diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index c887638ab9b8f..55f58bf9cbaca 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -166,7 +166,7 @@ jobs:
   tag:
     name: Tag
     runs-on: ubuntu-24.04-arm
-    needs: [ process ]
+    needs: [ get-merge-commit, process ]
     if: needs.process.outputs.targetRunId
     permissions:
       pull-requests: write
diff --git a/.github/workflows/get-merge-commit.yml b/.github/workflows/get-merge-commit.yml
index 7d8dd03fbf66d..d39e2ad3acfc7 100644
--- a/.github/workflows/get-merge-commit.yml
+++ b/.github/workflows/get-merge-commit.yml
@@ -40,7 +40,7 @@ jobs:
               ;;
             pull_request_target)
               if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-                echo "Checking the commits:\n$commits"
+                echo -e "Checking the commits:\n$commits"
                 echo "$commits" >> "$GITHUB_OUTPUT"
               else
                 # Skipping so that no notifications are sent
diff --git a/ci/default.nix b/ci/default.nix
index 619580035392b..dd39e082a6fbd 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -63,10 +63,7 @@ let
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;
-        fileset = fs.difference (fs.unions [
-          (fs.fileFilter (file: file.hasExt "nix") ../.)
-          ../.git-blame-ignore-revs
-        ]) (fs.maybeMissing ../.git);
+        fileset = fs.difference ../. (fs.maybeMissing ../.git);
       };
     in
     {
diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md
index 3cc16936f3c43..0e0d44114971d 100644
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -779,7 +779,7 @@ that depend on that library, you may want to use:
 
 ```nix
 haskellPackages.haskell-ci.overrideScope (self: super: {
-  Cabal = self.Cabal_3_14_1_1;
+  Cabal = self.Cabal_3_14_2_0;
 })
 ```
 
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 2574de140b737..6851294ddf962 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -1141,12 +1141,15 @@ They cannot be overridden without rebuilding the package.
 
 If dependencies should be resolved at runtime, use `--suffix` to append fallback values to `PATH`.
 
-There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
+There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
 
 `wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.
 
 Using the `makeBinaryWrapper` implementation is usually preferred, as it creates a tiny _compiled_ wrapper executable, that can be used as a shebang interpreter. This is needed mostly on Darwin, where shebangs cannot point to scripts, [due to a limitation with the `execve`-syscall](https://stackoverflow.com/questions/67100831/macos-shebang-with-absolute-path-not-working). Compiled wrappers generated by `makeBinaryWrapper` can be inspected with `less <path-to-wrapper>` - by scrolling past the binary data you should be able to see the shell command that generated the executable and there see the environment variables that were injected into the wrapper.
 
+However, `makeWrapper` is more flexible and implements more arguments.
+Use `makeWrapper` if you need the wrapper to use shell features (e.g. look up environment variables) at runtime.
+
 ### `remove-references-to -t` \<storepath\> [ `-t` \<storepath\> ... ] \<file\> ... {#fun-remove-references-to}
 
 Removes the references of the specified files to the specified store files. This is done without changing the size of the file by replacing the hash by `eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`, and should work on compiled executables. This is meant to be used to remove the dependency of the output on inputs that are known to be unnecessary at runtime. Of course, reckless usage will break the patched programs.
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index d6295bc93bee4..2b9c13e5071d5 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -106,7 +106,6 @@ luazip,,,,,,
 lusc_luv,,,,,,
 lush.nvim,,,https://luarocks.org/dev,,,teto
 luuid,,,,20120509-2,,
-luv,,,,1.48.0-2,,
 lyaml,,,,,,lblasc
 lz.n,,,,,,mrcjkb
 lze,,,,,,birdee
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index ebbd62adee7ca..baf9d7b982627 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -22,6 +22,16 @@
 
 - OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
 
+- GNOME has been updated to version 48.
+
+  - `decibels` music player is now installed by default. You can disable it using [](#opt-environment.gnome.excludePackages).
+  - `gnome-shell-extensions` extension collection (which included GNOME Classic extensions, Apps Menu, and User Themes, among others) are no longer installed by default. You can install them again with [](#opt-services.xserver.desktopManager.gnome.sessionPath).
+  - Option [](#opt-services.gnome.core-developer-tools.enable) now also installs `sysprof` and `d-spy`.
+  - Option `services.gnome.core-utilities.enable` has been renamed to [](#opt-services.gnome.core-apps.enable).
+  - `cantarell-fonts`, `source-code-pro` and `source-sans` fonts are no longer installed by default. They have been replaced by `adwaita-fonts`.
+
+  Refer to the [GNOME release notes](https://release.gnome.org/48/) for more details.
+
 - The `intel` video driver for X.org (from the xf86-video-intel package, which was previously removed because it was non-functional) has been fixed and the driver has been re-introduced.
 
 - The Mattermost module ([`services.mattermost`](#opt-services.mattermost.enable)) and packages (`mattermost` and `mmctl`) have been substantially updated:
diff --git a/nixos/modules/services/accessibility/speechd.nix b/nixos/modules/services/accessibility/speechd.nix
index 165be86346ccb..ff98c363fc29b 100644
--- a/nixos/modules/services/accessibility/speechd.nix
+++ b/nixos/modules/services/accessibility/speechd.nix
@@ -7,7 +7,6 @@
 let
   cfg = config.services.speechd;
   inherit (lib)
-    getExe
     mkEnableOption
     mkIf
     mkPackageOption
@@ -21,12 +20,12 @@ in
     package = mkPackageOption pkgs "speechd" { };
   };
 
-  # FIXME: speechd 0.12 (or whatever the next version is)
-  # will support socket activation, so switch to that once it's out.
   config = mkIf cfg.enable {
     environment = {
       systemPackages = [ cfg.package ];
-      sessionVariables.SPEECHD_CMD = getExe cfg.package;
     };
+    systemd.packages = [ cfg.package ];
+    # have to set `wantedBy` since `systemd.packages` ignores `[Install]`
+    systemd.user.sockets.speech-dispatcher.wantedBy = [ "sockets.target" ];
   };
 }
diff --git a/nixos/modules/services/x11/desktop-managers/gnome.md b/nixos/modules/services/x11/desktop-managers/gnome.md
index f959c0912652f..7f7801305e231 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome.md
+++ b/nixos/modules/services/x11/desktop-managers/gnome.md
@@ -19,7 +19,7 @@ To enable the GNOME desktop use:
 While it is not strictly necessary to use GDM as the display manager with GNOME, it is recommended, as some features such as screen lock [might not work](#sec-gnome-faq-can-i-use-lightdm-with-gnome) without it.
 :::
 
-The default applications used in NixOS are very minimal, inspired by the defaults used in [gnome-build-meta](https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/40.0/elements/core/meta-gnome-core-utilities.bst).
+The default applications used in NixOS are very minimal, inspired by the defaults used in [gnome-build-meta](https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/48.0/elements/core/meta-gnome-core-apps.bst).
 
 ### GNOME without the apps {#sec-gnome-without-the-apps}
 
@@ -27,7 +27,7 @@ If you’d like to only use the GNOME desktop and not the apps, you can disable
 
 ```nix
 {
-  services.gnome.core-utilities.enable = false;
+  services.gnome.core-apps.enable = false;
 }
 ```
 
diff --git a/nixos/modules/services/x11/desktop-managers/gnome.nix b/nixos/modules/services/x11/desktop-managers/gnome.nix
index 52a6a934e410a..1f980444e6449 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@@ -84,12 +84,19 @@ in
     maintainers = lib.teams.gnome.members;
   };
 
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "gnome" "core-utilities" "enable" ]
+      [ "services" "gnome" "core-apps" "enable" ]
+    )
+  ];
+
   options = {
 
     services.gnome = {
       core-os-services.enable = mkEnableOption "essential services for GNOME3";
       core-shell.enable = mkEnableOption "GNOME Shell services";
-      core-utilities.enable = mkEnableOption "GNOME core utilities";
+      core-apps.enable = mkEnableOption "GNOME core apps";
       core-developer-tools.enable = mkEnableOption "GNOME core developer tools";
       games.enable = mkEnableOption "GNOME games";
     };
@@ -213,7 +220,7 @@ in
 
       services.gnome.core-os-services.enable = true;
       services.gnome.core-shell.enable = true;
-      services.gnome.core-utilities.enable = mkDefault true;
+      services.gnome.core-apps.enable = mkDefault true;
 
       services.displayManager.sessionPackages = [ pkgs.gnome-session.sessions ];
 
@@ -326,17 +333,9 @@ in
     })
 
     (lib.mkIf serviceCfg.core-shell.enable {
-      services.xserver.desktopManager.gnome.sessionPath =
-        let
-          mandatoryPackages = [
-            pkgs.gnome-shell
-          ];
-          optionalPackages = [
-            pkgs.gnome-shell-extensions
-          ];
-        in
-        mandatoryPackages
-        ++ utils.removePackagesByName optionalPackages config.environment.gnome.excludePackages;
+      services.xserver.desktopManager.gnome.sessionPath = [
+        pkgs.gnome-shell
+      ];
 
       services.colord.enable = mkDefault true;
       services.gnome.glib-networking.enable = true;
@@ -380,14 +379,11 @@ in
 
       services.orca.enable = notExcluded pkgs.orca;
 
-      fonts.packages = with pkgs; [
-        cantarell-fonts
-        dejavu_fonts
-        source-code-pro # Default monospace font in 3.32
-        source-sans
-      ];
+      fonts.packages = utils.removePackagesByName [
+        pkgs.adwaita-fonts
+      ] config.environment.gnome.excludePackages;
 
-      # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-3-38/elements/core/meta-gnome-core-shell.bst
+      # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-48/elements/core/meta-gnome-core-shell.bst
       environment.systemPackages =
         let
           mandatoryPackages = [
@@ -400,7 +396,6 @@ in
             pkgs.gnome-bluetooth
             pkgs.gnome-color-manager
             pkgs.gnome-control-center
-            pkgs.gnome-shell-extensions
             pkgs.gnome-tour # GNOME Shell detects the .desktop file on first log-in.
             pkgs.gnome-user-docs
             pkgs.glib # for gsettings program
@@ -414,11 +409,12 @@ in
         ++ utils.removePackagesByName optionalPackages config.environment.gnome.excludePackages;
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-45/elements/core/meta-gnome-core-utilities.bst
-    (lib.mkIf serviceCfg.core-utilities.enable {
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-apps.bst
+    (lib.mkIf serviceCfg.core-apps.enable {
       environment.systemPackages = utils.removePackagesByName (
         [
           pkgs.baobab
+          pkgs.decibels
           pkgs.epiphany
           pkgs.gnome-text-editor
           pkgs.gnome-calculator
@@ -500,17 +496,19 @@ in
       ] config.environment.gnome.excludePackages;
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/3.38.0/elements/core/meta-gnome-core-developer-tools.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-developer-tools.bst
     (lib.mkIf serviceCfg.core-developer-tools.enable {
       environment.systemPackages = utils.removePackagesByName [
         pkgs.dconf-editor
         pkgs.devhelp
+        pkgs.d-spy
         pkgs.gnome-builder
         # boxes would make sense in this option, however
         # it doesn't function well enough to be included
         # in default configurations.
         # https://github.com/NixOS/nixpkgs/issues/60908
         # pkgs.gnome-boxes
+        pkgs.sysprof
       ] config.environment.gnome.excludePackages;
 
       services.sysprof.enable = notExcluded pkgs.sysprof;
diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/x11/display-managers/gdm.nix
index 5ab0e63c44113..5973191d6c7c2 100644
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@@ -211,7 +211,10 @@ in
       pkgs.gnome-session
       pkgs.gnome-shell
     ];
-    environment.systemPackages = [ pkgs.adwaita-icon-theme ];
+    environment.systemPackages = [
+      pkgs.adwaita-icon-theme
+      pkgs.gdm # For polkit rules
+    ];
 
     # We dont use the upstream gdm service
     # it has to be disabled since the gdm package has it
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 23b9e232c64df..65caee7451244 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -132,13 +132,20 @@ let
   initialRamdisk = pkgs.makeInitrdNG {
     name = "initrd-${kernel-name}";
     inherit (config.boot.initrd) compressor compressorArgs prepend;
-    inherit (cfg) strip;
 
     contents = lib.filter ({ source, ... }: !lib.elem source cfg.suppressedStorePaths) cfg.storePaths;
   };
 
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "boot" "initrd" "systemd" "strip" ] ''
+      The option to strip ELF files in initrd has been removed.
+      It only saved ~1MiB of initramfs size, but caused a few issues
+      like unloadable kernel modules.
+    '')
+  ];
+
   options.boot.initrd.systemd = {
     enable = mkEnableOption "systemd in initrd" // {
       description = ''
@@ -208,19 +215,6 @@ in
       default = [ ];
     };
 
-    strip = mkOption {
-      description = ''
-        Whether to completely strip executables and libraries copied to the initramfs.
-
-        Setting this to false may save on the order of 30MiB on the
-        machine building the system (by avoiding a binutils
-        reference), at the cost of ~1MiB of initramfs size. This puts
-        this option firmly in the territory of micro-optimisation.
-      '';
-      type = types.bool;
-      default = true;
-    };
-
     extraBin = mkOption {
       description = ''
         Tools to add to /bin
diff --git a/pkgs/applications/editors/eclipse/build-eclipse.nix b/pkgs/applications/editors/eclipse/build-eclipse.nix
index 1b42cc2311fe6..c6a3fa595a631 100644
--- a/pkgs/applications/editors/eclipse/build-eclipse.nix
+++ b/pkgs/applications/editors/eclipse/build-eclipse.nix
@@ -14,7 +14,7 @@
   libXtst,
   libsecret,
   gsettings-desktop-schemas,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   makeWrapper,
   perl,
   ...
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     libXtst
     libsecret
     zlib
-  ] ++ lib.optional (webkitgtk_4_0 != null) webkitgtk_4_0;
+  ] ++ lib.optional (webkitgtk_4_1 != null) webkitgtk_4_1;
 
   buildCommand = ''
     # Unpack tarball.
@@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
             libXtst
             libsecret
           ]
-          ++ lib.optional (webkitgtk_4_0 != null) webkitgtk_4_0
+          ++ lib.optional (webkitgtk_4_1 != null) webkitgtk_4_1
         )
       } \
       --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
diff --git a/pkgs/applications/editors/eclipse/default.nix b/pkgs/applications/editors/eclipse/default.nix
index d84e0b0e42bd7..1af06cdb0ba86 100644
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@@ -16,7 +16,7 @@
   jdk,
   jdk8,
   gsettings-desktop-schemas,
-  webkitgtk_4_0 ? null, # for internal web browser
+  webkitgtk_4_1 ? null, # for internal web browser
   buildEnv,
   runCommand,
   callPackage,
@@ -64,7 +64,7 @@ let
       gtk
       libXtst
       gsettings-desktop-schemas
-      webkitgtk_4_0
+      webkitgtk_4_1
       makeWrapper
       ;
   };
diff --git a/pkgs/applications/editors/formiko/default.nix b/pkgs/applications/editors/formiko/default.nix
index 8b803b5839ad3..672cb738f4a92 100644
--- a/pkgs/applications/editors/formiko/default.nix
+++ b/pkgs/applications/editors/formiko/default.nix
@@ -10,7 +10,7 @@
   gtkspell3,
   librsvg,
   pygobject3,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
 }:
 
 buildPythonApplication rec {
@@ -37,7 +37,7 @@ buildPythonApplication rec {
     gtkspell3
     librsvg
     pygobject3
-    webkitgtk_4_0
+    webkitgtk_4_1
   ];
 
   # Needs a display
diff --git a/pkgs/applications/editors/rednotebook/default.nix b/pkgs/applications/editors/rednotebook/default.nix
index f1646152955a2..74c2fbe5a5276 100644
--- a/pkgs/applications/editors/rednotebook/default.nix
+++ b/pkgs/applications/editors/rednotebook/default.nix
@@ -8,7 +8,7 @@
   gtk3,
   gtksourceview,
   pango,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   pygobject3,
   pyyaml,
   setuptools,
@@ -39,7 +39,7 @@ buildPythonApplication rec {
     gtk3
     gtksourceview
     pango
-    webkitgtk_4_0
+    webkitgtk_4_1
     pygobject3
     pyyaml
   ];
diff --git a/pkgs/applications/emulators/libretro/cores/fceumm.nix b/pkgs/applications/emulators/libretro/cores/fceumm.nix
index e245cf7dddb28..756674750c084 100644
--- a/pkgs/applications/emulators/libretro/cores/fceumm.nix
+++ b/pkgs/applications/emulators/libretro/cores/fceumm.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2025-04-11";
+  version = "0-unstable-2025-05-02";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "43e6496351b544df0de692fbb01b2a6942073f5c";
-    hash = "sha256-kGGvI1rKE/oSF2v3URDY/fLTThYc3Crk9UFN69Rcckg=";
+    rev = "3544ff567ecc417c170641587083b976739ef9db";
+    hash = "sha256-eNmzWLJVPeqFFEcFIhOQCn9OMrBp0iraTcft5pJVvvE=";
   };
 
   meta = {
diff --git a/pkgs/applications/misc/lutris/default.nix b/pkgs/applications/misc/lutris/default.nix
index e438351f1906a..eef78986d452e 100644
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@@ -14,7 +14,7 @@
   gtk3,
   libnotify,
   pango,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   wrapGAppsHook3,
 
   # check inputs
@@ -96,7 +96,7 @@ buildPythonApplication rec {
       gtk3
       libnotify
       pango
-      webkitgtk_4_0
+      webkitgtk_4_1
     ]
     ++ (with gst_all_1; [
       gst-libav
diff --git a/pkgs/applications/misc/lutris/fhsenv.nix b/pkgs/applications/misc/lutris/fhsenv.nix
index 05a53714a9612..0e3b8efc1b7a7 100644
--- a/pkgs/applications/misc/lutris/fhsenv.nix
+++ b/pkgs/applications/misc/lutris/fhsenv.nix
@@ -21,7 +21,7 @@ let
       gtksourceview
       gnome-desktop
       libgnome-keyring
-      webkitgtk_4_0
+      webkitgtk_4_1
     ];
   xorgDeps =
     pkgs: with pkgs.xorg; [
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index de0e544b8054b..4b30a0600e031 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -34,27 +34,14 @@
   libbgcode,
   heatshrink,
   catch2,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
   systemd,
   wxGTK-override ? null,
   opencascade-override ? null,
 }:
 let
-  wxGTK-prusa = wxGTK32.overrideAttrs (old: {
-    pname = "wxwidgets-prusa3d-patched";
-    version = "3.2.0";
-    configureFlags = old.configureFlags ++ [ "--disable-glcanvasegl" ];
-    patches = [ ./wxWidgets-Makefile.in-fix.patch ];
-    src = fetchFromGitHub {
-      owner = "prusa3d";
-      repo = "wxWidgets";
-      rev = "78aa2dc0ea7ce99dc19adc1140f74c3e2e3f3a26";
-      hash = "sha256-rYvmNmvv48JSKVT4ph9AS+JdstnLSRmcpWz1IdgBzQo=";
-      fetchSubmodules = true;
-    };
-  });
-  nanosvg-fltk = nanosvg.overrideAttrs (old: rec {
+  nanosvg-fltk = nanosvg.overrideAttrs (old: {
     pname = "nanosvg-fltk";
     version = "unstable-2022-12-22";
 
@@ -66,7 +53,7 @@ let
     };
   });
   openvdb_tbb_2021_8 = openvdb.override { tbb = tbb_2021_11; };
-  wxGTK-override' = if wxGTK-override == null then wxGTK-prusa else wxGTK-override;
+  wxGTK-override' = if wxGTK-override == null then wxGTK32 else wxGTK-override;
   opencascade-override' =
     if opencascade-override == null then opencascade-occt_7_6_1 else opencascade-override;
 in
@@ -87,6 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/prusa3d/PrusaSlicer/commit/cdc3db58f9002778a0ca74517865527f50ade4c3.patch";
       hash = "sha256-zgpGg1jtdnCBaWjR6oUcHo5sGuZx5oEzpux3dpRdMAM=";
     })
+    # https://github.com/prusa3d/PrusaSlicer/pull/11769
+    ./fix-ambiguous-constructors.patch
   ];
 
   # required for GCC 14
@@ -135,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
       libbgcode
       heatshrink
       catch2
-      webkitgtk_4_0
+      webkitgtk_4_1
     ]
     ++ lib.optionals withSystemd [
       systemd
diff --git a/pkgs/applications/misc/prusa-slicer/fix-ambiguous-constructors.patch b/pkgs/applications/misc/prusa-slicer/fix-ambiguous-constructors.patch
new file mode 100644
index 0000000000000..209a0d1a08a97
--- /dev/null
+++ b/pkgs/applications/misc/prusa-slicer/fix-ambiguous-constructors.patch
@@ -0,0 +1,37 @@
+From 910328f3131e24e330808f5d4cb814454dbe201d Mon Sep 17 00:00:00 2001
+From: Gregor Riepl <onitake@gmail.com>
+Date: Mon, 27 Nov 2023 13:01:55 +0100
+Subject: [PATCH] Make initializers explicit to avoid ambiguous wxArrayString
+ overloads
+
+---
+ src/slic3r/GUI/PhysicalPrinterDialog.cpp | 2 +-
+ src/slic3r/GUI/Plater.cpp                | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/slic3r/GUI/PhysicalPrinterDialog.cpp b/src/slic3r/GUI/PhysicalPrinterDialog.cpp
+index 849e987c731..7d0c628c23f 100644
+--- a/src/slic3r/GUI/PhysicalPrinterDialog.cpp
++++ b/src/slic3r/GUI/PhysicalPrinterDialog.cpp
+@@ -607,7 +607,7 @@ void PhysicalPrinterDialog::build_printhost_settings(ConfigOptionsGroup* m_optgr
+     // Always fill in the "printhost_port" combo box from the config and select it.
+     {
+         Choice* choice = dynamic_cast<Choice*>(m_optgroup->get_field("printhost_port"));
+-        choice->set_values({ m_config->opt_string("printhost_port") });
++        choice->set_values(std::vector<std::string>({ m_config->opt_string("printhost_port") }));
+         choice->set_selection();
+     }
+ 
+diff --git a/src/slic3r/GUI/Plater.cpp b/src/slic3r/GUI/Plater.cpp
+index debfe625fd4..4d61e29a2dc 100644
+--- a/src/slic3r/GUI/Plater.cpp
++++ b/src/slic3r/GUI/Plater.cpp
+@@ -4420,7 +4420,7 @@ void Plater::load_project(const wxString& filename)
+     s_multiple_beds.set_loading_project_flag(true);
+     ScopeGuard guard([](){ s_multiple_beds.set_loading_project_flag(false);});
+ 
+-    if (! load_files({ into_path(filename) }).empty()) {
++    if (! load_files(std::vector<boost::filesystem::path>({ into_path(filename) })).empty()) {
+         // At least one file was loaded.
+         p->set_project_filename(filename);
+         // Save the names of active presets and project specific config into ProjectDirtyStateManager.
diff --git a/pkgs/applications/networking/browsers/nyxt/default.nix b/pkgs/applications/networking/browsers/nyxt/default.nix
index 1f05ff540cee5..c97bf204e4834 100644
--- a/pkgs/applications/networking/browsers/nyxt/default.nix
+++ b/pkgs/applications/networking/browsers/nyxt/default.nix
@@ -15,7 +15,7 @@
   gdk-pixbuf,
   cairo,
   pango,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   openssl,
   gstreamer,
   gst-libav,
@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
     cairo
     pango
     gtk3
-    webkitgtk_4_0
+    webkitgtk_4_1
     openssl
     libfixposix
   ];
diff --git a/pkgs/applications/networking/instant-messengers/dino/default.nix b/pkgs/applications/networking/instant-messengers/dino/default.nix
index 0c3e2b095c03d..b730bb4eb176a 100644
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@@ -2,9 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  buildPackages,
   vala,
-  cmake,
   ninja,
   wrapGAppsHook4,
   pkg-config,
@@ -15,17 +13,17 @@
   gtk4,
   glib-networking,
   libadwaita,
+  libcanberra,
   libnotify,
-  libsoup_2_4,
+  libsoup_3,
   libgee,
-  libsignal-protocol-c,
+  libomemo-c,
   libgcrypt,
+  meson,
   sqlite,
   gpgme,
-  pcre2,
   qrencode,
   icu,
-  gspell,
   srtp,
   libnice,
   gnutls,
@@ -34,30 +32,28 @@
   gst-plugins-good,
   gst-plugins-bad,
   gst-vaapi,
-  webrtc-audio-processing,
+  webrtc-audio-processing_1,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dino";
-  version = "0.4.5";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "dino";
     repo = "dino";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-lF2cUalCrVD6274Ey8wggEXNvKXydlRjvX+815geL1c=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y3MGKpfhjmqnIvmt4mXnkmpjF/riXPDXyUiSrsceY6o=";
   };
 
   postPatch = ''
-    # don't overwrite manually set version information
-    substituteInPlace CMakeLists.txt \
-      --replace "include(ComputeVersion)" ""
+    echo ${finalAttrs.version} > VERSION
   '';
 
   nativeBuildInputs = [
     vala
-    cmake
-    ninja # https://github.com/dino/dino/issues/230
+    meson
+    ninja
     pkg-config
     wrapGAppsHook4
     gettext
@@ -76,11 +72,10 @@ stdenv.mkDerivation (finalAttrs: {
     libnotify
     gpgme
     libgcrypt
-    libsoup_2_4
-    pcre2
+    libsoup_3
     icu
-    libsignal-protocol-c
-    gspell
+    libcanberra
+    libomemo-c
     srtp
     libnice
     gnutls
@@ -89,35 +84,22 @@ stdenv.mkDerivation (finalAttrs: {
     gst-plugins-good # contains rtpbin, required for VP9
     gst-plugins-bad # required for H264, MSDK
     gst-vaapi # required for VAAPI
-    webrtc-audio-processing
+    webrtc-audio-processing_1
   ];
 
-  cmakeFlags = [
-    "-DBUILD_TESTS=true"
-    "-DRTP_ENABLE_H264=true"
-    "-DRTP_ENABLE_MSDK=true"
-    "-DRTP_ENABLE_VAAPI=true"
-    "-DRTP_ENABLE_VP9=true"
-    "-DVERSION_FOUND=true"
-    "-DVERSION_IS_RELEASE=true"
-    "-DVERSION_FULL=${finalAttrs.version}"
-    "-DXGETTEXT_EXECUTABLE=${lib.getBin buildPackages.gettext}/bin/xgettext"
-    "-DMSGFMT_EXECUTABLE=${lib.getBin buildPackages.gettext}/bin/msgfmt"
-    "-DGLIB_COMPILE_RESOURCES_EXECUTABLE=${lib.getDev buildPackages.glib}/bin/glib-compile-resources"
-    "-DSOUP_VERSION=${lib.versions.major libsoup_2_4.version}"
+  doCheck = true;
+
+  mesonFlags = [
+    "-Dplugin-notification-sound=enabled"
+    "-Dplugin-rtp-h264=enabled"
+    "-Dplugin-rtp-msdk=enabled"
+    "-Dplugin-rtp-vaapi=enabled"
+    "-Dplugin-rtp-vp9=enabled"
   ];
 
   # Undefined symbols for architecture arm64: "_gpg_strerror"
   NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-lgpg-error";
 
-  doCheck = true;
-  checkPhase = ''
-    runHook preCheck
-    ./xmpp-vala-test
-    ./signal-protocol-vala-test
-    runHook postCheck
-  '';
-
   # Dino looks for plugins with a .so filename extension, even on macOS where
   # .dylib is appropriate, and despite the fact that it builds said plugins with
   # that as their filename extension
diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
index 49936ab712a79..2c4061da23bbf 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix
@@ -46,11 +46,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.54.3";
+  version = "3.56.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-dGz4HvXDJa8X9Tsvq0bWcmDzsT2gFNiZTUrZ6Ea4Ves=";
+    hash = "sha256-39/lmRCdI5vFbajpYlssGVcGegGujv81BmOj2q50vRY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index e79f78a7dab51..4064b1a29c8fd 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -37,7 +37,8 @@
   nlsSupport ? true,
   osxkeychainSupport ? stdenv.hostPlatform.isDarwin,
   guiSupport ? false,
-  withManual ? true,
+  # Disable the manual since libxslt doesn't seem to parse the files correctly.
+  withManual ? !stdenv.hostPlatform.useLLVM,
   pythonSupport ? true,
   withpcre2 ? true,
   sendEmailSupport ? perlSupport,
@@ -456,6 +457,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   preInstallCheck =
     ''
+      # Some tests break with high concurrency
+      # https://github.com/NixOS/nixpkgs/pull/403237
+      if ((NIX_BUILD_CORES > 32)); then
+        NIX_BUILD_CORES=32
+      fi
+
       installCheckFlagsArray+=(
         GIT_PROVE_OPTS="--jobs $NIX_BUILD_CORES --failures --state=failed,save"
         GIT_TEST_INSTALLED=$out/bin
@@ -494,7 +501,11 @@ stdenv.mkDerivation (finalAttrs: {
     ''
     + ''
       # Flaky tests:
+      disable_test t0027-auto-crlf
+      disable_test t1451-fsck-buffer
+      disable_test t5319-multi-pack-index
       disable_test t6421-merge-partial-clone
+      disable_test t7504-commit-msg-hook
 
       # Fails reproducibly on ZFS on Linux with formD normalization
       disable_test t0021-conversion
diff --git a/pkgs/applications/version-management/git/git-send-email-honor-PATH.patch b/pkgs/applications/version-management/git/git-send-email-honor-PATH.patch
index ef384a98e0c8e..04c02fb853ea9 100644
--- a/pkgs/applications/version-management/git/git-send-email-honor-PATH.patch
+++ b/pkgs/applications/version-management/git/git-send-email-honor-PATH.patch
@@ -1,8 +1,17 @@
-diff --git a/Documentation/git-send-email.txt b/Documentation/git-send-email.txt
-index 3db4eab4ba..39bc0e77c9 100644
+diff --git a/Documentation/git-send-email.adoc b/Documentation/git-send-email.adoc
+index 7f223db42d..7e46a07d31 100644
 --- a/Documentation/git-send-email.adoc
 +++ b/Documentation/git-send-email.adoc
-@@ -220,9 +220,9 @@ a password is obtained using 'git-credential'.
+@@ -177,7 +177,7 @@ Sending
+ 	The command will be executed in the shell if necessary.  Default
+ 	is the value of `sendemail.sendmailCmd`.  If unspecified, and if
+ 	--smtp-server is also unspecified, git-send-email will search
+-	for `sendmail` in `/usr/sbin`, `/usr/lib` and $PATH.
++	for `sendmail` in $PATH.
+ 
+ --smtp-encryption=<encryption>::
+ 	Specify in what way encrypting begins for the SMTP connection.
+@@ -233,9 +233,9 @@ a password is obtained using 'git-credential'.
  --smtp-server=<host>::
  	If set, specifies the outgoing SMTP server to use (e.g.
  	`smtp.example.com` or a raw IP address).  If unspecified, and if
@@ -16,10 +25,10 @@ index 3db4eab4ba..39bc0e77c9 100644
  For backward compatibility, this option can also specify a full pathname
  of a sendmail-like program instead; the program must support the `-i`
 diff --git a/git-send-email.perl b/git-send-email.perl
-index e65d969d0b..508d49483d 100755
+index 798d59b84f..69c9cc2a7d 100755
 --- a/git-send-email.perl
 +++ b/git-send-email.perl
-@@ -1066,8 +1066,7 @@ sub expand_one_alias {
+@@ -1091,8 +1091,7 @@ sub expand_one_alias {
  }
  
  if (!defined $sendmail_cmd && !defined $smtp_server) {
diff --git a/pkgs/applications/video/natron/default.nix b/pkgs/applications/video/natron/default.nix
index 6d11f5aa5f7eb..57175d62e0e7b 100644
--- a/pkgs/applications/video/natron/default.nix
+++ b/pkgs/applications/video/natron/default.nix
@@ -60,6 +60,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     pkg-config
     wrapQtAppsHook
   ];
@@ -71,7 +72,6 @@ stdenv.mkDerivation {
     python3
     python3.pkgs.pyside2
     python3.pkgs.shiboken2
-    extra-cmake-modules
     wayland
     glog
     ceres-solver
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-webkitgtk.nix b/pkgs/applications/video/obs-studio/plugins/obs-webkitgtk.nix
index 72c1768cf5b8a..a4bab7b7b6260 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-webkitgtk.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-webkitgtk.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   obs-studio,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   glib-networking,
   meson,
   cmake,
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   buildInputs = [
     obs-studio
-    webkitgtk_4_0
+    webkitgtk_4_1
     glib-networking
   ];
 
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 841415a4b6e21..0260e5fe96fd1 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -31,6 +31,7 @@
   libcap_ng,
   socat,
   libslirp,
+  libcbor,
   apple-sdk_13,
   darwinMinVersionHook,
   guestAgentSupport ?
@@ -143,11 +144,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "9.2.3";
+  version = "10.0.0";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-uu1JQnDDYb9pgWrMhFEuPv7XHHoj92aRZCuAvD3naT4=";
+    hash = "sha256-IsB1YB/c+MeyZxqDnr3O8dTylz62c1JU/S4b0PMLOJY=";
   };
 
   depsBuildBuild =
@@ -195,6 +196,7 @@ stdenv.mkDerivation (finalAttrs: {
       snappy
       libtasn1
       libslirp
+      libcbor
     ]
     ++ lib.optionals (!userOnly) [ curl ]
     ++ lib.optionals ncursesSupport [ ncurses ]
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
index 7aee0a3a17a41..da2b2cbd51af6 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
@@ -28,7 +28,9 @@ let
     { hypr-dynamic-cursors = import ./hypr-dynamic-cursors.nix; }
     { hyprfocus = import ./hyprfocus.nix; }
     { hyprgrass = import ./hyprgrass.nix; }
-    { hyprscroller = import ./hyprscroller.nix; }
+    {
+      hyprscroller = throw "hyprlandPlugins.hyprscroller has been removed as the upstream project is deprecated. Consider using `hyprlandPlugins.hyprscrolling`.";
+    } # Added 2025-05-09
     { hyprspace = import ./hyprspace.nix; }
     { hyprsplit = import ./hyprsplit.nix; }
     (import ./hyprland-plugins.nix)
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
index 27c645acb74ae..890bda27dff79 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
@@ -8,13 +8,13 @@
 
 mkHyprlandPlugin hyprland {
   pluginName = "hypr-dynamic-cursors";
-  version = "0-unstable-2025-03-26";
+  version = "0-unstable-2025-05-08";
 
   src = fetchFromGitHub {
     owner = "VirtCode";
     repo = "hypr-dynamic-cursors";
-    rev = "e2c32d8108960b6eaf96918485503e90a016de4b";
-    hash = "sha256-/teXJjfdp4cZetlD7lsunettI5QB3UWeODhrrDXooOs=";
+    rev = "1aabd346eb7ad12a614fd18d095d13422d8b95b4";
+    hash = "sha256-KophdgmuoPO4adpgXxhDBAMQoRRoHjngiFWQxLoGgWY=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprgrass.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprgrass.nix
index 49c9f25e3ee49..185525befa6f7 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprgrass.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprgrass.nix
@@ -13,13 +13,13 @@
 
 mkHyprlandPlugin hyprland {
   pluginName = "hyprgrass";
-  version = "0.8.2-unstable-2025-02-01";
+  version = "0.8.2-unstable-2025-05-08";
 
   src = fetchFromGitHub {
     owner = "horriblename";
     repo = "hyprgrass";
-    rev = "f7017c493e071c02f203c09a63ef7260dede0586";
-    hash = "sha256-F9Jnu36LXJnfDdc3mG4JYKACw/ygsPcwEbZsOdCreIQ=";
+    rev = "7cf3779b5cdc6fa62fdc733b30c31a5b8e48609c";
+    hash = "sha256-8Sl2V23EYcZMniBLmKenxH7bMLTGC6Q84ntyFvOUkWU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix
index ac447a552785f..09d0f12903a8d 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix
@@ -14,13 +14,13 @@ let
             mkHyprlandPlugin,
           }:
           let
-            version = "0.48.0";
+            version = "0.49.0";
 
             hyprland-plugins-src = fetchFromGitHub {
               owner = "hyprwm";
               repo = "hyprland-plugins";
               tag = "v${version}";
-              hash = "sha256-q6v3nkJZdu45bwCuymQ+q3U7uwfA+M3GqsvZ0TgNsi4=";
+              hash = "sha256-GpsLyK/U05q7QnyFIWrnGS2loVyjPZByTtPitwu9UNw=";
             };
           in
           mkHyprlandPlugin hyprland {
@@ -44,8 +44,10 @@ let
         csgo-vulkan-fix = "CS:GO/CS2 Vulkan fix";
         hyprbars = "window title";
         hyprexpo = "workspaces overview";
+        hyprscrolling = "scrolling layout";
         hyprtrails = "smooth trails behind moving windows";
         hyprwinwrap = "xwinwrap-like";
+        xtra-dispatchers = "extra dispatchers";
       };
 in
 hyprland-plugins
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprscroller.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprscroller.nix
deleted file mode 100644
index 83090727ed088..0000000000000
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprscroller.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  lib,
-  mkHyprlandPlugin,
-  hyprland,
-  cmake,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-
-mkHyprlandPlugin hyprland {
-  pluginName = "hyprscroller";
-  version = "0-unstable-2025-03-24";
-
-  src = fetchFromGitHub {
-    owner = "dawsers";
-    repo = "hyprscroller";
-    rev = "5b62ca58790f8c2961da79af95efa458f6a814fe";
-    hash = "sha256-monOoefLpK2cUAPBlJlVt9BkoSELQmYVysj81zJ74i0=";
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/lib
-    mv hyprscroller.so $out/lib/libhyprscroller.so
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
-
-  meta = {
-    homepage = "https://github.com/dawsers/hyprscroller";
-    description = "Hyprland layout plugin providing a scrolling layout like PaperWM";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ donovanglover ];
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix
index 2e2d2e06d8198..51aa0db52b886 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix
@@ -8,13 +8,13 @@
 
 mkHyprlandPlugin hyprland {
   pluginName = "hyprspace";
-  version = "0-unstable-2025-02-08";
+  version = "0-unstable-2025-05-09";
 
   src = fetchFromGitHub {
     owner = "KZDKM";
     repo = "hyprspace";
-    rev = "ac55bbdb6cee760af9315899b5b187a40ce43e46";
-    hash = "sha256-t/KaeHEgzh225HUdAiHXRsgDeyDrBCMTg0LjR73v3Nw=";
+    rev = "82bdb6720ef6163f0b10b49ba49702f0bde815d8";
+    hash = "sha256-qs8I5gBib+RLNGYa9om36VivHVrrisJDlZ4EnXNA6OQ=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
index 2ddb895e7fbbd..8a7d7cda0a962 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
@@ -9,13 +9,13 @@
 }:
 mkHyprlandPlugin hyprland rec {
   pluginName = "hyprsplit";
-  version = "0.48.1";
+  version = "0.48.1-unstable-2025-05-03";
 
   src = fetchFromGitHub {
     owner = "shezdy";
     repo = "hyprsplit";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-MN7eipww5r/I4tlEPTN6U+RZAkXPyf1YYx/YSCqVmoU=";
+    rev = "9a65a4d33cc86703d2ac1f349de9697c8fc7a4b9";
+    hash = "sha256-NJTCUa8kHXzQDpUmSifXrHMheR5yejigG2vPBepHolA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index 90b6d9b04adc7..a86f65d03f972 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -27,11 +27,10 @@ for var in "${var_templates_bool[@]}"; do
     mangleVarBool "$var" ${role_suffixes[@]+"${role_suffixes[@]}"}
 done
 
-# Arocc does not support "-B"
-if [[ -z "@isArocc@" ]]; then
-    # `-B@bintools@/bin' forces cc to use ld-wrapper.sh when calling ld.
-    NIX_CFLAGS_COMPILE_@suffixSalt@="-B@bintools@/bin/@bintools_targetPrefix@ $NIX_CFLAGS_COMPILE_@suffixSalt@"
-fi
+# Prepending `@bintools@/bin' to $PATH forces cc to use ld-wrapper.sh when calling ld.
+# $path_backup is where cc-wrapper.sh stores the $PATH that will be used for the
+# compiler invocation.
+path_backup="@bintools@/bin:$path_backup"
 
 # Export and assign separately in order that a failing $(..) will fail
 # the script.
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index f12fe4d18bec6..8101394088fd8 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -880,7 +880,6 @@ stdenvNoCC.mkDerivation {
       cc = optionalString (!nativeTools) cc;
       wrapperName = "CC_WRAPPER";
       inherit suffixSalt coreutils_bin bintools;
-      bintools_targetPrefix = bintools.targetPrefix;
       inherit libc_bin libc_dev libc_lib;
       inherit darwinPlatformForCC;
       default_hardening_flags_str = builtins.toString defaultHardeningFlags;
diff --git a/pkgs/build-support/kernel/make-initrd-ng-tool.nix b/pkgs/build-support/kernel/make-initrd-ng-tool.nix
index 9097728fe7a96..c373530285c76 100644
--- a/pkgs/build-support/kernel/make-initrd-ng-tool.nix
+++ b/pkgs/build-support/kernel/make-initrd-ng-tool.nix
@@ -1,10 +1,6 @@
 {
   rustPlatform,
   lib,
-  makeWrapper,
-  patchelf,
-  glibc,
-  binutils,
 }:
 
 rustPlatform.buildRustPackage {
diff --git a/pkgs/build-support/kernel/make-initrd-ng.nix b/pkgs/build-support/kernel/make-initrd-ng.nix
index 4d2ad14a023b5..da2941cdd6f23 100644
--- a/pkgs/build-support/kernel/make-initrd-ng.nix
+++ b/pkgs/build-support/kernel/make-initrd-ng.nix
@@ -20,8 +20,6 @@ in
   # Name of the derivation (not of the resulting file!)
   name ? "initrd",
 
-  strip ? true,
-
   # Program used to compress the cpio archive; use "cat" for no compression.
   # This can also be a function which takes a package set and returns the path to the compressor,
   # such as `pkgs: "${pkgs.lzop}/bin/lzop"`.
@@ -95,15 +93,10 @@ runCommand name
     passAsFile = [ "contents" ];
     contents = builtins.toJSON contents;
 
-    nativeBuildInputs =
-      [
-        makeInitrdNGTool
-        cpio
-      ]
-      ++ lib.optional makeUInitrd ubootTools
-      ++ lib.optional strip binutils;
-
-    STRIP = if strip then "${pkgsBuildHost.binutils.targetPrefix}strip" else null;
+    nativeBuildInputs = [
+      makeInitrdNGTool
+      cpio
+    ] ++ lib.optional makeUInitrd ubootTools;
   })
   ''
     mkdir -p ./root/var/empty
diff --git a/pkgs/build-support/kernel/make-initrd-ng/src/main.rs b/pkgs/build-support/kernel/make-initrd-ng/src/main.rs
index 149c5393e35a2..85449c7eb0272 100644
--- a/pkgs/build-support/kernel/make-initrd-ng/src/main.rs
+++ b/pkgs/build-support/kernel/make-initrd-ng/src/main.rs
@@ -189,32 +189,6 @@ fn copy_file<
 
     if let Ok(Object::Elf(e)) = Object::parse(&contents) {
         add_dependencies(source, e, &contents, &dlopen, queue)?;
-
-        // Make file writable to strip it
-        let mut permissions = fs::metadata(&target)
-            .wrap_err_with(|| format!("failed to get metadata for {:?}", target))?
-            .permissions();
-        permissions.set_mode(permissions.mode() | 0o200);
-        fs::set_permissions(&target, permissions.clone())
-            .wrap_err_with(|| format!("failed to set read-write permissions for {:?}", target))?;
-
-        // Strip further than normal
-        if let Ok(strip) = env::var("STRIP") {
-            if !Command::new(strip)
-                .arg("--strip-all")
-                .arg(OsStr::new(&target))
-                .output()?
-                .status
-                .success()
-            {
-                println!("{:?} was not successfully stripped.", OsStr::new(&target));
-            }
-        }
-
-        // Remove writable permissions
-        permissions.set_mode(permissions.mode() & 0o555);
-        fs::set_permissions(&target, permissions)
-            .wrap_err_with(|| format!("failed to remove writable permissions for {:?}", target))?;
     };
 
     Ok(())
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index cba158bd31ea9..0fb5aac50a7ac 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -22,10 +22,12 @@ assertExecutable() {
 # --unset        VAR     : remove VAR from the environment
 # --chdir        DIR     : change working directory (use instead of --run "cd DIR")
 # --run          COMMAND : run command before the executable
-# --add-flags    ARGS    : prepend ARGS to the invocation of the executable
+# --add-flag     ARG     : prepend the single argument ARG to the invocation of the executable
 #                          (that is, *before* any arguments passed on the command line)
-# --append-flags ARGS    : append ARGS to the invocation of the executable
+# --append-flag  ARG     : append the single argument ARG to the invocation of the executable
 #                          (that is, *after* any arguments passed on the command line)
+# --add-flags    ARGS    : prepend ARGS verbatim to the Bash-interpreted invocation of the executable
+# --append-flags ARGS    : append ARGS verbatim to the Bash-interpreted invocation of the executable
 
 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix
@@ -164,6 +166,14 @@ makeShellWrapper() {
                 contents="$(cat "$fileName")"
                 addValue "$p" "$varName" "$separator" "$contents"
             done
+        elif [[ "$p" == "--add-flag" ]]; then
+            flags=${params[n + 1]@Q}
+            n=$((n + 1))
+            flagsBefore="${flagsBefore-} $flags"
+        elif [[ "$p" == "--append-flag" ]]; then
+            flags=${params[n + 1]@Q}
+            n=$((n + 1))
+            flagsAfter="${flagsAfter-} $flags"
         elif [[ "$p" == "--add-flags" ]]; then
             flags="${params[$((n + 1))]}"
             n=$((n + 1))
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 7491e567260c2..96cc43157d380 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -367,17 +367,14 @@ rec {
         '';
 
       checkPhase =
-        # GHC (=> shellcheck) isn't supported on some platforms (such as risc-v)
-        # but we still want to use writeShellApplication on those platforms
         let
-          shellcheckSupported =
-            lib.meta.availableOn stdenv.buildPlatform shellcheck-minimal.compiler
-            && (builtins.tryEval shellcheck-minimal.compiler.outPath).success;
           excludeFlags = lib.optionals (excludeShellChecks != [ ]) [
             "--exclude"
             (lib.concatStringsSep "," excludeShellChecks)
           ];
-          shellcheckCommand = lib.optionalString shellcheckSupported ''
+          # GHC (=> shellcheck) isn't supported on some platforms (such as risc-v)
+          # but we still want to use writeShellApplication on those platforms
+          shellcheckCommand = lib.optionalString shellcheck-minimal.compiler.bootstrapAvailable ''
             # use shellcheck which does not include docs
             # pandoc takes long to build and documentation isn't needed for just running the cli
             ${lib.getExe shellcheck-minimal} ${
diff --git a/pkgs/by-name/ad/adwaita-icon-theme/package.nix b/pkgs/by-name/ad/adwaita-icon-theme/package.nix
index 1566d31a54f0e..4eba811c85839 100644
--- a/pkgs/by-name/ad/adwaita-icon-theme/package.nix
+++ b/pkgs/by-name/ad/adwaita-icon-theme/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "adwaita-icon-theme";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major version}/adwaita-icon-theme-${version}.tar.xz";
-    hash = "sha256-rQiKIpWMuEaeQdnxu6Dvsn5YaiECITzYnMJtsuACvf4=";
+    hash = "sha256-hHBoiIZQ2WcxFb5tvyv9wxpGrrxSimqdtEIOYOZWuNQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ap/apache-directory-studio/package.nix b/pkgs/by-name/ap/apache-directory-studio/package.nix
index 8d607bc777873..6fd1e7301e568 100644
--- a/pkgs/by-name/ap/apache-directory-studio/package.nix
+++ b/pkgs/by-name/ap/apache-directory-studio/package.nix
@@ -8,7 +8,7 @@
   makeDesktopItem,
   glib,
   libsecret,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
 }:
 
 stdenv.mkDerivation rec {
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
         --prefix LD_LIBRARY_PATH : ${
           lib.makeLibraryPath [
             glib
-            webkitgtk_4_0
+            webkitgtk_4_1
           ]
         } \
         --run "mkdir -p /tmp/SWT-GDBusServer"
diff --git a/pkgs/by-name/ap/apvlv/package.nix b/pkgs/by-name/ap/apvlv/package.nix
index 8e652f2b1f894..de3bc91aeaa91 100644
--- a/pkgs/by-name/ap/apvlv/package.nix
+++ b/pkgs/by-name/ap/apvlv/package.nix
@@ -20,7 +20,7 @@
   poppler,
   stdenv,
   testers,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   wrapGAppsHook3,
 }:
 
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxshmfence # otherwise warnings in compilation
     pcre
     poppler
-    webkitgtk_4_0
+    webkitgtk_4_1
   ];
 
   installPhase = ''
diff --git a/pkgs/by-name/ar/archi/package.nix b/pkgs/by-name/ar/archi/package.nix
index 02238be0e7a73..7e88c81266116 100644
--- a/pkgs/by-name/ar/archi/package.nix
+++ b/pkgs/by-name/ar/archi/package.nix
@@ -7,7 +7,7 @@
   jdk,
   libsecret,
   glib,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   wrapGAppsHook3,
   _7zz,
   nixosTests,
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
           --prefix LD_LIBRARY_PATH : ${
             lib.makeLibraryPath ([
               glib
-              webkitgtk_4_0
+              webkitgtk_4_1
             ])
           } \
           --set WEBKIT_DISABLE_DMABUF_RENDERER 1 \
diff --git a/pkgs/by-name/as/ashpd-demo/package.nix b/pkgs/by-name/as/ashpd-demo/package.nix
index bcfca11eaa5e5..f03cbff96f3da 100644
--- a/pkgs/by-name/as/ashpd-demo/package.nix
+++ b/pkgs/by-name/as/ashpd-demo/package.nix
@@ -17,22 +17,25 @@
   wayland,
   wrapGAppsHook4,
   desktop-file-utils,
+  gitUpdater,
+  common-updater-scripts,
+  _experimental-update-script-combinators,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ashpd-demo";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "bilelmoussaoui";
     repo = "ashpd";
     rev = "${finalAttrs.version}-demo";
-    hash = "sha256-fIyJEUcyTcjTbBycjuJb99wALQelMT7Zq6PHKcL2F80=";
+    hash = "sha256-0IGqA8PM6I2p4/MrptkdSWIZThMoeaMsdMc6tVTI2MU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     src = "${finalAttrs.src}/ashpd-demo";
-    hash = "sha256-iluV24uSEHDcYi6pO2HNrKs4ShwFvZ/ryv8ioopaNMI=";
+    hash = "sha256-kUEzVBk8dKXCQdHFJJS633CBG1F57TIxJg1xApMwzbI=";
   };
 
   nativeBuildInputs = [
@@ -63,6 +66,37 @@ stdenv.mkDerivation (finalAttrs: {
     cd ashpd-demo
   '';
 
+  passthru = {
+    updateScript =
+      let
+        updateSource = gitUpdater {
+          url = finalAttrs.src.gitRepoUrl;
+          rev-suffix = "-demo";
+        };
+
+        updateLockfile = {
+          command = [
+            "sh"
+            "-c"
+            ''
+              PATH=${
+                lib.makeBinPath [
+                  common-updater-scripts
+                ]
+              }
+              update-source-version ashpd-demo --ignore-same-version --source-key=cargoDeps.vendorStaging > /dev/null
+            ''
+          ];
+          # Experimental feature: do not copy!
+          supportedFeatures = [ "silent" ];
+        };
+      in
+      _experimental-update-script-combinators.sequence [
+        updateSource
+        updateLockfile
+      ];
+  };
+
   meta = with lib; {
     description = "Tool for playing with XDG desktop portals";
     mainProgram = "ashpd-demo";
diff --git a/pkgs/by-name/at/at-spi2-core/package.nix b/pkgs/by-name/at/at-spi2-core/package.nix
index d4de5e0ff027d..84f77fc7fb560 100644
--- a/pkgs/by-name/at/at-spi2-core/package.nix
+++ b/pkgs/by-name/at/at-spi2-core/package.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-core";
-  version = "2.54.1";
+  version = "2.56.2";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor version}/at-spi2-core-${version}.tar.xz";
-    hash = "sha256-8HKeXIdl/rGWm7bB+6GK+iWCEmsDWap1oXP9oaz5PEw=";
+    hash = "sha256-4bHJg2qJR4UvdEDDLiMXkjTHa9mM2cxAAfN2QF+LeDs=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/at/atf/package.nix b/pkgs/by-name/at/atf/package.nix
index cbae83d9d988c..ced8145fa9340 100644
--- a/pkgs/by-name/at/atf/package.nix
+++ b/pkgs/by-name/at/atf/package.nix
@@ -10,26 +10,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atf";
-  version = "0.22";
+  version = "0.23";
 
   src = fetchFromGitHub {
     owner = "freebsd";
     repo = "atf";
     tag = "atf-${finalAttrs.version}";
-    hash = "sha256-vZfBk/lH+04d3NbTUYjAaxwGFHtnagl/kY04hgkE4Iw=";
+    hash = "sha256-g9cXeiCaiyGQXtg6eyrbRQpqk4VLGSFuhfPB+ynbDIo=";
   };
 
-  patches = [
-    # https://github.com/freebsd/atf/issues/88
-    # https://github.com/freebsd/atf/pull/85
-    # Maintainer say it fix some tests in issue 88.
-    ./pr-85.patch
-    (fetchpatch {
-      url = "https://github.com/freebsd/atf/commit/b42c98612cb99fa3f52766a46203263dc1de7187.patch?full_index=1";
-      hash = "sha256-goDPIdIF8vHXDengVIYbxw5W/JT5kfsG5japgtranas=";
-    })
-  ];
-
   postPatch =
     lib.optionalString finalAttrs.doInstallCheck ''
       # Can’t find `c_helpers` in the work folder.
diff --git a/pkgs/by-name/ba/baobab/package.nix b/pkgs/by-name/ba/baobab/package.nix
index a54268e3c78d0..d6355480fcb5c 100644
--- a/pkgs/by-name/ba/baobab/package.nix
+++ b/pkgs/by-name/ba/baobab/package.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "baobab";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/baobab/${lib.versions.major version}/baobab-${version}.tar.xz";
-    hash = "sha256-uI90+cBS08I4j3Bi0ijPXpJ1Raz3QIxWhB34DM0fnDc=";
+    hash = "sha256-VFklBNSdgH8jWRvn5+7xDGyd/LesUnuBw6zVh4eyb9o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/be/bespokesynth/package.nix b/pkgs/by-name/be/bespokesynth/package.nix
index b0a5136311d6d..d9bd14d19e2f7 100644
--- a/pkgs/by-name/be/bespokesynth/package.nix
+++ b/pkgs/by-name/be/bespokesynth/package.nix
@@ -28,7 +28,7 @@
   xcbutilkeysyms,
   xcb-util-cursor,
   gtk3,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   python3,
   curl,
   pcre,
@@ -107,7 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
       libXScrnSaver
       curl
       gtk3
-      webkitgtk_4_0
+      webkitgtk_4_1
       freetype
       libGL
       libusb1
diff --git a/pkgs/by-name/bu/bundler/package.nix b/pkgs/by-name/bu/bundler/package.nix
index dd606e28e00b8..bfc2e40af13bd 100644
--- a/pkgs/by-name/bu/bundler/package.nix
+++ b/pkgs/by-name/bu/bundler/package.nix
@@ -13,8 +13,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.6.6";
-  source.sha256 = "sha256-gysquNKtbj0nUTj7ZA3z021IGOFC0Tsne0SIZxG4l2E=";
+  version = "2.6.8";
+  source.sha256 = "sha256-vemZkXKWoWLklWSULcIxLtmo0y/C97SWyV9t88/Mh6k=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index c908df82511fa..866d548412f71 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -23,7 +23,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  srcVersion = "3.108";
+  srcVersion = "3.111";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -47,7 +47,7 @@ let
           owner = "nss-dev";
           repo = "nss";
           rev = "NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM";
-          hash = "sha256-L2XRj3D8SsS2QYQFDLwGtaPoZ7tN4kz8hGdVKefFSu8=";
+          hash = "sha256-GFtoSvLF5nAwBIiMa9CeEl5geAOK60gG2tjuQFubgYs=";
         };
 
     dontBuild = true;
diff --git a/pkgs/by-name/ca/cargo-modules/package.nix b/pkgs/by-name/ca/cargo-modules/package.nix
index 5266d163df717..1e44adb6cc0ea 100644
--- a/pkgs/by-name/ca/cargo-modules/package.nix
+++ b/pkgs/by-name/ca/cargo-modules/package.nix
@@ -6,17 +6,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cargo-modules";
-  version = "0.23.1";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "regexident";
     repo = "cargo-modules";
     tag = "v${version}";
-    hash = "sha256-L5goyuYn7qRVCgbOGRlSJA0B01MuOzIw9Lx5G/TanXs=";
+    hash = "sha256-MJswCl5eJjKarB2ufeNLQL0ZPDaRPpX6OGOqszG+a0g=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-txuTNuW6dJNnnLk9o5z4Pa42bJaAa9jB/ms8au+3Muc=";
+  cargoHash = "sha256-N1Bj0fqyirp51DNsrZEtRGOSUPS1YNbk+O3kdboQ+TQ=";
 
   checkFlags = [
     "--skip=cfg_test::with_tests::smoke"
diff --git a/pkgs/by-name/ca/cargo-seek/package.nix b/pkgs/by-name/ca/cargo-seek/package.nix
index 6c4fa885f51d7..e3f44a9c565f4 100644
--- a/pkgs/by-name/ca/cargo-seek/package.nix
+++ b/pkgs/by-name/ca/cargo-seek/package.nix
@@ -5,6 +5,7 @@
   openssl,
   pkg-config,
   rustPlatform,
+  versionCheckHook,
   writableTmpDirAsHomeHook,
 }:
 
@@ -30,13 +31,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   doInstallCheck = true;
-  nativeInstallCheckInputs = [ writableTmpDirAsHomeHook ];
-  # We cannot use `versionCheckHook` here since access to the $HOME directory is required.
-  installCheckPhase = ''
-    runHook preInstallCheck
-    $out/bin/cargo-seek --version | grep "${finalAttrs.version}"
-    runHook postInstallCheck
-  '';
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgramArg = "--version";
+  versionCheckDontIgnoreEnvironment = true;
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/cl/claws-mail/package.nix b/pkgs/by-name/cl/claws-mail/package.nix
index 42d0f5ab2914d..88adbe8526e69 100644
--- a/pkgs/by-name/cl/claws-mail/package.nix
+++ b/pkgs/by-name/cl/claws-mail/package.nix
@@ -55,7 +55,7 @@
   enablePluginClamd ? true,
   enablePluginDillo ? true,
   enablePluginFancy ? true,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   enablePluginFetchInfo ? true,
   enablePluginKeywordWarner ? true,
   enablePluginLibravatar ? enablePluginRavatar,
@@ -147,7 +147,7 @@ let
     {
       flags = [ "fancy-plugin" ];
       enabled = enablePluginFancy;
-      deps = [ webkitgtk_4_0 ];
+      deps = [ webkitgtk_4_1 ];
     }
     {
       flags = [ "fetchinfo-plugin" ];
diff --git a/pkgs/by-name/cm/cmake/009-cmCurl-Avoid-using-undocumented-type-for-CURLOPT_NETRC-values.diff b/pkgs/by-name/cm/cmake/009-cmCurl-Avoid-using-undocumented-type-for-CURLOPT_NETRC-values.diff
new file mode 100644
index 0000000000000..7749a95053a09
--- /dev/null
+++ b/pkgs/by-name/cm/cmake/009-cmCurl-Avoid-using-undocumented-type-for-CURLOPT_NETRC-values.diff
@@ -0,0 +1,13 @@
+diff --git a/Source/cmCurl.cxx b/Source/cmCurl.cxx
+index b9133ed7d47b9023de66a94ed5ff15a0f1ba440c..0cf8a71a72daaa07cb42b3f5eef81d2d04300cd6 100644
+--- a/Source/cmCurl.cxx
++++ b/Source/cmCurl.cxx
+@@ -170,7 +170,7 @@ std::string cmCurlSetNETRCOption(::CURL* curl, const std::string& netrc_level,
+                                  const std::string& netrc_file)
+ {
+   std::string e;
+-  CURL_NETRC_OPTION curl_netrc_level = CURL_NETRC_LAST;
++  long curl_netrc_level = CURL_NETRC_LAST;
+   ::CURLcode res;
+ 
+   if (!netrc_level.empty()) {
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index 67fad206fe406..15dc2765fcc66 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -76,6 +76,8 @@ stdenv.mkDerivation (finalAttrs: {
       # Backport of https://gitlab.kitware.com/cmake/cmake/-/merge_requests/9900
       # Needed to correctly link curl in pkgsStatic.
       ./008-FindCURL-Add-more-target-properties-from-pkg-config.diff
+      # Backport of https://gitlab.kitware.com/cmake/cmake/-/commit/1b0c92a3a1b782ff3e1c4499b6ab8db614d45bcd
+      ./009-cmCurl-Avoid-using-undocumented-type-for-CURLOPT_NETRC-values.diff
     ];
 
   outputs =
diff --git a/pkgs/by-name/cr/crc/package.nix b/pkgs/by-name/cr/crc/package.nix
index 1e127e3d9d6e9..9cc8c078bbdae 100644
--- a/pkgs/by-name/cr/crc/package.nix
+++ b/pkgs/by-name/cr/crc/package.nix
@@ -3,6 +3,7 @@
   buildGoModule,
   fetchFromGitHub,
   coreutils,
+  versionCheckHook,
   writableTmpDirAsHomeHook,
 }:
 
@@ -45,17 +46,13 @@ buildGoModule (finalAttrs: {
     "-X github.com/crc-org/crc/v2/pkg/crc/segment.WriteKey=${writeKey}"
   ];
 
-  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
-
   doInstallCheck = true;
-
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    HOME=$(mktemp -d) $out/bin/crc version | grep ${finalAttrs.version} > /dev/null
-
-    runHook postInstallCheck
-  '';
+  nativeCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgramArg = "version";
+  versionCheckDontIgnoreEnvironment = true;
 
   passthru.updateScript = ./update.sh;
 
diff --git a/pkgs/by-name/cu/curlMinimal/0001-http2-fix-stream-window-size-after-unpausing.patch b/pkgs/by-name/cu/curlMinimal/0001-http2-fix-stream-window-size-after-unpausing.patch
new file mode 100644
index 0000000000000..8960f617d3f16
--- /dev/null
+++ b/pkgs/by-name/cu/curlMinimal/0001-http2-fix-stream-window-size-after-unpausing.patch
@@ -0,0 +1,155 @@
+From 5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Fri, 4 Apr 2025 10:43:13 +0200
+Subject: [PATCH] http2: fix stream window size after unpausing
+
+When pausing a HTTP/2 transfer, the stream's local window size
+is reduced to 0 to prevent the server from sending further data
+which curl cannot write out to the application.
+
+When unpausing again, the stream's window size was not correctly
+increased again. The attempt to trigger a window update was
+ignored by nghttp2, the server never received it and the transfer
+stalled.
+
+Add a debug feature to allow use of small window sizes which
+reproduces this bug in test_02_21.
+
+Fixes #16955
+Closes #16960
+---
+ docs/libcurl/libcurl-env-dbg.md |  5 +++++
+ lib/http2.c                     | 31 +++++++++++++++++++++++++++++++
+ tests/http/test_02_download.py  | 27 +++++++++++++++++++++++++--
+ 3 files changed, 61 insertions(+), 2 deletions(-)
+
+diff --git a/docs/libcurl/libcurl-env-dbg.md b/docs/libcurl/libcurl-env-dbg.md
+index 471533625f6b..60c887bfd5a9 100644
+--- a/docs/libcurl/libcurl-env-dbg.md
++++ b/docs/libcurl/libcurl-env-dbg.md
+@@ -147,3 +147,8 @@ Make a blocking, graceful shutdown of all remaining connections when
+ a multi handle is destroyed. This implicitly triggers for easy handles
+ that are run via easy_perform. The value of the environment variable
+ gives the shutdown timeout in milliseconds.
++
++## `CURL_H2_STREAM_WIN_MAX`
++
++Set to a positive 32-bit number to override the HTTP/2 stream window's
++default of 10MB. Used in testing to verify correct window update handling.
+diff --git a/lib/http2.c b/lib/http2.c
+index 88fbcceb7135..a1221dcc51de 100644
+--- a/lib/http2.c
++++ b/lib/http2.c
+@@ -44,6 +44,7 @@
+ #include "connect.h"
+ #include "rand.h"
+ #include "strdup.h"
++#include "strparse.h"
+ #include "transfer.h"
+ #include "dynbuf.h"
+ #include "headers.h"
+@@ -141,6 +142,9 @@ struct cf_h2_ctx {
+   uint32_t goaway_error;        /* goaway error code from server */
+   int32_t remote_max_sid;       /* max id processed by server */
+   int32_t local_max_sid;        /* max id processed by us */
++#ifdef DEBUGBUILD
++  int32_t stream_win_max;       /* max h2 stream window size */
++#endif
+   BIT(initialized);
+   BIT(via_h1_upgrade);
+   BIT(conn_closed);
+@@ -166,6 +170,18 @@ static void cf_h2_ctx_init(struct cf_h2_ctx *ctx, bool via_h1_upgrade)
+   Curl_hash_offt_init(&ctx->streams, 63, h2_stream_hash_free);
+   ctx->remote_max_sid = 2147483647;
+   ctx->via_h1_upgrade = via_h1_upgrade;
++#ifdef DEBUGBUILD
++  {
++    const char *p = getenv("CURL_H2_STREAM_WIN_MAX");
++
++    ctx->stream_win_max = H2_STREAM_WINDOW_SIZE_MAX;
++    if(p) {
++      curl_off_t l;
++      if(!Curl_str_number(&p, &l, INT_MAX))
++        ctx->stream_win_max = (int32_t)l;
++    }
++  }
++#endif
+   ctx->initialized = TRUE;
+ }
+ 
+@@ -285,7 +301,15 @@ static int32_t cf_h2_get_desired_local_win(struct Curl_cfilter *cf,
+      * This gets less precise the higher the latency. */
+     return (int32_t)data->set.max_recv_speed;
+   }
++#ifdef DEBUGBUILD
++  else {
++    struct cf_h2_ctx *ctx = cf->ctx;
++    CURL_TRC_CF(data, cf, "stream_win_max=%d", ctx->stream_win_max);
++    return ctx->stream_win_max;
++  }
++#else
+   return H2_STREAM_WINDOW_SIZE_MAX;
++#endif
+ }
+ 
+ static CURLcode cf_h2_update_local_win(struct Curl_cfilter *cf,
+@@ -302,6 +326,13 @@ static CURLcode cf_h2_update_local_win(struct Curl_cfilter *cf,
+     int32_t wsize = nghttp2_session_get_stream_effective_local_window_size(
+                       ctx->h2, stream->id);
+     if(dwsize > wsize) {
++      rv = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE,
++                                                 stream->id, dwsize);
++      if(rv) {
++        failf(data, "[%d] nghttp2 set_local_window_size(%d) failed: "
++              "%s(%d)", stream->id, dwsize, nghttp2_strerror(rv), rv);
++        return CURLE_HTTP2;
++      }
+       rv = nghttp2_submit_window_update(ctx->h2, NGHTTP2_FLAG_NONE,
+                                         stream->id, dwsize - wsize);
+       if(rv) {
+diff --git a/tests/http/test_02_download.py b/tests/http/test_02_download.py
+index 4b9ae3caefab..b55f022338ad 100644
+--- a/tests/http/test_02_download.py
++++ b/tests/http/test_02_download.py
+@@ -313,9 +313,9 @@ def test_02_20_h2_small_frames(self, env: Env, httpd):
+         assert httpd.stop()
+         assert httpd.start()
+ 
+-    # download via lib client, 1 at a time, pause/resume at different offsets
++    # download serial via lib client, pause/resume at different offsets
+     @pytest.mark.parametrize("pause_offset", [0, 10*1024, 100*1023, 640000])
+-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
++    @pytest.mark.parametrize("proto", ['http/1.1', 'h3'])
+     def test_02_21_lib_serial(self, env: Env, httpd, nghttpx, proto, pause_offset):
+         if proto == 'h3' and not env.have_h3():
+             pytest.skip("h3 not supported")
+@@ -332,6 +332,29 @@ def test_02_21_lib_serial(self, env: Env, httpd, nghttpx, proto, pause_offset):
+         srcfile = os.path.join(httpd.docs_dir, docname)
+         self.check_downloads(client, srcfile, count)
+ 
++    # h2 download parallel via lib client, pause/resume at different offsets
++    # debug-override stream window size to reproduce #16955
++    @pytest.mark.parametrize("pause_offset", [0, 10*1024, 100*1023, 640000])
++    @pytest.mark.parametrize("swin_max", [0, 10*1024])
++    def test_02_21_h2_lib_serial(self, env: Env, httpd, pause_offset, swin_max):
++        proto = 'h2'
++        count = 2
++        docname = 'data-10m'
++        url = f'https://localhost:{env.https_port}/{docname}'
++        run_env = os.environ.copy()
++        run_env['CURL_DEBUG'] = 'multi,http/2'
++        if swin_max > 0:
++            run_env['CURL_H2_STREAM_WIN_MAX'] = f'{swin_max}'
++        client = LocalClient(name='hx-download', env=env, run_env=run_env)
++        if not client.exists():
++            pytest.skip(f'example client not built: {client.name}')
++        r = client.run(args=[
++             '-n', f'{count}', '-P', f'{pause_offset}', '-V', proto, url
++        ])
++        r.check_exit_code(0)
++        srcfile = os.path.join(httpd.docs_dir, docname)
++        self.check_downloads(client, srcfile, count)
++
+     # download via lib client, several at a time, pause/resume
+     @pytest.mark.parametrize("pause_offset", [100*1023])
+     @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index c6fd0ebeee21c..9f3b02d2fc59d 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -91,7 +91,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.12.1";
+  version = "8.13.0";
 
   src = fetchurl {
     urls = [
@@ -100,9 +100,14 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-A0Hx7ZeibIEauuvTfWK4M5VnkrdgfqPxXQAWE8dt4gI=";
+    hash = "sha256-Sgk5eaPC0C3i+8AFSaMncQB/LngDLG+qXs0vep4VICU=";
   };
 
