diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 76db9d0007ce..80d61816acb4 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -375,8 +375,74 @@ Assuming the following directory structure, we can define `sourceRoot` and `pnpm
   pnpmRoot = "frontend";
 ```
 
+### Yarn {#javascript-yarn}
+
+Yarn based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies. Nixpkgs provides the Nix function `fetchYarnDeps` which fetches an offline cache suitable for running `yarn install` before building the project. In addition, Nixpkgs provides the hooks:
+
+- `yarnConfigHook`: Fetches the dependencies from the offline cache and installs them into `node_modules`.
+- `yarnBuildHook`: Runs `yarn build` or a specified `yarn` command that builds the project.
+
+An example usage of the above attributes is:
+
+```nix
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  nodejs,
+  npmHooks,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "...";
+  version = "...";
+
+  src = fetchFromGitHub {
+    owner = "...";
+    repo = "...";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-mo8urQaWIHu33+r0Y7mL9mJ/aSe/5CihuIetTeDHEUQ=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    # Needed for executing package.json scripts
+    nodejs
+    npmHooks.npmInstallHook
+  ];
+
+  meta = {
+    # ...
+  };
+})
+```
+
+Note that there is no setup hook for installing yarn based packages - `npmHooks.npmInstallHook` should fit most cases, but sometimes you may need to override the `installPhase` completely.
+
+#### `yarnConfigHook` arguments {#javascript-yarnconfighook}
+
+By default, `yarnConfigHook` relies upon the attribute `${yarnOfflineCache}` (or `${offlineCache}` if the former is not set) to find the location of the offline cache produced by `fetchYarnDeps`. To disable this phase, you can set `dontYarnInstallDeps = true` or override the `configurePhase`.
+
+#### `yarnBuildHook` arguments {#javascript-yarnbuildhook}
+
+This script by default runs `yarn --offline build`, and it relies upon the project's dependencies installed at `node_modules`. Below is a list of additional `mkDerivation` arguments read by this hook:
+
+- `yarnBuildScript`: Sets a different `yarn --offline` subcommand (defaults to `build`).
+- `yarnBuildFlags`: Single string list of additional flags to pass the above command, or a Nix list of such additional flags.
+
 ### yarn2nix {#javascript-yarn2nix}
 
+WARNING: The `yarn2nix` functions have been deprecated in favor of the new `yarnConfigHook` and `yarnBuildHook`. Documentation for them still appears here for the sake of the packages that still use them. See also a tracking issue [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
+
 #### Preparation {#javascript-yarn2nix-preparation}
 
 You will need at least a `yarn.lock` file. If upstream does not have one you need to generate it and reference it in your package definition.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index faae462a68d3..b9daced0b17d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4123,6 +4123,12 @@
     githubId = 34543609;
     name = "creator54";
   };
+  crem = {
+    email = "max@alstercaminer.com";
+    github = "MaxCaminer";
+    githubId = 16345077;
+    name = "crem";
+  };
   crertel = {
     email = "chris@kedagital.com";
     github = "crertel";
@@ -7891,6 +7897,13 @@
     githubId = 33969028;
     name = "Sebastian Hasler";
   };
+  hausken = {
+    name = "Hausken";
+    email = "hauskens-git@disp.lease>";
+    github = "hauskens";
+    githubId = 79340822;
+    keys = [ { fingerprint = "3582 5B85 66C8 4F36 45C7  EC42 809F 7938 9CB1 8650"; } ];
+  };
   havvy = {
     email = "ryan.havvy@gmail.com";
     github = "Havvy";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index d5c7a218b4b5..f54d0f435249 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -922,6 +922,16 @@ with lib.maintainers;
     shortName = "Steam";
   };
 
+  stridtech = {
+    # Verify additions by approval of an already existing member of the team
+    members = [
+      superherointj
+      ulrikstrid
+    ];
+    scope = "Group registration for Strid Tech AB team members who collectively maintain packages";
+    shortName = "StridTech";
+  };
+
   systemd = {
     members = [ ];
     githubTeams = [ "systemd" ];
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index a28ae62468c0..7799d94004ab 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -197,6 +197,9 @@
 
 - `services.roundcube.maxAttachmentSize` will multiply the value set with `1.37` to offset overhead introduced by the base64 encoding applied to attachments.
 
+- The `services.mxisd` module has been removed as both [mxisd](https://github.com/kamax-matrix/mxisd) and [ma1sd](https://github.com/ma1uta/ma1sd) are not maintained any longer.
+  Consequently the package `pkgs.ma1sd` has also been removed.
+
 ## Other Notable Changes {#sec-release-24.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -218,6 +221,8 @@
 - `security.pam.u2f` now follows RFC42.
   All module options are now settable through the freeform `.settings`.
 
+- The hooks `yarnConfigHook` and `yarnBuildHook` were added. These should replace `yarn2nix.mkYarnPackage` and other `yarn2nix` related tools. The motivation to get rid of `yarn2nix` tools is the fact that they are too complex and hard to maintain, and they rely upon too much Nix evaluation which is problematic if import-from-derivation is not allowed (see more details at [#296856](https://github.com/NixOS/nixpkgs/issues/296856). The transition from `mkYarnPackage` to `yarn{Config,Build}Hook` is tracked at [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
+
 - Cinnamon has been updated to 6.2.
   - Following Mint 22 defaults, the Cinnamon module no longer ships geary and hexchat by default.
   - Nemo is now built with gtk-layer-shell support, note that for now it will be expected to see nemo-desktop
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index f26917c0bad5..36a1a054fea9 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -180,7 +180,7 @@ in
       #dnsmasq = 141;# dynamically allocated as of 2021-09-03
       #uhub = 142; # unused
       yandexdisk = 143;
-      mxisd = 144; # was once collectd
+      # mxisd = 144; # removed 2024-07-10
       #consul = 145;# dynamically allocated as of 2021-09-03
       #mailpile = 146; # removed 2022-01-12
       redmine = 147;
@@ -503,7 +503,7 @@ in
       #dnsmasq = 141; # unused
       uhub = 142;
       #yandexdisk = 143; # unused
-      mxisd = 144; # was once collectd
+      # mxisd = 144; # removed 2024-07-10
       #consul = 145; # unused
       #mailpile = 146; # removed 2022-01-12
       redmine = 147;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index eb2f049985c9..3465f3653db1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1087,7 +1087,6 @@
   ./services/networking/mullvad-vpn.nix
   ./services/networking/multipath.nix
   ./services/networking/murmur.nix
-  ./services/networking/mxisd.nix
   ./services/networking/mycelium.nix
   ./services/networking/namecoind.nix
   ./services/networking/nar-serve.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index d4661a19188c..a4c0f0d5c25e 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, ... }:
 
 let
   inherit (lib)
@@ -74,6 +74,7 @@ in
     (mkRemovedOptionModule [ "services" "mathics" ] "The Mathics module has been removed")
     (mkRemovedOptionModule [ "services" "meguca" ] "Use meguca has been removed from nixpkgs")
     (mkRemovedOptionModule [ "services" "mesos" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "mxisd" ] "The mxisd module has been removed as both mxisd and ma1sd got removed.")
     (mkRemovedOptionModule [ "services" "moinmoin" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "mwlib" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "pantheon" "files" ] ''
diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix
index 4d18d378d794..32d8f3dfecd5 100644
--- a/nixos/modules/services/cluster/k3s/default.nix
+++ b/nixos/modules/services/cluster/k3s/default.nix
@@ -17,6 +17,109 @@ let
       ]
       ++ config
     ) instruction;
+
+  manifestDir = "/var/lib/rancher/k3s/server/manifests";
+  chartDir = "/var/lib/rancher/k3s/server/static/charts";
+  imageDir = "/var/lib/rancher/k3s/agent/images";
+
+  manifestModule =
+    let
+      mkTarget =
+        name: if (lib.hasSuffix ".yaml" name || lib.hasSuffix ".yml" name) then name else name + ".yaml";
+    in
+    lib.types.submodule (
+      {
+        name,
+        config,
+        options,
+        ...
+      }:
+      {
+        options = {
+          enable = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+            description = "Whether this manifest file should be generated.";
+          };
+
+          target = lib.mkOption {
+            type = lib.types.nonEmptyStr;
+            example = lib.literalExpression "manifest.yaml";
+            description = ''
+              Name of the symlink (relative to {file}`${manifestDir}`).
+              Defaults to the attribute name.
+            '';
+          };
+
+          content = lib.mkOption {
+            type = with lib.types; nullOr (either attrs (listOf attrs));
+            default = null;
+            description = ''
+              Content of the manifest file. A single attribute set will
+              generate a single document YAML file. A list of attribute sets
+              will generate multiple documents separated by `---` in a single
+              YAML file.
+            '';
+          };
+
+          source = lib.mkOption {
+            type = lib.types.path;
+            example = lib.literalExpression "./manifests/app.yaml";
+            description = ''
+              Path of the source `.yaml` file.
+            '';
+          };
+        };
+
+        config = {
+          target = lib.mkDefault (mkTarget name);
+          source = lib.mkIf (config.content != null) (
+            let
+              name' = "k3s-manifest-" + builtins.baseNameOf name;
+              docName = "k3s-manifest-doc-" + builtins.baseNameOf name;
+              yamlDocSeparator = builtins.toFile "yaml-doc-separator" "\n---\n";
+              mkYaml = name: x: (pkgs.formats.yaml { }).generate name x;
+              mkSource =
+                value:
+                if builtins.isList value then
+                  pkgs.concatText name' (
+                    lib.concatMap (x: [
+                      yamlDocSeparator
+                      (mkYaml docName x)
+                    ]) value
+                  )
+                else
+                  mkYaml name' value;
+            in
+            lib.mkDerivedConfig options.content mkSource
+          );
+        };
+      }
+    );
+
+  enabledManifests = with builtins; filter (m: m.enable) (attrValues cfg.manifests);
+  linkManifestEntry = m: "${pkgs.coreutils-full}/bin/ln -sfn ${m.source} ${manifestDir}/${m.target}";
+  linkImageEntry = image: "${pkgs.coreutils-full}/bin/ln -sfn ${image} ${imageDir}/${image.name}";
+  linkChartEntry =
+    let
+      mkTarget = name: if (lib.hasSuffix ".tgz" name) then name else name + ".tgz";
+    in
+    name: value:
+    "${pkgs.coreutils-full}/bin/ln -sfn ${value} ${chartDir}/${mkTarget (builtins.baseNameOf name)}";
+
+  activateK3sContent = pkgs.writeShellScript "activate-k3s-content" ''
+    ${lib.optionalString (
+      builtins.length enabledManifests > 0
+    ) "${pkgs.coreutils-full}/bin/mkdir -p ${manifestDir}"}
+    ${lib.optionalString (cfg.charts != { }) "${pkgs.coreutils-full}/bin/mkdir -p ${chartDir}"}
+    ${lib.optionalString (
+      builtins.length cfg.images > 0
+    ) "${pkgs.coreutils-full}/bin/mkdir -p ${imageDir}"}
+
+    ${builtins.concatStringsSep "\n" (map linkManifestEntry enabledManifests)}
+    ${builtins.concatStringsSep "\n" (lib.mapAttrsToList linkChartEntry cfg.charts)}
+    ${builtins.concatStringsSep "\n" (map linkImageEntry cfg.images)}
+  '';
 in
 {
   imports = [ (removeOption [ "docker" ] "k3s docker option is no longer supported.") ];
@@ -127,11 +230,148 @@ in
       default = null;
       description = "File path containing the k3s YAML config. This is useful when the config is generated (for example on boot).";
     };
+
+    manifests = mkOption {
+      type = types.attrsOf manifestModule;
+      default = { };
+      example = lib.literalExpression ''
+        deployment.source = ../manifests/deployment.yaml;
+        my-service = {
+          enable = false;
+          target = "app-service.yaml";
+          content = {
+            apiVersion = "v1";
+            kind = "Service";
+            metadata = {
+              name = "app-service";
+            };
+            spec = {
+              selector = {
+                "app.kubernetes.io/name" = "MyApp";
+              };
+              ports = [
+                {
+                  name = "name-of-service-port";
+                  protocol = "TCP";
+                  port = 80;
+                  targetPort = "http-web-svc";
+                }
+              ];
+            };
+          }
+        };
+
+        nginx.content = [
+          {
+            apiVersion = "v1";
+            kind = "Pod";
+            metadata = {
+              name = "nginx";
+              labels = {
+                "app.kubernetes.io/name" = "MyApp";
+              };
+            };
+            spec = {
+              containers = [
+                {
+                  name = "nginx";
+                  image = "nginx:1.14.2";
+                  ports = [
+                    {
+                      containerPort = 80;
+                      name = "http-web-svc";
+                    }
+                  ];
+                }
+              ];
+            };
+          }
+          {
+            apiVersion = "v1";
+            kind = "Service";
+            metadata = {
+              name = "nginx-service";
+            };
+            spec = {
+              selector = {
+                "app.kubernetes.io/name" = "MyApp";
+              };
+              ports = [
+                {
+                  name = "name-of-service-port";
+                  protocol = "TCP";
+                  port = 80;
+                  targetPort = "http-web-svc";
+                }
+              ];
+            };
+          }
+        ];
+      '';
+      description = ''
+        Auto-deploying manifests that are linked to {file}`${manifestDir}` before k3s starts.
+        Note that deleting manifest files will not remove or otherwise modify the resources
+        it created. Please use the the `--disable` flag or `.skip` files to delete/disable AddOns,
+        as mentioned in the [docs](https://docs.k3s.io/installation/packaged-components#disabling-manifests).
+        This option only makes sense on server nodes (`role = server`).
+        Read the [auto-deploying manifests docs](https://docs.k3s.io/installation/packaged-components#auto-deploying-manifests-addons)
+        for further information.
+      '';
+    };
+
+    charts = mkOption {
+      type = with types; attrsOf (either path package);
+      default = { };
+      example = lib.literalExpression ''
+        nginx = ../charts/my-nginx-chart.tgz;
+        redis = ../charts/my-redis-chart.tgz;
+      '';
+      description = ''
+        Packaged Helm charts that are linked to {file}`${chartDir}` before k3s starts.
+        The attribute name will be used as the link target (relative to {file}`${chartDir}`).
+        The specified charts will only be placed on the file system and made available to the
+        Kubernetes APIServer from within the cluster, you may use the
+        [k3s Helm controller](https://docs.k3s.io/helm#using-the-helm-controller)
+        to deploy the charts. This option only makes sense on server nodes
+        (`role = server`).
+      '';
+    };
+
+    images = mkOption {
+      type = with types; listOf package;
+      default = [ ];
+      example = lib.literalExpression ''
+        [
+          (pkgs.dockerTools.pullImage {
+            imageName = "docker.io/bitnami/keycloak";
+            imageDigest = "sha256:714dfadc66a8e3adea6609bda350345bd3711657b7ef3cf2e8015b526bac2d6b";
+            sha256 = "0imblp0kw9vkcr7sp962jmj20fpmb3hvd3hmf4cs4x04klnq3k90";
+            finalImageTag = "21.1.2-debian-11-r0";
+          })
+        ]
+      '';
+      description = ''
+        List of derivations that provide container images.
+        All images are linked to {file}`${imageDir}` before k3s starts and consequently imported
+        by the k3s agent. This option only makes sense on nodes with an enabled agent.
+      '';
+    };
   };
 
   # implementation
 
   config = mkIf cfg.enable {
+    warnings =
+      (lib.optional (cfg.role != "server" && cfg.manifests != { })
+        "k3s: Auto deploying manifests are only installed on server nodes (role == server), they will be ignored by this node."
+      )
+      ++ (lib.optional (cfg.role != "server" && cfg.charts != { })
+        "k3s: Helm charts are only made available to the cluster on server nodes (role == server), they will be ignored by this node."
+      )
+      ++ (lib.optional (cfg.disableAgent && cfg.images != [ ])
+        "k3s: Images are only imported on nodes with an enabled agent, they will be ignored by this node"
+      );
+
     assertions = [
       {
         assertion = cfg.role == "agent" -> (cfg.configPath != null || cfg.serverAddr != "");
@@ -178,6 +418,7 @@ in
         LimitCORE = "infinity";
         TasksMax = "infinity";
         EnvironmentFile = cfg.environmentFile;
+        ExecStartPre = activateK3sContent;
         ExecStart = concatStringsSep " \\\n " (
           [ "${cfg.package}/bin/k3s ${cfg.role}" ]
           ++ (optional cfg.clusterInit "--cluster-init")
diff --git a/nixos/modules/services/networking/mxisd.nix b/nixos/modules/services/networking/mxisd.nix
deleted file mode 100644
index e53fb71788cd..000000000000
--- a/nixos/modules/services/networking/mxisd.nix
+++ /dev/null
@@ -1,137 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  isMa1sd =
-    package:
-    lib.hasPrefix "ma1sd" package.name;
-
-  isMxisd =
-    package:
-    lib.hasPrefix "mxisd" package.name;
-
-  cfg = config.services.mxisd;
-
-  server = optionalAttrs (cfg.server.name != null) { inherit (cfg.server) name; }
-        // optionalAttrs (cfg.server.port != null) { inherit (cfg.server) port; };
-
-  baseConfig = {
-    matrix.domain = cfg.matrix.domain;
-    key.path = "${cfg.dataDir}/signing.key";
-    storage = {
-      provider.sqlite.database = if isMa1sd cfg.package
-                                 then "${cfg.dataDir}/ma1sd.db"
-                                 else "${cfg.dataDir}/mxisd.db";
-    };
-  } // optionalAttrs (server != {}) { inherit server; };
-
-  # merges baseConfig and extraConfig into a single file
-  fullConfig = recursiveUpdate baseConfig cfg.extraConfig;
-
-  configFile = if isMa1sd cfg.package
-               then pkgs.writeText "ma1sd-config.yaml" (builtins.toJSON fullConfig)
-               else pkgs.writeText "mxisd-config.yaml" (builtins.toJSON fullConfig);
-
-in {
-  options = {
-    services.mxisd = {
-      enable = mkEnableOption "matrix federated identity server";
-
-      package = mkPackageOption pkgs "ma1sd" { };
-
-      environmentFile = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = ''
-          Path to an environment-file which may contain secrets to be
-          substituted via `envsubst`.
-        '';
-      };
-
-      dataDir = mkOption {
-        type = types.str;
-        default = "/var/lib/mxisd";
-        description = "Where data mxisd/ma1sd uses resides";
-      };
-
-      extraConfig = mkOption {
-        type = types.attrs;
-        default = {};
-        description = "Extra options merged into the mxisd/ma1sd configuration";
-      };
-
-      matrix = {
-
-        domain = mkOption {
-          type = types.str;
-          description = ''
-            the domain of the matrix homeserver
-          '';
-        };
-
-      };
-
-      server = {
-
-        name = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          description = ''
-            Public hostname of mxisd/ma1sd, if different from the Matrix domain.
-          '';
-        };
-
-        port = mkOption {
-          type = types.nullOr types.int;
-          default = null;
-          description = ''
-            HTTP port to listen on (unencrypted)
-          '';
-        };
-
-      };
-
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users.mxisd =
-      {
-        group = "mxisd";
-        home = cfg.dataDir;
-        createHome = true;
-        shell = "${pkgs.bash}/bin/bash";
-        uid = config.ids.uids.mxisd;
-      };
-
-    users.groups.mxisd =
-      {
-        gid = config.ids.gids.mxisd;
-      };
-
-    systemd.services.mxisd = {
-      description = "a federated identity server for the matrix ecosystem";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-
-      serviceConfig = let
-        executable = if isMa1sd cfg.package then "ma1sd" else "mxisd";
-      in {
-        Type = "simple";
-        User = "mxisd";
-        Group = "mxisd";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
-        ExecStart = "${cfg.package}/bin/${executable} -c ${cfg.dataDir}/mxisd-config.yaml";
-        ExecStartPre = "${pkgs.writeShellScript "mxisd-substitute-secrets" ''
-          umask 0077
-          ${pkgs.envsubst}/bin/envsubst -o ${cfg.dataDir}/mxisd-config.yaml \
-            -i ${configFile}
-        ''}";
-        WorkingDirectory = cfg.dataDir;
-        Restart = "on-failure";
-      };
-    };
-  };
-}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e6b4a4b66567..03ff34592982 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -596,7 +596,6 @@ in {
   musescore = handleTestOn ["x86_64-linux"] ./musescore.nix {};
   munin = handleTest ./munin.nix {};
   mutableUsers = handleTest ./mutable-users.nix {};
-  mxisd = handleTest ./mxisd.nix {};
   mycelium = handleTest ./mycelium {};
   mympd = handleTest ./mympd.nix {};
   mysql = handleTest ./mysql/mysql.nix {};
diff --git a/nixos/tests/k3s/auto-deploy.nix b/nixos/tests/k3s/auto-deploy.nix
new file mode 100644
index 000000000000..c2fae36c60be
--- /dev/null
+++ b/nixos/tests/k3s/auto-deploy.nix
@@ -0,0 +1,122 @@
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    k3s,
+    ...
+  }:
+  let
+    pauseImageEnv = pkgs.buildEnv {
+      name = "k3s-pause-image-env";
+      paths = with pkgs; [
+        tini
+        (hiPrio coreutils)
+        busybox
+      ];
+    };
+    pauseImage = pkgs.dockerTools.buildImage {
+      name = "test.local/pause";
+      tag = "local";
+      copyToRoot = pauseImageEnv;
+      config.Entrypoint = [
+        "/bin/tini"
+        "--"
+        "/bin/sleep"
+        "inf"
+      ];
+    };
+    helloImage = pkgs.dockerTools.buildImage {
+      name = "test.local/hello";
+      tag = "local";
+      copyToRoot = pkgs.hello;
+      config.Entrypoint = [ "${pkgs.hello}/bin/hello" ];
+    };
+  in
+  {
+    name = "${k3s.name}-auto-deploy";
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ k3s ];
+
+        # k3s uses enough resources the default vm fails.
+        virtualisation.memorySize = 1536;
+        virtualisation.diskSize = 4096;
+
+        services.k3s.enable = true;
+        services.k3s.role = "server";
+        services.k3s.package = k3s;
+        # Slightly reduce resource usage
+        services.k3s.extraFlags = builtins.toString [
+          "--disable coredns"
+          "--disable local-storage"
+          "--disable metrics-server"
+          "--disable servicelb"
+          "--disable traefik"
+          "--pause-image test.local/pause:local"
+        ];
+        services.k3s.images = [
+          pauseImage
+          helloImage
+        ];
+        services.k3s.manifests = {
+          absent = {
+            enable = false;
+            content = {
+              apiVersion = "v1";
+              kind = "Namespace";
+              metadata.name = "absent";
+            };
+          };
+
+          present = {
+            target = "foo-namespace.yaml";
+            content = {
+              apiVersion = "v1";
+              kind = "Namespace";
+              metadata.name = "foo";
+            };
+          };
+
+          hello.content = {
+            apiVersion = "batch/v1";
+            kind = "Job";
+            metadata.name = "hello";
+            spec = {
+              template.spec = {
+                containers = [
+                  {
+                    name = "hello";
+                    image = "test.local/hello:local";
+                  }
+                ];
+                restartPolicy = "OnFailure";
+              };
+            };
+          };
+        };
+      };
+
+    testScript = ''
+      start_all()
+
+      machine.wait_for_unit("k3s")
+      # check existence of the manifest files
+      machine.fail("ls /var/lib/rancher/k3s/server/manifests/absent.yaml")
+      machine.succeed("ls /var/lib/rancher/k3s/server/manifests/foo-namespace.yaml")
+      machine.succeed("ls /var/lib/rancher/k3s/server/manifests/hello.yaml")
+
+      # check if container images got imported
+      machine.succeed("crictl img | grep 'test\.local/pause'")
+      machine.succeed("crictl img | grep 'test\.local/hello'")
+
+      # check if resources of manifests got created
+      machine.wait_until_succeeds("kubectl get ns foo")
+      machine.wait_until_succeeds("kubectl wait --for=condition=complete job/hello")
+      machine.fail("kubectl get ns absent")
+
+      machine.shutdown()
+    '';
+  }
+)
diff --git a/nixos/tests/k3s/default.nix b/nixos/tests/k3s/default.nix
index 297b05a4e4a7..b8a3ace44f3e 100644
--- a/nixos/tests/k3s/default.nix
+++ b/nixos/tests/k3s/default.nix
@@ -19,4 +19,6 @@ in
   single-node = lib.mapAttrs (_: k3s: import ./single-node.nix { inherit system pkgs k3s; }) allK3s;
   # Run a multi-node k3s cluster and verify pod networking works across nodes
   multi-node = lib.mapAttrs (_: k3s: import ./multi-node.nix { inherit system pkgs k3s; }) allK3s;
+  # Test wether container images are imported and auto deploying manifests work
+  auto-deploy = lib.mapAttrs (_: k3s: import ./auto-deploy.nix { inherit system pkgs k3s; }) allK3s;
 }
diff --git a/nixos/tests/mxisd.nix b/nixos/tests/mxisd.nix
deleted file mode 100644
index 354612a8a53d..000000000000
--- a/nixos/tests/mxisd.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ... } : {
-
-  name = "mxisd";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ mguentner ];
-  };
-
-  nodes = {
-    server = args : {
-      services.mxisd.enable = true;
-      services.mxisd.matrix.domain = "example.org";
-    };
-  };
-
-  testScript = ''
-    start_all()
-    server.wait_for_unit("mxisd.service")
-    server.wait_for_open_port(8090)
-    server.succeed("curl -Ssf 'http://127.0.0.1:8090/_matrix/identity/api/v1'")
-  '';
-})
diff --git a/pkgs/applications/blockchains/bitcoin-abc/default.nix b/pkgs/applications/blockchains/bitcoin-abc/default.nix
index 857467c96739..8ead5982b855 100644
--- a/pkgs/applications/blockchains/bitcoin-abc/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-abc/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , mkDerivation
 , fetchFromGitHub
+, fetchpatch2
 , pkg-config
 , cmake
 , openssl
@@ -34,6 +35,14 @@ mkDerivation rec {
     hash = "sha256-+9uBmmdQ/shWYnJ7tM+Y8OgqYcQHHI2qeMw2tl1lE+w=";
   };
 
+  patches = [
+    # upnp: add compatibility for miniupnpc 2.2.8
+    (fetchpatch2 {
+      url = "https://github.com/Bitcoin-ABC/bitcoin-abc/commit/5678070f182124a1a8c7c60873d1877094be76ab.patch?full_index=1";
+      hash = "sha256-QC7TlWepVxQuIZVTbGtQy+HmmXP8PWNhJWdVYudJvmI=";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config cmake ];
   buildInputs = [
     openssl
diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix
index 0306be537829..ef5eab342a36 100644
--- a/pkgs/applications/blockchains/bitcoin-knots/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch2
 , autoreconfHook
 , pkg-config
 , util-linux
@@ -32,6 +33,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-PqpePDna2gpCzF2K43N4h6cV5Y9w/e5ZcUvaNEaFaIk=";
   };
 
+  patches = [
+    # upnp: add compatibility for miniupnpc 2.2.8
+    (fetchpatch2 {
+      url = "https://github.com/bitcoinknots/bitcoin/commit/643014424359a4783cf9c73bee3346ac2f04e713.patch?full_index=1";
+      hash = "sha256-FdLoNH3+ZZTbqrwRvhbAeJuGz4SgnIvoWUBzRxjfzs8=";
+    })
+  ];
+
   nativeBuildInputs =
     [ autoreconfHook pkg-config ]
     ++ lib.optionals stdenv.isLinux [ util-linux ]
diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
index 7e995ad60a8c..960ccf418306 100644
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch2
 , autoreconfHook
 , pkg-config
 , installShellFiles
@@ -43,6 +44,14 @@ stdenv.mkDerivation rec {
     sha256 = "0c1051fd921b8fae912f5c2dfd86b085ab45baa05cd7be4585b10b4d1818f3da";
   };
 
+  patches = [
+    # upnp: fix build with miniupnpc 2.2.8
+    (fetchpatch2 {
+      url = "https://github.com/bitcoin/bitcoin/commit/8acdf66540834b9f9cf28f16d389e8b6a48516d5.patch?full_index=1";
+      hash = "sha256-oDvHUvwAEp0LJCf6QBESn38Bu359TcPpLhvuLX3sm6M=";
+    })
+  ];
+
   nativeBuildInputs =
     [ autoreconfHook pkg-config installShellFiles ]
     ++ lib.optionals stdenv.isLinux [ util-linux ]
diff --git a/pkgs/applications/blockchains/elements/default.nix b/pkgs/applications/blockchains/elements/default.nix
index 68dfa2be0579..90bc9195f9b5 100644
--- a/pkgs/applications/blockchains/elements/default.nix
+++ b/pkgs/applications/blockchains/elements/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , autoreconfHook
 , pkg-config
 , util-linux
@@ -33,6 +34,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-qHtSgfZGZ4Beu5fsJAOZm8ejj7wfHBbOS6WAjOrCuw4=";
   };
 
+  patches = [
+    # upnp: fix build with miniupnpc 2.2.8
+    (fetchpatch2 {
+      url = "https://github.com/bitcoin/bitcoin/commit/8acdf66540834b9f9cf28f16d389e8b6a48516d5.patch?full_index=1";
+      hash = "sha256-oDvHUvwAEp0LJCf6QBESn38Bu359TcPpLhvuLX3sm6M=";
+    })
+  ];
+
   nativeBuildInputs =
     [ autoreconfHook pkg-config ]
     ++ lib.optionals stdenv.isLinux [ util-linux ]
diff --git a/pkgs/applications/blockchains/gridcoin-research/default.nix b/pkgs/applications/blockchains/gridcoin-research/default.nix
index ac38af861493..473803ece6d3 100644
--- a/pkgs/applications/blockchains/gridcoin-research/default.nix
+++ b/pkgs/applications/blockchains/gridcoin-research/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gridcoin-research";
-  version = "5.4.8.0";
+  version = "5.4.8.0-hotfix-1";
 
   src = fetchFromGitHub {
     owner = "gridcoin-community";
     repo = "Gridcoin-Research";
     rev = "${version}";
-    sha256 = "sha256-HZirzXkqM2aep+wq8k2UCFWHPtN0sBZXjamgt7RYPBo=";
+    hash = "sha256-e58GJNiZq4LP/HTeveTQD6APeTvUbhUTwMwhU+PiVc0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/blockchains/groestlcoin/default.nix b/pkgs/applications/blockchains/groestlcoin/default.nix
index 4e6e685316bf..e3acd14a5a9e 100644
--- a/pkgs/applications/blockchains/groestlcoin/default.nix
+++ b/pkgs/applications/blockchains/groestlcoin/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , fetchFromGitHub
+, fetchpatch2
 , autoreconfHook
 , pkg-config
 , installShellFiles
@@ -41,6 +42,14 @@ stdenv.mkDerivation rec {
     sha256 = "0f6vi2k5xvjrhiazfjcd4aj246dfcg51xsnqb9wdjl41cg0ckwmf";
   };
 
+  patches = [
+    # upnp: add compatibility for miniupnpc 2.2.8
+    (fetchpatch2 {
+      url = "https://github.com/Groestlcoin/groestlcoin/commit/8acdf66540834b9f9cf28f16d389e8b6a48516d5.patch?full_index=1";
+      hash = "sha256-oDvHUvwAEp0LJCf6QBESn38Bu359TcPpLhvuLX3sm6M=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config installShellFiles ]
     ++ lib.optionals stdenv.isLinux [ util-linux ]
     ++ lib.optionals stdenv.isDarwin [ hexdump ]
diff --git a/pkgs/applications/blockchains/haven-cli/default.nix b/pkgs/applications/blockchains/haven-cli/default.nix
index a9f528dd8c6c..69862f618bcd 100644
--- a/pkgs/applications/blockchains/haven-cli/default.nix
+++ b/pkgs/applications/blockchains/haven-cli/default.nix
@@ -1,9 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
+{ lib, stdenv, fetchFromGitHub, cmake, ninja, pkg-config
 , boost, miniupnpc, openssl, unbound
 , zeromq, pcsclite, readline, libsodium, hidapi
 , randomx, rapidjson, easyloggingpp
 , CoreData, IOKit, PCSC
 , trezorSupport ? true, libusb1, protobuf, python3
+, monero-cli
 }:
 
 stdenv.mkDerivation rec {
@@ -18,9 +19,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  patches = [
-    ./use-system-libraries.patch
-  ];
+  inherit (monero-cli) patches;
 
   postPatch = ''
     # remove vendored libraries
@@ -29,7 +28,7 @@ stdenv.mkDerivation rec {
     cp -r . $source
   '';
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake ninja pkg-config ];
 
   buildInputs = [
     boost miniupnpc openssl unbound
diff --git a/pkgs/applications/blockchains/haven-cli/use-system-libraries.patch b/pkgs/applications/blockchains/haven-cli/use-system-libraries.patch
deleted file mode 100644
index 367c432b826b..000000000000
--- a/pkgs/applications/blockchains/haven-cli/use-system-libraries.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index fb71d2d..3a710a4 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -364,10 +364,10 @@ if(NOT MANUAL_SUBMODULES)
-     endfunction ()
-     
-     message(STATUS "Checking submodules")
--    check_submodule(external/miniupnp)
--    check_submodule(external/rapidjson)
-+    # check_submodule(external/miniupnp)
-+    # check_submodule(external/rapidjson)
-     check_submodule(external/trezor-common)
--    check_submodule(external/randomx)
-+    # check_submodule(external/randomx)
-     check_submodule(external/supercop)
-   endif()
- endif()
- 
-@@ -300,7 +300,8 @@ endif()
- # elseif(CMAKE_SYSTEM_NAME MATCHES ".*BSDI.*")
- #   set(BSDI TRUE)
- 
--include_directories(external/rapidjson/include external/easylogging++ src contrib/epee/include external)
-+include_directories(external/easylogging++ src contrib/epee/include external)
-+#include_directories(external/rapidjson/include external/easylogging++ src contrib/epee/include external)
- 
- if(APPLE)
-   include_directories(SYSTEM /usr/include/malloc)
-diff --git a/cmake/FindMiniupnpc.cmake b/cmake/FindMiniupnpc.cmake
-index ad2004a..7f4bb68 100644
---- a/cmake/FindMiniupnpc.cmake
-+++ b/cmake/FindMiniupnpc.cmake
-@@ -37,7 +37,7 @@ set(MINIUPNP_STATIC_LIBRARIES ${MINIUPNP_STATIC_LIBRARY})
- 
- include(FindPackageHandleStandardArgs)
- find_package_handle_standard_args(
--  MiniUPnPc DEFAULT_MSG
-+  Miniupnpc DEFAULT_MSG
-   MINIUPNP_INCLUDE_DIR
-   MINIUPNP_LIBRARY
- )
-diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
-index 71b165f..10189ce 100644
---- a/external/CMakeLists.txt
-+++ b/external/CMakeLists.txt
-@@ -37,21 +37,9 @@
- 
- find_package(Miniupnpc REQUIRED)
- 
--message(STATUS "Using in-tree miniupnpc")
--set(UPNPC_NO_INSTALL TRUE CACHE BOOL "Disable miniupnp installation" FORCE)
--add_subdirectory(miniupnp/miniupnpc)
--set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
--set_property(TARGET libminiupnpc-static PROPERTY POSITION_INDEPENDENT_CODE ON)
--if(MSVC)
--  set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -wd4244 -wd4267")
--elseif(NOT MSVC)
--  set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -Wno-undef -Wno-unused-result -Wno-unused-value")
--endif()
--if(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
--	set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -D_NETBSD_SOURCE")
--endif()
--
--set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
-+set(UPNP_STATIC false PARENT_SCOPE)
-+set(UPNP_INCLUDE ${MINIUPNP_INCLUDE_DIR} PARENT_SCOPE)
-+set(UPNP_LIBRARIES ${MINIUPNP_LIBRARY} PARENT_SCOPE)
- 
- find_package(Unbound)
- 
-@@ -69,5 +69,4 @@ endif()
- 
- add_subdirectory(db_drivers)
- add_subdirectory(easylogging++)
- add_subdirectory(qrcodegen)
--add_subdirectory(randomx EXCLUDE_FROM_ALL)
-diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl
-index c626e22..be570ed 100644
---- a/src/p2p/net_node.inl
-+++ b/src/p2p/net_node.inl
-@@ -60,9 +60,9 @@
- #include "cryptonote_core/cryptonote_core.h"
- #include "net/parse.h"
- 
--#include <miniupnp/miniupnpc/miniupnpc.h>
--#include <miniupnp/miniupnpc/upnpcommands.h>
--#include <miniupnp/miniupnpc/upnperrors.h>
-+#include <miniupnpc/miniupnpc.h>
-+#include <miniupnpc/upnpcommands.h>
-+#include <miniupnpc/upnperrors.h>
- 
- #undef MONERO_DEFAULT_LOG_CATEGORY
- #define MONERO_DEFAULT_LOG_CATEGORY "net.p2p"
diff --git a/pkgs/applications/blockchains/litecoin/default.nix b/pkgs/applications/blockchains/litecoin/default.nix
index 3f8f5e236a6d..8a3c6a2657aa 100644
--- a/pkgs/applications/blockchains/litecoin/default.nix
+++ b/pkgs/applications/blockchains/litecoin/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchFromGitHub, fetchpatch
+{ lib, stdenv, mkDerivation, fetchFromGitHub, fetchpatch, fetchpatch2
 , pkg-config, autoreconfHook
 , openssl, db48, boost, zlib, miniupnpc
 , glib, protobuf, util-linux, qrencode
@@ -34,6 +34,13 @@ mkDerivation rec {
       url = "https://github.com/litecoin-project/litecoin/commit/6d1adb19aa79a8e8e140582759515bbd76816aa0.patch";
       hash = "sha256-1y4Iz2plMw5HMAjl9x50QQpYrYaUd2WKrrAcUnQmlBY=";
     })
+
+    # net: add compatibility for miniupnpc 2.2.8
+    # https://github.com/litecoin-project/litecoin/pull/971
+    (fetchpatch2 {
+      url = "https://github.com/litecoin-project/litecoin/commit/5dddffa3e1bbcc7a3e6963b4860ba2d675ca847b.patch?full_index=1";
+      hash = "sha256-F5GcL1RM91l04WrS3qYlV5zEcwyXrcRdmLLCqu1Hop0=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
diff --git a/pkgs/applications/blockchains/masari/default.nix b/pkgs/applications/blockchains/masari/default.nix
deleted file mode 100644
index 27bf5a0aad16..000000000000
--- a/pkgs/applications/blockchains/masari/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, unbound, openssl, boost
-, lmdb, miniupnpc, readline, git, libsodium, rapidjson, cppzmq }:
-
-stdenv.mkDerivation rec {
-  pname = "masari";
-  version = "unstable-2022-10-09";
-
-  src = fetchFromGitHub {
-    owner = "masari-project";
-    repo = "masari";
-    rev = "ff71f52220858b84a4403dab9a14339bcad57826";
-    sha256 = "sha256-GunNFqZNgpLfyAA9BiBC98axgTQuK76z3BUl5T0iJqs=";
-  };
-
-  postPatch = ''
-    # remove vendored libraries
-    rm -r external/{miniupnpc,rapidjson}
-
-    # include missing headers
-    sed -i "1i #include <map>" src/device/device_default.hpp
-    sed -i "1i #include <boost/mpl/contains.hpp>" contrib/epee/include/storages/portable_storage.h
-  '';
-
-  nativeBuildInputs = [ cmake pkg-config git ];
-
-  buildInputs = [
-    boost miniupnpc openssl unbound
-    readline libsodium
-    rapidjson cppzmq
-  ];
-
-  meta = with lib; {
-    description = "scalability-focused, untraceable, secure, and fungible cryptocurrency using the RingCT protocol";
-    homepage = "https://www.getmasari.org/";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ matthewcroughan ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/blockchains/monero-cli/default.nix b/pkgs/applications/blockchains/monero-cli/default.nix
index 8f2f3b850125..50d5d1b109a3 100644
--- a/pkgs/applications/blockchains/monero-cli/default.nix
+++ b/pkgs/applications/blockchains/monero-cli/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
+{ lib, stdenv, fetchFromGitHub, fetchpatch2, cmake, ninja, pkg-config
 , boost, miniupnpc, openssl, unbound
 , zeromq, pcsclite, readline, libsodium, hidapi
 , randomx, rapidjson
@@ -35,6 +35,28 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # cmake: remove unused/extera cmake/FindMiniupnpc.cmake and only rely on external/miniupnpc
+    # https://github.com/monero-project/monero/pull/9366
+    (fetchpatch2 {
+      url = "https://github.com/monero-project/monero/commit/5074a543a49f7e23fb39b6462fd4c4c9741c3693.patch?full_index=1";
+      hash = "sha256-dS2hhEU6m2of0ULlsf+/tZMHUmq3vGGXJPGHvtnpQnY=";
+    })
+
+    # cmake: add different parameters to add_monero_library.
+    # https://github.com/monero-project/monero/pull/9367
+    (fetchpatch2 {
+      url = "https://github.com/monero-project/monero/commit/b91ead90254ac6d6daf908f689c38e372a44c615.patch?full_index=1";
+      hash = "sha256-DL2YqkvEONbeEDqLOAo2eSF5JF5gOzKcLKeNlUXBY1w=";
+    })
+
+    # external: update miniupnpc to 2.2.8
+    # https://github.com/monero-project/monero/pull/9367
+    (fetchpatch2 {
+      url = "https://github.com/monero-project/monero/commit/d81da086ec5088a04b3f7b34831e72910300e2f7.patch?full_index=1";
+      hash = "sha256-ZJGiDMk5DMmEXwzoUYPC+DIoebluFh54kMQtQU78ckI=";
+      excludes = [ "external/miniupnp" ];
+    })
+
     ./use-system-libraries.patch
   ];
 
@@ -47,7 +69,7 @@ stdenv.mkDerivation rec {
     cp -r . $source
   '';
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake ninja pkg-config ];
 
   buildInputs = [
     boost miniupnpc openssl unbound
diff --git a/pkgs/applications/blockchains/monero-cli/use-system-libraries.patch b/pkgs/applications/blockchains/monero-cli/use-system-libraries.patch
index 5d3e3561d554..f8629d47553c 100644
--- a/pkgs/applications/blockchains/monero-cli/use-system-libraries.patch
+++ b/pkgs/applications/blockchains/monero-cli/use-system-libraries.patch
@@ -1,14 +1,14 @@
 diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
-index 5b7f69a56..5536debe8 100644
+index f8b834ac17...520e148428 100644
 --- a/external/CMakeLists.txt
 +++ b/external/CMakeLists.txt
-@@ -36,22 +36,9 @@
- # others.
