diff --git a/nixos/modules/services/web-servers/garage.nix b/nixos/modules/services/web-servers/garage.nix
index d2a5109e266a..3186360c7051 100644
--- a/nixos/modules/services/web-servers/garage.nix
+++ b/nixos/modules/services/web-servers/garage.nix
@@ -10,7 +10,7 @@ in
 {
   meta = {
     doc = ./garage.md;
-    maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
+    maintainers = [ ];
   };
 
   options.services.garage = {
diff --git a/nixos/tests/lomiri.nix b/nixos/tests/lomiri.nix
index 9d6337e9977c..c5889d27133f 100644
--- a/nixos/tests/lomiri.nix
+++ b/nixos/tests/lomiri.nix
@@ -19,9 +19,13 @@ in {
       inherit description password;
     };
 
+    # To control mouse via scripting
+    programs.ydotool.enable = true;
+
     services.desktopManager.lomiri.enable = lib.mkForce true;
     services.displayManager.defaultSession = lib.mkForce "lomiri";
 
+    # Help with OCR
     fonts.packages = [ pkgs.inconsolata ];
 
     environment = {
@@ -114,17 +118,9 @@ in {
   enableOCR = true;
 
   testScript = { nodes, ... }: ''
-    def open_starter():
-        """
-        Open the starter, and ensure it's opened.
-        """
-        machine.send_key("meta_l-a")
-        # Look for any of the default apps
-        machine.wait_for_text(r"(Search|System|Settings|Morph|Browser|Terminal|Alacritty)")
-
     def toggle_maximise():
         """
-        Send the keybind to maximise the current window.
+        Maximise the current window.
         """
         machine.send_key("ctrl-meta_l-up")
 
@@ -135,13 +131,43 @@ in {
         machine.send_key("esc")
         machine.sleep(5)
 
+    def mouse_click(xpos, ypos):
+        """
+        Move the mouse to a screen location and hit left-click.
+        """
+
+        # Need to reset to top-left, --absolute doesn't work?
+        machine.execute("ydotool mousemove -- -10000 -10000")
+        machine.sleep(2)
+
+        # Move
+        machine.execute(f"ydotool mousemove -- {xpos} {ypos}")
+        machine.sleep(2)
+
+        # Click (C0 - left button: down & up)
+        machine.execute("ydotool click 0xC0")
+        machine.sleep(2)
+
+    def open_starter():
+        """
+        Open the starter, and ensure it's opened.
+        """
+
+        # Using the keybind has a chance of instantly closing the menu again? Just click the button
+        mouse_click(20, 30)
+
+        # Look for Search box & GUI-less content-hub examples, highest chances of avoiding false positives
+        machine.wait_for_text(r"(Search|Export|Import|Share)")
+
     start_all()
     machine.wait_for_unit("multi-user.target")
 
     # Lomiri in greeter mode should work & be able to start a session
     with subtest("lomiri greeter works"):
         machine.wait_for_unit("display-manager.service")
-        # Start page shows current tie
+        machine.wait_until_succeeds("pgrep -u lightdm -f 'lomiri --mode=greeter'")
+
+        # Start page shows current time
         machine.wait_for_text(r"(AM|PM)")
         machine.screenshot("lomiri_greeter_launched")
 
@@ -152,7 +178,6 @@ in {
 
         # Login
         machine.send_chars("${password}\n")
-        # Best way I can think of to differenciate "Lomiri in LightDM greeter mode" from "Lomiri in user shell mode"
         machine.wait_until_succeeds("pgrep -u ${user} -f 'lomiri --mode=full-shell'")
 
     # The session should start, and not be stuck in i.e. a crash loop
@@ -196,6 +221,17 @@ in {
         machine.screenshot("alacritty_opens")
         machine.send_key("alt-f4")
 
+    # Morph is how we go online
+    with subtest("morph browser works"):
+        open_starter()
+        machine.send_chars("Morph\n")
+        machine.wait_for_text(r"(Bookmarks|address|site|visited any)")
+        machine.screenshot("morph_open")
+
+        # morph-browser has a separate VM test, there isn't anything new we could test here
+
+        # Keep it running, we're using it to check content-hub communication from LSS
+
     # LSS provides DE settings
     with subtest("system settings open"):
         open_starter()
@@ -231,64 +267,57 @@ in {
         machine.wait_for_text("Morph") # or Gallery, but Morph is already packaged
         machine.screenshot("settings_content-hub_peers")
 
-        # Sadly, it doesn't seem possible to actually select a peer and attempt a content-hub data exchange with just the keyboard
+        # Select Morph as content source
+        mouse_click(300, 100)
 
-        machine.send_key("alt-f4")
+        # Expect Morph to be brought into the foreground, with its Downloads page open
+        machine.wait_for_text("No downloads")
 
-    # Morph is how we go online
-    with subtest("morph browser works"):
-        open_starter()
-        machine.send_chars("Morph\n")
-        machine.wait_for_text(r"(Bookmarks|address|site|visited any)")
-        machine.screenshot("morph_open")
+        # If content-hub encounters a problem, it may have crashed the original application issuing the request.
+        # Check that it's still alive
+        machine.succeed("pgrep -u ${user} -f lomiri-system-settings")
 
-        # morph-browser has a separate VM test, there isn't anything new we could test here
+        machine.screenshot("content-hub_exchange")
 
-        machine.send_key("alt-f4")
+        # Testing any more would require more applications & setup, the fact that it's already being attempted is a good sign
+        machine.send_key("esc")
+
+        machine.send_key("alt-f4") # LSS
+        machine.sleep(2) # focus is slow to switch to second window, closing it *really* helps with OCR afterwards
+        machine.send_key("alt-f4") # Morph
 
     # The ayatana indicators are an important part of the experience, and they hold the only graphical way of exiting the session.
-    # Reaching them via the intended way requires wayland mouse control, but ydotool lacks a module for its daemon:
-    # https://github.com/NixOS/nixpkgs/issues/183659
-    # Luckily, there's a test app that also displays their contents, but it's abit inconsistent. Hopefully this is *good-enough*.
+    # There's a test app we could use that also displays their contents, but it's abit inconsistent.
     with subtest("ayatana indicators work"):
-        open_starter()
-        machine.send_chars("Indicators\n")
-        machine.wait_for_text(r"(Indicators|Client|List|network|datetime|session)")
+        mouse_click(735, 0) # the cog in the top-right, for the session indicator
+        machine.wait_for_text(r"(Notifications|Time|Date|System)")
         machine.screenshot("indicators_open")
 
-        # Element tab order within the indicator menus is not fully deterministic
-        # Only check that the indicators are listed & their items load
+        # Indicator order within the menus *should* be fixed based on per-indicator order setting
+        # Session is the one we clicked, but the last we should test (logout). Go as far left as we can test.
+        machine.send_key("left")
+        machine.send_key("left")
+        # Notifications are usually empty, nothing to check there
 
         with subtest("lomiri indicator network works"):
-            # Select indicator-network
-            machine.send_key("tab")
-            # Don't go further down, first entry
-            machine.send_key("ret")
+            # We start on this, don't go right
             machine.wait_for_text(r"(Flight|Wi-Fi)")
             machine.screenshot("indicators_network")
 
-        machine.send_key("shift-tab")
-        machine.send_key("ret")
-        machine.wait_for_text(r"(Indicators|Client|List|network|datetime|session)")
-
         with subtest("ayatana indicator datetime works"):
-            # Select ayatana-indicator-datetime
-            machine.send_key("tab")
-            machine.send_key("down")
-            machine.send_key("ret")
+            machine.send_key("right")
             machine.wait_for_text("Time and Date Settings")
             machine.screenshot("indicators_timedate")
 
-        machine.send_key("shift-tab")
-        machine.send_key("ret")
-        machine.wait_for_text(r"(Indicators|Client|List|network|datetime|session)")
-
         with subtest("ayatana indicator session works"):
-            # Select ayatana-indicator-session
-            machine.send_key("tab")
-            machine.send_key("down")
-            machine.send_key("ret")
+            machine.send_key("right")
             machine.wait_for_text("Log Out")
             machine.screenshot("indicators_session")
+
+            # We should be able to log out and return to the greeter
+            mouse_click(720, 280) # "Log Out"
+            mouse_click(400, 240) # confirm logout
+            machine.wait_until_fails("pgrep -u ${user} -f 'lomiri --mode=full-shell'")
+            machine.wait_until_succeeds("pgrep -u lightdm -f 'lomiri --mode=greeter'")
   '';
 })
diff --git a/pkgs/applications/audio/alsa-scarlett-gui/default.nix b/pkgs/applications/audio/alsa-scarlett-gui/default.nix
index 9504a5e9521b..05c409ed72ea 100644
--- a/pkgs/applications/audio/alsa-scarlett-gui/default.nix
+++ b/pkgs/applications/audio/alsa-scarlett-gui/default.nix
@@ -16,22 +16,28 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "geoffreybennett";
-    repo = pname;
+    repo = "alsa-scarlett-gui";
     rev = version;
-    sha256 = "sha256-+74JRQn2xwgPHZSrp5b+uny0+aLnsFvx/cOKIdj4J40=";
+    hash = "sha256-+74JRQn2xwgPHZSrp5b+uny0+aLnsFvx/cOKIdj4J40=";
   };
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
 
   makeFlags = [ "DESTDIR=\${out}" "PREFIX=''" ];
   sourceRoot = "${src.name}/src";
+
+  postPatch = ''
+    substituteInPlace file.c \
+      --replace-fail "/usr/sbin/alsactl" "${alsa-utils}/bin/alsactl"
+  '';
+
   nativeBuildInputs = [ pkg-config wrapGAppsHook4 makeWrapper ];
   buildInputs = [ gtk4 alsa-lib openssl ];
   postInstall = ''
     wrapProgram $out/bin/alsa-scarlett-gui --prefix PATH : ${lib.makeBinPath [ alsa-utils ]}
 
     substituteInPlace $out/share/applications/vu.b4.alsa-scarlett-gui.desktop \
-      --replace "Exec=/bin/alsa-scarlett-gui" "Exec=$out/bin/alsa-scarlett-gui"
+      --replace-fail "Exec=/bin/alsa-scarlett-gui" "Exec=$out/bin/alsa-scarlett-gui"
   '';
 
