Merge staging-next into staging

2026-10-02 13:00:23 +00:00 · 2024-08-17 00:02:31 +00:00
parent 014f94f5fe e96a0c6e15
commit 65d48aaf07
140 changed files with 1497 additions and 1167 deletions
--- a/nixos/modules/programs/xonsh.nix
+++ b/nixos/modules/programs/xonsh.nix
@@ -23,7 +23,7 @@ in
      };

      package = lib.mkPackageOption pkgs "xonsh" {
-        example = "xonsh.wrapper.override { extraPackages = ps: [ ps.requests ]; }";
+        example = "pkgs.xonsh.override { extraPackages = ps: [ ps.requests ]; }";
      };

      config = lib.mkOption {
--- a/nixos/modules/services/networking/nebula.nix
+++ b/nixos/modules/services/networking/nebula.nix
@@ -270,5 +270,5 @@ in
    }) enabledNetworks);
  };

-  meta.maintainers = [ numinit ];
+  meta.maintainers = with maintainers; [ numinit ];
 }
--- a/nixos/modules/virtualisation/openstack-config.nix
+++ b/nixos/modules/virtualisation/openstack-config.nix
@@ -63,8 +63,6 @@ in
      settings.PasswordAuthentication = mkDefault false;
    };

-    users.users.root.initialPassword = "foobar";
-
    # Enable the serial console on tty1
    systemd.services."serial-getty@tty1".enable = true;

--- a/pkgs/applications/emulators/craftos-pc/default.nix
+++ b/pkgs/applications/emulators/craftos-pc/default.nix
@@ -15,18 +15,18 @@
 }:

 let
-  version = "2.8.2";
+  version = "2.8.3";
  craftos2-lua = fetchFromGitHub {
    owner = "MCJack123";
    repo = "craftos2-lua";
    rev = "v${version}";
-    hash = "sha256-Kv0supnYKWLaVqOeZAzQNd3tQRP2KJugZqytyoj8QtY=";
+    hash = "sha256-OCHN/ef83X4r5hZcPfFFvNJHjINCTiK+COf369/WPsA=";
  };
  craftos2-rom = fetchFromGitHub {
    owner = "McJack123";
    repo = "craftos2-rom";
    rev = "v${version}";
-    hash = "sha256-5ZsLsqrkO02NLJCzsgf0k/ifsqNybTi4DcB9GLmWDHw=";
+    hash = "sha256-YidLt/JLwBMW0LMo5Q5PV6wGhF0J72FGX+iWYn6v0Z4=";
  };
 in

@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
    owner = "MCJack123";
    repo = "craftos2";
    rev = "v${version}";
-    hash = "sha256-ozebHgUgwdqYtWAyL+EdwpjEvZC+PkWcLYCPWz2FjSw=";
+    hash = "sha256-DbxAsXxpsa42dF6DaLmgIa+Hs/PPqJ4dE97PoKxG2Ig=";
  };

  nativeBuildInputs = [ patchelf unzip ];
--- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
@@ -8,6 +8,7 @@
 , pulseaudio
 , makeDesktopItem
 , zenity
+, olm

 , targetFlutterPlatform ? "linux"
 }:
@@ -44,6 +45,7 @@ flutter319.buildFlutterApplication (rec {
    maintainers = with maintainers; [ mkg20001 gilice ];
    platforms = [ "x86_64-linux" "aarch64-linux" ];
    sourceProvenance = [ sourceTypes.fromSource ];
+    inherit (olm.meta) knownVulnerabilities;
  };
 } // lib.optionalAttrs (targetFlutterPlatform == "linux") {
  nativeBuildInputs = [ imagemagick ];
--- a/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock
+++ b/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock
@@ -12,9 +12,9 @@ dependencies = [

 [[package]]
 name = "addr2line"
-version = "0.21.0"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
+checksum = "6e4503c46a5c0c7844e948c9a4d6acd9f50cccb4de1c48eb9e291ea17470c678"
 dependencies = [
 "gimli",
 ]
@@ -36,23 +36,24 @@ dependencies = [

 [[package]]
 name = "anstream"
-version = "0.6.13"
+version = "0.6.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
+checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
 dependencies = [
 "anstyle",
 "anstyle-parse",
 "anstyle-query",
 "anstyle-wincon",
 "colorchoice",
+ "is_terminal_polyfill",
 "utf8parse",
 ]

 [[package]]
 name = "anstyle"
-version = "1.0.6"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"

 [[package]]
 name = "anstyle-parse"
@@ -74,9 +75,9 @@ dependencies = [

 [[package]]
 name = "anstyle-wincon"
-version = "3.0.3"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
+checksum = "5bf74e1b6e971609db8ca7a9ce79fd5768ab6ae46441c572e46cf596f59e57f8"
 dependencies = [
 "anstyle",
 "windows-sys 0.52.0",
@@ -84,9 +85,9 @@ dependencies = [

 [[package]]
 name = "anyhow"
-version = "1.0.81"
+version = "1.0.86"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0952808a6c2afd1aa8947271f3a60f1a6763c7b912d210184c5149b5cf147247"
+checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"

 [[package]]
 name = "api_client"
@@ -136,9 +137,9 @@ dependencies = [

 [[package]]
 name = "async-channel"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f28243a43d821d11341ab73c80bed182dc015c514b951616cf79bd4af39af0c3"
+checksum = "9f2776ead772134d55b62dd45e59a79e21612d85d0af729b8b7d3967d601a62a"
 dependencies = [
 "concurrent-queue",
 "event-listener 5.3.0",
@@ -281,9 +282,9 @@ checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"

 [[package]]
 name = "backtrace"
-version = "0.3.71"
+version = "0.3.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
+checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
 dependencies = [
 "addr2line",
 "cc",
@@ -296,9 +297,9 @@ dependencies = [

 [[package]]
 name = "bitfield-struct"
-version = "0.5.6"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26b8cea8bb6a81b75a84603b9e096f05fa86db057904ef29be1deee900532bd"
+checksum = "6c2ce686adbebce0ee484a502c440b4657739adbad65eadf06d64f5816ee9765"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -313,9 +314,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

 [[package]]
 name = "bitflags"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"

 [[package]]
 name = "block"
@@ -362,9 +363,9 @@ dependencies = [

 [[package]]
 name = "bumpalo"
-version = "3.15.4"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"

 [[package]]
 name = "byteorder"
@@ -420,7 +421,7 @@ checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"

 [[package]]
 name = "cloud-hypervisor"
-version = "40.0.0"
+version = "41.0.0"
 dependencies = [
 "anyhow",
 "api_client",
@@ -451,9 +452,9 @@ dependencies = [

 [[package]]
 name = "colorchoice"
-version = "1.0.0"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+checksum = "d3fd119d74b830634cea2a0f58bbd0d54540518a14397557951e79340abc28c0"

 [[package]]
 name = "concurrent-queue"
@@ -509,9 +510,9 @@ dependencies = [

 [[package]]
 name = "darling"
-version = "0.20.9"
+version = "0.20.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83b2eb4d90d12bdda5ed17de686c2acb4c57914f8f921b8da7e112b5a36f3fe1"
+checksum = "6f63b86c8a8826a49b8c21f08a2d07338eec8d900540f8630dc76284be802989"
 dependencies = [
 "darling_core",
 "darling_macro",
@@ -519,9 +520,9 @@ dependencies = [

 [[package]]
 name = "darling_core"
-version = "0.20.9"
+version = "0.20.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622687fe0bac72a04e5599029151f5796111b90f1baaa9b544d807a5e31cd120"
+checksum = "95133861a8032aaea082871032f5815eb9e98cef03fa916ab4500513994df9e5"
 dependencies = [
 "fnv",
 "ident_case",
@@ -533,9 +534,9 @@ dependencies = [

 [[package]]
 name = "darling_macro"
-version = "0.20.9"
+version = "0.20.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "733cabb43482b1a1b53eee8583c2b9e8684d592215ea83efd305dd31bc2f0178"
+checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
 dependencies = [
 "darling_core",
 "quote",
@@ -566,12 +567,13 @@ dependencies = [
 "acpi_tables",
 "anyhow",
 "arch",
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
 "byteorder",
 "event_monitor",
 "hypervisor",
 "libc",
 "log",
+ "num_enum",
 "pci",
 "serde",
 "thiserror",
@@ -638,9 +640,9 @@ checksum = "a3d8a32ae18130a3c84dd492d4215c3d913c3b07c6b63c2eb3eb7ff1101ab7bf"

 [[package]]
 name = "enumflags2"
-version = "0.7.9"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3278c9d5fb675e0a51dabcf4c0d355f692b064171535ba72361be1528a9d8e8d"
+checksum = "d232db7f5956f3f14313dc2f87985c58bd2c695ce124c8cdd984e08e15ac133d"
 dependencies = [
 "enumflags2_derive",
 "serde",
@@ -648,9 +650,9 @@ dependencies = [

 [[package]]
 name = "enumflags2_derive"
-version = "0.7.9"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c785274071b1b420972453b306eeca06acf4633829db4223b58a2a8c5953bc4"
+checksum = "de0d48a183585823424a4ce1aa132d174a6a81bd540895822eb4c8373a8e49e8"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -686,7 +688,7 @@ version = "4.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74351c3392ea1ff6cd2628e0042d268ac2371cb613252ff383b6dfa50d22fa79"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
 "libc",
 ]

@@ -698,9 +700,9 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"

 [[package]]
 name = "errno"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
+checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
 dependencies = [
 "libc",
 "windows-sys 0.52.0",
@@ -897,7 +899,7 @@ version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6341b3480afbb34eaefc7f92713bc92f2d83e338aaa1c44192f9c2956f4a4903"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
 "cfg-if",
 "log",
 "managed",
@@ -940,9 +942,9 @@ dependencies = [

 [[package]]
 name = "gimli"
-version = "0.28.1"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
+checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"

 [[package]]
 name = "glob"
@@ -1015,9 +1017,9 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"

 [[package]]
 name = "igvm"
-version = "0.3.1"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bc8970c7e36437c52af3b3ef1acaa5e334c2a95cd8ee9639d574830f48af17e"
+checksum = "7984b10433b50e06a06bd50c69bca4888a5d7de8975f64ea4c2a7687eb99b09d"
 dependencies = [
 "bitfield-struct",
 "crc32fast",
@@ -1032,9 +1034,9 @@ dependencies = [

 [[package]]
 name = "igvm_defs"
-version = "0.3.1"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c4942827cef415726296f6d62411afdb13c1b1924125f3222988f04bef33ad2"
+checksum = "b64ec5588c475372ae830475d3ee9a7bd255407dcb9f03faf6d493556eb6105a"
 dependencies = [
 "bitfield-struct",
 "open-enum",
@@ -1080,6 +1082,12 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+
 [[package]]
 name = "itoa"
 version = "1.0.11"
@@ -1112,12 +1120,23 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bedae2ca4a531bebe311abaf9691f5cc14eaa21475243caa2e39c43bb872947d"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
 "kvm-bindings",
 "libc",
 "vmm-sys-util",
 ]

+[[package]]
+name = "landlock"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dafb8a4afee64f167eb2b52d32f0eea002e41a7a6450e68c799c8ec3a81a634c"
+dependencies = [
+ "enumflags2",
+ "libc",
+ "thiserror",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.4.0"
@@ -1126,9 +1145,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"

 [[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.155"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"

 [[package]]
 name = "libredox"
@@ -1136,7 +1155,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
 "libc",
 ]

@@ -1156,9 +1175,9 @@ dependencies = [

 [[package]]
 name = "libz-sys"
-version = "1.1.16"
+version = "1.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e143b5e666b2695d28f6bca6497720813f699c9602dd7f5cac91008b8ada7f9"
+checksum = "c15da26e5af7e25c90b37a2d75cdbf940cf4a55316de9d84c679c9b8bfabf82e"
 dependencies = [
 "cc",
 "libc",
@@ -1193,9 +1212,9 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.21"
+version = "0.4.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"

 [[package]]
 name = "managed"
@@ -1311,7 +1330,7 @@ version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
 "cfg-if",
 "cfg_aliases",
 "libc",
@@ -1335,19 +1354,20 @@ dependencies = [

 [[package]]
 name = "num_enum"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02339744ee7253741199f897151b38e72257d13802d4ee837285cc2990a90845"
+checksum = "4e613fc340b2220f734a8595782c551f1250e969d87d3be1ae0579e8d4065179"
 dependencies = [
 "num_enum_derive",
 ]

 [[package]]
 name = "num_enum_derive"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "681030a937600a36906c185595136d26abfebb4aa9c65701cefcaf8578bb982b"
+checksum = "af1844ef2428cc3e1cb900be36181049ef3d3193c63e43026cfe202983b27a56"
 dependencies = [
+ "proc-macro-crate",
 "proc-macro2",
 "quote",
 "syn 2.0.66",
@@ -1355,9 +1375,9 @@ dependencies = [

 [[package]]
 name = "object"
-version = "0.32.2"
+version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
+checksum = "081b846d1d56ddfc18fdf1a922e4f6e07a11768ea1b92dec44e42b72712ccfce"
 dependencies = [
 "memchr",
 ]
@@ -1370,29 +1390,29 @@ checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"

 [[package]]
 name = "open-enum"
-version = "0.4.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba485b94b3e73fa752d98cfcab74647a4a537269682cc1ee5256aa020432506d"
+checksum = "2eb2508143a400b3361812094d987dd5adc81f0f5294a46491be648d6c94cab5"
 dependencies = [
 "open-enum-derive",
 ]