+  patches = [
+    # Backport of https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6
+    ./0001-http2-fix-stream-window-size-after-unpausing.patch
+  ];
+
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''
diff --git a/pkgs/by-name/d-/d-spy/package.nix b/pkgs/by-name/d-/d-spy/package.nix
index a7a6c57de1d8a..36ecd9d1a4d46 100644
--- a/pkgs/by-name/d-/d-spy/package.nix
+++ b/pkgs/by-name/d-/d-spy/package.nix
@@ -14,19 +14,18 @@
   gnome,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "d-spy";
-  version = "47.0";
+  version = "48.0";
 
   outputs = [
     "out"
-    "lib"
     "dev"
   ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/d-spy/${lib.versions.major version}/d-spy-${version}.tar.xz";
-    hash = "sha256-7/sw1DKtXkPmxEm9+OMX2il+VuAnQW5z4ulsTPGPaeg=";
+    url = "mirror://gnome/sources/d-spy/${lib.versions.major finalAttrs.version}/d-spy-${finalAttrs.version}.tar.xz";
+    hash = "sha256-D3oJAZBGGU2X/Dw0KzhOocOA4Qqc/IAlv83lfVlcODA=";
   };
 
   nativeBuildInputs = [
@@ -55,11 +54,8 @@ stdenv.mkDerivation rec {
     description = "D-Bus exploration tool";
     mainProgram = "d-spy";
     homepage = "https://gitlab.gnome.org/GNOME/d-spy";
-    license = with licenses; [
-      lgpl3Plus # library
-      gpl3Plus # app
-    ];
+    license = licenses.gpl3Plus;
     teams = [ teams.gnome ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index 47bf4b6d868f5..f56dc18dcdbf6 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -10,7 +10,7 @@
   wrapGAppsHook3,
   gtk3,
   glib,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   glib-networking,
   override_xmx ? "1024m",
 }:
@@ -83,7 +83,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
             lib.makeLibraryPath [
               gtk3
               glib
-              webkitgtk_4_0
+              webkitgtk_4_1
               glib-networking
             ]
           }"
diff --git a/pkgs/by-name/de/decibels/package.nix b/pkgs/by-name/de/decibels/package.nix
index 8d3105cac66ac..dbfb975e1530c 100644
--- a/pkgs/by-name/de/decibels/package.nix
+++ b/pkgs/by-name/de/decibels/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchFromGitLab,
+  fetchurl,
   appstream,
   blueprint-compiler,
   desktop-file-utils,
@@ -13,20 +13,15 @@
   pkg-config,
   typescript,
   wrapGAppsHook4,
-  nix-update-script,
+  gnome,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "decibels";
   version = "48.0";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    group = "GNOME";
-    owner = "Incubator";
-    repo = "decibels";
-    tag = version;
-    hash = "sha256-qtKiKfcxGLuV1bE3lb7l4s+reZRJXcjlV35M8eZmvHc=";
-    fetchSubmodules = true;
+  src = fetchurl {
+    url = "mirror://gnome/sources/decibels/${lib.versions.major finalAttrs.version}/decibels-${finalAttrs.version}.tar.xz";
+    hash = "sha256-IpsRqSYxR7y4w+If8NSvZZ+yYmL4rs5Uetz4xl4DH3Q=";
   };
 
   nativeBuildInputs = [
@@ -60,16 +55,21 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    updateScript = nix-update-script { };
+    updateScript = gnome.updateScript {
+      packageName = "decibels";
+    };
   };
 
   meta = {
     description = "Play audio files";
-    homepage = "https://gitlab.gnome.org/GNOME/Incubator/decibels";
-    changelog = "https://gitlab.gnome.org/GNOME/decibels/-/blob/${version}/NEWS?ref_type=tags";
+    homepage = "https://gitlab.gnome.org/GNOME/decibels";
+    changelog = "https://gitlab.gnome.org/GNOME/decibels/-/blob/${finalAttrs.version}/NEWS?ref_type=tags";
     license = lib.licenses.gpl3Only;
-    teams = [ lib.teams.gnome-circle ];
+    teams = [
+      lib.teams.gnome
+      lib.teams.gnome-circle
+    ];
     mainProgram = "org.gnome.Decibels";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/do/docbook2x/package.nix b/pkgs/by-name/do/docbook2x/package.nix
index 52d59e710bc88..e266b8835ee10 100644
--- a/pkgs/by-name/do/docbook2x/package.nix
+++ b/pkgs/by-name/do/docbook2x/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   # writes its output to stdout instead of creating a file.
   patches = [ ./db2x_texixml-to-stdout.patch ];
 
-  strictDpes = true;
+  strictDeps = true;
   nativeBuildInputs = [
     makeWrapper
     perlPackages.perl
diff --git a/pkgs/by-name/du/duckstation/package.nix b/pkgs/by-name/du/duckstation/package.nix
index 66f9db82b8fc1..7f5705a5bd7c8 100644
--- a/pkgs/by-name/du/duckstation/package.nix
+++ b/pkgs/by-name/du/duckstation/package.nix
@@ -46,6 +46,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     ninja
     pkg-config
     qttools
@@ -57,7 +58,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     SDL2
     cpuinfo
     curl
-    extra-cmake-modules
     libXrandr
     libbacktrace
     libwebp
diff --git a/pkgs/by-name/du/duktape/duktape.pc.in b/pkgs/by-name/du/duktape/duktape.pc.in
deleted file mode 100644
index d34edb320e2e4..0000000000000
--- a/pkgs/by-name/du/duktape/duktape.pc.in
+++ /dev/null
@@ -1,10 +0,0 @@
-prefix=@out@
-exec_prefix=${prefix}
-libdir=${exec_prefix}/lib
-includedir=${prefix}/include
-
-Name: duktape
-Description: An embeddable Javascript engine, with a focus on portability and compact footprint
-Version: @version@
-Libs: -L${libdir} -lduktape
-Cflags: -I${includedir}
diff --git a/pkgs/by-name/du/duktape/package.nix b/pkgs/by-name/du/duktape/package.nix
index 9cb67506022b4..c7443c99ce154 100644
--- a/pkgs/by-name/du/duktape/package.nix
+++ b/pkgs/by-name/du/duktape/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
       make -f Makefile.cmdline
     ''
     + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
-      make -f Makefile.sharedlibrary
+      make INSTALL_PREFIX="$out" -f Makefile.sharedlibrary
     '';
 
   installPhase =
@@ -37,8 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
       install -d $out/lib/pkgconfig
       install -d $out/include
-      make -f Makefile.sharedlibrary install INSTALL_PREFIX=$out
-      substituteAll ${./duktape.pc.in} $out/lib/pkgconfig/duktape.pc
+
+      make INSTALL_PREFIX="$out" -f Makefile.sharedlibrary install
     '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ec/eclipse-mat/package.nix b/pkgs/by-name/ec/eclipse-mat/package.nix
index fff8bb0c2ab95..5bbb87b125c5b 100644
--- a/pkgs/by-name/ec/eclipse-mat/package.nix
+++ b/pkgs/by-name/ec/eclipse-mat/package.nix
@@ -15,7 +15,7 @@
   shared-mime-info,
   stdenv,
   unzip,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   zlib,
 }:
 
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
           glib
           gtk3
           libXtst
-          webkitgtk_4_0
+          webkitgtk_4_1
         ])
       } \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
     libXtst
     zlib
     shared-mime-info
-    webkitgtk_4_0
+    webkitgtk_4_1
   ];
 
   dontBuild = true;
diff --git a/pkgs/by-name/el/ell/package.nix b/pkgs/by-name/el/ell/package.nix
index ecfb50a5d1b07..5359f06a457f7 100644
--- a/pkgs/by-name/el/ell/package.nix
+++ b/pkgs/by-name/el/ell/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.73";
+  version = "0.76";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-pwAlRh+rkfPA6dXOGZcIidyCD2ioxVPSJjnyvrWuwow=";
+    hash = "sha256-LSTmcVBKI+EpDiTpiKFEeIIXIXc6C5gOYn5zf7sHe/I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/en/ente-auth/package.nix b/pkgs/by-name/en/ente-auth/package.nix
index 1447ce0701962..f5531a2fedbd0 100644
--- a/pkgs/by-name/en/ente-auth/package.nix
+++ b/pkgs/by-name/en/ente-auth/package.nix
@@ -2,7 +2,7 @@
   lib,
   flutter324,
   fetchFromGitHub,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   sqlite,
   libayatana-appindicator,
   makeDesktopItem,
@@ -49,7 +49,7 @@ flutter324.buildFlutterApplication rec {
   ];
 
   buildInputs = [
-    webkitgtk_4_0
+    webkitgtk_4_1
     sqlite
     libayatana-appindicator
     # The networking client used by ente-auth (native_dio_adapter)
diff --git a/pkgs/by-name/ep/epiphany/package.nix b/pkgs/by-name/ep/epiphany/package.nix
index ba61930135b58..de050c54c7b7c 100644
--- a/pkgs/by-name/ep/epiphany/package.nix
+++ b/pkgs/by-name/ep/epiphany/package.nix
@@ -37,11 +37,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "epiphany";
-  version = "47.3.1";
+  version = "48.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/epiphany/${lib.versions.major finalAttrs.version}/epiphany-${finalAttrs.version}.tar.xz";
-    hash = "sha256-eV17gfGLdIfZ6b/Ayy1oqJPSIA9F+Tl81CyzOSsggak=";
+    hash = "sha256-2ilT5+K3O/dHPAozl5EE15NieVKV6qCio46hiFN9rxM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ev/evince/package.nix b/pkgs/by-name/ev/evince/package.nix
index 62ce6370df693..977b8b78b30d7 100644
--- a/pkgs/by-name/ev/evince/package.nix
+++ b/pkgs/by-name/ev/evince/package.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "evince";
-  version = "46.3.1";
+  version = "48.0";
 
   outputs = [
     "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${lib.versions.major finalAttrs.version}/evince-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lFwgpvI4ObDVMycpFxRY6QaA2oJk6Zxvn0HCGcfu7nw=";
+    hash = "sha256-zS9lg1X6kHX9+eW0SqCvOn4JKMVWFOsQQrNhds9FESY=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/ev/evolution-data-server/hardcode-gsettings.patch b/pkgs/by-name/ev/evolution-data-server/hardcode-gsettings.patch
index 0f6e40630f620..62eae627efd75 100644
--- a/pkgs/by-name/ev/evolution-data-server/hardcode-gsettings.patch
+++ b/pkgs/by-name/ev/evolution-data-server/hardcode-gsettings.patch
@@ -66,10 +66,10 @@ index 5e65ec8..2cae29d 100644
  	g_mutex_unlock (&mutex);
  
 diff --git a/src/addressbook/libebook/e-book.c b/src/addressbook/libebook/e-book.c
-index e85a56b..59d3fe2 100644
+index a9b68e3..6a13b1b 100644
 --- a/src/addressbook/libebook/e-book.c
 +++ b/src/addressbook/libebook/e-book.c
-@@ -2587,7 +2587,18 @@ e_book_get_self (ESourceRegistry *registry,
+@@ -2586,7 +2586,18 @@ e_book_get_self (ESourceRegistry *registry,
  		return FALSE;
  	}
  
@@ -89,7 +89,7 @@ index e85a56b..59d3fe2 100644
  	uid = g_settings_get_string (settings, SELF_UID_KEY);
  	g_object_unref (settings);
  
-@@ -2642,7 +2653,18 @@ e_book_set_self (EBook *book,
+@@ -2641,7 +2652,18 @@ e_book_set_self (EBook *book,
  	g_return_val_if_fail (E_IS_BOOK (book), FALSE);
  	g_return_val_if_fail (E_IS_CONTACT (contact), FALSE);
  
@@ -109,7 +109,7 @@ index e85a56b..59d3fe2 100644
  	g_settings_set_string (
  		settings, SELF_UID_KEY,
  		e_contact_get_const (contact, E_CONTACT_UID));
-@@ -2670,7 +2692,18 @@ e_book_is_self (EContact *contact)
+@@ -2669,7 +2691,18 @@ e_book_is_self (EContact *contact)
  
  	g_return_val_if_fail (E_IS_CONTACT (contact), FALSE);
  
@@ -130,10 +130,10 @@ index e85a56b..59d3fe2 100644
  	g_object_unref (settings);
  
 diff --git a/src/addressbook/libedata-book/e-book-meta-backend.c b/src/addressbook/libedata-book/e-book-meta-backend.c
-index 3ab8908..6c4b210 100644
+index 752f83f..eaa3dad 100644
 --- a/src/addressbook/libedata-book/e-book-meta-backend.c
 +++ b/src/addressbook/libedata-book/e-book-meta-backend.c
-@@ -146,7 +146,18 @@ ebmb_is_power_saver_enabled (void)
+@@ -145,7 +145,18 @@ ebmb_is_power_saver_enabled (void)
  	GSettings *settings;
  	gboolean enabled = FALSE;
  
@@ -154,10 +154,10 @@ index 3ab8908..6c4b210 100644
  	if (g_settings_get_boolean (settings, "limit-operations-in-power-saver-mode")) {
  		GPowerProfileMonitor *power_monitor;
 diff --git a/src/calendar/backends/contacts/e-cal-backend-contacts.c b/src/calendar/backends/contacts/e-cal-backend-contacts.c
-index 047fb97..960f44c 100644
+index 9f8646a..079aba9 100644
 --- a/src/calendar/backends/contacts/e-cal-backend-contacts.c
 +++ b/src/calendar/backends/contacts/e-cal-backend-contacts.c
-@@ -1333,7 +1333,18 @@ e_cal_backend_contacts_init (ECalBackendContacts *cbc)
+@@ -1338,7 +1338,18 @@ e_cal_backend_contacts_init (ECalBackendContacts *cbc)
  		(GDestroyNotify) g_free,
  		(GDestroyNotify) contact_record_free);
  
@@ -204,10 +204,10 @@ index 2525856..7ecc1a8 100644
  				g_clear_object (&settings);
  			}
 diff --git a/src/calendar/libecal/e-reminder-watcher.c b/src/calendar/libecal/e-reminder-watcher.c
-index a83d3d3..dc7acac 100644
+index 026ae80..e3003c2 100644
 --- a/src/calendar/libecal/e-reminder-watcher.c
 +++ b/src/calendar/libecal/e-reminder-watcher.c
-@@ -2826,8 +2826,33 @@ e_reminder_watcher_init (EReminderWatcher *watcher)
+@@ -2844,8 +2844,33 @@ e_reminder_watcher_init (EReminderWatcher *watcher)
  
  	watcher->priv = e_reminder_watcher_get_instance_private (watcher);
  	watcher->priv->cancellable = g_cancellable_new ();
@@ -244,10 +244,10 @@ index a83d3d3..dc7acac 100644
  		g_signal_connect_object (
  			watcher->priv->desktop_settings,
 diff --git a/src/calendar/libedata-cal/e-cal-meta-backend.c b/src/calendar/libedata-cal/e-cal-meta-backend.c
-index f19ab22..abd3263 100644
+index 84ccbb0..9010429 100644
 --- a/src/calendar/libedata-cal/e-cal-meta-backend.c
 +++ b/src/calendar/libedata-cal/e-cal-meta-backend.c
-@@ -158,7 +158,18 @@ ecmb_is_power_saver_enabled (void)
+@@ -157,7 +157,18 @@ ecmb_is_power_saver_enabled (void)
  	GSettings *settings;
  	gboolean enabled = FALSE;
  
@@ -267,7 +267,7 @@ index f19ab22..abd3263 100644
  
  	if (g_settings_get_boolean (settings, "limit-operations-in-power-saver-mode")) {
  		GPowerProfileMonitor *power_monitor;
-@@ -2629,7 +2640,20 @@ ecmb_receive_object_sync (ECalMetaBackend *meta_backend,
+@@ -2628,7 +2639,20 @@ ecmb_receive_object_sync (ECalMetaBackend *meta_backend,
  			if (is_declined) {
  				GSettings *settings;
  
@@ -290,10 +290,10 @@ index f19ab22..abd3263 100644
  				g_clear_object (&settings);
  			}
 diff --git a/src/camel/camel-cipher-context.c b/src/camel/camel-cipher-context.c
-index d5a0823..2ae03f8 100644
+index d00fbd5..0f67653 100644
 --- a/src/camel/camel-cipher-context.c
 +++ b/src/camel/camel-cipher-context.c
-@@ -1631,7 +1631,18 @@ camel_cipher_can_load_photos (void)
+@@ -1630,7 +1630,18 @@ camel_cipher_can_load_photos (void)
  	GSettings *settings;
  	gboolean load_photos;
  
@@ -314,10 +314,10 @@ index d5a0823..2ae03f8 100644
  	g_clear_object (&settings);
  
 diff --git a/src/camel/camel-gpg-context.c b/src/camel/camel-gpg-context.c
-index 4c10de7..6c0ab5e 100644
+index 4594ab1..e71ce05 100644
 --- a/src/camel/camel-gpg-context.c
 +++ b/src/camel/camel-gpg-context.c
-@@ -744,7 +744,18 @@ gpg_ctx_get_executable_name (void)
+@@ -745,7 +745,18 @@ gpg_ctx_get_executable_name (void)
  		GSettings *settings;
  		gchar *path;
  
@@ -338,10 +338,10 @@ index 4c10de7..6c0ab5e 100644
  		g_clear_object (&settings);
  
 diff --git a/src/camel/camel-utils.c b/src/camel/camel-utils.c
-index e61160c..b6553a4 100644
+index 0c1c7dd..4188934 100644
 --- a/src/camel/camel-utils.c
 +++ b/src/camel/camel-utils.c
-@@ -362,7 +362,19 @@ void
+@@ -361,7 +361,19 @@ void
  _camel_utils_initialize (void)
  {
  	G_LOCK (mi_user_headers);
@@ -363,10 +363,10 @@ index e61160c..b6553a4 100644
  		G_CALLBACK (mi_user_headers_settings_changed_cb), NULL);
  	G_UNLOCK (mi_user_headers);
 diff --git a/src/camel/providers/imapx/camel-imapx-server.c b/src/camel/providers/imapx/camel-imapx-server.c
-index 396cf39..e31dc1a 100644
+index 8cf56f0..f4355d5 100644
 --- a/src/camel/providers/imapx/camel-imapx-server.c
 +++ b/src/camel/providers/imapx/camel-imapx-server.c
-@@ -5682,7 +5682,18 @@ camel_imapx_server_do_old_flags_update (CamelFolder *folder)
+@@ -5681,7 +5681,18 @@ camel_imapx_server_do_old_flags_update (CamelFolder *folder)
  	if (do_old_flags_update) {
  		GSettings *eds_settings;
  
@@ -387,10 +387,10 @@ index 396cf39..e31dc1a 100644
  		if (g_settings_get_boolean (eds_settings, "limit-operations-in-power-saver-mode")) {
  			GPowerProfileMonitor *power_monitor;
 diff --git a/src/camel/providers/smtp/camel-smtp-transport.c b/src/camel/providers/smtp/camel-smtp-transport.c
-index 38bedb6..f799c29 100644
+index f7c5d3c..67732c3 100644
 --- a/src/camel/providers/smtp/camel-smtp-transport.c
 +++ b/src/camel/providers/smtp/camel-smtp-transport.c
-@@ -1472,7 +1472,18 @@ smtp_helo (CamelSmtpTransport *transport,
+@@ -1471,7 +1471,18 @@ smtp_helo (CamelSmtpTransport *transport,
  		transport->authtypes = NULL;
  	}
  
@@ -507,10 +507,10 @@ index 3738359..f9ce2d9 100644
  		g_object_unref (settings);
  
 diff --git a/src/libedataserver/e-oauth2-service.c b/src/libedataserver/e-oauth2-service.c
-index 29c1dd2..84d42b7 100644
+index db775f9..fb524db 100644
 --- a/src/libedataserver/e-oauth2-service.c
 +++ b/src/libedataserver/e-oauth2-service.c
-@@ -94,7 +94,18 @@ eos_default_guess_can_process (EOAuth2Service *service,
+@@ -93,7 +93,18 @@ eos_default_guess_can_process (EOAuth2Service *service,
  	name_len = strlen (name);
  	hostname_len = strlen (hostname);
  
@@ -556,10 +556,10 @@ index 1539f8b..77cf123 100644
  	g_signal_connect (
  		registry->priv->settings, "changed",
 diff --git a/src/libedataserverui/e-reminders-widget.c b/src/libedataserverui/e-reminders-widget.c
-index 14b6481..7149b74 100644
+index b47a374..e812fbe 100644
 --- a/src/libedataserverui/e-reminders-widget.c
 +++ b/src/libedataserverui/e-reminders-widget.c
-@@ -1986,7 +1986,19 @@ static void
+@@ -1985,7 +1985,19 @@ static void
  e_reminders_widget_init (ERemindersWidget *reminders)
  {
  	reminders->priv = e_reminders_widget_get_instance_private (reminders);
diff --git a/pkgs/by-name/ev/evolution-data-server/package.nix b/pkgs/by-name/ev/evolution-data-server/package.nix
index a12e71bd042d0..ef177c079ded1 100644
--- a/pkgs/by-name/ev/evolution-data-server/package.nix
+++ b/pkgs/by-name/ev/evolution-data-server/package.nix
@@ -24,7 +24,6 @@
   wrapGAppsHook3,
   glib-networking,
   gsettings-desktop-schemas,
-  pcre,
   vala,
   cmake,
   ninja,
@@ -51,7 +50,7 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.54.3";
+  version = "3.56.1";
 
   outputs = [
     "out"
@@ -60,7 +59,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/evolution-data-server-${version}.tar.xz";
-    hash = "sha256-UQjcOO5cwfjvkVXof2xBKflkRVCglixa4j/4B7V8uNA=";
+    hash = "sha256-ZGzAA32j+fKVeUxjfZU5StdvjJvuImi+LEGD4ncgwTc=";
   };
 
   patches = [
@@ -102,7 +101,6 @@ stdenv.mkDerivation rec {
       openldap
       glib-networking
       libcanberra-gtk3
-      pcre
       libphonenumber
       libuuid
       boost
diff --git a/pkgs/by-name/ev/evolution-ews/hardcode-gsettings.patch b/pkgs/by-name/ev/evolution-ews/hardcode-gsettings.patch
index 2e1611cc942bf..2032686395fb6 100644
--- a/pkgs/by-name/ev/evolution-ews/hardcode-gsettings.patch
+++ b/pkgs/by-name/ev/evolution-ews/hardcode-gsettings.patch
@@ -1,8 +1,17 @@
 diff --git a/src/EWS/camel/camel-ews-utils.c b/src/EWS/camel/camel-ews-utils.c
-index 44a20d6..90d5729 100644
+index 32817df..da65217 100644
 --- a/src/EWS/camel/camel-ews-utils.c
 +++ b/src/EWS/camel/camel-ews-utils.c
-@@ -1554,7 +1554,18 @@ ews_utils_save_category_changes (GHashTable *old_categories, /* gchar *guid ~> C
+@@ -1550,7 +1550,7 @@ ews_utils_save_category_changes (GHashTable *old_categories, /* gchar *guid ~> C
+ 	gboolean changed = FALSE;
+ 
+ 	/* cannot save, when evolution is not installed */
+-	if (!e_ews_common_utils_gsettings_schema_exists ("org.gnome.evolution.mail"))
++	if (!true)
+ 		return FALSE;
+ 
+ 	if (!old_categories || !new_categories)
+@@ -1558,7 +1558,18 @@ ews_utils_save_category_changes (GHashTable *old_categories, /* gchar *guid ~> C
  
  	evo_labels = g_ptr_array_new_full (5, g_free);
  
@@ -23,10 +32,19 @@ index 44a20d6..90d5729 100644
  
  	for (ii = 0; strv && strv[ii]; ii++) {
 diff --git a/src/Microsoft365/camel/camel-m365-store.c b/src/Microsoft365/camel/camel-m365-store.c
-index 3db3564..a233d4d 100644
+index 7374c36..7da2023 100644
 --- a/src/Microsoft365/camel/camel-m365-store.c
 +++ b/src/Microsoft365/camel/camel-m365-store.c
-@@ -309,7 +309,18 @@ m365_store_save_category_changes (GHashTable *old_categories, /* gchar *id ~> Ca
+@@ -305,7 +305,7 @@ m365_store_save_category_changes (GHashTable *old_categories, /* gchar *id ~> Ca
+ 	gboolean changed = FALSE;
+ 
+ 	/* cannot save, when evolution is not installed */
+-	if (!e_ews_common_utils_gsettings_schema_exists ("org.gnome.evolution.mail"))
++	if (!true)
+ 		return FALSE;
+ 
+ 	if (!old_categories || !new_categories)
+@@ -313,7 +313,18 @@ m365_store_save_category_changes (GHashTable *old_categories, /* gchar *id ~> Ca
  
  	evo_labels = g_ptr_array_new_full (5, g_free);
  
@@ -47,51 +65,58 @@ index 3db3564..a233d4d 100644
  
  	for (ii = 0; strv && strv[ii]; ii++) {
 diff --git a/src/Microsoft365/common/e-m365-tz-utils.c b/src/Microsoft365/common/e-m365-tz-utils.c
-index 7a1d7f4..3c0d5e1 100644
+index cec5417..2e744a0 100644
 --- a/src/Microsoft365/common/e-m365-tz-utils.c
 +++ b/src/Microsoft365/common/e-m365-tz-utils.c
-@@ -192,7 +192,18 @@ e_m365_tz_utils_get_user_timezone (void)
- 	gchar *location;
+@@ -192,10 +192,21 @@ e_m365_tz_utils_get_user_timezone (void)
+ 	gchar *location = NULL;
  	ICalTimezone *zone = NULL;
  
--	settings = g_settings_new ("org.gnome.evolution.calendar");
-+	{
-+		g_autoptr(GSettingsSchemaSource) schema_source;
-+		g_autoptr(GSettingsSchema) schema;
-+		schema_source = g_settings_schema_source_new_from_directory("@evo@",
-+									    g_settings_schema_source_get_default(),
-+									    TRUE,
-+									    NULL);
-+		schema = g_settings_schema_source_lookup(schema_source,
-+							 "org.gnome.evolution.calendar",
-+							 FALSE);
-+		settings = g_settings_new_full(schema, NULL, NULL);
-+	}
+-	if (e_ews_common_utils_gsettings_schema_exists ("org.gnome.evolution.calendar")) {
++	if (true) {
+ 		GSettings *settings;
  
- 	if (g_settings_get_boolean (settings, "use-system-timezone"))
- 		location = e_cal_util_get_system_timezone_location ();
+-		settings = g_settings_new ("org.gnome.evolution.calendar");
++		{
++			g_autoptr(GSettingsSchemaSource) schema_source;
++			g_autoptr(GSettingsSchema) schema;
++			schema_source = g_settings_schema_source_new_from_directory("@evo@",
++										    g_settings_schema_source_get_default(),
++										    TRUE,
++										    NULL);
++			schema = g_settings_schema_source_lookup(schema_source,
++								 "org.gnome.evolution.calendar",
++								 FALSE);
++			settings = g_settings_new_full(schema, NULL, NULL);
++		}
+ 
+ 		if (g_settings_get_boolean (settings, "use-system-timezone"))
+ 			location = e_cal_util_get_system_timezone_location ();
 diff --git a/src/common/e-ews-common-utils.c b/src/common/e-ews-common-utils.c
-index 5017d40..34547e3 100644
+index 3458c10..7d21784 100644
 --- a/src/common/e-ews-common-utils.c
 +++ b/src/common/e-ews-common-utils.c
-@@ -218,7 +218,19 @@ e_ews_common_utils_get_configured_icaltimezone (void)
- 		if (schema) {
- 			GSettings *settings;
- 
--			settings = g_settings_new ("org.gnome.evolution.calendar");
-+			{
-+				g_autoptr(GSettingsSchemaSource) schema_source;
-+				g_autoptr(GSettingsSchema) schema;
-+				schema_source = g_settings_schema_source_new_from_directory("@evo@",
-+											    g_settings_schema_source_get_default(),
-+											    TRUE,
-+											    NULL);
-+				schema = g_settings_schema_source_lookup(schema_source,
-+									 "org.gnome.evolution.calendar",
-+									 FALSE);
-+				settings = g_settings_new_full(schema, NULL,
-+							       NULL);
-+			}
- 
- 			if (g_settings_get_boolean (settings, "use-system-timezone"))
- 				location = e_cal_util_get_system_timezone_location ();
+@@ -208,10 +208,21 @@ e_ews_common_utils_get_configured_icaltimezone (void)
+ 	ICalTimezone *zone = NULL;
+ 	gchar *location = NULL;
+ 
+-	if (e_ews_common_utils_gsettings_schema_exists ("org.gnome.evolution.calendar")) {
++	if (true) {
+ 		GSettings *settings;
+ 
+-		settings = g_settings_new ("org.gnome.evolution.calendar");
++		{
++			g_autoptr(GSettingsSchemaSource) schema_source;
++			g_autoptr(GSettingsSchema) schema;
++			schema_source = g_settings_schema_source_new_from_directory("@evo@",
++										    g_settings_schema_source_get_default(),
++										    TRUE,
++										    NULL);
++			schema = g_settings_schema_source_lookup(schema_source,
++								 "org.gnome.evolution.calendar",
++								 FALSE);
++			settings = g_settings_new_full(schema, NULL, NULL);
++		}
+ 
+ 		if (g_settings_get_boolean (settings, "use-system-timezone"))
+ 			location = e_cal_util_get_system_timezone_location ();
diff --git a/pkgs/by-name/ev/evolution-ews/package.nix b/pkgs/by-name/ev/evolution-ews/package.nix
index 4298118ad7c0a..9b4a5d7d3e3cd 100644
--- a/pkgs/by-name/ev/evolution-ews/package.nix
+++ b/pkgs/by-name/ev/evolution-ews/package.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.54.3.0";
+  version = "3.56.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-GscHzyWRqERRJXViGkkwx2GyF028XsscihhSYpRqFPY=";
+    hash = "sha256-DgC2qxV9j+r7T1HXchusP2IfI4f1WrS7PEPRN0KFrWs=";
   };
 
   patches = [
@@ -71,6 +71,7 @@ stdenv.mkDerivation rec {
         "org.gnome.evolution.mail" = "evo";
         "org.gnome.evolution.calendar" = "evo";
       };
+      schemaExistsFunction = "e_ews_common_utils_gsettings_schema_exists";
     };
 
     updateScript =
diff --git a/pkgs/by-name/ex/exaile/package.nix b/pkgs/by-name/ex/exaile/package.nix
index 8668a70dbed30..2c6178c8fc0ca 100644
--- a/pkgs/by-name/ex/exaile/package.nix
+++ b/pkgs/by-name/ex/exaile/package.nix
@@ -16,7 +16,7 @@
   librsvg,
   streamripper,
   udisks,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   iconTheme ? adwaita-icon-theme,
   deviceDetectionSupport ? true,
   documentationSupport ? true,
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional multimediaKeySupport keybinder3
     ++ lib.optional (musicBrainzSupport || cdMetadataSupport) python3.pkgs.musicbrainzngs
     ++ lib.optional podcastSupport python3.pkgs.feedparser
-    ++ lib.optional wikipediaSupport webkitgtk_4_0;
+    ++ lib.optional wikipediaSupport webkitgtk_4_1;
 
   nativeCheckInputs = with python3.pkgs; [
     pytest
diff --git a/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix b/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
index 6a3a7f36396b2..65bb8ed57b75a 100644
--- a/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
+++ b/pkgs/by-name/fc/fcitx5-mcbopomofo/package.nix
@@ -31,7 +31,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    extra-cmake-modules
     fcitx5
     fmt
     gtest
diff --git a/pkgs/by-name/fi/five-or-more/package.nix b/pkgs/by-name/fi/five-or-more/package.nix
index f1ac39fdcd3b7..f241567c592a1 100644
--- a/pkgs/by-name/fi/five-or-more/package.nix
+++ b/pkgs/by-name/fi/five-or-more/package.nix
@@ -17,13 +17,13 @@
   vala,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "five-or-more";
-  version = "3.32.3";
+  version = "48.1";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/five-or-more/${lib.versions.majorMinor version}/five-or-more-${version}.tar.xz";
-    hash = "sha256-LRDXLu/esyS0R9YyrwwySW4l/BWjwB230vAMm1HQnvQ=";
+    url = "mirror://gnome/sources/five-or-more/${lib.versions.major finalAttrs.version}/five-or-more-${finalAttrs.version}.tar.xz";
+    hash = "sha256-2UHOLjfqZsDYDx6BeX+8u+To72WnkLPMXla58QtepaM=";
   };
 
   nativeBuildInputs = [
@@ -50,7 +50,9 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    updateScript = gnome.updateScript { packageName = "five-or-more"; };
+    updateScript = gnome.updateScript {
+      packageName = "five-or-more";
+    };
   };
 
   meta = with lib; {
@@ -61,4 +63,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/fl/flac/package.nix b/pkgs/by-name/fl/flac/package.nix
index afc1ac74c150e..d42ca2a679fa8 100644
--- a/pkgs/by-name/fl/flac/package.nix
+++ b/pkgs/by-name/fl/flac/package.nix
@@ -6,12 +6,12 @@
   lib,
   libogg,
   nix-update-script,
-  pandoc,
+  buildPackages,
   pkg-config,
   stdenv,
   versionCheckHook,
+  enableManpages ? buildPackages.pandoc.compiler.bootstrapAvailable,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "flac";
   version = "1.5.0";
@@ -29,13 +29,18 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     doxygen
     graphviz
-    pandoc
     pkg-config
-  ];
+  ] ++ lib.optional enableManpages buildPackages.pandoc;
 
   buildInputs = [ libogg ];
 
-  cmakeFlags = lib.optionals (!stdenv.hostPlatform.isStatic) [ "-DBUILD_SHARED_LIBS=ON" ];
+  cmakeFlags =
+    lib.optionals (!stdenv.hostPlatform.isStatic) [
+      "-DBUILD_SHARED_LIBS=ON"
+    ]
+    ++ lib.optionals (!enableManpages) [
+      "-DINSTALL_MANPAGES=OFF"
+    ];
 
   CFLAGS = [
     "-O3"
@@ -46,13 +51,16 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [ ./package.patch ];
   doCheck = true;
 
-  outputs = [
-    "bin"
-    "dev"
-    "doc"
-    "man"
-    "out"
-  ];
+  outputs =
+    [
+      "bin"
+      "dev"
+      "doc"
+      "out"
+    ]
+    ++ lib.optionals enableManpages [
+      "man"
+    ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/fr/fractal/package.nix b/pkgs/by-name/fr/fractal/package.nix
index e7cb26597bce2..b7ffd27ba01b1 100644
--- a/pkgs/by-name/fr/fractal/package.nix
+++ b/pkgs/by-name/fr/fractal/package.nix
@@ -30,19 +30,19 @@
 
 stdenv.mkDerivation rec {
   pname = "fractal";
-  version = "10.1";
+  version = "11";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "fractal";
     tag = version;
-    hash = "sha256-61xiHVzmLMbLNZlobH6JVcvuO9eoFwqBZBo1rVtPYOc=";
+    hash = "sha256-gb6DHb7pFFAmNQxK1vnBQtVRiMRu0BCvkhACkLeRHXs=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-e3IW8D4aLU6d36ErUHDUDiXF1lN4HCn5OCX6GwaT3iQ=";
+    hash = "sha256-Yc+/aTaIq/9NmdIhHSKixWTwSZRNtxA6p5n9OWkYH/U=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gd/gdm/package.nix b/pkgs/by-name/gd/gdm/package.nix
index 6675a52a7eebe..99967c83fd4d2 100644
--- a/pkgs/by-name/gd/gdm/package.nix
+++ b/pkgs/by-name/gd/gdm/package.nix
@@ -43,7 +43,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdm";
-  version = "47.0";
+  version = "48.0";
 
   outputs = [
     "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdm/${lib.versions.major finalAttrs.version}/gdm-${finalAttrs.version}.tar.xz";
-    hash = "sha256-xYWDJr+8yKzlgTUuK+RGItwOnlwoAchpD9Lu1QJgf4Q=";
+    hash = "sha256-G8Btr/CT7HteN+y0+S5do0dKGxugdu25FR7pZ9HDCt8=";
   };
 
   mesonFlags = [
diff --git a/pkgs/by-name/gh/ghex/package.nix b/pkgs/by-name/gh/ghex/package.nix
index 6ae3dab157cdc..6522a6c75567a 100644
--- a/pkgs/by-name/gh/ghex/package.nix
+++ b/pkgs/by-name/gh/ghex/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ghex";
-  version = "46.2";
+  version = "48.alpha";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/ghex/${lib.versions.major finalAttrs.version}/ghex-${finalAttrs.version}.tar.xz";
-    hash = "sha256-qPJ2o2OXpw0guGL/fGZCQ9nPKJHeub4G10Wk8axmHzE=";
+    hash = "sha256-QP7kmZfZGhkmYmEXDEi7hy+zBupB+2WnIVBghow73+I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gh/ghostscript/package.nix b/pkgs/by-name/gh/ghostscript/package.nix
index 38808f010659b..f663327ee3f5f 100644
--- a/pkgs/by-name/gh/ghostscript/package.nix
+++ b/pkgs/by-name/gh/ghostscript/package.nix
@@ -64,13 +64,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ghostscript${lib.optionalString x11Support "-with-X"}";
-  version = "10.05.0";
+  version = "10.05.1";
 
   src = fetchurl {
     url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${
       lib.replaceStrings [ "." ] [ "" ] version
     }/ghostscript-${version}.tar.xz";
-    hash = "sha256-qsnE/fYYBadvYiABJzXBroMoE3iDFL/AQFXMDIlZuaM=";
+    hash = "sha256-IvK9yhXCiDDJcVzdxcKW6maJi/2rC2BKTgvP6wOvbK0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gi/giara/package.nix b/pkgs/by-name/gi/giara/package.nix
index 6c1aab02df9b9..5f826a8c28020 100644
--- a/pkgs/by-name/gi/giara/package.nix
+++ b/pkgs/by-name/gi/giara/package.nix
@@ -9,7 +9,7 @@
   wrapGAppsHook4,
   gtk4,
   gdk-pixbuf,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   gtksourceview5,
   glib-networking,
   libadwaita,
@@ -43,7 +43,7 @@ python3.pkgs.buildPythonApplication rec {
   buildInputs = [
     gtk4
     gdk-pixbuf
-    webkitgtk_4_0
+    webkitgtk_4_1
     gtksourceview5
     glib-networking
     libadwaita
diff --git a/pkgs/by-name/gj/gjs/package.nix b/pkgs/by-name/gj/gjs/package.nix
index 0b55b40fbce18..5c38bc00413f5 100644
--- a/pkgs/by-name/gj/gjs/package.nix
+++ b/pkgs/by-name/gj/gjs/package.nix
@@ -8,6 +8,7 @@
   pkg-config,
   gnome,
   gtk3,
+  gtk4,
   atk,
   gobject-introspection,
   spidermonkey_128,
@@ -30,6 +31,7 @@
 let
   testDeps = [
     gtk3
+    gtk4
     atk
     pango.out
     gdk-pixbuf
@@ -39,7 +41,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gjs";
-  version = "1.82.1";
+  version = "1.84.2";
 
   outputs = [
     "out"
@@ -49,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+zmqVjZXbeDloRcfVqGlgl4r0aaZcvsSC6eL0Qm1aTw=";
+    hash = "sha256-NRQu3zRXBWNjACkew6fVg/FJaf8/rg/zD0qVseZ0AWY=";
   };
 
   patches = [
@@ -123,6 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $PWD/libgjs.so.0 $out/lib/libgjs.so.0
     ln -s $PWD/subprojects/gobject-introspection-tests/libgimarshallingtests.so $installedTests/libexec/installed-tests/gjs/libgimarshallingtests.so
     ln -s $PWD/subprojects/gobject-introspection-tests/libregress.so $installedTests/libexec/installed-tests/gjs/libregress.so
+    ln -s $PWD/subprojects/gobject-introspection-tests/libutility.so $installedTests/libexec/installed-tests/gjs/libutility.so
     ln -s $PWD/subprojects/gobject-introspection-tests/libwarnlib.so $installedTests/libexec/installed-tests/gjs/libwarnlib.so
     ln -s $PWD/installed-tests/js/libgjstesttools/libgjstesttools.so $installedTests/libexec/installed-tests/gjs/libgjstesttools.so
   '';
@@ -142,6 +145,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   checkPhase = ''
     runHook preCheck
+    GTK_A11Y=none \
+    HOME=$(mktemp -d) \
     xvfb-run -s '-screen 0 800x600x24' \
       meson test --print-errorlogs
     runHook postCheck
diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
index bd0d87bb24765..a6485367bad91 100644
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -74,7 +74,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.82.5";
+  version = "2.84.1";
 
   outputs = [
     "bin"
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-BcIDH5vfa1q6egbKhPC0rO0osZvxtQxqslzGdSd8vD8=";
+    hash = "sha256-K0vC7ElhGl/DX4asqFXy7QGW5p5TCSura7czlr8weJo=";
   };
 
   patches =
diff --git a/pkgs/by-name/gl/glslang/package.nix b/pkgs/by-name/gl/glslang/package.nix
index 6feecafc1612a..47fcfdf24115d 100644
--- a/pkgs/by-name/gl/glslang/package.nix
+++ b/pkgs/by-name/gl/glslang/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "15.1.0";
+  version = "15.3.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = version;
-    hash = "sha256-E1Zenf7XSGoozx4hxdOlMu+XZ6mJROSu7jIVYPWe3go=";
+    hash = "sha256-HwFP4KJuA+BMQVvBWV0BCRj9U5I3CLEU+5bBtde2f6w=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/gl/glycin-loaders/fix-glycin-paths.patch b/pkgs/by-name/gl/glycin-loaders/fix-glycin-paths.patch
index f05edf96a72a9..27b4b14015887 100644
--- a/pkgs/by-name/gl/glycin-loaders/fix-glycin-paths.patch
+++ b/pkgs/by-name/gl/glycin-loaders/fix-glycin-paths.patch
@@ -1,17 +1,17 @@
 diff --git a/vendor/glycin/src/sandbox.rs b/vendor/glycin/src/sandbox.rs
-index 7d00b36..aa70dc7 100644
+index 08db832..4f44b21 100644
 --- a/vendor/glycin/src/sandbox.rs
 +++ b/vendor/glycin/src/sandbox.rs
-@@ -165,7 +165,7 @@ impl Sandbox {
+@@ -202,7 +202,7 @@ impl Sandbox {
  
-                 args.push(self.command);
+                 args.push(self.exec());
  
 -                ("bwrap".into(), args, Some(seccomp_memfd))
 +                ("@bwrap@".into(), args, Some(seccomp_memfd))
              }
              SandboxMechanism::FlatpakSpawn => {
                  let memory_limit = Self::memory_limit();
-@@ -233,8 +233,8 @@ impl Sandbox {
+@@ -299,8 +299,8 @@ impl Sandbox {
                  "/",
                  // Make /usr available as read only
                  "--ro-bind",
diff --git a/pkgs/by-name/gl/glycin-loaders/package.nix b/pkgs/by-name/gl/glycin-loaders/package.nix
index 709c452b709f4..30cb241f5dece 100644
--- a/pkgs/by-name/gl/glycin-loaders/package.nix
+++ b/pkgs/by-name/gl/glycin-loaders/package.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glycin-loaders";
-  version = "1.1.6";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glycin/${lib.versions.majorMinor finalAttrs.version}/glycin-${finalAttrs.version}.tar.xz";
-    hash = "sha256-2EzFaBTyKEEArTQ5pDCDe7IfD5jUbg0rWGifLBlwjwQ=";
+    hash = "sha256-zMV46aPoPQ3BU1c30f2gm6qVxxZ/Xl7LFfeGZUCU7tU=";
   };
 
   patches = [
@@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     description = "Glycin loaders for several formats";
-    homepage = "https://gitlab.gnome.org/sophie-h/glycin";
+    homepage = "https://gitlab.gnome.org/GNOME/glycin";
     teams = [ teams.gnome ];
     license = with licenses; [
       mpl20 # or
diff --git a/pkgs/by-name/gn/gnome-applets/package.nix b/pkgs/by-name/gn/gnome-applets/package.nix
index 71d6ae218bf1b..e5f866eac2cea 100644
--- a/pkgs/by-name/gn/gnome-applets/package.nix
+++ b/pkgs/by-name/gn/gnome-applets/package.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-applets";
-  version = "3.54.0";
+  version = "3.56.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-applets/${lib.versions.majorMinor finalAttrs.version}/gnome-applets-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FASM8amK2U4U715E/f6IVvo/KDZAHHkr/83mi4db2vk=";
+    hash = "sha256-+heu3JVa3ZgaouQ7TAcTU/aGu9HuwdcXqJCnNTIK0XE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-backgrounds/package.nix b/pkgs/by-name/gn/gnome-backgrounds/package.nix
index c2622183607d6..b727b46f8cb27 100644
--- a/pkgs/by-name/gn/gnome-backgrounds/package.nix
+++ b/pkgs/by-name/gn/gnome-backgrounds/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-backgrounds";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-backgrounds/${lib.versions.major version}/gnome-backgrounds-${version}.tar.xz";
-    hash = "sha256-h0pKOcQmFzb2qFRyKDNAC2EkQcRoGqWYLZCxWryckf0=";
+    hash = "sha256-LWuqAR7peATHVh9+HL2NR2PjC1W4gY3aePn3WvuNjQU=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-boxes/package.nix b/pkgs/by-name/gn/gnome-boxes/package.nix
index a8028f1d2097c..a5bc86e04ea07 100644
--- a/pkgs/by-name/gn/gnome-boxes/package.nix
+++ b/pkgs/by-name/gn/gnome-boxes/package.nix
@@ -50,11 +50,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-boxes";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-boxes/${lib.versions.major version}/gnome-boxes-${version}.tar.xz";
-    hash = "sha256-Zb9sLeG/TVFpXJGSxbHmKFyzLJihiqlIo3bqMgOLx48=";
+    hash = "sha256-0F9fQlaPr79tiHcRYbBu1fc51DEhJ41BjK6VxW5RPq0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-builder/package.nix b/pkgs/by-name/gn/gnome-builder/package.nix
index 28bf38d715ade..429899d4c2f99 100644
--- a/pkgs/by-name/gn/gnome-builder/package.nix
+++ b/pkgs/by-name/gn/gnome-builder/package.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-builder";
-  version = "47.2";
+  version = "48.0";
 
   outputs = [
     "out"
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-builder/${lib.versions.major finalAttrs.version}/gnome-builder-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Roe5PEfNHjNmWi3FA3kLYhPugnhy/ABNl40UvL+ptJU=";
+    hash = "sha256-ev6aejs8ZiF2i8RqYdaY3XiLNlP7RqcII4vcz03me6Q=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-calculator/package.nix b/pkgs/by-name/gn/gnome-calculator/package.nix
index ce4880b41f971..54e44104ed3ec 100644
--- a/pkgs/by-name/gn/gnome-calculator/package.nix
+++ b/pkgs/by-name/gn/gnome-calculator/package.nix
@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-calculator";
-  version = "47.1";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-calculator/${lib.versions.major version}/gnome-calculator-${version}.tar.xz";
-    hash = "sha256-vp+SJ5m35+ZclzSLm35kf/4zyDG7OlHTniwWjSrcQOA=";
+    hash = "sha256-vEvUGpuhkPRcvuDYxnUs3F0osM7xxr0MAeLa4fPBkWI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-calendar/package.nix b/pkgs/by-name/gn/gnome-calendar/package.nix
index 7d0ab132ced17..b457a6c1b67de 100644
--- a/pkgs/by-name/gn/gnome-calendar/package.nix
+++ b/pkgs/by-name/gn/gnome-calendar/package.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-calendar";
-  version = "47.0";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-calendar/${lib.versions.major version}/gnome-calendar-${version}.tar.xz";
-    hash = "sha256-OwMxPxxNEtyCHgfiCdFZbVPq+iVdSS0s5av5LtG1HnY=";
+    hash = "sha256-Bs6t1cAL6ONYGB1CHs8mgs4K6i/LEtkDsw0pyjMonwI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-characters/package.nix b/pkgs/by-name/gn/gnome-characters/package.nix
index f02abaee04bf3..73d26f0c44cc6 100644
--- a/pkgs/by-name/gn/gnome-characters/package.nix
+++ b/pkgs/by-name/gn/gnome-characters/package.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-characters";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-characters/${lib.versions.major version}/gnome-characters-${version}.tar.xz";
-    hash = "sha256-a88Foi8w8THYqANbD2PYapVnAHpfbfXOhVa6Bnd7dXQ=";
+    hash = "sha256-osMspU2RHbJARCA1DTRC5pGi3Oiw9dAImfZs/4w8jXE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-chess/package.nix b/pkgs/by-name/gn/gnome-chess/package.nix
index f3ff43b151f06..9c0fb5f950bd5 100644
--- a/pkgs/by-name/gn/gnome-chess/package.nix
+++ b/pkgs/by-name/gn/gnome-chess/package.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-chess";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-chess/${lib.versions.major version}/gnome-chess-${version}.tar.xz";
-    hash = "sha256-OkQ6LHiA5q0TG3Wt2AdO2+WYK3aruEKQT+PfnCxQ6H4=";
+    hash = "sha256-eDTEdvCLvyd5BrApNjLtMugDdMuUQyayGeqQVqapXz8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-clocks/package.nix b/pkgs/by-name/gn/gnome-clocks/package.nix
index 89ee6b4197a28..f27bdc255fbde 100644
--- a/pkgs/by-name/gn/gnome-clocks/package.nix
+++ b/pkgs/by-name/gn/gnome-clocks/package.nix
@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-clocks";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-clocks/${lib.versions.major finalAttrs.version}/gnome-clocks-${finalAttrs.version}.tar.xz";
-    hash = "sha256-QovfS9F+Jt5s7wFM16fuvYkUPD8nMrJLfaaYErqlITE=";
+    hash = "sha256-YW7h+3UwCx8muXZiGelUdRNgyg+g9JExG8+DvzgIfGI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-connections/package.nix b/pkgs/by-name/gn/gnome-connections/package.nix
index b4802ea3bdabe..7213e140b8945 100644
--- a/pkgs/by-name/gn/gnome-connections/package.nix
+++ b/pkgs/by-name/gn/gnome-connections/package.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-connections";
-  version = "47.2.1";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-connections/${lib.versions.major finalAttrs.version}/gnome-connections-${finalAttrs.version}.tar.xz";
-    hash = "sha256-BSPjy4edSsC5Xn7l8y22YSi1q4QE/xGSMHHNVs/k2Lg=";
+    hash = "sha256-Nw75QFBrVybG8rfLl5ayI9HW1Chfg8/DOFvWdMMon9A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-console/package.nix b/pkgs/by-name/gn/gnome-console/package.nix
index d1c557a197e38..ead44457a72e2 100644
--- a/pkgs/by-name/gn/gnome-console/package.nix
+++ b/pkgs/by-name/gn/gnome-console/package.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-console";
-  version = "47.1";
+  version = "48.0.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-console/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-0/YAtFtRcWaRrukocDMunJqMqJ1VNWXzEx2eKAdHJdA=";
+    hash = "sha256-AY6Qjk2uvPyxUNTxuyjZgnKqnRTWgV6vjaRfiJ2wXEk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-contacts/package.nix b/pkgs/by-name/gn/gnome-contacts/package.nix
index 324f08b1c7df4..6addc8e84af30 100644
--- a/pkgs/by-name/gn/gnome-contacts/package.nix
+++ b/pkgs/by-name/gn/gnome-contacts/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-contacts";
-  version = "47.1.1";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-contacts/${lib.versions.major version}/gnome-contacts-${version}.tar.xz";
-    hash = "sha256-R+GuRbcEGgXV4nZJ2RLiwwAlYYisRg7cukaJnGYIpHg=";
+    hash = "sha256-onYplbWUJ+w/GF8otVlONwd7cqcM18GSF+1jRjfswbU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-control-center/package.nix b/pkgs/by-name/gn/gnome-control-center/package.nix
index fc6237c7e98fd..2faeedb56dd31 100644
--- a/pkgs/by-name/gn/gnome-control-center/package.nix
+++ b/pkgs/by-name/gn/gnome-control-center/package.nix
@@ -65,6 +65,7 @@
   tzdata,
   udisks2,
   upower,
+  wayland-scanner,
   libepoxy,
   gnome-user-share,
   gnome-remote-desktop,
@@ -74,11 +75,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-control-center";
-  version = "47.4";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-control-center/${lib.versions.major finalAttrs.version}/gnome-control-center-${finalAttrs.version}.tar.xz";
-    hash = "sha256-KMfbdNcg/MnyE8EtNy5+rMF2ekm8TKZrK9ILD9ECJmg=";
+    hash = "sha256-AYPbNlqqj4W0SyPMnK5nXRyDNgSf7BGoym6pvb6MSP4=";
   };
 
   patches = [
@@ -98,6 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     python3
     shared-mime-info
+    wayland-scanner
     wrapGAppsHook4
   ];
 
diff --git a/pkgs/by-name/gn/gnome-flashback/fix-paths.patch b/pkgs/by-name/gn/gnome-flashback/fix-paths.patch
new file mode 100644
index 0000000000000..f2f37d345ebbb
--- /dev/null
+++ b/pkgs/by-name/gn/gnome-flashback/fix-paths.patch
@@ -0,0 +1,13 @@
+diff --git a/system-indicators/si-input-sources.c b/system-indicators/si-input-sources.c
+index f13b262..2186b76 100644
+--- a/system-indicators/si-input-sources.c
++++ b/system-indicators/si-input-sources.c
+@@ -807,7 +807,7 @@ spawn_keyboard_display (const char *description)
+   flags = G_SPAWN_SEARCH_PATH | G_SPAWN_DO_NOT_REAP_CHILD;
+   error = NULL;
+ 
+-  argv[0] = g_strdup ("tecla");
++  argv[0] = g_strdup ("@tecla@");
+   argv[1] = g_strdup (description);
+   argv[2] = NULL;
+ 
diff --git a/pkgs/by-name/gn/gnome-flashback/package.nix b/pkgs/by-name/gn/gnome-flashback/package.nix
index 5acf060c71cf7..6d64cd8f16cbe 100644
--- a/pkgs/by-name/gn/gnome-flashback/package.nix
+++ b/pkgs/by-name/gn/gnome-flashback/package.nix
@@ -20,7 +20,9 @@
   pkg-config,
   polkit,
   gdm,
+  replaceVars,
   systemd,
+  tecla,
   upower,
   pam,
   wrapGAppsHook3,
@@ -64,13 +66,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-flashback";
-  version = "3.54.0";
+  version = "3.56.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-flashback/${lib.versions.majorMinor finalAttrs.version}/gnome-flashback-${finalAttrs.version}.tar.xz";
-    hash = "sha256-gkNa4wLNZK6xG25M0YTaj/+qzSSFFf+gIidZXDzPne4=";
+    hash = "sha256-LQ+iLzc9sIDq7w5Wk7lijN6ETyVjPVqQMTsEndlSkmA=";
   };
 
+  patches = [
+    (replaceVars ./fix-paths.patch {
+      tecla = lib.getExe tecla;
+    })
+  ];
+
   # make .desktop Execs absolute
   postPatch = ''
     patch -p0 <<END_PATCH
diff --git a/pkgs/by-name/gn/gnome-font-viewer/package.nix b/pkgs/by-name/gn/gnome-font-viewer/package.nix
index 8ff75ba3b3f8d..067bc0f82fdf4 100644
--- a/pkgs/by-name/gn/gnome-font-viewer/package.nix
+++ b/pkgs/by-name/gn/gnome-font-viewer/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-font-viewer";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-font-viewer/${lib.versions.major version}/gnome-font-viewer-${version}.tar.xz";
-    hash = "sha256-uOWgQuCyQbDHyuQ/dNoNX4jmQjAXqR/rhudhfttAgO0=";
+    hash = "sha256-cyYkIxtiT/XHrAOoznG+Ejk9qlNVHRFVCyDXsKOocqc=";
   };
 
   doCheck = true;
diff --git a/pkgs/by-name/gn/gnome-initial-setup/package.nix b/pkgs/by-name/gn/gnome-initial-setup/package.nix
index 76e6436fcf5e2..bc0f06ce9ef84 100644
--- a/pkgs/by-name/gn/gnome-initial-setup/package.nix
+++ b/pkgs/by-name/gn/gnome-initial-setup/package.nix
@@ -37,11 +37,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-initial-setup";
-  version = "47.4";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-initial-setup/${lib.versions.major finalAttrs.version}/gnome-initial-setup-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LAKZ3CtxaBGCNZUNWJijUclMuduP2AjarV1uS6lbh7g=";
+    hash = "sha256-s9q/fnm2Zf8SJB+9umFUiVE9iGIkdZmGr49IZXWSMV4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-keyring/package.nix b/pkgs/by-name/gn/gnome-keyring/package.nix
index 6acf7603a18cf..707b5570068e4 100644
--- a/pkgs/by-name/gn/gnome-keyring/package.nix
+++ b/pkgs/by-name/gn/gnome-keyring/package.nix
@@ -3,6 +3,8 @@
   stdenv,
   fetchurl,
   pkg-config,
+  meson,
+  ninja,
   dbus,
   libgcrypt,
   pam,
@@ -15,16 +17,17 @@
   libselinux,
   p11-kit,
   openssh,
-  wrapGAppsHook3,
+  wrapGAppsNoGuiHook,
   docbook-xsl-nons,
   docbook_xml_dtd_43,
   gnome,
+  writeText,
   useWrappedDaemon ? true,
 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-keyring";
-  version = "46.2";
+  version = "48.0";
 
   outputs = [
     "out"
@@ -33,16 +36,18 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-keyring/${lib.versions.major version}/gnome-keyring-${version}.tar.xz";
-    hash = "sha256-vybJZriot/MoXsyLs+RnucIPlTW5TcRRycVZ3c/2GSU=";
+    hash = "sha256-8gUYySDp6j+cm4tEvoxQ2Nf+7NDdViSWD3e9LKT7650=";
   };
 
   nativeBuildInputs = [
     pkg-config
+    meson
+    ninja
     gettext
     libxslt
     docbook-xsl-nons
     docbook_xml_dtd_43
-    wrapGAppsHook3
+    wrapGAppsNoGuiHook
   ];
 
   buildInputs = [
@@ -61,32 +66,37 @@ stdenv.mkDerivation rec {
     python3
   ];
 
-  configureFlags = [
-    "--with-pkcs11-config=${placeholder "out"}/etc/pkcs11/" # installation directories
-    "--with-pkcs11-modules=${placeholder "out"}/lib/pkcs11/"
+  mesonFlags = [
+    # installation directories
+    "-Dpkcs11-config=${placeholder "out"}/etc/pkcs11" # todo: this should probably be /share/p11-kit/modules
+    "-Dpkcs11-modules=${placeholder "out"}/lib/pkcs11"
     # gnome-keyring doesn't build with ssh-agent by default anymore, we need to
     # switch to using gcr https://github.com/NixOS/nixpkgs/issues/140824
-    "--enable-ssh-agent"
-    # cross compilation requires these paths to be explicitly declared:
-    "LIBGCRYPT_CONFIG=${lib.getExe' (lib.getDev libgcrypt) "libgcrypt-config"}"
-    "SSH_ADD=${lib.getExe' openssh "ssh-add"}"
-    "SSH_AGENT=${lib.getExe' openssh "ssh-agent"}"
+    "-Dssh-agent=true"
+    # TODO: enable socket activation
+    "-Dsystemd=disabled"
+    "--cross-file=${writeText "crossfile.ini" ''
+      [binaries]
+      ssh-add = '${lib.getExe' openssh "ssh-add"}'
+      ssh-agent = '${lib.getExe' openssh "ssh-agent"}'
+    ''}"
   ];
 
   # Tends to fail non-deterministically.
   # - https://github.com/NixOS/nixpkgs/issues/55293
   # - https://github.com/NixOS/nixpkgs/issues/51121
+  # - At least “gnome-keyring:gkm::xdg-store / xdg-trust” is still flaky on 48.beta.
   doCheck = false;
 
-  postPatch = ''
-    patchShebangs build
-  '';
-
   checkPhase = ''
+    runHook postCheck
+
     export HOME=$(mktemp -d)
     dbus-run-session \
       --config-file=${dbus}/share/dbus-1/session.conf \
-      make check
+      meson test --print-errorlogs
+
+    runHook preCheck
   '';
 
   # Use wrapped gnome-keyring-daemon with cap_ipc_lock=ep
@@ -109,7 +119,12 @@ stdenv.mkDerivation rec {
     description = "Collection of components in GNOME that store secrets, passwords, keys, certificates and make them available to applications";
     homepage = "https://gitlab.gnome.org/GNOME/gnome-keyring";
     changelog = "https://gitlab.gnome.org/GNOME/gnome-keyring/-/blob/${version}/NEWS?ref_type=tags";
-    license = licenses.gpl2;
+    license = [
+      # Most of the code (some is 2Plus)
+      licenses.lgpl21Plus
+      # Some stragglers
+      licenses.gpl2Plus
+    ];
     teams = [ teams.gnome ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/by-name/gn/gnome-mahjongg/package.nix b/pkgs/by-name/gn/gnome-mahjongg/package.nix
index b057dac36ec4e..ddc8b0315e7f7 100644
--- a/pkgs/by-name/gn/gnome-mahjongg/package.nix
+++ b/pkgs/by-name/gn/gnome-mahjongg/package.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-mahjongg";
-  version = "47.2";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-mahjongg/${lib.versions.major finalAttrs.version}/gnome-mahjongg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Nd+SZBnzeCY4CjNGIHVjzYfH6ZoT3r4Ok6FAnYXMYVc=";
+    hash = "sha256-3Ujg+BrKNL6tpGxdIhsyWRuO2B6dNhw6JY359rIiLIQ=";
   };
 
   nativeBuildInputs = [
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Disassemble a pile of tiles by removing matching pairs";
     mainProgram = "gnome-mahjongg";
     teams = [ teams.gnome ];
-    license = licenses.gpl3Plus;
+    license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };
 })
diff --git a/pkgs/by-name/gn/gnome-maps/package.nix b/pkgs/by-name/gn/gnome-maps/package.nix
index 2f031a4043bd8..5e1ad264b1a4e 100644
--- a/pkgs/by-name/gn/gnome-maps/package.nix
+++ b/pkgs/by-name/gn/gnome-maps/package.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-maps";
-  version = "47.4";
+  version = "48.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-maps/${lib.versions.major finalAttrs.version}/gnome-maps-${finalAttrs.version}.tar.xz";
-    hash = "sha256-GMXicPtSLP08AD7AEJPgZesvK40bJ4Dfwnngv3dzXgs=";
+    hash = "sha256-rW3WEmiF+xaG7kv0mnh6clfHzF93nlQTQVWmgKMKjLk=";
   };
 
   doCheck = !stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/by-name/gn/gnome-mines/package.nix b/pkgs/by-name/gn/gnome-mines/package.nix
index 1a54b48e18c43..4ffe501953827 100644
--- a/pkgs/by-name/gn/gnome-mines/package.nix
+++ b/pkgs/by-name/gn/gnome-mines/package.nix
@@ -7,26 +7,25 @@
   vala,
   pkg-config,
   gnome,
-  adwaita-icon-theme,
-  gtk3,
-  wrapGAppsHook3,
+  gtk4,
+  libadwaita,
+  wrapGAppsHook4,
   librsvg,
   gettext,
   itstool,
-  python3,
   libxml2,
-  libgnome-games-support,
+  libgnome-games-support_2_0,
   libgee,
   desktop-file-utils,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-mines";
-  version = "40.1";
+  version = "48.1";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gnome-mines/${lib.versions.major version}/gnome-mines-${version}.tar.xz";
-    hash = "sha256-NQLps/ccs7LnEcDmAZGH/rzCvKh349RW3KtwD3vjEnI=";
+    url = "mirror://gnome/sources/gnome-mines/${lib.versions.major finalAttrs.version}/gnome-mines-${finalAttrs.version}.tar.xz";
+    hash = "sha256-70stLd477GFBV+3eTZGJzGr+aSlSot1VsocOLmLtgQQ=";
   };
 
   nativeBuildInputs = [
@@ -36,27 +35,23 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     itstool
-    python3
     libxml2
-    wrapGAppsHook3
+    wrapGAppsHook4
     desktop-file-utils
   ];
 
   buildInputs = [
-    gtk3
+    gtk4
+    libadwaita
+    libgnome-games-support_2_0
     librsvg
-    adwaita-icon-theme
-    libgnome-games-support
     libgee
   ];
 
-  postPatch = ''
-    chmod +x build-aux/meson_post_install.py
-    patchShebangs build-aux/meson_post_install.py
-  '';
-
   passthru = {
-    updateScript = gnome.updateScript { packageName = "gnome-mines"; };
+    updateScript = gnome.updateScript {
+      packageName = "gnome-mines";
+    };
   };
 
   meta = with lib; {
@@ -67,4 +62,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/gn/gnome-music/package.nix b/pkgs/by-name/gn/gnome-music/package.nix
index 5522ed6f3da00..32bfa64b6f783 100644
--- a/pkgs/by-name/gn/gnome-music/package.nix
+++ b/pkgs/by-name/gn/gnome-music/package.nix
@@ -31,13 +31,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gnome-music";
-  version = "47.1";
+  version = "48.0";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-music/${lib.versions.major version}/gnome-music-${version}.tar.xz";
-    hash = "sha256-Zm8XX1YKGtnLq2HqDzA5PKL+0pRrpG5cAOrqEX28cNA=";
+    hash = "sha256-jNqs0FJitjuxYIolrK1RboksMyIyNXy5t/aPLPuG1m4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-nibbles/package.nix b/pkgs/by-name/gn/gnome-nibbles/package.nix
index bd8b259efd127..b82651f754629 100644
--- a/pkgs/by-name/gn/gnome-nibbles/package.nix
+++ b/pkgs/by-name/gn/gnome-nibbles/package.nix
@@ -4,10 +4,10 @@
   fetchurl,
   pkg-config,
   gnome,
+  gsound,
   gtk4,
   wrapGAppsHook4,
   librsvg,
-  gsound,
   gettext,
   itstool,
   vala,
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-nibbles";
-  version = "4.1.0";
+  version = "4.2.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-nibbles/${lib.versions.majorMinor finalAttrs.version}/gnome-nibbles-${finalAttrs.version}.tar.xz";
-    hash = "sha256-YyQb2KFfWRgKYYEgQeLo85hiJn3J5lLz0XNULFUNkpI=";
+    hash = "sha256-Pkofm68cV7joNd7fCGnjJy5lNKHdacTib64QxCAKrwA=";
   };
 
   nativeBuildInputs = [
@@ -42,14 +42,21 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    gsound
     gtk4
     librsvg
-    gsound
     libadwaita
     libgee
     libgnome-games-support_2_0
   ];
 
+  # The "we can link with libadwaita?" valac.links() check fails otherwise.
+  # Command line: `valac testfile.vala --pkg=libadwaita-1 --Xcc=-w --Xcc=-DVALA_STRICT_C` -> 1
+  # testfile.vala.c:50:46: error: passing argument 2 of 'adw_about_dialog_set_developers'
+  # from incompatible pointer type [-Wincompatible-pointer-types]
+  # 50 |         adw_about_dialog_set_developers (ad, s);
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
   passthru = {
     updateScript = gnome.updateScript { packageName = "gnome-nibbles"; };
   };
diff --git a/pkgs/by-name/gn/gnome-online-accounts/package.nix b/pkgs/by-name/gn/gnome-online-accounts/package.nix
index c1ec50a7d782a..9d437660787e3 100644
--- a/pkgs/by-name/gn/gnome-online-accounts/package.nix
+++ b/pkgs/by-name/gn/gnome-online-accounts/package.nix
@@ -32,7 +32,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-online-accounts";
-  version = "3.52.3.1";
+  version = "3.54.2";
 
   outputs =
     [
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-online-accounts/${lib.versions.majorMinor finalAttrs.version}/gnome-online-accounts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Se1yfW/ElHSZb6ft8JGbIeT8hW6jfm4w8XtQsQOvlwE=";
+    hash = "sha256-D389KcBmb/vMUD8+DzOWNi7/25MX1BZkzmXfFH7zU3I=";
   };
 
   mesonFlags = [
diff --git a/pkgs/by-name/gn/gnome-panel/package.nix b/pkgs/by-name/gn/gnome-panel/package.nix
index 5efd8db1e9f10..4ab8da344c094 100644
--- a/pkgs/by-name/gn/gnome-panel/package.nix
+++ b/pkgs/by-name/gn/gnome-panel/package.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-panel";
-  version = "3.54.0";
+  version = "3.56.0";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-panel/${lib.versions.majorMinor finalAttrs.version}/gnome-panel-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lLnNUcpQ/zKiic1QWRNuexYMHxJrXWZp4QbcqIUEXCg=";
+    hash = "sha256-UoptZ92E7a5sgKXuZW+E+9lC87Nx1g+XottgZc9P0XA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-remote-desktop/package.nix b/pkgs/by-name/gn/gnome-remote-desktop/package.nix
index 02cc0c2f34889..b34c9e6eae5b0 100644
--- a/pkgs/by-name/gn/gnome-remote-desktop/package.nix
+++ b/pkgs/by-name/gn/gnome-remote-desktop/package.nix
@@ -13,6 +13,9 @@
   libei,
   libepoxy,
   libdrm,
+  libva,
+  vulkan-loader,
+  shaderc,
   nv-codec-headers-11,
   pipewire,
   systemd,
@@ -31,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-remote-desktop";
-  version = "47.3";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-remote-desktop/${lib.versions.major version}/gnome-remote-desktop-${version}.tar.xz";
-    hash = "sha256-QE2wiHLmkDlD4nUam2Myf2NZcKnKodL2dTCcpEV8+cI=";
+    hash = "sha256-vPN3D8oPrtovrjsaP/by6QoCd492pC6P0QPK4YYo9PI=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +47,7 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
     asciidoc
+    shaderc # for glslc
     wrapGAppsHook3
   ];
 
@@ -58,6 +62,8 @@ stdenv.mkDerivation rec {
     libei
     libepoxy
     libdrm
+    libva
+    vulkan-loader
     nv-codec-headers-11
     libnotify
     libopus
diff --git a/pkgs/by-name/gn/gnome-robots/package.nix b/pkgs/by-name/gn/gnome-robots/package.nix
index 2b31d74aa47d9..f6552990ece8f 100644
--- a/pkgs/by-name/gn/gnome-robots/package.nix
+++ b/pkgs/by-name/gn/gnome-robots/package.nix
@@ -24,17 +24,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-robots";
-  version = "41.1";
+  version = "41.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-robots/${lib.versions.major finalAttrs.version}/gnome-robots-${finalAttrs.version}.tar.xz";
-    hash = "sha256-K4BQcFrIPpOL56iREyYB62XHk/IJzX6RDGzWQphzBHg=";
+    hash = "sha256-kSHC+DaBIEP+7yumYc1dD9SOPWMZxDlBuf3RWLmw65E=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "gnome-robots-${finalAttrs.version}";
-    hash = "sha256-7kwjpZJqAqqKlt6mOFyjaaxZ1Tr2WuhE72jwjCZpX9E=";
+    hash = "sha256-1h9+XPmkapzdYsI6qtPPHtlwEEmyIzaAogLiYvIHJak=";
   };
 
   nativeBuildInputs = [
@@ -62,12 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
     gst_all_1.gst-plugins-good
   ];
 
