1";
+  version = "13.5.2";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -102,7 +102,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-YUITJ7YyK+210ASH1zxlILJ10r0L6SJjbiw2UVASCbw=";
+      hash = "sha256-CXcaJLgG448tjTlOcxGwT/w1qWaokpVXbBZ6cLxWcNc=";
     };
   };
 
diff --git a/pkgs/by-name/pl/plasticity/package.nix b/pkgs/by-name/pl/plasticity/package.nix
index 2306bee07642..dcc33000da72 100644
--- a/pkgs/by-name/pl/plasticity/package.nix
+++ b/pkgs/by-name/pl/plasticity/package.nix
@@ -33,11 +33,11 @@
 }:
 stdenv.mkDerivation rec  {
   pname = "plasticity";
-  version = "24.1.7";
+  version = "24.1.8";
 
   src = fetchurl {
     url = "https://github.com/nkallen/plasticity/releases/download/v${version}/Plasticity-${version}-1.x86_64.rpm";
-    hash = "sha256-HVAQXDfj/5UoOGvgrOW09xFeVv4MF/wXqxtRdwZAqso=";
+    hash = "sha256-Hh1yf3JqzMEvorWztLvoTcnDAk48cNe7NcCLrvNQCzo=";
   };
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/by-name/pr/prrte/package.nix b/pkgs/by-name/pr/prrte/package.nix
index c8ac31fe626a..de604217cc94 100644
--- a/pkgs/by-name/pr/prrte/package.nix
+++ b/pkgs/by-name/pr/prrte/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "prrte";
-  version = "3.0.5";
+  version = "3.0.6";
 
   src = fetchFromGitHub {
     owner = "openpmix";
     repo = "prrte";
     rev = "v${version}";
-    sha256 = "sha256-RDxd4veLGbN+T7xCDnNp2lbOM7mwKKD+SKdPmExr1C8=";
+    sha256 = "sha256-0JHtUpGFdPKmgUk0+MNxTfZIUDz/vY/CV+Mqbmv0JFw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/py/pyright/package.nix b/pkgs/by-name/py/pyright/package.nix
index f9d8679b2104..3507a95d2e58 100644
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -1,13 +1,13 @@
 { lib, buildNpmPackage, fetchFromGitHub, runCommand, jq }:
 
 let
-  version = "1.1.373";
+  version = "1.1.375";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "pyright";
     rev = "${version}";
-    hash = "sha256-TMQ9ttWUDwf7Lp2JOwpIu4Bn3TbioXxkCPpEZiPDPyk=";
+    hash = "sha256-9GiwWCbo6z9/x9qBEsRoTh9WYNJ0XnlMq1BD7vrIHfA=";
   };
 
   patchedPackageJSON = runCommand "package.json" { } ''
@@ -37,7 +37,7 @@ let
     pname = "pyright-internal";
     inherit version src;
     sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-BsfhbfhjHIlip3IiOJewjVD6Eq4bgr+Yo81rvIrJr7E=";
+    npmDepsHash = "sha256-4roH83gyZg6g6HjqassEAcn36bgqd1lwrq/ArST2+18=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -51,7 +51,7 @@ buildNpmPackage rec {
   inherit version src;
 
   sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-cZhNkQjO1dAghXNoVCF0NQEi9QjXci626Ck9PXntoYA=";
+  npmDepsHash = "sha256-BJgdf7rDxs4NvXDJ4Y8z+DEAX77CXrB7FXzGEqH+YwI=";
 
   postPatch = ''
     chmod +w ../../
diff --git a/pkgs/by-name/rs/rsgain/package.nix b/pkgs/by-name/rs/rsgain/package.nix
index 4d2713771827..2a8fa32ec554 100644
--- a/pkgs/by-name/rs/rsgain/package.nix
+++ b/pkgs/by-name/rs/rsgain/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
     pname = "rsgain";
-    version = "3.5.1";
+    version = "3.5.2";
 
     src = fetchFromGitHub {
       owner = "complexlogic";
       repo = "rsgain";
       rev = "v${version}";
-      sha256 = "sha256-33ezojvCYAvxmUWzLxes3nUpK4iIWjlXsVSi+q7xeGU=";
+      sha256 = "sha256-kTvIMsRI99U2ovkN5pC4OUS/bJWpRYSuRcvObvQRnbQ=";
     };
 
     cmakeFlags = ["-DCMAKE_BUILD_TYPE='Release'"];
diff --git a/pkgs/by-name/se/sendme/package.nix b/pkgs/by-name/se/sendme/package.nix
index 0054e560becd..2df9fa3d5af1 100644
--- a/pkgs/by-name/se/sendme/package.nix
+++ b/pkgs/by-name/se/sendme/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sendme";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "n0-computer";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3fD09NAHpuE5Me5bn87afUrnrsaRVZscPUavioIT4q0=";
+    hash = "sha256-PYuYFC4DsiVI3EiL8akffRvwDMWgc2qwblrqtlEqnYg=";
   };
 
-  cargoHash = "sha256-TGEoD/PEFnuheTKVdTJVB5XEobrQFLk8JoEBFELj/pY=";
+  cargoHash = "sha256-yG6YZ02x7P6qwIu3vvz5ZUEUGrveizof+qHsSGXc3WU=";
 
   buildInputs = lib.optionals stdenv.isDarwin (
     with darwin.apple_sdk.frameworks; [
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
index 7e5164eb529d..b344d91603b5 100644
--- a/pkgs/by-name/sn/snapcraft/package.nix
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -35,7 +35,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "snapcraft";
-  version = "8.3.1";
+  version = "8.3.2";
 
   pyproject = true;
 
