diff --git a/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix b/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
index df424ede6066..0c5648c14149 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
@@ -4,16 +4,12 @@ with lib;
 
 let
   cfg = config.services.prometheus.exporters.smartctl;
-  format = pkgs.formats.yaml {};
-  configFile = format.generate "smartctl-exporter.yml" {
-    smartctl_exporter = {
-      bind_to = "${cfg.listenAddress}:${toString cfg.port}";
-      url_path = "/metrics";
-      smartctl_location = "${pkgs.smartmontools}/bin/smartctl";
-      collect_not_more_than_period = cfg.maxInterval;
-      devices = cfg.devices;
-    };
-  };
+  args = concatStrings [
+    "--web.listen-address=\"${cfg.listenAddress}:${toString cfg.port}\" "
+    "--smartctl.path=\"${pkgs.smartmontools}/bin/smartctl\" "
+    "--smartctl.interval=\"${cfg.maxInterval}\" "
+    "${concatMapStringsSep " " (device: "--smartctl.device=${device}") cfg.devices}"
+  ];
 in {
   port = 9633;
 
@@ -50,17 +46,13 @@ in {
         "CAP_SYS_ADMIN"
       ];
       DevicePolicy = "closed";
-      DeviceAllow = lib.mkOverride 50 (
-        if cfg.devices != [] then
-          cfg.devices
-        else [
-          "block-blkext rw"
-          "block-sd rw"
-          "char-nvme rw"
-        ]
-      );
+      DeviceAllow = lib.mkOverride 50 [
+        "block-blkext rw"
+        "block-sd rw"
+        "char-nvme rw"
+      ];
       ExecStart = ''
-        ${pkgs.prometheus-smartctl-exporter}/bin/smartctl_exporter -config ${configFile}
+        ${pkgs.prometheus-smartctl-exporter}/bin/smartctl_exporter ${args}
       '';
       PrivateDevices = lib.mkForce false;
       ProtectProc = "invisible";
diff --git a/nixos/modules/system/activation/test.nix b/nixos/modules/system/activation/test.nix
new file mode 100644
index 000000000000..8cf000451c6e
--- /dev/null
+++ b/nixos/modules/system/activation/test.nix
@@ -0,0 +1,27 @@
+{ lib
+, nixos
+, expect
+, testers
+}:
+let
+  node-forbiddenDependencies-fail = nixos ({ ... }: {
+    system.forbiddenDependenciesRegex = "-dev$";
+    environment.etc."dev-dependency" = {
+      text = "${expect.dev}";
+    };
+    documentation.enable = false;
+    fileSystems."/".device = "ignore-root-device";
+    boot.loader.grub.enable = false;
+  });
+  node-forbiddenDependencies-succeed = nixos ({ ... }: {
+    system.forbiddenDependenciesRegex = "-dev$";
+    system.extraDependencies = [ expect.dev ];
+    documentation.enable = false;
+    fileSystems."/".device = "ignore-root-device";
+    boot.loader.grub.enable = false;
+  });
+in
+lib.recurseIntoAttrs {
+  test-forbiddenDependencies-fail = testers.testBuildFailure node-forbiddenDependencies-fail.config.system.build.toplevel;
+  test-forbiddenDependencies-succeed = node-forbiddenDependencies-succeed.config.system.build.toplevel;
+}
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index 55ff98db5382..64e97b510b06 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -77,7 +77,7 @@ let
 
       ${config.system.systemBuilderCommands}
 
-      echo -n "${toString config.system.extraDependencies}" > $out/extra-dependencies
+      echo -n "$extraDependencies" > $out/extra-dependencies
 
       ${config.system.extraSystemBuilderCmds}
     '';
@@ -105,6 +105,8 @@ let
     dryActivationScript = config.system.dryActivationScript;
     nixosLabel = config.system.nixos.label;
 
+    inherit (config.system) extraDependencies;
+
     # Needed by switch-to-configuration.
     perl = pkgs.perl.withPackages (p: with p; [ ConfigIniFiles FileSlurp ]);
   } // config.system.systemBuilderArgs);
@@ -223,6 +225,16 @@ in
       '';
     };
 