+@@ -39,23 +39,12 @@
+   add_compile_options(-D_GNU_SOURCE)
+ endif()
  
- find_package(Miniupnpc REQUIRED)
--
 -message(STATUS "Using in-tree miniupnpc")
 -set(UPNPC_NO_INSTALL TRUE CACHE BOOL "Disable miniupnp installation" FORCE)
+-set(UPNPC_BUILD_TESTS FALSE CACHE BOOL "Disable miniupnp internal tests." FORCE)
 -add_subdirectory(miniupnp/miniupnpc)
 -set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
 -set_property(TARGET libminiupnpc-static PROPERTY POSITION_INDEPENDENT_CODE ON)
@@ -20,33 +20,19 @@ index 5b7f69a56..5536debe8 100644
 -if(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
 -	set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -D_NETBSD_SOURCE")
 -endif()
--
--set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
-+set(UPNP_STATIC false PARENT_SCOPE)
-+set(UPNP_INCLUDE ${MINIUPNP_INCLUDE_DIR} PARENT_SCOPE)
-+set(UPNP_LIBRARIES ${MINIUPNP_LIBRARY} PARENT_SCOPE)
++include(FindPkgConfig)
++pkg_check_modules(MINIUPNPC REQUIRED IMPORTED_TARGET GLOBAL miniupnpc)
++get_target_property(MINIUPNPC_INCLUDE_DIR PkgConfig::MINIUPNPC INTERFACE_INCLUDE_DIRECTORIES)
++set_target_properties(PkgConfig::MINIUPNPC PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "${MINIUPNPC_INCLUDE_DIR}/miniupnpc")
++set(UPNP_LIBRARIES PkgConfig::MINIUPNPC PARENT_SCOPE)
  
+-set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
+-
  find_package(Unbound)
  
-@@ -69,4 +56,3 @@ endif()
+ if(NOT UNBOUND_INCLUDE_DIR)
+@@ -72,4 +61,3 @@
  add_subdirectory(db_drivers)
  add_subdirectory(easylogging++)
  add_subdirectory(qrcodegen)
 -add_subdirectory(randomx EXCLUDE_FROM_ALL)
-diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl
-index d4b39869c..13071d898 100644
---- a/src/p2p/net_node.inl
-+++ b/src/p2p/net_node.inl
-@@ -61,9 +61,9 @@
- #include "cryptonote_core/cryptonote_core.h"
- #include "net/parse.h"
- 
--#include <miniupnp/miniupnpc/miniupnpc.h>
--#include <miniupnp/miniupnpc/upnpcommands.h>
--#include <miniupnp/miniupnpc/upnperrors.h>
-+#include <miniupnpc/miniupnpc.h>
-+#include <miniupnpc/upnpcommands.h>
-+#include <miniupnpc/upnperrors.h>
- 
- #undef MONERO_DEFAULT_LOG_CATEGORY
- #define MONERO_DEFAULT_LOG_CATEGORY "net.p2p"
diff --git a/pkgs/applications/blockchains/namecoin/default.nix b/pkgs/applications/blockchains/namecoin/default.nix
index 4cf298c17859..89fa92a31615 100644
--- a/pkgs/applications/blockchains/namecoin/default.nix
+++ b/pkgs/applications/blockchains/namecoin/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, openssl, boost, libevent, autoreconfHook, db4, miniupnpc, eject, pkg-config, hexdump }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch2, openssl, boost, libevent, autoreconfHook, db4, miniupnpc, eject, pkg-config, hexdump }:
 
 stdenv.mkDerivation rec {
   pname = "namecoind";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-2KMK5Vb8osuaKbzI1aaPSYg+te+v9CEcGUkrVI6Fk54=";
   };
 
+  patches = [
+    # upnp: add compatibility for miniupnpc 2.2.8
+    (fetchpatch2 {
+      url = "https://github.com/namecoin/namecoin-core/commit/8acdf66540834b9f9cf28f16d389e8b6a48516d5.patch?full_index=1";
+      hash = "sha256-oDvHUvwAEp0LJCf6QBESn38Bu359TcPpLhvuLX3sm6M=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/applications/blockchains/particl-core/default.nix b/pkgs/applications/blockchains/particl-core/default.nix
index dcd9f107b926..cacb8f5f4619 100644
--- a/pkgs/applications/blockchains/particl-core/default.nix
+++ b/pkgs/applications/blockchains/particl-core/default.nix
@@ -4,6 +4,7 @@
 , boost
 , db48
 , fetchFromGitHub
+, fetchpatch2
 , libevent
 , miniupnpc
 , openssl
@@ -25,6 +26,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-RxkLt+7u+r5jNwEWiArTUpZ8ykYwWtvIDFXTSKhGN/w=";
   };
 
+  patches = [
+    # upnp: fix build with miniupnpc 2.2.8
+    (fetchpatch2 {
+      url = "https://github.com/bitcoin/bitcoin/commit/8acdf66540834b9f9cf28f16d389e8b6a48516d5.patch?full_index=1";
+      hash = "sha256-oDvHUvwAEp0LJCf6QBESn38Bu359TcPpLhvuLX3sm6M=";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [ openssl db48 boost zlib miniupnpc libevent zeromq unixtools.hexdump python3 ];
 
diff --git a/pkgs/applications/editors/rehex/default.nix b/pkgs/applications/editors/rehex/default.nix
index 9a3ba2a4a59f..e48d45cb7d27 100644
--- a/pkgs/applications/editors/rehex/default.nix
+++ b/pkgs/applications/editors/rehex/default.nix
@@ -5,7 +5,7 @@
 , which
 , zip
 , libicns
-, botan2
+, botan3
 , capstone
 , jansson
 , libunistring
@@ -32,14 +32,17 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config which zip ]
     ++ lib.optionals stdenv.isDarwin [ libicns ];
 
-  buildInputs = [ botan2 capstone jansson libunistring wxGTK32 ]
+  buildInputs = [ botan3 capstone jansson libunistring wxGTK32 ]
     ++ (with lua53Packages; [ lua busted ])
     ++ (with perlPackages; [ perl TemplateToolkit ])
     ++ lib.optionals stdenv.isLinux [ gtk3 ]
     ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa IOKit ];
 
-  makeFlags = [ "prefix=${placeholder "out"}" ]
-    ++ lib.optionals stdenv.isDarwin [ "-f Makefile.osx" ];
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+    "BOTAN_PKG=botan-3"
+    "CXXSTD=-std=c++20"
+  ] ++ lib.optionals stdenv.isDarwin [ "-f Makefile.osx" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/emulators/flycast/default.nix b/pkgs/applications/emulators/flycast/default.nix
index ff1773a83726..2ef186f3013c 100644
--- a/pkgs/applications/emulators/flycast/default.nix
+++ b/pkgs/applications/emulators/flycast/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , cmake
 , pkg-config
 , makeWrapper
@@ -27,6 +28,14 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # miniupnp: add support for api version 18
+    (fetchpatch2 {
+      url = "https://github.com/flyinghead/flycast/commit/71982eda7a038e24942921e558845103b6c12326.patch?full_index=1";
+      hash = "sha256-5fFCgX7MfCqW7zxXJuHt9js+VTZZKEQHRYuWh7MTKzI=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/applications/file-managers/xplorer/default.nix b/pkgs/applications/file-managers/xplorer/default.nix
index 027c051fef79..9c3a04e8dde3 100644
--- a/pkgs/applications/file-managers/xplorer/default.nix
+++ b/pkgs/applications/file-managers/xplorer/default.nix
@@ -6,7 +6,10 @@
 , freetype
 , gtk3
 , libsoup
-, mkYarnPackage
+, stdenvNoCC
+, yarnConfigHook
+, yarnBuildHook
+, nodejs
 , openssl
 , pkg-config
 , rustPlatform
@@ -25,7 +28,7 @@ let
     sha256 = "sha256-VFRdkSfe2mERaYYtZlg9dvH1loGWVBGwiTRj4AoNEAo=";
   };
 
-  frontend-build = mkYarnPackage {
+  frontend-build = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit version src;
     pname = "xplorer-ui";
 
@@ -33,19 +36,16 @@ let
       yarnLock = src + "/yarn.lock";
       sha256 = "sha256-H37vD0GTSsWV5UH7C6UANDWnExTGh8yqajLn3y7P2T8=";
     };
-
-    packageJSON = ./package.json;
-
-    buildPhase = ''
-      export HOME=$(mktemp -d)
-      yarn --offline run prebuild
-
-      cp -r deps/xplorer/out $out
+    nativeBuildInputs = [
+      yarnConfigHook
+      yarnBuildHook
+      nodejs
+    ];
+    yarnBuildScript = "prebuild";
+    installPhase = ''
+      cp -r out $out
     '';
-
-    distPhase = "true";
-    dontInstall = true;
-  };
+  });
 in
 
 rustPlatform.buildRustPackage {
diff --git a/pkgs/applications/file-managers/xplorer/package.json b/pkgs/applications/file-managers/xplorer/package.json
deleted file mode 100644
index fd381eb347d9..000000000000
--- a/pkgs/applications/file-managers/xplorer/package.json
+++ /dev/null
@@ -1,88 +0,0 @@
-{
-  "name": "xplorer",
-  "description": "Xplorer, a customizable, modern file manager",
-  "version": "0.3.1",
-  "author": "Justin Maximillian Kimlim <kimlimjustin@gmail.com>",
-  "icon": "build/icon.icns",
-  "private": true,
-  "homepage": "https://xplorer.space",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/kimlimjustin/xplorer.git"
-  },
-  "os": ["darwin", "win32", "linux"],
-  "scripts": {
-    "start": "yarn dev",
-    "web": "concurrently \"cd api/web && cargo run\" \"live-server ./out/src --no-browser\"",
-    "dev": "yarn compile && concurrently --kill-others \"yarn compile:watch\" \"yarn sass:watch\" \"yarn web\" \"tauri dev\"",
-    "clean": "rimraf out",
-    "sass": "sass src/Public/style.scss out/src/Public/style.css",
-    "sass:watch": "node scripts/sass-watcher.js",
-    "docs": "yarn --cwd ./docs start",
-    "pretest": "yarn compile",
-    "test": "jest",
-    "copyfiles": "node scripts/copyfiles",
-    "compile": "webpack && yarn sass && yarn copyfiles",
-    "compile:watch": "webpack --watch",
-    "crowdin": "crowdin",
-    "crowdin:pull": "crowdin pull",
-    "postcrowdin:pull": "node scripts/post_crowdin_pull.js",
-    "crowdin:sync": "yarn --cwd ./docs write-translations && crowdin upload && crowdin download",
-    "lint": "eslint -c .eslintrc.yml --ext .ts ./src",
-    "prettier": "prettier --write src",
-    "grunt": "grunt",
-    "css:minify": "cleancss --batch --batch-suffix \"\" out/**/*.css ",
-    "prebuild": "yarn compile && yarn grunt && yarn css:minify",
-    "build": "tauri build",
-    "postinstall": "husky install",
-    "fakefiles": "python scripts/generate-fake-files.py 1000"
-  },
-  "workspaces": ["packages/*"],
-  "keywords": [
-    "Xplorer",
-    "File explorer",
-    "File",
-    "File manager",
-    "Folders",
-    "Directory"
-  ],
-  "license": "Apache-2.0",
-  "devDependencies": {
-    "@crowdin/cli": "^3.6.5",
-    "@tauri-apps/cli": "^1.1.1",
-    "@types/jest": "^27.0.2",
-    "@types/marked": "^4.0.1",
-    "@typescript-eslint/eslint-plugin": "^5.4.0",
-    "@typescript-eslint/parser": "^5.4.0",
-    "buffer": "^6.0.3",
-    "clean-css-cli": "^5.3.3",
-    "concurrently": "^6.2.1",
-    "cpy": "^8.1.2",
-    "eslint": "^8.2.0",
-    "grunt": "^1.4.1",
-    "grunt-cli": "^1.4.3",
-    "grunt-contrib-uglify": "^5.0.1",
-    "grunt-contrib-watch": "^1.1.0",
-    "husky": "^7.0.2",
-    "jest": "^27.1.0",
-    "live-server": "^1.2.1",
-    "node-watch": "^0.7.1",
-    "postinstall-postinstall": "^2.1.0",
-    "prettier": "2.5.1",
-    "rimraf": "^3.0.2",
-    "sass": "1.45.2",
-    "ts-jest": "^27.0.7",
-    "ts-loader": "^9.2.6",
-    "typescript": "^4.4.2",
-    "webpack": "^5.58.2",
-    "webpack-cli": "^4.9.0"
-  },
-  "dependencies": {
-    "@tauri-apps/api": "^1.1.0",
-    "highlight.js": "^11.2.0",
-    "mammoth": "^1.4.18",
-    "marked": "^4.0.15",
-    "xlsx": "^0.17.1"
-  },
-  "optionalDependencies": {}
-}
diff --git a/pkgs/applications/graphics/f3d/default.nix b/pkgs/applications/graphics/f3d/default.nix
index dc3b9e4b3a61..ee6a830246d7 100644
--- a/pkgs/applications/graphics/f3d/default.nix
+++ b/pkgs/applications/graphics/f3d/default.nix
@@ -4,6 +4,9 @@
 , cmake
 , help2man
 , gzip
+# There is a f3d overriden with EGL enabled vtk in top-level/all-packages.nix
+# compiling with EGL enabled vtk will result in f3d running in headless mode
+# See https://github.com/NixOS/nixpkgs/pull/324022. This may change later.
 , vtk_9
 , autoPatchelfHook
 , Cocoa
@@ -15,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "f3d";
-  version = "2.4.0";
+  version = "2.5.0";
 
   outputs = [ "out" ] ++ lib.optionals withManual [ "man" ];
 
@@ -23,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "f3d-app";
     repo = "f3d";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mqkPegbGos38S50CoV4Qse9Z4wZ327UmIwmSrrP35uI=";
+    hash = "sha256-Mw40JyXZj+Q4a9dD5UnkUSdUfQGaV92gor8ynn86VJ8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index bb5a0b660086..fdebd48b4102 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -198,6 +198,17 @@ stdenv.mkDerivation (finalAttrs: {
       "-DWITH_CYCLES_DEVICE_OPTIX=ON"
     ];
 
+  preConfigure = ''
+    (
+      expected_python_version=$(grep -E --only-matching 'set\(_PYTHON_VERSION_SUPPORTED [0-9.]+\)' build_files/cmake/Modules/FindPythonLibsUnix.cmake | grep -E --only-matching '[0-9.]+')
+      actual_python_version=$(python -c 'import sys; print(".".join(map(str, sys.version_info[0:2])))')
+      if ! [[ "$actual_python_version" = "$expected_python_version" ]]; then
+        echo "wrong Python version, expected '$expected_python_version', got '$actual_python_version'" >&2
+        exit 1
+      fi
+    )
+  '';
+
   nativeBuildInputs =
     [
       cmake
diff --git a/pkgs/applications/misc/corectrl/default.nix b/pkgs/applications/misc/corectrl/default.nix
index 9240635aa542..14247827b2d6 100644
--- a/pkgs/applications/misc/corectrl/default.nix
+++ b/pkgs/applications/misc/corectrl/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv
 , fetchFromGitLab
 , extra-cmake-modules
-, botan2
+, botan3
 , karchive
 , kauth
 , libdrm
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec{
     wrapQtAppsHook
   ];
   buildInputs = [
-    botan2
+    botan3
     karchive
     kauth
     libdrm
diff --git a/pkgs/applications/misc/keepassxc/default.nix b/pkgs/applications/misc/keepassxc/default.nix
index ec633ac7514b..a8e00ab7a132 100644
--- a/pkgs/applications/misc/keepassxc/default.nix
+++ b/pkgs/applications/misc/keepassxc/default.nix
@@ -5,7 +5,7 @@
 , qttools
 
 , asciidoctor
-, botan2
+, botan3
 , curl
 , libXi
 , libXtst
@@ -114,7 +114,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     curl
-    botan2
+    botan3
     libXi
     libXtst
     libargon2
diff --git a/pkgs/applications/misc/kuro/default.nix b/pkgs/applications/misc/kuro/default.nix
index 55a2e04c9326..02911f312122 100644
--- a/pkgs/applications/misc/kuro/default.nix
+++ b/pkgs/applications/misc/kuro/default.nix
@@ -1,17 +1,20 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , fetchYarnDeps
+, yarnConfigHook
+, yarnBuildHook
+, nodejs
 , makeWrapper
 , makeDesktopItem
 , copyDesktopItems
-, mkYarnPackage
 , electron_29
 }:
 
 let
   electron = electron_29;
 in
-mkYarnPackage rec {
+stdenv.mkDerivation rec {
   pname = "kuro";
   version = "9.0.0";
 
@@ -22,8 +25,6 @@ mkYarnPackage rec {
     hash = "sha256-9Z/r5T5ZI5aBghHmwiJcft/x/wTRzDlbIupujN2RFfU=";
   };
 
-  packageJSON = ./package.json;
-
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
     hash = "sha256-GTiNv7u1QK/wjQgpka7REuoLn2wjZG59kYJQaZZPycI=";
@@ -32,30 +33,29 @@ mkYarnPackage rec {
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs
     makeWrapper
     copyDesktopItems
   ];
 
-  postBuild = ''
-    pushd deps/kuro
-
-    yarn --offline run electron-builder \
-      --dir \
-      -c.electronDist=${electron}/libexec/electron \
-      -c.electronVersion=${electron.version}
-
-    popd
-  '';
+  yarnBuildScript = "electron-builder";
+  yarnBuildFlags = [
+    "--dir"
+    "-c.electronDist=${electron}/libexec/electron"
+    "-c.electronVersion=${electron.version}"
+  ];
 
   installPhase = ''
     runHook preInstall
 
     # resources
     mkdir -p "$out/share/lib/kuro"
-    cp -r ./deps/kuro/dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/kuro"
+    cp -r ./dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/kuro"
 
     # icons
-    install -Dm644 ./deps/kuro/static/Icon.png $out/share/icons/hicolor/1024x1024/apps/kuro.png
+    install -Dm644 ./static/Icon.png $out/share/icons/hicolor/1024x1024/apps/kuro.png
 
     # executable wrapper
     makeWrapper '${electron}/bin/electron' "$out/bin/kuro" \
@@ -65,9 +65,6 @@ mkYarnPackage rec {
 
     runHook postInstall
   '';
-  # Do not attempt generating a tarball for contents again.
-  # note: `doDist = false;` does not work.
-  distPhase = "true";
 
   desktopItems = [
     (makeDesktopItem {
diff --git a/pkgs/applications/misc/kuro/package.json b/pkgs/applications/misc/kuro/package.json
deleted file mode 100644
index 0ae2f22c08db..000000000000
--- a/pkgs/applications/misc/kuro/package.json
+++ /dev/null
@@ -1,149 +0,0 @@
-{
-  "name": "kuro",
-  "productName": "Kuro",
-  "version": "9.0.0",
-  "description": "Elegant Microsoft To-Do desktop app (Ao fork)",
-  "license": "MIT",
-  "repository": "davidsmorais/kuro",
-  "author": {
-    "name": "davidsmorais",
-    "email": "david@dsmorais.com",
-    "url": "https://github.com/davidsmorais"
-  },
-  "maintainers": [
-    {
-      "name": "davidsmorais",
-      "email": "david@dsmorais.com",
-      "url": "https://github.com/davidsmorais"
-    }
-  ],
-  "scripts": {
-    "postinstall": "electron-builder install-app-deps",
-    "icons": "electron-icon-maker --input=./static/Icon.png --output=./build/",
-    "test": "xo && stylelint 'src/style/*.css'",
-    "release": "yarn version && rm -rf dist build && yarn icons && electron-builder --publish never",
-    "build-snap": "electron-builder --linux snap",
-    "build-win": "electron-builder --win",
-    "start": "electron ."
-  },
-  "dependencies": {
-    "auto-launch": "^5.0.1",
-    "electron-context-menu": "^3.6.1",
-    "electron-debug": "^1.4.0",
-    "electron-dl": "^2.0.0",
-    "electron-store": "^8.1.0",
-    "lodash": "^4.17.21"
-  },
-  "devDependencies": {
-    "electron": "^22.1.0",
-    "electron-builder": "^23.6.0",
-    "electron-icon-maker": "^0.0.5",
-    "stylelint": "^14.9.1",
-    "xo": "^0.53.1"
-  },
-  "xo": {
-    "envs": [
-      "browser",
-      "node"
-    ],
-    "rules": {
-      "n/prefer-global/process": 0,
-      "unicorn/prefer-module": 0,
-      "unicorn/no-for-loop": 0,
-      "unicorn/no-array-for-each": 0,
-      "import/extensions": 0,
-      "object-curly-spacing": 0,
-      "quote-props": 0,
-      "unicorn/prefer-query-selector": 0,
-      "quotes": [
-        "error",
-        "double"
-      ]
-    },
-    "space": 2
-  },
-  "stylelint": {
-    "rules": {
-      "block-closing-brace-empty-line-before": "never",
-      "block-closing-brace-newline-after": "always",
-      "block-no-empty": true,
-      "block-opening-brace-space-before": "always",
-      "color-hex-case": "upper",
-      "color-hex-length": "long",
-      "color-no-invalid-hex": true,
-      "comment-no-empty": true,
-      "declaration-block-semicolon-space-before": "never",
-      "indentation": 2,
-      "max-empty-lines": 0,
-      "no-duplicate-selectors": true
-    }
-  },
-  "build": {
-    "appId": "com.davidsmorais.kuro",
-    "snap": {
-      "title": "Kuro"
-    },
-    "files": [
-      "**/*",
-      "!media${/*}",
-      "!docs${/*}"
-    ],
-    "win": {
-      "target": [
-        {
-          "target": "nsis",
-          "arch": [
-            "x64"
-          ]
-        }
-      ],
-      "icon": "icons/win/icon.ico",
-      "publish": {
-        "provider": "github",
-        "releaseType": "release"
-      }
-    },
-    "linux": {
-      "category": "Office",
-      "icon": "icons/png",
-      "description": "Kuro is an unofficial, featureful, open source, community-driven, free Microsoft To-Do app, used by people in more than 120 countries. (Ao fork)",
-      "synopsis": "Elegant Microsoft To-Do desktop app (Ao fork)",
-      "publish": {
-        "provider": "github",
-        "releaseType": "release"
-      },
-      "target": [
-        {
-          "target": "AppImage",
-          "arch": [
-            "x64"
-          ]
-        },
-        {
-          "target": "deb",
-          "arch": [
-            "x64"
-          ]
-        },
-        {
-          "target": "pacman",
-          "arch": [
-            "x64"
-          ]
-        },
-        {
-          "target": "rpm",
-          "arch": [
-            "x64"
-          ]
-        },
-        {
-          "target": "snap",
-          "arch": [
-            "x64"
-          ]
-        }
-      ]
-    }
-  }
-}
diff --git a/pkgs/applications/networking/browsers/floorp/default.nix b/pkgs/applications/networking/browsers/floorp/default.nix
index ff36607709bc..67edb1657a83 100644
--- a/pkgs/applications/networking/browsers/floorp/default.nix
+++ b/pkgs/applications/networking/browsers/floorp/default.nix
@@ -3,11 +3,12 @@
 , fetchFromGitHub
 , buildMozillaMach
 , nixosTests
+, python311
 }:
 
 ((buildMozillaMach rec {
   pname = "floorp";
-  packageVersion = "11.14.1";
+  packageVersion = "11.15.0";
   applicationName = "Floorp";
   binaryName = "floorp";
   branding = "browser/branding/official";
@@ -22,7 +23,7 @@
     repo = "Floorp";
     fetchSubmodules = true;
     rev = "v${packageVersion}";
-    hash = "sha256-PhI+hIypPF6W5RJIXhCAXblSJNwgYavfCgdQozDSXG0=";
+    hash = "sha256-LRuts3O3Rj5e6rT9gKTTwAIsY0oSziuiZ3rzE7wHa7o=";
   };
 
   extraConfigureFlags = [
@@ -32,10 +33,12 @@
   ];
 
   extraPostPatch = ''
-    # Fix .desktop files for PWAs generated by Floorp; they hardcode /usr/bin
-    # https://github.com/NixOS/nixpkgs/issues/314115
+    # Fix .desktop files for PWAs generated by Floorp
+    # The executable path returned by Services.dirsvc.get() is absolute and
+    # thus is the full /nix/store/[..] path. To avoid breaking PWAs with each
+    # update, rely on `floorp` being in $PATH, as before.
     substituteInPlace floorp/browser/base/content/modules/ssb/LinuxSupport.mjs \
-      --replace-fail /usr/bin/floorp floorp
+      --replace-fail 'Services.dirsvc.get("XREExeF",Ci.nsIFile).path' floorp
   '';
 
   updateScript = ./update.sh;
@@ -61,6 +64,7 @@
   enableOfficialBranding = false;
   googleAPISupport = true;
   mlsAPISupport = true;
+  python3 = python311;
 }).overrideAttrs (prev: {
   MOZ_DATA_REPORTING = "";
   MOZ_TELEMETRY_REPORTING = "";
diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index 52754219efbf..9d19d13af8a1 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -95,6 +95,7 @@ let
     maintainers = with maintainers; [
       euank
       mic92
+      marcusramberg
       superherointj
       wrmilling
       yajo
diff --git a/pkgs/applications/networking/ktailctl/default.nix b/pkgs/applications/networking/ktailctl/default.nix
index b9cd8e47d938..155e415e02bc 100644
--- a/pkgs/applications/networking/ktailctl/default.nix
+++ b/pkgs/applications/networking/ktailctl/default.nix
@@ -23,20 +23,20 @@
 }:
 
 let
-  version = "0.16.2";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-rnuh0+i6W9ipSM61MXd9dTlIkdGUHMjtvElW/4S2YCg=";
+    hash = "sha256-urB8NcdQMF6RNX8F2CpzOd0ZkRi3IS4XFyOOXIeChpY=";
   };
 
   goDeps = (buildGoModule {
     pname = "ktailctl-go-wrapper";
     inherit src version;
     modRoot = "src/wrapper";
-    vendorHash = "sha256-GD+G+7b8GBwR3OrRPJbGJVom+kLC67VvlGFIA0S7UF8=";
+    vendorHash = "sha256-Ls4MVppMJbUUukaKkDAN8Lx/s09JRJTf/RMgk0iDcnw=";
   }).goModules;
 in
 stdenv.mkDerivation {
diff --git a/pkgs/applications/networking/p2p/eiskaltdcpp/default.nix b/pkgs/applications/networking/p2p/eiskaltdcpp/default.nix
index 5386c6636add..67dab32e113f 100644
--- a/pkgs/applications/networking/p2p/eiskaltdcpp/default.nix
+++ b/pkgs/applications/networking/p2p/eiskaltdcpp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, bzip2, libX11
+{ lib, stdenv, fetchFromGitHub, fetchpatch2, cmake, pkg-config, bzip2, libX11
 , mkDerivation, qtbase, qttools, qtmultimedia, qtscript
 , libiconv, pcre-cpp, libidn, lua5, miniupnpc, aspell, gettext, perl }:
 
@@ -13,6 +13,13 @@ mkDerivation rec {
     sha256 = "sha256-JmAopXFS6MkxW0wDQ1bC/ibRmWgOpzU0971hcqAehLU=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/eiskaltdcpp/eiskaltdcpp/commit/5ab5e1137a46864b6ecd1ca302756da8b833f754.patch?full_index=1";
+      hash = "sha256-GIdcIHKXNSbHxbiMGRPgfq2w/zNSfR/FhyyXayFWfg8=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ qtbase qttools qtmultimedia qtscript bzip2 libX11 pcre-cpp libidn lua5 miniupnpc aspell gettext
     (perl.withPackages (p: with p; [
diff --git a/pkgs/applications/networking/p2p/retroshare/cpp-filesystem.patch b/pkgs/applications/networking/p2p/retroshare/cpp-filesystem.patch
deleted file mode 100644
index e9aa64e2871a..000000000000
--- a/pkgs/applications/networking/p2p/retroshare/cpp-filesystem.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/libretroshare/src/util/rsdir.cc b/libretroshare/src/util/rsdir.cc
-index 8556b8198..d63699216 100644
---- a/libretroshare/src/util/rsdir.cc
-+++ b/libretroshare/src/util/rsdir.cc
-@@ -47,6 +47,7 @@
- 
- #include <fstream>
- #include <stdexcept>
-+#include <filesystem>
- 
- #if defined(WIN32) || defined(__CYGWIN__)
- #include "util/rsstring.h"
diff --git a/pkgs/applications/networking/p2p/retroshare/default.nix b/pkgs/applications/networking/p2p/retroshare/default.nix
index e4e44f79aea5..e98afce389d9 100644
--- a/pkgs/applications/networking/p2p/retroshare/default.nix
+++ b/pkgs/applications/networking/p2p/retroshare/default.nix
@@ -1,5 +1,4 @@
-{ lib, mkDerivation, fetchFromGitHub
-, fetchpatch
+{ lib, stdenv, mkDerivation, fetchFromGitHub, fetchpatch2
 , qmake, cmake, pkg-config, miniupnpc, bzip2
 , speex, libmicrohttpd, libxml2, libxslt, sqlcipher, rapidjson, libXScrnSaver
 , qtbase, qtx11extras, qtmultimedia, libgnome-keyring
@@ -7,13 +6,13 @@
 
 mkDerivation rec {
   pname = "retroshare";
-  version = "0.6.6";
+  version = "0.6.7.2";
 
   src = fetchFromGitHub {
     owner = "RetroShare";
     repo = "RetroShare";
     rev = "v${version}";
-    sha256 = "1hsymbhsfgycj39mdkrdp2hgq8irmvxa4a6jx2gg339m1fgf2xmh";
+    hash = "sha256-1A1YvOWIiWlP1JPUTg5Z/lxVGCBv4tCPf5sZdPogitU=";
     fetchSubmodules = true;
   };
 
@@ -21,13 +20,13 @@ mkDerivation rec {
     # The build normally tries to get git sub-modules during build
     # but we already have them checked out
     ./no-submodules.patch
-    ./cpp-filesystem.patch
 
-    # Fix gcc-13 build failure
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/RetroShare/RetroShare/commit/e1934fd9b03cd52c556eb06d94fb5d68b649592e.patch";
-      hash = "sha256-oqxQAsD4fmkWAH2kSVmmed/q0LzTW/iqUU1SgYNdFyk=";
+    # Support the miniupnpc-2.2.8 API change
+    (fetchpatch2 {
+      url = "https://github.com/RetroShare/libretroshare/commit/f1b89c4f87d77714571b4135c301bf0429096a20.patch?full_index=1";
+      hash = "sha256-UiZMsUFaOZTLj/dx1rLr5bTR1CQ6nt2+IygQdvwJqwc=";
+      stripLen = 1;
+      extraPrefix = "libretroshare/";
     })
   ];
 
@@ -48,6 +47,15 @@ mkDerivation rec {
     "RS_EXTRA_VERSION="
   ];
 
+  postPatch = ''
+    # Build libsam3 as C, not C++. No, I have no idea why it tries to
+    # do that, either.
+    substituteInPlace libretroshare/src/libretroshare.pro \
+      --replace-fail \
+        "LIBSAM3_MAKE_PARAMS =" \
+        "LIBSAM3_MAKE_PARAMS = CC=$CC AR=$AR"
+  '';
+
   postInstall = ''
     # BT DHT bootstrap
     cp libbitdht/src/bitdht/bdboot.txt $out/share/retroshare
diff --git a/pkgs/applications/networking/p2p/retroshare/no-submodules.patch b/pkgs/applications/networking/p2p/retroshare/no-submodules.patch
index d47268003090..f8cb88adfe0b 100644
--- a/pkgs/applications/networking/p2p/retroshare/no-submodules.patch
+++ b/pkgs/applications/networking/p2p/retroshare/no-submodules.patch
@@ -1,8 +1,9 @@
+Submodule libretroshare contains modified content
 diff --git a/libretroshare/src/libretroshare.pro b/libretroshare/src/libretroshare.pro
-index 84d18944e..71aeb67d2 100644
+index 923f878c..ef00f3d7 100644
 --- a/libretroshare/src/libretroshare.pro
 +++ b/libretroshare/src/libretroshare.pro
-@@ -870,20 +870,14 @@ rs_jsonapi {
+@@ -930,20 +930,14 @@ rs_jsonapi {
          genrestbedlib.variable_out = PRE_TARGETDEPS
          win32-g++:isEmpty(QMAKE_SH) {
              genrestbedlib.commands = \
@@ -28,7 +29,7 @@ index 84d18944e..71aeb67d2 100644
                  mkdir -p $${RESTBED_BUILD_PATH} &&
          }
          genrestbedlib.commands += \
-@@ -991,14 +985,9 @@ rs_broadcast_discovery {
+@@ -1063,14 +1057,9 @@ rs_broadcast_discovery {
          udpdiscoverycpplib.variable_out = PRE_TARGETDEPS
          win32-g++:isEmpty(QMAKE_SH) {
              udpdiscoverycpplib.commands = \
@@ -44,8 +45,26 @@ index 84d18944e..71aeb67d2 100644
          }
          udpdiscoverycpplib.commands += \
              cd $$shell_path($${UDP_DISCOVERY_BUILD_PATH}) && \
+@@ -1106,15 +1095,13 @@ rs_sam3_libsam3 {
+     win32-g++:isEmpty(QMAKE_SH) {
+         LIBSAM3_MAKE_PARAMS = CC=gcc
+         libsam3.commands = \
+-            cd /D $$shell_path($${RS_SRC_PATH}) && git submodule update --init supportlibs/libsam3 || cd . $$escape_expand(\\n\\t) \
++            cd /D $$shell_path($${RS_SRC_PATH}) && cd . $$escape_expand(\\n\\t) \
+             $(CHK_DIR_EXISTS) $$shell_path($$LIBSAM3_BUILD_PATH) $(MKDIR) $$shell_path($${LIBSAM3_BUILD_PATH}) $$escape_expand(\\n\\t) \
+             $(COPY_DIR) $$shell_path($${LIBSAM3_SRC_PATH}) $$shell_path($${LIBSAM3_BUILD_PATH}) || cd . $$escape_expand(\\n\\t)
+     } else {
+         LIBSAM3_MAKE_PARAMS =
+         libsam3.commands = \
+-            cd $${RS_SRC_PATH} && ( \
+-            git submodule update --init supportlibs/libsam3 || \
+-            true ) && \
++            cd $${RS_SRC_PATH} && \
+             mkdir -p $${LIBSAM3_BUILD_PATH} && \
+             (cp -r $${LIBSAM3_SRC_PATH}/* $${LIBSAM3_BUILD_PATH} || true) &&
+     }
 diff --git a/retroshare-gui/src/retroshare-gui.pro b/retroshare-gui/src/retroshare-gui.pro
-index 654efd170..06cba9ba3 100644
+index d73117b84..b2fc6799a 100644
 --- a/retroshare-gui/src/retroshare-gui.pro
 +++ b/retroshare-gui/src/retroshare-gui.pro
 @@ -66,10 +66,7 @@ rs_gui_cmark {
diff --git a/pkgs/applications/networking/p2p/transmission/4.nix b/pkgs/applications/networking/p2p/transmission/4.nix
index 7c5e9b365186..dd27a22168b4 100644
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch2
 , cmake
 , pkg-config
 , python3
@@ -69,6 +70,20 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/transmission/transmission/commit/febfe49ca3ecab1a7142ecb34012c1f0b2bcdee8.patch?full_index=1";
+      hash = "sha256-Ge0+AXf/ilfMieGBAdvvImY7JOb0gGIdeKprC37AROs=";
+      excludes = [
+        # The submodule that we don't use (we use our miniupnp)
+        "third-party/miniupnp"
+        # Hunk fails for this one, but we don't care because we don't rely upon
+        # xcode definitions even for the Darwin build.
+        "Transmission.xcodeproj/project.pbxproj"
+      ];
+    })
+  ];
+
   outputs = [ "out" "apparmor" ];
 
   cmakeFlags = [
diff --git a/pkgs/applications/networking/powerdns-admin/default.nix b/pkgs/applications/networking/powerdns-admin/default.nix
index 6028f0e1a1ae..7029dd054165 100644
--- a/pkgs/applications/networking/powerdns-admin/default.nix
+++ b/pkgs/applications/networking/powerdns-admin/default.nix
@@ -1,6 +1,7 @@
-{ lib, stdenv, fetchFromGitHub, fetchYarnDeps, mkYarnPackage, nixosTests, writeText, python3 }:
+{ lib, stdenv, fetchFromGitHub, fetchYarnDeps, yarnConfigHook, nixosTests, writeText, python3 }:
 
 let
+  pname = "powerdns-admin";
   version = "0.4.2";
   src = fetchFromGitHub {
     owner = "PowerDNS-Admin";
@@ -23,44 +24,32 @@ let
     ./0001-Fix-flask-2.3-issue.patch
   ];
 
-  assets = mkYarnPackage {
-    inherit src version;
-    packageJSON = ./package.json;
+  assets = stdenv.mkDerivation {
+    pname = "${pname}-assets";
+    inherit version src;
 
     offlineCache = fetchYarnDeps {
       yarnLock = "${src}/yarn.lock";
       hash = "sha256-rXIts+dgOuZQGyiSke1NIG7b4lFlR/Gfu3J6T3wP3aY=";
     };
 
-    # Copied from package.json, see also
-    # https://github.com/NixOS/nixpkgs/pull/214952
-    packageResolutions = {
-      "@fortawesome/fontawesome-free" = "6.3.0";
-    };
-
-    nativeBuildInputs = pythonDeps;
+    nativeBuildInputs = [
+      yarnConfigHook
+    ] ++ pythonDeps;
     patches = all_patches ++ [
       ./0002-Remove-cssrewrite-filter.patch
     ];
     buildPhase = ''
-      # The build process expects the directory to be writable
-      # with node_modules at a specific path
-      # https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/master/.yarnrc
-
-      approot=deps/powerdns-admin-assets
-
-      ln -s $node_modules $approot/powerdnsadmin/static/node_modules
-      SESSION_TYPE=filesystem FLASK_APP=$approot/powerdnsadmin/__init__.py flask assets build
+      SESSION_TYPE=filesystem FLASK_APP=./powerdnsadmin/__init__.py flask assets build
     '';
     installPhase = ''
       # https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/54b257768f600c5548a1c7e50eac49c40df49f92/docker/Dockerfile#L43
       mkdir $out
-      cp -r $approot/powerdnsadmin/static/{generated,assets,img} $out
-      find $node_modules -name webfonts -exec cp -r {} $out \;
-      find $node_modules -name fonts -exec cp -r {} $out \;
-      find $node_modules/icheck/skins/square -name '*.png' -exec cp {} $out/generated \;
+      cp -r powerdnsadmin/static/{generated,assets,img} $out
+      find powerdnsadmin/static/node_modules -name webfonts -exec cp -r {} $out \; -printf "Copying %P\n"
+      find powerdnsadmin/static/node_modules -name fonts -exec cp -r {} $out \; -printf "Copying %P\n"
+      find powerdnsadmin/static/node_modules/icheck/skins/square -name '*.png' -exec cp {} $out/generated \;
     '';
-    distPhase = "true";
   };
 
   assetsPy = writeText "assets.py" ''
@@ -73,9 +62,7 @@ let
     assets.register('css_main', 'generated/main.css')
   '';
 in stdenv.mkDerivation {
-  pname = "powerdns-admin";
-
-  inherit src version;
+  inherit pname version src;
 
   nativeBuildInputs = [ python.pkgs.wrapPython ];
 
diff --git a/pkgs/applications/networking/powerdns-admin/package.json b/pkgs/applications/networking/powerdns-admin/package.json
deleted file mode 100644
index 0fb58f9c544c..000000000000
--- a/pkgs/applications/networking/powerdns-admin/package.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "dependencies": {
-    "@fortawesome/fontawesome-free": "6.3.0",
-    "admin-lte": "3.2.0",
-    "bootstrap": "4.6.2",
-    "bootstrap-datepicker": "^1.9.0",
-    "bootstrap-validator": "^0.11.9",
-    "datatables.net-plugins": "^1.13.1",
-    "icheck": "^1.0.2",
-    "jquery-slimscroll": "^1.3.8",
-    "jquery-sparkline": "^2.4.0",
-    "jquery-ui-dist": "^1.13.2",
-    "jquery.quicksearch": "^2.4.0",
-    "jquery-validation": "^1.19.5",
-    "jtimeout": "^3.2.0",
-    "knockout": "^3.5.1",
-    "multiselect": "^0.9.12"
-  },
-  "resolutions": {
-    "admin-lte/@fortawesome/fontawesome-free": "6.3.0"
-  },
-  "name": "powerdns-admin-assets",
-  "version": "0.4.1"
-}
diff --git a/pkgs/applications/networking/yaup/default.nix b/pkgs/applications/networking/yaup/default.nix
index f3854cecd6a8..238bedd52be0 100644
--- a/pkgs/applications/networking/yaup/default.nix
+++ b/pkgs/applications/networking/yaup/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , intltool
 , pkg-config
 , wrapGAppsHook3
@@ -19,6 +20,15 @@ stdenv.mkDerivation {
     hash = "sha256-RWnNjpgXRYncz9ID8zirENffy1UsfHD1H6Mmd8DKN4k=";
   };
 
+  patches = [
+    # Fix build with miniupnpc 2.2.8
+    # https://github.com/Holarse-Linuxgaming/yaup/pull/6
+    (fetchpatch2 {
+      url = "https://github.com/Holarse-Linuxgaming/yaup/commit/c92134e305932785a60bd72131388f507b4d1853.patch?full_index=1";
+      hash = "sha256-Exqkfp9VYIf9JpAc10cO8NuEAWvI5Houi7CLXV5zBDY=";
+    })
+  ];
+
   nativeBuildInputs = [
     intltool
     pkg-config
diff --git a/pkgs/applications/office/micropad/default.nix b/pkgs/applications/office/micropad/default.nix
index c50e14015f3b..46c318ffbd11 100644
--- a/pkgs/applications/office/micropad/default.nix
+++ b/pkgs/applications/office/micropad/default.nix
@@ -2,100 +2,88 @@
 , stdenv
 , fetchFromGitHub
 , fetchYarnDeps
+, yarnBuildHook
 , fetchzip
 , makeWrapper
 , makeDesktopItem
-, mkYarnPackage
 , electron
 , desktopToDarwinBundle
 , copyDesktopItems
 }:
-let
-  executableName = "micropad";
-in
-  mkYarnPackage rec {
-    pname = "micropad";
-    version = "4.5.1";
 
-    src = fetchFromGitHub {
-      owner = "MicroPad";
-      repo = "Micropad-Electron";
-      rev = "v${version}";
-      hash = "sha256-z+g+FwmoX4Qqf+v4BVLCtfrXwGiAUFlPLQQhp2CMhLU=";
-    };
+stdenv.mkDerivation (finalAttrs: {
+  pname = "micropad";
+  version = "4.5.1";
 
-    micropad-core = fetchzip {
-      url = "https://github.com/MicroPad/MicroPad-Core/releases/download/v${version}/micropad.tar.xz";
-      hash = "sha256-y13PVA/AKKsc5q7NDwZFasb7fOo+56IW8qbTbsm2WWc=";
-    };
+  src = fetchFromGitHub {
+    owner = "MicroPad";
+    repo = "Micropad-Electron";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-z+g+FwmoX4Qqf+v4BVLCtfrXwGiAUFlPLQQhp2CMhLU=";
+  };
 
-    packageJSON = ./package.json;
+  # This project can't be built from source currently, because Nixpkgs lacks
+  # ecosystem for https://bun.sh
+  micropad-core = fetchzip {
+    url = "https://github.com/MicroPad/MicroPad-Core/releases/download/v${finalAttrs.version}/micropad.tar.xz";
+    hash = "sha256-y13PVA/AKKsc5q7NDwZFasb7fOo+56IW8qbTbsm2WWc=";
+  };
 
-    offlineCache = fetchYarnDeps {
-      yarnLock = "${src}/yarn.lock";
-      hash = "sha256-ESYSHuHLNsn3EYKIe2p0kg142jyC0USB+Ef//oGeF08=";
-    };
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-ESYSHuHLNsn3EYKIe2p0kg142jyC0USB+Ef//oGeF08=";
+  };
 
-    nativeBuildInputs = [ copyDesktopItems makeWrapper ]
-      ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
+  nativeBuildInputs = [ yarnBuildHook copyDesktopItems makeWrapper ]
+    ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];
 
-    buildPhase = ''
-      runHook preBuild
-      pushd deps/micropad/
-      yarn --offline build
-      popd
-      runHook postBuild
-    '';
+  installPhase = ''
+    runHook preInstall
 
-    installPhase = ''
-      runHook preInstall
+    # resources
+    mkdir -p "$out/share/"
+    cp -r './deps/micropad' "$out/share/micropad"
+    ln -s '${finalAttrs.micropad-core}' "$out/share/micropad/core"
+    rm "$out/share/micropad/node_modules"
+    cp -r './node_modules' "$out/share/micropad"
 
-      # resources
-      mkdir -p "$out/share/"
-      cp -r './deps/micropad' "$out/share/micropad"
-      ln -s '${micropad-core}' "$out/share/micropad/core"
-      rm "$out/share/micropad/node_modules"
-      cp -r './node_modules' "$out/share/micropad"
+    # icons
+    for icon in $out/share/micropad/build/icons/*.png; do
+      mkdir -p "$out/share/icons/hicolor/$(basename $icon .png | sed -e 's/^icon-//')/apps"
+      ln -s "$icon" "$out/share/icons/hicolor/$(basename $icon .png | sed -e 's/^icon-//')/apps/micropad.png"
+    done
 
-      # icons
-      for icon in $out/share/micropad/build/icons/*.png; do
-        mkdir -p "$out/share/icons/hicolor/$(basename $icon .png | sed -e 's/^icon-//')/apps"
-        ln -s "$icon" "$out/share/icons/hicolor/$(basename $icon .png | sed -e 's/^icon-//')/apps/micropad.png"
-      done
+    # executable wrapper
+    makeWrapper '${electron}/bin/electron' "$out/bin/micropad" \
+      --add-flags "$out/share/micropad" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
 
-      # executable wrapper
-      makeWrapper '${electron}/bin/electron' "$out/bin/${executableName}" \
-        --add-flags "$out/share/micropad" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+    runHook postInstall
+  '';
 
-      runHook postInstall
-    '';
+  # Do not attempt generating a tarball for micropad again.
