diff --git a/lib/cli.nix b/lib/cli.nix
index fcffacb5ea99..311037c519a6 100644
--- a/lib/cli.nix
+++ b/lib/cli.nix
@@ -90,7 +90,16 @@ rec {
     mkOption ?
       k: v: if v == null
             then []
-            else [ (mkOptionName k) (lib.generators.mkValueStringDefault {} v) ]
+            else if optionValueSeparator == null then
+              [ (mkOptionName k) (lib.generators.mkValueStringDefault {} v) ]
+            else
+              [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault {} v}" ],
+
+    # how to separate an option from its flag;
+    # by default, there is no separator, so option `-c` and value `5`
+    # would become ["-c" "5"].
+    # This is useful if the command requires equals, for example, `-c=5`.
+    optionValueSeparator ? null
     }:
     options:
       let
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 6774939023d2..408ea5416293 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -1639,6 +1639,27 @@ runTests {
     ];
   };
 
+  testToGNUCommandLineSeparator = {
+    expr = cli.toGNUCommandLine { optionValueSeparator = "="; } {
+      data = builtins.toJSON { id = 0; };
+      X = "PUT";
+      retry = 3;
+      retry-delay = null;
+      url = [ "https://example.com/foo" "https://example.com/bar" ];
+      silent = false;
+      verbose = true;
+    };
+
+    expected = [
+      "-X=PUT"
+      "--data={\"id\":0}"
+      "--retry=3"
+      "--url=https://example.com/foo"
+      "--url=https://example.com/bar"
+      "--verbose"
+    ];
+  };
+
   testToGNUCommandLineShell = {
     expr = cli.toGNUCommandLineShell {} {
       data = builtins.toJSON { id = 0; };
diff --git a/nixos/modules/programs/steam.nix b/nixos/modules/programs/steam.nix
index d76863aff83b..31577ac2de45 100644
--- a/nixos/modules/programs/steam.nix
+++ b/nixos/modules/programs/steam.nix
@@ -4,6 +4,8 @@ let
   cfg = config.programs.steam;
   gamescopeCfg = config.programs.gamescope;
 
+  extraCompatPaths = lib.makeSearchPathOutput "steamcompattool" "" cfg.extraCompatPackages;
+
   steam-gamescope = let
     exports = builtins.attrValues (builtins.mapAttrs (n: v: "export ${n}=${v}") cfg.gamescopeSession.env);
   in
@@ -42,7 +44,7 @@ in {
       '';
       apply = steam: steam.override (prev: {
         extraEnv = (lib.optionalAttrs (cfg.extraCompatPackages != [ ]) {
-          STEAM_EXTRA_COMPAT_TOOLS_PATHS = lib.makeSearchPathOutput "steamcompattool" "" cfg.extraCompatPackages;
+          STEAM_EXTRA_COMPAT_TOOLS_PATHS = extraCompatPaths;
         }) // (lib.optionalAttrs cfg.extest.enable {
           LD_PRELOAD = "${pkgs.pkgsi686Linux.extest}/lib/libextest.so";
         }) // (prev.extraEnv or {});
@@ -139,6 +141,11 @@ in {
       Load the extest library into Steam, to translate X11 input events to
       uinput events (e.g. for using Steam Input on Wayland)
     '';
+
+    protontricks = {
+      enable = lib.mkEnableOption "protontricks, a simple wrapper for running Winetricks commands for Proton-enabled games";
+      package = lib.mkPackageOption pkgs "protontricks" { };
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -169,7 +176,8 @@ in {
     environment.systemPackages = [
       cfg.package
       cfg.package.run
-    ] ++ lib.optional cfg.gamescopeSession.enable steam-gamescope;
+    ] ++ lib.optional cfg.gamescopeSession.enable steam-gamescope
+    ++ lib.optional cfg.protontricks.enable (cfg.protontricks.package.override { inherit extraCompatPaths; });
 
