diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 448ff107f858..d4d046d57c1f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7024,6 +7024,13 @@
     githubId = 2544204;
     name = "Erik Skytthe";
   };
+  esrh = {
+    name = "Eshan Ramesh";
+    email = "esrh@esrh.me";
+    github = "eshrh";
+    githubId = 16175276;
+    keys = [ { fingerprint = "E4CE B0F0 B2EC 09A3 9678  F294 CC7A 7E3C 6CF3 1343"; } ];
+  };
   ethancedwards8 = {
     email = "ethan@ethancedwards.com";
     github = "ethancedwards8";
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index 9f2359782dc9..84bda1f9346b 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -9,11 +9,11 @@
 
 buildMozillaMach rec {
   pname = "firefox-beta";
-  version = "133.0b9";
+  version = "135.0b3";
   applicationName = "Mozilla Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "2c950f04730666387a84b25cfe3afbd93b53988608345a062c8b538619e895c274049fe557a604e86f7ea5744ae2a50dc9c448a20664f0d7308949422a453ae9";
+    sha512 = "2d6f04b929257532ac3883f6c16f063718c66acaf0c131d1f449f4a0de947d061ca772a3388f02b9122649ba27474500db287a9b4b7a0cc53a1639805c7f3064";
   };
 
   meta = {
diff --git a/pkgs/tools/security/amber/default.nix b/pkgs/by-name/am/amber-secret/package.nix
similarity index 61%
rename from pkgs/tools/security/amber/default.nix
rename to pkgs/by-name/am/amber-secret/package.nix
index d95e21c954df..d4d60e9669b9 100644
--- a/pkgs/tools/security/amber/default.nix
+++ b/pkgs/by-name/am/amber-secret/package.nix
@@ -1,9 +1,9 @@
 {
   lib,
   stdenv,
-  rustPlatform,
+  darwin,
   fetchFromGitHub,
-  Security,
+  rustPlatform,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -15,18 +15,19 @@ rustPlatform.buildRustPackage rec {
     owner = "fpco";
     repo = "amber";
     rev = "v${version}";
-    sha256 = "sha256-nduSnDhLvHpZD7Y1zeZC4nNL7P1qfLWc0yMpsdqrKHM=";
+    hash = "sha256-nduSnDhLvHpZD7Y1zeZC4nNL7P1qfLWc0yMpsdqrKHM=";
   };
 
   cargoHash = "sha256-DxTsbJ51TUMvc/NvsUYhRG9OxxEGrWfEPYCOYaG9PXo=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
-  meta = with lib; {
+  meta = {
     description = "Manage secret values in-repo via public key cryptography";
     homepage = "https://github.com/fpco/amber";
-    license = licenses.mit;
-    maintainers = with maintainers; [ psibi ];
+    changelog = "https://github.com/fpco/amber/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ psibi ];
     mainProgram = "amber";
   };
 }
diff --git a/pkgs/tools/security/badchars/default.nix b/pkgs/by-name/ba/badchars/package.nix
similarity index 59%
rename from pkgs/tools/security/badchars/default.nix
rename to pkgs/by-name/ba/badchars/package.nix
index 849ac3208280..a127cdc3e473 100644
--- a/pkgs/tools/security/badchars/default.nix
+++ b/pkgs/by-name/ba/badchars/package.nix
@@ -1,33 +1,30 @@
 {
   lib,
-  buildPythonApplication,
-  fetchPypi,
+  fetchFromGitHub,
+  gitUpdater,
   python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "badchars";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-4neV1S5gwQ03kEXEyZezNSj+PVXJyA5MO4lyZzGKE/c=";
+  src = fetchFromGitHub {
+    owner = "cytopia";
+    repo = "badchars";
+    tag = version;
+    hash = "sha256-VWe3k34snEviBK7VBCDTWAu3YjZfh1gXHXjlnFlefJw=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail "argparse" ""
-  '';
-
-  build-system = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];
 
   # no tests are available and it can't be imported (it's only a script, not a module)
   doCheck = false;
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
     description = "HEX badchar generator for different programming languages";
     longDescription = ''
       A HEX bad char generator to instruct encoders such as shikata-ga-nai to
@@ -35,8 +32,8 @@ python3.pkgs.buildPythonApplication rec {
     '';
     homepage = "https://github.com/cytopia/badchars";
     changelog = "https://github.com/cytopia/badchars/releases/tag/${version}";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
     mainProgram = "badchars";
   };
 }
diff --git a/pkgs/by-name/co/cosmic-ext-ctl/package.nix b/pkgs/by-name/co/cosmic-ext-ctl/package.nix
new file mode 100644
index 000000000000..9812b7f88eff
--- /dev/null
+++ b/pkgs/by-name/co/cosmic-ext-ctl/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+  cosmic-comp,
+}:
+let
+  version = "1.1.0";
+in
+rustPlatform.buildRustPackage {
+  pname = "cosmic-ext-ctl";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "cosmic-utils";
+    repo = "cosmic-ctl";
+    tag = "v${version}";
+    hash = "sha256-dcUzrJcwJpzbYPuqdHgm43NYbaowsFmFP4sS0cfzNAg=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-EReo2hkBaIO1YOBx4D9rQSXlx+3NK5VQtj59jfZZI/0=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/cosmic-ctl";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI for COSMIC Desktop configuration management";
+    changelog = "https://github.com/cosmic-utils/cosmic-ctl/releases/tag/v${version}";
+    homepage = "https://github.com/cosmic-utils/cosmic-ctl";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ HeitorAugustoLN ];
+    mainProgram = "cosmic-ctl";
+    inherit (cosmic-comp.meta) platforms;
+  };
+}
diff --git a/pkgs/by-name/dn/dnscrypt-proxy/package.nix b/pkgs/by-name/dn/dnscrypt-proxy/package.nix
index 4d11703a59be..92d43baaa160 100644
--- a/pkgs/by-name/dn/dnscrypt-proxy/package.nix
+++ b/pkgs/by-name/dn/dnscrypt-proxy/package.nix
@@ -7,7 +7,7 @@
 
 buildGoModule rec {
   pname = "dnscrypt-proxy";
-  version = "2.1.5";
+  version = "2.1.7";
 
   vendorHash = null;
 
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "DNSCrypt";
     repo = "dnscrypt-proxy";
     rev = version;
-    sha256 = "sha256-A9Cu4wcJxrptd9CpgXw4eyMX2nmNAogYBRDeeAjpEZY=";
+    sha256 = "sha256-s0ooICual87+y/DMppuTQtNzZRRCg/42SQImDrPVRng=";
   };
 
   passthru.tests = { inherit (nixosTests) dnscrypt-proxy2; };
diff --git a/pkgs/by-name/ep/epson-escpr/package.nix b/pkgs/by-name/ep/epson-escpr/package.nix
index 5d6882fe04fb..a90a7f95e675 100644
--- a/pkgs/by-name/ep/epson-escpr/package.nix
+++ b/pkgs/by-name/ep/epson-escpr/package.nix
@@ -5,8 +5,6 @@
   cups,
   fetchpatch,
   dos2unix,
-  automake115x,
-  autoconf,
 }:
 
