diff --git a/.gitignore b/.gitignore
index db5517cfde91..d8d8847c5679 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@
 .idea/
 .nixos-test-history
 .vscode/
+.helix/
 outputs/
 result-*
 result
diff --git a/lib/default.nix b/lib/default.nix
index ef0bb60ab8c5..2605da47679e 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -64,6 +64,9 @@ let
     # linux kernel configuration
     kernel = callLibs ./kernel.nix;
 
+    # network
+    network = callLibs ./network;
+
     # TODO: For consistency, all builtins should also be available from a sub-library;
     # these are the only ones that are currently not
     inherit (builtins) addErrorContext isPath trace typeOf unsafeGetAttrPos;
@@ -73,7 +76,7 @@ let
       info showWarnings nixpkgsVersion version isInOldestRelease
       mod compare splitByAndCompare seq deepSeq lessThan add sub
       functionArgs setFunctionArgs isFunction toFunction mirrorFunctionArgs
-      toHexString toBaseDigits inPureEvalMode isBool isInt pathExists
+      fromHexString toHexString toBaseDigits inPureEvalMode isBool isInt pathExists
       genericClosure readFile;
     inherit (self.fixedPoints) fix fix' converge extends composeExtensions
       composeManyExtensions makeExtensible makeExtensibleWithCustomName;
diff --git a/lib/network/default.nix b/lib/network/default.nix
new file mode 100644
index 000000000000..e0c583ee7506
--- /dev/null
+++ b/lib/network/default.nix
@@ -0,0 +1,49 @@
+{ lib }:
+let
+  inherit (import ./internal.nix { inherit lib; }) _ipv6;
+in
+{
+  ipv6 = {
+    /**
+      Creates an `IPv6Address` object from an IPv6 address as a string. If
+      the prefix length is omitted, it defaults to 64. The parser is limited
+      to the first two versions of IPv6 addresses addressed in RFC 4291.
+      The form "x:x:x:x:x:x:d.d.d.d" is not yet implemented. Addresses are
+      NOT compressed, so they are not always the same as the canonical text
+      representation of IPv6 addresses defined in RFC 5952.
+
+      # Type
+
+      ```
+      fromString :: String -> IPv6Address
+      ```
+
+      # Examples
+
+      ```nix
+      fromString "2001:DB8::ffff/32"
+      => {
+        address = "2001:db8:0:0:0:0:0:ffff";
+        prefixLength = 32;
+      }
+      ```
+
+      # Arguments
+
+      - [addr] An IPv6 address with optional prefix length.
+    */
+    fromString =
+      addr:
+      let
+        splittedAddr = _ipv6.split addr;
+
+        addrInternal = splittedAddr.address;
+        prefixLength = splittedAddr.prefixLength;
+
+        address = _ipv6.toStringFromExpandedIp addrInternal;
+      in
+      {
+        inherit address prefixLength;
+      };
+  };
+}
diff --git a/lib/network/internal.nix b/lib/network/internal.nix
new file mode 100644
index 000000000000..3e05be90c547
--- /dev/null
+++ b/lib/network/internal.nix
@@ -0,0 +1,209 @@
+{
+  lib ? import ../.,
+}:
+let
+  inherit (builtins)
+    map
+    match
+    genList
+    length
+    concatMap
+    head
+    toString
+    ;
+
+  inherit (lib) lists strings trivial;
+
+  inherit (lib.lists) last;
+
+  /*
+    IPv6 addresses are 128-bit identifiers. The preferred form is 'x:x:x:x:x:x:x:x',
+    where the 'x's are one to four hexadecimal digits of the eight 16-bit pieces of
+    the address. See RFC 4291.
+  */
+  ipv6Bits = 128;
+  ipv6Pieces = 8; # 'x:x:x:x:x:x:x:x'
+  ipv6PieceBits = 16; # One piece in range from 0 to 0xffff.
+  ipv6PieceMaxValue = 65535; # 2^16 - 1
+in
+let
+  /**
+    Expand an IPv6 address by removing the "::" compression and padding them
+    with the necessary number of zeros. Converts an address from the string to
+    the list of strings which then can be parsed using `_parseExpanded`.
+    Throws an error when the address is malformed.
+
+    # Type: String -> [ String ]
+
+    # Example:
+
+    ```nix
+    expandIpv6 "2001:DB8::ffff"
+    => ["2001" "DB8" "0" "0" "0" "0" "0" "ffff"]
+    ```
+  */
+  expandIpv6 =
+    addr:
+    if match "^[0-9A-Fa-f:]+$" addr == null then
+      throw "${addr} contains malformed characters for IPv6 address"
+    else
+      let
+        pieces = strings.splitString ":" addr;
+        piecesNoEmpty = lists.remove "" pieces;
+        piecesNoEmptyLen = length piecesNoEmpty;
+        zeros = genList (_: "0") (ipv6Pieces - piecesNoEmptyLen);
+        hasPrefix = strings.hasPrefix "::" addr;
+        hasSuffix = strings.hasSuffix "::" addr;
+        hasInfix = strings.hasInfix "::" addr;
+      in
+      if addr == "::" then
+        zeros
+      else if
+        let
+          emptyCount = length pieces - piecesNoEmptyLen;
+          emptyExpected =
+            # splitString produces two empty pieces when "::" in the beginning
+            # or in the end, and only one when in the middle of an address.
+            if hasPrefix || hasSuffix then
+              2
+            else if hasInfix then
+              1
+            else
+              0;
+        in
+        emptyCount != emptyExpected
+        || (hasInfix && piecesNoEmptyLen >= ipv6Pieces) # "::" compresses at least one group of zeros.
+        || (!hasInfix && piecesNoEmptyLen != ipv6Pieces)
+      then
+        throw "${addr} is not a valid IPv6 address"
+      # Create a list of 8 elements, filling some of them with zeros depending
+      # on where the "::" was found.
+      else if hasPrefix then
+        zeros ++ piecesNoEmpty
+      else if hasSuffix then
+        piecesNoEmpty ++ zeros
+      else if hasInfix then
+        concatMap (piece: if piece == "" then zeros else [ piece ]) pieces
+      else
+        pieces;
+
+  /**
+    Parses an expanded IPv6 address (see `expandIpv6`), converting each part
+    from a string to an u16 integer. Returns an internal representation of IPv6
+    address (list of integers) that can be easily processed by other helper
+    functions.
+    Throws an error some element is not an u16 integer.
+
+    # Type: [ String ] -> IPv6
+
+    # Example:
+
+    ```nix
+    parseExpandedIpv6 ["2001" "DB8" "0" "0" "0" "0" "0" "ffff"]
+    => [8193 3512 0 0 0 0 0 65535]
+    ```
+  */
+  parseExpandedIpv6 =
+    addr:
+    assert lib.assertMsg (
+      length addr == ipv6Pieces
+    ) "parseExpandedIpv6: expected list of integers with ${ipv6Pieces} elements";
+    let
+      u16FromHexStr =
+        hex:
+        let
+          parsed = trivial.fromHexString hex;
+        in
+        if 0 <= parsed && parsed <= ipv6PieceMaxValue then
+          parsed
+        else
+          throw "0x${hex} is not a valid u16 integer";
+    in
+    map (piece: u16FromHexStr piece) addr;
+in
+let
+  /**
+    Parses an IPv6 address from a string to the internal representation (list
+    of integers).
+
+    # Type: String -> IPv6
+
+    # Example:
+
+    ```nix
+    parseIpv6FromString "2001:DB8::ffff"
+    => [8193 3512 0 0 0 0 0 65535]
+    ```
+  */
+  parseIpv6FromString = addr: parseExpandedIpv6 (expandIpv6 addr);
+in
+{
+  /*
+    Internally, an IPv6 address is stored as a list of 16-bit integers with 8
+    elements. Wherever you see `IPv6` in internal functions docs, it means that
+    it is a list of integers produced by one of the internal parsers, such as
+    `parseIpv6FromString`
+  */
+  _ipv6 = {
+    /**
+      Converts an internal representation of an IPv6 address (i.e, a list
+      of integers) to a string. The returned string is not a canonical
+      representation as defined in RFC 5952, i.e zeros are not compressed.
+
+      # Type: IPv6 -> String
+
+      # Example:
+
+      ```nix
+      parseIpv6FromString [8193 3512 0 0 0 0 0 65535]
+      => "2001:db8:0:0:0:0:0:ffff"
+      ```
+    */
+    toStringFromExpandedIp =
+      pieces: strings.concatMapStringsSep ":" (piece: strings.toLower (trivial.toHexString piece)) pieces;
+
+    /**
+      Extract an address and subnet prefix length from a string. The subnet
+      prefix length is optional and defaults to 128. The resulting address and
+      prefix length are validated and converted to an internal representation
+      that can be used by other functions.
+
+      # Type: String -> [ {address :: IPv6, prefixLength :: Int} ]
+
+      # Example:
+
+      ```nix
+      split "2001:DB8::ffff/32"
+      => {
+        address = [8193 3512 0 0 0 0 0 65535];
+        prefixLength = 32;
+      }
+      ```
+    */
+    split =
+      addr:
+      let
+        splitted = strings.splitString "/" addr;
+        splittedLength = length splitted;
+      in
+      if splittedLength == 1 then # [ ip ]
+        {
+          address = parseIpv6FromString addr;
+          prefixLength = ipv6Bits;
+        }
+      else if splittedLength == 2 then # [ ip subnet ]
+        {
+          address = parseIpv6FromString (head splitted);
+          prefixLength =
+            let
+              n = strings.toInt (last splitted);
+            in
+            if 1 <= n && n <= ipv6Bits then
+              n
+            else
+              throw "${addr} IPv6 subnet should be in range [1;${toString ipv6Bits}], got ${toString n}";
+        }
+      else
+        throw "${addr} is not a valid IPv6 address in CIDR notation";
+  };
+}
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 408ea5416293..dd12923e636e 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -102,6 +102,7 @@ let
     testAllTrue
     toBaseDigits
     toHexString
+    fromHexString
     toInt
     toIntBase10
     toShellVars
@@ -286,6 +287,21 @@ runTests {
     expected = "FA";
   };
 
