diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c8ea1cd54590..23b0e5213116 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -24515,6 +24515,12 @@
     github = "peterablehmann";
     githubId = 36541313;
   };
+  xiaoxiangmoe = {
+    name = "ZHAO JinXiang";
+    email = "xiaoxiangmoe@gmail.com";
+    github = "xiaoxiangmoe";
+    githubId = 8111351;
+  };
   xinyangli = {
     email = "lixinyang411@gmail.com";
     matrix = "@me:xinyang.life";
diff --git a/pkgs/applications/audio/tageditor/default.nix b/pkgs/applications/audio/tageditor/default.nix
index 8464918d746a..4c21e137aed1 100644
--- a/pkgs/applications/audio/tageditor/default.nix
+++ b/pkgs/applications/audio/tageditor/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tageditor";
-  version = "3.9.3";
+  version = "3.9.4";
 
   src = fetchFromGitHub {
     owner = "martchus";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KAtOnTf3foOILDfTjVpkCOG6jsyS5fv0/Wv9Zcut2oE=";
+    hash = "sha256-VRQV4bTPG4VFhRHFJamUnYd04ZCaNpaxU27Jcl6Chc4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index d3b8c866366a..b1259a842fee 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3246,8 +3246,8 @@ let
         mktplcRef = {
           name = "compare-folders";
           publisher = "moshfeu";
-          version = "0.24.3";
-          hash = "sha256-eaumF2BIqEYoyL7LQ0Wx3+gkkFGpWKQoN3AisI8wTQY=";
+          version = "0.25.1";
+          hash = "sha256-axNTdnSkMkFs7LSZCc7VinjbrDncsRHlRtDG9+eh2qQ=";
         };
 
         meta = {
@@ -5333,8 +5333,8 @@ let
         mktplcRef = {
           name = "vscode-icons";
           publisher = "vscode-icons-team";
-          version = "12.9.0";
-          hash = "sha256-ULjZlbGcVbPiokfnx7d4z7cmVVEfy2d+SUch80rZRA4=";
+          version = "12.10.0";
+          hash = "sha256-GNDLuszuJN3P0V25F4gm7yUJsFEQgFMMPMTFLWLIvSo=";
         };
         meta = {
           description = "Bring real icons to your Visual Studio Code";
diff --git a/pkgs/applications/networking/browsers/qutebrowser/default.nix b/pkgs/applications/networking/browsers/qutebrowser/default.nix
index f0f0800b2ae4..1de7936f7d7f 100644
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@@ -36,7 +36,7 @@ let
       stripRoot = false;
     };
 
-  version = "3.3.1";
+  version = "3.4.0";
 in
 
 python3.pkgs.buildPythonApplication {
@@ -46,7 +46,7 @@ python3.pkgs.buildPythonApplication {
 
   src = fetchurl {
     url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/qutebrowser-${version}.tar.gz";
-    hash = "sha256-qttkrMxzC8mhXONByaBYCx82OD7Uh09U0xzh2r6U4Xo=";
+    hash = "sha256-gUEkwO0zdDDmE6HaNm1eOJBMsgSa+xUFlxRWylymIj4=";
   };
 
   # Needs tox
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix
index a3ad03a49344..024e3b067a85 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "helm-dt";
-  version = "0.4.1";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "vmware-labs";
     repo = "distribution-tooling-for-helm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KrQAlB0ORNzKIG2vxych3gVBytTh3Hhnjsyn1ia1ZQM=";
+    hash = "sha256-m+XTR+LYTXeDTqo/deFAIQjbUqGn6yD/n5cQvJ+jKPc=";
   };
 
-  vendorHash = "sha256-T8Kk+9NAhYOvSq94HOEE53BT7Xh9tU1gJ420o/tiVEo=";
+  vendorHash = "sha256-rovAY4G4ew6JhehyXMz7cDKSEsHu0IQwaNYvClDog2s=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/system/coolercontrol/coolercontrol-gui.nix b/pkgs/applications/system/coolercontrol/coolercontrol-gui.nix
index f6f9c95c0e95..1f1fec06f319 100644
--- a/pkgs/applications/system/coolercontrol/coolercontrol-gui.nix
+++ b/pkgs/applications/system/coolercontrol/coolercontrol-gui.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage {
   inherit version src;
   sourceRoot = "${src.name}/coolercontrol-ui/src-tauri";
 
-  cargoHash = "sha256-nS67ABuI2/C08X+TWWoOx7bptIPF1fsvBC1Ucoky1/4=";
+  cargoHash = "sha256-gjR54dZjVonyznfBGb3iNNdmPalE+a53MmkOEZj3+sY=";
 
   buildFeatures = [ "custom-protocol" ];
 
diff --git a/pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix b/pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix
index 6906769b44ad..19475bc7572e 100644
--- a/pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix
+++ b/pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix
@@ -11,7 +11,7 @@ buildNpmPackage {
   inherit version src;
   sourceRoot = "${src.name}/coolercontrol-ui";
 
-  npmDepsHash = "sha256-j+bGOGIG9H/1z0dN8BfvWSi6gPvYmCV7l0ZNH8h3yeU=";
+  npmDepsHash = "sha256-t+QShKaXpQuEzeeu/ljBBEzeYsxqvMpx5waDZ2gyPAI=";
 
   preBuild = ''
     autoPatchelf node_modules/sass-embedded-linux-x64/dart-sass/src/dart
diff --git a/pkgs/applications/system/coolercontrol/coolercontrold.nix b/pkgs/applications/system/coolercontrol/coolercontrold.nix
index 76c42cf30039..ee9af95a0ddf 100644
--- a/pkgs/applications/system/coolercontrol/coolercontrold.nix
+++ b/pkgs/applications/system/coolercontrol/coolercontrold.nix
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage {
   sourceRoot = "${src.name}/coolercontrold";
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ZAjaegUgNkKygXqskyeUkWpcqi1Jt7pE8GtqWlaP6/I=";
+  cargoHash = "sha256-5gqtSZs/unFobEl1MHec2uhGDrWnO6ITlYbB78VasZg=";
 
   buildInputs = [ libdrm ];
 
diff --git a/pkgs/applications/system/coolercontrol/default.nix b/pkgs/applications/system/coolercontrol/default.nix
index 89cb7f0e9c37..066be7abb8ff 100644
--- a/pkgs/applications/system/coolercontrol/default.nix
+++ b/pkgs/applications/system/coolercontrol/default.nix
@@ -5,13 +5,13 @@
 }:
 
 let
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitLab {
     owner = "coolercontrol";
     repo = "coolercontrol";
     rev = version;
-    hash = "sha256-9l10X4uDv3KJz582QQMhqh38bwDtQVHm9HdAVNC6Kfg=";
+    hash = "sha256-lRw5IcSrLM6aUajt2Ny1IUuGYcAjY1oUDZENyz0wVJI=";
   };
 
