diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index df3308c01abf..fca7b1e13d2c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4239,6 +4239,11 @@
     githubId = 111202;
     name = "Henry Bubert";
   };
+  cryptoluks = {
+    github = "cryptoluks";
+    githubId = 9020527;
+    name = "cryptoluks";
+  };
   CrystalGamma = {
     email = "nixos@crystalgamma.de";
     github = "CrystalGamma";
diff --git a/nixos/modules/programs/steam.nix b/nixos/modules/programs/steam.nix
index d317398495f5..d76863aff83b 100644
--- a/nixos/modules/programs/steam.nix
+++ b/nixos/modules/programs/steam.nix
@@ -192,5 +192,5 @@ in {
     ];
   };
 
-  meta.maintainers = lib.teams.steam;
+  meta.maintainers = lib.teams.steam.members;
 }
diff --git a/nixos/modules/services/admin/pgadmin.nix b/nixos/modules/services/admin/pgadmin.nix
index ead0c3c6c9a3..b3dd3c78874c 100644
--- a/nixos/modules/services/admin/pgadmin.nix
+++ b/nixos/modules/services/admin/pgadmin.nix
@@ -152,7 +152,8 @@ in
         # Check here for password length to prevent pgadmin from starting
         # and presenting a hard to find error message
         # see https://github.com/NixOS/nixpkgs/issues/270624
-        PW_LENGTH=$(wc -m < ${escapeShellArg cfg.initialPasswordFile})
+        PW_FILE="$CREDENTIALS_DIRECTORY/initial_password"
+        PW_LENGTH=$(wc -m < "$PW_FILE")
         if [ $PW_LENGTH -lt ${toString cfg.minimumPasswordLength} ]; then
             echo "Password must be at least ${toString cfg.minimumPasswordLength} characters long"
             exit 1
@@ -162,7 +163,7 @@ in
           echo ${escapeShellArg cfg.initialEmail}
 
           # file might not contain newline. echo hack fixes that.
-          PW=$(cat ${escapeShellArg cfg.initialPasswordFile})
+          PW=$(cat "$PW_FILE")
 
           # Password:
           echo "$PW"
@@ -181,6 +182,8 @@ in
         LogsDirectory = "pgadmin";
         StateDirectory = "pgadmin";
         ExecStart = "${cfg.package}/bin/pgadmin4";
+        LoadCredential = [ "initial_password:${cfg.initialPasswordFile}" ]
+          ++ optional cfg.emailServer.enable "email_password:${cfg.emailServer.passwordFile}";
       };
     };
 
@@ -193,7 +196,8 @@ in
 
     environment.etc."pgadmin/config_system.py" = {
       text = lib.optionalString cfg.emailServer.enable ''
-        with open("${cfg.emailServer.passwordFile}") as f:
+        import os
+        with open(os.path.join(os.environ['CREDENTIALS_DIRECTORY'], 'email_password')) as f:
           pw = f.read()
         MAIL_PASSWORD = pw
       '' + formatPy cfg.settings;
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index cc32b2a15e7c..6107a2594baf 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -473,8 +473,8 @@ in {
         "${cfg.package.util-linux}/bin/umount"
         "${cfg.package.util-linux}/bin/sulogin"
 
-        # required for script services
-        "${pkgs.runtimeShell}"
+        # required for script services, and some tools like xfs still want the sh symlink
+        "${pkgs.bash}/bin"
 
         # so NSS can look up usernames
         "${pkgs.glibc}/lib/libnss_files.so.2"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index ccde1a9feb2a..e40054923262 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -588,7 +588,7 @@ in {
   mysql-backup = handleTest ./mysql/mysql-backup.nix {};
   mysql-replication = handleTest ./mysql/mysql-replication.nix {};
   n8n = handleTest ./n8n.nix {};
-  nagios = handleTest ./nagios.nix {};
+  nagios = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./nagios.nix {};
   nar-serve = handleTest ./nar-serve.nix {};
   nat.firewall = handleTest ./nat.nix { withFirewall = true; };
   nat.standalone = handleTest ./nat.nix { withFirewall = false; };
diff --git a/nixos/tests/installer-systemd-stage-1.nix b/nixos/tests/installer-systemd-stage-1.nix
index 1dd55dada042..00205f941771 100644
--- a/nixos/tests/installer-systemd-stage-1.nix
+++ b/nixos/tests/installer-systemd-stage-1.nix
@@ -19,7 +19,7 @@
     luksroot
     luksroot-format1
     luksroot-format2
-    # lvm
+    lvm
     separateBoot
     separateBootFat
     separateBootZfs
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index b034d21146f3..3f57a64333dd 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -974,6 +974,9 @@ in {
           "mount LABEL=nixos /mnt",
       )
     '';
+    extraConfig = optionalString systemdStage1 ''
+      boot.initrd.services.lvm.enable = true;
+    '';
   };
 
   # Boot off an encrypted root partition with the default LUKS header format
diff --git a/pkgs/applications/blockchains/electrs/default.nix b/pkgs/applications/blockchains/electrs/default.nix
index 2401231367ef..e289aede5473 100644
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "electrs";
-  version = "0.10.1";
+  version = "0.10.5";
 
   src = fetchFromGitHub {
     owner = "romanz";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cRnCo/N0k5poiOh308Djw6bySFQFIY3GiD2qjRyMjLM=";
+    hash = "sha256-tAHN5HWI9XsiCQzqLNtiib9wMskjfogc44+b4Bsjpog=";
   };
 
-  cargoHash = "sha256-fsYJ+80se5VsIaRkFgwJaPPgRw/WdsecRTt6EIjoQTQ=";
+  cargoHash = "sha256-M0DIKt41K3BcP43+fBhv3HbRcIh8U9nhQYA/sm+bNow=";
 
   # needed for librocksdb-sys
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
diff --git a/pkgs/applications/editors/heh/default.nix b/pkgs/applications/editors/heh/default.nix
index 0b31e30e67f5..23d9ffafea20 100644
--- a/pkgs/applications/editors/heh/default.nix
+++ b/pkgs/applications/editors/heh/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , rustPlatform
 , fetchFromGitHub
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -15,6 +16,10 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-zkb+HogwioqxZ+BTl7bcDQx9i9uWhT2QdAIXpHqvDl0=";
   };
 
+  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    AppKit
+  ]);
+
   cargoHash = "sha256-YcTaLq04NhmnJ1pdbiKMRIBSFvHNWNgoAS8Uz8uGGAw=";
 
   meta = with lib; {
diff --git a/pkgs/applications/editors/kakoune/default.nix b/pkgs/applications/editors/kakoune/default.nix
index 9a3522c5a531..a1319f573546 100644
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kakoune-unwrapped";
-  version = "2024.05.09";
+  version = "2024.05.18";
   src = fetchFromGitHub {
     repo = "kakoune";
     owner = "mawww";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Dfp33zk9ZUMrCZRfPNfoSX6rgQKItvOQx+CuRNQgtTA=";
+    hash = "sha256-1nYSVbvQ4tz1r8p7zCD6w/79haqpelb15qva9r3Fwew=";
   };
   makeFlags = [ "debug=no" "PREFIX=${placeholder "out"}" ];
 
diff --git a/pkgs/applications/misc/collision/default.nix b/pkgs/applications/misc/collision/default.nix
index f550e48ba954..8fd8ad8f33ba 100644
--- a/pkgs/applications/misc/collision/default.nix
+++ b/pkgs/applications/misc/collision/default.nix
@@ -4,34 +4,59 @@
 , crystal
 , wrapGAppsHook4
 , desktopToDarwinBundle
-, gi-crystal
 , gobject-introspection
+, gnome
+, python3
 , libadwaita
 , openssl
 , libxml2
 , pkg-config
+, gitUpdater
+, _experimental-update-script-combinators
+, runCommand
+, crystal2nix
+, writeShellScript
 }:
+
 crystal.buildCrystalPackage rec {
   pname = "Collision";
-  version = "3.6.0";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "GeopJr";
     repo = "Collision";
     rev = "v${version}";
-    hash = "sha256-Qxe4ILDdfYfxu95EvKRTvkAOgDIZDiLymBlZouBWn0M=";
+    hash = "sha256-Bo/u0UYM/N7tLqdCs2OU5pdj2s9LXPooSR1PCGk9dSc=";
   };
-  patches = [ ./make.patch ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail 'gtk-update-icon-cache $(PREFIX)/share/icons/hicolor' 'true'
+  '';
+
   shardsFile = ./shards.nix;
+  copyShardDeps = true;
+
+  preBuild = ''
+    cd lib/gi-crystal && shards build -Dpreview_mt --release --no-debug
+    cd ../.. && mkdir bin/ && cp lib/gi-crystal/bin/gi-crystal bin/
+  '';
 
   # Crystal compiler has a strange issue with OpenSSL. The project will not compile due to
   # main_module:(.text+0x6f0): undefined reference to `SSL_library_init'
   # There is an explanation for this https://danilafe.com/blog/crystal_nix_revisited/
   # Shortly, adding pkg-config to buildInputs along with openssl fixes the issue.
 
