diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 9ffb233bd71c..69b8bd959eeb 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -331,6 +331,7 @@ in
         ExecStart = "${cfg.package}/bin/celery --app paperless beat --loglevel INFO";
         Restart = "on-failure";
         LoadCredential = lib.optionalString (cfg.passwordFile != null) "PAPERLESS_ADMIN_PASSWORD:${cfg.passwordFile}";
+        PrivateNetwork = cfg.database.createLocally; # defaultServiceConfig enables this by default, needs to be disabled for remote DBs
       };
       environment = env;
 
@@ -407,6 +408,7 @@ in
         User = cfg.user;
         ExecStart = "${cfg.package}/bin/paperless-ngx document_consumer";
         Restart = "on-failure";
+        PrivateNetwork = cfg.database.createLocally; # defaultServiceConfig enables this by default, needs to be disabled for remote DBs
       };
       environment = env;
       # Allow the consumer to access the private /tmp directory of the server.
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 70726f126226..7bf52b43f3f7 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1333,7 +1333,14 @@ in
       restartTriggers = optionals cfg.enableReload [ configFile ];
       # Block reloading if not all certs exist yet.
       # Happens when config changes add new vhosts/certs.
-      unitConfig.ConditionPathExists = optionals (sslServices != []) (map (certName: certs.${certName}.directory + "/fullchain.pem") vhostCertNames);
+      unitConfig = {
+        ConditionPathExists = optionals (sslServices != []) (map (certName: certs.${certName}.directory + "/fullchain.pem") vhostCertNames);
+        # Disable rate limiting for this, because it may be triggered quickly a bunch of times
+        # if a lot of certificates are renewed in quick succession. The reload itself is cheap,
+        # so even doing a lot of them in a short burst is fine.
+        # FIXME: there's probably a better way to do this.
+        StartLimitIntervalSec = 0;
+      };
       serviceConfig = {
         Type = "oneshot";
         TimeoutSec = 60;
diff --git a/nixos/tests/headscale.nix b/nixos/tests/headscale.nix
index cb5ce26b7944..3ba331b7c3d4 100644
--- a/nixos/tests/headscale.nix
+++ b/nixos/tests/headscale.nix
@@ -13,7 +13,10 @@ import ./make-test-python.nix (
   in
   {
     name = "headscale";
-    meta.maintainers = with lib.maintainers; [ misterio77 ];
+    meta.maintainers = with lib.maintainers; [
+      kradalby
+      misterio77
+    ];
 
     nodes =
       let
diff --git a/pkgs/applications/audio/espeak-ng/default.nix b/pkgs/applications/audio/espeak-ng/default.nix
index e7463c8c6613..14835a9e0b60 100644
--- a/pkgs/applications/audio/espeak-ng/default.nix
+++ b/pkgs/applications/audio/espeak-ng/default.nix
@@ -9,7 +9,7 @@
   libtool,
   pkg-config,
   ronn,
-  substituteAll,
+  replaceVars,
   buildPackages,
   mbrolaSupport ? true,
   mbrola,
@@ -45,8 +45,7 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals mbrolaSupport [
       # Hardcode correct mbrola paths.
-      (substituteAll {
-        src = ./mbrola.patch;
+      (replaceVars ./mbrola.patch {
         inherit mbrola;
       })
     ];
diff --git a/pkgs/applications/display-managers/lightdm/default.nix b/pkgs/applications/display-managers/lightdm/default.nix
index c3988cdd4e68..45fa03377e69 100644
--- a/pkgs/applications/display-managers/lightdm/default.nix
+++ b/pkgs/applications/display-managers/lightdm/default.nix
@@ -4,7 +4,7 @@
   buildPackages,
   fetchFromGitHub,
   nix-update-script,
-  substituteAll,
+  replaceVars,
   plymouth,
   pam,
   pkg-config,
@@ -85,8 +85,7 @@ stdenv.mkDerivation rec {
     # Hardcode plymouth to fix transitions.
     # For some reason it can't find `plymouth`
     # even when it's in PATH in environment.systemPackages.
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       plymouth = "${plymouth}/bin/plymouth";
     })
   ];
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/codeium/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/codeium/default.nix
index 59be7f543d1c..bb6ad95c94b5 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/codeium/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/codeium/default.nix
@@ -3,7 +3,7 @@
   codeium,
   fetchFromGitHub,
   melpaBuild,
-  substituteAll,
+  replaceVars,
   gitUpdater,
 }:
 
@@ -19,8 +19,7 @@ melpaBuild {
   };
 
   patches = [
-    (substituteAll {
-      src = ./0000-set-codeium-command-executable.patch;
+    (replaceVars ./0000-set-codeium-command-executable.patch {
       codeium = lib.getExe' codeium "codeium_language_server";
     })
   ];
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index f8e5fc9ad1fd..47795ac8954b 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -23,10 +23,10 @@ let
     # certain plugins need a custom configuration (available in passthru.initLua)
     # to work with nix.
     # if true, the wrapper automatically appends those snippets when necessary
-    , autoconfigure ? false
+    , autoconfigure ? true
 
     # append to PATH runtime deps of plugins
-    , autowrapRuntimeDeps ? false
+    , autowrapRuntimeDeps ? true
 
     # should contain all args but the binary. Can be either a string or list
     , wrapperArgs ? []
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 1a78e3eb4793..0fac70eb1665 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -11,7 +11,6 @@
   fetchurl,
   neovimUtils,
   replaceVars,
-  substituteAll,
   # Language dependencies
   fetchYarnDeps,
   mkYarnModules,
@@ -58,6 +57,7 @@
   tmux,
   tup,
   typescript,
+  typescript-language-server,
   vim,
   which,
   xdg-utils,
@@ -188,8 +188,7 @@ in
 
   aw-watcher-vim = super.aw-watcher-vim.overrideAttrs {
     patches = [
-      (substituteAll {
-        src = ./patches/aw-watcher-vim/program_paths.patch;
+      (replaceVars ./patches/aw-watcher-vim/program_paths.patch {
         curl = lib.getExe curl;
       })
     ];
@@ -1103,8 +1102,7 @@ in
     super.fruzzy.overrideAttrs (old: {
       buildInputs = [ nim1 ];
       patches = [
-        (substituteAll {
-          src = ./patches/fruzzy/get_version.patch;
+        (replaceVars ./patches/fruzzy/get_version.patch {
           inherit (old) version;
         })
       ];
@@ -1243,8 +1241,7 @@ in
 
   gx-nvim = super.gx-nvim.overrideAttrs {
     patches = lib.optionals stdenv.hostPlatform.isLinux [
-      (substituteAll {
-        src = ./patches/gx-nvim/fix-paths.patch;
+      (replaceVars ./patches/gx-nvim/fix-paths.patch {
         inherit xdg-utils;
       })
     ];
@@ -1530,10 +1527,7 @@ in
     # https://github.com/NixOS/nixpkgs/pull/105810#issuecomment-740007985
     # https://github.com/camspiers/lens.vim/pull/40/files
     patches = [
-      (substituteAll {
-        src = ./patches/lens-vim/remove_duplicate_g_lens_animate.patch;
-        inherit languagetool;
-      })
+      ./patches/lens-vim/remove_duplicate_g_lens_animate.patch
     ];
   };
 
@@ -1662,8 +1656,7 @@ in
     in
     super.markdown-preview-nvim.overrideAttrs {
       patches = [
-        (substituteAll {
-          src = ./markdown-preview-nvim/fix-node-paths.patch;
+        (replaceVars ./markdown-preview-nvim/fix-node-paths.patch {
           node = "${nodejs}/bin/node";
         })
       ];
@@ -2573,8 +2566,7 @@ in
       "openscad.utilities"
     ];
     patches = [
-      (substituteAll {
-        src = ./patches/openscad.nvim/program_paths.patch;
+      (replaceVars ./patches/openscad.nvim/program_paths.patch {
         htop = lib.getExe htop;
         openscad = lib.getExe openscad;
         zathura = lib.getExe zathura;
@@ -2683,8 +2675,7 @@ in
 
   Preview-nvim = super.Preview-nvim.overrideAttrs {
     patches = [
-      (substituteAll {
-        src = ./patches/preview-nvim/hardcode-mdt-binary-path.patch;
+      (replaceVars ./patches/preview-nvim/hardcode-mdt-binary-path.patch {
         mdt = lib.getExe md-tui;
       })
     ];
@@ -3308,6 +3299,9 @@ in
       nvim-lspconfig
       plenary-nvim
     ];
+    runtimeDeps = [
+      typescript-language-server
+    ];
   };
 
   nvzone-typr = super.nvzone-typr.overrideAttrs {
@@ -3534,8 +3528,7 @@ in
     #   let g:grammarous#show_first_error = 1
     # see https://github.com/rhysd/vim-grammarous/issues/39
     patches = [
-      (substituteAll {
-        src = ./patches/vim-grammarous/set_default_languagetool.patch;
+      (replaceVars ./patches/vim-grammarous/set_default_languagetool.patch {
         inherit languagetool;
       })
     ];
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 625d048b8da0..fdc8c05b090b 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -57,6 +57,11 @@ callPackage ./generic.nix rec {
 
   updateScript = ./update-vscodium.sh;
 
+  # Editing the `codium` binary (and shell scripts) within the app bundle causes the bundle's signature
+  # to be invalidated, which prevents launching starting with macOS Ventura, because VSCodium is notarized.
+  # See https://eclecticlight.co/2022/06/17/app-security-changes-coming-in-ventura/ for more information.
+  dontFixup = stdenv.hostPlatform.isDarwin;
+
   meta = with lib; {
     description = ''
       Open source source code editor developed by Microsoft for Windows,
diff --git a/pkgs/applications/emulators/wine/packages.nix b/pkgs/applications/emulators/wine/packages.nix
index 3d87723f4404..c0dc9e9af2bb 100644
--- a/pkgs/applications/emulators/wine/packages.nix
+++ b/pkgs/applications/emulators/wine/packages.nix
@@ -5,7 +5,7 @@
   pkgsi686Linux,
   pkgsCross,
   callPackage,
-  substituteAll,
+  replaceVars,
   moltenvk,
   wineRelease ? "stable",
   supportFlags,
@@ -80,8 +80,7 @@ with src;
       mingwW64.buildPackages.gcc
     ];
     monos = [ mono ];
-    buildScript = substituteAll {
-      src = ./builder-wow.sh;
+    buildScript = replaceVars ./builder-wow.sh {
       # pkgconfig has trouble picking the right architecture
       pkgconfig64remove = lib.makeSearchPathOutput "dev" "lib/pkgconfig" [
         pkgs.glib
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index 9258defc289d..e5e552f299f9 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -2,7 +2,7 @@
   stdenv,
   lib,
   fetchurl,
-  substituteAll,
+  replaceVars,
   autoreconfHook,
   pkg-config,
   intltool,
@@ -74,8 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # to remove compiler from the runtime closure, reference was retained via
     # gimp --version --verbose output
-    (substituteAll {
-      src = ./remove-cc-reference.patch;
+    (replaceVars ./remove-cc-reference.patch {
       cc_version = stdenv.cc.cc.name;
     })
 
diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index b3069527f8b2..b03b88c3c7b2 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -41,7 +41,7 @@
 , potrace
 , python3
 , runCommand
-, substituteAll
+, replaceVars
 , wrapGAppsHook3
 , libepoxy
 , zlib
@@ -92,15 +92,13 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://gitlab.com/inkscape/inkscape/-/commit/eb6dadcf1a5c660167ba43f3606c8e7cc6529787.patch";
       hash = "sha256-FvbJV/YrBwhHg0kFdbhyd/Y9g7YV2nPIrRqZt7yJ50Q=";
     })
-    (substituteAll {
-      src = ./fix-python-paths.patch;
+    (replaceVars ./fix-python-paths.patch {
       # Python is used at run-time to execute scripts,
       # e.g., those from the "Effects" menu.
       python3 = lib.getExe python3Env;
     })
-    (substituteAll {
+    (replaceVars ./fix-ps2pdf-path.patch {
       # Fix path to ps2pdf binary
-      src = ./fix-ps2pdf-path.patch;
       inherit ghostscript;
     })
   ];
diff --git a/pkgs/applications/graphics/inkscape/extensions/textext/default.nix b/pkgs/applications/graphics/inkscape/extensions/textext/default.nix
index 840ba0333bb5..669ae89edd43 100644
--- a/pkgs/applications/graphics/inkscape/extensions/textext/default.nix
+++ b/pkgs/applications/graphics/inkscape/extensions/textext/default.nix
@@ -2,7 +2,7 @@
   lib,
   writeScript,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   inkscape,
   pdflatex,
   lualatex,
@@ -33,8 +33,7 @@ python3.pkgs.buildPythonApplication rec {
   patches = [
     # Make sure we can point directly to pdflatex in the extension,
     # instead of relying on the PATH (which might not have it)
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       inherit pdflatex lualatex;
     })
 