-  postPatch = ''
-    # https://gitlab.gnome.org/GNOME/gnome-robots/-/merge_requests/38
-    substituteInPlace data/icons/meson.build \
-      --replace-fail 'gtk-update-icon-cache' 'gtk4-update-icon-cache'
-  '';
-
   preFixup = ''
     # Seal GStreamer plug-ins so that we can notice when they are missing.
     gappsWrapperArgs+=(--set "GST_PLUGIN_SYSTEM_PATH_1_0" "$GST_PLUGIN_SYSTEM_PATH_1_0")
@@ -91,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
                   common-updater-scripts
                 ]
               }
-              update-source-version gnome-robots --ignore-same-version --source-key=cargoDeps > /dev/null
+              update-source-version gnome-robots --ignore-same-version --source-key=cargoDeps.vendorStaging > /dev/null
             ''
           ];
           # Experimental feature: do not copy!
diff --git a/pkgs/by-name/gn/gnome-session/fix-paths.patch b/pkgs/by-name/gn/gnome-session/fix-paths.patch
index 38805c645b95f..22f06ddfd2e80 100644
--- a/pkgs/by-name/gn/gnome-session/fix-paths.patch
+++ b/pkgs/by-name/gn/gnome-session/fix-paths.patch
@@ -6,10 +6,10 @@ index b4b1f8fa..99d52cba 100755
     [ "x$XDG_SESSION_CLASS" != "xgreeter" ] &&
     [  -n "$SHELL" ]; then
    if [ "$1" != '-l' ]; then
--    exec bash -c "exec -l '$SHELL' -c '$0 -l $*'"
+-    exec bash -c "exec -l '$SHELL' -c 'exec $0 -l $*'"
 +    # Make sure the shell actually sets up the environment.
 +    unset __NIXOS_SET_ENVIRONMENT_DONE
-+    exec @bash@ -c "exec -l '$SHELL' -c '$0 -l $*'"
++    exec @bash@ -c "exec -l '$SHELL' -c 'exec $0 -l $*'"
    else
      shift
    fi
diff --git a/pkgs/by-name/gn/gnome-session/package.nix b/pkgs/by-name/gn/gnome-session/package.nix
index 0d825cbaa39ab..d60b3ca2d110c 100644
--- a/pkgs/by-name/gn/gnome-session/package.nix
+++ b/pkgs/by-name/gn/gnome-session/package.nix
@@ -34,7 +34,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-session";
   # Also bump ./ctl.nix when bumping major version.
-  version = "47.0.1";
+  version = "48.0";
 
   outputs = [
     "out"
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-session/${lib.versions.major finalAttrs.version}/gnome-session-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Vq6caOSZlXk+sglrzcRTOxEWaeHlTItuCx2VL2peinA=";
+    hash = "sha256-3ZCfvFsizb2y/E3xpH140bWUPMxeYeaiChhGJGNHxBc=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-settings-daemon/package.nix b/pkgs/by-name/gn/gnome-settings-daemon/package.nix
index fedef926e6bf2..afaee31db68f0 100644
--- a/pkgs/by-name/gn/gnome-settings-daemon/package.nix
+++ b/pkgs/by-name/gn/gnome-settings-daemon/package.nix
@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-settings-daemon";
-  version = "47.2";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-settings-daemon/${lib.versions.major finalAttrs.version}/gnome-settings-daemon-${finalAttrs.version}.tar.xz";
-    hash = "sha256-HrdYhi6Ij1WghpGTCH8c+8x6EWNlTmMAmf9DQt0/alo=";
+    hash = "sha256-OGCi6iFNy8tmAK56HjNYpTiSFQh7w+SkfO4/h7ruBi4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-shell-extensions/package.nix b/pkgs/by-name/gn/gnome-shell-extensions/package.nix
index d5f0f7aa07e2c..4f67728257871 100644
--- a/pkgs/by-name/gn/gnome-shell-extensions/package.nix
+++ b/pkgs/by-name/gn/gnome-shell-extensions/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell-extensions";
-  version = "47.4";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell-extensions/${lib.versions.major finalAttrs.version}/gnome-shell-extensions-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VDN57FsNBCAO5iofa6JAcWoJ11rQrd3bIFvjjOgpP1g=";
+    hash = "sha256-m2f8LFgC2hcTp3sZ/6BCMY3XHnva6EN3lsX1GXlTOTw=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-shell/fix-paths.patch b/pkgs/by-name/gn/gnome-shell/fix-paths.patch
index a87f5129152f1..56e7161483261 100644
--- a/pkgs/by-name/gn/gnome-shell/fix-paths.patch
+++ b/pkgs/by-name/gn/gnome-shell/fix-paths.patch
@@ -10,10 +10,10 @@ index de91167c5..1c9965678 100644
 +ExecStart=@gsettings@ set org.gnome.shell disable-user-extensions true
  Restart=no
 diff --git a/js/ui/extensionDownloader.js b/js/ui/extensionDownloader.js
-index 197cc1c1c..dd74aa167 100644
+index 53fd92846..89533cedc 100644
 --- a/js/ui/extensionDownloader.js
 +++ b/js/ui/extensionDownloader.js
-@@ -110,7 +110,7 @@ async function extractExtensionArchive(bytes, dir) {
+@@ -124,7 +124,7 @@ async function extractExtensionArchive(bytes, dir) {
      stream.close_async(GLib.PRIORITY_DEFAULT, null);
  
      const unzip = Gio.Subprocess.new(
@@ -22,7 +22,7 @@ index 197cc1c1c..dd74aa167 100644
          Gio.SubprocessFlags.NONE);
      await unzip.wait_check_async(null);
  
-@@ -132,7 +132,7 @@ async function extractExtensionArchive(bytes, dir) {
+@@ -146,7 +146,7 @@ async function extractExtensionArchive(bytes, dir) {
      }
  
      const compileSchema = Gio.Subprocess.new(
@@ -32,15 +32,15 @@ index 197cc1c1c..dd74aa167 100644
  
      try {
 diff --git a/js/ui/status/keyboard.js b/js/ui/status/keyboard.js
-index fff4e73c2..92859b099 100644
+index 1b43e1051..a31b0a304 100644
 --- a/js/ui/status/keyboard.js
 +++ b/js/ui/status/keyboard.js
-@@ -1092,6 +1092,6 @@ class InputSourceIndicator extends PanelMenu.Button {
-         if (xkbVariant.length > 0)
-             description = `${description}\t${xkbVariant}`;
+@@ -1104,6 +1104,6 @@ class InputSourceIndicator extends PanelMenu.Button {
+     _showLayout() {
+         Main.overview.hide();
  
--        Util.spawn(['tecla', description]);
-+        Util.spawn(['@tecla@', description]);
+-        Util.spawn(['tecla']);
++        Util.spawn(['@tecla@']);
      }
  });
 diff --git a/subprojects/extensions-tool/src/command-install.c b/subprojects/extensions-tool/src/command-install.c
diff --git a/pkgs/by-name/gn/gnome-shell/package.nix b/pkgs/by-name/gn/gnome-shell/package.nix
index 58cffaf69fb7c..8333dad8a2faa 100644
--- a/pkgs/by-name/gn/gnome-shell/package.nix
+++ b/pkgs/by-name/gn/gnome-shell/package.nix
@@ -69,7 +69,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell";
-  version = "47.4";
+  version = "48.1";
 
   outputs = [
     "out"
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major finalAttrs.version}/gnome-shell-${finalAttrs.version}.tar.xz";
-    hash = "sha256-aAuvaU9F+PyDLSRa2mxjtfxLAwzPvrv8Dg47wo2i5G0=";
+    hash = "sha256-uk9FWv1iE/OHVFlG482dqjnJBPerFt2DCsd6c/8QAso=";
   };
 
   patches = [
@@ -183,7 +183,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
-    patchShebangs src/data-to-c.py
+    patchShebangs \
+      src/data-to-c.py \
+      meson/generate-app-list.py
 
     # We can generate it ourselves.
     rm -f man/gnome-shell.1
diff --git a/pkgs/by-name/gn/gnome-software/package.nix b/pkgs/by-name/gn/gnome-software/package.nix
index e6c3e3bd3ae6b..d6d62b5775b72 100644
--- a/pkgs/by-name/gn/gnome-software/package.nix
+++ b/pkgs/by-name/gn/gnome-software/package.nix
@@ -48,11 +48,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-software";
-  version = "47.4";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major finalAttrs.version}/gnome-software-${finalAttrs.version}.tar.xz";
-    hash = "sha256-coHFS5t0jWai55LrjgMxyJec44+vrfct482ZnYDpe08=";
+    hash = "sha256-CEqYUEApTDZFS0ZKIUT5gcAnSQa0xJ1xYT5hztapbo8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gn/gnome-sudoku/package.nix b/pkgs/by-name/gn/gnome-sudoku/package.nix
index 83252077c1765..e7c934d7a60a9 100644
--- a/pkgs/by-name/gn/gnome-sudoku/package.nix
+++ b/pkgs/by-name/gn/gnome-sudoku/package.nix
@@ -10,6 +10,7 @@
   gettext,
   gtk4,
   gnome,
+  blueprint-compiler,
   wrapGAppsHook4,
   libadwaita,
   libgee,
@@ -22,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-sudoku";
-  version = "47.1.1";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-sudoku/${lib.versions.major version}/gnome-sudoku-${version}.tar.xz";
-    hash = "sha256-RyW0KDZGaysqzF5RZrU9jrEczd4lh9tofK+MjUc+uIk=";
+    hash = "sha256-eXE62CpZkEzWlv8CJV627ZNk6I8+eDNDsfnQygnyx+M=";
   };
 
   nativeBuildInputs = [
@@ -39,6 +40,7 @@ stdenv.mkDerivation rec {
     itstool
     libxml2
     desktop-file-utils
+    blueprint-compiler
     wrapGAppsHook4
   ];
 
diff --git a/pkgs/by-name/gn/gnome-system-monitor/package.nix b/pkgs/by-name/gn/gnome-system-monitor/package.nix
index 71f395a5e5b73..fa8aae787c36c 100644
--- a/pkgs/by-name/gn/gnome-system-monitor/package.nix
+++ b/pkgs/by-name/gn/gnome-system-monitor/package.nix
@@ -7,6 +7,7 @@
   gtkmm4,
   libxml2,
   bash,
+  catch2_3,
   gtk4,
   libadwaita,
   glib,
@@ -25,11 +26,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-system-monitor";
-  version = "47.1";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-system-monitor/${lib.versions.major finalAttrs.version}/gnome-system-monitor-${finalAttrs.version}.tar.xz";
-    hash = "sha256-08VxT9kfp/BdZ3XmeXzNqzFJ8THRqndqM1LirdsRDwE=";
+    hash = "sha256-Ezw6bihjZuZZ/S2AWCQJp71e2uRW5jxPacz2btb8Zjg=";
   };
 
   patches = [
@@ -49,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     bash
+    catch2_3
     gtk4
     libadwaita
     glib
diff --git a/pkgs/by-name/gn/gnome-tecla/package.nix b/pkgs/by-name/gn/gnome-tecla/package.nix
index 456a8263405da..e08ec43dd48fe 100644
--- a/pkgs/by-name/gn/gnome-tecla/package.nix
+++ b/pkgs/by-name/gn/gnome-tecla/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tecla";
-  version = "47.0";
+  version = "48.0.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/tecla/${lib.versions.major finalAttrs.version}/tecla-${finalAttrs.version}.tar.xz";
-    hash = "sha256-B5C5nsKRN6VLVGxRBmGpmqbwOcjXXxDAjpKGgsCAT+U=";
+    hash = "sha256-eD00ZNKiz36xUHZJ29n/Cc4khSwqbJoNNl24QGPT1AE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-terminal/package.nix b/pkgs/by-name/gn/gnome-terminal/package.nix
index c090f1b949a7a..4bcf840b4397e 100644
--- a/pkgs/by-name/gn/gnome-terminal/package.nix
+++ b/pkgs/by-name/gn/gnome-terminal/package.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-terminal";
-  version = "3.54.4";
+  version = "3.56.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-terminal/${lib.versions.majorMinor finalAttrs.version}/gnome-terminal-${finalAttrs.version}.tar.xz";
-    hash = "sha256-RDqAaJM3EI5LGQOZlp5mq6BBzDxju5nFc4Ul1SixMrg=";
+    hash = "sha256-ojB1PlC9Qx27EwDhV7/XMXMA4lIm/zCJMxY2OhOGT/g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-text-editor/package.nix b/pkgs/by-name/gn/gnome-text-editor/package.nix
index 3cca898d5b845..289c59cabc832 100644
--- a/pkgs/by-name/gn/gnome-text-editor/package.nix
+++ b/pkgs/by-name/gn/gnome-text-editor/package.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-text-editor";
-  version = "47.3";
+  version = "48.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-text-editor/${lib.versions.major finalAttrs.version}/gnome-text-editor-${finalAttrs.version}.tar.xz";
-    hash = "sha256-RsZyv+huRN6YB5djaigPBcxer2zem0LcS8yVZAVilyU=";
+    hash = "sha256-/B9dR1vdJ9TAQ5pbj+ENbkAbQvHbo9BLdWeDkDbuICs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-tour/package.nix b/pkgs/by-name/gn/gnome-tour/package.nix
index cee095a78c627..17bf79a473bbb 100644
--- a/pkgs/by-name/gn/gnome-tour/package.nix
+++ b/pkgs/by-name/gn/gnome-tour/package.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-tour";
-  version = "47.0";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-tour/${lib.versions.major finalAttrs.version}/gnome-tour-${finalAttrs.version}.tar.xz";
-    hash = "sha256-cvqvieAGyJMkp+FXIEaRaWGziuujj21tTMQePT1GaUQ=";
+    hash = "sha256-uKA7JXTrlWq+mvFBQWHMsX+DDVNgC5wEmc7zu29BJ8U=";
   };
 
   cargoVendorDir = "vendor";
diff --git a/pkgs/by-name/gn/gnome-usage/package.nix b/pkgs/by-name/gn/gnome-usage/package.nix
index 8be45e2786548..059aadd85b82c 100644
--- a/pkgs/by-name/gn/gnome-usage/package.nix
+++ b/pkgs/by-name/gn/gnome-usage/package.nix
@@ -12,20 +12,22 @@
   wrapGAppsHook4,
   glib,
   gtk4,
+  json-glib,
   libadwaita,
   libgee,
   libgtop,
+  networkmanager,
   gnome,
   tinysparql,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-usage";
-  version = "46.0";
+  version = "48.rc";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-GGrajgAYjIn4yrVPNZmO2XpG6rb9shiRAoNhvzhqybI=";
+    url = "mirror://gnome/sources/gnome-usage/${lib.versions.major finalAttrs.version}/gnome-usage-${finalAttrs.version}.tar.xz";
+    hash = "sha256-LUbc2QcKkY/sMUdxaaQDI2CdCFa5XHo3wBusqULTk+w=";
   };
 
   nativeBuildInputs = [
@@ -42,9 +44,11 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib
     gtk4
+    json-glib
     libadwaita
     libgee
     libgtop
+    networkmanager
     tinysparql
   ];
 
@@ -55,7 +59,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "gnome-usage";
     };
   };
 
@@ -67,4 +71,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     teams = [ teams.gnome ];
   };
-}
+})
diff --git a/pkgs/by-name/gn/gnome-user-docs/package.nix b/pkgs/by-name/gn/gnome-user-docs/package.nix
index 6c7b2a4664b43..cb51a99aeba86 100644
--- a/pkgs/by-name/gn/gnome-user-docs/package.nix
+++ b/pkgs/by-name/gn/gnome-user-docs/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-user-docs";
-  version = "47.2";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-user-docs/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-2b8IuabChNHgT2/pI3pt7trRYeDlungQv/7PKF4rzd8=";
+    hash = "sha256-rJc9kk4AVFoUWNhqEQ1Hc+a743w3KEDXbtZAyyaMYf0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gn/gnome-user-share/package.nix b/pkgs/by-name/gn/gnome-user-share/package.nix
index 06c91bfce2dfd..b49dd59173c8b 100644
--- a/pkgs/by-name/gn/gnome-user-share/package.nix
+++ b/pkgs/by-name/gn/gnome-user-share/package.nix
@@ -5,15 +5,19 @@
   gettext,
   meson,
   ninja,
+  rustc,
+  rustPlatform,
+  cargo,
   fetchurl,
   apacheHttpdPackages,
   pkg-config,
   glib,
   libxml2,
-  systemd,
   wrapGAppsNoGuiHook,
   itstool,
   gnome,
+  _experimental-update-script-combinators,
+  common-updater-scripts,
 }:
 
 let
@@ -22,18 +26,28 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-user-share";
-  version = "47.2";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-user-share/${lib.versions.major finalAttrs.version}/gnome-user-share-${finalAttrs.version}.tar.xz";
-    hash = "sha256-H6wbuIAN+kitnD4ZaQ9+EOZ6T5lNnLF8rh0b3/yRRLo=";
+    hash = "sha256-tVgFBwGVwvZYQVuc0shbLNFOqYHWGCOlANTWK4v4OAE=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    name = "gnome-user-share-${finalAttrs.version}";
+    hash = "sha256-tQoP0yBOCesj2kwgBUoqmcVtFttwML2N+wfSULtfC4w=";
   };
 
   preConfigure =
     ''
-      sed -e 's,^LoadModule dnssd_module.\+,LoadModule dnssd_module ${mod_dnssd}/modules/mod_dnssd.so,' \
-        -e 's,''${HTTP_MODULES_PATH},${apacheHttpd}/modules,' \
-        -i data/dav_user_2.4.conf
+      substituteInPlace data/dav_user_2.4.conf \
+        --replace-fail \
+          'LoadModule dnssd_module ''${HTTP_MODULES_PATH}/mod_dnssd.so' \
+          'LoadModule dnssd_module ${mod_dnssd}/modules/mod_dnssd.so' \
+        --replace-fail \
+          '${"$"}{HTTP_MODULES_PATH}' \
+          '${apacheHttpd}/modules'
     ''
     + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
       substituteInPlace meson.build --replace-fail \
@@ -51,6 +65,9 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     meson
     ninja
+    rustc
+    rustPlatform.cargoSetupHook
+    cargo
     gettext
     glib # for glib-compile-schemas
     itstool
@@ -60,16 +77,39 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     glib
-    systemd
   ];
 
   doCheck = true;
   strictDeps = true;
 
   passthru = {
-    updateScript = gnome.updateScript {
-      packageName = "gnome-user-share";
-    };
+    updateScript =
+      let
+        updateSource = gnome.updateScript {
+          packageName = "gnome-user-share";
+        };
+
+        updateLockfile = {
+          command = [
+            "sh"
+            "-c"
+            ''
+              PATH=${
+                lib.makeBinPath [
+                  common-updater-scripts
+                ]
+              }
+              update-source-version gnome-user-share --ignore-same-version --source-key=cargoDeps.vendorStaging > /dev/null
+            ''
+          ];
+          # Experimental feature: do not copy!
+          supportedFeatures = [ "silent" ];
+        };
+      in
+      _experimental-update-script-combinators.sequence [
+        updateSource
+        updateLockfile
+      ];
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/gn/gnome-weather/package.nix b/pkgs/by-name/gn/gnome-weather/package.nix
index c834526790785..aecb98b3d246c 100644
--- a/pkgs/by-name/gn/gnome-weather/package.nix
+++ b/pkgs/by-name/gn/gnome-weather/package.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-weather";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-weather/${lib.versions.major version}/gnome-weather-${version}.tar.xz";
-    hash = "sha256-UV9YYjdN00bLyFqd3wMGstMnZXhQu2C2ycmGD86WIOY=";
+    hash = "sha256-TAVps9gVri+UFtRxNMvTBWNAZA/xhtMalMhlgTtL27U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gr/grpc/package.nix b/pkgs/by-name/gr/grpc/package.nix
index 55f55853d9c46..25667a32a657d 100644
--- a/pkgs/by-name/gr/grpc/package.nix
+++ b/pkgs/by-name/gr/grpc/package.nix
@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.71.0"; # N.B: if you change this, please update:
+  version = "1.72.0"; # N.B: if you change this, please update:
   # pythonPackages.grpcio
   # pythonPackages.grpcio-channelz
   # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-QKSdMpfl0pdKy/r4z8VKcGN0gsQmx9lBRHlCjaaF5Sg=";
+    hash = "sha256-3ZFQ59zoxNlS5tdm5Bt8EyKyp+9HEpYvLlWarErIR6g=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix b/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix
index f14ffaded9a5e..61baf68d5f801 100644
--- a/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix
+++ b/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gsettings-desktop-schemas";
-  version = "47.1";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-pgIE2cnAobJk1tDRNKODQLpfxgdqNLhNqUXYv8x6KBU=";
+    hash = "sha256-5o8VWBO/GPhlqLLI6dRzWItsytyvu2Zqt4iFfGwtG9M=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/gt/gtk-frdp/package.nix b/pkgs/by-name/gt/gtk-frdp/package.nix
index ca436b7412228..9196214e4616e 100644
--- a/pkgs/by-name/gt/gtk-frdp/package.nix
+++ b/pkgs/by-name/gt/gtk-frdp/package.nix
@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation {
   pname = "gtk-frdp";
-  version = "0-unstable-2024-12-23";
+  version = "0-unstable-2025-03-14";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gtk-frdp";
-    rev = "46ca0beb9b5bf8c9b245a596231016bcca9baf6b";
-    sha256 = "zRC3YVe2WwOmVzEDaJwsct3YQ4ZbvYTr2CTyRmfCXFY=";
+    rev = "a0187fa02e1ff249e9583e8c09a2c2f5915ce2a3";
+    hash = "sha256-oi4Iwi9/elfUDKK0IhoNgtS8ORIzVUBagqBVdNRxGjI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gu/gupnp-igd/package.nix b/pkgs/by-name/gu/gupnp-igd/package.nix
index 7d26c68a68bc9..245f9bbcb4d92 100644
--- a/pkgs/by-name/gu/gupnp-igd/package.nix
+++ b/pkgs/by-name/gu/gupnp-igd/package.nix
@@ -11,13 +11,13 @@
   docbook_xsl,
   docbook_xml_dtd_412,
   glib,
-  gupnp,
+  gupnp_1_6,
   gnome,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gupnp-igd";
-  version = "1.2.0";
+  version = "1.6.0";
 
   outputs = [
     "out"
@@ -25,8 +25,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-S1EgCYqhPt0ngYup7k1/6WG/VAv1DQVv9wPGFUXgK+E=";
+    url = "mirror://gnome/sources/gupnp-igd/${lib.versions.majorMinor finalAttrs.version}/gupnp-igd-${finalAttrs.version}.tar.xz";
+    hash = "sha256-QJmXgzmrIhJtSWjyozK20JT8RMeHl4YHgfH8LxF3G3Q=";
   };
 
   depsBuildBuild = [
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [
     glib
-    gupnp
+    gupnp_1_6
   ];
 
   mesonFlags = [
@@ -56,20 +56,19 @@ stdenv.mkDerivation rec {
 
   # Seems to get stuck sometimes.
   # https://github.com/NixOS/nixpkgs/issues/119288
-  #doCheck = true;
+  # doCheck = true;
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "gupnp-igd";
       versionPolicy = "odd-unstable";
-      freeze = true;
     };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Library to handle UPnP IGD port mapping";
     homepage = "http://www.gupnp.org/";
-    license = licenses.lgpl21Plus;
-    platforms = platforms.unix;
+    license = lib.licenses.lgpl21Plus;
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/gu/gupnp-tools/package.nix b/pkgs/by-name/gu/gupnp-tools/package.nix
index 112cb1dde0a3a..24e29a70b0fb8 100644
--- a/pkgs/by-name/gu/gupnp-tools/package.nix
+++ b/pkgs/by-name/gu/gupnp-tools/package.nix
@@ -16,13 +16,13 @@
   wrapGAppsHook3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gupnp-tools";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "U8+TEj85fo+PC46eQ2TIanUCpTNPTAvi4FSoJEeL1bo=";
+    url = "mirror://gnome/sources/gupnp-tools/${lib.versions.majorMinor finalAttrs.version}/gupnp-tools-${finalAttrs.version}.tar.xz";
+    sha256 = "TJLy0aPUVOwfX7Be8IyjTfnHQ69kyLWWXDWITUbLAFw=";
   };
 
   nativeBuildInputs = [
@@ -42,13 +42,9 @@ stdenv.mkDerivation rec {
     gtksourceview4
   ];
 
-  # new libxml2 version
-  # TODO: can be dropped on next update
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];
-
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "gupnp-tools";
       versionPolicy = "odd-unstable";
     };
   };
@@ -60,4 +56,4 @@ stdenv.mkDerivation rec {
     teams = [ teams.gnome ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/gv/gvfs/package.nix b/pkgs/by-name/gv/gvfs/package.nix
index 331b434640dc2..b44ec36390a35 100644
--- a/pkgs/by-name/gv/gvfs/package.nix
+++ b/pkgs/by-name/gv/gvfs/package.nix
@@ -47,11 +47,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvfs";
-  version = "1.56.1";
+  version = "1.57.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gvfs/${lib.versions.majorMinor finalAttrs.version}/gvfs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-hnMczsZ5ZI+HNOI3sd4ZDr3ubkyMD1b0VMMViOUJqhA=";
+    hash = "sha256-8Wvvjsof1sEX6F2wEdIekVZpeQ1VhnNJxfGykSmelYU=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gz/gz-cmake/package.nix b/pkgs/by-name/gz/gz-cmake/package.nix
index 215ebb8d98bc5..6ab3dcebd263d 100644
--- a/pkgs/by-name/gz/gz-cmake/package.nix
+++ b/pkgs/by-name/gz/gz-cmake/package.nix
@@ -6,16 +6,22 @@
   doxygen,
   graphviz,
   pkg-config,
+  python3,
+  nix-update-script,
 }:
+let
+  version = "4.2.0";
+  versionPrefix = "gz-cmake${lib.versions.major version}";
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gz-cmake";
-  version = "4.1.1";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "gazebosim";
     repo = "gz-cmake";
-    tag = "gz-cmake${lib.versions.major finalAttrs.version}_${finalAttrs.version}";
-    hash = "sha256-BWgRm+3UW65Cu7TqXtFFG05JlYF52dbpAsIE8aDnJM0=";
+    tag = "${versionPrefix}_${finalAttrs.version}";
+    hash = "sha256-+bMOcGWfcwPhxR9CBp4iH02CZC4oplCjsTDpPDsDnSs=";
   };
 
   nativeBuildInputs = [
@@ -25,6 +31,26 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  cmakeFlags = [
+    (lib.cmakeBool "BUILDSYSTEM_TESTING" finalAttrs.doCheck)
+  ];
+
+  nativeCheckInputs = [ python3 ];
+
+  # 98% tests passed, 1 tests failed out of 44
+  # 44 - c_child_requires_c_nodep (Failed)
+  #
+  # Package gz-c_child_private was not found in the pkg-config search path.
+  # Perhaps you should add the directory containing `gz-c_child_private.pc'
+  # to the PKG_CONFIG_PATH environment variable
+  # No package 'gz-c_child_private' found
+  doCheck = false;
+
+  # Extract the version by matching the tag's prefix.
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex=${versionPrefix}_([\\d\\.]+)" ];
+  };
+
   meta = {
     description = "CMake modules to build Gazebo projects";
     homepage = "https://github.com/gazebosim/gz-cmake";
diff --git a/pkgs/by-name/hy/hyprland/info.json b/pkgs/by-name/hy/hyprland/info.json
index ad4f188f971b7..bb4eebd26adde 100644
--- a/pkgs/by-name/hy/hyprland/info.json
+++ b/pkgs/by-name/hy/hyprland/info.json
@@ -1,7 +1,7 @@
 {
-  "branch": "v0.48.1-b",
-  "commit_hash": "29e2e59fdbab8ed2cc23a20e3c6043d5decb5cdc",
-  "commit_message": "version: bump to v0.48.1",
-  "date": "2025-03-28",
-  "tag": "v0.48.1"
+  "branch": "main",
+  "commit_hash": "9958d297641b5c84dcff93f9039d80a5ad37ab00",
+  "commit_message": "version: bump to 0.49.0",
+  "date": "2025-05-08",
+  "tag": "v0.49.0"
 }
diff --git a/pkgs/by-name/hy/hyprland/package.nix b/pkgs/by-name/hy/hyprland/package.nix
index 9b84b0beb8d04..4ad3601c78f85 100644
--- a/pkgs/by-name/hy/hyprland/package.nix
+++ b/pkgs/by-name/hy/hyprland/package.nix
@@ -86,14 +86,14 @@ assert assertMsg (!hidpiXWayland)
 
 customStdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + optionalString debug "-debug";
-  version = "0.48.1";
+  version = "0.49.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprland";
     fetchSubmodules = true;
     tag = "v${finalAttrs.version}";
-    hash = "sha256-skuJFly6LSFfyAVy2ByNolkEwIijsTu2TxzQ9ugWarI=";
+    hash = "sha256-3RVRQr+2WKBflZSsoLym9RwyqHWPk/J5WRtuJ0hgA+g=";
   };
 
   postPatch = ''
@@ -102,10 +102,6 @@ customStdenv.mkDerivation (finalAttrs: {
 
     # Remove extra @PREFIX@ to fix pkg-config paths
     sed -i "s#@PREFIX@/##g" hyprland.pc.in
-
-    substituteInPlace protocols/meson.build --replace-fail \
-      "wayland_scanner = dependency('wayland-scanner')" \
-      "wayland_scanner = dependency('wayland-scanner', native: true)"
   '';
 
   # variables used by generateVersion.sh script, and shown in `hyprctl version`
diff --git a/pkgs/by-name/im/imlib2/package.nix b/pkgs/by-name/im/imlib2/package.nix
index 0e3ba1ecf3b6d..752b3dfb88827 100644
--- a/pkgs/by-name/im/imlib2/package.nix
+++ b/pkgs/by-name/im/imlib2/package.nix
@@ -43,11 +43,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "imlib2";
-  version = "1.12.4";
+  version = "1.12.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/imlib2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-vwf/CSVe0w8FocJS1LV4QmwtzbvCjoxxSt8GBpA5VyA=";
+    hash = "sha256-+iMV8oN5tDCm5mBbQoSwe+BqPvQi1PXhybskcUxM9t0=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/ju/juce/package.nix b/pkgs/by-name/ju/juce/package.nix
index 16956d078fc91..f2a5779e737dc 100644
--- a/pkgs/by-name/ju/juce/package.nix
+++ b/pkgs/by-name/ju/juce/package.nix
@@ -13,7 +13,7 @@
   freetype,
   curl,
   libglvnd,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   pcre2,
   libsysprof-capture,
   util-linuxMinimal,
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib # libasound.so
       libglvnd # libGL.so
-      webkitgtk_4_0 # webkit2gtk-4.0
+      webkitgtk_4_1 # webkit2gtk-4.0
       util-linuxMinimal
       libselinux
       libsepol
diff --git a/pkgs/by-name/ju/just-lsp/package.nix b/pkgs/by-name/ju/just-lsp/package.nix
index f6c7c53b8cb9f..a153eb5bb1d77 100644
--- a/pkgs/by-name/ju/just-lsp/package.nix
+++ b/pkgs/by-name/ju/just-lsp/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "just-lsp";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "terror";
     repo = "just-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-MBkuLvMwAH0858X0TRAK1pL/JwsTIY/6Ra+Vd6X0odA=";
+    hash = "sha256-lR3VtPS96gPUj4OVZLeQSHnss22hBTRBLUV8n2Y3E9M=";
   };
 
-  cargoHash = "sha256-gVxWy8SGvAaavrdZHK/9aKfPAXUtfs98TyFKFkFa3+U=";
+  cargoHash = "sha256-eDjUYB5AN56hxolizw0KYb0Z/k28OWOUYOxhB/5pKV0=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/li/libadwaita/package.nix b/pkgs/by-name/li/libadwaita/package.nix
index 95bec3c799270..3a224ecaa0e13 100644
--- a/pkgs/by-name/li/libadwaita/package.nix
+++ b/pkgs/by-name/li/libadwaita/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.6.4";
+  version = "1.7.2";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     rev = finalAttrs.version;
-    hash = "sha256-7AI8Eb6o/Gysli9CprwsgAzz1cGmNU79Qm7OzlsaTFw=";
+    hash = "sha256-3QrFoUaQe2uIUTV/D4Da31o9Ee2d39/9mz1Is1/x3As=";
   };
 
   depsBuildBuild = [
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   mesonFlags =
     [
-      "-Dgtk_doc=true"
+      "-Ddocumentation=true"
     ]
     ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
       "-Dtests=false"
diff --git a/pkgs/by-name/li/libapparmor/package.nix b/pkgs/by-name/li/libapparmor/package.nix
index b7c4b3db494e9..a0b305a85653a 100644
--- a/pkgs/by-name/li/libapparmor/package.nix
+++ b/pkgs/by-name/li/libapparmor/package.nix
@@ -60,24 +60,14 @@ stdenv.mkDerivation (finalAttrs: {
       ncurses
       which
       dejagnu
+      perl # podchecker
     ]
     ++ lib.optionals withPython [
       python3Packages.setuptools
-    ]
-    ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
-      # TODO FIXME This is a super ugly HACK.
-      # perl is required for podchecker.
-      # It is a native build input on native platform because checks are enabled there.
-      # Checks can't be enabled on cross, but moving perl to
-      # nativeCheckInputs causes rebuilds on native compile.
-      # Thus, hacks!
-      # This should just be made unconditional and removed from nativeCheckInputs.
-      perl
     ];
 
   nativeCheckInputs = [
     python3Packages.pythonImportsCheckHook
-    perl
   ];
 
   buildInputs =
diff --git a/pkgs/by-name/li/libcamera/package.nix b/pkgs/by-name/li/libcamera/package.nix
index b9e321fd4dcf7..323d49b427c39 100644
--- a/pkgs/by-name/li/libcamera/package.nix
+++ b/pkgs/by-name/li/libcamera/package.nix
@@ -17,6 +17,7 @@
   python3,
   python3Packages,
   systemd, # for libudev
+  libpisp,
   withTracing ? lib.meta.availableOn stdenv.hostPlatform lttng-ust,
   lttng-ust, # withTracing
   withQcam ? false,
@@ -26,12 +27,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-m55SojGt5v5AEatBZiVqQA3xP9eeRWqHa+C3JsTiErQ=";
+    hash = "sha256-zlMjeLlEeigzisVr7kWVrTI5gRbpJb2pZvqXNdErITQ=";
   };
 
   outputs = [
@@ -85,6 +86,7 @@ stdenv.mkDerivation rec {
 
       gtest
     ]
+    ++ lib.optionals stdenv.hostPlatform.isAarch [ libpisp ]
     ++ lib.optionals withTracing [ lttng-ust ]
     ++ lib.optionals withQcam [
       libtiff
diff --git a/pkgs/by-name/li/libcdio/package.nix b/pkgs/by-name/li/libcdio/package.nix
index 73f1f6de7667b..94a8d43df4b4d 100644
--- a/pkgs/by-name/li/libcdio/package.nix
+++ b/pkgs/by-name/li/libcdio/package.nix
@@ -11,6 +11,7 @@
   ncurses,
   help2man,
   libiconv,
+  withMan ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,26 +29,38 @@ stdenv.mkDerivation (finalAttrs: {
     NIX_CFLAGS_COMPILE = "-D_LARGEFILE64_SOURCE";
   };
 
-  postPatch = ''
-    patchShebangs .
-    echo "
-    @set UPDATED 1 January 1970
-    @set UPDATED-MONTH January 1970
-    @set EDITION ${finalAttrs.version}
-    @set VERSION ${finalAttrs.version}
-    " > doc/version.texi
-  '';
+  postPatch =
+    ''
+      patchShebangs .
+      echo "
+      @set UPDATED 1 January 1970
+      @set UPDATED-MONTH January 1970
+      @set EDITION ${finalAttrs.version}
+      @set VERSION ${finalAttrs.version}
+      " > doc/version.texi
+    ''
+    + lib.optionalString (!withMan) ''
+      substituteInPlace src/Makefile.am \
+        --replace-fail 'man_cd_drive     = cd-drive.1' "" \
+        --replace-fail 'man_cd_info     = cd-info.1' "" \
+        --replace-fail 'man_cd_read     = cd-read.1' "" \
+        --replace-fail 'man_iso_info     = iso-info.1' "" \
+        --replace-fail 'man_iso_read     = iso-read.1' ""
+    '';
 
   configureFlags = [
-    (lib.enableFeature true "maintainer-mode")
+    (lib.enableFeature withMan "maintainer-mode")
   ];
 
-  nativeBuildInputs = [
-    pkg-config
-    help2man
-    autoreconfHook
-    texinfo
-  ];
+  nativeBuildInputs =
+    [
+      pkg-config
+      autoreconfHook
+      texinfo
+    ]
+    ++ lib.optionals withMan [
+      help2man
+    ];
 
   buildInputs = [
     libcddb
@@ -59,13 +72,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = !stdenv.hostPlatform.isDarwin;
 
-  outputs = [
-    "out"
-    "lib"
-    "dev"
-    "info"
-    "man"
-  ];
+  outputs =
+    [
+      "out"
+      "lib"
+      "dev"
+      "info"
+    ]
+    ++ lib.optionals withMan [
+      "man"
+    ];
 
   passthru = {
     tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
diff --git a/pkgs/by-name/li/libconfig/package.nix b/pkgs/by-name/li/libconfig/package.nix
index 409a25de54832..97a81eb7456b7 100644
--- a/pkgs/by-name/li/libconfig/package.nix
+++ b/pkgs/by-name/li/libconfig/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   # This also disables building tests.
   # on static windows cross-compile they fail to build
   doCheck ? with stdenv.hostPlatform; !(isWindows && isStatic),
@@ -9,13 +10,24 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libconfig";
-  version = "1.7.3";
+  version = "1.8";
 
   src = fetchurl {
     url = "https://hyperrealm.github.io/${finalAttrs.pname}/dist/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
-    hash = "sha256-VFFm1srAN3RDgdHpzFpUBQlOe/rRakEWmbz/QLuzHuc=";
+    hash = "sha256-BR4V3Q6QfESQXzF5M/VIcxTypW6MZybIMEzpkIhIUKo=";
   };
 
+  patches = [
+    # Fix tests on i686-linux:
+    #   https://github.com/hyperrealm/libconfig/pull/260
+    # TODO: remove with a next release
+    (fetchpatch {
+      name = "32-bit-tests.patch";
+      url = "https://github.com/hyperrealm/libconfig/commit/b90c45a18110fcca415d00a98ff79c908c42544b.patch";
+      hash = "sha256-8CihXbpKx0Rn0CFxyP6+f6m8vUYehCl/1EtTo98VpfM=";
+    })
+  ];
+
   inherit doCheck;
 
   configureFlags =
diff --git a/pkgs/by-name/li/libdex/package.nix b/pkgs/by-name/li/libdex/package.nix
index b6f528c23c194..a7a060d9dc6d6 100644
--- a/pkgs/by-name/li/libdex/package.nix
+++ b/pkgs/by-name/li/libdex/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdex";
-  version = "0.8.1";
+  version = "0.10.0";
 
   outputs = [
     "out"
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libdex/${lib.versions.majorMinor finalAttrs.version}/libdex-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lVR1rT5Dqr1vb3BDUmS17ne9JlvZVUUhH+4CawjTeKA=";
+    hash = "sha256-mKaWJqp2Rq1FW+p6f5LSof+kfkVZoVShv+mMFvpxHuE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libepoxy/package.nix b/pkgs/by-name/li/libepoxy/package.nix
index 1a99df8bdf558..236b97dd0511b 100644
--- a/pkgs/by-name/li/libepoxy/package.nix
+++ b/pkgs/by-name/li/libepoxy/package.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
-  buildInputs =
+  propagatedBuildInputs =
     lib.optionals (x11Support && !stdenv.hostPlatform.isDarwin) [
       libGL
     ]
diff --git a/pkgs/by-name/li/libevdev/package.nix b/pkgs/by-name/li/libevdev/package.nix
index 5d56ee62fe64d..dab1e65b15088 100644
--- a/pkgs/by-name/li/libevdev/package.nix
+++ b/pkgs/by-name/li/libevdev/package.nix
@@ -2,19 +2,23 @@
   lib,
   stdenv,
   fetchurl,
+  pkg-config,
   python3,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libevdev";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-q/GqzoYgjuvdXTVQ/97UyNc7tAW3ltUcOJydBgTLz78=";
+    hash = "sha256-8Aq41CrYuQUpb6tn4TuHHxpCSDkzFRZkIQD4KtiBJ80=";
   };
 
-  nativeBuildInputs = [ python3 ];
+  nativeBuildInputs = [
+    pkg-config
+    python3
+  ];
 
   meta = with lib; {
     description = "Wrapper library for evdev devices";
diff --git a/pkgs/by-name/li/libgepub/package.nix b/pkgs/by-name/li/libgepub/package.nix
index 1f5805ad3e2c5..91b8fdcf39774 100644
--- a/pkgs/by-name/li/libgepub/package.nix
+++ b/pkgs/by-name/li/libgepub/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libgepub";
-  version = "0.7.1";
+  version = "0.7.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "o+SzGiMmWdJqVLkSGziCw9c5fDz0SuXGS4ZwCYC8f2A=";
+    sha256 = "WlZpWqipEy1nwHkqQPJSzgpI2dAytOGops6YrxT9Xhs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libmanette/package.nix b/pkgs/by-name/li/libmanette/package.nix
index d8a446b72b48e..19fb8adb4a121 100644
--- a/pkgs/by-name/li/libmanette/package.nix
+++ b/pkgs/by-name/li/libmanette/package.nix
@@ -12,18 +12,17 @@
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
-  gtk-doc,
-  docbook-xsl-nons,
-  docbook_xml_dtd_43,
+  gi-docgen,
   glib,
   libgudev,
   libevdev,
+  hidapi,
   gnome,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libmanette";
-  version = "0.2.9";
+  version = "0.2.12";
 
   outputs = [
     "out"
@@ -31,8 +30,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-KTZr5UUvYKdMZfxk/+LXTt3U5uaCTCzvpWekO9kraI8=";
+    url = "mirror://gnome/sources/libmanette/${lib.versions.majorMinor finalAttrs.version}/libmanette-${finalAttrs.version}.tar.xz";
+    hash = "sha256-SLNJJnGA8dw01AWp4ekLoW8FShnOkHkw5nlJPZEeodg=";
   };
 
   nativeBuildInputs =
@@ -45,9 +44,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withIntrospection [
       vala
       gobject-introspection
-      gtk-doc
-      docbook-xsl-nons
-      docbook_xml_dtd_43
+      gi-docgen
     ]
     ++ lib.optionals (withIntrospection && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
       mesonEmulatorHook
@@ -57,6 +54,7 @@ stdenv.mkDerivation rec {
     [
       glib
       libevdev
+      hidapi
     ]
     ++ lib.optionals withIntrospection [
       libgudev
@@ -71,9 +69,14 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "libmanette";
       versionPolicy = "odd-unstable";
     };
   };
@@ -86,4 +89,4 @@ stdenv.mkDerivation rec {
     teams = [ teams.gnome ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/li/libmsgraph/package.nix b/pkgs/by-name/li/libmsgraph/package.nix
index 457e5e5b375f4..1f99ed61c20e4 100644
--- a/pkgs/by-name/li/libmsgraph/package.nix
+++ b/pkgs/by-name/li/libmsgraph/package.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmsgraph";
-  version = "0.2.3";
+  version = "0.3.3";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/msgraph/${lib.versions.majorMinor finalAttrs.version}/msgraph-${finalAttrs.version}.tar.xz";
-    hash = "sha256-7ULoAMt/CgdHfNnj50TNwaJApq16uWuKh1gGJnqf3bA=";
+    hash = "sha256-N9fhLyqZBJCuohGE8LJ+C5Feu05QlvTWYyxiBRwFQBI=";
   };
 
   nativeBuildInputs = [
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postFixup = ''
     # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
-    moveToOutput "share/doc/msgraph-0" "$devdoc"
+    moveToOutput "share/doc/msgraph-1" "$devdoc"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/li/libnftnl/package.nix b/pkgs/by-name/li/libnftnl/package.nix
index a2536ad82ac70..36a77b3ebf29e 100644
--- a/pkgs/by-name/li/libnftnl/package.nix
+++ b/pkgs/by-name/li/libnftnl/package.nix
@@ -8,12 +8,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.8";
+  version = "1.2.9";
   pname = "libnftnl";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.xz";
-    hash = "sha256-N/6l1rXJsI3nkg0pjePNyULnrmSxo+i4gLLTkK5nrZU=";
+    hash = "sha256-6MIWJV4SnyYnBjn+53dSZWZaMbEaqSAlPD5dXWLfxLg=";
   };
 
   configureFlags = lib.optional (
diff --git a/pkgs/by-name/li/libnice/gupnp-igd-bump.patch b/pkgs/by-name/li/libnice/gupnp-igd-bump.patch
new file mode 100644
index 0000000000000..90a8f618968bd
--- /dev/null
+++ b/pkgs/by-name/li/libnice/gupnp-igd-bump.patch
@@ -0,0 +1,33 @@
+From 7255d6376fad2c88eaadf1278ee8947181230866 Mon Sep 17 00:00:00 2001
+From: Your Name <you@example.com>
+Date: Sun, 16 Apr 2023 19:52:38 +0000
+Subject: [PATCH] Update for gupnp-igd-1.6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+New gupnp-igd has been released.
+No significant changed in API so pkgconfig dependency can be simple
+bumped.
+
+Signed-off-by: Tomasz Kłoczko <kloczek@github.com>
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 6a733b73..c42fa138 100644
+--- a/meson.build
++++ b/meson.build
+@@ -285,7 +285,7 @@ gst_dep = dependency('gstreamer-base-1.0', version: gst_req,
+ cdata.set('HAVE_GSTREAMER', gst_dep.found(), description: 'Build GStreamer plugin')
+ 
+ # GUPnP IGD
+-gupnp_igd_dep = dependency('gupnp-igd-1.0', version: gupnp_igd_req, required: get_option('gupnp'))
++gupnp_igd_dep = dependency('gupnp-igd-1.6', version: gupnp_igd_req, required: get_option('gupnp'))
+ cdata.set('HAVE_GUPNP', gupnp_igd_dep.found(), description: 'Use the GUPnP IGD library')
+ 
+ libm = cc.find_library('m', required: false)
+-- 
+GitLab
+
diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 7cc8166bf6d79..cdb839c464b03 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -18,7 +17,7 @@
   graphviz,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libnice";
   version = "0.1.22";
 
@@ -29,18 +28,14 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
 
   src = fetchurl {
-    url = "https://libnice.freedesktop.org/releases/${pname}-${version}.tar.gz";
+    url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz";
     hash = "sha256-pfckzwnq5QxBp1FxQdidpKYeyerKMtpKAHP67VQXrX4=";
   };
 
   patches = [
-    # Fix generating data
-    # Note: upstream is not willing to merge our fix
-    # https://gitlab.freedesktop.org/libnice/libnice/merge_requests/35#note_98871
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/libnice/libnice/commit/d470c4bf4f2449f7842df26ca1ce1efb63452bc6.patch";
-      sha256 = "0z74vizf92flfw1m83p7yz824vfykmnm0xbnk748bnnyq186i6mg";
-    })
+    # Bumps the gupnp_igd_dep version requested to 1.6
+    # https://gitlab.freedesktop.org/libnice/libnice/-/merge_requests/255
+    ./gupnp-igd-bump.patch
   ];
 
   nativeBuildInputs = [
@@ -78,7 +73,7 @@ stdenv.mkDerivation rec {
   # see https://github.com/NixOS/nixpkgs/pull/53293#issuecomment-453739295
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "GLib ICE implementation";
     longDescription = ''
       Libnice is an implementation of the IETF's Interactice Connectivity
@@ -88,10 +83,10 @@ stdenv.mkDerivation rec {
       It provides a GLib-based library, libnice and a Glib-free library,
       libstun as well as GStreamer elements.'';
     homepage = "https://libnice.freedesktop.org/";
-    platforms = platforms.unix;
-    license = with licenses; [
+    platforms = lib.platforms.unix;
+    license = with lib.licenses; [
       lgpl21
       mpl11
     ];
   };
-}
+})
diff --git a/pkgs/by-name/li/libnotify/package.nix b/pkgs/by-name/li/libnotify/package.nix
index 3f1777e70a1b0..8911bb2088127 100644
--- a/pkgs/by-name/li/libnotify/package.nix
+++ b/pkgs/by-name/li/libnotify/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -20,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libnotify";
-  version = "0.8.4";
+  version = "0.8.6";
 
   outputs = [
     "out"
@@ -30,20 +29,9 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-j6BNTr3BVbCiOd+IvZ8J6PJznVcHoTkLQnq0mF+D0lo=";
+    hash = "sha256-xVQKrvtg4dY7HFh8BfIoTr5y7OfQwOXkp3jP1YRLa1g=";
   };
 
-  patches = [
-    # Revert to avoid manpages breakage:
-    #   https://gitlab.gnome.org/GNOME/libnotify/-/merge_requests/37#note_2366448
-    (fetchpatch {
-      revert = true;
-      name = "unbreak-man.path";
-      url = "https://gitlab.gnome.org/GNOME/libnotify/-/commit/2f99025b7ad54f29dc5236aa7dfcfa97d1c8efde.patch";
-      hash = "sha256-/qbBs+bJjzCR2I7swy0RTsTaXap+gkYzvfchobeOzPQ=";
-    })
-  ];
-
   mesonFlags = [
     # disable tests as we don't need to depend on GTK (2/3)
     "-Dtests=false"
diff --git a/pkgs/by-name/li/libpanel/package.nix b/pkgs/by-name/li/libpanel/package.nix
index e0c2601c4c867..b577910323a38 100644
--- a/pkgs/by-name/li/libpanel/package.nix
+++ b/pkgs/by-name/li/libpanel/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpanel";
-  version = "1.8.1";
+  version = "1.10.0";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libpanel/${lib.versions.majorMinor finalAttrs.version}/libpanel-${finalAttrs.version}.tar.xz";
-    hash = "sha256-uHuPqbeXaMxwQkN5PwFYoECh5G03uYiRiFRaf33Kpvs=";
+    hash = "sha256-V4zlEieP8rte7rtVCZOSxSU3pavZvQYpVn8QJTKziyU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/li/libpisp/package.nix b/pkgs/by-name/li/libpisp/package.nix
new file mode 100644
index 0000000000000..2a9dd59d2d467
--- /dev/null
+++ b/pkgs/by-name/li/libpisp/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  meson,
+  ninja,
+  boost,
+  nlohmann_json,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libpisp";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "raspberrypi";
+    repo = "libpisp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YshU7G5Rov67CVwFbf5ENp2j5ptAvkVrlMu85KmnEpk=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+  ];
+  buildInputs = [
+    boost
+    nlohmann_json
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/raspberrypi/libpisp";
+    description = "A helper library to generate run-time configuration for the Raspberry Pi ISP (PiSP), consisting of the Frontend and Backend hardware components.";
+    license = licenses.bsd2;
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/by-name/li/librsvg/package.nix b/pkgs/by-name/li/librsvg/package.nix
index 7fcc852066dbf..9e156eaccbe68 100644
--- a/pkgs/by-name/li/librsvg/package.nix
+++ b/pkgs/by-name/li/librsvg/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   pkg-config,
   meson,
   ninja,
@@ -50,7 +49,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.59.2";
+  version = "2.60.0";
 
   outputs =
     [
@@ -63,39 +62,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-7NKT+wzDOMFwFxu8e8++pnJdBByV8xOF3JNUCZM+RZc=";
+    hash = "sha256-C2/8zfbnCvyYdogvXSzp/88scTy6rxrZAXDap1Lh7sM=";
   };
 
-  patches = [
-    (fetchpatch {
-      # merged in 2.60.0-beta.0
-      name = "cross-introspection.patch";
-      url = "https://gitlab.gnome.org/GNOME/librsvg/-/commit/84f24b1f5767f807f8d0442bbf3f149a0defcf78.patch";
-      hash = "sha256-FRyAYCCP3eu7YDUS6g7sKCdbq2nU8yQdbdVaQwLrlhE=";
-    })
-    (fetchpatch {
-      # merged in 2.60.0-beta.0; required for cross-gdk-pixbuf-loader.patch to apply
-      name = "Replace-CRLF-with-just-LF-in-a-few-remaining-files-that-had-them";
-      url = "https://gitlab.gnome.org/GNOME/librsvg/-/commit/8c93369806283feafd060f4507111344e1110f79.patch";
-      hash = "sha256-FU6ZiWhXm8jPhGGuNKqlxDIEXu2bSfq1MWyQoADqLZA=";
-    })
-    (fetchpatch {
-      # merged in 2.60.0-beta.0; required for cross-gdk-pixbuf-loader.patch to apply
-      name = "do-not-look-for-gdk-pixbuf-query-loaders-in-cross-builds.patch";
-      url = "https://gitlab.gnome.org/GNOME/librsvg/-/commit/ce2957acb7b0b5d7f75f47a3c503f5532aa698a6.patch";
-      hash = "sha256-f0Mdt4GjycIkM/k68KRsR0Hv2C+gaieQ4WnhjPbA5vs=";
-    })
-    (fetchpatch {
-      name = "cross-gdk-pixbuf-loader.patch";
-      url = "https://gitlab.gnome.org/GNOME/librsvg/-/merge_requests/1095.patch";
-      hash = "sha256-4R/DfDkNn7WhgBy526v309FzK6znCt2dV/ooz4LYrVU=";
-    })
-  ];
-
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-M8iNNWpYgLIm0X3sTjAaRIFYLIHnMyrkcsayFrLg25Y=";
+    hash = "sha256-DMkYsskjw6ARQsaHDRautT0oy8VqW/BJBfBVErxUe88=";
     dontConfigure = true;
   };
 
@@ -166,15 +139,11 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs \
       meson/cargo_wrapper.py \
       meson/makedef.py \
+      meson/query-rustc.py
 
     # Fix thumbnailer path
     substituteInPlace gdk-pixbuf-loader/librsvg.thumbnailer.in \
       --replace-fail '@bindir@/gdk-pixbuf-thumbnailer' '${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer'
-
-    # Fix pkg-config file Requires section.
-    # https://gitlab.gnome.org/GNOME/librsvg/-/issues/1150
-    substituteInPlace rsvg/meson.build \
-      --replace-fail 'requires: library_dependencies_sole,' 'requires: [cairo_dep, gio_dep, glib_dep, pixbuf_dep],'
   '';
 
   preCheck = ''
diff --git a/pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch b/pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch
index 2fed4f2cee8d4..ad9e91e652c82 100644
--- a/pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch
+++ b/pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch
@@ -1,40 +1,3 @@
-From 86211534862622124d26e8570034efc1f5d78823 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1?= <nabijaczleweli@nabijaczleweli.xyz>
-Date: Sat, 22 Feb 2025 23:09:30 +0100
-Subject: [PATCH] Inject matchpathcon_filespec_add64() if
- !defined(__INO_T_MATCHES_INO64_T) instead of using __BITS_PER_LONG < 64 as
- proxy
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The __INO_T_MATCHES_INO64_T is defined
-if ino_t would be the same size as ino64_t
-if -D_FILE_OFFSET_BITS=64 were not defined.
-
-This is /exactly/ what
-  /* ABI backwards-compatible shim for non-LFS 32-bit systems */
-  #if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && __BITS_PER_LONG < 64
-is trying to get at, but currently fails because x32/RV32 are "LFS"
-with 32-bit longs and 64-bit time_ts natively.
-
-Thus, the
-  static_assert(sizeof(unsigned long) == sizeof(__ino_t), "inode size mismatch");
-assertion fails (__ino_t is the "kernel ino_t" type,
-which generally corresponds to the kernel's ulong, which is u64 on x32).
-
-glibc headers allow us to check the condition we care about directly.
-
-Fixes: commit 9395cc0322 ("Always build for LFS mode on 32-bit archs.")
-Closes: #463
-Closes: Debian#1098481
-Signed-off-by: наб <nabijaczleweli@nabijaczleweli.xyz>
-Cc: Alba Mendez <me@alba.sh>
----
- libselinux/include/selinux/selinux.h | 2 +-
- libselinux/src/matchpathcon.c        | 4 ++--
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
 diff --git libselinux/include/selinux/selinux.h libselinux/include/selinux/selinux.h
 index f3cf5a209..f64896b7a 100644
 --- libselinux/include/selinux/selinux.h
@@ -44,7 +7,7 @@ index f3cf5a209..f64896b7a 100644
     use the latter of the two specifications based on their order in the 
     file contexts configuration.  Return the used specification index. */
 -#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && __BITS_PER_LONG < 64
-+#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && !defined(__INO_T_MATCHES_INO64_T)
++#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && defined(__INO64_T_TYPE) && !defined(__INO_T_MATCHES_INO64_T)
  #define matchpathcon_filespec_add matchpathcon_filespec_add64
  #endif
  extern int matchpathcon_filespec_add(ino_t ino, int specind, const char *file);
@@ -57,16 +20,22 @@ index 51f0e4ff9..ab7c3090a 100644
  }
  
 -#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && __BITS_PER_LONG < 64
-+#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && !defined(__INO_T_MATCHES_INO64_T)
++#if (defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64) && defined(__INO64_T_TYPE) && !defined(__INO_T_MATCHES_INO64_T)
  /* alias defined in the public header but we undefine it here */
  #undef matchpathcon_filespec_add
  
-@@ -282,7 +282,7 @@ int matchpathcon_filespec_add(unsigned long ino, int specind,
+@@ -280,9 +280,13 @@ int matchpathcon_filespec_add(unsigned long ino, int specind,
+ {
+ 	return matchpathcon_filespec_add64(ino, specind, file);
  }
++#elif (defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64) || defined(__INO_T_MATCHES_INO64_T)
++
++static_assert(sizeof(uint64_t) == sizeof(ino_t), "inode size mismatch");
++
  #else
  
 -static_assert(sizeof(unsigned long) == sizeof(ino_t), "inode size mismatch");
-+static_assert(sizeof(uint64_t) == sizeof(ino_t), "inode size mismatch");
++static_assert(sizeof(uint32_t) == sizeof(ino_t), "inode size mismatch");
  
  #endif
  
diff --git a/pkgs/by-name/li/libselinux/package.nix b/pkgs/by-name/li/libselinux/package.nix
index 4aec113dc9fef..9c799e0199bcf 100644
--- a/pkgs/by-name/li/libselinux/package.nix
+++ b/pkgs/by-name/li/libselinux/package.nix
@@ -57,7 +57,9 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-RiEUibLVzfiRU6N/J187Cs1iPAih87gCZrlyRVI2abU=";
     })
 
-    # PR: https://github.com/SELinuxProject/selinux/pull/464
+    # commit 5c3fcbd931b7f9752b5ce29cec3b6813991d61c0 plus an additional
+    # fix for a musl build regression caused by that commit:
+    # https://lore.kernel.org/selinux/20250426151356.7116-2-hi@alyssa.is/
     # Fix build on 32-bit LFS platforms
     ./fix-build-32bit-lfs.patch
   ];
diff --git a/pkgs/by-name/li/libshumate/package.nix b/pkgs/by-name/li/libshumate/package.nix
index 7fd934fb9e5d1..6e9cbb678d062 100644
--- a/pkgs/by-name/li/libshumate/package.nix
+++ b/pkgs/by-name/li/libshumate/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libshumate";
-  version = "1.3.2";
+  version = "1.4.0";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libshumate/${lib.versions.majorMinor finalAttrs.version}/libshumate-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+HYrvG4pbXi+H4Qi9W2kxAvI0Sr8cAKjJBcqkZju7Vw=";
+    hash = "sha256-OYQ2jgJZhis4ENHdyG0trdbTcqKzI3bM9K/3wuSMbTA=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/li/libspelling/package.nix b/pkgs/by-name/li/libspelling/package.nix
index 48614e059f8b1..0a81e31aa843e 100644
--- a/pkgs/by-name/li/libspelling/package.nix
+++ b/pkgs/by-name/li/libspelling/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libspelling";
-  version = "0.4.6";
+  version = "0.4.8";
 
   outputs = [
     "out"
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libspelling/${lib.versions.majorMinor finalAttrs.version}/libspelling-${finalAttrs.version}.tar.xz";
-    hash = "sha256-MkiptTNuovcn0tuRLS8Ag6zMBQXOcHZ5s9m4JmwBAfU=";
+    hash = "sha256-J3ZGKFgY2nspXvAHssXr2BXQkws60JdQWzztlpZa9Rc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libtheora/package.nix b/pkgs/by-name/li/libtheora/package.nix
index df49f3988c01e..63a7096e8c8db 100644
--- a/pkgs/by-name/li/libtheora/package.nix
+++ b/pkgs/by-name/li/libtheora/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   autoreconfHook,
   libogg,
   libvorbis,
@@ -13,20 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtheora";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchurl {
     url = "https://downloads.xiph.org/releases/theora/libtheora-${finalAttrs.version}.tar.gz";
-    hash = "sha256-QJUpVsR4EZKNHnkizaO8H0J+t1aAw8NySckelJBUkWs=";
+    hash = "sha256-J5MnM5kDtUTCipKurafQ3P0Dl7WcLzaMxpisVvUVkG4=";
   };
 
-  patches = [
-    # fix error in autoconf scripts
-    (fetchpatch {
-      url = "https://github.com/xiph/theora/commit/28cc6dbd9b2a141df94f60993256a5fca368fa54.diff";
-      hash = "sha256-M/UULkiklvEay7LyOuCamxWCSvt37QSMzHOsAAnOWJo=";
-    })
-  ] ++ lib.optionals stdenv.hostPlatform.isMinGW [ ./mingw-remove-export.patch ];
+  patches = lib.optionals stdenv.hostPlatform.isMinGW [ ./mingw-remove-export.patch ];
 
   configureFlags = [ "--disable-examples" ];
 
@@ -60,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://gitlab.xiph.org/xiph/theora/-/releases/v${finalAttrs.version}";
     description = "Library for Theora, a free and open video compression format";
     homepage = "https://www.theora.org/";
     license = lib.licenses.bsd3;
diff --git a/pkgs/by-name/li/libxcvt/package.nix b/pkgs/by-name/li/libxcvt/package.nix
new file mode 100644
index 0000000000000..0688e25aa6362
--- /dev/null
+++ b/pkgs/by-name/li/libxcvt/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  meson,
+  ninja,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcvt";
+  version = "0.1.3";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libxcvt-${finalAttrs.version}.tar.xz";
+    hash = "sha256-qSmZiodn3n36NtbaR1HNvu807WMHFPL0p2ezUfJELgE=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "VESA CVT standard timing modeline generation library & utility";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcvt";
+    license = with lib.licenses; [
+      mit
+      hpndSellVariant
+    ];
+    mainProgram = "cvt";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+    badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
+  };
+})
diff --git a/pkgs/by-name/li/licensedigger/package.nix b/pkgs/by-name/li/licensedigger/package.nix
index 6536648e1963f..9035c07c27d43 100644
--- a/pkgs/by-name/li/licensedigger/package.nix
+++ b/pkgs/by-name/li/licensedigger/package.nix
@@ -3,7 +3,7 @@
   fetchFromGitLab,
   stdenv,
   cmake,
-  kdePackages,
+  extra-cmake-modules,
   libsForQt5,
 }:
 stdenv.mkDerivation {
@@ -18,10 +18,12 @@ stdenv.mkDerivation {
     hash = "sha256-/ZEja+iDx0lVkJaLshPd1tZD4ZUspVeFHY1TNXjr4qg=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
 
   buildInputs = [
-    kdePackages.extra-cmake-modules
     libsForQt5.qtbase
   ];
 
diff --git a/pkgs/by-name/li/lightsoff/package.nix b/pkgs/by-name/li/lightsoff/package.nix
index 16887e030310e..da5a5a3f43041 100644
--- a/pkgs/by-name/li/lightsoff/package.nix
+++ b/pkgs/by-name/li/lightsoff/package.nix
@@ -4,18 +4,15 @@
   fetchurl,
   vala,
   pkg-config,
-  gtk3,
+  glib,
+  gtk4,
+  libadwaita,
   gnome,
-  adwaita-icon-theme,
   gdk-pixbuf,
-  librsvg,
-  wrapGAppsHook3,
+  wrapGAppsHook4,
   gettext,
   itstool,
-  clutter,
-  clutter-gtk,
   libxml2,
-  appstream-glib,
   meson,
   ninja,
   python3,
@@ -23,20 +20,19 @@
 
 stdenv.mkDerivation rec {
   pname = "lightsoff";
-  version = "46.0";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/lightsoff/${lib.versions.major version}/lightsoff-${version}.tar.xz";
-    hash = "sha256-ZysVMuBkX64C8oN6ltU57c/Uw7pPcuWR3HP+R567i5I=";
+    hash = "sha256-LsmVAXE9vNE8WlZaLhGMxMwrUCg2s4enc2z7pAqLOYk=";
   };
 
   nativeBuildInputs = [
     vala
     pkg-config
-    wrapGAppsHook3
+    wrapGAppsHook4
     itstool
     gettext
-    appstream-glib
     libxml2
     meson
     ninja
@@ -44,17 +40,16 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gtk3
-    adwaita-icon-theme
-    gdk-pixbuf
-    librsvg
-    clutter
-    clutter-gtk
+    glib
+    gtk4
+    libadwaita
   ];
 
   postPatch = ''
     chmod +x build-aux/meson_post_install.py
     patchShebangs build-aux/meson_post_install.py
+    substituteInPlace build-aux/meson_post_install.py \
+      --replace-fail "gtk-update-icon-cache" "gtk4-update-icon-cache"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/lo/localsearch/package.nix b/pkgs/by-name/lo/localsearch/package.nix
index d5260225a3ce8..a2e0f6e95475b 100644
--- a/pkgs/by-name/lo/localsearch/package.nix
+++ b/pkgs/by-name/lo/localsearch/package.nix
@@ -19,11 +19,11 @@
   bzip2,
   dbus,
   exempi,
+  ffmpeg,
   giflib,
   glib,
   gobject-introspection,
   gnome,
-  gst_all_1,
   icu,
   json-glib,
   libcue,
@@ -39,7 +39,6 @@
   libtiff,
   libuuid,
   libxml2,
-  networkmanager,
   poppler,
   systemd,
   taglib,
@@ -50,11 +49,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "localsearch";
-  version = "3.8.2";
+  version = "3.9.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/localsearch/${lib.versions.majorMinor finalAttrs.version}/localsearch-${finalAttrs.version}.tar.xz";
-    hash = "sha256-zaaRlfaEU1eo2RwCNnDv6SI49NE4oe96FAH0WiqEA84=";
+    hash = "sha256-1C9AjcP7KP5U9amrv18d7PWBjbnC6exRwJRkvf0MFLk=";
   };
 
   patches = [
@@ -87,16 +86,11 @@ stdenv.mkDerivation (finalAttrs: {
       bzip2
       dbus
       exempi
+      ffmpeg
       giflib
       gexiv2
       totem-pl-parser
       tinysparql
-      gst_all_1.gst-plugins-base
-      gst_all_1.gst-plugins-good
-      gst_all_1.gst-plugins-bad
-      gst_all_1.gst-plugins-ugly
-      gst_all_1.gstreamer
-      gst_all_1.gst-libav
       icu
       json-glib
       libcue
@@ -116,7 +110,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libseccomp
-      networkmanager
       systemd
       upower
     ]
diff --git a/pkgs/by-name/lo/localsearch/tracker-landlock-nix-store-permission.patch b/pkgs/by-name/lo/localsearch/tracker-landlock-nix-store-permission.patch
index 4715241ee628f..a38e37fa222a0 100644
--- a/pkgs/by-name/lo/localsearch/tracker-landlock-nix-store-permission.patch
+++ b/pkgs/by-name/lo/localsearch/tracker-landlock-nix-store-permission.patch
@@ -1,8 +1,8 @@
-diff --git a/src/libtracker-miners-common/tracker-landlock.c b/src/libtracker-miners-common/tracker-landlock.c
-index 6d4510be1..1de5d5a90 100644
---- a/src/libtracker-miners-common/tracker-landlock.c
-+++ b/src/libtracker-miners-common/tracker-landlock.c
-@@ -184,6 +184,10 @@ gboolean
+diff --git a/src/common/tracker-landlock.c b/src/common/tracker-landlock.c
+index f26791d73..f03e8ddb9 100644
+--- a/src/common/tracker-landlock.c
++++ b/src/common/tracker-landlock.c
+@@ -185,6 +185,10 @@ gboolean
  tracker_landlock_init (const gchar * const *indexed_folders)
  {
  	TrackerLandlockRule stock_rules[] = {
@@ -11,5 +11,5 @@ index 6d4510be1..1de5d5a90 100644
 +		  LANDLOCK_ACCESS_FS_READ_FILE |
 +		  LANDLOCK_ACCESS_FS_READ_DIR) },
  		/* Allow access to the executable itself */
- 		{ LIBEXECDIR "/tracker-extract-3",
- 		 LANDLOCK_ACCESS_FS_READ_FILE |
+ 		{ LIBEXECDIR "/localsearch-extractor-3",
+ 		  LANDLOCK_ACCESS_FS_READ_FILE |
diff --git a/pkgs/by-name/lo/loupe/package.nix b/pkgs/by-name/lo/loupe/package.nix
index 373eb637020eb..4f887f68316aa 100644
--- a/pkgs/by-name/lo/loupe/package.nix
+++ b/pkgs/by-name/lo/loupe/package.nix
@@ -8,8 +8,6 @@
   meson,
   ninja,
   pkg-config,
-  jq,
-  moreutils,
   rustc,
   wrapGAppsHook4,
   gtk4,
@@ -19,21 +17,25 @@
   libseccomp,
   glycin-loaders,
   gnome,
+  common-updater-scripts,
+  _experimental-update-script-combinators,
+  rustPlatform,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "loupe";
-  version = "47.4";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/loupe/${lib.versions.major finalAttrs.version}/loupe-${finalAttrs.version}.tar.xz";
-    hash = "sha256-jckmgpqcM4gAyPQytaNHJG5ty9mtLdGiTEmOr90+ias=";
+    hash = "sha256-EHE9PpZ4nQd659M4lFKl9sOX3fQ6UMBxy/4tEnJZcN4=";
   };
 
-  patches = [
-    # Fix paths in glycin library
-    glycin-loaders.passthru.glycinPathsPatch
-  ];
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    name = "loupe-deps-${finalAttrs.version}";
+    hash = "sha256-PKkyZDd4FLWGZ/kDKWkaSV8p8NDniSQGcR9Htce6uCg=";
+  };
 
   nativeBuildInputs = [
     cargo
@@ -42,9 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    jq
-    moreutils
     rustc
+    rustPlatform.cargoSetupHook
     wrapGAppsHook4
   ];
 
@@ -56,13 +57,12 @@ stdenv.mkDerivation (finalAttrs: {
     libseccomp
   ];
 
-  postPatch = ''
-    # Replace hash of file we patch in vendored glycin.
-    jq \
-      --arg hash "$(sha256sum vendor/glycin/src/sandbox.rs | cut -d' ' -f 1)" \
-      '.files."src/sandbox.rs" = $hash' \
-      vendor/glycin/.cargo-checksum.json \
-      | sponge vendor/glycin/.cargo-checksum.json
+  preConfigure = ''
+    # Dirty approach to add patches after cargoSetupPostUnpackHook
+    # We should eventually use a cargo vendor patch hook instead
+    pushd ../$(stripHash $cargoDeps)/glycin-2.*
+      patch -p3 < ${glycin-loaders.passthru.glycinPathsPatch}
+    popd
   '';
 
   preFixup = ''
@@ -73,8 +73,34 @@ stdenv.mkDerivation (finalAttrs: {
     )
   '';
 
-  passthru.updateScript = gnome.updateScript {
-    packageName = "loupe";
+  passthru = {
+    updateScript =
+      let
+        updateSource = gnome.updateScript {
+          packageName = "loupe";
+        };
+
+        updateLockfile = {
+          command = [
+            "sh"
+            "-c"
+            ''
+              PATH=${
+                lib.makeBinPath [
+                  common-updater-scripts
+                ]
+              }
+              update-source-version loupe --ignore-same-version --source-key=cargoDeps.vendorStaging > /dev/null
+            ''
+          ];
+          # Experimental feature: do not copy!
+          supportedFeatures = [ "silent" ];
+        };
+      in
+      _experimental-update-script-combinators.sequence [
+        updateSource
+        updateLockfile
+      ];
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh b/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
index 3948342a36fc9..c860048d10a28 100644
--- a/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
+++ b/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
@@ -25,10 +25,12 @@ assertExecutable() {
 #                          the environment
 # --unset        VAR     : remove VAR from the environment
 # --chdir        DIR     : change working directory (use instead of --run "cd DIR")
-# --add-flags    ARGS    : prepend ARGS to the invocation of the executable
+# --add-flag     ARG     : prepend the single argument ARG to the invocation of the executable
 #                          (that is, *before* any arguments passed on the command line)
-# --append-flags ARGS    : append ARGS to the invocation of the executable
+# --append-flag  ARG     : append the single argument ARG to the invocation of the executable
 #                          (that is, *after* any arguments passed on the command line)
+# --add-flags    ARGS    : prepend the whitespace-separated list of arguments ARGS to the invocation of the executable
+# --append-flags ARGS    : append the whitespace-separated list of arguments ARGS to the invocation of the executable
 
