diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 74666cb9244f..5b75b7ecde11 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -272,6 +272,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `mongodb-4_4` has been removed as it has reached end of life. Consequently, `unifi7` and `unifi8` now use MongoDB 5.0 by default.
 
+- `mongodb-5_0` and newer requires a cpu with the avx instruction set to run.
+
 - `nitter` requires a `guest_accounts.jsonl` to be provided as a path or loaded into the default location at `/var/lib/nitter/guest_accounts.jsonl`. See [Guest Account Branch Deployment](https://github.com/zedeus/nitter/wiki/Guest-Account-Branch-Deployment) for details.
 
 - `boot.supportedFilesystems` and `boot.initrd.supportedFilesystems` are now attribute sets instead of lists. Assignment from lists as done previously is still supported, but checking whether a filesystem is enabled must now by done using `supportedFilesystems.fs or false` instead of using `lib.elem "fs" supportedFilesystems` as was done previously.
@@ -354,7 +356,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `optparse-bash` is now dropped due to upstream inactivity. Alternatives available in Nixpkgs include [`argc`](https://github.com/sigoden/argc), [`argbash`](https://github.com/matejak/argbash), [`bashly`](https://github.com/DannyBen/bashly) and [`gum`](https://github.com/charmbracelet/gum), to name a few.
 
-- `kanata` package has been updated to v1.6.0, which includes breaking changes.  Check out the changelog of [v1.5.0](https://github.com/jtroo/kanata/releases/tag/v1.5.0) and [v1.6.0](https://github.com/jtroo/kanata/releases/tag/v1.6.0) for details.
+- `kanata` package has been updated to v1.6.1, which includes breaking changes.  Check out the changelog of [v1.5.0](https://github.com/jtroo/kanata/releases/tag/v1.5.0) and [v1.6.0](https://github.com/jtroo/kanata/releases/tag/v1.6.0) for details.
 
 - `craftos-pc` package has been updated to v2.8, which includes [breaking changes](https://github.com/MCJack123/craftos2/releases/tag/v2.8).
   - Files are now handled in binary mode; this could break programs with embedded UTF-8 characters.
diff --git a/pkgs/applications/accessibility/wvkbd/default.nix b/pkgs/applications/accessibility/wvkbd/default.nix
index d74790c2f1bd..a918797e2de2 100644
--- a/pkgs/applications/accessibility/wvkbd/default.nix
+++ b/pkgs/applications/accessibility/wvkbd/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wvkbd";
-  version = "0.14.4";
+  version = "0.15";
 
   src = fetchFromGitHub {
     owner = "jjsullivan5196";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1ySKsWgSCqsWV0RnR+wZt7+hWVWUqXrQLd1H6FqYzc8=";
+    sha256 = "sha256-9gDxMH1hghqjcXlbda7CHjDdjcjApjjie7caihKIg9M=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/blockchains/sparrow/default.nix b/pkgs/applications/blockchains/sparrow/default.nix
index 8552d12bc9bf..d1d78d50c922 100644
--- a/pkgs/applications/blockchains/sparrow/default.nix
+++ b/pkgs/applications/blockchains/sparrow/default.nix
@@ -1,4 +1,5 @@
 { stdenv
+, stdenvNoCC
 , lib
 , makeWrapper
 , fetchurl
@@ -17,17 +18,54 @@
 , hwi
 , imagemagick
 , gzip
+, gnupg
 }:
 
 let
   pname = "sparrow";
-  version = "1.8.4";
+  version = "1.9.0";
 
   src = fetchurl {
     url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}-x86_64.tar.gz";
-    sha256 = "0w6z84w9spwfpqrf5m9bcq30xqp94c27jw3qzxfdyisp8n22xvd8";
+    sha256 = "sha256-UbFijiPOfVuJP9q6S5odkrhLJ2BUResbJK09Dn9PyCw=";
+
+    # nativeBuildInputs, downloadToTemp, and postFetch are used to verify the signed upstream package.
+    # The signature is not a self-contained file. Instead the SHA256 of the package is added to a manifest file.
+    # The manifest file is signed by the owner of the public key, Craig Raw.
+    # Thus to verify the signed package, the manifest is verified with the public key,
+    # and then the package is verified against the manifest.
+    # The public key is obtained from https://keybase.io/craigraw/pgp_keys.asc
+    # and is included in this repo to provide reproducibility.
+    nativeBuildInputs = [ gnupg ];
+    downloadToTemp = true;
+
+    postFetch = ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=$PWD/gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      ln -s ${manifest} ./manifest.txt
+      ln -s ${manifestSignature} ./manifest.txt.asc
+      ln -s $downloadedFile ./${pname}-${version}-x86_64.tar.gz
+      gpg --import ${publicKey}
+      gpg --verify manifest.txt.asc manifest.txt
+      sha256sum -c --ignore-missing manifest.txt
+      popd
+      mv $downloadedFile $out
+    '';
   };
 
+  manifest = fetchurl {
+    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}-manifest.txt";
+    sha256 = "sha256-x50wkQKlh7r4PM5YwhQaz6tnJpByQDMAmYsp1HafX2c=";
+  };
+
+  manifestSignature = fetchurl {
+    url = "https://github.com/sparrowwallet/${pname}/releases/download/${version}/${pname}-${version}-manifest.txt.asc";
+    sha256 = "sha256-Nb5tQogQFMObd+nR/eUpEFUoCh1AnTX3s/jICJbvqqo=";
+  };
+
+  publicKey = ./publickey.asc;
+
   launcher = writeScript "sparrow" ''
     #! ${bash}/bin/bash
     params=(
@@ -74,7 +112,7 @@ let
     exec ${tor}/bin/tor "$@"
   '';
 
-  jdk-modules = stdenv.mkDerivation {
+  jdk-modules = stdenvNoCC.mkDerivation {
     name = "jdk-modules";
     nativeBuildInputs = [ openjdk ];
     dontUnpack = true;
@@ -95,7 +133,7 @@ let
     '';
   };
 
-  sparrow-modules = stdenv.mkDerivation {
+  sparrow-modules = stdenvNoCC.mkDerivation {
     pname = "sparrow-modules";
     inherit version src;
     nativeBuildInputs = [ makeWrapper gzip gnugrep openjdk autoPatchelfHook stdenv.cc.cc.lib zlib ];
@@ -150,7 +188,6 @@ let
       # with one from Nixpkgs.
       gzip -c ${torWrapper}  > tor.gz
       cp tor.gz modules/kmp.tor.binary.linuxx64/kmptor/linux/x64/tor.gz
-      find modules
     '';
 
     installPhase = ''
@@ -162,7 +199,7 @@ let
     '';
   };
 in
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   inherit version src;
   pname = "sparrow-unwrapped";
   nativeBuildInputs = [ makeWrapper copyDesktopItems ];
@@ -180,7 +217,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  sparrow-icons = stdenv.mkDerivation {
+  sparrow-icons = stdenvNoCC.mkDerivation {
     inherit version src;
     pname = "sparrow-icons";
     nativeBuildInputs = [ imagemagick ];
@@ -212,8 +249,6 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  passthru.updateScript = ./update.sh;
-
   meta = with lib; {
     description = "A modern desktop Bitcoin wallet application supporting most hardware wallets and built on common standards such as PSBT, with an emphasis on transparency and usability.";
     homepage = "https://sparrowwallet.com";
diff --git a/pkgs/applications/blockchains/sparrow/publickey.asc b/pkgs/applications/blockchains/sparrow/publickey.asc
new file mode 100644
index 000000000000..c053995b68eb
--- /dev/null
+++ b/pkgs/applications/blockchains/sparrow/publickey.asc
@@ -0,0 +1,90 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: GPGTools - http://gpgtools.org
+
+mQINBF2V8eEBEADmjYzGOpxEI0J7jQ1qFzlsrjF6NaBSq+UqKwPOL917pvI/8b/d
+bI1gLV1kgIMAnwf3/JWkF4Ind0pk3g3Vj/jzTYg/ePSwjAhvhowoDo4va+AtV066
+tRf3FjQYFCWR6ccN4zxmQxZ9QPOp4XIcXwu7Ce+ORRRiU9gkWXfiU64pmpzH89gz
+LF35r+98+d9Ov6nAPhRSUlj+vk85mu6Lk8J26srHKWB7iXat1rl4lEAPpFtyvU6L
+oO5XZoRPvXce3mByyuh8SDYTr6GVYjfPHWPaxcGrS/qTe2RCn3ec3xWSGT/U4xH0
+TwagphjxlSnpeHDxZXG6wpgyVEcjpQ1M9hIK7z1G+SHuW4EoyaZf2llTsNbKvbV8
+UOao6g5uAYeLQyBJPKExocNj7+DvbNrpRXYy1levrWtnkNS/oPx3wJgxeXL55uXC
+MCcc5X5T6GNNAtBubAxtYRt65Q6Lvga7v6dWTDtvwufxfjtXZGFO/Hut4wS6IyTt
+77i4GB/WeAQGGhPHGssVECd80u7/DEZ1EMcfTexsDJ9T1ZeM6orvAQ3i2DGdoiYt
+/pJPd2g0LE1Q0HhSVC74JP0pUPJ7V/nzBVPXbYQTQWxESce+NUpnONs2uW+XNSxb
+i0PoUwyDZsRQ7SZJZuOStBWqUXC8TUoGtkaRQHtBgumW0zHasgShVpkU+wARAQAB
+tCNDcmFpZyBSYXcgPGNyYWlnQHNwYXJyb3d3YWxsZXQuY29tPokCVAQTAQoAPgIb
+AwULCQgHAwUVCgkICwUWAgMBAAIeBQIXgBYhBNTQ0yAvwGhJolezjelGGDNMZ0tA
+BQJlCacEBQkO+IMiAAoJEOlGGDNMZ0tAMZ0QAJtLTl8n/H2nn3nnuHMV18lLya+F
+92/7Q5cSls+EPDzmhZnOY13aVlzL0y9++snRA6QrajyF5pxk5/t6OUcztg9PSSzz
+dJ4SrjqF7nxSWXAybQLSWK0NmAZGC4cCkHuFwOOpTYTsGjUH0lMnvGF7PllQK0L7
+8zKrNUpHHLWpkPBHfJEnGbv3XVG4DVWfdTAmpgSP/Lma3qRs5TRlr4pWbCQxUjd3
+8QCw25PGT4xQ9g/yCWY1rBq2x7MzHsiuNmd/qCuwcXiSCChrlGUUVYWwp7FXkVFq
+9wIJB7lYxOKbrwL8KcA2jQL0ZH9421+xfThCruMEnb3fPiW7y5VAbJKNLvk+WHa6
+Vfj12+R3a3ZM2P8iExS6+d04xM0AXK4J5bIcpFW0D8GdjJyED6I7cAPF723xSws1
+t9RD1rVslOlCvOJtoqATuWqGoTVAR4cdpdpnTywKZpjQowLdIcUPbW58zJQxmONh
+vXoTzqvhQV2b9wRlrT+8gwlYmGh+P+xpR8nlHD7GQWoUC/mfWm4w6rMfX6xHBylC
+SHB+teH+9lqUaefbbxKQlAbLL+3q7M4O4Dx224OZBvRN7MFnvBWJimhj8n7lJwfY
+Pl7l/ZENqigiosH5XPLIXE8WhbT2SLh9a2Lp+qH8xrEcsUlUST+F0gE9qawTTl9X
+RGfvr16YhNpScpBptB5DcmFpZyBSYXcgPGNyYWlncmF3QGdtYWlsLmNvbT6JAjYE
+MAEKACAWIQTU0NMgL8BoSaJXs43pRhgzTGdLQAUCZQmpwgIdIAAKCRDpRhgzTGdL
+QNX9D/4kl6JOsL4/P88m8i3SYW1N+FzCrr486Ak8zmfoPjtoSytk0+QIsjb5Esn4
+ltU2UD7MPoPplky3TykNUbVqPr1LtSoabbxOOpz3kpHgkYN2KvH6Bv2H81kBF0k9
+a8XYY92/73q7n7QiMmm6SNm0LO0QvHRu5KoCVQ+FyeLu4h4UqpK0RWtjIUUo6whO
+hXO1ZkkAcV38gewbU92bQBnhLxQNm/EHs9g3Dx+dmhmym4yn0sfNxX+4MsLNMa6E
+jcQ0YF+EgrQk9r8MF3NtPPFfzxswOThXNlEzie5ETAqcouT6mnlfTnB8UL4wjBoP
+GueatUqvtO99RUZbM2otZdz1bBAmOQ/R92wcqsC46zY+PdIXX3YuiGVEfZHjuAU7
+3FlajlZeWvp2NgZzLHFAjjWt67IeYkvfsv4bvq9EANXebI0Srq/g0o2Ego+kfBsZ
+Ca+2jMgxo9+6X69+WJEe46G9bHatpl2dStylgWRhroEbkV83bIFwwE8Q9QOX4uJW
+FB16kl/qTuBiG/rDgVT8eZuCYJXFKQtgPoslEramQuURyUfKFrOAyL7mQHHGSZab
+mgI8kKI//DvTD3t/BspikmdgZLQL4zoXKIFFPuES+TQO+BHoB+TikjZC81mcyZOX
+Sh+Eg21pO3B+HMOXkpv0aj3ZCUt55hslWUom8huQxY7sUdg4KIkCNgQwAQoAIBYh
+BNTQ0yAvwGhJolezjelGGDNMZ0tABQJlCaa2Ah0gAAoJEOlGGDNMZ0tA4uYQAJuP
+GEiE6/XO10lG8feXk5EIpTgFT8XiF7/CEFrGdPOgb/2HQ2G0QXGfrYI5VTJPdgsG
+Mj2JgTcFX12fyKvGpb0HXMdvqNEtNUV4z5wrhUkItPFF4wJ2YAeFuJpdgsTU3RYL
+mct30Dcr79M0JSsOO3erjAqsMj+GlTWbHMEzM86regfe0KTU9f4G8DIYRoM+Zu3E
+P3BgpKm2miyEW++vuK+/Q+cWPSi7ztRPQ9CoswPb/xEFuxnzRCbdmwGqRUJzFfQJ
+3uMTSt5JACn1mn/Bojn8IcAhCKJsBNL3MHAqkJVPdzzQhsr2z0bevVBhhbBabaub
+zbFOIHluSge5/IGr7bFjldql/UflYavrV1+aH2CzI/YEgBxZZoIgYl9N5n+vO1GI
+Xn39axQ4Lhf7mJc5Y89ojZkhT7sHgpCceyzsFWrBrcLXhhFCafTBcVQd+U1xk5Xf
+SV+3TTbWz1woIzVJ6ef5wUYI0qZBuXDef6kIEBnFUwbn5Iu834NtthSkam9LeDcJ
+NDISaoCOd+cRgKSTrGkLEIF7hzlF901S/jTDDaKGs9JnruhokxjmyxJvFcowP4Lo
+O8J+782+e1QiL49M97tvnYwzLU/iGieG6kWgQcJHVy5ZJdDNMfkZMNR6Ek4dzBVQ
+c5pgVp882o9l61xdCQq6o/oSBSCbOGe8Ujr1tGpXiQJUBBMBCgA+AhsDBQsJCAcD
+BRUKCQgLBRYCAwEAAh4BAheAFiEE1NDTIC/AaEmiV7ON6UYYM0xnS0AFAmUJpwMF
+CQ74gyIACgkQ6UYYM0xnS0Dnww//fMTpZ66XJK15CqbqqFHOlkneoV/X2Oo1CN/t
+qIiG6s1TMA/ZwF1dmHSZh46tAd2TK0qTxR4kxXlVq5oO5HbzIA9n/hvJJA8ZXk3g
+QieX4L5uITdHmAzChhf0N0jAQT8Oe72SocRMgPCI8c3ZKhBHYqI1PCTUSQKD6+dS
+D0zHGZhtPJctDBJGVDCT8jaS4JeDVBU0UijzxLo6qkZvSIXoTxjQHQILFZq4biCs
+2gLQ6aJ870TtQz/PiZkL+o5XImY+nPoAyEIC+mDSgO4kb5ELJ5U66vDMpR75FFpW
+t/wU0/0q7W9wIzifdRuctVDyh88/5ycg4zrVyX0PmNrx27EGIhL1sEPfLnzMU7am
+FqffWVtjvWrPtOiJE6vYRZA1IhallNY1eVI2NcEAj3+gSUsQx5rl7loP+axB7eSM
+BKNUBlTptKrCMCWiYVrIFHDG7rHpNc/8G7mpjQCZtUyTNfRG87991JI9nAXHqntr
+Slvr2t1TBaNkJQn06/Vx4StR8dNHvN09OzmriPibjxVXfW1fbiPD8mNPM1q1ll37
+15IaZJLJfxA0tz5hhK1J9/asM80GMRfJmbGprZqkbDEFoi4QlLGJfYM5YeHi/TKB
+j0IBS7Kh0rZ0y2YpwYRGJjeL+RMwRdbFV0vIayyZ8AS6mXbYVFfpgDnQQ2mJUkm2
+XNpucCm5Ag0EXZXx4QEQAMkaRHXCSMDjBJ+7hQp5+OW7vhRb3jJ5RvveGJpMaV9z
+/6UTo+VhI1AzkKKFZ/gwk7fJWm5cuE9fA6rc+h5eHbTtDkcPxAQk58YJyNdKj1t+
+XncvU3Nhb8C/+cChQrnxAlQeFeSk2VUnxh7eTU4jwZo89N+cLJCzz0gIBbmOtTS6
+zcdVaAhi0ePmD496kFxOz0ccGtukeXE38VdUM5PfSSEE8Cy+pokgFjyUSXBefW9u
+XsETpw12KvF6xBizFYBTsMmGQQqxtk5bO/bQly61798gcFsxnrMPxBDyENJPkNEJ
+s7tdCWEQB2dA8BZw7tN7sItVQabTmz4gUlmRSfsZfZbNZy7nL3zIBXRBZ6I9OPOp
+m7BCUlOEQgJQru3RJdfnFVaNUURTd0Up+t+lACuUXXuMlrDbjAFlIGN0YR86JN6b
+yAv2s9V5U/3R6QV50BRkj1qQehwUKRQYNMMeSs0I63zHgWOLjXwqr1O0U2/x+8o+
++UOUVCvsicQcl2CDLbC4C+xntZSKUwYmWtAWjkiDp5Fk2Fxyj9vK5TSym+ur3AAH
+gZVugkoM5yMhiOIJVPKGB1aAnQNmQVYREEpJBTtFqbURraqObqiHKPF6MKAL+AW4
+jv2Lms0gJ2S5rSmP/Zi0CiABYg1pppojYlrHp1vXb251o7WlPgwf6nKKLTi8byTN
+ABEBAAGJAjwEGAEKACYCGwwWIQTU0NMgL8BoSaJXs43pRhgzTGdLQAUCZQmnLAUJ
+DviDSwAKCRDpRhgzTGdLQNAwD/0ThrnXqwZ+dyFK4M73nqSXwWjED/xHAQYmrEAr
+kVoox3GZYlTFlQlCQZTi+yOsrFdiP7EfWM8jbc6BqEh4fhn1f+wUIiZQELl+6M/U
+rHrPz5h4c9rD/+M62awPa6HdauaHkUrF3nAax9EOTVQJvxKLpuaE9Ki9p2ZMEQOK
+HakTDtLL2BeXiJG1I/SH1thBPuGL4hReY8qrj0ryYMrlYdu7l+RJrQUemLVD/eQI
+S8MqH8E5HjZKS7QNSCEEeHgFw1Yu28C+AnjHQHS5gDugw8ire/NetFxI8Wx5nOOU
+oCRR3P1U5IFWqj+Yukc3rB0z9+kSK3cic1jdCRy26JYxz9xuBbAqcnKoGtrB3HVI
+Y2pdQKN4kTpifGDriSEe6epuEvvObBovYJE3lc4AWr8VNFJd4UYphJ/9Px+5xajo
+ZBicNI9pGq0gTDuBb+tBwTt2dw8tFSCLyJ+C1dFRZX8NM3FlnpjeJQb7SCcLT4PZ
+h4+CyElfF/HkcVZHjjanpXZdP91clgmRidnlDBQ07BmaTgvxdlkwHJFGqGcuZn1A
+y1p23CECTYiFxFxgMvVjNHSPSyrEnNC0ash+BIGuxvYfm/7CioThFXw9TbwQXn6C
+IsgINPAvnKVmW6Ui0jLvtlIWV/TW2yDFjPoC2ilVexwt9QdvtBf5baT8GCilb5Yo
+EmR2yA==
+=t5JY
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/pkgs/applications/blockchains/sparrow/update.sh b/pkgs/applications/blockchains/sparrow/update.sh
deleted file mode 100755
index 7a520b351aa4..000000000000
--- a/pkgs/applications/blockchains/sparrow/update.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq gnused gnupg common-updater-scripts
-
-set -eu -o pipefail
-
-version="$(curl -s https://api.github.com/repos/sparrowwallet/sparrow/releases| jq '.[] | {name} | limit(1;.[])' | sed 's/[\"v]//g' | head -n 1)"
-depname="sparrow-$version-x86_64.tar.gz"
-src_root="https://github.com/sparrowwallet/sparrow/releases/download/$version";
-src="$src_root/$depname";
-manifest="$src_root/sparrow-$version-manifest.txt"
-signature="$src_root/sparrow-$version-manifest.txt.asc"
-key="D4D0 D320 2FC0 6849 A257 B38D E946 1833 4C67 4B40"
-
-pushd $(mktemp -d --suffix=-sparrow-updater)
-export GNUPGHOME=$PWD/gnupg
-mkdir -m 700 -p "$GNUPGHOME"
-curl -L -o "$depname" -- "$src"
-curl -L -o manifest.txt -- "$manifest"
-curl -L -o signature.asc -- "$signature"
-gpg --batch --recv-keys "$key"
-gpg --batch --verify signature.asc manifest.txt
-sha256sum -c --ignore-missing manifest.txt
-sha256=$(nix-prefetch-url --type sha256 "file://$PWD/$depname")
-popd
-
-update-source-version sparrow-unwrapped "$version" "$sha256"
diff --git a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
index 70f4cbd833de..8ed7c0b946b4 100644
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
@@ -67,7 +67,7 @@ let
       cp $out/lib/* $out/share/adapter
       cp -r adapter/scripts $out/share/adapter
       cp -t $out/share/formatters formatters/*.py
-      ln -s ${lldb.lib} $out/share/lldb
+      ln -s ${lib.getLib lldb} $out/share/lldb
       makeWrapper $out/share/adapter/codelldb $out/bin/codelldb \
         --set-default LLDB_DEBUGSERVER_PATH "${lldb.out}/bin/lldb-server"
     '';
diff --git a/pkgs/applications/graphics/emulsion/default.nix b/pkgs/applications/graphics/emulsion/default.nix
index 323920ff4deb..67342c57c846 100644
--- a/pkgs/applications/graphics/emulsion/default.nix
+++ b/pkgs/applications/graphics/emulsion/default.nix
@@ -37,16 +37,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "emulsion";
-  version = "10.5";
+  version = "11.0";
 