     networking.firewall = lib.mkMerge [
       (lib.mkIf (cfg.remotePlay.openFirewall || cfg.localNetworkGameTransfers.openFirewall) {
diff --git a/nixos/modules/services/home-automation/ebusd.nix b/nixos/modules/services/home-automation/ebusd.nix
index ac9ec06639c1..f5c5479e8eaf 100644
--- a/nixos/modules/services/home-automation/ebusd.nix
+++ b/nixos/modules/services/home-automation/ebusd.nix
@@ -138,7 +138,7 @@ in
       after = [ "network.target" ];
       serviceConfig = {
         ExecStart = let
-          args = cli.toGNUCommandLineShell { } (foldr (a: b: a // b) { } [
+          args = cli.toGNUCommandLineShell { optionValueSeparator = "="; } (foldr (a: b: a // b) { } [
             {
               inherit (cfg) device port configpath scanconfig readonly;
               foreground = true;
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index fe0e6ec6c41c..facc0227abd0 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -27,11 +27,11 @@
         version = "2024-04-10";
       };
       ungoogled-patches = {
-        hash = "sha256-bGc8hQnuiGot0kThSAi4AFAwmvrNPs1bR7oZx2XoAGo=";
-        rev = "125.0.6422.76-1";
+        hash = "sha256-vHnXIrDdHGIe8byb41CiEWq3FPTecKg006dU7+iESKA=";
+        rev = "125.0.6422.112-1";
       };
     };
-    hash = "sha256-m7WeRloS6tGH2AwhkNicpqThUQmS+9w2xFS2dbmu1vw=";
-    version = "125.0.6422.76";
+    hash = "sha256-EA8TzemtndFb8qAp4XWNjwWmNRz/P4Keh3k1Cn9qLEU=";
+    version = "125.0.6422.112";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix
index 6c30f9a19bf6..5f86a28e465c 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.66";
+  "version" = "1.11.67";
   "hashes" = {
-    "desktopSrcHash" = "sha256-QrFk6NIHvWgQuJz33CEU6rwmgtGZ9w3L9vqj/rdCkE8=";
-    "desktopYarnHash" = "1kin5z6cjgsljdhh5f4fq2782ld86pza6hz58rq1zwbd187nzbwz";
-    "webSrcHash" = "sha256-xWaK2tHsuZmiwp7HExX83zKL8Z0ScRCEOnfxePWk2KI=";
-    "webYarnHash" = "1ykjpsg4d4kykd6w7c0yjyg8ljpc9czzwjx7ab27i84ys6pknx3q";
+    "desktopSrcHash" = "sha256-oM4/PKydmIBp2zVbzJRbVYnklYO2IHH7ZBV4MfLxnQo=";
+    "desktopYarnHash" = "04dbsacigq5jrh7gpyxj31grwzsg58cy6d4y7k3hmcwd4gj68iid";
+    "webSrcHash" = "sha256-faJiuAmEIEkNrwjgU06XT9J2NxJrJNIsPb1K5WXR0Lc=";
+    "webYarnHash" = "14sy3by840gbxqyvhwaj5k07hvhcsj300s39qjfsg1sx9fnfzck3";
   };
 }
diff --git a/pkgs/applications/office/morgen/default.nix b/pkgs/applications/office/morgen/default.nix
index 5f6c9ea5c119..4bd45374ece2 100644
--- a/pkgs/applications/office/morgen/default.nix
+++ b/pkgs/applications/office/morgen/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "morgen";
-  version = "3.4.2";
+  version = "3.4.3";
 
   src = fetchurl {
     url = "https://dl.todesktop.com/210203cqcj00tw1/versions/${version}/linux/deb";
-    hash = "sha256-N9G9yfUhKZd3dcsyBKODL6vnMqQgLk2DRQ+YZAYdPks=";
+    hash = "sha256-QxbvD18yoIidiDoU7FsCpdgYZolp8LRx93d1GTjtnfA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ar/ark-pixel-font/limit-builds.patch b/pkgs/by-name/ar/ark-pixel-font/limit-builds.patch
new file mode 100644
index 000000000000..c63798e071c9
--- /dev/null
+++ b/pkgs/by-name/ar/ark-pixel-font/limit-builds.patch
@@ -0,0 +1,34 @@
+diff --git a/build.py b/build.py
+index 48bc757d..88b9ed9b 100644
+--- a/build.py
++++ b/build.py
+@@ -1,6 +1,5 @@
+ from scripts import configs
+ from scripts.configs import path_define
+-from scripts.services import publish_service, info_service, template_service, image_service
+ from scripts.services.font_service import DesignContext, FontContext
+ from scripts.utils import fs_util
+ 
+@@ -21,21 +20,6 @@ def main():
+             font_context.make_pcf()
+             font_context.make_otc()
+             font_context.make_ttc()
+-            publish_service.make_release_zips(font_config, width_mode)
+-            info_service.make_info_file(design_context, width_mode)
+-            info_service.make_alphabet_txt_file(design_context, width_mode)
+-            template_service.make_alphabet_html_file(design_context, width_mode)
+-        template_service.make_demo_html_file(design_context)
+-        image_service.make_preview_image_file(font_config)
+-    template_service.make_index_html_file()
+-    template_service.make_playground_html_file()
+-    image_service.make_readme_banner()
+-    image_service.make_github_banner()
+-    image_service.make_itch_io_banner()
+-    image_service.make_itch_io_background()
+-    image_service.make_itch_io_cover()
+-    image_service.make_afdian_cover()
+-
+ 
+ if __name__ == '__main__':
+     main()
+
diff --git a/pkgs/by-name/ar/ark-pixel-font/package.nix b/pkgs/by-name/ar/ark-pixel-font/package.nix
index 578552a03f13..e93cccf68420 100644
--- a/pkgs/by-name/ar/ark-pixel-font/package.nix
+++ b/pkgs/by-name/ar/ark-pixel-font/package.nix
@@ -28,10 +28,15 @@ python312Packages.buildPythonPackage rec {
     gitpython
   ];
 
+  # By default build.py builds a LOT of extraneous artifacts we don't need.
+  patches = [ ./limit-builds.patch ];
+
   buildPhase = ''
     runHook preBuild
 