 [[package]]
 name = "open-enum-derive"
-version = "0.4.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed1c261430059cab8b2b51eec42a3c15750439ec6c013cd8fe41d4a450de776"
+checksum = "8d1296fab5231654a5aec8bf9e87ba4e3938c502fc4c3c0425a00084c78944be"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 1.0.109",
+ "syn 2.0.66",
 ]

 [[package]]
 name = "openssl-src"
-version = "300.2.3+3.2.1"
+version = "300.3.1+3.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cff92b6f71555b61bb9315f7c64da3ca43d87531622120fea0195fc761b4843"
+checksum = "7259953d42a81bf137fbbd73bd30a8e1914d6dce43c2b90ed575783a22608b91"
 dependencies = [
 "cc",
 ]
@@ -1486,9 +1506,9 @@ dependencies = [

 [[package]]
 name = "paste"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"

 [[package]]
 name = "pci"
@@ -1538,9 +1558,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"

 [[package]]
 name = "piper"
-version = "0.2.1"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668d31b1c4eba19242f2088b2bf3316b82ca31082a8335764db4e083db7485d4"
+checksum = "ae1d5c74c9876f070d3e8fd503d748c7d974c3e48da8f41350fa5222ef9b4391"
 dependencies = [
 "atomic-waker",
 "fastrand",
@@ -1555,9 +1575,9 @@ checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"

 [[package]]
 name = "pnet"
-version = "0.34.0"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "130c5b738eeda2dc5796fe2671e49027e6935e817ab51b930a36ec9e6a206a64"
+checksum = "682396b533413cc2e009fbb48aadf93619a149d3e57defba19ff50ce0201bd0d"
 dependencies = [
 "ipnetwork",
 "pnet_base",
@@ -1569,18 +1589,18 @@ dependencies = [

 [[package]]
 name = "pnet_base"
-version = "0.34.0"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe4cf6fb3ab38b68d01ab2aea03ed3d1132b4868fa4e06285f29f16da01c5f4c"
+checksum = "ffc190d4067df16af3aba49b3b74c469e611cad6314676eaf1157f31aa0fb2f7"
 dependencies = [
 "no-std-net",
 ]

 [[package]]
 name = "pnet_datalink"
-version = "0.34.0"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad5854abf0067ebbd3967f7d45ebc8976ff577ff0c7bd101c4973ae3c70f98fe"
+checksum = "e79e70ec0be163102a332e1d2d5586d362ad76b01cec86f830241f2b6452a7b7"
 dependencies = [
 "ipnetwork",
 "libc",
@@ -1591,9 +1611,9 @@ dependencies = [

 [[package]]
 name = "pnet_macros"
-version = "0.34.0"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "688b17499eee04a0408aca0aa5cba5fc86401d7216de8a63fdf7a4c227871804"
+checksum = "13325ac86ee1a80a480b0bc8e3d30c25d133616112bb16e86f712dcf8a71c863"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1603,18 +1623,18 @@ dependencies = [

 [[package]]
 name = "pnet_macros_support"
-version = "0.34.0"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eea925b72f4bd37f8eab0f221bbe4c78b63498350c983ffa9dd4bcde7e030f56"
+checksum = "eed67a952585d509dd0003049b1fc56b982ac665c8299b124b90ea2bdb3134ab"
 dependencies = [
 "pnet_base",
 ]

 [[package]]
 name = "pnet_packet"
-version = "0.34.0"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9a005825396b7fe7a38a8e288dbc342d5034dac80c15212436424fef8ea90ba"
+checksum = "4c96ebadfab635fcc23036ba30a7d33a80c39e8461b8bd7dc7bb186acb96560f"
 dependencies = [
 "glob",
 "pnet_base",
@@ -1624,9 +1644,9 @@ dependencies = [

 [[package]]
 name = "pnet_sys"
-version = "0.34.0"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "417c0becd1b573f6d544f73671070b039051e5ad819cc64aa96377b536128d00"
+checksum = "7d4643d3d4db6b08741050c2f3afa9a892c4244c085a72fcda93c9c2c9a00f4b"
 dependencies = [
 "libc",
 "winapi",
@@ -1634,9 +1654,9 @@ dependencies = [

 [[package]]
 name = "pnet_transport"
-version = "0.34.0"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2637e14d7de974ee2f74393afccbc8704f3e54e6eb31488715e72481d1662cc3"
+checksum = "5f604d98bc2a6591cf719b58d3203fd882bdd6bf1db696c4ac97978e9f4776bf"
 dependencies = [
 "libc",
 "pnet_base",
@@ -1661,9 +1681,12 @@ dependencies = [

 [[package]]
 name = "ppv-lite86"
-version = "0.2.17"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+dependencies = [
+ "zerocopy",
+]

 [[package]]
 name = "proc-macro-crate"
@@ -1770,9 +1793,9 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.10.4"
+version = "1.10.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
+checksum = "b91213439dad192326a0d7c6ee3955910425f441d7038e0d6933b0aec5c4517f"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -1799,9 +1822,9 @@ checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"

 [[package]]
 name = "remain"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad9f2390298a947ee0aa6073d440e221c0726188cfbcdf9604addb6ee393eb4a"
+checksum = "46aef80f842736de545ada6ec65b81ee91504efd6853f4b96de7414c42ae7443"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1826,7 +1849,7 @@ version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
 "errno",
 "libc",
 "linux-raw-sys",
@@ -1876,9 +1899,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.115"
+version = "1.0.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12dc5c46daa8e9fdf4f5e71b6cf9a53f2487da0e86e55808e2d35539666497dd"
+checksum = "4e0d21c9a8cae1235ad58a00c11cb40d4b1e5c784f1ef2c537876ed6ffd8b7c5"
 dependencies = [
 "itoa",
 "ryu",
@@ -1898,9 +1921,9 @@ dependencies = [

 [[package]]
 name = "serde_with"
-version = "3.7.0"
+version = "3.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee80b0e361bbf88fd2f6e242ccd19cfda072cb0faa6ae694ecee08199938569a"
+checksum = "69cecfa94848272156ea67b2b1a53f20fc7bc638c4a46d2f8abde08f05f4b857"
 dependencies = [
 "serde",
 "serde_derive",
@@ -1909,9 +1932,9 @@ dependencies = [

 [[package]]
 name = "serde_with_macros"
-version = "3.7.0"
+version = "3.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6561dc161a9224638a31d876ccdfefbc1df91d3f3a8342eddb35f055d48c7655"
+checksum = "a8fee4991ef4f274617a51ad4af30519438dacb2f56ac773b08a1922ff743350"
 dependencies = [
 "darling",
 "proc-macro2",
@@ -1946,9 +1969,9 @@ dependencies = [

 [[package]]
 name = "signal-hook-registry"
-version = "1.4.1"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
+checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
 dependencies = [
 "libc",
 ]
@@ -2062,18 +2085,18 @@ dependencies = [

 [[package]]
 name = "thiserror"
-version = "1.0.61"
+version = "1.0.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
+checksum = "f2675633b1499176c2dff06b0856a27976a8f9d436737b4cf4f312d4d91d8bbb"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "1.0.61"
+version = "1.0.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
+checksum = "d20468752b09f49e909e55a5d338caa8bedf615594e9d80bc4c565d30faf798c"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2257,7 +2280,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6be08d1166d41a78861ad50212ab3f9eca0729c349ac3a7a8f557c62406b87cc"
 dependencies = [
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
 "libc",
 "vm-memory",
 "vmm-sys-util",
@@ -2433,7 +2456,7 @@ dependencies = [
 "anyhow",
 "arc-swap",
 "arch",
- "bitflags 2.5.0",
+ "bitflags 2.6.0",
 "block",
 "blocking",
 "cfg-if",
@@ -2450,6 +2473,7 @@ dependencies = [
 "hypervisor",
 "igvm",
 "igvm_defs",
+ "landlock",
 "libc",
 "linux-loader",
 "log",
@@ -2803,9 +2827,9 @@ dependencies = [

 [[package]]
 name = "zerocopy"
-version = "0.7.32"
+version = "0.7.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
 dependencies = [
 "byteorder",
 "zerocopy-derive",
@@ -2813,9 +2837,9 @@ dependencies = [

 [[package]]
 name = "zerocopy-derive"
-version = "0.7.32"
+version = "0.7.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2824,9 +2848,9 @@ dependencies = [

 [[package]]
 name = "zvariant"
-version = "4.1.1"
+version = "4.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aa6d31a02fbfb602bfde791de7fedeb9c2c18115b3d00f3a36e489f46ffbbc7"
+checksum = "1724a2b330760dc7d2a8402d841119dc869ef120b139d29862d6980e9c75bfc9"
 dependencies = [
 "endi",
 "enumflags2",
@@ -2837,9 +2861,9 @@ dependencies = [

 [[package]]
 name = "zvariant_derive"
-version = "4.1.1"
+version = "4.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "642bf1b6b6d527988b3e8193d20969d53700a36eac734d21ae6639db168701c8"
+checksum = "55025a7a518ad14518fb243559c058a2e5b848b015e31f1d90414f36e3317859"
 dependencies = [
 "proc-macro-crate",
 "proc-macro2",
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@@ -4,23 +4,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "cloud-hypervisor";
-  version = "40.0";
+  version = "41.0";

  src = fetchFromGitHub {
    owner = "cloud-hypervisor";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-zrMJGdbOukNbzmcTuIcHlwAbJvTzhz53dc4TO/Fplb4=";
+    hash = "sha256-CI7hWRZUexvmBZJ8cPXxZxwmcxLnw6h9PFMhoaj9jh4=";
  };

-  patches = [
-    (fetchpatch {
-      name = "ub.patch";
-      url = "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/02f146fef81c4aa4a7ef3555c176d3b533158d7a.patch";
-      hash = "sha256-g9WcGJy8Q+Bc0egDfoQVSVfKqyXa8vkIZk+aYQyFuy8=";
-    })
-  ];
-
  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
--- a/pkgs/by-name/ca/cargo-typify/package.nix
+++ b/pkgs/by-name/ca/cargo-typify/package.nix
@@ -1,35 +1,58 @@
-{ lib, rustfmt, rustPlatform, fetchFromGitHub, gitUpdater }:
+{
+  lib,
+  rustfmt,
+  rustPlatform,
+  fetchFromGitHub,
+  gitUpdater,
+  makeWrapper,
+}:

 rustPlatform.buildRustPackage rec {
  pname = "cargo-typify";
-  version = "0.0.14";
+  version = "0.1.0";

  src = fetchFromGitHub {
    owner = "oxidecomputer";
    repo = "typify";
    rev = "v${version}";
-    hash = "sha256-Clwm5hRjPPPRB6xpO8YOGpqnyNFtsSMkPbWBY3etPCI=";
+    hash = "sha256-vokhWIY5iikTyADrqxp6DIq+tJ+xdFPebDFTddJnstA=";
  };

-  cargoHash = "sha256-balx5xOtrWwMOFeGQkYQ2f+lcGMCJvdPqE8rH9adkfU=";
+  cargoHash = "sha256-etlZqhtRCcCBeMC4lq6BjTD4TQyWEwJf1bLKjoIDR70=";

-  cargoBuildFlags = [ "-p" "cargo-typify" ];
+  nativeBuildInputs = [
+    rustfmt
+    makeWrapper
+  ];

-  nativeCheckInputs = [ rustfmt ];
+  cargoBuildFlags = [
+    "--package"
+    "cargo-typify"
+  ];
+  cargoTestFlags = [
+    "--package"
+    "cargo-typify"
+  ];
+
+  strictDeps = true;

  preCheck = ''
    # cargo-typify depends on rustfmt-wrapper, which requires RUSTFMT:
    export RUSTFMT="${lib.getExe rustfmt}"
  '';

+  postInstall = ''
+    wrapProgram $out/bin/cargo-typify \
+      --set RUSTFMT "${lib.getExe rustfmt}"
+  '';
+
  passthru.updateScript = gitUpdater { rev-prefix = "v"; };

-  meta = with lib; {
+  meta = {
    description = "JSON Schema to Rust type converter";
    mainProgram = "cargo-typify";
    homepage = "https://github.com/oxidecomputer/typify";
-    license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ david-r-cox ];
-    broken = true;
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ david-r-cox ];
  };
 }
--- a/pkgs/by-name/ci/cinny-unwrapped/package.nix
+++ b/pkgs/by-name/ci/cinny-unwrapped/package.nix
@@ -9,6 +9,7 @@
  pango,
  stdenv,
  darwin,
+  olm,
 }:

 buildNpmPackage rec {
@@ -54,5 +55,6 @@ buildNpmPackage rec {
    maintainers = with lib.maintainers; [ abbe ];
    license = lib.licenses.agpl3Only;
    platforms = lib.platforms.all;
+    inherit (olm.meta) knownVulnerabilities;
  };
 }
--- a/pkgs/by-name/de/deepfilternet/Cargo.lock
+++ b/pkgs/by-name/de/deepfilternet/Cargo.lock
@@ -1073,9 +1073,12 @@ dependencies = [

 [[package]]
 name = "deranged"
-version = "0.3.8"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]

 [[package]]
 name = "derivative"
@@ -2805,6 +2808,12 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-derive"
 version = "0.3.3"
@@ -3266,6 +3275,12 @@ dependencies = [
 "windows-sys 0.48.0",
 ]

+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.17"
@@ -4134,12 +4149,14 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.28"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17f6bb557fd245c28e6411aa56b6403c689ad95061f50e4be16c274e70a17e48"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
 "deranged",
 "itoa",
+ "num-conv",
+ "powerfmt",
 "serde",
 "time-core",
 "time-macros",
@@ -4147,16 +4164,17 @@ dependencies = [