+    system.forbiddenDependenciesRegex = mkOption {
+      default = "";
+      example = "-dev$";
+      type = types.str;
+      description = lib.mdDoc ''
+        A POSIX Extended Regular Expression that matches store paths that
+        should not appear in the system closure, with the exception of {option}`system.extraDependencies`, which is not checked.
+      '';
+    };
+
     system.extraSystemBuilderCmds = mkOption {
       type = types.lines;
       internal = true;
@@ -298,8 +310,26 @@ in
         config.system.copySystemConfiguration
         ''ln -s '${import ../../../lib/from-env.nix "NIXOS_CONFIG" <nixos-config>}' \
             "$out/configuration.nix"
+        '' +
+      optionalString
+        (config.system.forbiddenDependenciesRegex != "")
+        ''
+          if [[ $forbiddenDependenciesRegex != "" && -n $closureInfo ]]; then
+            if forbiddenPaths="$(grep -E -- "$forbiddenDependenciesRegex" $closureInfo/store-paths)"; then
+              echo -e "System closure $out contains the following disallowed paths:\n$forbiddenPaths"
+              exit 1
+            fi
+          fi
         '';
 
+    system.systemBuilderArgs = lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") {
+      inherit (config.system) forbiddenDependenciesRegex;
+      closureInfo = pkgs.closureInfo { rootPaths = [
+        # override to avoid  infinite recursion (and to allow using extraDependencies to add forbidden dependencies)
+        (config.system.build.toplevel.overrideAttrs (_: { extraDependencies = []; closureInfo = null; }))
+      ]; };
+    };
+
     system.build.toplevel = system;
 
   };
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 70cd995ececa..b372ae20480b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -194,6 +194,7 @@ in {
   ergo = handleTest ./ergo.nix {};
   ergochat = handleTest ./ergochat.nix {};
   etc = pkgs.callPackage ../modules/system/etc/test.nix { inherit evalMinimalConfig; };
+  activation = pkgs.callPackage ../modules/system/activation/test.nix { };
   etcd = handleTestOn ["x86_64-linux"] ./etcd.nix {};
   etcd-cluster = handleTestOn ["x86_64-linux"] ./etcd-cluster.nix {};
   etebase-server = handleTest ./etebase-server.nix {};
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index cdf666378fa3..8b40d7e41c00 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1086,13 +1086,8 @@ let
         ];
       };
       exporterTest = ''
-        wait_for_unit("prometheus-smartctl-exporter.service")
-        wait_for_open_port(9633)
         wait_until_succeeds(
-          "curl -sSf 'localhost:9633/metrics'"
-        )
-        wait_until_succeeds(
-            'journalctl -eu prometheus-smartctl-exporter.service -o cat | grep "/dev/vda: Unable to detect device type"'
+            'journalctl -eu prometheus-smartctl-exporter.service -o cat | grep "Device unavailable"'
         )
       '';
     };
diff --git a/pkgs/applications/graphics/rnote/default.nix b/pkgs/applications/graphics/rnote/default.nix
index eb0eaaeda95d..560c5c6a4927 100644
--- a/pkgs/applications/graphics/rnote/default.nix
+++ b/pkgs/applications/graphics/rnote/default.nix
@@ -6,7 +6,6 @@
 , clang
 , cmake
 , desktop-file-utils
-, gio-sharp
 , glib
 , gstreamer
 , gtk4
@@ -24,20 +23,20 @@
 
 stdenv.mkDerivation rec {
   pname = "rnote";
-  version = "0.5.7";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "flxzt";
     repo = "rnote";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-w4y+t8idcaNwvC2Wp9SRjcd4m23Zt+yHG2fjOA2rBU8=";
+    hash = "sha256-Sy8EHl4UuDMwRAKDkl7njD9GSzKpy1Cfsgw53On+nxo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-Hybbbokru4vz5ly3oZuNGdBa+lYbhdYjESUpRxIUqJc=";
+    hash = "sha256-Pe4lNcvJNELAitaGY56EUJ8iN7Dkh8DoUpA/t+aRuqk=";
   };
 
