diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 40ab1b6aabd1..c94182b83e15 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15341,6 +15341,12 @@
     githubId = 5047052;
     name = "Niclas Hirschfeld";
   };
+  nwjsmith = {
+    email = "nate@theinternate.com";
+    github = "nwjsmith";
+    githubId = 1348;
+    name = "Nate Smith";
+  };
   nyabinary = {
     name = "Niko Cantero";
     email = "nyanbinary@keemail.me";
diff --git a/nixos/modules/programs/clash-verge.nix b/nixos/modules/programs/clash-verge.nix
index 4425fe1a9fe7..a2912cb1d8e0 100644
--- a/nixos/modules/programs/clash-verge.nix
+++ b/nixos/modules/programs/clash-verge.nix
@@ -1,9 +1,22 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   options.programs.clash-verge = {
     enable = lib.mkEnableOption "Clash Verge";
-    package = lib.mkPackageOption pkgs "clash-verge" {};
+    package = lib.mkOption {
+      type = lib.types.package;
+      description = ''
+        The clash-verge package to use. Available options are
+        clash-verge-rev and clash-nyanpasu, both are forks of
+        the original clash-verge project.
+      '';
+      example = "pkgs.clash-verge-rev";
+    };
     autoStart = lib.mkEnableOption "Clash Verge auto launch";
     tunMode = lib.mkEnableOption "Clash Verge TUN mode";
   };
@@ -16,10 +29,12 @@
 
       environment.systemPackages = [
         cfg.package
-        (lib.mkIf cfg.autoStart (pkgs.makeAutostartItem {
-          name = "clash-verge";
-          package = cfg.package;
-        }))
+        (lib.mkIf cfg.autoStart (
+          pkgs.makeAutostartItem {
+            name = "clash-verge";
+            package = cfg.package;
+          }
+        ))
       ];
 
       security.wrappers.clash-verge = lib.mkIf cfg.tunMode {
diff --git a/nixos/modules/programs/wayland/waybar.nix b/nixos/modules/programs/wayland/waybar.nix
index ab811994be07..35c5cc86f3b4 100644
--- a/nixos/modules/programs/wayland/waybar.nix
+++ b/nixos/modules/programs/wayland/waybar.nix
@@ -1,4 +1,9 @@
-{ lib, pkgs, config, ... }:
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
 
 let
   cfg = config.programs.waybar;
@@ -11,11 +16,9 @@ in
 
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
-    systemd.user.services.waybar = {
-      description = "Waybar as systemd service";
-      wantedBy = [ "graphical-session.target" ];
-      partOf = [ "graphical-session.target" ];
-      script = "${cfg.package}/bin/waybar";
+    systemd = {
+      packages = [ cfg.package ];
+      user.services.waybar.wantedBy = [ "graphical-session.target" ];
     };
   };
 
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index db0971065900..fa2cf2b2c6d5 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -32,6 +32,10 @@ let
     runtimeEnv = {
       efiMountPoint = config.boot.loader.efi.efiSysMountPoint;
     };
+
+    # We disable SC2016 because we don't want to expand the regexes in the sed commands.
+    excludeShellChecks = [ "SC2016" ];
+
     text = builtins.readFile ./xen-boot-builder.sh;
   };
 in
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 967a45d17dfb..0e1a63d801e4 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -786,6 +786,7 @@ in {
   plasma6 = handleTest ./plasma6.nix {};
   plasma5-systemd-start = handleTest ./plasma5-systemd-start.nix {};
   plausible = handleTest ./plausible.nix {};
+  playwright-python = handleTest ./playwright-python.nix {};
   please = handleTest ./please.nix {};
   pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix {};
   plikd = handleTest ./plikd.nix {};
diff --git a/nixos/tests/playwright-python.nix b/nixos/tests/playwright-python.nix
new file mode 100644
index 000000000000..0a5deecbb508
--- /dev/null
+++ b/nixos/tests/playwright-python.nix
@@ -0,0 +1,58 @@
+import ./make-test-python.nix (
+  { pkgs, ... }:
+  {
+    name = "playwright-python";
+
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ phaer ];
+    };
+
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        environment.variables = {
+          NIX_MANUAL_DOCROOT = "file://${pkgs.nix.doc}/share/doc/nix/manual/index.html";
+          PLAYWRIGHT_BROWSERS_PATH = pkgs.playwright-driver.browsers;
+        };
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "test_playwright"
+            {
+              libraries = [ pkgs.python3Packages.playwright ];
+            }
+            ''
+              import sys
+              from playwright.sync_api import sync_playwright
+              from playwright.sync_api import expect
+
+              browsers = {
+                "chromium": ["--headless", "--disable-gpu"],
+                "firefox": [],
+                "webkit": []
+              }
+              if len(sys.argv) != 3 or sys.argv[1] not in browsers.keys():
+                  print(f"usage: {sys.argv[0]} [{'|'.join(browsers.keys())}] <url>")
+                  sys.exit(1)
+              browser_name = sys.argv[1]
+              url = sys.argv[2]
+              browser_args = browsers.get(browser_name)
+              print(f"Running test on {browser_name} {' '.join(browser_args)}")
+              with sync_playwright() as p:
+                  browser = getattr(p, browser_name).launch(args=browser_args)
+                  context = browser.new_context()
+                  page = context.new_page()
+                  page.goto(url)
+                  expect(page.get_by_text("Nix Reference Manual")).to_be_visible()
+            ''
+          )
+        ];
+      };
+
+    testScript = ''
+      # FIXME: Webkit segfaults
+      for browser in ["firefox", "chromium"]:
+          with subtest(f"Render Nix Manual in {browser}"):
+              machine.succeed(f"test_playwright {browser} $NIX_MANUAL_DOCROOT")
+    '';
+
+  }
+)
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
index 4aab7dface2a..841570a61919 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bitwig-studio";
-  version = "5.2";
+  version = "5.2.4";
 
   src = fetchurl {
     url = "https://www.bitwig.com/dl/Bitwig%20Studio/${version}/installer_linux/";
-    hash = "sha256:0cnjwgjbpyrb4pd0841zbhy84ps7gkmq3j148ga826nrxnw082pi";
+    hash = "sha256-/JEJthaFSdad5Hj5sdBQLLyDdp2Rp4ZAlhIA+RgwXRw=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook3 ];
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index faf9aded966d..0ea8a7943153 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -133,6 +133,13 @@ let
         # Expects bash to be at /bin/bash
         ac-rtags = fix-rtags super.ac-rtags;
 
+        age = super.age.overrideAttrs (attrs: {
+          postPatch = attrs.postPatch or "" + ''
+            substituteInPlace age.el \
+              --replace-fail 'age-program (executable-find "age")' 'age-program "${lib.getExe pkgs.age}"'
+          '';
+        });
+
         airline-themes = super.airline-themes.override {
           inherit (self.melpaPackages) powerline;
         };
@@ -357,6 +364,13 @@ let
 
         forge = buildWithGit super.forge;
 
+        gnuplot-mode = super.gnuplot-mode.overrideAttrs (attrs: {
+          postPatch = attrs.postPatch or "" + ''
+            substituteInPlace gnuplot-mode.el \
+              --replace-fail 'gnuplot-program "gnuplot"' 'gnuplot-program "${lib.getExe pkgs.gnuplot}"'
+          '';
+        });
+
         magit = buildWithGit super.magit;
 
         magit-find-file = buildWithGit super.magit-find-file;
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index c44c7fc0f70d..d1b57b42e78c 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -21,17 +21,17 @@
   ungoogled-chromium = {
     deps = {
       gn = {
-        hash = "sha256-BiMGbML5aNUt4JzzVqSszBj+8BMlEc92csNugo5qjUk=";
-        rev = "b2afae122eeb6ce09c52d63f67dc53fc517dbdc8";
+        hash = "sha256-8o3rDdojqVHMQCxI2T3MdJOXKlW3XX7lqpy3zWhJiaA=";
+        rev = "d010e218ca7077928ad7c9e9cc02fe43b5a8a0ad";
         url = "https://gn.googlesource.com/gn";
-        version = "2024-06-11";
+        version = "2024-08-19";
       };
       ungoogled-patches = {
-        hash = "sha256-o/cEVLD64qYd/VIbmN/FCFbu7LgQsZdWkyxIns7/bRs=";
-        rev = "128.0.6613.137-1";
+        hash = "sha256-3BK1HZiQ9SnRuMMviC8gm9ZLiu8ImceBlcAp24/aYlM=";
+        rev = "129.0.6668.58-1";
       };
     };
-    hash = "sha256-/q+Z1a1EFZRQvC3pmuDbzJWzSSYkI7bfgUAaJRBaj00=";
-    version = "128.0.6613.137";
+    hash = "sha256-8dKWu2/ZKw5ZthH1s5wR+h9b0aIqlDhNsPUrlE9DMQg=";
+    version = "129.0.6668.58";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index b62be88b132c..d095b53185f9 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -4,7 +4,7 @@ let
     if stdenv.isLinux then {
       stable = "0.0.67";
       ptb = "0.0.105";
-      canary = "0.0.483";
+      canary = "0.0.492";
       development = "0.0.28";
     } else {
       stable = "0.0.318";
@@ -25,7 +25,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-AWYRQxD0FPqRo1TXUR9wWhZTUr34MRFaBTXzhNcwGKI=";
+        hash = "sha256-NjcNgKYm1Twm8nN3sFlZCG/3x5fcSmX7X2On7CeZm0M=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
diff --git a/pkgs/applications/version-management/ghorg/default.nix b/pkgs/applications/version-management/ghorg/default.nix
index 528bba032b9f..094a6172e8cb 100644
--- a/pkgs/applications/version-management/ghorg/default.nix
+++ b/pkgs/applications/version-management/ghorg/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ghorg";
-  version = "1.9.13";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "gabrie30";
     repo = "ghorg";
     rev = "v${version}";
-    sha256 = "sha256-RXXDWz8sXvn0+6JFf6cHNRwg9xAGrCHGRM/M8MQpMko=";
+    sha256 = "sha256-MZGpH8fvSERSMUxGa1JX4mb8d/p3aDztgRH1FQA8f/Y=";
   };
 
