diff --git a/doc/languages-frameworks/ocaml.section.md b/doc/languages-frameworks/ocaml.section.md
index 44f514e90a1b..46fddcb3b9de 100644
--- a/doc/languages-frameworks/ocaml.section.md
+++ b/doc/languages-frameworks/ocaml.section.md
@@ -120,14 +120,6 @@ buildDunePackage rec {
 }
 ```
 
-Note about `minimalOCamlVersion`.  A deprecated version of this argument was
-spelled `minimumOCamlVersion`; setting the old attribute wrongly modifies the
-derivation hash and is therefore inappropriate. As a technical dept, currently
-packaged libraries may still use the old spelling: maintainers are invited to
-fix this when updating packages. Massive renaming is strongly discouraged as it
-would be challenging to review, difficult to test, and will cause unnecessary
-rebuild.
-
 The build will automatically fail if two distinct versions of the same library
 are added to `buildInputs` (which usually happens transitively because of
 `propagatedBuildInputs`). Set `dontDetectOcamlConflicts` to true to disable this
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index cb1f7efd5828..8285bc64ac0c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8413,6 +8413,12 @@
     githubId = 7403236;
     name = "Markus J. Ankenbrand";
   };
+  iivusly = {
+    email = "iivusly@icloud.com";
+    github = "iivusly";
+    githubId = 52052910;
+    name = "iivusly";
+  };
   ikervagyok = {
     email = "ikervagyok@gmail.com";
     github = "ikervagyok";
@@ -10588,13 +10594,6 @@
     name = "Kat Inskip";
     keys = [ { fingerprint = "9CC6 44B5 69CD A59B C874  C4C9 E8DD E3ED 1C90 F3A0"; } ];
   };
-  kiwi = {
-    email = "envy1988@gmail.com";
-    github = "Kiwi";
-    githubId = 35715;
-    name = "Robert Djubek";
-    keys = [ { fingerprint = "8992 44FC D291 5CA2 0A97  802C 156C 88A5 B0A0 4B2A"; } ];
-  };
   kjeremy = {
     email = "kjeremy@gmail.com";
     name = "Jeremy Kolb";
@@ -17708,13 +17707,6 @@
     githubId = 226872;
     name = "Samuel Ainsworth";
   };
-  samueldr = {
-    email = "samuel@dionne-riel.com";
-    matrix = "@samueldr:matrix.org";
-    github = "samueldr";
-    githubId = 132835;
-    name = "Samuel Dionne-Riel";
-  };
   samuelefacenda = {
     name = "Samuele Facenda";
     email = "samuele.facenda@gmail.com";
@@ -20045,12 +20037,6 @@
     githubId = 1391883;
     name = "Tom Hall";
   };
-  thubrecht = {
-    email = "tom@hubrecht.ovh";
-    github = "Tom-Hubrecht";
-    githubId = 26650391;
-    name = "Tom Hubrecht";
-  };
   Thunderbottom = {
     email = "chinmaydpai@gmail.com";
     github = "Thunderbottom";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 26ed7fd6ef51..51b5f575487a 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -677,12 +677,6 @@ with lib.maintainers;
     shortName = "Mercury Employees";
   };
 
-  mobile = {
-    members = [ samueldr ];
-    scope = "Maintain Mobile NixOS.";
-    shortName = "Mobile";
-  };
-
   nix = {
     members = [
       eelco
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index ed895586f2b0..b1b18b35e9c2 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -62,7 +62,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 <!-- Please keep entries alphabetically sorted. -->
 
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
-The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server software.
+The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the ankisyncd software.
 
 - [ALVR](https://github.com/alvr-org/alvr), a VR desktop streamer. Available as [programs.alvr](#opt-programs.alvr.enable).
 
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 57d8c59e612b..dce64715eb52 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -25,6 +25,16 @@
 
 - `androidenv.androidPkgs_9_0` has been removed, and replaced with `androidenv.androidPkgs` for a more complete Android SDK including support for Android 9 and later.
 
+- `wstunnel` has had a major version upgrade that entailed rewriting the program in Rust.
+  The module was updated to accommodate for breaking changes.
+  Breaking changes to the module API were minimised as much as possible,
+  but some were nonetheless inevitable due to changes in the upstream CLI.
+  Certain options were moved from separate CLI arguments into the forward specifications,
+  and those options were also removed from the module's API,
+  please consult the wstunnel man page for more detail.
+  Also be aware that if you have set additional options in `services.wstunnel.{clients,servers}.<name>.extraArgs`,
+  that those might have been removed or modified upstream.
+
 - `nginx` package no longer includes `gd` and `geoip` dependencies. For enabling it, override `nginx` package with the optionals `withImageFilter` and `withGeoIP`.
 
 - `openssh` and `openssh_hpn` are now compiled without Kerberos 5 / GSSAPI support in an effort to reduce the attack surface of the components for the majority of users. Users needing this support can
diff --git a/nixos/modules/services/misc/snapper.nix b/nixos/modules/services/misc/snapper.nix
index 4e0b4c551e23..1b16ef7958ad 100644
--- a/nixos/modules/services/misc/snapper.nix
+++ b/nixos/modules/services/misc/snapper.nix
@@ -1,16 +1,32 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 
 let
   cfg = config.services.snapper;
 
-  mkValue = v:
-    if isList v then "\"${concatMapStringsSep " " (escape [ "\\" " " ]) v}\""
-    else if v == true then "yes"
-    else if v == false then "no"
-    else if isString v then "\"${v}\""
-    else builtins.toJSON v;
+  mkValue =
+    v:
+    if isList v then
+      "\"${
+        concatMapStringsSep " " (escape [
+          "\\"
+          " "
+        ]) v
+      }\""
+    else if v == true then
+      "yes"
+    else if v == false then
+      "no"
+    else if isString v then
+      "\"${v}\""
+    else
+      builtins.toJSON v;
 
   mkKeyValue = k: v: "${k}=${mkValue v}";
 
@@ -43,7 +59,7 @@ let
 
     ALLOW_GROUPS = mkOption {
       type = types.listOf safeStr;
-      default = [];
+      default = [ ];
       description = ''
         List of groups allowed to operate with the config.
 
@@ -53,7 +69,7 @@ let
 
     ALLOW_USERS = mkOption {
       type = types.listOf safeStr;
-      default = [];
+      default = [ ];
       example = [ "alice" ];
       description = ''
         List of users allowed to operate with the config. "root" is always
@@ -78,6 +94,54 @@ let
         Defines whether hourly snapshots should be created.
       '';
     };
+
+    TIMELINE_LIMIT_HOURLY = mkOption {
+      type = types.str;
+      default = "10";
+      description = ''
+        Limits for timeline cleanup.
+      '';
+    };
+
+    TIMELINE_LIMIT_DAILY = mkOption {
+      type = types.str;
+      default = "10";
+      description = ''
+        Limits for timeline cleanup.
+      '';
+    };
+
+    TIMELINE_LIMIT_WEEKLY = mkOption {
+      type = types.str;
+      default = "0";
+      description = ''
+        Limits for timeline cleanup.
+      '';
+    };
+
+    TIMELINE_LIMIT_MONTHLY = mkOption {
+      type = types.str;
+      default = "10";
+      description = ''
+        Limits for timeline cleanup.
+      '';
+    };
+
+    TIMELINE_LIMIT_QUARTERLY = mkOption {
+      type = types.str;
+      default = "0";
+      description = ''
+        Limits for timeline cleanup.
+      '';
+    };
+
+    TIMELINE_LIMIT_YEARLY = mkOption {
+      type = types.str;
+      default = "10";
+      description = ''
+        Limits for timeline cleanup.
+      '';
+    };
   };
 in
 
@@ -152,112 +216,129 @@ in
         is valid here, even if NixOS doesn't document it.
       '';
 
-      type = types.attrsOf (types.submodule {
-        freeformType = types.attrsOf (types.oneOf [ (types.listOf safeStr) types.bool safeStr types.number ]);
+      type = types.attrsOf (
+        types.submodule {
+          freeformType = types.attrsOf (
+            types.oneOf [
+              (types.listOf safeStr)
+              types.bool
+              safeStr
+              types.number
+            ]
+          );
 
-        options = configOptions;
-      });
+          options = configOptions;
+        }
+      );
     };
   };
 
-  config = mkIf (cfg.configs != {}) (let
-    documentation = [ "man:snapper(8)" "man:snapper-configs(5)" ];
-  in {
+  config = mkIf (cfg.configs != { }) (
+    let
+      documentation = [
+        "man:snapper(8)"
+        "man:snapper-configs(5)"
+      ];
+    in
+    {
+      environment = {
 
-    environment = {
+        systemPackages = [ pkgs.snapper ];
 
-      systemPackages = [ pkgs.snapper ];
+        # Note: snapper/config-templates/default is only needed for create-config
+        #       which is not the NixOS way to configure.
+        etc =
+          {
 
-      # Note: snapper/config-templates/default is only needed for create-config
-      #       which is not the NixOS way to configure.
-      etc = {
-
-        "sysconfig/snapper".text = ''
-          SNAPPER_CONFIGS="${lib.concatStringsSep " " (builtins.attrNames cfg.configs)}"
-        '';
-
-      }
-      // (mapAttrs' (name: subvolume: nameValuePair "snapper/configs/${name}" ({
-        text = lib.generators.toKeyValue { inherit mkKeyValue; } (filterAttrs (k: v: v != defaultOf k) subvolume);
-      })) cfg.configs)
-      // (lib.optionalAttrs (cfg.filters != null) {
-        "snapper/filters/default.txt".text = cfg.filters;
-      });
-
-    };
-
-    services.dbus.packages = [ pkgs.snapper ];
-
-    systemd.services.snapperd = {
-      description = "DBus interface for snapper";
-      inherit documentation;
-      serviceConfig = {
-        Type = "dbus";
-        BusName = "org.opensuse.Snapper";
-        ExecStart = "${pkgs.snapper}/bin/snapperd";
-        CapabilityBoundingSet = "CAP_DAC_OVERRIDE CAP_FOWNER CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_SYS_ADMIN CAP_SYS_MODULE CAP_IPC_LOCK CAP_SYS_NICE";
-        LockPersonality = true;
-        NoNewPrivileges = false;
-        PrivateNetwork = true;
-        ProtectHostname = true;
-        RestrictAddressFamilies = "AF_UNIX";
-        RestrictRealtime = true;
+            "sysconfig/snapper".text = ''
+              SNAPPER_CONFIGS="${lib.concatStringsSep " " (builtins.attrNames cfg.configs)}"
+            '';
+          }
+          // (mapAttrs' (
+            name: subvolume:
+            nameValuePair "snapper/configs/${name}" ({
+              text = lib.generators.toKeyValue { inherit mkKeyValue; } (
+                filterAttrs (k: v: v != defaultOf k) subvolume
+              );
+            })
+          ) cfg.configs)
+          // (lib.optionalAttrs (cfg.filters != null) { "snapper/filters/default.txt".text = cfg.filters; });
       };
-    };
 
-    systemd.services.snapper-timeline = {
-      description = "Timeline of Snapper Snapshots";
-      inherit documentation;
-      requires = [ "local-fs.target" ];
-      serviceConfig.ExecStart = "${pkgs.snapper}/lib/snapper/systemd-helper --timeline";
-    };
+      services.dbus.packages = [ pkgs.snapper ];
 
-    systemd.timers.snapper-timeline = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        Persistent = cfg.persistentTimer;
-        OnCalendar = cfg.snapshotInterval;
+      systemd.services.snapperd = {
+        description = "DBus interface for snapper";
+        inherit documentation;
+        serviceConfig = {
+          Type = "dbus";
+          BusName = "org.opensuse.Snapper";
+          ExecStart = "${pkgs.snapper}/bin/snapperd";
+          CapabilityBoundingSet = "CAP_DAC_OVERRIDE CAP_FOWNER CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_SYS_ADMIN CAP_SYS_MODULE CAP_IPC_LOCK CAP_SYS_NICE";
+          LockPersonality = true;
+          NoNewPrivileges = false;
+          PrivateNetwork = true;
+          ProtectHostname = true;
+          RestrictAddressFamilies = "AF_UNIX";
+          RestrictRealtime = true;
+        };
       };
-    };
 
-    systemd.services.snapper-cleanup = {
-      description = "Cleanup of Snapper Snapshots";
-      inherit documentation;
-      serviceConfig.ExecStart = "${pkgs.snapper}/lib/snapper/systemd-helper --cleanup";
-    };
+      systemd.services.snapper-timeline = {
+        description = "Timeline of Snapper Snapshots";
+        inherit documentation;
+        requires = [ "local-fs.target" ];
+        serviceConfig.ExecStart = "${pkgs.snapper}/lib/snapper/systemd-helper --timeline";
+      };
 
-    systemd.timers.snapper-cleanup = {
-      description = "Cleanup of Snapper Snapshots";
-      inherit documentation;
-      wantedBy = [ "timers.target" ];
-      requires = [ "local-fs.target" ];
-      timerConfig.OnBootSec = "10m";
-      timerConfig.OnUnitActiveSec = cfg.cleanupInterval;
-    };
+      systemd.timers.snapper-timeline = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          Persistent = cfg.persistentTimer;
+          OnCalendar = cfg.snapshotInterval;
+        };
+      };
 
-    systemd.services.snapper-boot = lib.mkIf cfg.snapshotRootOnBoot {
-      description = "Take snapper snapshot of root on boot";
-      inherit documentation;
-      serviceConfig.ExecStart = "${pkgs.snapper}/bin/snapper --config root create --cleanup-algorithm number --description boot";
-      serviceConfig.Type = "oneshot";
-      requires = [ "local-fs.target" ];
-      wantedBy = [ "multi-user.target" ];
-      unitConfig.ConditionPathExists = "/etc/snapper/configs/root";
-    };
+      systemd.services.snapper-cleanup = {
+        description = "Cleanup of Snapper Snapshots";
+        inherit documentation;
+        serviceConfig.ExecStart = "${pkgs.snapper}/lib/snapper/systemd-helper --cleanup";
+      };
 
-    assertions =
-      concatMap
-        (name:
-          let
-            sub = cfg.configs.${name};
-          in
-          [ { assertion = !(sub ? extraConfig);
-              message = ''
-                The option definition `services.snapper.configs.${name}.extraConfig' no longer has any effect; please remove it.
-                The contents of this option should be migrated to attributes on `services.snapper.configs.${name}'.
-              '';
-            }
-          ] ++
+      systemd.timers.snapper-cleanup = {
+        description = "Cleanup of Snapper Snapshots";
+        inherit documentation;
+        wantedBy = [ "timers.target" ];
+        requires = [ "local-fs.target" ];
+        timerConfig.OnBootSec = "10m";
+        timerConfig.OnUnitActiveSec = cfg.cleanupInterval;
+      };
+
+      systemd.services.snapper-boot = lib.mkIf cfg.snapshotRootOnBoot {
+        description = "Take snapper snapshot of root on boot";
+        inherit documentation;
+        serviceConfig.ExecStart = "${pkgs.snapper}/bin/snapper --config root create --cleanup-algorithm number --description boot";
+        serviceConfig.Type = "oneshot";
+        requires = [ "local-fs.target" ];
+        wantedBy = [ "multi-user.target" ];
+        unitConfig.ConditionPathExists = "/etc/snapper/configs/root";
+      };
+
+      assertions = concatMap (
+        name:
+        let
+          sub = cfg.configs.${name};
+        in
+        [
+          {
+            assertion = !(sub ? extraConfig);
+            message = ''
+              The option definition `services.snapper.configs.${name}.extraConfig' no longer has any effect; please remove it.
+              The contents of this option should be migrated to attributes on `services.snapper.configs.${name}'.
+            '';
+          }
+        ]
+        ++
           map
             (attr: {
               assertion = !(hasAttr attr sub);
@@ -265,8 +346,11 @@ in
                 The option definition `services.snapper.configs.${name}.${attr}' has been renamed to `services.snapper.configs.${name}.${toUpper attr}'.
               '';
             })
-            [ "fstype" "subvolume" ]
-        )
-        (attrNames cfg.configs);
-  });
+            [
+              "fstype"
+              "subvolume"
+            ]
+      ) (attrNames cfg.configs);
+    }
+  );
 }
diff --git a/nixos/modules/services/monitoring/grafana-reporter.nix b/nixos/modules/services/monitoring/grafana-reporter.nix
index 340ab7abd19b..528041cab37a 100644
--- a/nixos/modules/services/monitoring/grafana-reporter.nix
+++ b/nixos/modules/services/monitoring/grafana-reporter.nix
@@ -60,7 +60,7 @@ in {
           "-templates ${cfg.templateDir}"
         ];
       in {
-        ExecStart = "${pkgs.grafana_reporter}/bin/grafana-reporter ${args}";
+        ExecStart = "${pkgs.grafana-reporter}/bin/grafana-reporter ${args}";
       };
     };
   };
diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index 7add377896ca..e68c39946fe3 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -37,7 +37,6 @@ in
 {
   meta.maintainers = with maintainers; [
     misuzu
-    thubrecht
   ];
   meta.doc = ./netbird.md;
 
diff --git a/nixos/modules/services/networking/netbird/server.nix b/nixos/modules/services/networking/netbird/server.nix
index 2b6ad696646e..e3de286a04fa 100644
--- a/nixos/modules/services/networking/netbird/server.nix
+++ b/nixos/modules/services/networking/netbird/server.nix
@@ -16,7 +16,7 @@ in
 
 {
   meta = {
-    maintainers = with lib.maintainers; [thubrecht patrickdag];
+    maintainers = with lib.maintainers; [patrickdag];
     doc = ./server.md;
   };
 
diff --git a/nixos/modules/services/networking/wstunnel.nix b/nixos/modules/services/networking/wstunnel.nix
index 1b169567624c..bd7536351955 100644
--- a/nixos/modules/services/networking/wstunnel.nix
+++ b/nixos/modules/services/networking/wstunnel.nix
@@ -1,83 +1,94 @@
-{ config, lib, options, pkgs, utils, ... }:
-with lib;
+{ config
+, lib
+, pkgs
+, ...
+}:
+
 let
   cfg = config.services.wstunnel;
-  attrsToArgs = attrs: utils.escapeSystemdExecArgs (
-    mapAttrsToList
-    (name: value: if value == true then "--${name}" else "--${name}=${value}")
-    attrs
-  );
 
-  hostPortToString = { host, port }: "${host}:${builtins.toString port}";
+  hostPortToString = { host, port }: "${host}:${toString port}";
 
   hostPortSubmodule = {
     options = {
-      host = mkOption {
+      host = lib.mkOption {
         description = "The hostname.";
-        type = types.str;
+        type = lib.types.str;
       };
-      port = mkOption {
+      port = lib.mkOption {
         description = "The port.";
-        type = types.port;
+        type = lib.types.port;
       };
     };
   };
 
   commonOptions = {
-    enable = mkOption {
-      description = "Whether to enable this `wstunnel` instance.";
-      type = types.bool;
+    enable = lib.mkEnableOption "this `wstunnel` instance." // {
       default = true;
     };
 
-    package = mkPackageOption pkgs "wstunnel" {};
+    package = lib.mkPackageOption pkgs "wstunnel" { };
 
-    autoStart = mkOption {
-      description = "Whether this tunnel server should be started automatically.";
-      type = types.bool;
-      default = true;
-    };
+    autoStart =
+      lib.mkEnableOption "starting this wstunnel instance automatically." // {
+        default = true;
+      };
 
-    extraArgs = mkOption {
-      description = "Extra command line arguments to pass to `wstunnel`. Attributes of the form `argName = true;` will be translated to `--argName`, and `argName = \"value\"` to `--argName=value`.";
-      type = with types; attrsOf (either str bool);
-      default = {};
+    extraArgs = lib.mkOption {
+      description = ''
+        Extra command line arguments to pass to `wstunnel`.
+        Attributes of the form `argName = true;` will be translated to `--argName`,
+        and `argName = \"value\"` to `--argName value`.
+      '';
+      type = with lib.types; attrsOf (either str bool);
+      default = { };
       example = {
         "someNewOption" = true;
         "someNewOptionWithValue" = "someValue";
       };
     };
 
-    loggingLevel = mkOption {
+    loggingLevel = lib.mkOption {
       description = ''
         Passed to --log-lvl
 
         Control the log verbosity. i.e: TRACE, DEBUG, INFO, WARN, ERROR, OFF
         For more details, checkout [EnvFilter](https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html#example-syntax)
       '';
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
       example = "INFO";
       default = null;
     };
 
-    environmentFile = mkOption {
-      description = "Environment file to be passed to the systemd service. Useful for passing secrets to the service to prevent them from being world-readable in the Nix store. Note however that the secrets are passed to `wstunnel` through the command line, which makes them locally readable for all users of the system at runtime.";
-      type = types.nullOr types.path;
+    environmentFile = lib.mkOption {
+      description = ''
+        Environment file to be passed to the systemd service.
+        Useful for passing secrets to the service to prevent them from being
+        world-readable in the Nix store.
+        Note however that the secrets are passed to `wstunnel` through
+        the command line, which makes them locally readable for all users of
+        the system at runtime.
+      '';
+      type = lib.types.nullOr lib.types.path;
       default = null;
       example = "/var/lib/secrets/wstunnelSecrets";
     };
   };
 
-  serverSubmodule = { config, ...}: {
+  serverSubmodule = { config, ... }: {
     options = commonOptions // {
-      listen = mkOption {
-        description = "Address and port to listen on. Setting the port to a value below 1024 will also give the process the required `CAP_NET_BIND_SERVICE` capability.";
-        type = types.submodule hostPortSubmodule;
+      listen = lib.mkOption {
+        description = ''
+          Address and port to listen on.
+          Setting the port to a value below 1024 will also give the process
+          the required `CAP_NET_BIND_SERVICE` capability.
+        '';
+        type = lib.types.submodule hostPortSubmodule;
         default = {
           host = "0.0.0.0";
           port = if config.enableHTTPS then 443 else 80;
         };
-        defaultText = literalExpression ''
+        defaultText = lib.literalExpression ''
           {
             host = "0.0.0.0";
             port = if enableHTTPS then 443 else 80;
@@ -85,39 +96,50 @@ let
         '';
       };
 
-      restrictTo = mkOption {
-        description = "Accepted traffic will be forwarded only to this service. Set to `null` to allow forwarding to arbitrary addresses.";
-        type = types.listOf (types.submodule hostPortSubmodule);
-        default = [];
+      restrictTo = lib.mkOption {
+        description = ''
+          Accepted traffic will be forwarded only to this service.
+        '';
+        type = lib.types.listOf (lib.types.submodule hostPortSubmodule);
+        default = [ ];
         example = [{
           host = "127.0.0.1";
           port = 51820;
         }];
       };
 
-      enableHTTPS = mkOption {
+      enableHTTPS = lib.mkOption {
         description = "Use HTTPS for the tunnel server.";
-        type = types.bool;
+        type = lib.types.bool;
         default = true;
       };
 
-      tlsCertificate = mkOption {
-        description = "TLS certificate to use instead of the hardcoded one in case of HTTPS connections. Use together with `tlsKey`.";
-        type = types.nullOr types.path;
+      tlsCertificate = lib.mkOption {
+        description = ''
+          TLS certificate to use instead of the hardcoded one in case of HTTPS connections.
+          Use together with `tlsKey`.
+        '';
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/var/lib/secrets/cert.pem";
       };
 
-      tlsKey = mkOption {
-        description = "TLS key to use instead of the hardcoded on in case of HTTPS connections. Use together with `tlsCertificate`.";
-        type = types.nullOr types.path;
+      tlsKey = lib.mkOption {
+        description = ''
+          TLS key to use instead of the hardcoded on in case of HTTPS connections.
