diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 372cb78f7665..64969dc2b426 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -295,20 +295,6 @@ jobs:
           REPOSITORY: ${{ github.repository }}
           NUMBER: ${{ github.event.number }}
 
-      - name: Requesting maintainer reviews
-        run: |
-          # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
-          # There appears to be no API to request reviews based on GitHub IDs
-          jq -r 'keys[]' comparison/maintainers.json \
-            | while read -r id; do gh api /user/"$id" --jq .login; done \
-            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
-
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          NUMBER: ${{ github.event.number }}
-          AUTHOR: ${{ github.event.pull_request.user.login }}
-
       - name: Add eval summary to commit statuses
         if: ${{ github.event_name == 'pull_request_target' }}
         run: |
@@ -328,3 +314,17 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           NUMBER: ${{ github.event.number }}
+
+      - name: Requesting maintainer reviews
+        run: |
+          # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
+          # There appears to be no API to request reviews based on GitHub IDs
+          jq -r 'keys[]' comparison/maintainers.json \
+            | while read -r id; do gh api /user/"$id" --jq .login; done \
+            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
+
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          NUMBER: ${{ github.event.number }}
+          AUTHOR: ${{ github.event.pull_request.user.login }}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index aac137019f9e..90b2f335206b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2129,6 +2129,7 @@
     github = "asymmetric";
     githubId = 101816;
     name = "Lorenzo Manacorda";
+    matrix = "@asymmetric:matrix.dapp.org.uk";
   };
   aszlig = {
     email = "aszlig@nix.build";
@@ -3314,6 +3315,13 @@
     github = "brendanreis";
     githubId = 10686906;
   };
+  bretek = {
+    email = "josephmadden999@gmail.com";
+    github = "bretek";
+    githubId = 79257746;
+    name = "Joseph Madden";
+    keys = [ { fingerprint = "3CF8 E983 2219 AB4B 0E19  158E 6112 1921 C9F8 117C"; } ];
+  };
   brettlyons = {
     email = "blyons@fastmail.com";
     github = "brettlyons";
@@ -7359,7 +7367,7 @@
     github = "FedX-sudo";
     githubId = 66258975;
     name = "Fedx sudo";
-    matrix = "fedx:matrix.org";
+    matrix = "@fedx:matrix.org";
   };
   fee1-dead = {
     email = "ent3rm4n@gmail.com";
@@ -12803,7 +12811,7 @@
   };
   lenny = {
     name = "Lenny.";
-    matrix = "lenny@flipdot.org";
+    matrix = "@lenny:flipdot.org";
     keys = [ { fingerprint = "6D63 2D4D 0CFE 8D53 F5FD  C7ED 738F C800 6E9E A634"; } ];
   };
   leo248 = {
diff --git a/nixos/modules/services/misc/homepage-dashboard.nix b/nixos/modules/services/misc/homepage-dashboard.nix
index a4e5b8d2fc8c..35908488f487 100644
--- a/nixos/modules/services/misc/homepage-dashboard.nix
+++ b/nixos/modules/services/misc/homepage-dashboard.nix
@@ -254,6 +254,14 @@ in
           ExecStart = lib.getExe cfg.package;
           Restart = "on-failure";
         };
+
+        preStart = ''
+          # Related:
+          # * https://github.com/NixOS/nixpkgs/issues/346016 ("homepage-dashboard: cache dir is not cleared upon version upgrade")
+          # * https://github.com/gethomepage/homepage/discussions/4560 ("homepage NixOS package does not clear cache on upgrade leaving broken state")
+          # * https://github.com/vercel/next.js/discussions/58864 ("Feature Request: Allow configuration of cache dir")
+          rm -rf "$NIXPKGS_HOMEPAGE_CACHE_DIR"/*
+        '';
       };
 
       networking.firewall = lib.mkIf cfg.openFirewall {
diff --git a/pkgs/applications/backup/vorta/default.nix b/pkgs/applications/backup/vorta/default.nix
index 0eb847724fea..18fd4e2126de 100644
--- a/pkgs/applications/backup/vorta/default.nix
+++ b/pkgs/applications/backup/vorta/default.nix
@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vorta";
-  version = "0.9.1";
+  version = "0.10.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "borgbase";
     repo = "vorta";
-    rev = "v${version}";
-    hash = "sha256-wGlnldS2p92NAYAyRPqKjSneIlbdsOiJ0N42n/mMGFI=";
+    tag = "v${version}";
+    hash = "sha256-VhM782mFWITA0VlKw0sBIu/UxUqlFLgq5XVdCpQggCw=";
   };
 
   nativeBuildInputs = [
@@ -78,15 +78,19 @@ python3Packages.buildPythonApplication rec {
       export QT_QPA_PLATFORM=offscreen
     '';
 
-  disabledTestPaths = [
-    # QObject::connect: No such signal QPlatformNativeInterface::systemTrayWindowChanged(QScreen*)
-    "tests/test_excludes.py"
-    "tests/integration"
-    "tests/unit"
-  ];
+  disabledTestPaths =
+    [
+      # QObject::connect: No such signal QPlatformNativeInterface::systemTrayWindowChanged(QScreen*)    "tests/test_excludes.py"
+      "tests/integration"
+      "tests/unit"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      # Darwin-only test
+      "tests/network_manager/test_darwin.py"
+    ];
 
   meta = with lib; {
-    changelog = "https://github.com/borgbase/vorta/releases/tag/${src.rev}";
+    changelog = "https://github.com/borgbase/vorta/releases/tag/v${version}";
     description = "Desktop Backup Client for Borg";
     homepage = "https://vorta.borgbase.com/";
     license = licenses.gpl3Only;
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 79b1e07ae5b7..c9d6a47ffdd9 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -11290,6 +11290,18 @@ final: prev:
     meta.homepage = "https://github.com/rust-lang/rust.vim/";
   };
 
+  rzls-nvim = buildVimPlugin {
+    pname = "rzls.nvim";
+    version = "2024-12-24";
+    src = fetchFromGitHub {
+      owner = "tris203";
+      repo = "rzls.nvim";
+      rev = "494a0a377d84f7424fc95d5f04f57027e24dedd7";
+      sha256 = "0fb8r1csdqiggbb68p22a0q3624ck9752z9ay9iarqkkap0z9z7c";
+    };
+    meta.homepage = "https://github.com/tris203/rzls.nvim/";
+  };
+
   sad-vim = buildVimPlugin {
     pname = "sad.vim";
     version = "2019-02-18";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 34c5dcb6d04e..c2dddac4eeee 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -2656,6 +2656,10 @@ in
     dependencies = [ self.nvim-lspconfig ];
   };
 