   src = fetchFromGitHub {
     owner = "ArturKovacs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Wrb5jHr2rXDpXF/uHpNLKSc//Xdj0/VsXQcytit0hKY=";
+    sha256 = "sha256-0t+MUZu1cvkJSL9Ly9kblH8fMr05KuRpOo+JDn/VUc8=";
   };
 
-  cargoHash = "sha256-zfR4sp/AmK3+UcFdqMMZE9O9+oGathqmuqFw11SmUWI=";
+  cargoHash = "sha256-detJZRnxT3FubaF/A4w2pFdhW03BH0gsaeuNFYu+cBw=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/applications/misc/cartridges/default.nix b/pkgs/applications/misc/cartridges/default.nix
index 008004aa3c8e..6481805cc996 100644
--- a/pkgs/applications/misc/cartridges/default.nix
+++ b/pkgs/applications/misc/cartridges/default.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cartridges";
-  version = "2.7.4";
+  version = "2.8.4";
 
   src = fetchFromGitHub {
     owner = "kra-mo";
     repo = "cartridges";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-AfO+vLJSWdaMqqbzRZWrY94nu/9BM7mqdad9rkiq1pg=";
+    hash = "sha256-x6utIvU4LxM/CJogy5JrFrDTLFmXbgItgqtT+lM7FGA=";
   };
 
   pythonPath = with python3Packages; [
@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
       and more with no login necessary.
       You can sort and hide games or download cover art from SteamGridDB.
     '';
-    homepage = "https://apps.gnome.org/app/hu.kramo.Cartridges/";
+    homepage = "https://apps.gnome.org/Cartridges/";
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.getchoo ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/misc/gpu-viewer/default.nix b/pkgs/applications/misc/gpu-viewer/default.nix
index 18a8f5396689..329babc36c68 100644
--- a/pkgs/applications/misc/gpu-viewer/default.nix
+++ b/pkgs/applications/misc/gpu-viewer/default.nix
@@ -19,7 +19,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gpu-viewer";
-  version = "3.02";
+  version = "3.04";
 
   format = "other";
 
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "arunsivaramanneo";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-/m8kXCICvWDqKIC6DbhUAXsjT+RNLMTsvlVTx85AJhE=";
+    hash = "sha256-+FDBHSVBTUHnhu2n7i9W1zIZe2wjY+OuFwQOJZojuzs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/nwg-displays/default.nix b/pkgs/applications/misc/nwg-displays/default.nix
index e014100f45c5..bedc06bd333c 100644
--- a/pkgs/applications/misc/nwg-displays/default.nix
+++ b/pkgs/applications/misc/nwg-displays/default.nix
@@ -14,13 +14,13 @@
 
 python310Packages.buildPythonApplication rec {
   pname = "nwg-displays";
-  version = "0.3.16";
+  version = "0.3.18";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-displays";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rnaBYDGEsc8oGw4yZ60NQFbNf+L0tmHYDYf+UDoDmSI=";
+    hash = "sha256-wf72x3lXNAJ6Y4zJmYgwJrL1gWJBvTYUcXasT5zlXCM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/nwg-dock-hyprland/default.nix b/pkgs/applications/misc/nwg-dock-hyprland/default.nix
index 19003c66a675..ff0a57b07555 100644
--- a/pkgs/applications/misc/nwg-dock-hyprland/default.nix
+++ b/pkgs/applications/misc/nwg-dock-hyprland/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "nwg-dock-hyprland";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Lekvk3tQfeOR+Ltbc5b7TMiUZpktZ2nvCtUncrFb+Kc=";
+    sha256 = "sha256-cdNxaOnm98RcPG2o0GaBETpd+Zo2nlgrFv+2PiHOwUI=";
   };
 
-  vendorHash = "sha256-5fN/6HASfTMb80YYAIoWRqnRGMvvX4d8C2UvOc0jQU0=";
+  vendorHash = "sha256-JEzc950c4EGOYMLgpL8PXENkGlWSX8Z4A4jCx1B99X8=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/misc/rofi-rbw/default.nix b/pkgs/applications/misc/rofi-rbw/default.nix
index 9e3df3fc3667..f4cbf40e3d07 100644
--- a/pkgs/applications/misc/rofi-rbw/default.nix
+++ b/pkgs/applications/misc/rofi-rbw/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonApplication rec {
   pname = "rofi-rbw";
-  version = "1.4.0";
+  version = "1.4.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "fdw";
     repo = "rofi-rbw";
     rev = "refs/tags/${version}";
-    hash = "sha256-1xbdZlZa3YPz+33AMgvhiMO12vc/ej0RybypQUzEn+8=";
+    hash = "sha256-wUb89GkNB2lEfb42hMvcxpbjc1O+wx8AkFjq7aJwAko=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/yandex-browser/default.nix b/pkgs/applications/networking/browsers/yandex-browser/default.nix
index d5f761c3b1f8..51b662f0ef36 100644
--- a/pkgs/applications/networking/browsers/yandex-browser/default.nix
+++ b/pkgs/applications/networking/browsers/yandex-browser/default.nix
@@ -54,15 +54,15 @@
 
 let
   version = {
-    corporate = "23.11.1.822-1";
-    beta = "24.1.1.939-1";
-    stable = "24.1.1.940-1";
+    corporate = "24.1.3.843-1";
+    beta = "24.4.1.918-1";
+    stable = "24.4.1.915-1";
   }.${edition};
 
   hash = {
-    corporate = "sha256-OOcz2dQeVea0vBjF1FyrCsnRR+WrCzfLTd+YXpLJCsI=";
-    beta = "sha256-Meswp1aeNTBr79l7XGWqJT9qqUdOfSzIpdL1L29UfJw=";
-    stable = "sha256-FZHoCRedpHHVwibSXts2DncUN83PZ9UlVOSXPjgAaNs=";
+    corporate = "sha256-rI19YmsC2p2Dsi6Grd8IyNdpjMHWwET3wcVw5r7545M=";
+    beta = "sha256-EQjjaTMPQKaULITEF+MQuY1lRVXuOjyiGWuGQtIpIz0=";
+    stable = "sha256-2IIIADFG9kCtzB0X4AfrFI+btqoUzKwd6NlZt7qtL/M=";
   }.${edition};
 
