diff --git a/.github/workflows/check-by-name.yml b/.github/workflows/check-by-name.yml
index 34c9e0632b5e..59eb6c857f64 100644
--- a/.github/workflows/check-by-name.yml
+++ b/.github/workflows/check-by-name.yml
@@ -120,5 +120,6 @@ jobs:
           else
             exitCode=$?
             echo "To run locally: ./maintainers/scripts/check-by-name.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
+            echo "If you're having trouble, ping @NixOS/nixpkgs-check-by-name"
             exit "$exitCode"
           fi
diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 8eb3d1ff39a4..8fa0f9a5aaa5 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -287,6 +287,43 @@ buildNpmPackage {
 }
 ```
 
+#### importNpmLock.buildNodeModules {#javascript-buildNpmPackage-importNpmLock.buildNodeModules}
+
+`importNpmLock.buildNodeModules` returns a derivation with a pre-built `node_modules` directory, as imported by `importNpmLock`.
+
+This is to be used together with `importNpmLock.hooks.linkNodeModulesHook` to facilitate `nix-shell`/`nix develop` based development workflows.
+
+It accepts an argument with the following attributes:
+
+`npmRoot` (Path; optional)
+: Path to package directory containing the source tree. If not specified, the `package` and `packageLock` arguments must both be specified.
+
+`package` (Attrset; optional)
+: Parsed contents of `package.json`, as returned by `lib.importJSON ./my-package.json`. If not specified, the `package.json` in `npmRoot` is used.
+
+`packageLock` (Attrset; optional)
+: Parsed contents of `package-lock.json`, as returned `lib.importJSON ./my-package-lock.json`. If not specified, the `package-lock.json` in `npmRoot` is used.
+
+`derivationArgs` (`mkDerivation` attrset; optional)
+: Arguments passed to `stdenv.mkDerivation`
+
+For example:
+
+```nix
+pkgs.mkShell {
+  packages = [
+    importNpmLock.hooks.linkNodeModulesHook
+    nodejs
+  ];
+
+  npmDeps = importNpmLock.buildNodeModules {
+    npmRoot = ./.;
+    inherit nodejs;
+  };
+}
+```
+will create a development shell where a `node_modules` directory is created & packages symlinked to the Nix store when activated.
+
 ### corepack {#javascript-corepack}
 
 This package puts the corepack wrappers for pnpm and yarn in your PATH, and they will honor the `packageManager` setting in the `package.json`.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 19d8c8bb4d6a..8ab2825ce1a5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5630,6 +5630,12 @@
     githubId = 6689924;
     name = "David Terry";
   };
+  dxwil = {
+    email = "dovydas@kersys.lt";
+    github = "dxwil";
+    githubId = 90563298;
+    name = "Dovydas Kersys";
+  };
   dylan-gonzalez = {
     email = "dylcg10@gmail.com";
     github = "dylan-gonzalez";
@@ -12284,6 +12290,12 @@
     githubId = 44469719;
     name = "Jussi Kuokkanen";
   };
+  lutzberger = {
+    email = "lutz.berger@airbus.com";
+    github = "lutzberger";
+    githubId = 115777584;
+    name = "Lutz Berger";
+  };
   lux = {
     email = "lux@lux.name";
     github = "luxzeitlos";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index a34a890c14ae..b374cfebbec4 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -656,6 +656,7 @@
   ./services/logging/syslogd.nix
   ./services/logging/vector.nix
   ./services/logging/ulogd.nix
+  ./services/mail/automx2.nix
   ./services/mail/clamsmtp.nix
   ./services/mail/davmail.nix
   ./services/mail/dkimproxy-out.nix
diff --git a/nixos/modules/programs/rust-motd.nix b/nixos/modules/programs/rust-motd.nix
index 301b7cebb7f8..19f98868ee34 100644
--- a/nixos/modules/programs/rust-motd.nix
+++ b/nixos/modules/programs/rust-motd.nix
@@ -88,7 +88,7 @@ in {
   };
   config = lib.mkIf cfg.enable {
     assertions = [
-      { assertion = config.users.motd == null;
+      { assertion = config.users.motd == "";
         message = ''
           `programs.rust-motd` is incompatible with `users.motd`!
         '';
diff --git a/nixos/modules/services/mail/automx2.nix b/nixos/modules/services/mail/automx2.nix
new file mode 100644
index 000000000000..2cfb5f491341
--- /dev/null
+++ b/nixos/modules/services/mail/automx2.nix
@@ -0,0 +1,108 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.automx2;
+  format = pkgs.formats.json { };
+in
+{
+  options = {
+    services.automx2 = {
+      enable = lib.mkEnableOption "automx2";
+
+      package = lib.mkPackageOption pkgs [
+        "python3Packages"
+        "automx2"
+      ] { };
+
+      domain = lib.mkOption {
+        type = lib.types.str;
+        example = "example.com";
+        description = ''
+          E-Mail-Domain for which mail client autoconfig/autoconfigure should be set up.
+          The `autoconfig` and `autodiscover` subdomains are automatically prepended and set up with ACME.
+          The names of those domains are hardcoded in the mail clients and are not configurable.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 4243;
+        description = "Port used by automx2.";
+      };
+
+      settings = lib.mkOption {
+        inherit (format) type;
+        description = ''
+          Bootstrap json to populate database.
+          See [docs](https://rseichter.github.io/automx2/#_sqlite) for details.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      virtualHosts = {
+        "autoconfig.${cfg.domain}" = {
+          enableACME = true;
+          forceSSL = true;
+          serverAliases = [ "autodiscover.${cfg.domain}" ];
+          locations = {
+            "/".proxyPass = "http://127.0.0.1:${toString cfg.port}/";
+            "/initdb".extraConfig = ''
+              # Limit access to clients connecting from localhost
+              allow 127.0.0.1;
+              deny all;
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.services.automx2 = {
+      after = [ "network.target" ];
+      postStart = ''
+        sleep 3
+        ${lib.getExe pkgs.curl} -X POST --json @${format.generate "automx2.json" cfg.settings} http://127.0.0.1:${toString cfg.port}/initdb/
+      '';
+      serviceConfig = {
+        Environment = [
+          "AUTOMX2_CONF=${pkgs.writeText "automx2-conf" ''
+            [automx2]
+            loglevel = WARNING
+            db_uri = sqlite:///:memory:
+            proxy_count = 1
+          ''}"
+          "FLASK_APP=automx2.server:app"
+          "FLASK_CONFIG=production"
+        ];
+        ExecStart = "${
+          pkgs.python3.buildEnv.override { extraLibs = [ cfg.package ]; }
+        }/bin/flask run --host=127.0.0.1 --port=${toString cfg.port}";
+        Restart = "always";
+        StateDirectory = "automx2";
