diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 631b7298e1ca..d6cf4d333b72 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -212,6 +212,12 @@
     githubId = 882455;
     name = "Elliot Cameron";
   };
+  _404wolf = {
+    email = "wolfmermelstein@gmail.com";
+    github = "404wolf";
+    githubId = 108041238;
+    name = "Wolf Mermelstein";
+  };
   _414owen = {
     email = "owen@owen.cafe";
     github = "414owen";
@@ -17159,11 +17165,11 @@
     name = "Szymon Scholz";
   };
   ratcornu = {
-    email = "ratcornu@skaven.org";
+    email = "ratcornu+programmation@skaven.org";
     github = "RatCornu";
     githubId = 98173832;
     name = "Balthazar Patiachvili";
-    matrix = "@ratcornu:skweel.skaven.org";
+    matrix = "@ratcornu:skaven.org";
     keys = [ { fingerprint = "1B91 F087 3D06 1319 D3D0  7F91 FA47 BDA2 6048 9ADA"; } ];
   };
   ratsclub = {
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 357678db60bd..800bbd03566d 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -61,6 +61,8 @@
 
 - [wg-access-server](https://github.com/freifunkMUC/wg-access-server/), an all-in-one WireGuard VPN solution with a web ui for connecting devices. Available at [services.wg-access-server](#opt-services.wg-access-server.enable).
 
+- [Pingvin Share](https://github.com/stonith404/pingvin-share), a self-hosted file sharing platform and an alternative for WeTransfer. Available as [services.pingvin-share](#opt-services.pingvin-share.enable).
+
 - [Envision](https://gitlab.com/gabmus/envision), a UI for building, configuring and running Monado, the open source OpenXR runtime. Available as [programs.envision](#opt-programs.envision.enable).
 
 - [Localsend](https://localsend.org/), an open source cross-platform alternative to AirDrop. Available as [programs.localsend](#opt-programs.localsend.enable).
@@ -258,6 +260,8 @@
 
 - `/share/nano` is now only linked when `programs.nano.enable` is enabled.
 
+- PPD files for Utax printers got renamed (spaces replaced by underscores) in newest `foomatic-db` package; users of Utax printers might need to adapt their `hardware.printers.ensurePrinters.*.model` value.
+
 - `libe57format` has been updated to `>= 3.0.0`, which contains some backward-incompatible API changes. See the [release note](https://github.com/asmaloney/libE57Format/releases/tag/v3.0.0) for more details.
 
 - `gitlab` deprecated support for *runner registration tokens* in GitLab 16.0, disabled their support in GitLab 17.0 and will
@@ -326,6 +330,10 @@
 
 - The `lsh` package and the `services.lshd` module have been removed as they had no maintainer in Nixpkgs and hadn’t seen an upstream release in over a decade. It is recommended to migrate to `openssh` and `services.openssh`.
 
+- `opencv2` and `opencv3` have been removed, as they are obsolete and
+  were not used by any other package. External users are encouraged to
+  migrate to OpenCV 4.
+
 ## Other Notable Changes {#sec-release-24.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 1c3e47f0bdd9..cf79c8b4792b 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1467,6 +1467,7 @@
   ./services/web-apps/phylactery.nix
   ./services/web-apps/photoprism.nix
   ./services/web-apps/pict-rs.nix
+  ./services/web-apps/pingvin-share.nix
   ./services/web-apps/plantuml-server.nix
   ./services/web-apps/plausible.nix
   ./services/web-apps/powerdns-admin.nix
diff --git a/nixos/modules/profiles/perlless.nix b/nixos/modules/profiles/perlless.nix
index 6257589ef9eb..f34c3d2d210b 100644
--- a/nixos/modules/profiles/perlless.nix
+++ b/nixos/modules/profiles/perlless.nix
@@ -1,8 +1,4 @@
-# WARNING: If you enable this profile, you will NOT be able to switch to a new
-# configuration and thus you will not be able to rebuild your system with
-# nixos-rebuild!
-
-{ lib, ... }:
+{ lib, pkgs, ... }:
 
 {
 
@@ -31,4 +27,8 @@
   # string "perl".
   system.forbiddenDependenciesRegexes = ["perl"];
 
+  # Re-add nixos-rebuild to the systemPackages that was removed by the
+  # `system.disableInstallerTools` option.
+  environment.systemPackages = [pkgs.nixos-rebuild];
+
 }
diff --git a/nixos/modules/services/web-apps/pingvin-share.md b/nixos/modules/services/web-apps/pingvin-share.md
new file mode 100644
index 000000000000..4c9ab901ee53
--- /dev/null
+++ b/nixos/modules/services/web-apps/pingvin-share.md
@@ -0,0 +1,43 @@
+# Pingvin Share {#module-services-pingvin-share}
+
+A self-hosted file sharing platform and an alternative for WeTransfer.
+
+## Configuration {#module-services-pingvin-share-basic-usage}
+
+By default, the module will execute Pingvin Share backend and frontend on the ports 8080 and 3000.
+
+I will run two systemd services named `pingvin-share-backend` and `pingvin-share-frontend` in the specified data directory.
+
+Here is a basic configuration:
+
+```nix
+{
+  services-pingvin-share = {
+    enable = true;
+
+    openFirewall = true;
+
+    backend.port = 9010;
+    frontend.port = 9011;
+  };
+}
+```
+
+## Reverse proxy configuration {#module-services-pingvin-share-reverse-proxy-configuration}
+
+The prefered method to run this service is behind a reverse proxy not to expose an open port. This, you can configure Nginx such like this:
+
+```nix
+{
+  services-pingvin-share = {
+    enable = true;
+
+    hostname = "pingvin-share.domain.tld";
+    https = true;
+
+    nginx.enable = true;
+  };
+}
+```
+
+Furthermore, you can increase the maximal size of an uploaded file with the option [services.nginx.clientMaxBodySize](#opt-services.nginx.clientMaxBodySize).
diff --git a/nixos/modules/services/web-apps/pingvin-share.nix b/nixos/modules/services/web-apps/pingvin-share.nix
new file mode 100644
index 000000000000..2d637a82ba8e
--- /dev/null
+++ b/nixos/modules/services/web-apps/pingvin-share.nix
@@ -0,0 +1,226 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.pingvin-share;
+  inherit (lib)
+    mkOption
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    types
+    ;
+in
+
+{
+  options = {
+    services.pingvin-share = {
+      enable = mkEnableOption "Pingvin Share, a self-hosted file sharing platform";
+
+      user = mkOption {
+        type = types.str;
+        default = "pingvin";
+        description = ''
+          User account under which Pingvin Share runs.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "pingvin";
+        description = ''
+          Group under which Pingvin Share runs.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the firewall for the port in {option}`services.pingvin-share.frontend.port`.
+        '';
+      };
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/pingvin-share";
+        example = "/var/lib/pingvin";
+        description = ''
+          The path to the data directory in which Pingvin Share will store its data.
+        '';
+      };
+
+      hostname = mkOption {
+        type = types.str;
+        default = "localhost:${toString cfg.backend.port}";
+        defaultText = lib.literalExpression "localhost:\${options.services.pingvin-share.backend.port}";
+        example = "pingvin-share.domain.tdl";
+        description = ''
+          The domain name of your instance. If null, the redirections will be made to localhost.
+        '';
+      };
+
+      https = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = ''
+          Whether to enable HTTPS for the domain.
+        '';
+      };
+
+      backend = {
+        package = mkPackageOption pkgs [
+          "pingvin-share"
+          "backend"
+        ] { };
+
+        port = mkOption {
+          type = types.port;
+          default = 8080;
+          example = 9000;
+          description = ''
+            The port that the backend service of Pingvin Share will listen to.
+          '';
+        };
+      };
+
+      frontend = {
+        package = mkPackageOption pkgs [
+          "pingvin-share"
+          "frontend"
+        ] { };
+
+        port = mkOption {
+          type = types.port;
+          default = 3000;
+          example = 8000;
+          description = ''
+            The port that the frontend service of Pingvin Share will listen to.
+          '';
+        };
+      };
+
+      nginx = {
+        enable = mkEnableOption "a Nginx reverse proxy for Pingvin Share.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    users.groups = mkIf (cfg.group == "pingvin") { pingvin = { }; };
+
+    users.users = mkIf (cfg.user == "pingvin") {
+      pingvin = {
+        group = cfg.group;
+        description = "Pingvin Share daemon user";
+        isSystemUser = true;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.frontend.port ];
+
+    systemd.services.pingvin-share-backend = {
+      description = "Backend service of Pingvin Share, a self-hosted file sharing platform.";
+
+      wantedBy = [
+        "multi-user.target"
+        "pingvin-share-frontend.service"
+      ];
+      before = [ "pingvin-share-frontend.service" ];
+      after = [
+        "network.target"
+        "network-online.target"
+      ];
+      wants = [ "network-online.target" ];
+
+      environment = {
+        PRISMA_SCHEMA_ENGINE_BINARY = "${pkgs.prisma-engines}/bin/schema-engine";
+        PRISMA_QUERY_ENGINE_BINARY = "${pkgs.prisma-engines}/bin/query-engine";
+        PRISMA_QUERY_ENGINE_LIBRARY = "${pkgs.prisma-engines}/lib/libquery_engine.node";
+        PRISMA_INTROSPECTION_ENGINE_BINARY = "${pkgs.prisma-engines}/bin/introspection-engine";
+        PRISMA_FMT_BINARY = "${pkgs.prisma-engines}/bin/prisma-fmt";
+        PORT = toString cfg.backend.port;
+        DATABASE_URL = "file:${cfg.dataDir}/pingvin-share.db?connection_limit=1";
+        DATA_DIRECTORY = cfg.dataDir;
+      };
+
+      path = with pkgs; [
+        cfg.backend.package
+        openssl
+        prisma-engines
+      ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        Type = "simple";
+        Restart = "on-failure";
+        ExecStartPre = [
+          "${cfg.backend.package}/node_modules/.bin/prisma migrate deploy"
+          "${cfg.backend.package}/node_modules/.bin/prisma db seed"
+        ];
+        ExecStart = "${cfg.backend.package}/node_modules/.bin/ts-node dist/src/main";
+        StateDirectory = mkIf (cfg.dataDir == "/var/lib/pingvin-share") "pingvin-share";
+        WorkingDirectory = cfg.backend.package;
+      };
+    };
+
+    systemd.services.pingvin-share-frontend = {
+      description = "Frontend service of Pingvin Share, a self-hosted file sharing platform.";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [
+        "network-online.target"
+        "pingvin-share-backend.service"
+      ];
+      after = [
+        "network-online.target"
+        "pingvin-share-backend.service"
+      ];
+
+      environment = {
+        PORT = toString cfg.frontend.port;
+        API_URL = "${if cfg.https then "https" else "http"}://${cfg.hostname}";
+      };
+      path = [ cfg.frontend.package ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        Type = "simple";
+        Restart = "on-failure";
+        ExecStart = "${cfg.frontend.package}/node_modules/.bin/next start";
+        StateDirectory = mkIf (cfg.dataDir == "/var/lib/pingvin-share") "pingvin-share";
+        WorkingDirectory = cfg.frontend.package;
+      };
+    };
+
+    services.nginx = mkIf cfg.nginx.enable {
+      enable = lib.mkDefault true;
+      virtualHosts."${cfg.hostname}" = {
+        enableACME = cfg.https;
+        forceSSL = cfg.https;
+
+        locations."/" = {
+          proxyPass = "http://localhost:${toString cfg.frontend.port}";
+          recommendedProxySettings = true;
+        };
+        locations."/api" = {
+          proxyPass = "http://localhost:${toString cfg.backend.port}";
+          recommendedProxySettings = true;
+        };
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ ratcornu ];
+    doc = ./pingvin-share.md;
+  };
+}
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 10f69f3a744a..a1aed8c4e917 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -143,6 +143,7 @@ let
           --transform 'flags=rSh;s|/nix/store/||' \
           --files-from ${hostPkgs.closureInfo { rootPaths = [ config.system.build.toplevel regInfo ]; }}/store-paths \
           | ${hostPkgs.erofs-utils}/bin/mkfs.erofs \
+            --quiet \
             --force-uid=0 \
             --force-gid=0 \
             -L ${nixStoreFilesystemLabel} \
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 83538fb3bc07..dfedc0ef552f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -771,6 +771,7 @@ in {
   php84 = handleTest ./php { php = pkgs.php84; };
   phylactery = handleTest ./web-apps/phylactery.nix {};
   pict-rs = handleTest ./pict-rs.nix {};
+  pingvin-share = handleTest ./pingvin-share.nix {} ;
   pinnwand = handleTest ./pinnwand.nix {};
   plantuml-server = handleTest ./plantuml-server.nix {};
   plasma-bigscreen = handleTest ./plasma-bigscreen.nix {};
diff --git a/nixos/tests/pingvin-share.nix b/nixos/tests/pingvin-share.nix
new file mode 100644
index 000000000000..5b1ec55add20
--- /dev/null
+++ b/nixos/tests/pingvin-share.nix
@@ -0,0 +1,26 @@
+import ./make-test-python.nix (
+  { lib, ... }:
+  {
+    name = "pingvin-share";
+    meta.maintainers = with lib.maintainers; [ ratcornu ];
+
+    nodes.machine =
+      { ... }:
+      {
+        services.pingvin-share = {
+          enable = true;
+
+          backend.port = 9010;
+          frontend.port = 9011;
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("pingvin-share-frontend.service")
+      machine.wait_for_open_port(9010)
+      machine.wait_for_open_port(9011)
+      machine.succeed("curl --fail http://127.0.0.1:9010/api/configs")
+      machine.succeed("curl --fail http://127.0.0.1:9011/")
+    '';
+  }
+)
diff --git a/pkgs/applications/emulators/86box/darwin.patch b/pkgs/applications/emulators/86box/darwin.patch
new file mode 100644
index 000000000000..b63649c19d12
--- /dev/null
+++ b/pkgs/applications/emulators/86box/darwin.patch
@@ -0,0 +1,15 @@
+diff --git a/src/qt/qt_platform.cpp b/src/qt/qt_platform.cpp
+index 824f71023..1f38e4b5f 100644
+--- a/src/qt/qt_platform.cpp
++++ b/src/qt/qt_platform.cpp
+@@ -673,6 +673,10 @@ plat_init_rom_paths(void)
+         rom_add_path(QDir(path).filePath("86Box/roms").toUtf8().constData());
+ #endif
+     }
++
++    #ifdef __APPLE__
++    rom_add_path("@out@/share/86Box/roms/");
++    #endif
+ }
+ 
+ void
diff --git a/pkgs/applications/emulators/86box/default.nix b/pkgs/applications/emulators/86box/default.nix
index 00f7290a49ca..5633eb64af5a 100644
--- a/pkgs/applications/emulators/86box/default.nix
+++ b/pkgs/applications/emulators/86box/default.nix
@@ -1,5 +1,6 @@
 {
   stdenv,
+  darwin,
   lib,
   fetchFromGitHub,
   cmake,
@@ -42,29 +43,43 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ioE0EVIXv/biXXvLqwhmtZ/RJM0nLqcE+i+CU+WXBY4=";
   };
 