+          Use together with `tlsCertificate`.
+        '';
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/var/lib/secrets/key.pem";
       };
 
-      useACMEHost = mkOption {
-        description = "Use a certificate generated by the NixOS ACME module for the given host. Note that this will not generate a new certificate - you will need to do so with `security.acme.certs`.";
-        type = types.nullOr types.str;
+      useACMEHost = lib.mkOption {
+        description = ''
+          Use a certificate generated by the NixOS ACME module for the given host.
+          Note that this will not generate a new certificate - you will need to do so with `security.acme.certs`.
+        '';
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "example.com";
       };
@@ -126,95 +148,113 @@ let
 
   clientSubmodule = { config, ... }: {
     options = commonOptions // {
-      connectTo = mkOption {
+      connectTo = lib.mkOption {
         description = "Server address and port to connect to.";
-        type = types.str;
+        type = lib.types.str;
         example = "https://wstunnel.server.com:8443";
       };
 
-      localToRemote = mkOption {
+      localToRemote = lib.mkOption {
         description = ''Listen on local and forwards traffic from remote.'';
-        type = types.listOf (types.str);
-        default = [];
+        type = lib.types.listOf (lib.types.str);
+        default = [ ];
         example = [
           "tcp://1212:google.com:443"
           "unix:///tmp/wstunnel.sock:g.com:443"
         ];
       };
 
-      remoteToLocal = mkOption {
+      remoteToLocal = lib.mkOption {
         description = "Listen on remote and forwards traffic from local. Only tcp is supported";
-        type = types.listOf (types.str);
-        default = [];
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
         example = [
           "tcp://1212:google.com:443"
           "unix://wstunnel.sock:g.com:443"
         ];
       };
 
-      addNetBind = mkEnableOption "Whether add CAP_NET_BIND_SERVICE to the tunnel service, this should be enabled if you want to bind port < 1024";
+      addNetBind = lib.mkEnableOption "Whether add CAP_NET_BIND_SERVICE to the tunnel service, this should be enabled if you want to bind port < 1024";
 
-      httpProxy = mkOption {
+      httpProxy = lib.mkOption {
         description = ''
           Proxy to use to connect to the wstunnel server (`USER:PASS@HOST:PORT`).
 
           ::: {.warning}
-          Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the `environmentFile` option to a file containing `PROXY_PASSWORD=<your-password-here>` and set this option to `<user>:$PROXY_PASSWORD@<host>:<port>`. Note however that this will also locally leak the passwords at runtime via e.g. /proc/<pid>/cmdline.
-
+          Passwords specified here will be world-readable in the Nix store!
+          To pass a password to the service, point the `environmentFile` option
+          to a file containing `PROXY_PASSWORD=<your-password-here>` and set
+          this option to `<user>:$PROXY_PASSWORD@<host>:<port>`.
+          Note however that this will also locally leak the passwords at
+          runtime via e.g. /proc/<pid>/cmdline.
           :::
         '';
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         default = null;
       };
 
-      soMark = mkOption {
-        description = "Mark network packets with the SO_MARK sockoption with the specified value. Setting this option will also enable the required `CAP_NET_ADMIN` capability for the systemd service.";
-        type = types.nullOr types.int;
+      soMark = lib.mkOption {
+        description = ''
+          Mark network packets with the SO_MARK sockoption with the specified value.
+          Setting this option will also enable the required `CAP_NET_ADMIN` capability
+          for the systemd service.
+        '';
+        type = lib.types.nullOr lib.types.ints.unsigned;
         default = null;
       };
 
-      upgradePathPrefix = mkOption {
-        description = "Use a specific HTTP path prefix that will show up in the upgrade request to the `wstunnel` server. Useful when running `wstunnel` behind a reverse proxy.";
-        type = types.nullOr types.str;
+      upgradePathPrefix = lib.mkOption {
+        description = ''
+          Use a specific HTTP path prefix that will show up in the upgrade
+          request to the `wstunnel` server.
+          Useful when running `wstunnel` behind a reverse proxy.
+        '';
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "wstunnel";
       };
 
-      tlsSNI = mkOption {
+      tlsSNI = lib.mkOption {
         description = "Use this as the SNI while connecting via TLS. Useful for circumventing hostname-based firewalls.";
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         default = null;
       };
 
-      tlsVerifyCertificate = mkOption {
+      tlsVerifyCertificate = lib.mkOption {
         description = "Whether to verify the TLS certificate of the server. It might be useful to set this to `false` when working with the `tlsSNI` option.";
-        type = types.bool;
+        type = lib.types.bool;
         default = true;
       };
 
       # The original argument name `websocketPingFrequency` is a misnomer, as the frequency is the inverse of the interval.
-      websocketPingInterval = mkOption {
+      websocketPingInterval = lib.mkOption {
         description = "Frequency at which the client will send websocket ping to the server.";
-        type = types.nullOr types.ints.unsigned;
+        type = lib.types.nullOr lib.types.ints.unsigned;
         default = null;
       };
 
-      upgradeCredentials = mkOption {
+      upgradeCredentials = lib.mkOption {
         description = ''
-          Use these credentials to authenticate during the HTTP upgrade request (Basic authorization type, `USER:[PASS]`).
+          Use these credentials to authenticate during the HTTP upgrade request
+          (Basic authorization type, `USER:[PASS]`).
 
           ::: {.warning}
-          Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the `environmentFile` option to a file containing `HTTP_PASSWORD=<your-password-here>` and set this option to `<user>:$HTTP_PASSWORD`. Note however that this will also locally leak the passwords at runtime via e.g. /proc/<pid>/cmdline.
+          Passwords specified here will be world-readable in the Nix store!
+          To pass a password to the service, point the `environmentFile` option
+          to a file containing `HTTP_PASSWORD=<your-password-here>` and set this
+          option to `<user>:$HTTP_PASSWORD`.
+          Note however that this will also locally leak the passwords at runtime
+          via e.g. /proc/<pid>/cmdline.
           :::
         '';
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         default = null;
       };
 
-      customHeaders = mkOption {
+      customHeaders = lib.mkOption {
         description = "Custom HTTP headers to send during the upgrade request.";
-        type = types.attrsOf types.str;
-        default = {};
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
         example = {
           "X-Some-Header" = "some-value";
         };
@@ -224,49 +264,63 @@ let
 
   generateServerUnit = name: serverCfg: {
     name = "wstunnel-server-${name}";
-    value = {
-      description = "wstunnel server - ${name}";
-      requires = [ "network.target" "network-online.target" ];
-      after = [ "network.target" "network-online.target" ];
-      wantedBy = optional serverCfg.autoStart "multi-user.target";
+    value =
+      let
+        certConfig = config.security.acme.certs.${serverCfg.useACMEHost};
+      in
+      {
+        description = "wstunnel server - ${name}";
+        requires = [ "network.target" "network-online.target" ];
+        after = [ "network.target" "network-online.target" ];
+        wantedBy = lib.optional serverCfg.autoStart "multi-user.target";
 
-      serviceConfig = let
-        certConfig = config.security.acme.certs."${serverCfg.useACMEHost}";
-      in {
-        Type = "simple";
-        ExecStart = with serverCfg; let
-          resolvedTlsCertificate = if useACMEHost != null
-            then "${certConfig.directory}/fullchain.pem"
-            else tlsCertificate;
-          resolvedTlsKey = if useACMEHost != null
-            then "${certConfig.directory}/key.pem"
-            else tlsKey;
-        in ''
-          ${package}/bin/wstunnel \
+        environment.RUST_LOG = serverCfg.loggingLevel;
+
+        serviceConfig = {
+          Type = "exec";
+          EnvironmentFile =
+            lib.optional (serverCfg.environmentFile != null) serverCfg.environmentFile;
+          DynamicUser = true;
+          SupplementaryGroups =
+            lib.optional (serverCfg.useACMEHost != null) certConfig.group;
+          PrivateTmp = true;
+          AmbientCapabilities =
+            lib.optionals (serverCfg.listen.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+          NoNewPrivileges = true;
+          RestrictNamespaces = "uts ipc pid user cgroup";
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          PrivateDevices = true;
+          RestrictSUIDSGID = true;
+
+          Restart = "on-failure";
+          RestartSec = 2;
+          RestartSteps = 20;
+          RestartMaxDelaySec = "5min";
+        };
+
+        script = with serverCfg; ''
+          ${lib.getExe package} \
             server \
-            ${concatStringsSep " " (builtins.map (hostPair:   "--restrict-to ${utils.escapeSystemdExecArg (hostPortToString hostPair)}") restrictTo)} \
-            ${optionalString (resolvedTlsCertificate != null) "--tls-certificate ${utils.escapeSystemdExecArg resolvedTlsCertificate}"} \
-            ${optionalString (resolvedTlsKey != null)         "--tls-private-key ${utils.escapeSystemdExecArg resolvedTlsKey}"} \
-            ${optionalString (loggingLevel != null) "--log-lvl ${loggingLevel}"} \
-            ${attrsToArgs extraArgs} \
-            ${utils.escapeSystemdExecArg "${if enableHTTPS then "wss" else "ws"}://${hostPortToString listen}"}
+            ${lib.cli.toGNUCommandLineShell { } (
+              lib.recursiveUpdate
+              {
+                restrict-to = map hostPortToString restrictTo;
+                tls-certificate = if useACMEHost != null
+                                  then "${certConfig.directory}/fullchain.pem"
+                                  else "${tlsCertificate}";
+                tls-private-key = if useACMEHost != null
+                                  then "${certConfig.directory}/key.pem"
+                                  else "${tlsKey}";
+              }
+              extraArgs
+            )} \
+            ${lib.escapeShellArg "${if enableHTTPS then "wss" else "ws"}://${hostPortToString listen}"}
         '';
-        EnvironmentFile = optional (serverCfg.environmentFile != null) serverCfg.environmentFile;
-        DynamicUser = true;
-        SupplementaryGroups = optional (serverCfg.useACMEHost != null) certConfig.group;
-        PrivateTmp = true;
-        AmbientCapabilities = optionals (serverCfg.listen.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
-        NoNewPrivileges = true;
-        RestrictNamespaces = "uts ipc pid user cgroup";
-        ProtectSystem = "strict";
-        ProtectHome = true;
-        ProtectKernelTunables = true;
-        ProtectKernelModules = true;
-        ProtectControlGroups = true;
-        PrivateDevices = true;
-        RestrictSUIDSGID = true;
       };
-    };
   };
 
   generateClientUnit = name: clientCfg: {
@@ -275,30 +329,19 @@ let
       description = "wstunnel client - ${name}";
       requires = [ "network.target" "network-online.target" ];
       after = [ "network.target" "network-online.target" ];
-      wantedBy = optional clientCfg.autoStart "multi-user.target";
+      wantedBy = lib.optional clientCfg.autoStart "multi-user.target";
+
+      environment.RUST_LOG = clientCfg.loggingLevel;
 
       serviceConfig = {
-        Type = "simple";
-        ExecStart = with clientCfg; ''
-          ${package}/bin/wstunnel client \
-            ${concatStringsSep " " (builtins.map (x:          "--local-to-remote ${x}") localToRemote)} \
-            ${concatStringsSep " " (builtins.map (x:          "--remote-to-local ${x}") remoteToLocal)} \
-            ${concatStringsSep " " (mapAttrsToList (n: v:     "--http-headers \"${n}: ${v}\"") customHeaders)} \
-            ${optionalString (httpProxy != null)              "--http-proxy ${httpProxy}"} \
-            ${optionalString (soMark != null)                 "--socket-so-mark=${toString soMark}"} \
-            ${optionalString (upgradePathPrefix != null)      "--http-upgrade-path-prefix ${upgradePathPrefix}"} \
-            ${optionalString (tlsSNI != null)                 "--tls-sni-override ${tlsSNI}"} \
-            ${optionalString tlsVerifyCertificate             "--tls-verify-certificate"} \
-            ${optionalString (websocketPingInterval != null)  "--websocket-ping-frequency-sec ${toString websocketPingInterval}"} \
-            ${optionalString (upgradeCredentials != null)     "--http-upgrade-credentials ${upgradeCredentials}"} \
-            ${optionalString (loggingLevel != null) "--log-lvl ${loggingLevel}"} \
-            ${attrsToArgs extraArgs} \
-            ${utils.escapeSystemdExecArg connectTo}
-        '';
-        EnvironmentFile = optional (clientCfg.environmentFile != null) clientCfg.environmentFile;
+        Type = "exec";
+        EnvironmentFile =
+          lib.optional (clientCfg.environmentFile != null) clientCfg.environmentFile;
         DynamicUser = true;
         PrivateTmp = true;
-        AmbientCapabilities = (optionals (clientCfg.soMark != null) [ "CAP_NET_ADMIN" ]) ++ (optionals (clientCfg.addNetBind) [ "CAP_NET_BIND_SERVICE" ]);
+        AmbientCapabilities =
+          (lib.optionals clientCfg.addNetBind [ "CAP_NET_BIND_SERVICE" ]) ++
+          (lib.optionals (clientCfg.soMark != null) [ "CAP_NET_ADMIN" ]);
         NoNewPrivileges = true;
         RestrictNamespaces = "uts ipc pid user cgroup";
         ProtectSystem = "strict";
@@ -308,17 +351,45 @@ let
         ProtectControlGroups = true;
         PrivateDevices = true;
         RestrictSUIDSGID = true;
+
+        Restart = "on-failure";
+        RestartSec = 2;
+        RestartSteps = 20;
+        RestartMaxDelaySec = "5min";
       };
+
+      script = with clientCfg; ''
+        ${lib.getExe package} \
+          client \
+          ${lib.cli.toGNUCommandLineShell { } (
+            lib.recursiveUpdate
+            {
+              local-to-remote = localToRemote;
+              remote-to-local = remoteToLocal;
+              http-headers = lib.mapAttrsToList (n: v: "${n}:${v}") customHeaders;
+              http-proxy = httpProxy;
+              socket-so-mark = soMark;
+              http-upgrade-path-prefix = upgradePathPrefix;
+              tls-sni-override = tlsSNI;
+              tls-verify-certificate = tlsVerifyCertificate;
+              websocket-ping-frequency-sec = websocketPingInterval;
+              http-upgrade-credentials = upgradeCredentials;
+            }
+            extraArgs
+          )} \
+          ${lib.escapeShellArg connectTo}
+      '';
     };
   };
-in {
+in
+{
   options.services.wstunnel = {
-    enable = mkEnableOption "wstunnel";
+    enable = lib.mkEnableOption "wstunnel";
 
-    servers = mkOption {
+    servers = lib.mkOption {
       description = "`wstunnel` servers to set up.";
-      type = types.attrsOf (types.submodule serverSubmodule);
-      default = {};
+      type = lib.types.attrsOf (lib.types.submodule serverSubmodule);
+      default = { };
       example = {
         "wg-tunnel" = {
           listen = {
@@ -336,13 +407,13 @@ in {
       };
     };
 
-    clients = mkOption {
+    clients = lib.mkOption {
       description = "`wstunnel` clients to set up.";
-      type = types.attrsOf (types.submodule clientSubmodule);
-      default = {};
+      type = lib.types.attrsOf (lib.types.submodule clientSubmodule);
+      default = { };
       example = {
         "wg-tunnel" = {
-          connectTo = "https://wstunnel.server.com:8443";
+          connectTo = "wss://wstunnel.server.com:8443";
           localToRemote = [
             "tcp://1212:google.com:443"
             "tcp://2:n.lan:4?proxy_protocol"
@@ -356,28 +427,42 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
-    systemd.services = (mapAttrs' generateServerUnit (filterAttrs (n: v: v.enable) cfg.servers)) // (mapAttrs' generateClientUnit (filterAttrs (n: v: v.enable) cfg.clients));
+  config = lib.mkIf cfg.enable {
+    systemd.services =
+      (lib.mapAttrs' generateServerUnit (lib.filterAttrs (n: v: v.enable) cfg.servers)) //
+      (lib.mapAttrs' generateClientUnit (lib.filterAttrs (n: v: v.enable) cfg.clients));
 
-    assertions = (mapAttrsToList (name: serverCfg: {
-      assertion = !(serverCfg.useACMEHost != null && (serverCfg.tlsCertificate != null || serverCfg.tlsKey != null));
-      message = ''
-        Options services.wstunnel.servers."${name}".useACMEHost and services.wstunnel.servers."${name}".{tlsCertificate, tlsKey} are mutually exclusive.
-      '';
-    }) cfg.servers) ++
-    (mapAttrsToList (name: serverCfg: {
-      assertion = !((serverCfg.tlsCertificate != null || serverCfg.tlsKey != null) && !(serverCfg.tlsCertificate != null && serverCfg.tlsKey != null));
-      message = ''
-        services.wstunnel.servers."${name}".tlsCertificate and services.wstunnel.servers."${name}".tlsKey need to be set together.
-      '';
-    }) cfg.servers) ++
-    (mapAttrsToList (name: clientCfg: {
-      assertion = !(clientCfg.localToRemote == [] && clientCfg.remoteToLocal == []);
-      message = ''
-        Either one of services.wstunnel.clients."${name}".localToRemote or services.wstunnel.clients."${name}".remoteToLocal must be set.
-      '';
-    }) cfg.clients);
+    assertions =
+      (lib.mapAttrsToList
+        (name: serverCfg: {
+          assertion =
+            !(serverCfg.useACMEHost != null && serverCfg.tlsCertificate != null);
+          message = ''
+            Options services.wstunnel.servers."${name}".useACMEHost and services.wstunnel.servers."${name}".{tlsCertificate, tlsKey} are mutually exclusive.
+          '';
+        })
+        cfg.servers) ++
+
+      (lib.mapAttrsToList
+        (name: serverCfg: {
+          assertion =
+            (serverCfg.tlsCertificate == null && serverCfg.tlsKey == null) ||
+            (serverCfg.tlsCertificate != null && serverCfg.tlsKey != null);
+          message = ''
+            services.wstunnel.servers."${name}".tlsCertificate and services.wstunnel.servers."${name}".tlsKey need to be set together.
+          '';
+        })
+        cfg.servers) ++
+
+      (lib.mapAttrsToList
+        (name: clientCfg: {
+          assertion = !(clientCfg.localToRemote == [ ] && clientCfg.remoteToLocal == [ ]);
+          message = ''
+            Either one of services.wstunnel.clients."${name}".localToRemote or services.wstunnel.clients."${name}".remoteToLocal must be set.
+          '';
+        })
+        cfg.clients);
   };
 
-  meta.maintainers = with maintainers; [ alyaeanyx neverbehave ];
+  meta.maintainers = with lib.maintainers; [ alyaeanyx rvdp neverbehave ];
 }
diff --git a/nixos/modules/virtualisation/oci-image.nix b/nixos/modules/virtualisation/oci-image.nix
index d4af5016dd71..1e2b90bfd46e 100644
--- a/nixos/modules/virtualisation/oci-image.nix
+++ b/nixos/modules/virtualisation/oci-image.nix
@@ -9,10 +9,10 @@ in
   config = {
     system.build.OCIImage = import ../../lib/make-disk-image.nix {
       inherit config lib pkgs;
+      inherit (cfg) diskSize;
       name = "oci-image";
       configFile = ./oci-config-user.nix;
       format = "qcow2";
-      diskSize = 8192;
       partitionTableType = if cfg.efi then "efi" else "legacy";
     };
 
diff --git a/nixos/modules/virtualisation/oci-options.nix b/nixos/modules/virtualisation/oci-options.nix
index 0dfedc6a530c..76f3475a4281 100644
--- a/nixos/modules/virtualisation/oci-options.nix
+++ b/nixos/modules/virtualisation/oci-options.nix
@@ -9,6 +9,12 @@
           Whether the OCI instance is using EFI.