+        User = "automx2";
+        WorkingDirectory = "/var/lib/automx2";
+      };
+      unitConfig = {
+        Description = "MUA configuration service";
+        Documentation = "https://rseichter.github.io/automx2/";
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    users = {
+      groups.automx2 = { };
+      users.automx2 = {
+        group = "automx2";
+        isSystemUser = true;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index 22e61ea3a683..eeb8d03f1902 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -48,7 +48,7 @@ let
     preferLocalBuild = true;
   } ''
     mkdir -p $out/bin
-    for i in changePassword.php createAndPromote.php userOptions.php edit.php nukePage.php update.php; do
+    for i in changePassword.php createAndPromote.php resetUserEmail.php userOptions.php edit.php nukePage.php update.php; do
       makeWrapper ${php}/bin/php $out/bin/mediawiki-$(basename $i .php) \
         --set MEDIAWIKI_CONFIG ${mediawikiConfig} \
         --add-flags ${pkg}/share/mediawiki/maintenance/$i
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 9a0d63d42db6..fe85fcf4b567 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1004,10 +1004,6 @@
     dependencies = with self; [ plenary-nvim ];
   };
 
-  lualine-nvim = super.lualine-nvim.overrideAttrs {
-    dependencies = with self; [ nvim-web-devicons ];
-  };
-
   luasnip = super.luasnip.overrideAttrs {
     dependencies = with self; [ luaPackages.jsregexp ];
   };
diff --git a/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
index f1e2132dc81d..001e7e60f822 100644
--- a/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix
@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "mongodb-vscode";
     publisher = "mongodb";
-    version = "1.7.0";
-    hash = "sha256-EDU8kQLTQIe5D905ZVskFt/28Mzv1Zr7auqG4tksQ/o=";
+    version = "1.8.0";
+    hash = "sha256-KtpXhDRf9vFS0iSQCJzywmIlRMhWLOlSuK7DPc0ddnw=";
   };
 
   meta = {
diff --git a/pkgs/applications/misc/joplin-desktop/default.nix b/pkgs/applications/misc/joplin-desktop/default.nix
index 2118d623cd22..6a1a9423b5eb 100644
--- a/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/pkgs/applications/misc/joplin-desktop/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "joplin-desktop";
-  version = "3.0.13";
+  version = "3.0.15";
 
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "Unsupported system: ${system}";
@@ -16,9 +16,9 @@ let
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}${suffix}";
     sha256 = {
-      x86_64-linux = "sha256-/B7udtkRP8rOYzXupWSEGg0FrJoRJ63l4uLtQWe2CZ8=";
-      x86_64-darwin = "sha256-XZN1jTv/FhJXuFxZ6D6h/vFMdKi84Z9UWfj2CrMgBBA=";
-      aarch64-darwin = "sha256-lsODOBkZ4+x5D6Er2/paTzAMKZvqIBVkKrWHh5iRvrk=";
+      x86_64-linux = "sha256-rNKYihIbdfGZEIGURyty+hS82ftHsqV1YjqM8VYB6RU=";
+      x86_64-darwin = "sha256-s7gZSr/5VOg8bqxGPckK7UxDpvmsNgdhjDg+lxnO/lU=";
+      aarch64-darwin = "sha256-UzAGYIKd5swtl6XNFVTPeg0nqwKKtu0e36+LA0Qiusw=";
     }.${system} or throwSystem;
   };
 
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 0788b035e997..efd486ede2d7 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,11 +1,11 @@
 {
   stable = {
     chromedriver = {
-      hash_darwin = "sha256-4wp3nlGkuNDlmF+3bmJOmaMccQcsXBZaVO95Se6Vj1M=";
+      hash_darwin = "sha256-tC2BZmjKeYjBfwJINtgVQEJjiqJidVtnXdxigFkR2/M=";
       hash_darwin_aarch64 =
-        "sha256-La32ZBMgdWyl4nFoh4LfaxsoZJxrYkB/fbYOzltG8e8=";
-      hash_linux = "sha256-qhoTtgPNrs2jMEVbVuVZAsQDygm72xfhWvhDC/mDUzc=";
-      version = "128.0.6613.84";
+        "sha256-MRXiiQPY8EZ85zRCmJyxuI7SG5RbalBBg+vt0goeWus=";
+      hash_linux = "sha256-rQ/WYDghBXewFqMTGf7ZJGp2mMiPwjf8ImNyTvXulQU=";
+      version = "128.0.6613.86";
     };
     deps = {
       gn = {
@@ -15,8 +15,8 @@
         version = "2024-06-11";
       };
     };
-    hash = "sha256-kUHJtJ4X8UDMP2TgHdFd6gEPzU28mBgxtGceVZCl5xM=";
-    version = "128.0.6613.84";
+    hash = "sha256-wqhaK1VuE1qPLt+f/x2KrtwZGxKFluTOWYMau+cSl2E=";
+    version = "128.0.6613.113";
   };
   ungoogled-chromium = {
     deps = {
diff --git a/pkgs/applications/networking/browsers/misc/widevine-cdm.nix b/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
index 0c8d8fb24edd..bd5813ddcccc 100644
--- a/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
+++ b/pkgs/applications/networking/browsers/misc/widevine-cdm.nix
@@ -1,34 +1,70 @@
 { lib
 , stdenv
+, fetchurl
 , fetchzip
+, fetchFromGitHub
+, squashfsTools
+, curl
+, python3
 }:
 
 stdenv.mkDerivation rec {
   pname = "widevine-cdm";
   version = "4.10.2710.0";
+  lacrosVersion = "120.0.6098.0";
 
-  src = fetchzip {
+  widevineInstaller = if stdenv.isAarch64 then fetchFromGitHub {
+      owner = "AsahiLinux";
+      repo = "widevine-installer";
+      rev = "7a3928fe1342fb07d96f61c2b094e3287588958b";
+      sha256 = "sha256-XI1y4pVNpXS+jqFs0KyVMrxcULOJ5rADsgvwfLF6e0Y=";
+    } else null;
+
+  src = if stdenv.isAarch64 then fetchurl {
+    url = "https://commondatastorage.googleapis.com/chromeos-localmirror/distfiles/chromeos-lacros-arm64-squash-zstd-${lacrosVersion}";
+    hash = "sha256-OKV8w5da9oZ1oSGbADVPCIkP9Y0MVLaQ3PXS3ZBLFXY=";
+  } else fetchzip {
     url = "https://dl.google.com/widevine-cdm/${version}-linux-x64.zip";
     hash = "sha256-lGTrSzUk5FluH1o4E/9atLIabEpco3C3gZw+y6H6LJo=";
     stripRoot = false;
   };
 
+  buildInputs = [ squashfsTools curl python3 ];
+
+  unpackPhase = if stdenv.isAarch64 then ''
+    curl -# -o lacros.squashfs "file://$src"
+    unsquashfs -q lacros.squashfs 'WidevineCdm/*'
+    python3 ${widevineInstaller}/widevine_fixup.py squashfs-root/WidevineCdm/_platform_specific/cros_arm64/libwidevinecdm.so libwidevinecdm.so
+    cp squashfs-root/WidevineCdm/manifest.json .
+    cp squashfs-root/WidevineCdm/LICENSE LICENSE.txt
+  '' else null;
+
   installPhase = ''
     runHook preInstall
 
     install -vD manifest.json $out/share/google/chrome/WidevineCdm/manifest.json
     install -vD LICENSE.txt $out/share/google/chrome/WidevineCdm/LICENSE.txt
-    install -vD libwidevinecdm.so $out/share/google/chrome/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
+    install -vD libwidevinecdm.so $out/share/google/chrome/WidevineCdm/_platform_specific/linux_${
+    if stdenv.targetPlatform.isAarch64 then "arm64"
+    else if stdenv.targetPlatform.isx86_64 then "x64"
+    else throw "Unsupported platform ${stdenv.targetPlatform.config}"
+    }/libwidevinecdm.so
 
     runHook postInstall
   '';
 
+# Accoring to widevine-installer: "Hack because Chromium hardcodes a check for this right now..."
