diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 69f0c7048c03..4a4dba0fdafb 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -321,6 +321,9 @@
 - `nix.channel.enable = false` no longer implies `nix.settings.nix-path = []`.
   Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overriden by the `NIX_PATH` configuration variable.
 
+- Buildkite Agents are now each running in their own private `/tmp`.
+  To return to the old behaviour, set `systemd.services.buildkite-agent-${name}.serviceConfig.PrivateTmp = false;`.
+
 ## Detailed migration information {#sec-release-24.11-migration}
 
 ### `sound` options removal {#sec-release-24.11-migration-sound}
diff --git a/nixos/modules/services/continuous-integration/buildkite-agents.nix b/nixos/modules/services/continuous-integration/buildkite-agents.nix
index fc30172c6499..eb7b7a170785 100644
--- a/nixos/modules/services/continuous-integration/buildkite-agents.nix
+++ b/nixos/modules/services/continuous-integration/buildkite-agents.nix
@@ -205,6 +205,8 @@ in
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/buildkite-agent start --config ${cfg.dataDir}/buildkite-agent.cfg";
         User = "buildkite-agent-${name}";
+        # Workaround https://github.com/buildkite/agent/issues/2916
+        PrivateTmp = lib.mkDefault true;
         RestartSec = 5;
         Restart = "on-failure";
         TimeoutSec = 10;
diff --git a/nixos/modules/services/networking/wg-quick.nix b/nixos/modules/services/networking/wg-quick.nix
index 2062f2806d79..369c5a939765 100644
--- a/nixos/modules/services/networking/wg-quick.nix
+++ b/nixos/modules/services/networking/wg-quick.nix
@@ -57,6 +57,15 @@ let
         '';
       };
 
+      generatePrivateKeyFile = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Automatically generate a private key with
+          {command}`wg genkey`, at the privateKeyFile location.
+        '';
+      };
+
       privateKeyFile = mkOption {
         example = "/private/wireguard_key";
         type = with types; nullOr str;
@@ -218,9 +227,24 @@ let
 
   writeScriptFile = name: text: ((pkgs.writeShellScriptBin name text) + "/bin/${name}");
 
+  generatePrivateKeyScript = privateKeyFile: ''
+    set -e
+
+    # If the parent dir does not already exist, create it.
+    # Otherwise, does nothing, keeping existing permissions intact.
+    mkdir -p --mode 0755 "${dirOf privateKeyFile}"
+
+    if [ ! -f "${privateKeyFile}" ]; then
+      # Write private key file with atomically-correct permissions.
+      (set -e; umask 077; wg genkey > "${privateKeyFile}")
+    fi
+  '';
+
   generateUnit = name: values:
     assert assertMsg (values.configFile != null || ((values.privateKey != null) != (values.privateKeyFile != null))) "Only one of privateKey, configFile or privateKeyFile may be set";
+    assert assertMsg (values.generatePrivateKeyFile == false || values.privateKeyFile != null) "generatePrivateKeyFile requires privateKeyFile to be set";
     let
+      generateKeyScriptFile = if values.generatePrivateKeyFile then writeScriptFile "generatePrivateKey.sh" (generatePrivateKeyScript values.privateKeyFile) else null;
       preUpFile = if values.preUp != "" then writeScriptFile "preUp.sh" values.preUp else null;
       postUp =
             optional (values.privateKeyFile != null) "wg set ${name} private-key <(cat ${values.privateKeyFile})" ++
@@ -247,6 +271,7 @@ let
         optionalString (values.mtu != null) "MTU = ${toString values.mtu}\n" +
         optionalString (values.privateKey != null) "PrivateKey = ${values.privateKey}\n" +
         optionalString (values.listenPort != null) "ListenPort = ${toString values.listenPort}\n" +
+        optionalString (generateKeyScriptFile != null) "PreUp = ${generateKeyScriptFile}\n" +
         optionalString (preUpFile != null) "PreUp = ${preUpFile}\n" +
         optionalString (postUpFile != null) "PostUp = ${postUpFile}\n" +
         optionalString (preDownFile != null) "PreDown = ${preDownFile}\n" +
diff --git a/pkgs/applications/audio/spotify/linux.nix b/pkgs/applications/audio/spotify/linux.nix
index 84ca34d48d60..5ca8e481fa2d 100644
--- a/pkgs/applications/audio/spotify/linux.nix
+++ b/pkgs/applications/audio/spotify/linux.nix
@@ -14,14 +14,14 @@ let
   # If an update breaks things, one of those might have valuable info:
   # https://aur.archlinux.org/packages/spotify/
   # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.2.40.599.g606b7f29";
+  version = "1.2.42.290.g242057a2";
   # To get the latest stable revision:
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
   # To get general information:
   # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
   # More examples of api usage:
   # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "77";
+  rev = "78";
 
   deps = [
     alsa-lib
@@ -88,7 +88,7 @@ stdenv.mkDerivation {
   src = fetchurl {
     name = "spotify-${version}-${rev}.snap";
     url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    hash = "sha512-XQyZbU6dJh87jEdEvks2D0EpMkjPSKROl8kurSaiPs2z4FZ2SxM2DUvHwtKemKKScdTISm3jh6wyHXwPhB8eNQ==";
+    hash = "sha512-3kT7SA2Q1OxgDa5duivIiHaxcROBAFjDnTx6rw2ya6o5yOVygseS02zBgWg2Qd8jq0721KbYC83u9M+MWtWhhA==";
   };
 
   nativeBuildInputs = [ wrapGAppsHook3 makeShellWrapper squashfsTools ];
diff --git a/pkgs/applications/backup/restic-integrity/default.nix b/pkgs/applications/backup/restic-integrity/default.nix
index ac0c5b99d121..41bb1c318ff5 100644
--- a/pkgs/applications/backup/restic-integrity/default.nix
+++ b/pkgs/applications/backup/restic-integrity/default.nix
@@ -5,17 +5,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "restic-integrity";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitea {
     domain = "git.nwex.de";
     owner = "networkException";
     repo = "restic-integrity";
     rev = version;
-    hash = "sha256-mryHePqfEawW/vLgxfm+eh4oSbcALhxvRid4kF9klTs=";
+    hash = "sha256-5F2nFSyqrT4JEzUb1NVk0g2LqgwRix3rfflXJ3pttvo=";
   };
 
-  cargoHash = "sha256-0BvB1ijsppblEC2PNLfVt+sgM4wTdSLZ/RoDH4JrQy4=";
+  cargoHash = "sha256-97M7dqgTzl2ysegavwzf6xtYKum/s9cq4vgaIQR7IA0=";
 