         '';
       };
+      diskSize = lib.mkOption {
+        type = lib.types.int;
+        default = 8192;
+        description = "Size of the disk image created in MB.";
+        example = "diskSize = 12 * 1024; # 12GiB";
+      };
     };
   };
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8d5b865891e4..7471a2343138 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1045,6 +1045,7 @@ in {
   wordpress = handleTest ./wordpress.nix {};
   wrappers = handleTest ./wrappers.nix {};
   writefreely = handleTest ./web-apps/writefreely.nix {};
+  wstunnel = runTest ./wstunnel.nix;
   xandikos = handleTest ./xandikos.nix {};
   xautolock = handleTest ./xautolock.nix {};
   xfce = handleTest ./xfce.nix {};
diff --git a/nixos/tests/crabfit.nix b/nixos/tests/crabfit.nix
index 0cd0741f6fa4..0daf47d52f25 100644
--- a/nixos/tests/crabfit.nix
+++ b/nixos/tests/crabfit.nix
@@ -4,7 +4,7 @@ import ./make-test-python.nix (
   {
     name = "crabfit";
 
-    meta.maintainers = with lib.maintainers; [ thubrecht ];
+    meta.maintainers = with lib.maintainers; [ ];
 
     nodes = {
       machine =
diff --git a/nixos/tests/matomo.nix b/nixos/tests/matomo.nix
index 130f3dd8485a..cf54f71b738f 100644
--- a/nixos/tests/matomo.nix
+++ b/nixos/tests/matomo.nix
@@ -41,14 +41,14 @@ let
 in {
   matomo = matomoTest pkgs.matomo // {
     name = "matomo";
-    meta.maintainers = with maintainers; [ florianjacob kiwi mmilata twey boozedog ];
+    meta.maintainers = with maintainers; [ florianjacob mmilata twey boozedog ];
   };
   matomo-beta = matomoTest pkgs.matomo-beta // {
     name = "matomo-beta";
-    meta.maintainers = with maintainers; [ florianjacob kiwi mmilata twey boozedog ];
+    meta.maintainers = with maintainers; [ florianjacob mmilata twey boozedog ];
   };
   matomo_5 = matomoTest pkgs.matomo_5 // {
     name = "matomo-5";
-    meta.maintainers = with maintainers; [ florianjacob kiwi mmilata twey boozedog ] ++ lib.teams.flyingcircus.members;
+    meta.maintainers = with maintainers; [ florianjacob mmilata twey boozedog ] ++ lib.teams.flyingcircus.members;
   };
 }
diff --git a/nixos/tests/wstunnel.nix b/nixos/tests/wstunnel.nix
new file mode 100644
index 000000000000..3bbc295568fb
--- /dev/null
+++ b/nixos/tests/wstunnel.nix
@@ -0,0 +1,96 @@
+let
+  certs = import ./common/acme/server/snakeoil-certs.nix;
+  domain = certs.domain;
+in
+
+{
+  name = "wstunnel";
+
+  nodes = {
+    server = {
+      virtualisation.vlans = [ 1 ];
+
+      security.pki.certificateFiles = [ certs.ca.cert ];
+
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
+      };
+
+      systemd.network.networks."01-eth1" = {
+        name = "eth1";
+        networkConfig.Address = "10.0.0.1/24";
+      };
+
+      services.wstunnel = {
+        enable = true;
+        servers.my-server = {
+          listen = {
+            host = "10.0.0.1";
+            port = 443;
+          };
+          tlsCertificate = certs.${domain}.cert;
+          tlsKey = certs.${domain}.key;
+        };
+      };
+    };
+
+    client = {
+      virtualisation.vlans = [ 1 ];
+
+      security.pki.certificateFiles = [ certs.ca.cert ];
+
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
+        extraHosts = ''
+          10.0.0.1 ${domain}
+        '';
+      };
+
+      systemd.network.networks."01-eth1" = {
+        name = "eth1";
+        networkConfig.Address = "10.0.0.2/24";
+      };
+
+      services.wstunnel = {
+        enable = true;
+        clients.my-client = {
+          autoStart = false;
+          connectTo = "wss://${domain}:443";
+          localToRemote = [
+            "tcp://8080:localhost:2080"
+          ];
+          remoteToLocal = [
+            "tcp://2081:localhost:8081"
+          ];
+        };
+      };
+    };
+  };
+
+  testScript = /* python */ ''
+    start_all()
+    server.wait_for_unit("wstunnel-server-my-server.service")
+    client.wait_for_open_port(443, "10.0.0.1")
+
+    client.systemctl("start wstunnel-client-my-client.service")
+    client.wait_for_unit("wstunnel-client-my-client.service")
+
+    with subtest("connection from client to server"):
+      server.succeed("nc -l 2080 >/tmp/msg &")
+      client.sleep(1)
+      client.succeed('nc -w1 localhost 8080 <<<"Hello from client"')
+      server.succeed('grep "Hello from client" /tmp/msg')
+
+    with subtest("connection from server to client"):
+      client.succeed("nc -l 8081 >/tmp/msg &")
+      server.sleep(1)
+      server.succeed('nc -w1 localhost 2081 <<<"Hello from server"')
+      client.succeed('grep "Hello from server" /tmp/msg')
+
+    client.systemctl("stop wstunnel-client-my-client.service")
+  '';
+}
diff --git a/pkgs/applications/audio/cmus/default.nix b/pkgs/applications/audio/cmus/default.nix
index 7448e562ffa6..db32f8548517 100644
--- a/pkgs/applications/audio/cmus/default.nix
+++ b/pkgs/applications/audio/cmus/default.nix
@@ -8,12 +8,12 @@
 , samplerateSupport ? jackSupport, libsamplerate ? null
 , ossSupport ? false, alsa-oss ? null
 , pulseaudioSupport ? config.pulseaudio or false, libpulseaudio ? null
+, sndioSupport ? false, sndio ? null
 , mprisSupport ? stdenv.isLinux, systemd ? null
 
 # TODO: add these
 #, artsSupport
 #, roarSupport
-#, sndioSupport
 #, sunSupport
 #, waveoutSupport
 
@@ -59,11 +59,11 @@ let
     (mkFlag samplerateSupport "CONFIG_SAMPLERATE=y" libsamplerate)
     (mkFlag ossSupport        "CONFIG_OSS=y"        alsa-oss)
     (mkFlag pulseaudioSupport "CONFIG_PULSE=y"      libpulseaudio)
+    (mkFlag sndioSupport      "CONFIG_SNDIO=y"      sndio)
     (mkFlag mprisSupport      "CONFIG_MPRIS=y"      systemd)
 
     #(mkFlag artsSupport      "CONFIG_ARTS=y")
     #(mkFlag roarSupport      "CONFIG_ROAR=y")
-    #(mkFlag sndioSupport     "CONFIG_SNDIO=y")
     #(mkFlag sunSupport       "CONFIG_SUN=y")
     #(mkFlag waveoutSupport   "CONFIG_WAVEOUT=y")
 
@@ -92,13 +92,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "cmus";
-  version = "2.10.0-unstable-2023-11-05";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner  = "cmus";
     repo   = "cmus";
-    rev    = "23afab39902d3d97c47697196b07581305337529";
-    sha256 = "sha256-pxDIYbeJMoaAuErCghWJpDSh1WbYbhgJ7+ca5WLCrOs=";
+    rev    = "v${version}";
+    hash   = "sha256-kUJC+ORLkYD57mPL/1p5VCm9yiNzVdOZhxp7sVP6oMw=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/audio/spotify-qt/default.nix b/pkgs/applications/audio/spotify-qt/default.nix
index d5947d145172..0fbf7c943842 100644
--- a/pkgs/applications/audio/spotify-qt/default.nix
+++ b/pkgs/applications/audio/spotify-qt/default.nix
@@ -1,4 +1,5 @@
-{ fetchFromGitHub
+{ stdenvNoCC
+, fetchFromGitHub
 , lib
 , cmake
 , mkDerivation
@@ -26,12 +27,18 @@ mkDerivation rec {
 
    installFlags = [ "DESTDIR=$(out)" ];
 
+   postInstall = lib.optionalString stdenvNoCC.isDarwin ''
+     mkdir -p $out/Applications
+     mv $out/bin/spotify-qt.app $out/Applications
+     ln $out/Applications/spotify-qt.app/Contents/MacOS/spotify-qt $out/bin/spotify-qt
+   '';
+
    meta = with lib; {
     description = "Lightweight unofficial Spotify client using Qt";
     mainProgram = "spotify-qt";
     homepage = "https://github.com/kraxarn/spotify-qt";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ iivusly ];
     platforms = platforms.unix;
    };
 }
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 2c8147cfce73..2b2f69fa0078 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -60,6 +60,9 @@
 , zsh
 , # codeium-nvim dependencies
   codeium
+, # codesnap-nvim dependencies
+  clang
+, libuv
 , # command-t dependencies
   getconf
 , ruby
@@ -400,6 +403,50 @@
     '';
   };
 
+  codesnap-nvim =
+    let
+      version = "1.3.1";
+      src = fetchFromGitHub {
+        owner = "mistricky";
+        repo = "codesnap.nvim";
+        rev = "refs/tags/v${version}";
+        hash = "sha256-nS/bAWsBQ1L4M9437Yp6FdmHoogzalKlLIAXnRZyMp0=";
+      };
+      codesnap-lib = rustPlatform.buildRustPackage {
+        pname = "codesnap-lib";
+        inherit version src;
+
+        sourceRoot = "${src.name}/generator";
+
+        cargoHash = "sha256-FTQl5WIGEf+RQKYJ4BbIE3cCeN+NYUp7VXIrpxB05tU=";
+
+        nativeBuildInputs = [
+          pkg-config
+          rustPlatform.bindgenHook
+        ];
+
+        buildInputs = [
+          libuv.dev
+        ] ++ lib.optionals stdenv.isDarwin [
+          darwin.apple_sdk.frameworks.AppKit
+        ];
+      };
+    in
+    buildVimPlugin {
+      pname = "codesnap.nvim";
+      inherit version src;
+
+      # https://github.com/mistricky/codesnap.nvim/blob/main/scripts/build_generator.sh
+      postInstall = let
+        extension = if stdenv.isDarwin then "dylib" else "so";
+      in ''
+        cp ${codesnap-lib}/lib/libgenerator.${extension} lua/generator.so
+      '';
+
+      doInstallCheck = true;
+      nvimRequireCheck = "codesnap";
+    };
+
   command-t = super.command-t.overrideAttrs {
     nativeBuildInputs = [ getconf ruby ];
     buildPhase = ''
@@ -1485,6 +1532,11 @@
     '';
   };
 
+  todo-comments-nvim = super.todo-comments-nvim.overrideAttrs {
+    dependencies = [ self.plenary-nvim ];
+    nvimRequireCheck = "todo-comments";
+  };
+
   tup =
     let
       # Based on the comment at the top of https://github.com/gittup/tup/blob/master/contrib/syntax/tup.vim
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index b2370410771a..2f1c42fe67f2 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -191,6 +191,7 @@ https://github.com/neoclide/coc.nvim/,release,
 https://github.com/manicmaniac/coconut.vim/,HEAD,
 https://github.com/Exafunction/codeium.nvim/,HEAD,
 https://github.com/Exafunction/codeium.vim/,HEAD,
+https://github.com/mistricky/codesnap.nvim/,HEAD,
 https://github.com/gorbit99/codewindow.nvim/,HEAD,
 https://github.com/metakirby5/codi.vim/,,
 https://github.com/tjdevries/colorbuddy.nvim/,,
diff --git a/pkgs/applications/editors/xed-editor/default.nix b/pkgs/applications/editors/xed-editor/default.nix
index d44b07292ca0..7458618a1e14 100644
--- a/pkgs/applications/editors/xed-editor/default.nix
+++ b/pkgs/applications/editors/xed-editor/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xed-editor";
-  version = "3.6.2";
+  version = "3.6.3";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xed";
     rev = version;
-    sha256 = "sha256-+yY+vzDMeS4AMMAklzADD4/LAQgav3clM2CCK6xh47Q=";
+    sha256 = "sha256-xsNqzicI11dM/DjY00pXaPpQdHA0ltP23g34fMWUoUA=";
   };
 
   patches = [
diff --git a/pkgs/applications/kde/alligator.nix b/pkgs/applications/kde/alligator.nix
index 425f9733b38a..78263cb73be5 100644
--- a/pkgs/applications/kde/alligator.nix
+++ b/pkgs/applications/kde/alligator.nix
@@ -38,6 +38,6 @@ mkDerivation rec {
     # https://invent.kde.org/plasma-mobile/alligator/-/commit/db30f159c4700244532b17a260deb95551045b7a
     #  * SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only OR LicenseRef-KDE-Accepted-GPL
     license = with licenses; [ gpl2Only gpl3Only ];
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/kde/audiotube.nix b/pkgs/applications/kde/audiotube.nix
index c5a5da855008..58d188d486fb 100644
--- a/pkgs/applications/kde/audiotube.nix
+++ b/pkgs/applications/kde/audiotube.nix
@@ -66,6 +66,6 @@ mkDerivation rec {
     homepage = "https://invent.kde.org/plasma-mobile/audiotube";
     # https://invent.kde.org/plasma-mobile/audiotube/-/tree/c503d0607a3386112beaa9cf990ab85fe33ef115/LICENSES
     license = with licenses; [ bsd2 cc0 gpl2Only gpl3Only ];
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/kde/calindori.nix b/pkgs/applications/kde/calindori.nix
index bb10fa7bb10c..c1e9f4d59b18 100644
--- a/pkgs/applications/kde/calindori.nix
+++ b/pkgs/applications/kde/calindori.nix
@@ -41,6 +41,6 @@ mkDerivation rec {
     description = "Calendar for Plasma Mobile";
     homepage = "https://invent.kde.org/plasma-mobile/calindori";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/kde/kalk.nix b/pkgs/applications/kde/kalk.nix
index c151078e910e..d88741d179bb 100644
--- a/pkgs/applications/kde/kalk.nix
+++ b/pkgs/applications/kde/kalk.nix
@@ -46,6 +46,6 @@ mkDerivation rec {
     mainProgram = "kalk";
     homepage = "https://invent.kde.org/plasma-mobile/kalk";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/kde/kasts.nix b/pkgs/applications/kde/kasts.nix
index 65e4d09409c7..87136676df40 100644
--- a/pkgs/applications/kde/kasts.nix
+++ b/pkgs/applications/kde/kasts.nix
@@ -63,6 +63,6 @@ mkDerivation rec {
     homepage = "https://apps.kde.org/kasts/";
     # https://invent.kde.org/plasma-mobile/kasts/-/tree/master/LICENSES
     license = with licenses; [ bsd2 cc-by-sa-40 cc0 gpl2Only gpl2Plus gpl3Only gpl3Plus lgpl3Plus ];
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/kde/kclock.nix b/pkgs/applications/kde/kclock.nix
index 6212fa8b0400..d97ad5417744 100644
--- a/pkgs/applications/kde/kclock.nix
+++ b/pkgs/applications/kde/kclock.nix
@@ -41,6 +41,6 @@ mkDerivation rec {
     description = "Clock app for plasma mobile";
     homepage = "https://invent.kde.org/plasma-mobile/kclock";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/kde/keysmith.nix b/pkgs/applications/kde/keysmith.nix
index cca4d2ece563..6dd8e3505b53 100644
--- a/pkgs/applications/kde/keysmith.nix
+++ b/pkgs/applications/kde/keysmith.nix
@@ -34,7 +34,7 @@ mkDerivation rec {
     mainProgram = "keysmith";
     license = licenses.gpl3;
     homepage = "https://github.com/KDE/keysmith";
-    maintainers = with maintainers; [ samueldr shamilton ];
+    maintainers = with maintainers; [ shamilton ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/kde/koko.nix b/pkgs/applications/kde/koko.nix
index 826125f91d10..d47734b94e1f 100644
--- a/pkgs/applications/kde/koko.nix
+++ b/pkgs/applications/kde/koko.nix
@@ -77,6 +77,6 @@ mkDerivation rec {
     homepage = "https://apps.kde.org/koko/";
     # LGPL-2.1-only OR LGPL-3.0-only OR LicenseRef-KDE-Accepted-LGPL
     license = [ licenses.lgpl3Only licenses.lgpl21Only ];
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/kde/kpublictransport.nix b/pkgs/applications/kde/kpublictransport.nix
index 0678aa10daff..84d97a42ac3f 100644
--- a/pkgs/applications/kde/kpublictransport.nix
+++ b/pkgs/applications/kde/kpublictransport.nix
@@ -10,7 +10,7 @@ mkDerivation {
   pname = "kpublictransport";
   meta = with lib; {
     license = [ licenses.cc0 ];
-    maintainers = [ maintainers.samueldr ];
+    maintainers = [ ];
   };
   nativeBuildInputs = [ extra-cmake-modules ];
 
diff --git a/pkgs/applications/kde/krecorder.nix b/pkgs/applications/kde/krecorder.nix
index afa5ddee2ed6..d6bdfcc4d38c 100644
--- a/pkgs/applications/kde/krecorder.nix
+++ b/pkgs/applications/kde/krecorder.nix
@@ -38,6 +38,6 @@ mkDerivation rec {
     mainProgram = "krecorder";
     homepage = "https://invent.kde.org/plasma-mobile/krecorder";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/kde/ktrip.nix b/pkgs/applications/kde/ktrip.nix
index ebcb85d67d4a..8780a64d51a9 100644
--- a/pkgs/applications/kde/ktrip.nix
+++ b/pkgs/applications/kde/ktrip.nix
@@ -43,6 +43,6 @@ mkDerivation rec {
     homepage = "https://apps.kde.org/ktrip/";
     # GPL-2.0-or-later
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/kde/kweather.nix b/pkgs/applications/kde/kweather.nix
index b9a5fc04f6df..5c2f244fae60 100644
--- a/pkgs/applications/kde/kweather.nix
+++ b/pkgs/applications/kde/kweather.nix
@@ -44,6 +44,6 @@ mkDerivation rec {
     mainProgram = "kweather";
     homepage = "https://invent.kde.org/plasma-mobile/kweather";
     license = with licenses; [ gpl2Plus cc-by-40 ];
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/auto-multiple-choice/default.nix b/pkgs/applications/misc/auto-multiple-choice/default.nix
index cd27d3584b70..33a4edbdbe57 100644
--- a/pkgs/applications/misc/auto-multiple-choice/default.nix
+++ b/pkgs/applications/misc/auto-multiple-choice/default.nix
@@ -37,31 +37,28 @@ stdenv.mkDerivation (finalAttrs: rec {
 
   makeFlags = [
     "PERLPATH=${perl}/bin/perl"
-    # We *need* to pass DESTDIR, as the Makefile ignores PREFIX.
-    "DESTDIR=$(out)"
-    # Relative paths.
-    "BINDIR=/bin"
-    "PERLDIR=/share/perl5"
-    "MODSDIR=/lib" # At runtime, AMC will test for that dir before
-    # defaulting to the "portable" strategy we use, so this test
-    # *must* fail.  *But* this variable cannot be set to anything but
-    # "/lib" , because that name is hardcoded in the main executable
-    # and this variable controls both both the path AMC will check at
-    # runtime, AND the path where the actual modules will be stored at
-    # build-time.  This has been reported upstream as
-    # https://project.auto-multiple-choice.net/issues/872
-    "TEXDIR=/tex/latex/" # what texlive.combine expects
-    "TEXDOCDIR=/share/doc/texmf/" # TODO where to put this?
-    "MAN1DIR=/share/man/man1"
-    "DESKTOPDIR=/share/applications"
-    "METAINFODIR=/share/metainfo"
-    "ICONSDIR=/share/auto-multiple-choice/icons"
-    "APPICONDIR=/share/icons/hicolor"
-    "LOCALEDIR=/share/locale"
-    "MODELSDIR=/share/auto-multiple-choice/models"
-    "DOCDIR=/share/doc/auto-multiple-choice"
-    "SHARED_MIMEINFO_DIR=/share/mime/packages"
-    "LANG_GTKSOURCEVIEW_DIR=/share/gtksourceview-4/language-specs"
+    # We *need* to set DESTDIR as empty and use absolute paths below,
+    # because the Makefile ignores PREFIX and MODSDIR is required to
+    # be an absolute path to not trigger "portable distribution" check
+    # in auto-multiple-choice.in.
+    "DESTDIR="
+    # Set variables from Makefile.conf to absolute paths
+    "BINDIR=${placeholder "out"}/bin"
+    "PERLDIR=${placeholder "out"}/share/perl5"
+    "MODSDIR=${placeholder "out"}/lib"
+    "TEXDIR=${placeholder "out"}/tex/latex/" # what texlive.combine expects
+    "TEXDOCDIR=${placeholder "out"}/share/doc/texmf/" # TODO where to put this?
+    "MAN1DIR=${placeholder "out"}/share/man/man1"
+    "DESKTOPDIR=${placeholder "out"}/share/applications"
+    "METAINFODIR=${placeholder "out"}/share/metainfo"
+    "ICONSDIR=${placeholder "out"}/share/auto-multiple-choice/icons"
+    "CSSDIR=${placeholder "out"}/share/auto-multiple-choice/gtk"
+    "APPICONDIR=${placeholder "out"}/share/icons/hicolor"
+    "LOCALEDIR=${placeholder "out"}/share/locale"
+    "MODELSDIR=${placeholder "out"}/share/auto-multiple-choice/models"
+    "DOCDIR=${placeholder "out"}/share/doc/auto-multiple-choice"
+    "SHARED_MIMEINFO_DIR=${placeholder "out"}/share/mime/packages"
+    "LANG_GTKSOURCEVIEW_DIR=${placeholder "out"}/share/gtksourceview-4/language-specs"
     # Pretend to be redhat so `install` doesn't try to chown/chgrp.
     "SYSTEM_TYPE=rpm"
     "GCC=${stdenv.cc.targetPrefix}cc"
@@ -93,6 +90,7 @@ stdenv.mkDerivation (finalAttrs: rec {
       XMLWriter
     ]}:"$out/share/perl5 \
     --prefix XDG_DATA_DIRS : "$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
+    --prefix PATH : "$out/bin" \
     --set TEXINPUTS ":.:$out/tex/latex"
   '';
 
diff --git a/pkgs/applications/misc/librecad/default.nix b/pkgs/applications/misc/librecad/default.nix
index eb2e3c136cf4..3ce387c410d9 100644
--- a/pkgs/applications/misc/librecad/default.nix
+++ b/pkgs/applications/misc/librecad/default.nix
@@ -72,7 +72,7 @@ mkDerivation rec {
     description = "2D CAD package based on Qt";
     homepage = "https://librecad.org";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ kiwi viric ];
+    maintainers = with maintainers; [ viric ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/maliit-framework/default.nix b/pkgs/applications/misc/maliit-framework/default.nix
index 2f30e805c584..f730e9265d25 100644
--- a/pkgs/applications/misc/maliit-framework/default.nix
+++ b/pkgs/applications/misc/maliit-framework/default.nix
@@ -73,6 +73,6 @@ mkDerivation rec {
     mainProgram = "maliit-server";
     homepage = "http://maliit.github.io/";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/maliit-keyboard/default.nix b/pkgs/applications/misc/maliit-keyboard/default.nix
index 9613639b0f17..c315b5251cea 100644
--- a/pkgs/applications/misc/maliit-keyboard/default.nix
+++ b/pkgs/applications/misc/maliit-keyboard/default.nix
@@ -69,6 +69,6 @@ mkDerivation rec {
     mainProgram = "maliit-keyboard";
     homepage = "http://maliit.github.io/";
     license = with licenses; [ lgpl3Only bsd3 cc-by-30 ];
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-digitalocean.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-digitalocean.nix
index 094f493dbb72..8a0d2d4c4933 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-digitalocean.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-digitalocean.nix
@@ -48,6 +48,6 @@ buildPythonPackage {
     description = "NixOps Digitalocean plugin";
     homepage = "https://github.com/nix-community/nixops-digitalocean";
     license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ kiwi ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
index a9f29029b069..8dda89f776b4 100644
--- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
@@ -60,7 +60,6 @@ let
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [
       arianvp
-      kiwi
       toonn
     ];
     platforms = platforms.darwin ++ [
diff --git a/pkgs/applications/networking/znc/modules.nix b/pkgs/applications/networking/znc/modules.nix
index 91c2ec526d1c..747846194729 100644
--- a/pkgs/applications/networking/znc/modules.nix
+++ b/pkgs/applications/networking/znc/modules.nix
@@ -77,7 +77,7 @@ in
       description = "ZNC clientaway module";
       homepage = "https://github.com/kylef/znc-contrib";
       license = licenses.gpl2;
-      maintainers = with maintainers; [ kiwi ];
+      maintainers = with maintainers; [ ];
     };
   };
 
@@ -117,7 +117,7 @@ in
       description = "ZNC ignore module";
       homepage = "https://github.com/kylef/znc-contrib";
       license = licenses.gpl2;
-      maintainers = with maintainers; [ kiwi ];
+      maintainers = with maintainers; [ ];
     };
   };
 
@@ -137,7 +137,7 @@ in
       description = "Palaver ZNC module";
       homepage = "https://github.com/cocodelabs/znc-palaver";
       license = licenses.mit;
-      maintainers = with maintainers; [ kiwi szlend ];
+      maintainers = with maintainers; [ szlend ];
     };
   };
 
diff --git a/pkgs/applications/office/scribus/default.nix b/pkgs/applications/office/scribus/default.nix
index 941f34231ca9..85c0afe9db66 100644
--- a/pkgs/applications/office/scribus/default.nix
+++ b/pkgs/applications/office/scribus/default.nix
@@ -70,7 +70,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     maintainers = with maintainers; [
-      kiwi
       arthsmn
     ];
     description = "Desktop Publishing (DTP) and Layout program";
diff --git a/pkgs/applications/plasma-mobile/plasma-dialer.nix b/pkgs/applications/plasma-mobile/plasma-dialer.nix
index 5a5132cd9051..975d4571a16e 100644
--- a/pkgs/applications/plasma-mobile/plasma-dialer.nix
+++ b/pkgs/applications/plasma-mobile/plasma-dialer.nix
@@ -82,6 +82,6 @@ mkDerivation rec {
     mainProgram = "plasmaphonedialer";
     homepage = "https://invent.kde.org/plasma-mobile/plasma-dialer";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/plasma-mobile/plasma-phonebook.nix b/pkgs/applications/plasma-mobile/plasma-phonebook.nix
index bc186b67d317..67164f548d1e 100644
--- a/pkgs/applications/plasma-mobile/plasma-phonebook.nix
+++ b/pkgs/applications/plasma-mobile/plasma-phonebook.nix
@@ -37,6 +37,6 @@ mkDerivation rec {
     homepage = "https://invent.kde.org/plasma-mobile/plasma-phonebook";
     # https://invent.kde.org/plasma-mobile/plasma-phonebook/-/commit/3ac27760417e51c051c5dd44155c3f42dd000e4f
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/plasma-mobile/plasma-settings.nix b/pkgs/applications/plasma-mobile/plasma-settings.nix
index 28047954304a..c30cda1cd839 100644
--- a/pkgs/applications/plasma-mobile/plasma-settings.nix
+++ b/pkgs/applications/plasma-mobile/plasma-settings.nix
@@ -53,6 +53,6 @@ mkDerivation rec {
     homepage = "https://invent.kde.org/plasma-mobile/plasma-settings";
     # https://invent.kde.org/plasma-mobile/plasma-settings/-/commit/a59007f383308503e59498b3036e1483bca26e35
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/plasma-mobile/spacebar.nix b/pkgs/applications/plasma-mobile/spacebar.nix
index 7ae6e7684acc..8dce4192a08c 100644
--- a/pkgs/applications/plasma-mobile/spacebar.nix
+++ b/pkgs/applications/plasma-mobile/spacebar.nix
@@ -52,6 +52,6 @@ mkDerivation {
     mainProgram = "spacebar";
     homepage = "https://invent.kde.org/plasma-mobile/spacebar";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/science/math/eigenmath/default.nix b/pkgs/applications/science/math/eigenmath/default.nix
index cb6748ec3779..a120de87b9ff 100644
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "3.26-unstable-2024-06-09";
+  version = "3.27-unstable-2024-06-20";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "285fc0133f0e7bb5e1e220b75246ce542ae50269";
-    hash = "sha256-ddED3PaHSSupe/QqMYj88GCmh9IrRvpAd4/WEpRTN00=";
+    rev = "c3e3da104dbef888c3e52659134d5e9bdc12764d";
+    hash = "sha256-fqCphnRQw79v7ZTCZU9ucm/R7BKY7yCZYDSnxD7uRS8=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
diff --git a/pkgs/applications/video/mlv-app/default.nix b/pkgs/applications/video/mlv-app/default.nix
index 72e53090d33c..05c6799e4213 100644
--- a/pkgs/applications/video/mlv-app/default.nix
+++ b/pkgs/applications/video/mlv-app/default.nix
@@ -54,9 +54,7 @@ mkDerivation rec {
     description = "All in one MLV processing app that is pretty great";
     homepage = "https://mlv.app";
     license = licenses.gpl3;
-    maintainers = with maintainers; [
-      kiwi
-    ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
     mainProgram = "mlvapp";
   };
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 2d75330f1c9e..2a1fe1344e20 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -10,15 +10,15 @@
 , stdenvNoCC
 , runtimeShell
 , bintools ? null, libc ? null, coreutils ? null, gnugrep ? null
-, netbsd ? null
+, netbsd ? null, netbsdCross ? null
 , sharedLibraryLoader ?
