diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index e68a29b0b3fd..9acfd4181108 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -428,7 +428,26 @@ NOTE: It is highly recommended to use a pinned version of pnpm (i.e. `pnpm_8` or
 
 In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e. `inherit (finalAttrs) patches`.
 
-`pnpm.configHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array.
+`pnpm.configHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:
+
+```nix
+{
+  pnpm,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "foo";
+  version = "0-unstable-1980-01-01";
+
+  src = ...;
+
+  pnpmInstallFlags = [ "--shamefully-hoist" ];
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pnpmInstallFlags;
+  };
+})
+```
 
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
@@ -459,16 +478,16 @@ Assuming the following directory structure, we can define `sourceRoot` and `pnpm
 
 #### PNPM Workspaces {#javascript-pnpm-workspaces}
 
-If you need to use a PNPM workspace for your project, then set `pnpmWorkspace = "<workspace project name>"` in your `pnpm.fetchDeps` call,
-which will make PNPM only install dependencies for that workspace package.
+If you need to use a PNPM workspace for your project, then set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]`, etc, in your `pnpm.fetchDeps` call,
+which will make PNPM only install dependencies for those workspace packages.
 
 For example:
 
 ```nix
 ...
-pnpmWorkspace = "@astrojs/language-server";
+pnpmWorkspaces = [ "@astrojs/language-server" ];
 pnpmDeps = pnpm.fetchDeps {
-  inherit (finalAttrs) pnpmWorkspace;
+  inherit (finalAttrs) pnpmWorkspaces;
   ...
 }
 ```
@@ -476,7 +495,7 @@ pnpmDeps = pnpm.fetchDeps {
 The above would make `pnpm.fetchDeps` call only install dependencies for the `@astrojs/language-server` workspace package.
 Note that you do not need to set `sourceRoot` to make this work.
 
-Usually in such cases, you'd want to use `pnpm --filter=$pnpmWorkspace build` to build your project, as `npmHooks.npmBuildHook` probably won't work. A `buildPhase` based on the following example will probably fit most workspace projects:
+Usually in such cases, you'd want to use `pnpm --filter=<pnpm workspace name> build` to build your project, as `npmHooks.npmBuildHook` probably won't work. A `buildPhase` based on the following example will probably fit most workspace projects:
 
 ```nix
 buildPhase = ''
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f44254be32e4..fed81e98a0ff 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23179,6 +23179,17 @@
     githubId = 36118348;
     keys = [ { fingerprint = "69C9 876B 5797 1B2E 11C5  7C39 80A1 F76F C9F9 54AE"; } ];
   };
+  wizardlink = {
+    name = "wizardlink";
+    email = "contact@thewizard.link";
+    github = "wizardlink";
+    githubId = 26727907;
+    keys = [
+      {
+        fingerprint = "A1D3 A2B4 E14B D7C0 445B  B749 A576 7B54 367C FBDF";
+      }
+    ];
+  };
   wizeman = {
     email = "rcorreia@wizy.org";
     github = "wizeman";
diff --git a/maintainers/scripts/rebuild-amount.sh b/maintainers/scripts/rebuild-amount.sh
index 32810f6b98c0..0058e8c04ba0 100755
--- a/maintainers/scripts/rebuild-amount.sh
+++ b/maintainers/scripts/rebuild-amount.sh
@@ -81,11 +81,13 @@ newPkgs() {
     # could eat too much memory for a standard 4GiB machine.
     local -a list
     for i in 1 2; do
-        local l="$($MKTEMP)"
+        local l
+        l="$($MKTEMP)"
         list[$i]="$l"
         toRemove+=("$l")
 
-        local expr="$($MKTEMP)"
+        local expr
+        expr="$($MKTEMP)"
         toRemove+=("$expr")
         nixexpr "${!i}" > "$expr"
 
diff --git a/nixos/modules/services/misc/bazarr.nix b/nixos/modules/services/misc/bazarr.nix
index 0bf326a19386..35929beac402 100644
--- a/nixos/modules/services/misc/bazarr.nix
+++ b/nixos/modules/services/misc/bazarr.nix
@@ -37,7 +37,7 @@ in
 
   config = lib.mkIf cfg.enable {
     systemd.services.bazarr = {
-      description = "bazarr";
+      description = "Bazarr";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
diff --git a/nixos/modules/services/web-apps/youtrack.nix b/nixos/modules/services/web-apps/youtrack.nix
index ff48a978b734..e80cdda68087 100644
--- a/nixos/modules/services/web-apps/youtrack.nix
+++ b/nixos/modules/services/web-apps/youtrack.nix
@@ -9,6 +9,8 @@ in
     (lib.mkRenamedOptionModule [ "services" "youtrack" "port" ] [ "services" "youtrack" "environmentalParameters" "listen-port" ])
     (lib.mkRemovedOptionModule [ "services" "youtrack" "maxMemory" ] "Please instead use `services.youtrack.generalParameters`.")
     (lib.mkRemovedOptionModule [ "services" "youtrack" "maxMetaspaceSize" ] "Please instead use `services.youtrack.generalParameters`.")
+    (lib.mkRemovedOptionModule [ "services" "youtrack" "extraParams" ] "Please migrate to `services.youtrack.generalParameters`.")
+    (lib.mkRemovedOptionModule [ "services" "youtrack" "jvmOpts" ] "Please migrate to `services.youtrack.generalParameters`.")
   ];
 
   options.services.youtrack = {
@@ -22,33 +24,15 @@ in
       type = lib.types.str;
     };
 
-    extraParams = lib.mkOption {
-      default = {};
-      description = ''
-        Extra parameters to pass to youtrack.
-        Use to configure YouTrack 2022.x, deprecated with YouTrack 2023.x. Use `services.youtrack.generalParameters`.
-        https://www.jetbrains.com/help/youtrack/standalone/YouTrack-Java-Start-Parameters.html
-        for more information.
-      '';
-      example = lib.literalExpression ''
-        {
-          "jetbrains.youtrack.overrideRootPassword" = "tortuga";
-        }
-      '';
-      type = lib.types.attrsOf lib.types.str;
-      visible = false;
-    };
-
     package = lib.mkOption {
       description = ''
         Package to use.
       '';
       type = lib.types.package;
-      default = null;
-      relatedPackages = [ "youtrack_2022_3" "youtrack" ];
+      default = pkgs.youtrack;
+      defaultText = lib.literalExpression "pkgs.youtrack";
     };
 
-
     statePath = lib.mkOption {
       description = ''
         Path were the YouTrack state is stored.
@@ -67,19 +51,6 @@ in
       type = lib.types.nullOr lib.types.str;
     };
 
-    jvmOpts = lib.mkOption {
-      description = ''
-        Extra options to pass to the JVM.
-        Only has a use with YouTrack 2022.x, deprecated with YouTrack 2023.x. Use `serivces.youtrack.generalParameters`.
-        See https://www.jetbrains.com/help/youtrack/standalone/Configure-JVM-Options.html
-        for more information.
-      '';
-      type = lib.types.separatedString " ";
-      example = "--J-XX:MetaspaceSize=250m";
-      default = "";
-      visible = false;
-    };
-
     autoUpgrade = lib.mkOption {
       type = lib.types.bool;
       default = true;
@@ -90,7 +61,6 @@ in
       type = with lib.types; listOf str;
       description = ''
         General configuration parameters and other JVM options.
-        Only has an effect for YouTrack 2023.x.
         See https://www.jetbrains.com/help/youtrack/server/2023.3/youtrack-java-start-parameters.html#general-parameters
         for more information.
       '';
@@ -121,7 +91,6 @@ in
       };
       description = ''
         Environmental configuration parameters, set imperatively. The values doesn't get removed, when removed in Nix.
-        Only has an effect for YouTrack 2023.x.
         See https://www.jetbrains.com/help/youtrack/server/2023.3/youtrack-java-start-parameters.html#environmental-parameters
         for more information.
       '';
@@ -135,90 +104,47 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    warnings = lib.optional (lib.versions.major cfg.package.version <= "2022")
-      "YouTrack 2022.x is deprecated. See https://nixos.org/manual/nixos/unstable/index.html#module-services-youtrack for details on how to upgrade."
-    ++ lib.optional (cfg.extraParams != {} && (lib.versions.major cfg.package.version >= "2023"))
-      "'services.youtrack.extraParams' is deprecated and has no effect on YouTrack 2023.x and newer. Please migrate to 'services.youtrack.generalParameters'"
-    ++ lib.optional (cfg.jvmOpts != "" && (lib.versions.major cfg.package.version >= "2023"))
-      "'services.youtrack.jvmOpts' is deprecated and has no effect on YouTrack 2023.x and newer. Please migrate to 'services.youtrack.generalParameters'";
-
-    # XXX: Drop all version feature switches at the point when we consider YT 2022.3 as outdated.
