diff --git a/nixos/maintainers/scripts/incus/incus-container-image.nix b/nixos/maintainers/scripts/incus/incus-container-image.nix
index 63b9353f7ee3..9faf6a5d87ad 100644
--- a/nixos/maintainers/scripts/incus/incus-container-image.nix
+++ b/nixos/maintainers/scripts/incus/incus-container-image.nix
@@ -16,8 +16,7 @@
   # copy the config for nixos-rebuild
   system.activationScripts.config =
     let
-      config = pkgs.substituteAll {
-        src = ./incus-container-image-inner.nix;
+      config = pkgs.replaceVars ./incus-container-image-inner.nix {
         stateVersion = lib.trivial.release;
       };
     in
diff --git a/nixos/maintainers/scripts/incus/incus-virtual-machine-image.nix b/nixos/maintainers/scripts/incus/incus-virtual-machine-image.nix
index 0742e7d75ac9..db60160c9c77 100644
--- a/nixos/maintainers/scripts/incus/incus-virtual-machine-image.nix
+++ b/nixos/maintainers/scripts/incus/incus-virtual-machine-image.nix
@@ -16,8 +16,7 @@
   # copy the config for nixos-rebuild
   system.activationScripts.config =
     let
-      config = pkgs.substituteAll {
-        src = ./incus-virtual-machine-image-inner.nix;
+      config = pkgs.replaceVars ./incus-virtual-machine-image-inner.nix {
         stateVersion = lib.trivial.release;
       };
     in
diff --git a/nixos/maintainers/scripts/lxd/lxd-container-image.nix b/nixos/maintainers/scripts/lxd/lxd-container-image.nix
index 5913ed69a6db..0ccc6308b96b 100644
--- a/nixos/maintainers/scripts/lxd/lxd-container-image.nix
+++ b/nixos/maintainers/scripts/lxd/lxd-container-image.nix
@@ -18,8 +18,7 @@
   # copy the config for nixos-rebuild
   system.activationScripts.config =
     let
-      config = pkgs.substituteAll {
-        src = ./lxd-container-image-inner.nix;
+      config = pkgs.replaceVars ./lxd-container-image-inner.nix {
         stateVersion = lib.trivial.release;
       };
     in
diff --git a/nixos/maintainers/scripts/lxd/lxd-virtual-machine-image.nix b/nixos/maintainers/scripts/lxd/lxd-virtual-machine-image.nix
index 1ccecc4c351d..19582e2c0d5d 100644
--- a/nixos/maintainers/scripts/lxd/lxd-virtual-machine-image.nix
+++ b/nixos/maintainers/scripts/lxd/lxd-virtual-machine-image.nix
@@ -18,8 +18,7 @@
   # copy the config for nixos-rebuild
   system.activationScripts.config =
     let
-      config = pkgs.substituteAll {
-        src = ./lxd-virtual-machine-image-inner.nix;
+      config = pkgs.replaceVars ./lxd-virtual-machine-image-inner.nix {
         stateVersion = lib.trivial.release;
       };
     in
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 5a700f070b62..665b968c9d1d 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -832,11 +832,7 @@ in
         { source = config.isoImage.splashImage;
           target = "/isolinux/background.png";
         }
-        { source = pkgs.substituteAll  {
-            name = "isolinux.cfg";
-            src = pkgs.writeText "isolinux.cfg-in" isolinuxCfg;
-            bootRoot = "/boot";
-          };
+        { source = isolinuxCfg;
           target = "/isolinux/isolinux.cfg";
         }
         { source = "${pkgs.syslinux}/share/syslinux";
diff --git a/nixos/modules/services/misc/taskserver/default.nix b/nixos/modules/services/misc/taskserver/default.nix
index 592514718940..dc9033b5a23b 100644
--- a/nixos/modules/services/misc/taskserver/default.nix
+++ b/nixos/modules/services/misc/taskserver/default.nix
@@ -142,8 +142,7 @@ let
       src = pkgs.runCommand "nixos-taskserver-src" { preferLocalBuild = true; } ''
         mkdir -p "$out"
         cat "${
-          pkgs.substituteAll {
-            src = ./helper-tool.py;
+          pkgs.replaceVars ./helper-tool.py {
             inherit taskd certtool;
             inherit (cfg)
               dataDir
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index 81f94e8639d9..72e8e4c0d081 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -727,11 +727,13 @@ in
 
       system.build.installBootLoader =
         let
-          install-grub-pl = pkgs.substituteAll {
-            src = ./install-grub.pl;
+          install-grub-pl = pkgs.replaceVars ./install-grub.pl {
             utillinux = pkgs.util-linux;
             btrfsprogs = pkgs.btrfs-progs;
             inherit (config.system.nixos) distroName;
+            # targets of a replacement in code
+            bootPath = null;
+            bootRoot = null;
           };
           perl = pkgs.perl.withPackages (p: with p; [
             FileSlurp FileCopyRecursive
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index 6a7dbf488591..c50c3a66bd60 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -185,7 +185,6 @@ mkDerivation (finalAttrs: {
             ./native-comp-driver-options-30.patch
         )
         {
-
           backendPath = (
             lib.concatStringsSep " " (
               builtins.map (x: ''"-B${x}"'') (
diff --git a/pkgs/applications/networking/dropbox/cli.nix b/pkgs/applications/networking/dropbox/cli.nix
index 31eda100eb97..aeb89f52a6da 100644
--- a/pkgs/applications/networking/dropbox/cli.nix
+++ b/pkgs/applications/networking/dropbox/cli.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  substituteAll,
+  replaceVars,
   autoreconfHook,
   pkg-config,
   fetchurl,
@@ -34,9 +34,10 @@ stdenv.mkDerivation {
   strictDeps = true;
 
   patches = [
-    (substituteAll {
-      src = ./fix-cli-paths.patch;
+    (replaceVars ./fix-cli-paths.patch {
       inherit dropboxd;
+      # patch context
+      DESKTOP_FILE_DIR = null;
     })
   ];
 
diff --git a/pkgs/applications/science/logic/z3/default.nix b/pkgs/applications/science/logic/z3/default.nix
index 1c874934adbd..20be36ebda6c 100644
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@@ -150,7 +150,7 @@ let
   };
 
   # replace @dir@ in the path of the given list of patches
-  fixupPatches = dir: map (patch: replaceVars patch { dir = dir; });
+  fixupPatches = dir: map (patch: replaceVars patch { inherit dir; });
 in
 {
   z3_4_13 = common {
diff --git a/pkgs/build-support/replace-vars/replace-vars-with.nix b/pkgs/build-support/replace-vars/replace-vars-with.nix
index 14a1e6a8e1e3..42be45b6dcf1 100644
--- a/pkgs/build-support/replace-vars/replace-vars-with.nix
+++ b/pkgs/build-support/replace-vars/replace-vars-with.nix
@@ -58,13 +58,11 @@
 
 let
   # We use `--replace-fail` instead of `--subst-var-by` so that if the thing isn't there, we fail.
-  subst-var-by =
-    name: value:
-    lib.optionals (value != null) [
-      "--replace-fail"
-      (lib.escapeShellArg "@${name}@")
-      (lib.escapeShellArg value)
-    ];
+  subst-var-by = name: value: [
+    "--replace-fail"
+    (lib.escapeShellArg "@${name}@")
+    (lib.escapeShellArg (lib.defaultTo "@${name}@" value))
+  ];
 
   substitutions = lib.concatLists (lib.mapAttrsToList subst-var-by replacements);
 
diff --git a/pkgs/build-support/setup-hooks/multiple-outputs.sh b/pkgs/build-support/setup-hooks/multiple-outputs.sh
index 45096d833b42..cc3ab4816fa2 100644
--- a/pkgs/build-support/setup-hooks/multiple-outputs.sh
+++ b/pkgs/build-support/setup-hooks/multiple-outputs.sh
@@ -85,7 +85,7 @@ _multioutConfig() {
 
     prependToVar configureFlags \
         --bindir="${!outputBin}"/bin --sbindir="${!outputBin}"/sbin \
-        --includedir="${!outputInclude}"/include --oldincludedir="${!outputInclude}"/include \
+        --includedir="${!outputInclude}"/include \
         --mandir="${!outputMan}"/share/man --infodir="${!outputInfo}"/share/info \
         --docdir="${!outputDoc}"/share/doc/"${shareDocName}" \
         --libdir="${!outputLib}"/lib --libexecdir="${!outputLib}"/libexec \
diff --git a/pkgs/by-name/ar/arma3-unix-launcher/package.nix b/pkgs/by-name/ar/arma3-unix-launcher/package.nix
index 6c15df4cd33a..44c3fa908eab 100644
--- a/pkgs/by-name/ar/arma3-unix-launcher/package.nix
+++ b/pkgs/by-name/ar/arma3-unix-launcher/package.nix
@@ -11,7 +11,7 @@
   nlohmann_json,
   qt5,
   spdlog,
-  substituteAll,
+  replaceVars,
   buildDayZLauncher ? false,
 }:
 stdenv.mkDerivation (finalAttrs: {
@@ -27,8 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     # prevent CMake from trying to get libraries on the internet
-    (substituteAll {
-      src = ./dont_fetch_dependencies.patch;
+    (replaceVars ./dont_fetch_dependencies.patch {
       argparse_src = fetchFromGitHub {
         owner = "p-ranav";
         repo = "argparse";
diff --git a/pkgs/by-name/br/brillo/package.nix b/pkgs/by-name/br/brillo/package.nix
index fb4358628cdb..3d642154c028 100644
--- a/pkgs/by-name/br/brillo/package.nix
+++ b/pkgs/by-name/br/brillo/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitLab,
   go-md2man,
   coreutils,
-  substituteAll,
+  replaceVars,
 }:
 
 stdenv.mkDerivation rec {
@@ -19,9 +19,10 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./udev-rule.patch;
+    (replaceVars ./udev-rule.patch {
       inherit coreutils;
+      # patch context
+      group = null;
     })
   ];
 
diff --git a/pkgs/by-name/bu/budgie-control-center/package.nix b/pkgs/by-name/bu/budgie-control-center/package.nix
index 622d46eafa83..1e97c87364d8 100644
--- a/pkgs/by-name/bu/budgie-control-center/package.nix
+++ b/pkgs/by-name/bu/budgie-control-center/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   accountsservice,
   adwaita-icon-theme,
   budgie-desktop,
@@ -81,13 +81,11 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
-    (substituteAll {
-      src = ./paths.patch;
+    (replaceVars ./paths.patch {
       budgie_desktop = budgie-desktop;
       gcm = gnome-color-manager;
       inherit
         cups
-        glibc
         libgnomekbd
         shadow
         ;
diff --git a/pkgs/by-name/cb/cbmc/0001-Do-not-download-sources-in-cmake.patch b/pkgs/by-name/cb/cbmc/0001-Do-not-download-sources-in-cmake.patch
index 324fd2adc04a..18a22340b11a 100644
--- a/pkgs/by-name/cb/cbmc/0001-Do-not-download-sources-in-cmake.patch
+++ b/pkgs/by-name/cb/cbmc/0001-Do-not-download-sources-in-cmake.patch
@@ -17,7 +17,7 @@ index 2c1289a..8128362 100644
      download_project(PROJ cudd
 -            URL https://sourceforge.net/projects/cudd-mirror/files/cudd-3.0.0.tar.gz/download
 -            URL_MD5 4fdafe4924b81648b908881c81fe6c30
-+            SOURCE_DIR @cudd.src@
++            SOURCE_DIR @cudd@
              )
  
      if(NOT EXISTS ${cudd_SOURCE_DIR}/Makefile)
diff --git a/pkgs/by-name/cb/cbmc/package.nix b/pkgs/by-name/cb/cbmc/package.nix
index fe86380d9b6f..9f43b14131de 100644
--- a/pkgs/by-name/cb/cbmc/package.nix
+++ b/pkgs/by-name/cb/cbmc/package.nix
@@ -8,7 +8,7 @@
   flex,
   makeWrapper,
   perl,
-  substituteAll,
+  replaceVars,
   cudd,
   nix-update-script,
   fetchpatch,
@@ -47,9 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./0001-Do-not-download-sources-in-cmake.patch;
-      inherit cudd;
+    (replaceVars ./0001-Do-not-download-sources-in-cmake.patch {
+      cudd = cudd.src;
     })
     ./0002-Do-not-download-sources-in-cmake.patch
     # Fixes build with libc++ >= 19 due to the removal of std::char_traits<unsigned>.
diff --git a/pkgs/by-name/cm/cmake/setup-hook.sh b/pkgs/by-name/cm/cmake/setup-hook.sh
index a6f5a4f57a5b..ea2d3d2a45bb 100755
--- a/pkgs/by-name/cm/cmake/setup-hook.sh
+++ b/pkgs/by-name/cm/cmake/setup-hook.sh
@@ -93,7 +93,6 @@ cmakeConfigurePhase() {
     prependToVar cmakeFlags "-DCMAKE_INSTALL_BINDIR=${!outputBin}/bin"
     prependToVar cmakeFlags "-DCMAKE_INSTALL_SBINDIR=${!outputBin}/sbin"
     prependToVar cmakeFlags "-DCMAKE_INSTALL_INCLUDEDIR=${!outputInclude}/include"
-    prependToVar cmakeFlags "-DCMAKE_INSTALL_OLDINCLUDEDIR=${!outputInclude}/include"
     prependToVar cmakeFlags "-DCMAKE_INSTALL_MANDIR=${!outputMan}/share/man"
     prependToVar cmakeFlags "-DCMAKE_INSTALL_INFODIR=${!outputInfo}/share/info"
     prependToVar cmakeFlags "-DCMAKE_INSTALL_DOCDIR=${!outputDoc}/share/doc/${shareDocName}"
diff --git a/pkgs/by-name/du/duktape/package.nix b/pkgs/by-name/du/duktape/package.nix
index c285f44a5e4a..9cb67506022b 100644
--- a/pkgs/by-name/du/duktape/package.nix
+++ b/pkgs/by-name/du/duktape/package.nix
@@ -21,19 +21,25 @@ stdenv.mkDerivation (finalAttrs: {
     validatePkgConfig
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
 
-  buildPhase = ''
-    make -f Makefile.sharedlibrary
-    make -f Makefile.cmdline
-  '';
+  buildPhase =
+    ''
+      make -f Makefile.cmdline
+    ''
+    + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
+      make -f Makefile.sharedlibrary
+    '';
 
-  installPhase = ''
-    install -d $out/bin
-    install -m755 duk $out/bin/
-    install -d $out/lib/pkgconfig
-    install -d $out/include
-    make -f Makefile.sharedlibrary install INSTALL_PREFIX=$out
-    substituteAll ${./duktape.pc.in} $out/lib/pkgconfig/duktape.pc
-  '';
+  installPhase =
+    ''
+      install -d $out/bin
+      install -m755 duk $out/bin/
+    ''
+    + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
+      install -d $out/lib/pkgconfig
+      install -d $out/include
+      make -f Makefile.sharedlibrary install INSTALL_PREFIX=$out
+      substituteAll ${./duktape.pc.in} $out/lib/pkgconfig/duktape.pc
+    '';
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/fb/fbmenugen/package.nix b/pkgs/by-name/fb/fbmenugen/package.nix
index 1b6d303f07dd..018a5a2a1689 100644
--- a/pkgs/by-name/fb/fbmenugen/package.nix
+++ b/pkgs/by-name/fb/fbmenugen/package.nix
@@ -5,7 +5,7 @@
   gnused,
   makeWrapper,
   perlPackages,
-  substituteAll,
+  replaceVars,
   xorg,
   wrapGAppsHook3,
   gitUpdater,
@@ -23,10 +23,11 @@ perlPackages.buildPerlPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./0001-Fix-paths.patch;
+    (replaceVars ./0001-Fix-paths.patch {
       xmessage = xorg.xmessage;
       inherit fluxbox gnused;
+      # replaced in postPatch
+      fbmenugen = null;
     })
   ];
 
diff --git a/pkgs/by-name/fr/freenet/package.nix b/pkgs/by-name/fr/freenet/package.nix
index 4046a270c3e7..3d9bdb6dac8a 100644
--- a/pkgs/by-name/fr/freenet/package.nix
+++ b/pkgs/by-name/fr/freenet/package.nix
@@ -8,7 +8,7 @@
   gradle_8,
   bash,
   coreutils,
-  substituteAll,
+  replaceVars,
   nixosTests,
   writeText,
 }:
@@ -50,14 +50,15 @@ stdenv.mkDerivation rec {
     jdk
   ];
 
-  wrapper = substituteAll {
-    src = ./freenetWrapper;
+  wrapper = replaceVars ./freenetWrapper {
     inherit
       bash
       coreutils
       jre
       seednodes
       ;
+    # replaced in installPhase
+    CLASSPATH = null;
   };
 
   mitmCache = gradle.fetchDeps {
diff --git a/pkgs/by-name/gl/glance/package.nix b/pkgs/by-name/gl/glance/package.nix
index 2f9f14fbc117..70690be2f87a 100644
--- a/pkgs/by-name/gl/glance/package.nix
+++ b/pkgs/by-name/gl/glance/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "glance";
-  version = "0.6.4";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "glanceapp";
     repo = "glance";
     rev = "v${version}";
-    hash = "sha256-L3IBCh4pDeaErxl89s/1yMHoU8dYtRcmqcIgFiyGq2U=";
+    hash = "sha256-Ef3Kf7rYmkWqOUpde7P46IRs1x/+jMW3lmN13hfTCNs=";
   };
 
-  vendorHash = "sha256-6PDcUb2Rv+Shqb+wtsit8Yt9RSgN5tz+MeXrujZXDCo=";
+  vendorHash = "sha256-lURRHlZoxbuW1SXxrxy2BkMndcEllGFmVCB4pXBad8Q=";
 
   excludedPackages = [ "scripts/build-and-ship" ];
 
diff --git a/pkgs/by-name/in/iniparser/package.nix b/pkgs/by-name/in/iniparser/package.nix
index ca36474af0d9..b04a3fbf48e7 100644
--- a/pkgs/by-name/in/iniparser/package.nix
+++ b/pkgs/by-name/in/iniparser/package.nix
@@ -27,7 +27,6 @@ stdenv.mkDerivation (finalAttrs: {
     (replaceVars ./remove-fetchcontent-usage.patch {
       # Do not let cmake's fetchContent download unity
       unitySrc = symlinkJoin {
-        name = "unity-with-iniparser-config";
         paths = [
           (fetchFromGitHub {
             owner = "throwtheswitch";
diff --git a/pkgs/by-name/lc/lcms2/package.nix b/pkgs/by-name/lc/lcms2/package.nix
index 17af27ccd36b..e5fe6136e7da 100644
--- a/pkgs/by-name/lc/lcms2/package.nix
+++ b/pkgs/by-name/lc/lcms2/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.16";
+  version = "2.17";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${pname}-${version}.tar.gz";
-    hash = "sha256-2HPTSti5tM6gEGMfGmIo0gh0deTcXnY+uBrMI9nUWlE=";
+    hash = "sha256-0Rr1aeQqG6oWUNIK1h0S5Br0/q1Kp5ZKAfk7CLU6sHQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/le/lesspipe/package.nix b/pkgs/by-name/le/lesspipe/package.nix
index 0fd06e2758de..7f42f6bbf59a 100644
--- a/pkgs/by-name/le/lesspipe/package.nix
+++ b/pkgs/by-name/le/lesspipe/package.nix
@@ -167,6 +167,7 @@ stdenv.mkDerivation rec {
       };
       execer = [
         "cannot:${iconv}/bin/iconv"
+        "cannot:${file}/bin/file"
       ];
     }}
     ${resholve.phraseSolution "lesscomplete" {
@@ -216,6 +217,9 @@ stdenv.mkDerivation rec {
         ];
         builtin = [ "setopt" ];
       };
+      execer = [
+        "cannot:${file}/bin/file"
+      ];
     }}
   '';
 
diff --git a/pkgs/by-name/li/libtiff/package.nix b/pkgs/by-name/li/libtiff/package.nix
index 49d39705ef79..7dea25c62d01 100644
--- a/pkgs/by-name/li/libtiff/package.nix
+++ b/pkgs/by-name/li/libtiff/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  fetchpatch,
   nix-update-script,
 
   cmake,
@@ -17,6 +16,17 @@
   zlib,
   zstd,
 
+  # Because lerc is C++ and static libraries don't track dependencies,
+  # that every downstream dependent of libtiff has to link with a C++
+  # compiler, or the C++ standard library won't be linked, resulting
+  # in undefined symbol errors.  Without systematic support for this
+  # in build systems, fixing this would require modifying the build
+  # system of every libtiff user.  Hopefully at some point build
+  # systems will figure this out, and then we can enable this.
+  #
+  # See https://github.com/mesonbuild/meson/issues/14234
+  withLerc ? !stdenv.hostPlatform.isStatic,
+
   # for passthru.tests
   libgeotiff,
   python3Packages,
@@ -43,13 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
     # libc++abi 11 has an `#include <version>`, this picks up files name
     # `version` in the project's include paths
     ./rename-version.patch
-
-    # https://gitlab.com/libtiff/libtiff/-/merge_requests/685
-    (fetchpatch {
-      name = "static.patch";
-      url = "https://gitlab.com/libtiff/libtiff/-/commit/e6f3d60187a699507d6c85c5c63a8f258d8b8ebc.patch";
-      hash = "sha256-TZE7nyOPojxnR9/jiZbv2LgKS2Yz+Db9lbLgeefrQsc=";
-    })
   ];
 
   postPatch = ''
@@ -80,10 +83,13 @@ stdenv.mkDerivation (finalAttrs: {
     sphinx
   ];
 
-  buildInputs = [
-    lerc
-    zstd
-  ];
+  buildInputs =
+    [
+      zstd
+    ]
+    ++ lib.optionals withLerc [
+      lerc
+    ];
 
   # TODO: opengl support (bogus configure detection)
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 24f40f987082..5f8ae3cdb2d3 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-Ix1UTVYJRPTii/LqJQto+und+BrSAIZeHlTA6biysm0=";
+    hash = "sha256-k4s0kh68kycc8MSVkD64X547mWmFW4UuToDIcZ87OSc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-vgMzl3Kx1OqHSkVdykgwoMn+XNrjg93OmVgDc6I7AV0=";
+  cargoHash = "sha256-6aLWkphWLScUz6l0RJj9LmNad6aPxLz2iVxXVOXq7pg=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 79d0e5b7eb54..581f844c8b6c 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -12,7 +12,7 @@
   ninja,
   pkg-config,
   python3,
-  substituteAll,
+  replaceVars,
   zlib,
 }:
 
@@ -46,8 +46,7 @@ python3.pkgs.buildPythonApplication rec {
     # are not as predictable, therefore we need to keep them in the RPATH.
     # At the moment we are keeping the paths starting with /nix/store.
     # https://github.com/NixOS/nixpkgs/issues/31222#issuecomment-365811634
-    (substituteAll {
-      src = ./001-fix-rpath.patch;
+    (replaceVars ./001-fix-rpath.patch {
       inherit (builtins) storeDir;
     })
 
diff --git a/pkgs/by-name/nu/nuget-to-json/package.nix b/pkgs/by-name/nu/nuget-to-json/package.nix
index 6a2be3060576..7691a503dcb9 100644
--- a/pkgs/by-name/nu/nuget-to-json/package.nix
+++ b/pkgs/by-name/nu/nuget-to-json/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   runtimeShell,
-  substituteAll,
+  replaceVarsWith,
   nix,
   coreutils,
   jq,
@@ -12,23 +12,25 @@
   cacert,
 }:
 
-substituteAll {
+replaceVarsWith {
   name = "nuget-to-json";
   dir = "bin";
 
   src = ./nuget-to-json.sh;
   isExecutable = true;
 
