diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d1690081b374..7ad008549ac8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -18703,6 +18703,13 @@
     githubId = 34161949;
     keys = [ { fingerprint = "155C F413 0129 C058 9A5F  5524 3658 73F2 F0C6 153B"; } ];
   };
+  sanana = {
+    email = "asya@waifu.club";
+    github = "AsyaTheAbove";
+    githubId = 40492846;
+    keys = [ { fingerprint = "B766 7717 1644 5ABC DE82  94AA 4679 BF7D CC04 4783"; } ];
+    name = "sanana the skenana";
+  };
   sander = {
     email = "s.vanderburg@tudelft.nl";
     github = "svanderburg";
diff --git a/nixos/modules/services/continuous-integration/jenkins/slave.nix b/nixos/modules/services/continuous-integration/jenkins/slave.nix
index c0599a65b480..d5a6b93a6cf8 100644
--- a/nixos/modules/services/continuous-integration/jenkins/slave.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/slave.nix
@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
-with lib;
+
 let
+  inherit (lib) mkIf mkOption types;
   cfg = config.services.jenkinsSlave;
   masterCfg = config.services.jenkins;
 in {
@@ -47,16 +48,16 @@ in {
         '';
       };
 
-      javaPackage = mkPackageOption pkgs "jdk" { };
+      javaPackage = lib.mkPackageOption pkgs "jdk" { };
     };
   };
 
   config = mkIf (cfg.enable && !masterCfg.enable) {
-    users.groups = optionalAttrs (cfg.group == "jenkins") {
+    users.groups = lib.optionalAttrs (cfg.group == "jenkins") {
       jenkins.gid = config.ids.gids.jenkins;
     };
 
-    users.users = optionalAttrs (cfg.user == "jenkins") {
+    users.users = lib.optionalAttrs (cfg.user == "jenkins") {
       jenkins = {
         description = "jenkins user";
         createHome = true;
diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix
index 2bb9df15de2c..fcdb17333776 100644
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@@ -1,17 +1,17 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
+  inherit (lib) mkIf mkOption mkEnableOption types optional optionals;
+  inherit (lib.types) nullOr bool listOf str;
 
   cfg = config.services.i2pd;
 
   homeDir = "/var/lib/i2pd";
 
   strOpt = k: v: k + " = " + v;
-  boolOpt = k: v: k + " = " + boolToString v;
+  boolOpt = k: v: k + " = " + lib.boolToString v;
   intOpt = k: v: k + " = " + toString v;
-  lstOpt = k: xs: k + " = " + concatStringsSep "," xs;
+  lstOpt = k: xs: k + " = " + lib.concatStringsSep "," xs;
   optionalNullString = o: s: optional (s != null) (strOpt o s);
   optionalNullBool = o: b: optional (b != null) (boolOpt o b);
   optionalNullInt = o: i: optional (i != null) (intOpt o i);
@@ -54,7 +54,7 @@ let
   mkKeyedEndpointOpt = name: addr: port: keyloc:
     (mkEndpointOpt name addr port) // {
       keys = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = keyloc;
         description = ''
           File to persist ${lib.toUpper name} keys.
@@ -162,8 +162,8 @@ let
       (sec "meshnets")
       (boolOpt "yggdrasil" cfg.yggdrasil.enable)
     ] ++ (optionalNullString "yggaddress" cfg.yggdrasil.address)
-      ++ (flip map
-      (collect (proto: proto ? port && proto ? address) cfg.proto)
+      ++ (lib.flip map
+      (lib.collect (proto: proto ? port && proto ? address) cfg.proto)
       (proto: let protoOpts = [
         (sec proto.name)
         (boolOpt "enabled" proto.enable)
@@ -178,10 +178,10 @@ let
         ++ (optionals (proto ? outproxy) (optionalNullString "outproxy" proto.outproxy))
         ++ (optionals (proto ? outproxyPort) (optionalNullInt "outproxyport" proto.outproxyPort))
         ++ (optionals (proto ? outproxyEnable) (optionalNullBool "outproxy.enabled" proto.outproxyEnable));
-        in (concatStringsSep "\n" protoOpts)
+        in (lib.concatStringsSep "\n" protoOpts)
       ));
   in
-    pkgs.writeText "i2pd.conf" (concatStringsSep "\n" opts);
+    pkgs.writeText "i2pd.conf" (lib.concatStringsSep "\n" opts);
 
   tunnelConf = let
     mkOutTunnel = tun:
@@ -200,7 +200,7 @@ let
           ++ (optionals (tun ? outbound.quantity) (optionalNullInt "outbound.quantity" tun.outbound.quantity))
           ++ (optionals (tun ? crypto.tagsToSend) (optionalNullInt "crypto.tagstosend" tun.crypto.tagsToSend));
       in
-        concatStringsSep "\n" outTunOpts;
+        lib.concatStringsSep "\n" outTunOpts;
 
     mkInTunnel = tun:
       let
@@ -214,16 +214,16 @@ let
           ++ (optionals (tun ? inPort) (optionalNullInt "inport" tun.inPort))
           ++ (optionals (tun ? accessList) (optionalEmptyList "accesslist" tun.accessList));
       in
-        concatStringsSep "\n" inTunOpts;
+        lib.concatStringsSep "\n" inTunOpts;
 
-    allOutTunnels = collect (tun: tun ? port && tun ? destination) cfg.outTunnels;
-    allInTunnels = collect (tun: tun ? port && tun ? address) cfg.inTunnels;
+    allOutTunnels = lib.collect (tun: tun ? port && tun ? destination) cfg.outTunnels;
+    allInTunnels = lib.collect (tun: tun ? port && tun ? address) cfg.inTunnels;
 
     opts = [ notice ] ++ (map mkOutTunnel allOutTunnels) ++ (map mkInTunnel allInTunnels);
   in
-    pkgs.writeText "i2pd-tunnels.conf" (concatStringsSep "\n" opts);
+    pkgs.writeText "i2pd-tunnels.conf" (lib.concatStringsSep "\n" opts);
 
-  i2pdFlags = concatStringsSep " " (
+  i2pdFlags = lib.concatStringsSep " " (
     optional (cfg.address != null) ("--host=" + cfg.address) ++ [
     "--service"
     ("--conf=" + i2pdConf)
@@ -235,7 +235,7 @@ in
 {
 
   imports = [
-    (mkRenamedOptionModule [ "services" "i2pd" "extIp" ] [ "services" "i2pd" "address" ])
+    (lib.mkRenamedOptionModule [ "services" "i2pd" "extIp" ] [ "services" "i2pd" "address" ])
   ];
 
   ###### interface
@@ -252,7 +252,7 @@ in
         '';
       };
 
-      package = mkPackageOption pkgs "i2pd" { };
+      package = lib.mkPackageOption pkgs "i2pd" { };
 
       logLevel = mkOption {
         type = types.enum ["debug" "info" "warn" "error"];
@@ -269,7 +269,7 @@ in
       logCLFTime = mkEnableOption "full CLF-formatted date and time to log";
 
       address = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Your external IP or hostname.
@@ -277,7 +277,7 @@ in
       };
 
       family = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Specify a family the router belongs to.
@@ -285,7 +285,7 @@ in
       };
 
       dataDir = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Alternative path to storage of i2pd data (RI, keys, peer profiles, ...)
@@ -301,7 +301,7 @@ in
       };
 
       ifname = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Network interface to bind to.
@@ -309,7 +309,7 @@ in
       };
 
       ifname4 = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           IPv4 interface to bind to.
@@ -317,7 +317,7 @@ in
       };
 
       ifname6 = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           IPv6 interface to bind to.
@@ -325,7 +325,7 @@ in
       };
 
       ntcpProxy = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Proxy URL for NTCP transport.
@@ -399,7 +399,7 @@ in
       reseed.verify = mkEnableOption "SU3 signature verification";
 
       reseed.file = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Full path to SU3 file to reseed from.
@@ -407,7 +407,7 @@ in
       };
 
       reseed.urls = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         default = [];
         description = ''
           Reseed URLs.
@@ -415,7 +415,7 @@ in
       };
 
       reseed.floodfill = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Path to router info of floodfill to reseed from.
@@ -423,7 +423,7 @@ in
       };
 
       reseed.zipfile = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Path to local .zip file to reseed from.
@@ -431,7 +431,7 @@ in
       };
 
       reseed.proxy = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           URL for reseed proxy, supports http/socks.
@@ -446,7 +446,7 @@ in
         '';
       };
      addressbook.subscriptions = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         default = [
           "http://inr.i2p/export/alive-hosts.txt"
           "http://i2p-projekt.i2p/hosts.txt"
@@ -460,7 +460,7 @@ in
       trust.enable = mkEnableOption "explicit trust options";
 
       trust.family = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Router Family to trust for first hops.
@@ -468,7 +468,7 @@ in
       };
 
       trust.routers = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         default = [];
         description = ''
           Only connect to the listed routers.
@@ -543,7 +543,7 @@ in
       yggdrasil.enable = mkEnableOption "Yggdrasil";
 
       yggdrasil.address = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         default = null;
         description = ''
           Your local yggdrasil address. Specify it if you want to bind your router to a
@@ -572,7 +572,7 @@ in
         };
 
         strictHeaders = mkOption {
-          type = with types; nullOr bool;
+          type = nullOr bool;
           default = null;
           description = ''
             Enable strict host checking on WebUI.
@@ -580,7 +580,7 @@ in
         };
 
         hostname = mkOption {
-          type = with types; nullOr str;
+          type = nullOr str;
           default = null;
           description = ''
             Expected hostname for WebUI.
@@ -591,7 +591,7 @@ in
       proto.httpProxy = (mkKeyedEndpointOpt "httpproxy" "127.0.0.1" 4444 "httpproxy-keys.dat")
       // {
         outproxy = mkOption {
-          type = with types; nullOr str;
+          type = nullOr str;
           default = null;
           description = "Upstream outproxy bind address.";
         };
@@ -648,7 +648,7 @@ in
                 description = "Service port. Default to the tunnel's listen port.";
               };
               accessList = mkOption {
-                type = with types; listOf str;
+                type = listOf str;
                 default = [];
                 description = "I2P nodes that are allowed to connect to this service.";
               };
diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index defae3cf9617..1c5fe1a56a42 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -167,7 +167,8 @@ in
     asar
     copyDesktopItems
     # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
-    (buildPackages.wrapGAppsHook3.override { inherit (buildPackages) makeWrapper; })
+    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
   ];
 
   dontBuild = true;
diff --git a/pkgs/applications/networking/browsers/brave/make-brave.nix b/pkgs/applications/networking/browsers/brave/make-brave.nix
index e94e1a93bf72..2ea95693a9ae 100644
--- a/pkgs/applications/networking/browsers/brave/make-brave.nix
+++ b/pkgs/applications/networking/browsers/brave/make-brave.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wrapGAppsHook3, makeWrapper
+{ lib, stdenv, fetchurl, buildPackages
 , alsa-lib
 , at-spi2-atk
 , at-spi2-core
@@ -112,7 +112,9 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     dpkg
-    (wrapGAppsHook3.override { inherit makeWrapper; })
+    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/cluster/kubedb-cli/default.nix b/pkgs/applications/networking/cluster/kubedb-cli/default.nix
index 65be1f739ae3..f70dcee4682d 100644
--- a/pkgs/applications/networking/cluster/kubedb-cli/default.nix
+++ b/pkgs/applications/networking/cluster/kubedb-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubedb-cli";
-  version = "0.47.0";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "kubedb";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-C106krMg4vtRe78hh6emAGBxEApfc5ZorRgTtH+QZ9g=";
+    sha256 = "sha256-xqupDfcjCSP7uomBCuFlhCAOetZrvSiKehOgCqZKLLg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/kubevela/default.nix b/pkgs/applications/networking/cluster/kubevela/default.nix
index caa2519af57a..1c8b61851870 100644
--- a/pkgs/applications/networking/cluster/kubevela/default.nix
+++ b/pkgs/applications/networking/cluster/kubevela/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "kubevela";
-  version = "1.9.11";
+  version = "1.9.12";
 
   src = fetchFromGitHub {
     owner = "kubevela";
     repo = "kubevela";
     rev = "v${version}";
-    hash = "sha256-u9UGV1UwZoj4eSqqMLf8BvsfTFIYagoslN5pflDKm8c=";
+    hash = "sha256-AltyaV4tFW/3nOzEgWwlIqFXVaEtcpN5IxdFScZ7Nes=";
   };
 