-    services.youtrack.package = lib.mkDefault (
-      if lib.versionAtLeast config.system.stateVersion "24.11" then pkgs.youtrack
-      else pkgs.youtrack_2022_3
-    );
-
-    services.youtrack.generalParameters = lib.optional (lib.versions.major cfg.package.version >= "2023")
-      "-Ddisable.configuration.wizard.on.upgrade=${lib.boolToString cfg.autoUpgrade}"
-      ++ (lib.mapAttrsToList (k: v: "-D${k}=${v}") cfg.extraParams);
+    services.youtrack.generalParameters = [ "-Ddisable.configuration.wizard.on.upgrade=${lib.boolToString cfg.autoUpgrade}" ];
 
     systemd.services.youtrack = let
-      service_jar = let
-        mergeAttrList = lib.foldl' lib.mergeAttrs {};
-        stdParams = mergeAttrList [
-          (lib.optionalAttrs (cfg.environmentalParameters ? base-url && cfg.environmentalParameters.base-url != null) {
-            "jetbrains.youtrack.baseUrl" = cfg.environmentalParameters.base-url;
-          })
-          {
-          "java.aws.headless" = "true";
-          "jetbrains.youtrack.disableBrowser" = "true";
-          }
-        ];
-        extraAttr = lib.concatStringsSep " " (lib.mapAttrsToList (k: v: "-D${k}=${v}") (stdParams // cfg.extraParams));
-      in {
-        environment.HOME = cfg.statePath;
-        environment.YOUTRACK_JVM_OPTS = "${extraAttr}";
-        after = [ "network.target" ];
-        wantedBy = [ "multi-user.target" ];
-        path = with pkgs; [ unixtools.hostname ];
-        serviceConfig = {
+      jvmoptions = pkgs.writeTextFile {
+        name = "youtrack.jvmoptions";
+        text = (lib.concatStringsSep "\n" cfg.generalParameters);
+      };
+
+      package = cfg.package.override {
+        statePath = cfg.statePath;
+      };
+    in {
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      path = with pkgs; [ unixtools.hostname ];
+      preStart = ''
+        # This detects old (i.e. <= 2022.3) installations that were not migrated yet
+        # and migrates them to the new state directory style
+        if [[ -d ${cfg.statePath}/teamsysdata ]] && [[ ! -d ${cfg.statePath}/2022_3 ]]
+        then
+          mkdir -p ${cfg.statePath}/2022_3
+          mv ${cfg.statePath}/teamsysdata ${cfg.statePath}/2022_3
+          mv ${cfg.statePath}/.youtrack ${cfg.statePath}/2022_3
+        fi
+        mkdir -p ${cfg.statePath}/{backups,conf,data,logs,temp}
+        ${pkgs.coreutils}/bin/ln -fs ${jvmoptions} ${cfg.statePath}/conf/youtrack.jvmoptions
+        ${package}/bin/youtrack configure ${lib.concatStringsSep " " (lib.mapAttrsToList (name: value: "--${name}=${toString value}") cfg.environmentalParameters )}
+      '';
+      serviceConfig = lib.mkMerge [
+        {
           Type = "simple";
           User = "youtrack";
           Group = "youtrack";
           Restart = "on-failure";
-          ExecStart = ''${cfg.package}/bin/youtrack ${cfg.jvmOpts} ${cfg.environmentalParameters.listen-address}:${toString cfg.environmentalParameters.listen-port}'';
-        };
-      };
-      service_zip = let
-        jvmoptions = pkgs.writeTextFile {
-          name = "youtrack.jvmoptions";
-          text = (lib.concatStringsSep "\n" cfg.generalParameters);
-        };
-
-        package = cfg.package.override {
-          statePath = cfg.statePath;
-        };
-      in {
-        after = [ "network.target" ];
-        wantedBy = [ "multi-user.target" ];
-        path = with pkgs; [ unixtools.hostname ];
-        preStart = ''
-          # This detects old (i.e. <= 2022.3) installations that were not migrated yet
-          # and migrates them to the new state directory style
-          if [[ -d ${cfg.statePath}/teamsysdata ]] && [[ ! -d ${cfg.statePath}/2022_3 ]]
-          then
-            mkdir -p ${cfg.statePath}/2022_3
-            mv ${cfg.statePath}/teamsysdata ${cfg.statePath}/2022_3
-            mv ${cfg.statePath}/.youtrack ${cfg.statePath}/2022_3
-          fi
-          mkdir -p ${cfg.statePath}/{backups,conf,data,logs,temp}
-          ${pkgs.coreutils}/bin/ln -fs ${jvmoptions} ${cfg.statePath}/conf/youtrack.jvmoptions
-          ${package}/bin/youtrack configure ${lib.concatStringsSep " " (lib.mapAttrsToList (name: value: "--${name}=${toString value}") cfg.environmentalParameters )}
-        '';
-        serviceConfig = lib.mkMerge [
-          {
-            Type = "simple";
-            User = "youtrack";
-            Group = "youtrack";
-            Restart = "on-failure";
-            ExecStart = "${package}/bin/youtrack run";
-          }
-          (lib.mkIf (cfg.statePath == "/var/lib/youtrack") {
-            StateDirectory = "youtrack";
-          })
-        ];
-      };
-    in if (lib.versions.major cfg.package.version >= "2023") then service_zip else service_jar;
+          ExecStart = "${package}/bin/youtrack run";
+        }
+        (lib.mkIf (cfg.statePath == "/var/lib/youtrack") {
+          StateDirectory = "youtrack";
+        })
+      ];
+    };
 
     users.users.youtrack = {
       description = "Youtrack service user";
diff --git a/pkgs/applications/misc/xmrig/moneroocean.nix b/pkgs/applications/misc/xmrig/moneroocean.nix
index 34629c9fef72..dac636ddbdb3 100644
--- a/pkgs/applications/misc/xmrig/moneroocean.nix
+++ b/pkgs/applications/misc/xmrig/moneroocean.nix
@@ -5,13 +5,13 @@
 
 xmrig.overrideAttrs (oldAttrs: rec {
   pname = "xmrig-mo";
-  version = "6.22.0-mo3";
+  version = "6.22.1-mo1";
 
   src = fetchFromGitHub {
     owner = "MoneroOcean";
     repo = "xmrig";
     rev = "v${version}";
-    hash = "sha256-3KFyCs9Kf0i7IkG1piP/DRj1jTj1VmXbAk/U3Wt4jh0=";
+    hash = "sha256-CwGHSrnxzKCLKJC7MmqWATqTUNehhRECcX4g/e9oGSI=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/cloudflare-dyndns/default.nix b/pkgs/applications/networking/cloudflare-dyndns/default.nix
index 087b3c66f00d..cf013c5d69ac 100644
--- a/pkgs/applications/networking/cloudflare-dyndns/default.nix
+++ b/pkgs/applications/networking/cloudflare-dyndns/default.nix
@@ -1,52 +1,39 @@
-{ lib
-, python3
-, fetchFromGitHub
-, fetchpatch
+{
+  lib,
+  python3,
+  fetchFromGitHub,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cloudflare-dyndns";
-  version = "4.1";
-  format = "pyproject";
+  version = "5.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kissgyorgy";
-    repo = pname;
+    repo = "cloudflare-dyndns";
     rev = "v${version}";
-    hash = "sha256-6Q5fpJ+HuQ+hc3xTtB5tR43pn9WZ0nZZR723iLAkpis=";
+    hash = "sha256-tI6qdNxIMEuAR+BcqsRi2EBXTQnfdDLKW7Y+fbcmlao=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [
     poetry-core
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     attrs
     click
     cloudflare
-    pydantic_1
+    pydantic
     requests
+    httpx
+    truststore
   ];
 
   nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
   ];
 
-  patches = [
-    # Switch to poetry-core, https://github.com/kissgyorgy/cloudflare-dyndns/pull/22
-    (fetchpatch {
-      name = "switch-to-poetry-core.patch";
-      url = "https://github.com/kissgyorgy/cloudflare-dyndns/commit/741ed1ccb3373071ce15683a3b8ddc78d64866f8.patch";
-      sha256 = "sha256-mjSah0DWptZB6cjhP6dJg10BpJylPSQ2K4TKda7VmHw=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'click = "^7.0"' 'click = "*"' \
-      --replace 'attrs = "^21.1.0"' 'attrs = "*"'
-  '';
-
   disabledTests = [
     "test_get_ipv4"
   ];
diff --git a/pkgs/applications/networking/cluster/talosctl/default.nix b/pkgs/applications/networking/cluster/talosctl/default.nix
index 583aa3bf063a..801a4cfbc5c6 100644
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    hash = "sha256-Ezie6RQsigmJgdvnSVk6awuUu2kODSio9DNg4bow76M=";
+    hash = "sha256-6WHeiVH/vZHiM4bqq3T5lC0ARldJyZtIErPeDgrZgxc=";
   };
 
-  vendorHash = "sha256-9qkealjjdBO659fdWdgFii3ThPRwKpYasB03L3Bktqs=";
+  vendorHash = "sha256-aTtvVpL979BUvSBwBqRqCWSWIBBmmty9vBD97Q5P4+E=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix
index 97756395964e..c482ff0313b1 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.81";
+  "version" = "1.11.82";
   "hashes" = {
-    "desktopSrcHash" = "sha256-Dr1Bu05UzfqXDceBC6GP3A3Actt5ycUZlJ+MSLYkDZ0=";
-    "desktopYarnHash" = "19ly8as7y1a1vwaxzmziwia3idnndf1iyz0l160zc213pd3nzabz";
-    "webSrcHash" = "sha256-NaoBGyoHyCfmcOOokkQL6DrLxVQufVdZP/pgVMY6CPA=";
-    "webYarnHash" = "1ap2cjxz5332sm7b1fv0530pibgrfman90i7msyr6a1zfvvds0cc";
+    "desktopSrcHash" = "sha256-XG8q37N4PehYKPyoedgsIIBp2jrSHtoSJKaGrsxaIM8=";
+    "desktopYarnHash" = "11130y915pa356fikk3i96w81ms41284x11d4xm1xw8385smjbgq";
+    "webSrcHash" = "sha256-2W3noZfVnxpxwihimH6mlTxFpBpAdvXtLLfVHRiToxE=";
+    "webYarnHash" = "1rmimxkd70ynrf29s67336vv43g2i6ry8bibc06zb8qyicg6ld83";
   };
 }
diff --git a/pkgs/applications/terminal-emulators/foot/default.nix b/pkgs/applications/terminal-emulators/foot/default.nix
index e7eb39e8a756..d84858ad07f8 100644
--- a/pkgs/applications/terminal-emulators/foot/default.nix
+++ b/pkgs/applications/terminal-emulators/foot/default.nix
@@ -26,7 +26,7 @@
 }:
 
 let
-  version = "1.18.1";
+  version = "1.19.0";
 
   # build stimuli file for PGO build and the script to generate it
   # independently of the foot's build, so we can cache the result
@@ -98,7 +98,7 @@ stdenv.mkDerivation {
     owner = "dnkl";
     repo = "foot";
     rev = version;
-    hash = "sha256:15s7fbkibvq53flf5yy9ad37y53pl83rcnjwlnfh96a4s5mj6v5d";
+    hash = "sha256-EY6VNrAxqA20RHLqfusbdxJPfEE7Fchi1W0noHfbxws=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/applications/version-management/git-mit/default.nix b/pkgs/applications/version-management/git-mit/default.nix
index 2dc3ab74a05d..e334ef8c9fb6 100644
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.13.29";
+  version = "5.13.30";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-8XUpUpsd2q/1N28ZAPt7rW0pJu0WzE6oVSOwdJxhSBk=";
+    hash = "sha256-HBY9YJk7LvhCGAuXsWpugD5uSitLc1f/F4Ms4PxhZUo=";
   };
 
-  cargoHash = "sha256-KtdbYzXHpdg0Rf4ENrWpP0+vG3+HlLVi7MLeXp9HoVw=";
+  cargoHash = "sha256-XMlVGr88RWwfJ2gHTSxdOxgUDlf51ra/opL66Dkd1p4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/video/mpv/0001-fix-darwin-build.patch b/pkgs/applications/video/mpv/0001-fix-darwin-build.patch
deleted file mode 100644
index 2b6085ed3c9f..000000000000
--- a/pkgs/applications/video/mpv/0001-fix-darwin-build.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/osdep/mac/input_helper.swift b/osdep/mac/input_helper.swift
-index 0acec6bd40..0ec5837864 100644
---- a/osdep/mac/input_helper.swift
-+++ b/osdep/mac/input_helper.swift
-@@ -18,6 +18,14 @@
- import Cocoa
- import Carbon.HIToolbox
- 
-+extension NSCondition {
-+    fileprivate func withLock<T>(_ body: () throws -> T) rethrows -> T {
-+        self.lock()
-+        defer { self.unlock() }
-+        return try body()
-+    }
-+}
-+
- class InputHelper: NSObject {
-     var option: OptionHelper?