 let
@@ -29,17 +27,10 @@ stdenv.mkDerivation {
     ];
     sha256 = "sha256-hVbX4OXPe4y37Szju3uVdXlVdjX4DFSN/A2Emz3eCcQ=";
   };
-  # DOS Line Endings in /lib directory and UNIX Line endings in /src directory.
-  # So convert everything to UNIX style line endings.
-  # Since the files are modified, autoconf and automake is required
-  postUnpack = ''
-    dir=''${src%-*}
-    cd ''${dir#*-}
-    local f
-    for f in $(find ./ -type f || die); do
-      ${dos2unix}/bin/dos2unix $f
-    done
-    cd ..
+  # the patches above are expecting unix line endings, but one of the files
+  # being patched has dos line endings in the source tarball
+  prePatch = ''
+    ${dos2unix}/bin/dos2unix lib/epson-escpr-api.h
   '';
 
   patches = [
@@ -59,10 +50,6 @@ stdenv.mkDerivation {
     "-p1"
   ];
   buildInputs = [ cups ];
-  nativeBuildInputs = [
-    automake115x
-    autoconf
-  ];
 
   meta = with lib; {
     homepage = "http://download.ebz.epson.net/dsc/search/01/search/";
diff --git a/pkgs/by-name/er/erigon/package.nix b/pkgs/by-name/er/erigon/package.nix
index 810255b8c033..5fcc6673d107 100644
--- a/pkgs/by-name/er/erigon/package.nix
+++ b/pkgs/by-name/er/erigon/package.nix
@@ -7,7 +7,7 @@
 
 let
   pname = "erigon";
-  version = "2.60.10";
+  version = "2.61.0";
 in
 buildGoModule {
   inherit pname version;
@@ -16,11 +16,11 @@ buildGoModule {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-14s3Dfo1sqQlNZSdjByUCAsYzbv6xjPcCsBxEmoY3pU=";
+    hash = "sha256-B9FDGBx5ac1v0PqVK/2LhDH2seRthZxtaGu3G9flo0A=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-I4rdz8dswA9/w4S9BNS43VTD9iDsH+cNK2haWowhBO4=";
+  vendorHash = "sha256-bGVHIrICYWyHPgWWgEAIT+J/IIPjcWqTHeuqbT6lung=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:
diff --git a/pkgs/by-name/hy/hyprutils/package.nix b/pkgs/by-name/hy/hyprutils/package.nix
index bb6b9b0f7753..dec697da74fd 100644
--- a/pkgs/by-name/hy/hyprutils/package.nix
+++ b/pkgs/by-name/hy/hyprutils/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprutils";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprutils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7D5j2sh3Miw2CRdmx8ftepb342pl36kDFJy+3aVfDVc=";
+    hash = "sha256-1LimBKvDpBbeX+qW7T240WEyw+DBVpDotZB4JYm8Aps=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/i2/i2pd/package.nix b/pkgs/by-name/i2/i2pd/package.nix
index c24325c31ba1..643c4a86e17f 100644
--- a/pkgs/by-name/i2/i2pd/package.nix
+++ b/pkgs/by-name/i2/i2pd/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "i2pd";
-  version = "2.54.0";
+  version = "2.55.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "sha256-neoIDZNBBDq3tqz1ET3/CS/zb0Lret9niyuU7iWoNIE=";
+    sha256 = "sha256-mdjt2+h+IWjHBRDUpx85ku6s6gKHjxUBuhv+gJK7QhU=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/in/inori/package.nix b/pkgs/by-name/in/inori/package.nix
new file mode 100644
index 000000000000..b7d7d87bf482
--- /dev/null
+++ b/pkgs/by-name/in/inori/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "inori";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "eshrh";
+    repo = "inori";
+    tag = "v${version}";
+    hash = "sha256-yd1kIlPepVbeTEFzjxTDWEh8o4m6dh/ya9GitqYHHT8=";
+  };
+
+  cargoHash = "sha256-mmzJXIl0wfcyEaYc2wZfA22ZEbTQXG5LVqxEQ4+x76M=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Client for the Music Player Daemon (MPD)";
+    homepage = "https://github.com/eshrh/inori";
+    changelog = "https://github.com/eshrh/inori/releases/tag/${src.tag}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+    mainProgram = "inori";
+    maintainers = with lib.maintainers; [
+      stephen-huan
+      esrh
+    ];
+  };
+}
diff --git a/pkgs/by-name/la/lazygit/package.nix b/pkgs/by-name/la/lazygit/package.nix
index cfa21b9bcb91..3567a2607a25 100644
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@@ -8,13 +8,13 @@
 # Regression in go1.23 see https://github.com/jesseduffield/lazygit/issues/4002
 buildGo122Module rec {
   pname = "lazygit";
-  version = "0.44.1";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-BP5PMgRq8LHLuUYDrWaX1PgfT9VEhj3xeLE2aDMAPF0=";
+    hash = "sha256-hGJDsx0klccbueP7h5HtcYioFLL4gf3W3lbOHIA36FA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/mo/modelscan/package.nix b/pkgs/by-name/mo/modelscan/package.nix
index a71ca94e2592..a80b370a485f 100644
--- a/pkgs/by-name/mo/modelscan/package.nix
+++ b/pkgs/by-name/mo/modelscan/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "modelscan";
-  version = "0.8.1";
+  version = "0.8.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "protectai";
     repo = "modelscan";
     tag = "v${version}";
-    hash = "sha256-90VnIVQFjtKgLCHc+tmOtDdgJP8aaH4h5ZiOOejnXgQ=";
+    hash = "sha256-MhwXarjIHZgSC7G7+XevVyCflM/SiaNagJMhzLvs1Uc=";
   };
 
   build-system = with python3.pkgs; [
diff --git a/pkgs/by-name/ni/nix-fast-build/package.nix b/pkgs/by-name/ni/nix-fast-build/package.nix
index f610c1f3a9ac..2c4e485d8d4b 100644
--- a/pkgs/by-name/ni/nix-fast-build/package.nix
+++ b/pkgs/by-name/ni/nix-fast-build/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nix-fast-build";
-  version = "1.0.0";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nix-fast-build";
     rev = "refs/tags/${version}";
-    hash = "sha256-8zW6eWvE9T03cMpo/hY8RRZIsSCfs1zmsJOkEZzuYwM=";
+    hash = "sha256-HkaJeIFgxncLm8MC1BaWRTkge9b1/+mjPcbzXTRshoM=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/op/openasar/package.nix b/pkgs/by-name/op/openasar/package.nix
index d48baf764f83..f12a4c8c47ef 100644
--- a/pkgs/by-name/op/openasar/package.nix
+++ b/pkgs/by-name/op/openasar/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openasar";
-  version = "0-unstable-2024-11-13";
+  version = "0-unstable-2025-01-10";
 