+  postInstall = lib.optionalString stdenv.isAarch64 ''
+    mkdir -p "$out/share/google/chrome/WidevineCdm/_platform_specific/linux_x64"
+    touch "$out/share/google/chrome/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so"
+  '';
+
   meta = with lib; {
     description = "Widevine CDM";
     homepage = "https://www.widevine.com";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    maintainers = with maintainers; [ jlamur ];
-    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ jlamur dxwil ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 }
diff --git a/pkgs/applications/networking/remote/freerdp/3.nix b/pkgs/applications/networking/remote/freerdp/3.nix
index 9ec1d9e0c620..202893ced50c 100644
--- a/pkgs/applications/networking/remote/freerdp/3.nix
+++ b/pkgs/applications/networking/remote/freerdp/3.nix
@@ -61,6 +61,8 @@
 , withManPages ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
 
 , buildPackages
+, gnome
+, remmina
 }:
 
 let
@@ -163,19 +165,19 @@ stdenv.mkDerivation (finalAttrs: {
     "-DDOCBOOKXSL_DIR=${docbook-xsl-nons}/xml/xsl/docbook"
   ] ++ lib.mapAttrsToList (k: v: "-D${k}=${cmFlag v}") {
     BUILD_TESTING = false; # false is recommended by upstream
-    WITH_CAIRO = (cairo != null);
-    WITH_CUPS = (cups != null);
-    WITH_FAAC = (withUnfree && faac != null);
-    WITH_FAAD2 = (faad2 != null);
-    WITH_FUSE = (stdenv.isLinux && fuse3 != null);
-    WITH_JPEG = (libjpeg_turbo != null);
-    WITH_KRB5 = (libkrb5 != null);
-    WITH_OPENH264 = (openh264 != null);
-    WITH_OPUS = (libopus != null);
+    WITH_CAIRO = cairo != null;
+    WITH_CUPS = cups != null;
+    WITH_FAAC = withUnfree && faac != null;
+    WITH_FAAD2 = faad2 != null;
+    WITH_FUSE = stdenv.isLinux && fuse3 != null;
+    WITH_JPEG = libjpeg_turbo != null;
+    WITH_KRB5 = libkrb5 != null;
+    WITH_OPENH264 = openh264 != null;
+    WITH_OPUS = libopus != null;
     WITH_OSS = false;
     WITH_MANPAGES = withManPages;
-    WITH_PCSC = (pcsclite != null);
-    WITH_PULSE = (libpulseaudio != null);
+    WITH_PCSC = pcsclite != null;
+    WITH_PULSE = libpulseaudio != null;
     WITH_SERVER = buildServer;
     WITH_WEBVIEW = false; # avoid introducing webkit2gtk-4.0
     WITH_VAAPI = false; # false is recommended by upstream
@@ -194,6 +196,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-framework AudioToolbox"
   ]);
 
+  passthru.tests = {
+    inherit remmina;
+    inherit (gnome) gnome-remote-desktop;
+  };
+
   meta = with lib; {
     description = "Remote Desktop Protocol Client";
     longDescription = ''
diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
index c00aff0b2288..67931a07dd40 100644
--- a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
@@ -149,22 +149,22 @@ let
               target=$(readlink $out/share/glib-2.0)
               rm $out/share/glib-2.0
               mkdir $out/share/glib-2.0
-              ln -fs $target/* $out/share/glib-2.0
+              ln -fsr $target/* $out/share/glib-2.0
           fi
 
           if [[ -L $out/share/glib-2.0/schemas ]]; then
               target=$(readlink $out/share/glib-2.0/schemas)
               rm $out/share/glib-2.0/schemas
               mkdir $out/share/glib-2.0/schemas
-              ln -fs $target/* $out/share/glib-2.0/schemas
+              ln -fsr $target/* $out/share/glib-2.0/schemas
           fi
 
           mkdir -p $out/share/glib-2.0/schemas
 
           for d in $out/share/gsettings-schemas/*; do
               # Force symlink, in case there are duplicates
-              ln -fs $d/glib-2.0/schemas/*.xml $out/share/glib-2.0/schemas
-              ln -fs $d/glib-2.0/schemas/*.gschema.override $out/share/glib-2.0/schemas
+              ln -fsr $d/glib-2.0/schemas/*.xml $out/share/glib-2.0/schemas
+              ln -fsr $d/glib-2.0/schemas/*.gschema.override $out/share/glib-2.0/schemas
           done
 
           # and compile them
diff --git a/pkgs/build-support/node/import-npm-lock/default.nix b/pkgs/build-support/node/import-npm-lock/default.nix
index b63e5237dc3e..48057ec8891e 100644
--- a/pkgs/build-support/node/import-npm-lock/default.nix
+++ b/pkgs/build-support/node/import-npm-lock/default.nix
@@ -52,11 +52,16 @@ let
       else null
     );
 
+  cleanModule = lib.flip removeAttrs [
+    "link" # Remove link not to symlink directories. These have been processed to store paths already.
+    "funding" # Remove funding to get rid sponsorship nag in build output
+  ];
+
   # Manage node_modules outside of the store with hooks
   hooks = callPackages ./hooks { };
 
 in
-{
+lib.fix (self: {
   importNpmLock =
     { npmRoot ? null
     , package ? importJSON (npmRoot + "/package.json")
@@ -94,10 +99,8 @@ in
                   fetcherOpts = fetcherOpts.${modulePath} or {};
                 };
               in
-              (removeAttrs module [
-                "link"
-                "funding"
-              ]) // lib.optionalAttrs (src != null) {
+              cleanModule module
+              // lib.optionalAttrs (src != null) {
                 resolved = "file:${src}";
               } // lib.optionalAttrs (module ? dependencies) {
                 dependencies = mapLockDependencies module.dependencies;
@@ -133,8 +136,52 @@ in
       cp "$packageLockPath" $out/package-lock.json
     '';
 
+  # Build node modules from package.json & package-lock.json
+  buildNodeModules =
+    { npmRoot ? null
+    , package ? importJSON (npmRoot + "/package.json")
+    , packageLock ? importJSON (npmRoot + "/package-lock.json")
+    , nodejs
+    , derivationArgs ? { }
+    }:
+    stdenv.mkDerivation ({
+      pname = derivationArgs.pname or "${getName package}-node-modules";
+      version = derivationArgs.version or getVersion package;
+
+      dontUnpack = true;
+
+      npmDeps = self.importNpmLock {
+        inherit npmRoot package packageLock;
+      };
+
+      package = toJSON package;
+      packageLock = toJSON packageLock;
+
+      installPhase = ''
+        runHook preInstall
+        mkdir $out
+        cp package.json $out/
+        cp package-lock.json $out/
+        [[ -d node_modules ]] && mv node_modules $out/
+        runHook postInstall
+      '';
+    } // derivationArgs // {
+      nativeBuildInputs = [
+        nodejs
+        nodejs.passthru.python
+        hooks.npmConfigHook
+      ] ++ derivationArgs.nativeBuildInputs or [ ];
+
+      passAsFile = [ "package" "packageLock" ] ++ derivationArgs.passAsFile or [ ];
+
+      postPatch = ''
+        cp --no-preserve=mode "$packagePath" package.json
+        cp --no-preserve=mode "$packageLockPath" package-lock.json
+      '' + derivationArgs.postPatch or "";
+    });
+
   inherit hooks;
-  inherit (hooks) npmConfigHook;
+  inherit (hooks) npmConfigHook linkNodeModulesHook;
 
   __functor = self: self.importNpmLock;
-}
+})
diff --git a/pkgs/build-support/node/import-npm-lock/hooks/default.nix b/pkgs/build-support/node/import-npm-lock/hooks/default.nix
index 5990371def91..0140ebf2d470 100644
--- a/pkgs/build-support/node/import-npm-lock/hooks/default.nix
+++ b/pkgs/build-support/node/import-npm-lock/hooks/default.nix
@@ -10,4 +10,14 @@
         storePrefix = builtins.storeDir;
       };
     } ./npm-config-hook.sh;
+
+  linkNodeModulesHook = makeSetupHook
+    {
+      name = "node-modules-hook.sh";
+      substitutions = {
+        nodejs = lib.getExe nodejs;
+        script = ./link-node-modules.js;
+        storePrefix = builtins.storeDir;
+      };
+    } ./link-node-modules-hook.sh;
 }
diff --git a/pkgs/build-support/node/import-npm-lock/hooks/link-node-modules-hook.sh b/pkgs/build-support/node/import-npm-lock/hooks/link-node-modules-hook.sh
new file mode 100644
index 000000000000..12f2f8507fa5
--- /dev/null
+++ b/pkgs/build-support/node/import-npm-lock/hooks/link-node-modules-hook.sh
@@ -0,0 +1,31 @@
+linkNodeModulesHook() {
+    echo "Executing linkNodeModulesHook"
+    runHook preShellHook
+
+    if [ -n "${npmRoot-}" ]; then
+      pushd "$npmRoot"
+    fi
+
+    @nodejs@ @script@ @storePrefix@ "${npmDeps}/node_modules"
+    if test -f node_modules/.bin; then
+        export PATH=$(readlink -f node_modules/.bin):$PATH
+    fi
+
+    if [ -n "${npmRoot-}" ]; then
+      popd
+    fi
+
+    runHook postShellHook
+    echo "Finished executing linkNodeModulesShellHook"
+}
+
+if [ -z "${dontLinkNodeModules:-}" ] && [ -z "${shellHook-}" ]; then
+    echo "Using linkNodeModulesHook shell hook"
+    shellHook=linkNodeModulesHook
+fi
+
+
+if [ -z "${dontLinkNodeModules:-}" ]; then
+    echo "Using linkNodeModulesHook preConfigure hook"
+    preConfigureHooks+=(linkNodeModulesHook)
+fi
diff --git a/pkgs/build-support/node/import-npm-lock/hooks/link-node-modules.js b/pkgs/build-support/node/import-npm-lock/hooks/link-node-modules.js
new file mode 100644
index 000000000000..79e247eb4acb
--- /dev/null
+++ b/pkgs/build-support/node/import-npm-lock/hooks/link-node-modules.js
@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+const fs = require("fs");
+const path = require("path");
+
+async function asyncFilter(arr, pred) {
+  const filtered = [];
+  for (const elem of arr) {
+    if (await pred(elem)) {
+      filtered.push(elem);
+    }
+  }
+  return filtered;
+}
+
+// Get a list of all _unmanaged_ files in node_modules.