-  nativeBuildInputs = [ wrapGAppsHook4 pkg-config gobject-introspection gi-crystal ]
+  nativeBuildInputs = [ wrapGAppsHook4 pkg-config gobject-introspection ]
     ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
-  buildInputs = [ libadwaita openssl libxml2 ];
+
+  buildInputs = [
+    libadwaita
+    openssl
+    libxml2
+    gnome.nautilus-python
+    python3.pkgs.pygobject3
+  ];
 
   buildTargets = ["bindings" "build"];
 
@@ -40,6 +65,22 @@ crystal.buildCrystalPackage rec {
 
   installTargets = ["desktop" "install"];
 
+  postInstall = ''
+      install -Dm555 ./nautilus-extension/collision-extension.py -t $out/share/nautilus-python/extensions
+  '';
+
+  passthru = {
+    updateScript = _experimental-update-script-combinators.sequence [
+      (gitUpdater { rev-prefix = "v"; })
+      (_experimental-update-script-combinators.copyAttrOutputToFile "collision.shardLock" ./shard.lock)
+      { command = [ (writeShellScript "update-lock" "cd $1; ${lib.getExe crystal2nix}") ./. ]; supportedFeatures = [ "silent" ]; }
+      { command = [ "rm" ./shard.lock ]; supportedFeatures = [ "silent" ]; }
+    ];
+    shardLock = runCommand "shard.lock" { inherit src; } ''
+      cp $src/shard.lock $out
+    '';
+  };
+
   meta = with lib; {
     description = "Check hashes for your files";
     homepage = "https://github.com/GeopJr/Collision";
diff --git a/pkgs/applications/misc/collision/make.patch b/pkgs/applications/misc/collision/make.patch
deleted file mode 100644
index 73872a789278..000000000000
--- a/pkgs/applications/misc/collision/make.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/Makefile	2023-07-09 10:49:31.064190374 +0300
-+++ b/Makefile	2023-07-19 11:19:37.415480179 +0300
-@@ -6,7 +6,7 @@
- all: desktop bindings build
- 
- bindings: 
--	./bin/gi-crystal || $(CRYSTAL_LOCATION)shards install && ./bin/gi-crystal
-+	gi-crystal
- 
- build:
- 	COLLISION_LOCALE_LOCATION="$(PREFIX)$(LOCALE_LOCATION)" $(CRYSTAL_LOCATION)shards build -Dpreview_mt --release --no-debug
-@@ -43,7 +43,7 @@
- 	install -D -m 0644 data/dev.geopjr.Collision.desktop $(PREFIX)/share/applications/dev.geopjr.Collision.desktop
- 	install -D -m 0644 data/icons/dev.geopjr.Collision.svg $(PREFIX)/share/icons/hicolor/scalable/apps/dev.geopjr.Collision.svg
- 	install -D -m 0644 data/icons/dev.geopjr.Collision-symbolic.svg $(PREFIX)/share/icons/hicolor/symbolic/apps/dev.geopjr.Collision-symbolic.svg
--	gtk-update-icon-cache $(PREFIX)/share/icons/hicolor
-+	gtk4-update-icon-cache --ignore-theme-index $(PREFIX)/share/icons/hicolor
- 	glib-compile-schemas $(PREFIX)/share/glib-2.0/schemas/
- 
- uninstall:
\ No newline at end of file
diff --git a/pkgs/applications/misc/collision/shards.nix b/pkgs/applications/misc/collision/shards.nix
index e7e93781eb68..e1b6032d5932 100644
--- a/pkgs/applications/misc/collision/shards.nix
+++ b/pkgs/applications/misc/collision/shards.nix
@@ -1,18 +1,23 @@
 {
+  blake3 = {
+    url = "https://github.com/geopjr/blake3.cr.git";
+    rev = "v1.3.0";
+    sha256 = "0pc3h7b5gfkmxlw708qaqjfzjvv5ig3iwxxainq6pwfhpff4a5wd";
+  };
   gettext = {
     url = "https://github.com/geopjr/gettext.cr.git";
     rev = "v1.0.0";
     sha256 = "1y27m4170rr4532j56grzhwbz8hj6z7j3zfkd0jnfwnsxclks1kc";
   };
-  gio = {
-    url = "https://github.com/hugopl/gio.cr.git";
-    rev = "v0.1.0";
-    sha256 = "0vj35bi64d4hni18nrl8fmms306a0gl4zlxpf3aq08lh0sbwzhd8";
+  gi-crystal = {
+    url = "https://github.com/hugopl/gi-crystal.git";
+    rev = "v0.22.2";
+    sha256 = "0bpa1f8iaf97z2kbgjc7nc8km7nd7bppiwna319lm2hvm8m5pw15";
   };
   gtk4 = {
     url = "https://github.com/hugopl/gtk4.cr.git";
-    rev = "v0.15.0";
-    sha256 = "100j5k4sfc2dpj3nplzjcaxw1bwy3hsy5cw93asg00kda9h8dbb1";
+    rev = "v0.16.1";
+    sha256 = "1cqkbh072y70l8g0p040vf50k920p32ry1larnwn9mqabd74jwaj";
   };
   harfbuzz = {
     url = "https://github.com/hugopl/harfbuzz.cr.git";
@@ -26,12 +31,12 @@
   };
   non-blocking-spawn = {
     url = "https://github.com/geopjr/non-blocking-spawn.git";
-    rev = "v1.0.5";
-    sha256 = "139gr87zlw0k9kf6pf9k2d88aa9x3kcnfg34qpbqrwsrck7708za";
+    rev = "v1.1.0";
+    sha256 = "1h43gskannylaai4dz2sjb6rds2h6slm1krg88inan12silhp66c";
   };
   pango = {
     url = "https://github.com/hugopl/pango.cr.git";
-    rev = "v0.2.0";
-    sha256 = "0dl3qrhi2ybylmvzx1x5gsznp2pcdkc50waxrljxwnf5avn8ixsf";
+    rev = "v0.3.1";
+    sha256 = "0xlf127flimnll875mcq92q7xsi975rrgdpcpmnrwllhdhfx9qmv";
   };
 }
diff --git a/pkgs/applications/misc/process-compose/default.nix b/pkgs/applications/misc/process-compose/default.nix
index 78a122528707..9cda45b04c32 100644
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "1.5.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-OxEo5fkRSdEZLyvK4Pt3EOWLO0ph6RkSD2OOeAWg72M=";
+    hash = "sha256-yFKqdUlfiMQbx3yJLD5/BJ8pecg5NRr64+HbUwsEOE4=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -43,7 +43,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  vendorHash = "sha256-X4pMes9hLMF8bZ6MX5cZdm4HfjnHYshGlA/lXlHr1Ow=";
+  vendorHash = "sha256-c53Af0X/TUFsxpV4YE525uh+yLG/t2tSmQkr9ElziBM=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/taskwarrior-tui/default.nix b/pkgs/applications/misc/taskwarrior-tui/default.nix
index 922a7d19d4f9..e96478d96c68 100644
--- a/pkgs/applications/misc/taskwarrior-tui/default.nix
+++ b/pkgs/applications/misc/taskwarrior-tui/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "taskwarrior-tui";
-  version = "0.26.0";
+  version = "0.26.3";
 
   src = fetchFromGitHub {
     owner = "kdheepak";
     repo = "taskwarrior-tui";
     rev = "v${version}";
-    sha256 = "sha256-/OIBWUDMPMbCFLnoCJORgzlhUAqlFIItXQSzLTWZ7Jo=";
+    sha256 = "sha256-8PFGlsm9B6qHRrY7YIPwknmGS+Peg5MWd0kMT173wIQ=";
   };
 
-  cargoHash = "sha256-JR6KX5x8BLfX8keofoYqS2eftCDoMLg25OMfTf0k53Q=";
+  cargoHash = "sha256-Cd319GCvdh6S8OO2ylKs1H2+zO4Uq1tgNakghVD12BA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/xpipe/default.nix b/pkgs/applications/networking/xpipe/default.nix
index 00329886b299..c099f1c5d14c 100644
--- a/pkgs/applications/networking/xpipe/default.nix
+++ b/pkgs/applications/networking/xpipe/default.nix
@@ -33,14 +33,14 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-yz8D40ckr6oydlY6+kjQqXtWQ6Q+ZmGQccNVBFbW3/k=";
+    x86_64-linux = "sha256-PFAs/HoQsTqgThN5jdfwU07QNxThBrO7ES1D7GZCPH0=";
   }.${system} or throwSystem;
 
   displayname = "XPipe";
 
 in stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "9.2";
+  version = "9.3";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";
diff --git a/pkgs/applications/office/trilium/desktop.nix b/pkgs/applications/office/trilium/desktop.nix
index e2ad6d5d5f82..9681c5fc9b8a 100644
--- a/pkgs/applications/office/trilium/desktop.nix
+++ b/pkgs/applications/office/trilium/desktop.nix
@@ -7,13 +7,13 @@
 
 let
   pname = "trilium-desktop";
-  version = "0.63.5";
+  version = "0.63.6";
 
   linuxSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-  linuxSource.sha256 = "1a2h96gd04mqn6cskjhj657dx9wqvlqsvgydjbaqpwc8593swpb3";
+  linuxSource.sha256 = "12kgq5x4f93hxz057zqhz0x1y0rxfxh90fv9fjjs3jrnk0by7f33";
 
   darwinSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-mac-x64-${version}.zip";
-  darwinSource.sha256 = "155y85vsawrqd0wcdpl87sv9s2nkamc73aiklsw8nbw1x96hqvap";
+  darwinSource.sha256 = "0ry512cn622av3nm8rnma2yvqc71rpzax639872ivvc5vm4rsc30";
 
