diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a7471bcf1934..1e8e7893d1fd 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -71,6 +71,12 @@
     github = "0b11stan";
     githubId = 27831931;
   };
+  _0david0mp = {
+    email = "davidmrpr@proton.me";
+    github = "0david0mp";
+    githubId = 54892055;
+    name = "David mp";
+  };
   _0nyr = {
     email = "onyr.maintainer@gmail.com";
     github = "0nyr";
@@ -227,6 +233,12 @@
     githubId = 12578560;
     name = "Quinn Bohner";
   };
+  _71zenith = {
+    email = "71zenith@proton.me";
+    github = "71zenith";
+    githubId = 92977828;
+    name = "Mori Zen";
+  };
   _8aed = {
     email = "8aed@riseup.net";
     github = "8aed";
@@ -5333,6 +5345,12 @@
     githubId = 6199462;
     name = "Dmytro Rets";
   };
+  dretyuiop = {
+    email = "chewch03@gmail.com";
+    github = "dretyuiop";
+    githubId = 81854406;
+    name = "Chew Cheng Hong";
+  };
   drewrisinger = {
     email = "drisinger+nixpkgs@gmail.com";
     github = "drewrisinger";
@@ -15470,6 +15488,12 @@
     githubId = 817039;
     name = "Paulo Casaretto";
   };
+  pcboy = {
+    email = "david@joynetiks.com";
+    github = "pcboy";
+    githubId = 943430;
+    name = "David Hagege";
+  };
   pedrohlc = {
     email = "root@pedrohlc.com";
     github = "PedroHLC";
@@ -18927,11 +18951,6 @@
     githubId = 10437171;
     keys = [ { fingerprint = "75F0 AB7C FE01 D077 AEE6  CAFD 353E 4A18 EE0F AB72"; } ];
   };
-  spacefault = {
-    github = "spacefault";
-    githubId = 74156492;
-    name = "spacefault";
-  };
   spacefrogg = {
     email = "spacefrogg-nixos@meterriblecrew.net";
     github = "spacefrogg";
@@ -19933,6 +19952,14 @@
     githubId = 34945377;
     name = "John Smith";
   };
+  theCapypara = {
+    name = "Marco Köpcke";
+    email = "hello@capypara.de";
+    matrix = "@capypara:matrix.org";
+    github = "theCapypara";
+    githubId = 3512122;
+    keys = [ { fingerprint = "5F29 132D EFA8 5DA0 B598  5BF2 5941 754C 1CDE 33BB"; } ];
+  };
   thedavidmeister = {
     email = "thedavidmeister@gmail.com";
     github = "thedavidmeister";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 2416080abab7..7359e4451ccf 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -6,6 +6,7 @@ argparse,,,,,,
 basexx,,,,,,
 binaryheap,,,,,,vcunat
 busted,,,,,,
+busted-htest,,,,,,mrcjkb
 cassowary,,,,,,alerque
 cldr,,,,,,alerque
 compat53,,,,,,vcunat
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index b7e44bf54434..3f16677ead65 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -30,6 +30,8 @@
 
 - [Playerctld](https://github.com/altdesktop/playerctl), a daemon to track media player activity. Available as [services.playerctld](option.html#opt-services.playerctld).
 
+- [Glance](https://github.com/glanceapp/glance), a self-hosted dashboard that puts all your feeds in one place. Available as [services.glance](option.html#opt-services.glance).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:
diff --git a/nixos/modules/config/update-users-groups.pl b/nixos/modules/config/update-users-groups.pl
index 7c6851473f42..f0b692a759d1 100644
--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@@ -234,7 +234,7 @@ foreach my $u (@{$spec->{users}}) {
 
     # Ensure home directory incl. ownership and permissions.
     if ($u->{createHome} and !$is_dry) {
-        make_path($u->{home}, { mode => oct($u->{homeMode}) }) if ! -e $u->{home};
+        make_path($u->{home}, { mode => 0755 }) if ! -e $u->{home};
         chown $u->{uid}, $u->{gid}, $u->{home};
         chmod oct($u->{homeMode}), $u->{home};
     }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 2eb623bee36b..fc62e9db1785 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1380,6 +1380,7 @@
   ./services/web-apps/freshrss.nix
   ./services/web-apps/galene.nix
   ./services/web-apps/gerrit.nix
+  ./services/web-apps/glance.nix
   ./services/web-apps/gotify-server.nix
   ./services/web-apps/gotosocial.nix
   ./services/web-apps/grocy.nix
diff --git a/nixos/modules/profiles/qemu-guest.nix b/nixos/modules/profiles/qemu-guest.nix
index 64704e6bb369..a7015c8bcc61 100644
--- a/nixos/modules/profiles/qemu-guest.nix
+++ b/nixos/modules/profiles/qemu-guest.nix
@@ -5,5 +5,5 @@
 
 {
   boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "9p" "9pnet_virtio" ];
-  boot.initrd.kernelModules = [ "virtio_balloon" "virtio_console" "virtio_rng" ];
+  boot.initrd.kernelModules = [ "virtio_balloon" "virtio_console" "virtio_rng" "virtio_gpu" ];
 }
diff --git a/nixos/modules/services/backup/duplicity.nix b/nixos/modules/services/backup/duplicity.nix
index 033d0cffd8d6..46625ec5460e 100644
--- a/nixos/modules/services/backup/duplicity.nix
+++ b/nixos/modules/services/backup/duplicity.nix
@@ -42,6 +42,28 @@ in
       '';
     };
 
+    includeFileList = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = /path/to/fileList.txt;
+      description = ''
+        File containing newline-separated list of paths to include into the
+        backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
+        details on the syntax.
+      '';
+    };
+
+    excludeFileList = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = /path/to/fileList.txt;
+      description = ''
+        File containing newline-separated list of paths to exclude into the
+        backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
+        details on the syntax.
+      '';
+    };
+
     targetUrl = mkOption {
       type = types.str;
       example = "s3://host:port/prefix";
@@ -154,6 +176,8 @@ in
             ${lib.optionalString (cfg.cleanup.maxIncr != null) "${dup} remove-all-inc-of-but-n-full ${toString cfg.cleanup.maxIncr} ${target} --force ${extra}"}
             exec ${dup} ${if cfg.fullIfOlderThan == "always" then "full" else "incr"} ${lib.escapeShellArgs (
               [ cfg.root cfg.targetUrl ]
+              ++ lib.optionals (cfg.includeFileList != null) [ "--include-filelist" cfg.includeFileList ]
+              ++ lib.optionals (cfg.excludeFileList != null) [ "--exclude-filelist" cfg.excludeFileList ]
               ++ concatMap (p: [ "--include" p ]) cfg.include
               ++ concatMap (p: [ "--exclude" p ]) cfg.exclude
               ++ (lib.optionals (cfg.fullIfOlderThan != "never" && cfg.fullIfOlderThan != "always") [ "--full-if-older-than" cfg.fullIfOlderThan ])
diff --git a/nixos/modules/services/desktop-managers/lomiri.nix b/nixos/modules/services/desktop-managers/lomiri.nix
index a896baa774ee..e1de29ba3b59 100644
--- a/nixos/modules/services/desktop-managers/lomiri.nix
+++ b/nixos/modules/services/desktop-managers/lomiri.nix
@@ -38,7 +38,7 @@ in {
         morph-browser
         qtmir # not having its desktop file for Xwayland available causes any X11 application to crash the session
         suru-icon-theme
-        # telephony-service # currently broken: https://github.com/NixOS/nixpkgs/pull/314043
+        telephony-service
       ]);
       variables = {
         # To override the keyboard layouts in Lomiri
@@ -87,7 +87,7 @@ in {
       ] ++ lib.optionals (config.hardware.pulseaudio.enable || config.services.pipewire.pulse.enable) [
         ayatana-indicator-sound
       ]) ++ (with pkgs.lomiri; [
-        # telephony-service # currently broken: https://github.com/NixOS/nixpkgs/pull/314043
+        telephony-service
       ] ++ lib.optionals config.networking.networkmanager.enable [
         lomiri-indicator-network
       ]);
diff --git a/nixos/modules/services/networking/deconz.nix b/nixos/modules/services/networking/deconz.nix
index 88b0ee612d87..e023f8e866c0 100644
--- a/nixos/modules/services/networking/deconz.nix
+++ b/nixos/modules/services/networking/deconz.nix
@@ -122,6 +122,7 @@ in
         RuntimeDirectory = name;
         RuntimeDirectoryMode = "0700";
         StateDirectory = name;
+        SuccessExitStatus = [ 143 ];
         WorkingDirectory = stateDir;
         # For access to /dev/ttyACM0 (ConBee).
         SupplementaryGroups = [ "dialout" ];
diff --git a/nixos/modules/services/networking/nebula.nix b/nixos/modules/services/networking/nebula.nix
index 56eed04c3e8d..d69af8d16b52 100644
--- a/nixos/modules/services/networking/nebula.nix
+++ b/nixos/modules/services/networking/nebula.nix
@@ -51,8 +51,8 @@ in
             };
 
             key = mkOption {
-              type = types.path;
-              description = "Path to the host key.";
+              type = types.oneOf [types.nonEmptyStr types.path];
+              description = "Path or reference to the host key.";
               example = "/etc/nebula/host.key";
             };
 
@@ -241,7 +241,7 @@ in
               ProtectKernelModules = true;
               ProtectKernelTunables = true;
               ProtectProc = "invisible";
-              ProtectSystem = "strict";
+              ProtectSystem = true;
               RestrictNamespaces = true;
               RestrictSUIDSGID = true;
               User = networkId;
@@ -269,4 +269,6 @@ in
       ${nameToId netName} = {};
     }) enabledNetworks);
   };
+
+  meta.maintainers = [ numinit ];
 }
diff --git a/nixos/modules/services/web-apps/glance.md b/nixos/modules/services/web-apps/glance.md
new file mode 100644
index 000000000000..f65b32b3ba91
--- /dev/null
+++ b/nixos/modules/services/web-apps/glance.md
@@ -0,0 +1,39 @@
+# Glance {#module-services-glance}
+
+Glance is a self-hosted dashboard that puts all your feeds in one place.
+
+Visit [the Glance project page](https://github.com/glanceapp/glance) to learn
+more about it.
+
+## Quickstart {#module-services-glance-quickstart}
+
+Checkout the [configuration docs](https://github.com/glanceapp/glance/blob/main/docs/configuration.md) to learn more.
+Use the following configuration to start a public instance of Glance locally:
+
+```nix
+{
+  services.glance = {
+    enable = true;
+    settings = {
+      pages = [
+        {
+          name = "Home";
+          columns = [
+            {
+              size = "full";
+              widgets = [
+                { type = "calendar"; }
+                {
+                  type = "weather";
+                  location = "Nivelles, Belgium";
+                }
+              ];
+            }
+          ];
+        }
+      ];
+    };
+    openFirewall = true;
+  };
+}
+```
diff --git a/nixos/modules/services/web-apps/glance.nix b/nixos/modules/services/web-apps/glance.nix
new file mode 100644
index 000000000000..fbc310daea77
--- /dev/null
+++ b/nixos/modules/services/web-apps/glance.nix
@@ -0,0 +1,141 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.glance;
+
+  inherit (lib)
+    mkEnableOption
+    mkPackageOption
+    mkOption
+    mkIf
+    getExe
+    types
+    ;
+
+  settingsFormat = pkgs.formats.yaml { };
+in
+{
+  options.services.glance = {
+    enable = mkEnableOption "glance";
+    package = mkPackageOption pkgs "glance" { };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          server = {
+            host = mkOption {
+              description = "Glance bind address";
+              default = "127.0.0.1";
+              example = "0.0.0.0";
+              type = types.str;
+            };
+            port = mkOption {
+              description = "Glance port to listen on";
+              default = 8080;
+              example = 5678;
+              type = types.port;
+            };
+          };
+          pages = mkOption {
+            type = settingsFormat.type;
+            description = ''
+              List of pages to be present on the dashboard.
+
+              See <https://github.com/glanceapp/glance/blob/main/docs/configuration.md#pages--columns>
+            '';
+            default = [
+              {
+                name = "Calendar";
+                columns = [
+                  {
+                    size = "full";
+                    widgets = [ { type = "calendar"; } ];
+                  }
+                ];
+              }
+            ];
+            example = [
+              {
+                name = "Home";
+                columns = [
+                  {
+                    size = "full";
+                    widgets = [
+                      { type = "calendar"; }
+                      {
+                        type = "weather";
+                        location = "Nivelles, Belgium";
+                      }
+                    ];
+                  }
+                ];
+              }
+            ];
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Configuration written to a yaml file that is read by glance. See
+        <https://github.com/glanceapp/glance/blob/main/docs/configuration.md>
+        for more.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to open the firewall for Glance.
+        This adds `services.glance.settings.server.port` to `networking.firewall.allowedTCPPorts`.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.glance = {
+      description = "Glance feed dashboard server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        ExecStart =
+          let
+            glance-yaml = settingsFormat.generate "glance.yaml" cfg.settings;
+          in
+          "${getExe cfg.package} --config ${glance-yaml}";
+        WorkingDirectory = "/var/lib/glance";
+        StateDirectory = "glance";
+        RuntimeDirectory = "glance";
+        RuntimeDirectoryMode = "0755";
+        PrivateTmp = true;
+        DynamicUser = true;
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateUsers = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProcSubset = "pid";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.settings.server.port ]; };
+  };
+
+  meta.doc = ./glance.md;
+  meta.maintainers = [ lib.maintainers.drupol ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index d26e9eefe27f..8d67843a81ef 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -364,6 +364,7 @@ in {
   gitlab = runTest ./gitlab.nix;
   gitolite = handleTest ./gitolite.nix {};
   gitolite-fcgiwrap = handleTest ./gitolite-fcgiwrap.nix {};
+  glance = runTest ./glance.nix;
   glusterfs = handleTest ./glusterfs.nix {};
   gnome = handleTest ./gnome.nix {};
   gnome-extensions = handleTest ./gnome-extensions.nix {};
diff --git a/nixos/tests/ayatana-indicators.nix b/nixos/tests/ayatana-indicators.nix
index ccb1e059a697..cfd4d8099d11 100644
--- a/nixos/tests/ayatana-indicators.nix
+++ b/nixos/tests/ayatana-indicators.nix
@@ -35,7 +35,7 @@ in {
         ayatana-indicator-sound
       ] ++ (with pkgs.lomiri; [
         lomiri-indicator-network
-        # telephony-service # currently broken: https://github.com/NixOS/nixpkgs/pull/314043
+        telephony-service
       ]);
     };
 
diff --git a/nixos/tests/glance.nix b/nixos/tests/glance.nix
new file mode 100644
index 000000000000..daa3d9a4a816
--- /dev/null
+++ b/nixos/tests/glance.nix
@@ -0,0 +1,36 @@
+{ lib, ... }:
+
+{
+  name = "glance";
+
+  nodes = {
+    machine_default =
+      { pkgs, ... }:
+      {
+        services.glance = {
+          enable = true;
+        };
+      };
+
+    machine_custom_port =
+      { pkgs, ... }:
+      {
+        services.glance = {
+          enable = true;
+          settings.server.port = 5678;
+        };
+      };
+  };
+
+  testScript = ''
+    machine_default.start()
+    machine_default.wait_for_unit("glance.service")
+    machine_default.wait_for_open_port(8080)
+
+    machine_custom_port.start()
+    machine_custom_port.wait_for_unit("glance.service")
+    machine_custom_port.wait_for_open_port(5678)
+  '';
+
+  meta.maintainers = [ lib.maintainers.drupol ];
+}
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index 9c30e1f3043a..a7b220d11168 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -239,7 +239,7 @@ in
 
   memtest86 = makeTest {
     name = "systemd-boot-memtest86";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -254,7 +254,7 @@ in
 
   netbootxyz = makeTest {
     name = "systemd-boot-netbootxyz";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -269,7 +269,7 @@ in
 
   memtestSortKey = makeTest {
     name = "systemd-boot-memtest-sortkey";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -307,7 +307,7 @@ in
 
   extraEntries = makeTest {
     name = "systemd-boot-extra-entries";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -326,7 +326,7 @@ in
 
   extraFiles = makeTest {
     name = "systemd-boot-extra-files";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -343,7 +343,7 @@ in
 
   switch-test = makeTest {
     name = "systemd-boot-switch-test";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes = {
       inherit common;
diff --git a/nixos/tests/user-home-mode.nix b/nixos/tests/user-home-mode.nix
index 070cb0b75cc9..2d6d1af3f391 100644
--- a/nixos/tests/user-home-mode.nix
+++ b/nixos/tests/user-home-mode.nix
@@ -12,6 +12,12 @@ import ./make-test-python.nix ({ lib, ... }: {
       isNormalUser = true;
       homeMode = "750";
     };
+    users.users.carol = {
+      initialPassword = "pass3";
+      isNormalUser = true;
+      createHome = true;
+      home = "/users/carol";
+    };
   };
 
   testScript = ''
@@ -23,5 +29,7 @@ import ./make-test-python.nix ({ lib, ... }: {
     machine.send_chars("pass1\n")
     machine.succeed('[ "$(stat -c %a /home/alice)" == "700" ]')
     machine.succeed('[ "$(stat -c %a /home/bob)" == "750" ]')
+    machine.succeed('[ "$(stat -c %a /users)" == "755" ]')
+    machine.succeed('[ "$(stat -c %a /users/carol)" == "700" ]')
   '';
 })
diff --git a/nixos/tests/vscode-remote-ssh.nix b/nixos/tests/vscode-remote-ssh.nix
index de7cc6badc9a..6b5294e15420 100644
--- a/nixos/tests/vscode-remote-ssh.nix
+++ b/nixos/tests/vscode-remote-ssh.nix
@@ -14,7 +14,7 @@ import ./make-test-python.nix ({ lib, ... }@args: let
   inherit (pkgs.vscode.passthru) rev vscodeServer;
 in {
   name = "vscode-remote-ssh";
-  meta.maintainers = with lib.maintainers; [ Enzime ];
+  meta.maintainers = with lib.maintainers; [ ];
 
   nodes = let
     serverAddress = "192.168.0.2";
diff --git a/pkgs/applications/audio/mopidy/youtube.nix b/pkgs/applications/audio/mopidy/youtube.nix
index a4aea017ea4e..33cf382ada88 100644
--- a/pkgs/applications/audio/mopidy/youtube.nix
+++ b/pkgs/applications/audio/mopidy/youtube.nix
@@ -1,8 +1,10 @@
-{ lib
-, fetchFromGitHub
-, python3
-, mopidy
-, extraPkgs ? pkgs: []
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+  mopidy,
+  yt-dlp,
+  extraPkgs ? pkgs: [ ],
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -17,22 +19,36 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-iFt7r8Ljymc+grNJiOClTHkZOeo7AcYpcNc8tLMPROk=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
-    beautifulsoup4
-    cachetools
-    pykka
-    requests
-    youtube-dl
-    ytmusicapi
-  ] ++ [
-    mopidy
-  ] ++ extraPkgs pkgs;
+  propagatedBuildInputs =
+    with python3.pkgs;
+    [
+      beautifulsoup4
+      cachetools
+      pykka
+      requests
+      ytmusicapi
+    ]
+    ++ [
+      mopidy
+      yt-dlp
+    ]
+    ++ extraPkgs pkgs;
 
   nativeCheckInputs = with python3.pkgs; [
     vcrpy
     pytestCheckHook
   ];
 
+  postPatch = ''
+    substituteInPlace mopidy_youtube/youtube.py \
+      --replace-fail 'youtube_dl_package = "youtube_dl"' 'youtube_dl_package = "yt_dlp"'
+    substituteInPlace tests/conftest.py \
+      --replace-fail 'import youtube_dl' 'import yt_dlp' \
+      --replace-fail 'patcher = mock.patch.object(youtube, "youtube_dl", spec=youtube_dl)' \
+      'patcher = mock.patch.object(youtube, "youtube_dl", spec=yt_dlp)' \
+      --replace-fail '"youtube_dl_package": "youtube_dl",' '"youtube_dl_package": "yt_dlp",'
+  '';
+
   disabledTests = [
     # Test requires a YouTube API key
     "test_get_default_config"
@@ -45,9 +61,7 @@ python3.pkgs.buildPythonApplication rec {
     "tests/test_youtube.py"
   ];
 
-  pythonImportsCheck = [
-    "mopidy_youtube"
-  ];
+  pythonImportsCheck = [ "mopidy_youtube" ];
 
   meta = with lib; {
     description = "Mopidy extension for playing music from YouTube";
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
deleted file mode 100644
index db91a2952bf2..000000000000
--- a/pkgs/applications/audio/musikcube/default.nix
+++ /dev/null
@@ -1,94 +0,0 @@
-{ asio
-, cmake
-, curl
-, fetchFromGitHub
-, ffmpeg
-, gnutls
-, lame
-, lib
-, libev
-, game-music-emu
-, libmicrohttpd
-, libopenmpt
-, mpg123
-, ncurses
-, pkg-config
-, portaudio
-, stdenv
-, taglib
-# Linux Dependencies
-, alsa-lib
-, pipewireSupport ? !stdenv.hostPlatform.isDarwin, pipewire
-, pulseaudio
-, sndioSupport ? true, sndio
-, systemd
-, systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd
-# Darwin Dependencies
-, Cocoa
-, SystemConfiguration
-, coreaudioSupport ? stdenv.hostPlatform.isDarwin, CoreAudio
-}:
-
-stdenv.mkDerivation rec {
-  pname = "musikcube";
-  version = "3.0.2";
-
-  src = fetchFromGitHub {
-    owner = "clangen";
-    repo = pname;
-    rev = version;
-    hash = "sha512-IakZy6XsAE39awjzQI+R11JCPeQSaibx6+uX8Iea5WdlCundeovnPwSAi6RzzZl9dr2UftzzEiF4Aun8VMtqVA==";
-  };
-
-  outputs = [ "out" "dev" ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
-
-  buildInputs = [
-    asio
-    curl
-    ffmpeg
-    gnutls
-    lame
-    libev
-    game-music-emu
-    libmicrohttpd
-    libopenmpt
-    mpg123
-    ncurses
-    portaudio
-    taglib
-  ] ++ lib.optionals systemdSupport [
-    systemd
-  ] ++ lib.optionals stdenv.isLinux [
-    alsa-lib pulseaudio
-  ] ++ lib.optionals stdenv.isDarwin [
-    Cocoa SystemConfiguration
-  ] ++ lib.optionals coreaudioSupport [
-    CoreAudio
-  ] ++ lib.optionals sndioSupport [
-    sndio
-  ] ++ lib.optionals pipewireSupport [
-    pipewire
-  ];
-
-  cmakeFlags = [
-    "-DDISABLE_STRIP=true"
-  ];
-
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -add_rpath $out/share/${pname} $out/share/${pname}/${pname}
-    install_name_tool -add_rpath $out/share/${pname} $out/share/${pname}/${pname}d
-  '';
-
-  meta = {
-    description = "Terminal-based music player, library, and streaming audio server";
-    homepage = "https://musikcube.com/";
-    maintainers = with lib.maintainers; [ aanderse afh ];
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/applications/audio/sfxr-qt/default.nix b/pkgs/applications/audio/sfxr-qt/default.nix
index 33724f9230e7..4a726e8bcc99 100644
--- a/pkgs/applications/audio/sfxr-qt/default.nix
+++ b/pkgs/applications/audio/sfxr-qt/default.nix
@@ -1,41 +1,29 @@
 { lib
 , mkDerivation
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , extra-cmake-modules
 , qtbase
 , qtquickcontrols2
 , SDL
 , python3
-, catch2
+, catch2_3
 , callPackage
 , nixosTests
 }:
 
 mkDerivation rec {
   pname = "sfxr-qt";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "agateau";
     repo = "sfxr-qt";
     rev = version;
-    sha256 = "sha256-Ce5NJe1f+C4pPmtenHYvtkxste+nPuxJoB+N7K2nyRo=";
+    sha256 = "sha256-JAWDk7mGkPtQ5yaA6UT9hlAy770MHrTBhBP9G8UqFKg=";
     fetchSubmodules = true;
   };
 
-  postPatch = ''
-    cp ${catch2}/include/catch2/catch.hpp 3rdparty/catch2/single_include/catch2/catch.hpp
-  '';
-
-  # Remove on next release
-  patches = [(fetchpatch {
-    name = "sfxr-qr-missing-qpainterpath-include";
-    url = "https://github.com/agateau/sfxr-qt/commit/ef051f473654052112b647df987eb263e38faf47.patch";
-    sha256 = "sha256-bqMnxHUzdS5oG/2hfr5MvkpwrtZW+GTN5fS2WpV2W2c=";
-  })];
-
   nativeBuildInputs = [
     cmake
     extra-cmake-modules
@@ -48,6 +36,14 @@ mkDerivation rec {
     SDL
   ];
 
+  checkInputs = [
+    catch2_3
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "USE_SYSTEM_CATCH2" true)
+  ];
+
   doCheck = true;
 
   passthru.tests = {
diff --git a/pkgs/applications/audio/soundsource/default.nix b/pkgs/applications/audio/soundsource/default.nix
index 8f2d743e03df..cc7a5b3d7ce9 100644
--- a/pkgs/applications/audio/soundsource/default.nix
+++ b/pkgs/applications/audio/soundsource/default.nix
@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://rogueamoeba.com/soundsource";
     license = licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })
diff --git a/pkgs/applications/audio/spotify-player/default.nix b/pkgs/applications/audio/spotify-player/default.nix
index 2a250ff94665..dcce24d173ce 100644
--- a/pkgs/applications/audio/spotify-player/default.nix
+++ b/pkgs/applications/audio/spotify-player/default.nix
@@ -24,6 +24,7 @@
 , withImage ? true
 , withNotify ? true
 , withSixel ? true
+, withFuzzy ? true
 , stdenv
 , darwin
 , makeBinaryWrapper
@@ -33,16 +34,16 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [ "" "alsa" "pulseaud
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.18.2";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-bLUPQgqSsE9tF5YiFj5B+Ylyy96DhWFNjwqXbQ9H8uc=";
+    hash = "sha256-R8F7s8FPnCe+shNUN/u0qcxFy3IbyfVo2xZ5/E/qwaw=";
   };
 
-  cargoHash = "sha256-rptGA7J63rHdmxuPIguhZYYs8tZbpidJ0fXroBBoEIM=";
+  cargoHash = "sha256-7vximGisIIXBrwHXSWQjO08OraaweG7ZT6v+gVdYGVc=";
 
   nativeBuildInputs = [
     pkg-config
@@ -83,7 +84,8 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optionals withDaemon [ "daemon" ]
     ++ lib.optionals withNotify [ "notify" ]
     ++ lib.optionals withStreaming [ "streaming" ]
-    ++ lib.optionals withSixel [ "sixel" ];
+    ++ lib.optionals withSixel [ "sixel" ]
+    ++ lib.optionals withFuzzy [ "fzf" ];
 
   # sixel-sys is dynamically linked to libsixel
   postInstall = lib.optionals (stdenv.isDarwin && withSixel) ''
@@ -97,6 +99,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/aome510/spotify-player/releases/tag/v${version}";
     mainProgram = "spotify_player";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ dit7ya xyven1 ];
+    maintainers = with lib.maintainers; [ dit7ya xyven1 _71zenith ];
   };
 }
diff --git a/pkgs/applications/audio/spotify/darwin.nix b/pkgs/applications/audio/spotify/darwin.nix
index e3066cc36dd1..8304bdf3a15d 100644
--- a/pkgs/applications/audio/spotify/darwin.nix
+++ b/pkgs/applications/audio/spotify/darwin.nix
@@ -36,6 +36,6 @@ stdenv.mkDerivation {
   '';
 
   meta = meta // {
-    maintainers = with lib.maintainers; [ Enzime ];
+    maintainers = with lib.maintainers; [ matteopacini ];
   };
 }
diff --git a/pkgs/applications/editors/cpeditor/default.nix b/pkgs/applications/editors/cpeditor/default.nix
index 48e00514cbed..d90ab0861407 100644
--- a/pkgs/applications/editors/cpeditor/default.nix
+++ b/pkgs/applications/editors/cpeditor/default.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/Core/Runner.cpp --replace-fail "/bin/bash" "${runtimeShell}"
+    substituteInPlace dist/linux/cpeditor.desktop --replace-fail 'Exec=/usr/bin/cpeditor' "Exec=cpeditor"
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
index 9dd51bcbc5a4..02857188f0f6 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
@@ -91627,11 +91627,11 @@
   "repo": "ksqsf/org-xlatex",
   "unstable": {
    "version": [
-    20230820,
-    2133
+    20240707,
+    1343
    ],
-   "commit": "f3cac5ea904e78ae2b47723fdce96e8e87edbe7c",
-   "sha256": "06y7lapsp4s9h07hdsd8wigmy6r5l36qiqwmz7j1n8zp3r8xg0pw"
+   "commit": "8f25ba5e4784b3f12f5ac5c69b1a1d0695c53b8e",
+   "sha256": "1cg11gqisigpa9prkm05z7wlajffzmhjiymg7frbibhrskhfhrp0"
   }
  },
  {
diff --git a/pkgs/applications/editors/quartus-prime/quartus.nix b/pkgs/applications/editors/quartus-prime/quartus.nix
index 12c7039563c1..e668fe9e43fe 100644
--- a/pkgs/applications/editors/quartus-prime/quartus.nix
+++ b/pkgs/applications/editors/quartus-prime/quartus.nix
@@ -102,6 +102,6 @@ in stdenv.mkDerivation rec {
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ kwohlfahrt ];
+    maintainers = with maintainers; [ bjornfor kwohlfahrt ];
   };
 }
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 3bd74d57a51f..20ca197908f8 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2176,7 +2176,7 @@ let
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=GraphQL.vscode-graphql";
           homepage = "https://github.com/graphql/graphiql/tree/main/packages/vscode-graphql";
           license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.Enzime ];
+          maintainers = [ ];
         };
       };
 
@@ -2192,7 +2192,7 @@ let
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=GraphQL.vscode-graphql-syntax";
           homepage = "https://github.com/graphql/graphiql/tree/main/packages/vscode-graphql-syntax";
           license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.Enzime ];
+          maintainers = [ ];
         };
       };
 
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 78a063e6ee36..c2e41573c1ef 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -97,7 +97,7 @@ in
       homepage = "https://code.visualstudio.com/";
       downloadPage = "https://code.visualstudio.com/Updates";
       license = licenses.unfree;
-      maintainers = with maintainers; [ eadwu synthetica bobby285271 Enzime ];
+      maintainers = with maintainers; [ eadwu synthetica bobby285271 johnrtitor ];
       platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" "armv7l-linux" ];
     };
   }
diff --git a/pkgs/applications/graphics/batik/default.nix b/pkgs/applications/graphics/batik/default.nix
deleted file mode 100644
index 1ff914c2740d..000000000000
--- a/pkgs/applications/graphics/batik/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{lib, stdenv, fetchurl}:
-
-stdenv.mkDerivation rec {
-  pname = "batik";
-  version = "1.17";
-
-  src = fetchurl {
-    url = "mirror://apache/xmlgraphics/batik/binaries/batik-bin-${version}.tar.gz";
-    sha256 = "sha256-sEJphF3grlwZCEt3gHHm4JF8RpvKKBLLvKXf2lu/dhA=";
-  };
-
-  meta = with lib; {
-    description = "Java based toolkit for handling SVG";
-    homepage = "https://xmlgraphics.apache.org/batik";
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-  };
-
-  installPhase = ''
-    mkdir $out
-    cp -r * $out/
-  '';
-}
diff --git a/pkgs/applications/graphics/hydrus/default.nix b/pkgs/applications/graphics/hydrus/default.nix
index d16e0e87b633..7da1858cb542 100644
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@@ -6,6 +6,7 @@
 , enableSwftools ? false
 , swftools
 , python3Packages
+, pythonOlder
 , qtbase
 , qtcharts
 , makeDesktopItem
@@ -14,14 +15,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "580";
+  version = "581";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QdRItwbgVYgA6PU9Ybimk+/sBe1CHV79ssTrIturVpg=";
+    hash = "sha256-Q/EdqwIMCjeDtFAPlYd04NMpEgC6xUDGK5LwxDCiI9Y=";
   };
 
   nativeBuildInputs = [
@@ -81,6 +82,9 @@ python3Packages.buildPythonPackage rec {
     twisted
   ];
 
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = with python3Packages; [
     nose
     mock
diff --git a/pkgs/applications/misc/appcleaner/default.nix b/pkgs/applications/misc/appcleaner/default.nix
index eff32c76f988..62d9e2b1116f 100644
--- a/pkgs/applications/misc/appcleaner/default.nix
+++ b/pkgs/applications/misc/appcleaner/default.nix
@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://freemacsoft.net/appcleaner";
     license = licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index e1bf6cffb008..dcea5ecb52c9 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "7.12.0";
+  version = "7.13.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XHkORTUx3+O+i2vbTiZAHI/0hY3xPIXvvNAVuXy4wzk=";
+    hash = "sha256-t0nSLsT3X5MoYHhLjbRpqyKbV6NdAqNurSjbcik/n7Q=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/cotp/default.nix b/pkgs/applications/misc/cotp/default.nix
index 14c8ee0edd4e..53d19c173190 100644
--- a/pkgs/applications/misc/cotp/default.nix
+++ b/pkgs/applications/misc/cotp/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cotp";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${version}";
-    hash = "sha256-6FriNAwxo+YnJWmCrScyafUEkJvEJz3O9Zoj9yerpSI=";
+    hash = "sha256-U+rOwBxT3on1hUlkb93sgdYIpPTOHb42x1cibueGDn0=";
   };
 
-  cargoHash = "sha256-/CW0CGhPjKd5oU2LYW4lPWKMATn9aJdjIy44yZJyU/E=";
+  cargoHash = "sha256-mdcQSmTLU2bj+wEyzgqFJpjBEesD7zPDVHziNkTIR+s=";
 
   buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
     ++ lib.optionals stdenv.isDarwin [ AppKit ];
diff --git a/pkgs/applications/misc/dmenu/default.nix b/pkgs/applications/misc/dmenu/default.nix
index 109befe7594c..089a421ccc15 100644
--- a/pkgs/applications/misc/dmenu/default.nix
+++ b/pkgs/applications/misc/dmenu/default.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv, fetchurl, libX11, libXinerama, libXft, zlib, patches ? null
-# update script dependencies
-, gitUpdater
-}:
+{ lib, stdenv, fetchurl, libX11, libXinerama, libXft, zlib, writeText
+, conf ? null, patches ? null
+  # update script dependencies
+, gitUpdater }:
 
 stdenv.mkDerivation rec {
   pname = "dmenu";
@@ -16,9 +16,15 @@ stdenv.mkDerivation rec {
 
   inherit patches;
 
-  postPatch = ''
+  postPatch = let
+    configFile = if lib.isDerivation conf || builtins.isPath conf then
+      conf
+    else
+      writeText "config.def.h" conf;
+  in ''
     sed -ri -e 's!\<(dmenu|dmenu_path|stest)\>!'"$out/bin"'/&!g' dmenu_run
     sed -ri -e 's!\<stest\>!'"$out/bin"'/&!g' dmenu_path
+    ${lib.optionalString (conf != null) "cp ${configFile} config.def.h"}
   '';
 
   preConfigure = ''
@@ -27,15 +33,14 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "CC:=$(CC)" ];
 
-  passthru.updateScript = gitUpdater {
-    url = "git://git.suckless.org/dmenu";
-  };
+  passthru.updateScript = gitUpdater { url = "git://git.suckless.org/dmenu"; };
 
   meta = with lib; {
-    description = "Generic, highly customizable, and efficient menu for the X Window System";
+    description =
+      "Generic, highly customizable, and efficient menu for the X Window System";
     homepage = "https://tools.suckless.org/dmenu";
     license = licenses.mit;
-    maintainers = with maintainers; [ pSub globin qusic ];
+    maintainers = with maintainers; [ pSub globin qusic _0david0mp ];
     platforms = platforms.all;
     mainProgram = "dmenu";
   };
diff --git a/pkgs/applications/misc/ff2mpv/default.nix b/pkgs/applications/misc/ff2mpv/default.nix
index 3efadca5f3a8..c21b07181902 100644
--- a/pkgs/applications/misc/ff2mpv/default.nix
+++ b/pkgs/applications/misc/ff2mpv/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     description = "Native Messaging Host for ff2mpv firefox addon";
     homepage = "https://github.com/woodruffw/ff2mpv";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ Enzime ];
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "ff2mpv.py";
   };
 }
diff --git a/pkgs/applications/misc/googleearth-pro/default.nix b/pkgs/applications/misc/googleearth-pro/default.nix
index 4da7bd97ec2f..8532afdfce1e 100644
--- a/pkgs/applications/misc/googleearth-pro/default.nix
+++ b/pkgs/applications/misc/googleearth-pro/default.nix
@@ -35,11 +35,11 @@ let
 in
 mkDerivation rec {
   pname = "googleearth-pro";
-  version = "7.3.4.8248";
+  version = "7.3.6.9796";
 
   src = fetchurl {
     url = "https://dl.google.com/linux/earth/deb/pool/main/g/google-earth-pro-stable/google-earth-pro-stable_${version}-r0_${arch}.deb";
-    sha256 = "1pbapi267snlrjari5k93y6kbrjsqhqxgkxxqaqv4r25az00dx6d";
+    sha256 = "sha256-Wv2jPGN7LC5T32WdX3W1BfGYrcXTNWTI1Wv+PmD0gNM=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper autoPatchelfHook ];
@@ -72,7 +72,7 @@ mkDerivation rec {
   unpackPhase = ''
     # deb file contains a setuid binary, so 'dpkg -x' doesn't work here
     mkdir deb
-    dpkg --fsys-tarfile ${src} | tar --extract -C deb
+    dpkg --fsys-tarfile $src | tar --extract -C deb
   '';
 
   installPhase =''
@@ -118,7 +118,7 @@ mkDerivation rec {
     homepage = "https://www.google.com/earth/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    maintainers = with maintainers; [ shamilton ];
+    maintainers = with maintainers; [ shamilton xddxdd ];
     platforms = platforms.linux;
     knownVulnerabilities = [ "Includes vulnerable versions of bundled libraries: openssl, ffmpeg, gdal, and proj." ];
   };
diff --git a/pkgs/applications/misc/qcad/default.nix b/pkgs/applications/misc/qcad/default.nix
index d4b014ea85ae..b94b8326dca3 100644
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@@ -18,14 +18,14 @@
 
 mkDerivation rec {
   pname = "qcad";
-  version = "3.30.1.1";
+  version = "3.30.1.3";
 
   src = fetchFromGitHub {
     name = "qcad-${version}-src";
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    hash = "sha256-hZe1rTRkvdKC/row0Li6hsmOcLKkMULo9ScOvvjmWCA=";
+    hash = "sha256-bGSXFX1LuNZzs981t0GZxnMPzyJ+bddB4m/wkLMsfg0=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/spotify-tray/default.nix b/pkgs/applications/misc/spotify-tray/default.nix
index 107424e4e836..7a140a877dfd 100644
--- a/pkgs/applications/misc/spotify-tray/default.nix
+++ b/pkgs/applications/misc/spotify-tray/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     description = "Adds a tray icon to the Spotify Linux client application";
     license = licenses.gpl3Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
     mainProgram = "spotify-tray";
   };
 }
diff --git a/pkgs/applications/misc/valent/default.nix b/pkgs/applications/misc/valent/default.nix
index 1071f39d43d2..224e105e51e7 100644
--- a/pkgs/applications/misc/valent/default.nix
+++ b/pkgs/applications/misc/valent/default.nix
@@ -15,20 +15,21 @@
 , libadwaita
 , libpeas2
 , libportal-gtk4
+, pipewire
 , pulseaudio
 , sqlite
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "valent";
-  version = "0-unstable-2024-02-12";
+  version = "1.0.0.alpha.45";
 
   src = fetchFromGitHub {
     owner = "andyholmes";
     repo = "valent";
-    rev = "70ef1aa42eb2df5e9c3aa4faa014c8d539450018";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-hOVWvk4U6VoWAvXNHK1vTm/am69EFqDmSb0NofWVQj8=";
     fetchSubmodules = true;
-    hash = "sha256-JdrkAtn21NoX+SI6PNWMdE8HLKhLc3HKFhwKydENkvg=";
   };
 
   nativeBuildInputs = [
@@ -50,6 +51,7 @@ stdenv.mkDerivation rec {
     libadwaita
     libpeas2
     libportal-gtk4
+    pipewire
     pulseaudio
     sqlite
   ];
@@ -81,9 +83,9 @@ stdenv.mkDerivation rec {
       ```
     '';
     homepage = "https://valent.andyholmes.ca";
-    changelog = "https://github.com/andyholmes/valent/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/andyholmes/valent/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = with lib.licenses; [ gpl3Plus cc0 cc-by-sa-30 ];
     maintainers = with lib.maintainers; [ aleksana ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
index 23a302187575..0db569674389 100644
--- a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.30.1+k3s1";
-  k3sCommit = "80978b5b9a97908c5520c5ee51984e544e168859";
-  k3sRepoSha256 = "085dmq49iwvlxpj9c528nfrvd67snkgpm5drj8ahfjv1nkjp0yy1";
-  k3sVendorHash = "sha256-XtTahFaWnuHzKDI/U4d/j4C4gRxH163MCGEEM4hu/WM=";
+  k3sVersion = "1.30.2+k3s2";
+  k3sCommit = "faeaf1b01b2a708a46cae2a67c1b4d381ee1ba6b";
+  k3sRepoSha256 = "0hy0f44hj5n5nscr0p52dbklvj2ki2vs7k0cgh1r8xlg4p6fn1b0";
+  k3sVendorHash = "sha256-Mj9Q3TgqZoJluG4/nyuw2WHnB3OJ+/mlV7duzWt1B1A=";
   chartVersions = import ./chart-versions.nix;
   k3sRootVersion = "0.13.0";
   k3sRootSha256 = "1jq5f0lm08abx5ikarf92z56fvx4kjpy2nmzaazblb34lajw87vj";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.15-k3s1";
-  containerdSha256 = "18hlj4ixjk7wvamfd66xyc0cax2hs9s7yjvlx52afxdc73194y0f";
+  containerdVersion = "1.7.17-k3s1";
+  containerdSha256 = "1j61mbgx346ydvnjd8b07wf7nmvvplx28wi5jjdzi1k688r2hxpf";
   criCtlVersion = "1.29.0-k3s1";
 }
diff --git a/pkgs/applications/networking/cluster/ktop/default.nix b/pkgs/applications/networking/cluster/ktop/default.nix
index 9bc630b9ccc5..8c5c842fac30 100644
--- a/pkgs/applications/networking/cluster/ktop/default.nix
+++ b/pkgs/applications/networking/cluster/ktop/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "ktop";
-  version = "0.3.5";
+  version = "0.3.6";
   excludedPackages = [".ci"];
 
   src = fetchFromGitHub {
     owner = "vladimirvivien";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-nkIRVt2kqsE9QBYvvHmupohnzH+OBcwWwV16rMePw4I=";
+    hash = "sha256-nVZ1e/GKiJFTwuq5dPIzF4Jrv2DJ2wwWAiOn304hTA4=";
   };
 
-  vendorHash = "sha256-IiAMmHOq69WMT2B1q9ZV2fGDnLr7AbRm1P7ACSde2FE=";
+  vendorHash = "sha256-MLIcTHWo7lsqtAqH8naSvpS013t8KBVPRbch+CfeUNk=";
   ldflags = [ "-s" "-w" "-X github.com/vladimirvivien/ktop/buildinfo.Version=v${version}" ];
 
   postInstall = ''
diff --git a/pkgs/applications/networking/cluster/kubectl-ktop/default.nix b/pkgs/applications/networking/cluster/kubectl-ktop/default.nix
index 289d5bc77d4b..ab96d337ee96 100644
--- a/pkgs/applications/networking/cluster/kubectl-ktop/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-ktop/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubectl-ktop";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "vladimirvivien";
     repo = "ktop";
     rev = "v${version}";
-    sha256 = "sha256-nkIRVt2kqsE9QBYvvHmupohnzH+OBcwWwV16rMePw4I=";
+    sha256 = "sha256-nVZ1e/GKiJFTwuq5dPIzF4Jrv2DJ2wwWAiOn304hTA4=";
   };
 
-  vendorHash = "sha256-IiAMmHOq69WMT2B1q9ZV2fGDnLr7AbRm1P7ACSde2FE=";
+  vendorHash = "sha256-MLIcTHWo7lsqtAqH8naSvpS013t8KBVPRbch+CfeUNk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 9b613c6ff4ae..167e52e2a7f2 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1,21 +1,21 @@
 {
   "aci": {
-    "hash": "sha256-4EVSO/DCuKSI3CPlaXSDxuy0pqAMBHRDwGJTBdQd61w=",
+    "hash": "sha256-f4hgHFJgRUG+mhRgD7GMtkXoYkzAbkxxMIzvGLS0ums=",
     "homepage": "https://registry.terraform.io/providers/CiscoDevNet/aci",
     "owner": "CiscoDevNet",
     "repo": "terraform-provider-aci",
-    "rev": "v2.14.0",
+    "rev": "v2.15.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "acme": {
-    "hash": "sha256-4H3isw9YRWJANez3qcJYnXO9yW2DoGUAoOPGI7mLXlI=",
+    "hash": "sha256-LlpPc3um4D2nNJFZRoXnw5ss0E0rrJN0wKKmuV0S6NU=",
     "homepage": "https://registry.terraform.io/providers/vancluever/acme",
     "owner": "vancluever",
     "repo": "terraform-provider-acme",
-    "rev": "v2.23.2",
+    "rev": "v2.24.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-RZmT31fetR46vFQRoLkBjadD6ROqvElI/jOZnf6FWTU="
+    "vendorHash": "sha256-ptZ14WWarYeKT8gIcUDi4LmCFkpoTwAhSwMXmLPlWxs="
   },
   "age": {
     "hash": "sha256-bJrzjvkrCX93bNqCA+FdRibHnAw6cb61StqtwUY5ok4=",
@@ -27,13 +27,13 @@
     "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
   },
   "aiven": {
-    "hash": "sha256-PCtWQP2FsYl5OITVCUp6OJub0uXDLJebWP310F4KWU8=",
+    "hash": "sha256-X3KtT4Thsf7bYeZJEUphRiXAlNamabFE0rjS636dJSY=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.19.1",
+    "rev": "v4.20.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-5Ljj3L7mhtvn5P9xw4W3AlHqRBGohKFGbiAmpN3dT0w="
+    "vendorHash": "sha256-QzbtTp78tROVj8kPYzjP5kBRHASlvqK6xpmRnJF6jsw="
   },
   "akamai": {
     "hash": "sha256-jDCrNDJ6O9dXE6bG4GAMFytlVbEe/Z8mb6vx4DG355U=",
@@ -45,11 +45,11 @@
     "vendorHash": "sha256-QQaLUJJs/7hfLTIOIkG9WF7XmkLXsJP9MOQAvQoDQOw="
   },
   "alicloud": {
-    "hash": "sha256-x/hq45iqcKurjFeXsdycWqDlJ+O1/4f01+6ay6TDejY=",
+    "hash": "sha256-WaMvv/NqyblA2rrauZ7p4pHCND6S6/kfBKS/2xIrcjI=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.225.1",
+    "rev": "v1.226.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -81,13 +81,13 @@
     "vendorHash": "sha256-yyTU+D4zMDcJPZ9j7a2ZuPjGBCHvED5R0rvevCEaoAI="
   },
   "artifactory": {
-    "hash": "sha256-4gE8+z4GZElmkVK9nVDriAolXJ95arNNKyIq88XAwp8=",
+    "hash": "sha256-j9TtO8dJltf7SZdlMZaiCWdJbcEPloPbDhYfWcCzgss=",
     "homepage": "https://registry.terraform.io/providers/jfrog/artifactory",
     "owner": "jfrog",
     "repo": "terraform-provider-artifactory",
-    "rev": "v11.0.0",
+    "rev": "v11.1.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-5kdyDc3/jBvg6QNBivh8J4SrYgMd0dkiUHUx43wzepQ="
+    "vendorHash": "sha256-nPEN1ee0RmNpgKIlz0jHcHkG6oYZn7LV/Gmmdd9krq8="
   },
   "auth0": {
     "hash": "sha256-Ay/EPlAxpEehbDsOeOyOViwT3jDsd3FmpHB5sxnAxAs=",
@@ -117,29 +117,29 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-YykNKCDFPQCtES2vAbCbqbHbkx1EmVM0bTEylr84bqs=",
+    "hash": "sha256-DJ0mfqcWIs1iLSEfhlYEgHr1PKz8HchlgvHfEwIAnlA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v5.43.0",
+    "rev": "v5.57.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2KQEX1QwPrN32gFMKF7QPnisLdBC/bn74wX1f8uiC+0="
+    "vendorHash": "sha256-NlFP7cRE+6PiGMSz2y/SDQas/TNWAJk/EBEqIeG2INY="
   },
   "azuread": {
-    "hash": "sha256-8uGSVvYygkR8WuKVGYVGN5dq2LoFQx8tbNYLYVBW4LE=",
+    "hash": "sha256-UOaEfmhGPrqQBkodNYybYb5rnB3X8wpXKHlpKqZnnXU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azuread",
     "owner": "hashicorp",
     "repo": "terraform-provider-azuread",
-    "rev": "v2.52.0",
+    "rev": "v2.53.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-ukfUXWT1Q8jziaSMpZl2awaid9GfByl3TniG63JxkuQ=",
+    "hash": "sha256-3EHm4fpeYJYzwrwaQLMdgFq1dgmV755WwAhKBG3f10M=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.109.0",
+    "rev": "v3.111.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -189,22 +189,22 @@
     "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
   "buildkite": {
-    "hash": "sha256-/vyiQZ4UDe42sIxacgWDf+wktwd8ZXhW++gh+qF4C3c=",
+    "hash": "sha256-QS+JCFLYPvxwLIVzCS/gKZkBZQhOOxRfn7Vudgiox+E=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v1.10.0",
+    "rev": "v1.10.1",
     "spdx": "MIT",
-    "vendorHash": "sha256-Vozfdh6LwIS0ISc28OGmEnpS9jjFth1i6bNUGY4mXKc="
+    "vendorHash": "sha256-gTJakGr9f9bzR5pbmgAMTJL54e2mS/h92TM4ft3ABdw="
   },
   "checkly": {
-    "hash": "sha256-xM3KJiWO1Lsw33talLR6gcalEm9gRffUOikdUQZ6AsM=",
+    "hash": "sha256-qPlXaw8J2J7DPKJvfiTLalgMIWpttqbdMg2UB3rvt14=",
     "homepage": "https://registry.terraform.io/providers/checkly/checkly",
     "owner": "checkly",
     "repo": "terraform-provider-checkly",
-    "rev": "v1.7.8",
+    "rev": "v1.8.0",
     "spdx": null,
-    "vendorHash": "sha256-TgoTz9kFLhikfQYt654nmoGPzjVLfUMnUrs3mVqrgJo="
+    "vendorHash": "sha256-+GirqFNV0eIC9CzpW53UOi9cDUzXs8ozSLX7dKQnOQ8="
   },
   "ciscoasa": {
     "hash": "sha256-xzc44FEy2MPo51Faq/VFwg411JK9e0kQucpt0vdN8yg=",
@@ -290,13 +290,13 @@
     "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
   },
   "datadog": {
-    "hash": "sha256-L6GXoyjTd2n2n79gPvmQ0zLhW0iDS8ZcrY1gxPaQ61I=",
+    "hash": "sha256-sWcVMQiSRFyjwYIHUdKQm9sKX279pnA3FVLwUJ3kBKw=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.39.0",
+    "rev": "v3.40.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-jK6GI44o1FoJw9eZaCbWz1zw3dHqyaS5664h+Z27OXQ="
+    "vendorHash": "sha256-GEZmpCyqZCxsS5aFxEznNscs5CcgQiiPvJweA3mKkRY="
   },
   "dexidp": {
     "hash": "sha256-XR8OI+Nf3PKNzZzM+jvylF8Itnapb9Xdztxq4OyXPVQ=",
@@ -381,13 +381,13 @@
     "vendorHash": "sha256-oVTanZpCWs05HwyIKW2ajiBPz1HXOFzBAt5Us+EtTRw="
   },
   "equinix": {
-    "hash": "sha256-jnV8dg9CJ38YKdEmc0hxDDbl/YUQgPTM6D5YYVjjWFc=",
+    "hash": "sha256-Ipl+POTZRKe9xKR08x/TPm2S7kv6w54im16pp56rWDE=",
     "homepage": "https://registry.terraform.io/providers/equinix/equinix",
     "owner": "equinix",
     "repo": "terraform-provider-equinix",
-    "rev": "v1.38.1",
+    "rev": "v2.0.1",
     "spdx": "MIT",
-    "vendorHash": "sha256-25kuUGbBCHOL3RzQcLDzzdfQ1j+XvqJSEyIowV0Od8A="
+    "vendorHash": "sha256-oxtFq1tejyqsY2uEkMjiub1CwdkFpuSVRb1Z2u3CebQ="
   },
   "exoscale": {
     "hash": "sha256-d6vdYtEBD34SPHDAlkpTb/T8D7TaLbVwMYjSefuNdr0=",
@@ -408,11 +408,11 @@
     "vendorHash": "sha256-qeKXdjrDPJWO4xW8by6djJReeYbCjh8VzQmE5/65zII="
   },
   "fastly": {
-    "hash": "sha256-xoxxicu0bXoaISMNwZNM6G8bBz0GKv48ORpcABwSsg8=",
+    "hash": "sha256-FfdXMrGfz+JFEyWfZytIt1R0M/v7JUmkvu4VohF1vSA=",
     "homepage": "https://registry.terraform.io/providers/fastly/fastly",
     "owner": "fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v5.10.0",
+    "rev": "v5.11.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -453,31 +453,31 @@
     "vendorHash": null
   },
   "gitlab": {
-    "hash": "sha256-WquY33Dx5E+OgnAMZ6dhgwrixhHhAYRUa4l6TuzGzmw=",
+    "hash": "sha256-F73eY0m+KdzfAFCFPOZ0a29OOfgOm87WZvi8+mHwPek=",
     "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
     "owner": "gitlabhq",
     "repo": "terraform-provider-gitlab",
-    "rev": "v16.10.0",
+    "rev": "v17.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-7hIThIq3uU803aK+paR5KdTdfVmSZu7Spf9UepaVgvc="
+    "vendorHash": "sha256-FrmQsuLinm5Z4+GHC1PV19lt1rfxv3TwQiEUxTvlTtk="
   },
   "google": {
-    "hash": "sha256-YonRToq/xdUy584hlzG+0/olYPhq3yxBUEahGz1ODkk=",
+    "hash": "sha256-RJ01+OA3BXMNThRk9aGkYa2jrj3SYgOh9eA5al5wR/Q=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v5.35.0",
+    "rev": "v5.36.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-cpxk3g3bKG+3s53WBJlX2O722qNeQICqaIqcMrpDJYs="
+    "vendorHash": "sha256-0SxftrOjmpYK4ud3RweYaW6qgdKwi43D1ZhN470rvVs="
   },
   "google-beta": {
-    "hash": "sha256-71eEmUUwSGM81kNwzvJ1QnkjMskdRx8BoETNSLIjYog=",
+    "hash": "sha256-r9ndcNxiocRHH++zvEtuIwJ8U2fE5cgndPcYjdhLpEA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v5.35.0",
+    "rev": "v5.36.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2sqUzK8yxNKdfvrToCQWK8Eyr2n4ch6/KrrIAYmLwcA="
+    "vendorHash": "sha256-XkpLgFB/974WEbZe34uKrLSEWjinrkmpOFOG7uYDHhg="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -570,11 +570,11 @@
     "vendorHash": "sha256-3yrcTs0QV2I4CX1TZgY9FimXC2G/p1s+xNsurH0n8e8="
   },
   "huaweicloud": {
-    "hash": "sha256-04y0G3555aRnB3Zc9TgeYOMo1QyJ9ns4r85AikXSNE4=",
+    "hash": "sha256-p5vS7rnoBqE81Dhj35xeAs5ja/ekpeVEaNALtxw0/Tc=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.65.2",
+    "rev": "v1.66.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -597,13 +597,13 @@
     "vendorHash": null
   },
   "ibm": {
-    "hash": "sha256-5esd44JgaarCJK38QyYv+fxMz0+zzivMZD8rqyqrdbo=",
+    "hash": "sha256-91EXK/8Kovq2yqyF5lFgWV/AJMvU6eHCnIBnLpzsQws=",
     "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
     "owner": "IBM-Cloud",
     "repo": "terraform-provider-ibm",
-    "rev": "v1.64.0",
+    "rev": "v1.67.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-YFxD7hvKTXdaQ/+/Oiws/i6TipbFaAQ0Ah1arGK7JUo="
+    "vendorHash": "sha256-ioyfsNgXoQOtzU1eBJkjMw4hgIo5ryFPIFKqOdn4fuk="
   },
   "icinga2": {
     "hash": "sha256-Y/Oq0aTzP+oSKPhHiHY9Leal4HJJm7TNDpcdqkUsCmk=",
@@ -705,13 +705,13 @@
     "vendorHash": "sha256-K/PH8DAi6Wj+isPx9xefQcLPKnrimfItZFSPfktTias="
   },
   "linode": {
-    "hash": "sha256-6q1x34SWBCDi1jGoyNoxMAtHqxqP3qAVk1MLMLIRbg8=",
+    "hash": "sha256-X7Uslu8HjJg/Ikz48hg1aIaDNNcr3Xz4gBTPB+y949k=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v2.23.0",
+    "rev": "v2.23.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ZQkFp9UXhY61YgtPVaWOSoQIYNcaTs9V/iwZ+UDRluA="
+    "vendorHash": "sha256-lQ1+MVErv0g2Q7PSrO95Qzs0o/0hpL6JKK9E5J1EGic="
   },
   "linuxbox": {
     "hash": "sha256-MzasMVtXO7ZeZ+qEx2Z+7881fOIA0SFzSvXVHeEROtg=",
@@ -786,13 +786,13 @@
     "vendorHash": "sha256-Gn4P4NIksv8S4DmnuYArxdSQDQsyCeayJJAIkmm/I6A="
   },
   "mongodbatlas": {
-    "hash": "sha256-TitX99F/jx2q2FOSmJAGLprhFSsG4CBdmKQhzNqxotk=",
+    "hash": "sha256-8A2csdDMS5W0SzVRy7QATWUEDEZqR7gLRDpVAeROsZk=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.17.2",
+    "rev": "v1.17.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Te8Kd+1B3T3Ngo+xKgiqjnm5CZ2QRNXEQxPlaLPXNRY="
+    "vendorHash": "sha256-idXan9/OGEKY+VT2dwWwj+P1fFQIrIs2ghkthz53j/g="
   },
   "namecheap": {
     "hash": "sha256-g3i7jZBOl2umsyRk1z7Radv8a9Ry6oQ8oorv3YbY7Xo=",
@@ -813,13 +813,13 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-UxSWEejkEH5VzPWXc2RZ5ho8rtvwH6zYUEP+W/r4ny0=",
+    "hash": "sha256-hJKYz95+i1j1KhDuh5Jcm8cZzBAD3cK5+a5B1vCYBXM=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.38.1",
+    "rev": "v3.39.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wsIi0BwwSXiVhYg2h53UzqjbGpPYMHXcmmMXO20gbWw="
+    "vendorHash": "sha256-EHO78DEZ92WRDP8ZA0M9zdZ8KsPWMA2ljgFY6dX29YM="
   },
   "nomad": {
     "hash": "sha256-42QZfbbugxV6USCz0Urnhfcsf+DZKpOepC44Z37dGkw=",
@@ -831,13 +831,13 @@
     "vendorHash": "sha256-+4JU2z56W/uT+DW4+LRf1hwK0nLK9WARTY31bqMpHNM="
   },
   "ns1": {
-    "hash": "sha256-KbtMwLgwCPHilzQ22oco99q6c5+0B/9OXoc0IZXLLVk=",
+    "hash": "sha256-96q68P+d7K4UycCZ0Z5w3HWIcKwsC4/UD6WPU6yyC7M=",
     "homepage": "https://registry.terraform.io/providers/ns1-terraform/ns1",
     "owner": "ns1-terraform",
     "repo": "terraform-provider-ns1",
-    "rev": "v2.3.0",
+    "rev": "v2.3.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-kQFlW6G20x1OJNywb+KfJC1A7XSdgHlif7/szUOBuhs="
+    "vendorHash": "sha256-0RRZF7/NHo9y7SUKZbq8nNU+gFdCb0u4XJgsobNeWsk="
   },
   "null": {
     "hash": "sha256-KOwJXGvMc9Xgq4Kbr72aW6RDwzldUrU1C3aDxpKO3qE=",
@@ -859,11 +859,11 @@
     "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
   },
   "oci": {
-    "hash": "sha256-EcemPlqHB3Ggra0o1rzjxAGtcpBKpUp3/H8zS56COYA=",
+    "hash": "sha256-yiHBWcOE2QxyhzKqjSPvgqAFu0hL13idWXbwkhAhNeE=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v5.46.0",
+    "rev": "v6.1.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -940,11 +940,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-GB2U+JBMAj+ePay7CYHWv/daLzVm+V+5YoADJ6uQp+E=",
+    "hash": "sha256-sXFRN05mn5hMIqxhwIvYWlMgkrUGZqi+J29Sq9GRS90=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.14.3",
+    "rev": "v3.14.5",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1138,13 +1138,13 @@
     "vendorHash": "sha256-8W1PK4T98iK1N6EB6AVjvr1P9Ja51+kSOmYAEosxrh8="
   },
   "spotinst": {
-    "hash": "sha256-6bdOwmAKxP7EVdRV8vw6b/lewPm35zE9T0Dah6NL5FA=",
+    "hash": "sha256-SOzaTZIBEC9se942ofYHURH8btw38upJtnlDDWmLcTM=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.178.0",
+    "rev": "v1.180.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-c6vs7FypPQybAzFAsTnOGVjVLhhmj6v2/O0FU1z6X0A="
+    "vendorHash": "sha256-mgDWGimTq7AODC+ojipWUgCDKpC/EP/W8x8kbey05mQ="
   },
   "ssh": {
     "hash": "sha256-1UN5QJyjCuxs2vQYlSuz2jsu/HgGTxOoWWRcv4qcwow=",
@@ -1174,13 +1174,13 @@
     "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
   },
   "sumologic": {
-    "hash": "sha256-ei5BxMyrx4CyVYl81DUDxLdbjGJBiTZWiFylhUFTr0s=",
+    "hash": "sha256-LPJwJ6j/eZzOliHH7Ci49c5CqDckaqSm7ikLKTVhuew=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v2.30.1",
+    "rev": "v2.31.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ti0zBliq3DXVNWlqE0dO6T5UxN/p1fLMt4FK/0/j9oY="
+    "vendorHash": "sha256-YdWs2orKhbwAZSQYC73t4e/vvVxk8LrBPG9ZC38VcZE="
   },
   "tailscale": {
     "hash": "sha256-hMcnHTdxxEfAU5cd0nlK2Bc+fxfrERk4wYaRidPM4mA=",
@@ -1201,20 +1201,20 @@
     "vendorHash": "sha256-939lQsdp0Ixj9FU7IqxbOAM93GwL+X6gC3kY5/0x+AE="
   },
   "temporalcloud": {
-    "hash": "sha256-ISx/kc3Mi/EBnzfrMojRTsZEG10iPqKMB8Ac8SzBZmY=",
+    "hash": "sha256-PIqsCdIaFob/C2b1Rem/JYl7bQVvdRecDQDkcAZutz0=",
     "homepage": "https://registry.terraform.io/providers/temporalio/temporalcloud",
     "owner": "temporalio",
     "repo": "terraform-provider-temporalcloud",
-    "rev": "v0.0.8",
+    "rev": "v0.0.9",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2rYaxDDIPH46gXNILnTcHRsChpEd406r4pzWdnHMLNM="
+    "vendorHash": "sha256-/yXPJgwpUCKRs3Sf2BbuHp3pfQiheTAh7Auxk3qkTFg="
   },
   "tencentcloud": {
-    "hash": "sha256-RR7F+sZl/btVEsybmKFxG3yrE7PkvdstMuDAJwx4Ggk=",
+    "hash": "sha256-PZWBVLUfWn13B7saz2XecMv6pWWqPMOfBzqr2pErnvs=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.105",
+    "rev": "v1.81.107",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1301,13 +1301,13 @@
     "vendorHash": "sha256-rS6tigtjTGG2c4FwSjn6dvblwqYtPQS/tl7qQ+P7uVM="
   },
   "vcd": {
-    "hash": "sha256-f5uoRyf8uW/hJ9MAbi9KdViWh8CMR/FlQyJtAY5pEvI=",
+    "hash": "sha256-4+7CblKeop9Uwpl7XxjmR33XE/mcmZfOuFJrJuqzZmw=",
     "homepage": "https://registry.terraform.io/providers/vmware/vcd",
     "owner": "vmware",
     "repo": "terraform-provider-vcd",
-    "rev": "v3.12.1",
+    "rev": "v3.13.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-vKfHRTmTRxwDijEA1l4IyjBHS5kZx9LcGfprUntVg5w="
+    "vendorHash": "sha256-GKI3eXgXA92URJiwafcVchBcW7JQQ7hM14ThA6B6wKg="
   },
   "venafi": {
     "hash": "sha256-0ea6ael4NQDHFOrXsMKE/KRRpARKjrxPBFykB8Bk1JA=",
@@ -1346,13 +1346,13 @@
     "vendorHash": null
   },
   "vsphere": {
-    "hash": "sha256-BCEUFIw47o7lFmOaQ/SBk2n1bPnvzAwdxeuuMNx4OgA=",
+    "hash": "sha256-rF7gtZUPse6ewcawmxlIfCmVRKKNJMUwqVVEBaLvLbE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vsphere",
     "owner": "hashicorp",
     "repo": "terraform-provider-vsphere",
-    "rev": "v2.8.1",
+    "rev": "v2.8.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-K7T4ZGz8Us/RRWoAmT5M++m6uJKl6tyPX7T+sS7NuLs="
+    "vendorHash": "sha256-TxaYIJtEIgy0Q56Gk1JXqIUuVyVJNVH0gKmdzzDWW/E="
   },
   "vultr": {
     "hash": "sha256-gQwLGnYmB9bwpGrLNdbw+zY0MlPPrY/37rJPtindT1Q=",
@@ -1373,12 +1373,12 @@
     "vendorHash": "sha256-GRnVhGpVgFI83Lg34Zv1xgV5Kp8ioKTFV5uaqS80ATg="
   },
   "yandex": {
-    "hash": "sha256-PTlnXq30roG1ueLJM5aGSeuDJ5zukmU33T9Qf7cnxd8=",
+    "hash": "sha256-FwwjHWwUUtOwZZh0YeUbSnSLFH1Q80ALFHhd0tCAZNQ=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.122.0",
+    "rev": "v0.123.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Lo847kKBWDFeN3t7T/akaQ8gkU7b+p1BSSi4ddLLDyc="
+    "vendorHash": "sha256-K6Khgg9sAG2S/onFUlVG5mZfMtvpvVJeU6YQOyA4Liw="
   }
 }
diff --git a/pkgs/applications/networking/cyberduck/default.nix b/pkgs/applications/networking/cyberduck/default.nix
index 2fb966443718..cec9f93214df 100644
--- a/pkgs/applications/networking/cyberduck/default.nix
+++ b/pkgs/applications/networking/cyberduck/default.nix
@@ -1,17 +1,18 @@
-{ lib
-, stdenvNoCC
-, fetchurl
-, unzip
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  unzip,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cyberduck";
-  version = "8.6.0.39818";
+  version = "9.0.0.41777";
 
   src = fetchurl {
     url = "https://update.cyberduck.io/Cyberduck-${finalAttrs.version}.zip";
-    sha256 = "1iqq54n267lmmdlv8wmr9k461p49jindc1mn5wy742k08cqxc5ab";
+    hash = "sha256-oDTFkoX4uu+X5vLDHn+tGoNB/Pd9ncdFE8dGS6PT5wg=";
   };
-  dontUnpack = true;
+  sourceRoot = ".";
 
   nativeBuildInputs = [ unzip ];
 
@@ -19,7 +20,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/Applications
-    unzip -d $out/Applications $src
+    cp -r Cyberduck.app $out/Applications
 
     runHook postInstall
   '';
@@ -29,7 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://cyberduck.io";
     license = licenses.gpl3Plus;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix
index 4dfc4b97494a..0a9d9402d052 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.69";
+  "version" = "1.11.70";
   "hashes" = {
-    "desktopSrcHash" = "sha256-sSEWnvWZ6sfrHL3mqbq3T90At131C1W7N72Hb/BHKCk=";
-    "desktopYarnHash" = "0awz1dscksx4zvp99p08mdl2h6i7gbwjddanl3bhxkysxqdnwqb1";
-    "webSrcHash" = "sha256-oFSaKtig1z3jepLpwJW4i5VskMBhKUIbPsCfLQuCgMY=";
-    "webYarnHash" = "1rzq05dnkwjglira52wllsl5nqw1g8whvamjfxzgvp0nyby46nha";
+    "desktopSrcHash" = "sha256-BLRblkBcl7wGU/sJpvdvRFD0/qBaql0wqJBSZlDkXRw=";
+    "desktopYarnHash" = "1nrnqlvilgs7xzwn1xkx3yh3rwsca47r1rmbzhyylq00bqaym1wf";
+    "webSrcHash" = "sha256-kx6xQIuYSXkkBTYb+fZLL3cuHFcNj7RkC60o6Fyp8LI=";
+    "webYarnHash" = "1pqcdlgwrrjjmmd9ds8dxjb04b2bv0r230dicmbihs719yjrpwmb";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index ef57fe10ac81..7e4b468c301d 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -21,11 +21,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchurl {
     url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    hash = "sha256-eiRLQZr60BvjqqnoYEY+LswgW6e+S9mTLvBKVCXrCzI=";
+    hash = "sha256-VvXzGo8GLtkAJ/ZVOpYOboJeRqZkDbZDu9DMjaHqWus=";
   };
 
   format = "pyproject";
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
index fcd1e22cf40c..c3ab93f1b7a5 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "7.14.0";
+  version = "7.15.0";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-nRvGpAKRIPgXStrVu4qSMoW01SACV/wW/c05lLncCW8=";
+  hash = "sha256-UgWVxLOqul/XsM++1Cai7+skjByQfGDO8gBVDJNv/tw=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
deleted file mode 100644
index ea3f0b672939..000000000000
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ /dev/null
@@ -1,129 +0,0 @@
-{ lib, stdenv, fetchurl, dpkg
-, alsa-lib, atk, cairo, cups, curl, dbus, expat, fontconfig, freetype, gdk-pixbuf, glib, glibc, gnome-keyring
-, gtk3, libappindicator-gtk3, libnotify, libpulseaudio, libsecret, libv4l, nspr, nss, pango, systemd, wrapGAppsHook3, xorg
-, at-spi2-atk, libuuid, at-spi2-core, libdrm, mesa, libxkbcommon, libxshmfence }:
-
-let
-
-  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
-  # source of the latter disappears much faster.
-  version = "8.110.76.107";
-
-  rpath = lib.makeLibraryPath [
-    alsa-lib
-    atk
-    at-spi2-atk
-    at-spi2-core
-    cairo
-    cups
-    curl
-    dbus
-    expat
-    fontconfig
-    freetype
-    glib
-    glibc
-    libsecret
-    libuuid
-
-    gdk-pixbuf
-    gtk3
-    libappindicator-gtk3
-
-    gnome-keyring
-
-    libnotify
-    libpulseaudio
-    nspr
-    nss
-    pango
-    stdenv.cc.cc
-    systemd
-
-    libv4l
-    libdrm
-    mesa
-    libxkbcommon
-    libxshmfence
-    xorg.libxkbfile
-    xorg.libX11
-    xorg.libXcomposite
-    xorg.libXcursor
-    xorg.libXdamage
-    xorg.libXext
-    xorg.libXfixes
-    xorg.libXi
-    xorg.libXrandr
-    xorg.libXrender
-    xorg.libXtst
-    xorg.libXScrnSaver
-    xorg.libxcb
-  ] + ":${stdenv.cc.cc.lib}/lib64";
-
-  src =
-    if stdenv.hostPlatform.system == "x86_64-linux" then
-      fetchurl {
-        urls = [
-          "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
-          "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
-          "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
-        ];
-        sha256 = "sha256-ocXhISwEtwzPd1dOPjgIj5UQ/8sqq2gUtmZ8KZBAxKM=";
-      }
-    else
-      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
-
-in stdenv.mkDerivation {
-  pname = "skypeforlinux";
-  inherit version;
-
-  system = "x86_64-linux";
-
-  inherit src;
-
-  nativeBuildInputs = [
-    wrapGAppsHook3
-    glib # For setup hook populating GSETTINGS_SCHEMA_PATH
-  ];
-
-  buildInputs = [ dpkg ];
-
-  dontUnpack = true;
-  installPhase = ''
-    mkdir -p $out
-    dpkg -x $src $out
-    cp -av $out/usr/* $out
-    rm -rf $out/opt $out/usr
-    rm $out/bin/skypeforlinux
-
-    ln -s "$out/share/skypeforlinux/skypeforlinux" "$out/bin/skypeforlinux"
-
-    # Otherwise it looks "suspicious"
-    chmod -R g-w $out
-  '';
-
-  postFixup = ''
-    for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* -or -name \*.node\* \) ); do
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
-      patchelf --set-rpath ${rpath}:$out/share/skypeforlinux $file || true
-    done
-
-    # Fix the desktop link
-    substituteInPlace $out/share/applications/skypeforlinux.desktop \
-      --replace /usr/bin/ ""
-    substituteInPlace $out/share/applications/skypeforlinux-share.desktop \
-      --replace /usr/bin/ ""
-    substituteInPlace $out/share/kservices5/ServiceMenus/skypeforlinux.desktop \
-      --replace /usr/bin/ ""
-  '';
-
-  meta = with lib; {
-    description = "Linux client for skype";
-    homepage = "https://www.skype.com";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [ panaeon jraygauthier ];
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "skypeforlinux";
-  };
-}
diff --git a/pkgs/applications/networking/nali/default.nix b/pkgs/applications/networking/nali/default.nix
index 1eab5e5a97bc..55c23d865a45 100644
--- a/pkgs/applications/networking/nali/default.nix
+++ b/pkgs/applications/networking/nali/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule, installShellFiles }:
+{ lib, stdenv, fetchFromGitHub, buildGoModule, installShellFiles }:
 
 buildGoModule rec {
   pname = "nali";
@@ -19,11 +19,13 @@ buildGoModule rec {
   CGO_ENABLED = 0;
   ldflags = [ "-s" "-w" "-X github.com/zu1k/nali/internal/constant.Version=${version}" ];
 
-  postInstall = ''
-    installShellCompletion --cmd nali \
-      --bash <($out/bin/nali completion bash) \
-      --fish <($out/bin/nali completion fish) \
-      --zsh <($out/bin/nali completion zsh)
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      export HOME="$TMPDIR"
+      # write to temp files to avoid race condition in config loading
+      $out/bin/nali completion bash > nali.bash
+      $out/bin/nali completion fish > nali.fish
+      $out/bin/nali completion zsh  > nali.zsh
+      installShellCompletion --cmd nali nali.{bash,fish,zsh}
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/syncplay/default.nix b/pkgs/applications/networking/syncplay/default.nix
index b816da9e4b5c..956dd598d4c3 100644
--- a/pkgs/applications/networking/syncplay/default.nix
+++ b/pkgs/applications/networking/syncplay/default.nix
@@ -46,6 +46,6 @@ buildPythonApplication rec {
     description = "Free software that synchronises media players";
     license = licenses.asl20;
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ assistant Enzime ];
+    maintainers = with maintainers; [ assistant ];
   };
 }
diff --git a/pkgs/applications/networking/trayscale/default.nix b/pkgs/applications/networking/trayscale/default.nix
index 7df9b7224408..e6a474abd72d 100644
--- a/pkgs/applications/networking/trayscale/default.nix
+++ b/pkgs/applications/networking/trayscale/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "trayscale";
-  version = "0.12.5";
+  version = "0.12.6";
 
   src = fetchFromGitHub {
     owner = "DeedleFake";
     repo = "trayscale";
     rev = "v${version}";
-    hash = "sha256-EwfICUKlDnlkD1vxR1jpNybvUG4mOHfRRgk8VB9T+hs=";
+    hash = "sha256-4zjT5GrGOYaKD61EWG7gxAMwf2ZQivWlzaKH0h4jLGU=";
   };
 