-  vendorHash = "sha256-NnUZnlvVb2VmNx4HM8lkbTNcQA3/pctkg1UVpOY8Acs=";
+  vendorHash = "sha256-Ethbor1nZRYuemBL03QdnExNJtdOJ4w76sjLrBDW9Aw=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/applications/networking/cluster/pachyderm/default.nix b/pkgs/applications/networking/cluster/pachyderm/default.nix
index dee29c2fd9c2..56bad49da759 100644
--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pachyderm";
-  version = "2.11.2";
+  version = "2.11.3";
 
   src = fetchFromGitHub {
     owner = "pachyderm";
     repo = "pachyderm";
     rev = "v${version}";
-    hash = "sha256-CNYFaUZBUwa+RF4JFXSmsdHalCPeowM4FYeWBojOOjA=";
+    hash = "sha256-tn+wOd01zClMcANYTolXHTEMGohXGNnKbsZ5NA4kELc=";
   };
 
   vendorHash = "sha256-d2MSMucGMGGPLE0wh8Y27AUVPkeyOCkCa0JSPawYQmc=";
diff --git a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
index 9cfa239e081a..95ab2c39b21d 100644
--- a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
@@ -4,11 +4,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "rocketchat-desktop";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchurl {
     url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat-${version}-linux-amd64.deb";
-    hash = "sha256-SMpcsRKxx51O7cagDFIrp70QiAHaoAU5NhLHtog647g=";
+    hash = "sha256-6NvQtc+IUWqixFwWUHvl+SkSl0pk3SK4VmQXoZYyqqg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
index 49df94819656..97abf0e749f6 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
@@ -8,8 +8,7 @@
 , asar
 , rsync
 , python3
-, wrapGAppsHook3
-, makeWrapper
+, buildPackages
 , nixosTests
 , gtk3
 , atk
@@ -127,7 +126,9 @@ stdenv.mkDerivation rec {
     asar
     python3
     autoPatchelfHook
-    (wrapGAppsHook3.override { inherit makeWrapper; })
+    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/ktailctl/default.nix b/pkgs/applications/networking/ktailctl/default.nix
index d66e8586a6e3..ae8e63b0da2f 100644
--- a/pkgs/applications/networking/ktailctl/default.nix
+++ b/pkgs/applications/networking/ktailctl/default.nix
@@ -1,11 +1,11 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, buildGoModule
+, buildGo123Module
 , cmake
 , extra-cmake-modules
 , git
-, go
+, go_1_23
 , wrapQtAppsHook
 , qtbase
 , qtdeclarative
@@ -23,20 +23,20 @@
 }:
 
 let
-  version = "0.17.2";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-jACcTRIdzYiSLy7zw5QuDu9tZfee9ufhlEecbTbSr+4=";
+    hash = "sha256-tZnwn94qZyQ8JAC6Y1dDTmc7Cob+kMZnEaP7+EytbH8=";
   };
 
-  goDeps = (buildGoModule {
+  goDeps = (buildGo123Module {
     pname = "ktailctl-go-wrapper";
     inherit src version;
     modRoot = "src/wrapper";
-    vendorHash = "sha256-V4Bn5/VaoFOZlNGBedA4Ly8Kocw0BWyfIHv8IU6Eay4=";
+    vendorHash = "sha256-KdkvAPLnoC7DccRVIz7t/Ns71dnG59DpO5qwOhJk7qc=";
   }).goModules;
 in
 stdenv.mkDerivation {
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
     cmake
     extra-cmake-modules
     git
-    go
+    go_1_23
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/applications/office/appflowy/default.nix b/pkgs/applications/office/appflowy/default.nix
index f3a7ea76c533..0790cb44d1f3 100644
--- a/pkgs/applications/office/appflowy/default.nix
+++ b/pkgs/applications/office/appflowy/default.nix
@@ -25,7 +25,8 @@ let
       };
       aarch64-darwin = x86_64-darwin;
     }
-    ."${stdenvNoCC.hostPlatform.system}";
+    ."${stdenvNoCC.hostPlatform.system}"
+      or (throw "appflowy: No source for system: ${stdenvNoCC.hostPlatform.system}");
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "appflowy";
diff --git a/pkgs/applications/version-management/git-annex-remote-googledrive/default.nix b/pkgs/applications/version-management/git-annex-remote-googledrive/default.nix
index 72c0e48275ca..03bd655adcdc 100644
--- a/pkgs/applications/version-management/git-annex-remote-googledrive/default.nix
+++ b/pkgs/applications/version-management/git-annex-remote-googledrive/default.nix
@@ -6,24 +6,29 @@
 , gitpython
 , humanfriendly
 , tenacity
+, setuptools
+, distutils
 }:
 
 buildPythonApplication rec {
   pname = "git-annex-remote-googledrive";
   version = "1.3.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "0rwjcdvfgzdlfgrn1rrqwwwiqqzyh114qddrbfwd46ld5spry6r1";
   };
 
+  build-system = [ setuptools ];
+
   propagatedBuildInputs = [
     annexremote
     drivelib
     gitpython
     tenacity
     humanfriendly
+    distutils
   ];
 
   # while git-annex does come with a testremote command that *could* be used,
@@ -36,7 +41,7 @@ buildPythonApplication rec {
 
   meta = with lib; {
     description = "Git-annex special remote for Google Drive";
-    homepage = "https://pypi.org/project/git-annex-remote-googledrive/";
+    homepage = "https://github.com/Lykos153/git-annex-remote-googledrive";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ gravndal ];
     mainProgram = "git-annex-remote-googledrive";
diff --git a/pkgs/applications/version-management/gitkraken/default.nix b/pkgs/applications/version-management/gitkraken/default.nix
index 3e2206aa633b..7d35f1efbb58 100644
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@@ -37,7 +37,7 @@
   makeDesktopItem,
   openssl,
   wrapGAppsHook3,
-  makeShellWrapper,
+  buildPackages,
   at-spi2-atk,
   at-spi2-core,
   libuuid,
@@ -166,7 +166,9 @@ let
 
     nativeBuildInputs = [
       copyDesktopItems
-      (wrapGAppsHook3.override { makeWrapper = makeShellWrapper; })
+      # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+      # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+      (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
     ];
     buildInputs = [
       gtk3
diff --git a/pkgs/applications/video/anilibria-winmaclinux/default.nix b/pkgs/applications/video/anilibria-winmaclinux/default.nix
index 336931662171..8bb21ac9d43b 100644
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@@ -18,13 +18,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "2.2.18";
+  version = "2.2.19";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-gFIz2tkuBaC4DoN/oVNra5pQi23MAuhFJRGxEcZgvAo=";
+    hash = "sha256-f4AlTfLTn0GvBj3ztpkNPc6BDlLsEtz/yE5F2WfjU8U=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/by-name/bo/boxed-cpp/package.nix b/pkgs/by-name/bo/boxed-cpp/package.nix
index 442a27ed3374..3ce5a5c9c608 100644
--- a/pkgs/by-name/bo/boxed-cpp/package.nix
+++ b/pkgs/by-name/bo/boxed-cpp/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (final: {
   pname = "boxed-cpp";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "contour-terminal";
     repo = "boxed-cpp";
     rev = "v${final.version}";
-    hash = "sha256-Z/dfSa/6SnzLWnFCXjJUbTBNa5dFZna099Crbcya/Dw=";
+    hash = "sha256-uZ/wT159UuEcTUtoQyt0D59z2wnLT5KpeeCpjyij198=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/cu/cups-idprt-barcode/package.nix b/pkgs/by-name/cu/cups-idprt-barcode/package.nix
index 1f9bb0b168f9..a5e3a85b5a94 100644
--- a/pkgs/by-name/cu/cups-idprt-barcode/package.nix
+++ b/pkgs/by-name/cu/cups-idprt-barcode/package.nix
@@ -25,10 +25,13 @@ stdenvNoCC.mkDerivation {
 
   installPhase =
     let
-      arch = builtins.getAttr stdenvNoCC.hostPlatform.system {
-        x86_64-linux = "x64";
-        x86-linux = "x86";
-      };
+      arch =
+        {
+          x86_64-linux = "x64";
+          x86-linux = "x86";
+        }
+        ."${stdenvNoCC.hostPlatform.system}"
+          or (throw "cups-idprt-barcode: No prebuilt filters for system: ${stdenvNoCC.hostPlatform.system}");
     in
     ''
       runHook preInstall
diff --git a/pkgs/by-name/cu/cups-idprt-mt888/package.nix b/pkgs/by-name/cu/cups-idprt-mt888/package.nix
index 27441a467b30..0fa4fd146d06 100644
--- a/pkgs/by-name/cu/cups-idprt-mt888/package.nix
+++ b/pkgs/by-name/cu/cups-idprt-mt888/package.nix
@@ -25,10 +25,13 @@ stdenvNoCC.mkDerivation {
 
   installPhase =
     let
-      arch = builtins.getAttr stdenvNoCC.hostPlatform.system {
-        x86_64-linux = "x64";
-        x86-linux = "x86";
-      };
+      arch =
+        {
+          x86_64-linux = "x64";
+          x86-linux = "x86";
+        }
+        ."${stdenvNoCC.hostPlatform.system}"
+          or (throw "cups-idprt-mt888: No prebuilt filters for system: ${stdenvNoCC.hostPlatform.system}");
     in
     ''
       runHook preInstall
diff --git a/pkgs/by-name/cu/cups-idprt-mt890/package.nix b/pkgs/by-name/cu/cups-idprt-mt890/package.nix
index ca3baacbcfe4..96ca74b35ee6 100644
--- a/pkgs/by-name/cu/cups-idprt-mt890/package.nix
+++ b/pkgs/by-name/cu/cups-idprt-mt890/package.nix
@@ -25,10 +25,13 @@ stdenvNoCC.mkDerivation {
 
   installPhase =
     let
-      arch = builtins.getAttr stdenvNoCC.hostPlatform.system {
-        x86_64-linux = "x64";
-        x86-linux = "x86";
-      };
+      arch =
+        {
+          x86_64-linux = "x64";
+          x86-linux = "x86";
+        }
+        ."${stdenvNoCC.hostPlatform.system}"
+          or (throw "cups-idprt-mt890: No prebuilt filters for system: ${stdenvNoCC.hostPlatform.system}");
     in
     ''
       runHook preInstall
diff --git a/pkgs/by-name/cu/cups-idprt-sp900/package.nix b/pkgs/by-name/cu/cups-idprt-sp900/package.nix
index ed07c4fc36be..34243a325ee7 100644
--- a/pkgs/by-name/cu/cups-idprt-sp900/package.nix
+++ b/pkgs/by-name/cu/cups-idprt-sp900/package.nix
@@ -34,10 +34,13 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   installPhase =
     let
-      arch = builtins.getAttr stdenvNoCC.hostPlatform.system {
-        x86_64-linux = "x64";
-        x86-linux = "x86";
-      };
+      arch =
+        {
+          x86_64-linux = "x64";
+          x86-linux = "x86";
+        }
+        ."${stdenvNoCC.hostPlatform.system}"
+          or (throw "cups-idprt-sp900: No prebuilt filters for system: ${stdenvNoCC.hostPlatform.system}");
     in
     ''
       runHook preInstall
diff --git a/pkgs/by-name/cu/cups-idprt-tspl/package.nix b/pkgs/by-name/cu/cups-idprt-tspl/package.nix
index 60aa4c8c80d8..f165015c14f4 100644
--- a/pkgs/by-name/cu/cups-idprt-tspl/package.nix
+++ b/pkgs/by-name/cu/cups-idprt-tspl/package.nix
@@ -33,10 +33,13 @@ stdenvNoCC.mkDerivation {
 