   if libc == null then
     null
   else if stdenvNoCC.targetPlatform.isNetBSD then
-    if !(targetPackages ? netbsd) then
+    if !(targetPackages ? netbsdCross) then
       netbsd.ld_elf_so
-    else if libc != targetPackages.netbsd.headers then
-      targetPackages.netbsd.ld_elf_so
+    else if libc != targetPackages.netbsdCross.headers then
+      targetPackages.netbsdCross.ld_elf_so
     else
       null
   else
diff --git a/pkgs/build-support/ocaml/dune.nix b/pkgs/build-support/ocaml/dune.nix
index 972244f80b0a..e293605cb31d 100644
--- a/pkgs/build-support/ocaml/dune.nix
+++ b/pkgs/build-support/ocaml/dune.nix
@@ -7,8 +7,7 @@ let Dune =
   { "1" = dune_1; "2" = dune_2; "3" = dune_3; }."${dune-version}"
 ; in
 
-if (args ? minimumOCamlVersion && lib.versionOlder ocaml.version args.minimumOCamlVersion) ||
-   (args ? minimalOCamlVersion && lib.versionOlder ocaml.version args.minimalOCamlVersion)
+if args ? minimalOCamlVersion && lib.versionOlder ocaml.version args.minimalOCamlVersion
 then throw "${pname}-${version} is not available for OCaml ${ocaml.version}"
 else
 
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index 4077ee5ced8e..ab872bac854f 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -198,13 +198,16 @@ in ''
      )
 
      set +e
-     EXTRA_BUILD=$(sed -n "s/^cargo:rustc-flags=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
-     EXTRA_FEATURES=$(sed -n "s/^cargo:rustc-cfg=\(.*\)/--cfg \1/p" target/build/${crateName}.opt | tr '\n' ' ')
-     EXTRA_LINK_ARGS=$(sed -n "s/^cargo:rustc-link-arg=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
-     EXTRA_LINK_ARGS_BINS=$(sed -n "s/^cargo:rustc-link-arg-bins=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
-     EXTRA_LINK_ARGS_LIB=$(sed -n "s/^cargo:rustc-link-arg-lib=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
-     EXTRA_LINK_LIBS=$(sed -n "s/^cargo:rustc-link-lib=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ')
-     EXTRA_LINK_SEARCH=$(sed -n "s/^cargo:rustc-link-search=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
+     # We want to support the new prefix invocation syntax which uses two colons
+     # See https://doc.rust-lang.org/cargo/reference/build-scripts.html#outputs-of-the-build-script
+
+     EXTRA_BUILD=$(sed -n "s/^cargo::\{0,1\}rustc-flags=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
+     EXTRA_FEATURES=$(sed -n "s/^cargo::\{0,1\}rustc-cfg=\(.*\)/--cfg \1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS=$(sed -n "s/^cargo::\{0,1\}rustc-link-arg=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS_BINS=$(sed -n "s/^cargo::\{0,1\}rustc-link-arg-bins=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_ARGS_LIB=$(sed -n "s/^cargo::\{0,1\}rustc-link-arg-lib=\(.*\)/-C link-arg=\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_LIBS=$(sed -n "s/^cargo::\{0,1\}rustc-link-lib=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ')
+     EXTRA_LINK_SEARCH=$(sed -n "s/^cargo::\{0,1\}rustc-link-search=\(.*\)/\1/p" target/build/${crateName}.opt | tr '\n' ' ' | sort -u)
 
      # We want to read part of every line that has cargo:rustc-env= prefix and
      # export it as environment variables. This turns out tricky if the lines
@@ -217,14 +220,15 @@ in ''
      #
      _OLDIFS="$IFS"
      IFS=$'\n'
-     for env in $(sed -n "s/^cargo:rustc-env=\(.*\)/\1/p" target/build/${crateName}.opt); do
+     for env in $(sed -n "s/^cargo::\{0,1\}rustc-env=\(.*\)/\1/p" target/build/${crateName}.opt); do
        export "$env"
      done
      IFS="$_OLDIFS"
 
      CRATENAME=$(echo ${crateName} | sed -e "s/\(.*\)-sys$/\U\1/" -e "s/-/_/g")
-     grep -P "^cargo:(?!(rustc-|warning=|rerun-if-changed=|rerun-if-env-changed))" target/build/${crateName}.opt \
-       | awk -F= "/^cargo:/ { sub(/^cargo:/, \"\", \$1); gsub(/-/, \"_\", \$1); print \"export \" toupper(\"DEP_$(echo $CRATENAME)_\" \$1) \"=\" \"\\\"\"\$2\"\\\"\" }" > target/env
+     grep -P "^cargo:(?!:?(rustc-|warning=|rerun-if-changed=|rerun-if-env-changed))" target/build/${crateName}.opt \
+       | awk -F= "/^cargo::metadata=/ {  gsub(/-/, \"_\", \$2); print \"export \" toupper(\"DEP_$(echo $CRATENAME)_\" \$2) \"=\" \"\\\"\"\$3\"\\\"\"; next }
+                  /^cargo:/ { sub(/^cargo::?/, \"\", \$1); gsub(/-/, \"_\", \$1); print \"export \" toupper(\"DEP_$(echo $CRATENAME)_\" \$1) \"=\" \"\\\"\"\$2\"\\\"\"; next }" > target/env
      set -e
   fi
   runHook postConfigure
diff --git a/pkgs/build-support/rust/build-rust-crate/test/default.nix b/pkgs/build-support/rust/build-rust-crate/test/default.nix
index 522eedfede7f..d020031a92f9 100644
--- a/pkgs/build-support/rust/build-rust-crate/test/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/test/default.nix
@@ -421,6 +421,53 @@ let
         buildDependencies = [ depCrate ];
         dependencies = [ depCrate ];
       };
+      # Support new invocation prefix for build scripts `cargo::`
+      # https://doc.rust-lang.org/cargo/reference/build-scripts.html#outputs-of-the-build-script
+      buildScriptInvocationPrefix = let
+        depCrate = buildRustCrate: mkCrate buildRustCrate {
+          crateName = "bar";
+          src = mkFile "build.rs" ''
+              fn main() {
+                // Old invocation prefix
+                // We likely won't see be mixing these syntaxes in the same build script in the wild.
+                println!("cargo:key_old=value_old");
+
+                // New invocation prefix
+                println!("cargo::metadata=key=value");
+                println!("cargo::metadata=key_complex=complex(value)");
+              }
+          '';
+        };
+      in {
+        crateName = "foo";
+        src = symlinkJoin {
+          name = "build-script-and-main-invocation-prefix";
+          paths = [
+            (mkFile  "src/main.rs" ''
+              const BUILDFOO: &'static str = env!("BUILDFOO");
+
+              #[test]
+              fn build_foo_check() { assert!(BUILDFOO == "yes(check)"); }
+
+              fn main() { }
+            '')
+            (mkFile  "build.rs" ''
+              use std::env;
+              fn main() {
+                assert!(env::var_os("DEP_BAR_KEY_OLD").expect("metadata key 'key_old' not set in dependency") == "value_old");
+                assert!(env::var_os("DEP_BAR_KEY").expect("metadata key 'key' not set in dependency") == "value");
+                assert!(env::var_os("DEP_BAR_KEY_COMPLEX").expect("metadata key 'key_complex' not set in dependency") == "complex(value)");
+
+                println!("cargo::rustc-env=BUILDFOO=yes(check)");
+              }
+            '')
+          ];
+        };
+        buildDependencies = [ (depCrate buildPackages.buildRustCrate) ];
+        dependencies = [ (depCrate buildRustCrate) ];
+        buildTests = true;
+        expectedTestOutputs = [ "test build_foo_check ... ok" ];
+      };
       # Regression test for https://github.com/NixOS/nixpkgs/issues/74071
       # Whenevever a build.rs file is generating files those should not be overlayed onto the actual source dir
       buildRsOutDirOverlay = {
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index f10ef5d4178b..ca6c93cac7b5 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -192,7 +192,7 @@ in buildNpmPackage rec {
     inherit description;
     homepage = "https://bitwarden.com";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ amarshall kiwi ];
+    maintainers = with lib.maintainers; [ amarshall ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "bitwarden";
   };
diff --git a/pkgs/by-name/cr/crabfit-api/package.nix b/pkgs/by-name/cr/crabfit-api/package.nix
index 8ab103de0fbe..43fa2947b87b 100644
--- a/pkgs/by-name/cr/crabfit-api/package.nix
+++ b/pkgs/by-name/cr/crabfit-api/package.nix
@@ -68,7 +68,7 @@ rustPlatform.buildRustPackage {
     description = "Enter your availability to find a time that works for everyone";
     homepage = "https://github.com/GRA0007/crab.fit";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ thubrecht ];
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "crabfit-api";
   };
 }
diff --git a/pkgs/by-name/cr/crabfit-frontend/package.nix b/pkgs/by-name/cr/crabfit-frontend/package.nix
index 24ad597d40cb..9a694807abb4 100644
--- a/pkgs/by-name/cr/crabfit-frontend/package.nix
+++ b/pkgs/by-name/cr/crabfit-frontend/package.nix
@@ -113,6 +113,6 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Enter your availability to find a time that works for everyone";
     homepage = "https://github.com/GRA0007/crab.fit";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ thubrecht ];
+    maintainers = with lib.maintainers; [ ];
   };
 })
diff --git a/pkgs/servers/monitoring/grafana-reporter/default.nix b/pkgs/by-name/gr/grafana-reporter/package.nix
similarity index 52%
rename from pkgs/servers/monitoring/grafana-reporter/default.nix
rename to pkgs/by-name/gr/grafana-reporter/package.nix
index 1b4d0d04fa30..309ce2ecba03 100644
--- a/pkgs/servers/monitoring/grafana-reporter/default.nix
+++ b/pkgs/by-name/gr/grafana-reporter/package.nix
@@ -1,33 +1,41 @@
-{ lib, buildGoPackage, fetchFromGitHub, tetex, makeWrapper }:
-
-with lib;
-
-buildGoPackage rec {
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, tetex
+, makeWrapper
+}:
+buildGoModule rec {
   pname = "reporter";
   version = "2.3.1";
-  rev = "v${version}";
-
-  goPackagePath = "github.com/IzakMarais/reporter";
-
-  nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
-    inherit rev;
+    rev = "v${version}";
     owner = "IzakMarais";
     repo = "reporter";
     sha256 = "sha256-lsraJwx56I2Gn8CePWUlQu1qdMp78P4xwPzLxetYUcw=";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
+  vendorHash = null;
+
+  postPatch = ''
+    go mod init github.com/IzakMarais/reporter
+  '';
+
   postInstall = ''
     wrapProgram $out/bin/grafana-reporter \
-      --prefix PATH : ${makeBinPath [ tetex ]}
+      --prefix PATH : ${lib.makeBinPath [ tetex ]}
   '';
 
+  # Testing library used had a breaking API change and upstream didn't adapt.
+  doCheck = false;
+
   meta = {
     description = "PDF report generator from a Grafana dashboard";
     mainProgram = "grafana-reporter";
     homepage = "https://github.com/IzakMarais/reporter";
-    license = licenses.mit;
-    maintainers = with maintainers; [ disassembler ];
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.disassembler ];
   };
 }
diff --git a/pkgs/by-name/li/libsignal-ffi/package.nix b/pkgs/by-name/li/libsignal-ffi/package.nix
index d2c8f1f3df80..c78efec962b3 100644
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -21,8 +21,10 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-HqnxemAPjjKl/l4dVjEUIIvgW3ibNtQWnA10QYcd8Os=";
   };
 
-  nativeBuildInputs = [ protobuf ] ++ lib.optionals stdenv.isDarwin [ xcodebuild ];
-  buildInputs = [ rustPlatform.bindgenHook ];
+  nativeBuildInputs = [
+    protobuf
+    rustPlatform.bindgenHook
+  ] ++ lib.optionals stdenv.isDarwin [ xcodebuild ];
 
   env.BORING_BSSL_PATH = "${boringssl-wrapper}";
 
diff --git a/pkgs/by-name/ne/netbird-dashboard/package.nix b/pkgs/by-name/ne/netbird-dashboard/package.nix
index 18353174e118..dcacab7f5585 100644
--- a/pkgs/by-name/ne/netbird-dashboard/package.nix
+++ b/pkgs/by-name/ne/netbird-dashboard/package.nix
@@ -30,6 +30,6 @@ buildNpmPackage rec {
     description = "NetBird Management Service Web UI Panel";
     homepage = "https://github.com/netbirdio/dashboard";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ thubrecht ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/by-name/po/poutine/package.nix b/pkgs/by-name/po/poutine/package.nix
index 617454ae468e..6ebd925ff2eb 100644
--- a/pkgs/by-name/po/poutine/package.nix
+++ b/pkgs/by-name/po/poutine/package.nix
@@ -1,7 +1,9 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
+  installShellFiles,
 }:
 
 buildGoModule rec {
@@ -22,6 +24,15 @@ buildGoModule rec {
     "-w"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd ${meta.mainProgram} \
+      --bash <($out/bin/${meta.mainProgram} completion bash) \
+      --fish <($out/bin/${meta.mainProgram} completion fish) \
+      --zsh <($out/bin/${meta.mainProgram} completion zsh)
+  '';
+
   meta = with lib; {
     description = "Security scanner that detects misconfigurations and vulnerabilities in build pipelines of repositories";
     homepage = "https://github.com/boostsecurityio/poutine";
diff --git a/pkgs/by-name/pt/ptyxis/package.nix b/pkgs/by-name/pt/ptyxis/package.nix
index e5c51f1b7508..18a9da1fc7cf 100644
--- a/pkgs/by-name/pt/ptyxis/package.nix
+++ b/pkgs/by-name/pt/ptyxis/package.nix
@@ -15,14 +15,14 @@
 }:
 
 let
-  version = "46.2";
+  version = "46.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "chergert";
     repo = "ptyxis";
     rev = version;
-    hash = "sha256-/n/S2ws6qsVwTXX96MPa+/ISozDDu8A1wkD1g3dmAtQ=";
+    hash = "sha256-DKZgnistOv6eFWtqYPtMc1tQJWovCWIqrqGgs9uWu5k=";
   };
 
   vte-gtk4-patched = vte-gtk4.overrideAttrs (prev: {
diff --git a/pkgs/by-name/ty/typstyle/package.nix b/pkgs/by-name/ty/typstyle/package.nix
index c6640cc6dd62..247d6180b0d0 100644
--- a/pkgs/by-name/ty/typstyle/package.nix
+++ b/pkgs/by-name/ty/typstyle/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typstyle";
-  version = "0.11.26";
+  version = "0.11.27";
 
   src = fetchFromGitHub {
     owner = "Enter-tainer";
     repo = "typstyle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zuMsYSiGHJkvI1y+vH77FHzCZFPkYqVoeve2kXwKVDI=";
+    hash = "sha256-7c2WbAEDdCmh92MXBks0AjYEEKfVFVIgU+U2x5K2jLQ=";
   };
 
-  cargoHash = "sha256-PVve8zJvMQuMw4k2fEnjA2viv+f3dNgQ6xmPjbx7EgY=";
+  cargoHash = "sha256-EkMa5mudKaiGtMN2jhQ0PWZlpkpnYZUPXLAJng9+Kes=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/uc/uclibc-ng/package.nix b/pkgs/by-name/uc/uclibc-ng/package.nix
index ebbf7ea0af41..b4464ef3ba65 100644
--- a/pkgs/by-name/uc/uclibc-ng/package.nix
+++ b/pkgs/by-name/uc/uclibc-ng/package.nix
@@ -1,5 +1,5 @@
 { lib
-, stdenvNoLibc
+, stdenv
 , buildPackages
 , fetchurl
 , gitUpdater
@@ -9,7 +9,6 @@
 }:
 
 let
-  stdenv = stdenvNoLibc;
   isCross = (stdenv.buildPlatform != stdenv.hostPlatform);
   configParser = ''
     function parseconfig {
diff --git a/pkgs/by-name/ws/wstunnel/package.nix b/pkgs/by-name/ws/wstunnel/package.nix
index 9e172a08f375..cfcaa1dc8e47 100644
--- a/pkgs/by-name/ws/wstunnel/package.nix
+++ b/pkgs/by-name/ws/wstunnel/package.nix
@@ -1,32 +1,44 @@
-{ fetchFromGitHub
+{ lib
+, fetchFromGitHub
 , rustPlatform
-, lib
+, testers
+, wstunnel
+, nixosTests
 }:
 
-rustPlatform.buildRustPackage rec {
+let
+  version = "9.7.0";
+in
+
+rustPlatform.buildRustPackage {
   pname = "wstunnel";
-  version = "9.6.2";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "erebe";
-    repo  = "wstunnel";
+    repo = "wstunnel";
     rev = "v${version}";
-    hash = "sha256-0r+8C8Gf3/s3opzplzc22d9VVp39FtBq1bYkxlmtqjg=";
+    hash = "sha256-8bLccR6ZmldmrvjlZKFHEa4PoLzyUcLkyQbwSrJjoyY=";
   };
 
-  cargoHash = "sha256-hHVxa7Ihmuuf26ZSzGmrHA2RczhzXtse3h1M4cNCvhw=";
+  cargoHash = "sha256-IAq7Fyr6Ne1Bq18WfqBoppel9FOWSs8PkiXKMwcJ26c=";
 
   checkFlags = [
-    # make use of network connection
+    # Tries to launch a test container
     "--skip=tcp::tests::test_proxy_connection"
   ];
 
+  passthru.tests = {
+    version = testers.testVersion { package = wstunnel; };
+    nixosTest = nixosTests.wstunnel;
+  };
+
   meta = {
-    description = "Tunneling program over websocket protocol";
+    description = "Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI";
+    homepage = "https://github.com/erebe/wstunnel";
+    changelog = "https://github.com/erebe/wstunnel/releases/tag/v${version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ rvdp neverbehave ];
     mainProgram = "wstunnel";
-    homepage    = "https://github.com/erebe/wstunnel";
-    license     = with lib.licenses; [ bsd3 ];
-    maintainers = with lib.maintainers; [ neverbehave ];
-    platforms   = lib.platforms.linux;
   };
 }
diff --git a/pkgs/data/fonts/vegur/default.nix b/pkgs/data/fonts/vegur/default.nix
index b161ad4e3e35..8c1f6c4bf980 100644
--- a/pkgs/data/fonts/vegur/default.nix
+++ b/pkgs/data/fonts/vegur/default.nix
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "http://dotcolon.net/font/vegur/";
     description = "Humanist sans serif font";
     platforms = platforms.all;
-    maintainers = with maintainers; [ minijackson samueldr ];
+    maintainers = with maintainers; [ minijackson ];
     license = licenses.cc0;
   };
 })
diff --git a/pkgs/desktops/cinnamon/xreader/default.nix b/pkgs/desktops/cinnamon/xreader/default.nix
index f38392bd4212..94386d42815f 100644
--- a/pkgs/desktops/cinnamon/xreader/default.nix
+++ b/pkgs/desktops/cinnamon/xreader/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xreader";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "sha256-MWSAyXQcE8cDdzJISFV7UHheHX+7zF1Ula+LGicvUPM=";
+    sha256 = "sha256-+q0fZA72m5T5ZB6bYWPWdQGxLpwjNp5Vak2TzaGwGWQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index 03dd4e728f4e..bc102cb88861 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -306,15 +306,6 @@ package-maintainers:
     - elm-export-persistent
     # - pipes-mongodb
     - streaming-wai
-  kiwi:
-    - config-schema
-    - config-value
-    - glirc
-    - irc-core
-    - matterhorn
-    - mattermost-api
-    - mattermost-api-qc
-    - Unique
   libjared:
     - sensei
   malo:
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index d05b86212b64..2e81440fca77 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -21834,7 +21834,6 @@ self: {
        ];
        description = "It provides the functionality like unix \"uniq\" utility";
        license = lib.licenses.bsd3;
-       maintainers = [ lib.maintainers.kiwi ];
      }) {};
 
   "Unixutils" = callPackage
@@ -73682,7 +73681,6 @@ self: {
        testHaskellDepends = [ base config-value text ];
        description = "Schema definitions for the config-value package";
        license = lib.licenses.isc;
-       maintainers = [ lib.maintainers.kiwi ];
      }) {};
 
   "config-select" = callPackage
@@ -73716,7 +73714,6 @@ self: {
        testHaskellDepends = [ base text ];
        description = "Simple, layout-based value language similar to YAML or JSON";
        license = lib.licenses.mit;
-       maintainers = [ lib.maintainers.kiwi ];
      }) {};
 
   "config-value-getopt" = callPackage
@@ -125275,7 +125272,6 @@ self: {
        license = lib.licenses.isc;
        hydraPlatforms = lib.platforms.none;
        mainProgram = "glirc";
-       maintainers = [ lib.maintainers.kiwi ];
      }) {};
 
   "gll" = callPackage
@@ -175544,7 +175540,6 @@ self: {
        description = "IRC core library for glirc";
        license = lib.licenses.isc;
        hydraPlatforms = lib.platforms.none;
-       maintainers = [ lib.maintainers.kiwi ];
        broken = true;
      }) {};
 
@@ -201019,7 +201014,6 @@ self: {
        description = "Terminal client for the Mattermost chat system";
        license = lib.licenses.bsd3;
        mainProgram = "matterhorn";
-       maintainers = [ lib.maintainers.kiwi ];
      }) {};
 
   "mattermost-api" = callPackage
@@ -201048,7 +201042,6 @@ self: {
        ];
        description = "Client API for Mattermost chat system";
        license = lib.licenses.bsd3;
-       maintainers = [ lib.maintainers.kiwi ];
      }) {};
 
   "mattermost-api-qc" = callPackage
@@ -201064,7 +201057,6 @@ self: {
        ];
        description = "QuickCheck instances for the Mattermost client API library";
        license = lib.licenses.isc;
-       maintainers = [ lib.maintainers.kiwi ];
      }) {};
 
   "maude" = callPackage
diff --git a/pkgs/development/libraries/kirigami-addons/default.nix b/pkgs/development/libraries/kirigami-addons/default.nix
index 8cefa310b61a..403267a4eb56 100644
--- a/pkgs/development/libraries/kirigami-addons/default.nix
+++ b/pkgs/development/libraries/kirigami-addons/default.nix
@@ -38,7 +38,7 @@ mkDerivation rec {
     homepage = "https://invent.kde.org/libraries/kirigami-addons";
     # https://invent.kde.org/libraries/kirigami-addons/-/blob/b197d98fdd079b6fc651949bd198363872d1be23/src/treeview/treeviewplugin.cpp#L1-5
     license = licenses.lgpl2Plus;
-    maintainers = with maintainers; [ samueldr matthiasbeyer ];
+    maintainers = with maintainers; [ matthiasbeyer ];
   };
 }
 
diff --git a/pkgs/development/libraries/kweathercore/default.nix b/pkgs/development/libraries/kweathercore/default.nix
index 943dee42c0e9..6c957b6fc9e5 100644
--- a/pkgs/development/libraries/kweathercore/default.nix
+++ b/pkgs/development/libraries/kweathercore/default.nix
@@ -29,7 +29,7 @@ mkDerivation rec {
 
   meta = with lib; {
     license = [ licenses.cc0 ];
-    maintainers = [ maintainers.samueldr ];
+    maintainers = [ ];
     description = ''
       Library to facilitate retrieval of weather information including forecasts and alerts
     '';
diff --git a/pkgs/development/libraries/libadwaita/default.nix b/pkgs/development/libraries/libadwaita/default.nix
index 7f7f93c37949..449176cfd9e5 100644
--- a/pkgs/development/libraries/libadwaita/default.nix
+++ b/pkgs/development/libraries/libadwaita/default.nix
@@ -14,6 +14,7 @@
 , gtk4
 , gnome
 , gsettings-desktop-schemas
+, desktop-file-utils
 , xvfb-run
 , AppKit
 , Foundation
@@ -47,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     sassc
     vala
     gobject-introspection
+    desktop-file-utils  # for validate-desktop-file
   ];
 
   mesonFlags = [
@@ -104,6 +106,11 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
     moveToOutput "share/doc" "$devdoc"
+
+    # Put all resources related to demo app into devdoc output.