-     var lock = NSCondition()
diff --git a/pkgs/by-name/ar/arc-browser/package.nix b/pkgs/by-name/ar/arc-browser/package.nix
index 39e8d88255f1..00e3e6757d83 100644
--- a/pkgs/by-name/ar/arc-browser/package.nix
+++ b/pkgs/by-name/ar/arc-browser/package.nix
@@ -1,19 +1,20 @@
-{ lib
-, stdenvNoCC
-, fetchurl
-, undmg
-, writeShellApplication
-, curl
-, common-updater-scripts
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  undmg,
+  writeShellApplication,
+  curl,
+  common-updater-scripts,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arc-browser";
-  version = "1.63.1-54714";
+  version = "1.65.0-54911";
 
   src = fetchurl {
     url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-jL8iAh+e8Z72VG9XQbswjyTPtjO2Pm8ealRte8xr1PQ=";
+    hash = "sha256-7p1FizITL4GVvlDTV91nwYQZ7LKEd4snJQX0NvB81Qo=";
   };
 
   nativeBuildInputs = [ undmg ];
@@ -23,8 +24,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/Applications/Arc.app
-    cp -R . $out/Applications/Arc.app
+    mkdir -p "$out/Applications/Arc.app"
+    cp -R . "$out/Applications/Arc.app"
 
     runHook postInstall
   '';
@@ -33,9 +34,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   passthru.updateScript = lib.getExe (writeShellApplication {
     name = "arc-browser-update-script";
-    runtimeInputs = [ curl common-updater-scripts ];
+    runtimeInputs = [
+      curl
+      common-updater-scripts
+    ];
     text = ''
-      set -euo pipefail
       redirect_url="$(curl -s -L -f "https://releases.arc.net/release/Arc-latest.dmg" -o /dev/null -w '%{url_effective}')"
       # The url scheme is: https://releases.arc.net/release/Arc-1.23.4-56789.dmg
       # We strip everything before 'Arc-' and after '.dmg'
@@ -50,7 +53,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://arc.net/";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ donteatoreo ];
-    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 })
diff --git a/pkgs/by-name/as/astro-language-server/package.nix b/pkgs/by-name/as/astro-language-server/package.nix
index a979dafd8a24..23c06cfe5062 100644
--- a/pkgs/by-name/as/astro-language-server/package.nix
+++ b/pkgs/by-name/as/astro-language-server/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
       pname
       version
       src
-      pnpmWorkspace
+      pnpmWorkspaces
       prePnpmInstall
       ;
     hash = "sha256-/X8ZoWK5kBPm/8clBDP+B9A5ofXnH2svmy4kMc2t5iA=";
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Must specify to download "@astrojs/yaml2ts" depencendies
   # https://pnpm.io/filtering#--filter-package_name-1
-  pnpmWorkspace = "@astrojs/language-server...";
+  pnpmWorkspaces = [ "@astrojs/language-server..." ];
   prePnpmInstall = ''
     # Warning section for "pnpm@v8"
     # https://pnpm.io/cli/install#--filter-package_selector
diff --git a/pkgs/by-name/ba/bash-language-server/package.nix b/pkgs/by-name/ba/bash-language-server/package.nix
index 2778d255cecb..a5853aeb9e2c 100644
--- a/pkgs/by-name/ba/bash-language-server/package.nix
+++ b/pkgs/by-name/ba/bash-language-server/package.nix
@@ -19,9 +19,9 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-yJ81oGd9aNsWQMLvDSgMVVH1//Mw/SVFYFIPsJTQYzE=";
   };
 
-  pnpmWorkspace = "bash-language-server";
+  pnpmWorkspaces = [ "bash-language-server" ];
   pnpmDeps = pnpm_8.fetchDeps {
-    inherit (finalAttrs) pname version src pnpmWorkspace;
+    inherit (finalAttrs) pname version src pnpmWorkspaces;
     hash = "sha256-W25xehcxncBs9QgQBt17F5YHK0b+GDEmt27XzTkyYWg=";
   };
 
diff --git a/pkgs/by-name/be/beekeeper-studio/package.nix b/pkgs/by-name/be/beekeeper-studio/package.nix
index 274bf24136db..437d3b7e7e4c 100644
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -7,7 +7,7 @@
 
 let
   pname = "beekeeper-studio";
-  version = "4.6.2";
+  version = "4.6.8";
 
   plat = {
     aarch64-linux = "-arm64";
@@ -15,8 +15,8 @@ let
   }.${stdenv.hostPlatform.system};
 
   hash = {
-    aarch64-linux = "sha256-ZxqwxCON21S+RPG0/M2TtcI2Ave7ZT05lKQdyysQFUk=";
-    x86_64-linux = "sha256-8sGFNoAsX+X3IJDXpwlYRt78nokauPYz88yDEYy6NP8=";
+    aarch64-linux = "sha256-EKGL+aeuCcBuSh+VtkdgFhI1LccuvO8WHoqbZ/JdX7c=";
+    x86_64-linux = "sha256-LyO9xCqZG5gNAvCIX9wacSb59wiLjXPDta+Fipu24fk=";
   }.${stdenv.hostPlatform.system};
 
   src = fetchurl {
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index 6531632cc1bd..edd016c15139 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -189,6 +189,7 @@ in buildNpmPackage rec {
       comment = description;
       desktopName = "Bitwarden";
       categories = [ "Utility" ];
+      mimeTypes = [ "x-scheme-handler/bitwarden" ];
     })
   ];
 
diff --git a/pkgs/development/tools/buildpack/default.nix b/pkgs/by-name/bu/buildpack/package.nix
similarity index 70%
rename from pkgs/development/tools/buildpack/default.nix
rename to pkgs/by-name/bu/buildpack/package.nix
index 31a4c70bd68f..548550164391 100644
--- a/pkgs/development/tools/buildpack/default.nix
+++ b/pkgs/by-name/bu/buildpack/package.nix
@@ -1,13 +1,21 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+}:
 
-buildGoModule rec {
+let
   pname = "pack";
   version = "0.35.1";
+in
+buildGoModule {
+  inherit pname version;
 
   src = fetchFromGitHub {
     owner = "buildpacks";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-iQkYtnobhAt73JMRrejk0DkOH1ZW2bqfZx05ZrDG5bA=";
   };
 
@@ -17,7 +25,11 @@ buildGoModule rec {
 
   subPackages = [ "cmd/pack" ];
 
-  ldflags = [ "-s" "-w" "-X github.com/buildpacks/pack.Version=${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/buildpacks/pack.Version=${version}"
+  ];
 
   postInstall = ''
     installShellCompletion --cmd pack \
@@ -26,12 +38,12 @@ buildGoModule rec {
       --fish $(PACK_HOME=$PWD $out/bin/pack completion --shell fish)
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://buildpacks.io/";
     changelog = "https://github.com/buildpacks/pack/releases/tag/v${version}";
     description = "CLI for building apps using Cloud Native Buildpacks";
     mainProgram = "pack";
-    license = licenses.asl20;
-    maintainers = [ ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ momeemt ];
   };
 }
diff --git a/pkgs/by-name/ca/castxml/package.nix b/pkgs/by-name/ca/castxml/package.nix
index fc8eccd1dcca..03a984741211 100644
--- a/pkgs/by-name/ca/castxml/package.nix
+++ b/pkgs/by-name/ca/castxml/package.nix
@@ -52,6 +52,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  # darwin clang adds `-isysroot` when $SDKROOT is set. this confuses the
+  # regular expressions for the disabled tests below.