   nativeBuildInputs = [
@@ -60,7 +59,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     alsa-lib
-    gio-sharp
     glib
     gstreamer
     gtk4
@@ -81,6 +79,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/flxzt/rnote";
+    changelog = "https://github.com/flxzt/rnote/releases/tag/${src.rev}";
     description = "Simple drawing application to create handwritten notes";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ dotlambda yrd ];
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index e155dac034e7..6fc1405b7067 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -112,13 +112,13 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-g38aJ8JN/0PZ0ArSti1/5nzflIlkz/qhn5Qz4yXCie8=",
+    "hash": "sha256-5eqUaO8XRPh2wkltGu7D3GToNAq1zSpQ1LS/h0W/CQA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v4.45.0",
+    "rev": "v4.46.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-C3wr/3huORBacbe0+Z0qqH+iSaJCxQwLq9wqLSirDiM="
+    "vendorHash": "sha256-xo9Z50jK8dWxQ8DeGLjB8ppnGuUmGlQLhzRHpKs8hYg="
   },
   "azuread": {
     "hash": "sha256-itaFeOEnoTIJfACvJZCIe9RWNVgewdVFZzXUK7yGglQ=",
@@ -167,13 +167,13 @@
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-eU8vA2fxtdsObgh2dTExGLzzBnfSc2DSGdFHrLXR3SA=",
+    "hash": "sha256-tT5JSiUPeezQFn4tnKrsUxfm/llaBk8R2eOGqGIbEH4=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.22.0",
+    "rev": "v2.23.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Qkla3OEcyiMn6eqBj+4LB8JwpIwceLAASI1qvOcUBD0="
+    "vendorHash": "sha256-CFRZSdQnbhV7n10r2R1+cGxn7nKD+GvXWf85rYFRPVI="
   },
   "brightbox": {
     "hash": "sha256-F/AQq45ADM0+PbFpMPtpMvbYw8F41GDBzk7LoY/L/Qg=",
@@ -861,13 +861,13 @@
     "vendorHash": "sha256-hHwFm+gSMjN4YQEFd/dd50G0uZsxzqi21tHDf4mPBLY="
   },
   "opentelekomcloud": {
-    "hash": "sha256-H1X+wWxdP7MwUtUaQiw0usOO6jwAAVLYMoG5Ut2OcqM=",
+    "hash": "sha256-vmsnpu4FThMY0OfCAj0DnI4fpOwVGvJXpQ3u+kAieFc=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.31.9",
+    "rev": "v1.32.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-n7Ez596JnRwsKYPuR8lCLo6ez/TFch2kMgoScg7pPUI="
+    "vendorHash": "sha256-TCeAqQLdeCS3NPDAppinRv4qBPBWtG/qAUKc+4acqEE="
   },
   "opsgenie": {
     "hash": "sha256-6lbJyBppfRqqmYpPgyzUTvnvHPSWjE3SJULqliZ2iUI=",
@@ -1232,11 +1232,11 @@
     "vendorHash": "sha256-160GDEQfymeCJpjYOoWP5sGQ0PJHw9kKPaefmbF5Ig4="
   },
   "vultr": {
-    "hash": "sha256-6NiVW6kqUCeit6Dc9GbP4mV03UJkqo+UwHsDE4xMwzQ=",
+    "hash": "sha256-DfiJgN1R7qW3c13hBabsMizY3mYamIq8AGms1q9kdVU=",
     "homepage": "https://registry.terraform.io/providers/vultr/vultr",
     "owner": "vultr",
     "repo": "terraform-provider-vultr",
-    "rev": "v2.11.4",
+    "rev": "v2.12.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/remote/freerdp/default.nix b/pkgs/applications/networking/remote/freerdp/default.nix
index d072a03c0b47..58c22375af47 100644
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@@ -156,7 +156,7 @@ stdenv.mkDerivation rec {
     WITH_X11 = true;
   };
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin [
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
     "-DTARGET_OS_IPHONE=0"
     "-DTARGET_OS_WATCH=0"
     "-include AudioToolbox/AudioToolbox.h"
diff --git a/pkgs/applications/networking/sniffers/kismet/default.nix b/pkgs/applications/networking/sniffers/kismet/default.nix
index 1e4bb853742e..b0feaf38ecc4 100644
--- a/pkgs/applications/networking/sniffers/kismet/default.nix
+++ b/pkgs/applications/networking/sniffers/kismet/default.nix
@@ -71,25 +71,27 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals withNetworkManager [
     networkmanager
     glib
-  ] ++ lib.optional withSensors [
+  ] ++ lib.optionals withSensors [
     lm_sensors
   ];
 
   propagatedBuildInputs = [
-  ] ++ lib.optional withPython (python3.withPackages (ps: [
-    ps.numpy
-    ps.protobuf
-    ps.pyserial
-    ps.setuptools
-    ps.websockets
-  ]));
+  ] ++ lib.optionals withPython [
+    (python3.withPackages (ps: [
+      ps.numpy
+      ps.protobuf
+      ps.pyserial
+      ps.setuptools
+      ps.websockets
+    ]))
+  ];
 
   configureFlags = [
-  ] ++ lib.optional (!withNetworkManager) [
+  ] ++ lib.optionals (!withNetworkManager) [
     "--disable-libnm"
-  ] ++ lib.optional (!withPython) [
+  ] ++ lib.optionals (!withPython) [
     "--disable-python-tools"
-  ] ++ lib.optional (!withSensors) [
+  ] ++ lib.optionals (!withSensors) [
     "--disable-lmsensors"
   ];
 