   app = {
diff --git a/pkgs/applications/networking/cluster/k3s/1_27/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_27/chart-versions.nix
index 1acca4d0e101..7595645c35b5 100644
--- a/pkgs/applications/networking/cluster/k3s/1_27/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_27/chart-versions.nix
@@ -1,10 +1,10 @@
 {
     traefik-crd  = {
-        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.2+up25.0.0.tgz";
-        sha256 = "0jygzsn5pxzf7423x5iqfffgx5xvm7c7hfck46y7vpv1fdkiipcq";
+        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.3+up25.0.0.tgz";
+        sha256 = "1z693i4kd3jyf26ccnb0sxjyxadipl6k13n7jyg5v4y93fv1rpdw";
     };
     traefik = {
-        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.2+up25.0.0.tgz";
-        sha256 = "1g9n19lnqdkmbbr3rnbwc854awha0kqqfwyxanyx1lg5ww8ldp89";
+        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.3+up25.0.0.tgz";
+        sha256 = "1a24qlp7c6iri72ka1i37l1lzn13xibrd26dy295z2wzr55gg7if";
     };
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_27/versions.nix b/pkgs/applications/networking/cluster/k3s/1_27/versions.nix
index 928337553966..508ef6c4139d 100644
--- a/pkgs/applications/networking/cluster/k3s/1_27/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_27/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.27.12+k3s1";
-  k3sCommit = "78ad57567c9eb1fd1831986f5fd7b4024add1767";
-  k3sRepoSha256 = "1j6xb3af4ypqq5m6a8x2yc2515zvlgqzfsfindjm9cbmq5iisphq";
-  k3sVendorHash = "sha256-65cmpRwD9C+fcbBSv1YpeukO7bfGngsLv/rk6sM59gU=";
+  k3sVersion = "1.27.13+k3s1";
+  k3sCommit = "b23f142da8589854cc7ee45da08d96b5ad1ee1ff";
+  k3sRepoSha256 = "052998644il0qra7cdpvmy007gw16k2rvyg418m1j02pm9a3zn10";
+  k3sVendorHash = "sha256-rQZZnleRekkU1+I38LmFnnatZPuS+K1jbBwA+Dmc0jo=";
   chartVersions = import ./chart-versions.nix;
   k3sRootVersion = "0.12.2";
   k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.11-k3s2.27";
-  containerdSha256 = "0xjxc5dgh3drk2glvcabd885damjffp9r4cs0cm1zgnrrbhlipra";
+  containerdVersion = "1.7.15-k3s1.27";
+  containerdSha256 = "0bjxw174prhq8izmgrmpyljfxzrj0lh5d0w04g3lyn0rp3kwxqsl";
   criCtlVersion = "1.26.0-rc.0-k3s1";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_28/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_28/chart-versions.nix
index 1acca4d0e101..7595645c35b5 100644
--- a/pkgs/applications/networking/cluster/k3s/1_28/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_28/chart-versions.nix
@@ -1,10 +1,10 @@
 {
     traefik-crd  = {
-        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.2+up25.0.0.tgz";
-        sha256 = "0jygzsn5pxzf7423x5iqfffgx5xvm7c7hfck46y7vpv1fdkiipcq";
+        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.3+up25.0.0.tgz";
+        sha256 = "1z693i4kd3jyf26ccnb0sxjyxadipl6k13n7jyg5v4y93fv1rpdw";
     };
     traefik = {
-        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.2+up25.0.0.tgz";
-        sha256 = "1g9n19lnqdkmbbr3rnbwc854awha0kqqfwyxanyx1lg5ww8ldp89";
+        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.3+up25.0.0.tgz";
+        sha256 = "1a24qlp7c6iri72ka1i37l1lzn13xibrd26dy295z2wzr55gg7if";
     };
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
index b8e68bb87740..67991dfd6fc7 100644
--- a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.28.8+k3s1";
-  k3sCommit = "653dd61aaa2d0ef8bd83ac4dbc6d150dde792efc";
-  k3sRepoSha256 = "0pf8xw1m56m2s8i99vxj4i2l7fz7388kiynwzfrck43jb7v7kbbw";
-  k3sVendorHash = "sha256-wglwRW2RO9QJI6CRLgkVg5Upt6R0M3gX76zy0kT02ec=";
+  k3sVersion = "1.28.9+k3s1";
+  k3sCommit = "289a1a3edbc0f6ee5a7f91bf96aa1ed1b743bd1f";
+  k3sRepoSha256 = "0kms6r10k6v037r5lxxrp90bnynrgyrn61kqnzy2f5avny4blikh";
+  k3sVendorHash = "sha256-iUp2Maua3BnrC4Jq2ij0uOW5gYYZfz6e+TEdDtN0PT8=";
   chartVersions = import ./chart-versions.nix;
   k3sRootVersion = "0.12.2";
   k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.11-k3s2";
-  containerdSha256 = "0279sil02wz7310xhrgmdbc0r2qibj9lafy0i9k24jdrh74icmib";
+  containerdVersion = "1.7.15-k3s1";
+  containerdSha256 = "18hlj4ixjk7wvamfd66xyc0cax2hs9s7yjvlx52afxdc73194y0f";
   criCtlVersion = "1.26.0-rc.0-k3s1";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_29/chart-versions.nix
index 1acca4d0e101..7595645c35b5 100644
--- a/pkgs/applications/networking/cluster/k3s/1_29/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_29/chart-versions.nix
@@ -1,10 +1,10 @@
 {
     traefik-crd  = {
-        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.2+up25.0.0.tgz";
-        sha256 = "0jygzsn5pxzf7423x5iqfffgx5xvm7c7hfck46y7vpv1fdkiipcq";
+        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.3+up25.0.0.tgz";
+        sha256 = "1z693i4kd3jyf26ccnb0sxjyxadipl6k13n7jyg5v4y93fv1rpdw";
     };
     traefik = {
-        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.2+up25.0.0.tgz";
-        sha256 = "1g9n19lnqdkmbbr3rnbwc854awha0kqqfwyxanyx1lg5ww8ldp89";
+        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.3+up25.0.0.tgz";
+        sha256 = "1a24qlp7c6iri72ka1i37l1lzn13xibrd26dy295z2wzr55gg7if";
     };
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
index cf1f57e0fe60..31dd51fa9ca6 100644
--- a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix
@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.29.3+k3s1";
-  k3sCommit = "8aecc26b0f167d5e9e4e9fbcfd5a471488bf5957";
-  k3sRepoSha256 = "12285mhwi6cifsw3gjxxmd1g2i5f7vkdgzdc6a78rkvnx7z1j3p3";
-  k3sVendorHash = "sha256-pID2h/rvvKyfHWoglYPbbliAby+9R2zoh7Ajd36qjVQ=";
+  k3sVersion = "1.29.4+k3s1";
+  k3sCommit = "94e29e2ef5d79904f730e2024c8d1682b901b2d5";
+  k3sRepoSha256 = "0kkhd2fnlmjanzvwgdclmbg6azw3r1a2lj5207716pavxmb9ld7y";
+  k3sVendorHash = "sha256-wOX+ktGPFYUKLZBK/bQhWWG+SnRCkNYnk3Tz8wpMo5A=";
   chartVersions = import ./chart-versions.nix;
-  k3sRootVersion = "0.12.2";
-  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
+  k3sRootVersion = "0.13.0";
+  k3sRootSha256 = "1jq5f0lm08abx5ikarf92z56fvx4kjpy2nmzaazblb34lajw87vj";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.11-k3s2";
-  containerdSha256 = "0279sil02wz7310xhrgmdbc0r2qibj9lafy0i9k24jdrh74icmib";
+  containerdVersion = "1.7.15-k3s1";
+  containerdSha256 = "18hlj4ixjk7wvamfd66xyc0cax2hs9s7yjvlx52afxdc73194y0f";
   criCtlVersion = "1.29.0-k3s1";
 }
diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index b5f017b85b05..e4c7a42fd578 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -30,7 +30,6 @@ lib:
 # It is likely we will have to split out additional builders for additional
 # versions in the future, or customize this one further.
 { lib
-, fetchpatch
 , makeWrapper
 , socat
 , iptables
@@ -56,6 +55,7 @@ lib:
 , sqlite
 , nixosTests
 , pkgsBuildBuild
+, go
 }:
 
 # k3s is a kinda weird derivation. One of the main points of k3s is the
@@ -93,8 +93,9 @@ let
 
   # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
   versionldflags = [
-    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
-    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
+    "-X github.com/k3s-io/k3s/pkg/version.Version=v${k3sVersion}"
+    "-X github.com/k3s-io/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
+    "-X github.com/k3s-io/k3s/pkg/version.UpstreamGolang=go${go.version}"
     "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
     "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
     "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
@@ -185,15 +186,6 @@ let
     src = k3sRepo;
     vendorHash = k3sVendorHash;
 
-    patches =
-      # Disable: Add runtime checking of golang version
-      (fetchpatch {
-        # https://github.com/k3s-io/k3s/pull/9054
-        url = "https://github.com/k3s-io/k3s/commit/b297996b9252b02e56e9425f55f6becbf6bb7832.patch";
-        hash = "sha256-xBOY2jnLhT9dtVKtq26V9QUnuX1q6E/9UcO9IaU719U=";
-        revert = true;
-      });
-
     nativeBuildInputs = [ pkg-config ];
     buildInputs = [ libseccomp sqlite.dev ];
 
diff --git a/pkgs/applications/networking/hpmyroom/default.nix b/pkgs/applications/networking/hpmyroom/default.nix
index a177256432d3..78fdb5077818 100644
--- a/pkgs/applications/networking/hpmyroom/default.nix
+++ b/pkgs/applications/networking/hpmyroom/default.nix
@@ -4,11 +4,11 @@
 }:
 mkDerivation rec {
   pname = "hpmyroom";
-  version = "12.9.0.0601";
+  version = "12.13.0.0749";
 
   src = fetchurl {
     url = "https://www.myroom.hpe.com/downloadfiles/${pname}-${version}.x86_64.rpm";
-    sha256 = "sha256-1BC4EjCCLAuCIOV+jJn3pfKKW7UJI5tfC+wg0FUgB64=";
+    sha256 = "sha256-Ff3j14rC2ZHhNJLPxvKn9Sxyv351HuHbggclwOuFfX4=";
   };
 
   nativeBuildInputs = [
@@ -56,5 +56,6 @@ mkDerivation rec {
     # TODO: A Darwin binary is available upstream
     platforms = [ "x86_64-linux" ];
     mainProgram = "hpmyroom";
+    broken = true; # requires libpng15
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/dino/default.nix b/pkgs/applications/networking/instant-messengers/dino/default.nix
index 19e84a5f3079..428715b6f1b7 100644
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@@ -34,6 +34,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-smy/t6wTCnG0kuRFKwyeLENKqOQDhL0fZTtj3BHo6kw=";
   };
 
+  patches = [
+    # fixes build failure https://github.com/dino/dino/issues/1576
+    # backport of https://github.com/dino/dino/commit/657502955567dd538e56f300e075c7db52e25d74
+    ./fix-compile-new-vala-c.diff
+  ];
+
   postPatch = ''
     # don't overwrite manually set version information
     substituteInPlace CMakeLists.txt \
diff --git a/pkgs/applications/networking/instant-messengers/dino/fix-compile-new-vala-c.diff b/pkgs/applications/networking/instant-messengers/dino/fix-compile-new-vala-c.diff
new file mode 100644
index 000000000000..b8277f32afc9
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/dino/fix-compile-new-vala-c.diff
@@ -0,0 +1,16 @@
+diff --git a/plugins/gpgme-vala/vapi/gpgme_public.vapi b/plugins/gpgme-vala/vapi/gpgme_public.vapi
+index bcf12569..b32efd03 100644
+--- a/plugins/gpgme-vala/vapi/gpgme_public.vapi
++++ b/plugins/gpgme-vala/vapi/gpgme_public.vapi
+@@ -22,9 +22,9 @@ public class Key {
+     public string issuer_name;
+     public string chain_id;
+     public Validity owner_trust;
+-    [CCode(array_null_terminated = true)]
++    [CCode(array_length = false, array_null_terminated = true)]
+     public SubKey[] subkeys;
+-    [CCode(array_null_terminated = true)]
++    [CCode(array_length = false, array_null_terminated = true)]
+     public UserID[] uids;
+     public KeylistMode keylist_mode;
+     // public string fpr; // requires gpgme >= 1.7.0
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index d25f4698f864..e1e3f83d05d5 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240425-1";
+  version = "20240504";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-CulgcWcAX/42jB3kCmxLAFioyNtMJV80dW3ofp7Yw6o=";
+    hash = "sha256-ojV/taYV5J4nHfDg//lJ78ltJv7nIG1H9iXo95nA/n8=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/nextdns/default.nix b/pkgs/applications/networking/nextdns/default.nix
index 7699d5d399c8..0661a3f9db2c 100644
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "nextdns";
-  version = "1.43.0";
+  version = "1.43.3";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${version}";
-    sha256 = "sha256-5aznAAO53EFeq/fap10ARGerKzQAvLx0zOeG6OWkymw=";
+    sha256 = "sha256-sltTvjEfUZsmXDEyN+Zyck7oqZ+Xu8xScNnitt/0eic=";
   };
 
   vendorHash = "sha256-U5LJF1RX0ZS0PhjQTZKXrJo89WPfSZaVbgskWcYNlJY=";
diff --git a/pkgs/applications/radio/fldigi/default.nix b/pkgs/applications/radio/fldigi/default.nix
index abdf52051345..2390a4f8c081 100644
--- a/pkgs/applications/radio/fldigi/default.nix
+++ b/pkgs/applications/radio/fldigi/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fldigi";
-  version = "4.2.04";
+  version = "4.2.05";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-crVeX9vtvn1O5ah1dc74425qUKcozKlDMVeIefMpktY=";
+    hash = "sha256-rBGJ+63Szhy37LQw0LpE2/lLyP5lwK7hsz/uq453iHY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -39,6 +39,8 @@ stdenv.mkDerivation rec {
     libsamplerate
   ] ++ lib.optionals (stdenv.isLinux) [ libpulseaudio alsa-lib udev ];
 
+  env.CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++14";
+
   enableParallelBuilding = true;
 
   meta = with lib; {
@@ -47,8 +49,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ relrod ftrvxmtrx ];
     platforms = platforms.unix;
-    # unable to execute command: posix_spawn failed: Argument list too long
-    # Builds fine on aarch64-darwin
-    broken = stdenv.system == "x86_64-darwin";
   };
 }
diff --git a/pkgs/applications/science/math/eigenmath/default.nix b/pkgs/applications/science/math/eigenmath/default.nix
index feddf92821c6..becf26c61af7 100644
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "0-unstable-2024-04-26";
+  version = "0-unstable-2024-05-03";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "14a55ff60d078b752033b4ae29d332b04b6e8912";
-    hash = "sha256-p7wcLmssTqs3LCkZWB9rhCXEc4IVgZJNBvRhS51oH5E=";
+    rev = "69ebfbaa7f328ddc9d97b7c404369818a5febe4a";
+    hash = "sha256-lHxVyUXIY9+YIStA6202Bhy/b0xaxJbW/VPI7FbNJk0=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
diff --git a/pkgs/applications/science/math/getdp/default.nix b/pkgs/applications/science/math/getdp/default.nix
index d28f59e4be2f..5df35cce8e23 100644
--- a/pkgs/applications/science/math/getdp/default.nix
+++ b/pkgs/applications/science/math/getdp/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "3.6.0";
   src = fetchurl {
     url = "http://getdp.info/src/getdp-${version}-source.tgz";
-    sha256 = "sha256-N1cb72W77Dr+TzeHpLgv5FuFb+SJqyGcfn+kOfEvZgA=";
+    hash = "sha256-nzefwCV+Z9BHDofuTfhR+vhqm3cCSiUT+7cbtn601N8=";
   };
 
   inherit (petsc) mpiSupport;
diff --git a/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix b/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
index 5b8e0078d75c..f71a9dce894f 100644
--- a/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
+++ b/pkgs/applications/terminal-emulators/blackbox-terminal/default.nix
@@ -72,6 +72,9 @@ stdenv.mkDerivation rec {
         rev = "3c8f66be867aca6656e4109ce880b6ea7431b895";
         hash = "sha256-vz9ircmPy2Q4fxNnjurkgJtuTSS49rBq/m61p1B43eU=";
       };
+      postPatch = (old.postPatch or "") + ''
+        patchShebangs src/box_drawing_generate.sh
+      '';
     } // lib.optionalAttrs sixelSupport {
       buildInputs = old.buildInputs ++ [ libsixel ];
       mesonFlags = old.mesonFlags ++ [ "-Dsixel=true" ];
diff --git a/pkgs/applications/version-management/git-cola/default.nix b/pkgs/applications/version-management/git-cola/default.nix
index f7182140e017..0f5fd0cb7aa2 100644
--- a/pkgs/applications/version-management/git-cola/default.nix
+++ b/pkgs/applications/version-management/git-cola/default.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "git-cola";
-  version = "4.6.1";
+  version = "4.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "git-cola";
     repo = "git-cola";
     rev = "v${version}";
-    hash = "sha256-qAvoBVZt2IwrWFNzGWpCZqj8gbjysGlB/VXaa1CMH4o=";
+    hash = "sha256-BiSs3vWJacCtGthHi/nFJm4Hqt0uO6XXZi/Zqvjb928=";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-mute-filter.nix b/pkgs/applications/video/obs-studio/plugins/obs-mute-filter.nix
index 0a98afde99f0..fd683f3a4ccf 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-mute-filter.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-mute-filter.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-mute-filter";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "norihiro";
     repo = "obs-mute-filter";
     rev = version;
-    sha256 = "sha256-SiutSmp+DnzMU62kxtBUL0xgMXTe0k+nKwSU3wQe4+g=";
+    sha256 = "sha256-UVYN9R7TnwD3a+KIYTXvxOQWfNUtR8cSWUoKZuNoBJc=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/window-managers/sommelier/default.nix b/pkgs/applications/window-managers/sommelier/default.nix
index f0b940776128..6c3a04915fe6 100644
--- a/pkgs/applications/window-managers/sommelier/default.nix
+++ b/pkgs/applications/window-managers/sommelier/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation {
   pname = "sommelier";
-  version = "123.0";
+  version = "124.0";
 
   src = fetchzip rec {
     url = "https://chromium.googlesource.com/chromiumos/platform2/+archive/${passthru.rev}/vm_tools/sommelier.tar.gz";
-    passthru.rev = "1abc91204f35cde76db37853ff3643c5cdb607e6";
+    passthru.rev = "0ced021a6b362f35592cca5a3915d0ed784615f2";
     stripRoot = false;
-    sha256 = "Wa30MU7iK1Y7pKNeC+FPFXDwDxFLWOZPG4jkm8cnWeg=";
+    sha256 = "zSiGhF4FhLUavC7YEOGGq4NE2hxK4YNXF3CpLptoZbM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/php/build-composer-project.nix b/pkgs/build-support/php/build-composer-project.nix
index 5a21eda03544..b83734a02f02 100644
--- a/pkgs/build-support/php/build-composer-project.nix
+++ b/pkgs/build-support/php/build-composer-project.nix
@@ -2,11 +2,7 @@
   callPackage,
   stdenvNoCC,
   lib,
-  writeTextDir,
   php,
-  makeBinaryWrapper,
-  fetchFromGitHub,
-  fetchurl,
 }:
 
 let
@@ -75,27 +71,30 @@ let
           runHook postInstallCheck
         '';
 
-      composerRepository = phpDrv.mkComposerRepository {
-        inherit composer composer-local-repo-plugin;
-        inherit (finalAttrs)
-          patches
-          pname
-          src
-          vendorHash
-          version
-          ;
+      composerRepository =
+        previousAttrs.composerRepository or (phpDrv.mkComposerRepository {
+          inherit composer composer-local-repo-plugin;
+          inherit (finalAttrs)
+            patches
+            pname
+            src
+            vendorHash
+            version
+            ;
 