   meta = {
diff --git a/pkgs/by-name/af/affine-bin/package.nix b/pkgs/by-name/af/affine-bin/package.nix
new file mode 100644
index 000000000000..b576208ee505
--- /dev/null
+++ b/pkgs/by-name/af/affine-bin/package.nix
@@ -0,0 +1,144 @@
+{
+  copyDesktopItems,
+  electron,
+  fetchFromGitHub,
+  fetchurl,
+  lib,
+  makeDesktopItem,
+  makeWrapper,
+  stdenvNoCC,
+  unzip,
+  buildType ? "stable",
+  commandLineArgs ? "",
+}:
+let
+  hostPlatform = stdenvNoCC.hostPlatform;
+  nodePlatform = hostPlatform.parsed.kernel.name; # nodejs's `process.platform`
+  nodeArch = # nodejs's `process.arch`
+    {
+      "x86_64" = "x64";
+      "aarch64" = "arm64";
+    }
+    .${hostPlatform.parsed.cpu.name}
+      or (throw "affine-bin(${buildType}): unsupported CPU family ${hostPlatform.parsed.cpu.name}");
+in
+stdenvNoCC.mkDerivation (
+  finalAttrs:
+  (
+    {
+      # https://github.com/toeverything/AFFiNE/releases/tag/v0.18.1
+      version = "0.18.1";
+      githubSourceCode = fetchFromGitHub {
+        owner = "toeverything";
+        repo = "AFFiNE";
+        rev = "8b066a4b398aace25a20508a8e3c1a381721971f";
+        hash = "sha256-TWwojG3lqQlQFX3BKoFjJ27a3T/SawXgNDO6fP6gW4k=";
+      };
+      productName = if buildType == "stable" then "AFFiNE" else "AFFiNE-" + buildType;
+      binName = lib.toLower finalAttrs.productName;
+      pname = "${finalAttrs.binName}-bin";
+      meta =
+        {
+          description = "Workspace with fully merged docs, whiteboards and databases";
+          longDescription = ''
+            AFFiNE is an open-source, all-in-one workspace and an operating
+            system for all the building blocks that assemble your knowledge
+            base and much more -- wiki, knowledge management, presentation
+            and digital assets
+          '';
+          homepage = "https://affine.pro/";
+          license = lib.licenses.mit;
+          maintainers = with lib.maintainers; [
+            richar
+            redyf
+            xiaoxiangmoe
+          ];
+          platforms = [
+            "aarch64-darwin"
+            "x86_64-darwin"
+            "x86_64-linux"
+          ];
+          sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+        }
+        // lib.optionalAttrs hostPlatform.isLinux {
+          mainProgram = finalAttrs.binName;
+        };
+
+      src = (
+        let
+          inherit (finalAttrs) version;
+          affinePrebuiltBinariesHashes = {
+            darwin-arm64 = "I8lOO97MNLkha0utWPAP4EKv9HiPMWpLi2ibvXjzjhdl7abgSPmMKbv1dGHxMzgMzGbDzhzKqzhYtJI+0Asfzw==";
+            darwin-x64 = "LZdd7yHJx9Hx0Po8NQgeDp0BhIyXGr0QsbF6bWP5pS08c4fdtE9UzNPfJGfzz/snTkWfKMQZop0Ea4fYGosr1Q==";
+            linux-x64 = "+impaFLuvcfpj4QjHwjZ06+fUpsxxRlk4eWO6+E4xkBMrV43gwZGeSeAw2pMgXogRGb/Oy6XUoA7o8tTQt9J6A==";
+          };
+          platform = if hostPlatform.isLinux then "linux" else "macos";
+        in
+        fetchurl {
+          # example: https://github.com/toeverything/AFFiNE/releases/download/v0.18.1/affine-0.18.1-stable-darwin-arm64.zip
+          url = "https://github.com/toeverything/AFFiNE/releases/download/v${version}/affine-${version}-${buildType}-${platform}-${nodeArch}.zip";
+          sha512 = affinePrebuiltBinariesHashes."${nodePlatform}-${nodeArch}";
+        }
+      );
+
+      nativeBuildInputs =
+        [
+          unzip
+        ]
+        ++ lib.optionals hostPlatform.isLinux [
+          copyDesktopItems
+          makeWrapper
+        ];
+
+      installPhase =
+        let
+          inherit (finalAttrs) binName productName;
+        in
+        if hostPlatform.isDarwin then
+          ''
+            runHook preInstall
+
+            mkdir -p $out/Applications
+            cd ..
+            mv ${productName}.app $out/Applications
+
+            runHook postInstall
+          ''
+        else
+          ''
+            runHook preInstall
+
+            mkdir --parents $out/lib/${binName}/
+            mv ./{resources,LICENSE*} $out/lib/${binName}/
+            install -Dm644 "${finalAttrs.githubSourceCode}/packages/frontend/apps/electron/resources/icons/icon_${buildType}_64x64.png" $out/share/icons/hicolor/64x64/apps/${binName}.png
+
+            makeWrapper "${electron}/bin/electron" $out/bin/${binName} \
+              --inherit-argv0 \
+              --add-flags $out/lib/${binName}/resources/app.asar \
+              --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+              --add-flags ${lib.escapeShellArg commandLineArgs}
+
+            runHook postInstall
+          '';
+    }
+    // lib.optionalAttrs hostPlatform.isLinux {
+      desktopItems =
+        let
+          inherit (finalAttrs) binName productName;
+        in
+        [
+          (makeDesktopItem {
+            name = binName;
+            desktopName = productName;
+            comment = "AFFiNE Desktop App";
+            exec = "${binName} %U";
+            terminal = false;
+            icon = binName;
+            startupWMClass = binName;
+            categories = [ "Utility" ];
+            mimeTypes = [ "x-scheme-handler/${binName}" ];
+          })
+        ];
+    }
+  )
+)
diff --git a/pkgs/by-name/af/affine/package.nix b/pkgs/by-name/af/affine/package.nix
index f66da1181d10..1fb002189e08 100644
--- a/pkgs/by-name/af/affine/package.nix
+++ b/pkgs/by-name/af/affine/package.nix
@@ -1,75 +1,244 @@
 {
-  lib,
-  fetchurl,
-  stdenvNoCC,
+  cacert,
+  cargo,
   copyDesktopItems,
+  electron_33,
+  fetchFromGitHub,
+  fetchurl,
+  findutils,
+  jq,
+  lib,
   makeDesktopItem,
   makeWrapper,
-  unzip,
-  electron,
+  nodejs_20,
+  rsync,
+  rustPlatform,
+  rustc,
+  stdenv,
+  stdenvNoCC,
+  yarn,
+  zip,
+  buildType ? "stable",
   commandLineArgs ? "",
 }:
-
-stdenvNoCC.mkDerivation (
+let
+  hostPlatform = stdenvNoCC.hostPlatform;
+  nodePlatform = hostPlatform.parsed.kernel.name; # nodejs's `process.platform`
+  nodeArch = # nodejs's `process.arch`
+    {
+      "x86_64" = "x64";
+      "aarch64" = "arm64";
+    }
+    .${hostPlatform.parsed.cpu.name}
+      or (throw "affine(${buildType}): unsupported CPU family ${hostPlatform.parsed.cpu.name}");
+  electron = electron_33;
+in
+stdenv.mkDerivation (
   finalAttrs:
-  let
-    icon = fetchurl {
-      url = "https://raw.githubusercontent.com/toeverything/AFFiNE/v${finalAttrs.version}/packages/frontend/core/public/favicon-192.png";
-      hash = "sha256-smZ5W7fy3TK3bvjwV4i71j2lVmKSZcyhMhcWfPxNnN4=";
-    };
-  in
-  {
-    pname = "affine";
-    version = "0.17.5";
-    src = fetchurl {
-      url = "https://github.com/toeverything/AFFiNE/releases/download/v${finalAttrs.version}/affine-${finalAttrs.version}-stable-linux-x64.zip";
-      hash = "sha256-lK5DDI9CKRneY4AwMI4r1qlGyYtQG4Xi8Ys4I3jawTk=";
-    };
-    nativeBuildInputs = [
-      copyDesktopItems
-      makeWrapper
-      unzip
-    ];
-    postInstall = ''
-      mkdir -p $out/lib
-      cp -r ./resources/* -t $out/lib/
-      mkdir -p $out/share/doc/affine/
-      cp LICENSE* $out/share/doc/affine/
-      install -Dm644 ${icon} $out/share/pixmaps/affine.png
-      makeWrapper "${electron}/bin/electron" $out/bin/affine \
-        --inherit-argv0 \
-        --add-flags $out/lib/app.asar \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-        --add-flags ${lib.escapeShellArg commandLineArgs}
-    '';
-    desktopItems = [
-      (makeDesktopItem {
-        name = "affine";
-        desktopName = "AFFiNE";
-        exec = "affine %U";
-        terminal = false;
-        icon = "affine";
-        startupWMClass = "affine";
-        categories = [ "Utility" ];
-      })
-    ];
-    meta = {
-      description = "Workspace with fully merged docs, whiteboards and databases";
-      longDescription = ''
-        AFFiNE is an open-source, all-in-one workspace and an operating
-        system for all the building blocks that assemble your knowledge
-        base and much more -- wiki, knowledge management, presentation
-        and digital assets
+  (
+    {
+      productName = if buildType == "stable" then "AFFiNE" else "AFFiNE-" + buildType;
+      binName = lib.toLower finalAttrs.productName;
+      pname = finalAttrs.binName;
+
+      # https://github.com/toeverything/AFFiNE/releases/tag/v0.18.1
+      version = "0.18.1";
+      GITHUB_SHA = "8b066a4b398aace25a20508a8e3c1a381721971f";
+      src = fetchFromGitHub {
+        owner = "toeverything";
+        repo = "AFFiNE";
+        rev = finalAttrs.GITHUB_SHA;
+        hash = "sha256-TWwojG3lqQlQFX3BKoFjJ27a3T/SawXgNDO6fP6gW4k=";
+      };
+
+      meta =
+        {
+          description = "Workspace with fully merged docs, whiteboards and databases";
+          longDescription = ''
+            AFFiNE is an open-source, all-in-one workspace and an operating
+            system for all the building blocks that assemble your knowledge
+            base and much more -- wiki, knowledge management, presentation
+            and digital assets
+          '';
+          homepage = "https://affine.pro/";
+          license = lib.licenses.mit;
+          maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+          platforms = [
+            "aarch64-darwin"
+            "aarch64-linux"
+            "x86_64-darwin"
+            "x86_64-linux"
+          ];
+          sourceProvenance = [ lib.sourceTypes.fromSource ];
+        }
+        // lib.optionalAttrs hostPlatform.isLinux {
+          mainProgram = finalAttrs.binName;
+        };
+
+      env = {
+        BUILD_TYPE = buildType;
+      };
+      cargoDeps = rustPlatform.fetchCargoVendor {
+        src = finalAttrs.src;
+        hash = "sha256-5s/X9CD/H9rSn7SqMHioLg1KRP7y9fsozdFRY3hNiP8=";
+      };
+      yarnOfflineCache = stdenvNoCC.mkDerivation {
+        name = "yarn-offline-cache";
+        src = finalAttrs.src;
+        nativeBuildInputs = [
+          yarn
+          cacert
+        ];
+        supportedArchitectures = builtins.toJSON {
+          os = [
+            "darwin"
+            "linux"
+          ];
+          cpu = [
+            "arm64"
+            "x64"
+          ];
+          libc = [
+            "glibc"
+            "musl"
+          ];
+        };
+        buildPhase = ''
+          export HOME="$NIX_BUILD_TOP"
+          export CI=1
+
+          mkdir -p $out
+          yarn config set enableTelemetry false
+          yarn config set cacheFolder $out
+          yarn config set enableGlobalCache false
+          yarn config set supportedArchitectures --json "$supportedArchitectures"
+
+          yarn install --immutable --mode=skip-build
+        '';
+        dontInstall = true;
+        outputHashMode = "recursive";
+        outputHash = "sha256-HueTia+1ApfvbBK/b+iE84TB1DCWIDLoQ9XhjYlGCUs=";
+      };
+      nativeBuildInputs =
+        [
+          nodejs_20
+          yarn
+          cargo
+          rustc
+          findutils
+          zip
+          jq
+          rsync
+        ]
+        ++ lib.optionals hostPlatform.isLinux [
+          copyDesktopItems
+          makeWrapper
+        ];
+
+      patchPhase = ''
+        runHook prePatchPhase
+
+        sed -i '/packagerConfig/a \    electronZipDir: process.env.ELECTRON_FORGE_ELECTRON_ZIP_DIR,' packages/frontend/apps/electron/forge.config.mjs
+
+        runHook postPatchPhase
       '';
-      homepage = "https://affine.pro/";
-      downloadPage = "https://affine.pro/download";
-      license = lib.licenses.mit;
-      maintainers = with lib.maintainers; [
-        richar
-        redyf
-      ];
-      mainProgram = "affine";
-      platforms = [ "x86_64-linux" ];
-    };
-  }
+
+      configurePhase =
+        let
+          electronContentPath =
+            electron + (if hostPlatform.isLinux then "/libexec/electron/" else "/Applications/");
+        in
+        ''
+          runHook preConfigurePhase
+
+          export HOME="$NIX_BUILD_TOP"
+          export CI=1
+
+          # cargo config
+          mkdir -p .cargo
+          cat $cargoDeps/.cargo/config.toml >> .cargo/config.toml
+          ln -s $cargoDeps @vendor@
+
+          # yarn config
+          yarn config set enableTelemetry false
+          yarn config set enableGlobalCache false
+          yarn config set cacheFolder $yarnOfflineCache
+
+          # electron config
+          ELECTRON_VERSION_IN_LOCKFILE=$(yarn why electron --json | tail --lines 1 | jq --raw-output '.children | to_entries | first | .key ' | cut -d : -f 2)
+          rsync --archive --chmod=u+w ${electronContentPath} $HOME/.electron-prebuilt-zip-tmp
+          export ELECTRON_FORGE_ELECTRON_ZIP_DIR=$PWD/.electron_zip_dir
+          mkdir -p $ELECTRON_FORGE_ELECTRON_ZIP_DIR
+          (cd $HOME/.electron-prebuilt-zip-tmp && zip --recurse-paths - .) > $ELECTRON_FORGE_ELECTRON_ZIP_DIR/electron-v$ELECTRON_VERSION_IN_LOCKFILE-${nodePlatform}-${nodeArch}.zip
+          export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+
+          runHook postConfigurePhase
+        '';
+      buildPhase = ''
+        runHook preBuild
+
+        # first build
+        yarn workspaces focus @affine/electron @affine/monorepo
+        CARGO_NET_OFFLINE=true yarn workspace @affine/native build
+        BUILD_TYPE=${buildType} SKIP_NX_CACHE=1 yarn workspace @affine/electron generate-assets
+
+        # second build
+        yarn config set nmMode classic
+        yarn config set nmHoistingLimits workspaces
+        find . -name 'node_modules' -type d -prune -exec rm -rf '{}' +
+        yarn workspaces focus @affine/electron @affine/monorepo
+        BUILD_TYPE=${buildType} SKIP_WEB_BUILD=1 SKIP_BUNDLE=1 HOIST_NODE_MODULES=1 yarn workspace @affine/electron make
+
+        runHook postBuild
+      '';
+      installPhase =
+        let
+          inherit (finalAttrs) binName productName;
+        in
+        if hostPlatform.isDarwin then
+          ''
+            runHook preInstall
+
+            mkdir -p $out/Applications
+            mv packages/frontend/apps/electron/out/${buildType}/${productName}-darwin-${nodeArch}/${productName}.app $out/Applications
+
+            runHook postInstall
+          ''
+        else
+          ''
+            runHook preInstall
+
+            mkdir --parents $out/lib/${binName}/
+            mv packages/frontend/apps/electron/out/${buildType}/${productName}-linux-${nodeArch}/{resources,LICENSE*} $out/lib/${binName}/
+            install -Dm644 packages/frontend/apps/electron/resources/icons/icon_${buildType}_64x64.png $out/share/icons/hicolor/64x64/apps/${binName}.png
+
+            makeWrapper "${electron}/bin/electron" $out/bin/${binName} \
+              --inherit-argv0 \
+              --add-flags $out/lib/${binName}/resources/app.asar \
+              --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+              --add-flags ${lib.escapeShellArg commandLineArgs}
+
+            runHook postInstall
+          '';
+    }
+    // (lib.optionalAttrs hostPlatform.isLinux {
+      desktopItems =
+        let
+          inherit (finalAttrs) binName productName;
+        in
+        [
+          (makeDesktopItem {
+            name = binName;
+            desktopName = productName;
+            comment = "AFFiNE Desktop App";
+            exec = "${binName} %U";
+            terminal = false;
+            icon = binName;
+            startupWMClass = binName;
+            categories = [ "Utility" ];
+            mimeTypes = [ "x-scheme-handler/${binName}" ];
+          })
+        ];
+    })
+  )
 )
diff --git a/pkgs/by-name/ar/arcticons-sans/package.nix b/pkgs/by-name/ar/arcticons-sans/package.nix
index cb16a684ba29..5905d8bfa784 100644
--- a/pkgs/by-name/ar/arcticons-sans/package.nix
+++ b/pkgs/by-name/ar/arcticons-sans/package.nix
@@ -6,10 +6,10 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arcticons-sans";
-  version = "0.590";
+  version = "0.591";
 
   src = fetchzip {
-    hash = "sha256-0iSkTfUMgrKi6LF+9KAihPus0biGuOFsYN51ydYAF5E=";
+    hash = "sha256-fMsAvrH4NVdXoywW66fJhNWDDY5JxDxPJgvaUD9lEpw=";
     url = "https://github.com/arcticons-team/arcticons-font/archive/refs/tags/${finalAttrs.version}.zip";
   };
 
diff --git a/pkgs/by-name/au/autosubst2/imports.patch b/pkgs/by-name/au/autosubst2/imports.patch
new file mode 100644
index 000000000000..a9e1d766cc7e
--- /dev/null
+++ b/pkgs/by-name/au/autosubst2/imports.patch
@@ -0,0 +1,72 @@
+diff --git a/Src/Autosubst/GenAutomation.hs b/Src/Autosubst/GenAutomation.hs
+index f1c205c..6f48895 100755
+--- a/Src/Autosubst/GenAutomation.hs
++++ b/Src/Autosubst/GenAutomation.hs
+@@ -7,6 +7,7 @@ import           Autosubst.Names
+ import           Autosubst.Syntax
+ import           Autosubst.Tactics
+ import           Autosubst.Types
++import           Control.Monad
+ import           Control.Monad.Except
+ import           Control.Monad.Reader
+ import           Control.Monad.State.Lazy
+diff --git a/Src/Autosubst/GenCode.hs b/Src/Autosubst/GenCode.hs
+index 9145915..d4b7569 100755
+--- a/Src/Autosubst/GenCode.hs
++++ b/Src/Autosubst/GenCode.hs
+@@ -5,6 +5,7 @@ module Autosubst.GenCode (generateCode) where
+ import           Autosubst.Generator
+ import           Autosubst.ModularGenerator
+ import           Autosubst.Types
++import           Control.Monad
+ import           Control.Monad.Except
+ import           Control.Monad.Reader
+ import           Control.Monad.RWS          hiding ((<>))
+diff --git a/Src/Autosubst/GenM.hs b/Src/Autosubst/GenM.hs
+index 59483c1..3a4a447 100755
+--- a/Src/Autosubst/GenM.hs
++++ b/Src/Autosubst/GenM.hs
+@@ -2,6 +2,7 @@
+ {-# LANGUAGE MultiParamTypeClasses #-}
+ module Autosubst.GenM where
+ 
++import           Control.Monad
+ import           Control.Monad.Except
+ import           Control.Monad.Reader
+ import           Control.Monad.RWS
+diff --git a/Src/Autosubst/Generator.hs b/Src/Autosubst/Generator.hs
+index 576db42..264b836 100755
+--- a/Src/Autosubst/Generator.hs
++++ b/Src/Autosubst/Generator.hs
+@@ -8,6 +8,7 @@ import           Autosubst.Names
+ import           Autosubst.Syntax
+ import           Autosubst.Tactics
+ import           Autosubst.Types
++import           Control.Monad
+ import           Control.Monad.Except
+ import           Control.Monad.Reader
+ import           Control.Monad.RWS          hiding ((<>))
+diff --git a/Src/Autosubst/ModularGenerator.hs b/Src/Autosubst/ModularGenerator.hs
+index 323c1b1..dae8346 100755
+--- a/Src/Autosubst/ModularGenerator.hs
++++ b/Src/Autosubst/ModularGenerator.hs
+@@ -7,6 +7,7 @@ import           Autosubst.Names
+ import           Autosubst.Syntax
+ import           Autosubst.Tactics
+ import           Autosubst.Types
++import           Control.Monad
+ import           Control.Monad.Except
+ import           Control.Monad.Reader
+ import           Control.Monad.State.Lazy
+diff --git a/Src/Autosubst/Tactics.hs b/Src/Autosubst/Tactics.hs
+index ef3545c..cdd38fb 100755
+--- a/Src/Autosubst/Tactics.hs
++++ b/Src/Autosubst/Tactics.hs
+@@ -2,6 +2,7 @@
+ {-# LANGUAGE MultiParamTypeClasses #-}
+ module Autosubst.Tactics where
+ 
++import           Control.Monad
+ import           Control.Monad.Except
+ import           Control.Monad.Reader
+ import           Control.Monad.RWS       hiding ((<>))
diff --git a/pkgs/by-name/au/autosubst2/package.nix b/pkgs/by-name/au/autosubst2/package.nix
new file mode 100644
index 000000000000..e1fb55fb6824
--- /dev/null
+++ b/pkgs/by-name/au/autosubst2/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  haskellPackages,
+  fetchFromGitHub,
+}:
+
+haskellPackages.mkDerivation {
+  pname = "autosubst2";
+  version = "0-unstable-2022-07-04";
+
+  src = fetchFromGitHub {
+    owner = "uds-psl";
+    repo = "autosubst2";
+    rev = "8a71e1dc4dea81f13a9572ea302064eb374566c6";
+    hash = "sha256-3n87NBi3NbuDb44/oEnzjNk/TAHUwATJYuaw70k/tpk=";
+  };
+  patches = [ ./imports.patch ];
+
+  isLibrary = true;
+  isExecutable = true;
+  libraryHaskellDepends = with haskellPackages; [
+    base
+    parsec
+    containers
+    mtl
+    array
+    wl-pprint
+    graphviz
+    text
+  ];
+  executableHaskellDepends = with haskellPackages; [
+    base
+    optparse-applicative
+    wl-pprint
+    directory
+  ];
+  testHaskellDepends = with haskellPackages; [
+    base
+    QuickCheck
+    containers
+  ];
+  doCheck = false;
+
+  homepage = "https://github.com/uds-psl/autosubst2";
+  description = "Tool for generating de Bruijn boilerplate Coq code to handle substitutions in languages with binders";
+  maintainers = with lib.maintainers; [ chen ];
+  license = lib.licenses.bsd3;
+  mainProgram = "as2-exe";
+}
diff --git a/pkgs/by-name/ba/bant/package.nix b/pkgs/by-name/ba/bant/package.nix
index 3ad49af6b1ad..daad4e7b0b2d 100644
--- a/pkgs/by-name/ba/bant/package.nix
+++ b/pkgs/by-name/ba/bant/package.nix
@@ -19,13 +19,13 @@ let
 in
 buildBazelPackage rec {
   pname = "bant";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "hzeller";
     repo = "bant";
     rev = "v${version}";
-    hash = "sha256-CMqh2v6Y/jvrDC2M4Q+pC0FkNJ95gbGTR1UC6zviwV4=";
+    hash = "sha256-TIVbf5qZNohZAFugi/E7m1Sgekn82/qqtx8jSHo75Js=";
   };
 
   bazelFlags = [
@@ -40,8 +40,8 @@ buildBazelPackage rec {
   fetchAttrs = {
     hash =
       {
-        aarch64-linux = "sha256-2QMg/Ko3HgqKhI2g4PZ+UWOujDACLZHxyec1zAm58yg=";
-        x86_64-linux = "sha256-SfQ6dlC+JVYXIpuvMNyQJkY6+zq8Md2+LsiRstJWMdY=";
+        aarch64-linux = "sha256-8pLgn67kwVNdqhUXYsdi7OsArCZZmW55UPzUBlIyBbk=";
+        x86_64-linux = "sha256-dUNdvSJA3SlIIRWmhaq3Hu0+84mBBhxbU/eBDXIv/iI=";
       }
       .${system} or (throw "No hash for system: ${system}");
   };
diff --git a/pkgs/by-name/be/beeper-bridge-manager/package.nix b/pkgs/by-name/be/beeper-bridge-manager/package.nix
index a45069a9a898..f1bbec78e3c8 100644
--- a/pkgs/by-name/be/beeper-bridge-manager/package.nix
+++ b/pkgs/by-name/be/beeper-bridge-manager/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "bbctl";
-  version = "0.12.2";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "beeper";
     repo = "bridge-manager";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Q8RgfkPw8KPkfORaPCwM18rNhzNm4UcH4hSdfYe4FZo=";
+    hash = "sha256-bNnansZNshWp70LQQsa6+bS+LJxpCzdTkL2pX+ksrP0=";
   };
 