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index e88ae758d2ad..cc40237d1552 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -119,7 +119,7 @@ let
     flatten flip
     concatMapStrings concatStringsSep
     getDev getLib
-    optional optionals optionalString;
+    optionals optionalString;
 
   jre' = jre17_minimal.override {
     modules = [ "java.base" "java.desktop" "java.logging" "java.sql" ];
@@ -195,7 +195,7 @@ in
     tar -xf ${srcs.translations}
   '';
 
-  patches = optional (variant == "still") [ ./skip-failed-test-with-icu70.patch ./gpgme-1.18.patch ]
+  patches = optionals (variant == "still") [ ./skip-failed-test-with-icu70.patch ./gpgme-1.18.patch ]
   ;
 
   ### QT/KDE
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index c8d3de79f155..fff9200285aa 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -48,7 +48,7 @@ rec {
       };
 
       buildInputs = oldAttrs.buildInputs
-        ++ lib.optional withSeccomp [ libseccomp ];
+        ++ lib.optionals withSeccomp [ libseccomp ];
     });
 
     docker-tini = tini.overrideAttrs (oldAttrs: {
diff --git a/pkgs/development/libraries/gtk-frdp/default.nix b/pkgs/development/libraries/gtk-frdp/default.nix
index a76805d8d1fb..acd2cae6abfc 100644
--- a/pkgs/development/libraries/gtk-frdp/default.nix
+++ b/pkgs/development/libraries/gtk-frdp/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     };
   };
 
-  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin [
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
     "-DTARGET_OS_IPHONE=0"
     "-DTARGET_OS_WATCH=0"
   ];
diff --git a/pkgs/development/libraries/proj/default.nix b/pkgs/development/libraries/proj/default.nix
index 2e1000ef5e64..87736e1ebc75 100644
--- a/pkgs/development/libraries/proj/default.nix
+++ b/pkgs/development/libraries/proj/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "proj";
-  version = "9.1.0";
+  version = "9.1.1";
 
   src = fetchFromGitHub {
     owner = "OSGeo";
     repo = "PROJ";
     rev = version;
-    hash = "sha256-Upsp72RorV+5PFPHOK3zCJgVTRZ6fSVVFRope8Bp8/M=";
+    hash = "sha256-yw7eSm64qFFt9egJWKVyVo0e7xQRSmfUY7pk6Cwvwdk=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/smokegen/default.nix b/pkgs/development/libraries/smokegen/default.nix
index 643ae1064db7..2a93965aeb39 100644
--- a/pkgs/development/libraries/smokegen/default.nix
+++ b/pkgs/development/libraries/smokegen/default.nix
@@ -1,16 +1,18 @@
-{ pkgs, lib, ... }:
+{ stdenv, lib, cmake, qt4, fetchzip }:
 
-pkgs.stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "smokegen";
-  version = "v4.14.3";
-  src = pkgs.fetchzip {
-    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
+  version = "4.14.3";
+
+  src = fetchzip {
+    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/v${version}/${pname}-v${version}.tar.gz";
     hash = "sha256-finsoruPeJZLawIjNUJ25Pq54eaCByfALVraNQJPk7c=";
   };
-  buildInputs = [ pkgs.cmake pkgs.qt4 ];
-  buildPhase = ''
-      cmake .
-    '';
+
+  strictDeps = true;
+  nativeBuildInputs = [ cmake qt4 ];
+  buildInputs = [ qt4 ];
+
   meta = with lib; {
     description = "A general purpose C++ parser with a plugin infrastructure";
     homepage = "https://invent.kde.org/unmaintained/smokegen";
diff --git a/pkgs/development/libraries/smokeqt/default.nix b/pkgs/development/libraries/smokeqt/default.nix
index 145a9f243bb3..1c427b8abb70 100644
--- a/pkgs/development/libraries/smokeqt/default.nix
+++ b/pkgs/development/libraries/smokeqt/default.nix
@@ -1,16 +1,22 @@
-{ pkgs, lib, ... }:
+{ stdenv, lib, cmake, qt4, smokegen, fetchzip }:
 