-        composerLock = previousAttrs.composerLock or null;
-        composerNoDev = previousAttrs.composerNoDev or true;
-        composerNoPlugins = previousAttrs.composerNoPlugins or true;
-        composerNoScripts = previousAttrs.composerNoScripts or true;
-        composerStrictValidation = previousAttrs.composerStrictValidation or true;
+          composerLock = previousAttrs.composerLock or null;
+          composerNoDev = previousAttrs.composerNoDev or true;
+          composerNoPlugins = previousAttrs.composerNoPlugins or true;
+          composerNoScripts = previousAttrs.composerNoScripts or true;
+          composerStrictValidation = previousAttrs.composerStrictValidation or true;
+        });
+
+      env = {
+        COMPOSER_CACHE_DIR = "/dev/null";
+        COMPOSER_DISABLE_NETWORK = "1";
+        COMPOSER_MIRROR_PATH_REPOS = "1";
       };
 
-      COMPOSER_CACHE_DIR = "/dev/null";
-      COMPOSER_DISABLE_NETWORK = "1";
-      COMPOSER_MIRROR_PATH_REPOS = "1";
-
       meta = previousAttrs.meta or { } // {
         platforms = lib.platforms.all;
       };
diff --git a/pkgs/build-support/php/build-composer-repository.nix b/pkgs/build-support/php/build-composer-repository.nix
index a5b02fd95e04..ec6c35b8a42c 100644
--- a/pkgs/build-support/php/build-composer-repository.nix
+++ b/pkgs/build-support/php/build-composer-repository.nix
@@ -2,8 +2,6 @@
   callPackage,
   stdenvNoCC,
   lib,
-  writeTextDir,
-  fetchFromGitHub,
   php,
 }:
 
@@ -107,10 +105,12 @@ let
           runHook postInstallCheck
         '';
 
-      COMPOSER_CACHE_DIR = "/dev/null";
-      COMPOSER_MIRROR_PATH_REPOS = "1";
-      COMPOSER_HTACCESS_PROTECT = "0";
-      COMPOSER_DISABLE_NETWORK = "0";
+      env = {
+        COMPOSER_CACHE_DIR = "/dev/null";
+        COMPOSER_MIRROR_PATH_REPOS = "1";
+        COMPOSER_HTACCESS_PROTECT = "0";
+        COMPOSER_DISABLE_NETWORK = "0";
+      };
 
       outputHashMode = "recursive";
       outputHashAlgo =
diff --git a/pkgs/build-support/php/hooks/default.nix b/pkgs/build-support/php/hooks/default.nix
index 1bdc4d3e9280..4c0ba1b18801 100644
--- a/pkgs/build-support/php/hooks/default.nix
+++ b/pkgs/build-support/php/hooks/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   makeSetupHook,
-  diffutils,
   jq,
   writeShellApplication,
   moreutils,
diff --git a/pkgs/build-support/php/pkgs/composer-local-repo-plugin.nix b/pkgs/build-support/php/pkgs/composer-local-repo-plugin.nix
index 5351a3e51f4d..601640b6f0bb 100644
--- a/pkgs/build-support/php/pkgs/composer-local-repo-plugin.nix
+++ b/pkgs/build-support/php/pkgs/composer-local-repo-plugin.nix
@@ -43,10 +43,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-edbn07r/Uc1g0qOuVBZBs6N1bMN5kIfA1b4FCufdw5M=";
   };
 
-  COMPOSER_CACHE_DIR = "/dev/null";
-  COMPOSER_MIRROR_PATH_REPOS = "1";
-  COMPOSER_HTACCESS_PROTECT = "0";
-  COMPOSER_DISABLE_NETWORK = "1";
+  env = {
+    COMPOSER_CACHE_DIR = "/dev/null";
+    COMPOSER_MIRROR_PATH_REPOS = "1";
+    COMPOSER_HTACCESS_PROTECT = "0";
+    COMPOSER_DISABLE_NETWORK = "1";
+  };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/build-support/php/pkgs/composer-phar.nix b/pkgs/build-support/php/pkgs/composer-phar.nix
index a03adc6e6ab0..d278810091ef 100644
--- a/pkgs/build-support/php/pkgs/composer-phar.nix
+++ b/pkgs/build-support/php/pkgs/composer-phar.nix
@@ -32,7 +32,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     mkdir -p $out/bin
     install -D $src $out/libexec/composer/composer.phar
-    makeWrapper ${php}/bin/php $out/bin/composer \
+    makeWrapper ${lib.getExe php} $out/bin/composer \
       --add-flags "$out/libexec/composer/composer.phar" \
       --prefix PATH : ${
         lib.makeBinPath [
@@ -53,6 +53,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Dependency Manager for PHP, shipped from the PHAR file";
     homepage = "https://getcomposer.org/";
     license = lib.licenses.mit;
+    mainProgram = "composer";
     maintainers = with lib.maintainers; [ drupol ];
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/an/ansel/package.nix b/pkgs/by-name/an/ansel/package.nix
index 39c59017ab3a..54fa01bf0d60 100644
--- a/pkgs/by-name/an/ansel/package.nix
+++ b/pkgs/by-name/an/ansel/package.nix
@@ -77,7 +77,7 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "unstable-2024-02-23";
+  version = "0-unstable-2024-02-23";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
@@ -160,7 +160,10 @@ stdenv.mkDerivation {
     )
   '';
 
-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript = unstableGitUpdater {
+    # Tags inherited from Darktable, + a "nightly" 0.0.0 tag that new artefacts get attached to
+    hardcodeZeroVersion = true;
+  };
 
   meta = {
     description = "A darktable fork minus the bloat plus some design vision";
diff --git a/pkgs/by-name/bl/bluez-tools/package.nix b/pkgs/by-name/bl/bluez-tools/package.nix
index 47d381a321d7..21fb5f2b140f 100644
--- a/pkgs/by-name/bl/bluez-tools/package.nix
+++ b/pkgs/by-name/bl/bluez-tools/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bluez-tools";
-  version = "unstable-2020-10-25";
+  version = "0-unstable-2020-10-24";
 
   src = fetchFromGitHub {
     owner = "khvzak";
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 9f9d962743d7..0c7221679a88 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -27,13 +27,13 @@ let
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-nhs44W7cOREdULdXFNZpFGeeZeVTGUffKOBhtL4zAaw=";
+    hash = "sha256-rP3PHS6kuJCgbCQy4h+bJksmJAJvHDBMSysLM5FxQjk=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
diff --git a/pkgs/by-name/ea/earlyoom/package.nix b/pkgs/by-name/ea/earlyoom/package.nix
index ba69b72b3bab..4efb5a52e38e 100644
--- a/pkgs/by-name/ea/earlyoom/package.nix
+++ b/pkgs/by-name/ea/earlyoom/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "earlyoom";
-  version = "1.8";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = "earlyoom";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jgNoYOGor2i3ngDuU3It238n5ky+AppzlRKdkwXb2AI=";
+    hash = "sha256-7gVwR/D3HEMv2sRXYe/B2aluxncDkMGyiBklwAJkWjk=";
   };
 
   outputs = [ "out" ] ++ lib.optionals withManpage [ "man" ];
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index 0aaa1960e5ca..5e4b1d7ba774 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -92,7 +92,7 @@ let
 
   test-firmware =
     let
-      version = "unstable-2022-04-02";
+      version = "0-unstable-2022-04-02";
       src = fetchFromGitHub {
         name = "fwupd-test-firmware-${version}";
         owner = "fwupd";
diff --git a/pkgs/development/tools/hatch/default.nix b/pkgs/by-name/ha/hatch/package.nix
similarity index 81%
rename from pkgs/development/tools/hatch/default.nix
rename to pkgs/by-name/ha/hatch/package.nix
index 4f3dec85ff67..06f2911faafb 100644
--- a/pkgs/development/tools/hatch/default.nix
+++ b/pkgs/by-name/ha/hatch/package.nix
@@ -8,14 +8,19 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "hatch";
-  version = "1.9.0";
+  version = "1.9.7";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4ealEeFS7HzU26vE9Pahh0hwvUnJfRfTkLkjLdpoXOM=";
+    hash = "sha256-Gae4IXn5Tyrd2612qn5lq5DK1VqxA9U4J2N5NcnmYkw=";
   };
 
+  postPatch = ''
+    # Loosen hatchling runtime version dependency
+    sed -i 's/hatchling<1.22/hatchling/' pyproject.toml
+  '';
+
   nativeBuildInputs = with python3.pkgs; [
     hatchling
     hatch-vcs
@@ -69,19 +74,13 @@ python3.pkgs.buildPythonApplication rec {
     "test_editable_exact_force_include_option"
     "test_editable_exact_force_include_build_data_precedence"
     "test_editable_pth"
-    # AssertionError: assert len(extract_installed_requirements(output.splitlines())) > 0
-    "test_creation_allow_system_packages"
-    # cli table output mismatch
-    "test_context_formatting"
     # expects sh, finds bash
     "test_all"
     "test_already_installed_update_flag"
     "test_already_installed_update_prompt"
-    # unmet expectations about the binary module we provide
-    "test_dependency_not_found"
-    "test_marker_unmet"
-    # output capturing mismatch, likely stdout/stderr mixup
-    "test_no_compatibility_check_if_exists"
+    # Loosen hatchling runtime version dependency
+    "test_core"
+    "test_correct"
   ] ++ lib.optionals stdenv.isDarwin [
     # https://github.com/NixOS/nixpkgs/issues/209358
     "test_scripts_no_environment"
@@ -90,6 +89,8 @@ python3.pkgs.buildPythonApplication rec {
     # It is not possible to run it in a nix build using a /nix/store shell.
     # See https://github.com/pypa/hatch/pull/709 for the relevant code.
     "test_populate_default_popen_kwargs_executable"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    "test_resolve"
   ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/la/labwc-gtktheme/package.nix b/pkgs/by-name/la/labwc-gtktheme/package.nix
index 2d4dd3351840..0e9645e59628 100644
--- a/pkgs/by-name/la/labwc-gtktheme/package.nix
+++ b/pkgs/by-name/la/labwc-gtktheme/package.nix
@@ -9,7 +9,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "labwc-gtktheme";
-  version = "unstable-2022-07-17";
+  version = "0-unstable-2022-07-17";
   pyproject = false;
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/la/labwc-menu-generator/package.nix b/pkgs/by-name/la/labwc-menu-generator/package.nix
index 17254a077d5d..79c43706cc73 100644
--- a/pkgs/by-name/la/labwc-menu-generator/package.nix
+++ b/pkgs/by-name/la/labwc-menu-generator/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "labwc-menu-generator";
-  version = "unstable-2024-03-27";
+  version = "0-unstable-2024-03-27";
 
   src = fetchFromGitHub {
     owner = "labwc";
diff --git a/pkgs/by-name/le/lexical/package.nix b/pkgs/by-name/le/lexical/package.nix
index 2a8adc595f8e..d836b471cc8d 100644
--- a/pkgs/by-name/le/lexical/package.nix
+++ b/pkgs/by-name/le/lexical/package.nix
@@ -7,13 +7,13 @@
 
 beamPackages.mixRelease rec {
   pname = "lexical";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "lexical-lsp";
     repo = "lexical";
     rev = "refs/tags/v${version}";
-    hash = "sha256-20qfzYioR1PhA0ZBcft0nhcwxB95pw5L9zoPLWd7ZIE=";
+    hash = "sha256-gDiNjtYeEGoYoyoNmPh73EuYCvY36y9lUyLasbFrFgs=";
   };
 
   mixFodDeps = beamPackages.fetchMixDeps {
diff --git a/pkgs/by-name/li/libui-ng/package.nix b/pkgs/by-name/li/libui-ng/package.nix
index aad482235544..9cded1afcc7e 100644
--- a/pkgs/by-name/li/libui-ng/package.nix
+++ b/pkgs/by-name/li/libui-ng/package.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libui-ng";
-  version = "unstable-2024-02-05";
+  version = "4.1-unstable-2024-02-05";
 
   src = fetchFromGitHub {
     owner = "libui-ng";
@@ -47,7 +47,9 @@ stdenv.mkDerivation rec {
     (lib.mesonBool "examples" (!stdenv.isDarwin))
   ];
 
-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "alpha";
+  };
 
   meta = with lib; {
     description = "A portable GUI library for C";
diff --git a/pkgs/by-name/lo/louvain-community/package.nix b/pkgs/by-name/lo/louvain-community/package.nix
index 857857092353..21ef70400c69 100644
--- a/pkgs/by-name/lo/louvain-community/package.nix
+++ b/pkgs/by-name/lo/louvain-community/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "louvain-community";
-  version = "unstable-2024-01-30";
+  version = "0-unstable-2024-01-30";
 
   src = fetchFromGitHub {
     owner = "meelgroup";
diff --git a/pkgs/by-name/ni/nitter/package.nix b/pkgs/by-name/ni/nitter/package.nix
index 3b3e89cf3e69..28884a7debf0 100644
--- a/pkgs/by-name/ni/nitter/package.nix
+++ b/pkgs/by-name/ni/nitter/package.nix
@@ -8,7 +8,7 @@
 
 buildNimPackage (finalAttrs: prevAttrs: {
   pname = "nitter";
-  version = "unstable-2024-02-26";
+  version = "0-unstable-2024-02-26";
 
   src = fetchFromGitHub {
     owner = "zedeus";
diff --git a/pkgs/by-name/ni/nix-search-cli/package.nix b/pkgs/by-name/ni/nix-search-cli/package.nix
index 56bde6ac04c2..daf80cf9a772 100644
--- a/pkgs/by-name/ni/nix-search-cli/package.nix
+++ b/pkgs/by-name/ni/nix-search-cli/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule {
   pname = "nix-search-cli";
-  version = "unstable-2023-09-12";
+  version = "0-unstable-2023-09-12";
 
   src = fetchFromGitHub {
     owner = "peterldowns";
@@ -17,7 +17,11 @@ buildGoModule {
 
   vendorHash = "sha256-JDOu7YdX9ztMZt0EFAMz++gD7n+Mn1VOe5g6XwrgS5M=";
 