+  checkPhase = ''
+    runHook preCheck
+    ctest -E 'cmd.cc-gnu-(src-cxx|c-src-c)-cmd' -j $NIX_BUILD_CORES
+    runHook postCheck
+  '';
+
   passthru.tests = testers.testVersion { package = finalAttrs.finalPackage; };
 
   meta = {
diff --git a/pkgs/tools/misc/hyfetch/default.nix b/pkgs/by-name/hy/hyfetch/package.nix
similarity index 66%
rename from pkgs/tools/misc/hyfetch/default.nix
rename to pkgs/by-name/hy/hyfetch/package.nix
index 2e906541bda1..e88178b7880e 100644
--- a/pkgs/tools/misc/hyfetch/default.nix
+++ b/pkgs/by-name/hy/hyfetch/package.nix
@@ -1,23 +1,26 @@
-{ lib
-, fetchFromGitHub
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
 }:
-
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "hyfetch";
-  version = "1.4.11";
-  format = "setuptools";
+  version = "1.99.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hykilpikonna";
     repo = "hyfetch";
     rev = "refs/tags/${version}";
-    hash = "sha256-xzN/tbS5BUvpKeozesE99gNp3NRDjvf4Qx7BHLc4svo=";
+    hash = "sha256-GL1/V+LgSXJ4b28PfinScDrJhU9VDa4pVi24zWEzbAk=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
-    typing-extensions
-    setuptools
+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  dependencies = [
+    python3Packages.typing-extensions
   ];
 
   # No test available
@@ -27,7 +30,7 @@ python3.pkgs.buildPythonApplication rec {
     "hyfetch"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "neofetch with pride flags <3";
     longDescription = ''
       HyFetch is a command-line system information tool fork of neofetch.
@@ -39,8 +42,11 @@ python3.pkgs.buildPythonApplication rec {
       icon set you are using, etc.
     '';
     homepage = "https://github.com/hykilpikonna/HyFetch";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     mainProgram = "hyfetch";
-    maintainers = with maintainers; [ yisuidenghua ];
+    maintainers = with lib.maintainers; [
+      yisuidenghua
+      isabelroses
+    ];
   };
 }
diff --git a/pkgs/by-name/in/inv-sig-helper/package.nix b/pkgs/by-name/in/inv-sig-helper/package.nix
index 31f78a23b5f7..a6b295a0fbf2 100644
--- a/pkgs/by-name/in/inv-sig-helper/package.nix
+++ b/pkgs/by-name/in/inv-sig-helper/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage {
   pname = "inv-sig-helper";
-  version = "0-unstable-2024-08-17";
+  version = "0-unstable-2024-09-24";
 
   src = fetchFromGitHub {
     owner = "iv-org";
     repo = "inv_sig_helper";
-    rev = "215d32c76e5e9e598de6e4f8542316f80dd92f57";
-    hash = "sha256-Ge0XoWrscyZSrkmtDPkAnv96IVylKZTcgGgonbFV43I=";
+    rev = "5025e49e6106f93ec06d0e3fd542a51e1c44c25a";
+    hash = "sha256-fMRjkZRMvcro3pOO20l5zRDOwn/E5KTVBOiDmcGROz4=";
   };
 
-  cargoHash = "sha256-JVpLUhNJ7/4WZwLn/zOurpP8kF5WblF3nphJh6keHG8=";
+  cargoHash = "sha256-AisolMo++xMDesdfafeGx37r7sGbk0P0vMsHq0YTUL4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/op/opnborg/package.nix b/pkgs/by-name/op/opnborg/package.nix
index 8c8d167dfa39..15ab67158a97 100644
--- a/pkgs/by-name/op/opnborg/package.nix
+++ b/pkgs/by-name/op/opnborg/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "opnborg";
-  version = "0.1.2";
+  version = "0.1.18";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "opnborg";
     rev = "v${version}";
-    hash = "sha256-R8yl7dI+VNeY1OVoBo+CN88+2eSePjlzet/Zowj0cQs=";
+    hash = "sha256-eRJLdrNspkdpb24Bz7GjvcC+1iwRVXyG6Rjqf3fGkZY=";
   };
 
   vendorHash = "sha256-REXJryUcu+/AdVx1aK0nJ98Wq/EdhrZqL24kC1wK6mc=";
diff --git a/pkgs/by-name/pu/pulumi-esc/package.nix b/pkgs/by-name/pu/pulumi-esc/package.nix
index b9fc15444e62..a0417b5c2ff2 100644
--- a/pkgs/by-name/pu/pulumi-esc/package.nix
+++ b/pkgs/by-name/pu/pulumi-esc/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "pulumi-esc";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "pulumi";
     repo = "esc";
     rev = "v${version}";
-    hash = "sha256-SeHO8N8NwAF4f6Eo46V2mBElVgJc5ijVrjsBHWtUMc0=";
+    hash = "sha256-/H2HFjq/CpY5/xj9tqr+1Qo1nD06joahvbIiu16DLrs=";
   };
 
   subPackages = "cmd/esc";
 
-  vendorHash = "sha256-xJtlTyhGyoxefE2pFcLGHMapn9L2F/PKuNt49J41viE=";
+  vendorHash = "sha256-T9DUgfYpu1xXekMxzlr2VwmPSkD/sPml+G0KaFeeAWA=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/misc/rpiboot/default.nix b/pkgs/by-name/rp/rpiboot/package.nix
similarity index 53%
rename from pkgs/development/misc/rpiboot/default.nix
rename to pkgs/by-name/rp/rpiboot/package.nix
index 53b8c0326b1b..424132d6361a 100644
--- a/pkgs/development/misc/rpiboot/default.nix
+++ b/pkgs/by-name/rp/rpiboot/package.nix
@@ -1,14 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, libusb1, pkg-config }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libusb1,
+  pkg-config,
+}:
 
 stdenv.mkDerivation rec {
   pname = "rpiboot";
-  version = "20221215-105525";
+  version = "20240926-102326";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "usbboot";
     rev = version;
-    hash = "sha256-Y77IrDblXmnpZleJ3zTyiGDYLZ7gNxASXpqUzwS1NCU=";
+    hash = "sha256-9m7PAw1WNQlfqOr5hDXrCsZlZLBmvoGUT58NN2cVolw=";
   };
 
   buildInputs = [ libusb1 ];
@@ -22,16 +28,27 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
     mkdir -p $out/share/rpiboot
     cp rpiboot $out/bin
-    cp -r msd $out/share/rpiboot
+    cp -r msd firmware eeprom-erase mass-storage-gadget* recovery* secure-boot* rpi-imager-embedded $out/share/rpiboot
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/raspberrypi/usbboot";
     changelog = "https://github.com/raspberrypi/usbboot/blob/${version}/debian/changelog";
     description = "Utility to boot a Raspberry Pi CM/CM3/CM4/Zero over USB";
     mainProgram = "rpiboot";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ cartr flokli ];
-    platforms = [ "aarch64-linux" "aarch64-darwin" "armv7l-linux" "armv6l-linux" "x86_64-linux" "x86_64-darwin" ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      cartr
+      flokli
+      stv0g
+    ];
+    platforms = [
+      "aarch64-linux"
+      "aarch64-darwin"
+      "armv7l-linux"
+      "armv6l-linux"
+      "x86_64-linux"
+      "x86_64-darwin"
+    ];
   };
 }
diff --git a/pkgs/by-name/sy/syncyomi/package.nix b/pkgs/by-name/sy/syncyomi/package.nix
index 103bc5831957..96bb04803eeb 100644
--- a/pkgs/by-name/sy/syncyomi/package.nix
+++ b/pkgs/by-name/sy/syncyomi/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "syncyomi";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "SyncYomi";
     repo = "SyncYomi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-90MA62Zm9ouaf+CnYsbOm/njrUui21vW/VrwKYfsCZs=";
+    hash = "sha256-PPE6UXHo2ZlN0A0VkUH+8pkdfm6WEvpofusk6c3RBHk=";
   };
 
   vendorHash = "sha256-/rpT6SatIZ+GVzmVg6b8Zy32pGybprObotyvEgvdL2w=";
diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/by-name/tf/tflint/package.nix
similarity index 62%
rename from pkgs/development/tools/analysis/tflint/default.nix
rename to pkgs/by-name/tf/tflint/package.nix
index c3a7b65b051d..5ec4650a11a6 100644
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/by-name/tf/tflint/package.nix
@@ -1,21 +1,25 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, runCommand
-, makeWrapper
-, tflint
-, tflint-plugins
-, symlinkJoin
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  runCommand,
+  makeWrapper,
+  tflint,
+  tflint-plugins,
+  symlinkJoin,
 }:
 
-buildGoModule rec {
+let
   pname = "tflint";
   version = "0.52.0";
+in
+buildGoModule {
+  inherit pname version;
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-H27krznCX00F0EZ4ahdsMVh+wcAAUC/ErQac9Y4QaJs=";
   };
 
@@ -25,9 +29,13 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+  ];
 
-  passthru.withPlugins = plugins:
+  passthru.withPlugins =
+    plugins:
     let
       actualPlugins = plugins tflint-plugins;
       pluginDir = symlinkJoin {
@@ -38,17 +46,18 @@ buildGoModule rec {
     runCommand "tflint-with-plugins"
       {
         nativeBuildInputs = [ makeWrapper ];
-      } ''
-      makeWrapper ${tflint}/bin/tflint $out/bin/tflint \
-        --set TFLINT_PLUGIN_DIR "${pluginDir}"
-    '';
+      }
+      ''
+        makeWrapper ${tflint}/bin/tflint $out/bin/tflint \
+          --set TFLINT_PLUGIN_DIR "${pluginDir}"
+      '';
 
-  meta = with lib; {
+  meta = {
     description = "Terraform linter focused on possible errors, best practices, and so on";
     mainProgram = "tflint";