-  vendorHash = "sha256-uz4pao8Y/Sb3fffi9d0lbWQEUMohbthA6t6k6PfQz2M=";
+  vendorHash = "sha256-yTNUxwnulQ+WbHdQbeNDghH4RPXurQMIgKDyXfrMxG8=";
 
   meta = {
     description = "Tool for running self-hosted bridges with the Beeper Matrix server.";
diff --git a/pkgs/by-name/bi/bio-gappa/package.nix b/pkgs/by-name/bi/bio-gappa/package.nix
new file mode 100644
index 000000000000..da1c70583844
--- /dev/null
+++ b/pkgs/by-name/bi/bio-gappa/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  autoconf,
+  pkg-config,
+  libz,
+  bzip2,
+  xz,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bio-gappa";
+  version = "0.8.4";
+
+  src = fetchFromGitHub {
+    owner = "lczech";
+    repo = "gappa";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-VAp9e5Cu3tTeWSOTZ8kPG1eOyocYZiJsy/s+MWbCMLI=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    autoconf
+  ];
+
+  buildInputs = [
+    libz
+    bzip2
+    xz
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    install -Dm755 ../bin/gappa $out/bin/gappa
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/lczech/gappa";
+    description = "Toolkit for analyzing and visualizing phylogenetic (placement) data";
+    longDescription = ''
+      gappa is a collection of commands for working with phylogenetic data. Its
+      main focus are evolutionary placements of short environmental sequences
+      on a reference phylogenetic tree. Such data are typically produced by
+      tools such as EPA-ng, RAxML-EPA or pplacer, and usually stored in jplace
+      files.
+    '';
+    platforms = platforms.all;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ bzizou ];
+    mainProgram = "gappa";
+  };
+})
diff --git a/pkgs/by-name/bo/boxes/package.nix b/pkgs/by-name/bo/boxes/package.nix
index fcbdaf627789..476eae96fe76 100644
--- a/pkgs/by-name/bo/boxes/package.nix
+++ b/pkgs/by-name/bo/boxes/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gccStdenv,
+  stdenv,
   fetchFromGitHub,
   bison,
   flex,
@@ -9,7 +9,7 @@
   ncurses,
 }:
 
-gccStdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "boxes";
   version = "2.3.1";
 
@@ -43,7 +43,7 @@ gccStdenv.mkDerivation rec {
                 "GLOBALCONF=${placeholder "out"}/share/boxes/boxes-config"
   '';
 
-  makeFlags = [ "CC=${gccStdenv.cc.targetPrefix}cc" ];
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
   installPhase = ''
     install -Dm755 -t $out/bin out/boxes
diff --git a/pkgs/by-name/cl/cloud-hypervisor/package.nix b/pkgs/by-name/cl/cloud-hypervisor/package.nix
index a7a0c60737c0..8c4feed3207c 100644
--- a/pkgs/by-name/cl/cloud-hypervisor/package.nix
+++ b/pkgs/by-name/cl/cloud-hypervisor/package.nix
@@ -36,6 +36,8 @@ rustPlatform.buildRustPackage rec {
     "--bins"
     "--lib" # Integration tests require root.
     "--exclude"
+    "hypervisor" # /dev/kvm
+    "--exclude"
     "net_util" # /dev/net/tun
     "--exclude"
     "vmm" # /dev/kvm
diff --git a/pkgs/by-name/co/cosmic-wallpapers/package.nix b/pkgs/by-name/co/cosmic-wallpapers/package.nix
index 50b7a15ba526..26c64b5f5738 100644
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@@ -8,7 +8,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-wallpapers";
-  version = "1.0.0-alpha.3";
+  version = "1.0.0-alpha.4";
 
   src = fetchFromGitHub {
     owner = "pop-os";
diff --git a/pkgs/by-name/de/descent3-unwrapped/package.nix b/pkgs/by-name/de/descent3-unwrapped/package.nix
new file mode 100644
index 000000000000..eb1d0de47adb
--- /dev/null
+++ b/pkgs/by-name/de/descent3-unwrapped/package.nix
@@ -0,0 +1,152 @@
+{
+  SDL2,
+  cmake,
+  fetchFromGitHub,
+  glm,
+  lib,
+  runCommand,
+  stdenv,
+  unstableGitUpdater,
+  writeShellScript,
+  zlib,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "descent3-unwrapped";
+  # I’m using an unstable version here because we need to use -additionaldir in
+  # the wrapped version of Descent 3. Once there’s a stable version of Descent
+  # 3 that supports the -additionaldir command-line option, we can stop using
+  # an unstable version of Descent 3.
+  version = "1.5.0-beta-unstable-2024-10-29";
+  src = fetchFromGitHub {
+    owner = "DescentDevelopers";
+    repo = "Descent3";
+    rev = "d51ce964c7a925333ea64f00cf8d9ae15ee63a6b";
+    fetchSubmodules = true;
+    leaveDotGit = true;
+    # Descent 3 is supposed to display its Git commit hash in the bottom right
+    # corner of the main menu. That feature only works if either the .git
+    # directory or a git-hash.txt file exists at build time. We don’t want .git
+    # to exist at build time (see #8567), so we create a git-hash.txt file and
+    # then delete the .git directory.
+    #
+    # Technically, we could simplify the code by reading the value of src.rev.
+    # src.rev contains a Git commit hash at the moment, but it won’t contain a
+    # Git commit hash in the future when we switch to a stable version of
+    # Descent 3.
+    #
+    # Upstream expects git-hash.txt to contain a short commit hash, but I’ve
+    # decided to use a full commit hash. Full commit hashes are more
+    # reproducible. The short hash “1234” might correspond to one commit today,
+    # but correspond to two commits tomorrow. Full commit hashes don’t have
+    # that problem.
+    #
+    # Also, upstream expects git-hash.txt to contain no newlines. If
+    # git-hash.txt contains a newline, then Descent 3 will fail to build.
+    postFetch = ''
+      cd "$out"
+      git rev-parse --verify HEAD | tr --delete '\n' > git-hash.txt
+      rm -r .git
+    '';
+    hash = "sha256-C6r06cntQ14jPFO9EUzLisZjsl22cIaJb8I7xFzXrNc=";
+  };
+
+  hardeningDisable = [ "format" ];
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    SDL2
+    glm
+    zlib
+  ];
+  cmakeFlags = [ "-DFORCE_PORTABLE_INSTALL=OFF" ];
+  # This is a workaround for a problem that will eventually get fixed upstream.
+  postInstall = ''
+    cd "$out"
+    mv lib/* share/
+    rmdir lib
+  '';
+
+  passthru = {
+    # The idea here is to make sure that we don’t forget to update meta.license
+    # when reviewing a pull request from @r-ryantm.
+    tests.licenseInfoIsUpToDate = runCommand "${pname}-license-info-is-up-to-date" { } ''
+      function on_success {
+        echo Test succeeded. > "$out"
+      }
+
+      function on_failure {
+        echo \
+          It looks like at least one of Descent 3’s licensing-related files \
+          changed. Before you continue to update this package, you should \
+          check to see if meta.license needs to be updated. Once you’ve done \
+          that, you can update the hashes in the \
+          passthru.tests.licenseInfoIsUpToDate script and then try running the \
+          package tests again. >&2
+        return 1
+      }
+
+      cd ${lib.strings.escapeShellArg src}
+      sha256sum --check << EOF && on_success || on_failure
+        8b1ba204bb69a0ade2bfcf65ef294a920f6bb361b317dba43c7ef29d96332b9b  LICENSE
+        55d65dbf5d785111cf7029941cb7f72dbef084509e6126bcc58b6bb20203f8c6  THIRD_PARTY.md
+      EOF
+    '';
+    updateScript = unstableGitUpdater {
+      shallowClone = false;
+      # unstableGitUpdater assumes that the version number should be 0 if there
+      # isn’t any tags in the repo’s default branch. For most packages, that is
+      # the correct decision, but for Descent 3 it’s not. Descent 3’s source
+      # code lived in private repos until 2024. In 2024, a new public repo was
+      # created [1], but the old commit history wasn’t imported into the new
+      # repo. Version 1.5.0-beta from 2005 [2] was the last release that was
+      # created from one of the private repos.*
+      #
+      # *Technically, there was one release that came after the 2005 one. There
+      # was a Linux version and a macOS version of Descent 3 that were released
+      # on Steam in 2020 [3][4][5]. Those versions don’t count because they
+      # haven’t been fully merged into the public repo yet [6].
+      #
+      # [1]: <https://github.com/DescentDevelopers/Descent3/commit/637df31ca1e47371fb8ca822f928734c13afd8cf>
+      # [2]: <http://descent3.com/downloads.php>
+      # [3]: <https://www.patreon.com/posts/project-descent-33611585>
+      # [4]: <https://steamdb.info/depot/273592>
+      # [5]: <https://steamdb.info/depot/273593>
+      # [6]: <https://github.com/DescentDevelopers/Descent3/issues/240>
+      tagConverter = writeShellScript "${pname}-tag-converter.sh" ''
+        read -r input_tag
+        if [ "$input_tag" = 0 ]
+        then
+          printf '%s' 1.5.0-beta
+        else
+          printf '%s' "$input_tag"
+        fi
+      '';
+    };
+  };
+
+  meta = {
+    description = "Game engine for a 6DOF first-person shooter";
+    homepage = "https://github.com/DescentDevelopers/Descent3";
+    license = with lib.licenses; [
+      # See LICENSE and header that’s at the top of many source files.
+      gpl3Plus
+      # See THIRD_PARTY.md.
+      isc
+      mit
+    ];
+    mainProgram = "Descent3";
+    maintainers = [ lib.maintainers.jayman2000 ];
+    platforms = lib.platforms.all;
+    badPlatforms = [
+      # Descent 3 stores modules in HOG2 archives. It extracts those modules
+      # and then tries to dlopen() them at runtime.
+      lib.systems.inspect.platformPatterns.isStatic
+      # When you build Descent 3 on Darwin, it produces a different directory
+      # structure (no bin/ directory) [1]. I’m sure that this derivation could be
+      # updated to account for that different directory structure, but I don’t
+      # have any Darwin systems to test things on at the moment.
+      #
+      # [1]: <https://logs.ofborg.org/?key=nixos/nixpkgs.355710&attempt_id=747dd630-5068-4ba9-9c50-6f150634ef1a>
+    ] ++ lib.platforms.darwin;
+  };
+}
diff --git a/pkgs/by-name/de/descent3/package.nix b/pkgs/by-name/de/descent3/package.nix
new file mode 100644
index 000000000000..5027a8bc12e7
--- /dev/null
+++ b/pkgs/by-name/de/descent3/package.nix
@@ -0,0 +1,60 @@
+{
+  descent3-unwrapped,
+  lib,
+  makeBinaryWrapper,
+  runCommand,
+}:
+
+runCommand "descent3-${descent3-unwrapped.version}"
+  {
+    pname = "descent3";
+    inherit (descent3-unwrapped) version;
+    nativeBuildInputs = [ makeBinaryWrapper ];
+    passthru.unwrapped = descent3-unwrapped;
+
+    meta = descent3-unwrapped.meta // {
+      # The code that produces the wrapper is in the Nixpkgs repo, and the
+      # Nixpkgs repo is MIT Licensed.
+      license = [ lib.licenses.mit ];
+      longDescription = ''
+        Playing Descent 3 using the Nix package manager is a little bit awkward
+        at the moment. This wrapper makes it slightly less awkward. Here’s how
+        you use this wrapper:
+
+        1. Install the `descent3` package, or start an ephemeral shell with the
+        `descent3` package.
+
+        2. Find the documentation folder for `descent3-unwrapped` by running this
+        command:
+
+            ```bash
+            nix-instantiate --eval --expr '(import <nixpkgs> { }).descent3-unwrapped + "/share/doc/Descent3"'
+            ```
+
+        3. Open `<descent3-unwrapped-doc-folder>/USAGE.md`.
+
+        4. Follow steps 1–6 of Descent 3’s usage instructions.
+
+        5. Change directory into the `D3-open-source` folder:
+
+          ```bash
+          cd <path-to-D3-open-source>
+          ```
+
+        6. Start Descent 3 by running this command:
+
+            ```bash
+            Descent3
+            ```
+      '';
+    };
+  }
+  ''
+    mkdir --parents "$out/bin"
+    descent3_unwrapped=${lib.strings.escapeShellArg descent3-unwrapped}
+    makeBinaryWrapper \
+      "$descent3_unwrapped/bin/Descent3" \
+      "$out/bin/Descent3" \
+      --append-flags -additionaldir \
+      --append-flags "$descent3_unwrapped/share"
+  ''
diff --git a/pkgs/by-name/fr/frp/package.nix b/pkgs/by-name/fr/frp/package.nix
index 419cf6e76f81..13e589f308d6 100644
--- a/pkgs/by-name/fr/frp/package.nix
+++ b/pkgs/by-name/fr/frp/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.61.0";
+  version = "0.61.1";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ZanHYU7UEPsI/KAygxcTszUB4emnrrqxiuuLsCVk+cM=";
+    hash = "sha256-HPhT+crjQELQMDpBywWy+POplKxfLrHCAWkTRRhogqA=";
   };
 
