diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 74e4fa9ba4eb..c0a31e826ac0 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -113,4 +113,4 @@ fb0e5be84331188a69b3edd31679ca6576edb75a
 3fe3b055adfc020e6a923c466b6bcd978a13069a
 
 # k3s: format with nixfmt-rfc-style
-0b7900d5e8e0bcac89e14a52d3e840f9201e9f47
+6cfcd3c75428ede517bc6b15a353d704837a2830
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 99c182b8340e..48715df24024 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5508,6 +5508,12 @@
       fingerprint = "9484 44FC E03B 05BA 5AB0  591E C37B 1C1D 44C7 86EE";
     }];
   };
+  dvn0 = {
+    email = "git@dvn.me";
+    github = "dvn0";
+    githubId = 10859387;
+    name = "Devan Carpenter";
+  };
   dwarfmaster = {
     email = "nixpkgs@dwarfmaster.net";
     github = "dwarfmaster";
@@ -7034,15 +7040,6 @@
     githubId = 12715461;
     name = "Anders Bo Rasmussen";
   };
-  fwam = {
-    name = "Legion Orsetti";
-    email = "fwam@queereen.dev";
-    github = "fwam";
-    githubId = 113541944;
-    keys = [{
-      fingerprint = "3822 20B8 57ED 0602 3786  8A7A 18E1 AE22 D704 B4FC";
-    }];
-  };
   fwc = {
     github = "fwc";
     githubId = 29337229;
@@ -8598,6 +8595,12 @@
     githubId = 3948275;
     name = "Harikrishnan R";
   };
+  ilya-epifanov = {
+    email = "mail@ilya.network";
+    github = "ilya-epifanov";
+    githubId = 92526;
+    name = "Ilya";
+  };
   ilya-fedin = {
     email = "fedin-ilja2010@ya.ru";
     github = "ilya-fedin";
@@ -11940,6 +11943,12 @@
       fingerprint = "66D1 3048 2B5F 2069 81A6  6B83 6F98 7CCF 224D 20B9";
     }];
   };
+  luftmensch-luftmensch = {
+    email = "valentinobocchetti59@gmail.com";
+    name = "Valentino Bocchetti";
+    github = "luftmensch-luftmensch";
+    githubId = 65391343;
+  };
   lugarun = {
     email = "lfschmidt.me@gmail.com";
     github = "lugarun";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 2a50f6f98d09..8b609bce4f26 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -723,6 +723,16 @@ with lib.maintainers; {
     enableFeatureFreezePing = true;
   };
 
+  lix = {
+    members = [
+      raitobezarius
+      qyriad
+    ];
+    scope = "Maintain the Lix package manager inside of Nixpkgs.";
+    shortName = "Lix ecosystem";
+    enableFeatureFreezePing = true;
+  };
+
   module-system = {
     members = [
       infinisil
diff --git a/nixos/modules/programs/xss-lock.nix b/nixos/modules/programs/xss-lock.nix
index 1bb73905599f..7a556e41061c 100644
--- a/nixos/modules/programs/xss-lock.nix
+++ b/nixos/modules/programs/xss-lock.nix
@@ -42,5 +42,10 @@ in
         ]);
       serviceConfig.Restart = "always";
     };
+
+    warnings = lib.mkIf (config.services.xserver.displayManager.startx.enable) [
+      "xss-lock service only works if a displayManager is set; it doesn't work when services.xserver.displayManager.startx.enable = true"
+    ];
+
   };
 }
diff --git a/nixos/modules/services/x11/desktop-managers/mate.nix b/nixos/modules/services/x11/desktop-managers/mate.nix
index beae07b70dbf..19235be4aa8d 100644
--- a/nixos/modules/services/x11/desktop-managers/mate.nix
+++ b/nixos/modules/services/x11/desktop-managers/mate.nix
@@ -84,6 +84,7 @@ in
       programs.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
 
       services.gnome.at-spi2-core.enable = true;
+      services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
       services.udev.packages = [ pkgs.mate.mate-settings-daemon ];
       services.gvfs.enable = true;
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index d1773da9afa6..6a553b9f30ed 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -112,7 +112,7 @@ in rec {
         (onFullSupported "nixos.tests.latestKernel.login")
         (onFullSupported "nixos.tests.lightdm")
         (onFullSupported "nixos.tests.login")
-        (onFullSupported "nixos.tests.misc")
+        (onFullSupported "nixos.tests.misc.default")
         (onFullSupported "nixos.tests.mutableUsers")
         (onFullSupported "nixos.tests.nat.firewall")
         (onFullSupported "nixos.tests.nat.standalone")
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
index 091c2b1f305b..5ef1a2f79e79 100644
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@@ -124,7 +124,7 @@ in rec {
         "nixos.tests.firewall"
         "nixos.tests.ipv6"
         "nixos.tests.login"
-        "nixos.tests.misc"
+        "nixos.tests.misc.default"
         "nixos.tests.nat.firewall"
         "nixos.tests.nat.standalone"
         "nixos.tests.nfs4.simple"
diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix
index e7842debba7a..83e0f46be3ec 100644
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@@ -1,164 +1,185 @@
 # Miscellaneous small tests that don't warrant their own VM run.
+{ pkgs, ... }:
 
-import ./make-test-python.nix ({ lib, pkgs, ...} : let
-  foo = pkgs.writeText "foo" "Hello World";
-in {
-  name = "misc";
-  meta.maintainers = with lib.maintainers; [ eelco ];
+let
+  inherit (pkgs) lib;
+  tests = {
+    default = testsForPackage { nixPackage = pkgs.nix; };
+    lix = testsForPackage { nixPackage = pkgs.lix; };
+  };
 
-  nodes.machine =
-    { lib, ... }:
-    { swapDevices = lib.mkOverride 0
-        [ { device = "/root/swapfile"; size = 128; } ];
-      environment.variables.EDITOR = lib.mkOverride 0 "emacs";
-      documentation.nixos.enable = lib.mkOverride 0 true;
-      systemd.tmpfiles.rules = [ "d /tmp 1777 root root 10d" ];
-      systemd.tmpfiles.settings."10-test"."/tmp/somefile".d = {};
-      virtualisation.fileSystems = { "/tmp2" =
-        { fsType = "tmpfs";
-          options = [ "mode=1777" "noauto" ];
-        };
-        # Tests https://discourse.nixos.org/t/how-to-make-a-derivations-executables-have-the-s-permission/8555
-        "/user-mount/point" = {
-          device = "/user-mount/source";
-          fsType = "none";
-          options = [ "bind" "rw" "user" "noauto" ];
-        };
-        "/user-mount/denied-point" = {
-          device = "/user-mount/denied-source";
-          fsType = "none";
-          options = [ "bind" "rw" "noauto" ];
+  testsForPackage = args: lib.recurseIntoAttrs {
+    # If the attribute is not named 'test'
+    # You will break all the universe on the release-*.nix side of things.
+    # `discoverTests` relies on `test` existence to perform a `callTest`.
+    test = testMiscFeatures args;
+    passthru.override = args': testsForPackage (args // args');
+  };
+
+  testMiscFeatures = { nixPackage, ... }: pkgs.testers.nixosTest (
+  let
+    foo = pkgs.writeText "foo" "Hello World";
+  in {
+    name = "misc";
+    meta.maintainers = with lib.maintainers; [ raitobezarius ];
+
+    nodes.machine =
+      { lib, ... }:
+      { swapDevices = lib.mkOverride 0
+          [ { device = "/root/swapfile"; size = 128; } ];
+        environment.variables.EDITOR = lib.mkOverride 0 "emacs";
+        documentation.nixos.enable = lib.mkOverride 0 true;
+        systemd.tmpfiles.rules = [ "d /tmp 1777 root root 10d" ];
+        systemd.tmpfiles.settings."10-test"."/tmp/somefile".d = {};
+        virtualisation.fileSystems = { "/tmp2" =
+          { fsType = "tmpfs";
+            options = [ "mode=1777" "noauto" ];
+          };
+          # Tests https://discourse.nixos.org/t/how-to-make-a-derivations-executables-have-the-s-permission/8555
+          "/user-mount/point" = {
+            device = "/user-mount/source";
+            fsType = "none";
+            options = [ "bind" "rw" "user" "noauto" ];
+          };
+          "/user-mount/denied-point" = {
+            device = "/user-mount/denied-source";
+            fsType = "none";
+            options = [ "bind" "rw" "noauto" ];
+          };
         };
+        systemd.automounts = lib.singleton
+          { wantedBy = [ "multi-user.target" ];
+            where = "/tmp2";
+          };
+        users.users.sybil = { isNormalUser = true; group = "wheel"; };
+        users.users.alice = { isNormalUser = true; };
+        security.sudo = { enable = true; wheelNeedsPassword = false; };
+        boot.kernel.sysctl."vm.swappiness" = 1;
+        boot.kernelParams = [ "vsyscall=emulate" ];
+        system.extraDependencies = [ foo ];
+
+        nix.package = nixPackage;
       };
-      systemd.automounts = lib.singleton
-        { wantedBy = [ "multi-user.target" ];
-          where = "/tmp2";
-        };
-      users.users.sybil = { isNormalUser = true; group = "wheel"; };
-      users.users.alice = { isNormalUser = true; };
-      security.sudo = { enable = true; wheelNeedsPassword = false; };
-      boot.kernel.sysctl."vm.swappiness" = 1;
-      boot.kernelParams = [ "vsyscall=emulate" ];
-      system.extraDependencies = [ foo ];
-    };
 
-  testScript =
-    ''
-      import json
+    testScript =
+      ''
+        import json
 
 
-      def get_path_info(path):
-          result = machine.succeed(f"nix --option experimental-features nix-command path-info --json {path}")
-          parsed = json.loads(result)
-          return parsed
+        def get_path_info(path):
+            result = machine.succeed(f"nix --option experimental-features nix-command path-info --json {path}")
+            parsed = json.loads(result)
+            return parsed
 
 
-      with subtest("nix-db"):
-          info = get_path_info("${foo}")
-          print(info)
+        with subtest("nix-db"):
+            info = get_path_info("${foo}")
+            print(info)
 
-          if (
-              info[0]["narHash"]
-              != "sha256-BdMdnb/0eWy3EddjE83rdgzWWpQjfWPAj3zDIFMD3Ck="
-          ):
-              raise Exception("narHash not set")
+            if (
+                info[0]["narHash"]
+                != "sha256-BdMdnb/0eWy3EddjE83rdgzWWpQjfWPAj3zDIFMD3Ck="
+            ):
+                raise Exception("narHash not set")
 
-          if info[0]["narSize"] != 128:
-              raise Exception("narSize not set")
+            if info[0]["narSize"] != 128:
+                raise Exception("narSize not set")
 
-      with subtest("nixos-version"):
-          machine.succeed("[ `nixos-version | wc -w` = 2 ]")
+        with subtest("nixos-version"):
+            machine.succeed("[ `nixos-version | wc -w` = 2 ]")
 
-      with subtest("nixos-rebuild"):
-          assert "NixOS module" in machine.succeed("nixos-rebuild --help")
+        with subtest("nixos-rebuild"):
+            assert "NixOS module" in machine.succeed("nixos-rebuild --help")
 
-      with subtest("Sanity check for uid/gid assignment"):
-          assert "4" == machine.succeed("id -u messagebus").strip()
-          assert "4" == machine.succeed("id -g messagebus").strip()
-          assert "users:x:100:" == machine.succeed("getent group users").strip()
+        with subtest("Sanity check for uid/gid assignment"):
+            assert "4" == machine.succeed("id -u messagebus").strip()
+            assert "4" == machine.succeed("id -g messagebus").strip()
+            assert "users:x:100:" == machine.succeed("getent group users").strip()
 
-      with subtest("Regression test for GMP aborts on QEMU."):
-          machine.succeed("expr 1 + 2")
+        with subtest("Regression test for GMP aborts on QEMU."):
+            machine.succeed("expr 1 + 2")
 
-      with subtest("the swap file got created"):
-          machine.wait_for_unit("root-swapfile.swap")
-          machine.succeed("ls -l /root/swapfile | grep 134217728")
+        with subtest("the swap file got created"):
+            machine.wait_for_unit("root-swapfile.swap")
+            machine.succeed("ls -l /root/swapfile | grep 134217728")
 
-      with subtest("whether kernel.poweroff_cmd is set"):
-          machine.succeed('[ -x "$(cat /proc/sys/kernel/poweroff_cmd)" ]')
+        with subtest("whether kernel.poweroff_cmd is set"):
+            machine.succeed('[ -x "$(cat /proc/sys/kernel/poweroff_cmd)" ]')
 
-      with subtest("whether the io cgroupv2 controller is properly enabled"):
-          machine.succeed("grep -q '\\bio\\b' /sys/fs/cgroup/cgroup.controllers")
+        with subtest("whether the io cgroupv2 controller is properly enabled"):
+            machine.succeed("grep -q '\\bio\\b' /sys/fs/cgroup/cgroup.controllers")
 
-      with subtest("whether we have a reboot record in wtmp"):
-          machine.shutdown
-          machine.wait_for_unit("multi-user.target")
-          machine.succeed("last | grep reboot >&2")
+        with subtest("whether we have a reboot record in wtmp"):
+            machine.shutdown
+            machine.wait_for_unit("multi-user.target")
+            machine.succeed("last | grep reboot >&2")
 
-      with subtest("whether we can override environment variables"):
-          machine.succeed('[ "$EDITOR" = emacs ]')
+        with subtest("whether we can override environment variables"):
+            machine.succeed('[ "$EDITOR" = emacs ]')
 
-      with subtest("whether hostname (and by extension nss_myhostname) works"):
-          assert "machine" == machine.succeed("hostname").strip()
-          assert "machine" == machine.succeed("hostname -s").strip()
+        with subtest("whether hostname (and by extension nss_myhostname) works"):
+            assert "machine" == machine.succeed("hostname").strip()
+            assert "machine" == machine.succeed("hostname -s").strip()
 
-      with subtest("whether systemd-udevd automatically loads modules for our hardware"):
-          machine.succeed("systemctl start systemd-udev-settle.service")
-          machine.wait_for_unit("systemd-udev-settle.service")
-          assert "mousedev" in machine.succeed("lsmod")
+        with subtest("whether systemd-udevd automatically loads modules for our hardware"):
+            machine.succeed("systemctl start systemd-udev-settle.service")
+            machine.wait_for_unit("systemd-udev-settle.service")
+            assert "mousedev" in machine.succeed("lsmod")
 
-      with subtest("whether systemd-tmpfiles-clean works"):
-          machine.succeed(
-              "touch /tmp/foo", "systemctl start systemd-tmpfiles-clean", "[ -e /tmp/foo ]"
-          )
-          # move into the future
-          machine.succeed(
-              'date -s "@$(($(date +%s) + 1000000))"',
-              "systemctl start systemd-tmpfiles-clean",
-          )
-          machine.fail("[ -e /tmp/foo ]")
+        with subtest("whether systemd-tmpfiles-clean works"):
+            machine.succeed(
+                "touch /tmp/foo", "systemctl start systemd-tmpfiles-clean", "[ -e /tmp/foo ]"
+            )
+            # move into the future
+            machine.succeed(
+                'date -s "@$(($(date +%s) + 1000000))"',
+                "systemctl start systemd-tmpfiles-clean",
+            )
+            machine.fail("[ -e /tmp/foo ]")
 
-      with subtest("whether systemd-tmpfiles settings works"):
-          machine.succeed("[ -e /tmp/somefile ]")
+        with subtest("whether systemd-tmpfiles settings works"):
+            machine.succeed("[ -e /tmp/somefile ]")
 
-      with subtest("whether automounting works"):
-          machine.fail("grep '/tmp2 tmpfs' /proc/mounts")
-          machine.succeed("touch /tmp2/x")
-          machine.succeed("grep '/tmp2 tmpfs' /proc/mounts")
+        with subtest("whether automounting works"):
+            machine.fail("grep '/tmp2 tmpfs' /proc/mounts")
+            machine.succeed("touch /tmp2/x")
+            machine.succeed("grep '/tmp2 tmpfs' /proc/mounts")
 
-      with subtest(
-          "Whether mounting by a user is possible with the `user` option in fstab (#95444)"
-      ):
-          machine.succeed("mkdir -p /user-mount/source")
-          machine.succeed("touch /user-mount/source/file")
-          machine.succeed("chmod -R a+Xr /user-mount/source")
-          machine.succeed("mkdir /user-mount/point")
-          machine.succeed("chown alice:users /user-mount/point")
-          machine.succeed("su - alice -c 'mount /user-mount/point'")
-          machine.succeed("su - alice -c 'ls /user-mount/point/file'")
-      with subtest(
-          "Whether mounting by a user is denied without the `user` option in  fstab"
-      ):
-          machine.succeed("mkdir -p /user-mount/denied-source")
-          machine.succeed("touch /user-mount/denied-source/file")
-          machine.succeed("chmod -R a+Xr /user-mount/denied-source")
-          machine.succeed("mkdir /user-mount/denied-point")
-          machine.succeed("chown alice:users /user-mount/denied-point")
-          machine.fail("su - alice -c 'mount /user-mount/denied-point'")
+        with subtest(
+            "Whether mounting by a user is possible with the `user` option in fstab (#95444)"
+        ):
+            machine.succeed("mkdir -p /user-mount/source")
+            machine.succeed("touch /user-mount/source/file")
+            machine.succeed("chmod -R a+Xr /user-mount/source")
+            machine.succeed("mkdir /user-mount/point")
+            machine.succeed("chown alice:users /user-mount/point")
+            machine.succeed("su - alice -c 'mount /user-mount/point'")
+            machine.succeed("su - alice -c 'ls /user-mount/point/file'")
+        with subtest(
+            "Whether mounting by a user is denied without the `user` option in  fstab"
+        ):
+            machine.succeed("mkdir -p /user-mount/denied-source")
+            machine.succeed("touch /user-mount/denied-source/file")
+            machine.succeed("chmod -R a+Xr /user-mount/denied-source")
+            machine.succeed("mkdir /user-mount/denied-point")
+            machine.succeed("chown alice:users /user-mount/denied-point")
+            machine.fail("su - alice -c 'mount /user-mount/denied-point'")
 