-    python build.py
+    # Too much debug output would break Hydra, so this jankness has to be here for it to build at all.
+    # I wish there's a builtin way to set the log level without modifying the script itself...
+    python3 build.py 2>&1 >/dev/null | grep -E '^(INFO|WARN|ERROR)'
 
     runHook postBuild
   '';
@@ -43,6 +48,9 @@ python312Packages.buildPythonPackage rec {
     install -Dm444 build/outputs/*.otf -t $out/share/fonts/opentype
     install -Dm444 build/outputs/*.ttf -t $out/share/fonts/truetype
     install -Dm444 build/outputs/*.woff2 -t $out/share/fonts/woff2
+    install -Dm444 build/outputs/*.pcf -t $out/share/fonts/pcf
+    install -Dm444 build/outputs/*.otc -t $out/share/fonts/otc
+    install -Dm444 build/outputs/*.ttc -t $out/share/fonts/ttc
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ba/basedpyright/package-lock.json b/pkgs/by-name/ba/basedpyright/package-lock.json
new file mode 100644
index 000000000000..dee0ab51a521
--- /dev/null
+++ b/pkgs/by-name/ba/basedpyright/package-lock.json
@@ -0,0 +1,193 @@
+{
+  "name": "pyright-root",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pyright-root",
+      "hasInstallScript": true,
+      "dependencies": {
+        "glob": "^7.2.3",
+        "jsonc-parser": "^3.2.1"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "node_modules/jsonc-parser": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.1.tgz",
+      "integrity": "sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA=="
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  },
+  "dependencies": {
+    "balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "requires": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+    },
+    "fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+    },
+    "glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "requires": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      }
+    },
+    "inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "requires": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "jsonc-parser": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.1.tgz",
+      "integrity": "sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA=="
+    },
+    "minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "requires": {
+        "brace-expansion": "^1.1.7"
+      }
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg=="
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  }
+}
diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
new file mode 100644
index 000000000000..b22acd3544ff
--- /dev/null
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  nix-update-script,
+  buildNpmPackage,
+  fetchFromGitHub,
+  runCommand,
+  jq,
+}:
+
+let
+  version = "1.12.3";
+
+  src = fetchFromGitHub {
+    owner = "detachhead";
+    repo = "basedpyright";
+    rev = "v${version}";
+    hash = "sha256-n4jiKxkXGCKJkuXSsUktsiJQuCcZ+D/RJH/ippnOVw8=";
+  };
+
+  patchedPackageJSON = runCommand "package.json" { } ''
+    ${jq}/bin/jq '
+      .devDependencies |= with_entries(select(.key == "glob" or .key == "jsonc-parser"))
+      | .scripts =  {  }
+      ' ${src}/package.json > $out
+  '';
+
+  pyright-root = buildNpmPackage {
+    pname = "pyright-root";
+    inherit version src;
+    npmDepsHash = "sha256-63kUhKrxtJhwGCRBnxBfOFXs2ARCNn+OOGu6+fSJey4=";
+    dontNpmBuild = true;
+    postPatch = ''
+      cp ${patchedPackageJSON} ./package.json
+      cp ${./package-lock.json} ./package-lock.json
+    '';
+    installPhase = ''
+      runHook preInstall
+      cp -r . "$out"
+      runHook postInstall
+    '';
+  };
+
+  pyright-internal = buildNpmPackage {
+    pname = "pyright-internal";
+    inherit version src;
+    sourceRoot = "${src.name}/packages/pyright-internal";
+    npmDepsHash = "sha256-ba7GzkKrXps4W1ptv+j9fMMXwpi30ymbqgIJ64PaZ1g=";
+    dontNpmBuild = true;
+    # FIXME: Remove this flag when TypeScript 5.5 is released
+    npmFlags = [ "--legacy-peer-deps" ];
+    installPhase = ''
+      runHook preInstall
+      cp -r . "$out"
+      runHook postInstall
+    '';
+  };
+in
+buildNpmPackage rec {
+  pname = "basedpyright";
+  inherit version src;
+
+  sourceRoot = "${src.name}/packages/pyright";
+  npmDepsHash = "sha256-9V1T6w1G1SZi19dgRaFmv+Vy71hmQR+L6cDjQZJrGy8=";
+
+  postPatch = ''
+    chmod +w ../../
+    ln -s ${pyright-root}/node_modules ../../node_modules
+    chmod +w ../pyright-internal
+    ln -s ${pyright-internal}/node_modules ../pyright-internal/node_modules
+  '';
+
+  postInstall = ''
+    mv "$out/bin/pyright" "$out/bin/basedpyright"
+    mv "$out/bin/pyright-langserver" "$out/bin/basedpyright-langserver"
+  '';
+
+  dontNpmBuild = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/detachhead/basedpyright/releases/tag/${version}";
+    description = "Type checker for the Python language";
+    homepage = "https://github.com/detachhead/basedpyright";
+    license = lib.licenses.mit;
+    mainProgram = "basedpyright";
+    maintainers = with lib.maintainers; [ kiike ];
+  };
+}
diff --git a/pkgs/by-name/fa/fastfetch/package.nix b/pkgs/by-name/fa/fastfetch/package.nix
index 6fcc7c3773ad..e9394ab92267 100644
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -47,13 +47,13 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.13.1";
+  version = "2.13.2";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-AB7GxeKLD+xdnFEA/STD7CFazsybYGtX10Q/Q4MRTrU=";
+    hash = "sha256-Wt+HFl+HJKMzC8O0JslVLpHFrmVVSBpac79TsKVpz+k=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/by-name/hd/hdos/package.nix b/pkgs/by-name/hd/hdos/package.nix
new file mode 100644
index 000000000000..9737d12d273d
--- /dev/null
+++ b/pkgs/by-name/hd/hdos/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  makeWrapper,
+  # TODO: for jre 17+, we'll need a workaroud:
+  # https://gitlab.com/hdos/issues/-/issues/2004
+  openjdk11,
+  makeDesktopItem,
+  copyDesktopItems,
+  libGL,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "hdos";
+  version = "8";
+
+  src = fetchurl {
+    url = "https://cdn.hdos.dev/launcher/v${finalAttrs.version}/hdos-launcher.jar";
+    hash = "sha256-00ddeR+ov6Tjrn+pscXoao4C0ek/iP9Hdlgq946pL8A=";
+  };
+
+  dontUnpack = true;
+
+  desktop = makeDesktopItem {
+    name = "HDOS";
+    type = "Application";
+    exec = "hdos";
+    icon = fetchurl {
+      url = "https://raw.githubusercontent.com/flathub/dev.hdos.HDOS/8e17cbecb06548fde2c023032e89ddf30befeabc/dev.hdos.HDOS.png";
+      hash = "sha256-pqLNJ0g7GCPotgEPfw2ZZOqapaCRAsJxB09INp6Y6gM=";
+    };
+    comment = "HDOS is a client for Old School RuneScape that emulates the era of 2008-2011 RuneScape HD";
+    desktopName = "HDOS";
+    genericName = "Oldschool Runescape";
+    categories = [ "Game" ];
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    makeWrapper ${lib.getExe openjdk11} $out/bin/hdos \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
+      --add-flags "-jar $src"
+    runHook postInstall
+  '';
+
+  desktopItems = [ finalAttrs.desktop ];
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "High Detail Old School Runescape Client";
+    homepage = "https://hdos.dev";
+    changelog = "https://hdos.dev/changelog";
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    license = lib.licenses.unfree;
+    platforms = openjdk11.meta.platforms;
+    maintainers = [ lib.maintainers.misterio77 ];
+  };
+})
diff --git a/pkgs/by-name/hd/hdos/update.sh b/pkgs/by-name/hd/hdos/update.sh
new file mode 100755
index 000000000000..e2effc6d0d9e
--- /dev/null
+++ b/pkgs/by-name/hd/hdos/update.sh
@@ -0,0 +1,7 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p common-updater-scripts findutils
+
+set -euo pipefail
+
+version="$(curl -s https://cdn.hdos.dev/client/getdown.txt | grep 'launcher.version = ' | cut -d '=' -f2 | xargs)"
+update-source-version hdos "$version"
diff --git a/pkgs/by-name/st/stirling-pdf/package.nix b/pkgs/by-name/st/stirling-pdf/package.nix
index dcd4f61d8102..9a7ef232c01f 100644
--- a/pkgs/by-name/st/stirling-pdf/package.nix
+++ b/pkgs/by-name/st/stirling-pdf/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "stirling-pdf";
-  version = "0.23.1";
+  version = "0.24.6";
 