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    makeWrapper
-    qt5.wrapQtAppsHook
-  ] ++ lib.optionals enableWayland [ extra-cmake-modules wayland-scanner ];
+  patches = [ ./darwin.patch ];
 
-  buildInputs = [
-    freetype
-    fluidsynth
-    SDL2
-    glib
-    openal
-    rtmidi
-    pcre2
-    jack2
-    libpcap
-    libslirp
-    qt5.qtbase
-    qt5.qttools
-  ] ++ lib.optional stdenv.isLinux alsa-lib
+  postPatch = ''
+    substituteAllInPlace src/qt/qt_platform.cpp
+  '';
+
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+      makeWrapper
+      qt5.wrapQtAppsHook
+    ]
+    ++ lib.optionals enableWayland [
+      extra-cmake-modules
+      wayland-scanner
+    ];
+
+  buildInputs =
+    [
+      freetype
+      fluidsynth
+      SDL2
+      glib
+      openal
+      rtmidi
+      pcre2
+      jack2
+      libpcap
+      libslirp
+      qt5.qtbase
+      qt5.qttools
+    ]
+    ++ lib.optional stdenv.isLinux alsa-lib
     ++ lib.optional enableWayland wayland
-    ++ lib.optional enableVncRenderer libvncserver;
+    ++ lib.optional enableVncRenderer libvncserver
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk_11_0.libs.xpc;
 
   cmakeFlags =
     lib.optional stdenv.isDarwin "-DCMAKE_MACOSX_BUNDLE=OFF"
@@ -108,12 +123,17 @@ stdenv.mkDerivation (finalAttrs: {
       makeWrapperArgs+=(--prefix ${libPathVar} : "${libPath}")
     '';
 
-  meta = with lib; {
+  meta = {
     description = "Emulator of x86-based machines based on PCem";
     mainProgram = "86Box";
     homepage = "https://86box.net/";
-    license = with licenses; [ gpl2Only ] ++ optional (unfreeEnableDiscord || unfreeEnableRoms) unfree;
-    maintainers = [ maintainers.jchw ];
-    platforms = platforms.linux;
+    license =
+      with lib.licenses;
+      [ gpl2Only ] ++ lib.optional (unfreeEnableDiscord || unfreeEnableRoms) unfree;
+    maintainers = with lib.maintainers; [
+      jchw
+      matteopacini
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/applications/misc/bambu-studio/orca-slicer.nix b/pkgs/applications/misc/bambu-studio/orca-slicer.nix
index 7428453a20cc..353252dfea17 100644
--- a/pkgs/applications/misc/bambu-studio/orca-slicer.nix
+++ b/pkgs/applications/misc/bambu-studio/orca-slicer.nix
@@ -2,7 +2,7 @@
   lib,
   fetchFromGitHub,
   bambu-studio,
-  opencv2,
+  opencv,
 }:
 bambu-studio.overrideAttrs (
   finalAttrs: previousAttrs: {
@@ -28,7 +28,7 @@ bambu-studio.overrideAttrs (
     buildInputs =
       previousAttrs.buildInputs
       ++ [
-        opencv2
+        opencv
       ];
 
     preFixup = ''
diff --git a/pkgs/applications/misc/gnome-secrets/default.nix b/pkgs/applications/misc/gnome-secrets/default.nix
index 046e296489b6..cdf030b6e723 100644
--- a/pkgs/applications/misc/gnome-secrets/default.nix
+++ b/pkgs/applications/misc/gnome-secrets/default.nix
@@ -17,7 +17,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gnome-secrets";
-  version = "8.0";
+  version = "9.6";
   format = "other";
 
   src = fetchFromGitLab {
@@ -25,7 +25,7 @@ python3Packages.buildPythonApplication rec {
     owner = "World";
     repo = "secrets";
     rev = version;
-    hash = "sha256-SEPQjl6hd8IBs0c0LBEYaqn2n8CGQmYSEMJp5yoL/PA=";
+    hash = "sha256-iF2AQYAwwIr/sCZUz1pdqEa74DH4y4Nts6aJj3mS2f4=";
   };
 
   nativeBuildInputs = [
@@ -49,9 +49,11 @@ python3Packages.buildPythonApplication rec {
   propagatedBuildInputs = with python3Packages; [
     pygobject3
     construct
+    pykcs11
     pykeepass
     pyotp
     validators
+    yubico
     zxcvbn
   ];
 
diff --git a/pkgs/applications/networking/cluster/gatekeeper/default.nix b/pkgs/applications/networking/cluster/gatekeeper/default.nix
index 604ee8d30010..559be08a5e89 100644
--- a/pkgs/applications/networking/cluster/gatekeeper/default.nix
+++ b/pkgs/applications/networking/cluster/gatekeeper/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gatekeeper";
-  version = "3.16.3";
+  version = "3.17.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "gatekeeper";
     rev = "v${version}";
-    hash = "sha256-G/ELuaUSlyeNcN6v1/xubF+VjvltdLKYmwlYWKzQiuw=";
+    hash = "sha256-33imFUFIonE5DTNwAKgJQd4jQ/lLap3LmVTqn9nxj98=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/science/math/mathematica/10.nix b/pkgs/applications/science/math/mathematica/10.nix
deleted file mode 100644
index e5ab259b8f70..000000000000
--- a/pkgs/applications/science/math/mathematica/10.nix
+++ /dev/null
@@ -1,132 +0,0 @@
-{ lib
-, patchelf
-, requireFile
-, stdenv
-# arguments from default.nix
-, lang
-, meta
-, name
-, src
-, version
-# dependencies
-, alsa-lib
-, coreutils
-, cudaPackages
-, fontconfig
-, freetype
-, gcc
-, glib
-, libuuid
-, libxml2
-, ncurses
-, opencv2
-, openssl
-, unixODBC
-, xorg
-# options
-, cudaSupport
-}:
-
-let
-  platform =
-    if stdenv.hostPlatform.system == "i686-linux" || stdenv.hostPlatform.system == "x86_64-linux" then
-      "Linux"
-    else
-      throw "Mathematica requires i686-linux or x86_64 linux";
-in
-stdenv.mkDerivation rec {
-  inherit meta src version;
-
-  pname = "mathematica";
-
-  buildInputs = [
-    coreutils
-    patchelf
-    alsa-lib
-    coreutils
-    fontconfig
-    freetype
-    gcc.cc
-    gcc.libc
-    glib
-    ncurses
-    opencv2
-    openssl
-    unixODBC
-    libxml2
-    libuuid
-  ] ++ (with xorg; [
-    libX11
-    libXext
-    libXtst
-    libXi
-    libXmu
-    libXrender
-    libxcb
-    libXcursor
-    libXfixes
-    libXrandr
-    libICE
-    libSM
-  ]);
-
-  ldpath = lib.makeLibraryPath buildInputs
-    + lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux")
-      (":" + lib.makeSearchPathOutput "lib" "lib64" buildInputs);
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  unpackPhase = ''
-    echo "=== Extracting makeself archive ==="
-    # find offset from file
-    offset=$(${stdenv.shell} -c "$(grep -axm1 -e 'offset=.*' $src); echo \$offset" $src)
-    dd if="$src" ibs=$offset skip=1 | tar -xf -
-    cd Unix
-  '';
-
-  installPhase = ''
-    cd Installer
-    # don't restrict PATH, that has already been done
-    sed -i -e 's/^PATH=/# PATH=/' MathInstaller
-
-    echo "=== Running MathInstaller ==="
-    ./MathInstaller -auto -createdir=y -execdir=$out/bin -targetdir=$out/libexec/Mathematica -platforms=${platform} -silent
-  '';
-
-  preFixup = ''
-    echo "=== PatchElfing away ==="
-    # This code should be a bit forgiving of errors, unfortunately
-    set +e
-    find $out/libexec/Mathematica/SystemFiles -type f -perm -0100 | while read f; do
-      type=$(readelf -h "$f" 2>/dev/null | grep 'Type:' | sed -e 's/ *Type: *\([A-Z]*\) (.*/\1/')
-      if [ -z "$type" ]; then
-        :
-      elif [ "$type" == "EXEC" ]; then
-        echo "patching $f executable <<"
-        patchelf --shrink-rpath "$f"
-        patchelf \
-    --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
-          "$f" \
-          && patchelf --shrink-rpath "$f" \
-          || echo unable to patch ... ignoring 1>&2
-      elif [ "$type" == "DYN" ]; then
-        echo "patching $f library <<"
-        patchelf \
-          --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
-          "$f" \
-          && patchelf --shrink-rpath "$f" \
-          || echo unable to patch ... ignoring 1>&2
-      else
-        echo "not patching $f <<: unknown elf type"
-      fi
-    done
-  '';
-
-  # all binaries are already stripped
-  dontStrip = true;
-
-  # we did this in prefixup already
-  dontPatchELF = true;
-}
diff --git a/pkgs/applications/science/math/mathematica/11.nix b/pkgs/applications/science/math/mathematica/11.nix
deleted file mode 100644
index 5b9460f76e06..000000000000
--- a/pkgs/applications/science/math/mathematica/11.nix
+++ /dev/null
@@ -1,146 +0,0 @@
-{ lib
-, patchelf
-, requireFile
-, stdenv
-# arguments from default.nix
-, lang
-, meta
-, name
-, src
-, version
-# dependencies
-, alsa-lib
-, coreutils
-, cudaPackages
-, dbus
-, fontconfig
-, freetype
-, gcc
-, glib
-, libGL
-, libGLU
-, libuuid
-, libxml2
-, ncurses
-, opencv2
-, openssl
-, unixODBC
-, xkeyboard_config
-, xorg
-, zlib
-# options
-, cudaSupport
-}:
-
-stdenv.mkDerivation rec {
-  inherit meta name src version;
-
-  buildInputs = [
-    coreutils
-    patchelf
-    alsa-lib
-    coreutils
-    dbus
-    fontconfig
-    freetype
-    gcc.cc
-    gcc.libc
-    glib
-    ncurses
-    opencv2
-    openssl
-    unixODBC
-    xkeyboard_config
-    libxml2
-    libuuid
-    zlib
-    libGL
-    libGLU
-  ] ++ (with xorg; [
-    libX11
-    libXext
-    libXtst
-    libXi
-    libXmu
-    libXrender
-    libxcb
-    libXcursor
-    libXfixes
-    libXrandr
-    libICE
-    libSM
-  ]);
-
-  ldpath = lib.makeLibraryPath buildInputs
-    + lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux")
-      (":" + lib.makeSearchPathOutput "lib" "lib64" buildInputs);
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  unpackPhase = ''
-    echo "=== Extracting makeself archive ==="
-    # find offset from file
-    offset=$(${stdenv.shell} -c "$(grep -axm1 -e 'offset=.*' $src); echo \$offset" $src)
-    dd if="$src" ibs=$offset skip=1 | tar -xf -
-    cd Unix
-  '';
-
-  installPhase = ''
-    cd Installer
-    # don't restrict PATH, that has already been done
-    sed -i -e 's/^PATH=/# PATH=/' MathInstaller
-    sed -i -e 's/\/bin\/bash/\/bin\/sh/' MathInstaller
-
-    echo "=== Running MathInstaller ==="
-    ./MathInstaller -auto -createdir=y -execdir=$out/bin -targetdir=$out/libexec/Mathematica -silent
-
-    # Fix library paths
-    cd $out/libexec/Mathematica/Executables
-    for path in mathematica MathKernel Mathematica WolframKernel wolfram math; do
-      sed -i -e 's#export LD_LIBRARY_PATH$#export LD_LIBRARY_PATH=${zlib}/lib:\''${LD_LIBRARY_PATH}#' $path
-    done
-
-    # Fix xkeyboard config path for Qt
-    for path in mathematica Mathematica; do
-      line=$(grep -n QT_PLUGIN_PATH $path | sed 's/:.*//')
-      sed -i -e "$line iexport QT_XKB_CONFIG_ROOT=\"${xkeyboard_config}/share/X11/xkb\"" $path
-    done
-  '';
-
-  preFixup = ''
-    echo "=== PatchElfing away ==="
-    # This code should be a bit forgiving of errors, unfortunately
-    set +e
-    find $out/libexec/Mathematica/SystemFiles -type f -perm -0100 | while read f; do
-      type=$(readelf -h "$f" 2>/dev/null | grep 'Type:' | sed -e 's/ *Type: *\([A-Z]*\) (.*/\1/')
-      if [ -z "$type" ]; then
-        :
-      elif [ "$type" == "EXEC" ]; then
-        echo "patching $f executable <<"
-        patchelf --shrink-rpath "$f"
-        patchelf \
-    --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
-          "$f" \
-          && patchelf --shrink-rpath "$f" \
-          || echo unable to patch ... ignoring 1>&2
-      elif [ "$type" == "DYN" ]; then
-        echo "patching $f library <<"
-        patchelf \
-          --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
-          "$f" \
-          && patchelf --shrink-rpath "$f" \
-          || echo unable to patch ... ignoring 1>&2
-      else
-        echo "not patching $f <<: unknown elf type"
-      fi
-    done
-  '';
-
-  # all binaries are already stripped
-  dontStrip = true;
-
-  # we did this in prefixup already
-  dontPatchELF = true;
-}
diff --git a/pkgs/applications/science/math/mathematica/9.nix b/pkgs/applications/science/math/mathematica/9.nix
deleted file mode 100644
index c2fc07c532fc..000000000000
--- a/pkgs/applications/science/math/mathematica/9.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{ lib
-, patchelf
-, requireFile
-, stdenv
-# arguments from default.nix
-, lang
-, meta
-, name
-, src
-, version
-# dependencies
-, alsa-lib
-, coreutils
-, cudaPackages
-, fontconfig
-, freetype
-, gcc
-, glib
-, ncurses
-, opencv2
-, openssl
-, unixODBC
-, xorg
-# options
-, cudaSupport
-}:
-
-let
-  platform =
-    if stdenv.hostPlatform.system == "i686-linux" || stdenv.hostPlatform.system == "x86_64-linux" then
-      "Linux"
-    else
-      throw "Mathematica requires i686-linux or x86_64 linux";
-in
-stdenv.mkDerivation rec {
-  inherit meta src version;
-  pname = "mathematica";
-
-  buildInputs = [
-    coreutils
-    patchelf
-    alsa-lib
-    coreutils
-    fontconfig
-    freetype
-    gcc.cc
-    gcc.libc
-    glib
-    ncurses
-    opencv2
-    openssl
-    unixODBC
-  ] ++ (with xorg; [
-    libX11
-    libXext
-    libXtst
-    libXi
-    libXmu
-    libXrender
-    libxcb
-  ]);
-
-  ldpath = lib.makeLibraryPath buildInputs
-    + lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux")
-    (":" + lib.makeSearchPathOutput "lib" "lib64" buildInputs);
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  unpackPhase = ''
-    echo "=== Extracting makeself archive ==="
-    # find offset from file
-    offset=$(${stdenv.shell} -c "$(grep -axm1 -e 'offset=.*' $src); echo \$offset" $src)
-    dd if="$src" ibs=$offset skip=1 | tar -xf -
-    cd Unix
-  '';
-
-  installPhase = ''
-    cd Installer
-    # don't restrict PATH, that has already been done
-    sed -i -e 's/^PATH=/# PATH=/' MathInstaller
-
-    echo "=== Running MathInstaller ==="
-    ./MathInstaller -auto -createdir=y -execdir=$out/bin -targetdir=$out/libexec/Mathematica -platforms=${platform} -silent
-  '';
-
-  preFixup = ''
-    echo "=== PatchElfing away ==="
-    find $out/libexec/Mathematica/SystemFiles -type f -perm -0100 | while read f; do
-      type=$(readelf -h "$f" 2>/dev/null | grep 'Type:' | sed -e 's/ *Type: *\([A-Z]*\) (.*/\1/')
-      if [ -z "$type" ]; then
-        :
-      elif [ "$type" == "EXEC" ]; then
-        echo "patching $f executable <<"
-        patchelf \
-            --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-            --set-rpath "${ldpath}" \
-            "$f"
-        patchelf --shrink-rpath "$f"
-      elif [ "$type" == "DYN" ]; then
-        echo "patching $f library <<"
-        patchelf \
-          --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
-          "$f" \
-          && patchelf --shrink-rpath "$f" \
-          || echo unable to patch ... ignoring 1>&2
-      else
-        echo "not patching $f <<: unknown elf type"
-      fi
-    done
-  '';
-
-  # all binaries are already stripped
-  dontStrip = true;
-
-  # we did this in prefixup already
-  dontPatchELF = true;
-}
diff --git a/pkgs/applications/science/math/mathematica/default.nix b/pkgs/applications/science/math/mathematica/default.nix
index c4cebcd8e29a..9e2552478765 100644
--- a/pkgs/applications/science/math/mathematica/default.nix
+++ b/pkgs/applications/science/math/mathematica/default.nix
@@ -44,12 +44,6 @@ let versions = callPackage ./versions.nix { };
                         else "and with local documentation"}")
       else lib.head matching-versions;
 
