diff --git a/pkgs/by-name/ad/adwaita-fonts/package.nix b/pkgs/by-name/ad/adwaita-fonts/package.nix
new file mode 100644
index 000000000000..9eb7280d2c0b
--- /dev/null
+++ b/pkgs/by-name/ad/adwaita-fonts/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  pkg-config,
+  meson,
+  ninja,
+  glib,
+  gnome-common,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "adwaita-fonts";
+  version = "48.2";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "adwaita-fonts";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-rXr4U5k0MUz766F5kVssZfM6Ra/hQOe/HLpGss2aZuo=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+  ];
+
+  buildInputs = [
+    glib
+    gnome-common
+  ];
+
+  meta = {
+    description = "Adwaita Sans, a variation of Inter, and Adwaita Mono, Iosevka customized to match Inter";
+    homepage = "https://gitlab.gnome.org/GNOME/adwaita-fonts";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.qxrein ];
+  };
+})
diff --git a/pkgs/by-name/bi/bitrise/package.nix b/pkgs/by-name/bi/bitrise/package.nix
index cc65a5bf4b58..b389c5b06430 100644
--- a/pkgs/by-name/bi/bitrise/package.nix
+++ b/pkgs/by-name/bi/bitrise/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.26.1";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = version;
-    hash = "sha256-gL9YvddHIU+ZHC5/4NH7xsBLM+p9f5Uc6JzxUAIAVSo=";
+    hash = "sha256-qkKGkUY5d4EWTjz6IfWhjYOSpXISE4Z98P0laRKe5wo=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access
diff --git a/pkgs/by-name/ci/circt/package.nix b/pkgs/by-name/ci/circt/package.nix
index c9d6c4999651..8c54990b6ba8 100644
--- a/pkgs/by-name/ci/circt/package.nix
+++ b/pkgs/by-name/ci/circt/package.nix
@@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.103.0";
+  version = "1.104.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-MpNsGioHd7VstuHlzI7SUvrvGcSpViULzAyL0CzMFgw=";
+    hash = "sha256-r5UYoeqrXSWvWtR0IgjrH67RIgul3vpNoN+4lWlGrHw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/dn/dnf5/package.nix b/pkgs/by-name/dn/dnf5/package.nix
index aedbb9114f35..9ef5da372a6c 100644
--- a/pkgs/by-name/dn/dnf5/package.nix
+++ b/pkgs/by-name/dn/dnf5/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  appstream,
   cmake,
   createrepo_c,
   doxygen,
@@ -32,7 +33,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dnf5";
-  version = "5.2.8.1";
+  version = "5.2.9.0";
 
   outputs = [
     "out"
@@ -43,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rpm-software-management";
     repo = "dnf5";
     rev = finalAttrs.version;
-    hash = "sha256-R9woS84vZkF7yatbJr7KNhaUsLZcGaiS+XnYXG3i1jA=";
+    hash = "sha256-TkWFSxbxsRRRMDkTKlaOnKC0VLmcV0LuZmmnvqtywaw=";
   };
 
   nativeBuildInputs =
@@ -63,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     ]);
 
   buildInputs = [
+    appstream
     cppunit
     fmt
     json_c
diff --git a/pkgs/by-name/gl/glasgow/package.nix b/pkgs/by-name/gl/glasgow/package.nix
index b9893eab803a..4e40bfce685d 100644
--- a/pkgs/by-name/gl/glasgow/package.nix
+++ b/pkgs/by-name/gl/glasgow/package.nix
@@ -10,7 +10,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "glasgow";
-  version = "0-unstable-2025-01-05";
+  version = "0-unstable-2025-01-26";
   # from `pdm show`
   realVersion = let
       tag = builtins.elemAt (lib.splitString "-" version) 0;
@@ -22,8 +22,8 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "GlasgowEmbedded";
     repo = "glasgow";
-    rev = "5e719a48658a873427ba3dafcf00757cbfcf3aa4";
-    sha256 = "sha256-el538mYGqe5beOQOV2zp4v3phwzXF3rGK7DXguyf904=";
+    rev = "2a67f79d6025a06e98277956cbb036c4237960f1";
+    sha256 = "sha256-THunn3Oz+eldjQ72TGuq4Egnn6fiMiGG/UtYVRc/tfU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hysteria/package.nix b/pkgs/by-name/hy/hysteria/package.nix
index 498f880f96dd..d031de61df7a 100644
--- a/pkgs/by-name/hy/hysteria/package.nix
+++ b/pkgs/by-name/hy/hysteria/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "hysteria";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = pname;
     rev = "app/v${version}";
-    hash = "sha256-EdqFushE/G0kWOkks7m2nSQ9wXq1p1HjebSgb5tAzmo=";
+    hash = "sha256-0vd1cV2E07EntiOE0wHrSe4e/SRqbFrXhyBRFGxU7xY=";
   };
 
