diff --git a/doc/build-helpers/images.md b/doc/build-helpers/images.md
index 5596784bfa48..033891fcef48 100644
--- a/doc/build-helpers/images.md
+++ b/doc/build-helpers/images.md
@@ -6,7 +6,6 @@ This chapter describes tools for creating various types of images.
 images/appimagetools.section.md
 images/dockertools.section.md
 images/ocitools.section.md
-images/snaptools.section.md
 images/portableservice.section.md
 images/makediskimage.section.md
 images/binarycache.section.md
diff --git a/doc/build-helpers/images/snaptools.section.md b/doc/build-helpers/images/snaptools.section.md
deleted file mode 100644
index 259fa1b06180..000000000000
--- a/doc/build-helpers/images/snaptools.section.md
+++ /dev/null
@@ -1,71 +0,0 @@
-# pkgs.snapTools {#sec-pkgs-snapTools}
-
-`pkgs.snapTools` is a set of functions for creating Snapcraft images. Snap and Snapcraft is not used to perform these operations.
-
-## The makeSnap Function {#ssec-pkgs-snapTools-makeSnap-signature}
-
-`makeSnap` takes a single named argument, `meta`. This argument mirrors [the upstream `snap.yaml` format](https://docs.snapcraft.io/snap-format) exactly.
-
-The `base` should not be specified, as `makeSnap` will force set it.
-
-Currently, `makeSnap` does not support creating GUI stubs.
-
-## Build a Hello World Snap {#ssec-pkgs-snapTools-build-a-snap-hello}
-
-The following expression packages GNU Hello as a Snapcraft snap.
-
-``` {#ex-snapTools-buildSnap-hello .nix}
-let
-  inherit (import <nixpkgs> { }) snapTools hello;
-in snapTools.makeSnap {
-  meta = {
-    name = "hello";
-    summary = hello.meta.description;
-    description = hello.meta.longDescription;
-    architectures = [ "amd64" ];
-    confinement = "strict";
-    apps.hello.command = "${hello}/bin/hello";
-  };
-}
-```
-
-`nix-build` this expression and install it with `snap install ./result --dangerous`. `hello` will now be the Snapcraft version of the package.
-
-## Build a Graphical Snap {#ssec-pkgs-snapTools-build-a-snap-firefox}
-
-Graphical programs require many more integrations with the host. This example uses Firefox as an example because it is one of the most complicated programs we could package.
-
-``` {#ex-snapTools-buildSnap-firefox .nix}
-let
-  inherit (import <nixpkgs> { }) snapTools firefox;
-in snapTools.makeSnap {
-  meta = {
-    name = "nix-example-firefox";
-    summary = firefox.meta.description;
-    architectures = [ "amd64" ];
-    apps.nix-example-firefox = {
-      command = "${firefox}/bin/firefox";
-      plugs = [
-        "pulseaudio"
-        "camera"
-        "browser-support"
-        "avahi-observe"
-        "cups-control"
-        "desktop"
-        "desktop-legacy"
-        "gsettings"
-        "home"
-        "network"
-        "mount-observe"
-        "removable-media"
-        "x11"
-      ];
-    };
-    confinement = "strict";
-  };
-}
-```
-
-`nix-build` this expression and install it with `snap install ./result --dangerous`. `nix-example-firefox` will now be the Snapcraft version of the Firefox package.
-
-The specific meaning behind plugs can be looked up in the [Snapcraft interface documentation](https://docs.snapcraft.io/supported-interfaces).
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 22689868cf02..710172699abf 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -123,14 +123,14 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `k3s`: was updated to version [v1.29](https://github.com/k3s-io/k3s/releases/tag/v1.29.1%2Bk3s2), all previous versions (k3s_1_26, k3s_1_27, k3s_1_28) will be removed. See [changelog and upgrade notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#urgent-upgrade-notes) for more information.
+
 - `himalaya` was updated to `v1.0.0-beta.3`, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta.3) for details.
 
 - The `power.ups` module now generates `upsd.conf`, `upsd.users` and `upsmon.conf` automatically from a set of new configuration options. This breaks compatibility with existing `power.ups` setups where these files were created manually. Back up these files before upgrading NixOS.
 
 - `unrar` was updated to v7. See [changelog](https://www.rarlab.com/unrar7notes.htm) for more information.
 
-- `k3s` was updated to [v1.29](https://github.com/k3s-io/k3s/releases/tag/v1.29.1%2Bk3s2). See [changelog and upgrade notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#urgent-upgrade-notes) for more information.
-
 - `k9s` was updated to v0.31. There have been various breaking changes in the config file format,
   check out the changelog of [v0.29](https://github.com/derailed/k9s/releases/tag/v0.29.0),
   [v0.30](https://github.com/derailed/k9s/releases/tag/v0.30.0) and
diff --git a/pkgs/applications/graphics/lightburn/default.nix b/pkgs/applications/graphics/lightburn/default.nix
index 7ac16d934fa8..34b1a6d0f57e 100644
--- a/pkgs/applications/graphics/lightburn/default.nix
+++ b/pkgs/applications/graphics/lightburn/default.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lightburn";
-  version = "1.5.02";
+  version = "1.5.03";
 
   nativeBuildInputs = [
     p7zip
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/LightBurnSoftware/deployment/releases/download/${version}/LightBurn-Linux64-v${version}.7z";
-    sha256 = "sha256-1gmiPWrNk3T8WJ9u/4UzrhwxOcPUKyWIqtwqJiXA4c4=";
+    sha256 = "sha256-p1vbpxRrcNInftBkVVhIckVsrZQRvlk/323D5zIjXJ8=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/opentoonz/default.nix b/pkgs/applications/graphics/opentoonz/default.nix
index 7fd9606f3abc..1214d868d5c8 100644
--- a/pkgs/applications/graphics/opentoonz/default.nix
+++ b/pkgs/applications/graphics/opentoonz/default.nix
@@ -36,6 +36,7 @@ in stdenv.mkDerivation rec {
 
   cmakeDir = "../sources";
   cmakeFlags = [
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
     "-DTIFF_INCLUDE_DIR=${libtiff.dev}/include"
     "-DTIFF_LIBRARY=${libtiff.out}/lib/libtiff.so"
   ];
diff --git a/pkgs/applications/graphics/opentoonz/source.nix b/pkgs/applications/graphics/opentoonz/source.nix
index 27a4b8c0b0d2..2864dcf36088 100644
--- a/pkgs/applications/graphics/opentoonz/source.nix
+++ b/pkgs/applications/graphics/opentoonz/source.nix
@@ -3,7 +3,7 @@
 
 { fetchFromGitHub, }: rec {
   versions = {
-    opentoonz = "1.5.0";
+    opentoonz = "1.7.1";
     libtiff = "4.0.3";  # The version in thirdparty/tiff-*
   };
 
@@ -11,6 +11,6 @@
     owner = "opentoonz";
     repo = "opentoonz";
     rev = "v${versions.opentoonz}";
-    sha256 = "1rw30ksw3zjph1cwxkfvqj0330v8wd4333gn0fdf3cln1w0549lk";
+    hash = "sha256-5iXOvh4QTv+G0fjEHU62u7QCee+jbvKhK0+fQXbdJis=";
   };
 }
diff --git a/pkgs/applications/graphics/photoqt/default.nix b/pkgs/applications/graphics/photoqt/default.nix
index 5d1ce4129791..ccc95ac94216 100644
--- a/pkgs/applications/graphics/photoqt/default.nix
+++ b/pkgs/applications/graphics/photoqt/default.nix
@@ -20,16 +20,17 @@
 , qtmultimedia
 , qtpositioning
 , qtsvg
+, zxing-cpp
 , qtwayland
 }:
 
 stdenv.mkDerivation rec {
   pname = "photoqt";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchurl {
     url = "https://photoqt.org/pkgs/photoqt-${version}.tar.gz";
-    hash = "sha256-OUqsyvmv6ccJDzcWAeS1OOmK2eXOCEgGktz6GEUzoA8=";
+    hash = "sha256-B0ZubvWIEZFnD2v74bpPv+/wr7vaHS9QP4//9/afjzQ=";
   };
 
   nativeBuildInputs = [
@@ -55,20 +56,19 @@ stdenv.mkDerivation rec {
     qtmultimedia
     qtpositioning
     qtsvg
+    zxing-cpp
   ] ++ lib.optionals stdenv.isLinux [
     qtwayland
   ];
 
   cmakeFlags = [
-    "-DDEVIL=OFF"
-    "-DCHROMECAST=OFF"
-    "-DFREEIMAGE=OFF"
-    "-DIMAGEMAGICK=OFF"
+    (lib.cmakeBool "DEVIL" false)
+    (lib.cmakeBool "CHROMECAST" false)
+    (lib.cmakeBool "FREEIMAGE" false)
+    (lib.cmakeBool "IMAGEMAGICK" false)
   ];
 
-  preConfigure = ''
-    export MAGICK_LOCATION="${graphicsmagick}/include/GraphicsMagick"
-  '';
+  env.MAGICK_LOCATION = "${graphicsmagick}/include/GraphicsMagick";
 
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
diff --git a/pkgs/applications/misc/hcl2json/default.nix b/pkgs/applications/misc/hcl2json/default.nix
index be6da03f1708..40bfede8551f 100644
--- a/pkgs/applications/misc/hcl2json/default.nix
+++ b/pkgs/applications/misc/hcl2json/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "hcl2json";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "tmccombs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6DCxpnTizTg3uhHIIze2IyA8IKcjIv44XoId7exdQZI=";
+    sha256 = "sha256-lnmWIyS1byXvShR1/ej8PAuo+WJBEBykQwJ79439Fus=";
   };
 
-  vendorHash = "sha256-Ay6Sgdm7X+NxtLkFM0AT8aoWLdASjUhcidRUiV2K+us=";
+  vendorHash = "sha256-HbdectUQgyQZ9qcfBarwRTF3VjzSqaM2vhVekThv2+k=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/misc/inlyne/default.nix b/pkgs/applications/misc/inlyne/default.nix
index d9698c04aed5..665a910cb103 100644
--- a/pkgs/applications/misc/inlyne/default.nix
+++ b/pkgs/applications/misc/inlyne/default.nix
@@ -6,6 +6,8 @@
 , pkg-config
 , fontconfig
 , xorg
+, libxkbcommon
+, wayland
 , libGL
 , openssl
 , darwin
@@ -13,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inlyne";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "trimental";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DSi6iS1ySdvGf6FxZpsDOAFpAKx/APcZjxA3Qy0gQBU=";
+    hash = "sha256-dDGTy5WOCyeWYfemVtv+YswNyHSqDL4C7MbHsKgRwLk=";
   };
 
-  cargoHash = "sha256-UzegSJGAOBUDN8WluN7fLWS7NfHhm9YY0Zuq6DCIqHo=";
+  cargoHash = "sha256-GDy7/FooHD77X5dZmlLX+isRKr2WjadKPKyVD55M9ZE=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -36,6 +38,8 @@ rustPlatform.buildRustPackage rec {
     xorg.libXi
     xorg.libXrandr
     xorg.libxcb
+    wayland
+    libxkbcommon
     openssl
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk_11_0.frameworks.AppKit
diff --git a/pkgs/applications/misc/whalebird/default.nix b/pkgs/applications/misc/whalebird/default.nix
index ce7d178f1c05..665cae9d4bd9 100644
--- a/pkgs/applications/misc/whalebird/default.nix
+++ b/pkgs/applications/misc/whalebird/default.nix
@@ -1,38 +1,54 @@
-{ lib, stdenv, fetchurl
-, autoPatchelfHook, makeDesktopItem, copyDesktopItems, makeWrapper, gnugrep, asar
-, electron, python3, alsa-lib, gtk3, libdbusmenu, libxshmfence, mesa, nss
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeDesktopItem
+, copyDesktopItems
+, makeWrapper
+, electron
+, cacert
+, gitMinimal
+, yarn
 }:
-
 stdenv.mkDerivation rec {
   pname = "whalebird";
-  version = "5.0.7";
+  version = "6.0.4";
 
-  src = let
-    downloads = "https://github.com/h3poteto/whalebird-desktop/releases/download/v${version}";
-  in
-    if stdenv.system == "x86_64-linux" then
-      fetchurl {
-        url = downloads + "/Whalebird-${version}-linux-x64.tar.bz2";
-        hash = "sha256-eufP038REwF2VwAxxI8R0S3fE8oJ+SX/CES5ozuut2w=";
-      }
-    else if stdenv.system == "aarch64-linux" then
-      fetchurl {
-        url = downloads + "/Whalebird-${version}-linux-arm64.tar.bz2";
-        hash = "sha256-U0xVTUUm6wsRxYc1w4vfNtVE6o8dNzXTSi+IX4mgDEE=";
-      }
-    else
-      throw "Whalebird is not supported for ${stdenv.system}";
+  src = fetchFromGitHub {
+    owner = "h3poteto";
+    repo = "whalebird-desktop";
+    rev = "v${version}";
+    hash = "sha256-Yx0GEEPJ+d4/RvCbqZdKR6iE2iUNbOJr+RuboqjT8z8=";
+  };
+  # we cannot use fetchYarnDeps because that doesn't support yarn 2/berry lockfiles
+  offlineCache = stdenv.mkDerivation {
+    name = "whalebird-${version}-offline-cache";
+    inherit src;
+
+    nativeBuildInputs = [
+      cacert # needed for git
+      gitMinimal # needed to download git dependencies
+      yarn
+    ];
+
+    buildPhase = ''
+      export HOME=$(mktemp -d)
+      yarn config set enableTelemetry 0
+      yarn config set cacheFolder $out
+      yarn config set --json supportedArchitectures.os '[ "linux" ]'
+      yarn config set --json supportedArchitectures.cpu '[ "arm64", "x64" ]'
+      yarn
+    '';
+
+    outputHashMode = "recursive";
+    outputHash = "sha256-RjTGAgHRRQ4O3eTYpmTrl+KXafDZkWf1NH6lzdozVAA=";
+  };
 
   nativeBuildInputs = [
-    autoPatchelfHook
     makeWrapper
     copyDesktopItems
-    gnugrep
-    asar
+    yarn
   ];
 
-  buildInputs = [ alsa-lib gtk3 libdbusmenu libxshmfence mesa nss ];
-
   desktopItems = [
     (makeDesktopItem {
       desktopName = "Whalebird";
@@ -44,28 +60,21 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  unpackPhase = ''
-    mkdir -p opt
-    tar -xf ${src} -C opt
-    # remove the version/target suffix from the untar'd directory
-    mv opt/Whalebird-* opt/Whalebird
-  '';
+  ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   buildPhase = ''
     runHook preBuild
 
-    # Necessary steps to find the tray icon
-    # For aarch64-linux, we need to overwrite this symlink first as it points to
-    # /usr/bin/python3
-    if [ "${stdenv.system}" = "aarch64-linux" ]
-    then ln -sf ${python3}/bin/python3 \
-      opt/Whalebird/resources/app.asar.unpacked/node_modules/better-sqlite3/build/node_gyp_bins/python3
-    fi
-    asar extract opt/Whalebird/resources/app.asar "$TMP/work"
-    substituteInPlace "$TMP/work/dist/electron/main.js" \
-      --replace "$(grep -oE '.{2},"tray_icon.png"' "$TMP/work/dist/electron/main.js")" \
-        "\"$out/opt/Whalebird/resources/build/icons/tray_icon.png\""
-    asar pack --unpack='{*.node,*.ftz,rect-overlay}' "$TMP/work" opt/Whalebird/resources/app.asar
+    export HOME=$(mktemp -d)
+    yarn config set enableTelemetry 0
+    yarn config set cacheFolder ${offlineCache}
+
+    yarn --immutable-cache
+    yarn run nextron build --no-pack
+    yarn run electron-builder --dir \
+      --config electron-builder.yml \
+      -c.electronDist="${electron}/libexec/electron" \
+      -c.electronVersion=${electron.version}
 
     runHook postBuild
   '';
@@ -73,26 +82,29 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    mkdir $out
-    mv opt $out
+    mkdir -p $out/opt
+    cp -r ./dist/linux-unpacked $out/opt/Whalebird
 
-    # install icons
-    for icon in $out/opt/Whalebird/resources/build/icons/*.png; do
-      mkdir -p "$out/share/icons/hicolor/$(basename $icon .png)/apps"
-      ln -s "$icon" "$out/share/icons/hicolor/$(basename $icon .png)/apps/whalebird.png"
+    # Install icons
+    # Taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=whalebird#n41
+    for i in 16 32 128 256 512; do
+      install -Dm644 "resources/icons/icon.iconset/icon_$i"x"$i.png" \
+        "$out/share/icons/hicolor/$i"x"$i/apps/whalebird.png"
     done
+    install -Dm644 "resources/icons/icon.iconset/icon_32x32@2x.png" \
+      "$out/share/icons/hicolor/64x64/apps/whalebird.png"
 
-    makeWrapper ${electron}/bin/electron $out/bin/whalebird \
-      --add-flags $out/opt/Whalebird/resources/app.asar \
+    makeWrapper "${electron}/bin/electron" "$out/bin/whalebird" \
+      --add-flags "$out/opt/Whalebird/resources/app.asar" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
 
     runHook postInstall
   '';
 
   meta = with lib; {
-    description = "Electron based Mastodon, Pleroma and Misskey client for Windows, Mac and Linux";
+    description = "Single-column Fediverse client for desktop";
     homepage = "https://whalebird.social";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = with sourceTypes; [ fromSource ];
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ wolfangaukang colinsane weathercold ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index fccf83101ff0..ad3913aedb2b 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -28,12 +28,12 @@
         version = "2024-01-22";
       };
       ungoogled-patches = {
-        hash = "sha256-7c4VQLotLHmSFKfzzXrlwXKB3XPFpyRTnuATrS9RfEw=";
-        rev = "122.0.6261.111-1";
+        hash = "sha256-YIJysusNifUPN3Ii2tCUSvHEe63RWlTrTdOt5KBVyK4=";
+        rev = "122.0.6261.128-1";
       };
     };
-    hash = "sha256-43h11bx/k78W7fEPZz4LwxNVExwGSSt74mlbiUYf5ig=";
-    hash_deb_amd64 = "sha256-juwTFdJB1hgAA14aabNIrql5aaP1JWQy7nOsoTF2Vto=";
-    version = "122.0.6261.111";
+    hash = "sha256-BzLSwDQrmKavh4s2uOSfP935NnB5+Hw7oD7YDbSWp2g=";
+    hash_deb_amd64 = "sha256-SxdYfWhV3ZpiGWmagOM6JUfjAmU9pzFGDQDinXrweas=";
+    version = "122.0.6261.128";
   };
 }
diff --git a/pkgs/applications/networking/browsers/polypane/default.nix b/pkgs/applications/networking/browsers/polypane/default.nix
index aa4032a7d7d9..d0a1e359f956 100644
--- a/pkgs/applications/networking/browsers/polypane/default.nix
+++ b/pkgs/applications/networking/browsers/polypane/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "polypane";
-  version = "18.0.0";
+  version = "18.0.4";
 
   src = fetchurl {
     url = "https://github.com/firstversionist/${pname}/releases/download/v${version}/${pname}-${version}.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-d2A+edQJKyChNCA7QH+YjlcIlHYVghX3UP60ZZBtP1s=";
+    sha256 = "sha256-FqaXLoFgkKHzOvy7f9R36uIDnv2c6HrVF6T3VK5Aw3c=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/networking/cluster/glooctl/default.nix b/pkgs/applications/networking/cluster/glooctl/default.nix
index 594e52737cdc..97f03bddf7f1 100644
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.16.6";
+  version = "1.16.7";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-vn04bNkg0De46kLcyuaWt9watBXFIGI+4X8SBW3XNyg=";
+    hash = "sha256-046zHSvJY9kl/vY8TL62TUYkg+otvchq0DIyDsro/+U=";
   };
 