+// This means every file in node_modules that is _not_ a symlink to the Nix store.
+async function getUnmanagedFiles(storePrefix, files) {
+  return await asyncFilter(files, async (file) => {
+    const filePath = path.join("node_modules", file);
+
+    // Is file a symlink
+    const stat = await fs.promises.lstat(filePath);
+    if (!stat.isSymbolicLink()) {
+      return true;
+    }
+
+    // Is file in the store
+    const linkTarget = await fs.promises.readlink(filePath);
+    return !linkTarget.startsWith(storePrefix);
+  });
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const storePrefix = args[0];
+  const sourceModules = args[1];
+
+  // Ensure node_modules exists
+  try {
+    await fs.promises.mkdir("node_modules");
+  } catch (err) {
+    if (err.code !== "EEXIST") {
+      throw err;
+    }
+  }
+
+  const files = await fs.promises.readdir("node_modules");
+
+  // Get deny list of files that we don't manage.
+  // We do manage nix store symlinks, but not other files.
+  // For example: If a .vite was present in both our
+  // source node_modules and the non-store node_modules we don't want to overwrite
+  // the non-store one.
+  const unmanaged = await getUnmanagedFiles(storePrefix, files);
+  const managed = new Set(files.filter((file) => ! unmanaged.includes(file)));
+
+  const sourceFiles = await fs.promises.readdir(sourceModules);
+  await Promise.all(
+    sourceFiles.map(async (file) => {
+      const sourcePath = path.join(sourceModules, file);
+      const targetPath = path.join("node_modules", file);
+
+      // Skip file if it's not a symlink to a store path
+      if (unmanaged.includes(file)) {
+        console.log(`'${targetPath}' exists, cowardly refusing to link.`);
+        return;
+      }
+
+      // Don't unlink this file, we just wrote it.
+      managed.delete(file);
+
+      // Link to a temporary dummy path and rename.
+      // This is to get some degree of atomicity.
+      try {
+        await fs.promises.symlink(sourcePath, targetPath + "-nix-hook-temp");
+      } catch (err) {
+        if (err.code !== "EEXIST") {
+          throw err;
+        }
+
+        await fs.promises.unlink(targetPath + "-nix-hook-temp");
+        await fs.promises.symlink(sourcePath, targetPath + "-nix-hook-temp");
+      }
+      await fs.promises.rename(targetPath + "-nix-hook-temp", targetPath);
+    })
+  );
+
+  // Clean up store symlinks not included in this generation of node_modules
+  await Promise.all(
+    Array.from(managed).map((file) =>
+      fs.promises.unlink(path.join("node_modules", file)),
+    )
+  );
+}
+
+main();
diff --git a/pkgs/by-name/aa/aaaaxy/package.nix b/pkgs/by-name/aa/aaaaxy/package.nix
index a666b61ff0b0..a3561d811cc8 100644
--- a/pkgs/by-name/aa/aaaaxy/package.nix
+++ b/pkgs/by-name/aa/aaaaxy/package.nix
@@ -20,13 +20,13 @@
 
 buildGoModule rec {
   pname = "aaaaxy";
-  version = "1.5.183";
+  version = "1.5.190";
 
   src = fetchFromGitHub {
     owner = "divVerent";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-uXu9z4J3ufe7thXsAGWGTSgb8LVPboM7CSTNf7NBw1Q=";
+    hash = "sha256-yMap8Po3NeFwaqTn0gCHp8f30iiNg1AmG/ALQcW8eYA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/av/av1an-unwrapped/package.nix b/pkgs/by-name/av/av1an-unwrapped/package.nix
index a3b0cb4acc51..7c5280af9fa9 100644
--- a/pkgs/by-name/av/av1an-unwrapped/package.nix
+++ b/pkgs/by-name/av/av1an-unwrapped/package.nix
@@ -10,30 +10,24 @@
   rav1e,
   nix-update-script,
 }:
+
 rustPlatform.buildRustPackage rec {
   pname = "av1an-unwrapped";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "master-of-zen";
     repo = "av1an";
-    rev = version;
-    hash = "sha256-A4/1UdM8N5CHP44PBNB+ZH2Gcl84rcpUBwQRSnubBGc=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Mb5I+9IBwpfmK1w4LstNHI/qsJKlCuRxgSUiqpwUqF0=";
   };
 
-  cargoPatches = [
-    # TODO: Remove next release
-    # Updates the `time` crate to work around
-    # https://github.com/NixOS/nixpkgs/issues/332957
-    ./rust-1.80.0.patch
-  ];
-
-  cargoHash = "sha256-Obq4oRXZ7IHDT+B9gKrVflq/FDzoN7ttZi8Aj2uOGxM=";
+  cargoHash = "sha256-IWcSaJoakXSPIdycWIikGSmOk+D4A3aMnJwuiKn8XNY=";
 
   nativeBuildInputs = [
-    rustPlatform.bindgenHook
-    pkg-config
     nasm
+    pkg-config
+    rustPlatform.bindgenHook
   ];
 
   buildInputs = [
@@ -47,7 +41,12 @@ rustPlatform.buildRustPackage rec {
   ];
 
   passthru = {
-    updateScript = nix-update-script { };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "'^(\d*\.\d*\.\d*)$'"
+      ];
+    };
   };
 
   meta = {
@@ -57,7 +56,7 @@ rustPlatform.buildRustPackage rec {
       It can increase your encoding speed and improve cpu utilization by running multiple encoder processes in parallel.
     '';
     homepage = "https://github.com/master-of-zen/Av1an";
-    changelog = "https://github.com/master-of-zen/Av1an/releases/tag/${src.rev}";
+    changelog = "https://github.com/master-of-zen/Av1an/releases/tag/${version}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ getchoo ];
     mainProgram = "av1an";
diff --git a/pkgs/by-name/av/av1an-unwrapped/rust-1.80.0.patch b/pkgs/by-name/av/av1an-unwrapped/rust-1.80.0.patch
deleted file mode 100644
index 7acb0c9f7e65..000000000000
--- a/pkgs/by-name/av/av1an-unwrapped/rust-1.80.0.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index e5a1c65..b8cb96f 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -1008,6 +1008,12 @@ dependencies = [
-  "num-traits",
- ]
- 
-+[[package]]
-+name = "num-conv"
-+version = "0.1.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
-+
- [[package]]
- name = "num-derive"
- version = "0.3.3"
-@@ -1684,13 +1690,14 @@ dependencies = [
- 
- [[package]]
- name = "time"
--version = "0.3.31"
-+version = "0.3.36"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
-+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
- dependencies = [
-  "deranged",
-  "itoa",
-  "libc",
-+ "num-conv",
-  "num_threads",
-  "powerfmt",
-  "serde",
-@@ -1706,10 +1713,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
- 
- [[package]]
- name = "time-macros"
--version = "0.2.16"
-+version = "0.2.18"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
-+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
- dependencies = [
-+ "num-conv",
-  "time-core",
- ]
- 
diff --git a/pkgs/by-name/av/av1an/package.nix b/pkgs/by-name/av/av1an/package.nix
index ec3a4d66ae8b..5595a72fb9bf 100644
--- a/pkgs/by-name/av/av1an/package.nix
+++ b/pkgs/by-name/av/av1an/package.nix
@@ -2,7 +2,6 @@
   lib,
   symlinkJoin,
   makeBinaryWrapper,
-  testers,