+    for d in applications icons metainfo; do
+      moveToOutput "share/$d" "$devdoc"
+    done
   '';
 
   passthru = {
diff --git a/pkgs/development/libraries/libdisplay-info/default.nix b/pkgs/development/libraries/libdisplay-info/default.nix
index 20376ba6a4b3..68cca4ea1355 100644
--- a/pkgs/development/libraries/libdisplay-info/default.nix
+++ b/pkgs/development/libraries/libdisplay-info/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libdisplay-info";
-  version = "0.1.1";
+  version = "0.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "emersion";
     repo = pname;
     rev = version;
-    sha256 = "sha256-7t1CoLus3rPba9paapM7+H3qpdsw7FlzJsSHFwM/2Lk=";
+    sha256 = "sha256-6xmWBrPHghjok43eIDGeshpUEQTuwWLXNHg7CnBUt3Q=";
   };
 
   depsBuildBuild = [ pkg-config ];
diff --git a/pkgs/development/libraries/libqofono/default.nix b/pkgs/development/libraries/libqofono/default.nix
index 361421466e89..ff72711c8a75 100644
--- a/pkgs/development/libraries/libqofono/default.nix
+++ b/pkgs/development/libraries/libqofono/default.nix
@@ -52,7 +52,7 @@ mkDerivation rec {
     description = "Library for accessing the ofono daemon, and declarative plugin for it";
     homepage = "https://git.sailfishos.org/mer-core/libqofono/";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 2c44bf7f7f83..5ce56bf973f5 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -2597,14 +2597,14 @@ buildLuarocksPackage {
 nlua = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
   pname = "nlua";
-  version = "0.1.0-1";
+  version = "0.2.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/nlua-0.1.0-1.rockspec";
-    sha256 = "14ynhy85m2prawym1ap1kplkbicafbczpggzgdnji00frwqa1zvv";
+    url    = "mirror://luarocks/nlua-0.2.0-1.rockspec";
+    sha256 = "15d8gmlf0kr31p1nlj9skliq8yfk3k24w0df6jxlxqnmb8nkxk04";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mfussenegger/nlua/archive/v0.1.0.zip";
-    sha256 = "1x3pbv5ngbk0sjgwfpjsv3x49wzq4x29d9rm0hgyyb2g2mwag3jc";
+    url    = "https://github.com/mfussenegger/nlua/archive/v0.2.0.zip";
+    sha256 = "09fxryslz9qwyzsvy0sc67irjikcg8cngl5d6g56prqixr3bsxpy";
   };
 
   disabled = luaOlder "5.1";
diff --git a/pkgs/development/misc/or1k/newlib.nix b/pkgs/development/misc/or1k/newlib.nix
index 127d84a82ea2..92829896a27c 100644
--- a/pkgs/development/misc/or1k/newlib.nix
+++ b/pkgs/development/misc/or1k/newlib.nix
@@ -1,6 +1,6 @@
-{ stdenv, texinfo, flex, bison, fetchFromGitHub, stdenvNoLibc, buildPackages }:
+{ stdenv, texinfo, flex, bison, fetchFromGitHub, crossLibcStdenv, buildPackages }:
 
-stdenvNoLibc.mkDerivation {
+crossLibcStdenv.mkDerivation {
   name = "newlib";
   src = fetchFromGitHub {
     owner = "openrisc";
diff --git a/pkgs/development/misc/vc4/newlib.nix b/pkgs/development/misc/vc4/newlib.nix
index 48efd317d4c2..e1a8b2eeaa6a 100644
--- a/pkgs/development/misc/vc4/newlib.nix
+++ b/pkgs/development/misc/vc4/newlib.nix
@@ -1,6 +1,6 @@
-{ stdenv, texinfo, flex, bison, fetchFromGitHub, stdenvNoLibc, buildPackages }:
+{ stdenv, texinfo, flex, bison, fetchFromGitHub, crossLibcStdenv, buildPackages }:
 
-stdenvNoLibc.mkDerivation {
+crossLibcStdenv.mkDerivation {
   name = "newlib";
   src = fetchFromGitHub {
     owner = "itszor";
diff --git a/pkgs/development/ocaml-modules/cpuid/default.nix b/pkgs/development/ocaml-modules/cpuid/default.nix
index a0c28bc92d9a..7afbd8432399 100644
--- a/pkgs/development/ocaml-modules/cpuid/default.nix
+++ b/pkgs/development/ocaml-modules/cpuid/default.nix
@@ -6,7 +6,7 @@ buildDunePackage rec {
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.03";
 
   src = fetchurl {
     url = "https://github.com/pqwy/cpuid/releases/download/v${version}/cpuid-v${version}.tbz";
diff --git a/pkgs/development/ocaml-modules/directories/default.nix b/pkgs/development/ocaml-modules/directories/default.nix
index 79f994458ca6..5f86db245470 100644
--- a/pkgs/development/ocaml-modules/directories/default.nix
+++ b/pkgs/development/ocaml-modules/directories/default.nix
@@ -5,7 +5,7 @@ buildDunePackage rec {
   version = "0.5";
   useDune2 = true;
 
-  minimumOCamlVersion = "4.07";
+  minimalOCamlVersion = "4.07";
 
   src = fetchFromGitHub {
     owner = "ocamlpro";
diff --git a/pkgs/development/ocaml-modules/earley/default.nix b/pkgs/development/ocaml-modules/earley/default.nix
index 0d365c8036dd..a679ee1ed4fd 100644
--- a/pkgs/development/ocaml-modules/earley/default.nix
+++ b/pkgs/development/ocaml-modules/earley/default.nix
@@ -12,7 +12,7 @@ buildDunePackage rec {
     sha256 = "1vi58zdxchpw6ai0bz9h2ggcmg8kv57yk6qbx82lh47s5wb3mz5y";
   };
 
-  minimumOCamlVersion = "4.07";
+  minimalOCamlVersion = "4.07";
   useDune2 = true;
 
   buildInputs = [ stdlib-shims ];
diff --git a/pkgs/development/ocaml-modules/eigen/default.nix b/pkgs/development/ocaml-modules/eigen/default.nix
index 16a69db3b2fc..5c75c4cb1044 100644
--- a/pkgs/development/ocaml-modules/eigen/default.nix
+++ b/pkgs/development/ocaml-modules/eigen/default.nix
@@ -13,7 +13,7 @@ buildDunePackage rec {
     sha256 = "1zaw03as14hyvfpyj6bjrfbcxp2ljdbqcqqgm53kms244mig425f";
   };
 
-  minimumOCamlVersion = "4.02";
+  minimalOCamlVersion = "4.02";
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
diff --git a/pkgs/development/ocaml-modules/fix/default.nix b/pkgs/development/ocaml-modules/fix/default.nix
index 1d738dfb32cc..844059849bfc 100644
--- a/pkgs/development/ocaml-modules/fix/default.nix
+++ b/pkgs/development/ocaml-modules/fix/default.nix
@@ -12,7 +12,7 @@ buildDunePackage rec {
     sha256 = "sha256-Xuw4pEPqAbQjSHrpMCNE7Th0mpbNMSxdEdwvH4hu2SM=";
   };
 
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.03";
   useDune2 = true;
 
   meta = with lib; {
diff --git a/pkgs/development/ocaml-modules/gnuplot/default.nix b/pkgs/development/ocaml-modules/gnuplot/default.nix
index 038863aad978..6b30ac5848c4 100644
--- a/pkgs/development/ocaml-modules/gnuplot/default.nix
+++ b/pkgs/development/ocaml-modules/gnuplot/default.nix
@@ -6,7 +6,7 @@ buildDunePackage rec {
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.03";
 
   src = fetchFromGitHub {
     owner  = "c-cube";
diff --git a/pkgs/development/ocaml-modules/lacaml/default.nix b/pkgs/development/ocaml-modules/lacaml/default.nix
index 04880bca3ac5..e8d0e966c40f 100644
--- a/pkgs/development/ocaml-modules/lacaml/default.nix
+++ b/pkgs/development/ocaml-modules/lacaml/default.nix
@@ -10,7 +10,7 @@ buildDunePackage rec {
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mmottl/lacaml/releases/download/${version}/lacaml-${version}.tbz";
diff --git a/pkgs/development/ocaml-modules/lwt-dllist/default.nix b/pkgs/development/ocaml-modules/lwt-dllist/default.nix
index b28981b1b779..88ad74b3e652 100644
--- a/pkgs/development/ocaml-modules/lwt-dllist/default.nix
+++ b/pkgs/development/ocaml-modules/lwt-dllist/default.nix
@@ -6,7 +6,7 @@ buildDunePackage rec {
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.02";
+  minimalOCamlVersion = "4.02";
 
   src = fetchurl {
     url = "https://github.com/mirage/${pname}/releases/download/v${version}/${pname}-v${version}.tbz";
diff --git a/pkgs/development/ocaml-modules/opam-format/default.nix b/pkgs/development/ocaml-modules/opam-format/default.nix
index fdb8ba33d5eb..1360c6281636 100644
--- a/pkgs/development/ocaml-modules/opam-format/default.nix
+++ b/pkgs/development/ocaml-modules/opam-format/default.nix
@@ -7,7 +7,7 @@ buildDunePackage rec {
 
   inherit (opam-core) src version;
 
-  minimumOCamlVersion = "4.02.3";
+  minimalOCamlVersion = "4.02.3";
 
   # get rid of check for curl at configure time
   # opam-format does not call curl at run time
diff --git a/pkgs/development/ocaml-modules/opam-repository/default.nix b/pkgs/development/ocaml-modules/opam-repository/default.nix
index ff9ad75fad86..008cc2812453 100644
--- a/pkgs/development/ocaml-modules/opam-repository/default.nix
+++ b/pkgs/development/ocaml-modules/opam-repository/default.nix
@@ -3,7 +3,7 @@
 buildDunePackage rec {
   pname = "opam-repository";
 
-  minimumOCamlVersion = "4.02";
+  minimalOCamlVersion = "4.02";
 
   useDune2 = true;
 
diff --git a/pkgs/development/ocaml-modules/opti/default.nix b/pkgs/development/ocaml-modules/opti/default.nix
index 4ce5087912d2..1d854a1fda50 100644
--- a/pkgs/development/ocaml-modules/opti/default.nix
+++ b/pkgs/development/ocaml-modules/opti/default.nix
@@ -6,7 +6,7 @@ buildDunePackage rec {
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.02";
+  minimalOCamlVersion = "4.02";
 
   src = fetchurl {
     url = "https://github.com/magnusjonsson/opti/releases/download/${version}/opti-${version}.tbz";
diff --git a/pkgs/development/ocaml-modules/postgresql/default.nix b/pkgs/development/ocaml-modules/postgresql/default.nix
index 4140baa675cb..25dddaed08c9 100644
--- a/pkgs/development/ocaml-modules/postgresql/default.nix
+++ b/pkgs/development/ocaml-modules/postgresql/default.nix
@@ -6,7 +6,7 @@ buildDunePackage rec {
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.08";
 
   src = fetchFromGitHub {
     owner = "mmottl";
diff --git a/pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix b/pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix
index 27d07649d408..b80adedbc753 100644
--- a/pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix
@@ -10,7 +10,7 @@ buildDunePackage rec {
   pname = "ppx_yojson_conv";
   version = "0.15.1";
   duneVersion = "3";
-  minimumOCamlVersion = "4.08.0";
+  minimalOCamlVersion = "4.08.0";
 
   src = fetchFromGitHub {
     owner = "janestreet";
diff --git a/pkgs/development/ocaml-modules/wtf8/default.nix b/pkgs/development/ocaml-modules/wtf8/default.nix
index bc071f9305f8..456fe129c8b1 100644
--- a/pkgs/development/ocaml-modules/wtf8/default.nix
+++ b/pkgs/development/ocaml-modules/wtf8/default.nix
@@ -6,7 +6,7 @@ buildDunePackage rec {
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.02";
+  minimalOCamlVersion = "4.02";
 
   src = fetchurl {
     url = "https://github.com/flowtype/ocaml-${pname}/releases/download/v${version}/${pname}-v${version}.tbz";
diff --git a/pkgs/development/python-modules/django-types/default.nix b/pkgs/development/python-modules/django-types/default.nix
index e2520f4026fa..523e155a68c5 100644
--- a/pkgs/development/python-modules/django-types/default.nix
+++ b/pkgs/development/python-modules/django-types/default.nix
@@ -25,6 +25,6 @@ buildPythonPackage rec {
     description = "Type stubs for Django";
     homepage = "https://github.com/sbdchd/django-types";
     license = licenses.mit;
-    maintainers = with maintainers; [ thubrecht ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/dvclive/default.nix b/pkgs/development/python-modules/dvclive/default.nix
index 33adbdf07a08..45cdd3c924d2 100644
--- a/pkgs/development/python-modules/dvclive/default.nix
+++ b/pkgs/development/python-modules/dvclive/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "dvclive";
-  version = "3.46.0";
+  version = "3.46.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvclive";
     rev = "refs/tags/${version}";
-    hash = "sha256-yIViKlkCdoG2vSZdScL38fZd9musLRKzBd9wSR6lJdk=";
+    hash = "sha256-ifr8gsGSOIBPC07JcFcV97yV4Io5J2uiMf2ucmySiWc=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/hocr-tools/default.nix b/pkgs/development/python-modules/hocr-tools/default.nix
index 609590b48623..40d2653d6c0d 100644
--- a/pkgs/development/python-modules/hocr-tools/default.nix
+++ b/pkgs/development/python-modules/hocr-tools/default.nix
@@ -32,6 +32,6 @@ buildPythonPackage rec {
 Tools for manipulating and evaluating the hOCR format for representing multi-lingual OCR results by embedding them into HTML";
     homepage = "https://github.com/tmbdev/hocr-tools";
     license = licenses.asl20;
-    maintainers = [ maintainers.kiwi ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/loadcredential/default.nix b/pkgs/development/python-modules/loadcredential/default.nix
deleted file mode 100644
index 239f9ac16175..000000000000
--- a/pkgs/development/python-modules/loadcredential/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-  wheel,
-}:
-
-buildPythonPackage rec {
-  pname = "loadcredential";
-  version = "1.1";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "Tom-Hubrecht";
-    repo = "loadcredential";
-    rev = "v${version}";
-    hash = "sha256-GXpMqGLDmDnTGa9cBYe0CP3Evm5sQ3AK9u6k3mLAW34=";
-  };
-
-  build-system = [
-    setuptools
-    wheel
-  ];
-
-  pythonImportsCheck = [ "loadcredential" ];
-
-  meta = {
-    description = "Simple python package to read credentials passed through systemd's LoadCredential, with a fallback on env variables ";
-    homepage = "https://github.com/Tom-Hubrecht/loadcredential";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ thubrecht ];
-  };
-}
diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix
index 81157ed9d23e..09321eb17d67 100644
--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.19.7";
+  version = "1.19.8";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gn8YTnCAmAcmQxpgtitk2eRy3spveuU0peeHu/iSnCE=";
+    hash = "sha256-CErC2Pwdw8CzV423uToysGaz92cBNyO3tLLuLozc0MU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index da509f319fab..b9b961e6c9c4 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -100,7 +100,6 @@ buildPythonPackage rec {
       mit
     ];
     maintainers = with maintainers; [
-      kiwi
       dotlambda
     ];
     changelog = "https://github.com/ocrmypdf/OCRmyPDF/blob/${src.rev}/docs/release_notes.rst";
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index c327e2e6df34..5bd009c93438 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -87,10 +87,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/pikepdf/pikepdf";
     description = "Read and write PDFs with Python, powered by qpdf";
     license = licenses.mpl20;
-    maintainers = with maintainers; [
-      kiwi
-      dotlambda
-    ];
+    maintainers = with maintainers; [ dotlambda ];
     changelog = "https://github.com/pikepdf/pikepdf/blob/${src.rev}/docs/releasenotes/version${lib.versions.major version}.rst";
   };
 }
diff --git a/pkgs/development/python-modules/pynws/default.nix b/pkgs/development/python-modules/pynws/default.nix
index c99595ee2570..a9e5e959e53d 100644
--- a/pkgs/development/python-modules/pynws/default.nix
+++ b/pkgs/development/python-modules/pynws/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pynws";
-  version = "1.8.1";
+  version = "1.8.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pynws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gC5IOW5sejXigBKfxLst8MwU/IkqSQrMZhmd4eza++s=";
+    hash = "sha256-3QKdZ7hg7HfQ56xHbkhXCtlBq4JCwfXdZiTctI3OVl0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix
index 2fba1b0b779f..88aa722c89b8 100644
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@@ -12,6 +12,7 @@
   pythonOlder,
   requests,
   requests-pkcs12,
+  requests-toolbelt,
   responses,
   restfly,
   semver,
@@ -21,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "pytenable";
-  version = "1.4.22";
+  version = "1.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,7 +31,7 @@ buildPythonPackage rec {
     owner = "tenable";
     repo = "pyTenable";
     rev = "refs/tags/${version}";
-    hash = "sha256-acMafLlO0yGEnW+0XeBWUpDWvOPFAB4RK/XyAb2JbPw=";
+    hash = "sha256-uLZ1TQx5awHOOF+IR3aWTwwYTd71O/V+EHaDrb1LAXU=";
   };
 
   build-system = [ setuptools ];
@@ -41,6 +42,7 @@ buildPythonPackage rec {
     python-box
     python-dateutil
     requests
+    requests-toolbelt
     restfly
     semver
     typing-extensions
diff --git a/pkgs/development/python-modules/pytest-helpers-namespace/default.nix b/pkgs/development/python-modules/pytest-helpers-namespace/default.nix
index 45bf7c67c5ca..ced0389f2887 100644
--- a/pkgs/development/python-modules/pytest-helpers-namespace/default.nix
+++ b/pkgs/development/python-modules/pytest-helpers-namespace/default.nix
@@ -34,6 +34,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/saltstack/pytest-helpers-namespace";
     description = "PyTest Helpers Namespace";
     license = licenses.asl20;
-    maintainers = [ maintainers.kiwi ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/python-digitalocean/default.nix b/pkgs/development/python-modules/python-digitalocean/default.nix
index c0ab09542d95..4597db497fb9 100644
--- a/pkgs/development/python-modules/python-digitalocean/default.nix
+++ b/pkgs/development/python-modules/python-digitalocean/default.nix
@@ -50,9 +50,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/koalalorenzo/python-digitalocean";
     changelog = "https://github.com/koalalorenzo/python-digitalocean/releases/tag/v${version}";
     license = with licenses; [ lgpl3Only ];
-    maintainers = with maintainers; [
-      kiwi
-      teh
-    ];
+    maintainers = with maintainers; [ teh ];
   };
 }
diff --git a/pkgs/development/python-modules/python-xmp-toolkit/default.nix b/pkgs/development/python-modules/python-xmp-toolkit/default.nix
index e9541adb6a5d..612194ae7536 100644
--- a/pkgs/development/python-modules/python-xmp-toolkit/default.nix
+++ b/pkgs/development/python-modules/python-xmp-toolkit/default.nix
@@ -46,6 +46,6 @@ buildPythonPackage {
     homepage = "https://github.com/python-xmp-toolkit/python-xmp-toolkit";
     description = "Python XMP Toolkit for working with metadata";
     license = licenses.bsd3;
-    maintainers = [ maintainers.kiwi ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/ruffus/default.nix b/pkgs/development/python-modules/ruffus/default.nix
index 37ff8340634a..44a1b8939795 100644
--- a/pkgs/development/python-modules/ruffus/default.nix
+++ b/pkgs/development/python-modules/ruffus/default.nix
@@ -44,6 +44,6 @@ buildPythonPackage rec {
     description = "Light-weight Python Computational Pipeline Management";
     homepage = "http://www.ruffus.org.uk";
     license = licenses.mit;
-    maintainers = [ maintainers.kiwi ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/testcontainers/default.nix b/pkgs/development/python-modules/testcontainers/default.nix
index 362a4f36b94e..dd59406a7dfd 100644
--- a/pkgs/development/python-modules/testcontainers/default.nix
+++ b/pkgs/development/python-modules/testcontainers/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "testcontainers";
-  version = "4.5.1";
+  version = "4.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "testcontainers";
     repo = "testcontainers-python";
     rev = "refs/tags/testcontainers-v${version}";
-    hash = "sha256-7QlT3ibSUDeC+aWi2MCagLkomXG3/VU1xHQ7Xgoh/Pw=";
+    hash = "sha256-jTTpeIWZD61UZkQWW5q/c0vgViT76qjDXw4qXfNqDnA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/zha/default.nix b/pkgs/development/python-modules/zha/default.nix
index f8ba88bdf0c6..f28b72ac0372 100644
--- a/pkgs/development/python-modules/zha/default.nix
+++ b/pkgs/development/python-modules/zha/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "zha";