     homepage = "https://github.com/terraform-linters/tflint";
     changelog = "https://github.com/terraform-linters/tflint/blob/v${version}/CHANGELOG.md";
-    license = licenses.mpl20;
-    maintainers = [ ];
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ momeemt ];
   };
 }
diff --git a/pkgs/by-name/yo/youtrack_2022_3/package.nix b/pkgs/by-name/yo/youtrack_2022_3/package.nix
deleted file mode 100644
index 5e1ab1a754f5..000000000000
--- a/pkgs/by-name/yo/youtrack_2022_3/package.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ lib, stdenv, fetchurl, makeWrapper, jdk17, gawk }:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "youtrack";
-  version = "2022.3.65371";
-
-  jar = fetchurl {
-    url = "https://download.jetbrains.com/charisma/youtrack-${finalAttrs.version}.jar";
-    hash = "sha256-NQKWmKEq5ljUXd64zY27Nj8TU+uLdA37chbFVdmwjNs=";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  dontUnpack = true;
-
-  installPhase = ''
-    runHook preInstall
-    makeWrapper ${jdk17}/bin/java $out/bin/youtrack \
-      --add-flags "\$YOUTRACK_JVM_OPTS -jar $jar" \
-      --prefix PATH : "${lib.makeBinPath [ gawk ]}" \
-      --set JRE_HOME ${jdk17}
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Issue tracking and project management tool for developers";
-    maintainers = lib.teams.serokell.members ++ [ lib.maintainers.leona ];
-    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-    # https://www.jetbrains.com/youtrack/buy/license.html
-    license = lib.licenses.unfree;
-  };
-})
diff --git a/pkgs/development/libraries/fcft/default.nix b/pkgs/development/libraries/fcft/default.nix
index ec8c9962125e..2a36329b386f 100644
--- a/pkgs/development/libraries/fcft/default.nix
+++ b/pkgs/development/libraries/fcft/default.nix
@@ -17,25 +17,16 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fcft";
-  version = "3.1.8";
+  version = "3.1.9";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fcft";
     rev = version;
-    hash = "sha256-Wgm2QdW4rg573soF/8HhDmlyN4S2cA0VWOejow464gU=";
+    hash = "sha256-D4W62IHuM7ofEeU/3sp038tv2a1+xQd0mdSKXaY7Ikg=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "system-nanosvg.patch";
-      url = "https://codeberg.org/dnkl/fcft/commit/5cee776e1d7f1bdb0df383c3dd798831a6fe4fa0.patch";
-      excludes = [ "CHANGELOG.md" ];
-      hash = "sha256-yRBtKCKT/Oih66/OQqt4GPg3GfHmhiLM8mlLEWYYRC0=";
-    })
-  ];
-
   depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ pkg-config meson ninja scdoc ];
   buildInputs = [ freetype fontconfig nanosvg pixman tllist ]
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 0de95e8ef8f9..8a79a06560fc 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -50,11 +50,12 @@
 , cupsSupport ? stdenv.hostPlatform.isLinux
 , compileSchemas ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , cups
-, AppKit
-, Cocoa
 , libexecinfo
 , broadwaySupport ? true
 , testers
+, apple-sdk
+, apple-sdk_10_15
+, darwinMinVersionHook
 }:
 
 let
@@ -131,9 +132,7 @@ stdenv.mkDerivation (finalAttrs: {
     libXi
     libXrandr
     libXrender
-  ]) ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-  ] ++ lib.optionals trackerSupport [
+  ]) ++ lib.optionals trackerSupport [
     tinysparql
   ] ++ lib.optionals waylandSupport [
     libGL
@@ -143,8 +142,6 @@ stdenv.mkDerivation (finalAttrs: {
     xorg.libXinerama
   ] ++ lib.optionals cupsSupport [
     cups
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     libexecinfo
   ];
@@ -165,6 +162,11 @@ stdenv.mkDerivation (finalAttrs: {
     # Required for GSettings schemas at runtime.
     # Will be picked up by wrapGAppsHook4.
     gsettings-desktop-schemas
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (darwinMinVersionHook "10.15")
+  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin
+                   && lib.versionOlder apple-sdk.version "10.15") [
+      apple-sdk_10_15
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/libkrunfw/default.nix b/pkgs/development/libraries/libkrunfw/default.nix
index e56cf6707376..6369dd56f490 100644
--- a/pkgs/development/libraries/libkrunfw/default.nix
+++ b/pkgs/development/libraries/libkrunfw/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libkrunfw";
-  version = "4.4.1";
+  version = "4.4.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "libkrunfw";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-rxMklV/pu/muz/7m1clEs+BItXid/jMt6j/R/yHBKHI=";
+    hash = "sha256-o1bFz3INtJRm9gdm2b9+sHW6r+l/RNCZr62ucI73N9w=";
   };
 
   kernelSrc = fetchurl {
diff --git a/pkgs/development/python-modules/ihm/default.nix b/pkgs/development/python-modules/ihm/default.nix
index bf7b81b05dad..1d07533f536a 100644
--- a/pkgs/development/python-modules/ihm/default.nix
+++ b/pkgs/development/python-modules/ihm/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "ihm";
-  version = "1.6";
+  version = "1.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ihmwg";
     repo = "python-ihm";
     rev = "refs/tags/${version}";
-    hash = "sha256-G6u1z0bPC6EDVMLL9oCWi2B7AEj4UikGnSDQ8AOpuMA=";
+    hash = "sha256-jQm8Xl2yyR+y1Leyz8naT1rFJpgK5XdUd7YgnhDuBWo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 8beba0e4753f..552429e9edc5 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -114,8 +114,8 @@ rec {
       "sha256-JsQYZqlzCM64Uxk3btQZm8dX/oSHsy1l29dUG7n025s=";
 
   mypy-boto3-application-insights =
-    buildMypyBoto3Package "application-insights" "1.35.0"
-      "sha256-PQcqaUxzDx91mwL55prFG2EFdQQw278ugQUAVhgzLX8=";
+    buildMypyBoto3Package "application-insights" "1.35.45"
+      "sha256-rXdCTd/cv1F+VWlWnT0VBPdE0JZzXnI5QJu7Tk1rq4Y=";
 
   mypy-boto3-applicationcostprofiler =
     buildMypyBoto3Package "applicationcostprofiler" "1.35.0"
@@ -142,16 +142,16 @@ rec {
       "sha256-l5hKmbwel2Z5BvQbuKXRsfusKU28laF5mVDDPW+Ij0g=";
 
   mypy-boto3-athena =
-    buildMypyBoto3Package "athena" "1.35.25"
-      "sha256-XcD23pDz3oaNwME+iqmDQr9Lbz8z7NVduFEiTnxV55c=";
+    buildMypyBoto3Package "athena" "1.35.44"
+      "sha256-2eDPfyD3gm+kOyVUOn83aAAEPO+IzTahq3CPkaICqJI=";
 
   mypy-boto3-auditmanager =
     buildMypyBoto3Package "auditmanager" "1.35.0"
       "sha256-nr00I/1oqR16ZIw3+iA2BrS0C0Wr7UlJ48VnuOFIcb0=";
 
   mypy-boto3-autoscaling =
-    buildMypyBoto3Package "autoscaling" "1.35.4"
-      "sha256-XRAj8UYVmjQ0GjAevPGs1/g2XRsoCElCNaj1kPrWyCo=";
+    buildMypyBoto3Package "autoscaling" "1.35.45"
+      "sha256-HQLkmsxLESKVXzNW+60XFLhYTT6oDeNFsm6WGNP1cgk=";
 
   mypy-boto3-autoscaling-plans =
     buildMypyBoto3Package "autoscaling-plans" "1.35.0"
@@ -414,8 +414,8 @@ rec {
       "sha256-yJ3ApQy6xeEdxNcRQG5mekfK1aP7FPdR79TfbRZkESo=";
 
   mypy-boto3-dms =
-    buildMypyBoto3Package "dms" "1.35.38"
-      "sha256-b9AA9n1WWgk4HV1U/3L/eVl4eualNyhYCjbFw+QvHV4=";
+    buildMypyBoto3Package "dms" "1.35.45"
+      "sha256-+15k+ChWuPK+fBeSbYtraNugtJOI1mcjDU45ohDLauM=";
 
   mypy-boto3-docdb =
     buildMypyBoto3Package "docdb" "1.35.0"
@@ -446,8 +446,8 @@ rec {
       "sha256-wBJ7PnAlsi88AZIRPoNgbzOhPwUAJBegtwk+tw1lOwU=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.35.38"
-      "sha256-AwY1//39/3P8l+zEsunb7Mun//B1wiR8ae+ZxGulzRo=";
+    buildMypyBoto3Package "ec2" "1.35.45"
+      "sha256-j/hg6HA48HKlSdEExcvPsalA5p0ReOYstBDw1xEdyHM=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.35.0"
@@ -470,8 +470,8 @@ rec {
       "sha256-6o825Pz7Vbg/xuFXR7mTLv3zWcLoRIqbFqjRcQtZOJ8=";
 
   mypy-boto3-eks =
-    buildMypyBoto3Package "eks" "1.35.0"
-      "sha256-w+uJ5Jqfbnj3ykj59C8sbhitp5MyTIE+PnZXrlIkOag=";
+    buildMypyBoto3Package "eks" "1.35.45"
+      "sha256-Dl9pCZc5WX6HC0LbXznGrpSc32KtPvHNMFD9Ru8Ay6k=";
 
   mypy-boto3-elastic-inference =
     buildMypyBoto3Package "elastic-inference" "1.35.38"
@@ -542,8 +542,8 @@ rec {
       "sha256-rm0PB0oie7q+8pl+efohmHe8StLZVvSWYgLIajxd3Fo=";
 
   mypy-boto3-fms =
-    buildMypyBoto3Package "fms" "1.35.0"
-      "sha256-Y+FKtBDxQ2SyN8uHLkt7KKylo8uOa6mCHUwf98TsBRg=";
+    buildMypyBoto3Package "fms" "1.35.45"
+      "sha256-tcegJLaem1b74dGFSatTjmQzt59L8Nu0thNnqes1TC8=";
 
   mypy-boto3-forecast =
     buildMypyBoto3Package "forecast" "1.35.0"
@@ -1006,8 +1006,8 @@ rec {
       "sha256-b9gTTuQxsXE4CjZgRgbZn4xGSC7N/4v3eF4fF9fFSow=";
 
   mypy-boto3-payment-cryptography-data =
-    buildMypyBoto3Package "payment-cryptography-data" "1.35.0"
-      "sha256-tHHuRkz2nA550ldsMbiUS7XJGMHgx3rRt5scFV7tFNM=";