-  inherit runtimeShell cacert;
-  binPath = lib.makeBinPath [
-    nix
-    coreutils
-    jq
-    xmlstarlet
-    curl
-    gnugrep
-    gawk
-  ];
+  replacements = {
+    inherit runtimeShell cacert;
+    binPath = lib.makeBinPath [
+      nix
+      coreutils
+      jq
+      xmlstarlet
+      curl
+      gnugrep
+      gawk
+    ];
+  };
 
   meta = {
     description = "Convert a nuget packages directory to a lockfile for buildDotnetModule";
diff --git a/pkgs/by-name/nu/nuget-to-nix/package.nix b/pkgs/by-name/nu/nuget-to-nix/package.nix
index dcd51fa81457..118ca77cc3c6 100644
--- a/pkgs/by-name/nu/nuget-to-nix/package.nix
+++ b/pkgs/by-name/nu/nuget-to-nix/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   runtimeShell,
-  substituteAll,
+  replaceVarsWith,
   nix,
   coreutils,
   jq,
@@ -13,24 +13,26 @@
   cacert,
 }:
 
-substituteAll {
+replaceVarsWith {
   name = "nuget-to-nix";
   dir = "bin";
 
   src = ./nuget-to-nix.sh;
   isExecutable = true;
 
-  inherit runtimeShell cacert;
-  binPath = lib.makeBinPath [
-    nix
-    coreutils
-    jq
-    xmlstarlet
-    curl
-    gnugrep
-    gawk
-    nuget-to-json
-  ];
+  replacements = {
+    inherit runtimeShell cacert;
+    binPath = lib.makeBinPath [
+      nix
+      coreutils
+      jq
+      xmlstarlet
+      curl
+      gnugrep
+      gawk
+      nuget-to-json
+    ];
+  };
 
   meta = {
     description = "Convert a nuget packages directory to a lockfile for buildDotnetModule";
diff --git a/pkgs/by-name/sp/speechd/package.nix b/pkgs/by-name/sp/speechd/package.nix
index 58bee929bfab..2947cf31bdb7 100644
--- a/pkgs/by-name/sp/speechd/package.nix
+++ b/pkgs/by-name/sp/speechd/package.nix
@@ -1,7 +1,7 @@
 {
   stdenv,
   lib,
-  substituteAll,
+  replaceVars,
   pkg-config,
   fetchurl,
   python3Packages,
@@ -47,16 +47,16 @@ stdenv.mkDerivation rec {
 
   patches =
     [
-      (substituteAll {
-        src = ./fix-paths.patch;
+      (replaceVars ./fix-paths.patch {
         utillinux = util-linux;
+        # patch context
+        bindir = null;
       })
     ]
     ++ lib.optionals (withEspeak && espeak.mbrolaSupport) [
       # Replace FHS paths.
-      (substituteAll {
-        src = ./fix-mbrola-paths.patch;
-        inherit espeak mbrola;
+      (replaceVars ./fix-mbrola-paths.patch {
+        inherit mbrola;
       })
     ];
 
diff --git a/pkgs/by-name/us/usbutils/package.nix b/pkgs/by-name/us/usbutils/package.nix
index 72a557c931f0..49a7d88925ea 100644
--- a/pkgs/by-name/us/usbutils/package.nix
+++ b/pkgs/by-name/us/usbutils/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  substituteAll,
+  replaceVars,
   fetchpatch,
   meson,
   ninja,
@@ -23,8 +23,7 @@ stdenv.mkDerivation rec {
 
   patches =
     [
-      (substituteAll {
-        src = ./fix-paths.patch;
+      (replaceVars ./fix-paths.patch {
         inherit hwdata;
       })
     ]
diff --git a/pkgs/by-name/wa/waf/package.nix b/pkgs/by-name/wa/waf/package.nix
index 77423091ed7a..7a2e4298a0d8 100644
--- a/pkgs/by-name/wa/waf/package.nix
+++ b/pkgs/by-name/wa/waf/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waf";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "waf-${finalAttrs.version}";
-    hash = "sha256-Dt8eo/rY6JRu6teTQM0y7bjMzQjOv3WSL6bcF9g0B8o=";
+    hash = "sha256-cZ8tt17m1KUGxYPJf+cHf9j8rzNCrGyY8rcZcSvebyY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zl/zlib-ng/package.nix b/pkgs/by-name/zl/zlib-ng/package.nix
index 6b80713075de..70935d20f519 100644
--- a/pkgs/by-name/zl/zlib-ng/package.nix
+++ b/pkgs/by-name/zl/zlib-ng/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zlib-ng";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "zlib-ng";
     repo = "zlib-ng";
     rev = version;
-    hash = "sha256-22JX7diwhPaAhqErUdFymeSMzEGQkOp7LdBFwCnx5oc=";
+    hash = "sha256-Khmrhp5qy4vvoQe4WgoogpjWrgcUB/q8zZeqIydthYg=";
   };
 
   outputs = [
diff --git a/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix b/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
index 8d839427a2fe..49beba0de955 100644
--- a/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
+++ b/pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  substituteAll,
+  replaceVars,
   fetchurl,
   fetchpatch,
   findXMLCatalogs,
@@ -50,8 +50,7 @@ let
             })
 
             # Add legacy sourceforge.net URIs to the catalog
-            (substituteAll {
-              src = ./catalog-legacy-uris.patch;
+            (replaceVars ./catalog-legacy-uris.patch {
               inherit legacySuffix suffix version;
             })
           ]
diff --git a/pkgs/desktops/gnome/extensions/extensionOverrides.nix b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
index b3f1929c3cef..c4bd7f0880b4 100644
--- a/pkgs/desktops/gnome/extensions/extensionOverrides.nix
+++ b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
@@ -21,7 +21,6 @@
 , smartmontools
 , replaceVars
 , stdenvNoCC
-, substituteAll
 , touchegg
 , util-linux
 , vte
@@ -136,8 +135,7 @@ super: lib.trivial.pipe super [
     });
   in {
     patches = [
-      (substituteAll {
-        src = ./extensionOverridesPatches/lunarcal_at_ailin.nemui.patch;
+      (replaceVars ./extensionOverridesPatches/lunarcal_at_ailin.nemui.patch {
         chinese_calendar_path = chinese-calendar;
       })
     ];
diff --git a/pkgs/desktops/gnome/extensions/gsconnect/default.nix b/pkgs/desktops/gnome/extensions/gsconnect/default.nix
index c4db5afa5771..3a029b6519f1 100644
--- a/pkgs/desktops/gnome/extensions/gsconnect/default.nix
+++ b/pkgs/desktops/gnome/extensions/gsconnect/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, substituteAll
+, replaceVars
 , openssl
 , gsound
 , meson
@@ -35,9 +35,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     # Make typelibs available in the extension
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       gapplication = "${glib.bin}/bin/gapplication";
+      # Replaced in postPatch
+      typelibPath = null;
     })
 
     # Allow installing installed tests to a separate output
diff --git a/pkgs/desktops/gnome/extensions/taskwhisperer/default.nix b/pkgs/desktops/gnome/extensions/taskwhisperer/default.nix
index fc37e6875820..32b920fce9c0 100644
--- a/pkgs/desktops/gnome/extensions/taskwhisperer/default.nix
+++ b/pkgs/desktops/gnome/extensions/taskwhisperer/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  substituteAll,
+  replaceVars,
   fetchFromGitHub,
   taskwarrior2,
   gettext,
@@ -37,10 +37,8 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       task = "${taskwarrior2}/bin/task";
-      shell = runtimeShell;
     })
   ];
 
diff --git a/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix b/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
index 3ad337e3dd80..ca2dece93391 100644
--- a/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
+++ b/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
@@ -3,7 +3,7 @@
   lib,
   fetchFromGitLab,
   gitUpdater,
-  substituteAll,
+  replaceVars,
   testers,
   dbus-test-runner,
   dpkg,
@@ -63,9 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     ./2001-Mark-problematic-tests.patch
 
-    (substituteAll {
-      src = ./2002-Nixpkgs-versioned-QML-path.patch.in;
-      name = "2002-Nixpkgs-versioned-QML-path.patch";
+    (replaceVars ./2002-Nixpkgs-versioned-QML-path.patch.in {
       qtVersion = lib.versions.major qtbase.version;
     })
   ];
diff --git a/pkgs/desktops/mate/caja-dropbox/default.nix b/pkgs/desktops/mate/caja-dropbox/default.nix
index 00ee31898376..9bce1b56f531 100644
--- a/pkgs/desktops/mate/caja-dropbox/default.nix
+++ b/pkgs/desktops/mate/caja-dropbox/default.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  substituteAll,
+  replaceVars,
   pkg-config,
   gobject-introspection,
   gdk-pixbuf,
@@ -26,9 +26,10 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-cli-paths.patch;
+    (replaceVars ./fix-cli-paths.patch {
       inherit dropboxd;
+      # patch context
+      DESKTOP_FILE_DIR = null;
     })
   ];
 
diff --git a/pkgs/development/compilers/crystal/default.nix b/pkgs/development/compilers/crystal/default.nix
index 52557ca4a64a..f83ac656dcf8 100644
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@@ -4,7 +4,7 @@
 , fetchurl
 , fetchpatch
 , lib
-, substituteAll
+, replaceVars
   # Dependencies
 , boehmgc
 , coreutils
@@ -95,8 +95,7 @@ let
       };
 
       patches = [
-          (substituteAll {
-            src = ./tzdata.patch;
+          (replaceVars ./tzdata.patch {
             inherit tzdata;
           })
         ]
diff --git a/pkgs/development/compilers/dotnet/sign-apphost.nix b/pkgs/development/compilers/dotnet/sign-apphost.nix
index 021d9ef61a90..e69adc5f3660 100644
--- a/pkgs/development/compilers/dotnet/sign-apphost.nix
+++ b/pkgs/development/compilers/dotnet/sign-apphost.nix
@@ -1,12 +1,11 @@
 {
-  substituteAll,
+  replaceVars,
   callPackage,
 }:
 let
   sigtool = callPackage ./sigtool.nix { };
 
 in
-substituteAll {
-  src = ./sign-apphost.proj;
+replaceVars ./sign-apphost.proj {
   codesign = "${sigtool}/bin/codesign";
 }
diff --git a/pkgs/development/compilers/dotnet/wrapper.nix b/pkgs/development/compilers/dotnet/wrapper.nix
index d268476c2c14..2ac14b665fea 100644
--- a/pkgs/development/compilers/dotnet/wrapper.nix
+++ b/pkgs/development/compilers/dotnet/wrapper.nix
@@ -15,7 +15,7 @@
   darwin,
   icu,
   lndir,
-  substituteAll,
+  replaceVars,
   nugetPackageHook,
   xmlstarlet,
 }:
@@ -42,10 +42,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     [
       ./dotnet-setup-hook.sh
     ]
-    ++ lib.optional (type == "sdk") (substituteAll {
-      src = ./dotnet-sdk-setup-hook.sh;
-      inherit lndir xmlstarlet;
-    });
+    ++ lib.optional (type == "sdk") (
+      replaceVars ./dotnet-sdk-setup-hook.sh {
+        inherit lndir xmlstarlet;
+      }
+    );
 
   propagatedSandboxProfile = toString unwrapped.__propagatedSandboxProfile;
 
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 6a3e7738fc1d..54386a3ca24e 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -10,7 +10,7 @@
   llvmPackages,
   symlinkJoin,
   makeWrapper,
-  substituteAll,
+  replaceVars,
   buildNpmPackage,
   emscripten,
 }:
@@ -57,8 +57,7 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./0001-emulate-clang-sysroot-include-logic.patch;
+    (replaceVars ./0001-emulate-clang-sysroot-include-logic.patch {
       resourceDir = "${llvmEnv}/lib/clang/${lib.versions.major llvmPackages.llvm.version}/";
     })
   ];
diff --git a/pkgs/development/compilers/go/1.22.nix b/pkgs/development/compilers/go/1.22.nix
index b64be8d90a71..471d398358a8 100644
--- a/pkgs/development/compilers/go/1.22.nix
+++ b/pkgs/development/compilers/go/1.22.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   tzdata,
-  substituteAll,
+  replaceVars,
   iana-etc,
   xcbuild,
   mailcap,
@@ -75,20 +75,17 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   patches = [
-    (substituteAll {
-      src = ./iana-etc-1.17.patch;
+    (replaceVars ./iana-etc-1.17.patch {
       iana = iana-etc;
     })
     # Patch the mimetype database location which is missing on NixOS.
     # but also allow static binaries built with NixOS to run outside nix
-    (substituteAll {
-      src = ./mailcap-1.17.patch;
+    (replaceVars ./mailcap-1.17.patch {
       inherit mailcap;
     })
     # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
     # that run outside a nix server
-    (substituteAll {
-      src = ./tzdata-1.19.patch;
+    (replaceVars ./tzdata-1.19.patch {
       inherit tzdata;
     })
     ./remove-tools-1.11.patch
diff --git a/pkgs/development/compilers/go/1.23.nix b/pkgs/development/compilers/go/1.23.nix
index 514cf806be38..dfeffaac7784 100644
--- a/pkgs/development/compilers/go/1.23.nix
+++ b/pkgs/development/compilers/go/1.23.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   tzdata,
-  substituteAll,
+  replaceVars,
   iana-etc,
   xcbuild,
   mailcap,
@@ -75,20 +75,17 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   patches = [
-    (substituteAll {
-      src = ./iana-etc-1.17.patch;
+    (replaceVars ./iana-etc-1.17.patch {
       iana = iana-etc;
     })
     # Patch the mimetype database location which is missing on NixOS.
     # but also allow static binaries built with NixOS to run outside nix
-    (substituteAll {
-      src = ./mailcap-1.17.patch;
+    (replaceVars ./mailcap-1.17.patch {
       inherit mailcap;
     })
     # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
     # that run outside a nix server
-    (substituteAll {
-      src = ./tzdata-1.19.patch;
+    (replaceVars ./tzdata-1.19.patch {
       inherit tzdata;
     })
     ./remove-tools-1.11.patch
diff --git a/pkgs/development/compilers/go/1.24.nix b/pkgs/development/compilers/go/1.24.nix
index 75a4cb6c8475..a563cbcd85a2 100644
--- a/pkgs/development/compilers/go/1.24.nix
+++ b/pkgs/development/compilers/go/1.24.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   tzdata,
-  substituteAll,
+  replaceVars,
   iana-etc,
   xcbuild,
   mailcap,
@@ -75,20 +75,17 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   patches = [
-    (substituteAll {
-      src = ./iana-etc-1.17.patch;
+    (replaceVars ./iana-etc-1.17.patch {
       iana = iana-etc;
     })
     # Patch the mimetype database location which is missing on NixOS.
     # but also allow static binaries built with NixOS to run outside nix
-    (substituteAll {
-      src = ./mailcap-1.17.patch;
+    (replaceVars ./mailcap-1.17.patch {
       inherit mailcap;
     })
     # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
     # that run outside a nix server
-    (substituteAll {
-      src = ./tzdata-1.19.patch;
+    (replaceVars ./tzdata-1.19.patch {
       inherit tzdata;
     })
     ./remove-tools-1.11.patch
diff --git a/pkgs/development/compilers/ponyc/default.nix b/pkgs/development/compilers/ponyc/default.nix
index 005605e9095a..a78cd863dabd 100644
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@@ -13,7 +13,7 @@
   python3,
   # Not really used for anything real, just at build time.
   git,
-  substituteAll,
+  replaceVars,
   which,
   z3,
   cctools,
@@ -67,8 +67,7 @@ stdenv.mkDerivation (rec {
       ./disable-networking-tests.patch
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      (substituteAll {
-        src = ./fix-darwin-build.patch;
+      (replaceVars ./fix-darwin-build.patch {
         libSystem = darwin.Libsystem;
       })
     ];
diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
index 09a9e59eff3d..8e21e0d0e166 100644
--- a/pkgs/development/compilers/swift/compiler/default.nix
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -28,7 +28,7 @@
 , glibc
 , libuuid
 # Darwin-specific
-, substituteAll
+, replaceVars
 , fixDarwinDylibNames
 , xcbuild
 , cctools # libtool
@@ -300,12 +300,10 @@ in stdenv.mkDerivation {
     patch -p1 -d swift -i ${./patches/swift-linux-fix-libc-paths.patch}
     patch -p1 -d swift -i ${./patches/swift-linux-fix-linking.patch}
     patch -p1 -d swift -i ${./patches/swift-darwin-libcxx-flags.patch}
-    patch -p1 -d swift -i ${substituteAll {
-      src = ./patches/swift-darwin-plistbuddy-workaround.patch;
+    patch -p1 -d swift -i ${replaceVars ./patches/swift-darwin-plistbuddy-workaround.patch {
       inherit swiftArch;
     }}
-    patch -p1 -d swift -i ${substituteAll {
-      src = ./patches/swift-prevent-sdk-dirs-warning.patch;
+    patch -p1 -d swift -i ${replaceVars ./patches/swift-prevent-sdk-dirs-warning.patch {
       inherit (builtins) storeDir;
     }}
 