   meta = with lib; {
     description = "CLI tool to check the integrity of a restic repository without unlocking it";
diff --git a/pkgs/applications/emulators/retroarch/hashes.json b/pkgs/applications/emulators/retroarch/hashes.json
index 5879f15afa46..ab4ac151db71 100644
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -15,10 +15,10 @@
         "src": {
             "owner": "libretro",
             "repo": "libretro-atari800",
-            "rev": "8bfa3b80f6a2db365dfd1e8a6c06b7b0844327cf",
-            "hash": "sha256-sUv1NT5aOwULOCC9vCrlRXcvVdlfZk9dmPMZg2NGAPg="
+            "rev": "50141a6bf1a069abd86dd8c53aa4031f3f7cfbd1",
+            "hash": "sha256-pS5nvU+2eZ7We0ySN+Te6+Y3uuro5bz2FTPuLgvNCl4="
         },
-        "version": "unstable-2024-05-18"
+        "version": "unstable-2024-07-25"
     },
     "beetle-gba": {
         "fetcher": "fetchFromGitHub",
@@ -55,20 +55,20 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-pce-libretro",
-            "rev": "372184b402852f9b3a3f1663ea676ffa910f6e48",
-            "hash": "sha256-Q15EKf2dKpmnBRx25KDAeiOOXBNUbNKNBBh16diV6tQ="
+            "rev": "03935421be14680a4aed799388e74ecab8167311",
+            "hash": "sha256-frZ+IYULs5QYGBSw8sp+kEM9U/ykEzZPM/XLdqPr7rs="
         },
-        "version": "unstable-2024-07-19"
+        "version": "unstable-2024-07-26"
     },
     "beetle-pce-fast": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "beetle-pce-fast-libretro",
-            "rev": "c68ee949ab5a572c0c6541d25b66e997174a09f6",
-            "hash": "sha256-6hGO1GGFMBJxhuGXeUulilSN5zAqYjls/b4pHnoyc0Y="
+            "rev": "7b7ad0760860f792f3f3a2768230397504e3f66d",
+            "hash": "sha256-KQLvjpUiA/p9wrUIrxd6jJddk91MEF7B58agPALmu/A="
         },
-        "version": "unstable-2024-07-19"
+        "version": "unstable-2024-07-26"
     },
     "beetle-pcfx": {
         "fetcher": "fetchFromGitHub",
@@ -85,10 +85,10 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-psx-libretro",
-            "rev": "9c3f4dbe9650c31fa690db230243b4eae9a2f131",
-            "hash": "sha256-9TJzviamGLClhS6Y9OUm1HfEtLEREaOzgaIXX4GSMYs="
+            "rev": "38d74b0b769e3a72e8ea574389b9cc80994e9cc8",
+            "hash": "sha256-1Lm7TYCTEx6hNa2tjSNWHJMh3vFhyR1oqwiuyVIu+XM="
         },
-        "version": "unstable-2024-07-19"
+        "version": "unstable-2024-07-26"
     },
     "beetle-saturn": {
         "fetcher": "fetchFromGitHub",
@@ -115,10 +115,10 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-supergrafx-libretro",
-            "rev": "0e6ce96d68c1565d1cfb2d64841970f19f3cfb66",
-            "hash": "sha256-4LEvzyIpWBH0jfTuJaRxYe1fKdrw7/Mes6UlkxNyS58="
+            "rev": "1943f676c70a9ceeee51f05a7422093c525e83ca",
+            "hash": "sha256-ANoD95tfBtJyOokB0fdBmFA+d+iJQ4EcFTZyBNXbfMY="
         },
-        "version": "unstable-2024-06-28"
+        "version": "unstable-2024-07-26"
     },
     "beetle-vb": {
         "fetcher": "fetchFromGitHub",
@@ -165,10 +165,10 @@
         "src": {
             "owner": "libretro",
             "repo": "bsnes-libretro",
-            "rev": "5c0115612ea84fefeebf7219c32006cd32b575ec",
-            "hash": "sha256-veOlN2OV6Xxl+GmH7T/DdTVCmEiSgK72QHgT9TGu89w="
+            "rev": "d63ec98054477d4be3398d108b6ec0a7b162349a",
+            "hash": "sha256-XONLqioPLJJkZMQ5e2wz0N2vMwZxsPG5FYkDeZgk+JU="
         },
-        "version": "unstable-2024-07-19"
+        "version": "unstable-2024-07-26"
     },
     "bsnes-hd": {
         "fetcher": "fetchFromGitHub",
@@ -246,10 +246,10 @@
         "src": {
             "owner": "schellingb",
             "repo": "dosbox-pure",
-            "rev": "1476308debfad87ce377c6cfe62db1398774cd65",
-            "hash": "sha256-Op+3UQoPSHOSBqOdebp9wjgTt0apTLuwlcbooPqMvLU="
+            "rev": "2b7544492940e2208147f2b44cf6209b97ce8493",
+            "hash": "sha256-felA+nEqtbgW7BJ/kJPrfqGmLcMsv8jqN4nWA4uCvOE="
         },
-        "version": "unstable-2024-07-20"
+        "version": "unstable-2024-08-01"
     },
     "easyrpg": {
         "fetcher": "fetchFromGitHub",
@@ -287,10 +287,10 @@
         "src": {
             "owner": "libretro",
             "repo": "fbneo",
-            "rev": "143452d376faf0090d40241c71cc9b532b0605e0",
-            "hash": "sha256-6IzxMuCX6w5QXR7B3Lz/7GfgIwHQ9MaSakb0bHwG5KU="
+            "rev": "6fbc30a830c54304c16ba7dccd3aca2cb30bb473",
+            "hash": "sha256-zVrkyVskf3VIwEz50gG+z0Zp5SUeMEAX2ls9lKcyLXY="
         },
-        "version": "unstable-2024-07-12"
+        "version": "unstable-2024-07-27"
     },
     "fceumm": {
         "fetcher": "fetchFromGitHub",
@@ -307,11 +307,11 @@
         "src": {
             "owner": "flyinghead",
             "repo": "flycast",
-            "rev": "0b6b8b3753fb219cb0e3a1d55d2ec7948f2e4842",
-            "hash": "sha256-3U7JTNROxi71NpHERlUzGb8i9oaGdsXDtqgClqcO0kM=",
+            "rev": "45bf218df428123f739714ef4e65e1b96c0959b7",
+            "hash": "sha256-TB8cSwvwyfG3tNsMf2qXDZGMTuwnNeRlhyH8fzDnvQM=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-07-19"
+        "version": "unstable-2024-07-29"
     },
     "fmsx": {
         "fetcher": "fetchFromGitHub",
@@ -348,20 +348,20 @@
         "src": {
             "owner": "libretro",
             "repo": "gambatte-libretro",
-            "rev": "0cf1a421a2123205559c666853cdf9112382fa46",
-            "hash": "sha256-CjcmRMk+fL1WwiiNcFCv8FGeoPl/Ib9jMvXJRzApPNU="
+            "rev": "607c19668426b8945011fd11e25cfce7849f7e13",
+            "hash": "sha256-8uLKOxLRWbczUkhsXqjXVH7SDlIqrp0LNdzVjmxbP2U="
         },
-        "version": "unstable-2024-07-19"
+        "version": "unstable-2024-07-26"
     },
     "genesis-plus-gx": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "Genesis-Plus-GX",
-            "rev": "7f3efe569177702f77d1cdfadba6568f82e30112",
-            "hash": "sha256-ABuWTzN0AvHXiODMSVU0lVYr44WGWpjtEuFfe0y6URw="
+            "rev": "5567ea92c6a1b76d72fedaee679a997056038001",
+            "hash": "sha256-4NWA963BSJ9OTq8Lv1v8P3kYwY+mBTQ8uN6zspmkUB4="
         },
-        "version": "unstable-2024-07-20"
+        "version": "unstable-2024-07-26"
     },
     "gpsp": {
         "fetcher": "fetchFromGitHub",
@@ -439,10 +439,10 @@
         "src": {
             "owner": "libretro",
             "repo": "mame2003-plus-libretro",
-            "rev": "eb6295935f5be566fb3aa34dae2856596c37c214",
-            "hash": "sha256-eYHbPi6rWvwrTPhwGGs2OmvKgs1Ks3SF+6/wgPyvUJw="
+            "rev": "8ffa3c773640956c02dfbcd7d5dc8e3a12fc6773",
+            "hash": "sha256-OzLXcXvrgNQa81n4z8MFEApqsYL4y1e9Cuela5kE34c="
         },
-        "version": "unstable-2024-07-20"
+        "version": "unstable-2024-07-28"
     },
     "mame2010": {
         "fetcher": "fetchFromGitHub",
@@ -631,10 +631,10 @@
         "src": {
             "owner": "libretro",
             "repo": "pcsx_rearmed",
-            "rev": "e87127f85b42b8ca4273f7962cdef8c30c2e2090",
-            "hash": "sha256-X8fcy83wGKuaYI91VTSbbOeURKNPFYbUpMliw8hat3Q="
+            "rev": "19f1a7d2de3a136810a84341db77d4f5eb8f3361",
+            "hash": "sha256-RnR6KuZa5cxw/Z+ZIZ2RhNrPRWlZupR9TDUhc2puBqQ="
         },
-        "version": "unstable-2024-07-16"
+        "version": "unstable-2024-07-24"
     },
     "picodrive": {
         "fetcher": "fetchFromGitHub",
@@ -652,22 +652,22 @@
         "src": {
             "owner": "jpd002",
             "repo": "Play-",
-            "rev": "fea21169c4d1fd6aa19f8a5c2ef960af2a3be554",
-            "hash": "sha256-GoLETeWLvtP+DMGkFL/nDhjt85P0pgr1/NTNif1PCCo=",
+            "rev": "06517ef014305c8579f38fa7574ef3685181d037",
+            "hash": "sha256-b9lsxVRjkV85OzPE5569ZbeShji2kudbcz3amd9aXnA=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-07-19"
+        "version": "unstable-2024-07-29"
     },
     "ppsspp": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "hrydgard",
             "repo": "ppsspp",
-            "rev": "5edd02ef0a81fec0b9f0e6423cbea96123af083f",
-            "hash": "sha256-h+hXuRT/0UizOeJgdG4kqWk3mzl6Y88IdHDK/2XqsPA=",
+            "rev": "52cf10274c342c1dd97d91c273b109d5c859d227",
+            "hash": "sha256-/XDrbaMyDJgyCZd/5vYkAXw7OvIXx+oagbwqL51uCFI=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-07-20"
+        "version": "unstable-2024-07-29"
     },
     "prboom": {
         "fetcher": "fetchFromGitHub",
@@ -744,20 +744,20 @@
         "src": {
             "owner": "libretro",
             "repo": "smsplus-gx",
-            "rev": "081d956e07188ba9204595c9f15d34b2b0664796",
-            "hash": "sha256-oVzoVvbqxbyZytXLdnlpeYZDefRRG8mxBFdhgFCPPHM="
+            "rev": "29cd96822f5e9b71a8ccfa13a38c6c37ed83ccac",
+            "hash": "sha256-jdA5PDqwYCJ0V1MxTBJr2Lsm8r9jvZ+l2g2HgrhfP30="
         },
-        "version": "unstable-2024-07-20"
+        "version": "unstable-2024-07-22"
     },
     "snes9x": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "snes9xgit",
             "repo": "snes9x",
-            "rev": "881eeaed9a0d7b6ce9b16b094f25101785f0e39e",
-            "hash": "sha256-ZDp/k9TuaVUp9xH9rvzfpbB0VSJbCFRbkMcnR/oPWLM="
+            "rev": "e92b93ca9cd7936134abe0b90975bc9fc009fbf0",
+            "hash": "sha256-zsGf+3J0k7It/QEg/9SIZrb4yg8K8/6KXUE1/dK83yg="
         },
-        "version": "unstable-2024-07-14"
+        "version": "unstable-2024-07-29"
     },
     "snes9x2002": {
         "fetcher": "fetchFromGitHub",
@@ -794,10 +794,10 @@
         "src": {
             "owner": "stella-emu",
             "repo": "stella",
-            "rev": "69b300b6f9d46c4f9caa2df1f848a74163cd1173",
-            "hash": "sha256-8TgbZzmuwDUn23zR1/XKIOdrLwgzq18oMS1KOhSs1oQ="
+            "rev": "56e6bd69bc070f1d31e13610f1a7ebb1ca8bacbf",
+            "hash": "sha256-M2pyCeBQ3N51E6Xy+NvnQwAcuAuXL8sRvZm3nuyeFv0="
         },
-        "version": "unstable-2024-06-30"
+        "version": "unstable-2024-07-30"
     },
     "stella2014": {
         "fetcher": "fetchFromGitHub",
@@ -814,10 +814,10 @@
         "src": {
             "owner": "libretro",
             "repo": "swanstation",
-            "rev": "b17b0e4348b3e21f67f84568b12a26a95d0631dc",
-            "hash": "sha256-Q+sDPXclfKnPFmMjgxtlY6/iK6ZnegwQ3uNoqUhDkoo="
+            "rev": "37cd87e14ca09ac1b558e5b2c7db4ad256865bbb",
+            "hash": "sha256-dNIxlTPoY4S6VMtTN22ti3DE4aU/8XN/XhAo3DMNR/E="
         },
-        "version": "unstable-2024-07-15"
+        "version": "unstable-2024-07-24"
     },
     "tgbdual": {
         "fetcher": "fetchFromGitHub",
diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
index 23194ee9ed25..43bf5af6267c 100644
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.6.4";
+  version = "0.7.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-dBehxqr/UCXIQDMrGFN6ID+v0NYi50JTHuML3su2O0A=";
+    hash = "sha256-bn+5LBqZNwrhVX0KfXNBS00rE+BybN/NJmL4lu/oua0=";
   };
 