-    specific-drv = ./. + "/${lib.versions.major found-version.version}.nix";
-
-    real-drv = if lib.pathExists specific-drv
-               then specific-drv
-               else ./generic.nix;
-
     isMatching = v1: v2:
       let as      = lib.splitVersion v1;
           bs      = lib.splitVersion v2;
@@ -64,7 +58,7 @@ let versions = callPackage ./versions.nix { };
 
 in
 
-callPackage real-drv {
+callPackage ./generic.nix {
   inherit cudaSupport cudaPackages;
   inherit (found-version) version lang;
   src = if source == null then found-version.src else source;
diff --git a/pkgs/applications/science/math/mathematica/versions.nix b/pkgs/applications/science/math/mathematica/versions.nix
index 3bbf70433471..98e65d376b39 100644
--- a/pkgs/applications/science/math/mathematica/versions.nix
+++ b/pkgs/applications/science/math/mathematica/versions.nix
@@ -147,34 +147,6 @@ let versions = [
     sha256 = "sha256-uftx4a/MHXLCABlv+kNFEtII+ikg4geHhDP1BOWK6dc=";
     installer = "Mathematica_12.0.0_LINUX.sh";
   }
-  {
-    version = "11.3.0";
-    lang = "en";
-    language = "English";
-    sha256 = "sha256-D8/iCMHqyESOe+OvC9uENwsXvZxdBmwBOSjI7pWu0Q4=";
-    installer = "Mathematica_11.3.0_LINUX.sh";
-  }
-  {
-    version = "11.2.0";
-    lang = "ja";
-    language = "Japanese";
-    sha256 = "sha256-kWOS7dMr7YYiI430Nd2OhkJrsEMDijM28w3xDYGbSbE=";
-    installer = "Mathematica_11.2.0_ja_LINUX.sh";
-  }
-  {
-    version = "9.0.0";
-    lang = "en";
-    language = "English";
-    sha256 = "sha256-mKgxdd7dLWa5EOuR5C37SeU+UC9Cv5YTbY5xSK9y34A=";
-    installer = "Mathematica_9.0.0_LINUX.sh";
-  }
-  {
-    version = "10.0.2";
-    lang = "en";
-    language = "English";
-    sha256 = "sha256-NHUg1jzLos1EsIr8TdYdNaA5+3jEcFqVZIr9GVVUXrQ=";
-    installer = "Mathematica_10.0.2_LINUX.sh";
-  }
 ];
 
 in
diff --git a/pkgs/applications/science/math/wolfram-engine/default.nix b/pkgs/applications/science/math/wolfram-engine/default.nix
index 4ce49e6cad4c..c7a1b585379a 100644
--- a/pkgs/applications/science/math/wolfram-engine/default.nix
+++ b/pkgs/applications/science/math/wolfram-engine/default.nix
@@ -101,9 +101,9 @@ stdenv.mkDerivation rec {
     # Fix the installation script
     patchShebangs MathInstaller
     substituteInPlace MathInstaller \
-      --replace '`hostname`' "" \
-      --replace "chgrp" "# chgrp" \
-      --replace "chown" ": # chown"
+      --replace-fail '`hostname`' "" \
+      --replace-fail "chgrp" "# chgrp" \
+      --replace-fail "chown" ": # chown"
 
     # Install the desktop items
     export XDG_DATA_HOME="$out/share"
@@ -125,7 +125,7 @@ stdenv.mkDerivation rec {
       --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb"
     if ! isELF "$out/libexec/${dirName}/SystemFiles/FrontEnd/Binaries/Linux-x86-64/WolframPlayer"; then
       substituteInPlace $out/libexec/${dirName}/SystemFiles/FrontEnd/Binaries/Linux-x86-64/WolframPlayer \
-        --replace "TopDirectory=" "TopDirectory=$out/libexec/${dirName} #";
+        --replace-fail "TopDirectory=" "TopDirectory=$out/libexec/${dirName} #";
     fi
 
     for path in WolframPlayer wolframplayer; do
diff --git a/pkgs/applications/science/math/wolfram-engine/l10ns.nix b/pkgs/applications/science/math/wolfram-engine/l10ns.nix
index cfd296087d74..de9b677ab17a 100644
--- a/pkgs/applications/science/math/wolfram-engine/l10ns.nix
+++ b/pkgs/applications/science/math/wolfram-engine/l10ns.nix
@@ -7,6 +7,13 @@
 let allVersions = lib.flip map
   # N.B. Versions in this list should be ordered from newest to oldest.
   [
+    {
+      version = "14.1.0";
+      lang = "en";
+      language = "English";
+      sha256 = "1kxdvm3i7nn3ws784y972h2br1n0y82kkkjvz7c5llssv6d3pgj8";
+      installer = "WolframEngine_14.1.0_LIN.sh";
+    }
     {
       version = "13.3.0";
       lang = "en";
diff --git a/pkgs/applications/video/p2pvc/default.nix b/pkgs/applications/video/p2pvc/default.nix
deleted file mode 100644
index 703676b4615d..000000000000
--- a/pkgs/applications/video/p2pvc/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ lib, stdenv, pkg-config, fetchFromGitHub, opencv2, ncurses, portaudio }:
-
-stdenv.mkDerivation {
-  pname = "p2pvc";
-  version = "unstable-2015-02-12";
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ opencv2 ncurses portaudio ];
-
-  enableParallelBuilding = true;
-
-  installPhase = "mkdir -p $out/bin; cp p2pvc $out/bin/";
-
-  src = fetchFromGitHub {
-    owner = "mofarrell";
-    repo = "p2pvc";
-    rev = "d7b1c70288a7750fc8f9a22dbddbe51d34b5b9e5";
-    sha256 = "0d4vvrsjad5gk4rrjwgydn9ffj12jfb4aksw2px6jw75hp9pzmka";
-  };
-
-  meta = {
-    description = "Point to point color terminal video chat";
-    homepage = "https://github.com/mofarrell/p2pvc";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ trino ];
-    platforms = with lib.platforms; linux;
-    mainProgram = "p2pvc";
-  };
-}
diff --git a/pkgs/by-name/fo/foomatic-db/package.nix b/pkgs/by-name/fo/foomatic-db/package.nix
index 494216228a06..4f2a08952a4a 100644
--- a/pkgs/by-name/fo/foomatic-db/package.nix
+++ b/pkgs/by-name/fo/foomatic-db/package.nix
@@ -13,15 +13,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "foomatic-db";
-  version = "unstable-2024-05-04";
+  version = "unstable-2024-08-13";
 