 [[package]]
 name = "time-core"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"

 [[package]]
 name = "time-macros"
-version = "0.2.14"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a942f44339478ef67935ab2bbaec2fb0322496cf3cbe84b261e06ac3814c572"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
 "time-core",
 ]

--- a/pkgs/by-name/de/deepfilternet/cargo-lock-bump-time.patch
+++ b/pkgs/by-name/de/deepfilternet/cargo-lock-bump-time.patch
@@ -0,0 +1,84 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 48eb89c..ae318a6 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -1073,9 +1073,12 @@ dependencies = [
+ 
+ [[package]]
+ name = "deranged"
+-version = "0.3.8"
+version = "0.3.11"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f2696e8a945f658fd14dc3b87242e6b80cd0f36ff04ea560fa39082368847946"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+]
+ 
+ [[package]]
+ name = "derivative"
+@@ -2805,6 +2808,12 @@ dependencies = [
+  "serde",
+ ]
+ 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+ [[package]]
+ name = "num-derive"
+ version = "0.3.3"
+@@ -3266,6 +3275,12 @@ dependencies = [
+  "windows-sys 0.48.0",
+ ]
+ 
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+ [[package]]
+ name = "ppv-lite86"
+ version = "0.2.17"
+@@ -4134,12 +4149,14 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.28"
+version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "17f6bb557fd245c28e6411aa56b6403c689ad95061f50e4be16c274e70a17e48"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
+ "num-conv",
+ "powerfmt",
+  "serde",
+  "time-core",
+  "time-macros",
+@@ -4147,16 +4164,17 @@ dependencies = [
+ 
+ [[package]]
+ name = "time-core"
+-version = "0.1.1"
+version = "0.1.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.14"
+version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1a942f44339478ef67935ab2bbaec2fb0322496cf3cbe84b261e06ac3814c572"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+ "num-conv",
+  "time-core",
+ ]
+ 
--- a/pkgs/by-name/de/deepfilternet/package.nix
+++ b/pkgs/by-name/de/deepfilternet/package.nix
@@ -15,6 +15,11 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-5bYbfO1kmduNm9YV5niaaPvRIDRmPt4QOX7eKpK+sWY=";
  };

+  cargoPatches = [
+    # Fix compilation with Rust 1.80 (https://github.com/NixOS/nixpkgs/issues/332957)
+    ./cargo-lock-bump-time.patch
+  ];
+
  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
--- a/pkgs/by-name/el/element-call/package.nix
+++ b/pkgs/by-name/el/element-call/package.nix
@@ -6,6 +6,7 @@
 , yarnBuildHook
 , nodejs
 , npmHooks
+, olm
 }:

 let
@@ -52,5 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = licenses.asl20;
    maintainers = with maintainers; [ kilimnik ];
    mainProgram = "element-call";
+    inherit (olm.meta) knownVulnerabilities;
  };
 })
--- a/pkgs/by-name/mq/mqttui/Cargo.lock
+++ b/pkgs/by-name/mq/mqttui/Cargo.lock
--- a/pkgs/by-name/mq/mqttui/package.nix
+++ b/pkgs/by-name/mq/mqttui/package.nix
@@ -8,19 +8,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "mqttui";
-  version = "0.21.0";
+  version = "0.21.1";

  src = fetchFromGitHub {
    owner = "EdJoPaTo";
    repo = "mqttui";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aIvT1js+xY1rauZYVCkl71JLfIDjIEGy3W8WdIaTyxY=";
+    hash = "sha256-JxaXiQj/dGSUhqyDtNij3JKT5NtEkyMta6rLGHmcLrU=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "ratatui-binary-data-widget-0.1.0" = "sha256-4/8ZZag7vpEXnh6wJvZkgGLrOQNJXsnek3gFG/F0+zY=";
+      "ratatui-binary-data-widget-0.1.0" = "sha256-IQ6BbFW1huv8QrNjqBMVKVMN7gfic/NyTBQNf+wCwAo=";
    };
  };

--- a/pkgs/by-name/ru/ruff/Cargo.lock
+++ b/pkgs/by-name/ru/ruff/Cargo.lock
@@ -2060,7 +2060,7 @@ dependencies = [

 [[package]]
 name = "ruff"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
 "anyhow",
 "argfile",
@@ -2252,7 +2252,7 @@ dependencies = [

 [[package]]
 name = "ruff_linter"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
 "aho-corasick",
 "annotate-snippets 0.9.2",
@@ -2572,7 +2572,7 @@ dependencies = [

 [[package]]
 name = "ruff_wasm"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
 "console_error_panic_hook",
 "console_log",
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "ruff";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ruff";
    rev = "refs/tags/${version}";
-    hash = "sha256-s4JIqeOIxJ3NQ61fuBYYF0kSovEMcVHRExLB7kpICeg=";
+    hash = "sha256-/tD1TJRq+/2/KMmRHqB8ZbShoDkXG9nnBqacxXYKjbg=";
  };

  cargoLock = {
--- a/pkgs/by-name/st/stackql/package.nix
+++ b/pkgs/by-name/st/stackql/package.nix
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "stackql";
-  version = "0.5.699";
+  version = "0.5.708";

  src = fetchFromGitHub {
    owner = "stackql";
    repo = "stackql";
    rev = "v${version}";
-    hash = "sha256-nObrqCStZI80pgzZOvumgK5Osycf5Uj5ESETpWkqBx0=";
+    hash = "sha256-hk6YbTYdGPYDAhqYNYvGUcdiEa/07SYkfCHCcckyZ10=";
  };

-  vendorHash = "sha256-dFrJS7qd5N2Vmm6GOhRcCltbvUh0aTJTfqnxRHMmMJo=";
+  vendorHash = "sha256-6T756bvSED919n9GvwbfM4YXyGlOZKM3khEXnpcrhlI=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/xo/xonsh/package.nix
+++ b/pkgs/by-name/xo/xonsh/package.nix
@@ -1,118 +1,24 @@
 {
  lib,
-  callPackage,
-  coreutils,
-  fetchFromGitHub,
-  git,
-  gitUpdater,
-  glibcLocales,
-  python3Packages,
+  python3,
+  runCommand,
+  # configurable options
+  extraPackages ? (ps: [ ]),
 }:

 let
-
-  argset = {
-    pname = "xonsh";
-    version = "0.17.0";
-    pyproject = true;
-
-    # PyPI package ships incomplete tests
-    src = fetchFromGitHub {
-      owner = "xonsh";
-      repo = "xonsh";
-      rev = "refs/tags/${argset.version}";
-      hash = "sha256-9sRY9aetWWXzCFfgdHCBCia48THIJcMxsYMnFR6Xa8A=";
-    };
-
-    nativeBuildInputs = with python3Packages; [
-      setuptools
-      wheel
-    ];
-
-    propagatedBuildInputs = (with python3Packages; [
-      ply
-      prompt-toolkit
-      pygments
-    ]);
-
-    nativeCheckInputs = [
-      git
-      glibcLocales
-    ] ++ (with python3Packages; [
-      pip
-      pyte
-      pytest-mock
-      pytest-subprocess
-      pytestCheckHook
-      requests
-    ]);
-
-    disabledTests = [
-      # fails on sandbox
-      "test_colorize_file"
-      "test_loading_correctly"
-      "test_no_command_path_completion"
-      "test_bsd_man_page_completions"
-      "test_xonsh_activator"
-      # fails on non-interactive shells
-      "test_capture_always"
-      "test_casting"
-      "test_command_pipeline_capture"
-      "test_dirty_working_directory"
-      "test_man_completion"
-      "test_vc_get_branch"
-      "test_bash_and_is_alias_is_only_functional_alias"
-      "test_spec_modifier_alias_output_format"
-      # flaky tests
-      "test_script"
-      "test_alias_stability"
-      "test_alias_stability_exception"
-      "test_complete_import"
-      "test_subproc_output_format"
-    ];
-
-    disabledTestPaths = [
-      # fails on sandbox
-      "tests/completers/test_command_completers.py"
-      "tests/test_ptk_highlight.py"
-      "tests/test_ptk_shell.py"
-      # fails on non-interactive shells
-      "tests/prompt/test_gitstatus.py"
-      "tests/completers/test_bash_completer.py"
-    ];
-
-    env.LC_ALL = "en_US.UTF-8";
-
-    postPatch = ''
-      sed -ie 's|/bin/ls|${lib.getExe' coreutils "ls"}|' tests/test_execer.py
-      sed -ie 's|SHELL=xonsh|SHELL=$out/bin/xonsh|' tests/test_integrations.py
-
-      for script in tests/test_integrations.py scripts/xon.sh $(find -name "*.xsh"); do
-        sed -ie 's|/usr/bin/env|${lib.getExe' coreutils "env"}|' $script
-      done
-      patchShebangs .
-    '';
-
-    preCheck = ''
-      export HOME=$TMPDIR
-      export PATH=$out/bin:$PATH
-    '';
-
-    passthru = {
-      shellPath = "/bin/xonsh";
-      python = python3Packages.python; # To the wrapper
-      wrapper = callPackage ./wrapper.nix { };
-      updateScript = gitUpdater { };
-    };
-
-    meta = {
-      homepage = "https://xon.sh/";
-      description = "A Python-ish, BASHwards-compatible shell";
-      changelog = "https://github.com/xonsh/xonsh/raw/main/CHANGELOG.rst";
-      license = with lib.licenses; [ bsd3 ];
-      mainProgram = "xonsh";
-      maintainers = with lib.maintainers; [ samlukeyes123 ];
-    };
-  };
+  pythonEnv = python3.withPackages
+    (ps: [ ps.xonsh ] ++ extraPackages ps);
+  xonsh = python3.pkgs.xonsh;
 in
-python3Packages.buildPythonApplication argset
+runCommand
+  "xonsh-${xonsh.version}"
+  {
+    inherit (xonsh) pname version meta passthru;
+  }
+  ''
+    mkdir -p $out/bin
+    for bin in ${lib.getBin xonsh}/bin/*; do
+      ln -s ${pythonEnv}/bin/$(basename "$bin") $out/bin/
+    done
+  ''
--- a/pkgs/by-name/xo/xonsh/unwrapped.nix
+++ b/pkgs/by-name/xo/xonsh/unwrapped.nix
@@ -0,0 +1,128 @@
+{
+  lib,
+  coreutils,
+  fetchFromGitHub,
+  git,
+  gitUpdater,
+  glibcLocales,
+  pythonPackages,
+}:
+
+let
+
+  argset = {
+    pname = "xonsh";
+    version = "0.18.2";
+    pyproject = true;
+
+    # PyPI package ships incomplete tests
+    src = fetchFromGitHub {
+      owner = "xonsh";
+      repo = "xonsh";
+      rev = "refs/tags/${argset.version}";
+      hash = "sha256-iTdUu2yGixWwDJICDLfzRcwgGe+xlq2CvxUeSbmDiUU=";
+    };
+
+    nativeBuildInputs = with pythonPackages; [
+      setuptools
+      wheel
+    ];
+
+    propagatedBuildInputs = (
+      with pythonPackages;
+      [
+        ply
+        prompt-toolkit
+        pygments
+      ]
+    );
+
+    nativeCheckInputs =
+      [
+        git
+        glibcLocales
+      ]
+      ++ (with pythonPackages; [
+        pip
+        pyte
+        pytest-mock
+        pytest-subprocess
+        pytestCheckHook
+        requests
+      ]);
+
+    disabledTests = [
+      # fails on sandbox
+      "test_colorize_file"
+      "test_loading_correctly"
+      "test_no_command_path_completion"
+      "test_bsd_man_page_completions"
+      "test_xonsh_activator"
+
+      # fails on non-interactive shells
+      "test_capture_always"
+      "test_casting"
+      "test_command_pipeline_capture"
+      "test_dirty_working_directory"
+      "test_man_completion"
+      "test_vc_get_branch"
+      "test_bash_and_is_alias_is_only_functional_alias"
+
+      # flaky tests
+      "test_script"
+      "test_alias_stability"
+      "test_alias_stability_exception"
+      "test_complete_import"
+      "test_subproc_output_format"
+
+      # https://github.com/xonsh/xonsh/issues/5569
+      "test_spec_decorator_alias_output_format"
+    ];
+
+    disabledTestPaths = [
+      # fails on sandbox
+      "tests/completers/test_command_completers.py"
+      "tests/shell/test_ptk_highlight.py"
+      # fails on non-interactive shells
+      "tests/prompt/test_gitstatus.py"
+      "tests/completers/test_bash_completer.py"
+    ];
+
+    # https://github.com/NixOS/nixpkgs/issues/248978
+    dontWrapPythonPrograms = true;
+
+    env.LC_ALL = "en_US.UTF-8";
+
+    postPatch = ''
+      sed -ie 's|/bin/ls|${lib.getExe' coreutils "ls"}|' tests/test_execer.py
+      sed -ie 's|SHELL=xonsh|SHELL=$out/bin/xonsh|' tests/test_integrations.py
+
+      for script in tests/test_integrations.py scripts/xon.sh $(find -name "*.xsh"); do
+        sed -ie 's|/usr/bin/env|${lib.getExe' coreutils "env"}|' $script
+      done
+      patchShebangs .
+    '';
+
+    preCheck = ''
+      export HOME=$TMPDIR
+      export PATH=$out/bin:$PATH
+    '';
+
+    passthru = {
+      shellPath = "/bin/xonsh";
+      python = pythonPackages.python; # To the wrapper
+      wrapper = throw "The top-level xonsh package is now wrapped. Use it directly.";
+      updateScript = gitUpdater { };
+    };
+
+    meta = {
+      homepage = "https://xon.sh/";
+      description = "Python-ish, BASHwards-compatible shell";
+      changelog = "https://github.com/xonsh/xonsh/raw/main/CHANGELOG.rst";
+      license = with lib.licenses; [ bsd3 ];
+      mainProgram = "xonsh";
+      maintainers = with lib.maintainers; [ samlukeyes123 ];
+    };
+  };
+in
+pythonPackages.buildPythonPackage argset
--- a/pkgs/by-name/xo/xonsh/wrapper.nix
+++ b/pkgs/by-name/xo/xonsh/wrapper.nix
@@ -1,25 +0,0 @@
-{
-  lib,
-  runCommand,
-  xonsh,
-  # configurable options
-  extraPackages ? (ps: [ ]),
-}:
-
-let
-  inherit (xonsh.passthru) python;
-
-  pythonEnv = python.withPackages
-    (ps: [ (ps.toPythonModule xonsh) ] ++ extraPackages ps);
-in
-runCommand
-  "xonsh-wrapped-${xonsh.version}"
-  {
-    inherit (xonsh) pname version meta passthru;
-  }
-  ''
-    mkdir -p $out/bin
-    for bin in ${lib.getBin xonsh}/bin/*; do
-      ln -s ${pythonEnv}/bin/$(basename "$bin") $out/bin/
-    done
-  ''
--- a/pkgs/by-name/zo/zola/package.nix
+++ b/pkgs/by-name/zo/zola/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "zola";
-  version = "0.19.1";
+  version = "0.19.2";

  src = fetchFromGitHub {
    owner = "getzola";
    repo = "zola";
    rev = "v${version}";
-    hash = "sha256-qvePWGTosOTWsuwcFeOVZ7MePFpMPkC3eosIgjlPRyY=";
+    hash = "sha256-BjHAHj3EGE1L+EQdniS4OGOViOmcRDR5RhgmYK2zmVY=";
  };