   vendorHash = "sha256-UyzqKpF2WBj25Bm4MtkF6yjl87A61vGsteBNCjJV178=";
diff --git a/pkgs/applications/networking/cluster/k3s/1_24/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_24/chart-versions.nix
deleted file mode 100644
index 8c40604d0f1c..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_24/chart-versions.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-    traefik-crd  = {
-        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-20.3.1+up20.3.0.tgz";
-        sha256 = "1775vjldvqvhzdbzanxhbaqbmkih09yb91im651q8bc7z5sb9ckn";
-    };
-    traefik = {
-        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-20.3.1+up20.3.0.tgz";
-        sha256 = "1rj0f0n0vgjcbzfwzhqmsd501i2f6vw145w9plbp8gwdyzmg2nc6";
-    };
-}
diff --git a/pkgs/applications/networking/cluster/k3s/1_24/default.nix b/pkgs/applications/networking/cluster/k3s/1_24/default.nix
deleted file mode 100644
index 25b615d6718f..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_24/default.nix
+++ /dev/null
@@ -1,332 +0,0 @@
-{ stdenv
-, lib
-, makeWrapper
-, socat
-, iptables
-, iproute2
-, ipset
-, bridge-utils
-, btrfs-progs
-, conntrack-tools
-, buildGoModule
-, runc
-, rsync
-, kmod
-, libseccomp
-, pkg-config
-, ethtool
-, util-linux
-, fetchFromGitHub
-, fetchurl
-, fetchzip
-, fetchgit
-, zstd
-, yq-go
-, sqlite
-, nixosTests
-, k3s
-, pkgsBuildBuild
-}:
-
-# k3s is a kinda weird derivation. One of the main points of k3s is the
-# simplicity of it being one binary that can perform several tasks.
-# However, when you have a good package manager (like nix), that doesn't
-# actually make much of a difference; you don't really care if it's one binary
-# or 10 since with a good package manager, installing and running it is
-# identical.
-# Since upstream k3s packages itself as one large binary with several
-# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
-# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
-# some exceptions.
-# K3s also carries patches to some packages (such as containerd and cni
-# plugins), so we intentionally use the k3s versions of those binaries for k3s,
-# even if the upstream version of those binaries exist in nixpkgs already. In
-# the end, that means we have a thick k3s binary that behaves like the upstream
-# one for the most part.
-# However, k3s also bundles several pieces of unpatched software, from the
-# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
-# Those pieces of software we entirely ignore upstream's handling of, and just
-# make sure they're in the path if desired.
-let
-  k3sVersion = "1.24.10+k3s1";     # k3s git tag
-  k3sCommit = "546a94e9ae1c3be6f9c0dcde32a6e6672b035bc8"; # k3s git commit at the above version
-  k3sRepoSha256 = "sha256-HfkGb3GtR2wQkVIze26aFh6A6W0fegr8ovpSel7oujQ=";
-  k3sVendorHash = "sha256-YAerisDr/knlKPaO2fVMZA4FUpwshFmkpi3mJAmLqKM=";
-
-  # Based on the traefik charts here: https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/download#L29-L32
-  # see also https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/manifests/traefik.yaml#L8-L16
-  # At the time of writing, there are two traefik charts, and that's it
-  charts = import ./chart-versions.nix;
-
-  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/version.sh#L56
-  k3sRootVersion = "0.12.1";
-  k3sRootSha256 = "sha256-xCXbarWztnvW2xn3cGa84hie3OevVZeGEDWh+Uf3RBw=";
-
-  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/version.sh#L49
-  k3sCNIVersion = "1.1.1-k3s1";
-  k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
-
-  # taken from go.mod, the 'github.com/containerd/containerd' line
-  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
-  # https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/go.mod#L10
-  containerdVersion = "1.5.16-k3s1";
-  containerdSha256 = "sha256-dxC44qE1A20Hd2j77Ir9Sla8xncttswWIuGGM/5FWi8=";
-
-  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
-  # https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/go.mod#L18
-  criCtlVersion = "1.24.0-k3s1";
-
-  baseMeta = k3s.meta;
-
-  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
-  versionldflags = [
-    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
-    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
-    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
-    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
-    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
-    "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
-    "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
-    "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
-    "-X k8s.io/component-base/version.gitTreeState=clean"
-    "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
-    "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
-    "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
-    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
-  ];
-
-  # bundled into the k3s binary
-  traefikChart = fetchurl charts.traefik;
-  traefik-crdChart = fetchurl charts.traefik-crd;
-
-  # so, k3s is a complicated thing to package
-  # This derivation attempts to avoid including any random binaries from the
-  # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
-  # we don't care about doing, we can add those as build or runtime
-  # dependencies using a real package manager).
-  # In addition to those binaries, it's also configuration though (right now
-  # mostly strongswan configuration), and k3s does use those files.
-  # As such, we download it in order to grab 'etc' and bundle it into the final
-  # k3s binary.
-  k3sRoot = fetchzip {
-    # Note: marked as apache 2.0 license
-    url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
-    sha256 = k3sRootSha256;
-    stripRoot = false;
-  };
-  k3sCNIPlugins = buildGoModule rec {
-    pname = "k3s-cni-plugins";
-    version = k3sCNIVersion;
-    vendorHash = null;
-
-    subPackages = [ "." ];
-
-    src = fetchFromGitHub {
-      owner = "rancher";
-      repo = "plugins";
-      rev = "v${version}";
-      sha256 = k3sCNISha256;
-    };
-
-    postInstall = ''
-      mv $out/bin/plugins $out/bin/cni
-    '';
-
-    meta = baseMeta // {
-      description = "CNI plugins, as patched by rancher for k3s";
-    };
-  };
-  # Grab this separately from a build because it's used by both stages of the
-  # k3s build.
-  k3sRepo = fetchgit {
-    url = "https://github.com/k3s-io/k3s";
-    rev = "v${k3sVersion}";
-    sha256 = k3sRepoSha256;
-  };
-  # Stage 1 of the k3s build:
-  # Let's talk about how k3s is structured.
-  # One of the ideas of k3s is that there's the single "k3s" binary which can
-  # do everything you need, from running a k3s server, to being a worker node,
-  # to running kubectl.
-  # The way that actually works is that k3s is a single go binary that contains
-  # a bunch of bindata that it unpacks at runtime into directories (either the
-  # user's home directory or /var/lib/rancher if run as root).
-  # This bindata includes both binaries and configuration.
-  # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
-  # First, we build all the binaries that get packed into the thick k3s binary
-  # (and output them from one derivation so they'll all be suitably patched up).
-  # Then, we bundle those binaries into our thick k3s binary and use that as
-  # the final single output.
-  # This approach was chosen because it ensures the bundled binaries all are
-  # correctly built to run with nix (we can lean on the existing buildGoModule
-  # stuff), and we can again lean on that tooling for the final k3s binary too.
-  # Other alternatives would be to manually run the
-  # strip/patchelf/remove-references step ourselves in the installPhase of the
-  # derivation when we've built all the binaries, but haven't bundled them in
-  # with generated bindata yet.
-
-  k3sServer = buildGoModule rec {
-    pname = "k3s-server";
-    version = k3sVersion;
-
-    src = k3sRepo;
-    vendorHash = k3sVendorHash;
-
-    nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ libseccomp sqlite.dev ];
-
-    subPackages = [ "cmd/server" ];
-    ldflags = versionldflags;
-
-    tags = [ "libsqlite3" "linux" ];
-
-    # create the multicall symlinks for k3s
-    postInstall = ''
-      mv $out/bin/server $out/bin/k3s
-      pushd $out
-      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/build#L123-L131
-      ln -s k3s ./bin/k3s-agent
-      ln -s k3s ./bin/k3s-server
-      ln -s k3s ./bin/k3s-etcd-snapshot
-      ln -s k3s ./bin/k3s-secrets-encrypt
-      ln -s k3s ./bin/k3s-certificate
-      ln -s k3s ./bin/k3s-completion
-      ln -s k3s ./bin/kubectl
-      ln -s k3s ./bin/crictl
-      ln -s k3s ./bin/ctr
-      popd
-    '';
-
-    meta = baseMeta // {
-      description = "The various binaries that get packaged into the final k3s binary";
-    };
-  };
-  k3sContainerd = buildGoModule {
-    pname = "k3s-containerd";
-    version = containerdVersion;
-    src = fetchFromGitHub {
-      owner = "k3s-io";
-      repo = "containerd";
-      rev = "v${containerdVersion}";
-      sha256 = containerdSha256;
-    };
-    vendorHash = null;
-    buildInputs = [ btrfs-progs ];
-    subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
-    ldflags = versionldflags;
-  };
-in
-buildGoModule rec {
-  pname = "k3s";
-  version = k3sVersion;
-
-  src = k3sRepo;
-  vendorHash = k3sVendorHash;
-
-  postPatch = ''
-    # Nix prefers dynamically linked binaries over static binary.
-
-    substituteInPlace scripts/package-cli \
-      --replace '"$LDFLAGS $STATIC" -o' \
-                '"$LDFLAGS" -o' \
-      --replace "STATIC=\"-extldflags \'-static\'\"" \
-                ""
-
-    # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
-
-    substituteInPlace scripts/package-cli \
-      --replace '"''${GO}" generate' \
-                'GOFLAGS="" \
-                 GOOS="${pkgsBuildBuild.go.GOOS}" \
-                 GOARCH="${pkgsBuildBuild.go.GOARCH}" \
-                 CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
-                 "''${GO}" generate'
-  '';
-
-  # Important utilities used by the kubelet, see
-  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
-  # Note the list in that issue is stale and some aren't relevant for k3s.
-  k3sRuntimeDeps = [
-    kmod
-    socat
-    iptables
-    iproute2
-    ipset
-    bridge-utils
-    ethtool
-    util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
-    conntrack-tools
-  ];
-
-  buildInputs = k3sRuntimeDeps;
-
-  nativeBuildInputs = [
-    makeWrapper
-    rsync
-    yq-go
-    zstd
-  ];
-
-  # embedded in the final k3s cli
-  propagatedBuildInputs = [
-    k3sCNIPlugins
-    k3sContainerd
-    k3sServer
-    runc
-  ];
-
-  # We override most of buildPhase due to peculiarities in k3s's build.
-  # Specifically, it has a 'go generate' which runs part of the package. See
-  # this comment:
-  # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
-  # So, why do we use buildGoModule at all? For the `vendorHash` / `go mod download` stuff primarily.
-  buildPhase = ''
-    patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
-
-    # copy needed 'go generate' inputs into place
-    mkdir -p ./bin/aux
-    rsync -a --no-perms ${k3sServer}/bin/ ./bin/
-    ln -vsf ${runc}/bin/runc ./bin/runc
-    ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
-    ln -vsf ${k3sContainerd}/bin/* ./bin/
-    rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
-    mkdir -p ./build/static/charts
-
-    cp ${traefikChart} ./build/static/charts
-    cp ${traefik-crdChart} ./build/static/charts
-
-    export ARCH=$GOARCH
-    export DRONE_TAG="v${k3sVersion}"
-    export DRONE_COMMIT="${k3sCommit}"
-    # use ./scripts/package-cli to run 'go generate' + 'go build'
-
-    ./scripts/package-cli
-    mkdir -p $out/bin
-  '';
-
-  # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
-  doCheck = false;
-
-  installPhase = ''
-    # wildcard to match the arm64 build too
-    install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
-    wrapProgram $out/bin/k3s \
-      --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
-      --prefix PATH : "$out/bin"
-    ln -s $out/bin/k3s $out/bin/kubectl
-    ln -s $out/bin/k3s $out/bin/crictl
-    ln -s $out/bin/k3s $out/bin/ctr
-  '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
-  '';
-
-  # Fix-Me: Needs to be adapted specifically for 1.24
-  # passthru.updateScript = ./update.sh;
-
-  passthru.tests = k3s.passthru.mkTests k3sVersion;
-
-  meta = baseMeta;
-}
diff --git a/pkgs/applications/networking/cluster/k3s/1_25/0001-script-download-strip-downloading-just-package-CRD.patch b/pkgs/applications/networking/cluster/k3s/1_25/0001-script-download-strip-downloading-just-package-CRD.patch
deleted file mode 100644
index 115fd6824772..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_25/0001-script-download-strip-downloading-just-package-CRD.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 6f53bd36a40da4c71486e3b79f6e32d53d6eea5d Mon Sep 17 00:00:00 2001
-From: Euan Kemp <euank@euank.com>
-Date: Thu, 3 Feb 2022 23:50:40 -0800
-Subject: [PATCH 2/2] scrips/download: strip downloading, just package CRD
-
-The CRD packaging is a complicated set of commands, so let's reuse it.
----
- scripts/download | 10 ++--------
- 1 file changed, 2 insertions(+), 8 deletions(-)
-
-diff --git a/scripts/download b/scripts/download
-index 5effc0562a..82361803ee 100755
---- a/scripts/download
-+++ b/scripts/download
-@@ -24,12 +24,6 @@ rm -rf ${CONTAINERD_DIR}
- mkdir -p ${CHARTS_DIR}
- mkdir -p ${DATA_DIR}
- 
--curl --compressed -sfL https://github.com/k3s-io/k3s-root/releases/download/${VERSION_ROOT}/k3s-root-${ARCH}.tar | tar xf - --exclude=bin/socat
--
--git clone --single-branch --branch=${VERSION_RUNC} --depth=1 https://github.com/opencontainers/runc ${RUNC_DIR}
--
--git clone --single-branch --branch=${VERSION_CONTAINERD} --depth=1 https://github.com/k3s-io/containerd ${CONTAINERD_DIR}
--
- setup_tmp() {
-     TMP_DIR=$(mktemp -d --tmpdir=${CHARTS_DIR})
-     cleanup() {
-@@ -44,8 +38,8 @@ setup_tmp() {
- 
- download_and_package_traefik () {
-   echo "Downloading Traefik Helm chart from ${TRAEFIK_URL}"
--  curl -sfL ${TRAEFIK_URL} -o ${TMP_DIR}/${TRAEFIK_FILE}
--  code=$?
-+  # nixpkgs: copy in our known traefik chart instead
-+  cp $TRAEFIK_CHART_FILE ${TMP_DIR}/${TRAEFIK_FILE}
- 
-   if [ $code -ne 0 ]; then
-     echo "Error: Failed to download Traefik Helm chart!"
--- 
-2.34.1
-
diff --git a/pkgs/applications/networking/cluster/k3s/1_25/default.nix b/pkgs/applications/networking/cluster/k3s/1_25/default.nix
deleted file mode 100644
index 7ea3ff7867e6..000000000000
--- a/pkgs/applications/networking/cluster/k3s/1_25/default.nix
+++ /dev/null
@@ -1,336 +0,0 @@
-{ stdenv
-, lib
-, makeWrapper
-, socat
-, iptables
-, iproute2
-, ipset
-, bridge-utils
-, btrfs-progs
-, conntrack-tools
-, buildGoModule
-, runc
-, rsync
-, kmod
-, libseccomp
-, pkg-config
-, ethtool
-, util-linux
-, fetchFromGitHub
-, fetchurl
-, fetchzip
-, fetchgit
-, zstd
-, yq-go
-, sqlite
-, nixosTests
-, pkgsBuildBuild
-, k3s
-}:
-
-# k3s is a kinda weird derivation. One of the main points of k3s is the
-# simplicity of it being one binary that can perform several tasks.
-# However, when you have a good package manager (like nix), that doesn't
-# actually make much of a difference; you don't really care if it's one binary
-# or 10 since with a good package manager, installing and running it is
-# identical.
-# Since upstream k3s packages itself as one large binary with several
-# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
-# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
-# some exceptions.
-# K3s also carries patches to some packages (such as containerd and cni
-# plugins), so we intentionally use the k3s versions of those binaries for k3s,
-# even if the upstream version of those binaries exist in nixpkgs already. In
-# the end, that means we have a thick k3s binary that behaves like the upstream
-# one for the most part.
-# However, k3s also bundles several pieces of unpatched software, from the
-# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
-# Those pieces of software we entirely ignore upstream's handling of, and just
-# make sure they're in the path if desired.
-let
-  k3sVersion = "1.25.3+k3s1";     # k3s git tag
-  k3sCommit = "f2585c1671b31b4b34bddbb3bf4e7d69662b0821"; # k3s git commit at the above version
-  k3sRepoSha256 = "0zwf3iwjcidx14zw36s1hr0q8wmmbfc0rfqwd7fmpjq597h8zkms";
-  k3sVendorHash = "sha256-U67tJRGqPFk5AfRe7I50zKGC9HJ2oh+iI/C7qF/76BQ=";
-
-  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
-  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
-  traefikChartVersion = "12.0.0";
-  traefikChartSha256 = "1sqmi71fi3ad5dh5fmsp9mv80x6pkgqwi4r9fr8l6i9sdnai6f1a";
-
-  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
-  k3sRootVersion = "0.11.0";
-  k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
-
-  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
-  k3sCNIVersion = "1.1.1-k3s1";
-  k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
-
-  # taken from go.mod, the 'github.com/containerd/containerd' line
-  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
-  containerdVersion = "1.5.13-k3s2";
-  containerdSha256 = "1pfr2ji4aij9js90gf4a3hqnhyw5hshcjdccm62l700j68gs5z97";
-
-  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
-  criCtlVersion = "1.25.0-k3s1";
-
-  baseMeta = k3s.meta;
-
-  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
-  versionldflags = [
-    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
-    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
-    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
-    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
-    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
-    "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
-    "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
-    "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
-    "-X k8s.io/component-base/version.gitTreeState=clean"
-    "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
-    "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
-    "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
-    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
-  ];
-
-  # bundled into the k3s binary
-  traefikChart = fetchurl {
-    url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
-    sha256 = traefikChartSha256;
-  };
-  # so, k3s is a complicated thing to package
-  # This derivation attempts to avoid including any random binaries from the
-  # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
-  # we don't care about doing, we can add those as build or runtime
-  # dependencies using a real package manager).
-  # In addition to those binaries, it's also configuration though (right now
-  # mostly strongswan configuration), and k3s does use those files.
-  # As such, we download it in order to grab 'etc' and bundle it into the final
-  # k3s binary.
-  k3sRoot = fetchzip {
-    # Note: marked as apache 2.0 license
-    url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
-    sha256 = k3sRootSha256;
-    stripRoot = false;
-  };
-  k3sCNIPlugins = buildGoModule rec {
-    pname = "k3s-cni-plugins";
-    version = k3sCNIVersion;
-    vendorHash = null;
-
-    subPackages = [ "." ];
-
-    src = fetchFromGitHub {
-      owner = "rancher";
-      repo = "plugins";
-      rev = "v${version}";
-      sha256 = k3sCNISha256;
-    };
-
-    postInstall = ''
-      mv $out/bin/plugins $out/bin/cni
-    '';
-
-    meta = baseMeta // {
-      description = "CNI plugins, as patched by rancher for k3s";
-    };
-  };
-  # Grab this separately from a build because it's used by both stages of the
-  # k3s build.
-  k3sRepo = fetchgit {
-    url = "https://github.com/k3s-io/k3s";
-    rev = "v${k3sVersion}";
-    sha256 = k3sRepoSha256;
-  };
-  # Stage 1 of the k3s build:
-  # Let's talk about how k3s is structured.
-  # One of the ideas of k3s is that there's the single "k3s" binary which can
-  # do everything you need, from running a k3s server, to being a worker node,
-  # to running kubectl.
-  # The way that actually works is that k3s is a single go binary that contains
-  # a bunch of bindata that it unpacks at runtime into directories (either the
-  # user's home directory or /var/lib/rancher if run as root).
-  # This bindata includes both binaries and configuration.
-  # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
-  # First, we build all the binaries that get packed into the thick k3s binary
-  # (and output them from one derivation so they'll all be suitably patched up).
-  # Then, we bundle those binaries into our thick k3s binary and use that as
-  # the final single output.
-  # This approach was chosen because it ensures the bundled binaries all are
-  # correctly built to run with nix (we can lean on the existing buildGoModule
-  # stuff), and we can again lean on that tooling for the final k3s binary too.
-  # Other alternatives would be to manually run the
-  # strip/patchelf/remove-references step ourselves in the installPhase of the
-  # derivation when we've built all the binaries, but haven't bundled them in
-  # with generated bindata yet.
-
-  k3sServer = buildGoModule rec {
-    pname = "k3s-server";
-    version = k3sVersion;
-
-    src = k3sRepo;
-    vendorHash = k3sVendorHash;
-
-    nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ libseccomp sqlite.dev ];
-
-    subPackages = [ "cmd/server" ];
-    ldflags = versionldflags;
-
-    tags = [ "libsqlite3" "linux" ];
-
-    # create the multicall symlinks for k3s
-    postInstall = ''
-      mv $out/bin/server $out/bin/k3s
-      pushd $out
-      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
-      ln -s k3s ./bin/k3s-agent
-      ln -s k3s ./bin/k3s-server
-      ln -s k3s ./bin/k3s-etcd-snapshot
-      ln -s k3s ./bin/k3s-secrets-encrypt
-      ln -s k3s ./bin/k3s-certificate
-      ln -s k3s ./bin/kubectl
-      ln -s k3s ./bin/crictl
-      ln -s k3s ./bin/ctr
-      popd
-    '';
-
-    meta = baseMeta // {
-      description = "The various binaries that get packaged into the final k3s binary";
-    };
-  };
-  k3sContainerd = buildGoModule {
-    pname = "k3s-containerd";
-    version = containerdVersion;
-    src = fetchFromGitHub {
-      owner = "k3s-io";
-      repo = "containerd";
-      rev = "v${containerdVersion}";
-      sha256 = containerdSha256;
-    };
-    vendorHash = null;
-    buildInputs = [ btrfs-progs ];
-    subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
-    ldflags = versionldflags;
-  };
-in
-buildGoModule rec {
-  pname = "k3s";
-  version = k3sVersion;
-
-  src = k3sRepo;
-  vendorHash = k3sVendorHash;
-
-  patches = [
-    ./0001-script-download-strip-downloading-just-package-CRD.patch
-  ];
-
-  postPatch = ''
-    # Nix prefers dynamically linked binaries over static binary.
-
-    substituteInPlace scripts/package-cli \
-      --replace '"$LDFLAGS $STATIC" -o' \
-                '"$LDFLAGS" -o' \
-      --replace "STATIC=\"-extldflags \'-static\'\"" \
-                ""
-
-    # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
-
-    substituteInPlace scripts/package-cli \
-      --replace '"''${GO}" generate' \
-                'GOFLAGS="" \
-                 GOOS="${pkgsBuildBuild.go.GOOS}" \
-                 GOARCH="${pkgsBuildBuild.go.GOARCH}" \
-                 CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
-                 "''${GO}" generate'
-  '';
-
-  # Important utilities used by the kubelet, see
-  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
-  # Note the list in that issue is stale and some aren't relevant for k3s.
-  k3sRuntimeDeps = [
-    kmod
-    socat
-    iptables
-    iproute2
-    ipset
-    bridge-utils
-    ethtool
-    util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
-    conntrack-tools
-  ];
-
-  buildInputs = k3sRuntimeDeps;
-
-  nativeBuildInputs = [
-    makeWrapper
-    rsync
-    yq-go
-    zstd
-  ];
-
-  # embedded in the final k3s cli
-  propagatedBuildInputs = [
-    k3sCNIPlugins
-    k3sContainerd
-    k3sServer
-    runc
-  ];
-
-  # We override most of buildPhase due to peculiarities in k3s's build.
-  # Specifically, it has a 'go generate' which runs part of the package. See
-  # this comment:
-  # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
-  # So, why do we use buildGoModule at all? For the `vendorHash` / `go mod download` stuff primarily.
-  buildPhase = ''
-    patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
-
-    # copy needed 'go generate' inputs into place
-    mkdir -p ./bin/aux
-    rsync -a --no-perms ${k3sServer}/bin/ ./bin/
-    ln -vsf ${runc}/bin/runc ./bin/runc
-    ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
-    ln -vsf ${k3sContainerd}/bin/* ./bin/
-    rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
-    mkdir -p ./build/static/charts
-    # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
-    export TRAEFIK_CHART_FILE=${traefikChart}
-    # place the traefik chart using their code since it's complicated
-    # We trim the actual download, see patches
-    ./scripts/download
-
-    export ARCH=$GOARCH
-    export DRONE_TAG="v${k3sVersion}"
-    export DRONE_COMMIT="${k3sCommit}"
-    # use ./scripts/package-cli to run 'go generate' + 'go build'
-
-    ./scripts/package-cli
-    mkdir -p $out/bin
-  '';
-
-  # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
-  doCheck = false;
-
-  installPhase = ''
-    # wildcard to match the arm64 build too
-    install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
-    wrapProgram $out/bin/k3s \
-      --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
-      --prefix PATH : "$out/bin"
-    ln -s $out/bin/k3s $out/bin/kubectl
-    ln -s $out/bin/k3s $out/bin/crictl
-    ln -s $out/bin/k3s $out/bin/ctr
-  '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
-  '';
-
-  # Fix-Me: Needs to be adapted specifically for 1.25
-  # passthru.updateScript = ./update.sh;
-
-  passthru.tests = k3s.passthru.mkTests k3sVersion;
-
-  meta = baseMeta;
-}
diff --git a/pkgs/applications/networking/cluster/k8sgpt/default.nix b/pkgs/applications/networking/cluster/k8sgpt/default.nix
index a24b521e242c..909e7fb621e5 100644
--- a/pkgs/applications/networking/cluster/k8sgpt/default.nix
+++ b/pkgs/applications/networking/cluster/k8sgpt/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "k8sgpt";
-  version = "0.3.27";
+  version = "0.3.28";
 
   src = fetchFromGitHub {
     owner = "k8sgpt-ai";
     repo = "k8sgpt";
     rev = "v${version}";
-    hash = "sha256-HWcEcufn0NM+7AF4/M29bsUoQYlVA1nbrkCKt9F1g6k=";
+    hash = "sha256-VDVCkGTLoAZZyTX+zn43KisnUV9XQ9xo9ZIQf3AwDcY=";
   };
 
-  vendorHash = "sha256-b8Y95BDOR5HI6QMU4XLn5FmSHFD9fntc80r84KgmkuY=";
+  vendorHash = "sha256-NOXySV9sQl4Q1eDbcGMk0msMSosjyxYyJfhu7hd/4gw=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/applications/networking/remote/xrdp/default.nix b/pkgs/applications/networking/remote/xrdp/default.nix
index 10ad5f8d93fb..3d6d1de3d964 100644
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  version = "0.9.25";
+  version = "0.9.25.1";
   patchedXrdpSrc = applyPatches {
     patches = [ ./dynamic_config.patch ];
     name = "xrdp-patched-${version}";
@@ -31,7 +31,7 @@ let
       repo = "xrdp";
       rev = "v${version}";
       fetchSubmodules = true;
-      hash = "sha256-XVaNN+sBEACh/yGnCLn9GHszoofWbcyA+Mr6KZMVFB0=";
+      hash = "sha256-oAs0oWkCyj3ObdJuHLfT25ZzkTrxNAXDiFU64OOP4Ow=";
     };
   };
 
diff --git a/pkgs/applications/office/timeular/default.nix b/pkgs/applications/office/timeular/default.nix
index 8ea89c5b058b..ef6c931bcc6a 100644
--- a/pkgs/applications/office/timeular/default.nix
+++ b/pkgs/applications/office/timeular/default.nix
@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "6.7.3";
+  version = "6.7.5";
   pname = "timeular";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/timeular-desktop-packages/linux/production/Timeular-${version}.AppImage";
-    hash = "sha256-VnjCTf2x3GzmKW9EfNWGsN/aK7DKjTo8DZOF2qqGJ0Q=";
+    hash = "sha256-b/I34f8fGgPr4+fZJ+2cb+Xi/AvotxNHYg7IaLTByPk=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/science/electronics/systemc/default.nix b/pkgs/applications/science/electronics/systemc/default.nix
index dc6186841f47..4e14d08e63bf 100644
--- a/pkgs/applications/science/electronics/systemc/default.nix
+++ b/pkgs/applications/science/electronics/systemc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "systemc";
@@ -11,16 +11,21 @@ stdenv.mkDerivation rec {
     sha256 = "0sj8wlkp68cjhmkd9c9lvm3lk3sckczpz7w9vby64inc1f9fnf0b";
   };
 
-  enableParallelBuilding = true;
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ cmake ];
 
-  configureFlags = [ "--with-unix-layout" ];
+  cmakeFlags = [
+    # Undefined reference to the sc_core::sc_api_version_2_3_4_XXX
+    # https://github.com/accellera-official/systemc/issues/21
+    "-DCMAKE_CXX_STANDARD=17"
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   meta = with lib; {
     description = "The language for System-level design, modeling and verification";
     homepage    = "https://systemc.org/";
     license     = licenses.asl20;
-    platforms   = platforms.linux;
+    platforms   = platforms.unix;
     maintainers = with maintainers; [ victormignot amiloradovsky ];
   };
 }
diff --git a/pkgs/applications/science/electronics/verilator/default.nix b/pkgs/applications/science/electronics/verilator/default.nix
index 062ba93ca420..92f8fa52b91f 100644
--- a/pkgs/applications/science/electronics/verilator/default.nix
+++ b/pkgs/applications/science/electronics/verilator/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, perl, flex, bison, python3, autoconf,
+{ lib, stdenv, fetchFromGitHub, fetchpatch, perl, flex, bison, python3, autoconf,
   which, cmake, ccache, help2man, makeWrapper, glibcLocales,
   systemc, git, numactl }:
 