diff --git a/pkgs/development/compilers/swift/swift-driver/default.nix b/pkgs/development/compilers/swift/swift-driver/default.nix
index 52567304af31..1872e9f6a875 100644
--- a/pkgs/development/compilers/swift/swift-driver/default.nix
+++ b/pkgs/development/compilers/swift/swift-driver/default.nix
@@ -10,7 +10,7 @@
   XCTest,
   sqlite,
   ncurses,
-  substituteAll,
+  replaceVars,
 }:
 let
   sources = callPackage ../sources.nix { };
@@ -50,8 +50,7 @@ stdenv.mkDerivation {
       hash = "sha256-eVBaKN6uzj48ZnHtwGV0k5ChKjak1tDCyE+wTdyGq2c=";
     })
     # Prevent a warning about SDK directories we don't have.
-    (substituteAll {
-      src = ./patches/prevent-sdk-dirs-warnings.patch;
+    (replaceVars ./patches/prevent-sdk-dirs-warnings.patch {
       inherit (builtins) storeDir;
     })
   ];
diff --git a/pkgs/development/compilers/swift/swiftpm/default.nix b/pkgs/development/compilers/swift/swiftpm/default.nix
index 53fd9fcb8ac9..48f8b49a8df4 100644
--- a/pkgs/development/compilers/swift/swiftpm/default.nix
+++ b/pkgs/development/compilers/swift/swiftpm/default.nix
@@ -13,7 +13,7 @@
   pkg-config,
   sqlite,
   ncurses,
-  substituteAll,
+  replaceVars,
   runCommandLocal,
   makeWrapper,
   DarwinTools, # sw_vers
@@ -45,8 +45,7 @@ let
       ./patches/disable-xctest.patch
       ./patches/fix-clang-cxx.patch
       ./patches/nix-pkgconfig-vars.patch
-      (substituteAll {
-        src = ./patches/fix-stdlib-path.patch;
+      (replaceVars ./patches/fix-stdlib-path.patch {
         inherit (builtins) storeDir;
         swiftLib = swift.swift.lib;
       })
@@ -429,8 +428,7 @@ stdenv.mkDerivation (
         # Prevent a warning about SDK directories we don't have.
         swiftpmMakeMutable swift-driver
         patch -p1 -d .build/checkouts/swift-driver -i ${
-          substituteAll {
-            src = ../swift-driver/patches/prevent-sdk-dirs-warnings.patch;
+          replaceVars ../swift-driver/patches/prevent-sdk-dirs-warnings.patch {
             inherit (builtins) storeDir;
           }
         }
diff --git a/pkgs/development/compilers/temurin-bin/sources.json b/pkgs/development/compilers/temurin-bin/sources.json
index 225c244e3cfc..ab1757d9dc8d 100644
--- a/pkgs/development/compilers/temurin-bin/sources.json
+++ b/pkgs/development/compilers/temurin-bin/sources.json
@@ -6,52 +6,52 @@
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "9",
-            "sha256": "0a431310ccccc36c85b1274b5d31e368fdc8cf62cb7c2ed98d7b59eb5a13dc82",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jdk_x64_alpine-linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "2e1f667395cdb1e872bd7320e3eda96c0f0978e29e574e75f9cdf61160e8974a",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jdk_x64_alpine-linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           }
         },
         "openjdk17": {
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "67632ee4563e9827b56f62ab6da95bce200d9e82092b211988c0d2113abc4071",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jdk_x64_alpine-linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "259c85e16f7bbfdfb3e0a2ec1c5d6e2063300d413422286583265a9d8a882358",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jdk_x64_alpine-linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           }
         },
         "openjdk21": {
           "aarch64": {
-            "build": "11",
-            "sha256": "f22e32b869dd0e5e3f248646f62bffaa307b360299488ac8764e622923d7e747",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jdk_aarch64_alpine-linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "2798990401d9c47eaeddb7d5148f577770e4c1013b9223290a43765463204ae4",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jdk_aarch64_alpine-linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "8da7da49101d45f646272616f20e8b10d57472bbf5961d64ffb07d7ba93c6909",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jdk_x64_alpine-linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "6c66470a9143ad562570a34c1583d9fa50bf904f6f9ced642e9d800ce043a0f3",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jdk_x64_alpine-linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           }
         },
         "openjdk23": {
           "aarch64": {
-            "build": "11",
-            "sha256": "ebdd6602d27bd7535bf06f21e8a0c3d563be7b790a90bef00cb6ac4123c66f86",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jdk_aarch64_alpine-linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "b55c5c881a2fed17ec5a59feaa33d9263703b399d1bfae3a5eaed3f140aa4570",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jdk_aarch64_alpine-linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "4c37a9e885c4e099b049c3ba9baa073de1525e28cd5ffca016c5c5bd7ed385a6",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jdk_x64_alpine-linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "2c05c6dfea23a83fdbfaf5b03cc3cfd8d998c8069e930e0e585a39d4a99f3d99",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jdk_x64_alpine-linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           }
         },
         "openjdk8": {
@@ -59,9 +59,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "6",
-            "sha256": "86071bc98901cae80c62745a64bb4486212985fe5b66b5aec36ce92e8a036a9d",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jdk_x64_alpine-linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "9fcb96380b25c1d1caec65b7606c387716a7ae51caf359f5f3ff0dcca40f231f",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jdk_x64_alpine-linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           }
         }
       },
@@ -70,52 +70,52 @@
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "9",
-            "sha256": "905e35f14228904d67a7a56f9f0b8ede58e9b15f9af3a3d54fb86f78c8e47a34",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jre_x64_alpine-linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "69031fc68d41189691dbeca73447ca543040d26995f61cef83fd7aed8fb4dbd2",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jre_x64_alpine-linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           }
         },
         "openjdk17": {
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "7a2df4e2f86eca649af1e17d990ab8e354cb6dee389606025b9d05f75623c388",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jre_x64_alpine-linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "9dcc53a30676692e604571a6e0bd13ac0c1b15f4bc2b78d19f88bd316075f84a",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jre_x64_alpine-linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           }
         },
         "openjdk21": {
           "aarch64": {
-            "build": "11",
-            "sha256": "12b988a3d934e3eb89c6a981a93f8e2adf0a62cc9030487dee76c0c29b93714d",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jre_aarch64_alpine-linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "bcd459e70cdddaa6ada0d855ce944c592814042f1e12d53aa08fa89eedcdf893",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jre_aarch64_alpine-linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "2dfa33fb8e9474e6967c6cf17964abb5ddce9c17fa6a9f8d7aa221a0ae295df9",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jre_x64_alpine-linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "2330f38feb59ab7af0e2fffc12d5500005d35f7f53f49dd8a9f9aa1ae68aee5f",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jre_x64_alpine-linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           }
         },
         "openjdk23": {
           "aarch64": {
-            "build": "11",
-            "sha256": "b56eaedc094cb9107be2d5be9ad34c3dd9492c45aa671d102b5829a488cfc744",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jre_aarch64_alpine-linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "248a2ffb3abcb0cee7841ce648af7af415c96ee88cba4f8bf676c0115d38de5e",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jre_aarch64_alpine-linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "38a1b20b5ee8869b20e9f9aefdc91eedf245584d35287842a66540f0745dd3d0",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jre_x64_alpine-linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "4513750bd10cc6c38f0c19d335dac7dcc112bba64e52010f81ba29e7a71e2a76",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jre_x64_alpine-linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           }
         },
         "openjdk8": {
@@ -123,9 +123,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "6",
-            "sha256": "7f7c265560dd5a42533bf282831d7d2f044a7ff7f4c310b40a0f9f8e19ff12e5",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jre_x64_alpine-linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "4fb0636534b0cd4534a3cdcbbe7cf2e937523d6376d9cef00cc6cfd5d19537e8",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jre_x64_alpine-linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           }
         }
       }
@@ -134,332 +134,332 @@
       "jdk": {
         "openjdk11": {
           "aarch64": {
-            "build": "9",
-            "sha256": "f2087cc3abdd509b74facf8e43e81e36244d14c70dec080b8f3a662695417ca7",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "e7b3d37c347fe7af2a53711f16da8b9b164748ce4a84e47bb0739c3be7f1c421",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           },
           "armv6l": {
-            "build": "9",
-            "sha256": "6bdd7da08c9f8fedded8da0411b6566c16cb9a904d164b68a0b7f11c8376673a",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jdk_arm_linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "79d574328f6960d40349996ef8c5949581f9e533dc76f134857c4125c78558ff",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jdk_arm_linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           },
           "armv7l": {
-            "build": "9",
-            "sha256": "6bdd7da08c9f8fedded8da0411b6566c16cb9a904d164b68a0b7f11c8376673a",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jdk_arm_linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "79d574328f6960d40349996ef8c5949581f9e533dc76f134857c4125c78558ff",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jdk_arm_linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           },
           "packageType": "jdk",
           "powerpc64le": {
-            "build": "9",
-            "sha256": "0014ffdae26d2b8f840b4842e3f9d4edc3576b4a961770708273d8ecc86ba5b6",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "42c63651125a149cee2ba781300d75ffa67a25032f95038d50ee6d6177cb2e41",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jdk_ppc64le_linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "9",
-            "sha256": "191baa2e052627614022171400a917d28f0987dc54da48aaf07b06f552bb9884",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jdk_x64_linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "7def4c5807b38ef1a7bb30a86572a795ca604127cc8d1f5b370abf23618104e6",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jdk_x64_linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           }
         },
         "openjdk17": {
           "aarch64": {
-            "build": "11",
-            "sha256": "0c17fa4f14c0d2cc9e9334f996fccdddc5da4459d768f3105c7ff0283c47bf62",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "62efc3e83fc9bcd08db7c4f02977328cb3559a54519078d8337314cf025d19b7",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jdk_aarch64_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "armv6l": {
-            "build": "11",
-            "sha256": "e69d43be937e05dbccae4cc98f732ed86aa11993234bf5ad6e81c30475a78ce7",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jdk_arm_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "f43986385403c0f08bd3512c9d11a51c49044a7c8a0a39cf4e2e3731ca0db229",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jdk_arm_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "armv7l": {
-            "build": "11",
-            "sha256": "e69d43be937e05dbccae4cc98f732ed86aa11993234bf5ad6e81c30475a78ce7",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jdk_arm_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "f43986385403c0f08bd3512c9d11a51c49044a7c8a0a39cf4e2e3731ca0db229",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jdk_arm_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "packageType": "jdk",
           "powerpc64le": {
-            "build": "11",
-            "sha256": "d4e553c6fa7afdfe2577420c6e77a558db8113a3cef84e755384148f5610834e",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "f4cb9ee5906a44d110fa381310cd7181d95498d27087d449e7e9b74bddd9def2",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jdk_ppc64le_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "riscv64": {
-            "build": "11",
-            "sha256": "e7c82833a7381a05cae2be0e947c08e971bbae4f2e4142c6ec87bbd7530a5646",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jdk_riscv64_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "d7ba818b1417b67f1f3cdcf7c5fac5e179998469dce7448349f24175eb9b2871",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jdk_riscv64_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "8682892fc02965930b9022c066fa164dd6f458ef4a5dc262016aa28333b30f49",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jdk_x64_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "a3af83983fb94dd7d11b13ba2dba0fb6819dc2caaf87e6937afd22ad4680ae9a",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jdk_x64_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           }
         },
         "openjdk21": {
           "aarch64": {
-            "build": "11",
-            "sha256": "6482639ed9fd22aa2e704cc366848b1b3e1586d2bf1213869c43e80bca58fe5c",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "04fe1273f624187d927f1b466e8cdb630d70786db07bee7599bfa5153060afd3",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           },
           "packageType": "jdk",
           "powerpc64le": {
-            "build": "11",
-            "sha256": "3c6f4c358facfb6c19d90faf02bfe0fc7512d6b0e80ac18146bbd7e0d01deeef",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "163724b70b86d5a8461f85092165a9cc5a098ed900fee90d1b0c0be9607ae3d2",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jdk_ppc64le_linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           },
           "riscv64": {
-            "build": "11",
-            "sha256": "2f1b3e401e36de803398dfb9818861f9f14ca8ae7db650ea0946ab048fefe3b9",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jdk_riscv64_linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "203796e4ba2689aa921b5e0cdc9e02984d88622f80fcb9acb05a118b05007be8",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jdk_riscv64_linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "3c654d98404c073b8a7e66bffb27f4ae3e7ede47d13284c132d40a83144bfd8c",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jdk_x64_linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "a2650fba422283fbed20d936ce5d2a52906a5414ec17b2f7676dddb87201dbae",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jdk_x64_linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           }
         },
         "openjdk23": {
           "aarch64": {
-            "build": "11",
-            "sha256": "808e3843293e50515bf02ad2f956e543da65e32dac82ae7a266a147b3485c61a",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jdk_aarch64_linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "fb43ae1202402842559cb6223886ec1663b90ffbec48479abbcb92c92c9012eb",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jdk_aarch64_linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           },
           "packageType": "jdk",
           "powerpc64le": {
-            "build": "11",
-            "sha256": "1885ab141fe7b8ed6beb77b814b1c1c99fd54713399bf917edb6a4020545adde",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jdk_ppc64le_linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "548fd82af4eb0802fe20b0b61a4664a69c7f03cd963540908f30dbf73636dafe",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jdk_ppc64le_linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           },
           "riscv64": {
-            "build": "11",
-            "sha256": "80d7bab9f9614bdf934c6bc441031bd1fead3aea85f16770123bd8a6bcdc52b6",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jdk_riscv64_linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "1e102e1e6653f8810ef6c275b0d38ea7036abd4a8709f0f916b339f65e76bb56",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jdk_riscv64_linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "2400267e4e9c0f6ae880a4d763af6caf18c673714bdee5debf8388b0b5d52886",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jdk_x64_linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "870ac8c05c6fe563e7a3878a47d0234b83c050e83651d2c47e8b822ec74512dd",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jdk_x64_linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           }
         },
         "openjdk8": {
           "aarch64": {
             "build": "6",
-            "sha256": "383caabc20428e9500f2e07965317ed4387a0e336104483e29a9e06eeffbf26b",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jdk_aarch64_linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "1d1662bd8ca7edc9281c723d9eebafea940e6a41464bdc43a83b564bc974c7e5",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jdk_aarch64_linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           },
           "armv6l": {
             "build": "6",
-            "sha256": "ff1ce3f6f1cf11987ab63f278b29cf1aae799652606c547f8a590e7acbd16b61",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jdk_arm_linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "c555750ee41799d30553bd9744c1ab9b8e6b2a2ea83195619a11ef30cc4154f4",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jdk_arm_linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           },
           "armv7l": {
             "build": "6",
-            "sha256": "ff1ce3f6f1cf11987ab63f278b29cf1aae799652606c547f8a590e7acbd16b61",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jdk_arm_linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "c555750ee41799d30553bd9744c1ab9b8e6b2a2ea83195619a11ef30cc4154f4",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jdk_arm_linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           },
           "packageType": "jdk",
           "powerpc64le": {
             "build": "6",
-            "sha256": "64fb17e83b79f9ad41dc18351a408bfe90324fd6360903ca5c0a740006c81be3",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jdk_ppc64le_linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "7eac77deb8fc6c6130f9445c9a68af0bcc40bf6736b5672ef5c3d737c025e84d",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jdk_ppc64le_linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "6",
-            "sha256": "abaaa90deadf51bd28921453baf2992b3dff6171bb7142f5bdd14ef269f7b245",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jdk_x64_linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "5b0a0145e7790552a9c8767b4680074c4628ec276e5bb278b61d85cf90facafa",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jdk_x64_linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           }
         }
       },
       "jre": {
         "openjdk11": {
           "aarch64": {
-            "build": "9",
-            "sha256": "e37ba6636e31f3c9191ac7e3fd0ab7fb354a2f3b320d68bfb95efd1e053134c9",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "4ececb5c229763107e9e4acf3b7035db38cf18a98a47176fa5ed1be3f3d15518",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           },
           "armv6l": {
-            "build": "9",
-            "sha256": "6b7b1297da762cf2b1eb4834073e6a45cda82a359efb17a89eba3fc6b59b4d26",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jre_arm_linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "e4a00a3ea318a63ba97236633f34c8a5477f6cdb643cf6883788840818110f5f",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jre_arm_linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           },
           "armv7l": {
-            "build": "9",
-            "sha256": "6b7b1297da762cf2b1eb4834073e6a45cda82a359efb17a89eba3fc6b59b4d26",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jre_arm_linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "e4a00a3ea318a63ba97236633f34c8a5477f6cdb643cf6883788840818110f5f",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jre_arm_linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           },
           "packageType": "jre",
           "powerpc64le": {
-            "build": "9",
-            "sha256": "7e7edaf34c29c304514d60f40f6c9ce58eb3e32b0dec20bb6ccd1cfbb4456698",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jre_ppc64le_linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "69b38f0dde128d8c606012335cd60f1f55afa09b4135582188943bee699ebf03",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jre_ppc64le_linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "9",
-            "sha256": "84cd7101f39172a4db085fb52940595bb14dad6bc3afb5bf82ee497eceaf86d3",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jre_x64_linux_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "d26c566a7010d1303d3979b6f076e7911b49419a609c9e4d81f27262bf47f87c",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jre_x64_linux_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           }
         },
         "openjdk17": {
           "aarch64": {
-            "build": "11",
-            "sha256": "97c4fb748eaa1292fb2f28fec90a3eba23e35974ef67f8b3aa304ad4db2ba162",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "bab3f352fc7144ac1435924f056872d16f4b32c8bcda58b9a77b636eb1c664f4",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jre_aarch64_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "armv6l": {
-            "build": "11",
-            "sha256": "f9c4008680db016c9cab26cc2739d4553898911522f6a78a611fafa1f5270c88",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jre_arm_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "7ac439bce4d5ecddb250b31401b1c1a6da2762f51652eafedd53584a0d9e3130",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jre_arm_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "armv7l": {
-            "build": "11",
-            "sha256": "f9c4008680db016c9cab26cc2739d4553898911522f6a78a611fafa1f5270c88",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jre_arm_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "7ac439bce4d5ecddb250b31401b1c1a6da2762f51652eafedd53584a0d9e3130",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jre_arm_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "packageType": "jre",
           "powerpc64le": {
-            "build": "11",
-            "sha256": "790f53fcc95cc76ed8f27d3146cf789fc354a2afb7148cffd197ca61a643212f",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jre_ppc64le_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "2a730e9d34cce4d588739b626a034ed68c065a2db61048ee7886be48ec9fe460",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jre_ppc64le_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "riscv64": {
-            "build": "11",
-            "sha256": "f6f3e71e5452b764aad47e6ffa4f0b26fcfe69bd9eb07fbd468343f9dd5f17b5",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jre_riscv64_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "2f77e44aa9fec9cf35b0b1fd492055e7fec0a3ea4d4338def6b42bd46d485e02",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jre_riscv64_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "4086cc7cb2d9e7810141f255063caad10a8a018db5e6b47fa5394c506ab65bff",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jre_x64_linux_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "a4b0015872758aac6a5d17139e952a3951ee536ae6d9a99828823a80a71add56",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jre_x64_linux_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           }
         },
         "openjdk21": {
           "aarch64": {
-            "build": "11",
-            "sha256": "e4d02c33aeaf8e1148c1c505e129a709c5bc1889e855d4fb4f001b1780db42b4",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "f1b78f2bd6d505d5e0539261737740ad11ade3233376b4ca52e6c72fbefd2bf6",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jre_aarch64_linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           },
           "packageType": "jre",
           "powerpc64le": {
-            "build": "11",
-            "sha256": "ae9ad61578da420fa7aeb01d3f6909da8a74d54a31bb8ba090a263cfadf221cc",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jre_ppc64le_linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "381e31581af3858d4c471829c3da3263e83dfe8ac5d36b58403babb57f6e202c",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jre_ppc64le_linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           },
           "riscv64": {
-            "build": "11",
-            "sha256": "c6fe71bb6ce61366242073e3904c4f51613252a885d54be81c65d3fadd2c5b7c",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jre_riscv64_linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "a8d219a4a97f9c53ba88cb8927910005d4f3d08a87ab1bdebff921ef41afa93d",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jre_riscv64_linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "553dda64b3b1c3c16f8afe402377ffebe64fb4a1721a46ed426a91fd18185e62",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jre_x64_linux_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "7fc9d6837da5fa1f12e0f41901fd70a73154914b8c8ecbbcad2d44176a989937",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jre_x64_linux_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           }
         },
         "openjdk23": {
           "aarch64": {
-            "build": "11",
-            "sha256": "0b498a5b673cb50fe9cfd0a13bd39c7259b4fad4d930d614e1563aeb8bca7f0e",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jre_aarch64_linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "b2a8a287ebd2d2a1d5d32eb6b79768cf2b5e02f1b4d6d4791297feb8636b9e2f",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jre_aarch64_linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           },
           "packageType": "jre",
           "powerpc64le": {
-            "build": "11",
-            "sha256": "ae5d49932f7d9b182c2d9ededa18bd4defc61873f1d717caa3d905bba870a683",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jre_ppc64le_linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "a21355923fdcdcc49fcf6359f2763f49f001bd4caeb970f7313f18aeaa61b588",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jre_ppc64le_linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           },
           "riscv64": {
-            "build": "11",
-            "sha256": "cf65a926c2d7cbdbaa63242a8d20ce747335e7260eaaabd7bb52d51c099fda9a",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jre_riscv64_linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "c2c8f8add6af6518cfc565ec0a7410e031301b91f2d8bd594303d7f04680da4e",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jre_riscv64_linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           },
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "1233cbec40f05c76ad926b68521ae78c6ae4f454996ef549602be6987069fa77",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jre_x64_linux_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "1a16c654e67a72dadfa632969a457404ad1cc30c6375857fdcb393e0592ce3ba",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jre_x64_linux_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           }
         },
         "openjdk8": {
           "aarch64": {
             "build": "6",
-            "sha256": "786522da4c761104dd8274c81edc90126a25acaafbbbc5da886b3fb51f33cba2",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jre_aarch64_linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "730ed649ee973b7408cf7107e90576b67e8ed4b3aebb9e3e8a1056151f373152",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jre_aarch64_linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           },
           "armv6l": {
             "build": "6",
-            "sha256": "49894dbe2f915dfad026cf7b4013118c0284e88359172499b1b25a4dac195ff1",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jre_arm_linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "055c47c5c1dfe8c9c135d87fed7a3745c17374618bc8d5acb9316d1b812c0e6d",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jre_arm_linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           },
           "armv7l": {
             "build": "6",
-            "sha256": "49894dbe2f915dfad026cf7b4013118c0284e88359172499b1b25a4dac195ff1",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jre_arm_linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "055c47c5c1dfe8c9c135d87fed7a3745c17374618bc8d5acb9316d1b812c0e6d",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jre_arm_linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           },
           "packageType": "jre",
           "powerpc64le": {
             "build": "6",
-            "sha256": "c573f33f9e5ba49a4838847d0d34efc9c1dc57a9ba71b926599530bbcda87f65",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jre_ppc64le_linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "812ebf110f1d1cfc26a135368850064f96689e7918aa6bbac1c8f210fad5752f",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jre_ppc64le_linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           },
           "vmType": "hotspot",
           "x86_64": {
             "build": "6",
-            "sha256": "bb8c8cc575b69e68e12a213674ec2e3848baff4f1955d2973d98e67666ab94d7",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jre_x64_linux_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "730fe33b1fc1f7da1e325d007b475d25a063850a167b548ea4bf689d4fcd867d",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jre_x64_linux_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           }
         }
       }
@@ -468,66 +468,66 @@
       "jdk": {
         "openjdk11": {
           "aarch64": {
-            "build": "9",
-            "sha256": "658f73050ab168109862d4e25eefeedb587063cc01128a78ea4081e8ec62edcf",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jdk_aarch64_mac_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "c970e5917964da1b50c0029ba88a6fbe962783def4de6a8a2835af6a6859002c",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jdk_aarch64_mac_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "9",
-            "sha256": "fa6f88ebd8c3d2b4f5146cd45e4ef875cb2d073b6e95b60de86a1ce0bfdb463a",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jdk_x64_mac_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "b0142c2c85da43bb3565321164e8129b1166de5d6a43c88e567a92c39128c003",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jdk_x64_mac_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           }
         },
         "openjdk17": {
           "aarch64": {
-            "build": "11",
-            "sha256": "d8b2f77f755d06e81a540834c5be22ed86f3c8a51a20396606c074303f8f9e2d",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jdk_aarch64_mac_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "95bcc8052340394b87644d71a60fb26f31857f4090a7dfee57113e9e0f2dfacb",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jdk_aarch64_mac_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "840535070200a944a6b582d258ee84608bd25c9f2b5d1cdddb58dfadb019675a",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jdk_x64_mac_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "bc2e9225d156d27149fc7a91817e6b64f76132b2b81d1f44cb8c90d7497b6ea7",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jdk_x64_mac_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           }
         },
         "openjdk21": {
           "aarch64": {
-            "build": "11",
-            "sha256": "dc6db7347907d23743d13af935d3c10e8b3490acdf542115f578838227da0dab",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jdk_aarch64_mac_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "4ef4083919126a3d93e603284b405c7493905497485a92b375f5d6c3e8f7e8f2",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jdk_aarch64_mac_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "b9b46f396ab5f3658fa5569af963896167c7f735cfec816359c04101fae38bdf",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jdk_x64_mac_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "7aacfc400078ad65b7c7de3ec75ff74bf5c2077d6740b350f85ae10be4f71e76",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jdk_x64_mac_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           }
         },
         "openjdk23": {
           "aarch64": {
-            "build": "11",
-            "sha256": "9e69810a50c8183e01429243d0bb112e381a122c6e7be936b7c13c3cfe7b29a0",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jdk_aarch64_mac_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "749993e751f085c7ae713140066a90800075e4aeedfac50a5ed0c5457131c5a0",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jdk_aarch64_mac_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           },
           "packageType": "jdk",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "055a5b9c27991ad955c8207a20b549ac3254d479aa8a4fc199b6b02d56b1875e",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jdk_x64_mac_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "97fca2e90668351f248f149d4e96e16875094eba6716a8dd1dcf163be9e19085",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jdk_x64_mac_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           }
         },
         "openjdk8": {
@@ -535,75 +535,75 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "6",
-            "sha256": "e5cc78b704cf96f7a6c4ad677048f79331f38cd37fbef6c86dce75e1bfe28895",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jdk_x64_mac_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "2f70725e032fe55629a2659d53646b14c538b12cdcedc2d3c9fa342e1b401cf1",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jdk_x64_mac_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           }
         }
       },
       "jre": {
         "openjdk11": {
           "aarch64": {
-            "build": "9",
-            "sha256": "f1d602b478269c7def552d4a01c5ba3ac91cc34f5d66b5313da3aa0b72d670e7",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jre_aarch64_mac_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "ea341e15094e8e892a2d9ff1d4960d1fd05937385278912618905d4b9e7c88e8",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jre_aarch64_mac_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "9",
-            "sha256": "97e0e32b12460e92e3b4632492b3ccd648cf03a6023ca2ee7dc81f7cfa3bd275",
-            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.25%2B9/OpenJDK11U-jre_x64_mac_hotspot_11.0.25_9.tar.gz",
-            "version": "11.0.25"
+            "build": "4",
+            "sha256": "6d184fbcfa659675f52a7d789d4db05b9c9873c18ad9975a7b3c31e20ee4c878",
+            "url": "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.26%2B4/OpenJDK11U-jre_x64_mac_hotspot_11.0.26_4.tar.gz",
+            "version": "11.0.26"
           }
         },
         "openjdk17": {
           "aarch64": {
-            "build": "11",
-            "sha256": "a886b8f2a50eca2e59b45ea59f5a2e8e9d27ff5b5b3b069443a70cda7f27c907",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jre_aarch64_mac_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "9fb89125d5807f42cec588824fde487be42273a89c55ccfc5f44efda64e03e2c",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jre_aarch64_mac_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "bf9faf4540001a251e6bfb52b99c7ec5b1f36d3ebe94e104f61a30f173ba8c78",
-            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.13%2B11/OpenJDK17U-jre_x64_mac_hotspot_17.0.13_11.tar.gz",
-            "version": "17.0.13"
+            "build": "7",
+            "sha256": "f2c7454f7aba076cd414887b31da92e4a50fda7a13d97f6e295c911af60de0b6",
+            "url": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.14%2B7/OpenJDK17U-jre_x64_mac_hotspot_17.0.14_7.tar.gz",
+            "version": "17.0.14"
           }
         },
         "openjdk21": {
           "aarch64": {
-            "build": "11",
-            "sha256": "12249a1c5386957c93fc372260c483ae921b1ec6248a5136725eabd0abc07f93",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jre_aarch64_mac_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "9b792bbd408676483caaeb619439190abf1552fe11ab05b19c80d408e5f49c25",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jre_aarch64_mac_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "0e0dcb571f7bf7786c111fe066932066d9eab080c9f86d8178da3e564324ee81",
-            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.5%2B11/OpenJDK21U-jre_x64_mac_hotspot_21.0.5_11.tar.gz",
-            "version": "21.0.5"
+            "build": "7",
+            "sha256": "632f7cba1aa752ae4108eccf3abc8b7e51b75d262e11e0cb9077b847438e5549",
+            "url": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jre_x64_mac_hotspot_21.0.6_7.tar.gz",
+            "version": "21.0.6"
           }
         },
         "openjdk23": {
           "aarch64": {
-            "build": "11",
-            "sha256": "e29029d35608f4e415e49c7990ebe0f42d0ecb7dc2d4d444e41adf3e3287f922",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jre_aarch64_mac_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "56b86d4f5745ba44894310c3417755e4b4aaa62d4a17a5cb4dab6200c14c56fe",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jre_aarch64_mac_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           },
           "packageType": "jre",
           "vmType": "hotspot",
           "x86_64": {
-            "build": "11",
-            "sha256": "87e532fda02327e0f2766650223b6bd63a4407c4907f82790edb5862a5285116",
-            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jre_x64_mac_hotspot_23.0.1_11.tar.gz",
-            "version": "23.0.1"
+            "build": "7",
+            "sha256": "2c5b81ce3234d6bef0ec352734aa2de19c0950020c55a1cbfc21ae5fda7690b8",
+            "url": "https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.2%2B7/OpenJDK23U-jre_x64_mac_hotspot_23.0.2_7.tar.gz",
+            "version": "23.0.2"
           }
         },
         "openjdk8": {
@@ -611,9 +611,9 @@
           "vmType": "hotspot",
           "x86_64": {
             "build": "6",
-            "sha256": "55aac241ad7cb7c1903d4810ad705ffe2f2536a88b6a88efabb4942a9f09db33",
-            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u432-b06/OpenJDK8U-jre_x64_mac_hotspot_8u432b06.tar.gz",
-            "version": "8.0.432"
+            "sha256": "e2658d0808fd2f4d5ad261a8954366a9b277eabd55a404452674b56abc325fec",
+            "url": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u442-b06/OpenJDK8U-jre_x64_mac_hotspot_8u442b06.tar.gz",
+            "version": "8.0.442"
           }
         }
       }
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 0285a5355461..0c5c18277e2a 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -15,7 +15,7 @@
   libintl,
   libtool,
   expat,
-  substituteAll,
+  replaceVars,
   vala,
   gobject-introspection,
 }:
@@ -45,8 +45,7 @@ let
       pname = "vala";
       inherit version;
 
