diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index f706f92c6691..2acbc4fb0867 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -310,6 +310,120 @@ See `node2nix` [docs](https://github.com/svanderburg/node2nix) for more info.
 - `node2nix` has some [bugs](https://github.com/svanderburg/node2nix/issues/238) related to working with lock files from npm distributed with `nodejs_16`.
 - `node2nix` does not like missing packages from npm. If you see something like `Cannot resolve version: vue-loader-v16@undefined` then you might want to try another tool. The package might have been pulled off of npm.
 
+### pnpm {#javascript-pnpm}
+
+Pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8` and `pnpm_9`, which support different sets of lock file versions.
+
+When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The functions `pnpm_8.fetchDeps` and `pnpm_9.fetchDeps` can create this pnpm store derivation. In conjunction, the setup hooks `pnpm_8.configHook` and `pnpm_9.configHook` will prepare the build environment to install the prefetched dependencies store. Here is an example for a package that contains a `package.json` and a `pnpm-lock.yaml` files using the above `pnpm_` attributes:
+
+```nix
+{
+  stdenv,
+  nodejs,
+  # This is pinned as { pnpm = pnpm_9; }
+  pnpm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "foo";
+  version = "0-unstable-1980-01-01";
+
+  src = ...;
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+  ];
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "...";
+  };
+})
+```
+
+NOTE: It is highly recommended to use a pinned version of pnpm (i.e. `pnpm_8` or `pnpm_9`), to increase future reproducibility. It might also be required to use an older version, if the package needs support for a certain lock file version.
+
+In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e. `inherit (finalAttrs) patches`.
+
+`pnpm.configHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array.
+
+#### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
+
+If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchDeps`.
+If `sourceRoot` is different between the parent derivation and `fetchDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchDeps`.
+
+Assuming the following directory structure, we can define `sourceRoot` and `pnpmRoot` as follows:
+
+```
+.
+├── frontend
+│   ├── ...
+│   ├── package.json
+│   └── pnpm-lock.yaml
+└── ...
+```
+
+```nix
+  ...
+  pnpmDeps = pnpm.fetchDeps {
+    ...
+    sourceRoot = "${finalAttrs.src.name}/frontend";
+  };
+
+  # by default the working directory is the extracted source
+  pnpmRoot = "frontend";
+```
+
+#### PNPM Workspaces {#javascript-pnpm-workspaces}
+
+If you need to use a PNPM workspace for your project, then set `pnpmWorkspace = "<workspace project name>"` in your `pnpm.fetchDeps` call,
+which will make PNPM only install dependencies for that workspace package.
+
+For example:
+
+```nix
+...
+pnpmWorkspace = "@astrojs/language-server";
+pnpmDeps = pnpm.fetchDeps {
+  inherit (finalAttrs) pnpmWorkspace;
+  ...
+}
+```
+
+The above would make `pnpm.fetchDeps` call only install dependencies for the `@astrojs/language-server` workspace package.
+Note that you do not need to set `sourceRoot` to make this work.
+
+Usually in such cases, you'd want to use `pnpm --filter=$pnpmWorkspace build` to build your project, as `npmHooks.npmBuildHook` probably won't work. A `buildPhase` based on the following example will probably fit most workspace projects:
+
+```nix
+buildPhase = ''
+  runHook preBuild
+
+  pnpm --filter=@astrojs/language-server build
+
+  runHook postBuild
+'';
+```
+
+#### Additional PNPM Commands and settings {#javascript-pnpm-extraCommands}
+
+If you require setting an additional PNPM configuration setting (such as `dedupe-peer-dependents` or similar),
+set `prePnpmInstall` to the right commands to run. For example:
+
+```nix
+prePnpmInstall = ''
+  pnpm config set dedupe-peer-dependants false
+'';
+pnpmDeps = pnpm.fetchDeps {
+  inherit (finalAttrs) prePnpmInstall;
+  ...
+};
+```
+
+In this example, `prePnpmInstall` will be run by both `pnpm.configHook` and by the `pnpm.fetchDeps` builder.
+
+
 ### yarn2nix {#javascript-yarn2nix}
 
 #### Preparation {#javascript-yarn2nix-preparation}
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 0981122388bb..9eacf831bac5 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -255,6 +255,22 @@ let
         if final.isMacOS then "MACOSX_DEPLOYMENT_TARGET"
         else if final.isiOS then "IPHONEOS_DEPLOYMENT_TARGET"
         else null;
+
+      # Remove before 25.05
+      androidSdkVersion =
+        if (args ? sdkVer && !args ? androidSdkVersion) then
+          throw "For android `sdkVer` has been renamed to `androidSdkVersion`"
+        else if (args ? androidSdkVersion) then
+          args.androidSdkVersion
+        else
+          null;
+      androidNdkVersion =
+        if (args ? ndkVer && !args ? androidNdkVersion) then
+          throw "For android `ndkVer` has been renamed to `androidNdkVersion`"
+        else if (args ? androidSdkVersion) then
+          args.androidNdkVersion
+        else
+          null;
     } // (
       let
         selectEmulator = pkgs:
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 79ec4461e419..ae76569ad859 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -60,23 +60,23 @@ rec {
   armv7a-android-prebuilt = {
     config = "armv7a-unknown-linux-androideabi";
     rustc.config = "armv7-linux-androideabi";
-    sdkVer = "28";
-    ndkVer = "24";
+    androidSdkVersion = "28";
+    androidNdkVersion = "24";
     useAndroidPrebuilt = true;
   } // platforms.armv7a-android;
 