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 72c39afafb36..f82e788578c9 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -766,27 +766,27 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "131.0.6778.264",
+    "version": "132.0.6834.83",
     "deps": {
       "depot_tools": {
-        "rev": "20b9bdcace7ed561d6a75728c85373503473cb6b",
-        "hash": "sha256-vlBENaVTtbwDJtSswuszcUlx+icZYJeP6ew6MO1cAv0="
+        "rev": "41d43a2a2290450aeab946883542f8049b155c87",
+        "hash": "sha256-m/6b4VZZTUQOeED1mYvZOQCx8Re+Zd4O8SKDMjJ9Djo="
       },
       "gn": {
-        "rev": "95b0f8fe31a992a33c040bbe3867901335c12762",
-        "hash": "sha256-a8yCdBsl0nBMPS+pCLwrkAvQNP/THx/z/GySyOgx4Jk="
+        "rev": "feafd1012a32c05ec6095f69ddc3850afb621f3a",
+        "hash": "sha256-zZoD5Bx7wIEP2KJkHef6wHrxU3px+8Vseq29QcK32bg="
       },
       "ungoogled-patches": {
-        "rev": "131.0.6778.264-1",
-        "hash": "sha256-u/2iKhrJRbvOtv5Yi/AfSpR7Xu4NjBTF5G03wsVGEKo="
+        "rev": "132.0.6834.83-1",
+        "hash": "sha256-yL7eMNTL1FDoqXcwuHx5BzjjESjzsIfdzHCTZW9jXUo="
       },
-      "npmHash": "sha256-b1l8SwjAfoColoa3zhTMPEF/rRuxzT3ATHE77rWU5EA="
+      "npmHash": "sha256-H1/h3x+Cgp1x94Ze3UPPHxRVpylZDvpMXMOuS+jk2dw="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "2d05e31515360f4da764174f7c448b33e36da871",
-        "hash": "sha256-aAb+lMefY4+zADsVeyLIhNI4AQfGmzu+7Y8o3t2csmU=",
+        "rev": "03d59cf5ecf1d8444838ff9a1e96231304d4ff9c",
+        "hash": "sha256-2FuT20iW8Mp4AehdEFT5Ua3La5z8bmT1FdLaUZRL0CE=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -796,18 +796,23 @@
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "6a68fd412b9aecd515a20a7cf84d11b598bfaf96",
-        "hash": "sha256-7skqaen0XqbRvAGXQ0/3kea3vRInktdP3DOBeIBiGlQ="
+        "rev": "8e31ad42561900383e10dbefc1d3e8f38cedfbe9",
+        "hash": "sha256-kmhTlz/qjvN0Qlra7Wz05O6X058hPPn0nVvAxFXQDC4="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
-        "rev": "9a1d90c3b412d5ebeb97a6e33d98e1d0dd923221",
-        "hash": "sha256-zPm+Rif9fITazDvvm6SvLq8gwcPzPbuaXlRbyYqv7JA="
+        "rev": "cec7f478354a8c8599f264ed8bb6043b5468f72d",
+        "hash": "sha256-CwiK9Td8aRS08RywItHKFvibzDAUYYd0YNRKxYPLTD8="
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "efc3baa2d1ece3630fcfa72bef93ed831bcaec4c",
-        "hash": "sha256-0OBelaxkKdajYXrGgz08nyPZhxqpsnFXiF3m8DGQkDo="
+        "rev": "5b01ea4a6f3b666b7d190e7cb7c31db2ed4d94ce",
+        "hash": "sha256-uA+t5Ecc/iK3mllHR8AMVGRfU/7z1G3yrw0TamPQiOY="
+      },
+      "src/third_party/llvm-libc/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
+        "rev": "ca74a72e2b32ad804522bbef04dfe32560a10206",
+        "hash": "sha256-av9JdqLOQbezgRS4P8QXmvfB5l47v04WRagNJJgT5u4="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -826,8 +831,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "4811f9e01c4cfcbf9c6957015063eaaa0d92be91",
-        "hash": "sha256-98wwIeMTF2Wg2sJ07U1OUV83wR9nJOjGubp7Vnk3kj8="
+        "rev": "be9c3dfd3781964fc0bab0d6c91d9ad117b71b02",
+        "hash": "sha256-CqveHvjPEcRWnzi8w13xr2OainrmABNO8uj0GzKmQqo="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -836,13 +841,13 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "e0175250977c2b2b95087afc0857883538a1386c",
-        "hash": "sha256-1O+hnZF73AY44jcmajJlpaQY5PV4+x0hYwqf1TtMahY="
+        "rev": "9616efc903b7469161996006c8cf963238e26503",
+        "hash": "sha256-Z2uFWfZDYcY0m4R6mFMZJLnnVHu3/hQOAkCPQ5049SQ="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
-        "rev": "f650ff816f2ef227f61ea2e9f222aa69708ab367",
-        "hash": "sha256-qWsGQNUptbz0jYvUuxP7woNf5QQrfn9k3uvr82Yk0QM="
+        "rev": "1df5e50a45db9518a56ebb42cb020a94a090258b",
+        "hash": "sha256-gItDOfNqm1tHlmelz3l2GGdiKi9adu1EpPP6U7+8EQY="
       },
       "src/third_party/accessibility_test_framework/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/Accessibility-Test-Framework-for-Android.git",
@@ -851,8 +856,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "ac6cda4cbd716102ded6a965f79573b41581898d",
-        "hash": "sha256-7Zfc262U42G6BUlxnLp6sQ78VlWBt0pTzkYwXY0rqaE="
+        "rev": "ce13a00a2b049a1ef5e0e70a3d333ce70838ef7b",
+        "hash": "sha256-fMIHpa2QFsQQ19LGyhvV3Ihh6Ls8wwwhqTtpLoTEaf4="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -866,8 +871,8 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "179dd9f858f0f5b0e52b61aefc621dc82e2ad34a",
-        "hash": "sha256-B7X9PTlMQdolsvEfuCNaKnRFcvsPNZtn5FOcJBY6sCA="
+        "rev": "f674555ab03e6355e0981a647c115097e9fe5324",
+        "hash": "sha256-2ZhG4cJf85zO7x+SGG6RD2qgOxZVosxAIbuZt9GYUKs="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -881,13 +886,13 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "389450f61ea0b2057fc9ea393d3065859c4ba7f2",
-        "hash": "sha256-FK3tOLq5NcKQuStY5o8Lv2CXpjYHJm7n+NnyLFMOCxo="
+        "rev": "93f12c117a4e1c0cc2b129dcc52e84dbd9b84200",
+        "hash": "sha256-Q2CaWvDqOmfaPG6a+SUHG5rFHalPEf4Oq/ytT3xuSOk="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "740d2502dbbd719a76c5a8d3fb4dac1b5363f42e",
-        "hash": "sha256-R41YVv4uWCU6SsACXPRppeCDguTs+/NVJckvMGGTgJE="
+        "rev": "73dbf565079c89a531e6e01c4e8fc048a8a9660b",
+        "hash": "sha256-6P3Mw60+xZVsFbrhG6UkTlz8xvvEOptV3Ar1sos0CsU="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -896,8 +901,8 @@
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "080aeb7199e66e4b0a2b6383fd26a9f8d2cccbf5",
-        "hash": "sha256-YHEBGqfftgK68wWAWVTxtbl1GECBT1qTNe7irYkM/8k="
+        "rev": "ac36a797d3470e8ee906b98457a59270d01db30d",
+        "hash": "sha256-rhUNPA5b0H3PBsOpXbAeRLpS0tNQkiHbjRBWmJycSAY="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -921,38 +926,38 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "815ff2bb4038144dea89c33021bc4429f22a130f",
-        "hash": "sha256-28uZotrv+/MBBo+pcBWY3Csqrdv5Y4DxGbGEwK9Cwdw="
+        "rev": "8690defa74b6975c10e85c113f121d4b2a3f2564",
+        "hash": "sha256-ArbHGjkHd1sko7gDPFksYz7XHKNge+e6tVy6oKPuqzg="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
-        "rev": "8295336dd70f1201d42c22ab5b0861de38cf8fbf",
-        "hash": "sha256-PXsXIqWB4NNiFhanRjMIFSWYuW/IRuQo8mMPUBEentY="
+        "rev": "00fe003dac355b979f36157f9407c7c46448958e",
+        "hash": "sha256-IS7m1wBwpPBUNhx2GttY1fzvmLIeAp3o2gXfrFpRdvY="
       },
       "src/third_party/google_benchmark/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git",
-        "rev": "344117638c8ff7e239044fd0fa7085839fc03021",
-        "hash": "sha256-gztnxui9Fe/FTieMjdvfJjWHjkImtlsHn6fM1FruyME="
+        "rev": "761305ec3b33abf30e08d50eb829e19a802581cc",
+        "hash": "sha256-cH8s1gP6kCcojAAfTt5iQCVqiAaSooNk4BdaILujM3w="
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "cd95210465496ac2337b313cf49f607762abe286",
-        "hash": "sha256-172yvjgbFWQyd0PBRl74PJzpY/mDGC85D7PdeogNodU="
+        "rev": "571c76e919c0c48219ced35bef83e1fc83b00eed",
+        "hash": "sha256-ib9wbV6S64OFc4zx0wQsQ84+5RxbETK0PS9Wm1BFQ1U="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "6b0c5b7ee1988a14a4af94564e8ae8bba8a94374",
-        "hash": "sha256-kTkwRfaqw5ZCHEvu2YPZ+1vCfekHkY5pY3m9snDN64g="
+        "rev": "47f7823bdf4b1f39e462b2a497a674860e922e38",
+        "hash": "sha256-cFXUi2oO/614jF0GV7oW0ss62dXWFHDNWNT8rWHAiQc="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
-        "rev": "71f51fd6fa45fac73848f65421081edd723297cd",
-        "hash": "sha256-AalRQhJmornCqmvE2+36J/3LubaA0jr6P1PXy32lX4I="
+        "rev": "fbc5e98031e1271a0a566fcd4d9092b2d3275d05",
+        "hash": "sha256-o5/Lbhh6HHSWCVCEyDwDCgs+PLm67si981w0HuIWY7c="
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "44791916611acec1cd74c492c7453e46d9b0dbd2",
-        "hash": "sha256-SkF+RIIlU8Vl3AmN6kARkLuVz/X5vygNOtGN2K3Sr+M="
+        "rev": "b91cf840ac3255ef03b23cc93621369627422a1a",
+        "hash": "sha256-65cZPyqZUdSnYPJYUMYeJgx3mUC6L/qb9P2bDqd2Zkk="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -961,8 +966,8 @@
       },
       "src/third_party/chromium-variations": {
         "url": "https://chromium.googlesource.com/chromium-variations.git",
-        "rev": "7d681838b57a25ca6659b9cc0111f879147c416b",
-        "hash": "sha256-zio8SqKEqOYYjVWZnzfrPqngqym2lZu9M/hgSi3ey0Q="
+        "rev": "c170abb48f7715c237f4c06eaed0fe6f8a4c6f8d",
+        "hash": "sha256-mg5mu2jcy0xyNJ650ywWUMC94keRsqhZQuPZclHmyLI="
       },
       "src/third_party/cld_3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/cld_3.git",
@@ -981,8 +986,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "1e83a2fdd3102f65c6f1fb602c1b320486218a99",
-        "hash": "sha256-28cFACca+NYE8oKlP5aWXNCLeEjhWqJ6gRnFI+VxDvg="
+        "rev": "8df44962d437a0477f07ba6b8843d0b6a48646a4",
+        "hash": "sha256-FlvmSjY8kt5XHymDLaZdPuZ4k5xcagJk8w/U6adTkWI="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -991,23 +996,23 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "b08c5ad457bddea2664ba20fb25beb3d1799fed2",
-        "hash": "sha256-cwpcY8YTXk+VVIFphO5ihc5rvbG3ZY9iHeK81P5DHBs="
+        "rev": "554629b9242e6ae832ef14e3384654426f7fcc06",
+        "hash": "sha256-fvGypRhgl2uX9YE2cwjL7d3pYBa3Imd5p0RLhMYRgrc="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "b4d7ae714c548c3e139b95a85582dc15ece1d2f7",
-        "hash": "sha256-1RDDbvce5WR32if3cFYxiU9HS04x3BYIgOFJPMVJSBo="
+        "rev": "ae6f165652e0ea983d73f5d04b7470d08c869e4f",
+        "hash": "sha256-/K6eM9s+fd2wjCrK0g0CgFNy0zxEN9SxTvmE50hMtXw="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "20b9bdcace7ed561d6a75728c85373503473cb6b",
-        "hash": "sha256-vlBENaVTtbwDJtSswuszcUlx+icZYJeP6ew6MO1cAv0="
+        "rev": "41d43a2a2290450aeab946883542f8049b155c87",
+        "hash": "sha256-m/6b4VZZTUQOeED1mYvZOQCx8Re+Zd4O8SKDMjJ9Djo="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "5284f1c63b2b08c47b8915ce713a1aace991dfe9",
-        "hash": "sha256-1Nh9SVIAde4jxgwFucbtZpl6rMyPM4Plfi+dhwP0wI8="
+        "rev": "f2f3682c9db8ca427f8c64f0402cc2c5152c6c24",
+        "hash": "sha256-mBWZdbgZfO01Pt2lZSHX/d5r+8A/+qCZA8MRtZdeTrs="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1016,8 +1021,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "7eea0a9213e801ad9479a6499fd0330ec1db8693",
-        "hash": "sha256-JkOjOnLrDOcYHi3hptT1BDRvsKpTtOsBHT8YLb1hlJM="
+        "rev": "b396a6fbb2e173f52edb3360485dedf3389ef830",
+        "hash": "sha256-UroGjERR5TW9KbyLwR/NBpytXrW1tHfu6ZvQPngROq4="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -1031,8 +1036,8 @@
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "686d6944501a6ee9c849581e3fe343273d4af3f6",
-        "hash": "sha256-j5mpWn4j+U4rRlXbq8okUUXrRKycZkiV+UntiS90ChM="
+        "rev": "591ae4b02eaff9a03e2ec863da895128b0b49910",
+        "hash": "sha256-wwHxNuZe2hBmGBpVg/iQJBoL350jfPYPTPqDn3RiqZE="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -1066,8 +1071,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "f02bffad0fd57f3acfa835c3f2899c5b71ff8be0",
-        "hash": "sha256-Lc2hbmZnnXQa0vzlJCizNBQ5WCOI5sJglTTe5gWVYUA="
+        "rev": "0ae7e607370cc66218ccfacf5de4db8a35424c2f",
+        "hash": "sha256-+nbRZi3vAMTURhhFVUu5+59fVIv0GH3YZog2JavyVLY="
       },
       "src/third_party/freetype-testing/src": {
         "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git",
@@ -1116,8 +1121,8 @@
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
-        "rev": "62df7bdbc10887e094661e07ec2595b7920376fd",
-        "hash": "sha256-Iv/7r79cKC1pFkxPPHK/IHv/HFx18XZ4YVr+C2CX8+M="
+        "rev": "d144031940543e15423a25ae5a8a74141044862f",
+        "hash": "sha256-n7tiIFAj8AiSCa9Tw+1j+ro9cSt5vagZpkbBBUUtYQY="
       },
       "src/third_party/hunspell_dictionaries": {
         "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git",
@@ -1141,8 +1146,8 @@
       },
       "src/third_party/libFuzzer/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git",
-        "rev": "487e79376394754705984c5de7c4ce7f82f2bd7c",
-        "hash": "sha256-xQXfRIcQmAVP0k2mT7Blv1wBxL6wDaWTbIPGcTiMZRo="
+        "rev": "a7128317fe7935a43d6c9f39df54f21113951941",
+        "hash": "sha256-jPS+Xi/ia0sMspxSGN38zasmVS/HslxH/qOFsV9TguE="
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
@@ -1161,28 +1166,23 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "840f8797871cc587f7113ea9d2483a1156d57c0e",
-        "hash": "sha256-2XHqNAmv2L3TEFXu4Q6rnASLmuE93QplSVKNqyhlKUk="
+        "rev": "be60f06ab420d6a65c477213f04c8b0f2e12ba2e",
+        "hash": "sha256-9VhEVOG9cReDOGoX+x5G/jJ8Y5RDoQIiLMoZtt5c9pI="
       },
       "src/third_party/libavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/AOMediaCodec/libavif.git",
-        "rev": "2c36aed375fff68611641b57d919b191f33431d5",
-        "hash": "sha256-fApdfzEtQnmio6BVzkcr/VkwojrNs+cx/+Am80H9dXw="
+        "rev": "1cdeff7ecf456492c47cf48fc0cef6591cdc95da",
+        "hash": "sha256-lUuVyh2srhWMNUp4lEivyDic3MSZf5s63iAb84We80M="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "ffad64ff4e349f926ad5ffcc882e205a94156d77",
-        "hash": "sha256-M2ExAgLm/NZ2soQEv3Ap/qx/B3+nd3NdDqYOL0E/pc8="
-      },
-      "src/third_party/libavifinfo/src": {
-        "url": "https://aomedia.googlesource.com/libavifinfo.git",
-        "rev": "8d8b58a3f517ef8d1794baa28ca6ae7d19f65514",
-        "hash": "sha256-61OPjdMCIbHvWncmBzNw6sqlHcuc1kyqm9k1j4UTcZ0="
+        "rev": "c3548280e0a516ed7cad7ff1591b5807cef64aa4",
+        "hash": "sha256-hO5epHYNYI6pGwVSUv1Hp3qb7qOv8uOs4u+IdhDxd8Q="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
-        "rev": "1b382075dd1bd545655af7ebef949b3090061b74",
-        "hash": "sha256-kpyJiFXtk8eK8EkgzUbG0GS+znEeqzlB62qy9tPpEC8="
+        "rev": "8e87a6e51c93e7836ecdbcc0a520c7992f3ece13",
+        "hash": "sha256-DO3FW5Q233ctFKk4K5F8oZec9kfrVl6uxAwMn0niKz4="
       },
       "src/third_party/beto-core/src": {
         "url": "https://beto-core.googlesource.com/beto-core.git",
@@ -1206,8 +1206,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "902e8ca804ae6c05f505e510c16647c32ce4d1cb",
-        "hash": "sha256-j2m9zVajkAdPF1ehLX0Gxp4LyMunhFDDCzrCm2WzArc="
+        "rev": "9129cf4b2a5ca775c280243257a0b4856a93c7fb",
+        "hash": "sha256-owXaTIj0pbhUeJkirxaRoCmgIN9DwNzY3h771kaN+Fc="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -1256,8 +1256,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "906334ac1de2b0afa666472dce5545b82c1251fb",
-        "hash": "sha256-7GInV/uHuK6bUa1dSBuxJn6adyjfoOqSqfmfTvQbAoc="
+        "rev": "727319a77ffe68e9aacb08e09ae7151b3a8f70a3",
+        "hash": "sha256-QGm37X4uid8zv+vRu0pVTvoQd2WcKztrj3tJkDjx82o="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1271,8 +1271,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "a8e59d207483f75b87dd5fc670e937672cdf5776",
-        "hash": "sha256-gTNmhYuYmt/JmWSAVbcE4PqG3kW/JaL7XEWXbiNVfMM="
+        "rev": "6ac7c8f25170c85265fca69fd1fe5d31baf3344f",
+        "hash": "sha256-vPVq7RzqO7gBUgYuNX0Fwxqok9jtXXJZgbhVFchG5Ws="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -1306,8 +1306,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "4f27c4f1698522dfcea36dca948a13e2eaf4c26c",
-        "hash": "sha256-dosSqpFlvli60ZJ0vexVZOK/FmzOYq5BDrZKZW0lMfc="
+        "rev": "cb6fd42532fc3a831d6863d5006217e32a67c417",
+        "hash": "sha256-IlGxfw6Mhc7FYvhU2+Ngt9qflqr4JMC2OcplvksGI+U="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -1321,13 +1321,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "7a8409531fbb58d7d15ae331e645977b113d7ced",
-        "hash": "sha256-KlqgaOxKJQHHjU1g1VCcJEBhv809DdEUedrxdk8N99I="
+        "rev": "84a8011ec69d0e2de271c05be7d62979608040d9",
+        "hash": "sha256-d8qJECIdq01ct+sS7cHVKFulYJarwahKCEcVf762JNI="
       },
       "src/third_party/perfetto": {
         "url": "https://android.googlesource.com/platform/external/perfetto.git",
-        "rev": "24764a1d9c2fce1e9816ffae691f00353ade330d",
-        "hash": "sha256-FAaxTuIYExmL3PSWwcvLpnPD4qsGDGr4/CIyi0NSrnI="
+        "rev": "ea011a2c2d3aecdc4f1674887e107a56d2905edd",
+        "hash": "sha256-3vervpsq/QLMrR7RcJMwwh+CdFvSEj8yAzj6s9d1XMo="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -1346,8 +1346,8 @@
       },
       "src/third_party/quic_trace/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/quic-trace.git",
-        "rev": "caa0a6eaba816ecb737f9a70782b7c80b8ac8dbc",
-        "hash": "sha256-Nf9ZDLcE1JunhbpEMHhrY2ROnbgrvVZoRkPwWq1DU0g="
+        "rev": "413da873d93a03d3662f24b881ea459a79f9c589",
+        "hash": "sha256-N1uFoNd3mz/LH1z06581Ds7BUyc67SNXUPzqomYREr8="
       },
       "src/third_party/pywebsocket3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/pywebsocket3.git",
@@ -1366,8 +1366,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "f14f6b1ab7cf544c0190074488d17821281cfa4d",
-        "hash": "sha256-0p57otDuIShl6MngYs22XA1QYxptDVa3vCwJsH59H34="
+        "rev": "c17fe9bc158c29de3cdd655ac73d14f52c17810a",
+        "hash": "sha256-mRfkEm+NzEX0DkJejk1THx4G7v0sIFmRrAnt3Zl5uco="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1386,8 +1386,8 @@
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "7a9a492a38b7c701f7c96a15a76046aed8f8c0c3",
-        "hash": "sha256-6uBO4jwPSqhT4j+KTE0Za7B4prrE2kstsHNtHwTJX+Q="
+        "rev": "d5c4284774115bb1e32c012a2be1b5fbeb1ab1f9",
+        "hash": "sha256-h2BHyaOM0oscfX5cu8s4N1yyOkg/yQbvwD1DxF+RAQc="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -1396,18 +1396,18 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "689e8a82f8070a372981b7476fb673e243330d71",
-        "hash": "sha256-tImVDNyS5hCN6A1ODeVuB7XLCNr3EdxN8x961nPCM9g="
+        "rev": "658227d3b535287dc6859788bde6076c4fe3fe7c",
+        "hash": "sha256-gOUt/NljRK5wMFwy2aLqZ5NHwk4y/GxbQ+AZ3MxM0M8="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "73fd75175922012f21557239b7743a152ea7f1fd",
-        "hash": "sha256-D8UIXXQX6dTxbuqFgd6AbmErr1r9839yiN6MrJlsqPw="
+        "rev": "0b56dd5952b25fad65139b64096fcd187048ed38",
+        "hash": "sha256-LVWvbMLjkMyAUM+0UpQ4oRsfcRU5F/xY60wiwxth4Ko="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "2acc4ea0028bc703be2d4e9bc8a4032d015d6516",
-        "hash": "sha256-mwcvSRycM8bq3dDWk4yfkL8Tg5bfEap6lrr1Oxemzy4="
+        "rev": "9c644fcb5b9a1a9c975c50a790fd14c5451292b0",
+        "hash": "sha256-twWSeJp9bNbLYFszCWv9BCztfbXUBKSWV55/U+hd2hw="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -1416,38 +1416,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "50bc4debdc3eec5045edbeb8ce164090e29b91f3",
-        "hash": "sha256-Zv5QZ8MmP45MH5e6EBDNPmP0vcjjNXJHKva5MNh5ovA="
+        "rev": "996c728cf7dcfb29845cfa15222822318f047810",
+        "hash": "sha256-FrT/kVIMjcu2zv+7kDeNKM77NnOyMBb8pV0w8DBP42A="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "42b315c15b1ff941b46bb3949c105e5386be8717",
-        "hash": "sha256-xb0TlPyXP2wu7jMrWZu+z8WC5mk0CbYgvkZEt3r+mww="
+        "rev": "9117e042b93d4ff08d2406542708170f77aaa2a3",
+        "hash": "sha256-m/a1i26u8lzpKuQHyAy6ktWWjbLZEaio1awz8VovTGE="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "14345dab231912ee9601136e96ca67a6e1f632e7",
-        "hash": "sha256-ny/UVx4r+Fj39ZEepaWqDPplAJcrBQEQlkqsSofwLJ0="
+        "rev": "cbcad3c0587dddc768d76641ea00f5c45ab5a278",
+        "hash": "sha256-exXzafLgrgxyRvaF+4pCF+OLtPT2gDmcvzazQ4EQ1eA="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "bd1c8ea9c6ac51e4c3a6ddb9d602bb204678eb5f",
-        "hash": "sha256-Ze/DGiD8Zj3mY+5Pi+tf6xMrX2YBqfl4Nc37b/JgmnI="
+        "rev": "b0177a972b8d47e823a4500cf88df88a8c27add7",
+        "hash": "sha256-NDp2TLeMLAHb92R+PjaPDTx8ckIlpSsS3BNx3lerB68="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "c9a5acda16dc2759457dc856b5d7df00ac5bf4a2",
-        "hash": "sha256-0JzqUW6XbhPbLGs/smuNG6zQoWP8iaAO5VglGSyN94g="
+        "rev": "15f2de809304aba619ee327f3273425418ca83de",
+        "hash": "sha256-PiWKL045DAOGm+Hl/UyO6vmD4fVfuf2fSvXK6gSYbwo="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "8c907ea21fe0147f791d79051b18e21bc8c4ede0",
-        "hash": "sha256-2abhzNt/rKbAhGQZhUhQ2LoemtU1Yh1fx9rrijOtjy4="
+        "rev": "87ab6b39a97d084a2ef27db85e3cbaf5d2622a09",
+        "hash": "sha256-luDw6g/EMSK67Et2wNta74PHGQU6Y7IRpDlSpgDYV6Q="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "cbb4ab171fc7cd0b636a76ee542e238a8734f4be",
-        "hash": "sha256-nKpS0ddAsN2KhOg6J/SwB8ZlVXrJTVixD4DuUkyxb6c="
+        "rev": "bc2c38412f739c298d6f5c076c064e6b5696959f",
+        "hash": "sha256-WWV+P++0Czeqg5p2UTqIP81pY8oz7cS7E7Z/sc0km6g="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -1486,13 +1486,13 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "ae8b3ca40fbeee0bc67ef41a6c5b6dd5af839344",
-        "hash": "sha256-7u5Ay43GtcVTt3Cwg/5OaYQdG6SXXYtUun7DVN+XChE="
+        "rev": "b9f32fd2943dd2b3d0033bf938c9d843f4b5c9a9",
+        "hash": "sha256-Dd5uWNtnBIc2jiMkh9KjI5O1tJtmMvdlMA2nf+VOkQQ="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "79aff54b0fa9238ce3518dd9eaf9610cd6f22e82",
-        "hash": "sha256-xkMnUduSG88EWiwq6PITN0KgAKjFd4QOis3dgxedK30="
+        "rev": "afaf497805cbb502da89991c2dcd783201efdd08",
+        "hash": "sha256-S8kGTd3+lf5OTayCMOqqrjxH4tcbT0NLZBpKmTCysMs="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1511,8 +1511,8 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "3986629de01e518a3f2359bf5629ef2b7ef72330",
-        "hash": "sha256-x8GQUj75mQXswI3b29tS9u25Zx3peYqDM8v1/wkC9cs="
+        "rev": "d1d33679661a34f03a806af2b813f699db3004f9",
+        "hash": "sha256-aDPlmLxNY9M5+Qb8VtdfxphHXU/X6JwYhkUSXkLh/FE="
       },
       "src/tools/page_cycler/acid3": {
         "url": "https://chromium.googlesource.com/chromium/deps/acid3.git",
@@ -1521,13 +1521,13 @@
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "20707e3718ee14250fb8a44b3bf023ea36bd88df",
-        "hash": "sha256-/IUfh0De9m7ACrisqKlpxZsb+asoAWGXCaK6L+s24Q8="
+        "rev": "7fb5347e88f10472226c9aa1962a148e55d8c480",
+        "hash": "sha256-4J/F2v2W3mMdhqQ4q35gYkGaqTKlcG6OxUt3vQ8pcLs="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "9c09e7876ff830e1f9a731aa930040d1028ff5a1",
-        "hash": "sha256-OKa0W4s3VfaQ/MBHkrkZ8/LeRGqjGh9hTaqet7S4o58="
+        "rev": "e51f1d7dbd113aa01ddfb30890c8a89b11fcd96c",
+        "hash": "sha256-KJirPTvmC6vRTvrl6Nl0SQSieX/OhgfIiTblMxgoAvU="
       }
     }
   }
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 5c645dc7165c..c97fdea4af83 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "134.0-1",
+  "packageVersion": "134.0.1-1",
   "source": {
-    "rev": "134.0-1",
-    "sha256": "bu9ec9gK4b1OkC2Z1ycr/lmhrSB5TcIqcHXaZxf0Vmw="
+    "rev": "134.0.1-1",
+    "hash": "sha256-YtZb+VaJu+zofIjJUUx6FjVsEb1sCgFsGlxgP++Yki0="
   },
   "firefox": {
-    "version": "134.0",
-    "sha512": "EnWmhtwKJ7SN9K4FYWURUS9nbgNHTjCVslIerCWjhdNFqj6HhnFtvoEq9J4H1ysydyR5CJ1kiWjiAEygycNTRA=="
+    "version": "134.0.1",
+    "hash": "sha512-P0DKWnU6ZuCK9OixLXX+q2ewVn7P/TT1zwE/Sa64CczUWMgBHpRW3JAsJOr2JgeBF4dFFOtAzuVXTq/Ok+53LQ=="
   }
 }
diff --git a/pkgs/applications/networking/browsers/librewolf/src.nix b/pkgs/applications/networking/browsers/librewolf/src.nix
index ead541fa36d6..da05c980e09b 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.nix
+++ b/pkgs/applications/networking/browsers/librewolf/src.nix
@@ -8,15 +8,19 @@ let
 in
 {
   inherit (src) packageVersion;
-  source = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "librewolf";
-    repo = "source";
-    fetchSubmodules = true;
-    inherit (src.source) rev sha256;
-  };
-  firefox = fetchurl {
-    url = "mirror://mozilla/firefox/releases/${src.firefox.version}/source/firefox-${src.firefox.version}.source.tar.xz";
-    inherit (src.firefox) sha512;
-  };
+  source = fetchFromGitea (
+    src.source
+    // {
+      domain = "codeberg.org";
+      owner = "librewolf";
+      repo = "source";
+      fetchSubmodules = true;
+    }
+  );
+  firefox = fetchurl (
+    src.firefox
+    // {
+      url = "mirror://mozilla/firefox/releases/${src.firefox.version}/source/firefox-${src.firefox.version}.source.tar.xz";
+    }
+  );
 }
diff --git a/pkgs/applications/office/paperwork/openpaperwork-core.nix b/pkgs/applications/office/paperwork/openpaperwork-core.nix
index 01317f647589..44672bcf4cf4 100644
--- a/pkgs/applications/office/paperwork/openpaperwork-core.nix
+++ b/pkgs/applications/office/paperwork/openpaperwork-core.nix
@@ -1,7 +1,7 @@
 {
   buildPythonPackage,
   lib,
-  fetchFromGitLab,
+  callPackage,
 