   src = fetchFromGitHub {
     owner = "GooseMod";
     repo = "OpenAsar";
-    rev = "ef4470849624032a8eb7265eabd23158aa5a2356";
-    hash = "sha256-U9wYKen5MfE/WTKL0SICN0v3DPMLqblMYQVAbkZnfjY=";
+    rev = "4ed9e52d42501927b60354fcc456da50ed41cde2";
+    hash = "sha256-3b31iEmNUlBLc47Cw7EtMMgc+oPr1V6oqNTKRemXJfA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ow/owmods-gui/package.nix b/pkgs/by-name/ow/owmods-gui/package.nix
new file mode 100644
index 000000000000..28e477cbf2e8
--- /dev/null
+++ b/pkgs/by-name/ow/owmods-gui/package.nix
@@ -0,0 +1,122 @@
+{
+  lib,
+  libsoup_3,
+  dbus,
+  glib,
+  glib-networking,
+  librsvg,
+  webkitgtk_4_1,
+  pkg-config,
+  wrapGAppsHook3,
+  makeDesktopItem,
+  copyDesktopItems,
+  rustPlatform,
+  buildNpmPackage,
+  fetchFromGitHub,
+  mono,
+  wrapWithMono ? true,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "owmods-gui";
+  version = "0.15.0";
+
+  src = fetchFromGitHub {
+    owner = "ow-mods";
+    repo = "ow-mod-man";
+    tag = "gui_v${version}";
+    hash = "sha256-rTANG+yHE8YfWYUyELoKgj4El+1ZW6vI9NkgADD40pw=";
+  };
+
+  cargoHash = "sha256-rFkh2G7kFuQI7nlZIwaqvt7x9bKLqmWU21YwZu2+wUA=";
+
+  buildFeatures = [
+    "tauri/custom-protocol"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    copyDesktopItems
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    dbus
+    libsoup_3
+    glib
+    librsvg
+    glib-networking
+    webkitgtk_4_1
+  ];
+
+  buildAndTestSubdir = "owmods_gui/backend";
+
+  preFixup = lib.optionalString wrapWithMono "gappsWrapperArgs+=(--prefix PATH : '${mono}/bin')";
+
+  postPatch =
+    let
+      frontend = buildNpmPackage {
+        inherit version;
+
+        env.VITE_VERSION_SUFFIX = "-nix";
+
+        pname = "owmods-gui-ui";
+        src = "${src}/owmods_gui/frontend";
+
+        packageJSON = "${src}/owmods_gui/frontend/package.json";
+        npmDepsHash = "sha256-h6e+hQzd52G3XtufioEYlBuXNu6I+ZTQcNgJaQdaAck=";
+
+        postBuild = ''
+          cp -r ../dist/ $out
+        '';
+        distPhase = "true";
+        dontInstall = true;
+        installInPlace = true;
+        distDir = "../dist";
+
+        meta = {
+          description = "Web frontend for the Outer Wilds Mod Manager";
+          homepage = "https://github.com/ow-mods/ow-mod-man/tree/main/owmods_gui/frontend";
+          license = lib.licenses.gpl3Plus;
+        };
+      };
+    in
+    ''
+      substituteInPlace owmods_gui/backend/tauri.conf.json \
+        --replace-fail '"frontendDist": "../dist"' '"frontendDist": "${frontend}"'
+    '';
+
+  postInstall = ''
+    install -DT owmods_gui/backend/icons/128x128@2x.png $out/share/icons/hicolor/256x256@2/apps/outer-wilds-mod-manager.png
+    install -DT owmods_gui/backend/icons/128x128.png $out/share/icons/hicolor/128x128/apps/outer-wilds-mod-manager.png
+    install -DT owmods_gui/backend/icons/32x32.png $out/share/icons/hicolor/32x32/apps/outer-wilds-mod-manager.png
+
+    mv $out/bin/owmods_gui $out/bin/outer-wilds-mod-manager
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "outer-wilds-mod-manager";
+      exec = "outer-wilds-mod-manager %u";
+      icon = "outer-wilds-mod-manager";
+      desktopName = "Outer Wilds Mod Manager";
+      categories = [ "Game" ];
+      comment = "Manage Outer Wilds Mods";
+      mimeTypes = [ "x-scheme-handler/owmods" ];
+    })
+  ];
+
+  meta = {
+    description = "GUI version of the mod manager for Outer Wilds Mod Loader";
+    homepage = "https://github.com/ow-mods/ow-mod-man/tree/main/owmods_gui";
+    downloadPage = "https://github.com/ow-mods/ow-mod-man/releases/tag/gui_v${version}";
+    changelog = "https://github.com/ow-mods/ow-mod-man/releases/tag/gui_v${version}";
+    mainProgram = "outer-wilds-mod-manager";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      bwc9876
+      locochoco
+      spoonbaker
+    ];
+  };
+}
diff --git a/pkgs/by-name/ra/rar2hashcat/darwin-support.patch b/pkgs/by-name/ra/rar2hashcat/darwin-support.patch
new file mode 100644
index 000000000000..26979c2eb3fa
--- /dev/null
+++ b/pkgs/by-name/ra/rar2hashcat/darwin-support.patch
@@ -0,0 +1,24 @@
+diff --git a/Makefile b/Makefile
+index eca86a9..f11931b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,5 +1,5 @@
+ # Common variables
+-CFLAGS = -g -static -O2 -D_GNU_SOURCE -DARCH_LITTLE_ENDIAN=1
++CFLAGS = -g -O2 -D_GNU_SOURCE -DARCH_LITTLE_ENDIAN=1
+ TARGET = rar2hashcat
+ 
+ # Variables for Linux target
+diff --git a/base64_convert.c b/base64_convert.c
+index 0d2635d..b101e3c 100644
+--- a/base64_convert.c
++++ b/base64_convert.c
+@@ -163,7 +163,7 @@ static char *strnzcpy(char *dst, const char *src, int size)
+ 	return dst;
+ }
+ 
+-#ifdef __linux__
++#if defined(__linux__) || defined(__APPLE__)
+ static char *strupr(char *s)
+ {
+ 	unsigned char *ptr = (unsigned char *)s;
diff --git a/pkgs/by-name/ra/rar2hashcat/package.nix b/pkgs/by-name/ra/rar2hashcat/package.nix
new file mode 100644
index 000000000000..fe0d5733e920
--- /dev/null
+++ b/pkgs/by-name/ra/rar2hashcat/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rar2hashcat";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "hashstation";
+    repo = "rar2hashcat";
+    rev = finalAttrs.version;
+    hash = "sha256-GVh4Gyjn84xAwO7wKXYe2DPnpb8gnxGIMH5Szce+XpY=";
+  };
+
+  patches = [
+    ./darwin-support.patch
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=implicit-function-declaration -Wno-error=int-conversion";
+
+  makeFlags = [
+    "CC_LINUX=${stdenv.cc.targetPrefix}cc"
+    "rar2hashcat"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D rar2hashcat $out/bin/rar2hashcat
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/hashstation/rar2hashcat/releases/tag/${finalAttrs.version}";
+    description = "Processes input RAR files into a format suitable for use with hashcat";
+    homepage = "https://github.com/hashstation/rar2hashcat";
+    license = lib.licenses.mit;
+    mainProgram = "rar2hashcat";
+    maintainers = with lib.maintainers; [ emilytrau ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ti/tideways-cli/package.nix b/pkgs/by-name/ti/tideways-cli/package.nix
index 44a64a6ec318..074a12d49d00 100644
--- a/pkgs/by-name/ti/tideways-cli/package.nix
+++ b/pkgs/by-name/ti/tideways-cli/package.nix
@@ -11,7 +11,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-cli";
-  version = "1.2.2";
+  version = "1.2.4";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -38,19 +38,19 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/cli/${finalAttrs.version}/tideways-cli_linux_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-g06PE464P/A0PDGG7xMa644ztcIRMAU/ueee2IOhiHc=";
+        hash = "sha256-PoZHmr4kq6A6aTVlo9kbjnRSkLBJ9q/GneHGWoEvraQ=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/cli/${finalAttrs.version}/tideways-cli_linux_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-nbC9vMXA5vHKxEpINDQJTUqh7YOe0T0x5MbbQg03gk4=";
+        hash = "sha256-8r3s9izpi8fR+lSDQ6ZAxGWK2XQxrtp7WgRykRC+pD4=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/cli/${finalAttrs.version}/tideways-cli_macos_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-RfCTl61r/zfWy/3W+zmrSaAjIWe52POfZnzsmm5loD4=";
+        hash = "sha256-D40PF6zgf79NO1K35koZ2gpUeJllF9CpW9DoCQ1uJIU=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/cli/${finalAttrs.version}/tideways-cli_macos_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-4N4hUvbf8b9BnKUY4YTsB76Z35DmSTyWv6BC+bqJNCI=";
+        hash = "sha256-QGkRu0IRUpydLIy0DgtRhLiH0mLZ0UTRCJo1WZeICQQ=";
       };
     };
 