   doCheck = false;
diff --git a/pkgs/applications/virtualization/xen/generic/default.nix b/pkgs/applications/virtualization/xen/generic/default.nix
index f7bbde81663f..fbbefa95d61d 100644
--- a/pkgs/applications/virtualization/xen/generic/default.nix
+++ b/pkgs/applications/virtualization/xen/generic/default.nix
@@ -426,8 +426,6 @@ stdenv.mkDerivation (finalAttrs: {
     "xen" # Build the Xen Hypervisor.
     "tools" # Build the userspace tools, such as `xl`.
     "docs" # Build the Xen Documentation
-    # TODO: Enable the Stubdomains target. This requires another pre-fetched source: mini-os. Currently, Xen appears to build a limited version of stubdomains which does not include mini-os.
-    # "stubdom"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/al/aldente/package.nix b/pkgs/by-name/al/aldente/package.nix
index 73d4ae9614e8..4d79821f6718 100644
--- a/pkgs/by-name/al/aldente/package.nix
+++ b/pkgs/by-name/al/aldente/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "aldente";
-  version = "1.28.2";
+  version = "1.28.4";
 
   src = fetchurl {
     url = "https://github.com/davidwernhart/aldente-charge-limiter/releases/download/${finalAttrs.version}/AlDente.dmg";
-    hash = "sha256-CgBH5PRlq6USfdE8ubHKAYNq1YzUmfIN7wAS4HfJvZU=";
+    hash = "sha256-ihfTVVc6kM+rOyPG7k2rkLVmCsOlBA7Uik8KrWhrdp0=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/cl/clash-verge/package.nix b/pkgs/by-name/cl/clash-verge/package.nix
deleted file mode 100644
index 9d9aca7cb1fc..000000000000
--- a/pkgs/by-name/cl/clash-verge/package.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, dpkg
-, wrapGAppsHook3
-, autoPatchelfHook
-, clash-meta
-, openssl
-, webkitgtk
-, udev
-, libayatana-appindicator
-, nix-update-script
-}:
-
-stdenv.mkDerivation rec {
-  pname = "clash-verge";
-  version = "1.3.8";
-
-  src = fetchurl {
-    url = "https://github.com/zzzgydi/clash-verge/releases/download/v${version}/clash-verge_${version}_amd64.deb";
-    hash = "sha256-kOju4yaa+EKzFWDrk0iSJVoWkQMBjQG3hKLfAsqlsy8=";
-  };
-
-  nativeBuildInputs = [
-    dpkg
-    wrapGAppsHook3
-    autoPatchelfHook
-  ];
-
-  buildInputs = [
-    openssl
-    webkitgtk
-    stdenv.cc.cc
-  ];
-
-  runtimeDependencies = [
-    (lib.getLib udev)
-    libayatana-appindicator
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin
-    mv usr/* $out
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    rm -f $out/bin/clash
-    ln -sf ${lib.getExe clash-meta} $out/bin/${clash-meta.meta.mainProgram}
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = with lib; {
-    description = "Clash GUI based on tauri";
-    homepage = "https://github.com/zzzgydi/clash-verge";
-    platforms = [ "x86_64-linux" ];
-    license = licenses.gpl3Plus;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ zendo ];
-    mainProgram = "clash-verge";
-  };
-}
diff --git a/pkgs/by-name/en/envision-unwrapped/package.nix b/pkgs/by-name/en/envision-unwrapped/package.nix
index f72410f1f814..0f65731f8051 100644
--- a/pkgs/by-name/en/envision-unwrapped/package.nix
+++ b/pkgs/by-name/en/envision-unwrapped/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "envision-unwrapped";
-  version = "0-unstable-2024-09-09";
+  version = "0-unstable-2024-09-21";
 
   src = fetchFromGitLab {
     owner = "gabmus";
     repo = "envision";
-    rev = "f8a18e96f049f2fd51409aac011e1aa09eaac2db";
-    hash = "sha256-ZEczUdFyjgqCisFjgQeYWJ9JQP0/G7cgVpkHwWjNfRQ=";
+    rev = "41e9af1676d3cfd458939a34b5c8b06d84c3f764";
+    hash = "sha256-qk9xlHWbkCRpve3SZMtq5ojfS2tRwyXsckqu7fs/Lm0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
new file mode 100644
index 000000000000..3c79b955f99c
--- /dev/null
+++ b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "jawiki-all-titles-in-ns0";
+  version = "0-unstable-2024-09-11";
+
+  src = fetchFromGitHub {
+    owner = "musjj";
+    repo = "jawiki-archive";
+    rev = "d205f63665e351ea853edc72157f14daa22a227f";
+    hash = "sha256-Jj2vH8UMhgSzWv+RnOipnVNSdeOF6jttcLN/kVYa4D4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp jawiki-latest-all-titles-in-ns0.gz $out/jawiki-all-titles-in-ns0.gz
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "A jawiki dump list of page titles in main namespace";
+    homepage = "https://dumps.wikimedia.org/backup-index.html";
+    license = with lib.licenses; [
+      fdl13Only
+      cc-by-sa-30
+    ];
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides a dump gz file
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/jp/jp-zip-codes/package.nix b/pkgs/by-name/jp/jp-zip-codes/package.nix
new file mode 100644
index 000000000000..71e20fb4c831
--- /dev/null
+++ b/pkgs/by-name/jp/jp-zip-codes/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "jp-zip-code";
+  version = "0-unstable-2024-08-01";
+
+  # This package uses a mirror as the source because the
+  # original provider uses the same URL for updated content.
+  src = fetchFromGitHub {
+    owner = "musjj";
+    repo = "jp-zip-codes";
+    rev = "94139331b79d8e23cd089fb9ad511ce55079154a";
+    hash = "sha256-e+wsJv2cP2wUwVNimWy0eYr32pr7YUy8pJAYDYbk0zo=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out ken_all.zip
+    install -Dt $out jigyosyo.zip
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "Zip files containing japanese zip codes";
+    longDescription = "Zip files with japanese zip codes for japanese IME dictionaries";
+    homepage = "https://github.com/musjj/jp-zip-codes";
+    license = lib.licenses.publicDomain;
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides some zip files
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/me/melonDS/package.nix b/pkgs/by-name/me/melonDS/package.nix
index 2be371c93476..bb4783e966a9 100644
--- a/pkgs/by-name/me/melonDS/package.nix
+++ b/pkgs/by-name/me/melonDS/package.nix
@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "melonDS";
-  version = "0.9.5-unstable-2024-09-06";
+  version = "0.9.5-unstable-2024-09-18";
 
   src = fetchFromGitHub {
     owner = "melonDS-emu";
     repo = "melonDS";
-    rev = "268c4f14c194b72ced33f520688fb0d3d096fad5";
-    hash = "sha256-D7tponrkD+YI6MYeilP5YlpIJ3brdZYKpDV/YE9vOFA=";
+    rev = "2179ca2a417e356f23a09cd88707b20c1bcaf66f";
+    hash = "sha256-93KbpRlVVZc8JoaZiVLKOsTezLqY2Y7J2bFL7RkCcxM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/me/merge-ut-dictionaries/package.nix b/pkgs/by-name/me/merge-ut-dictionaries/package.nix
new file mode 100644
index 000000000000..198cdb27e9ce
--- /dev/null
+++ b/pkgs/by-name/me/merge-ut-dictionaries/package.nix
@@ -0,0 +1,90 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+  python3,
+  jawiki-all-titles-in-ns0,
+  ibus-engines,
+
+  mozcdic-ut-jawiki,
+  mozcdic-ut-personal-names,
+  mozcdic-ut-place-names,
+  mozcdic-ut-sudachidict,
+
+  dictionaries ? [
+    mozcdic-ut-jawiki
+    mozcdic-ut-personal-names
+    mozcdic-ut-place-names
+    mozcdic-ut-sudachidict
+  ],
+}:
+
+assert lib.assertMsg (dictionaries != [ ]) "merge-ut-dictionaries needs at least one dictionary.";
+
+stdenvNoCC.mkDerivation {
+  pname = "merge-ut-dictionaries";
+  version = "0-unstable-2024-08-28";
+
+  src = fetchFromGitHub {
+    owner = "utuhiro78";
+    repo = "merge-ut-dictionaries";
+    rev = "9cacaadfc4a199914726687ad6545bfd7152c001";
+    hash = "sha256-AdcwXl+33pyN8Q95EDNwMps3ObCzys8nicege6yeRk8=";
+  };
+
+  nativeBuildInputs = [ python3 ];
+
+  preConfigure = ''
+    cd src
+
+    substituteInPlace make.sh \
+      --replace-fail "git" "true #" \
+      --replace-fail "mv mozcdic-ut" "#"
+
+    substituteInPlace count_word_hits.py \
+      --replace-fail 'subprocess.run' "#" \
+      --replace-fail "jawiki-latest-all-titles-in-ns0.gz" "${jawiki-all-titles-in-ns0}/jawiki-all-titles-in-ns0.gz"
+
+    substituteInPlace remove_duplicate_ut_entries.py \
+      --replace-fail "url =" 'url = "${ibus-engines.mozc.src}/src/data/dictionary_oss/id.def"#' \
+      --replace-fail "urllib.request.urlopen" "open" \
+      --replace-fail "read().decode()" "read()"
+
+    for dir in ${lib.concatStringsSep " " dictionaries}; do
+      cp -v $dir/mozcdic-ut-*.txt.tar.bz2 .
+    done
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    bash make.sh
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out mozcdic-ut.txt
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "Mozc UT dictionaries are additional dictionaries for Mozc.";
+    homepage = "https://github.com/utuhiro78/merge-ut-dictionaries";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides a dictionary
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/ibus-setup-mozc-jp.desktop b/pkgs/by-name/mo/mozc/ibus-setup-mozc-jp.desktop
similarity index 100%
rename from pkgs/tools/inputmethods/ibus-engines/ibus-mozc/ibus-setup-mozc-jp.desktop
rename to pkgs/by-name/mo/mozc/ibus-setup-mozc-jp.desktop
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix b/pkgs/by-name/mo/mozc/package.nix
similarity index 59%
rename from pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
rename to pkgs/by-name/mo/mozc/package.nix
index 4c19fd9abc01..b374329d23ff 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-mozc/default.nix
+++ b/pkgs/by-name/mo/mozc/package.nix
@@ -1,36 +1,43 @@
-{ lib
-, buildBazelPackage
-, fetchFromGitHub
-, qt6
-, pkg-config
-, bazel
-, ibus
-, unzip
-, xdg-utils
+{
+  lib,
+  buildBazelPackage,
+  fetchFromGitHub,
+  qt6,
+  pkg-config,
+  bazel,
+  ibus,
+  unzip,
+  xdg-utils,
+  jp-zip-codes,
+  dictionaries ? [ ],
+  merge-ut-dictionaries,
 }:
+
 let
-  zip-codes = fetchFromGitHub {
-    owner = "musjj";
-    repo = "jp-zip-codes";
-    rev = "119c888a38032a92e139c52cd26f45bb495c4d54";
-    hash = "sha256-uyAL2TcFJsYZACFDAxIQ4LE40Hi4PVrQRnJl5O5+RmU=";
-  };
+  ut-dictionary = merge-ut-dictionaries.override { inherit dictionaries; };
 in
 buildBazelPackage rec {
   pname = "ibus-mozc";
-  version = "2.29.5374.102";
+  version = "2.30.5544.102";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mozc";
     rev = version;
-    hash = "sha256-AcIN5sWPBe4JotAUYv1fytgQw+mJzdFhKuVPLR48soA=";
+    hash = "sha256-w0bjoMmq8gL7DSehEG7cKqp5e4kNOXnCYLW31Zl9FRs=";
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ qt6.wrapQtAppsHook pkg-config unzip ];
+  nativeBuildInputs = [
+    qt6.wrapQtAppsHook
+    pkg-config
+    unzip
+  ];
 