+  doDist = false;
 
-    # Do not attempt generating a tarball for micropad again.
-    doDist = false;
+  # The desktop item properties should be kept in sync with data from upstream:
+  # https://github.com/MicroPad/MicroPad-Electron/blob/master/package.json
+  desktopItems = [
+    (makeDesktopItem {
+      name = "micropad";
+      exec = "micropad %u";
+      icon = "micropad";
+      desktopName = "µPad";
+      startupWMClass = "µPad";
+      comment = finalAttrs.meta.description;
+      categories = ["Office"];
+    })
+  ];
 
-    # The desktop item properties should be kept in sync with data from upstream:
-    # https://github.com/MicroPad/MicroPad-Electron/blob/master/package.json
-    desktopItems = [
-      (makeDesktopItem {
-        name = "micropad";
-        exec = "${executableName} %u";
-        icon = "micropad";
-        desktopName = "µPad";
-        startupWMClass = "µPad";
-        comment = meta.description;
-        categories = ["Office"];
-      })
-    ];
-
-    passthru.updateScript = ./update.sh;
-
-    meta = with lib; {
-      description = "A powerful note-taking app that helps you organise + take notes without restrictions";
-      homepage = "https://getmicropad.com/";
-      license = licenses.mpl20;
-      maintainers = with maintainers; [rhysmdnz];
-      inherit (electron.meta) platforms;
-      mainProgram = "micropad";
-    };
-  }
+  meta = {
+    description = "A powerful note-taking app that helps you organise + take notes without restrictions";
+    homepage = "https://getmicropad.com/";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [rhysmdnz];
+    inherit (electron.meta) platforms;
+    mainProgram = "micropad";
+  };
+})
diff --git a/pkgs/applications/office/micropad/package.json b/pkgs/applications/office/micropad/package.json
deleted file mode 100644
index 8e1ca96a0519..000000000000
--- a/pkgs/applications/office/micropad/package.json
+++ /dev/null
@@ -1,117 +0,0 @@
-{
-  "name": "micropad",
-  "version": "4.5.1",
-  "description": "A powerful note-taking app that helps you organise + take notes without restrictions.",
-  "main": "main.js",
-  "scripts": {
-    "start": "yarn build && yarn electron . --is-dev --no-sandbox",
-    "build": "yarn tsc -p tsconfig.json",
-    "update-core": "rm -rf core && rm -rf tmp && mkdir tmp && wget https://github.com/MicroPad/MicroPad-Core/releases/download/v${npm_package_version}/micropad.tar.xz -P ./tmp && cd tmp && tar -xf micropad.tar.xz && rm build/dist/*.map && cp -r build ../core && cd .. && rm -rf tmp",
-    "pack": "yarn build && yarn electron-builder --dir",
-    "dist": "yarn build && yarn electron-builder",
-    "windows:version": "echo %npm_package_version%"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/MicroPad/Electron.git"
-  },
-  "author": {
-    "name": "Nick Webster",
-    "email": "nick@nick.geek.nz"
-  },
-  "license": "MPL-2.0",
-  "bugs": {
-    "url": "https://github.com/MicroPad/Electron/issues"
-  },
-  "homepage": "https://getmicropad.com",
-  "devDependencies": {
-    "@types/mime": "^3.0.1",
-    "@types/node": "^18.7.18",
-    "@types/typo-js": "^1.2.1",
-    "electron": "^28.1.0",
-    "electron-builder": "^24.9.1",
-    "typescript": "~5.2.2"
-  },
-  "dependencies": {
-    "dictionary-en": "^3.0.0",
-    "dictionary-en-au": "^2.1.1",
-    "electron-context-menu": "^3.1.2",
-    "electron-window-state": "^5.0.3",
-    "localforage": "^1.10.0",
-    "mime": "^3.0.0",
-    "typo-js": "^1.2.3"
-  },
-  "build": {
-    "appId": "com.getmicropad.micropad",
-    "productName": "µPad",
-    "publish": {
-      "provider": "github",
-      "releaseType": "release"
-    },
-    "asarUnpack": [
-      "preload.js"
-    ],
-    "linux": {
-      "target": [
-        {
-          "target": "tar.gz",
-          "arch": [
-            "x64",
-            "armv7l",
-            "arm64"
-          ]
-        },
-        {
-          "target": "AppImage",
-          "arch": [
-            "x64",
-            "armv7l",
-            "arm64"
-          ]
-        },
-        "snap",
-        "deb",
-        "rpm",
-        "pacman"
-      ],
-      "executableName": "micropad",
-      "category": "Office",
-      "icon": "build/icons"
-    },
-    "pacman": {
-      "depends": [
-        "gtk3"
-      ]
-    },
-    "snap": {
-      "publish": {
-        "provider": "github",
-        "releaseType": "release"
-      }
-    },
-    "mac": {
-      "target": {
-        "target": "dmg",
-        "arch": "universal"
-      },
-      "category": "public.app-category.productivity",
-      "identity": null
-    },
-    "win": {
-      "target": [
-        {
-          "target": "nsis",
-          "arch": [
-            "x64",
-            "arm64"
-          ]
-        },
-        "portable"
-      ]
-    },
-    "nsis": {
-      "allowToChangeInstallationDirectory": true,
-      "oneClick": false
-    }
-  }
-}
diff --git a/pkgs/applications/office/micropad/update.sh b/pkgs/applications/office/micropad/update.sh
deleted file mode 100755
index e2265af4ee72..000000000000
--- a/pkgs/applications/office/micropad/update.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl common-updater-scripts jq nix nodePackages.prettier prefetch-yarn-deps
-
-set -eu -o pipefail
-
-latest_version=$(curl -s https://api.github.com/repos/MicroPad/Micropad-Electron/releases/latest | jq --raw-output '.tag_name[1:]')
-old_core_hash=$(nix-instantiate --eval --strict -A "micropad.micropad-core.drvAttrs.outputHash" | tr -d '"' | sed -re 's|[+]|\\&|g')
-new_core_hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --unpack "https://github.com/MicroPad/MicroPad-Core/releases/download/v$latest_version/micropad.tar.xz"))
-
-nixFile=$(nix-instantiate --eval --strict -A "micropad.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/')
-nixFolder=$(dirname "$nixFile")
-
-sed -i "$nixFile" -re "s|\"$old_core_hash\"|\"$new_core_hash\"|"
-
-curl -o "$nixFolder/package.json" -s "https://raw.githubusercontent.com/MicroPad/MicroPad-Electron/v$latest_version/package.json"
-curl -o "$nixFolder/yarn.lock" -s "https://raw.githubusercontent.com/MicroPad/MicroPad-Electron/v$latest_version/yarn.lock"
-
-prettier --write "$nixFolder/package.json"
-old_yarn_hash=$(nix-instantiate --eval --strict -A "micropad.offlineCache.outputHash" | tr -d '"' | sed -re 's|[+]|\\&|g')
-new_yarn_hash=$(nix hash to-sri --type sha256 $(prefetch-yarn-deps "$nixFolder/yarn.lock"))
-sed -i "$nixFile" -re "s|\"$old_yarn_hash\"|\"$new_yarn_hash\"|"
-rm "$nixFolder/yarn.lock"
-
-update-source-version micropad "$latest_version"
diff --git a/pkgs/applications/video/openshot-qt/default.nix b/pkgs/applications/video/openshot-qt/default.nix
index 4a8208d8bbb6..406b391f2a25 100644
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@@ -47,7 +47,7 @@ mkDerivationWith python3.pkgs.buildPythonApplication {
     pyqtwebengine
     pyzmq
     requests
-    sip4
+    sip
   ];
 
   strictDeps = true;
diff --git a/pkgs/build-support/node/fetch-yarn-deps/default.nix b/pkgs/build-support/node/fetch-yarn-deps/default.nix
index 4ef74c0cab88..d0caa42dade1 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@@ -1,4 +1,19 @@
-{ stdenv, lib, makeWrapper, coreutils, nix-prefetch-git, fetchurl, nodejs-slim, prefetch-yarn-deps, cacert, callPackage, nix }:
+{
+  stdenv,
+  lib,
+  makeWrapper,
+  coreutils,
+  nix-prefetch-git,
+  fetchurl,
+  nodejs-slim,
+  prefetch-yarn-deps,
+  fixup-yarn-lock,
+  yarn,
+  makeSetupHook,
+  cacert,
+  callPackage,
+  nix,
+}:
 
 let
   yarnpkg-lockfile-tar = fetchurl {
@@ -6,9 +21,9 @@ let
     hash = "sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==";
   };
 
-  tests = callPackage ./tests {};
-
-in {
+  tests = callPackage ./tests { };
+in
+{
   prefetch-yarn-deps = stdenv.mkDerivation {
     name = "prefetch-yarn-deps";
 
@@ -30,12 +45,20 @@ in {
 
       patchShebangs $out/libexec
       makeWrapper $out/libexec/index.js $out/bin/prefetch-yarn-deps \
-        --prefix PATH : ${lib.makeBinPath [ coreutils nix-prefetch-git nix ]}
+        --prefix PATH : ${
+          lib.makeBinPath [
+            coreutils
+            nix-prefetch-git
+            nix
+          ]
+        }
 
       runHook postInstall
     '';
 
-    passthru = { inherit tests; };
+    passthru = {
+      inherit tests;
+    };
   };
 
   fixup-yarn-lock = stdenv.mkDerivation {
@@ -63,45 +86,93 @@ in {
       runHook postInstall
     '';
 
-    passthru = { inherit tests; };
+    passthru = {
+      inherit tests;
+    };
   };
 
-  fetchYarnDeps = let
-    f = {
-      name ? "offline",
-      src ? null,
-      hash ? "",
-      sha256 ? "",
-      ...
-    }@args: let
-      hash_ =
-        if hash != "" then { outputHashAlgo = null; outputHash = hash; }
-        else if sha256 != "" then { outputHashAlgo = "sha256"; outputHash = sha256; }
-        else { outputHashAlgo = "sha256"; outputHash = lib.fakeSha256; };
-    in stdenv.mkDerivation ({
-      inherit name;
+  fetchYarnDeps =
+    let
+      f =
+        {
+          name ? "offline",
+          src ? null,
+          hash ? "",
+          sha256 ? "",
+          ...
+        }@args:
+        let
+          hash_ =
+            if hash != "" then
+              {
+                outputHashAlgo = null;
+                outputHash = hash;
+              }
+            else if sha256 != "" then
+              {
+                outputHashAlgo = "sha256";
+                outputHash = sha256;
+              }
+            else
+              {
+                outputHashAlgo = "sha256";
+                outputHash = lib.fakeSha256;
+              };
+        in
+        stdenv.mkDerivation (
+          {
+            inherit name;
 
-      dontUnpack = src == null;
-      dontInstall = true;
+            dontUnpack = src == null;
+            dontInstall = true;
 
-      nativeBuildInputs = [ prefetch-yarn-deps cacert ];
-      GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-      NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+            nativeBuildInputs = [
+              prefetch-yarn-deps
+              cacert
+            ];
+            GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+            NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
-      buildPhase = ''
-        runHook preBuild
+            buildPhase = ''
+              runHook preBuild
 
-        yarnLock=''${yarnLock:=$PWD/yarn.lock}
-        mkdir -p $out
-        (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock)
+              yarnLock=''${yarnLock:=$PWD/yarn.lock}
+              mkdir -p $out
+              (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock)
 
-        runHook postBuild
-      '';
+              runHook postBuild
+            '';
 
-      outputHashMode = "recursive";
-    } // hash_ // (removeAttrs args (["name" "hash" "sha256"] ++ (lib.optional (src == null) "src"))));
+            outputHashMode = "recursive";
+          }
+          // hash_
+          // (removeAttrs args (
+            [
+              "name"
+              "hash"
+              "sha256"
+            ]
+            ++ (lib.optional (src == null) "src")
+          ))
+        );
+    in
+    lib.setFunctionArgs f (lib.functionArgs f) // { inherit tests; };
 
-  in lib.setFunctionArgs f (lib.functionArgs f) // {
-    inherit tests;
-  };
+  yarnConfigHook = makeSetupHook {
+    name = "yarn-config-hook";
+    propagatedBuildInputs = [
+      yarn
+      fixup-yarn-lock
+    ];
+    meta = {
+      description = "Install nodejs dependencies from an offline yarn cache produced by fetchYarnDeps";
+    };
+  } ./yarn-config-hook.sh;
+
+  yarnBuildHook = makeSetupHook {
+    name = "yarn-build-hook";
+    meta = {
+      description = "Run yarn build in buildPhase";
+    };
+  } ./yarn-build-hook.sh;
 }
diff --git a/pkgs/build-support/node/fetch-yarn-deps/fixup.js b/pkgs/build-support/node/fetch-yarn-deps/fixup.js
index 732e569aba7b..a359cd58a916 100755
--- a/pkgs/build-support/node/fetch-yarn-deps/fixup.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/fixup.js
@@ -12,6 +12,15 @@ const fixupYarnLock = async (lockContents, verbose) => {
 	const fixedData = Object.fromEntries(
 		Object.entries(lockData.object)
 		.map(([dep, pkg]) => {
+			if (pkg.resolved === undefined) {
+				console.warn(`no resolved URL for package ${dep}`)
+				var maybeFile = dep.split("@", 2)[1]
+				if (maybeFile.startsWith("file:")) {
+					console.log(`Rewriting URL for local file dependency ${dep}`)
+					pkg.resolved = maybeFile
+				}
+				return [dep, pkg]
+			}
 			const [ url, hash ] = pkg.resolved.split("#", 2)
 
 			if (hash || url.startsWith("https://codeload.github.com")) {
diff --git a/pkgs/build-support/node/fetch-yarn-deps/yarn-build-hook.sh b/pkgs/build-support/node/fetch-yarn-deps/yarn-build-hook.sh
new file mode 100644
index 000000000000..947aa1736b6f
--- /dev/null
+++ b/pkgs/build-support/node/fetch-yarn-deps/yarn-build-hook.sh
@@ -0,0 +1,24 @@
+yarnBuildHook() {
+    runHook preBuild
+    echo "Executing yarnBuildHook"
+
+    if [ -z "${yarnBuildScript-}" ]; then
+        yarnBuildScript="build"
+    fi
+
+    if ! type node > /dev/null 2>&1 ; then
+        echo yarnConfigHook WARNING: a node interpreter was not added to the \
+            build, and is probably required to run \'yarn $yarnBuildHook\'. \
+            A common symptom of this is getting \'command not found\' errors \
+            for Nodejs related tools.
+    fi
+
+    yarn --offline "$yarnBuildScript" $yarnBuildFlags
+
+    echo "finished yarnBuildHook"
+    runHook postBuild
+}
+
+if [[ -z "${dontYarnBuild-}" && -z "${buildPhase-}" ]]; then
+    buildPhase=yarnBuildHook
+fi
diff --git a/pkgs/build-support/node/fetch-yarn-deps/yarn-config-hook.sh b/pkgs/build-support/node/fetch-yarn-deps/yarn-config-hook.sh
new file mode 100644
index 000000000000..d11229aafc71
--- /dev/null
+++ b/pkgs/build-support/node/fetch-yarn-deps/yarn-config-hook.sh
@@ -0,0 +1,37 @@
+yarnConfigHook(){
+    runHook preConfigure
+    echo "Executing yarnConfigHook"
+
+    # Use a constant HOME directory
+    mkdir -p /tmp/home
+    export HOME=/tmp/home
+    if [[ -n "$yarnOfflineCache" ]]; then
+        offlineCache="$yarnOfflineCache"
+    fi
+    if [[ -z "$offlineCache" ]]; then
+        echo yarnConfigHook: No yarnOfflineCache or offlineCache were defined\! >&2
+        exit 2
+    fi
+    yarn config --offline set yarn-offline-mirror "$offlineCache"
+    fixup-yarn-lock yarn.lock
+    yarn install \
+        --frozen-lockfile \
+        --force \
+        --production=false \
+        --ignore-engines \
+        --ignore-platform \
+        --ignore-scripts \
+        --no-progress \
+        --non-interactive \
+        --offline
+
+    # TODO: Check if this is really needed
+    patchShebangs node_modules
+
+    echo "finished yarnConfigHook"
+    runHook postConfigure
+}
+
+if [[ -z "${dontYarnInstallDeps-}" && -z "${configurePhase-}" ]]; then
+    configurePhase=yarnConfigHook
+fi
diff --git a/pkgs/by-name/al/alephone/package.nix b/pkgs/by-name/al/alephone/package.nix
index d850e77d7b3c..79a228259960 100644
--- a/pkgs/by-name/al/alephone/package.nix
+++ b/pkgs/by-name/al/alephone/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch2,
   alsa-lib,
   boost,
   curl,
@@ -48,6 +49,15 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-IUvMfG4jtN/QXq4DQIDuI0+Bl3MSSwDGKOyjfcRWgvE=";
   };
 
+  patches = [
+    # Fix build with miniupnpc 2.2.8
+    # https://github.com/Aleph-One-Marathon/alephone/pull/503
+    (fetchpatch2 {
+      url = "https://github.com/Aleph-One-Marathon/alephone/commit/e25c4bc1ac02619e811b8f19bf4c2f617550e124.patch?full_index=1";
+      hash = "sha256-BFLLSTjNl/+/kVb+t6EyW1jhAlKN/G+Q99TICV9VHOY=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     icoutils
diff --git a/pkgs/by-name/az/azure-cli/package.nix b/pkgs/by-name/az/azure-cli/package.nix
index 092462776607..a823d69e2ab5 100644
--- a/pkgs/by-name/az/azure-cli/package.nix
+++ b/pkgs/by-name/az/azure-cli/package.nix
@@ -441,7 +441,7 @@ py.pkgs.toPythonApplication (
       sourceProvenance = [ sourceTypes.fromSource ];
       license = licenses.mit;
       mainProgram = "az";
-      maintainers = with maintainers; [ katexochen ];
+      maintainers = with maintainers; [ katexochen ] ++ lib.teams.stridtech.members;
       platforms = platforms.all;
     };
   }
diff --git a/pkgs/by-name/bi/bicep/package.nix b/pkgs/by-name/bi/bicep/package.nix
index 52120d8bcffc..20763b9524b6 100644
--- a/pkgs/by-name/bi/bicep/package.nix
+++ b/pkgs/by-name/bi/bicep/package.nix
@@ -43,7 +43,7 @@ buildDotnetModule rec {
     homepage = "https://github.com/Azure/bicep/";
     changelog = "https://github.com/Azure/bicep/releases/tag/v${version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ khaneliman ];
+    maintainers = with lib.maintainers; [ khaneliman ] ++ lib.teams.stridtech.members;
     mainProgram = "bicep";
   };
 }
diff --git a/pkgs/by-name/bi/bitwarden-cli/package.nix b/pkgs/by-name/bi/bitwarden-cli/package.nix
index 0fd2e1dae4ef..b1879dce4797 100644
--- a/pkgs/by-name/bi/bitwarden-cli/package.nix
+++ b/pkgs/by-name/bi/bitwarden-cli/package.nix
@@ -3,7 +3,7 @@
 , buildNpmPackage
 , nodejs_20
 , fetchFromGitHub
-, python3
+, python311
 , darwin
 , nixosTests
 , xcbuild
@@ -25,7 +25,7 @@ buildNpmPackage rec {
   npmDepsHash = "sha256-rwzyKaCW3LAOqw6BEu8DLS0Ad5hB6cH1OnjWzbSEgVI=";
 
   nativeBuildInputs = [
-    python3
+    python311
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.cctools
     xcbuild.xcrun
diff --git a/pkgs/by-name/co/codefresh/package.json b/pkgs/by-name/co/codefresh/package.json
deleted file mode 100644
index e0e82b3bcdd4..000000000000
--- a/pkgs/by-name/co/codefresh/package.json
+++ /dev/null
@@ -1,118 +0,0 @@
-{
-  "name": "codefresh",
-  "version": "0.87.3",
-  "description": "Codefresh command line utility",
-  "main": "index.js",
-  "preferGlobal": true,
-  "scripts": {
-    "generate-completion": "node ./lib/interface/cli/completion/generate",
-    "test": "jest .spec.js --coverage",
-    "e2e": "bash e2e/e2e.spec.sh",
-    "eslint": "eslint --fix lib/logic/**",
-    "pkg": "pkg . -t node16-alpine-x64,node16-macos-x64,node16-linux-x64,node16-win-x64,node16-linux-arm64 --out-path ./dist",
-    "serve-docs": "yarn build-local-docs && cd temp && hugo server -D",
-    "serve-docs-beta": "ALLOW_BETA_COMMANDS=true yarn build-local-docs && cd temp && hugo server -D",
-    "build-local-docs": "node ./docs/index.js",
-    "build-public-docs": "node ./docs/index.js && cd temp && hugo",
-    "postinstall": "node run-check-version.js"
-  },
-  "bin": {
-    "codefresh": "lib/interface/cli/codefresh"
-  },
-  "repository": "git+https://github.com/codefresh-io/cli.git",
-  "keywords": [
-    "command line"
-  ],
-  "pkg": {
-    "scripts": [
-      "lib/**/*.js",
-      "node_modules/codefresh-sdk/lib/**/*.js",
-      "node_modules/kubernetes-client/**/*.js"
-    ],
-    "assets": "lib/**/*.hbs"
-  },
-  "resolutions": {
-    "websocket-extensions": "^0.1.4",
-    "lodash": "^4.17.21",
-    "json-schema": "^0.4.0",
-    "ajv": "^6.12.6",
-    "normalize-url": "^4.5.1",
-    "ansi-regex": "^5.0.1",
-    "y18n": "^4.0.1",
-    "shelljs": "^0.8.5",
-    "codefresh-sdk/swagger-client/qs": "6.9.7",
-    "kubernetes-client/qs": "6.9.7",
-    "**/request/qs": "6.5.3"
-  },
-  "dependencies": {
-    "@codefresh-io/docker-reference": "^0.0.5",
-    "adm-zip": "^0.5.5",
-    "ajv": "^6.12.6",
-    "bluebird": "^3.5.1",
-    "cf-errors": "^0.1.16",
-    "chalk": "^4.1.0",
-    "cli-progress": "3.10.0",
-    "codefresh-sdk": "^1.12.0",
-    "colors": "1.4.0",
-    "columnify": "^1.6.0",
-    "compare-versions": "^3.4.0",
-    "copy-dir": "^0.3.0",
-    "debug": "^3.1.0",
-    "diff": "^3.5.0",
-    "dockerode": "^2.5.7",
-    "draftlog": "^1.0.12",
-    "figlet": "^1.4.0",
-    "filesize": "^3.5.11",
-    "firebase": "git+https://github.com/codefresh-io/firebase.git#80b2ed883ff281cd67b53bd0f6a0bbd6f330fed5",
-    "flat": "^4.1.1",
-    "inquirer": "^7.1.0",
-    "js-yaml": "^3.10.0",
-    "kefir": "^3.8.1",
-    "kubernetes-client": "^9.0.0",
-    "lodash": "^4.17.21",
-    "mkdirp": "^0.5.1",
-    "moment": "^2.29.4",
-    "mongodb": "^4.17.2",
-    "node-forge": "^1.3.0",
-    "ora": "^5.4.1",
-    "prettyjson": "^1.2.5",
-    "promise-retry": "^2.0.1",
-    "recursive-readdir": "^2.2.3",
-    "request": "^2.88.0",
-    "request-promise": "^4.2.2",
-    "requestretry": "^7.0.2",
-    "rimraf": "^2.6.2",
-    "semver": "^7.5.4",
-    "tar-stream": "^2.2.0",
-    "uuid": "^3.1.0",
-    "yaml": "^1.10.0",
-    "yargs": "^15.4.1",
-    "yargs-parser": "^13.0.0",
-    "zip": "^1.2.0"
-  },
-  "devDependencies": {
-    "@types/node-forge": "^1.0.1",
-    "eslint": "^7.32.0",
-    "eslint-config-airbnb-base": "^15.0.0",
-    "eslint-plugin-import": "^2.25.4",
-    "eslint-plugin-jest": "^27.6.3",
-    "hugo-cli": "^0.5.4",
-    "jest": "^29.7.0",
-    "pkg": "5.5.2"
-  },
-  "bugs": {
-    "url": "https://github.com/codefresh-io/cli/issues"
-  },
-  "homepage": "https://github.com/codefresh-io/cli#readme",
-  "author": "Codefresh",
-  "license": "ISC",
-  "engines": {
-    "node": ">=14.0.0"
-  },
-  "jest": {
-    "testEnvironment": "node",
-    "setupFiles": [
-      "./test-setup.js"
-    ]
-  }
-}
diff --git a/pkgs/by-name/co/codefresh/package.nix b/pkgs/by-name/co/codefresh/package.nix
index 604ca4a83e95..36792f48dfaa 100644
--- a/pkgs/by-name/co/codefresh/package.nix
+++ b/pkgs/by-name/co/codefresh/package.nix
@@ -1,36 +1,40 @@
-{ lib, mkYarnPackage, fetchFromGitHub, fetchYarnDeps, testers, codefresh }:
+{ lib, stdenv, fetchFromGitHub, fetchYarnDeps, yarnConfigHook, npmHooks, nodejs, testers }:
 
-mkYarnPackage rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "codefresh";
   version = "0.87.3";
 
   src = fetchFromGitHub {
     owner = "codefresh-io";
     repo = "cli";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-SUwt0oWls823EeLxT4CW+LDdsjAtSxxxKkllhMJXCtM=";
   };
 
   offlineCache = fetchYarnDeps {
-    yarnLock = "${src}/yarn.lock";
+    yarnLock = "${finalAttrs.src}/yarn.lock";
     hash = "sha256-tzsHbvoQ59MwE4TYdPweLaAv9r4V8oyTQyvdeyPCsHY=";
   };
-  packageJSON = ./package.json;
-
-  doDist = false;
+  nativeBuildInputs = [
+    yarnConfigHook
+    npmHooks.npmInstallHook
+    nodejs
+  ];
+  # Tries to fetch stuff from the internet
+  dontNpmPrune = true;
 
   passthru.tests.version = testers.testVersion {
-    package = codefresh;
+    package = finalAttrs.finalPackage;
     # codefresh needs to read a config file, this is faked out with a subshell
     command = "codefresh --cfconfig <(echo 'contexts:') version";
   };
 
   meta = {
-    changelog = "https://github.com/codefresh-io/cli/releases/tag/v${version}";
+    changelog = "https://github.com/codefresh-io/cli/releases/tag/v${finalAttrs.version}";
     description = "Codefresh CLI tool to interact with Codefresh services";
     homepage = "https://github.com/codefresh-io/cli";
     license = lib.licenses.mit;
     mainProgram = "codefresh";
     maintainers = [ lib.maintainers.takac ];
   };
-}
+})
diff --git a/pkgs/by-name/el/element-call/package.json b/pkgs/by-name/el/element-call/package.json
deleted file mode 100644
index 173927845525..000000000000
--- a/pkgs/by-name/el/element-call/package.json
+++ /dev/null
@@ -1,129 +0,0 @@
-{
-  "name": "element-call",
-  "version": "0.0.0",
-  "type": "module",
-  "scripts": {
-    "dev": "vite",
-    "build": "NODE_OPTIONS=--max-old-space-size=16384 vite build",
-    "serve": "vite preview",
-    "prettier:check": "prettier -c .",
-    "prettier:format": "prettier -w .",
-    "lint": "yarn lint:types && yarn lint:eslint",
-    "lint:eslint": "eslint --max-warnings 0 src",
-    "lint:eslint-fix": "eslint --max-warnings 0 src --fix",
-    "lint:types": "tsc",
-    "i18n": "node_modules/i18next-parser/bin/cli.js",
-    "i18n:check": "node_modules/i18next-parser/bin/cli.js --fail-on-warnings --fail-on-update",
-    "test": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "backend": "docker-compose -f backend-docker-compose.yml up"
-  },
-  "dependencies": {
-    "@juggle/resize-observer": "^3.3.1",
-    "@livekit/components-core": "^0.10.0",
-    "@livekit/components-react": "^2.0.0",
-    "@matrix-org/olm": "https://gitlab.matrix.org/api/v4/projects/27/packages/npm/@matrix-org/olm/-/@matrix-org/olm-3.2.14.tgz",
-    "@opentelemetry/api": "^1.4.0",
-    "@opentelemetry/context-zone": "^1.9.1",
-    "@opentelemetry/exporter-jaeger": "^1.9.1",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.48.0",
-    "@opentelemetry/instrumentation-document-load": "^0.36.0",
-    "@opentelemetry/instrumentation-user-interaction": "^0.36.0",
-    "@opentelemetry/sdk-trace-web": "^1.9.1",
-    "@radix-ui/react-dialog": "^1.0.4",
-    "@radix-ui/react-slider": "^1.1.2",
-    "@radix-ui/react-visually-hidden": "^1.0.3",
-    "@react-aria/button": "^3.3.4",
-    "@react-aria/focus": "^3.5.0",
-    "@react-aria/menu": "^3.3.0",
-    "@react-aria/overlays": "^3.7.3",
-    "@react-aria/select": "^3.6.0",
-    "@react-aria/tabs": "^3.1.0",
-    "@react-aria/tooltip": "^3.1.3",
-    "@react-aria/utils": "^3.10.0",
-    "@react-rxjs/core": "^0.10.7",
-    "@react-spring/web": "^9.4.4",
-    "@react-stately/collections": "^3.3.4",
-    "@react-stately/select": "^3.1.3",
-    "@react-stately/tooltip": "^3.0.5",
-    "@react-stately/tree": "^3.2.0",
-    "@sentry/react": "^7.0.0",
-    "@sentry/tracing": "^7.0.0",
-    "@types/lodash": "^4.14.199",
-    "@use-gesture/react": "^10.2.11",
-    "@vector-im/compound-design-tokens": "^1.0.0",
-    "@vector-im/compound-web": "^3.0.0",
-    "@vitejs/plugin-basic-ssl": "^1.0.1",
-    "@vitejs/plugin-react": "^4.0.1",
-    "buffer": "^6.0.3",
-    "classnames": "^2.3.1",
-    "events": "^3.3.0",
-    "i18next": "^23.0.0",
-    "i18next-browser-languagedetector": "^7.0.0",
-    "i18next-http-backend": "^2.0.0",
-    "livekit-client": "^2.0.2",
-    "lodash": "^4.17.21",
-    "matrix-js-sdk": "github:matrix-org/matrix-js-sdk#d55c6a36df539f6adacc335efe5b9be27c9cee4a",
-    "matrix-widget-api": "^1.3.1",
-    "normalize.css": "^8.0.1",
-    "pako": "^2.0.4",
-    "postcss-preset-env": "^9.0.0",
-    "posthog-js": "^1.29.0",
-    "react": "18",
-    "react-dom": "18",
-    "react-i18next": "^14.0.0",
-    "react-router-dom": "^5.2.0",
-    "react-use-clipboard": "^1.0.7",
-    "react-use-measure": "^2.1.1",
-    "rxjs": "^7.8.1",
-    "sdp-transform": "^2.14.1",
-    "tinyqueue": "^2.0.3",
-    "unique-names-generator": "^4.6.0",
-    "uuid": "9",
-    "vaul": "^0.9.0"
-  },
-  "devDependencies": {
-    "@babel/core": "^7.16.5",
-    "@babel/preset-env": "^7.22.20",
-    "@babel/preset-react": "^7.22.15",
-    "@babel/preset-typescript": "^7.23.0",
-    "@react-spring/rafz": "^9.7.3",
-    "@react-types/dialog": "^3.5.5",
-    "@sentry/vite-plugin": "^2.0.0",
-    "@testing-library/react": "^14.0.0",
-    "@testing-library/user-event": "^14.5.1",
-    "@types/content-type": "^1.1.5",
-    "@types/dom-screen-wake-lock": "^1.0.1",
-    "@types/dompurify": "^3.0.2",
-    "@types/grecaptcha": "^3.0.4",
-    "@types/node": "^20.0.0",
-    "@types/react-router-dom": "^5.3.3",
-    "@types/request": "^2.48.8",
-    "@types/sdp-transform": "^2.4.5",
-    "@types/uuid": "9",
-    "@typescript-eslint/eslint-plugin": "^7.0.0",
-    "@typescript-eslint/parser": "^7.0.0",
-    "babel-loader": "^9.0.0",
-    "babel-plugin-transform-vite-meta-env": "^1.0.3",
-    "eslint": "^8.14.0",
-    "eslint-config-google": "^0.14.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-deprecate": "^0.8.2",
-    "eslint-plugin-import": "^2.26.0",
-    "eslint-plugin-jsx-a11y": "^6.5.1",
-    "eslint-plugin-matrix-org": "^1.2.1",
-    "eslint-plugin-react": "^7.29.4",
-    "eslint-plugin-react-hooks": "^4.5.0",
-    "eslint-plugin-unicorn": "^51.0.0",
-    "i18next-parser": "^8.0.0",
-    "jsdom": "^24.0.0",
-    "prettier": "^3.0.0",
-    "sass": "^1.42.1",
-    "typescript": "^5.1.6",
-    "typescript-eslint-language-service": "^5.0.5",
-    "vite": "^5.0.0",
-    "vite-plugin-html-template": "^1.1.0",
-    "vite-plugin-svgr": "^4.0.0",
-    "vitest": "^1.2.2"
-  }
-}
diff --git a/pkgs/by-name/el/element-call/package.nix b/pkgs/by-name/el/element-call/package.nix
index da7f41222c16..835329fef295 100644
--- a/pkgs/by-name/el/element-call/package.nix
+++ b/pkgs/by-name/el/element-call/package.nix
@@ -1,8 +1,11 @@
 { lib
 , stdenv
-, mkYarnPackage
 , fetchFromGitHub
 , fetchYarnDeps
+, yarnConfigHook
+, yarnBuildHook
+, nodejs
+, npmHooks
 }:
 
 let
@@ -15,38 +18,33 @@ let
     aarch64-darwin = "sha256-G4doEnZORJqcl3bWaKZPuQmBeXNXud06nLO12Afr9kM=";
   }.${system} or throwSystem;
 in
-mkYarnPackage rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "element-call";
   version = "0.5.16";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-call";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-GTHM27i716RZk+kDELMg/lYy355/SZoQLXGPQ90M4xg=";
   };
 
-  packageJSON = ./package.json;
-
   patches = [ ./name.patch ];
 
   offlineCache = fetchYarnDeps {
-    yarnLock = "${src}/yarn.lock";
+    yarnLock = "${finalAttrs.src}/yarn.lock";
     hash = offlineCacheHash;
   };
 
-  buildPhase = ''
-    runHook preBuild
-    yarn --offline run build
-    runHook postBuild
-  '';
-
-  preInstall = ''
-    mkdir $out
-    cp -R ./deps/element-call/dist $out
-  '';
-
-  doDist = false;
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs
+    npmHooks.npmInstallHook
+  ];
+  # From some reason causes the build to fail due to dependencies not available
+  # offline
+  dontNpmPrune = true;
 
   meta = with lib; {
     homepage = "https://github.com/element-hq/element-call";
@@ -55,4 +53,4 @@ mkYarnPackage rec {
     maintainers = with maintainers; [ kilimnik ];
     mainProgram = "element-call";
   };
-}
+})
diff --git a/pkgs/by-name/ex/exhibit/package.nix b/pkgs/by-name/ex/exhibit/package.nix
index 79b0f4742ea4..73fe81102632 100644
--- a/pkgs/by-name/ex/exhibit/package.nix
+++ b/pkgs/by-name/ex/exhibit/package.nix
@@ -36,7 +36,7 @@ python3Packages.buildPythonApplication rec {
 
   dependencies = with python3Packages; [
     pygobject3
-    f3d
+    f3d_egl
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/he/hello-cpp/package.nix b/pkgs/by-name/he/hello-cpp/package.nix
new file mode 100644
index 000000000000..a8313a66cc77
--- /dev/null
+++ b/pkgs/by-name/he/hello-cpp/package.nix
@@ -0,0 +1,18 @@
+{
+  cmake,
+  lib,
+  ninja,
+  stdenv,
+}:
+
+stdenv.mkDerivation {
+  name = "hello-cpp";
+  src = ./src;
+  nativeBuildInputs = [ cmake ninja ];
+  meta = {
+    description = "Basic sanity check that C++ and cmake infrastructure are working";
+    platforms = lib.platforms.all;
+    maintainers = stdenv.meta.maintainers or [];
+    mainProgram = "hello-cpp";
+  };
+}
diff --git a/pkgs/by-name/he/hello-cpp/src/CMakeLists.txt b/pkgs/by-name/he/hello-cpp/src/CMakeLists.txt
new file mode 100644
index 000000000000..b7bddfdefd0a
--- /dev/null
+++ b/pkgs/by-name/he/hello-cpp/src/CMakeLists.txt
@@ -0,0 +1,6 @@
+cmake_minimum_required(VERSION 3.10)
+project(hello-cpp)
+
+add_executable(hello-cpp main.cpp)
+
+install(TARGETS hello-cpp)
diff --git a/pkgs/by-name/he/hello-cpp/src/main.cpp b/pkgs/by-name/he/hello-cpp/src/main.cpp
new file mode 100644
index 000000000000..5c887e112046
--- /dev/null
+++ b/pkgs/by-name/he/hello-cpp/src/main.cpp
@@ -0,0 +1,6 @@
+#include <iostream>
+
+int main(int argc, char *argv[]) {
+    std::cout << "Hello, C++\n";
+    return 0;
+}
diff --git a/pkgs/by-name/ko/koodo-reader/package.json b/pkgs/by-name/ko/koodo-reader/package.json
deleted file mode 100644
index 5c8f5140d1ba..000000000000
--- a/pkgs/by-name/ko/koodo-reader/package.json
+++ /dev/null
@@ -1,312 +0,0 @@
-{
-  "name": "koodo-reader",
-  "main": "main.js",
-  "version": "1.6.6",
-  "description": "A cross-platform ebook reader",
-  "author": {
-    "name": "App by Troye",
-    "email": "support@960960.xyz"
-  },
-  "engines": {
-    "node": ">=18.0.0",
-    "npm": ">=6.0.0"
-  },
-  "repository": "https://github.com/koodo-reader/koodo-reader",
-  "private": false,
-  "resolutions": {
-    "//": "See https://github.com/facebook/create-react-app/issues/11773",
-    "react-error-overlay": "6.0.9"
-  },
-  "dependencies": {
-    "@aws-sdk/client-s3": "^3.485.0",
-    "adm-zip": "^0.5.2",
-    "axios": "^0.19.2",
-    "buffer": "^6.0.3",
-    "copy-text-to-clipboard": "^2.2.0",
-    "dompurify": "^3.0.1",
-    "electron-is-dev": "^1.1.0",
-    "electron-store": "^8.0.1",
-    "font-list": "^1.4.5",
-    "fs-extra": "^9.1.0",
-    "ftp": "^0.3.10",
-    "howler": "^2.2.3",
-    "iconv-lite": "^0.6.3",
-    "qs": "^6.11.2",
-    "react-hot-toast": "^2.1.1",
-    "react-tooltip": "^5.26.3",
-    "ssh2-sftp-client": "^9.1.0",
-    "webdav": "^3.6.2",
-    "wink-lemmatizer": "^3.0.4",
-    "ws": "^8.13.0",
-    "zip-a-folder": "^0.0.12"
-  },
-  "devDependencies": {
-    "@types/i18next": "^13.0.0",
-    "@types/iconv-lite": "^0.0.1",
-    "@types/node": "^13.13.2",
-    "@types/react": "17.0.2",
-    "@types/react-dom": "17.0.2",
-    "@types/react-i18next": "^8.1.0",
-    "@types/react-lottie": "^1.2.5",
-    "@types/react-redux": "^7.1.7",
-    "@types/react-router-dom": "^5.1.6",
-    "@types/spark-md5": "^3.0.2",
-    "@types/ws": "^8.5.5",
-    "classnames": "^2.2.6",
-    "concurrently": "^5.0.1",
-    "cross-env": "^6.0.3",
-    "electron": "14.1.1",
-    "electron-builder": "^23.6.0",
-    "hard-source-webpack-plugin": "^0.13.1",
-    "html-react-parser": "^0.13.0",
-    "i18next": "^20.2.4",
-    "node-sass": "^9.0.0",
-    "nodemon": "^2.0.6",
-    "rc-color-picker": "^1.2.6",
-    "react": "^17.0.2",
-    "react-device-detect": "^1.12.1",
-    "react-dom": "^17.0.2",
-    "react-dropzone": "^11.3.0",
-    "react-i18next": "^13.2.2",
-    "react-lottie": "^1.2.3",
-    "react-redux": "^7.2.0",
-    "react-router-dom": "^5.2.0",
-    "react-scripts": "^5.0.1",
-    "redux": "^4.0.5",
-    "redux-thunk": "^2.3.0",
-    "sass-loader": "^13.3.2",
-    "source-map-explorer": "^2.5.2",
-    "spark-md5": "^3.0.1",
-    "typescript": "3.8.3",
-    "wait-on": "^7.0.1"
-  },
-  "scripts": {
-    "analyze": "source-map-explorer 'build/static/js/*.js'",
-    "start": "react-scripts start",
-    "build": "react-scripts build",
-    "test": "react-scripts test",
-    "eject": "react-scripts eject",
-    "ele": "electron .",
-    "dev": "concurrently \"cross-env BROWSER=none npm start\" \"wait-on http://127.0.0.1:3000/ && nodemon --watch main.js --exec electron .\"",
-    "release": "electron-builder",
-    "prerelease": "react-scripts build"
-  },
-  "homepage": "./",
-  "build": {
-    "appId": "xyz.960960.koodo",
-    "productName": "Koodo Reader",
-    "copyright": "Copyright (c) 2021-2022 ${author}",
-    "files": [
-      "build/**/*",
-      "node_modules/**/*",
-      "package.json",
-      "main.js",
-      "edge-tts.js"
-    ],