+  rzls-nvim = super.rzls-nvim.overrideAttrs {
+    dependencies = [ self.roslyn-nvim ];
+  };
+
   samodostal-image-nvim = super.samodostal-image-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 78a30fca8af2..c21f5536c49b 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -935,6 +935,7 @@ https://github.com/keith/rspec.vim/,,
 https://github.com/ccarpita/rtorrent-syntax-file/,,
 https://github.com/simrat39/rust-tools.nvim/,,
 https://github.com/rust-lang/rust.vim/,,
+https://github.com/tris203/rzls.nvim/,HEAD,
 https://github.com/hauleth/sad.vim/,,
 https://github.com/vmware-archive/salt-vim/,,
 https://github.com/samodostal/image.nvim/,HEAD,samodostal-image-nvim
diff --git a/pkgs/by-name/at/atuin/package.nix b/pkgs/by-name/at/atuin/package.nix
index 266ae4b0d5b0..ba46f7d97944 100644
--- a/pkgs/by-name/at/atuin/package.nix
+++ b/pkgs/by-name/at/atuin/package.nix
@@ -5,6 +5,8 @@
   installShellFiles,
   rustPlatform,
   nixosTests,
+  jq,
+  moreutils,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,12 +20,34 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-P/q4XYhpXo9kwiltA0F+rQNSlqI+s8TSi5v5lFJWJ/4=";
   };
 
-  # TODO: unify this to one hash because updater do not support this
-  cargoHash =
-    if stdenv.hostPlatform.isLinux then
-      "sha256-JDm7HWMaLSodpOhrR7rm6ZS/ATX/q8fRK+OJ/EKqg3U="
-    else
-      "sha256-mrsqaqJHMyNi3yFDIyAXFBS+LY71VWXE8O7mjvgI6lo=";
+  # the interim crate contains both README.md and readme.md,
+  # which causes a hash mismatch on systems with a case-insensitive filesystem.
+  # This removes the readme files and updates cargo's checksum file accordingly
+  depsExtraArgs = {
+    nativeBuildInputs = [
+      jq
+      moreutils
+    ];
+
+    postBuild = ''
+      pushd $name/interim
+
+      if [ -e readme.md ]; then
+        rm --force --verbose README.md readme.md
+        jq 'del(.files."README.md") | del(.files."readme.md")' \
+          .cargo-checksum.json -c \
+          | sponge .cargo-checksum.json
+
+        popd
+      else
+        echo "ERROR: the interim crate has been updated"
+        echo "When you see this message, please remove the workaround for the interim crate from the atuin nix expression"
+        exit 1
+      fi
+    '';
+  };
+
+  cargoHash = "sha256-l8DsQwEJZL9kr9UIpZzebDSRYET2WM8VFwk+O1Qk9oQ=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.
diff --git a/pkgs/by-name/ca/cargo-valgrind/package.nix b/pkgs/by-name/ca/cargo-valgrind/package.nix
index b14b2cce68da..3ac7053fd4c6 100644
--- a/pkgs/by-name/ca/cargo-valgrind/package.nix
+++ b/pkgs/by-name/ca/cargo-valgrind/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-valgrind";
-  version = "2.1.1";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "jfrimmel";
     repo = "cargo-valgrind";
-    rev = "v${version}";
-    sha256 = "sha256-l/1paghG/ARD0JfzNh0xj2UD5kW6FddM8Xrd/FCygYc=";
+    tag = version;
+    sha256 = "sha256-yUCDKklkfK+2n+THH4QlHb+FpeWfObXpmp4VozsFiUM=";
   };
 
-  cargoHash = "sha256-9/kIIZDIsOhUvRT3TyXN5PGFUB+a8m2yXmzBbsPUK28=";
+  cargoHash = "sha256-6vcTsernIVkemGhMBT9LMTsBsJ4u1Sd12BgIp4Zn3vg=";
 
   passthru = {
     updateScript = nix-update-script { };
@@ -33,6 +33,7 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [
     "--skip examples_are_runnable"
     "--skip tests_are_runnable"
+    "--skip issue74"
   ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/ch/charmcraft/package.nix b/pkgs/by-name/ch/charmcraft/package.nix
index 83efaa904005..526da18da7bf 100644
--- a/pkgs/by-name/ch/charmcraft/package.nix
+++ b/pkgs/by-name/ch/charmcraft/package.nix
@@ -77,6 +77,8 @@ python3Packages.buildPythonApplication rec {
   disabledTests = [
     # Relies upon the `charm` tool being installed
     "test_validate_missing_charm"
+    "test_read_charm_from_yaml_file_self_contained_success[full-bases.yaml]"
+    "test_read_charm_from_yaml_file_self_contained_success[full-platforms.yaml]"
   ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/hh/hhexen/package.nix b/pkgs/by-name/hh/hhexen/package.nix
index dbb4278fa9bd..4d3601cf43f5 100644
--- a/pkgs/by-name/hh/hhexen/package.nix
+++ b/pkgs/by-name/hh/hhexen/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hhexen";
-  version = "1.6.3";
+  version = "1.6.4";
 
   src = fetchFromGitHub {
     owner = "sezero";
     repo = "hhexen";
     rev = "hhexen-${finalAttrs.version}";
-    hash = "sha256-y3jKfU4e8R2pJQN/FN7W6KQ7D/P+7pmQkdmZug15ApI=";
+    hash = "sha256-D1gIdIqb6RN7TA7ezbBhy2Z82TH1quN8kgAMNRHMfhw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ic/icloudpd/package.nix b/pkgs/by-name/ic/icloudpd/package.nix
index 2725853f39bd..f1eca052c99a 100644
--- a/pkgs/by-name/ic/icloudpd/package.nix
+++ b/pkgs/by-name/ic/icloudpd/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "icloudpd";
-  version = "1.25.0";
+  version = "1.25.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "icloud-photos-downloader";
     repo = "icloud_photos_downloader";
     rev = "v${version}";
-    hash = "sha256-7I/mthqlV5+EWaLRlCmBZPJaf7dWm8alpUtmlxvUNsY=";
+    hash = "sha256-Wjei2hJpeVYVgShbbzikZk4yr71HoeP/caqU1ktDQbI=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/ro/rockcraft/package.nix b/pkgs/by-name/ro/rockcraft/package.nix
index 38bf29563dd2..15857bf97414 100644
--- a/pkgs/by-name/ro/rockcraft/package.nix
+++ b/pkgs/by-name/ro/rockcraft/package.nix
@@ -48,6 +48,7 @@ python3Packages.buildPythonApplication rec {
   '';
 