-      setupHook = substituteAll {
-        src = ./setup-hook.sh;
+      setupHook = replaceVars ./setup-hook.sh {
         apiVersion = lib.versions.majorMinor version;
       };
 
diff --git a/pkgs/development/embedded/platformio/core.nix b/pkgs/development/embedded/platformio/core.nix
index e9071fa1ab24..1e5cdce702c1 100644
--- a/pkgs/development/embedded/platformio/core.nix
+++ b/pkgs/development/embedded/platformio/core.nix
@@ -6,7 +6,7 @@
   installShellFiles,
   git,
   spdx-license-list-data,
-  substituteAll,
+  replaceVars,
 }:
 
 with python3Packages;
@@ -29,12 +29,10 @@ buildPythonApplication rec {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./interpreter.patch;
+    (replaceVars ./interpreter.patch {
       interpreter = (python3Packages.python.withPackages (_: propagatedBuildInputs)).interpreter;
     })
-    (substituteAll {
-      src = ./use-local-spdx-license-list.patch;
+    (replaceVars ./use-local-spdx-license-list.patch {
       spdx_license_list_data = spdx-license-list-data.json;
     })
     ./missing-udev-rules-nixos.patch
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index c0ff75b80800..c098a042b3ab 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -1325,9 +1325,11 @@ self: super: builtins.intersectAttrs super {
   # whatever graphviz is in PATH.
   graphviz = overrideCabal (drv: {
     patches = [
-      (pkgs.substituteAll {
-        src = ./patches/graphviz-hardcode-graphviz-store-path.patch;
+      (pkgs.replaceVars ./patches/graphviz-hardcode-graphviz-store-path.patch {
         inherit (pkgs) graphviz;
+        # patch context
+        dot = null;
+        PATH = null;
       })
     ] ++ (drv.patches or []);
   }) super.graphviz;
diff --git a/pkgs/development/interpreters/acl2/default.nix b/pkgs/development/interpreters/acl2/default.nix
index 6be3b9a865c5..3f6fbe627898 100644
--- a/pkgs/development/interpreters/acl2/default.nix
+++ b/pkgs/development/interpreters/acl2/default.nix
@@ -6,7 +6,7 @@
   fetchpatch,
   runCommandLocal,
   makeWrapper,
-  substituteAll,
+  replaceVars,
   sbcl,
   bash,
   which,
@@ -52,8 +52,7 @@ stdenv.mkDerivation rec {
   libipasir = callPackage ./libipasirglucose4 { };
 
   patches = [
-    (substituteAll {
-      src = ./0001-Fix-some-paths-for-Nix-build.patch;
+    (replaceVars ./0001-Fix-some-paths-for-Nix-build.patch {
       libipasir = "${libipasir}/lib/${libipasir.libname}";
       libssl = "${lib.getLib openssl}/lib/libssl${stdenv.hostPlatform.extensions.sharedLibrary}";
       libcrypto = "${lib.getLib openssl}/lib/libcrypto${stdenv.hostPlatform.extensions.sharedLibrary}";
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index 795bceede768..f40efde427ee 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, substituteAll, fetchurl
+{ lib, stdenv, replaceVars, fetchurl
 , zlibSupport ? true, zlib
 , bzip2, pkg-config, libffi
 , sqlite, openssl, ncurses, python, expat, tcl, tk, tclPackages, libX11
@@ -76,8 +76,7 @@ in with passthru; stdenv.mkDerivation rec {
   patches = [
     ./dont_fetch_vendored_deps.patch
 
-    (substituteAll {
-      src = ./tk_tcl_paths.patch;
+    (replaceVars ./tk_tcl_paths.patch {
       inherit tk tcl;
       tk_dev = tk.dev;
       tcl_dev = tcl;
@@ -85,8 +84,7 @@ in with passthru; stdenv.mkDerivation rec {
       tcl_libprefix = tcl.libPrefix;
     })
 
-    (substituteAll {
-      src = ./sqlite_paths.patch;
+    (replaceVars ./sqlite_paths.patch {
       inherit (sqlite) out dev;
     })
   ];
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 4d4b446af742..d88431bca7df 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -70,13 +70,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2";
-  version = "2.30.12";
+  version = "2.32.0";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-9f7V15p8Cso1TVxcd7bEFGO3C3oIhQikyLh4pWXLaiA=";
+    hash = "sha256-BdyMlttrDwQMoz+bO6bfU3bh0xKnT8yQF6nb6OGRbHw=";
   };
   dontDisableStatic = if withStatic then 1 else 0;
   outputs = [
diff --git a/pkgs/development/libraries/appstream/default.nix b/pkgs/development/libraries/appstream/default.nix
index a0ea85c83543..d4d0e26adb08 100644
--- a/pkgs/development/libraries/appstream/default.nix
+++ b/pkgs/development/libraries/appstream/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, substituteAll
+, replaceVars
 , fetchFromGitHub
 , meson
 , mesonEmulatorHook
@@ -50,8 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     # Fix hardcoded paths
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       libstemmer_includedir = "${lib.getDev libstemmer}/include";
     })
 
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 8c1d6926bcb9..95a8e14497d9 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -53,7 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./installed-tests-path.patch
 
     ./static-deps.patch
-    ./static-lerc.patch
   ];
 
   # gdk-pixbuf-thumbnailer is not wrapped therefore strictDeps will work
diff --git a/pkgs/development/libraries/gdk-pixbuf/static-lerc.patch b/pkgs/development/libraries/gdk-pixbuf/static-lerc.patch
deleted file mode 100644
index 737844a078ab..000000000000
--- a/pkgs/development/libraries/gdk-pixbuf/static-lerc.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 3bca69d889fe545dda4ed9a8fab8ff3fe38ba487 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Wed, 5 Feb 2025 19:37:27 +0100
-Subject: [PATCH] build: fix linking with libtiff with lerc support
-
-Lerc is written in C++.  When C and C++ objects are linked, a C++
-linker should be used to ensure C++-specific things are correctly
-handled.  See e.g. this comment in the Meson source for reference[1].
-One symptom of using a C linker to link with C++ objects is that
-libstdc++ won't be linked when building static executables, causing
-link failures.
-
-Unfortunately, Meson does not know whether dependencies found by
-pkg-config are C++, and therefore require a C++ linker, so we have to
-tell it ourselves to use a C++ linker.  There's no way to check
-whether libtiff is built with Lerc support, so we always use a C++
-linker if one is available and libtiff support is enabled.  If a C++
-linker ends up being used to link only C objects, it shouldn't do any
-harm.
-
-[1]: https://github.com/mesonbuild/meson/blob/9fd5281befe7881c9d1210c9e6865382bc0f2b08/mesonbuild/build.py#L1558-L1565
----
-Link: https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/181
-
- gdk-pixbuf/meson.build | 6 ++++++
- meson.build            | 6 ++++++
- 2 files changed, 12 insertions(+)
-
-diff --git a/gdk-pixbuf/meson.build b/gdk-pixbuf/meson.build
-index 570625bfe..5cc11355f 100644
---- a/gdk-pixbuf/meson.build
-+++ b/gdk-pixbuf/meson.build
-@@ -333,6 +333,11 @@ gdkpixbuf_bin = [
-   [ 'gdk-pixbuf-query-loaders', [ 'queryloaders.c' ] ],
- ]
- 
-+bin_link_language = 'c'
-+if loaders_cpp
-+  bin_link_language = 'cpp'
-+endif
-+
- foreach bin: gdkpixbuf_bin
-   bin_name = bin[0]
-   bin_source = bin.get(1, bin_name + '.c')
-@@ -342,6 +347,7 @@ foreach bin: gdkpixbuf_bin
-                    dependencies: gdk_pixbuf_deps + [ gdkpixbuf_dep ],
-                    include_directories: [ root_inc, gdk_pixbuf_inc ],
-                    c_args: common_cflags + gdk_pixbuf_cflags,
-+                   link_language : bin_link_language,
-                    install: true)
-   meson.override_find_program(bin_name, bin)
- 
-diff --git a/meson.build b/meson.build
-index f0d4812f4..31b3197fc 100644
---- a/meson.build
-+++ b/meson.build
-@@ -345,6 +345,8 @@ endif
- 
- # Don't check and build the tiff loader if native_windows_loaders is true
- tiff_opt = get_option('tiff')
-+tiff_dep = dependency('', required: false)
-+loaders_cpp = false
- if not tiff_opt.disabled() and not native_windows_loaders
-   # We currently don't have a fallback subproject, but this handles error
-   # reporting if tiff_opt is enabled.
-@@ -353,6 +355,10 @@ if not tiff_opt.disabled() and not native_windows_loaders
-   if tiff_dep.found()
-     enabled_loaders += 'tiff'
-     loaders_deps += tiff_dep
-+
-+    # If libtiff is built with LERC support, it should be linked with
-+    # a C++ linker.
-+    loaders_cpp = loaders_cpp or add_languages('cpp', required: false, native: false)
-   endif
- endif
- 
--- 
-GitLab
-
diff --git a/pkgs/development/libraries/gssdp/tools.nix b/pkgs/development/libraries/gssdp/tools.nix
index 7708bb6991a2..37fa43f91990 100644
--- a/pkgs/development/libraries/gssdp/tools.nix
+++ b/pkgs/development/libraries/gssdp/tools.nix
@@ -1,7 +1,7 @@
 {
   stdenv,
   lib,
-  substituteAll,
+  replaceVars,
   meson,
   ninja,
   pkg-config,
@@ -18,8 +18,7 @@ stdenv.mkDerivation rec {
   patches = [
     # Allow building tools separately from the library.
     # This is needed to break the depenency cycle.
-    (substituteAll {
-      src = ./standalone-tools.patch;
+    (replaceVars ./standalone-tools.patch {
       inherit version;
     })
   ];
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 3231bb6c649f..7e756b976b21 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchurl
 , fetchpatch
-, substituteAll
+, replaceVars
 , meson
 , ninja
 , gettext
@@ -127,8 +127,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # Add fallback paths for nvidia userspace libraries
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       inherit (addDriverRunpath) driverLink;
     })
     # Add support for newer AJA SDK from next GStreamer release
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index f9da5f6ba128..dd8abf8a8b99 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv
 , fetchurl
-, substituteAll
+, replaceVars
 , meson
 , nasm
 , ninja
@@ -71,8 +71,7 @@ stdenv.mkDerivation rec {
     # Reenable dynamic loading of libsoup on Darwin and use a different approach to do it.
     ./souploader-darwin.diff
     # dlopen libsoup_3 with an absolute path
-    (substituteAll {
-      src = ./souploader.diff;
+    (replaceVars ./souploader.diff {
       nixLibSoup3Path = "${lib.getLib libsoup_3}/lib";
     })
   ];
diff --git a/pkgs/development/libraries/gtk/2.x.nix b/pkgs/development/libraries/gtk/2.x.nix
index d1abe9b8e035..87b638ad76a4 100644
--- a/pkgs/development/libraries/gtk/2.x.nix
+++ b/pkgs/development/libraries/gtk/2.x.nix
@@ -22,7 +22,7 @@
   pango,
   perl,
   pkg-config,
-  substituteAll,
+  replaceVars,
   testers,
   AppKit,
   Cocoa,
@@ -32,8 +32,7 @@
 }:
 
 let
-  gtkCleanImmodulesCache = substituteAll {
-    src = ./hooks/clean-immodules-cache.sh;
+  gtkCleanImmodulesCache = replaceVars ./hooks/clean-immodules-cache.sh {
     gtk_module_path = "gtk-2.0";
     gtk_binary_version = "2.10.0";
   };
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index e995b48a1557..4f7ff70764c5 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, substituteAll
+, replaceVars
 , fetchurl
 , pkg-config
 , gettext
@@ -53,8 +53,7 @@
 
 let
 
-  gtkCleanImmodulesCache = substituteAll {
-    src = ./hooks/clean-immodules-cache.sh;
+  gtkCleanImmodulesCache = replaceVars ./hooks/clean-immodules-cache.sh {
     gtk_module_path = "gtk-3.0";
     gtk_binary_version = "3.0.0";
   };
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index c89cbce621a1..3c5cb9e863c1 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , buildPackages
-, substituteAll
+, replaceVars
 , fetchurl
 , pkg-config
 , docutils
@@ -58,8 +58,7 @@
 
 let
 
-  gtkCleanImmodulesCache = substituteAll {
-    src = ./hooks/clean-immodules-cache.sh;
+  gtkCleanImmodulesCache = replaceVars ./hooks/clean-immodules-cache.sh {
     gtk_module_path = "gtk-4.0";
     gtk_binary_version = "4.0.0";
   };
diff --git a/pkgs/development/libraries/libextractor/default.nix b/pkgs/development/libraries/libextractor/default.nix
index b46d4d8d1975..c8a545239846 100644
--- a/pkgs/development/libraries/libextractor/default.nix
+++ b/pkgs/development/libraries/libextractor/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   fetchpatch2,
-  substituteAll,
+  replaceVars,
   libtool,
   gettext,
   zlib,
@@ -60,8 +60,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals gstreamerSupport [
 
       # Libraries cannot be wrapped so we need to hardcode the plug-in paths.
-      (substituteAll {
-        src = ./gst-hardcode-plugins.patch;
+      (replaceVars ./gst-hardcode-plugins.patch {
         load_gst_plugins = lib.concatMapStrings (
           plugin: ''gst_registry_scan_path(gst_registry_get(), "${lib.getLib plugin}/lib/gstreamer-1.0");''
         ) (gstPlugins gst_all_1);
diff --git a/pkgs/development/libraries/libpeas/2.x.nix b/pkgs/development/libraries/libpeas/2.x.nix
index 35f204a1d5b4..c318f57be718 100644
--- a/pkgs/development/libraries/libpeas/2.x.nix
+++ b/pkgs/development/libraries/libpeas/2.x.nix
@@ -3,7 +3,7 @@
 , buildPackages
 , fetchurl
 , pkgsCross
-, substituteAll
+, replaceVars
 , pkg-config
 , gi-docgen
 , gobject-introspection
@@ -34,8 +34,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # Make PyGObject’s gi library available.
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       pythonPaths = lib.concatMapStringsSep ", " (pkg: "'${pkg}/${python3.sitePackages}'") [
         python3.pkgs.pygobject3
       ];
diff --git a/pkgs/development/libraries/libpeas/default.nix b/pkgs/development/libraries/libpeas/default.nix
index df0398797df0..2958f8f31b55 100644
--- a/pkgs/development/libraries/libpeas/default.nix
+++ b/pkgs/development/libraries/libpeas/default.nix
@@ -2,7 +2,7 @@
   stdenv,
   lib,
   fetchurl,
-  substituteAll,
+  replaceVars,
   meson,
   ninja,
   pkg-config,
@@ -34,8 +34,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # Make PyGObject’s gi library available.
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       pythonPaths = lib.concatMapStringsSep ", " (pkg: "'${pkg}/${python3.sitePackages}'") [
         python3.pkgs.pygobject3
       ];
diff --git a/pkgs/development/libraries/libproxy/default.nix b/pkgs/development/libraries/libproxy/default.nix
index fe65c9d3bc1e..67ccc456dc74 100644
--- a/pkgs/development/libraries/libproxy/default.nix
+++ b/pkgs/development/libraries/libproxy/default.nix
@@ -15,19 +15,26 @@
   ninja,
   pkg-config,
   stdenv,
-  substituteAll,
+  replaceVars,
   vala,
+  buildPackages,
+  withIntrospection ?
+    lib.meta.availableOn stdenv.hostPlatform gobject-introspection
+    && stdenv.hostPlatform.emulatorAvailable buildPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libproxy";
   version = "0.5.9";
 
-  outputs = [
-    "out"
-    "dev"
-    "devdoc"
-  ];
+  outputs =
+    [
+      "out"
+      "dev"
+    ]
+    ++ lib.optionals withIntrospection [
+      "devdoc"
+    ];
 
   src = fetchFromGitHub {
     owner = "libproxy";
@@ -46,8 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
 
       # Hardcode path to Settings schemas for GNOME & related desktops.
       # Otherwise every app using libproxy would need to be wrapped individually.
-      (substituteAll {
-        src = ./hardcode-gsettings.patch;
+      (replaceVars ./hardcode-gsettings.patch {
         gds = glib.getSchemaPath gsettings-desktop-schemas;
       })
     ];
@@ -65,14 +71,17 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "requires_private: 'gobject-2.0'" "requires: 'gobject-2.0'"
   '';
 
-  nativeBuildInputs = [
-    gi-docgen
-    gobject-introspection
-    meson
-    ninja
-    pkg-config
-    vala
-  ];
+  nativeBuildInputs =
+    [
+      meson
+      ninja
+      pkg-config
+    ]
+    ++ lib.optionals withIntrospection [
+      gi-docgen
+      gobject-introspection
+      vala
+    ];
 
   buildInputs =
     [
@@ -95,6 +104,8 @@ stdenv.mkDerivation (finalAttrs: {
     [
       # Prevent installing commit hook.
       "-Drelease=true"
+      (lib.mesonBool "docs" withIntrospection)
+      (lib.mesonBool "introspection" withIntrospection)
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       "-Dconfig-gnome=false"
diff --git a/pkgs/development/libraries/libqofono/default.nix b/pkgs/development/libraries/libqofono/default.nix
index 04acf0639767..4b67650d3541 100644
--- a/pkgs/development/libraries/libqofono/default.nix
+++ b/pkgs/development/libraries/libqofono/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  substituteAll,
+  replaceVars,
   mkDerivation,
   fetchFromGitHub,
   gitUpdater,
@@ -22,8 +22,7 @@ mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./0001-NixOS-provide-mobile-broadband-provider-info-path.patch;
+    (replaceVars ./0001-NixOS-provide-mobile-broadband-provider-info-path.patch {
       mobileBroadbandProviderInfo = mobile-broadband-provider-info;
     })
     ./0001-NixOS-Skip-tests-they-re-shock-full-of-hardcoded-FHS.patch
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index fcd46738c997..11b9919ecdb6 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -141,18 +141,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "tests" finalAttrs.finalPackage.doCheck)
   ];
 
-  doCheck =
-    # Probably broken MIME type detection.
-    !stdenv.isDarwin
-    &&
-      # Could be made to work, but requires the C API test to be linked
-      # with a C++ linker because
-      # librsvg -> gdk-pixbuf -> libtiff -> lerc (C++).
-      #
-      # Doesn't make sense to pursue this upstream until gdk-pixbuf
-      # itself is fixed:
-      # https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/181
-      !stdenv.hostPlatform.isStatic;
+  # Probably broken MIME type detection.
+  doCheck = !stdenv.isDarwin;
 
   env = {
     PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_QUERY_LOADERS = writeShellScript "gdk-pixbuf-loader-loaders-wrapped" ''
diff --git a/pkgs/development/libraries/libsbsms/common.nix b/pkgs/development/libraries/libsbsms/common.nix
index 358710b79501..71c7114b296c 100644
--- a/pkgs/development/libraries/libsbsms/common.nix
+++ b/pkgs/development/libraries/libsbsms/common.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  substituteAll,
+  replaceVars,
   pname,
   version,
   url,
@@ -19,8 +19,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # Fix buidling on platforms other than x86
-    (substituteAll {
-      src = ./configure.patch;
+    (replaceVars ./configure.patch {
       msse = lib.optionalString stdenv.hostPlatform.isx86_64 "-msse";
     })
   ];
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index d5c6f1b6cf17..216e99f5a4f1 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -32,7 +32,7 @@
 , readline
 , rpcsvc-proto
 , stdenv
-, substituteAll
+, replaceVars
 , xhtml1
 , json_c
 , writeScript
@@ -127,8 +127,7 @@ stdenv.mkDerivation rec {
   patches = [
     ./0001-meson-patch-in-an-install-prefix-for-building-on-nix.patch
   ] ++ lib.optionals enableZfs [
-    (substituteAll {
-      src = ./0002-substitute-zfs-and-zpool-commands.patch;
+    (replaceVars ./0002-substitute-zfs-and-zpool-commands.patch {
       zfs = "${zfs}/bin/zfs";
       zpool = "${zfs}/bin/zpool";
     })
diff --git a/pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs-darwin.patch b/pkgs/development/libraries/openssl/3.4/use-etc-ssl-certs-darwin.patch
similarity index 100%
rename from pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs-darwin.patch
rename to pkgs/development/libraries/openssl/3.4/use-etc-ssl-certs-darwin.patch
diff --git a/pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs.patch b/pkgs/development/libraries/openssl/3.4/use-etc-ssl-certs.patch
similarity index 100%
rename from pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs.patch
rename to pkgs/development/libraries/openssl/3.4/use-etc-ssl-certs.patch
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index f0cf68f8b6aa..624904c170bb 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -344,8 +344,8 @@ in
   };
 
   openssl_3 = common {
-    version = "3.0.15";
-    hash = "sha256-I8Zm0O3yDxQkmz2PA2isrumrWFsJ4d6CEHxm4fPslTM=";
+    version = "3.0.16";
+    hash = "sha256-V+A8UP6rXTGxUq8rdk8QN5rs2O6S8WyYWYPOSpn374Y=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
@@ -366,9 +366,9 @@ in
     };
   };
 
-  openssl_3_3 = common {
-    version = "3.3.2";
-    hash = "sha256-LopAsBl5r+i+C7+z3l3BxnCf7bRtbInBDaEUq1/D0oE=";
+  openssl_3_4 = common {
+    version = "3.4.1";
+    hash = "sha256-1LIlJ6ZFrPdrU+REh6jbaHxu7WIdckaJHQJeOLqMllE=";
 
     patches = [
       ./3.0/nix-ssl-cert-file.patch
@@ -379,9 +379,9 @@ in
 
       (
         if stdenv.hostPlatform.isDarwin then
-          ./3.3/use-etc-ssl-certs-darwin.patch
+          ./3.4/use-etc-ssl-certs-darwin.patch
         else
-          ./3.3/use-etc-ssl-certs.patch
+          ./3.4/use-etc-ssl-certs.patch
       )
     ];
 
diff --git a/pkgs/development/libraries/qgnomeplatform/default.nix b/pkgs/development/libraries/qgnomeplatform/default.nix
index 187236621730..270a6593c740 100644
--- a/pkgs/development/libraries/qgnomeplatform/default.nix
+++ b/pkgs/development/libraries/qgnomeplatform/default.nix
@@ -11,7 +11,7 @@
   gtk3,
   qtbase,
   qtwayland,
-  substituteAll,
+  replaceVars,
   gsettings-desktop-schemas,
   useQt6 ? false,
 }:
@@ -29,8 +29,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # Hardcode GSettings schema path to avoid crashes from missing schemas
-    (substituteAll {
-      src = ./hardcode-gsettings.patch;
+    (replaceVars ./hardcode-gsettings.patch {
       gds_gsettings_path = glib.getSchemaPath gsettings-desktop-schemas;
     })
 
diff --git a/pkgs/development/libraries/qt-5/modules/qttools.nix b/pkgs/development/libraries/qt-5/modules/qttools.nix
index 52be15d64e8a..e4b95207fe92 100644
--- a/pkgs/development/libraries/qt-5/modules/qttools.nix
+++ b/pkgs/development/libraries/qt-5/modules/qttools.nix
@@ -4,7 +4,7 @@
   lib,
   qtbase,
   qtdeclarative,
-  substituteAll,
+  replaceVars,
   llvmPackages,
 }:
 
@@ -29,13 +29,11 @@ qtModule {
 
   patches = [
     # fixQtBuiltinPaths overwrites builtin paths we should keep
-    (substituteAll {
-      src = ./qttools-QT_HOST_DATA-refs.patch;
+    (replaceVars ./qttools-QT_HOST_DATA-refs.patch {
       qtbaseDev = lib.getDev qtbase;
     })
 