   aarch64-android-prebuilt = {
     config = "aarch64-unknown-linux-android";
     rustc.config = "aarch64-linux-android";
-    sdkVer = "28";
-    ndkVer = "24";
+    androidSdkVersion = "28";
+    androidNdkVersion = "24";
     useAndroidPrebuilt = true;
   };
 
   aarch64-android = {
     config = "aarch64-unknown-linux-android";
-    sdkVer = "30";
-    ndkVer = "24";
+    androidSdkVersion = "30";
+    androidNdkVersion = "24";
     libc = "bionic";
     useAndroidPrebuilt = false;
     useLLVM = true;
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7e3f45435799..ee728a947dbd 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19051,13 +19051,6 @@
     githubId = 2666479;
     name = "Y Nguyen";
   };
-  superherointj = {
-    email = "sergiomarcelo@yandex.com";
-    github = "superherointj";
-    githubId = 5861043;
-    matrix = "@superherointj:matrix.org";
-    name = "Sérgio Marcelo";
-  };
   SuperSandro2000 = {
     email = "sandro.jaeckel@gmail.com";
     matrix = "@sandro:supersandro.de";
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index c9276ac28e65..ce22447d7937 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3919,7 +3919,7 @@ let
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=signageos.signageos-vscode-sops";
           homepage = "https://github.com/signageos/vscode-sops";
           license = lib.licenses.unfree;
-          maintainers = [ lib.maintainers.superherointj ];
+          maintainers = [ ];
         };
       };
 
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 952a13726f7a..539f5e657cb1 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -51,13 +51,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-36";
+  version = "7.1.1-37";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-Y/tj8IAhsCFK7Yd0MXZ8X6AOLxICyVOIaSaQveMf17k=";
+    hash = "sha256-dlcyCJw/tytb6z5VaogblUlzBRYBtijUJbkX3vZdeEU=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/networking/browsers/librewolf/librewolf.nix b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
index 4b9baf27c0e2..b5d143ddd327 100644
--- a/pkgs/applications/networking/browsers/librewolf/librewolf.nix
+++ b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
@@ -6,7 +6,7 @@ rec {
 
   inherit (src) packageVersion firefox source;
 
-  extraPatches = [ ];
+  extraPatches = [ "${source}/patches/pref-pane/pref-pane-small.patch" ];
 
   extraConfigureFlags = [
     "--with-app-name=librewolf"
@@ -26,6 +26,12 @@ rec {
     cp ${source}/assets/search-config.json services/settings/dumps/main/search-config.json
     sed -i '/MOZ_SERVICES_HEALTHREPORT/ s/True/False/' browser/moz.configure
     sed -i '/MOZ_NORMANDY/ s/True/False/' browser/moz.configure
+
+    cp ${source}/patches/pref-pane/category-librewolf.svg browser/themes/shared/preferences
+    cp ${source}/patches/pref-pane/librewolf.css browser/themes/shared/preferences
+    cp ${source}/patches/pref-pane/librewolf.inc.xhtml browser/components/preferences
+    cp ${source}/patches/pref-pane/librewolf.js browser/components/preferences
+    cat ${source}/patches/pref-pane/preferences.ftl >> browser/locales/en-US/browser/preferences/preferences.ftl
   '';
 