   disabledTests = [
+    "test_project_all_platforms_invalid"
     "test_run_init_flask"
     "test_run_init_django"
   ];
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
index 77c4aaf02432..c7927f854cdf 100644
--- a/pkgs/by-name/sn/snapcraft/package.nix
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -170,6 +170,7 @@ python3Packages.buildPythonApplication rec {
     "test_lifecycle_write_component_metadata"
     "test_parse_info_integrated"
     "test_patch_elf"
+    "test_project_platform_unknown_name"
     "test_remote_builder_init"
     "test_setup_assets_remote_icon"
     "test_snap_command_fallback"
diff --git a/pkgs/by-name/st/storcli2/package.nix b/pkgs/by-name/st/storcli2/package.nix
new file mode 100644
index 000000000000..c9d121743a28
--- /dev/null
+++ b/pkgs/by-name/st/storcli2/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  rpmextract,
+  testers,
+}:
+stdenvNoCC.mkDerivation (
+  finalAttrs:
+  let
+    majVer = "8";
+    minVer = "11";
+    relPhs = "14";
+    verCode = "00" + majVer + ".00" + minVer + ".0000.00" + relPhs;
+  in
+  {
+    pname = "storcli";
+    version = majVer + "." + minVer;
+
+    src = fetchzip {
+      url = "https://docs.broadcom.com/docs-and-downloads/host-bus-adapters/host-bus-adapters-common-files/sas_sata_nvme_24g_p${finalAttrs.version}/StorCLI_Avenger_${finalAttrs.version}-${verCode}.zip";
+      hash = "sha256-vztV+Jp+p6nU4q7q8QQIkuL30QsoGj2tyIZp87luhH8=";
+    };
+
+    nativeBuildInputs = [ rpmextract ];
+
+    unpackPhase =
+      let
+        inherit (stdenvNoCC.hostPlatform) system;
+        platforms = {
+          x86_64-linux = "Linux";
+          aarch64-linux = "ARM/Linux";
+        };
+        platform = platforms.${system} or (throw "unsupported system: ${system}");
+      in
+      ''
+        rpmextract $src/Avenger_StorCLI/${platform}/storcli2-${verCode}-1.*.rpm
+      '';
+
+    dontPatch = true;
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = ''
+      install -D ./opt/MegaRAID/storcli2/storcli2 $out/bin/storcli2
+    '';
+
+    # Not needed because the binary is statically linked
+    dontFixup = false;
+
+    passthru.tests = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "${finalAttrs.meta.mainProgram} v";
+      version = verCode;
+    };
+
+    meta = with lib; {
+      # Unfortunately there is no better page for this.
+      # Filter for downloads, set 100 items per page. Sort by newest does not work.
+      # Then search manually for the latest version.
+      homepage = "https://www.broadcom.com/support/download-search?pg=&pf=Host+Bus+Adapters&pn=&pa=&po=&dk=storcli2&pl=&l=false";
+      description = "Storage Command Line Tool";
+      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+      license = licenses.unfree;
+      maintainers = with maintainers; [ edwtjo ];
+      mainProgram = "storcli2";
+      platforms = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
+    };
+  }
+)
diff --git a/pkgs/desktops/lomiri/services/lomiri-content-hub/default.nix b/pkgs/desktops/lomiri/services/lomiri-content-hub/default.nix
index a2bb44340024..753dc120f3cf 100644
--- a/pkgs/desktops/lomiri/services/lomiri-content-hub/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-content-hub/default.nix
@@ -130,7 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelChecking = false;
 
   preFixup = ''
-    for exampleExe in content-hub-test-{importer,exporter,sharer}; do
+    for exampleExe in lomiri-content-hub-test-{importer,exporter,sharer}; do
       moveToOutput bin/$exampleExe $examples
       moveToOutput share/applications/$exampleExe.desktop $examples
     done
diff --git a/pkgs/development/compilers/gleam/default.nix b/pkgs/development/compilers/gleam/default.nix
index a02a0c8c587e..c8c3d998f7ed 100644
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -14,13 +14,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "1.6.3";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-bGXSlbyV+0RjNtG/6u11xqjcvL7/FhhqdXanv2JlVII=";
+    hash = "sha256-Nr8OpinQ1Dmo6e8XpBYrtaRRhcX2s1TW/5nM1LxApGg=";
   };
 
   nativeBuildInputs = [
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage rec {
       SystemConfiguration
     ];
 
-  cargoHash = "sha256-c5q/UFkxDtGJxQORAH7iLlzH3rJI6cCD6H2uSC5bItw=";
+  cargoHash = "sha256-E1iowktT7oK259WY6AopfvinQuRT1yMnORbJn9Ly+3E=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/development/php-packages/castor/default.nix b/pkgs/development/php-packages/castor/default.nix
index f754a0ccfb4d..6ac00cf8cb2b 100644
--- a/pkgs/development/php-packages/castor/default.nix
+++ b/pkgs/development/php-packages/castor/default.nix
@@ -9,16 +9,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "castor";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "jolicode";
     repo = "castor";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GTsPcivETNP3x8kEI18CsUtV2ouAMkpC/uO+ltSkpnQ=";
+    hash = "sha256-PJtl1/Eete7zK81grQHdWtr9PBbLL0lC3nwz0vxtFx0=";
   };
 
-  vendorHash = "sha256-gJgItrEPHgSF2ReNLT4HAK9Dlx9uB6f0rXQ2A7WsNNE=";
+  vendorHash = "sha256-TjvbuvOwML9v1fMOA+ld9PM2wyysgL4Ws9Swf+N2nwk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index f47ba4528981..d24dfbee49a2 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -6,16 +6,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpstan";
-  version = "2.0.4";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan-src";
     tag = finalAttrs.version;
-    hash = "sha256-hKNwAZCK7dS/iBTrigEHSBXnCJQ2btSUDMUrfetiL0s=";
+    hash = "sha256-pc65TtMFsei338t73kjKO8agPhyvYfJrtKleQG7ZLlY=";
   };
 
-  vendorHash = "sha256-m5Ih/3a3p5BgifpK+vu2Z04glIc0vhz1/ikA4Hl0L7U=";
+  vendorHash = "sha256-93HlbsEn5BX/9Ch0hCexLJS/zqJHyG0ngyiz/wnAqog=";
   composerStrictValidation = false;
 
   meta = {
diff --git a/pkgs/development/php-packages/spx/default.nix b/pkgs/development/php-packages/spx/default.nix
index d861eab67a0b..7b9e73b538de 100644
--- a/pkgs/development/php-packages/spx/default.nix
+++ b/pkgs/development/php-packages/spx/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.4.17";
+  version = "0.4.18";
 in
 buildPecl {
   inherit version;
@@ -16,7 +16,7 @@ buildPecl {
     owner = "NoiseByNorthwest";
     repo = "php-spx";
     rev = "v${version}";
-    hash = "sha256-MH/0G9KKmwcVsJKpe6uE1xjvykBEWuYU0DIOGfXiLAw=";
+    hash = "sha256-Dcv8ncYPIug7e24mvL1gn0x0CeLNAck8djm/r/yiPe8=";
   };
 
   configureFlags = [ "--with-zlib-dir=${zlib.dev}" ];
diff --git a/pkgs/development/php-packages/xdebug/default.nix b/pkgs/development/php-packages/xdebug/default.nix
index 1fa38229d7a1..6b0b939a7d04 100644
--- a/pkgs/development/php-packages/xdebug/default.nix
+++ b/pkgs/development/php-packages/xdebug/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "3.4.0";
+  version = "3.4.1";
 in
 buildPecl {
   inherit version;
@@ -16,7 +16,7 @@ buildPecl {
     owner = "xdebug";
     repo = "xdebug";
     rev = version;
-    hash = "sha256-Gt6/ARrUzmsAhsdkKPNiX0CBmWTv7D3mHnxvvWjbLnE=";
+    hash = "sha256-yOqVS58bsFXGhdkQ20LK0E80bV7O2r/BE76CfBoeEqA=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/aiohomeconnect/default.nix b/pkgs/development/python-modules/aiohomeconnect/default.nix
index 09c40c51ed93..289d0ee84d4c 100644
--- a/pkgs/development/python-modules/aiohomeconnect/default.nix
+++ b/pkgs/development/python-modules/aiohomeconnect/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomeconnect";
-  version = "0.7.2";
+  version = "0.7.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiohomeconnect";
     tag = "v${version}";
-    hash = "sha256-E+2IQy3O+ccvZfjlORo+eTd+l41FSXk1dIE2Adrn3Ok=";
+    hash = "sha256-1+2ezwmlzLYbrODGNoOzd9Gbjl/5BzarmXr8eiaKZ9c=";
   };
 