-  version = "0.0.9";
+  version = "0.0.13";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha";
     rev = "refs/tags/${version}";
-    hash = "sha256-wQY355KUsN91y3lgj9k3ceeHb6a0faxiguIFK4ZwPIE=";
+    hash = "sha256-hcHj5bOz/zyH/Wfzncc8D2+7diIO2u4r5hXfX3Rqw/Q=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix b/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix
deleted file mode 100644
index 9981ac8b0388..000000000000
--- a/pkgs/development/tools/analysis/uefi-firmware-parser/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ lib, python3, fetchFromGitHub }:
-
-with python3.pkgs;
-
-buildPythonApplication rec {
-  pname = "uefi-firmware-parser";
-  version = "1.8";
-
-  # Version 1.8 is not published on pypi
-  src = fetchFromGitHub {
-    owner = "theopolis";
-    repo = "uefi-firmware-parser";
-    rev = "v${version}";
-    sha256 = "1yn9vi91j1yxkn0icdnjhgl0qrqqkzyhccj39af4f19q1gdw995l";
-  };
-
-  meta = with lib; {
-    homepage = "https://github.com/theopolis/uefi-firmware-parser/";
-    description = "Parse BIOS/Intel ME/UEFI firmware related structures: Volumes, FileSystems, Files, etc";
-    mainProgram = "uefi-firmware-parser";
-    # MIT + license headers in some files
-    license = with licenses; [
-      mit
-      zlib         # uefi_firmware/me.py
-      bsd2         # uefi_firmware/compression/Tiano/**/*
-      publicDomain # uefi_firmware/compression/LZMA/SDK/C/*
-    ];
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
-    maintainers = [ maintainers.samueldr ];
-  };
-}
diff --git a/pkgs/development/tools/djhtml/default.nix b/pkgs/development/tools/djhtml/default.nix
index 4e4342f36fb6..5d654b58a1ef 100644
--- a/pkgs/development/tools/djhtml/default.nix
+++ b/pkgs/development/tools/djhtml/default.nix
@@ -23,6 +23,6 @@ buildPythonApplication rec {
     homepage = "https://github.com/rtts/djhtml";
     description = "Django/Jinja template indenter";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ thubrecht ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/tools/ocaml/dune/3.nix b/pkgs/development/tools/ocaml/dune/3.nix
index 58a9cd791af9..f2c00e16c9e7 100644
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@@ -6,11 +6,11 @@ else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "3.15.3";
+  version = "3.16.0";
 
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    hash = "sha256-PCfHZ2QUBW8DaKcf3GcNKwpZiYCQx4obaCMJhOW+txM=";
+    hash = "sha256-VIHd55GMoxIeAsNNdDOfc0sy1Yg++4wbgFZHHnT5vaY=";
   };
 
   nativeBuildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/tools/ruff/Cargo.lock b/pkgs/development/tools/ruff/Cargo.lock
index 4f31226a3652..6d910ad0ab5a 100644
--- a/pkgs/development/tools/ruff/Cargo.lock
+++ b/pkgs/development/tools/ruff/Cargo.lock
@@ -305,9 +305,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.6"
+version = "4.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9689a29b593160de5bc4aacab7b5d54fb52231de70122626c178e6a368994c7"
+checksum = "5db83dced34638ad474f39f250d7fea9598bdd239eaced1bdf45d597da0f433f"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -315,9 +315,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.6"
+version = "4.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e5387378c84f6faa26890ebf9f0a92989f8873d4d380467bcd0d8d8620424df"
+checksum = "f7e204572485eb3fbf28f871612191521df159bc3e15a9f5064c66dba3a8c05f"
 dependencies = [
  "anstream",
  "anstyle",
@@ -691,6 +691,17 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "displaydoc"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "487585f4d0c6655fe74905e2504d8ad6908e4db67f744eb140876906c2f3175d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "drop_bomb"
 version = "0.1.5"
@@ -966,6 +977,124 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_collections"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_locid_transform_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e"
+
+[[package]]
+name = "icu_normalizer"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516"
+
+[[package]]
+name = "icu_properties"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f8ac670d7422d7f76b32e17a5db556510825b29ec9154f235977c9caba61036"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locid_transform",
+ "icu_properties_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569"
+
+[[package]]
+name = "icu_provider"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_provider_macros",
+ "stable_deref_trait",
+ "tinystr",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_provider_macros"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -974,12 +1103,14 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "idna"
-version = "0.5.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
+checksum = "4716a3a0933a1d01c2f72450e89596eb51dd34ef3c211ccd875acdf1f8fe47ed"
 dependencies = [
- "unicode-bidi",
- "unicode-normalization",
+ "icu_normalizer",
+ "icu_properties",
+ "smallvec",
+ "utf8_iter",
 ]
 
 [[package]]
@@ -1290,6 +1421,12 @@ version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
+[[package]]
+name = "litemap"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "643cb0b8d4fcc284004d5fd0d67ccf61dfffadb7f75e1e71bc420f4688a3a704"
+
 [[package]]
 name = "lock_api"
 version = "0.4.11"
@@ -1353,9 +1490,9 @@ checksum = "540f1c43aed89909c0cc0cc604e3bb2f7e7a341a3728a9e6cfe760e733cd11ed"
 
 [[package]]
 name = "memchr"
-version = "2.7.2"
+version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
 
 [[package]]
 name = "mimalloc"
@@ -1841,6 +1978,7 @@ dependencies = [
  "notify",
  "parking_lot",
  "rayon",
+ "red_knot_python_semantic",
  "ruff_index",
  "ruff_notebook",
  "ruff_python_ast",
@@ -1857,6 +1995,28 @@ dependencies = [
  "zip",
 ]
 
+[[package]]
+name = "red_knot_python_semantic"
+version = "0.0.0"
+dependencies = [
+ "anyhow",
+ "bitflags 2.5.0",
+ "hashbrown 0.14.5",
+ "indexmap",
+ "ruff_db",
+ "ruff_index",
+ "ruff_python_ast",
+ "ruff_python_parser",
+ "ruff_python_stdlib",
+ "ruff_text_size",
+ "rustc-hash",
+ "salsa-2022",
+ "smallvec",
+ "smol_str",
+ "tempfile",
+ "tracing",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.4.1"
@@ -1938,7 +2098,7 @@ dependencies = [
 
 [[package]]
 name = "ruff"
-version = "0.4.9"
+version = "0.4.10"
 dependencies = [
  "anyhow",
  "argfile",
@@ -2029,6 +2189,8 @@ dependencies = [
  "countme",
  "dashmap",
  "filetime",
+ "itertools 0.13.0",
+ "once_cell",
  "ruff_python_ast",
  "ruff_python_parser",
  "ruff_source_file",
@@ -2036,6 +2198,7 @@ dependencies = [
  "rustc-hash",
  "salsa-2022",
  "tracing",
+ "zip",
 ]
 
 [[package]]
@@ -2115,7 +2278,7 @@ dependencies = [
 
 [[package]]
 name = "ruff_linter"
-version = "0.4.9"
+version = "0.4.10"
 dependencies = [
  "aho-corasick",
  "annotate-snippets 0.9.2",
@@ -2333,7 +2496,6 @@ version = "0.0.0"
 dependencies = [
  "bitflags 2.5.0",
  "is-macro",
- "ruff_db",
  "ruff_index",
  "ruff_python_ast",
  "ruff_python_parser",
@@ -2341,8 +2503,6 @@ dependencies = [
  "ruff_source_file",
  "ruff_text_size",
  "rustc-hash",
- "salsa-2022",
- "tracing",
 ]
 
 [[package]]
@@ -2795,6 +2955,12 @@ version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
@@ -2872,6 +3038,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "synstructure"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.10.1"
@@ -2990,6 +3167,16 @@ dependencies = [
  "tikv-jemalloc-sys",
 ]
 
+[[package]]
+name = "tinystr"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
 [[package]]
 name = "tinytemplate"
 version = "1.2.1"
@@ -3183,12 +3370,6 @@ dependencies = [
  "unic-common",
 ]
 
-[[package]]
-name = "unicode-bidi"
-version = "0.3.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.12"
@@ -3263,9 +3444,9 @@ dependencies = [
 
 [[package]]
 name = "url"
-version = "2.5.0"
+version = "2.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
+checksum = "f7c25da092f0a868cdf09e8674cd3b7ef3a7d92a24253e663a2fb85e2496de56"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -3273,6 +3454,18 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "utf8parse"
 version = "0.2.1"
@@ -3688,6 +3881,18 @@ version = "0.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d135d17ab770252ad95e9a872d365cf3090e3be864a34ab46f48555993efc904"
 
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
+[[package]]
+name = "writeable"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
+
 [[package]]
 name = "yansi"
 version = "0.5.1"
@@ -3703,6 +3908,30 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "yoke"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c5b1314b079b0930c31e3af543d8ee1757b1951ae1e1565ec704403a7240ca5"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+ "synstructure",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.7.32"
@@ -3723,12 +3952,55 @@ dependencies = [
  "syn 2.0.66",
 ]
 
+[[package]]
+name = "zerofrom"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91ec111ce797d0e0784a1116d0ddcdbea84322cd79e5d5ad173daeba4f93ab55"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ea7b4a3637ea8669cedf0f1fd5c286a17f3de97b8dd5a70a6c167a1730e63a5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+ "synstructure",
+]
+
 [[package]]
 name = "zeroize"
 version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
 
+[[package]]
+name = "zerovec"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb2cc8827d6c0994478a15c53f374f46fbd41bea663d809b14744bc42e6b109c"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97cf56601ee5052b4417d90c8755c6683473c926039908196cf35d99f893ebe7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "zip"
 version = "0.6.6"
@@ -3762,9 +4034,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.10+zstd.1.5.6"
+version = "2.0.11+zstd.1.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c253a4914af5bafc8fa8c86ee400827e83cf6ec01195ec1f1ed8441bf00d65aa"
+checksum = "75652c55c0b6f3e6f12eb786fe1bc960396bf05a1eb3bf1f3691c3610ac2e6d4"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index 75285de4612b..a58eadf632ff 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.4.9";
+  version = "0.4.10";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     rev = "refs/tags/v${version}";
-    hash = "sha256-40ZXD52d/kZNkSZ64H/s/OiiU99IiblGfYa4KmU8xD4=";
+    hash = "sha256-FRBuvXtnbxRWoI0f8SM0U0Z5TRyX5Tbgq3d34Oh2bG4=";
   };
 
   cargoLock = {
diff --git a/pkgs/misc/cups/drivers/hll2390dw-cups/default.nix b/pkgs/misc/cups/drivers/hll2390dw-cups/default.nix
deleted file mode 100644
index bd9974d5b644..000000000000
--- a/pkgs/misc/cups/drivers/hll2390dw-cups/default.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{ lib, stdenv, fetchurl, makeWrapper
-, cups
-, dpkg
-, a2ps, ghostscript, gnugrep, gnused, coreutils, file, perl, which
-}:
-
-stdenv.mkDerivation rec {
-  pname = "hll2390dw-cups";
-  version = "4.0.0-1";
-
-  src = fetchurl {
-    # The i386 part is a lie. There are x86, x86_64 and armv7l drivers.
-    # Though this builds only supports x86_64 for now.
-    url = "https://download.brother.com/welcome/dlf103579/hll2390dwpdrv-${version}.i386.deb";
-    sha256 = "0w8rxh1sa5amxr87qmzs4m2p06b1b36wn2q127mg427sbkh1rwni";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ cups ghostscript dpkg a2ps ];
-
-  dontUnpack = true;
-
-  installPhase = ''
-    dpkg-deb -x $src $out
-
-    substituteInPlace $out/opt/brother/Printers/HLL2390DW/lpd/lpdfilter \
-      --replace /opt "$out/opt" \
-      --replace /usr/bin/perl ${perl}/bin/perl \
-      --replace "BR_PRT_PATH =~" "BR_PRT_PATH = \"$out\"; #" \
-      --replace "PRINTER =~" "PRINTER = \"HLL2390DW\"; #"
-
-    # FIXME : Allow i686 and armv7l variations to be setup instead.
-    _PLAT=x86_64
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-      $out/opt/brother/Printers/HLL2390DW/lpd/$_PLAT/brprintconflsr3
-    patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-      $out/opt/brother/Printers/HLL2390DW/lpd/$_PLAT/rawtobr3
-    ln -s $out/opt/brother/Printers/HLL2390DW/lpd/$_PLAT/brprintconflsr3 $out/opt/brother/Printers/HLL2390DW/lpd/brprintconflsr3
-    ln -s $out/opt/brother/Printers/HLL2390DW/lpd/$_PLAT/rawtobr3 $out/opt/brother/Printers/HLL2390DW/lpd/rawtobr3
-
-    for f in \
-      $out/opt/brother/Printers/HLL2390DW/cupswrapper/lpdwrapper \
-      $out/opt/brother/Printers/HLL2390DW/cupswrapper/paperconfigml2 \
-    ; do
-      #substituteInPlace $f \
-      wrapProgram $f \
-        --prefix PATH : ${lib.makeBinPath [
-          coreutils ghostscript gnugrep gnused
-        ]}
-    done
-
-    mkdir -p $out/lib/cups/filter/
-    ln -s $out/opt/brother/Printers/HLL2390DW/lpd/lpdfilter $out/lib/cups/filter/brother_lpdwrapper_HLL2390DW
-
-    mkdir -p $out/share/cups/model
-    ln -s $out/opt/brother/Printers/HLL2390DW/cupswrapper/brother-HLL2390DW-cups-en.ppd $out/share/cups/model/
-
-    wrapProgram $out/opt/brother/Printers/HLL2390DW/lpd/lpdfilter \
-      --prefix PATH ":" ${ lib.makeBinPath [ ghostscript a2ps file gnused gnugrep coreutils which ] }
-    '';
-
-  meta = with lib; {
-    homepage = "http://www.brother.com/";
-    description = "Brother HL-L2390DW combined print driver";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    platforms = [ "x86_64-linux" ];
-    downloadPage = "http://support.brother.com/g/b/downloadlist.aspx?c=us_ot&lang=en&prod=hll2390dw_us&os=128";
-    maintainers = [ maintainers.samueldr ];
-  };
-}
-
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 837070e65614..95fadc40da5f 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -133,7 +133,7 @@ let
       homepage = "https://www.denx.de/wiki/U-Boot/";
       description = "Boot loader for embedded systems";
       license = licenses.gpl2;
-      maintainers = with maintainers; [ bartsch dezgeg samueldr lopsided98 ];
+      maintainers = with maintainers; [ bartsch dezgeg lopsided98 ];
     } // extraMeta;
   } // removeAttrs args [ "extraMeta" "pythonScriptsToInstall" ]));
 in {
diff --git a/pkgs/os-specific/bsd/freebsd/default.nix b/pkgs/os-specific/bsd/freebsd/default.nix
index cfe6080b020a..e56c70c1d32d 100644
--- a/pkgs/os-specific/bsd/freebsd/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/default.nix
@@ -3,6 +3,7 @@
   makeScopeWithSplicing',
   generateSplicesForMkScope,
   callPackage,
+  crossLibcStdenv,
   attributePathToSplice ? [ "freebsd" ],
   branch ? "release/14.0.0",
 }:
@@ -23,30 +24,41 @@ let
       Branches can be selected by overriding the `branch` attribute on the freebsd package set.
     '';
 
-  # we do not include the branch in the splice here because the branch
-  # parameter to this file will only ever take on one value - more values
-  # are provided through overrides.
-  otherSplices = generateSplicesForMkScope attributePathToSplice;
+  # `./package-set.nix` should never know the name of the package set we
+  # are constructing; just this function is allowed to know that. This
+  # is why we:
+  #
+  #  - do the splicing for cross compilation here
+  #
+  #  - construct the *anonymized* `buildFreebsd` attribute to be passed
+  #    to `./package-set.nix`.
+  callFreeBSDWithAttrs =
+    extraArgs:
+    let
+      # we do not include the branch in the splice here because the branch
+      # parameter to this file will only ever take on one value - more values
+      # are provided through overrides.
+      otherSplices = generateSplicesForMkScope attributePathToSplice;
+    in
+    makeScopeWithSplicing' {
+      inherit otherSplices;
+      f =
+        self:
+        {
+          inherit branch;
+        }
+        // callPackage ./package-set.nix (
+          {
+            sourceData = versions.${self.branch} or (throw (badBranchError self.branch));
+            versionData = self.sourceData.version;
+            buildFreebsd = otherSplices.selfBuildHost;
+            patchesRoot = ./patches + "/${self.versionData.revision}";
+          }
+          // extraArgs
+        ) self;
+    };
 in
-# `./package-set.nix` should never know the name of the package set we
-# are constructing; just this function is allowed to know that. This
-# is why we:
-#
-#  - do the splicing for cross compilation here
-#
-#  - construct the *anonymized* `buildFreebsd` attribute to be passed
-#    to `./package-set.nix`.
-makeScopeWithSplicing' {
-  inherit otherSplices;
-  f =
-    self:
-    {
-      inherit branch;
-    }
-    // callPackage ./package-set.nix ({
-      sourceData = versions.${self.branch} or (throw (badBranchError self.branch));
-      versionData = self.sourceData.version;
-      buildFreebsd = otherSplices.selfBuildHost;
-      patchesRoot = ./patches + "/${self.versionData.revision}";
-    }) self;
+{
+  freebsd = callFreeBSDWithAttrs { };
+  freebsdCross = callFreeBSDWithAttrs { stdenv = crossLibcStdenv; };
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
index e20b94336d57..12f2c9407e3c 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   stdenvNoCC,
-  stdenvNoLibc,
+  stdenvNoLibs,
   overrideCC,
   buildPackages,
   versionData,
@@ -28,7 +28,7 @@ lib.makeOverridable (
       if attrs.noCC or false then
         stdenvNoCC
       else if attrs.noLibc or false then
-        stdenvNoLibc
+        stdenvNoLibs
       else if attrs.noLibcxx or false then
         overrideCC stdenv buildPackages.llvmPackages.clangNoLibcxx
       else
@@ -58,9 +58,12 @@ lib.makeOverridable (
 
       HOST_SH = stdenv'.shell;
 
+      # Since STRIP below is the flag
+      STRIPBIN = "${stdenv.cc.bintools.targetPrefix}strip";
+
       makeFlags = [
         "STRIP=-s" # flag to install, not command
-      ] ++ lib.optional (!stdenv'.hostPlatform.isFreeBSD) "MK_WERROR=no";
+      ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "MK_WERROR=no";
 
       # amd64 not x86_64 for this on unlike NetBSD
       MACHINE_ARCH = freebsd-lib.mkBsdArch stdenv';
@@ -88,9 +91,6 @@ lib.makeOverridable (
     // lib.optionalAttrs stdenv'.hasCC {
       # TODO should CC wrapper set this?
       CPP = "${stdenv'.cc.targetPrefix}cpp";
-
-      # Since STRIP in `makeFlags` has to be a flag, not the binary itself
-      STRIPBIN = "${stdenv'.cc.bintools.targetPrefix}strip";
     }
     // lib.optionalAttrs stdenv'.isDarwin { MKRELRO = "no"; }
     // lib.optionalAttrs (stdenv'.cc.isClang or false) {
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 7440666b4d79..5f5ec212f269 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   lib,
   stdenvNoCC,
   makeScopeWithSplicing',
@@ -20,9 +21,7 @@ makeScopeWithSplicing' {
 
       defaultMakeFlags = [
         "MKSOFTFLOAT=${
-          if
-            stdenvNoCC.hostPlatform.gcc.float or (stdenvNoCC.hostPlatform.parsed.abi.float or "hard") == "soft"
-          then
+          if stdenv.hostPlatform.gcc.float or (stdenv.hostPlatform.parsed.abi.float or "hard") == "soft" then
             "yes"
           else
             "no"