-      with subtest("shell-vars"):
-          machine.succeed('[ -n "$NIX_PATH" ]')
+        with subtest("shell-vars"):
+            machine.succeed('[ -n "$NIX_PATH" ]')
 
-      with subtest("nix-db"):
-          machine.succeed("nix-store -qR /run/current-system | grep nixos-")
+        with subtest("nix-db"):
+            machine.succeed("nix-store -qR /run/current-system | grep nixos-")
 
-      with subtest("Test sysctl"):
-          machine.wait_for_unit("systemd-sysctl.service")
-          assert "1" == machine.succeed("sysctl -ne vm.swappiness").strip()
-          machine.execute("sysctl vm.swappiness=60")
-          assert "60" == machine.succeed("sysctl -ne vm.swappiness").strip()
+        with subtest("Test sysctl"):
+            machine.wait_for_unit("systemd-sysctl.service")
+            assert "1" == machine.succeed("sysctl -ne vm.swappiness").strip()
+            machine.execute("sysctl vm.swappiness=60")
+            assert "60" == machine.succeed("sysctl -ne vm.swappiness").strip()
 
-      with subtest("Test boot parameters"):
-          assert "vsyscall=emulate" in machine.succeed("cat /proc/cmdline")
-    '';
-})
+        with subtest("Test boot parameters"):
+            assert "vsyscall=emulate" in machine.succeed("cat /proc/cmdline")
+      '';
+  });
+  in
+  tests
diff --git a/pkgs/applications/audio/jmusicbot/default.nix b/pkgs/applications/audio/jmusicbot/default.nix
index 5caf1a472d57..3bf4d63eec72 100644
--- a/pkgs/applications/audio/jmusicbot/default.nix
+++ b/pkgs/applications/audio/jmusicbot/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "JMusicBot";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchurl {
     url = "https://github.com/jagrosh/MusicBot/releases/download/${version}/JMusicBot-${version}.jar";
-    sha256 = "sha256-JSVrzyCqAp3V5OZ+KJczhWGolPkdaHsPmiqfmhapQMs=";
+    sha256 = "sha256-+0814w4zKNr2TxZ9CS8FxeuTLa71jM+DhrfFvLMFlw0=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/applications/audio/snd/default.nix b/pkgs/applications/audio/snd/default.nix
index 6958a38f2586..4cb879850b09 100644
--- a/pkgs/applications/audio/snd/default.nix
+++ b/pkgs/applications/audio/snd/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snd";
-  version = "24.2";
+  version = "24.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/snd/snd-${version}.tar.gz";
-    sha256 = "sha256-1ngnhOpPaRGH3xmiA7cUfVDqlJM1ZC+XfeSiV8vcdls=";
+    sha256 = "sha256-riy8WrL6jbD4aYnFf9x5DVeYabmty0OCb53jP3iVD9I=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/emulators/retroarch/hashes.json b/pkgs/applications/emulators/retroarch/hashes.json
index a612379f0e69..d1ea92493c1c 100644
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -85,10 +85,10 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-psx-libretro",
-            "rev": "54afe0284292fc6b83b9d515c86a553a8127a984",
-            "hash": "sha256-VZq8AZzjnTFh0GHh1mGIVAznTtJ+g0TJwTAXPUJdmI4="
+            "rev": "0c8abf7f9dda23874b5b9cecfcec519a9dfb032b",
+            "hash": "sha256-psGXpYzKI1QicoHxGhHwR92kymZ+9EaJUpGMcM2OMUY="
         },
-        "version": "unstable-2024-05-03"
+        "version": "unstable-2024-05-10"
     },
     "beetle-saturn": {
         "fetcher": "fetchFromGitHub",
@@ -287,10 +287,10 @@
         "src": {
             "owner": "libretro",
             "repo": "fbneo",
-            "rev": "3ece23fb10085098ac679f6bb61c20046b4a4b88",
-            "hash": "sha256-9dXQHkVYurUFnpnszGpdcTz/OcZh2J245O5r8gU5EQ8="
+            "rev": "573c9b99e3cc0b11a652b2f21a22dcb15a2c4dda",
+            "hash": "sha256-MTRv/F68GiEwt5iN4xilTWGgTw2mf2aAvqDExgeN/g0="
         },
-        "version": "unstable-2024-05-03"
+        "version": "unstable-2024-05-07"
     },
     "fceumm": {
         "fetcher": "fetchFromGitHub",
@@ -307,11 +307,11 @@
         "src": {
             "owner": "flyinghead",
             "repo": "flycast",
-            "rev": "0517a4600c46aa7f3db69eb827a5fcba40a1bda9",
-            "hash": "sha256-1tW6AwnzIZmiyQI8QFKn0ggBifONYR15tXSaRFu7n4k=",
+            "rev": "f13d7ad2dcf141f59a999090dbc0f78be196e665",
+            "hash": "sha256-YFLSUaEikwLPglHh3t8sHiKHRn5cchKzzkJlZDdgVsU=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-05-03"
+        "version": "unstable-2024-05-11"
     },
     "fmsx": {
         "fetcher": "fetchFromGitHub",
@@ -348,20 +348,20 @@
         "src": {
             "owner": "libretro",
             "repo": "gambatte-libretro",
-            "rev": "1030f93780121359d058a7f9eca081286906d88b",
-            "hash": "sha256-nnV1le7H22tY90G8/jCYy+9LPaY32G//7S48RotUyT8="
+            "rev": "a7e645196f5e54904a056e390ac7ceb033037de0",
+            "hash": "sha256-pz/IQpjySByHnRu64Ysd1LJPrcImMQ0CfTRV4ONUsA0="
         },
-        "version": "unstable-2024-05-03"
+        "version": "unstable-2024-05-10"
     },
     "genesis-plus-gx": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "Genesis-Plus-GX",
-            "rev": "86f701ba43953152d0db4e1cf548395ff7a57f1d",
-            "hash": "sha256-pDXxGrHX7XUvZNDLuASEfVGDiP07SZFHg21ZiRzJFDU="
+            "rev": "ba9fc37cfa4930311a9c77b1d8a23df0cae95e9a",
+            "hash": "sha256-Smw0MoUfewlz0zYQmtFLB0n8l0KyyoInohXZ7d9Xrwk="
         },
-        "version": "unstable-2024-05-03"
+        "version": "unstable-2024-05-10"
     },
     "gpsp": {
         "fetcher": "fetchFromGitHub",
@@ -601,10 +601,10 @@
         "src": {
             "owner": "libretro",
             "repo": "opera-libretro",
-            "rev": "cacba231c3bd71833f06943e230fe03d8ebec0ab",
-            "hash": "sha256-pWLcolQw5ctWrL7YQUaUK04QPS4ReUeJhdig3O5T8BM="
+            "rev": "5121aa6d36eff884bd56ccbadb6c112f1e951fee",
+            "hash": "sha256-mD/BEUwbWmRtB9llsqhz+/DhrzH9HiuXyJkX0pBks5M="
         },
-        "version": "unstable-2024-04-24"
+        "version": "unstable-2024-05-06"
     },
     "parallel-n64": {
         "fetcher": "fetchFromGitHub",
@@ -674,10 +674,10 @@
         "src": {
             "owner": "libretro",
             "repo": "libretro-prboom",
-            "rev": "6ec854969fd9dec33bb2cab350f05675d1158969",
-            "hash": "sha256-y0qZwYNwcO4ofWDZ7UXN9ZVMPFxjCnLDDZKBMdZLxEY="
+            "rev": "ab05295d81fed2bb9db9f68a7ceeec7a544191d8",
+            "hash": "sha256-ekVVxYg+Uet3pfir6P7PwI87p5XF2ATbFbux1t38ETs="
         },
-        "version": "unstable-2023-05-28"
+        "version": "unstable-2024-05-07"
     },
     "prosystem": {
         "fetcher": "fetchFromGitHub",
@@ -694,10 +694,10 @@
         "src": {
             "owner": "libretro",
             "repo": "libretro-uae",
-            "rev": "4806716da70cf1f030788b43190d71aae61e2041",
-            "hash": "sha256-MNqk8ItSC//82HsRfXVYCH+Xd2GV8OA/2heZprx89PY="
+            "rev": "106b98d50dab4b5648067096f0ba54acbf713fd3",
+            "hash": "sha256-UtZETlFrK59P6IK2i9Kt8qxRV8aEDMqxH7Oigm5sc1g="
         },
-        "version": "unstable-2024-04-19"
+        "version": "unstable-2024-05-04"
     },
     "quicknes": {
         "fetcher": "fetchFromGitHub",
@@ -814,10 +814,10 @@
         "src": {
             "owner": "libretro",
             "repo": "swanstation",
-            "rev": "6ed491d6ba46ac8ba64a580b3004a163c0725bd2",
-            "hash": "sha256-JRo1+zFBBtO0Ws7x32bltcm5WoDSIZBgLdPl75lpKAo="
+            "rev": "929958a1acaa075e32e108118b550e0449540cb6",
+            "hash": "sha256-UofVxdi+e1Y9d0ML/8lGahJCx5xnW5j9oDssRKrxYLU="
         },
-        "version": "unstable-2024-04-26"
+        "version": "unstable-2024-05-06"
     },
     "tgbdual": {
         "fetcher": "fetchFromGitHub",
diff --git a/pkgs/applications/emulators/vbam/default.nix b/pkgs/applications/emulators/vbam/default.nix
index 80fd7636aacb..3e7a7e2f47cd 100644
--- a/pkgs/applications/emulators/vbam/default.nix
+++ b/pkgs/applications/emulators/vbam/default.nix
@@ -14,6 +14,8 @@
 , sfml
 , zip
 , zlib
+, wrapGAppsHook3
+, gsettings-desktop-schemas
 }:
 
 stdenv.mkDerivation rec {
@@ -26,7 +28,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-t5/CM5KXDG0OCByu7mUyuC5NkYmB3BFmEHHgnMY05nE=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 ];
 
   buildInputs = [
     cairo
@@ -41,6 +43,7 @@ stdenv.mkDerivation rec {
     zlib
     wxGTK32
     gtk3
+    gsettings-desktop-schemas
   ];
 
   cmakeFlags = [
@@ -56,5 +59,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ lassulus netali ];
     homepage = "https://vba-m.com/";
     platforms = lib.platforms.linux;
+    mainProgram = "visualboyadvance-m";
   };
 }
diff --git a/pkgs/applications/finance/irpf/default.nix b/pkgs/applications/finance/irpf/default.nix
index b693aee613f7..9bf9c1f2d0cc 100644
--- a/pkgs/applications/finance/irpf/default.nix
+++ b/pkgs/applications/finance/irpf/default.nix
@@ -11,7 +11,7 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "irpf";
-  version = "2024-1.0";
+  version = "2024-1.1";
 
   # https://www.gov.br/receitafederal/pt-br/centrais-de-conteudo/download/pgd/dirpf
   # Para outros sistemas operacionais -> Multi
@@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation rec {
     year = lib.head (lib.splitVersion version);
   in fetchzip {
     url = "https://downloadirpf.receita.fazenda.gov.br/irpf/${year}/irpf/arquivos/IRPF${version}.zip";
-    hash = "sha256-x47Ud/aSfPuZYMZSGhJLnNFtNE62I+WjaFFatJPMPYg=";
+    hash = "sha256-7Eh5XhZKs2DAQC33ICUG+mgjEU7H3jdYZSeiHNJ6I6Q=";
   };
 
   nativeBuildInputs = [ unzip makeWrapper copyDesktopItems ];
@@ -71,7 +71,7 @@ stdenvNoCC.mkDerivation rec {
     license = licenses.unfree;
     platforms = platforms.all;
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    maintainers = with maintainers; [ atila ];
+    maintainers = with maintainers; [ atila bryanasdev000 ];
     mainProgram = "irpf";
   };
 }
diff --git a/pkgs/applications/misc/goldendict-ng/default.nix b/pkgs/applications/misc/goldendict-ng/default.nix
index 1693c8a12dd5..9f8de3ad6e16 100644
--- a/pkgs/applications/misc/goldendict-ng/default.nix
+++ b/pkgs/applications/misc/goldendict-ng/default.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goldendict-ng";
-  version = "24.01.22";
+  version = "24.05.05";
 
   src = fetchFromGitHub {
     owner = "xiaoyifang";
     repo = "goldendict-ng";
-    rev = "v${finalAttrs.version}-LoongYear.3dddb3be";
-    hash = "sha256-+OiZEkhNV06fZXPXv9zDzgJS5M3isHlcOXee3p/ejpw=";
+    rev = "v${finalAttrs.version}-LiXia.ecd1138c";
+    hash = "sha256-C/0FUFLE3R+tZyCL88BiSFOHPTanILD/fIIQ/OQBSfk=";
   };
 
   nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook wrapGAppsHook3 ];
diff --git a/pkgs/applications/misc/taskwarrior-tui/default.nix b/pkgs/applications/misc/taskwarrior-tui/default.nix
index 44b6ccf76095..922a7d19d4f9 100644
--- a/pkgs/applications/misc/taskwarrior-tui/default.nix
+++ b/pkgs/applications/misc/taskwarrior-tui/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "taskwarrior-tui";
-  version = "0.25.4";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "kdheepak";
     repo = "taskwarrior-tui";
     rev = "v${version}";
-    sha256 = "sha256-M8tiEUPfP5EWfPp7i6r0lpHC5ZUsEYeEKVz5gUpe4+A=";
+    sha256 = "sha256-/OIBWUDMPMbCFLnoCJORgzlhUAqlFIItXQSzLTWZ7Jo=";
   };
 
-  cargoHash = "sha256-B5peoyT/+miHXyoRGFLUv9qFzZZFsExrI46Zy0K7NL4=";
+  cargoHash = "sha256-JR6KX5x8BLfX8keofoYqS2eftCDoMLg25OMfTf0k53Q=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/misc/waypaper/default.nix b/pkgs/applications/misc/waypaper/default.nix
index 2722d8782fb4..a8dae9664264 100644
--- a/pkgs/applications/misc/waypaper/default.nix
+++ b/pkgs/applications/misc/waypaper/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "waypaper";
-  version = "2.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "anufrievroman";
     repo = "waypaper";
     rev = "refs/tags/${version}";
-    hash = "sha256-AIOrn5I0WX8S4iaK6mVEbdn1tQiED0JYA0GXDXJ6eNE=";
+    hash = "sha256-GB+H2kZr1+UhhGFpfXc3V4DPXjvHBdg6EKNEFhjKEHk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index d2937f86a175..64cd0aaa2413 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.10.9";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    hash = "sha256-0f+YXhxALbT+X1U0rmG+6IKqvzz8hvYSXS3YUpu+WWs=";
+    hash = "sha256-HVkR5sG3CfTW56pTB15S+w4kwbv7he9Be6RKmpu+E4E=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-42OWsNUFTLrx8FztxsCSHCxGb3yAv8qBKnN+EEIRCaA=";
+  vendorHash = "sha256-c0fTUU5zXI0QDo/bAL4v6zjEp0rNvCpQFAGwpgDWDFY=";
 
   # Set target as ./cmd per cli-local
   # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
diff --git a/pkgs/applications/networking/cluster/cilium/default.nix b/pkgs/applications/networking/cluster/cilium/default.nix
index 6b097500bacc..5353078e1d15 100644
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.16.6";
+  version = "0.16.7";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-MeBwlwxjMcBMy62IlhWBB+hTM5/Z9uIlqfCWsj0SQ4g=";
+    hash = "sha256-+Uxn9yR3D38CuvFeBA62aWLtY4rPrBJoF3tUmgKvKpw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/gatekeeper/default.nix b/pkgs/applications/networking/cluster/gatekeeper/default.nix
index 5558a48d9f8e..5ddb8409d31f 100644
--- a/pkgs/applications/networking/cluster/gatekeeper/default.nix
+++ b/pkgs/applications/networking/cluster/gatekeeper/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gatekeeper";
-  version = "3.15.1";
+  version = "3.16.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "gatekeeper";
     rev = "v${version}";
-    hash = "sha256-KPRcY14IeP4WU/cnUG7JWwJcp/LN6O74u417I+qAqXE=";
+    hash = "sha256-IIqucBPuEHymfg7nLmxXMrq1aaB6SFPrczPj4BH8Zyw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
index f768404e08fa..bd93089ee306 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helm-unittest";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DGmvF4U+yqXWm/L96ph+/OrLZ7q+JG4PQQFxC7pH710=";
+    hash = "sha256-YWzjv1/I+LX3AMeQenI36AsNJkZ6IzbMhM/f5/Kxs2M=";
   };
 
-  vendorHash = "sha256-BRFKrrJ9PhwMrfr3ON4/sm+BQ1ufeyP5PtfJQRksrj0=";
+  vendorHash = "sha256-A2izHBh58yPd2XPm4GKVosPtahUtQ35GbyBdr/L13CQ=";
 
   # NOTE: Remove the install and upgrade hooks.
   postPatch = ''
diff --git a/pkgs/applications/networking/cluster/kubectl-explore/default.nix b/pkgs/applications/networking/cluster/kubectl-explore/default.nix
index 2a0016e02018..66f45ad898a5 100644
--- a/pkgs/applications/networking/cluster/kubectl-explore/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-explore/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubectl-explore";
-  version = "0.8.3";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "keisku";
     repo = "kubectl-explore";
     rev = "v${version}";
-    hash = "sha256-OPZ0FQl++AxxZUMAdwg3+cr1KrwYNWs8n8UQ4oVrLBw=";
+    hash = "sha256-jPif9SjHVKB346XkPCiIYpTc/xWRda9jjXefK/Nbyz0=";
   };
 