   pythonRelaxDeps = [ "httpx" ];
diff --git a/pkgs/development/python-modules/aiolifx-themes/default.nix b/pkgs/development/python-modules/aiolifx-themes/default.nix
index d448d3482463..a4584ba311c8 100644
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiolifx-themes";
-  version = "0.5.8";
+  version = "0.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Djelibeybi";
     repo = "aiolifx-themes";
     tag = "v${version}";
-    hash = "sha256-MeGhtjdvtL0armoLrlqPsV4SUCTWbkBvRTj6ReuKQpQ=";
+    hash = "sha256-Y6LVSk0Ut5G0aGzV+hAfGmdM8h8a+4NYycQqBKoElXU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/aionut/default.nix b/pkgs/development/python-modules/aionut/default.nix
index 42eccd0b8181..d20e73abf85d 100644
--- a/pkgs/development/python-modules/aionut/default.nix
+++ b/pkgs/development/python-modules/aionut/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   poetry-core,
   pytest-asyncio,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
 }:
@@ -22,15 +23,11 @@ buildPythonPackage rec {
     hash = "sha256-DCWfa5YfrB7MTf78AeSHDgiZzLNXoiNLnty9a+Sr9tQ=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail " --cov=aionut --cov-report=term-missing:skip-covered" ""
-  '';
-
   build-system = [ poetry-core ];
 
   nativeCheckInputs = [
     pytest-asyncio
+    pytest-cov-stub
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/bizkaibus/default.nix b/pkgs/development/python-modules/bizkaibus/default.nix
index ba078194af8f..c79a3c35b966 100644
--- a/pkgs/development/python-modules/bizkaibus/default.nix
+++ b/pkgs/development/python-modules/bizkaibus/default.nix
@@ -1,25 +1,29 @@
 {
   lib,
-  requests,
+  aiohttp,
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "bizkaibus";
-  version = "0.1.4";
-  format = "setuptools";
-  disabled = pythonOlder "3.6";
+  version = "0.2.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "UgaitzEtxebarria";
     repo = "BizkaibusRTPI";
     rev = version;
-    sha256 = "1v7k9fclndb4x9npzhzj68kbrc3lb3wr6cwal2x46ib207593ckr";
+    hash = "sha256-TM02pSSOELRGSwsKc5C+34W94K6mnS0C69aijsPqSWs=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
 
   # Project has no tests
   doCheck = false;
@@ -29,7 +33,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to get information about Bizkaibus buses";
     homepage = "https://github.com/UgaitzEtxebarria/BizkaibusRTPI";
-    license = with licenses; [ mit ];
+    changelog = "https://github.com/UgaitzEtxebarria/BizkaibusRTPI/releases/tag/${version}";
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 1954fe6dd0d5..b0e691404108 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.35.92";
+  version = "1.35.93";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-8q9GOInTf7qyPHzQj7GwNfEjrWfks+/Eb3cU+avuXlc=";
+    hash = "sha256-mCAsipukijtuQ0qc+d5JktfMk+5QXx/EgcV82cgBYj0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 0183050890ec..fdb12bd74e9c 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.35.92";
+  version = "1.35.93";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-wCrnBYjiDRWoEAs0waHr+l8I6Fb2BXDbDRaxKNxMXCQ=";
+    hash = "sha256-aHLv6iTWsd0fAbdmL/HgvX+bcRDabWRHt4wbhdlDFR8=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/craft-application/default.nix b/pkgs/development/python-modules/craft-application/default.nix
index 14ddeebae157..e74061ddd7bc 100644
--- a/pkgs/development/python-modules/craft-application/default.nix
+++ b/pkgs/development/python-modules/craft-application/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "craft-application";
-  version = "4.6.0";
+  version = "4.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-application";
     tag = version;
-    hash = "sha256-kDujv7iVUvPfP9g3Ofm0Vso+I6qKBOq9NlFpigd6+Tc=";
+    hash = "sha256-ywGXzcnWYynmDXjDbSpzn8SroQ7z5fajhlE3JqI3PNk=";
   };
 
   postPatch = ''
@@ -103,6 +103,10 @@ buildPythonPackage rec {
       "test_to_yaml_file"
       # Tests expecting pytest-time
       "test_monitor_builds_success"
+      # Temporary fix until new release to support Python 3.13
+      "test_grammar_aware_part_error"
+      "test_grammar_aware_part_error[part2]"
+      "test_grammar_aware_project_error[project0]"
     ]
     ++ lib.optionals stdenv.hostPlatform.isAarch64 [
       # These tests have hardcoded "amd64" strings which fail on aarch64
diff --git a/pkgs/development/python-modules/craft-grammar/default.nix b/pkgs/development/python-modules/craft-grammar/default.nix
index a9a73aaf0995..035c4c249b4b 100644
--- a/pkgs/development/python-modules/craft-grammar/default.nix
+++ b/pkgs/development/python-modules/craft-grammar/default.nix
@@ -37,6 +37,11 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [ "tests/unit" ];
 
+  # Temp fix for test incompatibility with Python 3.13
+  disabledTests = [
+    "test_grammar_strlist_error[value2]"
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/development/python-modules/dctorch/default.nix b/pkgs/development/python-modules/dctorch/default.nix
index 90bfbceae4c2..05315bec521d 100644
--- a/pkgs/development/python-modules/dctorch/default.nix
+++ b/pkgs/development/python-modules/dctorch/default.nix
@@ -18,9 +18,11 @@ buildPythonPackage rec {
     hash = "sha256-TmfLAkiofrQNWYBhIlY4zafbZPgFftISCGloO/rlEG4=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  pythonRelaxDeps = [ "numpy" ];
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  dependencies = [
     numpy
     scipy
     torch
diff --git a/pkgs/development/python-modules/gotailwind/default.nix b/pkgs/development/python-modules/gotailwind/default.nix
index 72fd107555ca..b3a70580266a 100644
--- a/pkgs/development/python-modules/gotailwind/default.nix
+++ b/pkgs/development/python-modules/gotailwind/default.nix
@@ -10,6 +10,7 @@
   orjson,
   poetry-core,
   pytest-asyncio,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   syrupy,
@@ -35,8 +36,7 @@ buildPythonPackage rec {
   postPatch = ''
     # Upstream doesn't set a version for the pyproject.toml
     substituteInPlace pyproject.toml \
-      --replace-fail "0.0.0" "${version}" \
-      --replace-fail "--cov" ""
+      --replace-fail "0.0.0" "${version}"
   '';
 