@@ -37,6 +36,7 @@ makeScopeWithSplicing' {
       # because of the splices.
 
       mkDerivation = self.callPackage ./pkgs/mkDerivation.nix {
+        inherit stdenv stdenvNoCC;
         inherit (buildPackages.netbsd)
           netbsdSetupHook
           makeMinimal
@@ -129,7 +129,7 @@ makeScopeWithSplicing' {
       libpthread-headers = self.callPackage ./pkgs/libpthread/headers.nix { };
 
       csu = self.callPackage ./pkgs/csu.nix {
-        inherit (self) headers sys-headers ld_elf_so;
+        inherit (self) headers sys ld_elf_so;
         inherit (buildPackages.netbsd)
           netbsdSetupHook
           makeMinimal
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix b/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix
index ea78f338c533..a0d7ca419c1c 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/csu.nix
@@ -16,12 +16,11 @@
   statHook,
   rsync,
   headers,
-  sys-headers,
+  sys,
   ld_elf_so,
 }:
 
 mkDerivation {
-  noLibc = true;
   path = "lib/csu";
   meta.platforms = lib.platforms.netbsd;
   nativeBuildInputs = [
@@ -42,7 +41,7 @@ mkDerivation {
   ];
   buildInputs = [ headers ];
   extraPaths = [
-    sys-headers.path
+    sys.path
     ld_elf_so.path
   ];
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/include.nix b/pkgs/os-specific/bsd/netbsd/pkgs/include.nix
index a43a93847b23..6df34b96095e 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/include.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/include.nix
@@ -15,7 +15,6 @@
 }:
 
 mkDerivation {
-  noLibc = true;
   path = "include";
   nativeBuildInputs = [
     bsdSetupHook
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix b/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix
index 4116312b9625..7f25ce097ff0 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/ld_elf_so.nix
@@ -6,7 +6,6 @@
 }:
 
 mkDerivation {
-  noLibc = true;
   path = "libexec/ld.elf_so";
   meta.platforms = lib.platforms.netbsd;
   LIBC_PIC = "${libc}/lib/libc_pic.a";
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
index d6b14445acd4..cf71857776d8 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
@@ -24,7 +24,6 @@
 }:
 
 mkDerivation {
-  noLibc = true;
   path = "lib/libc";
   USE_FORT = "yes";
   MKPROFILE = "no";
@@ -95,8 +94,5 @@ mkDerivation {
     make -C $BSDSRCDIR/lib/libcrypt $makeFlags
     make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
   '';
-  postPatch = ''
-    sed -i 's,/usr\(/include/sys/syscall.h\),${headers}\1,g' \
-      $BSDSRCDIR/lib/{libc,librt}/sys/Makefile.inc
-  '';
+  inherit (librt) postPatch;
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix b/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix
index 87cd3092f1b1..4e4bf0bc5ac4 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/librt.nix
@@ -9,5 +9,8 @@ mkDerivation {
   path = "lib/librt";
   meta.platforms = lib.platforms.netbsd;
   extraPaths = [ libc.path ] ++ libc.extraPaths;
-  inherit (libc) postPatch;
+  postPatch = ''
+    sed -i 's,/usr\(/include/sys/syscall.h\),${headers}\1,g' \
+      $BSDSRCDIR/lib/{libc,librt}/sys/Makefile.inc
+  '';
 }
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix
index 5fb082e9d17f..f4f103087587 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/mkDerivation.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   stdenvNoCC,
-  stdenvNoLibc,
+  crossLibcStdenv,
   runCommand,
   rsync,
   source,
@@ -23,13 +23,7 @@
 lib.makeOverridable (
   attrs:
   let
-    stdenv' =
-      if attrs.noCC or false then
-        stdenvNoCC
-      else if attrs.noLibc or false then
-        stdenvNoLibc
-      else
-        stdenv;
+    stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
   in
   stdenv'.mkDerivation (
     rec {
diff --git a/pkgs/os-specific/bsd/openbsd/default.nix b/pkgs/os-specific/bsd/openbsd/default.nix
index bfc88f097865..00dba195b92f 100644
--- a/pkgs/os-specific/bsd/openbsd/default.nix
+++ b/pkgs/os-specific/bsd/openbsd/default.nix
@@ -1,17 +1,16 @@
 {
+  stdenv,
   lib,
+  stdenvNoCC,
   makeScopeWithSplicing',
   generateSplicesForMkScope,
+  pkgs,
   buildPackages,
+  netbsd,
 }:
 
-let
-  otherSplices = generateSplicesForMkScope "openbsd";
-  buildOpenbsd = otherSplices.selfBuildHost;
-in
-
 makeScopeWithSplicing' {
-  inherit otherSplices;
+  otherSplices = generateSplicesForMkScope "openbsd";
   f = (
     self:
     lib.packagesFromDirectoryRecursive {
@@ -20,8 +19,8 @@ makeScopeWithSplicing' {
     }
     // {
       libc = self.callPackage ./pkgs/libc/package.nix {
-        inherit (self) csu include;
-        inherit (buildOpenbsd) makeMinimal;
+        inherit (self) csu include lorder;
+        inherit (buildPackages.openbsd) makeMinimal;
         inherit (buildPackages.netbsd)
           install
           gencat
@@ -31,16 +30,16 @@ makeScopeWithSplicing' {
       };
       makeMinimal = buildPackages.netbsd.makeMinimal.override { inherit (self) make-rules; };
       mkDerivation = self.callPackage ./pkgs/mkDerivation.nix {
+        inherit stdenv;
         inherit (buildPackages.netbsd) install;
-        inherit (buildPackages.buildPackages) rsync;
       };
       include = self.callPackage ./pkgs/include/package.nix {
-        inherit (buildOpenbsd) makeMinimal;
+        inherit (buildPackages.openbsd) makeMinimal;
         inherit (buildPackages.netbsd) install rpcgen mtree;
       };
       csu = self.callPackage ./pkgs/csu.nix {
         inherit (self) include;
-        inherit (buildOpenbsd) makeMinimal;
+        inherit (buildPackages.openbsd) makeMinimal;
         inherit (buildPackages.netbsd) install;
       };
       make-rules = self.callPackage ./pkgs/make-rules/package.nix { };
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix b/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix
index 03a718042568..a2b2153a729b 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix
@@ -9,7 +9,6 @@
 }:
 
 mkDerivation {
-  noLibc = true;
   path = "lib/csu";
   nativeBuildInputs = [
     bsdSetupHook
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/libc/package.nix b/pkgs/os-specific/bsd/openbsd/pkgs/libc/package.nix
index 03fd256eee9d..cf233c827840 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/libc/package.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/libc/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  stdenvNoLibc,
+  stdenv,
   mkDerivation,
   bsdSetupHook,
   openbsdSetupHook,
@@ -10,6 +10,7 @@
   byacc,
   gencat,
   rpcgen,
+  lorder,
   csu,
   include,
   ctags,
@@ -18,8 +19,7 @@
   fetchpatch,
 }:
 
-mkDerivation {
-  noLibc = true;
+mkDerivation rec {
   pname = "libc";
   path = "lib/libc";
   extraPaths = [
@@ -53,6 +53,7 @@ mkDerivation {
     gencat
     rpcgen
     ctags
+    lorder
     tsort
   ];
 
@@ -68,9 +69,7 @@ mkDerivation {
 
   # Suppress lld >= 16 undefined version errors
   # https://github.com/freebsd/freebsd-src/commit/2ba84b4bcdd6012e8cfbf8a0d060a4438623a638
-  env.NIX_LDFLAGS = lib.optionalString (
-    stdenvNoLibc.hostPlatform.linker == "lld"
-  ) "--undefined-version";
+  env.NIX_LDFLAGS = lib.optionalString (stdenv.hostPlatform.linker == "lld") "--undefined-version";
 
   makeFlags = [
     "STRIP=-s" # flag to install, not command
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/lorder.nix b/pkgs/os-specific/bsd/openbsd/pkgs/lorder.nix
index c923a8431768..25ff1fcbd14f 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/lorder.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/lorder.nix
@@ -8,7 +8,6 @@
 }:
 
 mkDerivation {
-  noCC = true;
   path = "usr.bin/lorder";
   nativeBuildInputs = [
     bsdSetupHook
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix b/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix
index fefa1136eb76..1e7c705c0dfd 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix
@@ -2,6 +2,7 @@
   fetchpatch,
   lib,
   mkDerivation,
+  stdenv,
 }:
 
 mkDerivation {
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix
index 5d7b67502cf7..6c5bc5cd1719 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   stdenvNoCC,
-  stdenvNoLibc,
   runCommand,
   rsync,
   source,
@@ -15,13 +14,7 @@
 lib.makeOverridable (
   attrs:
   let
-    stdenv' =
-      if attrs.noCC or false then
-        stdenvNoCC
-      else if attrs.noLibc or false then
-        stdenvNoLibc
-      else
-        stdenv;
+    stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
   in
   stdenv'.mkDerivation (
     rec {
@@ -50,6 +43,9 @@ lib.makeOverridable (
 
       HOST_SH = stdenv'.shell;
 
+      # Since STRIP below is the flag
+      STRIPBIN = "${stdenv.cc.bintools.targetPrefix}strip";
+
       makeFlags = [
         "STRIP=-s" # flag to install, not command
         "-B"
@@ -85,9 +81,6 @@ lib.makeOverridable (
     // lib.optionalAttrs stdenv'.hasCC {
       # TODO should CC wrapper set this?
       CPP = "${stdenv'.cc.targetPrefix}cpp";
-
-      # Since STRIP in `makeFlags` has to be a flag, not the binary itself
-      STRIPBIN = "${stdenv'.cc.bintools.targetPrefix}strip";
     }
     // lib.optionalAttrs (attrs.headersOnly or false) {
       installPhase = "includesPhase";
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix b/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
index 72c6f6235548..4ff7bf48b920 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
@@ -48,6 +48,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/raspberrypi/tools";
     license = licenses.bsd3;
     platforms = [ "armv6l-linux" "armv7l-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ samueldr ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/input-utils/default.nix b/pkgs/os-specific/linux/input-utils/default.nix
deleted file mode 100644
index 36a203a47c76..000000000000
--- a/pkgs/os-specific/linux/input-utils/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib, stdenv, fetchurl, linuxHeaders }:
-
-stdenv.mkDerivation rec {
-  pname = "input-utils";
-  version = "1.3";
-
-  src = fetchurl {
-    url = "https://www.kraxel.org/releases/input/input-${version}.tar.gz";
-    sha256 = "11w0pp20knx6qpgzmawdbk1nj2z3fzp8yd6nag6s8bcga16w6hli";
-  };
-
-  prePatch = ''
-    # Use proper include path for kernel include files.
-    substituteInPlace ./name.sh --replace "/usr/include/linux/" "${linuxHeaders}/include/linux/"
-    substituteInPlace ./lirc.sh --replace "/usr/include/linux/" "${linuxHeaders}/include/linux/"
-  '';
-
-  makeFlags = [
-    "prefix=$(out)"
-    "STRIP="
-  ];
-
-  meta = with lib; {
-    description = "Input layer utilities, includes lsinput";
-    homepage    = "https://www.kraxel.org/blog/linux/input/";
-    license     = licenses.gpl2;
-    maintainers = with maintainers; [ samueldr ];
-    platforms   = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 6023c6e82ff8..c1424d01f878 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -148,7 +148,7 @@ stdenv.mkDerivation {
     homepage = "https://www.syslinux.org/";
     description = "Lightweight bootloader";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.samueldr ];
+    maintainers = [ ];
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/windows/default.nix b/pkgs/os-specific/windows/default.nix
index 7b9bbcc52f79..234abcde1611 100644
--- a/pkgs/os-specific/windows/default.nix
+++ b/pkgs/os-specific/windows/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPackages
-, newScope, overrideCC, stdenvNoLibc, libcCross
+, newScope, overrideCC, crossLibcStdenv, libcCross
 }:
 
 lib.makeScope newScope (self: with self; {
@@ -14,11 +14,11 @@ lib.makeScope newScope (self: with self; {
   mingw_runtime = mingwrt;
 
   mingw_w64 = callPackage ./mingw-w64 {
-    stdenv = stdenvNoLibc;
+    stdenv = crossLibcStdenv;
   };
 
   # FIXME untested with llvmPackages_16 was using llvmPackages_8
-  crossThreadsStdenv = overrideCC stdenvNoLibc
+  crossThreadsStdenv = overrideCC crossLibcStdenv
     (if stdenv.hostPlatform.useLLVM or false
      then buildPackages.llvmPackages.clangNoLibcxx
      else buildPackages.gccWithoutTargetLibc.override (old: {
diff --git a/pkgs/os-specific/windows/mingw-w64/default.nix b/pkgs/os-specific/windows/mingw-w64/default.nix
index ba2b243a9408..706186c8e2f1 100644
--- a/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/pkgs/os-specific/windows/mingw-w64/default.nix
@@ -3,12 +3,18 @@
 , windows
 , fetchurl
 , autoreconfHook
-, mingw_w64_headers
 }:
 
-stdenv.mkDerivation {
+let
+  version = "11.0.1";
+in stdenv.mkDerivation {
   pname = "mingw-w64";
-  inherit (mingw_w64_headers) version src meta;
+  inherit version;
+
+  src = fetchurl {
+    url = "mirror://sourceforge/mingw-w64/mingw-w64-v${version}.tar.bz2";
+    hash = "sha256-P2a84Gnui+10OaGhPafLkaXmfqYXDyExesf1eUYl7hA=";
+  };
 
   outputs = [ "out" "dev" ];
 
@@ -24,4 +30,8 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ windows.mingw_w64_headers ];
   hardeningDisable = [ "stackprotector" "fortify" ];
+
+  meta = {
+    platforms = lib.platforms.windows;
+  };
 }
diff --git a/pkgs/os-specific/windows/mingw-w64/headers.nix b/pkgs/os-specific/windows/mingw-w64/headers.nix
index d5edaeaa2bd1..1fd27a8c4573 100644
--- a/pkgs/os-specific/windows/mingw-w64/headers.nix
+++ b/pkgs/os-specific/windows/mingw-w64/headers.nix
@@ -1,19 +1,11 @@
-{ lib, stdenvNoCC, fetchurl }:
+{ stdenvNoCC, mingw_w64 }:
 
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "mingw_w64-headers";
-  version = "11.0.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/mingw-w64/mingw-w64-v${finalAttrs.version}.tar.bz2";
-    hash = "sha256-P2a84Gnui+10OaGhPafLkaXmfqYXDyExesf1eUYl7hA=";
-  };
+stdenvNoCC.mkDerivation {
+  name = "${mingw_w64.name}-headers";
+  inherit (mingw_w64) src meta;
 
   preConfigure = ''
     cd mingw-w64-headers
   '';
 
-  meta = {
-    platforms = lib.platforms.windows;
-  };
-})
+}
diff --git a/pkgs/os-specific/windows/mingw-w64/pthreads.nix b/pkgs/os-specific/windows/mingw-w64/pthreads.nix
index 3c5fab4fa708..3b143efed1d7 100644
--- a/pkgs/os-specific/windows/mingw-w64/pthreads.nix
+++ b/pkgs/os-specific/windows/mingw-w64/pthreads.nix
@@ -1,8 +1,8 @@
-{ stdenv, mingw_w64_headers }:
+{ stdenv, mingw_w64 }:
 
 stdenv.mkDerivation {
-  pname = "mingw_w64-pthreads";
-  inherit (mingw_w64_headers) version src meta;
+  name = "${mingw_w64.name}-pthreads";
+  inherit (mingw_w64) src meta;
 
   configureFlags = [
     # Rustc require 'libpthread.a' when targeting 'x86_64-pc-windows-gnu'.
diff --git a/pkgs/servers/monitoring/consul-alerts/default.nix b/pkgs/servers/monitoring/consul-alerts/default.nix
index 3fbbf7f4cbd3..f50d30d3aa04 100644
--- a/pkgs/servers/monitoring/consul-alerts/default.nix
+++ b/pkgs/servers/monitoring/consul-alerts/default.nix
@@ -1,21 +1,24 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "consul-alerts";
   version = "0.6.0";
-  rev = "v${version}";
-
-  goPackagePath = "github.com/AcalephStorage/consul-alerts";
-
-  goDeps = ./deps.nix;
 
   src = fetchFromGitHub {
-    inherit rev;
+    rev = "v${version}";
     owner = "AcalephStorage";
     repo = "consul-alerts";
     sha256 = "0836zicv76sd6ljhbbii1mrzh65pch10w3gfa128iynaviksbgn5";
   };
 
+  postPatch = ''
+    go mod init github.com/AcalephStorage/consul-alerts
+  '';
+
+  vendorHash = null;
+
+  doCheck = false;
+
   meta = with lib; {
     mainProgram = "consul-alerts";
     description = "Extendable open source continuous integration server";
diff --git a/pkgs/servers/monitoring/mtail/default.nix b/pkgs/servers/monitoring/mtail/default.nix
index 9e406689c112..dd4ffa53e65b 100644
--- a/pkgs/servers/monitoring/mtail/default.nix
+++ b/pkgs/servers/monitoring/mtail/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "mtail";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mtail";
     rev = "v${version}";
-    hash = "sha256-zIegPQEzG7qrvS40lDODw0oisZtMN5LnLdZA01K0FQs=";
+    hash = "sha256-AFSEMc7ZFT3fMupCPIA2nQZXIuJvsMXwsS4/zrJV+wM=";
   };
 
   vendorHash = "sha256-qn27BYQdYNfR+9w2SBfBzevtOLTm4Q6nwduL13TgmoY=";
diff --git a/pkgs/servers/web-apps/matomo/default.nix b/pkgs/servers/web-apps/matomo/default.nix
index 627c64e67b3e..529deabd48bc 100644
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@@ -118,7 +118,7 @@ let
           license = licenses.gpl3Plus;
           homepage = "https://matomo.org/";
           platforms = platforms.all;
-          maintainers = with maintainers; [ florianjacob kiwi sebbel twey boozedog ] ++ teams.flyingcircus.members;
+          maintainers = with maintainers; [ florianjacob sebbel twey boozedog ] ++ teams.flyingcircus.members;
         };
       };
 in
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 6a8b07b633ef..2304b3289b7e 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -32,11 +32,7 @@ rec {
 
 
   # Override the compiler in stdenv for specific packages.
-  overrideCC = stdenv: cc: stdenv.override {
-    allowedRequisites = null;
-    cc = cc;
-    hasCC = cc != null;
-  };
+  overrideCC = stdenv: cc: stdenv.override { allowedRequisites = null; cc = cc; };
 
 
   # Add some arbitrary packages to buildInputs for specific packages.
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index de7ae432f360..1cbbfeb6d202 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -41,43 +41,25 @@ in lib.init bootStages ++ [
       if crossSystem.isStatic
       then buildPackages.stdenvAdapters.makeStatic
       else lib.id;
-    stdenvNoCC = adaptStdenv (buildPackages.stdenv.override (old: rec {
-      buildPlatform = localSystem;
-      hostPlatform = crossSystem;
-      targetPlatform = crossSystem;
-
-      # Prior overrides are surely not valid as packages built with this run on
-      # a different platform, and so are disabled.
-      overrides = _: _: {};
-      extraBuildInputs = [ ]; # Old ones run on wrong platform
-      allowedRequisites = null;
-
-      cc = null;
-      hasCC = false;
-
-      extraNativeBuildInputs = old.extraNativeBuildInputs
-        ++ lib.optionals
-             (hostPlatform.isLinux && !buildPlatform.isLinux)
-             [ buildPackages.patchelf ]
-        ++ lib.optional
-             (let f = p: !p.isx86 || builtins.elem p.libc [ "musl" "wasilibc" "relibc" ] || p.isiOS || p.isGenode;
-               in f hostPlatform && !(f buildPlatform) )
-             buildPackages.updateAutotoolsGnuConfigScriptsHook
-        ;
-    }));
   in {
     inherit config;
     overlays = overlays ++ crossOverlays;
     selfBuild = false;
-    inherit stdenvNoCC;
     stdenv = let
-      inherit (stdenvNoCC) hostPlatform targetPlatform;
-      baseStdenv = stdenvNoCC.override {
+      baseStdenv = adaptStdenv (buildPackages.stdenv.override (old: rec {
+        buildPlatform = localSystem;
+        hostPlatform = crossSystem;
+        targetPlatform = crossSystem;
+
+        # Prior overrides are surely not valid as packages built with this run on
+        # a different platform, and so are disabled.
+        overrides = _: _: {};
         extraBuildInputs = [ ] # Old ones run on wrong platform
            ++ lib.optionals hostPlatform.isDarwin [ buildPackages.targetPackages.darwin.apple_sdk.frameworks.CoreFoundation ]
            ;
+        allowedRequisites = null;
 
-        hasCC = !stdenvNoCC.targetPlatform.isGhcjs;
+        hasCC = !targetPlatform.isGhcjs;
 
         cc = if crossSystem.useiOSPrebuilt or false
                then buildPackages.darwin.iosSdkPkgs.clang
@@ -95,7 +77,16 @@ in lib.init bootStages ++ [
                then buildPackages.llvmPackages.clang
              else buildPackages.gcc;
 
-      };
+        extraNativeBuildInputs = old.extraNativeBuildInputs
+          ++ lib.optionals
+               (hostPlatform.isLinux && !buildPlatform.isLinux)
+               [ buildPackages.patchelf ]
+          ++ lib.optional
+               (let f = p: !p.isx86 || builtins.elem p.libc [ "musl" "wasilibc" "relibc" ] || p.isiOS || p.isGenode;
+                 in f hostPlatform && !(f buildPlatform) )
+               buildPackages.updateAutotoolsGnuConfigScriptsHook
+          ;
+      }));
     in if config ? replaceCrossStdenv then config.replaceCrossStdenv { inherit buildPackages baseStdenv; } else baseStdenv;
   })
 
diff --git a/pkgs/tools/admin/qovery-cli/default.nix b/pkgs/tools/admin/qovery-cli/default.nix
index 5464fea5281e..82a035bc442e 100644
--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "qovery-cli";
-  version = "0.94.13";
+  version = "0.94.14";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LFVl4IlLoJyOdHv0rqL2GfUvLpp/8qT951fQkW8MHy4=";
+    hash = "sha256-A2U/NoVbUW0U5/1Q/jJ5MFBrcHB1c23EMAY3bwWZ/R4=";
   };
 
   vendorHash = "sha256-qrDadHGhjwsAIfIQIkUeT7Tehv1sTtsfzgPyKxc5zJE=";
diff --git a/pkgs/tools/bootloaders/refind/default.nix b/pkgs/tools/bootloaders/refind/default.nix
index 0a8af657ff44..9c4cda573e58 100644
--- a/pkgs/tools/bootloaders/refind/default.nix
+++ b/pkgs/tools/bootloaders/refind/default.nix
@@ -146,7 +146,7 @@ stdenv.mkDerivation rec {
       Linux kernels that provide EFI stub support.
     '';
     homepage = "http://refind.sourceforge.net/";
-    maintainers = with maintainers; [ AndersonTorres samueldr chewblacka ];
+    maintainers = with maintainers; [ AndersonTorres chewblacka ];
     platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
     license = licenses.gpl3Plus;
   };
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index ce58f6ea0a18..545ef57d4b08 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -201,6 +201,6 @@ stdenv.mkDerivation rec {
 
     platforms = if xenSupport then [ "x86_64-linux" "i686-linux" ] else platforms.gnu ++ platforms.linux;
 
-    maintainers = [ maintainers.samueldr ];
+    maintainers = [ ];
   };
 })
diff --git a/pkgs/tools/misc/mailman-rss/default.nix b/pkgs/tools/misc/mailman-rss/default.nix
deleted file mode 100644
index d71ee8795528..000000000000
--- a/pkgs/tools/misc/mailman-rss/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib, python3Packages, fetchPypi, withTwitter ? false}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "mailman-rss";
-  version = "0.2.4";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1brrik70jyagxa9l0cfmlxvqpilwj1q655bphxnvjxyganxf4c00";
-  };
-
-  propagatedBuildInputs = with python3Packages; [ python-dateutil future requests beautifulsoup4 ]
-    ++ lib.optional withTwitter python3Packages.twitter
-  ;
-
-  # No tests in Pypi Tarball
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Mailman archive -> rss converter";
-    homepage = "https://github.com/kyamagu/mailman-rss";
-    license = licenses.mit;
-    maintainers = with maintainers; [ samueldr ];
-    mainProgram = "mailman-rss";
-  };
-}
diff --git a/pkgs/tools/package-management/nix-top/default.nix b/pkgs/tools/package-management/nix-top/default.nix
deleted file mode 100644
index d9dcc2d64ec6..000000000000
--- a/pkgs/tools/package-management/nix-top/default.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, ruby
-, makeWrapper
-, getent               # /etc/passwd
-, ncurses              # tput
-, binutils-unwrapped   # strings
-, coreutils
-, findutils
-}:
-
-# No gems used, so mkDerivation is fine.
-let
-  additionalPath = lib.makeBinPath [ getent ncurses binutils-unwrapped coreutils findutils ];
-in
-stdenv.mkDerivation rec {
-  pname = "nix-top";
-  version = "0.3.0";
-
-  src = fetchFromGitHub {
-    owner = "samueldr";
-    repo = "nix-top";
-    rev = "v${version}";
-    sha256 = "sha256-w/TKzbZmMt4CX2KnLwPvR1ydp5NNlp9nNx78jJvhp54=";
-  };
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-  buildInputs = [
-    ruby
-  ];
-
-  installPhase = ''
-    mkdir -p $out/libexec/nix-top
-    install -D -m755 ./nix-top $out/bin/nix-top
-    wrapProgram $out/bin/nix-top \
-      --prefix PATH : "$out/libexec/nix-top:${additionalPath}"
-  '' + lib.optionalString stdenv.isDarwin ''
-    ln -s /bin/stty $out/libexec/nix-top
-  '';
-
-  meta = with lib; {
-    description = "Tracks what nix is building";
-    homepage = "https://github.com/samueldr/nix-top";
-    license = licenses.mit;
-    maintainers = with maintainers; [ samueldr ];
-    platforms = platforms.linux ++ platforms.darwin ++ platforms.freebsd;
-    mainProgram = "nix-top";
-  };
-}
diff --git a/pkgs/tools/package-management/nix-universal-prefetch/default.nix b/pkgs/tools/package-management/nix-universal-prefetch/default.nix
deleted file mode 100644
index be31ca34ad60..000000000000
--- a/pkgs/tools/package-management/nix-universal-prefetch/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ lib, stdenv
-, fetchFromGitHub
-, ruby
-}:
-
-# No gems used, so mkDerivation is fine.