 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix
@@ -86,9 +88,9 @@ makeDocumentedCWrapper() {
 # makeCWrapper EXECUTABLE ARGS
 # ARGS: same as makeWrapper
 makeCWrapper() {
-    local argv0 inherit_argv0 n params cmd main flagsBefore flagsAfter flags executable length
+    local argv0 inherit_argv0 n params cmd main flags executable length
     local uses_prefix uses_suffix uses_assert uses_assert_success uses_stdio uses_asprintf
-    local resolve_path
+    local flagsBefore=() flagsAfter=()
     executable=$(escapeStringLiteral "$1")
     params=("$@")
     length=${#params[*]}
@@ -147,16 +149,28 @@ makeCWrapper() {
                 n=$((n + 1))
                 [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 1 argument"$'\n'
             ;;
+            --add-flag)
+                flagsBefore+=("${params[n + 1]}")
+                uses_assert=1
+                n=$((n + 1))
+                [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 1 argument"$'\n'
+            ;;
+            --append-flag)
+                flagsAfter+=("${params[n + 1]}")
+                uses_assert=1
+                n=$((n + 1))
+                [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 1 argument"$'\n'
+            ;;
             --add-flags)
-                flags="${params[n + 1]}"
-                flagsBefore="$flagsBefore $flags"
+                read -ra flags <<< "${params[n + 1]}"
+                flagsBefore+=("${flags[@]}")
                 uses_assert=1
                 n=$((n + 1))
                 [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 1 argument"$'\n'
             ;;
             --append-flags)
-                flags="${params[n + 1]}"
-                flagsAfter="$flagsAfter $flags"
+                read -ra flags <<< "${params[n + 1]}"
+                flagsAfter+=("${flags[@]}")
                 uses_assert=1
                 n=$((n + 1))
                 [ $n -ge "$length" ] && main="$main#error makeCWrapper: $p takes 1 argument"$'\n'
@@ -182,7 +196,7 @@ makeCWrapper() {
             ;;
         esac
     done
-    [[ -z "$flagsBefore" && -z "$flagsAfter" ]] || main="$main"${main:+$'\n'}$(addFlags "$flagsBefore" "$flagsAfter")$'\n'$'\n'
+    (( ${#flagsBefore[@]} + ${#flagsAfter[@]} > 0 )) && main="$main"${main:+$'\n'}$(addFlags flagsBefore flagsAfter)$'\n'$'\n'
     [ -z "$inherit_argv0" ] && main="${main}argv[0] = \"${argv0:-${executable}}\";"$'\n'
     [ -z "$resolve_argv0" ] || main="${main}argv[0] = resolve_argv0(argv[0]);"$'\n'
     main="${main}return execv(\"${executable}\", argv);"$'\n'
@@ -203,23 +217,10 @@ makeCWrapper() {
 }
 
 addFlags() {
-    local n flag before after var
-
-    # Disable file globbing, since bash will otherwise try to find
-    # filenames matching the the value to be prefixed/suffixed if
-    # it contains characters considered wildcards, such as `?` and
-    # `*`. We want the value as is, except we also want to split
-    # it on on the separator; hence we can't quote it.
-    local reenableGlob=0
-    if [[ ! -o noglob ]]; then
-        reenableGlob=1
-    fi
-    set -o noglob
-    # shellcheck disable=SC2086
-    before=($1) after=($2)
-    if (( reenableGlob )); then
-        set +o noglob
-    fi
+    local n flag var
+
+    local -n before=$1
+    local -n after=$2
 
     var="argv_tmp"
     printf '%s\n' "char **$var = calloc(${#before[@]} + argc + ${#after[@]} + 1, sizeof(*$var));"
@@ -435,6 +436,14 @@ formatArgs() {
                 formatArgsLine 1 "$@"
                 shift 1
             ;;
+            --add-flag)
+                formatArgsLine 1 "$@"
+                shift 1
+            ;;
+            --append-flag)
+                formatArgsLine 1 "$@"
+                shift 1
+            ;;
             --add-flags)
                 formatArgsLine 1 "$@"
                 shift 1
diff --git a/pkgs/by-name/ma/makedepend/package.nix b/pkgs/by-name/ma/makedepend/package.nix
new file mode 100644
index 0000000000000..f84a707a96c8b
--- /dev/null
+++ b/pkgs/by-name/ma/makedepend/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "makedepend";
+  version = "1.0.9";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/util/makedepend-${finalAttrs.version}.tar.xz";
+    hash = "sha256-ktDetln/9tjdvB0n/EyozrK22+Fdc/CgTtwJ8cV4LdQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/util/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "parse C sources to make dependency lists for Makefiles";
+    homepage = "https://gitlab.freedesktop.org/xorg/util/makedepend";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpnd
+    ];
+    mainProgram = "makedepend";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/me/melonDS/package.nix b/pkgs/by-name/me/melonDS/package.nix
index dbd15dacc960e..096e3ad8d8f48 100644
--- a/pkgs/by-name/me/melonDS/package.nix
+++ b/pkgs/by-name/me/melonDS/package.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     pkg-config
     wrapQtAppsHook
   ];
@@ -46,7 +47,6 @@ stdenv.mkDerivation (finalAttrs: {
     [
       SDL2
       enet
-      extra-cmake-modules
       libarchive
       libslirp
       libGL
diff --git a/pkgs/by-name/me/metacity/package.nix b/pkgs/by-name/me/metacity/package.nix
index 6bf104a8db9f2..4cb4054d2fa56 100644
--- a/pkgs/by-name/me/metacity/package.nix
+++ b/pkgs/by-name/me/metacity/package.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "metacity";
-  version = "3.54.0";
+  version = "3.56.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/metacity/${lib.versions.majorMinor version}/metacity-${version}.tar.xz";
-    hash = "sha256-WHifKLbzhSL9iMIkKRChB9ppNCF7LH3VKn1RLTlB1kM=";
+    hash = "sha256-dVSZcQSyb/DnmgKzeiuhib3058zVQibw+vSxpZAGyQE=";
   };
 
   patches = [
diff --git a/pkgs/by-name/mi/mihomo-party/package.nix b/pkgs/by-name/mi/mihomo-party/package.nix
index 637a8e5f57b6a..1ea7711b30a71 100644
--- a/pkgs/by-name/mi/mihomo-party/package.nix
+++ b/pkgs/by-name/mi/mihomo-party/package.nix
@@ -8,7 +8,7 @@
   nspr,
   alsa-lib,
   openssl,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   udev,
   libayatana-appindicator,
   libGL,
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     nspr
     alsa-lib
     openssl
-    webkitgtk_4_0
+    webkitgtk_4_1
     (lib.getLib stdenv.cc.cc)
   ];
 
diff --git a/pkgs/by-name/mi/minigalaxy/package.nix b/pkgs/by-name/mi/minigalaxy/package.nix
index 131bd375418b3..020788f0cc306 100644
--- a/pkgs/by-name/mi/minigalaxy/package.nix
+++ b/pkgs/by-name/mi/minigalaxy/package.nix
@@ -10,7 +10,7 @@
   steam-run,
   replaceVars,
   unzip,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   wrapGAppsHook3,
 }:
 
@@ -61,7 +61,7 @@ python3Packages.buildPythonApplication rec {
   pythonPath = [
     python3Packages.pygobject3
     python3Packages.requests
-    webkitgtk_4_0
+    webkitgtk_4_1
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/mk/mkcal/package.nix b/pkgs/by-name/mk/mkcal/package.nix
index 102025313098e..f401fb0135e7b 100644
--- a/pkgs/by-name/mk/mkcal/package.nix
+++ b/pkgs/by-name/mk/mkcal/package.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs =
     [
       cmake
+      extra-cmake-modules
       doxygen
       graphviz
       perl
@@ -53,16 +54,12 @@ stdenv.mkDerivation (finalAttrs: {
       wrapQtAppsHook
     ]);
 
-  buildInputs =
-    [
-      extra-cmake-modules
-    ]
-    ++ (with libsForQt5; [
-      kcalendarcore
-      qtbase
-      qtpim
-      timed
-    ]);
+  buildInputs = with libsForQt5; [
+    kcalendarcore
+    qtbase
+    qtpim
+    timed
+  ];
 
   nativeCheckInputs = [
     tzdata
diff --git a/pkgs/by-name/mu/mutter/package.nix b/pkgs/by-name/mu/mutter/package.nix
index d449d31c81829..03ad81a4612e2 100644
--- a/pkgs/by-name/mu/mutter/package.nix
+++ b/pkgs/by-name/mu/mutter/package.nix
@@ -9,6 +9,7 @@
   gobject-introspection,
   cairo,
   colord,
+  docutils,
   lcms2,
   pango,
   libstartup_notification,
@@ -70,7 +71,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mutter";
-  version = "47.5";
+  version = "48.2";
 
   outputs = [
     "out"
@@ -81,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ZVGjPOiH5oQVsTlSr21rQw6VMG+Sl63IwRGVPplcUVs=";
+    hash = "sha256-PBi6Tgk+qaN4ET3K+nvbXB+db1r5dlAmt+Zst42vYU4=";
   };
 
   mesonFlags = [
@@ -107,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     desktop-file-utils
+    docutils # for rst2man
     gettext
     glib
     libxcvt
@@ -115,6 +117,7 @@ stdenv.mkDerivation (finalAttrs: {
     xvfb-run
     pkg-config
     python3
+    python3.pkgs.argcomplete # for register-python-argcomplete
     wayland-scanner
     wrapGAppsHook4
     gi-docgen
@@ -170,6 +173,12 @@ stdenv.mkDerivation (finalAttrs: {
     libXrandr
     libXinerama
     libXau
+
+    # for gdctl shebang
+    (python3.withPackages (pp: [
+      pp.pygobject3
+      pp.argcomplete
+    ]))
   ];
 
   postPatch = ''
@@ -183,7 +192,7 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
     # TODO: Move this into a directory devhelp can find.
-    moveToOutput "share/mutter-15/doc" "$devdoc"
+    moveToOutput "share/mutter-${finalAttrs.passthru.libmutter_api_version}/doc" "$devdoc"
   '';
 
   # Install udev files into our own tree.
@@ -193,7 +202,8 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   passthru = {
-    libdir = "${finalAttrs.finalPackage}/lib/mutter-15";
+    libmutter_api_version = "16"; # bumped each dev cycle
+    libdir = "${finalAttrs.finalPackage}/lib/mutter-${finalAttrs.passthru.libmutter_api_version}";
 
     tests = {
       libdirExists = runCommand "mutter-libdir-exists" { } ''
diff --git a/pkgs/by-name/mv/mvfst/package.nix b/pkgs/by-name/mv/mvfst/package.nix
index 4246792a4db98..3b4472c0e11b3 100644
--- a/pkgs/by-name/mv/mvfst/package.nix
+++ b/pkgs/by-name/mv/mvfst/package.nix
@@ -60,6 +60,13 @@ stdenv.mkDerivation (finalAttrs: {
     gtest
   ];
 
+  hardeningDisable = [
+    # causes test failures on aarch64
+    "pacret"
+    # causes empty cmake files to be generated
+    "trivialautovarinit"
+  ];
+
   cmakeFlags =
     [
       (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
diff --git a/pkgs/by-name/na/nautilus/package.nix b/pkgs/by-name/na/nautilus/package.nix
index 47f1fb7cc6c70..b226b106f290c 100644
--- a/pkgs/by-name/na/nautilus/package.nix
+++ b/pkgs/by-name/na/nautilus/package.nix
@@ -40,7 +40,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nautilus";
-  version = "47.2";
+  version = "48.1";
 
   outputs = [
     "out"
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/nautilus/${lib.versions.major finalAttrs.version}/nautilus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fzIDR08uY3ShHGdU7zPzNg6vf1tehfXkd+igrg+nZNk=";
+    hash = "sha256-eZWioXwp1LCav53ZrKFLje597DvXR3bdN5US8ubXNH8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ni/nixf-diagnose/package.nix b/pkgs/by-name/ni/nixf-diagnose/package.nix
new file mode 100644
index 0000000000000..bbcac13337bf6
--- /dev/null
+++ b/pkgs/by-name/ni/nixf-diagnose/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nixf,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nixf-diagnose";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "inclyc";
+    repo = "nixf-diagnose";
+    tag = finalAttrs.version;
+    hash = "sha256-gkeU3EwAl9810eRRp5/ddf1h0qpV6FrBBdntNBpBtsM=";
+  };
+
+  env.NIXF_TIDY_PATH = lib.getExe nixf;
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-nrr2/lTWPyH7MsG2hSMJjbFCpHsKWINEP8jwSYPhocg=";
+
+  meta = {
+    description = "CLI wrapper for nixf-tidy with fancy diagnostic output";
+    mainProgram = "nixf-diagnose";
+    homepage = "https://github.com/inclyc/nixf-diagnose";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ inclyc ];
+  };
+})
diff --git a/pkgs/by-name/ni/nixos-firewall-tool/package.nix b/pkgs/by-name/ni/nixos-firewall-tool/package.nix
index b928487c5277d..13f27d3b7b255 100644
--- a/pkgs/by-name/ni/nixos-firewall-tool/package.nix
+++ b/pkgs/by-name/ni/nixos-firewall-tool/package.nix
@@ -3,7 +3,7 @@
   lib,
   bash,
   installShellFiles,
-  shellcheck-minimal,
+  buildPackages,
 }:
 
 stdenvNoCC.mkDerivation {
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation {
   strictDeps = true;
   buildInputs = [ bash ];
   nativeBuildInputs = [ installShellFiles ];
-  nativeCheckInputs = [ shellcheck-minimal ];
+  nativeCheckInputs = [ buildPackages.shellcheck-minimal ];
 
   postPatch = ''
     patchShebangs --host nixos-firewall-tool
@@ -26,10 +26,7 @@ stdenvNoCC.mkDerivation {
     installShellCompletion nixos-firewall-tool.{bash,fish}
   '';
 
-  # Skip shellcheck if GHC is not available, see writeShellApplication.
-  doCheck =
-    lib.meta.availableOn stdenvNoCC.buildPlatform shellcheck-minimal.compiler
-    && (builtins.tryEval shellcheck-minimal.compiler.outPath).success;
+  doCheck = buildPackages.shellcheck-minimal.compiler.bootstrapAvailable;
   checkPhase = ''
     shellcheck nixos-firewall-tool
   '';
diff --git a/pkgs/by-name/ob/oboete/package.nix b/pkgs/by-name/ob/oboete/package.nix
index 5c8f86b09648f..e0dfc358d0e19 100644
--- a/pkgs/by-name/ob/oboete/package.nix
+++ b/pkgs/by-name/ob/oboete/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oboete";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "mariinkys";
     repo = "oboete";
     tag = version;
-    hash = "sha256-tQn3ihGHkR91zNtBIiyyIEEo21Q0ZSKLEaV/3UI9pwU=";
+    hash = "sha256-Xs9o6V/rUtRkUp7F2hJXLz8PP7XWtqx4uaONo3Q23uo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-91JMgdpMXL0a7oZXAG5xgiulOIyVXQ5x09wN3XDeSy0=";
+  cargoHash = "sha256-bhSkQcDqYhkRwqLbiOLXprQnMqjDKRetZ97K1ES5hrw=";
 
   nativeBuildInputs = [ libcosmicAppHook ];
 
diff --git a/pkgs/by-name/on/one-click-backup/package.nix b/pkgs/by-name/on/one-click-backup/package.nix
index 26ae411f0fed8..ea3994bbec300 100644
--- a/pkgs/by-name/on/one-click-backup/package.nix
+++ b/pkgs/by-name/on/one-click-backup/package.nix
@@ -21,13 +21,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     ninja
     qt6.wrapQtAppsHook
   ];
 
   buildInputs = [
     qt6.qtdeclarative
-    extra-cmake-modules
   ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/op/openclonk/package.nix b/pkgs/by-name/op/openclonk/package.nix
index 0626cf4980868..267bcc1cfa0db 100644
--- a/pkgs/by-name/op/openclonk/package.nix
+++ b/pkgs/by-name/op/openclonk/package.nix
@@ -23,7 +23,6 @@
   libogg,
   libpng,
   libvorbis,
-  libXrandr,
   openal,
   readline,
   SDL2,
@@ -86,7 +85,6 @@ stdenv.mkDerivation {
     libogg
     libpng
     libvorbis
-    libXrandr
     openal
     readline
     SDL2
diff --git a/pkgs/by-name/or/orca/fix-paths.patch b/pkgs/by-name/or/orca/fix-paths.patch
index 8f713de296d6e..49b5cc34ac890 100644
--- a/pkgs/by-name/or/orca/fix-paths.patch
+++ b/pkgs/by-name/or/orca/fix-paths.patch
@@ -1,39 +1,34 @@
-diff --git a/src/orca/debug.py b/src/orca/debug.py
-index e17e2333e..595c8489d 100644
---- a/src/orca/debug.py
-+++ b/src/orca/debug.py
-@@ -529,7 +529,7 @@ def traceit(frame, event, arg):
-     return traceit
+diff --git a/src/orca/ax_utilities_application.py b/src/orca/ax_utilities_application.py
+index 60c172f78..e8dadf76d 100644
+--- a/src/orca/ax_utilities_application.py
++++ b/src/orca/ax_utilities_application.py
+@@ -189,7 +189,7 @@ class AXUtilitiesApplication:
  
- def getOpenFDCount(pid):
--    procs = subprocess.check_output([ 'lsof', '-w', '-Ff', '-p', str(pid)])
-+    procs = subprocess.check_output([ '@lsof@', '-w', '-Ff', '-p', str(pid)])
-     procs = procs.decode('UTF-8').split('\n')
-     files = list(filter(lambda s: s and s[0] == 'f' and s[1:].isdigit(), procs))
- 
-@@ -547,7 +547,7 @@ def getCmdline(pid):
-     return cmdline
- 
- def pidOf(procName):
--    openFile = subprocess.Popen(f'pgrep {procName}',
-+    openFile = subprocess.Popen(f'@pgrep@ {procName}',
-                                 shell=True,
-                                 stdout=subprocess.PIPE).stdout
-     pids = openFile.read()
+         pid = AXUtilitiesApplication.get_process_id(app)
+         try:
+-            state = subprocess.getoutput(f"cat /proc/{pid}/status | grep State")
++            state = subprocess.getoutput(f"@cat@ /proc/{pid}/status | @grep@ State")
+             state = state.split()[1]
+         except Exception as error:
+             tokens = [f"AXUtilitiesApplication: Exception checking state of pid {pid}: {error}"]
+diff --git a/src/orca/debugging_tools_manager.py b/src/orca/debugging_tools_manager.py
+index 740f1a690..85f74d2dc 100644
+--- a/src/orca/debugging_tools_manager.py
++++ b/src/orca/debugging_tools_manager.py
+@@ -243,7 +243,7 @@ class DebuggingToolsManager:
+             else:
+                 name = AXObject.get_name(app) or "[DEAD]"
+             try:
+-                cmdline = subprocess.getoutput(f"cat /proc/{pid}/cmdline")
++                cmdline = subprocess.getoutput(f"@cat@ /proc/{pid}/cmdline")
+             except Exception as error:
+                 cmdline = f"EXCEPTION: {error}"
+             else:
 diff --git a/src/orca/orca_bin.py.in b/src/orca/orca_bin.py.in
-index c3b23dec2..320597ae6 100755
+index 6cb4c7772..903b344f0 100755
 --- a/src/orca/orca_bin.py.in
 +++ b/src/orca/orca_bin.py.in
-@@ -63,7 +63,7 @@ class ListApps(argparse.Action):
-                 name = "[DEAD]"
- 
-             try:
--                cmdline = subprocess.getoutput('cat /proc/%s/cmdline' % pid)
-+                cmdline = subprocess.getoutput('@cat@ /proc/%s/cmdline' % pid)
-             except Exception:
-                 cmdline = '(exception encountered)'
-             else:
-@@ -199,7 +199,7 @@ def inGraphicalDesktop():
+@@ -186,7 +186,7 @@ def inGraphicalDesktop():
  def otherOrcas():
      """Returns the pid of any other instances of Orca owned by this user."""
  
@@ -43,33 +38,33 @@ index c3b23dec2..320597ae6 100755
                                  stdout=subprocess.PIPE).stdout
      pids = openFile.read()
 diff --git a/src/orca/orca_modifier_manager.py b/src/orca/orca_modifier_manager.py
-index 48c0dead5..8a4a04e74 100644
+index 3407be009..452297a3f 100644
 --- a/src/orca/orca_modifier_manager.py
 +++ b/src/orca/orca_modifier_manager.py
-@@ -200,7 +200,7 @@ class OrcaModifierManager:
-         debug.printMessage(debug.LEVEL_INFO, msg, True)
+@@ -230,7 +230,7 @@ class OrcaModifierManager:
+         debug.print_message(debug.LEVEL_INFO, msg, True)
  
          self.unset_orca_modifiers(reason)
--        p = subprocess.Popen(['xkbcomp', os.environ['DISPLAY'], '-'],
-+        p = subprocess.Popen(['@xkbcomp@', os.environ['DISPLAY'], '-'],
-             stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
-         self._original_xmodmap, _ = p.communicate()
+-        with subprocess.Popen(["xkbcomp", os.environ["DISPLAY"], "-"],
++        with subprocess.Popen(["@xkbcomp@", os.environ["DISPLAY"], "-"],
+                               stdout=subprocess.PIPE, stderr=subprocess.DEVNULL) as p:
+             self._original_xmodmap, _ = p.communicate()
          self._create_orca_xmodmap()
-@@ -232,7 +232,7 @@ class OrcaModifierManager:
+@@ -262,7 +262,7 @@ class OrcaModifierManager:
              return
  
          self._caps_lock_cleared = False
--        p = subprocess.Popen(['xkbcomp', '-w0', '-', os.environ['DISPLAY']],
-+        p = subprocess.Popen(['@xkbcomp@', '-w0', '-', os.environ['DISPLAY']],
-             stdin=subprocess.PIPE, stdout=None, stderr=None)
-         p.communicate(self._original_xmodmap)
+-        with subprocess.Popen(["xkbcomp", "-w0", "-", os.environ["DISPLAY"]],
++        with subprocess.Popen(["@xkbcomp@", "-w0", "-", os.environ["DISPLAY"]],
+                               stdin=subprocess.PIPE, stdout=None, stderr=None) as p:
+             p.communicate(self._original_xmodmap)
+ 
+@@ -325,7 +325,7 @@ class OrcaModifierManager:
+             debug.print_message(debug.LEVEL_INFO, msg, True)
+ 
  
-@@ -293,7 +293,7 @@ class OrcaModifierManager:
-         if modified:
-             msg = "ORCA MODIFIER MANAGER: Updating xmodmap"
-             debug.printMessage(debug.LEVEL_INFO, msg, True)
--            p = subprocess.Popen(['xkbcomp', '-w0', '-', os.environ['DISPLAY']],
-+            p = subprocess.Popen(['@xkbcomp@', '-w0', '-', os.environ['DISPLAY']],
-                 stdin=subprocess.PIPE, stdout=None, stderr=None)
-             p.communicate(bytes('\n'.join(lines), 'UTF-8'))
+-            with subprocess.Popen(["xkbcomp", "-w0", "-", os.environ["DISPLAY"]],
++            with subprocess.Popen(["@xkbcomp@", "-w0", "-", os.environ["DISPLAY"]],
+                               stdin=subprocess.PIPE, stdout=None, stderr=None) as p:
+                 p.communicate(bytes('\n'.join(lines), 'UTF-8'))
          else:
diff --git a/pkgs/by-name/or/orca/package.nix b/pkgs/by-name/or/orca/package.nix
index 42064bcf690ae..ae9ddec8febe4 100644
--- a/pkgs/by-name/or/orca/package.nix
+++ b/pkgs/by-name/or/orca/package.nix
@@ -18,7 +18,7 @@
   dbus,
   xkbcomp,
   procps,
-  lsof,
+  gnugrep,
   coreutils,
   gsettings-desktop-schemas,
   speechd-minimal,
@@ -29,19 +29,19 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "orca";
-  version = "47.3";
+  version = "48.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/orca/${lib.versions.major version}/orca-${version}.tar.xz";
-    hash = "sha256-GwsUW7aFzXTso+KMt7cJf5jRPuHMWLce3u06j5BFIxs=";
+    hash = "sha256-ZsbwmCIUnaJDpGM6fYSnsduq8UU0qf653yv+AaUFF4o=";
   };
 
   patches = [
     (replaceVars ./fix-paths.patch {
       cat = "${coreutils}/bin/cat";
-      lsof = "${lsof}/bin/lsof";
+      grep = "${gnugrep}/bin/grep";
       pgrep = "${procps}/bin/pgrep";
       xkbcomp = "${xkbcomp}/bin/xkbcomp";
     })
diff --git a/pkgs/by-name/os/osmo/package.nix b/pkgs/by-name/os/osmo/package.nix
index c5bcfc5e08ba4..51ede958a4c49 100644
--- a/pkgs/by-name/os/osmo/package.nix
+++ b/pkgs/by-name/os/osmo/package.nix
@@ -10,7 +10,7 @@
   libnotify,
   libarchive,
   gspell,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   libgringotts,
   wrapGAppsHook3,
 }:
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     libnotify
     libarchive
     gspell
-    webkitgtk_4_0
+    webkitgtk_4_1
     libgringotts
   ];
 
diff --git a/pkgs/by-name/pa/papers/package.nix b/pkgs/by-name/pa/papers/package.nix
index ebc7a6ff1c453..87c8dbd1276f2 100644
--- a/pkgs/by-name/pa/papers/package.nix
+++ b/pkgs/by-name/pa/papers/package.nix
@@ -8,6 +8,7 @@
   appstream,
   desktop-file-utils,
   gtk4,
+  gtksourceview5,
   glib,
   pango,
   gdk-pixbuf,
@@ -27,6 +28,8 @@
   dbus,
   gi-docgen,
   libgxps,
+  libsysprof-capture,
+  libspelling,
   withLibsecret ? true,
   supportNautilus ? (!stdenv.hostPlatform.isDarwin),
   libadwaita,
@@ -37,7 +40,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "papers";
-  version = "47.3";
+  version = "48.2";
 
   outputs = [
     "out"
@@ -47,19 +50,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/papers/${lib.versions.major finalAttrs.version}/papers-${finalAttrs.version}.tar.xz";
-    hash = "sha256-PlhTk+gef6D5r55U38hvYSa1w9hS6pDf3DumsHlSxKo=";
+    hash = "sha256-HpvFlhNCS/ZVIjxr3Khzri8d2ifPAtc0K/9bVZBRYG0=";
   };
 
-  cargoRoot = "shell-rs";
-
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs)
       src
       pname
       version
-      cargoRoot
       ;
-    hash = "sha256-66pOdZxgzbvXkvF07rNvWtcF/dJ2+RuS24IeI/VWykE=";
+    hash = "sha256-1HFecOTn84m9lT166HlmYjqP+KN/ZOTWW4ztigrpqNQ=";
   };
 
   nativeBuildInputs = [
@@ -85,12 +85,15 @@ stdenv.mkDerivation (finalAttrs: {
       gdk-pixbuf
       glib
       gtk4
+      gtksourceview5
       gsettings-desktop-schemas
       libadwaita
       libarchive
       libgxps
       librsvg
       libspectre
+      libsysprof-capture
+      libspelling
       pango
       poppler
     ]
@@ -102,10 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
   mesonFlags =
-    [
-      "-Dps=enabled"
-    ]
-    ++ lib.optionals (!withLibsecret) [
+    lib.optionals (!withLibsecret) [
       "-Dkeyring=disabled"
     ]
     ++ lib.optionals (!supportNautilus) [
diff --git a/pkgs/by-name/pc/pcsx2/package.nix b/pkgs/by-name/pc/pcsx2/package.nix
index dcbcff5a34088..9aaf2bbedb34e 100644
--- a/pkgs/by-name/pc/pcsx2/package.nix
+++ b/pkgs/by-name/pc/pcsx2/package.nix
@@ -54,6 +54,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     pkg-config
     strip-nondeterminism
     wrapQtAppsHook
@@ -62,7 +63,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     curl
-    extra-cmake-modules
     ffmpeg
     libaio
     libbacktrace
diff --git a/pkgs/by-name/pl/plugdata/package.nix b/pkgs/by-name/pl/plugdata/package.nix
index 5cac0666f8639..3d35d5e0dba75 100644
--- a/pkgs/by-name/pl/plugdata/package.nix
+++ b/pkgs/by-name/pl/plugdata/package.nix
@@ -9,7 +9,7 @@
   pkg-config,
   alsa-lib,
   freetype,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   zenity,
   curl,
   xorg,
@@ -23,7 +23,6 @@
   libxkbcommon,
   libdatrie,
   libepoxy,
-  libsoup_2_4,
   libGL,
   libjack2,
   lerc,
@@ -60,7 +59,7 @@ stdenv.mkDerivation {
     alsa-lib
     curl
     freetype
-    webkitgtk_4_0
+    webkitgtk_4_1
     xorg.libX11
     xorg.libXcursor
     xorg.libXext
@@ -80,7 +79,6 @@ stdenv.mkDerivation {
     libxkbcommon
     libdatrie
     libepoxy
-    libsoup_2_4
     lerc
     libjack2
     expat
diff --git a/pkgs/by-name/po/portfolio/package.nix b/pkgs/by-name/po/portfolio/package.nix
index c962abdf08dc2..ee2b9cc6a9760 100644
--- a/pkgs/by-name/po/portfolio/package.nix
+++ b/pkgs/by-name/po/portfolio/package.nix
@@ -9,7 +9,7 @@
   makeDesktopItem,
   openjdk21,
   stdenvNoCC,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   wrapGAppsHook3,
   gitUpdater,
 }:
@@ -29,7 +29,7 @@ let
     glib-networking
     gtk3
     libsecret
-    webkitgtk_4_0
+    webkitgtk_4_1
   ];
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
diff --git a/pkgs/by-name/pr/previewqt/package.nix b/pkgs/by-name/pr/previewqt/package.nix
index 3dede06815d32..7e9daf5eb2a37 100644
--- a/pkgs/by-name/pr/previewqt/package.nix
+++ b/pkgs/by-name/pr/previewqt/package.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     pkg-config
     qt6Packages.wrapQtAppsHook
   ];
@@ -36,7 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs =
     [
       exiv2
-      extra-cmake-modules
       imagemagick
       libarchive
       libdevil
diff --git a/pkgs/by-name/ps/psqlodbc/package.nix b/pkgs/by-name/ps/psqlodbc/package.nix
index ac48d926e97ce..9f86aabed1d41 100644
--- a/pkgs/by-name/ps/psqlodbc/package.nix
+++ b/pkgs/by-name/ps/psqlodbc/package.nix
@@ -37,6 +37,8 @@ stdenv.mkDerivation rec {
     autoreconfHook
   ];
 
+  strictDeps = true;
+
   passthru =
     {
       updateScript = nix-update-script { };
@@ -46,9 +48,13 @@ stdenv.mkDerivation rec {
       driver = "lib/psqlodbcw.so";
     };
 
-  configureFlags = [
-    "--with-libpq=${lib.getDev libpq}"
-  ] ++ lib.optional withLibiodbc "--with-iodbc=${libiodbc}";
+  configureFlags =
+    [
+      "CPPFLAGS=-DSQLCOLATTRIBUTE_SQLLEN" # needed for cross
+      "--with-libpq=${lib.getDev libpq}"
+    ]
+    ++ lib.optional withLibiodbc "--with-iodbc=${libiodbc}"
+    ++ lib.optional withUnixODBC "--with-unixodbc=${unixODBC}";
 
   meta = with lib; {
     homepage = "https://odbc.postgresql.org/";
diff --git a/pkgs/by-name/py/pyright/package.nix b/pkgs/by-name/py/pyright/package.nix
index ed278678450d4..e3faf22ee0158 100644
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -7,13 +7,13 @@
 }:
 
 let
-  version = "1.1.399";
+  version = "1.1.400";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "pyright";
     tag = version;
-    hash = "sha256-AEdzc0ZC40k+ZUOL6JmFTR2iFYUiQMKnilPFLKoBbDY=";
+    hash = "sha256-ZpJTBHNi6mz/QSb5Lqvww4WNnjdcK9dxTR1bKnp8kqQ=";
   };
 
   patchedPackageJSON = runCommand "package.json" { } ''
@@ -44,7 +44,7 @@ let
     pname = "pyright-internal";
     inherit version src;
     sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-idKRVd3xYreLQe5cc5jRYCB6BKsnrBbYs91FdnNE1KU=";
+    npmDepsHash = "sha256-vVR3ByO/B970Zi7ac95hFq+tzLjSb/h62LYhDA8Troo=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -58,7 +58,7 @@ buildNpmPackage rec {
   inherit version src;
 
   sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-lgnTbvlwOcGr2E/X6pMebxwaIXo/Fqd8cjcSUmihKe4=";
+  npmDepsHash = "sha256-qYNQp5UHkAAAgGbHOVtvUVqP/odxbFPV5tDCJkDGhec=";
 
   postPatch = ''
     chmod +w ../../
diff --git a/pkgs/by-name/qt/qtorganizer-mkcal/package.nix b/pkgs/by-name/qt/qtorganizer-mkcal/package.nix
index 4546bc7b3925f..984e5e0f4a837 100644
--- a/pkgs/by-name/qt/qtorganizer-mkcal/package.nix
+++ b/pkgs/by-name/qt/qtorganizer-mkcal/package.nix
@@ -31,12 +31,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     pkg-config
   ];
 
   buildInputs =
     [
-      extra-cmake-modules
       mkcal
     ]
     ++ (with libsForQt5; [
diff --git a/pkgs/by-name/rn/rnnoise-plugin/package.nix b/pkgs/by-name/rn/rnnoise-plugin/package.nix
index af7cf9108cac3..136f86bef9c86 100644
--- a/pkgs/by-name/rn/rnnoise-plugin/package.nix
+++ b/pkgs/by-name/rn/rnnoise-plugin/package.nix
@@ -7,7 +7,7 @@
   gtk3-x11,
   pcre,
   pkg-config,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   xorg,
 }:
 stdenv.mkDerivation rec {
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       xorg.libXrandr
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
-      webkitgtk_4_0
+      webkitgtk_4_1
     ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/rn/rnote/package.nix b/pkgs/by-name/rn/rnote/package.nix
index 2dd40240ad474..3ffc58be726a8 100644
--- a/pkgs/by-name/rn/rnote/package.nix
+++ b/pkgs/by-name/rn/rnote/package.nix
@@ -27,18 +27,18 @@
 
 stdenv.mkDerivation rec {
   pname = "rnote";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "flxzt";
     repo = "rnote";
     tag = "v${version}";
-    hash = "sha256-RbuEgmly6Mjmx58zOV+tg6Mv5ghCNy/dE5FXYrEXtdg=";
+    hash = "sha256-uEYamKIZIjR7c2LB+GydLmxy+EhcKrcxV+9vsveqGVk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-0c3Me9SobMvUiJqTyz/3zhEvntkiJFS92BNJ9rRBAv0=";
+    hash = "sha256-bzB4yjBcMsOqbq1UCgPFErzVOXs55qy+CYBUinGEbg4=";
   };
 
   nativeBuildInputs = [
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://github.com/flxzt/rnote";
-    changelog = "https://github.com/flxzt/rnote/releases/tag/${src.rev}";
+    changelog = "https://github.com/flxzt/rnote/releases/tag/${src.tag}";
     description = "Simple drawing application to create handwritten notes";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ry/rygel/package.nix b/pkgs/by-name/ry/rygel/package.nix
index 51b945b9b3ec2..67a9b43c83051 100644
--- a/pkgs/by-name/ry/rygel/package.nix
+++ b/pkgs/by-name/ry/rygel/package.nix
@@ -38,7 +38,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rygel";
-  version = "0.44.1";
+  version = "0.44.2";
 
   # TODO: split out lib
   outputs = [
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/rygel/${lib.versions.majorMinor finalAttrs.version}/rygel-${finalAttrs.version}.tar.xz";
-    hash = "sha256-eyxjG4QkCNonpUJC+Agqukm9HKAgQeeeHu+6DHAJqHs=";
+    hash = "sha256-eW7uSUzfYNwr+CsAuPmaFLocfPQNKUSBf/DBqmBz1aA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/s2/s2n-tls/package.nix b/pkgs/by-name/s2/s2n-tls/package.nix
index 450e13b1c12cd..51e84aaf2c3b7 100644
--- a/pkgs/by-name/s2/s2n-tls/package.nix
+++ b/pkgs/by-name/s2/s2n-tls/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.5.12";
+  version = "1.5.17";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "s2n-tls";
     rev = "v${version}";
-    hash = "sha256-kK5/4j4Lvk0dMIi2S/iMUWDeIwfjAXr3ds6prm9Ym3A=";
+    hash = "sha256-ylaWeYLplAi94PQHauI1lG4PJI193TvrAPM7U446cnE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/sd/sdl2-compat/package.nix b/pkgs/by-name/sd/sdl2-compat/package.nix
index 23da12cc80570..807af8db75fa5 100644
--- a/pkgs/by-name/sd/sdl2-compat/package.nix
+++ b/pkgs/by-name/sd/sdl2-compat/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl2-compat";
-  version = "2.32.54";
+  version = "2.32.56";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "sdl2-compat";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-tkiKJ/YPipeqAiioWZKlL1dXKPnvbW57v97rtITpV0Y=";
+    hash = "sha256-Xg886KX54vwGANIhTAFslzPw/sZs2SvpXzXUXcOKgMs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index 1093605f44c1f..e5beca56b9b35 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -7,7 +7,6 @@
   cmake,
   darwinMinVersionHook,
   dbus,
-  fcitx5,
   fetchFromGitHub,
   ibus,
   installShellFiles,
@@ -57,7 +56,7 @@ assert lib.assertMsg (
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3";
-  version = "3.2.10";
+  version = "3.2.12";
 
   outputs = [
     "lib"
@@ -69,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libsdl-org";
     repo = "SDL";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-SylXpHPT4Y/37UapfLScJJ/CGniNyK4UNVAWax+WiBo=";
+    hash = "sha256-CPCbbVbi0gwSUkaEBOQPJwCU2NN9Lex2Z4hqBfIjn+o=";
   };
 
   postPatch =
@@ -100,7 +99,6 @@ stdenv.mkDerivation (finalAttrs: {
       apple-sdk_11
     ]
     ++ lib.optionals ibusSupport [
-      fcitx5
       ibus
     ]
     ++ lib.optional waylandSupport zenity;
diff --git a/pkgs/by-name/sn/snapshot/package.nix b/pkgs/by-name/sn/snapshot/package.nix
index 430f048b18ce9..0bd79455bc32e 100644
--- a/pkgs/by-name/sn/snapshot/package.nix
+++ b/pkgs/by-name/sn/snapshot/package.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snapshot";
-  version = "47.1";
+  version = "48.0.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/snapshot/${lib.versions.major finalAttrs.version}/snapshot-${finalAttrs.version}.tar.xz";
-    hash = "sha256-5LFiZ5ryTH6W7m4itH1f8NqW4KD2FtE66xIHxgn4lIM=";
+    hash = "sha256-OTF2hZogt9I138MDAxuiDGhkQRBpiNyRHdkbe21m4f0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sn/snipe-it/package.nix b/pkgs/by-name/sn/snipe-it/package.nix
index 79b4a7d62a560..a9ce41fbf4d98 100644
--- a/pkgs/by-name/sn/snipe-it/package.nix
+++ b/pkgs/by-name/sn/snipe-it/package.nix
@@ -9,16 +9,16 @@
 
 php84.buildComposerProject2 (finalAttrs: {
   pname = "snipe-it";
-  version = "8.1.2";
+  version = "8.1.3";
 
   src = fetchFromGitHub {
     owner = "grokability";
     repo = "snipe-it";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tF7lTkmowJAEz2BGNWK2yHkPYafS9Rs5Z98snsbCNQU=";
+    hash = "sha256-SzL1api9hObdvhKRtBrzgvZNuJHAoeB2GCt2etCZ6Kw=";
   };
 
-  vendorHash = "sha256-wVRmvxcrsu5ZBPYrIx9p4+ddWTgBBaeLvyqFMPj3iIg=";
+  vendorHash = "sha256-KOzPzKN1HXFidjXWe8tNPwFJ8DmdrkCDKeChNhGcTDo=";
 
   postInstall = ''
     snipe_it_out="$out/share/php/snipe-it"
diff --git a/pkgs/by-name/so/socalabs-sid/package.nix b/pkgs/by-name/so/socalabs-sid/package.nix
index 516bf9c903aae..31cdba5fd7951 100644
--- a/pkgs/by-name/so/socalabs-sid/package.nix
+++ b/pkgs/by-name/so/socalabs-sid/package.nix
@@ -13,7 +13,7 @@
   libGL,
   libjack2,
   curl,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   libsysprof-capture,
   pcre2,
   util-linux,
@@ -23,7 +23,6 @@
   libxkbcommon,
   libdatrie,
   libepoxy,
-  libsoup_2_4,
   lerc,
   sqlite,
   ninja,
@@ -89,11 +88,10 @@ stdenv.mkDerivation {
     libxkbcommon
     libdatrie
     libepoxy
-    libsoup_2_4
     lerc
     freetype
     curl
-    webkitgtk_4_0
+    webkitgtk_4_1
     pcre2
     util-linux
     sqlite
diff --git a/pkgs/by-name/sp/spdlog/package.nix b/pkgs/by-name/sp/spdlog/package.nix
index 8ed1455206c40..37e08a8dc5a2e 100644
--- a/pkgs/by-name/sp/spdlog/package.nix
+++ b/pkgs/by-name/sp/spdlog/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spdlog";
-  version = "1.15.1";
+  version = "1.15.2";
 
   src = fetchFromGitHub {
     owner = "gabime";
     repo = "spdlog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4QZVCounDbtkP+58fejHGWjquWT3b03b9TNGs45dN7c=";
+    hash = "sha256-9RhB4GdFjZbCIfMOWWriLAUf9DE/i/+FTXczr0pD0Vg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/sp/speechd/fix-paths.patch b/pkgs/by-name/sp/speechd/fix-paths.patch
index 7509c1842ba87..c9a4a92f1142c 100644
--- a/pkgs/by-name/sp/speechd/fix-paths.patch
+++ b/pkgs/by-name/sp/speechd/fix-paths.patch
@@ -1,3 +1,13 @@
+diff --git a/speech-dispatcher.service.in b/speech-dispatcher.service.in
+index 6280f2d9..edf6024c 100644
+--- a/speech-dispatcher.service.in
++++ b/speech-dispatcher.service.in
+@@ -20,4 +20,4 @@ Requires=speech-dispatcher.socket
+ [Service]
+ Type=simple
+ ExecStart=@bindir@/speech-dispatcher -s -t 0
+-ExecReload=/bin/kill -HUP $MAINPID
++ExecReload=@utillinux@/bin/kill -HUP $MAINPID
 diff --git a/speech-dispatcherd.service.in b/speech-dispatcherd.service.in
 index ab14b99d..12521b1b 100644
 --- a/speech-dispatcherd.service.in
diff --git a/pkgs/by-name/sp/speechd/package.nix b/pkgs/by-name/sp/speechd/package.nix
index 2947cf31bdb75..b4725c27ba3a6 100644
--- a/pkgs/by-name/sp/speechd/package.nix
+++ b/pkgs/by-name/sp/speechd/package.nix
@@ -9,6 +9,7 @@
   itstool,
   libtool,
   texinfo,
+  systemdMinimal,
   util-linux,
   autoreconfHook,
   glib,
@@ -36,13 +37,13 @@
 let
   inherit (python3Packages) python pyxdg wrapPython;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "speech-dispatcher";
-  version = "0.11.5";
+  version = "0.12.1";
 
   src = fetchurl {
-    url = "https://github.com/brailcom/speechd/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-HOR1n/q7rxrrQzpewHOb4Gdum9+66URKezvhsq8+wSs=";
+    url = "https://github.com/brailcom/speechd/releases/download/${finalAttrs.version}/speech-dispatcher-${finalAttrs.version}.tar.gz";
+    sha256 = "sha256-sUpSONKH0tzOTdQrvWbKZfoijn5oNwgmf3s0A297pLQ=";
   };
 
   patches =
@@ -77,9 +78,14 @@ stdenv.mkDerivation rec {
       libsndfile
       libao
       libpulseaudio
-      alsa-lib
       python
     ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      systemdMinimal # libsystemd
+    ]
+    ++ lib.optionals withAlsa [
+      alsa-lib
+    ]
     ++ lib.optionals withEspeak [
       espeak
       sonic
@@ -101,6 +107,7 @@ stdenv.mkDerivation rec {
       # Audio method falls back from left to right.
       "--with-default-audio-method=\"libao,pulse,alsa,oss\""
       "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+      "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
     ]
     ++ lib.optionals withPulse [
       "--with-pulse"
@@ -121,7 +128,7 @@ stdenv.mkDerivation rec {
       "--with-pico"
     ];
 
-  postPatch = ''
+  postPatch = lib.optionalString withPico ''
     substituteInPlace src/modules/pico.c --replace "/usr/share/pico/lang" "${svox}/share/pico/lang"
   '';
 
@@ -146,7 +153,8 @@ stdenv.mkDerivation rec {
       berce
       jtojnar
     ];
-    platforms = platforms.linux;
+    # TODO: remove checks for `withPico` once PR #375450 is merged
+    platforms = if withAlsa || withPico then platforms.linux else platforms.unix;
     mainProgram = "speech-dispatcher";
   };
-}
+})
diff --git a/pkgs/by-name/sp/spirv-cross/package.nix b/pkgs/by-name/sp/spirv-cross/package.nix
index b700c8a243c61..3751d3186beaf 100644
--- a/pkgs/by-name/sp/spirv-cross/package.nix
+++ b/pkgs/by-name/sp/spirv-cross/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-ctSMpvw9Wx/IiF0jOGkLmNUAQk855Hf9RwTWYz7mk+k=";
+    hash = "sha256-Rvb3XlTGoQKABSK/jKnbOePS4BKLDAW4L+t2SLw2RMA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/spirv-headers/package.nix b/pkgs/by-name/sp/spirv-headers/package.nix
index 313c045fcff53..ba28dbbb1efd1 100644
--- a/pkgs/by-name/sp/spirv-headers/package.nix
+++ b/pkgs/by-name/sp/spirv-headers/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-Q1i6i5XimULuGufP6mimwDW674anAETUiIEvDQwvg5Y=";
+    hash = "sha256-bUgt7m3vJYoozxgrA5hVTRcbPg3OAzht0e+MgTH7q9k=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/sp/spirv-tools/package.nix b/pkgs/by-name/sp/spirv-tools/package.nix
index 8fd082b2843ee..d1edc96a6f629 100644
--- a/pkgs/by-name/sp/spirv-tools/package.nix
+++ b/pkgs/by-name/sp/spirv-tools/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-2Wv0dxVQ8NvuDRTcsXkH1GKmuA6lsIuwTl0j6kbTefo=";
+    hash = "sha256-nGyEOREua/W2mdb8DhmqXW0gDThnXnIlhnURAUhCO2g=";
   };
 
   # The cmake options are sufficient for turning on static building, but not
diff --git a/pkgs/by-name/sp/spotify-player/package.nix b/pkgs/by-name/sp/spotify-player/package.nix
index 7a0b64227b218..70f9abdc99ea8 100644
--- a/pkgs/by-name/sp/spotify-player/package.nix
+++ b/pkgs/by-name/sp/spotify-player/package.nix
@@ -46,17 +46,17 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.20.4";
+  version = "0.20.5";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = "spotify-player";
     tag = "v${version}";
-    hash = "sha256-5N/zTkNgcIk/Ml11Oo+jyoO0r2Hh9SxFL+tdhD/1X/4=";
+    hash = "sha256-NlMQgVkMVCVrMv4IyFtPmRkAmf2k4F0dp6e8s63aBHg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-0vIhAJ3u+PfujUGI07fddDs33P35Q4CSDz1sMuQwVws=";
+  cargoHash = "sha256-glQh6PzwJp5o35aXRW4+Pq2iSeGg9vjR5fJQomPpSOc=";
 
   nativeBuildInputs =
     [
diff --git a/pkgs/by-name/st/stalwart-mail/package.nix b/pkgs/by-name/st/stalwart-mail/package.nix
index 77f48d5cadfe4..0a9ed8b7d733e 100644
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -15,10 +15,11 @@
   rocksdb,
   callPackage,
   withFoundationdb ? false,
+  stalwartEnterprise ? false,
 }:
 
 rustPlatform.buildRustPackage rec {
-  pname = "stalwart-mail";
+  pname = "stalwart-mail" + (lib.optionalString stalwartEnterprise "-enterprise");
   version = "0.11.8";
 
   src = fetchFromGitHub {
@@ -46,15 +47,18 @@ rustPlatform.buildRustPackage rec {
 
   # Issue: https://github.com/stalwartlabs/mail-server/issues/1104
   buildNoDefaultFeatures = true;
-  buildFeatures = [
-    "sqlite"
-    "postgres"
-    "mysql"
-    "rocks"
-    "elastic"
-    "s3"
-    "redis"
-  ] ++ lib.optionals withFoundationdb [ "foundationdb" ];
+  buildFeatures =
+    [
+      "sqlite"
+      "postgres"
+      "mysql"
+      "rocks"
+      "elastic"
+      "s3"
+      "redis"
+    ]
+    ++ lib.optionals withFoundationdb [ "foundationdb" ]
+    ++ lib.optionals stalwartEnterprise [ "enterprise" ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
@@ -154,7 +158,17 @@ rustPlatform.buildRustPackage rec {
     description = "Secure & Modern All-in-One Mail Server (IMAP, JMAP, SMTP)";
     homepage = "https://github.com/stalwartlabs/mail-server";
     changelog = "https://github.com/stalwartlabs/mail-server/blob/main/CHANGELOG.md";
-    license = lib.licenses.agpl3Only;
+    license =
+      [ lib.licenses.agpl3Only ]
+      ++ lib.optionals stalwartEnterprise [
+        {
+          fullName = "Stalwart Enterprise License 1.0 (SELv1) Agreement";
+          url = "https://github.com/stalwartlabs/mail-server/blob/main/LICENSES/LicenseRef-SEL.txt";
+          free = false;
+          redistributable = false;
+        }
+      ];
+
     maintainers = with lib.maintainers; [
       happysalada
       onny
diff --git a/pkgs/by-name/sw/swell-foop/package.nix b/pkgs/by-name/sw/swell-foop/package.nix
index 9b648bdf633c3..d22ac90d4e7b6 100644
--- a/pkgs/by-name/sw/swell-foop/package.nix
+++ b/pkgs/by-name/sw/swell-foop/package.nix
@@ -8,6 +8,7 @@
   vala,
   glib,
   gtk4,
+  libadwaita,
   libgee,
   libgnome-games-support_2_0,
   pango,
@@ -20,13 +21,13 @@
   python3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "swell-foop";
-  version = "46.0";
+  version = "48.1";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/swell-foop/${lib.versions.major version}/swell-foop-${version}.tar.xz";
-    hash = "sha256-BvireAfXHOyUi4aDcfR/ut7vzLXDV+E9HvPISBiR/KM=";
+    url = "mirror://gnome/sources/swell-foop/${lib.versions.major finalAttrs.version}/swell-foop-${finalAttrs.version}.tar.xz";
+    hash = "sha256-W5Ywh4/nAa7nUe1G/3ZcK82fgVpOVYJnajwmsxGCAxs=";
   };
 
   nativeBuildInputs = [
@@ -45,22 +46,25 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib
     gtk4
+    libadwaita
     libgee
     libgnome-games-support_2_0
     pango
   ];
 
   passthru = {
-    updateScript = gnome.updateScript { packageName = "swell-foop"; };
+    updateScript = gnome.updateScript {
+      packageName = "swell-foop";
+    };
   };
 
   meta = with lib; {
     homepage = "https://gitlab.gnome.org/GNOME/swell-foop";
-    changelog = "https://gitlab.gnome.org/GNOME/swell-foop/-/tree/${version}?ref_type=tags";
+    changelog = "https://gitlab.gnome.org/GNOME/swell-foop/-/tree/${finalAttrs.version}?ref_type=tags";
     description = "Puzzle game, previously known as Same GNOME";
     mainProgram = "swell-foop";
     teams = [ teams.gnome ];
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/sw/swtpm/package.nix b/pkgs/by-name/sw/swtpm/package.nix
index 1aecaf42d4769..a109e5efaacd3 100644
--- a/pkgs/by-name/sw/swtpm/package.nix
+++ b/pkgs/by-name/sw/swtpm/package.nix
@@ -16,6 +16,7 @@
   socat,
   gnutls,
   perl,
+  makeWrapper,
 
   # Tests
   python3,
@@ -25,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "swtpm";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "stefanberger";
     repo = "swtpm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZEpThaLgieTTBJ9Rouklepq6Bvo/h+2sbabNOo++fc0=";
+    hash = "sha256-N79vuI0FhawLyQtwVF6ABIvCmEaYefq/YkyrafUfUHE=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     perl # for pod2man
     python3
     autoreconfHook
+    makeWrapper
   ];
 
   nativeCheckInputs = [
@@ -113,6 +115,12 @@ stdenv.mkDerivation (finalAttrs: {
         'LC_ALL=C.UTF-8 certtool'
   '';
 
+  # Workaround for https://github.com/stefanberger/swtpm/issues/795
+  postFixup = ''
+    wrapProgram "$out/bin/swtpm_localca" --suffix PATH : "$out/bin"
+    wrapProgram "$out/bin/swtpm_setup" --suffix PATH : "$out/bin"
+  '';
+
   doCheck = true;
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/ti/tinysparql/package.nix b/pkgs/by-name/ti/tinysparql/package.nix
index e6e7e08c54b82..2024fbf72c38e 100644
--- a/pkgs/by-name/ti/tinysparql/package.nix
+++ b/pkgs/by-name/ti/tinysparql/package.nix
@@ -15,8 +15,6 @@
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
   vala,
   python3,
-  gi-docgen,
-  graphviz,
   libxml2,
   glib,
   wrapGAppsNoGuiHook,
@@ -37,7 +35,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tinysparql";
-  version = "3.8.2";
+  version = "3.9.2";
 
   outputs = [
     "out"
@@ -49,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "mirror://gnome/sources/tinysparql/${lib.versions.majorMinor version}/tinysparql-${version}.tar.xz";
-    hash = "sha256-u4ZDOGyO3FkaAyBdSg7aZh3N0glEc7/7m725TpNYnLI=";
+    hash = "sha256-FM4DkCQTXhgQIrzOSxqtLgA3fdnH2BK5g5HM/HVtrY4=";
   };
 
   strictDeps = true;
@@ -67,8 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
       gettext
       glib
       wrapGAppsNoGuiHook
-      gi-docgen
-      graphviz
       (python3.pythonOnBuildForHost.withPackages (p: [ p.pygobject3 ]))
     ]
     ++ lib.optionals withIntrospection [
@@ -126,13 +122,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   postPatch = ''
-    chmod +x \
-      docs/reference/libtracker-sparql/embed-files.py \
-      docs/reference/libtracker-sparql/generate-svgs.sh
     patchShebangs \
-      utils/data-generators/cc/generate \
-      docs/reference/libtracker-sparql/embed-files.py \
-      docs/reference/libtracker-sparql/generate-svgs.sh
+      utils/data-generators/cc/generate
 
     # File "/build/tinysparql-3.8.0/tests/functional-tests/test_cli.py", line 233, in test_help
     # self.assertIn("TINYSPARQL-IMPORT(1)", output, "Manpage not found")
@@ -155,7 +146,7 @@ stdenv.mkDerivation (finalAttrs: {
       # though, so we need to replace the absolute path with a local one during build.
       # We are using a symlink that will be overridden during installation.
       mkdir -p $out/lib
-      ln -s $PWD/src/libtracker-sparql/libtinysparql-3.0${darwinDot0}${extension} $out/lib/libtinysparql-3.0${darwinDot0}${extension}${linuxDot0}
+      ln -s $PWD/src/libtinysparql/libtinysparql-3.0${darwinDot0}${extension} $out/lib/libtinysparql-3.0${darwinDot0}${extension}${linuxDot0}
     '';
 
   checkPhase = ''
diff --git a/pkgs/by-name/ue/uesave/package.nix b/pkgs/by-name/ue/uesave/package.nix
index f090eea2065f0..d8eb98d3f9e49 100644
--- a/pkgs/by-name/ue/uesave/package.nix
+++ b/pkgs/by-name/ue/uesave/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "uesave";
-  version = "0.5.0";
+  version = "0.6.2";
   src = fetchFromGitHub {
     owner = "trumank";
     repo = "uesave-rs";
     rev = "v${version}";
-    hash = "sha256-9gOOSLejVfR1KJMhcNuKDkuTOvPC6sNG8xQOZlt8NxI=";
+    hash = "sha256-cwkeuHmtIS8zTxTSa1qLtWfN2OZinqKngMEYvrCCAk0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-rAbZfAAW+/7wjsVg9x/OkoCmSbUWeuIkRUYlF+PY0Vs=";
+  cargoHash = "sha256-QGhaaBvxKYnljrkCCcFZLALppvM15c8Xtn36SecaNJ8=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ul/ulauncher/package.nix b/pkgs/by-name/ul/ulauncher/package.nix
index 22c4e096f3de6..3aed9d81f845f 100644
--- a/pkgs/by-name/ul/ulauncher/package.nix
+++ b/pkgs/by-name/ul/ulauncher/package.nix
@@ -9,7 +9,7 @@
   gobject-introspection,
   gtk3,
   wrapGAppsHook3,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   libnotify,
   keybinder3,
   libappindicator,
@@ -45,7 +45,7 @@ python3Packages.buildPythonApplication rec {
     libappindicator
     libnotify
     librsvg
-    webkitgtk_4_0
+    webkitgtk_4_1
     wmctrl
   ];
 
diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index a91611b20089e..af83ee2cc1881 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -54,13 +54,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.22.0";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-CFsd8tdFL+JbxmDZoWdStvWcs9azSaLtMG8Ih5oXE/A=";
+    hash = "sha256-a9WNUVDy7ORB40VFUhkUxEaBho+HVNJ105AqdGDr+tI=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/up/upscaler/package.nix b/pkgs/by-name/up/upscaler/package.nix
index 8fc336d9b205c..7efcbb6f59946 100644
--- a/pkgs/by-name/up/upscaler/package.nix
+++ b/pkgs/by-name/up/upscaler/package.nix
@@ -18,7 +18,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "upscaler";
-  version = "1.4.1";
+  version = "1.5.1";
 
   pyproject = false; # meson instead of pyproject
 
@@ -27,7 +27,7 @@ python3Packages.buildPythonApplication rec {
     owner = "World";
     repo = "Upscaler";
     rev = version;
-    hash = "sha256-WjhefFyd1hnngD/uIvgjAI4i6AyoldDJKWocvotGw9g=";
+    hash = "sha256-yff33enYV42dRUr3zzDwUOud7mRxwFCz9BCGXpSgV9k=";
   };
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/by-name/ut/util-macros/package.nix b/pkgs/by-name/ut/util-macros/package.nix
new file mode 100644
index 0000000000000..a6ff12c619b1c
--- /dev/null
+++ b/pkgs/by-name/ut/util-macros/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  automake,
+  autoconf,
+  libtool,
+  testers,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "util-macros";
+  version = "1.20.2";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/util/util-macros-${finalAttrs.version}.tar.xz";
+    hash = "sha256-msJp66JPZy19ezV05L5fMz0T8Ep3EjA7GCGypRrILo4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  # not needed for releases, we propagate the needed tools
+  propagatedNativeBuildInputs = [
+    automake
+    autoconf
+    libtool
+  ];
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/util/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "GNU autoconf macros shared across X.Org projects";
+    homepage = "https://gitlab.freedesktop.org/xorg/util/macros";
+    license = with lib.licenses; [
+      hpndSellVariant
+      mit
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xorg-macros" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/va/valkey/package.nix b/pkgs/by-name/va/valkey/package.nix
index 6c846aad549c1..381aeaf25cf45 100644
--- a/pkgs/by-name/va/valkey/package.nix
+++ b/pkgs/by-name/va/valkey/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "valkey";
-  version = "8.0.2";
+  version = "8.0.3";
 
   src = fetchFromGitHub {
     owner = "valkey-io";
     repo = "valkey";
     rev = finalAttrs.version;
-    hash = "sha256-05EuPjVokzfJxhrnvFHD7prwt5y7gPxemeDIkLML7lw=";
+    hash = "sha256-IzerctJUc478dJu2AH20s/A3psiAZWDjQG3USQWqpos=";
   };
 
   patches = lib.optional useSystemJemalloc ./use_system_jemalloc.patch;
diff --git a/pkgs/by-name/ve/versionCheckHook/hook.sh b/pkgs/by-name/ve/versionCheckHook/hook.sh
index 88a046b552eed..436032b0a97d4 100644
--- a/pkgs/by-name/ve/versionCheckHook/hook.sh
+++ b/pkgs/by-name/ve/versionCheckHook/hook.sh
@@ -1,10 +1,11 @@
 _handleCmdOutput(){
+    local command=("$1" "$2")
     local versionOutput
     versionOutput="$(env \
         --chdir=/ \
-        --argv0="$(basename "$1")" \
-        --ignore-environment \
-        "$@" 2>&1 \
+        --argv0="$(basename "${command[0]}")" \
+        $( [[ -z "$3" || "$3" = "0" ]] && echo --ignore-environment ) \
+        "${command[@]}" 2>&1 \
         | sed -e 's|@storeDir@/[^/ ]*/|{{storeDir}}/|g' \
         || true)"
     if [[ "$versionOutput" =~ "$version" ]]; then
@@ -17,13 +18,16 @@ _handleCmdOutput(){
     # And in anycase we want these to be printed in the build log, useful for
     # debugging, so we print these to stderr.
     echo "$echoPrefix" find version "$version" in the output of the command \
-        "$@" >&2
+        "${command[@]}" >&2
     echo "$versionOutput" >&2
 }
 versionCheckHook(){
     runHook preVersionCheck
     echo Executing versionCheckPhase
 
+    # Enable --ignore-environment by default unless explicitly disabled
+    : "${versionCheckDontIgnoreEnvironment:=0}"
+
     local cmdProgram cmdArg echoPrefix
     if [[ -z "${versionCheckProgram-}" ]]; then
         if [[ -z "${pname-}" ]]; then
@@ -43,14 +47,14 @@ versionCheckHook(){
     fi
     if [[ -z "${versionCheckProgramArg}" ]]; then
         for cmdArg in "--help" "--version"; do
-            echoPrefix="$(_handleCmdOutput "$cmdProgram" "$cmdArg")"
+            echoPrefix="$(_handleCmdOutput "$cmdProgram" "$cmdArg" "$versionCheckDontIgnoreEnvironment")"
             if [[ "$echoPrefix" == "Successfully managed to" ]]; then
                 break
             fi
         done
     else
         cmdArg="$versionCheckProgramArg"
-        echoPrefix="$(_handleCmdOutput "$cmdProgram" "$cmdArg")"
+        echoPrefix="$(_handleCmdOutput "$cmdProgram" "$cmdArg" "$versionCheckDontIgnoreEnvironment")"
     fi
     if [[ "$echoPrefix" == "Did not" ]]; then
         exit 2
diff --git a/pkgs/by-name/vt/vte/package.nix b/pkgs/by-name/vt/vte/package.nix
index 88de416bd20e0..d8a5c60284cac 100644
--- a/pkgs/by-name/vt/vte/package.nix
+++ b/pkgs/by-name/vt/vte/package.nix
@@ -3,6 +3,7 @@
   lib,
   fetchurl,
   fetchpatch,
+  desktop-file-utils,
   gettext,
   pkg-config,
   meson,
@@ -34,7 +35,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vte";
-  version = "0.78.4";
+  version = "0.80.1";
 
   outputs = [
     "out"
@@ -43,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/vte/${lib.versions.majorMinor finalAttrs.version}/vte-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LepOQSJmWStkYKP+RIj149UHEvE5gVeQwOy0RxD34X4=";
+    hash = "sha256-DNvQ6YOv2dIuBl4yOnQxYAcr9ktFPgCxXtvm8tzdpGw=";
   };
 
   patches = [
@@ -55,26 +56,10 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://git.alpinelinux.org/aports/plain/community/vte3/fix-W_EXITCODE.patch?id=4d35c076ce77bfac7655f60c4c3e4c86933ab7dd";
       hash = "sha256-FkVyhsM0mRUzZmS2Gh172oqwcfXv6PyD6IEgjBhy2uU=";
     })
-    # build: Add fast_float dependency
-    # https://gitlab.gnome.org/GNOME/vte/-/issues/2823
-    (fetchpatch {
-      name = "0003-build-Add-fast_float-dependency.patch";
-      url = "https://gitlab.gnome.org/GNOME/vte/-/commit/f6095fca4d1baf950817e7010e6f1e7c313b9e2e.patch";
-      hash = "sha256-EL9PPiI5pDJOXf4Ck4nkRte/jHx/QWbxkjDFRSsp+so=";
-    })
-    (fetchpatch {
-      name = "0003-widget-termprops-Use-fast_float.patch";
-      url = "https://gitlab.gnome.org/GNOME/vte/-/commit/6c2761f51a0400772f443f12ea23a75576e195d3.patch";
-      hash = "sha256-jjM9bhl8EhtylUIQ2nMSNX3ugnkZQP/2POvSUDW0LM0=";
-    })
-    (fetchpatch {
-      name = "0003-build-Use-correct-path-to-include-fast_float.h.patch";
-      url = "https://gitlab.gnome.org/GNOME/vte/-/commit/d09330585e648b5c9991dffab4a06d1f127bf916.patch";
-      hash = "sha256-YGVXt2VojljYgTcmahQ2YEZGEysyUSwk+snQfoipJ+E=";
-    })
   ];
 
   nativeBuildInputs = [
+    desktop-file-utils # for desktop-file-validate
     gettext
     gobject-introspection
     gperf
@@ -134,6 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     patchShebangs perf/*
+    patchShebangs src/app/meson_desktopfile.py
     patchShebangs src/parser-seq.py
     patchShebangs src/minifont-coverage.py
     patchShebangs src/modes.py
diff --git a/pkgs/by-name/vu/vulkan-extension-layer/package.nix b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
index 3654a93409559..8fecc2e233e46 100644
--- a/pkgs/by-name/vu/vulkan-extension-layer/package.nix
+++ b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-5CtG2yWajvUYf1K/Zdy1E7V1wMGutwnqJBc8rVn8/Jk=";
+    hash = "sha256-WYlme5vEHpJHImfkGB+kmUY96fYia93WlfyutBfdxzk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulkan-headers/package.nix b/pkgs/by-name/vu/vulkan-headers/package.nix
index 27a43db9ff617..8510c2fb43af5 100644
--- a/pkgs/by-name/vu/vulkan-headers/package.nix
+++ b/pkgs/by-name/vu/vulkan-headers/package.nix
@@ -7,7 +7,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   # Adding `ninja` here to enable Ninja backend. Otherwise on gcc-14 or
   # later the build fails as:
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-LfJ7um+rzc4HdkJerHWkuPWeEc7ZFSBafbP+svAjklk=";
+    hash = "sha256-cbt0QHifjRCak+3V9J5PjNXDIEBvnwVYFa7rcmNv1VU=";
   };
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/by-name/vu/vulkan-loader/package.nix b/pkgs/by-name/vu/vulkan-loader/package.nix
index 2b3aa21792632..712d91733b521 100644
--- a/pkgs/by-name/vu/vulkan-loader/package.nix
+++ b/pkgs/by-name/vu/vulkan-loader/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-loader";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-LZRACulOrnlL9do216zTeCTXGfy2pLxqs+f9phDD3Pg=";
+    hash = "sha256-CeIjyW90Ri0MvhyFfYgss5Rjh5fHKhQf7CgBEcB/nPk=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
index aba64ca153384..88791c0cd7740 100644
--- a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   src = fetchFromGitHub {
     owner = "LunarG";
     repo = "VulkanTools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-M4DM9gUJXB+4npbtxPdVaxsh4AqKQ9J6nexa9y1an9w=";
+    hash = "sha256-VJxomhzHEIbQ8CUzlUN2fvBF+M9854FlIR0fE2RgppM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulkan-tools/package.nix b/pkgs/by-name/vu/vulkan-tools/package.nix
index fdb590743974e..b95c207125ac1 100644
--- a/pkgs/by-name/vu/vulkan-tools/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-1bODaBxL0pb+YQxqnuE9lBk7NXGKpoj4ZsInofLcm3s=";
+    hash = "sha256-47RVuhK9NDtOazG4awTjwbZSnG+thGw6GpyKmcCgWpQ=";
   };
 
   patches = [ ./wayland-scanner.patch ];
diff --git a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
index 3334e5b90bf36..59ea1f8ca1fa9 100644
--- a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
+++ b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-eXZlxdQB/EEwMzJrg+owxJ2LB1Jtd5OH9Wl+LV9JE8Y=";
+    hash = "sha256-MmC4UVa9P/0h7r8IBp1LhP9EztwyZv/ASWKKj8Gk1T8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulkan-validation-layers/package.nix b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
index bac5287bc103d..422250e5e9caf 100644
--- a/pkgs/by-name/vu/vulkan-validation-layers/package.nix
+++ b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-U9sTzf5xht3YOaThD8iE4KkXZDClFmmAv35c1t1bb7c=";
+    hash = "sha256-FavJ9QIv9J/QlY8bBSQ4C+8ZeNzge3Rov97GPOjltuA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/vu/vulkan-volk/package.nix b/pkgs/by-name/vu/vulkan-volk/package.nix
index 616b642f93225..cbbfde507c783 100644
--- a/pkgs/by-name/vu/vulkan-volk/package.nix
+++ b/pkgs/by-name/vu/vulkan-volk/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "volk";
-  version = "1.4.309.0";
+  version = "1.4.313.0";
 