-  vendorHash = "sha256-P4BiWeGZCI/8zehAt+5OEZhQcA9usw+OSum9gEl/gSU=";
+  vendorHash = "sha256-YFFhsBRWL1Rn+z8awRQiy6/5IEqD1f9CjAeIqfzrwu4=";
   proxyVendor = true;
 
   ldflags =
diff --git a/pkgs/by-name/ma/magic-vlsi/package.nix b/pkgs/by-name/ma/magic-vlsi/package.nix
index 04b5ba2852dc..d3d964c6fc8a 100644
--- a/pkgs/by-name/ma/magic-vlsi/package.nix
+++ b/pkgs/by-name/ma/magic-vlsi/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "magic-vlsi";
-  version = "8.3.507";
+  version = "8.3.515";
 
   src = fetchurl {
     url    = "http://opencircuitdesign.com/magic/archive/magic-${version}.tgz";
-    sha256 = "sha256-YSsfCIp3uGYoZkjNNv79nQTZyROYJQABEz+bkl0Nqfg=";
+    sha256 = "sha256-39kw0H+B3NOcbtBmxCwZxd9dPy1ouE6ise3BfgRqSZo=";
   };
 
   nativeBuildInputs = [ python3 ];
diff --git a/pkgs/by-name/mo/movim/package.nix b/pkgs/by-name/mo/movim/package.nix
index 2f68e3301a39..8ccbe1f069da 100644
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@@ -18,11 +18,11 @@ let
   defaultMinifyOpts = {
     script = {
       enable = false;
-      target = "es2021";
+      target = "es2020";
     };
     style = {
       enable = false;
-      browserslist = "defaults, Firefox ESR, last 20 Firefox major versions, last 20 Chrome major versions, last 3 Safari major versions, last 1 KaiOS version, and supports css-variables";
+      browserslist = "defaults, Firefox ESR, Firefox 91, last 20 Firefox major versions, last 20 Chrome major versions, last 3 Safari major versions, last 1 KaiOS version, and supports css-variables";
     };
     svg = {
       enable = false;
@@ -44,13 +44,13 @@ let
 in
 php.buildComposerProject2 (finalAttrs: {
   pname = "movim";
-  version = "0.29";
+  version = "0.29.1";
 
   src = fetchFromGitHub {
     owner = "movim";
     repo = "movim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hAOT3n0i9t3uWMjqWJlOs4Vakq3y4+GhiFZ4n3jVqtw=";
+    hash = "sha256-8YbRqlppD4tWqCki6v3F1cP8BcG66kAa3njEdPIRPhs=";
   };
 
   php = php.buildEnv (
@@ -98,7 +98,7 @@ php.buildComposerProject2 (finalAttrs: {
   # pinned commonmark
   composerStrictValidation = false;
 
-  vendorHash = "sha256-+twzmUayrAj65ixEsweHM6886nN/6PYUCTSLMc+EmVE=";
+  vendorHash = "sha256-Y1H7jvO/P4R+Rb4V87pha3Icd2Iy7VyzwVDPX72aMqA=";
 
   postPatch = ''
     # Our modules are already wrapped, removes missing *.so warnings;
@@ -123,47 +123,63 @@ php.buildComposerProject2 (finalAttrs: {
   '';
 