-  cargoHash = "sha256-Q2Zx00Gf89TJcsOFqkq0b4e96clv/CLQE51gGONZZl0=";
+  cargoHash = "sha256-ZbSdPi90Nl15YYN1tx9iNsdAjh6x02XKGG73IlOKdXo=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/development/libraries/libei/default.nix
+++ b/pkgs/development/libraries/libei/default.nix
@@ -22,14 +22,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "libei";
-  version = "1.2.1";
+  version = "1.3.0";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "libinput";
    repo = "libei";
    rev = version;
-    hash = "sha256-8n/C0rBlyhY8SaxkwU+tDskwSQObLRrR+utk4Ktgb7U=";
+    hash = "sha256-yKeMHgR3s83xwoXgLW28ewF2tvs6l0Hq0cCAroCgq0U=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/olm/default.nix
+++ b/pkgs/development/libraries/olm/default.nix
@@ -27,5 +27,44 @@ stdenv.mkDerivation rec {
    homepage = "https://gitlab.matrix.org/matrix-org/olm";
    license = licenses.asl20;
    maintainers = with maintainers; [ tilpner oxzi ];
+    knownVulnerabilities = [ ''
+      The libolm end‐to‐end encryption library used in many Matrix
+      clients and Jitsi Meet has been deprecated upstream, and relies
+      on a cryptography library that has known side‐channel issues and
+      disclaims that its implementations are not cryptographically secure
+      and should not be used when cryptographic security is required.
+
+      It is not known that the issues can be exploited over the network in
+      practical conditions. Upstream has stated that the library should
+      not be used going forwards, and there are no plans to move to a
+      another cryptography implementation or otherwise further maintain
+      the library at all.
+
+      You should make an informed decision about whether to override this
+      security warning, especially if you critically rely on end‐to‐end
+      encryption. If you don’t care about that, or don’t use the Matrix
+      functionality of a multi‐protocol client depending on libolm,
+      then there should be no additional risk.
+
+      Some clients are investigating migrating away from libolm to maintained
+      libraries without known vulnerabilities.
+
+      For further information, see:
+
+      * The libolm deprecation notice:
+        <https://gitlab.matrix.org/matrix-org/olm/-/blob/6d4b5b07887821a95b144091c8497d09d377f985/README.md#important-libolm-is-now-deprecated>
+
+      * The warning from the cryptography code used by libolm:
+        <https://gitlab.matrix.org/matrix-org/olm/-/blob/6d4b5b07887821a95b144091c8497d09d377f985/lib/crypto-algorithms/README.md>
+
+      * The blog post disclosing the details of the known vulnerabilities:
+        <https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/>
+
+      * The Matrix.org project lead’s response to the disclosure:
+        <https://news.ycombinator.com/item?id=41249371>
+
+      * A (likely incomplete) aggregation of client tracking issue links:
+        <https://github.com/NixOS/nixpkgs/pull/334638#issuecomment-2289025802>
+    '' ];
  };
 }
--- a/pkgs/development/python-modules/acme-tiny/default.nix
+++ b/pkgs/development/python-modules/acme-tiny/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  setuptools-scm,
  fusepy,
  fuse,
@@ -11,7 +12,7 @@
 buildPythonPackage rec {
  pname = "acme-tiny";
  version = "5.0.1";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
@@ -19,12 +20,15 @@ buildPythonPackage rec {
  };

  patchPhase = ''
-    substituteInPlace acme_tiny.py --replace '"openssl"' '"${openssl.bin}/bin/openssl"'
-    substituteInPlace tests/test_module.py --replace '"openssl"' '"${openssl.bin}/bin/openssl"'
-    substituteInPlace tests/utils.py --replace /etc/ssl/openssl.cnf ${openssl.out}/etc/ssl/openssl.cnf
+    substituteInPlace acme_tiny.py --replace-fail '"openssl"' '"${openssl.bin}/bin/openssl"'
+    substituteInPlace tests/test_module.py --replace-fail '"openssl"' '"${openssl.bin}/bin/openssl"'
+    substituteInPlace tests/utils.py --replace-fail /etc/ssl/openssl.cnf ${openssl.out}/etc/ssl/openssl.cnf
  '';

-  buildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];

  nativeCheckInputs = [
    fusepy
--- a/pkgs/development/python-modules/adb-enhanced/default.nix
+++ b/pkgs/development/python-modules/adb-enhanced/default.nix
@@ -3,6 +3,7 @@
  buildPythonPackage,
  docopt,
  fetchFromGitHub,
+  setuptools,
  jdk11,
  psutil,
  pythonOlder,
@@ -11,25 +12,27 @@
 buildPythonPackage rec {
  pname = "adb-enhanced";
  version = "2.5.24";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "ashishb";
-    repo = pname;
+    repo = "adb-enhanced";
    rev = "refs/tags/${version}";
    hash = "sha256-0HxeL6VGM+HTiAxs3NFRcEFbmH9q+0/pJdGyF1hl4hU=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    psutil
    docopt
  ];

  postPatch = ''
    substituteInPlace adbe/adb_enhanced.py \
-      --replace "cmd = 'java" "cmd = '${jdk11}/bin/java"
+      --replace-fail "cmd = 'java" "cmd = '${jdk11}/bin/java"
  '';

  # Disable tests because they require a dedicated Android emulator
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.114";
+  version = "9.2.115";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "ailment";
    rev = "refs/tags/v${version}";
-    hash = "sha256-l/cAGUmvIscZjFzTYNb+tMUPgyDEHt6emYbGjwpuJyU=";
+    hash = "sha256-RYsfQNi0TFxyM7Z1l1R3KYkFI7m0TW2+rzj5fEz/ET0=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/aio-pika/default.nix
+++ b/pkgs/development/python-modules/aio-pika/default.nix
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "aio-pika";
-  version = "9.4.2";
+  version = "9.4.3";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "mosquito";
    repo = "aio-pika";
    rev = "refs/tags/${version}";
-    hash = "sha256-Juzbn6A8IIdbtlN3cyT7UBb9fMpEgEgg0VE8GJCnGW4=";
+    hash = "sha256-lzBBcfWzhdT2v9RX5C+VWWSxsBCB7EOeCjm6wUrXGtA=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/aiolip/default.nix
+++ b/pkgs/development/python-modules/aiolip/default.nix
@@ -3,26 +3,29 @@
  buildPythonPackage,
  fetchFromGitHub,
  pytestCheckHook,
+  setuptools,
  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "aiolip";
  version = "1.1.6";
-  format = "setuptools";
+  pyproject = true;
  disabled = pythonOlder "3.5";

  src = fetchFromGitHub {
    owner = "bdraco";
-    repo = pname;
+    repo = "aiolip";
    rev = version;
    sha256 = "1bgmcl8q1p6f2xm3w2qylvla6vf6bd1p2hfwj4l8w6w0w04vr02g";
  };

+  build-system = [ setuptools ];
+
  nativeCheckInputs = [ pytestCheckHook ];

  postPatch = ''
-    substituteInPlace setup.py --replace "'pytest-runner'," ""
+    substituteInPlace setup.py --replace-fail "'pytest-runner'," ""
  '';

  pythonImportsCheck = [ "aiolip" ];
--- a/pkgs/development/python-modules/aiomealie/default.nix
+++ b/pkgs/development/python-modules/aiomealie/default.nix
@@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "aiomealie";
-  version = "0.8.0";
+  version = "0.8.1";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "joostlek";
    repo = "python-mealie";
    rev = "refs/tags/v${version}";
-    hash = "sha256-/Hg0kcwUNaEsm8znOOkWd0oOu0ikK5LAYGKbP2pvHhQ=";
+    hash = "sha256-1n/AMXEoJJ/jftYzYHvo+jTSasNEqnFVAYqlipHFmGc=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/aioqsw/default.nix
+++ b/pkgs/development/python-modules/aioqsw/default.nix
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "aioqsw";
-  version = "0.4.0";
+  version = "0.4.1";
  format = "pyproject";

  disabled = pythonOlder "3.11";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "Noltari";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-xXbOIG9gw1rO+iWdXNWWmweM83FpTLMuaDTcRZoMvL8=";
+    hash = "sha256-h/rTwMF3lc/hWwpzCvK6UMq0rjq3xkw/tEY3BqOPS2s=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aliyun-python-sdk-kms/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-kms/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "aliyun-python-sdk-kms";
-  version = "2.16.3";
+  version = "2.16.4";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-wxt9JOFTJxowQ+gB57a2s/DbR+lag8jRDNq4wRZi/Dk=";
+    hash = "sha256-DVuxZcB7apcpOXU6EoUHOT9IAReS7g7E9ZtgIeq9l1I=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/ambee/default.nix
+++ b/pkgs/development/python-modules/ambee/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
  pname = "ambee";
  version = "0.4.0";
  disabled = pythonOlder "3.8";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "frenck";
@@ -25,9 +25,9 @@ buildPythonPackage rec {
    hash = "sha256-2wX2CLr6kdVw2AGPW6DmYI2OBfQFI/iWVorok2d3wx4=";
  };

-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    aiohttp
    yarl
  ];
@@ -42,7 +42,7 @@ buildPythonPackage rec {
  postPatch = ''
    # Upstream doesn't set a version for the pyproject.toml
    substituteInPlace pyproject.toml \
-      --replace "0.0.0" "${version}"
+      --replace-fail "0.0.0" "${version}"
  '';

  pythonImportsCheck = [ "ambee" ];
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -36,7 +36,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.114";
+  version = "9.2.115";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -45,7 +45,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "angr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Juv1/N/QdV99P1QupXU+OTl2ycT0SNrQF3PfDvQjb3Y=";
+    hash = "sha256-9YMwVi4pQxdIMFfwVdQ8okc+n40qOnUDUYn8Rv3vmWU=";
  };

  pythonRelaxDeps = [ "capstone" ];
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.114";
+  version = "9.2.115";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "archinfo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Ov7jEV4avhdslf6K36lSQpz/bA+riYUKGVtnd3ChXPI=";
+    hash = "sha256-MuXECTXmM9oDPZ1P4654Z2DBEjFiq2rao9V5Z476sjk=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/atc-ble/default.nix
+++ b/pkgs/development/python-modules/atc-ble/default.nix
@@ -6,6 +6,7 @@
  poetry-core,
  pycryptodomex,
  pytestCheckHook,
+  pytest-cov-stub,
  pythonOlder,
  sensor-state-data,
 }:
@@ -13,31 +14,29 @@
 buildPythonPackage rec {
  pname = "atc-ble";
  version = "0.1.0";
-  format = "pyproject";
+  pyproject = true;

  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "Bluetooth-Devices";
-    repo = pname;
+    repo = "atc-ble";
    rev = "refs/tags/v${version}";
    hash = "sha256-rwOFKxUlbbNIDJRdCmZpHstXwxcTnvlExgcVDdGbIVY=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=atc_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  build-system = [ poetry-core ];

-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [
+  dependencies = [
    bluetooth-sensor-state-data
    pycryptodomex
    sensor-state-data
  ];

-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+  ];

  pythonImportsCheck = [ "atc_ble" ];