-  cargoHash = "sha256-wI7yqRvaszBP4OtlWbWIZ9RLf5y7dx2KufYLaK+PWps=";
+  cargoHash = "sha256-ssjLfNPP8g+2IOv0AQb+Soe/0e1H2LoqFSpmljj/z3o=";
 
   meta = with lib; {
     description = "Simple tui to view & control docker containers";
diff --git a/pkgs/applications/networking/cluster/kubectl-view-secret/default.nix b/pkgs/applications/networking/cluster/kubectl-view-secret/default.nix
index 7f22523e46bc..5dbc4513a9f0 100644
--- a/pkgs/applications/networking/cluster/kubectl-view-secret/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-view-secret/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubectl-view-secret";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "elsesiy";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-5X5rOoERx6HoG3cOBpYm12anMXXDjTtHZzQOOlJeJSs=";
+    hash = "sha256-0/gz3fquqZCRbHQrBBLXs2rwQPkyktEcBMQ46GfMauo=";
   };
 
-  vendorHash = "sha256-oQvmS05nev+ypfkKAlTN+JbzPux5iAzHsojW8SxtB70=";
+  vendorHash = "sha256-OJboCLa+ntKOhmQ9zs5aF/mio5OFsr/f/IS0PAwAi6U=";
 
   subPackages = [ "./cmd/" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/wavebox/default.nix b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
index d1df9c108143..eb4a9de8425d 100644
--- a/pkgs/applications/networking/instant-messengers/wavebox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
@@ -1,94 +1,247 @@
-{ alsa-lib
-, autoPatchelfHook
-, fetchurl
-, gtk3
-, gtk4
-, libnotify
-, copyDesktopItems
-, makeDesktopItem
-, makeWrapper
-, mesa
-, nss
-, lib
-, libdrm
-, qt5
-, stdenv
-, udev
-, xdg-utils
-, xorg
+{
+  lib,
+  stdenv,
+  patchelf,
+  makeWrapper,
+  fetchurl,
+  writeScript,
+
+  # Libraries
+  glib,
+  fontconfig,
+  freetype,
+  pango,
+  cairo,
+  libX11,
+  libXi,
+  atk,
+  nss,
+  nspr,
+  libXcursor,
+  libXext,
+  libXfixes,
+  libXrender,
+  libXScrnSaver,
+  libXcomposite,
+  libxcb,
+  alsa-lib,
+  libXdamage,
+  libXtst,
+  libXrandr,
+  libxshmfence,
+  expat,
+  cups,
+  dbus,
+  gtk3,
+  gtk4,
+  gdk-pixbuf,
+  gcc-unwrapped,
+  at-spi2-atk,
+  at-spi2-core,
+  libkrb5,
+  libdrm,
+  libglvnd,
+  mesa,
+  libxkbcommon,
+  pipewire,
+  wayland,
+
+  coreutils,
+
+  # command line arguments which are always set e.g "--disable-gpu"
+  commandLineArgs ? "",
+
+  systemd,
+
+  # Loaded at runtime.
+  libexif,
+  pciutils,
+
+  liberation_ttf,
+  curl,
+  util-linux,
+  xdg-utils,
+  wget,
+  flac,
+  harfbuzz,
+  icu,
+  libpng,
+  libopus,
+  snappy,
+  speechd,
+  bzip2,
+  libcap,
+
+  # Necessary for USB audio devices.
+  pulseSupport ? true,
+  libpulseaudio,
+
+  gsettings-desktop-schemas,
+
+  # Allow video acceleration via VA-API to be disabled on systems where is doesn't
+  # work reliably (--enable-features=VaapiVideoDecoder)
+  libvaSupport ? true,
+  libva,
+
+  # For Vulkan support (--enable-features=Vulkan)
+  addDriverRunpath,
 }:
 
-stdenv.mkDerivation rec {
+let
+  opusWithCustomModes = libopus.override { withCustomModes = true; };
+
+  deps =
+    [
+      glib
+      fontconfig
+      freetype
+      pango
+      cairo
+      libX11
+      libXi
+      atk
+      nss
+      nspr
+      libXcursor
+      libXext
+      libXfixes
+      libXrender
+      libXScrnSaver
+      libXcomposite
+      libxcb
+      alsa-lib
+      libXdamage
+      libXtst
+      libXrandr
+      libxshmfence
+      expat
+      cups
+      dbus
+      gdk-pixbuf
+      gcc-unwrapped.lib
+      systemd
+      libexif
+      pciutils
+      liberation_ttf
+      curl
+      util-linux
+      wget
+      flac
+      harfbuzz
+      icu
+      libpng
+      opusWithCustomModes
+      snappy
+      speechd
+      bzip2
+      libcap
+      at-spi2-atk
+      at-spi2-core
+      libkrb5
+      libdrm
+      libglvnd
+      mesa
+      coreutils
+      libxkbcommon
+      pipewire
+      wayland
+    ]
+    ++ lib.optional pulseSupport libpulseaudio
+    ++ lib.optional libvaSupport libva
+    ++ [
+      gtk3
+      gtk4
+    ];
+
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "wavebox";
-  version = "10.124.17-2";
+  version = "10.127.10-2";
 
   src = fetchurl {
-    url = "https://download.wavebox.app/stable/linux/tar/Wavebox_${version}.tar.gz";
-    sha256 = "sha256-RS1/zs/rFWsj29BrT8Mb2IXgy9brBsQypxfvnd7pKl0=";
+    url = "https://download.wavebox.app/stable/linux/deb/amd64/wavebox_${finalAttrs.version}_amd64.deb";
+    hash = "sha256-x095V2UhRJfPmmG+4/i7I9AnCU4WVrw0b71nEu73uew=";
   };
 
-  # don't remove runtime deps
-  dontPatchELF = true;
-  # ignore optional Qt 6 shim
-  autoPatchelfIgnoreMissingDeps = [ "libQt6Widgets.so.6" "libQt6Gui.so.6" "libQt6Core.so.6" ];
-
-  nativeBuildInputs = [ autoPatchelfHook makeWrapper qt5.wrapQtAppsHook copyDesktopItems ];
-
-  buildInputs = with xorg; [
-    libXdmcp
-    libXScrnSaver
-    libXtst
-    libxshmfence
-    libXdamage
-  ] ++ [
-    alsa-lib
+  nativeBuildInputs = [
+    patchelf
+    makeWrapper
+  ];
+  buildInputs = [
+    gsettings-desktop-schemas # needed for GSETTINGS_SCHEMAS_PATH
+    glib
     gtk3
-    nss
-    libdrm
-    mesa
-    gtk4
-    qt5.qtbase
   ];
 
-  runtimeDependencies = [ (lib.getLib udev) libnotify gtk4 ];
+  unpackPhase = ''
+    ar x $src
+    tar xf data.tar.xz
+  '';
 
-  desktopItems = [
-    (makeDesktopItem rec {
-      name = "Wavebox";
-      exec = "wavebox";
-      icon = "wavebox";
-      desktopName = name;
-      genericName = name;
-      categories = [ "Network" "WebBrowser" ];
-    })
-  ];
+  rpath = lib.makeLibraryPath deps + ":" + lib.makeSearchPathOutput "lib" "lib64" deps;
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin $out/opt/wavebox
-    cp -r * $out/opt/wavebox
+    exe=$out/bin/wavebox
 
-    # provide icon for desktop item
-    mkdir -p $out/share/icons/hicolor/128x128/apps
-    ln -s $out/opt/wavebox/product_logo_128.png $out/share/icons/hicolor/128x128/apps/wavebox.png
+    mkdir -p $out/bin $out/share
+
+    cp -a opt/* $out/share
+    cp -a usr/share/* $out/share
+
+
+    substituteInPlace $out/share/wavebox.io/wavebox/wavebox-launcher \
+      --replace-fail 'CHROME_WRAPPER' 'WRAPPER'
+    substituteInPlace $out/share/applications/wavebox.desktop \
+      --replace-fail /opt/wavebox.io/wavebox/wavebox-launcher $exe
+    substituteInPlace $out/share/menu/wavebox.menu \
+      --replace-fail /opt $out/share \
+      --replace-fail $out/share/wavebox.io/wavebox/wavebox $exe
+
+    for icon_file in $out/share/wavebox.io/wavebox/product_logo_[0-9]*.png; do
+      num_and_suffix="''${icon_file##*logo_}"
+      icon_size="''${num_and_suffix%.*}"
+      logo_output_prefix="$out/share/icons/hicolor"
+      logo_output_path="$logo_output_prefix/''${icon_size}x''${icon_size}/apps"
+      mkdir -p "$logo_output_path"
+      mv "$icon_file" "$logo_output_path/wavebox.png"
+    done
+
+    makeWrapper "$out/share/wavebox.io/wavebox/wavebox" "$exe" \
+      --prefix LD_LIBRARY_PATH : "$rpath" \
+      --prefix PATH            : "${lib.makeBinPath deps}" \
+      --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
+      --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
+      --set CHROME_WRAPPER "wavebox" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags ${lib.escapeShellArg commandLineArgs}
+
+    for elf in $out/share/wavebox.io/wavebox/{wavebox,chrome-sandbox,chrome_crashpad_handler}; do
+      patchelf --set-rpath $rpath $elf
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $elf
+    done
 
     runHook postInstall
   '';
 
-  postFixup = ''
-    makeWrapper $out/opt/wavebox/wavebox-launcher $out/bin/wavebox \
-    --prefix PATH : ${xdg-utils}/bin
-  '';
+  passthru = {
+    updateScript = writeScript "update-wavebox.sh" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p nix-update curl jq
 