@@ -43,7 +43,7 @@ python.pkgs.buildPythonApplication rec {
     owner = "canonical";
     repo = "snapcraft";
     rev = "refs/tags/${version}";
-    hash = "sha256-cdRlUY9hAJ8US93aiJymzsV27JVPY7lWCK7IUdjDmYE=";
+    hash = "sha256-JlmVnSpbMjMpJBXyRxF/LqJ+0e5fty6BK+sCPJ2Uw9I=";
   };
 
   patches = [
diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix
index 62c523afd539..85e068db0842 100644
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -101,7 +101,7 @@ lib.warnIf (useHardenedMalloc != null)
       ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "13.5.1";
+  version = "13.5.2";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -111,7 +111,7 @@ lib.warnIf (useHardenedMalloc != null)
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-1TxxLWjNd63UxiCqTWjqa5upreOrhX4MaMDwPEEIyoo=";
+      hash = "sha256-f6bKRWirHuOe2BnCYegZi1j58Ou3p6Syw++NVLGUGdU=";
     };
 
     i686-linux = fetchurl {
@@ -121,7 +121,7 @@ lib.warnIf (useHardenedMalloc != null)
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-x1Eo1fF/J79r5ZCq5JkVu38CZk5MTOiHh4Yhmji8oOc=";
+      hash = "sha256-ye+l3aq3nV97SUyARZMcPhdtGLoAWoscbr81F5LdbS4=";
     };
   };
 
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index d7defb8d408e..bbf81d4864f4 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "vacuum-go";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     rev = "refs/tags/v${version}";
-    hash = "sha256-i4B11hTPvF6kL7x8LUv8A4J1HfAhtxgSmvzNL+4sdYI=";
+    hash = "sha256-yfwAIcFDnhhPy71WpjNst4S7fn3V6UzkdtSYlr3zmEE=";
   };
 
-  vendorHash = "sha256-b51Rs09EjHxYATwaFdHV96ZOORFxD0Y9cKTcJTSGhIU=";
+  vendorHash = "sha256-Yxzj3IAYp6C7qLbV2RV4lWZRDSheauZXvd+p5B5Y3qA=";
 
   CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/data/fonts/cozette/default.nix b/pkgs/data/fonts/cozette/default.nix
index ea4230d9526a..ed1bdb1910f7 100644
--- a/pkgs/data/fonts/cozette/default.nix
+++ b/pkgs/data/fonts/cozette/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cozette";
-  version = "1.25.0";
+  version = "1.25.1";
 
   src = fetchzip {
     url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts-v-${builtins.replaceStrings ["."] ["-"] version}.zip";
-    hash = "sha256-ybq72r2p/2e41jzcZ/KxQgib3VIET6PppyCsGAQVXD8=";
+    hash = "sha256-Cnl7DTPcZmCRM06qe7WXfZorok3uUNYcB9bR/auzCao=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
index ef969cb67156..7c8f1fbd9cde 100644
--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.21.12";
+  version = "1.21.13";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-MOaK8nvB8d8jHjq3Tz0X07jVKgicebyqtXO08bgH7U8=";
+    hash = "sha256-cfsxYGod5I0SnVkehxemPgxVZf+6CaJOqfiZoTIUw00=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/httplib/default.nix b/pkgs/development/libraries/httplib/default.nix
index 95c15fdc610a..9abe05161ab5 100644
--- a/pkgs/development/libraries/httplib/default.nix
+++ b/pkgs/development/libraries/httplib/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "httplib";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${version}";
-    hash = "sha256-1w7uu2E4YIcGWNq//BZ2wtDKj9/tgmIhkJgadvCKmVg=";
+    hash = "sha256-8/m3i1ciSq+jybz0yxS3Lr9oeHpvOf6qKOwmzNloi+Y=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/pinocchio/default.nix b/pkgs/development/libraries/pinocchio/default.nix
index 91e701a6d8a7..347d8b4b2856 100644
--- a/pkgs/development/libraries/pinocchio/default.nix
+++ b/pkgs/development/libraries/pinocchio/default.nix
@@ -1,11 +1,12 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , boost
 , eigen
 , example-robot-data
-, collisionSupport ? !stdenv.isDarwin
+, collisionSupport ? true
 , console-bridge
 , jrl-cmakemodules
 , hpp-fcl
@@ -16,28 +17,30 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pinocchio";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "stack-of-tasks";
     repo = "pinocchio";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-h4NzfS27+jWyHbegxF+pgN6JzJdVAoM16J6G/9uNJc4=";
+    hash = "sha256-WgMqb+NHnaxW9/qSZ0UGI4zGxGjh12a5DwtdX9byBiw=";
   };
 