   build-system = [ poetry-core ];
@@ -58,6 +58,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     aresponses
     pytest-asyncio
+    pytest-cov-stub
     pytestCheckHook
     syrupy
   ];
diff --git a/pkgs/development/python-modules/holidays/default.nix b/pkgs/development/python-modules/holidays/default.nix
index 110efb4f5f4a..6bca170e3825 100644
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.63";
+  version = "0.64";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "vacanza";
     repo = "python-holidays";
     tag = "v${version}";
-    hash = "sha256-XA6XvxWHttt+ic5027Q/3VGqrFYznYCiExSFBHU7qcY=";
+    hash = "sha256-rPQr7nyouBepTi4tW0+wrbROYyWo92KkZUI6ff5jl7I=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/jaxopt/default.nix b/pkgs/development/python-modules/jaxopt/default.nix
index 6d4c4a427444..211afb5ee57a 100644
--- a/pkgs/development/python-modules/jaxopt/default.nix
+++ b/pkgs/development/python-modules/jaxopt/default.nix
@@ -2,20 +2,24 @@
   lib,
   stdenv,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
   fetchpatch,
-  pytest-xdist,
-  pytestCheckHook,
+
+  # build-system
   setuptools,
+
+  # dependencies
   absl-py,
-  cvxpy,
   jax,
-  jaxlib,
   matplotlib,
   numpy,
-  optax,
   scipy,
+
+  # tests
+  cvxpy,
+  optax,
+  pytest-xdist,
+  pytestCheckHook,
   scikit-learn,
 }:
 
@@ -24,8 +28,6 @@ buildPythonPackage rec {
   version = "0.8.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "google";
     repo = "jaxopt";
@@ -48,17 +50,16 @@ buildPythonPackage rec {
   dependencies = [
     absl-py
     jax
-    jaxlib
     matplotlib
     numpy
     scipy
   ];
 
   nativeCheckInputs = [
-    pytest-xdist
-    pytestCheckHook
     cvxpy
     optax
+    pytest-xdist
+    pytestCheckHook
     scikit-learn
   ];
 
@@ -74,6 +75,10 @@ buildPythonPackage rec {
     [
       # https://github.com/google/jaxopt/issues/592
       "test_solve_sparse"
+
+      # AssertionError: Not equal to tolerance rtol=1e-06, atol=1e-06
+      # https://github.com/google/jaxopt/issues/618
+      "test_binary_logit_log_likelihood"
     ]
     ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
       # https://github.com/google/jaxopt/issues/577
@@ -81,6 +86,9 @@ buildPythonPackage rec {
       "test_solve_sparse"
       "test_logreg_with_intercept_manual_loop3"
 
+      # Flaky (AssertionError)
+      "test_inv_hessian_product_pytree3"
+
       # https://github.com/google/jaxopt/issues/593
       # Makes the test suite crash
       "test_dtype_consistency"
diff --git a/pkgs/development/python-modules/llama-index-agent-openai/default.nix b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
index 65dc94f89abe..8c891aea7fcc 100644
--- a/pkgs/development/python-modules/llama-index-agent-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-agent-openai";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_agent_openai";
     inherit version;
-    hash = "sha256-MdJnXb2ESJdW3QYqf/7TMLKr3KO3cV1RFnT1tQdeTdY=";
+    hash = "sha256-OokTeyKKbpwrP0bjZ6J7dfsxtFjiF3e7qBneZUcH1Z4=";
   };
 
   pythonRelaxDeps = [ "llama-index-llms-openai" ];
diff --git a/pkgs/development/python-modules/llama-index-core/default.nix b/pkgs/development/python-modules/llama-index-core/default.nix
index a88c33424bb7..69048506cbfd 100644
--- a/pkgs/development/python-modules/llama-index-core/default.nix
+++ b/pkgs/development/python-modules/llama-index-core/default.nix
@@ -36,7 +36,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-core";
-  version = "0.12.6";
+  version = "0.12.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     owner = "run-llama";
     repo = "llama_index";
     tag = "v${version}";
-    hash = "sha256-bd7M2Fd5BsNYmczp32Je7QtzCP0LBTg8zsDt5SYXBPU=";
+    hash = "sha256-SptIZ5LNsJOzMtrJ3hW1NPWX7+hmg74HKcfKdImCc+8=";
   };
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/python-modules/llama-index-graph-stores-neo4j/default.nix b/pkgs/development/python-modules/llama-index-graph-stores-neo4j/default.nix
index 17aa925e7323..003a592de9d9 100644
--- a/pkgs/development/python-modules/llama-index-graph-stores-neo4j/default.nix
+++ b/pkgs/development/python-modules/llama-index-graph-stores-neo4j/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-graph-stores-neo4j";
-  version = "0.4.2";
+  version = "0.4.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_graph_stores_neo4j";
     inherit version;
-    hash = "sha256-+mh1iIE5BFBs4kREG7SjstOMWmWAc1JSUMkHbg89ues=";
+    hash = "sha256-P//9FvSUD0ZQybRgBjZjQREEdwqw9wiNygE8M0I2FhY=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
index 029a2d5d9275..4cd284af9199 100644
--- a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-llms-ollama";
-  version = "0.4.1";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_ollama";
     inherit version;
-    hash = "sha256-MkLlJtsh3/TnuwQzAhN2BklrSQ8GOcJoDcwok9QWJw8=";
+    hash = "sha256-88DaBPhUB5Az7jwbER4JdFYAW5o4Z+1LtJuNKOSg8zY=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/llama-index-llms-openai/default.nix b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
index 6d70cb685245..a8b5aee00e69 100644
--- a/pkgs/development/python-modules/llama-index-llms-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-llms-openai";
-  version = "0.3.10";
+  version = "0.3.12";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_openai";
     inherit version;
-    hash = "sha256-/aM0WqS6QbJdkoF+6KVpmTHnnHyHkkPxctbg5svFxbM=";
+    hash = "sha256-GIAnOn5AnAXx28zbrFzjwhR3GQHNNpautVainf7YR3o=";
   };
 
   pythonRemoveDeps = [
diff --git a/pkgs/development/python-modules/llama-index-multi-modal-llms-openai/default.nix b/pkgs/development/python-modules/llama-index-multi-modal-llms-openai/default.nix
index 87411043c63a..535d2ef7a358 100644
--- a/pkgs/development/python-modules/llama-index-multi-modal-llms-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-multi-modal-llms-openai/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-multi-modal-llms-openai";
-  version = "0.4.0";
+  version = "0.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_multi_modal_llms_openai";
     inherit version;
-    hash = "sha256-EcOsfi16zp283ZpmLye8pf786YxWgquv+33QHVl3Zlg=";
+    hash = "sha256-NDegjOyFzrvCEqpz2lybiwVLTcYoM4VoQ1p9+ISJR28=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/llama-index-readers-file/default.nix b/pkgs/development/python-modules/llama-index-readers-file/default.nix
index ff4b2a5fe60f..1bc0992a0baa 100644
--- a/pkgs/development/python-modules/llama-index-readers-file/default.nix
+++ b/pkgs/development/python-modules/llama-index-readers-file/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-readers-file";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_readers_file";
     inherit version;
-    hash = "sha256-EVAwC866t83dnim3Jx4JeyePvjUY3ibkNVlYVbEsO5o=";
+    hash = "sha256-1nei7vBpXQC0h6xOoUyC5qTqreOgnFQPj4FibYUuNJE=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
index b6216d8bbb89..32e3900c97d1 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-postgres";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_vector_stores_postgres";
     inherit version;
-    hash = "sha256-yk1uHPH1Bipgy+WNx5KQ5Iuvp6b58uvcYkLP5Ma4STI=";
+    hash = "sha256-4bbjXMH4T/BRJ/l+vDOYqbv2nn0HE9953h4qFRXFlXQ=";
   };
 