   meta = metaCommon // {
     mainProgram = "trilium";
diff --git a/pkgs/applications/office/trilium/server.nix b/pkgs/applications/office/trilium/server.nix
index 09983d4d0091..4d6dbaa0f7cf 100644
--- a/pkgs/applications/office/trilium/server.nix
+++ b/pkgs/applications/office/trilium/server.nix
@@ -3,8 +3,8 @@
 
 let
   serverSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-  serverSource.sha256 = "02kd7gm93nmxsxy1bx5kac7jizslik9nlfcnq8kn6mprfcv8anfn";
-  version = "0.63.5";
+  serverSource.sha256 = "0gwp6h6nvfzq7k1g3233h838nans45jkd5c3pzl6qdhhm19vcs27";
+  version = "0.63.6";
 in stdenv.mkDerivation {
   pname = "trilium-server";
   inherit version;
diff --git a/pkgs/applications/science/biology/seqkit/default.nix b/pkgs/applications/science/biology/seqkit/default.nix
index 5c46e25f5d6d..0fbda84ccea7 100644
--- a/pkgs/applications/science/biology/seqkit/default.nix
+++ b/pkgs/applications/science/biology/seqkit/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "seqkit";
-  version = "2.8.1";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "shenwei356";
     repo = "seqkit";
     rev = "v${version}";
-    sha256 = "sha256-LtPf99spy2ByTnSMJ5k1mWkh+Nct3Fg4Y9mXARxuXlA=";
+    sha256 = "sha256-jCzd36ds9YVBpnyR3gDJSX3CCVXzC9WkQWmkcDiDWfM=";
   };
 
   vendorHash = "sha256-0//kySYhNmfiwiys/Ku0/8RzKpnxO0+byD8pcIkvDY0=";
diff --git a/pkgs/applications/version-management/git-quick-stats/default.nix b/pkgs/applications/version-management/git-quick-stats/default.nix
index e8292e84af45..5f845a510fd6 100644
--- a/pkgs/applications/version-management/git-quick-stats/default.nix
+++ b/pkgs/applications/version-management/git-quick-stats/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-quick-stats";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchFromGitHub {
     repo = "git-quick-stats";
     owner = "arzzen";
     rev = version;
-    sha256 = "sha256-7riA3yYw2D8+x/wzzbv0RF+zHCtqVC1ZpVANZp9x2AQ=";
+    sha256 = "sha256-xd/ItpngreR77QTsSHLCgZfyvUZXBfOVPJaVtBZ2iTc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/video/kodi/addons/jellyfin/default.nix b/pkgs/applications/video/kodi/addons/jellyfin/default.nix
index 7623a3c4db13..9f16d0a86f7e 100644
--- a/pkgs/applications/video/kodi/addons/jellyfin/default.nix
+++ b/pkgs/applications/video/kodi/addons/jellyfin/default.nix
@@ -5,13 +5,13 @@ in
 buildKodiAddon rec {
   pname = "jellyfin";
   namespace = "plugin.video.jellyfin";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-kodi";
     rev = "v${version}";
-    sha256 = "sha256-yCgsQnzmlmyYAjp1q0J9QxGDRg5JCd23H9xgVozHiGM=";
+    sha256 = "sha256-Uyo8GClJU2/gdk4PeFNnoyvxOhooaxeXN3Wc5YGuCiM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/mpv/scripts/mpv-webm.nix b/pkgs/applications/video/mpv/scripts/mpv-webm.nix
index 051cc76883c4..409d86c193f4 100644
--- a/pkgs/applications/video/mpv/scripts/mpv-webm.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-webm.nix
@@ -8,13 +8,13 @@
 
 buildLua {
   pname = "mpv-webm";
-  version = "0-unstable-2024-04-22";
+  version = "0-unstable-2024-05-13";
 
   src = fetchFromGitHub {
     owner = "ekisu";
     repo = "mpv-webm";
-    rev = "225e8e53842f7da6f77034309c1e54293dc629a4";
-    hash = "sha256-82xWiuOChxfzX6e0+cGFxTqyuiPefyVwpvLM5ka7nPk=";
+    rev = "8d4902b2aec92f40e4595ec9a411ab90488dcf4e";
+    hash = "sha256-aPPVAZu9reDdyovSpDklYZYLaapKBclAx3lCYUMJt+w=";
   };
   passthru.updateScript = unstableGitUpdater {
     # only "latest" tag pointing at HEAD
diff --git a/pkgs/applications/video/vdr/softhddevice/default.nix b/pkgs/applications/video/vdr/softhddevice/default.nix
index 9271a9bf7064..e4dc348fa740 100644
--- a/pkgs/applications/video/vdr/softhddevice/default.nix
+++ b/pkgs/applications/video/vdr/softhddevice/default.nix
@@ -14,12 +14,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vdr-softhddevice";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "ua0lnj";
     repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-qyl4XDLJ99QXQY0XXYMteja0oWZ+vkFa4RwEo1Hv3bo=";
+    sha256 = "sha256-hg4zx3M5X56u3AqG8Aj9DDDB/V0w4EiU9EAz8Qe+NVY=";
     rev = "v${version}";
   };
 
diff --git a/pkgs/applications/virtualization/colima/default.nix b/pkgs/applications/virtualization/colima/default.nix
index e9e769767358..b3b981079d84 100644
--- a/pkgs/applications/virtualization/colima/default.nix
+++ b/pkgs/applications/virtualization/colima/default.nix
@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.6.8";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-9mBjK+VArfsLfwRRIFn8kY2scAtvIjIMWX84Bi7MBvU=";
+    hash = "sha256-7kaZ55Uhvx8V75IgURD03fLoAd/O/+2h/7tv9XiqnX4=";
     # We need the git revision
     leaveDotGit = true;
     postFetch = ''
@@ -35,7 +35,7 @@ buildGoModule rec {
   nativeBuildInputs = [ installShellFiles makeWrapper ]
     ++ lib.optionals stdenv.isDarwin [ darwin.DarwinTools ];
 
-  vendorHash = "sha256-QS0TwXI2Md+PXmT2UrzCMQoHRj+wjTSjWPv9CeVzyFU=";
+  vendorHash = "sha256-FPcz109zQBHaS/bIl78rVeiEluR1PhrJhgs21Ex6qEg=";
 
   # disable flaky Test_extractZones
   # https://hydra.nixos.org/build/212378003/log
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index 5bbb8b217525..6d6fd23717e5 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.21.3";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-niEuOsSOjHDP4KEax/OqQfxWC3XmTRUKB8k0DQ3Ybq0=";
+    sha256 = "sha256-O2A75cjTU72DGrg4PmEogN9aANYKIZWUkXfIJXs7CwA=";
   };
 
-  cargoHash = "sha256-LMVYrxYpkwM9rdGkKaeLFKB+B2HI+AEDwrdBCAFLpJQ=";
+  cargoHash = "sha256-FS38zqPtmtyV6oSjfxtNMe8n+LMTU1eBN6oX6CGph6k=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/by-name/ca/canon-capt/package.nix b/pkgs/by-name/ca/canon-capt/package.nix
new file mode 100644
index 000000000000..e2f77fee9c07
--- /dev/null
+++ b/pkgs/by-name/ca/canon-capt/package.nix
@@ -0,0 +1,71 @@
+{
+  autoconf,
+  automake,
+  cups,
+  fetchFromGitHub,
+  lib,
+  stdenv,
+}:
+
+let
+  version = "0.1.4.2-GxB";
+in
+stdenv.mkDerivation {
+  pname = "canon-capt";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "mounaiban";
+    repo = "captdriver";
+    rev = "8ecc3cde1ae9a20dcb015994bb0fea0dbefa2b83";
+    hash = "sha256-FslofWZNmF7G9+lmw1JehRBYZIAXcg6Dmv9xJ/c4Evo=";
+  };
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+  ];
+
+  buildInputs = [ cups ];
+
+  # Fix for 'ppdc: Unable to find include file "<font.defs>"', which blocks '*.ppd' generation.
+  # Issue occurs in hermetic sandbox; this workaround is the current solution.
+  # Source: https://github.com/NixOS/nixpkgs/blob/9997402000a82eda4327fde36291234118c7515e/pkgs/misc/drivers/hplip/default.nix#L160
+  CUPS_DATADIR = "${cups}/share/cups";
+
+  configurePhase = ''
+    runHook preConfigure
+    aclocal
+    autoconf
+    automake --add-missing
+    ./configure --prefix=$out/usr
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    make
+    make ppd
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/lib/cups/filter
+    install -D -m 755 ./src/rastertocapt $out/lib/cups/filter/rastertocapt
+
+    mkdir -p $out/share/cups/model/canon
+    install -D -m 644 ./ppd/CanonLBP-2900-3000.ppd $out/share/cups/model/canon/CanonLBP-2900-3000.ppd
+    install -D -m 644 ./ppd/CanonLBP-3010-3018-3050.ppd $out/share/cups/model/canon/CanonLBP-3010-3018-3050.ppd
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Community-driven driver for Canon CAPT-based printers";
+    homepage = "https://github.com/mounaiban/captdriver";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ cryptoluks ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ff/ff2mpv-rust/package.nix b/pkgs/by-name/ff/ff2mpv-rust/package.nix
index 8114704b982c..a0d78cb2c3bc 100644
--- a/pkgs/by-name/ff/ff2mpv-rust/package.nix
+++ b/pkgs/by-name/ff/ff2mpv-rust/package.nix
@@ -23,16 +23,16 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "ff2mpv-rust";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "ryze312";
     repo = "ff2mpv-rust";
     rev = version;
-    hash = "sha256-gk3MqoMCau6RTlttTLqFtlXhrYMOf89YFg8aAlh++9s=";
+    hash = "sha256-lQ1VRz/1HYZ3Il/LNNL+Jr6zFvGyxw9rUuzCCA1DZYo=";
   };
 