   isPy3k,
   isPyPy,
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "openpaperwork-core";
-  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  inherit (callPackage ./src.nix { }) version src;
   format = "pyproject";
 
   sourceRoot = "${src.name}/openpaperwork-core";
diff --git a/pkgs/applications/office/paperwork/openpaperwork-gtk.nix b/pkgs/applications/office/paperwork/openpaperwork-gtk.nix
index 2e88ee23bfe5..a2bbb74abd31 100644
--- a/pkgs/applications/office/paperwork/openpaperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/openpaperwork-gtk.nix
@@ -1,7 +1,7 @@
 {
   buildPythonPackage,
   lib,
-  fetchFromGitLab,
+  callPackage,
 
   isPy3k,
   isPyPy,
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "openpaperwork-gtk";
-  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  inherit (callPackage ./src.nix { }) version src;
   format = "pyproject";
 
   sourceRoot = "${src.name}/openpaperwork-gtk";
diff --git a/pkgs/applications/office/paperwork/paperwork-backend.nix b/pkgs/applications/office/paperwork/paperwork-backend.nix
index 0d0cee9f69fc..da40d64aff0c 100644
--- a/pkgs/applications/office/paperwork/paperwork-backend.nix
+++ b/pkgs/applications/office/paperwork/paperwork-backend.nix
@@ -1,7 +1,7 @@
 {
   buildPythonPackage,
   lib,
-  fetchFromGitLab,
+  callPackage,
   pyenchant,
   scikit-learn,
   pypillowfight,
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "paperwork-backend";
-  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  inherit (callPackage ./src.nix { }) version src;
   format = "pyproject";
 
   sourceRoot = "${src.name}/paperwork-backend";
diff --git a/pkgs/applications/office/paperwork/paperwork-gtk.nix b/pkgs/applications/office/paperwork/paperwork-gtk.nix
index 3f8876779d83..0ff7a13e031f 100644
--- a/pkgs/applications/office/paperwork/paperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/paperwork-gtk.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  callPackage,
   python3Packages,
   gtk3,
   cairo,
@@ -9,7 +10,6 @@
   dbus,
   libnotify,
   wrapGAppsHook3,
-  fetchFromGitLab,
   which,
   gettext,
   gobject-introspection,
@@ -32,7 +32,7 @@ let
     imagemagick
     perlPackages.Po4a
   ];
-  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src sample_documents;
+  inherit (callPackage ./src.nix { }) version src sample_documents;
 in
 
 python3Packages.buildPythonApplication rec {
diff --git a/pkgs/applications/office/paperwork/paperwork-shell.nix b/pkgs/applications/office/paperwork/paperwork-shell.nix
index 21e3976a9ada..787c7193ef9f 100644
--- a/pkgs/applications/office/paperwork/paperwork-shell.nix
+++ b/pkgs/applications/office/paperwork/paperwork-shell.nix
@@ -1,7 +1,7 @@
 {
   buildPythonPackage,
   lib,
-  fetchFromGitLab,
+  callPackage,
 
   isPy3k,
   isPyPy,
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "paperwork-shell";
-  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  inherit (callPackage ./src.nix { }) version src;
   format = "pyproject";
 
   sourceRoot = "${src.name}/paperwork-shell";
diff --git a/pkgs/applications/office/paperwork/src.nix b/pkgs/applications/office/paperwork/src.nix
index 5f83eddd3fb7..7038309799e8 100644
--- a/pkgs/applications/office/paperwork/src.nix
+++ b/pkgs/applications/office/paperwork/src.nix
@@ -1,14 +1,34 @@
-{ fetchFromGitLab }:
+{
+  fetchFromGitLab,
+  srcOnly,
+  fetchpatch,
+}:
 rec {
   version = "2.2.5";
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    repo = "paperwork";
-    group = "World";
-    owner = "OpenPaperwork";
-    rev = version;
-    sha256 = "sha256-PRh0ohmPLwpM76qYfbExFqq4OK6Hm0fbdzrjXungSoY=";
+  src = srcOnly {
+    pname = "paperwork-patched-src";
+    inherit version;
+    src = fetchFromGitLab {
+      domain = "gitlab.gnome.org";
+      repo = "paperwork";
+      group = "World";
+      owner = "OpenPaperwork";
+      rev = version;
+      sha256 = "sha256-PRh0ohmPLwpM76qYfbExFqq4OK6Hm0fbdzrjXungSoY=";
+    };
+    patches = [
+      # fix installing translations
+      # remove on next release
+      (
+        assert version == "2.2.5";
+        fetchpatch {
+          url = "https://gitlab.gnome.org/World/OpenPaperwork/paperwork/-/commit/b8e2633ace0f3d9d57e68c27db8f594b8a5ddd7e.patch";
+          hash = "sha256-VUT86kF0ZHLGK457ZrrIBMeiZqg/rPRpbkBA/ua9rU8=";
+        }
+      )
+    ];
   };
+
   sample_documents = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     repo = "paperwork-test-documents";
diff --git a/pkgs/applications/science/biology/samtools/default.nix b/pkgs/applications/science/biology/samtools/default.nix
index f7426dd11270..10bb0010a940 100644
--- a/pkgs/applications/science/biology/samtools/default.nix
+++ b/pkgs/applications/science/biology/samtools/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "samtools";
-  version = "1.19.2";
+  version = "1.21";
 
   src = fetchurl {
     url = "https://github.com/samtools/samtools/releases/download/${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-cfYEmWaOTAjn10X7/yTBXMigl3q6sazV0rtBm9sGXpY=";
+    hash = "sha256-BXJLCDprbwMF/K5SQ6BWzDbPgmMJw8uTR6a4nuP8Wto=";
   };
 
   # tests require `bgzip` from the htslib package
diff --git a/pkgs/applications/video/vdr/softhddevice/default.nix b/pkgs/applications/video/vdr/softhddevice/default.nix
index 7f6637ec3f61..8dce8caae6a0 100644
--- a/pkgs/applications/video/vdr/softhddevice/default.nix
+++ b/pkgs/applications/video/vdr/softhddevice/default.nix
@@ -15,12 +15,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vdr-softhddevice";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "ua0lnj";
     repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-bddPyOx8tCG+us9QQxO1t7rZK1HfZy3TFWtd5mPw2o4=";
+    sha256 = "sha256-T/A85lkKCjBaEaXGxVTurc1VY01mBCTv8t8m5qzvtpY=";
     rev = "v${version}";
   };
 
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index be348027945a..8ec8874f51e4 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -38,7 +38,7 @@
   libvpx,
   nettools,
   dbus,
-  substituteAll,
+  replaceVars,
   gsoap,
   zlib,
   xz,
@@ -235,10 +235,11 @@ stdenv.mkDerivation (finalAttrs: {
     # these issues by patching the code to set QT_PLUGIN_PATH to the necessary paths,
     # after the code that unsets it. Note that qtsvg is included so that SVG icons from
     # the user's icon theme can be loaded.
-    ++ optional (!headless && enableHardening) (substituteAll {
-      src = ./qt-env-vars.patch;
-      qtPluginPath = "${qtbase}/bin/${qtbase.qtPluginPrefix}:${qtsvg}/bin/${qtbase.qtPluginPrefix}:${qtwayland}/bin/${qtbase.qtPluginPrefix}";
-    })
+    ++ optional (!headless && enableHardening) (
+      replaceVars ./qt-env-vars.patch {
+        qtPluginPath = "${qtbase}/bin/${qtbase.qtPluginPrefix}:${qtsvg}/bin/${qtbase.qtPluginPrefix}:${qtwayland}/bin/${qtbase.qtPluginPrefix}";
+      }
+    )
     # While the KVM patch should not break any other behavior if --with-kvm is not specified,
     # we don't take any chances and only apply it if people actually want to use KVM support.
     ++ optional enableKvm (
diff --git a/pkgs/build-support/mitm-cache/default.nix b/pkgs/build-support/mitm-cache/default.nix
index 80287e60a33a..8d206034f7ea 100644
--- a/pkgs/build-support/mitm-cache/default.nix
+++ b/pkgs/build-support/mitm-cache/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   callPackage,
   rustPlatform,
-  substituteAll,
+  replaceVars,
   openssl,
   Security,
   python3Packages,
@@ -27,8 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-6eYOSSlswJGR2IrFo17qVnwI+h2FkyTjLFvwf62nG2c=";
 
-  setupHook = substituteAll {
-    src = ./setup-hook.sh;
+  setupHook = replaceVars ./setup-hook.sh {
     inherit openssl;
     ephemeral_port_reserve = python3Packages.ephemeral-port-reserve;
   };
diff --git a/pkgs/by-name/al/almo/package.nix b/pkgs/by-name/al/almo/package.nix
index 6c7e2c516ff1..b9b9480d9ea1 100644
--- a/pkgs/by-name/al/almo/package.nix
+++ b/pkgs/by-name/al/almo/package.nix
@@ -5,18 +5,15 @@
   gcc,
   python312Packages,
 }:
-let
-  version = "0.9.5-alpha";
-in
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "almo";
-  inherit version;
+  version = "0.9.6-alpha";
 
   src = fetchFromGitHub {
     owner = "abap34";
     repo = "almo";
-    tag = "v${version}";
-    sha256 = "sha256-Cz+XDJmdp+utzwm1c7ThTNS6kfNF6r4B16tnGQSCVMc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eNigZUeUz6ZjQsn+0S6+Orv0WoLbqGgoA3+wG5ZcSBI=";
   };
 
   buildInputs = [
@@ -45,7 +42,8 @@ stdenv.mkDerivation {
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
     homepage = "https://github.com/abap34/almo";
+    changelog = "https://github.com/abap34/almo/releases/tag/${finalAttrs.src.tag}";
     maintainers = with lib.maintainers; [ momeemt ];
     mainProgram = "almo";
   };
-}
+})
diff --git a/pkgs/by-name/al/alpine-make-rootfs/package.nix b/pkgs/by-name/al/alpine-make-rootfs/package.nix
index c4c42b0acfcc..c16f44c6ad1f 100644
--- a/pkgs/by-name/al/alpine-make-rootfs/package.nix
+++ b/pkgs/by-name/al/alpine-make-rootfs/package.nix
@@ -16,13 +16,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "alpine-make-rootfs";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "alpinelinux";
     repo = "alpine-make-rootfs";
     rev = "v${version}";
-    hash = "sha256-3j++mbQc6ozayZISgDFS9r35ovP0qLoflT6ahp8SUbc=";
+    hash = "sha256-sNqaMBtbklSBcKxsc3ROI30bE1PUzJJeZqLqC9p3H+U=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ar/arc-browser/package.nix b/pkgs/by-name/ar/arc-browser/package.nix
index 65fa10a52e49..9610a01feb64 100644
--- a/pkgs/by-name/ar/arc-browser/package.nix
+++ b/pkgs/by-name/ar/arc-browser/package.nix
@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arc-browser";
-  version = "1.77.0-57419";
+  version = "1.78.1-57736";
 
   src = fetchurl {
     url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-euPJvD/BM0jVh3oBMsZNAZeyxTNRA4dmwIYNhwTjHoI=";
+    hash = "sha256-n81GMJ1Lhx8z/wwicyEKCbJM7WVi0mepSbefSXMuM3g=";
   };
 
   nativeBuildInputs = [ undmg ];
diff --git a/pkgs/by-name/bc/bcc/bashreadline.py-remove-dependency-on-elftools.patch b/pkgs/by-name/bc/bcc/bashreadline.py-remove-dependency-on-elftools.patch
new file mode 100644
index 000000000000..dfc3d3c9d2bb
--- /dev/null
+++ b/pkgs/by-name/bc/bcc/bashreadline.py-remove-dependency-on-elftools.patch
@@ -0,0 +1,48 @@
+From 25c77bff079c331ae12d9e4499c82fdabf301610 Mon Sep 17 00:00:00 2001
+From: Dominique Martinet <asmadeus@codewreck.org>
+Date: Sun, 21 Jul 2024 20:59:51 +0900
+Subject: [PATCH] bashreadline.py: remove dependency on elftools
+
+This helper is only here to differentiate between very old bash
+versions or semi-recent ones; since we'll only catter to newer
+bash versions we don't need to bother with elftools here:
+just hardcode the newer symbol.
+---
+ tools/bashreadline.py | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+diff --git a/tools/bashreadline.py b/tools/bashreadline.py
+index 7e8324a2c0ea..e4b20aeb2371 100755
+--- a/tools/bashreadline.py
++++ b/tools/bashreadline.py
+@@ -17,7 +17,6 @@
+ # 12-Feb-2016    Allan McAleavy migrated to BPF_PERF_OUTPUT
+ 
+ from __future__ import print_function
+-from elftools.elf.elffile import ELFFile
+ from bcc import BPF
+ from time import strftime
+ import argparse
+@@ -33,18 +32,7 @@ args = parser.parse_args()
+ 
+ name = args.shared if args.shared else "/bin/bash"
+ 
+-
+-def get_sym(filename):
+-    with open(filename, 'rb') as f:
+-        elf = ELFFile(f)
+-        symbol_table = elf.get_section_by_name(".dynsym")
+-        for symbol in symbol_table.iter_symbols():
+-            if symbol.name == "readline_internal_teardown":
+-                return "readline_internal_teardown"
+-    return "readline"
+-
+-
+-sym = get_sym(name)
++sym = "readline_internal_teardown"
+ 
+ # load BPF program
+ bpf_text = """
+-- 
+2.45.2
+
diff --git a/pkgs/by-name/bc/bcc/package.nix b/pkgs/by-name/bc/bcc/package.nix
index b0f511c96b6c..e8404b9fb624 100644
--- a/pkgs/by-name/bc/bcc/package.nix
+++ b/pkgs/by-name/bc/bcc/package.nix
@@ -15,13 +15,14 @@
   netperf,
   nixosTests,
   python3Packages,
+  readline,
   stdenv,
   zip,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.32.0";
+  version = "0.33.0";
 
   disabled = !stdenv.hostPlatform.isLinux;
 
@@ -29,7 +30,7 @@ python3Packages.buildPythonApplication rec {
     owner = "iovisor";
     repo = "bcc";
     tag = "v${version}";
-    hash = "sha256-urEHDDBBIdopQiT/QI5WtTbIO45pBk6bTNpfs8q/2hA=";
+    hash = "sha256-6dT3seLuEVQNKWiYGLK1ajXzW7pb62S/GQ0Lp4JdGjc=";
   };
   format = "other";
 
@@ -50,6 +51,9 @@ python3Packages.buildPythonApplication rec {
     # This is needed until we fix
     # https://github.com/NixOS/nixpkgs/issues/40427
     ./fix-deadlock-detector-import.patch
+    # Quick & dirty fix for bashreadline
+    # https://github.com/NixOS/nixpkgs/issues/328743
+    ./bashreadline.py-remove-dependency-on-elftools.patch
   ];
 
   propagatedBuildInputs = [ python3Packages.netaddr ];
@@ -85,7 +89,10 @@ python3Packages.buildPythonApplication rec {
 
     # https://github.com/iovisor/bcc/issues/3996
     substituteInPlace src/cc/libbcc.pc.in \
-      --replace '$'{exec_prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@
+      --replace-fail '$'{exec_prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@
+
+    substituteInPlace tools/bashreadline.py \
+      --replace-fail '/bin/bash' '${readline}/lib/libreadline.so'
   '';
 
   preInstall = ''
diff --git a/pkgs/by-name/bi/bitwuzla/package.nix b/pkgs/by-name/bi/bitwuzla/package.nix
index 4c3a3b718727..4fb78ff4e646 100644
--- a/pkgs/by-name/bi/bitwuzla/package.nix
+++ b/pkgs/by-name/bi/bitwuzla/package.nix
@@ -14,6 +14,7 @@
   cryptominisat,
   zlib,
   pkg-config,
+  cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -34,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     git
     ninja
+    cmake
   ];
   buildInputs = [
     cadical
@@ -48,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     # note: the default value for default_library fails to link dynamic dependencies
     # but setting it to shared works even in pkgsStatic
     "-Ddefault_library=shared"
+    "-Dcryptominisat=true"
 