   extraPrefsFiles = [ "${source}/settings/librewolf.cfg" ];
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 33f1e7d3b1cf..c92c6fda87e5 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "129.0.1-1",
+  "packageVersion": "129.0.2-1",
   "source": {
-    "rev": "129.0.1-1",
-    "sha256": "0pvv3v23q31hdjvqi1f3cqfyjrb8dbrrbfwxj2wacak1g0mzbxf4"
+    "rev": "129.0.2-1",
+    "sha256": "1zghj91bqy2746x4x6cwn503dkw1fmfv0wgq02wv2cwlp8mmd7j7"
   },
   "firefox": {
-    "version": "129.0.1",
-    "sha512": "27c463e8277994c62bab85cf0e2f0cea16a9b272694b61fa56a6b3bd7c70d6481774288386094836a54df54c1b1144d61be67f4f5eac418c05479d452221c027"
+    "version": "129.0.2",
+    "sha512": "f6805a87e5cb4e437583916e3ec1b312dc73eec5fc06ce7a038b13bd7c6827b18cf383c30645d96623ce41675351f3023ec6b9f89d676f1c889994eae79f2c13"
   }
 }
diff --git a/pkgs/applications/networking/cluster/cilium/default.nix b/pkgs/applications/networking/cluster/cilium/default.nix
index 5353078e1d15..0e7aec795bba 100644
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@@ -42,7 +42,7 @@ buildGoModule rec {
     description = "CLI to install, manage & troubleshoot Kubernetes clusters running Cilium";
     license = lib.licenses.asl20;
     homepage = "https://www.cilium.io/";
-    maintainers = with lib.maintainers; [ bryanasdev000 humancalico qjoly superherointj ];
+    maintainers = with lib.maintainers; [ bryanasdev000 humancalico qjoly ];
     mainProgram = "cilium";
   };
 }
diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index 247ab0f339da..e3f8020cbaa0 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -95,7 +95,6 @@ let
     maintainers = with maintainers; [
       euank
       mic92
-      superherointj
       wrmilling
       yajo
     ];
diff --git a/pkgs/applications/networking/cluster/vcluster/default.nix b/pkgs/applications/networking/cluster/vcluster/default.nix
index f475ba4fbd0c..873854e21d1d 100644
--- a/pkgs/applications/networking/cluster/vcluster/default.nix
+++ b/pkgs/applications/networking/cluster/vcluster/default.nix
@@ -52,6 +52,6 @@ buildGoModule rec {
     homepage = "https://www.vcluster.com/";
     license = lib.licenses.asl20;
     mainProgram = "vcluster";
-    maintainers = with lib.maintainers; [ berryp peterromfeldhk qjoly superherointj ];
+    maintainers = with lib.maintainers; [ berryp peterromfeldhk qjoly ];
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index abd57741d898..c4f352ac67a1 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,30 +2,30 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.63";
-      ptb = "0.0.98";
-      canary = "0.0.465";
+      stable = "0.0.65";
+      ptb = "0.0.101";
+      canary = "0.0.475";
       development = "0.0.24";
     } else {
-      stable = "0.0.313";
-      ptb = "0.0.127";
-      canary = "0.0.574";
-      development = "0.0.45";
+      stable = "0.0.316";
+      ptb = "0.0.130";
+      canary = "0.0.583";
+      development = "0.0.46";
     };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-KtVX9EJPYmzDQd2beV/dDW8jjLDjacKZDrD72kLUwKo=";
+        hash = "sha256-kzYLZcjuG7k8RSjc5ooDlMKaAlMHvm0yCl5Krnhqq8A=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-aJx5ruZRCnBTf/Qon1uFfxMX2a25Xg2AzbnN/UtDe8w=";
+        hash = "sha256-JesxPoYybVLVwTrDwG2kO6Pikq7qvn7CO8j+24dwjBc=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-h4ULLPRhtGy6FZHKfj3AF0hjPhidVvJEbHOVgCh+6JQ=";
+        hash = "sha256-suVIDCZhI6DwUVizBmTm104Clr6pH/olAIbOMNzFNss=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -35,19 +35,19 @@ let
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-eQLPtwSX24+DOxvQcS2tFOMI6HNYedycl/U5GnzR6w0=";
+        hash = "sha256-ZJ2ybvKGGCm8CZhwGxmLXZWNUD1eAyg17zD/sBwViB4=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-Z2b4I8WzBaubb5oGEGpqC6VlVvObyQwKOH+mxCPMuMw=";
+        hash = "sha256-mLfeMx5dQNpoLUyoOSCj8XtNxWjsBpVWdFv1obtHJak=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-ZKjZf716RPOcXkZEFzvb4ojafafccVpjlLoEZv/GGec=";
+        hash = "sha256-eIjkXOW07sR26iBttT0mGDxNnpLFKlVJtzSAtFcicBg=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-KvomKLcDnHyRSGwKDxwb5AZbJqMwKpvP4BC0Sn7IVsk=";
+        hash = "sha256-nMihtf/xLIxwqAVrF1BSRewdS2WThx0LZ5HZUI+OzM0=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 60ef72756c34..9a431ad88530 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "17.2.2",
-  "repo_hash": "1gk29bwd6vzikjg28p30wgdq9a46l4qbnac5r0h2mwih1sm8hlbc",
+  "version": "17.2.4",
+  "repo_hash": "0hj1v7w68axzdy2lwwc320zpg2r2qv2f9rl23yisni6975p03ayi",
   "yarn_hash": "10y540bxwaz355p9r4q34199aibadrd5p4d9ck2y3n6735k0hm74",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v17.2.2-ee",
+  "rev": "v17.2.4-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "17.2.2",
-    "GITLAB_PAGES_VERSION": "17.2.2",
+    "GITALY_SERVER_VERSION": "17.2.4",
+    "GITLAB_PAGES_VERSION": "17.2.4",
     "GITLAB_SHELL_VERSION": "14.37.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.2.0",
-    "GITLAB_WORKHORSE_VERSION": "17.2.2"
+    "GITLAB_WORKHORSE_VERSION": "17.2.4"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 8d62fee32bf1..485af5b6efd9 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "17.2.2";
+  version = "17.2.4";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-4K0unlvhAnTIiuyRUNm0dXG5sJsxIuo8HkUQvUK7ws4=";
+      hash = "sha256-Y+Yi5kH/0s+yMuD/90Tdxeshp9m0Mrx080jmWnq/zZ0=";
     };
 
     vendorHash = "sha256-FqnGVRldhevJgBBvJcvGXzRaYWqSHzZiXIQmCNzJv+4=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
index 5c934a5afc83..0fecac629883 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "17.2.2";
+  version = "17.2.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-AtLsy2hHxqr3XyTItLfMoTmrUsM707Kme7jE2jAAfyc=";
+    hash = "sha256-7sB2MjU1iwqrOK8dNb7a14NFtrJ/7yoT07tzYVyCSJ8=";
   };
 