   src = fetchFromGitHub {
     # there is also a daily snapshot at the `downloadPage`,
     # but it gets deleted quickly and would provoke 404 errors
     owner = "OpenPrinting";
     repo = "foomatic-db";
-    rev = "eaad4c0d2406d4cd38a6d15e5dc93d1bc8358c30";
-    hash = "sha256-A+Op1E16woNl/ppVj0QfdV4XgT1M8sbrpTXtdOz3PYk=";
+    rev = "359508733741039b65c86e7a1318a89862e03b13";
+    hash = "sha256-DSduuSC9XX2+fS2XOQ4/FrmBzOu7rgfNDeLzpcBplsY=";
   };
 
   buildInputs = [ cups cups-filters ghostscript gnused perl ];
diff --git a/pkgs/by-name/li/libiec61850/package.nix b/pkgs/by-name/li/libiec61850/package.nix
index ccbf571bba29..03c8037d6b33 100644
--- a/pkgs/by-name/li/libiec61850/package.nix
+++ b/pkgs/by-name/li/libiec61850/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libiec61850";
-  version = "1.5.3";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "mz-automation";
     repo = "libiec61850";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SwJjjSapNaVOH5g46MiS9BkzI0fKm/P1xYug3OX5XbA=";
+    hash = "sha256-KFUqeDe90wrqMueD8AYgB1scl6OZkKW2z+oV9wREF3k=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/li/linux-wallpaperengine/package.nix b/pkgs/by-name/li/linux-wallpaperengine/package.nix
deleted file mode 100644
index 0ec85d195db7..000000000000
--- a/pkgs/by-name/li/linux-wallpaperengine/package.nix
+++ /dev/null
@@ -1,76 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, ffmpeg
-, libglut
-, freeimage
-, glew
-, glfw
-, glm
-, libGL
-, libpulseaudio
-, libX11
-, libXau
-, libXdmcp
-, libXext
-, libXpm
-, libXrandr
-, libXxf86vm
-, lz4
-, mpv
-, pkg-config
-, SDL2
-, SDL2_mixer
-, zlib
-}:
-
-stdenv.mkDerivation {
-  pname = "linux-wallpaperengine";
-  version = "unstable-2023-09-23";
-
-  src = fetchFromGitHub {
-    owner = "Almamu";
-    repo = "linux-wallpaperengine";
-    # upstream lacks versioned releases
-    rev = "21c38d9fd1d3d89376c870cec5c5e5dc7086bc3c";
-    hash = "sha256-bZlMHlNKSydh9eGm5cFSEtv/RV9sA5ABs99uurblBZY=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
-
-  buildInputs = [
-    ffmpeg
-    libglut
-    freeimage
-    glew
-    glfw
-    glm
-    libGL
-    libpulseaudio
-    libX11
-    libXau
-    libXdmcp
-    libXext
-    libXrandr
-    libXpm
-    libXxf86vm
-    mpv
-    lz4
-    SDL2
-    SDL2_mixer.all
-    zlib
-  ];
-
-  meta = {
-    description = "Wallpaper Engine backgrounds for Linux";
-    homepage = "https://github.com/Almamu/linux-wallpaperengine";
-    license = lib.licenses.gpl3Only;
-    mainProgram = "linux-wallpaperengine";
-    maintainers = with lib.maintainers; [ eclairevoyant ];
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/ma/mailsy/package.nix b/pkgs/by-name/ma/mailsy/package.nix
new file mode 100644
index 000000000000..7bda524ab227
--- /dev/null
+++ b/pkgs/by-name/ma/mailsy/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+buildNpmPackage rec {
+  pname = "mailsy";
+  version = "5.0.0";
+
+  src = fetchFromGitHub {
+    owner = "BalliAsghar";
+    repo = "Mailsy";
+    rev = version;
+    hash = "sha256-RnOWvu023SOcN83xEEkYFwgDasOmkMwSzJ/QYjvTBDo=";
+  };
+
+  npmDepsHash = "sha256-ljmqNmLvRHPdsKyOdDfECBXHTIExM6nPZF45lqV+pDM=";
+
+  npmFlags = [ "--legacy-peer-deps" ];
+
+  dontNpmBuild = true;
+
+  postPatch = ''
+    substituteInPlace utils/index.js \
+    --replace-fail 'dirname, "../data/account.json"' 'process.cwd(), "account.json"' \
+    --replace-fail 'dirname, "../data/email.html"' 'process.cwd(), "email.html"'
+  '';
+
+  meta = {
+    description = "Quickly generate a disposable email straight from terminal";
+    mainProgram = "mailsy";
+    homepage = "https://fig.io/manual/mailsy";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers._404wolf ];
+  };
+}
diff --git a/pkgs/servers/mesos-dns/default.nix b/pkgs/by-name/me/mesos-dns/package.nix
similarity index 79%
rename from pkgs/servers/mesos-dns/default.nix
rename to pkgs/by-name/me/mesos-dns/package.nix
index 1760a41777df..52f6ba74fd89 100644
--- a/pkgs/servers/mesos-dns/default.nix
+++ b/pkgs/by-name/me/mesos-dns/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mesos-dns";
-  version = "0.9.0";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "m3scluster";
     repo = "mesos-dns";
     rev = "v${version}";
-    hash = "sha256-lURD0WAHC4klRdV6/YhKNtXh03zcVuDzTj/LvKYomLk=";
+    hash = "sha256-6uuaSCPBY+mKfU2Xku9M1oF5jwxogR2Rki4AIdsjLr0=";
   };
 
-  vendorHash = "sha256-OILARWv9CDQEzzn7He/P8Z2Ug7m05AqOndoeM1sUpII=";
+  vendorHash = "sha256-k47kxdkwhf9b8DdvWzwhj12ebvPYezxyIJ8w1Zn+Xew=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 4c0f0becdea5..ab25f18fff90 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -7,19 +7,19 @@
 }:
 let
   pname = "open-webui";
-  version = "0.3.14";
+  version = "0.3.15";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     rev = "v${version}";
-    hash = "sha256-9qVAed+NvQrAmelaL0wzN7ReFdPKQU+U7mX5XfouHSA=";
+    hash = "sha256-e326Dxuu9cdpPV/T4arDSBqT1agnXdV5ysrIRyhF8ws=";
   };
 
   frontend = buildNpmPackage {
     inherit pname version src;
 
-    npmDepsHash = "sha256-exC+fyut0mmqq/30/bmKqgBS8DT/mLc2lXbO8vTg668=";
+    npmDepsHash = "sha256-exkFrKBwTtN18pPNcFG1fYBoWASHsnCHYYVWkCFd0z0=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.
diff --git a/pkgs/by-name/pr/proton-pass/package.nix b/pkgs/by-name/pr/proton-pass/package.nix
index 58d26335599a..66aa1c255a49 100644
--- a/pkgs/by-name/pr/proton-pass/package.nix
+++ b/pkgs/by-name/pr/proton-pass/package.nix
@@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-pass";
-  version = "1.20.2";
+  version = "1.22.0";
 
   src = fetchurl {
     url = "https://proton.me/download/PassDesktop/linux/x64/ProtonPass_${finalAttrs.version}.deb";
-    hash = "sha256-4QSBKVnEH7yDXwqY+29/a+yWv89i/TVCYO26V95KA4s=";
+    hash = "sha256-ARIUHmU/YN8IoAFMkcxzGAoH31vbJLT7HfYD6a57QaY=";
   };
 
   dontConfigure = true;
@@ -44,7 +44,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Desktop application for Proton Pass";
     homepage = "https://proton.me/pass";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ massimogengarelli sebtm ];
+    maintainers = with lib.maintainers; [
+      luftmensch-luftmensch
+      massimogengarelli
+      sebtm
+    ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     mainProgram = "proton-pass";
diff --git a/pkgs/by-name/re/renovate/package.nix b/pkgs/by-name/re/renovate/package.nix
index 9c9e43c39794..181734d93674 100644
--- a/pkgs/by-name/re/renovate/package.nix
+++ b/pkgs/by-name/re/renovate/package.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "renovate";
-  version = "38.27.0";
+  version = "38.46.2";
 
   src = fetchFromGitHub {
     owner = "renovatebot";
     repo = "renovate";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-wVL7Ke38sweVDr2krUukIToBw/VXDucH+3axIsdD3DM=";
+    hash = "sha256-fy4hWBhaYpfcrxdEuBqb/f7wG3TeLtte8OfjQ9Eoejo=";
   };
 
   postPatch = ''
@@ -44,7 +44,7 @@ stdenv'.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-/HeKabcA7y4dCVtslIRcon0oAaai6JvR8nFkGZtO2vg=";
+    hash = "sha256-UZuCBDveEumGgfx9h7RoBbTtkrpiyOcBnIQmpbsjc2g=";
   };
 
   env.COREPACK_ENABLE_STRICT = 0;
diff --git a/pkgs/development/compilers/mlkit/default.nix b/pkgs/development/compilers/mlkit/default.nix
index 5dbc219303a0..c4dfa85b70c1 100644
--- a/pkgs/development/compilers/mlkit/default.nix
+++ b/pkgs/development/compilers/mlkit/default.nix
@@ -15,6 +15,17 @@ stdenv.mkDerivation rec {
 
   buildFlags = [ "mlkit" "mlkit_libs" ];
 
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+    echo ==== Running MLKit test suite: test ====
+    make -C test_dev test
+    echo ==== Running MLKit test suite: test_prof ====
+    make -C test_dev test_prof
+    runHook postCheck
+  '';
+
   meta = with lib; {
     description = "Standard ML Compiler and Toolkit";
     homepage = "https://elsman.com/mlkit/";
diff --git a/pkgs/development/coq-modules/atbr/default.nix b/pkgs/development/coq-modules/atbr/default.nix
new file mode 100644
index 000000000000..e1a77312eefa
--- /dev/null
+++ b/pkgs/development/coq-modules/atbr/default.nix
@@ -0,0 +1,21 @@
+{ lib, mkCoqDerivation, coq, version ? null }:
+
+mkCoqDerivation {
+  pname = "atbr";
+  inherit version;
+  defaultVersion = let inherit (lib.versions) range; in
+    lib.switch coq.coq-version [
+      { case = range "8.20" "8.20"; out = "8.20.0"; }
+    ] null;
+  release = {
+    "8.20.0".sha256  = "sha256-Okhtq6Gnq4HA3tEZJvf8JBnmk3OKdm6hC1qINmoShmo=";
+  };
+  releaseRev = v: "v${v}";
+
+  mlPlugin = true;
+
+  meta = {
+    description = "Coq library and tactic for deciding Kleene algebras";
+    license = lib.licenses.lgpl3Plus;
+  };
+}
diff --git a/pkgs/development/libraries/gvm-libs/default.nix b/pkgs/development/libraries/gvm-libs/default.nix
index e8cae3fa727b..a6d2c884f8a7 100644
--- a/pkgs/development/libraries/gvm-libs/default.nix
+++ b/pkgs/development/libraries/gvm-libs/default.nix
@@ -25,15 +25,19 @@
 