   pythonRemoveDeps = [ "psycopg2-binary" ];
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
index 6f7b1003892b..534ee2b4226a 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-qdrant";
-  version = "0.4.0";
+  version = "0.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_vector_stores_qdrant";
     inherit version;
-    hash = "sha256-hv6cxCSKNtjUfZYNk2oxrJi10wAL4kxZeTx3v1ejlKc=";
+    hash = "sha256-Agy6T02j5sSZZgiI6eSgxLThwEk2oZNYyMygBo6HWug=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/llama-parse/default.nix b/pkgs/development/python-modules/llama-parse/default.nix
index abf1a82708c8..c4028223a15b 100644
--- a/pkgs/development/python-modules/llama-parse/default.nix
+++ b/pkgs/development/python-modules/llama-parse/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "llama-parse";
-  version = "0.5.17";
+  version = "0.5.19";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_parse";
     inherit version;
-    hash = "sha256-K6JwDKOxXoTvBy/ty7/q4vwTzntj/uIPzVJJ5vzb04E=";
+    hash = "sha256-22nacOGZomZHBeuYOnD6krfO4Z3Wz/F1r3aSoLik3VM=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 71f98591725a..bc5dd42043b7 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -678,8 +678,8 @@ rec {
       "sha256-LFhzVLxycvIbGPCIMvD18XAL8KkA1rnE+3LkFty4Q8s=";
 
   mypy-boto3-iotsecuretunneling =
-    buildMypyBoto3Package "iotsecuretunneling" "1.35.0"
-      "sha256-A1sYvlnpbfKZyxZvFCzBfD/Jbzd1PwlQwgj+fvcybGU=";
+    buildMypyBoto3Package "iotsecuretunneling" "1.35.93"
+      "sha256-HBXnSdkTqLdcwSQl42FfFZhQVDiErGfJShaGgt0I7bU=";
 
   mypy-boto3-iotsitewise =
     buildMypyBoto3Package "iotsitewise" "1.35.64"
diff --git a/pkgs/development/python-modules/py-synologydsm-api/default.nix b/pkgs/development/python-modules/py-synologydsm-api/default.nix
index e158bd909dad..741942f12a4b 100644
--- a/pkgs/development/python-modules/py-synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/py-synologydsm-api/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "2.5.3";
+  version = "2.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mib1185";
     repo = "py-synologydsm-api";
     tag = "v${version}";
-    hash = "sha256-3DpgJqL8pSiAK/t/Qe2CxntQStTqDumkivhnPKHVlnE=";
+    hash = "sha256-CjsSn9kbSOSiia47gDHUbMCgJs3pDJaJfQOwMPP+5WI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyemd/default.nix b/pkgs/development/python-modules/pyemd/default.nix
index 16d5cde88691..4cff9a018ffc 100644
--- a/pkgs/development/python-modules/pyemd/default.nix
+++ b/pkgs/development/python-modules/pyemd/default.nix
@@ -1,48 +1,56 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
-  fetchPypi,
   cython,
+  fetchPypi,
+  numpy,
   oldest-supported-numpy,
   packaging,
-  setuptools,
-  setuptools-scm,
-  wheel,
-  numpy,
   pytestCheckHook,
+  pythonOlder,
+  setuptools-scm,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pyemd";
   version = "1.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  format = "pyproject";
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-tCta57LRWx1N7mOBDqeYo5IX6Kdre0nA62OoTg/ZAP4=";
   };
 
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
   nativeBuildInputs = [
     cython
     numpy
     oldest-supported-numpy
     packaging
-    setuptools
-    setuptools-scm
-    wheel
   ];
 
-  propagatedBuildInputs = [ numpy ];
+  dependencies = [ numpy ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = [
+    # Broken with Numpy 2.x, https://github.com/wmayner/pyemd/issues/68
+    "test_emd_samples_2"
+    "test_emd_samples_3"
+  ];
+
   meta = with lib; {
     description = "Python wrapper for Ofir Pele and Michael Werman's implementation of the Earth Mover's Distance";
     homepage = "https://github.com/wmayner/pyemd";
+    changelog = "https://github.com/wmayner/pyemd/releases/tag/${version}";
     license = licenses.mit;
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index a9f0ad9ae17a..9f0e68834fc1 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -33,6 +33,11 @@ buildPythonPackage rec {
       url = "https://github.com/libgit2/pygit2/commit/eba710e45bb40e18641c6531394bb46631e7f295.patch";
       hash = "sha256-GFFzGVd/9+AcwicwOtBghhonijMp08svXTUZ/4/LmtI=";
     })
+    # temp fix for Python 3.13 until next release after 1.16.0
+    (fetchpatch {
+      url = "https://github.com/libgit2/pygit2/commit/7f143e1c5beec01ec3429aa4db12435ac02977d3.patch";
+      hash = "sha256-2SiFFPWVVo9urKRu64AejjTZMoXo2r+v1OwEIF+AzNo=";
+    })
   ];
 
   preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/development/python-modules/pylutron-caseta/default.nix b/pkgs/development/python-modules/pylutron-caseta/default.nix
index 3d2f1f2e8658..4a0a2105d172 100644
--- a/pkgs/development/python-modules/pylutron-caseta/default.nix
+++ b/pkgs/development/python-modules/pylutron-caseta/default.nix
@@ -6,6 +6,7 @@
   cryptography,
   fetchFromGitHub,
   hatchling,
+  orjson,
   pytest-asyncio,
   pytest-timeout,
   pytestCheckHook,
@@ -16,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pylutron-caseta";
-  version = "0.22.0";
+  version = "0.23.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,12 +26,15 @@ buildPythonPackage rec {
     owner = "gurumitts";
     repo = "pylutron-caseta";
     tag = "v${version}";
-    hash = "sha256-8NO1IAm16b5jxjVPSQqOSx5hJjAOAXyOknqwkgPT5Zo=";
+    hash = "sha256-p8c+WY+x5KcF7r6FXeF89JNtAwogRZELqXWgDc2iJek=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [ cryptography ] ++ lib.optionals (pythonOlder "3.11") [ async-timeout ];
+  dependencies = [
+    cryptography
+    orjson
+  ] ++ lib.optionals (pythonOlder "3.11") [ async-timeout ];
 
   optional-dependencies = {
     cli = [
@@ -51,10 +55,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pylutron_caseta" ];
 