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-Ya3lqK8BfvMVLZUrD2Et6OmptteWXp5VmZb2x2G/V/E=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Fix try-lock spuriously fail in V3ThreadPool destructor
+      # https://github.com/verilator/verilator/pull/4938
+      url = "https://github.com/verilator/verilator/commit/4b9cce4369c78423779238e585ed693c456d464e.patch";
+      hash = "sha256-sGrk/pxqZqUcmJdzQoPlzXMmYqHCOmd9Y2n6ieVNg1U=";
+    })
+  ];
+
   enableParallelBuilding = true;
   buildInputs = [ perl python3 systemc ];  # ccache
   nativeBuildInputs = [ makeWrapper flex bison autoconf help2man git ];
@@ -37,6 +46,11 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  env = {
+    SYSTEMC_INCLUDE = "${lib.getDev systemc}/include";
+    SYSTEMC_LIBDIR = "${lib.getLib systemc}/lib";
+  };
+
   meta = with lib; {
     description = "Fast and robust (System)Verilog simulator/compiler and linter";
     homepage    = "https://www.veripool.org/verilator";
diff --git a/pkgs/applications/version-management/got/default.nix b/pkgs/applications/version-management/got/default.nix
index 377e3a27e51f..2448e4ccffea 100644
--- a/pkgs/applications/version-management/got/default.nix
+++ b/pkgs/applications/version-management/got/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "got";
-  version = "0.96";
+  version = "0.97";
 
   src = fetchurl {
     url = "https://gameoftrees.org/releases/portable/got-portable-${finalAttrs.version}.tar.gz";
-    hash = "sha256-/R7r6IJtgkuNQwoLxys/1HcXW+l3PVkjnPXphFpAFTs=";
+    hash = "sha256-4HpIlKRYUDoymCBH8GS8DDXaY0nYiVvotpBkwglOO3I=";
   };
 
   nativeBuildInputs = [ pkg-config bison ]
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     # The configure script assumes dependencies on Darwin are installed via
     # Homebrew or MacPorts and hardcodes assumptions about the paths of
     # dependencies which fails the nixpkgs configurePhase.
-    substituteInPlace configure --replace 'xdarwin' 'xhomebrew'
+    substituteInPlace configure --replace-fail 'xdarwin' 'xhomebrew'
   '';
 
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
@@ -49,11 +49,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   installCheckPhase = ''
     runHook preInstallCheck
-    test "$($out/bin/got --version)" = "${finalAttrs.pname} ${finalAttrs.version}"
+    test "$($out/bin/got --version)" = "got ${finalAttrs.version}"
     runHook postInstallCheck
   '';
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://gameoftrees.org/releases/CHANGES";
     description = "A version control system which prioritizes ease of use and simplicity over flexibility";
     longDescription = ''
       Game of Trees (Got) is a version control system which prioritizes
@@ -65,9 +66,9 @@ stdenv.mkDerivation (finalAttrs: {
       on the same repository.
     '';
     homepage = "https://gameoftrees.org";
-    changelog = "https://gameoftrees.org/releases/CHANGES";
-    license = licenses.isc;
-    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ abbe afh ];
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ abbe afh ];
+    mainProgram = "got";
+    platforms = with lib.platforms; darwin ++ linux;
   };
 })
diff --git a/pkgs/applications/version-management/josh/default.nix b/pkgs/applications/version-management/josh/default.nix
index 5acd1a634344..b127966176cd 100644
--- a/pkgs/applications/version-management/josh/default.nix
+++ b/pkgs/applications/version-management/josh/default.nix
@@ -11,36 +11,24 @@
 , darwin
 }:
 
+let
+  # josh-ui requires javascript dependencies, haven't tried to figure it out yet
+  cargoFlags = [ "--workspace" "--exclude" "josh-ui" ];
+in
+
 rustPlatform.buildRustPackage rec {
   pname = "josh";
-  version = "23.02.14";
+  version = "23.12.04";
   JOSH_VERSION = "r${version}";
 
   src = fetchFromGitHub {
     owner = "esrlabs";
     repo = "josh";
     rev = JOSH_VERSION;
-    sha256 = "1sqa8xi5d55zshky7gicac02f67vp944hclkdsmwy0bczk9hgssr";
+    sha256 = "10fspcafqnv6if5c1h8z9pf9140jvvlrch88w62wsg4w2vhaii0v";
   };
 
-  patches = [
-    # Unreleased patch allowing compilation from the GitHub tarball download
-    (fetchpatch {
-      name = "josh-version-without-git.patch";
-      url = "https://github.com/josh-project/josh/commit/13e7565ab029206598881391db4ddc6dface692b.patch";
-      sha256 = "1l5syqj51sn7kcqvffwl6ggn5sq8wfkpviga860agghnw5dpf7ns";
-    })
-
-    # Merged upstream, fixes builds with newer rustc
-    (fetchpatch {
-      name = "josh-fix-builds-with-rust-173.patch";
-      url = "https://github.com/josh-project/josh/commit/7b8259b81a9acabb528ddebc4ab30fc712f756fb.patch";
-      sha256 = "sha256-YfrVlH6Ox05ZbmB/15HVaFlOyRTOFbYflq0edi6/X9k=";
-      includes = [ "josh-proxy/src/bin/josh-proxy.rs" ];
-    })
-  ];
-
-  cargoSha256 = "0f6cvz2s8qs53b2g6xja38m24hafqla61s4r5za0a1dyndgms7sl";
+  cargoSha256 = "1j0vl3h6f65ldg80bgryh1mz423lcrcdkn8rmajya1850pfxk3w3";
 
   nativeBuildInputs = [
     pkg-config
@@ -54,11 +42,8 @@ rustPlatform.buildRustPackage rec {
     darwin.Security
   ];
 
-  cargoBuildFlags = [
-    "-p" "josh"
-    "-p" "josh-proxy"
-    # TODO: josh-ui
-  ];
+  cargoBuildFlags = cargoFlags;
+  cargoTestFlags = cargoFlags;
 
   postInstall = ''
     wrapProgram "$out/bin/josh-proxy" --prefix PATH : "${git}/bin"
diff --git a/pkgs/applications/video/obs-studio/default.nix b/pkgs/applications/video/obs-studio/default.nix
index 29bb90a9dd8d..fee1addf0e6d 100644
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@@ -53,6 +53,7 @@
 , libdatachannel
 , libvpl
 , qrcodegencpp
+, nix-update-script
 }:
 
 let
@@ -61,13 +62,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-studio";
-  version = "30.0.2";
+  version = "30.1.0";
 
   src = fetchFromGitHub {
     owner = "obsproject";
     repo = finalAttrs.pname;
     rev = finalAttrs.version;
-    sha256 = "sha256-8pX1kqibrtDIaE1+/Pey1A5bu6MwFTXLrBOah4rsF+4=";
+    sha256 = "sha256-9rf3UGazEL5Obd6tqDwM5LOC6D1X6HNzs5sn5z1tOCA=";
     fetchSubmodules = true;
   };
 
@@ -76,25 +77,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./Enable-file-access-and-universal-access-for-file-URL.patch
     ./fix-nix-plugin-path.patch
 
-    # Backport ffmpeg 6.1 / GCC 13 build fixes
-    # FIXME: remove in next release
-    (fetchpatch {
-      url = "https://github.com/obsproject/obs-studio/commit/cd784644f5e82b9988043f229c19603289c6d32c.patch";
-      hash = "sha256-S4JE5kgr4x3uMHY2GRh0GBJpb7o/wYZb/v0CDITFNnQ=";
-    })
-    (fetchpatch {
-      url = "https://github.com/obsproject/obs-studio/commit/758b47d4ed9a25b8d64ad481d8d039990b9e57c9.patch";
-      hash = "sha256-jYpjwhx6e+dhN3kzbd6FcdjQ+WhIX0/BOu9PSkt+2yI=";
-    })
-    (fetchpatch {
-      url = "https://github.com/obsproject/obs-studio/commit/4b5be75c7e4b8cee908ed4a02fe0078285b4e8c9.patch";
-      hash = "sha256-tuOevhyxchwG42ilrplbiWoiDAKaY4HgzShlvp4VSQI=";
-    })
-    (fetchpatch {
-      url = "https://github.com/obsproject/obs-studio/commit/6e080a68067b27fe5463f0f4eee7df690451f3d7.patch";
-      hash = "sha256-nbn/q3uszoHaDvaW8Et1MS1sgQzMsJRmjGSMHzUxV70=";
-    })
-
     # Fix libobs.pc for plugins on non-x86 systems
     (fetchpatch {
       name = "fix-arm64-cmake.patch";
@@ -175,6 +157,10 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "ENABLE_PIPEWIRE" pipewireSupport)
   ];
 
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=sign-compare" # https://github.com/obsproject/obs-studio/issues/10200
+  ];
+
   dontWrapGApps = true;
   preFixup = let
     wrapperLibraries = [
@@ -202,6 +188,8 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${libcef}/lib/* $out/lib/obs-plugins/
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Free and open source software for video recording and live streaming";
     longDescription = ''
diff --git a/pkgs/applications/virtualization/imgcrypt/default.nix b/pkgs/applications/virtualization/imgcrypt/default.nix
index 25adabdba0a6..bb703e3a0ac6 100644
--- a/pkgs/applications/virtualization/imgcrypt/default.nix
+++ b/pkgs/applications/virtualization/imgcrypt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "imgcrypt";
-  version = "1.1.9";
+  version = "1.1.10";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-EStyi6RDK1G6kuaDGumZaHB4OrSrhhx/F5GsLe0amyA=";
+    hash = "sha256-81jfoWHYYenGQFcQI9kk8uPnv6FcyOtcJjpo1ykdtOI=";
   };
 
   vendorHash = null;
diff --git a/pkgs/build-support/lib/cmake.nix b/pkgs/build-support/lib/cmake.nix
new file mode 100644
index 000000000000..eff7bbca61a2
--- /dev/null
+++ b/pkgs/build-support/lib/cmake.nix
@@ -0,0 +1,30 @@
+{ stdenv, lib }:
+
+let
+  inherit (lib) findFirst isString optional optionals;
+
+  makeCMakeFlags = { cmakeFlags ? [], ... }:
+    cmakeFlags
+    ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) ([
+      "-DCMAKE_SYSTEM_NAME=${findFirst isString "Generic" (optional (!stdenv.hostPlatform.isRedox) stdenv.hostPlatform.uname.system)}"
+    ] ++ optionals (stdenv.hostPlatform.uname.processor != null) [
+      "-DCMAKE_SYSTEM_PROCESSOR=${stdenv.hostPlatform.uname.processor}"
+    ] ++ optionals (stdenv.hostPlatform.uname.release != null) [
+      "-DCMAKE_SYSTEM_VERSION=${stdenv.hostPlatform.uname.release}"
+    ] ++ optionals (stdenv.hostPlatform.isDarwin) [
+      "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
+    ] ++ optionals (stdenv.buildPlatform.uname.system != null) [
+      "-DCMAKE_HOST_SYSTEM_NAME=${stdenv.buildPlatform.uname.system}"
+    ] ++ optionals (stdenv.buildPlatform.uname.processor != null) [
+      "-DCMAKE_HOST_SYSTEM_PROCESSOR=${stdenv.buildPlatform.uname.processor}"
+    ] ++ optionals (stdenv.buildPlatform.uname.release != null) [
+      "-DCMAKE_HOST_SYSTEM_VERSION=${stdenv.buildPlatform.uname.release}"
+    ] ++ optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+      "-DCMAKE_CROSSCOMPILING_EMULATOR=env"
+    ] ++ optionals stdenv.hostPlatform.isStatic [
+      "-DCMAKE_LINK_SEARCH_START_STATIC=ON"
+    ]);
+in
+{
+  inherit makeCMakeFlags;
+}
diff --git a/pkgs/build-support/lib/meson.nix b/pkgs/build-support/lib/meson.nix
new file mode 100644
index 000000000000..395b573f8587
--- /dev/null
+++ b/pkgs/build-support/lib/meson.nix
@@ -0,0 +1,35 @@
+{ stdenv, lib }:
+
+let
+  inherit (lib) boolToString optionals;
+
+  # See https://mesonbuild.com/Reference-tables.html#cpu-families
+  cpuFamily = platform: with platform;
+    /**/ if isAarch32 then "arm"
+    else if isx86_32  then "x86"
+    else platform.uname.processor;
+
+  makeMesonFlags = { mesonFlags ? [], ... }:
+    let
+      crossFile = builtins.toFile "cross-file.conf" ''
+        [properties]
+        bindgen_clang_arguments = ['-target', '${stdenv.targetPlatform.config}']
+        needs_exe_wrapper = ${boolToString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform)}
+
+        [host_machine]
+        system = '${stdenv.targetPlatform.parsed.kernel.name}'
+        cpu_family = '${cpuFamily stdenv.targetPlatform}'
+        cpu = '${stdenv.targetPlatform.parsed.cpu.name}'
+        endian = ${if stdenv.targetPlatform.isLittleEndian then "'little'" else "'big'"}
+
+        [binaries]
+        llvm-config = 'llvm-config-native'
+        rust = ['rustc', '--target', '${stdenv.targetPlatform.rust.rustcTargetSpec}']
+      '';
+      crossFlags = optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--cross-file=${crossFile}" ];
+    in crossFlags ++ mesonFlags;
+
+in
+{
+  inherit makeMesonFlags;
+}
diff --git a/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh b/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
index 56e3a883b99a..750ed421789f 100644
--- a/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
@@ -12,7 +12,7 @@ npmInstallHook() {
         local dest="$packageOut/$(dirname "$file")"
         mkdir -p "$dest"
         cp "${npmWorkspace-.}/$file" "$dest"
-    done < <(@jq@ --raw-output '.[0].files | map(.path) | join("\n")' <<< "$(npm_config_cache="$HOME/.npm" npm pack --json --dry-run --loglevel=warn --no-foreground-scripts ${npmWorkspace+--workspace=$npmWorkspace} $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")
+    done < <(@jq@ --raw-output '.[0].files | map(.path | select(. | startswith("node_modules/") | not)) | join("\n")' <<< "$(npm_config_cache="$HOME/.npm" npm pack --json --dry-run --loglevel=warn --no-foreground-scripts ${npmWorkspace+--workspace=$npmWorkspace} $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")
 
     # Based on code from Python's buildPythonPackage wrap.sh script, for
     # supporting both the case when makeWrapperArgs is an array and a
diff --git a/pkgs/build-support/snap/default.nix b/pkgs/build-support/snap/default.nix
deleted file mode 100644
index ba5271868911..000000000000
--- a/pkgs/build-support/snap/default.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-{ callPackage, hello }:
-{
-  makeSnap = callPackage ./make-snap.nix { };
-}
diff --git a/pkgs/build-support/snap/make-snap.nix b/pkgs/build-support/snap/make-snap.nix
deleted file mode 100644
index cef7500bcbaf..000000000000
--- a/pkgs/build-support/snap/make-snap.nix
+++ /dev/null
@@ -1,84 +0,0 @@
-{
-  runCommand, squashfsTools, closureInfo, lib, jq, writeText
-}:
-
-{
-  # The meta parameter is the contents of the `snap.yaml`, NOT the
-  # `snapcraft.yaml`.
-  #
-  # - `snap.yaml` is what is inside of the final Snap,
-  # - `snapcraft.yaml` is used by `snapcraft` to build snaps
-  #
-  # Since we skip the `snapcraft` tool, we skip the `snapcraft.yaml`
-  # file. For more information:
-  #
-  #   https://docs.snapcraft.io/snap-format
-  #
-  # Note: unsquashfs'ing an existing snap from the store can be helpful
-  # for determining what you you're missing.
-  #
-  meta
-}: let
-    snap_yaml = let
-      # Validate the snap's meta contains a name.
-      # Also: automatically set the `base` parameter and the layout for
-      # the `/nix` bind.
-      validate = { name, ... } @ args:
-        args // {
-          # Combine the provided arguments with the required options.
-
-          # base: built from https://github.com/NixOS/snapd-nix-base
-          # and published as The NixOS Foundation on the Snapcraft store.
-          base = "nix-base";
-          layout = (args.layout or {}) // {
-            # Bind mount the Snap's root nix directory to `/nix` in the
-            # execution environment's filesystem namespace.
-            "/nix".bind = "$SNAP/nix";
-          };
-        };
-    in writeText "snap.yaml"
-      (builtins.toJSON (validate meta));
-
-  # These are specifically required by snapd, so don't change them
-  # unless you've verified snapcraft / snapd can handle them. Best bet
-  # is to just mirror this list against how snapcraft creates images.
-  # from: https://github.com/snapcore/snapcraft/blob/b88e378148134383ffecf3658e3a940b67c9bcc9/snapcraft/internal/lifecycle/_packer.py#L96-L98
-  mksquashfs_args = [
-    "-noappend" "-comp" "xz" "-no-xattrs" "-no-fragments"
-
-    # Note: We want -all-root every time, since all the files are
-    # owned by root anyway. This is true for Nix, but not true for
-    # other builds.
-    # from: https://github.com/snapcore/snapcraft/blob/b88e378148134383ffecf3658e3a940b67c9bcc9/snapcraft/internal/lifecycle/_packer.py#L100
-    "-all-root"
-  ];
-
-in runCommand "squashfs.img" {
-  nativeBuildInputs = [ squashfsTools jq ];
-
-  closureInfo = closureInfo {
-    rootPaths = [ snap_yaml ];
-  };
-} ''
-  root=$PWD/root
-  mkdir $root
-
-  (
-    # Put the snap.yaml in to `/meta/snap.yaml`, setting the version
-    # to the hash part of the store path
-    mkdir $root/meta
-    version=$(echo $out | cut -d/ -f4 | cut -d- -f1)
-    cat ${snap_yaml} | jq  ". + { version: \"$version\" }" \
-      > $root/meta/snap.yaml
-  )
-
-  (
-    # Copy the store closure in to the root
-    mkdir -p $root/nix/store
-    cat $closureInfo/store-paths | xargs -I{} cp -r {} $root/nix/store/
-  )
-
-  # Generate the squashfs image.
-  mksquashfs $root $out \
-    ${lib.concatStringsSep " " mksquashfs_args}
-''
diff --git a/pkgs/by-name/ad/ad-miner/package.nix b/pkgs/by-name/ad/ad-miner/package.nix
index 79c01a99ed95..43170f87474e 100644
--- a/pkgs/by-name/ad/ad-miner/package.nix
+++ b/pkgs/by-name/ad/ad-miner/package.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ad-miner";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mazars-Tech";
     repo = "AD_Miner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eAcnGS0HLrTqc/WVKNNwYA89GK233QZj4Gfggt4S8R8=";
+    hash = "sha256-o1RXuyX2dV0fQwXEeTgmeMYKXiKAqrl+fV8zi1J16Ic=";
   };
 
   # All requirements are pinned
diff --git a/pkgs/by-name/ar/arxiv-latex-cleaner/package.nix b/pkgs/by-name/ar/arxiv-latex-cleaner/package.nix
index bb0b1c6c4034..7a5499110a05 100644
--- a/pkgs/by-name/ar/arxiv-latex-cleaner/package.nix
+++ b/pkgs/by-name/ar/arxiv-latex-cleaner/package.nix
@@ -5,13 +5,13 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "arxiv-latex-cleaner";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchFromGitHub {
     owner = "google-research";
     repo = "arxiv-latex-cleaner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Dr0GyivoPjQwVYzvN1JIWhuLz60TQtz4MBB8n1hm6Lo=";
+    hash = "sha256-Yxp8XtlISVZfEjCEJ/EXsIGMCHDPOwPcjkJxECeXvYk=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/de/dep-scan/package.nix b/pkgs/by-name/de/dep-scan/package.nix
index c68c7cf78dc4..67f88409d99e 100644
--- a/pkgs/by-name/de/dep-scan/package.nix
+++ b/pkgs/by-name/de/dep-scan/package.nix
@@ -5,21 +5,19 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dep-scan";
-  version = "5.2.11";
+  version = "5.2.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "owasp-dep-scan";
     repo = "dep-scan";
     rev = "refs/tags/v${version}";
-    hash = "sha256-BEvuCdQcr35jWe9r9KR4Uov1zNVxfPSnENNPgy4N+nc=";
+    hash = "sha256-UoppQAokiWBcgTcSmwfoqrDKt/QHYd2NBR3CpNOqI4k=";
   };
 
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace " --cov-append --cov-report term --cov depscan" ""
-    substituteInPlace pyproject.toml \
-      --replace "oras==0.1.26" "oras~=0.1.26"
   '';
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/dm/dmarc-report-converter/package.nix b/pkgs/by-name/dm/dmarc-report-converter/package.nix
index 993c70c2c2ed..5fff732e84fc 100644
--- a/pkgs/by-name/dm/dmarc-report-converter/package.nix
+++ b/pkgs/by-name/dm/dmarc-report-converter/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "dmarc-report-converter";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "tierpod";
     repo = "dmarc-report-converter";
     rev = "v${version}";
-    hash = "sha256-doipM3SZmU/QUglN0UA2IpRgrhdMnuCmMPRs0OWRxPE=";
+    hash = "sha256-cP96tiBpMFNEHuIF0sovi+Q4yW8wMUqr138RyMOFoho=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index e87ebdc04d6f..6de468ab47b5 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -120,7 +120,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "1.9.14";
+  version = "1.9.15";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -131,7 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     rev = finalAttrs.version;
-    hash = "sha256-pG4pRksHw8p8rz99UnLURP+ROE+P+ySt4IlfmyRc1CQ=";
+    hash = "sha256-w0egw5FKNAOnIYjp2RUx74taivnClQmRfhaFHdKOGZc=";
   };
 
   patches = [
diff --git a/pkgs/by-name/g3/g3kb-switch/package.nix b/pkgs/by-name/g3/g3kb-switch/package.nix
new file mode 100644
index 000000000000..625cd6ef9a3d
--- /dev/null
+++ b/pkgs/by-name/g3/g3kb-switch/package.nix
@@ -0,0 +1,33 @@
+{ lib
+, stdenv
+, cmake
+, pkg-config
+, glib
+, fetchFromGitHub
+}:
+stdenv.mkDerivation rec {
+  pname = "g3kb-switch";
+  version = "1.4";
+  src = fetchFromGitHub {
+    owner = "lyokha";
+    repo = "g3kb-switch";
+    rev = version;
+    sha256 = "sha256-mcZduHcteZ+nS0YEZG5DfmpA8xrnLhwxumq6hLuLPIs=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+  buildInputs = [
+    glib
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/lyokha/g3kb-switch";
+    description = "CLI keyboard layout switcher for GNOME Shell";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ Freed-Wu ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/by-name/gi/git-instafix/package.nix b/pkgs/by-name/gi/git-instafix/package.nix
new file mode 100644
index 000000000000..9085d381ff2d
--- /dev/null
+++ b/pkgs/by-name/gi/git-instafix/package.nix
@@ -0,0 +1,42 @@
+{ git
+, lib
+, libgit2
+, makeWrapper
+, rustPlatform
+, stdenv
+, fetchFromGitHub
+}:
+let
+  inherit
+    (lib)
+    licenses
+    maintainers
+    ;
+
+  version = "0.2.1";
+in
+rustPlatform.buildRustPackage {
+  pname = "git-instafix";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "quodlibetor";
+    repo = "git-instafix";
+    rev = "v${version}";
+    hash = "sha256-rWHiaZji3GECsiMqvEGC/tF+K29ZLlY6+TCNxtixHQo=";
+  };
+
+  cargoHash = "sha256-t5vlr3YxjRPqMHwPqVjWul4RdSg0hiTWUQxcJmGKiTQ=";
+
+  buildInputs = [ libgit2 ];
+  nativeCheckInputs = [ git ];
+
+  meta = {
+    description = "Quickly fix up an old commit using your currently-staged changes";
+    homepage = "https://github.com/quodlibetor/git-instafix";
+    license = with licenses; [ mit asl20 ];
+    maintainers = with maintainers; [ mightyiam ];
+    changelog = "https://github.com/quodlibetor/git-instafix/releases/tag/v${version}";
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/by-name/op/openapi-tui/package.nix b/pkgs/by-name/op/openapi-tui/package.nix
new file mode 100644
index 000000000000..e2c88c4f4efc
--- /dev/null
+++ b/pkgs/by-name/op/openapi-tui/package.nix
@@ -0,0 +1,28 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "openapi-tui";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "zaghaghi";
+    repo = "openapi-tui";
+    rev = version;
+    hash = "sha256-7xkjlX3+/hdVN2PXoiXbouSoMLy0Qe8uMRlPHWJO5Ts=";
+  };
+
+  cargoHash = "sha256-U8TOms8C7vV64OKKdJhMAoOha9s2lBqfBWU7pyZ0h/s=";
+
+  meta = with lib; {
+    description = "Terminal UI to list, browse and run APIs defined with openapi spec";
+    homepage = "https://github.com/zaghaghi/openapi-tui";
+    license = licenses.mit;
+    maintainers = with maintainers; [ matthiasbeyer ];
+    mainProgram = "openapi-tui";
+  };
+}
+
diff --git a/pkgs/development/libraries/opencomposite/helper.nix b/pkgs/by-name/op/opencomposite-helper/package.nix
similarity index 100%
rename from pkgs/development/libraries/opencomposite/helper.nix
rename to pkgs/by-name/op/opencomposite-helper/package.nix
diff --git a/pkgs/development/libraries/opencomposite/default.nix b/pkgs/by-name/op/opencomposite/package.nix
similarity index 86%
rename from pkgs/development/libraries/opencomposite/default.nix
rename to pkgs/by-name/op/opencomposite/package.nix
index fc1b6e631964..dff4e5988cda 100644
--- a/pkgs/development/libraries/opencomposite/default.nix
+++ b/pkgs/by-name/op/opencomposite/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation {
   pname = "opencomposite";
-  version = "unstable-2024-02-16";
+  version = "unstable-2024-03-04";
 