-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript = unstableGitUpdater {
+    # Almost every commit is tagged as "release-<unix-time>-<commit>", software doesn't keep track of its version
+    # Using 0 feels closer to what the tagging is trying to express
+    hardcodeZeroVersion = true;
+  };
 
   meta = with lib; {
     description = "CLI for searching packages on search.nixos.org";
diff --git a/pkgs/by-name/pp/ppsspp/package.nix b/pkgs/by-name/pp/ppsspp/package.nix
index 01c24a71bfe6..0dd5e3492a0f 100644
--- a/pkgs/by-name/pp/ppsspp/package.nix
+++ b/pkgs/by-name/pp/ppsspp/package.nix
@@ -1,25 +1,29 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, SDL2
-, cmake
-, copyDesktopItems
-, ffmpeg_4
-, glew
-, libffi
-, libsForQt5
-, libzip
-, makeDesktopItem
-, makeWrapper
-, pkg-config
-, python3
-, snappy
-, vulkan-loader
-, wayland
-, zlib
-, enableQt ? false
-, enableVulkan ? true
-, forceWayland ? false
+{
+  lib,
+  SDL2,
+  cmake,
+  copyDesktopItems,
+  fetchFromGitHub,
+  ffmpeg,
+  glew,
+  libffi,
+  libsForQt5,
+  libzip,
+  makeDesktopItem,
+  makeWrapper,
+  pkg-config,
+  python3,
+  snappy,
+  stdenv,
+  vulkan-loader,
+  wayland,
+  zlib,
+
+  enableQt ? false,
+  enableVulkan ? true,
+  forceWayland ? false,
+  useSystemFfmpeg? false,
+  useSystemSnappy? true,
 }:
 
 let
@@ -55,26 +59,33 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
     pkg-config
     python3
-  ] ++ lib.optionals enableQt [ wrapQtAppsHook ];
+  ]
+  ++ lib.optionals enableQt [ wrapQtAppsHook ];
 
   buildInputs = [
     SDL2
-    ffmpeg_4
-    (glew.override { enableEGL = forceWayland; })
+    glew
     libzip
-    snappy
     zlib
-  ] ++ lib.optionals enableQt [
+  ]
+  ++ lib.optionals useSystemFfmpeg [
+    ffmpeg
+  ]
+  ++ lib.optionals useSystemSnappy [
+    snappy
+  ]
+  ++ lib.optionals enableQt [
     qtbase
     qtmultimedia
-  ] ++ lib.optionals enableVulkan [ vulkan-loader ]
+  ]
+  ++ lib.optionals enableVulkan [ vulkan-loader ]
   ++ lib.optionals vulkanWayland [ wayland libffi ];
 
   cmakeFlags = [
     (lib.cmakeBool "HEADLESS" (!enableQt))
-    (lib.cmakeBool "USE_SYSTEM_FFMPEG" true)
+    (lib.cmakeBool "USE_SYSTEM_FFMPEG" useSystemFfmpeg)
     (lib.cmakeBool "USE_SYSTEM_LIBZIP" true)
-    (lib.cmakeBool "USE_SYSTEM_SNAPPY" true)
+    (lib.cmakeBool "USE_SYSTEM_SNAPPY" useSystemSnappy)
     (lib.cmakeBool "USE_WAYLAND_WSI" vulkanWayland)
     (lib.cmakeBool "USING_QT_UI" enableQt)
     (lib.cmakeFeature "OpenGL_GL_PREFERENCE" "GLVND")
@@ -91,33 +102,40 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  installPhase = let
-    vulkanPath = lib.makeLibraryPath [ vulkan-loader ];
-  in
-    ''
-      runHook preInstall
+  installPhase =
+    lib.concatStringsSep "\n" ([
+      ''runHook preInstall''
+    ]
+    ++ [
+      ''mkdir -p $out/share/{applications,ppsspp/bin,icons}''
+    ]
+    ++ (if enableQt then [
+      ''install -Dm555 PPSSPPQt $out/share/ppsspp/bin/''
+      ] else [
+        ''install -Dm555 PPSSPPHeadless $out/share/ppsspp/bin/''
+        ''makeWrapper $out/share/ppsspp/bin/PPSSPPHeadless $out/bin/ppsspp-headless''
+        ''install -Dm555 PPSSPPSDL $out/share/ppsspp/bin/''
+      ])
+    ++ [
+      ''mv assets $out/share/ppsspp''
+      ''mv ../icons/hicolor $out/share/icons''
+    ]
+    ++ [
+      ''runHook postInstall''
+    ]);
 
-      mkdir -p $out/share/{applications,ppsspp,icons}
-    ''
-    + (if enableQt then ''
-      install -Dm555 PPSSPPQt $out/bin/ppsspp
-      wrapProgram $out/bin/ppsspp \
-    '' else ''
-      install -Dm555 PPSSPPHeadless $out/bin/ppsspp-headless
-      install -Dm555 PPSSPPSDL $out/share/ppsspp/
-      makeWrapper $out/share/ppsspp/PPSSPPSDL $out/bin/ppsspp \
-        --set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"} \
-    '')
-    + lib.optionalString enableVulkan ''
-        --prefix LD_LIBRARY_PATH : ${vulkanPath} \
-    ''
-    + ''
-
-      mv assets $out/share/ppsspp
-      mv ../icons/hicolor $out/share/icons
-
-      runHook postInstall
-    '';
+  postFixup =
+    let
+      wrapperArgs =
+        lib.concatStringsSep " "
+          (lib.optionals enableVulkan [
+            "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
+          ] ++ lib.optionals (!enableQt) [
+            "--set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"}"
+          ]);
+      binToBeWrapped = if enableQt then "PPSSPPQt" else "PPSSPPSDL";
+    in
+      ''makeWrapper $out/share/ppsspp/bin/${binToBeWrapped} $out/bin/ppsspp ${wrapperArgs}'';
 
   meta = {
     homepage = "https://www.ppsspp.org/";
diff --git a/pkgs/by-name/re/redka/package.nix b/pkgs/by-name/re/redka/package.nix
index ebe81491f86b..3ead73db8310 100644
--- a/pkgs/by-name/re/redka/package.nix
+++ b/pkgs/by-name/re/redka/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "redka";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "nalgeon";
     repo = "redka";
     rev = "v${version}";
-    hash = "sha256-nE5JrKsvQeU/wDNl5HYFiK9ezyGpUqX4d4SaZhfURxo=";
+    hash = "sha256-Dm+QMmCYoYJWv+Crot0bwcSPHuUYQzhRgTO65jRjLLE=";
   };
 
   vendorHash = "sha256-aX0X6TWVEouo884LunCt+UzLyvDHgmvuxdV0wh0r7Ro=";
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 2472831eac22..3e5b720bafe4 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "unstable-2024-04-16";
+  version = "0-unstable-2024-04-16";
   pyproject = true;
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/ri/river-bnf/package.nix b/pkgs/by-name/ri/river-bnf/package.nix
index f869a6e2ff0c..bae48c268483 100644
--- a/pkgs/by-name/ri/river-bnf/package.nix
+++ b/pkgs/by-name/ri/river-bnf/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "river-bnf";
-  version = "unstable-2023-10-10";
+  version = "0-unstable-2023-10-10";
 
   src = fetchFromSourcehut {
     owner = "~leon_plickat";
diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix
index a9e4fbb5713f..ef9b5965aff7 100644
--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@@ -32,10 +32,10 @@
 
 let
   # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "16377-08c3a38b6";
-  rpcs3Version = "0.0.31-16377-08c3a38b6";
-  rpcs3Revision = "08c3a38b6788d9cd4f0bb7310c22a7fd05dc3ba2";
-  rpcs3Hash = "sha256-GOKbznr1X+5nunbjfL9TZ9it/IPvV5mnpc0cbuGHDHw=";
+  rpcs3GitVersion = "16391-39e946630";
+  rpcs3Version = "0.0.31-16391-39e946630";
+  rpcs3Revision = "39e946630da8e23c4d2d2b763f63145eb9205e43";
+  rpcs3Hash = "sha256-CIPUmcpBc6iRMzZJZ5vKty/Uh4TYiR65xXD4aKRPSKc=";
 
   inherit (qt6Packages) qtbase qtmultimedia wrapQtAppsHook qtwayland;
 in
diff --git a/pkgs/by-name/sa/samrewritten/package.nix b/pkgs/by-name/sa/samrewritten/package.nix
index f90c31395f73..1cbaf4b79db8 100644
--- a/pkgs/by-name/sa/samrewritten/package.nix
+++ b/pkgs/by-name/sa/samrewritten/package.nix
@@ -11,7 +11,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "samrewritten";
-  version = "unstable-2023-05-23";
+  version = "202008-unstable-2023-05-22";
 
   src = fetchFromGitHub {
     owner = "PaulCombal";
diff --git a/pkgs/by-name/sp/spacedrive/package.nix b/pkgs/by-name/sp/spacedrive/package.nix
index a4efb37f8d60..50a25a63c25a 100644
--- a/pkgs/by-name/sp/spacedrive/package.nix
+++ b/pkgs/by-name/sp/spacedrive/package.nix
@@ -9,20 +9,20 @@
 
 let
   pname = "spacedrive";
-  version = "0.2.13";
+  version = "0.2.14";
 
   src = fetchurl {
     aarch64-darwin = {
       url = "https://github.com/spacedriveapp/spacedrive/releases/download/${version}/Spacedrive-darwin-aarch64.dmg";
-      hash = "sha256-Ph9+Jve1qP1KBbKRN1I2lylHRy/SWRJAx7nOF9l3A/E=";
+      hash = "sha256-G0Ey7ewZeXegiqkAXFmS0MdaYllTphp7Buqs5/4/mWY=";
     };
     x86_64-darwin = {
       url = "https://github.com/spacedriveapp/spacedrive/releases/download/${version}/Spacedrive-darwin-x86_64.dmg";
-      hash = "sha256-+FHxJre+ouOxKvhDG+uDKDp7ZSx8NWRxac4m4yFqgrE=";
+      hash = "sha256-ypUDb94RlGqJfkf4htWKZ0UrGZ0SyCZrrAqtMuxDzDI=";
     };
     x86_64-linux = {
       url = "https://github.com/spacedriveapp/spacedrive/releases/download/${version}/Spacedrive-linux-x86_64.AppImage";
-      hash = "sha256-AyR1FshOjFatkZLgT2K46IKJgeFDu4e4//CvcuNyt0E=";
+      hash = "sha256-DFJ1/uJW0BwEtJZxGpnvGC7U8YmsJTUbcuWEOAP2Bno=";
     };
   }.${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported.");
 
diff --git a/pkgs/by-name/te/tecoc/package.nix b/pkgs/by-name/te/tecoc/package.nix
index a5531b3aa874..a28e814c904b 100644
--- a/pkgs/by-name/te/tecoc/package.nix
+++ b/pkgs/by-name/te/tecoc/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tecoc";
-  version = "unstable-2023-06-21";
+  version = "0-unstable-2023-06-21";
 
   src = fetchFromGitHub {
     owner = "blakemcbride";
diff --git a/pkgs/by-name/uu/uuu/package.nix b/pkgs/by-name/uu/uuu/package.nix
index 4166d99d34fb..d0fa46bb6a40 100755
--- a/pkgs/by-name/uu/uuu/package.nix
+++ b/pkgs/by-name/uu/uuu/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uuu";
-  version = "1.5.179";
+  version = "1.5.181";
 
   src = fetchFromGitHub {
     owner = "nxp-imx";
     repo = "mfgtools";
     rev = "uuu_${finalAttrs.version}";
-    hash = "sha256-W0jFwivjD19SQmXz2G7cIvWh1zkyN4AXh3bfqF302MA=";
+    hash = "sha256-HMpirdXpcBFTkO7anGDIjsBJKjQ+kIN4kDhPlcqIDqY=";
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/applications/misc/wbg/default.nix b/pkgs/by-name/wb/wbg/package.nix
similarity index 93%
rename from pkgs/applications/misc/wbg/default.nix
rename to pkgs/by-name/wb/wbg/package.nix
index 4501f2c3ffeb..b971bce46d69 100644
--- a/pkgs/applications/misc/wbg/default.nix
+++ b/pkgs/by-name/wb/wbg/package.nix
@@ -20,14 +20,14 @@
 
 stdenv.mkDerivation rec {
   pname = "wbg";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "wbg";
     rev = version;
-    sha256 = "sha256-JJIIqSc0qHgjtpGKai8p6vihXg16unsO7vW91pioAmc=";
+    sha256 = "sha256-zd5OWC0r/75IaeKy5xjV+pQefRy48IcFTxx93iy0a0Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/llvm/common/lldb.nix b/pkgs/development/compilers/llvm/common/lldb.nix
index 59e427e846c4..c582ac863941 100644
--- a/pkgs/development/compilers/llvm/common/lldb.nix
+++ b/pkgs/development/compilers/llvm/common/lldb.nix
@@ -50,7 +50,9 @@ stdenv.mkDerivation (rec {
   src = src';
   inherit patches;
 
-  outputs = [ "out" "lib" "dev" ];
+  # LLDB expects to find the path to `bin` relative to `lib` on Darwin. It can’t be patched with the location of
+  # the `lib` output because that would create a cycle between it and the `out` output.
+  outputs = [ "out" "dev" ] ++ lib.optionals (!stdenv.isDarwin) [ "lib" ];
 
   sourceRoot = lib.optional (lib.versionAtLeast release_version "13") "${src.name}/${pname}";
 
diff --git a/pkgs/development/interpreters/risor/default.nix b/pkgs/development/interpreters/risor/default.nix
index 89b31b8aa9b0..c16eebf1e626 100644
--- a/pkgs/development/interpreters/risor/default.nix
+++ b/pkgs/development/interpreters/risor/default.nix
@@ -7,17 +7,17 @@
 
 buildGoModule rec {
   pname = "risor";
-  version = "1.5.2";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "risor-io";
     repo = "risor";
     rev = "v${version}";
-    hash = "sha256-tvEiboH5cGRpyBmmpu8A1UlDR1Y9XPe1pUNS0/Jvooc=";
+    hash = "sha256-IUmkb23Fx+bjzXrXWfKPOo0HFt7HjtjQoCRtH77HGBg=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-eW6eSZp5Msg/u50i1+S2KSzDws0Rq8JBY1Yxzq7/hVo=";
+  vendorHash = "sha256-+XYwFYbvZvk0TWoRtCKQIzbQeznQkolB+NFqUiZMkpA=";
 
   subPackages = [
     "cmd/risor"
diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix
index 3e155d6f2d90..2cdc6cfafb36 100644
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "drogon";
-  version = "1.9.3";
+  version = "1.9.4";
 
   src = fetchFromGitHub {
     owner = "drogonframework";
     repo = "drogon";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-en8w8kda0ijg6b6s2WHxHfuGaa+p08928Jw57UBevDU=";
+    sha256 = "sha256-P6blu3EIBzmK1zikFPiV+tvFLfiQhK+cRdClQOhcBSU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 5a7f49ce94ae..60a0f757c1d7 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -47,10 +47,10 @@ let
     x11Support = false;
   };
 
-  librarySuffix = if (stdenv.targetPlatform.extensions.library == ".so") then "2.0.so.0"
-                  else if (stdenv.targetPlatform.extensions.library == ".dylib") then "2.0.0.dylib"
-                  else if (stdenv.targetPlatform.extensions.library == ".a") then "2.0.a"
-                  else if (stdenv.targetPlatform.extensions.library == ".dll") then "2.0-0.dll"
+  librarySuffix = if (stdenv.hostPlatform.extensions.library == ".so") then "2.0.so.0"
+                  else if (stdenv.hostPlatform.extensions.library == ".dylib") then "2.0.0.dylib"
+                  else if (stdenv.hostPlatform.extensions.library == ".a") then "2.0.a"
+                  else if (stdenv.hostPlatform.extensions.library == ".dll") then "2.0-0.dll"
                   else "2.0-0.lib";
 in
 
@@ -238,6 +238,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeCheckInputs = [ tzdata desktop-file-utils shared-mime-info ];
 
+  # Conditional necessary to break infinite recursion with passthru.tests
   preCheck = lib.optionalString finalAttrs.finalPackage.doCheck or config.doCheckByDefault or false ''
     export LD_LIBRARY_PATH="$NIX_BUILD_TOP/glib-${finalAttrs.version}/glib/.libs''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     export TZDIR="${tzdata}/share/zoneinfo"
diff --git a/pkgs/development/libraries/java/commons/bcel/default.nix b/pkgs/development/libraries/java/commons/bcel/default.nix
index f25f4a552b7c..0387b5dd9e30 100644
--- a/pkgs/development/libraries/java/commons/bcel/default.nix
+++ b/pkgs/development/libraries/java/commons/bcel/default.nix
@@ -1,12 +1,12 @@
 {lib, stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  version = "6.8.1";
+  version = "6.8.2";
   pname = "commons-bcel";
 
   src = fetchurl {
     url    = "mirror://apache/commons/bcel/binaries/bcel-${version}-bin.tar.gz";
-    hash   = "sha256-a7PqcVvS+7tHSU2uXi5gLpl82ZN9hA03VEnCnc5cnRc=";
+    hash   = "sha256-VRCRxy+P3uPW9gWy9xHfJ35muhWCHtXNimRmTfba+04=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 80d75b8cf880..a8885fc5647b 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -284,7 +284,11 @@ let
       qtnetworkauth = callPackage ../modules/qtnetworkauth.nix {};
       qtpim = callPackage ../modules/qtpim.nix {};
       qtpositioning = callPackage ../modules/qtpositioning.nix {};
+      qtpurchasing = callPackage ../modules/qtpurchasing.nix {
+        inherit (darwin.apple_sdk_11_0.frameworks) Foundation StoreKit;
+      };
       qtquick1 = null;
+      qtquick3d = callPackage ../modules/qtquick3d.nix { };
       qtquickcontrols = callPackage ../modules/qtquickcontrols.nix {};
       qtquickcontrols2 = callPackage ../modules/qtquickcontrols2.nix {};
       qtremoteobjects = callPackage ../modules/qtremoteobjects.nix {};
diff --git a/pkgs/development/libraries/qt-5/modules/qtpurchasing.nix b/pkgs/development/libraries/qt-5/modules/qtpurchasing.nix
new file mode 100644
index 000000000000..3c1661c7b000
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/modules/qtpurchasing.nix
@@ -0,0 +1,14 @@
+{ stdenv
+, lib
+, qtModule
+, qtbase
+, qtdeclarative
+, StoreKit
+, Foundation
+}:
+
+qtModule {
+  pname = "qtpurchasing";
+  propagatedBuildInputs = [ qtbase qtdeclarative ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Foundation StoreKit ];
+}
diff --git a/pkgs/development/libraries/qt-5/modules/qtquick3d.nix b/pkgs/development/libraries/qt-5/modules/qtquick3d.nix
new file mode 100644
index 000000000000..1c84856c0c12
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/modules/qtquick3d.nix
@@ -0,0 +1,11 @@
+{ qtModule
+, qtbase
+, qtdeclarative
+, openssl
+}:
+
+qtModule {
+  pname = "qtquick3d";
+  propagatedBuildInputs = [ qtbase qtdeclarative ];
+  buildInputs = [ openssl ];
+}
diff --git a/pkgs/development/libraries/rapidyaml/default.nix b/pkgs/development/libraries/rapidyaml/default.nix
index 68449479278f..1275f2fa5452 100644
--- a/pkgs/development/libraries/rapidyaml/default.nix
+++ b/pkgs/development/libraries/rapidyaml/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rapidyaml";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "biojppm";
     repo = pname;
     fetchSubmodules = true;
     rev = "v${version}";
-    sha256 = "sha256-1/P6Szgng94UU8cPFAtOKMS+EmiwfW/IJl2UTolDU5s=";
+    sha256 = "sha256-p9XaMsrOgnEdb0yl52HXhNzz6YxuvTD5GCaq1a+l1bQ=";
   };
 
   nativeBuildInputs = [ cmake git ];
@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/biojppm/rapidyaml";
     license = licenses.mit;
     maintainers = with maintainers; [ martfont ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/science/math/ipopt/default.nix b/pkgs/development/libraries/science/math/ipopt/default.nix
index a76c2f878ba7..286a630f4b41 100644
--- a/pkgs/development/libraries/science/math/ipopt/default.nix
+++ b/pkgs/development/libraries/science/math/ipopt/default.nix
@@ -12,13 +12,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "ipopt";
-  version = "3.14.14";
+  version = "3.14.16";
 