-  buildInputs = [ ibus qt6.qtbase ];
+  buildInputs = [
+    ibus
+    qt6.qtbase
+  ];
 
   dontAddBazelOpts = true;
   removeRulesCC = false;
@@ -38,7 +45,7 @@ buildBazelPackage rec {
   inherit bazel;
 
   fetchAttrs = {
-    sha256 = "sha256-ToBLVJpAQErL/P1bfWJca2FjhDW5XTrwuJQLquwlrhA=";
+    sha256 = "sha256-+N7AhSemcfhq6j0IUeWZ0DyVvr1l5FbAkB+kahTy3pM=";
 
     # remove references of buildInputs and zip code files
     preInstall = ''
@@ -46,7 +53,12 @@ buildBazelPackage rec {
     '';
   };
 
-  bazelFlags = [ "--config" "oss_linux" "--compilation_mode" "opt" ];
+  bazelFlags = [
+    "--config"
+    "oss_linux"
+    "--compilation_mode"
+    "opt"
+  ];
 
   bazelTargets = [ "package" ];
 
@@ -55,13 +67,17 @@ buildBazelPackage rec {
       --replace-fail "/usr/bin/xdg-open" "${xdg-utils}/bin/xdg-open" \
       --replace-fail "/usr" "$out"
     substituteInPlace src/WORKSPACE.bazel \
-      --replace-fail "https://www.post.japanpost.jp/zipcode/dl/kogaki/zip/ken_all.zip" "file://${zip-codes}/ken_all.zip" \
-      --replace-fail "https://www.post.japanpost.jp/zipcode/dl/jigyosyo/zip/jigyosyo.zip" "file://${zip-codes}/jigyosyo.zip"
+      --replace-fail "https://www.post.japanpost.jp/zipcode/dl/kogaki/zip/ken_all.zip" "file://${jp-zip-codes}/ken_all.zip" \
+      --replace-fail "https://www.post.japanpost.jp/zipcode/dl/jigyosyo/zip/jigyosyo.zip" "file://${jp-zip-codes}/jigyosyo.zip"
   '';
 
-  preConfigure = ''
-    cd src
-  '';
+  preConfigure =
+    ''
+      cd src
+    ''
+    + lib.optionalString (dictionaries != [ ]) ''
+      cat ${ut-dictionary}/mozcdic-ut.txt >> data/dictionary_oss/dictionary00.txt
+    '';
 
   buildAttrs.installPhase = ''
     runHook preInstall
@@ -78,10 +94,6 @@ buildBazelPackage rec {
     runHook postInstall
   '';
 
-  passthru = {
-    inherit zip-codes;
-  };
-
   meta = with lib; {
     isIbusEngine = true;
     description = "Japanese input method from Google";
@@ -89,6 +101,10 @@ buildBazelPackage rec {
     homepage = "https://github.com/google/mozc";
     license = licenses.free;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ gebner ericsagnes pineapplehunter ];
+    maintainers = with maintainers; [
+      gebner
+      ericsagnes
+      pineapplehunter
+    ];
   };
 }
diff --git a/pkgs/by-name/mo/mozcdic-ut-alt-cannadic/package.nix b/pkgs/by-name/mo/mozcdic-ut-alt-cannadic/package.nix
new file mode 100644
index 000000000000..40295db08ce5
--- /dev/null
+++ b/pkgs/by-name/mo/mozcdic-ut-alt-cannadic/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "mozcdic-ut-alt-cannadic";
+  version = "0-unstable-2024-07-28";
+
+  src = fetchFromGitHub {
+    owner = "utuhiro78";
+    repo = "mozcdic-ut-alt-cannadic";
+    rev = "50fee0397b87fe508f9edd45bac56f5290d8ce66";
+    hash = "sha256-KKUj3d9yR2kTTTFbroZQs+OZR4KUyAUYE/X3z9/vQvM=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out mozcdic-ut-alt-cannadic.txt.tar.bz2
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "Mozc UT Alt-Cannadic Dictionary is a dictionary converted from Alt-Cannadic for Mozc.";
+    homepage = "https://github.com/utuhiro78/mozcdic-ut-alt-cannadic";
+    license = with lib.licenses; [
+      asl20
+      gpl2
+    ];
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides some zip files
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/mo/mozcdic-ut-edict2/package.nix b/pkgs/by-name/mo/mozcdic-ut-edict2/package.nix
new file mode 100644
index 000000000000..37551d7e0d04
--- /dev/null
+++ b/pkgs/by-name/mo/mozcdic-ut-edict2/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "mozcdic-ut-edict2";
+  version = "0-unstable-2024-07-28";
+
+  src = fetchFromGitHub {
+    owner = "utuhiro78";
+    repo = "mozcdic-ut-edict2";
+    rev = "b2112277d0d479b9218f42772356da3601b3e8cf";
+    hash = "sha256-DIIp8FooWxyHMrQmq+2KUGEmYHKy+H6NtHrvRldxXqc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out mozcdic-ut-edict2.txt.tar.bz2
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "Mozc UT EDICT2 Dictionary is a dictionary converted from EDICT2 for Mozc.";
+    homepage = "https://github.com/utuhiro78/mozcdic-ut-sudachidict";
+    license = with lib.licenses; [
+      asl20
+      cc-by-sa-40
+    ];
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides some zip files
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/mo/mozcdic-ut-jawiki/package.nix b/pkgs/by-name/mo/mozcdic-ut-jawiki/package.nix
new file mode 100644
index 000000000000..6dcc2f803106
--- /dev/null
+++ b/pkgs/by-name/mo/mozcdic-ut-jawiki/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "mozcdic-ut-jawiki";
+  version = "0-unstable-2024-08-23";
+
+  src = fetchFromGitHub {
+    owner = "utuhiro78";
+    repo = "mozcdic-ut-jawiki";
+    rev = "08814f70cc0cc9b0f4757fa46f40d918dfd7073d";
+    hash = "sha256-Sfw5cNXuno3aSUUPy9c3HODIu9cVSmskTwibD8w8jaM=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out mozcdic-ut-jawiki.txt.tar.bz2
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "Mozc UT Jawiki Dictionary is a dictionary generated from the Japanese Wikipedia for Mozc.";
+    homepage = "https://github.com/utuhiro78/mozcdic-ut-jawiki";
+    license = with lib.licenses; [
+      asl20
+      cc-by-sa-40
+    ];
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides some zip files
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/mo/mozcdic-ut-neologd/package.nix b/pkgs/by-name/mo/mozcdic-ut-neologd/package.nix
new file mode 100644
index 000000000000..686fe1e9fefb
--- /dev/null
+++ b/pkgs/by-name/mo/mozcdic-ut-neologd/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "mozcdic-ut-neologd";
+  version = "0-unstable-2024-07-28";
+
+  src = fetchFromGitHub {
+    owner = "utuhiro78";
+    repo = "mozcdic-ut-neologd";
+    rev = "b7035b88db25ad1a933f05a33f193711c6c3b2db";
+    hash = "sha256-JPTrWaDtdNs/Z0uLRwaS8Qc/l4/Y7NtwLanivyefXnk=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out mozcdic-ut-neologd.txt.tar.bz2
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "Mozc UT NEologd Dictionary is a dictionary converted from mecab-ipadic-NEologd for Mozc.";
+    homepage = "https://github.com/utuhiro78/mozcdic-ut-neologd";
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides some zip files
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/mo/mozcdic-ut-personal-names/package.nix b/pkgs/by-name/mo/mozcdic-ut-personal-names/package.nix
new file mode 100644
index 000000000000..96ee392c19d4
--- /dev/null
+++ b/pkgs/by-name/mo/mozcdic-ut-personal-names/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "mozcdic-ut-personal-names";
+  version = "0-unstable-2024-08-06";
+
+  src = fetchFromGitHub {
+    owner = "utuhiro78";
+    repo = "mozcdic-ut-personal-names";
+    rev = "79e1192de922bba74ce45f59fd591f1cd9a061f5";
+    hash = "sha256-5cfoeQS7H4uMRi7CQGFwdwDetihWKNVdFdON+/syvDA=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out mozcdic-ut-personal-names.txt.tar.bz2
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "Mozc UT Personal Name Dictionary is a dictionary for Mozc.";
+    homepage = "https://github.com/utuhiro78/mozcdic-ut-personal-names";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides some zip files
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/mo/mozcdic-ut-place-names/package.nix b/pkgs/by-name/mo/mozcdic-ut-place-names/package.nix
new file mode 100644
index 000000000000..b666aa027909
--- /dev/null
+++ b/pkgs/by-name/mo/mozcdic-ut-place-names/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "mozcdic-ut-place-names";
+  version = "0-unstable-2024-08-06";
+
+  src = fetchFromGitHub {
+    owner = "utuhiro78";
+    repo = "mozcdic-ut-place-names";
+    rev = "e606f2336b79bf0fa7fad3a0eb6a1a9baebafcb9";
+    hash = "sha256-IKn5ge8OiAidAmqr5+F7f4b1nUPa0ZT0n+5PfvkJKAs=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out mozcdic-ut-place-names.txt.tar.bz2
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "Mozc UT Place Name Dictionary is a dictionary converted from the Japan Post's ZIP code data for Mozc.";
+    homepage = "https://github.com/utuhiro78/mozcdic-ut-place-names";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides some zip files
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/mo/mozcdic-ut-skk-jisyo/package.nix b/pkgs/by-name/mo/mozcdic-ut-skk-jisyo/package.nix
new file mode 100644
index 000000000000..264490ad6126
--- /dev/null
+++ b/pkgs/by-name/mo/mozcdic-ut-skk-jisyo/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "mozcdic-ut-skk-jisyo";
+  version = "0-unstable-2024-07-27";
+
+  src = fetchFromGitHub {
+    owner = "utuhiro78";
+    repo = "mozcdic-ut-skk-jisyo";
+    rev = "7300f19e6a3f27334ed7af64589de8782549a13f";
+    hash = "sha256-LJ1rP+uyh8K3IWCgKMDYt0EwEDiQqQL+wBdQCFbZM/k=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out mozcdic-ut-skk-jisyo.txt.tar.bz2
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "Mozc UT SKK-JISYO Dictionary is a dictionary converted from SKK-JISYO for Mozc.";
+    homepage = "https://github.com/utuhiro78/mozcdic-ut-sudachidict";
+    license = with lib.licenses; [
+      asl20
+      gpl2Plus
+    ];
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides some zip files
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/mo/mozcdic-ut-sudachidict/package.nix b/pkgs/by-name/mo/mozcdic-ut-sudachidict/package.nix
new file mode 100644
index 000000000000..2ddb8fe5d2b5
--- /dev/null
+++ b/pkgs/by-name/mo/mozcdic-ut-sudachidict/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "mozcdic-ut-sudachidict";
+  version = "0-unstable-2024-07-28";
+
+  src = fetchFromGitHub {
+    owner = "utuhiro78";
+    repo = "mozcdic-ut-sudachidict";
+    rev = "a754f1fff5fded62cc066aa6be0ab0169059a144";
+    hash = "sha256-WzhWNpqtiG9TtFHEOSbHG1mbb4ak0zCkO13g9ZWqyBE=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out mozcdic-ut-sudachidict.txt.tar.bz2
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
+  };
+
+  meta = {
+    description = "Mozc UT SudachiDict Dictionary is a dictionary converted from SudachiDict for Mozc.";
+    homepage = "https://github.com/utuhiro78/mozcdic-ut-sudachidict";
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ pineapplehunter ];
+    platforms = lib.platforms.all;
+    # this does not need to be separately built
+    # it only provides some zip files
+    hydraPlatforms = [ ];
+  };
+}
diff --git a/pkgs/by-name/pw/pwru/package.nix b/pkgs/by-name/pw/pwru/package.nix
index f4d601ca9654..1b83c51649a4 100644
--- a/pkgs/by-name/pw/pwru/package.nix
+++ b/pkgs/by-name/pw/pwru/package.nix
@@ -1,19 +1,19 @@
 { lib
-, buildGoModule
+, buildGo123Module
 , fetchFromGitHub
 , clang
 , libpcap
 }:
 