   src = fetchFromGitLab {
     owner = "znixian";
     repo = "OpenOVR";
-    rev = "737bbedd29343bc2f808804e2b24302390a07655";
-    hash = "sha256-azb7T0d0YMQRc0Slq1tzNj6bOmCzfHW3ciY9lN+RTao=";
+    rev = "1bfdf67358add5f573efedbec1fa65d18b790e0e";
+    hash = "sha256-qF5oMI9B5a1oE2gQb/scbom/39Efccja0pTPHHaHMA8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rw/rwpspread/package.nix b/pkgs/by-name/rw/rwpspread/package.nix
index 79c80602d103..e9cded71c368 100644
--- a/pkgs/by-name/rw/rwpspread/package.nix
+++ b/pkgs/by-name/rw/rwpspread/package.nix
@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rwpspread";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "0xk1f0";
     repo = "rwpspread";
     rev = "v${version}";
-    hash = "sha256-gtqcogOjWvie7XK9E9KhuSsUh+aWEqZB7NVTqXH6R7Q=";
+    hash = "sha256-ACYELJU7Y4Xv+abQ/Vgo3xaP+jbO43K/CBE2yuEddko=";
   };
-  cargoHash = "sha256-3yWc1wi5jakBG2CTWpB4uhqIzG0/ufQhyd61EtpibIk=";
+  cargoHash = "sha256-ZNWDUOEhh36YjbGZpljyXsL0g7iW6GheLi2WxCj4w+s=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/gis/saga/default.nix b/pkgs/by-name/sa/saga/package.nix
similarity index 85%
rename from pkgs/applications/gis/saga/default.nix
rename to pkgs/by-name/sa/saga/package.nix
index 817fa7b86f24..3e9497b699da 100644
--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/by-name/sa/saga/package.nix
@@ -9,7 +9,7 @@
 , gdal
 , wxGTK32
 , proj
-, dxflib
+, libsForQt5
 , curl
 , libiodbc
 , xz
@@ -17,7 +17,7 @@
 , opencv
 , vigra
 , postgresql
-, Cocoa
+, darwin
 , unixODBC
 , poppler
 , hdf5
@@ -31,11 +31,11 @@
 
 stdenv.mkDerivation rec {
   pname = "saga";
-  version = "9.3.1";
+  version = "9.3.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/saga-gis/saga-${version}.tar.gz";
-    sha256 = "sha256-QrpEbb8zN003Afnu9UZUanWE0lIiy95POSWd1jB8EtA=";
+    sha256 = "sha256-741O6C7amxSnOOTledF0izmVhiT79tFI4+EOtpNqP2Q=";
   };
 
   sourceRoot = "saga-${version}/saga-gis";
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     curl
-    dxflib
+    libsForQt5.dxflib
     fftw
     libsvm
     hdf5
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
   # See https://groups.google.com/forum/#!topic/nix-devel/h_vSzEJAPXs
   # for why the have additional buildInputs on darwin
   ++ lib.optionals stdenv.isDarwin [
-    Cocoa
+    darwin.apple_sdk.frameworks.Cocoa
     unixODBC
     poppler
     netcdf
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DOpenMP_SUPPORT=${if stdenv.isDarwin then "OFF" else "ON"}"
+    (lib.cmakeBool "OpenMP_SUPPORT" (!stdenv.isDarwin))
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/smartgithg/default.nix b/pkgs/by-name/sm/smartgithg/package.nix
similarity index 95%
rename from pkgs/applications/version-management/smartgithg/default.nix
rename to pkgs/by-name/sm/smartgithg/package.nix
index 693505b20305..4693511951a1 100644
--- a/pkgs/applications/version-management/smartgithg/default.nix
+++ b/pkgs/by-name/sm/smartgithg/package.nix
@@ -2,7 +2,7 @@
 , stdenv
 , fetchurl
 , makeDesktopItem
-, openjdk19
+, openjdk21
 , gtk3
 , glib
 , gnome
@@ -11,15 +11,15 @@
 , which
 }:
 let
-  jre = openjdk19;
+  jre = openjdk21;
 in
 stdenv.mkDerivation rec {
   pname = "smartgithg";
-  version = "23.1.1";
+  version = "23.1.2";
 
   src = fetchurl {
     url = "https://www.syntevo.com/downloads/smartgit/smartgit-linux-${builtins.replaceStrings [ "." ] [ "_" ] version}.tar.gz";
-    sha256 = "sha256-LXB+OymApJjL4bgOZ8Vfd193jZHVbQ6G2zmrHNE/OJk=";
+    hash = "sha256-gXfHmRPUhs8s7IQIhN0vQyx8NpLrS28ufNNYOMA4AXw=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];
diff --git a/pkgs/data/fonts/lxgw-neoxihei/default.nix b/pkgs/data/fonts/lxgw-neoxihei/default.nix
index 34450f55cbdf..3832ba8d510b 100644
--- a/pkgs/data/fonts/lxgw-neoxihei/default.nix
+++ b/pkgs/data/fonts/lxgw-neoxihei/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.120";
+  version = "1.120.1";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-rQ+gbmUYr+iWm5WCUSqb+8+aMD5JZUsbPXZ0Nio2cl8=";
+    hash = "sha256-shzJ5y2mjvodtSHct9gm+09CludxUpR38qi9zvewjaQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/julia-modules/python/extract_artifacts.py b/pkgs/development/julia-modules/python/extract_artifacts.py
index f811c6624e85..4ac450d88a10 100755
--- a/pkgs/development/julia-modules/python/extract_artifacts.py
+++ b/pkgs/development/julia-modules/python/extract_artifacts.py
@@ -79,6 +79,10 @@ def get_archive_derivation(uuid, artifact_name, url, sha256):
           url = "{url}";
           sha256 = "{sha256}";
         }};
+        preUnpack = ''
+          mkdir unpacked
+          cd unpacked
+        '';
         sourceRoot = ".";
         dontConfigure = true;
         dontBuild = true;
diff --git a/pkgs/development/libraries/aravis/default.nix b/pkgs/development/libraries/aravis/default.nix
index 8baf539b26ef..ccdc06e906fe 100644
--- a/pkgs/development/libraries/aravis/default.nix
+++ b/pkgs/development/libraries/aravis/default.nix
@@ -29,13 +29,13 @@ assert enableViewer -> wrapGAppsHook != null;
 
 stdenv.mkDerivation rec {
   pname = "aravis";
-  version = "0.8.30";
+  version = "0.8.31";
 
   src = fetchFromGitHub {
     owner = "AravisProject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-1OxvLpzEKxIXiLJIUr+hCx+sxnH9Z5dBM5Lug1acCok=";
+    sha256 = "sha256-CsXnwrZqBCS7JVAB/7JlAAvks5HnYxgrdc4Bmg68QdE=";
   };
 
   outputs = [ "bin" "dev" "out" "lib" ];
diff --git a/pkgs/development/libraries/gdal/default.nix b/pkgs/development/libraries/gdal/default.nix
index 38a4342dfa1d..6c298ac0e1d9 100644
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@@ -234,18 +234,19 @@ stdenv.mkDerivation (finalAttrs: {
   '';
   nativeInstallCheckInputs = with python3.pkgs; [
     pytestCheckHook
+    pytest-benchmark
     pytest-env
     filelock
     lxml
   ];
+  pytestFlagsArray = [
+    "--benchmark-disable"
+  ];
   disabledTestPaths = [
     # tests that attempt to make network requests
     "gcore/vsis3.py"
     "gdrivers/gdalhttp.py"
     "gdrivers/wms.py"
-
-    # disable benchmarks
-    "benchmark/*"
   ];
   disabledTests = [
     # tests that attempt to make network requests
diff --git a/pkgs/development/libraries/libdatachannel/default.nix b/pkgs/development/libraries/libdatachannel/default.nix
index 64351a85a9ae..9c090399dbc5 100644
--- a/pkgs/development/libraries/libdatachannel/default.nix
+++ b/pkgs/development/libraries/libdatachannel/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdatachannel";
-  version = "0.19.5";
+  version = "0.20.2";
 
   src = fetchFromGitHub {
     owner = "paullouisageneau";
-    repo = pname;
+    repo = "libdatachannel";
     rev = "v${version}";
-    hash = "sha256-XTfe0NqDQWx4ISgEiUbzACH9csaG+IrUvwss07dnz80=";
+    hash = "sha256-bBSsD845iwCMA7TdMBxzezjNbMaGwvRq6rvY/8NLYRU=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index a40f5c6b15e4..7920b4405b2e 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -81,8 +81,8 @@
 # nix build .#mesa .#pkgsi686Linux.mesa .#pkgsCross.aarch64-multiplatform.mesa .#pkgsMusl.mesa
 
 let
-  version = "24.0.2";
-  hash = "sha256-lOKKjtrQbY7SuD61PyU7nrWqYsMID5OXAuGzA5tWyeg=";
+  version = "24.0.3";
+  hash = "sha256-d67JoqN7fTWW6hZAs8xT0LXZs7Uqvtid4H43F+kb/b4=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
diff --git a/pkgs/development/python-modules/aioslimproto/default.nix b/pkgs/development/python-modules/aioslimproto/default.nix
index 2294960ce59a..0a92b10bfd29 100644
--- a/pkgs/development/python-modules/aioslimproto/default.nix
+++ b/pkgs/development/python-modules/aioslimproto/default.nix
@@ -1,53 +1,44 @@
 { lib
+, aiohttp
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pillow
-, pytest-asyncio
-, pytestCheckHook
 , pythonOlder
 , setuptools
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "aioslimproto";
-  version = "2.3.3";
-  format = "pyproject";
+  version = "3.0.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
-    repo = pname;
+    repo = "aioslimproto";
     rev = "refs/tags/${version}";
-    hash = "sha256-d+PEzCF1Cw/7NmumxIRRlr3hojpNsZM/JMQ0KWdosXk=";
+    hash = "sha256-K7z34fT0PQ5qcV+66VbhYTUhCjqW/OjPnrygBFKIW1k=";
   };
 
-  patches = [
-    # https://github.com/home-assistant-libs/aioslimproto/pull/189
-    (fetchpatch {
-      name = "unpin-setuptools-version.patch";
-      url = "https://github.com/home-assistant-libs/aioslimproto/commit/06fd56987be8903ff147bad38af84b21bc31bc18.patch";
-      hash = "sha256-kTu1+IwDrcdqelyK/vfhxw8MQBis5I1jag7YTytKQhs=";
-    })
-  ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "--cov" ""
+  '';
 
   nativeBuildInputs = [
     setuptools
-    wheel
   ];
 
   propagatedBuildInputs = [
+    aiohttp
     async-timeout
     pillow
   ];
 
-  nativeCheckInputs = [
-    pytest-asyncio
-    pytestCheckHook
-  ];
+  # Module has no tests
+  doCheck = false;
 
   pythonImportsCheck = [
     "aioslimproto"
diff --git a/pkgs/development/python-modules/autologging/default.nix b/pkgs/development/python-modules/autologging/default.nix
index 1b3a7d652185..46adfc6195ac 100644
--- a/pkgs/development/python-modules/autologging/default.nix
+++ b/pkgs/development/python-modules/autologging/default.nix
@@ -1,11 +1,12 @@
 { lib, buildPythonPackage, fetchPypi }:
 
 buildPythonPackage rec {
-  pname = "Autologging";
+  pname = "autologging";
   version = "1.3.2";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Autologging";
+    inherit version;
     sha256 = "117659584d8aab8cf62046f682f8e57b54d958b8571c737fa8bf15c32937fbb6";
     extension = "zip";
   };
diff --git a/pkgs/development/python-modules/axis/default.nix b/pkgs/development/python-modules/axis/default.nix
index 1d77c3409c94..261d1b5ab5cd 100644
--- a/pkgs/development/python-modules/axis/default.nix
+++ b/pkgs/development/python-modules/axis/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "axis";
-  version = "53";
+  version = "54";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = "axis";
     rev = "refs/tags/v${version}";
-    hash = "sha256-M5uaRiZP66RApSztvgzzpAUBKCcSCqC6fxzmB52mibY=";
+    hash = "sha256-Atx9Lg0WgKcdnXqHieJFadjMPhK1F2qifSa89XxT8J8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 5e3aefbe8170..6dd67db97630 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.34.61";
+  version = "1.34.62";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-yOzieubWIEqCOipt9HEo1vnhxOYyUuHhHYb2NemLQVk=";
+    hash = "sha256-i0iPzIqL0zsA08frxJB65Eys6o/qk6Tf2sf6tfBlAMg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/clickhouse-connect/default.nix b/pkgs/development/python-modules/clickhouse-connect/default.nix
index 4c073d21c967..5be944efdb1d 100644
--- a/pkgs/development/python-modules/clickhouse-connect/default.nix
+++ b/pkgs/development/python-modules/clickhouse-connect/default.nix
@@ -23,7 +23,7 @@
 }:
 buildPythonPackage rec {
   pname = "clickhouse-connect";
-  version = "0.7.2";
+  version = "0.7.3";
 
   format = "setuptools";
 
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     repo = "clickhouse-connect";
     owner = "ClickHouse";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UOS0Z8KsMqyFBPfVc8Lag7zfw1DNgNDEnvAbmG15FGg=";
+    hash = "sha256-MA902Dyx3a8GTZ52LYY0UrWqNEFmibqIsdz6PFZIkIY=";
   };
 
   nativeBuildInputs = [ cython_3 ];
diff --git a/pkgs/development/python-modules/dbt-core/default.nix b/pkgs/development/python-modules/dbt-core/default.nix
index 806444d411b1..b537da2a3055 100644
--- a/pkgs/development/python-modules/dbt-core/default.nix
+++ b/pkgs/development/python-modules/dbt-core/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "dbt-core";
-  version = "1.7.9";
+  version = "1.7.10";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ff+cdY6xy14w30BDn1ct/2Q+4j8cQupJrJHb4vO58J0=";
+    hash = "sha256-0cKzQjAnj0JMrHyA/gOgYceM6g1URJFgQtp90m09Nkw=";
   };
 
   sourceRoot = "${src.name}/core";
diff --git a/pkgs/development/python-modules/gassist-text/default.nix b/pkgs/development/python-modules/gassist-text/default.nix
index b413c19d4093..a8e7b14de892 100644
--- a/pkgs/development/python-modules/gassist-text/default.nix
+++ b/pkgs/development/python-modules/gassist-text/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "gassist-text";
-  version = "0.0.10";
+  version = "0.0.11";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "gassist_text";
     rev = "refs/tags/${version}";
-    hash = "sha256-BSMflCSYNAaQVTOqKWyr9U9Q70ley1jjF6ndOVum+GA=";
+    hash = "sha256-XFHyI48TuPBJjHA4dLSpYv62Y5zK0knrIqNKBoWnEeU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/gvm-tools/default.nix b/pkgs/development/python-modules/gvm-tools/default.nix
index cd6a4bfcd25b..59d0da14b17d 100644
--- a/pkgs/development/python-modules/gvm-tools/default.nix
+++ b/pkgs/development/python-modules/gvm-tools/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "gvm-tools";
-  version = "24.1.0";
+  version = "24.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = "gvm-tools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4uYOhsnprYybt5EB/b4LW8/9cn0Nahc1lYQ+DwPNlOU=";
+    hash = "sha256-LLXMdT1q6IWsbsRjflpGN5pcjUCXWzdFK3gMw4mBm0U=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 2a78e7c96d37..dae2aae43bf2 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -2,7 +2,6 @@
 , aiohttp
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , freezegun
 , orjson
 , pydevccu
@@ -19,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2024.3.0";
+  version = "2024.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -28,19 +27,9 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = "hahomematic";
     rev = "refs/tags/${version}";
-    hash = "sha256-zSGzdj51StlLMmFZzprQUn6Ry9ahJPUq/Z9hVlKn8oA=";
+    hash = "sha256-/ulqUyplNu8YTHJKcfNPYzyzPvGkLFtoJDu5SqvfQrs=";
   };
 
-  patches = [
-    # Update pydevccu, extend ruff usage
-    # https://github.com/danielperna84/hahomematic/pull/1454
-    (fetchpatch {
-      url = "https://github.com/danielperna84/hahomematic/commit/81a9a1c9291e2271ac0b995e7dd4725cfe99c7fe.patch";
-      includes = [ "tests/test_central_pydevccu.py" ];
-      hash = "sha256-l/wNK0/nOZHyrFp+in3ozmMyN5ifo514esGPJVZlb1g=";
-    })
-  ];
-
   __darwinAllowLocalNetworking = true;
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/kivy/default.nix b/pkgs/development/python-modules/kivy/default.nix
index dd04b97010dd..d9b8e23fe416 100644
--- a/pkgs/development/python-modules/kivy/default.nix
+++ b/pkgs/development/python-modules/kivy/default.nix
@@ -10,7 +10,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Kivy";
+  pname = "kivy";
   version = "2.1.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/llama-parse/default.nix b/pkgs/development/python-modules/llama-parse/default.nix
index e65edce158db..284f03f67a59 100644
--- a/pkgs/development/python-modules/llama-parse/default.nix
+++ b/pkgs/development/python-modules/llama-parse/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "llama-parse";
-  version = "0.3.8";
+  version = "0.3.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_parse";
     inherit version;
-    hash = "sha256-PUc5cmaH5mAufKy8nxfUONOZiaSnMyT8mRIrOu+jhKQ=";
+    hash = "sha256-vra6Tbt6V3CKtvEPfVMUFZjjneGgQKYeb1pxw6XVaxM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index db565039d5a0..fd96cc0aa78a 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -385,7 +385,7 @@ rec {
 
   mypy-boto3-ivs = buildMypyBoto3Package "ivs" "1.34.45" "sha256-Ilrtk6ZF1p3GNuZrtiEiNXi3bHI3MYNr6bDpJ8sf4Fg=";
 
-  mypy-boto3-ivs-realtime = buildMypyBoto3Package "ivs-realtime" "1.34.0" "sha256-x+B14roN4jNXeLp+Tmwtj28OMeGe80qLMaIbVCzulbY=";
+  mypy-boto3-ivs-realtime = buildMypyBoto3Package "ivs-realtime" "1.34.62" "sha256-/8P/S2xdYub8/tC0yaUbUfcxfDKpDnfAvmqneXFcAOo=";
 
   mypy-boto3-ivschat = buildMypyBoto3Package "ivschat" "1.34.0" "sha256-eNwL7uUI7x30KJwNO5U/0XSV1O4YZYu/zYvGQgz7p+8=";
 
@@ -411,7 +411,7 @@ rec {
 
   mypy-boto3-kinesisanalytics = buildMypyBoto3Package "kinesisanalytics" "1.34.0" "sha256-eEoSmwMTa/hsbKbuKuzAZv4jHljGKq3b5Rw7K2Pgc50=";
 
-  mypy-boto3-kinesisanalyticsv2 = buildMypyBoto3Package "kinesisanalyticsv2" "1.34.0" "sha256-ZxVW6BKUdgnWKk4J3B2I0vlSLZRR+Dua3Sb/mzIDFNE=";
+  mypy-boto3-kinesisanalyticsv2 = buildMypyBoto3Package "kinesisanalyticsv2" "1.34.62" "sha256-bL6EKRjfIIUUIMSpoE0BWeAg3xb2xbKi8NBpHSaEEFg=";
 
   mypy-boto3-kinesisvideo = buildMypyBoto3Package "kinesisvideo" "1.34.48" "sha256-uYSkwOuYKF3B+sj5IWbDL789Xue2yNY9g14j/2b6k6w=";
 
@@ -619,7 +619,7 @@ rec {
 
   mypy-boto3-rum = buildMypyBoto3Package "rum" "1.34.49" "sha256-Mq2H+13cjxYRwFfxJpWTAb+W5bx+Vew+jl+zbreRIkQ=";
 
-  mypy-boto3-s3 = buildMypyBoto3Package "s3" "1.34.14" "sha256-ccOasGI820QtIltxwXg/alE8/0xKE1BaLvuy46/y6WU=";
+  mypy-boto3-s3 = buildMypyBoto3Package "s3" "1.34.62" "sha256-HWDLEJB667VrTYZYircK5C23oRSGnwWLu7tNWG6yLm0=";
 
   mypy-boto3-s3control = buildMypyBoto3Package "s3control" "1.34.18" "sha256-53s5ii1gFX9toigiazEtS5Jogg3VFFr+1/uiLzoU7Uo=";
 
diff --git a/pkgs/development/python-modules/orbax-checkpoint/default.nix b/pkgs/development/python-modules/orbax-checkpoint/default.nix
index 0f9d467335ce..c1787fe86747 100644
--- a/pkgs/development/python-modules/orbax-checkpoint/default.nix
+++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "orbax-checkpoint";
-  version = "0.5.3";
+  version = "0.5.5";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "orbax_checkpoint";
     inherit version;
-    hash = "sha256-FXKQTLv+hROSfg2A+AtzDg7y9oAzLTwoENhENTKTi0U=";
+    hash = "sha256-zry5byLxFzah+e52x4yIi6roU3Jox/9mY62cujB2xlU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index 9d5630a22360..881e7e33d91b 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -35,7 +35,7 @@
 
 buildPythonPackage rec {
   pname = "python-lsp-server";
-  version = "1.10.0";
+  version = "1.10.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     owner = "python-lsp";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-dh33m7wgOwUETjdNqqDKZnpTgbrYCg9/XXC296tHm4w=";
+    hash = "sha256-tY+BE8DAajZKwlZ2D7uCr9LC7D61ULkhV8Z9EpRu6j0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-ptrace/default.nix b/pkgs/development/python-modules/python-ptrace/default.nix
index 790f1e58c295..496987c94e4a 100644
--- a/pkgs/development/python-modules/python-ptrace/default.nix
+++ b/pkgs/development/python-modules/python-ptrace/default.nix
@@ -1,27 +1,30 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, six
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "python-ptrace";
-  version = "0.9.8";
-  format = "setuptools";
+  version = "0.9.9";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1e3bc6223f626aaacde8a7979732691c11b13012e702fee9ae16c87f71633eaa";
+    hash = "sha256-Vrv+9E6vOne+SBOMyldnzfRx6CeP4Umfm3LxUZB/Jc8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # requires distorm, which is optionally
   doCheck = false;
 