-    "directories": {
-      "buildResources": "assets"
-    },
-    "publish": {
-      "provider": "github",
-      "repo": "koodo-reader",
-      "owner": "koodo-reader"
-    },
-    "buildDependenciesFromSource": false,
-    "nodeGypRebuild": false,
-    "fileAssociations": [
-      {
-        "ext": "epub",
-        "icon": "assets/icons/epub",
-        "role": "Viewer",
-        "mimeType": "application/epub+zip"
-      },
-      {
-        "ext": "pdf",
-        "icon": "assets/icons/pdf",
-        "role": "Viewer",
-        "mimeType": "application/pdf"
-      },
-      {
-        "ext": "mobi",
-        "icon": "assets/icons/mobi",
-        "role": "Viewer",
-        "mimeType": "application/x-mobipocket-ebook"
-      },
-      {
-        "ext": "azw3",
-        "icon": "assets/icons/azw3",
-        "role": "Viewer",
-        "mimeType": "application/vnd.amazon.ebook"
-      },
-      {
-        "ext": "azw",
-        "icon": "assets/icons/azw3",
-        "role": "Viewer",
-        "mimeType": "application/vnd.amazon.ebook"
-      },
-      {
-        "ext": "cbz",
-        "icon": "assets/icons/comic",
-        "role": "Viewer",
-        "mimeType": "application/x-cbz"
-      },
-      {
-        "ext": "cbr",
-        "icon": "assets/icons/comic",
-        "role": "Viewer",
-        "mimeType": "application/x-cbr"
-      },
-      {
-        "ext": "cbt",
-        "icon": "assets/icons/comic",
-        "role": "Viewer",
-        "mimeType": "application/x-cbt"
-      },
-      {
-        "ext": "cb7",
-        "icon": "assets/icons/comic",
-        "role": "Viewer",
-        "mimeType": "application/x-cb7"
-      },
-      {
-        "ext": "fb2",
-        "icon": "assets/icons/fb2",
-        "role": "Viewer",
-        "mimeType": "application/x-fictionbook+xml"
-      }
-    ],
-    "extends": null,
-    "dmg": {
-      "contents": [
-        {
-          "x": 410,
-          "y": 150,
-          "type": "link",
-          "path": "/Applications"
-        },
-        {
-          "x": 130,
-          "y": 150,
-          "type": "file"
-        }
-      ]
-    },
-    "mac": {
-      "target": [
-        {
-          "target": "dmg",
-          "arch": [
-            "x64",
-            "arm64"
-          ]
-        }
-      ],
-      "icon": "assets/icons/icon.icns",
-      "category": "public.app-category.productivity",
-      "artifactName": "${productName}-${version}-${arch}.${ext}"
-    },
-    "win": {
-      "target": [
-        {
-          "target": "nsis",
-          "arch": [
-            "x64"
-          ]
-        },
-        {
-          "target": "zip",
-          "arch": [
-            "x64",
-            "ia32",
-            "arm64"
-          ]
-        },
-        {
-          "target": "portable",
-          "arch": [
-            "x64"
-          ]
-        }
-      ],
-      "icon": "assets/icons/icon.ico",
-      "artifactName": "${productName}-${version}-${arch}-Win.${ext}",
-      "publisherName": "App by Troye"
-    },
-    "linux": {
-      "icon": "assets/icons",
-      "category": "Office",
-      "target": [
-        {
-          "target": "snap",
-          "arch": [
-            "x64"
-          ]
-        },
-        {
-          "target": "deb",
-          "arch": [
-            "arm64",
-            "ia32",
-            "x64"
-          ]
-        },
-        {
-          "target": "rpm",
-          "arch": [
-            "x64"
-          ]
-        },
-        {
-          "target": "AppImage",
-          "arch": [
-            "arm64",
-            "ia32",
-            "x64"
-          ]
-        }
-      ],
-      "artifactName": "${productName}-${version}-${arch}.${ext}"
-    },
-    "portable": {
-      "artifactName": "${productName}-${version}-Portable.${ext}"
-    },
-    "nsis": {
-      "artifactName": "${productName}-${version}.${ext}",
-      "oneClick": false,
-      "allowToChangeInstallationDirectory": true,
-      "include": "assets/windows/installer.nsh"
-    },
-    "snap": {
-      "publish": [
-        {
-          "provider": "github"
-        }
-      ]
-    }
-  },
-  "eslintConfig": {
-    "extends": "react-app"
-  },
-  "browserslist": {
-    "production": [
-      ">0.2%",
-      "not dead",
-      "not op_mini all"
-    ],
-    "development": [
-      "last 1 chrome version",
-      "last 1 firefox version",
-      "last 1 safari version"
-    ]
-  },
-  "babel": {
-    "presets": [
-      "react-app"
-    ],
-    "plugins": [
-      [
-        "react-hot-loader/babel"
-      ]
-    ]
-  }
-}
diff --git a/pkgs/by-name/ko/koodo-reader/package.nix b/pkgs/by-name/ko/koodo-reader/package.nix
index 5a53af807eea..9fa8ce626b9a 100644
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@@ -1,10 +1,11 @@
 {
   lib,
   stdenv,
-  mkYarnPackage,
   fetchFromGitHub,
-  applyPatches,
   fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  nodejs,
   makeDesktopItem,
   copyDesktopItems,
   makeWrapper,
@@ -15,31 +16,28 @@
 let
   electronDist = electron + (if stdenv.isDarwin then "/Applications" else "/libexec/electron");
 in
-mkYarnPackage rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "koodo-reader";
-  version = "1.6.6";
+  version = "1.6.7";
 
-  src = applyPatches {
-    src = fetchFromGitHub {
-      owner = "troyeguo";
-      repo = "koodo-reader";
-      rev = "v${version}";
-      hash = "sha256-g2bVm8LFeEIPaWlaxzMI0SrpM+79zQFzJ7Vs5CbWBT4=";
-    };
-    patches = [ ./update-react-i18next.patch ]; # Could be upstreamed
+  src = fetchFromGitHub {
+    owner = "troyeguo";
+    repo = "koodo-reader";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ZHRU8dJjKQFLIB1t2VK/COy6a3nShUeWR8iAM9YJdto=";
   };
 
-  # should be copied from `koodo-reader.src`
-  packageJSON = ./package.json;
-
   offlineCache = fetchYarnDeps {
-    yarnLock = "${src}/yarn.lock";
-    hash = "sha256-VvYkotVb74zR9+/IWiQwOX/6RJf+xukpi7okRovfVzc=";
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-58mxYt2wD6SGzhvo9c44CPmdX+/tLnbJCMPafo4txbY=";
   };
 
   nativeBuildInputs =
     [
       makeWrapper
+      yarnConfigHook
+      yarnBuildHook
+      nodejs
     ]
     ++ lib.optionals (!stdenv.isDarwin) [
       copyDesktopItems
@@ -53,28 +51,12 @@ mkYarnPackage rec {
   # disable code signing on Darwin
   env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
 
-  configurePhase = ''
-    runHook preConfigure
-
-    cp -r $node_modules node_modules
-    chmod +w node_modules
-
-    runHook postConfigure
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    export HOME=$(mktemp -d)
-    yarn --offline build
-
+  postBuild = ''
     cp -r ${electronDist} electron-dist
     chmod -R u+w electron-dist
     yarn --offline run electron-builder --dir \
       -c.electronDist=electron-dist \
       -c.electronVersion=${electron.version}
-
-    runHook postBuild
   '';
 
   installPhase = ''
@@ -107,15 +89,13 @@ mkYarnPackage rec {
       --inherit-argv0
   '';
 
-  doDist = false;
-
   desktopItems = [
     (makeDesktopItem {
       name = "koodo-reader";
       desktopName = "Koodo Reader";
       exec = "koodo-reader %U";
       icon = "koodo-reader";
-      comment = meta.description;
+      comment = finalAttrs.meta.description;
       categories = [ "Office" ];
       mimeTypes = [
         "application/epub+zip"
@@ -136,7 +116,7 @@ mkYarnPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/troyeguo/koodo-reader/releases/tag/v${version}";
+    changelog = "https://github.com/troyeguo/koodo-reader/releases/tag/v${finalAttrs.version}";
     description = "A cross-platform ebook reader";
     longDescription = ''
       A modern ebook manager and reader with sync and backup capacities
@@ -148,4 +128,4 @@ mkYarnPackage rec {
     maintainers = with lib.maintainers; [ tomasajt ];
     platforms = electron.meta.platforms;
   };
-}
+})
diff --git a/pkgs/by-name/ko/koodo-reader/update-react-i18next.patch b/pkgs/by-name/ko/koodo-reader/update-react-i18next.patch
deleted file mode 100644
index 6d71460ee38d..000000000000
--- a/pkgs/by-name/ko/koodo-reader/update-react-i18next.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-diff --git a/package.json b/package.json
-index c71b04a1..a4b4b3ef 100644
---- a/package.json
-+++ b/package.json
-@@ -67,7 +67,7 @@
-     "react-device-detect": "^1.12.1",
-     "react-dom": "^17.0.2",
-     "react-dropzone": "^11.3.0",
--    "react-i18next": "^11.8.15",
-+    "react-i18next": "^13.2.2",
-     "react-lottie": "^1.2.3",
-     "react-redux": "^7.2.0",
-     "react-router-dom": "^5.2.0",
-diff --git a/yarn.lock b/yarn.lock
-index 881db5b2..2df4d362 100644
---- a/yarn.lock
-+++ b/yarn.lock
-@@ -1828,7 +1828,7 @@
-   resolved "https://registry.yarnpkg.com/@babel/regjsgen/-/regjsgen-0.8.0.tgz#f0ba69b075e1f05fb2825b7fad991e7adbb18310"
-   integrity sha512-x/rqGMdzj+fWZvCOYForTghzbtqPDZ5gPwaoNGHdgDfF2QA/XZbCBp4Moo5scrkAMPhB7z26XM/AaHuIJdgauA==
- 
--"@babel/runtime@^7.1.2", "@babel/runtime@^7.12.0", "@babel/runtime@^7.12.13", "@babel/runtime@^7.12.5", "@babel/runtime@^7.14.5", "@babel/runtime@^7.15.4", "@babel/runtime@^7.16.3", "@babel/runtime@^7.20.6", "@babel/runtime@^7.20.7", "@babel/runtime@^7.8.4", "@babel/runtime@^7.9.2":
-+"@babel/runtime@^7.1.2", "@babel/runtime@^7.12.0", "@babel/runtime@^7.12.13", "@babel/runtime@^7.12.5", "@babel/runtime@^7.15.4", "@babel/runtime@^7.16.3", "@babel/runtime@^7.20.6", "@babel/runtime@^7.20.7", "@babel/runtime@^7.8.4", "@babel/runtime@^7.9.2":
-   version "7.21.0"
-   resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.21.0.tgz#5b55c9d394e5fcf304909a8b00c07dc217b56673"
-   integrity sha512-xwII0//EObnq89Ji5AKYQaRYiW/nZ3llSv29d49IuxPhKbtJoLP+9QUUZ4nVragQVtaVGeZrpB+ZtG/Pdy/POw==
-@@ -1842,6 +1842,13 @@
-   dependencies:
-     regenerator-runtime "^0.14.0"
- 
-+"@babel/runtime@^7.22.5":
-+  version "7.23.1"
-+  resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.23.1.tgz#72741dc4d413338a91dcb044a86f3c0bc402646d"
-+  integrity sha512-hC2v6p8ZSI/W0HUzh3V8C5g+NwSKzKPtJwSpTjwl0o297GP9+ZLQSkdvHz46CM3LqyoXxq+5G9komY+eSqSO0g==
-+  dependencies:
-+    regenerator-runtime "^0.14.0"
-+
- "@babel/template@^7.18.10", "@babel/template@^7.20.7", "@babel/template@^7.3.3":
-   version "7.20.7"
-   resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.20.7.tgz#a15090c2839a83b02aa996c0b4994005841fd5a8"
-@@ -10951,12 +10958,12 @@ react-i18next@*:
-     "@babel/runtime" "^7.20.6"
-     html-parse-stringify "^3.0.1"
- 
--react-i18next@^11.8.15:
--  version "11.18.6"
--  resolved "https://registry.yarnpkg.com/react-i18next/-/react-i18next-11.18.6.tgz#e159c2960c718c1314f1e8fcaa282d1c8b167887"
--  integrity sha512-yHb2F9BiT0lqoQDt8loZ5gWP331GwctHz9tYQ8A2EIEUu+CcEdjBLQWli1USG3RdWQt3W+jqQLg/d4rrQR96LA==
-+react-i18next@^13.2.2:
-+  version "13.2.2"
-+  resolved "https://registry.yarnpkg.com/react-i18next/-/react-i18next-13.2.2.tgz#b1e78ed66a54f4bc819616f68b98221e1b1a1936"
-+  integrity sha512-+nFUkbRByFwnrfDcYqvzBuaeZb+nACHx+fAWN/pZMddWOCJH5hoc21+Sa/N/Lqi6ne6/9wC/qRGOoQhJa6IkEQ==
-   dependencies:
--    "@babel/runtime" "^7.14.5"
-+    "@babel/runtime" "^7.22.5"
-     html-parse-stringify "^3.0.1"
- 
- react-is@^16.12.0, react-is@^16.13.1, react-is@^16.6.0, react-is@^16.7.0:
diff --git a/pkgs/by-name/li/listmonk/frontend.nix b/pkgs/by-name/li/listmonk/frontend.nix
index 928092038c12..1584526d4b23 100644
--- a/pkgs/by-name/li/listmonk/frontend.nix
+++ b/pkgs/by-name/li/listmonk/frontend.nix
@@ -1,37 +1,34 @@
-{ mkYarnPackage
+{ stdenv
 , fetchYarnDeps
+, yarnConfigHook
+, yarnBuildHook
+, nodejs
 , meta
 , version
 , src
 }:
 
-mkYarnPackage {
+stdenv.mkDerivation (finalAttrs: {
   pname = "listmonk-frontend";
   inherit version;
 
   src = "${src}/frontend";
-  packageJSON = ./package.json;
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/frontend/yarn.lock";
     hash = "sha256-TdrglyRtb2Q8SFtoiCoDj/zBV2+7DwzIm/Fzlt0ZvSo=";
   };
 
-  configurePhase = ''
-    ln -s $node_modules node_modules
-  '';
-
-  buildPhase = ''
-    yarn --offline build
-  '';
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs
+  ];
 
   installPhase = ''
     mkdir $out
     cp -R dist/* $out
   '';
 
-  doDist = false;
-
-
   inherit meta;
-}
+})
diff --git a/pkgs/by-name/li/listmonk/package.json b/pkgs/by-name/li/listmonk/package.json
deleted file mode 100644
index 25018ef265dd..000000000000
--- a/pkgs/by-name/li/listmonk/package.json
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  "name": "listmonk",
-  "version": "0.1.0",
-  "private": true,
-  "scripts": {
-    "dev": "vite",
-    "build": "vite build",
-    "serve": "vite preview",
-    "lint": "eslint --ext .js,.vue --ignore-path .gitignore src",
-    "prebuild": "eslint --ext .js,.vue --ignore-path .gitignore src"
-  },
-  "dependencies": {
-    "@tinymce/tinymce-vue": "^3",
-    "axios": "^1.6.2",
-    "buefy": "^0.9.25",
-    "bulma": "^0.9.4",
-    "chart.js": "^4.4.1",
-    "codeflask": "^1.4.1",
-    "dayjs": "^1.11.10",
-    "indent.js": "^0.3.5",
-    "qs": "^6.10.1",
-    "textversionjs": "^1.1.3",
-    "tinymce": "^5.10.9",
-    "turndown": "^7.1.2",
-    "vue": "^2.7.14",
-    "vue-chartjs": "^5.3.0",
-    "vue-i18n": "^8.28.2",
-    "vue-router": "^3.2.0",
-    "vuex": "^3.6.2"
-  },
-  "devDependencies": {
-    "@vitejs/plugin-vue2": "^2.3.1",
-    "@vue/eslint-config-airbnb": "^7.0.1",
-    "cypress": "13.6.1",
-    "cypress-file-upload": "^5.0.2",
-    "eslint": "^8.56.0",
-    "eslint-define-config": "^2.0.0",
-    "eslint-plugin-import": "^2.23.3",
-    "eslint-plugin-vue": "^9.19.2",
-    "sass": "^1.34.0",
-    "vite": "^5.0.12",
-    "vue-eslint-parser": "^9.3.2",
-    "vue-template-compiler": "^2.6.12"
-  }
-}
diff --git a/pkgs/applications/networking/browsers/mullvad-browser/default.nix b/pkgs/by-name/mu/mullvad-browser/package.nix
similarity index 98%
rename from pkgs/applications/networking/browsers/mullvad-browser/default.nix
rename to pkgs/by-name/mu/mullvad-browser/package.nix
index edb62c692abe..93853396564c 100644
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -90,7 +90,7 @@ let
       ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "13.5";
+  version = "13.5.1";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -102,7 +102,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-Wz1gYK1CqfK4aa7K2PR8wKx7VcvALquYKA2vetUAdeU=";
+      hash = "sha256-YUITJ7YyK+210ASH1zxlILJ10r0L6SJjbiw2UVASCbw=";
     };
   };
 
@@ -255,7 +255,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     inherit sources;
-    updateScript = callPackage ../tor-browser/update.nix {
+    updateScript = callPackage ./update.nix {
       inherit pname version meta;
       baseUrl = "https://cdn.mullvad.net/browser/";
       name = "mullvad-browser";
diff --git a/pkgs/applications/networking/browsers/tor-browser/update.nix b/pkgs/by-name/mu/mullvad-browser/update.nix
similarity index 100%
rename from pkgs/applications/networking/browsers/tor-browser/update.nix
rename to pkgs/by-name/mu/mullvad-browser/update.nix
diff --git a/pkgs/by-name/nc/nc4nix/package.nix b/pkgs/by-name/nc/nc4nix/package.nix
index 4269d235ea26..0f0850ae8b9c 100644
--- a/pkgs/by-name/nc/nc4nix/package.nix
+++ b/pkgs/by-name/nc/nc4nix/package.nix
@@ -1,28 +1,28 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:
 
 buildGoModule {
   pname = "nc4nix";
-  version = "0-unstable-2024-03-01";
+  version = "0-unstable-2024-05-24";
 
   src = fetchFromGitHub {
     owner = "helsinki-systems";
     repo = "nc4nix";
-    rev = "ba37674c0dddf93e0a011dace92ec7f0ec834765";
-    hash = "sha256-k12eeP2gojLCsJH1GGuiTmxz3ViPc0+oFBuptyh42Bw=";
+    rev = "9d605367d0d952de9d022155e8df28e6793ff104";
+    hash = "sha256-QAtN4fcbsX0e6DIchOjxpHDDmIt7SGiN8riLplqXIYs=";
   };
 
-  vendorHash = "sha256-ZXl4kMDY9ADkHUcLsl3uNpyErMzbgS+J65+uUeIXpSE=";
+  vendorHash = "sha256-qntRsv3KvAbV3lENjAHKkQOqh3uTo3gacfwase489tQ=";
 
-  meta = with lib; {
+  meta = {
     description = "Packaging helper for Nextcloud apps";
     mainProgram = "nc4nix";
     homepage = "https://github.com/helsinki-systems/nc4nix";
-    license = licenses.mit;
-    maintainers = with maintainers; [ onny ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ onny ];
+    platforms = lib.platforms.linux;
   };
 }
-
diff --git a/pkgs/by-name/ni/nix-health/package.nix b/pkgs/by-name/ni/nix-health/package.nix
index bd9c66856ae6..3cb4fc881c7b 100644
--- a/pkgs/by-name/ni/nix-health/package.nix
+++ b/pkgs/by-name/ni/nix-health/package.nix
@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-health";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchCrate {
     inherit version;
     pname = "nix_health";
-    hash = "sha256-u5ipQnux/ulllfPFyUdeLj7gAf3Vu7KL2Q4uYxtv1q4=";
+    hash = "sha256-/I6LdcH61wgJOEv51J1jkWlD8BlSAaRR1e7gc5H9bQI=";
   };
 
-  cargoHash = "sha256-oTO9V+zGmMgDXrt6w1fB81b+WmK3MRI/eCTNEuVM0hk=";
+  cargoHash = "sha256-mqJA5Fv/sYj6ZkE73emtaHvg9hdT/5lN0kM3sl+GRCo=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libiconv openssl ]
diff --git a/pkgs/by-name/nt/ntlm-challenger/package.nix b/pkgs/by-name/nt/ntlm-challenger/package.nix
new file mode 100644
index 000000000000..1e96bda9e470
--- /dev/null
+++ b/pkgs/by-name/nt/ntlm-challenger/package.nix
@@ -0,0 +1,38 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication {
+  pname = "ntlm-challenger";
+  version = "0-unstable-2022-11-10";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "nopfor";
+    repo = "ntlm_challenger";
+    rev = "bd61ef65c7692fb1968383894da662bf99026aec";
+    hash = "sha256-F9aZB8M25gPDY7J7cXkAH30m7zmk4NHczUHyBDBZInA=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    requests
+    impacket
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D ntlm_challenger.py $out/bin/ntlm_challenger
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Parse NTLM challenge messages over HTTP and SMB";
+    mainProgram = "ntlm_challenger";
+    homepage = "https://github.com/nopfor/ntlm_challenger";
+    license = licenses.mit;
+    maintainers = [ maintainers.crem ];
+  };
+}
diff --git a/pkgs/by-name/po/postlight-parser/package.json b/pkgs/by-name/po/postlight-parser/package.json
deleted file mode 100644
index 11b49c9e686e..000000000000
--- a/pkgs/by-name/po/postlight-parser/package.json
+++ /dev/null
@@ -1,165 +0,0 @@
-{
-  "name": "@postlight/parser",
-  "version": "2.2.3",
-  "description": "Postlight Parser transforms web pages into clean text. Publishers and programmers use it to make the web make sense, and readers use it to read any web article comfortably.",
-  "author": "Postlight <mercury@postlight.com>",
-  "homepage": "https://reader.postlight.com",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/postlight/parser.git"
-  },
-  "bugs": {
-    "url": "https://github.com/postlight/parser/issues"
-  },
-  "keywords": [
-    "mercury",
-    "parser",
-    "reader",
-    "web",
-    "content"
-  ],
-  "files": [
-    "dist",
-    "cli.js",
-    "src/shims/"
-  ],
-  "main": "./dist/mercury.js",
-  "bin": {
-    "mercury-parser": "./cli.js",
-    "postlight-parser": "./cli.js"
-  },
-  "scripts": {
-    "lint": "eslint . --fix",
-    "lint:ci": "remark . && eslint .",
-    "lint-fix-quiet": "eslint --fix --quiet",
-    "build": "yarn lint && rollup -c && yarn test:build",
-    "build:ci": "rollup -c && yarn test:build",
-    "build:web": "yarn lint && rollup -c rollup.config.web.js && yarn test:build:web",
-    "build:esm": "yarn lint && rollup -c rollup.config.esm.js && yarn test:build:esm",
-    "build:esm:ci": "rollup -c rollup.config.esm.js && yarn test:build:esm",
-    "build:web:ci": "rollup -c rollup.config.web.js && yarn test:build:web",
-    "release": "yarn build && yarn build:web",
-    "build:generator": "rollup -c scripts/rollup.config.js",
-    "test_build": "rollup -c",
-    "test": "yarn test:node && yarn test:web",
-    "test:node": "jest --json --outputFile test-output.json",
-    "test:web": "node ./node_modules/karma/bin/karma start karma.conf.js --auto-watch",
-    "test:build": "cd ./scripts && jest check-build.test.js",
-    "test:build:web": "node ./scripts/proxy-browser-test.js",
-    "test:build:esm": "node ./scripts/proxy-browser-test.js",
-    "watch:test": "jest --watch",
-    "generate-parser": "node ./dist/generate-custom-parser.js"
-  },
-  "engines": {
-    "node": ">=10"
-  },
-  "devDependencies": {
-    "@babel/core": "^7.0.0",
-    "@babel/plugin-transform-runtime": "^7.0.0",
-    "@babel/polyfill": "^7.0.0",
-    "@babel/preset-env": "^7.0.0",
-    "@babel/runtime": "^7.0.0",
-    "@jesses/circle-github-bot": "^2.1.0",
-    "@octokit/rest": "^16.9.0",
-    "babel-core": "^7.0.0-bridge.0",
-    "babel-eslint": "^10.0.1",
-    "babel-jest": "^23.4.2",
-    "babel-plugin-module-alias": "^1.6.0",
-    "babel-plugin-module-resolver": "^3.1.2",
-    "babelify": "^10.0.0",
-    "babelrc-rollup": "^3.0.0",
-    "brfs": "^2.0.1",
-    "brfs-babel": "^2.0.0",
-    "browserify": "^16.2.3",
-    "changelog-maker": "^2.3.0",
-    "eslint": "^5.12.0",
-    "eslint-config-airbnb": "^17.1.0",
-    "eslint-config-prettier": "^6.1.0",
-    "eslint-import-resolver-babel-module": "^2.2.1",
-    "eslint-plugin-babel": "^5.3.0",
-    "eslint-plugin-import": "^2.14.0",
-    "eslint-plugin-jsx-a11y": "^6.1.2",
-    "eslint-plugin-react": "^7.12.3",
-    "express": "^4.16.4",
-    "husky": "^3.0.0",
-    "inquirer": "^7.0.0",
-    "jasmine-core": "^2.5.2",
-    "jest": "^23.6.0",
-    "jest-cli": "^23.6.0",
-    "karma": "^6.3.16",
-    "karma-browserify": "8.1.0",
-    "karma-chrome-launcher": "^3.0.0",
-    "karma-cli": "^2.0.0",
-    "karma-jasmine": "^1.0.2",
-    "karma-mocha": "^1.3.0",
-    "karma-requirejs": "^1.1.0",
-    "lint-staged": "^8.1.0",
-    "mocha": "^6.0.0",
-    "nock": "^10.0.6",
-    "ora": "^4.0.0",
-    "prettier": "^1.15.3",
-    "remark-cli": "^7.0.0",
-    "remark-lint": "^6.0.4",
-    "remark-preset-lint-recommended": "^3.0.2",
-    "request": "^2.88.2",
-    "requirejs": "^2.3.6",
-    "rollup": "^1.1.0",
-    "rollup-plugin-babel": "^4.0.1",
-    "rollup-plugin-commonjs": "^9.2.0",
-    "rollup-plugin-node-globals": "^1.4.0",
-    "rollup-plugin-node-resolve": "^2.0.0",
-    "rollup-plugin-terser": "^6.1.0",
-    "rollup-plugin-uglify": "^6.0.1",
-    "watchify": "^3.11.1"
-  },
-  "dependencies": {
-    "@babel/runtime-corejs2": "^7.2.0",
-    "@postlight/ci-failed-test-reporter": "^1.0",
-    "browser-request": "github:postlight/browser-request#feat-add-headers-to-response",
-    "cheerio": "^0.22.0",
-    "difflib": "github:postlight/difflib.js",
-    "ellipsize": "0.1.0",
-    "iconv-lite": "0.5.0",
-    "jquery": "^3.5.0",
-    "moment": "^2.23.0",
-    "moment-parseformat": "3.0.0",
-    "moment-timezone": "0.5.37",
-    "postman-request": "^2.88.1-postman.31",
-    "string-direction": "^0.1.2",
-    "turndown": "^7.1.1",
-    "valid-url": "^1.0.9",
-    "wuzzy": "^0.1.4",
-    "yargs-parser": "^15.0.1"
-  },
-  "bundleDependencies": [
-    "jquery",
-    "moment-timezone",
-    "browser-request"
-  ],
-  "browser": {
-    "main": "./dist/mercury.web.js",
-    "cheerio": "./src/shims/cheerio-query",
-    "jquery": "./node_modules/jquery/dist/jquery.min.js",
-    "postman-request": "browser-request",
-    "iconv-lite": "./src/shims/iconv-lite",
-    "moment-timezone": "./node_modules/moment-timezone/builds/moment-timezone-with-data-2012-2022.min.js"
-  },
-  "husky": {
-    "hooks": {
-      "pre-commit": "lint-staged"
-    }
-  },
-  "lint-staged": {
-    "*.js": [
-      "eslint --fix",
-      "prettier --write",
-      "git add"
-    ],
-    "*.{json,css,md}": [
-      "remark .",
-      "prettier --write",
-      "git add"
-    ]
-  }
-}
diff --git a/pkgs/by-name/po/postlight-parser/package.nix b/pkgs/by-name/po/postlight-parser/package.nix
index c00028b9a401..fd0617ede1f2 100644
--- a/pkgs/by-name/po/postlight-parser/package.nix
+++ b/pkgs/by-name/po/postlight-parser/package.nix
@@ -1,36 +1,53 @@
 { lib
 , stdenv
-, mkYarnPackage
 , fetchFromGitHub
 , fetchYarnDeps
+, yarnConfigHook
+, yarnBuildHook
+, nodejs
+, npmHooks
 }:
 
-mkYarnPackage rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "postlight-parser";
   version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "postlight";
     repo = "parser";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-k6m95FHeJ+iiWSeY++1zds/bo1RtNXbnv2spaY/M+L0=";
   };
 
-  packageJSON = ./package.json;
-
-  doDist = false;
-
   offlineCache = fetchYarnDeps {
-    yarnLock = "${src}/yarn.lock";
+    yarnLock = "${finalAttrs.src}/yarn.lock";
     hash = "sha256-Vs8bfkhEbPv33ew//HBeDnpQcyWveByHi1gUsdl2CNI=";
   };
 
-  meta = with lib; {
-    changelog = "https://github.com/postlight/parser/blob/${src.rev}/CHANGELOG.md";
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs
+    npmHooks.npmInstallHook
+  ];
+  # Upstream doesn't include a script in package.json that only builds without
+  # testing, and tests fail because they need to access online websites. Hence
+  # we use the builtin interface of yarnBuildHook to lint, and in `postBuild`
+  # we run the rest of commands needed to create the js files eventually
+  # distributed and wrapped by npmHooks.npmInstallHook
+  yarnBuildScript = "lint";
+  postBuild = ''
+    yarn --offline run rollup -c
+  '';
+  # Tries to download stuff from the internet in this phase.
+  dontNpmPrune = true;
+
+  meta = {
+    changelog = "https://github.com/postlight/parser/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     homepage = "https://reader.postlight.com";
     description = "Extracts the bits that humans care about from any URL you give it";
-    license = licenses.mit;
-    maintainers = with maintainers; [ viraptor ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ viraptor ];
     mainProgram = "postlight-parser";
   };
-}
+})
diff --git a/pkgs/by-name/ps/pshs/package.nix b/pkgs/by-name/ps/pshs/package.nix
new file mode 100644
index 000000000000..a51d8bf90774
--- /dev/null
+++ b/pkgs/by-name/ps/pshs/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  libevent,
+  file,
+  qrencode,
+  openssl,
+  miniupnpc,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pshs";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "projg2";
+    repo = "pshs";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-sfhhxeQa0rmBerfAemuHou0N001Zq5Hh7s7utxLQHOI=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    libevent
+    file
+    qrencode
+    openssl
+    miniupnpc
+  ];
+
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Pretty small HTTP server - a command-line tool to share files";
+    mainProgram = "pshs";
+    homepage = "https://github.com/mgorny/pshs";
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/qo/qodem/package.nix b/pkgs/by-name/qo/qodem/package.nix
new file mode 100644
index 000000000000..3398e9749d08
--- /dev/null
+++ b/pkgs/by-name/qo/qodem/package.nix
@@ -0,0 +1,88 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  fetchpatch2,
+  autoreconfHook,
+  ncurses,
+  SDL,
+  gpm,
+  miniupnpc,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qodem";
+  version = "1.0.1-unstable-2022-02-12";
+
+  src = fetchFromGitLab {
+    owner = "AutumnMeowMeow";
+    repo = "qodem";
+    rev = "69cc7458ef23243f790348a4cc503a8173008e55";
+    hash = "sha256-Ocb2inuxeDOfqge+h7pHL9I9Kn72Mgi8Eq179/58alk=";
+  };
+
+  patches = [
+    # Fix ICH with count>1
+    # https://gitlab.com/AutumnMeowMeow/qodem/-/issues/77
+    (fetchpatch2 {
+      url = "https://gitlab.com/-/project/6684464/uploads/c2ceaef82d483c13ff9ec64424f3c40a/0001-Fix-ICH-with-count-1.patch";
+      hash = "sha256-lCqj4p8onUS4pehQMXS6lbC7JH5dP6sOjDALpasgd2M=";
+    })
+
+    # Don't clear line rendition on partial ED
+    # https://gitlab.com/AutumnMeowMeow/qodem/-/issues/78
+    (fetchpatch2 {
+      url = "https://gitlab.com/-/project/6684464/uploads/462c0b1cf05c3fc2857ce982e62fefcc/0001-Don-t-clear-line-rendition-on-partial-ED.patch";
+      hash = "sha256-lSuxP0tUfGa3BjK3ehpdMi16XaGZrdVvAcM2vnjAme8=";
+    })
+
+    # DECCOLM should clear line rendition attributes
+    # https://gitlab.com/AutumnMeowMeow/qodem/-/issues/78
+    (fetchpatch2 {
+      url = "https://gitlab.com/-/project/6684464/uploads/812bdfdfaee44eed346fcff85f53efbe/0002-DECCOLM-should-clear-line-rendition-attributes.patch";
+      hash = "sha256-XO+h5fpBTLLYC3t4FRCy1uFiMkmSXbre4T2NB/FC3uQ=";
+    })
+
+    # Fix build with miniupnpc 2.2.8
+    ./qodem-fix-miniupnpc-2.2.8.patch
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    ncurses
+    SDL
+    miniupnpc
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform gpm) [
+    gpm
+  ];
+
+  configureFlags = lib.optionals (!(lib.meta.availableOn stdenv.hostPlatform gpm)) [
+    "--disable-gpm"
+  ];
+
+  strictDeps = true;
+
+  enableParallelBuilding = true;
+
+  __structuredAttrs = true;
+
+  meta = {
+    homepage = "https://qodem.sourceforge.net/";
+    description = "Re-implementation of the DOS-era Qmodem serial communications package";
+    longDescription = ''
+      Qodem is a from-scratch clone implementation of the Qmodem
+      communications program made popular in the days when Bulletin Board
+      Systems ruled the night. Qodem emulates the dialing directory and the
+      terminal screen features of Qmodem over both modem and Internet
+      connections.
+    '';
+    changelog = "${finalAttrs.src.meta.homepage}-/blob/${finalAttrs.src.rev}/ChangeLog";
+    maintainers = with lib.maintainers; [ embr ];
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    license = lib.licenses.publicDomain;
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/qo/qodem/qodem-fix-miniupnpc-2.2.8.patch b/pkgs/by-name/qo/qodem/qodem-fix-miniupnpc-2.2.8.patch
new file mode 100644
index 000000000000..ba4335c7ea51
--- /dev/null
+++ b/pkgs/by-name/qo/qodem/qodem-fix-miniupnpc-2.2.8.patch
@@ -0,0 +1,55 @@
+diff --git a/source/netclient.c b/source/netclient.c
+index 6b6f99ec9b...88d4b91077 100644
+--- a/source/netclient.c
++++ b/source/netclient.c
+@@ -496,7 +496,7 @@
+      */
+     device_list = upnpDiscover(2000, NULL, NULL, 0, 0, 2, NULL);
+ #    else
+-#      if (MINIUPNPC_API_VERSION == 17)
++#      if (MINIUPNPC_API_VERSION >= 17)
+     /*
+      * Version 17
+      *
+@@ -516,8 +516,13 @@
+ 
+     if (device_list != NULL) {
+ 
++#if (MINIUPNPC_API_VERSION <= 17) || !defined(MINIUPNPC_API_VERSION)
+         rc = UPNP_GetValidIGD(device_list, &upnp_urls, &upnp_igd_datas,
+                               local_host, sizeof(local_host));
++#else
++        rc = UPNP_GetValidIGD(device_list, &upnp_urls, &upnp_igd_datas,
++                              local_host, sizeof(local_host), NULL, 0);
++#endif
+ 
+         switch (rc) {
+ 
+@@ -525,13 +530,27 @@
+             DLOG(("Found valid IGD : %s\n", upnp_urls.controlURL));
+             break;
+ 
++#if (MINIUPNPC_API_VERSION >= 18)
+         case 2:
++            DLOG(("Found a (reserved?) IGD : %s\n", upnp_urls.controlURL));
++            DLOG(("Trying to continue anyway\n"));
++            break;
++#endif
+ 
++#if (MINIUPNPC_API_VERSION <= 17) || !defined(MINIUPNPC_API_VERSION)
++        case 2:
++#else
++        case 3:
++#endif
+             DLOG(("Found a (not connected?) IGD : %s\n", upnp_urls.controlURL));
+             DLOG(("Trying to continue anyway\n"));
+             break;
+ 
++#if (MINIUPNPC_API_VERSION <= 17) || !defined(MINIUPNPC_API_VERSION)
+         case 3:
++#else
++        case 4:
++#endif
+             DLOG(("UPnP device found. Is it an IGD ? : %s\n",
+                     upnp_urls.controlURL));
+             DLOG(("Trying to continue anyway\n"));
diff --git a/pkgs/by-name/si/simdutf/package.nix b/pkgs/by-name/si/simdutf/package.nix
index 82d2baf04a21..c4d67116fed9 100644
--- a/pkgs/by-name/si/simdutf/package.nix
+++ b/pkgs/by-name/si/simdutf/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "simdutf";
-  version = "5.2.8";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "simdutf";
     repo = "simdutf";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-EFyKefq03fpkrKQoSgfvWAjMwwB5UubQouZZU9Obn3k=";
+    hash = "sha256-SSAErbGE1OThqnef4IzAvsZfLFfM3GhCWmJTWdvjabU=";
   };
 
   # Fix build on darwin
diff --git a/pkgs/by-name/sk/skia/package.nix b/pkgs/by-name/sk/skia/package.nix
new file mode 100644
index 000000000000..d6fb1940efbe
--- /dev/null
+++ b/pkgs/by-name/sk/skia/package.nix
@@ -0,0 +1,143 @@
+{ lib
+, stdenv
+, fetchgit
+, expat
+, fontconfig
+, freetype
+, harfbuzzFull
+, icu
+, gn
+, libGL
+, libjpeg
+, libwebp
+, libX11
+, ninja
+, python3
+, testers
+, vulkan-headers
+, vulkan-memory-allocator
+, xcbuild
+
+, enableVulkan ? !stdenv.isDarwin
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "skia";
+  # Version from https://skia.googlesource.com/skia/+/refs/heads/main/RELEASE_NOTES.md
+  # or https://chromiumdash.appspot.com/releases
+  # plus date of the tip of the corresponding chrome/m$version branch
+  version = "124-unstable-2024-05-22";
+
+  src = fetchgit {
+    url = "https://skia.googlesource.com/skia.git";
+    # Tip of the chrome/m$version branch
+    rev = "a747f7ea37db6ea3871816dbaf2eb41b5776c826";
+    hash = "sha256-zHfv4OZK/nVJc2rl+dBSCc4f6qndpAKcFZtThw06+LY=";
+  };
+
+  postPatch = ''
+    # System zlib detection bug workaround
+    substituteInPlace BUILD.gn \
+      --replace-fail 'deps = [ "//third_party/zlib" ]' 'deps = []'
+  '';
+
+  nativeBuildInputs = [
+    gn
+    ninja
+    python3
+  ] ++ lib.optional stdenv.isDarwin xcbuild;
+
+  buildInputs = [
+    expat
+    fontconfig
+    freetype
+    harfbuzzFull
+    icu
+    libGL
+    libjpeg
+    libwebp
+    libX11
+  ] ++ lib.optionals enableVulkan [
+    vulkan-headers
+    vulkan-memory-allocator
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+    gn gen build --args='${toString ([
+      # Build in release mode
+      "is_official_build=true"
+      "is_component_build=true"
+      # Don't use missing tools
+      "skia_use_dng_sdk=false"
+      "skia_use_wuffs=false"
+      # Use system dependencies
+      "extra_cflags=[\"-I${harfbuzzFull.dev}/include/harfbuzz\"]"
+    ] ++ map (lib: "skia_use_system_${lib}=true") [
+      "zlib"
+      "harfbuzz"
+      "libpng"
+      "libwebp"
+    ] ++ lib.optionals enableVulkan [
+      "skia_use_vulkan=true"
+    ])}'
+    cd build
+    runHook postConfigure
+  '';
+
+  # Somewhat arbitrary, but similar to what other distros are doing
+  installPhase = ''
+    runHook preInstall
+
+    # Libraries
+    mkdir -p $out/lib
+    cp *.so *.a $out/lib
+
+    # Includes
+    pushd ../include
+    find . -name '*.h' -exec install -Dm644 {} $out/include/skia/{} \;
+    popd
+    pushd ../modules
+    find . -name '*.h' -exec install -Dm644 {} $out/include/skia/modules/{} \;
+    popd
+
+    # Pkg-config
+    mkdir -p $out/lib/pkgconfig
+    cat > $out/lib/pkgconfig/skia.pc <<'EOF'
+    prefix=${placeholder "out"}
+    exec_prefix=''${prefix}
+    libdir=''${prefix}/lib
+    includedir=''${prefix}/include/skia
+    Name: skia
+    Description: 2D graphic library for drawing text, geometries and images.