-  cargoHash = "sha256-NjzqzfueqR1MNR23lRYj7IYIa+OHzVhpuAo18avKMUk=";
+  cargoHash = "sha256-cbueToB7zDHV4k9K8RusHjnMR0ElXsPEfuqHYli25nc=";
 
   postInstall = ''
     $out/bin/ff2mpv-rust manifest > manifest.json
diff --git a/pkgs/by-name/in/invidtui/package.nix b/pkgs/by-name/in/invidtui/package.nix
index d141398a2f9d..68f31ed6f10b 100644
--- a/pkgs/by-name/in/invidtui/package.nix
+++ b/pkgs/by-name/in/invidtui/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "invidtui";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "darkhz";
     repo = "invidtui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nNJ2bjrHRIzcPs+jbZpgaHBxSWRzSRIsT6xx9EsbISg=";
+    hash = "sha256-ErdoAHXdptUCZ2aW4XT1Hul/OBfnK6dfncgQ8JRFHxg=";
   };
 
   vendorHash = "sha256-C7O2GJuEdO8geRPfHx1Sq6ZveDE/u65JBx/Egh3cnK4=";
diff --git a/pkgs/by-name/ji/jikken/package.nix b/pkgs/by-name/ji/jikken/package.nix
index 9b51b96ac2dc..79f0343932a8 100644
--- a/pkgs/by-name/ji/jikken/package.nix
+++ b/pkgs/by-name/ji/jikken/package.nix
@@ -26,9 +26,9 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.isDarwin [
-      darwin.apple_sdk.frameworks.IOKit
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
+      darwin.apple_sdk_11_0.frameworks.IOKit
+      darwin.apple_sdk_11_0.frameworks.Security
+      darwin.apple_sdk_11_0.frameworks.SystemConfiguration
     ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 463fad226834..30812bd5ad16 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.369";
+  version = "0.0.371";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-OmU6C0hapdpM/41kEeNwpcMRooCWMLzI5FgQbIvjsb8=";
+    hash = "sha256-5cP5Z2VDxpBneDX+jhciaNrtDGi8XDm7DhhRBKh6ACU=";
   };
 
   vendorHash = "sha256-72cHswoTZszo42NOrPNuokDlqoJ3/YEhGe+rQSKvgAw=";
diff --git a/pkgs/by-name/rc/rcp/package.nix b/pkgs/by-name/rc/rcp/package.nix
index b5b64741ac0a..f04fa7e769eb 100644
--- a/pkgs/by-name/rc/rcp/package.nix
+++ b/pkgs/by-name/rc/rcp/package.nix
@@ -1,6 +1,8 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , rustPlatform
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -14,6 +16,10 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-kVO2WMwB/Lv4fCcdXaWL/Gfmenky6uMNVrUwhWU9y7A=";
   };
 
+  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    IOKit
+  ]);
+
   cargoHash = "sha256-Pa8YgFAT9nue/QLhHQm6PlTJU/myK60UcND5TthMOxc=";
 
   RUSTFLAGS = "--cfg tokio_unstable";
@@ -30,5 +36,7 @@ rustPlatform.buildRustPackage rec {
     license = with licenses; [ mit ];
     mainProgram = "rcp";
     maintainers = with maintainers; [ wykurz ];
+    # = note: Undefined symbols for architecture x86_64: "_utimensat"
+    broken = stdenv.isDarwin && stdenv.isx86_64;
   };
 }
diff --git a/pkgs/by-name/xi/xiu/package.nix b/pkgs/by-name/xi/xiu/package.nix
index 7857c9b1c3e6..369432312f04 100644
--- a/pkgs/by-name/xi/xiu/package.nix
+++ b/pkgs/by-name/xi/xiu/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xiu";
-  version = "0.12.6";
+  version = "0.12.7";
 
   src = fetchFromGitHub {
     owner = "harlanc";
     repo = "xiu";
     rev = "v${version}";
-    hash = "sha256-53fVb5c9uS92/rPvZDWXxZX42p4cHqumGe6Dw+/hLvk=";
+    hash = "sha256-tFArcI7NcIopM5uPshaOU3ExJW5URc5Mf2V0ZwwgwKo=";
   };
 
-  cargoHash = "sha256-ICZQ+UJ4LPNSeT9SjdcCUXgam40hMAOrJmLIwPEfqs4=";
+  cargoHash = "sha256-OBL1uDVogcU6saEz2d2sWJTwXM2KE/YfhsNZtH0Cnk8=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/libraries/tkimg/default.nix b/pkgs/development/libraries/tkimg/default.nix
index 094a6b5dda3d..90970a45602a 100644
--- a/pkgs/development/libraries/tkimg/default.nix
+++ b/pkgs/development/libraries/tkimg/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchsvn, tcl, tcllib, tk, xorg }:
+{ stdenv, lib, fetchsvn, tcl, tcllib, tk, xorg, darwin }:
 
 tcl.mkTclDerivation rec {
   pname = "tkimg";
@@ -16,7 +16,9 @@ tcl.mkTclDerivation rec {
     "--with-tkinclude=${tk.dev}/include"
   ];
 
-  buildInputs = [ xorg.libX11 tcllib ];
+  buildInputs = [ xorg.libX11 tcllib ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    Cocoa
+  ]);
 
   meta = {
     homepage = "https://sourceforge.net/projects/tkimg/";
diff --git a/pkgs/development/python-modules/dcmstack/default.nix b/pkgs/development/python-modules/dcmstack/default.nix
index 8e7b74fc8dd3..fd84640e8d78 100644
--- a/pkgs/development/python-modules/dcmstack/default.nix
+++ b/pkgs/development/python-modules/dcmstack/default.nix
@@ -1,27 +1,32 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, pytestCheckHook
-, nibabel
-, pydicom
-, pylibjpeg-libjpeg
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nibabel,
+  pydicom,
+  pylibjpeg-libjpeg,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "dcmstack";
   version = "0.9";
-  format = "setuptools";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "moloney";
-    repo = pname;
+    repo = "dcmstack";
     rev = "refs/tags/v${version}";
     hash = "sha256-GVzih9H2m2ZGSuZMRuaDG78b95PI3j0WQw5M3l4KNCs=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     nibabel
     pydicom
     pylibjpeg-libjpeg
@@ -29,9 +34,16 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  pythonImportsCheck = [ "dcmstack" ];
+
+  disabledTestPaths = [
+    # AttributeError: 'TestNitoolCli' object has no attribute 'out_dir'
+    "test/test_cli.py"
+  ];
+
   meta = with lib; {
-    homepage = "https://github.com/moloney/dcmstack";
     description = "DICOM to Nifti conversion preserving metadata";
+    homepage = "https://github.com/moloney/dcmstack";
     license = licenses.mit;
     maintainers = with maintainers; [ bcdarwin ];
   };
diff --git a/pkgs/development/python-modules/django-import-export/default.nix b/pkgs/development/python-modules/django-import-export/default.nix
index 50e60202dc97..a57a770444ed 100644
--- a/pkgs/development/python-modules/django-import-export/default.nix
+++ b/pkgs/development/python-modules/django-import-export/default.nix
@@ -1,41 +1,60 @@
-{ lib
-, buildPythonPackage
-, chardet
-, diff-match-patch
-, django
-, fetchFromGitHub
-, psycopg2
-, python
-, pythonOlder
-, pytz
-, tablib
+{
+  lib,
+  buildPythonPackage,
+  chardet,
+  diff-match-patch,
+  django,
+  fetchFromGitHub,
+  psycopg2,
+  python,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  pytz,
+  setuptools-scm,
+  tablib,
 }:
 
 buildPythonPackage rec {
   pname = "django-import-export";
-  version = "3.3.8";
-  format = "setuptools";
+  version = "4.0.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "django-import-export";
-    repo = pname;
+    repo = "django-import-export";
     rev = "refs/tags/${version}";
-    hash = "sha256-9BsaYLAkd6UvQxMtwk+pI7HyOWNU4rUmingkyemRCz4=";
+    hash = "sha256-ItJx9yJSy88/OvkpjGDWGBOMk5YlSquicSWi0tbKeWE=";
   };
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [ "tablib" ];
+
+  build-system = [ setuptools-scm ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [
     diff-match-patch
     django
     tablib
-  ] ++ (with tablib.optional-dependencies; html ++ ods ++ xls ++ xlsx ++ yaml);
+  ];
+
+  passthru.optional-dependencies = {
+    all = [ tablib ] ++ tablib.optional-dependencies.all;
+    cli = [ tablib ] ++ tablib.optional-dependencies.cli;
+    ods = [ tablib ] ++ tablib.optional-dependencies.ods;
+    pandas = [ tablib ] ++ tablib.optional-dependencies.pandas;
+    xls = [ tablib ] ++ tablib.optional-dependencies.xls;
+    xlsx = [ tablib ] ++ tablib.optional-dependencies.xlsx;
+    yaml = [ tablib ] ++ tablib.optional-dependencies.yaml;
+  };
 
   nativeCheckInputs = [
     chardet
     psycopg2
     pytz
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   checkPhase = ''
     runHook preCheck
@@ -43,9 +62,7 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
-  pythonImportsCheck = [
-    "import_export"
-  ];
+  pythonImportsCheck = [ "import_export" ];
 
   meta = with lib; {
     description = "Django application and library for importing and exporting data with admin integration";
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index b090f81da975..fd2813fe9e54 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -6,15 +6,18 @@
 , requests
 , six
 , stone
+, urllib3
 , mock
 , pytest-mock
 , pytestCheckHook
 , sphinxHook
+, sphinx-rtd-theme
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
   pname = "dropbox";
-  version = "11.36.2";
+  version = "12.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,7 +28,7 @@ buildPythonPackage rec {
     owner = "dropbox";
     repo = "dropbox-sdk-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-d++lxsbwPxnz1JPguWkImHXB+GQpMa9Uo3JNIxIe2ok=";
+    hash = "sha256-0MDm6NB+0vkN8QRSHvuDYEyYhYQWQD4jsctyd5fLdwE=";
   };
 
   build-system = [
@@ -36,6 +39,7 @@ buildPythonPackage rec {
     requests
     six
     stone
+    urllib3
   ];
 
   nativeCheckInputs = [
@@ -46,7 +50,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "'pytest-runner == 5.2.0'," ""
+      --replace "'pytest-runner==5.2.0'," ""
   '';
 
   doCheck = true;
@@ -55,7 +59,20 @@ buildPythonPackage rec {
     "dropbox"
   ];
 