 stdenv.mkDerivation rec {
   pname = "gvm-libs";
-  version = "22.8.0";
+  version = "22.10.0";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "gvm-libs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nFqYpt9OWEPgSbaNsHLhs9mg7ChQcmfcgHh7nFfQh18=";
+    hash = "sha256-o86bNwoGUw6VLESkaamWXPOfrdbFipJZmQCL6W5+nfk=";
   };
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail "-Werror" ""
+  '';
+
   nativeBuildInputs = [
     cmake
     doxygen
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
deleted file mode 100644
index 01479f31116e..000000000000
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ /dev/null
@@ -1,304 +0,0 @@
-{ lib, stdenv
-, fetchFromGitHub
-, callPackage
-, cmake, pkg-config, unzip, zlib, pcre, hdf5
-, glog, boost, gflags, protobuf_21
-, config
-
-, enableJPEG      ? true, libjpeg
-, enablePNG       ? true, libpng
-, enableTIFF      ? true, libtiff
-, enableWebP      ? true, libwebp
-, enableEXR ?     !stdenv.isDarwin, openexr_3
-, enableEigen     ? true, eigen
-, enableOpenblas  ? true, openblas, blas, lapack
-, enableContrib   ? true
-
-, enableCuda      ? config.cudaSupport
-, cudaPackages
-, enableUnfree    ? false
-, enableIpp       ? false
-, enablePython    ? false, pythonPackages ? null
-, enableGtk2      ? false, gtk2
-, enableGtk3      ? false, gtk3
-, enableFfmpeg    ? false, ffmpeg
-, enableGStreamer ? false, gst_all_1
-, enableTesseract ? false, tesseract, leptonica
-, enableTbb       ? false, tbb
-, enableOvis      ? false, ogre
-, enableGPhoto2   ? false, libgphoto2
-, enableDC1394    ? false, libdc1394
-, enableDocs      ? false, doxygen, graphviz-nox
-
-, AVFoundation, Cocoa, VideoDecodeAcceleration, bzip2, CoreMedia, MediaToolbox, Accelerate
-}:
-
-assert blas.implementation == "openblas" && lapack.implementation == "openblas";
-
-assert enablePython -> pythonPackages != null;
-
-let
-  inherit (cudaPackages) backendStdenv cudatoolkit;
-  inherit (cudaPackages.cudaFlags) cudaCapabilities;
-
-  version = "3.4.18";
-
-  src = fetchFromGitHub {
-    owner  = "opencv";
-    repo   = "opencv";
-    rev    = version;
-    hash   = "sha256-PgwAZNoPknFT0jCLt3TCzend6OYFY3iUIzDf/FptAYA=";
-  };
-
-  contribSrc = fetchFromGitHub {
-    owner  = "opencv";
-    repo   = "opencv_contrib";
-    rev    = version;
-    hash   = "sha256-TEF/GHglOmsshlC6q4iw14ZMpvA0SaKwlidomAN+sRc=";
-  };
-
-  # Contrib must be built in order to enable Tesseract support:
-  buildContrib = enableContrib || enableTesseract;
-
-  useSystemProtobuf = ! stdenv.isDarwin;
-
-  # See opencv/3rdparty/ippicv/ippicv.cmake
-  ippicv = {
-    src = fetchFromGitHub {
-      owner  = "opencv";
-      repo   = "opencv_3rdparty";
-      rev    = "32e315a5b106a7b89dbed51c28f8120a48b368b4";
-      sha256 = "19w9f0r16072s59diqxsr5q6nmwyz9gnxjs49nglzhd66p3ddbkp";
-    } + "/ippicv";
-    files = let name = platform : "ippicv_2019_${platform}_general_20180723.tgz"; in
-      if stdenv.hostPlatform.system == "x86_64-linux" then
-      { ${name "lnx_intel64"} = "c0bd78adb4156bbf552c1dfe90599607"; }
-      else if stdenv.hostPlatform.system == "i686-linux" then
-      { ${name "lnx_ia32"}    = "4f38432c30bfd6423164b7a24bbc98a0"; }
-      else if stdenv.hostPlatform.system == "x86_64-darwin" then
-      { ${name "mac_intel64"} = "fe6b2bb75ae0e3f19ad3ae1a31dfa4a2"; }
-      else
-      throw "ICV is not available for this platform (or not yet supported by this package)";
-    dst = ".cache/ippicv";
-  };
-
-  # See opencv_contrib/modules/xfeatures2d/cmake/download_vgg.cmake
-  vgg = {
-    src = fetchFromGitHub {
-      owner  = "opencv";
-      repo   = "opencv_3rdparty";
-      rev    = "fccf7cd6a4b12079f73bbfb21745f9babcd4eb1d";
-      sha256 = "0r9fam8dplyqqsd3qgpnnfgf9l7lj44di19rxwbm8mxiw0rlcdvy";
-    };
-    files = {
-      "vgg_generated_48.i"  = "e8d0dcd54d1bcfdc29203d011a797179";
-      "vgg_generated_64.i"  = "7126a5d9a8884ebca5aea5d63d677225";
-      "vgg_generated_80.i"  = "7cd47228edec52b6d82f46511af325c5";
-      "vgg_generated_120.i" = "151805e03568c9f490a5e3a872777b75";
-    };
-    dst = ".cache/xfeatures2d/vgg";
-  };
-
-  # See opencv_contrib/modules/xfeatures2d/cmake/download_boostdesc.cmake
-  boostdesc = {
-    src = fetchFromGitHub {
-      owner  = "opencv";
-      repo   = "opencv_3rdparty";
-      rev    = "34e4206aef44d50e6bbcd0ab06354b52e7466d26";
-      sha256 = "13yig1xhvgghvxspxmdidss5lqiikpjr0ddm83jsi0k85j92sn62";
-    };
-    files = {
-      "boostdesc_bgm.i"          = "0ea90e7a8f3f7876d450e4149c97c74f";
-      "boostdesc_bgm_bi.i"       = "232c966b13651bd0e46a1497b0852191";
-      "boostdesc_bgm_hd.i"       = "324426a24fa56ad9c5b8e3e0b3e5303e";
-      "boostdesc_binboost_064.i" = "202e1b3e9fec871b04da31f7f016679f";
-      "boostdesc_binboost_128.i" = "98ea99d399965c03d555cef3ea502a0b";
-      "boostdesc_binboost_256.i" = "e6dcfa9f647779eb1ce446a8d759b6ea";
-      "boostdesc_lbgm.i"         = "0ae0675534aa318d9668f2a179c2a052";
-    };
-    dst = ".cache/xfeatures2d/boostdesc";
-  };
-
-  # See opencv_contrib/modules/face/CMakeLists.txt
-  face = {
-    src = fetchFromGitHub {
-      owner  = "opencv";
-      repo   = "opencv_3rdparty";
-      rev    = "8afa57abc8229d611c4937165d20e2a2d9fc5a12";
-      sha256 = "061lsvqdidq9xa2hwrcvwi9ixflr2c2lfpc8drr159g68zi8bp4v";
-    };
-    files = {
-      "face_landmark_model.dat" = "7505c44ca4eb54b4ab1e4777cb96ac05";
-    };
-    dst = ".cache/data";
-  };
-
-  # See opencv/cmake/OpenCVDownload.cmake
-  installExtraFiles = extra : ''
-    mkdir -p "${extra.dst}"
-  '' + lib.concatStrings (lib.mapAttrsToList (name : md5 : ''
-    ln -s "${extra.src}/${name}" "${extra.dst}/${md5}-${name}"
-  '') extra.files);
-
-  opencvFlag = name: enabled: "-DWITH_${name}=${printEnabled enabled}";
-
-  printEnabled = enabled : if enabled then "ON" else "OFF";
-in
-
-stdenv.mkDerivation {
-  pname = "opencv";
-  inherit version src;
-
-  postUnpack = lib.optionalString buildContrib ''
-    cp --no-preserve=mode -r "${contribSrc}/modules" "$NIX_BUILD_TOP/opencv_contrib"
-  '';
-
-  # Ensures that we use the system OpenEXR rather than the vendored copy of the source included with OpenCV.
-  patches = [
-    ./cmake-don-t-use-OpenCVFindOpenEXR.patch
-  ];
-
-  # This prevents cmake from using libraries in impure paths (which
-  # causes build failure on non NixOS)
-  # Also, work around https://github.com/NixOS/nixpkgs/issues/26304 with
-  # what appears to be some stray headers in dnn/misc/tensorflow
-  # in contrib when generating the Python bindings:
-  postPatch = ''
-    sed -i '/Add these standard paths to the search paths for FIND_LIBRARY/,/^\s*$/{d}' CMakeLists.txt
-    sed -i -e 's|if len(decls) == 0:|if len(decls) == 0 or "opencv2/" not in hdr:|' ./modules/python/src2/gen2.py
-  '';
-
-  preConfigure =
-    lib.optionalString enableIpp (installExtraFiles ippicv) + (
-    lib.optionalString buildContrib ''
-      cmakeFlagsArray+=("-DOPENCV_EXTRA_MODULES_PATH=$NIX_BUILD_TOP/opencv_contrib")
-
-      ${installExtraFiles vgg}
-      ${installExtraFiles boostdesc}
-      ${installExtraFiles face}
-    '');
-
-  postConfigure = ''
-    [ -e modules/core/version_string.inc ]
-    echo '"(build info elided)"' > modules/core/version_string.inc
-  '';
-
-  buildInputs =
-       [ zlib pcre hdf5 glog boost gflags ]
-    ++ lib.optional useSystemProtobuf protobuf_21
-    ++ lib.optional enablePython pythonPackages.python
-    ++ lib.optional enableGtk2 gtk2
-    ++ lib.optional enableGtk3 gtk3
-    ++ lib.optional enableJPEG libjpeg
-    ++ lib.optional enablePNG libpng
-    ++ lib.optional enableTIFF libtiff
-    ++ lib.optional enableWebP libwebp
-    ++ lib.optionals enableEXR [ openexr_3 ]
-    ++ lib.optional enableFfmpeg ffmpeg
-    ++ lib.optionals (enableFfmpeg && stdenv.isDarwin)
-                     [ VideoDecodeAcceleration bzip2 ]
-    ++ lib.optionals enableGStreamer [ gst_all_1.gstreamer gst_all_1.gst-plugins-base ]
-    ++ lib.optional enableOvis ogre
-    ++ lib.optional enableGPhoto2 libgphoto2
-    ++ lib.optional enableDC1394 libdc1394
-    ++ lib.optional enableEigen eigen
-    ++ lib.optional enableOpenblas openblas
-    # There is seemingly no compile-time flag for Tesseract.  It's
-    # simply enabled automatically if contrib is built, and it detects
-    # tesseract & leptonica.
-    ++ lib.optionals enableTesseract [ tesseract leptonica ]
-    ++ lib.optional enableTbb tbb
-    ++ lib.optionals stdenv.isDarwin [
-      bzip2 AVFoundation Cocoa VideoDecodeAcceleration CoreMedia MediaToolbox Accelerate
-    ]
-    ++ lib.optionals enableDocs [ doxygen graphviz-nox ];
-
-  propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy
-    ++ lib.optional enableCuda cudatoolkit;
-
-  nativeBuildInputs = [ cmake pkg-config unzip ];
-
-  # Configure can't find the library without this.
-  OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
-
-  cmakeFlags = [
-    "-DWITH_OPENMP=ON"
-    "-DBUILD_PROTOBUF=${printEnabled (!useSystemProtobuf)}"
-    "-DPROTOBUF_UPDATE_FILES=${printEnabled useSystemProtobuf}"
-    "-DOPENCV_ENABLE_NONFREE=${printEnabled enableUnfree}"
-    "-DBUILD_TESTS=OFF"
-    "-DBUILD_PERF_TESTS=OFF"
-    "-DBUILD_DOCS=${printEnabled enableDocs}"
-    (opencvFlag "IPP" enableIpp)
-    (opencvFlag "TIFF" enableTIFF)
-    (opencvFlag "WEBP" enableWebP)
-    (opencvFlag "JPEG" enableJPEG)
-    (opencvFlag "PNG" enablePNG)
-    (opencvFlag "OPENEXR" enableEXR)
-    (opencvFlag "CUDA" enableCuda)
-    (opencvFlag "CUBLAS" enableCuda)
-    (opencvFlag "TBB" enableTbb)
-  ] ++ lib.optionals enableCuda [
-    "-DCUDA_FAST_MATH=ON"
-    "-DCUDA_HOST_COMPILER=${backendStdenv.cc}/bin/cc"
-    "-DCUDA_NVCC_FLAGS=--expt-relaxed-constexpr"
-    "-DCUDA_ARCH_BIN=${lib.concatStringsSep ";" cudaCapabilities}"
-    "-DCUDA_ARCH_PTX=${lib.last cudaCapabilities}"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-DWITH_OPENCL=OFF"
-    "-DWITH_LAPACK=OFF"
-
-    # Disable unnecessary vendoring that's enabled by default only for Darwin.
-    # Note that the opencvFlag feature flags listed above still take
-    # precedence, so we can safely list everything here.
-    "-DBUILD_ZLIB=OFF"
-    "-DBUILD_TIFF=OFF"
-    "-DBUILD_JASPER=OFF"
-    "-DBUILD_JPEG=OFF"
-    "-DBUILD_PNG=OFF"
-    "-DBUILD_WEBP=OFF"
-  ] ++ lib.optionals enablePython [
-    "-DOPENCV_SKIP_PYTHON_LOADER=ON"
-  ] ++ lib.optionals enableEigen [
-    # Autodetection broken by https://github.com/opencv/opencv/pull/13337
-    "-DEIGEN_INCLUDE_PATH=${eigen}/include/eigen3"
-  ];
-
-  postBuild = lib.optionalString enableDocs ''
-    make doxygen
-  '';
-
-  # By default $out/lib/pkgconfig/opencv.pc looks something like this:
-  #
-  #   prefix=/nix/store/10pzq1a8fkh8q4sysj8n6mv0w0nl0miq-opencv-3.4.1
-  #   exec_prefix=${prefix}
-  #   libdir=${exec_prefix}//nix/store/10pzq1a8fkh8q4sysj8n6mv0w0nl0miq-opencv-3.4.1/lib
-  #   ...
-  #   Libs: -L${exec_prefix}//nix/store/10pzq1a8fkh8q4sysj8n6mv0w0nl0miq-opencv-3.4.1/lib ...
-  #
-  # Note that ${exec_prefix} is set to $out but that $out is also appended to
-  # ${exec_prefix}. This causes linker errors in downstream packages so we strip
-  # of $out after the ${exec_prefix} prefix:
-  postInstall = ''
-    sed -i "s|{exec_prefix}/$out|{exec_prefix}|" \
-      "$out/lib/pkgconfig/opencv.pc"
-  '';
-
-  hardeningDisable = [ "bindnow" "relro" ];
-
-  passthru = lib.optionalAttrs enablePython { pythonPath = []; } // {
-    tests = lib.optionalAttrs enableCuda {
-      no-libstdcxx-errors = callPackage ./libstdcxx-test.nix { attrName = "opencv3"; };
-    };
-  };
-
-  meta = {
-    description = "Open Computer Vision Library with more than 500 algorithms";
-    homepage = "https://opencv.org/";
-    # OpenCV 3 won't build with CUDA 12+
-    broken = enableCuda && cudaPackages.cudaAtLeast "12";
-    license = if enableUnfree then lib.licenses.unfree else lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [mdaiter basvandijk];
-    platforms = with lib.platforms; linux ++ darwin;
-  };
-}
diff --git a/pkgs/development/libraries/opencv/default.nix b/pkgs/development/libraries/opencv/default.nix
deleted file mode 100644
index d59e6a6342d7..000000000000
--- a/pkgs/development/libraries/opencv/default.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, unzip
-, zlib
-, enableGtk2 ? false, gtk2
-, enableJPEG ? true, libjpeg
-, enablePNG ? true, libpng
-, enableTIFF ? true, libtiff
-, enableEXR ? (!stdenv.isDarwin), openexr, ilmbase
-, enableFfmpeg ? false, ffmpeg
-, enableGStreamer ? false, gst_all_1
-, enableEigen ? true, eigen
-, enableUnfree ? false
-, AVFoundation, Cocoa, QTKit, Accelerate
-}:
-
-let
-  opencvFlag = name: enabled: "-DWITH_${name}=${if enabled then "ON" else "OFF"}";
-
-in
-
-stdenv.mkDerivation rec {
-  pname = "opencv";
-  version = "2.4.13.7";
-
-  src = fetchFromGitHub {
-    owner = "opencv";
-    repo = "opencv";
-    rev = version;
-    sha256 = "062js7zhh4ixi2wk61wyi23qp9zsk5vw24iz2i5fab2hp97y5zq3";
-  };
-
-  patches =
-    [ # Don't include a copy of the CMake status output in the
-      # build. This causes a runtime dependency on GCC.
-      ./no-build-info.patch
-    ];
-
-  # This prevents cmake from using libraries in impure paths (which causes build failure on non NixOS)
-  postPatch = ''
-    sed -i '/Add these standard paths to the search paths for FIND_LIBRARY/,/^\s*$/{d}' CMakeLists.txt
-  '';
-
-  outputs = [ "out" "dev" ];
-
-  buildInputs =
-       [ zlib ]
-    ++ lib.optional enableGtk2 gtk2
-    ++ lib.optional enableJPEG libjpeg
-    ++ lib.optional enablePNG libpng
-    ++ lib.optional enableTIFF libtiff
-    ++ lib.optionals enableEXR [ openexr ilmbase ]
-    ++ lib.optional enableFfmpeg ffmpeg
-    ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base ])
-    ++ lib.optional enableEigen eigen
-    ++ lib.optionals stdenv.isDarwin [ AVFoundation Cocoa QTKit Accelerate ]
-    ;
-
-  nativeBuildInputs = [ cmake pkg-config unzip ];
-
-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++14";
-
-  env.NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";
-
-  cmakeFlags = [
-    (opencvFlag "TIFF" enableTIFF)
-    (opencvFlag "JPEG" enableJPEG)
-    (opencvFlag "PNG" enablePNG)
-    (opencvFlag "OPENEXR" enableEXR)
-    (opencvFlag "GSTREAMER" enableGStreamer)
-  ] ++ lib.optional (!enableUnfree) "-DBUILD_opencv_nonfree=OFF";
-
-  hardeningDisable = [ "bindnow" "relro" ];
-
-  # Fix pkg-config file that gets broken with multiple outputs
-  postFixup = ''
-    sed -i $dev/lib/pkgconfig/opencv.pc -e "s|includedir_old=.*|includedir_old=$dev/include/opencv|"
-    sed -i $dev/lib/pkgconfig/opencv.pc -e "s|includedir_new=.*|includedir_new=$dev/include|"
-  '';
-
-  meta = with lib; {
-    description = "Open Computer Vision Library with more than 500 algorithms";
-    homepage = "https://opencv.org/";
-    license = if enableUnfree then licenses.unfree else licenses.bsd3;
-    maintainers = [ ];
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/development/libraries/opencv/no-build-info.patch b/pkgs/development/libraries/opencv/no-build-info.patch
deleted file mode 100644
index 4ee9701583a0..000000000000
--- a/pkgs/development/libraries/opencv/no-build-info.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff -ru -x '*~' opencv-2.4.13-orig/modules/core/src/system.cpp opencv-2.4.13/modules/core/src/system.cpp
---- opencv-2.4.13-orig/modules/core/src/system.cpp	1970-01-01 01:00:01.000000000 +0100
-+++ opencv-2.4.13/modules/core/src/system.cpp	2016-10-02 18:44:53.674181762 +0200
-@@ -442,9 +442,7 @@
- 
- const std::string& getBuildInformation()
- {
--    static std::string build_info =
--#include "version_string.inc"
--    ;
-+    static std::string build_info = "(build info elided)";
-     return build_info;
- }
- 
diff --git a/pkgs/development/libraries/science/biology/elastix/default.nix b/pkgs/development/libraries/science/biology/elastix/default.nix
index 0344559f8a8f..44e76244c987 100644
--- a/pkgs/development/libraries/science/biology/elastix/default.nix
+++ b/pkgs/development/libraries/science/biology/elastix/default.nix
@@ -1,26 +1,35 @@
-{ lib, stdenv, fetchFromGitHub, cmake, itk, Cocoa }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  itk,
+  Cocoa,
+}:
 