-buildGoModule rec {
+buildGo123Module rec {
   pname = "pwru";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = "pwru";
     rev = "v${version}";
-    hash = "sha256-BjiFuM06YDlPyB578p2hweBay+4z0bOn7fUoxSvrDY8=";
+    hash = "sha256-HK8t+IaeFLuyqUTuVSShbO426uaFyZcr+jZyz0wo4jw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
index 4ddd35d6a701..93c4fab10a9c 100644
--- a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
+++ b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "roddhjav-apparmor-rules";
-  version = "0-unstable-2024-09-08";
+  version = "0-unstable-2024-09-19";
 
   src = fetchFromGitHub {
     owner = "roddhjav";
     repo = "apparmor.d";
-    rev = "2af1d06f183302037a10f62641b90ee644a65eaf";
-    hash = "sha256-L+Rj10SonsmoT7D1bi4VPMK//rdUEY7yhKX7eejo9+Q=";
+    rev = "7a3a1f7725d07cbd7d969bba2649f31d330d1e40";
+    hash = "sha256-6P3dNNcPGPux/Epr0vIrEEl7To399UzJfb4Uq8MT5p4=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/sw/sway-audio-idle-inhibit/package.nix b/pkgs/by-name/sw/sway-audio-idle-inhibit/package.nix
index 423c932f97d0..42c542185649 100644
--- a/pkgs/by-name/sw/sway-audio-idle-inhibit/package.nix
+++ b/pkgs/by-name/sw/sway-audio-idle-inhibit/package.nix
@@ -9,15 +9,15 @@
 , wayland-protocols
 , wayland-scanner
 }:
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sway-audio-idle-inhibit";
-  version = "unstable-2023-08-09";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "ErikReider";
     repo = "SwayAudioIdleInhibit";
-    rev = "c850bc4812216d03e05083c69aa05326a7fab9c7";
-    hash = "sha256-MKzyF5xY0uJ/UWewr8VFrK0y7ekvcWpMv/u9CHG14gs=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-6bdIkNosp/mzH5SiyK6Mox/z8kuFk5RLMmcFZ2VIi0g=";
   };
 
   nativeBuildInputs = [
@@ -36,5 +36,4 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ rafaelrc ];
     mainProgram = "sway-audio-idle-inhibit";
   };
-}
-
+})
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index e5ec962b6f71..585720d88978 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-ls2QFCiPkXMTiCHo8AXb5bFl118zjtuQAGl26c4huwU=";
-    "x86_64-linux" = "sha256-QjQjP5p2fpOLWNGiU2aMMs2bUEFOWfBZrbPGLTOFozg=";
-    "aarch64-linux" = "sha256-DMxGakZBJhLTgZp7B9lwxilr6yhDVDe/GQCMFaRTWe4=";
+    "universal-macos" = "sha256-VtKM+Fw1yy0KYvbtxerYykEbYv1hCc81ckfETH36vCU=";
+    "x86_64-linux" = "sha256-LtnLLWSOUtnp27swwCrRiA3NIKqrOD2MZylXKbLm2fw=";
+    "aarch64-linux" = "sha256-tmlizjB8BWtbQd75RoYvIsRxqEuj1V7Fx9LgArvphm4=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.15.5";
+  version = "0.16.2";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
@@ -49,7 +49,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://tigerbeetle.com/";
     description = "Financial accounting database designed to be distributed and fast";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ danielsidhion ];
+    maintainers = with lib.maintainers; [
+      danielsidhion
+      nwjsmith
+    ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/vl/vlc/package.nix b/pkgs/by-name/vl/vlc/package.nix
index 7ee00c3e30ec..427263200911 100644
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -10,7 +10,8 @@
 , faad2
 , fetchpatch
 , fetchurl
-, ffmpeg
+# Please unpin FFmpeg on the next upstream release.
+, ffmpeg_6
 , flac
 , fluidsynth
 , freefont_ttf
@@ -135,7 +136,7 @@ stdenv.mkDerivation (finalAttrs: {
     avahi
     dbus
     faad2
-    ffmpeg
+    ffmpeg_6
     flac
     fluidsynth
     fribidi
diff --git a/pkgs/by-name/wa/waybar/package.nix b/pkgs/by-name/wa/waybar/package.nix
index 196e739b2aa6..fe8143c2eb49 100644
--- a/pkgs/by-name/wa/waybar/package.nix
+++ b/pkgs/by-name/wa/waybar/package.nix
@@ -179,13 +179,15 @@ stdenv.mkDerivation (finalAttrs: {
       "pulseaudio" = pulseSupport;
       "rfkill" = rfkillSupport;
       "sndio" = sndioSupport;
-      "systemd" = false;
+      "systemd" = true;
       "tests" = runTests;
       "upower_glib" = upowerSupport;
       "wireplumber" = wireplumberSupport;
     })
     ++ lib.optional experimentalPatches (lib.mesonBool "experimental" true);
 
+  PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "${placeholder "out"}/lib/systemd/user";
+
   postPatch = ''
     substituteInPlace include/util/command.hpp \
       --replace-fail /bin/sh ${lib.getExe' bash "sh"}
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix
index 2c7e931a8a7b..b0834d839e67 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix
@@ -1,22 +1,22 @@
 # Generated by update.sh script
 {
-  "version" = "22.0.2";
+  "version" = "23.0.0";
   "hashes" = {
     "aarch64-linux" = {
-      sha256 = "1n8ln1xk60hjvr191pj1mpg793zmq531mkwx3la8d2x6by0lrji8";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-22.0.2/graalvm-community-jdk-22.0.2_linux-aarch64_bin.tar.gz";
+      sha256 = "084b0xwadq3ppk1wfn56z17hm02vlqq6vzhj7vmqcb8injym7bj2";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.0/graalvm-community-jdk-23.0.0_linux-aarch64_bin.tar.gz";
     };
     "x86_64-linux" = {
-      sha256 = "0krnfhcnvhm809prdbhalj86652zh5cgl14qvp8vq3sydbcivb7b";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-22.0.2/graalvm-community-jdk-22.0.2_linux-x64_bin.tar.gz";
+      sha256 = "180jhfkdbpkh5znwmncyxrfcyv0ail16l8vxz6371ws8ym5vc3j4";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.0/graalvm-community-jdk-23.0.0_linux-x64_bin.tar.gz";
     };
     "x86_64-darwin" = {
-      sha256 = "1r0j7n4k5ganyrxs9pxjwdbm8k9a20g6giixdhm9nmpan6hxs4h5";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-22.0.2/graalvm-community-jdk-22.0.2_macos-x64_bin.tar.gz";
+      sha256 = "1ajdkm0f1gckyss9rp7i7gay8dh25azr37pd8f36hif8wlwbhf0k";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.0/graalvm-community-jdk-23.0.0_macos-x64_bin.tar.gz";
     };
     "aarch64-darwin" = {
-      sha256 = "07qhym71n4v2744j9h6qx72v79mgkk266isn4kc9rgrb7x8gsgc8";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-22.0.2/graalvm-community-jdk-22.0.2_macos-aarch64_bin.tar.gz";
+      sha256 = "16rapbc1az3c8dx83961yjra1j1rwg3i24dvgwixqd2is7v8g9fd";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-23.0.0/graalvm-community-jdk-23.0.0_macos-aarch64_bin.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/compilers/openjdk/openjfx/11/default.nix b/pkgs/development/compilers/openjdk/openjfx/11/default.nix
index dcce1a2de6fc..22a3ba949984 100644
--- a/pkgs/development/compilers/openjdk/openjfx/11/default.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, pkgs, fetchFromGitHub, writeText, gradle_7, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_7-headless, python3, ruby
+, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg-headless, python3, ruby
 , openjdk11-bootstrap
 , withMedia ? true
 , withWebKit ? false
@@ -30,7 +30,7 @@ in stdenv.mkDerivation {
     ../backport-ffmpeg-7-support-jfx11.patch
   ];
 