   installPhase =
     let
-      arch = builtins.getAttr stdenvNoCC.hostPlatform.system {
-        x86_64-linux = "x64";
-        x86-linux = "x86";
-      };
+      arch =
+        {
+          x86_64-linux = "x64";
+          x86-linux = "x86";
+        }
+        ."${stdenvNoCC.hostPlatform.system}"
+          or (throw "cups-idprt-tspl: No prebuilt filters for system: ${stdenvNoCC.hostPlatform.system}");
     in
     ''
       runHook preInstall
diff --git a/pkgs/by-name/do/dokieli/package.json b/pkgs/by-name/do/dokieli/package.json
new file mode 100644
index 000000000000..39198309b812
--- /dev/null
+++ b/pkgs/by-name/do/dokieli/package.json
@@ -0,0 +1,104 @@
+{
+  "name": "dokieli",
+  "version": "0.3.1417",
+  "description": "dokieli is a clientside editor for decentralised article publishing, annotations, and social interactions.",
+  "main": "./src/dokieli.js",
+  "type": "module",
+  "scripts": {
+    "build-dist": "webpack --progress --color",
+    "build": "yarn build-dist",
+    "test": "TZ=UTC node --experimental-vm-modules node_modules/jest/bin/jest.js --silent",
+    "test:e2e": "playwright test",
+    "watch": "webpack --progress --color --watch",
+    "minify": "webpack --progress --color --env minimize",
+    "postinstall": "patch-package",
+    "lint": "eslint ."
+  },
+  "repository": "https://github.com/linkeddata/dokieli",
+  "keywords": [
+    "activitystreams",
+    "activitypub",
+    "annotations",
+    "authoring",
+    "decentralized",
+    "editor",
+    "knowledge graph",
+    "linked data",
+    "notifications",
+    "publishing",
+    "social web",
+    "web standards"
+  ],
+  "author": "dokieli team",
+  "license": "Apache-2.0",
+  "bugs": {
+    "url": "https://github.com/linkeddata/dokieli/issues"
+  },
+  "homepage": "https://dokie.li/",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "buffer": "^6.0.3",
+    "d3-force": "^3.0.0",
+    "d3-selection": "^3.0.0",
+    "diff": "^5.2.0",
+    "dompurify": "^3.1.5",
+    "fs": "^0.0.1-security",
+    "http-link-header": "^1.1.3",
+    "leaflet": "^1.9.4",
+    "leaflet-gpx": "^1.7.0",
+    "medium-editor": "^5.23.3",
+    "medium-editor-tables": "^0.6.1",
+    "micromark": "^4.0.0",
+    "micromark-extension-gfm": "^3.0.0",
+    "micromark-extension-gfm-tagfilter": "^2.0.0",
+    "rdf-parser-rdfa": "https://github.com/rdf-ext/rdf-parser-rdfa.git#master",
+    "rdf-store-ldp": "^0.3.1",
+    "shower": "https://github.com/shower/core.git#main",
+    "simplerdf": "^0.2.14",
+    "simplerdf-parse": "^0.1.3",
+    "solid-auth-client": "^2.5.6"
+  },
+  "devDependencies": {
+    "@axe-core/playwright": "^4.9.1",
+    "@playwright/test": "^1.44.1",
+    "babel-eslint": "^10.1.0",
+    "dotenv": "^16.4.5",
+    "eslint": "^9.10.0",
+    "eslint-plugin-jest": "^27.9.0",
+    "husky": "^9.0.11",
+    "jest": "^29.0.3",
+    "jest-environment-jsdom": "^29.0.3",
+    "patch-package": "^8.0.0",
+    "process": "^0.11.10",
+    "terser-webpack-plugin": "^5.3.3",
+    "webpack": "5.94.0",
+    "webpack-cli": "^5.0.1"
+  },
+  "resolutions": {
+    "ansi-regex": "^5.0.0",
+    "xmldom": "https://github.com/xmldom/xmldom.git#master",
+    "green-turtle": "https://github.com/csarven/green-turtle#master",
+    "json5": "^1.0.2",
+    "http-cache-semantics": "^4.1.1",
+    "jsonld": "^5.0.0",
+    "xml2js": "^0.6.2",
+    "semver": "^7.6.2",
+    "lru-cache": "^8.0.0",
+    "micromatch": "^4.0.8"
+  },
+  "standard": {
+    "globals": [
+      "DO",
+      "SimpleRDF",
+      "ld",
+      "describe",
+      "it",
+      "before",
+      "beforeEach",
+      "after",
+      "afterEach"
+    ]
+  }
+}
diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
new file mode 100644
index 000000000000..882f863ef97a
--- /dev/null
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  mkYarnPackage,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  makeWrapper,
+  nodejs,
+  xsel,
+}:
+
+mkYarnPackage rec {
+  pname = "dokieli";
+  version = "0-unstable-2024-09-23";
+
+  src = fetchFromGitHub {
+    owner = "linkeddata";
+    repo = "dokieli";
+    rev = "40ebbc60ba48d8b08f763b07befba96382c5f027";
+    hash = "sha256-lc96jOR8uXLcZFhN3wpSd9O5cUdKxllB8WWCh2oWuEw=";
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    hash = "sha256-TEXCCLFhpwHZJ8zRGsC7J6EwNaFpIi+CZ3L5uilebK4=";
+  };
+
+  packageJSON = ./package.json;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -r * $out
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postFixup = ''
+    makeWrapper ${nodejs}/bin/npx $out/bin/dokieli           \
+      --prefix PATH : ${
+        lib.makeBinPath ([
+          nodejs
+          xsel
+        ])
+      }   \
+      --add-flags serve                                      \
+      --chdir $out/deps/dokieli
+  '';
+
+  doDist = false;
+
+  meta = {
+    description = "dokieli is a clientside editor for decentralised article publishing, annotations and social interactions";
+    homepage = "https://github.com/linkeddata/dokieli";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ shogo ];
+    mainProgram = "dokieli";
+  };
+}
diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index cbd89cda3c21..88f8b5620b45 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -2,8 +2,7 @@
 , lib
 , fetchurl
 , autoPatchelfHook
-, wrapGAppsHook3
-, makeWrapper
+, buildPackages
 , gnome-keyring
 , libsecret
 , git
@@ -44,7 +43,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    (wrapGAppsHook3.override { inherit makeWrapper; })
+    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/gr/grafana-alloy/package.nix b/pkgs/by-name/gr/grafana-alloy/package.nix
index c09e7725b9ce..e465a4f66eba 100644
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -16,17 +16,17 @@
 
 buildGoModule rec {
   pname = "grafana-alloy";
-  version = "1.3.1";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "grafana";
     repo = "alloy";
-    hash = "sha256-6YjQUIHZmuguzqTeaLgkrM/WdBPZu/KUXUDOmEB7rNQ=";
+    hash = "sha256-/LCp4PUt85HR+ig0/v7KlS1cFcFGpI8TXHk3IlcEkvk=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-eMtwmADYbvpIm4FHTHieQ1i4xCty5xCwsZ/JD9r94/8=";
+  vendorHash = "sha256-fhUoQGNRoWNbU5U21X45s+eJ8XjCkvYULTRShyq0f3E=";
 
   nativeBuildInputs = [ fixup-yarn-lock yarn nodejs installShellFiles ];
 
@@ -55,9 +55,14 @@ buildGoModule rec {
     "."
   ];
 
+  # Skip building the frontend in the goModules FOD
+  overrideModAttrs = (_: {
+    preBuild = null;
+  });
+
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/internal/web/ui/yarn.lock";
-    hash = "sha256-Jk+zqR/+NBde9ywncIEJM4kgavqiDvcIAjxJCSMrZDc=";
+    hash = "sha256-Y0WcmjFtiNXue2kcJGlvHVBGmMLewGICISoRHnBPHGw=";
   };
 
   preBuild = ''
diff --git a/pkgs/tools/graphics/grim/default.nix b/pkgs/by-name/gr/grim/package.nix
similarity index 51%
rename from pkgs/tools/graphics/grim/default.nix
rename to pkgs/by-name/gr/grim/package.nix
index caea55766d1f..9055acb96dd8 100644
--- a/pkgs/tools/graphics/grim/default.nix
+++ b/pkgs/by-name/gr/grim/package.nix
@@ -1,33 +1,30 @@
-{ lib
-, stdenv
-, fetchFromSourcehut
-, pixman
-, libpng
-, libjpeg
-, meson
-, ninja
-, pkg-config
-, scdoc
-, wayland
-, wayland-protocols
-, wayland-scanner
+{
+  lib,
+  fetchFromSourcehut,
+  libjpeg,
+  libpng,
+  meson,
+  ninja,
+  pixman,
+  pkg-config,
+  scdoc,
+  stdenv,
+  wayland,
+  wayland-protocols,
+  wayland-scanner,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "grim";
   version = "1.4.1";
 
   src = fetchFromSourcehut {
     owner = "~emersion";
-    repo = pname;
-    rev = "v${version}";
+    repo = "grim";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-5csJqRLNqhyeXR4dEQtnPUSwuZ8oY+BIt6AVICkm1+o=";
   };
 
-  mesonFlags = [
-    "-Dwerror=false"
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -44,12 +41,16 @@ stdenv.mkDerivation rec {
     wayland-protocols
   ];
 
-  meta = with lib; {
-    description = "Grab images from a Wayland compositor";
+  mesonFlags = [ (lib.mesonBool "werror" false) ];
+
+  strictDeps = true;
+
+  meta = {
     homepage = "https://github.com/emersion/grim";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    description = "Grab images from a Wayland compositor";
+    license = lib.licenses.mit;
     mainProgram = "grim";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (wayland.meta) platforms;
   };
-}
+})
diff --git a/pkgs/by-name/ip/ipxe/package.nix b/pkgs/by-name/ip/ipxe/package.nix
index 85e3564f3cbb..baf3e92a60b0 100644
--- a/pkgs/by-name/ip/ipxe/package.nix
+++ b/pkgs/by-name/ip/ipxe/package.nix
@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2024-09-13";
+  version = "1.21.1-unstable-2024-09-27";
 
   nativeBuildInputs = [
     gnu-efi
@@ -66,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "c85ad1246890cf3c0c5f2ac6de06ab046ddd0043";
-    hash = "sha256-Py0mXcCj/NhVW3crngR9ZLHvH9N0QJeVmykc3k+yi6Y=";
+    rev = "3f4f843920afdc1d808a8b20354cf3eca481401a";
+    hash = "sha256-+Zpl8xhiWrnkFVL+DLuV0N9pn6hjw5JxDMxeDmfcNS4=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 92d62030ae79..7a891bcf107a 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -1,67 +1,115 @@
-# Builds limine with all available features.
-
+# Derivation containing the Limine host tool and the compiled bootloader
 {
-  # Helpers
-  stdenv
-, fetchurl
-, lib
-, # Dependencies
-  llvmPackages
-, mtools
-, nasm
+  fetchurl,
+  lib,
+  llvmPackages_18,
+  mtools,
+  nasm,
+  # The following options map to configure flags.
+  enableAll ? false,
+  buildCDs ? false,
+  targets ? [ ],
+  # x86 specific flags
+  biosSupport ? false,
+  pxeSupport ? false,
 }:
 
 let
-  version = "7.9.1";
+  llvmPackages = llvmPackages_18;
+  stdenv = llvmPackages.stdenv;
+
+  version = "8.0.13";
+
+  hasI686 =
+    (if targets == [ ] then stdenv.hostPlatform.isx86_32 else (builtins.elem "i686" targets))
+    || enableAll;
+
+  hasX86_64 =
+    (if targets == [ ] then stdenv.hostPlatform.isx86_64 else (builtins.elem "x86_64" targets))
+    || enableAll;
+
+  uefiFlags =
+    target:
+    {
+      aarch64 = [ "--enable-uefi-aarch64" ];
+      i686 = [ "--enable-uefi-ia32" ];
+      loongarch64 = [ "--enable-uefi-loongarch64" ];
+      riscv64 = [ "--enable-uefi-riscv64" ];
+      x86_64 = [ "--enable-uefi-x86-64" ];
+    }
+    .${target} or (throw "Unsupported target ${target}");
+
+  configureFlags =
+    lib.optionals enableAll [ "--enable-all" ]
+    ++ lib.optionals biosSupport [ "--enable-bios" ]
+    ++ lib.optionals (buildCDs && biosSupport) [ "--enable-bios-cd" ]
+    ++ lib.optionals buildCDs [ "--enable-uefi-cd" ]
+    ++ lib.optionals pxeSupport [ "--enable-bios-pxe" ]
+    ++ lib.concatMap uefiFlags (
+      if targets == [ ] then [ stdenv.hostPlatform.parsed.cpu.name ] else targets
+    );
 in
+
+assert lib.assertMsg (!(biosSupport && !hasI686)) "BIOS builds are possible only for x86";
+
+assert lib.assertMsg (!(pxeSupport && !hasI686)) "PXE builds are possible only for x86";
+
 # The output of the derivation is a tool to create bootable images using Limine
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation {
-  inherit version;
+  inherit version configureFlags;
   pname = "limine";
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/limine-bootloader/limine/releases/download/v${version}/limine-${version}.tar.gz";
-    hash = "sha256-cR6ilV5giwvbqUoOGbnXQnqZzUz/oL7OGZPYNoFKvy0=";
+    hash = "sha256-pg0tAn4YlfEzpyxb9QAAR0PApYmtnafMbIXfhHw+w3k=";
   };
 
-  nativeBuildInputs = [
-    llvmPackages.bintools
-    # gcc is used for the host tool, while clang is used for the bootloader.
-    llvmPackages.clang
-    llvmPackages.lld
-    mtools
-    nasm
+  hardeningDisable = [
+    # clang doesn't support this for RISC-V target
+    "zerocallusedregs"
   ];
 
-  configureFlags = [
-    "--enable-all"
+  nativeBuildInputs =
+    [
+      llvmPackages.libllvm
+      llvmPackages.lld
+    ]
+    ++ lib.optionals (enableAll || buildCDs) [
+      mtools
+    ]
+    ++ lib.optionals (hasI686 || hasX86_64) [ nasm ];
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+    "man"
   ];
 
-  installFlags = [ "destdir=$out" "manprefix=/share" ];
-
-  outputs = [ "out" "doc" "dev" "man" ];
-
   meta = with lib; {
     homepage = "https://limine-bootloader.org/";
     description = "Limine Bootloader";
-    # Caution. Some submodules have different licenses.
-    license = [
-      licenses.bsd2 # limine, flanterm
-      licenses.bsd0 # freestanding-toolchain, freestanding-headers
-      licenses.asl20 # cc-runtime
-      licenses.mit # limine-efi, stb
-      licenses.zlib # tinf
-    ];
-    # The platforms on that the Liminine binary and helper tools can run, not
+    mainProgram = "limine";
+    # The platforms on that the Limine binary and helper tools can run, not
     # necessarily the platforms for that bootable images can be created.
     platforms = platforms.unix;
     badPlatforms = platforms.darwin;
+    # Caution. Some submodules have different licenses.
+    license = [
+      licenses.asl20 # cc-runtime
+      licenses.bsd0 # freestanding-toolchain, freestanding-headers
+      licenses.bsd2 # limine, flanterm
+      licenses.mit # limine-efi, stb
+      licenses.zlib # tinf
+    ];
     maintainers = [
       maintainers._48cf
       maintainers.phip1611
+      maintainers.sanana
+      maintainers.surfaceflinger
     ];
   };
 }
diff --git a/pkgs/by-name/mc/mcdreforged/package.nix b/pkgs/by-name/mc/mcdreforged/package.nix
index 31c53dfbe3f7..d9c216271205 100644
--- a/pkgs/by-name/mc/mcdreforged/package.nix
+++ b/pkgs/by-name/mc/mcdreforged/package.nix
@@ -8,14 +8,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mcdreforged";
-  version = "2.13.1";
+  version = "2.13.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MCDReforged";
     repo = "MCDReforged";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Um4XSpkpJupBy5h/hUuHNyXnaDvjL1IIcmSqBHKycEM=";
+    hash = "sha256-4podJ3InBnNc+t4BpCQrg2QbJ9ZJr5fmroXyzo7JrZw=";
   };
 