-    (substituteAll {
-      src = ./qttools-libclang-main-header.patch;
+    (replaceVars ./qttools-libclang-main-header.patch {
       libclangDev = lib.getDev llvmPackages.libclang;
     })
   ];
diff --git a/pkgs/development/libraries/quictls/default.nix b/pkgs/development/libraries/quictls/default.nix
index 63ddc6313d6a..a36d230fcbbc 100644
--- a/pkgs/development/libraries/quictls/default.nix
+++ b/pkgs/development/libraries/quictls/default.nix
@@ -32,8 +32,8 @@ stdenv.mkDerivation rec {
     ../openssl/3.0/openssl-disable-kernel-detection.patch
 
     (if stdenv.hostPlatform.isDarwin
-    then ../openssl/3.3/use-etc-ssl-certs-darwin.patch
-    else ../openssl/3.3/use-etc-ssl-certs.patch)
+    then ../openssl/3.4/use-etc-ssl-certs-darwin.patch
+    else ../openssl/3.4/use-etc-ssl-certs.patch)
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/science/math/or-tools/default.nix b/pkgs/development/libraries/science/math/or-tools/default.nix
index c460694da0fe..3c3fac71a1e4 100644
--- a/pkgs/development/libraries/science/math/or-tools/default.nix
+++ b/pkgs/development/libraries/science/math/or-tools/default.nix
@@ -7,7 +7,7 @@
   eigen,
   ensureNewerSourcesForZipFilesHook,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   glpk,
   lib,
   pkg-config,
@@ -40,8 +40,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./offline.patch;
+    (replaceVars ./offline.patch {
       pybind11_protobuf = "../../pybind11_protobuf";
     })
   ];
diff --git a/pkgs/development/libraries/wayqt/default.nix b/pkgs/development/libraries/wayqt/default.nix
index 86fa6cd20325..3bed9f6fc7bb 100644
--- a/pkgs/development/libraries/wayqt/default.nix
+++ b/pkgs/development/libraries/wayqt/default.nix
@@ -2,7 +2,7 @@
   stdenv,
   lib,
   fetchFromGitLab,
-  substituteAll,
+  replaceVars,
   meson,
   pkg-config,
   qttools,
@@ -25,8 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     # qmake get qtbase's path, but wayqt need qtwayland
-    (substituteAll {
-      src = ./fix-qtwayland-header-path.diff;
+    (replaceVars ./fix-qtwayland-header-path.diff {
       qtWaylandPath = "${qtwayland}/include";
     })
   ];
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 1469dd6d6429..e1609e6f2ed3 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -65,7 +65,7 @@
   libbacktrace,
   systemd,
   xdg-dbus-proxy,
-  substituteAll,
+  replaceVars,
   glib,
   unifdef,
   addDriverRunpath,
@@ -103,8 +103,7 @@ clangStdenv.mkDerivation (finalAttrs: {
   };
 
   patches = lib.optionals clangStdenv.hostPlatform.isLinux [
-    (substituteAll {
-      src = ./fix-bubblewrap-paths.patch;
+    (replaceVars ./fix-bubblewrap-paths.patch {
       inherit (builtins) storeDir;
       inherit (addDriverRunpath) driverLink;
     })
diff --git a/pkgs/development/lisp-modules/nix-cl.nix b/pkgs/development/lisp-modules/nix-cl.nix
index 773372d25afa..1357dafe3df3 100644
--- a/pkgs/development/lisp-modules/nix-cl.nix
+++ b/pkgs/development/lisp-modules/nix-cl.nix
@@ -59,7 +59,7 @@ let
     ;
 
   inherit (pkgs)
-    substituteAll
+    replaceVars
     ;
 
   # Stolen from python-packages.nix
@@ -209,8 +209,7 @@ let
               ;
           };
 
-          buildScript = substituteAll {
-            src = ./builder.lisp;
+          buildScript = replaceVars ./builder.lisp {
             asdf = "${asdfFasl}/asdf.${faslExt}";
           };
 
diff --git a/pkgs/development/lua-modules/nfd/default.nix b/pkgs/development/lua-modules/nfd/default.nix
index 1b34c1bd1803..a9b7aaef9e77 100644
--- a/pkgs/development/lua-modules/nfd/default.nix
+++ b/pkgs/development/lua-modules/nfd/default.nix
@@ -5,7 +5,7 @@
   lua,
   pkg-config,
   lib,
-  substituteAll,
+  replaceVars,
   zenity,
   AppKit,
 }:
@@ -24,8 +24,7 @@ buildLuarocksPackage {
 
   # use zenity because default gtk impl just crashes
   patches = [
-    (substituteAll {
-      src = ./zenity.patch;
+    (replaceVars ./zenity.patch {
       inherit zenity;
     })
   ];
diff --git a/pkgs/development/ocaml-modules/carton/default.nix b/pkgs/development/ocaml-modules/carton/default.nix
index b1f35bea8fa5..ea9eb4f06462 100644
--- a/pkgs/development/ocaml-modules/carton/default.nix
+++ b/pkgs/development/ocaml-modules/carton/default.nix
@@ -27,7 +27,7 @@
   cmdliner,
   hxd,
   getconf,
-  substituteAll,
+  replaceVars,
 }:
 
 buildDunePackage rec {
@@ -42,8 +42,7 @@ buildDunePackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./carton-find-getconf.patch;
+    (replaceVars ./carton-find-getconf.patch {
       getconf = "${getconf}";
     })
   ];
diff --git a/pkgs/development/ocaml-modules/menhir/default.nix b/pkgs/development/ocaml-modules/menhir/default.nix
index ae0f15843b30..c465e0fc6d32 100644
--- a/pkgs/development/ocaml-modules/menhir/default.nix
+++ b/pkgs/development/ocaml-modules/menhir/default.nix
@@ -1,6 +1,6 @@
 {
   buildDunePackage,
-  substituteAll,
+  replaceVars,
   ocaml,
   menhirLib,
   menhirSdk,
@@ -19,8 +19,7 @@ buildDunePackage rec {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./menhir-suggest-menhirLib.patch;
+    (replaceVars ./menhir-suggest-menhirLib.patch {
       libdir = "${menhirLib}/lib/ocaml/${ocaml.version}/site-lib/menhirLib";
     })
   ];
diff --git a/pkgs/development/ocaml-modules/plotkicadsch/default.nix b/pkgs/development/ocaml-modules/plotkicadsch/default.nix
index 69f67ae580a6..3497dd0771a3 100644
--- a/pkgs/development/ocaml-modules/plotkicadsch/default.nix
+++ b/pkgs/development/ocaml-modules/plotkicadsch/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildDunePackage,
-  substituteAll,
+  replaceVars,
   base64,
   cmdliner,
   digestif,
@@ -24,8 +24,7 @@ buildDunePackage rec {
   minimalOCamlVersion = "4.09";
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       inherit coreutils imagemagick;
     })
   ];
diff --git a/pkgs/development/php-packages/couchbase/default.nix b/pkgs/development/php-packages/couchbase/default.nix
index 381ec3734243..fb98e4846d83 100644
--- a/pkgs/development/php-packages/couchbase/default.nix
+++ b/pkgs/development/php-packages/couchbase/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   libcouchbase,
   zlib,
-  substituteAll,
+  replaceVars,
   php,
 }:
 let
@@ -29,8 +29,7 @@ buildPecl {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./libcouchbase.patch;
+    (replaceVars ./libcouchbase.patch {
       inherit libcouchbase;
     })
   ];
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index bf6a0326ff4e..028cceefc363 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   fetchpatch2,
-  substituteAll,
+  replaceVars,
   isPy310,
   isPyPy,
 
@@ -57,8 +57,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./unvendor-llhttp.patch;
+    (replaceVars ./unvendor-llhttp.patch {
       llhttpDev = lib.getDev llhttp;
       llhttpLib = lib.getLib llhttp;
     })
diff --git a/pkgs/development/python-modules/anytree/default.nix b/pkgs/development/python-modules/anytree/default.nix
index 55f1b8d9ac13..9483bf12dadc 100644
--- a/pkgs/development/python-modules/anytree/default.nix
+++ b/pkgs/development/python-modules/anytree/default.nix
@@ -8,7 +8,7 @@
   pytest7CheckHook,
   pythonOlder,
   six,
-  substituteAll,
+  replaceVars,
   withGraphviz ? true,
 }:
 
@@ -27,8 +27,7 @@ buildPythonPackage rec {
   };
 
   patches = lib.optionals withGraphviz [
-    (substituteAll {
-      src = ./graphviz.patch;
+    (replaceVars ./graphviz.patch {
       inherit graphviz;
     })
   ];
diff --git a/pkgs/development/python-modules/attrs/default.nix b/pkgs/development/python-modules/attrs/default.nix
index 5f14d0b149a6..f8824a6fef31 100644
--- a/pkgs/development/python-modules/attrs/default.nix
+++ b/pkgs/development/python-modules/attrs/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  substituteAll,
+  replaceVars,
   hatchling,
 }:
 
@@ -20,9 +20,8 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
+    (replaceVars ./remove-hatch-plugins.patch {
       # hatch-vcs and hatch-fancy-pypi-readme depend on pytest, which depends on attrs
-      src = ./remove-hatch-plugins.patch;
       inherit version;
     })
   ];
diff --git a/pkgs/development/python-modules/bash-kernel/default.nix b/pkgs/development/python-modules/bash-kernel/default.nix
index ff088a618e1d..6e546b311d3f 100644
--- a/pkgs/development/python-modules/bash-kernel/default.nix
+++ b/pkgs/development/python-modules/bash-kernel/default.nix
@@ -8,7 +8,7 @@
   python,
   pexpect,
   bashInteractive,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -23,8 +23,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./bash-path.patch;
+    (replaceVars ./bash-path.patch {
       bash = lib.getExe bashInteractive;
     })
   ];
diff --git a/pkgs/development/python-modules/bokeh/default.nix b/pkgs/development/python-modules/bokeh/default.nix
index 9ed21c339dee..9f7ac29dd5ec 100644
--- a/pkgs/development/python-modules/bokeh/default.nix
+++ b/pkgs/development/python-modules/bokeh/default.nix
@@ -4,7 +4,7 @@
   fetchPypi,
   fetchFromGitHub,
   pythonOlder,
-  substituteAll,
+  replaceVars,
   colorama,
   contourpy,
   jinja2,
@@ -64,8 +64,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./hardcode-nodejs-npmjs-paths.patch;
+    (replaceVars ./hardcode-nodejs-npmjs-paths.patch {
       node_bin = "${nodejs}/bin/node";
       npm_bin = "${nodejs}/bin/npm";
     })
diff --git a/pkgs/development/python-modules/cairocffi/default.nix b/pkgs/development/python-modules/cairocffi/default.nix
index b871515bc42a..0779eae1c92d 100644
--- a/pkgs/development/python-modules/cairocffi/default.nix
+++ b/pkgs/development/python-modules/cairocffi/default.nix
@@ -5,7 +5,7 @@
   pythonOlder,
   fetchPypi,
   lib,
-  substituteAll,
+  replaceVars,
   pikepdf,
   pytestCheckHook,
   cairo,
@@ -32,8 +32,7 @@ buildPythonPackage rec {
 
   patches = [
     # OSError: dlopen() failed to load a library: gdk-pixbuf-2.0 / gdk-pixbuf-2.0-0
-    (substituteAll {
-      src = ./dlopen-paths.patch;
+    (replaceVars ./dlopen-paths.patch {
       ext = stdenv.hostPlatform.extensions.sharedLibrary;
       cairo = cairo.out;
       glib = glib.out;
diff --git a/pkgs/development/python-modules/cmdstanpy/default.nix b/pkgs/development/python-modules/cmdstanpy/default.nix
index c03c2cf8403c..439b1c255307 100644
--- a/pkgs/development/python-modules/cmdstanpy/default.nix
+++ b/pkgs/development/python-modules/cmdstanpy/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   cmdstan,
   setuptools,
   pandas,
@@ -27,8 +27,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./use-nix-cmdstan-path.patch;
+    (replaceVars ./use-nix-cmdstan-path.patch {
       cmdstan = "${cmdstan}/opt/cmdstan";
     })
   ];
diff --git a/pkgs/development/python-modules/debugpy/default.nix b/pkgs/development/python-modules/debugpy/default.nix
index d87103d4d0a1..a2b42176966b 100644
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@@ -5,7 +5,7 @@
   pythonOlder,
   pythonAtLeast,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   gdb,
   lldb,
   pytestCheckHook,
@@ -39,8 +39,7 @@ buildPythonPackage rec {
   patches =
     [
       # Use nixpkgs version instead of versioneer
-      (substituteAll {
-        src = ./hardcode-version.patch;
+      (replaceVars ./hardcode-version.patch {
         inherit version;
       })
 
@@ -62,15 +61,13 @@ buildPythonPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       # Hard code GDB path (used to attach to process)
-      (substituteAll {
-        src = ./hardcode-gdb.patch;
+      (replaceVars ./hardcode-gdb.patch {
         inherit gdb;
       })
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # Hard code LLDB path (used to attach to process)
-      (substituteAll {
-        src = ./hardcode-lldb.patch;
+      (replaceVars ./hardcode-lldb.patch {
         inherit lldb;
       })
     ];
diff --git a/pkgs/development/python-modules/deltachat2/default.nix b/pkgs/development/python-modules/deltachat2/default.nix
index a2dcc68076f0..021e4f73fb10 100644
--- a/pkgs/development/python-modules/deltachat2/default.nix
+++ b/pkgs/development/python-modules/deltachat2/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   deltachat-rpc-server,
   setuptools-scm,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -20,8 +20,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./paths.patch;
+    (replaceVars ./paths.patch {
       deltachatrpcserver = lib.getExe deltachat-rpc-server;
     })
   ];
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index b4d478e3d8bd..d8520e33e97c 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -3,7 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchPypi,
-  substituteAll,
+  replaceVars,
   geos_3_9,
   gdal,
   asgiref,
@@ -28,17 +28,17 @@ buildPythonPackage rec {
 
   patches =
     [
-      (substituteAll {
-        src = ./django_3_set_zoneinfo_dir.patch;
+      (replaceVars ./django_3_set_zoneinfo_dir.patch {
         zoneinfo = tzdata + "/share/zoneinfo";
       })
     ]
-    ++ lib.optional withGdal (substituteAll {
-      src = ./django_3_set_geos_gdal_lib.patch;
-      inherit geos_3_9;
-      inherit gdal;
-      extension = stdenv.hostPlatform.extensions.sharedLibrary;
-    });
+    ++ lib.optional withGdal (
+      replaceVars ./django_3_set_geos_gdal_lib.patch {
+        inherit geos_3_9;
+        inherit gdal;
+        extension = stdenv.hostPlatform.extensions.sharedLibrary;
+      }
+    );
 
   propagatedBuildInputs = [
     asgiref
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index e7deafc63271..b5183c00d9dd 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -6,7 +6,7 @@
   fetchpatch,
   pythonAtLeast,
   pythonOlder,
-  substituteAll,
+  replaceVars,
 
   # build
   setuptools,
@@ -59,8 +59,7 @@ buildPythonPackage rec {
 
   patches =
     [
-      (substituteAll {
-        src = ./django_4_set_zoneinfo_dir.patch;
+      (replaceVars ./django_4_set_zoneinfo_dir.patch {
         zoneinfo = tzdata + "/share/zoneinfo";
       })
       # make sure the tests don't remove packages from our pythonpath
@@ -75,8 +74,7 @@ buildPythonPackage rec {
       })
     ]
     ++ lib.optionals withGdal [
-      (substituteAll {
-        src = ./django_4_set_geos_gdal_lib.patch;
+      (replaceVars ./django_4_set_geos_gdal_lib.patch {
         geos = geos;
         gdal = gdal;
         extension = stdenv.hostPlatform.extensions.sharedLibrary;
diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index 0a46ca3e1e7e..d04533cbf4a0 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -5,7 +5,7 @@
   fetchFromGitHub,
   fetchpatch,
   pythonOlder,
-  substituteAll,
+  replaceVars,
 
   # build-system
   setuptools,
@@ -58,8 +58,7 @@ buildPythonPackage rec {
 
   patches =
     [
-      (substituteAll {
-        src = ./django_5_set_zoneinfo_dir.patch;
+      (replaceVars ./django_5_set_zoneinfo_dir.patch {
         zoneinfo = tzdata + "/share/zoneinfo";
       })
       # prevent tests from messing with our pythonpath
@@ -75,8 +74,7 @@ buildPythonPackage rec {
       })
     ]
     ++ lib.optionals withGdal [
-      (substituteAll {
-        src = ./django_5_set_geos_gdal_lib.patch;
+      (replaceVars ./django_5_set_geos_gdal_lib.patch {
         geos = geos;
         gdal = gdal;
         extension = stdenv.hostPlatform.extensions.sharedLibrary;
diff --git a/pkgs/development/python-modules/dot2tex/default.nix b/pkgs/development/python-modules/dot2tex/default.nix
index acd9bbc34a1f..fc593d8a5871 100644
--- a/pkgs/development/python-modules/dot2tex/default.nix
+++ b/pkgs/development/python-modules/dot2tex/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  substituteAll,
+  replaceVars,
   pyparsing,
   graphviz,
   pytestCheckHook,
@@ -20,8 +20,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./path.patch;
+    (replaceVars ./path.patch {
       inherit graphviz;
     })
     ./test.patch # https://github.com/kjellmf/dot2tex/issues/5
diff --git a/pkgs/development/python-modules/espeak-phonemizer/default.nix b/pkgs/development/python-modules/espeak-phonemizer/default.nix
index 4ecae59fbc58..6b7304a7c895 100644
--- a/pkgs/development/python-modules/espeak-phonemizer/default.nix
+++ b/pkgs/development/python-modules/espeak-phonemizer/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   espeak-ng,
   pytestCheckHook,
 }:
@@ -20,8 +20,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./cdll.patch;
+    (replaceVars ./cdll.patch {
       libespeak_ng = "${lib.getLib espeak-ng}/lib/libespeak-ng.so";
     })
   ];
diff --git a/pkgs/development/python-modules/flit-gettext/default.nix b/pkgs/development/python-modules/flit-gettext/default.nix
index 311861da7f71..cdf3dadf14ed 100644
--- a/pkgs/development/python-modules/flit-gettext/default.nix
+++ b/pkgs/development/python-modules/flit-gettext/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
 
   # build-system
   flit-scm,
@@ -30,8 +30,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./msgfmt-path.patch;
+    (replaceVars ./msgfmt-path.patch {
       msgfmt = lib.getExe' gettext "msgfmt";
     })
   ];
diff --git a/pkgs/development/python-modules/gattlib/default.nix b/pkgs/development/python-modules/gattlib/default.nix
index bb961a993a13..a3f3a0d16e90 100644
--- a/pkgs/development/python-modules/gattlib/default.nix
+++ b/pkgs/development/python-modules/gattlib/default.nix
@@ -3,7 +3,9 @@
   buildPythonPackage,
   fetchFromGitHub,
   fetchpatch,
-  substituteAll,
+  replaceVars,
+
+  # build
   pkg-config,
   glibc,
   python,
@@ -31,8 +33,7 @@ buildPythonPackage rec {
       url = "https://github.com/oscaracena/pygattlib/commit/73a73b71cfc139e1e0a08816fb976ff330c77ea5.patch";
       hash = "sha256-/Y/CZNdN/jcxWroqRfdCH2rPUxZUbug668MIAow0scs=";
     })
-    (substituteAll {
-      src = ./setup.patch;
+    (replaceVars ./setup.patch {
       boost_version =
         let
           pythonVersion = with lib.versions; "${major python.version}${minor python.version}";
diff --git a/pkgs/development/python-modules/git-annex-adapter/default.nix b/pkgs/development/python-modules/git-annex-adapter/default.nix
index cd1dc62261f9..de88fb53556c 100644
--- a/pkgs/development/python-modules/git-annex-adapter/default.nix
+++ b/pkgs/development/python-modules/git-annex-adapter/default.nix
@@ -10,7 +10,7 @@
   pytestCheckHook,
   pythonOlder,
   setuptools,
-  substituteAll,
+  replaceVars,
   util-linux,
 }:
 
@@ -42,8 +42,7 @@ buildPythonPackage rec {
       url = "https://github.com/alpernebbi/git-annex-adapter/commit/d0d8905965a3659ce95cbd8f8b1e8598f0faf76b.patch";
       hash = "sha256-UcRTKzD3sbXGIuxj4JzZDnvjTYyWVkfeWgKiZ1rAlus=";
     })
-    (substituteAll {
-      src = ./git-annex-path.patch;
+    (replaceVars ./git-annex-path.patch {
       gitAnnex = "${git-annex}/bin/git-annex";
     })
   ];
diff --git a/pkgs/development/python-modules/glymur/default.nix b/pkgs/development/python-modules/glymur/default.nix
index d5fdb4fd0242..ebc6d0134203 100644
--- a/pkgs/development/python-modules/glymur/default.nix
+++ b/pkgs/development/python-modules/glymur/default.nix
@@ -13,7 +13,7 @@
   pythonOlder,
   scikit-image,
   setuptools,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -37,8 +37,7 @@ buildPythonPackage rec {
       url = "https://github.com/quintusdias/glymur/commit/89b159299035ebb05776c3b90278f410ca6dba64.patch";
       hash = "sha256-C/Q5WZmW5YtN3U8fxKljfqwKHtFLfR2LQ69Tj8SuIWg=";
     })
-    (substituteAll {
-      src = ./set-lib-paths.patch;
+    (replaceVars ./set-lib-paths.patch {
       openjp2_lib = "${lib.getLib openjpeg}/lib/libopenjp2${stdenv.hostPlatform.extensions.sharedLibrary}";
       tiff_lib = "${lib.getLib libtiff}/lib/libtiff${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
diff --git a/pkgs/development/python-modules/gpuctypes/default.nix b/pkgs/development/python-modules/gpuctypes/default.nix
index f8c8f1111160..9b3bb75434f9 100644
--- a/pkgs/development/python-modules/gpuctypes/default.nix
+++ b/pkgs/development/python-modules/gpuctypes/default.nix
@@ -3,7 +3,7 @@
   config,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   addDriverRunpath,
   cudaSupport ? config.cudaSupport,
   rocmSupport ? config.rocmSupport,
@@ -33,8 +33,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./0001-fix-dlopen-cuda.patch;
+    (replaceVars ./0001-fix-dlopen-cuda.patch {
       inherit (addDriverRunpath) driverLink;
       libnvrtc =
         if cudaSupport then
diff --git a/pkgs/development/python-modules/graphviz/default.nix b/pkgs/development/python-modules/graphviz/default.nix
index 99a78b6d7661..9af39497f215 100644
--- a/pkgs/development/python-modules/graphviz/default.nix
+++ b/pkgs/development/python-modules/graphviz/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   graphviz-nox,
   xdg-utils,
   makeFontsConf,
@@ -32,8 +32,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./paths.patch;
+    (replaceVars ./paths.patch {
       graphviz = graphviz-nox;
       xdgutils = xdg-utils;
     })
diff --git a/pkgs/development/python-modules/hydra-core/default.nix b/pkgs/development/python-modules/hydra-core/default.nix
index 0518e523d3d9..6264ff89d6c7 100644
--- a/pkgs/development/python-modules/hydra-core/default.nix
+++ b/pkgs/development/python-modules/hydra-core/default.nix
@@ -11,7 +11,7 @@
   packaging,
   pytestCheckHook,
   pythonOlder,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -29,8 +29,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./antlr4.patch;
+    (replaceVars ./antlr4.patch {
       antlr_jar = "${antlr4.out}/share/java/antlr-${antlr4.version}-complete.jar";
     })
     # https://github.com/facebookresearch/hydra/pull/2731
diff --git a/pkgs/development/python-modules/imageio-ffmpeg/default.nix b/pkgs/development/python-modules/imageio-ffmpeg/default.nix
index c10d435da7bc..a49ac3e344a0 100644
--- a/pkgs/development/python-modules/imageio-ffmpeg/default.nix
+++ b/pkgs/development/python-modules/imageio-ffmpeg/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   ffmpeg,
 