-stdenv.mkDerivation rec {
-  pname    = "elastix";
-  version = "5.1.0";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "elastix";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "SuperElastix";
-    repo = pname;
-    rev = version;
-    hash = "sha256-wFeLU8IwiF43a9TAvecQG+QMw88PQZdJ8sI1Zz3ZeXc=";
+    repo = "elastix";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-edUMj8sjku8EVYaktteIDS+ouaN3kg+CXQCeSWKlLDI=";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ itk ] ++ lib.optionals stdenv.isDarwin [ Cocoa ];
 
-  doCheck = !stdenv.isDarwin;  # usual dynamic linker issues
+  doCheck = !stdenv.isDarwin; # usual dynamic linker issues
 
   meta = with lib; {
     homepage = "https://elastix.lumc.nl";
     description = "Image registration toolkit based on ITK";
+    changelog = "https://github.com/SuperElastix/elastix/releases/tag/${finalAttrs.version}";
     maintainers = with maintainers; [ bcdarwin ];
-    platforms = platforms.x86_64;  # libitkpng linker issues with ITK 5.1
+    mainProgram = "elastix";
+    platforms = platforms.x86_64; # libitkpng linker issues with ITK 5.1
     license = licenses.asl20;
   };
-}
+})
diff --git a/pkgs/development/libraries/simpleitk/default.nix b/pkgs/development/libraries/simpleitk/default.nix
index 10e055d5acde..fbdfd20441d9 100644
--- a/pkgs/development/libraries/simpleitk/default.nix
+++ b/pkgs/development/libraries/simpleitk/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "simpleitk";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "SimpleITK";
     repo = "SimpleITK";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-JmZUlIdcCQ9yEqxoUwRaxvr/Q7xZm41QA3mtDtoSdyI=";
+    hash = "sha256-/FV5NAM9DJ54Vg6/5yn9DCybry+a8lS3fQ3HWLOeOTA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/array-api-compat/default.nix b/pkgs/development/python-modules/array-api-compat/default.nix
new file mode 100644
index 000000000000..3f25d7763b9e
--- /dev/null
+++ b/pkgs/development/python-modules/array-api-compat/default.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  setuptools,
+  numpy,
+  jaxlib,
+  jax,
+  torch,
+  dask,
+  sparse,
+  array-api-strict,
+  config,
+  cudaSupport ? config.cudaSupport,
+  cupy,
+  nix-update-script,
+}:
+
+buildPythonPackage rec {
+  pname = "array-api-compat";
+  version = "1.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "data-apis";
+    repo = "array-api-compat";
+    rev = "refs/tags/${version}";
+    hash = "sha256-DZs51yWgeMX7lmzR6jily0S3MRD4AVlk7BP8aU99Zp8=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    numpy
+    jaxlib
+    jax
+    torch
+    dask
+    sparse
+    array-api-strict
+  ] ++ lib.optionals cudaSupport [ cupy ];
+
+  pythonImportsCheck = [ "array_api_compat" ];
+
+  # CUDA (used via cupy) is not available in the testing sandbox
+  checkPhase = ''
+    runHook preCheck
+    python -m pytest -k 'not cupy'
+    runHook postCheck
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://data-apis.org/array-api-compat";
+    changelog = "https://github.com/data-apis/array-api-compat/releases/tag/${version}";
+    description = "Compatibility layer for NumPy to support the Python array API";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ berquist ];
+  };
+}
diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 0570f5c4df9b..368bf0fc0721 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -51,7 +51,7 @@
 
 buildPythonPackage rec {
   pname = "chromadb";
-  version = "0.5.4";
+  version = "0.5.5";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -60,13 +60,13 @@ buildPythonPackage rec {
     owner = "chroma-core";
     repo = "chroma";
     rev = "refs/tags/${version}";
-    hash = "sha256-wzfzuWuNqLAjfAZC38p1iTtJHez/pJ9Ncgeo23o1dMo=";
+    hash = "sha256-e6ZctUFeq9hHXWaxGdVTiqFpwaU7A+EKn2EdQPI7DHE=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-0OE2i29oE6RpJRswQWI8+5dbA6lOWd3nhqe1RGlnjhk=";
+    hash = "sha256-3FmnQEpknYNzI3WlQ3kc8qa4LFcn1zpxKDbkATU7/48=";
   };
 
   pythonRelaxDeps = [
@@ -74,14 +74,17 @@ buildPythonPackage rec {
     "orjson"
   ];
 
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
   nativeBuildInputs = [
     cargo
     pkg-config
     protobuf
     rustc
     rustPlatform.cargoSetupHook
-    setuptools
-    setuptools-scm
   ];
 
   buildInputs = [
@@ -89,7 +92,7 @@ buildPythonPackage rec {
     zstd
   ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bcrypt
     build
     chroma-hnswlib
@@ -141,8 +144,9 @@ buildPythonPackage rec {
   '';
 
   disabledTests = [
-    # flaky / timing sensitive
+    # Tests are laky / timing sensitive
     "test_fastapi_server_token_authn_allows_when_it_should_allow"
+    "test_fastapi_server_token_authn_rejects_when_it_should_reject"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/extract-msg/default.nix b/pkgs/development/python-modules/extract-msg/default.nix
index 37f4ea55af7a..9ed39dae6783 100644
--- a/pkgs/development/python-modules/extract-msg/default.nix
+++ b/pkgs/development/python-modules/extract-msg/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "extract-msg";
-  version = "0.48.7";
+  version = "0.49.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "TeamMsgExtractor";
     repo = "msg-extractor";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZZ07YCGRBcWKauNfIRi+CLE75BcOMIWuP+OZFDA5SSs=";
+    hash = "sha256-o9kf88IYYpjZDpg1liIaIpxzg0cfFepRx0BdxeLRTz0=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/inkex/default.nix b/pkgs/development/python-modules/inkex/default.nix
index 154848eae351..c796a0136953 100644
--- a/pkgs/development/python-modules/inkex/default.nix
+++ b/pkgs/development/python-modules/inkex/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   inkscape,
   fetchpatch,
@@ -62,10 +63,16 @@ buildPythonPackage {
     scour
   ];
 
-  disabledTests = [
-    "test_extract_multiple"
-    "test_lookup_and"
-  ];
+  disabledTests =
+    [
+      "test_extract_multiple"
+      "test_lookup_and"
+    ]
+    ++ lib.optional stdenv.isDarwin [
+      "test_image_extract"
+      "test_path_number_nodes"
+      "test_plotter" # Hangs
+    ];
 
   disabledTestPaths = [
     # Fatal Python error: Segmentation fault
diff --git a/pkgs/development/python-modules/jsonslicer/default.nix b/pkgs/development/python-modules/jsonslicer/default.nix
index 8f5420d194c8..a7f79e849be3 100644
--- a/pkgs/development/python-modules/jsonslicer/default.nix
+++ b/pkgs/development/python-modules/jsonslicer/default.nix
@@ -3,6 +3,8 @@
   buildPythonPackage,
   fetchFromGitHub,
   gitUpdater,
+  pytestCheckHook,
+  unittestCheckHook,
   setuptools,
   pkg-config,
   yajl,
@@ -16,7 +18,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "AMDmi3";
     repo = "jsonslicer";
-    rev = version;
+    rev = "refs/tags/${version}";
     hash = "sha256-nPifyqr+MaFqoCYFbFSSBDjvifpX0CFnHCdMCvhwYTA=";
   };
 