-  propagatedBuildInputs = [ six ];
-
   meta = with lib; {
     description = "Python binding of ptrace library";
     homepage = "https://github.com/vstinner/python-ptrace";
+    changelog = "https://github.com/vstinner/python-ptrace/blob/${version}/doc/changelog.rst";
     license = licenses.gpl2;
     maintainers = with maintainers; [ mic92 ];
   };
diff --git a/pkgs/development/python-modules/restrictedpython/default.nix b/pkgs/development/python-modules/restrictedpython/default.nix
index 169e28773b42..64dbb3016829 100644
--- a/pkgs/development/python-modules/restrictedpython/default.nix
+++ b/pkgs/development/python-modules/restrictedpython/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "restrictedpython";
-  version = "7.0";
+  version = "7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "RestrictedPython";
     inherit version;
-    hash = "sha256-U3BK+7w1D9yPskVEE2e+Zxyfg4CGkgGy6EUudPzj2xQ=";
+    hash = "sha256-h1rrUcE51440zvhgXcZTCbRJFoBg3QhVGh/p7bR8uaU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/scikit-hep-testdata/default.nix b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
index 94531f8a2213..1d448c0b45de 100644
--- a/pkgs/development/python-modules/scikit-hep-testdata/default.nix
+++ b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "scikit-hep-testdata";
-  version = "0.4.39";
+  version = "0.4.40";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-tcKEJrqB7cblcmH4PtSmx0heUew2+aDE4+mk2v9cUuo=";
+    hash = "sha256-6PUAam7eDWQOMS3SVIVJXvqQLBE187yUbkiyFZ+ojcU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/systembridgeconnector/default.nix b/pkgs/development/python-modules/systembridgeconnector/default.nix
index f5bb1e63136b..04132ffe081a 100644
--- a/pkgs/development/python-modules/systembridgeconnector/default.nix
+++ b/pkgs/development/python-modules/systembridgeconnector/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "systembridgeconnector";
-  version = "4.0.3";
+  version = "4.0.4";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,20 +23,21 @@ buildPythonPackage rec {
     owner = "timmo001";
     repo = "system-bridge-connector";
     rev = "refs/tags/${version}";
-    hash = "sha256-AjdWDEotz5AUo+auxBqXu7EMv/Kt97DZ6vOrFunZ2Fw=";
+    hash = "sha256-Guh9qbRLp+b2SuFgBx7jf16vRShuHJBi3WOVn9Akce8=";
   };
 
   patches = [
-    (fetchpatch2 {
-      url = "https://github.com/timmo001/system-bridge-connector/commit/a9030cf175ab4b51d77010de89e83cbb426448c2.patch";
-      hash = "sha256-0N8knoaEvymSvC92BxDKR0j52oasvOzWosFtHMI2Qmc=";
-    })
     (fetchpatch2 {
       url = "https://github.com/timmo001/system-bridge-connector/commit/25aa172775ee983dc4a29b8dda880aefbad70040.patch";
       hash = "sha256-PedW1S1gZmWkS4sJBqSAx3aoA1KppYS5Xlhoaxqkcd4=";
     })
   ];
 
+  postPatch = ''
+    substituteInPlace systembridgeconnector/_version.py \
+      --replace-fail ", dev=0" ""
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/systembridgemodels/default.nix b/pkgs/development/python-modules/systembridgemodels/default.nix
index 37bbef1c3b71..ee7945ee20b9 100644
--- a/pkgs/development/python-modules/systembridgemodels/default.nix
+++ b/pkgs/development/python-modules/systembridgemodels/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, fetchpatch2
 , setuptools
 , incremental
 , pytestCheckHook
@@ -10,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "systembridgemodels";
-  version = "4.0.1";
+  version = "4.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -19,15 +18,13 @@ buildPythonPackage rec {
     owner = "timmo001";
     repo = "system-bridge-models";
     rev = "refs/tags/${version}";
-    hash = "sha256-9k85tqJO/YtkYncfNQBelmDkd3SYtf6SHURfumvqUo0=";
+    hash = "sha256-5rbj58E8iDu2Rjf0k9Y1UoF3hbN7ntkx6dm20HYpw6I=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      url = "https://github.com/timmo001/system-bridge-models/commit/82fcee37cb302bc77384165b2ce10f2234c2a14a.patch";
-      hash = "sha256-tZSaWVUPCJmuzkae9LBTdyZ3UINMvrSMbdS5AvbId8Q=";
-    })
-  ];
+  postPatch = ''
+    substituteInPlace systembridgemodels/_version.py \
+      --replace-fail ", dev=0" ""
+  '';
 
   nativeBuildInputs = [
     setuptools
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 7509de247730..c114f157986f 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1107";
+  version = "3.0.1108";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-ulvBheV97APX/y8tx0zzhP8Lih0o8Kwfn9o4SB5tCOo=";
+    hash = "sha256-aeQPoVHrRMxXzutaBkEjD2ek4zU/ZV4aBgm17r0ZRPU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/timezonefinder/default.nix b/pkgs/development/python-modules/timezonefinder/default.nix
index c39b04cd3fe7..ea6df2843c9a 100644
--- a/pkgs/development/python-modules/timezonefinder/default.nix
+++ b/pkgs/development/python-modules/timezonefinder/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "timezonefinder";
-  version = "6.4.1";
+  version = "6.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "jannikmi";
     repo = "timezonefinder";
     rev = "refs/tags/${version}";
-    hash = "sha256-e9Zx236X76GYFuADCw9+5HWs2craeq44gVNclkc4th0=";
+    hash = "sha256-V5g1zTdXWeJba71/eUGQbF9XOhMQuzivtGkqGD4OHMY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-docutils/default.nix b/pkgs/development/python-modules/types-docutils/default.nix
index a55fe185e777..4744ffd95da5 100644
--- a/pkgs/development/python-modules/types-docutils/default.nix
+++ b/pkgs/development/python-modules/types-docutils/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-docutils";
-  version = "0.20.0.20240311";
+  version = "0.20.0.20240314";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sp3zYunm78umjieveBNZAtVmFPb6dsBz0pmJJy7tsGk=";
+    hash = "sha256-Lq158JJnPILx+3u4yHugGrrVTbZlB2QsBAseaE4j7Ug=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index dfa997587702..e54fc19d5008 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.37";
+  version = "3.2.38";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-aZKfS/xJYy5P+/xqReKty6yNQi8CcVfe4pOxios1/O4=";
+    hash = "sha256-AilJpggqi0c9KL/jY9XTGBNu21W1uo2INBWheBfkSLA=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/bearer/default.nix b/pkgs/development/tools/bearer/default.nix
index 75b264effdc9..9834644edc6c 100644
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.41.0";
+  version = "1.42.0";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RwoUyEIwKGDRqkETGEo6x1U14lqBogDzsoOHQKt8lHc=";
+    hash = "sha256-AcfOlTKhCntYauz3MxHBycvXBFVgnY7rBJPUwfEZUcA=";
   };
 
-  vendorHash = "sha256-KCsCUVO2WsKJKU/aiXgeyS01341Xf9yQnKvQ7hAkYbQ=";
+  vendorHash = "sha256-g0AnL6r3dUfCIAytTknAD5aCPBsohDUMNfMAYKBebi4=";
 
   subPackages = [
     "cmd/bearer"
diff --git a/pkgs/development/tools/cocoapods/Gemfile-beta.lock b/pkgs/development/tools/cocoapods/Gemfile-beta.lock
index a6de12d37758..363d1f9a30a0 100644
--- a/pkgs/development/tools/cocoapods/Gemfile-beta.lock
+++ b/pkgs/development/tools/cocoapods/Gemfile-beta.lock
@@ -1,7 +1,9 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    CFPropertyList (3.0.6)
+    CFPropertyList (3.0.7)
+      base64
+      nkf
       rexml
     activesupport (7.1.3)
       base64
@@ -22,10 +24,10 @@ GEM
     base64 (0.2.0)
     bigdecimal (3.1.6)
     claide (1.1.0)
-    cocoapods (1.15.1)
+    cocoapods (1.15.2)
       addressable (~> 2.8)
       claide (>= 1.0.2, < 2.0)
-      cocoapods-core (= 1.15.1)
+      cocoapods-core (= 1.15.2)
       cocoapods-deintegrate (>= 1.0.3, < 2.0)
       cocoapods-downloader (>= 2.1, < 3.0)
       cocoapods-plugins (>= 1.0.0, < 2.0)
@@ -40,7 +42,7 @@ GEM
       nap (~> 1.0)
       ruby-macho (>= 2.3.0, < 3.0)
       xcodeproj (>= 1.23.0, < 2.0)
-    cocoapods-core (1.15.1)
+    cocoapods-core (1.15.2)
       activesupport (>= 5.0, < 8)
       addressable (~> 2.8)
       algoliasearch (~> 1.0)
@@ -75,12 +77,13 @@ GEM
     i18n (1.14.1)
       concurrent-ruby (~> 1.0)
     json (2.7.1)
-    minitest (5.22.0)
+    minitest (5.22.2)
     molinillo (0.8.0)
     mutex_m (0.2.0)
     nanaimo (0.3.0)
     nap (1.1.0)
     netrc (0.11.0)
+    nkf (0.2.0)
     public_suffix (4.0.7)
     rexml (3.2.6)
     ruby-macho (2.5.1)
diff --git a/pkgs/development/tools/cocoapods/Gemfile.lock b/pkgs/development/tools/cocoapods/Gemfile.lock
index 82951ab2233d..194f5e8a84bf 100644
--- a/pkgs/development/tools/cocoapods/Gemfile.lock
+++ b/pkgs/development/tools/cocoapods/Gemfile.lock
@@ -1,7 +1,9 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    CFPropertyList (3.0.6)
+    CFPropertyList (3.0.7)
+      base64
+      nkf
       rexml
     activesupport (7.1.3)
       base64
@@ -22,10 +24,10 @@ GEM
     base64 (0.2.0)
     bigdecimal (3.1.6)
     claide (1.1.0)
-    cocoapods (1.15.1)
+    cocoapods (1.15.2)
       addressable (~> 2.8)
       claide (>= 1.0.2, < 2.0)
-      cocoapods-core (= 1.15.1)
+      cocoapods-core (= 1.15.2)
       cocoapods-deintegrate (>= 1.0.3, < 2.0)
       cocoapods-downloader (>= 2.1, < 3.0)
       cocoapods-plugins (>= 1.0.0, < 2.0)
@@ -40,7 +42,7 @@ GEM
       nap (~> 1.0)
       ruby-macho (>= 2.3.0, < 3.0)
       xcodeproj (>= 1.23.0, < 2.0)
-    cocoapods-core (1.15.1)
+    cocoapods-core (1.15.2)
       activesupport (>= 5.0, < 8)
       addressable (~> 2.8)
       algoliasearch (~> 1.0)
@@ -75,12 +77,13 @@ GEM
     i18n (1.14.1)
       concurrent-ruby (~> 1.0)
     json (2.7.1)
-    minitest (5.22.0)
+    minitest (5.22.2)
     molinillo (0.8.0)
     mutex_m (0.2.0)
     nanaimo (0.3.0)
     nap (1.1.0)
     netrc (0.11.0)
+    nkf (0.2.0)
     public_suffix (4.0.7)
     rexml (3.2.6)
     ruby-macho (2.5.1)
diff --git a/pkgs/development/tools/cocoapods/gemset-beta.nix b/pkgs/development/tools/cocoapods/gemset-beta.nix
index 44e3397129f6..022ce3a0f668 100644
--- a/pkgs/development/tools/cocoapods/gemset-beta.nix
+++ b/pkgs/development/tools/cocoapods/gemset-beta.nix
@@ -63,15 +63,15 @@
     version = "3.1.6";
   };
   CFPropertyList = {
-    dependencies = ["rexml"];
+    dependencies = ["base64" "nkf" "rexml"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1a36zn77yyibqsfpka0i8vgf3yv98ic2b9wwlbc29566y8wpa2bq";
+      sha256 = "0k1w5i4lb1z941m7ds858nly33f3iv12wvr1zav5x3fa99hj2my4";
       type = "gem";
     };
-    version = "3.0.6";
+    version = "3.0.7";
   };
   claide = {
     groups = ["default"];
@@ -89,10 +89,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19rmw9518zlcalr7vy6f10rbiya7ch86z3nfk2d6klw41ihc5hrq";
+      sha256 = "02h9lk5w0ilz39cdl7fil0fpmfbzyc23whkgp4rx2a6hx0yibxgh";
       type = "gem";
     };
-    version = "1.15.1";
+    version = "1.15.2";
   };
   cocoapods-core = {
     dependencies = ["activesupport" "addressable" "algoliasearch" "concurrent-ruby" "fuzzy_match" "nap" "netrc" "public_suffix" "typhoeus"];
@@ -100,10 +100,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03dh7vfr9r248c8vbkssa6q0y9imvv1ms6mx28w06ysmdvn4vbgv";
+      sha256 = "0di1g9k1f6i80yxzdl3rdlfdk2w89dv6k5m06444rbg1gzcm09ij";
       type = "gem";
     };
-    version = "1.15.1";
+    version = "1.15.2";
   };
   cocoapods-deintegrate = {
     groups = ["default"];
@@ -305,10 +305,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hv03j1ac349pjymis7jxmbqr5jalc60cg27529bbb3zymswhdjz";
+      sha256 = "0667vf0zglacry87nkcl3ns8421aydvz71vfa3g3yjhiq8zh19f5";
       type = "gem";
     };
-    version = "5.22.0";
+    version = "5.22.2";
   };
   molinillo = {
     groups = ["default"];
@@ -360,6 +360,16 @@
     };
     version = "0.11.0";
   };
+  nkf = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09piyp2pd74klb9wcn0zw4mb5l0k9wzwppxggxi1yi95l2ym3hgv";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
   public_suffix = {
     groups = ["default"];
     platforms = [];
diff --git a/pkgs/development/tools/cocoapods/gemset.nix b/pkgs/development/tools/cocoapods/gemset.nix
index efb58a05224c..d89ae9ca3aa4 100644
--- a/pkgs/development/tools/cocoapods/gemset.nix
+++ b/pkgs/development/tools/cocoapods/gemset.nix
@@ -61,15 +61,15 @@
     version = "3.1.6";
   };
   CFPropertyList = {
-    dependencies = ["rexml"];
+    dependencies = ["base64" "nkf" "rexml"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1a36zn77yyibqsfpka0i8vgf3yv98ic2b9wwlbc29566y8wpa2bq";
+      sha256 = "0k1w5i4lb1z941m7ds858nly33f3iv12wvr1zav5x3fa99hj2my4";
       type = "gem";
     };
-    version = "3.0.6";
+    version = "3.0.7";
   };
   claide = {
     groups = ["default"];
@@ -87,10 +87,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19rmw9518zlcalr7vy6f10rbiya7ch86z3nfk2d6klw41ihc5hrq";
+      sha256 = "02h9lk5w0ilz39cdl7fil0fpmfbzyc23whkgp4rx2a6hx0yibxgh";
       type = "gem";
     };
-    version = "1.15.1";
+    version = "1.15.2";
   };
   cocoapods-core = {
     dependencies = ["activesupport" "addressable" "algoliasearch" "concurrent-ruby" "fuzzy_match" "nap" "netrc" "public_suffix" "typhoeus"];
@@ -98,10 +98,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03dh7vfr9r248c8vbkssa6q0y9imvv1ms6mx28w06ysmdvn4vbgv";
+      sha256 = "0di1g9k1f6i80yxzdl3rdlfdk2w89dv6k5m06444rbg1gzcm09ij";
       type = "gem";
     };
-    version = "1.15.1";
+    version = "1.15.2";
   };
   cocoapods-deintegrate = {
     groups = ["default"];
@@ -293,10 +293,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hv03j1ac349pjymis7jxmbqr5jalc60cg27529bbb3zymswhdjz";
+      sha256 = "0667vf0zglacry87nkcl3ns8421aydvz71vfa3g3yjhiq8zh19f5";
       type = "gem";
     };
-    version = "5.22.0";
+    version = "5.22.2";
   };
   molinillo = {
     groups = ["default"];
@@ -344,6 +344,16 @@
     };
     version = "0.11.0";
   };
+  nkf = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09piyp2pd74klb9wcn0zw4mb5l0k9wzwppxggxi1yi95l2ym3hgv";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
   public_suffix = {
     groups = ["default"];
     platforms = [];
diff --git a/pkgs/development/tools/firebase-tools/default.nix b/pkgs/development/tools/firebase-tools/default.nix
index f43f48e5cfd1..2ddacca2631d 100644
--- a/pkgs/development/tools/firebase-tools/default.nix
+++ b/pkgs/development/tools/firebase-tools/default.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "13.4.1";
+  version = "13.5.0";
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     rev = "v${version}";
-    hash = "sha256-XznQP9kcool3dgydMk1tq68ms+/TKVgKj8EvhdFr8LE=";
+    hash = "sha256-9xgXPQa+a9nR5e1xbNnkZb+gPrK+5nWZS/Dhzva6DVQ=";
   };
 
-  npmDepsHash = "sha256-mDjSWIg/mtB1nl0Znu4MQO8Rr0EYfRbArx650DnqZd8=";
+  npmDepsHash = "sha256-wuuZfqP39fxvkNc9dXK9iE2x2QHOQUTi/pWu4ZRuYgE=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/development/tools/gauge/default.nix b/pkgs/development/tools/gauge/default.nix
index 2a2b17e73ed6..5998e3254d34 100644
--- a/pkgs/development/tools/gauge/default.nix
+++ b/pkgs/development/tools/gauge/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gauge";
-  version = "1.6.3";
+  version = "1.6.4";
 
   src = fetchFromGitHub {
     owner = "getgauge";
     repo = "gauge";
     rev = "v${version}";
-    hash = "sha256-ymnyoQRMr3s74PnDSmXCoWGSMBhxy/CRDpRvEZHOrFU=";
+    hash = "sha256-Hefhhexy3Kl4fmYXlNBgZBSdOGPJefS1BjKWoblIVaw=";
   };
 
-  vendorHash = "sha256-5kBjxhmBrC5ZzD7CSzRvIzQrJYRRU/X+n9L9JPvyJkY=";
+  vendorHash = "sha256-csS7lRTczno77LIDq2q3DeuJxQcOLr1cQf11NuWixG8=";
 
   excludedPackages = [ "build" "man" ];
 
diff --git a/pkgs/development/tools/haskell/hyper-haskell/default.nix b/pkgs/development/tools/haskell/hyper-haskell/default.nix
deleted file mode 100644
index 2b3fb76903e5..000000000000
--- a/pkgs/development/tools/haskell/hyper-haskell/default.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ lib, stdenvNoCC, fetchFromGitHub, jshon, electron_10
-, runtimeShell, hyper-haskell-server, extra-packages ? [] }:
-
-let
-  binPath = lib.makeBinPath ([ hyper-haskell-server ] ++ extra-packages);
-  electron = electron_10;
-in stdenvNoCC.mkDerivation rec {
-  pname = "hyper-haskell";
-  version = "0.2.3.0";
-
-  src = fetchFromGitHub {
-    owner = "HeinrichApfelmus";
-    repo = "hyper-haskell";
-    rev = "v${version}";
-    sha256 = "1nmkry4wh6a2dy98fcs81mq2p7zhxp1k0f4m3szr6fm3j1zwrd43";
-  };
-
-  propagatedBuildInputs = extra-packages;
-
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir -p $out/bin $out/share/hyper-haskell/worksheets $out/share/applications $out/share/icons/hicolor/scalable/apps $out/share/mime/packages
-
-    # Electron app
-    cp -R app $out
-
-    # Desktop Launcher
-    cp resources/hyper-haskell.desktop $out/share/applications/hyper-haskell.desktop
-    cp resources/icons/icon.svg $out/share/icons/hicolor/scalable/apps/hyper-haskell.svg
-    cp resources/shared-mime-info.xml $out/share/mime/packages/hyper-haskell.xml
-
-    # install example worksheets with backend set to nix
-    for worksheet in "worksheets/"*.hhs; do
-      ${jshon}/bin/jshon -e settings -s nix -i packageTool -p < $worksheet > $out/share/hyper-haskell/worksheets/`basename $worksheet`
-    done
-
-    # install electron wrapper script
-    cat > $out/bin/hyper-haskell <<EOF
-    #!${runtimeShell}
-    export PATH="${binPath}:\$PATH"
-    exec ${electron}/bin/electron $out/app "\$@"
-    EOF
-    chmod 755 $out/bin/hyper-haskell
-  '';
-
-  meta = with lib; {
-    description = "The strongly hyped graphical interpreter for the Haskell programming language";
-    homepage = "https://github.com/HeinrichApfelmus/hyper-haskell";
-    license = licenses.bsd3;
-    maintainers = [ maintainers.rvl ];
-  };
-}
diff --git a/pkgs/development/tools/haskell/hyper-haskell/server.nix b/pkgs/development/tools/haskell/hyper-haskell/server.nix
deleted file mode 100644
index ca272eb36262..000000000000
--- a/pkgs/development/tools/haskell/hyper-haskell/server.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ stdenv, ghcWithPackages, makeWrapper, packages, lib }:
-
-let
-hyperHaskellEnv = ghcWithPackages (self: [ self.hyper-haskell-server ] ++ packages self);
-in stdenv.mkDerivation {
-  pname = "hyper-haskell-server-with-packages";
-  version = hyperHaskellEnv.version;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  buildCommand = ''
-    mkdir -p $out/bin
-    makeWrapper ${hyperHaskellEnv}/bin/hyper-haskell-server $out/bin/hyper-haskell-server \
-      --set NIX_GHC ${hyperHaskellEnv}/bin/ghc \
-      --set NIX_GHCPKG ${hyperHaskellEnv}/bin/ghc-pkg \
-      --set NIX_GHC_LIBDIR ${hyperHaskellEnv}/lib/ghc-*
-  '';
-
-  # trivial derivation
-  preferLocalBuild = true;
-  allowSubstitutes = false;
-
-  meta = {
-    # Marked as broken because the underlying
-    # haskellPackages.hyper-haskell-server is marked as broken.
-    hydraPlatforms = lib.platforms.none;
-    broken = true;
-  };
-}
diff --git a/pkgs/development/tools/misc/cvise/default.nix b/pkgs/development/tools/misc/cvise/default.nix
index f65b0386cfd8..129b534339ee 100644
--- a/pkgs/development/tools/misc/cvise/default.nix
+++ b/pkgs/development/tools/misc/cvise/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonApplication
 , fetchFromGitHub
-, fetchpatch
 , bash
 , cmake
 , colordiff
@@ -17,27 +16,19 @@
 
 buildPythonApplication rec {
   pname = "cvise";
-  version = "2.9.0";
+  version = "2.10.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "marxin";
     repo = "cvise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4LEKVh3jNU3xOq75+IQezjhbL/6uAGQ3r0Au2cxx1WA=";
+    hash = "sha256-0gk4O1q90eH1FMhj4ncNVqX/MfVyaU0nckh1xny2wlM=";
   };
 
   patches = [
     # Refer to unifdef by absolute path.
     ./unifdef.patch
-
-    # Refer to shell via /usr/bin/env:
-    #   https://github.com/marxin/cvise/pull/121
-    (fetchpatch {
-      name = "env-shell.patch";
-      url = "https://github.com/marxin/cvise/commit/6a416eb590be978a2ad25c610974fdde84e88651.patch";
-      hash = "sha256-Kn6+TXP+wJpMs6jrgsa9OwjXf6vmIgGzny8jg3dfKWA=";
-    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/tools/time-ghc-modules/default.nix b/pkgs/development/tools/time-ghc-modules/default.nix
index e57495b8fb1c..7b0026b0692b 100644
--- a/pkgs/development/tools/time-ghc-modules/default.nix
+++ b/pkgs/development/tools/time-ghc-modules/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "time-ghc-modules";
-  version = "1.0.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "codedownio";
     repo = "time-ghc-modules";
     rev = version;
-    sha256 = "0s6540gllhjn7366inhwa70rdnngnhbi07jn1h6x8a0pi71wdfm9";
+    sha256 = "sha256-/PhJAhP3KCWFyeSk8e5JV0cpBueH/eVDwQTMZSnnZCo=";
   };
 
   nativeBuildInputs = [makeWrapper];
diff --git a/pkgs/development/tools/toxiproxy/default.nix b/pkgs/development/tools/toxiproxy/default.nix
index fdeb362ee946..985d0be9a20d 100644
--- a/pkgs/development/tools/toxiproxy/default.nix
+++ b/pkgs/development/tools/toxiproxy/default.nix
@@ -1,17 +1,22 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, testers
+, toxiproxy
+}:
 
 buildGoModule rec {
   pname = "toxiproxy";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = "toxiproxy";
     rev = "v${version}";
-    sha256 = "sha256-SL3YHsNeFw8K8lPrzJXAoTkHxS+1sTREfzjawBxdnf0=";
+    sha256 = "sha256-wa39RsopmENXNEI5kiNIYSLGi/qGwIEfNVKWhAgVOuE=";
   };
 
-  vendorHash = "sha256-CmENxPAdjz0BAyvhLKIaJjSbK/mvRzHGCQOfGIiA3yI=";
+  vendorHash = "sha256-m6jZOVlJI3GGqCsCkMAIB2jg1Nk8oAELyzL3y4b2nqA=";
 
   excludedPackages = [ "test/e2e" ];
 
@@ -20,14 +25,28 @@ buildGoModule rec {
   # Fixes tests on Darwin
   __darwinAllowLocalNetworking = true;
 
-  checkFlags = [ "-short" ];
+  checkFlags = [ "-short" "-skip=TestVersionEndpointReturnsVersion" ];
 
   postInstall = ''
     mv $out/bin/cli $out/bin/toxiproxy-cli
     mv $out/bin/server $out/bin/toxiproxy-server
   '';
 