-  nativeBuildInputs = [ sphinxHook ];
+  nativeBuildInputs = [
+    sphinxHook
+    sphinx-rtd-theme
+    pythonRelaxDepsHook
+  ];
+
+  # Version 12.0.0 re-introduced Python 2 support and set some very restrictive version bounds
+  # https://github.com/dropbox/dropbox-sdk-python/commit/75596daf316b4a806f18057e2797a15bdf83cf6d
+  # This will be the last major version to support Python 2, so version bounds might be more reasonable again in the future.
+  pythonRelaxDeps = [
+    "requests"
+    "stone"
+    "urllib3"
+  ];
 
   # Set SCOPED_USER_DROPBOX_TOKEN environment variable to a valid value.
   disabledTests = [
@@ -77,6 +94,8 @@ buildPythonPackage rec {
     "test_as_user"
     "test_as_admin"
     "test_clone_when_team_linked"
+    "test_bad_pins"
+    "test_bad_pins_session"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/google-ai-generativelanguage/default.nix b/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
index 37194dc41b01..9de834fab5d7 100644
--- a/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
+++ b/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "google-ai-generativelanguage";
-  version = "0.6.3";
+  version = "0.6.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EKEfHhu4Rw/1ADDBrNcps6unopreLDDPHRyRcpE2bGc=";
+    hash = "sha256-F1CEjBKvlsskrhw90F5L/iSGfcRXcAntA+EELYQh6HQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/heudiconv/default.nix b/pkgs/development/python-modules/heudiconv/default.nix
index 9c78027e0a83..58a2e777a9cc 100644
--- a/pkgs/development/python-modules/heudiconv/default.nix
+++ b/pkgs/development/python-modules/heudiconv/default.nix
@@ -1,26 +1,26 @@
-{ lib
-, buildPythonPackage
-, datalad
-, dcm2niix
-, dcmstack
-, etelemetry
-, fetchPypi
-, filelock
-, git
-, nibabel
-, nipype
-, pydicom
-, pytestCheckHook
-, pythonOlder
-, setuptools
-, versioningit
-, wheel
+{
+  lib,
+  buildPythonPackage,
+  datalad,
+  dcm2niix,
+  dcmstack,
+  etelemetry,
+  fetchPypi,
+  filelock,
+  git,
+  nibabel,
+  nipype,
+  pydicom,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  versioningit,
 }:
 
 buildPythonPackage rec {
   pname = "heudiconv";
   version = "1.1.0";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -31,22 +31,21 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "versioningit ~=" "versioningit >="
+      --replace-fail "versioningit ~=" "versioningit >="
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     versioningit
-    wheel
   ];
 
-  propagatedBuildInputs = [
-    nibabel
-    pydicom
-    nipype
+  dependencies = [
     dcmstack
     etelemetry
     filelock
+    nibabel
+    nipype
+    pydicom
   ];
 
   nativeCheckInputs = [
@@ -60,13 +59,16 @@ buildPythonPackage rec {
     export HOME=$(mktemp -d)
   '';
 
-  pythonImportsCheck = [
-    "heudiconv"
+  pythonImportsCheck = [ "heudiconv" ];
+
+  disabledTests = [
+    # No such file or directory
+    "test_bvals_are_zero"
   ];
 
   meta = with lib; {
-    homepage = "https://heudiconv.readthedocs.io";
     description = "Flexible DICOM converter for organizing imaging data";
+    homepage = "https://heudiconv.readthedocs.io";
     changelog = "https://github.com/nipy/heudiconv/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ bcdarwin ];
diff --git a/pkgs/development/python-modules/hickle/default.nix b/pkgs/development/python-modules/hickle/default.nix
index ec802955c0d3..b4597cd0c0d4 100644
--- a/pkgs/development/python-modules/hickle/default.nix
+++ b/pkgs/development/python-modules/hickle/default.nix
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   version = "5.0.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -47,17 +47,6 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "hickle" ];
 
-  disabledTests = [
-    # broken in 5.0.2 with recent NumPy
-    # see https://github.com/telegraphic/hickle/issues/174
-    "test_scalar_compression"
-    # broken in 5.0.2 with Python 3.11
-    # see https://github.com/telegraphic/hickle/issues/169
-    "test_H5NodeFilterProxy"
-    # broken in 5.0.2
-    "test_slash_dict_keys"
-  ];
-
   meta = with lib; {
     description = "Serialize Python data to HDF5";
     homepage = "https://github.com/telegraphic/hickle";
diff --git a/pkgs/development/python-modules/isoweek/default.nix b/pkgs/development/python-modules/isoweek/default.nix
index e16d27c47bcf..70c38d790430 100644
--- a/pkgs/development/python-modules/isoweek/default.nix
+++ b/pkgs/development/python-modules/isoweek/default.nix
@@ -1,20 +1,35 @@
-{ lib, fetchPypi, buildPythonPackage }:
+{
+  lib,
+  fetchPypi,
+  buildPythonPackage,
+  setuptools,
+  unittestCheckHook,
+  pythonOlder,
+}:
 
 buildPythonPackage rec {
   pname = "isoweek";
   version = "1.3.3";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1s7zsf0pab0l9gn6456qadnz5i5h90hafcjwnhx5mq23qjxggwvk";
+    hash = "sha256-c/P3usRD4Fo6tFwypyBIsMTybVPYFGLsSxQsdYHT/+g=";
   };
 
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
+
+  pythonImportsCheck = [ "isoweek" ];
+
   meta = with lib; {
-    description = "The module provide the class Week. Instances represent specific weeks spanning Monday to Sunday.";
+    description = "Module work with ISO weeks";
     homepage = "https://github.com/gisle/isoweek";
+    changelog = "https://github.com/gisle/isoweek/releases/tag/v${version}";
     license = licenses.bsd2;
     maintainers = with maintainers; [ mrmebelman ];
   };
 }
-
diff --git a/pkgs/development/python-modules/kaggle/default.nix b/pkgs/development/python-modules/kaggle/default.nix
index 38c3dce53151..815d1cd27e77 100644
--- a/pkgs/development/python-modules/kaggle/default.nix
+++ b/pkgs/development/python-modules/kaggle/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "kaggle";
-  version = "1.6.12";
+  version = "1.6.14";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-8SoFuC0q+xCnStxppfinNsZL2ZNNC1rPtP5PlzV1MLQ=";
+    sha256 = "sha256-WDUyveyjyeDK/EkxESxnN7Xmjxh6tZ7nff/fCf3529k=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/maestral/default.nix b/pkgs/development/python-modules/maestral/default.nix
index 52c24504174d..b58a764ece10 100644
--- a/pkgs/development/python-modules/maestral/default.nix
+++ b/pkgs/development/python-modules/maestral/default.nix
@@ -24,6 +24,7 @@
 , typing-extensions
 , watchdog
 , xattr
+, fetchpatch
 , pytestCheckHook
 , nixosTests
 }:
@@ -69,6 +70,14 @@ buildPythonPackage rec {
     rubicon-objc
   ];
 
+  patches = [
+    (fetchpatch {
+      name = "upgrade-dropbox-version-bounds";
+      url = "https://github.com/samschott/maestral/commit/8fd581fa503391534913afbc33a61132ff2e21ce.patch";
+      hash = "sha256-2Dke9iF/5Ptsf3CSRHUkjdFRrmdKY+L3sILRMyYrUH0=";
+    })
+  ];
+
   makeWrapperArgs = [
     # Add the installed directories to the python path so the daemon can find them
     "--prefix PYTHONPATH : ${makePythonPath dependencies}"
diff --git a/pkgs/development/python-modules/niapy/default.nix b/pkgs/development/python-modules/niapy/default.nix
index c05c0fb25a74..60308f21573f 100644
--- a/pkgs/development/python-modules/niapy/default.nix
+++ b/pkgs/development/python-modules/niapy/default.nix
@@ -1,18 +1,19 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, matplotlib
-, numpy
-, openpyxl
-, pandas
-, poetry-core
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  matplotlib,
+  numpy,
+  openpyxl,
+  pandas,
+  poetry-core,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "niapy";
-  version = "2.1.0";
+  version = "2.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,28 +21,22 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "NiaOrg";
     repo = "NiaPy";
-    rev = "refs/tags/${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-cT5CU1r3LZ9ValJwRUA0PaISmF6kXAz40alXbWYogGA=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     matplotlib
     numpy
     openpyxl
     pandas
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [
-    "niapy"
-  ];
+  pythonImportsCheck = [ "niapy" ];
 
   meta = with lib; {
     description = "Micro framework for building nature-inspired algorithms";
diff --git a/pkgs/development/python-modules/pefile/default.nix b/pkgs/development/python-modules/pefile/default.nix
index 55bd8c0cc07d..97b3419d7b55 100644
--- a/pkgs/development/python-modules/pefile/default.nix
+++ b/pkgs/development/python-modules/pefile/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , future
-, fetchFromGitHub
+, fetchPypi
 , setuptools-scm
 , pythonOlder
 }:
@@ -13,11 +13,10 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.6";
 