   src = fetchFromGitHub {
     owner = "Stirling-Tools";
     repo = "Stirling-PDF";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-71caSM4J0sNMqWX0ok8aO3wdpVcjfrn/yVGLWeO5fOk=";
+    hash = "sha256-QYoQaRerXLjF3D4S+HSTeaLz12Kxo2emBxSEpWVXUS0=";
   };
 
   patches = [
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "sha256-8suWAX1+GGMvMUaymZnze7cBL701P/381dGqnyfha7s=";
+    outputHash = "sha256-w1H1YgMyVjd/9lSRt8zZCRgcYDXarr/C+KBrsjI/jYY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tr/trealla/package.nix b/pkgs/by-name/tr/trealla/package.nix
index 64344c770923..d20888a48b1a 100644
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@@ -23,13 +23,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.52.6";
+  version = "2.52.9";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JTyXpaoHpf10fUNxx+qllhS0D9rfOP64BpjLQ9bob8k=";
+    hash = "sha256-fehgNWCH/c0wbnlTpydA9K8FPnvSFpcwum1ThngikGY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index 9940ba44c08d..5fc74e0d01d0 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,10 +1,10 @@
 {
   "darwin": {
-    "hash": "sha256-XRwnT73kCv4mO2DKkuFQ8qwpIIH9iyRTrJEZUi6tscU=",
-    "version": "0.2024.05.14.08.01.stable_04"
+    "hash": "sha256-cK82M7vOjtDdfWbaYzbHHkcqwF8L3crVA9jJotnPpX4=",
+    "version": "0.2024.05.21.16.09.stable_02"
   },
   "linux": {
-    "hash": "sha256-16ZMzvdkAAf9xSiL7TCaiJwEMd+jbOYIL/xiF2Todbw=",
-    "version": "0.2024.05.14.08.01.stable_04"
+    "hash": "sha256-chIrRzsxjFYS4UFYCTy04cdwSyCq/+/WiKBAmV9OdLs=",
+    "version": "0.2024.05.21.16.09.stable_02"
   }
 }
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 2d383c876cba..adf310cef2b7 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -51,7 +51,16 @@ stdenv.mkDerivation (finalAttrs: {
       ]}"
   ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "--with-build-cc=${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc"
-  ];
+  ] ++ (lib.optionals (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17") [
+      # lld17+ passes `--no-undefined-version` by default and makes this a hard
+      # error; ncurses' `resulting.map` version script references symbols that
+      # aren't present.
+      #
+      # See: https://lists.gnu.org/archive/html/bug-ncurses/2024-05/msg00086.html
+      #
+      # For now we allow this with `--undefined-version`:
+      "LDFLAGS=-Wl,--undefined-version"
+  ]);
 