+    buildMypyBoto3Package "payment-cryptography-data" "1.35.45"
+      "sha256-9FxAmPtuL14Y18X05pMj3uPoJqAyHJAJLDmGgoU79uY=";
 
   mypy-boto3-pca-connector-ad =
     buildMypyBoto3Package "pca-connector-ad" "1.35.0"
@@ -1162,8 +1162,8 @@ rec {
       "sha256-RwPNNFntNChLqbr86wd1bwp6OqWvs3oj3V+4X71J3Hw=";
 
   mypy-boto3-s3 =
-    buildMypyBoto3Package "s3" "1.35.42"
-      "sha256-LQQMBdaKFh2RxLcpJhJwNNooremNSA3vapVpq3ZVzd0=";
+    buildMypyBoto3Package "s3" "1.35.45"
+      "sha256-IA0bZfS9q+F1vkIwucqQ6UiEGs4e75GSpzLaGmHyKII=";
 
   mypy-boto3-s3control =
     buildMypyBoto3Package "s3control" "1.35.12"
@@ -1398,8 +1398,8 @@ rec {
       "sha256-rqjBKxMMg/gkt9PJyFyE3g2msAiTtiMZWF4TY3/grcs=";
 
   mypy-boto3-wafv2 =
-    buildMypyBoto3Package "wafv2" "1.35.9"
-      "sha256-snz65w4vU7DMSVJmhWHvQay38q17RYkmbk3986HlXT8=";
+    buildMypyBoto3Package "wafv2" "1.35.45"
+      "sha256-Soz9RxhGf4ss41NLcVT0UUjRcPv0sKzjcx1bo5MLC44=";
 
   mypy-boto3-wellarchitected =
     buildMypyBoto3Package "wellarchitected" "1.35.0"
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index b2f284b4f2b8..136e9e800609 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "1.0.2.20241019";
+  version = "1.0.2.20241023";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OvnRc+PV0rJxTgN4nPf9znsJtMTVU16nKTwdDA140Wc=";
+    hash = "sha256-WQs4DJygcyOTzDZHlbjW+uZAna5oswDDk4NwgS/Vr1c=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index ddc5003106ae..c36540a96f25 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   isPyPy,
   fetchPypi,
+  fetchpatch,
   pythonOlder,
   curl,
   openssl,
@@ -25,6 +26,16 @@ buildPythonPackage rec {
     hash = "sha256-jCRxr5B5rXmOFkXsCw09QiPbaHN50X3TanBjdEn4HWs=";
   };
 
+  patches = [
+    # Don't use -flat_namespace on macOS
+    # https://github.com/pycurl/pycurl/pull/855 remove on next update
+    (fetchpatch {
+      name = "no_flat_namespace.patch";
+      url = "https://github.com/pycurl/pycurl/commit/7deb85e24981e23258ea411dcc79ca9b527a297d.patch";
+      hash = "sha256-tk0PQy3cHyXxFnoVYNQV+KD/07i7AUYHNJnrw6H8tHk=";
+    })
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/python-snap7/default.nix b/pkgs/development/python-modules/python-snap7/default.nix
index 515e4b9bec69..80422b7cf258 100644
--- a/pkgs/development/python-modules/python-snap7/default.nix
+++ b/pkgs/development/python-modules/python-snap7/default.nix
@@ -10,7 +10,7 @@
 buildPythonPackage rec {
   pname = "python-snap7";
   version = "1.4.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -21,14 +21,14 @@ buildPythonPackage rec {
     hash = "sha256-CqLG5/U2k7WdZL5LfcFAnV1Q8HcIU7l36gi51lgB39s=";
   };
 
-  propagatedBuildInputs = [ setuptools ];
-
   prePatch = ''
     substituteInPlace snap7/common.py \
       --replace "lib_location = None" "lib_location = '${snap7}/lib/libsnap7.so'"
   '';
 
-  # Tests require root privileges to open privilaged ports
+  build-system = [ setuptools ];
+
+  # Tests require root privileges to open privileged ports
   doCheck = false;
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 684c06255dfc..9373a7d4acdc 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.8.4";
+  version = "0.8.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "Reticulum";
     rev = "refs/tags/${version}";
-    hash = "sha256-uonOifCGvSKJhxTAqD49BOHDdN69pRexcb2ny1GwqjA=";
+    hash = "sha256-3Eif3AVpjNH803XXkPGQ5ZgSpVwV1W4DDm9rYBj6AEo=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 2c242bbc7074..a168fba1abdb 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1256";
+  version = "3.0.1257";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-V6ov3ukP0o5lCDPtGgWk07E/bCv1w9f3bkLHuEX9/iI=";
+    hash = "sha256-HjOU8gn1T6TXnAd0fM8dgc3tz8hUgyHzsQjgISYD1qE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/wagtail-modeladmin/default.nix b/pkgs/development/python-modules/wagtail-modeladmin/default.nix
index 6b4664398505..2f3988e0af41 100644
--- a/pkgs/development/python-modules/wagtail-modeladmin/default.nix
+++ b/pkgs/development/python-modules/wagtail-modeladmin/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "wagtail-modeladmin";
-  version = "2.0.0";
+  version = "2.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     repo = pname;
     owner = "wagtail-nest";
     rev = "refs/tags/v${version}";
-    hash = "sha256-J6ViGf7lqUvl5EV4/LbADVDp15foY9bUZygs1dSDlKw=";
+    hash = "sha256-IG7e7YomMM7K2IlJ1Dr1zo+blDPHnu/JeS5csos8ncc=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/weasel/default.nix b/pkgs/development/python-modules/weasel/default.nix
index 412620646a3e..16987cee2cd1 100644
--- a/pkgs/development/python-modules/weasel/default.nix
+++ b/pkgs/development/python-modules/weasel/default.nix
@@ -1,19 +1,24 @@
 {
   lib,
   buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   cloudpathlib,
   confection,
-  fetchFromGitHub,
   packaging,
   pydantic,
-  pytestCheckHook,
-  pythonOlder,
   requests,
-  setuptools,
   smart-open,
   srsly,
   typer,
   wasabi,
+
+  # tests
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -21,8 +26,6 @@ buildPythonPackage rec {
   version = "0.4.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
-
   src = fetchFromGitHub {
     owner = "explosion";
     repo = "weasel";
@@ -52,7 +55,9 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "weasel" ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   disabledTests = [
     # This test requires internet access
@@ -61,12 +66,12 @@ buildPythonPackage rec {
     "test_project_git_file_asset"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Small and easy workflow system";
     homepage = "https://github.com/explosion/weasel/";
     changelog = "https://github.com/explosion/weasel/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ GaetanLepage ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
     mainProgram = "weasel";
   };
 }
diff --git a/pkgs/development/tools/doctl/default.nix b/pkgs/development/tools/doctl/default.nix
index 8e274ee1b564..2397da1f2625 100644
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.115.0";
+  version = "1.116.0";
 
   vendorHash = null;
 
@@ -31,7 +31,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "sha256-Q/1AkP+KWomloe/kVtR0TUDfOf9CVldDqeLFYsBisc4=";
+    sha256 = "sha256-yUgOHkQfsl1FgkOQirbEKzyrPcjs/k2H0P3jx3LHaiU=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/language-servers/neocmakelsp/default.nix b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
index dc841414cf4d..bdc780817da3 100644
--- a/pkgs/development/tools/language-servers/neocmakelsp/default.nix
+++ b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "neocmakelsp";
-  version = "0.8.4";
+  version = "0.8.12";
 
   src = fetchFromGitHub {
     owner = "Decodetalkers";
     repo = "neocmakelsp";
     rev = "v${version}";
-    hash = "sha256-DPKCAWIDw3ykYp2Cuwt9CcWHgdL7aoW5z2CjVFxizhg=";
+    hash = "sha256-5j1nNPdTZFPmda+2ZNYh9uM1qNCsK6gqUOXZwKJ6ckU=";
   };
 
-  cargoHash = "sha256-wYh5JNT7HJnY6PLFCPm21LNFHsffFq53FTCRkUuHxWY=";
+  cargoHash = "sha256-5ZI4heLlhPaNsNJlD9dYlvzTjoWNdHJGGmU6ugUZqds=";
 
   meta = with lib; {
     description = "CMake lsp based on tower-lsp and treesitter";
diff --git a/pkgs/development/tools/misc/lsof/default.nix b/pkgs/development/tools/misc/lsof/default.nix
index 9355144733ec..a878b5ff8ab5 100644
--- a/pkgs/development/tools/misc/lsof/default.nix
+++ b/pkgs/development/tools/misc/lsof/default.nix
@@ -21,8 +21,11 @@ stdenv.mkDerivation rec {
     # We remove phony 'FRC' target that forces rebuilds:
     #   'version.h: FRC ...' is translated to 'version.h: ...'.
     sed -i lib/dialects/*/Makefile -e 's/version.h:\s*FRC/version.h:/'
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    sed -i 's|lcurses|lncurses|g' Configure
+  ''
+    # help Configure find libproc.h in $SDKROOT
+   + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    sed -i -e 's|lcurses|lncurses|g' \
+           -e "s|/Library.*/MacOSX.sdk/|\"$SDKROOT\"/|" Configure
   '';
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index d89160064406..ae2c1e1193cb 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -15,8 +15,9 @@
     {
       hash ? "",
       pname,
-      pnpmWorkspace ? "",
+      pnpmWorkspaces ? [ ],
       prePnpmInstall ? "",
+      pnpmInstallFlags ? [ ],
       ...