   av1an-unwrapped,
   ffmpeg,
   python3Packages,
@@ -21,6 +20,7 @@
   withX265 ? true, # H.265/HEVC encoder
   withVmaf ? false, # Perceptual video quality assessment algorithm
 }:
+
 # av1an requires at least one encoder
 assert lib.assertMsg (lib.elem true [
   withAom
@@ -30,6 +30,7 @@ assert lib.assertMsg (lib.elem true [
   withX264
   withX265
 ]) "At least one encoder is required!";
+
 symlinkJoin {
   name = "av1an-${av1an-unwrapped.version}";
 
diff --git a/pkgs/by-name/eg/eg25-manager/package.nix b/pkgs/by-name/eg/eg25-manager/package.nix
index 320771bafe88..35514cf558eb 100644
--- a/pkgs/by-name/eg/eg25-manager/package.nix
+++ b/pkgs/by-name/eg/eg25-manager/package.nix
@@ -9,7 +9,7 @@
   scdoc,
   curl,
   glib,
-  libgpiod_1,
+  libgpiod,
   libgudev,
   libusb1,
   modemmanager,
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "eg25-manager";
-  version = "0.4.6";
+  version = "0.5.0";
 
   src = fetchFromGitLab {
     owner = "mobian1";
     repo = "eg25-manager";
     rev = finalAttrs.version;
-    hash = "sha256-2JsdwK1ZOr7ljNHyuUMzVCpl+HV0C5sA5LAOkmELqag=";
+    hash = "sha256-hOOYrEM+W7nHc6AQMYg6XQj4dgkLoBQe9S1F65TWPUI=";
   };
 
   postPatch = ''
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     curl
     glib
-    libgpiod_1 # Tracking issue for compatibility with libgpiod 2.0: https://gitlab.com/mobian1/eg25-manager/-/issues/45
+    libgpiod
     libgudev
     libusb1
     modemmanager
diff --git a/pkgs/by-name/fz/fzf/package.nix b/pkgs/by-name/fz/fzf/package.nix
index 8c59af8246a3..f133ec7b6158 100644
--- a/pkgs/by-name/fz/fzf/package.nix
+++ b/pkgs/by-name/fz/fzf/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "fzf";
-  version = "0.54.3";
+  version = "0.55.0";
 
   src = fetchFromGitHub {
     owner = "junegunn";
     repo = "fzf";
     rev = "v${version}";
-    hash = "sha256-kVWG2lfV+FhKbVC7mAqp3VCRWU6TgJGR3/NFwc8fslU=";
+    hash = "sha256-4ikNCepLF7odkaEO+tzgrHb4528LetPEeMStJVZyjWg=";
   };
 
-  vendorHash = "sha256-uhjJPB/jfRPAu9g41vWFnSBIN9TIZW3s6BGz0fA2ygE=";
+  vendorHash = "sha256-b7hCXDJ/EJr1sEvmS2RYaxBMkdWOo2LWe76mamD3BSY=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/ma/marwaita/package.nix b/pkgs/by-name/ma/marwaita/package.nix
index 75537b8b527c..95339811740a 100644
--- a/pkgs/by-name/ma/marwaita/package.nix
+++ b/pkgs/by-name/ma/marwaita/package.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "marwaita";
-  version = "20.3.1";
+  version = "21";
 
   src = fetchFromGitHub {
     owner = "darkomarko42";
     repo = pname;
     rev = version;
-    hash = "sha256-6siv6fve0i/6DrNKuwNEc7nWlD4GbMaH7y4Mgliq8iI=";
+    hash = "sha256-5igOzHfkW+HJtll2wLT5qWtLavoPCo170M8v4ID0Wf8=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/mi/mingtest/package.nix b/pkgs/by-name/mi/mingtest/package.nix
new file mode 100644
index 000000000000..78ea3d7b995c
--- /dev/null
+++ b/pkgs/by-name/mi/mingtest/package.nix
@@ -0,0 +1,34 @@
+{
+  stdenv,
+  cmake,
+  fetchFromGitHub,
+  lib,
+}:
+
+stdenv.mkDerivation rec {
+  name = "mingtest";
+  version = "0.1.9";
+  src = fetchFromGitHub {
+    owner = "craflin";
+    repo = "mingtest";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Iy2KvFCFk+uoztTVxTY7HMdc5GI4gSGqGmbJePJ5CO8=";
+  };
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "include(CDeploy)" "" \
+      --replace-fail "install_deploy_export()" ""
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = {
+    description = "Minimalistic C++ unit test framework";
+    homepage = "https://github.com/craflin/mingtest";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ lutzberger ];
+    platforms = lib.platforms.linux;
+  };
+
+}
diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
index 0317f5d32bac..679277118a99 100644
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -7,7 +7,7 @@
 
 buildGoModule rec {
 
-  version = "photos-v0.9.16";
+  version = "photos-v0.9.30";
   pname = "museum";
 
   src = fetchFromGitHub {
@@ -15,7 +15,7 @@ buildGoModule rec {
     repo = "ente";
     sparseCheckout = [ "server" ];
     rev = version;
-    hash = "sha256-ZtlwDV3Iksi2QNzoAsAtbN7B/n0UKubU4nlXx4N0l+E=";
+    hash = "sha256-R85eI8n9jQB55l8V4881X74RGH3k0JhGS+phLBrZHvc=";
   };
 
   sourceRoot = "${src.name}/server";
@@ -42,7 +42,7 @@ buildGoModule rec {
     mainProgram = "museum";
     platforms = platforms.linux;
   };
-  vendorHash = "sha256-Vo3KhWWxO0k/d5qUFRfX44oTZBXtJeUlz6qaUvXLDag=";
+  vendorHash = "sha256-Vz9AodHoClSmo51ExdOS4bWH13i1Sug++LQMIsZY2xY=";
 }
 
 
diff --git a/pkgs/by-name/ne/netclient/package.nix b/pkgs/by-name/ne/netclient/package.nix
index 0173274aa02d..9634c2b07a80 100644
--- a/pkgs/by-name/ne/netclient/package.nix
+++ b/pkgs/by-name/ne/netclient/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "netclient";
-  version = "0.24.3";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "gravitl";
     repo = "netclient";
     rev = "v${version}";
-    hash = "sha256-EwkjU4MICkCuJJ7a39dKPTuugELprHQUIyXqwmJpev8=";
+    hash = "sha256-cc0OBDDyg+egnQWPoteGVVHtg8vfYC9RVIpe7A+ZJPQ=";
   };
 
-  vendorHash = "sha256-R/aHXZ0BM2gWouUIezYf63SMqT8vjH2ZhOItgu6RBb4=";
+  vendorHash = "sha256-DzTTESPxYuZYNGjEG3PufLoS02+R9275arVcUzImpBU=";
 
   buildInputs = lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa
     ++ lib.optional stdenv.isLinux libX11;
diff --git a/pkgs/by-name/nh/nhost-cli/package.nix b/pkgs/by-name/nh/nhost-cli/package.nix
index b094556144f9..74538079e6a7 100644
--- a/pkgs/by-name/nh/nhost-cli/package.nix
+++ b/pkgs/by-name/nh/nhost-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "nhost-cli";
-  version = "1.21.0";
+  version = "1.22.3";
 
   src = fetchFromGitHub {
     owner = "nhost";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-xnSIWDKWi4weMjs8WOVqJ77DGqtw/EhLAmVa8CNjXb0=";
+    hash = "sha256-Rpjgsc+pinM440SqnvVHijUP4Y2ArHi4sdalRDWzaJQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 4ea10340adb1..ebcab4bda0cc 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -51,13 +51,13 @@ let
   };
 
   pname = "pretix";
-  version = "2024.7.1";
+  version = "2024.8.0";
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lOcV3+CNGyKR0QiQXr/hP/9rhWauEvnSLOvxmQa/DSg=";
+    hash = "sha256-3flZoDzS3SI7nAi1skEqVPXJM9vSBrGN+F0esbYKQDw=";
   };
 
   npmDeps = buildNpmPackage {
@@ -65,7 +65,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}/src/pretix/static/npm_dir";
-    npmDepsHash = "sha256-BfvKuwB5VLX09Lxji+EpMBvZeKTIQvptVtrHSRYY+14=";
+    npmDepsHash = "sha256-ZS+80LLyS2UBnVGRclYhwVwF1BR17D/79F2moQtqh80=";
 
     dontBuild = true;
 