   preBuild =
-    lib.optionalString minify.script.enable ''
-      find ./public -type f -iname "*.js" -print0 \
-        | xargs -0 -n 1 -P $NIX_BUILD_CORES ${writeShellScript "movim_script_minify" ''
-          file="$1"
-          tmp="$(mktemp)"
-          esbuild $file --minify --target=${lib.escapeShellArg minify.script.target} --outfile=$tmp
-          [[ "$(stat -c %s $tmp)" -lt "$(stat -c %s $file)" ]] && mv $tmp $file
-        ''}
-    ''
-    + lib.optionalString minify.style.enable ''
-      find ./public -type f -iname "*.css" -print0 \
-        | xargs -0 -n 1 -P $NIX_BUILD_CORES ${writeShellScript "movim_style_minify" ''
-          export BROWSERLIST="${lib.escapeShellArg minify.style.browserslist}"
-          file="$1"
-          tmp="$(mktemp)"
-          lightningcss $file --minify --browserslist --output-file=$tmp
-          [[ "$(stat -c %s $tmp)" -lt "$(stat -c %s $file)" ]] && mv $tmp $file
-        ''}
-    ''
-    + lib.optionalString minify.svg.enable ''
-      find ./public -type f -iname "*.svg" -a -not -path "*/emojis/*" -print0 \
-        | xargs -0 -n 1 -P $NIX_BUILD_CORES ${writeShellScript "movim_svg_minify" ''
-          file="$1"
-          tmp="$(mktemp)"
-          scour -i $file -o $tmp --disable-style-to-xml --enable-comment-stripping --enable-viewboxing --indent=tab
-          [[ "$(stat -c %s $tmp)" -lt "$(stat -c %s $file)" ]] && mv $tmp $file
-        ''}
-    '';
+    lib.optionalString minify.script.enable
+      # sh
+      ''
+        find ./public -type f -iname "*.js" -print0 \
+          | xargs -0 -n 1 -P $NIX_BUILD_CORES ${writeShellScript "movim_script_minify" ''
+            file="$1"
+            tmp="$(mktemp)"
+            esbuild $file --minify --target=${lib.escapeShellArg minify.script.target} --outfile=$tmp
+            [ "$(stat -c %s $tmp)" -lt "$(stat -c %s $file)" ] && mv $tmp $file
+          ''}
+      ''
+    +
+      lib.optionalString minify.style.enable
+        # sh
+        ''
+          find ./public -type f -iname "*.css" -print0 \
+            | xargs -0 -n 1 -P $NIX_BUILD_CORES ${writeShellScript "movim_style_minify" ''
+              export BROWSERLIST="${lib.escapeShellArg minify.style.browserslist}"
+              file="$1"
+              tmp="$(mktemp)"
+              lightningcss $file --minify --browserslist --output-file=$tmp
+              [ "$(stat -c %s $tmp)" -lt "$(stat -c %s $file)" ] && mv $tmp $file
+            ''}
+        ''
+    +
+      lib.optionalString minify.svg.enable
+        # sh
+        ''
+          find ./public -type f -iname "*.svg" -a -not -path "*/emojis/*" -print0 \
+            | xargs -0 -n 1 -P $NIX_BUILD_CORES ${writeShellScript "movim_svg_minify" ''
+              file="$1"
+              tmp="$(mktemp)"
+              scour -i $file -o $tmp --disable-style-to-xml --enable-comment-stripping --enable-viewboxing --indent=tab
+              [ "$(stat -c %s $tmp)" -lt "$(stat -c %s $file)" ] && mv $tmp $file
+            ''}
+        '';
 
   postInstall = ''
     mkdir -p $out/bin
-    echo "#!${lib.getExe dash}" > $out/bin/movim
-    echo "${lib.getExe finalAttrs.php} $out/share/php/${finalAttrs.pname}/daemon.php \"\$@\"" >> $out/bin/${finalAttrs.meta.mainProgram}
-    chmod +x $out/bin/${finalAttrs.meta.mainProgram}
+    cat << EOF > $out/bin/movim
+    #!${lib.getExe dash}
+    ${lib.getExe finalAttrs.php} $out/share/php/${finalAttrs.pname}/daemon.php "\$@"
+    EOF
+    chmod +x $out/bin/movim
 
-
-    mkdir -p $out/share/{bash-completion/completion,fish/vendor_completions.d,zsh/site-functions}
+    mkdir -p \
+      $out/share/bash-completion/completion \
+      $out/share/fish/vendor_completions.d \
+      $out/share/zsh/site-functions
     $out/bin/movim completion bash | sed "s/daemon.php/movim/g" > $out/share/bash-completion/completion/movim.bash
     $out/bin/movim completion fish | sed "s/daemon.php/movim/g" > $out/share/fish/vendor_completions.d/movim.fish
     $out/bin/movim completion zsh | sed "s/daemon.php/movim/g" > $out/share/zsh/site-functions/_movim
-    chmod +x $out/share/{bash-completion/completion/movim.bash,fish/vendor_completions.d/movim.fish,zsh/site-functions/_movim}
+
+    chmod +x \
+      $out/share/bash-completion/completion/movim.bash \
+      $out/share/fish/vendor_completions.d/movim.fish \
+      $out/share/zsh/site-functions/_movim
   '';
 