   # Only the C compiler, and explicitly not C++ compiler needs this flag on solaris:
   CFLAGS = lib.optionalString stdenv.isSunOS "-D_XOPEN_SOURCE_EXTENDED";
diff --git a/pkgs/development/libraries/ntirpc/default.nix b/pkgs/development/libraries/ntirpc/default.nix
index 39acba13d73e..5ae6380849c8 100644
--- a/pkgs/development/libraries/ntirpc/default.nix
+++ b/pkgs/development/libraries/ntirpc/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ntirpc";
-  version = "5.0";
+  version = "5.8";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "ntirpc";
     rev = "v${version}";
-    sha256 = "sha256-xqnfo07EHwendzibIz187vdaenHwxg078D6zJvoyewc=";
+    sha256 = "sha256-t9InlnlwVts9mlrH8sHaaTYSrjJKlkFlGs1YCmZzjdE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/asteval/default.nix b/pkgs/development/python-modules/asteval/default.nix
index d625dfe3448e..e9eed2ac38e0 100644
--- a/pkgs/development/python-modules/asteval/default.nix
+++ b/pkgs/development/python-modules/asteval/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "asteval";
-  version = "0.9.32";
+  version = "0.9.33";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "lmfit";
     repo = "asteval";
     rev = "refs/tags/${version}";
-    hash = "sha256-3eML5lEKEUlp3Fwdgvk31an83x8no5ichskKvzYJDsE=";
+    hash = "sha256-j07HH84cn2AA5DyMcM7sXiBubCjZP67RJXVcErMPyBk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bambi/default.nix b/pkgs/development/python-modules/bambi/default.nix
index 9f051f511c4d..f2447b2c9d12 100644
--- a/pkgs/development/python-modules/bambi/default.nix
+++ b/pkgs/development/python-modules/bambi/default.nix
@@ -87,5 +87,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/bambinos/bambi/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ bcdarwin ];
+    # https://github.com/NixOS/nixpkgs/issues/310940
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/casbin/default.nix b/pkgs/development/python-modules/casbin/default.nix
index 81c0dd3c24b6..0670369db9c5 100644
--- a/pkgs/development/python-modules/casbin/default.nix
+++ b/pkgs/development/python-modules/casbin/default.nix
@@ -23,9 +23,9 @@ buildPythonPackage rec {
     hash = "sha256-MeTOxDrk6pvJ1L9ZOKzWhXK8WXo0jWXGKEKR7y0ejbQ=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     simpleeval
     wcmatch
   ];
diff --git a/pkgs/development/python-modules/deezer-python/default.nix b/pkgs/development/python-modules/deezer-python/default.nix
index 812f9eba2469..0bd136e6fceb 100644
--- a/pkgs/development/python-modules/deezer-python/default.nix
+++ b/pkgs/development/python-modules/deezer-python/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "deezer-python";
-  version = "6.1.1";
+  version = "6.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,15 +23,20 @@ buildPythonPackage rec {
     owner = "browniebroke";
     repo = "deezer-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-pzEXiWKMP2Wqme/pqfTMHxWH/4YcCS6u865wslHrUqI=";
+    hash = "sha256-Y1y8FBxpGpNIWCZbel9fdGLGC9VM9h1BvHtUxCZxp/A=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace " --cov=deezer" ""
+      --replace-fail " --cov=deezer" ""
   '';
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    requests
+    tornado
+  ];
 
   nativeCheckInputs = [
     environs
@@ -40,11 +45,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  propagatedBuildInputs = [
-    requests
-    tornado
-  ];
-
   pythonImportsCheck = [ "deezer" ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/fido2/default.nix b/pkgs/development/python-modules/fido2/default.nix
index 5ce442d56bd2..8b5a06c4a1fc 100644
--- a/pkgs/development/python-modules/fido2/default.nix
+++ b/pkgs/development/python-modules/fido2/default.nix
@@ -3,38 +3,33 @@
   buildPythonPackage,
   cryptography,
   fetchPypi,
-  mock,
   poetry-core,
-  pyfakefs,
+  pyscard,
   pythonOlder,
-  six,
-  unittestCheckHook,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "fido2";
   version = "1.1.3";
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-JhAPIm0SztYhymGYUozhft9nt430KHruEoX+481aqfw=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
-    cryptography
-    six
-  ];
+  dependencies = [ cryptography ];
 
-  nativeCheckInputs = [
-    unittestCheckHook
-    mock
-    pyfakefs
-  ];
+  passthru.optional-dependencies = {
+    pcsc = [ pyscard ];
+  };
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   unittestFlagsArray = [ "-v" ];
 