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "Ipopt";
     rev = "releases/${version}";
-    sha256 = "sha256-qMPdJVLIXFePhTA6qRr1Pth/BjJ62cj9y8C1HKQJGDQ=";
+    sha256 = "sha256-ZuiZZMq7NzOm6CCJgMBgEWs8PEfM3pVr2yOWbS42l8U=";
   };
 
   CXXDEFS = [ "-DHAVE_RAND" "-DHAVE_CSTRING" "-DHAVE_CSTDIO" ];
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index d160f7433218..d5194ea29949 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -27,6 +27,7 @@
 , systemd
 , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd
 , nixosTests
+, blackbox-terminal
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -117,6 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
     };
     tests = {
       inherit (nixosTests.terminal-emulators) gnome-terminal lxterminal mlterm roxterm sakura stupidterm terminator termite xfce4-terminal;
+      blackbox-terminal = blackbox-terminal.override { sixelSupport = true; };
     };
   };
 
diff --git a/pkgs/development/php-packages/opentelemetry/default.nix b/pkgs/development/php-packages/opentelemetry/default.nix
index 98410f6b3fb3..044e18060708 100644
--- a/pkgs/development/php-packages/opentelemetry/default.nix
+++ b/pkgs/development/php-packages/opentelemetry/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "1.0.2";
+  version = "1.0.3";
 in
 buildPecl rec {
   inherit version;
@@ -15,7 +15,7 @@ buildPecl rec {
     owner = "open-telemetry";
     repo = "opentelemetry-php-instrumentation";
     rev = version;
-    hash = "sha256-w6Gkjh9+I6KlQyztv4o1XZ6nJ+Yn4wXXN6nma8/dLTU=";
+    hash = "sha256-KqLbKnAHxXbldNYVN7eMQ7NdZmPecu0UKHQdlUm7Ur0=";
   };
 
   sourceRoot = "${src.name}/ext";
diff --git a/pkgs/development/python-modules/argostranslate/default.nix b/pkgs/development/python-modules/argostranslate/default.nix
index 57ea8db15a3d..f631da6ea800 100644
--- a/pkgs/development/python-modules/argostranslate/default.nix
+++ b/pkgs/development/python-modules/argostranslate/default.nix
@@ -18,13 +18,13 @@ let
 in
 buildPythonPackage rec {
   pname = "argostranslate";
-  version = "1.9.3";
+  version = "1.9.6";
 
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-N1Dh8238cDKpIMeQT645lDvYMbOWjVqGuWxt37+TQmQ=";
+    sha256 = "sha256-3YzBMnqmcTIpn5UOFg3SDTFLjPSE9UDw0i8fB8LYh2s=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
index f6dd8f3c1068..c03cf2582452 100644
--- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix
@@ -1,12 +1,13 @@
-{ lib
-, azure-common
-, azure-mgmt-core
-, azure-mgmt-nspkg
-, buildPythonPackage
-, fetchPypi
-, isodate
-, pythonOlder
-, setuptools
+{
+  lib,
+  azure-common,
+  azure-mgmt-core,
+  azure-mgmt-nspkg,
+  buildPythonPackage,
+  fetchPypi,
+  isodate,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
@@ -21,11 +22,9 @@ buildPythonPackage rec {
     hash = "sha256-bGLmrFkONP7dc5/iSzGzdQcToBRhZpbqjUTHvMgcBrc=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     azure-common
     azure-mgmt-core
     isodate
@@ -34,9 +33,7 @@ buildPythonPackage rec {
   # has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "azure.mgmt.containerservice"
-  ];
+  pythonImportsCheck = [ "azure.mgmt.containerservice" ];
 
   meta = with lib; {
     description = "This is the Microsoft Azure Container Service Management Client Library";
diff --git a/pkgs/development/python-modules/casa-formats-io/default.nix b/pkgs/development/python-modules/casa-formats-io/default.nix
index 2537c9e8e5f6..49f1b18dc8bd 100644
--- a/pkgs/development/python-modules/casa-formats-io/default.nix
+++ b/pkgs/development/python-modules/casa-formats-io/default.nix
@@ -1,41 +1,48 @@
-{ lib
-, fetchPypi
-, buildPythonPackage
-, astropy
-, dask
-, numpy
-, oldest-supported-numpy
-, setuptools-scm
-, wheel
+{
+  lib,
+  astropy,
+  buildPythonPackage,
+  dask,
+  fetchPypi,
+  numpy,
+  oldest-supported-numpy,
+  pythonOlder,
+  setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "casa-formats-io";
   version = "0.3.0";
-  format = "pyproject";
+  prproject = true;
+
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "casa_formats_io";
+    inherit version;
     hash = "sha256-FpQj0XeZ7vvOzUM/+5qG6FRwNXl3gzoUBItYdQ1M4m4=";
   };
 
-  nativeBuildInputs = [
-    oldest-supported-numpy
-    setuptools-scm
-    wheel
-  ];
+  build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [ astropy dask numpy ];
+  nativeBuildInputs = [ oldest-supported-numpy ];
+
+  dependencies = [
+    astropy
+    dask
+    numpy
+  ];
 
   # Tests require a large (800 Mb) dataset
   doCheck = false;
 
   pythonImportsCheck = [ "casa_formats_io" ];
 
-  meta = {
+  meta = with lib; {
     description = "Dask-based reader for CASA data";
     homepage = "https://casa-formats-io.readthedocs.io/";
-    license = lib.licenses.lgpl2Only;
-    maintainers = with lib.maintainers; [ smaret ];
+    changelog = "https://github.com/radio-astro-tools/casa-formats-io/blob/v${version}/CHANGES.rst";
+    license = licenses.lgpl2Only;
+    maintainers = with maintainers; [ smaret ];
   };
 }
diff --git a/pkgs/development/python-modules/character-encoding-utils/default.nix b/pkgs/development/python-modules/character-encoding-utils/default.nix
index dd0e3b60fe1f..85e418ca7957 100644
--- a/pkgs/development/python-modules/character-encoding-utils/default.nix
+++ b/pkgs/development/python-modules/character-encoding-utils/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "character-encoding-utils";
-  version = "0.0.6";
+  version = "0.0.7";
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     pname = "character_encoding_utils";
     inherit version;
-    hash = "sha256-ugzWiSpa/xxlraVyVPTSq/uxPg11kOyePgb1cmzX3ug=";
+    hash = "sha256-cUggyNz5xphDF+7dSrx3vr3v3R8ISryHj9accMJfDbg=";
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/gflanguages/default.nix b/pkgs/development/python-modules/gflanguages/default.nix
index 9a3f77f957c0..0a6023a81749 100644
--- a/pkgs/development/python-modules/gflanguages/default.nix
+++ b/pkgs/development/python-modules/gflanguages/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "gflanguages";
-  version = "0.5.17";
+  version = "0.6.0";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dScgRQ6usjSqV0FqDyP+KGvHL06wlTFVcO+MmZ2NMAs=";
+    hash = "sha256-kaJZ0STN2U/4vQ7g5VbpPGv64czryK8jXmIJ97bkItA=";
   };
 
   pyproject = true;
diff --git a/pkgs/development/python-modules/govee-local-api/default.nix b/pkgs/development/python-modules/govee-local-api/default.nix
index 6cf2fa9b29c2..1b1d8fcde5ca 100644
--- a/pkgs/development/python-modules/govee-local-api/default.nix
+++ b/pkgs/development/python-modules/govee-local-api/default.nix
@@ -2,15 +2,15 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
   poetry-core,
-  poetry-dynamic-versioning,
   pytestCheckHook,
   pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "govee-local-api";
-  version = "1.4.4";
+  version = "1.4.5";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -19,12 +19,19 @@ buildPythonPackage rec {
     owner = "Galorhallen";
     repo = "govee-local-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-J4SG4n6LIZ/G6pEXAzliV7uTWzqsH7rtFe3Y7BJ2dWE=";
+    hash = "sha256-kmIuo/e3eLJTgmI+2Oq9Y0jov/133jXwgoBayGv33r4=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # configure pep517 build-backend
+      url = "https://github.com/Galorhallen/govee-local-api/commit/897a21ae723ff94343bbf4ba1541e3a1d3e03c94.patch";
+      hash = "sha256-/d5jGKGME768Ar+WWWQUByHJPGB31OHShI4oLjcMUIU=";
+    })
+  ];
+
   build-system = [
     poetry-core
-    poetry-dynamic-versioning
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/habluetooth/default.nix b/pkgs/development/python-modules/habluetooth/default.nix
index ece95d5f999e..702ffc382115 100644
--- a/pkgs/development/python-modules/habluetooth/default.nix
+++ b/pkgs/development/python-modules/habluetooth/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "habluetooth";
-  version = "2.8.0";
+  version = "2.8.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "habluetooth";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Qmq81iZpeLNrSIvxgkHl6ZYntlRwQPfPWRY2ZToQXCs=";
+    hash = "sha256-2QiV32gDaoIBLUv/a3YzosFl6+E/nm0WoSUcTx9ph8s=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/indexed-zstd/default.nix b/pkgs/development/python-modules/indexed-zstd/default.nix
index 88cb6f05930a..e7980f88a9fd 100644
--- a/pkgs/development/python-modules/indexed-zstd/default.nix
+++ b/pkgs/development/python-modules/indexed-zstd/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "indexed_zstd";
-  version = "1.6.0";
+  version = "1.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-icCerrv6ihBjSTS4Fsw7qhoA5ha8yegfMVRiIOhTvvY=";
+    hash = "sha256-i3Q3j5Rh/OqxdSFbZeHEiYZN2zS9gWBYk2pifwzKOos=";
   };
 
   nativeBuildInputs = [ cython setuptools ];
diff --git a/pkgs/development/python-modules/libretranslate/default.nix b/pkgs/development/python-modules/libretranslate/default.nix
index 042fd5d404d1..c339a7708024 100644
--- a/pkgs/development/python-modules/libretranslate/default.nix
+++ b/pkgs/development/python-modules/libretranslate/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "libretranslate";
-  version = "1.5.6";
+  version = "1.5.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LibreTranslate";
     repo = "LibreTranslate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-43VnxgtapMRKyXxqsvBgSMUxvpbLI+iOfW3FA0/POpE=";
+    hash = "sha256-lOVi/809ig+KtiNwdt9Wovn+2Q8I6amps1sZ5JJy7WE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/plaid-python/default.nix b/pkgs/development/python-modules/plaid-python/default.nix
index f3a92c1954c8..88df10cfc7f5 100644
--- a/pkgs/development/python-modules/plaid-python/default.nix
+++ b/pkgs/development/python-modules/plaid-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "plaid-python";
-  version = "21.0.0";
+  version = "21.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ksYTV10FGUjBIkJru4CiJIlPLT4S7fbpsNrjYczTFlI=";
+    hash = "sha256-KZGfr60RclPMis3y/XPY+VMQr0IxGXMwI7tPxNOlmhg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/plantuml-markdown/default.nix b/pkgs/development/python-modules/plantuml-markdown/default.nix
index 8013e90e71f8..09a64b298e46 100644
--- a/pkgs/development/python-modules/plantuml-markdown/default.nix
+++ b/pkgs/development/python-modules/plantuml-markdown/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "plantuml-markdown";
-  version = "3.9.5";
+  version = "3.9.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mikitex70";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-bfbji517y0/PXMfLg2gGWlogg7IPhXvQ5vekLzc4/ow=";
+    hash = "sha256-LbAQt7cbSUHSU5QfqQWQWuolPxCoXBjmVaw5Tz96fK8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/py65/default.nix b/pkgs/development/python-modules/py65/default.nix
index 3c06f5932f00..9f73ed1eb686 100644
--- a/pkgs/development/python-modules/py65/default.nix
+++ b/pkgs/development/python-modules/py65/default.nix
@@ -1,40 +1,42 @@
-{ lib
-, buildPythonPackage
-, pythonOlder
-, fetchFromGitHub
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  unittestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "py65";
-  version = "1.1.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
+  version = "1.2.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mnaberez";
     repo = "py65";
     rev = "refs/tags/${version}";
-    hash = "sha256-WLs3TAZovuphWZIvMvM3CZnqg1aZfMF4Yrqw46k+bLA=";
+    hash = "sha256-BMX+sMPx/YBFA4NFkaY0rl0EPicGHgb6xXVvLEIdllA=";
   };
 
-  postPatch = ''
-    substituteInPlace py65/tests/test_monitor.py \
-          --replace "test_argv_rom" "dont_test_argv_rom" \
-          --replace "test_argv_combination_rom_mpu" "dont_test_argv_combination_rom_mpu"
-  '';
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
 
   meta = {
-    homepage = "https://py65.readthedocs.io/";
+    homepage = "https://github.com/mnaberez/py65";
     description = "Emulate 6502-based microcomputer systems in Python";
-    mainProgram = "py65mon";
     longDescription = ''
       Py65 includes a program called Py65Mon that functions as a machine
       language monitor. This kind of program is sometimes also called a
       debugger. Py65Mon provides a command line with many convenient commands
       for interacting with the simulated 6502-based system.
     '';
+    changelog = "https://github.com/mnaberez/py65/blob/${src.rev}/CHANGES.txt";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ AndersonTorres tomasajt ];
+    mainProgram = "py65mon";
+    maintainers = with lib.maintainers; [
+      AndersonTorres
+      tomasajt
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/pynws/default.nix b/pkgs/development/python-modules/pynws/default.nix
index 5c3b5c7c49a2..8a28d85b06d4 100644
--- a/pkgs/development/python-modules/pynws/default.nix
+++ b/pkgs/development/python-modules/pynws/default.nix
@@ -9,33 +9,46 @@
 , pytest-cov
 , pytestCheckHook
 , pythonOlder
+, setuptools
+, setuptools-scm
+, tenacity
 }:
 
 buildPythonPackage rec {
   pname = "pynws";
-  version = "1.6.0";
-  format = "setuptools";
+  version = "1.7.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "MatthewFlamm";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-x56kfnmdVV0Fc7XSI60rrtEl4k3uzpIdZxTofUbkUHU=";
+    hash = "sha256-JjXGDjLITzJxEmCIv7RPvb+Jqe9hm++ptpJOryuK9M0=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
     aiohttp
     metar
   ];
 