     }@args:
     let
@@ -32,8 +33,14 @@
             outputHash = "";
             outputHashAlgo = "sha256";
           };
-      installFlags = lib.optionalString (pnpmWorkspace != "") "--filter=${pnpmWorkspace}";
+
+      filterFlags = lib.map (package: "--filter=${package}") pnpmWorkspaces;
     in
+    # pnpmWorkspace was deprecated, so throw if it's used.
+    assert (lib.throwIf (args ? pnpmWorkspace)
+      "pnpm.fetchDeps: `pnpmWorkspace` is no longer supported, please migrate to `pnpmWorkspaces`."
+    ) true;
+
     stdenvNoCC.mkDerivation (
       finalAttrs:
       (
@@ -73,7 +80,8 @@
             pnpm install \
                 --force \
                 --ignore-scripts \
-                ${installFlags} \
+                ${lib.escapeShellArgs filterFlags} \
+                ${lib.escapeShellArgs pnpmInstallFlags} \
                 --frozen-lockfile
 
             runHook postInstall
diff --git a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
index e82a62f9101c..a47e3184e9cb 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
+++ b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
@@ -22,11 +22,19 @@ pnpmConfigHook() {
 
     pnpm config set store-dir "$STORE_PATH"
 
-    echo "Installing dependencies"
-
     if [[ -n "$pnpmWorkspace" ]]; then
-        pnpmInstallFlags+=("--filter=$pnpmWorkspace")
+        echo "'pnpmWorkspace' is deprecated, please migrate to 'pnpmWorkspaces'."
+        exit 2
     fi
+
+    echo "Installing dependencies"
+    if [[ -n "$pnpmWorkspaces" ]]; then
+        local IFS=" "
+        for ws in $pnpmWorkspaces; do
+            pnpmInstallFlags+=("--filter=$ws")
+        done
+    fi
+
     runHook prePnpmInstall
 
     pnpm install \
diff --git a/pkgs/development/tools/rust/cargo-crev/default.nix b/pkgs/development/tools/rust/cargo-crev/default.nix
index 67c5ca0bc0a3..ab41565e01d9 100644
--- a/pkgs/development/tools/rust/cargo-crev/default.nix
+++ b/pkgs/development/tools/rust/cargo-crev/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-crev";
-  version = "0.25.9";
+  version = "0.25.11";
 
   src = fetchFromGitHub {
     owner = "crev-dev";
     repo = "cargo-crev";
     rev = "v${version}";
-    sha256 = "sha256-ZevtYJ1ibSs3an3m1KJNTTquz1w6UfTiFgd1mNHFHWE=";
+    sha256 = "sha256-suKnbCCJWKCDVGEmpddTphUfvuebBeiV+N/B6BIid88=";
   };
 
-  cargoHash = "sha256-QHhfHm2fDFR5BpSnw1wzr3dfCWDTzWNDDdRtj2qOoKE=";
+  cargoHash = "sha256-U6pznzHE9yURptV+7rC63vIdD1HxRD+Vg9vemHk7G+Q=";
 
   preCheck = ''
     export HOME=$(mktemp -d)
diff --git a/pkgs/development/tools/rust/cargo-show-asm/default.nix b/pkgs/development/tools/rust/cargo-show-asm/default.nix
index 80af89869c14..049ef9faf03a 100644
--- a/pkgs/development/tools/rust/cargo-show-asm/default.nix
+++ b/pkgs/development/tools/rust/cargo-show-asm/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-show-asm";
-  version = "0.2.39";
+  version = "0.2.41";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-fGUx2SOgs5IF7KTr36fHktykrFkxqLWp4CWVGOZ+MeM=";
+    hash = "sha256-U9i/xp9WxMYf4GMsZB7qYOpuuuEw4mWZp+ZEyguGtQQ=";
   };
 
-  cargoHash = "sha256-iCHf4/bqICZ0bTeFFeVopU0Yl8VbxRd+Cr4WucuptVk=";
+  cargoHash = "sha256-eUaEpex9x9bdqPJ4p5QvkWKaxs3ih4Gb9+4deGBZgXU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/rust/cargo-watch/default.nix b/pkgs/development/tools/rust/cargo-watch/default.nix
index 1033476eb976..91e7fea0fa10 100644
--- a/pkgs/development/tools/rust/cargo-watch/default.nix
+++ b/pkgs/development/tools/rust/cargo-watch/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-watch";
-  version = "8.5.2";
+  version = "8.5.3";
 
   src = fetchFromGitHub {
     owner = "watchexec";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Vf6BFr8MphaUJoHMtksbbVQb+jha7jowhktQCVFxlxQ=";
+    hash = "sha256-agwK20MkvnhqSVAWMy3HLkUJbraINn12i6VAg8mTzBk=";
   };
 
-  cargoHash = "sha256-skUG1B6TCFEXeQSRwA6vWjXmNifk5bTR4+JESw7CZMo=";
+  cargoHash = "sha256-oqGc5haN8Jyi0eQf8egrRXWxi0RGVdIFhpGKgmFB8DI=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Foundation Cocoa ];
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 52925f1ace94..a3144cf6bc39 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -58,12 +58,12 @@ rec {
   });
 
   beta = selectHighestVersion latest (generic {
-    version = "560.31.02";
-    sha256_64bit = "sha256-0cwgejoFsefl2M6jdWZC+CKc58CqOXDjSi4saVPNKY0=";
-    sha256_aarch64 = "sha256-m7da+/Uc2+BOYj6mGON75h03hKlIWItHORc5+UvXBQc=";
-    openSha256 = "sha256-X5UzbIkILvo0QZlsTl9PisosgPj/XRmuuMH+cDohdZQ=";
-    settingsSha256 = "sha256-A3SzGAW4vR2uxT1Cv+Pn+Sbm9lLF5a/DGzlnPhxVvmE=";
-    persistencedSha256 = "sha256-BDtdpH5f9/PutG3Pv9G4ekqHafPm3xgDYdTcQumyMtg=";
+    version = "565.57.01";
+    sha256_64bit = "sha256-buvpTlheOF6IBPWnQVLfQUiHv4GcwhvZW3Ks0PsYLHo=";
+    sha256_aarch64 = "sha256-aDVc3sNTG4O3y+vKW87mw+i9AqXCY29GVqEIUlsvYfE=";
+    openSha256 = "sha256-/tM3n9huz1MTE6KKtTCBglBMBGGL/GOHi5ZSUag4zXA=";
+    settingsSha256 = "sha256-H7uEe34LdmUFcMcS6bz7sbpYhg9zPCb/5AmZZFTx1QA=";
+    persistencedSha256 = "sha256-hdszsACWNqkCh8G4VBNitDT85gk9gJe1BlQ8LdrYIkg=";
   });
 
   # Vulkan developer beta driver
diff --git a/pkgs/os-specific/linux/zenergy/default.nix b/pkgs/os-specific/linux/zenergy/default.nix
new file mode 100644
index 000000000000..cfdb63d2a135
--- /dev/null
+++ b/pkgs/os-specific/linux/zenergy/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kmod,
+}:
+
+let
+  kernelDirectory = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+in
+stdenv.mkDerivation {
+  pname = "zenergy";
+  version = "0-unstable-2024-10-10";
+
+  src = fetchFromGitHub {
+    owner = "BoukeHaarsma23";
+    repo = "zenergy";
+    rev = "7c4e83d5e2f887f4c31edaf92e5f94e9448e9764";
+    hash = "sha256-5fYelEr4IYnuXrly15IcyicFrF0tYjs7OBqIhUYQXZ0=";
+  };
+
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  hardeningDisable = [
+    "format"
+    "pic"
+  ];
+
+  makeFlags = kernel.makeFlags ++ [ "KDIR=${kernelDirectory}" ];
+
+  installTargets = [ "modules_install" ];
+
+  preBuild = ''
+    substituteInPlace Makefile --replace-fail "PWD modules_install" "PWD INSTALL_MOD_PATH=$out modules_install"
+  '';
+
+  meta = with lib; {
+    description = "Based on AMD_ENERGY driver, but with some jiffies added so non-root users can read it safely.";
+    homepage = "https://github.com/BoukeHaarsma23/zenergy";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ wizardlink ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/home-automation/evcc/default.nix b/pkgs/servers/home-automation/evcc/default.nix
index fe8942c12bdc..ebce97dcc464 100644
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@@ -16,13 +16,13 @@
 
 buildGoModule rec {
   pname = "evcc";
-  version = "0.131.0";
+  version = "0.131.1";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     rev = version;
-    hash = "sha256-iR+qBRaDmk39wGigz734kS5hn/grX+ulZvytNYQW4bo=";
+    hash = "sha256-GEIiAjurbLLY+HMOxP40E3plZe2EsS82mxKSj9wheQI=";
   };
 
   vendorHash = "sha256-T3SmFnGOw6AJaji4tR1uK+lQj8JNcUMJErUuhwdg3gA=";
diff --git a/pkgs/servers/monitoring/plugins/default.nix b/pkgs/servers/monitoring/plugins/default.nix
index ae0db59d0b32..0993dceb9352 100644
--- a/pkgs/servers/monitoring/plugins/default.nix
+++ b/pkgs/servers/monitoring/plugins/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , pkg-config
 , runCommand
@@ -43,30 +42,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "monitoring-plugins";
-  version = "2.3.5";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "monitoring-plugins";
     repo = "monitoring-plugins";
     rev = "v${version}";
-    sha256 = "sha256-J9fzlxIpujoG7diSRscFhmEV9HpBOxFTJSmGGFjAzcM=";
+    hash = "sha256-T37t0shhC+8k7CN/hIOxsskuuCi0LwQui8xyRTC+pjQ=";
   };
 
-  patches = [
-    # fix build (makefile cannot produce -lcrypto)
-    # remove on next release
-    (fetchpatch {
-      url = "https://github.com/monitoring-plugins/monitoring-plugins/commit/bad156676894a2755c8b76519a11cdd2037e5cd6.patch";
-      hash = "sha256-aI/sX04KXe968SwdS8ZamNtgdNbHtho5cDsDaA+cjZY=";
-    })
-    # fix check_smtp with --starttls https://github.com/monitoring-plugins/monitoring-plugins/pull/1952
-    # remove on next release
-    (fetchpatch {
-      url = "https://github.com/monitoring-plugins/monitoring-plugins/commit/2eea6bb2a04bbfb169bac5f0f7c319f998e8ab87.patch";
-      hash = "sha256-CyVD340+zOxuxRRPmtowD3DFFRB1Q7+AANzul9HqwBI=";
-    })
-  ];