+    URL: https://skia.org/
+    Version: ${lib.versions.major finalAttrs.version}
+    Libs: -L''${libdir} -lskia
+    Cflags: -I''${includedir}
+    EOF
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    # Some skia includes are assumed to be under an include sub directory by
+    # other includes
+    for file in $(grep -rl '#include "include/' $out/include); do
+      substituteInPlace "$file" \
+        --replace-fail '#include "include/' '#include "'
+    done
+  '';
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = {
+    description = "2D graphic library for drawing text, geometries and images";
+    homepage = "https://skia.org/";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = lib.platforms.all;
+    pkgConfigModules = [ "skia" ];
+    # https://github.com/NixOS/nixpkgs/pull/325871#issuecomment-2220610016
+    broken = stdenv.isDarwin;
+  };
+})
diff --git a/pkgs/by-name/sp/spectral-language-server/package.json b/pkgs/by-name/sp/spectral-language-server/package.json
deleted file mode 100644
index 1f3651349c62..000000000000
--- a/pkgs/by-name/sp/spectral-language-server/package.json
+++ /dev/null
@@ -1,159 +0,0 @@
-{
-  "activationEvents": [
-    "onStartupFinished"
-  ],
-  "author": "Stoplight <support@stoplight.io>",
-  "bugs": {
-    "url": "https://github.com/stoplightio/vscode-spectral/issues"
-  },
-  "categories": [
-    "Linters"
-  ],
-  "contributes": {
-    "configuration": {
-      "properties": {
-        "spectral.enable": {
-          "default": true,
-          "description": "Controls whether or not Spectral is enabled.",
-          "scope": "resource",
-          "type": "boolean"
-        },
-        "spectral.rulesetFile": {
-          "description": "Location of the ruleset file to use when validating. If omitted, the default is a .spectral.yml/.spectral.json in the same folder as the document being validated. Paths are relative to the workspace. This can also be a remote HTTP url.",
-          "scope": "resource",
-          "type": "string"
-        },
-        "spectral.run": {
-          "default": "onType",
-          "description": "Run the linter on save (onSave) or as you type (onType).",
-          "enum": [
-            "onSave",
-            "onType"
-          ],
-          "scope": "resource",
-          "type": "string"
-        },
-        "spectral.trace.server": {
-          "default": "off",
-          "description": "Traces the communication between VS Code and the language server.",
-          "enum": [
-            "off",
-            "messages",
-            "verbose"
-          ],
-          "scope": "window",
-          "type": "string"
-        },
-        "spectral.validateFiles": {
-          "description": "An array of file globs (e.g., `**/*.yaml`) in minimatch glob format which should be validated by Spectral. If language identifiers are also specified, the file must match both in order to be validated. You can also use negative file globs (e.g., `!**/package.json`) here to exclude files.",
-          "items": {
-            "type": "string"
-          },
-          "scope": "resource",
-          "type": "array"
-        },
-        "spectral.validateLanguages": {
-          "default": [
-            "json",
-            "yaml"
-          ],
-          "description": "An array of language IDs which should be validated by Spectral. If file globs are also specified, the file must match both in order to be validated.",
-          "items": {
-            "type": "string"
-          },
-          "scope": "resource",
-          "type": "array"
-        }
-      },
-      "title": "Spectral",
-      "type": "object"
-    },
-    "commands": [
-      {
-        "title": "Show Output Channel",
-        "category": "Spectral",
-        "command": "spectral.showOutputChannel"
-      }
-    ]
-  },
-  "description": "JSON/YAML linter with OpenAPI and custom ruleset support.",
-  "devDependencies": {
-    "@types/chai": "^4.3.1",
-    "@types/chai-jest-snapshot": "^1.3.6",
-    "@types/glob": "^7.2.0",
-    "@types/mocha": "^9.1.0",
-    "@types/node": "^18.11.18",
-    "@types/vscode": "^1.48.0",
-    "@typescript-eslint/eslint-plugin": "^4.33.0",
-    "@typescript-eslint/parser": "^4.1.0",
-    "chai": "^4.2.0",
-    "chai-jest-snapshot": "^2.0.0",
-    "copyfiles": "^2.4.1",
-    "cross-env": "^7.0.3",
-    "eslint": "^7.8.1",
-    "eslint-config-google": "^0.14.0",
-    "glob": "^8.0.3",
-    "http-test-servers": "^2.0.0",
-    "merge-options": "^3.0.0",
-    "mocha": "^8.1.3",
-    "rimraf": "^3.0.2",
-    "semver": "^7.3.2",
-    "shelljs": "^0.8.5",
-    "ts-loader": "^9.2.8",
-    "ts-node": "^8.10.2",
-    "typescript": "beta",
-    "vsce": "^1.103.1",
-    "vscode-test": "^1.5.0",
-    "webpack": "^5.72.0",
-    "webpack-cli": "^4.9.2"
-  },
-  "displayName": "Spectral",
-  "engines": {
-    "vscode": "^1.48.0",
-    "node": "^12.20 || >= 14.13"
-  },
-  "homepage": "https://github.com/stoplightio/vscode-spectral",
-  "icon": "icon.png",
-  "keywords": [
-    "linter",
-    "validator",
-    "OpenAPI",
-    "Swagger",
-    "API",
-    "style guide",
-    "API description",
-    "API specification",
-    "OAS",
-    "OAS2",
-    "OAS3",
-    "AsyncAPI",
-    "json",
-    "yaml"
-  ],
-  "license": "Apache-2.0",
-  "main": "./client/index.js",
-  "name": "spectral",
-  "private": true,
-  "publisher": "stoplight",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/stoplightio/vscode-spectral"
-  },
-  "scripts": {
-    "clean": "rimraf dist && rimraf \"{server,client}/dist\"",
-    "lint": "eslint --ext .ts,.js .",
-    "test": "mocha -r ts-node/register \"./+(client|server)/__tests__/unit/**/*.test.ts\"",
-    "test:e2e": "cross-env CI=true CHAI_JEST_SNAPSHOT_UPDATE_ALL=false ts-node ./client/src/__tests__/e2e/index.ts"
-  },
-  "version": "1.1.2",
-  "workspaces": {
-    "packages": [
-      "client",
-      "server"
-    ],
-    "nohoist": [
-      "client/**",
-      "server/**"
-    ]
-  }
-}
diff --git a/pkgs/by-name/sp/spectral-language-server/package.nix b/pkgs/by-name/sp/spectral-language-server/package.nix
index 8193ff3acebd..9c895e171f7a 100644
--- a/pkgs/by-name/sp/spectral-language-server/package.nix
+++ b/pkgs/by-name/sp/spectral-language-server/package.nix
@@ -1,7 +1,10 @@
 { lib
 , buildNpmPackage
-, mkYarnPackage
+, stdenv
 , fetchYarnDeps
+, yarnConfigHook
+, yarnBuildHook
+, nodejs
 , fetchFromGitHub
 , typescript
 , jq
@@ -10,33 +13,29 @@
 let
   # Instead of the build script that spectral-language-server provides (ref: https://github.com/luizcorreia/spectral-language-server/blob/master/script/vscode-spectral-build.sh), we build vscode-spectral manually.
   # This is because the script must go through the network and will not work under the Nix sandbox environment.
-  vscodeSpectral = mkYarnPackage rec {
+  vscodeSpectral = stdenv.mkDerivation (finalAttrs: {
     pname = "vscode-spectral";
     version = "1.1.2";
 
     src = fetchFromGitHub {
       owner = "stoplightio";
       repo = "vscode-spectral";
-      rev = "v${version}";
+      rev = "v${finalAttrs.version}";
       hash = "sha256-TWy+bC6qhTKDY874ORTBbvCIH8ycpmBiU8GLYxBIiAs=";
     };
 
-    packageJSON = ./package.json;
-
     offlineCache = fetchYarnDeps {
-      yarnLock = src + "/yarn.lock";
+      yarnLock = finalAttrs.src + "/yarn.lock";
       hash = "sha256-am27A9VyFoXuOlgG9mnvNqV3Q7Bi7GJzDqqVFGDVWIA=";
     };
 
-    nativeBuildInputs = [ typescript jq ];
+    nativeBuildInputs = [ typescript jq yarnConfigHook ];
 
     postPatch = ''
       cp server/tsconfig.json server/tsconfig.json.bak
       jq '.compilerOptions += {"module": "NodeNext", "moduleResolution": "NodeNext"}' server/tsconfig.json.bak > server/tsconfig.json
     '';
 
-    dontConfigure = true;
-
     buildPhase = ''
       runHook preBuild
       # FIXME: vscode-spactral depends on @rollup/pluginutils, but it may have a bug that doesn't provide the type definitions for NodeNext module resolution. (ref: https://github.com/rollup/plugins/issues/1192)
@@ -53,14 +52,12 @@ let
       runHook postInstall
     '';
 
-    doDist = false;
-
     meta = with lib; {
       homepage = "https://github.com/stoplightio/vscode-spectral";
       description = "VS Code extension bringing the awesome Spectral JSON/YAML linter with OpenAPI/AsyncAPI support";
       license = licenses.asl20;
     };
-  };
+  });
 in
 buildNpmPackage rec {
   pname = "spectral-language-server";
diff --git a/pkgs/by-name/ti/tika/package.nix b/pkgs/by-name/ti/tika/package.nix
new file mode 100644
index 000000000000..932cb99a945f
--- /dev/null
+++ b/pkgs/by-name/ti/tika/package.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  stdenv,
+  maven,
+  jdk8,
+  fetchFromGitHub,
+  makeWrapper,
+  mvnDepsHash ? null,
+}:
+
+let
+  maven' = maven.override { jdk = jdk8; };
+
+  mvnDepsHashes = {
+    "x86_64-linux" = "sha256-M8O1EJtlTm+mVy/qxapRcBWxD14eYL/LLUxP2uOBoM4=";
+    "aarch64-linux" = "sha256-+ewdV9g0MfgiBiRAimkIZp9lrOTKnKnBB1LqhIlOSaQ=";
+    "x86_64-darwin" = "sha256-nUAy2+O8REuq6pOWb8d+/c/YxPxj+XwtCtkaxfihDzc=";
+    "aarch64-darwin" = "sha256-D6adBXtBH1IokUwwA2Z6m+6rJP2xg6BK4rcPyDSgo6o=";
+  };
+
+  knownMvnDepsHash =
+    mvnDepsHashes.${stdenv.system}
+      or (lib.warn "This platform doesn't have a default mvnDepsHash value, you'll need to specify it manually" lib.fakeHash);
+in
+maven'.buildMavenPackage rec {
+  pname = "tika";
+  version = "2.9.2";
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "tika";
+    rev = version;
+    hash = "sha256-4pSQcLDKgIcU+YypJ/ywdthi6tI1852fGVOCREzUFH0=";
+  };
+
+  buildOffline = true;
+
+  manualMvnArtifacts = [
+    "org.objenesis:objenesis:2.1"
+    "org.apache.apache.resources:apache-jar-resource-bundle:1.5"
+    "org.apache.maven.surefire:surefire-junit-platform:3.1.2"
+    "org.junit.platform:junit-platform-launcher:1.10.0"
+  ];
+
+  mvnHash = if mvnDepsHash != null then mvnDepsHash else knownMvnDepsHash;
+
+  mvnParameters = toString [
+    "-DskipTests=true" # skip tests (out of memory execptions)
+    "-Dossindex.skip" # skip dependency with vulnerability (recommended by upstream)
+  ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # Note: using * instead of version would match multiple files
+    install -Dm644 tika-app/target/tika-app-${version}.jar $out/share/tika/tika-app.jar
+    install -Dm644 tika-server/tika-server-standard/target/tika-server-standard-${version}.jar $out/share/tika/tika-server.jar
+
+    makeWrapper ${jdk8.jre}/bin/java $out/bin/tika-app \
+        --add-flags "-jar $out/share/tika/tika-app.jar"
+    makeWrapper ${jdk8.jre}/bin/java $out/bin/tika-server \
+        --prefix PATH : ${lib.makeBinPath [ jdk8.jre ]} \
+        --add-flags "-jar $out/share/tika/tika-server.jar"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/apache/tika/blob/${src.rev}/CHANGES.txt";
+    description = "A toolkit for extracting metadata and text from over a thousand different file types";
+    longDescription = ''
+      The Apache Tika™ toolkit detects and extracts metadata and text
+      from over a thousand different file types (such as PPT, XLS, and PDF).
+      All of these file types can be parsed through a single interface,
+      making Tika useful for search engine indexing, content analysis,
+      translation, and much more.
+    '';
+    homepage = "https://tika.apache.org";
+    license = lib.licenses.asl20;
+    mainProgram = "tika-server";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode # maven dependencies
+    ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/tor-browser/default.nix b/pkgs/by-name/to/tor-browser/package.nix
similarity index 98%
rename from pkgs/applications/networking/browsers/tor-browser/default.nix
rename to pkgs/by-name/to/tor-browser/package.nix
index 12b0c63b6afe..62c523afd539 100644
--- a/pkgs/applications/networking/browsers/tor-browser/default.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -101,7 +101,7 @@ lib.warnIf (useHardenedMalloc != null)
       ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "13.5";
+  version = "13.5.1";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -111,7 +111,7 @@ lib.warnIf (useHardenedMalloc != null)
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-npqrGyCwqMeZ8JssR/EpvDClkLQ3K0xEfE19fHn+GDs=";
+      hash = "sha256-1TxxLWjNd63UxiCqTWjqa5upreOrhX4MaMDwPEEIyoo=";
     };
 
     i686-linux = fetchurl {
@@ -121,7 +121,7 @@ lib.warnIf (useHardenedMalloc != null)
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-qeXLBFhcCPDWRuCZiLL1wOY6BRWsk0h36jWe5U6eCJ8=";
+      hash = "sha256-x1Eo1fF/J79r5ZCq5JkVu38CZk5MTOiHh4Yhmji8oOc=";
     };
   };
 
diff --git a/pkgs/by-name/to/tor-browser/update.nix b/pkgs/by-name/to/tor-browser/update.nix
new file mode 100644
index 000000000000..04b69d8ce208
--- /dev/null
+++ b/pkgs/by-name/to/tor-browser/update.nix
@@ -0,0 +1,64 @@
+{ lib
+, writeShellScript
+, coreutils
+, gnused
+, gnugrep
+, curl
+, gnupg
+, nix
+, common-updater-scripts
+
+# options
+, pname
+, version
+, meta
+, baseUrl ? "https://dist.torproject.org/torbrowser/"
+# name used to match published archive
+, name ? "tor-browser"
+, prerelease ? false
+}:
+
+let
+  versionMatch = if prerelease
+    then ''[0-9]+(\.[0-9]+)*.*''
+    else ''[0-9]+(\.[0-9]+)*'';
+in writeShellScript "update-${pname}" ''
+  PATH="${lib.makeBinPath [ coreutils curl gnugrep gnused gnupg nix common-updater-scripts ]}"
+  set -euo pipefail
+
+  trap
+
+  url=${baseUrl}
+  version=$(curl -s $url \
+            | sed -rne 's,^.*href="(${versionMatch})/".*,\1,p' \
+            | sort --version-sort | tail -1)
+
+  if [[ "${version}" = "$version" ]]; then
+      echo "The new version same as the old version."
+      exit 0
+  fi
+
+  HOME=$(mktemp -d)
+  export GNUPGHOME=$(mktemp -d)
+  trap 'rm -rf "$HOME" "$GNUPGHOME"' EXIT
+
+  gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
+  gpg --output $HOME/tor.keyring --export 0xEF6E286DDA85EA2A4BA7DE684E2C6E8793298290
+
+  curl --silent --show-error --fail -o $HOME/shasums "$url$version/sha256sums-signed-build.txt"
+  curl --silent --show-error --fail -o $HOME/shasums.asc "$url$version/sha256sums-signed-build.txt.asc"
+  gpgv --keyring=$HOME/tor.keyring $HOME/shasums.asc $HOME/shasums
+
+  declare -A platforms=(
+    ['x86_64-linux']='linux-x86_64'
+    ['i686-linux']='linux-i686'
+  )
+
+  for platform in ${lib.escapeShellArgs meta.platforms}; do
+    arch="''${platforms[$platform]}"
+    sha256=$(grep "${name}-$arch-$version.tar.xz" "$HOME/shasums" | cut -d" " -f1)
+    hash=$(nix hash to-sri --type sha256 "$sha256")
+
+    update-source-version "${pname}" "$version" "$hash" --ignore-same-version --source-key="sources.$platform"
+  done
+''
diff --git a/pkgs/by-name/tr/transmission_3/package.nix b/pkgs/by-name/tr/transmission_3/package.nix
index 3b5c4d30d2f8..32f9b92079a7 100644
--- a/pkgs/by-name/tr/transmission_3/package.nix
+++ b/pkgs/by-name/tr/transmission_3/package.nix
@@ -47,6 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # fix build with openssl 3.0
     ./transmission-3.00-openssl-3.patch
+    # fix build with miniupnpc 2.2.8
+    ./transmission-3.00-miniupnpc-2.2.8.patch
   ];
 
   outputs = [ "out" "apparmor" ];
diff --git a/pkgs/by-name/tr/transmission_3/transmission-3.00-miniupnpc-2.2.8.patch b/pkgs/by-name/tr/transmission_3/transmission-3.00-miniupnpc-2.2.8.patch
new file mode 100644
index 000000000000..66de8f9bf510
--- /dev/null
+++ b/pkgs/by-name/tr/transmission_3/transmission-3.00-miniupnpc-2.2.8.patch
@@ -0,0 +1,18 @@
+diff --git a/libtransmission/upnp.c b/libtransmission/upnp.c
+index c9e248a379...c7b2580bcb 100644
+--- a/libtransmission/upnp.c
++++ b/libtransmission/upnp.c
+@@ -194,8 +194,13 @@
+ 
+         errno = 0;
+ 
++#if (MINIUPNPC_API_VERSION >= 18)
+         if (UPNP_GetValidIGD(devlist, &handle->urls, &handle->data, handle->lanaddr,
++            sizeof(handle->lanaddr), NULL, 0) == UPNP_IGD_VALID_CONNECTED)
++#else
++        if (UPNP_GetValidIGD(devlist, &handle->urls, &handle->data, handle->lanaddr,
+             sizeof(handle->lanaddr)) == UPNP_IGD_VALID_CONNECTED)
++#endif
+         {
+             tr_logAddNamedInfo(getKey(), _("Found Internet Gateway Device \"%s\""), handle->urls.controlURL);
+             tr_logAddNamedInfo(getKey(), _("Local Address is \"%s\""), handle->lanaddr);
diff --git a/pkgs/by-name/tr/treedome/package.json b/pkgs/by-name/tr/treedome/package.json
deleted file mode 100644
index bc56e53d0266..000000000000
--- a/pkgs/by-name/tr/treedome/package.json
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  "name": "treedome",
-  "private": true,
-  "version": "0.0.0",
-  "type": "module",
-  "scripts": {
-    "dev": "vite",
-    "build": "tsc && vite build",
-    "preview": "vite preview",
-    "tauri": "tauri",
-    "clean": "rm -rf node_modules",
-    "prettier-format": "prettier --config .prettierrc 'src/**/*.ts*' --write"
-  },
-  "dependencies": {
-    "@column-resizer/react": "^1.3.0",
-    "@emotion/react": "^11.11.1",
-    "@emotion/styled": "^11.11.0",
-    "@fontsource/noto-sans": "^5.0.8",
-    "@fontsource/noto-sans-mono": "^5.0.8",
-    "@leeoniya/ufuzzy": "^1.0.8",
-    "@mantine/core": "^7.5.0",
-    "@mantine/form": "^7.5.0",
-    "@mantine/hooks": "^7.5.0",
-    "@mantine/modals": "^7.5.0",
-    "@mantine/notifications": "^7.5.0",
-    "@mantine/spotlight": "^7.5.0",
-    "@mantine/tiptap": "^7.5.0",
-    "@minoru/react-dnd-treeview": "^3.4.4",
-    "@mui/icons-material": "^5.14.0",
-    "@mui/material": "^5.14.0",
-    "@tabler/icons-react": "^2.28.0",
-    "@tauri-apps/api": "^1.4.0",
-    "@tiptap/extension-code-block-lowlight": "^2.0.4",
-    "@tiptap/extension-highlight": "^2.0.4",
-    "@tiptap/extension-image": "^2.0.4",
-    "@tiptap/extension-link": "^2.0.4",
-    "@tiptap/extension-placeholder": "^2.0.4",
-    "@tiptap/extension-subscript": "^2.0.4",
-    "@tiptap/extension-superscript": "^2.0.4",
-    "@tiptap/extension-text-align": "^2.0.4",
-    "@tiptap/extension-typography": "^2.2.3",
-    "@tiptap/extension-underline": "^2.0.4",
-    "@tiptap/pm": "^2.0.4",
-    "@tiptap/react": "^2.0.4",
-    "@tiptap/starter-kit": "^2.0.4",
-    "@types/lodash": "^4.14.195",
-    "fuse.js": "^7.0.0",
-    "jotai": "^2.2.2",
-    "lodash": "^4.17.21",
-    "lowlight": "^2.9.0",
-    "rc-tree": "^5.7.8",
-    "react": "^18.2.0",
-    "react-dnd": "^16.0.1",
-    "react-dom": "^18.2.0",
-    "react-idle-timer": "^5.7.2",
-    "wouter": "^2.11.0"
-  },
-  "devDependencies": {
-    "@tauri-apps/cli": "^1.4.0",
-    "@types/node": "^20.4.4",
-    "@types/react": "^18.2.15",
-    "@types/react-dom": "^18.2.19",
-    "@vitejs/plugin-react": "^4.0.3",
-    "prettier": "^3.0.0",
-    "typescript": "^5.1.6",
-    "vite": "^4.4.6"
-  }
-}
diff --git a/pkgs/by-name/tr/treedome/package.nix b/pkgs/by-name/tr/treedome/package.nix
index ca92f33ed5dd..de0236d0a930 100644
--- a/pkgs/by-name/tr/treedome/package.nix
+++ b/pkgs/by-name/tr/treedome/package.nix
@@ -8,7 +8,10 @@
 , gsettings-desktop-schemas
 , gtk3
 , libsoup
-, mkYarnPackage
+, stdenv
+, yarnConfigHook
+, yarnBuildHook
+, nodejs
 , openssl
 , pkg-config
 , rustPlatform
@@ -28,31 +31,20 @@ let
     fetchLFS = true;
   };
 
-  frontend-build = mkYarnPackage {
-    inherit version src;
+  frontend-build = stdenv.mkDerivation (finalAttrs: {
     pname = "treedome-ui";
+    inherit version src;
 
     offlineCache = fetchYarnDeps {
       yarnLock = "${src}/yarn.lock";
       hash = "sha256-CrD/n8z5fJKkBKEcvpRHJaqXBt1gbON7VsuLb2JGu1A=";
     };
 
-    packageJSON = ./package.json;
-
-    configurePhase = ''
-      runHook preConfigure
-      ln -s $node_modules node_modules
-      runHook postConfigure
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-
-      export HOME=$(mktemp -d)
-      yarn --offline run build
-
-      runHook postBuild
-    '';
+    nativeBuildInputs = [
+      yarnConfigHook
+      yarnBuildHook
+      nodejs
+    ];
 
     installPhase = ''
       runHook preInstall
@@ -62,9 +54,7 @@ let
 
       runHook postInstall
     '';
-
-    doDist = false;
-  };
+  });
 in
 rustPlatform.buildRustPackage {
   inherit version pname src;
diff --git a/pkgs/by-name/vi/vim-language-server/package.json b/pkgs/by-name/vi/vim-language-server/package.json
deleted file mode 100644
index bbc996c8302a..000000000000
--- a/pkgs/by-name/vi/vim-language-server/package.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "name": "vim-language-server",
-  "version": "2.3.1",
-  "description": "vim language server",
-  "keywords": [
-    "viml",
-    "vim",
-    "lsp",
-    "language",
-    "server",
-    "autocomplete"
-  ],
-  "main": "./out/index.js",
-  "repository": "https://github.com/iamcco/vim-language-server",
-  "author": "iamcco <ooiss@qq.com>",
-  "license": "MIT",
-  "scripts": {
-    "build-docs": "rm ./src/docs/builtin-docs.json && ./bin/build-docs.js",
-    "build": "rm -rf ./out && webpack",
-    "watch": "webpack -w",
-    "test": "mocha test/src/**/*.ts --require ts-node/register",
-    "lint": "tslint -c tslint.json --format verbose {.,test}/src/**/*.ts src/index.ts",
-    "fix": "tslint -c tslint.json --fix {.,test}/src/**/*.ts src/index.ts"
-  },
-  "bin": {
-    "vim-language-server": "./bin/index.js"
-  },
-  "devDependencies": {
-    "@types/mocha": "^7.0.2",
-    "@types/node": "^11.13.6",
-    "chai": "^4.2.0",
-    "chai-as-promised": "^7.1.1",
-    "fast-glob": "^3.2.4",
-    "findup": "^0.1.5",
-    "mocha": "^7.1.2",
-    "rxjs": "^6.6.7",
-    "rxjs-operators": "^1.1.3",
-    "shvl": "^2.0.0",
-    "ts-loader": "^8.1.0",
-    "ts-node": "^9.1.1",
-    "tslint": "^6.1.3",
-    "typescript": "^4.2.3",
-    "vscode-languageserver": "^7.0.0",
-    "vscode-languageserver-textdocument": "^1.0.1",
-    "vscode-uri": "^3.0.2",
-    "webpack": "^5.30.0",
-    "webpack-cli": "^4.6.0"
-  }
-}
diff --git a/pkgs/by-name/vi/vim-language-server/package.nix b/pkgs/by-name/vi/vim-language-server/package.nix
index 5e085d0f6d71..3d60dd1ca5fb 100644
--- a/pkgs/by-name/vi/vim-language-server/package.nix
+++ b/pkgs/by-name/vi/vim-language-server/package.nix
@@ -1,38 +1,41 @@
 { lib
-, mkYarnPackage
+, stdenv
 , fetchFromGitHub
 , fetchYarnDeps
+, yarnConfigHook
+, yarnBuildHook
+, nodejs
+, npmHooks
 }:
 
-mkYarnPackage rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "vim-language-server";
   version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "iamcco";
     repo = "vim-language-server";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-NfBKNCTvCMIJrSiTlCG+LtVoMBMdCc3rzpDb9Vp2CGM=";
   };
 
-  packageJSON = ./package.json;
   offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
+    yarnLock = finalAttrs.src + "/yarn.lock";
     hash = "sha256-mo8urQaWIHu33+r0Y7mL9mJ/aSe/5CihuIetTeDHEUQ=";
   };
 
-  buildPhase = ''
-    runHook preBuild
-
-    export HOME=$(mktemp -d)
-    # https://stackoverflow.com/a/69699772/4935114
-    env NODE_OPTIONS=--openssl-legacy-provider yarn --offline build
-
-    runHook postBuild
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    # Needed for executing package.json scripts
+    nodejs
+    npmHooks.npmInstallHook
+  ];
+  # https://stackoverflow.com/a/69699772/4935114
+  preBuild = ''
+    export NODE_OPTIONS=--openssl-legacy-provider
   '';
 
-  doDist = false;
-
   meta = with lib; {
     description = "VImScript language server, LSP for vim script";
     homepage = "https://github.com/iamcco/vim-language-server";
@@ -40,4 +43,4 @@ mkYarnPackage rec {
     maintainers = with maintainers; [ doronbehar ];
     mainProgram = "vim-language-server";
   };
-}
+})
diff --git a/pkgs/by-name/yo/your_spotify/client.nix b/pkgs/by-name/yo/your_spotify/client.nix
index 420498821bf9..4453d3988621 100644
--- a/pkgs/by-name/yo/your_spotify/client.nix
+++ b/pkgs/by-name/yo/your_spotify/client.nix
@@ -1,49 +1,36 @@
 {
-  apiEndpoint ? "http://localhost:3000",
-  fetchYarnDeps,
-  your_spotify,
-  mkYarnPackage,
-  fixup-yarn-lock,
+  stdenv,
   src,
   version,
-  yarn,
+  meta,
+  offlineCache,
+  apiEndpoint ? "http://localhost:3000",
+  yarnConfigHook,
+  yarnBuildHook,
+  nodejs
 }:
-mkYarnPackage rec {
-  inherit version src;
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "your_spotify_client";
-  name = "your_spotify_client-${version}";
-  packageJSON = ./package.json;
-  offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
-    hash = "sha256-5SgknaRVzgO2Dzc8MhAaM8UERWMv+PrItzevoWHbWnA=";
-  };
-  configurePhase = ''
-    runHook preConfigure
+  inherit version src offlineCache;
 
-    export HOME=$(mktemp -d)
-    yarn config --offline set yarn-offline-mirror $offlineCache
-    fixup-yarn-lock yarn.lock
-    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-    patchShebangs node_modules/
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs
+  ];
 
-    runHook postConfigure
-  '';
-  buildPhase = ''
-    runHook preBuild
+  API_ENDPOINT="${apiEndpoint}";
+  preBuild = ''
     pushd ./apps/client/
-    yarn --offline run build
-    export API_ENDPOINT="${apiEndpoint}"
+  '';
+  postBuild = ''
     substituteInPlace scripts/run/variables.sh --replace-quiet '/app/apps/client/' "./"
-
     chmod +x ./scripts/run/variables.sh
     patchShebangs --build ./scripts/run/variables.sh
-
     ./scripts/run/variables.sh
-
     popd
-    runHook postBuild
   '';
-  nativeBuildInputs = [yarn fixup-yarn-lock];
 
   installPhase = ''
     runHook preInstall
@@ -51,8 +38,6 @@ mkYarnPackage rec {
     cp -r ./apps/client/build/* $out
     runHook postInstall
   '';
-  doDist = false;
-  meta = {
-    inherit (your_spotify.meta) homepage changelog description license maintainers;
-  };
-}
+
+  inherit meta;
+})
diff --git a/pkgs/by-name/yo/your_spotify/package.json b/pkgs/by-name/yo/your_spotify/package.json
deleted file mode 100644
index 8c10988ffb6d..000000000000
--- a/pkgs/by-name/yo/your_spotify/package.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "name": "@your_spotify/root",
-  "version": "1.10.1",
-  "repository": "git@github.com:Yooooomi/your_spotify.git",
-  "author": "Timothee <timothee.boussus@gmail.com>",
-  "private": true,
-  "workspaces": [
-    "apps/*"
-  ]
-}
diff --git a/pkgs/by-name/yo/your_spotify/package.nix b/pkgs/by-name/yo/your_spotify/package.nix
index 0296b9d22c02..738d1aefa248 100644
--- a/pkgs/by-name/yo/your_spotify/package.nix
+++ b/pkgs/by-name/yo/your_spotify/package.nix
@@ -1,85 +1,76 @@
 {
-  callPackage,
+  lib,
+  stdenv,
   fetchFromGitHub,
   fetchYarnDeps,
-  lib,
-  makeWrapper,
-  mkYarnPackage,
+  yarnConfigHook,
+  yarnBuildHook,
   nodejs,
-  fixup-yarn-lock,
-  yarn,
-}: let
+  makeWrapper,
+  callPackage,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "your_spotify_server";
   version = "1.10.1";
+
   src = fetchFromGitHub {
     owner = "Yooooomi";
     repo = "your_spotify";
-    rev = "refs/tags/${version}";
+    rev = "refs/tags/${finalAttrs.version}";
     hash = "sha256-e82j2blGxQLWAlBNuAnFvlD9vwMk4/mRI0Vf7vuaPA0=";
   };
-  client = callPackage ./client.nix {inherit src version;};
-in
-  mkYarnPackage rec {
-    inherit version src;
-    pname = "your_spotify_server";
-    name = "your_spotify_server-${version}";
-    packageJSON = ./package.json;
-    offlineCache = fetchYarnDeps {
-      yarnLock = src + "/yarn.lock";
-      hash = "sha256-5SgknaRVzgO2Dzc8MhAaM8UERWMv+PrItzevoWHbWnA=";
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-5SgknaRVzgO2Dzc8MhAaM8UERWMv+PrItzevoWHbWnA=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    yarnConfigHook
+    yarnBuildHook
+    nodejs
+  ];
+
+  preBuild = ''
+    pushd ./apps/server/
+  '';
+  postBuild = ''
+    popd
+    rm -r node_modules
+    export NODE_ENV="production"
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    patchShebangs node_modules/
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/your_spotify
+    cp -r node_modules $out/share/your_spotify/node_modules
+    cp -r ./apps/server/{lib,package.json} $out
+    mkdir -p $out/bin
+    makeWrapper ${lib.escapeShellArg (lib.getExe nodejs)} "$out/bin/your_spotify_migrate" \
+      --add-flags "$out/lib/migrations.js" --set NODE_PATH "$out/share/your_spotify/node_modules"
+    makeWrapper ${lib.escapeShellArg (lib.getExe nodejs)} "$out/bin/your_spotify_server" \
+      --add-flags "$out/lib/index.js" --set NODE_PATH "$out/share/your_spotify/node_modules"
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    client = callPackage ./client.nix {
+      inherit (finalAttrs) src version offlineCache meta;
     };
+  };
 
-    configurePhase = ''
-      runHook preConfigure
-
-      export HOME=$(mktemp -d)
-      yarn config --offline set yarn-offline-mirror $offlineCache
-      fixup-yarn-lock yarn.lock
-
-      runHook postConfigure
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-
-      yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-      patchShebangs node_modules/
-
-      pushd ./apps/server/
-      yarn --offline run build
-      popd
-
-      rm -r node_modules
-      export NODE_ENV="production"
-      yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-      patchShebangs node_modules/
-
-      runHook postBuild
-    '';
-    nativeBuildInputs = [makeWrapper yarn fixup-yarn-lock];
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/share/your_spotify
-      cp -r node_modules $out/share/your_spotify/node_modules
-      cp -r ./apps/server/{lib,package.json} $out
-      mkdir -p $out/bin
-      makeWrapper ${lib.escapeShellArg (lib.getExe nodejs)} "$out/bin/your_spotify_migrate" \
-        --add-flags "$out/lib/migrations.js" --set NODE_PATH "$out/share/your_spotify/node_modules"
-      makeWrapper ${lib.escapeShellArg (lib.getExe nodejs)} "$out/bin/your_spotify_server" \
-        --add-flags "$out/lib/index.js" --set NODE_PATH "$out/share/your_spotify/node_modules"
-
-      runHook postInstall
-    '';
-    doDist = false;
-    passthru = {
-      inherit client;
-    };
-    meta = with lib; {
-      homepage = "https://github.com/Yooooomi/your_spotify";
-      changelog = "https://github.com/Yooooomi/your_spotify/releases/tag/${version}";
-      description = "Self-hosted application that tracks what you listen and offers you a dashboard to explore statistics about it";
-      license = licenses.gpl3Only;
-      maintainers = with maintainers; [patrickdag];
-      mainProgram = "your_spotify_server";
-    };
-  }
+  meta = {
+    homepage = "https://github.com/Yooooomi/your_spotify";
+    changelog = "https://github.com/Yooooomi/your_spotify/releases/tag/${finalAttrs.version}";
+    description = "Self-hosted application that tracks what you listen and offers you a dashboard to explore statistics about it";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ patrickdag ];
+    mainProgram = "your_spotify_server";
+  };
+})
diff --git a/pkgs/by-name/yt/ytmdesktop/package.nix b/pkgs/by-name/yt/ytmdesktop/package.nix
index 224b5f777b41..599f62347cd5 100644
--- a/pkgs/by-name/yt/ytmdesktop/package.nix
+++ b/pkgs/by-name/yt/ytmdesktop/package.nix
@@ -1,14 +1,12 @@
 {
   lib,
   asar,
-  binutils,
   commandLineArgs ? "",
   copyDesktopItems,
   electron_30,
   fetchurl,
   makeDesktopItem,
   makeWrapper,
-  nix-update-script,
   stdenv,
   zstd,
 }:
@@ -16,19 +14,21 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "ytmdesktop";
   version = "2.0.5";
 
-  desktopItem = makeDesktopItem {
-    desktopName = "Youtube Music Desktop App";
-    exec = "ytmdesktop";
-    icon = "ytmdesktop";
-    name = "ytmdesktop";
-    genericName = finalAttrs.meta.description;
-    mimeTypes = [ "x-scheme-handler/ytmd" ];
-    categories = [
-      "AudioVideo"
-      "Audio"
-    ];
-    startupNotify = true;
-  };
+  desktopItems = [
+    (makeDesktopItem {
+      desktopName = "Youtube Music Desktop App";
+      exec = "ytmdesktop";
+      icon = "ytmdesktop";
+      name = "ytmdesktop";
+      genericName = finalAttrs.meta.description;
+      mimeTypes = [ "x-scheme-handler/ytmd" ];
+      categories = [
+        "AudioVideo"
+        "Audio"
+      ];
+      startupNotify = true;
+    })
+  ];
 
   nativeBuildInputs = [
     asar
diff --git a/pkgs/development/libraries/botan/3.0.nix b/pkgs/development/libraries/botan/3.0.nix
index d55d7edfb74c..d3cd0ece00df 100644
--- a/pkgs/development/libraries/botan/3.0.nix
+++ b/pkgs/development/libraries/botan/3.0.nix
@@ -1,7 +1,9 @@
-{ callPackage, ... } @ args:
+{ callPackage, stdenv, lib, ... } @ args:
 
 callPackage ./generic.nix (args // {
   baseVersion = "3.4";
   revision = "0";
   hash = "sha256-cYQ6/MCixYX48z+jBPC1iuS5xdgwb4lGZ7N0YEQndVc=";
+  # this patch fixes build errors on MacOS with SDK 10.12, recheck to remove this again
+  extraPatches = lib.optionals stdenv.hostPlatform.isDarwin [ ./botan3-macos.patch ];
 })
diff --git a/pkgs/development/libraries/botan/botan3-macos.patch b/pkgs/development/libraries/botan/botan3-macos.patch
new file mode 100644
index 000000000000..4fde08c32d3f
--- /dev/null
+++ b/pkgs/development/libraries/botan/botan3-macos.patch
@@ -0,0 +1,48 @@
+diff --git a/src/lib/prov/commoncrypto/commoncrypto_block.cpp b/src/lib/prov/commoncrypto/commoncrypto_block.cpp
+index a07fe118d..f059ee497 100644
+--- a/src/lib/prov/commoncrypto/commoncrypto_block.cpp
++++ b/src/lib/prov/commoncrypto/commoncrypto_block.cpp
+@@ -11,6 +11,7 @@
+ #include <botan/hex.h>
+ #include <botan/internal/commoncrypto_utils.h>
+ 
++#include <CommonCrypto/CommonCryptoError.h>
+ #include <CommonCrypto/CommonCrypto.h>
+ 
+ namespace Botan {
+diff --git a/src/lib/prov/commoncrypto/commoncrypto_hash.cpp b/src/lib/prov/commoncrypto/commoncrypto_hash.cpp
+index 1fb79c419..faf9575c2 100644
+--- a/src/lib/prov/commoncrypto/commoncrypto_hash.cpp
++++ b/src/lib/prov/commoncrypto/commoncrypto_hash.cpp
+@@ -11,6 +11,7 @@
+ #include <botan/internal/stl_util.h>
+ #include <unordered_map>
+ 
++#include <CommonCrypto/CommonCryptoError.h>
+ #include <CommonCrypto/CommonCrypto.h>
+ 
+ namespace Botan {
+diff --git a/src/lib/prov/commoncrypto/commoncrypto_utils.h b/src/lib/prov/commoncrypto/commoncrypto_utils.h
+index b1c7411fd..9becab2d1 100644
+--- a/src/lib/prov/commoncrypto/commoncrypto_utils.h
++++ b/src/lib/prov/commoncrypto/commoncrypto_utils.h
+@@ -10,6 +10,7 @@
+ 
+ #include <botan/sym_algo.h>
+ 
++#include <CommonCrypto/CommonCryptoError.h>
+ #include <CommonCrypto/CommonCrypto.h>
+ 
+ namespace Botan {
+diff --git a/src/lib/rng/system_rng/system_rng.cpp b/src/lib/rng/system_rng/system_rng.cpp
+index b2f7b4c45..f4933b1e3 100644
+--- a/src/lib/rng/system_rng/system_rng.cpp
++++ b/src/lib/rng/system_rng/system_rng.cpp
+@@ -20,6 +20,7 @@
+    #include <bcrypt.h>
+    #include <windows.h>
+ #elif defined(BOTAN_TARGET_OS_HAS_CCRANDOM)
++   #include <CommonCrypto/CommonCryptoError.h>
+    #include <CommonCrypto/CommonRandom.h>
+ #elif defined(BOTAN_TARGET_OS_HAS_ARC4RANDOM)
+    #include <stdlib.h>
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 6c87feaab882..52b0983aeb67 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -233,7 +233,7 @@ let
       description = "Cryptographic library that implements the SSL and TLS protocols";
       license = licenses.openssl;
       mainProgram = "openssl";
-      maintainers = with maintainers; [ thillux ];
+      maintainers = with maintainers; [ thillux ] ++ lib.teams.stridtech.members;
       pkgConfigModules = [
         "libcrypto"
         "libssl"
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index 2c70046108da..14e4e29e0c6e 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -11,7 +11,7 @@
 , windows
 , enableJemalloc ? false
 , jemalloc
-, enableLiburing ? true
+, enableLiburing ? stdenv.isLinux
 , liburing
 , enableShared ? !stdenv.hostPlatform.isStatic
 , sse42Support ? stdenv.hostPlatform.sse4_2Support
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-bTUzh7ch14TDcm6GkfhA5I/qUVmUm+RE5d2HMZ3zaNc=";
   };
 
-  patches = [ ./fix-findliburing.patch ];
+  patches = lib.optional (lib.versionAtLeast finalAttrs.version "6.29.3" && enableLiburing) ./fix-findliburing.patch;
 
   nativeBuildInputs = [ cmake ninja ];
 
diff --git a/pkgs/development/libraries/vtk/generic.nix b/pkgs/development/libraries/vtk/generic.nix
index 5ad312c1b865..d131fe173ab8 100644
--- a/pkgs/development/libraries/vtk/generic.nix
+++ b/pkgs/development/libraries/vtk/generic.nix
@@ -3,6 +3,7 @@
 , fetchpatch
 , enableQt ? false, qtx11extras, qttools, qtdeclarative, qtEnv
 , enablePython ? false, python ? throw "vtk: Python support requested, but no python interpreter was given."