diff --git a/pkgs/development/python-modules/life360/default.nix b/pkgs/development/python-modules/life360/default.nix
index d8774ff34453..7e001e79b5f5 100644
--- a/pkgs/development/python-modules/life360/default.nix
+++ b/pkgs/development/python-modules/life360/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "life360";
-  version = "7.0.0";
+  version = "7.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "pnbruckner";
     repo = "life360";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+fvzZ1IsPsXLTcfR7vrE4n1nF7CdvoL4BzDJMsDBZVY=";
+    hash = "sha256-GkCs479lXcnCvb5guxyc+ZuZdiH4n8uD2VbkC+yijgg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index 335f0b8239a7..ce0b59dcfa86 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -15,21 +15,21 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbot";
-  version = "0.45.0";
+  version = "0.46.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     rev = "refs/tags/${version}";
-    hash = "sha256-lQVUHZvAZ4J0DLlUl30dSz2wwXKb9MK5prkXvub0yNI=";
+    hash = "sha256-fiWjChr7NATkO6jNBlt5kqxaLSSZWcdd7TjQwMP6klY=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bleak
     bleak-retry-connector
     boto3
diff --git a/pkgs/development/python-modules/requests-file/default.nix b/pkgs/development/python-modules/requests-file/default.nix
index 2c57e46c5696..d76cdfbdaefb 100644
--- a/pkgs/development/python-modules/requests-file/default.nix
+++ b/pkgs/development/python-modules/requests-file/default.nix
@@ -1,21 +1,26 @@
 {
   lib,
-  fetchPypi,
+  fetchFromGitHub,
   buildPythonPackage,
   setuptools,
   setuptools-scm,
   pytestCheckHook,
+  pythonOlder,
   requests,
 }:
 
 buildPythonPackage rec {
   pname = "requests-file";
-  version = "2.0.0";
+  version = "2.1.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-IMWTFinFWP2lZsrMEM/izVAkM+Yo9WjDTIDZagzJWXI=";
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "dashea";
+    repo = "requests-file";
+    rev = "refs/tags/${version}";
+    hash = "sha256-JtdtE44yiw2mLMZ0bJv0QiGWb7f8ywPLF7+BUufh/g4=";
   };
 
   build-system = [
@@ -23,7 +28,7 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [ requests ];
+  dependencies = [ requests ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -32,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Transport adapter for fetching file:// URLs with the requests python library";
     homepage = "https://github.com/dashea/requests-file";
+    changelog = "https://github.com/dashea/requests-file/blob/${version}/CHANGES.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
index 9c688c7445d3..c97b5fc5598a 100644
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@@ -5,8 +5,8 @@
   buildPythonPackage,
   cryptography,
   cssselect,
-  fetchPypi,
-  fetchpatch,
+  defusedxml,
+  fetchFromGitHub,
   glibcLocales,
   installShellFiles,
   itemadapter,
@@ -28,32 +28,25 @@
   testfixtures,
   tldextract,
   twisted,
+  uvloop,
   w3lib,
   zope-interface,
 }:
 
 buildPythonPackage rec {
   pname = "scrapy";
-  version = "2.11.1";
+  version = "2.11.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit version;
-    pname = "Scrapy";
-    hash = "sha256-czoDnHQj5StpvygQtTMgk9TkKoSEYDWcB7Auz/j3Pr4=";
+  src = fetchFromGitHub {
+    owner = "scrapy";
+    repo = "scrapy";
+    rev = "refs/tags/${version}";
+    hash = "sha256-EaO1kQ3VSTwEW+r0kSKycOxHNTPwwCVjch1ZBrTU0qQ=";
   };
 
-  patches = [
-    # https://github.com/scrapy/scrapy/pull/6316
-    # fix test_get_func_args. remove on next update
-    (fetchpatch {
-      name = "test_get_func_args.patch";
-      url = "https://github.com/scrapy/scrapy/commit/b1fe97dc6c8509d58b29c61cf7801eeee1b409a9.patch";
-      hash = "sha256-POlmsuW4SD9baKwZieKfmlp2vtdlb7aKQ62VOmNXsr0=";
-    })
-  ];
 
   nativeBuildInputs = [
     installShellFiles
@@ -63,6 +56,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     cryptography
     cssselect
+    defusedxml
     itemadapter
     itemloaders
     lxml
@@ -87,6 +81,7 @@ buildPythonPackage rec {
     pytestCheckHook
     sybil
     testfixtures
+    uvloop
   ];
 
   LC_ALL = "en_US.UTF-8";
@@ -101,11 +96,6 @@ buildPythonPackage rec {
 
   disabledTests =
     [
-      # It's unclear if the failures are related to libxml2, https://github.com/NixOS/nixpkgs/pull/123890
-      "test_nested_css"
-      "test_nested_xpath"
-      "test_flavor_detection"
-      "test_follow_whitespace"
       # Requires network access
       "AnonymousFTPTestCase"
       "FTPFeedStorageTest"
@@ -119,14 +109,6 @@ buildPythonPackage rec {
       "test_timeout_download_from_spider_server_hangs"
       "test_unbounded_response"
       "CookiesMiddlewareTest"
-      # Depends on uvloop
-      "test_asyncio_enabled_reactor_different_loop"
-      "test_asyncio_enabled_reactor_same_loop"
-      # Fails with AssertionError
-      "test_peek_fifo"
-      "test_peek_one_element"
-      "test_peek_lifo"
-      "test_callback_kwargs"
       # Test fails on Hydra
       "test_start_requests_laziness"
     ]
diff --git a/pkgs/development/python-modules/tokenlib/default.nix b/pkgs/development/python-modules/tokenlib/default.nix
index 1b0641574eec..59a19b81a3f9 100644
--- a/pkgs/development/python-modules/tokenlib/default.nix
+++ b/pkgs/development/python-modules/tokenlib/default.nix
@@ -4,25 +4,40 @@
   fetchFromGitHub,
   requests,
   webob,
+  fetchpatch,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "tokenlib";
-  version = "0.3.1";
-  format = "setuptools";
+  version = "2.0.0";
+
+  pyproject = true;
+  build-system = [ setuptools ];
 
   src = fetchFromGitHub {
     owner = "mozilla-services";
-    repo = pname;
-    rev = "refs/tags/${version}";
-    sha256 = "0bq6dqyfwh29pg8ngmrm4mx4q27an9lsj0p9l79p9snn4g2rxzc8";
+    repo = "tokenlib";
+    rev = "${version}";
+    hash = "sha256-+KybaLb4XAcuBARJUhL5gK71jfNMb8YL8dV5Vzf7yXI=";
   };
 