-  passthru.updateScript = ./update.sh;
-
-  meta = with lib; {
-    description = "Wavebox messaging application";
-    homepage = "https://wavebox.io";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ rawkode ];
-    platforms = [ "x86_64-linux" ];
-    hydraPlatforms = [ ];
+      version=$(curl "https://download.wavebox.app/stable/linux/latest.json" | jq --raw-output '.["urls"]["deb"] | match("https://download.wavebox.app/stable/linux/deb/amd64/wavebox_(.+)_amd64.deb").captures[0]["string"]')
+      nix-update wavebox --version "$version"
+    '';
   };
-}
+
+  meta = {
+    description = "Wavebox Productivity Browser";
+    homepage = "https://wavebox.io";
+    license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ flexiondotorg ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "wavebox";
+  };
+})
diff --git a/pkgs/applications/networking/instant-messengers/wavebox/update.sh b/pkgs/applications/networking/instant-messengers/wavebox/update.sh
deleted file mode 100755
index 316f8bfbb7ec..000000000000
--- a/pkgs/applications/networking/instant-messengers/wavebox/update.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix-update curl jq
-
-version=$(curl "https://download.wavebox.app/stable/linux/latest.json" | jq --raw-output '.["urls"]["tar"] | match("https://download.wavebox.app/stable/linux/tar/Wavebox_(.+).tar.gz").captures[0]["string"]')
-nix-update wavebox --version "$version"
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
index b52c91e4e1ed..5f7103886ccc 100644
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "cri-o";
-  version = "1.30.3";
+  version = "1.30.4";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     rev = "v${version}";
-    hash = "sha256-Cv76S2Ylsjzjc6rjCcRJyFjrIrm76I5pqDa1FI+Oq9s=";
+    hash = "sha256-PfG5RlUmMGMduTApdlHoI+4kdRprvWXeXZDkd6brVkM=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/ai/aiken/package.nix b/pkgs/by-name/ai/aiken/package.nix
new file mode 100644
index 000000000000..3ebdb3706b55
--- /dev/null
+++ b/pkgs/by-name/ai/aiken/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  fetchFromGitHub,
+  darwin,
+  stdenv,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "aiken";
+  version = "1.0.29-alpha"; # all releases are 'alpha'
+
+  src = fetchFromGitHub {
+    owner = "aiken-lang";
+    repo = "aiken";
+    rev = "v${version}";
+    hash = "sha256-fikXypc9HKil4Ut4jdgQtTTy/CHEogEpDprwdTgd9b4=";
+  };
+
+  cargoHash = "sha256-UWDPXnq2k/PoogrfuW93ieRW8AfuNIEfri9Jo6gHkdg=";
+
+  buildInputs =
+    [ openssl ]
+    ++ lib.optionals stdenv.isDarwin (
+      with darwin.apple_sdk.frameworks;
+      [
+        Security
+        CoreServices
+        SystemConfiguration
+      ]
+    );
+
+  nativeBuildInputs = [ pkg-config ];
+
+  meta = {
+    description = "Modern smart contract platform for Cardano";
+    homepage = "https://aiken-lang.org";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ t4ccer ];
+    mainProgram = "aiken";
+  };
+}
diff --git a/pkgs/by-name/bi/bitwarden-cli/package.nix b/pkgs/by-name/bi/bitwarden-cli/package.nix
index 8338dd233587..654fa709a9b1 100644
--- a/pkgs/by-name/bi/bitwarden-cli/package.nix
+++ b/pkgs/by-name/bi/bitwarden-cli/package.nix
@@ -11,18 +11,18 @@
 
 buildNpmPackage rec {
   pname = "bitwarden-cli";
-  version = "2024.7.1";
+  version = "2024.7.2";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "cli-v${version}";
-    hash = "sha256-ZnqvqPR1Xuf6huhD5kWlnu4XOAWn7yte3qxgU/HPhiQ=";
+    hash = "sha256-MqIznJe5GeRTJ+sgOJoTHAQaac0obuBDb63XxQeG1iY=";
   };
 
   nodejs = nodejs_20;
 
-  npmDepsHash = "sha256-lWlAc0ITSp7WwxM09umBo6qeRzjq4pJdC0RDUrZwcHY=";
+  npmDepsHash = "sha256-XDN92VPKTA9KeSg5CQXxhXyEARZBwpERZ3400xqwg7U=";
 
   nativeBuildInputs = [
     (python3.withPackages (ps: with ps; [ setuptools ]))
diff --git a/pkgs/by-name/bu/buildkite-agent/package.nix b/pkgs/by-name/bu/buildkite-agent/package.nix
index 9189c5963824..44c6099fc40b 100644
--- a/pkgs/by-name/bu/buildkite-agent/package.nix
+++ b/pkgs/by-name/bu/buildkite-agent/package.nix
@@ -13,16 +13,16 @@
 }:
 buildGoModule rec {
   pname = "buildkite-agent";
-  version = "3.59.0";
+  version = "3.76.1";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     rev = "v${version}";
-    sha256 = "sha256-pYaxjXoNn6MOE2oHUSKrBzP5oKhtfJwSHFCkcpkyzas=";
+    sha256 = "sha256-0i2b7sVBkV5zcJo+K5kg2Ojbix0rlQRXHKAmL9PJs+g=";
   };
 
-  vendorHash = "sha256-JSuam9Tn+ZekfLrj78tBncH7Q2aP4CaUgaaDkJ/azEw=";
+  vendorHash = "sha256-0P6EXqQa6WxhjNJ4X6THvjJRK/UQvqXTv+7IJViFAQs=";
 
   postPatch = ''
     substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash
diff --git a/pkgs/by-name/cd/cdecl/package.nix b/pkgs/by-name/cd/cdecl/package.nix
index e167cc3b69ae..20cac4a653f6 100644
--- a/pkgs/by-name/cd/cdecl/package.nix
+++ b/pkgs/by-name/cd/cdecl/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdecl";
-  version = "18.1";
+  version = "18.2";
 
   src = fetchFromGitHub {
     owner = "paul-j-lucas";
     repo = "cdecl";
     rev = "refs/tags/cdecl-${finalAttrs.version}";
-    hash = "sha256-qbb+xBGKNxteGMDcTy+o24EagupiSi/Zf/NLk7jpS0U=";
+    hash = "sha256-6mj5M4SI0TG+N4exu3xdAqh8a98VOFtS1DbuRIYmW+Y=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/jc/jcli/package.nix b/pkgs/by-name/jc/jcli/package.nix
new file mode 100644
index 000000000000..6fd632af1a6a
--- /dev/null
+++ b/pkgs/by-name/jc/jcli/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+
+buildGoModule rec {
+  pname = "jcli";
+  version = "0.0.42";
+
+  src = fetchFromGitHub {
+    owner = "jenkins-zh";
+    repo = "jenkins-cli";
+    rev = "v${version}";
+    hash = "sha256-t9NE911TjAvoCsmf9F989DNQ+s9GhgUF7cwuyHefWts=";
+  };
+
+  vendorHash = "sha256-bmPnxFvdKU5zuMsCDboSOxP5f7NnMRwS/gN0sW7eTRA=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/linuxsuren/cobra-extension/version.version=${version}"
+  ];
+
+  doCheck = false;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall =
+    ''
+      mv $out/bin/{jenkins-cli,jcli}
+    ''
+    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      installShellCompletion --cmd jcli \
+        --bash <($out/bin/jcli completion --type bash) \
+        --zsh <($out/bin/jcli completion --type zsh)
+    '';
+
+  meta = {
+    description = "Jenkins CLI allows you to manage your Jenkins in an easy way";
+    mainProgram = "jcli";
+    homepage = "https://github.com/jenkins-zh/jenkins-cli";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sikmir ];
+  };
+}
diff --git a/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix b/pkgs/by-name/li/linux-wifi-hotspot/package.nix
similarity index 74%
rename from pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
rename to pkgs/by-name/li/linux-wifi-hotspot/package.nix
index 8d7fb03499f5..d4e1d9f74725 100644
--- a/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
+++ b/pkgs/by-name/li/linux-wifi-hotspot/package.nix
@@ -1,37 +1,37 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, which
-, pkg-config
-, glib
-, gtk3
-, iw
-, makeWrapper
-, qrencode
-, hostapd
-, getopt
-, dnsmasq
-, iproute2
-, flock
-, iptables
-, gawk
-, coreutils
-, gnugrep
-, gnused
-, kmod
-, networkmanager
-, procps
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  which,
+  pkg-config,
+  glib,
+  gtk3,
+  iw,
+  makeWrapper,
+  qrencode,
+  hostapd,
+  getopt,
+  dnsmasq,
+  iproute2,
+  flock,
+  iptables,
+  gawk,
+  coreutils,
+  gnugrep,
+  gnused,
+  kmod,
+  networkmanager,
+  procps,
 }:
 
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "linux-wifi-hotspot";
   version = "4.7.2";
 
   src = fetchFromGitHub {
     owner = "lakinduakash";
-    repo = pname;
-    rev = "v${version}";
+    repo = "linux-wifi-hotspot";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-+WHYWQ4EyAt+Kq0LHEgC7Kk5HpIqThz6W3PIdW8Wojk=";
   };
 
@@ -61,13 +61,12 @@ stdenv.mkDerivation rec {
       --replace "/usr" "$out"
   '';
 
-  makeFlags = [
-    "PREFIX=${placeholder "out"}"
-  ];
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   postInstall = ''
     wrapProgram $out/bin/create_ap \
-      --prefix PATH : ${lib.makeBinPath [
+      --prefix PATH : ${
+        lib.makeBinPath [
           coreutils
           dnsmasq
           flock
@@ -83,7 +82,8 @@ stdenv.mkDerivation rec {
           networkmanager
           procps
           which
-        ]}
+        ]
+      }
 
     wrapProgram $out/bin/wihotspot-gui \
       --prefix PATH : ${lib.makeBinPath [ iw ]} \
@@ -98,8 +98,11 @@ stdenv.mkDerivation rec {
     description = "Feature-rich wifi hotspot creator for Linux which provides both GUI and command-line interface";
     homepage = "https://github.com/lakinduakash/linux-wifi-hotspot";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ onny ];
+    maintainers = with maintainers; [
+      johnrtitor
+      onny
+    ];
     platforms = platforms.unix;
   };
 