diff --git a/pkgs/by-name/ts/tsocks/package.nix b/pkgs/by-name/ts/tsocks/package.nix
index 2619380fdafb..03faca1336f4 100644
--- a/pkgs/by-name/ts/tsocks/package.nix
+++ b/pkgs/by-name/ts/tsocks/package.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     sed -i -e "s,\\\/usr,"$(echo $out|sed -e "s,\\/,\\\\\\\/,g")",g" tsocks
+    substituteInPlace configure \
+      --replace-fail "main(){return(0);}" "int main(){return(0);}"
     substituteInPlace tsocks --replace /usr $out
   '';
 
diff --git a/pkgs/by-name/xc/xc/example.md b/pkgs/by-name/xc/xc/example.md
new file mode 100644
index 000000000000..1d7bf507bd85
--- /dev/null
+++ b/pkgs/by-name/xc/xc/example.md
@@ -0,0 +1,9 @@
+# Tasks
+
+## example
+
+Tests if xc works
+
+```sh
+touch ./test
+```
diff --git a/pkgs/by-name/xc/xc/package.nix b/pkgs/by-name/xc/xc/package.nix
index 95ee1c8f1e3a..e369418dc05f 100644
--- a/pkgs/by-name/xc/xc/package.nix
+++ b/pkgs/by-name/xc/xc/package.nix
@@ -2,17 +2,19 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  gitUpdater,
+  versionCheckHook,
 }:
 
 buildGoModule rec {
   pname = "xc";
-  version = "0.8.0";
+  version = "0.8.5";
 
   src = fetchFromGitHub {
     owner = "joerdav";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-vTyCS85xbJnAgbasWD6LFxij9EezzlJ1pyvCJptqmOU=";
+    tag = "v${version}";
+    sha256 = "sha256-eaFHK7VsfLSgSJehv4urxq8qMPT+zzs2tRypz4q+MLc=";
   };
 
   vendorHash = "sha256-EbIuktQ2rExa2DawyCamTrKRC1yXXMleRB8/pcKFY5c=";
@@ -23,13 +25,26 @@ buildGoModule rec {
     "-X=main.version=${version}"
   ];
 
-  meta = with lib; {
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  postInstallCheck = ''
+    cp ${./example.md} example.md
+    $out/bin/xc -file ./example.md example
+    if ! [[ -f test ]] then
+      echo "example.md didn't do anything" >&2
+      return 1
+    fi
+  '';
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
     description = "Markdown defined task runner";
     mainProgram = "xc";
     homepage = "https://xcfile.dev/";
-    changelog = "https://github.com/joerdav/xc/releases/tag/${src.rev}";
-    license = licenses.mit;
-    maintainers = with maintainers; [
+    changelog = "https://github.com/joerdav/xc/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
       figsoda
       joerdav
     ];
diff --git a/pkgs/desktops/lomiri/applications/lomiri-system-settings/default.nix b/pkgs/desktops/lomiri/applications/lomiri-system-settings/default.nix
index 7b29df587707..515561bb8bb1 100644
--- a/pkgs/desktops/lomiri/applications/lomiri-system-settings/default.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri-system-settings/default.nix
@@ -48,13 +48,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-system-settings-unwrapped";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-system-settings";
     rev = finalAttrs.version;
-    hash = "sha256-dWaXPr9Z5jz5SbwLSd3jVqjK0E5BdcKVeF15p8j47uM=";
+    hash = "sha256-8X5a2zJ0y8bSSnbqDvRoYm/2VPAWcfZZuiH+5p8eXi4=";
   };
 
   outputs = [
diff --git a/pkgs/desktops/lomiri/qml/lomiri-settings-components/default.nix b/pkgs/desktops/lomiri/qml/lomiri-settings-components/default.nix
index 4f1ee61b2623..0ce25119ef6a 100644
--- a/pkgs/desktops/lomiri/qml/lomiri-settings-components/default.nix
+++ b/pkgs/desktops/lomiri/qml/lomiri-settings-components/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-settings-components";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-settings-components";
     rev = finalAttrs.version;
-    hash = "sha256-2Wyh+2AW6EeKRv26D4l+GIoH5sWC9SmOODNHOveFZPg=";
+    hash = "sha256-H7G3dzzitdyahB/MwgtfRBpo+qMOhmQSzN4EGYculks=";
   };
 
   postPatch =
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index 08acdfba4eb3..ca0248f8210d 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.16.0";
+  version = "3.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "aiogram";
     repo = "aiogram";
     tag = "v${version}";
-    hash = "sha256-0kvGEispsDpeTM1NXYb9HylskDONHP48NBn+JyBhSJ4=";
+    hash = "sha256-47PWd1geTALgO7MDglHqaoMmZ+u1BnKSlj6Jxj7fkBQ=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/amaranth/default.nix b/pkgs/development/python-modules/amaranth/default.nix
index c4effc294787..096505a690d3 100644
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@@ -20,8 +20,9 @@
 
 buildPythonPackage rec {
   pname = "amaranth";
-  format = "pyproject";
   version = "0.5.4";
+  pyproject = true;
+
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
@@ -33,12 +34,11 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail \
-        "pdm-backend~=2.3.0" \
-        "pdm-backend>=2.3.0"
+      --replace-fail "pdm-backend~=2.3.0" "pdm-backend>=2.3.0"
   '';
 
   nativeBuildInputs = [ git ];
+
   build-system = [ pdm-backend ];
 
   dependencies =
@@ -59,14 +59,28 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "amaranth" ];
 
+  disabledTests = [
+    "verilog"
+    "test_reversible"
+    "test_distance"
+  ];
+
+  disabledTestPaths = [
+    # Subprocesses
+    "tests/test_examples.py"
+    # Verification failures
+    "tests/test_lib_fifo.py"
+  ];
+
   meta = with lib; {
     description = "Modern hardware definition language and toolchain based on Python";
-    mainProgram = "amaranth-rpc";
     homepage = "https://amaranth-lang.org/docs/amaranth";
+    changelog = "https://github.com/amaranth-lang/amaranth/blob/v${version}/docs/changes.rst";
     license = licenses.bsd2;
     maintainers = with maintainers; [
       thoughtpolice
       pbsds
     ];
+    mainProgram = "amaranth-rpc";
   };
 }
diff --git a/pkgs/development/python-modules/awswrangler/default.nix b/pkgs/development/python-modules/awswrangler/default.nix
index ddbcc8213dfb..b34170f60747 100644
--- a/pkgs/development/python-modules/awswrangler/default.nix
+++ b/pkgs/development/python-modules/awswrangler/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "awswrangler";
-  version = "3.10.1";
+  version = "3.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "aws-sdk-pandas";
     tag = version;
-    hash = "sha256-JR1gO24biFluwqZAIQMFGjjbn9VBxTlAS8i76N82onc=";
+    hash = "sha256-dIdNrfhBrfrzXmspw25yd/y6MbXRrLfDveCQk+AERV0=";
   };
 
   pythonRelaxDeps = [ "packaging" ];
diff --git a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
index a4052e739880..97a4b3ad0815 100644
--- a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
@@ -1,38 +1,46 @@
 {
   lib,
-  buildPythonPackage,
-  fetchPypi,
   azure-common,
   azure-mgmt-core,
-  msrestazure,
+  buildPythonPackage,
+  fetchPypi,
+  isodate,
   pythonOlder,
+  setuptools,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cognitiveservices";
-  version = "13.5.0";
-  format = "setuptools";
+  version = "13.6.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
-    inherit pname version;
-    extension = "zip";
-    hash = "sha256-RK8LGbH4J+nN6gnGBUweZgkqUcMrwe9aVtvZtAvFeBU=";
+    pname = "azure_mgmt_cognitiveservices";
+    inherit version;
+    hash = "sha256-YS5W956CT4HVkM/wwJJTNYraBl1aYWnBOQX8NQZNm0A=";
   };
 