   meta = with lib; {
-    description = "Python module o control Lutron Caseta devices";
+    description = "Python module to control Lutron Caseta devices";
     homepage = "https://github.com/gurumitts/pylutron-caseta";
     changelog = "https://github.com/gurumitts/pylutron-caseta/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ asl20 ];
+    license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/pymodbus/default.nix b/pkgs/development/python-modules/pymodbus/default.nix
index c0bd05357cc2..c9e974b574ca 100644
--- a/pkgs/development/python-modules/pymodbus/default.nix
+++ b/pkgs/development/python-modules/pymodbus/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "pymodbus";
-  version = "3.8.1";
+  version = "3.8.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "pymodbus-dev";
     repo = "pymodbus";
     tag = "v${version}";
-    hash = "sha256-WuQddane7NPqGo6EHBPlFAZDmkcksDdWmHKdVSsSf+o=";
+    hash = "sha256-0jS18oCVX+WvGvaIlug3Wbf4oJUmspGYlcmJQR0MXhI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pysuezv2/default.nix b/pkgs/development/python-modules/pysuezv2/default.nix
index 20e8ca6901e2..4f50b7519533 100644
--- a/pkgs/development/python-modules/pysuezv2/default.nix
+++ b/pkgs/development/python-modules/pysuezv2/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pysuezv2";
-  version = "1.3.5";
+  version = "2.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "jb101010-2";
     repo = "pySuez";
     tag = version;
-    hash = "sha256-BG5nX2S+WV0Bdwm/cvm+mGO1RUd+F312tZ4jws6A/d8=";
+    hash = "sha256-p9kTWaSMRgKZFonHTgT7nj4NdeTFCeEHawIFew/rii4=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/python-kasa/default.nix b/pkgs/development/python-modules/python-kasa/default.nix
index 1f85ca405559..0e66efe2c02a 100644
--- a/pkgs/development/python-modules/python-kasa/default.nix
+++ b/pkgs/development/python-modules/python-kasa/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "python-kasa";
-  version = "0.9.0";
+  version = "0.9.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "python-kasa";
     repo = "python-kasa";
     tag = version;
-    hash = "sha256-xbyDiTnEeC/d2dpAxj/5tB27hFC3bKEO5JsUC1jmh18=";
+    hash = "sha256-9y0M2CYG7tFdT9nAcQLhgvTKeaxoFHAVihM2Rj+0N34=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/renault-api/default.nix b/pkgs/development/python-modules/renault-api/default.nix
index f2efb92394c2..d07acb4b3df7 100644
--- a/pkgs/development/python-modules/renault-api/default.nix
+++ b/pkgs/development/python-modules/renault-api/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "renault-api";
-  version = "0.2.8";
+  version = "0.2.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "hacf-fr";
     repo = "renault-api";
     tag = "v${version}";
-    hash = "sha256-j9KF2vqDZqQ35mDW/Qx6uy8H9hwuwBYfdcDXD1Cs7rQ=";
+    hash = "sha256-Y+KFC/g0zJ1Ng3LnMsStN2jOsnjKLzYLyvM+fDmzdGQ=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/solax/default.nix b/pkgs/development/python-modules/solax/default.nix
index b72088233b40..e30f9cfc9d3f 100644
--- a/pkgs/development/python-modules/solax/default.nix
+++ b/pkgs/development/python-modules/solax/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "solax";
-  version = "3.2.1";
+  version = "3.2.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eeALI7GvhRl8OQaSqv1I26rMaBTxF24w4QQzUcnV2ys=";
+    hash = "sha256-ht+UP/is9+galMiVz/pkwtre1BXfCTT39SpSz4Vctvs=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index 9f6dd8f79a59..990d8996d1b6 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -7,11 +7,14 @@
   cymem,
   cython_0,
   fetchPypi,
+  git,
   hypothesis,
   jinja2,
   langcodes,
   mock,
   murmurhash,
+  nix-update,
+  nix,
   numpy,
   packaging,
   preshed,
@@ -22,6 +25,8 @@
   setuptools,
   spacy-legacy,
   spacy-loggers,
+  spacy-lookups-data,
+  spacy-transformers,
   srsly,
   thinc,
   tqdm,
@@ -29,34 +34,34 @@
   wasabi,
   weasel,
   writeScript,
-  nix,
-  git,
-  nix-update,
 }:
 
 buildPythonPackage rec {
   pname = "spacy";
-  version = "3.8.2";
+  version = "3.8.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Szfr0lraQFmw3J4Ik+cN3l34NIUymgaO8EWA5wiSpl0=";
+    hash = "sha256-galn3D1qWgqaslBVlIP+IJIwZYKpGS+Yvnpjvc4nl/c=";
   };
 
+  postPatch = ''
+    sed -i "/numpy/d" pyproject.toml
+  '';
+
   build-system = [
     cymem
     cython_0
     murmurhash
     numpy
+    preshed
     thinc
   ];
 
-  pythonRelaxDeps = [
-    "thinc"
-  ];
+  pythonRelaxDeps = [ "thinc" ];
 
   dependencies = [
     catalogue
@@ -86,6 +91,11 @@ buildPythonPackage rec {
     mock
   ];
 
+  optional-dependencies = {
+    transformers = [ spacy-transformers ];
+    lookups = [ spacy-lookups-data ];
+  };
+
   # Fixes ModuleNotFoundError when running tests on Cythonized code. See #255262
   preCheck = ''
     cd $out
@@ -124,10 +134,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Industrial-strength Natural Language Processing (NLP)";
-    mainProgram = "spacy";
     homepage = "https://github.com/explosion/spaCy";
     changelog = "https://github.com/explosion/spaCy/releases/tag/release-v${version}";
     license = licenses.mit;
     maintainers = [ ];
+    mainProgram = "spacy";
   };
 }
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index f783d15e9623..88c1736b2796 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1296";
+  version = "3.0.1297";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-iTcI/pNCcQamVuDYIjv60KR4CBwBRVwZJ+VAJqR1keM=";
+    hash = "sha256-8EVqWhS814OwmG8nebKgGsAmn4aoKMCYBBU26tOyuj4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/textnets/default.nix b/pkgs/development/python-modules/textnets/default.nix
index 09b47a1b1207..00b1ea7b6244 100644
--- a/pkgs/development/python-modules/textnets/default.nix
+++ b/pkgs/development/python-modules/textnets/default.nix
@@ -3,18 +3,19 @@
   buildPythonPackage,
   cairocffi,
   cython,
-  fetchPypi,
+  en_core_web_sm,
+  fetchFromGitHub,
   igraph,
   leidenalg,
   pandas,
   poetry-core,
+  pyarrow,
   pytestCheckHook,
   pythonOlder,
   scipy,
   setuptools,
-  spacy,
   spacy-lookups-data,
-  en_core_web_sm,
+  spacy,
   toolz,
   tqdm,
   wasabi,
@@ -22,17 +23,19 @@
 