-  prePatch = ''
-    # test failure, ref https://github.com/stack-of-tasks/pinocchio/issues/2304
-    substituteInPlace unittest/CMakeLists.txt \
-      --replace-fail "add_pinocchio_unit_test(contact-cholesky)" ""
-  '' + lib.optionalString (stdenv.isLinux && stdenv.isAarch64) ''
-    # test failure, ref https://github.com/stack-of-tasks/pinocchio/issues/2304
-    substituteInPlace unittest/CMakeLists.txt \
-      --replace-fail "add_pinocchio_unit_test(contact-models)" ""
-    # test failure, ref https://github.com/stack-of-tasks/pinocchio/issues/2277
+  # test failure, ref https://github.com/stack-of-tasks/pinocchio/issues/2277
+  prePatch = lib.optionalString (stdenv.isLinux && stdenv.isAarch64) ''
     substituteInPlace unittest/algorithm/utils/CMakeLists.txt \
       --replace-fail "add_pinocchio_unit_test(force)" ""
   '';
 
+  patches = [
+    # fix urdf & collision support on aarch64-darwin
+    (fetchpatch {
+      name = "static-pointer_cast.patch";
+      url = "https://github.com/stack-of-tasks/pinocchio/pull/2339/commits/ead869e8f3cce757851b9a011c4a2f55fb66582b.patch";
+      hash = "sha256-CkrWQJP/pPNs6B3a1FclfM7JWwkmsPzRumS46KQHv0s=";
+    })
+  ];
+
   # example-robot-data models are used in checks.
   # Upstream provide them as git submodule, but we can use our own version instead.
   postPatch = ''
@@ -45,6 +48,13 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${example-robot-data.src} models/example-robot-data
   '';
 
+  # CMAKE_BUILD_TYPE defaults to Release in this package,
+  # which enable -O3, which break some tests
+  # ref. https://github.com/stack-of-tasks/pinocchio/issues/2304#issuecomment-2231018300
+  postConfigure = ''
+    substituteInPlace CMakeCache.txt --replace-fail '-O3' '-O2'
+  '';
+
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -71,9 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
     (lib.cmakeBool "BUILD_WITH_LIBPYTHON" pythonSupport)
     (lib.cmakeBool "BUILD_WITH_COLLISION_SUPPORT" collisionSupport)
-  ] ++ lib.optionals (pythonSupport && stdenv.isDarwin) [
-    # AssertionError: '.' != '/tmp/nix-build-pinocchio-2.7.0.drv/sou[84 chars].dae'
-    "-DCMAKE_CTEST_ARGUMENTS='--exclude-regex;test-py-bindings_geometry_model_urdf'"
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/science/math/suitesparse-graphblas/default.nix b/pkgs/development/libraries/science/math/suitesparse-graphblas/default.nix
index 6ace83fd043d..3dd08a239ee7 100644
--- a/pkgs/development/libraries/science/math/suitesparse-graphblas/default.nix
+++ b/pkgs/development/libraries/science/math/suitesparse-graphblas/default.nix
@@ -1,21 +1,25 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, gnum4
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gnum4,
 }:
 
 stdenv.mkDerivation rec {
   pname = "suitesparse-graphblas";
-  version = "9.2.0";
+  version = "9.3.0";
 
-  outputs = [ "out" "dev" ];
+  outputs = [
+    "out"
+    "dev"
+  ];
 
   src = fetchFromGitHub {
     owner = "DrTimothyAldenDavis";
     repo = "GraphBLAS";
     rev = "v${version}";
-    hash = "sha256-UtJ5AXbmoUA1NokgXDUDnhCZzOT1bTen6C89bsCWEIo=";
+    hash = "sha256-/ubvds/mg5SW8kEfnEuPyHCM/P8+ETT1Uus2ESj50Og=";
   };
 
   nativeBuildInputs = [
@@ -27,6 +31,8 @@ stdenv.mkDerivation rec {
     export HOME=$(mktemp -d)
   '';
 
+  cmakeFlags = [ (lib.cmakeBool "GRAPHBLAS_USE_JIT" (!(stdenv.isLinux && stdenv.isAarch64))) ];
+
   meta = with lib; {
     description = "Graph algorithms in the language of linear algebra";
     homepage = "https://people.engr.tamu.edu/davis/GraphBLAS.html";
diff --git a/pkgs/development/libraries/sentry-native/default.nix b/pkgs/development/libraries/sentry-native/default.nix
index bcf4ab9c742d..acda15495bd4 100644
--- a/pkgs/development/libraries/sentry-native/default.nix
+++ b/pkgs/development/libraries/sentry-native/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentry-native";
-  version = "0.7.7";
+  version = "0.7.8";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-native";
     rev = version;
-    hash = "sha256-5hrjwDeJH2XuPa/vVJGC45AmBT4s0aeSiE46iDKHsUk=";
+    hash = "sha256-S9fkxLCeQdHOt1FUa8CcZMmORNcxwQSuchng/dNq4g8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ansible-navigator/default.nix b/pkgs/development/python-modules/ansible-navigator/default.nix
index 96e6330f3815..a795039d1c21 100644
--- a/pkgs/development/python-modules/ansible-navigator/default.nix
+++ b/pkgs/development/python-modules/ansible-navigator/default.nix
@@ -5,18 +5,23 @@
   podman,
   fetchPypi,
   buildPythonPackage,
+  pythonOlder,
 }:
+
 buildPythonPackage rec {
   pname = "ansible-navigator";
-  version = "24.3.2";
-  format = "pyproject";
+  version = "24.7.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-IAcZFisB3BOmdxZuGZ3PZcDl2CXsg6ToI/1fdPpkIXw=";
+    pname = "ansible_navigator";
+    inherit version;
+    hash = "sha256-XMwJzDxo/VZ+0qy5MLg/Kw/7j3V594qfV+T6jeVEWzg=";
   };
 