   vendorHash = "sha256-yNHeM8MExcLwv2Ga4vtBmPFBt/Rj7Gd4QQYDlnAIo+c=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 77ba5813469d..a7d2c7d2c0fd 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "17.2.2";
+  version = "17.2.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/ad/adwaita-icon-theme-legacy/package.nix b/pkgs/by-name/ad/adwaita-icon-theme-legacy/package.nix
new file mode 100644
index 000000000000..3ffe3c70f17c
--- /dev/null
+++ b/pkgs/by-name/ad/adwaita-icon-theme-legacy/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  meson,
+  ninja,
+  gtk4,
+  gnome,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "adwaita-icon-theme-legacy";
+  version = "46.2";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/adwaita-icon-theme-legacy/${lib.versions.major finalAttrs.version}/adwaita-icon-theme-legacy-${finalAttrs.version}.tar.xz";
+    hash = "sha256-VISA9YWJpUty0Ygzt1WxX/vVZ+MYcknXTi4fj5nyL7Q=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    gtk4 # for gtk4-update-icon-cache
+  ];
+
+  passthru = {
+    updateScript = gnome.updateScript {
+      packageName = "adwaita-icon-theme-legacy";
+    };
+  };
+
+  meta = with lib; {
+    description = "Fullcolor icon theme providing fallback for legacy apps";
+    homepage = "https://gitlab.gnome.org/GNOME/adwaita-icon-theme-legacy";
+    license = licenses.cc-by-sa-30;
+    maintainers = teams.gnome.members;
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index ce9bc31eb2bc..145f3dc10f3a 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -3,7 +3,7 @@
 , cargo
 , copyDesktopItems
 , dbus
-, electron_29
+, electron_31
 , fetchFromGitHub
 , glib
 , gnome
@@ -12,7 +12,6 @@
 , libsecret
 , makeDesktopItem
 , makeWrapper
-, moreutils
 , napi-rs-cli
 , nodejs_20
 , patchutils_0_4_2
@@ -26,41 +25,28 @@
 let
   description = "Secure and free password manager for all of your devices";
   icon = "bitwarden";
-  electron = electron_29;
+  electron = electron_31;
 in buildNpmPackage rec {
   pname = "bitwarden-desktop";
-  version = "2024.6.4";
+  version = "2024.8.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-oQ2VZoxePdYUC+xMKlRMpvPubSPULvt31XSh/OBw3Ec=";
+    hash = "sha256-szIa7fASDmeWKZPc6HtHKeXKerCAXrYZQWTVFMugAxk=";
   };
 
   patches = [
     ./electron-builder-package-lock.patch
   ];
 
-  # The nested package-lock.json from upstream is out-of-date, so copy the
-  # lock metadata from the root package-lock.json.
-  postPatch = ''
-    cat {,apps/desktop/src/}package-lock.json \
-      | ${lib.getExe jq} -s '
-        .[1].packages."".dependencies.argon2 = .[0].packages."".dependencies.argon2
-          | .[0].packages."" = .[1].packages.""
-          | .[1].packages = .[0].packages
-          | .[1]
-        ' \
-      | ${moreutils}/bin/sponge apps/desktop/src/package-lock.json
-  '';
-
   nodejs = nodejs_20;
 
   makeCacheWritable = true;
   npmFlags = [ "--engine-strict" "--legacy-peer-deps" ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-9d9pWrFYelAx/PPDHY3m92Frp8RSQuBqpiOjmWtm/1g=";
+  npmDepsHash = "sha256-5neEpU7ZhVO5OR181owsvAnFfl7lr0MymvqbRFCPs3M=";
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     name = "${pname}-${version}";
@@ -76,7 +62,7 @@ in buildNpmPackage rec {
       patches;
     patchFlags = [ "-p4" ];
     sourceRoot = "${src.name}/${cargoRoot}";
-    hash = "sha256-ZmblY1APVa8moAR1waVBZPhrf5Wt1Gi6dvAxkhizckQ=";
+    hash = "sha256-ya/5z5XpsyuWayziLxuETu/dY8LzZspaAMqL2p8jYN8=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 
@@ -87,10 +73,9 @@ in buildNpmPackage rec {
     copyDesktopItems
     jq
     makeWrapper
-    moreutils
     napi-rs-cli
     pkg-config
-    python3
+    (python3.withPackages (ps: with ps; [ setuptools ]))
     rustc
     rustPlatform.cargoCheckHook
     rustPlatform.cargoSetupHook
@@ -102,18 +87,36 @@ in buildNpmPackage rec {
     libsecret
   ];
 
+  # node-argon2 builds with LTO, but that causes missing symbols. So disable it
+  # and rebuild. Then we need to copy it into the build output for
+  # electron-builder, as `apps/desktop/src/package.json` specifies `argon2` as
+  # a dependency and electron-builder will otherwise install a fresh (and
+  # broken) argon2. See https://github.com/ranisalt/node-argon2/pull/415
+  preConfigure = ''
+    pushd node_modules/argon2
+    substituteInPlace binding.gyp --replace-fail '"-flto", ' ""
+    "$npm_config_node_gyp" rebuild
+    popd
+    mkdir -p apps/desktop/build/node_modules
+    cp -r ./{,apps/desktop/build/}node_modules/argon2
+  '';
+
   preBuild = ''
     if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '^[0-9]+') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
       echo 'ERROR: electron version mismatch'
       exit 1
     fi
+
+    pushd apps/desktop/desktop_native/napi
+    npm run build
+    popd
   '';
 
   postBuild = ''
     pushd apps/desktop
 
     # desktop_native/index.js loads a file of that name regarldess of the libc being used
-    mv desktop_native/desktop_native.* desktop_native/desktop_native.linux-x64-musl.node
+    mv desktop_native/napi/desktop_napi.* desktop_native/napi/desktop_napi.linux-x64-musl.node
 