+  passthru.tests = {
+    cliVersion = testers.testVersion {
+      inherit version;
+      package = toxiproxy;
+      command = "${toxiproxy}/bin/toxiproxy-cli -version";
+    };
+    serverVersion = testers.testVersion {
+      inherit version;
+      package = toxiproxy;
+      command = "${toxiproxy}/bin/toxiproxy-server -version";
+    };
+  };
+
   meta = {
+    changelog = "https://github.com/Shopify/toxiproxy/releases/tag/v${version}";
     description = "Proxy for for simulating network conditions";
     homepage = "https://github.com/Shopify/toxiproxy";
     maintainers = with lib.maintainers; [ avnik ];
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 2c7da6ad3569..0d7f9f2c38f6 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGo122Module rec {
   pname = "flyctl";
-  version = "0.2.6";
+  version = "0.2.17";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-A0mlfTeAAeMvmzIvWGALmvMGtGOgVU3X9kvSyrvtK54=";
+    hash = "sha256-XE1kZdR9ZbWMqp0neouZBvNtIJbOdzp/aMe+uA85zL8=";
   };
 
-  vendorHash = "sha256-9l9zft37cGqVp6SBCc4bQcyNLpzSrLDbC++0ywkpDYU=";
+  vendorHash = "sha256-ZX7hcxQJdSLwY37DnV3vKcBW+K9F5RMPUeMtWzm48Dc=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/os-specific/darwin/sketchybar/default.nix b/pkgs/os-specific/darwin/sketchybar/default.nix
index 4ac6ef9c13c9..3081e40622c5 100644
--- a/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sketchybar";
-  version = "2.20.1";
+  version = "2.21.0";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dyo4J3Qszq7SSXdAXmgm7xFhWE5Eqtr7yZpNGmtuphY=";
+    hash = "sha256-hTfQQjx6ai83zYFfccsz/KaoZUIj5Dfz4ENe59gS02E=";
   };
 
   buildInputs = [
diff --git a/pkgs/servers/home-automation/evcc/default.nix b/pkgs/servers/home-automation/evcc/default.nix
index ec529a683341..aa701e92b1ed 100644
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@@ -21,13 +21,13 @@ in
 
 buildGoModule rec {
   pname = "evcc";
-  version = "0.124.9";
+  version = "0.124.10";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     rev = version;
-    hash = "sha256-I5dotao26D2fn1opQunUOFtJ/vS19lGumN6A21jkBjA=";
+    hash = "sha256-NbM8Uev2qIIS6WriP7QnVUumF29rZSOCavouPkPmYpE=";
   };
 
   vendorHash = "sha256-PZWMqv3R4Dq4cLtGNuvHCQ/GiYvlKJfSKEmBn0JYnb8=";
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index 45dadae35567..051f1c18e64e 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lighttpd";
-  version = "1.4.74";
+  version = "1.4.75";
 
   src = fetchurl {
     url = "https://download.lighttpd.net/lighttpd/releases-${lib.versions.majorMinor version}.x/${pname}-${version}.tar.xz";
-    sha256 = "sha256-XAhzboMIj34Bl5cVnzBuiOxymr6XbcmPs77XG50+U7U=";
+    sha256 = "sha256-i3IcqTnTEq+qbvMdy9avtRYe04Wsgo5vzNTFt2vhidY=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/monitoring/prometheus/smokeping-prober.nix b/pkgs/servers/monitoring/prometheus/smokeping-prober.nix
index 0f4e21defc04..fe514b3558f0 100644
--- a/pkgs/servers/monitoring/prometheus/smokeping-prober.nix
+++ b/pkgs/servers/monitoring/prometheus/smokeping-prober.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "smokeping_prober";
-  version = "0.7.2";
+  version = "0.7.3";
 
   ldflags = let
     setVars = rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
     owner = "SuperQ";
     repo = "smokeping_prober";
     rev = "v${version}";
-    sha256 = "sha256-Z+K3cRMD885V9aJwu3N/vP6aqtzD3LfMrxJ8DSCa5Xo=";
+    sha256 = "sha256-MP8AJ8XnIp/+9s7qeAGRHv2OtLL5zrjEhuzZ36V/GrY=";
   };
   vendorHash = "sha256-39/0reEt4Rfe7DfysS4BROUgBUg+x95z6DU3IjC6m5U=";
 
diff --git a/pkgs/servers/sslh/default.nix b/pkgs/servers/sslh/default.nix
index 7c3cc4635e25..ba02f33cee62 100644
--- a/pkgs/servers/sslh/default.nix
+++ b/pkgs/servers/sslh/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sslh";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "yrutschle";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KXjoYtiGaOrdWRbI0umNfxbtS7p+YaW352lC/5f+AM4=";
+    hash = "sha256-fIKiUrpHn2VcUFH6WblZDDpa+AenC2qtgrQ6uUUIyoQ=";
   };
 
   postPatch = "patchShebangs *.sh";
diff --git a/pkgs/servers/web-apps/changedetection-io/default.nix b/pkgs/servers/web-apps/changedetection-io/default.nix
index b9156d2e5b7d..4d058e916ab7 100644
--- a/pkgs/servers/web-apps/changedetection-io/default.nix
+++ b/pkgs/servers/web-apps/changedetection-io/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "changedetection-io";
-  version = "0.45.14";
+  version = "0.45.16";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dgtlmoon";
     repo = "changedetection.io";
     rev = version;
-    hash = "sha256-O+kWivVc/FZmIDjOE/fsUccrOyHrQ8GakjulEnm4w88=";
+    hash = "sha256-ln522U3XqZfhvLvMEzrqXV3SjhpgnrRk2MxQQRBL5VU=";
   };
 
   postPatch = ''
@@ -37,6 +37,7 @@ python3.pkgs.buildPythonApplication rec {
     feedgen
     flask
     flask-compress
+    flask-cors
     flask-expects-json
     flask-login
     flask-paginate
@@ -52,6 +53,8 @@ python3.pkgs.buildPythonApplication rec {
     paho-mqtt
     pillow
     playwright
+    pyee
+    pyppeteer
     pytz
     requests
     selenium
diff --git a/pkgs/shells/nushell/nu_scripts/default.nix b/pkgs/shells/nushell/nu_scripts/default.nix
index 69f5f3045ad4..3121db987de4 100644
--- a/pkgs/shells/nushell/nu_scripts/default.nix
+++ b/pkgs/shells/nushell/nu_scripts/default.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nu_scripts";
-  version = "unstable-2024-03-09";
+  version = "unstable-2024-03-12";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = pname;
-    rev = "5e51b23b1f25eef426da5548964e14fef4b4a485";
-    hash = "sha256-sAqTGy7pXDCgJ9UImJPYwUfbYgRjNjZdHHSyH/+QRNs=";
+    rev = "c2ef662e48223938b1ae35b95d2f28cd5b531fba";
+    hash = "sha256-EMpBJhPtuUMZ4FQTf/uJhZOz1DzHW56utLes3RdwK/0=";
   };
 
   installPhase = ''
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 2ec6a6c07c3e..ed96ef408a3f 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -6,7 +6,7 @@
 
 let
   # N.B. Keep in sync with default arg for stdenv/generic.
-  defaultMkDerivationFromStdenv = import ./generic/make-derivation.nix { inherit lib config; };
+  defaultMkDerivationFromStdenv = stdenv: (import ./generic/make-derivation.nix { inherit lib config; } stdenv).mkDerivation;
 
   # Low level function to help with overriding `mkDerivationFromStdenv`. One
   # gives it the old stdenv arguments and a "continuation" function, and
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index e764571869db..2cda43d5632f 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -52,7 +52,7 @@ argsStdenv@{ name ? "stdenv", preHook ? "", initialPath
 
 , # The implementation of `mkDerivation`, parameterized with the final stdenv so we can tie the knot.
   # This is convient to have as a parameter so the stdenv "adapters" work better
-  mkDerivationFromStdenv ? import ./make-derivation.nix { inherit lib config; }
+  mkDerivationFromStdenv ? stdenv: (import ./make-derivation.nix { inherit lib config; } stdenv).mkDerivation
 }:
 
 let
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 6a53d519045c..c40eaee5e4d6 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -9,7 +9,6 @@ let
     assertMsg
     attrNames
     boolToString
-    chooseDevOutputs
     concatLists
     concatMap
     concatMapStrings
@@ -19,7 +18,7 @@ let
     extendDerivation
     filter
     findFirst
-    flip
+    getDev
     head
     imap1
     isAttrs
@@ -40,6 +39,15 @@ let
     unique
   ;
 
+  inherit (import ../../build-support/lib/cmake.nix { inherit lib stdenv; }) makeCMakeFlags;
+  inherit (import ../../build-support/lib/meson.nix { inherit lib stdenv; }) makeMesonFlags;
+
+  mkDerivation =
+    fnOrAttrs:
+      if builtins.isFunction fnOrAttrs
+      then makeDerivationExtensible fnOrAttrs
+      else makeDerivationExtensibleConst fnOrAttrs;
+
   checkMeta = import ./check-meta.nix {
     inherit lib config;
     # Nix itself uses the `system` field of a derivation to decide where
@@ -102,11 +110,42 @@ let
           makeDerivationExtensible (self: attrs // (if builtins.isFunction f0 || f0?__functor then f self attrs else f0)))
       attrs;
 
-  mkDerivationSimple = overrideAttrs:
+  knownHardeningFlags = [
+    "bindnow"
+    "format"
+    "fortify"
+    "fortify3"
+    "pic"
+    "pie"
+    "relro"
+    "stackprotector"
+    "strictoverflow"
+    "trivialautovarinit"
+    "zerocallusedregs"
+  ];
+
+  removedOrReplacedAttrNames = [
+    "checkInputs" "installCheckInputs"
+    "nativeCheckInputs" "nativeInstallCheckInputs"
+    "__contentAddressed"
+    "__darwinAllowLocalNetworking"
+    "__impureHostDeps" "__propagatedImpureHostDeps"
+    "sandboxProfile" "propagatedSandboxProfile"
+  ];
+
+  # Turn a derivation into its outPath without a string context attached.
+  # See the comment at the usage site.
+  unsafeDerivationToUntrackedOutpath = drv:
+    if isDerivation drv
+    then builtins.unsafeDiscardStringContext drv.outPath
+    else drv;
+
+  makeDerivationArgument =
 
 
-# `mkDerivation` wraps the builtin `derivation` function to
-# produce derivations that use this stdenv and its shell.
+# `makeDerivationArgument` is responsible for the `mkDerivation` arguments that
+# affect the actual derivation, excluding a few behaviors that are not
+# essential, and specific to `mkDerivation`: `env`, `cmakeFlags`, `mesonFlags`.
 #
 # See also:
 #
@@ -146,8 +185,6 @@ let
 
 # Configure Phase
 , configureFlags ? []
-, cmakeFlags ? []
-, mesonFlags ? []
 , # Target is not included by default because most programs don't care.
   # Including it then would cause needless mass rebuilds.
   #
@@ -169,14 +206,6 @@ let
 
 , enableParallelBuilding ? config.enableParallelBuildingByDefault
 
-, meta ? {}
-, passthru ? {}
-, pos ? # position used in error messages and for meta.position
-    (if attrs.meta.description or null != null
-      then builtins.unsafeGetAttrPos "description" attrs.meta
-      else if attrs.version or null != null
-      then builtins.unsafeGetAttrPos "version" attrs
-      else builtins.unsafeGetAttrPos "name" attrs)
 , separateDebugInfo ? false
 , outputs ? [ "out" ]
 , __darwinAllowLocalNetworking ? false
@@ -198,8 +227,6 @@ let
 # but for anything complex, be prepared to debug if enabling.
 , __structuredAttrs ? config.structuredAttrsByDefault or false
 
-, env ? { }
-
 , ... } @ attrs:
 
 # Policy on acceptable hash types in nixpkgs
@@ -222,13 +249,6 @@ let
   separateDebugInfo' = separateDebugInfo && stdenv.hostPlatform.isLinux;
   outputs' = outputs ++ optional separateDebugInfo' "debug";
 
-  # Turn a derivation into its outPath without a string context attached.
-  # See the comment at the usage site.
-  unsafeDerivationToUntrackedOutpath = drv:
-    if isDerivation drv
-    then builtins.unsafeDiscardStringContext drv.outPath
-    else drv;
-
   noNonNativeDeps = builtins.length (depsBuildTarget ++ depsBuildTargetPropagated
                                   ++ depsHostHost ++ depsHostHostPropagated
                                   ++ buildInputs ++ propagatedBuildInputs
@@ -239,19 +259,6 @@ let
     # disabling fortify implies fortify3 should also be disabled
     then unique (hardeningDisable ++ [ "fortify3" ])
     else hardeningDisable;
-  knownHardeningFlags = [
-    "bindnow"
-    "format"
-    "fortify"
-    "fortify3"
-    "pic"
-    "pie"
-    "relro"
-    "stackprotector"
-    "strictoverflow"
-    "trivialautovarinit"
-    "zerocallusedregs"
-  ];
   defaultHardeningFlags =
     (if stdenv.hasCC then stdenv.cc else {}).defaultHardeningFlags or
       # fallback safe-ish set of flags
@@ -264,10 +271,13 @@ let
   erroneousHardeningFlags = subtractLists knownHardeningFlags (hardeningEnable ++ remove "all" hardeningDisable);
 
   checkDependencyList = checkDependencyList' [];
-  checkDependencyList' = positions: name: deps: flip imap1 deps (index: dep:
-    if isDerivation dep || dep == null || builtins.isString dep || builtins.isPath dep then dep
-    else if isList dep then checkDependencyList' ([index] ++ positions) name dep
-    else throw "Dependency is not of a valid type: ${concatMapStrings (ix: "element ${toString ix} of ") ([index] ++ positions)}${name} for ${attrs.name or attrs.pname}");
+  checkDependencyList' = positions: name: deps:
+    imap1
+      (index: dep:
+        if isDerivation dep || dep == null || builtins.isString dep || builtins.isPath dep then dep
+        else if isList dep then checkDependencyList' ([index] ++ positions) name dep
+        else throw "Dependency is not of a valid type: ${concatMapStrings (ix: "element ${toString ix} of ") ([index] ++ positions)}${name} for ${attrs.name or attrs.pname}")
+      deps;
 in if builtins.length erroneousHardeningFlags != 0
 then abort ("mkDerivation was called with unsupported hardening flags: " + lib.generators.toPretty {} {
   inherit erroneousHardeningFlags hardeningDisable hardeningEnable knownHardeningFlags;
@@ -286,70 +296,37 @@ else let
 
   outputs = outputs';
 
-  references = nativeBuildInputs ++ buildInputs
-            ++ propagatedNativeBuildInputs ++ propagatedBuildInputs;
-
-  dependencies = map (map chooseDevOutputs) [
+  dependencies = [
     [
-      (map (drv: drv.__spliced.buildBuild or drv) (checkDependencyList "depsBuildBuild" depsBuildBuild))
-      (map (drv: drv.__spliced.buildHost or drv) (checkDependencyList "nativeBuildInputs" nativeBuildInputs'))
-      (map (drv: drv.__spliced.buildTarget or drv) (checkDependencyList "depsBuildTarget" depsBuildTarget))
+      (map (drv: getDev drv.__spliced.buildBuild or drv) (checkDependencyList "depsBuildBuild" depsBuildBuild))
+      (map (drv: getDev drv.__spliced.buildHost or drv) (checkDependencyList "nativeBuildInputs" nativeBuildInputs'))
+      (map (drv: getDev drv.__spliced.buildTarget or drv) (checkDependencyList "depsBuildTarget" depsBuildTarget))
     ]
     [
-      (map (drv: drv.__spliced.hostHost or drv) (checkDependencyList "depsHostHost" depsHostHost))
-      (map (drv: drv.__spliced.hostTarget or drv) (checkDependencyList "buildInputs" buildInputs'))
+      (map (drv: getDev drv.__spliced.hostHost or drv) (checkDependencyList "depsHostHost" depsHostHost))
+      (map (drv: getDev drv.__spliced.hostTarget or drv) (checkDependencyList "buildInputs" buildInputs'))
     ]
     [
-      (map (drv: drv.__spliced.targetTarget or drv) (checkDependencyList "depsTargetTarget" depsTargetTarget))
+      (map (drv: getDev drv.__spliced.targetTarget or drv) (checkDependencyList "depsTargetTarget" depsTargetTarget))
     ]
   ];
-  propagatedDependencies = map (map chooseDevOutputs) [
+  propagatedDependencies = [
     [
-      (map (drv: drv.__spliced.buildBuild or drv) (checkDependencyList "depsBuildBuildPropagated" depsBuildBuildPropagated))
-      (map (drv: drv.__spliced.buildHost or drv) (checkDependencyList "propagatedNativeBuildInputs" propagatedNativeBuildInputs))
-      (map (drv: drv.__spliced.buildTarget or drv) (checkDependencyList "depsBuildTargetPropagated" depsBuildTargetPropagated))
+      (map (drv: getDev drv.__spliced.buildBuild or drv) (checkDependencyList "depsBuildBuildPropagated" depsBuildBuildPropagated))
+      (map (drv: getDev drv.__spliced.buildHost or drv) (checkDependencyList "propagatedNativeBuildInputs" propagatedNativeBuildInputs))
+      (map (drv: getDev drv.__spliced.buildTarget or drv) (checkDependencyList "depsBuildTargetPropagated" depsBuildTargetPropagated))
     ]
     [
-      (map (drv: drv.__spliced.hostHost or drv) (checkDependencyList "depsHostHostPropagated" depsHostHostPropagated))
-      (map (drv: drv.__spliced.hostTarget or drv) (checkDependencyList "propagatedBuildInputs" propagatedBuildInputs))
+      (map (drv: getDev drv.__spliced.hostHost or drv) (checkDependencyList "depsHostHostPropagated" depsHostHostPropagated))
+      (map (drv: getDev drv.__spliced.hostTarget or drv) (checkDependencyList "propagatedBuildInputs" propagatedBuildInputs))
     ]
     [
-      (map (drv: drv.__spliced.targetTarget or drv) (checkDependencyList "depsTargetTargetPropagated" depsTargetTargetPropagated))
+      (map (drv: getDev drv.__spliced.targetTarget or drv) (checkDependencyList "depsTargetTargetPropagated" depsTargetTargetPropagated))
     ]
   ];
 
-  computedSandboxProfile =
-    concatMap (input: input.__propagatedSandboxProfile or [])
-      (stdenv.extraNativeBuildInputs
-       ++ stdenv.extraBuildInputs
-       ++ concatLists dependencies);
-
-  computedPropagatedSandboxProfile =
-    concatMap (input: input.__propagatedSandboxProfile or [])
-      (concatLists propagatedDependencies);
-
-  computedImpureHostDeps =
-    unique (concatMap (input: input.__propagatedImpureHostDeps or [])
-      (stdenv.extraNativeBuildInputs
-       ++ stdenv.extraBuildInputs
-       ++ concatLists dependencies));
-
-  computedPropagatedImpureHostDeps =
-    unique (concatMap (input: input.__propagatedImpureHostDeps or [])
-      (concatLists propagatedDependencies));
-
-  envIsExportable = isAttrs env && !isDerivation env;
-
   derivationArg =
-    (removeAttrs attrs
-      (["meta" "passthru" "pos"
-       "checkInputs" "installCheckInputs"
-       "nativeCheckInputs" "nativeInstallCheckInputs"
-       "__contentAddressed"
-       "__darwinAllowLocalNetworking"
-       "__impureHostDeps" "__propagatedImpureHostDeps"
-       "sandboxProfile" "propagatedSandboxProfile"]
-       ++ optional (__structuredAttrs || envIsExportable) "env"))
+    removeAttrs attrs removedOrReplacedAttrNames
     // (optionalAttrs (attrs ? name || (attrs ? pname && attrs ? version)) {
       name =
         let
@@ -377,7 +354,7 @@ else let
             assert assertMsg (attrs ? version && attrs.version != null) "The ‘version’ attribute cannot be null.";
             "${attrs.pname}${staticMarker}${hostSuffix}-${attrs.version}"
         );
-    }) // optionalAttrs __structuredAttrs { env = checkedEnv; } // {
+    }) // {
       builder = attrs.realBuilder or stdenv.shell;
       args = attrs.args or ["-e" (attrs.builder or ./default-builder.sh)];
       inherit stdenv;
@@ -415,54 +392,6 @@ else let
         ++ optional (elem "host"   configurePlatforms) "--host=${stdenv.hostPlatform.config}"
         ++ optional (elem "target" configurePlatforms) "--target=${stdenv.targetPlatform.config}";
 
-      cmakeFlags =
-        cmakeFlags
-        ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) ([
-          "-DCMAKE_SYSTEM_NAME=${findFirst isString "Generic" (optional (!stdenv.hostPlatform.isRedox) stdenv.hostPlatform.uname.system)}"
-        ] ++ optionals (stdenv.hostPlatform.uname.processor != null) [
-          "-DCMAKE_SYSTEM_PROCESSOR=${stdenv.hostPlatform.uname.processor}"
-        ] ++ optionals (stdenv.hostPlatform.uname.release != null) [
-          "-DCMAKE_SYSTEM_VERSION=${stdenv.hostPlatform.uname.release}"
-        ] ++ optionals (stdenv.hostPlatform.isDarwin) [
-          "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
-        ] ++ optionals (stdenv.buildPlatform.uname.system != null) [
-          "-DCMAKE_HOST_SYSTEM_NAME=${stdenv.buildPlatform.uname.system}"
-        ] ++ optionals (stdenv.buildPlatform.uname.processor != null) [
-          "-DCMAKE_HOST_SYSTEM_PROCESSOR=${stdenv.buildPlatform.uname.processor}"
-        ] ++ optionals (stdenv.buildPlatform.uname.release != null) [
-          "-DCMAKE_HOST_SYSTEM_VERSION=${stdenv.buildPlatform.uname.release}"
-        ] ++ optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-          "-DCMAKE_CROSSCOMPILING_EMULATOR=env"
-        ] ++ lib.optionals stdenv.hostPlatform.isStatic [
-          "-DCMAKE_LINK_SEARCH_START_STATIC=ON"
-        ]);
-
-      mesonFlags =
-        let
-          # See https://mesonbuild.com/Reference-tables.html#cpu-families
-          cpuFamily = platform: with platform;
-            /**/ if isAarch32 then "arm"
-            else if isx86_32  then "x86"
-            else platform.uname.processor;
-
-          crossFile = builtins.toFile "cross-file.conf" ''
-            [properties]
-            bindgen_clang_arguments = ['-target', '${stdenv.targetPlatform.config}']
-            needs_exe_wrapper = ${boolToString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform)}
-
-            [host_machine]
-            system = '${stdenv.targetPlatform.parsed.kernel.name}'
-            cpu_family = '${cpuFamily stdenv.targetPlatform}'
-            cpu = '${stdenv.targetPlatform.parsed.cpu.name}'
-            endian = ${if stdenv.targetPlatform.isLittleEndian then "'little'" else "'big'"}
-
-            [binaries]
-            llvm-config = 'llvm-config-native'
-            rust = ['rustc', '--target', '${stdenv.targetPlatform.rust.rustcTargetSpec}']
-          '';
-          crossFlags = optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--cross-file=${crossFile}" ];
-        in crossFlags ++ mesonFlags;
-
       inherit patches;
 
       inherit doCheck doInstallCheck;
@@ -482,7 +411,28 @@ else let
       NIX_HARDENING_ENABLE = enabledHardeningOptions;
     } // optionalAttrs (stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform ? gcc.arch) {
       requiredSystemFeatures = attrs.requiredSystemFeatures or [] ++ [ "gccarch-${stdenv.hostPlatform.gcc.arch}" ];
-    } // optionalAttrs (stdenv.buildPlatform.isDarwin) {
+    } // optionalAttrs (stdenv.buildPlatform.isDarwin) (
+      let
+        computedSandboxProfile =
+          concatMap (input: input.__propagatedSandboxProfile or [])
+            (stdenv.extraNativeBuildInputs
+            ++ stdenv.extraBuildInputs
+            ++ concatLists dependencies);
+
+        computedPropagatedSandboxProfile =
+          concatMap (input: input.__propagatedSandboxProfile or [])
+            (concatLists propagatedDependencies);
+
+        computedImpureHostDeps =
+          unique (concatMap (input: input.__propagatedImpureHostDeps or [])
+            (stdenv.extraNativeBuildInputs
+            ++ stdenv.extraBuildInputs
+            ++ concatLists dependencies));
+
+        computedPropagatedImpureHostDeps =
+          unique (concatMap (input: input.__propagatedImpureHostDeps or [])
+            (concatLists propagatedDependencies));
+    in {
       inherit __darwinAllowLocalNetworking;
       # TODO: remove `unique` once nix has a list canonicalization primitive
       __sandboxProfile =
@@ -497,7 +447,7 @@ else let
         "/bin/sh"
       ];
       __propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;
-    } //
+    }) //
     # If we use derivations directly here, they end up as build-time dependencies.
     # This is especially problematic in the case of disallowed*, since the disallowed
     # derivations will be built by nix as build-time dependencies, while those
@@ -533,7 +483,82 @@ else let
         mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedRequisites;
     };
 