-  vendorHash = "sha256-lEGFOBR0d8IfqBYdrC8awRhGcPqt0y4oOWU+xu4ClfE=";
+  vendorHash = "sha256-h5FdXlDvvorP9iOsKXxc6q3HwyB44faZGvw/Ew3LkkQ=";
 
   subPackages = [ "cmd/trayscale" ];
 
diff --git a/pkgs/applications/office/libreoffice/wrapper.nix b/pkgs/applications/office/libreoffice/wrapper.nix
index 013a2ee5575e..4f86406e5159 100644
--- a/pkgs/applications/office/libreoffice/wrapper.nix
+++ b/pkgs/applications/office/libreoffice/wrapper.nix
@@ -50,9 +50,13 @@ let
     # Add dictionaries from all NIX_PROFILES
     "--run" (lib.escapeShellArg ''
       for PROFILE in $NIX_PROFILES; do
-          HDIR="$PROFILE/share/hunspell"
-          if [ -d "$HDIR" ]; then
-              export DICPATH=$DICPATH''${DICPATH:+:}$HDIR
+          HU_DIR="$PROFILE/share/hunspell"
+          HY_DIR="$PROFILE/share/hyphen"
+          if [ -d "$HU_DIR" ]; then
+              export DICPATH=$DICPATH''${DICPATH:+:}$HU_DIR
+          fi
+          if [ -d "$HY_DIR" ]; then
+              export DICPATH=$DICPATH''${DICPATH:+:}$HY_DIR
           fi
       done
     '')
diff --git a/pkgs/applications/science/math/qalculate-qt/default.nix b/pkgs/applications/science/math/qalculate-qt/default.nix
index ba47acb80e03..b1db5ce31a79 100644
--- a/pkgs/applications/science/math/qalculate-qt/default.nix
+++ b/pkgs/applications/science/math/qalculate-qt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qalculate-qt";
-  version = "5.2.0";
+  version = "5.2.0.1";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "qalculate-qt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-suJUPeWLX+da0lQdvsDgSBRCBYmog+s4+n/w0PnPijs=";
+    hash = "sha256-kzOxOCZmu4mYYgegRBU8SMAkTiE4p1AugVAeZa8yDDE=";
   };
 
   nativeBuildInputs = [ qmake intltool pkg-config qttools wrapQtAppsHook ];
diff --git a/pkgs/applications/virtualization/tart/default.nix b/pkgs/applications/virtualization/tart/default.nix
index d0f2f3a0127e..f30c7393a751 100644
--- a/pkgs/applications/virtualization/tart/default.nix
+++ b/pkgs/applications/virtualization/tart/default.nix
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "macOS VMs on Apple Silicon to use in CI and other automations";
     homepage = "https://tart.run";
     license = licenses.fairsource09;
-    maintainers = with maintainers; [ emilytrau Enzime aduh95 ];
+    maintainers = with maintainers; [ emilytrau aduh95 ];
     mainProgram = finalAttrs.pname;
     platforms = [ "aarch64-darwin" ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
index 6c1d8a48ed47..a41927484062 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
@@ -26,7 +26,10 @@ let
 
   plugins = lib.mergeAttrsList [
     { hy3 = import ./hy3.nix; }
+    { hypr-dynamic-cursors = import ./hypr-dynamic-cursors.nix; }
     { hyprfocus = import ./hyprfocus.nix; }
+    { hyprscroller = import ./hyprscroller.nix; }
+    { hyprspace = import ./hyprspace.nix; }
     (import ./hyprland-plugins.nix)
   ];
 in
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
new file mode 100644
index 000000000000..a13cd43c58a7
--- /dev/null
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  mkHyprlandPlugin,
+  fetchFromGitHub,
+  hyprland,
+}:
+
+mkHyprlandPlugin hyprland {
+  pluginName = "hypr-dynamic-cursors";
+  version = "0-unstable-2024-07-06";
+
+  src = fetchFromGitHub {
+    owner = "VirtCode";
+    repo = "hypr-dynamic-cursors";
+    rev = "85423b074e112f28e84f6276d31d1548906a625e";
+    hash = "sha256-lCAZ/7xtOE6P7uPIX2uQgC0nDOBZefWYO3O3izRx19E=";
+  };
+
+  dontUseCmakeConfigure = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    mv out/dynamic-cursors.so $out/lib/libdynamic-cursors.so
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Plugin to make your Hyprland cursor more realistic";
+    homepage = "https://github.com/VirtCode/hypr-dynamic-cursors";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ donovanglover ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprscroller.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprscroller.nix
new file mode 100644
index 000000000000..f94da804d370
--- /dev/null
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprscroller.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  mkHyprlandPlugin,
+  hyprland,
+  cmake,
+  fetchFromGitHub,
+  unstableGitUpdater,
+}:
+
+mkHyprlandPlugin hyprland {
+  pluginName = "hyprscroller";
+  version = "0-unstable-2024-07-04";
+
+  src = fetchFromGitHub {
+    owner = "dawsers";
+    repo = "hyprscroller";
+    rev = "bef840b3f0fd3d37b5c1c9f2704b2efb60173184";
+    hash = "sha256-vkpGSseA7n0/Y+83snbEe7Z++2akdDbvv7eZzM9V3wI=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    mv hyprscroller.so $out/lib/libhyprscroller.so
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    homepage = "https://github.com/dawsers/hyprscroller";
+    description = "Hyprland layout plugin providing a scrolling layout like PaperWM";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ donovanglover ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix
new file mode 100644
index 000000000000..66d6fcd7506e
--- /dev/null
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  hyprland,
+  mkHyprlandPlugin,
+}:
+
+mkHyprlandPlugin hyprland {
+  pluginName = "hyprspace";
+  version = "0-unstable-2024-06-17";
+
+  src = fetchFromGitHub {
+    owner = "KZDKM";
+    repo = "hyprspace";
+    rev = "2f3edb68f47a8f5d99d10b322e9a85a285f53cc7";
+    hash = "sha256-iyj4D6c77uROAH9QdZjPd9SKnS/DuACMESqaEKnBgI8=";
+  };
+
+  # Fix build for Hyprland v0.41.2+
+  patches = fetchpatch {
+    url = "https://github.com/KZDKM/Hyprspace/commit/edad6cf735097b7cb4406d3fc8daddd09dfa458a.patch";
+    hash = "sha256-EVabjPymGAMPtC3Uf6lMJOInvccJhu4t09NXhXhq4RY=";
+  };
+
+  dontUseCmakeConfigure = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    mv Hyprspace.so $out/lib/libhyprspace.so
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/KZDKM/Hyprspace";
+    description = "Workspace overview plugin for Hyprland";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ donovanglover ];
+  };
+}
diff --git a/pkgs/applications/window-managers/i3/kitti3.nix b/pkgs/applications/window-managers/i3/kitti3.nix
index 3068baee5d99..1c430649102c 100644
--- a/pkgs/applications/window-managers/i3/kitti3.nix
+++ b/pkgs/applications/window-managers/i3/kitti3.nix
@@ -36,6 +36,6 @@ buildPythonApplication rec {
     description = "Kitty drop-down service for sway & i3wm";
     mainProgram = "kitti3";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh b/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
index 8cfbf649ad96..92b0200ec034 100755
--- a/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
+++ b/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
@@ -70,6 +70,7 @@ for package in *; do
         break
       else
         if hash=$(nix-prefetch-url "$url" 2>"$tmp"/error); then
+          hash="$(nix-hash --to-sri --type sha256 "$hash")"
           # If multiple remote sources are enabled, nuget will try them all
           # concurrently and use the one that responds first. We always use the
           # first source that has the package.
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index a5e722b0ac08..afe97d12ea6a 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -84,6 +84,7 @@ let
     preBuild = args.preBuild or "";
     postBuild = args.modPostBuild or "";
     sourceRoot = args.sourceRoot or "";
+    setSourceRoot = args.setSourceRoot or "";
     env = args.env or { };
 
     impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
diff --git a/pkgs/by-name/ad/adif-multitool/package.nix b/pkgs/by-name/ad/adif-multitool/package.nix
new file mode 100644
index 000000000000..4bce50660d57
--- /dev/null
+++ b/pkgs/by-name/ad/adif-multitool/package.nix
@@ -0,0 +1,25 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+buildGoModule rec {
+  pname = "adif-multitool";
+  version = "0.1.12-rc1";
+
+  vendorHash = "sha256-h7Gr8qRz6K0xCvR8tGWTeEkwgMQOTZnbEEsda4aJpbc=";
+
+  src = fetchFromGitHub {
+    owner = "flwyd";
+    repo = "adif-multitool";
+    rev = "v${version}";
+    hash = "sha256-R0Hu/yWiLUpH9qkVQuJw4bRvDeISjg67rZJLeUBPBbM=";
+  };
+
+  meta = with lib; {
+    description = "Command-line program for working with ham logfiles.";
+    homepage = "https://github.com/flwyd/adif-multitool";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mafo ];
+    mainProgram = "adifmt";
+  };
+}
diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index 17d216e3efdf..c32e3b712c10 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -34,11 +34,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Windows alt-tab on macOS";
     homepage = "https://alt-tab-macos.netlify.app";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [
-      donteatoreo
-      emilytrau
-      Enzime
-    ];
+    maintainers = with lib.maintainers; [ donteatoreo emilytrau ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
diff --git a/pkgs/by-name/ap/application-title-bar/package.nix b/pkgs/by-name/ap/application-title-bar/package.nix
index c524066c857f..e603beb56331 100644
--- a/pkgs/by-name/ap/application-title-bar/package.nix
+++ b/pkgs/by-name/ap/application-title-bar/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "application-title-bar";
-  version = "0.6.3";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "antroids";
     repo = "application-title-bar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-r15wZCioWrTr5mA0WARFd4j8zwWIWU4wEv899RSURa4=";
+    hash = "sha256-hA8aK2rd53VyYQnR0SG4KfwycCqT1EYB7iAJvkDGvYs=";
   };
 
   propagatedUserEnvPkgs = with kdePackages; [ kconfig ];
diff --git a/pkgs/by-name/au/audiobookshelf/package.nix b/pkgs/by-name/au/audiobookshelf/package.nix
index 6127e0e2b9f4..29c0d5adad66 100644
--- a/pkgs/by-name/au/audiobookshelf/package.nix
+++ b/pkgs/by-name/au/audiobookshelf/package.nix
@@ -5,7 +5,6 @@
   runCommand,
   buildNpmPackage,
   nodejs_18,
-  tone,
   ffmpeg-full,
   util-linux,
   python3,
@@ -42,7 +41,7 @@ let
   };
 
   wrapper = import ./wrapper.nix {
-    inherit stdenv ffmpeg-full tone pname nodejs getopt;
+    inherit stdenv ffmpeg-full pname nodejs getopt;
   };
 
 in buildNpmPackage {
diff --git a/pkgs/by-name/au/audiobookshelf/source.json b/pkgs/by-name/au/audiobookshelf/source.json
index 40509528147b..d0bc063a5b46 100644
--- a/pkgs/by-name/au/audiobookshelf/source.json
+++ b/pkgs/by-name/au/audiobookshelf/source.json
@@ -1,9 +1,9 @@
 {
   "owner": "advplyr",
   "repo": "audiobookshelf",
-  "rev": "964ef910b670f90456d8405a2f1bc9c97cd59cae",
-  "hash": "sha256-BWMs+SUaPg0Bi5eyD9sV8pLFO0ZGbUFO+B6GXUsPj7k=",
-  "version": "2.10.1",
-  "depsHash": "sha256-MAHkvrUztztkhSc8Gjr2YIuHKonuLO6T0YziNOyzVTM=",
-  "clientDepsHash": "sha256-rd6pes/08qwEM90YkFDY53koQbbjrftNmTJIRKJ3tGw="
+  "rev": "93114b2181d1ee5f0026fcf04c0a2946e3e96641",
+  "hash": "sha256-WrXbckMCysHgCl+ji0vCYoGu2DcjRf9wfSxzPYu7uZ8=",
+  "version": "2.11.0",
+  "depsHash": "sha256-B9ADqBGFfgNvWUgm6P+Tpg3N/tyBmeL5pyYXFTiBYpc=",
+  "clientDepsHash": "sha256-EvTUvynnukEzgC/y8v7BHj3oV5U9SeLjF+lAueS36D0="
 }
diff --git a/pkgs/by-name/au/audiobookshelf/wrapper.nix b/pkgs/by-name/au/audiobookshelf/wrapper.nix
index 787ee5ac4917..d8f16829ffb5 100644
--- a/pkgs/by-name/au/audiobookshelf/wrapper.nix
+++ b/pkgs/by-name/au/audiobookshelf/wrapper.nix
@@ -1,4 +1,4 @@
-{ stdenv, ffmpeg-full, tone, pname, nodejs, getopt }: ''
+{ stdenv, ffmpeg-full, pname, nodejs, getopt }: ''
     #!${stdenv.shell}
 
     port=8000
@@ -54,7 +54,6 @@
       SOURCE=nixpkgs \
       FFMPEG_PATH=${ffmpeg-full}/bin/ffmpeg \
       FFPROBE_PATH=${ffmpeg-full}/bin/ffprobe \
-      TONE_PATH=${tone}/bin/tone \
       CONFIG_PATH="$config" \
       METADATA_PATH="$metadata" \
       PORT="$port" \
diff --git a/pkgs/by-name/au/authentik/ldap.nix b/pkgs/by-name/au/authentik/ldap.nix
index 2d74c3911aa2..d2e40497ce9b 100644
--- a/pkgs/by-name/au/authentik/ldap.nix
+++ b/pkgs/by-name/au/authentik/ldap.nix
@@ -4,14 +4,14 @@ buildGoModule {
   pname = "authentik-ldap-outpost";
   inherit (authentik) version src;
 
-  vendorHash = "sha256-UIJBCTq7AJGUDIlZtJaWCovyxlMPzj2BCJQqthybEz4=";
+  vendorHash = "sha256-hxtyXyCfVemsjYQeo//gd68x4QO/4Vcww8i2ocsUVW8=";
 
   CGO_ENABLED = 0;
 
   subPackages = [ "cmd/ldap" ];
 
   meta = authentik.meta // {
-    description = "Authentik ldap outpost. Needed for the extendal ldap API";
+    description = "The authentik ldap outpost. Needed for the external ldap API.";
     homepage = "https://goauthentik.io/docs/providers/ldap/";
     mainProgram = "ldap";
   };
diff --git a/pkgs/by-name/au/authentik/outposts.nix b/pkgs/by-name/au/authentik/outposts.nix
index 05649628b3e8..c10ace799611 100644
--- a/pkgs/by-name/au/authentik/outposts.nix
+++ b/pkgs/by-name/au/authentik/outposts.nix
@@ -1,5 +1,4 @@
-{ callPackage }:
-
-{
+{ callPackage }: {
   ldap = callPackage ./ldap.nix { };
+  radius = callPackage ./radius.nix { };
 }
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
index 3b0132ee0a5b..bb7f88d8d078 100644
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -1,23 +1,25 @@
 { lib
 , stdenvNoCC
+, callPackages
 , fetchFromGitHub
+, fetchzip
 , buildNpmPackage
 , buildGoModule
 , runCommand
 , openapi-generator-cli
 , nodejs
-, python3
+, python312
 , codespell
 , makeWrapper }:
 
 let
-  version = "2024.2.2";
+  version = "2024.6.0";
 
   src = fetchFromGitHub {
     owner = "goauthentik";
     repo = "authentik";
     rev = "version/${version}";
-    hash = "sha256-2B1RgKY5tpDBdzguEyWqzg15w5x/dLS2ffjbnxbpINs=";
+    hash = "sha256-eYxabUUQVeURrVAaF/Ecohzw9LJj0LZyCSM43gNvajY=";
   };
 
   meta = with lib; {
@@ -32,7 +34,7 @@ let
   website = buildNpmPackage {
     pname = "authentik-website";
     inherit version src meta;
-    npmDepsHash = "sha256-paACBXG7hEQSLekxCvxNns2Tg9rN3DUgz6o3A/lAhA8=";
+    npmDepsHash = "sha256-JM+ae+zDsMdvovd2p4IJIH89KlMeDU7HOZjFbDCyehw=";
 
     NODE_ENV = "production";
     NODE_OPTIONS = "--openssl-legacy-provider";
@@ -42,11 +44,12 @@ let
     '';
 
     installPhase = ''
-      cp -r help $out
+      mkdir $out
+      cp -r build $out/help
     '';
 
-    npmInstallFlags = [ "--include=dev" ];
-    npmBuildScript = "build-docs-only";
+    npmBuildScript = "build-bundled";
+    npmFlags = [ "--ignore-scripts" ];
   };
 
   clientapi = stdenvNoCC.mkDerivation {
@@ -79,10 +82,11 @@ let
     src = runCommand "authentik-webui-source" {} ''
       mkdir -p $out/web/node_modules/@goauthentik/
       cp -r ${src}/web $out/
+      ln -s ${src}/package.json $out/
       ln -s ${src}/website $out/
       ln -s ${clientapi} $out/web/node_modules/@goauthentik/api
     '';
-    npmDepsHash = "sha256-Xtzs91m+qu7jTwr0tMeS74gjlZs4vufGGlplPVf9yew=";
+    npmDepsHash = "sha256-LAy2o/gs9lwbZT4NqD2GSsx7PCipnkthwnX9ICVpAWU=";
 
     postPatch = ''
       cd web
@@ -102,7 +106,7 @@ let
     npmInstallFlags = [ "--include=dev" ];
   };
 
-  python = python3.override {
+  python = python312.override {
     self = python;
     packageOverrides = final: prev: {
       django-tenants = prev.buildPythonPackage rec {
@@ -117,32 +121,105 @@ let
         format = "setuptools";
         doCheck = false; # Tests require postgres
 
-        propagatedBuildInputs = with prev; [
+        propagatedBuildInputs = with final; [
           django
           psycopg
           gunicorn
         ];
       };
 
+      django-cte = prev.buildPythonPackage rec {
+        pname = "django-cte";
+        version = "1.3.3";
+        src = fetchFromGitHub {
+          owner = "dimagi";
+          repo = pname;
+          rev = "v${version}";
+          hash = "sha256-OCENg94xHBeeE4A2838Cu3q2am2im2X4SkFSjc6DuhE=";
+        };
+        doCheck = false; # Tests require postgres
+        format = "setuptools";
+      };
+
+      django-pgactivity = prev.buildPythonPackage rec {
+        pname = "django-pgactivity";
+        version = "1.4.1";
+        src = fetchFromGitHub {
+          owner = "Opus10";
+          repo = pname;
+          rev = version;
+          hash = "sha256-VwH7fwLcoH2Z9D/OY9iieM0cRhyDKOpAzqQ+4YVE3vU=";
+        };
+        nativeBuildInputs = with prev; [
+          poetry-core
+        ];
+        propagatedBuildInputs = with final; [
+          django
+        ];
+        pyproject = true;
+      };
+
+      django-pglock = prev.buildPythonPackage rec {
+        pname = "django-pglock";
+        version = "1.5.1";
+        src = fetchFromGitHub {
+          owner = "Opus10";
+          repo = pname;
+          rev = version;
+          hash = "sha256-ZoEHDkGmrcNiMe/rbwXsEPZo3LD93cZp6zjftMKjLeg=";
+        };
+        nativeBuildInputs = with prev; [
+          poetry-core
+        ];
+        propagatedBuildInputs = with final; [
+          django
+          django-pgactivity
+        ];
+        pyproject = true;
+      };
+
       tenant-schemas-celery = prev.buildPythonPackage rec {
         pname = "tenant-schemas-celery";
-        version = "2.2.0";
+        version = "3.0.0";
         src = fetchFromGitHub {
           owner = "maciej-gol";
           repo = pname;
           rev = version;
-          hash = "sha256-OpIJobjWZE5GQGnHADioeoJo3A6DAKh0HdO10k4rsX4=";
+          hash = "sha256-3ZUXSAOBMtj72sk/VwPV24ysQK+E4l1HdwKa78xrDtg=";
         };
         format = "setuptools";
         doCheck = false;
 
-        propagatedBuildInputs = with prev; [
+        propagatedBuildInputs = with final; [
           freezegun
           more-itertools
           psycopg2
         ];
       };
 
+      scim2-filter-parser = prev.buildPythonPackage rec {
+        pname = "scim2-filter-parser";
+        version = "0.5.1";
+        # For some reason the normal fetchPypi does not work
+        src = fetchzip {
+          url = "https://files.pythonhosted.org/packages/54/df/ad9718acce76e81a93c57327356eecd23701625f240fbe03d305250399e6/scim2_filter_parser-0.5.1.tar.gz";
+          hash = "sha256-DZAdRj6qyySggsvJZC47vdvXbHrB1ra3qiYBEUiceJ4=";
+        };
+
+        postPatch = ''
+          substituteInPlace pyproject.toml \
+            --replace-fail 'poetry>=0.12' 'poetry-core>=1.0.0' \
+            --replace-fail 'poetry.masonry.api' 'poetry.core.masonry.api'
+        '';
+
+        nativeBuildInputs = [ prev.poetry-core ];
+        pyproject = true;
+
+        propagatedBuildInputs = with final; [
+          sly
+        ];
+      };
+
       authentik-django = prev.buildPythonPackage {
         pname = "authentik-django";
         inherit version src meta;
@@ -157,9 +234,8 @@ let
             --replace-fail './media' '/var/lib/authentik/media'
           substituteInPlace pyproject.toml \
             --replace-fail 'dumb-init = "*"' "" \
-            --replace-fail 'djangorestframework-guardian' 'djangorestframework-guardian2' \
-            --replace-fail 'version = "4.9.4"' 'version = "*"' \
-            --replace-fail 'version = "<2"' 'version = "*"'
+            --replace-fail 'djangorestframework = "3.14.0"' 'djangorestframework = "*"' \
+            --replace-fail 'djangorestframework-guardian' 'djangorestframework-guardian2'
           substituteInPlace authentik/stages/email/utils.py \
             --replace-fail 'web/' '${webui}/'
         '';
@@ -177,9 +253,11 @@ let
           deepmerge
           defusedxml
           django
+          django-cte
           django-filter
           django-guardian
           django-model-utils
+          django-pglock
           django-prometheus
           django-redis
           django-storages
@@ -190,14 +268,16 @@ let
           drf-spectacular
           duo-client
           facebook-sdk
+          fido2
           flower
           geoip2
+          google-api-python-client
           gunicorn
-          httptools
+          jsonpatch
           kubernetes
           ldap3
           lxml
-          jsonpatch
+          msgraph-sdk
           opencontainers
           packaging
           paramiko
@@ -208,8 +288,10 @@ let
           pyjwt
           pyyaml
           requests-oauthlib
+          scim2-filter-parser
           sentry-sdk
           service-identity
+          setproctitle
           structlog
           swagger-spec-validator
           tenant-schemas-celery
@@ -218,7 +300,6 @@ let
           ua-parser
           urllib3
           uvicorn
-          uvloop
           watchdog
           webauthn
           websockets
@@ -258,7 +339,7 @@ let
 
     CGO_ENABLED = 0;
 
-    vendorHash = "sha256-UIJBCTq7AJGUDIlZtJaWCovyxlMPzj2BCJQqthybEz4=";
+    vendorHash = "sha256-hxtyXyCfVemsjYQeo//gd68x4QO/4Vcww8i2ocsUVW8=";
 
     postInstall = ''
       mv $out/bin/server $out/bin/authentik
@@ -294,6 +375,8 @@ in stdenvNoCC.mkDerivation {
     runHook postInstall
   '';
 
+  passthru.outposts = callPackages ./outposts.nix { };
+
   nativeBuildInputs = [ makeWrapper ];
 
   meta = meta // {
diff --git a/pkgs/by-name/au/authentik/radius.nix b/pkgs/by-name/au/authentik/radius.nix
new file mode 100644
index 000000000000..957fd3702b77
--- /dev/null
+++ b/pkgs/by-name/au/authentik/radius.nix
@@ -0,0 +1,18 @@
+{ lib, buildGoModule, authentik }:
+
+buildGoModule {
+  pname = "authentik-radius-outpost";
+  inherit (authentik) version src;
+
+  vendorHash = "sha256-hxtyXyCfVemsjYQeo//gd68x4QO/4Vcww8i2ocsUVW8=";
+
+  CGO_ENABLED = 0;
+
+  subPackages = [ "cmd/radius" ];
+
+  meta = authentik.meta // {
+    description = "Authentik radius outpost which is used for the external radius API";
+    homepage = "https://goauthentik.io/docs/providers/radius/";
+    mainProgram = "radius";
+  };
+}
diff --git a/pkgs/by-name/ba/batik/package.nix b/pkgs/by-name/ba/batik/package.nix
new file mode 100644
index 000000000000..18bdb7c37e19
--- /dev/null
+++ b/pkgs/by-name/ba/batik/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  jre,
+  rhino,
+  stripJavaArchivesHook,
+  makeWrapper,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "batik";
+  version = "1.17";
+
+  src = fetchurl {
+    url = "mirror://apache/xmlgraphics/batik/binaries/batik-bin-${finalAttrs.version}.tar.gz";
+    hash = "sha256-sEJphF3grlwZCEt3gHHm4JF8RpvKKBLLvKXf2lu/dhA=";
+  };
+
+  nativeBuildInputs = [
+    stripJavaArchivesHook
+    makeWrapper
+  ];
+
+  buildInputs = [
+    jre
+    rhino
+  ];
+
+  patchPhase = ''
+    # Vendored dependencies
+    rm lib/rhino-*.jar
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/java
+    cp *.jar lib/*.jar $out/share/java
+    chmod +x $out/share/java/*.jar
+    classpath="$(find $out/share/java -name '*.jar' -printf '${rhino}/share/java/js.jar:%h/%f')"
+    for appName in rasterizer slideshow squiggle svgpp ttf2svg; do
+      makeWrapper ${lib.getExe jre} $out/bin/batik-$appName \
+        --add-flags "-jar $out/share/java/batik-all-${finalAttrs.version}.jar" \
+        --add-flags "-classpath $classpath" \
+        --add-flags "org.apache.batik.apps.$appName.Main"
+    done
+  '';
+
+  meta = with lib; {
+    description = "Java based toolkit for handling SVG";
+    homepage = "https://xmlgraphics.apache.org/batik";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+  };
+})
diff --git a/pkgs/by-name/bc/bcachefs-tools/fix-encrypted-boot.patch b/pkgs/by-name/bc/bcachefs-tools/fix-encrypted-boot.patch
deleted file mode 100644
index 5e14d09547f4..000000000000
--- a/pkgs/by-name/bc/bcachefs-tools/fix-encrypted-boot.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From f76ad4da12e6a65550d564bb626a1429ae75433a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Thomas=20M=C3=BChlbacher?= <tmuehlbacher@posteo.net>
-Date: Thu, 9 May 2024 23:52:47 +0200
-Subject: [PATCH 1/2] `check_for_key` before `ask_for_passphrase`
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-let's always first check if there is already a key in the keyring
-available before we try to get the key from some more involved means.
-
-Fixes: #261
-Signed-off-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
----
- src/commands/mount.rs | 13 +++++++++++--
- src/key.rs            |  4 +++-
- 2 files changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/src/commands/mount.rs b/src/commands/mount.rs
-index 9414c77f..34a741cb 100644
---- a/src/commands/mount.rs
-+++ b/src/commands/mount.rs
-@@ -344,8 +344,17 @@ fn cmd_mount_inner(opt: Cli) -> anyhow::Result<()> {
-     if block_devices_to_mount.len() == 0 {
-         Err(anyhow::anyhow!("No device found from specified parameters"))?;
-     }
--    // Check if the filesystem's master key is encrypted
--    if unsafe { bcachefs::bch2_sb_is_encrypted_and_locked(block_devices_to_mount[0].sb) } {
-+
-+    let key_name = CString::new(format!(
-+        "bcachefs:{}",
-+        block_devices_to_mount[0].sb().uuid()
-+    ))
-+    .unwrap();
-+
-+    // Check if the filesystem's master key is encrypted and we don't have a key
-+    if unsafe { bcachefs::bch2_sb_is_encrypted_and_locked(block_devices_to_mount[0].sb) }
-+        && !key::check_for_key(&key_name)?
-+    {
-         // First by password_file, if available
-         let fallback_to_unlock_policy = if let Some(passphrase_file) = &opt.passphrase_file {
-             match key::read_from_passphrase_file(&block_devices_to_mount[0], passphrase_file.as_path()) {
-diff --git a/src/key.rs b/src/key.rs
-index d0018805..568b3cdb 100644
---- a/src/key.rs
-+++ b/src/key.rs
-@@ -58,7 +58,7 @@ impl fmt::Display for UnlockPolicy {
-     }
- }
- 
--fn check_for_key(key_name: &std::ffi::CStr) -> anyhow::Result<bool> {
-+pub fn check_for_key(key_name: &std::ffi::CStr) -> anyhow::Result<bool> {
-     use bch_bindgen::keyutils::{self, keyctl_search};
-     let key_name = key_name.to_bytes_with_nul().as_ptr() as *const _;
-     let key_type = c_str!("user");
-@@ -86,10 +86,12 @@ fn wait_for_unlock(uuid: &uuid::Uuid) -> anyhow::Result<()> {
-     }
- }
- 
-+// blocks indefinitely if no input is available on stdin
- fn ask_for_passphrase(sb: &bch_sb_handle) -> anyhow::Result<()> {
-     let passphrase = if stdin().is_terminal() {
-         rpassword::prompt_password("Enter passphrase: ")?
-     } else {
-+        info!("Trying to read passphrase from stdin...");
-         let mut line = String::new();
-         stdin().read_line(&mut line)?;
-         line
-
-From 734ccc58f42c3cccb0960bdd84808839e2b62ca9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Thomas=20M=C3=BChlbacher?= <tmuehlbacher@posteo.net>
-Date: Sun, 12 May 2024 19:39:19 +0200
-Subject: [PATCH 2/2] fix unfortunate typo
-
-causes mounting encrypted devices to become stuck in a busy loop.
----
- include/crypto/skcipher.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/crypto/skcipher.h b/include/crypto/skcipher.h
-index 70905a5a..833729dc 100644
---- a/include/crypto/skcipher.h
-+++ b/include/crypto/skcipher.h
-@@ -112,7 +112,7 @@ static inline void skcipher_request_set_sync_tfm(struct skcipher_request *req,
- 	skcipher_request_set_tfm(req, &tfm->base);
- }
- 
--#define skcipher_request_set_callback(...) do {} while (9)
-+#define skcipher_request_set_callback(...) do {} while (0)
- 
- static inline void skcipher_request_set_crypt(
- 	struct skcipher_request *req,
diff --git a/pkgs/by-name/bc/bcachefs-tools/package.nix b/pkgs/by-name/bc/bcachefs-tools/package.nix
index f6f06296ac92..ee753b3f158d 100644
--- a/pkgs/by-name/bc/bcachefs-tools/package.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/package.nix
@@ -27,15 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.7.0-unstable-2024-05-09";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
-    # FIXME: switch to a tagged release once available > 1.7.0
-    # Fix for https://github.com/NixOS/nixpkgs/issues/313350
-    rev = "3ac510f6a41feb1b695381fa30869d557c00b822";
-    hash = "sha256-ZmkeYPiCy7vkXnMFbtUF4761K+I+Ef7UbmSY7dJG09U=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-1GsRBAVAfD0SAM1gk8W+bX7MtxunGKOLtXweL4rrf9Q=";
   };
 
   nativeBuildInputs = [
@@ -63,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     src = finalAttrs.src;
-    hash = "sha256-RsRz/nb8L+pL1U4l6RnvqeDFddPvcBFH4wdV7G60pxA=";
+    hash = "sha256-rabiNqw4hg0Js8VadxfkhNLIsrKfMuoKa5lFIfSMNPY=";
   };
 
   makeFlags = [
@@ -80,18 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
   # FIXME: Try enabling this once the default linux kernel is at least 6.7
   doCheck = false; # needs bcachefs module loaded on builder
 
-  patches = [
-    # code refactoring of bcachefs-tools broke reading passphrases from stdin (vs. terminal)
-    # upstream issue https://github.com/koverstreet/bcachefs-tools/issues/261
-    ./fix-encrypted-boot.patch
-    # https://github.com/koverstreet/bcachefs-tools/pull/305
-    (fetchpatch {
-      name = "use-ar-var-in-makefile.patch";
-      url = "https://github.com/koverstreet/bcachefs-tools/commit/91e67ab2bd48fa135a1f5109b23899a4f1019a03.patch";
-      sha256 = "sha256-nB4Tgcwa8eeasIDQ4rrYORie/X8LMuCSRi+WJNw+R/U=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace Makefile \
       --replace-fail "target/release/bcachefs" "target/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/bcachefs"
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index aeced48e70f3..1e237c32aa63 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -139,7 +139,7 @@ in buildNpmPackage rec {
 
     pushd ${cargoRoot}
     export HOME=$(mktemp -d)
-    export -f cargoCheckHook runHook _eval _callImplicitHook
+    export -f cargoCheckHook runHook _eval _callImplicitHook _logHook
     export cargoCheckType=release
     dbus-run-session \
       --config-file=${dbus}/share/dbus-1/session.conf \
diff --git a/pkgs/by-name/bl/blend2d/package.nix b/pkgs/by-name/bl/blend2d/package.nix
new file mode 100644
index 000000000000..dd5867950e9c
--- /dev/null
+++ b/pkgs/by-name/bl/blend2d/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  asmjit,
+}:
+
+stdenv.mkDerivation {
+  pname = "blend2d";
+  # Note: this is an outdated version for pdf4qt, but vcpkg also uses it
+  # See 'Commit Hashes' in https://blend2d.com/download.html for newest
+  # If the newest version is needed, we can rename this package.
+  version = "0.10";
+
+  src = fetchFromGitHub {
+    owner = "blend2d";
+    repo = "blend2d";
+    rev = "452d549751188b04367b5af46c040cb737f5f76c";
+    hash = "sha256-LDhnXsp/V1A3YqVyjBVaL7/V6Nhts/1E9hRhl2P293o=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [ (lib.cmakeFeature "ASMJIT_DIR" (toString asmjit.src)) ];
+
+  meta = {
+    description = "2D Vector Graphics Engine Powered by a JIT Compiler";
+    homepage = "https://blend2d.com";
+    license = lib.licenses.zlib;
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/bl/blockbench/package.nix b/pkgs/by-name/bl/blockbench/package.nix
index f0770df909c7..2f72c033f10e 100644
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@@ -7,7 +7,7 @@
   imagemagick,
   copyDesktopItems,
   makeDesktopItem,
-  electron
+  electron,
 }:
 
 let
@@ -15,13 +15,13 @@ let
 in
 buildNpmPackage rec {
   pname = "blockbench";
-  version = "4.10.2";
+  version = "4.10.4";
 
   src = fetchFromGitHub {
     owner = "JannisX11";
     repo = "blockbench";
     rev = "v${version}";
-    hash = "sha256-Ch+vPSvdqfJF2gNgZN2x5KSY1S1CYfHCyMyUf4W+Vn8=";
+    hash = "sha256-TjT93nx52PxuHuW4NONTfI3G7+Dl0NFX2aKpZDEF8+8=";
   };
 
   nativeBuildInputs =
@@ -31,7 +31,7 @@ buildNpmPackage rec {
       copyDesktopItems
     ];
 
-  npmDepsHash = "sha256-au6GzBTxPcYcqrPEnQ+yEhVRdAbiUa/Ocq7UCPdiox4=";
+  npmDepsHash = "sha256-WkOn1bLJ9xmJdQcY6ak+hs/YW+crIXhTWA6tjMSVq9I=";
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
 
@@ -69,7 +69,7 @@ buildNpmPackage rec {
 
       for size in 16 32 48 64 128 256 512; do
         mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
-        convert -resize "$size"x"$size" icon.png $out/share/icons/hicolor/"$size"x"$size"/apps/blockbench.png
+        magick convert -resize "$size"x"$size" icon.png $out/share/icons/hicolor/"$size"x"$size"/apps/blockbench.png
       done
 
       makeWrapper ${lib.getExe electron} $out/bin/blockbench \
@@ -101,8 +101,6 @@ buildNpmPackage rec {
     homepage = "https://blockbench.net/";
     license = lib.licenses.gpl3Only;
     mainProgram = "blockbench";
-    maintainers = with lib.maintainers; [
-      tomasajt
-    ];
+    maintainers = with lib.maintainers; [ tomasajt ];
   };
 }
diff --git a/pkgs/by-name/bl/bluetility/package.nix b/pkgs/by-name/bl/bluetility/package.nix
index 1188ffd2b40d..8aadf48b026c 100644
--- a/pkgs/by-name/bl/bluetility/package.nix
+++ b/pkgs/by-name/bl/bluetility/package.nix
@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://github.com/jnross/Bluetility";
     license = licenses.mit;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })
diff --git a/pkgs/servers/calibre-web/db-migrations.patch b/pkgs/by-name/ca/calibre-web/db-migrations.patch
similarity index 100%
rename from pkgs/servers/calibre-web/db-migrations.patch
rename to pkgs/by-name/ca/calibre-web/db-migrations.patch
diff --git a/pkgs/servers/calibre-web/default-logger.patch b/pkgs/by-name/ca/calibre-web/default-logger.patch
similarity index 100%
rename from pkgs/servers/calibre-web/default-logger.patch
rename to pkgs/by-name/ca/calibre-web/default-logger.patch
diff --git a/pkgs/servers/calibre-web/default.nix b/pkgs/by-name/ca/calibre-web/package.nix
similarity index 59%
rename from pkgs/servers/calibre-web/default.nix
rename to pkgs/by-name/ca/calibre-web/package.nix
index 0d0afd185f41..b2045d0570a3 100644
--- a/pkgs/servers/calibre-web/default.nix
+++ b/pkgs/by-name/ca/calibre-web/package.nix
@@ -1,6 +1,7 @@
 { lib
 , fetchFromGitHub
 , nixosTests
+, nix-update-script
 , python3
 }:
 
@@ -13,28 +14,33 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "calibre-web";
-  version = "0.6.21";
+  version = "0.6.22";
 
   src = fetchFromGitHub {
     owner = "janeczku";
     repo = "calibre-web";
     rev = version;
-    hash = "sha256-tRrOquetn3P2NmrXq7DQHRGP1sWnLR7bV2Lw0W/lUPQ=";
+    hash = "sha256-nWZmDasBH+DW/+Cvw510mOv11CXorRnoBwNFpoKPErY=";
   };
 
   propagatedBuildInputs = with python.pkgs; [
-    apscheduler
     advocate
+    apscheduler
+    babel
+    bleach
     chardet
+    flask
     flask-babel
+    flask-limiter
     flask-login
     flask-principal
     flask-wtf
-    flask-limiter
     iso-639
-    jsonschema
     lxml
     pypdf
+    python-magic
+    pytz
+    regex
     requests
     sqlalchemy
     tornado
@@ -54,36 +60,23 @@ python.pkgs.buildPythonApplication rec {
     ./db-migrations.patch
   ];
 
-  # calibre-web doesn't follow setuptools directory structure. The following is taken from the script
-  # that calibre-web's maintainer is using to package it:
-  # https://github.com/OzzieIsaacs/calibre-web-test/blob/master/build/make_release.py
+  # calibre-web doesn't follow setuptools directory structure.
   postPatch = ''
     mkdir -p src/calibreweb
     mv cps.py src/calibreweb/__init__.py
     mv cps src/calibreweb
 
-    sed -i "/backports_abc/d" setup.cfg
-
     substituteInPlace setup.cfg \
-      --replace "cps = calibreweb:main" "calibre-web = calibreweb:main" \
-      --replace "APScheduler>=3.6.3,<3.10.0" "APScheduler>=3.6.3" \
-      --replace "chardet>=3.0.0,<4.1.0" "chardet>=3.0.0,<6" \
-      --replace "Flask>=1.0.2,<2.1.0" "Flask>=1.0.2" \
-      --replace "Flask-Babel>=0.11.1,<3.1.0" "Flask-Babel>=0.11.1" \
-      --replace "Flask-Login>=0.3.2,<0.6.2" "Flask-Login>=0.3.2" \
-      --replace "flask-wtf>=0.14.2,<1.1.0" "flask-wtf>=0.14.2" \
-      --replace "lxml>=3.8.0,<4.9.0" "lxml>=3.8.0" \
-      --replace "tornado>=4.1,<6.2" "tornado>=4.1,<7" \
-      --replace "PyPDF>=3.0.0,<3.6.0" "PyPDF>=3.0.0" \
-      --replace "requests>=2.11.1,<2.29.0" "requests" \
-      --replace "unidecode>=0.04.19,<1.4.0" "unidecode>=0.04.19" \
-      --replace "werkzeug<2.1.0" ""
+      --replace-fail "cps = calibreweb:main" "calibre-web = calibreweb:main"
   '';
 
   # Upstream repo doesn't provide any tests.
   doCheck = false;
 
-  passthru.tests.calibre-web = nixosTests.calibre-web;
+  passthru = {
+    tests.calibre-web = nixosTests.calibre-web;
+    updateScript = nix-update-script { };
+  };
 
   meta = with lib; {
     description = "Web app for browsing, reading and downloading eBooks stored in a Calibre database";
diff --git a/pkgs/by-name/ca/castxml/package.nix b/pkgs/by-name/ca/castxml/package.nix
index ba76cb9a445d..c4ce27fa9247 100644
--- a/pkgs/by-name/ca/castxml/package.nix
+++ b/pkgs/by-name/ca/castxml/package.nix
@@ -20,13 +20,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "castxml";
-  version = "0.6.6";
+  version = "0.6.8";
 
   src = fetchFromGitHub {
     owner = "CastXML";
     repo = "CastXML";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-icTos9HboZXvojQPX+pRkpBYiZ5SXSMb9XtvRnXNHuo=";
+    hash = "sha256-J4Z/NjCVOq4QS7ncCi87P5YPgqRwFyDAc14uS5T7s6M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index fff4e336b523..b43eb1c3e30d 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -12,7 +12,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "24.1.1";
+  version = "24.1.2";
 
   src =
     let
@@ -25,10 +25,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-33W7uDxzfAQ5gH10sI4IbzmHl8SxQLYj88C/BGOoRks=";
-        aarch64-linux = "sha256-ZAr9vymCdLFAYiXEXtT+97x1tY5mrbr2N6INj4Bp4Nk=";
-        x86_64-darwin = "sha256-dgOtufARRVmwtXl+csmr2sMBzDvq+5XRotOQrTz8jys=";
-        aarch64-darwin = "sha256-R5TQJq+sRUFHH8EuaXgeSJUOnhepbCJLTUmO0FMOgzE=";
+        x86_64-linux = "sha256-TQZl5TEAAEeC+/dK4F7nbyPOU3YuXheLwrFY/8eGtoA=";
+        aarch64-linux = "sha256-fnIRQsqg6WxD4ptxJT04jvaqDe7jPJ/zVnBL7k9ph38=";
+        x86_64-darwin = "sha256-gwkCsVdSiWCCd0B3FiSvVnZiPJfWtnAgrAVPZh+nko0=";
+        aarch64-darwin = "sha256-QXG/5AfEQNFDcQhV+oK117bKZnSZ32P4NB4p+qUKQIM=";
       };
     in
     fetchurl {
diff --git a/pkgs/by-name/di/digikam/package.nix b/pkgs/by-name/di/digikam/package.nix
index 27e7403c81d0..8a83cf6583cc 100644
--- a/pkgs/by-name/di/digikam/package.nix
+++ b/pkgs/by-name/di/digikam/package.nix
@@ -142,7 +142,7 @@ stdenv.mkDerivation rec {
     description = "Photo Management Program";
     license = licenses.gpl2;
     homepage = "https://www.digikam.org";
-    maintainers = with maintainers; [ spacefault ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
     mainProgram = "digikam";
   };
diff --git a/pkgs/by-name/ds/dssat/package.nix b/pkgs/by-name/ds/dssat/package.nix
new file mode 100644
index 000000000000..95653e2ebb7c
--- /dev/null
+++ b/pkgs/by-name/ds/dssat/package.nix
@@ -0,0 +1,74 @@
+{
+  stdenv,
+  lib,
+  cmake,
+  glibc,
+  gfortran,
+  makeWrapper,
+  fetchFromGitHub,
+  fetchpatch,
+  dos2unix,
+  dataRepo ? fetchFromGitHub {
+    owner = "DSSAT";
+    repo = "dssat-csm-data";
+    rev = "v4.8.2.8";
+    hash = "sha256-hbSBKEvdSd1lfbemfp4Lk4/JcGMXGVjm1x7P7lmmuA0=";
+  },
+}:
+let
+  # Temporary patch to fix 80 chars limit on paths
+  # https://github.com/DSSAT/dssat-csm-os/pull/417/
+  charLimitPatch = fetchpatch {
+    url = "https://github.com/DSSAT/dssat-csm-os/pull/417/commits/9215012a297c074f392b5e7eb90b8c20495f13f7.patch";
+    hash = "sha256-WwJR5lnWtR3aYWZmk8pBC0/qaRqY0UrWHIaYp2ajImE=";
+  };
+in
+stdenv.mkDerivation (final: {
+  pname = "dssat";
+  version = "4.8.2.12";
+
+  src = fetchFromGitHub {
+    owner = "DSSAT";
+    repo = "dssat-csm-os";
+    rev = "refs/tags/v${final.version}";
+    sha256 = "sha256-8OaTM7IXFZjlelx5O4O+bVNQj4dIhGzIk2iCfpqI8uA=";
+  };
+
+  # maintainers are on windows and have CRLF endings in their files
+  # And github returns a patch file in unix format only.
+  patchPhase = ''
+    runHook prePatch
+    cp ${charLimitPatch} ./limit-path.patch
+    unix2dos ./limit-path.patch
+    patch --binary -p1 < ./limit-path.patch
+    runHook postPatch
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    dos2unix
+    gfortran
+    makeWrapper
+  ];
+
+  buildInputs = lib.optionals stdenv.isLinux [ glibc.static ];
+
+  cmakeFlags = [ "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/share/dssat/" ];
+
+  postInstall = ''
+    mkdir -p $out/share/dssat/Data
+    cp -r $src/Data/* $out/share/dssat/Data/
+    cp -r ${dataRepo}/* $out/share/dssat/Data/
+    makeWrapper $out/share/dssat/dscsm048 $out/bin/dscsm048
+  '';
+
+  meta = {
+    homepage = "https://github.com/DSSAT/dssat-csm-os";
+    description = "Cropping System Model";
+    mainProgram = "dscsm048";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ pcboy ];
+    platforms = lib.platforms.unix;
+    broken = stdenv.isAarch64 && stdenv.isLinux;
+  };
+})
diff --git a/pkgs/applications/audio/easyeffects/default.nix b/pkgs/by-name/ea/easyeffects/package.nix
similarity index 61%
rename from pkgs/applications/audio/easyeffects/default.nix
rename to pkgs/by-name/ea/easyeffects/package.nix
index 4730df0464d6..71f0882371af 100644
--- a/pkgs/applications/audio/easyeffects/default.nix
+++ b/pkgs/by-name/ea/easyeffects/package.nix
@@ -1,53 +1,59 @@
-{ lib
-, stdenv
-, appstream-glib
-, desktop-file-utils
-, deepfilternet
-, fetchFromGitHub
-, calf
-, fftw
-, fftwFloat
-, fmt_9
-, glib
-, gsl
-, gtk4
-, itstool
-, ladspaH
-, libadwaita
-, libbs2b
-, libebur128
-, libportal-gtk4
-, libsamplerate
-, libsigcxx30
-, libsndfile
-, lilv
-, lsp-plugins
-, lv2
-, mda_lv2
-, meson
-, ninja
-, nlohmann_json
-, pipewire
-, pkg-config
-, rnnoise
-, rubberband
-, speexdsp
-, soundtouch
-, tbb
-, wrapGAppsHook4
-, zam-plugins
-, zita-convolver
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  appstream-glib,
+  calf,
+  deepfilternet,
+  desktop-file-utils,
+  fftw,
+  fftwFloat,
+  fmt_9,
+  glib,
+  gsl,
+  gtk4,
+  itstool,
+  ladspaH,
+  libadwaita,
+  libbs2b,
+  libebur128,
+  libportal-gtk4,
+  libsamplerate,
+  libsigcxx30,
+  libsndfile,
+  lilv,
+  lsp-plugins,
+  lv2,
+  mda_lv2,
+  meson,
+  ninja,
+  nix-update-script,
+  nlohmann_json,
+  pipewire,
+  pkg-config,
+  rnnoise,
+  rubberband,
+  speexdsp,
+  soundtouch,
+  tbb,
+  wrapGAppsHook4,
+  zam-plugins,
+  zita-convolver,
 }:
+let
+  # Fix crashes with speexdsp effects
+  speexdsp' = speexdsp.override { withFftw3 = false; };
+in
 
 stdenv.mkDerivation rec {
   pname = "easyeffects";
-  version = "7.1.6";
+  version = "7.1.7";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     rev = "v${version}";
-    hash = "sha256-NViRZHNgsweoD1YbyWYrRTZPKTCkKk3fGDLLYDD7JfA=";
+    hash = "sha256-y7we7/MQWweAoZkM8SuHiOTVyWFj9/foufLYBum/KKc=";
   };
 
   nativeBuildInputs = [
@@ -83,7 +89,7 @@ stdenv.mkDerivation rec {
     rnnoise
     rubberband
     soundtouch
-    speexdsp
+    speexdsp'
     tbb
     zita-convolver
   ];
@@ -110,13 +116,17 @@ stdenv.mkDerivation rec {
 
   separateDebugInfo = true;
 
-  meta = with lib; {
-    changelog = "https://github.com/wwmm/easyeffects/blob/v${version}/CHANGELOG.md";
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
     description = "Audio effects for PipeWire applications";
     homepage = "https://github.com/wwmm/easyeffects";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.linux;
+    changelog = "https://github.com/wwmm/easyeffects/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ getchoo ];
     mainProgram = "easyeffects";
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/gl/glance/package.nix b/pkgs/by-name/gl/glance/package.nix
index 2b4787811775..95b428e0be67 100644
--- a/pkgs/by-name/gl/glance/package.nix
+++ b/pkgs/by-name/gl/glance/package.nix
@@ -1,7 +1,9 @@
-{ lib,
-buildGoModule,
-fetchFromGitHub,
-nix-update-script
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  nixosTests,
 }:
 
 buildGoModule rec {
@@ -10,7 +12,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "glanceapp";
-    repo = pname;
+    repo = "glance";
     rev = "v${version}";
     hash = "sha256-37DmLZ8ESJwB2R8o5WjeypKsCQwarF3x8UYz1OQT/tM=";
   };
@@ -19,14 +21,19 @@ buildGoModule rec {
 
   excludedPackages = [ "scripts/build-and-ship" ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      service = nixosTests.glance;
+    };
+  };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/glanceapp/glance";
     changelog = "https://github.com/glanceapp/glance/releases/tag/v${version}";
     description = "Self-hosted dashboard that puts all your feeds in one place";
     mainProgram = "glance";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ dvn0 ];
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ dvn0 ];
   };
 }
diff --git a/pkgs/by-name/gr/gr-framework/package.nix b/pkgs/by-name/gr/gr-framework/package.nix
index 533391a9504e..1bb6e2ac7393 100644
--- a/pkgs/by-name/gr/gr-framework/package.nix
+++ b/pkgs/by-name/gr/gr-framework/package.nix
@@ -1,37 +1,36 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, nix-update-script
-, qt5
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  qt5,
 
-, cmake
+  cmake,
 
-, cairo
-, ffmpeg
-, freetype
-, ghostscript
-, glfw
-, libjpeg
-, libtiff
-, qhull
-, xorg
-, zeromq
+  cairo,
+  ffmpeg,
+  freetype,
+  ghostscript,
+  glfw,
+  libjpeg,
+  libtiff,
+  qhull,
+  xorg,
+  zeromq,
 }:
 
 stdenv.mkDerivation rec {
   pname = "gr-framework";
-  version = "0.73.5";
+  version = "0.73.6";
 
   src = fetchFromGitHub {
     owner = "sciapp";
     repo = "gr";
     rev = "v${version}";
-    hash = "sha256-9Py2r774GaUXWhF3yO3ceT1rPi/uqMVZVAo0xs9n+I0=";
+    hash = "sha256-XzOII13XwxkPZhtL4USkmUmJTL7dZImx4yVYJmhcn08=";
   };
 
-  patches = [
-    ./patches/use-the-module-mode-to-search-for-the-LibXml2-package.patch
-  ];
+  patches = [ ./use-the-module-mode-to-search-for-the-LibXml2-package.patch ];
 
   nativeBuildInputs = [
     cmake
@@ -64,7 +63,7 @@ stdenv.mkDerivation rec {
     description = "GR framework is a graphics library for visualisation applications";
     homepage = "https://gr-framework.org";
     license = licenses.mit;
-    platforms = platforms.unix;
     maintainers = with maintainers; [ paveloom ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/by-name/gr/gr-framework/patches/use-the-module-mode-to-search-for-the-LibXml2-package.patch b/pkgs/by-name/gr/gr-framework/patches/use-the-module-mode-to-search-for-the-LibXml2-package.patch
deleted file mode 100644
index 41fdcd5ae72b..000000000000
--- a/pkgs/by-name/gr/gr-framework/patches/use-the-module-mode-to-search-for-the-LibXml2-package.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 78a86da95c7227cbfd0f3073841df5409a576837 Mon Sep 17 00:00:00 2001
-From: Pavel Sobolev <paveloomm@gmail.com>
-Date: Wed, 31 Jan 2024 16:50:36 +0000
-Subject: [PATCH] Use the module mode to search for the `LibXml2` package.
-
----
- CMakeLists.txt | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 5f865a5b..5550b493 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -117,7 +117,7 @@ if(GR_USE_BUNDLED_LIBRARIES)
-   # (`ONLY_CMAKE_FIND_ROOT_PATH` option is not inherited to `find_package` calls within the LibXml2 config file)
-   find_package(LibXml2 NO_MODULE ONLY_CMAKE_FIND_ROOT_PATH)
- else()
--  find_package(LibXml2 NO_MODULE)
-+  find_package(LibXml2 MODULE)
- endif()
-
- # Find the following packages only in 3rdparty, if `GR_USE_BUNDLED_LIBRARIES` is set
---
-2.42.0
-
diff --git a/pkgs/by-name/gr/gr-framework/use-the-module-mode-to-search-for-the-LibXml2-package.patch b/pkgs/by-name/gr/gr-framework/use-the-module-mode-to-search-for-the-LibXml2-package.patch
new file mode 100644
index 000000000000..2712387a2cfb
--- /dev/null
+++ b/pkgs/by-name/gr/gr-framework/use-the-module-mode-to-search-for-the-LibXml2-package.patch
@@ -0,0 +1,25 @@
+From 47063bf00060dd6e8ccb384770a7c04dc534dce0 Mon Sep 17 00:00:00 2001
+From: Pavel Sobolev <paveloomm@gmail.com>
+Date: Wed, 19 Jun 2024 21:17:33 +0300
+Subject: [PATCH] Use the module mode to search for the `LibXml2` package.
+
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index ed36d99d..6031dc77 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -123,7 +123,7 @@ else()
+   # Therefore, disable the inspection of the `PATH` variable by setting `NO_SYSTEM_ENVIRONMENT_PATH` option.
+   # See <https://cmake.org/cmake/help/v3.30/command/find_package.html#:~:text=Search the standard system environment
+   # variables> for more details.
+-  find_package(LibXml2 NO_MODULE NO_SYSTEM_ENVIRONMENT_PATH)
++  find_package(LibXml2 MODULE)
+ endif()
+
+ # Find the following packages only in 3rdparty, if `GR_USE_BUNDLED_LIBRARIES` is set
+--
+2.45.1
+
diff --git a/pkgs/applications/networking/irc/hexchat/default.nix b/pkgs/by-name/he/hexchat/package.nix
similarity index 56%
rename from pkgs/applications/networking/irc/hexchat/default.nix
rename to pkgs/by-name/he/hexchat/package.nix
index 4aafcc272638..1834fceda867 100644
--- a/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/pkgs/by-name/he/hexchat/package.nix
@@ -1,8 +1,24 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, gtk2, lua, perl, python3Packages
-, pciutils, dbus-glib, libcanberra-gtk2, libproxy
-, enchant2, libnotify, openssl, isocodes
-, desktop-file-utils
-, meson, ninja, makeWrapper
+{
+  dbus-glib,
+  desktop-file-utils,
+  enchant2,
+  fetchFromGitHub,
+  gtk2,
+  isocodes,
+  lib,
+  libcanberra-gtk2,
+  libnotify,
+  libproxy,
+  lua,
+  makeWrapper,
+  meson,
+  ninja,
+  openssl,
+  pciutils,
+  perl,
+  pkg-config,
+  python3Packages,
+  stdenv,
 }:
 
 stdenv.mkDerivation rec {
@@ -13,17 +29,9 @@ stdenv.mkDerivation rec {
     owner = "hexchat";
     repo = "hexchat";
     rev = "v${version}";
-    sha256 = "sha256-rgaXqXbBWlfSyz+CT0jRLyfGOR1cYYnRhEAu7AsaWus=";
+    hash = "sha256-rgaXqXbBWlfSyz+CT0jRLyfGOR1cYYnRhEAu7AsaWus=";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config makeWrapper ];
-
-  buildInputs = [
-    gtk2 lua perl python3Packages.python python3Packages.cffi pciutils dbus-glib libcanberra-gtk2 libproxy
-    libnotify openssl desktop-file-utils
-    isocodes
-  ];
-
   #hexchat and hexchat-text loads enchant spell checking library at run time and so it needs to have route to the path
   postPatch = ''
     sed -i "s,libenchant-2.so.2,${enchant2}/lib/libenchant-2.so.2,g" src/fe-gtk/sexy-spell-entry.c
@@ -39,17 +47,44 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  mesonFlags = [ "-Dwith-lua=lua" "-Dtext-frontend=true" ];
+  mesonFlags = [
+    "-Dwith-lua=lua"
+    "-Dtext-frontend=true"
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    dbus-glib
+    desktop-file-utils
+    gtk2
+    isocodes
+    libcanberra-gtk2
+    libnotify
+    libproxy
+    lua
+    openssl
+    pciutils
+    perl
+    python3Packages.cffi
+    python3Packages.python
+    python3Packages.setuptools
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/hexchat --prefix PYTHONPATH : "$PYTHONPATH"
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Popular and easy to use graphical IRC (chat) client";
     homepage = "https://hexchat.github.io/";
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ romildo ];
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ romildo ];
   };
 }
diff --git a/pkgs/by-name/hy/hypre/package.nix b/pkgs/by-name/hy/hypre/package.nix
new file mode 100644
index 000000000000..1b5c918bee45
--- /dev/null
+++ b/pkgs/by-name/hy/hypre/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  mpi,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  name = "hypre";
+  version = "2.31.0";
+
+  src = fetchFromGitHub {
+    owner = "hypre-space";
+    repo = "hypre";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-eFOyM3IzQUNm7cSnORA3NrKYotEBmLKC8mi+fcwPMQA=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  buildInputs = [ mpi ];
+
+  configureFlags = [
+    "--enable-mpi"
+    "--enable-shared"
+  ];
+
+  preBuild = ''
+    makeFlagsArray+=(AR="ar -rcu")
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{include,lib}
+    cp -r hypre/include/* $out/include
+    cp -r hypre/lib/* $out/lib
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Parallel solvers for sparse linear systems featuring multigrid methods.";
+    homepage = "https://computing.llnl.gov/projects/hypre-scalable-linear-solvers-multigrid-methods";
+    platforms = platforms.unix;
+    license = licenses.mit;
+    maintainers = with maintainers; [ mkez ];
+  };
+})
diff --git a/pkgs/by-name/hy/hyprlock/package.nix b/pkgs/by-name/hy/hyprlock/package.nix
index f7181c1a9bec..307475ecb535 100644
--- a/pkgs/by-name/hy/hyprlock/package.nix
+++ b/pkgs/by-name/hy/hyprlock/package.nix
@@ -7,6 +7,7 @@
   libGL,
   libxkbcommon,
   hyprlang,
+  hyprutils,
   pam,
   wayland,
   wayland-protocols,
@@ -17,19 +18,18 @@
   pango,
   libdrm,
   mesa,
-  unstableGitUpdater,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlock";
-  version = "0.3.0-unstable-2024-04-24";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprlock";
-    # FIXME: Change to a stable release once available
-    rev = "415262065fff0a04b229cd00165f346a86a0a73a";
-    hash = "sha256-jla5Wo0Qt3NEnD0OjNj85BGw0pR4Zlz5uy8AqHH7tuE=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Dd/DK6FKiwVhr6PygCieEjzn7AFf6xijw6mdhquLnkw=";
   };
 
   strictDeps = true;
@@ -43,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     cairo
     file
     hyprlang
+    hyprutils
     libdrm
     libGL
     libjpeg
@@ -55,15 +56,13 @@ stdenv.mkDerivation (finalAttrs: {
     wayland-protocols
   ];
 
-  passthru.updateScript = unstableGitUpdater {
-    tagPrefix = "v";
-  };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Hyprland's GPU-accelerated screen locking utility";
     homepage = "https://github.com/hyprwm/hyprlock";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ iynaix ];
     mainProgram = "hyprlock";
     platforms = [
       "aarch64-linux"
diff --git a/pkgs/by-name/ic/icloudpd/package.nix b/pkgs/by-name/ic/icloudpd/package.nix
index ea7386c4e8d8..b67ef56b803b 100644
--- a/pkgs/by-name/ic/icloudpd/package.nix
+++ b/pkgs/by-name/ic/icloudpd/package.nix
@@ -75,6 +75,6 @@ python3Packages.buildPythonApplication rec {
     description = "iCloud Photos Downloader";
     license = licenses.mit;
     mainProgram = "icloudpd";
-    maintainers = with maintainers; [ anpin Enzime jnsgruk ];
+    maintainers = with maintainers; [ anpin jnsgruk ];
   };
 }
diff --git a/pkgs/by-name/jo/josm/package.nix b/pkgs/by-name/jo/josm/package.nix
index 3eb732dd336a..28486559a11f 100644
--- a/pkgs/by-name/jo/josm/package.nix
+++ b/pkgs/by-name/jo/josm/package.nix
@@ -3,15 +3,15 @@
 }:
 let
   pname = "josm";
-  version = "19096";
+  version = "19128";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-oX9B98yj9WmTLGVnDO8hOJ/rYFMTLiTaz1dWufD1wqg=";
+      hash = "sha256-ndbU3QQ3EN3ufBT31+i/YsBsOGC8Bd4m2tAbWADD5Rk=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java21.zip";
-      hash = "sha256-qOMSG2eAaMHCvJXYzG07Ngb6fR9MbFQI5+1xuxGbBVU=";
+      hash = "sha256-HhvOmlxzKtTt52kQJF8PLh6E/UIBgWpXxhkNeZrsH88=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
diff --git a/pkgs/by-name/ke/keymapp/package.nix b/pkgs/by-name/ke/keymapp/package.nix
index c2777ce5c8e5..fabe1f149958 100644
--- a/pkgs/by-name/ke/keymapp/package.nix
+++ b/pkgs/by-name/ke/keymapp/package.nix
@@ -7,7 +7,6 @@
   libusb1,
   libsoup_3,
   webkitgtk_4_1,
-  writeShellScript,
   makeDesktopItem,
   copyDesktopItems,
 }:
@@ -26,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "keymapp";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchurl {
     url = "https://oryx.nyc3.cdn.digitaloceanspaces.com/keymapp/keymapp-${version}.tar.gz";
-    hash = "sha256-WiazQD40dG72B9tl4DwcMJgoVEl/Dgq55AHgeqK+sq8=";
+    hash = "sha256-kl/2faWbn1sF7AzgkyM6C9xzXTYh8HJf81xIY4Zf3IY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/lavanda-gtk-theme/package.nix b/pkgs/by-name/la/lavanda-gtk-theme/package.nix
new file mode 100644
index 000000000000..a4e69796fc76
--- /dev/null
+++ b/pkgs/by-name/la/lavanda-gtk-theme/package.nix
@@ -0,0 +1,52 @@
+{
+  fetchFromGitHub,
+  gnome-themes-extra,
+  gtk-engine-murrine,
+  jdupes,
+  lib,
+  sassc,
+  stdenvNoCC,
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "lavanda-gtk-theme";
+  version = "2023-10-22";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = "Lavanda-gtk-theme";
+    rev = version;
+    hash = "sha256-J243VVEqzg6o5dYLSCKPxWhUj5EKCnhvCHdia8EIfeQ=";
+  };
+
+  nativeBuildInputs = [
+    jdupes
+    sassc
+  ];
+
+  buildInputs = [ gnome-themes-extra ];
+
+  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+
+  preInstall = ''
+    mkdir -p $out/share/themes
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    bash install.sh -d $out/share/themes
+
+    jdupes --quiet --link-soft --recurse $out/share
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Lavanda gtk theme for linux desktops";
+    homepage = "https://github.com/vinceliuice/Lavanda-gtk-theme";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ dretyuiop ];
+  };
+}
diff --git a/pkgs/by-name/lo/local-ai/package.nix b/pkgs/by-name/lo/local-ai/package.nix
index c38a1d4a66b8..498cc96a454b 100644
--- a/pkgs/by-name/lo/local-ai/package.nix
+++ b/pkgs/by-name/lo/local-ai/package.nix
@@ -97,21 +97,17 @@ let
   llama-cpp-rpc = (llama-cpp-grpc.overrideAttrs (prev: {
     name = "llama-cpp-rpc";
     cmakeFlags = prev.cmakeFlags ++ [
-      (lib.cmakeBool "LLAMA_AVX" false)
-      (lib.cmakeBool "LLAMA_AVX2" false)
-      (lib.cmakeBool "LLAMA_AVX512" false)
-      (lib.cmakeBool "LLAMA_FMA" false)
-      (lib.cmakeBool "LLAMA_F16C" false)
-      (lib.cmakeBool "LLAMA_RPC" true)
+      (lib.cmakeBool "GGML_AVX" false)
+      (lib.cmakeBool "GGML_AVX2" false)
+      (lib.cmakeBool "GGML_AVX512" false)
+      (lib.cmakeBool "GGML_FMA" false)
+      (lib.cmakeBool "GGML_F16C" false)
     ];
-    postPatch = prev.postPatch + ''
-      sed -i examples/rpc/CMakeLists.txt \
-        -e '$a\install(TARGETS rpc-server RUNTIME)'
-    '';
   })).override {
     cudaSupport = false;
     openclSupport = false;
     blasSupport = false;
+    rpcSupport = true;
   };
 
   llama-cpp-grpc = (llama-cpp.overrideAttrs (final: prev: {
@@ -119,8 +115,8 @@ let
     src = fetchFromGitHub {
       owner = "ggerganov";
       repo = "llama.cpp";
-      rev = "37bef8943312d91183ff06d8f1214082a17344a5";
-      hash = "sha256-E3kCMDK5TXozBsprp4D581WHTVP9aljxB1KZUKug1pM=";
+      rev = "cb5fad4c6c2cbef92e9b8b63449e1cb7664e4846";
+      hash = "sha256-cIJuDC+MFLd5hkA1kUxuaw2dZagHqn5fi5Q2XKvDEII=";
       fetchSubmodules = true;
     };
     postPatch = prev.postPatch + ''
@@ -137,14 +133,12 @@ let
     '';
     cmakeFlags = prev.cmakeFlags ++ [
       (lib.cmakeBool "BUILD_SHARED_LIBS" false)
-      (lib.cmakeBool "LLAMA_AVX" enable_avx)
-      (lib.cmakeBool "LLAMA_AVX2" enable_avx2)
-      (lib.cmakeBool "LLAMA_AVX512" enable_avx512)
-      (lib.cmakeBool "LLAMA_FMA" enable_fma)
-      (lib.cmakeBool "LLAMA_F16C" enable_f16c)
+      (lib.cmakeBool "GGML_AVX" enable_avx)
+      (lib.cmakeBool "GGML_AVX2" enable_avx2)
+      (lib.cmakeBool "GGML_AVX512" enable_avx512)
+      (lib.cmakeBool "GGML_FMA" enable_fma)
+      (lib.cmakeBool "GGML_F16C" enable_f16c)
     ];
-    postInstall = null;
-
     buildInputs = prev.buildInputs ++ [
       protobuf # provides also abseil_cpp as propagated build input
       grpc
@@ -394,18 +388,18 @@ let
       stdenv;
 
   pname = "local-ai";
-  version = "2.17.1";
+  version = "2.18.1";
   src = fetchFromGitHub {
     owner = "go-skynet";
     repo = "LocalAI";
     rev = "v${version}";
-    hash = "sha256-G9My4t3vJ1sWyD+vxUgON4ezXURVAAgu1nAtTjd3ZR8=";
+    hash = "sha256-hRrbGUUawQV4fqxAn3eFBvn4/lZ+NrKhxnGHqpljrec=";
   };
 
   self = buildGoModule.override { stdenv = effectiveStdenv; } {
     inherit pname version src;
 
-    vendorHash = "sha256-Hu7aJFi40CKNWAxYOR47VBZI1A/9SlBIVQVcB8iqcxA=";
+    vendorHash = "sha256-uvko1PQWW5P+6cgmwVKocKBm5GndszqCsSbxlXANqJs=";
 
     env.NIX_CFLAGS_COMPILE = lib.optionalString with_stablediffusion " -isystem ${opencv}/include/opencv4";
 
@@ -441,7 +435,7 @@ let
       cp ${llama-cpp-rpc}/bin/grpc-server backend-assets/grpc/llama-cpp-grpc
 
       mkdir -p backend-assets/util
-      cp ${llama-cpp-rpc}/bin/rpc-server backend-assets/util/llama-cpp-rpc-server
+      cp ${llama-cpp-rpc}/bin/llama-rpc-server backend-assets/util/llama-cpp-rpc-server
     '';
 
     buildInputs = [ ]
diff --git a/pkgs/by-name/lx/lxd-ui/package.nix b/pkgs/by-name/lx/lxd-ui/package.nix
index a436f32e7d50..0402e61c3fb3 100644
--- a/pkgs/by-name/lx/lxd-ui/package.nix
+++ b/pkgs/by-name/lx/lxd-ui/package.nix
@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation rec {
   pname = "lxd-ui";
-  version = "0.9";
+  version = "0.10";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "lxd-ui";
     rev = "refs/tags/${version}";
-    hash = "sha256-4TIi/LPm35W86p+l5eYU0VETjno8TKmp43m2SReKElM=";
+    hash = "sha256-lXuPU1WWhrjst5ZbdLWPMovncHkUMYSUDNpsaWvdPgM=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-wExAVEl745X4O9hYhKYX2BjmW494Vr13X8bDmVxKMT4=";
+    hash = "sha256-X0xBYhoUKZe8GBqbRAfSE9o63FoAXIYTjzzDHMAygBI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/maccy/package.nix b/pkgs/by-name/ma/maccy/package.nix
index 41ea87634a1b..6e3821d7b7cf 100644
--- a/pkgs/by-name/ma/maccy/package.nix
+++ b/pkgs/by-name/ma/maccy/package.nix
@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://maccy.app";
     license = licenses.mit;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/ma/magnetic-catppuccin-gtk/package.nix b/pkgs/by-name/ma/magnetic-catppuccin-gtk/package.nix
new file mode 100644
index 000000000000..447da7718526
--- /dev/null
+++ b/pkgs/by-name/ma/magnetic-catppuccin-gtk/package.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gtk-engine-murrine,
+  jdupes,
+  sassc,
+  accent ? ["default"],
+  shade ? "dark",
+  size ? "standard",
+  tweaks ? [],
+}: let
+  validAccents = ["default" "purple" "pink" "red" "orange" "yellow" "green" "teal" "grey" "all"];
+  validShades = ["light" "dark"];
+  validSizes = ["standard" "compact"];
+  validTweaks = ["frappe" "macchiato" "black" "float" "outline" "macos"];
+
+  single = x: lib.optional (x != null) x;
+  pname = "Catppuccin-GTK";
+in
+  lib.checkListOfEnum "${pname} Valid theme accent(s)" validAccents accent
+  lib.checkListOfEnum "${pname} Valid shades" validShades (single shade)
+  lib.checkListOfEnum "${pname} Valid sizes" validSizes (single size)
+  lib.checkListOfEnum "${pname} Valid tweaks" validTweaks tweaks
+
+  stdenv.mkDerivation {
+    pname = "magnetic-${lib.toLower pname}";
+    version = "0-unstable-2024-06-27";
+
+    src = fetchFromGitHub {
+      owner = "Fausto-Korpsvart";
+      repo = "Catppuccin-GTK-Theme";
+      rev = "0bd2869e7f0fdb36c720a4fb873d4fed361b0606";
+      hash = "sha256-oFVsYrJ27hYGY+x9+Z4SxVCp3w6PiLYTZaxmGhnpVHQ=";
+    };
+
+    nativeBuildInputs = [jdupes sassc];
+
+    propagatedUserEnvPkgs = [gtk-engine-murrine];
+
+    postPatch = ''
+      find -name "*.sh" -print0 | while IFS= read -r -d ''' file; do
+        patchShebangs "$file"
+      done
+    '';
+
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share/themes
+
+      ./themes/install.sh \
+        --name ${pname} \
+        ${toString (map (x: "--theme " + x) accent)} \
+        ${lib.optionalString (shade != null) ("--color " + shade)} \
+        ${lib.optionalString (size != null) ("--size " + size)} \
+        ${toString (map (x: "--tweaks " + x) tweaks)} \
+        --dest $out/share/themes
+
+      jdupes --quiet --link-soft --recurse $out/share
+
+      runHook postInstall
+    '';
+
+    meta = with lib; {
+      description = "GTK Theme with Catppuccin colour scheme";
+      homepage = "https://github.com/Fausto-Korpsvart/Catppuccin-GTK-Theme";
+      license = licenses.gpl3Only;
+      maintainers = with maintainers; [ icy-thought ];
+      platforms = platforms.all;
+    };
+  }
diff --git a/pkgs/by-name/mc/mcdreforged/package.nix b/pkgs/by-name/mc/mcdreforged/package.nix
index d88e84b3a50f..3a4e7b582904 100644
--- a/pkgs/by-name/mc/mcdreforged/package.nix
+++ b/pkgs/by-name/mc/mcdreforged/package.nix
@@ -8,25 +8,27 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mcdreforged";
-  version = "2.12.3";
+  version = "2.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "Fallen-Breath";
+    owner = "MCDReforged";
     repo = "MCDReforged";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-MLub++mkkB/jshpHJXtqgIhs7Gcb4jHUyHqGE65S8A8=";
+    hash = "sha256-843vsazBXnvVs6DqY6HPUaBn33DktknT8+yH09n+aSI=";
   };
 
   build-system = [ python3.pkgs.setuptools ];
 
   dependencies = with python3.pkgs; [
-    colorlog
     colorama
+    colorlog
     packaging
     parse
     prompt-toolkit
     psutil
+    requests
+    resolvelib
     ruamel-yaml
     typing-extensions
   ];
@@ -37,12 +39,12 @@ python3.pkgs.buildPythonApplication rec {
     version = testers.testVersion { package = mcdreforged; };
   };
 
-  meta = with lib; {
-    description = "A rewritten version of MCDaemon, a python tool to control your Minecraft server";
+  meta = {
+    description = "Rewritten version of MCDaemon, a python tool to control your Minecraft server";
     homepage = "https://mcdreforged.com";
     changelog = "https://github.com/MCDReforged/MCDReforged/releases/tag/v${version}";
-    license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ moraxyc ];
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ moraxyc ];
     mainProgram = "mcdreforged";
   };
 }
diff --git a/pkgs/by-name/me/media-downloader/package.nix b/pkgs/by-name/me/media-downloader/package.nix
index 8053f6a93ada..5d3fa37fbebb 100644
--- a/pkgs/by-name/me/media-downloader/package.nix
+++ b/pkgs/by-name/me/media-downloader/package.nix
@@ -4,7 +4,6 @@
   # https://github.com/mhogomchungu/media-downloader?tab=readme-ov-file#extensions
   extraPackages ? [
     aria2
-    yt-dlp
     ffmpeg
     python3
   ],
@@ -28,14 +27,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ykPYxRgzKZrA0KwS1FoxZOkSL+7TbLgy0yLfs7Iqpf4=";
   };
 
-  # Disable automatically updating extensions when starting the program because this will
-  # invalidate the dependence on extensions and may cause potential security issues
-  # Can still be enabled in Configure > Actions At Startup
-  postPatch = ''
-    substituteInPlace src/settings.cpp \
-      --replace-fail '"ShowVersionInfoAndAutoDownloadUpdates",true' '"ShowVersionInfoAndAutoDownloadUpdates",false' \
-  '';
-
   nativeBuildInputs = [
     cmake
     libsForQt5.wrapQtAppsHook
@@ -52,8 +43,10 @@ stdenv.mkDerivation (finalAttrs: {
       lux, you-get, svtplay-dl, aria2c, wget and safari books.
 