+  testFromHexStringFirstExample = {
+    expr = fromHexString "FF";
+    expected = 255;
+  };
+
+  testFromHexStringSecondExample = {
+    expr = fromHexString (builtins.hashString "sha256" "test");
+    expected = 9223372036854775807;
+  };
+
+  testFromHexStringWithPrefix = {
+    expr = fromHexString "0Xf";
+    expected = 15;
+  };
+
   testToBaseDigits = {
     expr = toBaseDigits 2 6;
     expected = [ 1 1 0 ];
diff --git a/lib/tests/network.sh b/lib/tests/network.sh
new file mode 100755
index 000000000000..54ca476d2deb
--- /dev/null
+++ b/lib/tests/network.sh
@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+
+# Tests lib/network.nix
+# Run:
+# [nixpkgs]$ lib/tests/network.sh
+# or:
+# [nixpkgs]$ nix-build lib/tests/release.nix
+
+set -euo pipefail
+shopt -s inherit_errexit
+
+if [[ -n "${TEST_LIB:-}" ]]; then
+  NIX_PATH=nixpkgs="$(dirname "$TEST_LIB")"
+else
+  NIX_PATH=nixpkgs="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.."; pwd)"
+fi
+export NIX_PATH
+
+die() {
+  echo >&2 "test case failed: " "$@"
+  exit 1
+}
+
+tmp="$(mktemp -d)"
+clean_up() {
+    rm -rf "$tmp"
+}
+trap clean_up EXIT SIGINT SIGTERM
+work="$tmp/work"
+mkdir "$work"
+cd "$work"
+
+prefixExpression='
+  let
+    lib = import <nixpkgs/lib>;
+    internal = import <nixpkgs/lib/network/internal.nix> {
+      inherit lib;
+    };
+  in
+  with lib;
+  with lib.network;
+'
+
+expectSuccess() {
+    local expr=$1
+    local expectedResult=$2
+    if ! result=$(nix-instantiate --eval --strict --json --show-trace \
+        --expr "$prefixExpression ($expr)"); then
+        die "$expr failed to evaluate, but it was expected to succeed"
+    fi
+    if [[ ! "$result" == "$expectedResult" ]]; then
+        die "$expr == $result, but $expectedResult was expected"
+    fi
+}
+
+expectSuccessRegex() {
+    local expr=$1
+    local expectedResultRegex=$2
+    if ! result=$(nix-instantiate --eval --strict --json --show-trace \
+        --expr "$prefixExpression ($expr)"); then
+        die "$expr failed to evaluate, but it was expected to succeed"
+    fi
+    if [[ ! "$result" =~ $expectedResultRegex ]]; then
+        die "$expr == $result, but $expectedResultRegex was expected"
+    fi
+}
+
+expectFailure() {
+    local expr=$1
+    local expectedErrorRegex=$2
+    if result=$(nix-instantiate --eval --strict --json --show-trace 2>"$work/stderr" \
+        --expr "$prefixExpression ($expr)"); then
+        die "$expr evaluated successfully to $result, but it was expected to fail"
+    fi
+    if [[ ! "$(<"$work/stderr")" =~ $expectedErrorRegex ]]; then
+        die "Error was $(<"$work/stderr"), but $expectedErrorRegex was expected"
+    fi
+}
+
+# Internal functions
+expectSuccess '(internal._ipv6.split "0:0:0:0:0:0:0:0").address'                         '[0,0,0,0,0,0,0,0]'
+expectSuccess '(internal._ipv6.split "000a:000b:000c:000d:000e:000f:ffff:aaaa").address' '[10,11,12,13,14,15,65535,43690]'
+expectSuccess '(internal._ipv6.split "::").address'                                      '[0,0,0,0,0,0,0,0]'
+expectSuccess '(internal._ipv6.split "::0000").address'                                  '[0,0,0,0,0,0,0,0]'
+expectSuccess '(internal._ipv6.split "::1").address'                                     '[0,0,0,0,0,0,0,1]'
+expectSuccess '(internal._ipv6.split "::ffff").address'                                  '[0,0,0,0,0,0,0,65535]'
+expectSuccess '(internal._ipv6.split "::000f").address'                                  '[0,0,0,0,0,0,0,15]'
+expectSuccess '(internal._ipv6.split "::1:1:1:1:1:1:1").address'                         '[0,1,1,1,1,1,1,1]'
+expectSuccess '(internal._ipv6.split "1::").address'                                     '[1,0,0,0,0,0,0,0]'
+expectSuccess '(internal._ipv6.split "1:1:1:1:1:1:1::").address'                         '[1,1,1,1,1,1,1,0]'
+expectSuccess '(internal._ipv6.split "1:1:1:1::1:1:1").address'                          '[1,1,1,1,0,1,1,1]'
+expectSuccess '(internal._ipv6.split "1::1").address'                                    '[1,0,0,0,0,0,0,1]'
+
+expectFailure 'internal._ipv6.split "0:0:0:0:0:0:0:-1"' "contains malformed characters for IPv6 address"
+expectFailure 'internal._ipv6.split "::0:"'              "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split ":0::"'              "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "0::0:"'             "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "0:0:"'              "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "0:0:0:0:0:0:0:0:0"' "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "0:0:0:0:0:0:0:0:"'  "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "::0:0:0:0:0:0:0:0"' "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "0::0:0:0:0:0:0:0"'  "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "::10000"'           "0x10000 is not a valid u16 integer"
+
+expectSuccess '(internal._ipv6.split "::").prefixLength'     '128'
+expectSuccess '(internal._ipv6.split "::/1").prefixLength'   '1'
+expectSuccess '(internal._ipv6.split "::/128").prefixLength' '128'
+
+expectFailure '(internal._ipv6.split "::/0").prefixLength'   "IPv6 subnet should be in range \[1;128\], got 0"
+expectFailure '(internal._ipv6.split "::/129").prefixLength' "IPv6 subnet should be in range \[1;128\], got 129"
+expectFailure '(internal._ipv6.split "/::/").prefixLength'   "is not a valid IPv6 address in CIDR notation"
+
+# Library API
+expectSuccess 'lib.network.ipv6.fromString "2001:DB8::ffff/64"' '{"address":"2001:db8:0:0:0:0:0:ffff","prefixLength":64}'
+expectSuccess 'lib.network.ipv6.fromString "1234:5678:90ab:cdef:fedc:ba09:8765:4321/44"' '{"address":"1234:5678:90ab:cdef:fedc:ba09:8765:4321","prefixLength":44}'
+
+echo >&2 tests ok
diff --git a/lib/tests/test-with-nix.nix b/lib/tests/test-with-nix.nix
index 9d66b91cab42..63b4b10bae8c 100644
--- a/lib/tests/test-with-nix.nix
+++ b/lib/tests/test-with-nix.nix
@@ -65,6 +65,9 @@ pkgs.runCommand "nixpkgs-lib-tests-nix-${nix.version}" {
   echo "Running lib/tests/sources.sh"
   TEST_LIB=$PWD/lib bash lib/tests/sources.sh
 