     (lib.strings.mesonEnable "testing" finalAttrs.finalPackage.doCheck)
   ];
@@ -56,6 +59,28 @@ stdenv.mkDerivation (finalAttrs: {
   checkInputs = [ gtest ];
   # two tests fail on darwin
   doCheck = stdenv.hostPlatform.isLinux;
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    export needle=11011110101011011011111011101111
+
+    cat > file.smt2 <<EOF
+    (declare-fun a () (_ BitVec 32))
+    (assert (= a #b$needle))
+    (check-sat)
+    (get-model)
+    EOF
+
+    # check each backend
+    (
+    set -euxo pipefail;
+    $out/bin/bitwuzla -S cms -j 3 -m file.smt2 | tee /dev/stderr | grep $needle;
+    $out/bin/bitwuzla -S cadical -m file.smt2 | tee /dev/stderr | grep $needle;
+    )
+
+    runHook postInstallCheck
+  '';
 
   meta = {
     description = "SMT solver for fixed-size bit-vectors, floating-point arithmetic, arrays, and uninterpreted functions";
diff --git a/pkgs/by-name/co/comic-mandown/package.nix b/pkgs/by-name/co/comic-mandown/package.nix
index 04fc1bbab70f..24798c0a3f38 100644
--- a/pkgs/by-name/co/comic-mandown/package.nix
+++ b/pkgs/by-name/co/comic-mandown/package.nix
@@ -6,9 +6,7 @@
 }:
 let
   mandown' = python3Packages.mandown.overridePythonAttrs (prev: {
-    propagatedBuildInputs =
-      prev.propagatedBuildInputs
-      ++ lib.optionals withGUI prev.optional-dependencies.gui;
+    dependencies = prev.dependencies ++ lib.optionals withGUI prev.optional-dependencies.gui;
   });
   mandownApp = python3Packages.toPythonApplication mandown';
 in
diff --git a/pkgs/by-name/cs/csharpier/package.nix b/pkgs/by-name/cs/csharpier/package.nix
index 426803998623..abab133cf716 100644
--- a/pkgs/by-name/cs/csharpier/package.nix
+++ b/pkgs/by-name/cs/csharpier/package.nix
@@ -2,10 +2,10 @@
 
 buildDotnetGlobalTool {
   pname = "csharpier";
-  version = "0.30.5";
+  version = "0.30.6";
   executables = "dotnet-csharpier";
 
-  nugetHash = "sha256-8NuhwRhvEZtmPtgbLLNbTOLUoDAihtkKE8aw5UQ0O5A=";
+  nugetHash = "sha256-A39F3ohTHZo8yYoyBOAUeW0bk98Za74Esz0Tx0tXgDI=";
 
   meta = with lib; {
     description = "Opinionated code formatter for C#";
diff --git a/pkgs/by-name/da/daggerfall-unity/package.nix b/pkgs/by-name/da/daggerfall-unity/package.nix
new file mode 100644
index 000000000000..62a47919a000
--- /dev/null
+++ b/pkgs/by-name/da/daggerfall-unity/package.nix
@@ -0,0 +1,123 @@
+{
+  alsa-lib,
+  autoPatchelfHook,
+  copyDesktopItems,
+  fetchurl,
+  fetchzip,
+  lib,
+  libGL,
+  libXScrnSaver,
+  libXcursor,
+  libXi,
+  libXinerama,
+  libXrandr,
+  libXxf86vm,
+  libpulseaudio,
+  libudev0-shim,
+  makeDesktopItem,
+  nix-update-script,
+  stdenv,
+  vulkan-loader,
+  pname ? "daggerfall-unity",
+  includeUnfree ? false,
+}:
+let
+  docFiles =
+    [
+      (fetchurl {
+        url = "https://www.dfworkshop.net/static_files/daggerfallunity/Daggerfall%20Unity%20Manual.pdf";
+        hash = "sha256-FywlD0K5b4vUWzyzANlF9575XTDLivbsym7F+qe0Dm8=";
+        name = "Daggerfall Unity Manual.pdf";
+        meta.license = lib.licenses.mit;
+      })
+    ]
+    ++ lib.optionals includeUnfree [
+      (fetchurl {
+        url = "https://cdn.bethsoft.com/bethsoft.com/manuals/Daggerfall/daggerfall-en.pdf";
+        hash = "sha256-24KSP/E7+KvSRTMDq63NVlVWTFZnQj1yya8wc36yrC0=";
+        meta.license = lib.licenses.unfree;
+      })
+    ];
+in
+stdenv.mkDerivation (finalAttrs: {
+  inherit pname;
+  version = "1.1.1";
+
+  src = fetchzip {
+    url = "https://github.com/Interkarma/daggerfall-unity/releases/download/v${finalAttrs.version}/dfu_linux_64bit-v${finalAttrs.version}.zip";
+    hash = "sha256-JuhhVLpREM9e9UtlDttvFUhHWpH7Sh79OEo1OM4ggKA=";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    alsa-lib
+    libGL
+    libXScrnSaver
+    libXcursor
+    libXi
+    libXinerama
+    libXrandr
+    libXxf86vm
+    libpulseaudio
+    libudev0-shim
+    vulkan-loader
+  ];
+
+  strictDeps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir --parents "$out/share/doc/"
+    cp --recursive * "$out"
+
+    ${lib.strings.concatMapStringsSep "\n" (file: ''
+      cp "${file}" "$out/share/doc/${file.name}"
+    '') docFiles}
+
+    runHook postInstall
+  '';
+
+  appendRunpaths = [ (lib.makeLibraryPath finalAttrs.buildInputs) ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "daggerfall-unity";
+      desktopName = "Daggerfall Unity";
+      comment = finalAttrs.meta.description;
+      icon = "UnityPlayer";
+      exec = "DaggerfallUnity.x86_64";
+      categories = [ "Game" ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex=^v(\\d+(\\.\\d+)*)$" ];
+  };
+
+  meta = {
+    homepage = "https://www.dfworkshop.net/";
+    description = "Open source recreation of Daggerfall in the Unity engine";
+    longDescription = ''
+      Daggerfall Unity is an open source recreation of Daggerfall in the Unity engine created by Daggerfall Workshop.
+
+      Experience the adventure and intrigue of Daggerfall with all of its original charm along with hundreds of fixes, quality of life enhancements, and extensive mod support.
+
+      Includes Daggerfall Unity manual.
+
+      ${lib.optionalString includeUnfree ''
+        This "unfree" variant also includes the manual for Daggerfall (the game, not the open source engine).
+      ''}
+    '';
+    changelog = "https://github.com/Interkarma/daggerfall-unity/releases/tag/v${finalAttrs.version}";
+    mainProgram = "DaggerfallUnity.x86_64";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ l0b0 ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/by-name/db/dblab/package.nix b/pkgs/by-name/db/dblab/package.nix
index 352fbdef4aa9..52e2ac001c12 100644
--- a/pkgs/by-name/db/dblab/package.nix
+++ b/pkgs/by-name/db/dblab/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "dblab";
-  version = "0.30.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "danvergara";
     repo = "dblab";
     rev = "v${version}";
-    hash = "sha256-TRMzKvJh5+s4+uLdLsORbnJvopHYEi28sIi2wo/eLBQ=";
+    hash = "sha256-a0452fNr78FDhVoBF8RkKbtamvc5e6gEbTOeRdgGQs4=";
   };
 
   vendorHash = "sha256-n1Z3sNvNLX1QpfpDSGDygjbC6IE85SBJHvyliy11OjU=";
diff --git a/pkgs/by-name/dn/dnscontrol/package.nix b/pkgs/by-name/dn/dnscontrol/package.nix
index 7ec9da1608a5..360f40d011a4 100644
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "4.15.4";
+  version = "4.15.5";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     rev = "v${version}";
-    hash = "sha256-Jwv8gIcQD62OV8i5DvIcurcsc6Wkis+kl95lnj8NXds=";
+    hash = "sha256-pb2r9XBQmS1pcCV9qBzGEPLfIgMaOFLh+5oW6Wks/sc=";
   };
 
   vendorHash = "sha256-x/FxspmR89Q2yZI0sP1D9OVUFEjMlpT/0IPusy5zHuo=";
diff --git a/pkgs/by-name/do/doctl/package.nix b/pkgs/by-name/do/doctl/package.nix
index 93d2a7b5402e..5c22b71d2985 100644
--- a/pkgs/by-name/do/doctl/package.nix
+++ b/pkgs/by-name/do/doctl/package.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.120.1";
+  version = "1.120.2";
 
   vendorHash = null;
 
@@ -31,7 +31,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     rev = "v${version}";
-    sha256 = "sha256-14oBTAE5/bBSYce9esn9gdMW13CUhB5IKkw9v3Gn6Nc=";
+    sha256 = "sha256-zIpwR9tgv1vO2xI5DaLTY/eFuv91G4tlQAtJBi0pXfA=";
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/do/doomretro/package.nix b/pkgs/by-name/do/doomretro/package.nix
index cc124e2ed384..271654b92124 100644
--- a/pkgs/by-name/do/doomretro/package.nix
+++ b/pkgs/by-name/do/doomretro/package.nix
@@ -15,13 +15,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "doomretro";
-  version = "5.6.1";
+  version = "5.6.2";
 
   src = fetchFromGitHub {
     owner = "bradharding";
     repo = "doomretro";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-v/a7Jc82QpH58c6pkki8xXZBi0v54oz03A2A/Oz3udU=";
+    hash = "sha256-w0stnSYIoxquy3PfbehpwlG5bnGVZWGy/8yNBpxYUSY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ea/earbuds/package.nix b/pkgs/by-name/ea/earbuds/package.nix
index bbb2ff1cff11..68c5eab58fcf 100644
--- a/pkgs/by-name/ea/earbuds/package.nix
+++ b/pkgs/by-name/ea/earbuds/package.nix
@@ -54,10 +54,6 @@ rustPlatform.buildRustPackage {
   # versionCheckProgramArg = [ "--version" ];
   # doInstallCheck = true;
 
-  passthru = {
-    updateScript = nix-update-script { };
-  };
-
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd earbuds \
       --bash <($out/bin/earbuds --generate bash) \
diff --git a/pkgs/by-name/fa/fatrace/package.nix b/pkgs/by-name/fa/fatrace/package.nix
index 0b56836230e7..9ec50157eda3 100644
--- a/pkgs/by-name/fa/fatrace/package.nix
+++ b/pkgs/by-name/fa/fatrace/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fatrace";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "martinpitt";
     repo = pname;
     rev = version;
-    sha256 = "sha256-MRHM+hyuRevK4L3u6dGw1S3O7w+BJBsprJVcSz6Q9xg=";
+    sha256 = "sha256-QkavhxORENQSLUg4tq+W1WB7zSYYinWOOYPqNbv+pEI=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ga/gama-tui/package.nix b/pkgs/by-name/ga/gama-tui/package.nix
index 92c0ce09a019..c99ff9a6ac3e 100644
--- a/pkgs/by-name/ga/gama-tui/package.nix
+++ b/pkgs/by-name/ga/gama-tui/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gama-tui";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "termkit";
     repo = "gama";
     tag = "v${version}";
-    hash = "sha256-ZMM+Nt/9Bqmx7kzlhZM8I++BYZhwilRjNXSTAmOrxk4=";
+    hash = "sha256-ISgORjzH7ZigQYm7PSA4ZClhpw2GU7yor580fEf5UNc=";
   };
 
   vendorHash = "sha256-PTyrSXLMr244+ZTvjBBUc1gmwYXBAs0bXZS2t3aSWFQ=";
diff --git a/pkgs/by-name/gm/gmailctl/package.nix b/pkgs/by-name/gm/gmailctl/package.nix
index b701b17923a0..900157a20cce 100644
--- a/pkgs/by-name/gm/gmailctl/package.nix
+++ b/pkgs/by-name/gm/gmailctl/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gmailctl";
-  version = "0.10.7";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "mbrt";
     repo = "gmailctl";
     rev = "v${version}";
-    hash = "sha256-OpRkBHNWRrBhh6nGrV7dZT01xsSlbANCk+g7b8SidG0=";
+    hash = "sha256-euYl7GKidkOFsSxrEnSBIdBNZOKuBBaS3LNQOZy9R9g=";
   };
 
-  vendorHash = "sha256-+r0WHrKARcxW1hUY1HwAXk0X6ZQrbgBj9+GjIJV5DS0=";
+  vendorHash = "sha256-OXz6GlpC9yhe4pRuVxTUUruJyxBQ63JC4a8xwtuDM/o=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/go/gocryptfs/package.nix b/pkgs/by-name/go/gocryptfs/package.nix
index 1567b10e3549..7738bcda8d90 100644
--- a/pkgs/by-name/go/gocryptfs/package.nix
+++ b/pkgs/by-name/go/gocryptfs/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "gocryptfs";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lStaMj2f8lQZx2E42o4ikPmFQzydlN3PFKwFvUx37SI=";
+    sha256 = "sha256-+JMit0loxT5KOupqL5bkO3pcAfuiN8YAw0ueUh9mUJI=";
   };
 
-  vendorHash = "sha256-ir7FR7ndbPhzUOCVPrYO0SEe03wDFIP74I4X6HJxtE8=";
+  vendorHash = "sha256-9qYmErARMIxnbECANO66m6fPwoR8YQlJzP/VcK9tfP4=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/ha/handheld-daemon/0001-remove-selinux-fixes.patch b/pkgs/by-name/ha/handheld-daemon/0001-remove-selinux-fixes.patch
new file mode 100644
index 000000000000..2fe3ae78a1a4
--- /dev/null
+++ b/pkgs/by-name/ha/handheld-daemon/0001-remove-selinux-fixes.patch
@@ -0,0 +1,37 @@
+diff --git a/src/hhd/plugins/power/power.py b/src/hhd/plugins/power/power.py
+index 5ece857..be41542 100644
+--- a/src/hhd/plugins/power/power.py
++++ b/src/hhd/plugins/power/power.py
+@@ -79,12 +79,6 @@ def create_subvol():
+         )
+         return
+ 
+-    # Fixup selinux for swap
+-    subprocess.run(
+-        ["semanage", "fcontext", "-a", "-t", "var_t", HHD_SWAP_SUBVOL],
+-    )
+-    subprocess.run(["restorecon", HHD_SWAP_SUBVOL])
+-
+     logger.info(f"Creating swap subvolume {HHD_SWAP_SUBVOL}")
+     os.system(f"btrfs subvolume create {HHD_SWAP_SUBVOL}")
+ 
+@@ -153,19 +147,6 @@ def create_temporary_swap():
+         subprocess.run(["chmod", "600", HHD_SWAP_FILE], check=True)
+         subprocess.run(["mkswap", HHD_SWAP_FILE], check=True)
+ 
+-    # Fixup selinux for swap
+-    subprocess.run(
+-        [
+-            "semanage",
+-            "fcontext",
+-            "-a",
+-            "-t",
+-            "swapfile_t",
+-            HHD_SWAP_FILE,
+-        ],
+-    )
+-    subprocess.run(["restorecon", HHD_SWAP_FILE])
+-
+     # Enable swap
+     subprocess.run(["swapon", HHD_SWAP_FILE], check=True)
+ 
diff --git a/pkgs/by-name/ha/handheld-daemon/package.nix b/pkgs/by-name/ha/handheld-daemon/package.nix
index 1c11cd3b59b2..aad4a57e50c2 100644
--- a/pkgs/by-name/ha/handheld-daemon/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon/package.nix
@@ -11,19 +11,25 @@
   efibootmgr,
   dbus,
   lsof,
+  btrfs-progs,
+  util-linux,
 }:
 python3Packages.buildPythonApplication rec {
   pname = "handheld-daemon";
-  version = "3.9.0";
+  version = "3.10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hhd-dev";
     repo = "hhd";
     tag = "v${version}";
-    hash = "sha256-y3CxdWqQEwdNYs4m1NEUeRjTvvhEpS5S739wyFlluWo=";
+    hash = "sha256-6BjXqqNe2u/rh1cnuJ13L/1KimprcyatIr53b0GOBSM=";
   };
 
+  # Handheld-daemon runs some selinux-related utils which are not in nixpkgs.
+  # NixOS doesn't support selinux so we can safely remove them
+  patches = [ ./0001-remove-selinux-fixes.patch ];
+
   # This package relies on several programs expected to be on the user's PATH.
   # We take a more reproducible approach by patching the absolute path to each of these required
   # binaries.
@@ -41,8 +47,16 @@ python3Packages.buildPythonApplication rec {
     substituteInPlace src/hhd/controller/physical/imu.py \
       --replace-fail '"modprobe' '"${lib.getExe' kmod "modprobe"}'
 
-    substituteInPlace src/hhd/plugins/overlay/power.py \
-      --replace-fail '"efibootmgr"' '"${lib.getExe' efibootmgr "id"}"'
+    substituteInPlace src/hhd/plugins/power/power.py \
+      --replace-fail '"efibootmgr"' '"${lib.getExe' efibootmgr "id"}"' \
+      --replace-fail '"systemctl"' '"${lib.getExe' systemd "systemctl"}"' \
+      --replace-fail '"stat"' '"${lib.getExe' coreutils "stat"}"' \
+      --replace-fail '"swapon"' '"${lib.getExe' util-linux "swapon"}"' \
+      --replace-fail '"swapoff"' '"${lib.getExe' util-linux "swapoff"}"' \
+      --replace-fail '"fallocate"' '"${lib.getExe' util-linux "fallocate"}"' \
+      --replace-fail '"chmod"' '"${lib.getExe' coreutils "chmod"}"' \
+      --replace-fail '"mkswap"' '"${lib.getExe' util-linux "mkswap"}"' \
+      --replace-fail '"btrfs",' '"${lib.getExe' btrfs-progs "btrfs"}",'
 
     substituteInPlace src/hhd/device/oxp/serial.py \
       --replace-fail "udevadm" "${lib.getExe' systemd "udevadm"}"
diff --git a/pkgs/by-name/ht/httpie-desktop/package.nix b/pkgs/by-name/ht/httpie-desktop/package.nix
index 42e2395299c9..745ada5f71a2 100644
--- a/pkgs/by-name/ht/httpie-desktop/package.nix
+++ b/pkgs/by-name/ht/httpie-desktop/package.nix
@@ -7,18 +7,18 @@
 
 appimageTools.wrapType2 rec {
   pname = "httpie-desktop";
-  version = "2024.1.2";
+  version = "2025.1.0";
 
   src =
     if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://github.com/httpie/desktop/releases/download/v${version}/HTTPie-${version}-arm64.AppImage";
-        hash = "sha256-RhIyLakCkMUcXvu0sgl5MtV4YXXkqqH1UUS7bptUzww=";
+        hash = "sha256-YadVCoBNFFco4773COyJOGHtbFKW1zMzi5kazWqIGbY=";
       }
     else
       fetchurl {
         url = "https://github.com/httpie/desktop/releases/download/v${version}/HTTPie-${version}.AppImage";
-        hash = "sha256-OOP1l7J2BgO3nOPSipxfwfN/lOUsl80UzYMBosyBHrM=";
+        hash = "sha256-8Ecamw+rmY3iun8ytMsJW3gGHLNcyuZ7VkOiNfiDEyk=";
       };
 
   extraInstallCommands =
@@ -34,11 +34,11 @@ appimageTools.wrapType2 rec {
         --replace-fail 'Exec=AppRun' 'Exec=httpie-desktop'
     '';
 