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "volk";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-lqLiWGaQBUq1YwXAmuz2NBfPgu2MQNoRY9g2BcVcI6g=";
+    hash = "sha256-MXJjHfrSZiDHnCJMaKYgy2480DxNv86pbHx2ebWU2ug=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/wa/warp/package.nix b/pkgs/by-name/wa/warp/package.nix
index 963d78b627617..9f2bb741c4367 100644
--- a/pkgs/by-name/wa/warp/package.nix
+++ b/pkgs/by-name/wa/warp/package.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation rec {
   pname = "warp";
-  version = "0.8.1";
+  version = "0.9.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "warp";
-    rev = "v${version}";
-    hash = "sha256-RmihaFv+U11CAa5ax53WzpwYJ2PFOrhYt4w2iboW4m8=";
+    tag = "v${version}";
+    hash = "sha256-60FhXIO1etcMhZJuSQjO2UWrkwV+AJOFmaAIi3uLpzY=";
   };
 
   postPatch = ''
@@ -38,9 +38,8 @@ stdenv.mkDerivation rec {
   '';
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-w3gQhyRpma+aJY7IC9Vb3FdIECHZBJoSjiPmKpJ2nM8=";
+    inherit pname version src;
+    hash = "sha256-sQFJ+eR/Ywl3KPN50P2RVHKAjxtOUb6YRoThRb5aMe8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/wasistlos/package.nix b/pkgs/by-name/wa/wasistlos/package.nix
index ff96d89d7d921..3b5ae22e2e00c 100644
--- a/pkgs/by-name/wa/wasistlos/package.nix
+++ b/pkgs/by-name/wa/wasistlos/package.nix
@@ -21,7 +21,7 @@
   pcre,
   pcre2,
   pkg-config,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   wrapGAppsHook3,
   xorg,
 }:
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     pcre
     pcre2
     sqlite
-    webkitgtk_4_0
+    webkitgtk_4_1
     xorg.libXdmcp
     xorg.libXtst
   ];
diff --git a/pkgs/by-name/wh/whois/package.nix b/pkgs/by-name/wh/whois/package.nix
index 7b12b26ecf9e0..249f3bea1b635 100644
--- a/pkgs/by-name/wh/whois/package.nix
+++ b/pkgs/by-name/wh/whois/package.nix
@@ -11,14 +11,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "5.5.23";
+  version = "5.6.0";
   pname = "whois";
 
   src = fetchFromGitHub {
     owner = "rfc1036";
     repo = "whois";
     rev = "v${version}";
-    hash = "sha256-c/Mx2HXAj6mHH8rElG7+F94sSrVSL1N9HZBvaMWUjlw=";
+    hash = "sha256-NzOJMciqSY8ivvj6fBV1+w009F1zf47U1FQACSfsbUM=";
   };
 
   patches = [
diff --git a/pkgs/by-name/wl/wlay/package.nix b/pkgs/by-name/wl/wlay/package.nix
index 44d20fccb996e..4e05f5b4f7f0a 100644
--- a/pkgs/by-name/wl/wlay/package.nix
+++ b/pkgs/by-name/wl/wlay/package.nix
@@ -30,12 +30,12 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     pkg-config
     wayland-scanner
   ];
 
   buildInputs = [
-    extra-cmake-modules
     glfw3
     libX11
     libXau
diff --git a/pkgs/by-name/wx/wxGTK32/package.nix b/pkgs/by-name/wx/wxGTK32/package.nix
index 84da8dc7f019a..32d7c9489df98 100644
--- a/pkgs/by-name/wx/wxGTK32/package.nix
+++ b/pkgs/by-name/wx/wxGTK32/package.nix
@@ -28,7 +28,7 @@
   unicode ? true,
   withMesa ? !stdenv.hostPlatform.isDarwin,
   withWebKit ? true,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
 }:
 let
   catch = fetchFromGitHub {
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
       xorgproto
     ]
     ++ lib.optional withMesa libGLU
-    ++ lib.optional (withWebKit && stdenv.hostPlatform.isLinux) webkitgtk_4_0
+    ++ lib.optional (withWebKit && stdenv.hostPlatform.isLinux) webkitgtk_4_1
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       expat
     ];
diff --git a/pkgs/by-name/xb/xbitmaps/package.nix b/pkgs/by-name/xb/xbitmaps/package.nix
new file mode 100644
index 0000000000000..5d60e45dfdd95
--- /dev/null
+++ b/pkgs/by-name/xb/xbitmaps/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  testers,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xbitmaps";
+  version = "1.1.3";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/data/xbitmaps-${finalAttrs.version}.tar.xz";
+    hash = "sha256-rWytVIh4MqF9hsLM/F5Sod+rCQ+DB7FSx4sOFSnND3o=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/data/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    homepage = "https://gitlab.freedesktop.org/xorg/data/bitmaps";
+    description = "X BitMap (XBM) format bitmaps commonly used in X.Org applications";
+    license = with lib.licenses; [
+      icu
+      smlnj
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xbitmaps" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/xc/xcb-imdkit/package.nix b/pkgs/by-name/xc/xcb-imdkit/package.nix
index 538b84c1c4bf6..9d92138bd5d1d 100644
--- a/pkgs/by-name/xc/xcb-imdkit/package.nix
+++ b/pkgs/by-name/xc/xcb-imdkit/package.nix
@@ -25,12 +25,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     xorgproto
     uthash
   ];
 
   buildInputs = [
-    extra-cmake-modules
     xcbutil
     xcbutilkeysyms
   ];
diff --git a/pkgs/by-name/xc/xcb-proto/package.nix b/pkgs/by-name/xc/xcb-proto/package.nix
new file mode 100644
index 0000000000000..d5fd73e2f42c9
--- /dev/null
+++ b/pkgs/by-name/xc/xcb-proto/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  python3,
+  testers,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xcb-proto";
+  version = "1.17.0";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/proto/xcb-proto-${finalAttrs.version}.tar.xz";
+    hash = "sha256-LBus0hEPR5n3TebrtxS5TPb4D7ESMWsSGUgP0iViFIw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    python3
+  ];
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/proto/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "XML-XCB protocol descriptions used by libxcb for the X11 protocol & extensions";
+    homepage = "https://gitlab.freedesktop.org/xorg/proto/xcbproto";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xcb-proto" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-gnome/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-gnome/package.nix
index 9fa774f3c6c55..9fa4feeef447f 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-gnome/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-gnome/package.nix
@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xdg-desktop-portal-gnome";
-  version = "47.3";
+  version = "48.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/xdg-desktop-portal-gnome/${lib.versions.major finalAttrs.version}/xdg-desktop-portal-gnome-${finalAttrs.version}.tar.xz";
-    hash = "sha256-n25LFLWDNnyRXpSUdk8ny4SSf6o/nm4Bi5O7vPM2HkQ=";
+    hash = "sha256-zRWsouE2TaMI6zeWu4rkpXfmDKT+EgBrMVIyz9GciGE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ya/yandex-music/package.nix b/pkgs/by-name/ya/yandex-music/package.nix
index e70102a9d05d0..524b64a7dfc0b 100644
--- a/pkgs/by-name/ya/yandex-music/package.nix
+++ b/pkgs/by-name/ya/yandex-music/package.nix
@@ -29,13 +29,13 @@ assert lib.assertMsg (trayStyle >= 1 && trayStyle <= 3) "Tray style must be with
 assert lib.assertMsg (vibeAnimationMaxFps >= 0) "Vibe animation max FPS must be greater then 0";
 stdenvNoCC.mkDerivation rec {
   pname = "yandex-music";
-  version = "5.46.0";
+  version = "5.50.0";
 
   src = fetchFromGitHub {
     owner = "cucumber-sp";
     repo = "yandex-music-linux";
     rev = "v${version}";
-    hash = "sha256-JyDpJCNHmPV1l9+//3sgJGkD+pewuoAb33hgTUi5Ukc=";
+    hash = "sha256-xn/9LjRLm6CNLrnrLiYr9deeo09iRMEKCRFuM3SELjw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ya/yandex-music/ym_info.json b/pkgs/by-name/ya/yandex-music/ym_info.json
index d12a00180eb6f..53080379232fd 100644
--- a/pkgs/by-name/ya/yandex-music/ym_info.json
+++ b/pkgs/by-name/ya/yandex-music/ym_info.json
@@ -1,6 +1,6 @@
 {
-  "version": "5.46.0",
-  "exe_name": "Yandex_Music_x64_5.46.0.exe",
-  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.46.0.exe",
-  "exe_hash": "sha256-gvdJ/ucPeSG/oSD6ullFzWdRYzu0ovxo0qK8ZjLHi+g="
+  "version": "5.50.0",
+  "exe_name": "Yandex_Music_x64_5.50.0.exe",
+  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.50.0.exe",
+  "exe_hash": "sha256-l0QyY8iJkBO0hPUZ1gA0wyJgppO46nURa3L7JzxRBG0="
 }
diff --git a/pkgs/by-name/ze/zenity/package.nix b/pkgs/by-name/ze/zenity/package.nix
index ccd2023955663..72ee2d4932257 100644
--- a/pkgs/by-name/ze/zenity/package.nix
+++ b/pkgs/by-name/ze/zenity/package.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zenity";
-  version = "4.0.5";
+  version = "4.1.90";
 
   src = fetchurl {
     url = "mirror://gnome/sources/zenity/${lib.versions.majorMinor finalAttrs.version}/zenity-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ij/+d1G+1JenWCKezge+kRStTkagZquuTl8x1tpMDp4=";
+    hash = "sha256-vzZ5xiBf9I3OvR4d/zo6SmoLOlPhy8OwmKnsC2K9cjY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/misc/hackage/pin.json b/pkgs/data/misc/hackage/pin.json
index caabf69e91da2..5355aca3d61b9 100644
--- a/pkgs/data/misc/hackage/pin.json
+++ b/pkgs/data/misc/hackage/pin.json
@@ -1,6 +1,6 @@
 {
-  "commit": "6fc5e0d20fed4a6e8ec26f6956786d0077f028b4",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/6fc5e0d20fed4a6e8ec26f6956786d0077f028b4.tar.gz",
-  "sha256": "08vkrfn4s1jb680rq1flxas8hv04f5l715z0kh8sv909k3psbfak",
-  "msg": "Update from Hackage at 2025-03-30T11:13:14Z"
+  "commit": "611ebba3fc94becabf6cc6fbe713e4bfad592924",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/611ebba3fc94becabf6cc6fbe713e4bfad592924.tar.gz",
+  "sha256": "1gn3asjrzr6v7lcdg1vyrpv7xv74ldwbz517cvfhh2mxzrawrkmc",
+  "msg": "Update from Hackage at 2025-04-21T04:38:52Z"
 }
diff --git a/pkgs/desktops/gnome/extensions/collisions.json b/pkgs/desktops/gnome/extensions/collisions.json
index 7aa61aa30e1d4..f54e3852aeed6 100644
--- a/pkgs/desktops/gnome/extensions/collisions.json
+++ b/pkgs/desktops/gnome/extensions/collisions.json
@@ -3,42 +3,41 @@
     "Applications_Menu@rmy.pobox.com",
     "apps-menu@gnome-shell-extensions.gcampax.github.com"
   ],
-  "persian-calendar": [
-    "PersianCalendar@oxygenws.com",
-    "persian-calendar@iamrezamousavi.gmail.com"
+  "battery-time": [
+    "batime@martin.zurowietz.de",
+    "battery-time@eetumos.github.com",
+    "batterytime@typeof.pw"
   ],
-  "system-monitor": [
-    "System_Monitor@bghome.gmail.com",
-    "system-monitor@gnome-shell-extensions.gcampax.github.com"
+  "eur-usd": [
+    "eur-usd-gshell@vezza.github.com",
+    "usd-mxn-gshell@kinduff.github.com"
+  ],
+  "fullscreen-to-empty-workspace": [
+    "fullscreen-to-empty-workspace2@corgijan.dev",
+    "fullscreen-to-empty-workspace@aiono.dev"
   ],
   "fuzzy-clock": [
     "FuzzyClock@fire-man-x",
-    "FuzzyClock@johngoetz",
-    "fuzzy-clock@keepawayfromfire.co.uk"
+    "FuzzyClock@johngoetz"
   ],
-  "battery-time": [
-    "batime@martin.zurowietz.de",
-    "battery-time@eetumos.github.com",
-    "batterytime@typeof.pw"
+  "mouse-follows-focus": [
+    "mouse-follows-focus@crisidev.org",
+    "mousefollowsfocus@matthes.biz"
   ],
   "nepali-calendar": [
     "nepali-calendar-gs-extension@subashghimire.info.np",
     "nepali-date@biplab"
   ],
-  "mouse-follows-focus": [
-    "mouse-follows-focus@crisidev.org",
-    "mousefollowsfocus@matthes.biz"
+  "persian-calendar": [
+    "PersianCalendar@oxygenws.com",
+    "persian-calendar@iamrezamousavi.gmail.com"
   ],
   "power-profile-indicator": [
     "power-profile-indicator@laux.wtf",
     "power-profile@fthx"
   ],
-  "fullscreen-to-empty-workspace": [
-    "fullscreen-to-empty-workspace2@corgijan.dev",
-    "fullscreen-to-empty-workspace@aiono.dev"
-  ],
-  "eur-usd": [
-    "eur-usd-gshell@vezza.github.com",
-    "usd-mxn-gshell@kinduff.github.com"
+  "system-monitor": [
+    "System_Monitor@bghome.gmail.com",
+    "system-monitor@gnome-shell-extensions.gcampax.github.com"
   ]
 }
diff --git a/pkgs/desktops/gnome/extensions/default.nix b/pkgs/desktops/gnome/extensions/default.nix
index a8bb071473a30..db47ad5da68a3 100644
--- a/pkgs/desktops/gnome/extensions/default.nix
+++ b/pkgs/desktops/gnome/extensions/default.nix
@@ -79,7 +79,7 @@ rec {
   gnome48Extensions = mapUuidNames (produceExtensionsList "48");
 
   # Keep the last three versions in here
-  gnomeExtensions = lib.trivial.pipe (gnome45Extensions // gnome46Extensions // gnome47Extensions) [
+  gnomeExtensions = lib.trivial.pipe (gnome46Extensions // gnome47Extensions // gnome48Extensions) [
     (v: builtins.removeAttrs v [ "__attrsFailEvaluation" ])
     # Apply some custom patches for automatically packaged extensions
     (callPackage ./extensionOverrides.nix { })
diff --git a/pkgs/desktops/gnome/extensions/extensionOverrides.nix b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
index 681adcf192a16..6e180edce1870 100644
--- a/pkgs/desktops/gnome/extensions/extensionOverrides.nix
+++ b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitLab,
-  fetchzip,
   cpio,
   ddcutil,
   easyeffects,
@@ -9,9 +8,7 @@
   glib,
   nautilus,
   gobject-introspection,
-  gsound,
   hddtemp,
-  libgda6,
   libgtop,
   libhandy,
   liquidctl,
@@ -171,22 +168,6 @@ lib.trivial.pipe super [
     }
   ))
 
-  (patchExtension "pano@elhan.io" (
-    final: prev: {
-      version = "23-alpha3";
-      src = fetchzip {
-        url = "https://github.com/oae/gnome-shell-pano/releases/download/v${final.version}/pano@elhan.io.zip";
-        hash = "sha256-LYpxsl/PC8hwz0ZdH5cDdSZPRmkniBPUCqHQxB4KNhc=";
-        stripRoot = false;
-      };
-      preInstall = ''
-        substituteInPlace extension.js \
-          --replace-fail "import Gda from 'gi://Gda?version>=5.0'" "imports.gi.GIRepository.Repository.prepend_search_path('${libgda6}/lib/girepository-1.0'); const Gda = (await import('gi://Gda')).default" \
-          --replace-fail "import GSound from 'gi://GSound'" "imports.gi.GIRepository.Repository.prepend_search_path('${gsound}/lib/girepository-1.0'); const GSound = (await import('gi://GSound')).default"
-      '';
-    }
-  ))
-
   (patchExtension "system-monitor@gnome-shell-extensions.gcampax.github.com" (old: {
     patches = [
       (replaceVars
diff --git a/pkgs/desktops/gnome/extensions/extensionRenames.nix b/pkgs/desktops/gnome/extensions/extensionRenames.nix
index e8494f6631da8..6758dcace5593 100644
--- a/pkgs/desktops/gnome/extensions/extensionRenames.nix
+++ b/pkgs/desktops/gnome/extensions/extensionRenames.nix
@@ -14,7 +14,6 @@
   "System_Monitor@bghome.gmail.com" = "system-monitor-2";
 
   "FuzzyClock@fire-man-x" = "fuzzy-clock-3";
-  "fuzzy-clock@keepawayfromfire.co.uk" = "fuzzy-clock-2";
   "FuzzyClock@johngoetz" = "fuzzy-clock";
 
   "battery-time@eetumos.github.com" = "battery-time-3";
diff --git a/pkgs/desktops/gnome/extensions/manuallyPackaged.nix b/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
index b1b6e0695b2f5..0ed4252b48f4a 100644
--- a/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
+++ b/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
@@ -20,4 +20,6 @@
   "unite@hardpixel.eu" = callPackage ./unite { };
   "valent@andyholmes.ca" = callPackage ./valent { };
   "window-corner-preview@fabiomereu.it" = callPackage ./window-corner-preview { };
+  # Can be removed when https://github.com/oae/gnome-shell-pano/issues/271 resolved
+  "pano@elhan.io" = callPackage ./pano { };
 }
diff --git a/pkgs/desktops/gnome/extensions/pano/default.nix b/pkgs/desktops/gnome/extensions/pano/default.nix
new file mode 100644
index 0000000000000..906b31727b409
--- /dev/null
+++ b/pkgs/desktops/gnome/extensions/pano/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  glib,
+  libgda6,
+  gsound,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gnome-shell-extension-pano";
+  version = "23-alpha5";
+
+  src = fetchzip {
+    url = "https://github.com/oae/gnome-shell-pano/releases/download/v${finalAttrs.version}/pano@elhan.io.zip";
+    hash = "sha256-kTaJOSyFtBa/fl3Mot8Q8qyhwJwhcbBY4FvdztqUP4w=";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = [
+    glib
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    glib-compile-schemas --strict schemas
+    runHook postBuild
+  '';
+
+  preInstall = ''
+    substituteInPlace extension.js \
+      --replace-fail "import Gda from 'gi://Gda?version>=5.0'" "imports.gi.GIRepository.Repository.prepend_search_path('${libgda6}/lib/girepository-1.0'); const Gda = (await import('gi://Gda')).default" \
+      --replace-fail "import GSound from 'gi://GSound'" "imports.gi.GIRepository.Repository.prepend_search_path('${gsound}/lib/girepository-1.0'); const GSound = (await import('gi://GSound')).default"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/gnome-shell/extensions
+    cp -r -T . $out/share/gnome-shell/extensions/pano@elhan.io
+    runHook postInstall
+  '';
+
+  passthru = {
+    extensionPortalSlug = "pano";
+    extensionUuid = "pano@elhan.io";
+  };
+
+  meta = with lib; {
+    description = "Next-gen Clipboard Manager for Gnome Shell";
+    homepage = "https://github.com/oae/gnome-shell-pano";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ honnip ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/desktops/gnome/extensions/update-extensions.py b/pkgs/desktops/gnome/extensions/update-extensions.py
index 222d9b77c8f3e..9faf6a574b1c5 100755
--- a/pkgs/desktops/gnome/extensions/update-extensions.py
+++ b/pkgs/desktops/gnome/extensions/update-extensions.py
@@ -35,7 +35,7 @@
 }
 
 # shell versions that we want to put into the gnomeExtensions attr set
-versions_to_merge = ["45", "46", "47"]
+versions_to_merge = ["46", "47", "48"]
 
 # Some type alias to increase readability of complex compound types
 PackageName = str
@@ -351,7 +351,7 @@ def find_collisions(
                 package_name_registry.setdefault(pname, set()).add(uuid)
     return {
         pname: sorted(uuids)
-        for pname, uuids in package_name_registry.items()
+        for pname, uuids in sorted(package_name_registry.items())
         if len(uuids) > 1
     }
 
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 3b09398dc678e..3382e69399736 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -69,7 +69,6 @@ let
       "--with-as=${
         if targetPackages.stdenv.cc.bintools.isLLVM then binutils else targetPackages.stdenv.cc.bintools
       }/bin/${targetPlatform.config}-as"
-      "--with-ld=${targetPackages.stdenv.cc.bintools}/bin/${targetPlatform.config}-ld"
     ]
     ++ (
       if withoutTargetLibc then
diff --git a/pkgs/development/compilers/ghc/8.10.7.nix b/pkgs/development/compilers/ghc/8.10.7.nix
index b794cf656b8ad..c972f29289d3b 100644
--- a/pkgs/development/compilers/ghc/8.10.7.nix
+++ b/pkgs/development/compilers/ghc/8.10.7.nix
@@ -640,6 +640,8 @@ stdenv.mkDerivation (
 
       # Our Cabal compiler name
       haskellCompilerName = "ghc-${version}";
+
+      bootstrapAvailable = lib.meta.availableOn stdenv.buildPlatform bootPkgs.ghc;
     };
 
     meta = {
diff --git a/pkgs/development/compilers/ghc/common-hadrian.nix b/pkgs/development/compilers/ghc/common-hadrian.nix
index 69615a939445f..f94890b913580 100644
--- a/pkgs/development/compilers/ghc/common-hadrian.nix
+++ b/pkgs/development/compilers/ghc/common-hadrian.nix
@@ -285,7 +285,7 @@
       # freeHaskellFunPtr is called with nixpkgs' hardening flags.
       # https://gitlab.haskell.org/ghc/ghc/-/issues/25485
       # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13599
-      ++ lib.optionals (lib.versionOlder version "9.13" && stdenv.hostPlatform.is32bit) [
+      ++ lib.optionals (lib.versionOlder version "9.13") [
         (fetchpatch {
           name = "ghc-rts-adjustor-fix-i386-stack-overrun.patch";
           url = "https://gitlab.haskell.org/ghc/ghc/-/commit/39bb6e583d64738db51441a556d499aa93a4fc4a.patch";
@@ -839,6 +839,8 @@ stdenv.mkDerivation (
       # TODO(@sternenseemann): there's no stage0:exe:haddock target by default,
       # so haddock isn't available for GHC cross-compilers. Can we fix that?
       hasHaddock = stdenv.hostPlatform == stdenv.targetPlatform;
+
+      bootstrapAvailable = lib.meta.availableOn stdenv.buildPlatform bootPkgs.ghc;
     };
 
     meta = {
diff --git a/pkgs/development/compilers/ghc/common-make-native-bignum.nix b/pkgs/development/compilers/ghc/common-make-native-bignum.nix
index 3c236bb4c45d4..03ad68c392a19 100644
--- a/pkgs/development/compilers/ghc/common-make-native-bignum.nix
+++ b/pkgs/development/compilers/ghc/common-make-native-bignum.nix
@@ -645,6 +645,8 @@ stdenv.mkDerivation (
 
       # Our Cabal compiler name
       haskellCompilerName = "ghc-${version}";
+
+      bootstrapAvailable = lib.meta.availableOn stdenv.buildPlatform bootPkgs.ghc;
     };
 
     meta = {
diff --git a/pkgs/development/compilers/go/1.24.nix b/pkgs/development/compilers/go/1.24.nix
index 6991b06118b65..51cdecec738c9 100644
--- a/pkgs/development/compilers/go/1.24.nix
+++ b/pkgs/development/compilers/go/1.24.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.24.2";
+  version = "1.24.3";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-ncd/+twW2DehvzLZnGJMtN8GR87nsRnt2eexvMBfLgA=";
+    hash = "sha256-IpwItgCxRGeYEJ+uH1aSKBAshHPKuoEEtkGMtbwDKHg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/llvm/common/clang/default.nix b/pkgs/development/compilers/llvm/common/clang/default.nix
index 8a65d5750d53b..f3d434b6ac575 100644
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@@ -302,6 +302,7 @@ stdenv.mkDerivation (
         ++ (finalAttrs.passthru.hardeningUnsupportedFlags or [ ]);
     };
 
+    requiredSystemFeatures = [ "big-parallel" ];
     meta = llvm_meta // {
       homepage = "https://clang.llvm.org/";
       description = "C language family frontend for LLVM";
diff --git a/pkgs/development/compilers/llvm/common/llvm/default.nix b/pkgs/development/compilers/llvm/common/llvm/default.nix
index d9a6f80874966..a605c17e492c5 100644
--- a/pkgs/development/compilers/llvm/common/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -559,19 +559,11 @@ stdenv.mkDerivation (
         ));
 
     # Workaround for configure flags that need to have spaces
-    preConfigure =
-      if lib.versionAtLeast release_version "15" then
-        ''
-          cmakeFlagsArray+=(
-            -DLLVM_LIT_ARGS="-svj''${NIX_BUILD_CORES} --no-progress-bar"
-          )
-        ''
-      else
-        ''
-          cmakeFlagsArray+=(
-            -DLLVM_LIT_ARGS='-svj''${NIX_BUILD_CORES} --no-progress-bar'
-          )
-        '';
+    preConfigure = ''
+      cmakeFlagsArray+=(
+        -DLLVM_LIT_ARGS="--verbose -j''${NIX_BUILD_CORES}"
+      )
+    '';
 
     # E.g. Mesa uses the build-id as a cache key (see #93946):
     LDFLAGS = optionalString (
diff --git a/pkgs/development/compilers/llvm/common/mlir/default.nix b/pkgs/development/compilers/llvm/common/mlir/default.nix
index fc3c7cb9116b6..66441232d968b 100644
--- a/pkgs/development/compilers/llvm/common/mlir/default.nix
+++ b/pkgs/development/compilers/llvm/common/mlir/default.nix
@@ -87,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
+  requiredSystemFeatures = [ "big-parallel" ];
   meta = llvm_meta // {
     homepage = "https://mlir.llvm.org/";
     description = "Multi-Level IR Compiler Framework";
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 0d78708d7da3c..26ff6f45891d2 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -9,6 +9,7 @@
   strace,
   texinfo,
   which,
+  writableTmpDirAsHomeHook,
   writeText,
   zstd,
   version,
@@ -32,12 +33,12 @@ let
     };
     # By unofficial and very loose convention we keep the latest version of
     # SBCL, and the previous one in case someone quickly needs to roll back.
-    "2.5.1" = {
-      sha256 = "sha256-QTOzbNFtFNYzlpw3/VHCyJqOpdbhYRVSgZ2R9xshn4s=";
-    };
     "2.5.2" = {
       sha256 = "sha256-XcJ+un3aQz31P9dEHeixFHSoLNrBaJwfbOVfoGXWX6w=";
     };
+    "2.5.4" = {
+      sha256 = "sha256-XxS07ZKUKp44dZT6wAC5bbdGfpzlYTBn/8CSPfPsIHI=";
+    };
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If ECL (or any other
@@ -97,6 +98,7 @@ stdenv.mkDerivation (self: {
     ++ lib.optionals self.doCheck (
       [
         which
+        writableTmpDirAsHomeHook
       ]
       ++ lib.optionals (builtins.elem stdenv.system strace.meta.platforms) [
         strace
@@ -133,18 +135,20 @@ stdenv.mkDerivation (self: {
   # altogether. One by one hopefully we can fix these (on ofBorg,
   # upstream--somehow some way) in due time.
   disabledTestFiles =
-    lib.optionals
-      (builtins.elem stdenv.hostPlatform.system [
-        "x86_64-linux"
-        "aarch64-linux"
-      ])
-      [
-        "foreign-stack-alignment.impure.lisp"
-        # Floating point tests are fragile
-        # https://sourceforge.net/p/sbcl/mailman/message/58728554/
-        "compiler.pure.lisp"
-        "float.pure.lisp"
-      ]
+    lib.optionals (lib.versionOlder "2.5.2" self.version) [ "debug.impure.lisp" ]
+    ++
+      lib.optionals
+        (builtins.elem stdenv.hostPlatform.system [
+          "x86_64-linux"
+          "aarch64-linux"
+        ])
+        [
+          "foreign-stack-alignment.impure.lisp"
+          # Floating point tests are fragile
+          # https://sourceforge.net/p/sbcl/mailman/message/58728554/
+          "compiler.pure.lisp"
+          "float.pure.lisp"
+        ]
     ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
       # This is failing on aarch64-linux on ofBorg. Not on my local machine nor on
       # a VM on my laptop. Not sure what’s wrong.
@@ -153,16 +157,24 @@ stdenv.mkDerivation (self: {
       # have it block a release.
       "futex-wait.test.sh"
     ];
-  patches = [
+  patches =
     # Support the NIX_SBCL_DYNAMIC_SPACE_SIZE envvar. Upstream SBCL didn’t want
     # to include this (see
     # "https://sourceforge.net/p/sbcl/mailman/sbcl-devel/thread/2cf20df7-01d0-44f2-8551-0df01fe55f1a%400brg.net/"),
     # but for Nix envvars are sufficiently useful that it’s worth maintaining
     # this functionality downstream.
-    ./dynamic-space-size-envvar-feature.patch
-    ./dynamic-space-size-envvar-tests.patch
-  ];
-  postPatch =
+    if lib.versionOlder "2.5.2" self.version then
+      [
+        ./dynamic-space-size-envvar-2.5.3-feature.patch
+        ./dynamic-space-size-envvar-2.5.3-tests.patch
+      ]
+    else
+      [
+        ./dynamic-space-size-envvar-2.5.2-feature.patch
+        ./dynamic-space-size-envvar-2.5.2-tests.patch
+      ];
+
+  sbclPatchPhase =
     lib.optionalString (self.disabledTestFiles != [ ]) ''
       (cd tests ; rm -f ${lib.concatStringsSep " " self.disabledTestFiles})
     ''
@@ -191,11 +203,7 @@ stdenv.mkDerivation (self: {
       fi
     '';
 
-  preBuild = ''
-    export INSTALL_ROOT=$out
-    mkdir -p test-home
-    export HOME=$PWD/test-home
-  '';
+  preConfigurePhases = "sbclPatchPhase";
 
   enableFeatures =
     assert lib.assertMsg (
@@ -232,6 +240,7 @@ stdenv.mkDerivation (self: {
   buildPhase = ''
     runHook preBuild
 
+    export INSTALL_ROOT=$out
     sh make.sh ${lib.concatStringsSep " " self.buildArgs}
     (cd doc/manual ; make info)
 
@@ -257,7 +266,7 @@ stdenv.mkDerivation (self: {
     ''
       runHook preInstall
 
-      INSTALL_ROOT=$out sh install.sh
+      sh install.sh
 
     ''
     + lib.optionalString (!self.purgeNixReferences) ''
diff --git a/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-feature.patch b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-2.5.2-feature.patch
similarity index 100%
rename from pkgs/development/compilers/sbcl/dynamic-space-size-envvar-feature.patch
rename to pkgs/development/compilers/sbcl/dynamic-space-size-envvar-2.5.2-feature.patch
diff --git a/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-tests.patch b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-2.5.2-tests.patch
similarity index 100%
rename from pkgs/development/compilers/sbcl/dynamic-space-size-envvar-tests.patch
rename to pkgs/development/compilers/sbcl/dynamic-space-size-envvar-2.5.2-tests.patch
diff --git a/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-2.5.3-feature.patch b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-2.5.3-feature.patch
new file mode 100644
index 0000000000000..3d50e30c49c2a
--- /dev/null
+++ b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-2.5.3-feature.patch
@@ -0,0 +1,64 @@
+From 9c899f7b8089eee7ce471f237d2046882298c4fc Mon Sep 17 00:00:00 2001
+From: Hraban Luyat <hraban@0brg.net>
+Date: Sat, 13 Apr 2024 14:04:57 -0400
+Subject: [PATCH 1/2] feat: NIX_SBCL_DYNAMIC_SPACE_SIZE envvar
+
+---
+ src/runtime/runtime.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/src/runtime/runtime.c b/src/runtime/runtime.c
+index 2b1f8b634..4f3f51139 100644
+--- a/src/runtime/runtime.c
++++ b/src/runtime/runtime.c
+@@ -416,6 +416,29 @@ static int is_memsize_arg(char *argv[], int argi, int argc, int *merge_core_page
+     return 0;
+ }
+ 
++/**
++ * Read memory options from the environment, if present.
++ *
++ * Memory settings are read in the following priority:
++ *
++ * 1. command line arguments
++ * 2. environment variable
++ * 3. embedded options in core
++ * 4. default
++ */
++static void
++read_memsize_from_env(void) {
++  const char *val = getenv("NIX_SBCL_DYNAMIC_SPACE_SIZE");
++  // The distinction is blurry between setting an envvar to the empty string and
++  // unsetting it entirely. Depending on the calling environment it can even be
++  // tricky to properly unset an envvar in the first place. An empty envvar is
++  // practically always intended to just mean “unset”, so let’s interpret it
++  // that way.
++  if (val != NULL && (strcmp(val, "") != 0)) {
++    dynamic_space_size = parse_size_arg(val, "NIX_SBCL_DYNAMIC_SPACE_SIZE");
++  }
++}
++
+ static struct cmdline_options
+ parse_argv(struct memsize_options memsize_options,
+            int argc, char *argv[], char *envp[], char *core)
+@@ -457,6 +480,9 @@ parse_argv(struct memsize_options memsize_options,
+         thread_control_stack_size = memsize_options.thread_control_stack_size;
+         dynamic_values_bytes = memsize_options.thread_tls_bytes;
+         if (memsize_options.present_in_core == 2) {
++            /* Only accept environment variable memory options where you would
++             * accept those options as command-line arguments. */
++            read_memsize_from_env();
+             int stop_parsing = 0; // have we seen '--'
+             int output_index = 1;
+ #ifndef LISP_FEATURE_WIN32
+@@ -490,6 +516,7 @@ parse_argv(struct memsize_options memsize_options,
+ #endif
+         }
+     } else {
++        read_memsize_from_env();
+         bool end_runtime_options = 0;
+         /* Parse our any of the command-line options that we handle from C,
+          * stopping at the first one that we don't, and leave the rest */
+-- 
+2.48.1
+
diff --git a/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-2.5.3-tests.patch b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-2.5.3-tests.patch
new file mode 100644
index 0000000000000..1282e0c3b036e
--- /dev/null
+++ b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-2.5.3-tests.patch
@@ -0,0 +1,130 @@
+From 979a92d10731bae90e611b98d29be8d187f0f1f8 Mon Sep 17 00:00:00 2001
+From: Hraban Luyat <hraban@0brg.net>
+Date: Sat, 13 Apr 2024 15:39:58 -0400
+Subject: [PATCH 2/2] test: dynamic space size envvar and precedence
+
+---
+ tests/memory-args.test.sh | 22 ++++++++++++++++++
+ tests/save7.test.sh       | 49 ++++++++++++++++++++++++++++++++++-----
+ 2 files changed, 65 insertions(+), 6 deletions(-)
+ create mode 100755 tests/memory-args.test.sh
+
+diff --git a/tests/memory-args.test.sh b/tests/memory-args.test.sh
+new file mode 100755
+index 000000000..72ef0cc79
+--- /dev/null
++++ b/tests/memory-args.test.sh
+@@ -0,0 +1,22 @@
++#!/bin/sh
++
++. ./subr.sh
++
++use_test_subdirectory
++
++set -e
++
++# Allow slight shrinkage if heap relocation has to adjust for alignment
++NIX_SBCL_DYNAMIC_SPACE_SIZE=234mb run_sbcl_with_args --script <<EOF
++(assert (<= 0 (- (* 234 1024 1024) (sb-ext:dynamic-space-size)) 65536))
++EOF
++
++NIX_SBCL_DYNAMIC_SPACE_SIZE=555mb run_sbcl_with_args --dynamic-space-size 234mb --script <<EOF
++(assert (<= 0 (- (* 234 1024 1024) (sb-ext:dynamic-space-size)) 65536))
++EOF
++
++run_sbcl_with_args --dynamic-space-size 234mb --script <<EOF
++(assert (<= 0 (- (* 234 1024 1024) (sb-ext:dynamic-space-size)) 65536))
++EOF
++
++exit $EXIT_TEST_WIN
+diff --git a/tests/save7.test.sh b/tests/save7.test.sh
+index dd112f220..d56bddbc2 100644
+--- a/tests/save7.test.sh
++++ b/tests/save7.test.sh
+@@ -25,6 +25,9 @@ echo "::: Success"
+ 
+ run_sbcl_with_args --noinform --control-stack-size 384KB --dynamic-space-size 260MB \
+     --disable-debugger --no-userinit --no-sysinit --noprint <<EOF
++  ; allow slight shrinkage if heap relocation has to adjust for alignment
++  (defun dynamic-space-size-good-p (expected-mb)
++    (<= 0 (- (* expected-mb 1024 1024) (dynamic-space-size)) 65536))
+   (save-lisp-and-die "$tmpcore" :executable t :save-runtime-options :accept-runtime-options)
+ EOF
+ chmod u+x "$tmpcore"
+@@ -57,6 +60,29 @@ if [ $? -ne 0 ]; then
+ fi
+ echo "::: Success"
+ 
++echo "::: Running :DYNAMIC-SPACE-SIZE-ENV-ACCEPT"
++NIX_SBCL_DYNAMIC_SPACE_SIZE=432MB ./"$tmpcore" --no-userinit --no-sysinit --noprint <<EOF
++  (when (dynamic-space-size-good-p 432)
++    (exit :code 42))
++EOF
++if [ $? -ne 42 ]; then
++  exit 1
++fi
++echo "::: Success"
++
++echo "::: Running :DYNAMIC-SPACE-SIZE-PRECEDENCE"
++NIX_SBCL_DYNAMIC_SPACE_SIZE=432MB ./"$tmpcore" --dynamic-space-size 333MB \
++  --no-userinit --no-sysinit --noprint <<EOF
++  (when (dynamic-space-size-good-p 333))
++    (exit :code 42))
++EOF
++status=$?
++if [ $status -ne 42 ]; then
++    echo "saved core should have prioritized memory specification from arg"
++    exit 1
++fi
++echo "::: Success"
++
+ echo "::: Running :DYNAMIC-SPACE-SIZE-ARG"
+ run_sbcl_with_core "$tmpcore" --noinform --control-stack-size 640KB \
+     --tls-limit 5000 \
+@@ -64,10 +90,7 @@ run_sbcl_with_core "$tmpcore" --noinform --control-stack-size 640KB \
+   (assert (eql (extern-alien "thread_control_stack_size" unsigned) (* 640 1024)))
+   (assert (eql (extern-alien "dynamic_values_bytes" (unsigned 32))
+                (* 5000 sb-vm:n-word-bytes)))
+-  ; allow slight shrinkage if heap relocation has to adjust for alignment
+-  (defun dynamic-space-size-good-p ()
+-    (<= 0 (- (* 260 1048576) (dynamic-space-size)) 65536))
+-  (assert (dynamic-space-size-good-p))
++  (assert (dynamic-space-size-good-p 260))
+   (save-lisp-and-die "${tmpcore}2" :executable t :save-runtime-options t)
+ EOF
+ chmod u+x "${tmpcore}2"
+@@ -76,15 +99,29 @@ echo "::: INFO: prepared test core"
+   (when (and (eql (extern-alien "thread_control_stack_size" unsigned) (* 640 1024))
+              (eql (extern-alien "dynamic_values_bytes" (unsigned 32))
+                   (* 5000 sb-vm:n-word-bytes))
+-             (dynamic-space-size-good-p))
++             (dynamic-space-size-good-p 260))
+     (exit :code 42))
+ EOF
+ status=$?
+-rm "$tmpcore" "${tmpcore}2"
+ if [ $status -ne 42 ]; then
+     echo "re-saved executable used wrong memory size options"
+     exit 1
+ fi
+ echo "::: Success"
+ 
++echo "::: Running :DYNAMIC-SPACE-SIZE-ENV-IGNORE"
++NIX_SBCL_DYNAMIC_SPACE_SIZE=432MB ./"${tmpcore}2" --no-userinit --no-sysinit --noprint <<EOF
++  (when (dynamic-space-size-good-p 260)
++    (exit :code 42))
++EOF
++status=$?
++if [ $status -ne 42 ]; then
++    echo "re-saved executable should have ignored memory specification from env"
++    exit 1
++fi
++echo "::: Success"
++rm "$tmpcore" "${tmpcore}2"
++
++
++
+ exit $EXIT_TEST_WIN
+-- 
+2.48.1
+
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 9f80c8382b7b7..33ed87c4bf284 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -129,8 +129,8 @@ let
 in
 rec {
   vala_0_56 = generic {
-    version = "0.56.17";
-    hash = "sha256-JhAMTk7wBJxhknXxQNl89WWIPQDHVDyCvM5aQmk07Wo=";
+    version = "0.56.18";
+    hash = "sha256-8q/+fUCrY9uOe57MP2vcnC/H4xNMhP8teV9IL+kmo4I=";
   };
 
   vala = vala_0_56;
diff --git a/pkgs/development/haskell-modules/cabal2nix-unstable.nix b/pkgs/development/haskell-modules/cabal2nix-unstable.nix
index 4a212e7f76d9d..8a0cda37add8c 100644
--- a/pkgs/development/haskell-modules/cabal2nix-unstable.nix
+++ b/pkgs/development/haskell-modules/cabal2nix-unstable.nix
@@ -35,10 +35,10 @@
 }:
 mkDerivation {
   pname = "cabal2nix";
-  version = "unstable-2025-04-22";
+  version = "unstable-2025-04-30";
   src = fetchzip {
-    url = "https://github.com/NixOS/cabal2nix/archive/e6ed81965def7775aabdda7456d0c13f626295ee.tar.gz";
-    sha256 = "1fh428r4wfrqjj77dxy1l3d9scm4ywz89rp7dhp07y3bq5yr7hs4";
+    url = "https://github.com/NixOS/cabal2nix/archive/fbe593fe71b916861b97117dfb91f7aae9c4fcce.tar.gz";
+    sha256 = "0sdyyawsz5zl2ffg4h4r3xcf73gfz9v0vgahccbp01if3m2g7p0y";
   };
   postUnpack = "sourceRoot+=/cabal2nix; echo source root reset to $sourceRoot";
   isLibrary = true;
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 29d5bc9c08080..1c64baf583d97 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -20,6 +20,30 @@ with haskellLib;
 
 self: super:
 {
+  # Hackage's accelerate is from 2020 and incomptible with our GHC.
+  # The existing derivation also has missing dependencies
+  # compared to the source from github.
+  # https://github.com/AccelerateHS/accelerate/issues/553
+  accelerate =
+    assert super.accelerate.version == "1.3.0.0";
+    lib.pipe super.accelerate [
+      (addBuildDepends [
+        self.double-conversion
+        self.formatting
+        self.microlens
+      ])
+
+      (overrideCabal (drv: {
+        version = "1.3.0.0-unstable-2025-04-25";
+        src = pkgs.fetchFromGitHub {
+          owner = "AccelerateHS";
+          repo = "accelerate";
+          rev = "3f681a5091eddf5a3b97f4cd0de32adc830e1117";
+          sha256 = "sha256-tCcl7wAls+5cBSrqbxfEAJngbV43OJcLJdaC4qqkBxc=";
+        };
+      }))
+    ];
+
   # https://github.com/ivanperez-keera/dunai/issues/427
   dunai = addBuildDepend self.list-transformer (enableCabalFlag "list-transformer" super.dunai);
 
@@ -34,7 +58,7 @@ self: super:
       Cabal-syntax = self.Cabal-syntax_3_12_1_0;
     }
   );
-  Cabal_3_14_1_1 =
+  Cabal_3_14_2_0 =
     overrideCabal
       (drv: {
         # Revert increased lower bound on unix since we have backported
@@ -47,15 +71,15 @@ self: super:
       })
       (
         doDistribute (
-          super.Cabal_3_14_1_1.override {
-            Cabal-syntax = self.Cabal-syntax_3_14_1_0;
+          super.Cabal_3_14_2_0.override {
+            Cabal-syntax = self.Cabal-syntax_3_14_2_0;
           }
         )
       );
 
   # Needs matching version of Cabal
   Cabal-hooks = super.Cabal-hooks.override {
-    Cabal = self.Cabal_3_14_1_1;
+    Cabal = self.Cabal_3_14_2_0;
   };
 
   # cabal-install needs most recent versions of Cabal and Cabal-syntax,
@@ -67,8 +91,8 @@ self: super:
         cabalInstallOverlay =
           cself: csuper:
           lib.optionalAttrs (lib.versionOlder self.ghc.version "9.12") {
-            Cabal = cself.Cabal_3_14_1_1;
-            Cabal-syntax = cself.Cabal-syntax_3_14_1_0;
+            Cabal = cself.Cabal_3_14_2_0;
+            Cabal-syntax = cself.Cabal-syntax_3_14_2_0;
           };
       in
       {
@@ -248,20 +272,6 @@ self: super:
     sha256 = "10zkvclyir3zf21v41zdsvg68vrkq89n64kv9k54742am2i4aygf";
   }) super.weeder;
 
-  # Allow aeson == 2.1.*
-  # https://github.com/hdgarrood/aeson-better-errors/issues/23
-  aeson-better-errors = lib.pipe super.aeson-better-errors [
-    doJailbreak
-    (appendPatches [
-      # https://github.com/hdgarrood/aeson-better-errors/pull/25
-      (fetchpatch {
-        name = "mtl-2-3.patch";
-        url = "https://github.com/hdgarrood/aeson-better-errors/commit/1ec49ab7d1472046b680b5a64ae2930515b47714.patch";
-        hash = "sha256-xuuocWxSoBDclVp0bJ9UrDamVcDVOAFgJIi/un1xBvk=";
-      })
-    ])
-  ];
-
   # Version 2.1.1 is deprecated, but part of Stackage LTS at the moment.
   # https://github.com/commercialhaskell/stackage/issues/7500
   # https://github.com/yesodweb/shakespeare/issues/280
@@ -478,7 +488,7 @@ self: super:
           name = "git-annex-${super.git-annex.version}-src";
           url = "git://git-annex.branchable.com/";
           rev = "refs/tags/" + super.git-annex.version;
-          sha256 = "18n6ah4d5i8qhx1s95zsb8bg786v0nv9hcjyxggrk88ya77maxha";
+          sha256 = "10prmih74h31fwv14inqavzmm25hmlr24h49h9lpxqd88dn3r9cd";
           # delete android and Android directories which cause issues on
           # darwin (case insensitive directory). Since we don't need them
           # during the build process, we can delete it to prevent a hash
@@ -899,16 +909,6 @@ self: super:
   # "base" dependency.
   haddock-cheatsheet = doJailbreak super.haddock-cheatsheet;
 
-  # https://github.com/Gabriella439/Haskell-MVC-Updates-Library/pull/1
-  mvc-updates = appendPatches [
-    (pkgs.fetchpatch {
-      name = "rename-pretraverse.patch";
-      url = "https://github.com/Gabriella439/Haskell-MVC-Updates-Library/commit/47b31202b761439947ffbc89ec1c6854c1520819.patch";
-      sha256 = "sha256-a6k3lWtXNYUIjWXR+vRAHz2bANq/2eM0F5FLL8Qt2lA=";
-      includes = [ "src/MVC/Updates.hs" ];
-    })
-  ] (doJailbreak super.mvc-updates);
-
   # Too strict bounds on bytestring < 0.12
   # https://github.com/Gabriella439/Haskell-Pipes-HTTP-Library/issues/18
   pipes-http = doJailbreak super.pipes-http;
@@ -1232,14 +1232,16 @@ self: super:
   # test suite requires git and does a bunch of git operations
   restless-git = dontCheck super.restless-git;
 
-  sensei = overrideCabal (drv: {
-    # sensei passes `-package hspec-meta` to GHC in the tests, but doesn't
-    # depend on it itself.
-    testHaskellDepends = drv.testHaskellDepends or [ ] ++ [ self.hspec-meta ];
-    # requires git at test-time *and* runtime, but we'll just rely on users to
-    # bring their own git at runtime.
-    testToolDepends = drv.testToolDepends or [ ] ++ [ pkgs.git ];
-  }) super.sensei;
+  # Missing test files
+  # https://github.com/pbrisbin/jsonpatch/issues/10
+  jsonpatch = overrideCabal (drv: {
+    testTargets =
+      lib.warnIf (lib.versionAtLeast drv.version "0.3.0.2")
+        "haskellPackages.jsonpatch: override can be dropped"
+        [
+          "readme" # disabled: "spec"
+        ];
+  }) super.jsonpatch;
 
   # Work around https://github.com/haskell/c2hs/issues/192.
   c2hs = dontCheck super.c2hs;
@@ -1460,22 +1462,7 @@ self: super:
   hjsmin = dontCheck super.hjsmin;
 
   # Remove for hail > 0.2.0.0
-  hail = overrideCabal (drv: {
-    patches = [
-      (fetchpatch {
-        # Relax dependency constraints,
-        # upstream PR: https://github.com/james-preston/hail/pull/13
-        url = "https://patch-diff.githubusercontent.com/raw/james-preston/hail/pull/13.patch";
-        sha256 = "039p5mqgicbhld2z44cbvsmam3pz0py3ybaifwrjsn1y69ldsmkx";
-      })
-      (fetchpatch {
-        # Relax dependency constraints,
-        # upstream PR: https://github.com/james-preston/hail/pull/16
-        url = "https://patch-diff.githubusercontent.com/raw/james-preston/hail/pull/16.patch";
-        sha256 = "0dpagpn654zjrlklihsg911lmxjj8msylbm3c68xa5aad1s9gcf7";
-      })
-    ];
-  }) super.hail;
+  hail = doJailbreak super.hail;
 
   # https://github.com/kazu-yamamoto/dns/issues/150
   dns = dontCheck super.dns;
@@ -2757,31 +2744,26 @@ self: super:
       [
         # 2023-12-20: New version needs extra dependencies
         (addBuildDepends [
+          self.cache
           self.extra
           self.fuzzyset_0_2_4
-          self.cache
-          self.timeit
+          self.jose-jwt
+          self.neat-interpolation
           self.prometheus-client
+          self.timeit
         ])
         # 2022-12-02: Too strict bounds.
         doJailbreak
         # 2022-12-02: Hackage release lags behind actual releases: https://github.com/PostgREST/postgrest/issues/2275
         (overrideSrc rec {
-          version = "12.2.7";
+          version = "13.0.0";
           src = pkgs.fetchFromGitHub {
             owner = "PostgREST";
             repo = "postgrest";
             rev = "v${version}";
-            hash = "sha256-4lKA+U7J8maKiDX9CWxWGjepGKSUu4ZOAA188yMt0bU=";
+            hash = "sha256-j+WlY7D3hkPHIjiyCFenC5trF31L05gEPptCwOVil6U=";
           };
         })
-        # 2024-11-03: Fixes build on aarch64-darwin. Can be removed after updating to 13+.
-        (appendPatches [
-          (fetchpatch {
-            url = "https://github.com/PostgREST/postgrest/commit/c045b261c4f7d2c2514e858120950be6b3ddfba8.patch";
-            hash = "sha256-6SeteL5sb+/K1y3f9XL7yNzXDdD1KQp91RNP4kutSLE=";
-          })
-        ])
       ];
 
   # Too strict bounds on hspec < 2.11
@@ -2939,14 +2921,6 @@ self: super:
     }
   ) super.feedback;
 
-  # https://github.com/maralorn/haskell-taskwarrior/pull/12
-  taskwarrior = appendPatches [
-    (fetchpatch {
-      url = "https://github.com/maralorn/haskell-taskwarrior/commit/b846c6ae64e716dca2d44488f60fee3697b5322d.patch";
-      sha256 = "sha256-fwBYBmw9Jva2UEPQ6E/5/HBA8ZDiM7/QQQDBp3diveU=";
-    })
-  ] super.taskwarrior;
-
   testcontainers = lib.pipe super.testcontainers [
     dontCheck # Tests require docker
     doJailbreak # https://github.com/testcontainers/testcontainers-hs/pull/58
@@ -3024,10 +2998,6 @@ self: super:
   # jailbreak to allow deepseq >= 1.5, https://github.com/jumper149/blucontrol/issues/3
   blucontrol = doJailbreak super.blucontrol;
 
-  # Stackage LTS 23.17 has 0.1.5, which was marked deprecated as it was broken.
-  # Can probably be dropped for Stackage LTS >= 23.18
-  network-control = doDistribute self.network-control_0_1_6;
-
   # Needs to match pandoc, see:
   # https://github.com/jgm/pandoc/commit/97b36ecb7703b434ed4325cc128402a9eb32418d
   commonmark-pandoc = doDistribute self.commonmark-pandoc_0_2_2_3;
@@ -3069,19 +3039,28 @@ self: super:
     assert super.bzlib.version == "0.5.2.0";
     doJailbreak super.bzlib;
 
-  what4 = lib.pipe super.what4 [
-    (addTestToolDepends (
-      with pkgs;
-      [
-        cvc4
-        cvc5
-        z3
+  inherit
+    (lib.mapAttrs (
+      _: pkg:
+      lib.pipe pkg [
+        (addTestToolDepends (
+          with pkgs;
+          [
+            cvc4
+            cvc5
+            z3
+          ]
+        ))
+        # 2025-04-09: FIXME: template_tests still failing with:
+        #   fd:9: hPutBuf: resource vanished (Broken pipe)
+        dontCheck
+
+        doDistribute
       ]
-    ))
-    # 2025-04-09: template_tests still failing with:
-    #   fd:9: hPutBuf: resource vanished (Broken pipe)
-    dontCheck
-  ];
+    ) super)
+    what4
+    what4_1_7
+    ;
 
   copilot-theorem = lib.pipe super.copilot-theorem [
     (addTestToolDepends (with pkgs; [ z3 ]))
@@ -3157,7 +3136,23 @@ self: super:
   # 2025-04-13: jailbreak to allow th-abstraction >= 0.7
   crucible =
     assert super.crucible.version == "0.7.2";
-    doJailbreak super.crucible;
+    doJailbreak (
+      super.crucible.override {
+        what4 = self.what4_1_7;
+      }
+    );
+
+  crucible-llvm = super.crucible-llvm.override {
+    what4 = self.what4_1_7;
+  };
+
+  # Test suite invokes cabal-install in a way incompatible with our generic builder
+  # (i.e. tries to re-use the ghc package db / environment from dist-newstyle).
+  sensei = dontCheck super.sensei;
+
+  crux = super.crux.override {
+    simple-get-opt = self.simple-get-opt_0_4;
+  };
 
   # 2025-04-23: jailbreak to allow megaparsec >= 9.7
   # 2025-04-23: test data missing from tarball
diff --git a/pkgs/development/haskell-modules/configuration-darwin.nix b/pkgs/development/haskell-modules/configuration-darwin.nix
index 1abc538fe6635..67fe45c2a1029 100644
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -330,6 +330,10 @@ self: super:
 
     sysinfo = dontCheck super.sysinfo;
 
+    network = super.network.overrideAttrs (drv: {
+      __darwinAllowLocalNetworking = true;
+    });
+
   }
   // lib.optionalAttrs pkgs.stdenv.hostPlatform.isAarch64 {
     # aarch64-darwin
diff --git a/pkgs/development/haskell-modules/configuration-ghc-9.12.x.nix b/pkgs/development/haskell-modules/configuration-ghc-9.12.x.nix
index e2d5923607c1c..cb32463d3ce64 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-9.12.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.12.x.nix
@@ -147,17 +147,6 @@ with haskellLib;
     ];
   }) super.doctest_0_24_0;
 
-  # https://github.com/typeable/generic-arbitrary/issues/18
-  generic-arbitrary = overrideCabal (drv: {
-    patches = drv.patches or [ ] ++ [
-      (pkgs.fetchpatch {
-        name = "hellwolf:fix-recursive-test-hidding-unit";
-        url = "https://github.com/typeable/generic-arbitrary/commit/133b80be93e6744f21e0e5ed4180a24c589f92e4.patch";
-        sha256 = "sha256-z9EVcD1uNAYUOVTwmCCnrEFFOvFB7lD94Y6BwGVwVRQ=";
-      })
-    ];
-  }) super.generic-arbitrary;
-
   # https://gitlab.haskell.org/ghc/ghc/-/issues/25930
   generic-lens = dontCheck super.generic-lens;
 
@@ -173,6 +162,13 @@ with haskellLib;
   # https://github.com/sjakobi/newtype-generics/pull/28/files
   newtype-generics = warnAfterVersion "0.6.2" (doJailbreak super.newtype-generics);
 
+  # Test failure because of GHC bug:
+  #   https://gitlab.haskell.org/ghc/ghc/-/issues/25937
+  #   https://github.com/sol/interpolate/issues/20
+  interpolate =
+    assert super.ghc.version == "9.12.2";
+    dontCheck super.interpolate;
+
   #
   # Multiple issues
   #
@@ -204,4 +200,7 @@ with haskellLib;
       }
     )
   );
+
+  # Allow Cabal 3.14
+  hpack = doDistribute self.hpack_0_38_0;
 }
diff --git a/pkgs/development/haskell-modules/configuration-ghc-9.8.x.nix b/pkgs/development/haskell-modules/configuration-ghc-9.8.x.nix
index f13b1e866f57a..fc4fe254d1e88 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-9.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.8.x.nix
@@ -7,8 +7,7 @@ let
   inherit (pkgs) lib;
 in
 
-self: super:
-{
+self: super: {
 
   llvmPackages = pkgs.lib.dontRecurseIntoAttrs self.ghc.llvmPackages;
 
@@ -99,8 +98,3 @@ self: super:
       '';
     } super.ghc-lib-parser;
 }
-// lib.optionalAttrs (lib.versionAtLeast super.ghc.version "9.8.3") {
-  # Breakage related to GHC 9.8.3 / deepseq 1.5.1.0
-  # https://github.com/typeable/generic-arbitrary/issues/18
-  generic-arbitrary = dontCheck super.generic-arbitrary;
-}
diff --git a/pkgs/development/haskell-modules/configuration-ghcjs-9.x.nix b/pkgs/development/haskell-modules/configuration-ghcjs-9.x.nix
index 22a8c7efd05d9..10a399e73063a 100644
--- a/pkgs/development/haskell-modules/configuration-ghcjs-9.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghcjs-9.x.nix
@@ -35,12 +35,9 @@ with haskellLib;
   patch = haskellLib.disableParallelBuilding super.patch;
   reflex-dom-core = haskellLib.disableParallelBuilding super.reflex-dom-core;
 
-  reflex-dom =
-    lib.warn "reflex-dom builds with JS backend but it is missing fixes for working at runtime"
-      super.reflex-dom.override
-      (drv: {
-        jsaddle-webkit2gtk = null;
-      });
+  reflex-dom = super.reflex-dom.override (drv: {
+    jsaddle-webkit2gtk = null;
+  });
 