   # causes redefinition of _FORTIFY_SOURCE
diff --git a/pkgs/applications/misc/dbeaver/default.nix b/pkgs/applications/misc/dbeaver/default.nix
deleted file mode 100644
index bd4504611758..000000000000
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ /dev/null
@@ -1,140 +0,0 @@
-{ lib
-, stdenv
-, copyDesktopItems
-, fetchFromGitHub
-, makeDesktopItem
-, makeWrapper
-, fontconfig
-, freetype
-, glib
-, gtk3
-, jdk17
-, libX11
-, libXrender
-, libXtst
-, zlib
-, maven
-, webkitgtk
-, glib-networking
-}:
-
-let
-  mavenJdk17 = maven.override {
-    jdk = jdk17;
-  };
-in
-mavenJdk17.buildMavenPackage rec {
-  pname = "dbeaver";
-  version = "22.2.2"; # When updating also update mvnHash
-
-  src = fetchFromGitHub {
-    owner = "dbeaver";
-    repo = "dbeaver";
-    rev = version;
-    hash = "sha256-TUdtrhQ1JzqZx+QNauNA1P/+WDSSeOGIgGX3SdS0JTI=";
-  };
-
-  mvnHash = "sha256-ERZYDsPxp1YXteSmunFIgTGZUYqjZJhqrNytLnIUNBQ=";
-  mvnParameters = "-P desktop,all-platforms";
-
-  nativeBuildInputs = [
-    copyDesktopItems
-    makeWrapper
-  ];
-
-  buildInputs = [
-    fontconfig
-    freetype
-    glib
-    gtk3
-    jdk17
-    libX11
-    libXrender
-    libXtst
-    zlib
-  ] ++ lib.optionals stdenv.isLinux [
-    webkitgtk
-    glib-networking
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "dbeaver";
-      exec = "dbeaver";
-      icon = "dbeaver";
-      desktopName = "dbeaver";
-      comment = "SQL Integrated Development Environment";
-      genericName = "SQL Integrated Development Environment";
-      categories = [ "Development" ];
-    })
-  ];
-
-  installPhase =
-    let
-      productTargetPath = "product/community/target/products/org.jkiss.dbeaver.core.product";
-
-      platformMap = {
-        aarch64-darwin = "aarch64";
-        aarch64-linux = "aarch64";
-        x86_64-darwin = "x86_64";
-        x86_64-linux = "x86_64";
-      };
-
-      systemPlatform = platformMap.${stdenv.hostPlatform.system} or (throw "dbeaver not supported on ${stdenv.hostPlatform.system}");
-    in
-    if stdenv.isDarwin then ''
-      runHook preInstall
-
-      mkdir -p $out/Applications $out/bin
-      cp -r ${productTargetPath}/macosx/cocoa/${systemPlatform}/DBeaver.app $out/Applications
-
-      sed -i "/^-vm/d; /bin\/java/d" $out/Applications/DBeaver.app/Contents/Eclipse/dbeaver.ini
-
-      ln -s $out/Applications/DBeaver.app/Contents/MacOS/dbeaver $out/bin/dbeaver
-
-      wrapProgram $out/Applications/DBeaver.app/Contents/MacOS/dbeaver \
-        --prefix JAVA_HOME : ${jdk17.home} \
-        --prefix PATH : ${jdk17}/bin
-
-      runHook postInstall
-    '' else ''
-      runHook preInstall
-
-      mkdir -p $out/
-      cp -r ${productTargetPath}/linux/gtk/${systemPlatform}/dbeaver $out/dbeaver
-
-      # Patch binaries.
-      interpreter=$(cat $NIX_CC/nix-support/dynamic-linker)
-      patchelf --set-interpreter $interpreter $out/dbeaver/dbeaver
-
-      makeWrapper $out/dbeaver/dbeaver $out/bin/dbeaver \
-        --prefix PATH : ${jdk17}/bin \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ glib gtk3 libXtst webkitgtk glib-networking ])} \
-        --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
-        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
-
-      mkdir -p $out/share/pixmaps
-      ln -s $out/dbeaver/icon.xpm $out/share/pixmaps/dbeaver.xpm
-
-      runHook postInstall
-    '';
-
-  meta = with lib; {
-    homepage = "https://dbeaver.io/";
-    description = "Universal SQL Client for developers, DBA and analysts. Supports MySQL, PostgreSQL, MariaDB, SQLite, and more";
-    longDescription = ''
-      Free multi-platform database tool for developers, SQL programmers, database
-      administrators and analysts. Supports all popular databases: MySQL,
-      PostgreSQL, MariaDB, SQLite, Oracle, DB2, SQL Server, Sybase, MS Access,
-      Teradata, Firebird, Derby, etc.
-    '';
-    sourceProvenance = with sourceTypes; [
-      fromSource
-      binaryBytecode # dependencies from maven
-    ];
-    license = licenses.asl20;
-    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
-    maintainers = with maintainers; [ jojosch mkg20001 ];
-    mainProgram = "dbeaver";
-  };
-}
diff --git a/pkgs/applications/networking/browsers/floorp/default.nix b/pkgs/applications/networking/browsers/floorp/default.nix
index aa67b61cf7e4..7b015bafbb0f 100644
--- a/pkgs/applications/networking/browsers/floorp/default.nix
+++ b/pkgs/applications/networking/browsers/floorp/default.nix
@@ -7,7 +7,7 @@
 
 ((buildMozillaMach rec {
   pname = "floorp";
-  packageVersion = "11.12.2";
+  packageVersion = "11.13.2";
   applicationName = "Floorp";
   binaryName = "floorp";
   branding = "browser/branding/official";
@@ -15,14 +15,14 @@
   allowAddonSideload = true;
 
   # Must match the contents of `browser/config/version.txt` in the source tree
-  version = "115.10.0";
+  version = "115.12.0";
 
   src = fetchFromGitHub {
     owner = "Floorp-Projects";
     repo = "Floorp";
     fetchSubmodules = true;
     rev = "v${packageVersion}";
-    hash = "sha256-KWUoR/0XOz4mCWBkTgDfvvrWukZMa3tQzQ+k5+BfzzY=";
+    hash = "sha256-sFtGtxk3vdR5JoZb1yiITybIfGmOYzKLb9NtbhWjBt8=";
   };
 
   extraConfigureFlags = [
diff --git a/pkgs/by-name/da/darklua/package.nix b/pkgs/by-name/da/darklua/package.nix
index c9969fec4cc8..780d6026ae11 100644
--- a/pkgs/by-name/da/darklua/package.nix
+++ b/pkgs/by-name/da/darklua/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "darklua";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "seaofvoices";
     repo = "darklua";
     rev = "v${version}";
-    hash = "sha256-FF0UEvylHFrGYgE3ASs0IwnYrh7gIClZUREtXjyVsPM=";
+    hash = "sha256-cabYENU4U+KisfXbiXcWojQM/nwzcVvM3QpYWOX7NtQ=";
   };
 
-  cargoHash = "sha256-XrWhOosQM+BaqViIju7urCi1B8+6kq8Taxe5T8LFzVE=";
+  cargoHash = "sha256-fYx+SQdQMnNSygr0/Y4zEPtqfQPZYmQUq3ndi1HlXuE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.CoreServices ];
 
diff --git a/pkgs/applications/misc/freeplane/default.nix b/pkgs/by-name/fr/freeplane/package.nix
similarity index 72%
rename from pkgs/applications/misc/freeplane/default.nix
rename to pkgs/by-name/fr/freeplane/package.nix
index 77918baff376..5ce7cebac098 100644
--- a/pkgs/applications/misc/freeplane/default.nix
+++ b/pkgs/by-name/fr/freeplane/package.nix
@@ -1,35 +1,31 @@
-{ stdenv
-, lib
-, fetchpatch
-, fetchFromGitHub
-, makeWrapper
-, makeDesktopItem
-, writeText
-, runtimeShell
-, jdk17
-, perl
-, gradle_7
-, which
+{
+  stdenvNoCC,
+  lib,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  makeDesktopItem,
+  writeText,
+  jdk17,
+  perl,
+  gradle_7,
+  which,
 }:
 
 let
   pname = "freeplane";
-  version = "1.11.8";
-
-  src_hash = "sha256-Qh2V265FvQpqGKmPsiswnC5yECwIcNwMI3/Ka9sBqXE=";
-  deps_outputHash = "sha256-2Zaw4FW12dThdr082dEB1EYkGwNiayz501wIPGXUfBw=";
+  version = "1.11.14";
 
   jdk = jdk17;
   gradle = gradle_7;
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "freeplane";
+    repo = "freeplane";
     rev = "release-${version}";
-    hash = src_hash;
+    hash = "sha256-zEQjB57iiKVQnH8VtynpEGKNAa2e+WpqnGt6fnv5Rjs=";
   };
 