+  echo "Running lib/tests/network.sh"
+  TEST_LIB=$PWD/lib bash lib/tests/network.sh
+
   echo "Running lib/fileset/tests.sh"
   TEST_LIB=$PWD/lib bash lib/fileset/tests.sh
 
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 546aed746d1c..771a28bc9dad 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -1074,6 +1074,32 @@ in {
     then v
     else k: v;
 
+  /**
+    Convert a hexadecimal string to it's integer representation.
+
+    # Type
+
+    ```
+    fromHexString :: String -> [ String ]
+    ```
+
+    # Examples
+
+    ```nix
+    fromHexString "FF"
+    => 255
+
+    fromHexString (builtins.hashString "sha256" "test")
+    => 9223372036854775807
+    ```
+  */
+  fromHexString = value:
+  let
+    noPrefix = lib.strings.removePrefix "0x" (lib.strings.toLower value);
+  in let
+    parsed = builtins.fromTOML "v=0x${noPrefix}";
+  in parsed.v;
+
   /**
     Convert the given positive integer to a string of its hexadecimal
     representation. For example:
diff --git a/pkgs/applications/graphics/gthumb/default.nix b/pkgs/applications/graphics/gthumb/default.nix
index 7de054195520..5b56ce758561 100644
--- a/pkgs/applications/graphics/gthumb/default.nix
+++ b/pkgs/applications/graphics/gthumb/default.nix
@@ -22,7 +22,6 @@
 , libwebp
 , libX11
 , json-glib
-, webkitgtk
 , lcms2
 , bison
 , flex
@@ -32,6 +31,7 @@
 , python3
 , desktop-file-utils
 , itstool
+, withWebservices ? true, webkitgtk
 }:
 
 stdenv.mkDerivation rec {
@@ -79,11 +79,11 @@ stdenv.mkDerivation rec {
     libtiff
     libwebp
     libX11
-    webkitgtk
-  ];
+  ] ++ lib.optional withWebservices webkitgtk;
 
   mesonFlags = [
     "-Dlibchamplain=true"
+    (lib.mesonBool "webservices" withWebservices)
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
index e1bbb48ea965..936ed7ec73ca 100644
--- a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
+++ b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "cloudfoundry-cli";
-  version = "8.7.10";
+  version = "8.7.11";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-hzXNaaL6CLVRIy88lCJ87q0V6A+ld1GPDcUagsvMXY0=";
+    sha256 = "sha256-7FYIJf9vNHK9u8r7HVpPtGGWwRA5cdrB9f1Vz1iTFjI=";
   };
-  vendorHash = "sha256-zDE+9OsnX3S7SPTVW3hR1rO++6Wdk00zy2msu+jUNlw=";
+  vendorHash = "sha256-9SpmMXmocwaZH4fqqETzmRP6wvI2NV/LL6M0Ld4lvso=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/cluster/clusterctl/default.nix b/pkgs/applications/networking/cluster/clusterctl/default.nix
index 4cdb78db4fd7..03188bd6eeca 100644
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "clusterctl";
-  version = "1.7.3";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "cluster-api";
     rev = "v${version}";
-    hash = "sha256-CqUAySELc9jMQD6+BCgnvajEDv8FjU4Ita7v0EFrPug=";
+    hash = "sha256-ziW+ROuUmrgsIWHXKL2Yw+9gC6VgE/7Ri3zc3sveyU8=";
   };
 