   passthru = {
diff --git a/pkgs/by-name/no/notonoto-hs/package.nix b/pkgs/by-name/no/notonoto-hs/package.nix
new file mode 100644
index 000000000000..be1cbe466900
--- /dev/null
+++ b/pkgs/by-name/no/notonoto-hs/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  fontforge,
+  python3,
+}:
+
+let
+  python3' = python3.withPackages (
+    ps: with ps; [
+      fonttools
+      ttfautohint-py
+    ]
+  );
+in
+
+stdenvNoCC.mkDerivation rec {
+  pname = "notonoto-hs";
+  version = "0.0.3";
+
+  src = fetchFromGitHub {
+    owner = "yuru7";
+    repo = "NOTONOTO";
+    tag = "v${version}";
+    hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
+  };
+
+  nativeBuildInputs = [
+    fontforge
+    python3'
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    fontforge --script fontforge_script.py --hidden-zenkaku-space
+    python3 ./fonttools_script.py
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 build/*.ttf -t $out/share/fonts/truetype/notonoto-hs
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Programming font that combines Noto Sans Mono and Noto Sans JP";
+    homepage = "https://github.com/yuru7/NOTONOTO";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ genga898 ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/no/notonoto/package.nix b/pkgs/by-name/no/notonoto/package.nix
index ef4447f866b3..36ca284845c7 100644
--- a/pkgs/by-name/no/notonoto/package.nix
+++ b/pkgs/by-name/no/notonoto/package.nix
@@ -2,7 +2,19 @@
   lib,
   fetchFromGitHub,
   stdenvNoCC,
+  fontforge,
+  python3,
 }:
+
+let
+  python3' = python3.withPackages (
+    ps: with ps; [
+      fonttools
+      ttfautohint-py
+    ]
+  );
+in
+
 stdenvNoCC.mkDerivation rec {
   pname = "notonoto";
   version = "0.0.3";
@@ -14,10 +26,24 @@ stdenvNoCC.mkDerivation rec {
     hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
   };
 
+  nativeBuildInputs = [
+    fontforge
+    python3'
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    fontforge --script fontforge_script.py
+    python3 ./fonttools_script.py
+
+    runHook postBuild
+  '';
+
   installPhase = ''
     runHook preInstall
 
-    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/notonoto {} \;
+    install -Dm444 build/*.ttf -t $out/share/fonts/truetype/notonoto
 
     runHook postInstall
   '';
@@ -27,7 +53,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/yuru7/NOTONOTO";
     license = lib.licenses.ofl;
     maintainers = with lib.maintainers; [ genga898 ];
-    mainProgram = "notonoto";
+    platforms = lib.platforms.all;
   };
-
 }
diff --git a/pkgs/by-name/si/simplotask/package.nix b/pkgs/by-name/si/simplotask/package.nix
index 9c7e426b5d8b..3a674ae1a181 100644
--- a/pkgs/by-name/si/simplotask/package.nix
+++ b/pkgs/by-name/si/simplotask/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "simplotask";
-  version = "1.16.3";
+  version = "1.16.4";
 
   src = fetchFromGitHub {
     owner = "umputun";
     repo = "spot";
     rev = "v${version}";
-    hash = "sha256-Se2Gq3GnQsAKIzRslt2zEkqeE8lwda96EcglhqfC5NA=";
+    hash = "sha256-pSYYYUzChK/GNAdCybd4KMNXwkTZo/0w6CtsYOvbKj8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index db812da65fe2..9ceee9d8fff6 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -24,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vesktop";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "Vencord";
     repo = "Vesktop";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-zvyDKgNTRha7Z7KGAA7x9LRJrL+1zyb5TZEFFK8Ffrc=";
+    hash = "sha256-z2MKnCWDWUczoz39zzBYRB6wiSU1SRRHLpeUZeJqbLc=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    hash = "sha256-GSAOdvd8X4dQNTDZMnzc4oMY54TKvdPuAOMb6DRzCEM=";
+    hash = "sha256-xn3yE2S6hfCijV+Edx3PYgGro8eF76/GqarOIRj9Tbg=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix
index adcb6252f05e..19df48ce1bd8 100644
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@@ -1,104 +1,110 @@
 {
+  lib,
+  stdenv,
   buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  cython,
+  distlib,
+  grpcio-tools,
+  jinja2,
+  jsonpickle,
+  jsonschema,
+  mypy-protobuf,
+  redis,
+  setuptools,
+  yapf,
+
+  # dependencies
   cloudpickle,
   crcmod,
-  cython,
   dill,
   fastavro,
   fasteners,
-  fetchFromGitHub,
-  fetchpatch,
-  freezegun,
   grpcio,
-  grpcio-tools,
   hdfs,
   httplib2,
-  hypothesis,
-  lib,
-  mock,
-  mypy-protobuf,
   numpy,
   objsize,
   orjson,
-  pandas,
-  parameterized,
   proto-plus,
   protobuf,
-  psycopg2,
   pyarrow,
   pydot,
-  pyhamcrest,
   pymongo,
-  pytest-xdist,
-  pytestCheckHook,
-  python,
   python-dateutil,
   pytz,
-  pyyaml,
   regex,
   requests,
+  typing-extensions,
+  zstandard,
+
+  # tests
+  python,
+  freezegun,
+  hypothesis,
+  mock,
+  pandas,
+  parameterized,
+  psycopg2,
+  pyhamcrest,
+  pytest-xdist,
+  pytestCheckHook,
+  pyyaml,
   requests-mock,
   scikit-learn,
-  setuptools,
   sqlalchemy,
   tenacity,
   testcontainers,
-  typing-extensions,
-  zstandard,
 }:
 