-  vendorHash = "sha256-ySONxi45Ckq0y4BNyTcm8s6KcnXW+k6thqL7qh6mbBc=";
+  vendorHash = "sha256-Pwa5idGOn1kTxhouxYwNlKafYU541/rQolm+2CJnLo4=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ha/handheld-daemon-ui/package.nix b/pkgs/by-name/ha/handheld-daemon-ui/package.nix
index 28ebc6cb1a1e..2454a82642bb 100644
--- a/pkgs/by-name/ha/handheld-daemon-ui/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon-ui/package.nix
@@ -5,11 +5,11 @@
 }:
 let
   pname = "handheld-daemon-ui";
-  version = "3.3.0";
+  version = "3.3.5";
 
   src = fetchurl {
     url = "https://github.com/hhd-dev/hhd-ui/releases/download/v${version}/hhd-ui.Appimage";
-    hash = "sha256-Fc2MwZoy1CKiWvh/Z1P0OnfkyWy4aT6I1aIY8gEf69U=";
+    hash = "sha256-g8LB24WxpbsGDFHRI0c80m9XXZghKYiRyuRRoYvb34g=";
   };
   extractedFiles = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index 3ab09c8dec0a..11561c25b4da 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -50,9 +50,15 @@ let
 
   # The geodata website is not versioned, so we use the internet archive
   geodata =
+    let
+      inherit (sources.components.geonames) timestamp;
+      date =
+        "${lib.substring 0 4 timestamp}-${lib.substring 4 2 timestamp}-${lib.substring 6 2 timestamp}T"
+        + "${lib.substring 8 2 timestamp}:${lib.substring 10 2 timestamp}:${lib.substring 12 2 timestamp}Z";
+    in
     runCommand "immich-geodata"
       {
-        outputHash = "sha256-imqSfzXaEMNo9T9tZr80sr/89n19kiFc8qwidFzRUaY=";
+        outputHash = sources.components.geonames.hash;
         outputHashMode = "recursive";
         nativeBuildInputs = [
           cacert
@@ -64,15 +70,15 @@ let
       }
       ''
         mkdir $out
-        url="https://web.archive.org/web/20240724153050/http://download.geonames.org/export/dump"
+        url="https://web.archive.org/web/${timestamp}/http://download.geonames.org/export/dump"
         curl -Lo ./cities500.zip "$url/cities500.zip"
         curl -Lo $out/admin1CodesASCII.txt "$url/admin1CodesASCII.txt"
         curl -Lo $out/admin2Codes.txt "$url/admin2Codes.txt"
         curl -Lo $out/ne_10m_admin_0_countries.geojson \
-          https://raw.githubusercontent.com/nvkelso/natural-earth-vector/ca96624a56bd078437bca8184e78163e5039ad19/geojson/ne_10m_admin_0_countries.geojson
+          https://github.com/nvkelso/natural-earth-vector/raw/ca96624a56bd078437bca8184e78163e5039ad19/geojson/ne_10m_admin_0_countries.geojson
 
         unzip ./cities500.zip -d $out/
-        echo "2024-07-24T15:30:50Z" > $out/geodata-date.txt
+        echo "${date}" > $out/geodata-date.txt
       '';
 
   src = fetchFromGitHub {
@@ -241,7 +247,10 @@ buildNpmPackage' {
   meta = {
     description = "Self-hosted photo and video backup solution";
     homepage = "https://immich.app/";
-    license = lib.licenses.agpl3Only;
+    license = with lib.licenses; [
+      agpl3Only
+      cc-by-40 # geonames
+    ];
     maintainers = with lib.maintainers; [
       dotlambda
       jvanbruegge
diff --git a/pkgs/by-name/im/immich/sources.json b/pkgs/by-name/im/immich/sources.json
index 735452b0e5dc..61baf35adda7 100644
--- a/pkgs/by-name/im/immich/sources.json
+++ b/pkgs/by-name/im/immich/sources.json
@@ -17,6 +17,10 @@
     "open-api/typescript-sdk": {
       "npmDepsHash": "sha256-GtqS59I+By1u6WcR+lDj2HKXVwh7jw5/N6MRdUctlaM=",
       "version": "1.122.3"
+    },
+    "geonames": {
+      "timestamp": "20241215052013",
+      "hash": "sha256-Gv85Y5KAkeqNU8iMMKwepI5o14Z0s5aQbLJVxhtjY14="
     }
   }
 }
diff --git a/pkgs/by-name/im/immich/update.sh b/pkgs/by-name/im/immich/update.sh
index a1a5e2e0585c..1e11085e3adf 100755
--- a/pkgs/by-name/im/immich/update.sh
+++ b/pkgs/by-name/im/immich/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq prefetch-npm-deps nix-prefetch-github coreutils
+#!nix-shell -i bash -p curl jq prefetch-npm-deps nix-prefetch-github coreutils ripgrep
 
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
@@ -39,6 +39,24 @@ for npm_component in cli server web "open-api/typescript-sdk"; do
       '.components += {($npm_component): {npmDepsHash: $hash, version: $version}}' \
       "$sources_tmp")" > "$sources_tmp"
 done
-
 rm "$lock"
+
+url="http://download.geonames.org/export/dump"
+curl -s "http://web.archive.org/save/$url/cities500.zip"
+curl -s "http://web.archive.org/save/$url/admin1CodesASCII.txt"
+curl -s "http://web.archive.org/save/$url/admin1Codes.txt"
+timestamp=$(curl -s \
+    "http://archive.org/wayback/available?url=$url/cities500.zip" \
+    | jq -r ".archived_snapshots.closest.timestamp")
+echo "$(jq --arg timestamp "$timestamp" --arg hash "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" \
+    '.components += {geonames: {timestamp: $timestamp, hash: $hash}}' \
+    "$sources_tmp")" > "$sources_tmp"
+
+cp "$sources_tmp" sources.json
+set +o pipefail
+output="$(nix-build ../../../.. -A immich.geodata 2>&1 || true)"
+set -o pipefail
+hash=$(echo "$output" | rg 'got:\s+(sha256-.*)$' -or '$1')
+echo "$(jq --arg hash "$hash" '.components.geonames.hash = $hash' "$sources_tmp")" > "$sources_tmp"
+
 mv "$sources_tmp" sources.json
diff --git a/pkgs/by-name/in/infrastructure-agent/package.nix b/pkgs/by-name/in/infrastructure-agent/package.nix
index d62e91af21c4..9c6100262d2e 100644
--- a/pkgs/by-name/in/infrastructure-agent/package.nix
+++ b/pkgs/by-name/in/infrastructure-agent/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "infrastructure-agent";
-  version = "1.58.0";
+  version = "1.58.1";
 
   src = fetchFromGitHub {
     owner = "newrelic";
     repo = "infrastructure-agent";
     rev = version;
-    hash = "sha256-L2er3DJ9zZb8AosHwOdNEsvQc7XPwQfGaa8d72iJOik=";
+    hash = "sha256-ckGouBmpjsS3qcTw3Br3N/uJf7KgowUyawr2bPsMJ5I=";
   };
 
   vendorHash = "sha256-0WLL15CXRi/flp4EV3Qt0wO1VaUmAokzsChpiqjs+YQ=";
diff --git a/pkgs/by-name/li/litmusctl/package.nix b/pkgs/by-name/li/litmusctl/package.nix
index 63c4151c12df..7991cc130c41 100644
--- a/pkgs/by-name/li/litmusctl/package.nix
+++ b/pkgs/by-name/li/litmusctl/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "litmusctl";
-  version = "1.12.0";
+  version = "1.13.0";
 
   nativeBuildInputs = [
     installShellFiles
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "litmuschaos";
     repo = "litmusctl";
     rev = "${version}";
-    hash = "sha256-pqkUaR/r9GKvTt8hEjqgSuEcNuSeRE+rtlj47uS5/dY=";
+    hash = "sha256-lPdejdnBefhYgv52I7BOm1VTgqHSp8u1lgJJxK5GWSA=";
   };
 
   vendorHash = "sha256-7FYOQ89aUFPX+5NCPYKg+YGCXstQ6j9DK4V2mCgklu0=";
diff --git a/pkgs/by-name/lo/logisim-evolution/package.nix b/pkgs/by-name/lo/logisim-evolution/package.nix
index 465360a20238..25127d879e4f 100644
--- a/pkgs/by-name/lo/logisim-evolution/package.nix
+++ b/pkgs/by-name/lo/logisim-evolution/package.nix
@@ -17,11 +17,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "logisim-evolution";
-  version = "3.8.0";
+  version = "3.9.0";
 
   src = fetchurl {
     url = "https://github.com/logisim-evolution/logisim-evolution/releases/download/v${finalAttrs.version}/logisim-evolution-${finalAttrs.version}-all.jar";
-    hash = "sha256-TFm+fa3CMp0OMhnKBc6cLIWGQbIG/OpOOCG7ea7wbCw=";
+    hash = "sha256-QxU1h6LKzWy25wtXgEufPT0KsIsLhrKnq9CRcS4Mlzc=";
   };
   dontUnpack = true;
 
diff --git a/pkgs/by-name/ma/matio/package.nix b/pkgs/by-name/ma/matio/package.nix
index 3a2fde315779..7b4953064e8e 100644
--- a/pkgs/by-name/ma/matio/package.nix
+++ b/pkgs/by-name/ma/matio/package.nix
@@ -1,18 +1,25 @@
-{ lib, stdenv, fetchurl }:
-stdenv.mkDerivation rec {
+{
+  fetchurl,
+  lib,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "matio";
-  version = "1.5.27";
+  version = "1.5.28";
+
   src = fetchurl {
-    url = "mirror://sourceforge/matio/${pname}-${version}.tar.gz";
-    sha256 = "sha256-CmqgCxjEUStjqNJ5BrB5yMbtQdSyhE96SuWY4Y0i07M=";
+    url = "mirror://sourceforge/matio/matio-${finalAttrs.version}.tar.gz";
+    hash = "sha256-naaYk0ohVprwWOY0hWRmb0UCnmwrCHjKDY+WCb93uNg=";
   };
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://sourceforge.net/p/matio/news/";
     description = "C library for reading and writing Matlab MAT files";
     homepage = "http://matio.sourceforge.net/";
-    license = licenses.bsd2;
+    license = lib.licenses.bsd2;
     maintainers = [ ];
     mainProgram = "matdump";
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 84a98183a047..97c43e597fda 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.6.1";
+  version = "2.6.2";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     rev = "v${version}";
-    hash = "sha256-V4ppqHQjPkkRKHkDHzEr05vOyv3BhiLnYxEftIn08XU=";
+    hash = "sha256-oaManxhksEBwbe1jmkRmOJMhYFiulGTVCuto4RMznvg=";
   };
 
   vendorHash = "sha256-xolhwdWRjYZMgwI4jq0fGzvxnNjx6EplvZC7XMvBw+M=";
diff --git a/pkgs/by-name/no/nova-password/package.nix b/pkgs/by-name/no/nova-password/package.nix
index 89c94b2389fa..ff9a35e29394 100644
--- a/pkgs/by-name/no/nova-password/package.nix
+++ b/pkgs/by-name/no/nova-password/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "nova-password";
-  version = "0.5.7";
+  version = "0.5.8";
 
   src = fetchFromGitHub {
     owner = "sapcc";
     repo = "nova-password";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tjjP+LmYaqpzmTk3tgFqZlG1KEeAkfI7RxzSm97jWVU=";
+    hash = "sha256-+qFbBjjbp1Nazpo21oOytvEPzn6Nmc4Cr8du045Ab/E=";
   };
 
-  vendorHash = "sha256-MwemuOaXGl0eF+lVtMCgbBeJGILmaeEHcbu+xp8Lm70=";
+  vendorHash = "sha256-tRBWniPM/IPR/JKi7R46tnx9rgyCb5hOkOR1oy7iVcc=";
 
   meta = {
     description = "Decrypt the admin password generated for the VM in OpenStack";
diff --git a/pkgs/by-name/pr/prrte/package.nix b/pkgs/by-name/pr/prrte/package.nix
index 44f8fba390ae..980b4d889d43 100644
--- a/pkgs/by-name/pr/prrte/package.nix
+++ b/pkgs/by-name/pr/prrte/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "prrte";
-  version = "3.0.7";
+  version = "3.0.8";
 
   src = fetchFromGitHub {
     owner = "openpmix";
     repo = "prrte";
     rev = "v${version}";
-    hash = "sha256-Jw9/M2rpGTA19qssDaZV+9FYlIvz8wgL5oUDdWwidHI=";
+    hash = "sha256-4Xc6We0mXpKCwfHlmqi+WbFjdQegWHGzWrEnMVqkqtU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/py/pylyzer/package.nix b/pkgs/by-name/py/pylyzer/package.nix
index 25f512e6d72b..43420e572d59 100644
--- a/pkgs/by-name/py/pylyzer/package.nix
+++ b/pkgs/by-name/py/pylyzer/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pylyzer";
-  version = "0.0.73";
+  version = "0.0.74";
 
   src = fetchFromGitHub {
     owner = "mtshiba";
     repo = "pylyzer";
     tag = "v${version}";
-    hash = "sha256-rpF0xrk1PvgfJ0EOHWnCuSWfzLVzXErnKizbvFBP+pg=";
+    hash = "sha256-NVCFwISPRTNgs4hn9ezp2Xb4r7xytziIByVSKyqt/lo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-pU230ghfHsJEcADoZH8/yP+fYDv21FPlwA0//SvHJWY=";
+  cargoHash = "sha256-mNFRP6mT4mKKKg05nJcdd8qy6YFxWVADHIU9uGrEcng=";
 
   nativeBuildInputs = [
     git
@@ -76,7 +76,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Fast static code analyzer & language server for Python";
     homepage = "https://github.com/mtshiba/pylyzer";
-    changelog = "https://github.com/mtshiba/pylyzer/releases/tag/v${version}";
+    changelog = "https://github.com/mtshiba/pylyzer/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ natsukium ];
     mainProgram = "pylyzer";
diff --git a/pkgs/by-name/st/stylance-cli/package.nix b/pkgs/by-name/st/stylance-cli/package.nix
index ba099d5aabfb..c6d6d82c827d 100644
--- a/pkgs/by-name/st/stylance-cli/package.nix
+++ b/pkgs/by-name/st/stylance-cli/package.nix
@@ -5,14 +5,14 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "stylance-cli";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-2RLdO2TxIa/ngji5tzKzSfpq2qErI7gaQqObDTMrd/g=";
+    hash = "sha256-YN7Y8dxwpZel1SeEgyckh4ZPuRqcAsNvc/fGRgvzeDw=";
   };
 