     npm exec electron-builder -- \
       --dir \
diff --git a/pkgs/by-name/de/deploy-rs/package.nix b/pkgs/by-name/de/deploy-rs/package.nix
new file mode 100644
index 000000000000..9830785e6a30
--- /dev/null
+++ b/pkgs/by-name/de/deploy-rs/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  darwin,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "deploy-rs";
+  version = "0-unstable-2024-06-12";
+
+  src = fetchFromGitHub {
+    owner = "serokell";
+    repo = "deploy-rs";
+    rev = "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a";
+    hash = "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=";
+  };
+
+  cargoHash = "sha256-lsW810bktMzHZIbuN3pz9N+IUcjNtE5J2AuB/G6pGWI=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  meta = {
+    description = "Multi-profile Nix-flake deploy tool";
+    homepage = "https://github.com/serokell/deploy-rs";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ teutat3s ];
+    mainProgram = "deploy";
+  };
+}
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index 983a19455c4f..7fc2c4c4f06c 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "3.4.1";
+  version = "3.5.1";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-c8heIHt+EJ6LnZT4/6TTWd7v85VRHjH72bdje12un4M=";
+    hash = "sha256-LRMkwSrBU5/IPXMhRT05pE487nmSffXvmfbwBiqpyj8=";
   };
 
-  vendorHash = "sha256-FCCQZdAYRtJR3DGQIEvUzv+1kqvxVTGkwJwZSohq28s=";
+  vendorHash = "sha256-XLDtWYFHwBqbkzj4yRyr3uC1FnpS0bn1ia8i6m+CTBM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
index a8b172f4eb5d..561bae2a9b92 100644
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@@ -44,7 +44,7 @@ let
   buildInfo = ndkBuildInfoFun stdenv.buildPlatform;
   targetInfo = ndkTargetInfoFun stdenv.targetPlatform;
 
-  inherit (stdenv.targetPlatform) sdkVer;
+  androidSdkVersion = if (stdenv.targetPlatform ? androidSdkVersion && stdenv.targetPlatform.androidSdkVersion != null) then stdenv.targetPlatform.androidSdkVersion else (throw "`androidSdkVersion` is not set during the importing of nixpkgs");
   suffixSalt = lib.replaceStrings ["-" "."] ["_" "_"] stdenv.targetPlatform.config;
 
   # targetInfo.triple is what Google thinks the toolchain should be, this is a little
@@ -76,8 +76,8 @@ rec {
       cp -r ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} $out/toolchain
       find $out/toolchain -type d -exec chmod 777 {} \;
 
-      if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer} ]; then
-        echo "NDK does not contain libraries for SDK version ${sdkVer}";
+      if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion} ]; then
+        echo "NDK does not contain libraries for SDK version ${androidSdkVersion}";
         exit 1
       fi
 
@@ -85,8 +85,8 @@ rec {
       ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.so $out/lib/
       ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.a $out/lib/
       chmod +w $out/lib/*
-      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}/*.so $out/lib/
-      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}/*.o $out/lib/
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}/*.so $out/lib/
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}/*.o $out/lib/
 
       echo "INPUT(-lc++_static)" > $out/lib/libc++.a
 
@@ -129,7 +129,7 @@ rec {
     bintools = binutils;
     libc = targetAndroidndkPkgs.libraries;
     extraBuildCommands = ''
-      echo "-D__ANDROID_API__=${stdenv.targetPlatform.sdkVer}" >> $out/nix-support/cc-cflags
+      echo "-D__ANDROID_API__=${stdenv.targetPlatform.androidSdkVersion}" >> $out/nix-support/cc-cflags
       # Android needs executables linked with -pie since version 5.0
       # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
       echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
@@ -150,9 +150,9 @@ rec {
   # cross-compiling packages to wrap incorrectly wrap binaries we don't include
   # anyways.
   libraries = runCommand "bionic-prebuilt" {} ''
-    lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}
+    lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}
     if [ ! -d $lpath ]; then
-      echo "NDK does not contain libraries for SDK version ${sdkVer} <$lpath>"
+      echo "NDK does not contain libraries for SDK version ${androidSdkVersion} <$lpath>"
       exit 1
     fi
     mkdir -p $out/lib
diff --git a/pkgs/development/node-packages/node-env.nix b/pkgs/development/node-packages/node-env.nix
index bc1e36628ac8..5400fc63588e 100644
--- a/pkgs/development/node-packages/node-env.nix
+++ b/pkgs/development/node-packages/node-env.nix
@@ -109,7 +109,7 @@ let
     );
 
   # Recursively composes the dependencies of a package
-  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
+  composePackage = { name, packageName, src, dependencies ? [], ... }:
     builtins.addErrorContext "while evaluating node package '${packageName}'" ''
       installPackage "${packageName}" "${src}"
       ${includeDependencies { inherit dependencies; }}
@@ -194,7 +194,7 @@ let
   # dependencies in the package.json file to the versions that are actually
   # being used.
 