-  deps = stdenv.mkDerivation {
+  deps = stdenvNoCC.mkDerivation {
     pname = "${pname}-deps";
     inherit src version;
 
@@ -40,28 +36,30 @@ let
     ];
 
     buildPhase = ''
+      runHook preBuild
       GRADLE_USER_HOME=$PWD gradle -Dorg.gradle.java.home=${jdk} --no-daemon build
+      runHook postBuild
     '';
 
     # Mavenize dependency paths
     # e.g. org.codehaus.groovy/groovy/2.4.0/{hash}/groovy-2.4.0.jar -> org/codehaus/groovy/groovy/2.4.0/groovy-2.4.0.jar
     installPhase = ''
+      runHook preInstall
       find ./caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
         | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
         | sh
-      # com/squareup/okio/okio/2.10.0/okio-jvm-2.10.0.jar expected to exist under name okio-2.10.0.jar
+      # com/squareup/okio/okio-jvm/x.y.z/okio-jvm-x.y.z.jar is expected to exist under com/squareup/okio/okio/x.y.z/okio-x.y.z.jar
       while IFS="" read -r -d "" path; do
-        dir=''${path%/*}; file=''${path##*/}; dest=''${file//-jvm-/-}
-        [[ -e $dir/$dest ]] && continue
-        ln -s "$dir/$file" "$dir/$dest"
+        ln -s "$path" ''${path//okio-jvm/okio}
       done < <(find "$out" -type f -name 'okio-jvm-*.jar' -print0)
+      runHook postInstall
     '';
     # otherwise the package with a namespace starting with info/... gets moved to share/info/...
     forceShare = [ "dummy" ];
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = deps_outputHash;
+    outputHash = "sha256-mWQTe/hOWGwWtsUPCZ7gle2FtskcEmJwsGQZITEc/Uc=";
   };
 
   # Point to our local deps repo
@@ -83,17 +81,18 @@ let
       }
     }
   '';
-
-in stdenv.mkDerivation rec {
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
   inherit pname version src;
 
   nativeBuildInputs = [
-    makeWrapper
+    makeBinaryWrapper
     jdk
     gradle
   ];
 
   buildPhase = ''
+    runHook preBuild
     mkdir -p freeplane/build
 
     GRADLE_USER_HOME=$PWD \
@@ -101,6 +100,7 @@ in stdenv.mkDerivation rec {
       --no-daemon --offline --init-script ${gradleInit} \
       -x test \
       build
+    runHook postBuild
   '';
 
   desktopItems = [
@@ -110,7 +110,7 @@ in stdenv.mkDerivation rec {
       genericName = "Mind-mapper";
       exec = "freeplane";
       icon = "freeplane";
-      comment = meta.description;
+      comment = finalAttrs.meta.description;
       mimeTypes = [
         "application/x-freemind"
         "application/x-freeplane"
@@ -134,19 +134,24 @@ in stdenv.mkDerivation rec {
     makeWrapper $out/share/freeplane/freeplane.sh $out/bin/freeplane \
       --set FREEPLANE_BASE_DIR $out/share/freeplane \
       --set JAVA_HOME ${jdk} \
-      --prefix PATH : ${lib.makeBinPath [ jdk which ]} \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          jdk
+          which
+        ]
+      } \
       --prefix _JAVA_AWT_WM_NONREPARENTING : 1 \
       --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on"
 
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Mind-mapping software";
     homepage = "https://freeplane.org/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ chaduffy ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ chaduffy ];
     mainProgram = "freeplane";
   };
-}
+})
diff --git a/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix b/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix
index 2087a5f41038..b3f2528ce2a2 100644
--- a/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix
+++ b/pkgs/by-name/ha/ha-mqtt-discoverable-cli/package.nix
@@ -1,39 +1,38 @@
-{ lib
-, python3
-, fetchFromGitHub
+{
+  lib,
+  fetchFromGitHub,
+  python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ha-mqtt-discoverable-cli";
-  version = "0.2.1";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "unixorn";
     repo = "ha-mqtt-discoverable-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-miFlrBmxVuIJjpsyYnbQt+QAGSrS4sHlJpCmxouM2Wc=";
+    hash = "sha256-rGRsB5kAtzI5KP4tMiQqLJQZs7z5k657V8Di0OzB6F8=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    poetry-core
-  ];
+  pythonRelaxDeps = [ "ha-mqtt-discoverable" ];
 
-  propagatedBuildInputs = with python3.pkgs; [
-    ha-mqtt-discoverable
-  ];
+  build-system = with python3.pkgs; [ poetry-core ];
+
+  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
+
+  dependencies = with python3.pkgs; [ ha-mqtt-discoverable ];
 
   # Project has no real tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "ha_mqtt_discoverable_cli"
-  ];
+  pythonImportsCheck = [ "ha_mqtt_discoverable_cli" ];
 
   meta = with lib; {
     description = "CLI for creating Home Assistant compatible MQTT entities that will be automatically discovered";
     homepage = "https://github.com/unixorn/ha-mqtt-discoverable-cli";
-    changelog = "https://github.com/unixorn/ha-mqtt-discoverable-cli/releases/tag/v0.2.1";
+    changelog = "https://github.com/unixorn/ha-mqtt-discoverable-cli/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
     mainProgram = "hmd";
diff --git a/pkgs/by-name/la/labwc-tweaks-gtk/package.nix b/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
index c8f6fdca999d..7d444421a0d8 100644
--- a/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
+++ b/pkgs/by-name/la/labwc-tweaks-gtk/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "labwc-tweaks-gtk";
-  version = "0-unstable-2024-04-07";
+  version = "0-unstable-2024-05-19";
 
   src = fetchFromGitHub {
     owner = "labwc";
     repo = "labwc-tweaks-gtk";
-    rev = "67adbedd610a1b44e7ba667ae72a5c9b07105119";
-    hash = "sha256-RGPm+hvyTWxkd3z841Y8ozXrDD1ZgHCZjimyRdRNrCs=";
+    rev = "6f251c525a89bbe3dc3fd1bc8cd7cad4950b348a";
+    hash = "sha256-MVnEJ3tk/TDCxAG8v5TDAZUIWmlUrP6Bq1VyeM5VkZ4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/le/lefthook/package.nix b/pkgs/by-name/le/lefthook/package.nix
index 65e7ffd52969..0cde03e8ae81 100644
--- a/pkgs/by-name/le/lefthook/package.nix
+++ b/pkgs/by-name/le/lefthook/package.nix
@@ -6,7 +6,7 @@
 
 let
   pname = "lefthook";
-  version = "1.6.11";
+  version = "1.6.12";
 in
 buildGoModule {
   inherit pname version;
@@ -15,7 +15,7 @@ buildGoModule {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-l94RysGILYju0u1jOIGxLVe/TECw1naMq9SzpYq6ooM=";
+    hash = "sha256-j39A+cHu1MUa7kP46JY8pADsOejsMX0rcBHQZflhWe8=";
   };
 
   vendorHash = "sha256-sDqP+fzAFavqtvJ98nwsD5+GxNhmLgtOkTzIK06wp9E=";
diff --git a/pkgs/by-name/li/lightningcss/package.nix b/pkgs/by-name/li/lightningcss/package.nix
index 7b9c58e087f3..b4d74f3bcb8a 100644
--- a/pkgs/by-name/li/lightningcss/package.nix
+++ b/pkgs/by-name/li/lightningcss/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lightningcss";
-  version = "1.24.1";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "parcel-bundler";
     repo = "lightningcss";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HRuL7zwpN2e51+/Ltvif+eh+WBss/FtHCOlJfa/eVdE=";
+    hash = "sha256-0no2f4aIJ4f9kSXUdaqjS4ARmVgfV5wqP407WCFeD1g=";
   };
 