-  cargoHash = "sha256-26EKLvqc9x7JT6EDkH9KbQJ+xX/CUslLmEF4XxnPbFY=";
+  cargoHash = "sha256-VKfQzsTTKIbh+X0suXyUXDsd8sDSRsc5SnO8qxcxGPQ=";
 
   meta = with lib; {
     description = "Library and cli tool for working with scoped CSS in rust";
diff --git a/pkgs/by-name/ty/typstyle/package.nix b/pkgs/by-name/ty/typstyle/package.nix
index f2a3216ec8a1..c7f9368ff297 100644
--- a/pkgs/by-name/ty/typstyle/package.nix
+++ b/pkgs/by-name/ty/typstyle/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typstyle";
-  version = "0.12.10";
+  version = "0.12.12";
 
   src = fetchFromGitHub {
     owner = "Enter-tainer";
     repo = "typstyle";
     tag = "v${version}";
-    hash = "sha256-nrsfp0T4QYLZw5F5R4iTewUjlZOErc/15c0O6O9BFBE=";
+    hash = "sha256-oQnZm+BkccHN3xXSe1yBus3m4JKyCBKM9kkJz+QryR0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-gPsZRdksX+7sZWK7V/q17oZmN2kgQkApC66/3KowDCI=";
+  cargoHash = "sha256-pbsB9mQafgI6PudjeCzOSpk3+iZkkdp/V1zgH8pP7us=";
 
   # Disabling tests requiring network access
   checkFlags = [
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/Enter-tainer/typstyle/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/Enter-tainer/typstyle/blob/${src.tag}/CHANGELOG.md";
     description = "Format your typst source code";
     homepage = "https://github.com/Enter-tainer/typstyle";
     license = lib.licenses.asl20;
diff --git a/pkgs/by-name/v2/v2raya/package.nix b/pkgs/by-name/v2/v2raya/package.nix
index 243b36cb3d82..2d54d4271225 100644
--- a/pkgs/by-name/v2/v2raya/package.nix
+++ b/pkgs/by-name/v2/v2raya/package.nix
@@ -17,13 +17,13 @@
 }:
 let
   pname = "v2raya";
-  version = "2.2.5.8";
+  version = "2.2.6.3";
 
   src = fetchFromGitHub {
     owner = "v2rayA";
     repo = "v2rayA";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-yFN7mG5qS7BAuCSvSSZFFiyytd7XZ4kJvctc8cU72Oc=";
+    tag = "v${version}";
+    hash = "sha256-Du7DqOkneOFBiPK5BeQtnKRsX0Tcuhq8iiugDMGTk7o=";
     postFetch = "sed -i -e 's/npmmirror/yarnpkg/g' $out/gui/yarn.lock";
   };
 
@@ -34,7 +34,7 @@ let
 
     offlineCache = fetchYarnDeps {
       yarnLock = "${src}/gui/yarn.lock";
-      hash = "sha256-AZIYkW2u1l9IaDpR9xiKNpc0sGAarLKwHf5kGnzdpKw=";
+      hash = "sha256-AexW4FFGkQBQlci/FAm9rpfbPn76v+O3nMX3xHymhPw=";
     };
 
     env.OUTPUT_DIR = placeholder "out";
@@ -60,7 +60,7 @@ buildGoModule {
 
   sourceRoot = "${src.name}/service";
 
-  vendorHash = "sha256-Oa7YmxcZr5scbhNeqGxJOkryL2uHQQ3RkLGWJaIXq3s=";
+  vendorHash = "sha256-kK99Y0CgesvlaM2WsFIPgdtWo2975m9TqyJXoNv43yU=";
 
   ldflags = [
     "-s"
@@ -87,12 +87,12 @@ buildGoModule {
       --prefix XDG_DATA_DIRS ":" ${assetsDir}/share
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Linux web GUI client of Project V which supports V2Ray, Xray, SS, SSR, Trojan and Pingtunnel";
     homepage = "https://github.com/v2rayA/v2rayA";
     mainProgram = "v2rayA";
-    license = licenses.agpl3Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ ChaosAttractor ];
+    license = lib.licenses.agpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ ChaosAttractor ];
   };
 }
diff --git a/pkgs/by-name/vu/vulnix/package.nix b/pkgs/by-name/vu/vulnix/package.nix
index e124fffbbe07..89b361bbff78 100644
--- a/pkgs/by-name/vu/vulnix/package.nix
+++ b/pkgs/by-name/vu/vulnix/package.nix
@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vulnix";
-  version = "1.10.1-unstable-2024-04-02";
+  version = "1.10.2";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "vulnix";
-    rev = "ebd8ea84553c0fd95bc3042584b495560821500f";
-    hash = "sha256-huC520cLPjcmnbh+qOamyVfiIJNrCUpwK+orEp+X2LQ=";
+    rev = "9abfc80da0b4135e982332e448a3969f3b28785b";
+    hash = "sha256-gSgAGN7LlciW4uY3VS49CbZ9WuRUcduJ5V7JesA8OVo=";
   };
 
   postPatch = ''
@@ -67,6 +67,6 @@ python3Packages.buildPythonApplication rec {
     mainProgram = "vulnix";
     homepage = "https://github.com/nix-community/vulnix";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ckauhaus ];
+    maintainers = with maintainers; [ henrirosten ];
   };
 }
diff --git a/pkgs/by-name/xe/xed-editor/package.nix b/pkgs/by-name/xe/xed-editor/package.nix
index ac50149c8ad1..c6a5d9d97d16 100644
--- a/pkgs/by-name/xe/xed-editor/package.nix
+++ b/pkgs/by-name/xe/xed-editor/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xed-editor";
-  version = "3.6.9";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xed";
     rev = version;
-    hash = "sha256-QPP7LWAiyKt7YBX88qlLS7PucQODH/c/j5WAbO9SF6k=";
+    hash = "sha256-q6lhgax3W51rtgmmROcrzxgaxz5J9r7CcPwhYDt/A5Y=";
   };
 
   patches = [
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index ad86dd6e4922..3fa77f28ef28 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -240,6 +240,14 @@ self: super: {
     ];
   }) super.statistics;
 
+  # Work around -Werror failures until a more permanent solution is released
+  # https://github.com/haskell-cryptography/HsOpenSSL/issues/88
+  # https://github.com/haskell-cryptography/HsOpenSSL/issues/93
+  # https://github.com/haskell-cryptography/HsOpenSSL/issues/95
+  HsOpenSSL = appendConfigureFlags [
+    "--ghc-option=-optc=-Wno-incompatible-pointer-types"
+  ] super.HsOpenSSL;
+
   # There are numerical tests on random data, that may fail occasionally
   lapack = dontCheck super.lapack;
 
diff --git a/pkgs/development/ocaml-modules/hxd/default.nix b/pkgs/development/ocaml-modules/hxd/default.nix
index d3a8ce7a85bd..de60667327b4 100644
--- a/pkgs/development/ocaml-modules/hxd/default.nix
+++ b/pkgs/development/ocaml-modules/hxd/default.nix
@@ -23,6 +23,10 @@ buildDunePackage rec {
 
   doCheck = true;
 
+  preCheck = ''
+    export DUNE_CACHE=disabled
+  '';
+
   meta = with lib; {
     description = "Hexdump in OCaml";
     homepage = "https://github.com/dinosaure/hxd";
diff --git a/pkgs/development/ocaml-modules/ocplib-simplex/default.nix b/pkgs/development/ocaml-modules/ocplib-simplex/default.nix
index 74ca96b18661..7d1c2d49d778 100644
--- a/pkgs/development/ocaml-modules/ocplib-simplex/default.nix
+++ b/pkgs/development/ocaml-modules/ocplib-simplex/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage, logs, zarith }:
+{ lib, fetchFromGitHub, fetchpatch, buildDunePackage, logs, zarith }:
 
 buildDunePackage rec {
   pname = "ocplib-simplex";
@@ -11,6 +11,13 @@ buildDunePackage rec {
     hash = "sha256-fLTht+TlyJIsIAsRLmmkFKsnbSeW3BgyAyURFdnGfko=";
   };
 
+  # Fix tests with dune 3.17.0
+  # See https://github.com/OCamlPro/ocplib-simplex/issues/35
+  patches = (fetchpatch {
+    url = "https://github.com/OCamlPro/ocplib-simplex/commit/456a744bddd397daade7959d4a49cfadafdadd33.patch";
+    hash = "sha256-tQUXOoRGe1AIzHcm6j2MopROxn75OE9YUP+CwcKUbVg=";
+  });
+
   propagatedBuildInputs = [ logs zarith ];
 
   doCheck = true;
diff --git a/pkgs/development/ocaml-modules/reason-react/default.nix b/pkgs/development/ocaml-modules/reason-react/default.nix
index 340b0c1c27b1..a447c3172d60 100644
--- a/pkgs/development/ocaml-modules/reason-react/default.nix
+++ b/pkgs/development/ocaml-modules/reason-react/default.nix
@@ -17,6 +17,11 @@ buildDunePackage {
     melange
   ];
   doCheck = true;
+  # Fix tests with dune 3.17.0
+  # See https://github.com/reasonml/reason-react/issues/870
+  preCheck = ''
+    export DUNE_CACHE=disabled
+  '';
   meta = reason-react-ppx.meta // {
     description = "Reason bindings for React.js";
   };
diff --git a/pkgs/development/python-modules/airthings-ble/default.nix b/pkgs/development/python-modules/airthings-ble/default.nix
index 854ab37120a2..68249000984c 100644
--- a/pkgs/development/python-modules/airthings-ble/default.nix
+++ b/pkgs/development/python-modules/airthings-ble/default.nix
@@ -7,6 +7,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
 }:
@@ -25,11 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-m2jsXLrj2yS2Wi2dSwyxBv/nXmU738gd5iJ1JVfakUg=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "-v -Wdefault --cov=airthings_ble --cov-report=term-missing:skip-covered" ""
-  '';
-
   build-system = [ poetry-core ];
 
   dependencies = [
@@ -38,7 +34,10 @@ buildPythonPackage rec {
     bleak-retry-connector
   ] ++ lib.optionals (pythonOlder "3.11") [ async-timeout ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "airthings_ble" ];
 
diff --git a/pkgs/development/python-modules/bluemaestro-ble/default.nix b/pkgs/development/python-modules/bluemaestro-ble/default.nix
index d1f8cbd91264..d153c721f7aa 100644
--- a/pkgs/development/python-modules/bluemaestro-ble/default.nix
+++ b/pkgs/development/python-modules/bluemaestro-ble/default.nix
@@ -5,6 +5,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -13,31 +14,29 @@
 buildPythonPackage rec {
   pname = "bluemaestro-ble";
   version = "0.2.3";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
-    repo = pname;
+    repo = "bluemaestro-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-mJ5JNGN4F9U3WMJQDwiZwuxE0zOirwo1sWF3/bVwXhY=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=bluemaestro_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "bluemaestro_ble" ];
 
@@ -45,7 +44,7 @@ buildPythonPackage rec {
     description = "Library for bluemaestro BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/bluemaestro-ble";
     changelog = "https://github.com/Bluetooth-Devices/bluemaestro-ble/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/bthome-ble/default.nix b/pkgs/development/python-modules/bthome-ble/default.nix
index 8f48d2c0364d..93433f5e53e3 100644
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@@ -6,6 +6,7 @@
   cryptography,
   fetchFromGitHub,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   pytz,
@@ -26,11 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-TlZyNGfHNKN+6tCKepLS+fbgfq3a1uzeCXl25khl6d8=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail " --cov=bthome_ble --cov-report=term-missing:skip-covered" ""
-  '';
-
   build-system = [ poetry-core ];
 
   dependencies = [
@@ -41,7 +37,10 @@ buildPythonPackage rec {
     pytz
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "bthome_ble" ];
 
diff --git a/pkgs/development/python-modules/craft-cli/default.nix b/pkgs/development/python-modules/craft-cli/default.nix
index 5438683cd995..ff5b86d6adec 100644
--- a/pkgs/development/python-modules/craft-cli/default.nix
+++ b/pkgs/development/python-modules/craft-cli/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "craft-cli";
-  version = "2.10.1";
+  version = "2.12.0";
 