   miso-examples = pkgs.lib.pipe super.miso-examples [
     (addBuildDepends (
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
index 868459725e02c..533f1e99c532b 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
@@ -11,9 +11,12 @@ broken-packages:
   - abides # failure in job https://hydra.nixos.org/build/233260056 at 2023-09-02
   - abnf # failure in job https://hydra.nixos.org/build/233238839 at 2023-09-02
   - AbortT-transformers # failure in job https://hydra.nixos.org/build/233210345 at 2023-09-02
+  - abstract-par-accelerate # failure in job https://hydra.nixos.org/build/296049870 at 2025-05-02
   - abt # failure in job https://hydra.nixos.org/build/233201301 at 2023-09-02
   - AC-BuildPlatform # failure in job https://hydra.nixos.org/build/233219130 at 2023-09-02
-  - accelerate # failure in job https://hydra.nixos.org/build/233198907 at 2023-09-02
+  - accelerate-fftw # failure in job https://hydra.nixos.org/build/296049868 at 2025-05-02
+  - accelerate-random # failure in job https://hydra.nixos.org/build/296049869 at 2025-05-02
+  - accelerate-utility # failure in job https://hydra.nixos.org/build/296049871 at 2025-05-02
   - accentuateus # failure in job https://hydra.nixos.org/build/233253627 at 2023-09-02
   - access-time # failure in job https://hydra.nixos.org/build/233246051 at 2023-09-02
   - accuerr # failure in job https://hydra.nixos.org/build/233220965 at 2023-09-02
@@ -129,6 +132,7 @@ broken-packages:
   - alga # failure in job https://hydra.nixos.org/build/233252723 at 2023-09-02
   - algebra-dag # failure in job https://hydra.nixos.org/build/233191945 at 2023-09-02
   - algebraic-classes # failure in job https://hydra.nixos.org/build/233246872 at 2023-09-02
+  - algebraic # failure in job https://hydra.nixos.org/build/296049876 at 2025-05-02
   - algebraic-prelude # failure in job https://hydra.nixos.org/build/233197561 at 2023-09-02
   - AlgorithmW # failure in job https://hydra.nixos.org/build/233245254 at 2023-09-02
   - algo-s # failure in job https://hydra.nixos.org/build/233221988 at 2023-09-02
@@ -656,6 +660,7 @@ broken-packages:
   - cabal-nirvana # failure in job https://hydra.nixos.org/build/233222083 at 2023-09-02
   - cabal-progdeps # failure in job https://hydra.nixos.org/build/233251917 at 2023-09-02
   - cabalQuery # failure in job https://hydra.nixos.org/build/233211475 at 2023-09-02
+  - cabal-scaffold # failure in job https://hydra.nixos.org/build/295453285 at 2025-05-02
   - CabalSearch # failure in job https://hydra.nixos.org/build/233200817 at 2023-09-02
   - cabal-setup # failure in job https://hydra.nixos.org/build/233225406 at 2023-09-02
   - cabal-sign # failure in job https://hydra.nixos.org/build/295092160 at 2025-04-22
@@ -682,7 +687,6 @@ broken-packages:
   - call-alloy # failure in job https://hydra.nixos.org/build/233249056 at 2023-09-02
   - cal-layout # failure in job https://hydra.nixos.org/build/233191194 at 2023-09-02
   - call-haskell-from-anything # failure in job https://hydra.nixos.org/build/233222493 at 2023-09-02
-  - calligraphy # only supports ghc < 9.6
   - call-plantuml # failure in job https://hydra.nixos.org/build/233241670 at 2023-09-02
   - candid # failure in job https://hydra.nixos.org/build/295092213 at 2025-04-22
   - canon # failure in job https://hydra.nixos.org/build/233235027 at 2023-09-02
@@ -738,7 +742,6 @@ broken-packages:
   - CC-delcont-ref-tf # failure in job https://hydra.nixos.org/build/233257768 at 2023-09-02
   - cci # failure in job https://hydra.nixos.org/build/233244756 at 2023-09-02
   - ccnx # failure in job https://hydra.nixos.org/build/233237732 at 2023-09-02
-  - cdar-mBound # failure in job https://hydra.nixos.org/build/295092219 at 2025-04-22
   - cdp # failure in job https://hydra.nixos.org/build/233251735 at 2023-09-02
   - c-dsl # failure in job https://hydra.nixos.org/build/233236075 at 2023-09-02
   - cedict # failure in job https://hydra.nixos.org/build/233206454 at 2023-09-02
@@ -1075,7 +1078,6 @@ broken-packages:
   - cr # failure in job https://hydra.nixos.org/build/233235318 at 2023-09-02
   - critbit # failure in job https://hydra.nixos.org/build/233237880 at 2023-09-02
   - criterion-cmp # failure in job https://hydra.nixos.org/build/233192619 at 2023-09-02
-  - criterion-compare # failure in job https://hydra.nixos.org/build/233257858 at 2023-09-02
   - criterion-plus # failure in job https://hydra.nixos.org/build/233194095 at 2023-09-02
   - criterion-to-html # failure in job https://hydra.nixos.org/build/233209983 at 2023-09-02
   - criu-rpc-types # failure in job https://hydra.nixos.org/build/252715844 at 2024-03-16
@@ -1083,10 +1085,8 @@ broken-packages:
   - crockford # failure in job https://hydra.nixos.org/build/233210759 at 2023-09-02
   - crocodile # failure in job https://hydra.nixos.org/build/233222277 at 2023-09-02
   - cronus # failure in job https://hydra.nixos.org/build/233225303 at 2023-09-02
-  - crucibile-llvm # what4 >=1.7 https://hydra.nixos.org/build/295428376
   - cruncher-types # failure in job https://hydra.nixos.org/build/233229024 at 2023-09-02
   - crunghc # failure in job https://hydra.nixos.org/build/233193295 at 2023-09-02
-  - crux # simple-get-opt <0.5 https://hydra.nixos.org/build/295428379
   - crypto-cipher-benchmarks # failure in job https://hydra.nixos.org/build/233195297 at 2023-09-02
   - cryptocompare # failure in job https://hydra.nixos.org/build/233192898 at 2023-09-02
   - cryptoconditions # failure in job https://hydra.nixos.org/build/233211816 at 2023-09-02
@@ -1193,7 +1193,6 @@ broken-packages:
   - data-pprint # failure in job https://hydra.nixos.org/build/233221300 at 2023-09-02
   - data-quotientref # failure in job https://hydra.nixos.org/build/233258168 at 2023-09-02
   - data-reify-cse # failure in job https://hydra.nixos.org/build/233240126 at 2023-09-02
-  - data-reify-gadt # failure in job https://hydra.nixos.org/build/295092744 at 2025-04-22
   - data-repr # failure in job https://hydra.nixos.org/build/233255402 at 2023-09-02
   - data-rev # failure in job https://hydra.nixos.org/build/233239036 at 2023-09-02
   - datarobot # failure in job https://hydra.nixos.org/build/233206913 at 2023-09-02
@@ -1248,6 +1247,7 @@ broken-packages:
   - decoder-conduit # failure in job https://hydra.nixos.org/build/233228100 at 2023-09-02
   - deepcontrol # failure in job https://hydra.nixos.org/build/233238035 at 2023-09-02
   - DeepDarkFantasy # failure in job https://hydra.nixos.org/build/233242150 at 2023-09-02
+  - deeplearning-hs # failure in job https://hydra.nixos.org/build/296049880 at 2025-05-02
   - deepl # failure in job https://hydra.nixos.org/build/233232956 at 2023-09-02
   - deepseq-bounded # failure in job https://hydra.nixos.org/build/233211193 at 2023-09-02
   - deepseq-instances # failure in job https://hydra.nixos.org/build/233236748 at 2023-09-02
@@ -1581,7 +1581,6 @@ broken-packages:
   - enum-text # failure in job https://hydra.nixos.org/build/233194373 at 2023-09-02
   - enum-utf8 # failure in job https://hydra.nixos.org/build/233234628 at 2023-09-02
   - envelope # failure in job https://hydra.nixos.org/build/233199309 at 2023-09-02
-  - env-extra # failure in job https://hydra.nixos.org/build/295093099 at 2025-04-22
   - env-parser # failure in job https://hydra.nixos.org/build/233237933 at 2023-09-02
   - envstatus # failure in job https://hydra.nixos.org/build/233257940 at 2023-09-02
   - envy-extensible # failure in job https://hydra.nixos.org/build/233229313 at 2023-09-02
@@ -1903,7 +1902,6 @@ broken-packages:
   - freetype-simple # failure in job https://hydra.nixos.org/build/233249707 at 2023-09-02
   - free-v-bucks-generator-no-survey # failure in job https://hydra.nixos.org/build/233208419 at 2023-09-02
   - free-v-bucks-generator-ps4-no-survey # failure in job https://hydra.nixos.org/build/233190747 at 2023-09-02
-  - free-vector-spaces # failure in job https://hydra.nixos.org/build/295093364 at 2025-04-22
   - fregel # failure in job https://hydra.nixos.org/build/252734327 at 2024-03-16
   - freq # failure in job https://hydra.nixos.org/build/233247154 at 2023-09-02
   - fresh # failure in job https://hydra.nixos.org/build/233196569 at 2023-09-02
@@ -2018,6 +2016,7 @@ broken-packages:
   - gentlemark # failure in job https://hydra.nixos.org/build/233202158 at 2023-09-02
   - genvalidity-appendful # failure in job https://hydra.nixos.org/build/295093519 at 2025-04-22
   - genvalidity-mergeful # failure in job https://hydra.nixos.org/build/295093508 at 2025-04-22
+  - genvalidity-network-uri # failure in job https://hydra.nixos.org/build/295454526 at 2025-05-02
   - geocode-google # failure in job https://hydra.nixos.org/build/233191594 at 2023-09-02
   - GeocoderOpenCage # failure in job https://hydra.nixos.org/build/233214852 at 2023-09-02
   - geodetic-types # failure in job https://hydra.nixos.org/build/233209496 at 2023-09-02
@@ -2237,6 +2236,7 @@ broken-packages:
   - grow-vector # failure in job https://hydra.nixos.org/build/233196279 at 2023-09-02
   - grpc-api-etcd # failure in job https://hydra.nixos.org/build/233239600 at 2023-09-02
   - grpc-haskell-core # failure in job https://hydra.nixos.org/build/267997256 at 2024-07-31
+  - gruvbox-colors # failure in job https://hydra.nixos.org/build/295454932 at 2025-05-02
   - gsl-random # failure in job https://hydra.nixos.org/build/233191503 at 2023-09-02
   - gstreamer # failure in job https://hydra.nixos.org/build/233239224 at 2023-09-02
   - GTALib # failure in job https://hydra.nixos.org/build/233250568 at 2023-09-02
@@ -2293,7 +2293,6 @@ broken-packages:
   - HaGL # failure in job https://hydra.nixos.org/build/234457220 at 2023-09-13
   - hahp # failure in job https://hydra.nixos.org/build/233250101 at 2023-09-02
   - haiji # failure in job https://hydra.nixos.org/build/233232272 at 2023-09-02
-  - hail # failure in job https://hydra.nixos.org/build/233219127 at 2023-09-02
   - hailgun-send # failure in job https://hydra.nixos.org/build/282936164 at 2024-12-24
   - hairy # failure in job https://hydra.nixos.org/build/233226903 at 2023-09-02
   - hakaru # failure in job https://hydra.nixos.org/build/233231467 at 2023-09-02
@@ -2540,7 +2539,6 @@ broken-packages:
   - hdaemonize-buildfix # failure in job https://hydra.nixos.org/build/233225678 at 2023-09-02
   - hdbc-aeson # failure in job https://hydra.nixos.org/build/233240596 at 2023-09-02
   - HDBC-mysql # failure in job https://hydra.nixos.org/build/233205323 at 2023-09-02
-  - HDBC-postgresql # failure in job https://hydra.nixos.org/build/295090953 at 2025-04-22
   - hdbc-postgresql-hstore # failure in job https://hydra.nixos.org/build/233201143 at 2023-09-02
   - HDBC-postgresql-hstore # failure in job https://hydra.nixos.org/build/233243932 at 2023-09-02
   - hdevtools # failure in job https://hydra.nixos.org/build/233229115 at 2023-09-02
@@ -3195,7 +3193,6 @@ broken-packages:
   - injections # failure in job https://hydra.nixos.org/build/233207796 at 2023-09-02
   - inline-c-cuda # failure in job https://hydra.nixos.org/build/237234701 at 2023-10-21
   - inline-c-objc # failure in job https://hydra.nixos.org/build/233223704 at 2023-09-02
-  - inline-python # failure in job https://hydra.nixos.org/build/295094702 at 2025-04-22
   - inline-r # failure in job https://hydra.nixos.org/build/233210520 at 2023-09-02
   - in-other-words # failure in job https://hydra.nixos.org/build/252711798 at 2024-03-16
   - in-other-words-plugin # failure in job https://hydra.nixos.org/build/233202396 at 2023-09-02
@@ -3260,6 +3257,7 @@ broken-packages:
   - irc-fun-types # failure in job https://hydra.nixos.org/build/233255910 at 2023-09-02
   - ireal # failure in job https://hydra.nixos.org/build/233239811 at 2023-09-02
   - iridium # failure in job https://hydra.nixos.org/build/233211261 at 2023-09-02
+  - iri # failure in job https://hydra.nixos.org/build/295455675 at 2025-05-02
   - iris # failure in job https://hydra.nixos.org/build/233212713 at 2023-09-02
   - iron-mq # failure in job https://hydra.nixos.org/build/233200693 at 2023-09-02
   - irt # failure in job https://hydra.nixos.org/build/233216553 at 2023-09-02
@@ -3541,6 +3539,7 @@ broken-packages:
   - leb128 # failure in job https://hydra.nixos.org/build/252731801 at 2024-03-16
   - leetify # failure in job https://hydra.nixos.org/build/233200752 at 2023-09-02
   - lendingclub # failure in job https://hydra.nixos.org/build/233239123 at 2023-09-02
+  - lens-accelerate # failure in job https://hydra.nixos.org/build/296049887 at 2025-05-02
   - lens-datetime # failure in job https://hydra.nixos.org/build/233252409 at 2023-09-02
   - lenses # failure in job https://hydra.nixos.org/build/233239109 at 2023-09-02
   - lens-filesystem # failure in job https://hydra.nixos.org/build/233205074 at 2023-09-02
@@ -3612,6 +3611,7 @@ broken-packages:
   - limp-cbc # failure in job https://hydra.nixos.org/build/233201076 at 2023-09-02
   - linda # failure in job https://hydra.nixos.org/build/233249512 at 2023-09-02
   - linden # failure in job https://hydra.nixos.org/build/233198590 at 2023-09-02
+  - linear-accelerate # failure in job https://hydra.nixos.org/build/296049888 at 2025-05-02
   - linear-algebra-cblas # failure in job https://hydra.nixos.org/build/233239710 at 2023-09-02
   - linearmap-category # failure in job https://hydra.nixos.org/build/236690982 at 2023-10-04
   - linear-maps # failure in job https://hydra.nixos.org/build/233258332 at 2023-09-02
@@ -3718,7 +3718,6 @@ broken-packages:
   - L-seed # failure in job https://hydra.nixos.org/build/233222324 at 2023-09-02
   - lsfrom # failure in job https://hydra.nixos.org/build/233211705 at 2023-09-02
   - lsh # failure in job https://hydra.nixos.org/build/233256686 at 2023-09-02
-  - ltext # failure in job https://hydra.nixos.org/build/255686825 at 2024-04-16
   - lti13 # failure in job https://hydra.nixos.org/build/252715722 at 2024-03-16
   - ltiv1p1 # failure in job https://hydra.nixos.org/build/233200883 at 2023-09-02
   - ltk # failure in job https://hydra.nixos.org/build/233244152 at 2023-09-02
@@ -3844,7 +3843,6 @@ broken-packages:
   - memcached # failure in job https://hydra.nixos.org/build/233190993 at 2023-09-02
   - memcache-haskell # failure in job https://hydra.nixos.org/build/233211839 at 2023-09-02
   - memfd # failure in job https://hydra.nixos.org/build/295095297 at 2025-04-22
-  - meminfo # failure in job https://hydra.nixos.org/build/233201130 at 2023-09-02
   - memis # failure in job https://hydra.nixos.org/build/233207107 at 2023-09-02
   - memoization-utils # failure in job https://hydra.nixos.org/build/233220093 at 2023-09-02
   - memoize # failure in job https://hydra.nixos.org/build/295095333 at 2025-04-22
@@ -4060,6 +4058,7 @@ broken-packages:
   - multiarg # failure in job https://hydra.nixos.org/build/233238633 at 2023-09-02
   - MultiChor # failure in job https://hydra.nixos.org/build/295091050 at 2025-04-22
   - multicurryable # failure in job https://hydra.nixos.org/build/252731222 at 2024-03-16
+  - multidir # failure in job https://hydra.nixos.org/build/295456419 at 2025-05-02
   - multihash # failure in job https://hydra.nixos.org/build/233203263 at 2023-09-02
   - multi-instance # failure in job https://hydra.nixos.org/build/233203186 at 2023-09-02
   - multilinear # failure in job https://hydra.nixos.org/build/233260046 at 2023-09-02
@@ -4142,6 +4141,7 @@ broken-packages:
   - nekos-best # failure in job https://hydra.nixos.org/build/233214327 at 2023-09-02
   - Neks # failure in job https://hydra.nixos.org/build/233238103 at 2023-09-02
   - neptune-backend # failure in job https://hydra.nixos.org/build/233214329 at 2023-09-02
+  - nerd-font-icons # failure in job https://hydra.nixos.org/build/295456454 at 2025-05-02
   - nero # failure in job https://hydra.nixos.org/build/233216907 at 2023-09-02
   - NestedFunctor # failure in job https://hydra.nixos.org/build/233253656 at 2023-09-02
   - nestedmap # failure in job https://hydra.nixos.org/build/233219375 at 2023-09-02
@@ -4295,7 +4295,7 @@ broken-packages:
   - om-http # failure in job https://hydra.nixos.org/build/233245328 at 2023-09-02
   - om-http-logging # failure in job https://hydra.nixos.org/build/233218069 at 2023-09-02
   - omnifmt # failure in job https://hydra.nixos.org/build/233219763 at 2023-09-02
-  - om-socket # failure in job https://hydra.nixos.org/build/233235423 at 2023-09-02
+  - om-plugin-imports # failure in job https://hydra.nixos.org/build/295456635 at 2025-05-02
   - on-a-horse # failure in job https://hydra.nixos.org/build/233199193 at 2023-09-02
   - ONC-RPC # failure in job https://hydra.nixos.org/build/233225207 at 2023-09-02
   - on-demand-ssh-tunnel # failure in job https://hydra.nixos.org/build/233197181 at 2023-09-02
@@ -4313,7 +4313,6 @@ broken-packages:
   - OpenAFP # failure in job https://hydra.nixos.org/build/233249295 at 2023-09-02
   - openai # failure in job https://hydra.nixos.org/build/295095863 at 2025-04-22
   - openai-servant-gen # failure in job https://hydra.nixos.org/build/295095800 at 2025-04-22
-  - openapi3-code-generator # failure in job https://hydra.nixos.org/build/233255628 at 2023-09-02
   - openapi-petstore # failure in job https://hydra.nixos.org/build/233221722 at 2023-09-02
   - openapi-typed # failure in job https://hydra.nixos.org/build/233226830 at 2023-09-02
   - opencc # failure in job https://hydra.nixos.org/build/233211902 at 2023-09-02
@@ -4769,7 +4768,6 @@ broken-packages:
   - postgresql-config # failure in job https://hydra.nixos.org/build/233197788 at 2023-09-02
   - postgresql-cube # failure in job https://hydra.nixos.org/build/233195283 at 2023-09-02
   - PostgreSQL # failure in job https://hydra.nixos.org/build/233258066 at 2023-09-02
-  - postgresql-libpq-configure # failure in job https://hydra.nixos.org/build/295096222 at 2025-04-22
   - postgresql-lo-stream # failure in job https://hydra.nixos.org/build/233194012 at 2023-09-02
   - postgresql-ltree # failure in job https://hydra.nixos.org/build/233199998 at 2023-09-02
   - postgresql-named # failure in job https://hydra.nixos.org/build/233241920 at 2023-09-02
@@ -4982,6 +4980,7 @@ broken-packages:
   - querystring-pickle # failure in job https://hydra.nixos.org/build/233246108 at 2023-09-02
   - questioner # failure in job https://hydra.nixos.org/build/233213704 at 2023-09-02
   - quibble-core # failure in job https://hydra.nixos.org/build/233200635 at 2023-09-02
+  - quic # failure in job https://hydra.nixos.org/build/295457190 at 2025-05-02
   - QuickAnnotate # failure in job https://hydra.nixos.org/build/233197428 at 2023-09-02
   - quickbooks # failure in job https://hydra.nixos.org/build/233227666 at 2023-09-02
   - quickcheck-arbitrary-template # failure in job https://hydra.nixos.org/build/233223045 at 2023-09-02
@@ -5143,6 +5142,7 @@ broken-packages:
   - reify # failure in job https://hydra.nixos.org/build/233247509 at 2023-09-02
   - relacion # failure in job https://hydra.nixos.org/build/233241624 at 2023-09-02
   - relational-postgresql8 # failure in job https://hydra.nixos.org/build/295096600 at 2025-04-22
+  - relational-query-postgresql-pure # failure in job https://hydra.nixos.org/build/296063076 at 2025-05-02
   - relation # failure in job https://hydra.nixos.org/build/233244581 at 2023-09-02
   - relevant-time # failure in job https://hydra.nixos.org/build/233190794 at 2023-09-02
   - reload # failure in job https://hydra.nixos.org/build/233212925 at 2023-09-02
@@ -5601,7 +5601,6 @@ broken-packages:
   - skemmtun # failure in job https://hydra.nixos.org/build/233223893 at 2023-09-02
   - sketch-frp-copilot # copilot >=4.3 && <4.4,
   - skew-list # failure in job https://hydra.nixos.org/build/295097034 at 2025-04-22
-  - skews # failure in job https://hydra.nixos.org/build/295097063 at 2025-04-22
   - skopedate # failure in job https://hydra.nixos.org/build/233220634 at 2023-09-02
   - skulk # failure in job https://hydra.nixos.org/build/233258672 at 2023-09-02
   - skylighting-extensions # failure in job https://hydra.nixos.org/build/233221387 at 2023-09-02
@@ -5828,7 +5827,6 @@ broken-packages:
   - stm-firehose # failure in job https://hydra.nixos.org/build/233220943 at 2023-09-02
   - stm-lifted # failure in job https://hydra.nixos.org/build/252726872 at 2024-03-16
   - stm-promise # failure in job https://hydra.nixos.org/build/233204293 at 2023-09-02
-  - stm-queue # failure in job https://hydra.nixos.org/build/295097230 at 2025-04-22
   - stm-stats # failure in job https://hydra.nixos.org/build/233214914 at 2023-09-02
   - stochastic # failure in job https://hydra.nixos.org/build/233242019 at 2023-09-02
   - Stomp # failure in job https://hydra.nixos.org/build/233252583 at 2023-09-02
@@ -6119,6 +6117,7 @@ broken-packages:
   - text-all # failure in job https://hydra.nixos.org/build/233229321 at 2023-09-02
   - text-and-plots # failure in job https://hydra.nixos.org/build/233205250 at 2023-09-02
   - text-ascii # failure in job https://hydra.nixos.org/build/233247653 at 2023-09-02
+  - text-builder-time # failure in job https://hydra.nixos.org/build/295458315 at 2025-05-02
   - text-compression # failure in job https://hydra.nixos.org/build/233202733 at 2023-09-02
   - text-containers # failure in job https://hydra.nixos.org/build/233253948 at 2023-09-02
   - text-format # failure in job https://hydra.nixos.org/build/295097568 at 2025-04-22
@@ -6361,6 +6360,7 @@ broken-packages:
   - type-combinators # failure in job https://hydra.nixos.org/build/233230024 at 2023-09-02
   - type-compare # failure in job https://hydra.nixos.org/build/233207530 at 2023-09-02
   - TypeCompose # failure in job https://hydra.nixos.org/build/233212999 at 2023-09-02
+  - typed-admin # failure in job https://hydra.nixos.org/build/296063081 at 2025-05-02
   - typed-digits # failure in job https://hydra.nixos.org/build/233198266 at 2023-09-02
   - typed-encoding # failure in job https://hydra.nixos.org/build/233208093 at 2023-09-02
   - typed-fsm # failure in job https://hydra.nixos.org/build/269663128 at 2024-08-19
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index e3056704662ff..280ce2eb60391 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -90,6 +90,7 @@ extra-packages:
   - hlint == 3.4.1                      # 2022-09-21: preserve for ghc 8.10
   - hlint == 3.6.*                      # 2025-04-14: needed for hls with ghc-lib-parser 9.6
   - hnix-store-core < 0.7               # 2023-12-11: required by hnix-store-remote 0.6
+  - hpack == 0.38.0                     # 2025-04-23: preserve for stack == 3.5.1
   - hspec < 2.8                         # 2022-04-07: Needed for tasty-hspec 1.1.6
   - hspec-core < 2.8                    # 2022-04-07: Needed for tasty-hspec 1.1.6
   - hspec-discover < 2.8                # 2022-04-07: Needed for tasty-hspec 1.1.6
@@ -108,6 +109,7 @@ extra-packages:
   - primitive-unlifted == 0.1.3.1       # 2024-03-16: preserve for ghc 9.2
   - retrie < 1.2.0.0                    # 2022-12-30: preserve for ghc < 9.2
   - shake-cabal < 0.2.2.3               # 2023-07-01: last version to support Cabal 3.6.*
+  - simple-get-opt < 0.5                # 2025-05-01: for crux-0.7.2
   - stylish-haskell == 0.14.4.0         # 2022-09-19: preserve for ghc 9.0
   - stylish-haskell == 0.14.5.0         # 2025-04-14: needed for hls with ghc-lib 9.6
   - tar == 0.6.0.0                      # 2025-02-08: last version to not require os-string (which can't be built with GHC < 9.2)
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
index 96bd6b061852f..8ff94d2405779 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
@@ -1,4 +1,4 @@
-# Stackage LTS 23.17
+# Stackage LTS 23.19
 # This file is auto-generated by
 # maintainers/scripts/haskell/update-stackage.sh
 default-package-overrides:
@@ -39,7 +39,7 @@ default-package-overrides:
   - agda2lagda ==0.2023.6.9
   - agreeing ==0.2.2.0
   - alarmclock ==0.7.0.7
-  - alex ==3.5.2.0
+  - alex ==3.5.3.0
   - alex-meta ==0.3.0.13
   - alex-tools ==0.6.1
   - algebra ==4.3.1
@@ -54,7 +54,7 @@ default-package-overrides:
   - alternators ==1.0.0.0
   - ALUT ==2.4.0.3
   - amqp ==0.24.0
-  - annotated-exception ==0.3.0.2
+  - annotated-exception ==0.3.0.4
   - annotated-wl-pprint ==0.7.0
   - ansi-terminal ==1.1.2
   - ansi-terminal-game ==1.9.3.0
@@ -77,7 +77,7 @@ default-package-overrides:
   - approximate ==0.3.5
   - approximate-equality ==1.1.0.2
   - arbor-lru-cache ==0.1.1.1
-  - arithmoi ==0.13.0.1
+  - arithmoi ==0.13.1.0
   - array-memoize ==0.6.0
   - arrow-extras ==0.1.0.1
   - arrows ==0.4.4.2
@@ -135,7 +135,7 @@ default-package-overrides:
   - aws-xray-client-wai ==0.1.0.2
   - backprop ==0.2.6.5
   - backtracking ==0.1.0
-  - bank-holiday-germany ==1.3.0.0
+  - bank-holiday-germany ==1.3.1.0
   - bank-holidays-england ==0.2.0.11
   - barbies ==2.1.1.0
   - base16 ==1.0
@@ -173,7 +173,7 @@ default-package-overrides:
   - bencoding ==0.4.5.6
   - benri-hspec ==0.1.0.3
   - between ==0.11.0.0
-  - bhoogle ==0.1.4.3
+  - bhoogle ==0.1.4.4
   - bibtex ==0.1.0.7
   - bifunctor-classes-compat ==0.1
   - bifunctors ==5.6.2
@@ -204,10 +204,10 @@ default-package-overrides:
   - bitvec ==1.1.5.0
   - bitwise ==1.0.0.1
   - bitwise-enum ==1.0.1.2
-  - Blammo ==2.1.2.0
+  - Blammo ==2.1.3.0
   - blank-canvas ==0.7.4
   - blas-carray ==0.1.0.2
-  - blas-comfort-array ==0.0.0.3
+  - blas-comfort-array ==0.0.0.4
   - blas-ffi ==0.1
   - blas-hs ==0.1.1.0
   - blaze-bootstrap ==0.1.0.1
@@ -463,7 +463,7 @@ default-package-overrides:
   - control-monad-free ==0.6.2
   - control-monad-omega ==0.3.3
   - convertible ==1.1.1.1
-  - cookie ==0.5.0
+  - cookie ==0.5.1
   - copilot ==4.1
   - copilot-c99 ==4.1
   - copilot-core ==4.1
@@ -501,9 +501,9 @@ default-package-overrides:
   - cryptohash-sha1 ==0.11.101.0
   - cryptohash-sha256 ==0.11.102.1
   - cryptohash-sha512 ==0.11.102.0
-  - crypton ==1.0.3
+  - crypton ==1.0.4
   - crypton-conduit ==0.2.3
-  - crypton-connection ==0.4.3
+  - crypton-connection ==0.4.4
   - cryptonite ==0.30
   - cryptonite-conduit ==0.2.2
   - cryptonite-openssl ==0.7
@@ -593,7 +593,7 @@ default-package-overrides:
   - declarative ==0.5.4
   - deepseq-generics ==0.2.0.0
   - deferred-folds ==0.9.18.7
-  - defun-core ==0.1
+  - defun-core ==0.1.0.1
   - dejafu ==2.4.0.7
   - dense-linear-algebra ==0.1.0.0
   - dependent-map ==0.4.0.0
@@ -611,7 +611,7 @@ default-package-overrides:
   - df1 ==0.4.3
   - dhall ==1.42.2
   - di ==1.3
-  - diagrams ==1.4.1
+  - diagrams ==1.4.2
   - diagrams-builder ==0.8.0.6
   - diagrams-cairo ==1.4.2.1
   - diagrams-canvas ==1.4.1.2
@@ -685,7 +685,7 @@ default-package-overrides:
   - dotenv ==0.12.0.0
   - dotgen ==0.4.3
   - dotnet-timespan ==0.0.1.0
-  - dotparse ==0.1.2.1
+  - dotparse ==0.1.2.2
   - double-conversion ==2.0.5.0
   - download ==0.3.2.7
   - download-curl ==0.1.4
@@ -903,7 +903,7 @@ default-package-overrides:
   - functor-classes-compat ==2.0.0.2
   - functor-combinators ==0.4.1.3
   - functor-products ==0.1.2.2
-  - fused-effects ==1.1.2.4
+  - fused-effects ==1.1.2.5
   - fusion-plugin ==0.2.7
   - fusion-plugin-types ==0.1.0
   - fuzzcheck ==0.1.1
@@ -917,7 +917,7 @@ default-package-overrides:
   - gemini-exports ==0.1.0.2
   - general-games ==1.1.1
   - generically ==0.1.1
-  - generic-arbitrary ==1.0.1
+  - generic-arbitrary ==1.0.1.2
   - generic-constraints ==1.1.1.1
   - generic-data ==1.1.0.2
   - generic-data-functions ==0.6.0
@@ -991,7 +991,7 @@ default-package-overrides:
   - ghc-source-gen ==0.4.6.0
   - ghc-syntax-highlighter ==0.0.11.0
   - ghc-tcplugins-extra ==0.4.6
-  - ghc-trace-events ==0.1.2.9
+  - ghc-trace-events ==0.1.2.10
   - ghc-typelits-extra ==0.4.8
   - ghc-typelits-knownnat ==0.7.13
   - ghc-typelits-natnormalise ==0.7.10
@@ -1012,7 +1012,7 @@ default-package-overrides:
   - gi-gdkx11 ==3.0.17
   - gi-gdkx113 ==3.0.17
   - gi-gdkx114 ==4.0.9
-  - gi-gio ==2.0.36
+  - gi-gio ==2.0.37
   - gi-glib ==2.0.30
   - gi-gmodule ==2.0.6
   - gi-gobject ==2.0.31
@@ -1054,7 +1054,7 @@ default-package-overrides:
   - glob-posix ==0.2.0.1
   - gloss ==1.13.2.2
   - gloss-algorithms ==1.13.0.3
-  - gloss-rendering ==1.13.1.2
+  - gloss-rendering ==1.13.2.1
   - glpk-headers ==0.5.1
   - GLURaw ==2.0.0.5
   - GLUT ==2.7.0.16
@@ -1114,7 +1114,7 @@ default-package-overrides:
   - hashids ==1.1.1.0
   - hashmap ==1.3.3
   - hashtables ==1.3.1
-  - haskell-gi ==0.26.14
+  - haskell-gi ==0.26.15
   - haskell-gi-base ==0.26.8
   - haskell-gi-overloading ==1.0
   - haskell-lexer ==1.1.2
@@ -1308,10 +1308,10 @@ default-package-overrides:
   - html-email-validate ==0.2.0.0
   - html-entities ==1.1.4.7
   - html-entity-map ==0.1.0.0
-  - html-parse ==0.2.1.0
+  - html-parse ==0.2.2.0
   - http2 ==5.3.9
   - HTTP ==4000.4.1
-  - http-api-data ==0.6.1
+  - http-api-data ==0.6.2
   - http-api-data-qq ==0.1.0.0
   - http-client ==0.7.19
   - http-client-openssl ==0.3.3
@@ -1325,7 +1325,7 @@ default-package-overrides:
   - http-download ==0.2.1.0
   - httpd-shed ==0.4.1.2
   - http-io-streams ==0.1.7.0
-  - http-link-header ==1.2.2
+  - http-link-header ==1.2.3
   - http-media ==0.8.1.1
   - http-query ==0.1.3
   - http-reverse-proxy ==0.6.1.0
@@ -1447,7 +1447,7 @@ default-package-overrides:
   - iso639 ==0.1.0.3
   - iso8601-time ==0.1.5
   - isocline ==1.0.9
-  - isomorphism-class ==0.3.0.1
+  - isomorphism-class ==0.3.1.2
   - ix-shapable ==0.1.0
   - jack ==0.7.2.2
   - jalaali ==1.0.0.0
@@ -1468,10 +1468,10 @@ default-package-overrides:
   - jsonifier ==0.2.1.3
   - jsonpath ==0.3.0.0
   - json-rpc ==1.1.1
-  - json-spec ==1.1.1.1
-  - json-spec-elm ==0.4.0.5
+  - json-spec ==1.1.1.2
+  - json-spec-elm ==0.4.0.6
   - json-spec-elm-servant ==0.4.3.0
-  - json-spec-openapi ==1.0.1.0
+  - json-spec-openapi ==1.0.1.1
   - json-stream ==0.4.6.0
   - JuicyCairo ==0.1.0.0
   - JuicyPixels ==3.3.9
@@ -1523,16 +1523,16 @@ default-package-overrides:
   - language-thrift ==0.13.0.0
   - lapack ==0.5.2
   - lapack-carray ==0.0.3
-  - lapack-comfort-array ==0.0.1
+  - lapack-comfort-array ==0.0.1.1
   - lapack-ffi ==0.0.3
-  - lapack-ffi-tools ==0.1.3.1
+  - lapack-ffi-tools ==0.1.3.2
   - lapack-hmatrix ==0.0.0.2
   - large-hashable ==0.1.2.0
   - largeword ==1.2.5
   - latex ==0.1.0.4
   - lattices ==2.2.1
   - lawful ==0.1.0.0
-  - lawful-conversions ==0.1.6
+  - lawful-conversions ==0.1.6.1
   - lazy-csv ==0.5.1
   - lazyio ==0.1.0.4
   - lazyppl ==1.0
@@ -1751,7 +1751,7 @@ default-package-overrides:
   - monads-tf ==0.3.0.1
   - monad-time ==0.4.0.0
   - mongoDB ==2.7.1.4
-  - monoidal-containers ==0.6.5.0
+  - monoidal-containers ==0.6.6.0
   - monoidal-functors ==0.2.3.0
   - monoid-extras ==0.6.5
   - monoidmap ==0.0.4.3
@@ -1811,7 +1811,7 @@ default-package-overrides:
   - nanospec ==0.2.2
   - nanovg ==0.8.1.0
   - nats ==1.1.2
-  - natural-arithmetic ==0.2.1.0
+  - natural-arithmetic ==0.2.2.0
   - natural-induction ==0.2.0.0
   - natural-sort ==0.1.2
   - natural-transformation ==0.4.1
@@ -1830,7 +1830,7 @@ default-package-overrides:
   - network-bsd ==2.8.1.0
   - network-byte-order ==0.1.7
   - network-conduit-tls ==1.4.0.1
-  - network-control ==0.1.5
+  - network-control ==0.1.6
   - network-info ==0.2.1
   - network-ip ==0.3.0.3
   - network-messagepack-rpc ==0.1.2.0
@@ -1893,8 +1893,8 @@ default-package-overrides:
   - old-locale ==1.0.0.7
   - old-time ==1.1.0.4
   - ollama-haskell ==0.1.3.0
-  - om-elm ==2.0.0.7
-  - om-show ==0.1.2.10
+  - om-elm ==2.0.0.8
+  - om-show ==0.1.2.11
   - once ==0.4
   - one-liner ==2.1
   - one-liner-instances ==0.1.3.0
@@ -1955,7 +1955,7 @@ default-package-overrides:
   - pandoc-types ==1.23.1
   - pango ==0.13.12.0
   - panic ==0.4.0.1
-  - pantry ==0.10.0
+  - pantry ==0.10.1
   - parallel ==3.2.2.0
   - parallel-io ==0.3.5
   - parameterized ==0.5.0.0
@@ -2080,7 +2080,7 @@ default-package-overrides:
   - postgresql-schema ==0.1.14
   - postgresql-simple ==0.7.0.0
   - postgresql-simple-url ==0.2.1.0
-  - postgresql-syntax ==0.4.1.1
+  - postgresql-syntax ==0.4.1.2
   - postgresql-typed ==0.6.2.5
   - post-mess-age ==0.2.1.0
   - pptable ==0.3.0.0
@@ -2108,7 +2108,7 @@ default-package-overrides:
   - pretty-terminal ==0.1.0.0
   - primecount ==0.1.0.2
   - primes ==0.2.1.0
-  - primitive ==0.9.0.0
+  - primitive ==0.9.1.0
   - primitive-addr ==0.1.0.3
   - primitive-extras ==0.10.2.2
   - primitive-offset ==0.2.0.1
@@ -2511,7 +2511,7 @@ default-package-overrides:
   - sox ==0.2.3.2
   - soxlib ==0.0.3.2
   - speculate ==0.4.20
-  - specup ==0.2.0.4
+  - specup ==0.2.0.5
   - speedy-slice ==0.3.2
   - sphinx ==0.6.1
   - Spintax ==0.3.7.0
@@ -2699,17 +2699,17 @@ default-package-overrides:
   - temporary-resourcet ==0.1.0.1
   - tensorflow-test ==0.1.0.0
   - tensort ==1.0.1.4
-  - termbox ==2.0.0.1
-  - termbox-banana ==2.0.0
-  - termbox-bindings-c ==0.1.0.1
-  - termbox-bindings-hs ==1.0.0
-  - termbox-tea ==1.0.0
+  - termbox ==2.0.0.2
+  - termbox-banana ==2.0.0.1
+  - termbox-bindings-c ==0.1.0.2
+  - termbox-bindings-hs ==1.0.0.1
+  - termbox-tea ==1.0.0.1
   - terminal ==0.2.0.0
   - terminal-progress-bar ==0.4.2
   - terminal-size ==0.3.4
   - termonad ==4.6.0.0
   - test-certs ==0.1.1.1
-  - test-framework ==0.8.2.1
+  - test-framework ==0.8.2.2
   - test-framework-hunit ==0.3.0.2
   - test-framework-leancheck ==0.0.4
   - test-framework-quickcheck2 ==0.3.0.6
@@ -2720,8 +2720,8 @@ default-package-overrides:
   - texmath ==0.12.9
   - text-ansi ==0.3.0.1
   - text-binary ==0.2.1.1
-  - text-builder ==0.6.7.3
-  - text-builder-dev ==0.3.9.1
+  - text-builder ==0.6.10
+  - text-builder-dev ==0.3.10
   - text-builder-linear ==0.1.3
   - text-conversions ==0.3.1.1
   - text-icu ==0.8.0.5
@@ -2796,7 +2796,7 @@ default-package-overrides:
   - titlecase ==1.0.1
   - tldr ==0.9.2
   - tls ==2.1.1
-  - tls-session-manager ==0.0.7
+  - tls-session-manager ==0.0.8
   - tlynx ==0.8.0.0
   - tmapchan ==0.0.3
   - tmapmvar ==0.0.4
@@ -2840,7 +2840,7 @@ default-package-overrides:
   - twitter-types ==0.11.0
   - twitter-types-lens ==0.11.0
   - typecheck-plugin-nat-simple ==0.1.0.9
-  - typed-process ==0.2.12.0
+  - typed-process ==0.2.13.0
   - typed-uuid ==0.2.0.0
   - type-equality ==1.0.1
   - type-errors ==0.2.0.2
@@ -2914,7 +2914,7 @@ default-package-overrides:
   - unix-compat ==0.7.4
   - unix-time ==0.4.16
   - unjson ==0.15.4
-  - unlifted ==0.2.2.0
+  - unlifted ==0.2.3.0
   - unliftio ==0.2.25.1
   - unliftio-core ==0.2.1.0
   - unliftio-path ==0.0.2.0
@@ -3086,7 +3086,7 @@ default-package-overrides:
   - xdg-desktop-entry ==0.1.1.2
   - xdg-userdirs ==0.1.0.2
   - xeno ==0.6
-  - xlsx ==1.1.3
+  - xlsx ==1.1.4
   - xml ==1.3.14
   - xml-basic ==0.1.3.3
   - xmlbf ==0.7
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
index 5cf81d4205ead..0ab13af65ce10 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
@@ -415,25 +415,12 @@ dont-distribute-packages:
  - ZipFold
  - a50
  - abcBridge
- - abstract-par-accelerate
  - ac-machine-conduit
  - accelerate-arithmetic
- - accelerate-fftw
  - accelerate-fourier
- - accelerate-io
- - accelerate-io-JuicyPixels
- - accelerate-io-array
- - accelerate-io-bmp
- - accelerate-io-bytestring
- - accelerate-io-cereal
- - accelerate-io-repa
- - accelerate-io-serialise
- - accelerate-io-vector
  - accelerate-llvm
  - accelerate-llvm-native
- - accelerate-random
  - accelerate-typelits
- - accelerate-utility
  - access-token-provider
  - acme-php
  - acme-safe
@@ -442,10 +429,6 @@ dont-distribute-packages:
  - adhoc-network
  - adict
  - adp-multi-monadiccp
- - aern2-fun
- - aern2-mfun
- - aern2-mp
- - aern2-real
  - aeson-native
  - aeson_1_5_6_0
  - affine
@@ -460,7 +443,6 @@ dont-distribute-packages:
  - algebra-checkers
  - algebra-driven-design
  - algebra-sql
- - algebraic
  - algolia
  - algorithmic-composition-additional
  - algorithmic-composition-basic
@@ -839,6 +821,7 @@ dont-distribute-packages:
  - clickhouse-haskell
  - clifford
  - clippings
+ - clod
  - cloud-haskell
  - cloud-seeder
  - cloudyfs
@@ -869,7 +852,6 @@ dont-distribute-packages:
  - color-counter
  - colorless-http-client
  - colorless-scotty
- - colour-accelerate
  - colour-space
  - columbia
  - columnar
@@ -946,7 +928,6 @@ dont-distribute-packages:
  - coordinate
  - copilot-cbmc
  - copilot-sbv
- - copilot-verifier
  - coroutine-enumerator
  - coroutine-iteratee
  - couch-simple
@@ -972,7 +953,6 @@ dont-distribute-packages:
  - crf-chain2-tiers
  - criu-rpc
  - cron-compat
- - crux-llvm
  - crypto-classical
  - crypto-conduit
  - crypto-pubkey
@@ -990,6 +970,7 @@ dont-distribute-packages:
  - curryer-rpc
  - cv-combinators
  - cypher
+ - dahdit-audio
  - dahdit-midi
  - dahdit-test
  - daino
@@ -1039,11 +1020,9 @@ dont-distribute-packages:
  - ddc-tools
  - ddc-war
  - ddci-core
- - dde
  - debug
  - decimal-arithmetic
  - dedukti
- - deeplearning-hs
  - deepzoom
  - defargs
  - definitive-filesystem
@@ -1489,7 +1468,7 @@ dont-distribute-packages:
  - gridland
  - grisette
  - grisette-monad-coroutine
- - grisette_0_11_0_0
+ - grisette_0_12_0_0
  - gross
  - groundhog-converters
  - groundhog-inspector
@@ -1517,6 +1496,7 @@ dont-distribute-packages:
  - gtkimageview
  - gtkrsync
  - guarded-rewriting
+ - h3spec
  - hOff-display
  - hPDB
  - hPDB-examples
@@ -1589,7 +1569,6 @@ dont-distribute-packages:
  - hascat-system
  - hash-addressed
  - hash-addressed-cli
- - hashable-accelerate
  - hashflare
  - hask-home
  - haskanoid
@@ -1897,6 +1876,7 @@ dont-distribute-packages:
  - http2-client-grpc
  - http2-grpc-proto-lens
  - http2-grpc-proto3-wire
+ - http3
  - https-everywhere-rules
  - https-everywhere-rules-raw
  - httpspec
@@ -1970,6 +1950,7 @@ dont-distribute-packages:
  - imj-base
  - imj-game-hamazed
  - imj-measure-stdout
+ - immutaball-core
  - imparse
  - imperative-edsl
  - imperative-edsl-vhdl
@@ -2164,6 +2145,7 @@ dont-distribute-packages:
  - lame-tester
  - landlock
  - lang
+ - langchain-hs
  - language-Modula2
  - language-ats
  - language-boogie
@@ -2201,7 +2183,6 @@ dont-distribute-packages:
  - legion-extra
  - leksah
  - leksah-server
- - lens-accelerate
  - lens-utils
  - lenz
  - lenz-mtl
@@ -2228,7 +2209,6 @@ dont-distribute-packages:
  - lightstep-haskell
  - lighttpd-conf
  - lighttpd-conf-qq
- - linear-accelerate
  - linear-code
  - linearEqSolver
  - linearscan-hoopl
@@ -2499,7 +2479,6 @@ dont-distribute-packages:
  - mutable-iter
  - mute-unmute
  - mvclient
- - mwc-random-accelerate
  - mwc-random-monad
  - mxnet-dataiter
  - mxnet-examples
@@ -2609,7 +2588,6 @@ dont-distribute-packages:
  - ois-input-manager
  - olwrapper
  - om-kubernetes
- - om-legion
  - one-time-password
  - online-csv
  - oops-examples
@@ -2989,7 +2967,6 @@ dont-distribute-packages:
  - regular-xmlpickler
  - reheat
  - rel8
- - relational-query-postgresql-pure
  - relative-date
  - remote-json
  - remote-json-client
@@ -3594,7 +3571,6 @@ dont-distribute-packages:
  - type-structure
  - type-sub-th
  - typecheck-plugin-nat-simple_0_1_0_11
- - typed-admin
  - typed-encoding-encoding
  - typed-gui
  - typed-streams
@@ -3727,6 +3703,7 @@ dont-distribute-packages:
  - wai-thrift
  - waldo
  - warp-grpc
+ - warp-quic
  - warped
  - wavesurfer
  - wavy
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 72cb136791f3f..1937f9e616a1e 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -825,6 +825,11 @@ builtins.intersectAttrs super {
     ];
   }) super.crucible-symio;
 
+  # Test suite requires z3 to be in PATH
+  crucible-llvm = addTestToolDepends [
+    pkgs.z3
+  ] super.crucible-llvm;
+
   # Compile manpages (which are in RST and are compiled with Sphinx).
   futhark =
     overrideCabal
@@ -1519,6 +1524,9 @@ builtins.intersectAttrs super {
     '';
   }) super.jacinda;
 
+  # Needs network access
+  pinecone = dontCheck super.pinecone;
+
   # Smoke test can't be executed in sandbox
   # https://github.com/georgefst/evdev/issues/25
   evdev = overrideCabal (drv: {
@@ -1699,10 +1707,15 @@ builtins.intersectAttrs super {
 
   postgresql-libpq-configure = overrideCabal (drv: {
     librarySystemDepends = (drv.librarySystemDepends or [ ]) ++ [ pkgs.libpq ];
+    libraryToolDepends = (drv.libraryToolDepends or [ ]) ++ [ pkgs.libpq.pg_config ];
   }) super.postgresql-libpq-configure;
 
   postgresql-libpq-pkgconfig = addPkgconfigDepend pkgs.libpq super.postgresql-libpq-pkgconfig;
 
+  HDBC-postgresql = overrideCabal (drv: {
+    libraryToolDepends = (drv.libraryToolDepends or [ ]) ++ [ pkgs.libpq.pg_config ];
+  }) super.HDBC-postgresql;
+
   # Test failure is related to a GHC implementation detail of primitives and doesn't
   # cause actual problems in dependent packages, see https://github.com/lehins/pvar/issues/4
   pvar = dontCheck super.pvar;
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 3d8eec3ddcc57..96fb57ee7651f 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -4360,8 +4360,8 @@ self: {
     }:
     mkDerivation {
       pname = "Blammo";
-      version = "2.1.2.0";
-      sha256 = "0aa1kn4aljj6nvsnilfq3xy4b4yzy4gs6k949jjcvjhpm2zgab1m";
+      version = "2.1.3.0";
+      sha256 = "1vng5l6pz4p391ywnmbmypbva1cr5i38knabk67j9ylk2i0fy04a";
       libraryHaskellDepends = [
         aeson
         base
@@ -5970,7 +5970,7 @@ self: {
     }
   ) { };
 
-  "Cabal_3_14_1_1" = callPackage (
+  "Cabal_3_14_2_0" = callPackage (
     {
       mkDerivation,
       array,
@@ -5991,8 +5991,10 @@ self: {
     }:
     mkDerivation {
       pname = "Cabal";
-      version = "3.14.1.1";
-      sha256 = "11grp5spxjmmjcvpszrzlgpv2zkad9l20rfbjd5rvnjp3wa51xan";
+      version = "3.14.2.0";
+      sha256 = "0cll8as76gvi0jhwrzpxrc0kf5v55jmc03mc9pnp4115gjqs5355";
+      revision = "1";
+      editedCabalFile = "016hy694a57zcqf8l5agfd19bxhdl4cr3my8vz30v4mr6xmai2pr";
       setupHaskellDepends = [
         mtl
         parsec
@@ -6268,7 +6270,7 @@ self: {
     }
   ) { };
 
-  "Cabal-syntax_3_14_1_0" = callPackage (
+  "Cabal-syntax_3_14_2_0" = callPackage (
     {
       mkDerivation,
       alex,
@@ -6289,8 +6291,8 @@ self: {
     }:
     mkDerivation {
       pname = "Cabal-syntax";
-      version = "3.14.1.0";
-      sha256 = "13d4sfqlbx2m8f075jnqq965sj0ayn1vk2fd2m8rdp9fsqy8hxm0";
+      version = "3.14.2.0";
+      sha256 = "11armvlq5ygzrsn1k4vld8fr5li1vh9gd1l4al31kz7zvbm3jpwx";
       libraryHaskellDepends = [
         array
         base
@@ -6724,8 +6726,8 @@ self: {
       pname = "Chart-diagrams";
       version = "1.9.5.1";
       sha256 = "1pk2fsmjl2dsabzpdwk3190nw0nwy581c4qsl93npx764qcxkp7q";
-      revision = "3";
-      editedCabalFile = "1d02cd4i4kvz53ymw1jrracbv0mkfzjizc64mkg8yxmrby0ywvlj";
+      revision = "4";
+      editedCabalFile = "0lkpn0jdx0nj6991dkakm3262z4l9sqzbyhck2nrxcisgg8afmn6";
       enableSeparateDataOutput = true;
       libraryHaskellDepends = [
         base
@@ -17729,8 +17731,6 @@ self: {
       librarySystemDepends = [ libpq ];
       description = "PostgreSQL driver for HDBC";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { inherit (pkgs) libpq; };
 
@@ -30321,8 +30321,8 @@ self: {
     }:
     mkDerivation {
       pname = "Monadoro";
-      version = "0.4.0.0";
-      sha256 = "0axilb24mw5f0jvmdyqbrnmh2k9klygxdfazqsyrj2cbxfsby3c3";
+      version = "0.4.0.2";
+      sha256 = "0mkj5k57c1m9nl04qyn770a754gkna62jg805cg88nhdlgpx9shs";
       isLibrary = true;
       isExecutable = true;
       enableSeparateDataOutput = true;
@@ -30715,8 +30715,8 @@ self: {
     }:
     mkDerivation {
       pname = "MultiChor";
-      version = "1.0.1.1";
-      sha256 = "1rdwjr6j398m91f7a6mjhpp9zjzs2iclq22q221pcxx5x1y08hq1";
+      version = "1.1.0.0";
+      sha256 = "0i2g57h3cfcls0r5bjnpj79yrf2pfjh09ybfwqa81gli7szr5m6r";
       libraryHaskellDepends = [
         base
         bytestring
@@ -34884,8 +34884,8 @@ self: {
     }:
     mkDerivation {
       pname = "PenroseKiteDart";
-      version = "1.2";
-      sha256 = "09z9kyyqmmbhw89inikh8hr2v8ninkwn4wkb7mjnfja92d4nfj3a";
+      version = "1.2.1";
+      sha256 = "0dzp261z231j0vwl727qa8vgzbi8dgc9vr462wlwdpzs8a18jdxf";
       libraryHaskellDepends = [
         base
         containers
@@ -37487,6 +37487,32 @@ self: {
     }
   ) { };
 
+  "Ranged-sets_0_5_0" = callPackage (
+    {
+      mkDerivation,
+      base,
+      HUnit,
+      QuickCheck,
+    }:
+    mkDerivation {
+      pname = "Ranged-sets";
+      version = "0.5.0";
+      sha256 = "03254dl4nl7x4dhlkj6285gc6djgwklfbg1yypl1vfl72l5bsh40";
+      libraryHaskellDepends = [
+        base
+        QuickCheck
+      ];
+      testHaskellDepends = [
+        base
+        HUnit
+        QuickCheck
+      ];
+      description = "Ranged sets for Haskell";
+      license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "Ranka" = callPackage (
     {
       mkDerivation,
@@ -49188,6 +49214,7 @@ self: {
       description = "Provides the class ParAccelerate, nothing more";
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -49232,6 +49259,7 @@ self: {
       QuickCheck,
       quickcheck-classes,
       random,
+      semirings,
       tagged,
       tasty,
       tasty-hspec,
@@ -49246,8 +49274,8 @@ self: {
     }:
     mkDerivation {
       pname = "ac-library-hs";
-      version = "1.2.3.0";
-      sha256 = "0b41jpl97imwprn73qqff5p4l2qk0qnm58hi88lgn74az5harpqk";
+      version = "1.2.6.0";
+      sha256 = "1n10dg5c0khy3ijic77inbvar7n8qir9lqpdqgkjiyn5bhmc7j4x";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -49255,6 +49283,7 @@ self: {
         bitvec
         bytestring
         primitive
+        random
         vector
         vector-algorithms
         wide-word
@@ -49264,6 +49293,7 @@ self: {
         bitvec
         bytestring
         primitive
+        random
         vector
         vector-algorithms
         wide-word
@@ -49279,6 +49309,7 @@ self: {
         QuickCheck
         quickcheck-classes
         random
+        semirings
         tagged
         tasty
         tasty-hspec
@@ -49482,8 +49513,6 @@ self: {
       ];
       description = "An embedded language for accelerated array processing";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -50020,6 +50049,7 @@ self: {
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
       maintainers = [ lib.maintainers.thielema ];
+      broken = true;
     }
   ) { };
 
@@ -50124,7 +50154,6 @@ self: {
       ];
       description = "Convert between Accelerate arrays and raw pointers";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -50301,7 +50330,6 @@ self: {
       ];
       description = "Binary serialisation of Accelerate arrays using serialise";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -50592,6 +50620,7 @@ self: {
       description = "Generate Accelerate arrays filled with high quality pseudorandom numbers";
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -50663,6 +50692,7 @@ self: {
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
       maintainers = [ lib.maintainers.thielema ];
+      broken = true;
     }
   ) { };
 
@@ -53292,7 +53322,6 @@ self: {
       ];
       description = "Generic operations for real functions";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -53330,7 +53359,6 @@ self: {
       ];
       description = "Multi-variate real function optimisation and proving";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "aern2-mfun-benchmark-optimisation";
     }
   ) { };
@@ -53382,7 +53410,6 @@ self: {
       ];
       description = "Multi-precision ball (interval) arithmetic";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -53421,7 +53448,6 @@ self: {
       ];
       description = "Real numbers as convergent sequences of intervals";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -53743,10 +53769,8 @@ self: {
     }:
     mkDerivation {
       pname = "aeson-better-errors";
-      version = "0.9.1.1";
-      sha256 = "05yibq9kqbjb8rh84n12sbax05amvd8jccpja0hyadz58pjy4jnk";
-      revision = "1";
-      editedCabalFile = "0wzvrmhn5q2x1mcv43cyxhlck815ldkhx7c7gz5ijjyva1iicgn2";
+      version = "0.9.1.3";
+      sha256 = "1jsnpa1ry1iyzz5qmg58za7i0d4944gcidj12jgwdslmpvcxb436";
       libraryHaskellDepends = [
         aeson
         base
@@ -58170,8 +58194,8 @@ self: {
     }:
     mkDerivation {
       pname = "alex";
-      version = "3.5.2.0";
-      sha256 = "02601mzx303gqicm1d528nqblnmwvc6mkmwyrl74f9s88vq04dli";
+      version = "3.5.3.0";
+      sha256 = "1ily1dp24i760m8p4l7x99ig532v8g1lxqp24f2i6dr8vpi55kd5";
       isLibrary = false;
       isExecutable = true;
       enableSeparateDataOutput = true;
@@ -58748,6 +58772,7 @@ self: {
       description = "General linear algebra structures";
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -59365,13 +59390,14 @@ self: {
     {
       mkDerivation,
       base,
+      hspec,
       safe,
       text,
     }:
     mkDerivation {
       pname = "align-equal";
-      version = "0.1.1.0";
-      sha256 = "138iplm5xgbbahbssdqsrwq0w3qwyr26gpnjf9rrkw82p2xph74n";
+      version = "1.0.1.2";
+      sha256 = "1bm5vlklrrdvnh1qcks5bck66n2kyjz50dd21f55qhpav8m2sdcr";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -59383,6 +59409,12 @@ self: {
         base
         text
       ];
+      testHaskellDepends = [
+        base
+        hspec
+        safe
+        text
+      ];
       description = "Aligns text prefixes before '=' for consistent formatting";
       license = lib.licenses.mit;
       hydraPlatforms = lib.platforms.none;
@@ -76331,8 +76363,8 @@ self: {
     }:
     mkDerivation {
       pname = "annotated-exception";
-      version = "0.3.0.2";
-      sha256 = "1xsyq28hkf7ngkq9v5ga958d2fqbmshc9gl8lzms6vknr64gaqr7";
+      version = "0.3.0.4";
+      sha256 = "134hwx6nm1ana5xc13dcrjb91r545lp00vpnzfm6narb5jgp9wg3";
       libraryHaskellDepends = [
         base
         containers
@@ -81984,10 +82016,8 @@ self: {
     }:
     mkDerivation {
       pname = "arch-hs";
-      version = "0.11.1.0";
-      sha256 = "1f50id3xplp8zwi379n6xi4in01gms97qbqnfxnsqzrv47xszwj4";
-      revision = "4";
-      editedCabalFile = "1qizarnjfzlml2v0bpdswhxdapakyhqil4avvmflzg4s3fm31m7l";
+      version = "0.12.0.1";
+      sha256 = "0j8j22yy3mz31ypw3j8bk4cz5n2pfvv41m5smg0jxxxvdf6jbdia";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -83341,8 +83371,8 @@ self: {
     }:
     mkDerivation {
       pname = "arithmoi";
-      version = "0.13.0.1";
-      sha256 = "08ny7pwy2askq0h34lsna0p0fqrb4wgngw5pxbdc150y2wb7p0lq";
+      version = "0.13.1.0";
+      sha256 = "0ka0sqkrkqrln6ci8fxzls9r5bhwii48xc39bbapdqbn4sc2c5bf";
       configureFlags = [ "-f-llvm" ];
       libraryHaskellDepends = [
         array
@@ -89821,8 +89851,8 @@ self: {
     }:
     mkDerivation {
       pname = "auto-split";
-      version = "0.1.0.3";
-      sha256 = "1v0m3a1jh04brkxvi9111a49wj7pfvx5wjix6h5q4clc85l0hcmg";
+      version = "0.1.0.4";
+      sha256 = "0h5amma97l6m8dxvhnnksskfm55zgpfx3qm24wivv7slhp7s9q2q";
       libraryHaskellDepends = [
         base
         ghc
@@ -93810,21 +93840,23 @@ self: {
       bytestring,
       containers,
       directory,
+      effectful,
+      effectful-core,
+      effectful-plugin,
+      effectful-th,
       extra,
       filepath,
-      freer-simple,
       ghcid,
       hashable,
       haskell-src-exts,
       hedgehog,
       hpack,
+      hspec,
       lens,
       lens-aeson,
       megaparsec,
       mono-traversable,
       optparse-applicative,
-      polysemy,
-      polysemy-plugin,
       prettyprinter,
       process,
       profunctors,
@@ -93847,8 +93879,8 @@ self: {
     }:
     mkDerivation {
       pname = "axel";
-      version = "0.0.12";
-      sha256 = "1136rnh5j47qxyciwmpgcdqy3j4f4pwcgb89wgkl8wixzxjxj6i1";
+      version = "0.0.13";
+      sha256 = "1300b6j2nnwwwlh4q0nw6qv2cadk6byiqqp0f4mhlmylzasvrbcy";
       isLibrary = true;
       isExecutable = true;
       enableSeparateDataOutput = true;
@@ -93859,21 +93891,23 @@ self: {
         bytestring
         containers
         directory
+        effectful
+        effectful-core
+        effectful-plugin
+        effectful-th
         extra
         filepath
-        freer-simple
         ghcid
         hashable
         haskell-src-exts
         hedgehog
         hpack
+        hspec
         lens
         lens-aeson
         megaparsec
         mono-traversable
         optparse-applicative
-        polysemy
-        polysemy-plugin
         prettyprinter
         process
         profunctors
@@ -93905,21 +93939,23 @@ self: {
         bytestring
         containers
         directory
+        effectful
+        effectful-core
+        effectful-plugin
+        effectful-th
         extra
         filepath
-        freer-simple
         ghcid
         hashable
         haskell-src-exts
         hedgehog
         hpack
+        hspec
         lens
         lens-aeson
         megaparsec
         mono-traversable
         optparse-applicative
-        polysemy
-        polysemy-plugin
         prettyprinter
         process
         profunctors
@@ -93951,21 +93987,23 @@ self: {
         bytestring
         containers
         directory
+        effectful
+        effectful-core
+        effectful-plugin
+        effectful-th
         extra
         filepath
-        freer-simple
         ghcid
         hashable
         haskell-src-exts
         hedgehog
         hpack
+        hspec
         lens
         lens-aeson
         megaparsec
         mono-traversable
         optparse-applicative
-        polysemy
-        polysemy-plugin
         prettyprinter
         process
         profunctors
@@ -96012,10 +96050,8 @@ self: {
     }:
     mkDerivation {
       pname = "bank-holiday-germany";
-      version = "1.3.0.0";
-      sha256 = "1agf4flql5xkj2rpdbdxpmvajhigcwzbxsmrh76bckmcj2b38k9f";
-      revision = "4";
-      editedCabalFile = "057nvj7bd6hm4xjylr75gq3sg74iz8h4xkyzxmxj54x76nplgq9i";
+      version = "1.3.1.0";
+      sha256 = "1a9n5vc9bqs6a6nh87px4lb9i73ad4yg0l67rlwiv80l4pqia1fi";
       libraryHaskellDepends = [
         base
         time
@@ -96033,6 +96069,38 @@ self: {
     }
   ) { };
 
+  "bank-holiday-germany_2_1_0_0" = callPackage (
+    {
+      mkDerivation,
+      base,
+      doctest,
+      hedgehog,
+      hspec,
+      hspec-hedgehog,
+      time,
+    }:
+    mkDerivation {
+      pname = "bank-holiday-germany";
+      version = "2.1.0.0";
+      sha256 = "1p0grrrd949ng2hjwfx66v42c9sl2lhwxy0qg1r4b0myr77wia03";
+      libraryHaskellDepends = [
+        base
+        time
+      ];
+      testHaskellDepends = [
+        base
+        doctest
+        hedgehog
+        hspec
+        hspec-hedgehog
+        time
+      ];
+      description = "German bank holidays and public holidays";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "bank-holiday-usa" = callPackage (
     {
       mkDerivation,
@@ -101619,18 +101687,20 @@ self: {
       hoogle,
       lens,
       process,
-      protolude,
       text,
       time,
       typed-process,
       vector,
+      verset,
       vty,
       vty-crossplatform,
     }:
     mkDerivation {
       pname = "bhoogle";
-      version = "0.1.4.3";
-      sha256 = "1qsvzsfn7cysz4p62pwba207h2q9khii1vbwgsgn01qwvhc0vm15";
+      version = "0.1.4.4";
+      sha256 = "1z19h0jgnipj16rqbrflcjnqaslafq9bvwkyg8q0il76q7s4wyxa";
+      revision = "1";
+      editedCabalFile = "182j2bc4cqddzv5vd2fkkyx2qs9ya7vg9r234xr5gyp35waln1i9";
       isLibrary = false;
       isExecutable = true;
       executableHaskellDepends = [
@@ -101643,11 +101713,11 @@ self: {
         hoogle
         lens
         process
-        protolude
         text
         time
         typed-process
         vector
+        verset
         vty
         vty-crossplatform
       ];
@@ -109391,10 +109461,8 @@ self: {
     }:
     mkDerivation {
       pname = "blas-comfort-array";
-      version = "0.0.0.3";
-      sha256 = "1g0bvag205ag520vlxv24cv63idjg6j8nwnadq9gbcibn4gvsisz";
-      revision = "1";
-      editedCabalFile = "1jdl8x0vs6p0h3qcwal7zr281cxqlxppq43yg2jkidhddqf9sgpd";
+      version = "0.0.0.4";
+      sha256 = "0km1pkmzaf89amyw867kbbakvgvimha8d7nsjn6rzn7pyc4p66ja";
       libraryHaskellDepends = [
         base
         blas-ffi
@@ -110491,8 +110559,8 @@ self: {
     }:
     mkDerivation {
       pname = "blockfrost-api";
-      version = "0.12.1.0";
-      sha256 = "0v3v42qlwiq9vmxb7n9y0sx6fpj58l367a28mrhjkagj3skh1m08";
+      version = "0.12.2.0";
+      sha256 = "04w745ws2nf90yix2idd6shahqfi7mwx83j4divjrkfb57pd8v6p";
       libraryHaskellDepends = [
         aeson
         base
@@ -110554,8 +110622,8 @@ self: {
     }:
     mkDerivation {
       pname = "blockfrost-client";
-      version = "0.9.1.0";
-      sha256 = "14pgfkpp3k1vnci718w7hcn4wmj81lbwdw14kmixb31haqajvn6n";
+      version = "0.9.2.0";
+      sha256 = "04q48afris70y4j4ya52kvj9n1iy8jqn6ygydp11idr15fpjj4qh";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -112338,6 +112406,8 @@ self: {
       pname = "bond";
       version = "0.13.0.0";
       sha256 = "0zb42j6hz8vjg38cpmmqzisnirajz140s9yp83f1zv471r6zb868";
+      revision = "1";
+      editedCabalFile = "0vvj75033s2jfskfc6zrqpzdyi0jdv45dyr33z86nlsg4dwpj81f";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -114198,8 +114268,8 @@ self: {
     }:
     mkDerivation {
       pname = "bowtie";
-      version = "0.5.0";
-      sha256 = "0gdf3fiji0w68h51r8xdgn442k7gni66fq78bgpkrpj718fvjmbf";
+      version = "0.7.0";
+      sha256 = "0d26srb8r8p32n4cq0bs8r11psh3w87mf6bq4h5612knsbdyny0f";
       libraryHaskellDepends = [
         base
         bifunctors
@@ -123734,10 +123804,8 @@ self: {
         }:
         mkDerivation {
           pname = "cabal-install";
-          version = "3.14.1.1";
-          sha256 = "1kmsnvdid2pc1r395id8h1vi8ckphm9h9rl7m5sn5d3zp153c7gi";
-          revision = "1";
-          editedCabalFile = "0yz85jln3nipglik8pn45kmbdn63i74xcll5yx5fdawlfrl4qav2";
+          version = "3.14.2.0";
+          sha256 = "1nvv3h9kq92ifyqqma88538579v7898pd9b52hras2h489skv8g8";
           isLibrary = true;
           isExecutable = true;
           libraryHaskellDepends = [
@@ -124173,8 +124241,8 @@ self: {
     }:
     mkDerivation {
       pname = "cabal-install-solver";
-      version = "3.14.1.0";
-      sha256 = "0gcccglkhz8kjjvqas79wn402c5im2fqqzms453hj0i28j0y4ydm";
+      version = "3.14.2.0";
+      sha256 = "0551cvrkbnjfqjd3byq7pczlwjdb0n1jrfsrb0j8axagylbif7g1";
       libraryHaskellDepends = [
         array
         base
@@ -124810,7 +124878,9 @@ self: {
       ];
       executableHaskellDepends = [ base ];
       license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
       mainProgram = "cabal-scaffold";
+      broken = true;
     }
   ) { };
 
@@ -126272,8 +126342,8 @@ self: {
     }:
     mkDerivation {
       pname = "cachix";
-      version = "1.7.7";
-      sha256 = "1hlihm8lwng0g2w1a1cw56y32h85hdb1nxx9h8p60fql46z2f18w";
+      version = "1.7.8";
+      sha256 = "18vp2r0q6ibk5snsys7qh65vmshp4344z29pqdp8qfwzk5yqc3hc";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -126433,8 +126503,8 @@ self: {
     }:
     mkDerivation {
       pname = "cachix-api";
-      version = "1.7.7";
-      sha256 = "13gr7l65xpn8y32cds129bwwsjmc4ykz3vzvfm5hvmi5przlwb88";
+      version = "1.7.8";
+      sha256 = "0rvmfwmgyn6jpivq45f5v5sg0s007ansjmizflxgiqn4sfqbkndr";
       libraryHaskellDepends = [
         aeson
         async
@@ -127652,6 +127722,71 @@ self: {
     }
   ) { };
 
+  "call-alloy_0_6_0_2" = callPackage (
+    {
+      mkDerivation,
+      async,
+      base,
+      bytestring,
+      containers,
+      directory,
+      exceptions,
+      extra,
+      file-embed,
+      filepath,
+      hspec,
+      process,
+      split,
+      string-interpolate,
+      transformers,
+      trifecta,
+      unix,
+    }:
+    mkDerivation {
+      pname = "call-alloy";
+      version = "0.6.0.2";
+      sha256 = "1b8xb2z3cjlqiz2jj75qbw4p0xhdybhnarq3xg2gdn2c953xyscq";
+      enableSeparateDataOutput = true;
+      libraryHaskellDepends = [
+        async
+        base
+        bytestring
+        containers
+        directory
+        exceptions
+        extra
+        filepath
+        process
+        split
+        transformers
+        trifecta
+        unix
+      ];
+      testHaskellDepends = [
+        async
+        base
+        bytestring
+        containers
+        directory
+        exceptions
+        extra
+        file-embed
+        filepath
+        hspec
+        process
+        split
+        string-interpolate
+        transformers
+        trifecta
+        unix
+      ];
+      description = "A simple library to call Alloy given a specification";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
+    }
+  ) { };
+
   "call-haskell-from-anything" = callPackage (
     {
       mkDerivation,
@@ -127771,8 +127906,8 @@ self: {
     }:
     mkDerivation {
       pname = "calligraphy";
-      version = "0.1.6";
-      sha256 = "1bsg18vq2cpzhj0lp5pcy73pa93wahaan0nrjgyyqd48szqppn33";
+      version = "0.1.7";
+      sha256 = "0lmhp9zqn65qlf93aijqcpnx5gbw51ms09hc553ks1nw4g97cpvv";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -127798,9 +127933,7 @@ self: {
       ];
       description = "HIE-based Haskell call graph and source code visualizer";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "calligraphy";
-      broken = true;
     }
   ) { };
 
@@ -128070,6 +128203,7 @@ self: {
       containers,
       deep-transformations,
       directory,
+      fast-logger,
       filepath,
       forms-data-format,
       hedgehog,
@@ -128093,8 +128227,8 @@ self: {
     }:
     mkDerivation {
       pname = "canadian-income-tax";
-      version = "2024.0";
-      sha256 = "0lciy9q87wjv8gpc0qhgf2p7bpcxk7bg0ka7ac86c201qbva1xw7";
+      version = "2024.1";
+      sha256 = "1j68n3j05ga0l3fm9ric61i04kn0yjgzw80vzgwa5g208v1l97vj";
       isLibrary = true;
       isExecutable = true;
       enableSeparateDataOutput = true;
@@ -128121,6 +128255,7 @@ self: {
         ca-province-codes
         containers
         directory
+        fast-logger
         filepath
         forms-data-format
         http-types
@@ -128199,8 +128334,8 @@ self: {
     }:
     mkDerivation {
       pname = "candid";
-      version = "0.5.0.2";
-      sha256 = "1xj5p9qjwn24xrm2wkp2bz5wrkljrjzvqsfd8az09r0x1d3v62b7";
+      version = "0.5.0.3";
+      sha256 = "1xl7pr6sf8750n7xscqh9fax9dak5rz63wxqrmib0a362arhvpgc";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -129493,6 +129628,8 @@ self: {
       pname = "cardano-addresses";
       version = "4.0.0";
       sha256 = "13cvazmshy3j9c53g7i8pd4fmh6mgiajhaf42cf2d353pjjxr1w4";
+      revision = "1";
+      editedCabalFile = "1alyswv1d4q616vikwyv35ycxlz73qa7w602y43iba2g953823xv";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -132847,8 +132984,6 @@ self: {
       ];
       description = "Exact real arithmetic using Centred Dyadic Approximations";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -141188,10 +141323,8 @@ self: {
     }:
     mkDerivation {
       pname = "clash-shake";
-      version = "0.3.2";
-      sha256 = "0bgnl1q1xm1yhwspqlfr02p37iy8vka727r4awr2lihg12x83bjx";
-      revision = "1";
-      editedCabalFile = "1gqzayyqdrhfd11as965bmi06ahnx72sr5ghxczrlfxsihdrbcgl";
+      version = "0.4.0";
+      sha256 = "0k9zsgkdqhgw4l16j34b5y0sp553whiz77zvz5p4qsx2h7avri9w";
       libraryHaskellDepends = [
         aeson
         base
@@ -144136,6 +144269,98 @@ self: {
     }
   ) { QtCore = null; };
 
+  "clod" = callPackage (
+    {
+      mkDerivation,
+      aeson,
+      base,
+      bytestring,
+      containers,
+      dhall,
+      directory,
+      file-embed,
+      filepath,
+      hashable,
+      hspec,
+      lens,
+      magic,
+      mtl,
+      optparse-applicative,
+      process,
+      QuickCheck,
+      random,
+      temporary,
+      text,
+      time,
+      transformers,
+      unix,
+      xxhash-ffi,
+    }:
+    mkDerivation {
+      pname = "clod";
+      version = "0.2.2";
+      sha256 = "1r71lqpj29x9i8hsc8baajny2b79d5mp2l9xdnsadmgmxsszvdvb";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        aeson
+        base
+        bytestring
+        containers
+        dhall
+        directory
+        file-embed
+        filepath
+        hashable
+        lens
+        magic
+        mtl
+        process
+        temporary
+        text
+        time
+        transformers
+        unix
+        xxhash-ffi
+      ];
+      executableHaskellDepends = [
+        aeson
+        base
+        bytestring
+        containers
+        directory
+        filepath
+        hashable
+        magic
+        optparse-applicative
+        process
+        text
+        time
+      ];
+      testHaskellDepends = [
+        base
+        bytestring
+        containers
+        directory
+        filepath
+        hashable
+        hspec
+        mtl
+        optparse-applicative
+        process
+        QuickCheck
+        random
+        temporary
+        text
+        time
+        unix
+      ];
+      description = "Project file manager for Claude AI integrations";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "clogparse" = callPackage (
     {
       mkDerivation,
@@ -146255,6 +146480,74 @@ self: {
     }
   ) { };
 
+  "co-log_0_7_0_0" = callPackage (
+    {
+      mkDerivation,
+      ansi-terminal,
+      base,
+      bytestring,
+      co-log-core,
+      containers,
+      contravariant,
+      dependent-map,
+      dependent-sum,
+      directory,
+      doctest,
+      exceptions,
+      filepath,
+      Glob,
+      hedgehog,
+      mtl,
+      text,
+      time,
+      transformers,
+      unliftio-core,
+      vector,
+    }:
+    mkDerivation {
+      pname = "co-log";
+      version = "0.7.0.0";
+      sha256 = "0r3jy8wah1bglx6qyys4v6qachgiwdlm1z3z3xp49b6yw82yjq38";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        ansi-terminal
+        base
+        bytestring
+        co-log-core
+        containers
+        contravariant
+        dependent-map
+        dependent-sum
+        directory
+        exceptions
+        filepath
+        mtl
+        text
+        time
+        transformers
+        unliftio-core
+        vector
+      ];
+      executableHaskellDepends = [
+        base
+        bytestring
+        dependent-map
+        mtl
+      ];
+      testHaskellDepends = [
+        base
+        co-log-core
+        doctest
+        Glob
+        hedgehog
+      ];
+      description = "Composable Contravariant Comonadic Logging Library";
+      license = lib.licenses.mpl20;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "co-log-concurrent" = callPackage (
     {
       mkDerivation,
@@ -149192,7 +149485,6 @@ self: {
       ];
       description = "Working with colours in Accelerate";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -159042,8 +159334,8 @@ self: {
     }:
     mkDerivation {
       pname = "consumers";
-      version = "2.3.3.0";
-      sha256 = "19j16m20qrlqqgcp1nfzn9q9bv3b27vn48chpj2ifh0l9mxjqnmv";
+      version = "2.3.3.1";
+      sha256 = "1c4kgsprk4gdgj6zy0vqpfh1izqqdrjbdlzvrln3xpafv80ig060";
       libraryHaskellDepends = [
         aeson
         base
@@ -159772,6 +160064,53 @@ self: {
     }
   ) { };
 
+  "contiguous_0_6_5_0" = callPackage (
+    {
+      mkDerivation,
+      base,
+      deepseq,
+      primitive,
+      primitive-unlifted,
+      QuickCheck,
+      quickcheck-classes,
+      quickcheck-instances,
+      random,
+      random-shuffle,
+      run-st,
+      vector,
+      weigh,
+    }:
+    mkDerivation {
+      pname = "contiguous";
+      version = "0.6.5.0";
+      sha256 = "1ml7a8gcx89jmd7l96amcwkfyq23h4z6gwn377iaw6nbi1hia0lm";
+      libraryHaskellDepends = [
+        base
+        deepseq
+        primitive
+        primitive-unlifted
+        run-st
+      ];
+      testHaskellDepends = [
+        base
+        primitive
+        QuickCheck
+        quickcheck-classes
+        quickcheck-instances
+        vector
+      ];
+      benchmarkHaskellDepends = [
+        base
+        random
+        random-shuffle
+        weigh
+      ];
+      description = "Unified interface for primitive arrays";
+      license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "contiguous-checked" = callPackage (
     {
       mkDerivation,
@@ -160986,8 +161325,8 @@ self: {
     }:
     mkDerivation {
       pname = "cookie";
-      version = "0.5.0";
-      sha256 = "178slrr0lpz3kim86i3a2g9qxccmxpcvgldp9f2cvyzqj1qgwl8f";
+      version = "0.5.1";
+      sha256 = "187plsi53i0hmkg44f7n5xd2qpsg1kz189f08zhvp8z34qkydp8s";
       libraryHaskellDepends = [
         base
         bytestring
@@ -162085,7 +162424,6 @@ self: {
       doHaddock = false;
       description = "System for verifying the correctness of generated Copilot programs";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "verify-examples";
     }
   ) { };
@@ -165557,8 +165895,8 @@ self: {
     }:
     mkDerivation {
       pname = "crdt-event-fold";
-      version = "1.8.1.1";
-      sha256 = "07nqvmlpbcy88k7lmwl5n0mq2n0lxq48nigyqgzibadwg3i20r8q";
+      version = "1.8.1.2";
+      sha256 = "0la453h3y52nz7xwixz6r2scnya1729d6hj2dbzj98rld8bf8xcz";
       libraryHaskellDepends = [
         aeson
         base
@@ -166294,8 +166632,8 @@ self: {
       pname = "criterion-compare";
       version = "0.1.0.0";
       sha256 = "034cm3hap9x6cwp44hrd03b09mifcm076a9pn3lgql5ardx91yl7";
-      revision = "1";
-      editedCabalFile = "0nzwqk0mrchrymbmim2542s37i3dvvs5ks25839z9x0fp6gpxiq6";
+      revision = "2";
+      editedCabalFile = "071hlwv6c510d2li0qxgdji1fa2c9iz88m63bcfk70bnamf4d5xr";
       isLibrary = false;
       isExecutable = true;
       executableHaskellDepends = [
@@ -166317,9 +166655,7 @@ self: {
       ];
       description = "A simple tool for visualising differences in Criterion benchmark results";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "criterion-compare";
-      broken = true;
     }
   ) { };
 
@@ -167321,8 +167657,6 @@ self: {
       ];
       description = "Simple top-level library for Crucible Simulation";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -167447,7 +167781,6 @@ self: {
       ];
       description = "A verification tool for C programs";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -169041,58 +169374,6 @@ self: {
   ) { };
 
   "crypton" = callPackage (
-    {
-      mkDerivation,
-      base,
-      basement,
-      bytestring,
-      deepseq,
-      gauge,
-      ghc-prim,
-      integer-gmp,
-      memory,
-      random,
-      tasty,
-      tasty-hunit,
-      tasty-kat,
-      tasty-quickcheck,
-    }:
-    mkDerivation {
-      pname = "crypton";
-      version = "1.0.3";
-      sha256 = "12z3xavhzw2nvvbkq0j22agwcnc4hh235cr7mzbd1a076wxrdbhl";
-      libraryHaskellDepends = [
-        base
-        basement
-        bytestring
-        deepseq
-        ghc-prim
-        integer-gmp
-        memory
-      ];
-      testHaskellDepends = [
-        base
-        bytestring
-        memory
-        tasty
-        tasty-hunit
-        tasty-kat
-        tasty-quickcheck
-      ];
-      benchmarkHaskellDepends = [
-        base
-        bytestring
-        deepseq
-        gauge
-        memory
-        random
-      ];
-      description = "Cryptography Primitives sink";
-      license = lib.licenses.bsd3;
-    }
-  ) { };
-
-  "crypton_1_0_4" = callPackage (
     {
       mkDerivation,
       base,
@@ -169141,7 +169422,6 @@ self: {
       ];
       description = "Cryptography Primitives sink";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -169229,45 +169509,6 @@ self: {
   ) { };
 
   "crypton-connection" = callPackage (
-    {
-      mkDerivation,
-      base,
-      basement,
-      bytestring,
-      containers,
-      crypton-x509,
-      crypton-x509-store,
-      crypton-x509-system,
-      crypton-x509-validation,
-      data-default,
-      network,
-      socks,
-      tls,
-    }:
-    mkDerivation {
-      pname = "crypton-connection";
-      version = "0.4.3";
-      sha256 = "1q9az1bd6gykm897vmasbx1v9dfnwz4fgypya12yssjy7772b269";
-      libraryHaskellDepends = [
-        base
-        basement
-        bytestring
-        containers
-        crypton-x509
-        crypton-x509-store
-        crypton-x509-system
-        crypton-x509-validation
-        data-default
-        network
-        socks
-        tls
-      ];
-      description = "Simple and easy network connection API";
-      license = lib.licenses.bsd3;
-    }
-  ) { };
-
-  "crypton-connection_0_4_4" = callPackage (
     {
       mkDerivation,
       base,
@@ -169297,7 +169538,6 @@ self: {
       ];
       description = "Simple and easy network connection API";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -173345,6 +173585,7 @@ self: {
       ghc-typelits-knownnat,
       mtl,
       primitive,
+      primitive-unaligned,
       prop-unit,
       text,
       transformers,
@@ -173352,8 +173593,8 @@ self: {
     }:
     mkDerivation {
       pname = "dahdit";
-      version = "0.7.0";
-      sha256 = "11g5c6csgrw6jq3ijv07yq2kj4f3ylkh450gv8qs9lqlg5haiis3";
+      version = "0.8.0";
+      sha256 = "15sj22p0xvxaa0mr6kyj86cmik3dyyz9v8ppziqfl055r9ja96vn";
       libraryHaskellDepends = [
         base
         bytestring
@@ -173364,6 +173605,7 @@ self: {
         ghc-typelits-knownnat
         mtl
         primitive
+        primitive-unaligned
         text
         transformers
         vector
@@ -173378,6 +173620,7 @@ self: {
         ghc-typelits-knownnat
         mtl
         primitive
+        primitive-unaligned
         prop-unit
         text
         transformers
@@ -173388,6 +173631,99 @@ self: {
     }
   ) { };
 
+  "dahdit-audio" = callPackage (
+    {
+      mkDerivation,
+      aeson,
+      aeson-casing,
+      aeson-pretty,
+      aeson-via,
+      base,
+      bytestring,
+      containers,
+      dahdit,
+      data-default,
+      data-sword,
+      daytripper,
+      digest,
+      directory,
+      filepath,
+      ghc-typelits-knownnat,
+      microlens,
+      mtl,
+      optparse-applicative,
+      pathwalk,
+      prettyprinter,
+      primitive,
+      regex-tdfa,
+      tasty,
+      tasty-hunit,
+      text,
+      transformers,
+    }:
+    mkDerivation {
+      pname = "dahdit-audio";
+      version = "0.8.0";
+      sha256 = "016wzjqvy0y1qj4jsqy183f570zlc4xzldgpqclj55lpcf2wv86b";
+      libraryHaskellDepends = [
+        aeson
+        aeson-casing
+        aeson-pretty
+        aeson-via
+        base
+        bytestring
+        containers
+        dahdit
+        data-default
+        data-sword
+        digest
+        directory
+        filepath
+        ghc-typelits-knownnat
+        microlens
+        mtl
+        optparse-applicative
+        pathwalk
+        prettyprinter
+        primitive
+        regex-tdfa
+        text
+        transformers
+      ];
+      testHaskellDepends = [
+        aeson
+        aeson-casing
+        aeson-pretty
+        aeson-via
+        base
+        bytestring
+        containers
+        dahdit
+        data-default
+        data-sword
+        daytripper
+        digest
+        directory
+        filepath
+        ghc-typelits-knownnat
+        microlens
+        mtl
+        optparse-applicative
+        pathwalk
+        prettyprinter
+        primitive
+        regex-tdfa
+        tasty
+        tasty-hunit
+        text
+        transformers
+      ];
+      description = "Audio file parsing/printing with dahdit";
+      license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "dahdit-midi" = callPackage (
     {
       mkDerivation,
@@ -173410,8 +173746,8 @@ self: {
     }:
     mkDerivation {
       pname = "dahdit-midi";
-      version = "0.7.0";
-      sha256 = "15id66nm3lknwgmmh57kfzjlg8ai7l3rlls5by56ii8a9c5x5hxg";
+      version = "0.8.0";
+      sha256 = "1avqjgyj86g20dyy3s816nvyqy4n8xwdqjvg4m0y70v343qr2bwg";
       libraryHaskellDepends = [
         base
         bytestring
@@ -173465,8 +173801,8 @@ self: {
     }:
     mkDerivation {
       pname = "dahdit-network";
-      version = "0.7.0";
-      sha256 = "07aj5hc8vgy3691q9x335b4ypxjl5m17b7qw19gkg0lxphddxx25";
+      version = "0.8.0";
+      sha256 = "175pgcrw7iphw6yahy20dd1cf6p0bbmf2sq0hmgj6bm25ms35j47";
       libraryHaskellDepends = [
         base
         bytestring
@@ -173506,8 +173842,8 @@ self: {
     }:
     mkDerivation {
       pname = "dahdit-test";
-      version = "0.7.0";
-      sha256 = "0k7sy43d319n2371qsv803x4p51653bfdysjk5nyc6f68i2q7j12";
+      version = "0.8.0";
+      sha256 = "0hzhqacfyhkk3y19y3f1mbd7jwwgdh8qf3y7clfjnpn67fjjmqng";
       libraryHaskellDepends = [
         base
         bytestring
@@ -176290,6 +176626,57 @@ self: {
     }
   ) { };
 