+, enableEgl ? false
 # Darwin support
 , AGL, Cocoa, CoreServices, DiskArbitration, IOKit, CFNetwork, Security, GLUT, OpenGL
 , ApplicationServices, CoreText, IOSurface, ImageIO, xpc, libobjc
@@ -15,7 +16,9 @@ let
   pythonMajor = lib.substring 0 1 python.pythonVersion;
 
 in stdenv.mkDerivation {
-  pname = "vtk${optionalString enableQt "-qvtk"}";
+  pname = "vtk"
+    + optionalString enableEgl "-egl"
+    + optionalString enableQt "-qvtk";
   inherit version;
 
   src = fetchurl {
@@ -82,7 +85,7 @@ in stdenv.mkDerivation {
     "-DVTK_MODULE_ENABLE_VTK_RenderingExternal=YES"
   ] ++ lib.optionals (!stdenv.isDarwin) [
     "-DOPENGL_INCLUDE_DIR=${libGL}/include"
-    "-DVTK_OPENGL_HAS_EGL=ON"
+    (lib.cmakeBool "VTK_OPENGL_HAS_EGL" enableEgl)
   ] ++ [
     "-DCMAKE_INSTALL_LIBDIR=lib"
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
@@ -113,6 +116,7 @@ in stdenv.mkDerivation {
     homepage = "https://www.vtk.org/";
     license = licenses.bsd3;
     maintainers = with maintainers; [ knedlsepp tfmoraes ];
-    platforms = with platforms; unix;
+    platforms = platforms.unix;
+    badPlatforms = optionals enableEgl platforms.darwin;
   };
 }
diff --git a/pkgs/development/ocaml-modules/get-activity/default.nix b/pkgs/development/ocaml-modules/get-activity/default.nix
new file mode 100644
index 000000000000..dbd585f57800
--- /dev/null
+++ b/pkgs/development/ocaml-modules/get-activity/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildDunePackage,
+  get-activity-lib,
+  ppx_expect,
+  cmdliner,
+  dune-build-info,
+  fmt,
+  logs,
+  alcotest
+}:
+
+buildDunePackage rec {
+  pname = "get-activity";
+  inherit (get-activity-lib) version src;
+
+  minimalOCamlVersion = "4.08";
+
+  buildInputs = [
+    get-activity-lib
+    cmdliner
+    dune-build-info
+    fmt
+    logs
+  ];
+
+  checkInputs = [ ppx_expect alcotest ];
+
+  doCheck = true;
+
+  meta = {
+    homepage = "https://github.com/tarides/get-activity";
+    description = "Collect activity and format as markdown for a journal";
+    license = lib.licenses.mit;
+    changelog = "https://github.com/tarides/get-activity/releases/tag/${version}";
+    maintainers = with lib.maintainers; [ zazedd ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/get-activity/lib.nix b/pkgs/development/ocaml-modules/get-activity/lib.nix
new file mode 100644
index 000000000000..7f3fe161a6d2
--- /dev/null
+++ b/pkgs/development/ocaml-modules/get-activity/lib.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  ppx_expect,
+  astring,
+  curly,
+  fmt,
+  logs,
+  ppx_yojson_conv,
+  ppx_yojson_conv_lib,
+  yojson,
+  alcotest
+}:
+
+buildDunePackage rec {
+  pname = "get-activity-lib";
+  version = "2.0.1";
+
+  src = fetchFromGitHub {
+    owner = "tarides";
+    repo = "get-activity";
+    rev = version;
+    hash = "sha256-QU/LPIxcem5nFvSxcNApOuBu6UHqLHIXVSOJ2UT0eKA=";
+  };
+
+  minimalOCamlVersion = "4.08";
+
+  buildInputs = [ ppx_yojson_conv ];
+
+  propagatedBuildInputs = [
+    astring
+    curly
+    fmt
+    logs
+    ppx_yojson_conv_lib
+    yojson
+  ];
+
+  checkInputs = [ ppx_expect alcotest ];
+
+  doCheck = true;
+
+  meta = {
+    homepage = "https://github.com/tarides/get-activity";
+    description = "Collect activity and format as markdown for a journal (lib)";
+    license = lib.licenses.mit;
+    changelog = "https://github.com/tarides/get-activity/releases/tag/${version}";
+    maintainers = with lib.maintainers; [ zazedd ];
+  };
+}
+
diff --git a/pkgs/development/python-modules/abjad/default.nix b/pkgs/development/python-modules/abjad/default.nix
index 9ff530afdf74..b0998b8c0693 100644
--- a/pkgs/development/python-modules/abjad/default.nix
+++ b/pkgs/development/python-modules/abjad/default.nix
@@ -8,6 +8,7 @@
   pythonOlder,
   pytestCheckHook,
   lilypond,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
@@ -26,6 +27,7 @@ buildPythonPackage rec {
     ply
     roman
     uqbar
+    typing-extensions
   ];
 
   buildInputs = [ lilypond ];
@@ -34,12 +36,12 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace abjad/io.py \
-      --replace 'lilypond_path = self.get_lilypond_path()' \
+      --replace-fail 'lilypond_path = self.get_lilypond_path()' \
                 'lilypond_path = "${lilypond}/bin/lilypond"'
     # general invocations of binary for IO purposes
 
     substituteInPlace abjad/configuration.py \
-      --replace '["lilypond"' '["${lilypond}/bin/lilypond"'
+      --replace-fail '["lilypond"' '["${lilypond}/bin/lilypond"'
     # get_lilypond_version_string
   '';
 
diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 50cae5fb0108..b54fa310ec9e 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -68,7 +68,10 @@ buildPythonPackage rec {
     hash = "sha256-eTVT1yowuDsajjceWojdUdX466FKneUt1i5QipBFdp4=";
   };
 
-  pythonRelaxDeps = [ "orjson" ];
+  pythonRelaxDeps = [
+    "chroma-hnswlib"
+    "orjson"
+  ];
 
   nativeBuildInputs = [
     cargo
diff --git a/pkgs/development/python-modules/openwebifpy/default.nix b/pkgs/development/python-modules/openwebifpy/default.nix
index a43b7c872e54..48795497e589 100644
--- a/pkgs/development/python-modules/openwebifpy/default.nix
+++ b/pkgs/development/python-modules/openwebifpy/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "openwebifpy";
-  version = "4.2.4";
+  version = "4.2.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qL/H2F+/d/JWwmUbZhvoMlZZDGgEpRBmHabt1MWjGAs=";
+    hash = "sha256-Ui3731ChEUterRXb+QVMR1CNXhPYhBkZoUwbSJ47g+4=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index cc522d35fc01..54c5e7978682 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -55,7 +55,7 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.42.3";
+  version = "4.42.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -64,7 +64,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vcwOFprscE8R3AdIJudYme9vvSFJvF+iCzRzBhiggr8=";
+    hash = "sha256-v5p63D8j1CNx3dCPa121auny5StEUpNK9IkPSugzAjg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/universal-silabs-flasher/default.nix b/pkgs/development/python-modules/universal-silabs-flasher/default.nix
index 55551a5206ef..db578a739331 100644
--- a/pkgs/development/python-modules/universal-silabs-flasher/default.nix
+++ b/pkgs/development/python-modules/universal-silabs-flasher/default.nix
@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "universal-silabs-flasher";
-  version = "0.0.20";
+  version = "0.0.21";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "NabuCasa";
     repo = "universal-silabs-flasher";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+wmBsb7zsN6vdNqUvozV317kEZCg1b+lBToRSdN2YM4=";
+    hash = "sha256-KZE22S6d+XCnGzdFDJdsbt9HnpnyvH+8p89wPUmLDGc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/build-managers/bloop/default.nix b/pkgs/development/tools/build-managers/bloop/default.nix
index 1f3929620f1f..6a47218ae33f 100644
--- a/pkgs/development/tools/build-managers/bloop/default.nix
+++ b/pkgs/development/tools/build-managers/bloop/default.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bloop";
-  version = "1.5.18";
+  version = "1.6.0";
 
   platform =
     if stdenv.isLinux && stdenv.isx86_64 then "x86_64-pc-linux"
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
   bloop-binary = fetchurl rec {
     url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bloop-${platform}";
     sha256 =
-      if stdenv.isLinux && stdenv.isx86_64 then "sha256-gfmsroHyr/xrbQ72x6LNRvIYaxgUjBOxYsyKqc0c9Oo="
-      else if stdenv.isDarwin && stdenv.isx86_64 then "sha256-fluOkbpVy895YyWisfTaDP2yXbqF+gToc1KbVL8Mon8="
+      if stdenv.isLinux && stdenv.isx86_64 then "sha256-f7ZmjDO8L3hcYkaxiwf5BBD44hBiBhNovylM4B308bI="
+      else if stdenv.isDarwin && stdenv.isx86_64 then "sha256-xXkWQ9dMZrSXZHrU1YxTxfDwGEj9y8/ARlypUNLnloo="
       else throw "unsupported platform";
   };
 
diff --git a/pkgs/development/tools/go-task/default.nix b/pkgs/development/tools/go-task/default.nix
index c744f2ee4318..96ca709a4e43 100644
--- a/pkgs/development/tools/go-task/default.nix
+++ b/pkgs/development/tools/go-task/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, fetchpatch
 , installShellFiles
 , testers
 , go-task
@@ -8,16 +9,26 @@
 
 buildGoModule rec {
   pname = "go-task";
-  version = "3.37.2";
+  version = "3.38.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "task";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yVQR7D3zpReBlYyuZNMBVs3lgWBR54doMUjRMhfgUJw=";
+    hash = "sha256-mz/07DONaO3kCxOXEnvWglY0b9JXxCXjTrVIEbsbl98=";
   };
 
-  vendorHash = "sha256-iugFWBIKt/Rm5ccQnIFR75P1AVZbbFhWN97dvr8DoBs=";
+  vendorHash = "sha256-2M/FrXip0Tz0wguCd81qbBDW3XIJlAWwVzD+hIFm6sw=";
+
+  patches = [
+    # fix version resolution when passed in though ldflags
+    # remove on next release
+    (fetchpatch {
+      name = "fix-ldflags-version.patch";
+      url = "https://github.com/go-task/task/commit/9ee4f21d62382714ac829df6f9bbf1637406eb5b.patch?full_index=1";
+      hash = "sha256-wu5//aZ/vzuObb03AjUUlVFjPr175mn1vVAZgqSGIZ0=";
+    })
+  ];
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/infisical/default.nix b/pkgs/development/tools/infisical/default.nix
index be072c60d5cd..abc4f35836a0 100644
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
@@ -15,7 +15,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # the version of infisical
-  version = "0.22.6";
+  version = "0.23.3";
 
   # the platform-specific, statically linked binary
   src =
@@ -76,7 +76,7 @@ stdenv.mkDerivation {
     changelog = "https://github.com/infisical/infisical/releases/tag/infisical-cli%2Fv${version}";
     license = licenses.mit;
     mainProgram = "infisical";
-    maintainers = teams.infisical.members;
+    maintainers = teams.infisical.members ++ (with maintainers; [ hausken ]);
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/development/tools/infisical/hashes.json b/pkgs/development/tools/infisical/hashes.json
index 3906ce44cb59..a35576b7cc25 100644
--- a/pkgs/development/tools/infisical/hashes.json
+++ b/pkgs/development/tools/infisical/hashes.json
@@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-wCOlCz8gh9icdiatzQY8Wm5Bf6JQoAZzKuSqo/QmOFY="
-, "x86_64-darwin": "sha256-v9DKsFQhf4wRw60xAEo8bXPN0/0r7YWhMSHoijuGzwI="
-, "aarch64-linux": "sha256-hoCBuR14nY8s+hQ+1bdhox0MhR0m60dH7JLCOlKmFvY="
-, "aarch64-darwin": "sha256-QGgVsQQLOKspk3NBiVIjTO6J+p2+H0+zAVYu/Pl8sMI="
+, "x86_64-linux": "sha256-L+uuKO6oIWjEXKkOCyON+0VHizLpaePe7p6LyY/mts4="
+, "x86_64-darwin": "sha256-qLjZEd53jlSCqoxA0BDeDz/kNXUQic9UA3GaLxIVkbM="
+, "aarch64-linux": "sha256-NW0/UHnv6/vlouc0gBC+lPdrGZyX1l1HJ+5Pp+ZyY1A="
+, "aarch64-darwin": "sha256-n4KaDPlLdjweRRHdqN8N2hGrAqsqYyiWD/3xpjfgYk4="
 }
diff --git a/pkgs/development/tools/infisical/update.sh b/pkgs/development/tools/infisical/update.sh
index 5810d2ee48b4..d0ad2342f415 100755
--- a/pkgs/development/tools/infisical/update.sh
+++ b/pkgs/development/tools/infisical/update.sh
@@ -6,7 +6,7 @@ set -euo pipefail
 RELEASE_NAME=$(curl -s https://api.github.com/repos/infisical/infisical/releases \
   | jq -r 'sort_by(.created_at) | reverse |
            (map
-             (select ((.prerelease == false) and (.draft == false))) |
+             (select ((.prerelease == false) and (.draft == false) and (.name | contains("infisical-cli")))) |
              first
            ) | .name')
 VERSION=$(echo "$RELEASE_NAME" | sed -E 's/^infisical-cli\/v//')
diff --git a/pkgs/development/tools/ruff/Cargo.lock b/pkgs/development/tools/ruff/Cargo.lock
index fc0c35f53759..07e945a5164c 100644
--- a/pkgs/development/tools/ruff/Cargo.lock
+++ b/pkgs/development/tools/ruff/Cargo.lock
@@ -184,9 +184,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
 
 [[package]]
 name = "bstr"
@@ -232,6 +232,15 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
+[[package]]
+name = "castaway"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a17ed5635fc8536268e5d4de1e22e81ac34419e5f052d4d51f4e01dcc263fcc"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "cc"
 version = "1.0.95"
@@ -305,9 +314,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.7"
+version = "4.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5db83dced34638ad474f39f250d7fea9598bdd239eaced1bdf45d597da0f433f"
+checksum = "84b3edb18336f4df585bc9aa31dd99c036dfa5dc5e9a2939a722a188f3a8970d"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -315,9 +324,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.7"
+version = "4.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7e204572485eb3fbf28f871612191521df159bc3e15a9f5064c66dba3a8c05f"
+checksum = "c1c09dd5ada6c6c78075d6fd0da3f90d8080651e2d6cc8eb2f1aaa4034ced708"
 dependencies = [
  "anstream",
  "anstyle",
@@ -369,11 +378,11 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.5"
+version = "4.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c780290ccf4fb26629baa7a1081e68ced113f1d3ec302fa5948f1c381ebf06c6"
+checksum = "2bac35c6dafb060fd4d275d9a4ffae97917c13a6327903a8be2153cd964f7085"
 dependencies = [
- "heck 0.5.0",
+ "heck",
  "proc-macro2",
  "quote",
  "syn",
@@ -436,6 +445,20 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "compact_str"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f86b9c4c00838774a6d902ef931eff7470720c51d90c2e32cfe15dc304737b3f"
+dependencies = [
+ "castaway",
+ "cfg-if",
+ "itoa",
+ "ryu",
+ "serde",
+ "static_assertions",
+]
+
 [[package]]
 name = "console"
 version = "0.15.8"
@@ -480,6 +503,11 @@ name = "countme"
 version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
+dependencies = [
+ "dashmap 5.5.3",
+ "once_cell",
+ "rustc-hash 1.1.0",
+]
 
 [[package]]
 name = "crc32fast"
@@ -644,6 +672,20 @@ dependencies = [
  "parking_lot_core",
 ]
 
+[[package]]
+name = "dashmap"
+version = "6.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "804c8821570c3f8b70230c2ba75ffa5c0f9a4189b9a432b6656c536712acae28"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
 [[package]]
 name = "diff"
 version = "0.1.13"
@@ -765,16 +807,6 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "eyre"
-version = "0.6.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cd915d99f24784cdc19fd37ef22b97e3ff0ae756c7e492e9fbfe897d61e2aec"
-dependencies = [
- "indenter",
- "once_cell",
-]
-
 [[package]]
 name = "fastrand"
 version = "2.0.2"
@@ -921,12 +953,6 @@ dependencies = [
  "hashbrown 0.14.5",
 ]
 
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
-
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -1029,12 +1055,6 @@ dependencies = [
  "rust-stemmers",
 ]
 
-[[package]]
-name = "indenter"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683"
-
 [[package]]
 name = "indexmap"
 version = "2.2.6"
@@ -1285,7 +1305,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
  "libc",
 ]
 
@@ -1313,9 +1333,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.21"
+version = "0.4.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
 
 [[package]]
 name = "lsp-server"
@@ -1358,9 +1378,9 @@ checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
 
 [[package]]
 name = "matchit"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "540f1c43aed89909c0cc0cc604e3bb2f7e7a341a3728a9e6cfe760e733cd11ed"
+checksum = "8d3c2fcf089c060eb333302d80c5f3ffa8297abecf220f788e4a09ef85f59420"
 
 [[package]]
 name = "memchr"
@@ -1425,7 +1445,7 @@ version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -1447,7 +1467,7 @@ version = "6.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
  "crossbeam-channel",
  "filetime",
  "fsevent-sys",
@@ -1838,28 +1858,20 @@ dependencies = [
 
 [[package]]
 name = "red_knot"
-version = "0.1.0"
+version = "0.0.0"
 dependencies = [
  "anyhow",
- "bitflags 2.5.0",
+ "countme",
  "crossbeam",
  "ctrlc",
- "dashmap",
- "hashbrown 0.14.5",
- "indexmap",
- "is-macro",
  "notify",
- "parking_lot",
  "rayon",
  "red_knot_module_resolver",
- "ruff_index",
- "ruff_notebook",
+ "red_knot_python_semantic",
+ "ruff_db",
  "ruff_python_ast",
- "ruff_python_parser",
- "ruff_text_size",
  "rustc-hash 2.0.0",
- "smol_str",
- "tempfile",
+ "salsa",
  "tracing",
  "tracing-subscriber",
  "tracing-tree",
@@ -1870,13 +1882,13 @@ name = "red_knot_module_resolver"
 version = "0.0.0"
 dependencies = [
  "anyhow",
+ "compact_str",
  "insta",
  "path-slash",
  "ruff_db",
  "ruff_python_stdlib",
  "rustc-hash 2.0.0",
  "salsa",
- "smol_str",
  "tempfile",
  "tracing",
  "walkdir",
@@ -1888,7 +1900,7 @@ name = "red_knot_python_semantic"
 version = "0.0.0"
 dependencies = [
  "anyhow",
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
  "hashbrown 0.14.5",
  "indexmap",
  "red_knot_module_resolver",
@@ -1899,8 +1911,6 @@ dependencies = [
  "ruff_text_size",
  "rustc-hash 2.0.0",
  "salsa",
- "smallvec",
- "smol_str",
  "tracing",
 ]
 
@@ -1985,12 +1995,12 @@ dependencies = [
 
 [[package]]
 name = "ruff"
-version = "0.5.0"
+version = "0.5.1"
 dependencies = [
  "anyhow",
  "argfile",
  "bincode",
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
  "cachedir",
  "chrono",
  "clap",
@@ -2043,6 +2053,9 @@ dependencies = [
  "criterion",
  "mimalloc",
  "once_cell",
+ "red_knot",
+ "red_knot_module_resolver",
+ "ruff_db",
  "ruff_linter",
  "ruff_python_ast",
  "ruff_python_formatter",
@@ -2074,7 +2087,7 @@ version = "0.0.0"
 dependencies = [
  "camino",
  "countme",
- "dashmap",
+ "dashmap 6.0.1",
  "filetime",
  "insta",
  "once_cell",
@@ -2164,12 +2177,12 @@ dependencies = [
 
 [[package]]
 name = "ruff_linter"
-version = "0.5.0"
+version = "0.5.1"
 dependencies = [
  "aho-corasick",
  "annotate-snippets 0.9.2",
  "anyhow",
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
  "chrono",
  "clap",
  "colored",
@@ -2258,14 +2271,18 @@ name = "ruff_python_ast"
 version = "0.0.0"
 dependencies = [
  "aho-corasick",
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
+ "compact_str",
  "is-macro",
  "itertools 0.13.0",
  "once_cell",
+ "ruff_cache",
+ "ruff_macros",
  "ruff_python_trivia",
  "ruff_source_file",
  "ruff_text_size",
  "rustc-hash 2.0.0",
+ "schemars",
  "serde",
 ]
 
@@ -2338,7 +2355,7 @@ dependencies = [
 name = "ruff_python_literal"
 version = "0.0.0"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
  "itertools 0.13.0",
  "ruff_python_ast",
  "unic-ucd-category",
@@ -2350,8 +2367,9 @@ version = "0.0.0"
 dependencies = [
  "annotate-snippets 0.9.2",
  "anyhow",
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
  "bstr",
+ "compact_str",
  "insta",
  "memchr",
  "ruff_python_ast",
@@ -2380,7 +2398,7 @@ dependencies = [
 name = "ruff_python_semantic"
 version = "0.0.0"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
  "is-macro",
  "ruff_index",
  "ruff_python_ast",
@@ -2560,7 +2578,7 @@ version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -2613,12 +2631,11 @@ checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 [[package]]
 name = "salsa"
 version = "0.18.0"
-source = "git+https://github.com/salsa-rs/salsa.git?rev=f706aa2d32d473ee633a77c1af01d180c85da308#f706aa2d32d473ee633a77c1af01d180c85da308"
+source = "git+https://github.com/salsa-rs/salsa.git?rev=a1bf3a613f451af7fc0a59411c56abc47fe8e8e1#a1bf3a613f451af7fc0a59411c56abc47fe8e8e1"
 dependencies = [
  "arc-swap",
  "crossbeam",
- "crossbeam-utils",
- "dashmap",
+ "dashmap 5.5.3",
  "hashlink",
  "indexmap",
  "log",
@@ -2631,10 +2648,8 @@ dependencies = [
 [[package]]
 name = "salsa-macros"
 version = "0.18.0"
-source = "git+https://github.com/salsa-rs/salsa.git?rev=f706aa2d32d473ee633a77c1af01d180c85da308#f706aa2d32d473ee633a77c1af01d180c85da308"
+source = "git+https://github.com/salsa-rs/salsa.git?rev=a1bf3a613f451af7fc0a59411c56abc47fe8e8e1#a1bf3a613f451af7fc0a59411c56abc47fe8e8e1"
 dependencies = [
- "eyre",
- "heck 0.4.1",
  "proc-macro2",
  "quote",
  "syn",
@@ -2736,9 +2751,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.117"
+version = "1.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "455182ea6142b14f93f4bc5320a2b31c1f266b66a4a5c858b013302a5d8cbfc3"
+checksum = "e8eddb61f0697cc3989c5d64b452f5488e2b8a60fd7d5076a3045076ffef8cb0"
 dependencies = [
  "itoa",
  "ryu",
@@ -2776,9 +2791,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.8.1"
+version = "3.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ad483d2ab0149d5a5ebcd9972a3852711e0153d863bf5a5d0391d28883c4a20"
+checksum = "079f3a42cd87588d924ed95b533f8d30a483388c4e400ab736a7058e34f16169"
 dependencies = [
  "serde",
  "serde_derive",
@@ -2787,9 +2802,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.8.1"
+version = "3.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65569b702f41443e8bc8bbb1c5779bd0450bbe723b56198980e80ec45780bce2"
+checksum = "bc03aad67c1d26b7de277d51c86892e7d9a0110a2fe44bf6b26cc569fba302d6"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -2833,15 +2848,6 @@ version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
-[[package]]
-name = "smol_str"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd538fb6910ac1099850255cf94a94df6551fbdd602454387d0adb2d1ca6dead"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "spin"
 version = "0.9.8"
@@ -2890,7 +2896,7 @@ version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
 dependencies = [
- "heck 0.5.0",
+ "heck",
  "proc-macro2",
  "quote",
  "rustversion",
@@ -3334,9 +3340,9 @@ checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
 name = "uuid"
-version = "1.8.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a183cf7feeba97b4dd1c0d46788634f6221d87fa961b305bed08c851829efcc0"
+checksum = "5de17fd2f7da591098415cff336e12965a28061ddace43b59cb3c430179c9439"
 dependencies = [
  "getrandom",
  "rand",
@@ -3346,9 +3352,9 @@ dependencies = [
 
 [[package]]
 name = "uuid-macro-internal"
-version = "1.8.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9881bea7cbe687e36c9ab3b778c36cd0487402e270304e8b1296d5085303c1a2"
+checksum = "a3ff64d5cde1e2cb5268bdb497235b6bd255ba8244f910dbc3574e59593de68c"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 6a68f3a7b820..c0d31e390d9d 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -1,34 +1,47 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, fetchpatch
 , installShellFiles
 , stdenv
 , darwin
 , rust-jemalloc-sys
 , ruff-lsp
+, nix-update-script
 , testers
 , ruff
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     rev = "refs/tags/${version}";
-    hash = "sha256-OjMoa247om4DLPZ6u0XPMd5L+LYlVzHL39plCCr/fYE=";
+    hash = "sha256-2tW/p9A7jpQg8ZmSF7KRuN6kBNKK1cfjnS9KlvnCpQA=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "lsp-types-0.95.1" = "sha256-8Oh299exWXVi6A39pALOISNfp8XBya8z+KT/Z7suRxQ=";
-      "salsa-0.18.0" = "sha256-keVEmSwV1Su1RlOTaIu253FZidk279qA+rXcCeuOggc=";
+      "salsa-0.18.0" = "sha256-gcaAsrrJXrWOIHUnfBwwuTBG1Mb+lUEmIxSGIVLhXaM=";
     };
   };
 
+  # Fix compatibility with cargo-auditable
+  # https://github.com/astral-sh/ruff/pull/12275
+  # TODO: this will be included in the next release
+  patches = [
+    (fetchpatch {
+      name = "fix-compatibility-with-cargo-auditable";
+      url = "https://github.com/astral-sh/ruff/commit/d0298dc26d471666acc01dacdb603e3e95aca06f.patch";
+      hash = "sha256-Shf1Gw1pY98ZE+h9OhlpkJwq/S52EAJqUUk/uHix2fg=";
+    })
+  ];
+
   nativeBuildInputs = [
     installShellFiles
   ];
@@ -73,6 +86,7 @@ rustPlatform.buildRustPackage rec {
 
   passthru.tests = {
     inherit ruff-lsp;
+    updateScript = nix-update-script { };
     version = testers.testVersion { package = ruff; };
   };
 
diff --git a/pkgs/games/0ad/game.nix b/pkgs/games/0ad/game.nix
index ee2e8b3016fb..676c14fd1fc9 100644
--- a/pkgs/games/0ad/game.nix
+++ b/pkgs/games/0ad/game.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchpatch, perl, fetchurl, python3, fmt, libidn
+{ stdenv, lib, fetchpatch, fetchpatch2, perl, fetchurl, python3, fmt, libidn
 , pkg-config, spidermonkey_78, boost, icu, libxml2, libpng, libsodium
 , libjpeg, zlib, curl, libogg, libvorbis, enet, miniupnpc
 , openal, libGLU, libGL, xorgproto, libX11, libXcursor, nspr, SDL2
@@ -72,6 +72,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/0ad/0ad/commit/093e1eb23519ab4a4633a999a555a58e4fd5343e.patch";
       hash = "sha256-NuWO64narU1JID/F3cj7lJKjo96XR7gSW0w8I3/hhuw=";
     })
+    # Fix build with miniupnpc 2.2.8
+    # https://github.com/0ad/0ad/pull/45
+    (fetchpatch2 {
+      url = "https://github.com/0ad/0ad/commit/1575580bbc5278576693f3fbbb32de0b306aa27e.patch?full_index=1";
+      hash = "sha256-iXiUYTJCWwJpb2U3P58jTV4OpyW6quofu8Jq6xNEq48=";
+    })
   ];
 
   configurePhase = ''
diff --git a/pkgs/games/chiaki4deck/default.nix b/pkgs/games/chiaki4deck/default.nix
index 817ce111d009..7ea0159236ac 100644
--- a/pkgs/games/chiaki4deck/default.nix
+++ b/pkgs/games/chiaki4deck/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch2
 , stdenv
 , cmake
 , pkg-config
@@ -45,6 +46,15 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Fix build with miniupnpc 2.2.8
+    # https://github.com/streetpea/chiaki4deck/pull/355
+    (fetchpatch2 {
+      url = "https://github.com/streetpea/chiaki4deck/commit/e5806ae39cc6e8632d0f8cccefb5b7ddd458951a.patch?full_index=1";
+      hash = "sha256-0oGhymCZkhckJkvP64WNc4aaEzXlXYI84S7Blq7WgVw=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/misc/drivers/epson-escpr2/default.nix b/pkgs/misc/drivers/epson-escpr2/default.nix
index 5631a975e2e9..2037b311639b 100644
--- a/pkgs/misc/drivers/epson-escpr2/default.nix
+++ b/pkgs/misc/drivers/epson-escpr2/default.nix
@@ -1,16 +1,22 @@
-{ lib, stdenv, fetchurl, cups, rpm, cpio }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  cups,
+  rpm,
+  cpio,
+}:
 
 stdenv.mkDerivation rec {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.2.11";
+  version = "1.2.12";
 
   src = fetchurl {
-    # To find new versions, visit
-    # http://download.ebz.epson.net/dsc/search/01/search/?OSC=LX and search for
-    # some printer like for instance "WF-7210" to get to the most recent
-    # version.
-    url = "https://download3.ebz.epson.net/dsc/f/03/00/15/93/07/6926ce2857b2e0f563eecfd6a877b7b71898ad46/epson-inkjet-printer-escpr2-1.2.11-1.src.rpm";
-    sha256 = "sha256-WMjtYYuMGMPf6222rvrP5Ep6fMRwebPTUXeQ6CbwEt4=";
+    # To find the most recent version go to
+    # https://support.epson.net/linux/Printer/LSB_distribution_pages/en/escpr2.php
+    # and retreive the download link for source package for x86 CPU
+    url = "https://download3.ebz.epson.net/dsc/f/03/00/15/98/70/f6a682eeeba1fd8bdf2ac112d5e1111d951c64a6/epson-inkjet-printer-escpr2-1.2.12-1.src.rpm";
+    sha256 = "sha256-7OkDlYhfQ/S3OD5QeN7DgNK0+LHabIm8zErtUDYcqwo=";
   };
 
   unpackPhase = ''
@@ -26,7 +32,10 @@ stdenv.mkDerivation rec {
   patches = [ ./cups-filter-ppd-dirs.patch ];
 
   buildInputs = [ cups ];
-  nativeBuildInputs = [ rpm cpio ];
+  nativeBuildInputs = [
+    rpm
+    cpio
+  ];
 
   meta = with lib; {
     homepage = "http://download.ebz.epson.net/dsc/search/01/search/";
@@ -38,7 +47,11 @@ stdenv.mkDerivation rec {
       Refer to the description of epson-escpr for usage.
     '';
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ma9e ma27 shawn8901 ];
+    maintainers = with maintainers; [
+      ma9e
+      ma27
+      shawn8901
+    ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/dante/dante-1.4.3-miniupnpc-2.2.8.patch b/pkgs/servers/dante/dante-1.4.3-miniupnpc-2.2.8.patch
new file mode 100644
index 000000000000..6f55c141acd5
--- /dev/null
+++ b/pkgs/servers/dante/dante-1.4.3-miniupnpc-2.2.8.patch
@@ -0,0 +1,176 @@
+diff --git a/include/autoconf.h.in b/include/autoconf.h.in
+index bab2fcfa6c...22bc9202ca 100644
+--- a/include/autoconf.h.in
++++ b/include/autoconf.h.in
+@@ -797,6 +797,9 @@
+ /* UPNP support library 1.7 */
+ #undef HAVE_LIBMINIUPNP17
+ 
++/* UPNP support library 2.2.8 */
++#undef HAVE_LIBMINIUPNP228
++
+ /* Define to 1 if you have the `prldap60' library (-lprldap60). */
+ #undef HAVE_LIBPRLDAP60
+ 
+diff --git a/include/common.h b/include/common.h
+index 137f5ec51f...2c24759b52 100755
+--- a/include/common.h
++++ b/include/common.h
+@@ -1404,8 +1404,14 @@
+ /* return codes from UPNP_GetValidIGD(). */
+ #define UPNP_NO_IGD           (0)
+ #define UPNP_CONNECTED_IGD    (1)
++#if HAVE_LIBMINIUPNP228
++#define UPNP_RESERVED_IGD     (2)
++#define UPNP_DISCONNECTED_IGD (3)
++#define UPNP_UNKNOWN_DEVICE   (4)
++#else /* !HAVE_LIBMINIUPNP_228 */
+ #define UPNP_DISCONNECTED_IGD (2)
+ #define UPNP_UNKNOWN_DEVICE   (3)
++#endif /* !HAVE_LIBMINIUPNP_228 */
+ 
+ #define UPNP_SUCCESS          (1)
+ #define UPNP_FAILURE          (2)
+diff --git a/lib/upnp.c b/lib/upnp.c
+index d9535ca03c...dc99d53c06 100644
+--- a/lib/upnp.c
++++ b/lib/upnp.c
+@@ -154,7 +154,7 @@
+                            addrstring,
+                            NULL,
+                            0
+-#if HAVE_LIBMINIUPNP17
++#if HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228
+                           ,0,
+ 
+ #if MINIUPNPC_API_VERSION >= 14
+@@ -162,7 +162,7 @@
+ #endif /* MINIUPNPC_API_VERSION >= 14 */
+ 
+                           &rc
+-#endif /* HAVE_LIBMINIUPNP17 */
++#endif /* HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228 */
+                          );
+ 
+ #if SOCKS_CLIENT && SOCKSLIBRARY_DYNAMIC
+@@ -208,7 +208,12 @@
+          socks_autoadd_directroute(&commands, &protocols, &saddr, &smask);
+       }
+ 
++#if HAVE_LIBMINIUPNP228
++      devtype = UPNP_GetValidIGD(dev, &url, &data, myaddr, sizeof(myaddr),
++                                 NULL, 0);
++#else /* !HAVE_LIBMINIUPNP228 */
+       devtype = UPNP_GetValidIGD(dev, &url, &data, myaddr, sizeof(myaddr));
++#endif /* !HAVE_LIBMINIUPNP228 */
+       switch (devtype) {
+          case UPNP_NO_IGD:
+             snprintf(emsg, emsglen, "no UPNP IGD discovered on local network");
+@@ -226,9 +231,10 @@
+             rc = 0;
+             break;
+ 
+-         case UPNP_DISCONNECTED_IGD:
++#if HAVE_LIBMINIUPNP228
++         case UPNP_RESERVED_IGD:
+             snprintf(emsg, emsglen,
+-                    "UPNP IGD discovered at url %s, but it is not connected",
++                    "UPNP IGD discovered at url %s, but its IP is reserved",
+                     str2vis(url.controlURL,
+                            strlen(url.controlURL),
+                             vbuf,
+@@ -236,6 +242,18 @@
+ 
+             swarnx("%s: %s", function, emsg);
+             rc = -1;
++#endif /* HAVE_LIBMINIUPNP228 */
++
++         case UPNP_DISCONNECTED_IGD:
++            snprintf(emsg, emsglen,
++                    "UPNP IGD discovered at url %s, but it is not connected",
++                    str2vis(url.controlURL,
++                           strlen(url.controlURL),
++                            vbuf,
++                            sizeof(vbuf)));
++
++            swarnx("%s: %s", function, emsg);
++            rc = -1;
+             break;
+ 
+          case UPNP_UNKNOWN_DEVICE:
+@@ -273,12 +291,12 @@
+ #if HAVE_LIBMINIUPNP13
+       STRCPY_ASSERTLEN(gw->state.data.upnp.servicetype, data.servicetype);
+ 
+-#elif HAVE_LIBMINIUPNP14 || HAVE_LIBMINIUPNP17
++#elif HAVE_LIBMINIUPNP14 || HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228
+       STRCPY_ASSERTLEN(gw->state.data.upnp.servicetype, data.CIF.servicetype);
+ 
+ #else
+ #  error "unexpected miniupnp version"
+-#endif /* HAVE_LIBMINIUPNP17 */
++#endif /* HAVE_LIBMINIUPNP14 || HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228 */
+ 
+       slog(LOG_NEGOTIATE, "%s: inited ok.  controlurl: %s, servicetype: %s",
+            function,
+@@ -756,9 +774,9 @@
+                                        buf,
+                                        protocol,
+                                        NULL
+-#if HAVE_LIBMINIUPNP17
++#if HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228
+                                        ,0
+-#endif /* HAVE_LIBMINIUPNP17 */
++#endif /* HAVE_LIBMINIUPNP17 || HAVE_LIBMINIUPNP228 */
+                                        )) != UPNPCOMMAND_SUCCESS) {
+                snprintf(emsg, emsglen,
+                        "UPNP_AddPortMapping() failed: %s", strupnperror(rc));
+diff --git a/miniupnpc.m4 b/miniupnpc.m4
+index 85086d4917...ebb8875763 100644
+--- a/miniupnpc.m4
++++ b/miniupnpc.m4
+@@ -20,7 +20,7 @@
+ 	LIBS=$oLIBS
+     fi
+     if test x"${have_libminiupnp}" = xt; then
+-        AC_MSG_CHECKING([for miniupnpc version >= 1.7])
++        AC_MSG_CHECKING([for miniupnpc version >= 2.2.8])
+ 	AC_TRY_COMPILE([
+             #include <stdio.h>
+             #include <miniupnpc/miniupnpc.h>
+@@ -30,12 +30,34 @@
+             #ifndef MINIUPNPC_API_VERSION
+ 	    #error "no api version define"
+             #else
+-            # if MINIUPNPC_API_VERSION < 8
++            # if MINIUPNPC_API_VERSION < 18
+             #error "api version too low"
+             # endif
+             #endif],
+          [AC_MSG_RESULT(yes)
+           AC_DEFINE(HAVE_LIBMINIUPNP, 1, [UPNP support library])
++          AC_DEFINE(HAVE_LIBMINIUPNP228, 1, [UPNP support library 2.2.8])
++          unset no_upnp
++	  SOCKDDEPS="${SOCKDDEPS}${SOCKDDEPS:+ }$UPNPLIB"
++	  DLIBDEPS="${DLIBDEPS}${DLIBDEPS:+ }$UPNPLIB"],
++         [AC_MSG_RESULT(no)])
++
++        AC_MSG_CHECKING([for miniupnpc version >= 1.7])
++	AC_TRY_COMPILE([
++            #include <stdio.h>
++            #include <miniupnpc/miniupnpc.h>
++            #include <miniupnpc/upnpcommands.h>
++            #include <miniupnpc/upnperrors.h>], [
++
++            #ifndef MINIUPNPC_API_VERSION
++	    #error "no api version define"
++            #else
++            # if MINIUPNPC_API_VERSION < 8 || MINIUPNPC_API_VERSION > 17
++            #error "api version too low or high"
++            # endif
++            #endif],
++         [AC_MSG_RESULT(yes)
++          AC_DEFINE(HAVE_LIBMINIUPNP, 1, [UPNP support library])
+           AC_DEFINE(HAVE_LIBMINIUPNP17, 1, [UPNP support library 1.7])
+           unset no_upnp
+ 	  SOCKDDEPS="${SOCKDDEPS}${SOCKDDEPS:+ }$UPNPLIB"
diff --git a/pkgs/servers/dante/default.nix b/pkgs/servers/dante/default.nix
index 99eaa5c46458..278c518a8106 100644
--- a/pkgs/servers/dante/default.nix
+++ b/pkgs/servers/dante/default.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
     # Fixes several issues with `osint.m4` that causes incorrect check failures when using newer
     # versions of clang: missing `stdint.h` for `uint8_t` and unused `sa_len_ptr`.
     ./clang-osint-m4.patch
+    # Fixes build with miniupnpc 2.2.8.