-  buildInputs = with python3Packages; [
+  build-system = with python3Packages; [
     setuptools
     setuptools-scm
   ];
@@ -32,15 +37,15 @@ buildPythonPackage rec {
     onigurumacffi
   ];
 
-  patchPhase = ''
-    # scm_git_archive doesn't exist anymore. Fixed upstream but unreleased
-    # Rev: https://github.com/ansible/ansible-navigator/pull/1716
-    sed -i '/setuptools_scm_git_archive/d' pyproject.toml
-  '';
+  # Tests want to run in tmux
+  doCheck = false;
+
+  pythonImportsCheck = [ "ansible_navigator" ];
 
   meta = with lib; {
     description = "Text-based user interface (TUI) for Ansible";
     homepage = "https://ansible.readthedocs.io/projects/navigator/";
+    changelog = "https://github.com/ansible/ansible-navigator/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ melkor333 ];
   };
diff --git a/pkgs/development/python-modules/flask-restful/default.nix b/pkgs/development/python-modules/flask-restful/default.nix
index 55bb0160b49b..fff1e2492f5b 100644
--- a/pkgs/development/python-modules/flask-restful/default.nix
+++ b/pkgs/development/python-modules/flask-restful/default.nix
@@ -5,6 +5,7 @@
   buildPythonPackage,
   fetchPypi,
   flask,
+  fetchpatch2,
   mock,
   nose,
   pytestCheckHook,
@@ -30,7 +31,15 @@ buildPythonPackage rec {
   # conditional so that overrides are easier for web applications
   patches =
     lib.optionals (lib.versionAtLeast werkzeug.version "2.1.0") [ ./werkzeug-2.1.0-compat.patch ]
-    ++ lib.optionals (lib.versionAtLeast flask.version "3.0.0") [ ./flask-3.0-compat.patch ];
+    ++ lib.optionals (lib.versionAtLeast flask.version "3.0.0") [ ./flask-3.0-compat.patch ]
+    ++ [
+      # replace use nose by pytest: https://github.com/flask-restful/flask-restful/pull/970
+      (fetchpatch2 {
+        url = "https://github.com/flask-restful/flask-restful/commit/6cc4b057e5450e0c84b3ee5f6f7a97e648a816d6.patch?full_index=1";
+        hash = "sha256-kIjrkyL0OfX+gjoiYfchU0QYTPHz4JMCQcHLFH9oEF4=";
+      })
+      ./fix-test-inputs.patch
+    ];
 