-  src = fetchFromGitHub {
-    owner = "erocarrera";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-lD8GpNl+cVNYTZUKFRF1/2kDwEbn/ekRBNBTYuFmFW0=";
+  # DON'T fetch from github, the repo is >60 MB due to test artifacts, which we cannot use
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-guYRQASz1pEcd8OVPjg4ZUsEURuLZuhYPbcMZZmAF9w=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +27,7 @@ buildPythonPackage rec {
     future
   ];
 
-  # Test data encrypted
+  # Test data contains properitary executables and malware, and is therefore encrypted
   doCheck = false;
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pybids/default.nix b/pkgs/development/python-modules/pybids/default.nix
index d702b4d509d3..33a00bac9284 100644
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@@ -1,19 +1,20 @@
-{ buildPythonPackage
-, lib
-, fetchPypi
-, setuptools
-, formulaic
-, click
-, num2words
-, numpy
-, scipy
-, pandas
-, nibabel
-, bids-validator
-, sqlalchemy
-, pytestCheckHook
-, versioneer
-, pythonRelaxDepsHook
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  formulaic,
+  click,
+  num2words,
+  numpy,
+  scipy,
+  pandas,
+  nibabel,
+  bids-validator,
+  sqlalchemy,
+  pytestCheckHook,
+  versioneer,
+  pythonRelaxDepsHook,
 }:
 
 buildPythonPackage rec {
@@ -49,28 +50,28 @@ buildPythonPackage rec {
     sqlalchemy
   ];
 
-  pythonImportsCheck = [
-    "bids"
-  ];
+  pythonImportsCheck = [ "bids" ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [
-    # looks for missing data:
+    # Test looks for missing data
     "test_config_filename"
-    # regression associated with formulaic >= 0.6.0
+    # Regression associated with formulaic >= 0.6.0
     # (see https://github.com/bids-standard/pybids/issues/1000)
     "test_split"
+    # AssertionError, TypeError
+    "test_run_variable_collection_bad_length_to_df_all_dense_var"
+    "test_extension_initial_dot"
+    "test_to_df"
   ];
 
   meta = with lib; {
     description = "Python tools for querying and manipulating BIDS datasets";
-    mainProgram = "pybids";
     homepage = "https://github.com/bids-standard/pybids";
     changelog = "https://github.com/bids-standard/pybids/blob/${version}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
+    mainProgram = "pybids";
   };
 }
diff --git a/pkgs/development/python-modules/pynetdicom/default.nix b/pkgs/development/python-modules/pynetdicom/default.nix
index 6f0407aacdff..c8e11897c727 100644
--- a/pkgs/development/python-modules/pynetdicom/default.nix
+++ b/pkgs/development/python-modules/pynetdicom/default.nix
@@ -29,10 +29,22 @@ buildPythonPackage rec {
 
   patches = [
     (fetchpatch {
-      name = "fix-python-3.11-test-attribute-errors";
+      name = "fix-python-3.11-test-attribute-errors.patch";
       url = "https://github.com/pydicom/pynetdicom/pull/754/commits/2126bd932d6dfb3f07045eb9400acb7eaa1b3069.patch";
       hash = "sha256-t6Lg0sTZSWIE5q5pkBvEoHDQ+cklDn8SgNBcFk1myp4=";
     })
+    (fetchpatch {
+      # https://github.com/pydicom/pynetdicom/pull/848
+      name = "replace-setup-with-setup_method1.patch";
+      url = "https://github.com/pydicom/pynetdicom/commit/09b4e0901445d46868668bc69a7b4f7f00cf6cbb.patch";
+      hash = "sha256-1ea1A/LU6qY+hd23b6H4OkKHQ0hI2/MYgBgZUZE0kRU=";
+    })
+    (fetchpatch {
+      # https://github.com/pydicom/pynetdicom/pull/848
+      name = "replace-setup-with-setup_method2.patch";
+      url = "https://github.com/pydicom/pynetdicom/commit/3966c2d749eeda718caccf9a88a0495d1823825d.patch";
+      hash = "sha256-C4MSfwwxDgr5T0XQMlR5j2wElPu83TqPhjyNDvfBjJs=";
+    })
   ];
 
   build-system = [ setuptools ];
@@ -86,7 +98,7 @@ buildPythonPackage rec {
   pytestFlagsArray = [
     # https://github.com/pydicom/pynetdicom/issues/923
     "-W"
-    "ignore::pytest.PytestRemovedIn8Warning"
+    "ignore::pytest.PytestRemovedIn9Warning"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pynmea2/default.nix b/pkgs/development/python-modules/pynmea2/default.nix
index 2bfdd61a6202..e4e9f37d2f50 100644
--- a/pkgs/development/python-modules/pynmea2/default.nix
+++ b/pkgs/development/python-modules/pynmea2/default.nix
@@ -1,22 +1,44 @@
-{ lib, buildPythonPackage, fetchPypi, pytestCheckHook }:
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  fetchpatch,
+  pytestCheckHook,
+  setuptools,
+  pythonOlder,
+}:
 
 buildPythonPackage rec {
   pname = "pynmea2";
   version = "1.19.0";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-Hap5uTJ5+IfRwjXlzFx54yZEVkE4zkaYmrD0ovyXDXw=";
   };
 
+  patches = [
+    # Removed depreciated imp and replaced with importlib, https://github.com/Knio/pynmea2/pull/164
+    (fetchpatch {
+      name = "remove-imp.patch";
+      url = "https://github.com/Knio/pynmea2/commit/c56717b5e859e978ad3b52b8f826faa5d50489f8.patch";
+      hash = "sha256-jeFyfukT+0NLNxvNCxL7TzL/8oKmKOam5ZUIvjdvN/Q=";
+    })
+  ];
+
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "pynmea2" ];
 
   meta = {
-    homepage = "https://github.com/Knio/pynmea2";
     description = "Python library for the NMEA 0183 protcol";
+    homepage = "https://github.com/Knio/pynmea2";
+    changelog = "https://github.com/Knio/pynmea2/releases/tag/${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ oxzi ];
   };
diff --git a/pkgs/development/python-modules/pystatgrab/default.nix b/pkgs/development/python-modules/pystatgrab/default.nix
index 9ba3fb7b3785..574cc349d5de 100644
--- a/pkgs/development/python-modules/pystatgrab/default.nix
+++ b/pkgs/development/python-modules/pystatgrab/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , cython
 , fetchFromGitHub
@@ -8,6 +9,7 @@
 , setuptools
 , unittestCheckHook
 , wheel
+, darwin
 }:
 
 buildPythonPackage rec {
@@ -33,7 +35,9 @@ buildPythonPackage rec {
 
   buildInputs = [
     libstatgrab
-  ];
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    IOKit
+  ]);
 
   nativeCheckInputs = [
     unittestCheckHook
diff --git a/pkgs/development/python-modules/pytest-postgresql/default.nix b/pkgs/development/python-modules/pytest-postgresql/default.nix
index 6eed5ef6ad2c..b5804dcf4977 100644
--- a/pkgs/development/python-modules/pytest-postgresql/default.nix
+++ b/pkgs/development/python-modules/pytest-postgresql/default.nix
@@ -13,8 +13,8 @@
 
 buildPythonPackage rec {
   pname = "pytest-postgresql";
-  version = "5.0.0";
-  format = "pyproject";
+  version = "6.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -22,13 +22,13 @@ buildPythonPackage rec {
     owner = "ClearcodeHQ";
     repo = "pytest-postgresql";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uWKp9yxTdlswoDPMlhx+2mF1cdhFzhGYKGHdXPGlz+w=";
+    hash = "sha256-6D9QNcfq518ORQDYCH5G+LLJ7tVWPFwB6ylZR3LOZ5g=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml  \
-      --replace "--cov" ""  \
-      --replace "--max-worker-restart=0" ""
+      --replace-fail "--cov" ""  \
+      --replace-fail "--max-worker-restart=0" ""
     sed -i 's#/usr/lib/postgresql/.*/bin/pg_ctl#${postgresql}/bin/pg_ctl#' pytest_postgresql/plugin.py
   '';
 