-  propagatedBuildInputs = [
-    msrestazure
+  build-system = [ setuptools ];
+
+  dependencies = [
     azure-common
     azure-mgmt-core
+    isodate
+    typing-extensions
   ];
 
   # Module has no tests
   doCheck = false;
 
+  pythonImportsCheck = [ "azure.mgmt.cognitiveservices" ];
+
   meta = with lib; {
     description = "This is the Microsoft Azure Cognitive Services Management Client Library";
-    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    homepage = "https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/cognitiveservices/azure-mgmt-cognitiveservices";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-cognitiveservices_${version}/sdk/cognitiveservices/azure-mgmt-cognitiveservices/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ maxwilson ];
   };
diff --git a/pkgs/development/python-modules/busylight-for-humans/default.nix b/pkgs/development/python-modules/busylight-for-humans/default.nix
index e4e9fd2337fc..bbc5d3ac2bbe 100644
--- a/pkgs/development/python-modules/busylight-for-humans/default.nix
+++ b/pkgs/development/python-modules/busylight-for-humans/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "busylight-for-humans";
-  version = "0.33.0";
+  version = "0.33.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "JnyJny";
     repo = "busylight";
     tag = version;
-    hash = "sha256-gwhN8aFwxRdA6fPuCDVdBJ8yl8Zq6DAfSRW88Yk7IUk=";
+    hash = "sha256-66XJumC++/Wa6hY/A3m6IR2ALCH4vLSut9ERW8msLY4=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/construct-typing/default.nix b/pkgs/development/python-modules/construct-typing/default.nix
index 2d5ecf5dde58..7253c51d6978 100644
--- a/pkgs/development/python-modules/construct-typing/default.nix
+++ b/pkgs/development/python-modules/construct-typing/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
+  pythonAtLeast,
   construct,
   typing-extensions,
   arrow,
@@ -46,11 +47,17 @@ buildPythonPackage rec {
     ruamel-yaml
   ];
 
-  disabledTests = [
-    # tests fail with construct>=2.10.70
-    "test_bitsinteger"
-    "test_bytesinteger"
-  ];
+  disabledTests =
+    [
+      # tests fail with construct>=2.10.70
+      "test_bitsinteger"
+      "test_bytesinteger"
+    ]
+    ++ lib.optionals (pythonAtLeast "3.13") [
+      # https://github.com/timrid/construct-typing/issues/31
+      "test_tenum_docstring"
+      "test_tenum_flags_docstring"
+    ];
 
   meta = {
     changelog = "https://github.com/timrid/construct-typing/releases/tag/v${version}";
diff --git a/pkgs/development/python-modules/elementpath/default.nix b/pkgs/development/python-modules/elementpath/default.nix
index 702c8cd453f3..e2e1d2a0342b 100644
--- a/pkgs/development/python-modules/elementpath/default.nix
+++ b/pkgs/development/python-modules/elementpath/default.nix
@@ -8,16 +8,16 @@
 
 buildPythonPackage rec {
   pname = "elementpath";
-  version = "4.5.0";
+  version = "4.6.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "sissaschool";
     repo = "elementpath";
     tag = "v${version}";
-    hash = "sha256-zyJ+UtPTGEziIlucIXN1dIzfN5sfLkeOia7tiqOGFjk=";
+    hash = "sha256-lFUrY3LOSc2OROkzotGSW9N3h9dJA4EnCvLNU41BPA0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/energyflow/default.nix b/pkgs/development/python-modules/energyflow/default.nix
index 6972331e0784..cf2850757686 100644
--- a/pkgs/development/python-modules/energyflow/default.nix
+++ b/pkgs/development/python-modules/energyflow/default.nix
@@ -3,41 +3,69 @@
   buildPythonPackage,
   fetchFromGitHub,
   h5py,
+  hatch-vcs,
+  hatchling,
+  igraph,
   numpy,
-  six,
-  wasserstein,
+  pot,
   pytestCheckHook,
+  pythonOlder,
+  scikit-learn,
+  tensorflow,
+  tf-keras,
+  wasserstein,
 }:
 
 buildPythonPackage rec {
   pname = "energyflow";
-  version = "1.3.3";
+  version = "1.4.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "pkomiske";
     repo = "EnergyFlow";
     tag = "v${version}";
-    hash = "sha256-Ioyk0IpyxcDdL2+3zkUa6yydavyphoh4do7GCz5nG60=";
+    hash = "sha256-4RzhpeOOty8IaVGByHD+PyeaeWgR7ZF98mSCJYoM9wY=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "setup_requires=" "" \
-      --replace "pytest-runner" ""
-  '';
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     h5py
     numpy
-    six
     wasserstein
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  pytestFlagsArray = [ "energyflow/tests" ];
-  disabledTestPaths = [
-    "energyflow/tests/test_archs.py" # requires tensorflow
-    "energyflow/tests/test_emd.py" # requires "ot"
+  optional-dependencies = {
+    all = [
+      igraph
+      scikit-learn
+      tensorflow
+    ];
+    archs = [
+      scikit-learn
+      tensorflow
+    ];
+    generation = [ igraph ];
+  };
+
+  nativeCheckInputs = [
+    pot
+    pytestCheckHook
+    tf-keras
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
+
+  disabledTests = [
+    # Issues with array
+    "test_emd_equivalence"
+    "test_gdim"
+    "test_n_jobs"
+    "test_periodic_phi"
   ];
 
   pythonImportsCheck = [ "energyflow" ];
@@ -45,6 +73,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python package for the EnergyFlow suite of tools";
     homepage = "https://energyflow.network/";
+    changelog = "https://github.com/thaler-lab/EnergyFlow/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ veprbl ];
   };
diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index 50698a923abb..617ecdb8d7f9 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -2,11 +2,11 @@
   lib,
   aiohttp,
   buildPythonPackage,
-  defusedxml,
   fetchFromGitHub,
   geopy,
   imageio,
   lxml,
+  numpy,
   pandas,
   pillow,
   pytestCheckHook,
@@ -18,26 +18,26 @@
 