--- a/pkgs/development/python-modules/autarco/default.nix
+++ b/pkgs/development/python-modules/autarco/default.nix
@@ -8,6 +8,7 @@
  orjson,
  poetry-core,
  pytest-asyncio,
+  pytest-cov-stub,
  pytestCheckHook,
  pythonOlder,
  syrupy,
@@ -33,8 +34,7 @@ buildPythonPackage rec {
  postPatch = ''
    # Upstream doesn't set a version for the pyproject.toml
    substituteInPlace pyproject.toml \
-      --replace "0.0.0" "${version}" \
-      --replace "--cov" ""
+      --replace-fail "0.0.0" "${version}"
  '';

  build-system = [ poetry-core ];
@@ -51,6 +51,7 @@ buildPythonPackage rec {
  nativeCheckInputs = [
    aresponses
    pytest-asyncio
+    pytest-cov-stub
    pytestCheckHook
    syrupy
  ];
--- a/pkgs/development/python-modules/avro3k/default.nix
+++ b/pkgs/development/python-modules/avro3k/default.nix
@@ -2,13 +2,14 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  isPy3k,
 }:

 buildPythonPackage rec {
  pname = "avro3k";
  version = "1.7.7-SNAPSHOT";
-  format = "setuptools";
+  pyproject = true;
  disabled = !isPy3k;

  src = fetchPypi {
@@ -19,9 +20,11 @@ buildPythonPackage rec {
  # setuptools.extern.packaging.version.InvalidVersion: Invalid version: '1.7.7-SNAPSHOT'
  postPatch = ''
    substituteInPlace setup.py \
-      --replace "1.7.7-SNAPSHOT" "1.7.7"
+      --replace-fail "1.7.7-SNAPSHOT" "1.7.7"
  '';

+  build-system = [ setuptools ];
+
  doCheck = false; # No such file or directory: './run_tests.py

  meta = with lib; {
--- a/pkgs/development/python-modules/azure-mgmt-commerce/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-commerce/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  msrestazure,
  azure-common,
  azure-mgmt-core,
@@ -11,7 +12,7 @@
 buildPythonPackage rec {
  pname = "azure-mgmt-commerce";
  version = "6.0.0";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
@@ -19,7 +20,9 @@ buildPythonPackage rec {
    sha256 = "6f5447395503b2318f451d24f8021ee08db1cac44f1c3337ea690700419626b6";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    msrestazure
    azure-common
    azure-mgmt-core
@@ -28,8 +31,6 @@ buildPythonPackage rec {

  prePatch = ''
    rm -f azure_bdist_wheel.py tox.ini
-    substituteInPlace setup.py \
-      --replace "wheel==0.30.0" "wheel"
    sed -i "/azure-namespace-package/c\ " setup.cfg
  '';

@@ -43,8 +44,6 @@ buildPythonPackage rec {
    description = "This is the Microsoft Azure Commerce Management Client Library";
    homepage = "https://github.com/Azure/azure-sdk-for-python";
    license = licenses.mit;
-    maintainers = with maintainers; [
-      maxwilson
-    ];
+    maintainers = with maintainers; [ maxwilson ];
  };
 }
--- a/pkgs/development/python-modules/azure-mgmt-consumption/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-consumption/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  msrestazure,
  azure-common,
  azure-mgmt-core,
@@ -11,7 +12,7 @@
 buildPythonPackage rec {
  pname = "azure-mgmt-consumption";
  version = "10.0.0";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
@@ -19,7 +20,9 @@ buildPythonPackage rec {
    hash = "sha256-BqCGQ2wXN/d6uGiU1R9Zc7bg+l7fVlWOTCllieurkTA=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    msrestazure
    azure-common
    azure-mgmt-core
@@ -28,8 +31,6 @@ buildPythonPackage rec {

  preBuild = ''
    rm -f azure_bdist_wheel.py
-    substituteInPlace setup.cfg \
-      --replace "azure-namespace-package = azure-mgmt-nspkg" ""
  '';

  pythonNamespaces = [ "azure.mgmt" ];
--- a/pkgs/development/python-modules/azure-mgmt-relay/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-relay/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  msrestazure,
  azure-common,
  azure-mgmt-core,
@@ -11,7 +12,7 @@
 buildPythonPackage rec {
  pname = "azure-mgmt-relay";
  version = "1.1.0";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
@@ -19,7 +20,9 @@ buildPythonPackage rec {
    sha256 = "c93b7550e64b6734bf23ce57ca974a3ea929b734c58d1fe3669728c4fd2d2eb3";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    msrestazure
    azure-common
    azure-mgmt-core
@@ -28,8 +31,6 @@ buildPythonPackage rec {

  preBuild = ''
    rm -f azure_bdist_wheel.py
-    substituteInPlace setup.cfg \
-      --replace "azure-namespace-package = azure-mgmt-nspkg" ""
  '';

  pythonNamespaces = [ "azure.mgmt" ];
--- a/pkgs/development/python-modules/batchgenerators/default.nix
+++ b/pkgs/development/python-modules/batchgenerators/default.nix
@@ -3,6 +3,7 @@
  buildPythonPackage,
  pythonOlder,
  fetchFromGitHub,
+  setuptools,
  pytestCheckHook,
  future,
  numpy,
@@ -16,18 +17,20 @@
 buildPythonPackage rec {
  pname = "batchgenerators";
  version = "0.25";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "MIC-DKFZ";
-    repo = pname;
+    repo = "batchgenerators";
    rev = "v${version}";
    hash = "sha256-L2mWH2t8PN9o1M67KDdl1Tj2ZZ02MY4icsJY2VNrj3A=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    future
    numpy
    pillow
@@ -38,10 +41,7 @@ buildPythonPackage rec {
  ];

  # see https://github.com/MIC-DKFZ/batchgenerators/pull/78
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace '"unittest2",' ""
-  '';
+  pythonRemoveDeps = [ "unittest2" ];

  nativeCheckInputs = [ pytestCheckHook ];

--- a/pkgs/development/python-modules/block-io/default.nix
+++ b/pkgs/development/python-modules/block-io/default.nix
@@ -13,7 +13,7 @@
 buildPythonPackage rec {
  pname = "block-io";
  version = "2.0.6";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.6";

@@ -22,7 +22,11 @@ buildPythonPackage rec {
    hash = "sha256-M7czfpagXqoWWSu4enB3Z2hc2GtAaskI6cnJzJdpC8I=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  pythonRelaxDeps = [ "base58" ];
+
+  dependencies = [
    base58
    bitcoin-utils-fork-minimal
    pycryptodome
@@ -30,11 +34,6 @@ buildPythonPackage rec {
    setuptools
  ];

-  preConfigure = ''
-    substituteInPlace setup.py \
-      --replace "base58==2.1.0" "base58>=2.1.0"
-  '';
-
  # Tests needs a BlockIO API key to run properly
  # https://github.com/BlockIo/block_io-python/blob/79006bc8974544b70a2d8e9f19c759941d32648e/test.py#L18
  doCheck = false;
--- a/pkgs/development/python-modules/boiboite-opener-framework/default.nix
+++ b/pkgs/development/python-modules/boiboite-opener-framework/default.nix
@@ -23,10 +23,7 @@ buildPythonPackage rec {
    hash = "sha256-atKqHRX24UjF/9Dy0aYXAN+80nBJKCd07FmaR5Vl1q4=";
  };

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "scapy==2.5.0rc1" "scapy"
-  '';
+  pythonRelaxDeps = [ "scapy" ];

  build-system = [ setuptools ];

--- a/pkgs/development/python-modules/celery-singleton/default.nix
+++ b/pkgs/development/python-modules/celery-singleton/default.nix
@@ -14,7 +14,7 @@
 buildPythonPackage rec {
  pname = "celery-singleton";
  version = "0.3.1";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "steinitzu";
@@ -33,9 +33,9 @@ buildPythonPackage rec {
    })
  ];

-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    celery
    redis
  ];
--- a/pkgs/development/python-modules/cemm/default.nix
+++ b/pkgs/development/python-modules/cemm/default.nix
@@ -16,7 +16,7 @@
 buildPythonPackage rec {
  pname = "cemm";
  version = "0.5.1";
-  format = "pyproject";
+  pyproject = true;

  disabled = pythonOlder "3.9";

@@ -38,12 +38,12 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace '"0.0.0"' '"${version}"'
+      --replace-fail '"0.0.0"' '"${version}"'
  '';

-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    aiohttp
    yarl
  ];
--- a/pkgs/development/python-modules/ciscoconfparse/default.nix
+++ b/pkgs/development/python-modules/ciscoconfparse/default.nix
@@ -15,13 +15,13 @@
 buildPythonPackage rec {
  pname = "ciscoconfparse";
  version = "1.7.24";
-  format = "pyproject";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "mpenning";
-    repo = pname;
+    repo = "ciscoconfparse";
    rev = "refs/tags/${version}";
    hash = "sha256-vL/CQdYcOP356EyRToviWylP1EBtxmeov6qkhfQNZ2Y=";
  };
@@ -35,16 +35,14 @@ buildPythonPackage rec {
    sed -i '/requires-python/d' pyproject.toml

    substituteInPlace pyproject.toml \
-      --replace '"poetry>=1.3.2",' ""
+      --replace-fail '"poetry>=1.3.2",' ""

    patchShebangs tests
  '';

-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    passlib
    deprecat
    dnspython
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -8,12 +8,13 @@
  pytestCheckHook,
  pythonOlder,
  setuptools,
+  typing-extensions,
  z3-solver,
 }:

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.114";
+  version = "9.2.115";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -22,7 +23,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "claripy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-VvYJQK2++wfH9aNR31Cbz8nQalWwbOwiE8YMOhAVG3c=";
+    hash = "sha256-KOjLjR59n4D9i12YSBrwyr0B8q2WZ1Y7D3tbWkKL5gY=";
  };

  # z3 does not provide a dist-info, so python-runtime-deps-check will fail
@@ -36,6 +37,7 @@ buildPythonPackage rec {
    cachetools
    decorator
    pysmt
+    typing-extensions
    z3-solver
  ] ++ z3-solver.requiredPythonModules;

--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -18,14 +18,14 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.114";
+  version = "9.2.115";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
    owner = "angr";
    repo = "binaries";
    rev = "refs/tags/v${version}";
-    hash = "sha256-M8agIZ4Gk67wKUfKI/13sYAYUta0sWk7cVkM5ayb0V0=";
+    hash = "sha256-tAng3ed/oGeFIg1bSugT+s9laLuD9nsuTvLd2lx6Xcs=";
  };
 in
 buildPythonPackage rec {
@@ -39,7 +39,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "cle";
    rev = "refs/tags/v${version}";
-    hash = "sha256-PGAuLW0yTuKrAo+xxlLQnnxugiZAhXQmC89Ve2OY8aY=";
+    hash = "sha256-HYALGByZYM2FXXIucYkByZ7C31Mb1ZgiySKDWdk/5GQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "cyclopts";
-  version = "2.9.5";
+  version = "2.9.6";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "BrianPugh";
    repo = "cyclopts";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KZGsYaEcOs8NoUCRG4MqW9wqrqDJ1Ygv6U7QfyGqNhQ=";
+    hash = "sha256-KXqeCUbSLHzeIMDpfaNj5aVxDtVP6dlctBDbukKPLSA=";
  };

  build-system = [
--- a/pkgs/development/python-modules/databricks-connect/default.nix
+++ b/pkgs/development/python-modules/databricks-connect/default.nix
@@ -3,6 +3,7 @@
  jdk8,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  six,
  py4j,
  pythonOlder,
@@ -11,7 +12,7 @@
 buildPythonPackage rec {
  pname = "databricks-connect";
  version = "11.3.33";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@@ -22,7 +23,9 @@ buildPythonPackage rec {

  sourceRoot = ".";

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    py4j
    six
    jdk8
@@ -31,14 +34,11 @@ buildPythonPackage rec {
  # requires network access
  doCheck = false;

-  prePatch = ''
-    substituteInPlace setup.py \
-      --replace "py4j==0.10.9" "py4j"
-  '';
+  pythonRelaxDeps = [ "py4j" ];

  preFixup = ''
    substituteInPlace "$out/bin/find-spark-home" \
-      --replace find_spark_home.py .find_spark_home.py-wrapped
+      --replace-fail find_spark_home.py .find_spark_home.py-wrapped
  '';

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/django-payments/default.nix
+++ b/pkgs/development/python-modules/django-payments/default.nix
@@ -9,6 +9,7 @@
  mercadopago,
  pythonOlder,
  requests,
+  setuptools,
  setuptools-scm,
  sphinx-rtd-theme,
  stripe,
@@ -18,7 +19,7 @@
 buildPythonPackage rec {
  pname = "django-payments";
  version = "2.0.0";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@@ -31,12 +32,15 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace setup.py \
-      --replace "django-phonenumber-field[phonenumberslite]" "django-phonenumber-field"
+      --replace-fail "django-phonenumber-field[phonenumberslite]" "django-phonenumber-field"
  '';

-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];

-  propagatedBuildInputs = [
+  dependencies = [
    django
    django-phonenumber-field
    requests
--- a/pkgs/development/python-modules/django-scim2/default.nix
+++ b/pkgs/development/python-modules/django-scim2/default.nix
@@ -19,11 +19,11 @@
 buildPythonPackage rec {
  pname = "django-scim2";
  version = "0.19.0";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "15five";
-    repo = pname;
+    repo = "django-scim2";
    rev = "refs/tags/${version}";
    hash = "sha256-larDh4f9/xVr11/n/WfkJ2Tx45DMQqyK3ZzkWAvzeig=";
  };
@@ -31,13 +31,13 @@ buildPythonPackage rec {
  # remove this when upstream releases a new version > 0.19.0
  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace "poetry>=0.12" "poetry-core>=1.5.2" \
-      --replace "poetry.masonry.api" "poetry.core.masonry.api"
+      --replace-fail "poetry>=0.12" "poetry-core>=1.5.2" \
+      --replace-fail "poetry.masonry.api" "poetry.core.masonry.api"
  '';