   pyproject = true;
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-cli";
     rev = "refs/tags/${version}";
-    hash = "sha256-XKRV5VJLC3B5gcNr/icOxWB6pDXDT7MV5wM/vEQHVm4=";
+    hash = "sha256-edN0eEXBaYDUqSc7Xv22MpG9wkHqI6x1HtRkQ468yH8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cytoolz/default.nix b/pkgs/development/python-modules/cytoolz/default.nix
index 574e717759e7..03b0b8c106b5 100644
--- a/pkgs/development/python-modules/cytoolz/default.nix
+++ b/pkgs/development/python-modules/cytoolz/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "cytoolz";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   disabled = isPy27 || isPyPy;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-60U7MBghUvmRelGJt9mQRrbOkM34rrD+/0smg+YA3v0=";
+    hash = "sha256-icwxYbieG7Ptdjb3TtLlWYT9NVFpBPyHjK4hbkKyx9Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-q/default.nix b/pkgs/development/python-modules/django-q/default.nix
deleted file mode 100644
index fac1bfa327a8..000000000000
--- a/pkgs/development/python-modules/django-q/default.nix
+++ /dev/null
@@ -1,93 +0,0 @@
-{
-  lib,
-  stdenv,
-  arrow,
-  blessed,
-  buildPythonPackage,
-  croniter,
-  django,
-  django-picklefield,
-  django-redis,
-  fetchFromGitHub,
-  future,
-  pkgs,
-  poetry-core,
-  pytest-django,
-  pytest-mock,
-  pytestCheckHook,
-  pythonOlder,
-  redis,
-  setuptools,
-}:
-
-buildPythonPackage rec {
-  pname = "django-q";
-  version = "1.3.9";
-  pyproject = true;
-
-  disabled = pythonOlder "3.6";
-
-  src = fetchFromGitHub {
-    owner = "Koed00";
-    repo = "django-q";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-gFSrAl3QGoJEJfvTTvLQgViPPjeJ6BfvgEwgLLo+uAA=";
-  };
-
-  patches = [ ./pep-621.patch ];
-
-  build-system = [
-    poetry-core
-  ];
-
-  pythonRelaxDeps = [
-    "redis"
-  ];
-
-  dependencies = [
-    django-picklefield
-    arrow
-    blessed
-    django
-    future
-    setuptools # for pkg_resources
-  ];
-
-  nativeCheckInputs = [
-    croniter
-    django-redis
-    pytest-django
-    pytest-mock
-    pytestCheckHook
-  ] ++ django-redis.optional-dependencies.hiredis;
-
-  pythonImportsCheck = [ "django_q" ];
-
-  preCheck = ''
-    ${pkgs.redis}/bin/redis-server &
-    REDIS_PID=$!
-  '';
-
-  postCheck = ''
-    kill $REDIS_PID
-  '';
-
-  # don't bother with two more servers to test
-  disabledTests = [
-    "test_disque"
-    "test_mongo"
-  ];
-
-  doCheck = !stdenv.hostPlatform.isDarwin;
-
-  meta = with lib; {
-    description = "Multiprocessing distributed task queue for Django";
-    homepage = "https://django-q.readthedocs.org";
-    changelog = "https://github.com/Koed00/django-q/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ gador ];
-    # django-q is unmaintained at the moment
-    # https://github.com/Koed00/django-q/issues/733
-    broken = lib.versionAtLeast redis.version "5";
-  };
-}
diff --git a/pkgs/development/python-modules/django-q/pep-621.patch b/pkgs/development/python-modules/django-q/pep-621.patch
deleted file mode 100644
index 5f89201e3511..000000000000
--- a/pkgs/development/python-modules/django-q/pep-621.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index 9a83e90..07068ac 100644
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -67,13 +67,15 @@ pytest-cov = "^2.12.0"
- black = { version = "^21.5b1", allow-prereleases = true }
- isort = {extras = ["requirements_deprecated_finder"], version = "^5.8.0"}
- 
--[tool.poetry.extras]
-+[build-system]
- requires = ["poetry_core>=1.0.0"]
--build-backend = ["poetry.core.masonry.api"]
-+build-backend = "poetry.core.masonry.api"
-+
-+[tool.poetry.extras]
- testing = ["django-redis", "croniter", "hiredis", "psutil", "iron-mq", "boto3", "pymongo"]
- rollbar = ["django-q-rollbar"]
- sentry = ["django-q-sentry"]
- 
- [tool.isort]
- profile = "black"
--multi_line_output = 3
-\ No newline at end of file
-+multi_line_output = 3
diff --git a/pkgs/development/python-modules/django-q2/default.nix b/pkgs/development/python-modules/django-q2/default.nix
new file mode 100644
index 000000000000..c9ec30eba2e5
--- /dev/null
+++ b/pkgs/development/python-modules/django-q2/default.nix
@@ -0,0 +1,99 @@
+{
+  lib,
+  arrow,
+  blessed,
+  bson,
+  buildPythonPackage,
+  croniter,
+  django,
+  django-picklefield,
+  django-redis,
+  fetchFromGitHub,
+  hiredis,
+  pkgs,
+  poetry-core,
+  pytest-django,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "django-q2";
+  version = "1.7.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "django-q2";
+    repo = "django-q2";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-mp/IZkfT64xW42B1TEO6lSHxvLQbeH4td8vqZH7wUxM=";
+  };
+
+  postPatch = ''
+    substituteInPlace django_q/tests/settings.py \
+      --replace-fail "HiredisParser" "_HiredisParser"
+  '';
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    arrow
+    bson # required for mongodb but undocumented
+    django
+    django-picklefield
+  ];
+
+  nativeCheckInputs = [
+    blessed
+    croniter
+    django-redis
+    # pyredis refuses to load with hiredis<3.0.0
+    (hiredis.overrideAttrs (
+      new: old: {
+        version = "3.1.0";
+        src = old.src.override {
+          rev = "refs/tags/v${new.version}";
+          hash = "sha256-ID5OJdARd2N2GYEpcYOpxenpZlhWnWr5fAClAgqEgGg=";
+        };
+      }
+    ))
+    pytest-django
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "django_q" ];
+
+  preCheck = ''
+    ${pkgs.redis}/bin/redis-server &
+    REDIS_PID=$!
+  '';
+
+  postCheck = ''
+    kill $REDIS_PID
+  '';
+
+  env = {
+    MONGO_HOST = "127.0.0.1";
+    REDIS_HOST = "127.0.0.1";
+  };
+
+  disabledTests = [
+    # requires a running mongodb
+    "test_mongo"
+  ];
+
+  disabledTestPaths = [
+    "django_q/tests/test_commands.py"
+  ];
+
+  pytestFlagsArray = [ "-vv" ];
+
+  meta = with lib; {
+    description = "Multiprocessing distributed task queue for Django based on Django-Q";
+    homepage = "https://github.com/django-q2/django-q2";
+    changelog = "https://github.com/django-q2/django-q2/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/pkgs/development/python-modules/galois/default.nix b/pkgs/development/python-modules/galois/default.nix
index 50999a139bf0..4eba6cd7c5c0 100644
--- a/pkgs/development/python-modules/galois/default.nix
+++ b/pkgs/development/python-modules/galois/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "galois";
-  version = "0.4.2";
+  version = "0.4.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mhostetter";
     repo = "galois";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-DbmrrNw7XwTL4i6pJIfkBOUs+KGEmdV2FmQa1xfOHYU=";
+    tag = "v${version}";
+    hash = "sha256-1gKL97oS06vgq4gpQSXeMfKzAtjAGQnB48W5BOiMBHA=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/google-cloud-datastore/default.nix b/pkgs/development/python-modules/google-cloud-datastore/default.nix
index e826e6c77bc3..cd2a14dc30ba 100644
--- a/pkgs/development/python-modules/google-cloud-datastore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datastore/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datastore";
-  version = "2.20.1";
+  version = "2.20.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_datastore";
     inherit version;
-    hash = "sha256-B5ULnIhlCHxWX0X6P916BdTD2ZrfeeEMP1lv8Ip9m7o=";
+    hash = "sha256-lmXQCXKdlVEynZR29NW9qcEdNGkkPqiiwNlJC2WqiZ8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/govee-ble/default.nix b/pkgs/development/python-modules/govee-ble/default.nix
index 840c0d0ae65f..49ceb0c1d124 100644
--- a/pkgs/development/python-modules/govee-ble/default.nix
+++ b/pkgs/development/python-modules/govee-ble/default.nix
@@ -6,6 +6,7 @@
   fetchFromGitHub,
   home-assistant-bluetooth,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -25,11 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-w21paR1VTV/ZFnl9SKkJmFFDZMPgA3d7P6blceVvnVk=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail " --cov=govee_ble --cov-report=term-missing:skip-covered" ""
-  '';
-
   build-system = [ poetry-core ];
 
   dependencies = [
@@ -39,7 +35,10 @@ buildPythonPackage rec {
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "govee_ble" ];
 
diff --git a/pkgs/development/python-modules/ibeacon-ble/default.nix b/pkgs/development/python-modules/ibeacon-ble/default.nix
index e0f9fc682355..732fe41c4efa 100644
--- a/pkgs/development/python-modules/ibeacon-ble/default.nix
+++ b/pkgs/development/python-modules/ibeacon-ble/default.nix
@@ -7,6 +7,8 @@
   home-assistant-bluetooth,
   mac-vendor-lookup,
   poetry-core,
+  pytest-asyncio,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
 }:
@@ -25,21 +27,20 @@ buildPythonPackage rec {
     hash = "sha256-1liSWxduYpjIMu7226EH4bsc7gca5g/fyL79W4ZMdU4=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail " --cov=ibeacon_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     aiooui
     home-assistant-bluetooth
     mac-vendor-lookup
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "ibeacon_ble" ];
 
@@ -47,7 +48,7 @@ buildPythonPackage rec {
     description = "Library for iBeacon BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/ibeacon-ble";
     changelog = "https://github.com/Bluetooth-Devices/ibeacon-ble/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/imgw-pib/default.nix b/pkgs/development/python-modules/imgw-pib/default.nix
index 996f1afc87e3..a43678b4ff8d 100644
--- a/pkgs/development/python-modules/imgw-pib/default.nix
+++ b/pkgs/development/python-modules/imgw-pib/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "imgw-pib";
-  version = "1.0.6";
+  version = "1.0.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = "imgw-pib";
-    rev = "refs/tags/${version}";
-    hash = "sha256-0ttGUsu00y/uuTXzPYkgh1QLMYOwPI/m8Qwk5Ty0Y3A=";
+    tag = version;
+    hash = "sha256-vhLBnUjCq9OUQViVWJT6jgcEeRYsjz307x1o28ZUv0g=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/incomfort-client/default.nix b/pkgs/development/python-modules/incomfort-client/default.nix
index 7af06bcc0368..414aa327007f 100644
--- a/pkgs/development/python-modules/incomfort-client/default.nix
+++ b/pkgs/development/python-modules/incomfort-client/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "incomfort-client";
-  version = "0.6.3-1";
+  version = "0.6.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "zxdavb";
     repo = "incomfort-client";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-I6MAFvODkw2QadzXJacFl/TwA6exfBB1PSDslmT7Ysw=";
+    tag = "v${version}";
+    hash = "sha256-fyQKkwHQEvRNTh1IBqE0/YSskBfrFEequ+VxoHSeShA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/inkbird-ble/default.nix b/pkgs/development/python-modules/inkbird-ble/default.nix
index 4722aa190241..9d2979024029 100644
--- a/pkgs/development/python-modules/inkbird-ble/default.nix
+++ b/pkgs/development/python-modules/inkbird-ble/default.nix
@@ -6,6 +6,7 @@
   fetchFromGitHub,
   home-assistant-bluetooth,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -14,32 +15,30 @@
 buildPythonPackage rec {
   pname = "inkbird-ble";
   version = "0.5.8";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
-    repo = pname;
+    repo = "inkbird-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-cUqU4XaY7CORhzy0AGjXI5c5ka+PnF4cHdyopyEBcLo=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     home-assistant-bluetooth
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=inkbird_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "inkbird_ble" ];
 
@@ -47,7 +46,7 @@ buildPythonPackage rec {
     description = "Library for Inkbird BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/inkbird-ble";
     changelog = "https://github.com/Bluetooth-Devices/inkbird-ble/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/kegtron-ble/default.nix b/pkgs/development/python-modules/kegtron-ble/default.nix
index 5d1928741b70..add192df0ade 100644
--- a/pkgs/development/python-modules/kegtron-ble/default.nix
+++ b/pkgs/development/python-modules/kegtron-ble/default.nix
@@ -5,6 +5,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -13,31 +14,29 @@
 buildPythonPackage rec {
   pname = "kegtron-ble";
   version = "0.4.0";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
-    repo = pname;
+    repo = "kegtron-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-O5I5shW8nL2RAQptS2Bp/GI/4L6o0xXXmwYvRq0MM8o=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=kegtron_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "kegtron_ble" ];
 
@@ -45,7 +44,7 @@ buildPythonPackage rec {
     description = "Library for Kegtron BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/kegtron-ble";
     changelog = "https://github.com/Bluetooth-Devices/kegtron-ble/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/ld2410-ble/default.nix b/pkgs/development/python-modules/ld2410-ble/default.nix
index b680db42a4d9..a811cdb3171a 100644
--- a/pkgs/development/python-modules/ld2410-ble/default.nix
+++ b/pkgs/development/python-modules/ld2410-ble/default.nix
@@ -1,11 +1,12 @@
 {
   lib,
   async-timeout,
-  bleak,
   bleak-retry-connector,
+  bleak,
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
 }:
@@ -13,31 +14,29 @@
 buildPythonPackage rec {
   pname = "ld2410-ble";
   version = "0.2.0";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "930913";
-    repo = pname;
+    repo = "ld2410-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-wQnE2hNT0UOnPJbHq1eayIO8g0XRZvEH6V19DL6RqoA=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=ld2410_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     async-timeout
     bleak
     bleak-retry-connector
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "ld2410_ble" ];
 
@@ -45,7 +44,7 @@ buildPythonPackage rec {
     description = "Library for the LD2410B modules from HiLinks";
     homepage = "https://github.com/930913/ld2410-ble";
     changelog = "https://github.com/930913/ld2410-ble/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/mailchecker/default.nix b/pkgs/development/python-modules/mailchecker/default.nix
index 5d11aeb2bbb7..c105952bf3a8 100644
--- a/pkgs/development/python-modules/mailchecker/default.nix
+++ b/pkgs/development/python-modules/mailchecker/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mailchecker";
-  version = "6.0.13";
+  version = "6.0.14";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-03Qew5vfLGkUFNw2Hg1nLwjiCkTXDNJy/QfiWc/bhjU=";
+    hash = "sha256-/FZwGXQwx46r1koP20LSRXxcqVQCEMWhkT2XlXhtKn0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/moat-ble/default.nix b/pkgs/development/python-modules/moat-ble/default.nix
index 26058cb0577a..fe8dbd54ca2a 100644
--- a/pkgs/development/python-modules/moat-ble/default.nix
+++ b/pkgs/development/python-modules/moat-ble/default.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   home-assistant-bluetooth,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -13,31 +14,29 @@
 buildPythonPackage rec {
   pname = "moat-ble";
   version = "0.1.1";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
-    repo = pname;
+    repo = "moat-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-dy1Fm0Z1PUsPY8QTiXUcWSi+csFnTUsobSkA92m06QI=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-sensor-state-data
     home-assistant-bluetooth
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=moat_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "moat_ble" ];
 
@@ -45,7 +44,7 @@ buildPythonPackage rec {
     description = "Library for Moat BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/moat-ble";
     changelog = "https://github.com/Bluetooth-Devices/moat-ble/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/modbus-tk/default.nix b/pkgs/development/python-modules/modbus-tk/default.nix
index 5d82d3aec56c..d56deb1ff34d 100644
--- a/pkgs/development/python-modules/modbus-tk/default.nix
+++ b/pkgs/development/python-modules/modbus-tk/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "modbus-tk";
-  version = "1.1.3";
+  version = "1.1.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "modbus_tk";
     inherit version;
-    hash = "sha256-aQ+nu4bql4mSRl0tYci1rMY5zg6LgzoKqW1N0XLFZEo=";
+    hash = "sha256-aJd3ZusQRplz3VaigUvZgbhd0YC3kEMkh4bYgAjyWTs=";
   };
 
   build-system = [ setuptools ];
@@ -29,10 +29,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "modbus_tk" ];
 
-  meta = with lib; {
+  meta = {
     description = "Module for simple Modbus interactions";
     homepage = "https://github.com/ljean/modbus-tk";
-    license = licenses.lgpl21Only;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/mopeka-iot-ble/default.nix b/pkgs/development/python-modules/mopeka-iot-ble/default.nix
index 8798668d6c28..9f8432f5689b 100644
--- a/pkgs/development/python-modules/mopeka-iot-ble/default.nix
+++ b/pkgs/development/python-modules/mopeka-iot-ble/default.nix
@@ -6,6 +6,7 @@
   fetchFromGitHub,
   home-assistant-bluetooth,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -20,26 +21,24 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "bluetooth-devices";
-    repo = pname;
+    repo = "mopeka-iot-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-CKLC0p66JapE9qNePE11ttoGMVd4kA7g28kA+pYLXCE=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=mopeka_iot_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     home-assistant-bluetooth
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "mopeka_iot_ble" ];
 