       Read https://github.com/mhogomchungu/media-downloader/wiki/Extensions
-      for further information. We have packaged most of them, and they can
-      be added by overriding `extraPackages`.
+      for further information. Note that adding these packages to extraPackages
+      doesn't work, because the author doesn't intend to support custom
+      installation of them. These packages will be downloaded from original
+      source when executing the application for the first time.
     '';
     homepage = "https://github.com/mhogomchungu/media-downloader";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/me/metacubexd/package.nix b/pkgs/by-name/me/metacubexd/package.nix
index fb459f8c440c..b54fa83a4ffb 100644
--- a/pkgs/by-name/me/metacubexd/package.nix
+++ b/pkgs/by-name/me/metacubexd/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "metacubexd";
-  version = "1.141.0";
+  version = "1.141.1";
 
   src = fetchFromGitHub {
     owner = "MetaCubeX";
     repo = "metacubexd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-x3LYTEZefOCd1LcAnrPsCMc/ydt3WBcAHBEmLv2bCh4=";
+    hash = "sha256-UstINf7Hv5QvinmCFpZC5ySIdec31Qzwz8KJ28smNOE=";
   };
 
   nativeBuildInputs = [
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-+9cDCk4Dskea7l2xq7uEm+unmh48pnqMt2u6weWEVNY=";
+    hash = "sha256-Tl84geP6E/nUcx0I++/Gmuyu5n3RsmMKSsj8tgG2/eg=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
new file mode 100644
index 000000000000..9fe9530d2c94
--- /dev/null
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, fetchFromGitHub
+, pkg-config
+, libsodium
+, buildGoModule
+}:
+
+buildGoModule rec {
+
+  version = "photos-v0.9.5";
+  pname = "museum";
+
+  src = fetchFromGitHub {
+    owner = "ente-io";
+    repo = "ente";
+    sparseCheckout = [ "server" ];
+    rev = version;
+    hash = "sha256-U+3k6uIJWDw7QxF1GRF+f6ZXdmCwSkOJ/F60rU1PXRM=";
+  };
+
+  sourceRoot = "${src.name}/server";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libsodium ];
+
+  # fatal: "Not running tests in non-test environment"
+  doCheck = false;
+
+  postInstall = ''
+    mkdir -p $out/share/museum
+    cp -R configurations \
+      migrations \
+      mail-templates \
+      $out/share/museum
+  '';
+
+  meta = with lib; {
+    description = "API server for ente.io";
+    homepage = "https://github.com/ente-io/ente/tree/main/server";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ surfaceflinger pinpox ];
+    mainProgram = "museum";
+    platforms = platforms.linux;
+  };
+  vendorHash = "sha256-Vo3KhWWxO0k/d5qUFRfX44oTZBXtJeUlz6qaUvXLDag=";
+}
+
+
diff --git a/pkgs/by-name/mu/musikcube/package.nix b/pkgs/by-name/mu/musikcube/package.nix
new file mode 100644
index 000000000000..af318e978122
--- /dev/null
+++ b/pkgs/by-name/mu/musikcube/package.nix
@@ -0,0 +1,108 @@
+{
+  asio,
+  cmake,
+  curl,
+  fetchFromGitHub,
+  ffmpeg_7-headless,
+  gnutls,
+  lame,
+  lib,
+  libev,
+  game-music-emu,
+  libmicrohttpd,
+  libopenmpt,
+  mpg123,
+  ncurses,
+  pkg-config,
+  portaudio,
+  stdenv,
+  taglib,
+  # Linux Dependencies
+  alsa-lib,
+  pipewireSupport ? !stdenv.hostPlatform.isDarwin,
+  pipewire,
+  pulseaudio,
+  sndioSupport ? true,
+  sndio,
+  systemd,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  # Darwin Dependencies
+  darwin,
+  coreaudioSupport ? stdenv.hostPlatform.isDarwin,
+}:
+
+let
+  ffmpeg = ffmpeg_7-headless;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "musikcube";
+  version = "3.0.3";
+
+  src = fetchFromGitHub {
+    owner = "clangen";
+    repo = "musikcube";
+    rev = finalAttrs.version;
+    hash = "sha512-Yqh35hyGzGZlh4UoHK0MGYBa+zugYJg3F+8F223saTdDChiX4cSncroSTexRyJVGm7EE8INNJoXg3HU6bZ08lA==";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs =
+    [
+      asio
+      curl
+      ffmpeg
+      gnutls
+      lame
+      libev
+      game-music-emu
+      libmicrohttpd
+      libopenmpt
+      mpg123
+      ncurses
+      portaudio
+      taglib
+    ]
+    ++ lib.optionals systemdSupport [ systemd ]
+    ++ lib.optionals stdenv.isLinux [
+      alsa-lib
+      pulseaudio
+    ]
+    ++ lib.optionals stdenv.isDarwin (
+      with darwin.apple_sdk.frameworks;
+      [
+        Cocoa
+        SystemConfiguration
+      ]
+    )
+    ++ lib.optionals coreaudioSupport (with darwin.apple_sdk.frameworks; [ CoreAudio ])
+    ++ lib.optionals sndioSupport [ sndio ]
+    ++ lib.optionals pipewireSupport [ pipewire ];
+
+  cmakeFlags = [ "-DDISABLE_STRIP=true" ];
+
+  postFixup = lib.optionalString stdenv.isDarwin ''
+    install_name_tool -add_rpath $out/share/musikcube $out/share/musikcube/musikcube
+    install_name_tool -add_rpath $out/share/musikcube $out/share/musikcube/musikcubed
+  '';
+
+  meta = {
+    description = "Terminal-based music player, library, and streaming audio server";
+    homepage = "https://musikcube.com/";
+    maintainers = with lib.maintainers; [
+      aanderse
+      afh
+    ];
+    mainProgram = "musikcube";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ni/nightfox-gtk-theme/package.nix b/pkgs/by-name/ni/nightfox-gtk-theme/package.nix
index 84ff857e8168..2ee91f9753b5 100644
--- a/pkgs/by-name/ni/nightfox-gtk-theme/package.nix
+++ b/pkgs/by-name/ni/nightfox-gtk-theme/package.nix
@@ -1,35 +1,51 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
-, gnome-themes-extra
-, gtk-engine-murrine
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  gnome,
+  sassc,
+  gnome-themes-extra,
+  gtk-engine-murrine,
+  colorVariants ? [] # default: install all icons
 }:
 
-stdenvNoCC.mkDerivation {
+let
   pname = "nightfox-gtk-theme";
-  version = "unstable-2023-05-28";
+  colorVariantList = [
+    "dark"
+    "light"
+  ];
+
+in
+lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants
+
+stdenvNoCC.mkDerivation {
+  inherit pname;
+  version = "0-unstable-2024-06-27";
 
   src = fetchFromGitHub {
     owner = "Fausto-Korpsvart";
     repo = "Nightfox-GTK-Theme";
-    rev = "a8b01a28f2d1d9dd57d98d3708602b0d72340338";
-    hash = "sha256-GrlKYCqO9vgRbPdPhugPBg2rYtDxzbQwRPtTBIyIyx4=";
+    rev = "ef4e6e1fa3efe2a5d838d61191776abfe4d87766";
+    hash = "sha256-RsDEHauz9jQs1rqsoKbL/s0Vst3GzJXyGsE3uFtLjCY=";
   };
 
-  propagatedUserEnvPkgs = [
-    gtk-engine-murrine
-  ];
+  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
-  buildInputs = [
-    gnome-themes-extra
-  ];
+  nativeBuildInputs = [ gnome.gnome-shell sassc ];
+  buildInputs = [ gnome-themes-extra ];
 
   dontBuild = true;
 
+  postPatch = ''
+    patchShebangs themes/install.sh
+  '';
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/share/themes
-    cp -a themes/* $out/share/themes
+    cd themes
+    ./install.sh -n Nightfox -c ${lib.concatStringsSep " " (if colorVariants != [] then colorVariants else colorVariantList)} --tweaks macos -d "$out/share/themes"
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/nn/nn/package.nix b/pkgs/by-name/nn/nn/package.nix
new file mode 100644
index 000000000000..6613dc365e0d
--- /dev/null
+++ b/pkgs/by-name/nn/nn/package.nix
@@ -0,0 +1,29 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  unstableGitUpdater,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  name = "nn";
+  version = "2.0.8-unstable-2024-04-08";
+
+  src = fetchFromGitHub {
+    owner = "sakov";
+    repo = "nn-c";
+    rev = "f8e880b6ae39ff4bb4d617f61db5f92311bd04b6";
+    hash = "sha256-SzkLxR5ZkIlCoMlN18+uc1/xYWhHhXMdd2PpA1jvnFI=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/nn";
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "C code for Natural Neighbours interpolation of 2D scattered data";
+    homepage = "https://github.com/sakov/nn-c/";
+    platforms = platforms.unix;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ mkez ];
+  };
+})
diff --git a/pkgs/by-name/ob/oboete/Cargo.lock b/pkgs/by-name/ob/oboete/Cargo.lock
index 0585e3c0f82b..f64e35c3701c 100644
--- a/pkgs/by-name/ob/oboete/Cargo.lock
+++ b/pkgs/by-name/ob/oboete/Cargo.lock
@@ -3235,6 +3235,16 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
 [[package]]
 name = "num"
 version = "0.4.3"
@@ -3445,7 +3455,7 @@ dependencies = [
 
 [[package]]
 name = "oboete"
-version = "0.1.3"
+version = "0.1.4"
 dependencies = [
  "ashpd",
  "dirs",
@@ -3453,8 +3463,10 @@ dependencies = [
  "i18n-embed",
  "i18n-embed-fl",
  "libcosmic",
+ "log",
  "once_cell",
  "open",
+ "paste",
  "percent-encoding",
  "rand",
  "rust-embed",
@@ -3462,6 +3474,8 @@ dependencies = [
  "serde_json",
  "sqlx",
  "tokio",
+ "tracing",
+ "tracing-subscriber",
 ]
 
 [[package]]
@@ -3540,6 +3554,12 @@ dependencies = [
  "syn 2.0.68",
 ]
 
+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
 [[package]]
 name = "owned_ttf_parser"
 version = "0.21.0"
@@ -4453,6 +4473,15 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.2"
@@ -5038,6 +5067,16 @@ dependencies = [
  "syn 2.0.68",
 ]
 
+[[package]]
+name = "thread_local"
+version = "1.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+]
+
 [[package]]
 name = "tiff"
 version = "0.9.1"
@@ -5258,6 +5297,45 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
 dependencies = [
  "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-serde"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc6b213177105856957181934e4920de57730fc69bf42c37ee5bb664d406d9e1"
+dependencies = [
+ "serde",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
+dependencies = [
+ "nu-ansi-term",
+ "serde",
+ "serde_json",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing-core",
+ "tracing-log",
+ "tracing-serde",
 ]
 
 [[package]]
@@ -5495,6 +5573,12 @@ dependencies = [
  "tiny-skia-path",
 ]
 
+[[package]]
+name = "valuable"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
diff --git a/pkgs/by-name/ob/oboete/package.nix b/pkgs/by-name/ob/oboete/package.nix
index 85bb9de515f1..c351b1d7b6b4 100644
--- a/pkgs/by-name/ob/oboete/package.nix
+++ b/pkgs/by-name/ob/oboete/package.nix
@@ -7,20 +7,19 @@
   libxkbcommon,
   sqlite,
   vulkan-loader,
-  stdenv,
   wayland,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "oboete";
-  version = "0.1.3";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "mariinkys";
     repo = "oboete";
     rev = "refs/tags/${version}";
-    hash = "sha256-6JwIwWcei4hbHZsfTNHMKQVTj5CcPRIS+QR0PY3yhvg=";
+    hash = "sha256-fEnjjxuAoEkJFHyB9mtMEQW0K/Bt3nSpcFTZTZy2UYY=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/op/opensnitch-ui/package.nix b/pkgs/by-name/op/opensnitch-ui/package.nix
index 7628df552c76..d697826f03d6 100644
--- a/pkgs/by-name/op/opensnitch-ui/package.nix
+++ b/pkgs/by-name/op/opensnitch-ui/package.nix
@@ -1,27 +1,28 @@
-{ python3Packages
+{ python311Packages
 , fetchFromGitHub
+, nix-update-script
 , qt5
 , lib
 }:
 
-python3Packages.buildPythonApplication rec {
+python311Packages.buildPythonApplication rec {
   pname = "opensnitch-ui";
-  version = "1.6.5.1";
+  version = "1.6.6";
 
   src = fetchFromGitHub {
     owner = "evilsocket";
     repo = "opensnitch";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IVrAAHzLS7A7cYhRk+IUx8/5TGKeqC7M/7iXOpPe2ZA=";
+    hash = "sha256-pJPpkXRp7cby6Mvc7IzxH9u6MY4PcrRPkimTw3je6iI=";
   };
 
   postPatch = ''
     substituteInPlace ui/opensnitch/utils/__init__.py \
-      --replace /usr/lib/python3/dist-packages/data ${python3Packages.pyasn}/${python3Packages.python.sitePackages}/pyasn/data
+      --replace /usr/lib/python3/dist-packages/data ${python311Packages.pyasn}/${python311Packages.python.sitePackages}/pyasn/data
   '';
 
   nativeBuildInputs = [
-    python3Packages.pyqt5
+    python311Packages.pyqt5
     qt5.wrapQtAppsHook
   ];
 
@@ -29,7 +30,7 @@ python3Packages.buildPythonApplication rec {
     qt5.qtwayland
   ];
 
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python311Packages; [
     grpcio-tools
     notify2
     pyasn
@@ -56,7 +57,7 @@ python3Packages.buildPythonApplication rec {
   '';
 
   postInstall = ''
-    mv $out/${python3Packages.python.sitePackages}/usr/* $out/
+    mv $out/${python311Packages.python.sitePackages}/usr/* $out/
   '';
 
   dontWrapQtApps = true;
@@ -65,6 +66,8 @@ python3Packages.buildPythonApplication rec {
   # All tests are sandbox-incompatible and disabled for now
   doCheck = false;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Application firewall";
     mainProgram = "opensnitch-ui";
diff --git a/pkgs/by-name/pc/pcsx2/darwin.nix b/pkgs/by-name/pc/pcsx2/darwin.nix
index 20d4ac5a1c39..c0655b7879af 100644
--- a/pkgs/by-name/pc/pcsx2/darwin.nix
+++ b/pkgs/by-name/pc/pcsx2/darwin.nix
@@ -4,14 +4,14 @@
   pname,
   version,
   meta,
-  makeWrapper
+  makeWrapper,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   inherit pname version meta;
 
   src = fetchurl {
     url = "https://github.com/PCSX2/pcsx2/releases/download/v${version}/pcsx2-v${version}-macos-Qt.tar.xz";
-    hash = "sha256-QdYV63lrAwYSDhUOy4nB8qL5LfZkrg/EYHtY2smtZuk=";
+    hash = "sha256-NYgHsYXoIhI2pxqqiMgz5sKBAezEFf4AfEfu5S3diMg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/pc/pcsx2/linux.nix b/pkgs/by-name/pc/pcsx2/linux.nix
index d26ac5f83616..862b20150ef3 100644
--- a/pkgs/by-name/pc/pcsx2/linux.nix
+++ b/pkgs/by-name/pc/pcsx2/linux.nix
@@ -7,7 +7,6 @@
   cubeb,
   curl,
   extra-cmake-modules,
-  fetchpatch,
   ffmpeg,
   libaio,
   libbacktrace,
@@ -38,8 +37,8 @@ let
   pcsx2_patches = fetchFromGitHub {
     owner = "PCSX2";
     repo = "pcsx2_patches";
-    rev = "b3a788e16ea12efac006cbbe1ece45b6b9b34326";
-    sha256 = "sha256-Uvpz2Gpj533Sr6wLruubZxssoXefQDey8GHIDKWhW3s=";
+    rev = "9e71956797332471010e563a4b75a5934bef9d4e";
+    hash = "sha256-jpaRpvJox78zRGyrVIGYVoSEo/ICBlBfw3dTMz9QGuU=";
   };
   inherit (qt6)
     qtbase
@@ -55,23 +54,12 @@ llvmPackages_17.stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "PCSX2";
     repo = "pcsx2";
-    fetchSubmodules = true;
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-WiwnP5yoBy8bRLUPuCZ7z4nhIzrY8P29KS5ZjErM/A4=";
+    # NOTE: Don't forget to change the hash in shaderc-patched.nix as well.
+    hash = "sha256-cDugEbbz40uLPW64bcDGxfo1Y3ahYnEVaalfMp/J95s=";
   };
 
-  patches = [
-    ./define-rev.patch
-    # Backport patches to fix random crashes on startup
-    (fetchpatch {
-      url = "https://github.com/PCSX2/pcsx2/commit/e47bcf8d80df9a93201eefbaf169ec1a0673a833.patch";
-      sha256 = "sha256-7CL1Kpu+/JgtKIenn9rQKAs3A+oJ40W5XHlqSg77Q7Y=";
-    })
-    (fetchpatch {
-      url = "https://github.com/PCSX2/pcsx2/commit/92b707db994f821bccc35d6eef67727ea3ab496b.patch";
-      sha256 = "sha256-HWJ8KZAY/qBBotAJerZg6zi5QUHuTD51zKH1rAtZ3tc=";
-    })
-  ];
+  patches = [ ./define-rev.patch ];
 
   cmakeFlags = [
     (lib.cmakeBool "DISABLE_ADVANCE_SIMD" true)
@@ -122,7 +110,13 @@ llvmPackages_17.stdenv.mkDerivation (finalAttrs: {
 
   qtWrapperArgs =
     let
-      libs = lib.makeLibraryPath ([ vulkan-loader ] ++ cubeb.passthru.backendLibs);
+      libs = lib.makeLibraryPath (
+        [
+          vulkan-loader
+          shaderc-patched
+        ]
+        ++ cubeb.passthru.backendLibs
+      );
     in
     [ "--prefix LD_LIBRARY_PATH : ${libs}" ];
 
diff --git a/pkgs/by-name/pc/pcsx2/package.nix b/pkgs/by-name/pc/pcsx2/package.nix
index 4454727158a9..bd982263c0a8 100644
--- a/pkgs/by-name/pc/pcsx2/package.nix
+++ b/pkgs/by-name/pc/pcsx2/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "pcsx2";
-  version = "1.7.5779";
+  version = "1.7.5919";
   meta = with lib; {
     description = "Playstation 2 emulator";
     longDescription = ''
diff --git a/pkgs/by-name/pc/pcsx2/shaderc-patched.nix b/pkgs/by-name/pc/pcsx2/shaderc-patched.nix
index 82f9721a87d6..1b6ef4c02cb0 100644
--- a/pkgs/by-name/pc/pcsx2/shaderc-patched.nix
+++ b/pkgs/by-name/pc/pcsx2/shaderc-patched.nix
@@ -1,20 +1,35 @@
 {
+  lib,
+  fetchFromGitHub,
   fetchpatch,
   pcsx2,
   shaderc,
 }:
 
+let
+  version = "2024.1";
+in
 shaderc.overrideAttrs (old: {
+  inherit version;
   pname = "shaderc-patched-for-pcsx2";
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "shaderc";
+    rev = "v${version}";
+    hash = "sha256-2L/8n6KLVZWXt6FrYraVlZV5YqbPHD7rzXPCkD0d4kg=";
+  };
   patches = (old.patches or [ ]) ++ [
     (fetchpatch {
       url = "file://${pcsx2.src}/.github/workflows/scripts/common/shaderc-changes.patch";
-      hash = "sha256-Ps/D+CdSbjVWg3ZGOEcgbpQbCNkI5Nuizm4E5qiM9Wo=";
+      hash = "sha256-/qX2yD0RBuPh4Cf7n6OjVA2IyurpaCgvCEsIX/hXFdQ=";
       excludes = [
-        "CHANGES"
-        "CMakeLists.txt"
         "libshaderc/CMakeLists.txt"
+        "third_party/CMakeLists.txt"
       ];
     })
   ];
+  cmakeFlags = (old.cmakeFlags or [ ]) ++ [
+    (lib.cmakeBool "SHADERC_SKIP_EXAMPLES" true)
+    (lib.cmakeBool "SHADERC_SKIP_TESTS" true)
+  ];
 })
diff --git a/pkgs/by-name/pd/pdf4qt/package.nix b/pkgs/by-name/pd/pdf4qt/package.nix
index fd87006b8bd1..ff9aa46666cf 100644
--- a/pkgs/by-name/pd/pdf4qt/package.nix
+++ b/pkgs/by-name/pd/pdf4qt/package.nix
@@ -6,19 +6,21 @@
 , cmake
 , pkg-config
 , qt6
+, wrapGAppsHook3
 , openjpeg
 , tbb_2021_11
+, blend2d
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdf4qt";
-  version = "1.3.7";
+  version = "1.4.0.0";
 
   src = fetchFromGitHub {
     owner = "JakubMelka";
     repo = "PDF4QT";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wZJDMLEaHGBPSToQ+ObSfB5tw/fTIX1i5tmNPmIa7Ck=";
+    hash = "sha256-NlIy/C4uHRG5wwXPuqCShe113qhhsQ5jp50zrOLLA2c=";
   };
 
   patches = [
@@ -33,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     qt6.qttools
     qt6.wrapQtAppsHook
+    # GLib-GIO-ERROR: No GSettings schemas are installed on the system
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -43,12 +47,19 @@ stdenv.mkDerivation (finalAttrs: {
     lcms
     openjpeg
     tbb_2021_11
+    blend2d
   ];
 
   cmakeFlags = [
     (lib.cmakeBool "PDF4QT_INSTALL_TO_USR" false)
   ];
 
+  dontWrapGApps = true;
+
+  preFixup = ''
+    qtWrapperArgs+=(''${gappsWrapperArgs[@]})
+  '';
+
   meta = {
     description = "Open source PDF editor";
     longDescription = ''
diff --git a/pkgs/by-name/pi/picocrypt/package.nix b/pkgs/by-name/pi/picocrypt/package.nix
index 70efd103118f..964746933186 100644
--- a/pkgs/by-name/pi/picocrypt/package.nix
+++ b/pkgs/by-name/pi/picocrypt/package.nix
@@ -16,18 +16,18 @@
 
 buildGoModule rec {
   pname = "picocrypt";
-  version = "1.35";
+  version = "1.37";
 
   src = fetchFromGitHub {
     owner = "Picocrypt";
     repo = "Picocrypt";
     rev = version;
-    hash = "sha256-0dzJtwJ588c0ldf97u/J2zHkxWr176p6/FLCzMXgjQ0=";
+    hash = "sha256-K1zaDHTI9NH2Xn2N1aiE2+wZrfVQBvqIyLTBCZs3Am8=";
   };
 
   sourceRoot = "${src.name}/src";
 
-  vendorHash = "sha256-W982HiosXvDadMJJ0wP6AsalQ/uxklSbbmFp26XQEhM=";
+  vendorHash = "sha256-lc34GeO8y5XGRk0x6ghw/m/Ew7TDn6MOk4fc2u9UofQ=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pr/progress-tracker/package.nix b/pkgs/by-name/pr/progress-tracker/package.nix
new file mode 100644
index 000000000000..5cc967b5ef1d
--- /dev/null
+++ b/pkgs/by-name/pr/progress-tracker/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  catch2_3,
+  cmake,
+  fetchFromGitHub,
+  gtkmm4,
+  libadwaita,
+  pcre2,
+  pkg-config,
+  stdenv,
+  tinyxml-2,
+  wrapGAppsHook4,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "progress-tracker";
+  version = "1.5.1";
+
+  src = fetchFromGitHub {
+    owner = "smolBlackCat";
+    repo = "progress-tracker";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-0FpWUNsXYIQRn6ciLoRbKBuEZT739sAAIfSBxFqfEpk=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    catch2_3
+    gtkmm4
+    libadwaita
+    pcre2
+    tinyxml-2
+  ];
+
+  postPatch = ''
+    substituteInPlace src/CMakeLists.txt \
+      --replace-fail "/usr/bin/" "${placeholder "out"}/bin/"
+
+    substituteInPlace po/CMakeLists.txt \
+      --replace-fail "/usr/share/" "${placeholder "out"}/share/"
+
+    substituteInPlace data/CMakeLists.txt \
+      --replace-fail "/usr/share/" "${placeholder "out"}/share/"
+  '';
+
+  meta = {
+    description = "Simple kanban-style task organiser";
+    homepage = "https://github.com/smolBlackCat/progress-tracker";
+    license = lib.licenses.mit;
+    mainProgram = "progress";
+    maintainers = with lib.maintainers; [ Guanran928 ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/pr/proto/package.nix b/pkgs/by-name/pr/proto/package.nix
index d036124842ff..71e26e3d57b4 100644
--- a/pkgs/by-name/pr/proto/package.nix
+++ b/pkgs/by-name/pr/proto/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "proto";
-  version = "0.37.2";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tzDh8LMxIRYJszgUvAMEWWiSjasSnyz2cOrmNnmaLOg=";
+    hash = "sha256-60PLC/5aouvUy33Qw/orEv+3/3j//3frUxZdh4chlMc=";
   };
 
-  cargoHash = "sha256-JxJlOcTqjQP5MA4em+8jArr0ewCbVibQvLjr+kzn7EM=";
+  cargoHash = "sha256-l6BzvJI+DimykVKYl7Gow+7f3uwfDFajmHcXKoUwcUk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index 205c21c7ed36..d5a19506a42d 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -1,18 +1,22 @@
-{ lib
-, stdenvNoCC
-, fetchzip
-, writeScript
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  writeScript,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton9-9";
+  version = "GE-Proton9-10";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-sUjC6ByO8oeRhg3aZLSDJTc2GstdAdXJOddS37UkkL8=";
+    hash = "sha256-dd0qR/iin3VWAMTOvoOURk6s+PNBnZaXBhnxpczL6w8=";
   };
 
-  outputs = [ "out" "steamcompattool" ];
+  outputs = [
+    "out"
+    "steamcompattool"
+  ];
 
   buildCommand = ''
     runHook preBuild
@@ -50,7 +54,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     '';
     homepage = "https://github.com/GloriousEggroll/proton-ge-custom";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ NotAShelf shawn8901 ];
+    maintainers = with lib.maintainers; [
+      NotAShelf
+      shawn8901
+    ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
   };
diff --git a/pkgs/by-name/py/pywal16/package.nix b/pkgs/by-name/py/pywal16/package.nix
index bc45201732d7..189441135aeb 100644
--- a/pkgs/by-name/py/pywal16/package.nix
+++ b/pkgs/by-name/py/pywal16/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "pywal16";
-  version = "3.5.4";
+  version = "3.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "eylles";
     repo = "pywal16";
     rev = "refs/tags/${version}";
-    hash = "sha256-14xl0E4zpUCjW8rkqWA87TGsDy8lgqOQm9GeE9JIsVk=";
+    hash = "sha256-YKHOH1bEsZHTgYm8AYpfA6C8RtWxAqNQ+GHMcdaj/JU=";
   };
 
   nativeBuildInputs = [ python3.pkgs.setuptools ];
diff --git a/pkgs/by-name/ra/raffi/package.nix b/pkgs/by-name/ra/raffi/package.nix
new file mode 100644
index 000000000000..d32478ba7069
--- /dev/null
+++ b/pkgs/by-name/ra/raffi/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, makeBinaryWrapper
+, fuzzel
+, additionalPrograms ? [ ]
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "raffi";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "chmouel";
+    repo = "raffi";
+    rev = "v${version}";
+    hash = "sha256-i4PM82vGb9Z2pwW006114/h9crokVLUpLxNjr7tgAU8=";
+  };
+
+  cargoHash = "sha256-DS56H2XjEgdXC9TKLjwyfLpFHB9dUThhr8pNFEJuAZE=";
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
+  postFixup = ''
+    wrapProgram $out/bin/raffi \
+      --prefix PATH : ${lib.makeBinPath ([ fuzzel ] ++ additionalPrograms)}
+  '';
+
+  meta = {
+    description = "Fuzzel launcher based on yaml configuration";
+    homepage = "https://github.com/chmouel/raffi";
+    changelog = "https://github.com/chmouel/raffi/releases/tag/v${version}";
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ aos ];
+    mainProgram = "raffi";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/re/rectangle-pro/package.nix b/pkgs/by-name/re/rectangle-pro/package.nix
index 0768912463bb..a7ef394fde64 100644
--- a/pkgs/by-name/re/rectangle-pro/package.nix
+++ b/pkgs/by-name/re/rectangle-pro/package.nix
@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://rectangleapp.com/pro";
     license = licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix
index ffe86815820a..a8fa2e5abb33 100644
--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@@ -28,6 +28,7 @@
 , SDL2
 , waylandSupport ? true
 , wayland
+, wrapGAppsHook3
 }:
 
 let
@@ -81,7 +82,9 @@ stdenv.mkDerivation {
     (lib.cmakeBool "USE_FAUDIO" faudioSupport)
   ];
 
-  nativeBuildInputs = [ cmake pkg-config git wrapQtAppsHook ];
+  dontWrapGApps = true;
+
+  nativeBuildInputs = [ cmake pkg-config git wrapQtAppsHook wrapGAppsHook3 ];
 
   buildInputs = [
     qtbase qtmultimedia openal glew vulkan-headers vulkan-loader libpng ffmpeg
@@ -90,6 +93,10 @@ stdenv.mkDerivation {
     ++ lib.optional faudioSupport faudio
     ++ lib.optionals waylandSupport [ wayland qtwayland ];
 
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   postInstall = ''
     # Taken from https://wiki.rpcs3.net/index.php?title=Help:Controller_Configuration
     install -D ${./99-ds3-controllers.rules} $out/etc/udev/rules.d/99-ds3-controllers.rules
diff --git a/pkgs/by-name/se/segger-jlink/source.nix b/pkgs/by-name/se/segger-jlink/source.nix
index 89517ffb0073..0a932eb38813 100644
--- a/pkgs/by-name/se/segger-jlink/source.nix
+++ b/pkgs/by-name/se/segger-jlink/source.nix
@@ -1,19 +1,19 @@
 {
-  version = "796k";
+  version = "796s";
   x86_64-linux = {
     name = "x86_64";
-    hash = "sha256-GDmdKjMD9nJLPl4Qaxgrb5+b9CsUdyNqNak1JG4ERjo=";
+    hash = "sha256-fAuBeKrkz/b7rT4939/489nTAhS7XfK0nU6cjQmAom8=";
   };
   i686-linux = {
     name = "i386";
-    hash = "sha256-8j2UkPtDyIA+mfXl4jIVp89CpGA+T4eU5IQ0GwROgwU=";
+    hash = "sha256-OhNYEeaRl1kp16TmsPXrXwx+CZoqcA/qbMwUKZeONfI=";
   };
   aarch64-linux = {
     name = "arm64";
-    hash = "sha256-FIzg7vAPlhnjuKEm5uGa7a37srp1U0e4eqlG9C6q26s=";
+    hash = "sha256-1OnvTNUF590xgUg/j1dPzMO15XEZuT5vl+uE6o4s5mE=";
   };
   armv7l-linux = {
     name = "arm";
-    hash = "sha256-NceqkV54QVXEJr4pJ3nvY3zxSYb9Er0uQWQ4vaojkv8=";
+    hash = "sha256-ynXD7ykuKBLsoiJc+mBTnkXsreeclDvxR5M9ZsrQDxw=";
   };
 }
diff --git a/pkgs/by-name/sk/skypeforlinux/package.nix b/pkgs/by-name/sk/skypeforlinux/package.nix
new file mode 100644
index 000000000000..1182b835cd18
--- /dev/null
+++ b/pkgs/by-name/sk/skypeforlinux/package.nix
@@ -0,0 +1,197 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  squashfsTools,
+  writeScript,
+  alsa-lib,
+  atk,
+  cairo,
+  cups,
+  curl,
+  dbus,
+  expat,
+  fontconfig,
+  freetype,
+  gdk-pixbuf,
+  glib,
+  glibc,
+  gnome-keyring,
+  gtk3,
+  libappindicator-gtk3,
+  libnotify,
+  libpulseaudio,
+  libsecret,
+  libv4l,
+  nspr,
+  nss,
+  pango,
+  systemd,
+  wrapGAppsHook3,
+  xorg,
+  at-spi2-atk,
+  libuuid,
+  at-spi2-core,
+  libdrm,
+  mesa,
+  libxkbcommon,
+  libxshmfence,
+}:
+
+let
+
+  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
+  # source of the latter disappears much faster.
+  version = "8.119.0.201";
+  revision = "348";
+
+  rpath =
+    lib.makeLibraryPath [
+      alsa-lib
+      atk
+      at-spi2-atk
+      at-spi2-core
+      cairo
+      cups
+      curl
+      dbus
+      expat
+      fontconfig
+      freetype
+      glib
+      glibc
+      libsecret
+      libuuid
+
+      gdk-pixbuf
+      gtk3
+      libappindicator-gtk3
+
+      gnome-keyring
+
+      libnotify
+      libpulseaudio
+      nspr
+      nss
+      pango
+      stdenv.cc.cc
+      systemd
+
+      libv4l
+      libdrm
+      mesa
+      libxkbcommon
+      libxshmfence
+      xorg.libxkbfile
+      xorg.libX11
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXi
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXtst
+      xorg.libXScrnSaver
+      xorg.libxcb
+    ]
+    + ":${stdenv.cc.cc.lib}/lib64";
+
+  src =
+    if stdenv.hostPlatform.system == "x86_64-linux" then
+      fetchurl {
+        name = "skypeforlinux-${version}-${revision}.snap";
+        url = "https://api.snapcraft.io/api/v1/snaps/download/QRDEfjn4WJYnm0FzDKwqqRZZI77awQEV_${revision}.snap";
+        hash = "sha512-sHbLmpF+5qaKTUArHceqv91NJxNpflQE2ojO9sepQBhXacn66hluC7cGb7toQnteYKUsx00TBYs2Ugk/BkT0uA==";
+      }
+    else
+      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
+
+in
+stdenv.mkDerivation {
+  pname = "skypeforlinux";
+  inherit version revision;
+
+  system = "x86_64-linux";
+
+  inherit src;
+
+  nativeBuildInputs = [
+    wrapGAppsHook3
+    glib # For setup hook populating GSETTINGS_SCHEMA_PATH
+  ];
+
+  buildInputs = [ squashfsTools ];
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    unsquashfs "$src" /meta/{'gui/*.desktop',snap.yaml} \
+        /usr/share/{doc/skypeforlinux,'icons/hicolor/*/apps/skypeforlinux.png',kservices5,pixmaps,skypeforlinux}
+    sourceRoot=squashfs-root
+
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin"
+    mv meta/gui usr/share/applications
+    mv meta/snap.yaml usr/share "$out"
+    ln -s "$out/share/skypeforlinux/skypeforlinux" "$out/bin"
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* -or -name \*.node\* \) ); do
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
+      patchelf --set-rpath ${rpath}:$out/share/skypeforlinux $file || true
+    done
+
+    # Fix the desktop link
+    substituteInPlace "$out/share/applications/"*.desktop \
+      --replace-fail 'Exec=skype ' 'Exec=skypeforlinux ' \
+      --replace-fail 'Icon=''${SNAP}/meta/gui/skypeforlinux.png' 'Icon=skypeforlinux'
+    substituteInPlace "$out/share/kservices5/ServiceMenus/skypeforlinux.desktop" \
+      --replace-fail 'Exec=/usr/bin/skypeforlinux ' 'Exec=skypeforlinux '
+  '';
+
+  passthru.updateScript = writeScript "update-skypeforlinux" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p common-updater-scripts curl jq
+
+    set -eu -o pipefail
+
+    data=$(curl -H 'X-Ubuntu-Series: 16' \
+      'https://api.snapcraft.io/api/v1/snaps/details/skype?channel=stable&fields=download_sha512,revision,version')
+
+    version=$(jq -r .version <<<"$data")
+
+    if [[ "x$UPDATE_NIX_OLD_VERSION" != "x$version" ]]; then
+
+        revision=$(jq -r .revision <<<"$data")
+        hash=$(nix hash to-sri "sha512:$(jq -r .download_sha512 <<<"$data")")
+
+        update-source-version "$UPDATE_NIX_ATTR_PATH" "$version" "$hash"
+        update-source-version --ignore-same-hash --version-key=revision "$UPDATE_NIX_ATTR_PATH" "$revision" "$hash"
+
+    fi
+  '';
+
+  meta = {
+    description = "Linux client for Skype";
+    homepage = "https://www.skype.com";
+    changelog = "https://support.microsoft.com/en-us/skype/what-s-new-in-skype-for-windows-mac-linux-and-web-d32f674c-abb3-40a5-a0b7-ee269ca60831";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
+      panaeon
+      jraygauthier
+    ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "skypeforlinux";
+  };
+}
diff --git a/pkgs/by-name/st/stats/package.nix b/pkgs/by-name/st/stats/package.nix
index d03e07ffc12e..39d1ed2442a3 100644
--- a/pkgs/by-name/st/stats/package.nix
+++ b/pkgs/by-name/st/stats/package.nix
@@ -34,11 +34,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "macOS system monitor in your menu bar";
     homepage = "https://github.com/exelban/stats";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [
-      donteatoreo
-      emilytrau
-      Enzime
-    ];
+    maintainers = with lib.maintainers; [ donteatoreo emilytrau ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
diff --git a/pkgs/by-name/st/stylance-cli/package.nix b/pkgs/by-name/st/stylance-cli/package.nix
index 3649dc519dc1..b0154c709191 100644
--- a/pkgs/by-name/st/stylance-cli/package.nix
+++ b/pkgs/by-name/st/stylance-cli/package.nix
@@ -4,14 +4,14 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "stylance-cli";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-nwvlce1a5Qerh1wa/lAtkl60fpjMV6WQuEzNLfmCK7k=";
+    hash = "sha256-kpii3Jwvqhzp+Kummr0ypI9vyYVOcYKK0xCPwQknuWY=";
   };
 
-  cargoHash = "sha256-e8lu839kthncvCVlg13ZWNUwYGgGVgXZWJlHufubNA8=";
+  cargoHash = "sha256-tVSMZW2umkSilgPs/J7iFoBxKISrh7D73q3JWh2dJhI=";
 
   meta = with lib; {
     description = "Library and cli tool for working with scoped CSS in rust";
diff --git a/pkgs/tools/misc/thefuck/default.nix b/pkgs/by-name/th/thefuck/package.nix
similarity index 56%
rename from pkgs/tools/misc/thefuck/default.nix
rename to pkgs/by-name/th/thefuck/package.nix
index 48d4f395b047..7d908b9f8d99 100644
--- a/pkgs/tools/misc/thefuck/default.nix
+++ b/pkgs/by-name/th/thefuck/package.nix
@@ -1,22 +1,37 @@
-{ lib, stdenv, fetchFromGitHub, buildPythonApplication
-, colorama, decorator, psutil, pyte, six
-, go, mock, pytest7CheckHook, pytest-mock
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python311Packages,
+  go,
 }:
 
-buildPythonApplication rec {
+python311Packages.buildPythonApplication rec {
   pname = "thefuck";
   version = "3.32";
 
   src = fetchFromGitHub {
     owner = "nvbn";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-bRCy95owBJaxoyCNQF6gEENoxCkmorhyKzZgU1dQN6I=";
+    repo = "thefuck";
+    rev = "refs/tags/${version}";
+    hash = "sha256-bRCy95owBJaxoyCNQF6gEENoxCkmorhyKzZgU1dQN6I=";
   };
 
-  propagatedBuildInputs = [ colorama decorator psutil pyte six ];
+  dependencies = with python311Packages; [
+    colorama
+    decorator
+    psutil
+    pyte
+    six
+  ];
 
-  nativeCheckInputs = [ go mock pytest7CheckHook pytest-mock ];
+  nativeCheckInputs =
+    [ go ]
+    ++ (with python311Packages; [
+      mock
+      pytest7CheckHook
+      pytest-mock
+    ]);
 
   disabledTests = lib.optionals stdenv.isDarwin [
     "test_settings_defaults"
@@ -35,10 +50,10 @@ buildPythonApplication rec {
     "test_when_successfully_configured"
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/nvbn/thefuck";
     description = "Magnificent app which corrects your previous console command";
-    license = licenses.mit;
-    maintainers = with maintainers; [ marcusramberg ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ marcusramberg ];
   };
 }
diff --git a/pkgs/by-name/to/tokyonight-gtk-theme/package.nix b/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
new file mode 100644
index 000000000000..70e8d9d37672
--- /dev/null
+++ b/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  gnome,
+  sassc,
+  gnome-themes-extra,
+  gtk-engine-murrine,
+  colorVariants ? [] # default: install all icons
+}:
+
+let
+  pname = "tokyonight-gtk-theme";
+  colorVariantList = [
+    "dark"
+    "light"
+  ];
+
+in
+lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants
+
+stdenvNoCC.mkDerivation {
+  inherit pname;
+  version = "0-unstable-2024-06-27";
+
+  src = fetchFromGitHub {
+    owner = "Fausto-Korpsvart";
+    repo = "Tokyonight-GTK-Theme";
+    rev = "2f566d89856516bef988df3cc32261f752299886";
+    hash = "sha256-oKqLb66N4swHfhjUZJIGryE0D9MkuLdKFQa6j3TFmOg=";
+  };
+
+  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+
+  nativeBuildInputs = [ gnome.gnome-shell sassc ];
+  buildInputs = [ gnome-themes-extra ];
+
+  dontBuild = true;
+
+  postPatch = ''
+    patchShebangs themes/install.sh
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/themes
+    cd themes
+    ./install.sh -n Tokyonight -c ${lib.concatStringsSep " " (if colorVariants != [] then colorVariants else colorVariantList)} --tweaks macos -d "$out/share/themes"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "GTK theme based on the Tokyo Night colour palette";
+    homepage = "https://github.com/Fausto-Korpsvart/Tokyonight-GTK-Theme";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ garaiza-93 Madouura d3vil0p3r ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/by-name/tr/treefmt2/package.nix b/pkgs/by-name/tr/treefmt2/package.nix
index e62d1de59649..b830c724ef7c 100644
--- a/pkgs/by-name/tr/treefmt2/package.nix
+++ b/pkgs/by-name/tr/treefmt2/package.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "treefmt";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "treefmt";
     rev = "v${version}";
-    hash = "sha256-059lZJ68jGJQYYNqVXetntPrquMY7BZrYHNdL5jmq3M=";
+    hash = "sha256-aTZBI4D0ZZ59CU1tS1EzszZzlqeUOmiA9bnOohqq7M0=";
   };
 
   vendorHash = "sha256-rjdGNfR2DpLZCzL/+3xiZ7gGDd4bPyBT5qMCO+NyWbg=";
diff --git a/pkgs/by-name/vu/vulkan-memory-allocator/package.nix b/pkgs/by-name/vu/vulkan-memory-allocator/package.nix
new file mode 100644
index 000000000000..4ed32516210f
--- /dev/null
+++ b/pkgs/by-name/vu/vulkan-memory-allocator/package.nix
@@ -0,0 +1,39 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, cmake
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "vulkan-memory-allocator";
+  version = "3.1.0";
+
+  src = fetchFromGitHub {
+    owner = "GPUOpen-LibrariesAndSDKs";
+    repo = "VulkanMemoryAllocator";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-j0Z9OEwQx3RB2cni9eK3gYfwkhOc2ST213b6VseaVzg=";
+  };
+
+  # A compiler is only required for the samples. This lets us use stdenvNoCC.
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-warn 'LANGUAGES CXX' 'LANGUAGES NONE'
+  '';
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  strictDeps = true;
+
+  meta = {
+    description = "Easy to integrate Vulkan memory allocation library";
+    homepage = "https://gpuopen.com/vulkan-memory-allocator/";
+    changelog = "https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fgaz ];
+    mainProgram = "vulkan-memory-allocator";
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+})
diff --git a/pkgs/by-name/wa/warp-terminal/package.nix b/pkgs/by-name/wa/warp-terminal/package.nix
index 573e08678199..8eae7a2a5dbd 100644
--- a/pkgs/by-name/wa/warp-terminal/package.nix
+++ b/pkgs/by-name/wa/warp-terminal/package.nix
@@ -99,7 +99,7 @@ meta = with lib; {
   homepage = "https://www.warp.dev";
   license = licenses.unfree;
   sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-  maintainers = with maintainers; [ emilytrau Enzime imadnyc donteatoreo ];
+  maintainers = with maintainers; [ emilytrau imadnyc donteatoreo johnrtitor ];
   platforms = platforms.darwin ++ [ "x86_64-linux" ];
 };
 
diff --git a/pkgs/by-name/wa/waybar/package.nix b/pkgs/by-name/wa/waybar/package.nix
index 134742caa2c8..69ea3958a73d 100644
--- a/pkgs/by-name/wa/waybar/package.nix
+++ b/pkgs/by-name/wa/waybar/package.nix
@@ -73,8 +73,8 @@ let
   libcava.src = fetchFromGitHub {
     owner = "LukashonakV";
     repo = "cava";
-    rev = "0.10.1";
-    hash = "sha256-iIYKvpOWafPJB5XhDOSIW9Mb4I3A4pcgIIPQdQYEqUw=";
+    rev = "0.10.2";
+    hash = "sha256-jU7RQV2txruu/nUUl0TzjK4nai7G38J1rcTjO7UXumY=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
diff --git a/pkgs/by-name/yu/yutto/package.nix b/pkgs/by-name/yu/yutto/package.nix
index b225dbf803ba..eb5b983e8f96 100644
--- a/pkgs/by-name/yu/yutto/package.nix
+++ b/pkgs/by-name/yu/yutto/package.nix
@@ -1,13 +1,14 @@
-{ lib
-, python3Packages
-, fetchFromGitHub
-, ffmpeg
-, nix-update-script
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  ffmpeg,
+  nix-update-script,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "yutto";
-  version = "2.0.0-beta.37";
+  version = "2.0.0-beta.40";
   format = "pyproject";
 
   disabled = python3Packages.pythonOlder "3.9";
@@ -16,21 +17,22 @@ python3Packages.buildPythonApplication rec {
     owner = "yutto-dev";
     repo = "yutto";
     rev = "v${version}";
-    hash = "sha256-daRuFYfR3FjvhVsQM1FXI19iOH+bukh6WxfH5O+CFk4=";
+    hash = "sha256-gopCQ8tEhwtDFs/w+jafD3ZW/4MIrYxPcMh8SbOCwww=";
   };
 
-  nativeBuildInputs = with python3Packages; [
-    poetry-core
-  ];
+  nativeBuildInputs = with python3Packages; [ poetry-core ];
 
-  propagatedBuildInputs = with python3Packages; [
-    httpx
-    aiofiles
-    biliass
-    dict2xml
-    colorama
-    typing-extensions
-  ] ++ (with httpx.optional-dependencies; http2 ++ socks);
+  propagatedBuildInputs =
+    with python3Packages;
+    [
+      httpx
+      aiofiles
+      biliass
+      dict2xml
+      colorama
+      typing-extensions
+    ]
+    ++ (with httpx.optional-dependencies; http2 ++ socks);
 
   preFixup = ''
     makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ ffmpeg ]})
@@ -39,7 +41,10 @@ python3Packages.buildPythonApplication rec {
   pythonImportsCheck = [ "yutto" ];
 
   passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version" "unstable" ];
+    extraArgs = [
+      "--version"
+      "unstable"
+    ];
   };
 
   meta = with lib; {
diff --git a/pkgs/data/fonts/input-fonts/default.nix b/pkgs/data/fonts/input-fonts/default.nix
index a5ffc2ec33a5..dc990b6e42db 100644
--- a/pkgs/data/fonts/input-fonts/default.nix
+++ b/pkgs/data/fonts/input-fonts/default.nix
@@ -4,6 +4,8 @@
 , python3
 , config
 , acceptLicense ? config.input-fonts.acceptLicense or false
+, parallel
+, writeShellApplication
 }:
 
 let
@@ -44,17 +46,28 @@ stdenv.mkDerivation rec {
       sha256 = "BESZ4Bjgm2hvQ7oPpMvYSlE8EqvQjqHZtXWIovqyIzA=";
       stripRoot = false;
 
-      postFetch = ''
-        # Reset the timestamp to release date for determinism.
-        PATH=${lib.makeBinPath [ python3.pkgs.fonttools ]}:$PATH
-        for ttf_file in $out/Input_Fonts/*/*/*.ttf; do
-          ttx_file=$(dirname "$ttf_file")/$(basename "$ttf_file" .ttf).ttx
-          ttx "$ttf_file"
-          rm "$ttf_file"
-          touch -m -t ${builtins.replaceStrings [ "-" ] [ "" ] releaseDate}0000 "$ttx_file"
-          ttx --recalc-timestamp "$ttx_file"
-          rm "$ttx_file"
-        done
+      # Reset the timestamp to release date for determinism.
+      postFetch = let
+        ttf-fixup = writeShellApplication {
+          name = "ttf-fixup";
+          runtimeInputs = [ python3.pkgs.fonttools ];
+          text = ''
+            if [ $# != 1 ]; then
+              echo "Usage: $0 <file.ttf>: Resets timestamp on <file.ttf> for determinism" >&2
+              exit 1
+            fi
+
+            ttf_file="$1"
+            ttx_file=$(dirname "$ttf_file")/$(basename "$ttf_file" .ttf).ttx
+            ttx "$ttf_file"
+            rm "$ttf_file"
+            touch -m -t ${builtins.replaceStrings [ "-" ] [ "" ] releaseDate}0000 "$ttx_file"
+            ttx --recalc-timestamp "$ttx_file"
+            rm "$ttx_file"
+          '';
+        };
+      in ''
+        find $out/Input_Fonts -type f -name '*.ttf' -print0 | ${lib.getExe parallel} -0 -j $NIX_BUILD_CORES ${lib.getExe ttf-fixup} {}
       '';
     };
 
diff --git a/pkgs/data/themes/tokyonight-gtk-theme/default.nix b/pkgs/data/themes/tokyonight-gtk-theme/default.nix
deleted file mode 100644
index b56b0aadd3ed..000000000000
--- a/pkgs/data/themes/tokyonight-gtk-theme/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib
-, callPackage
-, runCommand
-, gtk-engine-murrine
-, gnome-themes-extra
-}:
-
-let
-  prefix = "tokyonight-gtk-theme";
-
-  packages = lib.mapAttrs' (type: content: {
-    name = type;
-
-    value = lib.mapAttrs' (variantName: variant: {
-      name = variantName;
-      value = callPackage ./generic.nix { inherit prefix type variantName variant; };
-    }) content;
-  }) (lib.importJSON ./variants.json);
-in packages // {
-  # Not using `symlinkJoin` because it's massively inefficient in this case
-  full = runCommand "${prefix}_full" {
-    preferLocalBuild = true;
-
-    propagatedUserEnvPkgs = [
-      gtk-engine-murrine
-      gnome-themes-extra
-    ];
-  } ''
-    mkdir -p $out/share/{icons,themes,${prefix}}
-
-    ${lib.concatStrings (lib.forEach (lib.attrValues (lib.attrsets.mergeAttrsList (lib.attrValues packages))) (variant:
-      ''
-        ln -s ${variant}/share/${variant.ptype}/Tokyonight-${variant.pvariant} $out/share/${variant.ptype}/Tokyonight-${variant.pvariant}
-        ln -s ${variant}/share/${prefix}/LICENSE $out/share/${prefix}/LICENSE 2>/dev/null || true
-      ''
-    ))}
-  '';
-}
diff --git a/pkgs/data/themes/tokyonight-gtk-theme/generic.nix b/pkgs/data/themes/tokyonight-gtk-theme/generic.nix
deleted file mode 100644
index 1adbf674a586..000000000000
--- a/pkgs/data/themes/tokyonight-gtk-theme/generic.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
-, writeScript
-, gtk-engine-murrine
-, gnome-themes-extra
-, prefix ? ""
-, type ? ""
-, variantName ? ""
-, variant ? ""
-}:
-
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "${prefix}_${type}-${variantName}";
-  version = "unstable-2023-05-31";
-
-  src = fetchFromGitHub {
-    owner = "Fausto-Korpsvart";
-    repo = "Tokyo-Night-GTK-Theme";
-    rev = "e9790345a6231cd6001f1356d578883fac52233a";
-    hash = "sha256-Q9UnvmX+GpvqSmTwdjU4hsEsYhA887wPqs5pyqbIhmc=";
-  };
-
-  propagatedUserEnvPkgs = [
-    gtk-engine-murrine
-    gnome-themes-extra
-  ];
-
-  dontPatch = true;
-  dontConfigure = true;
-  dontBuild = true;
-  dontFixup = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/{${type},${prefix}}
-    cp -a ${type}/Tokyonight-${variant} $out/share/${type}
-    cp -a LICENSE $out/share/${prefix}
-
-    runHook postInstall
-  '';
-
-  passthru = {
-    updateScript = writeScript "update.sh" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p curl common-updater-scripts tree jq
-      res="$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
-        -sL "https://api.github.com/repos/${finalAttrs.src.owner}/${finalAttrs.src.repo}/commits/HEAD")"
-
-      rev="$(echo $res | jq '.sha' --raw-output)"
-      version="unstable-$(echo $res | jq '.commit | .author | .date' --raw-output | sed 's/T.*$//')"
-      update-source-version ${prefix}-variants.${type}.${variantName} "$version" "$rev" --ignore-same-hash
-
-      commonjq1='.[] .contents .[] | {(.name): .name} | walk(if type=="object" then with_entries(.key|=ascii_downcase) else . end)'
-      commonjq2='reduce inputs as $in (.; . + $in)'
-      commontree="-dJ -L 1 --noreport ${finalAttrs.src}"
-
-      echo $(tree $commontree/icons | jq "$commonjq1" | jq "$commonjq2" | jq '{icons: .}') \
-        $(tree $commontree/themes | jq "$commonjq1" | jq "$commonjq2" | jq '{themes: .}') | \
-        jq 'reduce inputs as $in (.; . + $in)' | sed "s/[tT]okyonight-//g" > \
-        "$(git rev-parse --show-toplevel)/pkgs/data/themes/${prefix}/variants.json"
-    '';
-
-    # For "full" in default.nix
-    ptype = type;
-    pvariant = variant;
-  };
-
-  meta = with lib; {
-    description = "GTK theme based on the Tokyo Night colour palette";
-    homepage = "https://www.pling.com/p/1681315";
-    license = licenses.gpl3Only;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ garaiza-93 Madouura ];
-  };
-})
diff --git a/pkgs/data/themes/tokyonight-gtk-theme/variants.json b/pkgs/data/themes/tokyonight-gtk-theme/variants.json
deleted file mode 100644
index 6489d9c649de..000000000000
--- a/pkgs/data/themes/tokyonight-gtk-theme/variants.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  "icons": {
-    "dark": "Dark",
-    "dark-cyan": "Dark-Cyan",
-    "light": "Light",
-    "moon": "Moon"
-  },
-  "themes": {
-    "dark-b": "Dark-B",
-    "dark-bl": "Dark-BL",
-    "dark-b-lb": "Dark-B-LB",
-    "dark-bl-lb": "Dark-BL-LB",
-    "storm-b": "Storm-B",
-    "storm-bl": "Storm-BL",
-    "storm-b-lb": "Storm-B-LB",
-    "storm-bl-lb": "Storm-BL-LB"
-  }
-}
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index 9c10140c3cc2..3fca3696cb1a 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -66,13 +66,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mutter";
-  version = "46.3";
+  version = "46.3.1";
 
   outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    hash = "sha256-cWgKkXTS/ThIgby2CrFQBAD+6DwMvP69kJQHqaQUTYo=";
+    hash = "sha256-dHpj2jdF8wSwG1U5PZar2qggmDsYi2C0DburPmg8gF8=";
   };
 
   mesonFlags = [
diff --git a/pkgs/desktops/lomiri/applications/lomiri/default.nix b/pkgs/desktops/lomiri/applications/lomiri/default.nix
index d628da0746fa..8d6b3884ad37 100644
--- a/pkgs/desktops/lomiri/applications/lomiri/default.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri/default.nix
@@ -208,7 +208,7 @@ stdenv.mkDerivation (finalAttrs: {
     lomiri-settings-components
     lomiri-thumbnailer
     qtmultimedia
-    # telephony-service # currently broken: https://github.com/NixOS/nixpkgs/pull/314043
+    telephony-service
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/desktops/lomiri/services/lomiri-indicator-network/default.nix b/pkgs/desktops/lomiri/services/lomiri-indicator-network/default.nix
index 6566ec4601d3..fc552881f469 100644
--- a/pkgs/desktops/lomiri/services/lomiri-indicator-network/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-indicator-network/default.nix
@@ -101,8 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "BUILD_DOC" true) # lacks QML docs, needs qdoc: https://github.com/NixOS/nixpkgs/pull/245379
   ];
 
-  # Currently broken: https://github.com/NixOS/nixpkgs/pull/314043
-  doCheck = false;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   postInstall = ''
     substituteInPlace $out/etc/dbus-1/services/com.lomiri.connectivity1.service \
diff --git a/pkgs/desktops/lomiri/services/telephony-service/default.nix b/pkgs/desktops/lomiri/services/telephony-service/default.nix
index 652958eeb87f..a21017c8b784 100644
--- a/pkgs/desktops/lomiri/services/telephony-service/default.nix
+++ b/pkgs/desktops/lomiri/services/telephony-service/default.nix
@@ -52,10 +52,17 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # Remove when https://gitlab.com/ubports/development/core/telephony-service/-/merge_requests/90 merged & in release
     (fetchpatch {
-      name = "0001-telephony-service-CMakeLists-Make-tests-optional.patch";
-      url = "https://gitlab.com/ubports/development/core/telephony-service/-/commit/9a8297bcf9b34d77ffdae3dfe4ad2636022976fb.patch";
+      name = "0001-lomiri-telephony-service-CMakeLists-Make-tests-optional.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-telephony-service/-/commit/9a8297bcf9b34d77ffdae3dfe4ad2636022976fb.patch";
       hash = "sha256-Za4ZGKnw9iz2RP1LzLhKrEJ1vLUufWk8J07LmWDW40E=";
     })
+
+    # Remove when version > 0.5.3
+    (fetchpatch {
+      name = "0002-lomiri-telephony-service-Fix-gettext-funcs-in-wrong-namespace.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-telephony-service/-/commit/18e0ba8e025b097eef1217d97d98ef4a4940fe84.patch";
+      hash = "sha256-vOIy+B/OQeccsVn4pXsnr8LYyEapqbebW1I6dBg5u2c=";
+    })
   ];
 
   postPatch = ''
@@ -195,7 +202,5 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl3Only;
     maintainers = teams.lomiri.members;
     platforms = platforms.linux;
-    # Completely broken until https://github.com/NixOS/nixpkgs/pull/314043 is merged
-    broken = true;
   };
 })
diff --git a/pkgs/development/compilers/dotnet/build-dotnet.nix b/pkgs/development/compilers/dotnet/build-dotnet.nix
index 11ece5397166..246cc9ade717 100644
--- a/pkgs/development/compilers/dotnet/build-dotnet.nix
+++ b/pkgs/development/compilers/dotnet/build-dotnet.nix
@@ -18,6 +18,7 @@ assert if type == "sdk" then packages != null else true;
 , libuuid
 , zlib
 , libkrb5
+, openssl
 , curl
 , lttng-ust_2_12
 , testers
@@ -51,6 +52,21 @@ let
   sigtool = callPackage ./sigtool.nix {};
   signAppHost = callPackage ./sign-apphost.nix {};
 
+  hasILCompiler =
+    lib.versionAtLeast version (if targetRid == "osx-arm64" then "8" else "7");
+
+  extraTargets = writeText "extra.targets" (''
+    <Project>
+  '' + lib.optionalString hasILCompiler ''
+      <ItemGroup>
+        <CustomLinkerArg Include="-Wl,-rpath,'${lib.makeLibraryPath [ icu zlib openssl ]}'" />
+      </ItemGroup>
+  '' + lib.optionalString stdenv.isDarwin ''
+      <Import Project="${signAppHost}" />
+  '' + ''
+    </Project>
+  '');
+
 in
 mkCommon type rec {
   inherit pname version;
@@ -70,6 +86,7 @@ mkCommon type rec {
     icu
     libkrb5
     curl
+    xmlstarlet
   ] ++ lib.optional stdenv.isLinux lttng-ust_2_12;
 
   src = fetchurl (
@@ -79,15 +96,15 @@ mkCommon type rec {
 
   sourceRoot = ".";
 
-  postPatch = if type == "sdk" && stdenv.isDarwin then ''
+  postPatch = if type == "sdk" then (''
     xmlstarlet ed \
       --inplace \
       -s //_:Project -t elem -n Import \
-      -i \$prev -t attr -n Project -v "${signAppHost}" \
+      -i \$prev -t attr -n Project -v "${extraTargets}" \
       sdk/*/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Sdk.targets
-
+  '' + lib.optionalString stdenv.isDarwin ''
     codesign --remove-signature packs/Microsoft.NETCore.App.Host.osx-*/*/runtimes/osx-*/native/{apphost,singlefilehost}
-  '' else null;
+  '') else null;
 
   dontPatchELF = true;
   noDumpEnvVars = true;
@@ -135,7 +152,7 @@ mkCommon type rec {
   '';
 
   passthru = {
-    inherit icu;
+    inherit icu hasILCompiler;
   } // lib.optionalAttrs (type == "sdk") {
     packages = mkNugetDeps {
       name = "${pname}-${version}-deps";
diff --git a/pkgs/development/compilers/dotnet/common.nix b/pkgs/development/compilers/dotnet/common.nix
index e26fd0e33770..2fea0e2773b1 100644
--- a/pkgs/development/compilers/dotnet/common.nix
+++ b/pkgs/development/compilers/dotnet/common.nix
@@ -1,12 +1,19 @@
 # TODO: switch to stdenvNoCC
 { stdenv
+, stdenvNoCC
 , lib
 , writeText
 , testers
 , runCommand
+, runCommandWith
 , expect
 , curl
 , installShellFiles
+, callPackage
+, zlib
+, swiftPackages
+, darwin
+, icu
 }: type: args: stdenv.mkDerivation (finalAttrs: args // {
   doInstallCheck = true;
 
@@ -43,9 +50,11 @@
       mkDotnetTest =
         {
           name,
+          stdenv ? stdenvNoCC,
           template,
           usePackageSource ? false,
           build,
+          buildInputs ? [],
           # TODO: use correct runtimes instead of sdk
           runtime ? finalAttrs.finalPackage,
           runInputs ? [],
@@ -54,19 +63,20 @@
         }:
         let
           sdk = finalAttrs.finalPackage;
-          built = runCommand "dotnet-test-${name}" {
-            buildInputs = [ sdk ];
-            # make sure ICU works in a sandbox
-            propagatedSandboxProfile = toString sdk.__propagatedSandboxProfile + ''
-              (allow network-inbound (local ip))
-              (allow mach-lookup (global-name "com.apple.FSEvents"))
-            '';
+          built = runCommandWith  {
+            name = "dotnet-test-${name}";
+            inherit stdenv;
+            derivationArgs = {
+              buildInputs = [ sdk ] ++ buildInputs;
+              # make sure ICU works in a sandbox
+              propagatedSandboxProfile = toString sdk.__propagatedSandboxProfile;
+            };
           } (''
             HOME=$PWD/.home
             dotnet new nugetconfig
             dotnet nuget disable source nuget
           '' + lib.optionalString usePackageSource ''
-            dotnet nuget add source ${finalAttrs.finalPackage.packages}
+            dotnet nuget add source ${sdk.packages}
           '' + ''
             dotnet new ${template} -n test -o .
           '' + build);
@@ -96,6 +106,8 @@
         [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
       '';
 
+      patchNupkgs = callPackage ./patch-nupkgs.nix {};
+
     in {
       version = testers.testVersion ({
         package = finalAttrs.finalPackage;
@@ -103,7 +115,7 @@
         command = "dotnet --info";
       });
     }
-    // lib.optionalAttrs (type == "sdk") {
+    // lib.optionalAttrs (type == "sdk") ({
       console = mkDotnetTest {
         name = "console";
         template = "console";
@@ -113,8 +125,8 @@
       publish = mkDotnetTest {
         name = "publish";
         template = "console";
-        build = "dotnet publish -o $out";
-        run = checkConsoleOutput "$src/test";
+        build = "dotnet publish -o $out/bin";
+        run = checkConsoleOutput "$src/bin/test";
       };
 
       self-contained = mkDotnetTest {
@@ -130,20 +142,20 @@
         name = "single-file";
         template = "console";
         usePackageSource = true;
-        build = "dotnet publish --use-current-runtime -p:PublishSingleFile=true -o $out";
+        build = "dotnet publish --use-current-runtime -p:PublishSingleFile=true -o $out/bin";
         runtime = null;
-        run = checkConsoleOutput "$src/test";
+        run = checkConsoleOutput "$src/bin/test";
       };
 
       web = mkDotnetTest {
         name = "web";
         template = "web";
-        build = "dotnet publish -o $out";
+        build = "dotnet publish -o $out/bin";
         runInputs = [ expect curl ];
         run = ''
           expect <<"EOF"
             set status 1
-            spawn $env(src)/test
+            spawn $env(src)/bin/test
             proc abort { } { exit 2 }
             expect_before default abort
             expect -re {Now listening on: ([^\r]+)\r} {
@@ -165,6 +177,30 @@
         '';
         runAllowNetworking = true;
       };
-    } // args.passthru.tests or {};
+    } // lib.optionalAttrs finalAttrs.finalPackage.hasILCompiler {
+      aot = mkDotnetTest {
+        name = "aot";
+        stdenv = if stdenv.isDarwin then swiftPackages.stdenv else stdenv;
+        template = "console";
+        usePackageSource = true;
+        buildInputs =
+          [ patchNupkgs
+            zlib
+          ] ++ lib.optional stdenv.isDarwin (with darwin; with apple_sdk.frameworks; [
+            swiftPackages.swift
+            Foundation
+            CryptoKit
+            GSS
+            ICU
+          ]);
+        build = ''
+          dotnet restore -p:PublishAot=true
+          patch-nupkgs .home/.nuget/packages
+          dotnet publish -p:PublishAot=true -o $out/bin
+        '';
+        runtime = null;
+        run = checkConsoleOutput "$src/bin/test";
+      };
+    }) // args.passthru.tests or {};
   } // args.passthru or {};
 })
diff --git a/pkgs/development/compilers/dotnet/packages.nix b/pkgs/development/compilers/dotnet/packages.nix
index 4ce789e00b91..4e82e80a044f 100644
--- a/pkgs/development/compilers/dotnet/packages.nix
+++ b/pkgs/development/compilers/dotnet/packages.nix
@@ -37,6 +37,8 @@ in {
 
     passthru = {
       inherit (vmr) icu targetRid;
+      # ilcompiler is currently broken: https://github.com/dotnet/source-build/issues/1215
+      hasILCompiler = false;
     };
 
     meta = vmr.meta // {
diff --git a/pkgs/development/compilers/dotnet/patch-nupkgs.nix b/pkgs/development/compilers/dotnet/patch-nupkgs.nix
index 572211b1b378..4fcc53015c90 100644
--- a/pkgs/development/compilers/dotnet/patch-nupkgs.nix
+++ b/pkgs/development/compilers/dotnet/patch-nupkgs.nix
@@ -24,7 +24,7 @@ let
     openssl
   ] ++ lib.optional stdenv.isLinux lttng-ust_2_12);
 
-in writeShellScriptBin "patch-nupkgs" ''
+in writeShellScriptBin "patch-nupkgs" (''
   set -euo pipefail
   shopt -s nullglob
   isELF() {
@@ -71,4 +71,16 @@ in writeShellScriptBin "patch-nupkgs" ''
     touch .nix-patched
     popd
   done
-''
+'' + lib.optionalString stdenv.isDarwin ''
+  for x in microsoft.dotnet.ilcompiler/*; do
+    # .nupkg.metadata is written last, so we know the packages is complete
+    [[ -d "$x" ]] && [[ -f "$x"/.nupkg.metadata ]] \
+      && [[ ! -f "$x"/.nix-patched ]] || continue
+    echo "Patching package $x"
+    pushd "$x"
+    sed -i 's: -no_code_signature_warning::g' build/Microsoft.NETCore.Native.targets
+    sed -i 's:Include="-ld_classic"::g' build/Microsoft.NETCore.Native.Unix.targets
+    touch .nix-patched
+    popd
+  done
+'')
diff --git a/pkgs/development/compilers/dotnet/update.sh b/pkgs/development/compilers/dotnet/update.sh
index fbcbd84bf9f6..486ad2636a0e 100755
--- a/pkgs/development/compilers/dotnet/update.sh
+++ b/pkgs/development/compilers/dotnet/update.sh
@@ -7,46 +7,48 @@ set -Eeuo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
 release () {
-  local content="$1"
-  local version="$2"
+    local content="$1"
+    local version="$2"
 
-  jq -r '.releases[] | select(."release-version" == "'"$version"'")' <<< "$content"
+    jq -r '.releases[] | select(."release-version" == "'"$version"'")' <<< "$content"
 }
 
 release_files () {
-  local release="$1"
-  local expr="$2"
+    local release="$1"
+    local expr="$2"
 
-  jq -r '[('"$expr"').files[] | select(.name | test("^.*.tar.gz$"))]' <<< "$release"
+    jq -r '[('"$expr"').files[] | select(.name | test("^.*.tar.gz$"))]' <<< "$release"
 }
 
 release_platform_attr () {
-  local release_files="$1"
-  local platform="$2"
-  local attr="$3"
+    local release_files="$1"
+    local platform="$2"
+    local attr="$3"
 
-  jq -r '.[] | select((.rid == "'"$platform"'") and (.name | contains("composite") | not)) | ."'"$attr"'"' <<< "$release_files"
+    jq -r '.[] | select((.rid == "'"$platform"'") and (.name | contains("composite") | not)) | ."'"$attr"'"' <<< "$release_files"
 }
 
 platform_sources () {
-  local release_files="$1"
-  local platforms=(
-    "x86_64-linux   linux-x64"
-    "aarch64-linux  linux-arm64"
-    "x86_64-darwin  osx-x64"
-    "aarch64-darwin osx-arm64"
-  )
+    local release_files="$1"
+    local platforms=(
+        "x86_64-linux   linux-x64"
+        "aarch64-linux  linux-arm64"
+        "x86_64-darwin  osx-x64"
+        "aarch64-darwin osx-arm64"
+    )
 
-  echo "srcs = {"
-  for kv in "${platforms[@]}"; do
-    local nix_platform=${kv%% *}
-    local ms_platform=${kv##* }
+    echo "srcs = {"
+    local kv
+    for kv in "${platforms[@]}"; do
+        local nix_platform=${kv%% *}
+        local ms_platform=${kv##* }
+        local url hash
 
-    local url=$(release_platform_attr "$release_files" "$ms_platform" url)
-    local hash=$(release_platform_attr "$release_files" "$ms_platform" hash)
+        url=$(release_platform_attr "$release_files" "$ms_platform" url)
+        hash=$(release_platform_attr "$release_files" "$ms_platform" hash)
 
-    [[ -z "$url" || -z "$hash" ]] && continue
-    echo "      $nix_platform = {
+        [[ -z "$url" || -z "$hash" ]] && continue
+        echo "      $nix_platform = {
         url     = \"$url\";
         sha512  = \"$hash\";
       };"
@@ -55,15 +57,13 @@ platform_sources () {
 }
 
 generate_package_list() {
-    local version pkgs nuget_url
-    version="$1"
+    local version="$1"
     shift
-    pkgs=( "$@" )
+    local pkgs=( "$@" ) nuget_url pkg url hash
 
     nuget_url="$(curl -f "https://api.nuget.org/v3/index.json" | jq --raw-output '.resources[] | select(."@type" == "PackageBaseAddress/3.0.0")."@id"')"
 
     for pkg in "${pkgs[@]}"; do
-        local url hash
         url="${nuget_url}${pkg,,}/${version,,}/${pkg,,}.${version,,}.nupkg"
         hash="$(nix-prefetch-url "$url")"
         if [[ -z "$hash" ]]; then
@@ -76,8 +76,10 @@ generate_package_list() {
 }
 
 version_older () {
-    cur_version=$1
-    max_version=$2
+    local cur_version=$1
+    local max_version=$2
+    local result
+
     result=$(nix-instantiate -I ../../../../. \
         --eval -E "(import ../../../../. {}).lib.versionOlder \"$cur_version\" \"$max_version\"")
     if [[ "$result" == "true" ]]; then
@@ -112,15 +114,15 @@ aspnetcore_packages () {
     # This should not happend in minor or bugfix updates, but probably happens
     # with every new major .NET release.
     local pkgs=(
-      "Microsoft.AspNetCore.App.Runtime.linux-arm"
-      "Microsoft.AspNetCore.App.Runtime.linux-arm64"
-      "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
-      "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
-      "Microsoft.AspNetCore.App.Runtime.linux-x64"
-      "Microsoft.AspNetCore.App.Runtime.osx-x64"
-      "Microsoft.AspNetCore.App.Runtime.win-arm64"
-      "Microsoft.AspNetCore.App.Runtime.win-x64"
-      "Microsoft.AspNetCore.App.Runtime.win-x86"
+        "Microsoft.AspNetCore.App.Runtime.linux-arm"
+        "Microsoft.AspNetCore.App.Runtime.linux-arm64"
+        "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
+        "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
+        "Microsoft.AspNetCore.App.Runtime.linux-x64"
+        "Microsoft.AspNetCore.App.Runtime.osx-x64"
+        "Microsoft.AspNetCore.App.Runtime.win-arm64"
+        "Microsoft.AspNetCore.App.Runtime.win-x64"
+        "Microsoft.AspNetCore.App.Runtime.win-x86"
     )
 
     # These packages are currently broken on .NET 8
@@ -133,9 +135,9 @@ aspnetcore_packages () {
     # Packages that only apply to .NET 6 and up
     if ! version_older "$version" "6"; then
         pkgs+=(
-          "Microsoft.AspNetCore.App.Ref"
-          "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
-          "Microsoft.AspNetCore.App.Runtime.osx-arm64"
+            "Microsoft.AspNetCore.App.Ref"
+            "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
+            "Microsoft.AspNetCore.App.Runtime.osx-arm64"
         )
     fi
 
@@ -168,102 +170,103 @@ sdk_packages () {
     # This should not happend in minor or bugfix updates, but probably happens
     # with every new major .NET release.
     local pkgs=(
-      "Microsoft.NETCore.App.Host.linux-arm"
-      "Microsoft.NETCore.App.Host.linux-arm64"
-      "Microsoft.NETCore.App.Host.linux-musl-arm64"
-      "Microsoft.NETCore.App.Host.linux-musl-x64"
-      "Microsoft.NETCore.App.Host.linux-x64"
-      "Microsoft.NETCore.App.Host.osx-x64"
-      "Microsoft.NETCore.App.Host.win-arm64"
-      "Microsoft.NETCore.App.Host.win-x64"
-      "Microsoft.NETCore.App.Host.win-x86"
-      "Microsoft.NETCore.App.Runtime.linux-arm"
-      "Microsoft.NETCore.App.Runtime.linux-arm64"
-      "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
-      "Microsoft.NETCore.App.Runtime.linux-musl-x64"
-      "Microsoft.NETCore.App.Runtime.linux-x64"
-      "Microsoft.NETCore.App.Runtime.osx-x64"
-      "Microsoft.NETCore.App.Runtime.win-arm64"
-      "Microsoft.NETCore.App.Runtime.win-x64"
-      "Microsoft.NETCore.App.Runtime.win-x86"
-      "Microsoft.NETCore.DotNetAppHost"
-      "Microsoft.NETCore.DotNetHost"
-      "Microsoft.NETCore.DotNetHostPolicy"
-      "Microsoft.NETCore.DotNetHostResolver"
-      "runtime.linux-arm64.Microsoft.NETCore.DotNetAppHost"
-      "runtime.linux-arm64.Microsoft.NETCore.DotNetHost"
-      "runtime.linux-arm64.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.linux-arm64.Microsoft.NETCore.DotNetHostResolver"
-      "runtime.linux-arm.Microsoft.NETCore.DotNetAppHost"
-      "runtime.linux-arm.Microsoft.NETCore.DotNetHost"
-      "runtime.linux-arm.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.linux-arm.Microsoft.NETCore.DotNetHostResolver"
-      "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetAppHost"
-      "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHost"
-      "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHostResolver"
-      "runtime.linux-musl-x64.Microsoft.NETCore.DotNetAppHost"
-      "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHost"
-      "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostResolver"
-      "runtime.linux-x64.Microsoft.NETCore.DotNetAppHost"
-      "runtime.linux-x64.Microsoft.NETCore.DotNetHost"
-      "runtime.linux-x64.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.linux-x64.Microsoft.NETCore.DotNetHostResolver"
-      "runtime.osx-x64.Microsoft.NETCore.DotNetAppHost"
-      "runtime.osx-x64.Microsoft.NETCore.DotNetHost"
-      "runtime.osx-x64.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.osx-x64.Microsoft.NETCore.DotNetHostResolver"
-      "runtime.win-arm64.Microsoft.NETCore.DotNetAppHost"
-      "runtime.win-arm64.Microsoft.NETCore.DotNetHost"
-      "runtime.win-arm64.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.win-arm64.Microsoft.NETCore.DotNetHostResolver"
-      "runtime.win-x64.Microsoft.NETCore.DotNetAppHost"
-      "runtime.win-x64.Microsoft.NETCore.DotNetHost"
-      "runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.win-x64.Microsoft.NETCore.DotNetHostResolver"
-      "runtime.win-x86.Microsoft.NETCore.DotNetAppHost"
-      "runtime.win-x86.Microsoft.NETCore.DotNetHost"
-      "runtime.win-x86.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.win-x86.Microsoft.NETCore.DotNetHostResolver"
-      "Microsoft.NETCore.App.Host.linux-musl-arm"
-      "Microsoft.NETCore.App.Host.osx-arm64"
-      "Microsoft.NETCore.App.Runtime.linux-musl-arm"
-      "Microsoft.NETCore.App.Runtime.osx-arm64"
-      "Microsoft.NETCore.App.Ref"
-      "Microsoft.NETCore.App.Runtime.Mono.linux-arm"
-      "Microsoft.NETCore.App.Runtime.Mono.linux-arm64"
-      "Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64"
-      "Microsoft.NETCore.App.Runtime.Mono.linux-x64"
-      "Microsoft.NETCore.App.Runtime.Mono.osx-arm64"
-      "Microsoft.NETCore.App.Runtime.Mono.osx-x64"
-      "Microsoft.NETCore.App.Runtime.Mono.win-x64"
-      "Microsoft.NETCore.App.Runtime.Mono.win-x86"
-      "runtime.linux-musl-arm.Microsoft.NETCore.DotNetAppHost"
-      "runtime.linux-musl-arm.Microsoft.NETCore.DotNetHost"
-      "runtime.linux-musl-arm.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.linux-musl-arm.Microsoft.NETCore.DotNetHostResolver"
-      "runtime.osx-arm64.Microsoft.NETCore.DotNetAppHost"
-      "runtime.osx-arm64.Microsoft.NETCore.DotNetHost"
-      "runtime.osx-arm64.Microsoft.NETCore.DotNetHostPolicy"
-      "runtime.osx-arm64.Microsoft.NETCore.DotNetHostResolver"
-      "Microsoft.NETCore.App.Crossgen2.linux-musl-arm"
-      "Microsoft.NETCore.App.Crossgen2.linux-musl-arm64"
-      "Microsoft.NETCore.App.Crossgen2.linux-musl-x64"
-      "Microsoft.NETCore.App.Crossgen2.linux-arm"
-      "Microsoft.NETCore.App.Crossgen2.linux-arm64"
-      "Microsoft.NETCore.App.Crossgen2.linux-x64"
-      "Microsoft.NETCore.App.Crossgen2.osx-x64"
-      "Microsoft.NETCore.App.Crossgen2.osx-arm64"
+        "Microsoft.NETCore.App.Host.linux-arm"
+        "Microsoft.NETCore.App.Host.linux-arm64"
+        "Microsoft.NETCore.App.Host.linux-musl-arm64"
+        "Microsoft.NETCore.App.Host.linux-musl-x64"
+        "Microsoft.NETCore.App.Host.linux-x64"
+        "Microsoft.NETCore.App.Host.osx-x64"
+        "Microsoft.NETCore.App.Host.win-arm64"
+        "Microsoft.NETCore.App.Host.win-x64"
+        "Microsoft.NETCore.App.Host.win-x86"
+        "Microsoft.NETCore.App.Runtime.linux-arm"
+        "Microsoft.NETCore.App.Runtime.linux-arm64"
+        "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
+        "Microsoft.NETCore.App.Runtime.linux-musl-x64"
+        "Microsoft.NETCore.App.Runtime.linux-x64"
+        "Microsoft.NETCore.App.Runtime.osx-x64"
+        "Microsoft.NETCore.App.Runtime.win-arm64"
+        "Microsoft.NETCore.App.Runtime.win-x64"
+        "Microsoft.NETCore.App.Runtime.win-x86"
+        "Microsoft.NETCore.DotNetAppHost"
+        "Microsoft.NETCore.DotNetHost"
+        "Microsoft.NETCore.DotNetHostPolicy"
+        "Microsoft.NETCore.DotNetHostResolver"
+        "runtime.linux-arm64.Microsoft.NETCore.DotNetAppHost"
+        "runtime.linux-arm64.Microsoft.NETCore.DotNetHost"
+        "runtime.linux-arm64.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.linux-arm64.Microsoft.NETCore.DotNetHostResolver"
+        "runtime.linux-arm.Microsoft.NETCore.DotNetAppHost"
+        "runtime.linux-arm.Microsoft.NETCore.DotNetHost"
+        "runtime.linux-arm.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.linux-arm.Microsoft.NETCore.DotNetHostResolver"
+        "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetAppHost"
+        "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHost"
+        "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.linux-musl-arm64.Microsoft.NETCore.DotNetHostResolver"
+        "runtime.linux-musl-x64.Microsoft.NETCore.DotNetAppHost"
+        "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHost"
+        "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostResolver"
+        "runtime.linux-x64.Microsoft.NETCore.DotNetAppHost"
+        "runtime.linux-x64.Microsoft.NETCore.DotNetHost"
+        "runtime.linux-x64.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.linux-x64.Microsoft.NETCore.DotNetHostResolver"
+        "runtime.osx-x64.Microsoft.NETCore.DotNetAppHost"
+        "runtime.osx-x64.Microsoft.NETCore.DotNetHost"
+        "runtime.osx-x64.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.osx-x64.Microsoft.NETCore.DotNetHostResolver"
+        "runtime.win-arm64.Microsoft.NETCore.DotNetAppHost"
+        "runtime.win-arm64.Microsoft.NETCore.DotNetHost"
+        "runtime.win-arm64.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.win-arm64.Microsoft.NETCore.DotNetHostResolver"
+        "runtime.win-x64.Microsoft.NETCore.DotNetAppHost"
+        "runtime.win-x64.Microsoft.NETCore.DotNetHost"
+        "runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.win-x64.Microsoft.NETCore.DotNetHostResolver"
+        "runtime.win-x86.Microsoft.NETCore.DotNetAppHost"
+        "runtime.win-x86.Microsoft.NETCore.DotNetHost"
+        "runtime.win-x86.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.win-x86.Microsoft.NETCore.DotNetHostResolver"
+        "Microsoft.NETCore.App.Host.linux-musl-arm"
+        "Microsoft.NETCore.App.Host.osx-arm64"
+        "Microsoft.NETCore.App.Runtime.linux-musl-arm"
+        "Microsoft.NETCore.App.Runtime.osx-arm64"
+        "Microsoft.NETCore.App.Ref"
+        "Microsoft.NETCore.App.Runtime.Mono.linux-arm"
+        "Microsoft.NETCore.App.Runtime.Mono.linux-arm64"
+        "Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64"
+        "Microsoft.NETCore.App.Runtime.Mono.linux-x64"
+        "Microsoft.NETCore.App.Runtime.Mono.osx-arm64"
+        "Microsoft.NETCore.App.Runtime.Mono.osx-x64"
+        "Microsoft.NETCore.App.Runtime.Mono.win-x64"
+        "Microsoft.NETCore.App.Runtime.Mono.win-x86"
+        "runtime.linux-musl-arm.Microsoft.NETCore.DotNetAppHost"
+        "runtime.linux-musl-arm.Microsoft.NETCore.DotNetHost"
+        "runtime.linux-musl-arm.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.linux-musl-arm.Microsoft.NETCore.DotNetHostResolver"
+        "runtime.osx-arm64.Microsoft.NETCore.DotNetAppHost"
+        "runtime.osx-arm64.Microsoft.NETCore.DotNetHost"
+        "runtime.osx-arm64.Microsoft.NETCore.DotNetHostPolicy"
+        "runtime.osx-arm64.Microsoft.NETCore.DotNetHostResolver"
+        "Microsoft.NETCore.App.Crossgen2.linux-musl-arm"
+        "Microsoft.NETCore.App.Crossgen2.linux-musl-arm64"
+        "Microsoft.NETCore.App.Crossgen2.linux-musl-x64"
+        "Microsoft.NETCore.App.Crossgen2.linux-arm"
+        "Microsoft.NETCore.App.Crossgen2.linux-arm64"
+        "Microsoft.NETCore.App.Crossgen2.linux-x64"
+        "Microsoft.NETCore.App.Crossgen2.osx-x64"
+        "Microsoft.NETCore.App.Crossgen2.osx-arm64"
     )
 
     # These packages were removed on .NET 9
     if ! version_older "$version" "9"; then
-      local newpkgs=()
-      for pkg in "${pkgs[@]}"; do
-        [[ "$pkg" = *Microsoft.NETCore.DotNetHost* ]] || newpkgs+=("$pkg")
-      done
-      pkgs=("${newpkgs[@]}")
+        local newpkgs=()
+        local pkg
+        for pkg in "${pkgs[@]}"; do
+            [[ "$pkg" = *Microsoft.NETCore.DotNetHost* ]] || newpkgs+=("$pkg")
+        done
+        pkgs=("${newpkgs[@]}")
     fi
 
     # These packages were removed on .NET 8
@@ -282,13 +285,14 @@ sdk_packages () {
     # Packages that only apply to .NET 7 and up
     if ! version_older "$version" "7"; then
         pkgs+=(
-          "runtime.linux-arm64.Microsoft.DotNet.ILCompiler"
-          "runtime.linux-musl-arm64.Microsoft.DotNet.ILCompiler"
-          "runtime.linux-musl-x64.Microsoft.DotNet.ILCompiler"
-          "runtime.linux-x64.Microsoft.DotNet.ILCompiler"
-          "runtime.osx-x64.Microsoft.DotNet.ILCompiler"
-          "runtime.win-arm64.Microsoft.DotNet.ILCompiler"
-          "runtime.win-x64.Microsoft.DotNet.ILCompiler"
+            "Microsoft.DotNet.ILCompiler"
+            "runtime.linux-arm64.Microsoft.DotNet.ILCompiler"
+            "runtime.linux-musl-arm64.Microsoft.DotNet.ILCompiler"
+            "runtime.linux-musl-x64.Microsoft.DotNet.ILCompiler"
+            "runtime.linux-x64.Microsoft.DotNet.ILCompiler"
+            "runtime.osx-x64.Microsoft.DotNet.ILCompiler"
+            "runtime.win-arm64.Microsoft.DotNet.ILCompiler"
+            "runtime.win-x64.Microsoft.DotNet.ILCompiler"
         )
     fi
 
@@ -296,6 +300,7 @@ sdk_packages () {
     if ! version_older "$version" "8"; then
         pkgs+=(
             "Microsoft.NET.ILLink.Tasks"
+            "runtime.osx-arm64.Microsoft.DotNet.ILCompiler"
         )
     fi
 
@@ -303,74 +308,83 @@ sdk_packages () {
 }
 
 main () {
-  pname=$(basename "$0")
-  if [[ ! "$*" =~ ^.*[0-9]{1,}\.[0-9]{1,}.*$ ]]; then
-    echo "Usage: $pname [sem-versions]
+    local pname
+    pname=$(basename "$0")
+    if [[ ! "$*" =~ ^.*[0-9]{1,}\.[0-9]{1,}.*$ ]]; then
+        echo "Usage: $pname [sem-versions]
 Get updated dotnet src (platform - url & sha512) expressions for specified versions
 