-  propagatedBuildInputs = [
+  patches = [
+    # fix wrong function name in tests
+    # See https://github.com/mozilla-services/tokenlib/pull/9
+    (fetchpatch {
+      url = "https://github.com/mozilla-services/tokenlib/pull/9/commits/cb7ef761f82f36e40069bd1b8684eec05af3b8a3.patch";
+      hash = "sha256-hc+iydxZu9bFqBD0EQDWMkRs2ibqNAhx6Qxjh6ppKNw=";
+    })
+  ];
+
+  dependencies = [
     requests
     webob
   ];
 
+  pythonImportsCheck = [ "tokenlib" ];
+
   meta = with lib; {
     homepage = "https://github.com/mozilla-services/tokenlib";
     description = "Generic support library for signed-token-based auth schemes";
diff --git a/pkgs/development/tools/database/apgdiff/default.nix b/pkgs/development/tools/database/apgdiff/default.nix
index 2aa53fbabd29..8ce720efd681 100644
--- a/pkgs/development/tools/database/apgdiff/default.nix
+++ b/pkgs/development/tools/database/apgdiff/default.nix
@@ -1,22 +1,33 @@
 { lib
-, stdenvNoCC
-, fetchurl
-, makeWrapper
+, maven
+, fetchFromGitHub
 , jre
+, makeWrapper
 }:
-stdenvNoCC.mkDerivation (finalAttrs: {
-  version = "2.7.0";
+maven.buildMavenPackage rec {
   pname = "apgdiff";
+  version = "2.7.0";
 
-  src = fetchurl {
-    url = "https://github.com/fordfrog/apgdiff/raw/release_${finalAttrs.version}/releases/apgdiff-${finalAttrs.version}.jar";
-    sha256 = "sha256-6OempDmedl6LOwP/s5y0hOIxGDWHd7qM7/opW3UwQ+I=";
+  src = fetchFromGitHub {
+    sparseCheckout = [ "src" ];
+    owner = "fordfrog";
+    repo = "apgdiff";
+    rev = "refs/tags/release_${version}";
+    hash = "sha256-2m+9QNwQV2tJwOabTXE2xjRB5gDrSwyL6zL2op+wmkM=";
   };
 
+  # Fix wrong version string in --help
+  postPatch = ''
+    sed -i 's/VersionNumber=.*/VersionNumber=${version}/' \
+      src/main/resources/cz/startnet/utils/pgdiff/Resources.properties
+  '';
+
+  mvnHash = "sha256-zJQirS8sVqHKZsBukEOf7ox5IeiAVOP6wEHWb4CAyxc=";
+
   nativeBuildInputs = [ makeWrapper ];
 
-  buildCommand = ''
-    install -Dm644 $src $out/lib/apgdiff.jar
+  installPhase = ''
+    install -Dm644 target/apgdiff-${version}.jar $out/lib/apgdiff.jar
 
     mkdir -p $out/bin
     makeWrapper ${jre}/bin/java $out/bin/apgdiff \
@@ -30,7 +41,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://apgdiff.com";
     license = licenses.mit;
     inherit (jre.meta) platforms;
-    sourceProvenance = [ sourceTypes.binaryBytecode ];
     maintainers = [ maintainers.misterio77 ];
   };
-})
+}
diff --git a/pkgs/servers/nfs-ganesha/default.nix b/pkgs/servers/nfs-ganesha/default.nix
index 54f0cdbd4857..c5d3d97d629f 100644
--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
-  version = "5.7";
+  version = "5.9";
   outputs = [ "out" "tools" ];
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     rev = "V${version}";
-    sha256 = "sha256-4GYte9kPUR4kFHrUzHXtiMGbuRhZ+4iw1hmqi+geljc=";
+    sha256 = "sha256-YFQcqRZenJUdTnlYM7gPnIxU47dytSHk5ALdbpSf5Ms=";
   };
 
   preConfigure = "cd src";
diff --git a/pkgs/servers/web-apps/lemmy/server.nix b/pkgs/servers/web-apps/lemmy/server.nix
index 4f605b0b2dbd..d4d44c473f5c 100644
--- a/pkgs/servers/web-apps/lemmy/server.nix
+++ b/pkgs/servers/web-apps/lemmy/server.nix
@@ -6,6 +6,7 @@
 , postgresql
 , libiconv
 , Security
+, SystemConfiguration
 , protobuf
 , rustfmt
 , nixosTests
@@ -33,7 +34,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = pinData.serverCargoHash;
 
   buildInputs = [ postgresql ]
-    ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
+    ++ lib.optionals stdenv.isDarwin [ libiconv Security SystemConfiguration ];
 