-pkgs.stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "smokeqt";
-  version = "v4.14.3";
-  src = pkgs.fetchzip {
-    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
+  version = "4.14.3";
+
+  src = fetchzip {
+    url = "https://invent.kde.org/unmaintained/${pname}/-/archive/v${version}/${pname}-v${version}.tar.gz";
     hash = "sha256-8FiEGF8gduVw5I/bi2wExGUWmjIjYEhWpjpXKJGBNMg=";
   };
+
+  strictDeps = true;
+  nativeBuildInputs = [ cmake smokegen ];
+  buildInputs = [ qt4 ];
+
   cmakeFlags = [
     "-DCMAKE_CXX_STANDARD=98"
   ];
-  buildInputs = [ pkgs.cmake pkgs.qt4 pkgs.smokegen ];
+
   meta = with lib; {
     description = "Bindings for the Qt libraries";
     homepage = "https://invent.kde.org/unmaintained/smokeqt";
diff --git a/pkgs/development/ocaml-modules/lambda-term/default.nix b/pkgs/development/ocaml-modules/lambda-term/default.nix
index 239cbca42986..c073ddf39cd2 100644
--- a/pkgs/development/ocaml-modules/lambda-term/default.nix
+++ b/pkgs/development/ocaml-modules/lambda-term/default.nix
@@ -26,7 +26,7 @@ buildDunePackage rec {
   };
 
   propagatedBuildInputs = [ zed lwt_log lwt_react mew_vi ]
-    ++ lib.optional (lib.versionAtLeast version "3.3.1") [ uucp logs ] ;
+    ++ lib.optionals (lib.versionAtLeast version "3.3.1") [ uucp logs ] ;
 
   meta = {
     description = "Terminal manipulation library for OCaml";
diff --git a/pkgs/development/python-modules/bundlewrap/default.nix b/pkgs/development/python-modules/bundlewrap/default.nix
index e4eae0d3fe75..75e3cd4f4b3b 100644
--- a/pkgs/development/python-modules/bundlewrap/default.nix
+++ b/pkgs/development/python-modules/bundlewrap/default.nix
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [ setuptools ];
   propagatedBuildInputs = [
     cryptography jinja2 Mako passlib pyyaml requests tomlkit librouteros
-  ] ++ lib.optional (pythonOlder "3.11") [ rtoml ];
+  ] ++ lib.optionals (pythonOlder "3.11") [ rtoml ];
 
   pythonImportsCheck = [ "bundlewrap" ];
 
diff --git a/pkgs/development/python-modules/intellifire4py/default.nix b/pkgs/development/python-modules/intellifire4py/default.nix
index f0b702b1b513..f17af2b24fa5 100644
--- a/pkgs/development/python-modules/intellifire4py/default.nix
+++ b/pkgs/development/python-modules/intellifire4py/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "intellifire4py";
-  version = "2.2.1";
+  version = "2.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jeeftor";
     repo = pname;
-    rev = version;
-    hash = "sha256-dn5814eRZ9456Fn7blf1UzXPii4dXu3sjoXBV7CmwSs=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-iqlKfpnETLqQwy5sNcK2x/TgmuN2hCfYoHEFK2WWVXI=";
   };
 
   propagatedBuildInputs = [
@@ -50,6 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to read Intellifire fireplace status data";
     homepage = "https://github.com/jeeftor/intellifire4py";
+    changelog = "https://github.com/jeeftor/intellifire4py/blob/${version}/CHANGELOG";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index c7a294eef44f..cc709c4f47a3 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     babel
     jupyter_server
     tomli
-  ] ++ lib.optional (pythonOlder "3.10") [
+  ] ++ lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ];
 
diff --git a/pkgs/development/python-modules/pip-requirements-parser/default.nix b/pkgs/development/python-modules/pip-requirements-parser/default.nix
index 0693fbf4fde8..fd1b95c48226 100644
--- a/pkgs/development/python-modules/pip-requirements-parser/default.nix
+++ b/pkgs/development/python-modules/pip-requirements-parser/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pip-requirements-parser";
-  version = "31.2.0";
+  version = "32.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "nexB";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-i4hw3tS4i2ek2JzcDiGo5aFFJ9J2JJ9MB5vxDhOilb0=";
+    hash = "sha256-Wu4C93PWujygKIzXqUjCmKWcllr+hkuvnqDuw6/D9Do=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to parse pip requirements";
     homepage = "https://github.com/nexB/pip-requirements-parser";
+    changelog = "https://github.com/nexB/pip-requirements-parser/blob/v${version}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 4061edfc5ae4..cd1fb4806f18 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -37,7 +37,7 @@ buildPythonPackage {
     buildPackages."protobuf${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}"
   ];
 