-  buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_7-headless ];
+  buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg-headless ];
   nativeBuildInputs = [ gradle perl pkg-config cmake gperf python3 ruby ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/compilers/openjdk/openjfx/17/default.nix b/pkgs/development/compilers/openjdk/openjfx/17/default.nix
index de0f50dab7c7..e3ddceac7d43 100644
--- a/pkgs/development/compilers/openjdk/openjfx/17/default.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/17/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, pkgs, fetchFromGitHub, writeText, openjdk17_headless, gradle_7
 , pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg_7-headless, python3, ruby
+, ffmpeg-headless, python3, ruby
 , withMedia ? true
 , withWebKit ? false
 }:
@@ -30,7 +30,7 @@ in stdenv.mkDerivation {
     ../backport-ffmpeg-7-support-jfx11.patch
   ];
 
-  buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_7-headless ];
+  buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg-headless ];
   nativeBuildInputs = [ gradle perl pkg-config cmake gperf python3 ruby ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/compilers/openjdk/openjfx/21/default.nix b/pkgs/development/compilers/openjdk/openjfx/21/default.nix
index 5eed503cad11..5266f5d8072f 100644
--- a/pkgs/development/compilers/openjdk/openjfx/21/default.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/21/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, pkgs, fetchFromGitHub, writeText
 , openjdk21_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst
-, libXxf86vm, glib, alsa-lib, ffmpeg_7, python3, ruby
+, libXxf86vm, glib, alsa-lib, ffmpeg, python3, ruby
 , withMedia ? true
 , withWebKit ? false
 }:
@@ -29,7 +29,7 @@ in stdenv.mkDerivation {
     ../backport-ffmpeg-7-support-jfx21.patch
   ];
 
-  buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_7 ];
+  buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg ];
   nativeBuildInputs = [ gradle perl pkg-config cmake gperf python3 ruby ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/compilers/openjdk/openjfx/22/default.nix b/pkgs/development/compilers/openjdk/openjfx/22/default.nix
index a64cecb8c9b5..5dde07c2d022 100644
--- a/pkgs/development/compilers/openjdk/openjfx/22/default.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/22/default.nix
@@ -16,7 +16,7 @@
 , libXxf86vm
 , glib
 , alsa-lib
-, ffmpeg_7
+, ffmpeg
 , python3
 , ruby
 , withMedia ? true
@@ -51,7 +51,7 @@ in stdenv.mkDerivation {
     })
   ];
 
-  buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_7 ];
+  buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg ];
   nativeBuildInputs = [ gradle perl pkg-config cmake gperf python3 ruby ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/aiovlc/default.nix b/pkgs/development/python-modules/aiovlc/default.nix
index 8d65e9d29932..329cfee05257 100644
--- a/pkgs/development/python-modules/aiovlc/default.nix
+++ b/pkgs/development/python-modules/aiovlc/default.nix
@@ -14,16 +14,16 @@
 
 buildPythonPackage rec {
   pname = "aiovlc";
-  version = "0.4.4";
+  version = "0.5.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "MartinHjelmare";
     repo = "aiovlc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lIcArNodNeC6Wtmsir6f0SwgHlafC3lh72mLU4UGBtg=";
+    hash = "sha256-F66HGfbsve/jYyUEapUTVtLxaEIW63r3eNNk7mXOx5Y=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index dcce596ff377..decda0e7425b 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -37,7 +37,7 @@
 
 buildPythonPackage rec {
   pname = "litellm";
-  version = "1.44.22";
+  version = "1.47.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0F972vEW6ebbbaJ6c0db3cDtFJIRUN81Gp0OMo0fgqY=";
+    hash = "sha256-onFBSClB+FDbpc7VYkm2jks8G6L/LGsZq9tyFW+uHZc=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 22b86b063e7b..66a865f3c719 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -434,8 +434,8 @@ rec {
       "sha256-OgK+ZM7wn7Elp6xzb1YnZtYP+eARgsP+BIYkQb+E4YE=";
 
   mypy-boto3-dynamodb =
-    buildMypyBoto3Package "dynamodb" "1.35.15"
-      "sha256-epE4c+VCicXTkuGGJu83lxFTDUBu2ndmy36NARTCy8E=";
+    buildMypyBoto3Package "dynamodb" "1.35.24"
+      "sha256-Vb+Jeh0ONUV57bBQAfS8T0crlFK63Z2ySHbDG98/cqE=";
 
   mypy-boto3-dynamodbstreams =
     buildMypyBoto3Package "dynamodbstreams" "1.35.0"
@@ -574,8 +574,8 @@ rec {
       "sha256-RJEZBr3yU/lGEainrpidLsdYBvVOPMq3cIaIpsTAziQ=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.35.18"
-      "sha256-NwWn0GsbAhUy5JEUO0LJsfP0jwlnSle5L4E87RpDz+U=";
+    buildMypyBoto3Package "glue" "1.35.23"
+      "sha256-v0uU9EREtfyjbUazDMPPWod/qFITlQrWgnPJoghJXZk=";
 
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.35.0"
@@ -770,8 +770,8 @@ rec {
       "sha256-d6dz+lqK8RJ4kwDvK8WYf5U3N9oic5s+4KJgW08/3oU=";
 
   mypy-boto3-lambda =
-    buildMypyBoto3Package "lambda" "1.35.21"
-      "sha256-2iXqAE6PaXYQCKciSnfXwlYY3Bo+NdPi62ii3wmVLVk=";
+    buildMypyBoto3Package "lambda" "1.35.23"
+      "sha256-I70ebuqU7cWYu+rAWqaUbNNiXdq9JZL/dm8++OiJxao=";
 
   mypy-boto3-lex-models =
     buildMypyBoto3Package "lex-models" "1.35.0"
@@ -862,12 +862,12 @@ rec {
       "sha256-v+a4wc62OnHXJv5BHy/oq88FRn3piimmenmAPAOZXOA=";
 
   mypy-boto3-mediaconvert =
-    buildMypyBoto3Package "mediaconvert" "1.35.18"
-      "sha256-QyyTcFluG5S6CQFwxahz/a9zj40dqhiqyD+OuUn79/0=";
+    buildMypyBoto3Package "mediaconvert" "1.35.23"
+      "sha256-TvkVif/foJUzw1tPg8l2Y81neHUfxeZ9aDKtaIYKyRg=";
 
   mypy-boto3-medialive =
-    buildMypyBoto3Package "medialive" "1.35.20"
-      "sha256-/tGt9kyF1LtOzejqC9F4qStNZa67tXeUf9yxc6UXs6M=";
+    buildMypyBoto3Package "medialive" "1.35.23"
+      "sha256-emjiDJ1sZylGgclL3E90nYBwqJgJq20fQx2Ug4e9UbQ=";
 
   mypy-boto3-mediapackage =
     buildMypyBoto3Package "mediapackage" "1.35.0"
@@ -942,8 +942,8 @@ rec {
       "sha256-J1tV2BTUW2Bu8ll+Yn0cJpUpMCCCkfqUEAnis/OJxrA=";
 
   mypy-boto3-neptune =
-    buildMypyBoto3Package "neptune" "1.35.0"
-      "sha256-YCZMfLWkodIcSsbOmzR6GfR+kMFzcbondo9FyzQexBo=";
+    buildMypyBoto3Package "neptune" "1.35.24"
+      "sha256-2hgamfnf5SPWo8R15FWJHO37IC0y2oLDTHsb/oPjArE=";
 
   mypy-boto3-neptunedata =
     buildMypyBoto3Package "neptunedata" "1.35.0"
@@ -1074,8 +1074,8 @@ rec {
       "sha256-mtpp+ro3b7tOrN4TrWr8BjLzaPo264ty8Sng6wtciMs=";
 
   mypy-boto3-quicksight =
-    buildMypyBoto3Package "quicksight" "1.35.9"
-      "sha256-DDn++YB0SylR31Sv5bBcbghb5aa4b1vjsDMMVJy5gn0=";
+    buildMypyBoto3Package "quicksight" "1.35.23"
+      "sha256-ljk8uB17CDpGT9TIAncsrZBGbI9UrPAPU3HQ9Cz2zYE=";
 
   mypy-boto3-ram =
     buildMypyBoto3Package "ram" "1.35.0"
@@ -1174,8 +1174,8 @@ rec {
       "sha256-P2Yg3qvcdAcjY+uwPg2DpTgT6ZXb1XYCOeu4bVfgFKI=";
 
   mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.35.15"
-      "sha256-16P85xGM98ExA6Cphg2nTviTLu6CF/Hj3/sZ7P3OkJo=";
+    buildMypyBoto3Package "sagemaker" "1.35.24"
+      "sha256-VLhoJLXWsQIWK+N9KC2nNi2VDC5SUeN/FJJJLefWix8=";
 
   mypy-boto3-sagemaker-a2i-runtime =
     buildMypyBoto3Package "sagemaker-a2i-runtime" "1.35.0"
@@ -1194,8 +1194,8 @@ rec {
       "sha256-ES0cThhoMFB4NKVTzThXATiicjq+MTRunsDCMC6YPbI=";
 
   mypy-boto3-sagemaker-metrics =
-    buildMypyBoto3Package "sagemaker-metrics" "1.35.0"
-      "sha256-zixUmBhFo3joSB0UUWRjNbbrpgt/21OyfOzDkn2Y7kg=";
+    buildMypyBoto3Package "sagemaker-metrics" "1.35.24"
+      "sha256-WBwXrGv877AZv6wIxYGwFNTVofmcmTqv/hqXAcraDyQ=";
 
   mypy-boto3-sagemaker-runtime =
     buildMypyBoto3Package "sagemaker-runtime" "1.35.15"
@@ -1426,12 +1426,12 @@ rec {
       "sha256-Om/TFPBZh3xr0inpGzCpvTNij9DTPq8dV1ikX8g4YtE=";
 
   mypy-boto3-workspaces =
-    buildMypyBoto3Package "workspaces" "1.35.8"
-      "sha256-fZ2uc54mRcpO/66YvK+com7nRPG61ldnM7tPAznUFk8=";
+    buildMypyBoto3Package "workspaces" "1.35.24"
+      "sha256-j7eEUDul3+bMWN80+gH+/gFBWqQHVQ2yN+YBx5VFZNM=";
 