-  vendorHash = "sha256-xNB+qC36DcD7oUWk242QcIKNfTmjuK5xbyJEztdhcJM=";
+  vendorHash = "sha256-8kq6ODLf/y23zHsemNtjpM+R8OMKE4DDnK2TGHvunUE=";
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix
index 516c1182e22f..6c30f9a19bf6 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.65";
+  "version" = "1.11.66";
   "hashes" = {
-    "desktopSrcHash" = "sha256-aRlTM8j+lMB97QsmRlcvSZqLJ/2vmQIz1viTIoycmYA=";
-    "desktopYarnHash" = "08scs091k0i6lwfpw0id4jxmmdix0jxvnm9fyjwzrsrzh6q6899y";
-    "webSrcHash" = "sha256-aE7pmqLOa9aCaSaSOpX2NqcY0OKBjL5mZbKModbKxZg=";
-    "webYarnHash" = "1b9q8v5jz6w2vvfkgq8nzajzs798ja2ff3wjv6d5m7sri8il7f0s";
+    "desktopSrcHash" = "sha256-QrFk6NIHvWgQuJz33CEU6rwmgtGZ9w3L9vqj/rdCkE8=";
+    "desktopYarnHash" = "1kin5z6cjgsljdhh5f4fq2782ld86pza6hz58rq1zwbd187nzbwz";
+    "webSrcHash" = "sha256-xWaK2tHsuZmiwp7HExX83zKL8Z0ScRCEOnfxePWk2KI=";
+    "webYarnHash" = "1ykjpsg4d4kykd6w7c0yjyg8ljpc9czzwjx7ab27i84ys6pknx3q";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index 211c5b49bf9a..9300a73b175d 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -107,7 +107,8 @@ let
     ]
     ++ lib.optionals withCyrus_sasl [ "--enable-cyrus-sasl=yes" ]
     ++ lib.optionals withGnutls [ "--enable-gnutls=yes" "--enable-nss=no" ]
-    ++ lib.optionals stdenv.isDarwin [ "--disable-gtkspell" "--disable-vv" ];
+    ++ lib.optionals stdenv.isDarwin [ "--disable-gtkspell" "--disable-vv" ]
+    ++ lib.optionals stdenv.cc.isClang [ "CFLAGS=-Wno-error=int-conversion" ];
 
     enableParallelBuilding = true;
 
@@ -138,6 +139,7 @@ let
 
     meta = {
       description = "Multi-protocol instant messaging client";
+      mainProgram = "pidgin";
       homepage = "https://pidgin.im/";
       license = lib.licenses.gpl2Plus;
       platforms = lib.platforms.unix;
diff --git a/pkgs/applications/networking/weather/meteo/default.nix b/pkgs/applications/networking/weather/meteo/default.nix
index ddee458a0569..9914f664d0b0 100644
--- a/pkgs/applications/networking/weather/meteo/default.nix
+++ b/pkgs/applications/networking/weather/meteo/default.nix
@@ -11,6 +11,7 @@
 , vala
 , wrapGAppsHook3
 , glib
+, glib-networking
 , gtk3
 , json-glib
 , libappindicator
@@ -42,6 +43,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib
+    glib-networking # see #311066
     gtk3
     json-glib
     libappindicator
diff --git a/pkgs/applications/science/chemistry/jmol/default.nix b/pkgs/applications/science/chemistry/jmol/default.nix
index ee3ab5f1f3a5..bafbeb3529c6 100644
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@@ -25,14 +25,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "16.1.63";
+  version = "16.2.15";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    hash = "sha256-zUX3msosz0LNQJuEUbFgT32Hw0Wq4CgW1iHMkvReysU=";
+    hash = "sha256-zPHh5IFdttliPc0SCgkM/3UQmS4eT2rfi5HqpFjY5hA=";
   };
 
   patchPhase = ''
diff --git a/pkgs/applications/video/mpv/scripts/evafast.nix b/pkgs/applications/video/mpv/scripts/evafast.nix
index 8ba1109ff2d5..5260adb1a8ef 100644
--- a/pkgs/applications/video/mpv/scripts/evafast.nix
+++ b/pkgs/applications/video/mpv/scripts/evafast.nix
@@ -16,7 +16,8 @@ buildLua {
     hash = "sha256-BGWD2XwVu8zOSiDJ+9oWi8aPN2Wkw0Y0gF58X4f+tdI=";
   };
 
-  passthru.updateScript = unstableGitUpdater { };
+  # Drop the `branch` parameter once upstream merges `rewrite` back into `master`
+  passthru.updateScript = unstableGitUpdater { branch = "rewrite"; };
 
   meta = with lib; {
     description = "Seeking and hybrid fastforwarding like VHS";
diff --git a/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix b/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
index 1f53e6cb503c..d2832e104ada 100644
--- a/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
+++ b/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
@@ -7,14 +7,14 @@
 }:
 buildLua (finalAttrs: {
   pname = "modernx-zydezu";
-  version = "0.2.9";
+  version = "0.3.4";
 
   scriptPath = "modernx.lua";
   src = fetchFromGitHub {
     owner = "zydezu";
     repo = "ModernX";
     rev = finalAttrs.version;
-    hash = "sha256-Tq/v8EbojvOSSwbu8kdbLVxZWZNi1UH6zAPTcsUcgog";
+    hash = "sha256-XzzdJLN2DImwo8ZmH1+Q5e2YfwCh7pKyUxjtPd2AMGs=";
   };
 
   postInstall = ''
@@ -35,6 +35,9 @@ buildLua (finalAttrs: {
     description = "A modern OSC UI replacement for MPV that retains the functionality of the default OSC";
     homepage = "https://github.com/zydezu/ModernX";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ Guanran928 ];
+    maintainers = with maintainers; [
+      luftmensch-luftmensch
+      Guanran928
+    ];
   };
 })
diff --git a/pkgs/by-name/ba/backgroundremover/package.nix b/pkgs/by-name/ba/backgroundremover/package.nix
index e6303bb377b7..67c2f2eaa6a8 100644
--- a/pkgs/by-name/ba/backgroundremover/package.nix
+++ b/pkgs/by-name/ba/backgroundremover/package.nix
@@ -3,20 +3,21 @@
 , runCommand
 , fetchFromGitHub
 , fetchurl
+, gitUpdater
 }:
 
 let
   p = python3.pkgs;
   self = p.buildPythonApplication rec {
     pname = "backgroundremover";
-    version = "0.2.6";
+    version = "0.2.8";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "nadermx";
       repo = "backgroundremover";
       rev = "v${version}";
-      hash = "sha256-dDOo7NPwvdfV+ae2oMUytCGC+2HF6xUI7dyKk2we23w=";
+      hash = "sha256-LjVT4j0OzfbVSQgU0z/gzRTLm7N0RQRrfxtTugWwOxs=";
     };
 
     models = runCommand "background-remover-models" {} ''
@@ -31,7 +32,9 @@ let
         --replace 'os.path.expanduser(os.path.join("~", ".u2net", model_name + ".pth"))' "os.path.join(\"$models\", model_name + \".pth\")"
     '';
 
-    nativeBuildInputs = [ p.setuptools p.wheel ];
+    nativeBuildInputs = [ p.setuptools p.wheel p.pythonRelaxDepsHook ];
+
+    pythonRelaxDeps = [ "pillow" "torchvision" ];
 
     propagatedBuildInputs = [
       p.certifi
@@ -76,6 +79,7 @@ let
           backgroundremover -i ${demoImage} -o $out
         '';
       };
+      updateScript = gitUpdater { rev-prefix = "v"; };
     };
 
     doCheck = false; # no tests
diff --git a/pkgs/by-name/cr/crunchy-cli/Cargo.lock b/pkgs/by-name/cr/crunchy-cli/Cargo.lock
index 61832fee845b..44a47cd532de 100644
--- a/pkgs/by-name/cr/crunchy-cli/Cargo.lock
+++ b/pkgs/by-name/cr/crunchy-cli/Cargo.lock
@@ -43,47 +43,48 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.13"
+version = "0.6.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
+checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
 dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
+ "is_terminal_polyfill",
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle"
-version = "1.0.6"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
+checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
+checksum = "a64c907d4e79225ac72e2a354c9ce84d50ebb4586dee56c82b3ee73004f537f5"
 dependencies = [
  "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.2"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
+checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
 dependencies = [
  "anstyle",
  "windows-sys 0.52.0",
@@ -91,9 +92,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.82"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f538837af36e6f6a9be0faa67f9a314f8119e4e4b5867c6ab40ed60360142519"
+checksum = "25bdb32cbbdce2b519a9cd7df3a678443100e265d5e25ca763b7572a5104f5f3"
 
 [[package]]
 name = "async-speed-limit"
@@ -120,9 +121,9 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "backtrace"
@@ -147,9 +148,9 @@ checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
 name = "base64"
-version = "0.22.0"
+version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "base64-serde"
@@ -179,18 +180,6 @@ version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
-[[package]]
-name = "bytemuck"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d6d68c57235a3a081186990eca2867354726650f42f7516ca50c28d6281fd15"
-
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
 [[package]]
 name = "bytes"
 version = "1.6.0"
@@ -199,9 +188,9 @@ checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "cc"
-version = "1.0.95"
+version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d32a725bc159af97c3e629873bb9f88fb8cf8a4867175f76dc987815ea07c83b"
+checksum = "099a5357d84c4c61eb35fc8eafa9a79a902c2f76911e5747ced4e032edd8d9b4"
 
 [[package]]
 name = "cfg-if"
@@ -291,9 +280,9 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
 
 [[package]]
 name = "console"
@@ -354,7 +343,7 @@ checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "crunchy-cli"
-version = "3.5.2"
+version = "3.6.1"
 dependencies = [
  "chrono",
  "clap",
@@ -367,7 +356,7 @@ dependencies = [
 
 [[package]]
 name = "crunchy-cli-core"
-version = "3.5.2"
+version = "3.6.1"
 dependencies = [
  "anyhow",
  "async-speed-limit",
@@ -381,8 +370,6 @@ dependencies = [
  "fs2",
  "futures-util",
  "http",
- "image",
- "image_hasher",
  "indicatif",
  "lazy_static",
  "log",
@@ -390,7 +377,9 @@ dependencies = [
  "num_cpus",
  "regex",
  "reqwest",
+ "rsubs-lib",
  "rustls-native-certs",
+ "rusty-chromaprint",
  "serde",
  "serde_json",
  "serde_plain",
@@ -404,9 +393,9 @@ dependencies = [
 
 [[package]]
 name = "crunchyroll-rs"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e63a541bdcf0170a29eab4015943e8a6a09281334b4beacd70ac5cfc1c19496b"
+checksum = "58580acc9c0abf96a231ec8b1a4597ea55d9426ea17f684ce3582e2b26437bbb"
 dependencies = [
  "async-trait",
  "chrono",
@@ -430,9 +419,9 @@ dependencies = [
 
 [[package]]
 name = "crunchyroll-rs-internal"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a9e0e09162451565645fdd4dadc6b38e09f3aafcfb477153584bedd8d62a358"
+checksum = "ce3c844dec8a3390f8c9853b5cf1d65c3d38fd0657b8b5d0e008db8945dea326"
 dependencies = [
  "darling",
  "quote",
@@ -490,7 +479,7 @@ version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "79b4bdd5f1c0c7493d780c645f0bff5b9361e6408210fa88910adb181efca64c"
 dependencies = [
- "base64 0.22.0",
+ "base64 0.22.1",
  "base64-serde",
  "chrono",
  "fs-err",
@@ -601,9 +590,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984"
+checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
 
 [[package]]
 name = "fnv"
@@ -723,9 +712,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.14"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -767,9 +756,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.14.3"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
 [[package]]
 name = "heck"
@@ -951,32 +940,6 @@ dependencies = [
  "unicode-normalization",
 ]
 
-[[package]]
-name = "image"
-version = "0.25.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd54d660e773627692c524beaad361aca785a4f9f5730ce91f42aabe5bce3d11"
-dependencies = [
- "bytemuck",
- "byteorder",
- "num-traits",
- "zune-core",
- "zune-jpeg",
-]
-
-[[package]]
-name = "image_hasher"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481465fe767d92494987319b0b447a5829edf57f09c52bf8639396abaaeaf78"
-dependencies = [
- "base64 0.22.0",
- "image",
- "rustdct",
- "serde",
- "transpose",
-]
-
 [[package]]
 name = "indexmap"
 version = "1.9.3"
@@ -995,7 +958,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.3",
+ "hashbrown 0.14.5",
  "serde",
 ]
 
@@ -1027,6 +990,12 @@ version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+
 [[package]]
 name = "iso8601"
 version = "0.6.1"
@@ -1072,9 +1041,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "ae743338b92ff9146ce83992f766a31066a91a8c84a45e0e9f21e7cf6de6d346"
 
 [[package]]
 name = "libredox"
@@ -1210,9 +1179,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.18"
+version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
 ]
@@ -1417,6 +1386,15 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "realfft"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "953d9f7e5cdd80963547b456251296efc2626ed4e3cbf36c869d9564e0220571"
+dependencies = [
+ "rustfft",
+]
+
 [[package]]
 name = "redox_users"
 version = "0.4.5"
@@ -1463,7 +1441,7 @@ version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
 dependencies = [
- "base64 0.22.0",
+ "base64 0.22.1",
  "bytes",
  "cookie",
  "cookie_store",
@@ -1531,21 +1509,34 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b833d8d034ea094b1ea68aa6d5c740e0d04bad9d16568d08ba6f76823a114316"
 
+[[package]]
+name = "rsubs-lib"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dcca2a9560fca05de8f95bc3767e46673d4b4c1f2c7a11092e10efd95bbdf62"
+dependencies = [
+ "regex",
+ "serde",
+]
+
+[[package]]
+name = "rubato"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6dd52e80cfc21894deadf554a5673002938ae4625f7a283e536f9cf7c17b0d5"
+dependencies = [
+ "num-complex",
+ "num-integer",
+ "num-traits",
+ "realfft",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
-[[package]]
-name = "rustdct"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b61555105d6a9bf98797c063c362a1d24ed8ab0431655e38f1cf51e52089551"
-dependencies = [
- "rustfft",
-]
-
 [[package]]
 name = "rustfft"
 version = "6.2.0"
@@ -1607,7 +1598,7 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
 dependencies = [
- "base64 0.22.0",
+ "base64 0.22.1",
  "rustls-pki-types",
 ]
 
@@ -1628,6 +1619,16 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "rusty-chromaprint"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1755646867c36ecb391776deaa0b557a76d3badf20c142de7282630c34b20440"
+dependencies = [
+ "rubato",
+ "rustfft",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.17"
@@ -1645,11 +1646,11 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "770452e37cad93e0a50d5abc3990d2bc351c36d0328f86cefec2f2fb206eaef6"
+checksum = "c627723fd09706bacdb5cf41499e95098555af3c3c29d014dc3c458ef6be11c0"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -1658,9 +1659,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f3cc463c0ef97e11c3461a9d3787412d30e8e7eb907c79180c4a57bf7c04ef"
+checksum = "317936bbbd05227752583946b9e66d7ce3b489f84e11a94a510b4437fef407d7"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1668,18 +1669,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.198"
+version = "1.0.200"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
+checksum = "ddc6f9cc94d67c0e21aaf7eda3a010fd3af78ebf6e096aa6e2e13c79749cce4f"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.198"
+version = "1.0.200"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
+checksum = "856f046b9400cee3c8c94ed572ecdb752444c24528c035cd35882aad6f492bcb"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1730,11 +1731,11 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c85f8e96d1d6857f13768fcbd895fcb06225510022a2774ed8b5150581847b0"
+checksum = "0ad483d2ab0149d5a5ebcd9972a3852711e0153d863bf5a5d0391d28883c4a20"
 dependencies = [
- "base64 0.22.0",
+ "base64 0.22.1",
  "chrono",
  "hex",
  "indexmap 1.9.3",
@@ -1748,9 +1749,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8b3a576c4eb2924262d5951a3b737ccaf16c931e39a2810c36f9a7e25575557"
+checksum = "65569b702f41443e8bc8bbb1c5779bd0450bbe723b56198980e80ec45780bce2"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -1798,9 +1799,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.5.6"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -2024,16 +2025,15 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
+checksum = "9cf6b47b3771c49ac75ad09a6162f53ad4b8088b76ac60e8ec1455b31a189fe1"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
  "pin-project-lite",
  "tokio",
- "tracing",
 ]
 
 [[package]]
@@ -2144,9 +2144,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-width"
-version = "0.1.11"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
+checksum = "68f5e5f3158ecfd4b8ff6fe086db7c8467a2dfdac97fe420f2b7c4aa97af66d6"
 