   build-system = [ python3.pkgs.setuptools ];
diff --git a/pkgs/by-name/pa/paper-plane/package.nix b/pkgs/by-name/pa/paper-plane/package.nix
index 228c4aa638b0..2028e7a848f2 100644
--- a/pkgs/by-name/pa/paper-plane/package.nix
+++ b/pkgs/by-name/pa/paper-plane/package.nix
@@ -1,7 +1,6 @@
 { lib
 , fetchFromGitHub
 , gtk4
-, wrapGAppsHook3
 , libadwaita
 , tdlib
 , rlottie
@@ -18,6 +17,7 @@
 , libshumate
 , gst_all_1
 , darwin
+, buildPackages
 }:
 
 let
@@ -36,7 +36,7 @@ let
   gtk4-paperplane = gtk4.overrideAttrs (prev: {
     patches = (prev.patches or []) ++ [ "${src}/build-aux/gtk-reversed-list.patch" ];
   });
-  wrapPaperPlaneHook = wrapGAppsHook3.override {
+  wrapPaperPlaneHook = buildPackages.wrapGAppsHook3.override {
     gtk3 = gtk4-paperplane;
   };
   # libadwaita has gtk4 in propagatedBuildInputs so it must be overrided
diff --git a/pkgs/by-name/pe/peergos/package.nix b/pkgs/by-name/pe/peergos/package.nix
index 95a2d501cf37..3913938d025e 100644
--- a/pkgs/by-name/pe/peergos/package.nix
+++ b/pkgs/by-name/pe/peergos/package.nix
@@ -9,10 +9,10 @@
 
 stdenv.mkDerivation rec {
   pname = "peergos";
-  version = "0.19.0";
+  version = "0.20.0";
   src = fetchurl {
     url = "https://github.com/Peergos/web-ui/releases/download/v${version}/Peergos.jar";
-    hash = "sha256-GxJI33EVNSZfmrj5H70kwW9RE8YuJKt36qYmdWKtEJ8=";
+    hash = "sha256-Kk0ahAsvfTYkmVZTDE+QhyDFHQFY6lpWhmIOYBeJ1xk=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/pi/pipet/package.nix b/pkgs/by-name/pi/pipet/package.nix
index 6a49e7d3c934..335b6256d969 100644
--- a/pkgs/by-name/pi/pipet/package.nix
+++ b/pkgs/by-name/pi/pipet/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "pipet";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "bjesus";
     repo = "pipet";
     rev = version;
-    hash = "sha256-PqOx/aFI5gHt78th1nkSKlTGw/r1eU7Ggz5kvtjMCmI=";
+    hash = "sha256-NhqrNehmL6LLLEOVT/s2PdQ7HtSCfoM4MST1IHVrJXE=";
   };
 
   vendorHash = "sha256-jNIjF5jxcpNLAjuWo7OG/Ac4l6NpQNCKzYUgdAoL+C4=";
diff --git a/pkgs/by-name/po/podman-tui/package.nix b/pkgs/by-name/po/podman-tui/package.nix
index 7f4f84948f3a..c92ea01778d0 100644
--- a/pkgs/by-name/po/podman-tui/package.nix
+++ b/pkgs/by-name/po/podman-tui/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "podman-tui";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    hash = "sha256-Is4qpN6i8zBK0WNYbb/YhtzsrgOth9sQdUT81sx7i7g=";
+    hash = "sha256-ldFlW0QNjOvuJGyd2SzmMWA3ofS2ZW5krvCJRU83NXs=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/sa/sasquatch-v4be/package.nix b/pkgs/by-name/sa/sasquatch-v4be/package.nix
new file mode 100644
index 000000000000..10318b97045d
--- /dev/null
+++ b/pkgs/by-name/sa/sasquatch-v4be/package.nix
@@ -0,0 +1,3 @@
+{ sasquatch }:
+
+sasquatch.override { bigEndian = true; }
diff --git a/pkgs/by-name/sa/sasquatch/darwin.patch b/pkgs/by-name/sa/sasquatch/darwin.patch
new file mode 100644
index 000000000000..657971c5b0ab
--- /dev/null
+++ b/pkgs/by-name/sa/sasquatch/darwin.patch
@@ -0,0 +1,357 @@
+Patch based on commits by Dave Vasilevsky <dave@vasilevsky.ca> and
+Blake Riley <blake.riley@gmail.com>, squashed into a single patch,
+with BSD-specific changes omitted.
+
+See also https://github.com/plougher/squashfs-tools/pull/69.
+
+diff --git a/squashfs-tools/action.c b/squashfs-tools/action.c
+index ea2f604..9c979f8 100644
+--- a/squashfs-tools/action.c
++++ b/squashfs-tools/action.c
+@@ -39,6 +39,10 @@
+ #include <errno.h>
+ #include <ctype.h>
+ 
++#ifndef FNM_EXTMATCH /* glibc extension */
++	#define FNM_EXTMATCH 0
++#endif
++
+ #include "squashfs_fs.h"
+ #include "mksquashfs.h"
+ #include "action.h"
+@@ -2415,9 +2419,12 @@ static char *get_start(char *s, int n)
+ 
+ static int subpathname_fn(struct atom *atom, struct action_data *action_data)
+ {
+-	return fnmatch(atom->argv[0], get_start(strdupa(action_data->subpath),
++	char *path = strdup(action_data->subpath);
++	int is_match = fnmatch(atom->argv[0], get_start(path,
+ 		count_components(atom->argv[0])),
+ 		FNM_PATHNAME|FNM_EXTMATCH) == 0;
++	free(path);
++	return is_match;
+ }
+ 
+ /*
+diff --git a/squashfs-tools/info.c b/squashfs-tools/info.c
+index 216b979..eea2ec9 100644
+--- a/squashfs-tools/info.c
++++ b/squashfs-tools/info.c
+@@ -144,31 +144,22 @@ void dump_state()
+ void *info_thrd(void *arg)
+ {
+ 	sigset_t sigmask;
+-	struct timespec timespec = { .tv_sec = 1, .tv_nsec = 0 };
+-	int sig, waiting = 0;
++	int sig, err, waiting = 0;
+ 
+ 	sigemptyset(&sigmask);
+ 	sigaddset(&sigmask, SIGQUIT);
+ 	sigaddset(&sigmask, SIGHUP);
++	sigaddset(&sigmask, SIGALRM);
+ 
+ 	while(1) {
+-		if(waiting)
+-			sig = sigtimedwait(&sigmask, NULL, &timespec);
+-		else
+-			sig = sigwaitinfo(&sigmask, NULL);
++		err = sigwait(&sigmask, &sig);
+ 
+-		if(sig == -1) {
++		if(err == -1) {
+ 			switch(errno) {
+-			case EAGAIN:
+-				/* interval timed out */
+-				waiting = 0;
+-				/* FALLTHROUGH */
+ 			case EINTR:
+-				/* if waiting, the wait will be longer, but
+-				   that's OK */
+ 				continue;
+ 			default:
+-				BAD_ERROR("sigtimedwait/sigwaitinfo failed "
++				BAD_ERROR("sigwait failed "
+ 					"because %s\n", strerror(errno));
+ 			}
+ 		}
+@@ -179,8 +170,12 @@ void *info_thrd(void *arg)
+ 			/* set one second interval period, if ^\ received
+ 			   within then, dump queue and cache status */
+ 			waiting = 1;
+-		} else
++			alarm(1);
++		} else if (sig == SIGQUIT) {
+ 			dump_state();
++		} else if (sig == SIGALRM) {
++			waiting = 0;
++		}
+ 	}
+ }
+ 
+diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
+index 843f9f4..ed2c3a6 100644
+--- a/squashfs-tools/mksquashfs.c
++++ b/squashfs-tools/mksquashfs.c
+@@ -35,7 +35,12 @@
+ #include <stddef.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
++#ifndef linux
++#include <sys/sysctl.h>
++#else
++#include <sys/sysinfo.h>
+ #include <sys/sysmacros.h>
++#endif
+ #include <fcntl.h>
+ #include <errno.h>
+ #include <dirent.h>
+@@ -50,7 +55,10 @@
+ #include <sys/wait.h>
+ #include <limits.h>
+ #include <ctype.h>
+-#include <sys/sysinfo.h>
++
++#ifndef FNM_EXTMATCH /* glibc extension */
++	#define FNM_EXTMATCH 0
++#endif
+ 
+ #ifndef linux
+ #include <sys/sysctl.h>
+@@ -5064,6 +5072,7 @@ static void initialise_threads(int readq, int fragq, int bwriteq, int fwriteq,
+ 	sigemptyset(&sigmask);
+ 	sigaddset(&sigmask, SIGQUIT);
+ 	sigaddset(&sigmask, SIGHUP);
++	sigaddset(&sigmask, SIGALRM);
+ 	if(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) != 0)
+ 		BAD_ERROR("Failed to set signal mask in intialise_threads\n");
+ 
+@@ -5802,6 +5811,35 @@ static int get_physical_memory()
+ 	long long page_size = sysconf(_SC_PAGESIZE);
+ 	int phys_mem;
+ 
++#ifndef linux
++	#ifdef HW_MEMSIZE
++		#define SYSCTL_PHYSMEM HW_MEMSIZE
++	#elif defined(HW_PHYSMEM64)
++		#define SYSCTL_PHYSMEM HW_PHYSMEM64
++	#else
++		#define SYSCTL_PHYSMEM HW_PHYSMEM
++	#endif
++
++	int mib[2];
++	uint64_t sysctl_physmem = 0;
++	size_t sysctl_len = sizeof(sysctl_physmem);
++
++	mib[0] = CTL_HW;
++	mib[1] = SYSCTL_PHYSMEM;
++
++	if(sysctl(mib, 2, &sysctl_physmem, &sysctl_len, NULL, 0) == 0) {
++		/* some systems use 32-bit values, work with what we're given */
++		if (sysctl_len == 4)
++			sysctl_physmem = *(uint32_t*)&sysctl_physmem;
++		phys_mem = sysctl_physmem >> 20;
++	} else {
++		ERROR_START("Failed to get amount of available "
++			"memory.");
++		ERROR_EXIT("  Defaulting to least viable amount\n");
++		phys_mem = SQUASHFS_LOWMEM;
++	}
++  #undef SYSCTL_PHYSMEM
++#else
+ 	if(num_pages == -1 || page_size == -1) {
+ 		struct sysinfo sys;
+ 		int res = sysinfo(&sys);
+@@ -5814,6 +5852,7 @@ static int get_physical_memory()
+ 	}
+ 
+ 	phys_mem = num_pages * page_size >> 20;
++#endif
+ 
+ 	if(phys_mem < SQUASHFS_LOWMEM)
+ 		BAD_ERROR("Mksquashfs requires more physical memory than is "
+diff --git a/squashfs-tools/read_xattrs.c b/squashfs-tools/read_xattrs.c
+index 2067f80..ca8b7f4 100644
+--- a/squashfs-tools/read_xattrs.c
++++ b/squashfs-tools/read_xattrs.c
+@@ -31,13 +31,13 @@
+ #include <stdio.h>
+ #include <string.h>
+ 
++#include <stdlib.h>
++
+ #include "squashfs_fs.h"
+ #include "squashfs_swap.h"
+ #include "xattr.h"
+ #include "error.h"
+ 
+-#include <stdlib.h>
+-
+ extern int read_fs_bytes(int, long long, long long, void *);
+ extern int read_block(int, long long, long long *, int, void *);
+ 
+diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
+index d434b42..1208e45 100644
+--- a/squashfs-tools/unsquashfs.c
++++ b/squashfs-tools/unsquashfs.c
+@@ -32,8 +32,12 @@
+ #include "stdarg.h"
+ #include "fnmatch_compat.h"
+ 
++#ifndef linux
++#include <sys/sysctl.h>
++#else
+ #include <sys/sysinfo.h>
+ #include <sys/sysmacros.h>
++#endif
+ #include <sys/types.h>
+ #include <sys/time.h>
+ #include <sys/resource.h>
+@@ -1182,7 +1186,7 @@ int create_inode(char *pathname, struct inode *i)
+ 			break;
+ 		case SQUASHFS_SYMLINK_TYPE:
+ 		case SQUASHFS_LSYMLINK_TYPE: {
+-			struct timespec times[2] = {
++			struct timeval times[2] = {
+ 				{ i->time, 0 },
+ 				{ i->time, 0 }
+ 			};
+@@ -1201,8 +1205,7 @@ int create_inode(char *pathname, struct inode *i)
+ 				goto failed;
+ 			}
+ 
+-			res = utimensat(AT_FDCWD, pathname, times,
+-					AT_SYMLINK_NOFOLLOW);
++			res = lutimes(pathname, times);
+ 			if(res == -1) {
+ 				EXIT_UNSQUASH_STRICT("create_inode: failed to"
+ 					" set time on %s, because %s\n",
+@@ -2687,6 +2690,7 @@ void initialise_threads(int fragment_buffer_size, int data_buffer_size, int cat_
+ 		sigemptyset(&sigmask);
+ 		sigaddset(&sigmask, SIGQUIT);
+ 		sigaddset(&sigmask, SIGHUP);
++		sigaddset(&sigmask, SIGALRM);
+ 		if(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) != 0)
+ 			EXIT_UNSQUASH("Failed to set signal mask in initialise_threads\n");
+ 
+diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
+index 1099678..5b6a038 100644
+--- a/squashfs-tools/unsquashfs.h
++++ b/squashfs-tools/unsquashfs.h
+@@ -46,6 +46,10 @@
+ #include <sys/ioctl.h>
+ #include <sys/time.h>
+ 
++#ifndef FNM_EXTMATCH /* glibc extension */
++	#define FNM_EXTMATCH 0
++#endif
++
+ #include "endian_compat.h"
+ #include "squashfs_fs.h"
+ #include "unsquashfs_error.h"
+diff --git a/squashfs-tools/unsquashfs_info.c b/squashfs-tools/unsquashfs_info.c
+index e906eaf..f1e68c2 100644
+--- a/squashfs-tools/unsquashfs_info.c
++++ b/squashfs-tools/unsquashfs_info.c
+@@ -96,31 +96,22 @@ void dump_state()
+ void *info_thrd(void *arg)
+ {
+ 	sigset_t sigmask;
+-	struct timespec timespec = { .tv_sec = 1, .tv_nsec = 0 };
+-	int sig, waiting = 0;
++	int sig, err, waiting = 0;
+ 
+ 	sigemptyset(&sigmask);
+ 	sigaddset(&sigmask, SIGQUIT);
+ 	sigaddset(&sigmask, SIGHUP);
++	sigaddset(&sigmask, SIGALRM);
+ 
+ 	while(1) {
+-		if(waiting)
+-			sig = sigtimedwait(&sigmask, NULL, &timespec);
+-		else
+-			sig = sigwaitinfo(&sigmask, NULL);
++		err = sigwait(&sigmask, &sig);
+ 
+-		if(sig == -1) {
++		if(err == -1) {
+ 			switch(errno) {
+-			case EAGAIN:
+-				/* interval timed out */
+-				waiting = 0;
+-				/* FALLTHROUGH */
+ 			case EINTR:
+-				/* if waiting, the wait will be longer, but
+-				   that's OK */
+ 				continue;
+ 			default:
+-				BAD_ERROR("sigtimedwait/sigwaitinfo failed "
++				BAD_ERROR("sigwait failed "
+ 					"because %s\n", strerror(errno));
+ 			}
+ 		}
+@@ -132,8 +123,12 @@ void *info_thrd(void *arg)
+ 			/* set one second interval period, if ^\ received
+ 			   within then, dump queue and cache status */
+ 			waiting = 1;
+-		} else
++			alarm(1);
++		} else if (sig == SIGQUIT) {
+ 			dump_state();
++		} else if (sig == SIGALRM) {
++			waiting = 0;
++		}
+ 	}
+ }
+ 
+diff --git a/squashfs-tools/unsquashfs_xattr.c b/squashfs-tools/unsquashfs_xattr.c
+index 61910e1..73e0090 100644
+--- a/squashfs-tools/unsquashfs_xattr.c
++++ b/squashfs-tools/unsquashfs_xattr.c
+@@ -27,6 +27,11 @@
+ 
+ #include <sys/xattr.h>
+ 
++#ifdef XATTR_NOFOLLOW /* Apple's xattrs */
++	#define lsetxattr(path_, name_, val_, sz_, flags_) \
++		setxattr(path_, name_, val_, sz_, 0, flags_ | XATTR_NOFOLLOW)
++#endif
++
+ #define NOSPACE_MAX 10
+ 
+ extern int root_process;
+diff --git a/squashfs-tools/xattr.c b/squashfs-tools/xattr.c
+index b1c0089..6d7ed98 100644
+--- a/squashfs-tools/xattr.c
++++ b/squashfs-tools/xattr.c
+@@ -22,6 +22,14 @@
+  * xattr.c
+  */
+ 
++#ifndef linux
++#define __BYTE_ORDER BYTE_ORDER
++#define __BIG_ENDIAN BIG_ENDIAN
++#define __LITTLE_ENDIAN LITTLE_ENDIAN
++#else
++#include <endian.h>
++#endif
++
+ #define TRUE 1
+ #define FALSE 0
+ 
+@@ -36,6 +44,13 @@
+ #include <stdlib.h>
+ #include <sys/xattr.h>
+ 
++#ifdef XATTR_NOFOLLOW /* Apple's xattrs */
++	#define llistxattr(path_, buf_, sz_) \
++		listxattr(path_, buf_, sz_, XATTR_NOFOLLOW)
++	#define lgetxattr(path_, name_, val_, sz_) \
++		getxattr(path_, name_, val_, sz_, 0, XATTR_NOFOLLOW)
++#endif
++
+ #include "squashfs_fs.h"
+ #include "squashfs_swap.h"
+ #include "mksquashfs.h"
+-- 
+2.35.1
+
diff --git a/pkgs/by-name/sa/sasquatch/package.nix b/pkgs/by-name/sa/sasquatch/package.nix
new file mode 100644
index 000000000000..1c71a75452fb
--- /dev/null
+++ b/pkgs/by-name/sa/sasquatch/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  lz4,
+  lzo,
+  which,
+  xz,
+  zlib,
+  zstd,
+  bigEndian ? false,
+}:
+
+let
+  drv = stdenv.mkDerivation (finalAttrs: {
+    pname = "sasquatch";
+    version = "4.5.1-4";
+
+    src = fetchFromGitHub {
+      owner = "onekey-sec";
+      repo = "sasquatch";
+      rev = "sasquatch-v${finalAttrs.version}";
+      hash = "sha256-0itva+j5WMKvueiUaO253UQ1S6W29xgtFvV4i3yvMtU=";
+    };
+
+    patches = lib.optional stdenv.isDarwin ./darwin.patch;
+
+    strictDeps = true;
+    nativeBuildInputs = [ which ];
+    buildInputs = [
+      zlib
+      xz
+      zstd
+      lz4
+      lzo
+    ];
+
+    preBuild = ''
+      cd squashfs-tools
+    '';
+
+    installFlags = [
+      "INSTALL_DIR=${placeholder "out"}/bin"
+      "INSTALL_MANPAGES_DIR=${placeholder "out"}/share/man/man1"
+    ];
+
+    makeFlags = [
+      "GZIP_SUPPORT=1"
+      "LZ4_SUPPORT=1"
+      "LZMA_SUPPORT=1"
+      "LZO_SUPPORT=1"
+      "XZ_SUPPORT=1"
+      "ZSTD_SUPPORT=1"
+    ];
+
+    env.NIX_CFLAGS_COMPILE = lib.optionalString bigEndian "-DFIX_BE";
+
+    postInstall = lib.optionalString bigEndian ''
+      mv $out/bin/sasquatch{,-v4be}
+    '';
+
+    meta = {
+      homepage = "https://github.com/onekey-sec/sasquatch";
+      description = "Set of patches to the standard unsquashfs utility (part of squashfs-tools) that attempts to add support for as many hacked-up vendor-specific SquashFS implementations as possible";
+      license = lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [ vlaci ];
+      platforms = lib.platforms.unix;
+      mainProgram = if bigEndian then "sasquatch-v4be" else "sasquatch";
+    };
+  });
+in
+drv
diff --git a/pkgs/by-name/st/stackql/package.nix b/pkgs/by-name/st/stackql/package.nix
index f63f7fd718b8..fb0b02d559cd 100644
--- a/pkgs/by-name/st/stackql/package.nix
+++ b/pkgs/by-name/st/stackql/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "stackql";
-  version = "0.5.740";
+  version = "0.5.742";
 