-}
+})
diff --git a/pkgs/by-name/po/powerpipe/package.nix b/pkgs/by-name/po/powerpipe/package.nix
index 353d2a5ba493..3591f8b94f0b 100644
--- a/pkgs/by-name/po/powerpipe/package.nix
+++ b/pkgs/by-name/po/powerpipe/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "powerpipe";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "powerpipe";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KJ024dIU0GmeHCFa/pbyFIA+LitaudHC+NBGg8yNWxM=";
+    hash = "sha256-8gQ3+sXeWTiuFgj2XKh2ngo5qBBczoqnX3NiHflJGSU=";
   };
 
-  vendorHash = "sha256-XALFXUeWrS4nt+ONToCfYXvLWuk7ZhLWvJidnATcWtM=";
+  vendorHash = "sha256-9SgGBkxPuelJrUpG8vnVPt0w5UdL4slxHJDSXDitaAQ=";
   proxyVendor = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/sttr/package.nix b/pkgs/by-name/st/sttr/package.nix
index 4d2a508cf768..bc7be6543e35 100644
--- a/pkgs/by-name/st/sttr/package.nix
+++ b/pkgs/by-name/st/sttr/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "sttr";
-  version = "0.2.22";
+  version = "0.2.23";
 
   src = fetchFromGitHub {
     owner = "abhimanyu003";
     repo = "sttr";
     rev = "v${version}";
-    hash = "sha256-VEfMkUMrn9yKMg1M56uFhM8ego3EyY1MqEgzkZE6Zbk=";
+    hash = "sha256-BO6R41FtpPS3GBuKifm+gEnkkQodQDtbjZWtsGtuvms=";
   };
 
-  vendorHash = "sha256-L3XKjJSk/1Evzq4ieUsJ4ewyfS8NDDSd10aDdsc5IcI=";
+  vendorHash = "sha256-n+B/e3M+S46vATq9eVXiYcO2s5WNGSvSE2Ci2rpigog=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/txtpbfmt/default.nix b/pkgs/by-name/tx/txtpbfmt/package.nix
similarity index 77%
rename from pkgs/development/tools/txtpbfmt/default.nix
rename to pkgs/by-name/tx/txtpbfmt/package.nix
index d08fe67330a2..88c04d5803f8 100644
--- a/pkgs/development/tools/txtpbfmt/default.nix
+++ b/pkgs/by-name/tx/txtpbfmt/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule {
   pname = "txtpbfmt";
-  version = "0-unstable-2024-04-16";
+  version = "0-unstable-2024-06-11";
 
   src = fetchFromGitHub {
     owner = "protocolbuffers";
     repo = "txtpbfmt";
-    rev = "1e18ef0a7fdc4d28b9223d2d50b4b2be7024519e";
-    hash = "sha256-L96aEAlPvdBXxAbH8IszQK0r7ouICmFrkHtTJe/dD+E=";
+    rev = "dedd929c1c222fd4d895cda0e1c87b940262b1f5";
+    hash = "sha256-L9btIjcQ3XMPzUrizoSEJ/Zj2xWphFAka3qtzm2mxP4=";
   };
 
   vendorHash = "sha256-IdD+R8plU4/e9fQaGSM5hJxyMECb6hED0Qg8afwHKbY=";
diff --git a/pkgs/by-name/wa/wayneko/package.nix b/pkgs/by-name/wa/wayneko/package.nix
new file mode 100644
index 000000000000..07adf3e83a58
--- /dev/null
+++ b/pkgs/by-name/wa/wayneko/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromSourcehut,
+  pixman,
+  pkg-config,
+  wayland,
+  wayland-scanner,
+}:
+
+stdenv.mkDerivation {
+  pname = "wayneko";
+  version = "0-unstable-2024-03-29";
+
+  src = fetchFromSourcehut {
+    owner = "~leon_plickat";
+    repo = "wayneko";
+    rev = "c1919dc3a7e610d30e4c06efaa5af85941f27d86";
+    hash = "sha256-2cbEcDK6WZPe4HvY1pxmZVyDAj617VP1l0Gn7uSlNaE=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail -Werror ""
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    pixman
+    wayland
+  ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = {
+    description = "Neko on Wayland";
+    homepage = "https://sr.ht/~leon_plickat/wayneko";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fgaz ];
+    mainProgram = "wayneko";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index 2fb6c21fff10..2c1192828300 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -18,12 +18,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.79";
+  version = "1.80";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-/PEny7+E/s1Y08NigO22uDnhFfMBtccqaI8hsBOO2fI=";
+    hash = "sha256-87LsCJrx6LEJCkiBq/c2RWqenmX9KViGBqKMdmMYRMw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/airgradient/default.nix b/pkgs/development/python-modules/airgradient/default.nix
index 992b06968b06..02a642b98bee 100644
--- a/pkgs/development/python-modules/airgradient/default.nix
+++ b/pkgs/development/python-modules/airgradient/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "airgradient";
-  version = "0.7.0";
+  version = "0.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "airgradienthq";
     repo = "python-airgradient";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4bHo65ew5UVGUgoM9y6kxo1ocMtrxQ5Bn6Zn77qXJ7M=";
+    hash = "sha256-EFt2V+r7RLiFMihFCCBU9iEPcbSybK6gP+uxed+mIeo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/asteval/default.nix b/pkgs/development/python-modules/asteval/default.nix
index 06b1325ca382..322bb50e711f 100644
--- a/pkgs/development/python-modules/asteval/default.nix
+++ b/pkgs/development/python-modules/asteval/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "asteval";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "lmfit";
     repo = "asteval";
     rev = "refs/tags/${version}";
-    hash = "sha256-Ee7EAcSfLmo9ijm4oa3nEVPoz1pgLx4ozbSXBW3kRPw=";
+    hash = "sha256-TIMyfX8bpzey0hw0lBMcdZVnc07j9PFVjn4YbX4oW/8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/gradio/client.nix b/pkgs/development/python-modules/gradio/client.nix
index 1e87a7ad652a..ed2d52c30c39 100644
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "gradio-client";
-  version = "1.0.1";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     # not to be confused with @gradio/client@${version}
     rev = "refs/tags/gradio_client@${version}";
     sparseCheckout = [ "client/python" ];
-    hash = "sha256-nbOWg2ZPcXTft7e4tR5p5xecVU62en0hEdXqAgLDZF4=";
+    hash = "sha256-l5WHNerSYNXrFGOpAqxxh0JLiFpatxq6a62q83tEavo=";
   };
   prePatch = ''
     cd client/python
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index b59ba637d713..a25d8baa10d3 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -15,7 +15,7 @@
   # runtime
   setuptools,
   aiofiles,
-  altair,
+  anyio,
   diffusers,
   fastapi,
   ffmpy,
@@ -47,6 +47,7 @@
 
   # check
   pytestCheckHook,
+  altair,
   boto3,
   gradio-pdf,
   ffmpeg,
@@ -62,7 +63,7 @@
 
 buildPythonPackage rec {
   pname = "gradio";
-  version = "4.36.1";
+  version = "4.40.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -70,7 +71,7 @@ buildPythonPackage rec {
   # We use the Pypi release, since it provides prebuilt webui assets
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-crLSEVbTRnEjuubzD0Y/AC7wbicnZidDCPXtPKw3Vjs=";
+    hash = "sha256-ChV5E6RfFcOwW6uFqU4/phfHfn27yS8+MKjMVytnlgU=";
   };
 
   # fix packaging.ParserSyntaxError, which can't handle comments
@@ -98,7 +99,7 @@ buildPythonPackage rec {
   dependencies = [
     setuptools # needed for 'pkg_resources'
     aiofiles
-    altair
+    anyio
     diffusers
     fastapi
     ffmpy
@@ -132,6 +133,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    altair
     boto3
     gradio-pdf
     ffmpeg
@@ -183,6 +185,9 @@ buildPythonPackage rec {
     # fails without network
     "test_download_if_url_correct_parse"
 
+    # flaky: OSError: Cannot find empty port in range: 7860-7959
+    "test_docs_url"
+
     # tests if pip and other tools are installed
     "test_get_executable_path"
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/lm-format-enforcer/default.nix b/pkgs/development/python-modules/lm-format-enforcer/default.nix
new file mode 100644
index 000000000000..fd6d202f0f4c
--- /dev/null
+++ b/pkgs/development/python-modules/lm-format-enforcer/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pydantic,
+  interegular,
+  pyyaml,
+  poetry-core,
+}:
+
+buildPythonPackage rec {
+  pname = "lm-format-enforcer";
+  version = "0.10.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "noamgat";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-GOnMj910rgzYeIeN2yLcXZDDel/Hu6nv7ov5BrlHJLg=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    interegular
+    pydantic
+    pyyaml
+  ];
+
+  doCheck = false; # most tests require internet access
+
+  pythonImportsCheck = [ "lmformatenforcer" ];
+
+  meta = with lib; {
+    description = "Enforce the output format (JSON Schema, Regex etc) of a language model";
+    changelog = "https://github.com/noamgat/lm-format-enforcer/releases/tag/v${version}";
+    homepage = "https://github.com/noamgat/lm-format-enforcer";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cfhammill ];
+  };
+}
diff --git a/pkgs/development/python-modules/nuclear/default.nix b/pkgs/development/python-modules/nuclear/default.nix
index ac7d35419835..5daade948aa8 100644
--- a/pkgs/development/python-modules/nuclear/default.nix
+++ b/pkgs/development/python-modules/nuclear/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "nuclear";
-  version = "2.2.5";
+  version = "2.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "igrek51";
     repo = "nuclear";
     rev = version;
-    hash = "sha256-JuO7BKmlQE6bWKqy1QvX5U4A9YkKu/4ouTSJh9R7JGo=";
+    hash = "sha256-UeU803SYMBLSWXjuxtWP2R2dBumRom+qsj2ljTiYFm0=";
   };
 
   build-system = [ setuptools ];
@@ -39,10 +39,6 @@ buildPythonPackage rec {
     # Disabled because test tries to install bash in a non-NixOS way
     "tests/autocomplete/test_bash_install.py"
   ];
-  disabledTests = [
-    # Setting the time zone in nix sandbox does not work - to be investigated
-    "test_context_logger"
-  ];
   pythonImportsCheck = [ "nuclear" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/outlines/default.nix b/pkgs/development/python-modules/outlines/default.nix
index 58e908e53a1c..e93ce65e23ad 100644
--- a/pkgs/development/python-modules/outlines/default.nix
+++ b/pkgs/development/python-modules/outlines/default.nix
@@ -6,9 +6,12 @@
   setuptools-scm,
   interegular,
   cloudpickle,
+  datasets,
   diskcache,
   joblib,
   jsonschema,
+  pyairports,
+  pycountry,
   pydantic,
   lark,
   nest-asyncio,
@@ -38,6 +41,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     interegular
     cloudpickle
+    datasets
     diskcache
     joblib
     jsonschema
@@ -48,16 +52,19 @@ buildPythonPackage rec {
     scipy
     torch
     transformers
+    pycountry
+    pyairports
   ];
 