 [[package]]
 name = "untrusted"
@@ -2498,21 +2498,6 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.8.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63381fa6624bf92130a6b87c0d07380116f80b565c42cf0d754136f0238359ef"
-
-[[package]]
-name = "zune-core"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f423a2c17029964870cfaabb1f13dfab7d092a62a29a89264f4d36990ca414a"
-
-[[package]]
-name = "zune-jpeg"
-version = "0.4.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec866b44a2a1fd6133d363f073ca1b179f438f99e7e5bfb1e33f7181facfe448"
-dependencies = [
- "zune-core",
-]
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
diff --git a/pkgs/by-name/cr/crunchy-cli/package.nix b/pkgs/by-name/cr/crunchy-cli/package.nix
index 1fc5711ef350..0855864a3fe8 100644
--- a/pkgs/by-name/cr/crunchy-cli/package.nix
+++ b/pkgs/by-name/cr/crunchy-cli/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "crunchy-cli";
-  version = "3.5.2";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "crunchy-labs";
     repo = "crunchy-cli";
     rev = "v${version}";
-    hash = "sha256-20jsBIjl6WOs0X4ancWHUuAe2Qiv8s4w+EpEVE5Psvw=";
+    hash = "sha256-SlTdyEeqQ9lCrFFTDtMhP0Kvm+3gxiUS+ZB5LvNWSZU=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/do/dorion/package.nix b/pkgs/by-name/do/dorion/package.nix
index 004e94fda27d..b9c63b443dd2 100644
--- a/pkgs/by-name/do/dorion/package.nix
+++ b/pkgs/by-name/do/dorion/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   name = "dorion";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchurl {
     url = "https://github.com/SpikeHD/Dorion/releases/download/v${finalAttrs.version }/Dorion_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-QqjRxAx2hDd8atpXuof8AVWtK3o8K77Se2b2CyOBMOw=";
+    hash = "sha256-ki1cNrMUSO9JX8HCm4lFKid3Jq6pwKJcb4bVPaha+IA=";
   };
 
   unpackCmd = ''
diff --git a/pkgs/servers/endlessh-go/default.nix b/pkgs/by-name/en/endlessh-go/package.nix
similarity index 70%
rename from pkgs/servers/endlessh-go/default.nix
rename to pkgs/by-name/en/endlessh-go/package.nix
index 44c574a316f2..988438ac89f7 100644
--- a/pkgs/servers/endlessh-go/default.nix
+++ b/pkgs/by-name/en/endlessh-go/package.nix
@@ -6,20 +6,24 @@
 
 buildGoModule rec {
   pname = "endlessh-go";
-  version = "20230625-3";
+  version = "2024.0119.1";
 
   src = fetchFromGitHub {
     owner = "shizunge";
     repo = "endlessh-go";
     rev = version;
-    sha256 = "sha256-ug01nwlUCKe7DkhSJJ9XUU4QHZeH0A2f/oH6wl2VzIc=";
+    hash = "sha256-CLmlcuRb5dt1oPNdBfx0ql1Zmn/HahcmhVA0k50i6yA=";
   };
 
-  vendorHash = "sha256-n7lzSLtR3bUslT6Q1khsFeofSvwuSaBv3n33+HIdssU=";
+  vendorHash = "sha256-unIyU60IrbiKDIjUf9F2pqqGNIA4gFp5XyQlvx6+xxQ=";
+
+  CGO_ENABLED = 0;
 
   ldflags = [ "-s" "-w" ];
 
-  passthru.tests = nixosTests.endlessh-go;
+  passthru.tests = {
+    inherit (nixosTests) endlessh-go;
+  };
 
   meta = with lib; {
     description = "An implementation of endlessh exporting Prometheus metrics";
diff --git a/pkgs/by-name/gi/git-instafix/package.nix b/pkgs/by-name/gi/git-instafix/package.nix
index a0792af8ac70..6dc4a101b2af 100644
--- a/pkgs/by-name/gi/git-instafix/package.nix
+++ b/pkgs/by-name/gi/git-instafix/package.nix
@@ -13,7 +13,7 @@ let
     maintainers
     ;
 
-  version = "0.2.2";
+  version = "0.2.3";
 in
 rustPlatform.buildRustPackage {
   pname = "git-instafix";
@@ -23,10 +23,10 @@ rustPlatform.buildRustPackage {
     owner = "quodlibetor";
     repo = "git-instafix";
     rev = "v${version}";
-    hash = "sha256-cwScEEijhMgBdTeYuOOxW13x4ZpyrUouZvAiD17dOog=";
+    hash = "sha256-gh0/pD07oWODZAOu82KijOFWUHfqSHyGLXg67K/rhqo=";
   };
 
-  cargoHash = "sha256-o4oIDqr+vRvfICtZbIuD2kBEneLJrvyPVr5FPLlYGv8=";
+  cargoHash = "sha256-FncpFgmbB186ZKl8XMjeNAFtAf1qlNW8hbhTOKBlUWc=";
 
   buildInputs = [ libgit2 ];
   nativeCheckInputs = [ git ];
diff --git a/pkgs/by-name/gl/glance/package.nix b/pkgs/by-name/gl/glance/package.nix
new file mode 100644
index 000000000000..cd54b841d288
--- /dev/null
+++ b/pkgs/by-name/gl/glance/package.nix
@@ -0,0 +1,32 @@
+{ lib,
+buildGoModule,
+fetchFromGitHub,
+nix-update-script
+}:
+
+buildGoModule rec {
+  pname = "glance";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "glanceapp";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-37nQEpJxioELNFJxacOUWOxGMFm80UtaYLDCxsoXRe8=";
+  };
+
+  vendorHash = "sha256-Okme73vLc3Pe9+rNlmG8Bj1msKaVb5PaIBsAAeTer6s=";
+
+  excludedPackages = [ "scripts/build-and-ship" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    homepage = "https://github.com/glanceapp/glance";
+    changelog = "https://github.com/glanceapp/glance/releases/tag/v${version}";
+    description = "A self-hosted dashboard that puts all your feeds in one place";
+    mainProgram = "glance";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ dvn0 ];
+  };
+}
diff --git a/pkgs/by-name/my/mysql84/no-force-outline-atomics.patch b/pkgs/by-name/my/mysql84/no-force-outline-atomics.patch
new file mode 100644
index 000000000000..a716a4f7f481
--- /dev/null
+++ b/pkgs/by-name/my/mysql84/no-force-outline-atomics.patch
@@ -0,0 +1,24 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 727d66011f9..acae1aada57 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1338,19 +1338,6 @@ IF(UNIX AND MY_COMPILER_IS_GNU_OR_CLANG
+   ENDIF()
+ ENDIF()
+ 
+-# For aarch64 some sub-architectures support LSE atomics and some don't. Thus,
+-# compiling for the common denominator (-march=armv8-a) means LSE is not used.
+-# The -moutline-atomics switch enables run-time detection of LSE support.
+-# There are compilers (gcc 9.3.1 for example) which support this switch, but
+-# do not enable it by default, even though it seems to help. So, we force it.
+-IF(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64")
+-  MY_CHECK_CXX_COMPILER_FLAG( "-moutline-atomics" HAVE_OUTLINE_ATOMICS)
+-  IF(HAVE_OUTLINE_ATOMICS)
+-    STRING_APPEND(CMAKE_C_FLAGS   " -moutline-atomics")
+-    STRING_APPEND(CMAKE_CXX_FLAGS " -moutline-atomics")
+-  ENDIF()
+-ENDIF()
+-
+ IF(LINUX)
+   OPTION(LINK_RANDOMIZE "Randomize the order of all symbols in the binary" OFF)
+   SET(LINK_RANDOMIZE_SEED "mysql"
diff --git a/pkgs/by-name/my/mysql84/package.nix b/pkgs/by-name/my/mysql84/package.nix
new file mode 100644
index 000000000000..d7081f614141
--- /dev/null
+++ b/pkgs/by-name/my/mysql84/package.nix
@@ -0,0 +1,78 @@
+{ lib, stdenv, fetchurl, bison, cmake, pkg-config
+, icu, libedit, libevent, lz4, ncurses, openssl, protobuf_21, re2, readline, zlib, zstd, libfido2
+, darwin, numactl, libtirpc, rpcsvc-proto, curl
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mysql";
+  version = "8.4.0";
+
+  src = fetchurl {
+    url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
+    hash = "sha256-R6VDP83WOduDa5nhtUWcK4E8va0j/ytd1K0n95K6kY4=";
+  };
+
+  nativeBuildInputs = [ bison cmake pkg-config ]
+    ++ lib.optionals (!stdenv.isDarwin) [ rpcsvc-proto ];
+
+  patches = [
+    ./no-force-outline-atomics.patch # Do not force compilers to turn on -moutline-atomics switch
+  ];
+
+  ## NOTE: MySQL upstream frequently twiddles the invocations of libtool. When updating, you might proactively grep for libtool references.
+  postPatch = ''
+    substituteInPlace cmake/libutils.cmake --replace /usr/bin/libtool libtool
+    substituteInPlace cmake/os/Darwin.cmake --replace /usr/bin/libtool libtool
+  '';
+
+  buildInputs = [
+    (curl.override { inherit openssl; }) icu libedit libevent lz4 ncurses openssl protobuf_21 re2 readline zlib
+    zstd libfido2
+  ] ++ lib.optionals stdenv.isLinux [
+    numactl libtirpc
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.cctools darwin.apple_sdk.frameworks.CoreServices darwin.developer_cmds darwin.DarwinTools
+  ];
+
+  outputs = [ "out" "static" ];
+
+  cmakeFlags = [
+    "-DFORCE_UNSUPPORTED_COMPILER=1" # To configure on Darwin.
+    "-DWITH_ROUTER=OFF" # It may be packaged separately.
+    "-DWITH_SYSTEM_LIBS=ON"
+    "-DWITH_UNIT_TESTS=OFF"
+    "-DMYSQL_UNIX_ADDR=/run/mysqld/mysqld.sock"
+    "-DMYSQL_DATADIR=/var/lib/mysql"
+    "-DINSTALL_INFODIR=share/mysql/docs"
+    "-DINSTALL_MANDIR=share/man"
+    "-DINSTALL_PLUGINDIR=lib/mysql/plugin"
+    "-DINSTALL_INCLUDEDIR=include/mysql"
+    "-DINSTALL_DOCREADMEDIR=share/mysql"
+    "-DINSTALL_SUPPORTFILESDIR=share/mysql"
+    "-DINSTALL_MYSQLSHAREDIR=share/mysql"
+    "-DINSTALL_MYSQLTESTDIR="
+    "-DINSTALL_DOCDIR=share/mysql/docs"
+    "-DINSTALL_SHAREDIR=share/mysql"
+  ];
+
+  postInstall = ''
+    moveToOutput "lib/*.a" $static
+    so=${stdenv.hostPlatform.extensions.sharedLibrary}
+    ln -s libmysqlclient$so $out/lib/libmysqlclient_r$so
+  '';
+
+  passthru = {
+    client = finalAttrs.finalPackage;
+    connector-c = finalAttrs.finalPackage;
+    server = finalAttrs.finalPackage;
+    mysqlVersion = lib.versions.majorMinor finalAttrs.version;
+  };
+
+  meta = with lib; {
+    homepage = "https://www.mysql.com/";
+    description = "The world's most popular open source database";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ orivej shyim ];
+    platforms = platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/pa/patch2pr/package.nix b/pkgs/by-name/pa/patch2pr/package.nix
index 67b5f227bcd4..488d2f858377 100644
--- a/pkgs/by-name/pa/patch2pr/package.nix
+++ b/pkgs/by-name/pa/patch2pr/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "patch2pr";
-  version = "0.22.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "bluekeyes";
     repo = "patch2pr";
     rev = "v${version}";
-    hash = "sha256-tG0pSXmrWT5PCcR25XngbKAS3q9jKdDKqWdPqA62omE=";
+    hash = "sha256-ot/PECNRuhJUYX1woektKC6VEV+rLKiSnCVCLIRhSUo=";
   };
 
-  vendorHash = "sha256-Z6BHUD7WrEpUmCaLvrFYCQCSbhPhee+gR5ep1oLzqbE=";
+  vendorHash = "sha256-K2qYfS0A1gOo2n3pBy00oLbd1/q/p5N8RoId+OP1Jmw=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/by-name/sa/sarif-tools/package.nix b/pkgs/by-name/sa/sarif-tools/package.nix
new file mode 100644
index 000000000000..881c2604eef9
--- /dev/null
+++ b/pkgs/by-name/sa/sarif-tools/package.nix
@@ -0,0 +1,4 @@
+{ python3Packages }:
+
+with python3Packages;
+toPythonApplication sarif-tools
diff --git a/pkgs/development/tools/misc/scc/default.nix b/pkgs/by-name/sc/scc/package.nix
similarity index 73%
rename from pkgs/development/tools/misc/scc/default.nix
rename to pkgs/by-name/sc/scc/package.nix
index 5a5bf1cafefe..5895b2f0b455 100644
--- a/pkgs/development/tools/misc/scc/default.nix
+++ b/pkgs/by-name/sc/scc/package.nix
@@ -1,5 +1,8 @@
-{ lib, buildGoModule, fetchFromGitHub }:
-
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
 buildGoModule rec {
   pname = "scc";
   version = "3.3.3";
@@ -19,7 +22,14 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://github.com/boyter/scc";
     description = "A very fast accurate code counter with complexity calculations and COCOMO estimates written in pure Go";
-    maintainers = with maintainers; [ sigma Br1ght0ne ];
-    license = with licenses; [ unlicense /* or */ mit ];
+    maintainers = with maintainers; [
+      sigma
+      Br1ght0ne
+    ];
+    license = with licenses; [
+      unlicense
+      # or
+      mit
+    ];
   };
 }
diff --git a/pkgs/by-name/to/tootik/package.nix b/pkgs/by-name/to/tootik/package.nix
index 9b236aabc6d9..c3b81e172282 100644
--- a/pkgs/by-name/to/tootik/package.nix
+++ b/pkgs/by-name/to/tootik/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tootik";
-  version = "0.10.4";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "dimkr";
     repo = "tootik";
     rev = version;
-    hash = "sha256-7rdDVxfTYcj6Wcoxrb5xCbpEYVTHQpocM27mSezkpoE=";
+    hash = "sha256-aAIyEUeIZvDbWfUcfcETGrB3Md8GqRB8hvRBUtMU5Zs=";
   };
 
-  vendorHash = "sha256-Lsc8nK4I1gZEW7RbEapHr3IJ6wTATLElX3XfNX1LwvM=";
+  vendorHash = "sha256-kAnGMNBWqH37QETnn2ncp7qOaCSx6Xd4HCFhCehh/kU=";
 
   nativeBuildInputs = [ openssl ];
 
diff --git a/pkgs/by-name/up/upbound/package.nix b/pkgs/by-name/up/upbound/package.nix
index 92031aa6dddf..421be958b168 100644
--- a/pkgs/by-name/up/upbound/package.nix
+++ b/pkgs/by-name/up/upbound/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "upbound";
-  version = "0.28.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "up";
     rev = "v${version}";
-    sha256 = "sha256-74kmEjJTcFYRgbuH8hFPS+sadVWk7FkFE+MrapQw/lw=";
+    sha256 = "sha256-KAWyHlqgj4xz3abSSa1cezpeDTmJbGSZAMffq3p/CyI=";
   };
 
-  vendorHash = "sha256-hNEM8U+3T4biEqGoN2ClKLSgKlfT/eoUkQQGiTrR2vM=";
+  vendorHash = "sha256-4o1WJHGHiO9r8RC8hr4KWZBiC8h52la1gKdYaYxEjbk=";
 
   subPackages = [ "cmd/docker-credential-up" "cmd/up" ];
 
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index fb4644dfc45d..3cfc974a77f1 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -60,6 +60,6 @@ buildNpmPackage rec {
     description = "Vencord web extension";
     homepage = "https://github.com/Vendicated/Vencord";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ FlafyDev fwam NotAShelf Scrumplex ];
+    maintainers = with maintainers; [ FlafyDev NotAShelf Scrumplex ];
   };
 }
diff --git a/pkgs/by-name/wa/warp-terminal/package.nix b/pkgs/by-name/wa/warp-terminal/package.nix
index cd69dc6e37cf..573e08678199 100644
--- a/pkgs/by-name/wa/warp-terminal/package.nix
+++ b/pkgs/by-name/wa/warp-terminal/package.nix
@@ -99,7 +99,7 @@ meta = with lib; {
   homepage = "https://www.warp.dev";
   license = licenses.unfree;
   sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-  maintainers = with maintainers; [ emilytrau Enzime imadnyc ];
+  maintainers = with maintainers; [ emilytrau Enzime imadnyc donteatoreo ];
   platforms = platforms.darwin ++ [ "x86_64-linux" ];
 };
 
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index 195553466fa1..28891c02ce2a 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,10 +1,10 @@
 {
   "darwin": {
-    "hash": "sha256-oIRZtj1BZWioO1ucEXnJQoz/FfDNHWLdYLExuLk+aJk=",
-    "version": "0.2024.04.23.08.01.stable_03"
+    "hash": "sha256-Ky5JyocpI9JKvhmmhk0Cg/Eo7icmo6FQAT639cGIGrA=",
+    "version": "0.2024.05.07.08.02.stable_02"
   },
   "linux": {
-    "hash": "sha256-R9//eoelQkH8OAhoU0ux+o1EpQozWhRJwCTTSY9LBGU=",
-    "version": "0.2024.04.23.08.01.stable_03"
+    "hash": "sha256-zUbWNgiupBoFWoN3I726FejGtGne9dctaiGlPBbj5KU=",
+    "version": "0.2024.05.07.08.02.stable_02"
   }
 }
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index 6b715e580fe5..5628df5393cf 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "30.0.0";
+  version = "30.0.1";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-V+oRmrqeIdYDaHmX7zCt7+So9tHOsJbqF0cBhCoctSU=";
+    hash = "sha256-THs6kN5VZpTvzTK7w/sGQbxoEyyPwzl93JDOvwucgeo=";
   };
 