   src = fetchFromGitHub {
     owner = "stackql";
     repo = "stackql";
     rev = "v${version}";
-    hash = "sha256-XwNz+O0FSNzWFiZvOUQCvcjg6L0f53c2ZaNiT8T0ikU=";
+    hash = "sha256-GMc22n0y4lKv4DlG9069p/TrMJLyw0Zdiykuo41Tgys=";
   };
 
   vendorHash = "sha256-dssGqcS9l3VipEypKErlCeRs087Tb5Kx4VXvkErZar4=";
diff --git a/pkgs/development/compilers/flix/default.nix b/pkgs/development/compilers/flix/default.nix
index 61fbdd6fe9d8..2bf6b754e297 100644
--- a/pkgs/development/compilers/flix/default.nix
+++ b/pkgs/development/compilers/flix/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "flix";
-  version = "0.50.0";
+  version = "0.51.0";
 
   src = fetchurl {
     url = "https://github.com/flix/flix/releases/download/v${version}/flix.jar";
-    sha256 = "sha256-fAEt7JsljnEXubYgiF8uEOuoOXHjv9AHgQbPunaEMw4=";
+    sha256 = "sha256-JeOw9mdmFAG0mMe8G/yanKCLPbCUPJxUBluNFFqjfbA=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/cuda-modules/tensorrt/fixup.nix b/pkgs/development/cuda-modules/tensorrt/fixup.nix
index 0d52c91320c4..aab6d8f32079 100644
--- a/pkgs/development/cuda-modules/tensorrt/fixup.nix
+++ b/pkgs/development/cuda-modules/tensorrt/fixup.nix
@@ -65,7 +65,7 @@ finalAttrs: prevAttrs: {
   # We need to look inside the extracted output to get the files we need.
   sourceRoot = "TensorRT-${finalAttrs.version}";
 
-  buildInputs = prevAttrs.buildInputs ++ [ finalAttrs.passthru.cudnn.lib ];
+  buildInputs = prevAttrs.buildInputs ++ [ (finalAttrs.passthru.cudnn.lib or null) ];
 
   preInstall =
     (prevAttrs.preInstall or "")
diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index 79c95c4d890c..b91fd89f80e4 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.7/6.7.2/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.7/6.7.3/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
index 68ef06921ac9..417aeaf9bb31 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
@@ -186,14 +186,14 @@ stdenv.mkDerivation rec {
     CoreBluetooth
   ]
   ++ lib.optional withGtk3 gtk3
-  ++ lib.optional (cups != null && lib.meta.availableOn stdenv.hostPlatform cups) cups
   ++ lib.optional (libmysqlclient != null && !stdenv.hostPlatform.isMinGW) libmysqlclient
   ++ lib.optional (postgresql != null && lib.meta.availableOn stdenv.hostPlatform postgresql) postgresql;
 
   nativeBuildInputs = [ bison flex gperf lndir perl pkg-config which cmake xmlstarlet ninja ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ moveBuildTree ];
 
-  propagatedNativeBuildInputs = [ lndir ];
+  propagatedNativeBuildInputs = [ lndir ]
+    ++ lib.optional (cups != null && lib.meta.availableOn stdenv.hostPlatform cups) cups;
 
   strictDeps = true;
 
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index 0475a67d56b8..c33fc9a4499d 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -5,13 +5,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.7.2";
+  version = "6.7.3";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     rev = "v${version}";
-    hash = "sha256-5OvU8I7hSnbBbu8OTrd0o2KSOyIMVfGGUSy4IsA85fA=";
+    hash = "sha256-QVLt1nhxYIMmmVY1rZ8pnkXNs0N6hp1o8rv33o8ptxM=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/modules/qtwayland.nix b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
index 17679c83a23f..771680233d16 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@@ -19,27 +19,6 @@ qtModule {
   nativeBuildInputs = [ pkg-config ];
 