-  meta = with lib; {
+  meta = {
     description = "Cross-platform API testing client for humans. Painlessly test REST, GraphQL, and HTTP APIs";
     homepage = "https://github.com/httpie/desktop";
-    license = licenses.unfree;
-    maintainers = with maintainers; [ luftmensch-luftmensch ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ luftmensch-luftmensch ];
     mainProgram = "httpie-desktop";
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/by-name/ko/kotlin-language-server/package.nix b/pkgs/by-name/ko/kotlin-language-server/package.nix
index b257d2fd1256..e9bd6b1aecbc 100644
--- a/pkgs/by-name/ko/kotlin-language-server/package.nix
+++ b/pkgs/by-name/ko/kotlin-language-server/package.nix
@@ -10,10 +10,10 @@
 
 stdenv.mkDerivation rec {
   pname = "kotlin-language-server";
-  version = "1.3.12";
+  version = "1.3.13";
   src = fetchzip {
     url = "https://github.com/fwcd/kotlin-language-server/releases/download/${version}/server.zip";
-    hash = "sha256-poWaU0vZS1cpMbbvN7/s1RRUKhekdfTi08fF/IZsVGs=";
+    hash = "sha256-ypiOeXA+14Js31WPGJAdSjskQJR9sBPVWGecLkKHiN4=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/ku/kubecm/package.nix b/pkgs/by-name/ku/kubecm/package.nix
index d67e5b2718b9..86959409db00 100644
--- a/pkgs/by-name/ku/kubecm/package.nix
+++ b/pkgs/by-name/ku/kubecm/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kubecm";
-  version = "0.32.1";
+  version = "0.32.2";
 
   src = fetchFromGitHub {
     owner = "sunny0826";
     repo = "kubecm";
     rev = "v${version}";
-    hash = "sha256-qB3Xzw6nWViBd2QMa3gBLrYhflalkjyLqeyl+7ICoSA=";
+    hash = "sha256-cW96teV0k0MJq6WJ37Ao4tDOOsB48uU2+WTD07n5EuQ=";
   };
 
   vendorHash = "sha256-Fr31wLvzIoN2wIU2EmUrsqiMcPpdJpQI3ZfB//JYIXE=";
diff --git a/pkgs/by-name/la/last/package.nix b/pkgs/by-name/la/last/package.nix
index cadef746e793..2729483f3343 100644
--- a/pkgs/by-name/la/last/package.nix
+++ b/pkgs/by-name/la/last/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1607";
+  version = "1608";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = "refs/tags/${version}";
-    hash = "sha256-AHaKE9il4GZ5JhCqmScqG/rTHEOA8+A421pbdrDHZeY=";
+    hash = "sha256-enTw68QklAJ6iz5L8y0R6ss6gAUFERfqdUMhJnPtePk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libixion/package.nix b/pkgs/by-name/li/libixion/package.nix
index 79283f35fa15..d921b8fe8653 100644
--- a/pkgs/by-name/li/libixion/package.nix
+++ b/pkgs/by-name/li/libixion/package.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
+    python3.pythonOnBuildForHost
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/li/liblangtag/package.nix b/pkgs/by-name/li/liblangtag/package.nix
index 68299e702347..dde975fd05e8 100644
--- a/pkgs/by-name/li/liblangtag/package.nix
+++ b/pkgs/by-name/li/liblangtag/package.nix
@@ -43,9 +43,13 @@ stdenv.mkDerivation rec {
     cp "${language_subtag_registry}" data/language-subtag-registry
   '';
 
-  configureFlags = lib.optional (
-    stdenv.hostPlatform.libc == "glibc"
-  ) "--with-locale-alias=${stdenv.cc.libc}/share/locale/locale.alias";
+  configureFlags =
+    [
+      "ac_cv_va_copy=1"
+    ]
+    ++ lib.optional (
+      stdenv.hostPlatform.libc == "glibc"
+    ) "--with-locale-alias=${stdenv.cc.libc}/share/locale/locale.alias";
 
   buildInputs = [
     gettext
diff --git a/pkgs/by-name/li/libossp_uuid/package.nix b/pkgs/by-name/li/libossp_uuid/package.nix
index a04339778f05..57078f4741eb 100644
--- a/pkgs/by-name/li/libossp_uuid/package.nix
+++ b/pkgs/by-name/li/libossp_uuid/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   };
 
   configureFlags = [
-    "ac_cv_va_copy=yes"
+    "ac_cv_va_copy=C99"
   ] ++ lib.optional stdenv.hostPlatform.isFreeBSD "--with-pic";
 
   patches = [ ./shtool.patch ];
diff --git a/pkgs/by-name/lx/lxgw-wenkai-screen/package.nix b/pkgs/by-name/lx/lxgw-wenkai-screen/package.nix
index d241185c5f00..4736c074e7ed 100644
--- a/pkgs/by-name/lx/lxgw-wenkai-screen/package.nix
+++ b/pkgs/by-name/lx/lxgw-wenkai-screen/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "lxgw-wenkai-screen";
-  version = "1.501";
+  version = "1.510";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwWenKai-Screen/releases/download/v${finalAttrs.version}/LXGWWenKaiScreen.ttf";
-    hash = "sha256-em3uh53neN8v1ueiw1rWVtC0bteD7IG3X1g9tkjBRJA=";
+    hash = "sha256-JAU87Jb3gqS1mXYprWKYt5xnzMVlZR992PNmsqnTF3U=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ma/materialgram/package.nix b/pkgs/by-name/ma/materialgram/package.nix
index 419b635f6832..e7aa414e3e3c 100644
--- a/pkgs/by-name/ma/materialgram/package.nix
+++ b/pkgs/by-name/ma/materialgram/package.nix
@@ -11,13 +11,13 @@ telegram-desktop.override {
   unwrapped = telegram-desktop.unwrapped.overrideAttrs (
     finalAttrs: previousAttrs: {
       pname = "materialgram-unwrapped";
-      version = "5.9.0.1";
+      version = "5.10.3.1";
 
       src = fetchFromGitHub {
         owner = "kukuruzka165";
         repo = "materialgram";
         rev = "refs/tags/v${finalAttrs.version}";
-        hash = "sha256-QmXwO8Dn+ATWGwN5smxOB2kxmJZETSMbqwFoR0t3luc=";
+        hash = "sha256-vnsQHvBQLc5ZCeGDW3msAPNHgWB7llgEIraNpdb/Fks=";
         fetchSubmodules = true;
       };
 
diff --git a/pkgs/by-name/oc/octopus/package.nix b/pkgs/by-name/oc/octopus/package.nix
index 199e729221b9..c735d07e3cf3 100644
--- a/pkgs/by-name/oc/octopus/package.nix
+++ b/pkgs/by-name/oc/octopus/package.nix
@@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-vG1HUkuNUZkhBumoJJy3AyFU6cZOo1YGmaOYcU6bPOM=";
   };
 
+  patches = [
+    # Discover all MPI languages components to avoid scalpack discovery failure
+    ./scalapack-mpi-alias.patch
+  ];
+
   nativeBuildInputs = [
     which
     perl
diff --git a/pkgs/by-name/oc/octopus/scalapack-mpi-alias.patch b/pkgs/by-name/oc/octopus/scalapack-mpi-alias.patch
new file mode 100644
index 000000000000..8c8253ebf1f3
--- /dev/null
+++ b/pkgs/by-name/oc/octopus/scalapack-mpi-alias.patch
@@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 70d89efb5e..47ba750d7a 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -131,7 +131,7 @@ set(Octopus_ext_libs)
+ find_package(GSL)
+ if (OCTOPUS_MPI)
+ 	set(MPI_DETERMINE_LIBRARY_VERSION ON)
+-	find_package(MPI 3 COMPONENTS Fortran)
++	find_package(MPI 3)
+ 	# Further set MKL variables
+ 	if (MPI_Fortran_LIBRARY_VERSION_STRING MATCHES Intel)
+ 		set(MKL_MPI intelmpi CACHE STRING "Octopus: Overloaded")
diff --git a/pkgs/by-name/op/opnborg/package.nix b/pkgs/by-name/op/opnborg/package.nix
index f683f27711ca..0a03c5dcad8f 100644
--- a/pkgs/by-name/op/opnborg/package.nix
+++ b/pkgs/by-name/op/opnborg/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "opnborg";
-  version = "0.1.54";
+  version = "0.1.63";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "opnborg";
     rev = "v${version}";
-    hash = "sha256-N6tZqHyL3bOkXJrn4qMVpUR3tQHa8DiurRqy6BJnK+Y=";
+    hash = "sha256-t/bcqHsRLE4Mxoe/0pziIHHrPf2ijUkYjr1vq8C1ZzQ=";
   };
 
-  vendorHash = "sha256-REXJryUcu+/AdVx1aK0nJ98Wq/EdhrZqL24kC1wK6mc=";
+  vendorHash = "sha256-kFO4Ju1EbUEc/CZpujmJpM1R1vRI5J4s6UIa2+IhTKE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ov/ov/package.nix b/pkgs/by-name/ov/ov/package.nix
index 2782c508692e..6ebb1ac4121f 100644
--- a/pkgs/by-name/ov/ov/package.nix
+++ b/pkgs/by-name/ov/ov/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "ov";
-  version = "0.37.0";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "ov";
     tag = "v${version}";
-    hash = "sha256-PZYYr2763L/BOn05TSDr3tkjQQkg2Niic3rJrFSevu0=";
+    hash = "sha256-xbGo/Hgg5XmJACRa4t4QC2vHse5gJ2D4fmmDKurmfNw=";
   };
 
-  vendorHash = "sha256-Xntel9WXwCY5iqC9JvrE/iSIXff504fCUP5kYc6pf7Y=";
+  vendorHash = "sha256-YS4HraVJ++ZLvNRVUynsZsA1lVYo91IuMKmRxCBQeKU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pb/pbzip2/package.nix b/pkgs/by-name/pb/pbzip2/package.nix
index 3348f0b85ee3..b1c3ca022fe1 100644
--- a/pkgs/by-name/pb/pbzip2/package.nix
+++ b/pkgs/by-name/pb/pbzip2/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   bzip2,
 }:
 
@@ -18,14 +19,30 @@ stdenv.mkDerivation rec {
     sha256 = "1rnvgcdixjzbrmcr1nv9b6ccrjfrhryaj7jwz28yxxv6lam3xlcg";
   };
 
+  patches = [
+    # https://libcxx.llvm.org/ReleaseNotes/19.html#deprecations-and-removals
+    # https://bugs.launchpad.net/pbzip2/+bug/2081588
+    (fetchpatch {
+      url = "https://github.com/freebsd/freebsd-ports/raw/974d3ff054965d2bd2ab884a0579ed06c5a08b07/archivers/pbzip2/files/patch-BZ2StreamScanner.cpp";
+      extraPrefix = "";
+      hash = "sha256-dvXdp+5S41akavy+mvPGHpUxHxenXS7bbTVBVkIJj0s=";
+    })
+    (fetchpatch {
+      url = "https://github.com/freebsd/freebsd-ports/raw/974d3ff054965d2bd2ab884a0579ed06c5a08b07/archivers/pbzip2/files/patch-BZ2StreamScanner.h";
+      extraPrefix = "";
+      hash = "sha256-/twP8HyHP4cAVgb5cUPq0CgDxUgDYPdd9haH9wDOrz8=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace pbzip2.cpp \
+      --replace-fail '"PRIuMAX"' '" PRIuMAX "'
+  '';
+
   buildInputs = [ bzip2 ];
 
-  preBuild = "substituteInPlace Makefile --replace g++ c++";
-
   installFlags = [ "PREFIX=$(out)" ];
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=reserved-user-defined-literal";
-
   meta = with lib; {
     homepage = "http://compression.ca/pbzip2/";
     description = "Parallel implementation of bzip2 for multi-core machines";
diff --git a/pkgs/by-name/pr/prometheus-frr-exporter/package.nix b/pkgs/by-name/pr/prometheus-frr-exporter/package.nix
index a838ad61677a..fc102e732b51 100644
--- a/pkgs/by-name/pr/prometheus-frr-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-frr-exporter/package.nix
@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "1.3.2";
+  version = "1.3.3";
   src = fetchFromGitHub {
     owner = "tynany";
     repo = "frr_exporter";
     rev = "v${version}";
-    hash = "sha256-Cy9m9ZwYWXelMsr6n6WWjBw4LlEZxkdy5ZMJKoJ8HZI=";
+    hash = "sha256-HjVod7h2Q21StSRd2ntYunBFKBmZ4qi+Hl515zI4gbc=";
   };
 in
 buildGoModule {
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index 9dbfbcb81b18..b4f108966d7a 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton9-22";
+  version = "GE-Proton9-23";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-mPoKv3mvazqiVCLEKS3LXAl2s4EYy7FPoSPexCvMawQ=";
+    hash = "sha256-eC1vYUfSsESPSaQK6wnOgXMf6fzn+NZ7SU/al5kY6CY=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ps/pscale/package.nix b/pkgs/by-name/ps/pscale/package.nix
index 3f05039ba54e..d6685accdf55 100644
--- a/pkgs/by-name/ps/pscale/package.nix
+++ b/pkgs/by-name/ps/pscale/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.219.0";
+  version = "0.220.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-kiypZpTw2DAF0fB7kqdRgDrvFtenexnVPq3kFNWBEgQ=";
+    sha256 = "sha256-moCBa0XVOAG+cpLChYCMtvB39/qkWN8JMPBEruRDXzo=";
   };
 
-  vendorHash = "sha256-/BYWAE2VpHy+HTmHOz4GhstcD+Y6R0tjeF9/8+LiZT0=";
+  vendorHash = "sha256-yeeB1v7ZnyZVDD3hMEOxCnwJL25qF8IGYVypj1mXGVg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index c45794ea8b6f..22edd7647034 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "3.20.1";
+  version = "3.20.2";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-a+p8cJKfkux0GupUuoZGfTFrrkW7fzUwmL4W6tr50ek=";
+    hash = "sha256-AFcgONdWHHIK4/3zON6PRJaTXEXiE/0/Ha2rZpABiyw=";
   };
 
-  cargoHash = "sha256-PKUN0scv7J4znaSAC2lc0AO4LzD4l59kuSKvLGRyXME=";
+  cargoHash = "sha256-kyjEACPrHWeAbpzi/7Lq+8Fvw/ClBGN6Jn2hebert/g=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/refinery-cli/package.nix b/pkgs/by-name/re/refinery-cli/package.nix
index 5c366be4ab1e..25a017a85bf1 100644
--- a/pkgs/by-name/re/refinery-cli/package.nix
+++ b/pkgs/by-name/re/refinery-cli/package.nix
@@ -18,7 +18,11 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-gHW+5WWzk1H2O5B2sWdl6QcOeUbNvbdZZBD10SmE1GA=";
   };
 
-  cargoHash = "sha256-Go7+LZSze/IrNwEl+11Dm5O9RcREyPSkHPjlE9SPO70=";
+  # The `time` crate doesn't build on Rust 1.80+
+  # https://github.com/NixOS/nixpkgs/issues/332957
+  cargoPatches = [ ./time-crate.patch ];
+
+  cargoHash = "sha256-RGhcI0TiZWKkzXpiozGLIulQ6YpzWt6lRCPMTTLZDfE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/refinery-cli/time-crate.patch b/pkgs/by-name/re/refinery-cli/time-crate.patch
new file mode 100644
index 000000000000..f688dc8d9d33
--- /dev/null
+++ b/pkgs/by-name/re/refinery-cli/time-crate.patch
@@ -0,0 +1,83 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 59dad7c..eb5b122 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -460,9 +460,12 @@ dependencies = [
+
+ [[package]]
+ name = "deranged"
+-version = "0.3.8"
++version = "0.3.11"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
++checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
++dependencies = [
++ "powerfmt",
++]
+
+ [[package]]
+ name = "derive_utils"
+@@ -1236,6 +1239,12 @@ dependencies = [
+  "num-traits",
+ ]
+
++[[package]]
++name = "num-conv"
++version = "0.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
++
+ [[package]]
+ name = "num-integer"
+ version = "0.1.45"
+@@ -1414,6 +1423,12 @@ dependencies = [
+  "postgres-protocol",
+ ]
+
++[[package]]
++name = "powerfmt"
++version = "0.2.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
++
+ [[package]]
+ name = "ppv-lite86"
+ version = "0.2.17"
+@@ -1900,12 +1915,14 @@ dependencies = [
+
+ [[package]]
+ name = "time"
+-version = "0.3.28"
++version = "0.3.37"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "17f6bb557fd245c28e6411aa56b6403c689ad95061f50e4be16c274e70a17e48"
++checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
+ dependencies = [
+  "deranged",
+  "itoa",
++ "num-conv",
++ "powerfmt",
+  "serde",
+  "time-core",
+  "time-macros",
+@@ -1913,16 +1930,17 @@ dependencies = [
+
+ [[package]]
+ name = "time-core"
+-version = "0.1.1"
++version = "0.1.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"
++checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+
+ [[package]]
+ name = "time-macros"
+-version = "0.2.14"
++version = "0.2.19"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1a942f44339478ef67935ab2bbaec2fb0322496cf3cbe84b261e06ac3814c572"
++checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
+ dependencies = [
++ "num-conv",
+  "time-core",
+ ]
diff --git a/pkgs/by-name/ro/robotframework-tidy/package.nix b/pkgs/by-name/ro/robotframework-tidy/package.nix
index 405c41fcb087..c129758de6af 100644
--- a/pkgs/by-name/ro/robotframework-tidy/package.nix
+++ b/pkgs/by-name/ro/robotframework-tidy/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "robotframework-tidy";
-  version = "4.15.0";
+  version = "4.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MarketSquare";
     repo = "robotframework-tidy";
     tag = version;
-    hash = "sha256-PNf0K1+kjijvJ53UCKkC2LyjBJOroDPdtYjcXbRU1VI=";
+    hash = "sha256-QTDbxq78p5O5jORyHThUcNx0/VWm0ZRBS8S//Ya9Oig=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/sc/scalapack/package.nix b/pkgs/by-name/sc/scalapack/package.nix
index cf5d8a5e4480..3c5485c2318c 100644
--- a/pkgs/by-name/sc/scalapack/package.nix
+++ b/pkgs/by-name/sc/scalapack/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   mpiCheckPhaseHook,
   mpi,
@@ -18,14 +19,22 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "Reference-ScaLAPACK";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-KDMW/D7ubGaD2L7eTwULJ04fAYDPAKl8xKPZGZMkeik=";
+    tag = "v${version}";
+    hash = "sha256-KDMW/D7ubGaD2L7eTwULJ04fAYDPAKl8xKPZGZMkeik=";
   };
 
   passthru = { inherit (blas) isILP64; };
 
   __structuredAttrs = true;
 
+  patches = [
+    (fetchpatch {
+      name = "version-string";
+      url = "https://github.com/Reference-ScaLAPACK/scalapack/commit/76cc1ed3032e9a4158a4513c9047c3746b269f04.patch";
+      hash = "sha256-kmllLa9GUeTrHRYeS0yIk9I8LwaIoEytdyQGRuinn3A=";
+    })
+  ];
+
   # Required to activate ILP64.
   # See https://github.com/Reference-ScaLAPACK/scalapack/pull/19
   postPatch = lib.optionalString passthru.isILP64 ''
@@ -76,6 +85,14 @@ stdenv.mkDerivation rec {
   # sometimes fail due to this
   checkFlags = [ "ARGS=--timeout 10000" ];
 