   vendorHash = "sha256-ALRnccGjPGuAITtuz79Cao95NhvSczAzspSMXytlw+A=";
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 6b4af03b5e6b..c4b9e90613e7 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,52 +2,52 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.58";
-      ptb = "0.0.92";
-      canary = "0.0.438";
-      development = "0.0.21";
+      stable = "0.0.59";
+      ptb = "0.0.93";
+      canary = "0.0.450";
+      development = "0.0.22";
     } else {
-      stable = "0.0.309";
-      ptb = "0.0.121";
-      canary = "0.0.547";
-      development = "0.0.43";
+      stable = "0.0.310";
+      ptb = "0.0.122";
+      canary = "0.0.559";
+      development = "0.0.44";
     };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-YkyniFgkD4GMxUya+/Ke5fxosZKHKyc4+cAx3HI4w8c=";
+        hash = "sha256-wv0HcbPlFRb8OTvnkCdb1MAuvl/7LHTUfE5UxpeSIPw=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-1HbTRWl1w9cu7D4NNFGVbHk1hvRmMywH+q2qA4+nokc=";
+        hash = "sha256-MO940dRAJ0J/fa8I+nU8483AH8PA7eIJ9ZUF15iqbgE=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-z2SsI1vmaW1HjBDkJEH468xPuyAqigOIbRDtaL4Lgxc=";
+        hash = "sha256-qKg27ysy3kUAPL5YrB2BKu5FCwXMfQZtDUT23Yge5No=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-LgRrQ2z0/mx9Xvkb7hOrhmOqaETiBITgJDO9vce/wtk=";
+        hash = "sha256-dSoi/YZra8SRbV1rvbtKkyHmhfTb+A6mja8zZ9Y5JNo=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-9Tfn+dxvhgNjSdfj8Irb/5VU3kn39DX6hdKkppJ6HeU=";
+        hash = "sha256-zQ4/S2BpQDuU3ReKaNh31DRHS4S6FFUo6Y6YjGB1/mE=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-3Lk+kPZcBqznIELVMdA6dRpCOaOuRrchmfHv/EAyyOQ=";
+        hash = "sha256-DckRIoLKmAqUtdXUvvSKeNZUq/77Acy0Np0fPhQjUa4=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-ec2XF3023bQn/85i1xO8tTuYuprtsaL9exqRiZam36A=";
+        hash = "sha256-HrgWpmqyn4k3DDM/LE4JUN6DeJKklm7kzyry4ZiL7pA=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-PZS7LHJExi+fb7G4CnIFk4KQx9/cL4ALXwzOcLx4sWU=";
+        hash = "sha256-Ryk43s8peXIvifcrxeot2nIGpqOfpgWKmVEYQkuX4I0=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index 39f05b615e36..29758aed79b5 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240702-2";
+  version = "20240708";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-nPNhN4ODCZMii5VATcvh8qvdrQQ0r94X6vlaYgtQFac=";
+    hash = "sha256-UwUygYbmwDdv37mo8rEsHx4mMGdXVfAcscrnn1g0wio=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/science/misc/cwltool/default.nix b/pkgs/applications/science/misc/cwltool/default.nix
index 8da98e131f64..ab43eac8bffb 100644
--- a/pkgs/applications/science/misc/cwltool/default.nix
+++ b/pkgs/applications/science/misc/cwltool/default.nix
@@ -24,8 +24,7 @@ python3.pkgs.buildPythonApplication rec {
       --replace '"schema-salad >= 8.4.20230426093816, < 9",' "" \
       --replace "PYTEST_RUNNER + " ""
     substituteInPlace pyproject.toml \
-      --replace "ruamel.yaml>=0.16.0,<0.18" "ruamel.yaml" \
-      --replace "mypy==1.10.0" "mypy==1.10.*"
+      --replace "ruamel.yaml>=0.16.0,<0.18" "ruamel.yaml"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/an/ansel/package.nix b/pkgs/by-name/an/ansel/package.nix
index 68364f7bf529..c96e9538d8b1 100644
--- a/pkgs/by-name/an/ansel/package.nix
+++ b/pkgs/by-name/an/ansel/package.nix
@@ -77,13 +77,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2024-06-29";
+  version = "0-unstable-2024-07-09";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "3799e7893d6b5221706f64a00a6d139fb9717380";
-    hash = "sha256-TyoLVZpKQ68/yjiUsJaXW1z0qr8krIAxRuFG7RtsToI=";
+    rev = "55761cfc7a6aacdc483dadacbf3fadcd89108e27";
+    hash = "sha256-5L/d5R2qQ/GFrJcDPKdqhhMQwEg050CmmDh3BLmETRQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 9648a86e01ba..ede4ecfb44a6 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -28,13 +28,13 @@ let
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.20.1";
+  version = "1.20.4";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-WUGdXPG/v8vmgI3a/X+J1EQUlbJdNaNAUx5whezMcAs=";
+    hash = "sha256-0YWkZdfthHpX4Duc0kP9/QBBTQk1Jx0Hrjd/aoRUIKU=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
diff --git a/pkgs/by-name/fl/flake-checker/package.nix b/pkgs/by-name/fl/flake-checker/package.nix
index 8594591ae1b8..5ccab79d9718 100644
--- a/pkgs/by-name/fl/flake-checker/package.nix
+++ b/pkgs/by-name/fl/flake-checker/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "flake-checker";
-  version = "0.1.20";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "flake-checker";
     rev = "v${version}";
-    hash = "sha256-Oq+HZzB0mWhixLl8jGcBRWrlOETLhath75ndeJdcN1g=";
+    hash = "sha256-cvjSQNvRnreherInbieJnaanU/TzDAgM544MBi7UWvQ=";
   };
 
-  cargoHash = "sha256-/Y3ihHwOHHmLnS1TcG1SCtUU4LORkCtGp1+t5Ow5j6E=";
+  cargoHash = "sha256-0iH5owyNfIpRz6nYwrJUoqd9lVGZ3T3K8rmsOk2UoGI=";
 
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     Security
diff --git a/pkgs/by-name/ge/getmail6/package.nix b/pkgs/by-name/ge/getmail6/package.nix
index a2dde5754a4f..85b08933d4ef 100644
--- a/pkgs/by-name/ge/getmail6/package.nix
+++ b/pkgs/by-name/ge/getmail6/package.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "getmail6";
-  version = "6.19.02";
+  version = "6.19.03";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "getmail6";
     repo = "getmail6";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ThyK30IT7ew5zQ3QAoxdr6ElQEWp2yJcmkLT5NmMfY0=";
+    hash = "sha256-BBsQ3u8CL3Aom+hqjeOErOBtWB8imU2PGgzP8+dq4mM=";
   };
 
   build-system = with python3.pkgs; [
diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix
index bfd8127b3406..673900a67a1f 100644
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "1.29.1";
+  version = "1.30.1";
   outputs = [ "out" "man" "doc" ];
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-R797aRLsaDjNSaYVFUSmKCUr+HQ5xarrssHJe3fwhTw=";
+    hash = "sha256-x7+QK8JnAwXuYvVnLq82CPNXOJfUIQ4ekKLI4ed65Aw=";
   };
 