+  optional-dependencies.retry = [
+    tenacity
+  ];
+
   nativeCheckInputs = [
     freezegun
     pytest-aiohttp
     pytest-asyncio
     pytest-cov
     pytestCheckHook
-  ];
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pythonImportsCheck = [ "pynws" ];
 
diff --git a/pkgs/development/python-modules/pyvista/default.nix b/pkgs/development/python-modules/pyvista/default.nix
index e0bfb1246f52..4985df3f9cc8 100644
--- a/pkgs/development/python-modules/pyvista/default.nix
+++ b/pkgs/development/python-modules/pyvista/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pyvista";
-  version = "0.43.6";
+  version = "0.43.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-EhhnX7r8yHynEVahMSB6LxCAquQcUF4cI0S4oW+IZ/Y=";
+    hash = "sha256-z/IO25hcHv1pimUecIIX5hZPYF2/1QkROqZ2D4Tk7DE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pywlroots/default.nix b/pkgs/development/python-modules/pywlroots/default.nix
index ec3936457391..a3d52e1bbb6b 100644
--- a/pkgs/development/python-modules/pywlroots/default.nix
+++ b/pkgs/development/python-modules/pywlroots/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "pywlroots";
-  version = "0.16.7";
+  version = "0.16.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zfjcXQCXysG+JMw00YES/GQk/yjHH9kCksb9SlZt9wo=";
+    hash = "sha256-jAkDZKAm75MlAMNuX+21ZV6kHb53zgIOJctJC2bXH1k=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/python-modules/quantile-forest/default.nix b/pkgs/development/python-modules/quantile-forest/default.nix
index 3b6bd12cd4c8..0b6d5df933b1 100644
--- a/pkgs/development/python-modules/quantile-forest/default.nix
+++ b/pkgs/development/python-modules/quantile-forest/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "quantile-forest";
-  version = "1.3.4";
+  version = "1.3.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "zillow";
     repo = "quantile-forest";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hzLJq0y+qjc48PfHW3i73x9safGOy0V1HEQ5WR8IXpI=";
+    hash = "sha256-0zlj9nks5KsgsLSflRW+4uiYlYVQsF0HMkZ3zG3if2E=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/softlayer/default.nix b/pkgs/development/python-modules/softlayer/default.nix
index 8ce880889d66..02e38fcc3786 100644
--- a/pkgs/development/python-modules/softlayer/default.nix
+++ b/pkgs/development/python-modules/softlayer/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "softlayer";
-  version = "6.1.11";
+  version = "6.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "softlayer-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2iN3T58aICQlGwr10/e/mWE9pA4rbJCBTE1jTu3GeGk=";
+    hash = "sha256-kOElL6VtHrtbA0lNAnDOC6VPX1mC7Rvk5x6N5x2Z1B0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/wsgidav/default.nix b/pkgs/development/python-modules/wsgidav/default.nix
index db7e85e1937e..c05415323093 100644
--- a/pkgs/development/python-modules/wsgidav/default.nix
+++ b/pkgs/development/python-modules/wsgidav/default.nix
@@ -1,22 +1,23 @@
-{ lib
-, buildPythonPackage
-, cheroot
-, fetchFromGitHub
-, pytestCheckHook
-, pythonOlder
-, defusedxml
-, jinja2
-, json5
-, python-pam
-, pyyaml
-, requests
-, setuptools
-, webtest
+{
+  lib,
+  buildPythonPackage,
+  cheroot,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  defusedxml,
+  jinja2,
+  json5,
+  python-pam,
+  pyyaml,
+  requests,
+  setuptools,
+  webtest,
 }:
 
 buildPythonPackage rec {
   pname = "wsgidav";
-  version = "4.3.2";
+  version = "4.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,12 +26,12 @@ buildPythonPackage rec {
     owner = "mar10";
     repo = "wsgidav";
     rev = "refs/tags/v${version}";
-    hash = "sha256-93+8h+vRLnspQ/lmdjKYpzSEJSKcqCkB4qRqTuKHNRA=";
+    hash = "sha256-vUqNC7ixpta0s7wRC5ROSKMa/MsgEBu5rr0XNu69FRw=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  __darwinAllowLocalNetworking = true;
+
+  build-system = [ setuptools ];
 
   dependencies = [
     defusedxml
@@ -40,8 +41,6 @@ buildPythonPackage rec {
     pyyaml
   ];
 
-  __darwinAllowLocalNetworking = true;
-
   nativeCheckInputs = [
     cheroot
     pytestCheckHook
@@ -49,9 +48,7 @@ buildPythonPackage rec {
     webtest
   ];
 
-  pythonImportsCheck = [
-    "wsgidav"
-  ];
+  pythonImportsCheck = [ "wsgidav" ];
 
   meta = with lib; {
     description = "Generic and extendable WebDAV server based on WSGI";
diff --git a/pkgs/development/python-modules/xcffib/default.nix b/pkgs/development/python-modules/xcffib/default.nix
index b0b00da0dc32..ff5215ccb4cc 100644
--- a/pkgs/development/python-modules/xcffib/default.nix
+++ b/pkgs/development/python-modules/xcffib/default.nix
@@ -47,11 +47,15 @@ buildPythonPackage rec {
     "xcffib"
   ];
 
+  # Tests use xvfb
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "A drop in replacement for xpyb, an XCB python binding";
     homepage = "https://github.com/tych0/xcffib";
     changelog = "https://github.com/tych0/xcffib/releases/tag/v${version}";
     license = licenses.asl20;
+    platforms = platforms.linux ++ platforms.darwin ++ platforms.windows;
     maintainers = with maintainers; [ kamilchm ];
   };
 }
diff --git a/pkgs/development/python-modules/zdaemon/default.nix b/pkgs/development/python-modules/zdaemon/default.nix
index 54c096b64257..4e72500da1dc 100644
--- a/pkgs/development/python-modules/zdaemon/default.nix
+++ b/pkgs/development/python-modules/zdaemon/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "zdaemon";
-  version = "5.0";
+  version = "5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ml7GxRmigLvPqPfnP04Q2AjnuCcQq2COD0Sb88BtQ9U=";
+    hash = "sha256-Iun+UFDq67ngPZrWTk9jzNheBMOP2zUc8RO+9vaNt6Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/bacon/default.nix b/pkgs/development/tools/bacon/default.nix
index 8e4816a859a3..93e301d7afb5 100644
--- a/pkgs/development/tools/bacon/default.nix
+++ b/pkgs/development/tools/bacon/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bacon";
-  version = "2.16.0";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-lYj6WIb8HvOO/RlxeTzD3r7Jjfx4mDqZ9VKo0chvooU=";
+    hash = "sha256-pui5cHWRE+b06RlAPfOXIO6DfuWlKvFWx2vlQX9H7k0=";
   };
 
-  cargoHash = "sha256-G3IfxIhQ1t47ZhndTBmcUZNXHYehaaMVgIjBuD71zHE=";
+  cargoHash = "sha256-Eu9Pf1bKd054451ssLh7rEfNLEdityAybjfUqo+DXtY=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices
diff --git a/pkgs/development/tools/misc/n98-magerun2/default.nix b/pkgs/development/tools/misc/n98-magerun2/default.nix
index 9cd87a29ec56..e0947e8f6fa6 100644
--- a/pkgs/development/tools/misc/n98-magerun2/default.nix
+++ b/pkgs/development/tools/misc/n98-magerun2/default.nix
@@ -5,16 +5,16 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "n98-magerun2";
-  version = "7.3.1";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "netz98";
     repo = "n98-magerun2";
     rev = finalAttrs.version;
-    hash = "sha256-a1T4SmeOEKRW/xS2VBPLZt6r9JdtaJn8YVvfRnzGdb4=";
+    hash = "sha256-OPvyZ0r7Zt4PC+rmRtBm9EkbaE4PeovnUHrhzXUqT8E=";
   };
 
-  vendorHash = "sha256-1j0/spum4C9j/HNVlHwUehAFYJOz7YvMVlC6dtbNYK0=";
+  vendorHash = "sha256-HSkcYbDQPK1ByG8Euq9YqzK0jqjKrWO+0R4ungFDOIY=";
 
   meta = {
     changelog = "https://magerun.net/category/magerun/";
diff --git a/pkgs/development/web/ihp-new/default.nix b/pkgs/development/web/ihp-new/default.nix
index 63cd36581078..76e66a7ae454 100644
--- a/pkgs/development/web/ihp-new/default.nix
+++ b/pkgs/development/web/ihp-new/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ihp-new";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "digitallyinduced";
     repo = "ihp";
     rev = "v${version}";
-    sha256 = "sha256-oQz7ZBrHe6WwYMwnxxUgnYM55CuH5Oxjz6mrLnYbB7U=";
+    sha256 = "sha256-DmaIr9kF+TG24wVNPVufxC74TYMCLziLYS9hCZHBDTc=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/games/freeciv/default.nix b/pkgs/games/freeciv/default.nix
index d1a50ea89cc1..6ecd9fcdade0 100644
--- a/pkgs/games/freeciv/default.nix
+++ b/pkgs/games/freeciv/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freeciv";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "freeciv";
     repo = "freeciv";
     rev = "R${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-8cMy0O5VxVi1ffvA/Gz4BnTB0WvJptMSgM7Zu992k5k=";
+    hash = "sha256-ImjXDJ1Bq85OfUhxGe184cd5eu4a8BrZh+YYhzUdrLo=";
   };
 
   postPatch = ''
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     description = "Multiplayer (or single player), turn-based strategy game";
     longDescription = ''
       Freeciv is a Free and Open Source empire-building strategy game
@@ -79,10 +79,10 @@ stdenv.mkDerivation rec {
       to the space age...
     '';
     homepage = "http://www.freeciv.org"; # http only
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ pierron ];
-    platforms = platforms.unix;
-    hydraPlatforms = platforms.linux; # sdl-config times out on darwin
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ pierron ];
+    platforms = lib.platforms.unix;
+    hydraPlatforms = lib.platforms.linux; # sdl-config times out on darwin
     broken = qtClient && stdenv.isDarwin; # Missing Qt5 development files
   };
 }
diff --git a/pkgs/games/gtypist/default.nix b/pkgs/games/gtypist/default.nix
index 43b95bacefc8..169b0fa77db0 100644
--- a/pkgs/games/gtypist/default.nix
+++ b/pkgs/games/gtypist/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0xzrkkmj0b1dw3yr0m9hml2y634cc4h61im6zwcq57s7285z8fn1";
   };
 
+  CFLAGS = "-std=gnu89";
+
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ ncurses perl fortune ]
    ++ lib.optional stdenv.isDarwin libiconv;
diff --git a/pkgs/games/openttd/jgrpp.nix b/pkgs/games/openttd/jgrpp.nix
index d26c62dd8906..30e302b17f97 100644
--- a/pkgs/games/openttd/jgrpp.nix
+++ b/pkgs/games/openttd/jgrpp.nix
@@ -2,13 +2,13 @@
 
 openttd.overrideAttrs (oldAttrs: rec {
   pname = "openttd-jgrpp";
-  version = "0.58.2";
+  version = "0.58.3";
 
   src = fetchFromGitHub rec {
     owner = "JGRennison";
     repo = "OpenTTD-patches";
     rev = "jgrpp-${version}";
-    hash = "sha256-XwKCqfYgrqQpo/2L+vHCde/z2QV88BFL+WQqvsEYdhE=";
+    hash = "sha256-NRCdZ7iSeofVjH/kjpnw4zlxXc4ojhF1xfMpAfZuu98=";
   };
 
   buildInputs = oldAttrs.buildInputs ++ [ zstd ];
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index f04b8fcd2108..5a06fac5d6c1 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "24.01.00";
+  version = "24.03.00";
 
   src = fetchzip {
     url = "https://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
-    sha256 = "sha256-MXWmKxcxgSVCSeeGlWsa8JTBa5hLyvGPZ0811w+s+yA=";
+    sha256 = "sha256-UKL5q5sURSVXvEOzoZdG+wWBSS5f9YWo5stViY3F2vg=";
     stripRoot = false;
   };
 
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index b7840b554bee..de33ff75d82f 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,14 +6,14 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.6.29";
-    hash = "sha256-Be2VaW0DQDS0FJUwXM627QaNgrn1B3Hbyq+PiKb7b+k=";
+    version = "6.6.30";
+    hash = "sha256-fQATjYekxV/+24mqyel3bYfgUMN4NhOHR9yyL6L5bl0=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.8.8";
-    hash = "sha256-6fT9vRjHw775m4ySUAUWU9R0dz/cWYYdZsPCwZjGiXM=";
+    version = "6.8.9";
+    hash = "sha256-OUlT/fiwLGTPnr/7gneyZBio/l8KAWopcJqTpSjBMl0=";
     variant = "main";
   };
 
diff --git a/pkgs/servers/go-libp2p-daemon/default.nix b/pkgs/servers/go-libp2p-daemon/default.nix
index 9da79d04546f..8d1d7ea20585 100644
--- a/pkgs/servers/go-libp2p-daemon/default.nix
+++ b/pkgs/servers/go-libp2p-daemon/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-libp2p-daemon";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "libp2p";
     repo = "go-libp2p-daemon";
     rev = "v${version}";
-    hash = "sha256-3zlSD+9KnIOBlaE3gCTBGKwZY0rMW8lbb4b77BlJm/g=";
+    hash = "sha256-1hhYyyGrXt/C6EoivON9WazmV/jJX8xwjCLPto28T6M=";
   };
 
-  vendorHash = "sha256-8wrtPfuZ9X3cKjDeywht0d3p5lQouk6ZPO1PIjBz2Ro=";
+  vendorHash = "sha256-Kdxo0QsS7o9BjSG6qFrlCnqyZXhX6NkT/aUznGrm3xo=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index b6b6ef4b63bb..ef9b4762dd14 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2024.5.0";
+  version = "2024.5.1";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
@@ -3083,7 +3083,8 @@
     ];
     "nws" = ps: with ps; [
       pynws
-    ];
+    ]
+    ++ pynws.optional-dependencies.retry;
     "nx584" = ps: with ps; [
       pynx584
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index d48e775ce011..c7097843a6cf 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -476,7 +476,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2024.5.0";
+  hassVersion = "2024.5.1";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -494,13 +494,13 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-YtlelAfFC3fnw78lZIf5FtQifvtwb2ZjCrZgM2G7S5U=";
+    hash = "sha256-/JuKN0V2wMZW56l2nt4T3cpDnQiHeC27+QVBi3j3aDI=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-9BgfQCP+t4zvC+ZVI0IAlm2qFArqRjTb8974sY/SHUg=";
+    hash = "sha256-3Tqs+69e1ESOcEMCx3LTt1c04pG5pK/RGX30x8WRegQ=";
   };
 
   build-system = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index db00b6573f2d..21b9895ba3ef 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2024.5.0";
+  version = "2024.5.1";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-QQ9FDxYJokISYWOOm7uAdz7o0TYLJJQn0YZm5tIZRhQ=";
+    hash = "sha256-lYoYU39/ayZb8Ue25a7uSN5x8tihzjj5mGaVKWPfa1w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/home-automation/evcc/default.nix b/pkgs/servers/home-automation/evcc/default.nix
index ba41a9dc7210..ac7f52e9561f 100644
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@@ -21,13 +21,13 @@ in
 
 buildGoModule rec {
   pname = "evcc";
-  version = "0.126.1";
+  version = "0.126.2";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     rev = version;
-    hash = "sha256-qNH1YdKQZptTGGOf/Nh4pBOpWCSgnq+JltF2OjlVGDk=";
+    hash = "sha256-jeOlBHCPn+k+rXADm0hcGqg+7qn8FOJKnCfSwZazRl8=";
   };
 
   vendorHash = "sha256-jJOxFkoVBT1NrnhntHPa2/irjHD09zKbtNDQoyelJp4=";
@@ -78,6 +78,7 @@ buildGoModule rec {
     # requires network access
     rm meter/template_test.go
     rm charger/template_test.go
+    rm tariff/template_test.go
   '';
 
   passthru = {
diff --git a/pkgs/servers/sql/rqlite/default.nix b/pkgs/servers/sql/rqlite/default.nix
index d590037c2403..fbf70f1e4b49 100644
--- a/pkgs/servers/sql/rqlite/default.nix
+++ b/pkgs/servers/sql/rqlite/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "rqlite";
-  version = "8.23.4";
+  version = "8.24.1";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5/vcle0b/EypdA7IC28IYRYc5HxUC2zT/VsKLPurWPk=";
+    sha256 = "sha256-K2OSOzdhJv1F1nJUqmPOVsqQZpOwWKdWQZyrHXH/hf0=";
   };
 