 buildPythonPackage rec {
   pname = "env-canada";
-  version = "0.7.2";
+  version = "0.8.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
     tag = "v${version}";
-    hash = "sha256-3SVpzWii9/ViJ7mbrqzKmN5FkOOYTeYdhJll6q/IseU=";
+    hash = "sha256-4PztYdQmMH2n3dlV8arJ2UFGp08nkIK80L460UdNhV8=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
     aiohttp
-    defusedxml
     geopy
     imageio
     lxml
+    numpy
     pandas
     pillow
     python-dateutil
@@ -57,6 +57,7 @@ buildPythonPackage rec {
     "test_get_loop"
     "test_get_ec_sites"
     "test_ecradar"
+    "test_historical_number_values"
   ];
 
   pythonImportsCheck = [ "env_canada" ];
diff --git a/pkgs/development/python-modules/environs/default.nix b/pkgs/development/python-modules/environs/default.nix
index e6697813e4f0..c6e377e7be99 100644
--- a/pkgs/development/python-modules/environs/default.nix
+++ b/pkgs/development/python-modules/environs/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "environs";
-  version = "14.0.0";
+  version = "14.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "sloria";
     repo = "environs";
     tag = version;
-    hash = "sha256-sqEe0DoJHUtHFin04+lNQKuXjvSmDmfwjQIvU6a4sDo=";
+    hash = "sha256-OmZn6ngujcPuws+idRtzwIt+9XLfRge7IFby+yCiQNM=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/equinox/default.nix b/pkgs/development/python-modules/equinox/default.nix
index faa86adc4466..7c48e8a67835 100644
--- a/pkgs/development/python-modules/equinox/default.nix
+++ b/pkgs/development/python-modules/equinox/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -47,6 +48,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    # SystemError: nanobind::detail::nb_func_error_except(): exception could not be translated!
+    "test_filter"
+  ];
+
   pythonImportsCheck = [ "equinox" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/ml-dtypes/default.nix b/pkgs/development/python-modules/ml-dtypes/default.nix
index 83100c471fd9..dc262a0cdac3 100644
--- a/pkgs/development/python-modules/ml-dtypes/default.nix
+++ b/pkgs/development/python-modules/ml-dtypes/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch2,
 
   # build-system
   setuptools,
@@ -17,31 +16,23 @@
 
 buildPythonPackage rec {
   pname = "ml-dtypes";
-  version = "0.5.0";
+  version = "0.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jax-ml";
     repo = "ml_dtypes";
     tag = "v${version}";
-    hash = "sha256-+6job9fEHVguh9JBE/NUv+QezwQohuKPO8DlhbaawZ4=";
+    hash = "sha256-XRvqyWyi5smaLh5ese5QY2aIOkVliXGc7ngwT5CRsmc=";
     # Since this upstream patch (https://github.com/jax-ml/ml_dtypes/commit/1bfd097e794413b0d465fa34f2eff0f3828ff521),
     # the attempts to use the nixpkgs packaged eigen dependency have failed.
     # Hence, we rely on the bundled eigen library.
     fetchSubmodules = true;
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "numpy2-compat.patch";
-      url = "https://github.com/jax-ml/ml_dtypes/commit/204df1147fd568f65890d958b6cdfa4dc55a226c.patch";
-      hash = "sha256-IPHE6bQTbM0Ky5X6FDwwD/1eXL+kcA/D8pDGihAiJrQ=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools~=73.0.1" "setuptools"
+      --replace-fail "setuptools~=75.7.0" "setuptools"
   '';
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyroute2/default.nix b/pkgs/development/python-modules/pyroute2/default.nix
index 61bbf1913150..f81db36e95d9 100644
--- a/pkgs/development/python-modules/pyroute2/default.nix
+++ b/pkgs/development/python-modules/pyroute2/default.nix
@@ -2,28 +2,25 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  importlib-metadata,
   pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pyroute2";
-  version = "0.7.12";
+  version = "0.8.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "svinota";
     repo = "pyroute2";
     tag = version;
-    hash = "sha256-zB792ZwDWd74YBYvQ5au0t2RWTIAqrWvNtQ/e+ZEk50=";
+    hash = "sha256-eItzD9ub8COaOkNLEKLtf8uJil4W4rqjzVa95LJahHw=";
   };
 
-  nativeBuildInputs = [ setuptools ];
-
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+  build-system = [ setuptools ];
 
   # Requires root privileges, https://github.com/svinota/pyroute2/issues/778
   doCheck = false;
diff --git a/pkgs/development/python-modules/result/default.nix b/pkgs/development/python-modules/result/default.nix
index db123e031067..cd4793401976 100644
--- a/pkgs/development/python-modules/result/default.nix
+++ b/pkgs/development/python-modules/result/default.nix
@@ -2,21 +2,19 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pytestCheckHook,
   pytest-asyncio,
-  nix-update-script,
+  pytest-cov-stub,
+  pytestCheckHook,
+  pythonOlder,
   setuptools,
-  wheel,
 }:
 
 buildPythonPackage rec {
   pname = "result";
   version = "0.17.0";
   pyproject = true;
-  build-system = [
-    setuptools
-    wheel
-  ];
+
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "rustedpy";
@@ -25,27 +23,20 @@ buildPythonPackage rec {
     hash = "sha256-o+7qKxGQCeMUnsmEReggvf+XwQWFHRCYArYk3DxCa50=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace '"--flake8",' "" \
-      --replace '"--tb=short",' "" \
-      --replace '"--cov=result",' "" \
-      --replace '"--cov=tests",' "" \
-      --replace '"--cov-report=term",' "" \
-      --replace '"--cov-report=xml",' ""
-  '';
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
   ];
 
-  passthru.updateScript = nix-update-script { };
   pythonImportsCheck = [ "result" ];
 
   meta = with lib; {
-    description = "A simple Result type for Python 3 inspired by Rust, fully type annotated";
+    description = "A Rust-like result type for Python";
     homepage = "https://github.com/rustedpy/result";
+    changelog = "https://github.com/rustedpy/result/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with lib.maintainers; [ emattiza ];
   };
diff --git a/pkgs/development/python-modules/scikit-hep-testdata/default.nix b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
index 75537af44715..ad27cd906f28 100644
--- a/pkgs/development/python-modules/scikit-hep-testdata/default.nix
+++ b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-hep-testdata";
-  version = "0.5.0";
+  version = "0.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-hep";
     repo = "scikit-hep-testdata";
     tag = "v${version}";
-    hash = "sha256-FIv3yC5Q3H1RXl0n32YH1UqaZiMuWHNcMPTSKLN+IkA=";
+    hash = "sha256-yG9ZeBKB0NcTZ8zU0iJTSwDvaafD+2FzkDk2dVYSJO8=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/teslemetry-stream/default.nix b/pkgs/development/python-modules/teslemetry-stream/default.nix
index 1154f0380442..f1c21d63c07f 100644
--- a/pkgs/development/python-modules/teslemetry-stream/default.nix
+++ b/pkgs/development/python-modules/teslemetry-stream/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "teslemetry-stream";
-  version = "0.4.2";
+  version = "0.6.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Teslemetry";
     repo = "python-teslemetry-stream";
     rev = "v${version}";
-    hash = "sha256-Ny68yiM0LS2U7zy6K2R35ZLm+Jo4s+HIFJjuqgL49E0=";
+    hash = "sha256-hKGYZYRfI4FikTPsf7Wy0gOA+dCiMdlpWtEb/Gn1y7s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/twentemilieu/default.nix b/pkgs/development/python-modules/twentemilieu/default.nix
index f91d96c0658e..4f0c5322a73f 100644
--- a/pkgs/development/python-modules/twentemilieu/default.nix
+++ b/pkgs/development/python-modules/twentemilieu/default.nix
@@ -1,14 +1,15 @@
 {
   lib,
-  buildPythonPackage,
-  pythonOlder,
-  fetchFromGitHub,
   aiohttp,
-  yarl,
   aresponses,
+  buildPythonPackage,
+  fetchFromGitHub,
   poetry-core,
   pytest-asyncio,
+  pytest-cov-stub,
   pytestCheckHook,
+  pythonOlder,
+  yarl,
 }:
 
 buildPythonPackage rec {
@@ -26,8 +27,8 @@ buildPythonPackage rec {
   };
 
   postPatch = ''
+    # Upstream is creating GitHub releases without version
     substituteInPlace pyproject.toml \
-      --replace "--cov" "" \
       --replace '"0.0.0"' '"${version}"'
   '';
 