-  cargoHash = "sha256-DVjhmJPyIRHwKTBWoIBYMJbigLpakDrXeCHQ9Y8/T48=";
+  cargoHash = "sha256-J7N+VOn9WUt60FTioblVHvB3XXmLeLM9vVCY44pkYW8=";
 
   nativeBuildInputs = [ installShellFiles mdbook ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
diff --git a/pkgs/by-name/no/nomacs/package.nix b/pkgs/by-name/no/nomacs/package.nix
index a12d5db94b86..6e03d7397fb7 100644
--- a/pkgs/by-name/no/nomacs/package.nix
+++ b/pkgs/by-name/no/nomacs/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nomacs";
-  version = "3.17.2295";
+  version = "3.19.0";
 
   src = fetchFromGitHub {
     owner = "nomacs";
     repo = "nomacs";
     rev = finalAttrs.version;
     fetchSubmodules = false; # We'll use our own
-    hash = "sha256-jHr7J0X1v2n/ZK0y3b/XPDISk7e08VWS6nicJU4fKKY=";
+    hash = "sha256-lpmM2GfMDlIp1vnbHMaOdicFcKH6LwEoKSETMt7C1NY=";
   };
 
   outputs = [ "out" ]
diff --git a/pkgs/by-name/po/pom/package.nix b/pkgs/by-name/po/pom/package.nix
index 7cfde2d59a57..4b9fc2615f6c 100644
--- a/pkgs/by-name/po/pom/package.nix
+++ b/pkgs/by-name/po/pom/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pom";
-  version = "0-unstable-2024-04-29";
+  version = "0.1.0-unstable-2024-05-17";
 
   src = fetchFromGitHub {
     owner = "maaslalani";
     repo = "pom";
-    rev = "a8a2da7043f222b9c849d1ea93726433980469c0";
-    hash = "sha256-EAt0Q0gSHngQj2G4qYM3zhUGkl/vqa7J36iajlH4dzs=";
+    rev = "699204a6db4f942ee6a6bf0dc389709ab6e1663f";
+    hash = "sha256-Qc4gU2oCgI/B788NuEqB+FoAYZQ84m5K3eArcdz+q20=";
   };
 
-  vendorHash = "sha256-2ghUITtL6RDRVqAZZ+PMj4sYDuh4VaKtGT11eSMlBiA=";
+  vendorHash = "sha256-xJNcFX+sZjZwXFTNrhsDnj3eR/r8+NH6tzpEJOhtkeY=";
 
   ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
 
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index b004d5dce582..cf34642df24a 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "vacuum-go";
-  version = "0.10.1";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     rev = "refs/tags/v${version}";
-    hash = "sha256-hIvQZQk9FwddqAQl7GjZ0zMa41j59LGHZ3eL9MRw7wg=";
+    hash = "sha256-JmdSUbPYhKPoYT5UL9B/d6ZWGIXy+hJt5TZxq0xaLrg=";
   };
 
-  vendorHash = "sha256-OhdN4/fNbXa5ZMakdf370rqyDlCVYjJ1IfeV6hEwcv4=";
+  vendorHash = "sha256-EI2AfOaOAez1L7M52OERJgIGsbxdmOGR0Zkp2YE9mYQ=";
 
   CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/development/compilers/gleam/default.nix b/pkgs/development/compilers/gleam/default.nix
index 94ed718e2a84..234bc86ba318 100644
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "1.3.0";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-pwcvRj/ENbjLogMxk9AO+X2lqwMY+RjHUrBG/8RXLeo=";
+    hash = "sha256-ncb95NjBH/Nk4XP2QIq66TgY1F7UaOaRIEvZchdo5Kw=";
   };
 
   nativeBuildInputs = [ git pkg-config ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++
     lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
-  cargoHash = "sha256-e8Fo0LDo3zXT8wsWhDlnV8i8pRdaTlcSRiuAJvdZ4RI=";
+  cargoHash = "sha256-6fbQOvmXWsU+6QiEHMNsbwuaIH9j0wzp0sNR7W8sBAE=";
 
   passthru.updateScript = nix-update-script { };
 
@@ -34,6 +34,7 @@ rustPlatform.buildRustPackage rec {
     description = "Statically typed language for the Erlang VM";
     mainProgram = "gleam";
     homepage = "https://gleam.run/";
+    changelog = "https://github.com/gleam-lang/gleam/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = teams.beam.members ++ [ lib.maintainers.philtaken ];
   };
diff --git a/pkgs/development/compilers/yosys/default.nix b/pkgs/development/compilers/yosys/default.nix
index 06ce12d642e3..6af75057e898 100644
--- a/pkgs/development/compilers/yosys/default.nix
+++ b/pkgs/development/compilers/yosys/default.nix
@@ -1,6 +1,5 @@
 { stdenv
 , lib
-, bash
 , bison
 , boost
 , fetchFromGitHub
@@ -76,13 +75,13 @@ let
 
 in stdenv.mkDerivation (finalAttrs: {
   pname   = "yosys";
-  version = "0.42";
+  version = "0.43";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo  = "yosys";
     rev   = "refs/tags/${finalAttrs.pname}-${finalAttrs.version}";
-    hash  = "sha256-P0peg81wxCG0Bw2EJEX5WuDYU7GmRqgRw2SyWK/CGNI=";
+    hash  = "sha256-MJTtQvHsHvuo4aNNYSPxSMbeXCty66q83/sbp1Yiiv4=";
     fetchSubmodules = true;
     leaveDotGit = true;
     postFetch = ''
@@ -122,7 +121,6 @@ in stdenv.mkDerivation (finalAttrs: {
     substituteInPlace ./Makefile \
       --replace-fail 'echo UNKNOWN' 'echo ${builtins.substring 0 10 finalAttrs.src.rev}'
 
-    chmod +x ./misc/yosys-config.in
     patchShebangs tests ./misc/yosys-config.in
   '';
 
diff --git a/pkgs/development/compilers/yosys/fix-clang-build.patch b/pkgs/development/compilers/yosys/fix-clang-build.patch
index 7f93594d0c1d..05ba4fbc5929 100644
--- a/pkgs/development/compilers/yosys/fix-clang-build.patch
+++ b/pkgs/development/compilers/yosys/fix-clang-build.patch
@@ -9,6 +9,14 @@
      ./cxxrtl-test-${subtest}
  }
  