 buildPythonPackage rec {
   pname = "apache-beam";
-  version = "2.61.0";
+  version = "2.62.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "beam";
     tag = "v${version}";
-    hash = "sha256-PAAQJ07sSzg6M/dSSmrrJjXE5Rd0VOWuBA3wcUklYHg=";
+    hash = "sha256-vLvnRZAQg9nhUOI0SIUn+9Y8O7edK3445PkdhPbhO3Y=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/apache/beam/pull/24143
-      name = "fix-for-dill-0.3.6.patch";
-      url = "https://github.com/apache/beam/commit/7e014435b816015d21cc07f3f6c80809f3d8023d.patch";
-      hash = "sha256-iUmnzrItTFM98w3mpadzrmtI3t0fucpSujAg/6qxCGk=";
-      stripLen = 2;
-    })
-  ];
-
   pythonRelaxDeps = [
+    "grpcio"
+    "jsonpickle"
+
+    # As of apache-beam v2.55.1, the requirement is cloudpickle~=2.2.1, but
+    # the current (2024-04-20) nixpkgs's pydot version is 3.0.0.
+    "cloudpickle"
+
     # See https://github.com/NixOS/nixpkgs/issues/156957
     "dill"
-    "numpy"
-    "pymongo"
-
-    # See https://github.com/NixOS/nixpkgs/issues/193613
-    "protobuf"
-
-    # As of apache-beam v2.45.0, the requirement is httplib2>=0.8,<0.21.0, but
-    # the current (2023-02-08) nixpkgs's httplib2 version is 0.21.0. This can be
-    # removed once beam is upgraded since the current requirement on master is
-    # for httplib2>=0.8,<0.22.0.
-    "httplib2"
 
     # As of apache-beam v2.45.0, the requirement is pyarrow<10.0.0,>=0.15.1, but
     # the current (2023-02-22) nixpkgs's pyarrow version is 11.0.0.
     "pyarrow"
+
+    "pydot"
   ];
 
   sourceRoot = "${src.name}/sdks/python";
 
-  nativeBuildInputs = [
+  build-system = [
     cython
+    distlib
     grpcio-tools
+    jinja2
+    jsonpickle
+    jsonschema
     mypy-protobuf
+    redis
     setuptools
+    yapf
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     cloudpickle
     crcmod
     dill
@@ -125,9 +131,23 @@ buildPythonPackage rec {
 
   enableParallelBuilding = true;
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "distlib==0.3.7" "distlib" \
+      --replace-fail "yapf==0.29.0" "yapf" \
+      --replace-fail "grpcio-tools==1.62.1" "grpcio-tools" \
+      --replace-fail "mypy-protobuf==3.5.0" "mypy-protobuf" \
+      --replace-fail "numpy>=1.14.3,<2.3.0" "numpy"
+
+    substituteInPlace setup.py \
+      --replace-fail "  copy_tests_from_docs()" ""
+  '';
+
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "apache_beam" ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     freezegun
     hypothesis
     mock
@@ -135,8 +155,8 @@ buildPythonPackage rec {
     parameterized
     psycopg2
     pyhamcrest
-    pytestCheckHook
     pytest-xdist
+    pytestCheckHook
     pyyaml
     requests-mock
     scikit-learn
@@ -147,7 +167,9 @@ buildPythonPackage rec {
 