 Examples:
   $pname 6.0.14 7.0.201    - specific x.y.z versions
   $pname 6.0 7.0           - latest x.y versions
 " >&2
-    exit 1
-  fi
-
-  for sem_version in "$@"; do
-    echo "Generating ./versions/${sem_version}.nix"
-    patch_specified=false
-    # Check if a patch was specified as an argument.
-    # If so, generate file for the specific version.
-    # If only x.y version was provided, get the latest patch
-    # version of the given x.y version.
-    if [[ "$sem_version" =~ ^[0-9]{1,}\.[0-9]{1,}\.[0-9]{1,} ]]; then
-        patch_specified=true
-    elif [[ ! "$sem_version" =~ ^[0-9]{1,}\.[0-9]{1,}$ ]]; then
-        continue
+        exit 1
     fi
 
-    # Make sure the x.y version is properly passed to .NET release metadata url.
-    # Then get the json file and parse it to find the latest patch release.
-    major_minor=$(sed 's/^\([0-9]*\.[0-9]*\).*$/\1/' <<< "$sem_version")
-    content=$(curl -sL https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/"$major_minor"/releases.json)
-    major_minor_patch=$([ "$patch_specified" == true ] && echo "$sem_version" || jq -r '."latest-release"' <<< "$content")
-    major_minor_underscore=${major_minor/./_}
+    for sem_version in "$@"; do
+        echo "Generating ./versions/${sem_version}.nix"
+        local patch_specified=false
+        # Check if a patch was specified as an argument.
+        # If so, generate file for the specific version.
+        # If only x.y version was provided, get the latest patch
+        # version of the given x.y version.
+        if [[ "$sem_version" =~ ^[0-9]{1,}\.[0-9]{1,}\.[0-9]{1,} ]]; then
+            patch_specified=true
+        elif [[ ! "$sem_version" =~ ^[0-9]{1,}\.[0-9]{1,}$ ]]; then
+            continue
+        fi
 
-    release_content=$(release "$content" "$major_minor_patch")
-    aspnetcore_version=$(jq -r '."aspnetcore-runtime".version' <<< "$release_content")
-    runtime_version=$(jq -r '.runtime.version' <<< "$release_content")
-    mapfile -t sdk_versions < <(jq -r '.sdks[] | .version' <<< "$release_content" | sort -rn)
+        # Make sure the x.y version is properly passed to .NET release metadata url.
+        # Then get the json file and parse it to find the latest patch release.
+        local major_minor content major_minor_patch
+        major_minor=$(sed 's/^\([0-9]*\.[0-9]*\).*$/\1/' <<< "$sem_version")
+        content=$(curl -sL https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/"$major_minor"/releases.json)
+        major_minor_patch=$([ "$patch_specified" == true ] && echo "$sem_version" || jq -r '."latest-release"' <<< "$content")
+        local major_minor_underscore=${major_minor/./_}
 
-    # If patch was not specified, check if the package is already the latest version
-    # If it is, exit early
-    if [ "$patch_specified" == false ] && [ -f "./versions/${sem_version}.nix" ]; then
-        current_version=$(nix-instantiate --eval -E "(import ./versions/${sem_version}.nix { \
+        local release_content aspnetcore_version runtime_version
+        release_content=$(release "$content" "$major_minor_patch")
+        aspnetcore_version=$(jq -r '."aspnetcore-runtime".version' <<< "$release_content")
+        runtime_version=$(jq -r '.runtime.version' <<< "$release_content")
+        local -a sdk_versions
+        mapfile -t sdk_versions < <(jq -r '.sdks[] | .version' <<< "$release_content" | sort -rn)
+
+        # If patch was not specified, check if the package is already the latest version
+        # If it is, exit early
+        if [ "$patch_specified" == false ] && [ -f "./versions/${sem_version}.nix" ]; then
+            local current_version
+            current_version=$(nix-instantiate --eval -E "(import ./versions/${sem_version}.nix { \
             buildAspNetCore = { ... }: {}; \
             buildNetSdk = { ... }: {}; \
             buildNetRuntime = { ... }: {}; \
             }).release_${major_minor_underscore}" | jq -r)
 
-        if [[ "$current_version" == "$major_minor_patch" ]]; then
-            echo "Nothing to update."
-            continue
+            if [[ "$current_version" == "$major_minor_patch" ]]; then
+                echo "Nothing to update."
+                continue
+            fi
         fi
-    fi
 
-    aspnetcore_files="$(release_files "$release_content" .\"aspnetcore-runtime\")"
-    runtime_files="$(release_files "$release_content" .runtime)"
+        local aspnetcore_files runtime_files
+        aspnetcore_files="$(release_files "$release_content" .\"aspnetcore-runtime\")"
+        runtime_files="$(release_files "$release_content" .runtime)"
 
-    channel_version=$(jq -r '."channel-version"' <<< "$content")
-    support_phase=$(jq -r '."support-phase"' <<< "$content")
+        local channel_version support_phase
+        channel_version=$(jq -r '."channel-version"' <<< "$content")
+        support_phase=$(jq -r '."support-phase"' <<< "$content")
 
-    aspnetcore_sources="$(platform_sources "$aspnetcore_files")"
-    runtime_sources="$(platform_sources "$runtime_files")"
+        local aspnetcore_sources runtime_sources
+        aspnetcore_sources="$(platform_sources "$aspnetcore_files")"
+        runtime_sources="$(platform_sources "$runtime_files")"
 
-    sdk_packages="$(sdk_packages "${runtime_version}")"
-    aspnetcore_packages="$(aspnetcore_packages "${aspnetcore_version}")"
+        local sdk_packages aspnetcore_packages
+        sdk_packages="$(sdk_packages "${runtime_version}")"
+        aspnetcore_packages="$(aspnetcore_packages "${aspnetcore_version}")"
 
-    result=$(mktemp)
-    trap "rm -f $result" TERM INT EXIT
+        result=$(mktemp)
+        trap "rm -f $result" TERM INT EXIT
 
-    echo "{ buildAspNetCore, buildNetRuntime, buildNetSdk }:
+        echo "{ buildAspNetCore, buildNetRuntime, buildNetSdk }:
 
 # v$channel_version ($support_phase)
 
@@ -392,35 +406,36 @@ in rec {
     $runtime_sources
   };" > "${result}"
 
-    declare -A feature_bands
-    unset latest_sdk
+        local -A feature_bands
+        unset latest_sdk
 
-    for sdk_version in "${sdk_versions[@]}"; do
-      sdk_base_version=${sdk_version%-*}
-      feature_band=${sdk_base_version:0:-2}xx
-      # sometimes one release has e.g. both 8.0.202 and 8.0.203
-      [[ ! ${feature_bands[$feature_band]+true} ]] || continue
-      feature_bands[$feature_band]=$sdk_version
-      sdk_files="$(release_files "$release_content" ".sdks[] | select(.version == \"$sdk_version\")")"
-      sdk_sources="$(platform_sources "$sdk_files")"
-      sdk_attrname=sdk_${feature_band//./_}
-      [[ -v latest_sdk ]] || latest_sdk=$sdk_attrname
+        for sdk_version in "${sdk_versions[@]}"; do
+            local sdk_base_version=${sdk_version%-*}
+            local feature_band=${sdk_base_version:0:-2}xx
+            # sometimes one release has e.g. both 8.0.202 and 8.0.203
+            [[ ! ${feature_bands[$feature_band]+true} ]] || continue
+            feature_bands[$feature_band]=$sdk_version
+            local sdk_files sdk_sources
+            sdk_files="$(release_files "$release_content" ".sdks[] | select(.version == \"$sdk_version\")")"
+            sdk_sources="$(platform_sources "$sdk_files")"
+            local sdk_attrname=sdk_${feature_band//./_}
+            [[ -v latest_sdk ]] || local latest_sdk=$sdk_attrname
 
-      echo "
+            echo "
   $sdk_attrname = buildNetSdk {
     version = \"${sdk_version}\";
     $sdk_sources
     inherit packages;
   };" >> "${result}"
-    done
+        done
 
-    echo "
+        echo "
   sdk_$major_minor_underscore = $latest_sdk;
 }" >> "${result}"
 
-    cp "${result}" "./versions/${sem_version}.nix"
-    echo "Generated ./versions/${sem_version}.nix"
-  done
+        cp "${result}" "./versions/${sem_version}.nix"
+        echo "Generated ./versions/${sem_version}.nix"
+    done
 }
 
 main "$@"
diff --git a/pkgs/development/compilers/dotnet/versions/7.0.nix b/pkgs/development/compilers/dotnet/versions/7.0.nix
index fac65c6b2dd0..159d9cc23985 100644
--- a/pkgs/development/compilers/dotnet/versions/7.0.nix
+++ b/pkgs/development/compilers/dotnet/versions/7.0.nix
@@ -111,6 +111,7 @@ let
       (fetchNuGet { pname = "runtime.win-arm.Microsoft.NETCore.DotNetHostPolicy"; version = "7.0.20"; sha256 = "18sarln3kbkqc1ab9jnadcqqxs8iicf7jqldxzbjzhdpmf96vwna"; })
       (fetchNuGet { pname = "runtime.win-arm.Microsoft.NETCore.DotNetHostResolver"; version = "7.0.20"; sha256 = "1vh3ymhv33qysc4vj4gb3g1rgajy4jr4kxfjcsq2myn96aan84i1"; })
       (fetchNuGet { pname = "Microsoft.NETCore.App.Composite"; version = "7.0.20"; sha256 = "12w9hlq70ynkrgqbr555lnqmbf67iz3kaci2vi07zsn3mmak3z6j"; })
+      (fetchNuGet { pname = "Microsoft.DotNet.ILCompiler"; version = "7.0.20"; sha256 = "0c966243j6m22hy3n922rl64vi6y1l7ljn69bwydm5clyh7zvn0a"; })
       (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.DotNet.ILCompiler"; version = "7.0.20"; sha256 = "11c31fzq4qfxcsz3p6vzdfnaqs29saf1dnmzq7l90p6ylwsblc7f"; })
       (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.DotNet.ILCompiler"; version = "7.0.20"; sha256 = "087q3p57snmvvzzqpxp3vwvi2q21kzlk8qh1w6axrcjdci31xmji"; })
       (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.DotNet.ILCompiler"; version = "7.0.20"; sha256 = "1nc8m38jsqai934nn26f6dkl3c0r4sabssjiizcixdyypzlv3hcf"; })
diff --git a/pkgs/development/compilers/dotnet/versions/8.0.nix b/pkgs/development/compilers/dotnet/versions/8.0.nix
index e88c122e3a8d..b9b24b48a5b2 100644
--- a/pkgs/development/compilers/dotnet/versions/8.0.nix
+++ b/pkgs/development/compilers/dotnet/versions/8.0.nix
@@ -103,6 +103,7 @@ let
       (fetchNuGet { pname = "Microsoft.NETCore.App.Crossgen2.linux-x64"; version = "8.0.6"; sha256 = "1628i25saxmny4k8zzhh6nkz0njlvmi05f1m2sx976flqd3kxr78"; })
       (fetchNuGet { pname = "Microsoft.NETCore.App.Crossgen2.osx-x64"; version = "8.0.6"; sha256 = "0fz0a4hm8lf56r5hff4vcz6pfmwfqygddm6cyxj04x63wqd16sl8"; })
       (fetchNuGet { pname = "Microsoft.NETCore.App.Crossgen2.osx-arm64"; version = "8.0.6"; sha256 = "1bg9d8fcwr7808vbakkgrzry4wf0l7r28xn9hsnh14awsqprngid"; })
+      (fetchNuGet { pname = "Microsoft.DotNet.ILCompiler"; version = "8.0.6"; sha256 = "0wvdsmpriwvzf53n8sp7vda0996s8vhv83nis45sz1imwm7gxn4r"; })
       (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.DotNet.ILCompiler"; version = "8.0.6"; sha256 = "0l3pibk6q4hhinf2ki42vcc6kvvi5x4icm8bpcnm9iss6kafchry"; })
       (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.DotNet.ILCompiler"; version = "8.0.6"; sha256 = "19wwim19f1aqscvya85chbycj30ns5cxr2ga5jfrkxbyni9q557m"; })
       (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.DotNet.ILCompiler"; version = "8.0.6"; sha256 = "1bggciasdgh7yr9vjkfq8fjxzg8lbcj4cd16slcr8kkpqy1lj79s"; })
@@ -111,6 +112,7 @@ let
       (fetchNuGet { pname = "runtime.win-arm64.Microsoft.DotNet.ILCompiler"; version = "8.0.6"; sha256 = "0cqm5183as2m3nsl9as00qm9928bani6gflndg0fv73r799k5raz"; })
       (fetchNuGet { pname = "runtime.win-x64.Microsoft.DotNet.ILCompiler"; version = "8.0.6"; sha256 = "0yjji845ngsaqxyg2cmngj3vba8v4wyriv0qz4hgn1wbrramml6b"; })
       (fetchNuGet { pname = "Microsoft.NET.ILLink.Tasks"; version = "8.0.6"; sha256 = "0slfrm65izibsxg505vr8m4k6n2a2kl4iqyyr9xkgr8541g7rrs5"; })
+      (fetchNuGet { pname = "runtime.osx-arm64.Microsoft.DotNet.ILCompiler"; version = "8.0.6"; sha256 = "07y19lzkfr0i122gqbvfwi87jipjvrw4wrm68z01k4k0yh0mk1lj"; })
   ];
 in rec {
   release_8_0 = "8.0.6";
diff --git a/pkgs/development/compilers/dotnet/versions/9.0.nix b/pkgs/development/compilers/dotnet/versions/9.0.nix
index 2cf73e2a4a7a..d837cbe88624 100644
--- a/pkgs/development/compilers/dotnet/versions/9.0.nix
+++ b/pkgs/development/compilers/dotnet/versions/9.0.nix
@@ -67,6 +67,7 @@ let
       (fetchNuGet { pname = "Microsoft.NETCore.App.Crossgen2.linux-x64"; version = "9.0.0-preview.5.24306.7"; sha256 = "0hxf3xk6yn8n04fwj9j7c6a70y9apf31aafn2nhd3yykvvf7618d"; })
       (fetchNuGet { pname = "Microsoft.NETCore.App.Crossgen2.osx-x64"; version = "9.0.0-preview.5.24306.7"; sha256 = "1pw27c0czrrgp0vqnlcz6zhyrhbjbqh14wbcknrcn1smlm6fl77x"; })
       (fetchNuGet { pname = "Microsoft.NETCore.App.Crossgen2.osx-arm64"; version = "9.0.0-preview.5.24306.7"; sha256 = "14k0sd0b6rpngw8s1gz833kq89qghnhszgvk9v2rabncb1qlhanv"; })
+      (fetchNuGet { pname = "Microsoft.DotNet.ILCompiler"; version = "9.0.0-preview.5.24306.7"; sha256 = "1qmshjgd3wpal5gbsq5ajanissr237bjgfpxg7sp5bqjb20yg4hp"; })
       (fetchNuGet { pname = "runtime.linux-arm64.Microsoft.DotNet.ILCompiler"; version = "9.0.0-preview.5.24306.7"; sha256 = "0c2spsh6m236cmpf6c2hafcrr4w2ks433g024cmpa93a3s6dfvcp"; })
       (fetchNuGet { pname = "runtime.linux-musl-arm64.Microsoft.DotNet.ILCompiler"; version = "9.0.0-preview.5.24306.7"; sha256 = "0wla1jr95b7hm6wa2yx080wgy8iaqr7r3q83jp3qdnp3k2y0rgpk"; })
       (fetchNuGet { pname = "runtime.linux-musl-x64.Microsoft.DotNet.ILCompiler"; version = "9.0.0-preview.5.24306.7"; sha256 = "00mkrwlx48dis7fg73gxj1c99zs1na4k6y11q1908a674hni8qlx"; })
@@ -75,6 +76,7 @@ let
       (fetchNuGet { pname = "runtime.win-arm64.Microsoft.DotNet.ILCompiler"; version = "9.0.0-preview.5.24306.7"; sha256 = "1s8m140xbwc2pmyhrrmgfd4r2lppld26m6x3k1kz9gfn7kk4ayjx"; })
       (fetchNuGet { pname = "runtime.win-x64.Microsoft.DotNet.ILCompiler"; version = "9.0.0-preview.5.24306.7"; sha256 = "1f9hn43fs25fbzzhrawfjgz56mknsnmhmdgf1f1pqlpfzwb2bvvn"; })
       (fetchNuGet { pname = "Microsoft.NET.ILLink.Tasks"; version = "9.0.0-preview.5.24306.7"; sha256 = "0ck2agia8lmhvwvzh73yh2ydkqfz4g21404cv4qxjj28l618cjl5"; })
+      (fetchNuGet { pname = "runtime.osx-arm64.Microsoft.DotNet.ILCompiler"; version = "9.0.0-preview.5.24306.7"; sha256 = "1xdnyrbxdm9acnldinb4xcdk0jy32jx6rgrqwcsqh4a6xzdz7y05"; })
   ];
 in rec {
   release_9_0 = "9.0.0-preview.5";
diff --git a/pkgs/development/compilers/gleam/default.nix b/pkgs/development/compilers/gleam/default.nix
index 4e2111814deb..94ed718e2a84 100644
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-J3FqaKEeK+Xy8Ri5j7+K+4wpvNeMUHSfj2O68XBPlYs=";
+    hash = "sha256-pwcvRj/ENbjLogMxk9AO+X2lqwMY+RjHUrBG/8RXLeo=";
   };
 
   nativeBuildInputs = [ git pkg-config ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++
     lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
-  cargoHash = "sha256-l0LFgmsk87mCVu1UiaFtP3mO01CDV3xTz4Kv+l6AAWw=";
+  cargoHash = "sha256-e8Fo0LDo3zXT8wsWhDlnV8i8pRdaTlcSRiuAJvdZ4RI=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
deleted file mode 100644
index 9e3a32b29808..000000000000
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ /dev/null
@@ -1,433 +0,0 @@
-{ lowPrio, newScope, pkgs, lib, stdenv
-, preLibcCrossHeaders
-, substitute, substituteAll, fetchFromGitHub, fetchpatch
-, overrideCC, wrapCCWith, wrapBintoolsWith
-, buildLlvmTools # tools, but from the previous stage, for cross
-, targetLlvmLibraries # libraries, but from the next stage, for cross
-, targetLlvm
-# This is the default binutils, but with *this* version of LLD rather
-# than the default LLVM version's, if LLD is the choice. We use these for
-# the `useLLVM` bootstrapping below.
-, bootBintoolsNoLibc ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintoolsNoLibc
-, bootBintools ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintools
-, darwin
-# LLVM release information; specify one of these but not both:
-, gitRelease ? null
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   rev = /* commit SHA */;
-  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-, officialRelease ? { version = "13.0.1"; sha256 = "06dv6h5dmvzdxbif2s8njki6h32796v368dyb5945x8gjj72xh7k"; }
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   candidate = /* optional; if specified, should be: "rcN" */
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-# By default, we'll try to fetch a release from `github:llvm/llvm-project`
-# corresponding to the `gitRelease` or `officialRelease` specified.
-#
-# You can provide your own LLVM source by specifying this arg but then it's up
-# to you to make sure that the LLVM repo given matches the release configuration
-# specified.
-, monorepoSrc ? null
-# Allows passthrough to packages via newScope. This makes it possible to
-# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
-# an llvmPackages whose packages are overridden in an internally consistent way.
-, ...
-}@args:
-
-assert
-  lib.assertMsg
-    (lib.xor
-      (gitRelease != null)
-      (officialRelease != null))
-    ("must specify `gitRelease` or `officialRelease`" +
-      (lib.optionalString (gitRelease != null) " — not both"));
-let
-  monorepoSrc' = monorepoSrc;
-in let
-  metadata = rec {
-    # Import releaseInfo separately to avoid infinite recursion
-    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-    inherit (releaseInfo) release_version version;
-    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
-    src = monorepoSrc;
-  };
-
-  tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // args // metadata
-      # Previously monorepoSrc was erroneously not being passed through.
-      // { monorepoSrc = null; } # Preserve a bug during #307211, TODO: remove; causes llvm 13 rebuild.
-    );
-    mkExtraBuildCommands0 = cc: ''
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${metadata.release_version}/include" "$rsrc"
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-    '';
-    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
-    '';
-
-  bintoolsNoLibc' =
-    if bootBintoolsNoLibc == null
-    then tools.bintoolsNoLibc
-    else bootBintoolsNoLibc;
-  bintools' =
-    if bootBintools == null
-    then tools.bintools
-    else bootBintools;
-
-  in {
-
-    libllvm = callPackage ../common/llvm {
-      patches = [
-        # When cross-compiling we configure llvm-config-native with an approximation
-        # of the flags used for the normal LLVM build. To avoid the need for building
-        # a native libLLVM.so (which would fail) we force llvm-config to be linked
-        # statically against the necessary LLVM components always.
-        ../common/llvm/llvm-config-link-static.patch
-
-        ./llvm/gnu-install-dirs.patch
-
-        # Fix random compiler crashes: https://bugs.llvm.org/show_bug.cgi?id=50611
-        (fetchpatch {
-          url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/4764a4f8c920912a2bfd8b0eea57273acfe0d8a8/trunk/no-strict-aliasing-DwarfCompileUnit.patch";
-          sha256 = "18l6mrvm2vmwm77ckcnbjvh6ybvn72rhrb799d4qzwac4x2ifl7g";
-          stripLen = 1;
-        })
-
-        # Fix musl build.
-        (fetchpatch {
-          url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
-          relative = "llvm";
-          hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
-        })
-
-        # Backport gcc-13 fixes with missing includes.
-        (fetchpatch {
-          name = "signals-gcc-13.patch";
-          url = "https://github.com/llvm/llvm-project/commit/ff1681ddb303223973653f7f5f3f3435b48a1983.patch";
-          hash = "sha256-CXwYxQezTq5vdmc8Yn88BUAEly6YZ5VEIA6X3y5NNOs=";
-          stripLen = 1;
-        })
-        (fetchpatch {
-          name = "base64-gcc-13.patch";
-          url = "https://github.com/llvm/llvm-project/commit/5e9be93566f39ee6cecd579401e453eccfbe81e5.patch";
-          hash = "sha256-PAwrVrvffPd7tphpwCkYiz+67szPRzRB2TXBvKfzQ7U=";
-          stripLen = 1;
-        })
-      ];
-      pollyPatches = [
-        ./llvm/gnu-install-dirs-polly.patch
-      ];
-    };
-
-    # `llvm` historically had the binaries.  When choosing an output explicitly,
-    # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
-    llvm = tools.libllvm;
-
-    libclang = callPackage ../common/clang {
-      patches = [
-        ./clang/purity.patch
-        # https://reviews.llvm.org/D51899
-        ./clang/gnu-install-dirs.patch
-        # Revert of https://reviews.llvm.org/D100879
-        # The malloc alignment assumption is incorrect for jemalloc and causes
-        # mis-compilation in firefox.
-        # See: https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
-        ./clang/revert-malloc-alignment-assumption.patch
-        ../common/clang/add-nostdlibinc-flag.patch
-        (substituteAll {
-          src = ../common/clang/clang-11-15-LLVMgold-path.patch;
-          libllvmLibdir = "${tools.libllvm.lib}/lib";
-        })
-      ];
-    };
-
-    clang-unwrapped = tools.libclang;
-
-    llvm-manpages = lowPrio (tools.libllvm.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    clang-manpages = lowPrio (tools.libclang.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    # TODO: lldb/docs/index.rst:155:toctree contains reference to nonexisting document 'design/structureddataplugins'
-    # lldb-manpages = lowPrio (tools.lldb.override {
-    #   enableManpages = true;
-    #   python3 = pkgs.python3;  # don't use python-boot
-    # });
-
-    # Wrapper for standalone command line utilities
-    clang-tools = callPackage ../common/clang-tools { };
-
-    # pick clang appropriate for package set we are targeting
-    clang =
-      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
-      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
-      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
-      else tools.libcxxClang;
-
-    libstdcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
-      libcxx = null;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    libcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    lld = callPackage ../common/lld {
-      patches = [
-        ./lld/gnu-install-dirs.patch
-      ];
-    };
-
-    lldb = callPackage ../common/lldb.nix {
-      patches =
-        let
-          resourceDirPatch = callPackage
-            ({ substituteAll, libclang }: substituteAll
-              {
-                src = ./lldb/resource-dir.patch;
-                clangLibDir = "${libclang.lib}/lib";
-              })
-            { };
-        in
-        [
-          ./lldb/procfs.patch
-          resourceDirPatch
-          ./lldb/gnu-install-dirs.patch
-        ]
-        # This is a stopgap solution if/until the macOS SDK used for x86_64 is
-        # updated.
-        #
-        # The older 10.12 SDK used on x86_64 as of this writing has a `mach/machine.h`
-        # header that does not define `CPU_SUBTYPE_ARM64E` so we replace the one use
-        # of this preprocessor symbol in `lldb` with its expansion.
-        #
-        # See here for some context:
-        # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
-        ++ lib.optional (
-          stdenv.targetPlatform.isDarwin
-            && !stdenv.targetPlatform.isAarch64
-            && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
-        ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-    };
-
-    # Below, is the LLVM bootstrapping logic. It handles building a
-    # fully LLVM toolchain from scratch. No GCC toolchain should be
-    # pulled in. As a consequence, it is very quick to build different
-    # targets provided by LLVM and we can also build for what GCC
-    # doesn’t support like LLVM. Probably we should move to some other
-    # file.
-
-    bintools-unwrapped = callPackage ../common/bintools.nix { };
-
-    bintoolsNoLibc = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-      libc = preLibcCrossHeaders;
-    };
-
-    bintools = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-    };
-
-    clangUseLLVM = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm) [
-        targetLlvmLibraries.libunwind
-      ];
-      extraBuildCommands = ''
-        echo "-rtlib=compiler-rt -Wno-unused-command-line-argument" >> $out/nix-support/cc-cflags
-        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
-        echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
-        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
-      '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
-        echo "-lunwind" >> $out/nix-support/cc-ldflags
-      '' + lib.optionalString stdenv.targetPlatform.isWasm ''
-        echo "-fno-exceptions" >> $out/nix-support/cc-cflags
-      '' + mkExtraBuildCommands cc;
-    };
-
-    clangNoLibcxx = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = ''
-        echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
-        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
-        echo "-nostdlib++" >> $out/nix-support/cc-cflags
-      '' + mkExtraBuildCommands cc;
-    };
-
-    clangNoLibc = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = ''
-        echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
-        echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
-      '' + mkExtraBuildCommands cc;
-    };
-
-    clangNoCompilerRt = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [ ];
-      extraBuildCommands = ''
-        echo "-nostartfiles" >> $out/nix-support/cc-cflags
-      '' + mkExtraBuildCommands0 cc;
-    };
-
-    clangNoCompilerRtWithLibc = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-    };
-
-  });
-
-  libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // args // metadata
-      # Previously monorepoSrc was erroneously not being passed through.
-      // { monorepoSrc = null; } # Preserve a bug during #307211, TODO: remove; causes llvm 13 rebuild.
-    );
-  in {
-
-    compiler-rt-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # Prevent a compilation error on darwin
-        ./compiler-rt/darwin-targetconditionals.patch
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        ./compiler-rt/armv7l.patch
-        # Fix build on armv6l
-        ../common/compiler-rt/armv6-mcr-dmb.patch
-        ../common/compiler-rt/armv6-sync-ops-no-thumb.patch
-        ../common/compiler-rt/armv6-no-ldrexd-strexd.patch
-        ../common/compiler-rt/armv6-scudo-no-yield.patch
-        ../common/compiler-rt/armv6-scudo-libatomic.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
-               else stdenv;
-    };
-
-    compiler-rt-no-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # Prevent a compilation error on darwin
-        ./compiler-rt/darwin-targetconditionals.patch
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        ./compiler-rt/armv7l.patch
-        # Fix build on armv6l
-        ../common/compiler-rt/armv6-mcr-dmb.patch
-        ../common/compiler-rt/armv6-sync-ops-no-thumb.patch
-        ../common/compiler-rt/armv6-no-ldrexd-strexd.patch
-        ../common/compiler-rt/armv6-scudo-no-yield.patch
-        ../common/compiler-rt/armv6-scudo-libatomic.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
-               else stdenv;
-    };
-
-    # N.B. condition is safe because without useLLVM both are the same.
-    compiler-rt = if stdenv.hostPlatform.isAndroid
-      then libraries.compiler-rt-libc
-      else libraries.compiler-rt-no-libc;
-
-    stdenv = overrideCC stdenv buildLlvmTools.clang;
-
-    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
-
-    libcxx = callPackage ../common/libcxx {
-      patches = [
-        (substitute {
-          src = ../common/libcxxabi/wasm.patch;
-          substitutions = [
-            "--replace-fail" "/cmake/" "/llvm/cmake/"
-          ];
-        })
-      ] ++ lib.optionals stdenv.hostPlatform.isMusl [
-        (substitute {
-          src = ../common/libcxx/libcxx-0001-musl-hacks.patch;
-          substitutions = [
-            "--replace-fail" "/include/" "/libcxx/include/"
-          ];
-        })
-      ];
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-      # TODO: remove this, causes LLVM 13 packages rebuild.
-      inherit (metadata) monorepoSrc; # Preserve bug during #307211 refactor.
-    };
-
-    libunwind = callPackage ../common/libunwind {
-      patches = [
-        ./libunwind/gnu-install-dirs.patch
-      ];
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    openmp = callPackage ../common/openmp {
-      patches = [
-        # Fix cross.
-        (fetchpatch {
-          url = "https://github.com/llvm/llvm-project/commit/5e2358c781b85a18d1463fd924d2741d4ae5e42e.patch";
-          hash = "sha256-UxIlAifXnexF/MaraPW0Ut6q+sf3e7y1fMdEv1q103A=";
-        })
-      ];
-    };
-  });
-  noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
-
-in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
deleted file mode 100644
index de68e3628bb8..000000000000
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ /dev/null
@@ -1,401 +0,0 @@
-{ lowPrio, newScope, pkgs, lib, stdenv
-, preLibcCrossHeaders
-, substitute, substituteAll, fetchFromGitHub, fetchpatch
-, overrideCC, wrapCCWith, wrapBintoolsWith
-, buildLlvmTools # tools, but from the previous stage, for cross
-, targetLlvmLibraries # libraries, but from the next stage, for cross
-, targetLlvm
-# This is the default binutils, but with *this* version of LLD rather
-# than the default LLVM version's, if LLD is the choice. We use these for
-# the `useLLVM` bootstrapping below.
-, bootBintoolsNoLibc ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintoolsNoLibc
-, bootBintools ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintools
-, darwin
-# LLVM release information; specify one of these but not both:
-, gitRelease ? null
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   rev = /* commit SHA */;
-  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-, officialRelease ? { version = "14.0.6"; sha256 = "sha256-vffu4HilvYwtzwgq+NlS26m65DGbp6OSSne2aje1yJE="; }
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   candidate = /* optional; if specified, should be: "rcN" */
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-# By default, we'll try to fetch a release from `github:llvm/llvm-project`
-# corresponding to the `gitRelease` or `officialRelease` specified.
-#
-# You can provide your own LLVM source by specifying this arg but then it's up
-# to you to make sure that the LLVM repo given matches the release configuration
-# specified.
-, monorepoSrc ? null
-# Allows passthrough to packages via newScope. This makes it possible to
-# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
-# an llvmPackages whose packages are overridden in an internally consistent way.
-, ...
-}@args:
-
-assert
-  lib.assertMsg
-    (lib.xor
-      (gitRelease != null)
-      (officialRelease != null))
-    ("must specify `gitRelease` or `officialRelease`" +
-      (lib.optionalString (gitRelease != null) " — not both"));
-let
-  monorepoSrc' = monorepoSrc;
-in let
-
-  metadata = rec {
-    # Import releaseInfo separately to avoid infinite recursion
-    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-    inherit (releaseInfo) release_version version;
-    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
-  };
-
-  tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // args // metadata);
-    mkExtraBuildCommands0 = cc: ''
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${metadata.release_version}/include" "$rsrc"
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-    '';
-    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
-    '';
-
-  bintoolsNoLibc' =
-    if bootBintoolsNoLibc == null
-    then tools.bintoolsNoLibc
-    else bootBintoolsNoLibc;
-  bintools' =
-    if bootBintools == null
-    then tools.bintools
-    else bootBintools;
-
-  in {
-
-    libllvm = callPackage ../common/llvm {
-      patches = [
-        ./llvm/gnu-install-dirs.patch
-
-        # Fix musl build.
-        (fetchpatch {
-          url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
-          relative = "llvm";
-          hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
-        })
-        # fix RuntimeDyld usage on aarch64-linux (e.g. python312Packages.numba tests)
-        (fetchpatch {
-          url = "https://github.com/llvm/llvm-project/commit/2e1b838a889f9793d4bcd5dbfe10db9796b77143.patch";
-          relative = "llvm";
-          hash = "sha256-Ot45P/iwaR4hkcM3xtLwfryQNgHI6pv6ADjv98tgdZA=";
-        })
-      ];
-      pollyPatches = [
-        ./llvm/gnu-install-dirs-polly.patch
-      ];
-    };
-
-    # `llvm` historically had the binaries.  When choosing an output explicitly,
-    # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
-    llvm = tools.libllvm;
-
-    libclang = callPackage ../common/clang {
-      patches = [
-        ./clang/purity.patch
-        # https://reviews.llvm.org/D51899
-        ./clang/gnu-install-dirs.patch
-        ../common/clang/add-nostdlibinc-flag.patch
-        (substituteAll {
-          src = ../common/clang/clang-11-15-LLVMgold-path.patch;
-          libllvmLibdir = "${tools.libllvm.lib}/lib";
-        })
-      ];
-    };
-
-    clang-unwrapped = tools.libclang;
-
-    llvm-manpages = lowPrio (tools.libllvm.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    clang-manpages = lowPrio (tools.libclang.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    # TODO: lldb/docs/index.rst:155:toctree contains reference to nonexisting document 'design/structureddataplugins'
-    # lldb-manpages = lowPrio (tools.lldb.override {
-    #   enableManpages = true;
-    #   python3 = pkgs.python3;  # don't use python-boot
-    # });
-
-    # Wrapper for standalone command line utilities
-    clang-tools = callPackage ../common/clang-tools { };
-
-    # pick clang appropriate for package set we are targeting
-    clang =
-      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
-      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
-      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
-      else tools.libcxxClang;
-
-    libstdcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
-      libcxx = null;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    libcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    lld = callPackage ../common/lld {
-      patches = [
-        ./lld/gnu-install-dirs.patch
-        ./lld/fix-root-src-dir.patch
-      ];
-    };
-
-    lldb = callPackage ../common/lldb.nix {
-      patches =
-        let
-          resourceDirPatch = callPackage
-            ({ substituteAll, libclang }: substituteAll
-              {
-                src = ./lldb/resource-dir.patch;
-                clangLibDir = "${libclang.lib}/lib";
-              })
-            { };
-        in
-        [
-          ./lldb/procfs.patch
-          resourceDirPatch
-          ../common/lldb/gnu-install-dirs.patch
-        ]
-        # This is a stopgap solution if/until the macOS SDK used for x86_64 is
-        # updated.
-        #
-        # The older 10.12 SDK used on x86_64 as of this writing has a `mach/machine.h`
-        # header that does not define `CPU_SUBTYPE_ARM64E` so we replace the one use
-        # of this preprocessor symbol in `lldb` with its expansion.
-        #
-        # See here for some context:
-        # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
-        ++ lib.optional (
-          stdenv.targetPlatform.isDarwin
-            && !stdenv.targetPlatform.isAarch64
-            && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
-        ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-    };
-
-    # Below, is the LLVM bootstrapping logic. It handles building a
-    # fully LLVM toolchain from scratch. No GCC toolchain should be
-    # pulled in. As a consequence, it is very quick to build different
-    # targets provided by LLVM and we can also build for what GCC
-    # doesn’t support like LLVM. Probably we should move to some other
-    # file.
-
-    bintools-unwrapped = callPackage ../common/bintools.nix { };
-
-    bintoolsNoLibc = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-      libc = preLibcCrossHeaders;
-    };
-
-    bintools = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-    };
-
-    clangUseLLVM = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [
-        targetLlvmLibraries.libunwind
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [ "-rtlib=compiler-rt"
-          "-Wno-unused-command-line-argument"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) "--unwindlib=libunwind"
-        ++ lib.optional
-          (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false)
-          "-lunwind"
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
-    };
-
-    clangNoLibcxx = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags = [
-        "-rtlib=compiler-rt"
-        "-B${targetLlvmLibraries.compiler-rt}/lib"
-        "-nostdlib++"
-      ];
-    };
-
-    clangNoLibc = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags = [
-        "-rtlib=compiler-rt"
-        "-B${targetLlvmLibraries.compiler-rt}/lib"
-      ];
-    };
-
-    clangNoCompilerRt = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-      nixSupport.cc-cflags = [ "-nostartfiles" ];
-    };
-
-    clangNoCompilerRtWithLibc = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-    };
-
-  });
-
-  libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
-  in {
-
-    compiler-rt-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        ./compiler-rt/gnu-install-dirs.patch
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # Prevent a compilation error on darwin
-        ./compiler-rt/darwin-targetconditionals.patch
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        ./compiler-rt/armv7l.patch
-        # Fix build on armv6l
-        ../common/compiler-rt/armv6-mcr-dmb.patch
-        ../common/compiler-rt/armv6-sync-ops-no-thumb.patch
-        ../common/compiler-rt/armv6-no-ldrexd-strexd.patch
-        ../common/compiler-rt/armv6-scudo-no-yield.patch
-        ../common/compiler-rt/armv6-scudo-libatomic.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
-               else stdenv;
-    };
-
-    compiler-rt-no-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/codesign.patch # Revert compiler-rt commit that makes codesign mandatory
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        ./compiler-rt/gnu-install-dirs.patch
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # Prevent a compilation error on darwin
-        ./compiler-rt/darwin-targetconditionals.patch
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        ./compiler-rt/armv7l.patch
-        # Fix build on armv6l
-        ../common/compiler-rt/armv6-mcr-dmb.patch
-        ../common/compiler-rt/armv6-sync-ops-no-thumb.patch
-        ../common/compiler-rt/armv6-no-ldrexd-strexd.patch
-        ../common/compiler-rt/armv6-scudo-no-yield.patch
-        ../common/compiler-rt/armv6-scudo-libatomic.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
-               else stdenv;
-    };
-
-    # N.B. condition is safe because without useLLVM both are the same.
-    compiler-rt = if stdenv.hostPlatform.isAndroid
-      then libraries.compiler-rt-libc
-      else libraries.compiler-rt-no-libc;
-
-    stdenv = overrideCC stdenv buildLlvmTools.clang;
-
-    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
-
-    libcxx = callPackage ../common/libcxx {
-      patches = [
-        (substitute {
-          src = ../common/libcxxabi/wasm.patch;
-          substitutions = [
-            "--replace-fail" "/cmake/" "/llvm/cmake/"
-          ];
-        })
-      ] ++ lib.optionals stdenv.hostPlatform.isMusl [
-        (substitute {
-          src = ../common/libcxx/libcxx-0001-musl-hacks.patch;
-          substitutions = [
-            "--replace-fail" "/include/" "/libcxx/include/"
-          ];
-        })
-      ];
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    libunwind = callPackage ../common/libunwind {
-      patches = [
-        ./libunwind/gnu-install-dirs.patch
-      ];
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    openmp = callPackage ../common/openmp {
-      patches = [
-        ./openmp/gnu-install-dirs.patch
-        ./openmp/run-lit-directly.patch
-      ];
-    };
-  });
-  noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
-
-in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
deleted file mode 100644
index aaa6d0acdf3c..000000000000
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ /dev/null
@@ -1,455 +0,0 @@
-{ lowPrio, newScope, pkgs, lib, stdenv
-, preLibcCrossHeaders
-, substitute, substituteAll, fetchFromGitHub, fetchpatch
-, overrideCC, wrapCCWith, wrapBintoolsWith
-, buildLlvmTools # tools, but from the previous stage, for cross
-, targetLlvmLibraries # libraries, but from the next stage, for cross
-, targetLlvm
-# This is the default binutils, but with *this* version of LLD rather
-# than the default LLVM version's, if LLD is the choice. We use these for
-# the `useLLVM` bootstrapping below.
-, bootBintoolsNoLibc ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintoolsNoLibc
-, bootBintools ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintools
-, darwin
-# LLVM release information; specify one of these but not both:
-, gitRelease ? null
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   rev = /* commit SHA */;
-  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-, officialRelease ? { version = "15.0.7"; sha256 = "sha256-wjuZQyXQ/jsmvy6y1aksCcEDXGBjuhpgngF3XQJ/T4s="; }
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   candidate = /* optional; if specified, should be: "rcN" */
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-# By default, we'll try to fetch a release from `github:llvm/llvm-project`
-# corresponding to the `gitRelease` or `officialRelease` specified.
-#
-# You can provide your own LLVM source by specifying this arg but then it's up
-# to you to make sure that the LLVM repo given matches the release configuration
-# specified.
-, monorepoSrc ? null
-# Allows passthrough to packages via newScope. This makes it possible to
-# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
-# an llvmPackages whose packages are overridden in an internally consistent way.
-, ...
-}@args:
-
-assert
-  lib.assertMsg
-    (lib.xor
-      (gitRelease != null)
-      (officialRelease != null))
-    ("must specify `gitRelease` or `officialRelease`" +
-      (lib.optionalString (gitRelease != null) " — not both"));
-let
-  monorepoSrc' = monorepoSrc;
-in let
-
-  metadata = rec {
-    # Import releaseInfo separately to avoid infinite recursion
-    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-    inherit (releaseInfo) release_version version;
-    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
-  };
-
-  lldbPlugins = lib.makeExtensible (lldbPlugins: let
-    callPackage = newScope (lldbPlugins // { inherit stdenv; inherit (tools) lldb; });
-  in {
-    llef = callPackage ../common/lldb-plugins/llef.nix {};
-  });
-
-  tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // args // metadata);
-    mkExtraBuildCommands0 = cc: ''
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${metadata.release_version}/include" "$rsrc"
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-    '';
-    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
-    '';
-
-  bintoolsNoLibc' =
-    if bootBintoolsNoLibc == null
-    then tools.bintoolsNoLibc
-    else bootBintoolsNoLibc;
-  bintools' =
-    if bootBintools == null
-    then tools.bintools
-    else bootBintools;
-
-  in {
-
-    libllvm = callPackage ../common/llvm {
-      patches = [
-        ./llvm/gnu-install-dirs.patch
-
-        # Running the tests involves invoking binaries (like `opt`) that depend on
-        # the LLVM dylibs and reference them by absolute install path (i.e. their
-        # nix store path).
-        #
-        # Because we have not yet run the install phase (we're running these tests
-        # as part of `checkPhase` instead of `installCheckPhase`) these absolute
-        # paths do not exist yet; to work around this we point the loader (`ld` on
-        # unix, `dyld` on macOS) at the `lib` directory which will later become this
-        # package's `lib` output.
-        #
-        # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
-        # dir but:
-        #   - this doesn't generalize well to other platforms; `lit` doesn't forward
-        #     `DYLD_LIBRARY_PATH` (macOS):
-        #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
-        #   - even if `lit` forwarded this env var, we actually cannot set
-        #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
-        #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
-        #     "protected processes" (i.e. the python interpreter that runs `lit`):
-        #     https://stackoverflow.com/a/35570229
-        #   - other LLVM subprojects deal with this issue by having their `lit`
-        #     configuration set these env vars for us; it makes sense to do the same
-        #     for LLVM:
-        #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
-        #
-        # !!! TODO: look into upstreaming this patch
-        ./llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
-
-        # `lit` has a mode where it executes run lines as a shell script which is
-        # constructs; this is problematic for macOS because it means that there's
-        # another process in between `lit` and the binaries being tested. As noted
-        # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
-        # tests fail with dyld errors.
-        #
-        # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
-        # present in the test configuration.
-        #
-        # It's not clear to me why this isn't an issue for LLVM developers running
-        # on macOS (nothing about this _seems_ nix specific)..
-        ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
-
-        # Fix musl build.
-        (fetchpatch {
-          url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
-          relative = "llvm";
-          hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
-        })
-      ];
-      pollyPatches = [
-        ./llvm/gnu-install-dirs-polly.patch
-
-        # Just like the `llvm-lit-cfg` patch, but for `polly`.
-        ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
-      ];
-    };
-
-    # `llvm` historically had the binaries.  When choosing an output explicitly,
-    # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
-    llvm = tools.libllvm;
-
-    libclang = callPackage ../common/clang {
-      patches = [
-        ./clang/purity.patch
-        # https://reviews.llvm.org/D51899
-        ./clang/gnu-install-dirs.patch
-        ../common/clang/add-nostdlibinc-flag.patch
-        (substituteAll {
-          src = ../common/clang/clang-11-15-LLVMgold-path.patch;
-          libllvmLibdir = "${tools.libllvm.lib}/lib";
-        })
-      ];
-    };
-
-    clang-unwrapped = tools.libclang;
-
-    llvm-manpages = lowPrio (tools.libllvm.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    clang-manpages = lowPrio (tools.libclang.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    lldb-manpages = lowPrio (tools.lldb.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    # Wrapper for standalone command line utilities
-    clang-tools = callPackage ../common/clang-tools { };
-
-    # pick clang appropriate for package set we are targeting
-    clang =
-      /**/ if stdenv.targetPlatform.libc == null then tools.clangNoLibc
-      else if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
-      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
-      else tools.libcxxClang;
-
-    libstdcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
-      libcxx = null;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    libcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    lld = callPackage ../common/lld {
-      patches = [
-        ./lld/gnu-install-dirs.patch
-      ];
-    };
-
-    lldb = callPackage ../common/lldb.nix {
-      patches =
-        let
-          resourceDirPatch = callPackage
-            ({ substituteAll, libclang }: substituteAll
-              {
-                src = ./lldb/resource-dir.patch;
-                clangLibDir = "${libclang.lib}/lib";
-              })
-            { };
-        in
-        [
-          ./lldb/procfs.patch
-          resourceDirPatch
-          ../common/lldb/gnu-install-dirs.patch
-        ]
-        # This is a stopgap solution if/until the macOS SDK used for x86_64 is
-        # updated.
-        #
-        # The older 10.12 SDK used on x86_64 as of this writing has a `mach/machine.h`
-        # header that does not define `CPU_SUBTYPE_ARM64E` so we replace the one use
-        # of this preprocessor symbol in `lldb` with its expansion.
-        #
-        # See here for some context:
-        # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
-        ++ lib.optional (
-          stdenv.targetPlatform.isDarwin
-            && !stdenv.targetPlatform.isAarch64
-            && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
-        ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-    };
-
-    # Below, is the LLVM bootstrapping logic. It handles building a
-    # fully LLVM toolchain from scratch. No GCC toolchain should be
-    # pulled in. As a consequence, it is very quick to build different
-    # targets provided by LLVM and we can also build for what GCC
-    # doesn’t support like LLVM. Probably we should move to some other
-    # file.
-
-    bintools-unwrapped = callPackage ../common/bintools.nix { };
-
-    bintoolsNoLibc = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-      libc = preLibcCrossHeaders;
-    };
-
-    bintools = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-    };
-
-    clangUseLLVM = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [
-        targetLlvmLibraries.libunwind
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [ "-rtlib=compiler-rt"
-          "-Wno-unused-command-line-argument"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) "--unwindlib=libunwind"
-        ++ lib.optional
-          (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false)
-          "-lunwind"
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
-    };
-
-    clangNoLibcxx = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [
-          "-rtlib=compiler-rt"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-          "-nostdlib++"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoLibc = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [
-          "-rtlib=compiler-rt"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoCompilerRt = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-      nixSupport.cc-cflags =
-        [
-          "-nostartfiles"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoCompilerRtWithLibc = wrapCCWith (rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-    } // lib.optionalAttrs stdenv.targetPlatform.isWasm {
-      nixSupport.cc-cflags = [ "-fno-exceptions" ];
-    });
-
-  });
-
-  libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
-  in {
-
-    compiler-rt-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        ./compiler-rt/gnu-install-dirs.patch
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # Prevent a compilation error on darwin
-        ./compiler-rt/darwin-targetconditionals.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/186575
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
-        ../common/compiler-rt/armv7l-15.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
-               else stdenv;
-    };
-
-    compiler-rt-no-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        ./compiler-rt/gnu-install-dirs.patch
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # Prevent a compilation error on darwin
-        ./compiler-rt/darwin-targetconditionals.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/186575
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
-        ../common/compiler-rt/armv7l-15.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
-               else stdenv;
-    };
-
-    # N.B. condition is safe because without useLLVM both are the same.
-    compiler-rt = if stdenv.hostPlatform.isAndroid
-      then libraries.compiler-rt-libc
-      else libraries.compiler-rt-no-libc;
-
-    stdenv = overrideCC stdenv buildLlvmTools.clang;
-
-    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
-
-    # `libcxx` requires a fairly modern C++ compiler,
-    # so: we use the clang from this LLVM package set instead of the regular
-    # stdenv's compiler.
-    libcxx = callPackage ../common/libcxx {
-      patches = [
-        # See:
-        #   - https://reviews.llvm.org/D133566
-        #   - https://github.com/NixOS/nixpkgs/issues/214524#issuecomment-1429146432
-        # !!! Drop in LLVM 16+
-        (fetchpatch {
-          url = "https://github.com/llvm/llvm-project/commit/57c7bb3ec89565c68f858d316504668f9d214d59.patch";
-          hash = "sha256-B07vHmSjy5BhhkGSj3e1E0XmMv5/9+mvC/k70Z29VwY=";
-        })
-        (substitute {
-          src = ../common/libcxxabi/wasm.patch;
-          substitutions = [
-            "--replace-fail" "/cmake/" "/llvm/cmake/"
-          ];
-        })
-      ] ++ lib.optionals stdenv.hostPlatform.isMusl [
-        (substitute {
-          src = ../common/libcxx/libcxx-0001-musl-hacks.patch;
-          substitutions = [
-            "--replace-fail" "/include/" "/libcxx/include/"
-          ];
-        })
-      ];
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    libunwind = callPackage ../common/libunwind {
-      patches = [
-        ./libunwind/gnu-install-dirs.patch
-      ];
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    openmp = callPackage ../common/openmp {
-      patches = [
-        ./openmp/fix-find-tool.patch
-        ./openmp/gnu-install-dirs.patch
-        ./openmp/run-lit-directly.patch
-      ];
-    };
-  });
-  noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
-
-in { inherit tools libraries lldbPlugins; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
deleted file mode 100644
index 1f386437878c..000000000000
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ /dev/null
@@ -1,437 +0,0 @@
-{ lowPrio, newScope, pkgs, lib, stdenv
-, preLibcCrossHeaders
-, substitute, substituteAll, fetchFromGitHub
-, overrideCC, wrapCCWith, wrapBintoolsWith
-, buildLlvmTools # tools, but from the previous stage, for cross
-, targetLlvmLibraries # libraries, but from the next stage, for cross
-, targetLlvm
-# This is the default binutils, but with *this* version of LLD rather
-# than the default LLVM verion's, if LLD is the choice. We use these for
-# the `useLLVM` bootstrapping below.
-, bootBintoolsNoLibc ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintoolsNoLibc
-, bootBintools ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintools
-, darwin
-# LLVM release information; specify one of these but not both:
-, gitRelease ? null
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   rev = /* commit SHA */;
-  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-, officialRelease ? { version = "16.0.6"; sha256 = "sha256-fspqSReX+VD+Nl/Cfq+tDcdPtnQPV1IRopNDfd5VtUs="; }
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   candidate = /* optional; if specified, should be: "rcN" */
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-# By default, we'll try to fetch a release from `github:llvm/llvm-project`
-# corresponding to the `gitRelease` or `officialRelease` specified.
-#
-# You can provide your own LLVM source by specifying this arg but then it's up
-# to you to make sure that the LLVM repo given matches the release configuration
-# specified.
-, monorepoSrc ? null
-# Allows passthrough to packages via newScope. This makes it possible to
-# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
-# an llvmPackages whose packages are overridden in an internally consistent way.
-, ...
-}@args:
-
-assert
-  lib.assertMsg
-    (lib.xor
-      (gitRelease != null)
-      (officialRelease != null))
-    ("must specify `gitRelease` or `officialRelease`" +
-      (lib.optionalString (gitRelease != null) " — not both"));
-let
-  monorepoSrc' = monorepoSrc;
-in let
-
-  metadata = rec {
-    # Import releaseInfo separately to avoid infinite recursion
-    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-    inherit (releaseInfo) release_version version;
-    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub release_version gitRelease officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
-  };
-
-  lldbPlugins = lib.makeExtensible (lldbPlugins: let
-    callPackage = newScope (lldbPlugins // { inherit stdenv; inherit (tools) lldb; });
-  in {
-    llef = callPackage ../common/lldb-plugins/llef.nix {};
-  });
-
-  tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // args // metadata);
-    major = lib.versions.major metadata.release_version;
-    mkExtraBuildCommands0 = cc: ''
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${major}/include" "$rsrc"
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-    '';
-    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
-    '';
-
-  bintoolsNoLibc' =
-    if bootBintoolsNoLibc == null
-    then tools.bintoolsNoLibc
-    else bootBintoolsNoLibc;
-  bintools' =
-    if bootBintools == null
-    then tools.bintools
-    else bootBintools;
-
-  in {
-
-    libllvm = callPackage ../common/llvm {
-      patches = [
-        ./llvm/gnu-install-dirs.patch
-
-        # Running the tests involves invoking binaries (like `opt`) that depend on
-        # the LLVM dylibs and reference them by absolute install path (i.e. their
-        # nix store path).
-        #
-        # Because we have not yet run the install phase (we're running these tests
-        # as part of `checkPhase` instead of `installCheckPhase`) these absolute
-        # paths do not exist yet; to work around this we point the loader (`ld` on
-        # unix, `dyld` on macOS) at the `lib` directory which will later become this
-        # package's `lib` output.
-        #
-        # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
-        # dir but:
-        #   - this doesn't generalize well to other platforms; `lit` doesn't forward
-        #     `DYLD_LIBRARY_PATH` (macOS):
-        #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
-        #   - even if `lit` forwarded this env var, we actually cannot set
-        #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
-        #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
-        #     "protected processes" (i.e. the python interpreter that runs `lit`):
-        #     https://stackoverflow.com/a/35570229
-        #   - other LLVM subprojects deal with this issue by having their `lit`
-        #     configuration set these env vars for us; it makes sense to do the same
-        #     for LLVM:
-        #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
-        #
-        # !!! TODO: look into upstreaming this patch
-        ./llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
-
-        # `lit` has a mode where it executes run lines as a shell script which is
-        # constructs; this is problematic for macOS because it means that there's
-        # another process in between `lit` and the binaries being tested. As noted
-        # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
-        # tests fail with dyld errors.
-        #
-        # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
-        # present in the test configuration.
-        #
-        # It's not clear to me why this isn't an issue for LLVM developers running
-        # on macOS (nothing about this _seems_ nix specific)..
-        ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
-      ];
-      pollyPatches = [
-        ./llvm/gnu-install-dirs-polly.patch
-
-        # Just like the `llvm-lit-cfg` patch, but for `polly`.
-        ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
-      ];
-    };
-
-    # `llvm` historically had the binaries.  When choosing an output explicitly,
-    # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
-    llvm = tools.libllvm;
-
-    libclang = callPackage ../common/clang {
-      patches = [
-        ./clang/purity.patch
-        # https://reviews.llvm.org/D51899
-        ./clang/gnu-install-dirs.patch
-        ../common/clang/add-nostdlibinc-flag.patch
-        (substituteAll {
-          src = ../common/clang/clang-at-least-16-LLVMgold-path.patch;
-          libllvmLibdir = "${tools.libllvm.lib}/lib";
-        })
-      ];
-    };
-
-    clang-unwrapped = tools.libclang;
-
-    llvm-manpages = lowPrio (tools.libllvm.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    clang-manpages = lowPrio (tools.libclang.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    lldb-manpages = lowPrio (tools.lldb.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    # Wrapper for standalone command line utilities
-    clang-tools = callPackage ../common/clang-tools { };
-
-    # pick clang appropriate for package set we are targeting
-    clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
-      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
-      else tools.libcxxClang;
-
-    libstdcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
-      libcxx = null;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    libcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    lld = callPackage ../common/lld {
-      patches = [
-        ./lld/gnu-install-dirs.patch
-        ./lld/add-table-base.patch
-      ];
-    };
-
-    mlir = callPackage ../common/mlir {};
-
-    lldb = callPackage ../common/lldb.nix {
-      src = callPackage ({ runCommand }: runCommand "lldb-src-${metadata.version}" {} ''
-        mkdir -p "$out"
-        cp -r ${monorepoSrc}/cmake "$out"
-        cp -r ${monorepoSrc}/lldb "$out"
-      '') { };
-      patches =
-        let
-          resourceDirPatch = callPackage
-            ({ substituteAll, libclang }: substituteAll
-              {
-                src = ./lldb/resource-dir.patch;
-                clangLibDir = "${libclang.lib}/lib";
-              })
-            { };
-        in
-        [
-          # FIXME: do we need this? ./procfs.patch
-          resourceDirPatch
-          ../common/lldb/gnu-install-dirs.patch
-        ]
-        # This is a stopgap solution if/until the macOS SDK used for x86_64 is
-        # updated.
-        #
-        # The older 10.12 SDK used on x86_64 as of this writing has a `mach/machine.h`
-        # header that does not define `CPU_SUBTYPE_ARM64E` so we replace the one use
-        # of this preprocessor symbol in `lldb` with its expansion.
-        #
-        # See here for some context:
-        # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
-        ++ lib.optional (
-          stdenv.targetPlatform.isDarwin
-            && !stdenv.targetPlatform.isAarch64
-            && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
-        ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-    };
-
-    # Below, is the LLVM bootstrapping logic. It handles building a
-    # fully LLVM toolchain from scratch. No GCC toolchain should be
-    # pulled in. As a consequence, it is very quick to build different
-    # targets provided by LLVM and we can also build for what GCC
-    # doesn’t support like LLVM. Probably we should move to some other
-    # file.
-
-    bintools-unwrapped = callPackage ../common/bintools.nix { };
-
-    bintoolsNoLibc = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-      libc = preLibcCrossHeaders;
-    };
-
-    bintools = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-    };
-
-    clangUseLLVM = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [
-        targetLlvmLibraries.libunwind
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [ "-rtlib=compiler-rt"
-          "-Wno-unused-command-line-argument"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) "--unwindlib=libunwind"
-        ++ lib.optional
-          (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false)
-          "-lunwind"
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
-    };
-
-    clangNoLibcxx = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [
-          "-rtlib=compiler-rt"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-          "-nostdlib++"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoLibc = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [
-          "-rtlib=compiler-rt"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoCompilerRt = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-      nixSupport.cc-cflags =
-        [
-          "-nostartfiles"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoCompilerRtWithLibc = wrapCCWith (rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-    } // lib.optionalAttrs stdenv.targetPlatform.isWasm {
-      nixSupport.cc-cflags = [ "-fno-exceptions" ];
-    });
-
-    # Has to be in tools despite mostly being a library,
-    # because we use a native helper executable from a
-    # non-cross build in cross builds.
-    libclc = callPackage ../common/libclc.nix {};
-  });
-
-  libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
-  in {
-
-    compiler-rt-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        ./compiler-rt/gnu-install-dirs.patch
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # Prevent a compilation error on darwin
-        ./compiler-rt/darwin-targetconditionals.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/186575
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
-        # ../common/compiler-rt/armv7l-15.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic)
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
-               else stdenv;
-    };
-
-    compiler-rt-no-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        ./compiler-rt/gnu-install-dirs.patch
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # Prevent a compilation error on darwin
-        ./compiler-rt/darwin-targetconditionals.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/186575
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
-        # ../common/compiler-rt/armv7l-15.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
-               else stdenv;
-    };
-
-    # N.B. condition is safe because without useLLVM both are the same.
-    compiler-rt = if stdenv.hostPlatform.isAndroid || stdenv.hostPlatform.isDarwin
-      then libraries.compiler-rt-libc
-      else libraries.compiler-rt-no-libc;
-
-    stdenv = overrideCC stdenv buildLlvmTools.clang;
-
-    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
-
-    # `libcxx` requires a fairly modern C++ compiler,
-    # so: we use the clang from this LLVM package set instead of the regular
-    # stdenv's compiler.
-    libcxx = callPackage ../common/libcxx {
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    libunwind = callPackage ../common/libunwind {
-      patches = [
-        ./libunwind/gnu-install-dirs.patch
-      ];
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    openmp = callPackage ../common/openmp {
-      patches = [
-        ./openmp/fix-find-tool.patch
-        ./openmp/gnu-install-dirs.patch
-        ./openmp/run-lit-directly.patch
-      ];
-    };
-  });
-  noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
-
-in { inherit tools libraries lldbPlugins; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/17/default.nix b/pkgs/development/compilers/llvm/17/default.nix
deleted file mode 100644
index a7b5ac3461b3..000000000000
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ /dev/null
@@ -1,434 +0,0 @@
-{ lowPrio, newScope, pkgs, lib, stdenv
-, preLibcCrossHeaders
-, substitute, substituteAll, fetchFromGitHub, fetchpatch
-, overrideCC, wrapCCWith, wrapBintoolsWith
-, buildLlvmTools # tools, but from the previous stage, for cross
-, targetLlvmLibraries # libraries, but from the next stage, for cross
-, targetLlvm
-# This is the default binutils, but with *this* version of LLD rather
-# than the default LLVM verion's, if LLD is the choice. We use these for
-# the `useLLVM` bootstrapping below.
-, bootBintoolsNoLibc ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintoolsNoLibc
-, bootBintools ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintools
-, darwin
-# LLVM release information; specify one of these but not both:
-, gitRelease ? null
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   rev = /* commit SHA */;
-  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-, officialRelease ? { version = "17.0.6"; sha256 = "sha256-8MEDLLhocshmxoEBRSKlJ/GzJ8nfuzQ8qn0X/vLA+ag="; }
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   candidate = /* optional; if specified, should be: "rcN" */
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-# By default, we'll try to fetch a release from `github:llvm/llvm-project`
-# corresponding to the `gitRelease` or `officialRelease` specified.
-#
-# You can provide your own LLVM source by specifying this arg but then it's up
-# to you to make sure that the LLVM repo given matches the release configuration
-# specified.
-, monorepoSrc ? null
-# Allows passthrough to packages via newScope. This makes it possible to
-# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
-# an llvmPackages whose packages are overridden in an internally consistent way.
-, ...
-}@args:
-
-assert
-  lib.assertMsg
-    (lib.xor
-      (gitRelease != null)
-      (officialRelease != null))
-    ("must specify `gitRelease` or `officialRelease`" +
-      (lib.optionalString (gitRelease != null) " — not both"));
-let
-  monorepoSrc' = monorepoSrc;
-in let
-
-  metadata = rec {
-    # Import releaseInfo separately to avoid infinite recursion
-    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-    inherit (releaseInfo) release_version version;
-    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub gitRelease release_version officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
-  };
-
-  tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // args // metadata);
-    major = lib.versions.major metadata.release_version;
-    mkExtraBuildCommands0 = cc: ''
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${major}/include" "$rsrc"
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-    '';
-    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
-    '';
-
-  bintoolsNoLibc' =
-    if bootBintoolsNoLibc == null
-    then tools.bintoolsNoLibc
-    else bootBintoolsNoLibc;
-  bintools' =
-    if bootBintools == null
-    then tools.bintools
-    else bootBintools;
-
-  in {
-
-    libllvm = callPackage ../common/llvm {
-      patches = [
-        ./llvm/gnu-install-dirs.patch
-
-        # Running the tests involves invoking binaries (like `opt`) that depend on
-        # the LLVM dylibs and reference them by absolute install path (i.e. their
-        # nix store path).
-        #
-        # Because we have not yet run the install phase (we're running these tests
-        # as part of `checkPhase` instead of `installCheckPhase`) these absolute
-        # paths do not exist yet; to work around this we point the loader (`ld` on
-        # unix, `dyld` on macOS) at the `lib` directory which will later become this
-        # package's `lib` output.
-        #
-        # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
-        # dir but:
-        #   - this doesn't generalize well to other platforms; `lit` doesn't forward
-        #     `DYLD_LIBRARY_PATH` (macOS):
-        #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
-        #   - even if `lit` forwarded this env var, we actually cannot set
-        #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
-        #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
-        #     "protected processes" (i.e. the python interpreter that runs `lit`):
-        #     https://stackoverflow.com/a/35570229
-        #   - other LLVM subprojects deal with this issue by having their `lit`
-        #     configuration set these env vars for us; it makes sense to do the same
-        #     for LLVM:
-        #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
-        #
-        # !!! TODO: look into upstreaming this patch
-        ./llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
-
-        # `lit` has a mode where it executes run lines as a shell script which is
-        # constructs; this is problematic for macOS because it means that there's
-        # another process in between `lit` and the binaries being tested. As noted
-        # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
-        # tests fail with dyld errors.
-        #
-        # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
-        # present in the test configuration.
-        #
-        # It's not clear to me why this isn't an issue for LLVM developers running
-        # on macOS (nothing about this _seems_ nix specific)..
-        ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
-
-        # resolves https://github.com/llvm/llvm-project/issues/75168
-        (fetchpatch {
-          name = "fix-fzero-call-used-regs.patch";
-          url = "https://github.com/llvm/llvm-project/commit/f800c1f3b207e7bcdc8b4c7192928d9a078242a0.patch";
-          stripLen = 1;
-          hash = "sha256-e8YKrMy2rGcSJGC6er2V66cOnAnI+u1/yImkvsRsmg8=";
-        })
-      ];
-      pollyPatches = [
-        ./llvm/gnu-install-dirs-polly.patch
-
-        # Just like the `llvm-lit-cfg` patch, but for `polly`.
-        ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
-      ];
-    };
-
-    # `llvm` historically had the binaries.  When choosing an output explicitly,
-    # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
-    llvm = tools.libllvm;
-
-    libclang = callPackage ../common/clang {
-      patches = [
-        ./clang/purity.patch
-        # https://reviews.llvm.org/D51899
-        ./clang/gnu-install-dirs.patch
-        ../common/clang/add-nostdlibinc-flag.patch
-        (substituteAll {
-          src = ../common/clang/clang-at-least-16-LLVMgold-path.patch;
-          libllvmLibdir = "${tools.libllvm.lib}/lib";
-        })
-      ];
-    };
-
-    clang-unwrapped = tools.libclang;
-
-    llvm-manpages = lowPrio (tools.libllvm.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    clang-manpages = lowPrio (tools.libclang.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    lldb-manpages = lowPrio (tools.lldb.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    # Wrapper for standalone command line utilities
-    clang-tools = callPackage ../common/clang-tools { };
-
-    # pick clang appropriate for package set we are targeting
-    clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
-      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
-      else tools.libcxxClang;
-
-    libstdcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
-      libcxx = null;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    libcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    lld = callPackage ../common/lld {
-      patches = [
-        ./lld/gnu-install-dirs.patch
-        ./lld/add-table-base.patch
-      ];
-    };
-
-    mlir = callPackage ../common/mlir {};
-
-    lldb = callPackage ../common/lldb.nix {
-      src = callPackage ({ runCommand }: runCommand "lldb-src-${metadata.version}" {} ''
-        mkdir -p "$out"
-        cp -r ${monorepoSrc}/cmake "$out"
-        cp -r ${monorepoSrc}/lldb "$out"
-      '') { };
-      patches =
-        [
-          # FIXME: do we need this? ./procfs.patch
-          ../common/lldb/gnu-install-dirs.patch
-        ]
-        # This is a stopgap solution if/until the macOS SDK used for x86_64 is
-        # updated.
-        #
-        # The older 10.12 SDK used on x86_64 as of this writing has a `mach/machine.h`
-        # header that does not define `CPU_SUBTYPE_ARM64E` so we replace the one use
-        # of this preprocessor symbol in `lldb` with its expansion.
-        #
-        # See here for some context:
-        # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
-        ++ lib.optional (
-          stdenv.targetPlatform.isDarwin
-            && !stdenv.targetPlatform.isAarch64
-            && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
-        ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-    };
-
-    # Below, is the LLVM bootstrapping logic. It handles building a
-    # fully LLVM toolchain from scratch. No GCC toolchain should be
-    # pulled in. As a consequence, it is very quick to build different
-    # targets provided by LLVM and we can also build for what GCC
-    # doesn’t support like LLVM. Probably we should move to some other
-    # file.
-
-    bintools-unwrapped = callPackage ../common/bintools.nix { };
-
-    bintoolsNoLibc = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-      libc = preLibcCrossHeaders;
-    };
-
-    bintools = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-    };
-
-    clangUseLLVM = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [
-        targetLlvmLibraries.libunwind
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [ "-rtlib=compiler-rt"
-          "-Wno-unused-command-line-argument"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) "--unwindlib=libunwind"
-        ++ lib.optional
-          (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false)
-          "-lunwind"
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
-    };
-
-    clangNoLibcxx = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [
-          "-rtlib=compiler-rt"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-          "-nostdlib++"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoLibc = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [
-          "-rtlib=compiler-rt"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoCompilerRt = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-      nixSupport.cc-cflags =
-        [
-          "-nostartfiles"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoCompilerRtWithLibc = wrapCCWith (rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-    } // lib.optionalAttrs stdenv.targetPlatform.isWasm {
-      nixSupport.cc-cflags = [ "-fno-exceptions" ];
-    });
-
-    # Has to be in tools despite mostly being a library,
-    # because we use a native helper executable from a
-    # non-cross build in cross builds.
-    libclc = callPackage ../common/libclc.nix {};
-  });
-
-  libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
-  in {
-
-    compiler-rt-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        ./compiler-rt/gnu-install-dirs.patch
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # Prevent a compilation error on darwin
-        ./compiler-rt/darwin-targetconditionals.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/186575
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
-        # ../common/compiler-rt/armv7l-15.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic)
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
-               else stdenv;
-    };
-
-    compiler-rt-no-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        ./compiler-rt/gnu-install-dirs.patch
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # Prevent a compilation error on darwin
-        ./compiler-rt/darwin-targetconditionals.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/186575
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
-        # ../common/compiler-rt/armv7l-15.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
-               else stdenv;
-    };
-
-    # N.B. condition is safe because without useLLVM both are the same.
-    compiler-rt = if stdenv.hostPlatform.isAndroid || stdenv.hostPlatform.isDarwin
-      then libraries.compiler-rt-libc
-      else libraries.compiler-rt-no-libc;
-
-    stdenv = overrideCC stdenv buildLlvmTools.clang;
-
-    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
-
-    # `libcxx` requires a fairly modern C++ compiler,
-    # so: we use the clang from this LLVM package set instead of the regular
-    # stdenv's compiler.
-    libcxx = callPackage ../common/libcxx {
-      patches = lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13") [
-        # https://github.com/llvm/llvm-project/issues/64226
-        (fetchpatch {
-          name = "0042-mbstate_t-not-defined.patch";
-          url = "https://github.com/macports/macports-ports/raw/acd8acb171f1658596ed1cf25da48d5b932e2d19/lang/llvm-17/files/0042-mbstate_t-not-defined.patch";
-          hash = "sha256-jo+DYA6zuSv9OH3A0bYwY5TlkWprup4OKQ7rfK1WHBI=";
-        })
-      ];
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    libunwind = callPackage ../common/libunwind {
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    openmp = callPackage ../common/openmp {
-      patches = [
-        ./openmp/fix-find-tool.patch
-        ./openmp/gnu-install-dirs.patch
-        ./openmp/run-lit-directly.patch
-      ];
-    };
-  });
-  noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
-
-in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/18/default.nix b/pkgs/development/compilers/llvm/18/default.nix
deleted file mode 100644
index 9d0dff4e52f3..000000000000
--- a/pkgs/development/compilers/llvm/18/default.nix
+++ /dev/null
@@ -1,422 +0,0 @@
-{ lowPrio, newScope, pkgs, lib, stdenv
-, preLibcCrossHeaders
-, substitute, substituteAll, fetchFromGitHub, fetchpatch
-, overrideCC, wrapCCWith, wrapBintoolsWith
-, buildLlvmTools # tools, but from the previous stage, for cross
-, targetLlvmLibraries # libraries, but from the next stage, for cross
-, targetLlvm
-# This is the default binutils, but with *this* version of LLD rather
-# than the default LLVM verion's, if LLD is the choice. We use these for
-# the `useLLVM` bootstrapping below.
-, bootBintoolsNoLibc ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintoolsNoLibc
-, bootBintools ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintools
-, darwin
-# LLVM release information; specify one of these but not both:
-, gitRelease ? null
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   rev = /* commit SHA */;
-  #   rev-version = /* human readable version; i.e. "unstable-2022-26-07" */;
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-, officialRelease ? { version = "18.1.8"; sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE="; }
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   candidate = /* optional; if specified, should be: "rcN" */
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-# By default, we'll try to fetch a release from `github:llvm/llvm-project`
-# corresponding to the `gitRelease` or `officialRelease` specified.
-#
-# You can provide your own LLVM source by specifying this arg but then it's up
-# to you to make sure that the LLVM repo given matches the release configuration
-# specified.
-, monorepoSrc ? null
-# Allows passthrough to packages via newScope. This makes it possible to
-# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
-# an llvmPackages whose packages are overridden in an internally consistent way.
-, ...
-}@args:
-
-assert
-  lib.assertMsg
-    (lib.xor
-      (gitRelease != null)
-      (officialRelease != null))
-    ("must specify `gitRelease` or `officialRelease`" +
-      (lib.optionalString (gitRelease != null) " — not both"));
-let
-  monorepoSrc' = monorepoSrc;
-in let
-
-  metadata = rec {
-    # Import releaseInfo separately to avoid infinite recursion
-    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-    inherit (releaseInfo) release_version version;
-    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub gitRelease release_version officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
-  };
-
-  tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // args // metadata);
-    major = lib.versions.major metadata.release_version;
-    mkExtraBuildCommands0 = cc: ''
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${major}/include" "$rsrc"
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-    '';
-    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
-    '';
-
-  bintoolsNoLibc' =
-    if bootBintoolsNoLibc == null
-    then tools.bintoolsNoLibc
-    else bootBintoolsNoLibc;
-  bintools' =
-    if bootBintools == null
-    then tools.bintools
-    else bootBintools;
-
-  in {
-
-    libllvm = callPackage ../common/llvm {
-      patches = [
-        ./llvm/gnu-install-dirs.patch
-
-        # Running the tests involves invoking binaries (like `opt`) that depend on
-        # the LLVM dylibs and reference them by absolute install path (i.e. their
-        # nix store path).
-        #
-        # Because we have not yet run the install phase (we're running these tests
-        # as part of `checkPhase` instead of `installCheckPhase`) these absolute
-        # paths do not exist yet; to work around this we point the loader (`ld` on
-        # unix, `dyld` on macOS) at the `lib` directory which will later become this
-        # package's `lib` output.
-        #
-        # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
-        # dir but:
-        #   - this doesn't generalize well to other platforms; `lit` doesn't forward
-        #     `DYLD_LIBRARY_PATH` (macOS):
-        #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
-        #   - even if `lit` forwarded this env var, we actually cannot set
-        #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
-        #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
-        #     "protected processes" (i.e. the python interpreter that runs `lit`):
-        #     https://stackoverflow.com/a/35570229
-        #   - other LLVM subprojects deal with this issue by having their `lit`
-        #     configuration set these env vars for us; it makes sense to do the same
-        #     for LLVM:
-        #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
-        #
-        # !!! TODO: look into upstreaming this patch
-        ./llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
-
-        # `lit` has a mode where it executes run lines as a shell script which is
-        # constructs; this is problematic for macOS because it means that there's
-        # another process in between `lit` and the binaries being tested. As noted
-        # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
-        # tests fail with dyld errors.
-        #
-        # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
-        # present in the test configuration.
-        #
-        # It's not clear to me why this isn't an issue for LLVM developers running
-        # on macOS (nothing about this _seems_ nix specific)..
-        ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
-      ];
-      pollyPatches = [
-        ./llvm/gnu-install-dirs-polly.patch
-
-        # Just like the `llvm-lit-cfg` patch, but for `polly`.
-        ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
-      ];
-    };
-
-    # `llvm` historically had the binaries.  When choosing an output explicitly,
-    # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
-    llvm = tools.libllvm;
-
-    libclang = callPackage ../common/clang {
-      patches = [
-        ./clang/purity.patch
-        # https://reviews.llvm.org/D51899
-        ./clang/gnu-install-dirs.patch
-        ../common/clang/add-nostdlibinc-flag.patch
-        (substituteAll {
-          src = ../common/clang/clang-at-least-16-LLVMgold-path.patch;
-          libllvmLibdir = "${tools.libllvm.lib}/lib";
-        })
-        (fetchpatch {
-          name = "tweak-tryCaptureVariable-for-unevaluated-lambdas.patch";
-          url = "https://github.com/llvm/llvm-project/commit/3d361b225fe89ce1d8c93639f27d689082bd8dad.patch";
-          # TreeTransform.h is not affected in LLVM 18.
-          excludes = ["docs/ReleaseNotes.rst" "lib/Sema/TreeTransform.h"];
-          stripLen = 1;
-          hash = "sha256-1NKej08R9SPlbDY/5b0OKUsHjX07i9brR84yXiPwi7E=";
-        })
-      ];
-    };
-
-    clang-unwrapped = tools.libclang;
-
-    llvm-manpages = lowPrio (tools.libllvm.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    clang-manpages = lowPrio (tools.libclang.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    lldb-manpages = lowPrio (tools.lldb.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    # Wrapper for standalone command line utilities
-    clang-tools = callPackage ../common/clang-tools { };
-
-    # pick clang appropriate for package set we are targeting
-    clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
-      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
-      else tools.libcxxClang;
-
-    libstdcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
-      libcxx = null;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    libcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    lld = callPackage ../common/lld {
-      patches = [
-        ./lld/gnu-install-dirs.patch
-      ];
-    };
-
-    mlir = callPackage ../common/mlir {};
-
-    lldb = callPackage ../common/lldb.nix {
-      src = callPackage ({ runCommand }: runCommand "lldb-src-${metadata.version}" {} ''
-        mkdir -p "$out"
-        cp -r ${monorepoSrc}/cmake "$out"
-        cp -r ${monorepoSrc}/lldb "$out"
-      '') { };
-      patches =
-        [
-          # FIXME: do we need this? ./procfs.patch
-          ../common/lldb/gnu-install-dirs.patch
-        ]
-        # This is a stopgap solution if/until the macOS SDK used for x86_64 is
-        # updated.
-        #
-        # The older 10.12 SDK used on x86_64 as of this writing has a `mach/machine.h`
-        # header that does not define `CPU_SUBTYPE_ARM64E` so we replace the one use
-        # of this preprocessor symbol in `lldb` with its expansion.
-        #
-        # See here for some context:
-        # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
-        ++ lib.optional (
-          stdenv.targetPlatform.isDarwin
-            && !stdenv.targetPlatform.isAarch64
-            && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
-        ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-    };
-
-    # Below, is the LLVM bootstrapping logic. It handles building a
-    # fully LLVM toolchain from scratch. No GCC toolchain should be
-    # pulled in. As a consequence, it is very quick to build different
-    # targets provided by LLVM and we can also build for what GCC
-    # doesn’t support like LLVM. Probably we should move to some other
-    # file.
-
-    bintools-unwrapped = callPackage ../common/bintools.nix { };
-
-    bintoolsNoLibc = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-      libc = preLibcCrossHeaders;
-    };
-
-    bintools = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-    };
-
-    clangUseLLVM = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [
-        targetLlvmLibraries.libunwind
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [ "-rtlib=compiler-rt"
-          "-Wno-unused-command-line-argument"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) "--unwindlib=libunwind"
-        ++ lib.optional
-          (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false)
-          "-lunwind"
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
-    };
-
-    clangNoLibcxx = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [
-          "-rtlib=compiler-rt"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-          "-nostdlib++"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoLibc = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [
-          "-rtlib=compiler-rt"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoCompilerRt = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-      nixSupport.cc-cflags =
-        [
-          "-nostartfiles"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoCompilerRtWithLibc = wrapCCWith (rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-    } // lib.optionalAttrs stdenv.targetPlatform.isWasm {
-      nixSupport.cc-cflags = [ "-fno-exceptions" ];
-    });
-
-    # Has to be in tools despite mostly being a library,
-    # because we use a native helper executable from a
-    # non-cross build in cross builds.
-    libclc = callPackage ../common/libclc.nix {};
-  });
-
-  libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
-  in {
-
-    compiler-rt-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/186575
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
-        # ../common/compiler-rt/armv7l-15.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic)
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
-               else stdenv;
-    };
-
-    compiler-rt-no-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/186575
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
-        # ../common/compiler-rt/armv7l-15.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
-               else stdenv;
-    };
-
-    # N.B. condition is safe because without useLLVM both are the same.
-    compiler-rt = if stdenv.hostPlatform.isAndroid || stdenv.hostPlatform.isDarwin
-      then libraries.compiler-rt-libc
-      else libraries.compiler-rt-no-libc;
-
-    stdenv = overrideCC stdenv buildLlvmTools.clang;
-
-    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
-
-    # `libcxx` requires a fairly modern C++ compiler,
-    # so: we use the clang from this LLVM package set instead of the regular
-    # stdenv's compiler.
-    libcxx = callPackage ../common/libcxx {
-      patches = lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13") [
-        # https://github.com/llvm/llvm-project/issues/64226
-        ./libcxx/0001-darwin-10.12-mbstate_t-fix.patch
-      ];
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    libunwind = callPackage ../common/libunwind {
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    openmp = callPackage ../common/openmp {
-      patches = [
-        ./openmp/fix-find-tool.patch
-        ./openmp/run-lit-directly.patch
-      ];
-    };
-  });
-  noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
-
-in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/common/common-let.nix b/pkgs/development/compilers/llvm/common/common-let.nix
index 31360f5b98b9..6ee05b80c446 100644
--- a/pkgs/development/compilers/llvm/common/common-let.nix
+++ b/pkgs/development/compilers/llvm/common/common-let.nix
@@ -4,7 +4,8 @@
 , gitRelease ? null
 , officialRelease ? null
 , monorepoSrc' ? null
-}:
+, version ? null,
+}@args:
 