+@@ -14,4 +14,4 @@ run_subtest value_fuzz
+ 
+ # Compile-only test.
+ ../../yosys -p "read_verilog test_unconnected_output.v; proc; clean; write_cxxrtl cxxrtl-test-unconnected_output.cc"
+-${CC:-gcc} -std=c++11 -c -o cxxrtl-test-unconnected_output -I../../backends/cxxrtl/runtime cxxrtl-test-unconnected_output.cc
++${CXX:-gcc} -std=c++11 -c -o cxxrtl-test-unconnected_output -I../../backends/cxxrtl/runtime cxxrtl-test-unconnected_output.cc
+diff --git a/tests/fmt/run-test.sh b/tests/fmt/run-test.sh
+index 998047f83..2a4a59f01 100644
 --- a/tests/fmt/run-test.sh
 +++ b/tests/fmt/run-test.sh
 @@ -51,7 +51,7 @@ test_cxxrtl () {
diff --git a/pkgs/development/embedded/svdtools/default.nix b/pkgs/development/embedded/svdtools/default.nix
index 8127385a79d5..1c5aae230f7d 100644
--- a/pkgs/development/embedded/svdtools/default.nix
+++ b/pkgs/development/embedded/svdtools/default.nix
@@ -5,14 +5,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svdtools";
-  version = "0.3.15";
+  version = "0.3.17";
 
   src = fetchCrate {
     inherit version pname;
-    hash = "sha256-P4XwIJnXnIQcp/l8GR7Mx8ybn1GdtiXVpQcky1JYVuU=";
+    hash = "sha256-mXxxsAN/KgQOAgVq6jNVtrb11g3WUbU6e+T1Tgmgciw=";
   };
 
-  cargoHash = "sha256-dBqbZWVTrIj2ji7JmLnlglvt4GkKef48kcl/V54thaQ=";
+  cargoHash = "sha256-2qA9xMJFj+28/ZCnz4KKm7T3EiG6NUY01JQvYmmuIOc=";
 
   meta = with lib; {
     description = "Tools to handle vendor-supplied, often buggy SVD files";
diff --git a/pkgs/development/libraries/lief/default.nix b/pkgs/development/libraries/lief/default.nix
index 4b691ba3d888..2c92e2efc193 100644
--- a/pkgs/development/libraries/lief/default.nix
+++ b/pkgs/development/libraries/lief/default.nix
@@ -11,13 +11,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "lief";
-  version = "0.13.2";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "lief-project";
     repo = "LIEF";
     rev = version;
-    sha256 = "sha256-lH4SqwPB2Jp/wUI2Cll67PQbHbwMqpNuLy/ei8roiHg=";
+    sha256 = "sha256-briOqt/S3YUl6Aon5sKXhutL8VFUSgnK2Wy4UKnHE20=";
   };
 
   outputs = [ "out" "py" ];
@@ -29,21 +29,26 @@ stdenv.mkDerivation rec {
 
   # Not a propagatedBuildInput because only the $py output needs it; $out is
   # just the library itself (e.g. C/C++ headers).
-  buildInputs = [
+  buildInputs = with python.pkgs; [
     python
+    build
+    pathspec
+    pip
+    pydantic
+    scikit-build-core
   ];
 
   env.CXXFLAGS = toString (lib.optional stdenv.isDarwin [ "-faligned-allocation" "-fno-aligned-new" "-fvisibility=hidden" ]);
 
   postBuild = ''
     pushd ../api/python
-    ${pyEnv.interpreter} setup.py build --parallel=$NIX_BUILD_CORES
+    ${pyEnv.interpreter} -m build --no-isolation --wheel --skip-dependency-check --config-setting=--parallel=$NIX_BUILD_CORES
     popd
   '';
 
   postInstall = ''
     pushd ../api/python
-    ${pyEnv.interpreter} setup.py install --skip-build --root=/ --prefix=$py
+    ${pyEnv.interpreter} -m pip install --prefix $py dist/*.whl
     popd
   '';
 
diff --git a/pkgs/development/python-modules/binwalk/default.nix b/pkgs/development/python-modules/binwalk/default.nix
index d3ebcbe91e37..844765011ca6 100644
--- a/pkgs/development/python-modules/binwalk/default.nix
+++ b/pkgs/development/python-modules/binwalk/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   stdenv,
   zlib,
   xz,
@@ -14,37 +13,29 @@
   cramfsprogs,
   cramfsswap,
   sasquatch,
+  setuptools,
   squashfsTools,
   matplotlib,
-  nose,
   pycrypto,
   pyqtgraph,
   pyqt5,
+  pytestCheckHook,
   visualizationSupport ? false,
 }:
 
 buildPythonPackage rec {
   pname = "binwalk${lib.optionalString visualizationSupport "-full"}";
-  version = "2.3.4";
-  format = "setuptools";
+  version = "2.4.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "ReFirmLabs";
+    owner = "OSPG";
     repo = "binwalk";
     rev = "v${version}";
-    hash = "sha256-hlPbzqGRSXcIqlI+SNKq37CnnHd1IoMBNSjhyeAM1TE=";
+    hash = "sha256-VApqQrVBV7w15Bpwc6Fd/cA1Ikqu7Ds8qu0TH68YVog=";
   };
 
-  patches = [
-    # test_firmware_zip fails with 2.3.3 upgrade
-    # https://github.com/ReFirmLabs/binwalk/issues/566
-    (fetchpatch {
-      url = "https://github.com/ReFirmLabs/binwalk/commit/dd4f2efd275c9dd1001130e82e0f985110cd2754.patch";
-      sha256 = "1707n4nf1d1ay1yn4i8qlrvj2c1120g88hjwyklpsc2s2dcnqj9r";
-      includes = [ "testing/tests/test_firmware_zip.py" ];
-      revert = true;
-    })
-  ];
+  build-system = [ setuptools ];
 
   propagatedBuildInputs =
     [
@@ -80,12 +71,12 @@ buildPythonPackage rec {
     HOME=$(mktemp -d)
   '';
 
-  nativeCheckInputs = [ nose ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "binwalk" ];
 
   meta = with lib; {
-    homepage = "https://github.com/ReFirmLabs/binwalk";
+    homepage = "https://github.com/OSPG/binwalk";
     description = "Tool for searching a given binary image for embedded files";
     mainProgram = "binwalk";
     maintainers = [ maintainers.koral ];
diff --git a/pkgs/development/python-modules/capstone/4.nix b/pkgs/development/python-modules/capstone/4.nix
index 2ecf1ce9347a..8c3a8df8f733 100644
--- a/pkgs/development/python-modules/capstone/4.nix
+++ b/pkgs/development/python-modules/capstone/4.nix
@@ -4,7 +4,7 @@
   capstone_4,
   stdenv,
   setuptools,
-  pythonAtLeast,
+  fetchpatch,
 }:
 
 buildPythonPackage {
@@ -12,6 +12,15 @@ buildPythonPackage {
   inherit (capstone_4) version src;
 
   sourceRoot = "source/bindings/python";
+  patches = [
+    # Drop distutils in python binding (PR 2271)
+    (fetchpatch {
+      name = "drop-distutils-in-python-binding.patch";
+      url = "https://github.com/capstone-engine/capstone/commit/d63211e3acb64fceb8b1c4a0d804b4b027f4ef71.patch";
+      hash = "sha256-zUGeFmm3xH5dzfPJE8nnHwqwFBrsZ7w8LBJAy20/3RI=";
+      stripLen = 2;
+    })
+  ];
 