+    ./dante-1.4.3-miniupnpc-2.2.8.patch
   ] ++ lib.optionals remove_getaddrinfo_checks [
     (fetchpatch {
       name = "0002-osdep-m4-Remove-getaddrinfo-too-low-checks.patch";
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 5757b3255b8f..9369259ff65e 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -211,6 +211,6 @@ stdenv.mkDerivation {
     license     = [ licenses.bsd2 ]
       ++ concatMap (m: m.meta.license) modules;
     platforms   = platforms.all;
-    maintainers = with maintainers; [ fpletz raitobezarius ] ++ teams.helsinki-systems.members;
+    maintainers = with maintainers; [ fpletz raitobezarius ] ++ teams.helsinki-systems.members ++ teams.stridtech.members;
   };
 }
diff --git a/pkgs/servers/http/pshs/default.nix b/pkgs/servers/http/pshs/default.nix
deleted file mode 100644
index e7715881541a..000000000000
--- a/pkgs/servers/http/pshs/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libevent, file, qrencode, miniupnpc }:
-
-stdenv.mkDerivation rec {
-  pname = "pshs";
-  version = "0.3.4";
-
-  src = fetchFromGitHub {
-    owner = "mgorny";
-    repo = "pshs";
-    rev = "v${version}";
-    sha256 = "1j8j4r0vsmp6226q6jdgf9bzhx3qk7vdliwaw7f8kcsrkndkg6p4";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libevent file qrencode miniupnpc ];
-
-  # SSL requires libevent at 2.1 with ssl support
-  configureFlags = [ "--disable-ssl" ];
-
-  meta = {
-    description = "Pretty small HTTP server - a command-line tool to share files";
-    mainProgram = "pshs";
-    homepage = "https://github.com/mgorny/pshs";
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/servers/ma1sd/default.nix b/pkgs/servers/ma1sd/default.nix
deleted file mode 100644
index a62edf64a632..000000000000
--- a/pkgs/servers/ma1sd/default.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, jre
-, git
-, gradle_7
-, perl
-, makeWrapper
-}:
-
-let
-  pname = "ma1sd";
-  version = "2.5.0";
-
-  src = fetchFromGitHub {
-    owner = "ma1uta";
-    repo = "ma1sd";
-    rev = version;
-    hash = "sha256-K3kaujAhWsRQuTMW3SZOnE7Rmu8+tDXaxpLrb45OI4A=";
-  };
-
-  gradle = gradle_7;
-
-  patches = [
-    # https://github.com/ma1uta/ma1sd/pull/122
-    (fetchpatch {
-      name = "java-16-compatibility.patch";
-      url = "https://github.com/ma1uta/ma1sd/commit/be2e2e97ce21741ca6a2e29a06f5748f45dd414e.patch";
-      hash = "sha256-dvCeK/0InNJtUG9CWrsg7BE0FGWtXuHo3TU0iFFUmIk=";
-    })
-  ];
-
-  deps = stdenv.mkDerivation {
-    pname = "${pname}-deps";
-    inherit src version patches;
-    nativeBuildInputs = [ gradle perl git ];
-
-    buildPhase = ''
-      export MA1SD_BUILD_VERSION=${version}
-      export GRADLE_USER_HOME=$(mktemp -d);
-      gradle --no-daemon build -x test
-    '';
-
-    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
-    installPhase = ''
-      find $GRADLE_USER_HOME/caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
-        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
-        | sh
-    '';
-
-    dontStrip = true;
-
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-    outputHash = "sha256-Px8FLnREBC6pADcEPn/GfhrtGnmZqjXIX7l1xPjiCvQ=";
-  };
-
-in
-stdenv.mkDerivation {
-  inherit pname src version patches;
-  nativeBuildInputs = [ gradle perl makeWrapper ];
-  buildInputs = [ jre ];
-
-  postPatch = ''
-    substituteInPlace build.gradle \
-      --replace 'gradlePluginPortal()' "" \
-      --replace 'mavenCentral()' "mavenLocal(); maven { url '${deps}' }"
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-    export MA1SD_BUILD_VERSION=${version}
-    export GRADLE_USER_HOME=$(mktemp -d)
-
-    gradle --offline --no-daemon build -x test
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    install -D build/libs/source.jar $out/lib/ma1sd.jar
-    makeWrapper ${jre}/bin/java $out/bin/ma1sd --add-flags "-jar $out/lib/ma1sd.jar"
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "Federated matrix identity server; fork of mxisd";
-    homepage = "https://github.com/ma1uta/ma1sd";
-    changelog = "https://github.com/ma1uta/ma1sd/releases/tag/${version}";
-    sourceProvenance = with sourceTypes; [
-      fromSource
-      binaryBytecode  # deps
-    ];
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ mguentner ];
-    platforms = platforms.all;
-    mainProgram = "ma1sd";
-  };
-
-}
diff --git a/pkgs/servers/miniflux/default.nix b/pkgs/servers/miniflux/default.nix
index b8206c57c490..9a9be0e85e93 100644
--- a/pkgs/servers/miniflux/default.nix
+++ b/pkgs/servers/miniflux/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "miniflux";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "miniflux";
     repo = "v2";
     rev = "refs/tags/${version}";
-    hash = "sha256-Q43ru/n7cY1DIT/JJP1sTbnXcgtbIh16fTDL9eV0YDE=";
+    hash = "sha256-1EH8KtKdAssxLk0IyhJsbrFU1obDTvmaGtFyLVlnOdQ=";
   };
 
-  vendorHash = "sha256-WCb0DxicVuJDm52GidivQPZb09LvZqJmgR5BoK8iZ7s=";
+  vendorHash = "sha256-kr2qCKuwp6Fpr0zEjggqk4Mff3V9pxGLU71lRhdRrW8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/servers/nextcloud/packages/28.json b/pkgs/servers/nextcloud/packages/28.json
index ed0f6fd9f24e..1104d2b03887 100644
--- a/pkgs/servers/nextcloud/packages/28.json
+++ b/pkgs/servers/nextcloud/packages/28.json
@@ -1,6 +1,6 @@
 {
   "bookmarks": {
-    "sha256": "1vpha2lxq199ckssnw7fc23dnk4pn1r0ipdwdqv102adpiqrfiy1",
+    "hash": "sha256-hqmX64arwllviwG7ySvdwA8IYzWoLjP2MyhT389UZXw=",
     "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.2.2/bookmarks-14.2.2.tar.gz",
     "version": "14.2.2",
     "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- ☠ Find broken links and duplicates\n- 📲 Synchronize with all your browsers and devices\n- 📔 Store archived versions of your links in case they are depublished\n- 🔍 Full-text search on site contents\n- 👪 Share bookmarks with other users and via public links\n- ⚛ Generate RSS feeds of your collections\n- 📈 Stats on how often you access which links\n- 🔒 Automatic backups of your bookmarks collection\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
@@ -10,9 +10,9 @@
     ]
   },
   "calendar": {
-    "sha256": "09rsp5anpaqzwmrixza5qh12vmq9hd3an045064vm3rnynz537qc",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.7.6/calendar-v4.7.6.tar.gz",
-    "version": "4.7.6",
+    "hash": "sha256-hEsQpCtqabG+TiHdUa8aMUtQDM7uHMr7+XQZArSR3wI=",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.7.11/calendar-v4.7.11.tar.gz",
+    "version": "4.7.11",
     "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
     "homepage": "https://github.com/nextcloud/calendar/",
     "licenses": [
@@ -20,7 +20,7 @@
     ]
   },
   "contacts": {
-    "sha256": "0xyrkr5p7xa8cn33kgx1hyblpbsdzaakpfm5bk6w9sm71a42688w",
+    "hash": "sha256-zxmgMiizzXGfReRS9XJ+fb6tJRLH/Z5NvuLpspYARFI=",
     "url": "https://github.com/nextcloud-releases/contacts/releases/download/v5.5.3/contacts-v5.5.3.tar.gz",
     "version": "5.5.3",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
@@ -30,9 +30,9 @@
     ]
   },
   "cookbook": {
-    "sha256": "0wd4vwfp4i8hfrlqfzac517iqfhzxy1sv0ryb96489q9fvbcvlnp",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.0/cookbook-0.11.0.tar.gz",
-    "version": "0.11.0",
+    "hash": "sha256-QRzXNoqOeEYYp0ctmsNisbQL5PWFOeqEVkcFeCduQtY=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.1/cookbook-0.11.1.tar.gz",
+    "version": "0.11.1",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -40,7 +40,7 @@
     ]
   },
   "cospend": {
-    "sha256": "04cpsd638p8midpznbz0nhdmcm5zfgq9n6yh1xifnvmfkd5k2wj0",
+    "hash": "sha256-J6w+ZqFNZbJeaPuZOZ4OQ+O+VhIQ0XajqYZuHqvjL24=",
     "url": "https://github.com/julien-nc/cospend-nc/releases/download/v1.6.1/cospend-1.6.1.tar.gz",
     "version": "1.6.1",
     "description": "# Nextcloud Cospend 💰\n\nNextcloud Cospend is a group/shared budget manager. It was inspired by the great [IHateMoney](https://github.com/spiral-project/ihatemoney/).\n\nYou can use it when you share a house, when you go on vacation with friends, whenever you share expenses with a group of people.\n\nIt lets you create projects with members and bills. Each member has a balance computed from the project bills. Balances are not an absolute amount of money at members disposal but rather a relative information showing if a member has spent more for the group than the group has spent for her/him, independently of exactly who spent money for whom. This way you can see who owes the group and who the group owes. Ultimately you can ask for a settlement plan telling you which payments to make to reset members balances.\n\nProject members are independent from Nextcloud users. Projects can be shared with other Nextcloud users or via public links.\n\n[MoneyBuster](https://gitlab.com/eneiluj/moneybuster) Android client is [available in F-Droid](https://f-droid.org/packages/net.eneiluj.moneybuster/) and on the [Play store](https://play.google.com/store/apps/details?id=net.eneiluj.moneybuster).\n\n[PayForMe](https://github.com/mayflower/PayForMe) iOS client is currently under developpement!\n\nThe private and public APIs are documented using [the Nextcloud OpenAPI extractor](https://github.com/nextcloud/openapi-extractor/). This documentation can be accessed directly in Nextcloud. All you need is to install Cospend (>= v1.6.0) and use the [the OCS API Viewer app](https://apps.nextcloud.com/apps/ocs_api_viewer) to browse the OpenAPI documentation.\n\n## Features\n\n* ✎ Create/edit/delete projects, members, bills, bill categories, currencies\n* ⚖ Check member balances\n* 🗠 Display project statistics\n* ♻ Display settlement plan\n* Move bills from one project to another\n* Move bills to trash before actually deleting them\n* Archive old projects before deleting them\n* 🎇 Automatically create reimbursement bills from settlement plan\n* 🗓 Create recurring bills (day/week/month/year)\n* 📊 Optionally provide custom amount for each member in new bills\n* 🔗 Link personal files to bills (picture of physical receipt for example)\n* 👩 Public links for people outside Nextcloud (can be password protected)\n* 👫 Share projects with Nextcloud users/groups/circles\n* 🖫 Import/export projects as csv (compatible with csv files from IHateMoney and SplitWise)\n* 🔗 Generate link/QRCode to easily add projects in MoneyBuster\n* 🗲 Implement Nextcloud notifications and activity stream\n\nThis app usually support the 2 or 3 last major versions of Nextcloud.\n\nThis app is under development.\n\n🌍 Help us to translate this app on [Nextcloud-Cospend/MoneyBuster Crowdin project](https://crowdin.com/project/moneybuster).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://github.com/julien-nc/cospend-nc/blob/master/CONTRIBUTING.md).\n\n## Documentation\n\n* [User documentation](https://github.com/julien-nc/cospend-nc/blob/master/docs/user.md)\n* [Admin documentation](https://github.com/julien-nc/cospend-nc/blob/master/docs/admin.md)\n* [Developer documentation](https://github.com/julien-nc/cospend-nc/blob/master/docs/dev.md)\n* [CHANGELOG](https://github.com/julien-nc/cospend-nc/blob/master/CHANGELOG.md#change-log)\n* [AUTHORS](https://github.com/julien-nc/cospend-nc/blob/master/AUTHORS.md#authors)\n\n## Known issues\n\n* It does not make you rich\n\nAny feedback will be appreciated.\n\n\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
@@ -50,9 +50,9 @@
     ]
   },
   "deck": {
-    "sha256": "0s8zhmqj3h4ajiwvki5bdxrbzckq9l8pr04hz6vs7jx3hpanj22g",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.12.2/deck-v1.12.2.tar.gz",
-    "version": "1.12.2",
+    "hash": "sha256-xvFnjkvonObhVjpM9kQNVlwpuDhWuTsdXXsAgSWypZo=",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.12.3/deck-v1.12.3.tar.gz",
+    "version": "1.12.3",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -60,7 +60,7 @@
     ]
   },
   "end_to_end_encryption": {
-    "sha256": "04b2hj96gpb4sf1w5r1sxa4fmxrk36vr3pia8i5w2pfi6fbhd9mc",
+    "hash": "sha256-+4RlbVoCnncygsPWdLCWgKZXXaC10risgd4b8uMRJO0=",
     "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v1.14.5/end_to_end_encryption-v1.14.5.tar.gz",
     "version": "1.14.5",
     "description": "Provides the necessary endpoint to enable end-to-end encryption.\n\n**Notice:** E2EE is currently not compatible to be used together with server-side encryption",
@@ -70,7 +70,7 @@
     ]
   },
   "forms": {
-    "sha256": "1hwc7ra12nsr79xp8lkv3ip46bxxbjpaglb0a4k06ikfnzjaddny",
+    "hash": "sha256-OqqorHVWCDicQKnTxEJjeXzDrsj98vWvtWYyaRmDsUs=",
     "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.2.4/forms-v4.2.4.tar.gz",
     "version": "4.2.4",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
@@ -80,7 +80,7 @@
     ]
   },
   "gpoddersync": {
-    "sha256": "1hk052864mb49crmsy2m9alv22rk7ns6m6q7l372j7py9gr8rf60",
+    "hash": "sha256-e4RtBCPtk8jIK+p4tGfukLmC8ikhAD7GiRSmmkWciZQ=",
     "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.9.0/gpoddersync.tar.gz",
     "version": "3.9.0",
     "description": "Expose GPodder API to sync podcast consumer apps like AntennaPod",
@@ -90,7 +90,7 @@
     ]
   },
   "groupfolders": {
-    "sha256": "17lhmj4ndxp7h0fxmxk3f3dwhs44mplxpyfb6nb5ia2dm8i858w1",
+    "hash": "sha256-a22KP20fE+cpOuv2erl3qUu4glWArx5oISFlI8vxAQc=",
     "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v16.0.7/groupfolders-v16.0.7.tar.gz",
     "version": "16.0.7",
     "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
@@ -100,7 +100,7 @@
     ]
   },
   "impersonate": {
-    "sha256": "0l1wmsiycwnn5py1mdc87paqlciclndrk72yf0ff7k11vidgb7mp",
+    "hash": "sha256-fJ96PmkRvgmoIYmF7r/zOQ88/tjb6d0+sQ1YbKq8sY8=",
     "url": "https://github.com/nextcloud-releases/impersonate/releases/download/v1.15.0/impersonate-v1.15.0.tar.gz",
     "version": "1.15.0",
     "description": "By installing the impersonate app of your Nextcloud you enable administrators to impersonate other users on the Nextcloud server. This is especially useful for debugging issues reported by users.\n\nTo impersonate a user an administrator has to simply follow the following four steps:\n\n1. Login as administrator to Nextcloud.\n2. Open users administration interface.\n3. Select the impersonate button on the affected user.\n4. Confirm the impersonation.\n\nThe administrator is then logged-in as the user, to switch back to the regular user account they simply have to press the logout button.\n\n**Note:**\n\n- This app is not compatible with instances that have encryption enabled.\n- While impersonate actions are logged note that actions performed impersonated will be logged as the impersonated user.\n- Impersonating a user is only possible after their first login.\n- You can limit which users/groups can use impersonation in Administration settings > Additional settings.",
@@ -110,9 +110,9 @@
     ]
   },
   "integration_openai": {
-    "sha256": "0q5fs57n644mad4qvr7pb46dljmdnl4c9wkh2kdhaqnmjsa7zs8j",
-    "url": "https://github.com/nextcloud-releases/integration_openai/releases/download/v2.0.1/integration_openai-v2.0.1.tar.gz",
-    "version": "2.0.1",
+    "hash": "sha256-qU86h6DHNetWOmt7yXCknQ3MBB9KdQ15UDJggqZgWMk=",
+    "url": "https://github.com/nextcloud-releases/integration_openai/releases/download/v2.0.3/integration_openai-v2.0.3.tar.gz",
+    "version": "2.0.3",
     "description": "⚠️ The smart pickers have been removed from this app\nas they are now included in the [Assistant app](https://apps.nextcloud.com/apps/assistant).\n\nThis app implements:\n\n* Text generation providers: Free prompt, Summarize, Headline and Reformulate (using any available large language model)\n* A Translation provider (using any available language model)\n* A SpeechToText provider (using Whisper)\n* An image generation provider\n\nInstead of connecting to the OpenAI API for these, you can also connect to a self-hosted [LocalAI](https://localai.io) instance\nor to any service that implements an API similar to the OpenAI one, for example: [Plusserver](https://www.plusserver.com/en/ai-platform/) or [MistralAI](https://mistral.ai).\n\n## Ethical AI Rating\n### Rating for Text generation using ChatGPT via OpenAI API: 🔴\n\nNegative:\n* the software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* the trained model is not freely available, so the model can not be run on-premises\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n\n### Rating for Translation using ChatGPT via OpenAI API: 🔴\n\nNegative:\n* the software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* the trained model is not freely available, so the model can not be run on-premises\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n### Rating for Image generation using DALL·E via OpenAI API: 🔴\n\nNegative:\n* the software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* the trained model is not freely available, so the model can not be ran on-premises\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via OpenAI API: 🟡\n\nPositive:\n* the software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can run on-premise\n\nNegative:\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n### Rating for Text generation via LocalAI: 🟢\n\nPositive:\n* the software for training and inferencing of this model is open source\n* the trained model is freely available, and thus can be ran on-premises\n* the training data is freely available, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n\n### Rating for Image generation using Stable Diffusion via LocalAI : 🟡\n\nPositive:\n* the software for training and inferencing of this model is open source\n* the trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via LocalAI: 🟡\n\nPositive:\n* the software for training and inferencing of this model is open source\n* the trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/integration_openai",
     "licenses": [
@@ -120,7 +120,7 @@
     ]
   },
   "integration_paperless": {
-    "sha256": "08rgdlinxpcwyq0f97ibv022qhj8smk94dvlf927xq46220w9pfx",
+    "hash": "sha256-ARjs8cCUJICJaZiMIIt/lYk15WlXzzRqAQBWwax6HY4=",
     "url": "https://github.com/nextcloud-releases/integration_paperless/releases/download/v1.0.3/integration_paperless-v1.0.3.tar.gz",
     "version": "1.0.3",
     "description": "Integration with the [Paperless](https://docs.paperless-ngx.com) Document Management System.\nIt adds a file action menu item that can be used to upload a file from your Nextcloud Files to Paperless.",
@@ -130,7 +130,7 @@
     ]
   },
   "mail": {
-    "sha256": "0bxbzibzsdqmd751759lg3vwhw9nyy5n37snijd083s1498sfqs5",
+    "hash": "sha256-4UlifHmX+3yX53RUIV9DVyj/nuttg25HNdaQjBQxXrs=",
     "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.2/mail-v3.7.2.tar.gz",
     "version": "3.7.2",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
@@ -140,7 +140,7 @@
     ]
   },
   "maps": {
-    "sha256": "1gqms3rrdpjmpb1h5d72b4lwbvsl8p10zwnkhgnsmvfcf93h3r1c",
+    "hash": "sha256-BmXs6Oepwnm+Cviy4awm3S8P9AiJTt1BnAQNb4TxVYE=",
     "url": "https://github.com/nextcloud/maps/releases/download/v1.4.0/maps-1.4.0.tar.gz",
     "version": "1.4.0",
     "description": "**The whole world fits inside your cloud!**\n\n- **🗺 Beautiful map:** Using [OpenStreetMap](https://www.openstreetmap.org) and [Leaflet](https://leafletjs.com), you can choose between standard map, satellite, topographical, dark mode or even watercolor! 🎨\n- **⭐ Favorites:** Save your favorite places, privately! Sync with [GNOME Maps](https://github.com/nextcloud/maps/issues/30) and mobile apps is planned.\n- **🧭 Routing:** Possible using either [OSRM](http://project-osrm.org), [GraphHopper](https://www.graphhopper.com) or [Mapbox](https://www.mapbox.com).\n- **🖼 Photos on the map:** No more boring slideshows, just show directly where you were!\n- **🙋 Contacts on the map:** See where your friends live and plan your next visit.\n- **📱 Devices:** Lost your phone? Check the map!\n- **〰 Tracks:** Load GPS tracks or past trips. Recording with [PhoneTrack](https://f-droid.org/en/packages/net.eneiluj.nextcloud.phonetrack/) or [OwnTracks](https://owntracks.org) is planned.",
@@ -150,17 +150,17 @@
     ]
   },
   "memories": {
-    "sha256": "1wahnkc253bgm0bqciyhfh1iyl8girbj8mzdd29l0k1bks8fr4qc",
+    "hash": "sha256-tzxeffvwMwthvBRG+/cLCXZkVS32rlf5v7XOKTbGoOo=",
     "url": "https://github.com/pulsejet/memories/releases/download/v7.3.1/memories.tar.gz",
     "version": "7.3.1",
-    "description": "# Memories: Photo Management for Nextcloud\n\nMemories is a *batteries-included* photo management solution for Nextcloud with advanced features including:\n\n- **📸 Timeline**: Sort photos and videos by date taken, parsed from Exif data.\n- **⏪ Rewind**: Jump to any time in the past instantly and relive your memories.\n- **🤖 AI Tagging**: Group photos by people and objects, powered by [recognize](https://github.com/nextcloud/recognize) and [facerecognition](https://github.com/matiasdelellis/facerecognition).\n- **🖼️ Albums**: Create albums to group photos and videos together. Then share these albums with others.\n- **🫱🏻‍🫲🏻 External Sharing**: Share photos and videos with people outside of your Nextcloud instance.\n- **📱 Mobile Support**: Work from any device, of any shape and size through the web app.\n- **✏️ Edit Metadata**: Edit dates and other metadata on photos quickly and in bulk.\n- **📦 Archive**: Store photos you don't want to see in your timeline in a separate folder.\n- **📹 Video Transcoding**: Transcode videos and use HLS for maximal performance.\n- **🗺️ Map**: View your photos on a map, tagged with accurate reverse geocoding.\n- **📦 Migration**: Migrate easily from Nextcloud Photos and Google Takeout.\n- **⚡️ Performance**: Do all this very fast.\n\n## 🚀 Installation\n\n1. Install the app from the Nextcloud app store (try a demo [here](https://demo.memories.gallery/apps/memories/)).\n1. Perform the recommended [configuration steps](https://memories.gallery/config/).\n1. Run `php occ memories:index` to generate metadata indices for existing photos.\n1. Open the 📷 Memories app in Nextcloud and set the directory containing your photos.",
+    "description": "# Memories: Photo Management for Nextcloud\r\n\r\nMemories is a *batteries-included* photo management solution for Nextcloud with advanced features including:\r\n\r\n- **📸 Timeline**: Sort photos and videos by date taken, parsed from Exif data.\r\n- **⏪ Rewind**: Jump to any time in the past instantly and relive your memories.\r\n- **🤖 AI Tagging**: Group photos by people and objects, powered by [recognize](https://github.com/nextcloud/recognize) and [facerecognition](https://github.com/matiasdelellis/facerecognition).\r\n- **🖼️ Albums**: Create albums to group photos and videos together. Then share these albums with others.\r\n- **🫱🏻‍🫲🏻 External Sharing**: Share photos and videos with people outside of your Nextcloud instance.\r\n- **📱 Mobile Support**: Work from any device, of any shape and size through the web app.\r\n- **✏️ Edit Metadata**: Edit dates and other metadata on photos quickly and in bulk.\r\n- **📦 Archive**: Store photos you don't want to see in your timeline in a separate folder.\r\n- **📹 Video Transcoding**: Transcode videos and use HLS for maximal performance.\r\n- **🗺️ Map**: View your photos on a map, tagged with accurate reverse geocoding.\r\n- **📦 Migration**: Migrate easily from Nextcloud Photos and Google Takeout.\r\n- **⚡️ Performance**: Do all this very fast.\r\n\r\n## 🚀 Installation\r\n\r\n1. Install the app from the Nextcloud app store (try a demo [here](https://demo.memories.gallery/apps/memories/)).\r\n1. Perform the recommended [configuration steps](https://memories.gallery/config/).\r\n1. Run `php occ memories:index` to generate metadata indices for existing photos.\r\n1. Open the 📷 Memories app in Nextcloud and set the directory containing your photos.",
     "homepage": "https://memories.gallery",
     "licenses": [
       "agpl"
     ]
   },
   "music": {
-    "sha256": "17anhb0zcky4fwmbj1czm536d7k8n03iwsn3dqnyq1b9c4bqyj4m",
+    "hash": "sha256-RnTyQYCbmkHDZhtonpvbKLUM3n93u53IhknyTrNGh9Y=",
     "url": "https://github.com/owncloud/music/releases/download/v2.0.0/music_2.0.0_for_nextcloud.tar.gz",
     "version": "2.0.0",
     "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone",
@@ -170,7 +170,7 @@
     ]
   },
   "notes": {
-    "sha256": "0j9bwbfvwwdaabyc79i514sp36cm4i9z02l8bkxlqr9fvim73nn9",
+    "hash": "sha256-av6y5GViTzlHtnUb/OIDw+0wdA/ZRwPYQMU3yDEbMTQ=",
     "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.10.0/notes.tar.gz",
     "version": "4.10.0",
     "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into third-party apps (currently, there are notes apps for [Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios) and the [console](https://git.danielmoch.com/nncli/about) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
@@ -180,7 +180,7 @@
     ]
   },
   "notify_push": {
-    "sha256": "14s8g3dqwrxjz1zww64n1lhwdb8374wr1b5v76xhawypmfz2a68h",
+    "hash": "sha256-Qv9pvOej/omXfAAkPXC/DBTbJVCg/DarkJDhLuTjjpQ=",
     "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.12/notify_push-v0.6.12.tar.gz",
     "version": "0.6.12",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
@@ -190,9 +190,9 @@
     ]
   },
   "onlyoffice": {
-    "sha256": "1vflj70q8d0hrfck9c5l1k4qa38gpdh3zjgx4aqamnlbvkfssk7h",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.2.2/onlyoffice.tar.gz",
-    "version": "9.2.2",
+    "hash": "sha256-rHUM3HVY3INPAtTqYxpm9V3Ad8VTl+Wd2S7xAj0CJko=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.3.0/onlyoffice.tar.gz",
+    "version": "9.3.0",
     "description": "ONLYOFFICE connector allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
@@ -200,7 +200,7 @@
     ]
   },
   "phonetrack": {
-    "sha256": "1i28xgzp85yb44ay2l2zw18fk00yd6fh6yddj92gdrljb3w9zpap",
+    "hash": "sha256-zQt+3t86HZJVT/wiETHkPdTwV6Qy+iNkH3/THtTe1Xs=",
     "url": "https://github.com/julien-nc/phonetrack/releases/download/v0.8.1/phonetrack-0.8.1.tar.gz",
     "version": "0.8.1",
     "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n* Create a tracking session.\n* Give the logging link\\* to the mobile devices. Choose the [logging method](https://gitlab.com/eneiluj/phonetrack-oc/wikis/userdoc#logging-methods) you prefer.\n* Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name. Setting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n* 📍 Display location history\n* ⛛ Filter points\n* ✎ Manually edit/add/delete points\n* ✎ Edit devices (rename, change colour/shape, move to another session)\n* ⛶ Define geofencing zones for devices\n* ⚇ Define proximity alerts for device pairs\n* 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n* 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n* 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n* 🗠 Display sessions statistics\n* 🔒 [Reserve a device name](https://gitlab.com/eneiluj/phonetrack-oc/wikis/userdoc#device-name-reservation) to make sure only authorised user can log with this name\n* 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n* ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is tested on Nextcloud 17 with Firefox 57+ and Chromium.\n\nThis app is compatible with theming colours and accessibility themes !\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n* PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
@@ -210,9 +210,9 @@
     ]
   },
   "polls": {
-    "sha256": "1s8ym7msl4cax69kr2piphgapllsva1vjh2xb7g03yb7z1hglhjs",
-    "url": "https://github.com/nextcloud/polls/releases/download/v7.1.2/polls.tar.gz",
-    "version": "7.1.2",
+    "hash": "sha256-s2S9RyhaRrs06UYH92OvObSiw+eVx2JDwI1A6YxfiYA=",
+    "url": "https://github.com/nextcloud/polls/releases/download/v7.1.3/polls.tar.gz",
+    "version": "7.1.3",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -220,7 +220,7 @@
     ]
   },
   "previewgenerator": {
-    "sha256": "0505kg4pxa6dqylniwa5ip6h5bama8cp0ng2y7prhb93mnhgr051",
+    "hash": "sha256-12ntS+OgT26AIi7b8x7w6ixm9OKFx2+ePxKGOea2RwA=",
     "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.5.0/previewgenerator-v5.5.0.tar.gz",
     "version": "5.5.0",
     "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**./occ preview:generate-all -vvv**\n\n**Important**: To enable pre-generation of previews you must add **php /var/www/nextcloud/occ preview:pre-generate** to a system cron job that runs at times of your choosing.",
@@ -230,7 +230,7 @@
     ]
   },
   "qownnotesapi": {
-    "sha256": "0y4cv4hagmax4nkdfzysd5fg2h2xak4m87waf3b0ci5f1bwdxdxx",
+    "hash": "sha256-k1Sm0ZO9qx9KmAGCGYupcLeMSllKUmOlPSUgbWVrqI4=",
     "url": "https://github.com/pbek/qownnotesapi/releases/download/v24.4.0/qownnotesapi-nc.tar.gz",
     "version": "24.4.0",
     "description": "QOwnNotesAPI is the Nextcloud/ownCloud API for [QOwnNotes](http://www.qownnotes.org), the open source notepad for Linux, macOS and Windows, that works together with the notes application of Nextcloud/ownCloud.\n\nThe only purpose of this App is to provide API access to your Nextcloud/ownCloud server for your QOwnNotes desktop installation, you cannot use this App for anything else, if you don't have QOwnNotes installed on your desktop computer!",
@@ -240,7 +240,7 @@
     ]
   },
   "registration": {
-    "sha256": "1ih7nfswskzpgbqfjsn4lym4cwyq4kbjv9m9cmy4g4nx44gr0dkl",
+    "hash": "sha256-4MLNKwYx/3hqnrcF2TpTCKOMveWINvWo71aOXcBO79E=",
     "url": "https://github.com/nextcloud-releases/registration/releases/download/v2.4.0/registration-v2.4.0.tar.gz",
     "version": "2.4.0",
     "description": "User registration\n\nThis app allows users to register a new account.\n\n# Features\n\n- Add users to a given group\n- Allow-list with email domains (including wildcard) to register with\n- Administrator will be notified via email for new user creation or require approval\n- Supports Nextcloud's Client Login Flow v1 and v2 - allowing registration in the mobile Apps and Desktop clients\n\n# Web form registration flow\n\n1. User enters their email address\n2. Verification link is sent to the email address\n3. User clicks on the verification link\n4. User is lead to a form where they can choose their username and password\n5. New account is created and is logged in automatically",
@@ -250,7 +250,7 @@
     ]
   },
   "richdocuments": {
-    "sha256": "0lxbdyvmwsrj9qsb3w3f6si6sydddb4p96rvhrsardq96pam3xwz",
+    "hash": "sha256-GtjSEiYrZPYq7fPfKuilxPvScONAPI83cqdAor6/+oo=",
     "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.3.8/richdocuments-v8.3.8.tar.gz",
     "version": "8.3.8",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
@@ -260,9 +260,9 @@
     ]
   },
   "spreed": {
-    "sha256": "0mz6cb2janafday60dw7ga42c67lpqzjpw0gli6jj90pzcc4by72",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v18.0.8/spreed-v18.0.8.tar.gz",
-    "version": "18.0.8",
+    "hash": "sha256-kKdMx8KXQQ5RemdINtiZG+zJGpDSn7TYlTMYG7GHIhI=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v18.0.10/spreed-v18.0.10.tar.gz",
+    "version": "18.0.10",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
@@ -270,7 +270,7 @@
     ]
   },
   "tasks": {
-    "sha256": "1g2wqsm9kjm7dri75ghix2hb5vby3vy3ibcvmwfdwsab3a12xbrg",
+    "hash": "sha256-HitYQcdURUHujRNMF0jKQzvSO93bItisI0emq0yw8p4=",
     "url": "https://github.com/nextcloud/tasks/releases/download/v0.16.0/tasks.tar.gz",
     "version": "0.16.0",
     "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
@@ -280,7 +280,7 @@
     ]
   },
   "twofactor_nextcloud_notification": {
-    "sha256": "0qpg6i6iw6ldnryf0p56kd7fgs5vyckw9m6yjcf8r4j3mwfka273",
+    "hash": "sha256-4fXWgDeiup5/Gm9hdZDj/u07rp/Nzwly53aLUT/d0IU=",
     "url": "https://github.com/nextcloud-releases/twofactor_nextcloud_notification/releases/download/v3.9.0/twofactor_nextcloud_notification-v3.9.0.tar.gz",
     "version": "3.9.0",
     "description": "Allows using any of your logged in devices as second factor",
@@ -290,7 +290,7 @@
     ]
   },
   "twofactor_webauthn": {
-    "sha256": "0llxakzcdcy9hscyzw3na5zp1p57h03w5fmm0gs9g62k1b88k6kw",
+    "hash": "sha256-2qvP6xZO7ZdCZkOSP4FNqyjZ0GMcw/FDSy67JDrlM04=",
     "url": "https://github.com/nextcloud-releases/twofactor_webauthn/releases/download/v1.4.0/twofactor_webauthn-v1.4.0.tar.gz",
     "version": "1.4.0",
     "description": "A two-factor provider for WebAuthn devices",
@@ -300,7 +300,7 @@
     ]
   },
   "unroundedcorners": {
-    "sha256": "16h8zg7k18r01yx2a72bn22nmvbafrs3ksyy23fbrnirzgwcaaqf",
+    "hash": "sha256-sdgc2ENnRkcQnopbqsn/FHYDoiKqeKfYEontFy0cYU4=",
     "url": "https://github.com/OliverParoczai/nextcloud-unroundedcorners/releases/download/v1.1.3/unroundedcorners-v1.1.3.tar.gz",
     "version": "1.1.3",
     "description": "# Unrounded Corners\nA Nextcloud app that restores the corners of buttons and widgets to their original looks by unrounding them.",
@@ -310,7 +310,7 @@
     ]
   },
   "user_oidc": {
-    "sha256": "1qarpmwk66mz6mvif0cc4jb7wi4yv76flzwhyvmzxk0ahafpi8x1",
+    "hash": "sha256-feBnHhVXR3B6SKPWx2rWDAjEERV1GMQ4NVlmoRLukJE=",
     "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v5.0.3/user_oidc-v5.0.3.tar.gz",
     "version": "5.0.3",
     "description": "Allows flexible configuration of an OIDC server as Nextcloud login user backend.",
@@ -320,7 +320,7 @@
     ]
   },
   "user_saml": {
-    "sha256": "1dw5mwzzlhfwarnnpsij3l6153psl83qkjmgm0bnipy4v8wkkqvj",
+    "hash": "sha256-OHIiM4krCTxAN6g+Obn1GONduLmUf0eqrsjjP6ziY2M=",
     "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v6.1.3/user_saml-v6.1.3.tar.gz",
     "version": "6.1.3",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
diff --git a/pkgs/servers/nextcloud/packages/29.json b/pkgs/servers/nextcloud/packages/29.json
index a082acb744bc..4c72373274da 100644
--- a/pkgs/servers/nextcloud/packages/29.json
+++ b/pkgs/servers/nextcloud/packages/29.json
@@ -1,6 +1,6 @@
 {
   "bookmarks": {
-    "sha256": "1vpha2lxq199ckssnw7fc23dnk4pn1r0ipdwdqv102adpiqrfiy1",
+    "hash": "sha256-hqmX64arwllviwG7ySvdwA8IYzWoLjP2MyhT389UZXw=",
     "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.2.2/bookmarks-14.2.2.tar.gz",
     "version": "14.2.2",
     "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- ☠ Find broken links and duplicates\n- 📲 Synchronize with all your browsers and devices\n- 📔 Store archived versions of your links in case they are depublished\n- 🔍 Full-text search on site contents\n- 👪 Share bookmarks with other users and via public links\n- ⚛ Generate RSS feeds of your collections\n- 📈 Stats on how often you access which links\n- 🔒 Automatic backups of your bookmarks collection\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
@@ -10,9 +10,9 @@
     ]
   },
   "calendar": {
-    "sha256": "09rsp5anpaqzwmrixza5qh12vmq9hd3an045064vm3rnynz537qc",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.7.6/calendar-v4.7.6.tar.gz",
-    "version": "4.7.6",
+    "hash": "sha256-hEsQpCtqabG+TiHdUa8aMUtQDM7uHMr7+XQZArSR3wI=",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.7.11/calendar-v4.7.11.tar.gz",
+    "version": "4.7.11",
     "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
     "homepage": "https://github.com/nextcloud/calendar/",
     "licenses": [
@@ -20,7 +20,7 @@
     ]
   },
   "contacts": {
-    "sha256": "0yxp3477fx4mrds8wchhzavrxwm88dvz7s58zp59q1v7qr9i7whr",
+    "hash": "sha256-48ERJ9DQ9w71encT2XVvcVaV+EbthgExQliKO1sQ+1A=",
     "url": "https://github.com/nextcloud-releases/contacts/releases/download/v6.0.0/contacts-v6.0.0.tar.gz",
     "version": "6.0.0",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
@@ -30,9 +30,9 @@
     ]
   },
   "cookbook": {
-    "sha256": "0wd4vwfp4i8hfrlqfzac517iqfhzxy1sv0ryb96489q9fvbcvlnp",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.0/cookbook-0.11.0.tar.gz",
-    "version": "0.11.0",
+    "hash": "sha256-QRzXNoqOeEYYp0ctmsNisbQL5PWFOeqEVkcFeCduQtY=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.1/cookbook-0.11.1.tar.gz",
+    "version": "0.11.1",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -40,7 +40,7 @@
     ]
   },
   "cospend": {
-    "sha256": "04cpsd638p8midpznbz0nhdmcm5zfgq9n6yh1xifnvmfkd5k2wj0",
+    "hash": "sha256-J6w+ZqFNZbJeaPuZOZ4OQ+O+VhIQ0XajqYZuHqvjL24=",
     "url": "https://github.com/julien-nc/cospend-nc/releases/download/v1.6.1/cospend-1.6.1.tar.gz",
     "version": "1.6.1",
     "description": "# Nextcloud Cospend 💰\n\nNextcloud Cospend is a group/shared budget manager. It was inspired by the great [IHateMoney](https://github.com/spiral-project/ihatemoney/).\n\nYou can use it when you share a house, when you go on vacation with friends, whenever you share expenses with a group of people.\n\nIt lets you create projects with members and bills. Each member has a balance computed from the project bills. Balances are not an absolute amount of money at members disposal but rather a relative information showing if a member has spent more for the group than the group has spent for her/him, independently of exactly who spent money for whom. This way you can see who owes the group and who the group owes. Ultimately you can ask for a settlement plan telling you which payments to make to reset members balances.\n\nProject members are independent from Nextcloud users. Projects can be shared with other Nextcloud users or via public links.\n\n[MoneyBuster](https://gitlab.com/eneiluj/moneybuster) Android client is [available in F-Droid](https://f-droid.org/packages/net.eneiluj.moneybuster/) and on the [Play store](https://play.google.com/store/apps/details?id=net.eneiluj.moneybuster).\n\n[PayForMe](https://github.com/mayflower/PayForMe) iOS client is currently under developpement!\n\nThe private and public APIs are documented using [the Nextcloud OpenAPI extractor](https://github.com/nextcloud/openapi-extractor/). This documentation can be accessed directly in Nextcloud. All you need is to install Cospend (>= v1.6.0) and use the [the OCS API Viewer app](https://apps.nextcloud.com/apps/ocs_api_viewer) to browse the OpenAPI documentation.\n\n## Features\n\n* ✎ Create/edit/delete projects, members, bills, bill categories, currencies\n* ⚖ Check member balances\n* 🗠 Display project statistics\n* ♻ Display settlement plan\n* Move bills from one project to another\n* Move bills to trash before actually deleting them\n* Archive old projects before deleting them\n* 🎇 Automatically create reimbursement bills from settlement plan\n* 🗓 Create recurring bills (day/week/month/year)\n* 📊 Optionally provide custom amount for each member in new bills\n* 🔗 Link personal files to bills (picture of physical receipt for example)\n* 👩 Public links for people outside Nextcloud (can be password protected)\n* 👫 Share projects with Nextcloud users/groups/circles\n* 🖫 Import/export projects as csv (compatible with csv files from IHateMoney and SplitWise)\n* 🔗 Generate link/QRCode to easily add projects in MoneyBuster\n* 🗲 Implement Nextcloud notifications and activity stream\n\nThis app usually support the 2 or 3 last major versions of Nextcloud.\n\nThis app is under development.\n\n🌍 Help us to translate this app on [Nextcloud-Cospend/MoneyBuster Crowdin project](https://crowdin.com/project/moneybuster).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://github.com/julien-nc/cospend-nc/blob/master/CONTRIBUTING.md).\n\n## Documentation\n\n* [User documentation](https://github.com/julien-nc/cospend-nc/blob/master/docs/user.md)\n* [Admin documentation](https://github.com/julien-nc/cospend-nc/blob/master/docs/admin.md)\n* [Developer documentation](https://github.com/julien-nc/cospend-nc/blob/master/docs/dev.md)\n* [CHANGELOG](https://github.com/julien-nc/cospend-nc/blob/master/CHANGELOG.md#change-log)\n* [AUTHORS](https://github.com/julien-nc/cospend-nc/blob/master/AUTHORS.md#authors)\n\n## Known issues\n\n* It does not make you rich\n\nAny feedback will be appreciated.\n\n\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
@@ -50,9 +50,9 @@
     ]
   },
   "deck": {
-    "sha256": "00cip1c0h7jhqrmj2vrbac5cajk8dql6pky2iw77g0dkjssqlgza",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.13.0/deck-v1.13.0.tar.gz",
-    "version": "1.13.0",
+    "hash": "sha256-yJJS85Ll+lBN61v+q3q15RI9T9zlUKnq/b+QvcYQtuU=",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.13.1/deck-v1.13.1.tar.gz",
+    "version": "1.13.1",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -60,7 +60,7 @@
     ]
   },
   "end_to_end_encryption": {
-    "sha256": "0hjq7qmp9psvq1vbak473wwfjdymay0l2d2h3vnssjqqw2kqf5dw",
+    "hash": "sha256-yqdu04S5o7koJQIlwwyL1KfIIxEWoZ/9H8ePGV/urjU=",
     "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v1.15.2/end_to_end_encryption-v1.15.2.tar.gz",
     "version": "1.15.2",
     "description": "Provides the necessary endpoint to enable end-to-end encryption.\n\n**Notice:** E2EE is currently not compatible to be used together with server-side encryption",
@@ -70,7 +70,7 @@
     ]
   },
   "forms": {
-    "sha256": "1hwc7ra12nsr79xp8lkv3ip46bxxbjpaglb0a4k06ikfnzjaddny",
+    "hash": "sha256-OqqorHVWCDicQKnTxEJjeXzDrsj98vWvtWYyaRmDsUs=",
     "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.2.4/forms-v4.2.4.tar.gz",
     "version": "4.2.4",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
@@ -80,7 +80,7 @@
     ]
   },
   "gpoddersync": {
-    "sha256": "1hk052864mb49crmsy2m9alv22rk7ns6m6q7l372j7py9gr8rf60",
+    "hash": "sha256-e4RtBCPtk8jIK+p4tGfukLmC8ikhAD7GiRSmmkWciZQ=",
     "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.9.0/gpoddersync.tar.gz",
     "version": "3.9.0",
     "description": "Expose GPodder API to sync podcast consumer apps like AntennaPod",
@@ -90,7 +90,7 @@
     ]
   },
   "groupfolders": {