-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    django
    scim2-filter-parser
  ];
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -44,7 +44,7 @@

 buildPythonPackage rec {
  pname = "django";
-  version = "5.0.7";
+  version = "5.0.8";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
    owner = "django";
    repo = "django";
    rev = "refs/tags/${version}";
-    hash = "sha256-g2Y8kcfYUjykZ7Y6JEsNW/jw6chMLLYpQlgdTFt7HmM=";
+    hash = "sha256-mH8o1f3UMuKEHwfXK2ck1GVj/T50F+7IgTsnXJn7aHU=";
  };

  patches =
--- a/pkgs/development/python-modules/eiswarnung/default.nix
+++ b/pkgs/development/python-modules/eiswarnung/default.nix
@@ -6,6 +6,7 @@
  fetchFromGitHub,
  poetry-core,
  pytest-asyncio,
+  pytest-cov-stub,
  pytestCheckHook,
  pythonOlder,
  pytz,
@@ -15,7 +16,7 @@
 buildPythonPackage rec {
  pname = "eiswarnung";
  version = "2.0.0";
-  format = "pyproject";
+  pyproject = true;

  disabled = pythonOlder "3.11";

@@ -30,14 +31,14 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace '"0.0.0"' '"${version}"' \
-      --replace 'addopts = "--cov"' "" \
-      --replace 'pytz = ">=2022.7.1,<2024.0.0"' 'pytz = "*"'
+      --replace-fail '"0.0.0"' '"${version}"'
  '';

-  nativeBuildInputs = [ poetry-core ];
+  pythonRelaxDeps = [ "pytz" ];

-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  dependencies = [
    aiohttp
    pytz
    yarl
@@ -46,6 +47,7 @@ buildPythonPackage rec {
  nativeCheckInputs = [
    aresponses
    pytest-asyncio
+    pytest-cov-stub
    pytestCheckHook
  ];

--- a/pkgs/development/python-modules/entrance/default.nix
+++ b/pkgs/development/python-modules/entrance/default.nix
@@ -4,6 +4,7 @@
  buildPythonPackage,
  pythonOlder,
  routerFeatures,
+  setuptools,
  janus,
  ncclient,
  paramiko,
@@ -18,7 +19,7 @@ let
    if routerFeatures then
      {
        prePatch = ''
-          substituteInPlace ./setup.py --replace "extra_deps = []" "extra_deps = router_feature_deps"
+          substituteInPlace ./setup.py --replace-fail "extra_deps = []" "extra_deps = router_feature_deps"
        '';
        extraBuildInputs = [
          janus
@@ -36,7 +37,7 @@ in
 buildPythonPackage rec {
  pname = "entrance";
  version = "1.1.20";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
@@ -49,7 +50,9 @@ buildPythonPackage rec {
  # No useful tests
  doCheck = false;

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    pyyaml
    sanic
  ] ++ opts.extraBuildInputs;
--- a/pkgs/development/python-modules/envoy-reader/default.nix
+++ b/pkgs/development/python-modules/envoy-reader/default.nix
@@ -4,6 +4,7 @@
  buildPythonPackage,
  envoy-utils,
  fetchFromGitHub,
+  setuptools,
  httpx,
  pyjwt,
  pytest-asyncio,
@@ -16,7 +17,7 @@
 buildPythonPackage rec {
  pname = "envoy-reader";
  version = "0.21.3";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@@ -27,7 +28,9 @@ buildPythonPackage rec {
    hash = "sha256-aIpZ4ln4L57HwK8H0FqsyNnXosnAp3ingrJI6/MPS90=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    beautifulsoup4
    envoy-utils
    httpx
@@ -41,10 +44,11 @@ buildPythonPackage rec {
    respx
  ];

+  pythonRelaxDeps = [ "pyjwt" ];
+
  postPatch = ''
    substituteInPlace setup.py \
-      --replace "pytest-runner>=5.2" "" \
-      --replace "pyjwt==2.1.0" "pyjwt>=2.1.0"
+      --replace-fail "pytest-runner>=5.2" ""
  '';

  pythonImportsCheck = [ "envoy_reader" ];
--- a/pkgs/development/python-modules/fastapi-mail/default.nix
+++ b/pkgs/development/python-modules/fastapi-mail/default.nix
@@ -33,16 +33,19 @@ buildPythonPackage rec {
    hash = "sha256-2iTZqZIxlt1GKhElasTcnys18UbNNDwHoZziHBOIGBo=";
  };

+  pythonRelaxDeps = [
+    "aiosmtplib"
+    "pydantic"
+  ];
+
  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace 'version = "1.2.5"' 'version = "${version}"' \
-      --replace 'aiosmtplib = "^2.0"' 'aiosmtplib = "*"' \
-      --replace 'pydantic = "^2.0"' 'pydantic = "*"' \
+      --replace-fail 'version = "1.2.5"' 'version = "${version}"'
  '';

-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    aioredis
    aiosmtplib
    blinker
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "fastcore";
-  version = "1.6.7";
+  version = "1.7.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "fastai";
    repo = "fastcore";
    rev = "refs/tags/${version}";
-    hash = "sha256-f31aQKYM1qawGrNtUZH3K+Zq9JerKNm+fEJ938bhHKc=";
+    hash = "sha256-8pbAUemswRP+K8kh23u1AbVfv28+3Ykzla4cWzSFMfc=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/fhir-py/default.nix
+++ b/pkgs/development/python-modules/fhir-py/default.nix
@@ -9,6 +9,7 @@
  requests,
  pytestCheckHook,
  pytest-asyncio,
+  pytest-cov-stub,
  responses,
 }:

@@ -26,15 +27,9 @@ buildPythonPackage rec {
    hash = "sha256-kYqoRso1ypN5novRxMMzz1h2NGNybbw5lK4+HErG79I=";
  };

-  preBuild = ''
-    substituteInPlace pyproject.toml  \
-      --replace "--cov=fhirpy" ""  \
-      --replace "--cov-report=xml" ""
-  '';
+  build-system = [ flit-core ];

-  nativeBuildInputs = [ flit-core ];
-
-  propagatedBuildInputs = [
+  dependencies = [
    aiohttp
    pytz
    requests
@@ -43,6 +38,7 @@ buildPythonPackage rec {
  nativeCheckInputs = [
    pytestCheckHook
    pytest-asyncio
+    pytest-cov-stub
    responses
  ];

--- a/pkgs/development/python-modules/finetuning-scheduler/default.nix
+++ b/pkgs/development/python-modules/finetuning-scheduler/default.nix
@@ -12,16 +12,16 @@

 buildPythonPackage rec {
  pname = "finetuning-scheduler";
-  version = "2.3.3";
+  version = "2.4.0";
  pyproject = true;

-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "speediedan";
    repo = "finetuning-scheduler";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Nci+NcfcaZV3NH3MTCyr8PwPdDykJTdq8+CmtngWdiM=";
+    hash = "sha256-uSFGZseSJv519LpaddO6yP6AsIMZutEA0Y7Yr+mEWTQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/finvizfinance/default.nix
+++ b/pkgs/development/python-modules/finvizfinance/default.nix
@@ -3,6 +3,7 @@
  buildPythonPackage,
  pythonOlder,
  fetchFromGitHub,
+  setuptools,
  beautifulsoup4,
  datetime,
  lxml,
@@ -15,7 +16,7 @@
 buildPythonPackage rec {
  pname = "finvizfinance";
  version = "1.0.1";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.5";

@@ -26,17 +27,14 @@ buildPythonPackage rec {
    hash = "sha256-4aR1x9GgbxnJUpn1+i95djZEVBFTAIzhMLxHe2FaciY=";
  };

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "bs4" "beautifulsoup4"
-  '';
+  build-system = [ setuptools ];

  nativeCheckInputs = [
    pytest-mock
    pytestCheckHook
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    beautifulsoup4
    datetime
    lxml
--- a/pkgs/development/python-modules/flake8-future-import/default.nix
+++ b/pkgs/development/python-modules/flake8-future-import/default.nix
@@ -6,6 +6,7 @@
  isPy38,
  isPy39,
  pythonAtLeast,
+  setuptools,
  flake8,
  six,
  python,
@@ -14,7 +15,7 @@
 buildPythonPackage rec {
  pname = "flake8-future-import";
  version = "0.4.7";
-  format = "setuptools";
+  pyproject = true;

  # PyPI tarball doesn't include the test suite
  src = fetchFromGitHub {
@@ -36,10 +37,12 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace "test_flake8_future_import.py" \
-      --replace "'flake8'" "'${lib.getExe flake8}'"
+      --replace-fail "'flake8'" "'${lib.getExe flake8}'"
  '';

-  propagatedBuildInputs = [ flake8 ];
+  build-system = [ setuptools ];
+
+  dependencies = [ flake8 ];

  nativeCheckInputs = [ six ];

--- a/pkgs/development/python-modules/flake8-polyfill/default.nix
+++ b/pkgs/development/python-modules/flake8-polyfill/default.nix
@@ -3,6 +3,7 @@
  buildPythonPackage,
  fetchpatch,
  fetchPypi,
+  setuptools,
  flake8,
  mock,
  pep8,
@@ -12,14 +13,16 @@
 buildPythonPackage rec {
  pname = "flake8-polyfill";
  version = "1.0.2";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
    sha256 = "1nlf1mkqw856vi6782qcglqhaacb23khk9wkcgn55npnjxshhjz4";
  };

-  propagatedBuildInputs = [ flake8 ];
+  build-system = [ setuptools ];
+
+  dependencies = [ flake8 ];

  nativeCheckInputs = [
    mock
@@ -39,7 +42,7 @@ buildPythonPackage rec {
  postPatch = ''
    # Failed: [pytest] section in setup.cfg files is no longer supported, change to [tool:pytest] instead.
    substituteInPlace setup.cfg \
-      --replace pytest 'tool:pytest'
+      --replace-fail pytest 'tool:pytest'
  '';

  pythonImportsCheck = [ "flake8_polyfill" ];
--- a/pkgs/development/python-modules/flask-gravatar/default.nix
+++ b/pkgs/development/python-modules/flask-gravatar/default.nix
@@ -12,13 +12,14 @@

  # tests
  pytestCheckHook,
+  pytest-cov-stub,
  pygments,
 }:

 buildPythonPackage rec {
  pname = "flask-gravatar";
  version = "0.5.0";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    pname = "Flask-Gravatar";
@@ -39,18 +40,18 @@ buildPythonPackage rec {
     -e "s|tests_require=tests_require,||g" \
     -e "s|extras_require=extras_require,||g" \
     -e "s|setup_requires=setup_requires,||g"
-    # pep8 is deprecated and cov not needed
+    # pep8 is deprecated
    substituteInPlace pytest.ini \
-     --replace "--pep8" "" \
-     --replace "--cov=flask_gravatar --cov-report=term-missing" ""
+     --replace-fail "--pep8" ""
  '';

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [ flask ];
+  dependencies = [ flask ];

  nativeCheckInputs = [
    pytestCheckHook
+    pytest-cov-stub
    pygments
  ];

--- a/pkgs/development/python-modules/hydrus-api/default.nix
+++ b/pkgs/development/python-modules/hydrus-api/default.nix
@@ -10,7 +10,7 @@
 buildPythonPackage rec {
  pname = "hydrus-api";
  version = "5.0.1";
-  format = "pyproject";
+  pyproject = true;

  disabled = pythonOlder "3.9";

@@ -20,15 +20,9 @@ buildPythonPackage rec {
    hash = "sha256-3Roeab9/woGF/aZYm9nbqrcyYN8CKA1k66cTRxx6jM4=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml --replace \
-      "poetry.masonry.api" \
-      "poetry.core.masonry.api"
-  '';
+  build-system = [ poetry-core ];

-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [ requests ];
+  dependencies = [ requests ];

  pythonImportsCheck = [ "hydrus_api" ];

--- a/pkgs/development/python-modules/imagecorruptions/default.nix
+++ b/pkgs/development/python-modules/imagecorruptions/default.nix
@@ -1,6 +1,7 @@
 {
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  numpy,
  scikit-image,
  lib,
@@ -10,19 +11,18 @@
 buildPythonPackage rec {
  pname = "imagecorruptions";
  version = "1.1.2";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
    sha256 = "044e173f24d5934899bdbf3596bfbec917e8083e507eed583ab217abebbe084d";
  };

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'opencv-python >= 3.4.5'," ""
-  '';
+  pythonRemoveDeps = [ "opencv-python" ];

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    numpy
    scikit-image
    opencv4
--- a/pkgs/development/python-modules/imantics/default.nix
+++ b/pkgs/development/python-modules/imantics/default.nix
@@ -2,6 +2,7 @@
  buildPythonPackage,
  fetchFromGitHub,
  lib,
+  setuptools,
  numpy,
  opencv4,
  lxml,
@@ -12,7 +13,7 @@
 buildPythonPackage rec {
  pname = "imantics";
  version = "0.1.12";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "jsbroks";
@@ -21,18 +22,17 @@ buildPythonPackage rec {
    sha256 = "1zv2gj8cbakhh2fyr2611cbqhfk37a56x973ny9n43y70n26pzm8";
  };

-  propagatedBuildInputs = [
+  pythonRemoveDeps = [ "opencv-python" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
    numpy
    opencv4
    lxml
    xmljson
  ];

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'opencv-python>=3'," ""
-  '';
-
  nativeCheckInputs = [ pytestCheckHook ];

  pythonImportsCheck = [ "imantics" ];
--- a/pkgs/development/python-modules/jupyter-c-kernel/default.nix
+++ b/pkgs/development/python-modules/jupyter-c-kernel/default.nix
@@ -1,6 +1,7 @@
 {
  lib,
  buildPythonPackage,
+  setuptools,
  fetchPypi,
  ipykernel,
  gcc,
@@ -9,7 +10,7 @@
 buildPythonPackage rec {
  pname = "jupyter-c-kernel";
  version = "1.2.2";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    pname = "jupyter_c_kernel";
@@ -19,10 +20,12 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace jupyter_c_kernel/kernel.py \
-      --replace "'gcc'" "'${gcc}/bin/gcc'"
+      --replace-fail "'gcc'" "'${gcc}/bin/gcc'"
  '';