 buildPythonPackage rec {
   pname = "textnets";
-  version = "0.9.4";
-  format = "pyproject";
+  version = "0.9.5";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-4154ytzo1QpwhKA1BkVMss9fNIkysnClW/yfSVlX33M=";
+  src = fetchFromGitHub {
+    owner = "jboynyc";
+    repo = "textnets";
+    tag = "v${version}";
+    hash = "sha256-MdKPxIshSx6U2EFGDTUS4EhoByyuVf0HKqvm9cS2KNY=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     cython
     poetry-core
     setuptools
@@ -41,13 +44,16 @@ buildPythonPackage rec {
   pythonRelaxDeps = [
     "igraph"
     "leidenalg"
+    "pyarrow"
+    "toolz"
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     cairocffi
     igraph
     leidenalg
     pandas
+    pyarrow
     scipy
     spacy
     spacy-lookups-data
diff --git a/pkgs/servers/homepage-dashboard/default.nix b/pkgs/servers/homepage-dashboard/default.nix
index c316faf358f0..9efcf8e247da 100644
--- a/pkgs/servers/homepage-dashboard/default.nix
+++ b/pkgs/servers/homepage-dashboard/default.nix
@@ -10,14 +10,13 @@
   nixosTests,
   enableLocalIcons ? false,
   nix-update-script,
-  git,
 }:
 let
   dashboardIcons = fetchFromGitHub {
-    owner = "walkxcode";
+    owner = "homarr-labs";
     repo = "dashboard-icons";
-    rev = "be82e22c418f5980ee2a13064d50f1483df39c8c"; # Until 2024-07-21
-    hash = "sha256-z69DKzKhCVNnNHjRM3dX/DD+WJOL9wm1Im1nImhBc9Y=";
+    rev = "51a2ae7b101c520bcfb5b44e5ddc99e658bc1e21"; # Until 2025-01-06
+    hash = "sha256-rKXeMAhHV0Ax7mVFyn6hIZXm5RFkbGakjugU0DG0jLM=";
   };
 
   installLocalIcons = ''
@@ -29,13 +28,13 @@ let
 in
 buildNpmPackage rec {
   pname = "homepage-dashboard";
-  version = "0.10.8";
+  version = "0.10.9";
 
   src = fetchFromGitHub {
     owner = "gethomepage";
     repo = "homepage";
     rev = "v${version}";
-    hash = "sha256-eFRWkwPSXQFhyKORpOTe9ifCX25ZeyVG7iezRmMxPvA=";
+    hash = "sha256-q8+uoikHMQVuTrVSH8tPsoI5655ZStMc/7tmoAfoZIY=";
   };
 
   npmDepsHash = "sha256-N39gwct2U4UxlIL5ceDzzU7HpA6xh2WksrZNxGz04PU=";
diff --git a/pkgs/servers/sql/postgresql/ext/pg_partman.nix b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
index 80305213dc20..c3ffbbe2ce7d 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_partman.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
@@ -8,13 +8,13 @@
 
 buildPostgresqlExtension rec {
   pname = "pg_partman";
-  version = "5.2.2";
+  version = "5.2.4";
 
   src = fetchFromGitHub {
     owner = "pgpartman";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-+T+JOGVOyxJH+mb0IhCJbSh+5DDlhaXvagy8C4lQizo=";
+    sha256 = "sha256-i/o+JZEXnJRO17kfdTw87aca28+I8pvuFZsPMA/kf+w=";
   };
 
   meta = with lib; {
diff --git a/pkgs/test/cc-wrapper/hardening.nix b/pkgs/test/cc-wrapper/hardening.nix
index fb30d17841e3..8e2a77cf0ef1 100644
--- a/pkgs/test/cc-wrapper/hardening.nix
+++ b/pkgs/test/cc-wrapper/hardening.nix
@@ -3,6 +3,7 @@
 , runCommand
 , runCommandWith
 , runCommandCC
+, bintools
 , hello
 , debian-devscripts
 }:
@@ -130,6 +131,56 @@ let
   '';
 
   brokenIf = cond: drv: if cond then drv.overrideAttrs (old: { meta = old.meta or {} // { broken = true; }; }) else drv;
+  overridePlatforms = platforms: drv: drv.overrideAttrs (old: { meta = old.meta or {} // { inherit platforms; }; });
+
+  instructionPresenceTest = label: mnemonicPattern: testBin: expectFailure: runCommand "${label}-instr-test" {
+    nativeBuildInputs = [
+      bintools
+    ];
+    buildInputs = [
+      testBin
+    ];
+  } ''
+    touch $out
+    if $OBJDUMP -d \
+      --no-addresses \
+      --no-show-raw-insn \
+      "$(PATH=$HOST_PATH type -P test-bin)" \
+      | grep -E '${mnemonicPattern}' > /dev/null ; then
+      echo "Found ${label} instructions" >&2
+      ${lib.optionalString expectFailure "exit 1"}
+    else
+      echo "Did not find ${label} instructions" >&2
+      ${lib.optionalString (!expectFailure) "exit 1"}
+    fi
+  '';
+
+  pacRetTest = testBin: expectFailure: overridePlatforms [ "aarch64-linux" ] (
+    instructionPresenceTest "pacret" "\\bpaciasp\\b" testBin expectFailure
+  );
+
+  elfNoteTest = label: pattern: testBin: expectFailure: runCommand "${label}-elf-note-test" {
+    nativeBuildInputs = [
+      bintools
+    ];
+    buildInputs = [
+      testBin
+    ];
+  } ''
+    touch $out
+    if $READELF -n "$(PATH=$HOST_PATH type -P test-bin)" \
+      | grep -E '${pattern}' > /dev/null ; then
+      echo "Found ${label} note" >&2
+      ${lib.optionalString expectFailure "exit 1"}
+    else
+      echo "Did not find ${label} note" >&2
+      ${lib.optionalString (!expectFailure) "exit 1"}
+    fi
+  '';
+
+  shadowStackTest = testBin: expectFailure: brokenIf stdenv.hostPlatform.isMusl (overridePlatforms [ "x86_64-linux" ] (
+    elfNoteTest "shadowstack" "\\bSHSTK\\b" testBin expectFailure
+  ));
 
 in nameDrvAfterAttrName ({
   bindNowExplicitEnabled = brokenIf stdenv.hostPlatform.isStatic (checkTestBin (f2exampleWithStdEnv stdenv {
@@ -204,6 +255,14 @@ in nameDrvAfterAttrName ({
     ignoreStackClashProtection = false;
   });
 
+  pacRetExplicitEnabled = pacRetTest (helloWithStdEnv stdenv {
+    hardeningEnable = [ "pacret" ];
+  }) false;
+
+  shadowStackExplicitEnabled = shadowStackTest (f1exampleWithStdEnv stdenv {
+    hardeningEnable = [ "shadowstack" ];
+  }) false;
+
   bindNowExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv {
     hardeningDisable = [ "bindnow" ];
   }) {
@@ -271,6 +330,14 @@ in nameDrvAfterAttrName ({
     expectFailure = true;
   };
 
+  pacRetExplicitDisabled = pacRetTest (helloWithStdEnv stdenv {
+    hardeningDisable = [ "pacret" ];
+  }) true;
+
+  shadowStackExplicitDisabled = shadowStackTest (f1exampleWithStdEnv stdenv {
+    hardeningDisable = [ "shadowstack" ];
+  }) true;
+
   # most flags can't be "unsupported" by compiler alone and
   # binutils doesn't have an accessible hardeningUnsupportedFlags
   # mechanism, so can only test a couple of flags through altered
@@ -472,4 +539,12 @@ in {
     ignoreStackClashProtection = false;
     expectFailure = true;
   };
+
+  allExplicitDisabledPacRet = pacRetTest (helloWithStdEnv stdenv {
+    hardeningDisable = [ "all" ];
+  }) true;
+
+  allExplicitDisabledShadowStack = shadowStackTest (f1exampleWithStdEnv stdenv {
+    hardeningDisable = [ "all" ];
+  }) true;
 }))