@@ -47,7 +46,7 @@ buildPythonPackage rec {
     description = "Library for Mopeka IoT BLE devices";
     homepage = "https://github.com/bluetooth-devices/mopeka-iot-ble";
     changelog = "https://github.com/Bluetooth-Devices/mopeka-iot-ble/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/nodriver/default.nix b/pkgs/development/python-modules/nodriver/default.nix
index 86572a31b2e9..803d69c2f909 100644
--- a/pkgs/development/python-modules/nodriver/default.nix
+++ b/pkgs/development/python-modules/nodriver/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "nodriver";
-  version = "0.37";
+  version = "0.38.post1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FF/E0hNZvo26Urtgw+nBH5Rmk7UCaqAsckCLDMuCK0A=";
+    hash = "sha256-ffaA4wmwwPCH1KwBA1VnlLf63AgbYxguROD6J08o/4o=";
   };
 
   disabled = pythonOlder "3.9";
diff --git a/pkgs/development/python-modules/oauthenticator/default.nix b/pkgs/development/python-modules/oauthenticator/default.nix
index ec3a2607fd6e..4a1b92734351 100644
--- a/pkgs/development/python-modules/oauthenticator/default.nix
+++ b/pkgs/development/python-modules/oauthenticator/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "oauthenticator";
-  version = "17.2.0";
+  version = "17.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YovSUu5o4dJ2wO1hXEe6Hc0Mf7hIH24DefBi5JV3H6c=";
+    hash = "sha256-5dkMskEf/z3G/MFjNGgjPA4OAjlCLAh8dzTRaFBVuPM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/okta/default.nix b/pkgs/development/python-modules/okta/default.nix
index dc75dfd84b56..87bbf82c11b7 100644
--- a/pkgs/development/python-modules/okta/default.nix
+++ b/pkgs/development/python-modules/okta/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "okta";
-  version = "2.9.8";
+  version = "2.9.9";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RDnRiPsc4p5yI9jFzOtRI+r00tvska8x4uCSjl+cWvo=";
+    hash = "sha256-RgB1trUSAxrCpGJxyLt6lzQXHcVPVnqIUacynalUUzY=";
   };
 
   pythonRelaxDeps = [ "aenum" ];
diff --git a/pkgs/development/python-modules/oralb-ble/default.nix b/pkgs/development/python-modules/oralb-ble/default.nix
index 11eba7e06ab1..22498f872d6d 100644
--- a/pkgs/development/python-modules/oralb-ble/default.nix
+++ b/pkgs/development/python-modules/oralb-ble/default.nix
@@ -9,6 +9,7 @@
   home-assistant-bluetooth,
   poetry-core,
   pytest-asyncio,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
 }:
@@ -27,14 +28,9 @@ buildPythonPackage rec {
     hash = "sha256-e6L8HXpqOAHnEktIJ1N1atC5QXno669W3c/S7cISa48=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail " --cov=oralb_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     bleak
     bleak-retry-connector
     bluetooth-data-tools
@@ -44,6 +40,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest-asyncio
+    pytest-cov-stub
     pytestCheckHook
   ];
 
@@ -58,7 +55,7 @@ buildPythonPackage rec {
     description = "Library for Oral B BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/oralb-ble";
     changelog = "https://github.com/Bluetooth-Devices/oralb-ble/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/pdftotext/default.nix b/pkgs/development/python-modules/pdftotext/default.nix
index f16fd012e72c..a5d58d186fb8 100644
--- a/pkgs/development/python-modules/pdftotext/default.nix
+++ b/pkgs/development/python-modules/pdftotext/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pdftotext";
-  version = "2.2.2";
+  version = "3.0.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2a9aa89bc62022408781b39d188fabf5a3ad1103b6630f32c4e27e395f7966ee";
+    sha256 = "sha256-w2UrGRVOFFUVqL+pU/xhNjOO2SM3vcy7U/4NiAE7Gqo=";
   };
 
   buildInputs = [ poppler ];
diff --git a/pkgs/development/python-modules/pdoc/default.nix b/pkgs/development/python-modules/pdoc/default.nix
index a372d124ac3a..986965a927d8 100644
--- a/pkgs/development/python-modules/pdoc/default.nix
+++ b/pkgs/development/python-modules/pdoc/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pdoc";
-  version = "15.0.0";
+  version = "15.0.1";
   disabled = pythonOlder "3.9";
 
   pyproject = true;
@@ -24,10 +24,10 @@ buildPythonPackage rec {
     owner = "mitmproxy";
     repo = "pdoc";
     rev = "v${version}";
-    hash = "sha256-6XEcHhaKkxY/FU748f+OsTcSgrM4iQTmJAL8rJ3EqnY=";
+    hash = "sha256-HDrDGnK557EWbBQtsvDzTst3oV0NjLRm4ilXaxd6/j8=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   dependencies = [
     jinja2
diff --git a/pkgs/development/python-modules/plotnine/default.nix b/pkgs/development/python-modules/plotnine/default.nix
index f6f2a003b0cd..6fd63a35390c 100644
--- a/pkgs/development/python-modules/plotnine/default.nix
+++ b/pkgs/development/python-modules/plotnine/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "plotnine";
-  version = "0.14.3";
+  version = "0.14.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "has2k1";
     repo = "plotnine";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-hGgPW40PEkOV1Z7gaqHtbx1ybdtEFYyz8fYUBMZchmU=";
+    tag = "v${version}";
+    hash = "sha256-pNbnbzmY3WMCfmuvaVa0JRuyadlvnVCIx5jtni/VcVI=";
   };
 
   postPatch = ''
@@ -111,7 +111,7 @@ buildPythonPackage rec {
   meta = {
     description = "Grammar of graphics for Python";
     homepage = "https://plotnine.readthedocs.io/";
-    changelog = "https://github.com/has2k1/plotnine/releases/tag/v${version}";
+    changelog = "https://github.com/has2k1/plotnine/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ onny ];
   };
diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index 677b7f7a3c71..e99f07ab0062 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "24.12.0";
+  version = "24.12.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -27,8 +27,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "pontos";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-+zlc23NRTDtPRaRnnvlf0tb3kkk+0TYPxACBUR/JWvw=";
+    tag = "v${version}";
+    hash = "sha256-ezU525MPiQkW7nmm/SUdG1dsOfybosdlL1Uf1rHIDFE=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/proxmoxer/default.nix b/pkgs/development/python-modules/proxmoxer/default.nix
index 8f3ff8621fc8..957d3ce1aab3 100644
--- a/pkgs/development/python-modules/proxmoxer/default.nix
+++ b/pkgs/development/python-modules/proxmoxer/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "proxmoxer";
-  version = "2.1.0";
+  version = "2.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "proxmoxer";
     repo = "proxmoxer";
-    rev = "refs/tags/${version}";
-    hash = "sha256-bwNv9eBuatMAWZ/ZOoF4VUZFIYAxJDEEwGQaAwPWcHY=";
+    tag = version;
+    hash = "sha256-56PccWOZiYLPSaJrFfOqP9kTuHqqhgiF1DpnNgFSabI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycrdt/Cargo.lock b/pkgs/development/python-modules/pycrdt/Cargo.lock
index 3ed87e9cc77a..c2e62969d489 100644
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@@ -106,9 +106,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "486f806e73c5707928240ddc295403b1b93c96a02038563881c4a2fd84b81ac4"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 dependencies = [
  "getrandom",
 ]
@@ -152,9 +152,9 @@ checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
 
 [[package]]
 name = "js-sys"
-version = "0.3.74"
+version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a865e038f7f6ed956f788f0d7d60c541fff74c7bd74272c5d4cf15c63743e705"
+checksum = "6717b6b5b077764fb5966237269cb3c64edddde4b14ce42647430a78ced9e7b7"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -162,9 +162,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.167"
+version = "0.2.168"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09d6582e104315a817dff97f75133544b2e094ee22447d2acf4a74e189ba06fc"
+checksum = "5aaeb2981e0606ca11d79718f8bb01164f1d6ed75080182d3abf017e6d244b6d"
 
 [[package]]
 name = "lock_api"
@@ -245,7 +245,7 @@ dependencies = [
 
 [[package]]
 name = "pycrdt"
-version = "0.10.8"
+version = "0.10.9"
 dependencies = [
  "pyo3",
  "yrs",
@@ -253,9 +253,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.22.6"
+version = "0.23.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f402062616ab18202ae8319da13fa4279883a2b8a9d9f83f20dbade813ce1884"
+checksum = "e484fd2c8b4cb67ab05a318f1fd6fa8f199fcc30819f08f07d200809dba26c15"
 dependencies = [
  "cfg-if",
  "indoc",
@@ -271,9 +271,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.22.6"
+version = "0.23.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b14b5775b5ff446dd1056212d778012cbe8a0fbffd368029fd9e25b514479c38"
+checksum = "dc0e0469a84f208e20044b98965e1561028180219e35352a2afaf2b942beff3b"
 dependencies = [
  "once_cell",
  "target-lexicon",
@@ -281,9 +281,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.22.6"
+version = "0.23.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ab5bcf04a2cdcbb50c7d6105de943f543f9ed92af55818fd17b660390fc8636"
+checksum = "eb1547a7f9966f6f1a0f0227564a9945fe36b90da5a93b3933fc3dc03fae372d"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -291,9 +291,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.22.6"
+version = "0.23.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fd24d897903a9e6d80b968368a34e1525aeb719d568dba8b3d4bfa5dc67d453"
+checksum = "fdb6da8ec6fa5cedd1626c886fc8749bdcbb09424a86461eb8cdf096b7c33257"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -303,9 +303,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.22.6"
+version = "0.23.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36c011a03ba1e50152b4b394b479826cad97e7a21eb52df179cd91ac411cbfbe"
+checksum = "38a385202ff5a92791168b1136afae5059d3ac118457bb7bc304c197c2d33e7d"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -325,9 +325,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.7"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
+checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
 dependencies = [
  "bitflags",
 ]
@@ -346,18 +346,18 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "serde"
-version = "1.0.215"
+version = "1.0.216"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
+checksum = "0b9781016e935a97e8beecf0c933758c97a5520d32930e460142b4cd80c6338e"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.215"
+version = "1.0.216"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
+checksum = "46f859dbbf73865c6627ed570e78961cd3ac92407a2d117204c49232485da55e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -448,9 +448,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d15e63b4482863c109d70a7b8706c1e364eb6ea449b201a76c5b89cedcec2d5c"
+checksum = "a474f6281d1d70c17ae7aa6a613c87fce69a127e2624002df63dcb39d6cf6396"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -459,13 +459,12 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d36ef12e3aaca16ddd3f67922bc63e48e953f126de60bd33ccc0101ef9998cd"
+checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79"
 dependencies = [
  "bumpalo",
  "log",
- "once_cell",
  "proc-macro2",
  "quote",
  "syn",
@@ -474,9 +473,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "705440e08b42d3e4b36de7d66c944be628d579796b8090bfa3471478a2260051"
+checksum = "2cc6181fd9a7492eef6fef1f33961e3695e4579b9872a6f7c83aee556666d4fe"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -484,9 +483,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98c9ae5a76e46f4deecd0f0255cc223cfa18dc9b261213b8aa0c7b36f61b3f1d"
+checksum = "30d7a95b763d3c45903ed6c81f156801839e5ee968bb07e534c44df0fcd330c2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -497,9 +496,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.97"
+version = "0.2.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ee99da9c5ba11bd675621338ef6fa52296b76b83305e9b6e5c77d4c286d6d49"
+checksum = "943aab3fdaaa029a6e0271b35ea10b72b943135afe9bffca82384098ad0e06a6"
 
 [[package]]
 name = "windows-targets"
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index 553393f3a1d6..f1a12eef0e4e 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "pycrdt";
-  version = "0.10.8";
+  version = "0.10.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-server";
     repo = "pycrdt";
     tag = version;
-    hash = "sha256-5ukP2J9Mm7yRVXZ6x5VbArF5GDxQvRvOpKEwiySzPV8=";
+    hash = "sha256-G0hmjSm1AP7CbnhT56Pxb/vVOQVGxSS4W4/CMGAeP7c=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyquil/default.nix b/pkgs/development/python-modules/pyquil/default.nix
index efc9368907df..0e2d63d80c50 100644
--- a/pkgs/development/python-modules/pyquil/default.nix
+++ b/pkgs/development/python-modules/pyquil/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "pyquil";
-  version = "4.14.3";
+  version = "4.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -33,8 +33,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "rigetti";
     repo = "pyquil";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-kGrOvec2q1GoVweu5tTbz8kvnjG6RAfjlF64Uf3RTxw=";
+    tag = "v${version}";
+    hash = "sha256-zRXIMSgcFlTZQ5Y/1pSC30ZhvKj1Pn1+7SbTetEdzio=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pytest-ansible/default.nix b/pkgs/development/python-modules/pytest-ansible/default.nix
index bc8106a999a6..0ddb147a32a0 100644
--- a/pkgs/development/python-modules/pytest-ansible/default.nix
+++ b/pkgs/development/python-modules/pytest-ansible/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-ansible";
-  version = "24.9.0";
+  version = "24.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,8 +24,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ansible";
     repo = "pytest-ansible";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-OlRWtKMgcZCDCFcUl3YXzG/ERPfx2KBEaKNf0strgCU=";
+    tag = "v${version}";
+    hash = "sha256-Z0pgWptr/bDGZCMi0l8J+q39d3zwBHfawNeJtELHo0E=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/qingping-ble/default.nix b/pkgs/development/python-modules/qingping-ble/default.nix
index 949ebbd187b8..6ee88b655f6f 100644
--- a/pkgs/development/python-modules/qingping-ble/default.nix
+++ b/pkgs/development/python-modules/qingping-ble/default.nix
@@ -5,6 +5,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -13,31 +14,29 @@
 buildPythonPackage rec {
   pname = "qingping-ble";
   version = "0.10.0";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "bluetooth-devices";
-    repo = pname;
+    repo = "qingping-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-5w3KGJLdHFv6kURKTz3YImZNjaETiVqbbJTJpBSLSo8=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=qingping_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "qingping_ble" ];
 
@@ -45,7 +44,7 @@ buildPythonPackage rec {
     description = "Library for Qingping BLE devices";
     homepage = "https://github.com/bluetooth-devices/qingping-ble";
     changelog = "https://github.com/Bluetooth-Devices/qingping-ble/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/rapt-ble/default.nix b/pkgs/development/python-modules/rapt-ble/default.nix
index a72e0f68d657..488d4318278b 100644
--- a/pkgs/development/python-modules/rapt-ble/default.nix
+++ b/pkgs/development/python-modules/rapt-ble/default.nix
@@ -6,6 +6,7 @@
   fetchFromGitHub,
   home-assistant-bluetooth,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -14,32 +15,30 @@
 buildPythonPackage rec {
   pname = "rapt-ble";
   version = "0.1.2";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "sairon";
-    repo = pname;
+    repo = "rapt-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-ozZwVgTV/xYl1nXLiybcPs6DQKocNdbxTEYDfYyQuvY=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=rapt_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     home-assistant-bluetooth
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "rapt_ble" ];
 