-  npmDepsHash = "sha256-vRk7yUL+st/1kwNItLhypF22A8YuOG7e3vfoZwB0+oo=";
+  npmDepsHash = "sha256-maDIkbe4BKY7XYOQNGdOalyTGdBXgIU5t0QjVJW6lvQ=";
 
   nativeBuildInputs = [
     remarshal
diff --git a/pkgs/data/icons/kora-icon-theme/default.nix b/pkgs/data/icons/kora-icon-theme/default.nix
index a490d1c7289a..6ff07f749e54 100644
--- a/pkgs/data/icons/kora-icon-theme/default.nix
+++ b/pkgs/data/icons/kora-icon-theme/default.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation rec  {
   pname = "kora-icon-theme";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub  {
     owner = "bikass";
     repo = "kora";
     rev = "v${version}";
-    sha256 = "sha256-YKdqV41HlQMvkyWoWbOCMUASshnEDnXtxzdmJdTEQGw=";
+    sha256 = "sha256-cWfQiJeyH/bkvASoe2nl4efHQdMpYFh587d5yycs31k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/misc/unicode-emoji/default.nix b/pkgs/data/misc/unicode-emoji/default.nix
index ae14a27c8b7f..580dfef90bc5 100644
--- a/pkgs/data/misc/unicode-emoji/default.nix
+++ b/pkgs/data/misc/unicode-emoji/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "15.0";
+  version = "15.1";
 
   fetchData = { suffix, hash }: stdenvNoCC.mkDerivation {
     pname = "unicode-emoji-${suffix}";
@@ -32,15 +32,15 @@ let
   srcs = {
     emoji-sequences = fetchData {
       suffix = "sequences";
-      hash = "sha256-XCIi2KQy2JagMaaML1SwT79HsPzi5phT8euKPpRetW0=";
+      hash = "sha256-63LJEV41BPu+HIYhthn4eUcaRszFbi9EVBe3wcrQUNE=";
     };
     emoji-test = fetchData {
       suffix = "test";
-      hash = "sha256-hEXyOsg4jglr4Z0CYuFPzv+Fb/Ugk/I1bciUhfGoU9s=";
+      hash = "sha256-2HbuJJqijqp2z6bfqnAoR6jROwYqpIjUZdA5XugTftk=";
     };
     emoji-zwj-sequences = fetchData {
       suffix = "zwj-sequences";
-      hash = "sha256-/jV/kRe3dGZ2Bjdl1YcTft+bJZA6eSvVSTW/CFZ5EYI=";
+      hash = "sha256-mnagPcrPzY+b/gjEnI2QtVGCuXfLzIemlOioGT77Dlc=";
     };
   };
 in
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index e9faec42cd31..9b53b7cc138e 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -61,5 +61,9 @@ stdenv.mkDerivation (finalAttrs: {
       "libva-glx" "libva-wayland" "libva-x11"
     ];
     platforms = platforms.unix;
+    badPlatforms = [
+      # Mandatory libva shared library.
+      lib.systems.inspect.platformPatterns.isStatic
+    ];
   };
 })
diff --git a/pkgs/development/libraries/nsync/default.nix b/pkgs/development/libraries/nsync/default.nix
index a984058e9b10..b54691a45bf2 100644
--- a/pkgs/development/libraries/nsync/default.nix
+++ b/pkgs/development/libraries/nsync/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nsync";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = version;
-    hash = "sha256-pE9waDI+6LQwbyPJ4zROoF93Vt6+SETxxJ/UxeZE5WE=";
+    hash = "sha256-5pd2IpnPB7lEmy44OJjcwfE+yUQBS0fZVG18VUe/3C8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/opensaml-cpp/default.nix b/pkgs/development/libraries/opensaml-cpp/default.nix
index 7e44f2a50eeb..09c2be979a82 100644
--- a/pkgs/development/libraries/opensaml-cpp/default.nix
+++ b/pkgs/development/libraries/opensaml-cpp/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit, autoreconfHook, pkg-config
-, boost, openssl, log4shib, xercesc, xml-security-c, xml-tooling-c, zlib
+, darwin, boost, openssl, log4shib, xercesc, xml-security-c, xml-tooling-c, zlib
 }:
 
 stdenv.mkDerivation rec {
@@ -14,7 +14,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     boost openssl log4shib xercesc xml-security-c xml-tooling-c zlib
-  ];
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    CoreServices
+    SystemConfiguration
+  ]);
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   configureFlags = [ "--with-xmltooling=${xml-tooling-c}" ];
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index d5194ea29949..89af6e847a88 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -98,7 +98,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # error: argument unused during compilation: '-pie' [-Werror,-Wunused-command-line-argument]
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isMusl "-Wno-unused-command-line-argument";
+  env.NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.hostPlatform.isMusl "-Wno-unused-command-line-argument"
+    ++ lib.optional stdenv.cc.isClang "-Wno-cast-function-type-strict");
 
   postPatch = ''
     patchShebangs perf/*
diff --git a/pkgs/development/misc/brev-cli/default.nix b/pkgs/development/misc/brev-cli/default.nix
index 146d41321c6a..812f063a3c62 100644
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.279";
+  version = "0.6.284";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jQkaMFTArXPSCm6aBQb/vb4JEkgHtmzJl/Iz/f/pBSY=";
+    sha256 = "sha256-G70309GQ3C7ZBS4baRKN3Ms4MBvCmLmPorbByZy4Qh4=";
   };
 
   vendorHash = "sha256-IR/tgqh8rS4uN5jSOcopCutbHCKHSU9icUfRhOgu4t8=";
diff --git a/pkgs/development/python-modules/accelerate/default.nix b/pkgs/development/python-modules/accelerate/default.nix
index 61b3c53e834c..b32cadab4b2d 100644
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@@ -77,6 +77,9 @@ buildPythonPackage rec {
     "test_remote_code"
     "test_transformers_model"
 
+    # nondeterministic, tests GC behaviour by thresholding global ram usage
+    "test_free_memory_dereferences_prepared_components"
+
     # set the environment variable, CC, which conflicts with standard environment
     "test_patch_environment_key_exists"
   ] ++ lib.optionals (pythonAtLeast "3.12") [
diff --git a/pkgs/development/python-modules/ansible-runner/default.nix b/pkgs/development/python-modules/ansible-runner/default.nix
index ae77ab3594be..b0145a3113ee 100644
--- a/pkgs/development/python-modules/ansible-runner/default.nix
+++ b/pkgs/development/python-modules/ansible-runner/default.nix
@@ -41,6 +41,11 @@ buildPythonPackage rec {
       hash = "sha256-eTnQkftvjK0YHU+ovotRVSuVlvaVeXp5SvYk1DPCg88=";
       excludes = [ ".github/workflows/ci.yml" "tox.ini" ];
     })
+    (fetchpatch {
+      # python 3.12 compat
+      url = "https://github.com/ansible/ansible-runner/commit/dc248497bb2375a363222ce755bf3a31f21d5f64.patch";
+      hash = "sha256-QT28Iw0uENoO35rqZpYBcmJB/GNDEF4m86SKf6p0XQU=";
+    })
   ];
 
   build-system = [
diff --git a/pkgs/development/python-modules/cloudflare/default.nix b/pkgs/development/python-modules/cloudflare/default.nix
index f7bba7ba76ec..34ca3c05bdcd 100644
--- a/pkgs/development/python-modules/cloudflare/default.nix
+++ b/pkgs/development/python-modules/cloudflare/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "cloudflare";
-  version = "2.19.4";
+  version = "2.20.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-O2AAoBojfCO8z99tICVupREex0qCaunnT58OW7WyOD8=";
+    hash = "sha256-Rq78Od+qI2XWObQjzsLNU1CuERU8ckfT6zVFvc8Bpoo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/coordinates/default.nix b/pkgs/development/python-modules/coordinates/default.nix
index e699e1b9a015..454a2b7083cb 100644
--- a/pkgs/development/python-modules/coordinates/default.nix
+++ b/pkgs/development/python-modules/coordinates/default.nix
@@ -1,33 +1,37 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder
-, pytest
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "coordinates";
   version = "0.4.0";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "clbarnes";
     repo = "coordinates";
-    rev = "v${version}";
-    sha256 = "1zha594rshjg3qjq9mrai2hfldya282ihasp2i3km7b2j4gjdw2b";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-S/AmH5FinTpHFFcrGAUSyjfqoIgq14QlHk9CnUkqCv4=";
   };
 
-  nativeCheckInputs = [ pytest ];
+  build-system = [ setuptools ];
 
-  checkPhase = ''
-    runHook preCheck
-    pytest tests/
-    runHook postCheck
-  '';
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "coordinates" ];
 
   meta = with lib; {
     description = "Convenience class for doing maths with explicit coordinates";
     homepage = "https://github.com/clbarnes/coordinates";
+    changelog = "https://github.com/clbarnes/coordinates/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/dask-yarn/default.nix b/pkgs/development/python-modules/dask-yarn/default.nix
index acea511b2495..c14f52aa43c9 100644
--- a/pkgs/development/python-modules/dask-yarn/default.nix
+++ b/pkgs/development/python-modules/dask-yarn/default.nix
@@ -1,20 +1,22 @@
 { lib
-, stdenv
 , buildPythonPackage
-, dask
-, distributed
+, pythonOlder
 , fetchFromGitHub
 , fetchpatch
+, setuptools
+, versioneer
+, dask
+, distributed
 , grpcio
-, pytestCheckHook
-, pythonOlder
 , skein
+, pytestCheckHook
+, stdenv
 }:
 
 buildPythonPackage rec {
   pname = "dask-yarn";
   version = "0.9";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -33,9 +35,18 @@ buildPythonPackage rec {
     })
   ];
 
-  propagatedBuildInputs = [
-    distributed
+  postPatch = ''
+    rm versioneer.py
+  '';
+
+  build-system = [
+    setuptools
+    versioneer
+  ];
+
+  dependencies = [
     dask
+    distributed
     grpcio
     skein
   ];
diff --git a/pkgs/development/python-modules/gemfileparser/default.nix b/pkgs/development/python-modules/gemfileparser/default.nix
index e6b91d24f804..73ef12c7496f 100644
--- a/pkgs/development/python-modules/gemfileparser/default.nix
+++ b/pkgs/development/python-modules/gemfileparser/default.nix
@@ -1,31 +1,38 @@
-{ lib
-, fetchPypi
-, buildPythonPackage
-, pytestCheckHook
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
+
 buildPythonPackage rec {
   pname = "gemfileparser";
   version = "0.8.0";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "839592e49ea3fd985cec003ef58f8e77009a69ed7644a0c0acc94cf6dd9b8d6e";
+    hash = "sha256-g5WS5J6j/Zhc7AA+9Y+OdwCaae12RKDArMlM9t2bjW4=";
   };
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  build-system = [ setuptools ];
 
-  pythonImportsCheck = [
-    "gemfileparser"
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "gemfileparser" ];
 
   meta = with lib; {
     description = "A library to parse Ruby Gemfile, .gemspec and Cocoapod .podspec file using Python";
-    mainProgram = "parsegemfile";
     homepage = "https://github.com/gemfileparser/gemfileparser";
-    license = with licenses; [ gpl3Plus /* or */ mit ];
-    maintainers = [ ];
+    license = with licenses; [
+      gpl3Plus
+      mit
+    ];
+    maintainers = with maintainers; [ ];
+    mainProgram = "parsegemfile";
   };
 }
diff --git a/pkgs/development/python-modules/hid/default.nix b/pkgs/development/python-modules/hid/default.nix
index deb4006dfe78..7c33cb5b9d3c 100644
--- a/pkgs/development/python-modules/hid/default.nix
+++ b/pkgs/development/python-modules/hid/default.nix
@@ -1,30 +1,40 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , hidapi
-, nose
 }:
 
 buildPythonPackage rec {
   pname = "hid";
   version = "1.0.6";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-SNdk166XRroSO5bb9FeJPKgCaLd5HEsdLgUTEO64OGA=";
   };
 
-  propagatedBuildInputs = [ hidapi ];
-
-  nativeCheckInputs = [ nose ];
-
  postPatch = ''
-    hidapi=${hidapi}/lib/
-    test -d $hidapi || { echo "ERROR: $hidapi doesn't exist, please update/fix this build expression."; exit 1; }
-    sed -i -e "s|libhidapi|$hidapi/libhidapi|" hid/__init__.py
+   hidapi=${hidapi}/lib/
+   test -d $hidapi || { echo "ERROR: $hidapi doesn't exist, please update/fix this build expression."; exit 1; }
+   sed -i -e "s|libhidapi|$hidapi/libhidapi|" hid/__init__.py
   '';
 
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    hidapi
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [
+    "hid"
+  ];
+
   meta = with lib; {
     description = "hidapi bindings in ctypes";
     homepage = "https://github.com/apmorton/pyhidapi";
diff --git a/pkgs/development/python-modules/hikvision/default.nix b/pkgs/development/python-modules/hikvision/default.nix
index 23f6387853a8..354edc5d7798 100644
--- a/pkgs/development/python-modules/hikvision/default.nix
+++ b/pkgs/development/python-modules/hikvision/default.nix
@@ -1,35 +1,39 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, requests
-, pytestCheckHook
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "hikvision";
   version = "2.0.4";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "fbradyirl";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "1l0zvir4hf1pcwwcmrhkspbdljzmi4lknxar5bkipdanpsm588mn";
+    repo = "hikvision";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tiJUqr5WtRvnKll1OymJ9Uva1tUT5so4Zzc4SHLcH9A=";
   };
 
-  propagatedBuildInputs = [
-    requests
-  ];
+  build-system = [ setuptools ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  dependencies = [ requests ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "hikvision.api" ];
 
   meta = with lib; {
     description = "Python module for interacting with Hikvision IP Cameras";
     homepage = "https://github.com/fbradyirl/hikvision";
+    changelog = "https://github.com/fbradyirl/hikvision/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/hjson/default.nix b/pkgs/development/python-modules/hjson/default.nix
index 44aa789f0d04..46ae9f518a34 100644
--- a/pkgs/development/python-modules/hjson/default.nix
+++ b/pkgs/development/python-modules/hjson/default.nix
@@ -1,25 +1,34 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, python
-, makeWrapper
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  makeWrapper,
+  pytestCheckHook,
+  python,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "hjson";
   version = "3.0.2";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.5";
 
-  # N.B. pypi src tarball does not have tests
   src = fetchFromGitHub {
     owner = "hjson";
     repo = "hjson-py";
-    rev = "v${version}";
-    sha256 = "1jc7j790rcqnhbrfj4lhnz3f6768dc55aij840wmx16jylfqpc2n";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-VrCLHfXShF45IEhGVQpryBzjxreQEunyghazDNKRh8k=";
   };
 
+  build-system = [ setuptools ];
+
   nativeBuildInputs = [ makeWrapper ];
 
+  nativeCheckInputs = [ pytestCheckHook ];
+
   pythonImportsCheck = [ "hjson" ];
 
   postInstall = ''
@@ -29,11 +38,17 @@ buildPythonPackage rec {
       --prefix PATH : ${lib.makeBinPath [ python ]}
   '';
 
+  disabledTestPaths = [
+    # AttributeError:  b'/build/source/hjson/tool.py:14: Deprecati[151 chars]ools' != b''
+    "hjson/tests/test_tool.py"
+  ];
+
   meta = with lib; {
     description = "A user interface for JSON";
-    mainProgram = "hjson";
     homepage = "https://github.com/hjson/hjson-py";
+    changelog = "https://github.com/hjson/hjson-py/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ bhipple ];
+    mainProgram = "hjson";
   };
 }
diff --git a/pkgs/development/python-modules/html2text/default.nix b/pkgs/development/python-modules/html2text/default.nix
index bda7879eab0a..236b312e343d 100644
--- a/pkgs/development/python-modules/html2text/default.nix
+++ b/pkgs/development/python-modules/html2text/default.nix
@@ -1,38 +1,38 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, pytestCheckHook
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "html2text";
   version = "2024.2.26";
   pyproject = true;
+
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "Alir3z4";
     repo = "html2text";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-1CLkTFR+/XQ428WjMF7wliyAG6CB+n8JSsLDdLHPO7I=";
+    hash = "sha256-1CLkTFR+/XQ428WjMF7wliyAG6CB+n8JSsLDdLHPO7I=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "html2text" ];
 
   meta = with lib; {
-    changelog = "https://github.com/Alir3z4/html2text/blob/${src.rev}/ChangeLog.rst";
     description = "Turn HTML into equivalent Markdown-structured text";
     homepage = "https://github.com/Alir3z4/html2text/";
+    changelog = "https://github.com/Alir3z4/html2text/blob/${src.rev}/ChangeLog.rst";
     license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ];
     mainProgram = "html2text";
-    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index 7807d5d7b279..826b2cee2235 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "8.0.0";
+  version = "8.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "ical";
     rev = "refs/tags/${version}";
-    hash = "sha256-nwF6iInQzHdOtmcC1fi6CS2LnYRCxc/DS9bg8IxTlFg=";
+    hash = "sha256-GA2Kn6OednhQtNzmIq5npN2qXVaMHCzy02Jwx7g3GBA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/lockfile/default.nix b/pkgs/development/python-modules/lockfile/default.nix
index 0fb64ad0baf9..1ee92f4ce38a 100644
--- a/pkgs/development/python-modules/lockfile/default.nix
+++ b/pkgs/development/python-modules/lockfile/default.nix
@@ -1,25 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pbr
-, nose
+, pynose
 }:
 
 buildPythonPackage rec {
   pname = "lockfile";
   version = "0.12.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "6aed02de03cba24efabcd600b30540140634fc06cfa603822d508d5361e9f799";
   };
 
-  buildInputs = [ pbr ];
-  nativeCheckInputs = [ nose ];
+  build-system = [
+    pbr
+    setuptools
+  ];
+
+  nativeCheckInputs = [ pynose ];
 
   checkPhase = ''
+    runHook preCheck
     nosetests
+    runHook postcheck
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/m2crypto/default.nix b/pkgs/development/python-modules/m2crypto/default.nix
index 00d23b854030..8b87fc606c98 100644
--- a/pkgs/development/python-modules/m2crypto/default.nix
+++ b/pkgs/development/python-modules/m2crypto/default.nix
@@ -1,18 +1,19 @@
-{ lib
-, stdenv
-, buildPythonPackage
-, fetchPypi
-, openssl
-, parameterized
-, pytestCheckHook
-, pythonOlder
-, swig2
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchPypi,
+  openssl,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  swig,
 }:
 
 buildPythonPackage rec {
   pname = "m2crypto";
   version = "0.41.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -22,32 +23,29 @@ buildPythonPackage rec {
     hash = "sha256-OhNYx+6EkEbZF4Knd/F4a/AnocHVG1+vjxlDW/w/FJU=";
   };
 