-    "sha256": "0s0bsidghrj5k38vbw6xbp7jr57sqb3pn9n2gq24sdklhy81k882",
+    "hash": "sha256-x9T/JoNJl6LxaPzF9IpKaGrz321nbMSAN3gfZbSapGE=",
     "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v17.0.1/groupfolders-v17.0.1.tar.gz",
     "version": "17.0.1",
     "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
@@ -100,7 +100,7 @@
     ]
   },
   "impersonate": {
-    "sha256": "01cm643l5d3mrv6f3g1psl94974hichy9vj0hmj3zl0za2zf7mmb",
+    "hash": "sha256-7NCfm2c861E1ZOZhpqjbsw2LC9I7ypp2J1LamqmWvtU=",
     "url": "https://github.com/nextcloud-releases/impersonate/releases/download/v1.16.0/impersonate-v1.16.0.tar.gz",
     "version": "1.16.0",
     "description": "By installing the impersonate app of your Nextcloud you enable administrators to impersonate other users on the Nextcloud server. This is especially useful for debugging issues reported by users.\n\nTo impersonate a user an administrator has to simply follow the following four steps:\n\n1. Login as administrator to Nextcloud.\n2. Open users administration interface.\n3. Select the impersonate button on the affected user.\n4. Confirm the impersonation.\n\nThe administrator is then logged-in as the user, to switch back to the regular user account they simply have to press the logout button.\n\n**Note:**\n\n- This app is not compatible with instances that have encryption enabled.\n- While impersonate actions are logged note that actions performed impersonated will be logged as the impersonated user.\n- Impersonating a user is only possible after their first login.\n- You can limit which users/groups can use impersonation in Administration settings > Additional settings.",
@@ -110,9 +110,9 @@
     ]
   },
   "integration_openai": {
-    "sha256": "0q5fs57n644mad4qvr7pb46dljmdnl4c9wkh2kdhaqnmjsa7zs8j",
-    "url": "https://github.com/nextcloud-releases/integration_openai/releases/download/v2.0.1/integration_openai-v2.0.1.tar.gz",
-    "version": "2.0.1",
+    "hash": "sha256-qU86h6DHNetWOmt7yXCknQ3MBB9KdQ15UDJggqZgWMk=",
+    "url": "https://github.com/nextcloud-releases/integration_openai/releases/download/v2.0.3/integration_openai-v2.0.3.tar.gz",
+    "version": "2.0.3",
     "description": "⚠️ The smart pickers have been removed from this app\nas they are now included in the [Assistant app](https://apps.nextcloud.com/apps/assistant).\n\nThis app implements:\n\n* Text generation providers: Free prompt, Summarize, Headline and Reformulate (using any available large language model)\n* A Translation provider (using any available language model)\n* A SpeechToText provider (using Whisper)\n* An image generation provider\n\nInstead of connecting to the OpenAI API for these, you can also connect to a self-hosted [LocalAI](https://localai.io) instance\nor to any service that implements an API similar to the OpenAI one, for example: [Plusserver](https://www.plusserver.com/en/ai-platform/) or [MistralAI](https://mistral.ai).\n\n## Ethical AI Rating\n### Rating for Text generation using ChatGPT via OpenAI API: 🔴\n\nNegative:\n* the software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* the trained model is not freely available, so the model can not be run on-premises\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n\n### Rating for Translation using ChatGPT via OpenAI API: 🔴\n\nNegative:\n* the software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* the trained model is not freely available, so the model can not be run on-premises\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n### Rating for Image generation using DALL·E via OpenAI API: 🔴\n\nNegative:\n* the software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* the trained model is not freely available, so the model can not be ran on-premises\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via OpenAI API: 🟡\n\nPositive:\n* the software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can run on-premise\n\nNegative:\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n### Rating for Text generation via LocalAI: 🟢\n\nPositive:\n* the software for training and inferencing of this model is open source\n* the trained model is freely available, and thus can be ran on-premises\n* the training data is freely available, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n\n### Rating for Image generation using Stable Diffusion via LocalAI : 🟡\n\nPositive:\n* the software for training and inferencing of this model is open source\n* the trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via LocalAI: 🟡\n\nPositive:\n* the software for training and inferencing of this model is open source\n* the trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/integration_openai",
     "licenses": [
@@ -120,7 +120,7 @@
     ]
   },
   "integration_paperless": {
-    "sha256": "08rgdlinxpcwyq0f97ibv022qhj8smk94dvlf927xq46220w9pfx",
+    "hash": "sha256-ARjs8cCUJICJaZiMIIt/lYk15WlXzzRqAQBWwax6HY4=",
     "url": "https://github.com/nextcloud-releases/integration_paperless/releases/download/v1.0.3/integration_paperless-v1.0.3.tar.gz",
     "version": "1.0.3",
     "description": "Integration with the [Paperless](https://docs.paperless-ngx.com) Document Management System.\nIt adds a file action menu item that can be used to upload a file from your Nextcloud Files to Paperless.",
@@ -130,7 +130,7 @@
     ]
   },
   "mail": {
-    "sha256": "0bxbzibzsdqmd751759lg3vwhw9nyy5n37snijd083s1498sfqs5",
+    "hash": "sha256-4UlifHmX+3yX53RUIV9DVyj/nuttg25HNdaQjBQxXrs=",
     "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.2/mail-v3.7.2.tar.gz",
     "version": "3.7.2",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
@@ -140,7 +140,7 @@
     ]
   },
   "maps": {
-    "sha256": "1gqms3rrdpjmpb1h5d72b4lwbvsl8p10zwnkhgnsmvfcf93h3r1c",
+    "hash": "sha256-BmXs6Oepwnm+Cviy4awm3S8P9AiJTt1BnAQNb4TxVYE=",
     "url": "https://github.com/nextcloud/maps/releases/download/v1.4.0/maps-1.4.0.tar.gz",
     "version": "1.4.0",
     "description": "**The whole world fits inside your cloud!**\n\n- **🗺 Beautiful map:** Using [OpenStreetMap](https://www.openstreetmap.org) and [Leaflet](https://leafletjs.com), you can choose between standard map, satellite, topographical, dark mode or even watercolor! 🎨\n- **⭐ Favorites:** Save your favorite places, privately! Sync with [GNOME Maps](https://github.com/nextcloud/maps/issues/30) and mobile apps is planned.\n- **🧭 Routing:** Possible using either [OSRM](http://project-osrm.org), [GraphHopper](https://www.graphhopper.com) or [Mapbox](https://www.mapbox.com).\n- **🖼 Photos on the map:** No more boring slideshows, just show directly where you were!\n- **🙋 Contacts on the map:** See where your friends live and plan your next visit.\n- **📱 Devices:** Lost your phone? Check the map!\n- **〰 Tracks:** Load GPS tracks or past trips. Recording with [PhoneTrack](https://f-droid.org/en/packages/net.eneiluj.nextcloud.phonetrack/) or [OwnTracks](https://owntracks.org) is planned.",
@@ -150,17 +150,17 @@
     ]
   },
   "memories": {
-    "sha256": "1wahnkc253bgm0bqciyhfh1iyl8girbj8mzdd29l0k1bks8fr4qc",
+    "hash": "sha256-tzxeffvwMwthvBRG+/cLCXZkVS32rlf5v7XOKTbGoOo=",
     "url": "https://github.com/pulsejet/memories/releases/download/v7.3.1/memories.tar.gz",
     "version": "7.3.1",
-    "description": "# Memories: Photo Management for Nextcloud\n\nMemories is a *batteries-included* photo management solution for Nextcloud with advanced features including:\n\n- **📸 Timeline**: Sort photos and videos by date taken, parsed from Exif data.\n- **⏪ Rewind**: Jump to any time in the past instantly and relive your memories.\n- **🤖 AI Tagging**: Group photos by people and objects, powered by [recognize](https://github.com/nextcloud/recognize) and [facerecognition](https://github.com/matiasdelellis/facerecognition).\n- **🖼️ Albums**: Create albums to group photos and videos together. Then share these albums with others.\n- **🫱🏻‍🫲🏻 External Sharing**: Share photos and videos with people outside of your Nextcloud instance.\n- **📱 Mobile Support**: Work from any device, of any shape and size through the web app.\n- **✏️ Edit Metadata**: Edit dates and other metadata on photos quickly and in bulk.\n- **📦 Archive**: Store photos you don't want to see in your timeline in a separate folder.\n- **📹 Video Transcoding**: Transcode videos and use HLS for maximal performance.\n- **🗺️ Map**: View your photos on a map, tagged with accurate reverse geocoding.\n- **📦 Migration**: Migrate easily from Nextcloud Photos and Google Takeout.\n- **⚡️ Performance**: Do all this very fast.\n\n## 🚀 Installation\n\n1. Install the app from the Nextcloud app store (try a demo [here](https://demo.memories.gallery/apps/memories/)).\n1. Perform the recommended [configuration steps](https://memories.gallery/config/).\n1. Run `php occ memories:index` to generate metadata indices for existing photos.\n1. Open the 📷 Memories app in Nextcloud and set the directory containing your photos.",
+    "description": "# Memories: Photo Management for Nextcloud\r\n\r\nMemories is a *batteries-included* photo management solution for Nextcloud with advanced features including:\r\n\r\n- **📸 Timeline**: Sort photos and videos by date taken, parsed from Exif data.\r\n- **⏪ Rewind**: Jump to any time in the past instantly and relive your memories.\r\n- **🤖 AI Tagging**: Group photos by people and objects, powered by [recognize](https://github.com/nextcloud/recognize) and [facerecognition](https://github.com/matiasdelellis/facerecognition).\r\n- **🖼️ Albums**: Create albums to group photos and videos together. Then share these albums with others.\r\n- **🫱🏻‍🫲🏻 External Sharing**: Share photos and videos with people outside of your Nextcloud instance.\r\n- **📱 Mobile Support**: Work from any device, of any shape and size through the web app.\r\n- **✏️ Edit Metadata**: Edit dates and other metadata on photos quickly and in bulk.\r\n- **📦 Archive**: Store photos you don't want to see in your timeline in a separate folder.\r\n- **📹 Video Transcoding**: Transcode videos and use HLS for maximal performance.\r\n- **🗺️ Map**: View your photos on a map, tagged with accurate reverse geocoding.\r\n- **📦 Migration**: Migrate easily from Nextcloud Photos and Google Takeout.\r\n- **⚡️ Performance**: Do all this very fast.\r\n\r\n## 🚀 Installation\r\n\r\n1. Install the app from the Nextcloud app store (try a demo [here](https://demo.memories.gallery/apps/memories/)).\r\n1. Perform the recommended [configuration steps](https://memories.gallery/config/).\r\n1. Run `php occ memories:index` to generate metadata indices for existing photos.\r\n1. Open the 📷 Memories app in Nextcloud and set the directory containing your photos.",
     "homepage": "https://memories.gallery",
     "licenses": [
       "agpl"
     ]
   },
   "music": {
-    "sha256": "17anhb0zcky4fwmbj1czm536d7k8n03iwsn3dqnyq1b9c4bqyj4m",
+    "hash": "sha256-RnTyQYCbmkHDZhtonpvbKLUM3n93u53IhknyTrNGh9Y=",
     "url": "https://github.com/owncloud/music/releases/download/v2.0.0/music_2.0.0_for_nextcloud.tar.gz",
     "version": "2.0.0",
     "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone",
@@ -170,7 +170,7 @@
     ]
   },
   "notes": {
-    "sha256": "0j9bwbfvwwdaabyc79i514sp36cm4i9z02l8bkxlqr9fvim73nn9",
+    "hash": "sha256-av6y5GViTzlHtnUb/OIDw+0wdA/ZRwPYQMU3yDEbMTQ=",
     "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.10.0/notes.tar.gz",
     "version": "4.10.0",
     "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into third-party apps (currently, there are notes apps for [Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios) and the [console](https://git.danielmoch.com/nncli/about) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
@@ -180,7 +180,7 @@
     ]
   },
   "notify_push": {
-    "sha256": "14s8g3dqwrxjz1zww64n1lhwdb8374wr1b5v76xhawypmfz2a68h",
+    "hash": "sha256-Qv9pvOej/omXfAAkPXC/DBTbJVCg/DarkJDhLuTjjpQ=",
     "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.12/notify_push-v0.6.12.tar.gz",
     "version": "0.6.12",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
@@ -190,9 +190,9 @@
     ]
   },
   "onlyoffice": {
-    "sha256": "1vflj70q8d0hrfck9c5l1k4qa38gpdh3zjgx4aqamnlbvkfssk7h",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.2.2/onlyoffice.tar.gz",
-    "version": "9.2.2",
+    "hash": "sha256-rHUM3HVY3INPAtTqYxpm9V3Ad8VTl+Wd2S7xAj0CJko=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.3.0/onlyoffice.tar.gz",
+    "version": "9.3.0",
     "description": "ONLYOFFICE connector allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
@@ -200,7 +200,7 @@
     ]
   },
   "phonetrack": {
-    "sha256": "1i28xgzp85yb44ay2l2zw18fk00yd6fh6yddj92gdrljb3w9zpap",
+    "hash": "sha256-zQt+3t86HZJVT/wiETHkPdTwV6Qy+iNkH3/THtTe1Xs=",
     "url": "https://github.com/julien-nc/phonetrack/releases/download/v0.8.1/phonetrack-0.8.1.tar.gz",
     "version": "0.8.1",
     "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n* Create a tracking session.\n* Give the logging link\\* to the mobile devices. Choose the [logging method](https://gitlab.com/eneiluj/phonetrack-oc/wikis/userdoc#logging-methods) you prefer.\n* Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name. Setting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n* 📍 Display location history\n* ⛛ Filter points\n* ✎ Manually edit/add/delete points\n* ✎ Edit devices (rename, change colour/shape, move to another session)\n* ⛶ Define geofencing zones for devices\n* ⚇ Define proximity alerts for device pairs\n* 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n* 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n* 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n* 🗠 Display sessions statistics\n* 🔒 [Reserve a device name](https://gitlab.com/eneiluj/phonetrack-oc/wikis/userdoc#device-name-reservation) to make sure only authorised user can log with this name\n* 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n* ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is tested on Nextcloud 17 with Firefox 57+ and Chromium.\n\nThis app is compatible with theming colours and accessibility themes !\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n* PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
@@ -210,9 +210,9 @@
     ]
   },
   "polls": {
-    "sha256": "1s8ym7msl4cax69kr2piphgapllsva1vjh2xb7g03yb7z1hglhjs",
-    "url": "https://github.com/nextcloud/polls/releases/download/v7.1.2/polls.tar.gz",
-    "version": "7.1.2",
+    "hash": "sha256-s2S9RyhaRrs06UYH92OvObSiw+eVx2JDwI1A6YxfiYA=",
+    "url": "https://github.com/nextcloud/polls/releases/download/v7.1.3/polls.tar.gz",
+    "version": "7.1.3",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -220,7 +220,7 @@
     ]
   },
   "previewgenerator": {
-    "sha256": "0505kg4pxa6dqylniwa5ip6h5bama8cp0ng2y7prhb93mnhgr051",
+    "hash": "sha256-12ntS+OgT26AIi7b8x7w6ixm9OKFx2+ePxKGOea2RwA=",
     "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.5.0/previewgenerator-v5.5.0.tar.gz",
     "version": "5.5.0",
     "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**./occ preview:generate-all -vvv**\n\n**Important**: To enable pre-generation of previews you must add **php /var/www/nextcloud/occ preview:pre-generate** to a system cron job that runs at times of your choosing.",
@@ -230,7 +230,7 @@
     ]
   },
   "qownnotesapi": {
-    "sha256": "0y4cv4hagmax4nkdfzysd5fg2h2xak4m87waf3b0ci5f1bwdxdxx",
+    "hash": "sha256-k1Sm0ZO9qx9KmAGCGYupcLeMSllKUmOlPSUgbWVrqI4=",
     "url": "https://github.com/pbek/qownnotesapi/releases/download/v24.4.0/qownnotesapi-nc.tar.gz",
     "version": "24.4.0",
     "description": "QOwnNotesAPI is the Nextcloud/ownCloud API for [QOwnNotes](http://www.qownnotes.org), the open source notepad for Linux, macOS and Windows, that works together with the notes application of Nextcloud/ownCloud.\n\nThe only purpose of this App is to provide API access to your Nextcloud/ownCloud server for your QOwnNotes desktop installation, you cannot use this App for anything else, if you don't have QOwnNotes installed on your desktop computer!",
@@ -240,7 +240,7 @@
     ]
   },
   "registration": {
-    "sha256": "1ih7nfswskzpgbqfjsn4lym4cwyq4kbjv9m9cmy4g4nx44gr0dkl",
+    "hash": "sha256-4MLNKwYx/3hqnrcF2TpTCKOMveWINvWo71aOXcBO79E=",
     "url": "https://github.com/nextcloud-releases/registration/releases/download/v2.4.0/registration-v2.4.0.tar.gz",
     "version": "2.4.0",
     "description": "User registration\n\nThis app allows users to register a new account.\n\n# Features\n\n- Add users to a given group\n- Allow-list with email domains (including wildcard) to register with\n- Administrator will be notified via email for new user creation or require approval\n- Supports Nextcloud's Client Login Flow v1 and v2 - allowing registration in the mobile Apps and Desktop clients\n\n# Web form registration flow\n\n1. User enters their email address\n2. Verification link is sent to the email address\n3. User clicks on the verification link\n4. User is lead to a form where they can choose their username and password\n5. New account is created and is logged in automatically",
@@ -250,7 +250,7 @@
     ]
   },
   "richdocuments": {
-    "sha256": "0x1x4x21sknih87gzqzmhxnvi1s1h4j70i4wsn7hnpdvc9j830vs",
+    "hash": "sha256-ErJ5Hi2aDQATE6dUasfgbxxYzvsk8Unlz3vT92vPcUg=",
     "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.4.3/richdocuments-v8.4.3.tar.gz",
     "version": "8.4.3",
     "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
@@ -260,9 +260,9 @@
     ]
   },
   "spreed": {
-    "sha256": "1ydd156cjhjydbjmzjm0bq0garxfgbppgd7q6bfz04y10yjyjkah",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v19.0.3/spreed-v19.0.3.tar.gz",
-    "version": "19.0.3",
+    "hash": "sha256-MeHPgTv3SlQLRdTg21WO51Uau3Bvb68Emk/3gGJkbL0=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v19.0.5/spreed-v19.0.5.tar.gz",
+    "version": "19.0.5",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
@@ -270,7 +270,7 @@
     ]
   },
   "tasks": {
-    "sha256": "1g2wqsm9kjm7dri75ghix2hb5vby3vy3ibcvmwfdwsab3a12xbrg",
+    "hash": "sha256-HitYQcdURUHujRNMF0jKQzvSO93bItisI0emq0yw8p4=",
     "url": "https://github.com/nextcloud/tasks/releases/download/v0.16.0/tasks.tar.gz",
     "version": "0.16.0",
     "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
@@ -280,7 +280,7 @@
     ]
   },
   "twofactor_nextcloud_notification": {
-    "sha256": "0qpg6i6iw6ldnryf0p56kd7fgs5vyckw9m6yjcf8r4j3mwfka273",
+    "hash": "sha256-4fXWgDeiup5/Gm9hdZDj/u07rp/Nzwly53aLUT/d0IU=",
     "url": "https://github.com/nextcloud-releases/twofactor_nextcloud_notification/releases/download/v3.9.0/twofactor_nextcloud_notification-v3.9.0.tar.gz",
     "version": "3.9.0",
     "description": "Allows using any of your logged in devices as second factor",
@@ -290,7 +290,7 @@
     ]
   },
   "twofactor_webauthn": {
-    "sha256": "0llxakzcdcy9hscyzw3na5zp1p57h03w5fmm0gs9g62k1b88k6kw",
+    "hash": "sha256-2qvP6xZO7ZdCZkOSP4FNqyjZ0GMcw/FDSy67JDrlM04=",
     "url": "https://github.com/nextcloud-releases/twofactor_webauthn/releases/download/v1.4.0/twofactor_webauthn-v1.4.0.tar.gz",
     "version": "1.4.0",
     "description": "A two-factor provider for WebAuthn devices",
@@ -300,7 +300,7 @@
     ]
   },
   "unroundedcorners": {
-    "sha256": "16h8zg7k18r01yx2a72bn22nmvbafrs3ksyy23fbrnirzgwcaaqf",
+    "hash": "sha256-sdgc2ENnRkcQnopbqsn/FHYDoiKqeKfYEontFy0cYU4=",
     "url": "https://github.com/OliverParoczai/nextcloud-unroundedcorners/releases/download/v1.1.3/unroundedcorners-v1.1.3.tar.gz",
     "version": "1.1.3",
     "description": "# Unrounded Corners\nA Nextcloud app that restores the corners of buttons and widgets to their original looks by unrounding them.",
@@ -310,7 +310,7 @@
     ]
   },
   "user_oidc": {
-    "sha256": "1qarpmwk66mz6mvif0cc4jb7wi4yv76flzwhyvmzxk0ahafpi8x1",
+    "hash": "sha256-feBnHhVXR3B6SKPWx2rWDAjEERV1GMQ4NVlmoRLukJE=",
     "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v5.0.3/user_oidc-v5.0.3.tar.gz",
     "version": "5.0.3",
     "description": "Allows flexible configuration of an OIDC server as Nextcloud login user backend.",
@@ -320,7 +320,7 @@
     ]
   },
   "user_saml": {
-    "sha256": "1dw5mwzzlhfwarnnpsij3l6153psl83qkjmgm0bnipy4v8wkkqvj",
+    "hash": "sha256-OHIiM4krCTxAN6g+Obn1GONduLmUf0eqrsjjP6ziY2M=",
     "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v6.1.3/user_saml-v6.1.3.tar.gz",
     "version": "6.1.3",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
diff --git a/pkgs/servers/nextcloud/packages/default.nix b/pkgs/servers/nextcloud/packages/default.nix
index 9c12619968af..8af2e2f5833b 100644
--- a/pkgs/servers/nextcloud/packages/default.nix
+++ b/pkgs/servers/nextcloud/packages/default.nix
@@ -19,7 +19,7 @@ let packages = self:
         appName = pname;
         appVersion = data.version;
         license = appBaseDefs.${pname};
-        inherit (data) url sha256 description homepage;
+        inherit (data) url hash description homepage;
       }) {};
 
   } // lib.mapAttrs (type: pkgs:
diff --git a/pkgs/servers/nosql/influxdb2/cli.nix b/pkgs/servers/nosql/influxdb2/cli.nix
index a331c58a3dbe..f00f09a96aa1 100644
--- a/pkgs/servers/nosql/influxdb2/cli.nix
+++ b/pkgs/servers/nosql/influxdb2/cli.nix
@@ -1,6 +1,8 @@
 { buildGoModule
 , fetchFromGitHub
+, installShellFiles
 , lib
+, stdenv
 }:
 
 let
@@ -18,11 +20,19 @@ in buildGoModule {
   version = version;
   inherit src;
 
+  nativeBuildInputs = [ installShellFiles ];
+
   vendorHash = "sha256-Ov0TPoMm0qi7kkWUUni677sCP1LwkT9+n3KHcAlQkDA=";
   subPackages = [ "cmd/influx" ];
 
   ldflags = [ "-X main.commit=v${version}" "-X main.version=${version}" ];
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd influx \
+      --bash <($out/bin/influx completion bash) \
+      --zsh  <($out/bin/influx completion zsh)
+  '';
+
   meta = with lib; {
     description = "CLI for managing resources in InfluxDB v2";
     license = licenses.mit;
diff --git a/pkgs/servers/sunshine/0001-fix-upnp-support-newer-miniupnpc-library-2782.patch b/pkgs/servers/sunshine/0001-fix-upnp-support-newer-miniupnpc-library-2782.patch
new file mode 100644
index 000000000000..1852ef846550
--- /dev/null
+++ b/pkgs/servers/sunshine/0001-fix-upnp-support-newer-miniupnpc-library-2782.patch
@@ -0,0 +1,120 @@
+From f4f1800f5e67ab59312ccf710695acf06fb4ae26 Mon Sep 17 00:00:00 2001
+From: ReenigneArcher <42013603+ReenigneArcher@users.noreply.github.com>
+Date: Mon, 1 Jul 2024 10:07:06 -0400
+Subject: [PATCH] fix(upnp): support newer miniupnpc library (#2782)
+
+Co-authored-by: Vithorio Polten <reach@vithor.io>
+---
+ src/upnp.cpp | 30 +++++++++++++++---------------
+ src/upnp.h   | 31 ++++++++++++++++++++++++++++++-
+ 2 files changed, 45 insertions(+), 16 deletions(-)
+
+diff --git a/src/upnp.cpp b/src/upnp.cpp
+index f65bcb87..fcbaaeb5 100644
+--- a/src/upnp.cpp
++++ b/src/upnp.cpp
+@@ -19,19 +19,6 @@
+ using namespace std::literals;
+ 
+ namespace upnp {
+-  constexpr auto INET6_ADDRESS_STRLEN = 46;
+-
+-  constexpr auto PORT_MAPPING_LIFETIME = 3600s;
+-  constexpr auto REFRESH_INTERVAL = 120s;
+-
+-  constexpr auto IPv4 = 0;
+-  constexpr auto IPv6 = 1;
+-
+-  using device_t = util::safe_ptr<UPNPDev, freeUPNPDevlist>;
+-
+-  KITTY_USING_MOVE_T(urls_t, UPNPUrls, , {
+-    FreeUPNPUrls(&el);
+-  });
+ 
+   struct mapping_t {
+     struct {
+@@ -59,6 +46,19 @@ namespace upnp {
+     return "Unknown status"sv;
+   }
+ 
++  /**
++   * This function is a wrapper around UPNP_GetValidIGD() that returns the status code. There is a pre-processor
++   * check to determine which version of the function to call based on the version of the MiniUPnPc library.
++   */
++  int
++  UPNP_GetValidIGDStatus(device_t &device, urls_t *urls, IGDdatas *data, std::array<char, INET6_ADDRESS_STRLEN> &lan_addr) {
++#if (MINIUPNPC_API_VERSION >= 18)
++    return UPNP_GetValidIGD(device.get(), &urls->el, data, lan_addr.data(), lan_addr.size(), nullptr, 0);
++#else
++    return UPNP_GetValidIGD(device.get(), &urls->el, data, lan_addr.data(), lan_addr.size());
++#endif
++  }
++
+   class deinit_t: public platf::deinit_t {
+   public:
+     deinit_t() {
+@@ -109,7 +109,7 @@ namespace upnp {
+       IGDdatas data;
+       urls_t urls;
+       std::array<char, INET6_ADDRESS_STRLEN> lan_addr;
+-      auto status = UPNP_GetValidIGD(device.get(), &urls.el, &data, lan_addr.data(), lan_addr.size());
++      auto status = upnp::UPNP_GetValidIGDStatus(device, &urls, &data, lan_addr);
+       if (status != 1 && status != 2) {
+         BOOST_LOG(debug) << "No valid IPv6 IGD: "sv << status_string(status);
+         return false;
+@@ -331,7 +331,7 @@ namespace upnp {
+         std::array<char, INET6_ADDRESS_STRLEN> lan_addr;
+ 
+         urls_t urls;
+-        auto status = UPNP_GetValidIGD(device.get(), &urls.el, &data, lan_addr.data(), lan_addr.size());
++        auto status = upnp::UPNP_GetValidIGDStatus(device, &urls, &data, lan_addr);
+         if (status != 1 && status != 2) {
+           BOOST_LOG(error) << status_string(status);
+           mapped = false;
+diff --git a/src/upnp.h b/src/upnp.h
+index 73fc4f79..4b2e3296 100644
+--- a/src/upnp.h
++++ b/src/upnp.h
+@@ -4,9 +4,38 @@
+  */
+ #pragma once
+ 
++#include <miniupnpc/miniupnpc.h>
++
+ #include "platform/common.h"
+ 
+ namespace upnp {
++  constexpr auto INET6_ADDRESS_STRLEN = 46;
++  constexpr auto IPv4 = 0;
++  constexpr auto IPv6 = 1;
++  constexpr auto PORT_MAPPING_LIFETIME = 3600s;
++  constexpr auto REFRESH_INTERVAL = 120s;
++
++  using device_t = util::safe_ptr<UPNPDev, freeUPNPDevlist>;
++
++  KITTY_USING_MOVE_T(urls_t, UPNPUrls, , {
++    FreeUPNPUrls(&el);
++  });
++
++  /**
++   * @brief Get the valid IGD status.
++   * @param device The device.
++   * @param urls The URLs.
++   * @param data The IGD data.
++   * @param lan_addr The LAN address.
++   * @return The UPnP Status.
++   * @retval 0 No IGD found.
++   * @retval 1 A valid connected IGD has been found.
++   * @retval 2 A valid IGD has been found but it reported as not connected.
++   * @retval 3 An UPnP device has been found but was not recognized as an IGD.
++   */
++  int
++  UPNP_GetValidIGDStatus(device_t &device, urls_t *urls, IGDdatas *data, std::array<char, INET6_ADDRESS_STRLEN> &lan_addr);
++
+   [[nodiscard]] std::unique_ptr<platf::deinit_t>
+   start();
+-}
++}  // namespace upnp
+-- 
+2.45.2
+
diff --git a/pkgs/servers/sunshine/default.nix b/pkgs/servers/sunshine/default.nix
index 6f949728f14a..d4145e22d088 100644
--- a/pkgs/servers/sunshine/default.nix
+++ b/pkgs/servers/sunshine/default.nix
@@ -62,6 +62,12 @@ stdenv'.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # fix(upnp): support newer miniupnpc library (#2782)
+    # Manually cherry-picked on to 0.23.1.
+    ./0001-fix-upnp-support-newer-miniupnpc-library-2782.patch
+  ];
+
   # build webui
   ui = buildNpmPackage {
     inherit src version;
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index 19c14a7c7ab0..d802662b53dc 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, fetchFromGitHub
+, fetchpatch2
 , installShellFiles
 , boost, zlib, openssl
 , upnpSupport ? true, miniupnpc
@@ -17,6 +18,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0n3cPF3KBuzNOagrn88HeTvFAu1sYTkijpiGr77X5GI=";
   };
 
+  patches = [
+    # Support miniupnp-2.2.8 (fixes #2071)
+    (fetchpatch2 {
+      url = "https://github.com/PurpleI2P/i2pd/commit/697d8314415b0dc0634fd1673abc589a080e0a31.patch?full_index=1";
+      hash = "sha256-B9Ngw1yPrnF5pGLe1a5x0TlyInvQGcq1zQUKO/ELFzA=";
+    })
+  ];
+
   buildInputs = [ boost zlib openssl ]
     ++ lib.optional upnpSupport miniupnpc;
 
diff --git a/pkgs/tools/networking/miniupnpc/default.nix b/pkgs/tools/networking/miniupnpc/default.nix
index b5d577d6139e..b643e472ea62 100644
--- a/pkgs/tools/networking/miniupnpc/default.nix
+++ b/pkgs/tools/networking/miniupnpc/default.nix
@@ -1,38 +1,36 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
 }:
 
 stdenv.mkDerivation rec {
   pname = "miniupnpc";
-  version = "2.2.7";
+  version = "2.2.8";
 
   src = fetchFromGitHub {
     owner = "miniupnp";
     repo = "miniupnp";
-    rev = "miniupnpc_${lib.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-cIijY1NcdF169tibfB13845UT9ZoJ/CZ+XLES9ctWTY=";
+    rev = "miniupnpc_${lib.replaceStrings [ "." ] [ "_" ] version}";
+    hash = "sha256-kPH5nr+rIcF3mxl+L0kN5dn+9xvQccVa8EduwhuYboY=";
   };
 
   sourceRoot = "${src.name}/miniupnpc";
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = [
+    (lib.cmakeBool "UPNPC_BUILD_SHARED" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "UPNPC_BUILD_STATIC" stdenv.hostPlatform.isStatic)
+  ];
+
   doCheck = !stdenv.isFreeBSD;
 
-  makeFlags = [ "PREFIX=$(out)" ];
-
   postInstall = ''
-    chmod +x $out/lib/libminiupnpc${stdenv.hostPlatform.extensions.sharedLibrary}
-
-    # for some reason cmake does not install binaries and manpages
-    # https://github.com/miniupnp/miniupnp/issues/637
-    mkdir -p $out/bin
-    cp -a upnpc-static $out/bin/upnpc
-    cp -a ../external-ip.sh $out/bin/external-ip
-    mkdir -p $out/share/man
-    cp -a ../man3 $out/share/man
+    mv $out/bin/upnpc-* $out/bin/upnpc
+    mv $out/bin/upnp-listdevices-* $out/bin/upnp-listdevices
+    mv $out/bin/external-ip.sh $out/bin/external-ip
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/qodem/default.nix b/pkgs/tools/networking/qodem/default.nix
deleted file mode 100644
index 6451a7d8d316..000000000000
--- a/pkgs/tools/networking/qodem/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, ncurses, SDL, gpm, miniupnpc }:
-
-stdenv.mkDerivation rec {
-  pname = "qodem";
-  version = "1.0.1";
-
-  src = fetchFromGitHub {
-    owner = "klamonte";
-    repo = "qodem";
-    rev = "v${version}";
-    sha256 = "NAdcTVmNrDa3rbsbxJxFoI7sz5NK5Uw+TbP+a1CdB+Q=";
-  };
-
-  nativeBuildInputs = [ autoconf automake ];
-  buildInputs = [ ncurses SDL gpm miniupnpc ];
-
-  meta = with lib; {
-    homepage = "https://qodem.sourceforge.net/";
-    description = "Re-implementation of the DOS-era Qmodem serial communications package";
-    longDescription = ''
-      Qodem is a from-scratch clone implementation of the Qmodem
-      communications program made popular in the days when Bulletin Board
-      Systems ruled the night. Qodem emulates the dialing directory and the
-      terminal screen features of Qmodem over both modem and Internet
-      connections.
-    '';
-    maintainers = with maintainers; [ embr ];
-    license = licenses.publicDomain;
-  };
-}
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index c262bbac48c2..40e32f06a29e 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -51,9 +51,9 @@ lib.makeExtensible (self: ({
 
   lix_2_90 = (
     common {
-      version = "2.90.0-rc1";
-      hash = "sha256-WY7BGnu5PnbK4O8cKKv9kvxwzZIGbIQUQLGPHFXitI0=";
-      docCargoHash = "sha256-V/MEC2aRlVrt/IKozyYZvZTXENrtDS/wsV08/ao4TCw=";
+      version = "2.90.0";
+      hash = "sha256-f8k+BezKdJfmE+k7zgBJiohtS3VkkriycdXYsKOm3sc=";
+      docCargoHash = "sha256-vSf9MyD2XzofZlbzsmh6NP69G+LiX72GX4Um9UJp3dc=";
     }
   );
 
diff --git a/pkgs/tools/security/pass/extensions/audit/default.nix b/pkgs/tools/security/pass/extensions/audit/default.nix
index 055af774a624..d3f196a20563 100644
--- a/pkgs/tools/security/pass/extensions/audit/default.nix
+++ b/pkgs/tools/security/pass/extensions/audit/default.nix
@@ -1,11 +1,16 @@
-{ lib, stdenv, pass, fetchFromGitHub, pythonPackages, makeWrapper, gnupg }:
+{
+  lib,
+  stdenv,
+  pass,
+  fetchFromGitHub,
+  python3,
+  gnupg,
+}:
 
-let
-  pythonEnv = pythonPackages.python.withPackages (p: [ p.requests p.setuptools p.zxcvbn ]);
-
-in stdenv.mkDerivation rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "pass-audit";
   version = "1.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "roddhjav";
@@ -21,30 +26,46 @@ in stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace audit.bash \
-      --replace-fail 'python3' "${pythonEnv.interpreter}"
-    substituteInPlace Makefile \
-      --replace-fail "install --root" "install --prefix ''' --root"
+      --replace-fail python3 "${lib.getExe python3}"
+    rm Makefile
+    patchShebangs audit.bash
   '';
 
-  outputs = [ "out" "man" ];
+  outputs = [
+    "out"
+    "man"
+  ];
 
-  buildInputs = [ pythonEnv ];
-  nativeBuildInputs = [ makeWrapper ];
+  build-system = with python3.pkgs; [ setuptools ];
+  dependencies = with python3.pkgs; [
+    requests
+    setuptools
+    zxcvbn
+  ];
 
   # Tests freeze on darwin with: pass-audit-1.1 (checkPhase): EOFError
   doCheck = !stdenv.isDarwin;
-  nativeCheckInputs = [ pythonPackages.green pass gnupg ];
+  nativeCheckInputs = [
+    python3.pkgs.green
+    pass
+    gnupg
+  ];
   checkPhase = ''
-    ${pythonEnv.interpreter} -m green -q
+    python3 -m green -q
   '';
 
-  installFlags = [ "DESTDIR=${placeholder "out"}" "PREFIX=" ];
   postInstall = ''
+    mkdir -p $out/lib/password-store/extensions
+    install -m777 audit.bash $out/lib/password-store/extensions/audit.bash
+    cp -r share $out/
+    buildPythonPath "$out $dependencies"
     wrapProgram $out/lib/password-store/extensions/audit.bash \
-      --prefix PYTHONPATH : "$out/${pythonEnv.sitePackages}" \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
       --run "export COMMAND"
   '';
 
+  pythonImportsCheck = [ "pass_audit" ];
+
   meta = with lib; {
     description = "Pass extension for auditing your password repository";
     homepage = "https://github.com/roddhjav/pass-audit";
diff --git a/pkgs/tools/security/pass/extensions/default.nix b/pkgs/tools/security/pass/extensions/default.nix
index b9c45a1096d3..dfb5dfa35bd0 100644
--- a/pkgs/tools/security/pass/extensions/default.nix
+++ b/pkgs/tools/security/pass/extensions/default.nix
@@ -1,13 +1,11 @@
 { pkgs, ... }:
 
 let
-  inherit (pkgs) callPackage python3Packages;
+  inherit (pkgs) callPackage;
 in
 
 {
-  pass-audit = callPackage ./audit {
-    pythonPackages = python3Packages;
-  };
+  pass-audit = callPackage ./audit {};
   pass-checkup = callPackage ./checkup.nix {};
   pass-import = callPackage ./import.nix {};
   pass-otp = callPackage ./otp.nix {};
diff --git a/pkgs/tools/security/zmap/default.nix b/pkgs/tools/security/zmap/default.nix
index 16e58028f3e1..1749c9ef6d7f 100644
--- a/pkgs/tools/security/zmap/default.nix
+++ b/pkgs/tools/security/zmap/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zmap";
-  version = "4.1.1";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "zmap";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ftdjIBAAe+3qUEHoNMAOCmzy+PWD4neIMWvFXFi2JFo=";
+    sha256 = "sha256-4BSHNR/snwLf0/UsiCM8xzXk59G5GtsxQKb1F2VVL9c=";
   };
 
   cmakeFlags = [ "-DRESPECT_INSTALL_PREFIX_CONFIG=ON" ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d2f86190374b..a498fa95649c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -857,6 +857,7 @@ mapAliases ({
 
   ### M ###
 
+  ma1sd = throw "ma1sd was dropped as it is unmaintained"; # Added 2024-07-10
   MACS2 = macs2; # Added 2023-06-12
   mailman-rss = throw "The mailman-rss package was dropped since it was unmaintained."; # Added 2024-06-21
   mariadb_104 = throw "mariadb_104 has been removed from nixpkgs, please switch to another version like mariadb_106"; # Added 2023-09-11
@@ -867,6 +868,7 @@ mapAliases ({
   marwaita-manjaro = lib.warn "marwaita-manjaro has been renamed to marwaita-teal" marwaita-teal; # Added 2024-07-08
   marwaita-peppermint = lib.warn "marwaita-peppermint has been renamed to marwaita-red" marwaita-red; # Added 2024-07-01
   marwaita-ubuntu = lib.warn "marwaita-ubuntu has been renamed to marwaita-orange" marwaita-orange; # Added 2024-07-08
+  masari = throw "masari has been removed as it was abandoned upstream"; # Added 2024-07-11
   matrique = spectral; # Added 2020-01-27
   matrixcli = throw "'matrixcli' has been removed due to being unmaintained and broken functionality. Recommend 'matrix-commander' as an alternative"; # Added 2024-03-09
   matrix-recorder = throw "matrix-recorder has been removed due to being unmaintained"; # Added 2023-05-21
@@ -1373,7 +1375,7 @@ mapAliases ({
   trustedGrub-for-HP = throw "trustedGrub-for-HP has been removed, because it is not maintained upstream anymore"; # Added 2023-05-10
   tvbrowser-bin = tvbrowser; # Added 2023-03-02
   typst-fmt = typstfmt; # Added 2023-07-15
-  typst-preview = throw "The features of this program have been consolidated to 'tinymist', an all-in-one language server for typst"; # Added 2024-07-07
+  typst-preview = throw "The features of 'typst-preview' have been consolidated to 'tinymist', an all-in-one language server for typst"; # Added 2024-07-07
 
   ### U ###
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 24f03593ee5a..27412bbac617 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -981,6 +981,8 @@ with pkgs;
   inherit (callPackages ../build-support/node/fetch-yarn-deps { })
     fixup-yarn-lock
     prefetch-yarn-deps
+    yarnConfigHook
+    yarnBuildHook
     fetchYarnDeps;
 
   find-cursor = callPackage ../tools/X11/find-cursor { };
@@ -5101,6 +5103,8 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
   };
 
+  f3d_egl = f3d.override { vtk_9 = vtk_9_egl; };
+
   facedetect = callPackage ../tools/graphics/facedetect { };
 
   faketty = callPackage ../tools/misc/faketty { };
@@ -9648,8 +9652,6 @@ with pkgs;
 
   kzipmix = pkgsi686Linux.callPackage ../tools/compression/kzipmix { };
 
-  ma1sd = callPackage ../servers/ma1sd { };
-
   mailcatcher = callPackage ../development/web/mailcatcher { };
 
   makebootfat = callPackage ../tools/misc/makebootfat { };
@@ -12083,8 +12085,6 @@ with pkgs;
 
   qmarkdowntextedit = libsForQt5.callPackage  ../development/libraries/qmarkdowntextedit { };
 
-  qodem = callPackage ../tools/networking/qodem { };
-
   qosmic = libsForQt5.callPackage ../applications/graphics/qosmic { };
 
   qovery-cli = callPackage ../tools/admin/qovery-cli { };
@@ -13514,8 +13514,6 @@ with pkgs;
 
   tor = callPackage ../tools/security/tor { };
 
-  tor-browser = callPackage ../applications/networking/browsers/tor-browser { };
-
   touchegg = callPackage ../tools/inputmethods/touchegg { };
 
   torrent7z = callPackage ../tools/archivers/torrent7z { };
@@ -15953,7 +15951,9 @@ with pkgs;
     graalvmDrv = graalvm-ce;
   }).override;
 
-  openshot-qt = libsForQt5.callPackage ../applications/video/openshot-qt { };
+  openshot-qt = libsForQt5.callPackage ../applications/video/openshot-qt {
+    python3 = python311;
+  };
 
   lingua-franca = callPackage ../development/compilers/lingua-franca { };
 
@@ -24568,6 +24568,9 @@ with pkgs;
   vtk_9_withQt5 = vtk_9.override { enableQt = true; };
 
   vtk = vtk_9;
+
+  vtk_9_egl = vtk_9.override { enableEgl = true; };
+
   vtkWithQt5 = vtk_9_withQt5;
 
   vulkan-caps-viewer = libsForQt5.callPackage ../tools/graphics/vulkan-caps-viewer { };
@@ -25672,8 +25675,6 @@ with pkgs;
 
   mullvad-vpn = callPackage ../applications/networking/mullvad-vpn { };
 
-  mullvad-browser = callPackage ../applications/networking/browsers/mullvad-browser { };
-
   mullvad-closest = with python3Packages; toPythonApplication mullvad-closest;
 
   mycorrhiza = callPackage ../servers/mycorrhiza { };
@@ -25819,8 +25820,6 @@ with pkgs;
 
   postgrey = callPackage ../servers/mail/postgrey { };
 
-  pshs = callPackage ../servers/http/pshs { };
-
   quark = callPackage ../servers/http/quark { };
 
   smtprelay = callPackage ../servers/mail/smtprelay { };
@@ -29553,6 +29552,7 @@ with pkgs;
 
   blender = callPackage  ../applications/misc/blender {
     openexr = openexr_3;
+    python3Packages = python311Packages;
     inherit (darwin.apple_sdk.frameworks) Cocoa CoreGraphics ForceFeedback OpenAL OpenGL;
   };
 
@@ -35691,8 +35691,6 @@ with pkgs;
 
   monero-gui = libsForQt5.callPackage ../applications/blockchains/monero-gui { };
 
-  masari = callPackage ../applications/blockchains/masari { };
-
   napari = with python3Packages; toPythonApplication napari;
 
   nano-wallet = libsForQt5.callPackage ../applications/blockchains/nano-wallet { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index d516da1b12e0..0939db097e0b 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -585,6 +585,10 @@ let
 
     genspio = callPackage ../development/ocaml-modules/genspio { };
 
+    get-activity = callPackage ../development/ocaml-modules/get-activity { };
+
+    get-activity-lib = callPackage ../development/ocaml-modules/get-activity/lib.nix { };
+
     getopt = callPackage ../development/ocaml-modules/getopt { };
 
     gettext-camomile = callPackage ../development/ocaml-modules/ocaml-gettext/camomile.nix { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b070a357c149..e3e6066cf77d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4104,6 +4104,11 @@ self: super: with self; {
     python3Packages = self;
   });
 
+  f3d_egl = toPythonModule (pkgs.f3d_egl.override {
+    withPythonBinding = true;
+    python3Packages = self;
+  });
+
   f5-icontrol-rest = callPackage ../development/python-modules/f5-icontrol-rest { };
 
   f5-sdk = callPackage ../development/python-modules/f5-sdk { };
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index 331c97d5a4d3..f3ce480c9ac0 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -158,6 +158,7 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
 
   libopenshot = callPackage ../development/libraries/libopenshot {
     stdenv = if pkgs.stdenv.isDarwin then pkgs.overrideSDK pkgs.stdenv "11.0" else pkgs.stdenv;
+    python3 = pkgs.python311;
   };
 
   packagekit-qt = callPackage ../tools/package-management/packagekit/qt.nix { };