-  pythonImportsCheck = [ "outlines" ];
+  checkPhase = ''
+    export HOME=$(mktemp -d)
+    python3 -c 'import outlines'
+  '';
 
   meta = with lib; {
     description = "Structured text generation";
     homepage = "https://github.com/outlines-dev/outlines";
     license = licenses.asl20;
     maintainers = with maintainers; [ lach ];
-    # Missing dependencies since the last update
-    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/patch-ng/default.nix b/pkgs/development/python-modules/patch-ng/default.nix
index 77b0b02fa0c8..1298fa3a1e26 100644
--- a/pkgs/development/python-modules/patch-ng/default.nix
+++ b/pkgs/development/python-modules/patch-ng/default.nix
@@ -5,13 +5,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.17.4"; # note: `conan` package may require a hardcoded one
+  version = "1.18.0"; # note: `conan` package may require a hardcoded one
   format = "setuptools";
   pname = "patch-ng";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1kja1nn08w0k8k6j4kad48k581hh9drvjjb8x60v9j13sxdvqyk2";
+    sha256 = "sha256-2gZ2KNbV/Z3FpV6rN5UdRr2VZhtyGfqzZLcRNmq8xpA=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pyairports/default.nix b/pkgs/development/python-modules/pyairports/default.nix
new file mode 100644
index 000000000000..b6c8b2a8a4c4
--- /dev/null
+++ b/pkgs/development/python-modules/pyairports/default.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pyairports";
+  version = "2.1.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-PWCnJ/zk2oG5xjk+qK4LM9Z7N+zjRN/8hj90njrWK80=";
+  };
+
+  build-system = [ setuptools ];
+
+  doCheck = false;
+
+  pythonImportChecks = [ "pyairports" ];
+
+  meta = with lib; {
+    description = "pyairports is a package which enables airport lookup by 3-letter IATA code.";
+    homepage = "https://github.com/ozeliger/pyairports";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ cfhammill ];
+  };
+}
diff --git a/pkgs/development/python-modules/scrapy-deltafetch/default.nix b/pkgs/development/python-modules/scrapy-deltafetch/default.nix
index 1a7a426af6a3..fa2c1ab63c40 100644
--- a/pkgs/development/python-modules/scrapy-deltafetch/default.nix
+++ b/pkgs/development/python-modules/scrapy-deltafetch/default.nix
@@ -3,32 +3,31 @@
   fetchPypi,
   buildPythonPackage,
   scrapy,
-  bsddb3,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "scrapy-deltafetch";
   version = "2.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "13f7968bd0ffae133e2a1dede215e683b8c95285f046260603a5c3e25f2d57b0";
+    hash = "sha256-E/eWi9D/rhM+Kh3t4hXmg7jJUoXwRiYGA6XD4l8tV7A=";
   };
 
-  propagatedBuildInputs = [
-    bsddb3
-    scrapy
-  ];
+  dependencies = [ scrapy ];
+
+  build-system = [ setuptools ];
 
   # no tests
   doCheck = false;
   pythonImportsCheck = [ "scrapy_deltafetch" ];
 
-  meta = with lib; {
+  meta = {
     description = "Scrapy spider middleware to ignore requests to pages containing items seen in previous crawls";
     homepage = "https://github.com/scrapy-plugins/scrapy-deltafetch";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ evanjs ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ evanjs ];
   };
 }
diff --git a/pkgs/development/python-modules/vllm/0001-setup.py-don-t-ask-for-hipcc-version.patch b/pkgs/development/python-modules/vllm/0001-setup.py-don-t-ask-for-hipcc-version.patch
new file mode 100644
index 000000000000..edaebfce508c
--- /dev/null
+++ b/pkgs/development/python-modules/vllm/0001-setup.py-don-t-ask-for-hipcc-version.patch
@@ -0,0 +1,24 @@
+From f6a7748bee79fc2e1898968fef844daacfa7860b Mon Sep 17 00:00:00 2001
+From: SomeoneSerge <else@someonex.net>
+Date: Wed, 31 Jul 2024 12:02:53 +0000
+Subject: [PATCH 1/2] setup.py: don't ask for hipcc --version
+
+---
+ setup.py | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/setup.py b/setup.py
+index 72ef26f1..01e006f9 100644
+--- a/setup.py
++++ b/setup.py
+@@ -279,6 +279,7 @@ def _install_punica() -> bool:
+ 
+ 
+ def get_hipcc_rocm_version():
++    return "0.0" # `hipcc --version` misbehaves ("unresolved paths") inside the nix sandbox
+     # Run the hipcc --version command
+     result = subprocess.run(['hipcc', '--version'],
+                             stdout=subprocess.PIPE,
+-- 
+2.45.1
+
diff --git a/pkgs/development/python-modules/vllm/0002-setup.py-nix-support-respect-cmakeFlags.patch b/pkgs/development/python-modules/vllm/0002-setup.py-nix-support-respect-cmakeFlags.patch
new file mode 100644
index 000000000000..e7a4bcd45761
--- /dev/null
+++ b/pkgs/development/python-modules/vllm/0002-setup.py-nix-support-respect-cmakeFlags.patch
@@ -0,0 +1,40 @@
+From 10b7e8330bdba319a4162cceb8e5dd4280215b04 Mon Sep 17 00:00:00 2001
+From: SomeoneSerge <else@someonex.net>
+Date: Wed, 31 Jul 2024 12:06:15 +0000
+Subject: [PATCH 2/2] setup.py: nix-support (respect cmakeFlags)
+
+---
+ setup.py | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/setup.py b/setup.py
+index 01e006f9..14762146 100644
+--- a/setup.py
++++ b/setup.py
+@@ -15,6 +15,15 @@ from setuptools import Extension, find_packages, setup
+ from setuptools.command.build_ext import build_ext
+ from torch.utils.cpp_extension import CUDA_HOME
+ 
++import os
++import json
++
++if "NIX_ATTRS_JSON_FILE" in os.environ:
++    with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f:
++        NIX_ATTRS = json.load(f)
++else:
++    NIX_ATTRS = { "cmakeFlags": os.environ.get("cmakeFlags", "").split() }
++
+ 
+ def load_module_from_path(module_name, path):
+     spec = importlib.util.spec_from_file_location(module_name, path)
+@@ -159,6 +168,7 @@ class cmake_build_ext(build_ext):
+             '-DCMAKE_LIBRARY_OUTPUT_DIRECTORY={}'.format(outdir),
+             '-DCMAKE_ARCHIVE_OUTPUT_DIRECTORY={}'.format(self.build_temp),
+             '-DVLLM_TARGET_DEVICE={}'.format(VLLM_TARGET_DEVICE),
++            *NIX_ATTRS["cmakeFlags"],
+         ]
+ 
+         verbose = envs.VERBOSE
+-- 
+2.45.1
+
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index a27589f42abe..3b9e6ee43487 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -1,10 +1,13 @@
 {
   lib,
   stdenv,
+  python,
   buildPythonPackage,
+  pythonRelaxDepsHook,
   fetchFromGitHub,
   which,
   ninja,
+  cmake,
   packaging,
   setuptools,
   torch,
@@ -23,6 +26,13 @@
   pydantic,
   aioprometheus,
   pynvml,
+  openai,
+  pyzmq,
+  tiktoken,
+  torchvision,
+  py-cpuinfo,
+  lm-format-enforcer,
+  prometheus-fastapi-instrumentator,
   cupy,
   writeShellScript,
 
@@ -31,83 +41,73 @@
   cudaSupport ? config.cudaSupport,
   cudaPackages ? { },
 
-  rocmSupport ? config.rocmSupport,
+  # Has to be either rocm or cuda, default to the free one
+  rocmSupport ? !config.cudaSupport,
   rocmPackages ? { },
   gpuTargets ? [ ],
-}:
+}@args:
 
 let
-  stdenv_pkg = stdenv;
+  cutlass = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "cutlass";
+    rev = "refs/tags/v3.5.0";
+    sha256 = "sha256-D/s7eYsa5l/mfx73tE4mnFcTQdYqGmXa9d9TCryw4e4=";
+  };
 in
 
 buildPythonPackage rec {
   pname = "vllm";
-  version = "0.3.3";
-  format = "pyproject";
+  version = "0.5.3.post1";
+  pyproject = true;
+
+  stdenv = if cudaSupport then cudaPackages.backendStdenv else args.stdenv;
 
   src = fetchFromGitHub {
     owner = "vllm-project";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-LU5pCPVv+Ws9dL8oWL1sJGzwQKI1IFk2A1I6TP9gXL4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-++DK2Y2zz+1KrEcdQc5XFrSjc7fCwMD2DQ/RqY7PoFU=";
   };
 
-  # Otherwise it tries to enumerate host supported ROCM gfx archs, and that is not possible due to sandboxing.
-  PYTORCH_ROCM_ARCH = lib.optionalString rocmSupport (
-    lib.strings.concatStringsSep ";" rocmPackages.clr.gpuTargets
-  );
+  patches = [
+    ./0001-setup.py-don-t-ask-for-hipcc-version.patch
+    ./0002-setup.py-nix-support-respect-cmakeFlags.patch
+  ];
 