@@ -87,17 +87,15 @@ python.pkgs.buildPythonApplication rec {
     # Discover pretix.plugin entrypoints during build and add them into
     # INSTALLED_APPS, so that their static files are collected.
     ./plugin-build.patch
-
-    # https://github.com/pretix/pretix/pull/4362
-    # Fix TOCTOU race in directory creation
-    ./pr4362.patch
   ];
 
   pythonRelaxDeps = [
     "importlib-metadata"
     "kombu"
+    "markdown"
     "pillow"
     "protobuf"
+    "pyjwt"
     "python-bidi"
     "requests"
     "sentry-sdk"
@@ -140,7 +138,6 @@ python.pkgs.buildPythonApplication rec {
     cryptography
     css-inline
     defusedcsv
-    dj-static
     django
     django-bootstrap3
     django-compressor
@@ -199,7 +196,6 @@ python.pkgs.buildPythonApplication rec {
     sentry-sdk
     sepaxml
     slimit
-    static3
     stripe
     text-unidecode
     tlds
diff --git a/pkgs/by-name/pr/pretix/plugins/zugferd.nix b/pkgs/by-name/pr/pretix/plugins/zugferd.nix
index e96193a52b50..e7aeb78b346f 100644
--- a/pkgs/by-name/pr/pretix/plugins/zugferd.nix
+++ b/pkgs/by-name/pr/pretix/plugins/zugferd.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pretix-zugferd";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-zugferd";
     rev = "v${version}";
-    hash = "sha256-ozFDNIA+0feHrHHvxcf+6Jh4L83svmPEE/rerd4Yim8=";
+    hash = "sha256-AJbrx1n32YAZnJGYX67qqaEnOeegYfSUEekvQnmjt+0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/pr/pretix/pr4362.patch b/pkgs/by-name/pr/pretix/pr4362.patch
deleted file mode 100644
index 97d4a20c2239..000000000000
--- a/pkgs/by-name/pr/pretix/pr4362.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 5688f3624005d02803f2a434db025f367b4963d3 Mon Sep 17 00:00:00 2001
-From: Martin Weinelt <hexa@darmstadt.ccc.de>
-Date: Thu, 1 Aug 2024 02:39:59 +0200
-Subject: [PATCH] Prevent race condition in directory creation
-
-Checking whether a path does not exist before trying to create it does
-not follow the Python paradigm of asking for forgiveness, rather than
-permission, and opens up a time-of-check to time-of-use race.
----
- src/pretix/settings.py | 17 +++++++++--------
- 1 file changed, 9 insertions(+), 8 deletions(-)
-
-diff --git a/src/pretix/settings.py b/src/pretix/settings.py
-index 81ff644be..854187f05 100644
---- a/src/pretix/settings.py
-+++ b/src/pretix/settings.py
-@@ -37,6 +37,7 @@ import configparser
- import logging
- import os
- import sys
-+from contextlib import suppress
- from json import loads
- from urllib.parse import urlparse
- 
-@@ -70,14 +71,14 @@ MEDIA_ROOT = os.path.join(DATA_DIR, 'media')
- PROFILE_DIR = os.path.join(DATA_DIR, 'profiles')
- CACHE_DIR = config.get('pretix', 'cachedir', fallback=os.path.join(DATA_DIR, 'cache'))
- 
--if not os.path.exists(DATA_DIR):
--    os.mkdir(DATA_DIR)
--if not os.path.exists(LOG_DIR):
--    os.mkdir(LOG_DIR)
--if not os.path.exists(MEDIA_ROOT):
--    os.mkdir(MEDIA_ROOT)
--if not os.path.exists(CACHE_DIR):
--    os.mkdir(CACHE_DIR)
-+def mkdir(path):
-+    with suppress(FileExistsError):
-+        os.mkdir(path)
-+
-+mkdir(DATA_DIR)
-+mkdir(LOG_DIR)
-+mkdir(MEDIA_ROOT)
-+mkdir(CACHE_DIR)
- 
- if config.has_option('django', 'secret'):
-     SECRET_KEY = config.get('django', 'secret')
--- 
-2.45.2
-
diff --git a/pkgs/by-name/pu/pupdate/package.nix b/pkgs/by-name/pu/pupdate/package.nix
index b78ac0a2b50d..7ca133d9b9dd 100644
--- a/pkgs/by-name/pu/pupdate/package.nix
+++ b/pkgs/by-name/pu/pupdate/package.nix
@@ -11,13 +11,13 @@
 
 buildDotnetModule rec {
   pname = "pupdate";
-  version = "3.11.1";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "mattpannella";
     repo = "pupdate";
     rev = "${version}";
-    hash = "sha256-odlKNp6kjOAYeRIHnLniqkCXTi1UXF3szn8tJtrxzQU=";
+    hash = "sha256-55tFnkF+zjvrGbG5AzBGc4nLqbPPMZ8+/muzav4dnsQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ru/rustlings/package.nix b/pkgs/by-name/ru/rustlings/package.nix
new file mode 100644
index 000000000000..1d2e83b9739f
--- /dev/null
+++ b/pkgs/by-name/ru/rustlings/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  cargo,
+  rustc,
+  clippy,
+  makeWrapper,
+}:
+let
+  pname = "rustlings";
+  version = "6.2.0";
+in
+rustPlatform.buildRustPackage {
+  inherit pname version;
+  src = fetchFromGitHub {
+    owner = "rust-lang";
+    repo = "rustlings";
+    rev = "v${version}";
+    hash = "sha256-BVmiMIIx8YEO57FO0ZpsCQcim68mn7NHpAOO86dZqlI=";
+  };
+
+  cargoHash = "sha256-ZupwPw/bfeN+s7IWXbY21K/ODXSaYef+IDDpBVCi3Ek=";
+
+  # Disabled test that does not work well in an isolated environment
+  checkFlags = [
+    "--skip=run_compilation_success"
+    "--skip=run_test_success"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  postFixup = ''
+    wrapProgram $out/bin/rustlings --suffix PATH : ${
+      lib.makeBinPath [
+        cargo
+        rustc
+        clippy
+      ]
+    }
+  '';
+
+  meta = {
+    description = "Explore the Rust programming language and learn more about it while doing exercises";
+    homepage = "https://rustlings.cool/";
+    changelog = "https://github.com/rust-lang/rustlings/releases";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ luftmensch-luftmensch ];
+    mainProgram = "rustlings";
+  };
+}
diff --git a/pkgs/by-name/st/stevenblack-blocklist/package.nix b/pkgs/by-name/st/stevenblack-blocklist/package.nix
index 6f36d87421d0..d2d8ab08f1f9 100644
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.14.96";
+  version = "3.14.100";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-gv40Hfe8Lk/flQp+SPwGws4eZ0umjF1qwX0HdHF9Xe4=";
+    hash = "sha256-6PdF/COJ7UA8ULHMJ2HEIwc6wwNDUxS/92r3D8f6N1E=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sy/syshud/package.nix b/pkgs/by-name/sy/syshud/package.nix
index ec1b9eb0a45b..6fc839d1d5aa 100644
--- a/pkgs/by-name/sy/syshud/package.nix
+++ b/pkgs/by-name/sy/syshud/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "syshud";
-  version = "0-unstable-2024-08-10";
+  version = "0-unstable-2024-08-24";
 
   src = fetchFromGitHub {
     owner = "System64fumo";
     repo = "syshud";
-    rev = "c7165dc7e28752b49be4ca81ab5db35019d6fcd0";
-    hash = "sha256-P8NgWooRMFl1iuFKQlWDJwMlZ/CIwvf2ctkqvRXt6SA=";
+    rev = "93f94c866b0ed6326ec7cc6da04221e1feaafeef";
+    hash = "sha256-+l7WDDrdKiFZAGrtARC86hDrNML8BMYIw0Z4yg/bKsU=";
   };
 
   postPatch = ''
@@ -39,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [
     "DESTDIR=${placeholder "out"}"
+    "PREFIX="
   ];
 
   # populate version info used by `syshud -v`:
@@ -57,7 +58,10 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version" "branch" ];
+    extraArgs = [
+      "--version"
+      "branch"
+    ];
   };
 
   meta = {
diff --git a/pkgs/development/compilers/intel-graphics-compiler/default.nix b/pkgs/development/compilers/intel-graphics-compiler/default.nix
index 27cd6acc3f17..ef3ff5ff4565 100644
--- a/pkgs/development/compilers/intel-graphics-compiler/default.nix
+++ b/pkgs/development/compilers/intel-graphics-compiler/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, bash
 , cmake
 , runCommandLocal
 , bison
@@ -20,8 +21,8 @@ let
   vc_intrinsics_src = fetchFromGitHub {
     owner = "intel";