   propagatedBuildInputs = [
     aniso8601
diff --git a/pkgs/development/python-modules/flask-restful/fix-test-inputs.patch b/pkgs/development/python-modules/flask-restful/fix-test-inputs.patch
new file mode 100644
index 000000000000..5f58c675f2aa
--- /dev/null
+++ b/pkgs/development/python-modules/flask-restful/fix-test-inputs.patch
@@ -0,0 +1,173 @@
+diff --git a/tests/test_inputs.py b/tests/test_inputs.py
+index 7c30d45..645b728 100644
+--- a/tests/test_inputs.py
++++ b/tests/test_inputs.py
+@@ -5,6 +5,7 @@ import re
+ 
+ #noinspection PyUnresolvedReferences
+ import six
++import pytest
+ 
+ from flask_restful import inputs
+ 
+@@ -17,7 +18,7 @@ def test_reverse_rfc822_datetime():
+     ]
+ 
+     for date_string, expected in dates:
+-        yield assert_equal, inputs.datetime_from_rfc822(date_string), expected
++        assert inputs.datetime_from_rfc822(date_string) == expected
+ 
+ 
+ def test_reverse_iso8601_datetime():
+@@ -29,7 +30,7 @@ def test_reverse_iso8601_datetime():
+     ]
+ 
+     for date_string, expected in dates:
+-        yield assert_equal, inputs.datetime_from_iso8601(date_string), expected
++        assert inputs.datetime_from_iso8601(date_string) == expected
+ 
+ 
+ def test_urls():
+@@ -53,7 +54,7 @@ def test_urls():
+     ]
+ 
+     for value in urls:
+-        yield assert_equal, inputs.url(value), value
++        assert inputs.url(value) == value
+ 
+ 
+ def check_bad_url_raises(value):
+@@ -118,7 +119,8 @@ def test_regex_bad_input():
+     num_only = inputs.regex(r'^[0-9]+$')
+ 
+     for value in cases:
+-        yield assert_raises, ValueError, lambda: num_only(value)
++        with pytest.raises(ValueError):
++            num_only(value)
+ 
+ 
+ def test_regex_good_input():
+@@ -131,12 +133,13 @@ def test_regex_good_input():
+     num_only = inputs.regex(r'^[0-9]+$')
+ 
+     for value in cases:
+-        yield assert_equal, num_only(value), value
++        assert num_only(value) == value
+ 
+ 
+ def test_regex_bad_pattern():
+     """Regex error raised immediately when regex input parser is created."""
+-    assert_raises(re.error, inputs.regex, '[')
++    with pytest.raises(re.error):
++        inputs.regex('[')
+ 
+ 
+ def test_regex_flags_good_input():
+@@ -149,7 +152,7 @@ def test_regex_flags_good_input():
+     case_insensitive = inputs.regex(r'^[A-Z]+$', re.IGNORECASE)
+ 
+     for value in cases:
+-        yield assert_equal, case_insensitive(value), value
++        assert case_insensitive(value) == value
+ 
+ 
+ def test_regex_flags_bad_input():
+@@ -161,7 +164,8 @@ def test_regex_flags_bad_input():
+     case_sensitive = inputs.regex(r'^[A-Z]+$')
+ 
+     for value in cases:
+-        yield assert_raises, ValueError, lambda: case_sensitive(value)
++        with pytest.raises(ValueError):
++            case_sensitive(value)
+ 
+ 
+ class TypesTestCase(unittest.TestCase):
+@@ -191,35 +195,41 @@ class TypesTestCase(unittest.TestCase):
+         assert inputs.boolean(False) == False
+ 
+     def test_bad_boolean(self):
+-        assert_raises(ValueError, lambda: inputs.boolean("blah"))
++        with pytest.raises(ValueError):
++            inputs.boolean("blah")
+ 
+     def test_date_later_than_1900(self):
+         assert inputs.date("1900-01-01") == datetime(1900, 1, 1)
+ 
+     def test_date_input_error(self):
+-        assert_raises(ValueError, lambda: inputs.date("2008-13-13"))
++        with pytest.raises(ValueError):
++            inputs.date("2008-13-13")
+ 
+     def test_date_input(self):
+         assert inputs.date("2008-08-01") == datetime(2008, 8, 1)
+ 
+     def test_natual_negative(self):
+-        assert_raises(ValueError, lambda: inputs.natural(-1))
++        with pytest.raises(ValueError):
++            inputs.natural(-1)
+ 
+     def test_natural(self):
+         assert 3 == inputs.natural(3)
+ 
+     def test_natual_string(self):
+-        assert_raises(ValueError, lambda: inputs.natural('foo'))
++        with pytest.raises(ValueError):
++            inputs.natural('foo')
+ 
+     def test_positive(self):
+         assert 1 == inputs.positive(1)
+         assert 10000 == inputs.positive(10000)
+ 
+     def test_positive_zero(self):
+-        assert_raises(ValueError, lambda: inputs.positive(0))
++        with pytest.raises(ValueError):
++            inputs.positive(0)
+ 
+     def test_positive_negative_input(self):
+-        assert_raises(ValueError, lambda: inputs.positive(-1))
++        with pytest.raises(ValueError):
++            inputs.positive(-1)
+ 
+     def test_int_range_good(self):
+         int_range = inputs.int_range(1, 5)
+@@ -231,11 +241,13 @@ class TypesTestCase(unittest.TestCase):
+ 
+     def test_int_range_low(self):
+         int_range = inputs.int_range(0, 5)
+-        assert_raises(ValueError, lambda: int_range(-1))
++        with pytest.raises(ValueError):
++            int_range(-1)
+ 
+     def test_int_range_high(self):
+         int_range = inputs.int_range(0, 5)
+-        assert_raises(ValueError, lambda: int_range(6))
++        with pytest.raises(ValueError):
++            int_range(6)
+ 
+ 
+ def test_isointerval():
+@@ -389,7 +401,7 @@ def test_isointerval():
+     ]
+ 
+     for value, expected in intervals:
+-        yield assert_equal, inputs.iso8601interval(value), expected
++        assert inputs.iso8601interval(value) == expected
+ 
+ 
+ def test_invalid_isointerval_error():
+@@ -413,12 +425,9 @@ def test_bad_isointervals():
+     ]
+ 
+     for bad_interval in bad_intervals:
+-        yield (
+-            assert_raises,
+-            Exception,
+-            inputs.iso8601interval,
+-            bad_interval,
+-        )
++        with pytest.raises(Exception):
++            inputs.iso8601interval(bad_interval)
++
+ 
+ if __name__ == '__main__':
+     unittest.main()
diff --git a/pkgs/development/python-modules/podman/default.nix b/pkgs/development/python-modules/podman/default.nix
index 3ba10ffb06b6..11f3a62535b4 100644
--- a/pkgs/development/python-modules/podman/default.nix
+++ b/pkgs/development/python-modules/podman/default.nix
@@ -5,7 +5,6 @@
   fixtures,
   pytestCheckHook,
   pythonOlder,
-  pyxdg,
   requests,
   requests-mock,
   rich,
@@ -16,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "podman";
-  version = "5.0.0";
+  version = "5.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,18 +24,19 @@ buildPythonPackage rec {
     owner = "containers";
     repo = "podman-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3tbhTg060/K4ejT/xjItSu9zf05LR/d0vkg4XDsspEE=";
+    hash = "sha256-2NsF00jaW2wl99sTxTQ5xJkqNOYh9RaecmBMcWP3TI8=";
   };
 
   build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
-    pyxdg
+  dependencies = [
     requests
-    rich
-    tomli
     urllib3
-  ];
+  ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];
+
+  passthru.optional-dependencies = {
+    progress_bar = [ rich ];
+  };
 