   mypy-boto3-workspaces-web =
-    buildMypyBoto3Package "workspaces-web" "1.35.0"
-      "sha256-+96DquSZ2c+ijrO1ZBo6y4YohHsOQwGPCwvvxGnoO7A=";
+    buildMypyBoto3Package "workspaces-web" "1.35.23"
+      "sha256-/uATkqLhOOPKwegWRQOSRGeM2tmq+VbWY3t780IvSek=";
 
   mypy-boto3-xray =
     buildMypyBoto3Package "xray" "1.35.0"
diff --git a/pkgs/development/python-modules/mypy-boto3/update.sh b/pkgs/development/python-modules/mypy-boto3/update.sh
index 5a6e63dde074..53622b479ed4 100755
--- a/pkgs/development/python-modules/mypy-boto3/update.sh
+++ b/pkgs/development/python-modules/mypy-boto3/update.sh
@@ -229,7 +229,7 @@ packages=(
   mypy-boto3-migrationhub-config
   mypy-boto3-migrationhuborchestrator
   mypy-boto3-migrationhubstrategy
-  mypy-boto3-mobile
+  # mypy-boto3-mobile
   mypy-boto3-mq
   mypy-boto3-mturk
   mypy-boto3-mwaa
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index 811aa8ce8243..6ad0fe9b1dc6 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -12,6 +12,7 @@
   setuptools,
   setuptools-scm,
   playwright-driver,
+  nixosTests,
   nodejs,
 }:
 
@@ -93,10 +94,14 @@ buildPythonPackage rec {
 
   passthru = {
     inherit driver;
-    tests = {
-      driver = playwright-driver;
-      browsers = playwright-driver.browsers;
-    };
+    tests =
+      {
+        driver = playwright-driver;
+        browsers = playwright-driver.browsers;
+      }
+      // lib.optionalAttrs stdenv.isLinux {
+        inherit (nixosTests) playwright-python;
+      };
     updateScript = ./update.sh;
   };
 
diff --git a/pkgs/development/python-modules/playwright/update.sh b/pkgs/development/python-modules/playwright/update.sh
index eb04e619feb6..2b283d3b607a 100755
--- a/pkgs/development/python-modules/playwright/update.sh
+++ b/pkgs/development/python-modules/playwright/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused common-updater-scripts jq prefetch-npm-deps
+#!nix-shell -i bash -p curl gnused common-updater-scripts jq prefetch-npm-deps unzip
 set -euo pipefail
 
 root="$(dirname "$(readlink -f "$0")")"
@@ -11,18 +11,60 @@ version=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s https://api.github.c
 setup_py_url="https://github.com/microsoft/playwright-python/raw/v${version}/setup.py"
 driver_version=$(curl -Ls "$setup_py_url" | grep '^driver_version =' | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+')
 
+# TODO: skip if update-source-version reported the same version
 update-source-version playwright-driver "$driver_version"
 update-source-version python3Packages.playwright "$version"
 
-# Update package-lock.json files for all npm deps that are built in playwright
-# TODO: skip if update-source-version reported the same version
-driver_file="$root/../../web/playwright/driver.nix"
+playwright_dir="$root/../../web/playwright"
+driver_file="$playwright_dir/driver.nix"
 repo_url_prefix="https://github.com/microsoft/playwright/raw"
-temp_dir=$(mktemp -d)
 
+temp_dir=$(mktemp -d)
 trap 'rm -rf "$temp_dir"' EXIT
 
 
+
+# update binaries of browsers, used by playwright.
+replace_sha() {
+  sed -i "s|$2 = \".\{44,52\}\"|$2 = \"$3\"|" "$1"
+}
+
+prefetch_browser() {
+    nix store prefetch-file --json --hash-type sha256 --unpack "$1" | jq -r .hash
+}
+
+update_browser() {
+    name="$1"
+    suffix="$2"
+    arm64_suffix="${3:-$2-arm64}"
+    revision="$(jq -r ".browsers.$name.revision" "$playwright_dir/browsers.json")"
+    replace_sha "$playwright_dir/$name.nix" "x86_64-linux" \
+        "$(prefetch_browser "https://playwright.azureedge.net/builds/$name/$revision/$name-$suffix.zip")"
+    replace_sha "$playwright_dir/$name.nix" "aarch64-linux" \
+        "$(prefetch_browser "https://playwright.azureedge.net/builds/$name/$revision/$name-$arm64_suffix.zip")"
+}
+
+curl -fsSl \
+    "https://raw.githubusercontent.com/microsoft/playwright/v${driver_version}/packages/playwright-core/browsers.json" \
+    | jq '
+      .comment = "This file is kept up to date via update.sh"
+      | .browsers |= (
+        [.[]
+          | select(.installByDefault) | del(.installByDefault)]
+          | map({(.name): . | del(.name)})
+          | add
+      )
+    ' > "$playwright_dir/browsers.json"
+
+# We currently use Chromium from nixpkgs, so we don't need to download it here
+# Likewise, darwin can be ignored here atm as we are using an impure install anyway.
+update_browser "firefox" "ubuntu-22.04"
+update_browser "webkit" "ubuntu-22.04"
+update_browser "ffmpeg" "linux"
+
+
+# Update package-lock.json files for all npm deps that are built in playwright
+
 # Function to download `package-lock.json` for a given source path and update hash
 update_hash() {
     local source_root_path="$1"
@@ -30,7 +72,6 @@ update_hash() {
 
     # Formulate download URL
     local download_url="${repo_url_prefix}/v${driver_version}${source_root_path}/package-lock.json"
-
     # Download package-lock.json to temporary directory
     curl -fsSL -o "${temp_dir}/package-lock.json" "$download_url"
 
@@ -45,7 +86,6 @@ update_hash() {
 while IFS= read -r source_root_line; do
     [[ "$source_root_line" =~ sourceRoot ]] || continue
     source_root_path=$(echo "$source_root_line" | sed -e 's/^.*"${src.name}\(.*\)";.*$/\1/')
-
     # Extract the current npmDepsHash for this sourceRoot
     existing_hash=$(grep -A1 "$source_root_line" "$driver_file" | grep 'npmDepsHash' | sed -e 's/^.*npmDepsHash = "\(.*\)";$/\1/')
 
diff --git a/pkgs/development/python-modules/protobuf/4.nix b/pkgs/development/python-modules/protobuf/4.nix
index 9d10deca12a5..d58e21d195a1 100644
--- a/pkgs/development/python-modules/protobuf/4.nix
+++ b/pkgs/development/python-modules/protobuf/4.nix
@@ -124,8 +124,6 @@ buildPythonPackage {
     homepage = "https://developers.google.com/protocol-buffers/";
     license = licenses.bsd3;
     maintainers = with maintainers; [ knedlsepp ];
-    # Tests are currently failing because backend is unavailable and causes tests to fail
-    # Progress tracked in https://github.com/NixOS/nixpkgs/pull/264902
     broken = lib.versionAtLeast protobuf.version "26";
   };
 }
diff --git a/pkgs/development/python-modules/pyais/default.nix b/pkgs/development/python-modules/pyais/default.nix
index d8a2da0da957..2ed166b9a78b 100644
--- a/pkgs/development/python-modules/pyais/default.nix
+++ b/pkgs/development/python-modules/pyais/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyais";
-  version = "2.7.2";
+  version = "2.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "M0r13n";
     repo = "pyais";
     rev = "refs/tags/v${version}";
-    hash = "sha256-itv5tVM8ff2gNUDGxY4aMKrpJVgfwPB/FWYog+CzJY4=";
+    hash = "sha256-qggtwz6cSz5mLKLVY0i7gWs09EcOoxlWWQoHZv+TDc8=";
   };
 
   build-system = [ setuptools ];
@@ -42,7 +42,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module for decoding and encoding AIS messages (AIVDM/AIVDO)";
     homepage = "https://github.com/M0r13n/pyais";
-    changelog = "https://github.com/M0r13n/pyais/blob/${version}/CHANGELOG.txt";
+    changelog = "https://github.com/M0r13n/pyais/blob/v${version}/CHANGELOG.txt";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/selenium-wire/default.nix b/pkgs/development/python-modules/selenium-wire/default.nix
index defbf1fe8fdc..b301c953bb71 100644
--- a/pkgs/development/python-modules/selenium-wire/default.nix
+++ b/pkgs/development/python-modules/selenium-wire/default.nix
@@ -36,9 +36,9 @@ buildPythonPackage rec {
     hash = "sha256-KgaDxHS0dAK6CT53L1qqx1aORMmkeaiXAUtGC82hiIQ=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     blinker
     brotli
     certifi
@@ -73,5 +73,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/wkeeling/selenium-wire/blob/${version}/HISTORY.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    broken = versionAtLeast blinker.version "1.8";
   };
 }
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 578ad26adf10..cb1b5724f800 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1234";
+  version = "3.0.1235";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-tQKF/MF2WdLp4vOJS3psiBklwzM9R3jo7SSLhZWOjBU=";
+    hash = "sha256-OiifyoM9rMnLK3B/xdC/0grSLUKH1IZh4CDI1Yur3/8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/timezonefinder/default.nix b/pkgs/development/python-modules/timezonefinder/default.nix
index 94482d760678..e869dc7ddc85 100644
--- a/pkgs/development/python-modules/timezonefinder/default.nix
+++ b/pkgs/development/python-modules/timezonefinder/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "timezonefinder";
-  version = "6.5.2";
+  version = "6.5.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,16 +23,17 @@ buildPythonPackage rec {
     owner = "jannikmi";
     repo = "timezonefinder";
     rev = "refs/tags/${version}";
-    hash = "sha256-2vQk7aSsyyh3mN1l4A5Y5yASJ2V7e4fegsOExGwyhGA=";
+    hash = "sha256-8fDKgM6LVe7aJgD4UfTpg0EjKGuudzYsmqniocozmAE=";
   };
 