-  propagatedBuildInputs = [ ipykernel ];
+  build-system = [ setuptools ];
+
+  dependencies = [ ipykernel ];

  # no tests in repository
  doCheck = false;
--- a/pkgs/development/python-modules/jupyterhub-systemdspawner/default.nix
+++ b/pkgs/development/python-modules/jupyterhub-systemdspawner/default.nix
@@ -5,13 +5,14 @@
  fetchFromGitHub,
  jupyterhub,
  pythonOlder,
+  setuptools,
  tornado,
 }:

 buildPythonPackage rec {
  pname = "jupyterhub-systemdspawner";
  version = "1.0.1";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.8";

@@ -23,16 +24,13 @@ buildPythonPackage rec {
  };

  postPatch = ''
-    substituteInPlace systemdspawner/systemd.py \
-      --replace "/bin/bash" "${bash}/bin/bash"
-
    substituteInPlace systemdspawner/systemdspawner.py \
-      --replace "/bin/bash" "${bash}/bin/bash"
+      --replace-fail "/bin/bash" "${bash}/bin/bash"
  '';

-  buildInputs = [ bash ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    jupyterhub
    tornado
  ];
--- a/pkgs/development/python-modules/jupyterlab-execute-time/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-execute-time/default.nix
@@ -1,8 +1,9 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, jupyterlab
-, jupyter-packaging
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  jupyterlab,
+  jupyter-packaging,
 }:

 buildPythonPackage rec {
@@ -19,7 +20,7 @@ buildPythonPackage rec {
  # jupyterlab is required to build from source but we use the pre-build package
  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace '"jupyterlab~=4.0.0"' ""
+      --replace-fail '"jupyterlab~=4.0.0"' ""
  '';

  dependencies = [
--- a/pkgs/development/python-modules/karton-autoit-ripper/default.nix
+++ b/pkgs/development/python-modules/karton-autoit-ripper/default.nix
@@ -3,6 +3,7 @@
  autoit-ripper,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  karton-core,
  malduck,
  pythonOlder,
@@ -12,31 +13,32 @@
 buildPythonPackage rec {
  pname = "karton-autoit-ripper";
  version = "1.2.0";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "CERT-Polska";
-    repo = pname;
+    repo = "karton-autoit-ripper";
    rev = "refs/tags/v${version}";
    hash = "sha256-D+M3JsIN8LUWg8GVweEzySHI7KaBb6cNHHn4pXoq55M=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  pythonRelaxDeps = [
+    "autoit-ripper"
+    "malduck"
+    "regex"
+  ];
+
+  dependencies = [
    autoit-ripper
    karton-core
    malduck
    regex
  ];

-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "autoit-ripper==" "autoit-ripper>=" \
-      --replace "malduck==" "malduck>=" \
-      --replace "regex==" "regex>="
-  '';
-
  # Module has no tests
  doCheck = false;

--- a/pkgs/development/python-modules/karton-classifier/default.nix
+++ b/pkgs/development/python-modules/karton-classifier/default.nix
@@ -3,6 +3,7 @@
  buildPythonPackage,
  chardet,
  fetchFromGitHub,
+  setuptools,
  karton-core,
  pytestCheckHook,
  python-magic,
@@ -12,18 +13,25 @@
 buildPythonPackage rec {
  pname = "karton-classifier";
  version = "2.0.0";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "CERT-Polska";
-    repo = pname;
+    repo = "karton-classifier";
    rev = "refs/tags/v${version}";
    hash = "sha256-DH8I4Lbbs2TVMvYlvh/P2I/7O4+VechP2JDDVHNsTSg=";
  };

-  propagatedBuildInputs = [
+  pythonRelaxDeps = [
+    "chardet"
+    "python-magic"
+  ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
    chardet
    karton-core
    python-magic
@@ -31,12 +39,6 @@ buildPythonPackage rec {

  nativeCheckInputs = [ pytestCheckHook ];

-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "chardet==3.0.4" "chardet" \
-      --replace "python-magic==0.4.18" "python-magic"
-  '';
-
  pythonImportsCheck = [ "karton.classifier" ];

  disabledTests = [
--- a/pkgs/development/python-modules/keyring-pass/default.nix
+++ b/pkgs/development/python-modules/keyring-pass/default.nix
@@ -24,10 +24,10 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace keyring_pass/__init__.py \
-      --replace 'pass_binary = "pass"' 'pass_binary = "${lib.getExe pass}"'
+      --replace-fail 'pass_binary = "pass"' 'pass_binary = "${lib.getExe pass}"'
  '';

-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];

  nativeCheckInputs = [
    keyring
--- a/pkgs/development/python-modules/keyrings-cryptfile/default.nix
+++ b/pkgs/development/python-modules/keyrings-cryptfile/default.nix
@@ -3,16 +3,18 @@
  argon2-cffi,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  keyring,
  pycryptodome,
  pytestCheckHook,
+  pytest-cov-stub,
  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "keyrings-cryptfile";
  version = "1.3.9";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.5";

@@ -22,12 +24,9 @@ buildPythonPackage rec {
    hash = "sha256-fCpFPKuZhUJrjCH3rVSlfkn/joGboY4INAvYgBrPAJE=";
  };

-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "-s --cov=keyrings/cryptfile" ""
-  '';
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    argon2-cffi
    keyring
    pycryptodome
@@ -35,7 +34,10 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "keyrings.cryptfile" ];

-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+  ];

  disabledTests = [
    # FileNotFoundError: [Errno 2] No such file or directory: '/build/...
--- a/pkgs/development/python-modules/kneed/default.nix
+++ b/pkgs/development/python-modules/kneed/default.nix
@@ -7,12 +7,13 @@
  scipy,
  matplotlib,
  pytestCheckHook,
+  pytest-cov-stub,
 }:

 buildPythonPackage rec {
  pname = "kneed";
  version = "0.8.5";
-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "arvkevi";
@@ -21,20 +22,16 @@ buildPythonPackage rec {
    sha256 = "sha256-oakP6NkdvTzMZcoXS6cKNsRo//K+CoPLlhvbQLGij00=";
  };

-  postPatch = ''
-    substituteInPlace pytest.ini \
-      --replace "--cov=kneed" ""
-  '';
+  build-system = [ hatchling ];

-  nativeBuildInputs = [ hatchling ];
-
-  propagatedBuildInputs = [
+  dependencies = [
    numpy
    scipy
  ];

  checkInputs = [
    pytestCheckHook
+    pytest-cov-stub
    matplotlib
  ];

--- a/pkgs/development/python-modules/lacuscore/default.nix
+++ b/pkgs/development/python-modules/lacuscore/default.nix
@@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "lacuscore";
-  version = "1.10.10";
+  version = "1.10.11";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "ail-project";
    repo = "LacusCore";
    rev = "refs/tags/v${version}";
-    hash = "sha256-FayFtkCV19fHlwsHIljVYEXJc8rxGZingfug3k2JCBM=";
+    hash = "sha256-WO0aAvSm0fE7AjgFxnLc5Sej0Ub7v8LruSgrwdFlUPE=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/libais/default.nix
+++ b/pkgs/development/python-modules/libais/default.nix
@@ -4,13 +4,14 @@
  fetchPypi,
  pytestCheckHook,
  pythonOlder,
+  setuptools,
  six,
 }:

 buildPythonPackage rec {
  pname = "libais";
  version = "0.17";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@@ -19,12 +20,9 @@ buildPythonPackage rec {
    hash = "sha256-6yrqIpjF6XaSfXSOTA0B4f3aLcHXkgA/3WBZBBNQ018=";
  };

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'pytest-runner'," ""
-  '';
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [ six ];
+  dependencies = [ six ];

  nativeCheckInputs = [ pytestCheckHook ];

--- a/pkgs/development/python-modules/libpurecool/default.nix
+++ b/pkgs/development/python-modules/libpurecool/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  netifaces,
  paho-mqtt,
  pycryptodome,
@@ -13,7 +14,7 @@
 buildPythonPackage rec {
  pname = "libpurecool";
  version = "0.6.4";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
@@ -24,10 +25,12 @@ buildPythonPackage rec {
  postPatch = ''
    rm libpurecool/zeroconf.py
    substituteInPlace libpurecool/dyson_pure_cool_link.py \
-      --replace "from .zeroconf import ServiceBrowser, Zeroconf" "from zeroconf import ServiceBrowser, Zeroconf"
+      --replace-fail "from .zeroconf import ServiceBrowser, Zeroconf" "from zeroconf import ServiceBrowser, Zeroconf"
  '';

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    netifaces
    paho-mqtt
    pycryptodome
--- a/pkgs/development/python-modules/license-expression/default.nix
+++ b/pkgs/development/python-modules/license-expression/default.nix
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "license-expression";
-  version = "30.3.0";
+  version = "30.3.1";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -19,14 +19,14 @@ buildPythonPackage rec {
    owner = "nexB";
    repo = "license-expression";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nHqfnetVyz4W2Q6onH0mU/4x9e/vD4rbl9DF4TYqWzs=";
+    hash = "sha256-+hINYDfUrNsCmXOIa4XO/ML1fJoB8/n6iQ4UGdw5ClE=";
  };

  dontConfigure = true;

-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];

-  propagatedBuildInputs = [ boolean-py ];
+  dependencies = [ boolean-py ];

  nativeCheckInputs = [ pytestCheckHook ];

--- a/pkgs/development/python-modules/limnoria/default.nix
+++ b/pkgs/development/python-modules/limnoria/default.nix
@@ -1,6 +1,7 @@
 {
  lib,
  buildPythonPackage,
+  setuptools,
  chardet,
  cryptography,
  feedparser,
@@ -17,7 +18,7 @@
 buildPythonPackage rec {
  pname = "limnoria";
  version = "2024.5.30";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.6";

@@ -26,7 +27,9 @@ buildPythonPackage rec {
    hash = "sha256-uKJMeC1dXhQp1CGbtdnqmELFO64VWblhABGfpKHGCZQ=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    chardet
    cryptography
    feedparser
@@ -40,7 +43,7 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace setup.py \
-      --replace "version=version" 'version="${version}"'
+      --replace-fail "version=version" 'version="${version}"'
  '';

  checkPhase = ''
--- a/pkgs/development/python-modules/markdown-macros/default.nix
+++ b/pkgs/development/python-modules/markdown-macros/default.nix
@@ -3,13 +3,14 @@
  buildPythonPackage,
  fetchPypi,
  fetchpatch,
+  setuptools,
  markdown,
 }:

 buildPythonPackage rec {
  pname = "markdown-macros";
  version = "0.1.2";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
@@ -27,10 +28,12 @@ buildPythonPackage rec {
  ];

  prePatch = ''
-    substituteInPlace setup.py --replace "distribute" "setuptools"
+    substituteInPlace setup.py --replace-fail "distribute" "setuptools"
  '';

-  propagatedBuildInputs = [ markdown ];
+  build-system = [ setuptools ];
+
+  dependencies = [ markdown ];

  doCheck = false;

--- a/pkgs/development/python-modules/marshmallow-polyfield/default.nix
+++ b/pkgs/development/python-modules/marshmallow-polyfield/default.nix
@@ -5,6 +5,7 @@
  marshmallow,
  pythonOlder,
  pytestCheckHook,
+  pytest-cov-stub,
  setuptools,
 }:

@@ -22,16 +23,14 @@ buildPythonPackage rec {
    hash = "sha256-jbpeyih2Ccw1Rk+QcXRO9AfN5B/DhZmxa/M6FzXHqqs=";
  };

-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--cov=marshmallow_polyfield" ""
-  '';
+  build-system = [ setuptools ];

-  nativeBuildInputs = [ setuptools ];
+  dependencies = [ marshmallow ];

-  propagatedBuildInputs = [ marshmallow ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+  ];

  pythonImportsCheck = [ "marshmallow" ];

--- a/pkgs/development/python-modules/matplotlib-sixel/default.nix
+++ b/pkgs/development/python-modules/matplotlib-sixel/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  imagemagick,
  matplotlib,
 }:
@@ -9,18 +10,20 @@
 buildPythonPackage rec {
  pname = "matplotlib-sixel";
  version = "0.0.2";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
    hash = "sha256-JXOb1/IacJV8bhDvF+OPs2Yg1tgRDOqwiAQfiSKTlew=";
  };

-  propagatedBuildInputs = [ matplotlib ];
+  build-system = [ setuptools ];
+
+  dependencies = [ matplotlib ];

  postPatch = ''
    substituteInPlace sixel/sixel.py \
-      --replace 'Popen(["convert",' 'Popen(["${imagemagick}/bin/convert",'
+      --replace-fail 'Popen(["convert",' 'Popen(["${imagemagick}/bin/convert",'
  '';

  pythonImportsCheck = [ "sixel" ];
--- a/pkgs/development/python-modules/mayim/default.nix
+++ b/pkgs/development/python-modules/mayim/default.nix
@@ -11,6 +11,7 @@

  # test
  pytest-asyncio,
+  pytest-cov-stub,

  pytestCheckHook,
 }:
@@ -27,16 +28,11 @@ buildPythonPackage rec {
    hash = "sha256-nb0E9kMEJUihaCp8RnqGh0nSyDQo50eL1C4K5lBPlPQ=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
    wheel
  ];