-  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
+  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }:
     ''
       if [ -d "${packageName}" ]
       then
@@ -496,7 +496,7 @@ let
     let
       extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
     in
-    stdenv.mkDerivation ({
+    stdenv.mkDerivation (finalAttrs: {
       name = "${name}${if version == null then "" else "-${version}"}";
       buildInputs = [ tarWrapper python nodejs ]
         ++ lib.optional (stdenv.isLinux) utillinux
@@ -508,8 +508,9 @@ let
       inherit dontStrip; # Stripping may fail a build for some package deployments
       inherit dontNpmInstall preRebuild unpackPhase buildPhase;
 
-      compositionScript = composePackage args;
-      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+      # TODO: enable overriding dependencies too?
+      compositionScript = composePackage { inherit packageName dependencies; inherit (finalAttrs) name src; };
+      pinpointDependenciesScript = pinpointDependenciesOfPackage { inherit packageName dependencies production; };
 
       passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
 
diff --git a/pkgs/development/tools/godot/4/default.nix b/pkgs/development/tools/godot/4/default.nix
index 111cf9e0a187..bb197071162a 100644
--- a/pkgs/development/tools/godot/4/default.nix
+++ b/pkgs/development/tools/godot/4/default.nix
@@ -155,7 +155,7 @@ stdenv.mkDerivation rec {
     description = "Free and Open Source 2D and 3D game engine";
     license = lib.licenses.mit;
     platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
-    maintainers = with lib.maintainers; [ shiryel superherointj ];
+    maintainers = with lib.maintainers; [ shiryel ];
     mainProgram = "godot4";
   };
 }
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
new file mode 100644
index 000000000000..232948d7a093
--- /dev/null
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -0,0 +1,20 @@
+{ lib, callPackage }:
+let
+  inherit (lib) mapAttrs' nameValuePair;
+
+  variants = {
+    "8" = {
+      version = "8.15.9";
+      hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
+    };
+    "9" = {
+      version = "9.7.0";
+      hash = "sha256-s1AY+/qPWDZosmSeQHkipyE1XNgfYb7rSsHUJY5YVVk=";
+    };
+  };
+
+  callPnpm = variant: callPackage ./generic.nix {inherit (variant) version hash;};
+
+  mkPnpm = versionSuffix: variant: nameValuePair "pnpm_${versionSuffix}" (callPnpm variant);
+in
+mapAttrs' mkPnpm variants
diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
new file mode 100644
index 000000000000..e5032da10590
--- /dev/null
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -0,0 +1,107 @@
+{
+  lib,
+  stdenvNoCC,
+  callPackage,
+  jq,
+  moreutils,
+  cacert,
+  makeSetupHook,
+  pnpm,
+  yq,
+}:
+{
+  fetchDeps =
+    {
+      hash ? "",
+      pname,
+      pnpmWorkspace ? "",
+      prePnpmInstall ? "",
+      ...
+    }@args:
+    let
+      args' = builtins.removeAttrs args [
+        "hash"
+        "pname"
+      ];
+      hash' =
+        if hash != "" then
+          { outputHash = hash; }
+        else
+          {
+            outputHash = "";
+            outputHashAlgo = "sha256";
+          };
+      installFlags = lib.optionalString (pnpmWorkspace != "")  "--filter=${pnpmWorkspace}";
+    in
+    stdenvNoCC.mkDerivation (finalAttrs: (
+      args'
+      // {
+        name = "${pname}-pnpm-deps";
+
+        nativeBuildInputs = [
+          cacert
+          jq
+          moreutils
+          pnpm
+          yq
+        ];
+
+        installPhase = ''
+          runHook preInstall
+
+          lockfileVersion="$(yq -r .lockfileVersion pnpm-lock.yaml)"
+          if [[ ''${lockfileVersion:0:1} -gt ${lib.versions.major pnpm.version} ]]; then
+            echo "ERROR: lockfileVersion $lockfileVersion in pnpm-lock.yaml is too new for the provided pnpm version ${lib.versions.major pnpm.version}!"
+            exit 1
+          fi
+
+          export HOME=$(mktemp -d)
+          pnpm config set store-dir $out
+          # Some packages produce platform dependent outputs. We do not want to cache those in the global store
+          pnpm config set side-effects-cache false
+          # As we pin pnpm versions, we don't really care about updates
+          pnpm config set update-notifier false
+          # Run any additional pnpm configuration commands that users provide.
+          ${prePnpmInstall}
+          # pnpm is going to warn us about using --force
+          # --force allows us to fetch all dependencies including ones that aren't meant for our host platform
+          pnpm install \
+              --force \
+              --ignore-scripts \
+              ${installFlags} \
+              --frozen-lockfile
+
+          runHook postInstall
+        '';
+
+        fixupPhase = ''
+          runHook preFixup
+
+          # Remove timestamp and sort the json files
+          rm -rf $out/v3/tmp
+          for f in $(find $out -name "*.json"); do
+            jq --sort-keys "del(.. | .checkedAt?)" $f | sponge $f
+          done
+
+          runHook postFixup
+        '';
+
+        passthru = {
+          serve = callPackage ./serve.nix {
+            inherit pnpm;
+            pnpmDeps = finalAttrs.finalPackage;
+          };
+        };
+
+        dontConfigure = true;
+        dontBuild = true;
+        outputHashMode = "recursive";
+      }
+      // hash'
+    ));
+
+  configHook = makeSetupHook {
+    name = "pnpm-config-hook";
+    propagatedBuildInputs = [ pnpm ];
+  } ./pnpm-config-hook.sh;
+}
diff --git a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