-  meta = checkMeta.commonMeta { inherit validity attrs pos references; };
+in
+  derivationArg;
+
+mkDerivationSimple = overrideAttrs:
+
+# `mkDerivation` wraps the builtin `derivation` function to
+# produce derivations that use this stdenv and its shell.
+#
+# Internally, it delegates most of its behavior to `makeDerivationArgument`,
+# except for the `env`, `cmakeFlags`, and `mesonFlags` attributes, as well
+# as the attributes `meta` and `passthru` that affect [package attributes],
+# and not the derivation itself.
+#
+# See also:
+#
+# * https://nixos.org/nixpkgs/manual/#sec-using-stdenv
+#   Details on how to use this mkDerivation function
+#
+# * https://nixos.org/manual/nix/stable/expressions/derivations.html#derivations
+#   Explanation about derivations in general
+#
+# * [package attributes]: https://nixos.org/manual/nix/stable/glossary#package-attribute-set
+{
+
+# Configure Phase
+  cmakeFlags ? []
+, mesonFlags ? []
+
+, meta ? {}
+, passthru ? {}
+, pos ? # position used in error messages and for meta.position
+    (if attrs.meta.description or null != null
+      then builtins.unsafeGetAttrPos "description" attrs.meta
+      else if attrs.version or null != null
+      then builtins.unsafeGetAttrPos "version" attrs
+      else builtins.unsafeGetAttrPos "name" attrs)
+
+# Experimental.  For simple packages mostly just works,
+# but for anything complex, be prepared to debug if enabling.
+, __structuredAttrs ? config.structuredAttrsByDefault or false
+
+, env ? { }
+
+, ... } @ attrs:
+
+# Policy on acceptable hash types in nixpkgs
+assert attrs ? outputHash -> (
+  let algo =
+    attrs.outputHashAlgo or (head (splitString "-" attrs.outputHash));
+  in
+  if algo == "md5" then
+    throw "Rejected insecure ${algo} hash '${attrs.outputHash}'"
+  else
+    true
+);
+
+let
+  envIsExportable = isAttrs env && !isDerivation env;
+
+  derivationArg = makeDerivationArgument
+    (removeAttrs
+      attrs
+        (["meta" "passthru" "pos"]
+        ++ optional (__structuredAttrs || envIsExportable) "env"
+        )
+    // optionalAttrs __structuredAttrs { env = checkedEnv; }
+    // {
+      cmakeFlags = makeCMakeFlags attrs;
+      mesonFlags = makeMesonFlags attrs;
+    });
+
+  meta = checkMeta.commonMeta {
+    inherit validity attrs pos;
+    references = attrs.nativeBuildInputs ++ attrs.buildInputs
+              ++ attrs.propagatedNativeBuildInputs ++ attrs.propagatedBuildInputs;
+  };
   validity = checkMeta.assertValidity { inherit meta attrs; };
 
   checkedEnv =
@@ -603,7 +628,6 @@ extendDerivation
   (derivation (derivationArg // optionalAttrs envIsExportable checkedEnv));
 
 in
-  fnOrAttrs:
-    if builtins.isFunction fnOrAttrs
-    then makeDerivationExtensible fnOrAttrs
-    else makeDerivationExtensibleConst fnOrAttrs
+{
+  inherit mkDerivation;
+}
diff --git a/pkgs/tools/misc/etcher/default.nix b/pkgs/tools/misc/etcher/default.nix
deleted file mode 100644
index 4b27f35cf53c..000000000000
--- a/pkgs/tools/misc/etcher/default.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, bash
-, util-linux
-, autoPatchelfHook
-, dpkg
-, makeWrapper
-, udev
-, electron
-}:
-
-stdenv.mkDerivation rec {
-  pname = "etcher";
-  version = "1.18.12";
-
-  src = fetchurl {
-    url = "https://github.com/balena-io/etcher/releases/download/v${version}/balena-etcher_${version}_amd64.deb";
-    hash = "sha256-Ucs187xTpbRJ7P32hCl8cHPxO3HCs44ZneAas043FXk=";
-  };
-
-  # sudo-prompt has hardcoded binary paths on Linux and we patch them here
-  # along with some other paths
-  postPatch = ''
-    substituteInPlace opt/balenaEtcher/resources/app/generated/gui.js \
-      --replace '/usr/bin/pkexec' '/usr/bin/pkexec", "/run/wrappers/bin/pkexec' \
-      --replace '/bin/bash' '${bash}/bin/bash' \
-      --replace '"lsblk"' '"${util-linux}/bin/lsblk"'
-  '';
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
-    makeWrapper
-  ];
-
-  buildInputs = [
-    stdenv.cc.cc.lib
-    udev
-  ];
-
-  dontConfigure = true;
-
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $out/share/${pname}
-
-    cp -a usr/share/* $out/share
-    cp -a opt/balenaEtcher/{locales,resources} $out/share/${pname}
-
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app
-
-    substituteInPlace $out/share/applications/balena-etcher.desktop \
-      --replace /opt/balenaEtcher/balena-etcher ${pname}
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "Flash OS images to SD cards and USB drives, safely and easily";
-    homepage = "https://etcher.io/";
-    license = licenses.asl20;
-    mainProgram = "etcher";
-    maintainers = with maintainers; [ wegank ];
-    platforms = [ "x86_64-linux" ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-  };
-}
diff --git a/pkgs/tools/misc/tagref/default.nix b/pkgs/tools/misc/tagref/default.nix
index 0b8ebf82730d..b54545f83685 100644
--- a/pkgs/tools/misc/tagref/default.nix
+++ b/pkgs/tools/misc/tagref/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tagref";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "stepchowfun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4F9u1wzeBgYP3L6h08xMvgq62ix/SOaFaLl7uEf1j1c=";
+    sha256 = "sha256-ANQxW5Qznu2JbiazFElB1sxpX4BwPgk6SVGgYpJ6DUw=";
   };
 
-  cargoHash = "sha256-AO6BGevCoLCH4vpyrXrgF3FrjUa3lHA7ynXfk4KKigM=";
+  cargoHash = "sha256-vdmr5n4M+Qe/jzjNdg+sy7q2osTivxmLG+xMTMkEFm4=";
 
   meta = with lib; {
     description = "Manage cross-references in your code";
diff --git a/pkgs/tools/networking/ipinfo/default.nix b/pkgs/tools/networking/ipinfo/default.nix
index e9db76d73f56..500b40120fc5 100644
--- a/pkgs/tools/networking/ipinfo/default.nix
+++ b/pkgs/tools/networking/ipinfo/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ipinfo";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "cli";
     rev = "refs/tags/${pname}-${version}";
-    hash = "sha256-B0Qb6RFBAUBpE1o8GqKQtxpndeHermMlwlWlfIa7rmM=";
+    hash = "sha256-sdQdCP2NotrdeqYrSd9c6sExFeuX54I4fxJfEyULPuk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/networking/mqttmultimeter/default.nix b/pkgs/tools/networking/mqttmultimeter/default.nix
index 1edb48a62cbb..e2d6f4e6fbd3 100644
--- a/pkgs/tools/networking/mqttmultimeter/default.nix
+++ b/pkgs/tools/networking/mqttmultimeter/default.nix
@@ -1,8 +1,7 @@
 { lib
 , stdenv
 , dotnetCorePackages
-, dotnet-runtime_6
-, dotnet-runtime_7
+, dotnet-runtime_8
 , buildDotnetModule
 , fetchFromGitHub
 , autoPatchelfHook
@@ -16,37 +15,23 @@
 # NOTES:
 # 1. we need autoPatchelfHook for quite a number of things in $out/lib
 
-let
-  version = "1.7.0.211";
-
-  sdk =
-    if lib.versionAtLeast (lib.versions.majorMinor version) "1.7"
-    then dotnetCorePackages.sdk_7_0
-    else dotnetCorePackages.sdk_6_0;
-
-  runtime =
-    if lib.versionAtLeast (lib.versions.majorMinor version) "1.7"
-    then dotnet-runtime_7
-    else dotnet-runtime_6;
-
-in
 buildDotnetModule rec {
   pname = "mqttmultimeter";
-  inherit version;
+  version = "1.8.2.272";
 
   src = fetchFromGitHub {
     owner = "chkr1011";
     repo = "mqttMultimeter";
     rev = "v" + version;
-    hash = "sha256-/XQ5HD0dBfFn3ERlLwHknS9Fyd3YMpKHBXuvMwRXcQ8=";
+    hash = "sha256-vL9lmIhNLwuk1tmXLKV75xAhktpdNOb0Q4ZdvLur5hw=";
   };
 
   sourceRoot = "${src.name}/Source";
 
   projectFile = [ "mqttMultimeter.sln" ];
   nugetDeps = ./deps.nix;
-  dotnet-sdk = sdk;
-  dotnet-runtime = runtime;
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-runtime = dotnet-runtime_8;
   executables = [ "mqttMultimeter" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/mqttmultimeter/deps.nix b/pkgs/tools/networking/mqttmultimeter/deps.nix
index 13ddfb334b60..c43ceb31c3c0 100644
--- a/pkgs/tools/networking/mqttmultimeter/deps.nix
+++ b/pkgs/tools/networking/mqttmultimeter/deps.nix
@@ -2,55 +2,50 @@
 # Please dont edit it manually, your changes might get overwritten!
 
 { fetchNuGet }: [
-  (fetchNuGet { pname = "Avalonia"; version = "0.10.19"; sha256 = "1yzrbp0b6kv9h9d4kl96ldr6ln40xj1j2yvbvpm0pgv7ajwr7qhc"; })
-  (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2020091801"; sha256 = "04jm83cz7vkhhr6n2c9hya2k8i2462xbf6np4bidk55as0jdq43a"; })
-  (fetchNuGet { pname = "Avalonia.AvaloniaEdit"; version = "0.10.12.2"; sha256 = "1sn8k71xcfnjxgxfqzdrv1hy7h7pvdk820nyzkmrf02gi77mx7nw"; })
-  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "0.10.19"; sha256 = "0wlmr4dlz8x3madm7xwhmsf0kgdnwcy6n7zvfd9x6h0bllii1lbn"; })
-  (fetchNuGet { pname = "Avalonia.Desktop"; version = "0.10.19"; sha256 = "0vghwp1wx6l1z0dlvd9aqdaikz6k34q0i9yzaphqlzjp6ms2g2ny"; })
-  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "0.10.19"; sha256 = "1zlcp8mwn2nscrdsvxlspny22m054gsva9az27pvk7s2s5mrqgfk"; })
-  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "0.10.19"; sha256 = "01fin1w9nwa3c9kpvbri26x1r4g59hmayx9r5hxwbhq7s7vm5ghr"; })
-  (fetchNuGet { pname = "Avalonia.Native"; version = "0.10.19"; sha256 = "0c9rw2wckyx9h5yfhm0af5zbs53n9bnhv0mlshl7mn0p92v1wfl3"; })
-  (fetchNuGet { pname = "Avalonia.ReactiveUI"; version = "0.10.19"; sha256 = "0kx4qka2rdmlp54qyn04hh79qc5w796gv3ryv24n82hpplzksqi9"; })
-  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "0.10.19"; sha256 = "0klk9hqas0h3d3lmr0di175nw2kwq5br1xpprkb4y4m83r5lfy0s"; })
-  (fetchNuGet { pname = "Avalonia.Skia"; version = "0.10.19"; sha256 = "16cl9ssmyif2a25fq9kvxs2vr83j589yns53zkfr3wmggl9n6lf2"; })
-  (fetchNuGet { pname = "Avalonia.Win32"; version = "0.10.19"; sha256 = "1pd3jmrdc738j7b4d8rzaj7fxrfq1m2pl3i62z2ym3h0sxl51xy2"; })
-  (fetchNuGet { pname = "Avalonia.X11"; version = "0.10.19"; sha256 = "1h71w73r7r9ci059qwsjqnhp60l8sfd3i3xsw37qfnbhslcna6hh"; })
-  (fetchNuGet { pname = "AvaloniaEdit.TextMate"; version = "0.10.12.2"; sha256 = "0d7i2vrv2lzyjb1xna4dxscl256g062c6b96ayh9aksnrygxxsx9"; })
-  (fetchNuGet { pname = "AvaloniaEdit.TextMate.Grammars"; version = "0.10.12.1"; sha256 = "0s3g1k0sqma5i6lq5qva2zkgghhba8s5iz4s6jy7dh984x6pp38b"; })
-  (fetchNuGet { pname = "DynamicData"; version = "7.1.1"; sha256 = "14xcqkw87zbjljy1pb727kwq5a4dfmsf5vg99fq0xxb71q828nvh"; })
-  (fetchNuGet { pname = "HarfBuzzSharp"; version = "2.8.2.1-preview.108"; sha256 = "0xs4px4fy5b6glc77rqswzpi5ddhxvbar1md6q9wla7hckabnq0z"; })
-  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Linux"; version = "2.8.2.1-preview.108"; sha256 = "16wvgvyra2g1b38rxxgkk85wbz89hspixs54zfcm4racgmj1mrj4"; })
-  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.macOS"; version = "2.8.2.1-preview.108"; sha256 = "16v7lrwwif2f5zfkx08n6y6w3m56mh4hy757biv0w9yffaf200js"; })
-  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.WebAssembly"; version = "2.8.2.1-preview.108"; sha256 = "15kqb353snwpavz3jja63mq8xjqsrw1f902scm8wxmsqrm5q6x55"; })
-  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Win32"; version = "2.8.2.1-preview.108"; sha256 = "0n6ymn9jqms3mk5hg0ar4y9jmh96myl6q0jimn7ahb1a8viq55k1"; })
-  (fetchNuGet { pname = "JetBrains.Annotations"; version = "10.3.0"; sha256 = "1grdx28ga9fp4hwwpwv354rizm8anfq4lp045q4ss41gvhggr3z8"; })
-  (fetchNuGet { pname = "MessagePack"; version = "2.5.108"; sha256 = "0cnaz28lhrdmavnxjkakl9q8p2yv8mricvp1b0wxdfnz8v41gwzs"; })
-  (fetchNuGet { pname = "MessagePack.Annotations"; version = "2.5.108"; sha256 = "0nb1fx8dwl7304kw0bc375bvlhb7pg351l4cl3vqqd7d8zqjwx5v"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "2.9.6"; sha256 = "18mr1f0wpq0fir8vjnq0a8pz50zpnblr7sabff0yqx37c975934a"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "3.4.0"; sha256 = "12rn6gl4viycwk3pz5hp5df63g66zvba4hnkwr3f0876jj5ivmsw"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "3.4.0"; sha256 = "0rhylcwa95bxawcgixk64knv7p7xrykdjcabmx3gknk8hvj1ai9y"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp.Scripting"; version = "3.4.0"; sha256 = "1h2f0z9xnw987x8bydka1sd42ijqjx973md6v1gvpy1qc6ad244g"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "3.4.0"; sha256 = "195gqnpwqkg2wlvk8x6yzm7byrxfq9bki20xmhf6lzfsdw3z4mf2"; })
+  (fetchNuGet { pname = "Avalonia"; version = "11.0.9"; sha256 = "1km9642p9qbx8i14q94h65m96ywr9d54ilv5h0rdsdfidbpbmfhf"; })
+  (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2023020321"; sha256 = "1az4s1g22ipak9a3xfh55z2h3rm6lpqh7svbpw6ag4ysrgsjjsjd"; })
+  (fetchNuGet { pname = "Avalonia.AvaloniaEdit"; version = "11.0.6"; sha256 = "1vma45sa5falrzmw23jzr3chhi7gllvxgkks379sd48a6p6acv6q"; })
+  (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.29"; sha256 = "05mm7f0jssih3gbzqfgjnfq5cnqa85ihsg0z1897ciihv8qd3waq"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.9"; sha256 = "1ycc7jzlhyvy3ssw8pqb9da8qrv9wxwnffk060w7wbb00m90zjh3"; })
+  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.9"; sha256 = "1q58z54wl9sk4j17innm885fn776j9f381mhsmd0mzw0ybya3dys"; })
+  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.9"; sha256 = "06mcb24grrikjqbgmvrry47hjyz9qcqz6az9lpmjlf9nrsf6h1yc"; })
+  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.9"; sha256 = "19j6z5zq5k4sfgkak6y0nsq3i98jzyz9y87bw5nf1jbpa4ahv2dn"; })
+  (fetchNuGet { pname = "Avalonia.Fonts.Inter"; version = "11.0.9"; sha256 = "1w56gyn5pbvv1j9mm5n9ga8zlfq515nzc6hdqfnsrgaxh6xxkxyb"; })
+  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.9"; sha256 = "0ws8gk8rc1h9axn55zm222axal3pbyjmsqvpgihzwfdjafk3qy2w"; })
+  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.9"; sha256 = "0hn6b2b16kiyzjmas9gx874bhn4x3ab114k2ixw32wcl3m61w749"; })
+  (fetchNuGet { pname = "Avalonia.ReactiveUI"; version = "11.0.9"; sha256 = "1j6q7djp1jl2j2k6qvfik7gjqjljbkwj1y65zgh93v002xirfmja"; })
+  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.9"; sha256 = "0vxjbrsn2r1jgm12avln2xnlqs0ya593yh341g7qrq9awmaik93h"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.9"; sha256 = "07sjawy0zpmsx0d26kfz7zw2a23z254sdd6psscypidl92cxhy3d"; })
+  (fetchNuGet { pname = "Avalonia.Themes.Fluent"; version = "11.0.9"; sha256 = "1ddsyh3bf99swsmb6m7cz1ilvlfqzqs8c1cfscpd9v8cabpgip8g"; })
+  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.9"; sha256 = "0q6kxvnrkzpcmby235h372axcy0wv3j9zlq64k1bhg92sh3za9w6"; })
+  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.9"; sha256 = "143rvsz6hw7fq5fvxflg0w8545gc20kcijd0qc3qilf0hcirn26q"; })
+  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.9"; sha256 = "0yrhmjrxdjymw70dqxpaivq9vvj4lvd16bxc8wm8w3nkw82my8f7"; })
+  (fetchNuGet { pname = "AvaloniaEdit.TextMate"; version = "11.0.6"; sha256 = "075qh14h3v89f6vzgjq63p8zvnazfd12p5pzv0zs1l9dm0zmc2pd"; })
+  (fetchNuGet { pname = "DynamicData"; version = "7.9.5"; sha256 = "1m9qx8g6na5ka6kd9vhg8gjmxrnkzb6v5cl5yqp1kdjsw4rcwy6x"; })
+  (fetchNuGet { pname = "HarfBuzzSharp"; version = "7.3.0"; sha256 = "1rqcmdyzxz9kc0k8594hbpksjc23mkakmjybi4b8702qycxx0lrf"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Linux"; version = "7.3.0"; sha256 = "0i9gaiyjgmcpnfn1fixbxq8shqlh4ahng7j4dxlf38zlln1f6h80"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.macOS"; version = "7.3.0"; sha256 = "1b5ng37bwk75cifw7p1hzn8z6sswi8h7h510qgwlbvgmlrs5r0ga"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.WebAssembly"; version = "7.3.0"; sha256 = "0dcmclnyryb82wzsky1dn0gbjsvx84mfx46v984f5fmg4v238lpm"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Win32"; version = "7.3.0"; sha256 = "1hyvmz7rfbrxbcpnwyvb64gdk1hifcpz3rln58yyb7g1pnbpnw2s"; })
+  (fetchNuGet { pname = "MessagePack"; version = "2.5.129"; sha256 = "08bpg5v467zyx5ni8pj9x2nkqx3r2vbfdh7v72laii0707163fb2"; })
+  (fetchNuGet { pname = "MessagePack.Annotations"; version = "2.5.129"; sha256 = "1q0pprliqr8wrn09k8sa2p9l28q30rk6sl47vlazgwc678f96vg7"; })
+  (fetchNuGet { pname = "MicroCom.Runtime"; version = "0.11.0"; sha256 = "0p9c3m0zk59x9dcqw077hzd2yk60myisbacvm36mnwpcjwzjkp2m"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.0.0"; sha256 = "0bbl0jpqywqmzz2gagld1p2gvdfldjfjmm25hil9wj2nq1zc4di8"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "3.8.0"; sha256 = "12n7rvr39bzkf2maw7zplw8rwpxpxss4ich3bb2pw770rx4nyvyw"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "3.8.0"; sha256 = "1kmry65csvfn72zzc16vj1nfbfwam28wcmlrk3m5rzb8ydbzgylb"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp.Scripting"; version = "3.8.0"; sha256 = "0w0yx0lpg54iw5jazqk46h48gx43ij32gwac8iywdj6kxfxm03vw"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "3.8.0"; sha256 = "0hjgxcsj5zy27lqk0986m59n5dbplx2vjjla2lsvg4bwg8qa7bpk"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.3.0"; sha256 = "0gw297dgkh0al1zxvgvncqs0j15lsna9l1wpqas4rflmys440xvb"; })
   (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "7.0.0"; sha256 = "121zs4jp8iimgbpzm3wsglhjwkc06irg1pxy8c1zcdlsg34cfq1p"; })
   (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "7.0.0"; sha256 = "181d7mp9307fs17lyy42f8cxnjwysddmpsalky4m0pqxcimnr6g7"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "7.0.0"; sha256 = "1bqd3pqn5dacgnkq0grc17cgb2i0w8z1raw12nwm3p3zhrfcvgxf"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "7.0.0"; sha256 = "1gn7d18i1wfy13vrwhmdv1rmsb4vrk26kqdld4cgvh77yigj90xs"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "7.0.0"; sha256 = "0b90zkrsk5dw3wr749rbynhpxlg4bgqdnd7d5vdlw2g9c7zlhgx6"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "7.0.0"; sha256 = "1b4km9fszid9vp2zb3gya5ni9fn8bq62bzaas2ck2r7gs0sdys80"; })
-  (fetchNuGet { pname = "Microsoft.NET.StringTools"; version = "17.4.0"; sha256 = "1smx30nq22plrn2mw4wb5vfgxk6hyx12b60c4wabmpnr81lq3nzv"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
+  (fetchNuGet { pname = "Microsoft.NET.StringTools"; version = "17.6.3"; sha256 = "0g5jdg0jp844a2ygwlm04igsxkrihqcq2rpmfx722nrv3vrk0r0z"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.0.0"; sha256 = "1fk2fk2639i7nzy58m9dvpdnzql4vb8yl8vr19r2fp8lmj9w2jr0"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.1.2"; sha256 = "1507hnpr9my3z4w1r6xk5n0s1j3y6a2c2cnynj76za7cphxi1141"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
-  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "4.5.0"; sha256 = "0fnkv3ky12227zqg4zshx4kw2mvysq2ppxjibfw02cc3iprv4njq"; })
-  (fetchNuGet { pname = "MQTTnet"; version = "4.2.0.706"; sha256 = "0125d2x62izlkplgyg5dazz2x38amkby6i8vlfvvjvng9zq159m3"; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
-  (fetchNuGet { pname = "ReactiveUI"; version = "13.2.10"; sha256 = "0x4pk45wipzsjzkv23as8l0sdds665l9404gaix8c0z2n24s76gg"; })
+  (fetchNuGet { pname = "MQTTnet"; version = "4.3.3.952"; sha256 = "0a6g389vxia2k6lgnhk1x7vgns7da7hlqvj1z0f5av5qfk2377g3"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; })
+  (fetchNuGet { pname = "ReactiveUI"; version = "18.3.1"; sha256 = "1lxkc8yk9glj0w9n5vry2dnwwvh8152ad2c5bivk8aciq64zidyn"; })
   (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
-  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "00j6nv2xgmd3bi347k00m7wr542wjlig53rmj28pmw7ddcn97jbn"; })
   (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
   (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; sha256 = "0l8xz8zn46w4d10bcn3l4yyn4vhb3lrj2zw8llvz7jk14k4zps5x"; })
   (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; sha256 = "02c9h3y35pylc0zfq3wcsvc5nqci95nrkq0mszifc0sjx7xrzkly"; })
@@ -61,7 +56,6 @@
   (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; sha256 = "0bh5bi25nk9w9xi8z23ws45q5yia6k7dg3i4axhfqlnj145l011x"; })
   (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "0c3g3g3jmhlhw4klrc86ka9fjbl7i59ds1fadsb2l8nqf8z3kb19"; })
   (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; sha256 = "0aqqi1v4wx51h51mk956y783wzags13wa7mgqyclacmsmpv02ps3"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "0lqhgqi0i8194ryqq6v2gqx0fb86db2gqknbm0aq31wb378j7ip8"; })
   (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; sha256 = "03mnvkhskbzxddz4hm113zsch1jyzh2cs450dk3rgfjp8crlw1va"; })
   (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
   (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
@@ -76,70 +70,52 @@
   (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "15zrc8fgd8zx28hdghcj5f5i34wf3l6bq5177075m2bc2j34jrqy"; })
   (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1p4dgxax6p7rlgj4q73k73rslcnz4wdcv8q2flg1s8ygwcm58ld5"; })
   (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "1lps7fbnw34bnh3lm31gs5c0g0dh7548wfmb8zz62v0zqz71msj5"; })
-  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; sha256 = "14nbkhvs7sji5r1saj2x8daz82rnf9kx28d3v2qss34qbr32dzix"; })
   (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; sha256 = "1jx02q6kiwlvfksq1q9qr17fj78y5v6mwsszav4qcz9z25d5g6vk"; })
   (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
-  (fetchNuGet { pname = "SkiaSharp"; version = "2.88.1-preview.108"; sha256 = "01sm36hdgmcgkai9m09xn2qfz8v7xhh803n8fng8rlxwnw60rgg6"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Linux"; version = "2.88.1-preview.108"; sha256 = "19jf2jcq2spwbpx3cfdi2a95jf4y8205rh56lmkh8zsxd2k7fjyp"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.macOS"; version = "2.88.1-preview.108"; sha256 = "1vcpqd7slh2b9gsacpd7mk1266r1xfnkm6230k8chl3ng19qlf15"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.WebAssembly"; version = "2.88.1-preview.108"; sha256 = "0a89gqjw8k97arr0kyd0fm3f46k1qamksbnyns9xdlgydjg557dd"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.1-preview.108"; sha256 = "05g9blprq5msw3wshrgsk19y0fvhjlqiybs1vdyhfmww330jlypn"; })
-  (fetchNuGet { pname = "Splat"; version = "10.0.1"; sha256 = "18fzrn7xwjzxj4v3drs8djd3yf14bnq5n9n8vdnwfa1zk5jqpsb9"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
+  (fetchNuGet { pname = "SkiaSharp"; version = "2.88.7"; sha256 = "0f6wbk9dnjiffb9ycjachy1m9zw3pai2m503nym07qgb0izxm792"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Linux"; version = "2.88.7"; sha256 = "0p0z6nxkkmabv46wmxhs3yr0xy24i6jzn54gk0hsm3h1a8vi3m21"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.macOS"; version = "2.88.7"; sha256 = "05xwa1izzvqz4gznvx2x31qnpvl1lc65hm5p9sscjg5afisya0ss"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.WebAssembly"; version = "2.88.7"; sha256 = "1k2hfasgbv01navc55zzwdwzfxcw4186jni35c00zykgwhbwb250"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.7"; sha256 = "119mlbh5hmlis7vb111s95dwg5p1anm2hmv7cm6fz7gy18473d7v"; })
+  (fetchNuGet { pname = "Splat"; version = "14.4.1"; sha256 = "03ycyjn2ii44npi015p4rk344xnjgdzz02cf63cmhx2ab8hv6p4b"; })
   (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
-  (fetchNuGet { pname = "System.Collections.Immutable"; version = "1.5.0"; sha256 = "1d5gjn5afnrf461jlxzawcvihz195gayqpcfbv6dd7pxa9ialn06"; })
-  (fetchNuGet { pname = "System.Collections.Immutable"; version = "1.6.0"; sha256 = "1pbxzdz3pwqyybzv5ff2b7nrc281bhg7hq34w0fn1w3qfgrbwyw2"; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "5.0.0"; sha256 = "1kvcllagxz2q92g81zkz81djkn2lid25ayjfgjalncyc68i15p0r"; })
   (fetchNuGet { pname = "System.ComponentModel.Annotations"; version = "4.5.0"; sha256 = "1jj6f6g87k0iwsgmg3xmnn67a14mq88np0l1ys5zkxhkvbc8976p"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
-  (fetchNuGet { pname = "System.Drawing.Common"; version = "4.5.0"; sha256 = "0knqa0zsm91nfr34br8gx5kjqq4v81zdhqkacvs2hzc8nqk0ddhc"; })
   (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.3.0"; sha256 = "1d951hrvrpndk7insiag80qxjbf2y0y39y8h5hnq9612ws661glk"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
   (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
-  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw"; })
-  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; sha256 = "0j6ndgglcf4brg2lz4wzsh1av1gh8xrzdsn9f0yznskhqn1xzj9c"; })
+  (fetchNuGet { pname = "System.IO.Pipelines"; version = "6.0.0"; sha256 = "08211lvckdsdbd67xz4f6cyk76cli565j0dby1grlc4k9bhwby65"; })
   (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
   (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
-  (fetchNuGet { pname = "System.Memory"; version = "4.5.3"; sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a"; })
-  (fetchNuGet { pname = "System.Memory"; version = "4.5.5"; sha256 = "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h"; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"; })
   (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; sha256 = "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59"; })
   (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; sha256 = "191p63zy5rpqx7dnrb3h7prvgixmk168fhvvkkvhlazncf8r3nc2"; })
   (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
   (fetchNuGet { pname = "System.Reactive"; version = "5.0.0"; sha256 = "1lafmpnadhiwxyd543kraxa3jfdpm6ipblxrjlibym9b1ykpr5ik"; })
   (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
   (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; sha256 = "11f8y3qfysfcrscjpjym9msk7lsfxkk4fmz9qq95kn3jd0769f74"; })
-  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.7.0"; sha256 = "121l1z2ypwg02yz84dy6gr82phpys0njk7yask3sihgy214w43qp"; })
   (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; sha256 = "0w1n67glpv8241vnpz1kl14sy7zlnw414aqwj4hcx5nd86f6994q"; })
   (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; sha256 = "0ql7lcakycrvzgi9kxz1b3lljd990az1x6c4jsiwcacrvimpib5c"; })
   (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; sha256 = "02bly8bdc98gs22lqsfx9xicblszr2yan7v2mmw3g7hy6miq5hwq"; })
-  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4"; })
+  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "5.0.0"; sha256 = "17qsl5nanlqk9iz0l5wijdn6ka632fs1m1fvx18dfgswm258r3ss"; })
   (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
   (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.3.0"; sha256 = "0y2ssg08d817p0vdag98vn238gyrrynjdj4181hdg780sif3ykp1"; })
   (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
-  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; sha256 = "02hdkgk13rvsd6r9yafbwzss8kr55wnj8d5c7xjnp8gqrwc8sn0m"; })
   (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.5.2"; sha256 = "1vz4275fjij8inf31np78hw50al8nqkngk04p3xv5n4fcmf1grgi"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.6.0"; sha256 = "0xmzi2gpbmgyfr75p24rqqsba3cmrqgmcv45lsqp5amgrdwd0f0m"; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.1"; sha256 = "119br3pd85lq8zcgh4f60jzmv1g976q1kdgi3hvqdlhfbw6siz2j"; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
   (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
   (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
-  (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.3.0"; sha256 = "01vv2p8h4hsz217xxs0rixvb7f2xzbh6wv1gzbfykcbfrza6dvnf"; })
-  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.7.0"; sha256 = "1a56ls5a9sr3ya0nr086sdpa9qv0abv31dd6fp27maqa9zclqq5d"; })
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
-  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
   (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "7.0.0"; sha256 = "1151hbyrcf8kyg1jz8k9awpbic98lwz9x129rg7zk1wrs6vjlpxl"; })
-  (fetchNuGet { pname = "System.Text.Json"; version = "7.0.2"; sha256 = "1i6yinxvbwdk5g5z9y8l4a5hj2gw3h9ijlz2f1c1ngyprnwz2ivf"; })
-  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.0"; sha256 = "1bgq51k7fwld0njylfn7qc5fmwrk2137gdq7djqdsw347paa9c2l"; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "7.0.0"; sha256 = "0scb0lp7wbgcinaa4kqiqs7b8i5nx4ppfad81138jiwd1sl37pyp"; })
   (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
   (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; sha256 = "1xxcx2xh8jin360yjwm4x4cf5y3a2bwpn2ygkfkwkicz7zk50s2z"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.3"; sha256 = "0g7r6hm572ax8v28axrdxz1gnsblg6kszq17g51pj14a5rn2af7i"; })
-  (fetchNuGet { pname = "System.ValueTuple"; version = "4.5.0"; sha256 = "00k8ja51d0f9wrq4vv5z2jhq8hy31kac2rg0rv06prylcybzl8cy"; })
-  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.1"; sha256 = "15f9vd7r0bxmyv754238bdckfg6sxaa3d4yx71hdzkz9k0mhjcky"; })
-  (fetchNuGet { pname = "TextMateSharp"; version = "1.0.23"; sha256 = "1cx1ybzqp1cvxsip1kwdmk4jj1hg6vscywviv5qqqsyyww56p5xv"; })
-  (fetchNuGet { pname = "TextMateSharp"; version = "1.0.29"; sha256 = "011gqjvc6qmvqcq57jbyi9rv2ifcqsaw1h688xgmvwspsq95hfxg"; })
-  (fetchNuGet { pname = "TextMateSharp.Grammars"; version = "1.0.29"; sha256 = "1y8l2bjc4y151qfh5nx4zpdr0aii64xnsfmyzn4lawzsvl1j1g9s"; })
-  (fetchNuGet { pname = "Tmds.DBus"; version = "0.9.0"; sha256 = "0vvx6sg8lxm23g5jvm5wh2gfs95mv85vd52lkq7d1b89bdczczf3"; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; sha256 = "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153"; })
+  (fetchNuGet { pname = "TextMateSharp"; version = "1.0.56"; sha256 = "1nb0rlcgrdp05h952gwbbqp2kwgdvni7jmswdh263n4xnnvhmzdr"; })
+  (fetchNuGet { pname = "TextMateSharp.Grammars"; version = "1.0.56"; sha256 = "1jzvhwx13dyg7iirk2c1m8h0dca8b0pki4yh0r8r89y4c1ighx98"; })
+  (fetchNuGet { pname = "Tmds.DBus.Protocol"; version = "0.15.0"; sha256 = "0d99kcs7r9cp6gpyc7z230czkkyx4164x86dhy0mca73f2ykc2g2"; })
 ]
diff --git a/pkgs/tools/networking/networkmanager/sstp/default.nix b/pkgs/tools/networking/networkmanager/sstp/default.nix
index 4178454c4292..026f038ef20d 100644
--- a/pkgs/tools/networking/networkmanager/sstp/default.nix
+++ b/pkgs/tools/networking/networkmanager/sstp/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
-, fetchFromGitLab
 , autoreconfHook
+, fetchurl
 , file
 , glib
 , gnome
@@ -20,15 +20,12 @@
 