@@ -41,6 +42,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
+    pytest-cov-stub
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/weconnect-mqtt/default.nix b/pkgs/development/python-modules/weconnect-mqtt/default.nix
index 910009e6a233..19a2cd2fb32b 100644
--- a/pkgs/development/python-modules/weconnect-mqtt/default.nix
+++ b/pkgs/development/python-modules/weconnect-mqtt/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   paho-mqtt_2,
+  pytest-cov-stub,
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
@@ -30,8 +31,7 @@ buildPythonPackage rec {
     substituteInPlace requirements.txt \
       --replace-fail "weconnect[Images]~=" "weconnect>="
     substituteInPlace pytest.ini \
-      --replace-fail "--cov=weconnect_mqtt --cov-config=.coveragerc --cov-report html" "" \
-      --replace-fail "pytest-cov" ""
+      --replace-fail "required_plugins = pytest-cov" ""
   '';
 
   pythonRelaxDeps = [ "python-dateutil" ];
@@ -44,7 +44,10 @@ buildPythonPackage rec {
     weconnect
   ] ++ weconnect.optional-dependencies.Images;
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "weconnect_mqtt" ];
 
@@ -52,7 +55,7 @@ buildPythonPackage rec {
     description = "Python client that publishes data from Volkswagen WeConnect";
     homepage = "https://github.com/tillsteinbach/WeConnect-mqtt";
     changelog = "https://github.com/tillsteinbach/WeConnect-mqtt/releases/tag/v${version}";
-    license = with lib.licenses; [ mit ];
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "weconnect-mqtt";
   };
diff --git a/pkgs/development/python-modules/weconnect/default.nix b/pkgs/development/python-modules/weconnect/default.nix
index ea09e36a8647..c4d08efb46d7 100644
--- a/pkgs/development/python-modules/weconnect/default.nix
+++ b/pkgs/development/python-modules/weconnect/default.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   oauthlib,
   pillow,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   requests,
@@ -32,13 +33,12 @@ buildPythonPackage rec {
       --replace-fail "setup_requires=SETUP_REQUIRED" "setup_requires=[]" \
       --replace-fail "tests_require=TEST_REQUIRED" "tests_require=[]"
     substituteInPlace pytest.ini \
-      --replace-fail "--cov=weconnect --cov-config=.coveragerc --cov-report html" "" \
       --replace-fail "required_plugins = pytest-cov" ""
   '';
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     oauthlib
     requests
   ];
@@ -50,7 +50,10 @@ buildPythonPackage rec {
     ];
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "weconnect" ];
 
@@ -58,7 +61,7 @@ buildPythonPackage rec {
     description = "Python client for the Volkswagen WeConnect Services";
     homepage = "https://github.com/tillsteinbach/WeConnect-python";
     changelog = "https://github.com/tillsteinbach/WeConnect-python/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/withings-api/default.nix b/pkgs/development/python-modules/withings-api/default.nix
index 8f35b3798f7e..9c589fd060e8 100644
--- a/pkgs/development/python-modules/withings-api/default.nix
+++ b/pkgs/development/python-modules/withings-api/default.nix
@@ -1,21 +1,22 @@
 {
   lib,
+  arrow,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
   poetry-core,
-  arrow,
-  requests-oauthlib,
-  typing-extensions,
   pydantic,
-  responses,
+  pytest-cov-stub,
   pytestCheckHook,
+  pythonOlder,
+  requests-oauthlib,
+  responses,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "withings-api";
   version = "2.4.0";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -28,13 +29,12 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'requests-oauth = ">=0.4.1"' ''' \
-      --replace 'addopts = "--capture no --cov ./withings_api --cov-report html:build/coverage_report --cov-report term --cov-report xml:build/coverage.xml"' '''
+      --replace-fail 'requests-oauth = ">=0.4.1"' '''
   '';
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     arrow
     requests-oauthlib
     typing-extensions
@@ -42,13 +42,17 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    pytest-cov-stub
     pytestCheckHook
     responses
   ];
 