-  setupPyGlobalFlags = "--cpp_implementation";
+  setupPyGlobalFlags = [ "--cpp_implementation" ];
 
   pythonImportsCheck = [
     "google.protobuf"
diff --git a/pkgs/development/python-modules/pyshark/default.nix b/pkgs/development/python-modules/pyshark/default.nix
index c7b469dbf760..b33a1bd9f385 100644
--- a/pkgs/development/python-modules/pyshark/default.nix
+++ b/pkgs/development/python-modules/pyshark/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   ];
 
   # `stripLen` does not seem to work here
-  patchFlags = "-p2";
+  patchFlags = [ "-p2" ];
 
   sourceRoot = "${src.name}/src";
 
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index 4c9cf5003cce..62e6ce951bde 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -133,7 +133,7 @@ buildPythonPackage rec {
     # https://github.com/python-lsp/python-lsp-server/issues/243
     "test_numpy_completions"
     "test_workspace_loads_pycodestyle_config"
-  ] ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) [
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # pyqt5 is broken on aarch64-darwin
     "test_pyqt_completion"
   ];
diff --git a/pkgs/development/tools/ansible-language-server/default.nix b/pkgs/development/tools/ansible-language-server/default.nix
index be4bba8c2659..8d9b1f0ca50f 100644
--- a/pkgs/development/tools/ansible-language-server/default.nix
+++ b/pkgs/development/tools/ansible-language-server/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildNpmPackage
 , fetchFromGitHub
+, nix-update-script
 }:
 
 buildNpmPackage rec {
@@ -29,7 +30,7 @@ buildNpmPackage rec {
     sed -i '/"prepack"/d' package.json
   '';
 
-  passthru.updateScript = {
+  passthru.updateScript = nix-update-script {
     attrPath = pname;
   };
 
diff --git a/pkgs/development/tools/godot/4/default.nix b/pkgs/development/tools/godot/4/default.nix
index 177e2448cc31..13ccfcc80964 100644
--- a/pkgs/development/tools/godot/4/default.nix
+++ b/pkgs/development/tools/godot/4/default.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  sconsFlags = "platform=linuxbsd target=editor production=true";
+  sconsFlags = [ "platform=linuxbsd target=editor production=true" ];
   preConfigure = ''
     sconsFlags+=" ${
       lib.concatStringsSep " "
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
index cff0b459d64b..6a140ca25289 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/default.nix
@@ -397,7 +397,7 @@ lib.composeManyExtensions [
           (
             old: {
               nativeBuildInputs = (old.nativeBuildInputs or [ ])
-                ++ lib.optional (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
+                ++ lib.optionals (lib.versionAtLeast old.version "3.4") [ self.setuptools-rust ]
                 ++ lib.optional (!self.isPyPy) pyBuildPackages.cffi
                 ++ lib.optional (lib.versionAtLeast old.version "3.5" && !isWheel)
                 (with pkgs.rustPlatform; [ cargoSetupHook rust.cargo rust.rustc ]);
@@ -1078,9 +1078,9 @@ lib.composeManyExtensions [
 
           buildInputs = old.buildInputs or [ ] ++ [
             pkgs.which
-          ] ++ lib.optional enableGhostscript [
+          ] ++ lib.optionals enableGhostscript [
             pkgs.ghostscript
-          ] ++ lib.optional stdenv.isDarwin [
+          ] ++ lib.optionals stdenv.isDarwin [
             Cocoa
           ];
 