-  nativeBuildInputs = [
-    swig2
-    openssl
-  ];
+  build-system = [ setuptools ];
 
-  buildInputs = [
-    openssl
-    parameterized
-  ];
+  nativeBuildInputs = [ swig ];
 
-  env = {
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin (toString [
-      "-Wno-error=implicit-function-declaration"
-      "-Wno-error=incompatible-pointer-types"
-    ]);
-  } // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
-    CPP = "${stdenv.cc.targetPrefix}cpp";
-  };
+  buildInputs = [ openssl ];
+
+  env =
+    {
+      NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin (toString [
+        "-Wno-error=implicit-function-declaration"
+        "-Wno-error=incompatible-pointer-types"
+      ]);
+    }
+    // lib.optionalAttrs (stdenv.hostPlatform != stdenv.buildPlatform) {
+      CPP = "${stdenv.cc.targetPrefix}cpp";
+    };
 
   nativeCheckInputs = [
     pytestCheckHook
+    openssl
   ];
 
-  pythonImportsCheck = [
-    "M2Crypto"
-  ];
+  pythonImportsCheck = [ "M2Crypto" ];
 
   meta = with lib; {
     description = "A Python crypto and SSL toolkit";
diff --git a/pkgs/development/python-modules/nanomsg-python/default.nix b/pkgs/development/python-modules/nanomsg-python/default.nix
index 06b2ed5f634f..1125b88c0e4e 100644
--- a/pkgs/development/python-modules/nanomsg-python/default.nix
+++ b/pkgs/development/python-modules/nanomsg-python/default.nix
@@ -1,22 +1,35 @@
-{ lib, buildPythonPackage, fetchFromGitHub, nanomsg }:
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nanomsg,
+  setuptools,
+  pythonOlder,
+}:
 
 buildPythonPackage {
   pname = "nanomsg-python";
   version = "1.0.20190114";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "tonysimpson";
     repo = "nanomsg-python";
     rev = "3acd9160f90f91034d4a43ce603aaa19fbaf1f2e";
-    sha256 = "1qgybcpmm9xxrn39alcgdcpvwphgm1glkbnwx0ljpz4nd1jsnyrl";
+    hash = "sha256-NHurZWiW/Csp6NyuSV+oD16+L2uPUZWGzb2nWi9b/uE=";
   };
 
+  build-system = [ setuptools ];
+
   buildInputs = [ nanomsg ];
 
   # Tests requires network connections
   doCheck = false;
 
+  pythonImportsCheck = [ "nanomsg" ];
+
   meta = with lib; {
     description = "Bindings for nanomsg";
     homepage = "https://github.com/tonysimpson/nanomsg-python";
diff --git a/pkgs/development/python-modules/nanotime/default.nix b/pkgs/development/python-modules/nanotime/default.nix
index aeabc540eb00..d41126916b0b 100644
--- a/pkgs/development/python-modules/nanotime/default.nix
+++ b/pkgs/development/python-modules/nanotime/default.nix
@@ -1,24 +1,31 @@
-{ lib, buildPythonPackage, fetchPypi, nose }:
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  pythonOlder,
+}:
 
 buildPythonPackage rec {
   pname = "nanotime";
   version = "0.5.2";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c7cc231fc5f6db401b448d7ab51c96d0a4733f4b69fabe569a576f89ffdf966b";
+    hash = "sha256-x8wjH8X220AbRI16tRyW0KRzP0tp+r5Wmldvif/flms=";
   };
 
-  nativeCheckInputs = [ nose ];
+  build-system = [ setuptools ];
 
-  checkPhase = ''
-    nosetests
-  '';
-
-  # tests currently fail
+  # Tests currently failing
+  # https://github.com/jbenet/nanotime/issues/2
   doCheck = false;
 
+  pythonImportsCheck = [ "nanotime" ];
+
   meta = with lib; {
     description = "Provides a time object that keeps time as the number of nanoseconds since the UNIX epoch";
     homepage = "https://github.com/jbenet/nanotime/tree/master/python";
diff --git a/pkgs/development/python-modules/nats-python/default.nix b/pkgs/development/python-modules/nats-python/default.nix
index 9662dddd5ddb..f93b2feab69c 100644
--- a/pkgs/development/python-modules/nats-python/default.nix
+++ b/pkgs/development/python-modules/nats-python/default.nix
@@ -1,41 +1,39 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, fetchpatch
-, poetry-core
-, pythonOlder
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+  poetry-core,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "nats-python";
   version = "0.8.0";
-  disabled = pythonOlder "3.6";
-  format = "pyproject";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "Gr1N";
     repo = "nats-python";
-    rev = version;
-    sha256 = "1j7skyxldir3mphvnsyhjxmf3cimv4h7n5v58jl2gff4yd0hdw7g";
+    rev = "refs/tags/${version}";
+    hash = "sha256-7/AGQfPEuSeoRGUXeyDZNbLhapfQa7vhrSPHRruf+sg=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
-
   patches = [
     # Switch to poetry-core, https://github.com/Gr1N/nats-python/pull/19
     (fetchpatch {
       name = "use-poetry-core.patch";
       url = "https://github.com/Gr1N/nats-python/commit/71b25b324212dccd7fc06ba3914491adba22e83f.patch";
-      sha256 = "1fip1qpzk2ka7qgkrdpdr6vnrnb1p8cwapa51xp0h26nm7yis1gl";
+      hash = "sha256-9AUd/anWCAhuD0VdxRm6Ydlst8nttjwfPmqK+S8ON7o=";
     })
   ];
 
-  propagatedBuildInputs = [
-    setuptools
-  ];
+  build-system = [ poetry-core ];
+
+  dependencies = [ setuptools ];
 
   # Tests require a running NATS server
   doCheck = false;
@@ -45,6 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python client for NATS messaging system";
     homepage = "https://github.com/Gr1N/nats-python";
+    changelog = "https://github.com/Gr1N/nats-python/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/naturalsort/default.nix b/pkgs/development/python-modules/naturalsort/default.nix
index 9d7572fb0f70..8be9da8328f2 100644
--- a/pkgs/development/python-modules/naturalsort/default.nix
+++ b/pkgs/development/python-modules/naturalsort/default.nix
@@ -1,20 +1,36 @@
-{ lib, buildPythonPackage, fetchFromGitHub }:
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+}:
 
 buildPythonPackage rec {
   pname = "naturalsort";
   version = "1.5.1";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "xolox";
     repo = "python-naturalsort";
-    rev = version;
-    sha256 = "0w43vlddzh97hffnvxp2zkrns9qyirx5g8ijxnxkbx1c4b4gq5ih";
+    rev = "refs/tags/${version}";
+    hash = "sha256-MBb8yCIs9DW77TKiV3qOHidt8/zi9m2dgyfB3xrdg3A=";
   };
 
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "natsort" ];
+
   meta = with lib; {
     description = "Simple natural order sorting API for Python that just works";
     homepage = "https://github.com/xolox/python-naturalsort";
+    changelog = "https://github.com/xolox/python-naturalsort/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ eyjhb ];
   };
diff --git a/pkgs/development/python-modules/noiseprotocol/default.nix b/pkgs/development/python-modules/noiseprotocol/default.nix
index d1cc83e517ad..8192e2dd4f30 100644
--- a/pkgs/development/python-modules/noiseprotocol/default.nix
+++ b/pkgs/development/python-modules/noiseprotocol/default.nix
@@ -1,18 +1,30 @@
-{ lib, buildPythonPackage, fetchFromGitHub, cryptography, pytestCheckHook }:
+{
+  lib,
+  buildPythonPackage,
+  cryptography,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+}:
 
 buildPythonPackage rec {
   pname = "noiseprotocol";
   version = "0.3.1";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "plizonczyk";
     repo = "noiseprotocol";
-    rev = "v${version}";
-    sha256 = "1mk0rqpjifdv3v1cjwkdnjbrfmzzjm9f3qqs1r8vii4j2wvhm6am";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-VZkKNxeSxLhRDhrj4VKV/1eXl7RtcsnCHru5KC/OYNY=";
   };
 
-  propagatedBuildInputs = [ cryptography ];
+  build-system = [ setuptools ];
+
+  dependencies = [ cryptography ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -21,6 +33,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Noise Protocol Framework";
     homepage = "https://github.com/plizonczyk/noiseprotocol/";
+    changelog = "https://github.com/plizonczyk/noiseprotocol/blob/v${version}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/oemthermostat/default.nix b/pkgs/development/python-modules/oemthermostat/default.nix
index f40e39f10bf6..154a3f7f1e6b 100644
--- a/pkgs/development/python-modules/oemthermostat/default.nix
+++ b/pkgs/development/python-modules/oemthermostat/default.nix
@@ -1,45 +1,39 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pytestCheckHook
-, pythonOlder
-, requests
-, setuptools-scm
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "oemthermostat";
   version = "1.1.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "Cadair";
     repo = "openenergymonitor_thermostat";
-    rev = "v${version}";
-    sha256 = "vrMw3/X8MtejO1WyUA1DOlfVCPTCPgcK5p3+OlTWcM4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-vrMw3/X8MtejO1WyUA1DOlfVCPTCPgcK5p3+OlTWcM4=";
   };
 
-  nativeBuildInputs = [
-    setuptools-scm
-  ];
+  build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [
-    requests
-  ];
+  dependencies = [ requests ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [
-    "oemthermostat"
-  ];
+  pythonImportsCheck = [ "oemthermostat" ];
 
   meta = with lib; {
     description = "Python module to interact with OpenEnergyMonitor thermostats";
     homepage = "https://github.com/Cadair/openenergymonitor_thermostat";
+    changelog = "https://github.com/Cadair/openenergymonitor_thermostat/blob/v${version}/CHANGELOG.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/openwrt-ubus-rpc/default.nix b/pkgs/development/python-modules/openwrt-ubus-rpc/default.nix
index c5a5ac35b3cd..efafabe29d61 100644
--- a/pkgs/development/python-modules/openwrt-ubus-rpc/default.nix
+++ b/pkgs/development/python-modules/openwrt-ubus-rpc/default.nix
@@ -1,34 +1,43 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, requests
-, urllib3
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  requests,
+  setuptools,
+  urllib3,
 }:
 
 buildPythonPackage rec {
   pname = "openwrt-ubus-rpc";
   version = "0.0.3";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "Noltari";
     repo = "python-ubus-rpc";
-    rev = version;
-    sha256 = "19scncc1w9ar3pw4yrw24akjgm74n2m7y308hzl1i360daf5p21k";
+    rev = "refs/tags/${version}";
+    hash = "sha256-M4hbnGrAjBjohwgMf6qw5NQnpyKCZ0/4HVklHhizTKc=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     requests
     urllib3
   ];
 
   # Project has no tests
   doCheck = false;
+
   pythonImportsCheck = [ "openwrt.ubus" ];
 
   meta = with lib; {
     description = "Python API for OpenWrt ubus RPC";
     homepage = "https://github.com/Noltari/python-ubus-rpc";
+    changelog = "https://github.com/Noltari/python-ubus-rpc/releases/tag/${version}";
     license = with licenses; [ gpl2Only ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/opuslib/default.nix b/pkgs/development/python-modules/opuslib/default.nix
index c30d70851186..2f5bbf8b2581 100644
--- a/pkgs/development/python-modules/opuslib/default.nix
+++ b/pkgs/development/python-modules/opuslib/default.nix
@@ -1,17 +1,20 @@
-{ buildPythonPackage,
+{
+  buildPythonPackage,
   fetchFromGitHub,
   fetchpatch,
   isPy27,
   libopus,
-  nose,
-  lib, stdenv,
+  pynose,
+  lib,
+  stdenv,
   substituteAll,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "opuslib";
   version = "3.0.3";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = isPy27;
 
@@ -41,7 +44,11 @@ buildPythonPackage rec {
     })
   ];
 
-  nativeCheckInputs = [ nose ];
+  build-system = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [ pynose ];
 
   meta = with lib; {
     description = "Python bindings to the libopus, IETF low-delay audio codec";
diff --git a/pkgs/development/python-modules/psycopg2cffi/default.nix b/pkgs/development/python-modules/psycopg2cffi/default.nix
index f791f953d3f0..608bae034ea5 100644
--- a/pkgs/development/python-modules/psycopg2cffi/default.nix
+++ b/pkgs/development/python-modules/psycopg2cffi/default.nix
@@ -5,35 +5,46 @@
 , postgresql
 , postgresqlTestHook
 , pytestCheckHook
+, setuptools
 , six
+, stdenv
 }:
 
 buildPythonPackage rec {
   pname = "psycopg2cffi";
-  version = "2.8.1";
-  format = "setuptools";
+  version = "2.9.0";
+  pyproject = true;
 
-  # NB: This is a fork.
-  # The original repo exists at https://github.com/chtd/psycopg2cffi, however
-  # this is mostly unmaintained and does not build for PyPy. Given that the
-  # whole point of this cffi alternative to psycopg2 is to use it with PyPy, I
-  # chose to use a working fork instead, which was linked in the relevant issue:
-  # https://github.com/chtd/psycopg2cffi/issues/113#issuecomment-730548574
-  #
-  # If/when these changes get merged back upstream we should revert to using the
-  # original source as opposed to the fork.
   src = fetchFromGitHub {
-    owner = "Omegapol";
-    repo = pname;
-    rev = "c202b25cd861d5e8f0f55c329764ff1da9f020c0";
-    sha256 = "09hsnjkix1c0vlhmfvrp8pchpnz2ya4xrchyq15czj527nx2dmy2";
+    owner = "chtd";
+    repo = "psycopg2cffi";
+    rev = "refs/tags/${version}";
+    hash = "sha256-9r5MYxw9cvdbLVj8StmMmn0AKQepOpCc7TIBGXZGWe4=";
   };
 
-  nativeBuildInputs = [ postgresql ];
+  postPatch = ''
+    substituteInPlace psycopg2cffi/_impl/_build_libpq.py \
+      --replace-fail "from distutils import sysconfig" "import sysconfig" \
+      --replace-fail "sysconfig.get_python_inc()" "sysconfig.get_path('include')"
+  '';
 
-  propagatedBuildInputs = [ six cffi ];
+  build-system = [
+    postgresql
+    setuptools
+  ];
 
-  nativeCheckInputs = [ postgresqlTestHook pytestCheckHook ];
+  dependencies = [
+    cffi
+    six
+  ];
+
+  # FATAL: could not create shared memory segment: Operation not permitted
+  doCheck = !stdenv.isDarwin;
+
+  nativeCheckInputs = [
+    postgresqlTestHook
+    pytestCheckHook
+  ];
 
   disabledTests = [
     # AssertionError: '{}' != []
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index f404504cce90..615e076cb702 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "0.10.0.20240508";
+  version = "0.10.0.20240512";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DnDamv29WeYYL6FFDxfxFWRGYUvmNemorW+DlvoEM64=";
+    hash = "sha256-776icZQcsDEZv0EOeLmLlKmK1tidWi/FQ2SZ/N4Cbqo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pynmeagps/default.nix b/pkgs/development/python-modules/pynmeagps/default.nix
index 7791bb13f315..89bfe09c1637 100644
--- a/pkgs/development/python-modules/pynmeagps/default.nix
+++ b/pkgs/development/python-modules/pynmeagps/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pynmeagps";
-  version = "1.0.35";
+  version = "1.0.36";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "semuconsulting";
     repo = "pynmeagps";
-    rev = "v${version}";
-    hash = "sha256-ULGBfTHCFGUSF3cmJ4GEUrgGDo4uJwstBj8nZ7tj0AA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-n7dCr85TeBLxdrD1ZAA7PGJd9+3+xFJ8gjRU/JOFysY=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pytest-fixture-config/default.nix b/pkgs/development/python-modules/pytest-fixture-config/default.nix
index 31ab985dbff2..5be97cd7471c 100644
--- a/pkgs/development/python-modules/pytest-fixture-config/default.nix
+++ b/pkgs/development/python-modules/pytest-fixture-config/default.nix
@@ -1,17 +1,30 @@
-{ lib, buildPythonPackage, fetchPypi
-, setuptools-git, pytest }:
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-git,
+  pytest,
+}:
 
 buildPythonPackage rec {
   pname = "pytest-fixture-config";
-  version = "1.7.0";
-  format = "setuptools";
+  version = "1.7.1-unstable-2022-10-03";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "13i1qpz22w3x4dmw8vih5jdnbqfqvl7jiqs0dg764s0zf8bp98a1";
+  src = fetchFromGitHub {
+    owner = "man-group";
+    repo = "pytest-plugins";
+    rev = "5f9b88a65a8c1e506885352bbd9b2a47900f5014";
+    hash = "sha256-huN3RzwtfVf4iMJ96VRP/ldOxTUlUMF1wJIdbcGXHn4=";
   };
 
-  nativeBuildInputs = [ setuptools-git ];
+  sourceRoot = "${src.name}/pytest-fixture-config";
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-git
+  ];
 
   buildInputs = [ pytest ];
 
diff --git a/pkgs/development/python-modules/pytest-server-fixtures/default.nix b/pkgs/development/python-modules/pytest-server-fixtures/default.nix
index 29f26251b022..1466371e1af4 100644
--- a/pkgs/development/python-modules/pytest-server-fixtures/default.nix
+++ b/pkgs/development/python-modules/pytest-server-fixtures/default.nix
@@ -1,26 +1,45 @@
-{ lib, buildPythonPackage, fetchPypi
-, pytest, pytest-shutil, pytest-fixture-config, psutil
-, requests, future, retry }:
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  future,
+  psutil,
+  pytest,
+  pytest-shutil,
+  pytest-fixture-config,
+  requests,
+  retry,
+  six,
+  setuptools,
+}:
 
 buildPythonPackage rec {
   pname = "pytest-server-fixtures";
-  version = "1.7.1";
-  format = "setuptools";
+  inherit (pytest-fixture-config) version src;
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-xecz0gqNDnc8pRPjYOS6JkeVLqlCj6K9BVFsYoHqPOc=";
-  };
+  sourceRoot = "${src.name}/pytest-server-fixtures";
+
+  build-system = [ setuptools ];
 
   buildInputs = [ pytest ];
-  propagatedBuildInputs = [ pytest-shutil pytest-fixture-config psutil requests future retry ];
 