+  pythonImportsCheck = [ "withings_api" ];
+
   meta = with lib; {
     description = "Library for the Withings Health API";
     homepage = "https://github.com/vangorra/python_withings_api";
+    changelog = "https://github.com/vangorra/python_withings_api/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ kittywitch ];
     broken = versionAtLeast pydantic.version "2";
diff --git a/pkgs/stdenv/linux/bootstrap-files/armv5tel-unknown-linux-gnueabi.nix b/pkgs/stdenv/linux/bootstrap-files/armv5tel-unknown-linux-gnueabi.nix
index 0ac818b9f223..f608581568b5 100644
--- a/pkgs/stdenv/linux/bootstrap-files/armv5tel-unknown-linux-gnueabi.nix
+++ b/pkgs/stdenv/linux/bootstrap-files/armv5tel-unknown-linux-gnueabi.nix
@@ -1,18 +1,21 @@
+# Autogenerated by maintainers/scripts/bootstrap-files/refresh-tarballs.bash as:
+# $ ./refresh-tarballs.bash --targets=armv5tel-unknown-linux-gnueabi
+#
+# Metadata:
+# - nixpkgs revision: 029dea9aaacf920ce8f7d89e4cf09da31a38d8e1
+# - hydra build: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.armv5tel-unknown-linux-gnueabi.build/latest
+# - resolved hydra build: https://hydra.nixos.org/build/281086357
+# - instantiated derivation: /nix/store/j44ipis8k634n1a6j9j1blff88w13ix9-stdenv-bootstrap-tools-armv5tel-unknown-linux-gnueabi.drv
+# - output directory: /nix/store/7xapg8fj3p2fpmnppsd28a66q62vzdg1-stdenv-bootstrap-tools-armv5tel-unknown-linux-gnueabi
+# - build time: Tue, 03 Dec 2024 13:59:40 +0000
 {
-  # Note: do not use Hydra as a source URL. Ask a member of the
-  # infrastructure team to mirror the job.
+  bootstrapTools = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/armv5tel-unknown-linux-gnueabi/029dea9aaacf920ce8f7d89e4cf09da31a38d8e1/bootstrap-tools.tar.xz";
+    hash = "sha256-+7cdKUThhOb4pVFBjPWFpBbTfn64A/ezkZnP6hEhMRM=";
+  };
   busybox = import <nix/fetchurl.nix> {
-    # from job: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.armv5tel.dist/latest
-    # from build: https://hydra.nixos.org/build/114203025
-    url = "http://tarballs.nixos.org/stdenv-linux/armv5tel/0eb0ddc4dbe3cd5415c6b6e657538eb809fc3778/busybox";
-    # note: the following hash is different than the above hash, due to executable = true
-    sha256 = "0qxp2fsvs4phbc17g9npj9bsm20ylr8myi5pivcrmxm5qqflgi8d";
+    url = "http://tarballs.nixos.org/stdenv/armv5tel-unknown-linux-gnueabi/029dea9aaacf920ce8f7d89e4cf09da31a38d8e1/busybox";
+    hash = "sha256-vZ3oSKUjGVcx2TJsrKmTX4d+3S4/flD780vFVaaHDGI=";
     executable = true;
   };
-  bootstrapTools = import <nix/fetchurl.nix> {
-    # from job: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.armv5tel.dist/latest
-    # from build: https://hydra.nixos.org/build/114203025
-    url = "http://tarballs.nixos.org/stdenv-linux/armv5tel/0eb0ddc4dbe3cd5415c6b6e657538eb809fc3778/bootstrap-tools.tar.xz";
-    sha256 = "28327343db5ecc7f7811449ec69280d5867fa5d1d377cab0426beb9d4e059ed6";
-  };
 }
diff --git a/pkgs/stdenv/linux/bootstrap-files/armv6l-unknown-linux-gnueabihf.nix b/pkgs/stdenv/linux/bootstrap-files/armv6l-unknown-linux-gnueabihf.nix
index 8bc99c64c681..8bef180f3b69 100644
--- a/pkgs/stdenv/linux/bootstrap-files/armv6l-unknown-linux-gnueabihf.nix
+++ b/pkgs/stdenv/linux/bootstrap-files/armv6l-unknown-linux-gnueabihf.nix
@@ -1,18 +1,21 @@
+# Autogenerated by maintainers/scripts/bootstrap-files/refresh-tarballs.bash as:
+# $ ./refresh-tarballs.bash --targets=armv6l-unknown-linux-gnueabihf
+#
+# Metadata:
+# - nixpkgs revision: 029dea9aaacf920ce8f7d89e4cf09da31a38d8e1
+# - hydra build: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.armv6l-unknown-linux-gnueabihf.build/latest
+# - resolved hydra build: https://hydra.nixos.org/build/281086894
+# - instantiated derivation: /nix/store/gq29b3av5mf7x9zlbvaf1qrvlnb1ps4l-stdenv-bootstrap-tools-armv6l-unknown-linux-gnueabihf.drv
+# - output directory: /nix/store/cwfvh58lcbyk26d34j1w26d3ladgcgn8-stdenv-bootstrap-tools-armv6l-unknown-linux-gnueabihf
+# - build time: Tue, 03 Dec 2024 13:59:47 +0000
 {
-  # Note: do not use Hydra as a source URL. Ask a member of the
-  # infrastructure team to mirror the job.
+  bootstrapTools = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/armv6l-unknown-linux-gnueabihf/029dea9aaacf920ce8f7d89e4cf09da31a38d8e1/bootstrap-tools.tar.xz";
+    hash = "sha256-IOZRTJRvoP0bIz5GI6GqGAYb/FdME+xVVyFTvgtmLuw=";
+  };
   busybox = import <nix/fetchurl.nix> {
-    # from job: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.armv6l.dist/latest
-    # from build: https://hydra.nixos.org/build/114202834
-    url = "http://tarballs.nixos.org/stdenv-linux/armv6l/0eb0ddc4dbe3cd5415c6b6e657538eb809fc3778/busybox";
-    # note: the following hash is different than the above hash, due to executable = true
-    sha256 = "1q02537cq56wlaxbz3s3kj5vmh6jbm27jhvga6b4m4jycz5sxxp6";
+    url = "http://tarballs.nixos.org/stdenv/armv6l-unknown-linux-gnueabihf/029dea9aaacf920ce8f7d89e4cf09da31a38d8e1/busybox";
+    hash = "sha256-kdlAOhgypLa+ZesRT1ZVDoDQdNefV1Rx5Yf7H254o80=";
     executable = true;
   };
-  bootstrapTools = import <nix/fetchurl.nix> {
-    # from job: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.armv6l.dist/latest
-    # from build: https://hydra.nixos.org/build/114202834
-    url = "http://tarballs.nixos.org/stdenv-linux/armv6l/0eb0ddc4dbe3cd5415c6b6e657538eb809fc3778/bootstrap-tools.tar.xz";
-    sha256 = "0810fe74f8cd09831f177d075bd451a66b71278d3cc8db55b07c5e38ef3fbf3f";
-  };
 }
diff --git a/pkgs/tools/text/diffutils/default.nix b/pkgs/tools/text/diffutils/default.nix
index b9f960f10dca..ceeae464da4d 100644
--- a/pkgs/tools/text/diffutils/default.nix
+++ b/pkgs/tools/text/diffutils/default.nix
@@ -36,7 +36,9 @@ stdenv.mkDerivation rec {
   # Disable stack-related gnulib tests on x86_64-darwin because they have problems running under
   # Rosetta 2: test-c-stack hangs, test-sigsegv-catch-stackoverflow fails.
   postPatch =
-    if (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) then
+    if
+      ((stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) || (stdenv.hostPlatform.isAarch32))
+    then
       ''
         sed -i -E 's:test-c-stack2?\.sh::g' gnulib-tests/Makefile.in
         sed -i -E 's:test-sigsegv-catch-stackoverflow[12]::g' gnulib-tests/Makefile.in
diff --git a/pkgs/tools/text/gnugrep/default.nix b/pkgs/tools/text/gnugrep/default.nix
index bbb876703f2b..98d471cca61e 100644
--- a/pkgs/tools/text/gnugrep/default.nix
+++ b/pkgs/tools/text/gnugrep/default.nix
@@ -32,7 +32,8 @@ stdenv.mkDerivation {
   # cygwin: FAIL: multibyte-white-space
   # freebsd: FAIL mb-non-UTF8-performance
   # x86_64-darwin: fails 'stack-overflow' tests on Rosetta 2 emulator
-  doCheck = !stdenv.hostPlatform.isCygwin && !stdenv.hostPlatform.isFreeBSD && !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) && !stdenv.buildPlatform.isRiscV64;
+  # aarch32: fails 'stack-overflow' when run on qemu under x86_64
+  doCheck = !stdenv.hostPlatform.isCygwin && !stdenv.hostPlatform.isFreeBSD && !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) && !stdenv.buildPlatform.isRiscV64 && !stdenv.hostPlatform.isAarch32;
 
   # On macOS, force use of mkdir -p, since Grep's fallback
   # (./install-sh) is broken.
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4dd11e3449a4..f876f6ff2be0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1584,10 +1584,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  amber-secret = callPackage ../tools/security/amber {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   inherit (callPackages ../development/tools/ammonite {})
     ammonite_2_12
     ammonite_2_13
@@ -1960,8 +1956,6 @@ with pkgs;
 
   babelfish = callPackage ../shells/fish/babelfish.nix { };
 
-  badchars = python3Packages.callPackage ../tools/security/badchars { };
-
   bat-extras = recurseIntoAttrs (callPackages ../tools/misc/bat-extras { });
 
   beauty-line-icon-theme = callPackage ../data/icons/beauty-line-icon-theme {
@@ -9387,9 +9381,7 @@ with pkgs;
 
   isort = with python3Packages; toPythonApplication isort;
 
-  ispc = callPackage ../development/compilers/ispc {
-    llvmPackages = llvmPackages_17;
-  };
+  ispc = callPackage ../development/compilers/ispc { };
 
   isso = callPackage ../servers/isso {
     nodejs = nodejs_20;