   # Using OPENSSL_NO_VENDOR is not an option on darwin
   # As of version 0.10.35 rust-openssl looks for openssl on darwin
diff --git a/pkgs/tools/admin/qovery-cli/default.nix b/pkgs/tools/admin/qovery-cli/default.nix
index d51b0e716c97..6db291f236d5 100644
--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "qovery-cli";
-  version = "0.92.8";
+  version = "0.93.1";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8QDuYb6NzoX9c+gROR5ECqAp/pfwFtPPNMaNiWGPtD4=";
+    hash = "sha256-wJivWE0B2u3xNhD9mAbHFCxl3aKv6YfWxJ/8UOV4E70=";
   };
 
-  vendorHash = "sha256-6gjYnDv4L2AO47uWcp/MySX9i3IDMIWQUvgglxPCvGo=";
+  vendorHash = "sha256-wGgzVtQc4e0thiM9fJb7BxJl348wCDZvPCx0+Qlw0mQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/compression/bzip2/default.nix b/pkgs/tools/compression/bzip2/default.nix
index bfab2dbb9467..0268b60afc52 100644
--- a/pkgs/tools/compression/bzip2/default.nix
+++ b/pkgs/tools/compression/bzip2/default.nix
@@ -25,7 +25,7 @@ in {
 
   patches = [
     (fetchurl {
-      url = "https://ftp.suse.com/pub/people/sbrabec/bzip2/for_downstream/bzip2-1.0.6.2-autoconfiscated.patch";
+      url = "ftp://ftp.suse.com/pub/people/sbrabec/bzip2/for_downstream/bzip2-1.0.6.2-autoconfiscated.patch";
       sha256 = "sha256-QMufl6ffJVVVVZespvkCbFpB6++R1lnq1687jEsUjr0=";
     })
   ];
diff --git a/pkgs/tools/compression/upx/default.nix b/pkgs/tools/compression/upx/default.nix
index 3a2c6394f90a..f20e39a4bca5 100644
--- a/pkgs/tools/compression/upx/default.nix
+++ b/pkgs/tools/compression/upx/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "upx";
-  version = "4.2.3";
+  version = "4.2.4";
   src = fetchFromGitHub {
     owner = "upx";
     repo = "upx";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-3+aOadTqQ1apnrXt2I27j8P6iJF96W90YjxVTPmRhs0=";
+    hash = "sha256-r36BD5f/sQSz3GjvreOptc7atIaaBZKpU+7qm+BKLss=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/misc/gh-dash/default.nix b/pkgs/tools/misc/gh-dash/default.nix
index 82201e0bd53d..a5435c2991fb 100644
--- a/pkgs/tools/misc/gh-dash/default.nix
+++ b/pkgs/tools/misc/gh-dash/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gh-dash";
-  version = "3.14.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "gh-dash";
     rev = "v${version}";
-    hash = "sha256-6YPUGOQ2KBfu+3XAgub9Cpz0QBrU2kV+gq13tUtzY+w=";
+    hash = "sha256-mF7n4nrsKyp46U4jar+ioUKwpaETiDt4Ol/5DZrjvCs=";
   };
 
   vendorHash = "sha256-jCf9FWAhZK5hTzyy8N4r5dfUYTgESmsn8iKxCccgWiM=";
diff --git a/pkgs/tools/networking/miniupnpc/default.nix b/pkgs/tools/networking/miniupnpc/default.nix
index f9b8f0c536fa..0b766ea87227 100644
--- a/pkgs/tools/networking/miniupnpc/default.nix
+++ b/pkgs/tools/networking/miniupnpc/default.nix
@@ -9,7 +9,10 @@ stdenv.mkDerivation rec {
   version = "2.2.7";
 
   src = fetchurl {
-    url = "https://miniupnp.tuxfamily.org/files/${pname}-${version}.tar.gz";
+    urls = [
+      "https://miniupnp.tuxfamily.org/files/${pname}-${version}.tar.gz"
+      "http://miniupnp.free.fr/files/${pname}-${version}.tar.gz"
+    ];
     sha256 = "sha256-sMOicFaED9DskyilqbrD3F4OxtLoczNJz1d7CqHnCsE=";
   };
 
diff --git a/pkgs/tools/package-management/protontricks/default.nix b/pkgs/tools/package-management/protontricks/default.nix
index c3c43163c671..a3ba1f112fb8 100644
--- a/pkgs/tools/package-management/protontricks/default.nix
+++ b/pkgs/tools/package-management/protontricks/default.nix
@@ -12,6 +12,7 @@
 , yad
 , pytestCheckHook
 , nix-update-script
+, extraCompatPaths ? ""
 }:
 
 buildPythonApplication rec {
@@ -51,7 +52,7 @@ buildPythonApplication rec {
     ]}"
     # Steam Runtime does not work outside of steam-run, so don't use it
     "--set STEAM_RUNTIME 0"
-  ];
+  ] ++ lib.optional (extraCompatPaths != "") "--set STEAM_EXTRA_COMPAT_TOOLS_PATHS ${extraCompatPaths}";
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8126fabe5d66..33735423c67a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25837,7 +25837,7 @@ with pkgs;
   leafnode1 = callPackage ../servers/news/leafnode/1.nix { };
 
   lemmy-server = callPackage ../servers/web-apps/lemmy/server.nix {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
   lemmy-ui = callPackage ../servers/web-apps/lemmy/ui.nix {