-  # RuntimeError: Unable to find a free server number to start Xvfb
+  dependencies = [
+    future
+    psutil
+    pytest-shutil
+    pytest-fixture-config
+    requests
+    retry
+    six
+  ];
+
+  # Don't run intergration tests
   doCheck = false;
 
   meta = with lib; {
     description = "Extensible server fixures for py.test";
-    homepage  = "https://github.com/manahl/pytest-plugins";
+    homepage = "https://github.com/manahl/pytest-plugins";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/pytest-shutil/default.nix b/pkgs/development/python-modules/pytest-shutil/default.nix
index 480c15b87c36..d9c80a93510e 100644
--- a/pkgs/development/python-modules/pytest-shutil/default.nix
+++ b/pkgs/development/python-modules/pytest-shutil/default.nix
@@ -1,13 +1,15 @@
 { lib
 , isPyPy
 , buildPythonPackage
-, fetchPypi
+, pytest-fixture-config
+, fetchpatch
 
-# build
-, pytest
+# build-time
+, setuptools
+, setuptools-git
 
 # runtime
-, setuptools-git
+, pytest
 , mock
 , path
 , execnet
@@ -15,32 +17,34 @@
 , six
 
 # tests
-, cmdline
 , pytestCheckHook
  }:
 
 buildPythonPackage rec {
   pname = "pytest-shutil";
-  version = "1.7.0";
-  format = "setuptools";
+  inherit (pytest-fixture-config) version src;
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-2BZSYd5251CFBcNB2UwCsRPclj8nRUOrynTb+r0CEmE=";
-  };
+  sourceRoot = "${src.name}/pytest-shutil";
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "contextlib2" 'contextlib2;python_version<"3"' \
-      --replace "path.py" "path"
-  '';
-
-  buildInputs = [
-    pytest
+  # imp was removed in Python 3.12
+  patches = [
+    (fetchpatch {
+      name = "stop-using-imp.patch";
+      url = "https://build.opensuse.org/public/source/openSUSE:Factory/python-pytest-shutil/stop-using-imp.patch?rev=10";
+      hash = "sha256-L8tXoQ9q8o6aP3TpJY/sUVVbUd/ebw0h6de6dBj1WNY=";
+      stripLen = 1;
+    })
   ];
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
     setuptools-git
+  ];
+
+  buildInputs = [ pytest ];
+
+  dependencies = [
     mock
     path
     execnet
@@ -49,7 +53,6 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    cmdline
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/pytest-virtualenv/default.nix b/pkgs/development/python-modules/pytest-virtualenv/default.nix
index 408430d5127c..494209517eb3 100644
--- a/pkgs/development/python-modules/pytest-virtualenv/default.nix
+++ b/pkgs/development/python-modules/pytest-virtualenv/default.nix
@@ -1,21 +1,43 @@
-{ lib, buildPythonPackage, fetchPypi
-, pytest, pytest-cov, mock, cmdline, pytest-fixture-config, pytest-shutil, virtualenv }:
+{
+  lib,
+  buildPythonPackage,
+  cmdline,
+  importlib-metadata,
+  mock,
+  pytestCheckHook,
+  pytest,
+  pytest-fixture-config,
+  pytest-shutil,
+  setuptools,
+  virtualenv,
+}:
 
 buildPythonPackage rec {
   pname = "pytest-virtualenv";
-  version = "1.7.0";
-  format = "setuptools";
+  inherit (pytest-fixture-config) version src;
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "03w2zz3crblj1p6i8nq17946hbn3zqp9z7cfnifw47hi4a4fww12";
-  };
+  sourceRoot = "${src.name}/pytest-virtualenv";
 
-  nativeCheckInputs = [ pytest pytest-cov mock cmdline ];
-  propagatedBuildInputs = [ pytest-fixture-config pytest-shutil virtualenv ];
-  checkPhase = "py.test tests/unit ";
+  build-system = [ setuptools ];
 
-  nativeBuildInputs = [ pytest ];
+  buildInputs = [ pytest ];
+
+  dependencies = [
+    importlib-metadata
+    pytest-fixture-config
+    pytest-shutil
+    virtualenv
+  ];
+
+  nativeCheckInputs = [
+    cmdline
+    mock
+    pytestCheckHook
+  ];
+
+  # Don't run integration tests
+  disabledTestPaths = [ "tests/integration/*" ];
 
   meta = with lib; {
     description = "Create a Python virtual environment in your test that cleans up on teardown. The fixture has utility methods to install packages and list what’s installed.";
diff --git a/pkgs/development/python-modules/sacn/default.nix b/pkgs/development/python-modules/sacn/default.nix
index 609d8969be6b..f03c7a263271 100644
--- a/pkgs/development/python-modules/sacn/default.nix
+++ b/pkgs/development/python-modules/sacn/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "sacn";
-  version = "1.9.0";
+  version = "1.9.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LimA0I8y1tdjFk244iWvKJj0Rx3OEaYOSIJtirRHh4o=";
+    hash = "sha256-ppXWRBZVm4QroxZ19S388sRuI5zpaDgJrJqhnwefr3k=";
   };
 
   # no tests
diff --git a/pkgs/development/python-modules/sarif-tools/default.nix b/pkgs/development/python-modules/sarif-tools/default.nix
new file mode 100644
index 000000000000..785c26e34529
--- /dev/null
+++ b/pkgs/development/python-modules/sarif-tools/default.nix
@@ -0,0 +1,69 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, poetry-core
+, jsonpath-ng
+, jinja2
+, python
+, python-docx
+, matplotlib
+, pyyaml
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+}:
+
+buildPythonPackage rec {
+  pname = "sarif-tools";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "sarif-tools";
+    rev = "v${version}";
+    hash = "sha256-80amYGnf7xZdpxzTjBGwgg39YN/jJsEkTm0uAlVbH0w=";
+  };
+
+  disabled = pythonOlder "3.8";
+
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = [
+    jsonpath-ng
+    jinja2
+    python
+    python-docx
+    matplotlib
+    pyyaml
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonRelaxDeps = [
+    "python-docx"
+  ];
+
+  disabledTests = [
+    # Broken, re-enable once https://github.com/microsoft/sarif-tools/pull/41 is merged
+    "test_version"
+  ];
+
+  pythonImportsCheck = [
+    "sarif"
+  ];
+
+  meta = {
+    description = "A set of command line tools and Python library for working with SARIF files";
+    homepage = "https://github.com/microsoft/sarif-tools";
+    changelog = "https://github.com/microsoft/sarif-tools/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ puzzlewolf ];
+    mainProgram = "sarif";
+  };
+}
diff --git a/pkgs/development/python-modules/tesla-fleet-api/default.nix b/pkgs/development/python-modules/tesla-fleet-api/default.nix
index fad5795a930e..31317cd7b7b4 100644
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@@ -1,15 +1,16 @@
-{ lib
-, aiohttp
-, aiolimiter
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, setuptools
+{
+  lib,
+  aiohttp,
+  aiolimiter,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "tesla-fleet-api";
-  version = "0.5.6";
+  version = "0.5.9";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -18,12 +19,10 @@ buildPythonPackage rec {
     owner = "Teslemetry";
     repo = "python-tesla-fleet-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dkxKC0WAgfDvUD9YktRrNCgXpw2+6apfsMVqStZICII=";
+    hash = "sha256-aDejd9UHGXkBa5xyCJaLOkT1A2cWmnx1rKJkXjjw0fc=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     aiohttp
@@ -31,11 +30,9 @@ buildPythonPackage rec {
   ];
 
   # Module has no tests
-  doCheck  =false;
+  doCheck = false;
 
-  pythonImportsCheck = [
-    "tesla_fleet_api"
-  ];
+  pythonImportsCheck = [ "tesla_fleet_api" ];
 
   meta = with lib; {
     description = "Python library for Tesla Fleet API and Teslemetry";
diff --git a/pkgs/development/tools/go-minimock/default.nix b/pkgs/development/tools/go-minimock/default.nix
index 10010fa82223..8a02ab2c82da 100644
--- a/pkgs/development/tools/go-minimock/default.nix
+++ b/pkgs/development/tools/go-minimock/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "go-minimock";
-  version = "3.3.7";
+  version = "3.3.8";
 
   src = fetchFromGitHub {
     owner = "gojuno";
     repo = "minimock";
     rev = "v${version}";
-    sha256 = "sha256-jwQT3JmVFS7e6wr+hCFLlA1YhiKdTrMai0RfClJafJQ=";
+    sha256 = "sha256-FPp2CunPCVxuz+MUKyy1HQdWc9TeLG7ri5vI7ig/xeM=";
   };
 
   ldflags = [
     "-s" "-w" "-X main.version=${version}"
   ];
 
-  vendorHash = "sha256-vcYhLMs/skZlhzdeEWUcv28VkRvraavziBwbwrgLZio=";
+  vendorHash = "sha256-O1Bp+zuSq3/UULpej4rXxeHcDiNAhECqj9Yh9aGeA0E=";
 
   doCheck = true;
 
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index a8021045119a..342a2c19e41d 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.58.0";
+  version = "1.58.1";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-qG/H6/FePQFJdiSnf1zh5Pos9KjuicRJ3HzDM0QXPSE=";
+    hash = "sha256-RnrD1KA0XNdFx5bs2vfCoBEuBjtesyyTXAvIWMeRPVQ=";
   };
 
-  vendorHash = "sha256-bT8MUeLk7LgLlqk3aBqsVU139ZH4y1ZFsQ67Lxj4OBg=";
+  vendorHash = "sha256-Q3y4yam9gRFopZbAlLzWSFj59j+WwWeflJMdYmmJh7U=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/development/tools/rust/cargo-binstall/default.nix b/pkgs/development/tools/rust/cargo-binstall/default.nix
index b537a8056cf3..3c7421f84101 100644
--- a/pkgs/development/tools/rust/cargo-binstall/default.nix
+++ b/pkgs/development/tools/rust/cargo-binstall/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-DD9tecF6oZOg501DUMm5KEPC2BOxMa78YGIXLvhsRys=";
+    hash = "sha256-o31/cEkQyn89URqmJpOZHG6YII8VOle1X3vwdgJF334=";
   };
 
-  cargoHash = "sha256-veVE4THR58DAOo0CqMCnN3EqCOEge8K0PvLM0KgHDnI=";
+  cargoHash = "sha256-kZZ2S3XDdCREuit3RIByLXn/tEiqY+Oap242ZXx6y6s=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/sqldef/default.nix b/pkgs/development/tools/sqldef/default.nix
index 571d226ea517..7846d381aef2 100644
--- a/pkgs/development/tools/sqldef/default.nix
+++ b/pkgs/development/tools/sqldef/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "sqldef";
-  version = "0.17.7";
+  version = "0.17.8";
 
   src = fetchFromGitHub {
     owner = "k0kubun";
     repo = "sqldef";
     rev = "v${version}";
-    hash = "sha256-esLS7syckxdYpP3I2kKYXEFpTyV4+VQCiCV5cXJfexs=";
+    hash = "sha256-60CN+Z5YZemYwn7eN0VZ/S8kAmQv6DBA1tCAhDLDKe0=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-hH8dje3ajG1KNi7jEkaEgzCGJuvrZiNhIBC0my0wljM=";
+  vendorHash = "sha256-I1kyXotFYvnL8/FryjKJWGOYSTeXrXNB1+TNgR7q3qo=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/development/tools/yarn-berry/default.nix b/pkgs/development/tools/yarn-berry/default.nix
index 5c00fbbc457b..b7caeb4f823e 100644
--- a/pkgs/development/tools/yarn-berry/default.nix
+++ b/pkgs/development/tools/yarn-berry/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yarn-berry";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchFromGitHub {
     owner = "yarnpkg";
     repo = "berry";
     rev = "@yarnpkg/cli/${finalAttrs.version}";
-    hash = "sha256-id/Z7oqwoIIWaOU5mQ7vuPRQw6WQAKcDAopYB2tEl0s=";
+    hash = "sha256-dOWcfeWotWgx1ctY/TEuxH1gkgp9Gxou6jaymJMBHLE=";
   };
 
   buildInputs = [
diff --git a/pkgs/games/eduke32/convert-bmp-to-png.diff b/pkgs/games/eduke32/convert-bmp-to-png.diff
new file mode 100644
index 000000000000..7d83ce4aabaf
--- /dev/null
+++ b/pkgs/games/eduke32/convert-bmp-to-png.diff
@@ -0,0 +1,23 @@
+diff --git a/GNUmakefile b/GNUmakefile
+index f83f04d..25a4fa8 100644
+--- a/GNUmakefile
++++ b/GNUmakefile
+@@ -798,6 +798,9 @@ libklzw$(DLLSUFFIX): $(engine_src)/klzw.cpp
+ 	$(COMPILE_STATUS)
+ 	$(RECIPE_IF) $(COMPILER_C) -shared -fPIC $< -o $@ $(RECIPE_RESULT_COMPILE)
+ 
++%.png: %.bmp
++	gm convert $< $@
++
+ # to debug the tools link phase, make a copy of this rule explicitly replacing % with the name of a tool, such as kextract
+ %$(EXESUFFIX): $(tools_obj)/%.$o $(foreach i,tools $(tools_deps),$(call expandobjs,$i))
+ 	$(LINK_STATUS)
+@@ -880,7 +883,7 @@ $$($1_obj)/%.$$o: $$($1_rsrc)/%.c | $$($1_obj)
+ 	$$(call MKDIR,$$(dir $$@))
+ 	$$(RECIPE_IF) $$(COMPILER_C) $$($1_cflags) -c $$< -o $$@ $$(RECIPE_RESULT_COMPILE)
+ 
+-$$($1_obj)/%_banner.c: $$($1_rsrc)/%.bmp | $$($1_obj)
++$$($1_obj)/%_banner.c: $$($1_rsrc)/%.png | $$($1_obj)
+ 	echo "#include \"gtkpixdata_shim.h\"" > $$@
+ 	gdk-pixbuf-csource --extern --struct --raw --name=startbanner_pixdata $$^ | sed 's/load_inc//' >> $$@
+ 
diff --git a/pkgs/games/eduke32/default.nix b/pkgs/games/eduke32/default.nix
index 1ddcccd27f9d..5bb9966602d8 100644
--- a/pkgs/games/eduke32/default.nix
+++ b/pkgs/games/eduke32/default.nix
@@ -37,6 +37,12 @@ in stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-dyZ4JtDBxsTDe9uQDWxJe7M74X7m+5wpEHm+i+s9hwo=";
   };
 
+  patches = [
+    # gdk-pixbuf-csource no longer supports bmp so convert to png
+    # patch GNUMakefile to use graphicsmagick to convert bmp -> png
+    ./convert-bmp-to-png.diff
+  ];
+
   buildInputs = [
     flac
     libvorbis
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 745e7df93be6..6cf2b1264f74 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -573,6 +573,7 @@ in python.pkgs.buildPythonApplication rec {
     "orjson"
     "pillow"
     "pyopenssl"
+    "sqlalchemy"
     "typing-extensions"
     "urllib3"
   ];
diff --git a/pkgs/servers/keycloak/default.nix b/pkgs/servers/keycloak/default.nix
index afb70893f898..1792b51abf8d 100644
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@@ -18,11 +18,11 @@ let
   '';
 in stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "24.0.3";
+  version = "24.0.4";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    hash = "sha256-VlCAUAa3e8ho8s1pA935B+bz4mvziDtayu0GB9yOTI4=";
+    hash = "sha256-tqY3rYFRsRpbvms8DVtCp8nXl0hlX1CzuOVFCE+23o4=";
   };
 
   nativeBuildInputs = [ makeWrapper jre ];
diff --git a/pkgs/servers/monitoring/prometheus/snmp-exporter.nix b/pkgs/servers/monitoring/prometheus/snmp-exporter.nix
index 812484fdf615..2f8c4f7ba371 100644
--- a/pkgs/servers/monitoring/prometheus/snmp-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/snmp-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "snmp_exporter";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "prometheus";
     repo = "snmp_exporter";
     rev = "v${version}";
-    sha256 = "sha256-6Y2zJwY5gToJlY6iLug2jNXXtNLNz98WoTKGcWgYzaA=";
+    sha256 = "sha256-6UTvzcN0BB4uLfyZxr8CkmlMAjggYRV/EmQPRD7ZqmY=";
   };
 
-  vendorHash = "sha256-8soLDI/hBzSZB6Lfj1jVkIWfIkMPJmp84bu7TKg7jeo=";
+  vendorHash = "sha256-0WGiVM4HTgcVkCxfjW1c+z1wlf/ay5BXZXuGRPS4guc=";
 
   buildInputs = [ net-snmp ];
 