 stdenv.mkDerivation rec {
   pname = "NetworkManager-sstp";
-  version = "unstable-2023-03-09";
+  version = "1.3.2";
   name = "${pname}${lib.optionalString withGnome "-gnome"}-${version}";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "GNOME";
-    repo = "network-manager-sstp";
-    rev = "852db07dc7d19c37e398d831410bd94c8659a210";
-    hash = "sha256-DxgcuTza2G5a7F2mBtDaEuynu7F1Ex9pnAESAjyoRq8=";
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "sha256-zd+g86cZLyibLhYLal6XzUb9wFu7kHROp0KzRM95Qng=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/sitespeed-io/default.nix b/pkgs/tools/networking/sitespeed-io/default.nix
index e852df0b8d4c..505807129318 100644
--- a/pkgs/tools/networking/sitespeed-io/default.nix
+++ b/pkgs/tools/networking/sitespeed-io/default.nix
@@ -24,13 +24,13 @@
 assert (!withFirefox && !withChromium) -> throw "Either `withFirefox` or `withChromium` must be enabled.";
 buildNpmPackage rec {
   pname = "sitespeed-io";
-  version = "33.1.1";
+  version = "33.2.0";
 
   src = fetchFromGitHub {
     owner = "sitespeedio";
     repo = "sitespeed.io";
     rev = "v${version}";
-    hash = "sha256-Blzv0fLWqDfLYbtSVTUbhWS75fkqADzEwYQvomeqt1U=";
+    hash = "sha256-GU7eQfh44zAuZ0oPb/9wGxK/+AfKvNPyuRgmEP0NaMM=";
   };
 
   nodejs = nodejs_18;
@@ -46,7 +46,7 @@ buildNpmPackage rec {
 
   dontNpmBuild = true;
   npmInstallFlags = [ "--omit=dev" ];
-  npmDepsHash = "sha256-+oU0+AVWf7PNqZCUI/KYe+PoNrHNaR35N6SifYCSRp4=";
+  npmDepsHash = "sha256-t11JMu+MjTRsDuud/mDvLglvdcj1mlZfx67ueejdw/0=";
 
   postInstall = ''
     mv $out/bin/sitespeed{.,-}io
diff --git a/pkgs/tools/security/buttercup-desktop/default.nix b/pkgs/tools/security/buttercup-desktop/default.nix
index ffbfe1d3791c..bd83baa6db53 100644
--- a/pkgs/tools/security/buttercup-desktop/default.nix
+++ b/pkgs/tools/security/buttercup-desktop/default.nix
@@ -2,10 +2,10 @@
 
 let
   pname = "buttercup-desktop";
-  version = "2.26.0";
+  version = "2.26.1";
   src = fetchurl {
     url = "https://github.com/buttercup/buttercup-desktop/releases/download/v${version}/Buttercup-linux-x86_64.AppImage";
-    sha256 = "sha256-fsHyHljHk2e/pxzz7jYv639ob0D6gTMA3U4OXxbvYz8=";
+    sha256 = "sha256-usyq9qf6bBJHKreGzKzMdZYNmpZGtkUQScHyk1nvFQI=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname src version; };
 
diff --git a/pkgs/tools/security/cdxgen/default.nix b/pkgs/tools/security/cdxgen/default.nix
index ae39464b84a3..f624b10952fc 100644
--- a/pkgs/tools/security/cdxgen/default.nix
+++ b/pkgs/tools/security/cdxgen/default.nix
@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "cdxgen";
-  version = "10.2.2";
+  version = "10.2.3";
 
   src = fetchFromGitHub {
     owner = "AppThreat";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-N0vz2IaXd0cQBPcmGIdN7Z5IbPyrzSn4+enhFTe0dhI=";
+    sha256 = "sha256-C/XTMOFLW2FPPi1Pgx7g5H8jtJlya5LnKmo3oF21yMI=";
   };
 
-  npmDepsHash = "sha256-2JmrlKoE6iLlw8jsqi2m34npB/GJjBdvoBssAPKVvxA=";
+  npmDepsHash = "sha256-64dKqV17WvuHjF+n1vCEfpLx6UBNpGkVE+XYi7YswgI=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index a91a74f08126..38c8813a301c 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "10.7.0";
+  version = "10.7.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-D3/gOrn0iK+AbXOLJgbIz5ocaPl07eb9xVwvtsMrpQc=";
+    hash = "sha256-i7XZXZuEZasW00HMpwyyS7pxI8hMrx6DZmp39sj1IyI=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-xiSOw027tIb8r54Z8s41PUN72TQ31xiIufyMLCo06ZM=";
+  vendorHash = "sha256-B5wwA2S6LiMRBpM6fWaPVubKuOjkdYcffAssSbpLs48=";
 
   subPackages = [
     "apps/cnspec"
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 93901742c6ad..fdf461a59d3b 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-03-11";
+  version = "2024-03-13";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-tL/ff2XZdGM8lfpfw8tSr2HTOVZCEAWNOdjV/mnZNtQ=";
+    hash = "sha256-Lp69o/Cn2T410vpvfaF/SF8Kf6ehjLP3tcwuqIv7guM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/faraday-agent-dispatcher/default.nix b/pkgs/tools/security/faraday-agent-dispatcher/default.nix
index 510cdd99167c..a7920f1e1cbd 100644
--- a/pkgs/tools/security/faraday-agent-dispatcher/default.nix
+++ b/pkgs/tools/security/faraday-agent-dispatcher/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "faraday-agent-dispatcher";
-  version = "3.2.1";
+  version = "3.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "infobyte";
     repo = "faraday_agent_dispatcher";
     rev = "refs/tags/${version}";
-    hash = "sha256-OO9Rxm7jMfQAyyO5plLDWXbfYmPR2egewOMlrhHQTEw=";
+    hash = "sha256-rpi8S6pmei8MaACnfmOKFK+nNpljoMglu2uk75zvs9I=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/security/pass/wofi-pass.nix b/pkgs/tools/security/pass/wofi-pass.nix
index b6edce34d20c..46ba88ec8cd3 100644
--- a/pkgs/tools/security/pass/wofi-pass.nix
+++ b/pkgs/tools/security/pass/wofi-pass.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wofi-pass";
-  version = "23.1.4";
+  version = "24.0.0";
 
   src = fetchFromGitHub {
     owner = "schmidtandreas";
     repo = "wofi-pass";
     rev = "v${version}";
-    sha256 = "sha256-Ycu1NFHoglJdOzGuJ7yfmDo1+f+FMPkpQXJuz6nvtig=";
+    sha256 = "sha256-tmRfbcX83AfPx7yPajQIqrJVXzzhQhi9JZN8TIIpRrc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/zkar/default.nix b/pkgs/tools/security/zkar/default.nix
index 85bed59a1fa2..f7d68300a45e 100644
--- a/pkgs/tools/security/zkar/default.nix
+++ b/pkgs/tools/security/zkar/default.nix
@@ -5,21 +5,25 @@
 
 buildGoModule rec {
   pname = "zkar";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "phith0n";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-TGqsiYZLbXvCc30OtvNbX4INlzw3ZfjvXal47rP7NDw=";
+    repo = "zkar";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-JPkxJpx2guTaEfTYhQsgZG+kXqHXgEiOrS9sk5vOjVc=";
   };
 
-  vendorHash = "sha256-HQ9qclaaDj0H8PL0oQG1WsH19wVQpynijHNcal4gWBE=";
+  vendorHash = "sha256-R+Pd3QklWqTuivUy7nRIzCmWSujgXpdfFoXAihGSflk=";
+
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "Java serialization protocol analysis tool";
     homepage = "https://github.com/phith0n/zkar";
+    changelog = "https://github.com/phith0n/zkar/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "zkar";
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c6bf02d3a7da..4b98aef13346 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -286,6 +286,7 @@ mapAliases ({
   erlang_23 = throw "erlangR23 has been removed in favor of newer versions."; # added 2023-09-11
   erlangR23 = erlang_23;
   etcd_3_3 = throw "etcd_3_3 has been removed because upstream no longer maintains it"; # Added 2023-09-29
+  etcher = throw "'etcher' has been removed because it depended on an insecure version of Electron"; # Added 2024-03-14
   eterm = throw "eterm was removed because it is still insecure: https://github.com/mej/Eterm/issues/7"; # Added 2023-09-10
   exa = throw "'exa' has been removed because it is unmaintained upstream. Consider using 'eza', a maintained fork"; # Added 2023-09-07
   exhibitor = throw "'exhibitor' has been removed because it is unmaintained upstream"; # Added 2023-06-20
@@ -473,6 +474,8 @@ mapAliases ({
   hip-nvidia = throw "'hip-nvidia' has been removed in favor of 'rocmPackages.clr'"; # Added 2023-10-08
   ht-rust = xh; # Added 2021-02-13
   hydra-unstable = hydra_unstable; # added 2022-05-10
+  hyper-haskell = throw "'hyper-haskell' has been removed. reason: has been broken for a long time and depends on an insecure electron version"; # Added 2024-03-14
+  hyper-haskell-server-with-packages = throw "'hyper-haskell-server-with-packages' has been removed. reason: has been broken for a long time"; # Added 2024-03-14
 
   ### I ###
 
@@ -517,6 +520,8 @@ mapAliases ({
 
   ### K ###
 
+  k3s_1_24 = throw "'k3s_1_24' has been removed from nixpkgs as it has reached end of life"; # Added 2024-03-14
+  k3s_1_25 = throw "'k3s_1_25' has been removed from nixpkgs as it has reached end of life"; # Added 2024-03-14
   # k3d was a 3d editing software k-3d - "k3d has been removed because it was broken and has seen no release since 2016" Added 2022-01-04
   # now kube3d/k3d will take it's place
   kube3d = k3d; # Added 2022-0705
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 188986f4f0b7..6ae76f39f76e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -889,7 +889,7 @@ with pkgs;
 
   tarsum = callPackage ../build-support/docker/tarsum.nix { };
 
-  snapTools = callPackage ../build-support/snap { };
+  snapTools = throw "snapTools was removed because makeSnap produced broken snaps and it was the only function in snapTools. See https://github.com/NixOS/nixpkgs/issues/100618 for more details."; # 2024-03-04;
 
   nix-prefetch-docker = callPackage ../build-support/docker/nix-prefetch-docker.nix { };
 
@@ -6137,10 +6137,6 @@ with pkgs;
 
   opam-publish = callPackage ../development/tools/ocaml/opam-publish { };
 
-  opencomposite = callPackage ../development/libraries/opencomposite { };
-
-  opencomposite-helper = callPackage ../development/libraries/opencomposite/helper.nix { };
-
   osdlyrics = callPackage ../applications/audio/osdlyrics { };
 
   ossutil = callPackage ../tools/admin/ossutil { };
@@ -7946,10 +7942,6 @@ with pkgs;
 
   esshader = callPackage ../tools/graphics/esshader { };
 
-  etcher = callPackage ../tools/misc/etcher {
-    electron = electron_19;
-  };
-
   ethercalc = callPackage ../servers/web-apps/ethercalc { };
 
   ethtool = callPackage ../tools/misc/ethtool { };
@@ -29900,11 +29892,6 @@ with pkgs;
 
   qmapshack = libsForQt5.callPackage ../applications/gis/qmapshack { };
 
-  saga = callPackage ../applications/gis/saga {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-    inherit (libsForQt5) dxflib;
-  };
-
   spatialite_gui = callPackage ../applications/gis/spatialite-gui {
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa IOKit;
     wxGTK = wxGTK32;
@@ -32063,20 +32050,6 @@ with pkgs;
 
   hydroxide = callPackage ../applications/networking/hydroxide { };
 
-  hyper-haskell-server-with-packages = callPackage ../development/tools/haskell/hyper-haskell/server.nix {
-    inherit (haskellPackages) ghcWithPackages;
-    packages = self: with self; [];
-  };
-
-  hyper-haskell = callPackage ../development/tools/haskell/hyper-haskell {
-    hyper-haskell-server = hyper-haskell-server-with-packages.override {
-      packages = self: with self; [
-        hyper-extra diagrams csound-catalog
-      ];
-    };
-    extra-packages = [ csound ];
-  };
-
   hyperion-ng = libsForQt5.callPackage ../applications/video/hyperion-ng {
     protobuf = protobuf_21;
   };
@@ -32572,12 +32545,6 @@ with pkgs;
 
   jwm-settings-manager = callPackage ../applications/window-managers/jwm/jwm-settings-manager.nix { };
 
-  k3s_1_24 = callPackage ../applications/networking/cluster/k3s/1_24 {
-    buildGoModule = buildGo120Module;
-  };
-  k3s_1_25 = callPackage ../applications/networking/cluster/k3s/1_25 {
-    buildGoModule = buildGo120Module;
-  };
   inherit (callPackage ../applications/networking/cluster/k3s {
     buildGoModule = buildGo120Module;
   }) k3s_1_26 k3s_1_27 k3s_1_28;
@@ -35012,8 +34979,6 @@ with pkgs;
 
   skrooge = libsForQt5.callPackage ../applications/office/skrooge { };
 
-  smartgithg = callPackage ../applications/version-management/smartgithg { };
-
   smartdeblur = libsForQt5.callPackage ../applications/graphics/smartdeblur { };
 
   snapper = callPackage ../tools/misc/snapper { };
@@ -36027,7 +35992,7 @@ with pkgs;
   wgnord = callPackage ../applications/networking/wgnord/default.nix { };
 
   whalebird = callPackage ../applications/misc/whalebird {
-    electron = electron_21;
+    electron = electron_27;
   };
 
   windowlab = callPackage ../applications/window-managers/windowlab { };
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 435e17da15e0..ebbe1c4c9e48 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -306,8 +306,6 @@ let
         hledger-web
         hlint
         hpack
-        # hyper-haskell  # depends on electron-10.4.7 which is marked as insecure
-        # hyper-haskell-server-with-packages # hyper-haskell-server is broken
         icepeak
         ihaskell
         jacinda