-  nativeBuildInputs = [
-    cffi
+  build-system = [
     poetry-core
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [ cffi ];
+
+  dependencies = [
     cffi
     h3
     numpy
@@ -53,9 +54,9 @@ buildPythonPackage rec {
   meta = with lib; {
     changelog = "https://github.com/jannikmi/timezonefinder/blob/${version}/CHANGELOG.rst";
     description = "Module for finding the timezone of any point on earth (coordinates) offline";
-    mainProgram = "timezonefinder";
     homepage = "https://github.com/MrMinimal64/timezonefinder";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "timezonefinder";
   };
 }
diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index 7806daf5ff7d..e0e666d7ffa7 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "5.3.12";
+  version = "5.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = "uproot5";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ozrC/I6CNHE/7S0ioL+ED9Vk6q0v3i4lNxv7ipvProk=";
+    hash = "sha256-iCyGG4y7cnJqHEaqpzFc/LjWiLZw3HArU5hDtEyLgFo=";
   };
 
   build-system = [
@@ -49,6 +49,7 @@ buildPythonPackage rec {
     numpy
     fsspec
     packaging
+    xxhash
   ];
 
   nativeCheckInputs = [
@@ -57,7 +58,6 @@ buildPythonPackage rec {
     pytest-timeout
     rangehttpserver
     scikit-hep-testdata
-    xxhash
   ];
 
   preCheck = ''
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 9b4935a788f0..e08e84ee7f22 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -294,15 +294,30 @@ let
         "test-child-process-exec-env"
         "test-child-process-uid-gid"
         "test-fs-write-stream-eagain"
+        "test-https-client-checkServerIdentity"
         "test-https-foafssl"
+        "test-https-strict"
         "test-process-euid-egid"
         "test-process-initgroups"
         "test-process-setgroups"
         "test-process-uid-gid"
         "test-setproctitle"
+        "test-tls-cert-regression"
         "test-tls-cli-max-version-1.3"
         "test-tls-client-auth"
+        "test-tls-client-getephemeralkeyinfo"
+        "test-tls-client-mindhsize"
+        "test-tls-client-renegotiation-13"
+        "test-tls-client-verify"
+        "test-tls-getcipher"
+        "test-tls-junk-closes-server"
+        "test-tls-junk-server"
+        "test-tls-multi-key"
+        "test-tls-multiple-cas-as-string"
+        "test-tls-peer-certificate-encoding"
+        "test-tls-set-ciphers"
         "test-tls-sni-option"
+        "test-tls-sni-server-client"
         # This is a bit weird, but for some reason fs watch tests fail with
         # sandbox.
         "test-fs-promises-watch"
diff --git a/pkgs/development/web/playwright/browsers.json b/pkgs/development/web/playwright/browsers.json
new file mode 100644
index 000000000000..e7fb77faf27e
--- /dev/null
+++ b/pkgs/development/web/playwright/browsers.json
@@ -0,0 +1,28 @@
+{
+  "comment": "This file is kept up to date via update.sh",
+  "browsers": {
+    "chromium": {
+      "revision": "1134",
+      "browserVersion": "129.0.6668.29"
+    },
+    "firefox": {
+      "revision": "1463",
+      "browserVersion": "130.0"
+    },
+    "webkit": {
+      "revision": "2070",
+      "revisionOverrides": {
+        "mac10.14": "1446",
+        "mac10.15": "1616",
+        "mac11": "1816",
+        "mac11-arm64": "1816",
+        "mac12": "2009",
+        "mac12-arm64": "2009"
+      },
+      "browserVersion": "18.0"
+    },
+    "ffmpeg": {
+      "revision": "1010"
+    }
+  }
+}
diff --git a/pkgs/development/web/playwright/chromium.nix b/pkgs/development/web/playwright/chromium.nix
new file mode 100644
index 000000000000..0da9e66641c1
--- /dev/null
+++ b/pkgs/development/web/playwright/chromium.nix
@@ -0,0 +1,29 @@
+{
+  runCommand,
+  makeWrapper,
+  makeFontsConf,
+  chromium,
+  ...
+}:
+let
+  fontconfig = makeFontsConf {
+    fontDirectories = [ ];
+  };
+in
+runCommand "playwright-chromium"
+  {
+    nativeBuildInputs = [
+      makeWrapper
+    ];
+  }
+  ''
+    mkdir -p $out/chrome-linux
+
+    # See here for the Chrome options:
+    # https://github.com/NixOS/nixpkgs/issues/136207#issuecomment-908637738
+    # We add --disable-gpu to be able to run in gpu-less environments such
+    # as headless nixos test vms.
+    makeWrapper ${chromium}/bin/chromium $out/chrome-linux/chrome \
+      --set-default SSL_CERT_FILE /etc/ssl/certs/ca-bundle.crt \
+      --set-default FONTCONFIG_FILE ${fontconfig}
+  ''
diff --git a/pkgs/development/web/playwright/driver.nix b/pkgs/development/web/playwright/driver.nix
index 107bf6281a44..f05d5fd6c081 100644
--- a/pkgs/development/web/playwright/driver.nix
+++ b/pkgs/development/web/playwright/driver.nix
@@ -7,6 +7,8 @@
   jq,
   nodejs,
   fetchFromGitHub,
+  linkFarm,
+  callPackage,
   makeFontsConf,
   makeWrapper,
   runCommand,
@@ -16,6 +18,14 @@ let
   inherit (stdenv.hostPlatform) system;
 
   throwSystem = throw "Unsupported system: ${system}";
+  suffix =
+    {
+      x86_64-linux = "linux";
+      aarch64-linux = "linux-arm64";
+      x86_64-darwin = "mac";
+      aarch64-darwin = "mac-arm64";
+    }
+    .${system} or throwSystem;
 
   version = "1.47.0";
 
@@ -148,6 +158,7 @@ let
     '';
 
     passthru = {
+      browsersJSON = (lib.importJSON ./browsers.json).browsers;
       browsers =
         {
           x86_64-linux = browsers-linux { };
@@ -209,37 +220,36 @@ let
   browsers-linux =
     {
       withChromium ? true,
+      withFirefox ? true,
+      withWebkit ? true,
+      withFfmpeg ? true,
     }:
     let
-      fontconfig = makeFontsConf { fontDirectories = [ ]; };
+      browsers =
+        lib.optionals withChromium [ "chromium" ]
+        ++ lib.optionals withFirefox [ "firefox" ]
+        ++ lib.optionals withWebkit [ "webkit" ]
+        ++ lib.optionals withFfmpeg [ "ffmpeg" ];
     in
-    runCommand ("playwright-browsers" + lib.optionalString withChromium "-chromium")
-      {
-        nativeBuildInputs = [
-          makeWrapper
-          jq
-        ];
-      }
-      (
-        ''
-          BROWSERS_JSON=${playwright-core}/browsers.json
-        ''
-        + lib.optionalString withChromium ''
-          CHROMIUM_REVISION=$(jq -r '.browsers[] | select(.name == "chromium").revision' $BROWSERS_JSON)
-          mkdir -p $out/chromium-$CHROMIUM_REVISION/chrome-linux
-
-          # See here for the Chrome options:
-          # https://github.com/NixOS/nixpkgs/issues/136207#issuecomment-908637738
-          makeWrapper ${chromium}/bin/chromium $out/chromium-$CHROMIUM_REVISION/chrome-linux/chrome \
-            --set SSL_CERT_FILE /etc/ssl/certs/ca-bundle.crt \
-            --set FONTCONFIG_FILE ${fontconfig}
-        ''
-        + ''
-          FFMPEG_REVISION=$(jq -r '.browsers[] | select(.name == "ffmpeg").revision' $BROWSERS_JSON)
-          mkdir -p $out/ffmpeg-$FFMPEG_REVISION
-          ln -s ${ffmpeg}/bin/ffmpeg $out/ffmpeg-$FFMPEG_REVISION/ffmpeg-linux
-        ''
-      );
+    linkFarm "playwright-browsers" (
+      lib.listToAttrs (
+        map (
+          name:
+          let
+            value = playwright-core.passthru.browsersJSON.${name};
+          in
+          lib.nameValuePair
+            # TODO check platform for revisionOverrides
+            "${name}-${value.revision}"
+            (
+              callPackage ./${name}.nix {
+                inherit suffix system throwSystem;
+                inherit (value) revision;
+              }
+            )
+        ) browsers
+      )
+    );
 in
 {
   playwright-core = playwright-core;
diff --git a/pkgs/development/web/playwright/ffmpeg.nix b/pkgs/development/web/playwright/ffmpeg.nix
new file mode 100644
index 000000000000..f541031019ed
--- /dev/null
+++ b/pkgs/development/web/playwright/ffmpeg.nix
@@ -0,0 +1,17 @@
+{
+  fetchzip,
+  suffix,
+  revision,
+  system,
+  throwSystem,
+}:
+fetchzip {
+  url = "https://playwright.azureedge.net/builds/ffmpeg/${revision}/ffmpeg-${suffix}.zip";
+  stripRoot = false;
+  hash =
+    {
+      x86_64-linux = "sha256-FEm62UvMv0h6Sav93WmbPLw3CW1L1xg4nD26ca5ol38=";
+      aarch64-linux = "sha256-jtQ+NS++VHRiKoIV++PIxEnyVnYtVwUyNlSILKSH4A4=";
+    }
+    .${system} or throwSystem;
+}
diff --git a/pkgs/development/web/playwright/firefox.nix b/pkgs/development/web/playwright/firefox.nix
new file mode 100644
index 000000000000..0f404bee2899
--- /dev/null
+++ b/pkgs/development/web/playwright/firefox.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  firefox-bin,
+  suffix,
+  revision,
+  system,
+  throwSystem,
+}:
+let
+  suffix' =
+    if lib.hasPrefix "linux" suffix then "ubuntu-22.04" + (lib.removePrefix "linux" suffix) else suffix;
+in
+stdenv.mkDerivation {
+  name = "playwright-firefox";
+  src = fetchzip {
+    url = "https://playwright.azureedge.net/builds/firefox/${revision}/firefox-${suffix'}.zip";
+    hash =
+      {
+        x86_64-linux = "sha256-Hd9LlSRLW51gDoFyszqvg46Q/sMizLRsVKAN9atbwsw=";
+        aarch64-linux = "sha256-SEXH3gLOfNjOcnNWQjQ5gaaow47veVs0BoTYSgXw+24=";
+      }
+      .${system} or throwSystem;
+  };
+
+  inherit (firefox-bin.unwrapped)
+    nativeBuildInputs
+    buildInputs
+    runtimeDependencies
+    appendRunpaths
+    patchelfFlags
+    ;
+
+  buildPhase = ''
+    mkdir -p $out/firefox
+    cp -R . $out/firefox
+  '';
+}
diff --git a/pkgs/development/web/playwright/webkit.nix b/pkgs/development/web/playwright/webkit.nix
new file mode 100644
index 000000000000..5c8062bb6f70
--- /dev/null
+++ b/pkgs/development/web/playwright/webkit.nix
@@ -0,0 +1,135 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchFromGitHub,
+  makeWrapper,
+  autoPatchelfHook,
+  patchelfUnstable,
+
+  at-spi2-atk,
+  cairo,
+  flite,
+  fontconfig,
+  freetype,
+  glib,
+  glib-networking,
+  gst_all_1,
+  harfbuzz,
+  harfbuzzFull,
+  icu70,
+  lcms,
+  libdrm,
+  libepoxy,
+  libevent,
+  libgcc,
+  libgcrypt,
+  libgpg-error,
+  libjpeg8,
+  libopus,
+  libpng,
+  libsoup_3,
+  libtasn1,
+  libvpx,
+  libwebp,
+  libwpe,
+  libwpe-fdo,
+  libxkbcommon,
+  libxml2,
+  libxslt,
+  mesa,
+  sqlite,
+  systemdLibs,
+  wayland-scanner,
+  woff2,
+  zlib,
+  suffix,
+  revision,
+  system,
+  throwSystem,
+}:
+let
+  suffix' =
+    if lib.hasPrefix "linux" suffix then "ubuntu-22.04" + (lib.removePrefix "linux" suffix) else suffix;
+  libvpx' = libvpx.overrideAttrs (
+    finalAttrs: previousAttrs: {
+      version = "1.12.0";
+      src = fetchFromGitHub {
+        owner = "webmproject";
+        repo = finalAttrs.pname;
+        rev = "v${finalAttrs.version}";
+        sha256 = "sha256-9SFFE2GfYYMgxp1dpmL3STTU2ea1R5vFKA1L0pZwIvQ=";
+      };
+    }
+  );
+
+in
+stdenv.mkDerivation {
+  name = "playwright-webkit";
+  src = fetchzip {
+    url = "https://playwright.azureedge.net/builds/webkit/${revision}/webkit-${suffix'}.zip";
+    stripRoot = false;
+    hash =
+      {
+        x86_64-linux = "sha256-pHYGQYwu47jdOAD+/mLrP6Dd+2aDMHENddVwAu0uEfI=";
+        aarch64-linux = "sha256-0UeYWjeFnQ8yVa3juWg7Z7VF1GDbP4pJ9OUJRbv1OJw=";
+      }
+      .${system} or throwSystem;
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    patchelfUnstable
+    makeWrapper
+  ];
+  buildInputs = [
+    at-spi2-atk
+    cairo
+    flite
+    fontconfig.lib
+    freetype
+    glib
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer
+    harfbuzz
+    harfbuzzFull
+    icu70
+    lcms
+    libdrm
+    libepoxy
+    libevent
+    libgcc.lib
+    libgcrypt
+    libgpg-error
+    libjpeg8
+    libopus
+    libpng
+    libsoup_3
+    libtasn1
+    libwebp
+    libwpe
+    libwpe-fdo
+    libvpx'
+    libxml2
+    libxslt
+    mesa
+    sqlite
+    systemdLibs
+    wayland-scanner
+    woff2.lib
+    libxkbcommon
+    zlib
+  ];
+
+  patchelfFlags = [ "--no-clobber-old-sections" ];
+  buildPhase = ''
+    cp -R . $out
+
+    # remove unused gtk browser
+    rm -rf $out/minibrowser-gtk
+
+    wrapProgram $out/minibrowser-wpe/bin/MiniBrowser \
+      --prefix GIO_EXTRA_MODULES ":" "${glib-networking}/lib/gio/modules/"
+  '';
+}
diff --git a/pkgs/misc/opensbi/default.nix b/pkgs/misc/opensbi/default.nix
index 172e28c05669..dae75b546cae 100644
--- a/pkgs/misc/opensbi/default.nix
+++ b/pkgs/misc/opensbi/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opensbi";
-  version = "1.5";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "riscv-software-src";
     repo = "opensbi";
     rev = "v${version}";
-    hash = "sha256-vK14P97FcaVz4GDr/0055Z6s/k7BPKPQGZ/MQxbOWu0=";
+    hash = "sha256-qb3orbmZJtesIBj9F2OX+BhrlctymZA1ZIbV/GVa0lU=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/graphics/xcur2png/default.nix b/pkgs/tools/graphics/xcur2png/default.nix
index 5d5396aea273..6419752cac8a 100644
--- a/pkgs/tools/graphics/xcur2png/default.nix
+++ b/pkgs/tools/graphics/xcur2png/default.nix
@@ -1,4 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, libpng, xorg }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  pkg-config,
+  libpng,
+  xorg,
+}:
 