+  "data-effects_0_4_0_2" = callPackage (
+    {
+      mkDerivation,
+      base,
+      co-log-core,
+      containers,
+      data-default,
+      data-effects-core,
+      data-effects-th,
+      infinite-list,
+      lens,
+      tasty,
+      tasty-discover,
+      tasty-hunit,
+      text,
+      these,
+      time,
+      unbounded-delays,
+      unliftio,
+    }:
+    mkDerivation {
+      pname = "data-effects";
+      version = "0.4.0.2";
+      sha256 = "0dkrn3p8whywqmiznq8wp2g7j12pnrjjm11w7pj64hgjx0s0rkaf";
+      libraryHaskellDepends = [
+        base
+        co-log-core
+        containers
+        data-default
+        data-effects-core
+        data-effects-th
+        infinite-list
+        lens
+        text
+        these
+        time
+        unbounded-delays
+        unliftio
+      ];
+      testHaskellDepends = [
+        base
+        tasty
+        tasty-hunit
+      ];
+      testToolDepends = [ tasty-discover ];
+      description = "A basic framework for effect systems based on effects represented by GADTs";
+      license = lib.licenses.mpl20;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "data-effects-core" = callPackage (
     {
       mkDerivation,
@@ -176320,6 +176707,45 @@ self: {
     }
   ) { };
 
+  "data-effects-core_0_4_0_2" = callPackage (
+    {
+      mkDerivation,
+      base,
+      free,
+      hspec,
+      kan-extensions,
+      mtl,
+      primitive,
+      tasty,
+      tasty-discover,
+      tasty-hspec,
+      unliftio,
+    }:
+    mkDerivation {
+      pname = "data-effects-core";
+      version = "0.4.0.2";
+      sha256 = "03p30sj5nqqmkw55p0fc83ncx5w8z7rpi920x35mdgl00wpxxs6a";
+      libraryHaskellDepends = [
+        base
+        free
+        kan-extensions
+        mtl
+        primitive
+        unliftio
+      ];
+      testHaskellDepends = [
+        base
+        hspec
+        tasty
+        tasty-hspec
+      ];
+      testToolDepends = [ tasty-discover ];
+      description = "A basic framework for effect systems based on effects represented by GADTs";
+      license = lib.licenses.mpl20;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "data-effects-th" = callPackage (
     {
       mkDerivation,
@@ -176375,6 +176801,60 @@ self: {
     }
   ) { };
 
+  "data-effects-th_0_4_0_2" = callPackage (
+    {
+      mkDerivation,
+      base,
+      containers,
+      data-default,
+      data-effects-core,
+      either,
+      extra,
+      formatting,
+      infinite-list,
+      lens,
+      mtl,
+      tasty,
+      tasty-discover,
+      tasty-hunit,
+      template-haskell,
+      text,
+      th-abstraction,
+    }:
+    mkDerivation {
+      pname = "data-effects-th";
+      version = "0.4.0.2";
+      sha256 = "08qa9f0mc4246qp8dnfp7pcbfvlfvrgpqyv407nqqnd1wc7nlf78";
+      libraryHaskellDepends = [
+        base
+        containers
+        data-default
+        data-effects-core
+        either
+        extra
+        formatting
+        infinite-list
+        lens
+        mtl
+        template-haskell
+        text
+        th-abstraction
+      ];
+      testHaskellDepends = [
+        base
+        data-default
+        data-effects-core
+        infinite-list
+        tasty
+        tasty-hunit
+      ];
+      testToolDepends = [ tasty-discover ];
+      description = "Template Haskell utilities for the data-effects library";
+      license = lib.licenses.mpl20;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "data-elevator" = callPackage (
     {
       mkDerivation,
@@ -177916,8 +178396,8 @@ self: {
     }:
     mkDerivation {
       pname = "data-reify-gadt";
-      version = "0.1.0.0";
-      sha256 = "1fi9fsx1xvrd6lbh0zr21727clvv1j6ca62yq70z5fwsy4yx1gf2";
+      version = "0.1.0.1";
+      sha256 = "0zbqka2cjah449z4ddlq77ljg8x45pnjqvl0hkpghv55v2isg1sl";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -177941,9 +178421,7 @@ self: {
       ];
       description = "Data.Reify for GADTs";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "example-ast";
-      broken = true;
     }
   ) { };
 
@@ -179392,6 +179870,82 @@ self: {
     }
   ) { };
 
+  "dataframe" = callPackage (
+    {
+      mkDerivation,
+      array,
+      attoparsec,
+      base,
+      bytestring,
+      containers,
+      criterion,
+      directory,
+      hashable,
+      HUnit,
+      random,
+      random-shuffle,
+      statistics,
+      text,
+      time,
+      vector,
+      vector-algorithms,
+    }:
+    mkDerivation {
+      pname = "dataframe";
+      version = "0.1.0.1";
+      sha256 = "1n17s20s4lznqs4rx8f90zw5sijkz0s6b48j6wrg4wgddg3dsb2m";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        array
+        attoparsec
+        base
+        bytestring
+        containers
+        directory
+        hashable
+        statistics
+        text
+        time
+        vector
+        vector-algorithms
+      ];
+      executableHaskellDepends = [
+        array
+        attoparsec
+        base
+        bytestring
+        containers
+        directory
+        hashable
+        statistics
+        text
+        time
+        vector
+        vector-algorithms
+      ];
+      testHaskellDepends = [
+        base
+        HUnit
+        random
+        random-shuffle
+        text
+        time
+        vector
+      ];
+      benchmarkHaskellDepends = [
+        base
+        criterion
+        random
+        text
+        vector
+      ];
+      description = "An intuitive, dynamically-typed DataFrame library";
+      license = lib.licenses.gpl3Plus;
+      mainProgram = "dataframe";
+    }
+  ) { };
+
   "datalog" = callPackage (
     {
       mkDerivation,
@@ -181642,7 +182196,6 @@ self: {
       ];
       description = "Delay differential equations";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -182288,6 +182841,7 @@ self: {
     {
       mkDerivation,
       aeson,
+      aeson-qq,
       base,
       containers,
       hspec,
@@ -182297,8 +182851,8 @@ self: {
     }:
     mkDerivation {
       pname = "debug-print";
-      version = "0.1.0.0";
-      sha256 = "0920fwzv5lal5214g973yv73dyyg02aa9fdkddcv7bdq445as6m5";
+      version = "0.2.0.0";
+      sha256 = "195hacxpm3ik7r8mcl5vs1l6j5q8nhvvrsxqbp3p7bghybvnaa3v";
       libraryHaskellDepends = [
         aeson
         base
@@ -182308,6 +182862,7 @@ self: {
       ];
       testHaskellDepends = [
         aeson
+        aeson-qq
         base
         hspec
         markdown-unlit
@@ -183059,6 +183614,7 @@ self: {
       license = lib.licenses.mit;
       hydraPlatforms = lib.platforms.none;
       mainProgram = "deeplearning_demonstration";
+      broken = true;
     }
   ) { };
 
@@ -183679,8 +184235,8 @@ self: {
     { mkDerivation, base }:
     mkDerivation {
       pname = "defun-core";
-      version = "0.1";
-      sha256 = "1vxkasxvkkk0x11r850h14fh37pfyavd0pib5zgnj4w0ddmqx00g";
+      version = "0.1.0.1";
+      sha256 = "0yy02va22bhxk1gl1m1k4c84sc788g891p5m81mr3bai5y7vq402";
       libraryHaskellDepends = [ base ];
       description = "Defunctionalization helpers: core definitions";
       license = lib.licenses.bsd3;
@@ -183696,8 +184252,8 @@ self: {
     }:
     mkDerivation {
       pname = "defun-sop";
-      version = "0.1";
-      sha256 = "1zd8laprbmaaxgj21n8bnrax2m9l67y950d1fs8b2bdlsc33llc8";
+      version = "0.1.0.1";
+      sha256 = "0wb6axzilgqf32c7xk3ja42cax7brbv29f7nx69j65qxblayb7ls";
       libraryHaskellDepends = [
         base
         defun-core
@@ -189154,8 +189710,8 @@ self: {
     }:
     mkDerivation {
       pname = "diagrams";
-      version = "1.4.1";
-      sha256 = "0z4i169yzznfj6bmkvgs09v85zchq7visajn6v5hvhj3m0ic0cmh";
+      version = "1.4.2";
+      sha256 = "12ff6lvkmpbblz3id517rf48rzd1v940y6gq6khhbsy8p9ad2ic4";
       libraryHaskellDepends = [
         diagrams-contrib
         diagrams-core
@@ -189213,8 +189769,8 @@ self: {
     }:
     mkDerivation {
       pname = "diagrams-braille";
-      version = "0.1.1";
-      sha256 = "1h9j1hrhpzl5rqhjnwp92sv0shc9i7yhnzpbs1dxfpyn8baws7mc";
+      version = "0.1.2";
+      sha256 = "1b2avafvrc2rx0r9x0xnx9nvl8cl21jrls587clwpv4nrsijfhnr";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -189511,6 +190067,8 @@ self: {
       pname = "diagrams-canvas";
       version = "1.4.2";
       sha256 = "0ns1xmgcjqig7qld7r77rbcrk779cmzj7xfqj6a7sbdci3in2dgm";
+      revision = "1";
+      editedCabalFile = "08pm7i10k7a046jjrdbzhmlrv05wp171mblgs8y18m6vc8hw87v6";
       libraryHaskellDepends = [
         base
         blank-canvas
@@ -189807,8 +190365,8 @@ self: {
       pname = "diagrams-graphviz";
       version = "1.4.1.1";
       sha256 = "0lscrxd682jvyrl5bj4dxp7593qwyis01sl0p4jm2jfn335wdq40";
-      revision = "6";
-      editedCabalFile = "1h0y3dv8707yvk1g0hmyb6knzahyzyxqmabkih4wyq5cz1zjmh1n";
+      revision = "7";
+      editedCabalFile = "17wf141cgyw13v3ly074vaakrdgi1k3ifq6k521b4sn8r6vzfaws";
       libraryHaskellDepends = [
         base
         containers
@@ -190091,7 +190649,7 @@ self: {
     }
   ) { };
 
-  "diagrams-input_0_1_4" = callPackage (
+  "diagrams-input_0_1_5" = callPackage (
     {
       mkDerivation,
       attoparsec,
@@ -190125,8 +190683,8 @@ self: {
     }:
     mkDerivation {
       pname = "diagrams-input";
-      version = "0.1.4";
-      sha256 = "0xmywrx8mc12jzynym9d8aw026agwphygf6n4jmd1mvw9vs0270d";
+      version = "0.1.5";
+      sha256 = "011kvcx3py8dwjx10ddd0z6pm5k76lb2y4mzkfp1nbcy0imkkfyq";
       libraryHaskellDepends = [
         attoparsec
         base
@@ -192501,8 +193059,8 @@ self: {
     }:
     mkDerivation {
       pname = "digraph";
-      version = "0.3.0";
-      sha256 = "0p70978qy83xz14drzk874zghjh3jybgw9a4fp1cfrmpmbdms5df";
+      version = "0.3.2";
+      sha256 = "1662r57g9lapqs6l3rqassa55li2q16v83ay4p41afcsn7119v11";
       libraryHaskellDepends = [
         base
         containers
@@ -200995,8 +201553,8 @@ self: {
     }:
     mkDerivation {
       pname = "dotparse";
-      version = "0.1.2.1";
-      sha256 = "16vadqgm8wka009piypcy77prqlj0961frdldn5shd75kfbp1r0z";
+      version = "0.1.2.2";
+      sha256 = "0zn8vhq76jihraq8brq1h4klx99wsp4qd3ylzr0dzrv1rsiby6vx";
       libraryHaskellDepends = [
         algebraic-graphs
         base
@@ -213146,7 +213704,7 @@ self: {
     }
   ) { };
 
-  "encoding_0_10" = callPackage (
+  "encoding_0_10_2" = callPackage (
     {
       mkDerivation,
       array,
@@ -213163,8 +213721,8 @@ self: {
     }:
     mkDerivation {
       pname = "encoding";
-      version = "0.10";
-      sha256 = "035ma429ppxn69drwddhlkwy72wa9ddad0j0wl7g5xi5i980pmzj";
+      version = "0.10.2";
+      sha256 = "07fclvjvd25cb21j6hakkcrk83f46ri9mkc9qdgllhb5p9zwxdig";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -214350,8 +214908,6 @@ self: {
       ];
       description = "Safe helpers for accessing and modifying environment variables";
       license = lib.licenses.mit;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -215832,6 +216388,10 @@ self: {
       aeson,
       base,
       bytestring,
+      doctest,
+      hedgehog,
+      hspec,
+      hspec-hedgehog,
       http-client,
       http-types,
       network-uri,
@@ -215840,8 +216400,8 @@ self: {
     }:
     mkDerivation {
       pname = "erpnext-api-client";
-      version = "0.1.0.1";
-      sha256 = "01p08sgjpxmg9zq4953m09csg2qy28kp6ffpv042cn5djcdmb1ls";
+      version = "0.2.0.0";
+      sha256 = "02hcskijn2sazmi142vsk4d80fw1jm4rdbs93fq86r7jh6x4r6g0";
       libraryHaskellDepends = [
         aeson
         base
@@ -215852,6 +216412,20 @@ self: {
         text
         time
       ];
+      testHaskellDepends = [
+        aeson
+        base
+        bytestring
+        doctest
+        hedgehog
+        hspec
+        hspec-hedgehog
+        http-client
+        http-types
+        network-uri
+        text
+        time
+      ];
       description = "Generic API client library for ERPNext";
       license = lib.licenses.mit;
     }
@@ -234498,8 +235072,8 @@ self: {
     }:
     mkDerivation {
       pname = "flat-tex";
-      version = "0.8.0";
-      sha256 = "0p5shxpvv15ihbgdvgqwqjq1xz96s5cbflvwb8x7bh5qni8mm3ax";
+      version = "0.8.1";
+      sha256 = "1j6kjs1pl6lbcmkfwdxpa1m3bmb8ja53w9k99pzps5b9amdrcjgv";
       isLibrary = false;
       isExecutable = true;
       executableHaskellDepends = [
@@ -242307,6 +242881,8 @@ self: {
       pname = "free-vector-spaces";
       version = "0.1.5.2";
       sha256 = "0p0flpai3n9ism9dd3kyf1fa8s8rpb4cc00m3bplb9s8zb6aghpb";
+      revision = "1";
+      editedCabalFile = "1b0c7vifxhnm91wzwy10nzjwxd4dv91zx7jcfmr22qflml89blp7";
       libraryHaskellDepends = [
         base
         lens
@@ -242319,8 +242895,6 @@ self: {
       ];
       description = "Instantiate the classes from the vector-space package with types from linear";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -244548,8 +245122,8 @@ self: {
       pname = "ftp-client";
       version = "0.5.1.6";
       sha256 = "0xlrmzngdzg8h7lcb6kaz1zcm3kd1rdax4xs0h048iz7f78q18dg";
-      revision = "1";
-      editedCabalFile = "14pdfmm796mv3qd5y2rq8pj429v31w1d3dlxgyvypjmjh07v87gf";
+      revision = "2";
+      editedCabalFile = "1wskfpp32w1cg48jvwymf4d3z5211zrwk373cymji3h4nww7v3b3";
       libraryHaskellDepends = [
         attoparsec
         base
@@ -246202,8 +246776,8 @@ self: {
     }:
     mkDerivation {
       pname = "fused-effects";
-      version = "1.1.2.4";
-      sha256 = "0ib129qadbjvk6ksf6gy98j43i4dskpzsjys63zcqxcwy66i45yd";
+      version = "1.1.2.5";
+      sha256 = "1jpa9n06pph20hr73rx1shljdk78w4nnv285qsf28iz9mx6ggqvg";
       libraryHaskellDepends = [
         base
         transformers
@@ -250609,8 +251183,8 @@ self: {
     }:
     mkDerivation {
       pname = "generic-arbitrary";
-      version = "1.0.1";
-      sha256 = "1ir95k98w3i7aisw3gjflzaxzgq3qamxw1bssvdbww43sgckw0cj";
+      version = "1.0.1.2";
+      sha256 = "17cpwndcycz9sca00nfpgq8k3p2kf4cjpl7zz2bjdlkw9jvkhh9x";
       libraryHaskellDepends = [
         base
         QuickCheck
@@ -250667,8 +251241,8 @@ self: {
     }:
     mkDerivation {
       pname = "generic-case";
-      version = "0.1.0.0";
-      sha256 = "0fbdic8f3cj7vvj539g4fvsga1cj99awc3qinv491by0gfpvvq2l";
+      version = "0.1.1.0";
+      sha256 = "1sqm7rcn7qc2m46xy8rvz08a47ls1qxyd2aivamskd0zy5kfmmm1";
       libraryHaskellDepends = [
         base
         generics-sop
@@ -253307,6 +253881,8 @@ self: {
       ];
       description = "GenValidity support for URI";
       license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -254244,8 +254820,8 @@ self: {
     }:
     mkDerivation {
       pname = "geoip2";
-      version = "0.4.1.2";
-      sha256 = "1gnwylivkxiiafda6yx7qggafknh2p0b4x8ci7lf412rifj0a4pr";
+      version = "0.4.1.3";
+      sha256 = "14prn5sn10ja8ad3j03fhvhjkgfrrcp9zsz0h266md0hayqlvzg0";
       libraryHaskellDepends = [
         base
         bytestring
@@ -258187,8 +258763,8 @@ self: {
     }:
     mkDerivation {
       pname = "ghc-prof";
-      version = "1.4.1.12";
-      sha256 = "15gshlj8jp85m9y05z1wmssq5rkqyix9890hy1rkmy7nmkhij6mj";
+      version = "1.4.1.13";
+      sha256 = "0g85216s10pm515wi0dl95znq3vdac3zvagizg8vy82zfmsgxwcp";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -259160,8 +259736,8 @@ self: {
     }:
     mkDerivation {
       pname = "ghc-trace-events";
-      version = "0.1.2.9";
-      sha256 = "01fk87z47jf8hm7dahjnfdmg2m26gi00f64va0p8l6rnirzxz9z9";
+      version = "0.1.2.10";
+      sha256 = "0f3lsk1g4d07hw8hzl819wf04wismx4vynln7mq32zkrhqgkx0ph";
       libraryHaskellDepends = [
         base
         bytestring
@@ -262493,8 +263069,8 @@ self: {
     }:
     mkDerivation {
       pname = "gi-gio";
-      version = "2.0.36";
-      sha256 = "03wbzg9xyjn6axkyvah4v5knf06inzfr1n5qd36bnbzffnbqihg9";
+      version = "2.0.37";
+      sha256 = "0a3z1aj1fqnpwxcf27anjcp2wpg3mbn86xybk150260bb00jzxpb";
       setupHaskellDepends = [
         base
         Cabal
@@ -264843,8 +265419,8 @@ self: {
     }:
     mkDerivation {
       pname = "gi-soup3";
-      version = "3.0.4";
-      sha256 = "0llrmd15rvvagq67r1yhxdbrgj8ni94kv1ws4l2ysc728qdiyw06";
+      version = "3.0.5";
+      sha256 = "0g3znkvb2m2bsydwppqybp3j22d2mzkhhas6p3r3h9kfj8qb4510";
       setupHaskellDepends = [
         base
         Cabal
@@ -264981,7 +265557,7 @@ self: {
     }
   ) { vte_291 = pkgs.vte; };
 
-  "gi-vte_2_91_34" = callPackage (
+  "gi-vte_2_91_35" = callPackage (
     {
       mkDerivation,
       base,
@@ -264991,6 +265567,7 @@ self: {
       gi-atk,
       gi-cairo,
       gi-gdk3,
+      gi-gdkpixbuf,
       gi-gio,
       gi-glib,
       gi-gobject,
@@ -265005,14 +265582,15 @@ self: {
     }:
     mkDerivation {
       pname = "gi-vte";
-      version = "2.91.34";
-      sha256 = "0l4sz3v2slj02h434fxv9nkycdvg4ndl6651zawbih19vqlwrn5j";
+      version = "2.91.35";
+      sha256 = "1m2kz8d1bkv4slb3pp7kw5k5fiyligxmn3bvss4gy6y0smhzdmyy";
       setupHaskellDepends = [
         base
         Cabal
         gi-atk
         gi-cairo
         gi-gdk3
+        gi-gdkpixbuf
         gi-gio
         gi-glib
         gi-gobject
@@ -265027,6 +265605,7 @@ self: {
         gi-atk
         gi-cairo
         gi-gdk3
+        gi-gdkpixbuf
         gi-gio
         gi-glib
         gi-gobject
@@ -266261,8 +266840,8 @@ self: {
     }:
     mkDerivation {
       pname = "git-annex";
-      version = "10.20250320";
-      sha256 = "03js1bafx3646h6h6zj0915c2pyjxj22f1nm6bjd34bjffx2di5i";
+      version = "10.20250416";
+      sha256 = "02d4dw7mc72y4lb34nhg4lv0wjns9p8hzx80wqbf2vgsyq7q6zk5";
       configureFlags = [
         "-fassistant"
         "-f-benchmark"
@@ -271110,10 +271689,8 @@ self: {
     }:
     mkDerivation {
       pname = "gloss-rendering";
-      version = "1.13.1.2";
-      sha256 = "0zrdqh72gswyn27x43ifhy4q8m7hvmv24b5ki3hyra5yq74njlsm";
-      revision = "2";
-      editedCabalFile = "107mqdimasvv6vy2r16kk0cz3dqh98m9189q9hd10chk0r5k8ir0";
+      version = "1.13.2.1";
+      sha256 = "06xbbch1gh0rjyawj6x7lw8ig0ph9j13klzsfsxmvv3y7x0px09r";
       libraryHaskellDepends = [
         base
         bmp
@@ -279415,8 +279992,8 @@ self: {
     }:
     mkDerivation {
       pname = "grammatical-parsers";
-      version = "0.7.2";
-      sha256 = "1lmi0rfzrs8jncfrqkdcf6x2ysd1j78wbgiap1dvk8ldp7qd1i95";
+      version = "0.7.2.1";
+      sha256 = "0j1y8bblzpx22nv7ix2c2bz0aw2mjz46lgym4jv65nbgmwqbnwny";
       isLibrary = true;
       isExecutable = true;
       setupHaskellDepends = [
@@ -279427,7 +280004,6 @@ self: {
       libraryHaskellDepends = [
         attoparsec
         base
-        containers
         input-parsers
         monoid-subclasses
         parsers
@@ -279644,6 +280220,7 @@ self: {
       data-default,
       deepseq,
       exceptions,
+      filepath,
       grpc-spec,
       hashable,
       http-types,
@@ -279679,10 +280256,8 @@ self: {
     }:
     mkDerivation {
       pname = "grapesy";
-      version = "1.0.0";
-      sha256 = "1vrb4xb57j5bpzrhzipnw454yb5hpdyl64c2pnl0gdh79c053vvm";
-      revision = "1";
-      editedCabalFile = "146jyzlqdppdshkjqc2k7wjfs0awil5n3b1m17dcsiis8fslnj6n";
+      version = "1.0.1";
+      sha256 = "1iplb4pvbqrpqdd6vbafd01drxyfinbrjq0w74w8rjzs4h7ag9wp";
       enableSeparateDataOutput = true;
       libraryHaskellDepends = [
         aeson
@@ -279726,6 +280301,7 @@ self: {
         containers
         deepseq
         exceptions
+        filepath
         grpc-spec
         http-types
         http2
@@ -281711,6 +282287,8 @@ self: {
       pname = "greencard";
       version = "3.0.4.2";
       sha256 = "1vl9p6mqss5r4jfqnjir7m1q7fhh9f204c99qd5y5d0j7yc26r5y";
+      revision = "1";
+      editedCabalFile = "1scqpjhrv0sqbyrri78jj3jqjw24nv0as3p869ljrrpipxcwxlpp";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [ base ];
@@ -282672,7 +283250,7 @@ self: {
     }
   ) { };
 
-  "grisette_0_11_0_0" = callPackage (
+  "grisette_0_12_0_0" = callPackage (
     {
       mkDerivation,
       array,
@@ -282712,8 +283290,8 @@ self: {
     }:
     mkDerivation {
       pname = "grisette";
-      version = "0.11.0.0";
-      sha256 = "1fc1qdpq748fm3q61i1shpq0ksvnpz4zf7a5ph2gxgd49d7m0j3y";
+      version = "0.12.0.0";
+      sha256 = "0dcwbc53321jg6jfmsr72kmsx8w7c6x9aq4yllwfvbzh092ljlib";
       libraryHaskellDepends = [
         array
         async
@@ -284211,6 +284789,20 @@ self: {
     }
   ) { };
 
+  "gruvbox-colors" = callPackage (
+    { mkDerivation, base }:
+    mkDerivation {
+      pname = "gruvbox-colors";
+      version = "0.1.0.0";
+      sha256 = "0if8kvwx51bwsdkwpk9ardmlm9l5v91vfy4g3bj2gmd3184nw6la";
+      libraryHaskellDepends = [ base ];
+      description = "Gruvbox colors for use in Haskell";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
+    }
+  ) { };
+
   "gsasl" = callPackage (
     {
       mkDerivation,
@@ -286412,12 +287004,11 @@ self: {
       network,
       quic,
       tls,
-      unliftio,
     }:
     mkDerivation {
       pname = "h3spec";
-      version = "0.1.11";
-      sha256 = "0h519wf2a9swgi695ynydvfcrmmbr70kin49qk04a4nx9b4lcln1";
+      version = "0.1.12";
+      sha256 = "0f62kj6676mwiynlih3xzzr836qjcln8gsy070fn4cpkdyx7m33w";
       isLibrary = false;
       isExecutable = true;
       executableHaskellDepends = [
@@ -286430,10 +287021,10 @@ self: {
         network
         quic
         tls
-        unliftio
       ];
       description = "QUIC";
       license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
       mainProgram = "h3spec";
     }
   ) { };
@@ -290991,9 +291582,7 @@ self: {
       ];
       description = "A service for pull-based continuous deployment based on hydra";
       license = lib.licenses.asl20;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "hail";
-      broken = true;
     }
   ) { };
 
@@ -301288,8 +301877,8 @@ self: {
         }:
         mkDerivation {
           pname = "haskell-gi";
-          version = "0.26.14";
-          sha256 = "1cz429xlbw7aszqz9dygy31vv0bckdxz14qlwqm57vkdd6j7gv00";
+          version = "0.26.15";
+          sha256 = "07lpd31j582czgvrivyh0fp3bbjmhvqicgy47pv2j69x450q2wsa";
           setupHaskellDepends = [
             base
             Cabal
@@ -302310,8 +302899,8 @@ self: {
     }:
     mkDerivation {
       pname = "haskell-names";
-      version = "0.9.9";
-      sha256 = "0gqh7whzzcg46c262yf610g781ach3p8458kwf3mmf1pyhjrj7hm";
+      version = "0.9.9.1";
+      sha256 = "041dlfwxa68hlakad9p431adndjm9n3890zsbym14czygksznwzx";
       enableSeparateDataOutput = true;
       libraryHaskellDepends = [
         aeson
@@ -309256,7 +309845,7 @@ self: {
     }
   ) { };
 
-  "hasql_1_9_1_1" = callPackage (
+  "hasql_1_9_1_2" = callPackage (
     {
       mkDerivation,
       aeson,
@@ -309294,8 +309883,8 @@ self: {
     }:
     mkDerivation {
       pname = "hasql";
-      version = "1.9.1.1";
-      sha256 = "0wv3mpvv35nl7va34487naybxni3l588wpnfkgwlknfcv3qq4cg0";
+      version = "1.9.1.2";
+      sha256 = "0z8hadc22nx2yxbp9m5yvlz72rsbagwx676h29nh3cagaz7a9swi";
       libraryHaskellDepends = [
         aeson
         attoparsec
@@ -310234,7 +310823,7 @@ self: {
     }
   ) { };
 
-  "hasql-pool_1_3" = callPackage (
+  "hasql-pool_1_3_0_1" = callPackage (
     {
       mkDerivation,
       async,
@@ -310251,8 +310840,8 @@ self: {
     }:
     mkDerivation {
       pname = "hasql-pool";
-      version = "1.3";
-      sha256 = "0zi2sv8pv2vg3ga1pngf71cmzfam5aw3l5mkm18cwsa0z6zk7ksq";
+      version = "1.3.0.1";
+      sha256 = "0rvj241z6adnkrkr5yfr0k8ngxqylsl85kjcka6mn05m4swplsfz";
       libraryHaskellDepends = [
         base
         bytestring
@@ -312183,8 +312772,8 @@ self: {
     }:
     mkDerivation {
       pname = "haxl";
-      version = "2.5.1.0";
-      sha256 = "15psynsr61ahcmmm06lcprl47l271nqw2h0kwkahs6jy00l7ymhb";
+      version = "2.5.1.1";
+      sha256 = "1paqg3yggvama25nsfpm656rhj3d23kcapd609pgikh9bbjr8syg";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -317300,6 +317889,41 @@ self: {
     }
   ) { };
 
+  "heftia_0_6_0_0" = callPackage (
+    {
+      mkDerivation,
+      base,
+      data-effects,
+      mtl,
+      tasty,
+      tasty-discover,
+      tasty-hunit,
+      unliftio,
+    }:
+    mkDerivation {
+      pname = "heftia";
+      version = "0.6.0.0";
+      sha256 = "18nvp0zcdwi9zf2w1zz60zn4iy78mjy9zqnw6156kz8bwpi8vbda";
+      revision = "1";
+      editedCabalFile = "0abcmwiwqik19fc8h5z0ijpw2fmygfkkyx44wddq26gd3kh89wid";
+      libraryHaskellDepends = [
+        base
+        data-effects
+        mtl
+        unliftio
+      ];
+      testHaskellDepends = [
+        base
+        tasty
+        tasty-hunit
+      ];
+      testToolDepends = [ tasty-discover ];
+      description = "higher-order algebraic effects done right";
+      license = lib.licenses.mpl20;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "heftia-effects" = callPackage (
     {
       mkDerivation,
@@ -317417,6 +318041,116 @@ self: {
     }
   ) { eff = null; };
 
+  "heftia-effects_0_6_0_1" = callPackage (
+    {
+      mkDerivation,
+      base,
+      bytestring,
+      co-log-core,
+      containers,
+      data-effects,
+      eff,
+      effectful,
+      eveff,
+      filepath,
+      freer-simple,
+      fused-effects,
+      heftia,
+      hspec,
+      logict,
+      mpeff,
+      mtl,
+      polysemy,
+      process,
+      tasty,
+      tasty-bench,
+      tasty-discover,
+      tasty-hspec,
+      text,
+      time,
+      unbounded-delays,
+      unliftio,
+    }:
+    mkDerivation {
+      pname = "heftia-effects";
+      version = "0.6.0.1";
+      sha256 = "0jdxprqjz2x7g9sa6szvh8bs54kqmmgaacqfwr7jsydnjsdmbayq";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        base
+        bytestring
+        co-log-core
+        containers
+        data-effects
+        heftia
+        process
+        text
+        time
+        unbounded-delays
+        unliftio
+      ];
+      executableHaskellDepends = [
+        base
+        bytestring
+        co-log-core
+        containers
+        data-effects
+        filepath
+        heftia
+        process
+        text
+        time
+        unbounded-delays
+        unliftio
+      ];
+      testHaskellDepends = [
+        base
+        bytestring
+        co-log-core
+        containers
+        data-effects
+        heftia
+        hspec
+        process
+        tasty
+        tasty-hspec
+        text
+        time
+        unbounded-delays
+        unliftio
+      ];
+      testToolDepends = [ tasty-discover ];
+      benchmarkHaskellDepends = [
+        base
+        bytestring
+        co-log-core
+        containers
+        data-effects
+        eff
+        effectful
+        eveff
+        freer-simple
+        fused-effects
+        heftia
+        logict
+        mpeff
+        mtl
+        polysemy
+        process
+        tasty-bench
+        text
+        time
+        unbounded-delays
+        unliftio
+      ];
+      description = "higher-order algebraic effects done right";
+      license = lib.licenses.mpl20;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
+    }
+  ) { eff = null; };
+
   "hegg" = callPackage (
     {
       mkDerivation,
@@ -323667,8 +324401,8 @@ self: {
     }:
     mkDerivation {
       pname = "hhp";
-      version = "1.0.2";
-      sha256 = "1ssgxdk087h1j8sg1f28vsy64c8aipmr02f3rbhdxjmxf2z7jgim";
+      version = "1.0.3";
+      sha256 = "059a5j39l0mmk5wc9zird3jz1zsrpgk5h8zxbn18w9i9zpmlbwlc";
       isLibrary = true;
       isExecutable = true;
       enableSeparateDataOutput = true;
@@ -324279,8 +325013,8 @@ self: {
       pname = "hie-compat";
       version = "0.3.1.2";
       sha256 = "0m0520z20qd3vxh047izb140jbywnhi20i9av7gf6h8f8486cs0m";
-      revision = "1";
-      editedCabalFile = "03yidgx0vbw5jy1193lqb9yhc97z1hbwsfa92dkndh73j1d5ia3l";
+      revision = "2";
+      editedCabalFile = "0pljzwzj9szs7ynk8avfzy9wwphvm1jh3dl0zcid44bvkg15x863";
       libraryHaskellDepends = [
         array
         base
@@ -324445,8 +325179,8 @@ self: {
     }:
     mkDerivation {
       pname = "hiedb";
-      version = "0.6.0.1";
-      sha256 = "0pvbxjhwqd7abvb5j23ynlg0rsqc09c0vq915drb52cilbs46fcn";
+      version = "0.6.0.2";
+      sha256 = "0sfxykvg5n44lpjj069j25pnff30ckby8k3n7yhp8ixajfnfrb5i";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -327662,6 +328396,9 @@ self: {
       incipit-base,
       lens,
       lens-regex-pcre,
+      monad-control,
+      network,
+      network-uri,
       optparse-applicative,
       path,
       path-io,
@@ -327669,6 +328406,7 @@ self: {
       random,
       tasty,
       tasty-hedgehog,
+      template-haskell,
       these,
       time,
       transformers,
@@ -327677,8 +328415,8 @@ self: {
     }:
     mkDerivation {
       pname = "hix";
-      version = "0.8.0";
-      sha256 = "014rbcbg99zz9a5095avrpcqzdqarifha9jaw7hwcbpxlxs1i3jn";
+      version = "0.9.1";
+      sha256 = "1vqlswkw63spi7lwdcsqcijz2lrihsghapr1wmxaa67vjf7hz3il";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -327696,17 +328434,24 @@ self: {
         filepattern
         generic-lens
         generics-sop
+        hedgehog
         http-client
         http-client-tls
         http-types
         incipit-base
         lens
         lens-regex-pcre
+        monad-control
+        network
+        network-uri
         optparse-applicative
         path
         path-io
         pretty
         random
+        tasty
+        tasty-hedgehog
+        template-haskell
         these
         time
         transformers
@@ -327727,11 +328472,14 @@ self: {
         incipit-base
         path
         path-io
+        pretty
         tasty
         tasty-hedgehog
         these
+        time
         transformers
       ];
+      doHaddock = false;
       description = "Haskell/Nix development build tools";
       license = "BSD-2-Clause-Patent";
       hydraPlatforms = lib.platforms.none;
@@ -328853,6 +329601,8 @@ self: {
       pname = "hledger";
       version = "1.42.1";
       sha256 = "0cw2v3ckg3b90d7xkq7mjwb1pr7z5js9qb3bm2i9mz7284aqzn3q";
+      revision = "1";
+      editedCabalFile = "1i422nwlp4pab9c4pi0vrdmnc52znxwd7pyd1173gk6jkkkvqg7n";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -329564,6 +330314,8 @@ self: {
       pname = "hledger-lib";
       version = "1.42.1";
       sha256 = "0c59vxi9w809vhw0gzpkl8iv0qbd6wv5xq6lvllxz0y7axkw7vnl";
+      revision = "1";
+      editedCabalFile = "1lpnp61hfscjx01krypqlm08zsjgxgwd400wphg70yk7ay4zg981";
       libraryHaskellDepends = [
         aeson
         aeson-pretty
@@ -329913,6 +330665,8 @@ self: {
       pname = "hledger-ui";
       version = "1.42.1";
       sha256 = "1grj5j2lndyxzbfbr9mp29qy2l4gs7pcqgbmrkdb2l8qcdm83nwm";
+      revision = "1";
+      editedCabalFile = "0db3yzr818m458ddlfkhbypsyjfkgmlbqyl9vyqdmvklxlnap0j5";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -330168,6 +330922,8 @@ self: {
       pname = "hledger-web";
       version = "1.42.1";
       sha256 = "13z1fzvfdacdcaabhc68ic93rbh2kw983nhcm7jzkipnp559lvnj";
+      revision = "1";
+      editedCabalFile = "1mf2g5j8jqfdnvs1qnq58bb2d6yzi9bc3kh0zz00f0wbqhwiih30";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -335234,6 +335990,29 @@ self: {
     }
   ) { };
 
+  "hoare" = callPackage (
+    {
+      mkDerivation,
+      async,
+      base,
+      deepseq,
+      stm,
+    }:
+    mkDerivation {
+      pname = "hoare";
+      version = "0.1.0.0";
+      sha256 = "1xc49mfp7j9fk28xfn2w23ka6yx6rid453mfxh80ix1hzngyww4k";
+      libraryHaskellDepends = [
+        async
+        base
+        deepseq
+        stm
+      ];
+      description = "Simple tools for communicating sequential processes";
+      license = lib.licenses.zlib;
+    }
+  ) { };
+
   "hoauth" = callPackage (
     {
       mkDerivation,
@@ -340145,6 +340924,139 @@ self: {
     }
   ) { };
 
+  "hpack_0_38_1" = callPackage (
+    {
+      mkDerivation,
+      aeson,
+      base,
+      bifunctors,
+      bytestring,
+      Cabal,
+      containers,
+      crypton,
+      deepseq,
+      directory,
+      filepath,
+      Glob,
+      hspec,
+      hspec-discover,
+      http-client,
+      http-client-tls,
+      http-types,
+      HUnit,
+      infer-license,
+      interpolate,
+      mockery,
+      mtl,
+      pretty,
+      QuickCheck,
+      scientific,
+      template-haskell,
+      temporary,
+      text,
+      transformers,
+      unordered-containers,
+      vcr,
+      vector,
+      yaml,
+    }:
+    mkDerivation {
+      pname = "hpack";
+      version = "0.38.1";
+      sha256 = "03qygb51jb4r6sg2bkaz7k80h11wgjr27hgpx6h08xm8axdk2gba";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        aeson
+        base
+        bifunctors
+        bytestring
+        Cabal
+        containers
+        crypton
+        deepseq
+        directory
+        filepath
+        Glob
+        http-client
+        http-client-tls
+        http-types
+        infer-license
+        mtl
+        pretty
+        scientific
+        text
+        transformers
+        unordered-containers
+        vector
+        yaml
+      ];
+      executableHaskellDepends = [
+        aeson
+        base
+        bifunctors
+        bytestring
+        Cabal
+        containers
+        crypton
+        deepseq
+        directory
+        filepath
+        Glob
+        http-client
+        http-client-tls
+        http-types
+        infer-license
+        mtl
+        pretty
+        scientific
+        text
+        transformers
+        unordered-containers
+        vector
+        yaml
+      ];
+      testHaskellDepends = [
+        aeson
+        base
+        bifunctors
+        bytestring
+        Cabal
+        containers
+        crypton
+        deepseq
+        directory
+        filepath
+        Glob
+        hspec
+        http-client
+        http-client-tls
+        http-types
+        HUnit
+        infer-license
+        interpolate
+        mockery
+        mtl
+        pretty
+        QuickCheck
+        scientific
+        template-haskell
+        temporary
+        text
+        transformers
+        unordered-containers
+        vcr
+        vector
+        yaml
+      ];
+      testToolDepends = [ hspec-discover ];
+      description = "A modern format for Haskell packages";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+      mainProgram = "hpack";
+    }
+  ) { };
+
   "hpack-convert" = callPackage (
     {
       mkDerivation,
@@ -344379,10 +345291,8 @@ self: {
     }:
     mkDerivation {
       pname = "hs-opentelemetry-instrumentation-auto";
-      version = "0.1.0.1";
-      sha256 = "00qsmldcn20c5vsy617w0kcn4dw0l730n74bdrp2acv1jpppaa4v";
-      revision = "1";
-      editedCabalFile = "0paa6p9w4ryr35dandqna53p56jsv3cgkw3dcw4f66j0bgaw2jgw";
+      version = "0.1.0.2";
+      sha256 = "1w4xq79phbbhjjp9q5pj7wlsdp0nrlfdhqpc9yh0vlaqag93cc6d";
       libraryHaskellDepends = [
         base
         bytestring
@@ -346820,6 +347730,8 @@ self: {
       pname = "hsblst";
       version = "0.0.4";
       sha256 = "13dlz8am20np31bq31z596yam6w1rb0fdzlg3zwwvm6wyjh6b8sg";
+      revision = "1";
+      editedCabalFile = "1cwplg9k8pr6iy27gkc32ayxnwf63sbzdd660p1lm8dihvj9q1jy";
       libraryHaskellDepends = [
         base
         deepseq
@@ -356677,8 +357589,8 @@ self: {
     }:
     mkDerivation {
       pname = "html-parse";
-      version = "0.2.1.0";
-      sha256 = "1vjy8bmxg0dsmq74hahmn1mkkgf7jm5qwhcfc8bsmm82c6jg08xx";
+      version = "0.2.2.0";
+      sha256 = "0dhwz7mx7y0pb2jqrx0pa8qdl0s3m77qjacyx6ih15xy39a4xn5z";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -357634,10 +358546,8 @@ self: {
     }:
     mkDerivation {
       pname = "http-api-data";
-      version = "0.6.1";
-      sha256 = "1kz3qjjazl61q7iad6q67zdsm2gynsjdfcn34rzmybjhq27wylas";
-      revision = "1";
-      editedCabalFile = "0gw1hahhc5pyagvmvbpwqbm7sqpyfccy59p249jrmz667hsz92g3";
+      version = "0.6.2";
+      sha256 = "0d42xkm60i3irxcvwixvn5c01paz2kpfsz29vhxz08ir83zsk16w";
       libraryHaskellDepends = [
         base
         bytestring
@@ -359343,6 +360253,7 @@ self: {
       errors,
       hspec,
       hspec-attoparsec,
+      hspec-discover,
       http-api-data,
       network-uri,
       QuickCheck,
@@ -359351,8 +360262,8 @@ self: {
     }:
     mkDerivation {
       pname = "http-link-header";
-      version = "1.2.2";
-      sha256 = "1ix1k35x2cxzjvbywkpz8c0w6mmhp6hj235ch8rmc64lsff6x1hc";
+      version = "1.2.3";
+      sha256 = "1fycx3ba06r0dhjnab9grikc7f61c4dbz1mgnw4l7ymhyyqwrchg";
       libraryHaskellDepends = [
         attoparsec
         base
@@ -359369,11 +360280,13 @@ self: {
         errors
         hspec
         hspec-attoparsec
+        hspec-discover
         http-api-data
         network-uri
         QuickCheck
         text
       ];
+      testToolDepends = [ hspec-discover ];
       benchmarkHaskellDepends = [
         attoparsec
         base
@@ -360819,6 +361732,7 @@ self: {
       testToolDepends = [ hspec-discover ];
       description = "HTTP/3 library";
       license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -373065,6 +373979,146 @@ self: {
     }
   ) { };
 
+  "immutaball-core" = callPackage (
+    {
+      mkDerivation,
+      array,
+      async,
+      base,
+      bytestring,
+      containers,
+      curl,
+      directory,
+      filepath,
+      gl,
+      HUnit,
+      i18n,
+      JuicyPixels,
+      lens,
+      libvorbis,
+      mtl,
+      OpenGL,
+      parallel,
+      parsec,
+      pipes,
+      prettyprinter,
+      QuickCheck,
+      sdl2,
+      sdl2-ttf,
+      stm,
+      tasty,
+      tasty-hunit,
+      tasty-quickcheck,
+      text,
+      time,
+      transformers,
+      unbounded-delays,
+      wires,
+    }:
+    mkDerivation {
+      pname = "immutaball-core";
+      version = "0.1.0.4.1";
+      sha256 = "136vbcyywfyl2kafpygz1iwv5yahlzxhj9y07wsz3dch90x0lail";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        array
+        async
+        base
+        bytestring
+        containers
+        curl
+        directory
+        filepath
+        gl
+        i18n
+        JuicyPixels
+        lens
+        libvorbis
+        mtl
+        OpenGL
+        parallel
+        parsec
+        pipes
+        prettyprinter
+        sdl2
+        sdl2-ttf
+        stm
+        text
+        time
+        transformers
+        unbounded-delays
+        wires
+      ];
+      executableHaskellDepends = [
+        array
+        async
+        base
+        bytestring
+        containers
+        curl
+        directory
+        filepath
+        gl
+        i18n
+        JuicyPixels
+        lens
+        libvorbis
+        mtl
+        OpenGL
+        parallel
+        parsec
+        pipes
+        prettyprinter
+        sdl2
+        sdl2-ttf
+        stm
+        text
+        time
+        transformers
+        unbounded-delays
+        wires
+      ];
+      testHaskellDepends = [
+        array
+        async
+        base
+        bytestring
+        containers
+        curl
+        directory
+        filepath
+        gl
+        HUnit
+        i18n
+        JuicyPixels
+        lens
+        libvorbis
+        mtl
+        OpenGL
+        parallel
+        parsec
+        pipes
+        prettyprinter
+        QuickCheck
+        sdl2
+        sdl2-ttf
+        stm
+        tasty
+        tasty-hunit
+        tasty-quickcheck
+        text
+        time
+        transformers
+        unbounded-delays
+        wires
+      ];
+      description = "Immutaball platformer game";
+      license = lib.licenses.bsd0;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "imp" = callPackage (
     {
       mkDerivation,
@@ -376763,7 +377817,7 @@ self: {
       inline-c,
       primitive,
       process,
-      python3-embed,
+      python3,
       quickcheck-instances,
       stm,
       tasty,
@@ -376797,7 +377851,7 @@ self: {
         transformers
         vector
       ];
-      libraryPkgconfigDepends = [ python3-embed ];
+      libraryPkgconfigDepends = [ python3 ];
       testHaskellDepends = [
         base
         tasty
@@ -376810,10 +377864,8 @@ self: {
       doHaddock = false;
       description = "Python interpreter embedded into haskell";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
-  ) { python3-embed = null; };
+  ) { inherit (pkgs) python3; };
 
   "inline-r" = callPackage (
     {
@@ -380205,8 +381257,8 @@ self: {
       pname = "invertible-grammar";
       version = "0.1.3.5";
       sha256 = "01g4lf31hgv8dqabmabkp6zld6v2l3a2mv9wcgyfxghfrd6dspdw";
-      revision = "1";
-      editedCabalFile = "04xlxfqhyapb2wzzzfvzk6pr11w4rfqyi1axvsk1mxlrihyvl6yy";
+      revision = "2";
+      editedCabalFile = "1w61hp5rsgp8lgfmaik3r8iqbhsq9hlb7bm5j9sfnlfv0j57ba4g";
       libraryHaskellDepends = [
         base
         bifunctors
@@ -382477,8 +383529,8 @@ self: {
     }:
     mkDerivation {
       pname = "iri";
-      version = "0.5.1";
-      sha256 = "0r1isflm644d823vwimrcmh4s8ash84gi4hgav1gxgiryw9j013n";
+      version = "0.5.1.1";
+      sha256 = "1xyndxzdqpbmwv8f86jlin22snddcm769m84d29sb9dkhyi6hncd";
       libraryHaskellDepends = [
         attoparsec
         base
@@ -382507,8 +383559,10 @@ self: {
         tasty-hunit
       ];
       doHaddock = false;
-      description = "RFC-based resource identifier library";
+      description = "RFC-compliant universal resource identifier library (URL, URI, IRI)";
       license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -383287,13 +384341,14 @@ self: {
       tasty,
       tasty-quickcheck,
       text,
+      time,
       unordered-containers,
       vector,
     }:
     mkDerivation {
       pname = "isomorphism-class";
-      version = "0.3.0.1";
-      sha256 = "13jshr62x7wsj9bgwid8qbzig4svis5xk286c774k34k74vd4qy1";
+      version = "0.3.1.2";
+      sha256 = "0zsjpvxv6j81idqi8g18bahx24rp1y78p2g48yikr3lbbgjwlcic";
       libraryHaskellDepends = [
         base
         bytestring
@@ -383303,6 +384358,7 @@ self: {
         profunctors
         QuickCheck
         text
+        time
         unordered-containers
         vector
       ];
@@ -383316,7 +384372,7 @@ self: {
         tasty-quickcheck
         text
       ];
-      description = "Isomorphism typeclass solving the conversion problem";
+      description = "Isomorphism typeclass as a lawful solution to the conversion problem";
       license = lib.licenses.mit;
     }
   ) { };
@@ -390436,8 +391492,8 @@ self: {
     }:
     mkDerivation {
       pname = "json-spec";
-      version = "1.1.1.1";
-      sha256 = "0mdg820v9nm5aij4c5w2fnzzssni9nkki7vsnhx7nd03gsnfmrfv";
+      version = "1.1.1.2";
+      sha256 = "1wg7g94mss8bjx65xgnpz1d2rm9a68q6lnprwclmhjcrk91lfw7l";
       libraryHaskellDepends = [
         aeson
         base
@@ -390477,8 +391533,8 @@ self: {
     }:
     mkDerivation {
       pname = "json-spec-elm";
-      version = "0.4.0.5";
-      sha256 = "17gna98c9x3zf7pc3yc1908si1v5l7vy5avrpc2gkdwnjaq6daq6";
+      version = "0.4.0.6";
+      sha256 = "1kr3j1lijki5v54gq71c1qm2ina2nsk26msxix4w9z8dg66nk6xr";
       libraryHaskellDepends = [
         base
         bound
@@ -390576,7 +391632,7 @@ self: {
     }
   ) { };
 
-  "json-spec-elm-servant_0_4_4_0" = callPackage (
+  "json-spec-elm-servant_0_4_4_1" = callPackage (
     {
       mkDerivation,
       aeson,
@@ -390604,8 +391660,8 @@ self: {
     }:
     mkDerivation {
       pname = "json-spec-elm-servant";
-      version = "0.4.4.0";
-      sha256 = "0gg7658hb9nvk2s6qny53xs2brj2797rp5n69h66r2wwlxlrf6l9";
+      version = "0.4.4.1";
+      sha256 = "0236nyzixcj5z10kmmdxhdzb9gmaczjk0p9icgyh972zm6ql00l0";
       libraryHaskellDepends = [
         base
         bound
@@ -390668,8 +391724,8 @@ self: {
     }:
     mkDerivation {
       pname = "json-spec-openapi";
-      version = "1.0.1.0";
-      sha256 = "1hq9sbb94qkaakvhrxnmvwxkw9mgdyq5krxfjasg4yl3ic4f0alk";
+      version = "1.0.1.1";
+      sha256 = "0vk9m76ga1706b9r4ggpfk7f11jpv22mhibqxd7vqfbi3iffm2ys";
       libraryHaskellDepends = [
         aeson
         base
@@ -391715,28 +392771,26 @@ self: {
     {
       mkDerivation,
       aeson,
-      ansi-wl-pprint,
       base,
       binary,
       bytestring,
       containers,
       data-fix,
-      deriving-compat,
       directory,
       exceptions,
       filepath,
-      hashable,
+      hedgehog,
       lens,
       megaparsec,
       mtl,
       optparse-applicative,
       parser-combinators,
+      prettyprinter,
       scientific,
-      semigroupoids,
       tasty,
       tasty-bench,
       tasty-golden,
-      tasty-hunit,
+      tasty-hedgehog,
       template-haskell,
       text,
       th-lift-instances,
@@ -391748,29 +392802,26 @@ self: {
     }:
     mkDerivation {
       pname = "jsonnet";
-      version = "0.3.1.1";
-      sha256 = "021kklj3ycpm5n2r6bjqc0vicn9vdv5a56sd1la6pf430i1fd7z9";
+      version = "0.4.0.0";
+      sha256 = "1a9hn0mnwya2i8d513yw59n90racqr5zyyvy9f5vncwkxb6j7yvz";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
         aeson
-        ansi-wl-pprint
         base
         binary
         bytestring
         containers
         data-fix
-        deriving-compat
         directory
         exceptions
         filepath
-        hashable
         lens
         megaparsec
         mtl
         parser-combinators
+        prettyprinter
         scientific
-        semigroupoids
         template-haskell
         text
         th-lift-instances
@@ -391782,28 +392833,29 @@ self: {
       ];
       executableHaskellDepends = [
         aeson
-        ansi-wl-pprint
         base
         bytestring
-        mtl
+        megaparsec
         optparse-applicative
         text
       ];
       testHaskellDepends = [
-        ansi-wl-pprint
         base
         bytestring
+        containers
+        data-fix
         filepath
-        mtl
+        hedgehog
+        prettyprinter
         tasty
         tasty-golden
-        tasty-hunit
+        tasty-hedgehog
         text
       ];
       benchmarkHaskellDepends = [
-        ansi-wl-pprint
         base
         bytestring
+        prettyprinter
         tasty-bench
         text
       ];
@@ -391815,6 +392867,57 @@ self: {
     }
   ) { };
 
+  "jsonpatch" = callPackage (
+    {
+      mkDerivation,
+      aeson,
+      aeson-optics,
+      aeson-pretty,
+      aeson-qq,
+      base,
+      bytestring,
+      hspec,
+      hspec-expectations-json,
+      markdown-unlit,
+      optics-core,
+      path,
+      text,
+      vector,
+    }:
+    mkDerivation {
+      pname = "jsonpatch";
+      version = "0.3.0.1";
+      sha256 = "0ycszkiij85j1hymq3v7g8pyjqam6g3cphar0yvdhy00xfda2wxd";
+      libraryHaskellDepends = [
+        aeson
+        aeson-optics
+        base
+        bytestring
+        optics-core
+        text
+        vector
+      ];
+      testHaskellDepends = [
+        aeson
+        aeson-optics
+        aeson-pretty
+        aeson-qq
+        base
+        bytestring
+        hspec
+        hspec-expectations-json
+        markdown-unlit
+        optics-core
+        path
+        text
+        vector
+      ];
+      testToolDepends = [ markdown-unlit ];
+      description = "JSON Patch parsing and application";
+      license = lib.licenses.agpl3Only;
+    }
+  ) { };
+
   "jsonpath" = callPackage (
     {
       mkDerivation,
@@ -398872,13 +399975,14 @@ self: {
       rio,
       template-haskell,
       time,
+      transformers,
       unix,
       unliftio,
     }:
     mkDerivation {
       pname = "kmonad";
-      version = "0.4.3";
-      sha256 = "1wd55wx24sbgyq5laibmgn1agdq69333s9j7n44hs47a7hfxdvlv";
+      version = "0.4.4";
+      sha256 = "1jyxsg0pj5slvz86d3jpfmrg4im678fw4abidjfy7qnhd4gid2dl";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -398892,6 +399996,7 @@ self: {
         rio
         template-haskell
         time
+        transformers
         unix
         unliftio
       ];
@@ -403481,6 +404586,65 @@ self: {
     }
   ) { };
 
+  "langchain-hs" = callPackage (
+    {
+      mkDerivation,
+      aeson,
+      base,
+      bytestring,
+      containers,
+      directory,
+      filepath,
+      http-conduit,
+      http-types,
+      ollama-haskell,
+      pdf-toolbox-document,
+      scalpel,
+      tasty,
+      tasty-hunit,
+      temporary,
+      text,
+    }:
+    mkDerivation {
+      pname = "langchain-hs";
+      version = "0.0.1.0";
+      sha256 = "10i1xk5zi9dmbw86zi3fkanqgwdzkb6kgyr5bccjfjhrizb8c933";
+      libraryHaskellDepends = [
+        aeson
+        base
+        bytestring
+        containers
+        directory
+        http-conduit
+        http-types
+        ollama-haskell
+        pdf-toolbox-document
+        scalpel
+        text
+      ];
+      testHaskellDepends = [
+        aeson
+        base
+        bytestring
+        containers
+        directory
+        filepath
+        http-conduit
+        http-types
+        ollama-haskell
+        pdf-toolbox-document
+        scalpel
+        tasty
+        tasty-hunit
+        temporary
+        text
+      ];
+      description = "Haskell implementation of Langchain";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "language-Modula2" = callPackage (
     {
       mkDerivation,
@@ -406916,10 +408080,8 @@ self: {
     }:
     mkDerivation {
       pname = "lapack-comfort-array";
-      version = "0.0.1";
-      sha256 = "1p4vfw95qnd48cbizncb7b7fgzkxbv7r3rp3ffw6r11wymhm67q0";
-      revision = "1";
-      editedCabalFile = "0z80pnn3fpbfbrxmv2n3gwwwlny4a9hgnivd0b8i25q1agyprzcs";
+      version = "0.0.1.1";
+      sha256 = "04ls07alcsbnghrgvprgz81yv8v6xkpv392c18qyjfwfdv0hdg0j";
       libraryHaskellDepends = [
         base
         comfort-array
@@ -406977,10 +408139,8 @@ self: {
     }:
     mkDerivation {
       pname = "lapack-ffi-tools";
-      version = "0.1.3.1";
-      sha256 = "1mf41wcbxkgiv71c3jjwhsdg9d7qpa88qsifpa5vgplpx2v1p6ya";
-      revision = "3";
-      editedCabalFile = "19xnq84gw4937zhmj2h8nlrlsikni7qjdm2dbljl1qv68cjs3gjz";
+      version = "0.1.3.2";
+      sha256 = "0y30qwxzbggn3aqr437j3bi1yfa1fpdq96xq7vxbi1fnll8a9432";
       isLibrary = false;
       isExecutable = true;
       enableSeparateDataOutput = true;
@@ -408297,8 +409457,8 @@ self: {
     }:
     mkDerivation {
       pname = "lawful-conversions";
-      version = "0.1.6";
-      sha256 = "1gp4z8g5smnhi31h4cpniha5g1lha6hh5rhh7cv1cwkrzh0cmkbg";
+      version = "0.1.6.1";
+      sha256 = "18dp73b63wvzznvk1v47jxalpbfc9zjh184p88pjrjq3y6m514dg";
       libraryHaskellDepends = [
         base
         bytestring
@@ -410978,6 +412138,7 @@ self: {
       description = "Instances to mix lens with Accelerate";
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -415409,22 +416570,22 @@ self: {
     {
       mkDerivation,
       base,
-      c2hs,
+      cpphs,
       libvirt,
       syb,
       unix,
     }:
     mkDerivation {
       pname = "libvirt-hs";
-      version = "0.2.2";
-      sha256 = "1zrc7z0v3zarmbfhasv1mk2wcyhg8azhdpk7q4aayhrb9hcq3i0n";
+      version = "0.2.3";
+      sha256 = "07bpi4339g6848kvz42ii11w412qih1r52csjn5ppdxhj3dm8924";
       libraryHaskellDepends = [
         base
         syb
         unix
       ];
       libraryPkgconfigDepends = [ libvirt ];
-      libraryToolDepends = [ c2hs ];
+      libraryToolDepends = [ cpphs ];
       description = "FFI bindings to libvirt virtualization API (http://libvirt.org)";
       license = lib.licenses.bsd3;
       badPlatforms = lib.platforms.darwin;
@@ -417313,6 +418474,7 @@ self: {
       description = "Lifting linear vector spaces into Accelerate";
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -417428,6 +418590,83 @@ self: {
     }
   ) { };
 
+  "linear-base_0_5_0" = callPackage (
+    {
+      mkDerivation,
+      base,
+      containers,
+      deepseq,
+      ghc-bignum,
+      ghc-prim,
+      hashable,
+      hashtables,
+      hedgehog,
+      inspection-testing,
+      linear-generics,
+      mmorph,
+      MonadRandom,
+      primitive,
+      random,
+      random-shuffle,
+      storable-tuple,
+      tasty,
+      tasty-bench,
+      tasty-hedgehog,
+      tasty-inspection-testing,
+      text,
+      transformers,
+      unordered-containers,
+      vector,
+    }:
+    mkDerivation {
+      pname = "linear-base";
+      version = "0.5.0";
+      sha256 = "0iikqp73i0isxkd8xwg5f8f6dk3cv5iw6ifjkmp5r5kwxb650xgq";
+      libraryHaskellDepends = [
+        base
+        containers
+        ghc-bignum
+        ghc-prim
+        hashable
+        linear-generics
+        primitive
+        storable-tuple
+        text
+        transformers
+        vector
+      ];
+      testHaskellDepends = [
+        base
+        containers
+        hedgehog
+        inspection-testing
+        linear-generics
+        mmorph
+        tasty
+        tasty-hedgehog
+        tasty-inspection-testing
+        vector
+      ];
+      benchmarkHaskellDepends = [
+        base
+        containers
+        deepseq
+        hashable
+        hashtables
+        MonadRandom
+        random
+        random-shuffle
+        tasty-bench
+        unordered-containers
+        vector
+      ];
+      doHaddock = false;
+      description = "Standard library for linear types";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "linear-circuit" = callPackage (
     {
       mkDerivation,
@@ -417879,10 +419118,8 @@ self: {
     }:
     mkDerivation {
       pname = "linearmap-category";
-      version = "0.6.0.1";
-      sha256 = "1rwa6jlkxvgzsw6v717gk5981rxdhk78zvv1smninlwsrjwc5j0i";
-      revision = "1";
-      editedCabalFile = "0qj860xn0k36vr45zpchskk3y86k8529qspz53f600nvzgd4r4cz";
+      version = "0.6.0.2";
+      sha256 = "0nkg4s9kdxqa8g20yyzp8hig8cvvccmqgh1lf5vb0z4sq9ca1ka4";
       libraryHaskellDepends = [
         base
         call-stack
@@ -421397,16 +422634,18 @@ self: {
       aeson,
       base,
       http-conduit,
+      http-types,
       text,
     }:
     mkDerivation {
       pname = "llama-cpp-haskell";
-      version = "0.1.0.1";
-      sha256 = "0c4pw2mp73n5pvr377aa6kklqc1d4kcgmymb3bixqagcav7nizsh";
+      version = "0.1.0.2";
+      sha256 = "11g5v696mj0rcl8w2bjd6wvklrl25xk97s5hlzqc2hazwpzfgdwk";
       libraryHaskellDepends = [
         aeson
         base
         http-conduit
+        http-types
         text
       ];
       description = "Haskell bindings for the llama.cpp llama-server";
@@ -426008,8 +427247,8 @@ self: {
     }:
     mkDerivation {
       pname = "looksee";
-      version = "0.8.0";
-      sha256 = "0nzbcw766wpn86z8vsmf765zisw8af3304nas2fngm7hkv77v5ds";
+      version = "0.8.1";
+      sha256 = "1xzidd03v499rcggkwdgj650jl3q9qbzwxwqll9hglbr5c12d4kb";
       libraryHaskellDepends = [
         base
         bifunctors
@@ -427975,9 +429214,7 @@ self: {
       ];
       description = "Parameterized file evaluator";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "ltext";
-      broken = true;
     }
   ) { };
 
@@ -433697,8 +434934,8 @@ self: {
     }:
     mkDerivation {
       pname = "manifolds-core";
-      version = "0.6.1.0";
-      sha256 = "1fw6985ccg173x3449s81yzgnn3irhyzbw8i8jajyzqawr7kasp4";
+      version = "0.6.1.1";
+      sha256 = "0w953qmqczw7hhyxmd3vk9qng684k9cwjmgvxzr2yxhjpr05h7vm";
       libraryHaskellDepends = [
         base
         call-stack
@@ -440367,8 +441604,8 @@ self: {
       pname = "meminfo";
       version = "0.2.0.0";
       sha256 = "1mxk57qr4d1k6sz4qld09d61nc15hixggc5klfj5xr0n8rw1za3x";
-      revision = "2";
-      editedCabalFile = "0i6znbcw4yyf8jzkixx5dxbklzfnh79hmywvwwamdmjgi39akpi5";
+      revision = "3";
+      editedCabalFile = "0gl7cfjc6l8nnwwkj6p9760a2k4swz4s8bbrz4c0hqlyywcds3gy";
       libraryHaskellDepends = [
         attoparsec
         base
@@ -440377,8 +441614,6 @@ self: {
       ];
       description = "Library for reading `/proc/meminfo`";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -454486,10 +455721,8 @@ self: {
     }:
     mkDerivation {
       pname = "monoidal-containers";
-      version = "0.6.5.0";
-      sha256 = "008icgq7704pk301s6224k24iy3n60h0jvkkqgq61fi2fbbdy5r7";
-      revision = "2";
-      editedCabalFile = "1261ch2xj89dp2bjah961164ssawbvbhq12nmv931fr2h2h8v80m";
+      version = "0.6.6.0";
+      sha256 = "0i2hc4x1y6437az5cg1rg8p57m1m6k742h5vbdw0vr4hrq2ldsqi";
       libraryHaskellDepends = [
         aeson
         base
@@ -461549,6 +462782,74 @@ self: {
     }
   ) { };
 
+  "multidir" = callPackage (
+    {
+      mkDerivation,
+      base,
+      cond,
+      containers,
+      directory,
+      filepath,
+      filepattern,
+      hspec,
+      HUnit,
+      optparse-applicative,
+      process,
+      text,
+      toml-reader,
+    }:
+    mkDerivation {
+      pname = "multidir";
+      version = "0.1.0.0";
+      sha256 = "04xhsp0d83ims32fgyr92l71gc1cja9hcw5gw2d0iqi81iysfvbg";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        base
+        cond
+        containers
+        directory
+        filepath
+        filepattern
+        optparse-applicative
+        process
+        text
+        toml-reader
+      ];
+      executableHaskellDepends = [
+        base
+        cond
+        containers
+        directory
+        filepath
+        filepattern
+        optparse-applicative
+        process
+        text
+        toml-reader
+      ];
+      testHaskellDepends = [
+        base
+        cond
+        containers
+        directory
+        filepath
+        filepattern
+        hspec
+        HUnit
+        optparse-applicative
+        process
+        text
+        toml-reader
+      ];
+      description = "Simple tool for running commands in multiple directories";
+      license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
+      mainProgram = "muld";
+      broken = true;
+    }
+  ) { };
+
   "multifile" = callPackage (
     {
       mkDerivation,
@@ -464156,10 +465457,8 @@ self: {
     }:
     mkDerivation {
       pname = "mvc-updates";
-      version = "1.2.0";
-      sha256 = "125bwc79qcmwb8dn8yqkrxlbqf3vwdzhjx66c69j2jbrp70061n6";
-      revision = "2";
-      editedCabalFile = "1al0sfcnyrrqyxlm3rg1zwg2iyk9am1j80g37x6hcg5prxqx98m0";
+      version = "1.2.1";
+      sha256 = "1x4v5c0fnvb42smhzbf0ra1w6y3rc8cynmy74q0xi7zw40y70f20";
       libraryHaskellDepends = [
         async
         base
@@ -464364,7 +465663,6 @@ self: {
       ];
       description = "Generate Accelerate arrays filled with high quality pseudorandom numbers";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -467752,8 +469050,8 @@ self: {
     }:
     mkDerivation {
       pname = "natural-arithmetic";
-      version = "0.2.1.0";
-      sha256 = "17kd0216k0rqfisdd7rad3cv3qg0jyvd146k3gg1pv9y8waf5rin";
+      version = "0.2.2.0";
+      sha256 = "1ps6lcp0s3izphp3hx73p2v91cs1r2iz4rh1hwrmxd9pfar815ya";
       libraryHaskellDepends = [
         base
         unlifted
@@ -468718,6 +470016,20 @@ self: {
     }
   ) { };
 
+  "nerd-font-icons" = callPackage (
+    { mkDerivation, base }:
+    mkDerivation {
+      pname = "nerd-font-icons";
+      version = "0.1.0.0";
+      sha256 = "0nbgb9lz0ibha72gyh0q86rbssik2fxphab6f1asm0r5kz5va3ly";
+      libraryHaskellDepends = [ base ];
+      description = "Nerd Font Icons for use in haskell";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
+    }
+  ) { };
+
   "nerf" = callPackage (
     {
       mkDerivation,
@@ -471306,40 +472618,6 @@ self: {
   ) { };
 
   "network-control" = callPackage (
-    {
-      mkDerivation,
-      base,
-      hspec,
-      hspec-discover,
-      pretty-simple,
-      psqueues,
-      QuickCheck,
-      text,
-      unix-time,
-    }:
-    mkDerivation {
-      pname = "network-control";
-      version = "0.1.5";
-      sha256 = "0ir2v3ys923m7jqagvbi327d3gdnrccdvhkf2jzsljazn35l91qc";
-      libraryHaskellDepends = [
-        base
-        psqueues
-        unix-time
-      ];
-      testHaskellDepends = [
-        base
-        hspec
-        pretty-simple
-        QuickCheck
-        text
-      ];
-      testToolDepends = [ hspec-discover ];
-      description = "Library to control network protocols";
-      license = lib.licenses.bsd3;
-    }
-  ) { };
-
-  "network-control_0_1_6" = callPackage (
     {
       mkDerivation,
       base,
@@ -471370,7 +472648,6 @@ self: {
       testToolDepends = [ hspec-discover ];
       description = "Library to control network protocols";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -476669,8 +477946,8 @@ self: {
     }:
     mkDerivation {
       pname = "no-recursion";
-      version = "0.1.2.2";
-      sha256 = "0vdj0j29xlynv2n1z9gqk7yxh3kfynpyvj59kmpkbg8z3qhcrcg3";
+      version = "0.1.2.3";
+      sha256 = "1zds0fz29k5iypksqkizhggsxw1ndc5y8ilf4j9hsm084kqidfhz";
       setupHaskellDepends = [
         base
         Cabal
@@ -484753,8 +486030,8 @@ self: {
     }:
     mkDerivation {
       pname = "om-elm";
-      version = "2.0.0.7";
-      sha256 = "0xf775929s76galzqfaq2zx0ks1wkcfqzqi3a1z3zg6w4fswiw67";
+      version = "2.0.0.8";
+      sha256 = "094yrsxv9fnag30azj0gm4vnb5s29516q35pgr7jyz13i06fjx5w";
       libraryHaskellDepends = [
         base
         bytestring
@@ -484784,8 +486061,8 @@ self: {
     }:
     mkDerivation {
       pname = "om-fail";
-      version = "0.1.0.5";
-      sha256 = "0a3h016vy2czq0bdkagljz9dpy1133ym07a61sk5drq76jcq5byn";
+      version = "0.1.0.6";
+      sha256 = "1zxb3k29wvr97bdirvnnansj3insvwc0zsi6p9smblrdasydl117";
       libraryHaskellDepends = [
         base
         monad-logger
@@ -484811,8 +486088,8 @@ self: {
     }:
     mkDerivation {
       pname = "om-fork";
-      version = "0.7.1.11";
-      sha256 = "03gln694nn2v16ccljgqr9a795skw5js9j76mamc803qgnrdsdj1";
+      version = "0.7.1.12";
+      sha256 = "1zrq2mwpx9f8z4x2xkp33zqzbiczgw92xdfxd3xwjfc8r0rag0p6";
       libraryHaskellDepends = [
         aeson
         base
@@ -484867,8 +486144,8 @@ self: {
     }:
     mkDerivation {
       pname = "om-http";
-      version = "0.5.0.0";
-      sha256 = "165m5dijcwa9knrn4lfk86l8gs30b98xbmp75vm6y0wc3my0dhsq";
+      version = "0.5.0.1";
+      sha256 = "0sq6kjb0axdcx0j2cfmrx1vfl56svcs5rgp9gk4nnhysm9zcslky";
       libraryHaskellDepends = [
         aeson
         async
@@ -485044,7 +486321,6 @@ self: {
       ];
       description = "Legion Framework";
       license = lib.licenses.mit;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -485063,8 +486339,8 @@ self: {
     }:
     mkDerivation {
       pname = "om-logging";
-      version = "1.1.0.9";
-      sha256 = "0k8yw4v1xxh2vm5507wxxfl3dvxfaz8nip3apri22aqyxjg05w45";
+      version = "1.1.0.10";
+      sha256 = "0s2yj64mvqf7agm8xlvrb407ir4i89giyd70475yaza6nixmm9r5";
       libraryHaskellDepends = [
         aeson
         base
@@ -485092,8 +486368,8 @@ self: {
     }:
     mkDerivation {
       pname = "om-plugin-imports";
-      version = "0.4.0.1.9.10";
-      sha256 = "1qkgfxsd4vpxd0fbhkfz5636zc5mbhcxh80h98h67hdxkkc69ad4";
+      version = "0.4.0.1.9.12";
+      sha256 = "0jywx9qz6xws3504z6gby42zzz9d4qj9v62xfg9zmp0faypbbdh6";
       libraryHaskellDepends = [
         base
         containers
@@ -485103,6 +486379,8 @@ self: {
       ];
       description = "Plugin-based explicit import generation";
       license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -485115,8 +486393,8 @@ self: {
     }:
     mkDerivation {
       pname = "om-show";
-      version = "0.1.2.10";
-      sha256 = "1ngwdci1pqf2wmhqfn54372wv7w7v8p5hr56k37kb0aslkdci8qa";
+      version = "0.1.2.11";
+      sha256 = "1abp4yygjcgpr92d767fgzqn1zp67j71mhfwaq6rvsbvqy3pi5zi";
       libraryHaskellDepends = [
         aeson
         base
@@ -485152,8 +486430,8 @@ self: {
     }:
     mkDerivation {
       pname = "om-socket";
-      version = "1.0.0.3";
-      sha256 = "0slvcxz4s81w8wagqyrlawlss4sgwcxqnpjaayvxgf8d0rq5add6";
+      version = "1.0.0.4";
+      sha256 = "01lxvngyx28qk3s4f7ix0grl45jy3zgki1l32dkqan69nklzzgln";
       libraryHaskellDepends = [
         aeson
         base
@@ -485188,8 +486466,6 @@ self: {
       ];
       description = "Socket utilities";
       license = lib.licenses.mit;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -485205,8 +486481,8 @@ self: {
     }:
     mkDerivation {
       pname = "om-time";
-      version = "0.3.1.0";
-      sha256 = "1ri7hp3jb0nnc5j02n5wh0ninsng58w79hx9rmmq9z972m4vbqfn";
+      version = "0.3.1.1";
+      sha256 = "03g2yipal5v5rnvzrljn0gvy3jn6fk0hqwy84vi13qwy6crbxnrr";
       libraryHaskellDepends = [
         aeson
         base
@@ -486497,7 +487773,7 @@ self: {
     }
   ) { };
 