   patches = [
-    # Included in qtwayland 6.7.3
-    # Fixes https://bugs.kde.org/show_bug.cgi?id=489259
-    (fetchpatch {
-      url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/92bcb8f6b7a852c7a5d662fc34de561692a7a454.diff";
-      sha256 = "sha256-XgGO8VnmQHLhUxTGf9CniwkCr5FsFiuUbnVP0NLNekI=";
-    })
-
-    # Included in qtwayland 6.7.3
-    # Fixes https://bugs.kde.org/show_bug.cgi?id=489072
-    (fetchpatch {
-      url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/c4f91b479303dda2e49499de249018d7c66c5f99.diff";
-      sha256 = "sha256-4rUdl6WuJHONW0Uy2wjTvyvDY3bJWeRvhk3tCkaOOro=";
-    })
-
-    # Included in qtwayland 6.7.3
-    # Fixes https://bugs.kde.org/show_bug.cgi?id=489180
-    (fetchpatch {
-      url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/632127d7f1d86cba4dd17361f24f9fd70a0ae44c.diff";
-      sha256 = "sha256-1EIcMj6+yIpqXAGZB3ZbrwRkl4n1o7TVP2SC1Nu1t78=";
-    })
-
     # Update wayland.xml to version 1.23.0
     (fetchpatch {
       url = "https://invent.kde.org/qt/qt/qtwayland/-/commit/c2f61bc47baacf2e6a44c6c3c4e4cbf0abfa4095.diff";
diff --git a/pkgs/development/libraries/qt-6/patches/0001-qtbase-qmake-always-use-libname-instead-of-absolute-.patch b/pkgs/development/libraries/qt-6/patches/0001-qtbase-qmake-always-use-libname-instead-of-absolute-.patch
index a8bb8f71cdbf..94ae308c1cfc 100644
--- a/pkgs/development/libraries/qt-6/patches/0001-qtbase-qmake-always-use-libname-instead-of-absolute-.patch
+++ b/pkgs/development/libraries/qt-6/patches/0001-qtbase-qmake-always-use-libname-instead-of-absolute-.patch
@@ -1,23 +1,8 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nick Cao <nickcao@nichi.co>
-Date: Thu, 13 Apr 2023 23:42:29 +0800
-Subject: [PATCH] qtbase: qmake: always use libname instead of absolute path in
- qmake files
-
-In generated qmake files, absolute paths to qt libraries are embedded
-and then used in linker flags. However as the libraries can be provided
-by qt modules other than the one currently being built, the ebedded
-paths can be incorrect.
----
- cmake/QtFinishPrlFile.cmake      | 7 ++++---
- cmake/QtGenerateLibHelpers.cmake | 3 ---
- 2 files changed, 4 insertions(+), 6 deletions(-)
-
 diff --git a/cmake/QtFinishPrlFile.cmake b/cmake/QtFinishPrlFile.cmake
-index 1cf9377e6ce..ac4428bd7a1 100644
+index 0cef22617c..232d92bc62 100644
 --- a/cmake/QtFinishPrlFile.cmake
 +++ b/cmake/QtFinishPrlFile.cmake
-@@ -64,9 +64,10 @@ foreach(line ${lines})
+@@ -69,9 +69,10 @@ foreach(line ${lines})
                          endif()
                          list(APPEND adjusted_libs "-framework" "${CMAKE_MATCH_1}")
                      else()
@@ -32,16 +17,16 @@ index 1cf9377e6ce..ac4428bd7a1 100644
                  endif()
              else()
 diff --git a/cmake/QtGenerateLibHelpers.cmake b/cmake/QtGenerateLibHelpers.cmake
-index 3ffe354fd8d..441332d4582 100644
+index 96675267d2..c9d4a69497 100644
 --- a/cmake/QtGenerateLibHelpers.cmake
 +++ b/cmake/QtGenerateLibHelpers.cmake
-@@ -73,9 +73,6 @@ function(qt_transform_absolute_library_paths_to_link_flags out_var library_path_
-             string(TOLOWER "${dir}" dir_lower)
-             # If library_path isn't in default link directories, we should add it to link flags.
-             list(FIND IMPLICIT_LINK_DIRECTORIES_LOWER "${dir_lower}" index)
--            if(${index} EQUAL -1)
--                list(APPEND out_list "-L\"${dir}\"")
--            endif()
+@@ -82,9 +82,6 @@ function(qt_transform_absolute_library_paths_to_link_flags out_var library_path_
+                 # If library_path isn't in default link directories, we should add it to link flags.
+                 # But we shouldn't add it duplicately.
+                 list(FIND IMPLICIT_LINK_DIRECTORIES_LOWER "${dir_lower}" index)
+-                if(index EQUAL -1 AND NOT "-L\"${dir}\"" IN_LIST out_list)
+-                    list(APPEND out_list "-L\"${dir}\"")
+-                endif()
+             endif()
              list(APPEND out_list "${lib_name_with_link_flag}")
          else()
-             list(APPEND out_list "${library_path}")
diff --git a/pkgs/development/libraries/qt-6/patches/0007-qtbase-allow-translations-outside-prefix.patch b/pkgs/development/libraries/qt-6/patches/0007-qtbase-allow-translations-outside-prefix.patch
index d8061f1610e9..c7c097cce359 100644
--- a/pkgs/development/libraries/qt-6/patches/0007-qtbase-allow-translations-outside-prefix.patch
+++ b/pkgs/development/libraries/qt-6/patches/0007-qtbase-allow-translations-outside-prefix.patch
@@ -1,22 +1,13 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nick Cao <nickcao@nichi.co>
-Date: Tue, 10 Oct 2023 10:14:40 -0400
-Subject: [PATCH] qtbase: allow translations outside prefix
-
----
- cmake/QtBuildPathsHelpers.cmake | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
 diff --git a/cmake/QtBuildPathsHelpers.cmake b/cmake/QtBuildPathsHelpers.cmake
-index 18082ac6a5f..e16aea7d7c6 100644
+index bf28d1e9ee..08e64a2092 100644
 --- a/cmake/QtBuildPathsHelpers.cmake
 +++ b/cmake/QtBuildPathsHelpers.cmake
-@@ -134,7 +134,7 @@ function(qt_configure_process_path name default docstring)
-             set(rel_path ".")
-         elseif(rel_path MATCHES "^\.\./")
-             # INSTALL_SYSCONFDIR is allowed to be outside the prefix.
--            if(NOT name STREQUAL "INSTALL_SYSCONFDIR")
-+            if(NOT (name STREQUAL "INSTALL_SYSCONFDIR" OR name STREQUAL "INSTALL_TRANSLATIONSDIR"))
-                 message(FATAL_ERROR
-                     "Path component '${name}' is outside computed install prefix: ${rel_path} ")
-                 return()
+@@ -140,7 +140,7 @@ function(qt_configure_process_path name default docstring)
+         set(new_value ".")
+     elseif(rel_path MATCHES "^\.\./")
+         # INSTALL_SYSCONFDIR is allowed to be outside the prefix.
+-        if(NOT name STREQUAL "INSTALL_SYSCONFDIR")
++        if(NOT (name STREQUAL "INSTALL_SYSCONFDIR" OR name STREQUAL "INSTALL_TRANSLATIONSDIR"))
+             message(FATAL_ERROR
+                 "Path component '${name}' is outside computed install prefix: ${rel_path} ")
+         endif()
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index aeca3be2539e..234fb3afeb31 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,315 +4,315 @@
 
 {
   qt3d = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qt3d-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1pwagjicvqc7lbypkw7wvjznndyzqm2ihisqdqc36ccp0kcqgh4b";
-      name = "qt3d-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qt3d-everywhere-src-6.7.3.tar.xz";
+      sha256 = "155nddckcc94klwsn51s9p8ynk1acg7q9dx99blhq7ch98vqrm25";
+      name = "qt3d-everywhere-src-6.7.3.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qt5compat-everywhere-src-6.7.2.tar.xz";
-      sha256 = "00y071p09v91ascxg3llc0yfbx7xs24smcgxckdrnkgwkqcba9l8";
-      name = "qt5compat-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qt5compat-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1w2k7911n20wdgl3lmxwc7h8sbn7jkjwxz6sl089szmavyinhslb";
+      name = "qt5compat-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtactiveqt-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1y02pyb2bz9wf5jmf2kh20wqq2vmq8afmgrs0pvhgfvyrs8b7an0";
-      name = "qtactiveqt-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtactiveqt-everywhere-src-6.7.3.tar.xz";
+      sha256 = "03qsszrsv3x2w9v65wnmizyqbs0x13c00zjd7sfgsaxw20p5x11a";
+      name = "qtactiveqt-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtbase = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtbase-everywhere-src-6.7.2.tar.xz";
-      sha256 = "16bmfrjfxjajs6sqg1383ihhfwwf69ihkpnpvsajh5pv21g2mwn5";
-      name = "qtbase-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtbase-everywhere-src-6.7.3.tar.xz";
+      sha256 = "15rhv8irwpgxs0pgqsn5dy9ndz6n3vfyv7iccdvaq1aj0nmvkjwc";
+      name = "qtbase-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtcharts-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1nlv4z2rvhrn1f1f7n6qdag7lmkpl3idnj6ph572qzwb8lvs9xh0";
-      name = "qtcharts-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtcharts-everywhere-src-6.7.3.tar.xz";
+      sha256 = "0n9n4gj86g86yqkgws12aw2p6d94lmx6y19qki5gmg76a2jn7sh7";
+      name = "qtcharts-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtconnectivity-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1s08djgzhh5p9ij0hxbrrcx9n7r7f0ba6pr9793mdsgh8ar23lwf";
-      name = "qtconnectivity-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtconnectivity-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1igwnbjhdwmaw1x4v0gx9wv4h4a5h9f9rv9m9dyi0ybv14prpyc0";
+      name = "qtconnectivity-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtdatavis3d-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0lsfd737zi8517scys3xj4c9l505vvkdg3n6dw89bdfyjmywisy0";
-      name = "qtdatavis3d-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtdatavis3d-everywhere-src-6.7.3.tar.xz";
+      sha256 = "108x4hafvrc4jpmmx6lcf7mnns7vkgz0004b6qkw5bzq36apdwp1";
+      name = "qtdatavis3d-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtdeclarative-everywhere-src-6.7.2.tar.xz";
-      sha256 = "16drp7yjsm50cvsyww9xk15hzf2csax02vpbv0jx8hlcmyhwnaac";
-      name = "qtdeclarative-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtdeclarative-everywhere-src-6.7.3.tar.xz";
+      sha256 = "0xcq1dhws5k1sdf8iwxc2j2s45171rhjckfla17brxdb87j70ywk";
+      name = "qtdeclarative-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtdoc-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0vbmhx2rbfbxgzz1ipa185wvnm08a43sdr47y9jn1ivdnrn4bhd0";
-      name = "qtdoc-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtdoc-everywhere-src-6.7.3.tar.xz";
+      sha256 = "0113rrsrcaw5l425xv96z081idjpav2iprg1834pxfqk3wk2l3ak";
+      name = "qtdoc-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtgraphs-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0046293800if5ca04r40wsa4gxh8r5q6c863yrx3cmjadqk3m0fq";
-      name = "qtgraphs-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtgraphs-everywhere-src-6.7.3.tar.xz";
+      sha256 = "13vcx0fkx9vyvjysnj0n805x13ir1srbzlg1jha8h56ccg6dw2f3";
+      name = "qtgraphs-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtgrpc-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0zp1l9vf0p78f53mhirs4crw6cjy6fmv26n7nndyrk8a0hz8b7wd";
-      name = "qtgrpc-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtgrpc-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1py6h4g5zhqpm99bhxk12paw675a4c6dl95s6nwkvg1y2vaavapf";
+      name = "qtgrpc-everywhere-src-6.7.3.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qthttpserver-everywhere-src-6.7.2.tar.xz";
-      sha256 = "11lbfx08yl725w4n8dmvviscixvfkpzx8ijhy74gx0waz6sbjlq3";
-      name = "qthttpserver-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qthttpserver-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1zyyyj9q0yy5gh28yqgc0nwhgdvg0qbwkag9bd566srbwp3if8vz";
+      name = "qthttpserver-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtimageformats-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1mp5bi45gcmsds0g2xfjd1mklrijbwfv0hx4s1md2rxfbxwdi8g1";
-      name = "qtimageformats-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtimageformats-everywhere-src-6.7.3.tar.xz";
+      sha256 = "0ls76bxl3xhy7hyzw53vj8q3h0llsbm9dpb86wvw6m0n11283mcz";
+      name = "qtimageformats-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtlanguageserver-everywhere-src-6.7.2.tar.xz";
-      sha256 = "14hs20738d2ljfb5la8p0lip7qranjnrwl5fwdhs1zs4a5jzwndn";
-      name = "qtlanguageserver-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtlanguageserver-everywhere-src-6.7.3.tar.xz";
+      sha256 = "13yzz6qnpkah9s89xlqiszzkbw1j6c1a2vzwkgjdj0w589r3hvf5";
+      name = "qtlanguageserver-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtlocation-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0pa8ibw490p3433ysni73f0gpz7gvxyl2abh3ygvd28ipxcdlcpj";
-      name = "qtlocation-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtlocation-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1657scmrkyhm31fgvgpjlqd053gb7bcywra4qvlgg3h4rpfxg7sn";
+      name = "qtlocation-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtlottie-everywhere-src-6.7.2.tar.xz";
-      sha256 = "03piwc7p0lgqm73rx2kf5ckh986nv9dkssfl47js8lnkb29vrbyr";
-      name = "qtlottie-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtlottie-everywhere-src-6.7.3.tar.xz";
+      sha256 = "03c3s6alabqqqhi8cx8rnkr3gx7h8rcf2wn8iy9n7hbsfrvix39r";
+      name = "qtlottie-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtmultimedia-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1lsiarvag8lr4a1apa466xz56b1znjncy8wz5hyiv6nbb88kby4f";
-      name = "qtmultimedia-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtmultimedia-everywhere-src-6.7.3.tar.xz";
+      sha256 = "00vkazz4mcz5n2hdh10y9mh0fi2kygai009vi69m4hwjwnw2hk9h";
+      name = "qtmultimedia-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtnetworkauth-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0w7l5lhhxhg9x1rd66727gwkpzi6l7wmyc0c4qrfp2g5rx7q42bz";
-      name = "qtnetworkauth-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtnetworkauth-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1dqk9983cjf3kiprk053xn3np2c25044dlfdrzs5d742x2jpb6kb";
+      name = "qtnetworkauth-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtpositioning-everywhere-src-6.7.2.tar.xz";
-      sha256 = "073v10z1axmqydrvdka9g69wr117kzhvci9sjr110swgmbq0j002";
-      name = "qtpositioning-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtpositioning-everywhere-src-6.7.3.tar.xz";
+      sha256 = "0736qsf7k3dqdm9gd7xc0l368h45jgzh4nzz72wizj9489sp6w6s";
+      name = "qtpositioning-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtquick3d-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0w2js64s1wg86dblqmmy9cyjz2x96f9qbk4674xjsbnsqspgk3xv";
-      name = "qtquick3d-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtquick3d-everywhere-src-6.7.3.tar.xz";
+      sha256 = "0mwrlz9ji0ivnxz44m9xhhsk7lngxjnmid420s359vs21msik6ni";
+      name = "qtquick3d-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtquick3dphysics-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0h21dq5yplqizyk43agfw7yzyjfcs3d8bl7jq6n07g2fnjw91izz";
-      name = "qtquick3dphysics-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtquick3dphysics-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1wyqi6z0g2pi0wj288ssjj0awn8jpi9rqa8bi510s9vr625w8pdl";
+      name = "qtquick3dphysics-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtquickeffectmaker-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0vbmgdqlwihi379z1yr8ci09jxr93jrkgd8ripr2jb680z72c3rv";
-      name = "qtquickeffectmaker-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtquickeffectmaker-everywhere-src-6.7.3.tar.xz";
+      sha256 = "15if8ansjc1nkpaf6ldyydb47grgv079pm15ljn0ykf35ldzv2sq";
+      name = "qtquickeffectmaker-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtquicktimeline-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1sqr0xmiz33wfl5db24chq3gsbs0p17ylbin23gcx5gh3jhdxv91";
-      name = "qtquicktimeline-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtquicktimeline-everywhere-src-6.7.3.tar.xz";
+      sha256 = "00n90camzs7c3s61id58466sypc83w0101wrnw0xwlaci1kld45p";
+      name = "qtquicktimeline-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtremoteobjects-everywhere-src-6.7.2.tar.xz";
-      sha256 = "10vlkg5v5hc8fwiw9x06d84z6cs4i5kxm652si3lwvvxma0np40b";
-      name = "qtremoteobjects-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtremoteobjects-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1lciziv5qvnxich39j0q46v3pkn83yy1jkm2q3d10k5672lqmh4r";
+      name = "qtremoteobjects-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtscxml-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0vy80npai5ikwlf0ghxf5xj8vq1hi3cdjgddjas2g3yl0qszkv10";
-      name = "qtscxml-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtscxml-everywhere-src-6.7.3.tar.xz";
+      sha256 = "18zdgq3sapkh6jsnfhl0xm0r8ydbg7kxwr70b7szpdmg1pmyp3v0";
+      name = "qtscxml-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtsensors-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0ndvwra9bssfqw32bk5mbj3zdqgi9zshm0gd0bfd8vn5hz3xxlga";
-      name = "qtsensors-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtsensors-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1z68yfjljv7bi49kna4a7yz6javw9bqdw0jr30zmzvb2ldfqsfn0";
+      name = "qtsensors-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtserialbus-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0asb6xnp6gnn41bivirld1llhb2zmbgidianv7blcms5kfliqr37";
-      name = "qtserialbus-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtserialbus-everywhere-src-6.7.3.tar.xz";
+      sha256 = "0xk218y1cm9icdzb4dn9nvszr9n22anmf2iz72vhhy42gaf2xn2m";
+      name = "qtserialbus-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtserialport-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1z5lsgdl4g48fr2kcp7zznv5jyv42xmd4qn6rrxikd8w2v8lrhr1";
-      name = "qtserialport-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtserialport-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1w26n5nw8fv9cq258xm0p7niisbig5ky83njm3nwjfcvh3p5iynl";
+      name = "qtserialport-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtshadertools-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1hbw5xz12frydk787rl6cgfxm2bxlzkxiwcxjjmgq04cmk039ypd";
-      name = "qtshadertools-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtshadertools-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1589ij1aarr0i6cfbdxg8yxvljs52599g39d98sxmnvxiiwi5rbl";
+      name = "qtshadertools-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtspeech-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1khl90m6jd2zg0r0fncdz3r1w2l96vwp6jihpq9rgr730ja7d36c";
-      name = "qtspeech-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtspeech-everywhere-src-6.7.3.tar.xz";
+      sha256 = "04h998pshs2bzm3a0bvmkq2an2yhgfrap22k3lvprx3f3gsgn2gn";
+      name = "qtspeech-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtsvg-everywhere-src-6.7.2.tar.xz";
-      sha256 = "00ggr84l1h8did6ivprv343rwwcl7j2bbbilxqzmiqsvlf3143gv";
-      name = "qtsvg-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtsvg-everywhere-src-6.7.3.tar.xz";
+      sha256 = "0sx0xm6hcjhjhrmswycrgwvdjk6mymkindmw2bb7mq5i3yvjq520";
+      name = "qtsvg-everywhere-src-6.7.3.tar.xz";
     };
   };
   qttools = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qttools-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0ajbma9lbrb0d048bvg2xl74m833ddv2b9684r3hjcr53fnmbs2q";
-      name = "qttools-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qttools-everywhere-src-6.7.3.tar.xz";
+      sha256 = "0gr06dr3dd334mswrjdxp27dhpdbpjvk03hipafsrncwc7gvffzh";
+      name = "qttools-everywhere-src-6.7.3.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qttranslations-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1a9cb1br3wqn0rshkgj21hba3r7jx8dbavc3ayfjgdy1bl5phicq";
-      name = "qttranslations-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qttranslations-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1j3dklf0gvzpnl6zw254fv7wy3iyypbbcsfkwjsrnfq4mjn65iyw";
+      name = "qttranslations-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtvirtualkeyboard-everywhere-src-6.7.2.tar.xz";
-      sha256 = "03qqrs0nv6bhnm0ps54inw43xgnfx3vdq8mqq5wzyq09basn81ij";
-      name = "qtvirtualkeyboard-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtvirtualkeyboard-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1n932jgj97ili5chhfrscqvhdaz0na5yla3xljnlih0jw82231qs";
+      name = "qtvirtualkeyboard-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtwayland-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0nwa59g1wk7fkym837pkw312abjb376gx44rpd5d8jv4vphmg852";
-      name = "qtwayland-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtwayland-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1ddjf9lrlx8cp0699sq8vc8fx44nvz9daxq5qazh7x98nv7cf9p3";
+      name = "qtwayland-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtwebchannel-everywhere-src-6.7.2.tar.xz";
-      sha256 = "072hniyxavz2jjkzh7mrz4g67zf0cngvp4xgdradxrqhgdh9cpdc";
-      name = "qtwebchannel-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtwebchannel-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1f3lak91fvlncgs43dcgkgjg25f9449d2pvbsh33m6xhdpg3yqqm";
+      name = "qtwebchannel-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtwebengine-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1lgz0mj9lw4ii1c8nkbr0ll02xzx8i6n7wvvn21f72sdb5smhxf7";
-      name = "qtwebengine-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtwebengine-everywhere-src-6.7.3.tar.xz";
+      sha256 = "1ns6v24jarjlvd1b3nh4x3sp6y38ag62dsh7x6f5dp40pff1aay2";
+      name = "qtwebengine-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtwebsockets-everywhere-src-6.7.2.tar.xz";
-      sha256 = "0pr13p6inlh2i79yc567w8dp446rh9xvfakq5diwis4wxkv4mpjv";
-      name = "qtwebsockets-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtwebsockets-everywhere-src-6.7.3.tar.xz";
+      sha256 = "03lrqphvn0bwrma8rjqb8x7giqgk24gdgl9v7syaas7fnxyh00xs";
+      name = "qtwebsockets-everywhere-src-6.7.3.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.7.2";
+    version = "6.7.3";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.7/6.7.2/submodules/qtwebview-everywhere-src-6.7.2.tar.xz";
-      sha256 = "1zp44kfrks0grc1l6f3ayvfmw45zmhal0pfrzjdw7znl0dlhkqac";
-      name = "qtwebview-everywhere-src-6.7.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.7/6.7.3/submodules/qtwebview-everywhere-src-6.7.3.tar.xz";
+      sha256 = "0bdr0m8453difqwd8gvgqsd4df4j8lnlbi44cdazwhx28kzfi2kh";
+      name = "qtwebview-everywhere-src-6.7.3.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/ocaml-modules/cfstream/default.nix b/pkgs/development/ocaml-modules/cfstream/default.nix
index 204128adec22..e5de1b648534 100644
--- a/pkgs/development/ocaml-modules/cfstream/default.nix
+++ b/pkgs/development/ocaml-modules/cfstream/default.nix
@@ -1,10 +1,10 @@
-{ lib, buildDunePackage, fetchFromGitHub, ocaml, m4, camlp-streams, core_kernel, ounit }:
+{ lib, buildDunePackage, fetchFromGitHub, m4, camlp-streams, core_kernel, ounit }:
 