-  # cupy-cuda12x is the same wheel as cupy, but built with cuda dependencies, we already have it set up
-  # like that in nixpkgs. Version upgrade is due to upstream shenanigans
-  # https://github.com/vllm-project/vllm/pull/2845/commits/34a0ad7f9bb7880c0daa2992d700df3e01e91363
-  #
-  # hipcc --version works badly on NixOS due to unresolved paths.
-  # Unclear why pythonRelaxDeps doesn't work here, but on last attempt, it didn't.
-  postPatch =
-    ''
-      substituteInPlace requirements.txt \
-        --replace "xformers == 0.0.23.post1" "xformers"
-      substituteInPlace requirements.txt \
-        --replace "cupy-cuda12x == 12.1.0" "cupy"
-      substituteInPlace requirements-build.txt \
-        --replace "torch==2.1.2" "torch"
-      substituteInPlace pyproject.toml \
-        --replace "torch == 2.1.2" "torch"
-      substituteInPlace requirements.txt \
-        --replace "torch == 2.1.2" "torch"
-    ''
-    + lib.optionalString rocmSupport ''
-      substituteInPlace setup.py \
-        --replace "'hipcc', '--version'" "'${writeShellScript "hipcc-version-stub" "echo HIP version: 0.0"}'"
-    '';
-
-  preBuild =
-    lib.optionalString cudaSupport ''
-      export CUDA_HOME=${cudaPackages.cuda_nvcc}
-    ''
-    + lib.optionalString rocmSupport ''
-      export ROCM_HOME=${rocmPackages.clr}
-      export PATH=$PATH:${rocmPackages.hipcc}
-    '';
+  # Ignore the python version check because it hard-codes minor versions and
+  # lags behind `ray`'s python interpreter support
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        'set(PYTHON_SUPPORTED_VERSIONS' \
+        'set(PYTHON_SUPPORTED_VERSIONS "${lib.versions.majorMinor python.version}"'
+  '';
 
   nativeBuildInputs = [
+    cmake
     ninja
-    packaging
-    setuptools
-    torch
-    wheel
+    pythonRelaxDepsHook
     which
   ] ++ lib.optionals rocmSupport [ rocmPackages.hipcc ];
 
+  build-system = [
+    packaging
+    setuptools
+    wheel
+  ];
+
   buildInputs =
     (lib.optionals cudaSupport (
       with cudaPackages;
       [
         cuda_cudart # cuda_runtime.h, -lcudart
-        cuda_cccl # <thrust/*>
+        cuda_cccl
         libcusparse # cusparse.h
-        libcublas # cublas_v2.h
         libcusolver # cusolverDn.h
+        cuda_nvcc
+        cuda_nvtx
+        libcublas
       ]
     ))
     ++ (lib.optionals rocmSupport (
@@ -121,31 +121,49 @@ buildPythonPackage rec {
       ]
     ));
 
-  propagatedBuildInputs =
+  dependencies =
     [
-      psutil
-      ray
-      pandas
-      pyarrow
-      sentencepiece
-      numpy
-      torch
-      transformers
-      outlines
-      xformers
-      fastapi
-      uvicorn
-      pydantic
       aioprometheus
+      fastapi
+      lm-format-enforcer
+      numpy
+      openai
+      outlines
+      pandas
+      prometheus-fastapi-instrumentator
+      psutil
+      py-cpuinfo
+      pyarrow
+      pydantic
+      pyzmq
+      ray
+      sentencepiece
+      tiktoken
+      torch
+      torchvision
+      transformers
+      uvicorn
+      xformers
     ]
     ++ uvicorn.optional-dependencies.standard
     ++ aioprometheus.optional-dependencies.starlette
     ++ lib.optionals cudaSupport [
-      pynvml
       cupy
+      pynvml
     ];
 
-  stdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv_pkg;
+  dontUseCmakeConfigure = true;
+  cmakeFlags = [ (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_CUTLASS" "${lib.getDev cutlass}") ];
+
+  env =
+    lib.optionalAttrs cudaSupport { CUDA_HOME = "${lib.getDev cudaPackages.cuda_nvcc}"; }
+    // lib.optionalAttrs rocmSupport {
+      # Otherwise it tries to enumerate host supported ROCM gfx archs, and that is not possible due to sandboxing.
+      PYTORCH_ROCM_ARCH = lib.strings.concatStringsSep ";" rocmPackages.clr.gpuTargets;
+      ROCM_HOME = "${rocmPackages.clr}";
+    };
+
+  pythonRelaxDeps = true;
 
   pythonImportsCheck = [ "vllm" ];
 
diff --git a/pkgs/development/python-modules/wat/default.nix b/pkgs/development/python-modules/wat/default.nix
index 7ea81661648f..4231336c31ce 100644
--- a/pkgs/development/python-modules/wat/default.nix
+++ b/pkgs/development/python-modules/wat/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "wat";
-  version = "0.1.2";
+  version = "0.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "igrek51";
     repo = "wat";
     rev = version;
-    hash = "sha256-ibbWM2L/GoJVg8RxtsBSBn/qA+KIkC5+wq5YH6mtiUs=";
+    hash = "sha256-WCMMj4KtfWOp6LsS4XHD/M/iepstVasHknEvEUTMMM8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/weconnect/default.nix b/pkgs/development/python-modules/weconnect/default.nix
index cba91268a5eb..bd168ccb8f59 100644
--- a/pkgs/development/python-modules/weconnect/default.nix
+++ b/pkgs/development/python-modules/weconnect/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "weconnect";
-  version = "0.60.3";
+  version = "0.60.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "tillsteinbach";
     repo = "WeConnect-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eIGzcuSKzcpE6UPQKmv0kcFcIFizWOunfOJDHfcw7Yk=";
+    hash = "sha256-Ht+TSjI1FZ+y/lt5IlepxpT5uOBYeJaNmF7aBw2YUPA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/ctlptl/default.nix b/pkgs/development/tools/ctlptl/default.nix
index f7dca069d483..a5f3dde68f5b 100644
--- a/pkgs/development/tools/ctlptl/default.nix
+++ b/pkgs/development/tools/ctlptl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ctlptl";
-  version = "0.8.29";
+  version = "0.8.30";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-4drk8mqFVGXUktPiWuVNzWVBQr4TRcutZgGsF3vpRIE=";
+    hash = "sha256-qIuZfOgzoFaZznacJ2UEMMDKevsadmRkhwPXkb5rJiM=";
   };
 
-  vendorHash = "sha256-rf/4xyridcsSlGOVQ91Wr8bHnm7wfuXs6HSPKW2J8hM=";
+  vendorHash = "sha256-GeUuCMcx/huEw4SLNierkcmxyZiOvClKwpjGQZDP6nw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/database/clickhouse-backup/default.nix b/pkgs/development/tools/database/clickhouse-backup/default.nix
index 3223119b08f8..3a794b5f0e69 100644
--- a/pkgs/development/tools/database/clickhouse-backup/default.nix
+++ b/pkgs/development/tools/database/clickhouse-backup/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.5.20";
+  version = "2.5.21";
 
   src = fetchFromGitHub {
     owner = "Altinity";
     repo = "clickhouse-backup";
     rev = "v${version}";
-    hash = "sha256-s9GVhn4jRNhBaoxjQwyJfAkchsf+KRw0aqLsBDuca3o=";
+    hash = "sha256-DjmhDUHC7278J9ByUlzXUF2s1GxRVNbRaYdlyy+5D/w=";
   };
 
-  vendorHash = "sha256-sMhcEFRqIROnXSdZA+NjHGAZLicFjU7swJK9RBV/EpQ=";
+  vendorHash = "sha256-w3bfCn8A2ETJ6i1hm1FTNpTDXPFXF4vvkFAZCO/y7HE=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/development/tools/misc/jcli/default.nix b/pkgs/development/tools/misc/jcli/default.nix
deleted file mode 100644
index 2b7f14284f16..000000000000
--- a/pkgs/development/tools/misc/jcli/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ lib, buildGoModule, fetchFromGitHub }:
-
-buildGoModule rec {
-  pname = "jcli";
-  version = "0.0.42";
-
-  src = fetchFromGitHub {
-    owner = "jenkins-zh";
-    repo = "jenkins-cli";
-    rev = "v${version}";
-    hash = "sha256-t9NE911TjAvoCsmf9F989DNQ+s9GhgUF7cwuyHefWts=";
-  };
-
-  vendorHash = "sha256-bmPnxFvdKU5zuMsCDboSOxP5f7NnMRwS/gN0sW7eTRA=";
-
-  doCheck = false;
-
-  postInstall = ''
-    mv $out/bin/{jenkins-cli,jcli}
-  '';
-
-  meta = with lib; {
-    description = "Jenkins CLI allows you to manage your Jenkins in an easy way";
-    mainProgram = "jcli";
-    homepage = "https://jcli.jenkins-zh.cn/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ sikmir ];
-  };
-}
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index ba5daf6887aa..32dd8a6a70d2 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,14 +6,14 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.6.42";
-    hash = "sha256-0YqvOObUHP2S8Jf1H+fzAZ+wOMoFt1BLxWilqt6ohVg=";
+    version = "6.6.43";
+    hash = "sha256-4o8qdAkqFjlRFS2k2zW9weSB1JQ5BFuDdcv26v9qYoA=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.9.11";
-    hash = "sha256-c6Mkk37SFoC9hJfh/iQqyNzGJJjN0W28VLta/nayCgc=";
+    version = "6.9.12";
+    hash = "sha256-ysnu/6q2Zc0b+MNRdjQDLNmmjU+nWKpb/CcPOSSmotM=";
     variant = "main";
   };
 
diff --git a/pkgs/servers/misc/gobgpd/default.nix b/pkgs/servers/misc/gobgpd/default.nix
index 05cdfec4278f..b4e1f0cb2ccd 100644
--- a/pkgs/servers/misc/gobgpd/default.nix
+++ b/pkgs/servers/misc/gobgpd/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "gobgpd";
-  version = "3.28.0";
+  version = "3.29.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HdGRZrMukIQLxTmwTVB/zUlnrhDjq5b6ree7aqx8pRE=";
+    hash = "sha256-mTg3eN5ZmzQxItPq8ghPpFafr6zF+nliofGEKShnH88=";
   };
 