@@ -54,6 +54,7 @@ buildPythonPackage rec {
     # permissions issue running pg as Nixbld user
     "test_executor_init_with_password"
     # "ValueError: Pytest terminal summary report not found"
+    "test_postgres_loader_in_cli"
     "test_postgres_options_config_in_cli"
     "test_postgres_options_config_in_ini"
   ];
diff --git a/pkgs/development/python-modules/raincloudy/default.nix b/pkgs/development/python-modules/raincloudy/default.nix
index 3a247bc6a81e..5db3430efb3d 100644
--- a/pkgs/development/python-modules/raincloudy/default.nix
+++ b/pkgs/development/python-modules/raincloudy/default.nix
@@ -1,51 +1,54 @@
-{ lib
-, aiohttp
-, aioresponses
-, beautifulsoup4
-, buildPythonPackage
-, fetchFromGitHub
-, html5lib
-, pytest-asyncio
-, pytest-aiohttp
-, pytestCheckHook
-, pythonOlder
-, requests
-, requests-mock
-, setuptools
-, setuptools-scm
-, urllib3
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  beautifulsoup4,
+  buildPythonPackage,
+  fetchFromGitHub,
+  html5lib,
+  pytest-asyncio,
+  pytest-aiohttp,
+  pytestCheckHook,
+  pythonAtLeast,
+  pythonOlder,
+  requests,
+  requests-mock,
+  setuptools,
+  setuptools-scm,
+  urllib3,
 }:
 
 buildPythonPackage rec {
   pname = "raincloudy";
   version = "1.2.0";
-  format = "setuptools";
+  pypriject = true;
 
-  disabled = pythonOlder "3.7";
+  # https://github.com/vanstinator/raincloudy/issues/65
+  disabled = pythonOlder "3.7" || pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "vanstinator";
-    repo = pname;
+    repo = "raincloudy";
     rev = "refs/tags/${version}";
     hash = "sha256-qCkBVirM09iA1sXiOB9FJns8bHjQq7rRk8XbRWrtBDI=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    setuptools-scm
-  ];
-
   postPatch = ''
     # https://github.com/vanstinator/raincloudy/pull/60
     substituteInPlace setup.py \
-      --replace "bs4" "beautifulsoup4" \
+      --replace-fail "bs4" "beautifulsoup4" \
 
     # fix raincloudy.aio package discovery, by relying on
     # autodiscovery instead.
     sed -i '/packages=/d' setup.py
   '';
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
     aiohttp
     requests
     beautifulsoup4
@@ -74,7 +77,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to interact with Melnor RainCloud Smart Garden Watering Irrigation Timer";
     homepage = "https://github.com/vanstinator/raincloudy";
-    license = with licenses; [ asl20 ];
+    changelog = "https://github.com/vanstinator/raincloudy/releases/tag/${version}";
+    license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/reportengine/default.nix b/pkgs/development/python-modules/reportengine/default.nix
index 79e1a908f7eb..3eb6cf2a869c 100644
--- a/pkgs/development/python-modules/reportengine/default.nix
+++ b/pkgs/development/python-modules/reportengine/default.nix
@@ -49,5 +49,8 @@ buildPythonPackage rec {
     homepage = "https://github.com/NNPDF/reportengine/";
     license = with licenses; [ gpl2Only ];
     maintainers = with maintainers; [ veprbl ];
+    # Incompatibility with ruamel >= 0.18
+    # https://github.com/NNPDF/reportengine/issues/60
+    broken = versionAtLeast ruamel-yaml.version "0.18";
   };
 }
diff --git a/pkgs/development/python-modules/skorch/default.nix b/pkgs/development/python-modules/skorch/default.nix
index 01d23f596dd9..ab128f978571 100644
--- a/pkgs/development/python-modules/skorch/default.nix
+++ b/pkgs/development/python-modules/skorch/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , pythonOlder
 , numpy
 , scikit-learn
@@ -26,6 +27,13 @@ buildPythonPackage rec {
     hash = "sha256-39XVBlCmbg162z9uL84GZrU+v+M8waXbGdVV72ZYf84=";
   };
 
+  # Remove at next skorch release:
+  patches = [ (fetchpatch {
+    name = "unbreak-tests-with-sklearn-1.4";
+    url = "https://github.com/skorch-dev/skorch/commit/1f7a779d0aa78589e17262c206f5775f2fcd75f8.diff";
+    hash = "sha256-X3SgjgDeq3PlBI13cC56LIL1dV1e+Z3tsBj9sz5pizo=";
+  }) ];
+
   disabled = pythonOlder "3.8";
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/slackclient/default.nix b/pkgs/development/python-modules/slackclient/default.nix
index 9769f22727a3..5c9c6ed8a52e 100644
--- a/pkgs/development/python-modules/slackclient/default.nix
+++ b/pkgs/development/python-modules/slackclient/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "slackclient";
-  version = "3.27.1";
+  version = "3.27.2";
   format =  "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "slackapi";
     repo = "python-slack-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fBHu4e6pSt8yzXbLWr5cwjRFDfvdH2jzpSNzdMBg4N0=";
+    hash = "sha256-1I08OUseiwCN9vUd56f9IFzCSB9kGjTLojyWm2dIimE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/summarytools/default.nix b/pkgs/development/python-modules/summarytools/default.nix
index 4bbbae78c88b..58457768fe0e 100644
--- a/pkgs/development/python-modules/summarytools/default.nix
+++ b/pkgs/development/python-modules/summarytools/default.nix
@@ -1,31 +1,31 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pythonOlder
-, setuptools
-, ipython
-, matplotlib
-, numpy
-, pandas
-, pytestCheckHook
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  setuptools,
+  ipython,
+  matplotlib,
+  numpy,
+  pandas,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "summarytools";
-  version = "0.2.3";
+  version = "0.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  # no version tags in GitHub repo
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wsDf9IXCMQe0cVfQQuRVwMhxkhhUxbPu06yWZPLvgw4=";
+    hash = "sha256-m29ug+JZC4HgMIVopovA/dyR40Z1IcADOiDWKg9mzdc=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     ipython
     matplotlib
     numpy
@@ -33,11 +33,13 @@ buildPythonPackage rec {
   ];
 
   nativeCheckImports = [ pytestCheckHook ];
+
   pythonImportsCheck = [ "summarytools" ];
 
   meta = with lib; {
     description = "Python port of the R summarytools package for summarizing dataframes";
     homepage = "https://github.com/6chaoran/jupyter-summarytools";
+    changelog = "https://github.com/6chaoran/jupyter-summarytools/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ bcdarwin ];
   };
diff --git a/pkgs/development/python-modules/torchgpipe/default.nix b/pkgs/development/python-modules/torchgpipe/default.nix
deleted file mode 100644
index f96add92f0cc..000000000000
--- a/pkgs/development/python-modules/torchgpipe/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-, pytestCheckHook
-, torch
-}:
-
-buildPythonPackage rec {
-  pname = "torchgpipe";
-  version = "0.0.7";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
-
-  src = fetchFromGitHub {
-    owner = "kakaobrain";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0ki0njhmz1i3pkpr3y6h6ac7p5qh1kih06mknc2s18mfw34f2l55";
-  };
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'pytest-runner'" ""
-  '';
-
-  propagatedBuildInputs = [ torch ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-  disabledTests = [
-    "test_inplace_on_requires_grad"
-    "test_input_requiring_grad"
-  ];
-
-  meta = with lib; {
-    description = "GPipe implemented in Pytorch and optimized for CUDA rather than TPU";
-    homepage = "https://torchgpipe.readthedocs.io";
-    license = licenses.asl20;
-    maintainers = [ maintainers.bcdarwin ];
-  };
-}
diff --git a/pkgs/development/python-modules/virt-firmware/default.nix b/pkgs/development/python-modules/virt-firmware/default.nix
index d5da9d57c40f..f319de6370fb 100644
--- a/pkgs/development/python-modules/virt-firmware/default.nix
+++ b/pkgs/development/python-modules/virt-firmware/default.nix
@@ -1,4 +1,6 @@
 { lib
+, pkgs
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , setuptools
@@ -10,7 +12,6 @@
 buildPythonPackage rec {
   pname = "virt-firmware";
   version = "24.4";
-
   pyproject = true;
 
   src = fetchPypi {
@@ -18,23 +19,28 @@ buildPythonPackage rec {
     hash = "sha256-rqhaKDOQEOj6bcRz3qZJ+a4yG1qTC9SUjuxMhZlnmwU=";
   };
 
-  pythonImportsCheck = [ "virt.firmware.efi" ];
-
-  nativeBuildInputs = [
+  build-system = [
     setuptools
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
-  pytestFlagsArray = ["tests/tests.py"];
-
-  propagatedBuildInputs = [
+  dependencies = [
     setuptools
     cryptography
     pefile
   ];
 
+  # tests require systemd-detect-virt
+  doCheck = lib.meta.availableOn stdenv.hostPlatform pkgs.systemd;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pkgs.systemd
+  ];
+
+  pytestFlagsArray = [ "tests/tests.py" ];
+
+  pythonImportsCheck = [ "virt.firmware.efi" ];
+
   meta = with lib; {
     description = "Tools for virtual machine firmware volumes";
     homepage = "https://gitlab.com/kraxel/virt-firmware";
diff --git a/pkgs/development/tools/gi-crystal/default.nix b/pkgs/development/tools/gi-crystal/default.nix
index 8b664ee1e00f..395efaa74241 100644
--- a/pkgs/development/tools/gi-crystal/default.nix
+++ b/pkgs/development/tools/gi-crystal/default.nix
@@ -2,16 +2,17 @@
 , fetchFromGitHub
 , crystal
 , gobject-introspection
+, gitUpdater
 }:
 crystal.buildCrystalPackage rec {
   pname = "gi-crystal";
-  version = "0.21.0";
+  version = "0.22.2";
 
   src = fetchFromGitHub {
     owner = "hugopl";
     repo = "gi-crystal";
     rev = "v${version}";
-    hash = "sha256-hL+4MvJn1z9UKCtyvU4zzIxOwRyYQ3Qt4qRb5F0J+sg=";
+    hash = "sha256-JfBbKqobikpTGMryeO86zZ46EbOHybem+Cc5FZEL6i4=";
   };
 