 buildDunePackage rec {
   pname = "cfstream";
   version = "1.3.2";
 
-  minimalOCamlVersion = "4.07";
+  minimalOCamlVersion = "4.08";
 
   src = fetchFromGitHub {
     owner = "biocaml";
@@ -15,13 +15,11 @@ buildDunePackage rec {
 
   patches = [ ./git_commit.patch ./janestreet-0.17.patch ];
 
-  strictDeps = true;
-
   nativeBuildInputs = [ m4 ];
   checkInputs = [ ounit ];
   propagatedBuildInputs = [ camlp-streams core_kernel ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
 
   meta = with lib; {
     inherit (src.meta) homepage;
diff --git a/pkgs/development/ocaml-modules/ppx_blob/default.nix b/pkgs/development/ocaml-modules/ppx_blob/default.nix
index b9665ecc0552..62ac0769d6eb 100644
--- a/pkgs/development/ocaml-modules/ppx_blob/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_blob/default.nix
@@ -4,7 +4,7 @@ buildDunePackage rec {
   pname = "ppx_blob";
   version = "0.9.0";
 
-  duneVersion = "3";
+  minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/johnwhitington/${pname}/releases/download/${version}/ppx_blob-${version}.tbz";
@@ -13,7 +13,7 @@ buildDunePackage rec {
 
   checkInputs = [ alcotest ];
   propagatedBuildInputs = [ ppxlib ];
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
 
   meta = with lib; {
     homepage = "https://github.com/johnwhitington/ppx_blob";
diff --git a/pkgs/development/ocaml-modules/printbox/default.nix b/pkgs/development/ocaml-modules/printbox/default.nix
index fe7e655ba60c..56d9628ebfaf 100644
--- a/pkgs/development/ocaml-modules/printbox/default.nix
+++ b/pkgs/development/ocaml-modules/printbox/default.nix
@@ -4,9 +4,7 @@ buildDunePackage rec {
   pname = "printbox";
   version = "0.11";
 
-  useDune2 = true;
-
-  minimalOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.04";
 
   src = fetchFromGitHub {
     owner = "c-cube";
diff --git a/pkgs/development/python-modules/adafruit-io/default.nix b/pkgs/development/python-modules/adafruit-io/default.nix
index 3177c7804766..e0f1122a464e 100644
--- a/pkgs/development/python-modules/adafruit-io/default.nix
+++ b/pkgs/development/python-modules/adafruit-io/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "adafruit-io";
-  version = "2.7.2";
+  version = "2.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "adafruit";
     repo = "Adafruit_IO_Python";
     rev = "refs/tags/${version}";
-    hash = "sha256-JBpF08WGe1pMK1y7HZLH/jSQkJtbWdiTGYHWRd39UIk=";
+    hash = "sha256-OwTHMyc2ePSdYVuY1h3PY+uDBl6/7fTMXiZC3sZm8fU=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/aiohasupervisor/default.nix b/pkgs/development/python-modules/aiohasupervisor/default.nix
index 04755463bf61..969e72889da6 100644
--- a/pkgs/development/python-modules/aiohasupervisor/default.nix
+++ b/pkgs/development/python-modules/aiohasupervisor/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "aiohasupervisor";
-  version = "0.1.0b1";
+  version = "0.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-INpyN5jdXOzTC6t18PvbkbDM7n4Y4rejb08UfyJyFSk=";
+    hash = "sha256-Jq9cSdMMXVgRHhQK1LuGwVR6GBTIrw3th7y9huRSQjM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index 2566232b3601..cd0e1c143a7f 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -57,14 +57,13 @@ else
         --replace '/usr/include/libffi' '${lib.getDev libffi}/include'
     '';
 
-    nativeBuildInputs = [
-      pkg-config
-      setuptools
-    ];
+    nativeBuildInputs = [ pkg-config ];
+
+    build-system = [ setuptools ];
 
     buildInputs = [ libffi ];
 
-    propagatedBuildInputs = [ pycparser ];
+    dependencies = [ pycparser ];
 
     # The tests use -Werror but with python3.6 clang detects some unreachable code.
     env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument -Wno-unreachable-code -Wno-c++11-narrowing";
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index 0aacc52e3f76..f1047b6adac2 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.7.9";
+  version = "1.7.10";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "fastai";
     repo = "fastcore";
     rev = "refs/tags/${version}";
-    hash = "sha256-OGqd+pLM3THcPD3JtccjH6sgpVEhcNVnGbIbyMFfqTU=";
+    hash = "sha256-ksHJrgNju2rEVHcKU6jpW6izQPFgrWvDrvDZy0/Cgug=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mobly/default.nix b/pkgs/development/python-modules/mobly/default.nix
index 046edf9a3da1..dc76a6d6ea09 100644
--- a/pkgs/development/python-modules/mobly/default.nix
+++ b/pkgs/development/python-modules/mobly/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "mobly";
-  version = "1.12.3";
+  version = "1.12.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mobly";
     rev = "refs/tags/${version}";
-    hash = "sha256-hhI1jrHJk4wo49MK8J4VTS2dGmHG2kwzgZeSWBXdXkA=";
+    hash = "sha256-77wZK5dqxXUkOgWE7NBpGJBbbtYYxRCJwPbtwLIX09I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pulsectl/default.nix b/pkgs/development/python-modules/pulsectl/default.nix
index abdc439fd611..756826b4500a 100644
--- a/pkgs/development/python-modules/pulsectl/default.nix
+++ b/pkgs/development/python-modules/pulsectl/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "pulsectl";
-  version = "24.4.0";
+  version = "24.8.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aX7VDn1FLnhniuOOKrk1hDAIvsRIlVKDzQ+zYoZ+MWU=";
+    hash = "sha256-sFFQbQ1z08xDV879PeF7uFnX7PAE6ZSw98+oeFG8cVY=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/clj-kondo/default.nix b/pkgs/development/tools/clj-kondo/default.nix
index b24d2b9fd255..e764f34c9125 100644
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@@ -3,12 +3,12 @@
 
 buildGraalvmNativeImage rec {
   pname = "clj-kondo";
-  version = "2024.08.29";
+  version = "2024.09.27";
 
   src = fetchurl {
     url =
       "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-0Mvj8FW6/Q9GudaD3lnRFvTjMkkAGwpAokdNJa/HfsI=";
+    sha256 = "sha256-DrSfL1WazlNd5H0jG6m0S5aED4BLVufr1rGIAyifn6E=";
   };
 
   graalvmDrv = graalvmCEPackages.graalvm-ce;
diff --git a/pkgs/development/tools/fblog/default.nix b/pkgs/development/tools/fblog/default.nix
index 8720d5a7f625..69e8d2326ea4 100644
--- a/pkgs/development/tools/fblog/default.nix
+++ b/pkgs/development/tools/fblog/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fblog";
-  version = "4.10.0";
+  version = "4.12.0";
 
   src = fetchFromGitHub {
     owner = "brocode";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-4Yg7gWVBG9GI1ailEbbcslM+XR8L7yjjjvf4dQq/87I=";
+    hash = "sha256-OZE+jqjsyvHLDJ+6r0txH56afufnl4H9PHcG7XRfxnE=";
   };
 