 stdenv.mkDerivation rec {
   pname = "xcur2png";
@@ -11,6 +19,17 @@ stdenv.mkDerivation rec {
     sha256 = "0858wn2p14bxpv9lvaz2bz1rk6zk0g8zgxf8iy595m8fqv4q2fya";
   };
 
+  patches = [
+    # https://github.com/eworm-de/xcur2png/pull/3
+    ./malloc.diff
+
+    # fix byte overflows due to off-by-one error
+    (fetchpatch {
+      url = "https://github.com/eworm-de/xcur2png/commit/aa035462d950fab35d322cb87fd2f0d702251e82.patch";
+      hash = "sha256-hlmJ/bcDSl1ADs0jp+JrAgAaMzielUSRVPad+plnSZg=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
   ];
diff --git a/pkgs/tools/graphics/xcur2png/malloc.diff b/pkgs/tools/graphics/xcur2png/malloc.diff
new file mode 100644
index 000000000000..88f4e8e17ba9
--- /dev/null
+++ b/pkgs/tools/graphics/xcur2png/malloc.diff
@@ -0,0 +1,33 @@
+--- a/xcur2png.c
++++ b/xcur2png.c
+@@ -16,7 +16,10 @@
+ /* Todo: atoi error handling */
+ /* help is -h in manual */
+
++#if HAVE_CONFIG_H
+ #include <config.h>
++#endif
++#undef malloc
+
+ #define _ATFILE_SOURCE
+ #include <stdio.h>
+@@ -34,6 +37,19 @@
+ #include <png.h>
+ #include <X11/Xcursor/Xcursor.h>
+
++
++void *malloc ();
++
++/* Allocate an N-byte block of memory from the heap.
++   If N is zero, allocate a 1-byte block.  */
++
++void* rpl_malloc (size_t n)
++{
++  if (n == 0)
++    n = 1;
++  return malloc (n);
++}
++
+ #define PNG_SETJMP_NOT_SUPPORTED 1
+ 
+ #define PROGRESS_SHARPS 50 /* total number of progress sharps */
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8a883f079d7a..d261728a53c2 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -263,6 +263,7 @@ mapAliases ({
   crossLibcStdenv = stdenvNoLibc; # Added 2024-09-06
   cryptowatch-desktop = throw "Cryptowatch Desktop was sunset on September 30th 2023 and has been removed from nixpkgs"; # Added 2023-12-22
   clash = throw "'clash' has been removed, upstream gone. Consider using 'mihomo' instead."; # added 2023-11-10
+  clash-verge = throw "'clash-verge' has been removed, as it was broken and unmaintained. Consider using 'clash-verge-rev' or 'clash-nyanpasu' instead"; # Added 2024-09-17
   clasp = clingo; # added 2022-12-22
   claws-mail-gtk3 = claws-mail; # Added 2021-07-10
   clucene_core_1 = throw "'clucene_core_1' has been renamed to/replaced by 'clucene_core'"; # Added 2023-12-09
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bf87e8845465..0313ae3d8c06 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6544,7 +6544,18 @@ with pkgs;
 
     m17n = callPackage ../tools/inputmethods/ibus-engines/ibus-m17n { };
 
-    mozc = callPackage ../tools/inputmethods/ibus-engines/ibus-mozc { };
+    inherit mozc;
+
+    mozc-ut = mozc.override { dictionaries = [
+      mozcdic-ut-alt-cannadic
+      mozcdic-ut-edict2
+      mozcdic-ut-jawiki
+      mozcdic-ut-neologd
+      mozcdic-ut-personal-names
+      mozcdic-ut-place-names
+      mozcdic-ut-skk-jisyo
+      mozcdic-ut-sudachidict
+    ]; };
 
     openbangla-keyboard = libsForQt5.callPackage ../applications/misc/openbangla-keyboard { withIbusSupport = true; };
 
@@ -8352,9 +8363,7 @@ with pkgs;
 
   gvproxy = callPackage ../tools/networking/gvproxy { };
 
-  gyroflow = qt6Packages.callPackage ../applications/video/gyroflow {
-    ffmpeg = ffmpeg_7;
-  };
+  gyroflow = qt6Packages.callPackage ../applications/video/gyroflow { };
 
   gzip = callPackage ../tools/compression/gzip { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b212c64afdfd..44bab16b9d66 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -10770,10 +10770,10 @@ with self; {
 
   GetoptLong = buildPerlPackage {
     pname = "Getopt-Long";
-    version = "2.54";
+    version = "2.58";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JV/JV/Getopt-Long-2.54.tar.gz";
-      hash = "sha256-WEujyZuy1rNBN1IS+bh0YT9wbPsBzuIbiiZ2qYq5hf4=";
+      url = "mirror://cpan/authors/id/J/JV/JV/Getopt-Long-2.58.tar.gz";
+      hash = "sha256-EwXtRuoh95QwTpeqPc06OFGQWXhenbdBXa8sIYUGxWk=";
     };
     meta = {
       description = "Extended processing of command line options";
@@ -10789,7 +10789,7 @@ with self; {
       hash = "sha256-QQ6EIRSpy/0/06X9JIqWcDwHxdh5sqpfnbAzPyMnYBY=";
     };
     buildInputs = [ CPANMetaCheck TestFatal TestWarnings ];
-    propagatedBuildInputs = [ ParamsValidate SubExporter ];
+    propagatedBuildInputs = [ ParamsValidate SubExporter GetoptLong ];
     meta = {
       description = "Getopt::Long, but simpler and more powerful";
       homepage = "https://github.com/rjbs/Getopt-Long-Descriptive";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6cb4a31554a2..63442fbcbd31 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10623,7 +10623,7 @@ self: super: with self; {
 
   # Protobuf 4.x
   protobuf4 = callPackage ../development/python-modules/protobuf/4.nix {
-    protobuf = pkgs.protobuf;
+    protobuf = pkgs.protobuf_25;
   };
 
   # Protobuf 5.x