   # build-system
@@ -27,8 +27,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./ffmpeg-path.patch;
+    (replaceVars ./ffmpeg-path.patch {
       ffmpeg = lib.getExe ffmpeg;
     })
   ];
diff --git a/pkgs/development/python-modules/imageio/default.nix b/pkgs/development/python-modules/imageio/default.nix
index d19c5579e25a..b0ec295e10a7 100644
--- a/pkgs/development/python-modules/imageio/default.nix
+++ b/pkgs/development/python-modules/imageio/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   isPyPy,
-  substituteAll,
+  replaceVars,
 
   # build-system
   setuptools,
@@ -42,8 +42,7 @@ buildPythonPackage rec {
   };
 
   patches = lib.optionals (!stdenv.hostPlatform.isDarwin) [
-    (substituteAll {
-      src = ./libgl-path.patch;
+    (replaceVars ./libgl-path.patch {
       libgl = "${libGL.out}/lib/libGL${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
   ];
diff --git a/pkgs/development/python-modules/img2pdf/default.nix b/pkgs/development/python-modules/img2pdf/default.nix
index 4e49d01ad8b6..913e8a913acc 100644
--- a/pkgs/development/python-modules/img2pdf/default.nix
+++ b/pkgs/development/python-modules/img2pdf/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   isPy27,
   fetchFromGitea,
-  substituteAll,
+  replaceVars,
   fetchpatch,
   colord,
   setuptools,
@@ -38,8 +38,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./default-icc-profile.patch;
+    (replaceVars ./default-icc-profile.patch {
       srgbProfile =
         if stdenv.hostPlatform.isDarwin then
           "/System/Library/ColorSync/Profiles/sRGB Profile.icc"
diff --git a/pkgs/development/python-modules/iniconfig/default.nix b/pkgs/development/python-modules/iniconfig/default.nix
index fcf045c94411..206faab7ae1d 100644
--- a/pkgs/development/python-modules/iniconfig/default.nix
+++ b/pkgs/development/python-modules/iniconfig/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  substituteAll,
+  replaceVars,
   fetchPypi,
   hatchling,
 }:
@@ -20,8 +20,7 @@ buildPythonPackage rec {
 
   patches = [
     # Cannot use hatch-vcs, due to an inifinite recursion
-    (substituteAll {
-      src = ./version.patch;
+    (replaceVars ./version.patch {
       inherit version;
     })
   ];
diff --git a/pkgs/development/python-modules/isal/default.nix b/pkgs/development/python-modules/isal/default.nix
index 0594330edaf8..2626fe2e4ef5 100644
--- a/pkgs/development/python-modules/isal/default.nix
+++ b/pkgs/development/python-modules/isal/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
 
   # build-system
   setuptools,
@@ -29,8 +29,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./version.patch;
+    (replaceVars ./version.patch {
       inherit version;
     })
   ];
diff --git a/pkgs/development/python-modules/k5test/default.nix b/pkgs/development/python-modules/k5test/default.nix
index 208f24c2b2bf..f1bfd4097c78 100644
--- a/pkgs/development/python-modules/k5test/default.nix
+++ b/pkgs/development/python-modules/k5test/default.nix
@@ -6,7 +6,7 @@
   krb5-c,
   pythonOlder,
   setuptools,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -22,8 +22,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       inherit findutils;
       krb5 = krb5-c;
       # krb5-config is in dev output
diff --git a/pkgs/development/python-modules/kaldi-active-grammar/default.nix b/pkgs/development/python-modules/kaldi-active-grammar/default.nix
index 14795b0c1268..c26bbabb60c7 100644
--- a/pkgs/development/python-modules/kaldi-active-grammar/default.nix
+++ b/pkgs/development/python-modules/kaldi-active-grammar/default.nix
@@ -10,7 +10,7 @@
   numpy,
   cffi,
   openfst,
-  substituteAll,
+  replaceVars,
   callPackage,
 }:
 
@@ -43,8 +43,7 @@ buildPythonPackage rec {
     # Uses the dependencies' binaries from $PATH instead of a specific directory
     ./0002-exec-path.patch
     # Makes it dynamically link to the correct Kaldi library
-    (substituteAll {
-      src = ./0003-ffi-path.patch;
+    (replaceVars ./0003-ffi-path.patch {
       kaldiFork = "${kaldi}/lib";
     })
   ];
diff --git a/pkgs/development/python-modules/kornia-rs/default.nix b/pkgs/development/python-modules/kornia-rs/default.nix
index b5311998abf9..e4b7bbd2a17e 100644
--- a/pkgs/development/python-modules/kornia-rs/default.nix
+++ b/pkgs/development/python-modules/kornia-rs/default.nix
@@ -6,7 +6,7 @@
   rustPlatform,
   cmake,
   nasm,
-  substituteAll,
+  replaceVars,
   libiconv,
 }:
 
@@ -36,8 +36,7 @@ buildPythonPackage rec {
 
   # The path dependency doesn't vendor the dependencies correctly, so get kornia-rs from crates instead.
   patches = [
-    (substituteAll {
-      src = ./kornia-rs-from-crates.patch;
+    (replaceVars ./kornia-rs-from-crates.patch {
       inherit version;
     })
   ];
diff --git a/pkgs/development/python-modules/libevdev/default.nix b/pkgs/development/python-modules/libevdev/default.nix
index e7be644cdd5a..1d511b3afae5 100644
--- a/pkgs/development/python-modules/libevdev/default.nix
+++ b/pkgs/development/python-modules/libevdev/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   isPy27,
   fetchPypi,
-  substituteAll,
+  replaceVars,
   pkgs,
   pytestCheckHook,
 }:
@@ -20,8 +20,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       libevdev = lib.getLib pkgs.libevdev;
     })
   ];
diff --git a/pkgs/development/python-modules/libusb1/default.nix b/pkgs/development/python-modules/libusb1/default.nix
index 34f6c1b7636f..18a9603b0625 100644
--- a/pkgs/development/python-modules/libusb1/default.nix
+++ b/pkgs/development/python-modules/libusb1/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   setuptools,
   libusb1,
   pytestCheckHook,
@@ -22,8 +22,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./ctypes.patch;
+    (replaceVars ./ctypes.patch {
       libusb = "${lib.getLib libusb1}/lib/libusb-1.0${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
   ];
diff --git a/pkgs/development/python-modules/mido/default.nix b/pkgs/development/python-modules/mido/default.nix
index 34227c595d3f..0a4547b1fd1f 100644
--- a/pkgs/development/python-modules/mido/default.nix
+++ b/pkgs/development/python-modules/mido/default.nix
@@ -3,7 +3,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  substituteAll,
+  replaceVars,
 
   # build-system
   setuptools,
@@ -39,8 +39,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./libportmidi-cdll.patch;
+    (replaceVars ./libportmidi-cdll.patch {
       libportmidi = "${portmidi.out}/lib/libportmidi${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
   ];
diff --git a/pkgs/development/python-modules/mss/default.nix b/pkgs/development/python-modules/mss/default.nix
index f7b5a590b1ba..d7585caecb68 100644
--- a/pkgs/development/python-modules/mss/default.nix
+++ b/pkgs/development/python-modules/mss/default.nix
@@ -4,7 +4,7 @@
   fetchPypi,
   pythonOlder,
   stdenv,
-  substituteAll,
+  replaceVars,
 
   # build-system
   hatchling,
@@ -34,8 +34,7 @@ buildPythonPackage rec {
   };
 
   patches = lib.optionals stdenv.hostPlatform.isLinux [
-    (substituteAll {
-      src = ./linux-paths.patch;
+    (replaceVars ./linux-paths.patch {
       x11 = "${xorg.libX11}/lib/libX11.so";
       xfixes = "${xorg.libXfixes}/lib/libXfixes.so";
       xrandr = "${xorg.libXrandr}/lib/libXrandr.so";
diff --git a/pkgs/development/python-modules/netmap/default.nix b/pkgs/development/python-modules/netmap/default.nix
index c863ae189dcb..81d326f50e41 100644
--- a/pkgs/development/python-modules/netmap/default.nix
+++ b/pkgs/development/python-modules/netmap/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   nmap,
   python,
 }:
@@ -20,8 +20,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./nmap-path.patch;
+    (replaceVars ./nmap-path.patch {
       nmap = "${lib.getBin nmap}/bin/nmap";
     })
   ];
diff --git a/pkgs/development/python-modules/nextcord/default.nix b/pkgs/development/python-modules/nextcord/default.nix
index 10aff1066fbc..c5e023027877 100644
--- a/pkgs/development/python-modules/nextcord/default.nix
+++ b/pkgs/development/python-modules/nextcord/default.nix
@@ -5,7 +5,7 @@
   pythonAtLeast,
   pythonOlder,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   ffmpeg,
   libopus,
   aiohttp,
@@ -34,8 +34,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./paths.patch;
+    (replaceVars ./paths.patch {
       ffmpeg = "${ffmpeg}/bin/ffmpeg";
       libopus = "${libopus}/lib/libopus${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
diff --git a/pkgs/development/python-modules/nocturne/default.nix b/pkgs/development/python-modules/nocturne/default.nix
index 0934e6fd2535..2d105972419e 100644
--- a/pkgs/development/python-modules/nocturne/default.nix
+++ b/pkgs/development/python-modules/nocturne/default.nix
@@ -9,7 +9,7 @@
   pybind11,
   pyvirtualdisplay,
   sfml,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -32,8 +32,7 @@ buildPythonPackage rec {
   '';
 
   patches = [
-    (substituteAll {
-      src = ./dependencies.patch;
+    (replaceVars ./dependencies.patch {
       gtest_src = gtest.src;
     })
   ];
diff --git a/pkgs/development/python-modules/notify-py/default.nix b/pkgs/development/python-modules/notify-py/default.nix
index 45893825139b..16f48f3725e7 100644
--- a/pkgs/development/python-modules/notify-py/default.nix
+++ b/pkgs/development/python-modules/notify-py/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   alsa-utils,
   libnotify,
   which,
@@ -33,16 +33,14 @@ buildPythonPackage rec {
   patches =
     lib.optionals stdenv.hostPlatform.isLinux [
       # hardcode paths to aplay and notify-send
-      (substituteAll {
-        src = ./linux-paths.patch;
+      (replaceVars ./linux-paths.patch {
         aplay = "${alsa-utils}/bin/aplay";
         notifysend = "${libnotify}/bin/notify-send";
       })
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # hardcode path to which
-      (substituteAll {
-        src = ./darwin-paths.patch;
+      (replaceVars ./darwin-paths.patch {
         which = "${which}/bin/which";
       })
     ];
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index fa72fbab6021..16df1272c82b 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -11,7 +11,7 @@
   numpy_1,
   llvmlite,
   libcxx,
-  substituteAll,
+  replaceVars,
   writers,
   numba,
   pytestCheckHook,
@@ -96,8 +96,7 @@ buildPythonPackage rec {
   ];
 
   patches = lib.optionals cudaSupport [
-    (substituteAll {
-      src = ./cuda_path.patch;
+    (replaceVars ./cuda_path.patch {
       cuda_toolkit_path = cudatoolkit;
       cuda_toolkit_lib_path = lib.getLib cudatoolkit;
     })
diff --git a/pkgs/development/python-modules/nvidia-ml-py/default.nix b/pkgs/development/python-modules/nvidia-ml-py/default.nix
index f5b4ea48a75d..e48b8b7d43e2 100644
--- a/pkgs/development/python-modules/nvidia-ml-py/default.nix
+++ b/pkgs/development/python-modules/nvidia-ml-py/default.nix
@@ -2,7 +2,7 @@
   lib,
   fetchPypi,
   buildPythonPackage,
-  substituteAll,
+  replaceVars,
   addDriverRunpath,
   setuptools,
   cudaPackages,
@@ -22,8 +22,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./0001-locate-libnvidia-ml.so.1-on-NixOS.patch;
+    (replaceVars ./0001-locate-libnvidia-ml.so.1-on-NixOS.patch {
       inherit (addDriverRunpath) driverLink;
     })
   ];
diff --git a/pkgs/development/python-modules/objgraph/default.nix b/pkgs/development/python-modules/objgraph/default.nix
index de84c59b59b8..9f4cf86fa761 100644
--- a/pkgs/development/python-modules/objgraph/default.nix
+++ b/pkgs/development/python-modules/objgraph/default.nix
@@ -7,7 +7,7 @@
   isPyPy,
   python,
   pythonOlder,
-  substituteAll,
+  replaceVars,
   setuptools,
 }:
 
@@ -24,8 +24,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./hardcode-graphviz-path.patch;
+    (replaceVars ./hardcode-graphviz-path.patch {
       graphviz = graphvizPkgs;
     })
   ];
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 5d75f8a829fc..dc87c6f4edfe 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -21,7 +21,7 @@
   pythonOlder,
   rich,
   reportlab,
-  substituteAll,
+  replaceVars,
   tesseract,
   unpaper,
   installShellFiles,
@@ -50,8 +50,7 @@ buildPythonPackage rec {
 
   patches = [
     ./use-pillow-heif.patch
-    (substituteAll {
-      src = ./paths.patch;
+    (replaceVars ./paths.patch {
       gs = lib.getExe ghostscript_headless;
       jbig2 = lib.getExe jbig2enc;
       pngquant = lib.getExe pngquant;
diff --git a/pkgs/development/python-modules/omegaconf/default.nix b/pkgs/development/python-modules/omegaconf/default.nix
index e0f551cbc4a6..0c9e7ab833fe 100644
--- a/pkgs/development/python-modules/omegaconf/default.nix
+++ b/pkgs/development/python-modules/omegaconf/default.nix
@@ -13,7 +13,7 @@
   pythonAtLeast,
   pythonOlder,
   pyyaml,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -31,8 +31,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./antlr4.patch;
+    (replaceVars ./antlr4.patch {
       antlr_jar = "${antlr4.out}/share/java/antlr-${antlr4.version}-complete.jar";
     })
 
diff --git a/pkgs/development/python-modules/openai-whisper/default.nix b/pkgs/development/python-modules/openai-whisper/default.nix
index 4c0327558971..634f8677be2c 100644
--- a/pkgs/development/python-modules/openai-whisper/default.nix
+++ b/pkgs/development/python-modules/openai-whisper/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   buildPythonPackage,
-  substituteAll,
+  replaceVars,
 
   # build-system
   setuptools,
@@ -38,8 +38,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./ffmpeg-path.patch;
+    (replaceVars ./ffmpeg-path.patch {
       ffmpeg = ffmpeg-headless;
     })
   ];
diff --git a/pkgs/development/python-modules/opuslib/default.nix b/pkgs/development/python-modules/opuslib/default.nix
index 4f7c86d2a481..b645a2d1b1d0 100644
--- a/pkgs/development/python-modules/opuslib/default.nix
+++ b/pkgs/development/python-modules/opuslib/default.nix
@@ -7,7 +7,7 @@
   pytestCheckHook,
   lib,
   stdenv,
-  substituteAll,
+  replaceVars,
   setuptools,
 }:
 
@@ -38,8 +38,7 @@ buildPythonPackage rec {
       url = "https://github.com/orion-labs/opuslib/commit/87a214fc98c1dcae38035e99fe8e279a160c4a52.patch";
       hash = "sha256-UoOafyTFvWLY7ErtBhkXTZSgbMZFrg5DGxjbhqEI7wo=";
     })
-    (substituteAll {
-      src = ./opuslib-paths.patch;
+    (replaceVars ./opuslib-paths.patch {
       opusLibPath = "${libopus}/lib/libopus${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
   ];
diff --git a/pkgs/development/python-modules/ots-python/default.nix b/pkgs/development/python-modules/ots-python/default.nix
index 9c0ae3625c21..ca91bfeaacee 100644
--- a/pkgs/development/python-modules/ots-python/default.nix
+++ b/pkgs/development/python-modules/ots-python/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  substituteAll,
+  replaceVars,
   opentype-sanitizer,
   setuptools-scm,
   pytestCheckHook,
@@ -23,8 +23,7 @@ buildPythonPackage rec {
     # Invoke ots-sanitize from the opentype-sanitizer package instead of
     # downloading precompiled binaries from the internet.
     # (nixpkgs-specific, not upstreamable)
-    (substituteAll {
-      src = ./0001-use-packaged-ots.patch;
+    (replaceVars ./0001-use-packaged-ots.patch {
       ots_sanitize = "${opentype-sanitizer}/bin/ots-sanitize";
     })
   ];
diff --git a/pkgs/development/python-modules/pdfminer-six/default.nix b/pkgs/development/python-modules/pdfminer-six/default.nix
index be653431e2a5..0fd59cbd4aec 100644
--- a/pkgs/development/python-modules/pdfminer-six/default.nix
+++ b/pkgs/development/python-modules/pdfminer-six/default.nix
@@ -8,7 +8,7 @@
   pythonOlder,
   pytestCheckHook,
   setuptools,
-  substituteAll,
+  replaceVars,
   ocrmypdf,
 }:
 
@@ -34,8 +34,7 @@ buildPythonPackage rec {
       excludes = [ "CHANGELOG.md" ];
       hash = "sha256-fsSXvN92MVtNFpAst0ctvGrbxVvoe4Nyz4wMZqJ1aw8=";
     })
-    (substituteAll {
-      src = ./disable-setuptools-git-versioning.patch;
+    (replaceVars ./disable-setuptools-git-versioning.patch {
       inherit version;
     })
   ];
diff --git a/pkgs/development/python-modules/phonemizer/default.nix b/pkgs/development/python-modules/phonemizer/default.nix
index 561088b606d8..9b4a69a67876 100644
--- a/pkgs/development/python-modules/phonemizer/default.nix
+++ b/pkgs/development/python-modules/phonemizer/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  substituteAll,
+  replaceVars,
   buildPythonPackage,
   fetchPypi,
   joblib,
@@ -27,8 +27,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./backend-paths.patch;
+    (replaceVars ./backend-paths.patch {
       libespeak = "${lib.getLib espeak-ng}/lib/libespeak-ng${stdenv.hostPlatform.extensions.sharedLibrary}";
       # FIXME package festival
     })
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index da0ebb79b504..f05ed913e313 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -20,7 +20,7 @@
   python-xmp-toolkit,
   qpdf,
   setuptools,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -42,8 +42,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./paths.patch;
+    (replaceVars ./paths.patch {
       jbig2dec = lib.getExe' jbig2dec "jbig2dec";
       mutool = lib.getExe' mupdf-headless "mutool";
     })
diff --git a/pkgs/development/python-modules/protobuf/4.nix b/pkgs/development/python-modules/protobuf/4.nix
index c4db1b86e164..48af41c206ec 100644
--- a/pkgs/development/python-modules/protobuf/4.nix
+++ b/pkgs/development/python-modules/protobuf/4.nix
@@ -9,7 +9,7 @@
   protobuf,
   pytestCheckHook,
   pythonAtLeast,
-  substituteAll,
+  replaceVars,
   tzdata,
 }:
 
@@ -31,8 +31,7 @@ buildPythonPackage {
   patches =
     lib.optionals (lib.versionAtLeast protobuf.version "22") [
       # Replace the vendored abseil-cpp with nixpkgs'
-      (substituteAll {
-        src = ./use-nixpkgs-abseil-cpp.patch;
+      (replaceVars ./use-nixpkgs-abseil-cpp.patch {
         abseil_cpp_include_path = "${lib.getDev protobuf.abseil-cpp}/include";
       })
     ]
diff --git a/pkgs/development/python-modules/proton-client/default.nix b/pkgs/development/python-modules/proton-client/default.nix
index 4e178ce26c92..b7a4db2ae9b0 100644
--- a/pkgs/development/python-modules/proton-client/default.nix
+++ b/pkgs/development/python-modules/proton-client/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  substituteAll,
+  replaceVars,
   bcrypt,
   pyopenssl,
   python-gnupg,
@@ -37,8 +37,7 @@ buildPythonPackage rec {
 
   patches = [
     # Patches library by fixing the openssl path
-    (substituteAll {
-      src = ./0001-OpenSSL-path-fix.patch;
+    (replaceVars ./0001-OpenSSL-path-fix.patch {
       openssl = openssl.out;
       ext = stdenv.hostPlatform.extensions.sharedLibrary;
     })
diff --git a/pkgs/development/python-modules/protonvpn-nm-lib/default.nix b/pkgs/development/python-modules/protonvpn-nm-lib/default.nix
index ff647a2582bd..2b679015e6bd 100644
--- a/pkgs/development/python-modules/protonvpn-nm-lib/default.nix
+++ b/pkgs/development/python-modules/protonvpn-nm-lib/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  substituteAll,
+  replaceVars,
   dbus-python,
   distro,
   jinja2,
@@ -48,8 +48,7 @@ buildPythonPackage rec {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./0001-Patching-GIRepository.patch;
+    (replaceVars ./0001-Patching-GIRepository.patch {
       networkmanager_path = "${networkmanager}/lib/girepository-1.0";
     })
   ];
diff --git a/pkgs/development/python-modules/pulsectl/default.nix b/pkgs/development/python-modules/pulsectl/default.nix
index 485acd9f7880..a4340c4a7fc8 100644
--- a/pkgs/development/python-modules/pulsectl/default.nix
+++ b/pkgs/development/python-modules/pulsectl/default.nix
@@ -4,7 +4,7 @@
   fetchPypi,
   libpulseaudio,
   glibc,
-  substituteAll,
+  replaceVars,
   stdenv,
   pulseaudio,
   unittestCheckHook,
@@ -22,8 +22,7 @@ buildPythonPackage rec {
 
   patches = [
     # substitute library paths for libpulse and librt
-    (substituteAll {
-      src = ./library-paths.patch;
+    (replaceVars ./library-paths.patch {
       libpulse = "${libpulseaudio.out}/lib/libpulse${stdenv.hostPlatform.extensions.sharedLibrary}";
       librt = "${glibc.out}/lib/librt${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
diff --git a/pkgs/development/python-modules/pydot/default.nix b/pkgs/development/python-modules/pydot/default.nix
index a8756cab87a1..bdbabe92c715 100644
--- a/pkgs/development/python-modules/pydot/default.nix
+++ b/pkgs/development/python-modules/pydot/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   setuptools,
-  substituteAll,
+  replaceVars,
   graphviz,
   pytestCheckHook,
   chardet,
@@ -37,8 +37,7 @@ buildPythonPackage rec {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./hardcode-graphviz-path.patch;
+    (replaceVars ./hardcode-graphviz-path.patch {
       inherit graphviz;
     })
   ];
diff --git a/pkgs/development/python-modules/pygame-ce/default.nix b/pkgs/development/python-modules/pygame-ce/default.nix
index 470ece383353..cd288f7184f9 100644
--- a/pkgs/development/python-modules/pygame-ce/default.nix
+++ b/pkgs/development/python-modules/pygame-ce/default.nix
@@ -1,7 +1,7 @@
 {
   stdenv,
   lib,
-  substituteAll,
+  replaceVars,
   fetchFromGitHub,
   buildPythonPackage,
   pythonOlder,
@@ -45,8 +45,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-dependency-finding.patch;
+    (replaceVars ./fix-dependency-finding.patch {
       buildinputs_include = builtins.toJSON (
         builtins.concatMap (dep: [
           "${lib.getDev dep}/"
diff --git a/pkgs/development/python-modules/pygame/default.nix b/pkgs/development/python-modules/pygame/default.nix
index f4da6a9f001c..c5c6ac9175eb 100644
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   fontconfig,
   python,
 