   nativeCheckInputs = [
     fixtures
@@ -54,6 +54,7 @@ buildPythonPackage rec {
     # Integration tests require a running container setup
     "AdapterIntegrationTest"
     "ContainersIntegrationTest"
+    "ContainersExecIntegrationTests"
     "ImagesIntegrationTest"
     "ManifestsIntegrationTest"
     "NetworksIntegrationTest"
@@ -69,6 +70,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/containers/podman-py/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
-    mainProgram = "podman";
   };
 }
diff --git a/pkgs/development/python-modules/python-zbar/default.nix b/pkgs/development/python-modules/python-zbar/default.nix
index ed676f9c3561..64dba8c8d350 100644
--- a/pkgs/development/python-modules/python-zbar/default.nix
+++ b/pkgs/development/python-modules/python-zbar/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonAtLeast,
   setuptools,
   pillow,
   zbar,
@@ -14,9 +13,6 @@ buildPythonPackage rec {
   version = "0.23.93";
   pyproject = true;
 
-  # distutils usage in setup.py
-  disabled = pythonAtLeast "3.12";
-
   src = fetchFromGitHub {
     owner = "mchehab";
     repo = "zbar";
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index 2e093e782306..89ece83ec054 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -1,11 +1,15 @@
 {
-  callPackage,
   lib,
   buildPythonPackage,
   fetchPypi,
+  maturin,
   pythonOlder,
+  rustPlatform,
+  rustc,
+  cargo,
   semantic-version,
   setuptools,
+  setuptools-rust,
   setuptools-scm,
   tomli,
   typing-extensions,
@@ -38,7 +42,26 @@ buildPythonPackage rec {
 
   doCheck = false;
 
-  passthru.tests.pyo3 = callPackage ./pyo3-test { };
+  passthru.tests = {
+    pyo3 = maturin.tests.pyo3.override {
+      format = "setuptools";
+      buildAndTestSubdir = null;
+
+      nativeBuildInputs =
+        [ setuptools-rust ]
+        ++ [
+          rustPlatform.cargoSetupHook
+          cargo
+          rustc
+        ];
+
+      preConfigure = ''
+        # sourceRoot puts Cargo.lock in the wrong place due to the
+        # example setup.
+        cd examples/word-count
+      '';
+    };
+  };
 
   meta = with lib; {
     description = "Setuptools plugin for Rust support";
diff --git a/pkgs/development/python-modules/setuptools-rust/pyo3-test/default.nix b/pkgs/development/python-modules/setuptools-rust/pyo3-test/default.nix
deleted file mode 100644
index b8f2c593a656..000000000000
--- a/pkgs/development/python-modules/setuptools-rust/pyo3-test/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  callPackage,
-  cargo,
-  rustPlatform,
-  rustc,
-  setuptools-rust,
-}:
-
-callPackage ../../../tools/rust/maturin/pyo3-test/generic.nix {
-  # Isolated builds break for this package, because PyO3 is not
-  # in the build root of the Python Package:
-  #
-  # https://github.com/pypa/pip/issues/6276
-  #
-  format = "setuptools";
-
-  nativeBuildInputs =
-    [ setuptools-rust ]
-    ++ [
-      rustPlatform.cargoSetupHook
-      cargo
-      rustc
-    ];
-
-  preConfigure = ''
-    # sourceRoot puts Cargo.lock in the wrong place due to the
-    # example setup.
-    cd examples/word-count
-  '';
-}
diff --git a/pkgs/development/tools/faas-cli/default.nix b/pkgs/development/tools/faas-cli/default.nix
index 3978737cf582..3ff99faa600f 100644
--- a/pkgs/development/tools/faas-cli/default.nix
+++ b/pkgs/development/tools/faas-cli/default.nix
@@ -18,13 +18,13 @@ let
 in
 buildGoModule rec {
   pname = "faas-cli";
-  version = "0.16.31";
+  version = "0.16.32";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "sha256-RvDrdgHzGGjJorm55ksMk+YqPdBgQyWs1IDaxqOYON8=";
+    sha256 = "sha256-EqP1YStp8sUJq0zel9mTmi8SWHvObciUetRzAbo3rK8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/go-minimock/default.nix b/pkgs/development/tools/go-minimock/default.nix
index c3a47019486a..eb370a22914a 100644
--- a/pkgs/development/tools/go-minimock/default.nix
+++ b/pkgs/development/tools/go-minimock/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "go-minimock";
-  version = "3.3.13";
+  version = "3.3.14";
 
   src = fetchFromGitHub {
     owner = "gojuno";
     repo = "minimock";
     rev = "v${version}";
-    hash = "sha256-YLGZJMBe5wKI9RccJ1ps48A3ZiPWMrzjZH4Fpy8K9yM=";
+    hash = "sha256-J4clMn65l7L+qSHbJBMDDRoEfgGHKllRu8nvTGlbgaw=";
   };
 
   ldflags = [
     "-s" "-w" "-X main.version=${version}"
   ];
 