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 23b659727841..a52099460e78 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -63,11 +63,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "samba";
-  version = "4.20.0";
+  version = "4.20.1";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
-    hash = "sha256-AmclQlEKxuXQyRwMFNkKtObsOXxwnpUsbaOm4LTVpC8=";
+    hash = "sha256-+Tw69SlTQNCBBsfA3PuF5PhQV9/RRYeqiBe+sxr/iPc=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/servers/web-apps/netbox/default.nix b/pkgs/servers/web-apps/netbox/default.nix
index b47ab2cd350b..1459ee23920c 100644
--- a/pkgs/servers/web-apps/netbox/default.nix
+++ b/pkgs/servers/web-apps/netbox/default.nix
@@ -22,8 +22,8 @@ lib.fix (self: {
   };
 
   netbox_3_7 = callPackage generic {
-    version = "3.7.4";
-    hash = "sha256-jQJYtu1K13AsFXx4GTgtMOdppK1Tgoaf2/fKKhS1sQo=";
+    version = "3.7.8";
+    hash = "sha256-61pJbMWXNFnvWI0z9yWvsutdCAP4VydeceANNw0nKsk=";
     extraPatches = [
       # Allow setting the STATIC_ROOT from within the configuration and setting a custom redis URL
       ./config.patch
diff --git a/pkgs/tools/misc/mcfly/default.nix b/pkgs/tools/misc/mcfly/default.nix
index 675639a03294..f9b6e634fd72 100644
--- a/pkgs/tools/misc/mcfly/default.nix
+++ b/pkgs/tools/misc/mcfly/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mcfly";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchFromGitHub {
     owner = "cantino";
     repo = "mcfly";
     rev = "v${version}";
-    hash = "sha256-beoXLTy3XikdZBS0Lh3cugHflNJ51PbqsCE3xtCHpj0=";
+    hash = "sha256-vzGZzZy3VBntsmBcb+APEQTWoz4rsxWAiiInj+E6Xd0=";
   };
 
   postPatch = ''
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
     substituteInPlace mcfly.fish --replace '(command which mcfly)'  '${placeholder "out"}/bin/mcfly'
   '';
 
-  cargoHash = "sha256-wWYpDU6oXT+sDCzX8VWJ6GfNPOi7T02LK0JKcWHFGi8=";
+  cargoHash = "sha256-XASDPF21ZlVTLa0n5MAsm9FZz+ar9KRiPacsx0bX7OA=";
 
   meta = with lib; {
     homepage = "https://github.com/cantino/mcfly";
diff --git a/pkgs/tools/misc/octosql/default.nix b/pkgs/tools/misc/octosql/default.nix
index a42f80d95ff9..675375cb0941 100644
--- a/pkgs/tools/misc/octosql/default.nix
+++ b/pkgs/tools/misc/octosql/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "octosql";
-  version = "0.12.2";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner  = "cube2222";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-jf40w5QkSTAgGu0JA4NeqsasN2TUf9vnKVw5zlZr8Mw=";
+    sha256 = "sha256-kzbIts5d2KmFfaAnOdpIXI1fiqBYXe5t981g4Uyk/cc=";
   };
 
   vendorHash = "sha256-p/2UsvxxywQKtk/9wDa5fjS0z6xLLzDONuQ5AtnUonk=";
diff --git a/pkgs/tools/misc/pre-commit/default.nix b/pkgs/tools/misc/pre-commit/default.nix
index 535ce1a8c4da..122226486bd4 100644
--- a/pkgs/tools/misc/pre-commit/default.nix
+++ b/pkgs/tools/misc/pre-commit/default.nix
@@ -18,7 +18,7 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "pre-commit";
-  version = "3.7.0";
+  version = "3.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonApplication rec {
     owner = "pre-commit";
     repo = "pre-commit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-k9pC/GCtqLlK9PhZmx4EKWT1HDyl+KQubDFDQOZdKUQ=";
+    hash = "sha256-+9NNXM4i6saxktF1pl93dmkrqjsErqMB6kEK3IPQTNQ=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/ip2unix/default.nix b/pkgs/tools/networking/ip2unix/default.nix
index b37d5b1272c8..e30b806c6dc7 100644
--- a/pkgs/tools/networking/ip2unix/default.nix
+++ b/pkgs/tools/networking/ip2unix/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, yaml-cpp, systemd
+{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, pkg-config, yaml-cpp, systemd
 , python3Packages, asciidoc, libxslt, docbook_xml_dtd_45, docbook_xsl
 , libxml2, docbook5
 }:
@@ -14,6 +14,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-+p5wQbX35LAjZ4vIE4AhI4M6gQ7gVviqf9jJDAr9xg8";
   };
 
+  patches = [
+    # https://github.com/nixcloud/ip2unix/pull/35
+    # fix out of range string_view access
+    (fetchpatch {
+      url = "https://github.com/nixcloud/ip2unix/commit/050ddf76b4b925f27e255fbb820b0700407ceb2b.patch";
+      hash = "sha256-5vaLmZmwuiMGV4KnVhuDSnXG1a390aBU51TShwpaMLs=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson ninja pkg-config asciidoc libxslt.bin docbook_xml_dtd_45 docbook_xsl
     libxml2.bin docbook5 python3Packages.pytest python3Packages.pytest-timeout
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index 3cf9c598b4ac..360639fa9ad4 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.18.3";
+  version = "1.18.4";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    hash = "sha256-eqN6Qwq+ofQ9Ed7Viz+DoJQkVTvUTo1U5rVqO1YDp2w=";
+    hash = "sha256-1gZP0PVvYWEfWmTVql+8uyNhcjawBMJKvqy/4sZ0/6Y=";
   };
 
-  cargoHash = "sha256-yJ2Ql6Fo2KaZRmvRB0C14fEcVwbBbsUlcqT3vFKHn58=";
+  cargoHash = "sha256-GZuRz4VtAm+aQO0Hq5v3HVfqjoMPsEw5G6VADsAvdEQ=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/package-management/lix/common.nix b/pkgs/tools/package-management/lix/common.nix
new file mode 100644
index 000000000000..a544707b4f35
--- /dev/null
+++ b/pkgs/tools/package-management/lix/common.nix
@@ -0,0 +1,286 @@
+{
+  lib,
+  fetchFromGitHub,
+  version,
+  suffix ? "",
+  hash ? null,
+  src ? fetchFromGitHub {
+    owner = "lix-project";
+    repo = "lix";
+    rev = version;
+    inherit hash;
+  },
+  docCargoHash ? null,
+  patches ? [ ],
+  maintainers ? lib.teams.lix.members,
+}@args:
+assert (hash == null) -> (src != null);
+{
+  stdenv,
+  meson,
+  bash,
+  bison,
+  boehmgc,
+  boost,
+  brotli,
+  busybox-sandbox-shell,
+  bzip2,
+  callPackage,
+  coreutils,
+  curl,
+  cmake,
+  docbook_xsl_ns,
+  docbook5,
+  doxygen,
+  editline,
+  flex,
+  git,
+  gnutar,
+  gtest,
+  gzip,
+  jq,
+  lib,
+  libarchive,
+  libcpuid,
+  libgit2,
+  libsodium,
+  libxml2,
+  libxslt,
+  lowdown,
+  lsof,
+  man,
+  mercurial,
+  mdbook,
+  mdbook-linkcheck,
+  nlohmann_json,
+  ninja,
+  openssl,
+  toml11,
+  python3,
+  perl,
+  pkg-config,
+  rapidcheck,
+  Security,
+  sqlite,
+  util-linuxMinimal,
+  xz,
+  nixosTests,
+
+  enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
+  enableStatic ? stdenv.hostPlatform.isStatic,
+  withAWS ? !enableStatic && (stdenv.isLinux || stdenv.isDarwin),
+  aws-sdk-cpp,
+  # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50
+  withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
+  libseccomp,
+
+  confDir,
+  stateDir,
+  storeDir,
+}:
+let
+  lix-doc = callPackage ./doc {
+    inherit src;
+    version = "${version}${suffix}";
+    cargoHash = docCargoHash;
+  };
+  self = stdenv.mkDerivation {
+    pname = "lix";
+
+    version = "${version}${suffix}";
+    VERSION_SUFFIX = suffix;
+
+    inherit src patches;
+
+    outputs =
+      [
+        "out"
+        "dev"
+      ]
+      ++ lib.optionals enableDocumentation [
+        "man"
+        "doc"
+      ];
+
+    strictDeps = true;
+
+    nativeBuildInputs =
+      [
+        pkg-config
+        bison
+        flex
+        jq
+        meson
+        ninja
+        cmake
+        python3
+        doxygen
+
+        # Tests
+        git
+        mercurial
+        jq
+        lsof
+      ]
+      ++ lib.optionals (enableDocumentation) [
+        (lib.getBin lowdown)
+        mdbook
+        mdbook-linkcheck
+      ]
+      ++ lib.optionals stdenv.isLinux [ util-linuxMinimal ];
+
+    buildInputs =
+      [
+        boost
+        brotli
+        bzip2
+        curl
+        editline
+        libsodium
+        openssl
+        sqlite
+        xz
+        gtest
+        libarchive
+        lowdown
+        rapidcheck
+        toml11
+        lix-doc
+      ]
+      ++ lib.optionals stdenv.isDarwin [ Security ]
+      ++ lib.optionals (stdenv.isx86_64) [ libcpuid ]
+      ++ lib.optionals withLibseccomp [ libseccomp ]
+      ++ lib.optionals withAWS [ aws-sdk-cpp ];
+
+    propagatedBuildInputs = [
+      boehmgc
+      nlohmann_json
+    ];
+
+    postPatch = ''
+      patchShebangs --build tests
+    '';
+
+    preConfigure =
+      # Copy libboost_context so we don't get all of Boost in our closure.
+      # https://github.com/NixOS/nixpkgs/issues/45462
+      lib.optionalString (!enableStatic) ''
+        mkdir -p $out/lib
+        cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
+        rm -f $out/lib/*.a
+        ${lib.optionalString stdenv.isLinux ''
+          chmod u+w $out/lib/*.so.*
+          patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
+        ''}
+        ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+          for LIB in $out/lib/*.dylib; do
+            chmod u+w $LIB
+            install_name_tool -id $LIB $LIB
+            install_name_tool -delete_rpath ${boost}/lib/ $LIB || true
+          done
+          install_name_tool -change ${boost}/lib/libboost_system.dylib $out/lib/libboost_system.dylib $out/lib/libboost_thread.dylib
+        ''}
+      '';
+
+    mesonFlags =
+      [
+        (lib.mesonEnable "gc" true)
+        (lib.mesonBool "enable-tests" true)
+        (lib.mesonBool "enable-docs" enableDocumentation)
+        (lib.mesonBool "enable-embedded-sandbox-shell" (stdenv.isLinux && stdenv.hostPlatform.isStatic))
+        (lib.mesonEnable "seccomp-sandboxing" withLibseccomp)
+
+        (lib.mesonOption "store-dir" storeDir)
+        (lib.mesonOption "state-dir" stateDir)
+        (lib.mesonOption "sysconfdir" confDir)
+      ]
+      ++ lib.optionals stdenv.isLinux [
+        (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
+      ];
+
+    # Needed for Meson to find Boost.
+    # https://github.com/NixOS/nixpkgs/issues/86131.
+    env = {
+      BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
+      BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
+    };
+
+    postInstall =
+      ''
+        mkdir -p $doc/nix-support
+        echo "doc manual $doc/share/doc/nix/manual" >> $doc/nix-support/hydra-build-products
+      ''
+      + lib.optionalString stdenv.hostPlatform.isStatic ''
+        mkdir -p $out/nix-support
+        echo "file binary-dist $out/bin/nix" >> $out/nix-support/hydra-build-products
+      ''
+      + lib.optionalString stdenv.isDarwin ''
+        for lib in libnixutil.dylib libnixexpr.dylib; do
+          install_name_tool \
+            -change "${lib.getLib boost}/lib/libboost_context.dylib" \
+            "$out/lib/libboost_context.dylib" \
+            "$out/lib/$lib"
+        done
+      '';
+
+    doCheck = true;
+    mesonCheckFlags = [ "--suite=check" ];
+    checkInputs = [
+      gtest
+      rapidcheck
+    ];
+
+    doInstallCheck = true;
+    mesonInstallCheckFlags = [ "--suite=installcheck" ];
+
+    preInstallCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # socket path becomes too long otherwise
+      export TMPDIR=$NIX_BUILD_TOP
+      # Prevent crashes in libcurl due to invoking Objective-C `+initialize` methods after `fork`.
+      # See http://sealiesoftware.com/blog/archive/2017/6/5/Objective-C_and_fork_in_macOS_1013.html.
+      export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+    '';
+
+    installCheckPhase = ''
+      runHook preInstallCheck
+      flagsArray=($mesonInstallCheckFlags "''${mesonInstallCheckFlagsArray[@]}")
+      meson test --no-rebuild "''${flagsArray[@]}"
+      runHook postInstallCheck
+    '';
+    # strictoverflow is disabled because we trap on signed overflow instead
+    hardeningDisable = [ "strictoverflow" ] ++ lib.optional stdenv.hostPlatform.isStatic "pie";
+    # hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
+    # hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
+    separateDebugInfo = stdenv.isLinux && !enableStatic;
+    enableParallelBuilding = true;
+
+    passthru = {
+      inherit aws-sdk-cpp boehmgc;
+      tests = {
+        misc = nixosTests.misc.lix.passthru.override { nixPackage = self; };
+      };
+    };
+
+    # point 'nix edit' and ofborg at the file that defines the attribute,
+    # not this common file.
+    pos = builtins.unsafeGetAttrPos "version" args;
+    meta = with lib; {
+      description = "Powerful package manager that makes package management reliable and reproducible";
+      longDescription = ''
+        Lix (a fork of Nix) is a powerful package manager for Linux and other Unix systems that
+        makes package management reliable and reproducible. It provides atomic
+        upgrades and rollbacks, side-by-side installation of multiple versions of
+        a package, multi-user package management and easy setup of build
+        environments.
+      '';
+      homepage = "https://lix.systems";
+      license = licenses.lgpl21Plus;
+      inherit maintainers;
+      platforms = platforms.unix;
+      outputsToInstall = [ "out" ] ++ optional enableDocumentation "man";
+      mainProgram = "nix";
+      broken = enableStatic;
+    };
+  };
+in
+self
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
new file mode 100644
index 000000000000..9a03e64f8b8f
--- /dev/null
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  aws-sdk-cpp,
+  boehmgc,
+  callPackage,
+  fetchFromGitHub,
+  Security,
+
+  storeDir ? "/nix/store",
+  stateDir ? "/nix/var",
+  confDir ? "/etc",
+}:
+let
+  boehmgc-nix_2_3 = boehmgc.override { enableLargeConfig = true; };
+
+  boehmgc-nix = boehmgc-nix_2_3.overrideAttrs (drv: {
+    patches = (drv.patches or [ ]) ++ [
+      # Part of the GC solution in https://github.com/NixOS/nix/pull/4944
+      ../nix/patches/boehmgc-coroutine-sp-fallback.patch
+    ];
+  });
+
+  aws-sdk-cpp-nix =
+    (aws-sdk-cpp.override {
+      apis = [
+        "s3"
+        "transfer"
+      ];
+      customMemoryManagement = false;
+    }).overrideAttrs
+      {
+        # only a stripped down version is build which takes a lot less resources to build
+        requiredSystemFeatures = [ ];
+      };
+
+  common =
+    args:
+    callPackage (import ./common.nix ({ inherit lib fetchFromGitHub; } // args)) {
+      inherit
+        Security
+        storeDir
+        stateDir
+        confDir
+        ;
+      boehmgc = boehmgc-nix;
+      aws-sdk-cpp = aws-sdk-cpp-nix;
+    };
+in
+lib.makeExtensible (self: ({
+  lix_2_90 = (
+    common {
+      version = "2.90-beta.1";
+      hash = "sha256-REWlo2RYHfJkxnmZTEJu3Cd/2VM+wjjpPy7Xi4BdDTQ=";
+      docCargoHash = "sha256-oH248kR4Of0MhcY2DYxNX0A+/XJ3L+UuIpBKn3sJt54=";
+    }
+  );
+
+  latest = self.lix_2_90;
+  stable = self.lix_2_90;
+}))
diff --git a/pkgs/tools/package-management/lix/doc/default.nix b/pkgs/tools/package-management/lix/doc/default.nix
new file mode 100644
index 000000000000..a3c1d7d9ccc5
--- /dev/null
+++ b/pkgs/tools/package-management/lix/doc/default.nix
@@ -0,0 +1,12 @@
+{
+  src,
+  rustPlatform,
+  version,
+  cargoHash,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "lix-doc";
+  sourceRoot = "${src.name}/lix-doc";
+  inherit version src cargoHash;
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c3f2dfd0d567..17d0a42d7245 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7807,8 +7807,6 @@ with pkgs;
 
   endlessh = callPackage ../servers/endlessh { };
 
-  endlessh-go = callPackage ../servers/endlessh-go { };
-
   ericw-tools = callPackage ../applications/misc/ericw-tools { };
 
   cryfs = callPackage ../tools/filesystems/cryfs { };
@@ -19528,8 +19526,6 @@ with pkgs;
 
   scala-cli = callPackage ../development/tools/build-managers/scala-cli { };
 
-  scc = callPackage ../development/tools/misc/scc { };
-
   scss-lint = callPackage ../development/tools/scss-lint { };
 
   segger-ozone = callPackage ../development/tools/misc/segger-ozone { };
@@ -39589,6 +39585,16 @@ with pkgs;
 
   nixStatic = pkgsStatic.nix;
 
+  lixVersions = recurseIntoAttrs (callPackage ../tools/package-management/lix {
+    storeDir = config.nix.storeDir or "/nix/store";
+    stateDir = config.nix.stateDir or "/nix/var";
+    inherit (darwin.apple_sdk.frameworks) Security;
+  });
+
+  lix = lixVersions.stable;
+
+  lixStatic = pkgsStatic.lix;
+
   inherit (callPackages ../applications/networking/cluster/nixops { })
     nixops_unstable_minimal
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 58369488b7b4..8bcc10a3327c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -13564,6 +13564,8 @@ self: super: with self; {
 
   sarif-om = callPackage ../development/python-modules/sarif-om { };
 
+  sarif-tools = callPackage ../development/python-modules/sarif-tools { };
+
   sarge = callPackage ../development/python-modules/sarge { };
 
   sasmodels = callPackage ../development/python-modules/sasmodels { };