@@ -44,8 +44,7 @@ buildPythonPackage rec {
 
   patches = [
     # Patch pygame's dependency resolution to let it find build inputs
-    (substituteAll {
-      src = ./fix-dependency-finding.patch;
+    (replaceVars ./fix-dependency-finding.patch {
       buildinputs_include = builtins.toJSON (
         builtins.concatMap (dep: [
           "${lib.getDev dep}/"
diff --git a/pkgs/development/python-modules/pygraphviz/default.nix b/pkgs/development/python-modules/pygraphviz/default.nix
index f6cf8b1a1595..f0a218a7883c 100644
--- a/pkgs/development/python-modules/pygraphviz/default.nix
+++ b/pkgs/development/python-modules/pygraphviz/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   graphviz,
   coreutils,
   pkg-config,
@@ -27,8 +27,7 @@ buildPythonPackage rec {
 
   patches = [
     # pygraphviz depends on graphviz executables and wc being in PATH
-    (substituteAll {
-      src = ./path.patch;
+    (replaceVars ./path.patch {
       path = lib.makeBinPath [
         graphviz
         coreutils
diff --git a/pkgs/development/python-modules/pylama/default.nix b/pkgs/development/python-modules/pylama/default.nix
index 112d9392d80d..39b5657819ad 100644
--- a/pkgs/development/python-modules/pylama/default.nix
+++ b/pkgs/development/python-modules/pylama/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   git,
   eradicate,
   mccabe,
@@ -32,8 +32,7 @@ let
     };
 
     patches = [
-      (substituteAll {
-        src = ./paths.patch;
+      (replaceVars ./paths.patch {
         git = "${lib.getBin git}/bin/git";
       })
     ];
diff --git a/pkgs/development/python-modules/pylddwrap/default.nix b/pkgs/development/python-modules/pylddwrap/default.nix
index b24700cee2c8..cb68291f27e6 100644
--- a/pkgs/development/python-modules/pylddwrap/default.nix
+++ b/pkgs/development/python-modules/pylddwrap/default.nix
@@ -6,7 +6,7 @@
   icontract,
   pytestCheckHook,
   pythonOlder,
-  substituteAll,
+  replaceVars,
   typing-extensions,
 }:
 
@@ -24,8 +24,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./replace_env_with_placeholder.patch;
+    (replaceVars ./replace_env_with_placeholder.patch {
       ldd_bin = "${stdenv.cc.bintools.libc_bin}/bin/ldd";
     })
   ];
diff --git a/pkgs/development/python-modules/pyocr/default.nix b/pkgs/development/python-modules/pyocr/default.nix
index 7df733b680a0..8305e308918e 100644
--- a/pkgs/development/python-modules/pyocr/default.nix
+++ b/pkgs/development/python-modules/pyocr/default.nix
@@ -7,7 +7,7 @@
   tesseract,
   cuneiform,
   isPy3k,
-  substituteAll,
+  replaceVars,
   pytestCheckHook,
   setuptools,
   setuptools-scm,
@@ -33,15 +33,17 @@ buildPythonPackage rec {
 
   patches =
     [ ]
-    ++ (lib.optional withTesseractSupport (substituteAll {
-      src = ./paths-tesseract.patch;
-      inherit tesseract;
-      tesseractLibraryLocation = "${tesseract}/lib/libtesseract${stdenv.hostPlatform.extensions.sharedLibrary}";
-    }))
-    ++ (lib.optional stdenv.hostPlatform.isLinux (substituteAll {
-      src = ./paths-cuneiform.patch;
-      inherit cuneiform;
-    }));
+    ++ (lib.optional withTesseractSupport (
+      replaceVars ./paths-tesseract.patch {
+        inherit tesseract;
+        tesseractLibraryLocation = "${tesseract}/lib/libtesseract${stdenv.hostPlatform.extensions.sharedLibrary}";
+      }
+    ))
+    ++ (lib.optional stdenv.hostPlatform.isLinux (
+      replaceVars ./paths-cuneiform.patch {
+        inherit cuneiform;
+      }
+    ));
 
   propagatedBuildInputs = [ pillow ];
 
diff --git a/pkgs/development/python-modules/pyogg/default.nix b/pkgs/development/python-modules/pyogg/default.nix
index 03d51fef67fa..220777cd3609 100644
--- a/pkgs/development/python-modules/pyogg/default.nix
+++ b/pkgs/development/python-modules/pyogg/default.nix
@@ -8,7 +8,7 @@
   libogg,
   libopus,
   opusfile,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -45,8 +45,7 @@ buildPythonPackage rec {
     "--binary"
   ];
   patches = [
-    (substituteAll {
-      src = ./pyogg-paths.patch;
+    (replaceVars ./pyogg-paths.patch {
       flacLibPath = "${flac.out}/lib/libFLAC${stdenv.hostPlatform.extensions.sharedLibrary}";
       oggLibPath = "${libogg}/lib/libogg${stdenv.hostPlatform.extensions.sharedLibrary}";
       vorbisLibPath = "${libvorbis}/lib/libvorbis${stdenv.hostPlatform.extensions.sharedLibrary}";
diff --git a/pkgs/development/python-modules/pypandoc/default.nix b/pkgs/development/python-modules/pypandoc/default.nix
index 0aad26e59cb6..102750113157 100644
--- a/pkgs/development/python-modules/pypandoc/default.nix
+++ b/pkgs/development/python-modules/pypandoc/default.nix
@@ -6,7 +6,7 @@
   pandocfilters,
   poetry-core,
   pythonOlder,
-  substituteAll,
+  replaceVars,
   texliveSmall,
 }:
 
@@ -25,8 +25,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./static-pandoc-path.patch;
+    (replaceVars ./static-pandoc-path.patch {
       pandoc = "${lib.getBin pandoc}/bin/pandoc";
       pandocVersion = pandoc.version;
     })
diff --git a/pkgs/development/python-modules/pyproj/default.nix b/pkgs/development/python-modules/pyproj/default.nix
index d419fbb76949..77f863139ed5 100644
--- a/pkgs/development/python-modules/pyproj/default.nix
+++ b/pkgs/development/python-modules/pyproj/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   pytestCheckHook,
   pythonOlder,
-  substituteAll,
+  replaceVars,
 
   certifi,
   cython,
@@ -31,8 +31,7 @@ buildPythonPackage rec {
 
   # force pyproj to use ${proj}
   patches = [
-    (substituteAll {
-      src = ./001.proj.patch;
+    (replaceVars ./001.proj.patch {
       proj = proj;
       projdev = proj.dev;
     })
diff --git a/pkgs/development/python-modules/pysaml2/default.nix b/pkgs/development/python-modules/pysaml2/default.nix
index 8fb26fb9f5f2..dca55176f162 100644
--- a/pkgs/development/python-modules/pysaml2/default.nix
+++ b/pkgs/development/python-modules/pysaml2/default.nix
@@ -17,7 +17,7 @@
   requests,
   responses,
   setuptools,
-  substituteAll,
+  replaceVars,
   xmlschema,
   xmlsec,
   zope-interface,
@@ -38,8 +38,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./hardcode-xmlsec1-path.patch;
+    (replaceVars ./hardcode-xmlsec1-path.patch {
       inherit xmlsec;
     })
   ];
diff --git a/pkgs/development/python-modules/pytesseract/default.nix b/pkgs/development/python-modules/pytesseract/default.nix
index e64c3e28a2b6..502bb3dd2465 100644
--- a/pkgs/development/python-modules/pytesseract/default.nix
+++ b/pkgs/development/python-modules/pytesseract/default.nix
@@ -5,7 +5,7 @@
   packaging,
   pillow,
   tesseract,
-  substituteAll,
+  replaceVars,
   pytestCheckHook,
   setuptools,
 }:
@@ -23,8 +23,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./tesseract-binary.patch;
+    (replaceVars ./tesseract-binary.patch {
       drv = tesseract;
     })
   ];
diff --git a/pkgs/development/python-modules/python-magic/default.nix b/pkgs/development/python-modules/python-magic/default.nix
index 942f4562d9db..c84659014b71 100644
--- a/pkgs/development/python-modules/python-magic/default.nix
+++ b/pkgs/development/python-modules/python-magic/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   fetchpatch,
-  substituteAll,
+  replaceVars,
   file,
   pytestCheckHook,
 }:
@@ -22,8 +22,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./libmagic-path.patch;
+    (replaceVars ./libmagic-path.patch {
       libmagic = "${file}/lib/libmagic${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
     (fetchpatch {
diff --git a/pkgs/development/python-modules/python-mapnik/default.nix b/pkgs/development/python-modules/python-mapnik/default.nix
index 6e0b93a60907..2ce7bff0593d 100644
--- a/pkgs/development/python-modules/python-mapnik/default.nix
+++ b/pkgs/development/python-modules/python-mapnik/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   isPyPy,
   python,
   setuptools,
@@ -43,8 +43,7 @@ buildPythonPackage rec {
   patches = [
     # python-mapnik seems to depend on having the mapnik src directory
     # structure available at build time. We just hardcode the paths.
-    (substituteAll {
-      src = ./find-libmapnik.patch;
+    (replaceVars ./find-libmapnik.patch {
       libmapnik = "${mapnik}/lib";
     })
     # Use `std::optional` rather than `boost::optional`
diff --git a/pkgs/development/python-modules/python-matter-server/default.nix b/pkgs/development/python-modules/python-matter-server/default.nix
index 9f860cdf7b54..90563f8b101f 100644
--- a/pkgs/development/python-modules/python-matter-server/default.nix
+++ b/pkgs/development/python-modules/python-matter-server/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   pythonOlder,
   stdenvNoCC,
-  substituteAll,
+  replaceVars,
 
   # build
   setuptools,
@@ -69,8 +69,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./link-paa-root-certs.patch;
+    (replaceVars ./link-paa-root-certs.patch {
       paacerts = paaCerts;
     })
   ];
diff --git a/pkgs/development/python-modules/python-rapidjson/default.nix b/pkgs/development/python-modules/python-rapidjson/default.nix
index 32153ca9f8c3..2c686ca2d8d4 100644
--- a/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/pkgs/development/python-modules/python-rapidjson/default.nix
@@ -7,7 +7,7 @@
   pytestCheckHook,
   pytz,
   setuptools,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -25,8 +25,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./rapidjson-include-dir.patch;
+    (replaceVars ./rapidjson-include-dir.patch {
       rapidjson = lib.getDev rapidjson;
     })
   ];
diff --git a/pkgs/development/python-modules/python3-gnutls/default.nix b/pkgs/development/python-modules/python3-gnutls/default.nix
index 60bf464cb510..88958200c0ec 100644
--- a/pkgs/development/python-modules/python3-gnutls/default.nix
+++ b/pkgs/development/python-modules/python3-gnutls/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   buildPythonPackage,
   isPy3k,
   gnutls,
@@ -34,8 +34,7 @@ buildPythonPackage rec {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./libgnutls-path.patch;
+    (replaceVars ./libgnutls-path.patch {
       gnutlslib = "${lib.getLib gnutls}/lib";
     })
   ];
diff --git a/pkgs/development/python-modules/pythran/default.nix b/pkgs/development/python-modules/pythran/default.nix
index c8873f5d3eed..9f041f3374cf 100644
--- a/pkgs/development/python-modules/pythran/default.nix
+++ b/pkgs/development/python-modules/pythran/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   fetchpatch2,
-  substituteAll,
+  replaceVars,
 
   # build-system
   setuptools,
@@ -37,8 +37,7 @@ buildPythonPackage rec {
 
   patches = [
     # Hardcode path to mp library
-    (substituteAll {
-      src = ./0001-hardcode-path-to-libgomp.patch;
+    (replaceVars ./0001-hardcode-path-to-libgomp.patch {
       gomp = "${
         if stdenv.cc.isClang then openmp else (lib.getLib stdenv.cc.cc)
       }/lib/libgomp${stdenv.hostPlatform.extensions.sharedLibrary}";
diff --git a/pkgs/development/python-modules/pyturbojpeg/default.nix b/pkgs/development/python-modules/pyturbojpeg/default.nix
index d91e446e5d7a..735f0a928c81 100644
--- a/pkgs/development/python-modules/pyturbojpeg/default.nix
+++ b/pkgs/development/python-modules/pyturbojpeg/default.nix
@@ -7,7 +7,7 @@
   setuptools,
   numpy,
   python,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -23,8 +23,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./lib-path.patch;
+    (replaceVars ./lib-path.patch {
       libturbojpeg = "${lib.getLib libjpeg_turbo}/lib/libturbojpeg${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
   ];
diff --git a/pkgs/development/python-modules/pyvirtualdisplay/default.nix b/pkgs/development/python-modules/pyvirtualdisplay/default.nix
index ac2a3bf68f69..dca19a30340c 100644
--- a/pkgs/development/python-modules/pyvirtualdisplay/default.nix
+++ b/pkgs/development/python-modules/pyvirtualdisplay/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchPypi,
-  substituteAll,
+  replaceVars,
   xorg,
 
   # build-system
@@ -32,8 +32,7 @@ buildPythonPackage rec {
   };
 
   patches = lib.optionals stdenv.hostPlatform.isLinux [
-    (substituteAll {
-      src = ./paths.patch;
+    (replaceVars ./paths.patch {
       xauth = lib.getExe xorg.xauth;
       xdpyinfo = lib.getExe xorg.xdpyinfo;
     })
diff --git a/pkgs/development/python-modules/slixmpp/default.nix b/pkgs/development/python-modules/slixmpp/default.nix
index 02070116ebda..0d1cb77e17c2 100644
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@@ -8,7 +8,7 @@
   pyasn1,
   pyasn1-modules,
   pytestCheckHook,
-  substituteAll,
+  replaceVars,
   pythonOlder,
 }:
 
@@ -34,8 +34,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [ pytestCheckHook ];
 
   patches = [
-    (substituteAll {
-      src = ./hardcode-gnupg-path.patch;
+    (replaceVars ./hardcode-gnupg-path.patch {
       inherit gnupg;
     })
   ];
diff --git a/pkgs/development/python-modules/sounddevice/default.nix b/pkgs/development/python-modules/sounddevice/default.nix
index f90e2f7a3064..8784657600b9 100644
--- a/pkgs/development/python-modules/sounddevice/default.nix
+++ b/pkgs/development/python-modules/sounddevice/default.nix
@@ -8,7 +8,7 @@
   cffi,
   numpy,
   portaudio,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -38,8 +38,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "sounddevice" ];
 
   patches = [
-    (substituteAll {
-      src = ./fix-portaudio-library-path.patch;
+    (replaceVars ./fix-portaudio-library-path.patch {
       portaudio = "${portaudio}/lib/libportaudio${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
   ];
diff --git a/pkgs/development/python-modules/streamdeck/default.nix b/pkgs/development/python-modules/streamdeck/default.nix
index e921659e2284..2d4009c57c7e 100644
--- a/pkgs/development/python-modules/streamdeck/default.nix
+++ b/pkgs/development/python-modules/streamdeck/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchPypi,
-  substituteAll,
+  replaceVars,
   pkgs,
 }:
 
@@ -19,8 +19,7 @@ buildPythonPackage rec {
 
   patches = [
     # substitute libusb path
-    (substituteAll {
-      src = ./hardcode-libusb.patch;
+    (replaceVars ./hardcode-libusb.patch {
       libusb = "${pkgs.hidapi}/lib/libhidapi-libusb${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
   ];
diff --git a/pkgs/development/python-modules/termplotlib/default.nix b/pkgs/development/python-modules/termplotlib/default.nix
index c4112b3e1629..d690ad1aa5a9 100644
--- a/pkgs/development/python-modules/termplotlib/default.nix
+++ b/pkgs/development/python-modules/termplotlib/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  substituteAll,
+  replaceVars,
   buildPythonPackage,
   fetchFromGitHub,
   pytestCheckHook,
@@ -33,8 +33,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ numpy ];
 
   patches = [
-    (substituteAll {
-      src = ./gnuplot-subprocess.patch;
+    (replaceVars ./gnuplot-subprocess.patch {
       gnuplot = "${gnuplot.out}/bin/gnuplot";
     })
   ];
diff --git a/pkgs/development/python-modules/tinygrad/default.nix b/pkgs/development/python-modules/tinygrad/default.nix
index b7826c8c01f2..e979b7991281 100644
--- a/pkgs/development/python-modules/tinygrad/default.nix
+++ b/pkgs/development/python-modules/tinygrad/default.nix
@@ -3,7 +3,7 @@
   config,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   addDriverRunpath,
   cudaSupport ? config.cudaSupport,
   rocmSupport ? config.rocmSupport,
@@ -56,8 +56,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-dlopen-cuda.patch;
+    (replaceVars ./fix-dlopen-cuda.patch {
       inherit (addDriverRunpath) driverLink;
       libnvrtc =
         if cudaSupport then
diff --git a/pkgs/development/python-modules/tpm2-pytss/default.nix b/pkgs/development/python-modules/tpm2-pytss/default.nix
index 7ca0bb688a41..807f51dabe42 100644
--- a/pkgs/development/python-modules/tpm2-pytss/default.nix
+++ b/pkgs/development/python-modules/tpm2-pytss/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  substituteAll,
+  replaceVars,
   buildPythonPackage,
   fetchPypi,
   fetchpatch,
@@ -53,8 +53,7 @@ buildPythonPackage rec {
       # when cross-compiling is turned on.
       # This patch changes the call to pycparser.preprocess_file to provide the name
       # of the cross-compiling cpp
-      (substituteAll {
-        src = ./cross.patch;
+      (replaceVars ./cross.patch {
         crossPrefix = stdenv.hostPlatform.config;
       })
     ];
diff --git a/pkgs/development/python-modules/vispy/default.nix b/pkgs/development/python-modules/vispy/default.nix
index eb3b16c0a3ea..875c06b5fe71 100644
--- a/pkgs/development/python-modules/vispy/default.nix
+++ b/pkgs/development/python-modules/vispy/default.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   buildPythonPackage,
-  substituteAll,
+  replaceVars,
   fetchPypi,
   cython,
   fontconfig,
@@ -32,8 +32,7 @@ buildPythonPackage rec {
   };
 
   patches = lib.optionals (!stdenv.hostPlatform.isDarwin) [
-    (substituteAll {
-      src = ./library-paths.patch;
+    (replaceVars ./library-paths.patch {
       fontconfig = "${fontconfig.lib}/lib/libfontconfig${stdenv.hostPlatform.extensions.sharedLibrary}";
       gl = "${libGL.out}/lib/libGL${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
diff --git a/pkgs/development/python-modules/wallet-py3k/default.nix b/pkgs/development/python-modules/wallet-py3k/default.nix
index fb50398d5be4..1237dafc3396 100644
--- a/pkgs/development/python-modules/wallet-py3k/default.nix
+++ b/pkgs/development/python-modules/wallet-py3k/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  substituteAll,
+  replaceVars,
   openssl,
   setuptools,
   six,
@@ -19,8 +19,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./openssl-path.patch;
+    (replaceVars ./openssl-path.patch {
       openssl = lib.getExe openssl;
     })
   ];
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index 9636de89d64a..d724cc4afd6b 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -13,7 +13,7 @@
 
   ## wandb
   buildPythonPackage,
-  substituteAll,
+  replaceVars,
 
   # build-system
   hatchling,
@@ -150,8 +150,7 @@ buildPythonPackage rec {
 
   patches = [
     # Replace git paths
-    (substituteAll {
-      src = ./hardcode-git-path.patch;
+    (replaceVars ./hardcode-git-path.patch {
       git = lib.getExe git;
     })
   ];
diff --git a/pkgs/development/python-modules/wavefile/default.nix b/pkgs/development/python-modules/wavefile/default.nix
index 9711e2684038..c36b099f26d0 100644
--- a/pkgs/development/python-modules/wavefile/default.nix
+++ b/pkgs/development/python-modules/wavefile/default.nix
@@ -7,7 +7,7 @@
   pyaudio,
   numpy,
   libsndfile,
-  substituteAll,
+  replaceVars,
 }:
 
 buildPythonPackage rec {
@@ -40,8 +40,7 @@ buildPythonPackage rec {
   patches = [
     # Fix check error
     # OSError: libsndfile.so.1: cannot open shared object file: No such file or directory
-    (substituteAll {
-      src = ./libsndfile.py.patch;
+    (replaceVars ./libsndfile.py.patch {
       libsndfile = "${lib.getLib libsndfile}/lib/libsndfile${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
   ];
diff --git a/pkgs/development/python-modules/weasyprint/default.nix b/pkgs/development/python-modules/weasyprint/default.nix
index e50d4f3d921a..d9deb72e8266 100644
--- a/pkgs/development/python-modules/weasyprint/default.nix
+++ b/pkgs/development/python-modules/weasyprint/default.nix
@@ -18,7 +18,7 @@
   pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
-  substituteAll,
+  replaceVars,
   tinycss2,
   tinyhtml5,
 }:
@@ -37,13 +37,11 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./library-paths.patch;
+    (replaceVars ./library-paths.patch {
       fontconfig = "${fontconfig.lib}/lib/libfontconfig${stdenv.hostPlatform.extensions.sharedLibrary}";
       pangoft2 = "${pango.out}/lib/libpangoft2-1.0${stdenv.hostPlatform.extensions.sharedLibrary}";
       gobject = "${glib.out}/lib/libgobject-2.0${stdenv.hostPlatform.extensions.sharedLibrary}";
       pango = "${pango.out}/lib/libpango-1.0${stdenv.hostPlatform.extensions.sharedLibrary}";
-      pangocairo = "${pango.out}/lib/libpangocairo-1.0${stdenv.hostPlatform.extensions.sharedLibrary}";
       harfbuzz = "${harfbuzz.out}/lib/libharfbuzz${stdenv.hostPlatform.extensions.sharedLibrary}";
       harfbuzz_subset = "${harfbuzz.out}/lib/libharfbuzz-subset${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
diff --git a/pkgs/development/python-modules/wxpython/4.2.nix b/pkgs/development/python-modules/wxpython/4.2.nix
index 8fd324dff01f..6a5d3debaf40 100644
--- a/pkgs/development/python-modules/wxpython/4.2.nix
+++ b/pkgs/development/python-modules/wxpython/4.2.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   setuptools,
   fetchPypi,
-  substituteAll,
+  replaceVars,
 
   # build
   autoPatchelfHook,
@@ -52,8 +52,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./4.2-ctypes.patch;
+    (replaceVars ./4.2-ctypes.patch {
       libgdk = "${gtk3.out}/lib/libgdk-3.so";
       libpangocairo = "${pango}/lib/libpangocairo-1.0.so";
       libcairo = "${cairo}/lib/libcairo.so";
diff --git a/pkgs/development/python-modules/xsdata/default.nix b/pkgs/development/python-modules/xsdata/default.nix
index 97d0d64a3b4b..3d4f21b9d1cd 100644
--- a/pkgs/development/python-modules/xsdata/default.nix
+++ b/pkgs/development/python-modules/xsdata/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   ruff,
   click,
   click-default-group,
@@ -32,8 +32,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./paths.patch;
+    (replaceVars ./paths.patch {
       ruff = lib.getExe ruff;
     })
   ];
diff --git a/pkgs/development/python-modules/youseedee/default.nix b/pkgs/development/python-modules/youseedee/default.nix
index e35be6b56568..6117e329d62a 100644
--- a/pkgs/development/python-modules/youseedee/default.nix
+++ b/pkgs/development/python-modules/youseedee/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  substituteAll,
+  replaceVars,
   setuptools,
   setuptools-scm,
   filelock,
@@ -23,8 +23,7 @@ buildPythonPackage rec {
   patches = [
     # Load data files from the unicode-character-database package instead of
     # downloading them from the internet. (nixpkgs-specific, not upstreamable)
-    (substituteAll {
-      src = ./0001-use-packaged-unicode-data.patch;
+    (replaceVars ./0001-use-packaged-unicode-data.patch {
       ucd_dir = "${unicode-character-database}/share/unicode";
     })
   ];
diff --git a/pkgs/development/python-modules/yq/default.nix b/pkgs/development/python-modules/yq/default.nix
index dfc1ae08903e..a0e3a27ac169 100644
--- a/pkgs/development/python-modules/yq/default.nix
+++ b/pkgs/development/python-modules/yq/default.nix
@@ -7,7 +7,7 @@
   pytestCheckHook,
   pyyaml,
   setuptools-scm,
-  substituteAll,
+  replaceVars,
   tomlkit,
   xmltodict,
 }:
@@ -23,8 +23,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./jq-path.patch;
+    (replaceVars ./jq-path.patch {
       jq = "${lib.getBin jq}/bin/jq";
     })
   ];
diff --git a/pkgs/development/python-modules/zlib-ng/default.nix b/pkgs/development/python-modules/zlib-ng/default.nix
index 77b3743c0137..15380edc65fa 100644
--- a/pkgs/development/python-modules/zlib-ng/default.nix
+++ b/pkgs/development/python-modules/zlib-ng/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
 