-  cargoHash = "sha256-HavdTNaLTGctePa890dy/jGlXZXXZu1QFeFJOpjOiME=";
+  cargoHash = "sha256-P/EP5bKDqGMBfZL+yyUXLjT9YwIpSCruFxkxIbpKIaQ=";
 
   patches = [
     # Backport fix for build error for lightningcss-napi
diff --git a/pkgs/by-name/me/melonDS/package.nix b/pkgs/by-name/me/melonDS/package.nix
index 7fc24f718d84..3ccecc1bab33 100644
--- a/pkgs/by-name/me/melonDS/package.nix
+++ b/pkgs/by-name/me/melonDS/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "melonDS";
-  version = "0.9.5-unstable-2024-05-13";
+  version = "0.9.5-unstable-2024-05-15";
 
   src = fetchFromGitHub {
     owner = "melonDS-emu";
     repo = "melonDS";
-    rev = "5df83c97c766bff3da8ba5a1504a6a5974467133";
-    hash = "sha256-Fo+HtTvkfrHU361ccH9zPifRoR6tNcw9gKIaExKEQh4=";
+    rev = "a72b79a55ad2d61811af11b1b911f6af863f66c2";
+    hash = "sha256-cdKfJ316iuRajdrRESt68oR8vkHISFRdHXxVuvGSUqE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/mini-calc/package.nix b/pkgs/by-name/mi/mini-calc/package.nix
index ad717a93f3ff..d7f3963dd372 100644
--- a/pkgs/by-name/mi/mini-calc/package.nix
+++ b/pkgs/by-name/mi/mini-calc/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "mini-calc";
-  version = "2.13.2";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "coco33920";
     repo = "calc";
     rev = version;
-    hash = "sha256-qLPIo+Ht34YApWwl16Xscq2+vlAdlbCK5AeKy5q9cO0=";
+    hash = "sha256-xLJbucUeH8pSXUESwwChR6onLVRXZ4Rx2d4FlXTbtLQ=";
   };
 
-  cargoHash = "sha256-oWN9JLPswNKRKDG3dh3z7aleAaqQ7AlMP+Zp2BpBueE=";
+  cargoHash = "sha256-GNguTQMjzuCCQKei5uA2lyB1Dms0nOfM7zQKxftV5Rk=";
 
   nativeBuildInputs = [ makeWrapper ];
   postFixup = ''
diff --git a/pkgs/tools/misc/ollama/disable-git.patch b/pkgs/by-name/ol/ollama/disable-git.patch
similarity index 100%
rename from pkgs/tools/misc/ollama/disable-git.patch
rename to pkgs/by-name/ol/ollama/disable-git.patch
diff --git a/pkgs/by-name/ol/ollama/disable-lib-check.patch b/pkgs/by-name/ol/ollama/disable-lib-check.patch
new file mode 100644
index 000000000000..8ce5fcb04e25
--- /dev/null
+++ b/pkgs/by-name/ol/ollama/disable-lib-check.patch
@@ -0,0 +1,10 @@
+--- a/llm/generate/gen_linux.sh
++++ b/llm/generate/gen_linux.sh
+@@ -245,7 +245,6 @@
+     if [ $(cat "${BUILD_DIR}/bin/deps.txt" | wc -l ) -lt 8 ] ; then
+         cat "${BUILD_DIR}/bin/deps.txt"
+         echo "ERROR: deps file short"
+-        exit 1
+     fi
+     compress
+ fi
diff --git a/pkgs/tools/misc/ollama/default.nix b/pkgs/by-name/ol/ollama/package.nix
similarity index 86%
rename from pkgs/tools/misc/ollama/default.nix
rename to pkgs/by-name/ol/ollama/package.nix
index fdda6ba3f1e8..9e0e4d2d87a0 100644
--- a/pkgs/tools/misc/ollama/default.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -30,22 +30,24 @@
 let
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.1.31";
+  version = "0.1.38";
 
   src = fetchFromGitHub {
     owner = "jmorganca";
     repo = "ollama";
     rev = "v${version}";
-    hash = "sha256-Ip1zrhgGpeYo2zsN206/x+tcG/bmPJAq4zGatqsucaw=";
+    hash = "sha256-9HHR48gqETYVJgIaDH8s/yHTrDPEmHm80shpDNS+6hY=";
     fetchSubmodules = true;
   };
-  vendorHash = "sha256-Lj7CBvS51RqF63c01cOCgY7BCQeCKGu794qzb/S80C0=";
+  vendorHash = "sha256-zOQGhNcGNlQppTqZdPfx+y4fUrxH0NOUl38FN8J6ffE=";
   # ollama's patches of llama.cpp's example server
   # `ollama/llm/generate/gen_common.sh` -> "apply temporary patches until fix is upstream"
   # each update, these patches should be synchronized with the contents of `ollama/llm/patches/`
   llamacppPatches = [
+    (preparePatch "02-clip-log.diff" "sha256-rMWbl3QgrPlhisTeHwD7EnGRJyOhLB4UeS7rqa0tdXM=")
     (preparePatch "03-load_exception.diff" "sha256-1DfNahFYYxqlx4E4pwMKQpL+XR0bibYnDFGt6dCL4TM=")
-    (preparePatch "04-locale.diff" "sha256-r5nHiP6yN/rQObRu2FZIPBKpKP9yByyZ6sSI2SKj6Do=")
+    (preparePatch "04-metal.diff" "sha256-Ne8J9R8NndUosSK0qoMvFfKNwqV5xhhce1nSoYrZo7Y=")
+    (preparePatch "05-clip-fix.diff" "sha256-rCc3xNuJR11OkyiXuau8y46hb+KYk40ZqH1Llq+lqWc=")
   ];
 
   preparePatch = patch: hash: fetchpatch {
@@ -76,20 +78,21 @@ let
   enableCuda = shouldEnable "cuda" config.cudaSupport;
 
 
+  rocmLibs = [
+    rocmPackages.clr
+    rocmPackages.hipblas
+    (rocmPackages.rocblas.override { tensileSepArch = true; tensileLazyLib = true; })
+    rocmPackages.rocsolver
+    rocmPackages.rocsparse
+    rocmPackages.rocm-device-libs
+    rocmPackages.rocm-smi
+  ];
   rocmClang = linkFarm "rocm-clang" {
     llvm = rocmPackages.llvm.clang;
   };
   rocmPath = buildEnv {
     name = "rocm-path";
-    paths = [
-      rocmPackages.clr
-      rocmPackages.hipblas
-      rocmPackages.rocblas
-      rocmPackages.rocsolver
-      rocmPackages.rocsparse
-      rocmPackages.rocm-device-libs
-      rocmClang
-    ];
+    paths = rocmLibs ++ [ rocmClang ];
   };
 
   cudaToolkit = buildEnv {
@@ -103,7 +106,7 @@ let
   };
 
   runtimeLibs = lib.optionals enableRocm [
-    rocmPackages.rocm-smi
+    rocmPath
   ] ++ lib.optionals enableCuda [
     linuxPackages.nvidia_x11
   ];
@@ -143,14 +146,9 @@ goBuild ((lib.optionalAttrs enableRocm {
   ] ++ lib.optionals stdenv.isDarwin
     metalFrameworks;
 
-  buildInputs = lib.optionals enableRocm [
-    rocmPackages.clr
-    rocmPackages.hipblas
-    rocmPackages.rocblas
-    rocmPackages.rocsolver
-    rocmPackages.rocsparse
-    libdrm
-  ] ++ lib.optionals enableCuda [
+  buildInputs = lib.optionals enableRocm
+    (rocmLibs ++ [ libdrm ])
+  ++ lib.optionals enableCuda [
     cudaPackages.cuda_cudart
   ] ++ lib.optionals stdenv.isDarwin
     metalFrameworks;
@@ -161,10 +159,11 @@ goBuild ((lib.optionalAttrs enableRocm {
     # this also disables necessary patches contained in `ollama/llm/patches/`
     # those patches are added to `llamacppPatches`, and reapplied here in the patch phase
     ./disable-git.patch
+    # disable a check that unnecessarily exits compilation during rocm builds
+    # since `rocmPath` is in `LD_LIBRARY_PATH`, ollama uses rocm correctly
+    ./disable-lib-check.patch
   ] ++ llamacppPatches;
   postPatch = ''
-    # replace a hardcoded use of `g++` with `$CXX` so clang can be used on darwin
-    substituteInPlace llm/generate/gen_common.sh --replace-fail 'g++' '$CXX'
     # replace inaccurate version number with actual release version
     substituteInPlace version/version.go --replace-fail 0.0.0 '${version}'
   '';
diff --git a/pkgs/development/compilers/odin/default.nix b/pkgs/development/compilers/odin/default.nix
index 44a215496e7a..5cb6818c6ba8 100644
--- a/pkgs/development/compilers/odin/default.nix
+++ b/pkgs/development/compilers/odin/default.nix
@@ -4,6 +4,7 @@
 , makeBinaryWrapper
 , libiconv
 , MacOSX-SDK
+, Security
 , which
 }:
 
@@ -25,7 +26,10 @@ in stdenv.mkDerivation rec {
     makeBinaryWrapper which
   ];
 
-  buildInputs = lib.optional stdenv.isDarwin libiconv;
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+    Security
+  ];
 