-  cargoHash = "sha256-8rnQllCne1q1uDpeJkqAdzNKSkEgVp+v9drXL8TaQmM=";
+  cargoHash = "sha256-zZ/xE7DVX1HSK81xwB4VxCtnOTUwJvSScmJeA/t/ACI=";
 
   meta = with lib; {
     description = "Small command-line JSON log viewer";
diff --git a/pkgs/development/tools/gauge/plugins/make-gauge-plugin.nix b/pkgs/development/tools/gauge/plugins/make-gauge-plugin.nix
index acf902e1b79d..71f88a2c40ae 100644
--- a/pkgs/development/tools/gauge/plugins/make-gauge-plugin.nix
+++ b/pkgs/development/tools/gauge/plugins/make-gauge-plugin.nix
@@ -17,7 +17,7 @@
 let
   otherArgs = lib.attrsets.removeAttrs args [ "pname" "data" "repo" "releasePrefix" "isMultiArch" ];
   inherit (stdenvNoCC.hostPlatform) system;
-  inherit (if isCrossArch then data else data.${system}) url hash;
+  inherit (if isCrossArch then data else data.${system} or (throw "gaugePlugins.${pname}: No source for system: ${system}")) url hash;
   # Upstream uses a different naming scheme for platforms
   systemMap = {
     "x86_64-darwin" = "darwin.x86_64";
diff --git a/pkgs/development/tools/gosec/default.nix b/pkgs/development/tools/gosec/default.nix
index a2c6cd85e5ed..be4d2d39dc5f 100644
--- a/pkgs/development/tools/gosec/default.nix
+++ b/pkgs/development/tools/gosec/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gosec";
-  version = "2.21.2";
+  version = "2.21.4";
 
   src = fetchFromGitHub {
     owner = "securego";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1lVyIytIorxxipDZAf2AYqtO1Slz9aUw6MpC40ji89w=";
+    hash = "sha256-fu0k+dZyEo2l0PWfN8iryGgUIJsWi7AQD3ku+w1tuGM=";
   };
 
-  vendorHash = "sha256-jxbGAEvkjvuK878nkl8TGbZmBzS7n9nG4hH9BL3UGwE=";
+  vendorHash = "sha256-LYEAQ/7S31Rv2gmkLReV1lKeAHW5DpKkegKb0Js75q0=";
 
   subPackages = [
     "cmd/gosec"
diff --git a/pkgs/development/tools/misc/unixbench/default.nix b/pkgs/development/tools/misc/unixbench/default.nix
index d5f060af82cf..7721a2648b35 100644
--- a/pkgs/development/tools/misc/unixbench/default.nix
+++ b/pkgs/development/tools/misc/unixbench/default.nix
@@ -9,6 +9,7 @@
 , libGLX
 , coreutils
 , unixtools
+, runtimeShell
 , targetPackages
 , gnugrep
 , gawk
@@ -89,7 +90,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     substituteInPlace $out/libexec/pgms/multi.sh \
-      --replace '/bin/sh "$' '${targetPackages.runtimeShell} "$'
+      --replace '/bin/sh "$' '${runtimeShell} "$'
 
     substituteInPlace $out/bin/ubench \
       --subst-var out
diff --git a/pkgs/development/tools/nwjs/default.nix b/pkgs/development/tools/nwjs/default.nix
index ff1fae302d16..408584de712e 100644
--- a/pkgs/development/tools/nwjs/default.nix
+++ b/pkgs/development/tools/nwjs/default.nix
@@ -3,6 +3,7 @@
 , atk
 , autoPatchelfHook
 , buildEnv
+, buildPackages
 , cairo
 , cups
 , dbus
@@ -32,7 +33,6 @@
 , stdenv
 , systemd
 , udev
-, wrapGAppsHook3
 , xorg
 }:
 
@@ -107,7 +107,9 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    (wrapGAppsHook3.override { inherit makeWrapper; })
+    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
   ];
 
   buildInputs = [ nwEnv ];
diff --git a/pkgs/development/tools/turso-cli/default.nix b/pkgs/development/tools/turso-cli/default.nix
index e87cd2c9e210..d08622783bf5 100644
--- a/pkgs/development/tools/turso-cli/default.nix
+++ b/pkgs/development/tools/turso-cli/default.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "turso-cli";
-  version = "0.97.1";
+  version = "0.97.2";
 
   src = fetchFromGitHub {
     owner = "tursodatabase";
     repo = "turso-cli";
     rev = "v${version}";
-    hash = "sha256-sS9H9mdbjV2EEsMKikQKND+gPeghH5cqRxhHcbjr7ok=";
+    hash = "sha256-6Ci1QESSN6wNpUAQoWtTyHWrGaI/3xs/jGCSkJsYC8o=";
   };
 
   vendorHash = "sha256-tBO21IgUczwMgrEyV7scV3YTY898lYHASaLeXqvBopU=";
diff --git a/pkgs/development/web/cypress/default.nix b/pkgs/development/web/cypress/default.nix
index 856b31af1565..2f3b8cf20808 100644
--- a/pkgs/development/web/cypress/default.nix
+++ b/pkgs/development/web/cypress/default.nix
@@ -4,13 +4,13 @@
 , gtk2
 , gtk3
 , lib
+, buildPackages
 , makeShellWrapper
 , mesa
 , nss
 , stdenv
 , udev
 , unzip
-, wrapGAppsHook3
 , xorg
 , darwin
 }:
@@ -46,8 +46,18 @@ in stdenv.mkDerivation rec {
   # don't remove runtime deps
   dontPatchELF = true;
 
-  nativeBuildInputs = [ unzip makeShellWrapper ]
-    ++ lib.optionals stdenv.isLinux [ autoPatchelfHook (wrapGAppsHook3.override { makeWrapper = makeShellWrapper; }) ];
+  nativeBuildInputs =
+    [
+      unzip
+      makeShellWrapper
+    ]
+    ++ lib.optionals stdenv.isLinux [
+      autoPatchelfHook
+      # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+      # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+      (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
+    ];
+
 
   buildInputs = lib.optionals stdenv.isLinux (with xorg; [
     libXScrnSaver
diff --git a/pkgs/shells/nushell/nu_scripts/default.nix b/pkgs/shells/nushell/nu_scripts/default.nix
index 48f81d678852..76b15ef1cd5a 100644
--- a/pkgs/shells/nushell/nu_scripts/default.nix
+++ b/pkgs/shells/nushell/nu_scripts/default.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nu_scripts";
-  version = "0-unstable-2024-09-11";
+  version = "0-unstable-2024-09-26";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = pname;
-    rev = "d04eea634a3ac35d481fa26c35271dfe175bf3e2";
-    hash = "sha256-uHD8j98WubyvtbtOqTdfGmeRJ7zoVDVZ9+CJzmB6vF0=";
+    rev = "e10ffbaaa7dc8c9ecd300e72d5f0b6c7e6691175";
+    hash = "sha256-CT4CI/oKidy7nwiqEbDJxKDuinrcjGQBke9bwwOcD8A=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/filesystems/sasquatch/default.nix b/pkgs/tools/filesystems/sasquatch/default.nix
deleted file mode 100644
index f8d66683fccb..000000000000
--- a/pkgs/tools/filesystems/sasquatch/default.nix
+++ /dev/null
@@ -1,76 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchurl
-, xz
-, lzo
-, zlib
-, zstd
-, lz4
-, lz4Support ? false
-}:
-
-let
-  patch = fetchFromGitHub
-    {
-      # NOTE: This uses my personal fork for now, until
-      # https://github.com/devttys0/sasquatch/pull/40 is merged.
-      # I, cole-h, will keep this fork available until that happens.
-      owner = "cole-h";
-      repo = "sasquatch";
-      rev = "6edc54705454c6410469a9cb5bc58e412779731a";
-      sha256 = "x+PuPYGD4Pd0fcJtlLWByGy/nggsmZkxwSXxJfPvUgo=";
-    } + "/patches/patch0.txt";
-in
-stdenv.mkDerivation rec {
-  pname = "sasquatch";
-  version = "4.4";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/squashfs/squashfs${version}.tar.gz";
-    sha256 = "qYGz8/IFS1ouZYhRo8BqJGCtBKmopkXgr+Bjpj/bsH4=";
-  };
-
-  buildInputs = [
-    xz
-    lzo
-    zlib
-    zstd
-  ]
-  ++ lib.optionals lz4Support [ lz4 ];
-
-  patches = [ patch ];
-  patchFlags = [ "-p0" ];
-
-  postPatch = ''
-    # Drop blanket -Werror to avoid build failure on fresh toolchains
-    # like gcc-11.
-    substituteInPlace squashfs-tools/Makefile --replace ' -Werror' ' '
-    cd squashfs-tools
-  '';
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: unsquashfs_xattr.o:/build/squashfs4.4/squashfs-tools/error.h:34: multiple definition of
-  #     `verbose'; unsquashfs.o:/build/squashfs4.4/squashfs-tools/error.h:34: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-
-  installFlags = [ "INSTALL_DIR=\${out}/bin" ];
-
-  makeFlags = [
-    "XZ_SUPPORT=1"
-    "CC=${stdenv.cc.targetPrefix}cc"
-    "CXX=${stdenv.cc.targetPrefix}c++"
-    "AR=${stdenv.cc.targetPrefix}ar"
-  ]
-    ++ lib.optional lz4Support "LZ4_SUPPORT=1";
-
-  meta = with lib; {
-    homepage = "https://github.com/devttys0/sasquatch";
-    description = "Set of patches to the standard unsquashfs utility (part of squashfs-tools) that attempts to add support for as many hacked-up vendor-specific SquashFS implementations as possible";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.pamplemousse ];
-    platforms = platforms.linux;
-    mainProgram = "sasquatch";
-  };
-}
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index b149649a75eb..83ac6002f20c 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "2.0.32";
+  version = "2.0.33";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-J8DAHwbpcSQtOWOkWjya3zXRhr9Dje2QzumDmeq2rR0=";
+    sha256 = "sha256-q2OVd3eb1zGQMiI3T0oXAq5dFzdYTYQGqPNBUeuMEck=";
   };
 
-  cargoHash = "sha256-M0MX2ZjVsJuWQ6nuxpF1VDYIlGPAsebRbxZ40oSYVO0=";
+  cargoHash = "sha256-cu6d9sCvVYt+85cl0dTOY9874QdnyA13T7Nb/KFjkMg=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/nsc/default.nix b/pkgs/tools/system/nsc/default.nix
index 88dafe7f4f3e..deefe7056929 100644
--- a/pkgs/tools/system/nsc/default.nix
+++ b/pkgs/tools/system/nsc/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "nsc";
-  version = "2.8.9";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KNW9meeThHT9ZZJFXsb9RAzLsvgnaXWbuMR4tei/s2U=";
+    hash = "sha256-pzUjcezzZ3Fo9b7nuPV08ZSxrk7cBufQL6Dbfvmjkg4=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule rec {
     "-X main.builtBy=nixpkgs"
   ];
 
-  vendorHash = "sha256-3qUgzvb7VkYrlYb+W0ZycJ0S7CQAHSUFNQSfwiKqMdI=";
+  vendorHash = "sha256-tZTrjIax3zofrRuSJQO7VA7rlTXN/GT1KTcsLpvB+2Q=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -46,7 +46,7 @@ buildGoModule rec {
   # the test strips table formatting from the command output in a naive way
   # that removes all the table characters, including '-'.
   # The nix build directory looks something like:
-  # /private/tmp/nix-build-nsc-2.8.9.drv-0/nsc_test2000598938/keys
+  # /private/tmp/nix-build-nsc-2.9.0.drv-0/nsc_test2000598938/keys
   # Then the `-` are removed from the path unintentionally and the test fails.
   # This should be fixed upstream to avoid mangling the path when
   # removing the table decorations from the command output.
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f1238d06493e..f790eb50f1da 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2186,15 +2186,7 @@ with pkgs;
     humanfriendly;
   };
 
-  git-annex-remote-googledrive = callPackage ../applications/version-management/git-annex-remote-googledrive {
-    inherit (python3Packages)
-    buildPythonApplication
-    annexremote
-    drivelib
-    gitpython
-    tenacity
-    humanfriendly;
-  };
+  git-annex-remote-googledrive = python3Packages.callPackage ../applications/version-management/git-annex-remote-googledrive { };
 
   git-annex-remote-rclone = callPackage ../applications/version-management/git-annex-remote-rclone { };
 
@@ -5195,8 +5187,6 @@ with pkgs;
     pythonPackages = python3Packages;
   };
 
-  grim = callPackage ../tools/graphics/grim { };
-
   grit = callPackage ../tools/misc/grit { };
 
   grobi = callPackage ../tools/X11/grobi { };
@@ -12128,8 +12118,6 @@ with pkgs;
 
   sanctity = callPackage ../tools/misc/sanctity { };
 
-  sasquatch = callPackage ../tools/filesystems/sasquatch { };
-
   sasview = libsForQt5.callPackage ../applications/science/misc/sasview { };
 
   sbs = callPackage ../tools/X11/sbs { };