   postPatch = ''
     ln -s ${capstone_4}/lib/libcapstone${stdenv.targetPlatform.extensions.sharedLibrary} prebuilt/
@@ -42,6 +51,5 @@ buildPythonPackage {
       bennofs
       ris
     ];
-    broken = pythonAtLeast "3.12"; # uses distutils
   };
 }
diff --git a/pkgs/development/python-modules/construct-typing/default.nix b/pkgs/development/python-modules/construct-typing/default.nix
new file mode 100644
index 000000000000..73123bed0f39
--- /dev/null
+++ b/pkgs/development/python-modules/construct-typing/default.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  construct,
+  typing-extensions,
+  arrow,
+  cloudpickle,
+  numpy,
+  pytestCheckHook,
+  ruamel-yaml,
+}:
+
+buildPythonPackage rec {
+  pname = "construct-typing";
+  version = "0.6.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "timrid";
+    repo = "construct-typing";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-zXpxu+VUcepEoAPLQnSlMCZkt8fDsMCLS0HBKhaYD20=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonRelaxDeps = [ "construct" ];
+
+  dependencies = [
+    construct
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [
+    "construct-stubs"
+    "construct_typed"
+  ];
+
+  nativeCheckInputs = [
+    arrow
+    cloudpickle
+    numpy
+    pytestCheckHook
+    ruamel-yaml
+  ];
+
+  disabledTests = [
+    # tests fail with construct>=2.10.70
+    "test_bitsinteger"
+    "test_bytesinteger"
+  ];
+
+  meta = {
+    changelog = "https://github.com/timrid/construct-typing/releases/tag/v${version}";
+    description = "Extension for the python package 'construct' that adds typing features";
+    homepage = "https://github.com/timrid/construct-typing";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/eq3btsmart/default.nix b/pkgs/development/python-modules/eq3btsmart/default.nix
new file mode 100644
index 000000000000..5fc267fe2e21
--- /dev/null
+++ b/pkgs/development/python-modules/eq3btsmart/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  bleak,
+  construct,
+  construct-typing,
+  pytest-asyncio,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "eq3btsmart";
+  version = "1.1.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "EuleMitKeule";
+    repo = "eq3btsmart";
+    rev = "refs/tags/${version}";
+    hash = "sha256-7kJqPygX2Oc7fz31qZWrS1ZA+kANZr8vxOwarUzgp/M=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    bleak
+    construct
+    construct-typing
+  ];
+
+  pythonImportsCheck = [ "eq3btsmart" ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  meta = {
+    changelog = "https://github.com/EuleMitKeule/eq3btsmart/releases/tag/${version}";
+    description = "Python library that allows interaction with eQ-3 Bluetooth smart thermostats";
+    homepage = "https://github.com/EuleMitKeule/eq3btsmart";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix b/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix
index 494e8bae5252..9fd7a92d85ec 100644
--- a/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix
+++ b/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-artifact-registry";
-  version = "1.11.3";
+  version = "1.11.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wsSeFbtZHWXeoiyC2lUUjFE09xkZuu+OtNNb4dHLIM0=";
+    hash = "sha256-Rf1kC+XSFciXMeZ2LjdkqQ0AYQZ0cdN2TvccGvOXgkk=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
index fbec33fc371c..9e643cded4a3 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-datatransfer";
-  version = "3.15.3";
+  version = "3.15.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5MhO7TEgnEO0PwjdpzB+7AZmokMdjAh6z0poKtQfOrE=";
+    hash = "sha256-rjVTnrJIUMJsnh/vdpiiL9e4g0iZP9ftYksVQd6cG4M=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-compute/default.nix b/pkgs/development/python-modules/google-cloud-compute/default.nix
index b7f89a66dd6d..1613121d3400 100644
--- a/pkgs/development/python-modules/google-cloud-compute/default.nix
+++ b/pkgs/development/python-modules/google-cloud-compute/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-compute";
-  version = "1.19.0";
+  version = "1.19.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oHs0CLP3d4bcsZZmn/N2e8UQgHGKfC0/13ne/I2Be00=";
+    hash = "sha256-a0pbhsLLvNpd2Q9OM4xRA/PoRgTs+wAtTss6DF1BUxs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-container/default.nix b/pkgs/development/python-modules/google-cloud-container/default.nix
index 5ec6a9d49cd0..ecddcee449bc 100644
--- a/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.47.0";
+  version = "2.47.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tvzOKTu2n5b9JDo9EJw48BUrJuOwOR9JK6PQyi44HfI=";
+    hash = "sha256-2dL+Xj37vFRSQ+yEStVRNIp/CeZdQK6VOPpcxGYAElE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index fb5e089228f7..437034e40120 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-monitoring";
-  version = "2.22.0";
+  version = "2.22.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SUaW4XiMVe9bL61GSBP92fWRF/wogZt9nSehhz17f60=";
+    hash = "sha256-2xexWvjUfaDPj7DjZfqvvNEfmqYngc4EjCmYiAiz3H0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-netapp/default.nix b/pkgs/development/python-modules/google-cloud-netapp/default.nix
index 75cdea219097..4dee8f473d67 100644
--- a/pkgs/development/python-modules/google-cloud-netapp/default.nix
+++ b/pkgs/development/python-modules/google-cloud-netapp/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-netapp";
-  version = "0.3.10";
+  version = "0.3.11";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Bau1Xqb+lmG6aCoWm93mtfOII7CbnnaeZ5vmLp6n0Zs=";
+    hash = "sha256-VFdqldB85ZP+U2CNk19nSbgRFa0UnUc0kq9oNW5nJqs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 01a271e84ae6..3b30ec1851c8 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.20.0";
+  version = "2.20.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oIanQTqvT/+9HE/pIp7wzpvPSPWo31tEnEoy3rWiz94=";
+    hash = "sha256-kcpPVCTYDOT1543sqCmW7jh7jI4GDRaYFpDjHjpCE4s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
index 79071c30d32e..772cef5957af 100644
--- a/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
+++ b/pkgs/development/python-modules/google-cloud-securitycenter/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-securitycenter";
-  version = "1.32.0";
+  version = "1.33.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EQ3KkE+5mxaFrJ6+zfGFQKI013dY4TyrxxzvDE/KuME=";
+    hash = "sha256-/BsKTEMKyj+dTRIutNMu3JP/DHgHBNgvJvp+ehb58nk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index 0f264d2c86a1..ffdd8bc5ac2c 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  gitUpdater,
   pythonAtLeast,
   pythonOlder,
 
@@ -32,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "mypy";
-  version = "1.10.1";
+  version = "1.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -41,10 +40,7 @@ buildPythonPackage rec {
     owner = "python";
     repo = "mypy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-joV+elRaAICNQHkYuYtTDjvOUkHPsRkG1OLRvdxeIHc=";
-  };
-  passthru.updateScript = gitUpdater {
-    rev-prefix = "v";
+    hash = "sha256-NCnc4C/YFKHN/kT7RTFCYs/yC00Kt1E7mWCoQuUjxG8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pysptk/default.nix b/pkgs/development/python-modules/pysptk/default.nix
index ffd7caf99da4..8f7686a46f09 100644
--- a/pkgs/development/python-modules/pysptk/default.nix
+++ b/pkgs/development/python-modules/pysptk/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "pysptk";
-  version = "0.2.2";
+  version = "1.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QUgBA/bchWTaJ54u/ubcRfoVcDeV77wSnHOjkgfVauE=";
+    hash = "sha256-eLHJM4v3laQc3D/wP81GmcQBwyP1RjC7caGXEAeNCz8=";
   };
 