-
   # TODO: Awful hack. Grrr...
   # Anyway the check that configure performs to figure out the ping
   # syntax is totally impure, because it runs an actual ping to
@@ -76,9 +60,6 @@ stdenv.mkDerivation rec {
   # --with-ping-command needs to be done here instead of in
   # configureFlags due to the spaces in the argument
   postPatch = ''
-    substituteInPlace po/Makefile.in.in \
-      --replace /bin/sh ${runtimeShell}
-
     sed -i configure.ac \
       -e 's|^DEFAULT_PATH=.*|DEFAULT_PATH=\"${binPath}\"|'
 
@@ -116,7 +97,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Official monitoring plugins for Nagios/Icinga/Sensu and others";
     homepage = "https://www.monitoring-plugins.org";
-    license = licenses.gpl3Only;
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ thoughtpolice relrod ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/tools/misc/cyberchef/default.nix b/pkgs/tools/misc/cyberchef/default.nix
index 11fc25bd9d17..2d29f582ff2c 100644
--- a/pkgs/tools/misc/cyberchef/default.nix
+++ b/pkgs/tools/misc/cyberchef/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cyberchef";
-  version = "10.19.2";
+  version = "10.19.4";
 
   src = fetchzip {
     url = "https://github.com/gchq/CyberChef/releases/download/v${version}/CyberChef_v${version}.zip";
-    sha256 = "sha256-+ICoJnW92IOi/QDwJXRNxP9tN99hNfH6BwLKJvzZFF4=";
+    sha256 = "sha256-eOMo7kdxC5HfmMrKUhGZU3vnBXibO2Fz1ftIS9RAbjY=";
     stripRoot = false;
   };
 
diff --git a/pkgs/tools/misc/jfrog-cli/default.nix b/pkgs/tools/misc/jfrog-cli/default.nix
index e3b06b2f76e4..77cb107fa0c2 100644
--- a/pkgs/tools/misc/jfrog-cli/default.nix
+++ b/pkgs/tools/misc/jfrog-cli/default.nix
@@ -7,17 +7,17 @@
 
 buildGo123Module rec {
   pname = "jfrog-cli";
-  version = "2.70.0";
+  version = "2.71.0";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ddwGmXb616kDNNNTNUykiEWX/2ihUpgetZ/va943RiQ=";
+    hash = "sha256-hblOe6YMlfWBVvWD5MKEKvAB55jUx98OMeqFDdgVrmM=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-1xUCQF2UDHAmzibixv9pR6G2gvXxIStCyBuz608UpIQ=";
+  vendorHash = "sha256-px+eXSIOe3v4iNBibXAtcFMROrHq6YYJIHbCC7nhNS4=";
 
   postPatch = ''
     # Patch out broken test cleanup.
diff --git a/pkgs/tools/networking/ockam/default.nix b/pkgs/tools/networking/ockam/default.nix
index 30b774b8f72f..2eaf4dafd2d8 100644
--- a/pkgs/tools/networking/ockam/default.nix
+++ b/pkgs/tools/networking/ockam/default.nix
@@ -13,7 +13,7 @@
 
 let
   pname = "ockam";
-  version = "0.134.0";
+  version = "0.138.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -22,10 +22,10 @@ rustPlatform.buildRustPackage {
     owner = "build-trust";
     repo = pname;
     rev = "ockam_v${version}";
-    hash = "sha256-6HZI0Gsxn3GmklHl9zJ6yY73FlqcLiyMAqJg8BBmzqg=";
+    hash = "sha256-AY0i7qXA7JXfIEY0htmL+/yn71xAuh7WowXOs2fD6n8=";
   };
 
-  cargoHash = "sha256-VZt7tDewvz7eGpAKzD8pYOnH/3BtH6cULp6uX7CPxX8=";
+  cargoHash = "sha256-gAl2es8UFVFv40sMY++SiDGjCMdL0XDN4PeSV7VlGmQ=";
   nativeBuildInputs = [ git pkg-config ];
   buildInputs = [ openssl dbus ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit Security ];
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index b6be05ef21b7..d1f7465c02f3 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.82.11";
+  version = "3.82.12";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hi7uGVPA9QW22DdfTCui7AMORGgoWH1ogevJqRYM6LQ=";
+    hash = "sha256-eTZ+Bee9t0cf9uaG+Cwvq+sWalQt2IhrM6eGhs90GIk=";
   };
 
-  vendorHash = "sha256-Ld+TYH2iCreDhueNmu8S5mcyDyWDXMVEwfW9TdVQ9aY=";
+  vendorHash = "sha256-MexqvYRGBHEVED3y0hWGGTwxRFI/LfyYE2IFLqChgWE=";
 
   proxyVendor = true;
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index b72d62ebd30c..2ba5f90a18c9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1273,6 +1273,7 @@ mapAliases {
   yacc = throw "'yacc' has been renamed to/replaced by 'bison'"; # Converted to throw 2024-10-17
   yafaray-core = libyafaray; # Added 2022-09-23
   yi = throw "'yi' has been removed, as it was broken and unmaintained"; # added 2024-05-09
+  youtrack_2022_3 = throw "'youtrack_2022_3' has been removed as it was deprecated. Please update to the 'youtrack' package."; # Added 2024-10-17
   yrd = throw "'yrd' has been removed, as it was broken and unmaintained"; # added 2024-05-27
 
   ### Z ###
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6ee07ea01ad6..7c373720abd0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4166,8 +4166,6 @@ with pkgs;
 
   btrbk = callPackage ../tools/backup/btrbk { };
 
-  buildpack = callPackage ../development/tools/buildpack { };
-
   bonk = callPackage ../tools/misc/bonk { };
 
   bottom-rs = callPackage ../tools/misc/bottom-rs { };
@@ -4806,7 +4804,7 @@ with pkgs;
 
   element-desktop = callPackage ../applications/networking/instant-messengers/element/element-desktop.nix {
     inherit (darwin.apple_sdk.frameworks) Security AppKit CoreServices;
-    electron = electron_31;
+    electron = electron_32;
   };
   element-desktop-wayland = writeScriptBin "element-desktop" ''
     #!/bin/sh
@@ -11864,8 +11862,6 @@ with pkgs;
 
   rpPPPoE = callPackage ../tools/networking/rp-pppoe { };
 
-  rpiboot = callPackage ../development/misc/rpiboot { };
-
   rpm = callPackage ../tools/package-management/rpm {
     python = python3;
     lua = lua5_4;
@@ -18565,8 +18561,6 @@ with pkgs;
 
   time-ghc-modules = callPackage ../development/tools/time-ghc-modules { };
 
-  tflint = callPackage ../development/tools/analysis/tflint { };
-
   tflint-plugins = recurseIntoAttrs (
     callPackage ../development/tools/analysis/tflint-plugins { }
   );
@@ -20063,9 +20057,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa QuartzCore;
   };
 
-  gtk4 = callPackage ../development/libraries/gtk/4.x.nix {
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
-  };
+  gtk4 = callPackage ../development/libraries/gtk/4.x.nix { };
 
 
   # On darwin gtk uses cocoa by default instead of x11.
@@ -37160,8 +37152,6 @@ with pkgs;
 
   hplipWithPlugin = hplip.override { withPlugin = true; };
 
-  hyfetch = callPackage ../tools/misc/hyfetch { };
-
   hyperfine = callPackage ../tools/misc/hyperfine {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index b9225acdb2b7..f83e88993450 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -407,6 +407,8 @@ in {
 
     new-lg4ff = callPackage ../os-specific/linux/new-lg4ff { };
 
+    zenergy = callPackage ../os-specific/linux/zenergy { };
+
     nvidiabl = callPackage ../os-specific/linux/nvidiabl { };
 
     nvidiaPackages = dontRecurseIntoAttrs (lib.makeExtensible (_: callPackage ../os-specific/linux/nvidia-x11 { }));