-  vendorHash = "sha256-O1Bp+zuSq3/UULpej4rXxeHcDiNAhECqj9Yh9aGeA0E=";
+  vendorHash = "sha256-60mOX0N8q9Q4Cb1G3hxQgykkDgvrVLYaZElptsW1PPI=";
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/language-servers/beancount-language-server/default.nix b/pkgs/development/tools/language-servers/beancount-language-server/default.nix
index eb561dae346b..d01732da1212 100644
--- a/pkgs/development/tools/language-servers/beancount-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/beancount-language-server/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "beancount-language-server";
-  version = "1.3.4";
+  version = "1.3.5";
 
   src = fetchFromGitHub {
     owner = "polarmutex";
     repo = "beancount-language-server";
     rev = "v${version}";
-    hash = "sha256-C44Z8JaEZvwgocaGjWT3rUAgIBtCRo0xZappMsydR7g=";
+    hash = "sha256-Z8Gc3QbnFGzF1mNjlbazz7OiDpQxY3HcaBKd32XjQCY=";
   };
 
-  cargoHash = "sha256-NMSNCURSO1iIWHH27FI5Y0q7+Ghds8VSxRGBOp+fH6A=";
+  cargoHash = "sha256-WMrh4toFqd+G30ZZxC+kT/Q07gn+3p80oKECASD48wc=";
 
   doInstallCheck = true;
   postInstallCheck = ''
diff --git a/pkgs/development/tools/rojo/default.nix b/pkgs/development/tools/rojo/default.nix
index 3ba5c839c5b5..c66c0a0b92f0 100644
--- a/pkgs/development/tools/rojo/default.nix
+++ b/pkgs/development/tools/rojo/default.nix
@@ -12,17 +12,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "rojo";
-  version = "7.4.2";
+  version = "7.4.3";
 
   src = fetchFromGitHub {
     owner = "rojo-rbx";
     repo = "rojo";
     rev = "v${version}";
-    hash = "sha256-T4a54JiCGKfXvt80rCRZbS/zqV3gomzG0IwAQRxcQo8=";
+    hash = "sha256-oCG0dD1nVk5bpz3QID4kKjzGN6JH6iZXir/PzIrayaU=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-hXEz7u6dT2LRcQDYNjK4yxSHA1lxXZwNP98r0NT6mgA=";
+  cargoHash = "sha256-c+uPLZU9uGbaNjs5b6Us393QSJKdUub27ZqggQqgriU=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/trunk/default.nix b/pkgs/development/tools/trunk/default.nix
index bbb340b42a9a..17cf053b98f1 100644
--- a/pkgs/development/tools/trunk/default.nix
+++ b/pkgs/development/tools/trunk/default.nix
@@ -10,13 +10,13 @@ SystemConfiguration
 
 rustPlatform.buildRustPackage rec {
   pname = "trunk";
-  version = "0.20.2";
+  version = "0.20.3";
 
   src = fetchFromGitHub {
     owner = "trunk-rs";
     repo = "trunk";
     rev = "v${version}";
-    hash = "sha256-hyjv3UJWIfJjdGtju4T6ufhz97F76uib/B9kyBHsC64=";
+    hash = "sha256-3p3HllZu69e2ERLoEJwSWL0OXl23lxvIPHV9HK30CqM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   # requires network
   checkFlags = [ "--skip=tools::tests::download_and_install_binaries" ];
 
-  cargoHash = "sha256-BI/jA5/7/QP62EtOXXRkbsJILsHbVacZY/bKZGcXk34=";
+  cargoHash = "sha256-4b+ASz8uV17Y7gO50YKiu8Zhhq4sL+HJj1WAD7VkEE4=";
 
   meta = with lib; {
     homepage = "https://github.com/trunk-rs/trunk";
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index a1cb87816a12..80bab2a26cd0 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -62,11 +62,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "550.40.65";
+    version = "550.40.67";
     persistencedVersion = "550.54.14";
     settingsVersion = "550.54.14";
-    sha256_64bit = "sha256-du86GHMBxzUkrP+nDzModBdxH3d1TueLPH5KeYSNKYU=";
-    openSha256 = "sha256-REBOh5bW7vUXa0sIGWddahPd1SR3GwBN4nmpv+m4Tak=";
+    sha256_64bit = "sha256-c28Nq5jA6CMrDqu8szIHSrxNTlzNr7NRrYQLmL26Brg=";
+    openSha256 = "sha256-SdkHGIfyujPCZ908LVc96kkl7gX0ovWjUuB7Vc5HYag=";
     settingsSha256 = "sha256-m2rNASJp0i0Ez2OuqL+JpgEF0Yd8sYVCyrOoo/ln2a4=";
     persistencedSha256 = "sha256-XaPN8jVTjdag9frLPgBtqvO/goB5zxeGzaTU0CdL6C4=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 2d8d1c1c6842..29125f1d2979 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -183,5 +183,7 @@ with pkgs;
 
   systemd = callPackage ./systemd { };
 