   # Make sure we're running the tests for the actually installed
   # package, so that cython's .so files are available.
-  preCheck = "cd $out/${python.sitePackages}";
+  preCheck = ''
+    cd $out/${python.sitePackages}
+  '';
 
   disabledTestPaths = [
     # Fails with
@@ -175,41 +197,150 @@ buildPythonPackage rec {
     "apache_beam/typehints/typed_pipeline_test.py"
     "apache_beam/coders/fast_coders_test.py"
     "apache_beam/dataframe/schemas_test.py"
+
+    # Fails with TypeError: cannot pickle 'EncodedFile' instances
+    # Upstream issue https://github.com/apache/beam/issues/33889
+    "apache_beam/options/pipeline_options_validator_test.py"
+    "apache_beam/yaml/main_test.py"
+    "apache_beam/yaml/programming_guide_test.py"
+    "apache_beam/yaml/readme_test.py"
+    "apache_beam/yaml/yaml_combine_test.py"
+    "apache_beam/yaml/yaml_enrichment_test.py"
+    "apache_beam/yaml/yaml_io_test.py"
+    "apache_beam/yaml/yaml_join_test.py"
+    "apache_beam/yaml/yaml_mapping_test.py"
+    "apache_beam/yaml/yaml_ml_test.py"
+    "apache_beam/yaml/yaml_provider_unit_test.py"
+
+    # FIXME All those fails due to a single- AttributeError: 'MaybeReshuffle' object has no attribute 'side_inputs'
+    # Upstream issue https://github.com/apache/beam/issues/33854
+    "apache_beam/coders/row_coder_test.py"
+    "apache_beam/examples/avro_nyc_trips_test.py"
+    "apache_beam/examples/complete/autocomplete_test.py"
+    "apache_beam/examples/complete/estimate_pi_test.py"
+    "apache_beam/examples/complete/game/game_stats_test.py"
+    "apache_beam/examples/complete/game/hourly_team_score_test.py"
+    "apache_beam/examples/complete/game/leader_board_test.py"
+    "apache_beam/examples/complete/game/user_score_test.py"
+    "apache_beam/examples/complete/tfidf_test.py"
+    "apache_beam/examples/complete/top_wikipedia_sessions_test.py"
+    "apache_beam/examples/cookbook/bigquery_side_input_test.py"
+    "apache_beam/examples/cookbook/bigquery_tornadoes_test.py"
+    "apache_beam/examples/cookbook/coders_test.py"
+    "apache_beam/examples/cookbook/combiners_test.py"
+    "apache_beam/examples/cookbook/custom_ptransform_test.py"
+    "apache_beam/examples/cookbook/filters_test.py"
+    "apache_beam/examples/matrix_power_test.py"
+    "apache_beam/examples/snippets/snippets_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/approximatequantiles_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/approximateunique_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/batchelements_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/cogroupbykey_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/combineglobally_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/combineperkey_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/combinevalues_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/count_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/distinct_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/groupbykey_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/groupintobatches_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/latest_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/max_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/mean_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/min_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/sample_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/sum_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/tolist_test.py"
+    "apache_beam/examples/snippets/transforms/aggregation/top_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/filter_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/flatmap_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/keys_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/kvswap_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/map_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/pardo_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/partition_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/regex_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/tostring_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/values_test.py"
+    "apache_beam/examples/snippets/transforms/elementwise/withtimestamps_test.py"
+    "apache_beam/examples/snippets/transforms/other/create_test.py"
+    "apache_beam/examples/snippets/transforms/other/flatten_test.py"
+    "apache_beam/examples/snippets/transforms/other/window_test.py"
+    "apache_beam/examples/snippets/util_test.py"
+    "apache_beam/io/avroio_test.py"
+    "apache_beam/io/concat_source_test.py"
+    "apache_beam/io/filebasedsink_test.py"
+    "apache_beam/io/filebasedsource_test.py"
+    "apache_beam/io/fileio_test.py"
+    "apache_beam/io/mongodbio_test.py"
+    "apache_beam/io/parquetio_test.py"
+    "apache_beam/io/sources_test.py"
+    "apache_beam/io/textio_test.py"
+    "apache_beam/io/tfrecordio_test.py"
+    "apache_beam/metrics/metric_test.py"
+    "apache_beam/ml/inference/base_test.py"
+    "apache_beam/ml/inference/sklearn_inference_test.py"
+    "apache_beam/ml/inference/utils_test.py"
+    "apache_beam/ml/rag/chunking/base_test.py"
+    "apache_beam/pipeline_test.py"
+    "apache_beam/runners/direct/direct_runner_test.py"
+    "apache_beam/runners/direct/sdf_direct_runner_test.py"
+    "apache_beam/runners/interactive/interactive_beam_test.py"
+    "apache_beam/runners/interactive/interactive_runner_test.py"
+    "apache_beam/runners/interactive/non_interactive_runner_test.py"
+    "apache_beam/runners/interactive/recording_manager_test.py"
+    "apache_beam/runners/portability/fn_api_runner/translations_test.py"
+    "apache_beam/runners/portability/fn_api_runner/trigger_manager_test.py"
+    "apache_beam/runners/portability/stager_test.py"
+    "apache_beam/testing/synthetic_pipeline_test.py"
+    "apache_beam/testing/test_stream_test.py"
+    "apache_beam/testing/util_test.py"
+    "apache_beam/transforms/combiners_test.py"
+    "apache_beam/transforms/core_test.py"
+    "apache_beam/transforms/create_test.py"
+    "apache_beam/transforms/deduplicate_test.py"
+    "apache_beam/transforms/periodicsequence_test.py"
+    "apache_beam/transforms/ptransform_test.py"
+    "apache_beam/transforms/sideinputs_test.py"
+    "apache_beam/transforms/stats_test.py"
+    "apache_beam/transforms/transforms_keyword_only_args_test.py"
+    "apache_beam/transforms/trigger_test.py"
+    "apache_beam/transforms/userstate_test.py"
+    "apache_beam/transforms/util_test.py"
+    "apache_beam/transforms/write_ptransform_test.py"
+
+    # FIXME AttributeError: 'Namespace' object has no attribute 'test_pipeline_options'
+    # Upstream issue https://github.com/apache/beam/issues/33853
+    "apache_beam/runners/portability/prism_runner_test.py"
+
+    # FIXME ValueError: Unable to run pipeline with requirement: unsupported_requirement
+    # Upstream issuehttps://github.com/apache/beam/issues/33853
+    "apache_beam/yaml/yaml_transform_scope_test.py"
+    "apache_beam/yaml/yaml_transform_test.py"
+    "apache_beam/yaml/yaml_transform_unit_test.py"
+    "apache_beam/yaml/yaml_udf_test.py"
+    "apache_beam/dataframe/frames_test.py"
+
+    # FIXME Those tests do not terminate due to a grpc error (threading issue)
+    # grpc_status:14, grpc_message:"Cancelling all calls"}"
+    # Upstream issue https://github.com/apache/beam/issues/33851
+    "apache_beam/runners/portability/portable_runner_test.py"
   ];
 