+  postFixup = ''
+    # _IMPORT_PREFIX, used to point to lib, points to dev output. Every package using the generated
+    # cmake file will thus look for the library in the dev output instead of out.
+    # Use the absolute path to $out instead to fix the issue.
+    substituteInPlace  $dev/lib/cmake/scalapack-${version}/scalapack-targets-release.cmake \
+      --replace "\''${_IMPORT_PREFIX}" "$out"
+  '';
+
   meta = with lib; {
     homepage = "http://www.netlib.org/scalapack/";
     description = "Library of high-performance linear algebra routines for parallel distributed memory machines";
diff --git a/pkgs/by-name/sp/spotdl/package.nix b/pkgs/by-name/sp/spotdl/package.nix
index 71b3bcad6d9f..05efd78c7843 100644
--- a/pkgs/by-name/sp/spotdl/package.nix
+++ b/pkgs/by-name/sp/spotdl/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "spotdl";
-  version = "4.2.10";
+  version = "4.2.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "spotDL";
     repo = "spotify-downloader";
     tag = "v${version}";
-    hash = "sha256-F97g5AhyXXYEICb/0RcfVPype8PVfFAKFEX0Xyg1QoI=";
+    hash = "sha256-9PlqnpUlV5b8g+lctGjVL1Xgf25SS5xqkDaa1bSlxpk=";
   };
 
   build-system = with python3.pkgs; [ poetry-core ];
diff --git a/pkgs/by-name/st/stats/package.nix b/pkgs/by-name/st/stats/package.nix
index 71f6b098561f..4a9c31379d0d 100644
--- a/pkgs/by-name/st/stats/package.nix
+++ b/pkgs/by-name/st/stats/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stats";
-  version = "2.11.23";
+  version = "2.11.26";
 
   src = fetchurl {
     url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-tlKiRvLTIt0lKc/fOQBj07lFjgOSkKNE4iNlNwxfTCU=";
+    hash = "sha256-WRbBqgjNn9W9qRFlbuNAOr8L6lzI1DpTsTCgCQiKSnU=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/su/summon/package.nix b/pkgs/by-name/su/summon/package.nix
index af4a2bc77b4d..a2625823c40f 100644
--- a/pkgs/by-name/su/summon/package.nix
+++ b/pkgs/by-name/su/summon/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "summon";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "cyberark";
     repo = "summon";
     rev = "v${version}";
-    hash = "sha256-Y61lVqsKZiHLJF0X4DIq6U7eRXJ0+6I/dBPwXYb2GmQ=";
+    hash = "sha256-W0KTZPxPY8sFZD1dB6fSo+YB0EDMD71TsPs98EbgM1Q=";
   };
 
   vendorHash = "sha256-StcJvUtMfBh7p1sD8ucvHNJ572whRfqz3id6XsFoXtk=";
diff --git a/pkgs/by-name/to/tomboy-ng/package.nix b/pkgs/by-name/to/tomboy-ng/package.nix
index 83edbf65cfa5..dea1e31daba6 100644
--- a/pkgs/by-name/to/tomboy-ng/package.nix
+++ b/pkgs/by-name/to/tomboy-ng/package.nix
@@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "tomboy-ng";
-  version = "0.41";
+  version = "0.42";
 
   src = fetchFromGitHub {
     owner = "tomboy-notes";
     repo = "tomboy-ng";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-W5pW2QwAFKhs8O5TqUbe2i+uMGDU1G4wZ+f+rfn9+ds=";
+    hash = "sha256-ppvEZeVHJ4DHIdEXfLOWcb4Wbsi6YVKqm6NGQ7lPtdg=";
   };
   kcontrols = fetchFromGitHub {
     owner = "davidbannon";
diff --git a/pkgs/by-name/um/umu-launcher-unwrapped/no-umu-version-json.patch b/pkgs/by-name/um/umu-launcher-unwrapped/no-umu-version-json.patch
new file mode 100644
index 000000000000..dd4e5af1c278
--- /dev/null
+++ b/pkgs/by-name/um/umu-launcher-unwrapped/no-umu-version-json.patch
@@ -0,0 +1,13 @@
+diff --git a/Makefile.in b/Makefile.in
+index b82053d..37db8c9 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -50,7 +50,7 @@ fix_shebangs:
+ umu/umu_version.json: umu/umu_version.json.in
+ 	$(info :: Updating $(@) )
+ 	cp $(<) $(<).tmp
+-	sed 's|##UMU_VERSION##|$(shell git describe --always --long --tags)|g' -i $(<).tmp
++	sed 's|##UMU_VERSION##|@version@|g' -i $(<).tmp
+ 	mv $(<).tmp $(@)
+ 
+ .PHONY: version
diff --git a/pkgs/by-name/um/umu-launcher-unwrapped/package.nix b/pkgs/by-name/um/umu-launcher-unwrapped/package.nix
new file mode 100644
index 000000000000..8d37b284ddcb
--- /dev/null
+++ b/pkgs/by-name/um/umu-launcher-unwrapped/package.nix
@@ -0,0 +1,70 @@
+{
+  python3Packages,
+  fetchFromGitHub,
+  lib,
+  bash,
+  hatch,
+  scdoc,
+  replaceVars,
+  fetchpatch2,
+}:
+python3Packages.buildPythonPackage rec {
+  pname = "umu-launcher-unwrapped";
+  version = "1.1.4";
+
+  src = fetchFromGitHub {
+    owner = "Open-Wine-Components";
+    repo = "umu-launcher";
+    tag = version;
+    hash = "sha256-TOsVK6o2V8D7CLzVOkLs8AClrZmlVQTfeii32ZIQCu4=";
+  };
+
+  # Both patches can be safely removed with the next release
+  patches = [
+    # Patch to avoid running `git describe`
+    # Fixed by https://github.com/Open-Wine-Components/umu-launcher/pull/289 upstream
+    (replaceVars ./no-umu-version-json.patch { inherit version; })
+    # Patch to use PREFIX in the installer call
+    (fetchpatch2 {
+      url = "https://github.com/Open-Wine-Components/umu-launcher/commit/602a2f84a05a63f7b1b1c4d8ca85d99fdaec2cd2.diff";
+      hash = "sha256-BMinTXr926V3HlzHHabxHKvy8quEvxsZKu1hoTGQT00=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    python3Packages.build
+    hatch
+    scdoc
+    python3Packages.installer
+  ];
+
+  pythonPath = [
+    python3Packages.filelock
+    python3Packages.xlib
+  ];
+
+  pyproject = false;
+  configureScript = "./configure.sh";
+
+  makeFlags = [
+    "PYTHONDIR=$(PREFIX)/${python3Packages.python.sitePackages}"
+    "PYTHON_INTERPRETER=${lib.getExe python3Packages.python}"
+    # Override RELEASEDIR to avoid running `git describe`
+    "RELEASEDIR=${pname}-${version}"
+    "SHELL_INTERPRETER=${lib.getExe bash}"
+  ];
+
+  meta = {
+    description = "Unified launcher for Windows games on Linux using the Steam Linux Runtime and Tools";
+    changelog = "https://github.com/Open-Wine-Components/umu-launcher/releases/tag/${version}";
+    homepage = "https://github.com/Open-Wine-Components/umu-launcher";
+    license = lib.licenses.gpl3;
+    mainProgram = "umu-run";
+    maintainers = with lib.maintainers; [
+      diniamo
+      MattSturgeon
+      fuzen
+    ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/um/umu-launcher/package.nix b/pkgs/by-name/um/umu-launcher/package.nix
new file mode 100644
index 000000000000..46de6e41b61b
--- /dev/null
+++ b/pkgs/by-name/um/umu-launcher/package.nix
@@ -0,0 +1,19 @@
+{
+  buildFHSEnv,
+  lib,
+  umu-launcher-unwrapped,
+}:
+buildFHSEnv {
+  pname = "umu-launcher";
+  inherit (umu-launcher-unwrapped) version meta;
+
+  targetPkgs = pkgs: [ pkgs.umu-launcher-unwrapped ];
+
+  executableName = umu-launcher-unwrapped.meta.mainProgram;
+  runScript = lib.getExe umu-launcher-unwrapped;
+
+  extraInstallCommands = ''
+    ln -s ${umu-launcher-unwrapped}/lib $out/lib
+    ln -s ${umu-launcher-unwrapped}/share $out/share
+  '';
+}
diff --git a/pkgs/by-name/ve/velero/package.nix b/pkgs/by-name/ve/velero/package.nix
index 4865f6f9d322..f4ddd73c10a7 100644
--- a/pkgs/by-name/ve/velero/package.nix
+++ b/pkgs/by-name/ve/velero/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "velero";
-  version = "1.15.1";
+  version = "1.15.2";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "velero";
     rev = "v${version}";
-    hash = "sha256-ypNpIEj6hw77cjXkYJ9zsKY0bFP7Nwa2skd1wdONsJY=";
+    hash = "sha256-WClNupUW1Nd5Xnx58KYDRLz1/2kNCOR4AoAsUv78yPE=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/we/weasis/package.nix b/pkgs/by-name/we/weasis/package.nix
index 579996b1be68..c1c4410e5263 100644
--- a/pkgs/by-name/we/weasis/package.nix
+++ b/pkgs/by-name/we/weasis/package.nix
@@ -18,12 +18,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "weasis";
-  version = "4.4.0";
+  version = "4.5.1";
 
   # Their build instructions indicate to use the packaging script
   src = fetchzip {
     url = "https://github.com/nroduit/Weasis/releases/download/v${version}/weasis-native.zip";
-    hash = "sha256-+Bi9rTuM9osKzbKVA4exqsFm8p9+1OHgJqRSNnCC6QQ=";
+    hash = "sha256-aGoTSOZ1W8JHQ0+FcJ9RZ47A1LfXJOoGNmVDiUd9zxE=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/xo/xonsh/unwrapped.nix b/pkgs/by-name/xo/xonsh/unwrapped.nix
index b98d12137850..93544f928fd6 100644
--- a/pkgs/by-name/xo/xonsh/unwrapped.nix
+++ b/pkgs/by-name/xo/xonsh/unwrapped.nix
@@ -3,8 +3,8 @@
   coreutils,
   fetchFromGitHub,
   git,
-  gitUpdater,
   glibcLocales,
+  nix-update-script,
   pythonPackages,
 }:
 
@@ -12,7 +12,7 @@ let
 
   argset = {
     pname = "xonsh";
-    version = "0.19.0";
+    version = "0.19.1";
     pyproject = true;
 
     # PyPI package ships incomplete tests
@@ -20,7 +20,7 @@ let
       owner = "xonsh";
       repo = "xonsh";
       rev = "refs/tags/${argset.version}";
-      hash = "sha256-rt402MKnhjC/AYz9Rm6B5RkivcVxveVW2rM/nT/xcNo=";
+      hash = "sha256-20egNKlJjJO1wdy1anApz0ADBnaHPUSqhfrsPe3QQIs=";
     };
 
     nativeBuildInputs = with pythonPackages; [
@@ -112,7 +112,7 @@ let
       shellPath = "/bin/xonsh";
       python = pythonPackages.python; # To the wrapper
       wrapper = throw "The top-level xonsh package is now wrapped. Use it directly.";
-      updateScript = gitUpdater { };
+      updateScript = nix-update-script { };
     };
 
     meta = {
diff --git a/pkgs/by-name/zb/zbus-xmlgen/package.nix b/pkgs/by-name/zb/zbus-xmlgen/package.nix
index 7d15399b5b8a..e984ca23347e 100644
--- a/pkgs/by-name/zb/zbus-xmlgen/package.nix
+++ b/pkgs/by-name/zb/zbus-xmlgen/package.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zbus_xmlgen";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-of+/HA8u+/hRnzXZqlQzL+6A4Hkka7pN+Wl2YdrACQY=";
+    hash = "sha256-H3QA1Eh1AL1CtiUykEjJ7Ltskcen8tIfbGg6jy7Xic8=";
   };
 
-  cargoHash = "sha256-+nTXAyBelqP0HQnJ6aGFiX2NobJ/MwEav/3gDry9y2U=";
+  cargoHash = "sha256-bglcui1OLp2USRpL2kOxU8fw+aLAbbDv5hrg5fxz4cQ=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
   nativeCheckInputs = [ rustfmt ];
diff --git a/pkgs/desktops/deepin/go-package/dde-daemon/default.nix b/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
index bbc43448b044..44120eae4e5c 100644
--- a/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
+++ b/pkgs/desktops/deepin/go-package/dde-daemon/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   buildGoModule,
   pkg-config,
   deepin-gettext-tools,
@@ -48,12 +48,10 @@ buildGoModule rec {
 
   patches = [
     ./0001-dont-set-PATH.diff
-    (substituteAll {
-      src = ./0002-fix-custom-wallpapers-path.diff;
+    (replaceVars ./0002-fix-custom-wallpapers-path.diff {
       inherit coreutils;
     })
-    (substituteAll {
-      src = ./0003-aviod-use-hardcode-path.diff;
+    (replaceVars ./0003-aviod-use-hardcode-path.diff {
       inherit dbus;
     })
   ];
diff --git a/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix b/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
index d331f1eae6a6..12d79cbbf9f4 100644
--- a/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
+++ b/pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   glib,
   gnome-shell,
   gettext,
@@ -22,8 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-gi-path.patch;
+    (replaceVars ./fix-gi-path.patch {
       gnomeShell = gnome-shell;
     })
   ];
diff --git a/pkgs/desktops/gnome/extensions/arcmenu/default.nix b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
index 9e78ddc15225..8fc92494caad 100644
--- a/pkgs/desktops/gnome/extensions/arcmenu/default.nix
+++ b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitLab,
   glib,
   gettext,
-  substituteAll,
+  replaceVars,
   gnome-menus,
 }:
 
@@ -20,8 +20,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix_gmenu.patch;
+    (replaceVars ./fix_gmenu.patch {
       gmenu_path = "${gnome-menus}/lib/girepository-1.0";
     })
   ];
diff --git a/pkgs/desktops/gnome/extensions/drop-down-terminal/default.nix b/pkgs/desktops/gnome/extensions/drop-down-terminal/default.nix
index e5302645d560..d95679f601c5 100644
--- a/pkgs/desktops/gnome/extensions/drop-down-terminal/default.nix
+++ b/pkgs/desktops/gnome/extensions/drop-down-terminal/default.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   gjs,
   vte,
   gnome,
@@ -25,8 +25,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix_vte_and_gjs.patch;
+    (replaceVars ./fix_vte_and_gjs.patch {
       inherit gjs vte;
     })
   ];
diff --git a/pkgs/desktops/gnome/extensions/extensionOverrides.nix b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
index 30fef8c4e238..530470a4824d 100644
--- a/pkgs/desktops/gnome/extensions/extensionOverrides.nix
+++ b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
@@ -17,7 +17,7 @@
 , nvme-cli
 , procps
 , smartmontools
-, substituteAll
+, replaceVars
 , touchegg
 , util-linux
 , vte
@@ -72,8 +72,7 @@ super: lib.trivial.pipe super [
   (patchExtension "eepresetselector@ulville.github.io" (old: {
     patches = [
       # Needed to find the currently set preset
-      (substituteAll {
-        src = ./extensionOverridesPatches/eepresetselector_at_ulville.github.io.patch;
+      (replaceVars ./extensionOverridesPatches/eepresetselector_at_ulville.github.io.patch {
         easyeffects_gsettings_path = "${glib.getSchemaPath easyeffects}";
       })
     ];
@@ -81,8 +80,7 @@ super: lib.trivial.pipe super [
 
   (patchExtension "freon@UshakovVasilii_Github.yahoo.com" (old: {
     patches = [
-      (substituteAll {
-        src = ./extensionOverridesPatches/freon_at_UshakovVasilii_Github.yahoo.com.patch;
+      (replaceVars ./extensionOverridesPatches/freon_at_UshakovVasilii_Github.yahoo.com.patch {
         inherit hddtemp liquidctl lm_sensors procps smartmontools;
         netcat = netcat-gnu;
         nvmecli = nvme-cli;
@@ -103,11 +101,10 @@ super: lib.trivial.pipe super [
   (patchExtension "gtk4-ding@smedius.gitlab.com" (old: {
     nativeBuildInputs = [ wrapGAppsHook3 ];
     patches = [
-      (substituteAll {
+      (replaceVars ./extensionOverridesPatches/gtk4-ding_at_smedius.gitlab.com.patch {
         inherit gjs;
         util_linux = util-linux;
         xdg_utils = xdg-utils;
-        src = ./extensionOverridesPatches/gtk4-ding_at_smedius.gitlab.com.patch;
         nautilus_gsettings_path = "${glib.getSchemaPath nautilus}";
       })
     ];
@@ -129,8 +126,7 @@ super: lib.trivial.pipe super [
 
   (patchExtension "system-monitor@gnome-shell-extensions.gcampax.github.com" (old: {
     patches = [
-      (substituteAll {
-        src = ./extensionOverridesPatches/system-monitor_at_gnome-shell-extensions.gcampax.github.com.patch;
+      (replaceVars ./extensionOverridesPatches/system-monitor_at_gnome-shell-extensions.gcampax.github.com.patch {
         gtop_path = "${libgtop}/lib/girepository-1.0";
       })
     ];
@@ -138,8 +134,7 @@ super: lib.trivial.pipe super [
 
   (patchExtension "system-monitor-next@paradoxxx.zero.gmail.com" (old: {
     patches = [
-      (substituteAll {
-        src = ./extensionOverridesPatches/system-monitor-next_at_paradoxxx.zero.gmail.com.patch;
+      (replaceVars ./extensionOverridesPatches/system-monitor-next_at_paradoxxx.zero.gmail.com.patch {
         gtop_path = "${libgtop}/lib/girepository-1.0";
       })
     ];
@@ -148,8 +143,7 @@ super: lib.trivial.pipe super [
 
   (patchExtension "Vitals@CoreCoding.com" (old: {
     patches = [
-      (substituteAll {
-        src = ./extensionOverridesPatches/vitals_at_corecoding.com.patch;
+      (replaceVars ./extensionOverridesPatches/vitals_at_corecoding.com.patch {
         gtop_path = "${libgtop}/lib/girepository-1.0";
       })
     ];
diff --git a/pkgs/desktops/gnome/extensions/no-title-bar/default.nix b/pkgs/desktops/gnome/extensions/no-title-bar/default.nix
index f8a2ef12b80f..2e6d23855ba7 100644
--- a/pkgs/desktops/gnome/extensions/no-title-bar/default.nix
+++ b/pkgs/desktops/gnome/extensions/no-title-bar/default.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   glib,
   gettext,
   xorg,
@@ -25,8 +25,7 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       xprop = "${xorg.xprop}/bin/xprop";
       xwininfo = "${xorg.xwininfo}/bin/xwininfo";
     })
diff --git a/pkgs/desktops/gnome/extensions/sound-output-device-chooser/default.nix b/pkgs/desktops/gnome/extensions/sound-output-device-chooser/default.nix
index 431784e78d9c..d70d1bb1e031 100644
--- a/pkgs/desktops/gnome/extensions/sound-output-device-chooser/default.nix
+++ b/pkgs/desktops/gnome/extensions/sound-output-device-chooser/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  substituteAll,
+  replaceVars,
   fetchFromGitHub,
   libpulseaudio,
   python3,
@@ -21,8 +21,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # Fix paths to libpulse and python
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       libpulse = "${libpulseaudio}/lib/libpulse.so";
       python = python3.interpreter;
     })
diff --git a/pkgs/desktops/lomiri/applications/lomiri/default.nix b/pkgs/desktops/lomiri/applications/lomiri/default.nix
index f4d14750e6c7..bf7881659864 100644
--- a/pkgs/desktops/lomiri/applications/lomiri/default.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri/default.nix
@@ -6,7 +6,7 @@
   fetchpatch2,
   gitUpdater,
   linkFarm,
-  substituteAll,
+  replaceVars,
   nixosTests,
   ayatana-indicator-datetime,
   bash,
@@ -117,8 +117,7 @@ stdenv.mkDerivation (finalAttrs: {
     })
 
     ./9901-lomiri-Disable-Wizard.patch
-    (substituteAll {
-      src = ./9902-Layout-fallback-file.patch;
+    (replaceVars ./9902-Layout-fallback-file.patch {
       nixosLayoutFile = "/etc/" + finalAttrs.finalPackage.passthru.etcLayoutsFile;
     })
   ];
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/datetime/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/datetime/default.nix
index 9ecda8e925d6..a9503c4fbb3f 100644
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/datetime/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/datetime/default.nix
@@ -5,7 +5,7 @@
   nix-update-script,
   meson,
   ninja,
-  substituteAll,
+  replaceVars,
   pkg-config,
   vala,
   libadwaita,
@@ -31,8 +31,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       tzdata = tzdata;
     })
   ];
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
index 82b10c75df8e..37d55612c396 100644
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , nix-update-script
-, substituteAll
+, replaceVars
 , meson
 , ninja
 , pkg-config
@@ -38,8 +38,7 @@ stdenv.mkDerivation rec {
     # https://github.com/elementary/switchboard-plug-keyboard/issues/324
     ./hide-install-unlisted-engines-button.patch
 
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       inherit onboard libgnomekbd;
     })
   ];
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
index e36eba828f7f..5837552a2d47 100644
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   nix-update-script,
-  substituteAll,
+  replaceVars,
   meson,
   ninja,
   pkg-config,
@@ -32,8 +32,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       touchegg = touchegg;
     })
   ];
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
index 3c58ca7ef4d4..1a4eccfe26c1 100644
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
@@ -6,7 +6,7 @@
   meson,
   ninja,
   pkg-config,
-  substituteAll,
+  replaceVars,
   vala,
   libadwaita,
   libgee,
@@ -31,8 +31,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       inherit networkmanagerapplet;
     })
   ];
diff --git a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
index 115eb32558df..55fe603c7b48 100644
--- a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , nix-update-script
 , linkFarm
-, substituteAll
+, replaceVars
 , elementary-greeter
 , pkg-config
 , meson
@@ -43,8 +43,7 @@ stdenv.mkDerivation rec {
   patches = [
     ./sysconfdir-install.patch
     # Needed until https://github.com/elementary/greeter/issues/360 is fixed
-    (substituteAll {
-      src = ./hardcode-fallback-background.patch;
+    (replaceVars ./hardcode-fallback-background.patch {
       default_wallpaper = "${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}";
     })
   ];
diff --git a/pkgs/desktops/pantheon/desktop/file-roller-contract/default.nix b/pkgs/desktops/pantheon/desktop/file-roller-contract/default.nix
index 3ac8f42b87ab..64a126da8807 100644
--- a/pkgs/desktops/pantheon/desktop/file-roller-contract/default.nix
+++ b/pkgs/desktops/pantheon/desktop/file-roller-contract/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   unstableGitUpdater,
-  substituteAll,
+  replaceVars,
   file-roller,
 }:
 