   LLVM_CONFIG = "${llvmPackages.llvm.dev}/bin/llvm-config";
 
diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
index e6f785cd833c..8f0ddad4a58a 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
@@ -316,5 +316,7 @@ qtModule {
     # This build takes a long time; particularly on slow architectures
     # 1 hour on 32x3.6GHz -> maybe 12 hours on 4x2.4GHz
     timeout = 24 * 3600;
+    # Not compatible with macOS 11 without massive patching
+    broken = stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "12";
   };
 }
diff --git a/pkgs/development/libraries/shibboleth-sp/default.nix b/pkgs/development/libraries/shibboleth-sp/default.nix
index ba9956471310..da63b22f9e7e 100644
--- a/pkgs/development/libraries/shibboleth-sp/default.nix
+++ b/pkgs/development/libraries/shibboleth-sp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, autoreconfHook, boost, fcgi, openssl, opensaml-cpp, log4shib, pkg-config, xercesc, xml-security-c, xml-tooling-c }:
+{ lib, stdenv, fetchgit, autoreconfHook, boost, fcgi, openssl, opensaml-cpp, log4shib, pkg-config, xercesc, xml-security-c, xml-tooling-c, darwin }:
 
 stdenv.mkDerivation rec {
   pname = "shibboleth-sp";
@@ -11,17 +11,20 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ boost fcgi openssl opensaml-cpp log4shib xercesc xml-security-c xml-tooling-c ];
+  buildInputs = [ boost fcgi openssl opensaml-cpp log4shib xercesc xml-security-c xml-tooling-c ]
+    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+      CoreServices
+      SystemConfiguration
+    ]);
 
   configureFlags = [
     "--without-apxs"
     "--with-xmltooling=${xml-tooling-c}"
     "--with-saml=${opensaml-cpp}"
     "--with-fastcgi"
+    "CXXFLAGS=-std=c++14"
   ];
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.isDarwin) "-std=c++14";
-
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/xdg-desktop-portal/default.nix b/pkgs/development/libraries/xdg-desktop-portal/default.nix
index 53a0d3b617e8..a8477e370da0 100644
--- a/pkgs/development/libraries/xdg-desktop-portal/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal/default.nix
@@ -28,6 +28,7 @@
 , wrapGAppsHook3
 , xmlto
 , enableGeoLocation ? true
+, enableSystemd ? true
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -78,7 +79,6 @@ stdenv.mkDerivation (finalAttrs: {
     flatpak
     fuse3
     bubblewrap
-    systemdMinimal # libsystemd
     glib
     gsettings-desktop-schemas
     json-glib
@@ -95,6 +95,8 @@ stdenv.mkDerivation (finalAttrs: {
     ]))
   ] ++ lib.optionals enableGeoLocation [
     geoclue2
+  ] ++ lib.optionals enableSystemd [
+    systemdMinimal # libsystemd
   ];
 
   nativeCheckInputs = [
@@ -109,6 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--sysconfdir=/etc"
     "-Dinstalled-tests=true"
     "-Dinstalled_test_prefix=${placeholder "installedTests"}"
+    (lib.mesonEnable "systemd" enableSystemd)
   ] ++ lib.optionals (!enableGeoLocation) [
     "-Dgeoclue=disabled"
   ];
diff --git a/pkgs/development/octave-modules/symbolic/default.nix b/pkgs/development/octave-modules/symbolic/default.nix
index 2ca59a972cb6..06920cfb6d50 100644
--- a/pkgs/development/octave-modules/symbolic/default.nix
+++ b/pkgs/development/octave-modules/symbolic/default.nix
@@ -14,13 +14,13 @@ let
 in
 buildOctavePackage rec {
   pname = "symbolic";
-  version = "3.1.1";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "cbm755";
     repo = "octsympy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6LmLzTwcBhvMDBE7u/lIkSUP97qFMPRHkxfbAyvas6M=";
+    hash = "sha256-H2242+1zlke4aLoS3gsHpDfopM5oSZ4IpVR3+xxQ0Dc=";
   };
 
   propagatedBuildInputs = [ pythonEnv ];
diff --git a/pkgs/development/python-modules/borb/default.nix b/pkgs/development/python-modules/borb/default.nix
index e1d2211f2ab3..3639e72e4d05 100644
--- a/pkgs/development/python-modules/borb/default.nix
+++ b/pkgs/development/python-modules/borb/default.nix
@@ -1,30 +1,38 @@
-{ lib
-, buildPythonPackage
-, cryptography
-, fetchPypi
-, fonttools
-, lxml
-, pillow
-, python-barcode
-, pythonOlder
-, qrcode
-, requests
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  cryptography,
+  fetchFromGitHub,
+  fonttools,
+  lxml,
+  matplotlib,
+  pandas,
+  pillow,
+  python-barcode,
+  pythonOlder,
+  qrcode,
+  pytestCheckHook,
+  requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "borb";
-  version = "2.1.22";
-  format = "setuptools";
+  version = "2.1.23";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-T+uSq/KF3p4zJJhQeompJIJ6BWhYFK9Ko9w0sZFtFhE=";
+  src = fetchFromGitHub {
+    owner = "jorisschellekens";
+    repo = "borb";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cpih7ijoT4dEdoFjh6qQcnzjWd2zusv4tNgPyrIghvg=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     cryptography
     fonttools
     lxml
@@ -35,11 +43,25 @@ buildPythonPackage rec {
     setuptools
   ];
 
-  pythonImportsCheck = [
-    "borb.pdf"
+  nativeCheckInputs = [
+    matplotlib
+    pandas
+    pytestCheckHook
   ];
 
-  doCheck = false;
+  pythonImportsCheck = [ "borb.pdf" ];
+
+  disabledTests = [
+    "test_code_files_are_small "
+    "test_image_has_pdfobject_methods"
+  ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "tests/pdf/"
+    "tests/toolkit/"
+    "tests/license/"
+  ];
 
   meta = with lib; {
     description = "Library for reading, creating and manipulating PDF files in Python";
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index a89d85efcafd..515597eca036 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "2.23.1";
+  version = "2.23.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "dsoftwareinc";
     repo = "fakeredis-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IMYxzlvPgwJNpb976jYXNW+6veQlUxQph43ZClyC4Eg=";
+    hash = "sha256-/nuBj9h5MMz1YvJozhl4Fq/OkLckesnQHHTUWfz06sA=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/garth/default.nix b/pkgs/development/python-modules/garth/default.nix
index c3e6bae9ed42..16bd5bb9085d 100644
--- a/pkgs/development/python-modules/garth/default.nix
+++ b/pkgs/development/python-modules/garth/default.nix
@@ -1,32 +1,31 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pdm-backend
-, pydantic
-, pytest-vcr
-, pytestCheckHook
-, pythonOlder
-, requests
-, requests-oauthlib
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pdm-backend,
+  pydantic,
+  pytest-vcr,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  requests-oauthlib,
 }:
 
 buildPythonPackage rec {
   pname = "garth";
-  version = "0.4.45";
+  version = "0.4.46";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dN4WQZ2FLkyqCGYFBICodHR7yBdrLvx4NE6OqB0SgZo=";
+    hash = "sha256-WuGeZ2EggyhbEDIbjg4ffIFaj2DyHi8Tvowhoi5k2Os=";
   };
 
-  nativeBuildInputs = [
-    pdm-backend
-  ];
+  build-system = [ pdm-backend ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     pydantic
     requests
     requests-oauthlib
@@ -37,9 +36,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "garth"
-  ];
+  pythonImportsCheck = [ "garth" ];
 
   disabledTests = [
     # Tests require network access
diff --git a/pkgs/development/python-modules/google-cloud-compute/default.nix b/pkgs/development/python-modules/google-cloud-compute/default.nix
index e3f504e50093..b7f89a66dd6d 100644
--- a/pkgs/development/python-modules/google-cloud-compute/default.nix
+++ b/pkgs/development/python-modules/google-cloud-compute/default.nix
@@ -1,33 +1,32 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pythonOlder
-, google-api-core
-, mock
-, proto-plus
-, protobuf
-, pytest-asyncio
-, pytestCheckHook
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  google-api-core,
+  mock,
+  proto-plus,
+  protobuf,
+  pytest-asyncio,
+  pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-compute";
-  version = "1.18.0";
+  version = "1.19.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QSI3GDh36yg4qm4Izaps8X85lFGhZuOpqjOuiUzBWh0=";
+    hash = "sha256-oHs0CLP3d4bcsZZmn/N2e8UQgHGKfC0/13ne/I2Be00=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     google-api-core
     proto-plus
     protobuf
diff --git a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
index 1420362dc622..40c61f8a7dc9 100644
--- a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
+++ b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
@@ -1,18 +1,20 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, gitlike-commands
-, paho-mqtt
-, poetry-core
-, pyaml
-, pydantic
-, pythonOlder
-, thelogrus
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  gitlike-commands,
+  paho-mqtt,
+  poetry-core,
+  pyaml,
+  pydantic,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  thelogrus,
 }:
 
 buildPythonPackage rec {
   pname = "ha-mqtt-discoverable";
-  version = "0.13.1";
+  version = "0.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,14 +23,16 @@ buildPythonPackage rec {
     owner = "unixorn";
     repo = "ha-mqtt-discoverable";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ue8az6Q7uU02IJJyyHk64Ji4J6sf/bShvTeHhN9U92Y=";
+    hash = "sha256-vL4EzeU+8nUPyLR22MJtLhknWF4DWMo49EKvkIqIWhA=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  pythonRelaxDeps = [ "pyaml" ];
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [
     gitlike-commands
     paho-mqtt
     pyaml
@@ -39,9 +43,7 @@ buildPythonPackage rec {
   # Test require a running Mosquitto instance
   doCheck = false;
 