+  replaceVars = recurseIntoAttrs (callPackage ./replace-vars { });
+
   substitute = recurseIntoAttrs (callPackage ./substitute { });
 }
diff --git a/pkgs/test/replace-vars/default.nix b/pkgs/test/replace-vars/default.nix
new file mode 100644
index 000000000000..76dc81de49c8
--- /dev/null
+++ b/pkgs/test/replace-vars/default.nix
@@ -0,0 +1,74 @@
+{
+  replaceVars,
+  emptyDirectory,
+  emptyFile,
+  runCommand,
+  testers,
+}:
+let
+  inherit (testers) testEqualContents testBuildFailure;
+in
+{
+  # Success case for `replaceVars`.
+  replaceVars = testEqualContents {
+    assertion = "replaceVars";
+    actual = replaceVars ./source.txt {
+      free = "free";
+      "equal in" = "are the same in";
+      brotherhood = "shared humanity";
+    };
+
+    expected = builtins.toFile "expected" ''
+      All human beings are born free and are the same in dignity and rights.
+      They are endowed with reason and conscience and should act towards
+      one another in a spirit of shared humanity.
+
+        -- eroosevelt@humanrights.un.org
+    '';
+  };
+
+  # There might eventually be a usecase for this, but it's not supported at the moment.
+  replaceVars-fails-on-directory =
+    runCommand "replaceVars-fails" { failed = testBuildFailure (replaceVars emptyDirectory { }); }
+      ''
+        grep -e "ERROR: file.*empty-directory.*does not exist" $failed/testBuildFailure.log
+        touch $out
+      '';
+
+  replaceVars-fails-in-build-phase =
+    runCommand "replaceVars-fails"
+      { failed = testBuildFailure (replaceVars emptyFile { not-found = "boo~"; }); }
+      ''
+        grep -e "ERROR: pattern @not-found@ doesn't match anything in file.*empty-file" $failed/testBuildFailure.log
+        touch $out
+      '';
+
+  replaceVars-fails-in-check-phase =
+    runCommand "replaceVars-fails"
+      {
+        failed =
+          let
+            src = builtins.toFile "source.txt" ''
+              Header.
+              before @whatIsThis@ middle @It'sOdd2Me@ after.
+              @cannot detect due to space@
+              Trailer.
+            '';
+          in
+          testBuildFailure (replaceVars src { });
+      }
+      ''
+        grep -e "unsubstituted Nix identifiers.*source.txt" $failed/testBuildFailure.log
+        grep -F "@whatIsThis@" $failed/testBuildFailure.log
+        grep -F "@It'sOdd2Me@" $failed/testBuildFailure.log
+        grep -F 'more precise `substitute` function' $failed/testBuildFailure.log
+
+        # Shouldn't see irrelevant details.
+        ! grep -q -E -e "Header|before|middle|after|Trailer" $failed/testBuildFailure.log
+
+        # Shouldn't see the "cannot detect" version.
+        ! grep -q -F "cannot detect due to space" $failed/testBuildFailure.log
+
+        touch $out
+      '';
+}
diff --git a/pkgs/test/replace-vars/source.txt b/pkgs/test/replace-vars/source.txt
new file mode 100644
index 000000000000..b3d293859e8b
--- /dev/null
+++ b/pkgs/test/replace-vars/source.txt
@@ -0,0 +1,5 @@
+All human beings are born @free@ and @equal in@ dignity and rights.
+They are endowed with reason and conscience and should act towards
+one another in a spirit of @brotherhood@.
+
+  -- eroosevelt@humanrights.un.org
diff --git a/pkgs/tools/security/fulcio/default.nix b/pkgs/tools/security/fulcio/default.nix
index 8967cc519a1c..0647a2cca923 100644
--- a/pkgs/tools/security/fulcio/default.nix
+++ b/pkgs/tools/security/fulcio/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dgaP2ELwbL7pQlFZpZorAEt0wLfdiOpduN0/rts15Ok=";
+    hash = "sha256-E8J+r16LMISUai8+/2rWvZX2bdzPDQ97fhMksjJwjBs=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -20,7 +20,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-d8ql6S8dVI0cBCh4F4ecqzJd8oAoJJrJmSuk2pFopNM=";
+  vendorHash = "sha256-mthspaFEY7ybwsfhWYK/27f4eFFQIT+gOqA66BMcANk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index f65553b39ce8..12bf3112227d 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "2.0.25";
+  version = "2.0.27";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+1MOGpk4nxYNtadjv88drubmHyEciiVWax7rdVWrjMY=";
+    sha256 = "sha256-Qp5f8c7ET74djXzZr2sZZy+4GUQwUPxSTtgQhoRJURg=";
   };
 
-  cargoHash = "sha256-+n+3BEZ84pYzjBLxW0YEz15RhgRqyakdamMA77Z+BeI=";
+  cargoHash = "sha256-ZvFKOlNagjH//WTPV/QeCOPvjLcimJ0v6YS0nXujhQA=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b1c3b6568c11..daf764881558 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1335,6 +1335,8 @@ with pkgs;
 
   replaceDependency = callPackage ../build-support/replace-dependency.nix { };
 
+  replaceVars = callPackage ../build-support/replace-vars { };
+
   nukeReferences = callPackage ../build-support/nuke-references {
     inherit (darwin) signingUtils;
   };
diff --git a/shell.nix b/shell.nix
index d9e94eb2816d..db447040db9d 100644
--- a/shell.nix
+++ b/shell.nix
@@ -17,14 +17,17 @@ let
 
   pkgs = import nixpkgs {
     inherit system;
-    config = {};
-    overlays = [];
+    config = { };
+    overlays = [ ];
   };
 in
 pkgs.mkShellNoCC {
-  packages = [
+  packages = with pkgs; [
     # The default formatter for Nix code
-    # https://github.com/NixOS/nixfmt
-    pkgs.nixfmt-rfc-style
+    # See https://github.com/NixOS/nixfmt
+    nixfmt-rfc-style
+    # Helper to review Nixpkgs PRs
+    # See CONTRIBUTING.md
+    nixpkgs-review
   ];
 }