@@ -1097,7 +1097,7 @@ lib.composeManyExtensions [
 
           nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
             pkg-config
-          ] ++ lib.optional (lib.versionAtLeast super.matplotlib.version "3.5.0") [
+          ] ++ lib.optionals (lib.versionAtLeast super.matplotlib.version "3.5.0") [
             self.setuptools-scm
             self.setuptools-scm-git-archive
           ];
@@ -2111,8 +2111,8 @@ lib.composeManyExtensions [
         if old.format != "wheel" then {
           nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++
             [ pkgs.gfortran ] ++
-            lib.optional (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ] ++
-            lib.optional (lib.versionAtLeast super.scipy.version "1.9.0") [ self.meson-python pkg-config ];
+            lib.optionals (lib.versionAtLeast super.scipy.version "1.7.0") [ self.pythran ] ++
+            lib.optionals (lib.versionAtLeast super.scipy.version "1.9.0") [ self.meson-python pkg-config ];
           propagatedBuildInputs = (old.propagatedBuildInputs or [ ]) ++ [ self.pybind11 ];
           setupPyBuildFlags = [ "--fcompiler='gnu95'" ];
           enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 244092441b24..8d8342cce980 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   buildFlags = [ "module" ];
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
diff --git a/pkgs/servers/libreddit/default.nix b/pkgs/servers/libreddit/default.nix
index 0209102eb8d9..2aa7159a5f99 100644
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-uIr8aUDErHVUKML2l6nITSBpOxqg3h1Md0948BxvutI=";
 
-  buildInputs = lib.optional stdenv.isDarwin [
+  buildInputs = lib.optionals stdenv.isDarwin [
     Security
   ];
 
diff --git a/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix b/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
index 21ccb8178c34..df21ef09f9f1 100644
--- a/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
+++ b/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
@@ -1,42 +1,33 @@
 { lib
 , fetchFromGitHub
-, fetchpatch
 , buildGoModule
+, nixosTests
 }:
 
 buildGoModule rec {
   pname = "smartctl_exporter";
-  version = "unstable-2020-11-14";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = pname;
-    rev = "e27581d56ad80340fb076d3ce22cef337ed76679";
-    sha256 = "sha256-iWaFDjVLBIAA9zGe0utbuvmEdA3R5lge0iCh3j2JfE8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fc1NZ5QwzR/jJkeaDm5PMT4wBFFlqZOXKTJMBJWKJJ8=";
   };
 
-  patches = [
-    # Fixes out of range panic (https://github.com/prometheus-community/smartctl_exporter/issues/19)
-    (fetchpatch {
-      url = "https://github.com/prometheus-community/smartctl_exporter/commit/15575301a8e2fe5802a8c066c6fa9765d50b8cfa.patch";
-      sha256 = "sha256-HLUrGXNz3uKpuQBUgQBSw6EGbGl23hQnimTGl64M5bQ=";
-    })
-    # Fix validation on empty smartctl response (https://github.com/prometheus-community/smartctl_exporter/pull/31)
-    (fetchpatch {
-      url = "https://github.com/prometheus-community/smartctl_exporter/commit/744b4e5f6a46e029d31d5aa46642e85f429c2cfa.patch";
-      sha256 = "sha256-MgLtYR1SpM6XrZQQ3AgQRmNF3OnaBCqXMJRV9BOzKPc=";
-    })
-    # Fixes missing metrics if outside of query interval (https://github.com/prometheus-community/smartctl_exporter/pull/18)
-    ./0001-Return-the-cached-value-if-it-s-not-time-to-scan-aga.patch
+  vendorSha256 = "sha256-lQKuT5dzjDHFpRSmcXpKD1RJDlEv+0kcxENkv3mT4FU=";
+
+  ldflags = [
+    "-X github.com/prometheus/common/version.Version=${version}"
   ];
 
-  vendorSha256 = "1xhrzkfm2p20k7prgdfax4408g4qpa4wbxigmcmfz7kjg2zi88ld";
+  passthru.tests = { inherit (nixosTests.prometheus-exporters) smartctl; };
 
   meta = with lib; {
     description = "Export smartctl statistics for Prometheus";
     homepage = "https://github.com/prometheus-community/smartctl_exporter";
     license = licenses.lgpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ hexa ];
+    maintainers = with maintainers; [ hexa Frostman ];
   };
 }
diff --git a/pkgs/servers/monitoring/uptime-kuma/default.nix b/pkgs/servers/monitoring/uptime-kuma/default.nix
index 45d9e2c19f3a..515e4e2edaf4 100644
--- a/pkgs/servers/monitoring/uptime-kuma/default.nix
+++ b/pkgs/servers/monitoring/uptime-kuma/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, stdenv, fetchFromGitHub, fetchzip, substituteAll, nixosTests, iputils }:
+{ pkgs, lib, stdenv, fetchFromGitHub, fetchzip, nixosTests, iputils, nodejs, makeWrapper }:
 let
   deps = import ./composition.nix { inherit pkgs; };
 in
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace "/sbin/ping" "${iputils}/bin/ping"
   '';
 