@@ -27,11 +29,19 @@ buildPythonPackage rec {
 
   buildInputs = [ yajl ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+    unittestCheckHook
+  ];
+
+  pythonImportsCheck = [ "jsonslicer" ];
+
   passthru.updateScript = gitUpdater { };
 
   meta = with lib; {
     description = "Stream JSON parser for Python";
     homepage = "https://github.com/AMDmi3/jsonslicer";
+    changelog = "https://github.com/AMDmi3/jsonslicer/blob/${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ jopejoe1 ];
   };
diff --git a/pkgs/development/python-modules/jxlpy/default.nix b/pkgs/development/python-modules/jxlpy/default.nix
new file mode 100644
index 000000000000..307e5211be4b
--- /dev/null
+++ b/pkgs/development/python-modules/jxlpy/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  cython,
+  libjxl,
+}:
+
+buildPythonPackage rec {
+  pname = "jxlpy";
+  version = "0.9.5";
+
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-Kqdm8b3hgO0Q3zE68rSIM4Jd7upjG+SQywSseGwCFUI=";
+  };
+
+  build-system = [
+    setuptools
+    cython
+  ];
+
+  buildInputs = [ libjxl ];
+
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "jxlpy" ];
+
+  meta = {
+    description = "Cython bindings and Pillow plugin for JPEG XL";
+    homepage = "https://github.com/olokelo/jxlpy";
+    changelog = "https://github.com/olokelo/jxlpy/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.huantian ];
+  };
+}
diff --git a/pkgs/development/python-modules/pbxproj/default.nix b/pkgs/development/python-modules/pbxproj/default.nix
new file mode 100644
index 000000000000..a9635b873729
--- /dev/null
+++ b/pkgs/development/python-modules/pbxproj/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  docopt,
+  openstep-parser,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pbxproj";
+  version = "4.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "kronenthaler";
+    repo = "mod-pbxproj";
+    rev = "refs/tags/${version}";
+    hash = "sha256-srtS6ggVnpffEa57LL2OzfC2mVd9uLxUL6LzxqPVLdo=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    docopt
+    openstep-parser
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [
+    "pbxproj"
+    "openstep_parser"
+  ];
+
+  meta = {
+    description = "Python module to manipulate XCode projects ";
+    homepage = "https://github.com/kronenthaler/mod-pbxproj";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ilaumjd ];
+  };
+}
diff --git a/pkgs/development/python-modules/pykcs11/default.nix b/pkgs/development/python-modules/pykcs11/default.nix
new file mode 100644
index 000000000000..5700fd4523a6
--- /dev/null
+++ b/pkgs/development/python-modules/pykcs11/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  callPackage,
+  fetchPypi,
+  setuptools,
+  swig4,
+}:
+
+buildPythonPackage rec {
+  pname = "pykcs11";
+  version = "1.5.16";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-Q9dGsGd/Q8xjS598Tastm6axqDuTHiWYJHBi+P9kHgc=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [ swig4 ];
+
+  pypaBuildFlags = [ "--skip-dependency-check" ];
+
+  outputs = [
+    "out"
+    "testout"
+  ];
+
+  postInstall = ''
+    mkdir $testout
+    cp -R test $testout/test
+  '';
+
+  pythonImportsCheck = [ "PyKCS11" ];
+
+  doCheck = false;
+
+  # tests complain about circular import, do testing with passthru.tests instead
+  passthru.tests = {
+    pytest = callPackage ./tests.nix { };
+  };
+
+  meta = with lib; {
+    description = "PKCS#11 wrapper for Python";
+    homepage = "https://github.com/LudovicRousseau/PyKCS11";
+    changelog = "https://github.com/LudovicRousseau/PyKCS11/releases/tag/${version}";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ hulr ];
+  };
+}
diff --git a/pkgs/development/python-modules/pykcs11/tests.nix b/pkgs/development/python-modules/pykcs11/tests.nix
new file mode 100644
index 000000000000..00468733ae30
--- /dev/null
+++ b/pkgs/development/python-modules/pykcs11/tests.nix
@@ -0,0 +1,33 @@
+{
+  buildPythonPackage,
+  asn1crypto,
+  pykcs11,
+  pytestCheckHook,
+  softhsm,
+}:
+
+buildPythonPackage {
+  pname = "pykcs11-tests";
+  inherit (pykcs11) version;
+  format = "other";
+
+  src = pykcs11.testout;
+
+  dontBuild = true;
+  dontInstall = true;
+
+  nativeCheckInputs = [
+    asn1crypto
+    pykcs11
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    export PYKCS11LIB=${softhsm}/lib/softhsm/libsofthsm2.so
+    export SOFTHSM2_CONF=$HOME/softhsm2.conf
+    echo "directories.tokendir = $HOME/tokens" > $HOME/softhsm2.conf
+    mkdir $HOME/tokens
+    ${softhsm}/bin/softhsm2-util --init-token --label "A token" --pin 1234 --so-pin 123456 --slot 0
+  '';
+}
diff --git a/pkgs/misc/mlxbf-bootimages/default.nix b/pkgs/misc/mlxbf-bootimages/default.nix
index a7552c0bb5cb..7c4291fe778e 100644
--- a/pkgs/misc/mlxbf-bootimages/default.nix
+++ b/pkgs/misc/mlxbf-bootimages/default.nix
@@ -6,12 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mlxbf-bootimages";
-  version = "4.0.3-12704";
+  version = "4.8.0-13249";
 
   src = fetchurl {
-    url = let mainVersion = builtins.elemAt (lib.splitString "-" version) 0; in
-      "https://linux.mellanox.com/public/repo/bluefield/${mainVersion}/bootimages/prod/${pname}-signed_${version}_arm64.deb";
-    hash = "sha256-e13XZhxf41240Qu+hh2a9+KIvZCL+8k5JyZrpJCHmI8=";
+    url = "https://linux.mellanox.com/public/repo/bluefield/${version}/bootimages/prod/${pname}-signed_${version}_arm64.deb";
+    hash = "sha256-VwbngA2UpHtvhCmL21qrebVSNG6/4PbkhnVAmERpek0=";
   };
 
   nativeBuildInputs = [
@@ -35,7 +34,7 @@ stdenv.mkDerivation rec {
     # they are unfree. See https://github.com/Mellanox/bootimages/issues/3
     license = licenses.unfree;
     platforms = [ "aarch64-linux" ];
-    maintainers = with maintainers; [ nikstur ];
+    maintainers = with maintainers; [ nikstur thillux ];
   };
 }
 
diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index 7a7a5112374a..85897310893d 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "evdi";
-  version = "1.14.5";
+  version = "1.14.6";
 
   src = fetchFromGitHub {
     owner = "DisplayLink";
     repo = "evdi";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-G+zNFwKWtAFr2AapQoukjFQlFItIP5Q5m5TWuvTMY8k=";
+    hash = "sha256-/XIWacrsB7qBqlLUwIGuDdahvt2dAwiK7dauFaYh7lU=";
   };
 
   env.NIX_CFLAGS_COMPILE = toString [
@@ -37,8 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   makeFlags = kernel.makeFlags ++ [
-    # This was removed in https://github.com/DisplayLink/evdi/commit/9884501a20346ff85d8a8e3782e9ac9795013ced#diff-5d2a962cad1c08060cbab9e0bba5330ed63958b64ac04024593562cec55f176dL52
-    "CONFIG_DRM_EVDI=m"
     "KVER=${kernel.modDirVersion}"
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
diff --git a/pkgs/servers/headscale/default.nix b/pkgs/servers/headscale/default.nix
index 8bb5a1eef31b..ad52bb94e89e 100644
--- a/pkgs/servers/headscale/default.nix
+++ b/pkgs/servers/headscale/default.nix
@@ -21,6 +21,10 @@ buildGoModule rec {
   patches = [
     # backport of https://github.com/juanfont/headscale/pull/1697
     ./trim-oidc-secret-path.patch
+
+    # fix for headscale not reacting to SIGTERM
+    # see https://github.com/juanfont/headscale/pull/1480 and https://github.com/juanfont/headscale/issues/1461
+    ./sigterm-fix.patch
   ];
 
   ldflags = ["-s" "-w" "-X github.com/juanfont/headscale/cmd/headscale/cli.Version=v${version}"];
diff --git a/pkgs/servers/headscale/sigterm-fix.patch b/pkgs/servers/headscale/sigterm-fix.patch
new file mode 100644
index 000000000000..22a97d98caac
--- /dev/null
+++ b/pkgs/servers/headscale/sigterm-fix.patch
@@ -0,0 +1,12 @@
+diff --git a/hscontrol/app.go b/hscontrol/app.go
+index b8dceba..4bcf019 100644
+--- a/hscontrol/app.go
++++ b/hscontrol/app.go
+@@ -821,6 +821,7 @@ func (h *Headscale) Serve() error {
+
+ 				// And we're done:
+ 				cancel()
++ 				return
+ 			}
+ 		}
+ 	}
diff --git a/pkgs/servers/pingvin-share/backend.nix b/pkgs/servers/pingvin-share/backend.nix
new file mode 100644
index 000000000000..47baa5d1a48d
--- /dev/null
+++ b/pkgs/servers/pingvin-share/backend.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildNpmPackage,
+  vips,
+  pkg-config,
+  nodePackages,
+  src,
+  version,
+  nixosTests,
+}:
+
+buildNpmPackage {
+  pname = "pingvin-share-backend";
+  inherit version;
+
+  src = "${src}/backend";
+
+  npmInstallFlags = [ "--build-from-source" ];
+  installPhase = ''
+    cp -r . $out
+    ln -s $out/node_modules/.bin $out/bin
+  '';
+
+  preBuild = ''
+    prisma generate
+  '';
+
+  buildInputs = [ vips ];
+  nativeBuildInputs = [
+    pkg-config
+    nodePackages.prisma
+  ];
+
+  npmDepsHash = "sha256-btjvX+2krSc0/bJqeLcVTqHBVWqiTFipp3MidO9wApY=";
+  makeCacheWritable = true;
+  npmFlags = [ "--legacy-peer-deps" ];
+
+  passthru.tests = {
+    pingvin-share = nixosTests.pingvin-share;
+  };
+
+  meta = with lib; {
+    description = "Backend of pingvin-share, a self-hosted file sharing platform";
+    homepage = "https://github.com/stonith404/pingvin-share";
+    downloadPage = "https://github.com/stonith404/pingvin-share/releases";
+    changelog = "https://github.com/stonith404/pingvin-share/releases/tag/v${version}";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ ratcornu ];
+  };
+}
diff --git a/pkgs/servers/pingvin-share/default.nix b/pkgs/servers/pingvin-share/default.nix
new file mode 100644
index 000000000000..9dd4fd88c237
--- /dev/null
+++ b/pkgs/servers/pingvin-share/default.nix
@@ -0,0 +1,21 @@
+{
+  callPackage,
+  fetchFromGitHub,
+  recurseIntoAttrs,
+}:
+
+let
+  version = "0.29.0";
+  src = fetchFromGitHub {
+    owner = "stonith404";
+    repo = "pingvin-share";
+    rev = "v${version}";
+    hash = "sha256-ETsIGb6IxGruApUP05cuMtTDNAE23CI1Q2MmjxX3aPo=";
+  };
+in
+
+recurseIntoAttrs {
+  backend = callPackage ./backend.nix { inherit src version; };
+
+  frontend = callPackage ./frontend.nix { inherit src version; };
+}
diff --git a/pkgs/servers/pingvin-share/frontend.nix b/pkgs/servers/pingvin-share/frontend.nix
new file mode 100644
index 000000000000..eaddc1f6f01e
--- /dev/null
+++ b/pkgs/servers/pingvin-share/frontend.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildNpmPackage,
+  vips,
+  pkg-config,
+  src,
+  version,
+  nixosTests,
+}:
+
+buildNpmPackage {
+  pname = "pingvin-share-frontend";
+  inherit version;
+
+  src = "${src}/frontend";
+
+  npmInstallFlags = [ "--build-from-source" ];
+  installPhase = ''
+    cp -r . $out
+    ln -s $out/node_modules/.bin $out/bin
+  '';
+
+  buildInputs = [ vips ];
+  nativeBuildInputs = [ pkg-config ];
+
+  npmDepsHash = "sha256-66CUVLbq2XdOQAr69DcvxTMvOgSR/RTKPaq80JG+8dg=";
+  makeCacheWritable = true;
+  npmFlags = [ "--legacy-peer-deps" ];
+
+  passthru.tests = {
+    pingvin-share = nixosTests.pingvin-share;
+  };
+
+  meta = with lib; {
+    description = "Frontend of pingvin-share, a self-hosted file sharing platform";
+    homepage = "https://github.com/stonith404/pingvin-share";
+    downloadPage = "https://github.com/stonith404/pingvin-share/releases";
+    changelog = "https://github.com/stonith404/pingvin-share/releases/tag/v${version}";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ ratcornu ];
+  };
+}
diff --git a/pkgs/tools/filesystems/erofs-utils/default.nix b/pkgs/tools/filesystems/erofs-utils/default.nix
index 5346403fa0e0..3946523ccb10 100644
--- a/pkgs/tools/filesystems/erofs-utils/default.nix
+++ b/pkgs/tools/filesystems/erofs-utils/default.nix
@@ -1,29 +1,50 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, fuse, util-linux, lz4, xz, zlib, libselinux
-, fuseSupport ? stdenv.isLinux
-, selinuxSupport ? false
-, lzmaSupport ? false
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoreconfHook,
+  pkg-config,
+  fuse,
+  util-linux,
+  lz4,
+  xz,
+  zlib,
+  libselinux,
+  fuseSupport ? stdenv.isLinux,
+  selinuxSupport ? false,
+  lzmaSupport ? false,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "erofs-utils";
-  version = "1.7.1";
-  outputs = [ "out" "man" ];
+  version = "1.8.1";
+  outputs = [
+    "out"
+    "man"
+  ];
 
   src = fetchurl {
-    url =
-      "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${version}.tar.gz";
-    hash = "sha256-GWCD1j5eIx+1eZ586GqUS7ylZNqrzj3pIlqKyp3K/xU=";
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${finalAttrs.version}.tar.gz";
+    hash = "sha256-Xb97SS92gkYrl6dxIdQ8p2Cc2Q5l+MlpMa78ggpvDaM=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ util-linux lz4 zlib ]
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+  buildInputs =
+    [
+      util-linux
+      lz4
+      zlib
+    ]
     ++ lib.optionals fuseSupport [ fuse ]
     ++ lib.optionals selinuxSupport [ libselinux ]
     ++ lib.optionals lzmaSupport [ xz ];
 