   # build-system
   cmake,
@@ -29,8 +29,7 @@ buildPythonPackage rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./version.patch;
+    (replaceVars ./version.patch {
       inherit version;
     })
   ];
diff --git a/pkgs/development/rocm-modules/5/rocprofiler/default.nix b/pkgs/development/rocm-modules/5/rocprofiler/default.nix
index 10397e8b9e7a..2948a7c03686 100644
--- a/pkgs/development/rocm-modules/5/rocprofiler/default.nix
+++ b/pkgs/development/rocm-modules/5/rocprofiler/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   rocmUpdateScript,
   symlinkJoin,
-  substituteAll,
+  replaceVars,
   cmake,
   clang,
   clr,
@@ -62,8 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./0000-dont-install-tests-hsaco.patch
 
     # Fix bad paths
-    (substituteAll {
-      src = ./0001-fix-shell-scripts.patch;
+    (replaceVars ./0001-fix-shell-scripts.patch {
       rocmtoolkit_merged = rocmtoolkit-merged;
     })
   ];
diff --git a/pkgs/development/rocm-modules/6/rocprofiler/default.nix b/pkgs/development/rocm-modules/6/rocprofiler/default.nix
index c3a0bf7112a6..a80c6e90f132 100644
--- a/pkgs/development/rocm-modules/6/rocprofiler/default.nix
+++ b/pkgs/development/rocm-modules/6/rocprofiler/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   rocmUpdateScript,
   symlinkJoin,
-  substituteAll,
+  replaceVars,
   cmake,
   clang,
   clr,
@@ -62,8 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./0000-dont-install-tests-hsaco.patch
 
     # Fix bad paths
-    (substituteAll {
-      src = ./0001-fix-shell-scripts.patch;
+    (replaceVars ./0001-fix-shell-scripts.patch {
       rocmtoolkit_merged = rocmtoolkit-merged;
     })
 
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect/package.nix b/pkgs/development/tcl-modules/by-name/ex/expect/package.nix
index ae1c8ae21cc1..f2d0c6d4bf63 100644
--- a/pkgs/development/tcl-modules/by-name/ex/expect/package.nix
+++ b/pkgs/development/tcl-modules/by-name/ex/expect/package.nix
@@ -7,7 +7,7 @@
   makeWrapper,
   autoreconfHook,
   fetchpatch,
-  substituteAll,
+  replaceVars,
 }:
 
 tcl.mkTclDerivation rec {
@@ -20,8 +20,7 @@ tcl.mkTclDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-build-time-run-tcl.patch;
+    (replaceVars ./fix-build-time-run-tcl.patch {
       tcl = "${buildPackages.tcl}/bin/tclsh";
     })
     # The following patches fix compilation with clang 15+
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
index 5fd35f3cb914..79c6726806ea 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_5/default.nix
@@ -38,7 +38,7 @@
   # Also, don't clean up environment variables (so that NIX_ environment variables are passed to compilers).
   enableNixHacks ? false,
   file,
-  substituteAll,
+  replaceVars,
   writeTextFile,
 }:
 
@@ -203,8 +203,7 @@ stdenv.mkDerivation rec {
     # This patch removes using the -fobjc-arc compiler option and makes the code
     # compile without automatic reference counting. Caveat: this leaks memory, but
     # we accept this fact because xcode_locator is only a short-lived process used during the build.
-    (substituteAll {
-      src = ./no-arc.patch;
+    (replaceVars ./no-arc.patch {
       multiBinPatch = if stdenv.hostPlatform.system == "aarch64-darwin" then "arm64" else "x86_64";
     })
 
@@ -214,20 +213,17 @@ stdenv.mkDerivation rec {
     # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
     # So we are replacing this bazel paths by defaultShellPath,
     # improving hermeticity and making it work in nixos.
-    (substituteAll {
-      src = ../strict_action_env.patch;
+    (replaceVars ../strict_action_env.patch {
       strictActionEnvPatch = defaultShellPath;
     })
 
-    (substituteAll {
-      src = ./actions_path.patch;
+    (replaceVars ./actions_path.patch {
       actionsPathPatch = defaultShellPath;
     })
 
     # bazel reads its system bazelrc in /etc
     # override this path to a builtin one
-    (substituteAll {
-      src = ../bazel_rc.patch;
+    (replaceVars ../bazel_rc.patch {
       bazelSystemBazelRCPath = bazelRC;
     })
 
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
index 7d339dec2c96..e941d53395c0 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
@@ -16,7 +16,7 @@
 # Also, don't clean up environment variables (so that NIX_ environment variables are passed to compilers).
 , enableNixHacks ? false
 , file
-, substituteAll
+, replaceVars
 , writeTextFile
 , writeShellApplication
 , makeBinaryWrapper
@@ -239,8 +239,7 @@ stdenv.mkDerivation rec {
     # This patch removes using the -fobjc-arc compiler option and makes the code
     # compile without automatic reference counting. Caveat: this leaks memory, but
     # we accept this fact because xcode_locator is only a short-lived process used during the build.
-    (substituteAll {
-      src = ./no-arc.patch;
+    (replaceVars ./no-arc.patch {
       multiBinPatch = if stdenv.hostPlatform.system == "aarch64-darwin" then "arm64" else "x86_64";
     })
 
@@ -250,20 +249,17 @@ stdenv.mkDerivation rec {
     # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
     # So we are replacing this bazel paths by defaultShellPath,
     # improving hermeticity and making it work in nixos.
-    (substituteAll {
-      src = ../strict_action_env.patch;
+    (replaceVars ../strict_action_env.patch {
       strictActionEnvPatch = defaultShellPath;
     })
 
-    (substituteAll {
-      src = ./actions_path.patch;
+    (replaceVars ./actions_path.patch {
       actionsPathPatch = defaultShellPath;
     })
 
     # bazel reads its system bazelrc in /etc
     # override this path to a builtin one
-    (substituteAll {
-      src = ../bazel_rc.patch;
+    (replaceVars ../bazel_rc.patch {
       bazelSystemBazelRCPath = bazelRC;
     })
   ] ++ lib.optional enableNixHacks ./nix-hacks.patch;
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index cd9acfcfc723..11da64513cbf 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -5,7 +5,7 @@
   fetchurl,
   makeWrapper,
   writeTextFile,
-  substituteAll,
+  replaceVars,
   writeShellApplication,
   makeBinaryWrapper,
   autoPatchelfHook,
@@ -377,15 +377,13 @@ stdenv.mkDerivation rec {
       # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
       # So we are replacing this bazel paths by defaultShellPath,
       # improving hermeticity and making it work in nixos.
-      (substituteAll {
-        src = ../strict_action_env.patch;
+      (replaceVars ../strict_action_env.patch {
         strictActionEnvPatch = defaultShellPath;
       })
 
       # bazel reads its system bazelrc in /etc
       # override this path to a builtin one
-      (substituteAll {
-        src = ../bazel_rc.patch;
+      (replaceVars ../bazel_rc.patch {
         bazelSystemBazelRCPath = bazelRC;
       })
     ]
diff --git a/pkgs/development/tools/ocaml/merlin/4.x.nix b/pkgs/development/tools/ocaml/merlin/4.x.nix
index 2a230cd8039e..660fe6671625 100644
--- a/pkgs/development/tools/ocaml/merlin/4.x.nix
+++ b/pkgs/development/tools/ocaml/merlin/4.x.nix
@@ -64,7 +64,6 @@ buildDunePackage {
     in
     [
       (replaceVars (if old-patch then ./fix-paths.patch else ./fix-paths2.patch) {
-
         dot-merlin-reader = "${dot-merlin-reader}/bin/dot-merlin-reader";
         dune = "${dune_3}/bin/dune";
       })
diff --git a/pkgs/development/tools/ocaml/merlin/default.nix b/pkgs/development/tools/ocaml/merlin/default.nix
index 12aaeac1fddd..858520d5b891 100644
--- a/pkgs/development/tools/ocaml/merlin/default.nix
+++ b/pkgs/development/tools/ocaml/merlin/default.nix
@@ -3,7 +3,7 @@
   fetchurl,
   fetchpatch,
   buildDunePackage,
-  substituteAll,
+  replaceVars,
   dot-merlin-reader,
   dune_2,
   yojson,
@@ -24,9 +24,8 @@ buildDunePackage rec {
   minimalOCamlVersion = "4.02.3";
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      dot_merlin_reader = "${dot-merlin-reader}/bin/dot-merlin-reader";
+    (replaceVars ./fix-paths.patch {
+      dot-merlin-reader = "${dot-merlin-reader}/bin/dot-merlin-reader";
       dune = "${dune_2}/bin/dune";
     })
     # https://github.com/ocaml/merlin/pull/1798
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index 78a842c395ad..5c0c3f3d7279 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -8,8 +8,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.13.1";
-  sha256 = "cfce282119390f7e0c2220410924428e90dadcb2df1744c0c4a0e7baae387cc2";
+  version = "22.14.0";
+  sha256 = "c609946bf793b55c7954c26582760808d54c16185d79cb2fb88065e52de21914";
   patches = [
     ./configure-emulator.patch
     ./configure-armv6-vfpv2.patch
@@ -18,22 +18,5 @@ buildNodejs {
     ./node-npm-build-npm-package-logic.patch
     ./use-correct-env-in-tests.patch
     ./bin-sh-node-run-v22.patch
-
-    # FIXME: remove after a minor point release
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/49acdc8748fe9fe83bc1b444e24c456dff00ecc5.patch?full_index=1";
-      hash = "sha256-iK7bj4KswTeQ9I3jJ22ZPTsvCU8xeGGXEOo43dxg3Mk=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/d0ff34f4b690ad49c86b6df8fd424f39d183e1a6.patch?full_index=1";
-      hash = "sha256-ezcCrg7UwK091pqYxXJn4ay9smQwsrYeMO/NBE7VaM8=";
-    })
-    # test-icu-env is failing on ICU 74.2
-    # FIXME: remove once https://github.com/nodejs/node/pull/56661 is included in a next release
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/a364ec1d1cbbd5a6d20ee54d4f8648dd7592ebcd.patch?full_index=1";
-      hash = "sha256-EL1NgCBzz5O1spwHgocLm5mkORAiqGFst0N6pc3JvFg=";
-      revert = true;
-    })
   ];
 }
diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
index 503dff90cd45..d7c966ef5630 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
@@ -1,4 +1,4 @@
-{ stdenv, dwarf-therapist, dwarf-fortress, substituteAll, coreutils, wrapQtAppsHook
+{ stdenv, dwarf-therapist, dwarf-fortress, replaceVars, coreutils, wrapQtAppsHook
 }:
 
 let
@@ -14,8 +14,7 @@ stdenv.mkDerivation {
   pname = "dwarf-therapist";
   inherit (dwarf-therapist) version meta;
 
-  wrapper = substituteAll {
-    src = ./dwarf-therapist.in;
+  wrapper = replaceVars ./dwarf-therapist.in {
     stdenv_shell = "${stdenv.shell}";
     rm = "${coreutils}/bin/rm";
     ln = "${coreutils}/bin/ln";
@@ -23,6 +22,8 @@ stdenv.mkDerivation {
     mkdir = "${coreutils}/bin/mkdir";
     dirname = "${coreutils}/bin/dirname";
     therapist = "${dwarf-therapist}";
+    # replaced in buildCommand
+    install = null;
   };
 
   paths = [ dwarf-therapist ];
diff --git a/pkgs/games/dwarf-fortress/wrapper/default.nix b/pkgs/games/dwarf-fortress/wrapper/default.nix
index b1a6555f6cb4..55f08c328558 100644
--- a/pkgs/games/dwarf-fortress/wrapper/default.nix
+++ b/pkgs/games/dwarf-fortress/wrapper/default.nix
@@ -2,7 +2,7 @@
   stdenv,
   lib,
   buildEnv,
-  substituteAll,
+  replaceVars,
   makeWrapper,
   runCommand,
   coreutils,
@@ -185,11 +185,8 @@ lib.throwIf (enableTWBT' && !enableDFHack) "dwarf-fortress: TWBT requires DFHack
     pname = "dwarf-fortress";
     version = dwarf-fortress.dfVersion;
 
-    dfInit = substituteAll {
-      name = "dwarf-fortress-init";
-      src = ./dwarf-fortress-init.in;
+    dfInit = replaceVars ./dwarf-fortress-init.in {
       inherit env;
-      inherit (dwarf-fortress) exe;
       stdenv_shell = "${stdenv.shell}";
       cp = "${coreutils}/bin/cp";
       rm = "${coreutils}/bin/rm";
diff --git a/pkgs/kde/plasma/kinfocenter/default.nix b/pkgs/kde/plasma/kinfocenter/default.nix
index 8911e77cf452..ce85b92bfc12 100644
--- a/pkgs/kde/plasma/kinfocenter/default.nix
+++ b/pkgs/kde/plasma/kinfocenter/default.nix
@@ -10,7 +10,7 @@
   pciutils,
   pulseaudio,
   qttools,
-  substituteAll,
+  replaceVars,
   systemsettings,
   util-linux,
   vulkan-tools,
@@ -40,9 +40,10 @@ mkKdeDerivation {
 
   patches = [
     # fwupdmgr is provided through NixOS' module
-    (substituteAll (
+    (replaceVars ./0001-tool-paths.patch (
       {
-        src = ./0001-tool-paths.patch;
+        # @QtBinariesDir@ only appears in the *removed* lines of the diff
+        QtBinariesDir = null;
       }
       // tools
     ))
diff --git a/pkgs/kde/plasma/plasma-workspace/default.nix b/pkgs/kde/plasma/plasma-workspace/default.nix
index 6225f7c3b77c..6aa092b2a757 100644
--- a/pkgs/kde/plasma/plasma-workspace/default.nix
+++ b/pkgs/kde/plasma/plasma-workspace/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   mkKdeDerivation,
-  substituteAll,
+  replaceVars,
   dbus,
   fontconfig,
   xorg,
@@ -22,8 +22,7 @@ mkKdeDerivation {
   pname = "plasma-workspace";
 
   patches = [
-    (substituteAll {
-      src = ./dependency-paths.patch;
+    (replaceVars ./dependency-paths.patch {
       dbusSend = lib.getExe' dbus "dbus-send";
       fcMatch = lib.getExe' fontconfig "fc-match";
       lsof = lib.getExe lsof;
@@ -31,6 +30,8 @@ mkKdeDerivation {
       xmessage = lib.getExe xorg.xmessage;
       xrdb = lib.getExe xorg.xrdb;
       xsetroot = lib.getExe xorg.xsetroot;
+      # @QtBinariesDir@ only appears in the *removed* lines of the diff
+      QtBinariesDir = null;
     })
   ];
 
diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix
index 9672e7761542..c3eac48f118f 100644
--- a/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/pkgs/os-specific/linux/udisks/2-default.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   pkg-config,
   gnused,
   autoreconfHook,
@@ -55,20 +55,15 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "devdoc";
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      bash = "${bash}/bin/bash";
+    (replaceVars ./fix-paths.patch {
       false = "${coreutils}/bin/false";
       mdadm = "${mdadm}/bin/mdadm";
-      mkswap = "${util-linux}/bin/mkswap";
       sed = "${gnused}/bin/sed";
       sh = "${bash}/bin/sh";
       sleep = "${coreutils}/bin/sleep";
-      swapon = "${util-linux}/bin/swapon";
       true = "${coreutils}/bin/true";
     })
-    (substituteAll {
-      src = ./force-path.patch;
+    (replaceVars ./force-path.patch {
       path = lib.makeBinPath [
         btrfs-progs
         coreutils
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index ba8028397562..31a3ff97d0a4 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -5,7 +5,7 @@
   fetchFromGitHub,
   fetchPypi,
   python313,
-  substituteAll,
+  replaceVars,
   ffmpeg-headless,
   inetutils,
   nixosTests,
@@ -440,8 +440,7 @@ python.pkgs.buildPythonApplication rec {
     ./patches/static-follow-symlinks.patch
 
     # Patch path to ffmpeg binary
-    (substituteAll {
-      src = ./patches/ffmpeg-path.patch;
+    (replaceVars ./patches/ffmpeg-path.patch {
       ffmpeg = "${lib.getExe ffmpeg-headless}";
     })
   ];
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 83a61ee2529d..ec00bd98bf0d 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1123,11 +1123,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libX11 = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libpthreadstubs, libxcb, xtrans, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libX11";
-    version = "1.8.10";
+    version = "1.8.11";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libX11-1.8.10.tar.xz";
-      sha256 = "0lywvwsz92j7isglvw2227g3na4ghyspvsvblpf43ns7jfnksfrb";
+      url = "mirror://xorg/individual/lib/libX11-1.8.11.tar.xz";
+      sha256 = "120f716wl7ay33yshicl1l0w62b9jx16ik3qnyh4ajwj8clyhx1v";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3883,11 +3883,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xkeyboardconfig = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xkeyboard-config";
-    version = "2.43";
+    version = "2.44";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.43.tar.xz";
-      sha256 = "00bcs1yj57jbgw1zcilz6f4rgjaj2k6k87m8kpl4x0rar1ig6468";
+      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.44.tar.xz";
+      sha256 = "0aillh6pmx5ji5jbqviq007vvg69ahz5832rz941s0xvxqzc7ljl";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 54d8bfedf011..2dc81662f425 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -149,14 +149,6 @@ self: super:
 
   libX11 = super.libX11.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "man" ];
-    patches = [
-      # Fix spurious Xerror when running synchronized
-      # https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/264
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/f3d6ebac35301d4ad068e307f0fbe6aa12ccbccb.patch";
-        hash = "sha256-wQNMsbQ+h9VlNiWr+r34AxvViC8fq02ZhcARRnw7O9k=";
-      })
-    ];
     configureFlags = attrs.configureFlags or []
       ++ malloc0ReturnsNullCrossFlag
       ++ lib.optional (stdenv.targetPlatform.useLLVM or false) "ac_cv_path_RAWCPP=cpp";
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 0c7378869811..90ad945d7fda 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -72,7 +72,7 @@ mirror://xorg/individual/app/xwininfo-1.1.6.tar.xz
 mirror://xorg/individual/app/xwud-1.0.7.tar.xz
 mirror://xorg/individual/data/xbitmaps-1.1.3.tar.xz
 mirror://xorg/individual/data/xcursor-themes-1.0.7.tar.xz
-mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.43.tar.xz
+mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.44.tar.xz
 mirror://xorg/individual/doc/xorg-docs-1.7.3.tar.xz
 mirror://xorg/individual/doc/xorg-sgml-doctools-1.12.1.tar.xz
 mirror://xorg/individual/driver/xf86-input-evdev-2.11.0.tar.xz
@@ -172,7 +172,7 @@ mirror://xorg/individual/lib/libICE-1.1.2.tar.xz
 mirror://xorg/individual/lib/libpciaccess-0.18.1.tar.xz
 mirror://xorg/individual/lib/libSM-1.2.5.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libX11-1.8.10.tar.xz
+mirror://xorg/individual/lib/libX11-1.8.11.tar.xz
 mirror://xorg/individual/lib/libXau-1.0.12.tar.xz
 mirror://xorg/individual/lib/libXaw-1.0.16.tar.xz
 mirror://xorg/individual/lib/libxcb-1.17.0.tar.xz
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 4198f41aadde..958fc54f277f 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1042,19 +1042,15 @@ substituteStream() {
                 pattern="$2"
                 replacement="$3"
                 shift 3
-                local savedvar
-                savedvar="${!var}"
-                eval "$var"'=${'"$var"'//"$pattern"/"$replacement"}'
-                if [ "$pattern" != "$replacement" ]; then
-                    if [ "${!var}" == "$savedvar" ]; then
-                        if [ "$replace_mode" == --replace-warn ]; then
-                            printf "substituteStream() in derivation $name: WARNING: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
-                        elif [ "$replace_mode" == --replace-fail ]; then
-                            printf "substituteStream() in derivation $name: ERROR: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
-                            return 1
-                        fi
+                if ! [[ "${!var}" == *"$pattern"* ]]; then
+                    if [ "$replace_mode" == --replace-warn ]; then
+                        printf "substituteStream() in derivation $name: WARNING: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
+                    elif [ "$replace_mode" == --replace-fail ]; then
+                        printf "substituteStream() in derivation $name: ERROR: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
+                        return 1
                     fi
                 fi
+                eval "$var"'=${'"$var"'//"$pattern"/"$replacement"}'
                 ;;
 
             --subst-var)
diff --git a/pkgs/test/replace-vars/default.nix b/pkgs/test/replace-vars/default.nix
index 7d9200a2cf08..e1cc2bf1c13d 100644
--- a/pkgs/test/replace-vars/default.nix
+++ b/pkgs/test/replace-vars/default.nix
@@ -119,6 +119,30 @@ let
             grep -F "@c@" $failed/testBuildFailure.log
             ! grep -F "@b@" $failed/testBuildFailure.log
 
+            touch $out
+          '';
+
+      fails-in-check-phase-with-bad-exemption =
+        runCommand "replaceVars-fails"
+          {
+            failed =
+              let
+                src = builtins.toFile "source.txt" ''
+                  @a@
+                  @b@
+                '';
+              in
+              testBuildFailure (
+                callReplaceVars src {
+                  a = "a";
+                  b = null;
+                  c = null;
+                }
+              );
+          }
+          ''
+            grep -e "ERROR: pattern @c@ doesn't match anything in file.*source.txt" $failed/testBuildFailure.log
+
             touch $out
           '';
     };
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index d3161f748743..8e2f0bfbbc80 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  substituteAll,
+  replaceVars,
   fetchFromGitHub,
   autoreconfHook,
   gettext,
@@ -71,10 +71,15 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       pythonInterpreter = python3Runtime.interpreter;
       pythonSitePackages = python3.sitePackages;
+      # patch context
+      prefix = null;
+      datarootdir = null;
+      localedir = null;
+      # removed line only
+      PYTHON = null;
     })
     ./build-without-dbus-launch.patch
   ];
diff --git a/pkgs/tools/misc/ckb-next/default.nix b/pkgs/tools/misc/ckb-next/default.nix
index f33ada649a34..9f3daa919e0f 100644
--- a/pkgs/tools/misc/ckb-next/default.nix
+++ b/pkgs/tools/misc/ckb-next/default.nix
@@ -2,7 +2,7 @@
   lib,
   wrapQtAppsHook,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   udev,
   stdenv,
   pkg-config,
@@ -57,9 +57,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./install-dirs.patch
-    (substituteAll {
-      name = "ckb-next-modprobe.patch";
-      src = ./modprobe.patch;
+    (replaceVars ./modprobe.patch {
       inherit kmod;
     })
   ];
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index fa91b2c64dca..bdb0cf2a7659 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, substituteAll
+, replaceVars
 , gettext
 , pkg-config
 , dbus
@@ -122,10 +122,11 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      inherit iputils openconnect ethtool gnused systemd;
+    (replaceVars ./fix-paths.patch {
+      inherit iputils openconnect ethtool gnused;
       inherit runtimeShell;
+      # patch context
+      OUTPUT = null;
     })
 
     # Meson does not support using different directories during build and
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 43d90812ebe1..fd2b75bb5c47 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10196,7 +10196,7 @@ with pkgs;
     inherit (darwin.apple_sdk_11_0.frameworks) Security;
   };
 
-  openssl = openssl_3_3;
+  openssl = openssl_3_4;
 
   openssl_legacy = openssl.override {
     conf = ../development/libraries/openssl/3.0/legacy.cnf;
@@ -10205,7 +10205,7 @@ with pkgs;
   inherit (callPackages ../development/libraries/openssl { })
     openssl_1_1
     openssl_3
-    openssl_3_3;
+    openssl_3_4;
 
   openwebrx = callPackage ../applications/radio/openwebrx {
     inherit (python3Packages)