-  buildInputs = [ pkgs.makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/share/
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postFixup = ''
-    makeWrapper ${pkgs.nodejs}/bin/node $out/bin/uptime-kuma-server \
+    makeWrapper ${nodejs}/bin/node $out/bin/uptime-kuma-server \
       --add-flags $out/share/server/server.js \
       --chdir $out/share/
   '';
diff --git a/pkgs/servers/photoprism/default.nix b/pkgs/servers/photoprism/default.nix
index 678f30c372d0..a33d3d183004 100644
--- a/pkgs/servers/photoprism/default.nix
+++ b/pkgs/servers/photoprism/default.nix
@@ -42,7 +42,7 @@ in
 stdenv.mkDerivation {
   inherit pname version;
 
-  buildInputs = [
+  nativeBuildInputs = [
     makeWrapper
   ];
 
diff --git a/pkgs/servers/search/elasticsearch/6.x.nix b/pkgs/servers/search/elasticsearch/6.x.nix
index f14138ca0897..87750f196f3f 100644
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (rec {
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre_headless util-linux ]
-             ++ optional enableUnfree [ zlib libxcrypt ];
+             ++ optionals enableUnfree [ zlib libxcrypt ];
 
   installPhase = ''
     mkdir -p $out
diff --git a/pkgs/shells/zsh/default.nix b/pkgs/shells/zsh/default.nix
index 782c2fb2bea3..5a003b889a04 100644
--- a/pkgs/shells/zsh/default.nix
+++ b/pkgs/shells/zsh/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
     "--enable-pcre"
     "--enable-zprofile=${placeholder "out"}/etc/zprofile"
     "--disable-site-fndir"
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform && !stdenv.hostPlatform.isStatic) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform && !stdenv.hostPlatform.isStatic) [
     # Also see: https://github.com/buildroot/buildroot/commit/2f32e668aa880c2d4a2cce6c789b7ca7ed6221ba
     "zsh_cv_shared_environ=yes"
     "zsh_cv_shared_tgetent=yes"
diff --git a/pkgs/tools/misc/wwcd/default.nix b/pkgs/tools/misc/wwcd/default.nix
index d18c72a25eeb..41c66d945f40 100644
--- a/pkgs/tools/misc/wwcd/default.nix
+++ b/pkgs/tools/misc/wwcd/default.nix
@@ -17,11 +17,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-laf1DEtdEs7q+rtp5Y5rb+7AGsKUv5T413CFWJiURWw=";
   };
 
-  autoreconfFlags = "-if";
   nativeBuildInputs = [
     autoreconfHook pkg-config check
   ];
 
+  autoreconfFlags = [ "-if" ];
+
   meta = with lib; {
     description = "What would cron do? Read crontab entries from stdin and print time of next execution(s)";
     homepage = "https://git.sr.ht/~bitfehler/wwcd";
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index 0544b6d1ec11..8c09f1e430f6 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.8.11";
+  version = "1.8.13";
 
   src = fetchFromGitHub {
     owner = "djcb";
     repo = "mu";
     rev = "v${version}";
-    hash = "sha256-IEfwAAUqEGtN4vww0pfW7iuIY/U3eqzC+MJsqtossCw=";
+    hash = "sha256-uXrJOBF3X8UF1ktTfAoYgzc0QBLvyzzGQVJVfs8tjng=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/wayland/waynergy/default.nix b/pkgs/tools/wayland/waynergy/default.nix
index c6b10c293bfd..fce7ac6605af 100644
--- a/pkgs/tools/wayland/waynergy/default.nix
+++ b/pkgs/tools/wayland/waynergy/default.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation rec {
   };
 
   depsBuildBuild = [ pkg-config ];
-  buildInputs = [ libdrm wayland wayland-protocols wl-clipboard libxkbcommon cmake libressl ];
   nativeBuildInputs = [ meson ninja ];
+  buildInputs = [ libdrm wayland wayland-protocols wl-clipboard libxkbcommon libressl ];
 
   postPatch = ''
     substituteInPlace waynergy.desktop --replace "Exec=/usr/bin/waynergy" "Exec=$out/bin/waynergy"