   vendorHash = "sha256-wrgRQwisOHAhvRbvGXMW5VWkQuEifCwCo3usuxLie4A=";
diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix
index 1f186bb14e21..1caad13bc76c 100644
--- a/pkgs/servers/unifi/default.nix
+++ b/pkgs/servers/unifi/default.nix
@@ -52,8 +52,8 @@ in rec {
   };
 
   unifi8 = generic {
-    version = "8.2.93";
-    suffix = "-1c329ecd26";
-    sha256 = "sha256-7zcRxflEvPRxH7MtudOqumeUpSzAaEIbjaaJVpr2Gbc=";
+    version = "8.3.32";
+    suffix = "-896f48ed11";
+    sha256 = "sha256-pqylClAEQtkEExIPOY1pRiymmYFvWxOOcqy+iCkWx5w=";
   };
 }
diff --git a/pkgs/stdenv/darwin/override-sdk.nix b/pkgs/stdenv/darwin/override-sdk.nix
index 02d3cd4fb747..d24c118cc668 100644
--- a/pkgs/stdenv/darwin/override-sdk.nix
+++ b/pkgs/stdenv/darwin/override-sdk.nix
@@ -287,6 +287,7 @@ let
 
         replacements = lib.pipe propagatedInputs [
           (lib.filter (pkg: pkg != null))
+          lib.flatten
           (map (dep: {
             name = builtins.unsafeDiscardStringContext dep;
             value = getReplacement newPackages dep;
@@ -311,6 +312,7 @@ let
     let
       mapPackageDeps = lib.flip lib.pipe [
         (lib.filter (pkg: pkg != null))
+        lib.flatten
         (map (pkg: {
           key = builtins.unsafeDiscardStringContext pkg;
           package = pkg;
diff --git a/pkgs/tools/admin/coldsnap/default.nix b/pkgs/tools/admin/coldsnap/default.nix
index b8b66fb66cf0..b2825ce7d5a8 100644
--- a/pkgs/tools/admin/coldsnap/default.nix
+++ b/pkgs/tools/admin/coldsnap/default.nix
@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "coldsnap";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-nQ9OIeFo79f2UBNE9dCl7+bt55XTjQTgWlfyP0Jkj1w=";
+    hash = "sha256-NYMcCLFhX7eD6GXMP9NZDXDnXDDVbcvVwhUAqmwX+ig=";
   };
-  cargoHash = "sha256-8HgO8BqBWiygZmiuRL8WJy3OXSBAKFNVGN7NA6Fx2BM=";
+  cargoHash = "sha256-ngkoxybl52zTH4wo+sIUtU8vtzOAp+jU1RyTO2KbCgU=";
 
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index ee75498adeed..e495fe13650d 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -19,14 +19,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2024.7.2";
+  version = "2024.7.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-DnXPCcbDwWN+jve2YIeQ3dlugamAc6AR2/7c68bpct8=";
+    hash = "sha256-D81VmT2E84Q4sOzZy/98mbx69vAskpwYlwqtXNjkBvs=";
   };
 
   nativeBuildInputs = with python.pkgs; [
diff --git a/pkgs/tools/misc/gotify-cli/default.nix b/pkgs/tools/misc/gotify-cli/default.nix
index cedd2ae95bc8..94a7c8c82eee 100644
--- a/pkgs/tools/misc/gotify-cli/default.nix
+++ b/pkgs/tools/misc/gotify-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gotify-cli";
-  version = "2.2.4";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "gotify";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-Hzdd9T8RcLxHG+vHb4KuKqW4SwcWDrVc6DZ0QUpH2Xc=";
+    sha256 = "sha256-GwPIGWEpj5GjGV9bz3LctZctHQe+Vywoc1piNb9vAAw=";
   };
 
   vendorHash = "sha256-+G0LWlPiDcYmEou4gpoIU/OAjzQ3VSHftM1ViG9lhYM=";
diff --git a/pkgs/tools/networking/gobgp/default.nix b/pkgs/tools/networking/gobgp/default.nix
index 3e89da8ed7fe..e4a7bcdc423c 100644
--- a/pkgs/tools/networking/gobgp/default.nix
+++ b/pkgs/tools/networking/gobgp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gobgp";
-  version = "3.28.0";
+  version = "3.29.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${version}";
-    sha256 = "sha256-HdGRZrMukIQLxTmwTVB/zUlnrhDjq5b6ree7aqx8pRE=";
+    sha256 = "sha256-mTg3eN5ZmzQxItPq8ghPpFafr6zF+nliofGEKShnH88=";
   };
 
   vendorHash = "sha256-wrgRQwisOHAhvRbvGXMW5VWkQuEifCwCo3usuxLie4A=";
diff --git a/pkgs/tools/security/spire/default.nix b/pkgs/tools/security/spire/default.nix
index 477b47057ee4..ee0d09492590 100644
--- a/pkgs/tools/security/spire/default.nix
+++ b/pkgs/tools/security/spire/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "spire";
-  version = "1.10.0";
+  version = "1.10.1";
 
   outputs = [ "out" "agent" "server" ];
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "spiffe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4S+Pko8uMZmVVB5vjG6Y1mBB3RFtwBBrH2T6FPrss9s=";
+    sha256 = "sha256-CSTpiLDGGiuCUOO2qrpqyKGKsIch7YoJW9XdPqT7/rI=";
   };
 
-  vendorHash = "sha256-U8JGj1hsV0ySREcWZeA243FO/8VPSZ1KUIsVrw1P5H0=";
+  vendorHash = "sha256-x+3UkUs/WJf8CW+FljeHOkYC2oMniknTbJd0DVwnrU8=";
 
   subPackages = [ "cmd/spire-agent" "cmd/spire-server" ];
 
diff --git a/pkgs/tools/wayland/wl-screenrec/default.nix b/pkgs/tools/wayland/wl-screenrec/default.nix
index 2836d7fed2bb..2ffdbf95de1a 100644
--- a/pkgs/tools/wayland/wl-screenrec/default.nix
+++ b/pkgs/tools/wayland/wl-screenrec/default.nix
@@ -3,22 +3,22 @@
 , fetchFromGitHub
 , pkg-config
 , libdrm
-, ffmpeg
+, ffmpeg_7
 , wayland
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "wl-screenrec";
-  version = "0.1.3";
+  version = "0.1.4-unstable-2024-07-28";
 
   src = fetchFromGitHub {
     owner = "russelltg";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-ThPZPV1GyMFRu94O9WwUpXbR4gnIML26K7TyIfXZlcI=";
+    rev = "b817accf1d4f2373cb6f466f760de35e5b8626bd";
+    hash = "sha256-07O2YM9dOHWzriM2+uiBWjEt2hKAuXtRtnKBuzb02Us=";
   };
 
-  cargoHash = "sha256-DtlVsUFKNKXcwqNvGvqkSKUE+kRHX8wajL4fR0c9ZuQ=";
+  cargoHash = "sha256-AYirjrnk8SGTXk5IjzCep2AQJYPbgHAOOf47MUDYj4k=";
 
   nativeBuildInputs = [
     pkg-config
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     wayland
     libdrm
-    ffmpeg
+    ffmpeg_7
   ];
 
   doCheck = false; # tests use host compositor, etc
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ee98649d944a..553bb6794a9d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4654,9 +4654,7 @@ with pkgs;
 
   wl-mirror = callPackage ../tools/wayland/wl-mirror { };
 
-  wl-screenrec = callPackage ../tools/wayland/wl-screenrec {
-    ffmpeg = ffmpeg_6;
-  };
+  wl-screenrec = callPackage ../tools/wayland/wl-screenrec { };
 
   wleave = callPackage ../tools/wayland/wleave { };
 
@@ -9146,8 +9144,6 @@ with pkgs;
 
   jc = with python3Packages; toPythonApplication jc;
 
-  jcli = callPackage ../development/tools/misc/jcli { };
-
   jd-cli = callPackage ../tools/security/jd-cli { };
 
   jd-diff-patch = callPackage ../development/tools/jd-diff-patch { };
@@ -13571,8 +13567,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  txtpbfmt = callPackage ../development/tools/txtpbfmt { };
-
   ipbt = callPackage ../tools/misc/ipbt { };
 
   tuckr = callPackage ../applications/misc/tuckr { };
@@ -26768,8 +26762,6 @@ with pkgs;
 
   linuxConsoleTools = callPackage ../os-specific/linux/consoletools { };
 
-  linux-wifi-hotspot = callPackage ../os-specific/linux/linux-wifi-hotspot { };
-
   linthesia = callPackage ../games/linthesia/default.nix { };
 
   libreelec-dvb-firmware = callPackage ../os-specific/linux/firmware/libreelec-dvb-firmware { };
@@ -33721,7 +33713,7 @@ with pkgs;
 
   viber = callPackage ../applications/networking/instant-messengers/viber { };
 
-  wavebox = libsForQt5.callPackage ../applications/networking/instant-messengers/wavebox { };
+  wavebox = callPackage ../applications/networking/instant-messengers/wavebox { };
 
   sonic-pi = libsForQt5.callPackage ../applications/audio/sonic-pi { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fe221d6cede9..e03d18b47b2f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7188,6 +7188,8 @@ self: super: with self; {
     llvm = pkgs.llvm_14;
   };
 
+  lm-format-enforcer = callPackage ../development/python-modules/lm-format-enforcer { };
+
   lmcloud = callPackage ../development/python-modules/lmcloud { };
 
   lmdb = callPackage ../development/python-modules/lmdb {
@@ -10936,6 +10938,8 @@ self: super: with self; {
 
   pyairnow = callPackage ../development/python-modules/pyairnow { };
 
+  pyairports = callPackage ../development/python-modules/pyairports { };
+
   pyairvisual = callPackage ../development/python-modules/pyairvisual { };
 
   pyais = callPackage ../development/python-modules/pyais { };