-  pythonImportsCheck = [
-    "ha_mqtt_discoverable"
-  ];
+  pythonImportsCheck = [ "ha_mqtt_discoverable" ];
 
   meta = with lib; {
     description = "Python module to create MQTT entities that are automatically discovered by Home Assistant";
@@ -49,6 +51,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/unixorn/ha-mqtt-discoverable/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
-    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/karton-core/default.nix b/pkgs/development/python-modules/karton-core/default.nix
index e9c0b9cb07c4..00796239d341 100644
--- a/pkgs/development/python-modules/karton-core/default.nix
+++ b/pkgs/development/python-modules/karton-core/default.nix
@@ -1,31 +1,30 @@
-{ lib
-, boto3
-, buildPythonPackage
-, fetchFromGitHub
-, orjson
-, pythonOlder
-, redis
-, setuptools
-, unittestCheckHook
+{
+  lib,
+  boto3,
+  buildPythonPackage,
+  fetchFromGitHub,
+  orjson,
+  pythonOlder,
+  redis,
+  setuptools,
+  unittestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "karton-core";
-  version = "5.3.4";
+  version = "5.4.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = "karton";
     rev = "refs/tags/v${version}";
-    hash = "sha256-q12S80GZFyh7zU6iMeCkyIesMK8qXtZ1B69w8H5LpOU=";
+    hash = "sha256-4IU4ttJdh5BU79076kbQOtzqzeQ3/Xb9Qd6Bh9iNXrA=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     boto3
@@ -33,19 +32,18 @@ buildPythonPackage rec {
     redis
   ];
 
-  nativeCheckInputs = [
-    unittestCheckHook
-  ];
+  nativeCheckInputs = [ unittestCheckHook ];
 
-  pythonImportsCheck = [
-    "karton.core"
-  ];
+  pythonImportsCheck = [ "karton.core" ];
 
   meta = with lib; {
     description = "Distributed malware processing framework";
     homepage = "https://karton-core.readthedocs.io/";
     changelog = "https://github.com/CERT-Polska/karton/releases/tag/v${version}";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ chivay fab ];
+    maintainers = with maintainers; [
+      chivay
+      fab
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/llama-index-agent-openai/default.nix b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
index 09f2d549225d..57e6554ba4b3 100644
--- a/pkgs/development/python-modules/llama-index-agent-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-agent-openai";
-  version = "0.2.4";
+  version = "0.2.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_agent_openai";
     inherit version;
-    hash = "sha256-zUpY+L8jNyjO2lVMuzTeVqK2u7v/bOgBw/j/DIKAv1U=";
+    hash = "sha256-RfTMZw0Deopn9UHTpNCV9/Ycr/btLCVwJEHrERbUtJU=";
   };
 
   pythonRelaxDeps = [ "llama-index-llms-openai" ];
diff --git a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
index a96b2f57c803..0a5cb7e3aede 100644
--- a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
@@ -1,14 +1,15 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, llama-index-core
-, poetry-core
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  llama-index-core,
+  poetry-core,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "llama-index-llms-ollama";
-  version = "0.1.3";
+  version = "0.1.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,23 +17,17 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_ollama";
     inherit version;
-    hash = "sha256-x5ZlS3PRA/kyTtTFXHbEm3NzirxuUNAllu1eKxxm3sU=";
+    hash = "sha256-ebwZw9p1rfWrGjYd9aHF3CsubKOL1/Ei/mV4AgQxhtk=";
   };
 
-  build-system = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
-  dependencies = [
-    llama-index-core
-  ];
+  dependencies = [ llama-index-core ];
 
   # Tests are only available in the mono repo
   doCheck = false;
 
-  pythonImportsCheck = [
-    "llama_index.llms.ollama"
-  ];
+  pythonImportsCheck = [ "llama_index.llms.ollama" ];
 
   meta = with lib; {
     description = "LlamaIndex LLMS Integration for ollama";
diff --git a/pkgs/development/python-modules/pycm/default.nix b/pkgs/development/python-modules/pycm/default.nix
index 58570c177902..6b9bfac5d7d0 100644
--- a/pkgs/development/python-modules/pycm/default.nix
+++ b/pkgs/development/python-modules/pycm/default.nix
@@ -32,18 +32,22 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # Minor tolerance issues with Python 3.12; should be fixed in next release
+    # (see https://github.com/sepandhaghighi/pycm/pull/528)
+    "verified_test"
+    "function_test"
+  ];
+
   postPatch = ''
     # Remove a trivial dependency on the author's `art` Python ASCII art library
     rm pycm/__main__.py
     # Also depends on python3Packages.notebook
     rm Otherfiles/notebook_check.py
     substituteInPlace setup.py \
-      --replace '=get_requires()' '=[]'
+      --replace-fail '=get_requires()' '=[]'
   '';
 
-  # https://github.com/sepandhaghighi/pycm/issues/488
-  pytestFlagsArray = [ "Test" ];
-
   pythonImportsCheck = [
     "pycm"
   ];
diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix
index 763b5a4a62c7..4178d616ae8f 100644
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.17";
+  version = "0.2.18";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyExploitDb";
     inherit version;
-    hash = "sha256-I7uDmKvHVx8mpqlq+kOyp57wCii8fy9ecJTSm7uHbZ0=";
+    hash = "sha256-pwlS0304aTSrGZFIj5f+jstcFwcy/liqQBW8p7hUhKE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/bearer/default.nix b/pkgs/development/tools/bearer/default.nix
index ce448845d3e3..6eca38cf6f14 100644
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.43.3";
+  version = "1.43.5";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-imSXfub1dn1Q0C777uMDAVoCP7glmvhMBvQ0HC/9CRE=";
+    hash = "sha256-VMg07HOPvQK57DWVjuxtt5w1xMM4ansngL8clBOhPSc=";
   };
 
   vendorHash = "sha256-rRlOWQ5M+aNMsnt7zHphm/SQyvPBZUCWpZH1J7TZe28=";
diff --git a/pkgs/development/tools/lazygit/default.nix b/pkgs/development/tools/lazygit/default.nix
index 4ed99c20ebf7..b5f1d5d4a64e 100644
--- a/pkgs/development/tools/lazygit/default.nix
+++ b/pkgs/development/tools/lazygit/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lazygit";
-  version = "0.41.0";
+  version = "0.42.0";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Ok6QnXw3oDeSzBekft8cDXM/YsADgF1NZznfNoGNvck=";
+    hash = "sha256-w5QL+CuMYyTTnNAfWF8jQuQWfjxaw7bANK69Dc+onGk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/misc/blackfire/default.nix b/pkgs/development/tools/misc/blackfire/default.nix
index f8b7125f7fca..de6894f6ebe3 100644
--- a/pkgs/development/tools/misc/blackfire/default.nix
+++ b/pkgs/development/tools/misc/blackfire/default.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "blackfire";
-  version = "2.28.1";
+  version = "2.28.2";
 
   src = passthru.sources.${stdenv.hostPlatform.system} or (throw "Unsupported platform for blackfire: ${stdenv.hostPlatform.system}");
 
@@ -57,23 +57,23 @@ stdenv.mkDerivation rec {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        sha256 = "n7bNRws6IwTYbWsUAHNtV1hfW+YDygJn/U1U5MaUuew=";
+        sha256 = "ECUWjBlWr2QSvYvzep7MVOrufCRTgLibkmOHAEhg36w=";
       };
       "i686-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        sha256 = "zH6mEeW0EjYPVSAJ4cL3YpaQPd+h0zxO7qfN43qb67Q=";
+        sha256 = "cU9WpD+mIcAn1eYc9n6rGi/jML5F7g6BoXtfWAI4P+Y=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        sha256 = "ncX9aHxZJhth3Md591PBhMO3uhsiI03L7M60hOm4uko=";
+        sha256 = "Ej2uFxl8gIW6V7hEGauRWhfdevxoAb5s+yyQi1TYQWQ=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        sha256 = "OcZ0tyNerGXZKwrJRN4a+1Z51CeHDokYvfA3ve0bNKA=";
+        sha256 = "brcOya9uqicGXGVRggYP6yiOriho7zrbO5b3F1XMW+M=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_amd64.pkg.tar.gz";
-        sha256 = "ypCC+u6rpGDYkXtw4Q6bBBwLfcmRk4GmmcXHKvmXqFI=";
+        sha256 = "M90t91STPtLnW3yd5gvhNC0RQ8aDLPmdXV7dZ03gp/4=";
       };
     };
 
diff --git a/pkgs/misc/moonfire-nvr/default.nix b/pkgs/misc/moonfire-nvr/default.nix
index 0946161ce52f..d6a994ac3e68 100644
--- a/pkgs/misc/moonfire-nvr/default.nix
+++ b/pkgs/misc/moonfire-nvr/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , rustPlatform
 , buildNpmPackage
 , fetchFromGitHub
@@ -7,6 +8,7 @@
 , sqlite
 , testers
 , moonfire-nvr
+, darwin
 }:
 
 let
@@ -52,7 +54,9 @@ in rustPlatform.buildRustPackage {
   buildInputs = [
     ncurses
     sqlite
-  ];
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    Security
+  ]);
 
   postInstall = ''
     mkdir -p $out/lib/ui
diff --git a/pkgs/os-specific/darwin/bartender/default.nix b/pkgs/os-specific/darwin/bartender/default.nix
index 011a356e5412..3650d0dcaf3c 100644
--- a/pkgs/os-specific/darwin/bartender/default.nix
+++ b/pkgs/os-specific/darwin/bartender/default.nix
@@ -6,12 +6,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bartender";
-  version = "5.0.49";
+  version = "5.0.52";
 