@@ -19,8 +19,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./exec-path.patch;
+    (replaceVars ./exec-path.patch {
       file_roller = file-roller;
     })
   ];
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/applications-menu/default.nix b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/applications-menu/default.nix
index 7b3b95b2c834..bd93ae6b2565 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/applications-menu/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/applications-menu/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , nix-update-script
-, substituteAll
+, replaceVars
 , meson
 , ninja
 , pkg-config
@@ -32,8 +32,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       bc = "${bc}/bin/bc";
     })
   ];
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix
index ba30fb48469f..dc8d244b1c6a 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/datetime/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   nix-update-script,
-  substituteAll,
+  replaceVars,
   pkg-config,
   meson,
   ninja,
@@ -32,8 +32,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       elementary_calendar = elementary-calendar;
     })
   ];
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/keyboard/default.nix b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/keyboard/default.nix
index 24ab81ba0068..53992f8c7b36 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/keyboard/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/keyboard/default.nix
@@ -6,7 +6,7 @@
   pkg-config,
   meson,
   ninja,
-  substituteAll,
+  replaceVars,
   vala,
   gtk3,
   granite,
@@ -30,8 +30,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       gkbd_keyboard_display = "${libgnomekbd}/bin/gkbd-keyboard-display";
     })
   ];
diff --git a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/power/default.nix b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/power/default.nix
index 6140d85064e5..41d8e5f88275 100644
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/power/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/power/default.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  substituteAll,
+  replaceVars,
   nix-update-script,
   gnome-power-manager,
   pkg-config,
@@ -32,8 +32,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
+    (replaceVars ./fix-paths.patch {
       gnome_power_manager = gnome-power-manager;
     })
   ];
diff --git a/pkgs/desktops/plasma-5/plasma-nm/default.nix b/pkgs/desktops/plasma-5/plasma-nm/default.nix
index dc7e8259eeb6..55818dffbe25 100644
--- a/pkgs/desktops/plasma-5/plasma-nm/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-nm/default.nix
@@ -1,6 +1,6 @@
 {
   mkDerivation,
-  substituteAll,
+  replaceVars,
   extra-cmake-modules,
   kdoctools,
   kcmutils,
@@ -75,8 +75,7 @@ mkDerivation {
   ];
 
   patches = [
-    (substituteAll {
-      src = ./0002-openvpn-binary-path.patch;
+    (replaceVars ./0002-openvpn-binary-path.patch {
       inherit openvpn;
     })
   ];
diff --git a/pkgs/development/libraries/gtkspell/default.nix b/pkgs/development/libraries/gtkspell/default.nix
index b663839ac53c..b0ad6cece22d 100644
--- a/pkgs/development/libraries/gtkspell/default.nix
+++ b/pkgs/development/libraries/gtkspell/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoreconfHook
     docbook_xsl
+    gtk2 # GLIB_GNU_GETTEXT
     gtk-doc
     intltool
     pkg-config
diff --git a/pkgs/development/php-packages/tideways/default.nix b/pkgs/development/php-packages/tideways/default.nix
index d63e98750dea..87464e23549a 100644
--- a/pkgs/development/php-packages/tideways/default.nix
+++ b/pkgs/development/php-packages/tideways/default.nix
@@ -23,7 +23,7 @@ in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-php";
   extensionName = "tideways";
-  version = "5.16.2";
+  version = "5.17.0";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -43,15 +43,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-x86_64.tar.gz";
-        hash = "sha256-bSLBk4VWRvErmSqXOEFE0N0K06+NRLmsJ76HegFYah8=";
+        hash = "sha256-zWmGGSSvV48dSU+Ox2ypPcIxVzr0oru9Eaoh1hQ+WgI=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-arm64.tar.gz";
-        hash = "sha256-nXTk0DlGSEq0bp4+Hls3+epV6JY4H50D6IO/M3evFpE=";
+        hash = "sha256-xGkyLBy5oXVXs3VHT6fVg82H7Dmfc8VGHV9CEfw3ETY=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-macos-arm.tar.gz";
-        hash = "sha256-IqQ0gtLAx8lVBccaDsum81FmkYXHKQ5zf27F2Y+H45g=";
+        hash = "sha256-StVPDWGKseagnkEi9dUX2dvu0+tIN8xxUTWmxKW1kDM=";
       };
     };
 
diff --git a/pkgs/development/python-modules/comicon/default.nix b/pkgs/development/python-modules/comicon/default.nix
index d57701eb250d..3f902b0128e9 100644
--- a/pkgs/development/python-modules/comicon/default.nix
+++ b/pkgs/development/python-modules/comicon/default.nix
@@ -1,20 +1,20 @@
 {
-  lib,
   buildPythonPackage,
-  fetchFromGitHub,
-  fetchpatch2,
-  poetry-core,
-  pythonOlder,
   ebooklib,
+  fetchFromGitHub,
+  lib,
   lxml,
+  nix-update-script,
   pillow,
+  poetry-core,
   pypdf,
   python-slugify,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "comicon";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
   disabled = pythonOlder "3.10";
 
@@ -22,29 +22,14 @@ buildPythonPackage rec {
     owner = "potatoeggy";
     repo = "comicon";
     tag = "v${version}";
-    hash = "sha256-0AGCTnStyBVL7DVkrUFyD60xnuuO1dcl+Twdyy+uq1Y=";
+    hash = "sha256-jZ/ZhSFg0ZPTYI10s8Cn1s9UZRFFnuLjS96lnUFVekQ=";
   };
 
-  patches = [
-    # Upstream forgot to bump the version before tagging
-    # See https://github.com/potatoeggy/comicon/commit/d698f0f03b1a391f988176885686e9fca135676e
-    (fetchpatch2 {
-      name = "comicon-version-bump.patch";
-      url = "https://github.com/potatoeggy/comicon/commit/d698f0f03b1a391f988176885686e9fca135676e.diff";
-      hash = "sha256-ZHltw4OSYuHF8mH0kBZDsuozPy08Bm7nme+XSwfGNn8=";
-    })
-  ];
-
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
-  pythonRelaxDeps = [
-    "pillow"
-    "pypdf"
-  ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     ebooklib
     lxml
     pillow
@@ -52,15 +37,21 @@ buildPythonPackage rec {
     python-slugify
   ];
 
+  pythonRelaxDeps = [
+    "pillow"
+  ];
+
   doCheck = false; # test artifacts are not public
 
   pythonImportsCheck = [ "comicon" ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     changelog = "https://github.com/potatoeggy/comicon/releases/tag/v${version}";
     description = "Lightweight comic converter library between CBZ, PDF, and EPUB";
     homepage = "https://github.com/potatoeggy/comicon";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ Scrumplex ];
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ Scrumplex ];
   };
 }
diff --git a/pkgs/development/python-modules/flaxlib/default.nix b/pkgs/development/python-modules/flaxlib/default.nix
index bb49634b6034..1a3a35ac30c5 100644
--- a/pkgs/development/python-modules/flaxlib/default.nix
+++ b/pkgs/development/python-modules/flaxlib/default.nix
@@ -49,6 +49,13 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  env = {
+    # https://github.com/google/flax/issues/4491
+    # Upstream should update Cargo.lock
+    # Enabling `PYO3_USE_ABI3_FORWARD_COMPATIBILITY` allows us to temporarily avoid the issue
+    PYO3_USE_ABI3_FORWARD_COMPATIBILITY = true;
+  };
+
   # This package does not have tests (yet ?)
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/geventhttpclient/default.nix b/pkgs/development/python-modules/geventhttpclient/default.nix
index d187eb57b4d9..d3a615957f55 100644
--- a/pkgs/development/python-modules/geventhttpclient/default.nix
+++ b/pkgs/development/python-modules/geventhttpclient/default.nix
@@ -15,10 +15,10 @@
 
 buildPythonPackage rec {
   pname = "geventhttpclient";
-  version = "2.3.1";
+  version = "2.3.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "geventhttpclient";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     tag = version;
     # TODO: unvendor llhttp
     fetchSubmodules = true;
-    hash = "sha256-uOGnwPbvTam14SFTUT0UrwxHfP4a5cn3a7EhLoGBUrA=";
+    hash = "sha256-0ltTmF09EKs+55Mitfe5vxPjmCtnhla6q6SAvhyIQPk=";
   };
 
   build-system = [ setuptools ];
@@ -48,10 +48,6 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
-  preCheck = ''
-    rm -rf geventhttpclient
-  '';
-
   pytestFlagsArray = [ "-m 'not network'" ];
 
   pythonImportsCheck = [ "geventhttpclient" ];
@@ -59,7 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/geventhttpclient/geventhttpclient";
     description = "High performance, concurrent HTTP client library using gevent";
-    changelog = "https://github.com/geventhttpclient/geventhttpclient/releases/tag/${version}";
+    changelog = "https://github.com/geventhttpclient/geventhttpclient/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ koral ];
   };
diff --git a/pkgs/development/python-modules/llama-cloud/default.nix b/pkgs/development/python-modules/llama-cloud/default.nix
index f137ecb2aa81..533367d32d46 100644
--- a/pkgs/development/python-modules/llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-cloud/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-cloud";
-  version = "0.1.8";
+  version = "0.1.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_cloud";
     inherit version;
-    hash = "sha256-cZm6siQKnMMwdAAD+ndkj0P25TPaQRqCUKSnBYT5EVM=";
+    hash = "sha256-/AO9M4odoEt2B6RNgqYrPrF42ArwWlNlPoAdb4u2ffc=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/mandown/default.nix b/pkgs/development/python-modules/mandown/default.nix
index b45bec563437..3738f5fb2588 100644
--- a/pkgs/development/python-modules/mandown/default.nix
+++ b/pkgs/development/python-modules/mandown/default.nix
@@ -1,44 +1,39 @@
 {
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  poetry-core,
   beautifulsoup4,
+  buildPythonPackage,
   comicon,
   feedparser,
+  fetchFromGitHub,
   filetype,
+  lib,
   lxml,
   natsort,
   nix-update-script,
   pillow,
+  poetry-core,
+  pyside6,
   python-slugify,
   requests,
   typer,
-  pyside6,
 }:
 
 buildPythonPackage rec {
   pname = "mandown";
-  version = "1.10.1";
+  version = "1.11.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "potatoeggy";
     repo = "mandown";
     tag = "v${version}";
-    hash = "sha256-6i0a2jEJy7aL6W801Xki7jmHhO5kkFL8rJI+y+MhWVo=";
+    hash = "sha256-xoRUGtZMM1l3gCtF1wFHBo3vTEGJcNxqkO/yeTuEke8=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
-  pythonRelaxDeps = [
-    "pillow"
-    "typer"
-  ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     beautifulsoup4
     comicon
     feedparser
@@ -51,18 +46,24 @@ buildPythonPackage rec {
     typer
   ];
 
+  pythonRelaxDeps = [
+    "pillow"
+    "typer"
+  ];
+
   optional-dependencies = {
     gui = [ pyside6 ];
-    updateScript = nix-update-script { };
   };
 
   pythonImportsCheck = [ "mandown" ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     changelog = "https://github.com/potatoeggy/mandown/releases/tag/v${version}";
     description = "Comic/manga/webtoon downloader and CBZ/EPUB/MOBI/PDF converter";
     homepage = "https://github.com/potatoeggy/mandown";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ Scrumplex ];
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ Scrumplex ];
   };
 }
diff --git a/pkgs/development/python-modules/mozart-api/default.nix b/pkgs/development/python-modules/mozart-api/default.nix
index 65421615d17e..02bfc83bca24 100644
--- a/pkgs/development/python-modules/mozart-api/default.nix
+++ b/pkgs/development/python-modules/mozart-api/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "mozart-api";
-  version = "4.1.1.116.4";
+  version = "4.1.1.116.5";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "mozart_api";
     inherit version;
-    hash = "sha256-9yg02AQdHMR/Yz0dpjSb3umdNRNTo7S04Q2BY/vu7WQ=";
+    hash = "sha256-4ALRG0yKCRwztQ9A6fMVaht6c8tDrMSh+CfsLRZbdcw=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pyannotate/default.nix b/pkgs/development/python-modules/pyannotate/default.nix
index d77b60248132..efb769051def 100644
--- a/pkgs/development/python-modules/pyannotate/default.nix
+++ b/pkgs/development/python-modules/pyannotate/default.nix
@@ -43,6 +43,7 @@ buildPythonPackage rec {
     ++ lib.optionals (pythonAtLeast "3.11") [
       # Tests are using lib2to3
       "pyannotate_tools/fixes/tests/test_annotate*.py"
+      "pyannotate_tools/annotations/tests/dundermain_test.py"
     ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pytapo/default.nix b/pkgs/development/python-modules/pytapo/default.nix
index 7d6537386687..335e53e31548 100644
--- a/pkgs/development/python-modules/pytapo/default.nix
+++ b/pkgs/development/python-modules/pytapo/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pytapo";
-  version = "3.3.37";
+  version = "3.3.38";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-InDbfWzRb+Q+E6feeatHIliq83g83oUfo3Yze/BAJdM=";
+    hash = "sha256-o3onR27lKg2QAa1Tgdidv6iOzqb/XlkJPq+vkkIhnAY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/robotframework/default.nix b/pkgs/development/python-modules/robotframework/default.nix
index 618499682282..b13c8e6ce301 100644
--- a/pkgs/development/python-modules/robotframework/default.nix
+++ b/pkgs/development/python-modules/robotframework/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "robotframework";
-  version = "7.1.1";
+  version = "7.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,10 +19,10 @@ buildPythonPackage rec {
     owner = "robotframework";
     repo = "robotframework";
     tag = "v${version}";
-    hash = "sha256-AJMJb8FN+KynxJXI7s7PwyM/+UpXCtWTcRK/fhCg+io=";
+    hash = "sha256-G+mmSeTLr6h0e2YCJOpbYaRNZ5M6PXWBYXdn9xGitkM=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [ jsonschema ];
 
@@ -30,11 +30,11 @@ buildPythonPackage rec {
     ${python.interpreter} utest/run.py
   '';
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/robotframework/robotframework/blob/master/doc/releasenotes/rf-${version}.rst";
     description = "Generic test automation framework";
     homepage = "https://robotframework.org/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ bjornfor ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bjornfor ];
   };
 }
diff --git a/pkgs/development/python-modules/tesserocr/default.nix b/pkgs/development/python-modules/tesserocr/default.nix
index 1bddf639b4c7..d091eb08f57d 100644
--- a/pkgs/development/python-modules/tesserocr/default.nix
+++ b/pkgs/development/python-modules/tesserocr/default.nix
@@ -61,6 +61,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/sirfz/tesserocr";
     license = licenses.mit;
     maintainers = with maintainers; [ mtrsk ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index e5968f51168b..1a66aab57537 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -105,9 +105,6 @@ let
 
     meta = {
       mainProgram = "gpu_stats";
-      # ld: library not found for -lIOReport
-      # TODO: succeeds on https://github.com/NixOS/nixpkgs/pull/348827, so try again once it lands on master
-      broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
     };
   };
 
@@ -302,7 +299,7 @@ buildPythonPackage rec {
       "test_disabled_context_manager"
       "test_mode_disabled"
     ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # AssertionError: assert not copy2_mock.called
       "test_copy_or_overwrite_changed_no_copy"
 
diff --git a/pkgs/development/python-modules/webrtc-noise-gain/default.nix b/pkgs/development/python-modules/webrtc-noise-gain/default.nix
index adf82573edd9..c258cc774af1 100644
--- a/pkgs/development/python-modules/webrtc-noise-gain/default.nix
+++ b/pkgs/development/python-modules/webrtc-noise-gain/default.nix
@@ -28,6 +28,16 @@ buildPythonPackage rec {
     hash = "sha256-GbdG2XM11zgPk2VZ0mu7qMv256jaMyJDHdBCBUnynMY=";
   };
 
+  postPatch = with stdenv.hostPlatform.uname; ''
+    # Configure the correct host platform for cross builds
+    substituteInPlace setup.py --replace-fail \
+      "system = platform.system().lower()" \
+      'system = "${lib.toLower system}"'
+    substituteInPlace setup.py --replace-fail \
+      "machine = platform.machine().lower()" \
+      'machine = "${lib.toLower processor}"'
+  '';
+
   nativeBuildInputs = [
     pybind11
     setuptools
diff --git a/pkgs/development/python-modules/yamale/default.nix b/pkgs/development/python-modules/yamale/default.nix
index 930d3bb607c7..b7dc2eda8bca 100644
--- a/pkgs/development/python-modules/yamale/default.nix
+++ b/pkgs/development/python-modules/yamale/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "yamale";
-  version = "5.3.0";
+  version = "6.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -20,17 +20,20 @@ buildPythonPackage rec {
     owner = "23andMe";
     repo = "yamale";
     tag = version;
-    hash = "sha256-fYH+0OUJ9EnsAQh/VUOUVms1jwqpcLBj/c5uLj/1gVc=";
+    hash = "sha256-Ij9jhGMYHUStZ/xR5GUg/eF6YQdtIfpLU7g1pev6wJU=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
     pyyaml
-    ruamel-yaml
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  optional-dependencies = {
+    ruamel = [ ruamel-yaml ];
+  };
+
+  nativeCheckInputs = [ pytestCheckHook ] ++ optional-dependencies.ruamel;
 
   pythonImportsCheck = [ "yamale" ];
 
diff --git a/pkgs/kde/gear/audiocd-kio/default.nix b/pkgs/kde/gear/audiocd-kio/default.nix
index b4fa60026b18..c99990ff606c 100644
--- a/pkgs/kde/gear/audiocd-kio/default.nix
+++ b/pkgs/kde/gear/audiocd-kio/default.nix
@@ -5,7 +5,7 @@
   flac,
   libogg,
   libvorbis,
-  substituteAll,
+  replaceVars,
   lame,
   opusTools,
 }:
@@ -13,8 +13,7 @@ mkKdeDerivation {
   pname = "audiocd-kio";
 
   patches = [
-    (substituteAll {
-      src = ./encoder-paths.patch;
+    (replaceVars ./encoder-paths.patch {
       lame = lib.getExe lame;
       opusenc = "${opusTools}/bin/opusenc";
     })
diff --git a/pkgs/kde/gear/kdeconnect-kde/default.nix b/pkgs/kde/gear/kdeconnect-kde/default.nix
index 3bc3abd422ea..d81c487e452f 100644
--- a/pkgs/kde/gear/kdeconnect-kde/default.nix
+++ b/pkgs/kde/gear/kdeconnect-kde/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   mkKdeDerivation,
-  substituteAll,
+  replaceVars,
   sshfs,
   qtconnectivity,
   qtmultimedia,
@@ -15,8 +15,7 @@ mkKdeDerivation {
   pname = "kdeconnect-kde";
 
   patches = [
-    (substituteAll {
-      src = ./hardcode-sshfs-path.patch;
+    (replaceVars ./hardcode-sshfs-path.patch {
       sshfs = lib.getExe sshfs;
     })
   ];
diff --git a/pkgs/kde/gear/kdenetwork-filesharing/default.nix b/pkgs/kde/gear/kdenetwork-filesharing/default.nix
index 4127b9c24f94..597cb8cc80de 100644
--- a/pkgs/kde/gear/kdenetwork-filesharing/default.nix
+++ b/pkgs/kde/gear/kdenetwork-filesharing/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   mkKdeDerivation,
-  substituteAll,
+  replaceVars,
   samba,
   shadow,
   qtdeclarative,
@@ -10,8 +10,7 @@ mkKdeDerivation {
   pname = "kdenetwork-filesharing";
 
   patches = [
-    (substituteAll {
-      src = ./dependency-paths.patch;
+    (replaceVars ./dependency-paths.patch {
       inherit samba;
       usermod = lib.getExe' shadow "usermod";
     })
diff --git a/pkgs/kde/gear/kdenlive/default.nix b/pkgs/kde/gear/kdenlive/default.nix
index 6bc08951f3cc..7746320e4d7b 100644
--- a/pkgs/kde/gear/kdenlive/default.nix
+++ b/pkgs/kde/gear/kdenlive/default.nix
@@ -1,6 +1,6 @@
 {
   mkKdeDerivation,
-  substituteAll,
+  replaceVars,
   qtsvg,
   qtmultimedia,
   qtnetworkauth,
@@ -17,8 +17,7 @@ mkKdeDerivation {
   pname = "kdenlive";
 