     repo = "vc-intrinsics";
-    rev = "v0.18.0";
-    hash = "sha256-F2GR3TDUUiygEhdQN+PsMT/CIYBATMQX5wkvwrziS2E=";
+    rev = "v0.19.0";
+    hash = "sha256-vOK7xfOR+aDpdGd8oOFLJc1Ct1S5BCJmLN6Ubn5wlkQ=";
   };
 
   inherit (llvmPackages_14) lld llvm;
@@ -31,16 +32,25 @@ in
 
 stdenv.mkDerivation rec {
   pname = "intel-graphics-compiler";
-  version = "1.0.17193.4";
+  version = "1.0.17384.11";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "intel-graphics-compiler";
     rev = "igc-${version}";
-    hash = "sha256-OOKj3kfl+0/dgeICFtbiOVE0nsYYvI4v97BLjcExAmc=";
+    hash = "sha256-O4uMaPauRv2aMgM2B7XdzCcjI5JghsjX5XbkeloLyck=";
   };
 
-  nativeBuildInputs = [ bison cmake flex (python3.withPackages (ps : with ps; [ mako ])) ];
+  postPatch = ''
+    substituteInPlace IGC/AdaptorOCL/igc-opencl.pc.in \
+      --replace-fail '/@CMAKE_INSTALL_INCLUDEDIR@' "/include" \
+      --replace-fail '/@CMAKE_INSTALL_LIBDIR@' "/lib"
+
+    chmod +x IGC/Scripts/igc_create_linker_script.sh
+    patchShebangs --build IGC/Scripts/igc_create_linker_script.sh
+  '';
+
+  nativeBuildInputs = [ bash bison cmake flex (python3.withPackages (ps : with ps; [ mako pyyaml ])) ];
 
   buildInputs = [ lld llvm spirv-headers spirv-llvm-translator' spirv-tools ];
 
@@ -49,12 +59,6 @@ stdenv.mkDerivation rec {
   # testing is done via intel-compute-runtime
   doCheck = false;
 
-  postPatch = ''
-    substituteInPlace IGC/AdaptorOCL/igc-opencl.pc.in \
-      --replace '/@CMAKE_INSTALL_INCLUDEDIR@' "/include" \
-      --replace '/@CMAKE_INSTALL_LIBDIR@' "/lib"
-  '';
-
   # Handholding the braindead build script
   # cmake requires an absolute path
   prebuilds = runCommandLocal "igc-cclang-prebuilds" { } ''
diff --git a/pkgs/development/compilers/spirv-llvm-translator/default.nix b/pkgs/development/compilers/spirv-llvm-translator/default.nix
index 6321b6940ec7..20adaf5f559b 100644
--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@@ -32,9 +32,9 @@ let
       rev = "v${version}";
       hash = "sha256-OsDohXRxovtEXaWiRGp8gJ0dXmoALyO+ZimeSO8aPVI=";
     } else if llvmMajor == "14" then {
-      version = "14.0.0+unstable-2024-05-27";
-      rev = "62f5b09b11b1da42274371b1f7535f6f2ab11485";
-      hash = "sha256-lEOdWHyq9hEyBZPz9z1LxUAZqNub+mZFHHWMlzh3HaI=";
+      version = "14.0.0+unstable-2024-07-15";
+      rev = "2823e7052b7999c10fff63bc8089e5aa205716f4";
+      hash = "sha256-8/4B74hYge6WiH7PzRGEgE3W7f9IkQ4VMmfkWKYA/l4=";
     } else if llvmMajor == "11" then {
       version = "11.0.0+unstable-2022-05-04";
       rev = "4ef524240833abfeee1c5b9fff6b1bd53f4806b3"; # 267 commits ahead of v11.0.0
diff --git a/pkgs/development/libraries/opencl-clang/default.nix b/pkgs/development/libraries/opencl-clang/default.nix
index b906be979f57..341c3f3ecf57 100644
--- a/pkgs/development/libraries/opencl-clang/default.nix
+++ b/pkgs/development/libraries/opencl-clang/default.nix
@@ -53,14 +53,14 @@ let
     };
   };
 
-  version = "unstable-2024-06-06";
+  version = "14.0.0-unstable-2024-07-09";
   src = applyPatches {
     src = fetchFromGitHub {
       owner = "intel";
       repo = "opencl-clang";
       # https://github.com/intel/opencl-clang/compare/ocl-open-140
-      rev = "66a54cbef6726c4e791986779a60d7a45b09c9c9";
-      hash = "sha256-vM2IlF/e3b2GIXMaHYre+iQn4WKsFIU3x90Ee5KVHtI=";
+      rev = "470cf0018e1ef6fc92eda1356f5f31f7da452abc";
+      hash = "sha256-Ja+vJ317HI3Nh45kcAMhyLVTIqyy6pE5KAsKs4ou9J8=";
     };
 
     patches = [
diff --git a/pkgs/development/python-modules/django-filter/default.nix b/pkgs/development/python-modules/django-filter/default.nix
index f1d0f1a5aaeb..212d5318b3fd 100644
--- a/pkgs/development/python-modules/django-filter/default.nix
+++ b/pkgs/development/python-modules/django-filter/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   flit-core,
   django,
   djangorestframework,
@@ -12,12 +12,14 @@
 
 buildPythonPackage rec {
   pname = "django-filter";
-  version = "24.2";
+  version = "24.3";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-SOX8HaPM1soNX5u1UJc1GM6Xek7d6dKooVSn9PC5+W4=";
+  src = fetchFromGitHub {
+    owner = "carltongibson";
+    repo = "django-filter";
+    rev = "refs/tags/${version}";
+    hash = "sha256-4q/x9FO9ErKnGeJDEXDMcvUKA4nlA7nkwwM2xj3WGWs=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/dvc/default.nix b/pkgs/development/python-modules/dvc/default.nix
index 74e3d6a3bba1..94f598abbe19 100644
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@@ -57,7 +57,7 @@
 
 buildPythonPackage rec {
   pname = "dvc";
-  version = "3.54.1";
+  version = "3.55.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -66,7 +66,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc";
     rev = "refs/tags/${version}";
-    hash = "sha256-q4o5IFL/Txy5qoe71FYzCEf7O+0RvlASripZzU3xaOw=";
+    hash = "sha256-nKzMHVMaoDu/d1wMAxA2q8DHdwoIb7+YG/7AhAtRVEM=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 38619f184f30..f3757841f211 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "19.11.0";
+  version = "19.11.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SVLyapbp9pNEznLetOppzmIc9fQuZF1MSfLsWVwIVGQ=";
+    hash = "sha256-yG8zDC2cirP7fXVTP7TP+BoCjRNgyj6AmXUt6anMy/k=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index 18dbd68cc66f..ca44848e76d0 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "python-gitlab";
-  version = "4.9.0";
+  version = "4.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "python_gitlab";
     inherit version;
-    hash = "sha256-30TbtunJQefr+5JE5+1KpNuQ9cFkmMstE1uObn8Imho=";
+    hash = "sha256-hvmcGRUIji0lc4F6yov2urXk8S1CsE72st8qu1KNV/0=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/rich-click/default.nix b/pkgs/development/python-modules/rich-click/default.nix
index 0b6d57325b35..5e6c06ba8364 100644
--- a/pkgs/development/python-modules/rich-click/default.nix
+++ b/pkgs/development/python-modules/rich-click/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "rich-click";
-  version = "1.8.2";
+  version = "1.8.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "ewels";
     repo = "rich-click";
     rev = "refs/tags/v${version}";
-    hash = "sha256-O7ZV6+p0nvWmKHUy/aK+qcED/KT4hZojoQRKr9Eg848=";
+    hash = "sha256-7Avg8HcN9q0EUOnkvuM0oIbwTUGAY2ksbX3SOVZtPOc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tellduslive/default.nix b/pkgs/development/python-modules/tellduslive/default.nix
index 44fd11d24342..32382d635c7d 100644
--- a/pkgs/development/python-modules/tellduslive/default.nix
+++ b/pkgs/development/python-modules/tellduslive/default.nix
@@ -6,38 +6,41 @@
   requests,
   requests-oauthlib,
   pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "tellduslive";
-  version = "0.10.11";
-  format = "setuptools";
+  version = "0.10.12";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "molobrakos";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0aqhj6fq2z2qb4jyk23ygjicf5nlj8lkya7blkyqb7jra5k1gyg0";
+    repo = "tellduslive";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-fWL+VSvoT+dT0jzD8DZEMxzTlqj4TYGCJPLpeui5q64=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     docopt
     requests