new file mode 100644
index 000000000000..e82a62f9101c
--- /dev/null
+++ b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
@@ -0,0 +1,50 @@
+# shellcheck shell=bash
+
+pnpmConfigHook() {
+    echo "Executing pnpmConfigHook"
+
+    if [ -n "${pnpmRoot-}" ]; then
+      pushd "$pnpmRoot"
+    fi
+
+    if [ -z "${pnpmDeps-}" ]; then
+      echo "Error: 'pnpmDeps' must be set when using pnpmConfigHook."
+      exit 1
+    fi
+
+    echo "Configuring pnpm store"
+
+    export HOME=$(mktemp -d)
+    export STORE_PATH=$(mktemp -d)
+
+    cp -Tr "$pnpmDeps" "$STORE_PATH"
+    chmod -R +w "$STORE_PATH"
+
+    pnpm config set store-dir "$STORE_PATH"
+
+    echo "Installing dependencies"
+
+    if [[ -n "$pnpmWorkspace" ]]; then
+        pnpmInstallFlags+=("--filter=$pnpmWorkspace")
+    fi
+    runHook prePnpmInstall
+
+    pnpm install \
+        --offline \
+        --ignore-scripts \
+        "${pnpmInstallFlags[@]}" \
+        --frozen-lockfile
+
+
+    echo "Patching scripts"
+
+    patchShebangs node_modules/{*,.*}
+
+    if [ -n "${pnpmRoot-}" ]; then
+      popd
+    fi
+
+    echo "Finished pnpmConfigHook"
+}
+
+postConfigureHooks+=(pnpmConfigHook)
diff --git a/pkgs/development/tools/pnpm/fetch-deps/serve.nix b/pkgs/development/tools/pnpm/fetch-deps/serve.nix
new file mode 100644
index 000000000000..a44022d841dc
--- /dev/null
+++ b/pkgs/development/tools/pnpm/fetch-deps/serve.nix
@@ -0,0 +1,30 @@
+{ writeShellApplication, pnpm, pnpmDeps }:
+writeShellApplication {
+  name = "serve-pnpm-store";
+
+  runtimeInputs = [
+    pnpm
+  ];
+
+  text = ''
+    storePath=$(mktemp -d)
+
+    clean() {
+      echo "Cleaning up temporary store at '$storePath'..."
+
+      rm -rf "$storePath"
+    }
+
+    echo "Copying pnpm store '${pnpmDeps}' to temporary store..."
+
+    cp -Tr "${pnpmDeps}" "$storePath"
+    chmod -R +w "$storePath"
+
+    echo "Run 'pnpm install --store-dir \"$storePath\"' to install packages from this store."
+
+    trap clean EXIT
+
+    pnpm server start \
+      --store-dir "$storePath"
+  '';
+}
diff --git a/pkgs/development/tools/pnpm/generic.nix b/pkgs/development/tools/pnpm/generic.nix
new file mode 100644
index 000000000000..7050df448970
--- /dev/null
+++ b/pkgs/development/tools/pnpm/generic.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenvNoCC,
+  callPackages,
+  fetchurl,
+  installShellFiles,
+  nodejs,
+  testers,
+  withNode ? true,
+
+  version,
+  hash,
+}: stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "pnpm";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://registry.npmjs.org/pnpm/-/pnpm-${finalAttrs.version}.tgz";
+    inherit hash;
+  };
+  # Remove binary files from src, we don't need them, and this way we make sure
+  # our distribution is free of binaryNativeCode
+  preConfigure = ''
+    rm -r dist/reflink.*node dist/vendor
+  '';
+
+  buildInputs = lib.optionals withNode [ nodejs ];
+
+  nativeBuildInputs = [ installShellFiles nodejs ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -d $out/{bin,libexec}
+    cp -R . $out/libexec/pnpm
+    ln -s $out/libexec/pnpm/bin/pnpm.cjs $out/bin/pnpm
+    ln -s $out/libexec/pnpm/bin/pnpx.cjs $out/bin/pnpx
+
+    runHook postInstall
+  '';
+
+  postInstall =
+    if lib.toInt (lib.versions.major version) < 9 then ''
+      export HOME="$PWD"
+      node $out/bin/pnpm install-completion bash
+      node $out/bin/pnpm install-completion fish
+      node $out/bin/pnpm install-completion zsh
+      sed -i '1 i#compdef pnpm' .config/tabtab/zsh/pnpm.zsh
+      installShellCompletion \
+        .config/tabtab/bash/pnpm.bash \
+        .config/tabtab/fish/pnpm.fish \
+        .config/tabtab/zsh/pnpm.zsh
+    '' else ''
+      node $out/bin/pnpm completion bash >pnpm.bash
+      node $out/bin/pnpm completion fish >pnpm.fish
+      node $out/bin/pnpm completion zsh >pnpm.zsh
+      sed -i '1 i#compdef pnpm' pnpm.zsh
+      installShellCompletion pnpm.{bash,fish,zsh}
+    '';
+
+  passthru = let
+    fetchDepsAttrs = callPackages ./fetch-deps { pnpm = finalAttrs.finalPackage; };
+  in {
+    inherit (fetchDepsAttrs) fetchDeps configHook;
+
+    tests.version = lib.optionalAttrs withNode (
+      testers.testVersion { package = finalAttrs.finalPackage; }
+    );
+  };
+
+  meta = with lib; {
+    description = "Fast, disk space efficient package manager for JavaScript";
+    homepage = "https://pnpm.io/";
+    changelog = "https://github.com/pnpm/pnpm/releases/tag/v${finalAttrs.version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Scrumplex ];
+    platforms = platforms.all;
+    mainProgram = "pnpm";
+  };
+})
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index ca7ec693fc00..949ad2eef5ad 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.11-rc4",
-        "hash": "sha256:1cjvsmnnzm2gc8m56jbn07r8zfz6b96701njhy2bbd4a800zx1hi"
+        "version": "6.11-rc5",
+        "hash": "sha256:06qq6y7cryq0xy4b68ky2hr44cw2nqhbna0dbzfbmr9d5sh9c0gn"
     },
     "6.1": {
         "version": "6.1.106",
diff --git a/pkgs/servers/etcd/3.5/default.nix b/pkgs/servers/etcd/3.5/default.nix
index a837ae4713ca..7ea9dc628894 100644
--- a/pkgs/servers/etcd/3.5/default.nix
+++ b/pkgs/servers/etcd/3.5/default.nix
@@ -20,7 +20,7 @@ let
     description = "Distributed reliable key-value store for the most critical data of a distributed system";
     license = licenses.asl20;
     homepage = "https://etcd.io/";
-    maintainers = with maintainers; [ offline superherointj ];
+    maintainers = with maintainers; [ offline ];
     platforms = platforms.darwin ++ platforms.linux;
   };
 