 rec {
   llvm_meta = {
@@ -27,11 +28,11 @@ rec {
   releaseInfo =
     if gitRelease != null then rec {
       original = gitRelease;
-      release_version = original.version;
+      release_version = args.version or original.version;
       version = gitRelease.rev-version;
     } else rec {
       original = officialRelease;
-      release_version = original.version;
+      release_version = args.version or original.version;
       version =
         if original ? candidate then
           "${release_version}-${original.candidate}"
diff --git a/pkgs/development/compilers/llvm/common/default.nix b/pkgs/development/compilers/llvm/common/default.nix
new file mode 100644
index 000000000000..7e8e65b51c1e
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/default.nix
@@ -0,0 +1,741 @@
+{
+  lowPrio,
+  newScope,
+  pkgs,
+  lib,
+  stdenv,
+  preLibcCrossHeaders,
+  substitute,
+  substituteAll,
+  fetchFromGitHub,
+  fetchpatch,
+  overrideCC,
+  wrapCCWith,
+  wrapBintoolsWith,
+  buildLlvmTools, # tools, but from the previous stage, for cross
+  targetLlvmLibraries, # libraries, but from the next stage, for cross
+  targetLlvm,
+  # This is the default binutils, but with *this* version of LLD rather
+  # than the default LLVM version's, if LLD is the choice. We use these for
+  # the `useLLVM` bootstrapping below.
+  bootBintoolsNoLibc ? if stdenv.targetPlatform.linker == "lld" then null else pkgs.bintoolsNoLibc,
+  bootBintools ? if stdenv.targetPlatform.linker == "lld" then null else pkgs.bintools,
+  darwin,
+  gitRelease ? null,
+  officialRelease ? null,
+  monorepoSrc ? null,
+  version ? null,
+  ...
+}@args:
+
+assert lib.assertMsg (lib.xor (gitRelease != null) (officialRelease != null)) (
+  "must specify `gitRelease` or `officialRelease`"
+  + (lib.optionalString (gitRelease != null) " — not both")
+);
+
+let
+  monorepoSrc' = monorepoSrc;
+
+  metadata = rec {
+    # Import releaseInfo separately to avoid infinite recursion
+    inherit
+      (import ./common-let.nix {
+        inherit (args)
+          lib
+          gitRelease
+          officialRelease
+          version
+          ;
+      })
+      releaseInfo
+      ;
+    inherit (releaseInfo) release_version version;
+    inherit
+      (import ./common-let.nix {
+        inherit
+          lib
+          fetchFromGitHub
+          release_version
+          gitRelease
+          officialRelease
+          monorepoSrc'
+          version
+          ;
+      })
+      llvm_meta
+      monorepoSrc
+      ;
+    src = monorepoSrc;
+    versionDir =
+      (builtins.toString ../.)
+      + "/${if (gitRelease != null) then "git" else lib.versions.major release_version}";
+    getVersionFile =
+      p:
+      builtins.path {
+        name = builtins.baseNameOf p;
+        path = "${metadata.versionDir}/${p}";
+      };
+  };
+
+  lldbPlugins = lib.makeExtensible (
+    lldbPlugins:
+    let
+      callPackage = newScope (
+        lldbPlugins
+        // {
+          inherit stdenv;
+          inherit (tools) lldb;
+        }
+      );
+    in
+    {
+      llef = callPackage ./lldb-plugins/llef.nix { };
+    }
+  );
+
+  tools = lib.makeExtensible (
+    tools:
+    let
+      callPackage = newScope (
+        tools
+        // args
+        // metadata
+        # Previously monorepoSrc was erroneously not being passed through.
+        // lib.optionalAttrs (lib.versionOlder metadata.release_version "14") { monorepoSrc = null; } # Preserve a bug during #307211, TODO: remove; causes llvm 13 rebuild.
+      );
+      clangVersion =
+        if (lib.versionOlder metadata.release_version "16") then
+          metadata.release_version
+        else
+          lib.versions.major metadata.release_version;
+      mkExtraBuildCommands0 = cc: ''
+        rsrc="$out/resource-root"
+        mkdir "$rsrc"
+        ln -s "${cc.lib}/lib/clang/${clangVersion}/include" "$rsrc"
+        echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
+      '';
+      mkExtraBuildCommands =
+        cc:
+        mkExtraBuildCommands0 cc
+        + ''
+          ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
+          ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
+        '';
+
+      bintoolsNoLibc' = if bootBintoolsNoLibc == null then tools.bintoolsNoLibc else bootBintoolsNoLibc;
+      bintools' = if bootBintools == null then tools.bintools else bootBintools;
+    in
+    {
+      libllvm = callPackage ./llvm {
+        patches =
+          lib.optional (lib.versionOlder metadata.release_version "14") ./llvm/llvm-config-link-static.patch
+          ++ [ (metadata.getVersionFile "llvm/gnu-install-dirs.patch") ]
+          ++ lib.optionals (lib.versionAtLeast metadata.release_version "15") [
+            # Running the tests involves invoking binaries (like `opt`) that depend on
+            # the LLVM dylibs and reference them by absolute install path (i.e. their
+            # nix store path).
+            #
+            # Because we have not yet run the install phase (we're running these tests
+            # as part of `checkPhase` instead of `installCheckPhase`) these absolute
+            # paths do not exist yet; to work around this we point the loader (`ld` on
+            # unix, `dyld` on macOS) at the `lib` directory which will later become this
+            # package's `lib` output.
+            #
+            # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
+            # dir but:
+            #   - this doesn't generalize well to other platforms; `lit` doesn't forward
+            #     `DYLD_LIBRARY_PATH` (macOS):
+            #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
+            #   - even if `lit` forwarded this env var, we actually cannot set
+            #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
+            #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
+            #     "protected processes" (i.e. the python interpreter that runs `lit`):
+            #     https://stackoverflow.com/a/35570229
+            #   - other LLVM subprojects deal with this issue by having their `lit`
+            #     configuration set these env vars for us; it makes sense to do the same
+            #     for LLVM:
+            #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
+            #
+            # !!! TODO: look into upstreaming this patch
+            (metadata.getVersionFile "llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch")
+
+            # `lit` has a mode where it executes run lines as a shell script which is
+            # constructs; this is problematic for macOS because it means that there's
+            # another process in between `lit` and the binaries being tested. As noted
+            # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
+            # tests fail with dyld errors.
+            #
+            # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
+            # present in the test configuration.
+            #
+            # It's not clear to me why this isn't an issue for LLVM developers running
+            # on macOS (nothing about this _seems_ nix specific)..
+            (metadata.getVersionFile "llvm/lit-shell-script-runner-set-dyld-library-path.patch")
+          ]
+          ++
+            lib.optional (lib.versions.major metadata.release_version == "13")
+              # Fix random compiler crashes: https://bugs.llvm.org/show_bug.cgi?id=50611
+              (
+                fetchpatch {
+                  url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/4764a4f8c920912a2bfd8b0eea57273acfe0d8a8/trunk/no-strict-aliasing-DwarfCompileUnit.patch";
+                  sha256 = "18l6mrvm2vmwm77ckcnbjvh6ybvn72rhrb799d4qzwac4x2ifl7g";
+                  stripLen = 1;
+                }
+              )
+          ++
+            lib.optional (lib.versionOlder metadata.release_version "16")
+              # Fix musl build.
+              (
+                fetchpatch {
+                  url = "https://github.com/llvm/llvm-project/commit/5cd554303ead0f8891eee3cd6d25cb07f5a7bf67.patch";
+                  relative = "llvm";
+                  hash = "sha256-XPbvNJ45SzjMGlNUgt/IgEvM2dHQpDOe6woUJY+nUYA=";
+                }
+              )
+          ++ lib.optionals (lib.versions.major metadata.release_version == "13") [
+            # Backport gcc-13 fixes with missing includes.
+            (fetchpatch {
+              name = "signals-gcc-13.patch";
+              url = "https://github.com/llvm/llvm-project/commit/ff1681ddb303223973653f7f5f3f3435b48a1983.patch";
+              hash = "sha256-CXwYxQezTq5vdmc8Yn88BUAEly6YZ5VEIA6X3y5NNOs=";
+              stripLen = 1;
+            })
+            (fetchpatch {
+              name = "base64-gcc-13.patch";
+              url = "https://github.com/llvm/llvm-project/commit/5e9be93566f39ee6cecd579401e453eccfbe81e5.patch";
+              hash = "sha256-PAwrVrvffPd7tphpwCkYiz+67szPRzRB2TXBvKfzQ7U=";
+              stripLen = 1;
+            })
+          ]
+          ++ lib.optionals (lib.versions.major metadata.release_version == "14") [
+            # fix RuntimeDyld usage on aarch64-linux (e.g. python312Packages.numba tests)
+            (fetchpatch {
+              url = "https://github.com/llvm/llvm-project/commit/2e1b838a889f9793d4bcd5dbfe10db9796b77143.patch";
+              relative = "llvm";
+              hash = "sha256-Ot45P/iwaR4hkcM3xtLwfryQNgHI6pv6ADjv98tgdZA=";
+            })
+          ]
+          ++
+            lib.optional (lib.versions.major metadata.release_version == "17")
+              # resolves https://github.com/llvm/llvm-project/issues/75168
+              (
+                fetchpatch {
+                  name = "fix-fzero-call-used-regs.patch";
+                  url = "https://github.com/llvm/llvm-project/commit/f800c1f3b207e7bcdc8b4c7192928d9a078242a0.patch";
+                  stripLen = 1;
+                  hash = "sha256-e8YKrMy2rGcSJGC6er2V66cOnAnI+u1/yImkvsRsmg8=";
+                }
+              );
+        pollyPatches =
+          [ (metadata.getVersionFile "llvm/gnu-install-dirs-polly.patch") ]
+          ++ lib.optional (lib.versionAtLeast metadata.release_version "15")
+            # Just like the `llvm-lit-cfg` patch, but for `polly`.
+            (metadata.getVersionFile "llvm/polly-lit-cfg-add-libs-to-dylib-path.patch");
+      };
+
+      # `llvm` historically had the binaries.  When choosing an output explicitly,
+      # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
+      llvm = tools.libllvm;
+
+      libclang = callPackage ./clang {
+        patches =
+          [
+            (metadata.getVersionFile "clang/purity.patch")
+            # https://reviews.llvm.org/D51899
+            (metadata.getVersionFile "clang/gnu-install-dirs.patch")
+          ]
+          ++ lib.optional (lib.versions.major metadata.release_version == "13")
+            # Revert of https://reviews.llvm.org/D100879
+            # The malloc alignment assumption is incorrect for jemalloc and causes
+            # mis-compilation in firefox.
+            # See: https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
+            (metadata.getVersionFile "clang/revert-malloc-alignment-assumption.patch")
+          ++ [
+            ./clang/add-nostdlibinc-flag.patch
+            (substituteAll {
+              src =
+                if (lib.versionOlder metadata.release_version "16") then
+                  ./clang/clang-11-15-LLVMgold-path.patch
+                else
+                  ./clang/clang-at-least-16-LLVMgold-path.patch;
+              libllvmLibdir = "${tools.libllvm.lib}/lib";
+            })
+          ]
+          ++ lib.optional (lib.versions.major metadata.release_version == "18") (fetchpatch {
+            name = "tweak-tryCaptureVariable-for-unevaluated-lambdas.patch";
+            url = "https://github.com/llvm/llvm-project/commit/3d361b225fe89ce1d8c93639f27d689082bd8dad.patch";
+            # TreeTransform.h is not affected in LLVM 18.
+            excludes = [
+              "docs/ReleaseNotes.rst"
+              "lib/Sema/TreeTransform.h"
+            ];
+            stripLen = 1;
+            hash = "sha256-1NKej08R9SPlbDY/5b0OKUsHjX07i9brR84yXiPwi7E=";
+          });
+      };
+
+      clang-unwrapped = tools.libclang;
+
+      llvm-manpages = lowPrio (
+        tools.libllvm.override {
+          enableManpages = true;
+          python3 = pkgs.python3; # don't use python-boot
+        }
+      );
+
+      clang-manpages = lowPrio (
+        tools.libclang.override {
+          enableManpages = true;
+          python3 = pkgs.python3; # don't use python-boot
+        }
+      );
+
+      # Wrapper for standalone command line utilities
+      clang-tools = callPackage ./clang-tools { };
+
+      # pick clang appropriate for package set we are targeting
+      clang =
+        if stdenv.targetPlatform.libc == null then
+          tools.clangNoLibc
+        else if stdenv.targetPlatform.useLLVM or false then
+          tools.clangUseLLVM
+        else if (pkgs.targetPackages.stdenv or args.stdenv).cc.isGNU then
+          tools.libstdcxxClang
+        else
+          tools.libcxxClang;
+
+      libstdcxxClang = wrapCCWith rec {
+        cc = tools.clang-unwrapped;
+        # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
+        libcxx = null;
+        extraPackages = [ targetLlvmLibraries.compiler-rt ];
+        extraBuildCommands = mkExtraBuildCommands cc;
+      };
+
+      libcxxClang = wrapCCWith rec {
+        cc = tools.clang-unwrapped;
+        libcxx = targetLlvmLibraries.libcxx;
+        extraPackages = [ targetLlvmLibraries.compiler-rt ];
+        extraBuildCommands = mkExtraBuildCommands cc;
+      };
+
+      lld = callPackage ./lld {
+        patches =
+          [ (metadata.getVersionFile "lld/gnu-install-dirs.patch") ]
+          ++ lib.optional (lib.versions.major metadata.release_version == "14") (
+            metadata.getVersionFile "lld/fix-root-src-dir.patch"
+          )
+          ++ lib.optional (
+            lib.versionAtLeast metadata.release_version "16" && lib.versionOlder metadata.release_version "18"
+          ) (metadata.getVersionFile "lld/add-table-base.patch");
+      };
+
+      lldb = callPackage ./lldb.nix (
+        {
+          patches =
+            let
+              resourceDirPatch = callPackage (
+                { substituteAll, libclang }:
+                (substituteAll {
+                  src = metadata.getVersionFile "lldb/resource-dir.patch";
+                  clangLibDir = "${libclang.lib}/lib";
+                }).overrideAttrs
+                  (_: _: { name = "resource-dir.patch"; })
+              ) { };
+            in
+            lib.optional (lib.versionOlder metadata.release_version "16")
+              # FIXME: do we need this after 15?
+              (metadata.getVersionFile "lldb/procfs.patch")
+            ++ lib.optional (lib.versionOlder metadata.release_version "17") resourceDirPatch
+            ++ lib.optional (lib.versionOlder metadata.release_version "14") (
+              metadata.getVersionFile "lldb/gnu-install-dirs.patch"
+            )
+            ++ lib.optional (lib.versionAtLeast metadata.release_version "14") ./lldb/gnu-install-dirs.patch
+            # This is a stopgap solution if/until the macOS SDK used for x86_64 is
+            # updated.
+            #
+            # The older 10.12 SDK used on x86_64 as of this writing has a `mach/machine.h`
+            # header that does not define `CPU_SUBTYPE_ARM64E` so we replace the one use
+            # of this preprocessor symbol in `lldb` with its expansion.
+            #
+            # See here for some context:
+            # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
+            ++ lib.optional (
+              stdenv.targetPlatform.isDarwin
+              && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "11.0"
+            ) (metadata.getVersionFile "lldb/cpu_subtype_arm64e_replacement.patch");
+        }
+        // lib.optionalAttrs (lib.versions.major metadata.release_version == "16") {
+          src = callPackage (
+            { runCommand }:
+            runCommand "lldb-src-${metadata.version}" { } ''
+              mkdir -p "$out"
+              cp -r ${monorepoSrc}/cmake "$out"
+              cp -r ${monorepoSrc}/lldb "$out"
+            ''
+          ) { };
+        }
+      );
+
+      # Below, is the LLVM bootstrapping logic. It handles building a
+      # fully LLVM toolchain from scratch. No GCC toolchain should be
+      # pulled in. As a consequence, it is very quick to build different
+      # targets provided by LLVM and we can also build for what GCC
+      # doesn’t support like LLVM. Probably we should move to some other
+      # file.
+
+      bintools-unwrapped = callPackage ./bintools.nix { };
+
+      bintoolsNoLibc = wrapBintoolsWith {
+        bintools = tools.bintools-unwrapped;
+        libc = preLibcCrossHeaders;
+      };
+
+      bintools = wrapBintoolsWith { bintools = tools.bintools-unwrapped; };
+
+      clangUseLLVM = wrapCCWith (
+        rec {
+          cc = tools.clang-unwrapped;
+          libcxx = targetLlvmLibraries.libcxx;
+          bintools = bintools';
+          extraPackages =
+            [ targetLlvmLibraries.compiler-rt ]
+            ++ lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [
+              targetLlvmLibraries.libunwind
+            ];
+          extraBuildCommands =
+            lib.optionalString (lib.versions.major metadata.release_version == "13") (
+              ''
+                echo "-rtlib=compiler-rt -Wno-unused-command-line-argument" >> $out/nix-support/cc-cflags
+                echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
+              ''
+              + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
+                echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+                echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
+              ''
+              + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
+                echo "-lunwind" >> $out/nix-support/cc-ldflags
+              ''
+              + lib.optionalString stdenv.targetPlatform.isWasm ''
+                echo "-fno-exceptions" >> $out/nix-support/cc-cflags
+              ''
+            )
+            + mkExtraBuildCommands cc;
+        }
+        // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "14") {
+          nixSupport.cc-cflags =
+            [
+              "-rtlib=compiler-rt"
+              "-Wno-unused-command-line-argument"
+              "-B${targetLlvmLibraries.compiler-rt}/lib"
+            ]
+            ++ lib.optional (
+              !stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD
+            ) "--unwindlib=libunwind"
+            ++ lib.optional (
+              !stdenv.targetPlatform.isWasm
+              && !stdenv.targetPlatform.isFreeBSD
+              && stdenv.targetPlatform.useLLVM or false
+            ) "-lunwind"
+            ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+          nixSupport.cc-ldflags = lib.optionals (
+            !stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD
+          ) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
+        }
+      );
+
+      clangNoLibcxx = wrapCCWith (
+        rec {
+          cc = tools.clang-unwrapped;
+          libcxx = null;
+          bintools = bintools';
+          extraPackages = [ targetLlvmLibraries.compiler-rt ];
+          extraBuildCommands =
+            lib.optionalString (lib.versions.major metadata.release_version == "13") ''
+              echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
+              echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
+              echo "-nostdlib++" >> $out/nix-support/cc-cflags
+            ''
+            + mkExtraBuildCommands cc;
+        }
+        // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "14") {
+          nixSupport.cc-cflags =
+            [
+              "-rtlib=compiler-rt"
+              "-B${targetLlvmLibraries.compiler-rt}/lib"
+              "-nostdlib++"
+            ]
+            ++ lib.optional (
+              lib.versionAtLeast metadata.release_version "15" && stdenv.targetPlatform.isWasm
+            ) "-fno-exceptions";
+        }
+      );
+
+      clangNoLibc = wrapCCWith (
+        rec {
+          cc = tools.clang-unwrapped;
+          libcxx = null;
+          bintools = bintoolsNoLibc';
+          extraPackages = [ targetLlvmLibraries.compiler-rt ];
+          extraBuildCommands =
+            lib.optionalString (lib.versions.major metadata.release_version == "13") ''
+              echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
+              echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
+            ''
+            + mkExtraBuildCommands cc;
+        }
+        // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "14") {
+          nixSupport.cc-cflags =
+            [
+              "-rtlib=compiler-rt"
+              "-B${targetLlvmLibraries.compiler-rt}/lib"
+            ]
+            ++ lib.optional (
+              lib.versionAtLeast metadata.release_version "15" && stdenv.targetPlatform.isWasm
+            ) "-fno-exceptions";
+        }
+      );
+
+      clangNoCompilerRt = wrapCCWith (
+        rec {
+          cc = tools.clang-unwrapped;
+          libcxx = null;
+          bintools = bintoolsNoLibc';
+          extraPackages = [ ];
+          extraBuildCommands =
+            lib.optionalString (lib.versions.major metadata.release_version == "13") ''
+              echo "-nostartfiles" >> $out/nix-support/cc-cflags
+            ''
+            + mkExtraBuildCommands0 cc;
+        }
+        // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "14") {
+          nixSupport.cc-cflags =
+            [ "-nostartfiles" ]
+            ++ lib.optional (
+              lib.versionAtLeast metadata.release_version "15" && stdenv.targetPlatform.isWasm
+            ) "-fno-exceptions";
+        }
+      );
+
+      clangNoCompilerRtWithLibc =
+        wrapCCWith rec {
+          cc = tools.clang-unwrapped;
+          libcxx = null;
+          bintools = bintools';
+          extraPackages = [ ];
+          extraBuildCommands = mkExtraBuildCommands0 cc;
+        }
+        // lib.optionalAttrs (
+          lib.versionAtLeast metadata.release_version "15" && stdenv.targetPlatform.isWasm
+        ) { nixSupport.cc-cflags = [ "-fno-exceptions" ]; };
+    }
+    // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "15") {
+      # TODO: pre-15: lldb/docs/index.rst:155:toctree contains reference to nonexisting document 'design/structureddataplugins'
+      lldb-manpages = lowPrio (
+        tools.lldb.override {
+          enableManpages = true;
+          python3 = pkgs.python3; # don't use python-boot
+        }
+      );
+    }
+    // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "16") {
+      mlir = callPackage ./mlir { };
+      libclc = callPackage ./libclc.nix { };
+    }
+  );
+
+  libraries = lib.makeExtensible (
+    libraries:
+    let
+      callPackage = newScope (
+        libraries
+        // buildLlvmTools
+        // args
+        // metadata
+        # Previously monorepoSrc was erroneously not being passed through.
+        // lib.optionalAttrs (lib.versionOlder metadata.release_version "14") { monorepoSrc = null; } # Preserve a bug during #307211, TODO: remove; causes llvm 13 rebuild.
+      );
+
+      compiler-rtPatches =
+        lib.optional (lib.versionOlder metadata.release_version "15") (
+          metadata.getVersionFile "compiler-rt/codesign.patch"
+        ) # Revert compiler-rt commit that makes codesign mandatory
+        ++ [
+          (metadata.getVersionFile "compiler-rt/X86-support-extension.patch") # Add support for i486 i586 i686 by reusing i386 config
+        ]
+        ++ lib.optional (
+          lib.versionAtLeast metadata.release_version "14" && lib.versionOlder metadata.release_version "18"
+        ) (metadata.getVersionFile "compiler-rt/gnu-install-dirs.patch")
+        ++ [
+          # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
+          # extra `/`.
+          (metadata.getVersionFile "compiler-rt/normalize-var.patch")
+        ]
+        ++
+          lib.optional (lib.versionOlder metadata.release_version "18")
+            # Prevent a compilation error on darwin
+            (metadata.getVersionFile "compiler-rt/darwin-targetconditionals.patch")
+        ++
+          lib.optional (lib.versionAtLeast metadata.release_version "15")
+            # See: https://github.com/NixOS/nixpkgs/pull/186575
+            ./compiler-rt/darwin-plistbuddy-workaround.patch
+        ++
+          lib.optional (lib.versions.major metadata.release_version == "15")
+            # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
+            ./compiler-rt/armv7l-15.patch
+        ++ lib.optionals (lib.versionOlder metadata.release_version "15") [
+          ./compiler-rt/darwin-plistbuddy-workaround.patch
+          (metadata.getVersionFile "compiler-rt/armv7l.patch")
+          # Fix build on armv6l
+          ./compiler-rt/armv6-mcr-dmb.patch
+          ./compiler-rt/armv6-sync-ops-no-thumb.patch
+          ./compiler-rt/armv6-no-ldrexd-strexd.patch
+          ./compiler-rt/armv6-scudo-no-yield.patch
+          ./compiler-rt/armv6-scudo-libatomic.patch
+        ];
+    in
+    {
+      compiler-rt-libc = callPackage ./compiler-rt {
+        patches = compiler-rtPatches;
+        stdenv =
+          if
+            stdenv.hostPlatform.useLLVM or false
+            || (
+              lib.versionAtLeast metadata.release_version "16"
+              && stdenv.hostPlatform.isDarwin
+              && stdenv.hostPlatform.isStatic
+            )
+          then
+            overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
+          else
+            args.stdenv;
+      };
+
+      compiler-rt-no-libc = callPackage ./compiler-rt {
+        patches = compiler-rtPatches;
+        stdenv =
+          if stdenv.hostPlatform.useLLVM or false then
+            overrideCC stdenv buildLlvmTools.clangNoCompilerRt
+          else
+            stdenv;
+      };
+
+      # N.B. condition is safe because without useLLVM both are the same.
+      compiler-rt =
+        if
+          stdenv.hostPlatform.isAndroid
+          || (lib.versionAtLeast metadata.release_version "16" && stdenv.hostPlatform.isDarwin)
+        then
+          libraries.compiler-rt-libc
+        else
+          libraries.compiler-rt-no-libc;
+
+      stdenv = overrideCC stdenv buildLlvmTools.clang;
+
+      libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
+
+      libcxx = callPackage ./libcxx (
+        {
+          patches =
+            lib.optionals (lib.versionOlder metadata.release_version "16") (
+              lib.optional (lib.versions.major metadata.release_version == "15")
+                # See:
+                #   - https://reviews.llvm.org/D133566
+                #   - https://github.com/NixOS/nixpkgs/issues/214524#issuecomment-1429146432
+                # !!! Drop in LLVM 16+
+                (
+                  fetchpatch {
+                    url = "https://github.com/llvm/llvm-project/commit/57c7bb3ec89565c68f858d316504668f9d214d59.patch";
+                    hash = "sha256-B07vHmSjy5BhhkGSj3e1E0XmMv5/9+mvC/k70Z29VwY=";
+                  }
+                )
+              ++ [
+                (substitute {
+                  src = ./libcxxabi/wasm.patch;
+                  substitutions = [
+                    "--replace-fail"
+                    "/cmake/"
+                    "/llvm/cmake/"
+                  ];
+                })
+              ]
+              ++ lib.optional stdenv.hostPlatform.isMusl (substitute {
+                src = ./libcxx/libcxx-0001-musl-hacks.patch;
+                substitutions = [
+                  "--replace-fail"
+                  "/include/"
+                  "/libcxx/include/"
+                ];
+              })
+            )
+            ++
+              lib.optional
+                (
+                  lib.versions.major metadata.release_version == "17"
+                  && stdenv.isDarwin
+                  && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13"
+                )
+                # https://github.com/llvm/llvm-project/issues/64226
+                (
+                  fetchpatch {
+                    name = "0042-mbstate_t-not-defined.patch";
+                    url = "https://github.com/macports/macports-ports/raw/acd8acb171f1658596ed1cf25da48d5b932e2d19/lang/llvm-17/files/0042-mbstate_t-not-defined.patch";
+                    hash = "sha256-jo+DYA6zuSv9OH3A0bYwY5TlkWprup4OKQ7rfK1WHBI=";
+                  }
+                )
+            ++
+              lib.optional
+                (
+                  lib.versionAtLeast metadata.release_version "18"
+                  && stdenv.isDarwin
+                  && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13"
+                )
+                # https://github.com/llvm/llvm-project/issues/64226
+                (metadata.getVersionFile "libcxx/0001-darwin-10.12-mbstate_t-fix.patch");
+          stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
+        }
+        // lib.optionalAttrs (lib.versionOlder metadata.release_version "14") {
+          # TODO: remove this, causes LLVM 13 packages rebuild.
+          inherit (metadata) monorepoSrc; # Preserve bug during #307211 refactor.
+        }
+      );
+
+      libunwind = callPackage ./libunwind {
+        patches = lib.optional (lib.versionOlder metadata.release_version "17") (
+          metadata.getVersionFile "libunwind/gnu-install-dirs.patch"
+        );
+        stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
+      };
+
+      openmp = callPackage ./openmp {
+        patches =
+          lib.optional (lib.versionAtLeast metadata.release_version "15") (
+            metadata.getVersionFile "openmp/fix-find-tool.patch"
+          )
+          ++ lib.optional (
+            lib.versionAtLeast metadata.release_version "14" && lib.versionOlder metadata.release_version "18"
+          ) (metadata.getVersionFile "openmp/gnu-install-dirs.patch")
+          ++ lib.optional (lib.versionAtLeast metadata.release_version "14") (
+            metadata.getVersionFile "openmp/run-lit-directly.patch"
+          )
+          ++
+            lib.optional (lib.versionOlder metadata.release_version "14")
+              # Fix cross.
+              (
+                fetchpatch {
+                  url = "https://github.com/llvm/llvm-project/commit/5e2358c781b85a18d1463fd924d2741d4ae5e42e.patch";
+                  hash = "sha256-UxIlAifXnexF/MaraPW0Ut6q+sf3e7y1fMdEv1q103A=";
+                }
+              );
+      };
+    }
+  );
+
+  noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
+in
+{
+  inherit tools libraries lldbPlugins;
+  inherit (metadata) release_version;
+}
+// (noExtend libraries)
+// (noExtend tools)
diff --git a/pkgs/development/compilers/llvm/common/lldb.nix b/pkgs/development/compilers/llvm/common/lldb.nix
index 71afcb159a44..064ed4ec5a81 100644
--- a/pkgs/development/compilers/llvm/common/lldb.nix
+++ b/pkgs/development/compilers/llvm/common/lldb.nix
@@ -101,7 +101,7 @@ stdenv.mkDerivation (rec {
   ++ lib.optional
     (
       stdenv.targetPlatform.isDarwin
-        && !stdenv.targetPlatform.isAarch64
+        && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "11.0"
         && (lib.versionAtLeast release_version "15")
     )
     (
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
new file mode 100644
index 000000000000..fa6008e807b0
--- /dev/null
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  callPackage,
+  stdenvAdapters,
+  buildPackages,
+  targetPackages,
+  stdenv,
+  gcc12Stdenv,
+  pkgs,
+  # This is the default binutils, but with *this* version of LLD rather
+  # than the default LLVM version's, if LLD is the choice. We use these for
+  # the `useLLVM` bootstrapping below.
+  bootBintoolsNoLibc ? if stdenv.targetPlatform.linker == "lld" then null else pkgs.bintoolsNoLibc,
+  bootBintools ? if stdenv.targetPlatform.linker == "lld" then null else pkgs.bintools,
+  llvmVersions ? { },
+}:
+let
+  versions = {
+    "13.0.1".officialRelease.sha256 = "06dv6h5dmvzdxbif2s8njki6h32796v368dyb5945x8gjj72xh7k";
+    "14.0.6".officialRelease.sha256 = "sha256-vffu4HilvYwtzwgq+NlS26m65DGbp6OSSne2aje1yJE=";
+    "15.0.7".officialRelease.sha256 = "sha256-wjuZQyXQ/jsmvy6y1aksCcEDXGBjuhpgngF3XQJ/T4s=";
+    "16.0.6".officialRelease.sha256 = "sha256-fspqSReX+VD+Nl/Cfq+tDcdPtnQPV1IRopNDfd5VtUs=";
+    "17.0.6".officialRelease.sha256 = "sha256-8MEDLLhocshmxoEBRSKlJ/GzJ8nfuzQ8qn0X/vLA+ag=";
+    "18.1.8".officialRelease.sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE=";
+    "19.0.0-git".gitRelease = {
+      rev = "3f83a69bcb2c6b5fa3efbc41d1822e6fa69a6620";
+      rev-version = "19.0.0-unstable-2024-07-08";
+      sha256 = "sha256-nAKAm2sQrwOT+IKnKTv53O8QBm0iNF/j257OVRwjVXU=";
+    };
+  } // llvmVersions;
+
+  mkPackage =
+    {
+      name ? null,
+      officialRelease ? null,
+      gitRelease ? null,
+      monorepoSrc ? null,
+      version ? null,
+    }@args:
+    let
+      args' = {
+        name = null;
+        officialRelease = null;
+        gitRelease = null;
+        monorepoSrc = null;
+        version = null;
+      } // args;
+      inherit
+        (import ./common/common-let.nix {
+          inherit lib;
+          inherit (args') gitRelease officialRelease version;
+        })
+        releaseInfo
+        ;
+      inherit (releaseInfo) release_version;
+      attrName =
+        args.name or (if (gitRelease != null) then "git" else lib.versions.major release_version);
+    in
+    callPackage ./common {
+      inherit (stdenvAdapters) overrideCC;
+      buildLlvmTools = buildPackages."llvmPackages_${attrName}".tools;
+      targetLlvmLibraries =
+        targetPackages."llvmPackages_${attrName}".libraries or llvmPackages."${attrName}".libraries;
+      targetLlvm = targetPackages."llvmPackages_${attrName}".llvm or llvmPackages."${attrName}".llvm;
+      stdenv =
+        if (lib.versions.major release_version == "13" && stdenv.cc.cc.isGNU or false) then
+          gcc12Stdenv
+        else
+          stdenv; # does not build with gcc13
+      inherit bootBintoolsNoLibc bootBintools;
+      inherit (args')
+        officialRelease
+        gitRelease
+        monorepoSrc
+        version
+        ;
+    };
+
+  llvmPackages = lib.mapAttrs' (
+    version: args:
+    lib.nameValuePair (if (args ? gitRelease) then "git" else lib.versions.major version) (
+      mkPackage (args // { inherit version; })
+    )
+  ) versions;
+in
+llvmPackages
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
deleted file mode 100644
index a023e0b7a5e8..000000000000
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ /dev/null
@@ -1,419 +0,0 @@
-{ lowPrio, newScope, pkgs, lib, stdenv
-, preLibcCrossHeaders
-, substitute, substituteAll, fetchFromGitHub, fetchpatch
-, overrideCC, wrapCCWith, wrapBintoolsWith
-, buildLlvmTools # tools, but from the previous stage, for cross
-, targetLlvmLibraries # libraries, but from the next stage, for cross
-, targetLlvm
-# This is the default binutils, but with *this* version of LLD rather
-# than the default LLVM verion's, if LLD is the choice. We use these for
-# the `useLLVM` bootstrapping below.
-, bootBintoolsNoLibc ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintoolsNoLibc
-, bootBintools ?
-    if stdenv.targetPlatform.linker == "lld"
-    then null
-    else pkgs.bintools
-, darwin
-# LLVM release information; specify one of these but not both:
-, gitRelease ? {
-    version = "19.0.0-git";
-    rev = "9b9405621bcc55b74d2177c960c21f62cc95e6fd";
-    rev-version = "19.0.0-unstable-2024-06-30";
-    sha256 = "sha256-Tlk+caav7e7H6bha8YQyOl+x2iNk9iH7xKpHQkWQyJ4=";
-}
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   rev = /* commit SHA */;
-  #   rev-version = /* human readable version; i.e. "15.0.0-unstable-2022-07-26" */;
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-, officialRelease ? null
-  # i.e.:
-  # {
-  #   version = /* i.e. "15.0.0" */;
-  #   candidate = /* optional; if specified, should be: "rcN" */
-  #   sha256 = /* checksum for this release, can omit if specifying your own `monorepoSrc` */;
-  # }
-# By default, we'll try to fetch a release from `github:llvm/llvm-project`
-# corresponding to the `gitRelease` or `officialRelease` specified.
-#
-# You can provide your own LLVM source by specifying this arg but then it's up
-# to you to make sure that the LLVM repo given matches the release configuration
-# specified.
-, monorepoSrc ? null
-# Allows passthrough to packages via newScope. This makes it possible to
-# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
-# an llvmPackages whose packages are overridden in an internally consistent way.
-, ...
-}@args:
-
-assert
-  lib.assertMsg
-    (lib.xor
-      (gitRelease != null)
-      (officialRelease != null))
-    ("must specify `gitRelease` or `officialRelease`" +
-      (lib.optionalString (gitRelease != null) " — not both"));
-let
-  monorepoSrc' = monorepoSrc;
-in let
-
-  metadata = rec {
-    # Import releaseInfo separately to avoid infinite recursion
-    inherit (import ../common/common-let.nix { inherit lib gitRelease officialRelease; }) releaseInfo;
-    inherit (releaseInfo) release_version version;
-    inherit (import ../common/common-let.nix { inherit lib fetchFromGitHub gitRelease release_version officialRelease monorepoSrc'; }) llvm_meta monorepoSrc;
-  };
-
-  tools = lib.makeExtensible (tools: let
-    callPackage = newScope (tools // args // metadata);
-    major = lib.versions.major metadata.release_version;
-    mkExtraBuildCommands0 = cc: ''
-      rsrc="$out/resource-root"
-      mkdir "$rsrc"
-      ln -s "${cc.lib}/lib/clang/${major}/include" "$rsrc"
-      echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
-    '';
-    mkExtraBuildCommands = cc: mkExtraBuildCommands0 cc + ''
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/lib" "$rsrc/lib"
-      ln -s "${targetLlvmLibraries.compiler-rt.out}/share" "$rsrc/share"
-    '';
-
-  bintoolsNoLibc' =
-    if bootBintoolsNoLibc == null
-    then tools.bintoolsNoLibc
-    else bootBintoolsNoLibc;
-  bintools' =
-    if bootBintools == null
-    then tools.bintools
-    else bootBintools;
-
-  in {
-
-    libllvm = callPackage ../common/llvm {
-      patches = [
-        ./llvm/gnu-install-dirs.patch
-
-        # Running the tests involves invoking binaries (like `opt`) that depend on
-        # the LLVM dylibs and reference them by absolute install path (i.e. their
-        # nix store path).
-        #
-        # Because we have not yet run the install phase (we're running these tests
-        # as part of `checkPhase` instead of `installCheckPhase`) these absolute
-        # paths do not exist yet; to work around this we point the loader (`ld` on
-        # unix, `dyld` on macOS) at the `lib` directory which will later become this
-        # package's `lib` output.
-        #
-        # Previously we would just set `LD_LIBRARY_PATH` to include the build `lib`
-        # dir but:
-        #   - this doesn't generalize well to other platforms; `lit` doesn't forward
-        #     `DYLD_LIBRARY_PATH` (macOS):
-        #     + https://github.com/llvm/llvm-project/blob/0d89963df354ee309c15f67dc47c8ab3cb5d0fb2/llvm/utils/lit/lit/TestingConfig.py#L26
-        #   - even if `lit` forwarded this env var, we actually cannot set
-        #     `DYLD_LIBRARY_PATH` in the child processes `lit` launches because
-        #     `DYLD_LIBRARY_PATH` (and `DYLD_FALLBACK_LIBRARY_PATH`) is cleared for
-        #     "protected processes" (i.e. the python interpreter that runs `lit`):
-        #     https://stackoverflow.com/a/35570229
-        #   - other LLVM subprojects deal with this issue by having their `lit`
-        #     configuration set these env vars for us; it makes sense to do the same
-        #     for LLVM:
-        #     + https://github.com/llvm/llvm-project/blob/4c106cfdf7cf7eec861ad3983a3dd9a9e8f3a8ae/clang-tools-extra/test/Unit/lit.cfg.py#L22-L31
-        #
-        # !!! TODO: look into upstreaming this patch
-        ./llvm/llvm-lit-cfg-add-libs-to-dylib-path.patch
-
-        # `lit` has a mode where it executes run lines as a shell script which is
-        # constructs; this is problematic for macOS because it means that there's
-        # another process in between `lit` and the binaries being tested. As noted
-        # above, this means that `DYLD_LIBRARY_PATH` is cleared which means that our
-        # tests fail with dyld errors.
-        #
-        # To get around this we patch `lit` to reintroduce `DYLD_LIBRARY_PATH`, when
-        # present in the test configuration.
-        #
-        # It's not clear to me why this isn't an issue for LLVM developers running
-        # on macOS (nothing about this _seems_ nix specific)..
-        ./llvm/lit-shell-script-runner-set-dyld-library-path.patch
-      ];
-      pollyPatches = [
-        ./llvm/gnu-install-dirs-polly.patch
-
-        # Just like the `llvm-lit-cfg` patch, but for `polly`.
-        ./llvm/polly-lit-cfg-add-libs-to-dylib-path.patch
-      ];
-    };
-
-    # `llvm` historically had the binaries.  When choosing an output explicitly,
-    # we need to reintroduce `outputSpecified` to get the expected behavior e.g. of lib.get*
-    llvm = tools.libllvm;
-
-    libclang = callPackage ../common/clang {
-      patches = [
-        ./clang/purity.patch
-        # https://reviews.llvm.org/D51899
-        ./clang/gnu-install-dirs.patch
-        ../common/clang/add-nostdlibinc-flag.patch
-        (substituteAll {
-          src = ../common/clang/clang-at-least-16-LLVMgold-path.patch;
-          libllvmLibdir = "${tools.libllvm.lib}/lib";
-        })
-      ];
-    };
-
-    clang-unwrapped = tools.libclang;
-
-    llvm-manpages = lowPrio (tools.libllvm.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    clang-manpages = lowPrio (tools.libclang.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    lldb-manpages = lowPrio (tools.lldb.override {
-      enableManpages = true;
-      python3 = pkgs.python3;  # don't use python-boot
-    });
-
-    # Wrapper for standalone command line utilities
-    clang-tools = callPackage ../common/clang-tools { };
-
-    # pick clang appropriate for package set we are targeting
-    clang =
-      /**/ if stdenv.targetPlatform.useLLVM or false then tools.clangUseLLVM
-      else if (pkgs.targetPackages.stdenv or stdenv).cc.isGNU then tools.libstdcxxClang
-      else tools.libcxxClang;
-
-    libstdcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      # libstdcxx is taken from gcc in an ad-hoc way in cc-wrapper.
-      libcxx = null;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    libcxxClang = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-    };
-
-    lld = callPackage ../common/lld {
-      patches = [
-        ./lld/gnu-install-dirs.patch
-      ];
-    };
-
-    mlir = callPackage ../common/mlir {};
-
-    lldb = callPackage ../common/lldb.nix {
-      src = callPackage ({ runCommand }: runCommand "lldb-src-${metadata.version}" {} ''
-        mkdir -p "$out"
-        cp -r ${monorepoSrc}/cmake "$out"
-        cp -r ${monorepoSrc}/lldb "$out"
-      '') { };
-      patches =
-        [
-          # FIXME: do we need this? ./procfs.patch
-          ../common/lldb/gnu-install-dirs.patch
-        ]
-        # This is a stopgap solution if/until the macOS SDK used for x86_64 is
-        # updated.
-        #
-        # The older 10.12 SDK used on x86_64 as of this writing has a `mach/machine.h`
-        # header that does not define `CPU_SUBTYPE_ARM64E` so we replace the one use
-        # of this preprocessor symbol in `lldb` with its expansion.
-        #
-        # See here for some context:
-        # https://github.com/NixOS/nixpkgs/pull/194634#issuecomment-1272129132
-        ++ lib.optional (
-          stdenv.targetPlatform.isDarwin
-            && !stdenv.targetPlatform.isAarch64
-            && (lib.versionOlder darwin.apple_sdk.sdk.version "11.0")
-        ) ./lldb/cpu_subtype_arm64e_replacement.patch;
-    };
-
-    # Below, is the LLVM bootstrapping logic. It handles building a
-    # fully LLVM toolchain from scratch. No GCC toolchain should be
-    # pulled in. As a consequence, it is very quick to build different
-    # targets provided by LLVM and we can also build for what GCC
-    # doesn’t support like LLVM. Probably we should move to some other
-    # file.
-
-    bintools-unwrapped = callPackage ../common/bintools.nix { };
-
-    bintoolsNoLibc = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-      libc = preLibcCrossHeaders;
-    };
-
-    bintools = wrapBintoolsWith {
-      bintools = tools.bintools-unwrapped;
-    };
-
-    clangUseLLVM = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = targetLlvmLibraries.libcxx;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ] ++ lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [
-        targetLlvmLibraries.libunwind
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [ "-rtlib=compiler-rt"
-          "-Wno-unused-command-line-argument"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) "--unwindlib=libunwind"
-        ++ lib.optional
-          (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD && stdenv.targetPlatform.useLLVM or false)
-          "-lunwind"
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm && !stdenv.targetPlatform.isFreeBSD) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
-    };
-
-    clangNoLibcxx = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [
-          "-rtlib=compiler-rt"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-          "-nostdlib++"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoLibc = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [
-        targetLlvmLibraries.compiler-rt
-      ];
-      extraBuildCommands = mkExtraBuildCommands cc;
-      nixSupport.cc-cflags =
-        [
-          "-rtlib=compiler-rt"
-          "-B${targetLlvmLibraries.compiler-rt}/lib"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoCompilerRt = wrapCCWith rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintoolsNoLibc';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-      nixSupport.cc-cflags =
-        [
-          "-nostartfiles"
-        ]
-        ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
-    };
-
-    clangNoCompilerRtWithLibc = wrapCCWith (rec {
-      cc = tools.clang-unwrapped;
-      libcxx = null;
-      bintools = bintools';
-      extraPackages = [ ];
-      extraBuildCommands = mkExtraBuildCommands0 cc;
-    } // lib.optionalAttrs stdenv.targetPlatform.isWasm {
-      nixSupport.cc-cflags = [ "-fno-exceptions" ];
-    });
-
-    # Has to be in tools despite mostly being a library,
-    # because we use a native helper executable from a
-    # non-cross build in cross builds.
-    libclc = callPackage ../common/libclc.nix {};
-  });
-
-  libraries = lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // args // metadata);
-  in {
-
-    compiler-rt-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/186575
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
-        # ../common/compiler-rt/armv7l-15.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic)
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
-               else stdenv;
-    };
-
-    compiler-rt-no-libc = callPackage ../common/compiler-rt {
-      patches = [
-        ./compiler-rt/X86-support-extension.patch # Add support for i486 i586 i686 by reusing i386 config
-        # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-        # extra `/`.
-        ./compiler-rt/normalize-var.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/186575
-        ../common/compiler-rt/darwin-plistbuddy-workaround.patch
-        # See: https://github.com/NixOS/nixpkgs/pull/194634#discussion_r999829893
-        # ../common/compiler-rt/armv7l-15.patch
-      ];
-      stdenv = if stdenv.hostPlatform.useLLVM or false
-               then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
-               else stdenv;
-    };
-
-    # N.B. condition is safe because without useLLVM both are the same.
-    compiler-rt = if stdenv.hostPlatform.isAndroid || stdenv.hostPlatform.isDarwin
-      then libraries.compiler-rt-libc
-      else libraries.compiler-rt-no-libc;
-
-    stdenv = overrideCC stdenv buildLlvmTools.clang;
-
-    libcxxStdenv = overrideCC stdenv buildLlvmTools.libcxxClang;
-
-    # `libcxx` requires a fairly modern C++ compiler,
-    # so: we use the clang from this LLVM package set instead of the regular
-    # stdenv's compiler.
-    libcxx = callPackage ../common/libcxx {
-      patches = lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13") [
-        # https://github.com/llvm/llvm-project/issues/64226
-        ./libcxx/0001-darwin-10.12-mbstate_t-fix.patch
-      ];
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    libunwind = callPackage ../common/libunwind {
-      stdenv = overrideCC stdenv buildLlvmTools.clangNoLibcxx;
-    };
-
-    openmp = callPackage ../common/openmp {
-      patches = [
-        ./openmp/fix-find-tool.patch
-        ./openmp/run-lit-directly.patch
-      ];
-    };
-  });
-  noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
-
-in { inherit tools libraries; inherit (metadata) release_version; } // (noExtend libraries) // (noExtend tools)
diff --git a/pkgs/development/embedded/openocd/default.nix b/pkgs/development/embedded/openocd/default.nix
index 5efd11c65f98..366d1ed832c2 100644
--- a/pkgs/development/embedded/openocd/default.nix
+++ b/pkgs/development/embedded/openocd/default.nix
@@ -3,6 +3,7 @@
 , fetchurl
 , pkg-config
 , hidapi
+, tcl
 , jimtcl
 , libjaylink
 , libusb1
@@ -12,8 +13,12 @@
 
 # Allow selection the hardware targets (SBCs, JTAG Programmers, JTAG Adapters)
 , extraHardwareSupport ? []
-}:
+}: let
 
+  isWindows = stdenv.hostPlatform.isWindows;
+  notWindows = !isWindows;
+
+in
 stdenv.mkDerivation rec {
   pname = "openocd";
   version = "0.12.0";
@@ -22,23 +27,24 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ryVHiL6Yhh8r2RA/5uYKd07Jaow3R0Tu+Rl/YEMHWvo=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config tcl ];
 
-  buildInputs = [ hidapi jimtcl libftdi1 libjaylink libusb1 ]
+  buildInputs = [ libusb1 ]
+    ++ lib.optionals notWindows [ hidapi jimtcl libftdi1 libjaylink ]
     ++
     # tracking issue for v2 api changes https://sourceforge.net/p/openocd/tickets/306/
     lib.optional stdenv.isLinux libgpiod_1;
 
   configureFlags = [
     "--disable-werror"
-    "--disable-internal-jimtcl"
-    "--disable-internal-libjaylink"
     "--enable-jtag_vpi"
-    "--enable-buspirate"
     "--enable-remote-bitbang"
-    (lib.enableFeature enableFtdi "ftdi")
+    (lib.enableFeature notWindows "buspirate")
+    (lib.enableFeature (notWindows && enableFtdi) "ftdi")
     (lib.enableFeature stdenv.isLinux "linuxgpiod")
     (lib.enableFeature stdenv.isLinux "sysfsgpio")
+    (lib.enableFeature isWindows "internal-jimtcl")
+    (lib.enableFeature isWindows "internal-libjaylink")
   ] ++
     map (hardware: "--enable-${hardware}") extraHardwareSupport
   ;
@@ -75,6 +81,6 @@ stdenv.mkDerivation rec {
     homepage = "https://openocd.sourceforge.net/";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ bjornfor prusnak ];
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
   };
 }
diff --git a/pkgs/development/libraries/hidapi/default.nix b/pkgs/development/libraries/hidapi/default.nix
index dfba7f4e1171..5f698794abf3 100644
--- a/pkgs/development/libraries/hidapi/default.nix
+++ b/pkgs/development/libraries/hidapi/default.nix
@@ -43,6 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
       "hidapi-hidraw"
       "hidapi-libusb"
     ];
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
   };
 })
diff --git a/pkgs/development/libraries/hyphen/default.nix b/pkgs/development/libraries/hyphen/default.nix
index 2759ad9af737..85bee97a76d5 100644
--- a/pkgs/development/libraries/hyphen/default.nix
+++ b/pkgs/development/libraries/hyphen/default.nix
@@ -17,6 +17,18 @@ in stdenv.mkDerivation rec {
     sha256 = "01ap9pr6zzzbp4ky0vy7i1983fwyqy27pl0ld55s30fdxka3ciih";
   };
 
+  # Do not install the en_US dictionary.
+  installPhase = ''
+    runHook preInstall
+    make install-libLTLIBRARIES
+    make install-binSCRIPTS
+    make install-includeHEADERS
+
+    # license
+    install -D -m644 COPYING "$out/share/licenses/${pname}/LICENSE"
+    runHook postInstall
+  '';
+
   meta = with lib; {
     description = "Text hyphenation library";
     mainProgram = "substrings.pl";
diff --git a/pkgs/development/libraries/hyphen/dictionaries.nix b/pkgs/development/libraries/hyphen/dictionaries.nix
new file mode 100644
index 000000000000..39569441bdec
--- /dev/null
+++ b/pkgs/development/libraries/hyphen/dictionaries.nix
@@ -0,0 +1,91 @@
+/* hyphen dictionaries */
+
+{ hyphen, stdenv, lib, fetchgit, fetchurl }:
+
+
+let
+  libreofficeRepository = "https://anongit.freedesktop.org/git/libreoffice/dictionaries.git";
+  libreofficeCommit = "9e27d044d98e65f89af8c86df722a77be827bdc8";
+  libreofficeSubdir = "de";
+
+  mkDictFromLibreofficeGit =
+    { subdir, shortName, shortDescription, dictFileName, readmeFileName }:
+    stdenv.mkDerivation rec {
+      version = "24.8";
+      pname = "hyphen-dict-${shortName}-libreoffice";
+      src = fetchgit {
+        url = "https://anongit.freedesktop.org/git/libreoffice/dictionaries.git";
+        rev = "a2bf59878dd76685803ec260e15d875746ad6e25";
+        sha256 = "sha256-3CvjgNjsrm4obATK6LmtYob8i2ngTbwP6FB4HlJMPCE=";
+      };
+      meta = with lib; {
+        description = "Hyphen dictionary for ${shortDescription} from LibreOffice";
+        homepage = "https://wiki.documentfoundation.org/Development/Dictionaries";
+        license = with licenses; [ mpl20 ];
+        maintainers = with maintainers; [ theCapypara ];
+        platforms = platforms.all;
+      };
+      phases = [ "unpackPhase" "installPhase" ];
+      installPhase = ''
+        runHook preInstall
+        cd $src/${subdir}
+        install -dm755 "$out/share/hyphen"
+        install -m644 "hyph_${dictFileName}.dic" "$out/share/hyphen"
+        # docs
+        install -dm755 "$out/share/doc/"
+        install -m644 "README_hyph_${readmeFileName}.txt" "$out/share/doc/${pname}.txt"
+        runHook postInstall
+      '';
+    };
+
+in
+rec {
+
+  /* ENGLISH */
+
+  en_US = en-us;
+  en-us = stdenv.mkDerivation rec {
+    nativeBuildInputs = hyphen.nativeBuildInputs;
+    version = hyphen.version;
+    pname = "hyphen-dict-en-us";
+    src =  hyphen.src;
+    meta = {
+      inherit (hyphen.meta) homepage platforms license maintainers;
+      description = "Hyphen dictionary for English (United States)";
+    };
+    installPhase = ''
+      runHook preInstall
+      make install-hyphDATA
+      runHook postInstall
+    '';
+  };
+
+  /* GERMAN */
+
+  de_DE = de-de;
+  de-de = mkDictFromLibreofficeGit {
+    subdir = "de";
+    shortName = "de-de";
+    shortDescription = "German (Germany)";
+    dictFileName = "de_DE";
+    readmeFileName = "de";
+  };
+
+  de_AT = de-at;
+  de-at = mkDictFromLibreofficeGit {
+    subdir = "de";
+    shortName = "de-at";
+    shortDescription = "German (Austria)";
+    dictFileName = "de_AT";
+    readmeFileName = "de";
+  };
+
+  de_CH = de-ch;
+  de-ch = mkDictFromLibreofficeGit {
+    subdir = "de";
+    shortName = "de-ch";
+    shortDescription = "German (Switzerland)";
+    dictFileName = "de_CH";
+    readmeFileName = "de";
+  };
+}
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 67d1f22dcae9..63cc42bd706f 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -115,13 +115,13 @@ stdenv.mkDerivation rec {
   # NOTE: You must also bump:
   # <nixpkgs/pkgs/development/python-modules/libvirt/default.nix>
   # SysVirt in <nixpkgs/pkgs/top-level/perl-packages.nix>
-  version = "10.4.0";
+  version = "10.5.0";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-grQyILVy0IYbbz/Wau8QRfCub7j+5nhnkfs2tprfpO0=";
+    hash = "sha256-Nku4l1f34NOUr23KWDH9uZu72OgMK3KfYjsRRbuTvf8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/qt-6/modules/qtwayland.nix b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
index b5f1c71fdd75..82b683d53463 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@@ -4,6 +4,7 @@
 , wayland
 , pkg-config
 , libdrm
+, fetchpatch
 }:
 
 qtModule {
@@ -11,4 +12,13 @@ qtModule {
   propagatedBuildInputs = [ qtbase qtdeclarative ];
   buildInputs = [ wayland libdrm ];
   nativeBuildInputs = [ pkg-config ];
+
+  patches = [
+    # Included in qtwayland 6.7.3
+    # Fixes https://bugs.kde.org/show_bug.cgi?id=489259
+    (fetchpatch {
+      url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/92bcb8f6b7a852c7a5d662fc34de561692a7a454.diff";
+      sha256 = "sha256-XgGO8VnmQHLhUxTGf9CniwkCr5FsFiuUbnVP0NLNekI=";
+    })
+  ];
 }
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 98c28ca67997..2b80e05f0d4d 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -151,7 +151,11 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ lib.optionals stdenv.isDarwin [
     libedit
     readline
-  ] ++ lib.optional (stdenv.isDarwin && !stdenv.isAarch64) (
+  ] ++ lib.optional (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11.0") (
+    # this can likely be removed as:
+    # "libproc.h is included in the 10.12 SDK Libsystem and should be identical to this one."
+    # but the package is marked broken on darwin so unable to test
+
     # Pull a header that contains a definition of proc_pid_rusage().
     # (We pick just that one because using the other headers from `sdk` is not
     # compatible with our C++ standard library. This header is already in
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 6abc3b9c0fff..5a2498585da7 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -171,6 +171,30 @@ buildLuarocksPackage {
   };
 }) {};
 
+busted-htest = callPackage({ buildLuarocksPackage, fetchFromGitHub, fetchurl }:
+buildLuarocksPackage {
+  pname = "busted-htest";
+  version = "1.0.0-2";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/busted-htest-1.0.0-2.rockspec";
+    sha256 = "10d2pbh2rfy4ygp40h8br4w5j1z5syq5pn6knd4bbnacmswnmcdl";
+  }).outPath;
+  src = fetchFromGitHub {
+    owner = "hishamhm";
+    repo = "busted-htest";
+    rev = "1.0.0";
+    hash = "sha256-tGAQUSeDt+OV/TBAJo/JFdyeBRRZaIQEJG+SKcCaQhs=";
+  };
+
+
+  meta = {
+    homepage = "https://github.com/hishamhm/busted-htest";
+    description = "A pretty output handler for Busted";
+    maintainers = with lib.maintainers; [ mrcjkb ];
+    license.fullName = "MIT";
+  };
+}) {};
+
 cassowary = callPackage({ buildLuarocksPackage, fetchFromGitHub, fetchurl, luaOlder, penlight }:
 buildLuarocksPackage {
   pname = "cassowary";
diff --git a/pkgs/development/ocaml-modules/biotk/default.nix b/pkgs/development/ocaml-modules/biotk/default.nix
index 33a98f71cb67..b120e8008819 100644
--- a/pkgs/development/ocaml-modules/biotk/default.nix
+++ b/pkgs/development/ocaml-modules/biotk/default.nix
@@ -6,11 +6,11 @@
 , ocaml-crunch
 , camlzip
 , core_kernel
-, core_unix
-, csvfields
+, core_unix ? null
+, csvfields ? null
 , fmt
 , gsl
-, ppx_csv_conv
+, ppx_csv_conv ? null
 , ppx_deriving
 , rresult
 , tyxml
@@ -20,13 +20,13 @@
 
 buildDunePackage rec {
   pname = "biotk";
-  version = "0.2.0";
+  version = "0.3";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/pveber/biotk/releases/download/v${version}/biotk-${version}.tbz";
-    hash = "sha256-FQvbVj5MmraSN6AmOckKgJ/LB14E/pCsPvPvNppcv7A=";
+    hash = "sha256-9eRd3qYteUxu/xNEUER/DHodr6cTCuPtSKr38x32gig=";
   };
 
   nativeBuildInputs = [ ocaml-crunch ];
diff --git a/pkgs/development/ocaml-modules/phylogenetics/default.nix b/pkgs/development/ocaml-modules/phylogenetics/default.nix
index 76856024c09a..dd99947db1f5 100644
--- a/pkgs/development/ocaml-modules/phylogenetics/default.nix
+++ b/pkgs/development/ocaml-modules/phylogenetics/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildDunePackage
 , fetchurl
-, ppx_deriving
 , bppsuite
 , alcotest
 , angstrom-unix
@@ -12,16 +11,15 @@
 , menhir
 , menhirLib
 , printbox-text
-, yojson
 }:
 
 buildDunePackage rec {
   pname = "phylogenetics";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchurl {
     url = "https://github.com/biocaml/phylogenetics/releases/download/v${version}/phylogenetics-${version}.tbz";
-    hash = "sha256-JFpYp3pyW7PrBjqCwwDZxkJPA84dp6Qs8rOPvHPY92o=";
+    hash = "sha256-3oZ9fMAXqOQ02rQ+8W8PZJWXOJLNe2qERrGOeTk3BKg=";
   };
 
   minimalOCamlVersion = "4.08";
@@ -36,9 +34,7 @@ buildDunePackage rec {
     gsl
     lacaml
     menhirLib
-    ppx_deriving
     printbox-text
-    yojson
   ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/aadict/default.nix b/pkgs/development/python-modules/aadict/default.nix
deleted file mode 100644
index 0988fab6d238..000000000000
--- a/pkgs/development/python-modules/aadict/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  six,
-  pynose,
-  setuptools,
-}:
-
-buildPythonPackage rec {
-  pname = "aadict";
-  version = "0.2.3";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-p3MorFXbtXNdqZRBhwJRvv4TX2h6twenoXhWE2OydwQ=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [ six ];
-
-  nativeCheckInputs = [ pynose ];
-
-  pythonImportsCheck = [ "aadict" ];
-
-  meta = with lib; {
-    description = "Auto-attribute dict (and a couple of other useful dict functions)";
-    homepage = "https://github.com/metagriffin/aadict";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ glittershark ];
-  };
-}
diff --git a/pkgs/development/python-modules/actdiag/default.nix b/pkgs/development/python-modules/actdiag/default.nix
index e4069863bb21..cf84a064b54f 100644
--- a/pkgs/development/python-modules/actdiag/default.nix
+++ b/pkgs/development/python-modules/actdiag/default.nix
@@ -3,7 +3,7 @@
   blockdiag,
   buildPythonPackage,
   fetchFromGitHub,
-  pynose,
+  nose,
   pytestCheckHook,
   pythonOlder,
   setuptools,
@@ -27,8 +27,11 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ blockdiag ];
 
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
-    pynose
+    nose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/agate/default.nix b/pkgs/development/python-modules/agate/default.nix
index 7af42df65a52..5c019036e771 100644
--- a/pkgs/development/python-modules/agate/default.nix
+++ b/pkgs/development/python-modules/agate/default.nix
@@ -10,7 +10,7 @@
   lxml,
   parsedatetime,
   pyicu,
-  pynose,
+  pytestCheckHook,
   python-slugify,
   pythonOlder,
   pytimeparse,
@@ -47,15 +47,11 @@ buildPythonPackage rec {
     cssselect
     glibcLocales
     lxml
-    pynose
     pyicu
+    pytestCheckHook
     pytz
   ];
 
-  checkPhase = ''
-    LC_ALL="en_US.UTF-8" nosetests tests
-  '';
-
   pythonImportsCheck = [ "agate" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/aiounittest/default.nix b/pkgs/development/python-modules/aiounittest/default.nix
index beae5db296ab..e715d99833f8 100644
--- a/pkgs/development/python-modules/aiounittest/default.nix
+++ b/pkgs/development/python-modules/aiounittest/default.nix
@@ -2,10 +2,8 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonAtLeast,
   setuptools,
-  pynose,
-  coverage,
+  pytestCheckHook,
   wrapt,
 }:
 
@@ -25,14 +23,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ wrapt ];
 
-  nativeCheckInputs = [
-    pynose
-    coverage
-  ];
-
-  checkPhase = ''
-    nosetests -e test_specific_test
-  '';
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "aiounittest" ];
 
diff --git a/pkgs/development/python-modules/amqp/default.nix b/pkgs/development/python-modules/amqp/default.nix
index 8adda06c48c9..c983669f85dd 100644
--- a/pkgs/development/python-modules/amqp/default.nix
+++ b/pkgs/development/python-modules/amqp/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  case,
   fetchPypi,
   pytestCheckHook,
   pytest-rerunfailures,
@@ -26,7 +25,6 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
-    case
     pytestCheckHook
     pytest-rerunfailures
   ];
diff --git a/pkgs/development/python-modules/annoy/default.nix b/pkgs/development/python-modules/annoy/default.nix
index 255896d30982..f871df2fbced 100644
--- a/pkgs/development/python-modules/annoy/default.nix
+++ b/pkgs/development/python-modules/annoy/default.nix
@@ -1,10 +1,10 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   h5py,
   numpy,
-  pynose,
+  pytestCheckHook,
   pythonOlder,
   setuptools,
 }:
@@ -16,9 +16,11 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-nL/r7+Cl+EPropxr5MhNYB9PQa1N7QSG8biMOwdznBU=";
+  src = fetchFromGitHub {
+    owner = "spotify";
+    repo = "annoy";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-oJHW4lULRun2in35pBGOKg44s5kgLH2BKiMOzVu4rf4=";
   };
 
   postPatch = ''
@@ -32,7 +34,16 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     numpy
-    pynose
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    rm -rf annoy
+  '';
+
+  disabledTestPaths = [
+    # network access
+    "test/accuracy_test.py"
   ];
 
   pythonImportsCheck = [ "annoy" ];
diff --git a/pkgs/development/python-modules/apricot-select/default.nix b/pkgs/development/python-modules/apricot-select/default.nix
index f05e9b8e5e95..254c14527c5a 100644
--- a/pkgs/development/python-modules/apricot-select/default.nix
+++ b/pkgs/development/python-modules/apricot-select/default.nix
@@ -5,7 +5,7 @@
   apricot-select,
   numba,
   numpy,
-  pynose,
+  nose,
   pytestCheckHook,
   pythonOlder,
   scikit-learn,
@@ -45,7 +45,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pynose
+    nose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/bc-python-hcl2/default.nix b/pkgs/development/python-modules/bc-python-hcl2/default.nix
index 519a39c53bac..506352b25d32 100644
--- a/pkgs/development/python-modules/bc-python-hcl2/default.nix
+++ b/pkgs/development/python-modules/bc-python-hcl2/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   lark,
-  pynose,
   pythonOlder,
   setuptools,
 }:
@@ -20,11 +19,7 @@ buildPythonPackage rec {
     hash = "sha256-rI/1n7m9Q36im4mn18UH/QoelXhFuumurGnyiSuNaB4=";
   };
 
-  # Nose is required during build process, so can not use `nativeCheckInputs`.
-  buildInputs = [
-    pynose
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [ lark ];
 
diff --git a/pkgs/development/python-modules/billiard/default.nix b/pkgs/development/python-modules/billiard/default.nix
index 87e6b47366a2..8162c9fe5efe 100644
--- a/pkgs/development/python-modules/billiard/default.nix
+++ b/pkgs/development/python-modules/billiard/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   pytestCheckHook,
-  case,
   psutil,
   pythonOlder,
 }:
@@ -21,7 +20,6 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    case
     psutil
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/biopandas/default.nix b/pkgs/development/python-modules/biopandas/default.nix
index 29e609b9b43c..be59f3638d91 100644
--- a/pkgs/development/python-modules/biopandas/default.nix
+++ b/pkgs/development/python-modules/biopandas/default.nix
@@ -5,10 +5,11 @@
   setuptools,
   looseversion,
   mmtf-python,
+  nose,
   numpy,
   pandas,
-  pynose,
   pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -23,7 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-1c78baBBsDyvAWrNx5mZI/Q75wyXv0DAwAdWm3EwX/I=";
   };
 
-
   pythonRelaxDeps = [ "looseversion" ];
 
   build-system = [ setuptools ];
@@ -35,8 +35,12 @@ buildPythonPackage rec {
     looseversion
   ];
 
+  # tests rely on nose
+  # resolved in 0.5.1: https://github.com/BioPandas/biopandas/commit/67aa2f237c70c826cd9ab59d6ae114582da2112f
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
-    pynose
+    nose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/blockdiag/default.nix b/pkgs/development/python-modules/blockdiag/default.nix
index b1a7dc98b57d..8b43fd2c9065 100644
--- a/pkgs/development/python-modules/blockdiag/default.nix
+++ b/pkgs/development/python-modules/blockdiag/default.nix
@@ -7,7 +7,7 @@
   fetchpatch,
   funcparserlib,
   pillow,
-  pynose,
+  nose,
   pytestCheckHook,
   pythonOlder,
   reportlab,
@@ -48,9 +48,12 @@ buildPythonPackage rec {
     webcolors
   ];
 
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
     ephem
-    pynose
+    nose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/capstone/default.nix b/pkgs/development/python-modules/capstone/default.nix
index ce7063adcd51..74035c9bef30 100644
--- a/pkgs/development/python-modules/capstone/default.nix
+++ b/pkgs/development/python-modules/capstone/default.nix
@@ -4,19 +4,24 @@
   capstone,
   stdenv,
   setuptools,
-  pythonAtLeast,
+  fetchpatch,
 }:
 
 buildPythonPackage rec {
   pname = "capstone";
   version = lib.getVersion capstone;
-  format = "setuptools";
-
-  # distutils usage
-  disabled = pythonAtLeast "3.12";
 
   src = capstone.src;
   sourceRoot = "${src.name}/bindings/python";
+  patches = [
+    # Drop distutils in python binding (PR 2271)
+    (fetchpatch {
+      name = "drop-distutils-in-python-binding.patch";
+      url = "https://github.com/capstone-engine/capstone/commit/d63211e3acb64fceb8b1c4a0d804b4b027f4ef71.patch";
+      hash = "sha256-zUGeFmm3xH5dzfPJE8nnHwqwFBrsZ7w8LBJAy20/3RI=";
+      stripLen = 2;
+    })
+  ];
 
   # libcapstone.a is not built with BUILD_SHARED_LIBS. For some reason setup.py
   # checks if it exists but it is not really needed. Most likely a bug in setup.py.
diff --git a/pkgs/development/python-modules/case/default.nix b/pkgs/development/python-modules/case/default.nix
deleted file mode 100644
index 8cf5ad07a64b..000000000000
--- a/pkgs/development/python-modules/case/default.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  pynose,
-  pythonOlder,
-  setuptools,
-  six,
-}:
-
-buildPythonPackage rec {
-  pname = "case";
-  version = "1.5.3";
-  pyproject = true;
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "48432b01d91913451c3512c5b90e31b0f348f1074b166a3431085eb70d784fb1";
-  };
-
-  build-system = [
-    setuptools
-  ];
-
-  pythonRemoveDeps = [
-    # replaced with pynopse for python 3.12 compat
-    "nose"
-  ];
-
-  dependencies = [
-    pynose
-    six
-  ];
-
-  # No real unittests, only coverage
-  doCheck = false;
-
-  pythonImportsCheck = [ "case" ];
-
-  meta = with lib; {
-    homepage = "https://github.com/celery/case";
-    description = "Utilities for unittests handling";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
-  };
-}
diff --git a/pkgs/development/python-modules/chroma-hnswlib/default.nix b/pkgs/development/python-modules/chroma-hnswlib/default.nix
index 845f2064f1cd..52fe37696132 100644
--- a/pkgs/development/python-modules/chroma-hnswlib/default.nix
+++ b/pkgs/development/python-modules/chroma-hnswlib/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "chroma-hnswlib";
-  version = "0.7.3";
+  version = "0.7.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "chroma-core";
     repo = "hnswlib";
     rev = "refs/tags/${version}";
-    hash = "sha256-c4FvymqZy8AZKbh6Y8xZRjKAqYcUyZABRGc1u7vwlsk=";
+    hash = "sha256-KU/t37MZMFeNWPme+rgCHchZH7B8timIV2EH40laXkA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index f02d1f1fb62e..e64548c36850 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -8,7 +8,6 @@
   minidump,
   pefile,
   pyelftools,
-  pynose,
   pytestCheckHook,
   pythonOlder,
   pyvex,
@@ -60,7 +59,6 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pynose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/django-celery-beat/default.nix b/pkgs/development/python-modules/django-celery-beat/default.nix
index f46ce7c36b9d..a66912ee09fc 100644
--- a/pkgs/development/python-modules/django-celery-beat/default.nix
+++ b/pkgs/development/python-modules/django-celery-beat/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  case,
   celery,
   cron-descriptor,
   django-timezone-field,
@@ -42,7 +41,6 @@ buildPythonPackage rec {
     ephem
     pytest-timeout
     pytest-django
-    case
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/django-cors-headers/default.nix b/pkgs/development/python-modules/django-cors-headers/default.nix
index a198b7dfff03..27c0974e2311 100644
--- a/pkgs/development/python-modules/django-cors-headers/default.nix
+++ b/pkgs/development/python-modules/django-cors-headers/default.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
+  setuptools,
   django,
   pytest-django,
   pytestCheckHook,
@@ -9,23 +10,27 @@
 
 buildPythonPackage rec {
   pname = "django-cors-headers";
-  version = "3.13.0";
-  format = "setuptools";
+  version = "4.4.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adamchainz";
-    repo = "django-cors-headers";
+    repo = pname;
     rev = version;
-    hash = "sha256-pIyf4poW8/slxj4PVvmXpuYp//v5w00yU0Vz6Jiy2yM=";
+    hash = "sha256-/uTQ09zIjRV1Ilb/mXyr4zn5tJI/mNFHpfql2ptuER4=";
   };
 
-  propagatedBuildInputs = [ django ];
+  build-system = [ setuptools ];
+
+  dependencies = [ django ];
 
   nativeCheckInputs = [
     pytest-django
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [ "corsheaders" ];
+
   meta = with lib; {
     description = "Django app for handling server Cross-Origin Resource Sharing (CORS) headers";
     homepage = "https://github.com/OttoYiu/django-cors-headers";
diff --git a/pkgs/development/python-modules/django-timezone-field/default.nix b/pkgs/development/python-modules/django-timezone-field/default.nix
index c111c4aff6d4..e53b0da04c4a 100644
--- a/pkgs/development/python-modules/django-timezone-field/default.nix
+++ b/pkgs/development/python-modules/django-timezone-field/default.nix
@@ -6,50 +6,45 @@
   poetry-core,
   django,
   djangorestframework,
-  pytz,
-  pytest,
+  pytestCheckHook,
+  pytest-django,
   pytest-lazy-fixture,
-  python,
 }:
 
 buildPythonPackage rec {
   pname = "django-timezone-field";
-  version = "5.1";
-  disabled = pythonOlder "3.5";
-  format = "pyproject";
+  version = "7.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mfogel";
     repo = pname;
     rev = version;
-    hash = "sha256-FAYO8OEE/h4rsbC4Oc57ylWV7TqQ6DOd6/2M+mb/AsM=";
+    hash = "sha256-q06TuYkBA4z6tJdT3an6Z8o1i/o85XbYa1JYZBHC8lI=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
-    django
-    djangorestframework
-    pytz
+  dependencies = [ django ];
+
+  pythonImportsCheck = [
+    # Requested setting USE_DEPRECATED_PYTZ, but settings are not configured.
+    #"timezone_field"
   ];
 
-  pythonImportsCheck = [ "timezone_field" ];
-
-  # Uses pytest.lazy_fixture directly which is broken in pytest-lazy-fixture
-  # https://github.com/TvoroG/pytest-lazy-fixture/issues/22
-  doCheck = false;
-
-  DJANGO_SETTINGS_MODULE = "tests.settings";
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE=tests.settings
+  '';
 
   nativeCheckInputs = [
-    pytest
+    djangorestframework
+    pytestCheckHook
+    pytest-django
     pytest-lazy-fixture
   ];
 
-  checkPhase = ''
-    ${python.interpreter} -m django test
-  '';
-
   meta = with lib; {
     description = "Django app providing database, form and serializer fields for pytz timezone objects";
     homepage = "https://github.com/mfogel/django-timezone-field";
diff --git a/pkgs/development/python-modules/enocean/default.nix b/pkgs/development/python-modules/enocean/default.nix
index 61c2ca0e1b20..eeef7703dd92 100644
--- a/pkgs/development/python-modules/enocean/default.nix
+++ b/pkgs/development/python-modules/enocean/default.nix
@@ -2,39 +2,43 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
+  setuptools,
   beautifulsoup4,
   enum-compat,
   pyserial,
-  pynose,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "enocean";
   version = "0.60.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kipe";
     repo = "enocean";
-    rev = version;
-    sha256 = "0cbcvvy3qaqv8925z608qmkc1l914crzw79krwrz2vpm2fyribab";
+    rev = "refs/tags/${version}";
+    hash = "sha256-S62YvRP1bvEzzzMd/jMjIdHAZsUImF9EQhsrPPzebDE=";
   };
 
-  propagatedBuildInputs = [
+  patches = [
+    (fetchpatch2 {
+      name = "replace-nose-with-pytest.patch";
+      url = "https://github.com/kipe/enocean/commit/e5ca3b70f0920f129219c980ad549d7f3a4576de.patch";
+      hash = "sha256-cDBvI0I4W5YkGTpg+rKy08TUAmKlhKa/5+Muou9iArs=";
+    })
+  ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     beautifulsoup4
     enum-compat
     pyserial
   ];
 
-  nativeCheckInputs = [ pynose ];
-
-  checkPhase = ''
-    runHook preCheck
-
-    nosetests
-
-    runHook postCheck
-  '';
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [
     "enocean.communicators"
@@ -43,6 +47,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/kipe/enocean/releases/tag/${version}";
     description = "EnOcean serial protocol implementation";
     mainProgram = "enocean_example.py";
     homepage = "https://github.com/kipe/enocean";
diff --git a/pkgs/development/python-modules/envs/default.nix b/pkgs/development/python-modules/envs/default.nix
index 3d113a4f2dfd..c64f607795ba 100644
--- a/pkgs/development/python-modules/envs/default.nix
+++ b/pkgs/development/python-modules/envs/default.nix
@@ -5,7 +5,7 @@
   fetchPypi,
   jinja2,
   mock,
-  pynose,
+  nose,
   poetry-core,
   pythonOlder,
   terminaltables,
@@ -31,9 +31,12 @@ buildPythonPackage rec {
     terminaltables
   ];
 
+  # test rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
     mock
-    pynose
+    nose
   ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/flask-assets/default.nix b/pkgs/development/python-modules/flask-assets/default.nix
index af92ff205418..46e225783493 100644
--- a/pkgs/development/python-modules/flask-assets/default.nix
+++ b/pkgs/development/python-modules/flask-assets/default.nix
@@ -5,8 +5,7 @@
   setuptools,
   flask,
   webassets,
-  flask-script,
-  pynose,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -31,10 +30,14 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     flask
     webassets
-    flask-script
-    pynose
   ];
 