@@ -47,7 +46,7 @@ buildPythonPackage rec {
     description = "Library for RAPT Pill hydrometer BLE devices";
     homepage = "https://github.com/sairon/rapt-ble";
     changelog = "https://github.com/sairon/rapt-ble/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/rocketchat-api/default.nix b/pkgs/development/python-modules/rocketchat-api/default.nix
index b5b527b2b402..d10f94d72f31 100644
--- a/pkgs/development/python-modules/rocketchat-api/default.nix
+++ b/pkgs/development/python-modules/rocketchat-api/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "rocketchat-api";
-  version = "1.33.0";
+  version = "1.34.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jadolg";
     repo = "rocketchat_API";
-    rev = "refs/tags/${version}";
-    hash = "sha256-t1t0uksmdPTrksDF0K3/f3KxAv0fX2W8wDIIcWAPEVs=";
+    tag = version;
+    hash = "sha256-ny/VybQDZFB4ZxHEnDP2IeYsHjgO9pAk4r0vpX+hWVE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ruuvitag-ble/default.nix b/pkgs/development/python-modules/ruuvitag-ble/default.nix
index 629e3c539954..3727519c563f 100644
--- a/pkgs/development/python-modules/ruuvitag-ble/default.nix
+++ b/pkgs/development/python-modules/ruuvitag-ble/default.nix
@@ -6,6 +6,7 @@
   fetchFromGitHub,
   hatchling,
   home-assistant-bluetooth,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -14,39 +15,37 @@
 buildPythonPackage rec {
   pname = "ruuvitag-ble";
   version = "0.1.2";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
-    repo = pname;
+    repo = "ruuvitag-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-J+807p2mE+VZ0oqldFtjdcNGsRTkAU54s6byQSGrng4=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     home-assistant-bluetooth
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=ruuvitag_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "ruuvitag_ble" ];
 
   meta = with lib; {
     description = "Library for Ruuvitag BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/ruuvitag-ble";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/sensirion-ble/default.nix b/pkgs/development/python-modules/sensirion-ble/default.nix
index 8dea1faea5e9..17e583d6b0f0 100644
--- a/pkgs/development/python-modules/sensirion-ble/default.nix
+++ b/pkgs/development/python-modules/sensirion-ble/default.nix
@@ -1,21 +1,23 @@
 {
   lib,
+  bluetooth-data-tools,
+  bluetooth-sensor-state-data,
   buildPythonPackage,
   fetchFromGitHub,
   hatchling,
-  bluetooth-data-tools,
-  bluetooth-sensor-state-data,
   home-assistant-bluetooth,
-  sensor-state-data,
+  pytest-cov-stub,
+  pytestCheckHook,
   pythonOlder,
+  sensor-state-data,
 }:
 
 buildPythonPackage rec {
   pname = "sensirion-ble";
   version = "0.1.1";
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "akx";
@@ -24,20 +26,20 @@ buildPythonPackage rec {
     hash = "sha256-VeUfrQ/1Hqs9yueUKcv/ZpCDEEy84VDcZpuTT4fXSGw=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=sensirion_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  build-system = [ hatchling ];
 
-  nativeBuildInputs = [ hatchling ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     home-assistant-bluetooth
     sensor-state-data
   ];
 
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
   pythonImportsCheck = [ "sensirion_ble" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/sensorpro-ble/default.nix b/pkgs/development/python-modules/sensorpro-ble/default.nix
index 4a730bf48d92..edf61cf40ef8 100644
--- a/pkgs/development/python-modules/sensorpro-ble/default.nix
+++ b/pkgs/development/python-modules/sensorpro-ble/default.nix
@@ -5,6 +5,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -13,31 +14,29 @@
 buildPythonPackage rec {
   pname = "sensorpro-ble";
   version = "0.5.3";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
-    repo = pname;
+    repo = "sensorpro-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-Zqa6qa0Jw79Iu4VEw6KN0GsZcC1X7OpiYUiyT4zwKyY=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=sensorpro_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "sensorpro_ble" ];
 
@@ -45,7 +44,7 @@ buildPythonPackage rec {
     description = "Library for Sensorpro BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/sensorpro-ble";
     changelog = "https://github.com/Bluetooth-Devices/sensorpro-ble/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/thermobeacon-ble/default.nix b/pkgs/development/python-modules/thermobeacon-ble/default.nix
index d6546fca8153..e3ea50474612 100644
--- a/pkgs/development/python-modules/thermobeacon-ble/default.nix
+++ b/pkgs/development/python-modules/thermobeacon-ble/default.nix
@@ -5,6 +5,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -24,20 +25,18 @@ buildPythonPackage rec {
     hash = "sha256-XeLTY78zg+5HR+GH9bHl2t86ifcWm7AA4zSwJOknsdc=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=thermobeacon_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  build-system = [ poetry-core ];
 
-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "thermobeacon_ble" ];
 
@@ -45,7 +44,7 @@ buildPythonPackage rec {
     description = "Library for Thermobeacon BLE devices";
     homepage = "https://github.com/bluetooth-devices/thermobeacon-ble";
     changelog = "https://github.com/Bluetooth-Devices/thermobeacon-ble/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/thermopro-ble/default.nix b/pkgs/development/python-modules/thermopro-ble/default.nix
index 1308da232617..ff83d59a08a3 100644
--- a/pkgs/development/python-modules/thermopro-ble/default.nix
+++ b/pkgs/development/python-modules/thermopro-ble/default.nix
@@ -5,6 +5,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -13,31 +14,29 @@
 buildPythonPackage rec {
   pname = "thermopro-ble";
   version = "0.10.0";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "bluetooth-devices";
-    repo = pname;
+    repo = "thermopro-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-xaRbp9XLCDGJ0NE0TzJygn2OzqvSFszs97vGHawCkzU=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-data-tools
     bluetooth-sensor-state-data
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=thermopro_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "thermopro_ble" ];
 
@@ -45,7 +44,7 @@ buildPythonPackage rec {
     description = "Library for Thermopro BLE devices";
     homepage = "https://github.com/bluetooth-devices/thermopro-ble";
     changelog = "https://github.com/Bluetooth-Devices/thermopro-ble/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/tilt-ble/default.nix b/pkgs/development/python-modules/tilt-ble/default.nix
index 11c8961308b7..4f9813e806e9 100644
--- a/pkgs/development/python-modules/tilt-ble/default.nix
+++ b/pkgs/development/python-modules/tilt-ble/default.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   home-assistant-bluetooth,
   poetry-core,
+  pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
   sensor-state-data,
@@ -13,31 +14,29 @@
 buildPythonPackage rec {
   pname = "tilt-ble";
   version = "0.2.4";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
-    repo = pname;
+    repo = "tilt-ble";
     rev = "refs/tags/v${version}";
     hash = "sha256-ok9XWx47hcke535480NORfS1pSagaOJvMR48lYTa/Tg=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bluetooth-sensor-state-data
     home-assistant-bluetooth
     sensor-state-data
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=tilt_ble --cov-report=term-missing:skip-covered" ""
-  '';
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "tilt_ble" ];
 
@@ -45,7 +44,7 @@ buildPythonPackage rec {
     description = "Library for Tilt BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/tilt-ble";
     changelog = "https://github.com/Bluetooth-Devices/tilt-ble/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/treescope/default.nix b/pkgs/development/python-modules/treescope/default.nix
index 48af7dc2c553..d5e95260d9a8 100644
--- a/pkgs/development/python-modules/treescope/default.nix
+++ b/pkgs/development/python-modules/treescope/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "treescope";
-  version = "0.1.6";
+  version = "0.1.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google-deepmind";
     repo = "treescope";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-QlCKdsQk9VzRNnQKqWUIt6drocx++Aq34cMmZTw0UZw=";
+    tag = "v${version}";
+    hash = "sha256-fDwiKKXgisJ4Z/CBv4Vwtd7QaGscu5teZo11mSGZjbE=";
   };
 
   build-system = [ flit-core ];
@@ -58,7 +58,7 @@ buildPythonPackage rec {
   meta = {
     description = "An interactive HTML pretty-printer for machine learning research in IPython notebooks";
     homepage = "https://github.com/google-deepmind/treescope";
-    changelog = "https://github.com/google-deepmind/treescope/releases/tag/v${version}";
+    changelog = "https://github.com/google-deepmind/treescope/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
diff --git a/pkgs/development/python-modules/types-awscrt/default.nix b/pkgs/development/python-modules/types-awscrt/default.nix
index c1f4dd5c1661..9ecb88d1e82c 100644
--- a/pkgs/development/python-modules/types-awscrt/default.nix
+++ b/pkgs/development/python-modules/types-awscrt/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "types-awscrt";
-  version = "0.23.3";
+  version = "0.23.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "types_awscrt";
     inherit version;
-    hash = "sha256-BDwK4P5dJyYYKUy+rxw0mmVKn3wAEhvmTSdIaTOsSiY=";
+    hash = "sha256-sbm7EPM34/6PX1CIYOs1TZ/gk/AuFIWVWp4L3U4lAHQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/xarray-dataclasses/default.nix b/pkgs/development/python-modules/xarray-dataclasses/default.nix
index 09205ea9e177..9dcbfd001c77 100644
--- a/pkgs/development/python-modules/xarray-dataclasses/default.nix
+++ b/pkgs/development/python-modules/xarray-dataclasses/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "xarray-dataclasses";
-  version = "1.8.0";
+  version = "1.9.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "astropenguin";
     repo = "xarray-dataclasses";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-NZBWq1G63yef6h9TjRBfCqPzhaks0Cm7bUCJfIIpmcE=";
+    tag = "v${version}";
+    hash = "sha256-p9xV9Mpk5fsWR8X6VWNaeRi66OqK4QQWA8pwD2aYqOU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/ocaml/dune/3.nix b/pkgs/development/tools/ocaml/dune/3.nix
index 289f81af5702..0cadd4fb20e0 100644
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@@ -6,11 +6,11 @@ else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "3.16.1";
+  version = "3.17.0";
 
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    hash = "sha256-t4GuIPh2E8KhG9BxeAngBHDILWFeFSZPmmTgMwUaw94=";
+    hash = "sha256-LDqmxB7Tnj1sGiktdfSAa9gDEIQa/FFnOqWc6cgWUHw=";
   };
 
   nativeBuildInputs = [ ocaml findlib ];
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 9a5b34e742ad..2b4a130467ea 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -124,6 +124,7 @@ let
             PSI = lib.mkForce (option no);
             RT_GROUP_SCHED = lib.mkForce (option no);
             SCHED_AUTOGROUP = lib.mkForce (option no);
+            SCHED_CLASS_EXT = lib.mkForce (option no);
             SCHED_CORE = lib.mkForce (option no);
             UCLAMP_TASK = lib.mkForce (option no);
             UCLAMP_TASK_GROUP = lib.mkForce (option no);
diff --git a/pkgs/servers/home-assistant/custom-components/moonraker/package.nix b/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
index 84cdd06a9607..6da582239dad 100644
--- a/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "marcolivierarsenault";
   domain = "moonraker";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "marcolivierarsenault";
     repo = "moonraker-home-assistant";
     rev = "refs/tags/${version}";
-    hash = "sha256-LGpCT0a6mxbf0W6ucTIBhl9aNUd5/1dUk6M+CzRKuoU=";
+    hash = "sha256-vBsNpCCYLxL5T9LPRitR3a6mBRQwxoDtUDXzN0hCSTQ=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/mail/mailman/hyperkitty.nix b/pkgs/servers/mail/mailman/hyperkitty.nix
index 344970ebb564..05d265ba0284 100644
--- a/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -7,27 +7,27 @@
 with python3.pkgs;
 
 buildPythonPackage rec {
-  pname = "HyperKitty";
-  version = "1.3.9";
+  pname = "hyperkitty";
+  version = "1.3.12";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
 
   src = fetchurl {
     url = "https://gitlab.com/mailman/hyperkitty/-/releases/${version}/downloads/hyperkitty-${version}.tar.gz";
-    hash = "sha256-BfhCh4zZcfwoIfubW/+MUWXwh1yFOH/jpRdQdsj6lME=";
+    hash = "sha256-3rWCk37FvJ6pwdXYa/t2pNpCm2Dh/qb9aWTnxmfPFh0=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     pdm-backend
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     django
     django-gravatar2
     django-haystack
     django-mailman3
-    django-q
+    django-q2
     django-compressor
     django-extensions
     djangorestframework
diff --git a/pkgs/servers/mail/mailman/python.nix b/pkgs/servers/mail/mailman/python.nix
index 258cba0ab8b6..e107bd0bcea8 100644
--- a/pkgs/servers/mail/mailman/python.nix
+++ b/pkgs/servers/mail/mailman/python.nix
@@ -20,13 +20,12 @@ lib.fix (self: python3.override {
         [2] f931bc81d63f5cfda55ac73d754c87b3fd63b291
       */
 
-      # django-q tests fail with redis 5.0.0.
-      # https://gitlab.com/mailman/hyperkitty/-/issues/493
-      redis = super.redis.overridePythonAttrs ({ pname, ... }: rec {
-        version = "4.6.0";
-        src = fetchPypi {
-          inherit pname version;
-          hash = "sha256-WF3FFrnrBCphnvCjnD19Vf6BvbTfCaUsnN3g0Hvxqn0=";
+      # the redis python library only supports hiredis 3+ from version 5.1.0 onwards
+      hiredis = super.hiredis.overrideAttrs (new: { src, ... }: {
+        version = "3.1.0";
+        src = src.override {
+          rev = "refs/tags/v${new.version}";
+          hash = "sha256-ID5OJdARd2N2GYEpcYOpxenpZlhWnWr5fAClAgqEgGg=";
         };
       });
     })
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index 6f1ed7ef5cf1..a6492ff3fd96 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.66.0";
+  version = "1.67.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-y+SZedMYxO0AMSjA5sCz9ynY1N537PCJ8LT3Mx1N4eA=";
+    sha256 = "sha256-CaiqX6GVDZYI/sJi2EbxspSf0cpRJ0R+aGFZADQMuWk=";
   };
 
   vendorHash = "sha256-b3rvF91f/JoAAY6vut+NUCbuQAf2XsQn/n5mVLPnIoU=";
diff --git a/pkgs/tools/misc/watchexec/default.nix b/pkgs/tools/misc/watchexec/default.nix
index c4597d54c41d..c8a51356f015 100644
--- a/pkgs/tools/misc/watchexec/default.nix
+++ b/pkgs/tools/misc/watchexec/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "watchexec";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kbcSm1plh5QS87hGQj9OL1rq2eK6jbGn/kfjPF6kNzo=";
+    hash = "sha256-wm3zse5VqUNZ5d6ksCXXrngCcwrAniQbQqx9MOJoK58=";
   };
 
-  cargoHash = "sha256-xLUI7B7clpdJQOMDd32ag87yQ99XgbLgPqahPwUHMZQ=";
+  cargoHash = "sha256-92lvMka6IqzNAxvYSMUeiDfYw4uKZjjpkZOABq9Mypo=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index aab3406980d6..1ba5b2e8a7bc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11630,11 +11630,7 @@ with pkgs;
     nodejs = nodejs_18;
   };
 
-  mailmanPackages = callPackage ../servers/mail/mailman {
-    # Hyperkitty test fails with 3.12:
-    # https://gitlab.com/mailman/hyperkitty/-/issues/514
-    python3 = python311;
-  };
+  mailmanPackages = callPackage ../servers/mail/mailman { };
   inherit (mailmanPackages) mailman mailman-hyperkitty;
   mailman-web = mailmanPackages.web;
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 908abcee956a..a0ab0278b2d6 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -169,6 +169,7 @@ mapAliases ({
   django-mysql = throw "django-mysql has been removed, since it was an unused leaf package"; # added 2024-07-02
   django_nose = django-nose; # added 2023-07-25
   django-nose = throw "django-nose has been removed since it has not been maintained and there are no dependent packages"; # added 2024-05-21
+  django-q = throw "django-q has been removed because it is unmaintained and was unused"; # added 2024-12-13
   django_reversion = django-reversion; # added 2022-06-18
   django_polymorphic = django-polymorphic; # added 2022-05-24
   django_redis = django-redis; # added 2021-10-11
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b569050507b3..6ec1efb59e17 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3575,7 +3575,7 @@ self: super: with self; {
 
   django-pwa = callPackage ../development/python-modules/django-pwa { };
 
-  django-q = callPackage ../development/python-modules/django-q { };
+  django-q2 = callPackage ../development/python-modules/django-q2 { };
 
   django-scheduler = callPackage ../development/python-modules/django-scheduler { };