   patches = [
-    (substituteAll {
-      src = ./dependency-paths.patch;
+    (replaceVars ./dependency-paths.patch {
       inherit mediainfo mlt glaxnimate;
       ffmpeg = ffmpeg-full;
     })
diff --git a/pkgs/kde/plasma/drkonqi/default.nix b/pkgs/kde/plasma/drkonqi/default.nix
index d9f097806899..965ba59b308d 100644
--- a/pkgs/kde/plasma/drkonqi/default.nix
+++ b/pkgs/kde/plasma/drkonqi/default.nix
@@ -4,7 +4,7 @@
   systemd,
   gdb,
   python3,
-  substituteAll,
+  replaceVars,
 }:
 let
   gdb' = gdb.override {
@@ -20,8 +20,7 @@ mkKdeDerivation {
   pname = "drkonqi";
 
   patches = [
-    (substituteAll {
-      src = ./gdb-path.patch;
+    (replaceVars ./gdb-path.patch {
       gdb = "${gdb'}/bin/gdb";
     })
   ];
diff --git a/pkgs/kde/plasma/kde-gtk-config/default.nix b/pkgs/kde/plasma/kde-gtk-config/default.nix
index c9b5a827eea8..0ffc06da8451 100644
--- a/pkgs/kde/plasma/kde-gtk-config/default.nix
+++ b/pkgs/kde/plasma/kde-gtk-config/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   mkKdeDerivation,
-  substituteAll,
+  replaceVars,
   procps,
   xsettingsd,
   pkg-config,
@@ -17,8 +17,7 @@ mkKdeDerivation {
   # aren't found.
   patches = [
     ./0001-gsettings-schemas-path.patch
-    (substituteAll {
-      src = ./dependency-paths.patch;
+    (replaceVars ./dependency-paths.patch {
       pgrep = lib.getExe' procps "pgrep";
       xsettingsd = lib.getExe xsettingsd;
     })
diff --git a/pkgs/kde/plasma/krdp/default.nix b/pkgs/kde/plasma/krdp/default.nix
index 8dd95c1a7659..dc8d7afcb1c0 100644
--- a/pkgs/kde/plasma/krdp/default.nix
+++ b/pkgs/kde/plasma/krdp/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   mkKdeDerivation,
-  substituteAll,
+  replaceVars,
   openssl,
   pkg-config,
   qtkeychain,
@@ -14,8 +14,7 @@ mkKdeDerivation {
   pname = "krdp";
 
   patches = [
-    (substituteAll {
-      src = ./hardcode-openssl-path.patch;
+    (replaceVars ./hardcode-openssl-path.patch {
       openssl = lib.getExe openssl;
     })
   ];
diff --git a/pkgs/kde/plasma/plasma-desktop/default.nix b/pkgs/kde/plasma/plasma-desktop/default.nix
index 46a0a73fb453..53c270cb5905 100644
--- a/pkgs/kde/plasma/plasma-desktop/default.nix
+++ b/pkgs/kde/plasma/plasma-desktop/default.nix
@@ -5,7 +5,7 @@
   makeWrapper,
   glib,
   gsettings-desktop-schemas,
-  substituteAll,
+  replaceVars,
   util-linux,
   pkg-config,
   qtsvg,
@@ -31,18 +31,15 @@ mkKdeDerivation {
   pname = "plasma-desktop";
 
   patches = [
-    (substituteAll {
-      src = ./hwclock-path.patch;
+    (replaceVars ./hwclock-path.patch {
       hwclock = "${lib.getBin util-linux}/bin/hwclock";
     })
-    (substituteAll {
-      src = ./kcm-access.patch;
+    (replaceVars ./kcm-access.patch {
       gsettings = "${gsettings-wrapper}/bin/gsettings";
     })
     ./tzdir.patch
     ./no-discover-shortcut.patch
-    (substituteAll {
-      src = ./wallpaper-paths.patch;
+    (replaceVars ./wallpaper-paths.patch {
       wallpapers = "${lib.getBin breeze}/share/wallpapers";
     })
   ];
diff --git a/pkgs/kde/plasma/plasma-disks/default.nix b/pkgs/kde/plasma/plasma-disks/default.nix
index 5941fe0dec54..db687bcbb8de 100644
--- a/pkgs/kde/plasma/plasma-disks/default.nix
+++ b/pkgs/kde/plasma/plasma-disks/default.nix
@@ -1,16 +1,15 @@
 {
   mkKdeDerivation,
   lib,
-  substituteAll,
+  replaceVars,
   smartmontools,
 }:
 mkKdeDerivation {
   pname = "plasma-disks";
 
   patches = [
-    (substituteAll {
+    (replaceVars ./smartctl-path.patch {
       smartctl = lib.getExe smartmontools;
-      src = ./smartctl-path.patch;
     })
   ];
 }
diff --git a/pkgs/kde/plasma/plasma-nm/default.nix b/pkgs/kde/plasma/plasma-nm/default.nix
index 6d93b623477b..3662452bad7b 100644
--- a/pkgs/kde/plasma/plasma-nm/default.nix
+++ b/pkgs/kde/plasma/plasma-nm/default.nix
@@ -1,6 +1,6 @@
 {
   mkKdeDerivation,
-  substituteAll,
+  replaceVars,
   pkg-config,
   qtwebengine,
   mobile-broadband-provider-info,
@@ -11,8 +11,7 @@ mkKdeDerivation {
   pname = "plasma-nm";
 
   patches = [
-    (substituteAll {
-      src = ./0002-openvpn-binary-path.patch;
+    (replaceVars ./0002-openvpn-binary-path.patch {
       inherit openvpn;
     })
   ];
diff --git a/pkgs/servers/headscale/default.nix b/pkgs/servers/headscale/default.nix
index 1287d3668ea9..8cc608dc228c 100644
--- a/pkgs/servers/headscale/default.nix
+++ b/pkgs/servers/headscale/default.nix
@@ -4,26 +4,33 @@
   fetchFromGitHub,
   installShellFiles,
   nixosTests,
+  postgresql,
 }:
 buildGoModule rec {
   pname = "headscale";
-  version = "0.23.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "juanfont";
     repo = "headscale";
     rev = "v${version}";
-    hash = "sha256-5tlnVNpn+hJayxHjTpbOO3kRInOYOFz0pe9pwjXZlBE=";
+    hash = "sha256-s9zzhN8NTC6YxOO6fyO+A0jleeY8bhN1wcbf4pvGkpI=";
   };
 
-  # Merged post-v0.23.0, so should be removed with next release.
-  patches = [ ./patches/config-loosen-up-BaseDomain-and-ServerURL-checks.patch ];
+  vendorHash = "sha256-SBfeixT8DQOrK2SWmHHSOBtzRdSZs+pwomHpw6Jd+qc=";
 
-  vendorHash = "sha256-+8dOxPG/Q+wuHgRwwWqdphHOuop0W9dVyClyQuh7aRc=";
+  subPackages = [ "cmd/headscale" ];
 
-  ldflags = ["-s" "-w" "-X github.com/juanfont/headscale/cmd/headscale/cli.Version=v${version}"];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/juanfont/headscale/cmd/headscale/cli.Version=v${version}"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  nativeCheckInputs = [ postgresql ];
 
-  nativeBuildInputs = [installShellFiles];
   checkFlags = ["-short"];
 
   postInstall = ''
@@ -33,7 +40,7 @@ buildGoModule rec {
       --zsh <($out/bin/headscale completion zsh)
   '';
 
-  passthru.tests = {inherit (nixosTests) headscale;};
+  passthru.tests = { inherit (nixosTests) headscale; };
 
   meta = with lib; {
     homepage = "https://github.com/juanfont/headscale";
@@ -56,6 +63,9 @@ buildGoModule rec {
     '';
     license = licenses.bsd3;
     mainProgram = "headscale";
-    maintainers = with maintainers; [nkje jk kradalby misterio77 ghuntley];
+    maintainers = with maintainers; [
+      kradalby
+      misterio77
+    ];
   };
 }
diff --git a/pkgs/servers/headscale/patches/config-loosen-up-BaseDomain-and-ServerURL-checks.patch b/pkgs/servers/headscale/patches/config-loosen-up-BaseDomain-and-ServerURL-checks.patch
deleted file mode 100644
index d226bc99ceff..000000000000
--- a/pkgs/servers/headscale/patches/config-loosen-up-BaseDomain-and-ServerURL-checks.patch
+++ /dev/null
@@ -1,204 +0,0 @@
-From 6ba8990b0b982b261b0b549080a2f7f780cc70d6 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Motiejus=20Jak=C5=A1tys?= <motiejus@jakstys.lt>
-Date: Thu, 21 Nov 2024 06:28:45 +0200
-Subject: [PATCH] config: loosen up BaseDomain and ServerURL checks
-
-Requirements [here][1]:
-
-> OK:
-> server_url: headscale.com, base: clients.headscale.com
-> server_url: headscale.com, base: headscale.net
->
-> Not OK:
-> server_url: server.headscale.com, base: headscale.com
->
-> Essentially we have to prevent the possibility where the headscale
-> server has a URL which can also be assigned to a node.
->
-> So for the Not OK scenario:
->
-> if the server is: server.headscale.com, and a node joins with the name
-> server, it will be assigned server.headscale.com and that will break
-> the connection for nodes which will now try to connect to that node
-> instead of the headscale server.
-
-Fixes #2210
-
-[1]: https://github.com/juanfont/headscale/issues/2210#issuecomment-2488165187
----
- hscontrol/types/config.go                     | 44 +++++++++++--
- hscontrol/types/config_test.go                | 64 ++++++++++++++++++-
- .../testdata/base-domain-in-server-url.yaml   |  2 +-
- 3 files changed, 102 insertions(+), 8 deletions(-)
-
-diff --git a/hscontrol/types/config.go b/hscontrol/types/config.go
-index 50ce2f075f4c..b10118aaeade 100644
---- a/hscontrol/types/config.go
-+++ b/hscontrol/types/config.go
-@@ -28,8 +28,9 @@ const (
- 	maxDuration           time.Duration = 1<<63 - 1
- )
- 
--var errOidcMutuallyExclusive = errors.New(
--	"oidc_client_secret and oidc_client_secret_path are mutually exclusive",
-+var (
-+	errOidcMutuallyExclusive = errors.New("oidc_client_secret and oidc_client_secret_path are mutually exclusive")
-+	errServerURLSuffix       = errors.New("server_url cannot be part of base_domain in a way that could make the DERP and headscale server unreachable")
- )
- 
- type IPAllocationStrategy string
-@@ -814,10 +815,10 @@ func LoadServerConfig() (*Config, error) {
- 	// - DERP run on their own domains
- 	// - Control plane runs on login.tailscale.com/controlplane.tailscale.com
- 	// - MagicDNS (BaseDomain) for users is on a *.ts.net domain per tailnet (e.g. tail-scale.ts.net)
--	//
--	// TODO(kradalby): remove dnsConfig.UserNameInMagicDNS check when removed.
--	if !dnsConfig.UserNameInMagicDNS && dnsConfig.BaseDomain != "" && strings.Contains(serverURL, dnsConfig.BaseDomain) {
--		return nil, errors.New("server_url cannot contain the base_domain, this will cause the headscale server and embedded DERP to become unreachable from the Tailscale node.")
-+	if !dnsConfig.UserNameInMagicDNS && dnsConfig.BaseDomain != "" {
-+		if err := isSafeServerURL(serverURL, dnsConfig.BaseDomain); err != nil {
-+			return nil, err
-+		}
- 	}
- 
- 	return &Config{
-@@ -910,6 +911,37 @@ func LoadServerConfig() (*Config, error) {
- 	}, nil
- }
- 
-+// BaseDomain cannot be a suffix of the server URL.
-+// This is because Tailscale takes over the domain in BaseDomain,
-+// causing the headscale server and DERP to be unreachable.
-+// For Tailscale upstream, the following is true:
-+// - DERP run on their own domains.
-+// - Control plane runs on login.tailscale.com/controlplane.tailscale.com.
-+// - MagicDNS (BaseDomain) for users is on a *.ts.net domain per tailnet (e.g. tail-scale.ts.net).
-+func isSafeServerURL(serverURL, baseDomain string) error {
-+	server, err := url.Parse(serverURL)
-+	if err != nil {
-+		return err
-+	}
-+
-+	serverDomainParts := strings.Split(server.Host, ".")
-+	baseDomainParts := strings.Split(baseDomain, ".")
-+
-+	if len(serverDomainParts) <= len(baseDomainParts) {
-+		return nil
-+	}
-+
-+	s := len(serverDomainParts)
-+	b := len(baseDomainParts)
-+	for i := range len(baseDomainParts) {
-+		if serverDomainParts[s-i-1] != baseDomainParts[b-i-1] {
-+			return nil
-+		}
-+	}
-+
-+	return errServerURLSuffix
-+}
-+
- type deprecator struct {
- 	warns  set.Set[string]
- 	fatals set.Set[string]
-diff --git a/hscontrol/types/config_test.go b/hscontrol/types/config_test.go
-index e6e8d6c2e0b1..68a13f6c0f40 100644
---- a/hscontrol/types/config_test.go
-+++ b/hscontrol/types/config_test.go
-@@ -1,6 +1,7 @@
- package types
- 
- import (
-+	"fmt"
- 	"os"
- 	"path/filepath"
- 	"testing"
-@@ -141,7 +142,7 @@ func TestReadConfig(t *testing.T) {
- 				return LoadServerConfig()
- 			},
- 			want:    nil,
--			wantErr: "server_url cannot contain the base_domain, this will cause the headscale server and embedded DERP to become unreachable from the Tailscale node.",
-+			wantErr: errServerURLSuffix.Error(),
- 		},
- 		{
- 			name:       "base-domain-not-in-server-url",
-@@ -337,3 +338,64 @@ tls_letsencrypt_challenge_type: TLS-ALPN-01
- 	err = LoadConfig(tmpDir, false)
- 	assert.NoError(t, err)
- }
-+
-+// OK
-+// server_url: headscale.com, base: clients.headscale.com
-+// server_url: headscale.com, base: headscale.net
-+//
-+// NOT OK
-+// server_url: server.headscale.com, base: headscale.com.
-+func TestSafeServerURL(t *testing.T) {
-+	tests := []struct {
-+		serverURL, baseDomain,
-+		wantErr string
-+	}{
-+		{
-+			serverURL:  "https://example.com",
-+			baseDomain: "example.org",
-+		},
-+		{
-+			serverURL:  "https://headscale.com",
-+			baseDomain: "headscale.com",
-+		},
-+		{
-+			serverURL:  "https://headscale.com",
-+			baseDomain: "clients.headscale.com",
-+		},
-+		{
-+			serverURL:  "https://headscale.com",
-+			baseDomain: "clients.subdomain.headscale.com",
-+		},
-+		{
-+			serverURL:  "https://headscale.kristoffer.com",
-+			baseDomain: "mybase",
-+		},
-+		{
-+			serverURL:  "https://server.headscale.com",
-+			baseDomain: "headscale.com",
-+			wantErr:    errServerURLSuffix.Error(),
-+		},
-+		{
-+			serverURL:  "https://server.subdomain.headscale.com",
-+			baseDomain: "headscale.com",
-+			wantErr:    errServerURLSuffix.Error(),
-+		},
-+		{
-+			serverURL: "http://foo\x00",
-+			wantErr:   `parse "http://foo\x00": net/url: invalid control character in URL`,
-+		},
-+	}
-+
-+	for _, tt := range tests {
-+		testName := fmt.Sprintf("server=%s domain=%s", tt.serverURL, tt.baseDomain)
-+		t.Run(testName, func(t *testing.T) {
-+			err := isSafeServerURL(tt.serverURL, tt.baseDomain)
-+			if tt.wantErr != "" {
-+				assert.EqualError(t, err, tt.wantErr)
-+
-+				return
-+			}
-+			assert.NoError(t, err)
-+		})
-+	}
-+}
-diff --git a/hscontrol/types/testdata/base-domain-in-server-url.yaml b/hscontrol/types/testdata/base-domain-in-server-url.yaml
-index 683e021837c9..2d6a4694a09a 100644
---- a/hscontrol/types/testdata/base-domain-in-server-url.yaml
-+++ b/hscontrol/types/testdata/base-domain-in-server-url.yaml
-@@ -8,7 +8,7 @@ prefixes:
- database:
-   type: sqlite3
- 
--server_url: "https://derp.no"
-+server_url: "https://server.derp.no"
- 
- dns:
-   magic_dns: true
--- 
-2.47.0
-
diff --git a/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix b/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
index 69556f845e66..ec9d756e845c 100644
--- a/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "wills106";
   domain = "solax_modbus";
-  version = "2024.11.2";
+  version = "2025.01.8";
 
   src = fetchFromGitHub {
     owner = "wills106";
     repo = "homeassistant-solax-modbus";
     tag = version;
-    hash = "sha256-Hy4LHEDp+WPpmWKQQqqLjQ0xSnShQg3a68g8NMJ9o2k=";
+    hash = "sha256-jvz9CtVCuNu3w/1ebXcI8GNRAWajm51F9SMf13cBhlw=";
   };
 
   dependencies = [ pymodbus ];
diff --git a/pkgs/servers/mir/default.nix b/pkgs/servers/mir/default.nix
index a5e066e81225..57bc70f1a7a4 100644
--- a/pkgs/servers/mir/default.nix
+++ b/pkgs/servers/mir/default.nix
@@ -5,8 +5,8 @@ let
 in
 {
   mir = common {
-    version = "2.19.2";
-    hash = "sha256-E6+FjYJUIgejpat1Kyl0B1JL+mnQd4rXjSQAPTX31qc=";
+    version = "2.19.3";
+    hash = "sha256-WwT0cdLZJlVTTq8REuQrtYWdpRhqEDjYPHDy2oj8Edk=";
   };
 
   mir_2_15 = common {
diff --git a/pkgs/servers/monitoring/prometheus/zfs-exporter.nix b/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
index 0091485c9246..10ee71c20832 100644
--- a/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "zfs_exporter";
-  version = "2.3.4";
+  version = "2.3.6";
 
   src = fetchFromGitHub {
     owner = "pdf";
     repo = pname;
     rev = "v" + version;
-    hash = "sha256-wPahjWTZLt5GapkOmGdGSicAmSGte2BHf6zZBHd7D3g=";
+    hash = "sha256-en30/vKZDlqRvQW3n5yeMwLrukObw0d+NfzmdWvfXZE=";
   };
 
-  vendorHash = "sha256-EUeP7ysMnFeQO8Gaxhhonxk40cUv04MSiEDsaEcjTuM=";
+  vendorHash = "sha256-fhodh5EcvAX2fruwv0e9VNAti2jKa7kEDQCVSDFl48A=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/system/nvidia-system-monitor-qt/default.nix b/pkgs/tools/system/nvidia-system-monitor-qt/default.nix
index 8758b394693f..d7ef01f0c9cc 100644
--- a/pkgs/tools/system/nvidia-system-monitor-qt/default.nix
+++ b/pkgs/tools/system/nvidia-system-monitor-qt/default.nix
@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "nvidia-system-monitor-qt";
-  version = "1.6";
+  version = "1.6-1";
 
   src = fetchFromGitHub {
     owner = "congard";
     repo = "nvidia-system-monitor-qt";
     rev = "v${version}";
-    sha256 = "sha256-Gvg7MgCqvfiEfGDQJSR1v5uAB99ZULAuGPGCce/K7HE=";
+    sha256 = "sha256-JHK7idyk5UxgDyt+SzvYjTLmlNzx6+Z+OPYsRD4NWPg=";
   };
 
   buildInputs = [ qtbase ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2a9a047d7768..f8d9bdadc376 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7871,6 +7871,11 @@ with pkgs;
     inherit (llvmPackages) llvm libclang;
   };
 
+  daggerfall-unity-unfree = daggerfall-unity.override {
+    pname = "daggerfall-unity-unfree";
+    includeUnfree = true;
+  };
+
   dbt = with python3Packages; toPythonApplication dbt-core;
 
   devbox = callPackage ../development/tools/devbox { buildGoModule = buildGo123Module; };
@@ -18317,7 +18322,7 @@ with pkgs;
   };
 
   weasis = callPackage ../by-name/we/weasis/package.nix {
-    jre = jdk21;
+    jre = jdk23;
   };
 
   sieveshell = with python3.pkgs; toPythonApplication managesieve;