-  disabledTests = [
-    # The reasons of failures for these tests are unclear.
-    # They reproduce in Docker with Ubuntu 22.04
-    # (= they're not `nixpkgs`-specific) but given the upstream uses
-    # quite elaborate testing infra with containers and multiple
-    # different runners - I don't expect them to help debugging these
-    # when running via our (= custom from their PoV) testing infra.
-    "test_with_main_session"
-    # AssertionErrors
-    "test_unified_repr"
-    "testDictComprehension"
-    "testDictComprehensionSimple"
-    "testGenerator"
-    "testGeneratorComprehension"
-    "testListComprehension"
-    "testNoneReturn"
-    "testSet"
-    "testTupleListComprehension"
-    "test_newtype"
-    "test_pardo_type_inference"
-    "test_get_output_batch_type"
-    "test_pformat_namedtuple_with_unnamed_fields"
-    "test_row_coder_fail_early_bad_schema"
-    # See https://github.com/apache/beam/issues/26004.
-    "test_batch_encode_decode"
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    #  PermissionError: [Errno 13] Permission denied: '/tmp/...'
+    "test_cache_manager_uses_local_ib_cache_root"
+    "test_describe_all_recordings"
+    "test_find_out_correct_user_pipeline"
+    "test_get_cache_manager_creates_cache_manager_if_absent"
+    "test_streaming_cache_uses_local_ib_cache_root"
+    "test_track_user_pipeline_cleanup_non_inspectable_pipeline"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Unified model for defining both batch and streaming data-parallel processing pipelines";
     homepage = "https://beam.apache.org/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ndl ];
-    # https://github.com/apache/beam/issues/27221
-    broken = lib.versionAtLeast pandas.version "2";
+    changelog = "https://github.com/apache/beam/blob/release-${version}/CHANGES.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ndl ];
   };
 }
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 6663feddc114..4ab89fdd134c 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.36.11";
+  version = "1.36.13";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-tBzTzvXEQvL3fRCkYJ//qowiMjKzYRVK9nT1WWUfcIk=";
+    hash = "sha256-kVtyFA//Xx2pzrEJbgJTcnnYCUDnwvm81EmMaD1pvzE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 6c37fbbf0b33..5903dada7878 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.36.11";
+  version = "1.36.12";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-TBjwmUJURW+DTQEp7R9JQhyM2ABHxOXbkAcPafDm89I=";
+    hash = "sha256-wefqyBDkLeSbR8sjwRjbIGwOcZEw5Gjd7csOuCwhkEw=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/datadog/default.nix b/pkgs/development/python-modules/datadog/default.nix
index 1440d815c338..4232b5307b14 100644
--- a/pkgs/development/python-modules/datadog/default.nix
+++ b/pkgs/development/python-modules/datadog/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "datadog";
-  version = "0.50.2";
+  version = "0.51.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-F3JXdL8rsKSPHQltknB0ksGH8krgiWCvCwwvqXlY/VE=";
+    hash = "sha256-MnlTT4Ma4LSuLYzkLvA4tKs45mfX7W/3Q3mC16DPUlA=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/holidays/default.nix b/pkgs/development/python-modules/holidays/default.nix
index 8223f8fbfb12..b9daea61b4ac 100644
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.65";
+  version = "0.66";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "vacanza";
     repo = "python-holidays";
     tag = "v${version}";
-    hash = "sha256-ykfcIWTRwYntp0cgrtNdgOH9y8P4TxayFPKRbo+5cI8=";
+    hash = "sha256-9VX+g7p9YmwahikVnQQ1kbm82VZLm5nqMQktQhbflBw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 368e73703327..b9829fd4c49a 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.9";
+  version = "1.9.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-buuA+r1R42SMhrmszEGhFW9HPeaJVg1KihAlWT42JTs=";
+    hash = "sha256-YWuJkNn6oKKTCZTdmJQA7+Eh1s37QQKSOJacXOHYhnw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/types-awscrt/default.nix b/pkgs/development/python-modules/types-awscrt/default.nix
index 2ec55d8b6020..bc77713be8aa 100644
--- a/pkgs/development/python-modules/types-awscrt/default.nix
+++ b/pkgs/development/python-modules/types-awscrt/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "types-awscrt";
-  version = "0.23.8";
+  version = "0.23.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "types_awscrt";
     inherit version;
-    hash = "sha256-IUE5Go9NNs8JhAbBnZBgs08TpVjCLUqtrCUKDFfRJxA=";
+    hash = "sha256-V+xo1F74c0WN9zB+yAV4pjNGlvCIVJqzScPWVefjVis=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/webauthn/default.nix b/pkgs/development/python-modules/webauthn/default.nix
index cd869ccff42c..de619fe7ee41 100644
--- a/pkgs/development/python-modules/webauthn/default.nix
+++ b/pkgs/development/python-modules/webauthn/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "webauthn";
-  version = "2.5.0";
+  version = "2.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "duo-labs";
     repo = "py_webauthn";
     tag = "v${version}";
-    hash = "sha256-XIL2rejPp/5zaPFuWHgn696sugNB3E/BRc7DuP0oI4Q=";
+    hash = "sha256-QXaZeR8PC3fW3KjmVKsupnftznSxLw8b1HvllOAiouk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/ocaml/ocp-index/default.nix b/pkgs/development/tools/ocaml/ocp-index/default.nix
index d1f7ec0f097c..1fa391f607f8 100644
--- a/pkgs/development/tools/ocaml/ocp-index/default.nix
+++ b/pkgs/development/tools/ocaml/ocp-index/default.nix
@@ -10,7 +10,7 @@
 