   PYSPTK_BUILD_VERSION = 0;
diff --git a/pkgs/development/python-modules/schema-salad/default.nix b/pkgs/development/python-modules/schema-salad/default.nix
index 6e3b6e3d5ed6..4df6f0af21f0 100644
--- a/pkgs/development/python-modules/schema-salad/default.nix
+++ b/pkgs/development/python-modules/schema-salad/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   cachecontrol,
   fetchFromGitHub,
-  fetchpatch,
   importlib-resources,
   mistune,
   mypy,
@@ -57,11 +56,6 @@ buildPythonPackage rec {
     ++ cachecontrol.optional-dependencies.filecache
     ++ lib.optionals (pythonOlder "3.9") [ importlib-resources ];
 
-  patches = [ (fetchpatch {
-    url = "https://patch-diff.githubusercontent.com/raw/common-workflow-language/schema_salad/pull/840.patch";
-    hash = "sha256-fke75FCCn23LAMJ5bDWJpuBR6E9XIpjmzzXSbjqpxn8=";
-  } ) ];
-
   nativeCheckInputs = [ pytestCheckHook ] ++ passthru.optional-dependencies.pycodegen;
 
   preCheck = ''
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index 62b6b615385a..d14dd1881925 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.23.0";
+  version = "1.23.2";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-46WXCImBqWmU82zIgulVyoB2/aGWXYunWDdQDsxMlOs=";
+    hash = "sha256-DheAS9HHzhmg6J6qBF81uaTmlGNS2igcxuc3ic3nFr0=";
   };
 
-  cargoHash = "sha256-29F4n9yuyGxQSZY4tJ8KaHXKLmpCPuUKDwOoyWBfmgk=";
+  cargoHash = "sha256-VEBwVs1UJFRsoyHHcKQaUpKna5XvAG7vzoWaS7c8ycU=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/development/tools/viceroy/default.nix b/pkgs/development/tools/viceroy/default.nix
index e4aa62b99ff3..94e861ce4ea3 100644
--- a/pkgs/development/tools/viceroy/default.nix
+++ b/pkgs/development/tools/viceroy/default.nix
@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "viceroy";
-  version = "0.9.7";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-oPeHu/EVcGFE7sSwmMWHnT+xAxayZlfyIk/sM64Q+Hw=";
+    hash = "sha256-/B07J1VVrg8kqvJSEWaWbvAu1/3Xr4g1j4uLjuUdCh8=";
   };
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
-  cargoHash = "sha256-z24qvgej2bWq0T4OgRnALJda4xGf5/s1O4ij2igCeyU=";
+  cargoHash = "sha256-k/BYHbZb0lfHDSXXApcM/BiAJByeH3dwrn71i9b8Aqs=";
 
   cargoTestFlags = [
     "--package viceroy-lib"
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 153e05c0a2ed..0b0ab903e34e 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -1140,6 +1140,7 @@
       bluetooth-auto-recovery
       bluetooth-data-tools
       dbus-fast
+      eq3btsmart
       esphome-dashboard-api
       fnv-hash-fast
       ha-ffmpeg
@@ -1154,7 +1155,7 @@
       sqlalchemy
       webrtc-noise-gain
       zeroconf
-    ]; # missing inputs: eq3btsmart
+    ];
     "escea" = ps: with ps; [
       pescea
     ];
@@ -5400,6 +5401,7 @@
     "environment_canada"
     "epion"
     "epson"
+    "eq3btsmart"
     "escea"
     "esphome"
     "eufylife_ble"
diff --git a/pkgs/servers/web-apps/livebook/default.nix b/pkgs/servers/web-apps/livebook/default.nix
index e1815a819bbf..990f658ce9f7 100644
--- a/pkgs/servers/web-apps/livebook/default.nix
+++ b/pkgs/servers/web-apps/livebook/default.nix
@@ -1,7 +1,7 @@
 { lib, beamPackages, makeWrapper, rebar3, elixir, erlang, fetchFromGitHub, nixosTests }:
 beamPackages.mixRelease rec {
   pname = "livebook";
-  version = "0.12.1";
+  version = "0.13.3";
 
   inherit elixir;
 
@@ -13,13 +13,13 @@ beamPackages.mixRelease rec {
     owner = "livebook-dev";
     repo = "livebook";
     rev = "v${version}";
-    hash = "sha256-Q4c0AelZZDPxE/rtoHIRQi3INMLHeiZ72TWgy183f4Q=";
+    hash = "sha256-luvqH6fjovRhVQrsP00XLSQ/rjHZgUbUWmL2B5XCyKI=";
   };
 
   mixFodDeps = beamPackages.fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version;
-    hash = "sha256-dyKhrbb7vazBV6LFERtGHLQXEx29vTgn074mY4fsHy4=";
+    hash = "sha256-/U/UmNVtl7H0rdgXpibM/bYvRbio8WzVRTv4tQ7GQcY=";
   };
 
   postInstall = ''
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 80cbd67811a6..3b4d6ef717af 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.58.1";
+  version = "0.59.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-RVB21zK46uZcKSlT9+Xcpwla/ohahsJN3txhGUhxRM0=";
+    hash = "sha256-2zAvrI7Vxy3/FuDhV4K77n7EsTZR3kpwYDLIEQ2bsuk=";
   };
 
   vendorHash = "sha256-/FxX1Tl393X/KheBG5aFFhdgKDUhRkd7Ge032P0ZE64=";
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index e2d9842ca4f2..70f85c47c2ed 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-07-02";
+  version = "2024-07-05";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     rev = "refs/tags/${version}";
-    hash = "sha256-lgnuUsIbRDtI5/KA9EBJxNfDTel/1+7VjLLMAoB0il0=";
+    hash = "sha256-+AnEOOzpF3fRb/kCDVO4fE0ZUpakyUCtpW0rXpcVPYY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f764648ae7d6..914324d07b82 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2487,6 +2487,8 @@ self: super: with self; {
 
   construct-classes = callPackage ../development/python-modules/construct-classes { };
 
+  construct-typing = callPackage ../development/python-modules/construct-typing { };
+
   consul = callPackage ../development/python-modules/consul { };
 
   container-inspector = callPackage ../development/python-modules/container-inspector { };
@@ -3928,6 +3930,8 @@ self: super: with self; {
 
   epson-projector = callPackage ../development/python-modules/epson-projector { };
 
+  eq3btsmart = callPackage ../development/python-modules/eq3btsmart { };
+
   equinox = callPackage ../development/python-modules/equinox { };
 
   eradicate = callPackage ../development/python-modules/eradicate { };