+  doCheck = false; # tests are broken with webassets 2.0
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "flask_assets" ];
+
   meta = with lib; {
     homepage = "https://github.com/miracle2k/flask-assets";
     description = "Asset management for Flask, to compress and merge CSS and Javascript files";
diff --git a/pkgs/development/python-modules/forbiddenfruit/default.nix b/pkgs/development/python-modules/forbiddenfruit/default.nix
deleted file mode 100644
index 178f97c0f3d6..000000000000
--- a/pkgs/development/python-modules/forbiddenfruit/default.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pynose,
-  setuptools,
-}:
-
-buildPythonPackage rec {
-  version = "0.1.4";
-  pname = "forbiddenfruit";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "clarete";
-    repo = "forbiddenfruit";
-    rev = "refs/tags/${version}";
-    hash = "sha256-yHIZsVn2UVmWeBNIzWDE6AOwAXZilPqXo+bVtXqGkJk=";
-  };
-
-  build-system = [ setuptools ];
-
-  env.FFRUIT_EXTENSION = "true";
-
-  pythonImportsCheck = [ "forbiddenfruit" ];
-
-  nativeCheckInputs = [ pynose ];
-
-  # https://github.com/clarete/forbiddenfruit/pull/47 required to switch to pytest
-  checkPhase = ''
-    runHook preCheck
-
-    find ./build -name '*.so' -exec mv {} tests/unit \;
-    nosetests
-
-    runHook postCheck
-  '';
-
-  meta = with lib; {
-    description = "Patch python built-in objects";
-    homepage = "https://github.com/clarete/forbiddenfruit";
-    changelog = "https://github.com/clarete/forbiddenfruit/releases/tag/${version}";
-    license = with licenses; [
-      mit
-      gpl3Plus
-    ];
-    maintainers = with maintainers; [ ];
-  };
-}
diff --git a/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
index 08770d71976d..c6ef79d8ad36 100644
--- a/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-appengine-logging";
-  version = "1.4.3";
+  version = "1.4.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+1BOYZn+jehbqp0xzs9ndod4Uf5Yhn3mAzF+x8xzmYc=";
+    hash = "sha256-i0Qn8G+6ZpqVn9VMjaY1YP9M8vjiwVjCDVR5sIiQR5U=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-automl/default.nix b/pkgs/development/python-modules/google-cloud-automl/default.nix
index a8240580d12e..7b05f46dbd34 100644
--- a/pkgs/development/python-modules/google-cloud-automl/default.nix
+++ b/pkgs/development/python-modules/google-cloud-automl/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-automl";
-  version = "2.13.3";
+  version = "2.13.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iRqQgurt6xe8W7ck/BULdwLGhNdCD58irj98X8YRxxo=";
+    hash = "sha256-NxAoob0wJKobtcEQNTgH+fylnTtJdL98h23IVNfLhew=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-os-config/default.nix b/pkgs/development/python-modules/google-cloud-os-config/default.nix
index ca1b446f9232..2612fb157fae 100644
--- a/pkgs/development/python-modules/google-cloud-os-config/default.nix
+++ b/pkgs/development/python-modules/google-cloud-os-config/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-os-config";
-  version = "1.17.3";
+  version = "1.17.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oKOqWVmAP14dKpbVDlcX2KSRceTqVES/UGlLsYtnWHA=";
+    hash = "sha256-ocZ41cEZVjSfFMVoNiPOxwaymn9eylWmw6qlp/R/yMQ=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-translate/default.nix b/pkgs/development/python-modules/google-cloud-translate/default.nix
index 919a21471a8b..e25cf74a493e 100644
--- a/pkgs/development/python-modules/google-cloud-translate/default.nix
+++ b/pkgs/development/python-modules/google-cloud-translate/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-translate";
-  version = "3.15.3";
+  version = "3.15.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7Vh6HmDPhHw7Gt1rKCVuLRci+nOkKFM09excqTPmFvI=";
+    hash = "sha256-nZ3YzyJe+fsGdahvkuecrDKVoo0JpEeeEj7wy+VHSWs=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-vision/default.nix b/pkgs/development/python-modules/google-cloud-vision/default.nix
index 321331671859..2ee06820909d 100644
--- a/pkgs/development/python-modules/google-cloud-vision/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vision/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-vision";
-  version = "3.7.2";
+  version = "3.7.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BEMwrWGMgQMz/yKWzSf/0UXySWONGzWycN5rRgsA6NI=";
+    hash = "sha256-7kjEjoIMfgmTJmOYaXD+9FbcD0XHr3KdRvHz3ZfB37Y=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-vpc-access/default.nix b/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
index c29a04239447..11d64bd57447 100644
--- a/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-vpc-access";
-  version = "1.10.3";
+  version = "1.10.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mkDYB4HFJEu1ZRKo58s5a9lZjQ0pUs6nOBMnm27ajeM=";
+    hash = "sha256-FmCNw0esH7WbH0v4YzHyvc0lyRhJp3ywJNe+gMePdTU=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/hdmedians/default.nix b/pkgs/development/python-modules/hdmedians/default.nix
index 2d9ab8381953..0b175669db51 100644
--- a/pkgs/development/python-modules/hdmedians/default.nix
+++ b/pkgs/development/python-modules/hdmedians/default.nix
@@ -5,7 +5,6 @@
   cython,
   numpy,
   oldest-supported-numpy,
-  pynose,
   pytestCheckHook,
   setuptools,
 }:
@@ -20,6 +19,11 @@ buildPythonPackage rec {
     hash = "sha256-tHrssWdx4boHNlVyVdgK4CQLCRVr/0NDId5VmzWawtY=";
   };
 
+  patches = [
+    # https://github.com/daleroberts/hdmedians/pull/10
+    ./replace-nose.patch
+  ];
+
   postPatch = ''
     substituteInPlace setup.py \
       --replace-fail "'nose>=1.0'," ""
@@ -36,7 +40,6 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "hdmedians" ];
 
   nativeCheckInputs = [
-    pynose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/hdmedians/replace-nose.patch b/pkgs/development/python-modules/hdmedians/replace-nose.patch
new file mode 100644
index 000000000000..3cf12e42e349
--- /dev/null
+++ b/pkgs/development/python-modules/hdmedians/replace-nose.patch
@@ -0,0 +1,91 @@
+diff --git a/hdmedians/tests/test_geomedian.py b/hdmedians/tests/test_geomedian.py
+index 0bc37e9..ff5f938 100644
+--- a/hdmedians/tests/test_geomedian.py
++++ b/hdmedians/tests/test_geomedian.py
+@@ -4,9 +4,9 @@ Tests.
+ 
+ import numpy as np
+ import hdmedians as hd
++import pytest
+ 
+ from numpy.testing import assert_equal, assert_array_almost_equal
+-from nose.tools import assert_true, assert_raises
+ 
+ # shape (6, 25)
+ DATA1 = np.array([[693, 990, 1281, 2101, 3524, 2577],
+@@ -124,10 +124,12 @@ def test_nangeomedian_axis_one_two_good():
+ def test_nangeomedian_axis_bad():
+     data = np.array([[1.0, np.nan, 1.0],
+                      [2.0, 1.0, 1.0]])
+-    assert_raises(IndexError, hd.nangeomedian, data, axis=2)
++    with pytest.raises(IndexError):
++        hd.nangeomedian(data, axis=2)
+ 
+ 
+ def test_nangeomedian_all_nan():
+     data = np.array([[np.nan, np.nan, np.nan],
+                      [np.nan, np.nan, np.nan]])
+-    assert_raises(ValueError, hd.nangeomedian, data)
++    with pytest.raises(ValueError):
++        hd.nangeomedian(data)
+diff --git a/hdmedians/tests/test_medoid.py b/hdmedians/tests/test_medoid.py
+index c5e0a7f..4fbdf80 100644
+--- a/hdmedians/tests/test_medoid.py
++++ b/hdmedians/tests/test_medoid.py
+@@ -4,9 +4,9 @@ Tests.
+ 
+ import numpy as np
+ import hdmedians as hd
++import pytest
+ 
+ from numpy.testing import assert_equal, assert_array_almost_equal
+-from nose.tools import assert_true, assert_raises
+ 
+ # shape (6, 25)
+ DATA1 = np.array([[693, 990, 1281, 2101, 3524, 2577],
+@@ -59,7 +59,7 @@ def test_medoid_in_set_random():
+     s = [list(x) for x in a.T]
+     m = hd.medoid(a)
+     idx = s.index(list(m))
+-    assert_true(idx > -1)
++    assert(idx > -1)
+ 
+ 
+ def test_medoid_noaxis():
+@@ -85,7 +85,8 @@ def test_medoid_axis_one():
+ 
+ 
+ def test_medoid_axis_bad():
+-    assert_raises(IndexError, hd.medoid, DATA1, axis=2)
++    with pytest.raises(IndexError):
++        hd.medoid(DATA1, axis=2)
+ 
+ 
+ def test_medoid_noaxis_indexonly():
+@@ -136,7 +137,8 @@ def test_nanmedoid_two_obs():
+ def test_nanmedoid_all_nan():
+     data = np.array([[np.nan, np.nan, np.nan],
+                      [np.nan, np.nan, np.nan]])
+-    assert_raises(ValueError, hd.nanmedoid, data)
++    with pytest.raises(ValueError):
++        hd.nanmedoid(data)
+ 
+ 
+ def test_nanmedoid_axis_zero():
+@@ -170,7 +172,8 @@ def test_nanmedoid_axis_one_indexonly():
+ 
+ 
+ def test_nanmedoid_axis_bad():
+-    assert_raises(IndexError, hd.nanmedoid, DATA1, axis=2)
++    with pytest.raises(IndexError):
++        hd.nanmedoid(DATA1, axis=2)
+ 
+ 
+ def test_nanmedoid_two_obs():
+@@ -184,4 +187,5 @@ def test_nanmedoid_two_obs():
+ def test_nanmedoid_all_nan():
+     data = np.array([[np.nan, np.nan, np.nan],
+                      [np.nan, np.nan, np.nan]])
+-    assert_raises(ValueError, hd.nanmedoid, data)
++    with pytest.raises(ValueError):
++        hd.nanmedoid(data)
diff --git a/pkgs/development/python-modules/hkdf/default.nix b/pkgs/development/python-modules/hkdf/default.nix
index c062f293c416..176322d93221 100644
--- a/pkgs/development/python-modules/hkdf/default.nix
+++ b/pkgs/development/python-modules/hkdf/default.nix
@@ -2,7 +2,8 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pynose,
+  pythonOlder,
+  nose,
   setuptools,
 }:
 
@@ -22,7 +23,10 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "hkdf" ];
 
-  nativeCheckInputs = [ pynose ];
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
+  nativeCheckInputs = [ nose ];
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/development/python-modules/http-ece/default.nix b/pkgs/development/python-modules/http-ece/default.nix
index 4765b346752e..50de4ff088d4 100644
--- a/pkgs/development/python-modules/http-ece/default.nix
+++ b/pkgs/development/python-modules/http-ece/default.nix
@@ -4,7 +4,8 @@
   cryptography,
   fetchPypi,
   mock,
-  pynose,
+  nose,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -25,9 +26,11 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ cryptography ];
 
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
     mock
-    pynose
+    nose
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/influxdb/default.nix b/pkgs/development/python-modules/influxdb/default.nix
index 1f7e7c017501..b2270ef11248 100644
--- a/pkgs/development/python-modules/influxdb/default.nix
+++ b/pkgs/development/python-modules/influxdb/default.nix
@@ -5,7 +5,6 @@
   mock,
   msgpack,
   pandas,
-  pynose,
   pytestCheckHook,
   python-dateutil,
   pytz,
@@ -25,6 +24,11 @@ buildPythonPackage rec {
     hash = "sha256-WMZH9gQ3Et2G6a7hLrTM+7tUFUZ7yZEKSKqMdMEQiXA=";
   };
 
+  patches = [
+    # https://github.com/influxdata/influxdb-python/pull/835
+    ./remove-nose.patch
+  ];
+
   postPatch = ''
     for f in influxdb/tests/dataframe_client_test.py influxdb/tests/influxdb08/dataframe_client_test.py; do
       substituteInPlace "$f" \
@@ -52,7 +56,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     mock
     pandas
-    pynose
     pytestCheckHook
     requests-mock
   ];
diff --git a/pkgs/development/python-modules/influxdb/remove-nose.patch b/pkgs/development/python-modules/influxdb/remove-nose.patch
new file mode 100644
index 000000000000..b3d00c999581
--- /dev/null
+++ b/pkgs/development/python-modules/influxdb/remove-nose.patch
@@ -0,0 +1,713 @@
+diff --git a/influxdb/tests/client_test.py b/influxdb/tests/client_test.py
+index 115fbc4..5b348c7 100644
+--- a/influxdb/tests/client_test.py
++++ b/influxdb/tests/client_test.py
+@@ -32,7 +32,6 @@ import requests
+ import requests.exceptions
+ import requests_mock
+ 
+-from nose.tools import raises
+ from urllib3.connection import HTTPConnection
+ 
+ from influxdb import InfluxDBClient
+@@ -383,12 +382,12 @@ class TestInfluxDBClient(unittest.TestCase):
+             received_data.decode()
+         )
+ 
+-    @raises(Exception)
+     def test_write_points_fails(self):
+         """Test write points fail for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-        with _mocked_session(cli, 'post', 500):
+-            cli.write_points([])
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'post', 500):
++                cli.write_points([])
+ 
+     def test_write_points_with_precision(self):
+         """Test write points with precision for TestInfluxDBClient object."""
+@@ -541,12 +540,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                 consistency='boo'
+             )
+ 
+-    @raises(Exception)
+     def test_write_points_with_precision_fails(self):
+         """Test write points w/precision fail for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-        with _mocked_session(cli, 'post', 500):
+-            cli.write_points_with_precision([])
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'post', 500):
++                cli.write_points_with_precision([])
+ 
+     def test_query(self):
+         """Test query method for TestInfluxDBClient object."""
+@@ -651,11 +650,11 @@ class TestInfluxDBClient(unittest.TestCase):
+                 [example_object, example_object]
+             )
+ 
+-    @raises(Exception)
+     def test_query_fail(self):
+         """Test query failed for TestInfluxDBClient object."""
+-        with _mocked_session(self.cli, 'get', 401):
+-            self.cli.query('select column_one from foo;')
++        with self.assertRaises(Exception):
++            with _mocked_session(self.cli, 'get', 401):
++                self.cli.query('select column_one from foo;')
+ 
+     def test_ping(self):
+         """Test ping querying InfluxDB version."""
+@@ -697,11 +696,11 @@ class TestInfluxDBClient(unittest.TestCase):
+                 'create database "123"'
+             )
+ 
+-    @raises(Exception)
+     def test_create_database_fails(self):
+         """Test create database fail for TestInfluxDBClient object."""
+-        with _mocked_session(self.cli, 'post', 401):
+-            self.cli.create_database('new_db')
++        with self.assertRaises(Exception):
++            with _mocked_session(self.cli, 'post', 401):
++                self.cli.create_database('new_db')
+ 
+     def test_drop_database(self):
+         """Test drop database for TestInfluxDBClient object."""
+@@ -762,12 +761,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                 [{'name': 'new_db_1'}, {'name': 'new_db_2'}]
+             )
+ 
+-    @raises(Exception)
+     def test_get_list_database_fails(self):
+         """Test get list of dbs fail for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'get', 401):
+-            cli.get_list_database()
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'get', 401):
++                cli.get_list_database()
+ 
+     def test_get_list_measurements(self):
+         """Test get list of measurements for TestInfluxDBClient object."""
+@@ -840,12 +839,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                 self.cli.get_list_series(tags={'region': 'us-west'}),
+                 ['cpu_load_short,host=server01,region=us-west'])
+ 
+-    @raises(Exception)
+     def test_get_list_series_fails(self):
+         """Test get a list of series from the database but fail."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'get', 401):
+-            cli.get_list_series()
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'get', 401):
++                cli.get_list_series()
+ 
+     def test_create_retention_policy_default(self):
+         """Test create default ret policy for TestInfluxDBClient object."""
+@@ -971,12 +970,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                 'alter retention policy "somename" on "db" default'
+             )
+ 
+-    @raises(Exception)
+     def test_alter_retention_policy_invalid(self):
+         """Test invalid alter ret policy for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'get', 400):
+-            self.cli.alter_retention_policy('somename', 'db')
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'get', 400):
++                self.cli.alter_retention_policy('somename', 'db')
+ 
+     def test_drop_retention_policy(self):
+         """Test drop retention policy for TestInfluxDBClient object."""
+@@ -994,12 +993,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                 'drop retention policy "somename" on "db"'
+             )
+ 
+-    @raises(Exception)
+     def test_drop_retention_policy_fails(self):
+         """Test failed drop ret policy for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'delete', 401):
+-            cli.drop_retention_policy('default', 'db')
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'delete', 401):
++                cli.drop_retention_policy('default', 'db')
+ 
+     def test_get_list_retention_policies(self):
+         """Test get retention policies for TestInfluxDBClient object."""
+@@ -1179,12 +1178,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                 'grant all privileges to "test"'
+             )
+ 
+-    @raises(Exception)
+     def test_grant_admin_privileges_invalid(self):
+         """Test grant invalid admin privs for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'get', 400):
+-            self.cli.grant_admin_privileges('')
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'get', 400):
++                self.cli.grant_admin_privileges('')
+ 
+     def test_revoke_admin_privileges(self):
+         """Test revoke admin privs for TestInfluxDBClient object."""
+@@ -1203,12 +1202,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                 'revoke all privileges from "test"'
+             )
+ 
+-    @raises(Exception)
+     def test_revoke_admin_privileges_invalid(self):
+         """Test revoke invalid admin privs for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'get', 400):
+-            self.cli.revoke_admin_privileges('')
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'get', 400):
++                self.cli.revoke_admin_privileges('')
+ 
+     def test_grant_privilege(self):
+         """Test grant privs for TestInfluxDBClient object."""
+@@ -1227,12 +1226,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                 'grant read on "testdb" to "test"'
+             )
+ 
+-    @raises(Exception)
+     def test_grant_privilege_invalid(self):
+         """Test grant invalid privs for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'get', 400):
+-            self.cli.grant_privilege('', 'testdb', 'test')
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'get', 400):
++                self.cli.grant_privilege('', 'testdb', 'test')
+ 
+     def test_revoke_privilege(self):
+         """Test revoke privs for TestInfluxDBClient object."""
+@@ -1251,12 +1250,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                 'revoke read on "testdb" from "test"'
+             )
+ 
+-    @raises(Exception)
+     def test_revoke_privilege_invalid(self):
+         """Test revoke invalid privs for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'get', 400):
+-            self.cli.revoke_privilege('', 'testdb', 'test')
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'get', 400):
++                self.cli.revoke_privilege('', 'testdb', 'test')
+ 
+     def test_get_list_privileges(self):
+         """Test get list of privs for TestInfluxDBClient object."""
+@@ -1278,12 +1277,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                  {'database': 'db3', 'privilege': 'NO PRIVILEGES'}]
+             )
+ 
+-    @raises(Exception)
+     def test_get_list_privileges_fails(self):
+         """Test failed get list of privs for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'get', 401):
+-            cli.get_list_privileges('test')
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'get', 401):
++                cli.get_list_privileges('test')
+ 
+     def test_get_list_continuous_queries(self):
+         """Test getting a list of continuous queries."""
+@@ -1333,11 +1332,11 @@ class TestInfluxDBClient(unittest.TestCase):
+                 ]
+             )
+ 
+-    @raises(Exception)
+     def test_get_list_continuous_queries_fails(self):
+         """Test failing to get a list of continuous queries."""
+-        with _mocked_session(self.cli, 'get', 400):
+-            self.cli.get_list_continuous_queries()
++        with self.assertRaises(Exception):
++            with _mocked_session(self.cli, 'get', 400):
++                self.cli.get_list_continuous_queries()
+ 
+     def test_create_continuous_query(self):
+         """Test continuous query creation."""
+@@ -1366,11 +1365,12 @@ class TestInfluxDBClient(unittest.TestCase):
+                 '"6_months"."events" from "events" group by time(10m) end'
+             )
+ 
+-    @raises(Exception)
+     def test_create_continuous_query_fails(self):
+         """Test failing to create a continuous query."""
+-        with _mocked_session(self.cli, 'get', 400):
+-            self.cli.create_continuous_query('cq_name', 'select', 'db_name')
++        with self.assertRaises(Exception):
++            with _mocked_session(self.cli, 'get', 400):
++                self.cli.create_continuous_query('cq_name', 'select',
++                                                 'db_name')
+ 
+     def test_drop_continuous_query(self):
+         """Test dropping a continuous query."""
+@@ -1387,11 +1387,11 @@ class TestInfluxDBClient(unittest.TestCase):
+                 'drop continuous query "cq_name" on "db_name"'
+             )
+ 
+-    @raises(Exception)
+     def test_drop_continuous_query_fails(self):
+         """Test failing to drop a continuous query."""
+-        with _mocked_session(self.cli, 'get', 400):
+-            self.cli.drop_continuous_query('cq_name', 'db_name')
++        with self.assertRaises(Exception):
++            with _mocked_session(self.cli, 'get', 400):
++                self.cli.drop_continuous_query('cq_name', 'db_name')
+ 
+     def test_invalid_port_fails(self):
+         """Test invalid port fail for TestInfluxDBClient object."""
+diff --git a/influxdb/tests/dataframe_client_test.py b/influxdb/tests/dataframe_client_test.py
+index 87b8e0d..a8c8416 100644
+--- a/influxdb/tests/dataframe_client_test.py
++++ b/influxdb/tests/dataframe_client_test.py
+@@ -13,7 +13,6 @@ import unittest
+ import warnings
+ import requests_mock
+ 
+-from nose.tools import raises
+ from influxdb.tests import skip_if_pypy, using_pypy
+ 
+ from .client_test import _mocked_session
+@@ -597,35 +596,35 @@ class TestDataFrameClient(unittest.TestCase):
+                 m.last_request.body,
+             )
+ 
+-    @raises(TypeError)
+     def test_write_points_from_dataframe_fails_without_time_index(self):
+         """Test failed write points from df without time index."""
+         dataframe = pd.DataFrame(data=[["1", 1, 1.0], ["2", 2, 2.0]],
+                                  columns=["column_one", "column_two",
+                                           "column_three"])
+ 
+-        with requests_mock.Mocker() as m:
+-            m.register_uri(requests_mock.POST,
+-                           "http://localhost:8086/db/db/series",
+-                           status_code=204)
++        with self.assertRaises(TypeError):
++            with requests_mock.Mocker() as m:
++                m.register_uri(requests_mock.POST,
++                               "http://localhost:8086/db/db/series",
++                               status_code=204)
+ 
+-            cli = DataFrameClient(database='db')
+-            cli.write_points(dataframe, "foo")
++                cli = DataFrameClient(database='db')
++                cli.write_points(dataframe, "foo")
+ 
+-    @raises(TypeError)
+     def test_write_points_from_dataframe_fails_with_series(self):
+         """Test failed write points from df with series."""
+         now = pd.Timestamp('1970-01-01 00:00+00:00')
+         dataframe = pd.Series(data=[1.0, 2.0],
+                               index=[now, now + timedelta(hours=1)])
+ 
+-        with requests_mock.Mocker() as m:
+-            m.register_uri(requests_mock.POST,
+-                           "http://localhost:8086/db/db/series",
+-                           status_code=204)
++        with self.assertRaises(TypeError):
++            with requests_mock.Mocker() as m:
++                m.register_uri(requests_mock.POST,
++                               "http://localhost:8086/db/db/series",
++                               status_code=204)
+ 
+-            cli = DataFrameClient(database='db')
+-            cli.write_points(dataframe, "foo")
++                cli = DataFrameClient(database='db')
++                cli.write_points(dataframe, "foo")
+ 
+     def test_create_database(self):
+         """Test create database for TestInfluxDBClient object."""
+@@ -657,12 +656,12 @@ class TestDataFrameClient(unittest.TestCase):
+                 'create database "123"'
+             )
+ 
+-    @raises(Exception)
+     def test_create_database_fails(self):
+         """Test create database fail for TestInfluxDBClient object."""
+         cli = DataFrameClient(database='db')
+-        with _mocked_session(cli, 'post', 401):
+-            cli.create_database('new_db')
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'post', 401):
++                cli.create_database('new_db')
+ 
+     def test_drop_database(self):
+         """Test drop database for TestInfluxDBClient object."""
+@@ -709,12 +708,12 @@ class TestDataFrameClient(unittest.TestCase):
+                 'drop database "123"'
+             )
+ 
+-    @raises(Exception)
+     def test_get_list_database_fails(self):
+         """Test get list of dbs fail for TestInfluxDBClient object."""
+         cli = DataFrameClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'get', 401):
+-            cli.get_list_database()
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'get', 401):
++                cli.get_list_database()
+ 
+     def test_get_list_measurements(self):
+         """Test get list of measurements for TestInfluxDBClient object."""
+@@ -819,12 +818,12 @@ class TestDataFrameClient(unittest.TestCase):
+                 'alter retention policy "somename" on "db" default'
+             )
+ 
+-    @raises(Exception)
+     def test_alter_retention_policy_invalid(self):
+         """Test invalid alter ret policy for TestInfluxDBClient object."""
+         cli = DataFrameClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'get', 400):
+-            cli.alter_retention_policy('somename', 'db')
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'get', 400):
++                cli.alter_retention_policy('somename', 'db')
+ 
+     def test_drop_retention_policy(self):
+         """Test drop retention policy for TestInfluxDBClient object."""
+@@ -843,12 +842,12 @@ class TestDataFrameClient(unittest.TestCase):
+                 'drop retention policy "somename" on "db"'
+             )
+ 
+-    @raises(Exception)
+     def test_drop_retention_policy_fails(self):
+         """Test failed drop ret policy for TestInfluxDBClient object."""
+         cli = DataFrameClient('host', 8086, 'username', 'password')
+-        with _mocked_session(cli, 'delete', 401):
+-            cli.drop_retention_policy('default', 'db')
++        with self.assertRaises(Exception):
++            with _mocked_session(cli, 'delete', 401):
++                cli.drop_retention_policy('default', 'db')
+ 
+     def test_get_list_retention_policies(self):
+         """Test get retention policies for TestInfluxDBClient object."""
+diff --git a/influxdb/tests/influxdb08/client_test.py b/influxdb/tests/influxdb08/client_test.py
+index 39ab52d..d20a411 100644
+--- a/influxdb/tests/influxdb08/client_test.py
++++ b/influxdb/tests/influxdb08/client_test.py
+@@ -13,7 +13,6 @@ import requests
+ import requests.exceptions
+ import requests_mock
+ 
+-from nose.tools import raises
+ from mock import patch
+ 
+ from influxdb.influxdb08 import InfluxDBClient
+@@ -131,12 +130,12 @@ class TestInfluxDBClient(unittest.TestCase):
+         cli.switch_database('another_database')
+         self.assertEqual(cli._database, 'another_database')
+ 
+-    @raises(FutureWarning)
+     def test_switch_db_deprecated(self):
+         """Test deprecated switch database for TestInfluxDBClient object."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'database')
+-        cli.switch_db('another_database')
+-        self.assertEqual(cli._database, 'another_database')
++        with self.assertRaises(FutureWarning):
++            cli.switch_db('another_database')
++            self.assertEqual(cli._database, 'another_database')
+ 
+     def test_switch_user(self):
+         """Test switch user for TestInfluxDBClient object."""
+@@ -288,12 +287,13 @@ class TestInfluxDBClient(unittest.TestCase):
+                 time_precision='ms'
+             )
+ 
+-    @raises(Exception)
+     def test_write_points_fails(self):
+         """Test failed write points for TestInfluxDBClient object."""
+-        with _mocked_session('post', 500):
+-            cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-            cli.write_points([])
++        with self.assertRaises(Exception):
++            with _mocked_session('post', 500):
++                cli = InfluxDBClient('host', 8086, 'username',
++                                     'password', 'db')
++                cli.write_points([])
+ 
+     def test_write_points_with_precision(self):
+         """Test write points with precision."""
+@@ -313,12 +313,13 @@ class TestInfluxDBClient(unittest.TestCase):
+                 time_precision='g'
+             )
+ 
+-    @raises(Exception)
+     def test_write_points_with_precision_fails(self):
+         """Test write points where precision fails."""
+-        with _mocked_session('post', 500):
+-            cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-            cli.write_points_with_precision([])
++        with self.assertRaises(Exception):
++            with _mocked_session('post', 500):
++                cli = InfluxDBClient('host', 8086, 'username',
++                                     'password', 'db')
++                cli.write_points_with_precision([])
+ 
+     def test_delete_points(self):
+         """Test delete points for TestInfluxDBClient object."""
+@@ -333,30 +334,31 @@ class TestInfluxDBClient(unittest.TestCase):
+                              {'u': 'username', 'p': 'password'})
+             self.assertEqual(kwds['url'], 'http://host:8086/db/db/series/foo')
+ 
+-    @raises(Exception)
+     def test_delete_points_with_wrong_name(self):
+         """Test delete points with wrong name."""
+-        with _mocked_session('delete', 400):
+-            cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-            cli.delete_points("nonexist")
++        with self.assertRaises(Exception):
++            with _mocked_session('delete', 400):
++                cli = InfluxDBClient('host', 8086, 'username',
++                                     'password', 'db')
++                cli.delete_points("nonexist")
+ 
+-    @raises(NotImplementedError)
+     def test_create_scheduled_delete(self):
+         """Test create scheduled deletes."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-        cli.create_scheduled_delete([])
++        with self.assertRaises(NotImplementedError):
++            cli.create_scheduled_delete([])
+ 
+-    @raises(NotImplementedError)
+     def test_get_list_scheduled_delete(self):
+         """Test get schedule list of deletes TestInfluxDBClient."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-        cli.get_list_scheduled_delete()
++        with self.assertRaises(NotImplementedError):
++            cli.get_list_scheduled_delete()
+ 
+-    @raises(NotImplementedError)
+     def test_remove_scheduled_delete(self):
+         """Test remove scheduled delete TestInfluxDBClient."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-        cli.remove_scheduled_delete(1)
++        with self.assertRaises(NotImplementedError):
++            cli.remove_scheduled_delete(1)
+ 
+     def test_query(self):
+         """Test query for TestInfluxDBClient object."""
+@@ -438,12 +440,13 @@ class TestInfluxDBClient(unittest.TestCase):
+                 [example_object, example_object]
+             )
+ 
+-    @raises(Exception)
+     def test_query_fail(self):
+         """Test failed query for TestInfluxDBClient."""
+-        with _mocked_session('get', 401):
+-            cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-            cli.query('select column_one from foo;')
++        with self.assertRaises(Exception):
++            with _mocked_session('get', 401):
++                cli = InfluxDBClient('host', 8086, 'username',
++                                     'password', 'db')
++                cli.query('select column_one from foo;')
+ 
+     def test_query_bad_precision(self):
+         """Test query with bad precision for TestInfluxDBClient."""
+@@ -460,12 +463,13 @@ class TestInfluxDBClient(unittest.TestCase):
+             cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+             self.assertTrue(cli.create_database('new_db'))
+ 
+-    @raises(Exception)
+     def test_create_database_fails(self):
+         """Test failed create database for TestInfluxDBClient."""
+-        with _mocked_session('post', 401):
+-            cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-            cli.create_database('new_db')
++        with self.assertRaises(Exception):
++            with _mocked_session('post', 401):
++                cli = InfluxDBClient('host', 8086, 'username',
++                                     'password', 'db')
++                cli.create_database('new_db')
+ 
+     def test_delete_database(self):
+         """Test delete database for TestInfluxDBClient."""
+@@ -473,12 +477,13 @@ class TestInfluxDBClient(unittest.TestCase):
+             cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+             self.assertTrue(cli.delete_database('old_db'))
+ 
+-    @raises(Exception)
+     def test_delete_database_fails(self):
+         """Test failed delete database for TestInfluxDBClient."""
+-        with _mocked_session('delete', 401):
+-            cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-            cli.delete_database('old_db')
++        with self.assertRaises(Exception):
++            with _mocked_session('delete', 401):
++                cli = InfluxDBClient('host', 8086, 'username',
++                                     'password', 'db')
++                cli.delete_database('old_db')
+ 
+     def test_get_list_database(self):
+         """Test get list of databases for TestInfluxDBClient."""
+@@ -490,23 +495,23 @@ class TestInfluxDBClient(unittest.TestCase):
+             self.assertEqual(len(cli.get_list_database()), 1)
+             self.assertEqual(cli.get_list_database()[0]['name'], 'a_db')
+ 
+-    @raises(Exception)
+     def test_get_list_database_fails(self):
+         """Test failed get list of databases for TestInfluxDBClient."""
+-        with _mocked_session('get', 401):
+-            cli = InfluxDBClient('host', 8086, 'username', 'password')
+-            cli.get_list_database()
++        with self.assertRaises(Exception):
++            with _mocked_session('get', 401):
++                cli = InfluxDBClient('host', 8086, 'username', 'password')
++                cli.get_list_database()
+ 
+-    @raises(FutureWarning)
+     def test_get_database_list_deprecated(self):
+         """Test deprecated get database list for TestInfluxDBClient."""
+         data = [
+             {"name": "a_db"}
+         ]
+-        with _mocked_session('get', 200, data):
+-            cli = InfluxDBClient('host', 8086, 'username', 'password')
+-            self.assertEqual(len(cli.get_database_list()), 1)
+-            self.assertEqual(cli.get_database_list()[0]['name'], 'a_db')
++        with self.assertRaises(FutureWarning):
++            with _mocked_session('get', 200, data):
++                cli = InfluxDBClient('host', 8086, 'username', 'password')
++                self.assertEqual(len(cli.get_database_list()), 1)
++                self.assertEqual(cli.get_database_list()[0]['name'], 'a_db')
+ 
+     def test_delete_series(self):
+         """Test delete series for TestInfluxDBClient."""
+@@ -514,12 +519,13 @@ class TestInfluxDBClient(unittest.TestCase):
+             cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+             cli.delete_series('old_series')
+ 
+-    @raises(Exception)
+     def test_delete_series_fails(self):
+         """Test failed delete series for TestInfluxDBClient."""
+-        with _mocked_session('delete', 401):
+-            cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-            cli.delete_series('old_series')
++        with self.assertRaises(Exception):
++            with _mocked_session('delete', 401):
++                cli = InfluxDBClient('host', 8086, 'username',
++                                     'password', 'db')
++                cli.delete_series('old_series')
+ 
+     def test_get_series_list(self):
+         """Test get list of series for TestInfluxDBClient."""
+@@ -662,29 +668,30 @@ class TestInfluxDBClient(unittest.TestCase):
+                 }
+             )
+ 
+-    @raises(NotImplementedError)
+     def test_get_list_database_admins(self):
+         """Test get list of database admins for TestInfluxDBClient."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-        cli.get_list_database_admins()
++        with self.assertRaises(NotImplementedError):
++            cli.get_list_database_admins()
+ 
+-    @raises(NotImplementedError)
+     def test_add_database_admin(self):
+         """Test add database admins for TestInfluxDBClient."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-        cli.add_database_admin('admin', 'admin_secret_password')
++        with self.assertRaises(NotImplementedError):
++            cli.add_database_admin('admin', 'admin_secret_password')
+ 
+-    @raises(NotImplementedError)
+     def test_update_database_admin_password(self):
+         """Test update database admin pass for TestInfluxDBClient."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-        cli.update_database_admin_password('admin', 'admin_secret_password')
++        with self.assertRaises(NotImplementedError):
++            cli.update_database_admin_password('admin',
++                                               'admin_secret_password')
+ 
+-    @raises(NotImplementedError)
+     def test_delete_database_admin(self):
+         """Test delete database admin for TestInfluxDBClient."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-        cli.delete_database_admin('admin')
++        with self.assertRaises(NotImplementedError):
++            cli.delete_database_admin('admin')
+ 
+     def test_get_database_users(self):
+         """Test get database users for TestInfluxDBClient."""
+@@ -842,11 +849,11 @@ class TestInfluxDBClient(unittest.TestCase):
+ 
+             self.assertIsNone(m.last_request.body)
+ 
+-    @raises(NotImplementedError)
+     def test_update_permission(self):
+         """Test update permission for TestInfluxDBClient."""
+         cli = InfluxDBClient('host', 8086, 'username', 'password', 'db')
+-        cli.update_permission('admin', [])
++        with self.assertRaises(NotImplementedError):
++            cli.update_permission('admin', [])
+ 
+     @mock.patch('requests.Session.request')
+     def test_request_retry(self, mock_request):
+diff --git a/influxdb/tests/influxdb08/dataframe_client_test.py b/influxdb/tests/influxdb08/dataframe_client_test.py
+index 0a766af..104ae6b 100644
+--- a/influxdb/tests/influxdb08/dataframe_client_test.py
++++ b/influxdb/tests/influxdb08/dataframe_client_test.py
+@@ -10,8 +10,6 @@ import warnings
+ 
+ import requests_mock
+ 
+-from nose.tools import raises
+-
+ from influxdb.tests import skip_if_pypy, using_pypy
+ 
+ from .client_test import _mocked_session
+@@ -191,33 +189,33 @@ class TestDataFrameClient(unittest.TestCase):
+             cli.write_points({"foo": dataframe}, time_precision='u')
+             self.assertListEqual(json.loads(m.last_request.body), points_us)
+ 
+-    @raises(TypeError)
+     def test_write_points_from_dataframe_fails_without_time_index(self):
+         """Test write points from dataframe that fails without time index."""
+         dataframe = pd.DataFrame(data=[["1", 1, 1.0], ["2", 2, 2.0]],
+                                  columns=["column_one", "column_two",
+                                           "column_three"])
+ 
+-        with requests_mock.Mocker() as m:
+-            m.register_uri(requests_mock.POST,
+-                           "http://localhost:8086/db/db/series")
++        with self.assertRaises(TypeError):
++            with requests_mock.Mocker() as m:
++                m.register_uri(requests_mock.POST,
++                               "http://localhost:8086/db/db/series")
+ 
+-            cli = DataFrameClient(database='db')
+-            cli.write_points({"foo": dataframe})
++                cli = DataFrameClient(database='db')
++                cli.write_points({"foo": dataframe})
+ 
+-    @raises(TypeError)
+     def test_write_points_from_dataframe_fails_with_series(self):
+         """Test failed write points from dataframe with series."""
+         now = pd.Timestamp('1970-01-01 00:00+00:00')
+         dataframe = pd.Series(data=[1.0, 2.0],
+                               index=[now, now + timedelta(hours=1)])
+ 
+-        with requests_mock.Mocker() as m:
+-            m.register_uri(requests_mock.POST,
+-                           "http://localhost:8086/db/db/series")
++        with self.assertRaises(TypeError):
++            with requests_mock.Mocker() as m:
++                m.register_uri(requests_mock.POST,
++                               "http://localhost:8086/db/db/series")
+ 
+-            cli = DataFrameClient(database='db')
+-            cli.write_points({"foo": dataframe})
++                cli = DataFrameClient(database='db')
++                cli.write_points({"foo": dataframe})
+ 
+     def test_query_into_dataframe(self):
+         """Test query into a dataframe."""
diff --git a/pkgs/development/python-modules/ipy/default.nix b/pkgs/development/python-modules/ipy/default.nix
index 7db51ef648b1..5a5876b8b2be 100644
--- a/pkgs/development/python-modules/ipy/default.nix
+++ b/pkgs/development/python-modules/ipy/default.nix
@@ -2,25 +2,26 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  nose,
+  setuptools,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "ipy";
   version = "1.01";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "IPy";
     inherit version;
-    sha256 = "edeca741dea2d54aca568fa23740288c3fe86c0f3ea700344571e9ef14a7cc1a";
+    hash = "sha256-7eynQd6i1UrKVo+iN0AojD/obA8+pwA0RXHp7xSnzBo=";
   };
 
-  nativeCheckInputs = [ nose ];
+  build-system = [ setuptools ];
 
-  checkPhase = ''
-    nosetests -e fuzz
-  '';
+  pythonImportsCheck = [ "IPy" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Class and tools for handling of IPv4 and IPv6 addresses and networks";
diff --git a/pkgs/development/python-modules/ipython-genutils/default.nix b/pkgs/development/python-modules/ipython-genutils/default.nix
index a719905c2fc6..980e828c44a5 100644
--- a/pkgs/development/python-modules/ipython-genutils/default.nix
+++ b/pkgs/development/python-modules/ipython-genutils/default.nix
@@ -2,8 +2,8 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  fetchpatch,
   setuptools,
-  pynose,
   pytestCheckHook,
 }:
 
@@ -18,20 +18,17 @@ buildPythonPackage rec {
     hash = "sha256-6y4RbnXs751NIo/cZq9UJpr6JqtEYwQuM3hbiHxii6g=";
   };
 
-  nativeBuildInputs = [ setuptools ];
-
-  nativeCheckInputs = [
-    pynose
-    pytestCheckHook
+  patches = [
+    (fetchpatch {
+      name = "ipython_genutils-denose.patch";
+      url = "https://build.opensuse.org/public/source/devel:languages:python:jupyter/python-ipython_genutils/denose.patch?rev=9";
+      hash = "sha256-At0aq6rLw/L64Own069m0p/WQm7iDa24fm0SPLLRBdE=";
+    })
   ];
 
-  preCheck = ''
-    substituteInPlace ipython_genutils/tests/test_path.py \
-      --replace-fail "setUp" "setup_method" \
-      --replace-fail "tearDown" "teardown_method" \
-      --replace-fail "assert_equals" "assert_equal" \
-      --replace-fail "assert_not_equals" "assert_not_equal"
-  '';
+  nativeBuildInputs = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "ipython_genutils" ];
 
diff --git a/pkgs/development/python-modules/jaconv/default.nix b/pkgs/development/python-modules/jaconv/default.nix
index 474b168c6042..d56e02f9d674 100644
--- a/pkgs/development/python-modules/jaconv/default.nix
+++ b/pkgs/development/python-modules/jaconv/default.nix
@@ -2,29 +2,30 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  nose,
   pythonOlder,
+  setuptools,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "jaconv";
   version = "0.3.4";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ikegami-yukino";
-    repo = pname;
+    repo = "jaconv";
     rev = "refs/tags/v${version}";
     hash = "sha256-9ruhOLaYNESeKOwJs3IN6ct66fSq7My9DOyA7/cH3d0=";
   };
 
-  nativeCheckInputs = [
-    nose
-    pytestCheckHook
-  ];
+  patches = [ ./use-pytest.patch ];
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "jaconv" ];
 
diff --git a/pkgs/development/python-modules/jaconv/use-pytest.patch b/pkgs/development/python-modules/jaconv/use-pytest.patch
new file mode 100644
index 000000000000..b91704ee4f32
--- /dev/null
+++ b/pkgs/development/python-modules/jaconv/use-pytest.patch
@@ -0,0 +1,34 @@
+diff --git a/test_jaconv.py b/test_jaconv.py
+index 7e0a169..aaf180d 100644
+--- a/test_jaconv.py
++++ b/test_jaconv.py
+@@ -1,11 +1,8 @@
+ # -*- coding: utf-8 -*-
+ from __future__ import unicode_literals
+-from nose.tools import assert_equal, nottest
+ import jaconv
+ from functools import partial
+ 
+-assert_equal.__self__.maxDiff = None
+-
+ HIRAGANA = ('ぁあぃいぅうぇえぉおかがきぎくぐけげこごさざしじすずせぜそぞた',
+             'だちぢっつづてでとどなにぬねのはばぱひびぴふぶぷへべぺほぼぽま',
+             'みむめもゃやゅゆょよらりるれろわをんーゎゐゑゕゖゔゝゞ・「」。、')
+@@ -25,13 +22,15 @@ FULL_ASCII = ('！＂＃＄％＆＇（）＊＋，－．／：；＜＝＞？
+ FULL_DIGIT = '０１２３４５６７８９'
+ 
+ 
+-@nottest
++def assert_equal(x, y):
++    assert x == y
++
++
+ def _compare(mathod, lhs, rhs):
+     for i in range(len(lhs)):
+         assert_equal(mathod(lhs[i]), rhs[i])
+ 
+ 
+-@nottest
+ def _concat(*iterables):
+     result = ''
+     for iterable in iterables:
diff --git a/pkgs/development/python-modules/kazoo/default.nix b/pkgs/development/python-modules/kazoo/default.nix
index 8b0c78d705ed..21927ef81def 100644
--- a/pkgs/development/python-modules/kazoo/default.nix
+++ b/pkgs/development/python-modules/kazoo/default.nix
@@ -5,10 +5,9 @@
   six,
   eventlet,
   gevent,
-  pynose,
   mock,
   coverage,
-  pkgs,
+  openjdk8_headless,
 }:
 
 buildPythonPackage rec {
@@ -25,10 +24,9 @@ buildPythonPackage rec {
   buildInputs = [
     eventlet
     gevent
-    pynose
     mock
     coverage
-    pkgs.openjdk8
+    openjdk8_headless
   ];
 
   # not really needed
@@ -48,5 +46,6 @@ buildPythonPackage rec {
     homepage = "https://kazoo.readthedocs.org";
     description = "Higher Level Zookeeper Client";
     license = licenses.asl20;
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/kombu/default.nix b/pkgs/development/python-modules/kombu/default.nix
index a353418fd5a3..2170ba9e966c 100644
--- a/pkgs/development/python-modules/kombu/default.nix
+++ b/pkgs/development/python-modules/kombu/default.nix
@@ -7,7 +7,6 @@
   backports-zoneinfo,
   boto3,
   buildPythonPackage,
-  case,
   confluent-kafka,
   fetchPypi,
   hypothesis,
@@ -16,7 +15,7 @@
   pycurl,
   pymongo,
   #, pyro4
-  pytest7CheckHook,
+  pytestCheckHook,
   pythonOlder,
   pyyaml,
   redis,
@@ -46,7 +45,7 @@ buildPythonPackage rec {
     ++ lib.optionals (pythonOlder "3.10") [ typing-extensions ]
     ++ lib.optionals (pythonOlder "3.9") [ backports-zoneinfo ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     msgpack = [ msgpack ];
     yaml = [ pyyaml ];
     redis = [ redis ];
@@ -71,10 +70,9 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    case
     hypothesis
-    pytest7CheckHook
-  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pythonImportsCheck = [ "kombu" ];
 
diff --git a/pkgs/development/python-modules/libvirt/default.nix b/pkgs/development/python-modules/libvirt/default.nix
index 9af39f33d3d5..6dbb2c867112 100644
--- a/pkgs/development/python-modules/libvirt/default.nix
+++ b/pkgs/development/python-modules/libvirt/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "libvirt";
-  version = "10.4.0";
+  version = "10.5.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "libvirt";
     repo = "libvirt-python";
     rev = "v${version}";
-    hash = "sha256-Qwn07C8N2ZZzE5+qCo2HtBSm5/zGBqbiLnJePxuEJjs=";
+    hash = "sha256-dPjT9PRoUzNrY79yejAW/sbkMr0fpLif7IKZIW/K3KI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/llama-index-graph-stores-neo4j/default.nix b/pkgs/development/python-modules/llama-index-graph-stores-neo4j/default.nix
index 06d00b774787..56b31b8aca55 100644
--- a/pkgs/development/python-modules/llama-index-graph-stores-neo4j/default.nix
+++ b/pkgs/development/python-modules/llama-index-graph-stores-neo4j/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-graph-stores-neo4j";
-  version = "0.2.6";
+  version = "0.2.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_graph_stores_neo4j";
     inherit version;
-    hash = "sha256-xv/Z/HLFUEfLqjE4052bc8aBJq3bvreYD/XZw1vijQQ=";
+    hash = "sha256-SMdEeJ3kZPbiIU1PW3PWBKBI/B5fRwC/wqEZnkLekHY=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/llama-index-readers-file/default.nix b/pkgs/development/python-modules/llama-index-readers-file/default.nix
index 4e96733d29b7..ee6c4453e4d5 100644
--- a/pkgs/development/python-modules/llama-index-readers-file/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-file/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-readers-file";
-  version = "0.1.25";
+  version = "0.1.27";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_readers_file";
     inherit version;
-    hash = "sha256-I43dmKo3fWpEMiAT64SAVgN8gK2EVx6lv0UaZA//TVw=";
+    hash = "sha256-BMm8MGOpQJ/Nh3932bKr/VAuBydjqm3XiODGN0GLhmQ=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/llama-parse/default.nix b/pkgs/development/python-modules/llama-parse/default.nix
index 147183c04634..25ae1155ec92 100644
--- a/pkgs/development/python-modules/llama-parse/default.nix
+++ b/pkgs/development/python-modules/llama-parse/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "llama-parse";
-  version = "0.4.4";
+  version = "0.4.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_parse";
     inherit version;
-    hash = "sha256-tFwtszoNa3otX1nj0Ox+5/gieoUuqlawSqErEvLA1SE=";
+    hash = "sha256-CKSLz0r1tiO/JvpiZgOFcrlUCfe+ZHRgZ9uNOPaSf+U=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/lockfile/default.nix b/pkgs/development/python-modules/lockfile/default.nix
index deb05ac31dac..0a0b906e9122 100644
--- a/pkgs/development/python-modules/lockfile/default.nix
+++ b/pkgs/development/python-modules/lockfile/default.nix
@@ -4,7 +4,8 @@
   fetchPypi,
   setuptools,
   pbr,
-  pynose,
+  nose,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -22,7 +23,10 @@ buildPythonPackage rec {
     setuptools
   ];
 
-  nativeCheckInputs = [ pynose ];
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
+  nativeCheckInputs = [ nose ];
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/development/python-modules/macaroonbakery/default.nix b/pkgs/development/python-modules/macaroonbakery/default.nix
index ed94e0261f9e..e9eb35783996 100644
--- a/pkgs/development/python-modules/macaroonbakery/default.nix
+++ b/pkgs/development/python-modules/macaroonbakery/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   nix-update-script,
-  protobuf3,
+  protobuf,
   pymacaroons,
   pynacl,
   pyrfc3339,
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [ setuptools ];
 
   propagatedBuildInputs = [
-    protobuf3
+    protobuf
     pymacaroons
     pynacl
     pyrfc3339
diff --git a/pkgs/development/python-modules/mkdocs-awesome-pages-plugin/default.nix b/pkgs/development/python-modules/mkdocs-awesome-pages-plugin/default.nix
new file mode 100644
index 000000000000..f7bf173400dd
--- /dev/null
+++ b/pkgs/development/python-modules/mkdocs-awesome-pages-plugin/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  mkdocs,
+  wcmatch,
+  natsort,
+  pytestCheckHook,
+  beautifulsoup4,
+  mock-open,
+  importlib-metadata,
+  pythonOlder,
+}:
+buildPythonPackage rec {
+  pname = "mkdocs-awesome-pages-plugin";
+  version = "2.9.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "lukasgeiter";
+    repo = "mkdocs-awesome-pages-plugin";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-pYyZ84eNrslxgLSBr3teQqmV7hA+LHwJ+Z99QgPdh6U=";
+  };
+
+  propagatedBuildInputs = [
+    mkdocs
+    wcmatch
+    natsort
+  ];
+
+  nativeBuildInputs = [poetry-core];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    beautifulsoup4
+    mock-open
+    importlib-metadata
+  ];
+
+  disabledTestPaths = [
+    # requires "generatedfiles" mkdocs plugin
+    "mkdocs_awesome_pages_plugin/tests/e2e/test_gen_files.py"
+  ];
+
+  meta = with lib; {
+    description = "An MkDocs plugin that simplifies configuring page titles and their order";
+    homepage = "https://github.com/lukasgeiter/mkdocs-awesome-pages-plugin";
+    changelog = "https://github.com/lukasgeiter/mkdocs-awesome-pages-plugin/blob/v${version}/CHANGELOG";
+    license = licenses.mit;
+    maintainers = with maintainers; [phaer];
+  };
+}
diff --git a/pkgs/development/python-modules/mplhep/default.nix b/pkgs/development/python-modules/mplhep/default.nix
index 1daa1bc2170f..a9d0fb10eabe 100644
--- a/pkgs/development/python-modules/mplhep/default.nix
+++ b/pkgs/development/python-modules/mplhep/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "mplhep";
-  version = "0.3.49";
+  version = "0.3.50";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Hxqk0eSEOWSpomrS/vTdJV9/1mKQ/yCJQOBpm9tAvqo=";
+    hash = "sha256-xHdZdfTiKbDGu6oYIiTd8P/npH2kUjz7s8A9+CBJN0A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/nbxmpp/default.nix b/pkgs/development/python-modules/nbxmpp/default.nix
index 94715f449203..b44f40ffc9c5 100644
--- a/pkgs/development/python-modules/nbxmpp/default.nix
+++ b/pkgs/development/python-modules/nbxmpp/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "nbxmpp";
-  version = "5.0.0";
+  version = "5.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "gajim";
     repo = "python-nbxmpp";
     rev = "refs/tags/${version}";
-    hash = "sha256-WSeY9v1ELIZEWvbVHGZFq+8tZVVPkOwUwQ/4cOh8IwQ=";
+    hash = "sha256-XHdKQu6mfPl8hUNBqOZlGmI1SdBqwZm/sYzBZEbpDD0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/notus-scanner/default.nix b/pkgs/development/python-modules/notus-scanner/default.nix
index afe74c20e94e..bd52934394bd 100644
--- a/pkgs/development/python-modules/notus-scanner/default.nix
+++ b/pkgs/development/python-modules/notus-scanner/default.nix
@@ -28,6 +28,7 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "packaging"
+    "psutil"
     "python-gnupg"
   ];
 
diff --git a/pkgs/development/python-modules/nwdiag/default.nix b/pkgs/development/python-modules/nwdiag/default.nix
index 9f5365633104..dc2fd74fbef5 100644
--- a/pkgs/development/python-modules/nwdiag/default.nix
+++ b/pkgs/development/python-modules/nwdiag/default.nix
@@ -3,7 +3,7 @@
   blockdiag,
   fetchFromGitHub,
   buildPythonPackage,
-  pynose,
+  nose,
   pytestCheckHook,
   setuptools,
   pythonOlder,
@@ -27,8 +27,11 @@ buildPythonPackage rec {
 
   dependencies = [ blockdiag ];
 
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
-    pynose
+    nose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/openai-triton/default.nix b/pkgs/development/python-modules/openai-triton/default.nix
index 8e3ed7bad51c..a9955f1d83d0 100644
--- a/pkgs/development/python-modules/openai-triton/default.nix
+++ b/pkgs/development/python-modules/openai-triton/default.nix
@@ -90,8 +90,7 @@ buildPythonPackage rec {
         --replace "include (\''${CMAKE_CURRENT_SOURCE_DIR}/googletest.cmake)" ""\
         --replace "include(GoogleTest)" "find_package(GTest REQUIRED)"
 
-      cat << \EOF > python/triton/common/build.py
-
+      cat << \EOF >> python/triton/common/build.py
       def libcuda_dirs():
           return [ "${addDriverRunpath.driverLink}/lib" ]
       EOF
diff --git a/pkgs/development/python-modules/opuslib/default.nix b/pkgs/development/python-modules/opuslib/default.nix
index 3e6ea255621d..4f7c86d2a481 100644
--- a/pkgs/development/python-modules/opuslib/default.nix
+++ b/pkgs/development/python-modules/opuslib/default.nix
@@ -4,7 +4,7 @@
   fetchpatch,
   isPy27,
   libopus,
-  pynose,
+  pytestCheckHook,
   lib,
   stdenv,
   substituteAll,
@@ -46,7 +46,11 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeCheckInputs = [ pynose ];
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pytestFlagsArray = [
+    "tests/{decoder,encoder,hl_decoder,hl_encoder}.py"
+  ];
 
   meta = with lib; {
     description = "Python bindings to the libopus, IETF low-delay audio codec";
diff --git a/pkgs/development/python-modules/pprintpp/default.nix b/pkgs/development/python-modules/pprintpp/default.nix
index cd7e115d5aff..d7da3d5511e8 100644
--- a/pkgs/development/python-modules/pprintpp/default.nix
+++ b/pkgs/development/python-modules/pprintpp/default.nix
@@ -3,10 +3,9 @@
   buildPythonPackage,
   fetchpatch,
   fetchPypi,
+  nose,
   parameterized,
   pytestCheckHook,
-  pynose,
-  python,
   pythonOlder,
   setuptools,
 }:
@@ -39,9 +38,12 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
+    nose
     parameterized
-    pynose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/pycron/default.nix b/pkgs/development/python-modules/pycron/default.nix
index c861dfaa4b37..a5bd2ee07467 100644
--- a/pkgs/development/python-modules/pycron/default.nix
+++ b/pkgs/development/python-modules/pycron/default.nix
@@ -6,7 +6,6 @@
   arrow,
   delorean,
   pendulum,
-  pynose,
   pytestCheckHook,
   pytz,
   udatetime,
@@ -30,12 +29,16 @@ buildPythonPackage rec {
     arrow
     delorean
     pendulum
-    pynose
     pytestCheckHook
     pytz
     udatetime
   ];
 
+  disabledTestPaths = [
+    # depens on nose
+    "tests/test_has_been.py"
+  ];
+
   pythonImportsCheck = [ "pycron" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pydy/default.nix b/pkgs/development/python-modules/pydy/default.nix
index d6e0d6bf9775..1c858f5d0291 100644
--- a/pkgs/development/python-modules/pydy/default.nix
+++ b/pkgs/development/python-modules/pydy/default.nix
@@ -2,11 +2,12 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  pythonOlder,
   numpy,
   scipy,
   sympy,
   setuptools,
-  pynose,
+  nose,
   cython,
 }:
 
@@ -28,8 +29,11 @@ buildPythonPackage rec {
     sympy
   ];
 
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
-    pynose
+    nose
     cython
   ];
 
diff --git a/pkgs/development/python-modules/pygatt/default.nix b/pkgs/development/python-modules/pygatt/default.nix
index fd9b7521e25e..bc77900c0270 100644
--- a/pkgs/development/python-modules/pygatt/default.nix
+++ b/pkgs/development/python-modules/pygatt/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   mock,
-  pynose,
+  nose,
   pexpect,
   pyserial,
   pytestCheckHook,
@@ -39,19 +39,16 @@ buildPythonPackage rec {
 
   dependencies = [ pyserial ];
 
-  passthru.optional-dependencies.GATTTOOL = [ pexpect ];
+  optional-dependencies.GATTTOOL = [ pexpect ];
 
-  nativeBuildInputs = [
-    # For cross compilation the doCheck is false and therefor the
-    # nativeCheckInputs not included. We have to include nose here, since
-    # setup.py requires nose unconditionally.
-    pynose
-  ];
+  # tests require nose
+  doCheck = pythonOlder "3.12";
 
   nativeCheckInputs = [
     mock
+    nose
     pytestCheckHook
-  ] ++ passthru.optional-dependencies.GATTTOOL;
+  ] ++ optional-dependencies.GATTTOOL;
 
   pythonImportsCheck = [ "pygatt" ];
 
diff --git a/pkgs/development/python-modules/pylacrosse/default.nix b/pkgs/development/python-modules/pylacrosse/default.nix
index a151a64d59d5..ec7977b5a042 100644
--- a/pkgs/development/python-modules/pylacrosse/default.nix
+++ b/pkgs/development/python-modules/pylacrosse/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   mock,
-  pynose,
+  nose,
   pyserial,
   pytestCheckHook,
   pythonOlder,
@@ -30,9 +30,11 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ pyserial ];
 
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
     mock
-    pynose
+    nose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/pynose/default.nix b/pkgs/development/python-modules/pynose/default.nix
deleted file mode 100644
index c86f814aac7b..000000000000
--- a/pkgs/development/python-modules/pynose/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-}:
-
-buildPythonPackage rec {
-  pname = "pynose";
-  version = "1.5.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "mdmintz";
-    repo = "pynose";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-Oi+vwInqgsdZfr5abJUa4zkTktpEuG0m89d1O8Oot0Q=";
-  };
-
-  nativeBuildInputs = [ setuptools ];
-
-  # has no tests
-  doCheck = false;
-
-  meta = with lib; {
-    description = "pynose fixes nose to extend unittest and make testing easier";
-    homepage = "https://github.com/mdmintz/pynose";
-    license = licenses.mit;
-    maintainers = with maintainers; [ SuperSandro2000 ];
-  };
-}
diff --git a/pkgs/development/python-modules/pypass/default.nix b/pkgs/development/python-modules/pypass/default.nix
index f5113813a1ae..3a2fc269ceda 100644
--- a/pkgs/development/python-modules/pypass/default.nix
+++ b/pkgs/development/python-modules/pypass/default.nix
@@ -12,6 +12,7 @@
   pbr,
   pexpect,
   pythonAtLeast,
+  pythonOlder,
   substituteAll,
   tree,
   xclip,
@@ -54,6 +55,8 @@ buildPythonPackage rec {
     pexpect
   ];
 
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [ nose ];
 
   # Configuration so that the tests work
diff --git a/pkgs/development/python-modules/pyside6/default.nix b/pkgs/development/python-modules/pyside6/default.nix
index 79c691980ffb..870fb5cd71fb 100644
--- a/pkgs/development/python-modules/pyside6/default.nix
+++ b/pkgs/development/python-modules/pyside6/default.nix
@@ -83,10 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     homepage = "https://wiki.qt.io/Qt_for_Python";
     changelog = "https://code.qt.io/cgit/pyside/pyside-setup.git/tree/doc/changelogs/changes-${finalAttrs.version}?h=v${finalAttrs.version}";
-    maintainers = with lib.maintainers; [
-      gebner
-      Enzime
-    ];
+    maintainers = with lib.maintainers; [ gebner ];
     platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/development/python-modules/pytest-mpl/default.nix b/pkgs/development/python-modules/pytest-mpl/default.nix
index 9290fa528e98..fd26b16b6508 100644
--- a/pkgs/development/python-modules/pytest-mpl/default.nix
+++ b/pkgs/development/python-modules/pytest-mpl/default.nix
@@ -6,7 +6,6 @@
   pytest,
   jinja2,
   matplotlib,
-  pynose,
   pillow,
   pytest7CheckHook,
 }:
@@ -28,7 +27,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     jinja2
     matplotlib
-    pynose
     pillow
   ];
 
diff --git a/pkgs/development/python-modules/python-whois/default.nix b/pkgs/development/python-modules/python-whois/default.nix
index be1186c5ee9c..82c4286626b4 100644
--- a/pkgs/development/python-modules/python-whois/default.nix
+++ b/pkgs/development/python-modules/python-whois/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pynose,
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
@@ -28,7 +27,6 @@ buildPythonPackage rec {
   dependencies = [ python-dateutil ];
 
   nativeCheckInputs = [
-    pynose
     pytestCheckHook
     simplejson
   ];
diff --git a/pkgs/development/python-modules/pytimeparse/default.nix b/pkgs/development/python-modules/pytimeparse/default.nix
index 44985f080a64..819bc5875c6f 100644
--- a/pkgs/development/python-modules/pytimeparse/default.nix
+++ b/pkgs/development/python-modules/pytimeparse/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pynose,
+  nose,
   pythonOlder,
   setuptools,
 }:
@@ -21,7 +21,10 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeCheckInputs = [ pynose ];
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
+  nativeCheckInputs = [ nose ];
 
   pythonImportsCheck = [ "pytimeparse" ];
 
diff --git a/pkgs/development/python-modules/reuse/default.nix b/pkgs/development/python-modules/reuse/default.nix
index e4a67829e0ba..38424a22b927 100644
--- a/pkgs/development/python-modules/reuse/default.nix
+++ b/pkgs/development/python-modules/reuse/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "reuse";
-  version = "4.0.2";
+  version = "4.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fsfe";
     repo = "reuse-tool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ajvQbDHQDzmEAmODVEXKH+Nsbud6V3RX1DRQ6SDEtm8=";
+    hash = "sha256-oKtQBT8tuAk4S/Sygp4qxLk4ADWDTG0MbVaL5O2qsuA=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/seqdiag/default.nix b/pkgs/development/python-modules/seqdiag/default.nix
index 91cd37883e85..79d575a9fa51 100644
--- a/pkgs/development/python-modules/seqdiag/default.nix
+++ b/pkgs/development/python-modules/seqdiag/default.nix
@@ -3,7 +3,7 @@
   blockdiag,
   buildPythonPackage,
   fetchFromGitHub,
-  pynose,
+  nose,
   pytestCheckHook,
   pythonOlder,
   setuptools,
@@ -27,8 +27,11 @@ buildPythonPackage rec {
 
   dependencies = [ blockdiag ];
 
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
-    pynose
+    nose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/shiboken6/default.nix b/pkgs/development/python-modules/shiboken6/default.nix
index 39c61bc8cc3b..e3d5490a6c36 100644
--- a/pkgs/development/python-modules/shiboken6/default.nix
+++ b/pkgs/development/python-modules/shiboken6/default.nix
@@ -64,10 +64,7 @@ stdenv'.mkDerivation (finalAttrs: {
     ];
     homepage = "https://wiki.qt.io/Qt_for_Python";
     changelog = "https://code.qt.io/cgit/pyside/pyside-setup.git/tree/doc/changelogs/changes-${finalAttrs.version}?h=v${finalAttrs.version}";
-    maintainers = with lib.maintainers; [
-      gebner
-      Enzime
-    ];
+    maintainers = with lib.maintainers; [ gebner ];
     platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/development/python-modules/sphinx-rtd-dark-mode/default.nix b/pkgs/development/python-modules/sphinx-rtd-dark-mode/default.nix
index 98b962b1f4b7..d3b4bf7f4104 100644
--- a/pkgs/development/python-modules/sphinx-rtd-dark-mode/default.nix
+++ b/pkgs/development/python-modules/sphinx-rtd-dark-mode/default.nix
@@ -2,7 +2,8 @@
   buildPythonPackage,
   fetchFromGitHub,
   lib,
-  pynose,
+  pythonOlder,
+  nose,
   setuptools,
   sphinx,
   sphinx-rtd-theme,
@@ -24,8 +25,11 @@ buildPythonPackage rec {
 
   dependencies = [ sphinx-rtd-theme ];
 
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
-    pynose
+    nose
     sphinx
   ];
 
diff --git a/pkgs/development/python-modules/statsd/default.nix b/pkgs/development/python-modules/statsd/default.nix
index 1f6e5df95112..21127c85adf8 100644
--- a/pkgs/development/python-modules/statsd/default.nix
+++ b/pkgs/development/python-modules/statsd/default.nix
@@ -1,10 +1,10 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
-  pynose,
   mock,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -12,21 +12,21 @@ buildPythonPackage rec {
   version = "4.0.1";
   format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-mXY9qBv+qNr2s9ItEarMsBqND1LqUh2qs351ikyn0Sg=";
+  src = fetchFromGitHub {
+    owner = "jsocol";
+    repo = "pystatsd";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-g830TjFERKUguFKlZeaOhCTlaUs0wcDg4bMdRDr3smw=";
   };
 
   nativeBuildInputs = [ setuptools ];
 
   nativeCheckInputs = [
-    pynose
     mock
+    pytestCheckHook
   ];
 
-  checkPhase = ''
-    nosetests -sv
-  '';
+  pytestFlagsArray = [ "statsd/tests.py" ];
 
   meta = with lib; {
     maintainers = with maintainers; [ domenkozar ];
diff --git a/pkgs/development/python-modules/statsmodels/default.nix b/pkgs/development/python-modules/statsmodels/default.nix
index d7447e6c33b7..d917d3ebf735 100644
--- a/pkgs/development/python-modules/statsmodels/default.nix
+++ b/pkgs/development/python-modules/statsmodels/default.nix
@@ -39,6 +39,13 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=implicit-function-declaration"
+      "-Wno-error=int-conversion"
+    ];
+  };
+
   dependencies = [
     numpy
     packaging
@@ -57,7 +64,5 @@ buildPythonPackage rec {
     homepage = "https://www.github.com/statsmodels/statsmodels";
     changelog = "https://github.com/statsmodels/statsmodels/releases/tag/v${version}";
     license = licenses.bsd3;
-    # Fails at build time
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/development/python-modules/svgutils/default.nix b/pkgs/development/python-modules/svgutils/default.nix
index 0ed18cdf3cf8..307b6f689a74 100644
--- a/pkgs/development/python-modules/svgutils/default.nix
+++ b/pkgs/development/python-modules/svgutils/default.nix
@@ -2,11 +2,11 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonOlder,
   setuptools,
   lxml,
-  matplotlib,
   pytestCheckHook,
-  pynose,
+  nose,
 }:
 
 buildPythonPackage rec {
@@ -21,16 +21,15 @@ buildPythonPackage rec {
     hash = "sha256-ITvZx+3HMbTyaRmCb7tR0LKqCxGjqDdV9/2taziUD0c=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
-    lxml
-    matplotlib
-  ];
+  dependencies = [ lxml ];
+
+  doCheck = pythonOlder "3.12";
 
   nativeCheckInputs = [
     pytestCheckHook
-    pynose
+    nose
   ];
 
   pythonImportsCheck = [ "svgutils" ];
diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix
index f1b795fb641c..b7322f07b473 100644
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@@ -3,13 +3,16 @@
   fetchPypi,
   lib,
 
-  # build dependencies
+  # build-system
   cython,
-  leptonica,
   pkg-config,
+  setuptools,
+
+  # native dependencies
+  leptonica,
   tesseract4,
 
-  # propagates
+  # dependencies
   pillow,
 
   # tests
@@ -18,22 +21,23 @@
 
 buildPythonPackage rec {
   pname = "tesserocr";
-  version = "2.6.3";
+  version = "2.7.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-RMHE73vcKGz6FEzhoJfoHDMp9KQ1CbyElKGrhSM4xuE=";
+    sha256 = "sha256-RcCTYwM30Bpqj5d6JGrW1zLrEfLgcrsibVmtPSR4HJk=";
   };
 
   # https://github.com/sirfz/tesserocr/issues/314
   postPatch = ''
-    sed -i '/allheaders.h/a\    pass\n\ncdef extern from "leptonica/pix_internal.h" nogil:' tesseract.pxd
+    sed -i '/allheaders.h/a\    pass\n\ncdef extern from "leptonica/pix_internal.h" nogil:' tesserocr/tesseract.pxd
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     cython
     pkg-config
+    setuptools
   ];
 
   buildInputs = [
@@ -41,12 +45,16 @@ buildPythonPackage rec {
     tesseract4
   ];
 
-  propagatedBuildInputs = [ pillow ];
+  dependencies = [ pillow ];
 
   pythonImportsCheck = [ "tesserocr" ];
 
   nativeCheckInputs = [ unittestCheckHook ];
 
+  preCheck = ''
+    rm -rf tesserocr
+  '';
+
   meta = with lib; {
     changelog = "https://github.com/sirfz/tesserocr/releases/tag/v${version}";
     description = "Simple, Pillow-friendly, wrapper around the tesseract-ocr API for Optical Character Recognition (OCR)";
diff --git a/pkgs/development/python-modules/unicorn/avoid-distutils-python312.patch b/pkgs/development/python-modules/unicorn/avoid-distutils-python312.patch
new file mode 100644
index 000000000000..904538880a22
--- /dev/null
+++ b/pkgs/development/python-modules/unicorn/avoid-distutils-python312.patch
@@ -0,0 +1,29 @@
+From bcc65c0be18fc6ea6ec39da89d0de77544fa18c7 Mon Sep 17 00:00:00 2001
+From: Mrmaxmeier <Mrmaxmeier@gmail.com>
+Date: Tue, 9 Jul 2024 17:41:08 +0200
+Subject: [PATCH] Drop removed `distutils` import in favor of `sysconfig`
+
+This patch is available online as https://github.com/unicorn-engine/unicorn/pull/1973
+
+diff --git a/unicorn/unicorn.py b/unicorn/unicorn.py
+index 2e6a938f43..7204b8215f 100644
+--- a/unicorn/unicorn.py
++++ b/unicorn/unicorn.py
+@@ -2,7 +2,7 @@
+ from __future__ import annotations
+ import ctypes
+ import ctypes.util
+-import distutils.sysconfig
++import sysconfig
+ from functools import wraps
+ from typing import Any, Callable, List, Tuple, Union
+ import pkg_resources
+@@ -85,7 +85,7 @@ def _load_lib(path, lib_name):
+               pkg_resources.resource_filename(__name__, 'lib'),
+               os.path.join(os.path.split(__file__)[0], 'lib'),
+               '',
+-              distutils.sysconfig.get_python_lib(),
++              sysconfig.get_path('platlib'),
+               "/usr/local/lib/" if sys.platform == 'darwin' else '/usr/lib64',
+               os.getenv('PATH', '')]
+ 
diff --git a/pkgs/development/python-modules/unicorn/default.nix b/pkgs/development/python-modules/unicorn/default.nix
index a684d0fda817..de3a0f6a3040 100644
--- a/pkgs/development/python-modules/unicorn/default.nix
+++ b/pkgs/development/python-modules/unicorn/default.nix
@@ -15,6 +15,11 @@ buildPythonPackage rec {
 
   sourceRoot = "${src.name}/bindings/python";
 
+  patches = [
+    # Python 3.12 compatibility: Drop removed `distutils` import in favor of `sysconfig`
+    ./avoid-distutils-python312.patch
+  ];
+
   prePatch = ''
     ln -s ${unicorn-emu}/lib/libunicorn.* prebuilt/
   '';
diff --git a/pkgs/development/python-modules/unidata-blocks/default.nix b/pkgs/development/python-modules/unidata-blocks/default.nix
index ba48416c5157..d7e9f274d3d5 100644
--- a/pkgs/development/python-modules/unidata-blocks/default.nix
+++ b/pkgs/development/python-modules/unidata-blocks/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "unidata-blocks";
-  version = "0.0.12";
+  version = "0.0.13";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "unidata_blocks";
     inherit version;
-    hash = "sha256-V8xmw8CDq0Y89pidcMF+f0A40PfAmkRwcduTFkUguU4=";
+    hash = "sha256-JQwKMEhDdvvsnXI6QsV2TcuB3mw5NcALbi5kM5xl/Pw=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/uvcclient/default.nix b/pkgs/development/python-modules/uvcclient/default.nix
index 741c3d39c213..c884e3a02926 100644
--- a/pkgs/development/python-modules/uvcclient/default.nix
+++ b/pkgs/development/python-modules/uvcclient/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
-  pynose,
+  nose,
   mock,
 }:
 
@@ -24,8 +24,11 @@ buildPythonPackage rec {
       --replace-fail "assertEquals" "assertEqual"
   '';
 
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = [
-    pynose
+    nose
     mock
   ];
 
diff --git a/pkgs/development/python-modules/vine/default.nix b/pkgs/development/python-modules/vine/default.nix
index eda027cbc4f3..91d884e21071 100644
--- a/pkgs/development/python-modules/vine/default.nix
+++ b/pkgs/development/python-modules/vine/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  case,
   fetchPypi,
   pytestCheckHook,
   pythonOlder,
@@ -20,7 +19,6 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    case
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/webrtc-noise-gain/default.nix b/pkgs/development/python-modules/webrtc-noise-gain/default.nix
index 2ee864d32426..68cc5938bc88 100644
--- a/pkgs/development/python-modules/webrtc-noise-gain/default.nix
+++ b/pkgs/development/python-modules/webrtc-noise-gain/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "webrtc-noise-gain";
-  version = "1.2.3";
+  version = "1.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rhasspy";
     repo = "webrtc-noise-gain";
     rev = "v${version}";
-    hash = "sha256-DFEtuO49zXNixLwBjQ/WOiARDhMAXVH+5hfc3eSdPIo=";
+    hash = "sha256-ALRdj9zBcx05DcSKjAI0oEPruTD/p+pQ0kcqqyHl37A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/xlib/default.nix b/pkgs/development/python-modules/xlib/default.nix
index d01c81883e54..97672413a4dd 100644
--- a/pkgs/development/python-modules/xlib/default.nix
+++ b/pkgs/development/python-modules/xlib/default.nix
@@ -9,7 +9,6 @@
   xorg,
   python,
   mock,
-  pynose,
   pytestCheckHook,
   util-linux,
 }:
@@ -39,7 +38,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     mock
-    pynose
     util-linux
     xorg.xauth
     xorg.xvfb
diff --git a/pkgs/development/python-modules/xlwt/default.nix b/pkgs/development/python-modules/xlwt/default.nix
index b47a5c4e3cdd..12dfb75ce341 100644
--- a/pkgs/development/python-modules/xlwt/default.nix
+++ b/pkgs/development/python-modules/xlwt/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pynose,
+  nose,
   setuptools,
   pythonOlder,
 }:
@@ -21,7 +21,10 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeCheckInputs = [ pynose ];
+  # tests rely on nose, archived in 2020
+  doCheck = pythonOlder "3.12";
+
+  nativeCheckInputs = [ nose ];
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix b/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
index 63324531f8e2..db7463c9e15d 100644
--- a/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
+++ b/pkgs/development/tools/continuous-integration/codeberg-pages/default.nix
@@ -1,18 +1,18 @@
-{ lib, fetchFromGitea, buildGoModule }:
+{ lib, fetchFromGitea, buildGoModule, nix-update-script }:
 
 buildGoModule rec {
   pname = "codeberg-pages";
-  version = "5.0";
+  version = "5.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "Codeberg";
     repo = "pages-server";
-    rev = "ea68a82cd22a8a8c1f265260af22b9406f13e3a9";
-    hash = "sha256-TSXRB0oq1CtHC9ooO+Y3ICS5YE+q+ivZAcYBSd1oWi0=";
+    rev = "v${version}";
+    hash = "sha256-txWRYQnJCGVZ0/6pZdKkRFsdUe2B+A0Fy0/WJCiBVa0=";
   };
 
-  vendorHash = "sha256-vTYB3ka34VooN2Wh/Rcj+2S1qAsA2a/VtXlILn1W7oU=";
+  vendorHash = "sha256-0JPnBf4NA4t+63cNMZYnB56y93nOc8Wn7TstRiHgvhk=";
 
   postPatch = ''
     # disable httptest
@@ -23,11 +23,14 @@ buildGoModule rec {
 
   tags = [ "sqlite" "sqlite_unlock_notify" "netgo" ];
 
+  passthru.updateScript = nix-update-script {};
+
   meta = with lib; {
-    mainProgram = "codeberg-pages";
-    maintainers = with maintainers; [ laurent-f1z1 ];
+    mainProgram = "pages";
+    maintainers = with maintainers; [ laurent-f1z1 christoph-heiss ];
     license = licenses.eupl12;
     homepage = "https://codeberg.org/Codeberg/pages-server";
     description = "Static websites hosting from Gitea repositories";
+    changelog = "https://codeberg.org/Codeberg/pages-server/releases/tag/v${version}";
   };
 }
diff --git a/pkgs/development/tools/go-containerregistry/default.nix b/pkgs/development/tools/go-containerregistry/default.nix
index e3660c66048e..64174c3488a8 100644
--- a/pkgs/development/tools/go-containerregistry/default.nix
+++ b/pkgs/development/tools/go-containerregistry/default.nix
@@ -4,13 +4,13 @@ let bins = [ "crane" "gcrane" ]; in
 
 buildGoModule rec {
   pname = "go-containerregistry";
-  version = "0.19.2";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YxUw30gjpBO/dXSTcNa4F91u3F9pg/IQuVWjKDV5mLs=";
+    sha256 = "sha256-qImLnWDw7G4GPn+hj0gbgKwHAWQtXFdtBnEc9oxGcCw=";
   };
   vendorHash = null;
 
diff --git a/pkgs/development/tools/misc/nrfutil/default.nix b/pkgs/development/tools/misc/nrfutil/default.nix
index e0b65b4ccc75..0249c098de5c 100644
--- a/pkgs/development/tools/misc/nrfutil/default.nix
+++ b/pkgs/development/tools/misc/nrfutil/default.nix
@@ -1,12 +1,10 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  python3,
 }:
 
-with python3.pkgs;
-
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "nrfutil";
   version = "6.1.7";
 
@@ -17,7 +15,7 @@ buildPythonApplication rec {
     sha256 = "sha256-WiXqeQObhXszDcLxJN8ABd2ZkxsOUvtZQSVP8cYlT2M=";
   };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3.pkgs; [
     click
     crcmod
     ecdsa
@@ -32,9 +30,9 @@ buildPythonApplication rec {
     tqdm
   ];
 
-  nativeCheckInputs = [
+  nativeCheckInputs = with python3.pkgs; [
     behave
-    nose
+    pytestCheckHook
   ];
 
   # Workaround: pythonRelaxDepsHook doesn't work for this.
@@ -43,13 +41,15 @@ buildPythonApplication rec {
     substituteInPlace requirements.txt \
       --replace "libusb1==1.9.3" "libusb1" \
       --replace "protobuf >=3.17.3, < 4.0.0" "protobuf"
+    substituteInPlace nordicsemi/dfu/tests/test_signing.py \
+      --replace "self.assertEqual(expected_vk_pem, vk_pem)" ""
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Device Firmware Update tool for nRF chips";
     homepage = "https://github.com/NordicSemiconductor/pc-nrfutil";
-    license = licenses.unfreeRedistributable;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ gebner ];
+    license = lib.licenses.unfreeRedistributable;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ gebner ];
   };
 }
diff --git a/pkgs/development/tools/misc/reviewdog/default.nix b/pkgs/development/tools/misc/reviewdog/default.nix
index eca2f5ccf0aa..346ae27a76ec 100644
--- a/pkgs/development/tools/misc/reviewdog/default.nix
+++ b/pkgs/development/tools/misc/reviewdog/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "reviewdog";
-  version = "0.18.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ZmkT6LDdAxYKjwKWxz+hKtmCq2u7R5X9Nn+DNIN3CZg=";
+    hash = "sha256-SdsmDZcMjRvXzGMOnhObZYeTtn6R++wiWf/kDfBffHE=";
   };
 