-  configureFlags = [
-    "MAX_BLOCK_SIZE=4096"
-  ] ++ lib.optional fuseSupport "--enable-fuse"
+  configureFlags =
+    [ "MAX_BLOCK_SIZE=4096" ]
+    ++ lib.optional fuseSupport "--enable-fuse"
     ++ lib.optional selinuxSupport "--with-selinux"
     ++ lib.optional lzmaSupport "--enable-lzma";
 
@@ -32,7 +53,11 @@ stdenv.mkDerivation rec {
     description = "Userspace utilities for linux-erofs file system";
     changelog = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/tree/ChangeLog?h=v${version}";
     license = with licenses; [ gpl2Plus ];
-    maintainers = with maintainers; [ ehmry nikstur ];
+    maintainers = with maintainers; [
+      ehmry
+      nikstur
+      jmbaur
+    ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/tools/graphics/pfstools/default.nix b/pkgs/tools/graphics/pfstools/default.nix
index ac41fd9c94f6..7d595c5e4ce1 100644
--- a/pkgs/tools/graphics/pfstools/default.nix
+++ b/pkgs/tools/graphics/pfstools/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, mkDerivation, fetchurl, cmake, pkg-config, darwin
 , openexr, zlib, imagemagick6, libGLU, libGL, libglut, fftwFloat
 , fftw, gsl, libexif, perl, qtbase, netpbm
-, enableUnfree ? false, opencv2
+, enableUnfree ? false, opencv
 }:
 
 mkDerivation rec {
@@ -36,7 +36,7 @@ mkDerivation rec {
     OpenGL GLUT
   ]) else [
     libGLU libGL libglut
-  ]) ++ lib.optional enableUnfree (opencv2.override { enableUnfree = true; });
+  ]) ++ lib.optional enableUnfree (opencv.override { enableUnfree = true; });
 
   patches = [ ./glut.patch ./threads.patch ./pfstools.patch ./pfsalign.patch ];
 
diff --git a/pkgs/tools/misc/mstflint/default.nix b/pkgs/tools/misc/mstflint/default.nix
index cd94f83f3f1b..b03c155ecc29 100644
--- a/pkgs/tools/misc/mstflint/default.nix
+++ b/pkgs/tools/misc/mstflint/default.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mstflint";
-  version = "4.28.0-1";
+  version = "4.29.0-1";
 
   src = fetchurl {
     url = "https://github.com/Mellanox/mstflint/releases/download/v${version}/mstflint-${version}.tar.gz";
-    hash = "sha256-zvCDc/9wAqT3XBI9A5kOprnnm52Ek8oGe2Je3dKHti0=";
+    hash = "sha256-G9BIFG8f4Ek9R3CyRLAuMpgbScrtBo/ZaiJwAQMiBlQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9bb124022242..d5218e2007ac 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -794,6 +794,7 @@ mapAliases ({
   libxkbcommon_7 = throw "libxkbcommon_7 has been removed because it is impacted by security issues and not used in nixpkgs, move to 'libxkbcommon'"; # Added 2023-01-03
   lightdm_gtk_greeter = lightdm-gtk-greeter; # Added 2022-08-01
   lightstep-tracer-cpp = throw "lightstep-tracer-cpp is deprecated since 2022-08-29; the upstream recommends migration to opentelemetry projects.";
+  linux_wallpaperengine = throw "linux_wallpaperengine was removed due to freeimage dependency"; # Added 2024-07-19
   lispPackages_new = throw "Lisp packages have been redesigned. See 'lisp-modules' in the nixpkgs manual."; # Added 2024-05-07
   lispPackages = throw "Lisp packages have been redesigned. See 'lisp-modules' in the nixpkgs manual."; # Added 2024-05-07
   lispPackagesFor = throw "Lisp packages have been redesigned. See 'lisp-modules' in the nixpkgs manual."; # Added 2024-05-07
@@ -933,6 +934,9 @@ mapAliases ({
   marwaita-peppermint = lib.warn "marwaita-peppermint has been renamed to marwaita-red" marwaita-red; # Added 2024-07-01
   marwaita-ubuntu = lib.warn "marwaita-ubuntu has been renamed to marwaita-orange" marwaita-orange; # Added 2024-07-08
   masari = throw "masari has been removed as it was abandoned upstream"; # Added 2024-07-11
+  mathematica9 = throw "mathematica9 has been removed as it was obsolete, broken, and depended on OpenCV 2"; # Added 2024-08-20
+  mathematica10 = throw "mathematica10 has been removed as it was obsolete, broken, and depended on OpenCV 2"; # Added 2024-08-20
+  mathematica11 = throw "mathematica11 has been removed as it was obsolete, broken, and depended on OpenCV 2"; # Added 2024-08-20
   matrique = spectral; # Added 2020-01-27
   matrixcli = throw "'matrixcli' has been removed due to being unmaintained and broken functionality. Recommend 'matrix-commander' as an alternative"; # Added 2024-03-09
   matrix-recorder = throw "matrix-recorder has been removed due to being unmaintained"; # Added 2023-05-21
@@ -1077,6 +1081,8 @@ mapAliases ({
   onevpl-intel-gpu = lib.warn "onevpl-intel-gpu has been renamed to vpl-gpu-rt" vpl-gpu-rt; # Added 2024-06-04
   opa = throw "opa has been removed from nixpkgs as upstream has abandoned the project"; # Added 2023-03-21
   opam_1_2 = throw "'opam_1_2' has been renamed to/replaced by 'opam'"; # Added 2023-03-08
+  opencv2 = throw "opencv2 has been removed as it is obsolete and was not used by any other package; please migrate to OpenCV 4"; # Added 2024-08-20
+  opencv3 = throw "opencv3 has been removed as it is obsolete and was not used by any other package; please migrate to OpenCV 4"; # Added 2024-08-20
   openafs_1_8 = openafs; # Added 2022-08-22
   openapi-generator-cli-unstable = throw "openapi-generator-cli-unstable was removed as it was not being updated; consider openapi-generator-cli instead"; # Added 2024-01-02
   openbangla-keyboard = throw "openbangla-keyboard has been replaced by ibus-engines.openbangla-keyboard and fcitx5-openbangla-keyboard"; # added 2023-10-10
@@ -1121,6 +1127,7 @@ mapAliases ({
   ### P ###
 
   PageEdit = pageedit; # Added 2024-01-21
+  p2pvc = throw "p2pvc has been removed as it is unmaintained upstream and depends on OpenCV 2"; # Added 2024-08-20
   packet-cli = metal-cli; # Added 2021-10-25
   packet = throw "packet has been removed as it is no longer working and unmaintained"; # Added 2024-03-29
   palemoon = throw "palemoon has been dropped due to python2 being EOL and marked insecure. Use 'palemoon-bin' instead"; # Added 2023-05-18
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 78006792b7a3..a3450ec74ab5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11214,8 +11214,6 @@ with pkgs;
 
   payload-dumper-go = callPackage ../tools/archivers/payload-dumper-go { };
 
-  p2pvc = callPackage ../applications/video/p2pvc { };
-
   p3x-onenote = callPackage ../applications/office/p3x-onenote { };
 
   p4c = callPackage ../development/compilers/p4c {
@@ -16745,8 +16743,6 @@ with pkgs;
 
   me_cleaner = callPackage ../tools/misc/me_cleaner { };
 
-  mesos-dns = callPackage ../servers/mesos-dns { };
-
   metamath = callPackage ../development/interpreters/metamath { };
 
   minder = callPackage ../applications/misc/minder { };
@@ -23012,19 +23008,6 @@ with pkgs;
 
   openct = callPackage ../development/libraries/openct { };
 
-  opencv2 = callPackage ../development/libraries/opencv {
-    inherit (darwin.apple_sdk.frameworks) AVFoundation Cocoa QTKit Accelerate;
-    ffmpeg = ffmpeg_4;
-  };
-
-  opencv3 = callPackage ../development/libraries/opencv/3.x.nix {
-    inherit (darwin.apple_sdk.frameworks)
-      AVFoundation Cocoa VideoDecodeAcceleration CoreMedia MediaToolbox Accelerate;
-    ffmpeg = ffmpeg_4;
-    # OpenCV3 won't build with anything newer than CUDA 11 due to API changes.
-    cudaPackages = cudaPackages_11;
-  };
-
   opencv4 = callPackage ../development/libraries/opencv/4.x.nix {
     inherit (darwin.apple_sdk.frameworks)
       AVFoundation Cocoa VideoDecodeAcceleration CoreMedia MediaToolbox Accelerate;
@@ -23187,6 +23170,8 @@ with pkgs;
 
   pico-sdk = callPackage ../development/libraries/pico-sdk { };
 
+  pingvin-share =  callPackage ../servers/pingvin-share { };
+
   pinocchio = callPackage ../development/libraries/pinocchio { };
 
   pipelight = callPackage ../tools/misc/pipelight {
@@ -37203,18 +37188,6 @@ with pkgs;
     cudaSupport = true;
   };
 
-  mathematica9 = callPackage ../applications/science/math/mathematica {
-    version = "9";
-  };
-
-  mathematica10 = callPackage ../applications/science/math/mathematica {
-    version = "10";
-  };
-
-  mathematica11 = callPackage ../applications/science/math/mathematica {
-    version = "11";
-  };
-
   mathmod = libsForQt5.callPackage ../applications/science/math/mathmod { };
 
   metis = callPackage ../development/libraries/science/math/metis { };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index f52c1e5f21d8..47d3c815ccef 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -19,6 +19,7 @@ let
 
       aac-tactics = callPackage ../development/coq-modules/aac-tactics {};
       addition-chains = callPackage ../development/coq-modules/addition-chains {};
+      atbr = callPackage ../development/coq-modules/atbr {};
       autosubst = callPackage ../development/coq-modules/autosubst {};
       bignums = if lib.versionAtLeast coq.coq-version "8.6"
         then callPackage ../development/coq-modules/bignums {}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9092d301e532..f7367f30d516 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -781,6 +781,8 @@ self: super: with self; {
 
   arnparse = callPackage ../development/python-modules/arnparse { };
 
+  array-api-compat = callPackage ../development/python-modules/array-api-compat { };
+
   array-api-strict = callPackage ../development/python-modules/array-api-strict { };
 
   array-record = callPackage ../development/python-modules/array-record { };
@@ -6565,6 +6567,8 @@ self: super: with self; {
 
   jwt = callPackage ../development/python-modules/jwt { };
 
+  jxlpy = callPackage ../development/python-modules/jxlpy { };
+
   jxmlease = callPackage ../development/python-modules/jxmlease { };
 
   k-diffusion = callPackage ../development/python-modules/k-diffusion { };
@@ -9947,6 +9951,8 @@ self: super: with self; {
 
   pbs-installer = callPackage ../development/python-modules/pbs-installer { };
 
+  pbxproj = callPackage ../development/python-modules/pbxproj { };
+
   pc-ble-driver-py = callPackage ../development/python-modules/pc-ble-driver-py { };
 
   pcapy-ng = callPackage ../development/python-modules/pcapy-ng {
@@ -10401,6 +10407,8 @@ self: super: with self; {
 
   pyixapi = callPackage ../development/python-modules/pyixapi { };
 
+  pykcs11 = callPackage ../development/python-modules/pykcs11 { };
+
   pykrakenapi = callPackage ../development/python-modules/pykrakenapi { };
 
   pylance = callPackage ../development/python-modules/pylance { };