 buildDunePackage rec {
   pname = "ocp-index";
-  version = "1.3.6";
+  version = "1.3.7";
 
   minimalOCamlVersion = "4.08";
 
@@ -18,7 +18,7 @@ buildDunePackage rec {
     owner = "OCamlPro";
     repo = "ocp-index";
     rev = version;
-    hash = "sha256-EgRpC58NBVFO1w0xx11CnonatU2H7bECsEk6Y4c/odY=";
+    hash = "sha256-FbkVJRbFNSho/E59QMUoGK+TrdnnacmykJWWG2JVDVA=";
   };
 
   nativeBuildInputs = [ cppo ];
diff --git a/pkgs/servers/metabase/default.nix b/pkgs/servers/metabase/default.nix
index 3b859dcd50db..7e77d9b30c2a 100644
--- a/pkgs/servers/metabase/default.nix
+++ b/pkgs/servers/metabase/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "metabase";
-  version = "0.52.4";
+  version = "0.52.8";
 
   src = fetchurl {
     url = "https://downloads.metabase.com/v${version}/metabase.jar";
-    hash = "sha256-sDlh82h7LeqYKxG0gi1cR4ZCMDic5J1nPwBPQ958SLY=";
+    hash = "sha256-Z14BuKaSAMzlgdtqppc/3ItCxVZwE4E1EQUVMVR6JwQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];