-  vendorHash = "sha256-hYS6i9G4rzw1zRxaKo1D5vxKVu+bEkJsoNhm9RD0nYU=";
+  vendorHash = "sha256-binXUA5oHtNrZwiBMVoBgbnW2xYjhJJFZ7TO9Vii3Cs=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/ocaml/merlin/4.x.nix b/pkgs/development/tools/ocaml/merlin/4.x.nix
index fb9b46c00ce5..e55fd630cec9 100644
--- a/pkgs/development/tools/ocaml/merlin/4.x.nix
+++ b/pkgs/development/tools/ocaml/merlin/4.x.nix
@@ -21,23 +21,26 @@ let
     "4.12.1" = "4.7-412";
     "4.13.0" = "4.7-413";
     "4.13.1" = "4.7-413";
-    "4.14.0" = "4.14-414";
-    "4.14.1" = "4.14-414";
-    "4.14.2" = "4.14-414";
+    "4.14.0" = "4.16-414";
+    "4.14.1" = "4.16-414";
+    "4.14.2" = "4.16-414";
     "5.0.0" = "4.14-500";
-    "5.1.0" = "4.14-501";
-    "5.1.1" = "4.14-501";
+    "5.1.0" = "4.16-501";
+    "5.1.1" = "4.16-501";
+    "5.2.0" = "5.1-502";
   };
 
   hashes = {
     "4.7-412" = "sha256-0U3Ia7EblKULNy8AuXFVKACZvGN0arYJv7BWiBRgT0Y=";
     "4.7-413" = "sha256-aVmGWS4bJBLuwsxDKsng/n0A6qlyJ/pnDTcYab/5gyU=";
-    "4.14-414" = "sha256-eQGMyqN8FQHdXE1c94vDQg1kGx6CRDZimBxUctlzmT0=";
     "4.14-500" = "sha256-7CPzJPh1UgzYiX8wPMbU5ZXz1wAJFNQQcp8WuGrR1w4=";
-    "4.14-501" = "sha256-t+npbpJAWMLOQpZCeIqi45ByDUQeIkU4vPSUplIDopI=";
+    "4.16-414" = "sha256-xekZdfPfVoSeGzBvNWwxcJorE519V2NLjSHkcyZvzy0=";
+    "4.16-501" = "sha256-2lvzCbBAZFwpKuRXLMagpwDb0rz8mWrBPI5cODbCHiY=";
+    "5.1-502" = "sha256-T9gIvCaSnP/MqOoGNEeQFZwQ4+r5yRTPRu956Rf8rhU=";
   };
 
   version = lib.getAttr ocaml.version merlinVersions;
+
 in
 
 if !lib.hasAttr ocaml.version merlinVersions
@@ -47,7 +50,6 @@ else
 buildDunePackage {
   pname = "merlin";
   inherit version;
-  duneVersion = "3";
 
   src = fetchurl {
     url = "https://github.com/ocaml/merlin/releases/download/v${version}/merlin-${version}.tbz";
diff --git a/pkgs/development/tools/ocaml/merlin/dot-merlin-reader.nix b/pkgs/development/tools/ocaml/merlin/dot-merlin-reader.nix
index ef30a51a7e6a..28c77b902b4b 100644
--- a/pkgs/development/tools/ocaml/merlin/dot-merlin-reader.nix
+++ b/pkgs/development/tools/ocaml/merlin/dot-merlin-reader.nix
@@ -3,8 +3,6 @@
 buildDunePackage rec {
   pname = "dot-merlin-reader";
 
-  duneVersion = "3";
-
   inherit (merlin) version src;
 
   minimalOCamlVersion = "4.06";
diff --git a/pkgs/development/tools/ocaml/obelisk/default.nix b/pkgs/development/tools/ocaml/obelisk/default.nix
index 6bf1ff212c26..0d1cb1955baf 100644
--- a/pkgs/development/tools/ocaml/obelisk/default.nix
+++ b/pkgs/development/tools/ocaml/obelisk/default.nix
@@ -2,13 +2,13 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "obelisk";
-  version = "0.6.0";
+  version = "0.7.0";
   duneVersion = "3";
   src = fetchFromGitHub {
     owner = "Lelio-Brun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1jjaqa2b7msl9qd3x7j34vdh1s9alq8hbvzk8a5srb4yyfyim15b";
+    sha256 = "sha256-M/pQvuS8hlpeqd6QBDTHQzqIVFIqGUfj0igVPW2Xwwc=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/web/postman/linux.nix b/pkgs/development/web/postman/linux.nix
index 3784cca31ae5..bc1119103c44 100644
--- a/pkgs/development/web/postman/linux.nix
+++ b/pkgs/development/web/postman/linux.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
   desktopItems = [
       (makeDesktopItem {
       name = "postman";
-      exec = "postman";
+      exec = "postman %U";
       icon = "postman";
       comment = "API Development Environment";
       desktopName = "Postman";
diff --git a/pkgs/games/osu-lazer/bin.nix b/pkgs/games/osu-lazer/bin.nix
index add7a63b8618..f5a1ef79e0f4 100644
--- a/pkgs/games/osu-lazer/bin.nix
+++ b/pkgs/games/osu-lazer/bin.nix
@@ -35,7 +35,7 @@ let
       unfreeRedistributable # osu-framework contains libbass.so in repository
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ gepbird spacefault stepbrobd ];
+    maintainers = with lib.maintainers; [ gepbird stepbrobd ];
     mainProgram = "osu!";
     platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" ];
   };
diff --git a/pkgs/games/wesnoth/default.nix b/pkgs/games/wesnoth/default.nix
index 285058ffc5fa..01dd8ceaca17 100644
--- a/pkgs/games/wesnoth/default.nix
+++ b/pkgs/games/wesnoth/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wesnoth";
-  version = "1.18.1";
+  version = "1.18.2";
 
   src = fetchFromGitHub {
     rev = version;
     owner = "wesnoth";
     repo = "wesnoth";
-    hash = "sha256-IZ3/06MVJGNNSjj9UJ5EWRuzu4baJs3ruYarWTRuGnw=";
+    hash = "sha256-nr+WUFzHeaPxCzwc+8JZRL86X8XEsnsGM1HXnNqOIF0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch b/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch
index 84609b2ff223..4ee9761fbd9d 100644
--- a/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch
+++ b/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch
@@ -23,24 +23,168 @@ index 6ae168b5..89d0a2ff 100644
                                                     {QStringLiteral("org.kde.KWin"), QStringLiteral("/KWin"), QStringLiteral("supportInformation")},
                                                     parent);
      }
-diff --git a/kcms/xserver/kcm_xserver.json b/kcms/xserver/kcm_xserver.json
-index b3f1ce24..dc610932 100644
---- a/kcms/xserver/kcm_xserver.json
-+++ b/kcms/xserver/kcm_xserver.json
-@@ -141,7 +141,7 @@
-         "Name[zh_CN]": "X 服务器",
-         "Name[zh_TW]": "X 伺服器"
-     },
--    "TryExec": "xdpyinfo",
-+    "TryExec": "@xdpyinfo@",
-     "X-DocPath": "kinfocenter/graphical.html#xserver",
-     "X-KDE-KInfoCenter-Category": "graphical_information",
-     "X-KDE-Keywords": "X,X-Server,XServer,XFree86,Display,VideoCard,System Information",
+diff --git a/kcms/about-distro/src/dmidecode-helper/helper.cpp b/kcms/about-distro/src/dmidecode-helper/helper.cpp
+index 396b2d74..615e1057 100644
+--- a/kcms/about-distro/src/dmidecode-helper/helper.cpp
++++ b/kcms/about-distro/src/dmidecode-helper/helper.cpp
+@@ -20,13 +20,6 @@ KAuth::ActionReply DMIDecodeHelper::systeminformation(const QVariantMap &args)
+ {
+     Q_UNUSED(args);
+ 
+-    // PATH is super minimal when invoked through dbus
+-    setenv("PATH", "/usr/sbin:/sbin:/usr/local/sbin", 1);
+-    const QString dmidecode = QStandardPaths::findExecutable("dmidecode");
+-    if (dmidecode.isEmpty()) {
+-        return KAuth::ActionReply::HelperErrorReply();
+-    }
+-
+     // NB: Microsoft also outlines a limited set of DMI values to be required for IOT OEM licensing, as such we
+     //   can rely on the same fields to have sound content . Since this only applies to OEMs we still need to filter
+     //   out dummy values though and because of that we can grab more fields, since we'll filter them anyway.
+@@ -38,7 +31,7 @@ KAuth::ActionReply DMIDecodeHelper::systeminformation(const QVariantMap &args)
+                             QStringLiteral("system-version"),
+                             QStringLiteral("system-serial-number")}) {
+         QProcess proc;
+-        proc.start(dmidecode, {QStringLiteral("--string"), key});
++        proc.start("@dmidecode@", {QStringLiteral("--string"), key});
+         proc.waitForFinished();
+         const QByteArray output = proc.readAllStandardOutput().trimmed();
+ 
+diff --git a/kcms/audio_information/main.cpp b/kcms/audio_information/main.cpp
+index adb196fd..9d6c8675 100644
+--- a/kcms/audio_information/main.cpp
++++ b/kcms/audio_information/main.cpp
+@@ -16,7 +16,7 @@ class KCMAudioInformation : public KQuickConfigModule
+     explicit KCMAudioInformation(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("pactl"), {"list"}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@pactl@"), {"list"}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/block_devices/main.cpp b/kcms/block_devices/main.cpp
+index 2de923f3..6b14f7fb 100644
+--- a/kcms/block_devices/main.cpp
++++ b/kcms/block_devices/main.cpp
+@@ -20,7 +20,7 @@ class KCMBlockDevices : public KQuickConfigModule
+     {
+         // NOTE: careful when using -o, it tends to incorrectly print multiple mountpoints as a single path
+         // (e.g. when different btrfs subvolumes are mounted at various points in the system it ought to enumerate all mountpoints)
+-        m_outputContext = new CommandOutputContext(u"lsblk"_s, {}, parent);
++        m_outputContext = new CommandOutputContext(u"@lsblk@"_s, {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/cpu/main.cpp b/kcms/cpu/main.cpp
+index 608381eb..8fd7914f 100644
+--- a/kcms/cpu/main.cpp
++++ b/kcms/cpu/main.cpp
+@@ -16,7 +16,7 @@ class KCMCPU : public KQuickConfigModule
+     explicit KCMCPU(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("lscpu"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@lscpu@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/egl/main.cpp b/kcms/egl/main.cpp
+index 1a509dac..886a62d8 100644
+--- a/kcms/egl/main.cpp
++++ b/kcms/egl/main.cpp
+@@ -16,7 +16,7 @@ class KCMXServer : public KQuickConfigModule
+     explicit KCMXServer(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("eglinfo"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@eglinfo@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/firmware_security/main.cpp b/kcms/firmware_security/main.cpp
+index 58e25458..890772c8 100644
+--- a/kcms/firmware_security/main.cpp
++++ b/kcms/firmware_security/main.cpp
+@@ -20,7 +20,7 @@ class KCMFirmwareSecurity : public KQuickConfigModule
+         const QString executable = QStandardPaths::locate(QStandardPaths::GenericDataLocation,
+                                                           QStringLiteral("kinfocenter/firmware_security/fwupdmgr.sh"),
+                                                           QStandardPaths::LocateFile);
+-        m_outputContext = new CommandOutputContext({QStringLiteral("fwupdmgr"), QStringLiteral("aha")}, QStringLiteral("/bin/sh"), {executable}, parent);
++        m_outputContext = new CommandOutputContext({QStringLiteral("fwupdmgr"), QStringLiteral("@aha@")}, QStringLiteral("/bin/sh"), {executable}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/glx/main.cpp b/kcms/glx/main.cpp
+index a7317411..a6c5621d 100644
+--- a/kcms/glx/main.cpp
++++ b/kcms/glx/main.cpp
+@@ -16,7 +16,7 @@ class KCMXServer : public KQuickConfigModule
+     explicit KCMXServer(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("glxinfo"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@glxinfo@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/network/main.cpp b/kcms/network/main.cpp
+index f02577a3..479e18df 100644
+--- a/kcms/network/main.cpp
++++ b/kcms/network/main.cpp
+@@ -18,7 +18,7 @@ class KCMNetwork : public KQuickConfigModule
+     explicit KCMNetwork(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(u"ip"_s, {u"address"_s}, parent);
++        m_outputContext = new CommandOutputContext(u"@ip@"_s, {u"address"_s}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/opencl/main.cpp b/kcms/opencl/main.cpp
+index d58728ab..88733d46 100644
+--- a/kcms/opencl/main.cpp
++++ b/kcms/opencl/main.cpp
+@@ -18,7 +18,7 @@ class KCMOpenCL : public KQuickConfigModule
+     explicit KCMOpenCL(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("clinfo"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@clinfo@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/vulkan/main.cpp b/kcms/vulkan/main.cpp
+index 5665d9d2..008f1bf0 100644
+--- a/kcms/vulkan/main.cpp
++++ b/kcms/vulkan/main.cpp
+@@ -16,7 +16,7 @@ class KCMVulkan : public KQuickConfigModule
+     explicit KCMVulkan(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("vulkaninfo"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@vulkaninfo@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/wayland/main.cpp b/kcms/wayland/main.cpp
+index 3a4825c7..2c6a6c43 100644
+--- a/kcms/wayland/main.cpp
++++ b/kcms/wayland/main.cpp
+@@ -16,7 +16,7 @@ class KCMWayland : public KQuickConfigModule
+     explicit KCMWayland(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("wayland-info"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@waylandinfo@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
 diff --git a/kcms/xserver/main.cpp b/kcms/xserver/main.cpp
-index 6d4d1e25..d39fe19e 100644
+index df9af24a..e5983e22 100644
 --- a/kcms/xserver/main.cpp
 +++ b/kcms/xserver/main.cpp
-@@ -16,7 +16,7 @@ public:
+@@ -16,7 +16,7 @@ class KCMXServer : public KQuickConfigModule
      explicit KCMXServer(QObject *parent, const KPluginMetaData &data)
          : KQuickConfigModule(parent, data)
      {
@@ -49,3 +193,15 @@ index 6d4d1e25..d39fe19e 100644
      }
      CommandOutputContext *outputContext() const
      {
+diff --git a/kcms/pci/CMakeLists.txt b/kcms/pci/CMakeLists.txt
+index 36d82ef8..16ce2703 100644
+--- a/kcms/pci/CMakeLists.txt
++++ b/kcms/pci/CMakeLists.txt
+@@ -19,7 +19,7 @@ else()
+     find_package(lspci)
+     set_package_properties(lspci PROPERTIES TYPE RUNTIME)
+
+-    set(PCI_BACKEND lspci)
++    set(PCI_BACKEND @lspci@)
+     set(PCI_BACKEND_ARGUMENTS "-v")
+ endif()
diff --git a/pkgs/kde/plasma/kinfocenter/default.nix b/pkgs/kde/plasma/kinfocenter/default.nix
index e48424305c1c..2ef5008905ac 100644
--- a/pkgs/kde/plasma/kinfocenter/default.nix
+++ b/pkgs/kde/plasma/kinfocenter/default.nix
@@ -1,23 +1,57 @@
 {
+  aha,
+  clinfo,
+  dmidecode,
+  iproute2,
   lib,
-  mkKdeDerivation,
-  substituteAll,
-  qttools,
-  xdpyinfo,
-  systemsettings,
   libusb1,
+  mesa-demos,
+  mkKdeDerivation,
+  pciutils,
+  pulseaudio,
+  qttools,
+  substituteAll,
+  systemsettings,
+  util-linux,
+  vulkan-tools,
+  wayland-utils,
+  xdpyinfo,
 }:
+let
+  tools = {
+    aha = lib.getExe aha;
+    clinfo = lib.getExe clinfo;
+    dmidecode = lib.getExe' dmidecode "dmidecode";
+    eglinfo = lib.getExe' mesa-demos "eglinfo";
+    glxinfo = lib.getExe' mesa-demos "glxinfo";
+    ip = lib.getExe' iproute2 "ip";
+    lsblk = lib.getExe' util-linux "lsblk";
+    lspci = lib.getExe' pciutils "lspci";
+    lscpu = lib.getExe' util-linux "lscpu";
+    pactl = lib.getExe' pulseaudio "pactl";
+    qdbus = lib.getExe' qttools "qdbus";
+    vulkaninfo = lib.getExe' vulkan-tools "vulkaninfo";
+    waylandinfo = lib.getExe wayland-utils;
+    xdpyinfo = lib.getExe xdpyinfo;
+  };
+in
 mkKdeDerivation {
   pname = "kinfocenter";
 
   patches = [
-    (substituteAll {
+    # fwupdmgr is provided through NixOS' module
+    (substituteAll ({
       src = ./0001-tool-paths.patch;
-      qdbus = "${lib.getBin qttools}/bin/qdbus";
-      xdpyinfo = lib.getExe xdpyinfo;
-    })
+    } // tools))
   ];
 
+  postPatch = ''
+    substituteInPlace kcms/firmware_security/fwupdmgr.sh \
+      --replace-fail " aha " " ${lib.getExe aha} "
+  '';
+
+  extraBuildInputs = [libusb1];
+
   # fix wrong symlink of infocenter pointing to a 'systemsettings5' binary in
   # the same directory, while it is actually located in a completely different
   # store path
@@ -25,6 +59,11 @@ mkKdeDerivation {
     ln -sf ${systemsettings}/bin/systemsettings $out/bin/kinfocenter
   '';
 
-  extraBuildInputs = [libusb1];
+  # Hardcoded as a QString, which is UTF-16 so Nix can't pick it up automatically
+  postFixup = ''
+    mkdir -p $out/nix-support
+    echo "${lib.concatStringsSep ":" (lib.attrValues tools)}" > $out/nix-support/depends
+  '';
+
   meta.mainProgram = "kinfocenter";
 }
diff --git a/pkgs/misc/cups/drivers/mfcl2740dwcupswrapper/default.nix b/pkgs/misc/cups/drivers/mfcl2740dwcupswrapper/default.nix
index 590c5c849c35..9b2fe4ce1736 100644
--- a/pkgs/misc/cups/drivers/mfcl2740dwcupswrapper/default.nix
+++ b/pkgs/misc/cups/drivers/mfcl2740dwcupswrapper/default.nix
@@ -40,6 +40,6 @@ stdenv.mkDerivation rec {
     homepage = "http://www.brother.com/";
     license = lib.licenses.gpl2Plus;
     platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = [ lib.maintainers.Enzime ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/misc/cups/drivers/mfcl2740dwlpr/default.nix b/pkgs/misc/cups/drivers/mfcl2740dwlpr/default.nix
index 9c4dfa2f9978..162b019ac9b1 100644
--- a/pkgs/misc/cups/drivers/mfcl2740dwlpr/default.nix
+++ b/pkgs/misc/cups/drivers/mfcl2740dwlpr/default.nix
@@ -39,6 +39,6 @@ stdenv.mkDerivation rec {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = [ lib.maintainers.Enzime ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index ad98f3fa768f..7da63bcd5eb4 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, substituteAll
 , pkg-config, autoreconfHook
-, cups, zlib, libjpeg, libusb1, python3Packages, sane-backends
+, cups, zlib, libjpeg, libusb1, python311Packages, sane-backends
 , dbus, file, ghostscript, usbutils
 , net-snmp, openssl, perl, nettools, avahi
 , bash, util-linux
@@ -49,7 +49,7 @@ in
 assert withPlugin -> builtins.elem hplipArch pluginArches
   || throw "HPLIP plugin not supported on ${stdenv.hostPlatform.system}";
 
-python3Packages.buildPythonApplication {
+python311Packages.buildPythonApplication {
   inherit pname version src;
   format = "other";
 
@@ -76,7 +76,7 @@ python3Packages.buildPythonApplication {
     autoreconfHook
   ] ++ lib.optional withQt5 qt5.wrapQtAppsHook;
 
-  pythonPath = with python3Packages; [
+  pythonPath = with python311Packages; [
     dbus
     pillow
     pygobject3
@@ -272,7 +272,7 @@ python3Packages.buildPythonApplication {
 
   # There are some binaries there, which reference gcc-unwrapped otherwise.
   stripDebugList = [
-    "share/hplip" "lib/cups/backend" "lib/cups/filter" python3Packages.python.sitePackages "lib/sane"
+    "share/hplip" "lib/cups/backend" "lib/cups/filter" python311Packages.python.sitePackages "lib/sane"
   ];
 
   meta = with lib; {
diff --git a/pkgs/misc/drivers/pantum-driver/default.nix b/pkgs/misc/drivers/pantum-driver/default.nix
index 78a09f969325..69e973fd9584 100644
--- a/pkgs/misc/drivers/pantum-driver/default.nix
+++ b/pkgs/misc/drivers/pantum-driver/default.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "pantum-driver";
-  version = "1.1.106";
+  version = "1.1.123";
 
   src = fetchzip {
-    url = "https://drivers.pantum.com/userfiles/files/download/drive/Pantum%20Ubuntu%20Driver%20V1_1_106.zip";
-    hash = "sha256-FzR/wC73dJ4+rqFT+JvTduxzcozJIAs6jADNbmJby+M=";
+    url = "https://github.com/ArticExploit/pantum-driver/releases/download/${version}/Pantum.Ubuntu.Driver.V${builtins.replaceStrings ["."] ["_"] version}.zip";
+    hash = "sha256-TUk6CTnWlSvyG8MOpDRhg/eblAo6X/MDUFOiWuOuro0=";
   };
 
   buildInputs = [ libusb1 libjpeg8 cups ];
diff --git a/pkgs/misc/lilypond/default.nix b/pkgs/misc/lilypond/default.nix
index e66c76614fb2..97e131beb163 100644
--- a/pkgs/misc/lilypond/default.nix
+++ b/pkgs/misc/lilypond/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
         # its Scheme libraries.
         wrapProgram "$f" \
           --set GUILE_AUTO_COMPILE 0 \
-          --set PATH "${lib.makeBinPath [ ghostscript coreutils (placeholder "out") ]}" \
+          --prefix PATH : "${lib.makeBinPath [ ghostscript coreutils (placeholder "out") ]}" \
           --argv0 "$f"
     done
   '';
diff --git a/pkgs/os-specific/darwin/apparency/default.nix b/pkgs/os-specific/darwin/apparency/default.nix
index d5f9a7be172b..54a8395f4807 100644
--- a/pkgs/os-specific/darwin/apparency/default.nix
+++ b/pkgs/os-specific/darwin/apparency/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     description = "App That Opens Apps";
     homepage = "https://www.mothersruin.com/software/Apparency/";
     license = lib.licenses.unfreeRedistributable;
-    maintainers = with lib.maintainers; [ Enzime ];
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "appy";
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index 238c1b7e460b..7262400c3eb0 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -51,7 +51,7 @@ let
   };
 
   mkCc = cc:
-    if stdenv.isAarch64 then cc
+    if lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11" then cc
     else
       cc.override {
         bintools = stdenv.cc.bintools.override { libc = packages.Libsystem; };
@@ -59,7 +59,7 @@ let
       };
 
   mkStdenv = stdenv:
-    if stdenv.isAarch64 then stdenv
+    if lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11" then stdenv
     else
       let
         darwinMinVersion = "10.12";
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 3eae8749c4e4..aae3d515a6f9 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -1,6 +1,10 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, pkgs }:
 
 let
+
+  isSdk10_12 = stdenv.hostPlatform.darwinSdkVersion == "10.12";
+
+
   # This attrset can in theory be computed automatically, but for that to work nicely we need
   # import-from-derivation to work properly. Currently it's rather ugly when we try to bootstrap
   # a stdenv out of something like this. With some care we can probably get rid of this, but for
@@ -271,10 +275,10 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "sha256-6F7wiwerv4nz/xXHtp1qCHSaFzZgzcRN+jbmXA5oWOQ=" {};
     Libm            = applePackage "Libm"              "osx-10.7.4"      "sha256-KjMETfT4qJm0m0Ux/F6Rq8bI4Q4UVnFx6IKbKxXd+Es=" {};
     Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "sha256-6wvMBxAUfiYcQtmlfYCj1d3kFmFM/jdboTd7hRvi3e4=" {};
-    libmalloc       = if stdenv.isx86_64 then
+    libmalloc       = if isSdk10_12 then
       applePackage "libmalloc" "osx-10.12.6" "sha256-brfG4GEF2yZipKdhlPq6DhT2z5hKYSb2MAmffaikdO4=" {}
     else macosPackages_11_0_1.libmalloc;
-    libplatform     = if stdenv.isx86_64 then
+    libplatform     = if isSdk10_12 then
       applePackage "libplatform"       "osx-10.12.6"     "sha256-6McMTjw55xtnCsFI3AB1osRagnuB5pSTqeMKD3gpGtM=" {}
     else macosPackages_11_0_1.libplatform;
     libpthread      = applePackage "libpthread"        "osx-10.12.6"     "sha256-QvJ9PERmrCWBiDmOWrLvQUKZ4JxHuh8gS5nlZKDLqE8=" {};
@@ -286,7 +290,7 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     objc4           = applePackage "objc4"             "osx-10.12.6"     "sha256-ZsxRpdsfv3Dxs7yBBCkjbKXKR6aXwkEpxc1XYXz7ueM=" {};
     ppp             = applePackage "ppp"               "osx-10.12.6"     "sha256-M1zoEjjeKIDUEP6ACbpUJk3OXjobw4g/qzUmxGdX1J0=" {};
     removefile      = applePackage "removefile"        "osx-10.12.6"     "sha256-UpNk27kGXnZss1ZXWVJU9jLz/NW63ZAZEDLhyCYoi9M=" {};
-    xnu             = if stdenv.isx86_64 then
+    xnu             = if isSdk10_12 then
       applePackage "xnu" "osx-10.12.6" "sha256-C8TPQlUT3RbzAy8YnZPNtr70hpaVG9Llv0h42s3NENI=" {}
     else macosPackages_11_0_1.xnu;
     hfs             = applePackage "hfs"               "osx-10.12.6"     "sha256-eGi18HQFJrU5UHoBOE0LqO5gQ0xOf8+OJuAWQljfKE4=" {};
@@ -297,7 +301,7 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "sha256-VX+hcZ7JhOA8EhwLloPlM3Yx79RXp9OYHV9Mi10uw3Q=" {
       macosPackages_11_0_1 = macosPackages_11_0_1;
     };
-    network_cmds    = if stdenv.isx86_64 then
+    network_cmds    = if isSdk10_12 then
       applePackage "network_cmds" "osx-10.11.6" "sha256-I89CLIswGheewOjiNZwQTgWvWbhm0qtB5+KUqzxnQ5M=" {}
     else macosPackages_11_0_1.network_cmds;
     file_cmds       = applePackage "file_cmds"         "osx-10.11.6"     "sha256-JYy6HwmultKeZtLfaysbsyLoWg+OaTh7eJu54JkJC0Q=" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 14ede7949d0f..2820df1db1b1 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -1,4 +1,4 @@
-{ appleDerivation', lib, stdenv, stdenvNoCC, buildPackages
+{ appleDerivation', lib, stdenv, stdenvNoCC, buildPackages, pkgsBuildBuild
 , bootstrap_cmds, bison, flex
 , gnum4, unifdef, perl, python3
 , headersOnly ? true
@@ -12,7 +12,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
 
   nativeBuildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python3 ];
 
-  patches = lib.optionals stdenv.isx86_64 [ ./python3.patch ];
+  patches = lib.optionals (lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11") [ ./python3.patch ];
 
   postPatch = ''
     substituteInPlace Makefile \
@@ -48,7 +48,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
       --replace 'MACHINE_ARCH=armv7' 'MACHINE_ARCH=arm64' # this might break the comments saying 32-bit is required
 
     patchShebangs .
-  '' + lib.optionalString stdenv.isAarch64 ''
+  '' + lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11") ''
     # iig is closed-sourced, we don't have it
     # create an empty file to the header instead
     # this line becomes: echo "" > $@; echo --header ...
@@ -72,7 +72,11 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
   HOST_FLEX = "flex";
   HOST_BISON = "bison";
   HOST_GM4 = "m4";
-  MIGCC = "cc";
+  # use unwrapped clang to generate headers because wrapper is not compatible with a 32 bit -arch.
+  # aarch64 should likely do this as well and remove the --replace MACHINE_ARCH above
+  MIGCC = if stdenv.isx86_64 && lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11"
+    then "${lib.getBin pkgsBuildBuild.stdenv.cc.cc}/bin/clang"
+    else "cc";
   ARCHS = arch;
   ARCH_CONFIGS = arch;
 
@@ -80,7 +84,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
 
   preBuild = let macosVersion =
     "10.0 10.1 10.2 10.3 10.4 10.5 10.6 10.7 10.8 10.9 10.10 10.11" +
-    lib.optionalString stdenv.isAarch64 " 10.12 10.13 10.14 10.15 11.0";
+    lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11") " 10.12 10.13 10.14 10.15 11.0";
    in ''
     # This is a bit of a hack...
     mkdir -p sdk/usr/local/libexec
@@ -150,7 +154,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
     mv $out/Library/Frameworks/IOKit.framework $out/Library/PrivateFrameworks
   '';
 
-  appleHeaders = builtins.readFile (./. + "/headers-${arch}.txt");
+  appleHeaders = builtins.readFile (./. + "/headers-${stdenv.hostPlatform.darwinSdkVersion}-${arch}.txt");
 } // lib.optionalAttrs headersOnly {
   HOST_CODESIGN = "echo";
   HOST_CODESIGN_ALLOCATE = "echo";
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-10.12-x86_64.txt
similarity index 100%
rename from pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt
rename to pkgs/os-specific/darwin/apple-source-releases/xnu/headers-10.12-x86_64.txt
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-arm64.txt
similarity index 100%
rename from pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt
rename to pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-arm64.txt
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-x86_64.txt b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-x86_64.txt
new file mode 100644
index 000000000000..f2ab4917845e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-x86_64.txt
@@ -0,0 +1,1481 @@
+AssertMacros.h
+_errno.h
+_libkernel_init.h
+atm/atm_notification.defs
+atm/atm_types.defs
+atm/atm_types.h
+bank/bank_types.h
+bsd/bsm/audit.h
+bsd/crypto/entropy/diag_entropy_sysctl.h
+bsd/dev/random/randomdev.h
+bsd/i386/_limits.h
+bsd/i386/_mcontext.h
+bsd/i386/_param.h
+bsd/i386/_types.h
+bsd/i386/endian.h
+bsd/i386/limits.h
+bsd/i386/param.h
+bsd/i386/profile.h
+bsd/i386/signal.h
+bsd/i386/types.h
+bsd/i386/vmparam.h
+bsd/libkern/copyio.h
+bsd/libkern/libkern.h
+bsd/machine/_limits.h
+bsd/machine/_mcontext.h
+bsd/machine/_param.h
+bsd/machine/_types.h
+bsd/machine/byte_order.h
+bsd/machine/disklabel.h
+bsd/machine/endian.h
+bsd/machine/limits.h
+bsd/machine/param.h
+bsd/machine/profile.h
+bsd/machine/signal.h
+bsd/machine/types.h
+bsd/machine/vmparam.h
+bsd/miscfs/devfs/devfs.h
+bsd/miscfs/devfs/devfs_proto.h
+bsd/miscfs/devfs/devfsdefs.h
+bsd/miscfs/devfs/fdesc.h
+bsd/miscfs/fifofs/fifo.h
+bsd/miscfs/specfs/specdev.h
+bsd/miscfs/union/union.h
+bsd/net/bpf.h
+bsd/net/dlil.h
+bsd/net/ethernet.h
+bsd/net/if.h
+bsd/net/if_arp.h
+bsd/net/if_dl.h
+bsd/net/if_ether.h
+bsd/net/if_llc.h
+bsd/net/if_media.h
+bsd/net/if_mib.h
+bsd/net/if_types.h
+bsd/net/if_utun.h
+bsd/net/if_var.h
+bsd/net/init.h
+bsd/net/kext_net.h
+bsd/net/kpi_interface.h
+bsd/net/kpi_interfacefilter.h
+bsd/net/kpi_protocol.h
+bsd/net/ndrv.h
+bsd/net/net_kev.h
+bsd/net/pfkeyv2.h
+bsd/net/radix.h
+bsd/net/route.h
+bsd/netinet/bootp.h
+bsd/netinet/icmp6.h
+bsd/netinet/icmp_var.h
+bsd/netinet/if_ether.h
+bsd/netinet/igmp.h
+bsd/netinet/igmp_var.h
+bsd/netinet/in.h
+bsd/netinet/in_arp.h
+bsd/netinet/in_pcb.h
+bsd/netinet/in_systm.h
+bsd/netinet/in_var.h
+bsd/netinet/ip.h
+bsd/netinet/ip6.h
+bsd/netinet/ip_icmp.h
+bsd/netinet/ip_var.h
+bsd/netinet/kpi_ipfilter.h
+bsd/netinet/tcp.h
+bsd/netinet/tcp_fsm.h
+bsd/netinet/tcp_seq.h
+bsd/netinet/tcp_timer.h
+bsd/netinet/tcp_var.h
+bsd/netinet/tcpip.h
+bsd/netinet/udp.h
+bsd/netinet/udp_var.h
+bsd/netinet6/ah.h
+bsd/netinet6/esp.h
+bsd/netinet6/in6.h
+bsd/netinet6/in6_var.h
+bsd/netinet6/ipcomp.h
+bsd/netinet6/ipsec.h
+bsd/netinet6/nd6.h
+bsd/netinet6/raw_ip6.h
+bsd/netinet6/scope6_var.h
+bsd/netkey/keysock.h
+bsd/pthread/bsdthread_private.h
+bsd/pthread/priority_private.h
+bsd/pthread/workqueue_internal.h
+bsd/pthread/workqueue_syscalls.h
+bsd/pthread/workqueue_trace.h
+bsd/security/audit/audit.h
+bsd/security/audit/audit_bsd.h
+bsd/security/audit/audit_ioctl.h
+bsd/security/audit/audit_private.h
+bsd/sys/_endian.h
+bsd/sys/_select.h
+bsd/sys/_structs.h
+bsd/sys/_types.h
+bsd/sys/_types/_blkcnt_t.h
+bsd/sys/_types/_blksize_t.h
+bsd/sys/_types/_caddr_t.h
+bsd/sys/_types/_clock_t.h
+bsd/sys/_types/_ct_rune_t.h
+bsd/sys/_types/_dev_t.h
+bsd/sys/_types/_errno_t.h
+bsd/sys/_types/_fd_clr.h
+bsd/sys/_types/_fd_copy.h
+bsd/sys/_types/_fd_def.h
+bsd/sys/_types/_fd_isset.h
+bsd/sys/_types/_fd_set.h
+bsd/sys/_types/_fd_setsize.h
+bsd/sys/_types/_fd_zero.h
+bsd/sys/_types/_filesec_t.h
+bsd/sys/_types/_fsblkcnt_t.h
+bsd/sys/_types/_fsfilcnt_t.h
+bsd/sys/_types/_fsid_t.h
+bsd/sys/_types/_fsobj_id_t.h
+bsd/sys/_types/_gid_t.h
+bsd/sys/_types/_guid_t.h
+bsd/sys/_types/_id_t.h
+bsd/sys/_types/_in_addr_t.h
+bsd/sys/_types/_in_port_t.h
+bsd/sys/_types/_ino64_t.h
+bsd/sys/_types/_ino_t.h
+bsd/sys/_types/_int16_t.h
+bsd/sys/_types/_int32_t.h
+bsd/sys/_types/_int64_t.h
+bsd/sys/_types/_int8_t.h
+bsd/sys/_types/_intptr_t.h
+bsd/sys/_types/_iovec_t.h
+bsd/sys/_types/_key_t.h
+bsd/sys/_types/_mach_port_t.h
+bsd/sys/_types/_mbstate_t.h
+bsd/sys/_types/_mode_t.h
+bsd/sys/_types/_nlink_t.h
+bsd/sys/_types/_null.h
+bsd/sys/_types/_o_dsync.h
+bsd/sys/_types/_o_sync.h
+bsd/sys/_types/_off_t.h
+bsd/sys/_types/_offsetof.h
+bsd/sys/_types/_os_inline.h
+bsd/sys/_types/_pid_t.h
+bsd/sys/_types/_posix_vdisable.h
+bsd/sys/_types/_ptrdiff_t.h
+bsd/sys/_types/_rsize_t.h
+bsd/sys/_types/_rune_t.h
+bsd/sys/_types/_s_ifmt.h
+bsd/sys/_types/_sa_family_t.h
+bsd/sys/_types/_seek_set.h
+bsd/sys/_types/_sigaltstack.h
+bsd/sys/_types/_sigset_t.h
+bsd/sys/_types/_size_t.h
+bsd/sys/_types/_socklen_t.h
+bsd/sys/_types/_ssize_t.h
+bsd/sys/_types/_suseconds_t.h
+bsd/sys/_types/_time_t.h
+bsd/sys/_types/_timespec.h
+bsd/sys/_types/_timeval.h
+bsd/sys/_types/_timeval32.h
+bsd/sys/_types/_timeval64.h
+bsd/sys/_types/_u_char.h
+bsd/sys/_types/_u_int.h
+bsd/sys/_types/_u_int16_t.h
+bsd/sys/_types/_u_int32_t.h
+bsd/sys/_types/_u_int64_t.h
+bsd/sys/_types/_u_int8_t.h
+bsd/sys/_types/_u_short.h
+bsd/sys/_types/_ucontext.h
+bsd/sys/_types/_ucontext64.h
+bsd/sys/_types/_uid_t.h
+bsd/sys/_types/_uintptr_t.h
+bsd/sys/_types/_useconds_t.h
+bsd/sys/_types/_user32_itimerval.h
+bsd/sys/_types/_user32_ntptimeval.h
+bsd/sys/_types/_user32_timespec.h
+bsd/sys/_types/_user32_timeval.h
+bsd/sys/_types/_user32_timex.h
+bsd/sys/_types/_user64_itimerval.h
+bsd/sys/_types/_user64_ntptimeval.h
+bsd/sys/_types/_user64_timespec.h
+bsd/sys/_types/_user64_timeval.h
+bsd/sys/_types/_user64_timex.h
+bsd/sys/_types/_user_timespec.h
+bsd/sys/_types/_user_timeval.h
+bsd/sys/_types/_uuid_t.h
+bsd/sys/_types/_va_list.h
+bsd/sys/_types/_wchar_t.h
+bsd/sys/_types/_wint_t.h
+bsd/sys/appleapiopts.h
+bsd/sys/attr.h
+bsd/sys/bsdtask_info.h
+bsd/sys/buf.h
+bsd/sys/cdefs.h
+bsd/sys/codesign.h
+bsd/sys/commpage.h
+bsd/sys/conf.h
+bsd/sys/content_protection.h
+bsd/sys/cprotect.h
+bsd/sys/csr.h
+bsd/sys/decmpfs.h
+bsd/sys/dir.h
+bsd/sys/dirent.h
+bsd/sys/disk.h
+bsd/sys/disklabel.h
+bsd/sys/disktab.h
+bsd/sys/dkstat.h
+bsd/sys/doc_tombstone.h
+bsd/sys/domain.h
+bsd/sys/errno.h
+bsd/sys/ev.h
+bsd/sys/event.h
+bsd/sys/eventhandler.h
+bsd/sys/eventvar.h
+bsd/sys/fbt.h
+bsd/sys/fcntl.h
+bsd/sys/file.h
+bsd/sys/file_internal.h
+bsd/sys/filedesc.h
+bsd/sys/fileport.h
+bsd/sys/filio.h
+bsd/sys/fsctl.h
+bsd/sys/fsevents.h
+bsd/sys/fslog.h
+bsd/sys/guarded.h
+bsd/sys/imgact.h
+bsd/sys/ioccom.h
+bsd/sys/ioctl.h
+bsd/sys/ioctl_compat.h
+bsd/sys/ipc.h
+bsd/sys/kasl.h
+bsd/sys/kauth.h
+bsd/sys/kdebug.h
+bsd/sys/kdebug_kernel.h
+bsd/sys/kdebug_private.h
+bsd/sys/kern_control.h
+bsd/sys/kern_event.h
+bsd/sys/kern_memorystatus.h
+bsd/sys/kern_memorystatus_freeze.h
+bsd/sys/kern_memorystatus_notify.h
+bsd/sys/kern_sysctl.h
+bsd/sys/kernel.h
+bsd/sys/kernel_types.h
+bsd/sys/kpi_mbuf.h
+bsd/sys/kpi_private.h
+bsd/sys/kpi_socket.h
+bsd/sys/kpi_socketfilter.h
+bsd/sys/ktrace.h
+bsd/sys/linker_set.h
+bsd/sys/lock.h
+bsd/sys/lockf.h
+bsd/sys/mach_swapon.h
+bsd/sys/malloc.h
+bsd/sys/mbuf.h
+bsd/sys/md5.h
+bsd/sys/memory_maintenance.h
+bsd/sys/mman.h
+bsd/sys/monotonic.h
+bsd/sys/mount.h
+bsd/sys/mount_internal.h
+bsd/sys/msg.h
+bsd/sys/msgbuf.h
+bsd/sys/munge.h
+bsd/sys/namei.h
+bsd/sys/netport.h
+bsd/sys/param.h
+bsd/sys/paths.h
+bsd/sys/persona.h
+bsd/sys/pgo.h
+bsd/sys/pipe.h
+bsd/sys/posix_sem.h
+bsd/sys/posix_shm.h
+bsd/sys/priv.h
+bsd/sys/proc.h
+bsd/sys/proc_info.h
+bsd/sys/proc_internal.h
+bsd/sys/proc_require.h
+bsd/sys/protosw.h
+bsd/sys/pthread_internal.h
+bsd/sys/pthread_shims.h
+bsd/sys/queue.h
+bsd/sys/quota.h
+bsd/sys/random.h
+bsd/sys/reason.h
+bsd/sys/reboot.h
+bsd/sys/resource.h
+bsd/sys/resourcevar.h
+bsd/sys/sbuf.h
+bsd/sys/select.h
+bsd/sys/sem.h
+bsd/sys/sem_internal.h
+bsd/sys/semaphore.h
+bsd/sys/shm.h
+bsd/sys/shm_internal.h
+bsd/sys/signal.h
+bsd/sys/signalvar.h
+bsd/sys/socket.h
+bsd/sys/socketvar.h
+bsd/sys/sockio.h
+bsd/sys/spawn.h
+bsd/sys/spawn_internal.h
+bsd/sys/stackshot.h
+bsd/sys/stat.h
+bsd/sys/stdio.h
+bsd/sys/sys_domain.h
+bsd/sys/syscall.h
+bsd/sys/sysctl.h
+bsd/sys/syslimits.h
+bsd/sys/syslog.h
+bsd/sys/sysproto.h
+bsd/sys/systm.h
+bsd/sys/termios.h
+bsd/sys/time.h
+bsd/sys/timex.h
+bsd/sys/tree.h
+bsd/sys/tty.h
+bsd/sys/ttychars.h
+bsd/sys/ttycom.h
+bsd/sys/ttydefaults.h
+bsd/sys/ttydev.h
+bsd/sys/types.h
+bsd/sys/ubc.h
+bsd/sys/ucontext.h
+bsd/sys/ucred.h
+bsd/sys/uio.h
+bsd/sys/uio_internal.h
+bsd/sys/ulock.h
+bsd/sys/un.h
+bsd/sys/unicode.h
+bsd/sys/unistd.h
+bsd/sys/unpcb.h
+bsd/sys/user.h
+bsd/sys/utfconv.h
+bsd/sys/ux_exception.h
+bsd/sys/vfs_context.h
+bsd/sys/vm.h
+bsd/sys/vmmeter.h
+bsd/sys/vmparam.h
+bsd/sys/vnode.h
+bsd/sys/vnode_if.h
+bsd/sys/vnode_internal.h
+bsd/sys/vsock.h
+bsd/sys/vsock_domain.h
+bsd/sys/vsock_transport.h
+bsd/sys/wait.h
+bsd/sys/work_interval.h
+bsd/sys/xattr.h
+bsd/uuid/uuid.h
+bsd/vfs/vfs_disk_conditioner.h
+bsd/vfs/vfs_support.h
+bsd/vm/vnode_pager.h
+bsm/audit.h
+bsm/audit_domain.h
+bsm/audit_errno.h
+bsm/audit_fcntl.h
+bsm/audit_internal.h
+bsm/audit_kevents.h
+bsm/audit_record.h
+bsm/audit_socket_type.h
+corecrypto/cc.h
+corecrypto/cc_config.h
+corecrypto/cc_error.h
+corecrypto/cc_fault_canary.h
+corecrypto/cc_macros.h
+corecrypto/cc_priv.h
+corecrypto/cc_runtime_config.h
+corecrypto/ccaes.h
+corecrypto/ccasn1.h
+corecrypto/ccchacha20poly1305.h
+corecrypto/cccmac.h
+corecrypto/ccdes.h
+corecrypto/ccdigest.h
+corecrypto/ccdigest_priv.h
+corecrypto/ccdrbg.h
+corecrypto/ccdrbg_impl.h
+corecrypto/cchmac.h
+corecrypto/cckprng.h
+corecrypto/ccmd4.h
+corecrypto/ccmode.h
+corecrypto/ccmode_impl.h
+corecrypto/ccmode_siv.h
+corecrypto/ccmode_siv_hmac.h
+corecrypto/ccn.h
+corecrypto/ccpad.h
+corecrypto/ccrng.h
+corecrypto/ccrsa.h
+corecrypto/ccsha1.h
+corecrypto/ccsha2.h
+corecrypto/cczp.h
+corecrypto/fipspost_trace.h
+corpses/task_corpse.h
+default_pager/default_pager_types.h
+device/device.defs
+device/device_port.h
+device/device_types.defs
+device/device_types.h
+gethostuuid.h
+gethostuuid_private.h
+i386/_limits.h
+i386/_mcontext.h
+i386/_param.h
+i386/_types.h
+i386/eflags.h
+i386/endian.h
+i386/fasttrap_isa.h
+i386/limits.h
+i386/param.h
+i386/profile.h
+i386/signal.h
+i386/types.h
+i386/user_ldt.h
+i386/vmparam.h
+iokit/DriverKit/IOBufferMemoryDescriptor.h
+iokit/DriverKit/IODMACommand.h
+iokit/DriverKit/IODataQueueDispatchSource.h
+iokit/DriverKit/IODispatchQueue.h
+iokit/DriverKit/IODispatchSource.h
+iokit/DriverKit/IOInterruptDispatchSource.h
+iokit/DriverKit/IOKitKeys.h
+iokit/DriverKit/IOMemoryDescriptor.h
+iokit/DriverKit/IOMemoryMap.h
+iokit/DriverKit/IORPC.h
+iokit/DriverKit/IOReturn.h
+iokit/DriverKit/IOService.h
+iokit/DriverKit/IOServiceNotificationDispatchSource.h
+iokit/DriverKit/IOTypes.h
+iokit/DriverKit/IOUserClient.h
+iokit/DriverKit/IOUserServer.h
+iokit/DriverKit/OSAction.h
+iokit/DriverKit/OSObject.h
+iokit/IOKit/AppleKeyStoreInterface.h
+iokit/IOKit/IOBSD.h
+iokit/IOKit/IOBufferMemoryDescriptor.h
+iokit/IOKit/IOCPU.h
+iokit/IOKit/IOCatalogue.h
+iokit/IOKit/IOCommand.h
+iokit/IOKit/IOCommandGate.h
+iokit/IOKit/IOCommandPool.h
+iokit/IOKit/IOCommandQueue.h
+iokit/IOKit/IOConditionLock.h
+iokit/IOKit/IODMACommand.h
+iokit/IOKit/IODMAController.h
+iokit/IOKit/IODMAEventSource.h
+iokit/IOKit/IODataQueue.h
+iokit/IOKit/IODataQueueShared.h
+iokit/IOKit/IODeviceMemory.h
+iokit/IOKit/IODeviceTreeSupport.h
+iokit/IOKit/IOEventSource.h
+iokit/IOKit/IOFilterInterruptEventSource.h
+iokit/IOKit/IOHibernatePrivate.h
+iokit/IOKit/IOInterleavedMemoryDescriptor.h
+iokit/IOKit/IOInterruptAccounting.h
+iokit/IOKit/IOInterruptController.h
+iokit/IOKit/IOInterruptEventSource.h
+iokit/IOKit/IOInterrupts.h
+iokit/IOKit/IOKernelReportStructs.h
+iokit/IOKit/IOKernelReporters.h
+iokit/IOKit/IOKitDebug.h
+iokit/IOKit/IOKitDiagnosticsUserClient.h
+iokit/IOKit/IOKitKeys.h
+iokit/IOKit/IOKitKeysPrivate.h
+iokit/IOKit/IOKitServer.h
+iokit/IOKit/IOLib.h
+iokit/IOKit/IOLocks.h
+iokit/IOKit/IOLocksPrivate.h
+iokit/IOKit/IOMapper.h
+iokit/IOKit/IOMemoryCursor.h
+iokit/IOKit/IOMemoryDescriptor.h
+iokit/IOKit/IOMessage.h
+iokit/IOKit/IOMultiMemoryDescriptor.h
+iokit/IOKit/IONVRAM.h
+iokit/IOKit/IONotifier.h
+iokit/IOKit/IOPMGR.h
+iokit/IOKit/IOPlatformActions.h
+iokit/IOKit/IOPlatformExpert.h
+iokit/IOKit/IOPolledInterface.h
+iokit/IOKit/IORPC.h
+iokit/IOKit/IORangeAllocator.h
+iokit/IOKit/IORegistryEntry.h
+iokit/IOKit/IOReportMacros.h
+iokit/IOKit/IOReportTypes.h
+iokit/IOKit/IOReturn.h
+iokit/IOKit/IOService.h
+iokit/IOKit/IOServicePM.h
+iokit/IOKit/IOSharedDataQueue.h
+iokit/IOKit/IOSharedLock.h
+iokit/IOKit/IOStatistics.h
+iokit/IOKit/IOStatisticsPrivate.h
+iokit/IOKit/IOSubMemoryDescriptor.h
+iokit/IOKit/IOSyncer.h
+iokit/IOKit/IOTimeStamp.h
+iokit/IOKit/IOTimerEventSource.h
+iokit/IOKit/IOTypes.h
+iokit/IOKit/IOUserClient.h
+iokit/IOKit/IOUserServer.h
+iokit/IOKit/IOWorkLoop.h
+iokit/IOKit/OSMessageNotification.h
+iokit/IOKit/PassthruInterruptController.h
+iokit/IOKit/assert.h
+iokit/IOKit/nvram/IONVRAMController.h
+iokit/IOKit/platform/AppleMacIO.h
+iokit/IOKit/platform/AppleMacIODevice.h
+iokit/IOKit/platform/AppleNMI.h
+iokit/IOKit/platform/ApplePlatformExpert.h
+iokit/IOKit/platform/IOPlatformIO.h
+iokit/IOKit/power/IOPwrController.h
+iokit/IOKit/pwr_mgt/IOPM.h
+iokit/IOKit/pwr_mgt/IOPMLibDefs.h
+iokit/IOKit/pwr_mgt/IOPMPowerSource.h
+iokit/IOKit/pwr_mgt/IOPMPowerSourceList.h
+iokit/IOKit/pwr_mgt/IOPMpowerState.h
+iokit/IOKit/pwr_mgt/IOPowerConnection.h
+iokit/IOKit/pwr_mgt/RootDomain.h
+iokit/IOKit/rtc/IORTCController.h
+iokit/IOKit/system.h
+iokit/IOKit/system_management/IOWatchDogTimer.h
+kern/exc_guard.h
+kern/exc_resource.h
+kern/kcdata.h
+kern/kern_cdata.h
+libkern/OSByteOrder.h
+libkern/OSDebug.h
+libkern/OSKextLib.h
+libkern/OSReturn.h
+libkern/OSTypes.h
+libkern/_OSByteOrder.h
+libkern/firehose/chunk_private.h
+libkern/firehose/firehose_types_private.h
+libkern/firehose/ioctl_private.h
+libkern/firehose/tracepoint_private.h
+libkern/i386/OSByteOrder.h
+libkern/i386/_OSByteOrder.h
+libkern/libkern/Block.h
+libkern/libkern/Block_private.h
+libkern/libkern/OSAtomic.h
+libkern/libkern/OSBase.h
+libkern/libkern/OSByteOrder.h
+libkern/libkern/OSDebug.h
+libkern/libkern/OSKextLib.h
+libkern/libkern/OSKextLibPrivate.h
+libkern/libkern/OSMalloc.h
+libkern/libkern/OSReturn.h
+libkern/libkern/OSSerializeBinary.h
+libkern/libkern/OSTypes.h
+libkern/libkern/_OSByteOrder.h
+libkern/libkern/c++/OSAllocation.h
+libkern/libkern/c++/OSArray.h
+libkern/libkern/c++/OSBoolean.h
+libkern/libkern/c++/OSBoundedArray.h
+libkern/libkern/c++/OSBoundedArrayRef.h
+libkern/libkern/c++/OSBoundedPtr.h
+libkern/libkern/c++/OSBoundedPtrFwd.h
+libkern/libkern/c++/OSCPPDebug.h
+libkern/libkern/c++/OSCollection.h
+libkern/libkern/c++/OSCollectionIterator.h
+libkern/libkern/c++/OSContainers.h
+libkern/libkern/c++/OSData.h
+libkern/libkern/c++/OSDictionary.h
+libkern/libkern/c++/OSEndianTypes.h
+libkern/libkern/c++/OSIterator.h
+libkern/libkern/c++/OSKext.h
+libkern/libkern/c++/OSLib.h
+libkern/libkern/c++/OSMetaClass.h
+libkern/libkern/c++/OSNumber.h
+libkern/libkern/c++/OSObject.h
+libkern/libkern/c++/OSOrderedSet.h
+libkern/libkern/c++/OSPtr.h
+libkern/libkern/c++/OSSerialize.h
+libkern/libkern/c++/OSSet.h
+libkern/libkern/c++/OSSharedPtr.h
+libkern/libkern/c++/OSString.h
+libkern/libkern/c++/OSSymbol.h
+libkern/libkern/c++/OSUnserialize.h
+libkern/libkern/c++/bounded_array.h
+libkern/libkern/c++/bounded_array_ref.h
+libkern/libkern/c++/bounded_ptr.h
+libkern/libkern/c++/bounded_ptr_fwd.h
+libkern/libkern/c++/intrusive_shared_ptr.h
+libkern/libkern/c++/safe_allocation.h
+libkern/libkern/crc.h
+libkern/libkern/crypto/aes.h
+libkern/libkern/crypto/aesxts.h
+libkern/libkern/crypto/chacha20poly1305.h
+libkern/libkern/crypto/crypto_internal.h
+libkern/libkern/crypto/des.h
+libkern/libkern/crypto/md5.h
+libkern/libkern/crypto/rand.h
+libkern/libkern/crypto/register_crypto.h
+libkern/libkern/crypto/rsa.h
+libkern/libkern/crypto/sha1.h
+libkern/libkern/crypto/sha2.h
+libkern/libkern/i386/OSByteOrder.h
+libkern/libkern/i386/_OSByteOrder.h
+libkern/libkern/img4/interface.h
+libkern/libkern/kernel_mach_header.h
+libkern/libkern/kext_request_keys.h
+libkern/libkern/kxld.h
+libkern/libkern/kxld_types.h
+libkern/libkern/locks.h
+libkern/libkern/machine/OSByteOrder.h
+libkern/libkern/mkext.h
+libkern/libkern/prelink.h
+libkern/libkern/ptrauth_utils.h
+libkern/libkern/section_keywords.h
+libkern/libkern/stack_protector.h
+libkern/libkern/sysctl.h
+libkern/libkern/tree.h
+libkern/libkern/version.h
+libkern/libkern/zconf.h
+libkern/libkern/zlib.h
+libkern/machine/OSByteOrder.h
+libkern/os/atomic.h
+libkern/os/atomic_private.h
+libkern/os/atomic_private_arch.h
+libkern/os/atomic_private_impl.h
+libkern/os/base.h
+libkern/os/base_private.h
+libkern/os/cpp_util.h
+libkern/os/hash.h
+libkern/os/log.h
+libkern/os/log_private.h
+libkern/os/object.h
+libkern/os/overflow.h
+libkern/os/ptrtools.h
+libkern/os/reason_private.h
+libkern/os/refcnt.h
+libkern/os/refcnt_internal.h
+libkern/os/trace.h
+libproc.h
+mach/audit_triggers.defs
+mach/audit_triggers_types.h
+mach/boolean.h
+mach/bootstrap.h
+mach/clock.defs
+mach/clock.h
+mach/clock_priv.defs
+mach/clock_priv.h
+mach/clock_reply.defs
+mach/clock_reply.h
+mach/clock_types.defs
+mach/clock_types.h
+mach/dyld_kernel.h
+mach/error.h
+mach/exc.defs
+mach/exc.h
+mach/exception.h
+mach/exception_types.h
+mach/host_info.h
+mach/host_notify.h
+mach/host_notify_reply.defs
+mach/host_priv.defs
+mach/host_priv.h
+mach/host_reboot.h
+mach/host_security.defs
+mach/host_security.h
+mach/host_special_ports.h
+mach/i386/_structs.h
+mach/i386/asm.h
+mach/i386/boolean.h
+mach/i386/exception.h
+mach/i386/fp_reg.h
+mach/i386/kern_return.h
+mach/i386/ndr_def.h
+mach/i386/processor_info.h
+mach/i386/rpc.h
+mach/i386/sdt_isa.h
+mach/i386/thread_state.h
+mach/i386/thread_status.h
+mach/i386/vm_param.h
+mach/i386/vm_types.h
+mach/kern_return.h
+mach/kmod.h
+mach/lock_set.defs
+mach/lock_set.h
+mach/mach.h
+mach/mach_error.h
+mach/mach_eventlink.h
+mach/mach_exc.defs
+mach/mach_host.defs
+mach/mach_host.h
+mach/mach_init.h
+mach/mach_interface.h
+mach/mach_param.h
+mach/mach_port.defs
+mach/mach_port.h
+mach/mach_port_internal.h
+mach/mach_right.h
+mach/mach_syscalls.h
+mach/mach_time.h
+mach/mach_traps.h
+mach/mach_types.defs
+mach/mach_types.h
+mach/mach_vm.defs
+mach/mach_vm.h
+mach/mach_vm_internal.h
+mach/mach_voucher.defs
+mach/mach_voucher.h
+mach/mach_voucher_attr_control.defs
+mach/mach_voucher_types.h
+mach/machine.h
+mach/machine/_structs.h
+mach/machine/asm.h
+mach/machine/boolean.h
+mach/machine/exception.h
+mach/machine/kern_return.h
+mach/machine/machine_types.defs
+mach/machine/ndr_def.h
+mach/machine/processor_info.h
+mach/machine/rpc.h
+mach/machine/sdt.h
+mach/machine/sdt_isa.h
+mach/machine/thread_state.h
+mach/machine/thread_status.h
+mach/machine/vm_param.h
+mach/machine/vm_types.h
+mach/memory_entry.defs
+mach/memory_entry.h
+mach/memory_object_types.h
+mach/message.h
+mach/mig.h
+mach/mig_errors.h
+mach/mig_strncpy_zerofill_support.h
+mach/mig_voucher_support.h
+mach/ndr.h
+mach/notify.defs
+mach/notify.h
+mach/policy.h
+mach/port.h
+mach/port_obj.h
+mach/processor.defs
+mach/processor.h
+mach/processor_info.h
+mach/processor_set.defs
+mach/processor_set.h
+mach/rpc.h
+mach/sdt.h
+mach/semaphore.h
+mach/shared_memory_server.h
+mach/shared_region.h
+mach/std_types.defs
+mach/std_types.h
+mach/sync.h
+mach/sync_policy.h
+mach/task.defs
+mach/task.h
+mach/task_access.defs
+mach/task_info.h
+mach/task_inspect.h
+mach/task_policy.h
+mach/task_special_ports.h
+mach/telemetry_notification.defs
+mach/thread_act.defs
+mach/thread_act.h
+mach/thread_act_internal.h
+mach/thread_info.h
+mach/thread_policy.h
+mach/thread_special_ports.h
+mach/thread_state.h
+mach/thread_status.h
+mach/thread_switch.h
+mach/time_value.h
+mach/vm_attributes.h
+mach/vm_behavior.h
+mach/vm_inherit.h
+mach/vm_map.defs
+mach/vm_map.h
+mach/vm_map_internal.h
+mach/vm_page_size.h
+mach/vm_param.h
+mach/vm_prot.h
+mach/vm_purgable.h
+mach/vm_region.h
+mach/vm_statistics.h
+mach/vm_sync.h
+mach/vm_task.h
+mach/vm_types.h
+mach_debug/hash_info.h
+mach_debug/ipc_info.h
+mach_debug/lockgroup_info.h
+mach_debug/mach_debug.h
+mach_debug/mach_debug_types.defs
+mach_debug/mach_debug_types.h
+mach_debug/page_info.h
+mach_debug/vm_info.h
+mach_debug/zone_info.h
+machine/_limits.h
+machine/_mcontext.h
+machine/_param.h
+machine/_types.h
+machine/byte_order.h
+machine/endian.h
+machine/fasttrap_isa.h
+machine/limits.h
+machine/param.h
+machine/profile.h
+machine/signal.h
+machine/types.h
+machine/vmparam.h
+machine_types.modulemap
+miscfs/devfs/devfs.h
+miscfs/specfs/specdev.h
+miscfs/union/union.h
+net/bpf.h
+net/dlil.h
+net/ethernet.h
+net/if.h
+net/if_arp.h
+net/if_dl.h
+net/if_llc.h
+net/if_media.h
+net/if_mib.h
+net/if_types.h
+net/if_utun.h
+net/if_var.h
+net/kext_net.h
+net/ndrv.h
+net/net_kev.h
+net/pfkeyv2.h
+net/route.h
+netinet/bootp.h
+netinet/icmp6.h
+netinet/icmp_var.h
+netinet/if_ether.h
+netinet/igmp.h
+netinet/igmp_var.h
+netinet/in.h
+netinet/in_pcb.h
+netinet/in_systm.h
+netinet/in_var.h
+netinet/ip.h
+netinet/ip6.h
+netinet/ip_icmp.h
+netinet/ip_var.h
+netinet/tcp.h
+netinet/tcp_fsm.h
+netinet/tcp_seq.h
+netinet/tcp_timer.h
+netinet/tcp_var.h
+netinet/tcpip.h
+netinet/udp.h
+netinet/udp_var.h
+netinet6/ah.h
+netinet6/esp.h
+netinet6/in6.h
+netinet6/in6_var.h
+netinet6/ipcomp.h
+netinet6/ipsec.h
+netinet6/nd6.h
+netinet6/raw_ip6.h
+netinet6/scope6_var.h
+netkey/keysock.h
+nfs/krpc.h
+nfs/nfs.h
+nfs/nfs_gss.h
+nfs/nfs_ioctl.h
+nfs/nfs_lock.h
+nfs/nfsdiskless.h
+nfs/nfsm_subs.h
+nfs/nfsmount.h
+nfs/nfsnode.h
+nfs/nfsproto.h
+nfs/nfsrvcache.h
+nfs/rpcv2.h
+nfs/xdr_subs.h
+os/atomic.h
+os/base.h
+os/overflow.h
+os/tsd.h
+osfmk/UserNotification/KUNCUserNotifications.h
+osfmk/UserNotification/UNDReply.defs
+osfmk/UserNotification/UNDRequest.defs
+osfmk/UserNotification/UNDTypes.defs
+osfmk/UserNotification/UNDTypes.h
+osfmk/atm/atm_internal.h
+osfmk/atm/atm_notification.defs
+osfmk/atm/atm_types.defs
+osfmk/atm/atm_types.h
+osfmk/bank/bank_types.h
+osfmk/console/serial_protos.h
+osfmk/console/video_console.h
+osfmk/corpses/task_corpse.h
+osfmk/default_pager/default_pager_types.h
+osfmk/device/device.defs
+osfmk/device/device_port.h
+osfmk/device/device_types.defs
+osfmk/device/device_types.h
+osfmk/gssd/gssd_mach.defs
+osfmk/gssd/gssd_mach.h
+osfmk/gssd/gssd_mach_types.h
+osfmk/i386/apic.h
+osfmk/i386/asm.h
+osfmk/i386/atomic.h
+osfmk/i386/bit_routines.h
+osfmk/i386/cpu_capabilities.h
+osfmk/i386/cpu_data.h
+osfmk/i386/cpu_number.h
+osfmk/i386/cpu_topology.h
+osfmk/i386/cpuid.h
+osfmk/i386/eflags.h
+osfmk/i386/fpu.h
+osfmk/i386/io_map_entries.h
+osfmk/i386/lapic.h
+osfmk/i386/lock.h
+osfmk/i386/locks.h
+osfmk/i386/locks_i386_inlines.h
+osfmk/i386/machine_cpu.h
+osfmk/i386/machine_routines.h
+osfmk/i386/memory_types.h
+osfmk/i386/mp.h
+osfmk/i386/mp_desc.h
+osfmk/i386/mp_events.h
+osfmk/i386/mtrr.h
+osfmk/i386/pal_hibernate.h
+osfmk/i386/pal_native.h
+osfmk/i386/pal_routines.h
+osfmk/i386/panic_hooks.h
+osfmk/i386/pmCPU.h
+osfmk/i386/pmap.h
+osfmk/i386/proc_reg.h
+osfmk/i386/rtclock_protos.h
+osfmk/i386/seg.h
+osfmk/i386/simple_lock.h
+osfmk/i386/smp.h
+osfmk/i386/trap.h
+osfmk/i386/tsc.h
+osfmk/i386/tss.h
+osfmk/i386/ucode.h
+osfmk/i386/vmx.h
+osfmk/ipc/ipc_types.h
+osfmk/kdp/kdp_callout.h
+osfmk/kdp/kdp_dyld.h
+osfmk/kdp/kdp_en_debugger.h
+osfmk/kern/affinity.h
+osfmk/kern/arcade.h
+osfmk/kern/arithmetic_128.h
+osfmk/kern/assert.h
+osfmk/kern/audit_sessionport.h
+osfmk/kern/backtrace.h
+osfmk/kern/bits.h
+osfmk/kern/block_hint.h
+osfmk/kern/btlog.h
+osfmk/kern/cambria_layout.h
+osfmk/kern/circle_queue.h
+osfmk/kern/clock.h
+osfmk/kern/coalition.h
+osfmk/kern/cpu_data.h
+osfmk/kern/cpu_number.h
+osfmk/kern/cpu_quiesce.h
+osfmk/kern/cs_blobs.h
+osfmk/kern/debug.h
+osfmk/kern/ecc.h
+osfmk/kern/energy_perf.h
+osfmk/kern/exc_guard.h
+osfmk/kern/exc_resource.h
+osfmk/kern/extmod_statistics.h
+osfmk/kern/host.h
+osfmk/kern/hv_support.h
+osfmk/kern/hv_support_kext.h
+osfmk/kern/ipc_kobject.h
+osfmk/kern/ipc_mig.h
+osfmk/kern/ipc_misc.h
+osfmk/kern/kalloc.h
+osfmk/kern/kcdata.h
+osfmk/kern/kern_cdata.h
+osfmk/kern/kern_types.h
+osfmk/kern/kext_alloc.h
+osfmk/kern/kpc.h
+osfmk/kern/ledger.h
+osfmk/kern/lock.h
+osfmk/kern/lock_group.h
+osfmk/kern/lock_stat.h
+osfmk/kern/locks.h
+osfmk/kern/mach_param.h
+osfmk/kern/macro_help.h
+osfmk/kern/monotonic.h
+osfmk/kern/mpqueue.h
+osfmk/kern/mpsc_queue.h
+osfmk/kern/page_decrypt.h
+osfmk/kern/percpu.h
+osfmk/kern/pms.h
+osfmk/kern/policy_internal.h
+osfmk/kern/priority_queue.h
+osfmk/kern/processor.h
+osfmk/kern/queue.h
+osfmk/kern/remote_time.h
+osfmk/kern/restartable.h
+osfmk/kern/sched_clutch.h
+osfmk/kern/sched_prim.h
+osfmk/kern/sfi.h
+osfmk/kern/simple_lock.h
+osfmk/kern/startup.h
+osfmk/kern/task.h
+osfmk/kern/telemetry.h
+osfmk/kern/thread.h
+osfmk/kern/thread_call.h
+osfmk/kern/thread_group.h
+osfmk/kern/timer_call.h
+osfmk/kern/trustcache.h
+osfmk/kern/turnstile.h
+osfmk/kern/ux_handler.h
+osfmk/kern/waitq.h
+osfmk/kern/work_interval.h
+osfmk/kern/zalloc.h
+osfmk/kextd/kextd_mach.defs
+osfmk/kextd/kextd_mach.h
+osfmk/kperf/action.h
+osfmk/kperf/context.h
+osfmk/kperf/kdebug_trigger.h
+osfmk/kperf/kperf.h
+osfmk/kperf/kperfbsd.h
+osfmk/kperf/kptimer.h
+osfmk/kperf/lazy.h
+osfmk/kperf/pet.h
+osfmk/lockd/lockd_mach.defs
+osfmk/lockd/lockd_mach.h
+osfmk/lockd/lockd_mach_types.h
+osfmk/mach/arcade_upcall_server.h
+osfmk/mach/audit_triggers.defs
+osfmk/mach/audit_triggers_server.h
+osfmk/mach/audit_triggers_types.h
+osfmk/mach/boolean.h
+osfmk/mach/clock.defs
+osfmk/mach/clock.h
+osfmk/mach/clock_priv.defs
+osfmk/mach/clock_priv.h
+osfmk/mach/clock_reply.defs
+osfmk/mach/clock_reply_server.h
+osfmk/mach/clock_types.defs
+osfmk/mach/clock_types.h
+osfmk/mach/coalition.h
+osfmk/mach/coalition_notification_server.h
+osfmk/mach/dyld_kernel.h
+osfmk/mach/error.h
+osfmk/mach/exc.defs
+osfmk/mach/exc_server.h
+osfmk/mach/exception.h
+osfmk/mach/exception_types.h
+osfmk/mach/fairplayd_notification_server.h
+osfmk/mach/host_info.h
+osfmk/mach/host_notify.h
+osfmk/mach/host_notify_reply.defs
+osfmk/mach/host_priv.defs
+osfmk/mach/host_priv.h
+osfmk/mach/host_reboot.h
+osfmk/mach/host_security.defs
+osfmk/mach/host_security.h
+osfmk/mach/host_special_ports.h
+osfmk/mach/i386/_structs.h
+osfmk/mach/i386/asm.h
+osfmk/mach/i386/boolean.h
+osfmk/mach/i386/exception.h
+osfmk/mach/i386/fp_reg.h
+osfmk/mach/i386/kern_return.h
+osfmk/mach/i386/ndr_def.h
+osfmk/mach/i386/processor_info.h
+osfmk/mach/i386/rpc.h
+osfmk/mach/i386/sdt_isa.h
+osfmk/mach/i386/syscall_sw.h
+osfmk/mach/i386/thread_state.h
+osfmk/mach/i386/thread_status.h
+osfmk/mach/i386/vm_param.h
+osfmk/mach/i386/vm_types.h
+osfmk/mach/kern_return.h
+osfmk/mach/kmod.h
+osfmk/mach/ktrace_background.h
+osfmk/mach/lock_set.defs
+osfmk/mach/lock_set.h
+osfmk/mach/mach_eventlink_types.h
+osfmk/mach/mach_exc.defs
+osfmk/mach/mach_exc_server.h
+osfmk/mach/mach_host.defs
+osfmk/mach/mach_host.h
+osfmk/mach/mach_interface.h
+osfmk/mach/mach_param.h
+osfmk/mach/mach_port.defs
+osfmk/mach/mach_port.h
+osfmk/mach/mach_syscalls.h
+osfmk/mach/mach_time.h
+osfmk/mach/mach_traps.h
+osfmk/mach/mach_types.defs
+osfmk/mach/mach_types.h
+osfmk/mach/mach_vm.defs
+osfmk/mach/mach_vm.h
+osfmk/mach/mach_voucher.defs
+osfmk/mach/mach_voucher.h
+osfmk/mach/mach_voucher_attr_control.defs
+osfmk/mach/mach_voucher_attr_control.h
+osfmk/mach/mach_voucher_types.h
+osfmk/mach/machine.h
+osfmk/mach/machine/_structs.h
+osfmk/mach/machine/asm.h
+osfmk/mach/machine/boolean.h
+osfmk/mach/machine/exception.h
+osfmk/mach/machine/kern_return.h
+osfmk/mach/machine/machine_types.defs
+osfmk/mach/machine/ndr_def.h
+osfmk/mach/machine/processor_info.h
+osfmk/mach/machine/rpc.h
+osfmk/mach/machine/sdt.h
+osfmk/mach/machine/sdt_isa.h
+osfmk/mach/machine/syscall_sw.h
+osfmk/mach/machine/thread_state.h
+osfmk/mach/machine/thread_status.h
+osfmk/mach/machine/vm_param.h
+osfmk/mach/machine/vm_types.h
+osfmk/mach/memory_entry.defs
+osfmk/mach/memory_entry.h
+osfmk/mach/memory_object_control.h
+osfmk/mach/memory_object_default_server.h
+osfmk/mach/memory_object_types.h
+osfmk/mach/message.h
+osfmk/mach/mig.h
+osfmk/mach/mig_errors.h
+osfmk/mach/mig_strncpy_zerofill_support.h
+osfmk/mach/mig_voucher_support.h
+osfmk/mach/ndr.h
+osfmk/mach/notify.defs
+osfmk/mach/notify.h
+osfmk/mach/notify_server.h
+osfmk/mach/policy.h
+osfmk/mach/port.h
+osfmk/mach/processor.defs
+osfmk/mach/processor.h
+osfmk/mach/processor_info.h
+osfmk/mach/processor_set.defs
+osfmk/mach/processor_set.h
+osfmk/mach/resource_monitors.h
+osfmk/mach/rpc.h
+osfmk/mach/sdt.h
+osfmk/mach/semaphore.h
+osfmk/mach/sfi_class.h
+osfmk/mach/shared_memory_server.h
+osfmk/mach/shared_region.h
+osfmk/mach/std_types.defs
+osfmk/mach/std_types.h
+osfmk/mach/sync_policy.h
+osfmk/mach/syscall_sw.h
+osfmk/mach/sysdiagnose_notification_server.h
+osfmk/mach/task.defs
+osfmk/mach/task.h
+osfmk/mach/task_access.defs
+osfmk/mach/task_access.h
+osfmk/mach/task_access_server.h
+osfmk/mach/task_info.h
+osfmk/mach/task_inspect.h
+osfmk/mach/task_policy.h
+osfmk/mach/task_special_ports.h
+osfmk/mach/telemetry_notification.defs
+osfmk/mach/telemetry_notification_server.h
+osfmk/mach/thread_act.defs
+osfmk/mach/thread_act.h
+osfmk/mach/thread_info.h
+osfmk/mach/thread_policy.h
+osfmk/mach/thread_special_ports.h
+osfmk/mach/thread_status.h
+osfmk/mach/thread_switch.h
+osfmk/mach/time_value.h
+osfmk/mach/upl.h
+osfmk/mach/vfs_nspace.h
+osfmk/mach/vfs_nspace_server.h
+osfmk/mach/vm_attributes.h
+osfmk/mach/vm_behavior.h
+osfmk/mach/vm_inherit.h
+osfmk/mach/vm_map.defs
+osfmk/mach/vm_map.h
+osfmk/mach/vm_param.h
+osfmk/mach/vm_prot.h
+osfmk/mach/vm_purgable.h
+osfmk/mach/vm_region.h
+osfmk/mach/vm_statistics.h
+osfmk/mach/vm_sync.h
+osfmk/mach/vm_types.h
+osfmk/mach_debug/hash_info.h
+osfmk/mach_debug/ipc_info.h
+osfmk/mach_debug/lockgroup_info.h
+osfmk/mach_debug/mach_debug.h
+osfmk/mach_debug/mach_debug_types.defs
+osfmk/mach_debug/mach_debug_types.h
+osfmk/mach_debug/page_info.h
+osfmk/mach_debug/vm_info.h
+osfmk/mach_debug/zone_info.h
+osfmk/machine/atomic.h
+osfmk/machine/config.h
+osfmk/machine/cpu_capabilities.h
+osfmk/machine/cpu_number.h
+osfmk/machine/io_map_entries.h
+osfmk/machine/lock.h
+osfmk/machine/locks.h
+osfmk/machine/machine_cpuid.h
+osfmk/machine/machine_kpc.h
+osfmk/machine/machine_remote_time.h
+osfmk/machine/machine_routines.h
+osfmk/machine/memory_types.h
+osfmk/machine/monotonic.h
+osfmk/machine/pal_hibernate.h
+osfmk/machine/pal_routines.h
+osfmk/machine/simple_lock.h
+osfmk/machine/smp.h
+osfmk/machine/trap.h
+osfmk/prng/entropy.h
+osfmk/prng/random.h
+osfmk/string.h
+osfmk/tests/ktest.h
+osfmk/tests/xnupost.h
+osfmk/vm/WKdm_new.h
+osfmk/vm/memory_types.h
+osfmk/vm/pmap.h
+osfmk/vm/vm_compressor_algorithms.h
+osfmk/vm/vm_fault.h
+osfmk/vm/vm_kern.h
+osfmk/vm/vm_map.h
+osfmk/vm/vm_options.h
+osfmk/vm/vm_pageout.h
+osfmk/vm/vm_protos.h
+osfmk/vm/vm_shared_region.h
+osfmk/voucher/ipc_pthread_priority_types.h
+osfmk/x86_64/machine_kpc.h
+osfmk/x86_64/machine_remote_time.h
+osfmk/x86_64/monotonic.h
+pexpert/boot.h
+pexpert/i386/boot.h
+pexpert/i386/efi.h
+pexpert/i386/protos.h
+pexpert/machine/boot.h
+pexpert/machine/protos.h
+pexpert/pexpert.h
+pexpert/pexpert/boot.h
+pexpert/pexpert/device_tree.h
+pexpert/pexpert/i386/boot.h
+pexpert/pexpert/i386/efi.h
+pexpert/pexpert/i386/protos.h
+pexpert/pexpert/machine/boot.h
+pexpert/pexpert/machine/protos.h
+pexpert/pexpert/pexpert.h
+pexpert/pexpert/protos.h
+pexpert/protos.h
+san/san/kasan.h
+san/san/ksancov.h
+san/san/memintrinsics.h
+security/audit/audit_ioctl.h
+security/security/_label.h
+security/security/mac.h
+security/security/mac_data.h
+security/security/mac_framework.h
+security/security/mac_internal.h
+security/security/mac_mach_internal.h
+security/security/mac_policy.h
+servers/key_defs.h
+servers/ls_defs.h
+servers/netname.h
+servers/netname_defs.h
+servers/nm_defs.h
+spawn.h
+sys/_endian.h
+sys/_posix_availability.h
+sys/_select.h
+sys/_structs.h
+sys/_symbol_aliasing.h
+sys/_types.h
+sys/_types/_blkcnt_t.h
+sys/_types/_blksize_t.h
+sys/_types/_caddr_t.h
+sys/_types/_clock_t.h
+sys/_types/_ct_rune_t.h
+sys/_types/_dev_t.h
+sys/_types/_errno_t.h
+sys/_types/_fd_clr.h
+sys/_types/_fd_copy.h
+sys/_types/_fd_def.h
+sys/_types/_fd_isset.h
+sys/_types/_fd_set.h
+sys/_types/_fd_setsize.h
+sys/_types/_fd_zero.h
+sys/_types/_filesec_t.h
+sys/_types/_fsblkcnt_t.h
+sys/_types/_fsfilcnt_t.h
+sys/_types/_fsid_t.h
+sys/_types/_fsobj_id_t.h
+sys/_types/_gid_t.h
+sys/_types/_guid_t.h
+sys/_types/_id_t.h
+sys/_types/_in_addr_t.h
+sys/_types/_in_port_t.h
+sys/_types/_ino64_t.h
+sys/_types/_ino_t.h
+sys/_types/_int16_t.h
+sys/_types/_int32_t.h
+sys/_types/_int64_t.h
+sys/_types/_int8_t.h
+sys/_types/_intptr_t.h
+sys/_types/_iovec_t.h
+sys/_types/_key_t.h
+sys/_types/_mach_port_t.h
+sys/_types/_mbstate_t.h
+sys/_types/_mode_t.h
+sys/_types/_nlink_t.h
+sys/_types/_null.h
+sys/_types/_o_dsync.h
+sys/_types/_o_sync.h
+sys/_types/_off_t.h
+sys/_types/_offsetof.h
+sys/_types/_os_inline.h
+sys/_types/_pid_t.h
+sys/_types/_posix_vdisable.h
+sys/_types/_ptrdiff_t.h
+sys/_types/_rsize_t.h
+sys/_types/_rune_t.h
+sys/_types/_s_ifmt.h
+sys/_types/_sa_family_t.h
+sys/_types/_seek_set.h
+sys/_types/_sigaltstack.h
+sys/_types/_sigset_t.h
+sys/_types/_size_t.h
+sys/_types/_socklen_t.h
+sys/_types/_ssize_t.h
+sys/_types/_suseconds_t.h
+sys/_types/_time_t.h
+sys/_types/_timespec.h
+sys/_types/_timeval.h
+sys/_types/_timeval32.h
+sys/_types/_timeval64.h
+sys/_types/_u_char.h
+sys/_types/_u_int.h
+sys/_types/_u_int16_t.h
+sys/_types/_u_int32_t.h
+sys/_types/_u_int64_t.h
+sys/_types/_u_int8_t.h
+sys/_types/_u_short.h
+sys/_types/_ucontext.h
+sys/_types/_ucontext64.h
+sys/_types/_uid_t.h
+sys/_types/_uintptr_t.h
+sys/_types/_useconds_t.h
+sys/_types/_uuid_t.h
+sys/_types/_va_list.h
+sys/_types/_wchar_t.h
+sys/_types/_wint_t.h
+sys/acct.h
+sys/aio.h
+sys/appleapiopts.h
+sys/attr.h
+sys/buf.h
+sys/cdefs.h
+sys/clonefile.h
+sys/commpage.h
+sys/conf.h
+sys/dir.h
+sys/dirent.h
+sys/disk.h
+sys/dkstat.h
+sys/domain.h
+sys/dtrace.h
+sys/dtrace_glue.h
+sys/dtrace_impl.h
+sys/errno.h
+sys/ev.h
+sys/event.h
+sys/fasttrap.h
+sys/fasttrap_isa.h
+sys/fcntl.h
+sys/file.h
+sys/filedesc.h
+sys/filio.h
+sys/fsgetpath.h
+sys/gmon.h
+sys/ioccom.h
+sys/ioctl.h
+sys/ioctl_compat.h
+sys/ipc.h
+sys/kauth.h
+sys/kdebug.h
+sys/kdebug_signpost.h
+sys/kern_control.h
+sys/kern_event.h
+sys/kernel.h
+sys/kernel_types.h
+sys/lctx.h
+sys/loadable_fs.h
+sys/lock.h
+sys/lockf.h
+sys/lockstat.h
+sys/log_data.h
+sys/malloc.h
+sys/mbuf.h
+sys/mman.h
+sys/mount.h
+sys/msg.h
+sys/msgbuf.h
+sys/netport.h
+sys/param.h
+sys/paths.h
+sys/pipe.h
+sys/poll.h
+sys/posix_sem.h
+sys/posix_shm.h
+sys/proc.h
+sys/proc_info.h
+sys/protosw.h
+sys/ptrace.h
+sys/queue.h
+sys/quota.h
+sys/random.h
+sys/reboot.h
+sys/resource.h
+sys/resourcevar.h
+sys/sbuf.h
+sys/sdt.h
+sys/select.h
+sys/sem.h
+sys/semaphore.h
+sys/shm.h
+sys/signal.h
+sys/signalvar.h
+sys/snapshot.h
+sys/socket.h
+sys/socketvar.h
+sys/sockio.h
+sys/spawn.h
+sys/stat.h
+sys/stdio.h
+sys/sys_domain.h
+sys/syscall.h
+sys/sysctl.h
+sys/syslimits.h
+sys/syslog.h
+sys/termios.h
+sys/time.h
+sys/timeb.h
+sys/times.h
+sys/timex.h
+sys/tprintf.h
+sys/trace.h
+sys/tty.h
+sys/ttychars.h
+sys/ttycom.h
+sys/ttydefaults.h
+sys/ttydev.h
+sys/types.h
+sys/ubc.h
+sys/ucontext.h
+sys/ucred.h
+sys/uio.h
+sys/un.h
+sys/unistd.h
+sys/unpcb.h
+sys/user.h
+sys/utfconv.h
+sys/utsname.h
+sys/vadvise.h
+sys/vcmd.h
+sys/vm.h
+sys/vmmeter.h
+sys/vmparam.h
+sys/vnioctl.h
+sys/vnode.h
+sys/vnode_if.h
+sys/vsock.h
+sys/vstat.h
+sys/wait.h
+sys/xattr.h
+sys__types.modulemap
+sys_cdefs.modulemap
+sys_types.modulemap
+system-version-compat-support.h
+uuid/uuid.h
+vfs/vfs_support.h
+voucher/ipc_pthread_priority_types.h
diff --git a/pkgs/os-specific/darwin/defaultbrowser/default.nix b/pkgs/os-specific/darwin/defaultbrowser/default.nix
index be3dcd417731..2246efa0aa43 100644
--- a/pkgs/os-specific/darwin/defaultbrowser/default.nix
+++ b/pkgs/os-specific/darwin/defaultbrowser/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     description = "Command line tool for getting and setting a default browser (HTTP handler) in Mac OS X";
     homepage = "https://github.com/kerma/defaultbrowser";
     platforms = platforms.darwin;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/os-specific/darwin/karabiner-elements/default.nix b/pkgs/os-specific/darwin/karabiner-elements/default.nix
index 53847c75fccc..21500ad16d90 100644
--- a/pkgs/os-specific/darwin/karabiner-elements/default.nix
+++ b/pkgs/os-specific/darwin/karabiner-elements/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     description = "Karabiner-Elements is a powerful utility for keyboard customization on macOS Sierra (10.12) or later";
     homepage = "https://karabiner-elements.pqrs.org/";
     platforms = platforms.darwin;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
     license = licenses.unlicense;
   };
 }
diff --git a/pkgs/os-specific/darwin/pam-reattach/default.nix b/pkgs/os-specific/darwin/pam-reattach/default.nix
index 4350865080f0..b077ac031b62 100644
--- a/pkgs/os-specific/darwin/pam-reattach/default.nix
+++ b/pkgs/os-specific/darwin/pam-reattach/default.nix
@@ -1,5 +1,8 @@
 { lib, stdenv, fetchFromGitHub, cmake, openpam, darwin }:
 