     requests-oauthlib
   ];
 
-  # Project has no tests
+  # Module has no tests
   doCheck = false;
 
   pythonImportsCheck = [ "tellduslive" ];
 
   meta = with lib; {
     description = "Python module to communicate with Telldus Live";
-    mainProgram = "tellduslive";
     homepage = "https://github.com/molobrakos/tellduslive";
-    license = with licenses; [ unlicense ];
+    license = licenses.unlicense;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "tellduslive";
   };
 }
diff --git a/pkgs/development/python-modules/typer-shell/default.nix b/pkgs/development/python-modules/typer-shell/default.nix
index e38822f9039a..bed80e598648 100644
--- a/pkgs/development/python-modules/typer-shell/default.nix
+++ b/pkgs/development/python-modules/typer-shell/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "typer-shell";
-  version = "0.1.10";
+  version = "0.1.11";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "FergusFettes";
     repo = "typer-shell";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Yr+TLEgIRy5hOAYWv9CnDVT3qm36Pzwsj60yFrzaXIQ=";
+    hash = "sha256-pxi4FGxDRMcW4q6h4lQzqGPLhdcfElMaR6aZV85h2Os=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/yfinance/default.nix b/pkgs/development/python-modules/yfinance/default.nix
index 407917c0b816..d9c3041c038c 100644
--- a/pkgs/development/python-modules/yfinance/default.nix
+++ b/pkgs/development/python-modules/yfinance/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "yfinance";
-  version = "0.2.42";
+  version = "0.2.43";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "ranaroussi";
     repo = "yfinance";
     rev = "refs/tags/${version}";
-    hash = "sha256-2iS//v5KKxoY6FQTyZ4A4hm7yR31Y5BqTRauUElxOd0=";
+    hash = "sha256-pHjOXxnANnqypcycqdIV8/6u/qVVNnRFAeL4xsHjk3w=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index b4742dbd1088..b1250a366a22 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.37.0";
+  version = "1.38.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     rev = "v${version}";
-    hash = "sha256-LqDF093SjAa1HdvebbMI4Mp47VzAaZ0OcecmI/m+1j8=";
+    hash = "sha256-BONfkSLQAnqKW/1PfMwK/DjAbLm5/i6V55SZDOF0rJA=";
   };
 
-  vendorHash = "sha256-A7bkIyQ6KA5iudcmffzxc2d0d6Exy74s5OEeUW42e2o=";
+  vendorHash = "sha256-NV5l7dlb05rRLtNe2cFvaC/G2rhZLY+DmVQcuyJU/08=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/servers/webmesh/default.nix b/pkgs/servers/webmesh/default.nix
index 2d1ed1037a9d..25b51d29e734 100644
--- a/pkgs/servers/webmesh/default.nix
+++ b/pkgs/servers/webmesh/default.nix
@@ -1,38 +1,47 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, gitUpdater
+, testers
+, webmesh
 }:
 
 buildGoModule rec {
   pname = "webmesh";
-  version = "0.1.2";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "webmeshproj";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-S7kenBrnhM8V0TdbRe+CJP2XGHG/dZbfGVwdRurPeP8=";
+    hash = "sha256-Inh7j01/xBJgGYmX1tGBRNYjn1N4AO2sywBwZ8yXlsY=";
   };
 
-  vendorHash = "sha256-LBd5IrNFGkEhz+joDv6juL7WuoFyoqCXnmEHFB1K6Nc=";
+  vendorHash = "sha256-xoc7NSdg5bn3aXgcrolJwv8jyrv2HEXFmiCtRXBVwVg=";
 
   CGO_ENABLED = 0;
 
-  subPackages = [ "cmd/node" "cmd/wmctl" ];
+  subPackages = [ "cmd/webmesh-node" "cmd/webmeshd" "cmd/wmctl" ];
 
   ldflags = [
     "-w"
     "-s"
     "-X github.com/webmeshproj/webmesh/pkg/version.Version=${version}"
-    "-X github.com/webmeshproj/webmesh/pkg/version.Commit=v${version}"
+    "-X github.com/webmeshproj/webmesh/pkg/version.GitCommit=v${version}"
   ];
 
-  postInstall = ''
-    mv $out/bin/node $out/bin/webmesh-node
-  '';
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
+    tests = {
+      webmesh-version = testers.testVersion {
+        package = webmesh;
+      };
+    };
+  };
 
   meta = with lib; {
     description = "Simple, distributed, zero-configuration WireGuard mesh provider";
+    mainProgram = "webmesh-node";
     homepage = "https://webmeshproj.github.io";
     license = licenses.asl20;
     maintainers = with maintainers; [ bbigras ];
diff --git a/pkgs/tools/admin/stripe-cli/default.nix b/pkgs/tools/admin/stripe-cli/default.nix
index ac1a5cc4e25e..7cb7cf78ddb8 100644
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.21.2";
+  version = "1.21.3";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-uerQwznpezbNnPj5U/IjMxoqRMJQhhje8oRwJTDimFY=";
+    hash = "sha256-iCr7RJ3dF0DetuIyfGshU4/VRNEhYxFOQlugl2oTZPM=";
   };
   vendorHash = "sha256-TuxYJ3u4/5PJYRoRgom+M1au9XerZ+vj9X3jUWTPM58=";
 
diff --git a/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix b/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix
index df93dacb4711..b5cbb8c3295e 100644
--- a/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix
+++ b/pkgs/tools/networking/openvpn/openvpn-auth-ldap.nix
@@ -1,12 +1,14 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, autoreconfHook
-, gnustep
-, re2c
-, openldap
-, openssl
-, openvpn
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch2,
+  autoreconfHook,
+  gnustep,
+  re2c,
+  openldap,
+  openssl,
+  openvpn,
 }:
 
 stdenv.mkDerivation rec {
@@ -22,6 +24,11 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./auth-ldap-fix-conftest.patch
+    (fetchpatch2 {
+      name = "fix-cve-2024-28820";
+      url = "https://patch-diff.githubusercontent.com/raw/threerings/openvpn-auth-ldap/pull/92.patch";
+      hash = "sha256-SXuo1D/WywKO5hCsmoeDdTsR7EelxFxJAKmlAQJ6vuE=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 816e3c462d29..8a5f7a44118b 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-08-24";
+  version = "2024-08-29";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     rev = "refs/tags/${version}";
-    hash = "sha256-Ga80kO/60pbjdoBirgNXJECpx6ylDyd5d/5gHUZ5ong=";
+    hash = "sha256-QZO7wJiqVVt9vpocC2X4Vrj8s02kh/E3j96JKbYoJJo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/system/zx/default.nix b/pkgs/tools/system/zx/default.nix
index 9867ca80a3c6..37021481d105 100644
--- a/pkgs/tools/system/zx/default.nix
+++ b/pkgs/tools/system/zx/default.nix
@@ -2,20 +2,23 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
 buildNpmPackage rec {
   pname = "zx";
-  version = "8.1.4";
+  version = "8.1.5";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "zx";
     rev = version;
-    hash = "sha256-9B/X7lOaNTXRGIteGDnLexVF8joo1m+xsfaqxTL2150=";
+    hash = "sha256-CeFUALi5MXQqd/LwSsyi6sBTFJpZGfCCMuD7Moyk9hM=";
   };
 
-  npmDepsHash = "sha256-HNaREvW8opvxjZWJ7cFrIoF1JELWBemr8VB9DyYdNfA=";
+  npmDepsHash = "sha256-yhy2bTXeBYxGaLYb2by+7Y5DfKJ04hroYiOIvwcBojY=";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Tool for writing scripts using JavaScript";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7e2a726f2075..238608ebcdbd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11072,7 +11072,7 @@ with pkgs;
   openvpn_learnaddress = callPackage ../tools/networking/openvpn/openvpn_learnaddress.nix { };
 
   openvpn-auth-ldap = callPackage ../tools/networking/openvpn/openvpn-auth-ldap.nix {
-    stdenv = clangStdenv;
+    inherit (llvmPackages_17) stdenv;
   };
 
   namespaced-openvpn = python3Packages.callPackage ../tools/networking/namespaced-openvpn { };