-stdenv.mkDerivation rec {
-  pname = "nix-universal-prefetch";
-  version = "0.4.0";
-
-  src = fetchFromGitHub {
-    owner = "samueldr";
-    repo = "nix-universal-prefetch";
-    rev = "v${version}";
-    sha256 = "sha256-HGn4qHWqpUwlS3yQrD3j5oH0yOlphsoSPD2vkyyRv+0=";
-  };
-
-  installPhase = ''
-    mkdir -pv $out/bin
-    cp nix-universal-prefetch $out/bin/nix-universal-prefetch
-    substituteInPlace "$out/bin/nix-universal-prefetch" \
-      --replace "/usr/bin/env nix-shell" "${ruby}/bin/ruby"
-  '';
-
-  meta = with lib; {
-    description = "Uses nixpkgs fetchers to figure out hashes";
-    homepage = "https://github.com/samueldr/nix-universal-prefetch";
-    license = licenses.mit;
-    maintainers = with maintainers; [ samueldr ];
-    platforms = platforms.linux ++ platforms.darwin;
-    mainProgram = "nix-universal-prefetch";
-  };
-}
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index b02cc7ed4867..e3c112127143 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "11.9.0";
+  version = "11.9.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ry8VUMTswRwt0QViTi6ZnYxDN9P5wVdXLsNJlvhJ3yM=";
+    hash = "sha256-8i2oNeFxpxhFxFlJR3ib0M1W9NNtqgGjlnKsqzLkf68=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-csSdZifkohlAVD2vXe4P1J4nX+EJNFB+YaVXRZKBsKI=";
+  vendorHash = "sha256-va23lTCCL/4EpTkBPH+rqZj4f+O4vAg2/nXGMEDNGXU=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index e94cfbd846ea..4bbd65c09b65 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.78.1";
+  version = "3.78.2";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Gek42O48RDkygeq+9oaV2f9UephOjxrevC6uQeAn24s=";
+    hash = "sha256-s+8l203ntPsp54yZpEX2wz8Dt/p3rokfu6KI8LSwpko=";
   };
 
-  vendorHash = "sha256-KSIHJe83F2PBWBYe/aoWJrqzGvDwZhrrCvJ2GVBnmfo=";
+  vendorHash = "sha256-0YNvqJlSF6TIGSbQrAu47G2oXPY9+2wiZbDP94oAaVA=";
 
   proxyVendor = true;
 
diff --git a/pkgs/tools/system/vboot_reference/default.nix b/pkgs/tools/system/vboot_reference/default.nix
index 4718173e430d..b5cd5cd19320 100644
--- a/pkgs/tools/system/vboot_reference/default.nix
+++ b/pkgs/tools/system/vboot_reference/default.nix
@@ -56,6 +56,6 @@ stdenv.mkDerivation rec {
     description = "Chrome OS partitioning and kernel signing tools";
     license = licenses.bsd3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ lheckemann samueldr ];
+    maintainers = with maintainers; [ lheckemann ];
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index b66c9370e8e6..e400b927b0e9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -98,7 +98,6 @@ mapAliases ({
   auditBlasHook = throw "'auditBlasHook' has been removed since it never worked"; # Added 2024-04-02
   authy = throw "'authy' has been removed since it reached end of life"; # Added 2024-04-19
   avldrums-lv2 = x42-avldrums; # Added 2020-03-29
-  avrlibcCross = avrlibc; # Added 2024-06-18
   awesome-4-0 = awesome; # Added 2022-05-05
   aws-env = throw "aws-env has been removed as the upstream project was unmaintained"; # Added 2024-06-11
 
@@ -199,7 +198,6 @@ mapAliases ({
   cope = throw "'cope' has been removed, as it is broken in nixpkgs since it was added, and fixing it is not trivial"; # Added 2024-04-12
   cpp-ipfs-api = cpp-ipfs-http-client; # Project has been renamed. Added 2022-05-15
   crispyDoom = crispy-doom; # Added 2023-05-01
-  crossLibcStdenv = stdenvNoLibc; # Added 2024-06-18
   cryptowatch-desktop = throw "Cryptowatch Desktop was sunset on September 30th 2023 and has been removed from nixpkgs"; # Added 2023-12-22
   clash = throw "'clash' has been removed, upstream gone. Consider using 'mihomo' instead."; # added 2023-11-10
   clasp = clingo; # added 2022-12-22
@@ -527,6 +525,7 @@ mapAliases ({
   grab-site = throw "grab-site has been removed because it's unmaintained and broken"; # Added 2023-11-12
   gradle_4 = throw "gradle_4 has been removed because it's no longer being updated"; # Added 2023-01-17
   gradle_5 = throw "gradle_5 has been removed because it's no longer being updated"; # Added 2023-01-17
+  grafana_reporter = grafana-reporter; # Added 2024-06-09
   gr-ais = throw "'gr-ais' has been renamed to/replaced by 'gnuradio3_7.pkgs.ais'"; # Converted to throw 2023-09-10
   graylog = throw "graylog is now available in versions 3.3 up to 5.0. Please mind the upgrade path and choose the appropriate version. Direct upgrading from 3.3 to 4.3 or above is not supported"; # Added 2023-04-24
   graylog-3_3 = throw "graylog 3.x is EOL. Please consider downgrading nixpkgs if you need an upgrade from 3.x to latest series."; # Added 2023-10-09
@@ -567,6 +566,7 @@ mapAliases ({
   hip-amd = throw "'hip-amd' has been removed in favor of 'rocmPackages.clr'"; # Added 2023-10-08
   hip-common = throw "'hip-common' has been replaced with 'rocmPackages.hip-common'"; # Added 2023-10-08
   hip-nvidia = throw "'hip-nvidia' has been removed in favor of 'rocmPackages.clr'"; # Added 2023-10-08
+  hll2390dw-cups = throw "The hll2390dw-cups package was dropped since it was unmaintained."; # Added 2024-06-21
   ht-rust = xh; # Added 2021-02-13
   hydra-unstable = hydra_unstable; # added 2022-05-10
   hyper-haskell = throw "'hyper-haskell' has been removed. reason: has been broken for a long time and depends on an insecure electron version"; # Added 2024-03-14
@@ -585,6 +585,7 @@ mapAliases ({
   imlib = throw "imlib has been dropped due to the lack of maintenance from upstream since 2004"; # Added 2023-01-04
   indiepass-desktop = throw "indiepass-desktop has been dropped because it does not work with recent Electron versions"; # Added 2024-03-14
   indigenous-desktop = throw "'indigenous-desktop' has been renamed to/replaced by 'indiepass-desktop'"; # Added 2023-11-08
+  input-utils = throw "The input-utils package was dropped since it was unmaintained."; # Added 2024-06-21
   instead-launcher = throw "instead-launcher has been removed, because it depended on qt4"; # Added 2023-07-26
   insync-v3 = throw "insync-v3 has been merged into the insync package; use insync instead"; #Added 2023-05-13
   index-fm = libsForQt5.mauiPackages.index; # added 2022-05-17
@@ -827,6 +828,7 @@ mapAliases ({
   ### M ###
 
   MACS2 = macs2; # Added 2023-06-12
+  mailman-rss = throw "The mailman-rss package was dropped since it was unmaintained."; # Added 2024-06-21
   mariadb_104 = throw "mariadb_104 has been removed from nixpkgs, please switch to another version like mariadb_106"; # Added 2023-09-11
   mariadb_1010 = throw "mariadb_1010 has been removed from nixpkgs, please switch to another version like mariadb_1011"; # Added 2023-11-14
   mariadb-client = hiPrio mariadb.client; #added 2019.07.28
@@ -879,7 +881,6 @@ mapAliases ({
   mpd_clientlib = libmpdclient; # Added 2021-02-11
   mpdevil = plattenalbum; # Added 2024-05-22
   mpg321 = throw "'mpg321' has been removed due to it being unmaintained by upstream. Consider using mpg123 instead."; # Added 2024-05-10
-  msp430NewlibCross = msp430Newlib; # Added 2024-06-18
   mumble_git = throw "'mumble_git' has been renamed to/replaced by 'pkgs.mumble'"; # Converted to throw 2023-09-10
   murmur_git = throw "'murmur_git' has been renamed to/replaced by 'pkgs.murmur'"; # Converted to throw 2023-09-10
   mutt-with-sidebar = mutt; # Added 2022-09-17
@@ -913,8 +914,6 @@ mapAliases ({
   nagiosPluginsOfficial = monitoring-plugins;
   neochat = libsForQt5.kdeGear.neochat; # added 2022-05-10
   neoload = throw "'neoload' has been removed as it is broken and unmaintained"; # Added 2024-03-02
-  newlibCross = newlib; # Added 2024-06-18
-  newlib-nanoCross = newlib-nano; # Added 2024-06-18
   nitrokey-udev-rules = libnitrokey; # Added 2023-03-25
   nix-direnv-flakes = nix-direnv;
   nix-repl = throw (
@@ -924,6 +923,8 @@ mapAliases ({
   );
   nix-review = throw "'nix-review' has been renamed to/replaced by 'nixpkgs-review'"; # Converted to throw 2023-09-10
   nix-template-rpm = throw "'nix-template-rpm' has been removed as it is broken and unmaintained"; # Added 2023-11-20
+  nix-top = throw "The nix-top package was dropped since it was unmaintained."; # Added 2024-06-21
+  nix-universal-prefetch = throw "The nix-universal-prefetch package was dropped since it was unmaintained."; # Added 2024-06-21
   nixFlakes = nixVersions.stable; # Added 2021-05-21
   nixStable = nixVersions.stable; # Added 2022-01-24
   nixUnstable = throw "nixUnstable has been removed. For bleeding edge (Nix master, roughly weekly updated) use nixVersions.git, otherwise use nixVersions.latest."; # Converted to throw 2024-04-22
@@ -1338,9 +1339,8 @@ mapAliases ({
   uade123 = uade; # Added 2022-07-30
   uberwriter = apostrophe; # Added 2020-04-23
   ubootBeagleboneBlack = ubootAmx335xEVM; # Added 2020-01-21
-  uclibc = uclibc-ng; # Added 2022-06-16
-  uclibcCross = uclibc-ng; # Added 2022-06-16
   ue4 = throw "ue4 has been removed, because the package was broken for years"; # Added 2023-11-22
+  uefi-firmware-parser = throw "The uefi-firmware-parser package was dropped since it was unmaintained."; # Added 2024-06-21
   uhd3_5 = throw "uhd3_5 has been removed, because it was no longer needed"; # Added 2023-10-07
   uhhyou.lv2 = throw "'uhhyou.lv2' has been removed, upstream gone"; # Added 2023-06-21
   unicorn-emu = unicorn; # Added 2020-10-29
@@ -1477,10 +1477,6 @@ mapAliases ({
   inherit (stdenv.hostPlatform) system; # Added 2021-10-22
   inherit (stdenv) buildPlatform hostPlatform targetPlatform; # Added 2023-01-09
 
-  freebsdCross = freebsd; # Added 2024-06-18
-  netbsdCross = netbsd; # Added 2024-06-18
-  openbsdCross = openbsd; # Added 2024-06-18
-
   # LLVM packages for (integration) testing that should not be used inside Nixpkgs:
   llvmPackages_latest = llvmPackages_18;
   llvmPackages_git = recurseIntoAttrs (callPackage ../development/compilers/llvm/git {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 36cdab06d6dc..c08e8f4c4802 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -31,6 +31,19 @@ with pkgs;
   # it's just the plain stdenv.
   stdenv_32bit = lowPrio (if stdenv.hostPlatform.is32bit then stdenv else multiStdenv);
 
+  stdenvNoCC = stdenv.override (
+    { cc = null; hasCC = false; }
+
+    // lib.optionalAttrs (stdenv.hostPlatform.isDarwin && (stdenv.hostPlatform != stdenv.buildPlatform)) {
+      # TODO: This is a hack to use stdenvNoCC to produce a CF when cross
+      # compiling. It's not very sound. The cross stdenv has:
+      #   extraBuildInputs = [ targetPackages.darwin.apple_sdks.frameworks.CoreFoundation ]
+      # and uses stdenvNoCC. In order to make this not infinitely recursive, we
+      # need to exclude this extraBuildInput.
+      extraBuildInputs = [];
+    }
+  );
+
   mkStdenvNoLibs = stdenv: let
     bintools = stdenv.cc.bintools.override {
       libc = null;
@@ -48,7 +61,7 @@ with pkgs;
   };
 
   stdenvNoLibs =
-    if stdenvNoCC.hostPlatform != stdenvNoCC.buildPlatform
+    if stdenv.hostPlatform != stdenv.buildPlatform && (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.useLLVM or false)
     then
       # We cannot touch binutils or cc themselves, because that will cause
       # infinite recursion. So instead, we just choose a libc based on the
@@ -61,17 +74,7 @@ with pkgs;
       # thing to to create an earlier thing (leading to infinite recursion) and
       # we also would still respect the stage arguments choices for these
       # things.
-      (if stdenvNoCC.hostPlatform.isDarwin || stdenvNoCC.hostPlatform.useLLVM or false
-       then overrideCC stdenvNoCC buildPackages.llvmPackages.clangNoCompilerRt
-       else gccCrossLibcStdenv)
-    else mkStdenvNoLibs stdenv;
-
-  stdenvNoLibc =
-    if stdenvNoCC.hostPlatform != stdenvNoCC.buildPlatform
-    then
-      (if stdenvNoCC.hostPlatform.isDarwin || stdenvNoCC.hostPlatform.useLLVM or false
-       then overrideCC stdenvNoCC buildPackages.llvmPackages.clangNoLibc
-       else gccCrossLibcStdenv)
+      overrideCC stdenv buildPackages.llvmPackages.clangNoCompilerRt
     else mkStdenvNoLibs stdenv;
 
   gccStdenvNoLibs = mkStdenvNoLibs gccStdenv;
@@ -9112,8 +9115,6 @@ with pkgs;
 
   input-remapper = python3Packages.callPackage ../tools/inputmethods/input-remapper { };
 
-  input-utils = callPackage ../os-specific/linux/input-utils { };
-
   inql = callPackage ../tools/security/inql { };
 
   intel-media-sdk = callPackage ../development/libraries/intel-media-sdk { };
@@ -15456,7 +15457,12 @@ with pkgs;
     dontStrip = true;
   }));
 
-  gccCrossLibcStdenv = overrideCC stdenvNoCC buildPackages.gccWithoutTargetLibc;
+  gccCrossLibcStdenv = overrideCC stdenv buildPackages.gccWithoutTargetLibc;
+
+  crossLibcStdenv =
+    if stdenv.hostPlatform.useLLVM or false || stdenv.hostPlatform.isDarwin
+    then overrideCC stdenv buildPackages.llvmPackages.clangNoLibc
+    else gccCrossLibcStdenv;
 
   # The GCC used to build libc for the target platform. Normal gccs will be
   # built with, and use, that cross-compiled libc.
@@ -17624,8 +17630,9 @@ with pkgs;
 
   h3 = h3_3;
 
-  avrlibc = callPackage ../development/misc/avr/libc {
-    stdenv = stdenvNoLibc;
+  avrlibc      = callPackage ../development/misc/avr/libc { };
+  avrlibcCross = callPackage ../development/misc/avr/libc {
+    stdenv = crossLibcStdenv;
   };
 
   avr8burnomat = callPackage ../development/misc/avr8-burn-omat { };
@@ -17699,7 +17706,10 @@ with pkgs;
 
   msp430GccSupport = callPackage ../development/misc/msp430/gcc-support.nix { };
 
-  msp430Newlib = callPackage ../development/misc/msp430/newlib.nix { };
+  msp430Newlib      = callPackage ../development/misc/msp430/newlib.nix { };
+  msp430NewlibCross = callPackage ../development/misc/msp430/newlib.nix {
+    newlib = newlibCross;
+  };
 
   mspds = callPackage ../development/misc/msp430/mspds { };
   mspds-bin = callPackage ../development/misc/msp430/mspds/binary.nix { };
@@ -19703,8 +19713,6 @@ with pkgs;
 
   udis86 = callPackage  ../development/tools/udis86 { };
 
-  uefi-firmware-parser = callPackage ../development/tools/analysis/uefi-firmware-parser { };
-
   uhd = callPackage ../applications/radio/uhd { };
   uhdMinimal = uhd.override {
     enableUtils = false;
@@ -20914,14 +20922,14 @@ with pkgs;
   };
 
   muslCross = musl.override {
-    stdenv = stdenvNoLibc;
+    stdenv = crossLibcStdenv;
   };
 
   # These are used when buiding compiler-rt / libgcc, prior to building libc.
   preLibcCrossHeaders = let
     inherit (stdenv.targetPlatform) libc;
   in     if stdenv.targetPlatform.isMinGW then targetPackages.windows.mingw_w64_headers or windows.mingw_w64_headers
-    else if libc == "nblibc" then targetPackages.netbsd.headers or netbsd.headers
+    else if libc == "nblibc" then targetPackages.netbsdCross.headers or netbsdCross.headers
     else if libc == "libSystem" && stdenv.targetPlatform.isAarch64 then targetPackages.darwin.LibsystemCross or darwin.LibsystemCross
     else null;
 
@@ -20932,13 +20940,13 @@ with pkgs;
     /**/ if name == null then null
     else if name == "glibc" then targetPackages.glibcCross or glibcCross
     else if name == "bionic" then targetPackages.bionic or bionic
-    else if name == "uclibc" then targetPackages.uclibc or uclibc
-    else if name == "avrlibc" then targetPackages.avrlibc or avrlibc
-    else if name == "newlib" && stdenv.targetPlatform.isMsp430 then targetPackages.msp430Newlib or msp430Newlib
+    else if name == "uclibc" then targetPackages.uclibcCross or uclibcCross
+    else if name == "avrlibc" then targetPackages.avrlibcCross or avrlibcCross
+    else if name == "newlib" && stdenv.targetPlatform.isMsp430 then targetPackages.msp430NewlibCross or msp430NewlibCross
     else if name == "newlib" && stdenv.targetPlatform.isVc4 then targetPackages.vc4-newlib or vc4-newlib
     else if name == "newlib" && stdenv.targetPlatform.isOr1k then targetPackages.or1k-newlib or or1k-newlib
-    else if name == "newlib" then targetPackages.newlib or newlib
-    else if name == "newlib-nano" then targetPackages.newlib-nano or newlib-nano
+    else if name == "newlib" then targetPackages.newlibCross or newlibCross
+    else if name == "newlib-nano" then targetPackages.newlib-nanoCross or newlib-nanoCross
     else if name == "musl" then targetPackages.muslCross or muslCross
     else if name == "msvcrt" then targetPackages.windows.mingw_w64 or windows.mingw_w64
     else if name == "ucrt" then targetPackages.windows.mingw_w64 or windows.mingw_w64
@@ -20946,9 +20954,9 @@ with pkgs;
       if stdenv.targetPlatform.useiOSPrebuilt
       then targetPackages.darwin.iosSdkPkgs.libraries or darwin.iosSdkPkgs.libraries
       else targetPackages.darwin.LibsystemCross or (throw "don't yet have a `targetPackages.darwin.LibsystemCross for ${stdenv.targetPlatform.config}`")
-    else if name == "fblibc" then targetPackages.freebsd.libc or freebsd.libc
-    else if name == "oblibc" then targetPackages.openbsd.libc or openbsd.libc
-    else if name == "nblibc" then targetPackages.netbsd.libc or netbsd.libc
+    else if name == "fblibc" then targetPackages.freebsdCross.libc or freebsdCross.libc
+    else if name == "oblibc" then targetPackages.openbsdCross.libc or openbsdCross.libc
+    else if name == "nblibc" then targetPackages.netbsdCross.libc or netbsdCross.libc
     else if name == "wasilibc" then targetPackages.wasilibc or wasilibc
     else if name == "relibc" then targetPackages.relibc or relibc
     else throw "Unknown libc ${name}";
@@ -20964,7 +20972,7 @@ with pkgs;
     };
 
   wasilibc = callPackage ../development/libraries/wasilibc {
-    stdenv = stdenvNoLibc;
+    stdenv = crossLibcStdenv;
   };
 
   relibc = callPackage ../development/libraries/relibc { };
@@ -25595,8 +25603,6 @@ with pkgs;
 
   phlare = callPackage ../servers/monitoring/phlare { };
 
-  grafana_reporter = callPackage ../servers/monitoring/grafana-reporter { };
-
   grafana-image-renderer = callPackage ../servers/monitoring/grafana-image-renderer { };
 
   grafana-dash-n-grab = callPackage ../servers/monitoring/grafana-dash-n-grab { };
@@ -25760,8 +25766,6 @@ with pkgs;
   inherit (mailmanPackages) mailman mailman-hyperkitty;
   mailman-web = mailmanPackages.web;
 
-  mailman-rss = callPackage ../tools/misc/mailman-rss { };
-
   listadmin = callPackage ../applications/networking/listadmin { };
 
   maker-panel = callPackage ../tools/misc/maker-panel { };
@@ -27953,6 +27957,14 @@ with pkgs;
     buildBarebox
     bareboxTools;
 
+  uclibc-ng-cross = uclibc-ng.override {
+    stdenv = crossLibcStdenv;
+  };
+
+  # Aliases
+  uclibc = uclibc-ng;
+  uclibcCross = uclibc-ng-cross;
+
   eudev = callPackage ../by-name/eu/eudev/package.nix {
     util-linux = util-linuxMinimal;
   };
@@ -39560,12 +39572,8 @@ with pkgs;
 
   nix-script = callPackage ../tools/nix/nix-script { };
 
-  nix-top = callPackage ../tools/package-management/nix-top { };
-
   nix-tree = haskell.lib.compose.justStaticExecutables (haskellPackages.nix-tree);
 
-  nix-universal-prefetch = callPackage ../tools/package-management/nix-universal-prefetch { };
-
   nixpkgs-review = callPackage ../tools/package-management/nixpkgs-review { };
 
   nix-serve = callPackage ../tools/package-management/nix-serve { };
@@ -39825,8 +39833,6 @@ with pkgs;
 
   canon-cups-ufr2 = callPackage ../misc/cups/drivers/canon { };
 
-  hll2390dw-cups = callPackage ../misc/cups/drivers/hll2390dw-cups { };
-
   mfc465cncupswrapper = callPackage ../misc/cups/drivers/brother/mfc465cncupswrapper { };
   mfc465cnlpr = callPackage ../misc/cups/drivers/brother/mfc465cnlpr { };
 
@@ -40579,11 +40585,18 @@ with pkgs;
     name = "bsd-setup-hook";
   } ../os-specific/bsd/setup-hook.sh;
 
-  freebsd = callPackage ../os-specific/bsd/freebsd { };
+  inherit (callPackage ../os-specific/bsd/freebsd { })
+    freebsd freebsdCross;
 
   netbsd = callPackage ../os-specific/bsd/netbsd { };
+  netbsdCross = callPackage ../os-specific/bsd/netbsd {
+    stdenv = crossLibcStdenv;
+  };
 
   openbsd = callPackage ../os-specific/bsd/openbsd { };
+  openbsdCross = callPackage ../os-specific/bsd/openbsd {
+    stdenv = crossLibcStdenv;
+  };
 
   powershell = callPackage ../shells/powershell { };
 
@@ -40607,14 +40620,18 @@ with pkgs;
 
   new-session-manager = callPackage ../applications/audio/new-session-manager { };
 
-  newlib = callPackage ../development/misc/newlib {
-    stdenv = stdenvNoLibc;
+  newlib = callPackage ../development/misc/newlib { };
+  newlibCross = callPackage ../development/misc/newlib {
+    stdenv = crossLibcStdenv;
   };
 
   newlib-nano = callPackage ../development/misc/newlib {
-    stdenv = stdenvNoLibc;
     nanoizeNewlib = true;
   };
+  newlib-nanoCross = callPackage ../development/misc/newlib {
+    nanoizeNewlib = true;
+    stdenv = crossLibcStdenv;
+  };
 
   omnisharp-roslyn = callPackage ../development/tools/omnisharp-roslyn { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 95ab04200e21..6051367964e5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7033,8 +7033,6 @@ self: super: with self; {
 
   lnkparse3 = callPackage ../development/python-modules/lnkparse3 { };
 
-  loadcredential = callPackage ../development/python-modules/loadcredential { };
-
   loca = callPackage ../development/python-modules/loca { };
 
   localimport = callPackage ../development/python-modules/localimport { };
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 025b6089f471..087b43c3cb14 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -49,10 +49,6 @@ in
 , # The standard environment to use for building packages.
   stdenv
 
-, # `stdenv` without a C compiler. Passing in this helps avoid infinite
-  # recursions, and may eventually replace passing in the full stdenv.
-  stdenvNoCC ? stdenv.override { cc = null; hasCC = false; }
-
 , # This is used because stdenv replacement and the stdenvCross do benefit from
   # the overridden configuration provided by the user, as opposed to the normal
   # bootstrapping stdenvs.
@@ -145,7 +141,7 @@ let
     pkgs = self.pkgsHostTarget;
     targetPackages = self.pkgsTargetTarget;
 
-    inherit stdenv stdenvNoCC;
+    inherit stdenv;
   };
 
   splice = self: super: import ./splice.nix lib self (adjacentPackages != null);