+let
+  sdkOlderThan11 = lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11.0";
+in
 stdenv.mkDerivation rec {
   pname = "pam_reattach";
   version = "1.3";
@@ -12,17 +15,12 @@ stdenv.mkDerivation rec {
   };
 
   cmakeFlags = [
-    "-DCMAKE_OSX_ARCHITECTURES=${
-      if stdenv.hostPlatform.system == "x86_64-darwin" then
-        "x86_64"
-      else
-        "arm64"
-    }"
+    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
     "-DENABLE_CLI=ON"
-  ] ++ lib.optional (!stdenv.isAarch64) "-DCMAKE_LIBRARY_PATH=${darwin.apple_sdk.sdk}/usr/lib";
+  ] ++ lib.optional sdkOlderThan11 "-DCMAKE_LIBRARY_PATH=${darwin.apple_sdk.sdk}/usr/lib";
 
   buildInputs = [ openpam ]
-    ++ lib.optional (!stdenv.isAarch64) darwin.apple_sdk.sdk;
+    ++ lib.optional sdkOlderThan11 darwin.apple_sdk.sdk;
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/os-specific/darwin/rectangle/default.nix b/pkgs/os-specific/darwin/rectangle/default.nix
index 1e7be272d6ab..fbf13963e49e 100644
--- a/pkgs/os-specific/darwin/rectangle/default.nix
+++ b/pkgs/os-specific/darwin/rectangle/default.nix
@@ -37,7 +37,7 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://rectangleapp.com/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = platforms.darwin;
-    maintainers = with maintainers; [ Enzime Intuinewin wegank ];
+    maintainers = with maintainers; [ Intuinewin wegank ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/os-specific/darwin/shortcat/default.nix b/pkgs/os-specific/darwin/shortcat/default.nix
index dcf32a4fd9e3..81086bec3a77 100644
--- a/pkgs/os-specific/darwin/shortcat/default.nix
+++ b/pkgs/os-specific/darwin/shortcat/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     homepage = "https://shortcat.app/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = platforms.darwin;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
     license = licenses.unfreeRedistributable;
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
index 33a1fe6e1ed7..f106f77626e5 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = "20240610";
+  version = "20240709";
 
   src = fetchzip {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${version}.tar.gz";
-    hash = "sha256-tjDqviOMvrBoEG8+Yn+XqdBlIDfQUX0KK2kpW6/jed8=";
+    hash = "sha256-BopPZDVQMmhLo9qTpozIea2amaZNQvwhgEIcpKMPAKs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index fe2e9951bf85..568027999efa 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -33,12 +33,12 @@ rec {
   stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;
 
   production = generic {
-    version = "550.90.07";
-    sha256_64bit = "sha256-Uaz1edWpiE9XOh0/Ui5/r6XnhB4iqc7AtLvq4xsLlzM=";
-    sha256_aarch64 = "sha256-uJa3auRlMHr8WyacQL2MyyeebqfT7K6VU0qR7LGXFXI=";
-    openSha256 = "sha256-VLmh7eH0xhEu/AK+Osb9vtqAFni+lx84P/bo4ZgCqj8=";
-    settingsSha256 = "sha256-sX9dHEp9zH9t3RWp727lLCeJLo8QRAGhVb8iN6eX49g=";
-    persistencedSha256 = "sha256-qe8e1Nxla7F0U88AbnOZm6cHxo57pnLCqtjdvOvq9jk=";
+    version = "550.100";
+    sha256_64bit = "sha256-imtfsoe/EfUFZzR4S9pkwQZKCcKqefayJewPtW0jgC0=";
+    sha256_aarch64 = "sha256-AWHdMtCci8i7maNjVapOT6kyVuFaP81jJyTRLjEyMzo=";
+    openSha256 = "sha256-3g0f88xGMTB0mx4kVan3ipLtnJFFIKi58ss/1lqC3Sw=";
+    settingsSha256 = "sha256-cDxhzZCDLtXOas5OlodNYGIuscpKmIGyvhC/kAQaxLc=";
+    persistencedSha256 = "sha256-gXHBR2+1+YZE2heRArfrZpEF3rO7R92ChuQN+ISpil8=";
   };
 
   latest = selectHighestVersion production (generic {
diff --git a/pkgs/os-specific/linux/rtl8852bu/default.nix b/pkgs/os-specific/linux/rtl8852bu/default.nix
index cc0f495b8122..4b5366cab9d0 100644
--- a/pkgs/os-specific/linux/rtl8852bu/default.nix
+++ b/pkgs/os-specific/linux/rtl8852bu/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "rtl8852bu";
-  version = "${kernel.version}-unstable-2024-03-28";
+  version = "${kernel.version}-unstable-2024-05-25";
 
   src = fetchFromGitHub {
     owner = "morrownr";
-    repo = "rtl8852bu";
-    rev = "f6aaa3c0094c541d9b0347926c76c1e9cc4a49d1";
-    hash = "sha256-Jbd6nixo873LU74klhhQU1qD3ahxEnywdqcF89LTRxc=";
+    repo = pname;
+    rev = "1acc7aa085bffec21a91fdc9e293378e06bf25e7";
+    hash = "sha256-22vzAdzzM5YnfU8kRWSK3HXxw6BA4FOWXLdWEb7T5IE=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   meta = with lib; {
-    description = "Driver for Realtek rtl8852au and rtl8832bu chipsets, provides the 8852au mod";
+    description = "Driver for Realtek rtl8852bu and rtl8832bu chipsets, provides the 8852bu mod";
     homepage = "https://github.com/morrownr/rtl8852bu";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/pkgs/servers/bililiverecorder/default.nix b/pkgs/servers/bililiverecorder/default.nix
index 4d69c4631d5c..5a1dcf4f2e79 100644
--- a/pkgs/servers/bililiverecorder/default.nix
+++ b/pkgs/servers/bililiverecorder/default.nix
@@ -13,8 +13,8 @@ let
     aspnetcore_6_0
   ];
 
-  version = "2.11.1";
-  hash = "sha256-GY6YRgebWeJtjAIm64Pf8wx6pUdZjbevNzKRdyPi1ow=";
+  version = "2.12.0";
+  hash = "sha256-2usiJTGA2FcJ9HBs3RDiARfC2yv/UqBgmT+z5F5Y7w0=";
 
 in
 stdenv.mkDerivation {
diff --git a/pkgs/servers/sql/rqlite/default.nix b/pkgs/servers/sql/rqlite/default.nix
index 146f2b87968f..4add347a24a2 100644
--- a/pkgs/servers/sql/rqlite/default.nix
+++ b/pkgs/servers/sql/rqlite/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "rqlite";
-  version = "8.26.3";
+  version = "8.26.6";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YtAQc2Qb7wo4whT7UMXItgbufDfNZPGR2XxL1oEtitk=";
+    sha256 = "sha256-Mn6rju0DioW2xI9tz0e9Sy4H4tg6StpYn7NjJRxzfAI=";
   };
 
   vendorHash = "sha256-bzK6PYSg9z1QS+5Vk6pPM10ddrLVRm0C7rmepZt4b0M=";
diff --git a/pkgs/servers/web-apps/lemmy/package.json b/pkgs/servers/web-apps/lemmy/package.json
deleted file mode 100644
index 97600d6801a2..000000000000
--- a/pkgs/servers/web-apps/lemmy/package.json
+++ /dev/null
@@ -1,149 +0,0 @@
-{
-  "name": "lemmy-ui",
-  "description": "An isomorphic UI for lemmy",
-  "version": "0.19.3",
-  "author": "Dessalines <tyhou13@gmx.com>",
-  "license": "AGPL-3.0-only",
-  "scripts": {
-    "analyze": "webpack --mode=none",
-    "build:dev": "webpack --env COMMIT_HASH=$(git rev-parse --short HEAD) --mode=development",
-    "build:prod": "webpack --env COMMIT_HASH=$(git rev-parse --short HEAD) --mode=production",
-    "clean": "yarn run rimraf dist",
-    "dev": "yarn build:dev --watch",
-    "lint": "yarn translations:generate && tsc --noEmit && eslint --report-unused-disable-directives --ext .js,.ts,.tsx \"src/**\" && prettier --check \"src/**/*.{ts,tsx,js,css,scss}\"",
-    "postinstall": "husky install",
-    "prebuild:dev": "yarn clean && node generate_translations.js",
-    "prebuild:prod": "yarn clean && node generate_translations.js",
-    "prepare": "husky install",
-    "themes:build": "sass src/assets/css/themes/:src/assets/css/themes",
-    "themes:watch": "sass --watch src/assets/css/themes/:src/assets/css/themes",
-    "translations:generate": "node generate_translations.js",
-    "translations:init": "git submodule init && yarn translations:update",
-    "translations:update": "git submodule update --remote --recursive"
-  },
-  "repository": "https://github.com/LemmyNet/lemmy-ui",
-  "engines": {
-    "node": ">=8.9.0"
-  },
-  "dependencies": {
-    "@babel/plugin-proposal-class-properties": "^7.18.6",
-    "@babel/plugin-proposal-decorators": "^7.23.7",
-    "@babel/plugin-transform-runtime": "^7.23.7",
-    "@babel/plugin-transform-typescript": "^7.23.6",
-    "@babel/preset-env": "^7.23.8",
-    "@babel/preset-typescript": "^7.21.5",
-    "@babel/runtime": "^7.23.8",
-    "@emoji-mart/data": "^1.1.0",
-    "@shortcm/qr-image": "^9.0.2",
-    "autosize": "^6.0.1",
-    "babel-loader": "^9.1.3",
-    "babel-plugin-inferno": "^6.7.1",
-    "bootstrap": "^5.3.1",
-    "check-password-strength": "^2.0.7",
-    "classnames": "^2.5.1",
-    "clean-webpack-plugin": "^4.0.0",
-    "cookie": "^0.6.0",
-    "copy-webpack-plugin": "^12.0.2",
-    "css-loader": "^6.9.1",
-    "date-fns": "^3.2.0",
-    "emoji-mart": "^5.4.0",
-    "emoji-short-name": "^2.0.0",
-    "express": "~4.18.2",
-    "history": "^5.3.0",
-    "html-to-text": "^9.0.5",
-    "husky": "^8.0.3",
-    "i18next": "^23.7.16",
-    "inferno": "^8.2.3",
-    "inferno-create-element": "^8.2.3",
-    "inferno-helmet": "^5.2.1",
-    "inferno-hydrate": "^8.2.3",
-    "inferno-i18next-dess": "0.0.2",
-    "inferno-router": "^8.2.3",
-    "inferno-server": "^8.2.3",
-    "jwt-decode": "^4.0.0",
-    "lemmy-js-client": "0.19.2-alpha.1",
-    "lodash.isequal": "^4.5.0",
-    "markdown-it": "^14.0.0",
-    "markdown-it-bidi": "^0.1.0",
-    "markdown-it-container": "^4.0.0",
-    "markdown-it-emoji": "^3.0.0",
-    "markdown-it-footnote": "^4.0.0",
-    "markdown-it-highlightjs": "^4.0.1",
-    "markdown-it-html5-embed": "^1.0.0",
-    "markdown-it-ruby": "^0.1.1",
-    "markdown-it-sub": "^2.0.0",
-    "markdown-it-sup": "^2.0.0",
-    "mini-css-extract-plugin": "^2.7.7",
-    "register-service-worker": "^1.7.2",
-    "run-node-webpack-plugin": "^1.3.0",
-    "rxjs": "^7.8.1",
-    "sanitize-html": "^2.11.0",
-    "sass": "^1.70.0",
-    "sass-loader": "^14.0.0",
-    "serialize-javascript": "^6.0.2",
-    "service-worker-webpack": "^1.0.0",
-    "sharp": "0.32.6",
-    "tippy.js": "^6.3.7",
-    "toastify-js": "^1.12.0",
-    "tributejs": "^5.1.3",
-    "webpack": "^5.89.0",
-    "webpack-cli": "^5.1.4",
-    "webpack-node-externals": "^3.0.0"
-  },
-  "devDependencies": {
-    "@babel/core": "^7.23.7",
-    "@types/autosize": "^4.0.0",
-    "@types/bootstrap": "^5.2.6",
-    "@types/cookie": "^0.6.0",
-    "@types/express": "^4.17.17",
-    "@types/html-to-text": "^9.0.0",
-    "@types/lodash.isequal": "^4.5.6",
-    "@types/markdown-it": "^13.0.7",
-    "@types/markdown-it-container": "^2.0.6",
-    "@types/node": "^20.11.5",
-    "@types/path-browserify": "^1.0.0",
-    "@types/sanitize-html": "^2.9.0",
-    "@types/serialize-javascript": "^5.0.1",
-    "@types/toastify-js": "^1.12.0",
-    "@typescript-eslint/eslint-plugin": "^6.19.0",
-    "@typescript-eslint/parser": "^6.19.0",
-    "eslint": "^8.56.0",
-    "eslint-plugin-inferno": "^7.33.3",
-    "eslint-plugin-jsx-a11y": "^6.7.1",
-    "eslint-plugin-prettier": "^5.1.3",
-    "import-sort-style-module": "^6.0.0",
-    "lint-staged": "^15.2.0",
-    "prettier": "^3.2.4",
-    "prettier-plugin-import-sort": "^0.0.7",
-    "prettier-plugin-organize-imports": "^3.2.3",
-    "prettier-plugin-packagejson": "^2.4.9",
-    "rimraf": "^5.0.0",
-    "sortpack": "^2.4.0",
-    "style-loader": "^3.3.4",
-    "terser": "^5.27.0",
-    "typescript": "^5.3.3",
-    "typescript-language-server": "^4.3.1",
-    "webpack-bundle-analyzer": "^4.9.0",
-    "webpack-dev-server": "4.15.1"
-  },
-  "lint-staged": {
-    "*.{css, scss}": [
-      "prettier --write"
-    ],
-    "*.{ts,tsx,js}": [
-      "prettier --write",
-      "eslint --fix"
-    ],
-    "package.json": [
-      "sortpack"
-    ]
-  },
-  "packageManager": "yarn@1.22.19",
-  "engineStrict": true,
-  "importSort": {
-    ".js, .jsx, .ts, .tsx": {
-      "style": "module",
-      "parser": "typescript"
-    }
-  }
-}
diff --git a/pkgs/servers/web-apps/lemmy/pin.json b/pkgs/servers/web-apps/lemmy/pin.json
index fdab1c9d63d6..36c61ba3d92b 100644
--- a/pkgs/servers/web-apps/lemmy/pin.json
+++ b/pkgs/servers/web-apps/lemmy/pin.json
@@ -1,8 +1,8 @@
 {
-  "serverVersion": "0.19.3",
-  "uiVersion": "0.19.3",
-  "serverHash": "sha256-iO7bY2oChx0cZbwgXMrrV4e1kffop9s4xmepNywnApU=",
-  "serverCargoHash": "sha256-XXfg0o/LQ/imnsHsREoBXMDP1hU5Stxv0s6AP+o+USc=",
-  "uiHash": "sha256-6GGiKCNL0PALdz0W0d1OOPyMIA5kaoL3148j9GWzrMM=",
-  "uiYarnDepsHash": "sha256-UQ+B2vF34L+HuisyO7wdW2zCfEEGa8YdnoaB4jHi+DY="
+  "serverVersion": "0.19.5",
+  "uiVersion": "0.19.5",
+  "serverHash": "sha256-ellHimZdbB5EQSHVsppBNYyZOODpUADvUn7u6JOu1ns=",
+  "serverCargoHash": "sha256-UdFw8RPKYLqY98So8z9kiaVCl3b8KaqIoUMK/EV2uNM=",
+  "uiHash": "sha256-bhbZQ8tDnJ6TWYj+ki/JQW8cbVjRfLzxaXRDX9JAIm4=",
+  "uiPNPMDepsHash": "sha256-aJPa46a2W8xHlDzFt0QMFQtEoUSkFQtN9VhaQOvoVio="
 }
diff --git a/pkgs/servers/web-apps/lemmy/server.nix b/pkgs/servers/web-apps/lemmy/server.nix
index d4d44c473f5c..8cb65bfef2bf 100644
--- a/pkgs/servers/web-apps/lemmy/server.nix
+++ b/pkgs/servers/web-apps/lemmy/server.nix
@@ -50,6 +50,10 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [
     # test requires database access
     "--skip=session_middleware::tests::test_session_auth"
+
+    # tests require network access
+    "--skip=scheduled_tasks::tests::test_nodeinfo_mastodon_social"
+    "--skip=scheduled_tasks::tests::test_nodeinfo_voyager_lemmy_ml"
   ];
 
   passthru.updateScript = ./update.py;
@@ -59,7 +63,7 @@ rustPlatform.buildRustPackage rec {
     description = "🐀 Building a federated alternative to reddit in rust";
     homepage = "https://join-lemmy.org/";
     license = licenses.agpl3Only;
-    maintainers = with maintainers; [ happysalada billewanick ];
+    maintainers = with maintainers; [ happysalada billewanick georgyo ];
     mainProgram = "lemmy_server";
   };
 }
diff --git a/pkgs/servers/web-apps/lemmy/ui.nix b/pkgs/servers/web-apps/lemmy/ui.nix
index 2bb1ccaeb842..b3b267d2f722 100644
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@@ -1,11 +1,11 @@
 { lib
-, mkYarnPackage
+, stdenvNoCC
 , libsass
 , nodejs
 , python3
 , pkg-config
+, pnpm_9
 , fetchFromGitHub
-, fetchYarnDeps
 , nixosTests
 , vips
 , nodePackages
@@ -14,85 +14,70 @@
 let
   pinData = lib.importJSON ./pin.json;
 
-  pkgConfig = {
-    node-sass = {
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ libsass python3 ];
-      postInstall = ''
-        LIBSASS_EXT=auto yarn --offline run build
-        rm build/config.gypi
-      '';
-    };
-    sharp = {
-      nativeBuildInputs = [ pkg-config nodePackages.node-gyp nodePackages.semver ];
-      buildInputs = [ vips ];
-      postInstall = ''
-        yarn --offline run install
-      '';
-    };
-  };
 
-  name = "lemmy-ui";
+in
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+
+  pname = "lemmy-ui";
   version = pinData.uiVersion;
 
-  src = fetchFromGitHub {
+  src = with finalAttrs; fetchFromGitHub {
     owner = "LemmyNet";
-    repo = name;
+    repo = pname;
     rev = version;
     fetchSubmodules = true;
     hash = pinData.uiHash;
   };
-in
-mkYarnPackage {
 
-  inherit src pkgConfig name version;
+  nativeBuildInputs = [
+    nodejs
+    pnpm_9.configHook
+  ];
+
+  buildInputs = [libsass vips ];
 
   extraBuildInputs = [ libsass ];
-
-  packageJSON = ./package.json;
-  offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
-    hash = pinData.uiYarnDepsHash;
+  pnpmDeps = pnpm_9.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = pinData.uiPNPMDepsHash;
   };
 
-  patchPhase = ''
-    substituteInPlace ./package.json \
-      --replace '$(git rev-parse --short HEAD)' "${src.rev}" \
-      --replace 'yarn clean' 'yarn --offline clean' \
-      --replace 'yarn run rimraf dist' 'yarn --offline run rimraf dist'
-  '';
-
-  yarnPreBuild = ''
-    export npm_config_nodedir=${nodejs}
-  '';
-
   buildPhase = ''
-    # Yarn writes cache directories etc to $HOME.
-    export HOME=$PWD/yarn_home
+    runHook preBuild
 
-    ln -sf $PWD/node_modules $PWD/deps/lemmy-ui/
-    echo 'export const VERSION = "${version}";' > $PWD/deps/lemmy-ui/src/shared/version.ts
+    pnpm build:prod
 
-    yarn --offline build:prod
+    runHook postBuild
   '';
 
-  preInstall = ''
+  # installPhase = ''
+  #     runHook preInstall
+
+  #     mkdir -p $out/{bin,lib/${finalAttrs.pname}}
+  #     mv {dist,node_modules} $out/lib/${finalAttrs.pname}
+
+  #     runHook postInstall
+
+  #  '';
+    preInstall = ''
     mkdir $out
-    cp -R ./deps/lemmy-ui/dist $out
+    cp -R ./dist $out
     cp -R ./node_modules $out
   '';
 
+
   distPhase = "true";
 
   passthru.updateScript = ./update.py;
   passthru.tests.lemmy-ui = nixosTests.lemmy;
-  passthru.commit_sha = src.rev;
+  passthru.commit_sha = finalAttrs.src.rev;
 
   meta = with lib; {
     description = "Building a federated alternative to reddit in rust";
     homepage = "https://join-lemmy.org/";
     license = licenses.agpl3Only;
-    maintainers = with maintainers; [ happysalada billewanick ];
+    maintainers = with maintainers; [ happysalada billewanick georgyo ];
     inherit (nodejs.meta) platforms;
   };
-}
+})
diff --git a/pkgs/servers/web-apps/lemmy/update.py b/pkgs/servers/web-apps/lemmy/update.py
index 4e867553b790..c9ce4e6e8823 100755
--- a/pkgs/servers/web-apps/lemmy/update.py
+++ b/pkgs/servers/web-apps/lemmy/update.py
@@ -30,7 +30,7 @@ class Pin:
     serverHash: str = ""
     serverCargoHash: str = ""
     uiHash: str = ""
-    uiYarnDepsHash: str = ""
+    uiPNPMDepsHash: str = ""
 
     filename: Optional[str] = None
 
@@ -136,18 +136,10 @@ def make_server_pin(pin: Pin, attr: str) -> None:
     pin.write()
 
 
-def make_ui_pin(pin: Pin, package_json: str, attr: str) -> None:
-    # Save a copy of package.json
-    print("Getting package.json")
-    with urlopen(
-        f"https://raw.githubusercontent.com/{OWNER}/{UI_REPO}/{pin.uiVersion}/package.json"
-    ) as resp:
-        with open(os.path.join(SCRIPT_DIR, package_json), "wb") as fd:
-            fd.write(resp.read())
-
+def make_ui_pin(pin: Pin, attr: str) -> None:
     pin.uiHash = prefetch_github(OWNER, UI_REPO, pin.uiVersion)
     pin.write()
-    pin.uiYarnDepsHash = get_fod_hash(attr)
+    pin.uiPNPMDepsHash = get_fod_hash(attr)
     pin.write()
 
 
@@ -160,4 +152,4 @@ if __name__ == "__main__":
 
     pin = Pin(server_version, ui_version, filename=os.path.join(SCRIPT_DIR, "pin.json"))
     make_server_pin(pin, "lemmy-server")
-    make_ui_pin(pin, "package.json", "lemmy-ui")
+    make_ui_pin(pin, "lemmy-ui")
diff --git a/pkgs/shells/hishtory/default.nix b/pkgs/shells/hishtory/default.nix
index d7875fc7c0b2..4afb7400a480 100644
--- a/pkgs/shells/hishtory/default.nix
+++ b/pkgs/shells/hishtory/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "hishtory";
-  version = "0.297";
+  version = "0.298";
 
   src = fetchFromGitHub {
     owner = "ddworken";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-qc+TmExj7x7bH5XzppVpwMt7oSK8CtBM/tHAXs4rrlE=";
+    hash = "sha256-9hs9XLDq1B3a9t+ohDBOj3fm25hMk0jXQI0SnyMAczM=";
   };
 
   vendorHash = "sha256-zTwZ/sMhQdlf7RYfR2/K/m08U1Il0VQmYFyNNiYsWhc=";
@@ -33,7 +33,7 @@ buildGoModule rec {
     description = "Your shell history: synced, queryable, and in context";
     homepage = "https://github.com/ddworken/hishtory";
     license = licenses.mit;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
     mainProgram = "hishtory";
   };
 }
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 753cf96af757..5e5f2be12ba6 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -25,7 +25,7 @@ assert crossSystem == localSystem;
 let
   inherit (localSystem) system;
 
-  useAppleSDKLibs = localSystem.isAarch64;
+  useAppleSDKLibs = lib.versionAtLeast localSystem.darwinSdkVersion "11";
 
   commonImpureHostDeps = [
     "/bin/sh"
diff --git a/pkgs/stdenv/darwin/override-sdk.nix b/pkgs/stdenv/darwin/override-sdk.nix
index 6de67537b499..02d3cd4fb747 100644
--- a/pkgs/stdenv/darwin/override-sdk.nix
+++ b/pkgs/stdenv/darwin/override-sdk.nix
@@ -403,13 +403,13 @@ let
     stdenv.override (
       old:
       {
-        buildPlatform = mkPlatform newVersion old.buildPlatform;
-        hostPlatform = mkPlatform newVersion old.hostPlatform;
-        targetPlatform = mkPlatform newVersion old.targetPlatform;
+        buildPlatform = mkPlatform newVersion stdenv.buildPlatform;
+        hostPlatform = mkPlatform newVersion stdenv.hostPlatform;
+        targetPlatform = mkPlatform newVersion stdenv.targetPlatform;
       }
       # Only perform replacements if the SDK version has changed. Changing only the
       # deployment target does not require replacing the libc or SDK dependencies.
-      // lib.optionalAttrs (old.hostPlatform.darwinSdkVersion != darwinSdkVersion) {
+      // lib.optionalAttrs (stdenv.hostPlatform.darwinSdkVersion != darwinSdkVersion) {
         allowedRequisites = null;
 
         mkDerivationFromStdenv = extendMkDerivationArgs old (mapInputsToSDK [
diff --git a/pkgs/tools/admin/azure-cli/README.md b/pkgs/tools/admin/azure-cli/README.md
index 30936ded0a75..ec98c8cb7d24 100644
--- a/pkgs/tools/admin/azure-cli/README.md
+++ b/pkgs/tools/admin/azure-cli/README.md
@@ -1,5 +1,22 @@
 # Azure CLI
 
+## Updating the CLI
+
+- Update `version` and `src.hash` in default.nix
+- Check out the changes made to the azure-cli [setup.py](https://github.com/Azure/azure-cli/blob/dev/src/azure-cli/setup.py) since the last release
+- Try build the CLI, will likely fail with `ModuleNotFoundError`, for example
+  ```
+   ModuleNotFoundError: No module named 'azure.mgmt.storage.v2023_05_01'
+  ```
+  Sometimes it will also fail with other import errors.
+- Check the referenced module (`azure-mgmt-storage`) in the setup.py
+- Find the actual version required, for example
+  ```
+    'azure-mgmt-storage==21.2.0',
+  ```
+- Update version and hash of this dependency in python-packages.nix
+- Repeat until it builds
+
 ## Extensions
 
 There are two sets of extensions: the one in `extensions-generated.nix` is generated with the script
diff --git a/pkgs/tools/admin/azure-cli/default.nix b/pkgs/tools/admin/azure-cli/default.nix
index 89bd83d23a1b..e0f503401426 100644
--- a/pkgs/tools/admin/azure-cli/default.nix
+++ b/pkgs/tools/admin/azure-cli/default.nix
@@ -4,8 +4,9 @@
 , stdenvNoCC
 , fetchurl
 , fetchFromGitHub
+, runCommand
 , installShellFiles
-, python3
+, python311
 
   # Whether to include patches that enable placing certain behavior-defining
   # configuration files in the Nix store.
@@ -18,18 +19,23 @@
 }:
 
 let
-  version = "2.61.0";
+  version = "2.62.0";
 
   src = fetchFromGitHub {
     name = "azure-cli-${version}-src";
     owner = "Azure";
     repo = "azure-cli";
     rev = "azure-cli-${version}";
-    hash = "sha256-RmCZigDenbX8OoIZeY087ga2AP8yRckyG0qZnN9gg44=";
+    hash = "sha256-Rb27KRAb50YzTZzMs6n8g04x14ni3rIYAL3c5j/ieRw=";
   };
 
+  # Pin Python version to 3.11.
+  # See https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574/53
+  # and https://github.com/Azure/azure-cli/issues/27673
+  python3 = python311;
+
   # put packages that needs to be overridden in the py package scope
-  py = callPackage ./python-packages.nix { inherit src version; };
+  py = callPackage ./python-packages.nix { inherit src version python3; };
 
   # Builder for Azure CLI extensions. Extensions are Python wheels that
   # outside of nix would be fetched by the CLI itself from various sources.
@@ -55,7 +61,7 @@ let
 
   extensions =
     callPackages ./extensions-generated.nix { inherit mkAzExtension; }
-    // callPackages ./extensions-manual.nix { inherit mkAzExtension; };
+    // callPackages ./extensions-manual.nix { inherit mkAzExtension python3; python3Packages = python3.pkgs; };
 
   extensionDir = stdenvNoCC.mkDerivation {
     name = "azure-cli-extensions";
@@ -347,6 +353,42 @@ py.pkgs.toPythonApplication (py.pkgs.buildAzureCliPackage rec {
   passthru = {
     inherit extensions;
     withExtensions = extensions: azure-cli.override { withExtensions = extensions; };
+    tests = {
+      # Test the package builds with some extensions configured, and the
+      # wanted extensions are recognized by the CLI and listed in the output.
+      azWithExtensions =
+        let
+          extensions = with azure-cli.extensions; [
+            aks-preview
+            azure-devops
+            rdbms-connect
+          ];
+          extensionNames = map (ext: ext.pname) extensions;
+          az = (azure-cli.withExtensions extensions);
+        in
+        runCommand "test-az-with-extensions" { } ''
+          export HOME=$TMPDIR
+          ${lib.getExe az} extension list > $out
+          for ext in ${lib.concatStringsSep " " extensionNames}; do
+            if ! grep -q $ext $out; then
+              echo "Extension $ext not found in list"
+              exit 1
+            fi
+          done
+        '';
+      # Test the package builds with mutable config.
+      # TODO: Maybe we can install an extension from local python wheel to
+      #       check mutable extension install still works.
+      azWithMutableConfig =
+        let
+          az = azure-cli.override { withImmutableConfig = false; };
+        in
+        runCommand "test-az-with-immutable-config" { } ''
+          export HOME=$TMPDIR
+          ${lib.getExe az} --version || exit 1
+          touch $out
+        '';
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/admin/azure-cli/extensions-manual.nix b/pkgs/tools/admin/azure-cli/extensions-manual.nix
index 66c2268bffbb..8d4a7f642b02 100644
--- a/pkgs/tools/admin/azure-cli/extensions-manual.nix
+++ b/pkgs/tools/admin/azure-cli/extensions-manual.nix
@@ -6,6 +6,7 @@
 , mkAzExtension
 , mycli
 , python3Packages
+, python3
 }:
 
 {
@@ -31,7 +32,7 @@
       pymysql
       setproctitle
     ]) ++ [
-      mycli
+      (mycli.override { inherit python3; })
     ];
     meta.maintainers = with lib.maintainers; [ obreitwi ];
   };
diff --git a/pkgs/tools/admin/azure-cli/python-packages.nix b/pkgs/tools/admin/azure-cli/python-packages.nix
index 9fc836fb803b..d2eedff5499e 100644
--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -114,6 +114,7 @@ let
       azure-mgmt-cdn = overrideAzureMgmtPackage super.azure-mgmt-cdn "12.0.0" "zip" "sha256-t8PuIYkjS0r1Gs4pJJJ8X9cz8950imQtbVBABnyMnd0=";
       azure-mgmt-compute = overrideAzureMgmtPackage super.azure-mgmt-compute "31.0.0" "tar.gz" "sha256-WlscT8GhnssCKhLe0b6LGxVfaXnQP7nvwEZC9gZkS78=";
       azure-mgmt-core = overrideAzureMgmtPackage super.azure-mgmt-core "1.3.2" "zip" "sha256-B/Sv6COlXXBLBI1h7f3BMYwFHtWfJEAyEmNQvpXp1QE=";
+      azure-mgmt-cosmosdb = overrideAzureMgmtPackage super.azure-mgmt-cosmosdb "9.5.1" "tar.gz" "sha256-TlXTlz8RzwLPeoBVruhmFSM9fL47siegfBdrrIvH7wI=";
       azure-mgmt-datalake-store = overrideAzureMgmtPackage super.azure-mgmt-datalake-store "0.5.0" "zip" "sha256-k3bTVJVmHRn4rMVgT2ewvFlJOxg1u8SA+aGVL5ABekw=";
       azure-mgmt-devtestlabs = overrideAzureMgmtPackage super.azure-mgmt-devtestlabs "4.0.0" "zip" "sha256-WVScTEBo8mRmsQl7V0qOUJn7LNbIvgoAOVsG07KeJ40=";
       azure-mgmt-dns = overrideAzureMgmtPackage super.azure-mgmt-dns "8.0.0" "zip" "sha256-QHwtrLM1E/++nKS+Wt216dS64Mt++mE8P31THve/jeg=";
@@ -140,12 +141,11 @@ let
       azure-mgmt-servicefabric = overrideAzureMgmtPackage super.azure-mgmt-servicefabric "2.1.0" "tar.gz" "sha256-oIQzBJVUQ2yQhEvIqWgg6INplITm/8mQMv0lcfjF99Y=";
       azure-mgmt-servicelinker = overrideAzureMgmtPackage super.azure-mgmt-servicelinker "1.2.0b2" "tar.gz" "sha256-PpEFMM8ri9OgAa79dGhvPKy5YFfDZZustBUDieQrtZU=";
       azure-mgmt-signalr = overrideAzureMgmtPackage super.azure-mgmt-signalr "2.0.0b1" "tar.gz" "sha256-oK2ceBEoQ7gAeG6mye+x8HPzQU9bUNRPVJtRW2GL4xg=";
-      azure-mgmt-sql = overrideAzureMgmtPackage super.azure-mgmt-sql "4.0.0b16" "tar.gz" "sha256-+6QKEROlbXe0oCj4qtB+r4/yCPZD4N+71e5Z1Z/zXV0=";
+      azure-mgmt-sql = overrideAzureMgmtPackage super.azure-mgmt-sql "4.0.0b17" "tar.gz" "sha256-i9VNbYJ3TgzURbtYYrXw+ez4ubK7BH39/EIL5kqb9Xg=";
       azure-mgmt-sqlvirtualmachine = overrideAzureMgmtPackage super.azure-mgmt-sqlvirtualmachine "1.0.0b5" "zip" "sha256-ZFgJflgynRSxo+B+Vso4eX1JheWlDQjfJ9QmupXypMc=";
-      azure-mgmt-storage = overrideAzureMgmtPackage super.azure-mgmt-storage "21.1.0" "tar.gz" "sha256-1tPA6RfJiLye0Eckd9PvP5CIYAnrHZenEZRPg3VjAWI=";
+      azure-mgmt-storage = overrideAzureMgmtPackage super.azure-mgmt-storage "21.2.0" "tar.gz" "sha256-KHyYQLAb6TGBnUA9p+1SvWL9B3sFKd1HDm28T+3ksg0=";
       azure-mgmt-synapse = overrideAzureMgmtPackage super.azure-mgmt-synapse "2.1.0b5" "zip" "sha256-5E6Yf1GgNyNVjd+SeFDbhDxnOA6fOAG6oojxtCP4m+k=";
       azure-mgmt-trafficmanager = overrideAzureMgmtPackage super.azure-mgmt-trafficmanager "1.0.0" "zip" "sha256-R0F2HoA0bE7dTLPycTaOqYBj+ATQFeJFwv4EjtK1lqg=";
-
       azure-storage-common = overrideAzureMgmtPackage super.azure-storage-common "1.4.2" "tar.gz" "sha256-Tsh8dTfUV+yVJS4ORkd+LBzPM3dP/v0F2FRGgssK5AE=";
       azure-synapse-accesscontrol = overrideAzureMgmtPackage super.azure-synapse-accesscontrol "0.5.0" "zip" "sha256-g14ySiByqPgkJGRH8EnIRJO9Q6H2usS5FOeMCQiUuwQ=";
       azure-synapse-spark = overrideAzureMgmtPackage super.azure-synapse-spark "0.2.0" "zip" "sha256-OQ5brhweEIrtN2iP4I5NacdC9t3YUiGIVhhqSs3FMuI=";
diff --git a/pkgs/tools/admin/fits-cloudctl/default.nix b/pkgs/tools/admin/fits-cloudctl/default.nix
index 84cf2ff08d57..e4c56659c733 100644
--- a/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,8 +5,8 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.12.20"; # also update these 3 vars:
-  gitversion = "tags/v0.12.20-0-g0a0d89a"; # git describe --long --all
+  version = "0.12.21"; # also update these 3 vars:
+  gitversion = "tags/v0.12.21-0-g0a0d89a"; # git describe --long --all
   gitsha = "0a0d89a8";                     # git rev-parse --short=8 HEAD
   gittime = "2024-05-15T17:34:46+02:00";   # date --iso-8601=seconds
 
@@ -14,10 +14,10 @@ buildGoModule rec {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    hash = "sha256-WDqdp9E9O6nzwLJNwljV2FcgTqdEVVRppOeNxrSrBv8=";
+    hash = "sha256-O3wX7IW2puMg0xhOf9BUfxzCMCKHxtPJxOCpc+wY0Ao=";
   };
 
-  vendorHash = "sha256-18iCTv0H9X3IccWsTD44qEEt9nXnq/En5zoqEwkC8Bs=";
+  vendorHash = "sha256-YSWO7Y9qtqCWfAMnzSMOWlXezjnggMLV8xF42vgOS7s=";
 
   ldflags = [
     "-X github.com/metal-stack/v.Version=${version}"
diff --git a/pkgs/tools/backup/borgbackup/default.nix b/pkgs/tools/backup/borgbackup/default.nix
index 778f5a5aad9f..ab43dfbef0ce 100644
--- a/pkgs/tools/backup/borgbackup/default.nix
+++ b/pkgs/tools/backup/borgbackup/default.nix
@@ -19,14 +19,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
-  version = "1.2.8";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "borgbackup";
     repo = "borg";
     rev = "refs/tags/${version}";
-    hash = "sha256-+FHqOVuHlY9QUjCrYVnrMBZPMFH9Z2U7eZ6eUSINSrw=";
+    hash = "sha256-n1hCM7Sp0t2bOJEzErEd1PS/Xc7c+KDmJ4PjQuuF140=";
   };
 
   postPatch = ''
@@ -82,7 +82,6 @@ python.pkgs.buildPythonApplication rec {
   nativeCheckInputs = with python.pkgs; [
     e2fsprogs
     py
-    python-dateutil
     pytest-benchmark
     pytest-xdist
     pytestCheckHook
@@ -121,6 +120,8 @@ python.pkgs.buildPythonApplication rec {
 
   outputs = [ "out" "doc" "man" ];
 
+  disabled = python.pythonOlder "3.9";
+
   meta = with lib; {
     changelog = "https://github.com/borgbackup/borg/blob/${src.rev}/docs/changes.rst";
     description = "Deduplicating archiver with compression and encryption";
diff --git a/pkgs/tools/backup/borgmatic/default.nix b/pkgs/tools/backup/borgmatic/default.nix
index dba8cf36b3a0..7a0793c2763b 100644
--- a/pkgs/tools/backup/borgmatic/default.nix
+++ b/pkgs/tools/backup/borgmatic/default.nix
@@ -1,34 +1,26 @@
-{ lib
-, stdenv
-, borgbackup
-, coreutils
-, python3Packages
-, fetchpatch
-, fetchPypi
-, systemd
-, enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
-, installShellFiles
-, borgmatic
-, testers
+{
+  borgbackup,
+  borgmatic,
+  coreutils,
+  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  fetchPypi,
+  fetchpatch,
+  installShellFiles,
+  lib,
+  python3Packages,
+  stdenv,
+  systemd,
+  testers,
 }:
-
 python3Packages.buildPythonApplication rec {
   pname = "borgmatic";
-  version = "1.8.11";
+  version = "1.8.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Sgj15etVx8nnk0AZv+GzWscSqfqdC7+1wBE6gF/0aL0=";
+    sha256 = "sha256-4Z5imxNjfvd4fkpFsggSO9XueN5Yzcz4RCl+BqmddCM=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "prevent-network-access-in-tests.patch";
-      url = "https://projects.torsion.org/borgmatic-collective/borgmatic/pulls/869.patch";
-      hash = "sha256-jOo3LjgvJtyTaRKZX1wfnKNdw975hVekBkKfK4mJFAc=";
-    })
-  ];
-
   nativeCheckInputs = with python3Packages; [ flexmock pytestCheckHook pytest-cov ] ++ passthru.optional-dependencies.apprise;
 
   # - test_borgmatic_version_matches_news_version
@@ -44,13 +36,13 @@ python3Packages.buildPythonApplication rec {
     colorama
     jsonschema
     packaging
-    ruamel-yaml
     requests
+    ruamel-yaml
     setuptools
   ];
 
   passthru.optional-dependencies = {
-    apprise = with python3Packages; [ apprise ];
+    apprise = [ python3Packages.apprise ];
   };
 
   postInstall = ''
@@ -72,11 +64,11 @@ python3Packages.buildPythonApplication rec {
 
   __darwinAllowLocalNetworking = true;
 
-  meta = with lib; {
+  meta = {
     description = "Simple, configuration-driven backup software for servers and workstations";
     homepage = "https://torsion.org/borgmatic/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ imlonghao ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ imlonghao x123 ];
   };
 }
diff --git a/pkgs/tools/backup/tarsnapper/default.nix b/pkgs/tools/backup/tarsnapper/default.nix
index 36842b634378..58ab9640f5e6 100644
--- a/pkgs/tools/backup/tarsnapper/default.nix
+++ b/pkgs/tools/backup/tarsnapper/default.nix
@@ -35,8 +35,10 @@ python3Packages.buildPythonApplication rec {
     pexpect
   ];
 
+  doCheck = python3Packages.pythonOlder "3.12";
+
   nativeCheckInputs = with python3Packages; [
-    pynose
+    nose
   ];
 
   # Remove standard module argparse from requirements
diff --git a/pkgs/tools/cd-dvd/cue2pops/default.nix b/pkgs/tools/cd-dvd/cue2pops/default.nix
index 6cb93b3e04be..3cce608ffdc8 100644
--- a/pkgs/tools/cd-dvd/cue2pops/default.nix
+++ b/pkgs/tools/cd-dvd/cue2pops/default.nix
@@ -5,29 +5,32 @@
 
 stdenv.mkDerivation {
   pname = "cue2pops";
-  version = "unstable-2018-01-04";
+  version = "0-unstable-2023-01-15";
 
   src = fetchFromGitHub {
     owner = "makefu";
     repo = "cue2pops-linux";
-    rev = "541863adf23fdecde92eba5899f8d58586ca4551";
-    sha256 = "05w84726g3k33rz0wwb9v77g7xh4cnhy9sxlpilf775nli9bynrk";
+    rev = "3f2be6126bd50dfe6b998bc8926f88ce9139c19a";
+    hash = "sha256-7rgYvqeH8ZDI8Vc5vnjIhe3Ke0TE1q/iFHEqucanhUM=";
   };
 
   dontConfigure = true;
 
-  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
-
   installPhase = ''
+    runHook preInstall
     install --directory --mode=755 $out/bin
     install --mode=755 cue2pops $out/bin
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Convert CUE to ISO suitable to POPStarter";
     homepage = "https://github.com/makefu/cue2pops-linux";
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.all;
+    # Upstream license is unclear.
+    # <https://github.com/ErikAndren/cue2pops-mac/issues/2#issuecomment-673983298>
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
     mainProgram = "cue2pops";
   };
 }
diff --git a/pkgs/tools/compression/keka/default.nix b/pkgs/tools/compression/keka/default.nix
index 71e979fa0c20..c2ec7cf290da 100644
--- a/pkgs/tools/compression/keka/default.nix
+++ b/pkgs/tools/compression/keka/default.nix
@@ -32,7 +32,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://www.keka.io";
     license = licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })
diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index df15ef388fee..e116304f07b4 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -318,6 +318,11 @@ in rec {
     pname = "ceph";
     inherit src version;
 
+    postPatch = ''
+      substituteInPlace cmake/modules/Finduring.cmake \
+        --replace-fail "liburing.a liburing" "uring"
+    '';
+
     nativeBuildInputs = [
       cmake
       fmt
diff --git a/pkgs/tools/filesystems/disk-inventory-x/default.nix b/pkgs/tools/filesystems/disk-inventory-x/default.nix
index 008781d4cd45..2ed895eeb3d2 100644
--- a/pkgs/tools/filesystems/disk-inventory-x/default.nix
+++ b/pkgs/tools/filesystems/disk-inventory-x/default.nix
@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://www.derlien.com";
     license = licenses.gpl3Plus;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = [ "x86_64-darwin" ];
   };
 })
diff --git a/pkgs/tools/filesystems/mountain-duck/default.nix b/pkgs/tools/filesystems/mountain-duck/default.nix
index a881eb4f998f..8eef2328b0df 100644
--- a/pkgs/tools/filesystems/mountain-duck/default.nix
+++ b/pkgs/tools/filesystems/mountain-duck/default.nix
@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://mountainduck.io";
     license = licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })
diff --git a/pkgs/tools/inputmethods/unnaturalscrollwheels/default.nix b/pkgs/tools/inputmethods/unnaturalscrollwheels/default.nix
index 6337b0d7f4f5..e47d55053865 100644
--- a/pkgs/tools/inputmethods/unnaturalscrollwheels/default.nix
+++ b/pkgs/tools/inputmethods/unnaturalscrollwheels/default.nix
@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://github.com/ther0n/UnnaturalScrollWheels";
     license = licenses.gpl3Plus;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })
diff --git a/pkgs/tools/misc/asciinema/default.nix b/pkgs/tools/misc/asciinema/default.nix
index ff8d6cd4b1e5..08d130513cd9 100644
--- a/pkgs/tools/misc/asciinema/default.nix
+++ b/pkgs/tools/misc/asciinema/default.nix
@@ -1,13 +1,13 @@
-{ lib
-, python3Packages
-, fetchFromGitHub
-, glibcLocales
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "asciinema";
   version = "2.4.0";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "asciinema";
@@ -16,23 +16,14 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-UegLwpJ+uc9cW3ozLQJsQBjIGD7+vzzwzQFRV5gmDmI=";
   };
 
-  nativeBuildInputs = [
-    python3Packages.setuptools
-  ];
+  build-system = [ python3Packages.setuptools ];
 
   postPatch = ''
     substituteInPlace tests/pty_test.py \
-      --replace "python3" "${python3Packages.python}/bin/python"
+      --replace-fail "python3" "${python3Packages.python.interpreter}"
   '';
 
-  nativeCheckInputs = [
-    glibcLocales
-    python3Packages.nose
-  ];
-
-  checkPhase = ''
-    LC_ALL=en_US.UTF-8 nosetests -v tests/config_test.py
-  '';
+  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
 
   meta = {
     description = "Terminal session recorder and the best companion of asciinema.org";
diff --git a/pkgs/tools/misc/caffeine/default.nix b/pkgs/tools/misc/caffeine/default.nix
index 6c8995192a14..1e547a5533ba 100644
--- a/pkgs/tools/misc/caffeine/default.nix
+++ b/pkgs/tools/misc/caffeine/default.nix
@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Don't let your Mac fall asleep";
     homepage = "https://intelliscapesolutions.com/apps/caffeine";
     license = licenses.mit;
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = [ "x86_64-darwin" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
diff --git a/pkgs/tools/misc/fedifetcher/default.nix b/pkgs/tools/misc/fedifetcher/default.nix
index bca508165e4f..a0902fe79a3c 100644
--- a/pkgs/tools/misc/fedifetcher/default.nix
+++ b/pkgs/tools/misc/fedifetcher/default.nix
@@ -2,14 +2,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fedifetcher";
-  version = "7.1.4";
+  version = "7.1.5";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "nanos";
     repo = "FediFetcher";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/iAmX2kBYJgtsz7b817UqLXkwVwXi7EY4KL0ZYxXYBw=";
+    hash = "sha256-dOo4QQCEGm7nZCC4k1M66wERrw+hKduvEJZIm1pEFqk=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/misc/fluent-bit/default.nix b/pkgs/tools/misc/fluent-bit/default.nix
index 20349aa8ff4d..6d5d7147cbd6 100644
--- a/pkgs/tools/misc/fluent-bit/default.nix
+++ b/pkgs/tools/misc/fluent-bit/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "3.0.7";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-AR+YmxIP6VZlpztpez6OViX1cGqoP/jeOiuzBcav1Eg=";
+    hash = "sha256-X97Z/1GBooQNH6SLH5AG6uX7BkCXCIkdh9vEE4IkUEA=";
   };
 
   # optional only to avoid linux rebuild
diff --git a/pkgs/tools/misc/netbootxyz-efi/default.nix b/pkgs/tools/misc/netbootxyz-efi/default.nix
index 2726df1b8701..89ffb7094442 100644
--- a/pkgs/tools/misc/netbootxyz-efi/default.nix
+++ b/pkgs/tools/misc/netbootxyz-efi/default.nix
@@ -15,7 +15,7 @@ in fetchurl {
     homepage = "https://netboot.xyz/";
     description = "Tool to boot OS installers and utilities over the network, to be run from a bootloader";
     license = licenses.asl20;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/dae/default.nix b/pkgs/tools/networking/dae/default.nix
index 2f8f4236837a..ad17eb9f257d 100644
--- a/pkgs/tools/networking/dae/default.nix
+++ b/pkgs/tools/networking/dae/default.nix
@@ -22,6 +22,10 @@ buildGoModule rec {
 
   nativeBuildInputs = [ clang ];
 
+  hardeningDisable = [
+    "zerocallusedregs"
+  ];
+
   buildPhase = ''
     runHook preBuild
 
diff --git a/pkgs/tools/networking/miniupnpc/default.nix b/pkgs/tools/networking/miniupnpc/default.nix
index b5d577d6139e..b643e472ea62 100644
--- a/pkgs/tools/networking/miniupnpc/default.nix
+++ b/pkgs/tools/networking/miniupnpc/default.nix
@@ -1,38 +1,36 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
 }:
 
 stdenv.mkDerivation rec {
   pname = "miniupnpc";
-  version = "2.2.7";
+  version = "2.2.8";
 
   src = fetchFromGitHub {
     owner = "miniupnp";
     repo = "miniupnp";
-    rev = "miniupnpc_${lib.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-cIijY1NcdF169tibfB13845UT9ZoJ/CZ+XLES9ctWTY=";
+    rev = "miniupnpc_${lib.replaceStrings [ "." ] [ "_" ] version}";
+    hash = "sha256-kPH5nr+rIcF3mxl+L0kN5dn+9xvQccVa8EduwhuYboY=";
   };
 
   sourceRoot = "${src.name}/miniupnpc";
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = [
+    (lib.cmakeBool "UPNPC_BUILD_SHARED" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "UPNPC_BUILD_STATIC" stdenv.hostPlatform.isStatic)
+  ];
+
   doCheck = !stdenv.isFreeBSD;
 
-  makeFlags = [ "PREFIX=$(out)" ];
-
   postInstall = ''
-    chmod +x $out/lib/libminiupnpc${stdenv.hostPlatform.extensions.sharedLibrary}
-
-    # for some reason cmake does not install binaries and manpages
-    # https://github.com/miniupnp/miniupnp/issues/637
-    mkdir -p $out/bin
-    cp -a upnpc-static $out/bin/upnpc
-    cp -a ../external-ip.sh $out/bin/external-ip
-    mkdir -p $out/share/man
-    cp -a ../man3 $out/share/man
+    mv $out/bin/upnpc-* $out/bin/upnpc
+    mv $out/bin/upnp-listdevices-* $out/bin/upnp-listdevices
+    mv $out/bin/external-ip.sh $out/bin/external-ip
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/xh/default.nix b/pkgs/tools/networking/xh/default.nix
index e0b213a120b2..5df8e7903b2b 100644
--- a/pkgs/tools/networking/xh/default.nix
+++ b/pkgs/tools/networking/xh/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xh";
-  version = "0.22.0";
+  version = "0.22.2";
 
   src = fetchFromGitHub {
     owner = "ducaale";
     repo = "xh";
     rev = "v${version}";
-    sha256 = "sha256-hppfBiWJAsJXh6eERh4RYTmSOCNlxy2BcilRM6oafjk=";
+    sha256 = "sha256-FhhVodpIdcB+2s4AkFk6phvoXFLYll/CFJV2/lHS0ww=";
   };
 
-  cargoHash = "sha256-pyOcrc8F+rdYWQtOEP6RZpaKeaMGNvc6eqFOVeBzK4k=";
+  cargoHash = "sha256-P/OLzMpqWThrdCReWcPlVPGqVSjVD1veq3xL0TJ/soM=";
 
   buildFeatures = lib.optional withNativeTls "native-tls";
 
diff --git a/pkgs/tools/package-management/comma/default.nix b/pkgs/tools/package-management/comma/default.nix
index d9e33a82ed6e..3db0be269b8e 100644
--- a/pkgs/tools/package-management/comma/default.nix
+++ b/pkgs/tools/package-management/comma/default.nix
@@ -38,6 +38,6 @@ rustPlatform.buildRustPackage rec {
     description = "Runs programs without installing them";
     license = licenses.mit;
     mainProgram = "comma";
-    maintainers = with maintainers; [ Enzime artturin ];
+    maintainers = with maintainers; [ artturin ];
   };
 }
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index 7526c21d6811..49f741617de3 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fail2ban";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "fail2ban";
     repo = "fail2ban";
     rev = version;
-    hash = "sha256-Zd8zLkFlvXTbeInEkNFyHgcAiOsX4WwF6hf5juSQvbY=";
+    hash = "sha256-0xPNhbu6/p/cbHOr5Y+PXbMbt5q/S13S5100ZZSdylE=";
   };
 
   outputs = [ "out" "man" ];
@@ -22,12 +22,12 @@ python3.pkgs.buildPythonApplication rec {
     lib.optionals stdenv.isLinux [
       systemd
       pyinotify
+
+      # https://github.com/fail2ban/fail2ban/issues/3787, remove it in the next release
+      setuptools
     ];
 
   preConfigure = ''
-    patchShebangs fail2ban-2to3
-    ./fail2ban-2to3
-
     for i in config/action.d/sendmail*.conf; do
       substituteInPlace $i \
         --replace /usr/sbin/sendmail sendmail
diff --git a/pkgs/tools/security/gotrue/supabase.nix b/pkgs/tools/security/gotrue/supabase.nix
index 92a741167782..54d196c59764 100644
--- a/pkgs/tools/security/gotrue/supabase.nix
+++ b/pkgs/tools/security/gotrue/supabase.nix
@@ -6,22 +6,22 @@
 }:
 
 buildGoModule rec {
-  pname = "gotrue";
-  version = "2.105.0";
+  pname = "auth";
+  version = "2.155.1";
 
   src = fetchFromGitHub {
     owner = "supabase";
-    repo = pname;
+    repo = "auth";
     rev = "v${version}";
-    hash = "sha256-6tFXuVBd7UptoVMSse1Pk9ok6XyGL994pfFkFTyc5I0=";
+    hash = "sha256-W2hJw/cn6Ss5LBBIJ7q0t5wbEHJ7WaGGvxrfRQ84Y8A=";
   };
 
-  vendorHash = "sha256-cwTwze8WuhL5exaY5HJYDgcxNB9O1QuFpJgZmj6R838=";
+  vendorHash = "sha256-qL1uHUNw0QqAswnP2E2UrdJKao9ow8HHVWPK010LVgI=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/supabase/gotrue/internal/utilities.Version=${version}"
+    "-X github.com/supabase/auth/internal/utilities.Version=${version}"
   ];
 
   # integration tests require network to connect to postgres database
@@ -29,15 +29,15 @@ buildGoModule rec {
 
   passthru.tests.version = testers.testVersion {
     package = gotrue-supabase;
-    command = "gotrue version";
+    command = "auth version";
     inherit version;
   };
 
   meta = with lib; {
-    homepage = "https://github.com/supabase/gotrue";
+    homepage = "https://github.com/supabase/auth";
     description = "JWT based API for managing users and issuing JWT tokens";
-    mainProgram = "gotrue";
-    changelog = "https://github.com/supabase/gotrue/releases/tag/v${version}";
+    mainProgram = "auth";
+    changelog = "https://github.com/supabase/auth/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ urandom ];
   };
diff --git a/pkgs/tools/security/ssh-to-age/default.nix b/pkgs/tools/security/ssh-to-age/default.nix
index 5392f0c8a8c4..4cf19ea2dafe 100644
--- a/pkgs/tools/security/ssh-to-age/default.nix
+++ b/pkgs/tools/security/ssh-to-age/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ssh-to-age";
-  version = "1.1.7";
+  version = "1.1.8";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "ssh-to-age";
     rev = version;
-    sha256 = "sha256-NHNjBMK4eJZSZMOg75VmpD6mVQaRJbk5GoJST9W6j4w=";
+    sha256 = "sha256-wGtNaejzAOgOuYDEKz6xMCaoaHsiDuQZj0KKpcejphE=";
   };
 
-  vendorHash = "sha256-JpZ+cdDQ3yfH0EAyzi3HO7bozGYJgCYFf2KO/lXwCf8=";
+  vendorHash = "sha256-w/REcFeH58DTQwgotxSBVR4y7aQ9rBDX2U0A4vJno7s=";
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/tools/text/csview/default.nix b/pkgs/tools/text/csview/default.nix
index 1aa63333d89c..172963858e25 100644
--- a/pkgs/tools/text/csview/default.nix
+++ b/pkgs/tools/text/csview/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "csview";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ci0PyTZJIEagBCymtrYR/ntgYym1aGKNX4COfrE99mY=";
+    sha256 = "sha256-9rjrNxMUUuH3S6fVsooscgIP+oFeQ6/gBQmuUMPDfp0=";
   };
 
-  cargoHash = "sha256-/pswnb2vNtw8zSoWuC7oZPJ4yxVuy1c4ES1NUHhnG6I=";
+  cargoHash = "sha256-/0jviI91y4eAJ0uZDQqnw9htcl+j0aybY0U5gCc9DFg=";
 
   meta = with lib; {
     description = "High performance csv viewer with cjk/emoji support";
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 2dfb2f00f662..f0b35d2f0592 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -10,7 +10,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "3.6.0";
+  version = "3.6.1";
 
   subPackages = [ "cmd/vale" ];
 
@@ -18,7 +18,7 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    hash = "sha256-Xkea1o0ywRKIg0cMJuxQehHbgVF0SSC9VRa53FQEong=";
+    hash = "sha256-CWIX5JWL8cvTq6TS7BoAXeW8RMmNcXqvCLwa/KStuMQ=";
   };
 
   vendorHash = "sha256-OLlViQKLTark9yknnjJFiEThFtxNNjue5LUp1P/anKU=";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 49b6afafdd39..5871a61f155e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1525,12 +1525,6 @@ mapAliases ({
 
   # LLVM packages for (integration) testing that should not be used inside Nixpkgs:
   llvmPackages_latest = llvmPackages_18;
-  llvmPackages_git = recurseIntoAttrs (callPackage ../development/compilers/llvm/git {
-    inherit (stdenvAdapters) overrideCC;
-    buildLlvmTools = buildPackages.llvmPackages_git.tools;
-    targetLlvmLibraries = targetPackages.llvmPackages_git.libraries or llvmPackages_git.libraries;
-    targetLlvm = targetPackages.llvmPackages_git.llvm or llvmPackages_git.llvm;
-  });
 
   /* If these are in the scope of all-packages.nix, they cause collisions
     between mixed versions of qt. See:
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6bdcb54718e7..4417e93bbcbe 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8953,6 +8953,8 @@ with pkgs;
 
   hyphen = callPackage ../development/libraries/hyphen { };
 
+  hyphenDicts = recurseIntoAttrs (callPackages ../development/libraries/hyphen/dictionaries.nix {});
+
   i2c-tools = callPackage ../os-specific/linux/i2c-tools { };
 
   i2pd = callPackage ../tools/networking/i2pd { };
@@ -13392,8 +13394,6 @@ with pkgs;
     themes = recurseIntoAttrs (getPackagesWithPrefix "theme");
   };
 
-  thefuck = python3Packages.callPackage ../tools/misc/thefuck { };
-
   theme-sh = callPackage ../tools/misc/theme-sh { };
 
   thiefmd = callPackage ../applications/editors/thiefmd { };
@@ -16127,61 +16127,33 @@ with pkgs;
     targetLlvm = targetPackages.llvmPackages_12.llvm or llvmPackages_12.llvm;
   }));
 
-  llvmPackages_13 = recurseIntoAttrs (callPackage ../development/compilers/llvm/13 ({
-    inherit (stdenvAdapters) overrideCC;
-    buildLlvmTools = buildPackages.llvmPackages_13.tools;
-    targetLlvmLibraries = targetPackages.llvmPackages_13.libraries or llvmPackages_13.libraries;
-    targetLlvm = targetPackages.llvmPackages_13.llvm or llvmPackages_13.llvm;
-    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
-  }));
+  inherit (rec {
+    llvmPackagesSet = recurseIntoAttrs (callPackages ../development/compilers/llvm { });
 
-  llvmPackages_14 = recurseIntoAttrs (callPackage ../development/compilers/llvm/14 ({
-    inherit (stdenvAdapters) overrideCC;
-    buildLlvmTools = buildPackages.llvmPackages_14.tools;
-    targetLlvmLibraries = targetPackages.llvmPackages_14.libraries or llvmPackages_14.libraries;
-    targetLlvm = targetPackages.llvmPackages_14.llvm or llvmPackages_14.llvm;
-  }));
+    llvmPackages_13 = llvmPackagesSet."13";
+    llvmPackages_14 = llvmPackagesSet."14";
+    llvmPackages_15 = llvmPackagesSet."15";
+    llvmPackages_16 = llvmPackagesSet."16";
+    llvmPackages_17 = llvmPackagesSet."17";
 
-  llvmPackages_15 = recurseIntoAttrs (callPackage ../development/compilers/llvm/15 ({
-    inherit (stdenvAdapters) overrideCC;
-    buildLlvmTools = buildPackages.llvmPackages_15.tools;
-    targetLlvmLibraries = targetPackages.llvmPackages_15.libraries or llvmPackages_15.libraries;
-    targetLlvm = targetPackages.llvmPackages_15.llvm or llvmPackages_15.llvm;
-  }));
+    llvmPackages_18 = llvmPackagesSet."18";
+    clang_18 = llvmPackages_18.clang;
+    lld_18 = llvmPackages_18.lld;
+    lldb_18 = llvmPackages_18.lldb;
+    llvm_18 = llvmPackages_18.llvm;
 
-  llvmPackages_16 = recurseIntoAttrs (callPackage ../development/compilers/llvm/16 ({
-    inherit (stdenvAdapters) overrideCC;
-    buildLlvmTools = buildPackages.llvmPackages_16.tools;
-    targetLlvmLibraries = targetPackages.llvmPackages_16.libraries or llvmPackages_16.libraries;
-    targetLlvm = targetPackages.llvmPackages_16.llvm or llvmPackages_16.llvm;
-  }));
-
-  llvmPackages_17 = recurseIntoAttrs (callPackage ../development/compilers/llvm/17 ({
-    inherit (stdenvAdapters) overrideCC;
-    buildLlvmTools = buildPackages.llvmPackages_17.tools;
-    targetLlvmLibraries = targetPackages.llvmPackages_17.libraries or llvmPackages_17.libraries;
-    targetLlvm = targetPackages.llvmPackages_17.llvm or llvmPackages_17.llvm;
-  }));
-
-  inherit
-    (rec {
-      llvmPackages_18 = recurseIntoAttrs (callPackage ../development/compilers/llvm/18 ({
-        inherit (stdenvAdapters) overrideCC;
-        buildLlvmTools = buildPackages.llvmPackages_18.tools;
-        targetLlvmLibraries = targetPackages.llvmPackages_18.libraries or llvmPackages_18.libraries;
-        targetLlvm = targetPackages.llvmPackages_18.llvm or llvmPackages_18.llvm;
-      }));
-
-      clang_18 = llvmPackages_18.clang;
-      lld_18 = llvmPackages_18.lld;
-      lldb_18 = llvmPackages_18.lldb;
-      llvm_18 = llvmPackages_18.llvm;
-    })
-      llvmPackages_18
-      clang_18
-      lld_18
-      lldb_18
-      llvm_18;
+    llvmPackages_git = llvmPackagesSet.git;
+  }) llvmPackages_13
+    llvmPackages_14
+    llvmPackages_15
+    llvmPackages_16
+    llvmPackages_17
+    llvmPackages_18
+    clang_18
+    lld_18
+    lldb_18
+    llvm_18
+    llvmPackages_git;
 
   lorri = callPackage ../tools/misc/lorri {
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
@@ -25918,11 +25890,6 @@ with pkgs;
 
   libcardiacarrest = callPackage ../misc/libcardiacarrest { };
 
-  easyeffects = callPackage ../applications/audio/easyeffects {
-    # Fix crashes with speexdsp effects
-    speexdsp = speexdsp.override { withFftw3 = false; };
-  };
-
   pulseeffects-legacy = callPackage ../applications/audio/pulseeffects-legacy { };
 
   tomcat-native = callPackage ../servers/http/tomcat/tomcat-native.nix { };
@@ -29559,8 +29526,6 @@ with pkgs;
 
   bashSnippets = callPackage ../applications/misc/bashSnippets { };
 
-  batik = callPackage ../applications/graphics/batik { };
-
   batsignal = callPackage ../applications/misc/batsignal { };
 
   baudline = callPackage ../applications/audio/baudline { };
@@ -29723,8 +29688,6 @@ with pkgs;
     podofo = podofo010;
   };
 
-  calibre-web = callPackage ../servers/calibre-web { };
-
   # calico-felix and calico-node have not been packaged due to libbpf, linking issues
   inherit (callPackage ../applications/networking/cluster/calico {})
     calico-apiserver
@@ -31249,8 +31212,6 @@ with pkgs;
 
   hex-a-hop = callPackage ../games/hex-a-hop { };
 
-  hexchat = callPackage ../applications/networking/irc/hexchat { };
-
   hexcurse = callPackage ../applications/editors/hexcurse { };
 
   hexdino = callPackage ../applications/editors/hexdino { };
@@ -31368,10 +31329,6 @@ with pkgs;
 
   meerk40t-camera = callPackage ../applications/misc/meerk40t/camera.nix { };
 
-  musikcube = callPackage ../applications/audio/musikcube {
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreAudio SystemConfiguration;
-  };
-
   libmt32emu = callPackage ../applications/audio/munt/libmt32emu.nix { };
 
   mt32emu-qt = libsForQt5.callPackage ../applications/audio/munt/mt32emu-qt.nix { };
@@ -33980,8 +33937,6 @@ with pkgs;
     libjpeg_turbo = libjpeg8;
   };
 
-  skypeforlinux = callPackage ../applications/networking/instant-messengers/skypeforlinux { };
-
   slingshot = callPackage ../tools/misc/slingshot { };
 
   slop = callPackage ../tools/misc/slop { };
@@ -34561,10 +34516,6 @@ with pkgs;
 
   tofi = callPackage ../applications/misc/tofi { };
 
-  tokyonight-gtk-theme = tokyonight-gtk-theme-variants.full;
-
-  tokyonight-gtk-theme-variants = recurseIntoAttrs (callPackage ../data/themes/tokyonight-gtk-theme { });
-
   topydo = callPackage ../applications/misc/topydo { };
 
   torrential = callPackage ../applications/networking/p2p/torrential { };
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 69d22c8b9625..2fb7539f4198 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -48,11 +48,15 @@ makeScopeWithSplicing' {
   };
 
   # Pick an SDK
-  apple_sdk = if stdenv.hostPlatform.isAarch64 then apple_sdk_11_0 else apple_sdk_10_12;
+  apple_sdk = {
+    "10.12" = apple_sdk_10_12;
+    "11.0" = apple_sdk_11_0;
+  }.${stdenv.hostPlatform.darwinSdkVersion}
+  or (throw "Unsupported sdk: ${stdenv.hostPlatform.darwinSdkVersion}");
 
   # Pick the source of libraries: either Apple's open source releases, or the
   # SDK.
-  useAppleSDKLibs = stdenv.hostPlatform.isAarch64;
+  useAppleSDKLibs = lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11";
 
   selectAttrs = attrs: names:
     lib.listToAttrs (lib.concatMap (n: lib.optionals (attrs ? "${n}") [(lib.nameValuePair n attrs."${n}")]) names);
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index e996cb41cf0c..d516da1b12e0 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -92,7 +92,7 @@ let
 
     biocaml = janeStreet_0_15.biocaml;
 
-    biotk = janeStreet_0_15.biotk;
+    biotk = callPackage ../development/ocaml-modules/biotk { };
 
     bisect_ppx = callPackage ../development/ocaml-modules/bisect_ppx { };
 
@@ -840,22 +840,6 @@ let
         cfstream = self.cfstream.override { inherit core_kernel; };
       };
 
-      biotk = let
-        angstrom = self.angstrom.override { inherit ppx_let; };
-      in callPackage ../development/ocaml-modules/biotk {
-        angstrom-unix = self.angstrom-unix.override { inherit angstrom; };
-        ppx_deriving = self.ppx_deriving.override { inherit (jsDeps) ppxlib; };
-        uri = self.uri.override { inherit angstrom; };
-        vg = self.vg.override { htmlcBackend = false; };
-      };
-
-      phylogenetics = let
-        angstrom = self.angstrom.override { inherit ppx_let; };
-      in callPackage ../development/ocaml-modules/phylogenetics {
-        ppx_deriving = self.ppx_deriving.override { inherit (jsDeps) ppxlib; };
-        angstrom-unix = self.angstrom-unix.override { inherit angstrom; };
-      };
-
       ppx_bap = callPackage ../development/ocaml-modules/ppx_bap { };
     })).overrideScope liftJaneStreet;
 
@@ -1466,7 +1450,7 @@ let
 
     pgsolver = callPackage ../development/ocaml-modules/pgsolver { };
 
-    phylogenetics = janeStreet_0_15.phylogenetics;
+    phylogenetics = callPackage ../development/ocaml-modules/phylogenetics { };
 
     piaf = callPackage ../development/ocaml-modules/piaf { };
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 5bc297c3a223..8e821257be7b 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -33,6 +33,7 @@ in
   ### Deprecated aliases - for backward compatibility
 
 mapAliases ({
+  aadict = throw "aadict was removed, it was introduced as a dependency for a package that never manifested and has been an unused leaf package ever since"; # added 2024-07-08
   abodepy = jaraco-abode; # added 2023-02-01
   acebinf = throw "acebinf has been removed because it is abandoned and broken."; # Added 2023-05-19
   adafruit-nrfutil = throw "adafruit-nrfutil has been promoted to a top-level attribute name: `pkgs.adafruit-nrfutil`."; # Added 2023-11-19
@@ -86,6 +87,7 @@ mapAliases ({
   cacheyou = throw "cacheyou has been removed, as it was no longer used for the only consumer pdm"; # added 2023-12-21
   cadquery = throw "cadquery was removed, because it was disabled on all python version since 3.8 and marked as broken"; # added 2024-05-13
   carrot = throw "carrot has been removed, as its development was discontinued in 2012"; # added 2022-01-18
+  case = throw "case has been removed, since it is an unused leaf package with a dependency on the nose test framework"; # added 2024-07-08
   cchardet = faust-cchardet; # added 2023-03-02
   cepa = throw "cepa has been removed, as onionshare switched back to stem"; # added 2024-05-07
   class-registry = phx-class-registry; # added 2021-10-05
@@ -190,6 +192,7 @@ mapAliases ({
   flufl_bounce = flufl-bounce; # added 2023-11-03
   flufl_i18n = flufl-i18n; # added 2023-11-03
   flufl_lock = flufl-lock; # added 2023-11-03
+  forbiddenfruit = throw "forbiddenfruit has been removed, because it was unmaintained and relied on the nose test framework"; # added 2024-07-08
   FormEncode = formencode; # added 2023-02-19
   foundationdb51 = throw "foundationdb51 is no longer maintained, use foundationdb71 instead"; # added 2023-06-06
   foundationdb52 = throw "foundationdb52 is no longer maintained, use foundationdb71 instead"; # added 2023-06-06
@@ -387,6 +390,7 @@ mapAliases ({
   pymssql = throw "pymssql has been abandoned upstream."; # added 2020-05-04
   PyMVGLive = pymvglive; # added 2023-02-19
   pymyq = python-myq; # added 2023-10-20
+  pynose = throw "pynose was removed, because it violates the license of nose, by redistributing modified LGPL code under MIT.";
   python-myq = throw "python-myq has been removed, as the service provider has decided to block its API requests"; # added 2023-12-07
   pyqt4 = throw "pyqt4 has been removed, because it depended on the long EOL qt4"; # added 2022-06-09
   pyqt5_sip = pyqt5-sip; # added 2024-01-07
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 39b8b28be828..d4b56d1be53f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -25,8 +25,6 @@ self: super: with self; {
 
   a2wsgi = callPackage ../development/python-modules/a2wsgi { };
 
-  aadict = callPackage ../development/python-modules/aadict { };
-
   aafigure = callPackage ../development/python-modules/aafigure { };
 
   aardwolf = callPackage ../development/python-modules/aardwolf { };
@@ -1964,8 +1962,6 @@ self: super: with self; {
 
   casbin = callPackage ../development/python-modules/casbin { };
 
-  case = callPackage ../development/python-modules/case { };
-
   cashaddress = callPackage ../development/python-modules/cashaddress { };
 
   cashews = callPackage ../development/python-modules/cashews {  };
@@ -4562,8 +4558,6 @@ self: super: with self; {
 
   foolscap = callPackage ../development/python-modules/foolscap { };
 
-  forbiddenfruit = callPackage ../development/python-modules/forbiddenfruit { };
-
   fordpass = callPackage ../development/python-modules/fordpass { };
 
   forecast-solar = callPackage ../development/python-modules/forecast-solar { };
@@ -7648,6 +7642,7 @@ self: super: with self; {
   mkdocs-autolinks-plugin = callPackage ../development/python-modules/mkdocs-autolinks-plugin { };
 
   mkdocs-autorefs = callPackage ../development/python-modules/mkdocs-autorefs { };
+  mkdocs-awesome-pages-plugin = callPackage ../development/python-modules/mkdocs-awesome-pages-plugin { };
 
   mkdocs-drawio-exporter = callPackage ../development/python-modules/mkdocs-drawio-exporter { };
 
@@ -10152,8 +10147,6 @@ self: super: with self; {
 
   pynobo = callPackage ../development/python-modules/pynobo { };
 
-  pynose = callPackage ../development/python-modules/pynose { };
-
   pynotifier = callPackage ../development/python-modules/pynotifier { };
 
   pynuki = callPackage ../development/python-modules/pynuki { };