   vendorHash = "sha256-Z/Cou6NDVQVu1F4XlgMM0jI72jF2vuI6mRGhWqObXKM=";
diff --git a/pkgs/servers/uwsgi/default.nix b/pkgs/servers/uwsgi/default.nix
index b75b1633df1c..92b0131ff411 100644
--- a/pkgs/servers/uwsgi/default.nix
+++ b/pkgs/servers/uwsgi/default.nix
@@ -71,13 +71,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uwsgi";
-  version = "2.0.24";
+  version = "2.0.25.1";
 
   src = fetchFromGitHub {
     owner = "unbit";
     repo = "uwsgi";
     rev = finalAttrs.version;
-    hash = "sha256-KVzIp2rKCpF6aXhhu+6nw7q8Pnx/0+HD23mmYmVFPSA=";
+    hash = "sha256-hAjwn5sZynMNBPw2dAtuf0xIbnDSraIWas6OEGdJlfc=";
   };
 
   patches = [
diff --git a/pkgs/tools/admin/qovery-cli/default.nix b/pkgs/tools/admin/qovery-cli/default.nix
index bfb27003c423..265f7f9de069 100644
--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "qovery-cli";
-  version = "0.92.2";
+  version = "0.92.3";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-V5CUDBQL5ZqurNSowfh+916BScqg0o5O37pl1o8W96g=";
+    hash = "sha256-Xcl/2vkuOYfZcgICThYD5i1h82E6Leh+hNPzmzISZvQ=";
   };
 
   vendorHash = "sha256-6gjYnDv4L2AO47uWcp/MySX9i3IDMIWQUvgglxPCvGo=";
diff --git a/pkgs/tools/filesystems/bindfs/default.nix b/pkgs/tools/filesystems/bindfs/default.nix
index f7d5ce61d81c..fbd016eda799 100644
--- a/pkgs/tools/filesystems/bindfs/default.nix
+++ b/pkgs/tools/filesystems/bindfs/default.nix
@@ -7,12 +7,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.17.6";
+  version = "1.17.7";
   pname = "bindfs";
 
   src = fetchurl {
     url = "https://bindfs.org/downloads/bindfs-${finalAttrs.version}.tar.gz";
-    hash = "sha256-076zzGm7K2gCzFOViOkh/qlz7WGRsTPyAkcZMR0cwYs=";
+    hash = "sha256-wLBg6Uw6IxodSqC88mb/GJmBpO845C++IylqfYFxm3o=";
   };
 
   nativeBuildInputs = [
@@ -32,5 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ lovek323 lovesegfault ];
     platforms = lib.platforms.unix;
+    broken = stdenv.isDarwin; # last successful build 2023-11-17
   };
 })
diff --git a/pkgs/tools/graphics/dpic/default.nix b/pkgs/tools/graphics/dpic/default.nix
index fb3e0c19bf82..53066ce42f8f 100644
--- a/pkgs/tools/graphics/dpic/default.nix
+++ b/pkgs/tools/graphics/dpic/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dpic";
-  version = "2023.06.01";
+  version = "2024.01.01";
 
   src = fetchurl {
     url = "https://ece.uwaterloo.ca/~aplevich/dpic/${pname}-${version}.tar.gz";
-    sha256 = "sha256-7sIGSHMsxEsO9b7nutY6cBxS59mrT3bepNNDQi2L+X4=";
+    sha256 = "sha256-FhkBrJr4bXMFUSuhtWSUBPtMgDoPqwYmJ8w8WJWthy8=";
   };
 
   # The prefix passed to configure is not used.
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index b136dcb6ad93..fc1d076c1ad6 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.37.0";
+  version = "1.38.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IJSXP4B07/0ZHzuAmPBXn/n0O7LOYNTB812sKz+mGuc=";
+    hash = "sha256-eKvJyORTb8gFgyeWW7C6PngQ+bKE9Oln2lpd646YbMU=";
   };
 
-  cargoHash = "sha256-jsy7FtTX/iG3TPdbYemG+6jbguQN4LoYMgscMffik7g=";
+  cargoHash = "sha256-uX0pQMt6WLUsXaUmbMojyScykdFe8DqpyGrK0QC66eE=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/misc/gtkterm/default.nix b/pkgs/tools/misc/gtkterm/default.nix
index ebd7ec388764..d761cf0644a6 100644
--- a/pkgs/tools/misc/gtkterm/default.nix
+++ b/pkgs/tools/misc/gtkterm/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkterm";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "Jeija";
     repo = "gtkterm";
     rev = version;
-    sha256 = "sha256-4Z+8fs4VEk2+Ci1X3oUuInylTdIbQ5AiPenFqnyNXvc=";
+    sha256 = "sha256-KYkAHpyDl47LBKb7ZjxPCGw9XuMrqHPyejMhIvYAr68=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/ostree/default.nix b/pkgs/tools/misc/ostree/default.nix
index caccfbec9b69..cab9aba3d90c 100644
--- a/pkgs/tools/misc/ostree/default.nix
+++ b/pkgs/tools/misc/ostree/default.nix
@@ -8,6 +8,7 @@
 , gobject-introspection
 , gjs
 , nixosTests
+, pkgsCross
 , curl
 , glib
 , systemd
@@ -140,6 +141,7 @@ in stdenv.mkDerivation rec {
 
   passthru = {
     tests = {
+      musl = pkgsCross.musl64.ostree;
       installedTests = nixosTests.installed-tests.ostree;
     };
   };
diff --git a/pkgs/tools/networking/bacnet-stack/default.nix b/pkgs/tools/networking/bacnet-stack/default.nix
index 697ae7af34b3..23718b291a97 100644
--- a/pkgs/tools/networking/bacnet-stack/default.nix
+++ b/pkgs/tools/networking/bacnet-stack/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bacnet-stack";
-  version = "1.3.3";
+  version = "1.3.5";
 
   src = fetchFromGitHub {
     owner = "bacnet-stack";
     repo = "bacnet-stack";
     rev = "bacnet-stack-${version}";
-    sha256 = "sha256-fFQIyZYHHNyszUO8jySIB9Y/Amzj/TTdxaex76ovBmw=";
+    sha256 = "sha256-Iwo0bNulKdFNwNU2xj6Uin+5hQt1I3N6+zso5BHrIOU=";
   };
 
   hardeningDisable = [ "all" ];
diff --git a/pkgs/tools/networking/ghz/default.nix b/pkgs/tools/networking/ghz/default.nix
index eb20a398e419..ca48241b8ff8 100644
--- a/pkgs/tools/networking/ghz/default.nix
+++ b/pkgs/tools/networking/ghz/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ghz";
-  version = "0.117.0";
+  version = "0.118.0";
 
   src = fetchFromGitHub {
     owner = "bojand";
     repo = "ghz";
     rev = "v${version}";
-    sha256 = "sha256-aAqbSPcz7qQID4H0Vu3VTnbECvlj+We9K5F656k9jTw=";
+    sha256 = "sha256-oBxkXe5PHdi5H5qSwV2G6+wBTvI4nRJuaRnUiq/3l+c=";
   };
 
-  vendorHash = "sha256-jtzCOF5TAHv3PiGxBx65IR/3x6JpqMzsWW8amab8hqQ=";
+  vendorHash = "sha256-h/obb+hJ0XnE7GK7G5djITjiL0OjjIk1q68JM8+EfHo=";
 
   subPackages = [ "cmd/ghz" "cmd/ghz-web" ];
 
diff --git a/pkgs/tools/networking/swagger-codegen3/default.nix b/pkgs/tools/networking/swagger-codegen3/default.nix
index 4caade2c053e..ca30bba0c35e 100644
--- a/pkgs/tools/networking/swagger-codegen3/default.nix
+++ b/pkgs/tools/networking/swagger-codegen3/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, jre, makeWrapper, testers, swagger-codegen3 }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.54";
+  version = "3.0.55";
   pname = "swagger-codegen";
 
   jarfilename = "${pname}-cli-${version}.jar";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://maven/io/swagger/codegen/v3/${pname}-cli/${version}/${jarfilename}";
-    sha256 = "sha256-OOv+7r43mxUZjTs3tGHax3Yu7CNM8bg6XkOt5pJADy0=";
+    sha256 = "sha256-xiPeWblDr6P405o4ik0gWG2GfBPC/eGtEyF6XCRFHGg=";
   };
 
   dontUnpack = true;
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     maintainers = [ maintainers._1000101 ];
     mainProgram = "swagger-codegen3";
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index abead14389c9..3be774f92048 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -172,12 +172,12 @@ in lib.makeExtensible (self: ({
 
   git = common rec {
     version = "2.23.0";
-    suffix = "pre20240426_${lib.substring 0 8 src.rev}";
+    suffix = "pre20240502_${lib.substring 0 8 src.rev}";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "2f678331d59451dd6f1d9512cb6d92e4ecb9750f";
-      hash = "sha256-4AwaLB/gTRgvZG4FmFY6OY52yeLAnj0a6rtJCz7TRXA=";
+      rev = "00ca2b05b8fbbef09be5d1e4820857605d4c31b6";
+      hash = "sha256-trTxWfGElp0rkjquqG5I5RYVoxo8foCflxJFUtHwnOQ=";
     };
   };
 
diff --git a/pkgs/tools/security/cnquery/default.nix b/pkgs/tools/security/cnquery/default.nix
index 9c87dab3f1c6..3451540aa776 100644
--- a/pkgs/tools/security/cnquery/default.nix
+++ b/pkgs/tools/security/cnquery/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.1.1";
+  version = "11.2.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     rev = "refs/tags/v${version}";
-    hash = "sha256-99bkEoAfNfejO/M1V8KmAmyP+klrCtmkf1l6aZynEgQ=";
+    hash = "sha256-6syVPPIqLoesz26OIdnGHwJlfYvZC73eX8kKJ/ZlOGU=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-Nb2KSTS85//GC4ikYgrNNoKYJYBYvG9q5GF5RPemklE=";
+  vendorHash = "sha256-7ZU0tB3sPdBKCktiB81HZzRbsYdhTnMDd/Lu6oLa+D4=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 6d2752ed9350..b6526540c77b 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.6"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.7"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 1da9542ad25b..9e15c13be2d2 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 55ea82f7d3f98652ea81ab1d29d3be3e55528345
-  ref: refs/tags/6.4.6
+  revision: 2f47cc94d99413b39b5963e94355f0d1ae012cb5
+  ref: refs/tags/6.4.7
   specs:
-    metasploit-framework (6.4.6)
+    metasploit-framework (6.4.7)
       actionpack (~> 7.0.0)
       activerecord (~> 7.0.0)
       activesupport (~> 7.0.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index f2f5ca23e802..85b471c8e8c9 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.4.6";
+  version = "6.4.7";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-2O/Hl95yd+4va6TGxd5zYdsjcgBwCGOcZ2jvtoOBhBE=";
+    hash = "sha256-HqISVgemx7heOxTfjjEf4si3wQle4pHGi5AW7nroPoc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index d829b53f6c5c..7d3b53263be2 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -674,12 +674,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "55ea82f7d3f98652ea81ab1d29d3be3e55528345";
-      sha256 = "04c4h61vdvv8cyf6623h01r27nv1fggcbim4dcpywxvjvsbwgvyq";
+      rev = "2f47cc94d99413b39b5963e94355f0d1ae012cb5";
+      sha256 = "11ryx1xfw5lhig393qjy170vgj723wqqxpql7dgbiix60xb158hy";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.6";
+    version = "6.4.7";
   };
   metasploit-model = {
     groups = ["default"];
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 933b3241d8ee..e81a92b3f1e0 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.2.5";
+  version = "3.2.6";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eoTENTqQgBFS/a7hakJh3eugoSrQrYMSnlT0381308Q=";
+    hash = "sha256-lbN82tzH2sXRM8aOjPvFI5J18k4OdYpurLCR8TjVyrw=";
   };
 
-  vendorHash = "sha256-+TIovSS13z9NIixEOFDPH3aOEoH7emlTunH9IoG/RWY=";
+  vendorHash = "sha256-F7k8XejAPlrv4RYCvVWxX1OlDXOGS/ow8wHXyuaCkq0=";
 
   subPackages = [ "cmd/nuclei/" ];
 
diff --git a/pkgs/tools/system/kanata/default.nix b/pkgs/tools/system/kanata/default.nix
index 935d671ab7b7..d5df91649898 100644
--- a/pkgs/tools/system/kanata/default.nix
+++ b/pkgs/tools/system/kanata/default.nix
@@ -8,19 +8,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kanata";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "jtroo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UZ6WoUZcnqN9k277ikix91UTnqQsUgZW69vbSNNbyHU=";
+    sha256 = "sha256-Kuxy6lGzImYYujuJwZZdfuu3X7/PJNOJefeZ0hVJaAA=";
   };
 
   cargoHash =
     if stdenv.isLinux
-    then "sha256-DLOQnQJtrR7A/elOTVXEnIdLM/FuWYWAPqpbSAXHDMo="
-    else "sha256-g6selNjRv9AwkPrzLllJf1VshBvwPhd+lTFIbtSnc3E=";
+    then "sha256-R2lHg+I8Sry3/n8vTfPpDysKCKMDUvxyMKRhEQKDqS0="
+    else "sha256-9CXrOP6SI+sCD9Q94N8TlRB/h+F/l7t3zHbtVDqddS4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.IOKit ];
 
@@ -37,5 +37,6 @@ rustPlatform.buildRustPackage rec {
     maintainers = with maintainers; [ bmanuel linj ];
     platforms = platforms.unix;
     mainProgram = "kanata";
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 483b0b43661b..1e3b17caf90b 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -56,5 +56,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = [ maintainers.vcunat ]; # not really, but someone should watch it
+    mainProgram = "lspci";
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 12bdbeaac305..cfd6d7c8ad51 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2759,20 +2759,38 @@ with pkgs;
 
   pcsxr = callPackage ../applications/emulators/pcsxr { };
 
-  ppsspp-sdl = ppsspp.override {
-    enableQt = false;
-    enableVulkan = true;
-  };
+  ppsspp-sdl = let
+    argset = {
+      ffmpeg = ffmpeg_4;
+      glew = glew.override { enableEGL = argset.forceWayland; };
+      enableQt = false;
+      enableVulkan = true;
+      forceWayland = false;
+    };
+  in
+    ppsspp.override argset;
 
-  ppsspp-sdl-wayland = ppsspp.override {
-    forceWayland = true;
-    enableVulkan = false; # https://github.com/hrydgard/ppsspp/issues/13845
-  };
+  ppsspp-sdl-wayland = let
+    argset = {
+      ffmpeg = ffmpeg_4;
+      glew = glew.override { enableEGL = argset.forceWayland; };
+      enableQt = false;
+      enableVulkan = false; # https://github.com/hrydgard/ppsspp/issues/13845
+      forceWayland = true;
+    };
+  in
+    ppsspp.override argset;
 
-  ppsspp-qt = ppsspp.override {
-    enableQt = true;
-    enableVulkan = false; # https://github.com/hrydgard/ppsspp/issues/11628
-  };
+  ppsspp-qt = let
+    argset = {
+      ffmpeg = ffmpeg_4;
+      glew = glew.override { enableEGL = argset.forceWayland; };
+      enableQt = true;
+      enableVulkan = false; # https://github.com/hrydgard/ppsspp/issues/11628
+      forceWayland = false;
+    };
+  in
+    ppsspp.override argset;
 
   proton-caller = callPackage ../applications/emulators/proton-caller { };
 
@@ -8923,8 +8941,6 @@ with pkgs;
 
   haste-server = callPackage ../servers/haste-server { };
 
-  hatch = python3Packages.callPackage ../development/tools/hatch { };
-
   hal-hardware-analyzer = libsForQt5.callPackage ../applications/science/electronics/hal-hardware-analyzer {
     stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
   };
@@ -31879,8 +31895,6 @@ with pkgs;
 
   waylevel = callPackage ../tools/misc/waylevel { };
 
-  wbg = callPackage ../applications/misc/wbg { };
-
   i3 = callPackage ../applications/window-managers/i3 {
     xcb-util-cursor = if stdenv.isDarwin then xcb-util-cursor-HEAD else xcb-util-cursor;
   };
@@ -32200,6 +32214,7 @@ with pkgs;
 
   inherit (callPackage ../applications/networking/cluster/k3s {
     buildGoModule = buildGo121Module;
+    go = go_1_21;
   }) k3s_1_26 k3s_1_27 k3s_1_28 k3s_1_29;
   k3s = k3s_1_29;