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index 1cbbfeb6d202..8aa83b8aa858 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -64,7 +64,7 @@ in lib.init bootStages ++ [
         cc = if crossSystem.useiOSPrebuilt or false
                then buildPackages.darwin.iosSdkPkgs.clang
              else if crossSystem.useAndroidPrebuilt or false
-               then buildPackages."androidndkPkgs_${crossSystem.ndkVer}".clang
+               then buildPackages."androidndkPkgs_${crossSystem.androidNdkVersion}".clang
              else if targetPlatform.isGhcjs
                # Need to use `throw` so tryEval for splicing works, ugh.  Using
                # `null` or skipping the attribute would cause an eval failure
diff --git a/pkgs/tools/package-management/deploy-rs/default.nix b/pkgs/tools/package-management/deploy-rs/default.nix
deleted file mode 100644
index ad656ca385e4..000000000000
--- a/pkgs/tools/package-management/deploy-rs/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, rustPlatform
-, CoreServices
-, SystemConfiguration
-}:
-
-rustPlatform.buildRustPackage {
-  pname = "deploy-rs";
-  version = "unstable-2024-02-16";
-
-  src = fetchFromGitHub {
-    owner = "serokell";
-    repo = "deploy-rs";
-    rev = "0a0187794ac7f7a1e62cda3dabf8dc041f868790";
-    hash = "sha256-dTGGw2y8wvfjr+J9CjQbfdulOq72hUG17HXVNxpH1yE=";
-  };
-
-  cargoHash = "sha256-Vo/45cZM/sBAaoikhEwCvduhMQjurwSZwCjwrIQn7IA=";
-
-  buildInputs = lib.optionals stdenv.isDarwin [
-    CoreServices
-    SystemConfiguration
-  ];
-
-  meta = with lib; {
-    description = "Multi-profile Nix-flake deploy tool";
-    homepage = "https://github.com/serokell/deploy-rs";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ teutat3s ];
-    mainProgram = "deploy";
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4dc9c547e6c6..3fc3bc28e3b0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11891,6 +11891,10 @@ with pkgs;
 
   pngquant = callPackage ../tools/graphics/pngquant { };
 
+  inherit (callPackages ../development/tools/pnpm { })
+    pnpm_8 pnpm_9;
+  pnpm = pnpm_9;
+
   po4a = perlPackages.Po4a;
 
   poac = callPackage ../development/tools/poac {
@@ -20101,7 +20105,7 @@ with pkgs;
 
   # TODO(@Ericson2314): Build bionic libc from source
   bionic = if stdenv.hostPlatform.useAndroidPrebuilt
-    then pkgs."androidndkPkgs_${stdenv.hostPlatform.ndkVer}".libraries
+    then pkgs."androidndkPkgs_${stdenv.hostPlatform.androidNdkVer}".libraries
     else callPackage ../os-specific/linux/bionic-prebuilt { };
 
   boolstuff = callPackage ../development/libraries/boolstuff { };
@@ -39173,10 +39177,6 @@ with pkgs;
 
   dell-530cdn = callPackage ../misc/drivers/dell-530cdn { };
 
-  deploy-rs = callPackage ../tools/package-management/deploy-rs {
-    inherit (darwin.apple_sdk.frameworks) CoreServices SystemConfiguration;
-  };
-
   dockutil = callPackage ../os-specific/darwin/dockutil { };
 
   eiciel = callPackage ../tools/filesystems/eiciel { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 28e48975c4d3..4ff91b21e584 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7288,10 +7288,10 @@ with self; {
 
   DBI = buildPerlPackage {
     pname = "DBI";
-    version = "1.643";
+    version = "1.644";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TI/TIMB/DBI-1.643.tar.gz";
-      hash = "sha256-iiuZPbVgosNzwXTul2pRAn3XgOx2auF2IMIDk9LoNvo=";
+      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.644.tar.gz";
+      hash = "sha256-Ipe5neCeZwhmQLWQaZ4OmC+0adpjqT/ijcFHgtt6U8g=";
     };
     postInstall = lib.optionalString (perl ? crossVersion) ''
       mkdir -p $out/${perl.libPrefix}/cross_perl/${perl.version}/DBI