   # Make sure gi-crystal picks up the name of the so or dylib and not the leading nix store path
@@ -33,6 +34,11 @@ crystal.buildCrystalPackage rec {
     runHook postInstall
   '';
 
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
+  };
+
+
   meta = with lib; {
     description = "GI Crystal is a binding generator used to generate Crystal bindings for GObject based libraries using GObject Introspection.";
     homepage = "https://github.com/hugopl/gi-crystal";
diff --git a/pkgs/development/tools/nufmt/default.nix b/pkgs/development/tools/nufmt/default.nix
index e753c134d1ab..a73e300052fc 100644
--- a/pkgs/development/tools/nufmt/default.nix
+++ b/pkgs/development/tools/nufmt/default.nix
@@ -1,8 +1,10 @@
 
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   rustPlatform,
+  darwin,
   ...
 }:
 rustPlatform.buildRustPackage rec {
@@ -16,6 +18,10 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-BwKLl8eMCrqVt9PA5SHAXxu3ypP2ePcSuljKL+wSkvw=";
   };
 
+  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    IOKit
+  ]);
+
   cargoSha256 = "sha256-16Z20opeZpoa7h258um+grL3ktPmY4P0M/tqMTr5hYc=";
 
   meta = with lib; {
diff --git a/pkgs/servers/monitoring/nagios/default.nix b/pkgs/servers/monitoring/nagios/default.nix
index 14e60891c08d..4f39239bfe08 100644
--- a/pkgs/servers/monitoring/nagios/default.nix
+++ b/pkgs/servers/monitoring/nagios/default.nix
@@ -10,17 +10,18 @@
 , unzip
 , nixosTests
 , nix-update-script
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "nagios";
-  version = "4.5.1";
+  version = "4.5.2";
 
   src = fetchFromGitHub {
     owner = "NagiosEnterprises";
     repo = "nagioscore";
-    rev = "refs/tags/nagios-${version}";
-    hash = "sha256-+U2k3w3Yr0qZjHwjRpKZVucB3a35PSZr1Sqa8k0ssq8=";
+    rev = "refs/tags/nagios-${finalAttrs.version}";
+    hash = "sha256-LD572aR6g67pH3QllnLD3g0bnck+vlC/YTN83WamHRs=";
   };
 
   patches = [ ./nagios.patch ];
@@ -46,7 +47,7 @@ stdenv.mkDerivation rec {
 
   # Do not create /var directories
   preInstall = ''
-    substituteInPlace Makefile --replace '$(MAKE) install-basic' ""
+    substituteInPlace Makefile --replace-fail '$(MAKE) install-basic' ""
   '';
   installTargets = "install install-config";
   postInstall = ''
@@ -59,6 +60,10 @@ stdenv.mkDerivation rec {
   passthru = {
     tests = {
       inherit (nixosTests) nagios;
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "nagios --version";
+      };
     };
     updateScript = nix-update-script {
       extraArgs = [ "--version-regex" "nagios-(.*)" ];
@@ -68,10 +73,10 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A host, service and network monitoring program";
     homepage = "https://www.nagios.org/";
-    changelog = "https://github.com/NagiosEnterprises/nagioscore/blob/nagios-${version}/Changelog";
+    changelog = "https://github.com/NagiosEnterprises/nagioscore/blob/nagios-${finalAttrs.version}/Changelog";
     license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
     mainProgram = "nagios";
     maintainers = with lib.maintainers; [ immae thoughtpolice relrod anthonyroussel ];
   };
-}
+})
diff --git a/pkgs/servers/sickbeard/sickgear.nix b/pkgs/servers/sickbeard/sickgear.nix
index fd405b598e92..1ad5c7c26eff 100644
--- a/pkgs/servers/sickbeard/sickgear.nix
+++ b/pkgs/servers/sickbeard/sickgear.nix
@@ -4,13 +4,13 @@ let
   pythonEnv = python3.withPackages(ps: with ps; [ cheetah3 lxml ]);
 in stdenv.mkDerivation rec {
   pname = "sickgear";
-  version = "3.30.18";
+  version = "3.30.19";
 
   src = fetchFromGitHub {
     owner = "SickGear";
     repo = "SickGear";
     rev = "release_${version}";
-    hash = "sha256-Xt4/bAK48A57n2Kl3LQICem8IR3pgsdgMjlP9qEVvBM=";
+    hash = "sha256-OC/BJ0wG6as1dt2dO9gUFD+FG85Vt2ehCoTcmh6iT7w=";
   };
 
   patches = [
diff --git a/pkgs/tools/admin/aws-lambda-runtime-interface-emulator/default.nix b/pkgs/tools/admin/aws-lambda-runtime-interface-emulator/default.nix
index b1993ef05c10..85509d92b369 100644
--- a/pkgs/tools/admin/aws-lambda-runtime-interface-emulator/default.nix
+++ b/pkgs/tools/admin/aws-lambda-runtime-interface-emulator/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "aws-lambda-runtime-interface-emulator";
-  version = "1.17";
+  version = "1.19";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lambda-runtime-interface-emulator";
     rev = "v${version}";
-    sha256 = "sha256-dJbN3Ln3nXED8HmIHSrdKW37fj8dyGnJG27S12VydiE=";
+    sha256 = "sha256-z4drwdODY+FjrDpdXK7zXD1yiQmpdItzVjzKHj0ZTJk=";
   };
 
   vendorHash = "sha256-fGoqKDBg+O4uzGmhEIROsBvDS+6zWCzsXe8U6t98bqk=";
diff --git a/pkgs/tools/misc/moar/default.nix b/pkgs/tools/misc/moar/default.nix
index 919609a2cb3e..4140308c4967 100644
--- a/pkgs/tools/misc/moar/default.nix
+++ b/pkgs/tools/misc/moar/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "moar";
-  version = "1.23.14";
+  version = "1.23.15";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Ss4xblv7F3fco1qUXkzhUWEDnyE/bdXv6Gs8cN9HWZw=";
+    hash = "sha256-tRjKBHsNJL66oz+0gZTrL8xFHQEyHLG+W35LHUYQKwU=";
   };
 
   vendorHash = "sha256-1u/2OlMX2FuZaxWnpU4n5r/4xKe+rK++GoCJiSq/BdE=";
diff --git a/pkgs/tools/misc/szyszka/default.nix b/pkgs/tools/misc/szyszka/default.nix
index 7bcce4158faf..8be3e0caf8b6 100644
--- a/pkgs/tools/misc/szyszka/default.nix
+++ b/pkgs/tools/misc/szyszka/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
@@ -9,6 +10,7 @@
 , gdk-pixbuf
 , gtk4
 , wrapGAppsHook4
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -36,7 +38,9 @@ rustPlatform.buildRustPackage rec {
     atk
     gdk-pixbuf
     gtk4
-  ];
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    Foundation
+  ]);
 
   meta = with lib; {
     description = "A simple but powerful and fast bulk file renamer";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d66724879cda..5649203e700a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2334,7 +2334,7 @@ with pkgs;
 
   git-credential-1password = callPackage ../applications/version-management/git-credential-1password { };
 
-  git-credential-keepassxc = callPackage ../applications/version-management/git-credential-keepassxc {
+  git-credential-keepassxc = darwin.apple_sdk_11_0.callPackage ../applications/version-management/git-credential-keepassxc {
     inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation;
   };
 
@@ -11187,7 +11187,7 @@ with pkgs;
 
   nylon = callPackage ../tools/networking/nylon { };
 
-  nym = callPackage ../applications/networking/nym {
+  nym = darwin.apple_sdk_11_0.callPackage ../applications/networking/nym {
     inherit (darwin.apple_sdk.frameworks) Security CoreServices;
   };
 
@@ -40256,7 +40256,7 @@ with pkgs;
 
   vazir-fonts = callPackage ../data/fonts/vazir-fonts { };
 
-  veilid = callPackage ../tools/networking/veilid {
+  veilid = darwin.apple_sdk_11_0.callPackage ../tools/networking/veilid {
     inherit (darwin.apple_sdk.frameworks) AppKit Security;
   };
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 780b1ac5cb0c..065153452e22 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -517,6 +517,7 @@ mapAliases ({
   TheanoWithCuda = theanoWithCuda; # added 2023-02-19
   TheanoWithoutCuda = theanoWithoutCuda; # added 2023-02-19
   thumborPexif = throw "thumborPexif has been removed, because it was unused."; # added 2024-01-07
+  torchgpipe = throw "torchgpipe has been removed, because it appears unmaintained and Pytorch now includes pipeline parallelism support"; # added 2024-05-18
   torrent_parser = torrent-parser; # added 2023-11-04
   transip = throw "transip has been removed because it is no longer maintained. TransIP SOAP V5 API was marked as deprecated"; # added 2023-02-27
   py-tree-sitter = throw "Was merged with tree-sitter."; # added 2024-03-20
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 29b5d95a9922..da91b2688565 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -15301,8 +15301,6 @@ self: super: with self; {
 
   torchdiffeq = callPackage ../development/python-modules/torchdiffeq { };
 
-  torchgpipe = callPackage ../development/python-modules/torchgpipe { };
-
   torchmetrics = callPackage ../development/python-modules/torchmetrics { };
 
   torchio = callPackage ../development/python-modules/torchio { };