   src = fetchurl {
     name = "Bartender ${lib.versions.major finalAttrs.version}.dmg";
     url = "https://www.macbartender.com/B2/updates/${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}/Bartender%20${lib.versions.major finalAttrs.version}.dmg";
-    hash = "sha256-DOQLtdbwYFyRri3GBdjLfFNII65QJMvAQu9Be4ATBx0=";
+    hash = "sha256-gKsDD/4z397ZpT+8xu7BI1c9r+nledzrPfD/ACexFvQ=";
   };
 
   dontPatch = true;
@@ -32,7 +32,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Take control of your menu bar";
     longDescription = ''
       Bartender is an award-winning app for macOS that superpowers your menu bar, giving you total control over your menu bar items, what's displayed, and when, with menu bar items only showing when you need them.
@@ -40,9 +40,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     '';
     homepage = "https://www.macbartender.com";
     changelog = "https://www.macbartender.com/Bartender${lib.versions.major finalAttrs.version}/release_notes/";
-    license = with licenses; [ unfree ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ stepbrobd ];
+    license = [ lib.licenses.unfree ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    maintainers = with lib.maintainers; [ stepbrobd ];
     platforms = [ "aarch64-darwin" "x86_64-darwin" ];
   };
 })
diff --git a/pkgs/tools/filesystems/garage/default.nix b/pkgs/tools/filesystems/garage/default.nix
index b90a2e49bffe..1072134e31a9 100644
--- a/pkgs/tools/filesystems/garage/default.nix
+++ b/pkgs/tools/filesystems/garage/default.nix
@@ -82,7 +82,7 @@ let
       changelog = "https://git.deuxfleurs.fr/Deuxfleurs/garage/releases/tag/v${version}";
       homepage = "https://garagehq.deuxfleurs.fr";
       license = lib.licenses.agpl3Only;
-      maintainers = with lib.maintainers; [ nickcao _0x4A6F teutat3s raitobezarius ];
+      maintainers = with lib.maintainers; [ nickcao _0x4A6F teutat3s ];
       knownVulnerabilities = (lib.optional eol "Garage version ${version} is EOL");
       inherit broken;
       mainProgram = "garage";
diff --git a/pkgs/tools/misc/mods/default.nix b/pkgs/tools/misc/mods/default.nix
index 33cc3dd3e133..331992986264 100644
--- a/pkgs/tools/misc/mods/default.nix
+++ b/pkgs/tools/misc/mods/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "mods";
-  version = "1.2.2";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "mods";
     rev = "v${version}";
-    hash = "sha256-ecmfWnrd9gwIEGAOIcOeUnfmkKmq9dLxpKqAHJemhvU=";
+    hash = "sha256-9sr6R7Keg9NQQapZKnjfrMOJilQEYCs8AS04TuNWQ68=";
   };
 
-  vendorHash = "sha256-pJ31Lsa5VVix3BM4RrllQA3MJ/JeNIKfQ8RClyFfXCI=";
+  vendorHash = "sha256-BL5bxyeVkcm7GO1Kzk9d/hj2wY50UhauEFq9YQ/JbCE=";
 
   ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
 
diff --git a/pkgs/tools/misc/pandoc-include/default.nix b/pkgs/tools/misc/pandoc-include/default.nix
index eafa1221a803..da509e094f84 100644
--- a/pkgs/tools/misc/pandoc-include/default.nix
+++ b/pkgs/tools/misc/pandoc-include/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonApplication rec {
   pname = "pandoc-include";
-  version = "1.3.1";
+  version = "1.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "DCsunset";
     repo = "pandoc-include";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8TIGw6p9c61oSH3ld14rmeG6wZY9u9JHALImxXM3c3Y=";
+    hash = "sha256-8gG1xkDuIN007uYSwSWgsDW4IFVIE44v3j7FN0RaZwU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/mpack/CVE-2011-4919.patch b/pkgs/tools/networking/mpack/CVE-2011-4919.patch
new file mode 100644
index 000000000000..10b9a1116ef3
--- /dev/null
+++ b/pkgs/tools/networking/mpack/CVE-2011-4919.patch
@@ -0,0 +1,23 @@
+commit 0c87201f64491575350b18d04c62ec142e119d1f
+Author: Sebastian Pipping <sebastian@pipping.org>
+Date:   Sat, 31 Dec 2011 19:17:20 +0000 (20:17 +0100)
+Source: https://web.archive.org/web/20120128080247/http://git.goodpoint.de/?p=mpack.git;a=commitdiff;h=0c87201f64491575350b18d04c62ec142e119d1f
+
+    Fix permissions
+
+diff --git a/unixos.c b/unixos.c
+index fa6d0a7..0e2f469 100644 (file)
+--- a/unixos.c
++++ b/unixos.c
+@@ -134,9 +134,9 @@ FILE *os_createnewfile(char *fname)
+     FILE *ret;
+      
+ #ifdef O_EXCL
+-    fd=open(fname, O_RDWR|O_CREAT|O_EXCL, 0644);
++    fd=open(fname, O_RDWR|O_CREAT|O_EXCL, 0600);
+ #else
+-    fd=open(fname, O_RDWR|O_CREAT|O_TRUNC, 0644);
++    fd=open(fname, O_RDWR|O_CREAT|O_TRUNC, 0600);
+ #endif
+ 
+     if (fd == -1)
diff --git a/pkgs/tools/networking/mpack/default.nix b/pkgs/tools/networking/mpack/default.nix
index 2c9bf4ff2d30..669ef500c455 100644
--- a/pkgs/tools/networking/mpack/default.nix
+++ b/pkgs/tools/networking/mpack/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0k590z96509k96zxmhv72gkwhrlf55jkmyqlzi72m61r7axhhh97";
   };
 
-  patches = [ ./build-fix.patch ./sendmail-via-execvp.diff ];
+  patches = [ ./build-fix.patch ./sendmail-via-execvp.diff ./CVE-2011-4919.patch ];
 
   postPatch = ''
     for f in *.{c,man,pl,unix} ; do
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index e0d1b5946059..3c338ddc10cb 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -6,7 +6,6 @@
 , pkg-config
 , dbus
 , gnome
-, systemd
 , libuuid
 , polkit
 , gnutls
@@ -51,6 +50,9 @@
 , runtimeShell
 , buildPackages
 , nixosTests
+, systemd
+, udev
+, withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 }:
 
 let
@@ -74,7 +76,8 @@ stdenv.mkDerivation rec {
     # System paths
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "-Dsystemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
+    (lib.mesonOption "systemdsystemunitdir"
+      (if withSystemd then "${placeholder "out"}/etc/systemd/system" else "no"))
     # to enable link-local connections
     "-Dudev_dir=${placeholder "out"}/lib/udev"
     "-Ddbus_conf_dir=${placeholder "out"}/share/dbus-1/system.d"
@@ -82,7 +85,8 @@ stdenv.mkDerivation rec {
 
     # Platform
     "-Dmodprobe=${kmod}/bin/modprobe"
-    "-Dsession_tracking=systemd"
+    (lib.mesonOption "session_tracking" (if withSystemd then "systemd" else "no"))
+    (lib.mesonBool "systemd_journal" withSystemd)
     "-Dlibaudit=yes-disabled-by-default"
     "-Dpolkit_agent_helper_1=/run/wrappers/bin/polkit-agent-helper-1"
 
@@ -130,7 +134,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    systemd
+    (if withSystemd then systemd else udev)
     libselinux
     audit
     libpsl
@@ -182,6 +186,9 @@ stdenv.mkDerivation rec {
     # TODO: submit upstream
     substituteInPlace meson.build \
       --replace "'vala', req" "'vala', native: false, req"
+  '' + lib.optionalString withSystemd ''
+    substituteInPlace data/NetworkManager.service.in \
+      --replace-fail /usr/bin/busctl ${systemd}/bin/busctl
   '';
 
   preBuild = ''
diff --git a/pkgs/tools/networking/networkmanager/fix-paths.patch b/pkgs/tools/networking/networkmanager/fix-paths.patch
index 2a1cc23e3079..e2010d8e64eb 100644
--- a/pkgs/tools/networking/networkmanager/fix-paths.patch
+++ b/pkgs/tools/networking/networkmanager/fix-paths.patch
@@ -10,19 +10,6 @@ index 148acade5c..6395fbfbe5 100644
 +PROGRAM="@runtimeShell@ -c '@ethtool@/bin/ethtool -i $$1 |@gnused@/bin/sed -n s/^driver:\ //p' -- $env{INTERFACE}", ENV{ID_NET_DRIVER}="%c"
  