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "--cov=src --cov-append --cov-report term-missing" ""
-  '';
-
  passthru.optional-dependencies = {
    postgres = [ psycopg ] ++ psycopg.optional-dependencies.pool;
    mysql = [ asyncmy ];
@@ -47,6 +43,7 @@ buildPythonPackage rec {
    [
      pytestCheckHook
      pytest-asyncio
+      pytest-cov-stub
    ]
    ++ (with passthru.optional-dependencies; [
      postgres
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -2,6 +2,7 @@
  lib,
  bleak,
  buildPythonPackage,
+  dash-bootstrap-components,
  dotmap,
  fetchFromGitHub,
  hypothesis,
@@ -9,6 +10,7 @@
  parse,
  pexpect,
  platformdirs,
+  poetry-core,
  ppk2-api,
  print-color,
  protobuf,
@@ -22,6 +24,7 @@
  pythonOlder,
  pyyaml,
  requests,
+  riden,
  setuptools,
  tabulate,
  timeago,
@@ -30,7 +33,7 @@

 buildPythonPackage rec {
  pname = "meshtastic";
-  version = "2.3.11";
+  version = "2.3.15";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -39,12 +42,15 @@ buildPythonPackage rec {
    owner = "meshtastic";
    repo = "Meshtastic-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-s56apVx7+EXkdw3FUjyGKGFjP+IVbO0/VDB4urXEtXQ=";
+    hash = "sha256-mirEsGeEQuWtaJ+eCROV1g9Bm0mRvCeTKkxPQqCuwe4=";
  };

-  pythonRelaxDeps = [ "protobuf" ];
+  pythonRelaxDeps = [
+    "bleak"
+    "protobuf"
+  ];

-  build-system = [ setuptools ];
+  build-system = [ poetry-core ];

  dependencies = [
    bleak
@@ -74,8 +80,10 @@ buildPythonPackage rec {
  };

  nativeCheckInputs = [
+    dash-bootstrap-components
    hypothesis
    pytestCheckHook
+    riden
  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);

  preCheck = ''
@@ -84,6 +92,11 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "meshtastic" ];

+  disabledTestPaths = [
+    # Circular import with dash-bootstrap-components
+    "meshtastic/tests/test_analysis.py"
+  ];
+
  disabledTests = [
    # TypeError
    "test_main_info_with_seriallog_output_txt"
--- a/pkgs/development/python-modules/mesonpep517/default.nix
+++ b/pkgs/development/python-modules/mesonpep517/default.nix
@@ -14,7 +14,7 @@
 buildPythonPackage rec {
  pname = "mesonpep517";
  version = "0.2";
-  format = "pyproject";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
@@ -26,15 +26,15 @@ buildPythonPackage rec {
  #
  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace 'backend-path = "."' 'backend-path = ["."]'
+      --replace-fail 'backend-path = "."' 'backend-path = ["."]'
  '';

-  nativeBuildInputs = [
+  build-system = [
    setuptools
    wheel
  ];

-  propagatedBuildInputs = [ toml ];
+  dependencies = [ toml ];

  propagatedNativeBuildInputs = [
    meson
--- a/pkgs/development/python-modules/mkdocs-jupyter/default.nix
+++ b/pkgs/development/python-modules/mkdocs-jupyter/default.nix
@@ -10,13 +10,14 @@
  nbconvert,
  pygments,
  pytestCheckHook,
+  pytest-cov-stub,
  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "mkdocs-jupyter";
  version = "0.24.8";
-  format = "pyproject";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@@ -26,19 +27,11 @@ buildPythonPackage rec {
    hash = "sha256-Cadi9ITVQNnA6UTTSyjLU2oyhp4iS0YOL8eRsUP3aUA=";
  };

-  postPatch = ''
-    sed -i "/--cov/d" pyproject.toml
-    substituteInPlace src/mkdocs_jupyter/tests/test_base_usage.py \
-      --replace "[\"mkdocs\"," "[\"${mkdocs.out}/bin/mkdocs\","
-  '';
-
  pythonRelaxDeps = [ "nbconvert" ];

-  nativeBuildInputs = [
-    hatchling
-  ];
+  build-system = [ hatchling ];

-  propagatedBuildInputs = [
+  dependencies = [
    ipykernel
    jupytext
    mkdocs
@@ -47,7 +40,10 @@ buildPythonPackage rec {
    pygments
  ];

-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+  ];

  pythonImportsCheck = [ "mkdocs_jupyter" ];

--- a/pkgs/development/python-modules/mlrose/default.nix
+++ b/pkgs/development/python-modules/mlrose/default.nix
@@ -4,6 +4,7 @@
  buildPythonPackage,
  fetchFromGitHub,
  fetchpatch,
+  setuptools,
  scikit-learn,
  pytestCheckHook,
  pytest-randomly,
@@ -12,7 +13,7 @@
 buildPythonPackage rec {
  pname = "mlrose";
  version = "1.3.0";
-  format = "setuptools";
+  pyproject = true;
  disabled = isPy27;

  src = fetchFromGitHub {
@@ -30,14 +31,15 @@ buildPythonPackage rec {
    })
  ];

-  propagatedBuildInputs = [ scikit-learn ];
+  build-system = [ setuptools ];
+  dependencies = [ scikit-learn ];
  nativeCheckInputs = [
    pytest-randomly
    pytestCheckHook
  ];

  postPatch = ''
-    substituteInPlace setup.py --replace sklearn scikit-learn
+    substituteInPlace setup.py --replace-fail sklearn scikit-learn
  '';

  pythonImportsCheck = [ "mlrose" ];
--- a/pkgs/development/python-modules/model-bakery/default.nix
+++ b/pkgs/development/python-modules/model-bakery/default.nix
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "model-bakery";
-  version = "1.19.1";
+  version = "1.19.2";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "model-bakers";
    repo = "model_bakery";
    rev = "refs/tags/${version}";
-    hash = "sha256-OSLRFuBG4GamSOpZvkPvoBanmRdDM8lCTNOwwZVjyEQ=";
+    hash = "sha256-Y1cv4AykDUkO5z1ejKuBphPGijnjpbgGcmwGBxeebcY=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/monai-deploy/default.nix
+++ b/pkgs/development/python-modules/monai-deploy/default.nix
@@ -31,15 +31,15 @@ buildPythonPackage rec {
    # Asked in https://github.com/Project-MONAI/monai-deploy-app-sdk/issues/450
    # if this patch can be incorporated upstream.
    substituteInPlace pyproject.toml \
-      --replace 'versioneer-518' 'versioneer'
+      --replace-fail 'versioneer-518' 'versioneer'
  '';

-  nativeBuildInputs = [
+  build-system = [
    versioneer
    setuptools
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    numpy
    networkx
    colorama
--- a/pkgs/development/python-modules/nameko/default.nix
+++ b/pkgs/development/python-modules/nameko/default.nix
@@ -32,12 +32,12 @@ buildPythonPackage rec {
  };

  postPatch = ''
-    substituteInPlace setup.py --replace "path.py" "path"
+    substituteInPlace setup.py --replace-fail "path.py" "path"
  '';

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    dnspython
    eventlet
    kombu
--- a/pkgs/development/python-modules/nessclient/default.nix
+++ b/pkgs/development/python-modules/nessclient/default.nix
@@ -4,30 +4,38 @@
  click,
  fetchFromGitHub,
  justbackoff,
+  pyserial-asyncio,
  pythonOlder,
  pytest-asyncio,
  pytestCheckHook,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "nessclient";
-  version = "1.0.0";
-  format = "setuptools";
+  version = "1.1.2";
+  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "nickw444";
-    repo = pname;
+    repo = "nessclient";
    rev = "refs/tags/${version}";
-    hash = "sha256-UqHXKfS4zF1YhFbNKSVESmsxD0CYJKOmjMOE3blGdI8=";
+    hash = "sha256-STDEIY7D02MlH+R6uLAKl6ghSQjhG1OEQWj71DrZP30=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    justbackoff
-    click
+    pyserial-asyncio
  ];

+  optional-dependencies = {
+    cli = [ click ];
+  };
+
  nativeCheckInputs = [
    pytest-asyncio
    pytestCheckHook
@@ -37,10 +45,10 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Python implementation/abstraction of the Ness D8x/D16x Serial Interface ASCII protocol";
-    mainProgram = "ness-cli";
    homepage = "https://github.com/nickw444/nessclient";
    changelog = "https://github.com/nickw444/nessclient/releases/tag/${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
+    mainProgram = "ness-cli";
  };
 }
--- a/pkgs/development/python-modules/niworkflows/default.nix
+++ b/pkgs/development/python-modules/niworkflows/default.nix
@@ -40,16 +40,14 @@ buildPythonPackage rec {
    hash = "sha256-29ZxLuKrvgCIOMMCUpi0HHhlNlgqUrUrSCiikwecmKw=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml --replace '"traits < 6.4"' '"traits"'
-  '';
+  pythonRelaxDeps = [ "traits" ];

-  nativeBuildInputs = [
+  build-system = [
    hatch-vcs
    hatchling
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    attrs
    importlib-resources
    jinja2
--- a/pkgs/development/python-modules/nix-kernel/default.nix
+++ b/pkgs/development/python-modules/nix-kernel/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  isPy3k,
  pexpect,
  notebook,
@@ -11,7 +12,7 @@
 buildPythonPackage rec {
  pname = "nix-kernel";
  version = "unstable-2020-04-26";
-  format = "setuptools";
+  pyproject = true;

  disabled = !isPy3k;

@@ -24,14 +25,16 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace nix-kernel/kernel.py \
-      --replace "'nix'" "'${nix}/bin/nix'" \
-      --replace "'nix repl'" "'${nix}/bin/nix repl'"
+      --replace-fail "'nix'" "'${nix}/bin/nix'" \
+      --replace-fail "'nix repl'" "'${nix}/bin/nix repl'"

    substituteInPlace setup.py \
-      --replace "cmdclass={'install': install_with_kernelspec}," ""
+      --replace-fail "cmdclass={'install': install_with_kernelspec}," ""
  '';

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    pexpect
    notebook
  ];
--- a/pkgs/development/python-modules/notus-scanner/default.nix
+++ b/pkgs/development/python-modules/notus-scanner/default.nix
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "notus-scanner";
-  version = "22.6.3";
+  version = "22.6.4";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = "notus-scanner";
    rev = "refs/tags/v${version}";
-    hash = "sha256-LYYof/s0OvXMbEH7jyFIymUVrWYUd/6lychIzfPlylc=";
+    hash = "sha256-DcFIypfdrz8pM7qAMVpof6xKWYp/bSRUswngxa5EQFk=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/packet-python/default.nix
+++ b/pkgs/development/python-modules/packet-python/default.nix
@@ -4,6 +4,7 @@
  fetchPypi,
  pytestCheckHook,
  pythonOlder,
+  setuptools,
  requests,
  requests-mock,
 }:
@@ -11,7 +12,7 @@
 buildPythonPackage rec {
  pname = "packet-python";
  version = "1.44.3";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@@ -22,10 +23,12 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace setup.py \
-      --replace "pytest-runner" ""
+      --replace-fail "pytest-runner" ""
  '';

-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];

  nativeCheckInputs = [
    pytestCheckHook
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@@ -5,12 +5,13 @@
  pythonOlder,
  setuptools,
  pytest,
+  pytest-cov-stub,
 }:

 buildPythonPackage rec {
  pname = "pglast";
  version = "6.2";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@@ -19,14 +20,14 @@ buildPythonPackage rec {
    hash = "sha256-mGP7o52Wun6AdE2jMAJBmLR10EmN50qzbMzB06BFXMg=";
  };

-  propagatedBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--cov=pglast --cov-report term-missing" ""
-  '';
+  dependencies = [ setuptools ];

-  nativeCheckInputs = [ pytest ];
+  nativeCheckInputs = [
+    pytest
+    pytest-cov-stub
+  ];

  # pytestCheckHook doesn't work
  # ImportError: cannot import name 'parse_sql' from 'pglast'
--- a/pkgs/development/python-modules/pika-pool/default.nix
+++ b/pkgs/development/python-modules/pika-pool/default.nix
@@ -2,27 +2,28 @@
  lib,
  buildPythonPackage,
  fetchPypi,
+  setuptools,
  pika,
 }:

 buildPythonPackage rec {
  pname = "pika-pool";
  version = "0.1.3";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
    sha256 = "f3985888cc2788cdbd293a68a8b5702a9c955db6f7b8b551aeac91e7f32da397";
  };

-  postPatch = ''
-    substituteInPlace setup.py --replace "pika >=0.9,<0.11" "pika"
-  '';
+  pythonRelaxDeps = [ "pika" ];
+
+  build-system = [ setuptools ];

  # Tests require database connections
  doCheck = false;

-  propagatedBuildInputs = [ pika ];
+  dependencies = [ pika ];
  meta = with lib; {
    homepage = "https://github.com/bninja/pika-pool";
    license = licenses.bsdOriginal;
--- a/pkgs/development/python-modules/playwrightcapture/default.nix
+++ b/pkgs/development/python-modules/playwrightcapture/default.nix
@@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "playwrightcapture";
-  version = "1.25.12";
+  version = "1.25.13";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
    owner = "Lookyloo";
    repo = "PlaywrightCapture";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nVRXTswisYm5Lbhb6brkUbl9okTkAcU+6WDe3Q+v6Cg=";
+    hash = "sha256-O482RKJejgg3eJe4M9U0ExuDFwFz9Fbpxvrn6re58h8=";
  };

  pythonRelaxDeps = [
--- a/Show More
+++ b/Show More