  LABEL="nm_drivers_end"
-diff --git a/data/NetworkManager.service.in b/data/NetworkManager.service.in
-index f09ae86ceb..b2ecb405ef 100644
---- a/data/NetworkManager.service.in
-+++ b/data/NetworkManager.service.in
-@@ -9,7 +9,7 @@ BindsTo=dbus.service
- [Service]
- Type=dbus
- BusName=org.freedesktop.NetworkManager
--ExecReload=/usr/bin/busctl call org.freedesktop.NetworkManager /org/freedesktop/NetworkManager org.freedesktop.NetworkManager Reload u 0
-+ExecReload=@systemd@/bin/busctl call org.freedesktop.NetworkManager /org/freedesktop/NetworkManager org.freedesktop.NetworkManager Reload u 0
- #ExecReload=/bin/kill -HUP $MAINPID
- ExecStart=@sbindir@/NetworkManager --no-daemon
- Restart=on-failure
 diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
 index a9e8c08508..875d6cc2cd 100644
 --- a/src/core/devices/nm-device.c
diff --git a/pkgs/tools/networking/ntpd-rs/default.nix b/pkgs/tools/networking/ntpd-rs/default.nix
index 828110037896..200338578513 100644
--- a/pkgs/tools/networking/ntpd-rs/default.nix
+++ b/pkgs/tools/networking/ntpd-rs/default.nix
@@ -1,8 +1,10 @@
 { lib
+, stdenv
 , rustPlatform
 , fetchFromGitHub
 , installShellFiles
 , pandoc
+, Security
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,6 +20,9 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-iZuDNFy8c2UZUh3J11lEtfHlDFN+qPl4iZg+ps7AenE=";
 
+  buildInputs = lib.optionals stdenv.isDarwin ([
+    Security
+  ]);
   nativeBuildInputs = [ pandoc installShellFiles ];
 
   postPatch = ''
@@ -53,5 +58,7 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/pendulum-project/ntpd-rs/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ fpletz ];
+    # note: Undefined symbols for architecture x86_64: "_ntp_adjtime"
+    broken = stdenv.isDarwin && stdenv.isx86_64;
   };
 }
diff --git a/pkgs/tools/networking/transmission-rss/default.nix b/pkgs/tools/networking/transmission-rss/default.nix
index 19df133e4028..03674346132c 100644
--- a/pkgs/tools/networking/transmission-rss/default.nix
+++ b/pkgs/tools/networking/transmission-rss/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, pkg-config, openssl }:
+{ stdenv, lib, rustPlatform, fetchFromGitHub, pkg-config, openssl, darwin }:
 
 rustPlatform.buildRustPackage rec {
   version = "0.3.1";
@@ -16,7 +16,11 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "sha256-QNMdqoxxY8ao2O44hJxZNgLrPwzu9+ieweTPc7pfFY4=";
 
   nativeBuildInputs = [pkg-config];
-  buildInputs = [openssl];
+  buildInputs = [openssl]
+    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+      Security
+      SystemConfiguration
+    ]);
 
   OPENSSL_NO_VENDOR = 1;
 
diff --git a/pkgs/tools/networking/tuic/default.nix b/pkgs/tools/networking/tuic/default.nix
index 9750d056a8bb..fc1270e01ae8 100644
--- a/pkgs/tools/networking/tuic/default.nix
+++ b/pkgs/tools/networking/tuic/default.nix
@@ -1,6 +1,8 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , rustPlatform
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec{
@@ -14,6 +16,10 @@ rustPlatform.buildRustPackage rec{
     hash = "sha256-VoNr91vDqBlt9asT/dwCeYk13UNiDexNNiKwD5DSn8k=";
   };
 
+  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    Security
+  ]);
+
   postPatch = ''
     ln -sf ${./Cargo.lock} Cargo.lock
   '';
diff --git a/pkgs/tools/security/vaultwarden/webvault.nix b/pkgs/tools/security/vaultwarden/webvault.nix
index 041b7ae3154a..1b07086846da 100644
--- a/pkgs/tools/security/vaultwarden/webvault.nix
+++ b/pkgs/tools/security/vaultwarden/webvault.nix
@@ -8,13 +8,13 @@
 }:
 
 let
-  version = "2024.3.1";
+  version = "2024.5.0";
 
   bw_web_builds = fetchFromGitHub {
     owner = "dani-garcia";
     repo = "bw_web_builds";
     rev = "v${version}";
-    hash = "sha256-oi0H8TIQwtpzxKoQGnKaOY0bcWu7avTtrY+NgNRiq8k=";
+    hash = "sha256-di0oOM3ju3rkDVGmKpvS6sCaIXL/QGawr0TUrQjZ8dM=";
   };
 
 in buildNpmPackage rec {
@@ -25,10 +25,10 @@ in buildNpmPackage rec {
     owner = "bitwarden";
     repo = "clients";
     rev = "web-v${lib.removeSuffix "b" version}";
-    hash = "sha256-JBEP4dNGL4rYKl2qNyhB2y/wZunikaGFltGVXLxgMWI=";
+    hash = "sha256-kQ2tWfkkG5aifA8UGb5X1wQkGZr6dcVlrb+b78RFX/k=";
   };
 
-  npmDepsHash = "sha256-vNudSHIMmF7oXGz+ZymQahyHebs/CBDc6Oy1g0A5nqA=";
+  npmDepsHash = "sha256-gprJGOE/uSSM3NHpcbelB7sueObEl4o522WRHIRFmwo=";
 
   postPatch = ''
     ln -s ${bw_web_builds}/{patches,resources} ..
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index b3060ead0e19..a313f1c88628 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -238,6 +238,7 @@ mapAliases ({
   dart_stable = dart; # Added 2020-01-15
   dart-sass-embedded = throw "dart-sass-embedded has been removed from nixpkgs, as is now included in Dart Sass itself.";
   dat = nodePackages.dat;
+  dbeaver = throw "'dbeaver' has been renamed to/replaced by 'dbeaver-bin'"; # Added 2024-05-16
   deadcode = throw "'deadcode' has been removed, as upstream is abandoned since 2019-04-27. Use the official deadcode from 'gotools' package."; # Added 2023-12-28
   deadpixi-sam = deadpixi-sam-unstable;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e352322aa5e4..d79e4307c31e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -820,8 +820,6 @@ with pkgs;
 
   oletools = with python3.pkgs; toPythonApplication oletools;
 
-  ollama = callPackage ../tools/misc/ollama {  };
-
   ots = callPackage ../tools/security/ots {  };
 
   credential-detector = callPackage ../tools/security/credential-detector { };
@@ -1146,7 +1144,7 @@ with pkgs;
             fetchurl = stdenv.fetchurlBoot;
           };
         });
-        perl = buildPackages.perl.override { fetchurl = stdenv.fetchurlBoot; };
+        perl = buildPackages.perl.override { inherit zlib; fetchurl = stdenv.fetchurlBoot; };
         openssl = buildPackages.openssl.override {
           fetchurl = stdenv.fetchurlBoot;
           buildPackages = {
@@ -1154,7 +1152,7 @@ with pkgs;
               fetchurl = stdenv.fetchurlBoot;
               inherit perl;
               xz = buildPackages.xz.override { fetchurl = stdenv.fetchurlBoot; };
-              gmp = null;
+              gmpSupport = false;
               aclSupport = false;
               attrSupport = false;
             };
@@ -1973,7 +1971,9 @@ with pkgs;
 
   npm-check-updates = callPackage ../tools/package-management/npm-check-updates { };
 
-  ntpd-rs = callPackage ../tools/networking/ntpd-rs { };
+  ntpd-rs = darwin.apple_sdk_11_0.callPackage ../tools/networking/ntpd-rs {
+    inherit (darwin.apple_sdk_11_0.frameworks) Security;
+  };
 
   ocs-url = libsForQt5.callPackage ../tools/misc/ocs-url { };
 
@@ -7189,8 +7189,6 @@ with pkgs;
 
   davfs2 = callPackage ../tools/filesystems/davfs2 { };
 
-  dbeaver = callPackage ../applications/misc/dbeaver { };
-
   dbench = callPackage ../development/tools/misc/dbench { };
 
   dclxvi = callPackage ../development/libraries/dclxvi { };
@@ -20440,9 +20438,7 @@ with pkgs;
 
   cypress = callPackage ../development/web/cypress { };
 
-  cyrus_sasl = callPackage ../development/libraries/cyrus-sasl {
-    libkrb5 = if stdenv.isFreeBSD then heimdal else libkrb5;
-  };
+  cyrus_sasl = callPackage ../development/libraries/cyrus-sasl { };
 
   cyrus-sasl-xoauth2 = callPackage ../development/libraries/cyrus-sasl-xoauth2 { };
 
@@ -22483,6 +22479,8 @@ with pkgs;
       lib.getBin stdenv.cc.libc
     else if stdenv.hostPlatform.isDarwin then
       lib.getBin libiconv
+    else if stdenv.hostPlatform.isFreeBSD then
+      lib.getBin freebsd.iconv
     else
       lib.getBin libiconvReal;
 
@@ -27661,6 +27659,7 @@ with pkgs;
 
   odin = callPackage ../development/compilers/odin {
     inherit (pkgs.darwin.apple_sdk_11_0) MacOSX-SDK;
+    inherit (pkgs.darwin.apple_sdk_11_0.frameworks) Security;
   };
 
   odp-dpdk = callPackage ../os-specific/linux/odp-dpdk { };
@@ -31158,8 +31157,6 @@ with pkgs;
 
   freeoffice = callPackage ../applications/office/softmaker/freeoffice.nix { };
 
-  freeplane = callPackage ../applications/misc/freeplane { };
-
   freepv = callPackage ../applications/graphics/freepv { };
 
   xfontsel = callPackage ../applications/misc/xfontsel { };