-  "open-browser_0_3_0_1" = callPackage (
+  "open-browser_0_4_0_0" = callPackage (
     {
       mkDerivation,
       base,
@@ -486505,8 +487781,8 @@ self: {
     }:
     mkDerivation {
       pname = "open-browser";
-      version = "0.3.0.1";
-      sha256 = "0gnckivfyv131f342nziyj0p57m9arq0ds8b6jylxga31snj3icn";
+      version = "0.4.0.0";
+      sha256 = "0pgqrdwmzw70yfqvbssc01b8n3aqw3l6a92j16vby9x0cv803zyy";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -486818,8 +488094,8 @@ self: {
     }:
     mkDerivation {
       pname = "openai";
-      version = "1.0.1";
-      sha256 = "0yjy6a77ss20clfga83785asj32752v315rv93043927lsjacnh5";
+      version = "1.1.0";
+      sha256 = "1kja27qbdy5zxczswrn53k1lgxf2y9hw77pj4jlc7arkpl6nndai";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -487356,8 +488632,8 @@ self: {
     }:
     mkDerivation {
       pname = "openapi3-code-generator";
-      version = "0.1.0.7";
-      sha256 = "18g7xca0q4l4zn5k1wvx3zvnvidagab7vjwb4g68xy18rxh3q2ap";
+      version = "0.2.0.0";
+      sha256 = "13nfdm8qvajcls4dmrrimr5c7py6d58jywmlz2c7shf9rg0mckdq";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -487450,9 +488726,7 @@ self: {
       ];
       description = "OpenAPI3 Haskell Client Code Generator";
       license = lib.licenses.mit;
-      hydraPlatforms = lib.platforms.none;
       mainProgram = "openapi3-code-generator-exe";
-      broken = true;
     }
   ) { };
 
@@ -487465,8 +488739,8 @@ self: {
     }:
     mkDerivation {
       pname = "opencascade-hs";
-      version = "0.4.0.0";
-      sha256 = "1dhasjjhcg54qihcihid69z70l75dn7xsbsd765lsgzc35m1qbrl";
+      version = "0.5.0.0";
+      sha256 = "104h4fzzyw457g2lxvhshaw711bc6zl3gd5zwg629hwqwm96b356";
       libraryHaskellDepends = [
         base
         resourcet
@@ -490522,6 +491796,39 @@ self: {
     }
   ) { };
 
+  "optima_0_4_0_6" = callPackage (
+    {
+      mkDerivation,
+      attoparsec,
+      attoparsec-data,
+      base,
+      optparse-applicative,
+      rerebase,
+      text,
+      text-builder,
+    }:
+    mkDerivation {
+      pname = "optima";
+      version = "0.4.0.6";
+      sha256 = "06wy9d3zidly70d3n9bbxfl9yx2hx03xw8k9p8vhjb0xj526vpgk";
+      libraryHaskellDepends = [
+        attoparsec
+        attoparsec-data
+        base
+        optparse-applicative
+        text
+        text-builder
+      ];
+      testHaskellDepends = [
+        attoparsec-data
+        rerebase
+      ];
+      description = "Simple command line interface arguments parser";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "optima-for-hasql" = callPackage (
     {
       mkDerivation,
@@ -494636,8 +495943,6 @@ self: {
       bytestring,
       bytestring-strict-builder,
       cassava,
-      Chart,
-      Chart-diagrams,
       criterion,
       deepseq,
       directory,
@@ -494647,15 +495952,16 @@ self: {
       listsafe,
       mtl,
       optparse-applicative,
+      process,
+      scientific,
       split,
       template-haskell,
-      time,
       vector,
     }:
     mkDerivation {
       pname = "packed-data";
-      version = "0.1.0.1";
-      sha256 = "0hpqqvxhf6jy6g9g7ngy2dirc9ppbakgmylikd10xa8rsy5ff7sy";
+      version = "0.1.0.3";
+      sha256 = "1h0aqcpfygj29mij5ln7zaypf4a6v37ycnlhh5shb7pvh0nfajn3";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -494667,12 +495973,7 @@ self: {
         mtl
         template-haskell
       ];
-      executableHaskellDepends = [
-        base
-        deepseq
-        mtl
-        time
-      ];
+      executableHaskellDepends = [ base ];
       testHaskellDepends = [
         base
         bytestring
@@ -494684,8 +495985,6 @@ self: {
         base
         bytestring
         cassava
-        Chart
-        Chart-diagrams
         criterion
         deepseq
         directory
@@ -494693,11 +495992,13 @@ self: {
         listsafe
         mtl
         optparse-applicative
+        process
+        scientific
         split
         vector
       ];
       license = lib.licenses.bsd3;
-      mainProgram = "packed-exe";
+      mainProgram = "examples";
     }
   ) { };
 
@@ -498663,10 +499964,8 @@ self: {
     }:
     mkDerivation {
       pname = "pantry";
-      version = "0.10.0";
-      sha256 = "1f0ck7j82km4sy1ia2iqv9aqkdr3p2h8sarbksrsx2dq68552xym";
-      revision = "3";
-      editedCabalFile = "1icnsp0j6dbbqsp2wkxbq0nwfv55fl95anh0xsl6x5gx2q4wg1gc";
+      version = "0.10.1";
+      sha256 = "1cn9lzgjk4gw8sk5pmzkcs9xwnrbqs70vslfcfv1cyfmdgh0w2il";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -501488,8 +502787,8 @@ self: {
     }:
     mkDerivation {
       pname = "parser-regex";
-      version = "0.2.0.2";
-      sha256 = "1aqx5krvmz2mdwlpbpnwlk50c3v02lxarv6p2si23qy26v7ra22f";
+      version = "0.3.0.0";
+      sha256 = "1vf8r4wwx97cj2dwd20znqbzp4svczw1hk9rjhpqh257l7b217pi";
       libraryHaskellDepends = [
         base
         containers
@@ -503032,8 +504331,8 @@ self: {
     }:
     mkDerivation {
       pname = "patat";
-      version = "0.14.2.0";
-      sha256 = "0shfw876xfw6xcaf4xjjj8gq2ky7k16fl6wvas952j87b5bhd7gf";
+      version = "0.15.0.0";
+      sha256 = "1vamp3m0567fvm1ghjjjmhpfw0pbp2aardhgr1n0fsmamjq8zgbz";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -507945,6 +509244,8 @@ self: {
       pname = "persistent";
       version = "2.14.6.3";
       sha256 = "1nqmd1ml1s4cm9hwfz9cz5qj4i9zm8ip69gmgysfgbs0h64f7w2d";
+      revision = "1";
+      editedCabalFile = "1rx07qblwxaq9fcl8z66lvmqd48widnlqcg3hgdd8ni9yrvwfmxi";
       libraryHaskellDepends = [
         aeson
         attoparsec
@@ -508024,7 +509325,7 @@ self: {
     }
   ) { };
 
-  "persistent_2_15_0_1" = callPackage (
+  "persistent_2_15_1_0" = callPackage (
     {
       mkDerivation,
       aeson,
@@ -508066,8 +509367,8 @@ self: {
     }:
     mkDerivation {
       pname = "persistent";
-      version = "2.15.0.1";
-      sha256 = "12lb7b3yx07yc8adhm8f58wspnngy9x6djnly7032r01pm3w9xfj";
+      version = "2.15.1.0";
+      sha256 = "142c91xplnm9fbzm7gkd1dl3p5da74nxr4bv5a921hhpsrwm0p9g";
       libraryHaskellDepends = [
         aeson
         attoparsec
@@ -509836,8 +511137,8 @@ self: {
     }:
     mkDerivation {
       pname = "persistent-sql-lifted";
-      version = "0.4.2.0";
-      sha256 = "1yd0fx23ww2q4dgjzqk9dicqzggcxh27jgx26hy7wd6mj88hcbh5";
+      version = "0.4.3.1";
+      sha256 = "1lcr99d84pyvcz7b0vln2q1ai98g8n44afp0xb0zfgmhal2zidic";
       libraryHaskellDepends = [
         annotated-exception
         base
@@ -510138,6 +511439,8 @@ self: {
       pname = "persistent-typed-db";
       version = "0.1.0.7";
       sha256 = "0fkshbf35mnlx4aqkij0lzzmpfxw34zkwgq8s2lm3rrrqw7gw59l";
+      revision = "1";
+      editedCabalFile = "19l1nfd82l8lsjsi00virsapwlnany5cdwgzw9hmm9bkwxfsk9v8";
       libraryHaskellDepends = [
         aeson
         base
@@ -514485,6 +515788,63 @@ self: {
     }
   ) { };
 
+  "pinecone" = callPackage (
+    {
+      mkDerivation,
+      aeson,
+      base,
+      containers,
+      http-api-data,
+      http-client,
+      http-client-tls,
+      scientific,
+      servant,
+      servant-client,
+      servant-client-core,
+      tasty,
+      tasty-hunit,
+      text,
+      time,
+      vector,
+    }:
+    mkDerivation {
+      pname = "pinecone";
+      version = "1.0.0";
+      sha256 = "0q30rj2rcvfmakxzra8jcywqihy6gz5r6b0jdxbjfw56m8drnc25";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        aeson
+        base
+        containers
+        http-api-data
+        http-client
+        http-client-tls
+        scientific
+        servant
+        servant-client
+        servant-client-core
+        text
+        time
+        vector
+      ];
+      executableHaskellDepends = [
+        base
+        text
+      ];
+      testHaskellDepends = [
+        base
+        tasty
+        tasty-hunit
+        text
+        vector
+      ];
+      description = "Servant bindings to Pinecone";
+      license = lib.licenses.bsd3;
+      mainProgram = "pinecone-example";
+    }
+  ) { };
+
   "ping" = callPackage (
     {
       mkDerivation,
@@ -516083,8 +517443,8 @@ self: {
       pname = "pipes-http";
       version = "1.0.6";
       sha256 = "00579dpb7mh8nli5gfr100w0mrn6nvqhbj50qzxc2m5cvw4gncd2";
-      revision = "3";
-      editedCabalFile = "0m38lrmr356gfrv6gnrncwiy1hnh882084yn7vgmjsqssgvhbz8a";
+      revision = "4";
+      editedCabalFile = "10i497dksdnfayzij3dn42pnz6ldklyiz0rd6zjkpn1hfz94ygv9";
       libraryHaskellDepends = [
         base
         bytestring
@@ -521123,8 +522483,8 @@ self: {
     }:
     mkDerivation {
       pname = "pollock";
-      version = "0.1.0.2";
-      sha256 = "112knjwg24mq9gigh3jmnhn3mgv51kawy0k8b7ys856429zpbflk";
+      version = "0.1.0.3";
+      sha256 = "14nvwjb0bsddkp34wm0cvqz7jrs4505p5c1yb2lm7fdw63mb0lb5";
       libraryHaskellDepends = [
         attoparsec
         base
@@ -526508,8 +527868,6 @@ self: {
       doHaddock = false;
       description = "low-level binding to libpq: configure based provider";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -527717,8 +529075,8 @@ self: {
     }:
     mkDerivation {
       pname = "postgresql-syntax";
-      version = "0.4.1.1";
-      sha256 = "1xzvp3ix75y8f3zwpm50dz1zafbyc0x311a2fc9dxb3v4vbcvwvl";
+      version = "0.4.1.2";
+      sha256 = "0z2mnx8npickm5h208mqm76ybr37cmqqf3q1nfy3kh19xdgqhfy7";
       libraryHaskellDepends = [
         base
         bytestring
@@ -527742,6 +529100,52 @@ self: {
     }
   ) { };
 
+  "postgresql-syntax_0_4_1_3" = callPackage (
+    {
+      mkDerivation,
+      base,
+      bytestring,
+      case-insensitive,
+      hashable,
+      headed-megaparsec,
+      hedgehog,
+      megaparsec,
+      parser-combinators,
+      rerebase,
+      tasty,
+      tasty-hunit,
+      text,
+      text-builder,
+      unordered-containers,
+    }:
+    mkDerivation {
+      pname = "postgresql-syntax";
+      version = "0.4.1.3";
+      sha256 = "0fg4zicn3kwdvvpf3si9pi6pmnsm9k5ph3drqd57jp8xz16b1rzl";
+      libraryHaskellDepends = [
+        base
+        bytestring
+        case-insensitive
+        hashable
+        headed-megaparsec
+        megaparsec
+        parser-combinators
+        text
+        text-builder
+        unordered-containers
+      ];
+      testHaskellDepends = [
+        hedgehog
+        rerebase
+        tasty
+        tasty-hunit
+      ];
+      description = "PostgreSQL AST parsing and rendering";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "postgresql-transactional" = callPackage (
     {
       mkDerivation,
@@ -533108,8 +534512,8 @@ self: {
       mkDerivation,
       base,
       base-orphans,
+      containers,
       deepseq,
-      ghc-prim,
       QuickCheck,
       quickcheck-classes-base,
       tagged,
@@ -533122,10 +534526,8 @@ self: {
     }:
     mkDerivation {
       pname = "primitive";
-      version = "0.9.0.0";
-      sha256 = "1iwr176mx2xc96vgvzlby8z8s9d4vhbj266n89hp6kf9j794nvb9";
-      revision = "2";
-      editedCabalFile = "0nc7cd9921bzf31k48pnmx3k2bfaxakgv3jchn4215qzzx7by86y";
+      version = "0.9.1.0";
+      sha256 = "0xixplp2b5sh2sx6hqllhr8bcsd028v7ry2pibdwayrwh50xxd24";
       libraryHaskellDepends = [
         base
         deepseq
@@ -533135,7 +534537,6 @@ self: {
       testHaskellDepends = [
         base
         base-orphans
-        ghc-prim
         QuickCheck
         quickcheck-classes-base
         tagged
@@ -533146,6 +534547,7 @@ self: {
       ];
       benchmarkHaskellDepends = [
         base
+        containers
         deepseq
         tasty-bench
         transformers
@@ -534645,7 +536047,7 @@ self: {
     }
   ) { };
 
-  "process_1_6_25_0" = callPackage (
+  "process_1_6_26_0" = callPackage (
     {
       mkDerivation,
       base,
@@ -534656,10 +536058,8 @@ self: {
     }:
     mkDerivation {
       pname = "process";
-      version = "1.6.25.0";
-      sha256 = "0rbfwyz2418nw15fb5a8l1f8vsyzcz4wjakpx49b259rdibf0vs9";
-      revision = "1";
-      editedCabalFile = "15ml3j10ahwmbiml8dm6llwalksclw394bmahccx4579jqavcah9";
+      version = "1.6.26.0";
+      sha256 = "18gxjw88qs4vgxyiq7srxmj0jy6kn2c5dwpq8a1wdgbbpwd920ys";
       libraryHaskellDepends = [
         base
         deepseq
@@ -536216,6 +537616,7 @@ self: {
       criterion,
       cryptohash-sha256,
       curryer-rpc,
+      data-default,
       data-interval,
       deepseq,
       deepseq-generics,
@@ -536286,8 +537687,8 @@ self: {
     }:
     mkDerivation {
       pname = "project-m36";
-      version = "1.1.0";
-      sha256 = "1nqdfvzq4pm8dgds0r7k5fv4sw10nfygnz0w9dvb118s14sap1fi";
+      version = "1.1.1";
+      sha256 = "1hn6zfnymgknvi2crn6pmr7h24dpm0wky8iq0sqi5nyzx72pilj8";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -536371,11 +537772,13 @@ self: {
         containers
         cryptohash-sha256
         curryer-rpc
+        data-default
         data-interval
         deepseq
         deepseq-generics
         directory
         either
+        exceptions
         filepath
         ghc
         ghc-paths
@@ -537684,8 +539087,8 @@ self: {
     }:
     mkDerivation {
       pname = "property-matchers";
-      version = "0.4.0.0";
-      sha256 = "04gfxskd5gagpfh21532d0kk89zrkmgxky3j9aqlw6s90ba02pr5";
+      version = "0.7.0.0";
+      sha256 = "0qry7qrf6dm86cvh3s2z9zdjdi7wpxmvxvrlhsl7sn3ybwphnk0f";
       libraryHaskellDepends = [
         adjunctions
         base
@@ -539840,6 +541243,7 @@ self: {
       dlist,
       hashable,
       HUnit,
+      integer-logarithms,
       megaparsec,
       parsec,
       QuickCheck,
@@ -539852,10 +541256,8 @@ self: {
     }:
     mkDerivation {
       pname = "pseudo-boolean";
-      version = "0.1.11.0";
-      sha256 = "04hkg7nlyrziq3pm44sqr6b5zjb5x3d70xqzblp3h7f1sc6839rr";
-      revision = "2";
-      editedCabalFile = "10rrnb6ih4lhck257iz0sx7az36ijcxiaxn29cnjvbc2ngv5m8v9";
+      version = "0.1.12.0";
+      sha256 = "1imnlqbfzqk80zkcbqqprfyynh1b10akgiafpbqd1cp7abgz3w5m";
       libraryHaskellDepends = [
         attoparsec
         base
@@ -539865,6 +541267,7 @@ self: {
         deepseq
         dlist
         hashable
+        integer-logarithms
         megaparsec
         parsec
         void
@@ -546074,10 +547477,8 @@ self: {
     }:
     mkDerivation {
       pname = "quic";
-      version = "0.2.7";
-      sha256 = "0x6x7xdknwa80ikclfn8mq8jyqgy73l0g8qy82jcgj3jqd4631zq";
-      revision = "1";
-      editedCabalFile = "1yvg2v2g1bv8yjc9qlpm60qg97443c0d035wb6blrp3xd6d885ms";
+      version = "0.2.10";
+      sha256 = "1ki26dcd3bkgiln8ww52w1azvjpw2c32cv9lczzwijq50hnkqs93";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -546121,6 +547522,8 @@ self: {
       testToolDepends = [ hspec-discover ];
       description = "QUIC";
       license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -546728,6 +548131,8 @@ self: {
       pname = "quickcheck-lockstep";
       version = "0.6.0";
       sha256 = "1s1z146l00v5hlcmwq9w9dpvs0mblld8h15xicxb619fbl1hrg5x";
+      revision = "1";
+      editedCabalFile = "00mlph661br03khrpzl9f1wvwmr2mrv6y3hqp7i371rm1dl83xd5";
       libraryHaskellDepends = [
         base
         constraints
@@ -550218,7 +551623,7 @@ self: {
     }
   ) { };
 
-  "random_1_3_0" = callPackage (
+  "random_1_3_1" = callPackage (
     {
       mkDerivation,
       base,
@@ -550242,8 +551647,8 @@ self: {
     }:
     mkDerivation {
       pname = "random";
-      version = "1.3.0";
-      sha256 = "1cgisk7y2r58lai3q61jx2fis2aiqg75y7qm3zipgmr5avk6fl3b";
+      version = "1.3.1";
+      sha256 = "0d8snwlrq8x4r197q1igpvwhrdbyc9wfry3qlsiczc35ya1sqh6q";
       libraryHaskellDepends = [
         base
         bytestring
@@ -558182,8 +559587,8 @@ self: {
     }:
     mkDerivation {
       pname = "reflex-dom";
-      version = "0.6.3.3";
-      sha256 = "0b9mgnbgljcasd621mw5cj5g1li8dpxiksjqjk45lilzycm1xcxs";
+      version = "0.6.3.4";
+      sha256 = "1l6phafpnngnjj406p0k84kcfangcpf144h2w25b7gfc8ihi2vkm";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -558394,8 +559799,8 @@ self: {
     }:
     mkDerivation {
       pname = "reflex-dom-core";
-      version = "0.8.1.2";
-      sha256 = "1ljv45i2byb28963flwllzvf2k0xizpsjrkpys3qsbhipyx0gc5m";
+      version = "0.8.1.3";
+      sha256 = "0g2sg068mchc0di8agxdcj1wxrc1qfhcnz4qcl3p0sc6h298sf0n";
       libraryHaskellDepends = [
         aeson
         base
@@ -562843,6 +564248,7 @@ self: {
       description = "The connector of relational-record and postgresql-pure";
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -565143,8 +566549,8 @@ self: {
       pname = "req";
       version = "3.13.4";
       sha256 = "0s80kl29b7d35v044yvkfa6ja40k4sm3wh26qpnscqzv2n6w8zzk";
-      revision = "3";
-      editedCabalFile = "1vfy9adansxpk8ldmmv8iycpgdnf5wdipfxvvpricjsj6lr0zv6k";
+      revision = "4";
+      editedCabalFile = "14r4xkchdpwcvsmsqx6wq77wj79yd6xa0lxf5rphl21gpsdcym4k";
       enableSeparateDataOutput = true;
       libraryHaskellDepends = [
         aeson
@@ -588087,10 +589493,13 @@ self: {
       hspec-discover,
       hspec-wai,
       http-client,
+      http-conduit,
+      http-media,
       http-types,
       mockery,
       mtl,
       network,
+      pretty,
       process,
       QuickCheck,
       stm,
@@ -588099,19 +589508,47 @@ self: {
       time,
       transformers,
       unix,
+      vcr,
       wai,
+      wai-extra,
       warp,
       yaml,
     }:
     mkDerivation {
       pname = "sensei";
-      version = "0.8.0";
-      sha256 = "0qmi9qzfbsx9xxkczwjx1pzwmkwpl1dq1c80f4nmjgqh4mm21aw5";
-      revision = "1";
-      editedCabalFile = "1vafgazhxamvwp1ihjhyn2q6v8y57a6hzjvahd10bxdb1ng3mlbx";
-      isLibrary = false;
+      version = "0.9.0";
+      sha256 = "0fw6s5c5fmiji9rw84i891zfbvzw6w2cx6jdhdkbijx1lksnh9mj";
+      isLibrary = true;
       isExecutable = true;
-      enableSeparateDataOutput = true;
+      libraryHaskellDepends = [
+        aeson
+        ansi-terminal
+        async
+        base
+        bytestring
+        casing
+        containers
+        directory
+        filepath
+        fsnotify
+        http-client
+        http-conduit
+        http-media
+        http-types
+        mtl
+        network
+        pretty
+        process
+        stm
+        temporary
+        text
+        time
+        transformers
+        unix
+        wai
+        warp
+        yaml
+      ];
       executableHaskellDepends = [
         aeson
         ansi-terminal
@@ -588124,11 +589561,15 @@ self: {
         filepath
         fsnotify
         http-client
+        http-conduit
+        http-media
         http-types
         mtl
         network
+        pretty
         process
         stm
+        temporary
         text
         time
         transformers
@@ -588152,10 +589593,13 @@ self: {
         hspec-contrib
         hspec-wai
         http-client
+        http-conduit
+        http-media
         http-types
         mockery
         mtl
         network
+        pretty
         process
         QuickCheck
         stm
@@ -588164,7 +589608,9 @@ self: {
         time
         transformers
         unix
+        vcr
         wai
+        wai-extra
         warp
         yaml
       ];
@@ -592431,6 +593877,8 @@ self: {
       pname = "servant-event-stream";
       version = "0.3.0.1";
       sha256 = "1nd9v3dmpnqwj63psm6zikgcd635fc80a7bhn0azzlgi551s5kf2";
+      revision = "1";
+      editedCabalFile = "1dw8rknp2a2b92ri6f4qgvz93r99c7jzrhdmll3n7kkz0lyk9z28";
       libraryHaskellDepends = [
         base
         bytestring
@@ -605765,6 +607213,19 @@ self: {
     }
   ) { };
 
+  "simple-get-opt_0_4" = callPackage (
+    { mkDerivation, base }:
+    mkDerivation {
+      pname = "simple-get-opt";
+      version = "0.4";
+      sha256 = "0xr5gi22ifq6nw0q0w1rf66djsns4gfv2l9yjvxhbxr4j8bqmwik";
+      libraryHaskellDepends = [ base ];
+      description = "A simple library for processing command-line options";
+      license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "simple-get-opt" = callPackage (
     { mkDerivation, base }:
     mkDerivation {
@@ -609627,8 +611088,6 @@ self: {
       ];
       description = "A very quick-and-dirty WebSocket server";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -620440,6 +621899,41 @@ self: {
     }
   ) { };
 
+  "sparse-set" = callPackage (
+    {
+      mkDerivation,
+      base,
+      criterion,
+      deepseq,
+      sparse-vector,
+      vector,
+    }:
+    mkDerivation {
+      pname = "sparse-set";
+      version = "0.1.0";
+      sha256 = "0yy5n4dli33s6hqlpaifi7p81bp656lymlk3zfw97ijz8ac07dsn";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        base
+        deepseq
+        sparse-vector
+        vector
+      ];
+      executableHaskellDepends = [ base ];
+      testHaskellDepends = [ base ];
+      benchmarkHaskellDepends = [
+        base
+        criterion
+        deepseq
+        vector
+      ];
+      description = "Sparse set data structure";
+      license = lib.licenses.bsd3;
+      mainProgram = "sparse-set";
+    }
+  ) { };
+
   "sparse-tensor" = callPackage (
     {
       mkDerivation,
@@ -620498,6 +621992,38 @@ self: {
     }
   ) { };
 
+  "sparse-vector" = callPackage (
+    {
+      mkDerivation,
+      base,
+      deepseq,
+      hspec,
+      mtl,
+      vector,
+    }:
+    mkDerivation {
+      pname = "sparse-vector";
+      version = "0.1.0";
+      sha256 = "0q01fjip1lql62kpqia23mhhv906n3hr7axs760gj7sclqgvcmyr";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        base
+        deepseq
+        mtl
+        vector
+      ];
+      executableHaskellDepends = [ base ];
+      testHaskellDepends = [
+        base
+        hspec
+      ];
+      description = "Sparse vector data structures";
+      license = lib.licenses.bsd3;
+      mainProgram = "sparse-vector";
+    }
+  ) { };
+
   "sparsebit" = callPackage (
     {
       mkDerivation,
@@ -621180,8 +622706,8 @@ self: {
     }:
     mkDerivation {
       pname = "specup";
-      version = "0.2.0.4";
-      sha256 = "1y57jx5mr1pz0zxmqg3277ba455v47s52ijnvlkr6mqiyy04rawy";
+      version = "0.2.0.5";
+      sha256 = "1b84drxgqaij48rwwannnkms1mzd5mw4i4r442am6wz4y7v45309";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -624609,7 +626135,7 @@ self: {
     }
   ) { inherit (pkgs) nlopt; };
 
-  "srtree_2_0_0_4" = callPackage (
+  "srtree_2_0_1_2" = callPackage (
     {
       mkDerivation,
       ad,
@@ -624647,8 +626173,8 @@ self: {
     }:
     mkDerivation {
       pname = "srtree";
-      version = "2.0.0.4";
-      sha256 = "0k9204jjgr8h08jdqb11zi5pbvrz38638nlc0nhj7zn0nwi6nsqw";
+      version = "2.0.1.2";
+      sha256 = "102ii4lmix7crryci80f04mpyk2iw4wlwc81kqqq0xf9yd40ycfn";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -631143,8 +632669,6 @@ self: {
       ];
       description = "An implementation of a real-time concurrent queue";
       license = lib.licenses.mit;
-      hydraPlatforms = lib.platforms.none;
-      broken = true;
     }
   ) { };
 
@@ -635715,8 +637239,8 @@ self: {
       pname = "string-interpolate";
       version = "0.3.4.0";
       sha256 = "13hb3spabggr6gsn9xhwpwldjvpl2l7z4lgssis82c40n108b0w8";
-      revision = "1";
-      editedCabalFile = "164afgw0mxnyx5vjwshxphzkw1c4wqm93f3r89rwa5f3w93js7d2";
+      revision = "2";
+      editedCabalFile = "0mw6ws7ixdcfhn7pkgci8v1pk26wnid123pi5f1y88hnmnrzs13k";
       libraryHaskellDepends = [
         base
         bytestring
@@ -635900,8 +637424,8 @@ self: {
     }:
     mkDerivation {
       pname = "string-random";
-      version = "0.1.4.4";
-      sha256 = "03bqbmijqmggc2dvl20an79f75z1bh15zfjndpc08sv3nnw1fz5c";
+      version = "0.1.4.5";
+      sha256 = "1k5kwr8q33c7ziwcwgi4v8srnpbw72ar7immx72mh4h2pkqmnmfy";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -638183,6 +639707,105 @@ self: {
     }
   ) { };
 
+  "stylish-haskell_0_15_1_0" = callPackage (
+    {
+      mkDerivation,
+      aeson,
+      base,
+      bytestring,
+      Cabal,
+      containers,
+      directory,
+      file-embed,
+      filepath,
+      ghc-lib-parser,
+      ghc-lib-parser-ex,
+      HsYAML,
+      HsYAML-aeson,
+      HUnit,
+      mtl,
+      optparse-applicative,
+      random,
+      regex-tdfa,
+      strict,
+      syb,
+      test-framework,
+      test-framework-hunit,
+      text,
+    }:
+    mkDerivation {
+      pname = "stylish-haskell";
+      version = "0.15.1.0";
+      sha256 = "06y6f7bv5j5k7q81194v9jqcbmmqcv7h8ii3lq1783bpfnyd6h19";
+      isLibrary = true;
+      isExecutable = true;
+      libraryHaskellDepends = [
+        aeson
+        base
+        bytestring
+        Cabal
+        containers
+        directory
+        file-embed
+        filepath
+        ghc-lib-parser
+        ghc-lib-parser-ex
+        HsYAML
+        HsYAML-aeson
+        mtl
+        regex-tdfa
+        syb
+        text
+      ];
+      executableHaskellDepends = [
+        aeson
+        base
+        bytestring
+        Cabal
+        containers
+        directory
+        file-embed
+        filepath
+        ghc-lib-parser
+        ghc-lib-parser-ex
+        HsYAML
+        HsYAML-aeson
+        mtl
+        optparse-applicative
+        regex-tdfa
+        strict
+        syb
+        text
+      ];
+      testHaskellDepends = [
+        aeson
+        base
+        bytestring
+        Cabal
+        containers
+        directory
+        file-embed
+        filepath
+        ghc-lib-parser
+        ghc-lib-parser-ex
+        HsYAML
+        HsYAML-aeson
+        HUnit
+        mtl
+        random
+        regex-tdfa
+        syb
+        test-framework
+        test-framework-hunit
+        text
+      ];
+      description = "Haskell code prettifier";
+      license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
+      mainProgram = "stylish-haskell";
+    }
+  ) { };
+
   "stylist" = callPackage (
     {
       mkDerivation,
@@ -651526,8 +653149,8 @@ self: {
     }:
     mkDerivation {
       pname = "taskwarrior";
-      version = "0.6.0.6";
-      sha256 = "12kxadpdw5k702j1p1bvgjy763gdhsy9wzx249apzqjgh0x766jc";
+      version = "0.6.0.7";
+      sha256 = "0qajc8vbp2misk5hyfx3sxa8yjlnnwix2cib1nvd598mkfwmbm15";
       libraryHaskellDepends = [
         aeson
         base
@@ -657452,10 +659075,8 @@ self: {
     }:
     mkDerivation {
       pname = "termbox";
-      version = "2.0.0.1";
-      sha256 = "0kynby25arx6hcq64cklw9qhw87qxy6vrz9z40d7k7j817gkzccq";
-      revision = "1";
-      editedCabalFile = "049mnzqwdsxa9ninv38nbbmwfh092wgp055nq4fkl97g1wkmd0w7";
+      version = "2.0.0.2";
+      sha256 = "0r6nfw75k3qbbmihm9l42xfc7a4ilhyv1cw8w8r4sv57pah6gcq7";
       libraryHaskellDepends = [
         base
         termbox-bindings-hs
@@ -657474,10 +659095,8 @@ self: {
     }:
     mkDerivation {
       pname = "termbox-banana";
-      version = "2.0.0";
-      sha256 = "1izf90r6idfspi06q3vwjipawpdcz5ag5qw3l45khn7js520rapn";
-      revision = "2";
-      editedCabalFile = "19xpkxjz8ay0wzy0nszfswvkyl5m2hchg7w05izcjkwl8skm0sjp";
+      version = "2.0.0.1";
+      sha256 = "0cgd6qfirgbgw50sln13ql9n4rzbx1vbr9w43va2nbviliim0ark";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -657517,10 +659136,8 @@ self: {
     { mkDerivation, base }:
     mkDerivation {
       pname = "termbox-bindings-c";
-      version = "0.1.0.1";
-      sha256 = "1rq695y6491f0nydgm64r6v2l8mkpvzgcrb2gxfdy6g0bwarimxw";
-      revision = "1";
-      editedCabalFile = "01n2013v0il3g1mm6lqjl01c0yqhpvsr86v7jcqpbj32rvkrg68v";
+      version = "0.1.0.2";
+      sha256 = "1n1z66xwnvrmvb3qd5wx8rwf2v54zvy3bzqrqcwp43jjii4mjqkh";
       libraryHaskellDepends = [ base ];
       description = "termbox bindings";
       license = lib.licenses.bsd3;
@@ -657535,10 +659152,8 @@ self: {
     }:
     mkDerivation {
       pname = "termbox-bindings-hs";
-      version = "1.0.0";
-      sha256 = "1j90pjqrngyygwwwk9zh2ah4sfdz9sv6222k21lmrql60md85g8i";
-      revision = "1";
-      editedCabalFile = "0qhmbx42njzbb7awvh7wgsgj52yxbcq8lrpj9dr8qpqzwprpnj2i";
+      version = "1.0.0.1";
+      sha256 = "10yzipc5g6diwb4kxkwwdh9x3v24n0pibmdlma34k1qnhhman54z";
       libraryHaskellDepends = [
         base
         termbox-bindings-c
@@ -657557,10 +659172,8 @@ self: {
     }:
     mkDerivation {
       pname = "termbox-tea";
-      version = "1.0.0";
-      sha256 = "0wya0fkjialv7hs6iw230x5ryx79s12pwig28mwrvgzvxmgm383a";
-      revision = "1";
-      editedCabalFile = "0zdpssg28lg5vwi61r2bp8c6p9b1phsxr8qz5gycg1yddd01n961";
+      version = "1.0.0.1";
+      sha256 = "1zpfv817yhx0wsb9s4ww9wb3rzfxj1ix9j60whwn458cchk37l2w";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -658336,22 +659949,18 @@ self: {
       containers,
       hostname,
       HUnit,
-      libxml,
       old-locale,
       QuickCheck,
       random,
       regex-posix,
       semigroups,
       time,
-      utf8-string,
       xml,
     }:
     mkDerivation {
       pname = "test-framework";
-      version = "0.8.2.1";
-      sha256 = "1yyfzf38n37yssqxm8mlzvp60n9vqkmprf1yfb9qmsya7kq53dkh";
-      revision = "1";
-      editedCabalFile = "0imq173blmc5nd77j82pxq8zskwrfcm38zik9zplp220fng2kn12";
+      version = "0.8.2.2";
+      sha256 = "04ijf5x6xx8i5lqv9ir33zs1rfzc4qkwwz8c1fdycnzvydcv4dnp";
       libraryHaskellDepends = [
         ansi-terminal
         ansi-wl-pprint
@@ -658372,14 +659981,12 @@ self: {
         containers
         hostname
         HUnit
-        libxml
         old-locale
         QuickCheck
         random
         regex-posix
         semigroups
         time
-        utf8-string
         xml
       ];
       description = "Framework for running and organising tests, with HUnit and QuickCheck support";
@@ -660210,8 +661817,8 @@ self: {
     }:
     mkDerivation {
       pname = "text-builder";
-      version = "0.6.7.3";
-      sha256 = "1d64f4ans02wyk06kb0li6bi79hkdwc3zsi9dsmhsi1578cx96jx";
+      version = "0.6.10";
+      sha256 = "0laz4mpxq4zxr4zy6q4s0l368f5lyvf3ck7549mfw0m2978i2c86";
       libraryHaskellDepends = [
         base
         bytestring
@@ -660233,6 +661840,99 @@ self: {
     }
   ) { };
 
+  "text-builder_1_0_0_3" = callPackage (
+    {
+      mkDerivation,
+      base,
+      bytestring,
+      QuickCheck,
+      quickcheck-classes,
+      quickcheck-instances,
+      tasty,
+      tasty-bench,
+      tasty-quickcheck,
+      text,
+      text-builder-core,
+      text-builder-linear,
+      time,
+      transformers,
+    }:
+    mkDerivation {
+      pname = "text-builder";
+      version = "1.0.0.3";
+      sha256 = "1r5v28029hwxl4pkyss5vrxm95ndz0ja4bmcglnsbgpqsj6ia96k";
+      libraryHaskellDepends = [
+        base
+        bytestring
+        text
+        text-builder-core
+        time
+        transformers
+      ];
+      testHaskellDepends = [
+        base
+        bytestring
+        QuickCheck
+        quickcheck-classes
+        quickcheck-instances
+        tasty
+        tasty-quickcheck
+        text
+      ];
+      benchmarkHaskellDepends = [
+        base
+        tasty-bench
+        text
+        text-builder-linear
+      ];
+      description = "Efficient and flexible strict text builder";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
+  "text-builder-core" = callPackage (
+    {
+      mkDerivation,
+      base,
+      QuickCheck,
+      quickcheck-classes,
+      quickcheck-instances,
+      tasty,
+      tasty-bench,
+      tasty-quickcheck,
+      text,
+      text-builder-linear,
+    }:
+    mkDerivation {
+      pname = "text-builder-core";
+      version = "0.1.1.1";
+      sha256 = "11kx5lgvmhfqzsqg239w6mjjzkwdd9ydz49r4hmvvy2rvhq0k8x9";
+      libraryHaskellDepends = [
+        base
+        QuickCheck
+        text
+      ];
+      testHaskellDepends = [
+        base
+        QuickCheck
+        quickcheck-classes
+        quickcheck-instances
+        tasty
+        tasty-quickcheck
+        text
+      ];
+      benchmarkHaskellDepends = [
+        base
+        tasty-bench
+        text
+        text-builder-linear
+      ];
+      description = "Internals of \"text-builder\"";
+      license = lib.licenses.mit;
+    }
+  ) { };
+
   "text-builder-dev" = callPackage (
     {
       mkDerivation,
@@ -660257,8 +661957,8 @@ self: {
     }:
     mkDerivation {
       pname = "text-builder-dev";
-      version = "0.3.9.1";
-      sha256 = "1l9jhbkgzxf4ppqw8gsychw613pq26f9xy0g4q136v6x1q40yci6";
+      version = "0.3.10";
+      sha256 = "0m4lsbx0vkad0jx8lvdj69k7nlmhqc2sxayq8c657c202sbwngs3";
       libraryHaskellDepends = [
         base
         bytestring
@@ -660291,6 +661991,53 @@ self: {
     }
   ) { };
 
+  "text-builder-dev_0_4" = callPackage (
+    {
+      mkDerivation,
+      base,
+      bytestring,
+      QuickCheck,
+      quickcheck-classes,
+      quickcheck-instances,
+      split,
+      tasty,
+      tasty-quickcheck,
+      text,
+      text-builder,
+      text-builder-core,
+      time,
+      transformers,
+    }:
+    mkDerivation {
+      pname = "text-builder-dev";
+      version = "0.4";
+      sha256 = "1b8lxbd10d29lvlxwmcyljrgpcw2vb2a2xzacah5ys9ivp9i9xi9";
+      libraryHaskellDepends = [
+        base
+        bytestring
+        split
+        text
+        text-builder
+        text-builder-core
+        time
+        transformers
+      ];
+      testHaskellDepends = [
+        base
+        QuickCheck
+        quickcheck-classes
+        quickcheck-instances
+        tasty
+        tasty-quickcheck
+        text
+        time
+      ];
+      description = "Edge of developments for \"text-builder\"";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "text-builder-linear" = callPackage (
     {
       mkDerivation,
@@ -660332,6 +662079,29 @@ self: {
     }
   ) { };
 
+  "text-builder-time" = callPackage (
+    {
+      mkDerivation,
+      base,
+      text-builder,
+      time,
+    }:
+    mkDerivation {
+      pname = "text-builder-time";
+      version = "0.1";
+      sha256 = "0whlk4qh9kx1pnzwbblsys0ijlwanpb5rwapf9k2h20nc27yfc6i";
+      libraryHaskellDepends = [
+        base
+        text-builder
+        time
+      ];
+      description = "Various formats for \"time\" in terms of \"text-builder\"";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+      broken = true;
+    }
+  ) { };
+
   "text-compression" = callPackage (
     {
       mkDerivation,
@@ -670454,43 +672224,6 @@ self: {
   ) { };
 
   "tls-session-manager" = callPackage (
-    {
-      mkDerivation,
-      auto-update,
-      base,
-      basement,
-      bytestring,
-      clock,
-      crypto-token,
-      memory,
-      psqueues,
-      serialise,
-      tls,
-    }:
-    mkDerivation {
-      pname = "tls-session-manager";
-      version = "0.0.7";
-      sha256 = "0n88cnwcaz86izp0x004pbjm2nnr1x6lc75kjc26j9m4k9h266nc";
-      revision = "1";
-      editedCabalFile = "16ipngf44pbzf9xdvh6khkjrjz860nd48f5lrzbi5dnbjhcd6vi2";
-      libraryHaskellDepends = [
-        auto-update
-        base
-        basement
-        bytestring
-        clock
-        crypto-token
-        memory
-        psqueues
-        serialise
-        tls
-      ];
-      description = "In-memory TLS session DB and session ticket";
-      license = lib.licenses.bsd3;
-    }
-  ) { };
-
-  "tls-session-manager_0_0_8" = callPackage (
     {
       mkDerivation,
       auto-update,
@@ -670520,7 +672253,6 @@ self: {
       ];
       description = "In-memory TLS session DB and session ticket";
       license = lib.licenses.bsd3;
-      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -675232,12 +676964,12 @@ self: {
     }
   ) { };
 
-  "transformers_0_6_1_2" = callPackage (
+  "transformers_0_6_2_0" = callPackage (
     { mkDerivation, base }:
     mkDerivation {
       pname = "transformers";
-      version = "0.6.1.2";
-      sha256 = "1db1gr4dkz1gi5q3fvqlv83qg5r5x89cmk8y9affa3n433xmrn1z";
+      version = "0.6.2.0";
+      sha256 = "0qr8ysnr6s4ky04qw9qsmysx64a9pvcp7hc5qaps0gffnx127gk5";
       libraryHaskellDepends = [ base ];
       description = "Concrete functor and monad transformers";
       license = lib.licenses.bsd3;
@@ -683656,6 +685388,7 @@ self: {
       description = "Admin console framework";
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
+      broken = true;
     }
   ) { };
 
@@ -683871,19 +685604,21 @@ self: {
       process,
       stm,
       temporary,
+      text,
       transformers,
       unliftio-core,
     }:
     mkDerivation {
       pname = "typed-process";
-      version = "0.2.12.0";
-      sha256 = "1q8v2vn1p2sygjym4aamfv53hyabq081aryf807p5pjix0x3vvjc";
+      version = "0.2.13.0";
+      sha256 = "1823mbibn4wgx5y7d1xywayjiz3hlv1mg3dcahpdyhdm2dh9c04l";
       libraryHaskellDepends = [
         async
         base
         bytestring
         process
         stm
+        text
         transformers
         unliftio-core
       ];
@@ -683896,6 +685631,7 @@ self: {
         process
         stm
         temporary
+        text
         transformers
         unliftio-core
       ];
@@ -690013,8 +691749,8 @@ self: {
       pname = "units-parser";
       version = "0.1.1.5";
       sha256 = "16q7q9c27wy8hx7rp34d2nhywpdkn8rb43hljx1j20kydyp0m2sb";
-      revision = "1";
-      editedCabalFile = "1rgsv7x0g150f9js092hp384vz55gc8wbsja164l7ia5qjbjxl7z";
+      revision = "2";
+      editedCabalFile = "0dr7zqz8cw7zj9p16xpdjqk07sn283q72ac2fd0dr1dzpp331jlh";
       libraryHaskellDepends = [
         base
         containers
@@ -691158,8 +692894,8 @@ self: {
     }:
     mkDerivation {
       pname = "unlifted";
-      version = "0.2.2.0";
-      sha256 = "06phlykja7x0xn07d78sik6rkzl0qwwihk310nfc3r22j4wym4kx";
+      version = "0.2.3.0";
+      sha256 = "19sqhx3sxnahafji04r40slbz6c8ws3fx5qpfkb2w2q1s4r2fmyx";
       libraryHaskellDepends = [
         base
         bytestring
@@ -692949,7 +694685,7 @@ self: {
     }
   ) { };
 
-  "uri-bytestring_0_4_0_0" = callPackage (
+  "uri-bytestring_0_4_0_1" = callPackage (
     {
       mkDerivation,
       attoparsec,
@@ -692974,8 +694710,8 @@ self: {
     }:
     mkDerivation {
       pname = "uri-bytestring";
-      version = "0.4.0.0";
-      sha256 = "09xwwljhb75nsxx0059ni5mkijr794z35vfvpb14710gp46wmz3z";
+      version = "0.4.0.1";
+      sha256 = "0xbrm2q7smj0ar7bz7c1nw510si8bfnb9kd4pvdrxbcpyj9zsg12";
       libraryHaskellDepends = [
         attoparsec
         base
@@ -695342,8 +697078,8 @@ self: {
       pname = "uuid";
       version = "1.3.16";
       sha256 = "1xhdf8zw2n2h4c0f8xf76c2gsjvldz34zgc4sn6wqpzcnk7pjihs";
-      revision = "2";
-      editedCabalFile = "1ka9hr7naddpdrnr6nfr81ansfqhgf02f0yvsddzwv3k7crc1qjl";
+      revision = "3";
+      editedCabalFile = "153pkkljg08pdv6hjdzzq67dzwy0k4c4k68ha110ak4d96iibc6r";
       libraryHaskellDepends = [
         base
         binary
@@ -695563,8 +697299,8 @@ self: {
       pname = "uuid-types";
       version = "1.0.6";
       sha256 = "0zimp0v7hx073rcb4y9l463jfg4y3yqxdbmw975d6vrx919xj3by";
-      revision = "2";
-      editedCabalFile = "0gg1mr480k5y5q92a1p9ii8vs8i4m3719yaaa8lvi7391c88rrw8";
+      revision = "3";
+      editedCabalFile = "183dz7p96r7da14064xkvdzxs66gzlxi26xca5m6yrypm20vdhjs";
       libraryHaskellDepends = [
         base
         binary
@@ -697361,8 +699097,8 @@ self: {
     }:
     mkDerivation {
       pname = "vary";
-      version = "0.1.1.1";
-      sha256 = "0qqhsld11qbv9d5rai2gkglb25jihkzcr0vif6x32njy27q1irb2";
+      version = "0.1.1.2";
+      sha256 = "1snil2rmlhbjrlazjycririwr9w4irznf5g4mgmjadb0xny9gwyx";
       libraryHaskellDepends = [
         aeson
         base
@@ -700084,6 +701820,8 @@ self: {
       pname = "verset";
       version = "0.0.1.9";
       sha256 = "1ygsqr6qhcfv71v0jgbh17ayrg1fkf63dl851zl3p745jjr2sxk2";
+      revision = "1";
+      editedCabalFile = "01dlq868938286b8a6ydvffzxaab9q8vg88mcavq25b6hfpr4ca1";
       libraryHaskellDepends = [
         base
         bytestring
@@ -700419,8 +702157,8 @@ self: {
     }:
     mkDerivation {
       pname = "vext";
-      version = "0.1.6.0";
-      sha256 = "1kf9yvpwf9pnqap11pirk6k5y7mw52a4xlvl7qpsnr7vbs1gilyl";
+      version = "0.1.7.0";
+      sha256 = "0ynwgb2d3xs6qn99qhdz417p1pjc6y1mjllk6v17rvxiim88yd36";
       libraryHaskellDepends = [
         base
         natural-arithmetic
@@ -708963,6 +710701,7 @@ self: {
       ];
       description = "Warp based on QUIC";
       license = lib.licenses.bsd3;
+      hydraPlatforms = lib.platforms.none;
     }
   ) { };
 
@@ -709410,8 +711149,8 @@ self: {
     }:
     mkDerivation {
       pname = "waterfall-cad";
-      version = "0.4.0.0";
-      sha256 = "062q7ip6ifk8si1nk0brmbd7qh6b05xar7dds9wrjbbhz1fyjcs5";
+      version = "0.5.0.0";
+      sha256 = "0yk6wwqwzna6g8al15pdd4mqc3jpbxbvg0jrgvqfcxh86idfcixx";
       libraryHaskellDepends = [
         base
         filepath
@@ -709437,12 +711176,16 @@ self: {
       optparse-applicative,
       parsec,
       parser-combinators,
+      raw-strings-qq,
+      svg-tree,
       waterfall-cad,
+      waterfall-cad-svg,
+      xml,
     }:
     mkDerivation {
       pname = "waterfall-cad-examples";
-      version = "0.4.0.0";
-      sha256 = "046k22r5q32y21r7fpg07301x12xmc8nwj9m4xgw100sxy66vvdg";
+      version = "0.5.0.0";
+      sha256 = "1fwyxnjphfcdf3qvmvszd2k78aiscdb47x9mm17kr11l1lnbn88i";
       isLibrary = true;
       isExecutable = true;
       libraryHaskellDepends = [
@@ -709453,7 +711196,11 @@ self: {
         optparse-applicative
         parsec
         parser-combinators
+        raw-strings-qq
+        svg-tree
         waterfall-cad
+        waterfall-cad-svg
+        xml
       ];
       executableHaskellDepends = [
         base
@@ -709463,7 +711210,11 @@ self: {
         optparse-applicative
         parsec
         parser-combinators
+        raw-strings-qq
+        svg-tree
         waterfall-cad
+        waterfall-cad-svg
+        xml
       ];
       description = "Examples for Waterfall CAD, a Declarative CAD/Solid Modeling Library";
       license = lib.licenses.lgpl21Only;
@@ -709471,6 +711222,41 @@ self: {
     }
   ) { };
 
+  "waterfall-cad-svg" = callPackage (
+    {
+      mkDerivation,
+      attoparsec,
+      base,
+      JuicyPixels,
+      lens,
+      linear,
+      opencascade-hs,
+      resourcet,
+      svg-tree,
+      text,
+      waterfall-cad,
+    }:
+    mkDerivation {
+      pname = "waterfall-cad-svg";
+      version = "0.5.0.0";
+      sha256 = "1x7q7zk2kzlgchsrdybzw26hny8lpignzbm3zdk29vskhpg381fk";
+      libraryHaskellDepends = [
+        attoparsec
+        base
+        JuicyPixels
+        lens
+        linear
+        opencascade-hs
+        resourcet
+        svg-tree
+        text
+        waterfall-cad
+      ];
+      description = "Declarative CAD/Solid Modeling Library, SVG Support";
+      license = lib.licenses.lgpl21Only;
+    }
+  ) { };
+
   "wavconvert" = callPackage (
     {
       mkDerivation,
@@ -709918,6 +711704,43 @@ self: {
     }
   ) { };
 
+  "web-cookiejar" = callPackage (
+    {
+      mkDerivation,
+      attoparsec,
+      base,
+      bytestring,
+      hspec,
+      http-client,
+      QuickCheck,
+      temporary,
+      time,
+    }:
+    mkDerivation {
+      pname = "web-cookiejar";
+      version = "0.1.0.0";
+      sha256 = "0hc9cpqs2h7kcxlrvlsmqm7xxq1cdi7zax3c7md5ldbzgzwiwr28";
+      libraryHaskellDepends = [
+        attoparsec
+        base
+        bytestring
+        http-client
+        time
+      ];
+      testHaskellDepends = [
+        base
+        bytestring
+        hspec
+        http-client
+        QuickCheck
+        temporary
+        time
+      ];
+      description = "Parsing/printing of persistent web cookies";
+      license = lib.licenses.bsd3;
+    }
+  ) { };
+
   "web-css" = callPackage (
     {
       mkDerivation,
@@ -716942,8 +718765,8 @@ self: {
       pname = "wl-pprint-annotated";
       version = "0.1.0.1";
       sha256 = "1br7qyf27iza213inwhf9bm2k6in0zbmfw6w4clqlc9f9cj2nrkb";
-      revision = "3";
-      editedCabalFile = "1g6qbs7lc6ng873ql5gflg62acn3pzy17dvck2hbxj02fdnjxlbr";
+      revision = "4";
+      editedCabalFile = "0via6f17s80d2kgw5ir7ii9ahmgp5ppky7pxschx4jrj3a88rypy";
       libraryHaskellDepends = [
         base
         containers
@@ -722651,8 +724474,8 @@ self: {
     }:
     mkDerivation {
       pname = "xlsx";
-      version = "1.1.3";
-      sha256 = "1ar4lk8xcxkqd9k553sp9zzygk4lxzhah7d5z1hzj4l570mvdps4";
+      version = "1.1.4";
+      sha256 = "11n6zc5wsk491fqzyn7davml84clbpnhvdw2gwsz4vq86fy69g0s";
       libraryHaskellDepends = [
         attoparsec
         base
@@ -723728,7 +725551,6 @@ self: {
       bytestring,
       containers,
       hashable,
-      QuickCheck,
       quickcheck-instances,
       rerebase,
       tasty,
@@ -723742,8 +725564,8 @@ self: {
     }:
     mkDerivation {
       pname = "xml-parser";
-      version = "0.1.1.1";
-      sha256 = "13af7yfxn1m7clhzxsbkd6q1nr8dslv39w4hvyhca0l7adplyyw3";
+      version = "0.1.1.2";
+      sha256 = "0hhrjaqykc43b07w6yn6q59rk4z0awm9c50917kif4iqxm92z07q";
       libraryHaskellDepends = [
         attoparsec
         base
@@ -723757,8 +725579,6 @@ self: {
         xml-conduit
       ];
       testHaskellDepends = [
-        attoparsec
-        QuickCheck
         quickcheck-instances
         rerebase
         tasty
@@ -724899,8 +726719,8 @@ self: {
         }:
         mkDerivation {
           pname = "xmobar";
-          version = "0.48.1";
-          sha256 = "1infcisv7l00a4z4byjwjisg4yndk0cymibfii1c7yzyzrlvavhl";
+          version = "0.49";
+          sha256 = "0mw01jxkcvm186csg71y21zig9rkxkp304i3ym4pgr3rilhp3p5z";
           configureFlags = [
             "-fwith_alsa"
             "-fwith_conduit"
@@ -726665,8 +728485,8 @@ self: {
     { mkDerivation }:
     mkDerivation {
       pname = "xz-clib";
-      version = "5.8.0.1";
-      sha256 = "0dw7lfkgjikawycwp1nglbdak9ay57nnidac5fdakyhg2paw8fpl";
+      version = "5.8.1";
+      sha256 = "0cycldc04ffkm5kvhb9x9mjgcw9vhzlbh34idpapv9bin9b594ic";
       doHaddock = false;
       description = "LZMA/XZ clibs";
       license = lib.licenses.bsd0;
@@ -728407,6 +730227,81 @@ self: {
     }
   ) { };
 
+  "yaml-unscrambler_0_1_0_20" = callPackage (
+    {
+      mkDerivation,
+      acc,
+      attoparsec,
+      attoparsec-data,
+      attoparsec-time,
+      base,
+      base64-bytestring,
+      bytestring,
+      conduit,
+      containers,
+      foldl,
+      hashable,
+      libyaml,
+      mtl,
+      neat-interpolation,
+      quickcheck-instances,
+      rerebase,
+      scientific,
+      selective,
+      tasty,
+      tasty-hunit,
+      text,
+      text-builder,
+      time,
+      transformers,
+      unordered-containers,
+      uuid,
+      vector,
+      yaml,
+    }:
+    mkDerivation {
+      pname = "yaml-unscrambler";
+      version = "0.1.0.20";
+      sha256 = "0s73nmvmnd1gn7hvmcbpvg1l10vwlzb5xfg7ljiwbp1dsfmqyzkw";
+      libraryHaskellDepends = [
+        acc
+        attoparsec
+        attoparsec-data
+        attoparsec-time
+        base
+        base64-bytestring
+        bytestring
+        conduit
+        containers
+        foldl
+        hashable
+        libyaml
+        mtl
+        scientific
+        selective
+        text
+        text-builder
+        time
+        transformers
+        unordered-containers
+        uuid
+        vector
+        yaml
+      ];
+      testHaskellDepends = [
+        foldl
+        neat-interpolation
+        quickcheck-instances
+        rerebase
+        tasty
+        tasty-hunit
+      ];
+      description = "Flexible declarative YAML parsing toolkit";
+      license = lib.licenses.mit;
+      hydraPlatforms = lib.platforms.none;
+    }
+  ) { };
+
   "yaml2owl" = callPackage (
     {
       mkDerivation,
@@ -729297,8 +731192,8 @@ self: {
     }:
     mkDerivation {
       pname = "yaya";
-      version = "0.6.2.2";
-      sha256 = "0b6sd8rdp6qys45s2lps0nhmqbs9x63axmhh3k71y81lmzyq1cax";
+      version = "0.6.2.3";
+      sha256 = "0xvn1zbg2r40wsld55bmw5j0slc4jwdsfpsha1zijsk2zw2vz5kw";
       setupHaskellDepends = [
         base
         Cabal
@@ -729339,8 +731234,8 @@ self: {
     }:
     mkDerivation {
       pname = "yaya-containers";
-      version = "0.1.2.1";
-      sha256 = "17akwh7inlcnizhx600ydf5j6fgbl25cnwm2fr2f6rlabkxvraki";
+      version = "0.1.2.2";
+      sha256 = "05qxk350hslwwa78hqbrwvd5bzz98l7cpf5syxcfjr85v0da04x9";
       setupHaskellDepends = [
         base
         Cabal
@@ -729374,8 +731269,8 @@ self: {
     }:
     mkDerivation {
       pname = "yaya-hedgehog";
-      version = "0.3.0.4";
-      sha256 = "13dfs72bwf6gdlbjmcfqi4hz4q2z21wmp0i5adk1arp8kgfypmf3";
+      version = "0.3.0.5";
+      sha256 = "0fsfb5gj8yri80yxax48z2z7yncg80fzlqxami13sa2pwszxfzii";
       setupHaskellDepends = [
         base
         Cabal
@@ -729412,8 +731307,8 @@ self: {
     }:
     mkDerivation {
       pname = "yaya-quickcheck";
-      version = "0.2.0.2";
-      sha256 = "13c8zyv83sik5ms2p49850jrpvhmr4wacz27ib79pbgp2lh538n9";
+      version = "0.2.0.3";
+      sha256 = "0fmy2qwqva413j89hz52pa00c7rf52qbd9z4klhavnm0w6j56bzj";
       setupHaskellDepends = [
         base
         Cabal
@@ -729479,8 +731374,8 @@ self: {
     }:
     mkDerivation {
       pname = "yaya-unsafe";
-      version = "0.4.1.3";
-      sha256 = "183hc024drdha6j8sqij9mv412yz0bc8mxv5jicg0qx3q1ldxr4y";
+      version = "0.4.1.4";
+      sha256 = "1nrwhpalhmbdzh5fj61vhfigjc1rszg1k904jw34z94xasv08qdh";
       setupHaskellDepends = [
         base
         Cabal
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index ba93166c2b664..4bbe05b0e4f0e 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -14,10 +14,12 @@
 
   # runtime dependencies
   bzip2,
+  withExpat ? true,
   expat,
   libffi,
   libuuid,
   libxcrypt,
+  withMpdecimal ? true,
   mpdecimal,
   ncurses,
   openssl,
@@ -92,6 +94,9 @@
   # tests
   testers,
 
+  # allow pythonMinimal to prevent accidental dependencies it doesn't want
+  allowedReferenceNames ? [ ],
+
 }@inputs:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -216,17 +221,21 @@ let
   buildInputs = lib.filter (p: p != null) (
     [
       bzip2
-      expat
       libffi
       libuuid
       libxcrypt
-      mpdecimal
       ncurses
       openssl
       sqlite
       xz
       zlib
     ]
+    ++ optionals withMpdecimal [
+      mpdecimal
+    ]
+    ++ optionals withExpat [
+      expat
+    ]
     ++ optionals bluezSupport [
       bluez
     ]
@@ -420,7 +429,7 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     CPPFLAGS = concatStringsSep " " (map (p: "-I${getDev p}/include") buildInputs);
     LDFLAGS = concatStringsSep " " (map (p: "-L${getLib p}/lib") buildInputs);
-    LIBS = "${optionalString (!stdenv.hostPlatform.isDarwin) "-lcrypt"}";
+    LIBS = "${optionalString (!stdenv.hostPlatform.isDarwin && libxcrypt != null) "-lcrypt"}";
     NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && !stdenv.hostPlatform.isStatic) (
       {
         "glibc" = "-lgcc_s";
@@ -436,7 +445,11 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags =
     [
       "--without-ensurepip"
+    ]
+    ++ optionals withExpat [
       "--with-system-expat"
+    ]
+    ++ optionals withMpdecimal [
       "--with-system-libmpdec"
     ]
     ++ optionals (openssl != null) [
@@ -743,6 +756,19 @@ stdenv.mkDerivation (finalAttrs: {
       buildPackages.bashNonInteractive
     ];
 
+  # Optionally set allowedReferences to guarantee minimal dependencies
+  # Allows python3Minimal to stay minimal and not have deps added by accident
+  # Doesn't do anything if allowedReferenceNames is empty (was not set)
+  ${if allowedReferenceNames != [ ] then "allowedReferences" else null} =
+    # map allowed names to their derivations
+    (map (name: inputs.${name}) allowedReferenceNames) ++ [
+      # any version of python depends on libc and libgcc
+      stdenv.cc.cc.lib
+      stdenv.cc.libc
+      # allows python referring to its own store path
+      "out"
+    ];
+
   separateDebugInfo = true;
 
   passthru = passthru // {
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index d738e391ea86b..127bc8f87912b 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -113,6 +113,10 @@
           sqlite = null;
           tzdata = null;
           libuuid = null;
+          bzip2 = null;
+          libxcrypt = null;
+          xz = null;
+          zlib = null;
           libffi = libffiBoot; # without test suite
           stripConfig = true;
           stripIdlelib = true;
@@ -124,6 +128,16 @@
           enableOptimizations = false;
           enableLTO = false;
           mimetypesSupport = false;
+          withExpat = false;
+          withMpdecimal = false;
+          /*
+            The actual 'allowedReferences' attribute is set inside the cpython derivation.
+            This is necessary in order to survive overrides of dependencies.
+          */
+          allowedReferenceNames = [
+            "bashNonInteractive"
+            "libffi"
+          ];
         }
         // sources.python312
       )).overrideAttrs
diff --git a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
index bbdc066d48b24..84643a3b50ca7 100644
--- a/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pytest-check-hook.sh
@@ -38,7 +38,8 @@ function pytestCheckPhase() {
         else
             # The `|| kill "$$"` trick propagates the errors from the process substitutiton subshell,
             # which is suggested by a StackOverflow answer: https://unix.stackexchange.com/a/217643
-            readarray -t -O"${#flagsArray[@]}" flagsArray < <(@pythonCheckInterpreter@ - "$path" <<EOF || kill "$$")
+            readarray -t -O"${#flagsArray[@]}" flagsArray < <(
+                @pythonCheckInterpreter@ - "$path" <<EOF || kill "$$"
 import glob
 import sys
 path_glob=sys.argv[1]
@@ -50,6 +51,7 @@ if not len(path_expanded):
 for path in path_expanded:
     print(path)
 EOF
+            )
         fi
     done
 
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index a77eddf07c78d..e921e2977f0e7 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.6.6";
+  version = "3.6.8";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-tGQv4WWY+5PUDWvN6faSUN68DxMjjK1BCnUFwM90Da0=";
+    hash = "sha256-2lNAtCuj3cXt5Ka5SP+ltAnUjLEZ4pN+J+TAsTv5w5A=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/appstream/default.nix b/pkgs/development/libraries/appstream/default.nix
index 26c5588843c2a..4e7f13732ef35 100644
--- a/pkgs/development/libraries/appstream/default.nix
+++ b/pkgs/development/libraries/appstream/default.nix
@@ -23,7 +23,6 @@
   libxmlb,
   libyaml,
   gobject-introspection,
-  pcre,
   itstool,
   gperf,
   vala,
@@ -109,7 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs =
     [
       libstemmer
-      pcre
       glib
       xapian
       libxml2
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 9167e7b08c611..044070d64f6ec 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -233,6 +233,13 @@ stdenv.mkDerivation {
         relative = "include";
         hash = "sha256-9JvKQOAB19wQpWLNAhuB9eL8qKqXWTQHAJIXdLYMNG8=";
       })
+      # Fixes ABI detection on some platforms (like loongarch64)
+      (fetchpatch {
+        url = "https://github.com/boostorg/context/commit/63996e427b4470c7b99b0f4cafb94839ea3670b6.patch";
+        stripLen = 1;
+        extraPrefix = "libs/context/";
+        hash = "sha256-Z8uw2+4IEybqVcU25i/0XJKS16hi/+3MXUxs53ghjL0=";
+      })
     ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/gcr/4.nix b/pkgs/development/libraries/gcr/4.nix
index f12fb0fe030f5..33e85811a8f8b 100644
--- a/pkgs/development/libraries/gcr/4.nix
+++ b/pkgs/development/libraries/gcr/4.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gcr";
-  version = "4.3.1";
+  version = "4.4.0.1";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gcr/${lib.versions.majorMinor finalAttrs.version}/gcr-${finalAttrs.version}.tar.xz";
-    hash = "sha256-svBw//GEDu9wVGoovoAjVCfBFqrcWTtbaMzIab46oJ0=";
+    hash = "sha256-DDw0Hkn59PJTKkiEUJgEGQoMJmPmEgNguymMXRdKgJg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/glibmm/2.68.nix b/pkgs/development/libraries/glibmm/2.68.nix
index 2bea3af219c23..be8ea25ae8acc 100644
--- a/pkgs/development/libraries/glibmm/2.68.nix
+++ b/pkgs/development/libraries/glibmm/2.68.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "glibmm";
-  version = "2.82.0";
+  version = "2.84.0";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-OGhM/zFyc2FcZ7j6mAbxYpnVHlUG2bkJuuFbWJ+pnLY=";
+    hash = "sha256-Vu5fUcis/Ar99GlZMW5MhVTLUO0ra8XOOJ2XnLtkJQk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/glibmm/default.nix b/pkgs/development/libraries/glibmm/default.nix
index 317de19f67036..30cb8d74d73b7 100644
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "glibmm";
-  version = "2.66.7";
+  version = "2.66.8";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-/gLB5fWCWUDYK1a27DGhLAbAXBWDz+Yvk00HY+HlQrM=";
+    hash = "sha256-ZPEdO5WiTiqNQWbs/1GHMPeezCciLvQfr3x+A0D8kyk=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gobject-introspection/0001-scanner-Prefer-some-getters-over-others.patch b/pkgs/development/libraries/gobject-introspection/0001-scanner-Prefer-some-getters-over-others.patch
new file mode 100644
index 0000000000000..437e4cd0a7a40
--- /dev/null
+++ b/pkgs/development/libraries/gobject-introspection/0001-scanner-Prefer-some-getters-over-others.patch
@@ -0,0 +1,92 @@
+From 7b2d3699ad117199bc316c7007cc5984c3b09368 Mon Sep 17 00:00:00 2001
+From: Maximiliano Sandoval <msandova@gnome.org>
+Date: Thu, 20 Mar 2025 22:52:54 +0100
+Subject: [PATCH] scanner: Prefer some getters over others
+
+At the moment the current set of heuristics to determine a getter for a
+property is good for finding *a* getter. However, if there are multiple
+candidates we might declare the wrong method as a getter.
+
+We introduce a priority system to determine which getter candidate is
+the most appropriate as the getter. The weight were chosen with gaps in
+between so that new and better heuristics have space to thrive.
+
+For a property named `p`, these are the possible getter candidates:
+
+ - A method declared via the `(getter p)` annotation
+ - The method `get_p`
+ - The method `is_p`
+ - The method `p`
+
+we declare the getter to be the first candidate in the list for which a
+method of the same name is available.
+
+See https://gitlab.gnome.org/GNOME/gjs/-/issues/681.
+---
+ giscanner/maintransformer.py | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/giscanner/maintransformer.py b/giscanner/maintransformer.py
+index a81b1777..9aaf2578 100644
+--- a/giscanner/maintransformer.py
++++ b/giscanner/maintransformer.py
+@@ -1612,7 +1612,10 @@ method or constructor of some type."""
+             if not prop.introspectable:
+                 continue
+             setter = None
+-            getter = []
++            # They keys are method names of candidates for getters. The values
++            # are priority weights that measure how tasteful was the heuristic
++            # used to propose their candidate.
++            getter = {}
+             if prop.setter is None:
+                 if prop.writable and not prop.construct_only:
+                     setter = 'set_' + normalized_name
+@@ -1620,17 +1623,17 @@ method or constructor of some type."""
+                 setter = prop.setter
+             if prop.getter is None:
+                 if prop.readable:
+-                    getter = ['get_' + normalized_name]
++                    getter[f"get_{normalized_name}"] = 50
+                     # Heuristic: boolean properties can have getters that are
+                     # prefixed by is_property_name, like: gtk_window_is_maximized()
+                     if prop.type.is_equiv(ast.TYPE_BOOLEAN) and not normalized_name.startswith("is_"):
+-                        getter.append(f"is_{normalized_name}")
++                        getter[f"is_{normalized_name}"] = 25
+                     # Heuristic: read-only properties can have getters that are
+                     # just the property name, like: gtk_widget_has_focus()
+                     if not prop.writable and prop.type.is_equiv(ast.TYPE_BOOLEAN):
+-                        getter.append(normalized_name)
++                        getter[normalized_name] = 10
+             else:
+-                getter = [prop.getter]
++                getter[prop.getter] = 99
+             for method in node.methods:
+                 if not method.introspectable:
+                     continue
+@@ -1645,7 +1648,7 @@ method or constructor of some type."""
+                         method.set_property = prop.name
+                     prop.setter = method.name
+                     continue
+-                if getter is not [] and method.name in getter:
++                if getter is not {} and method.name in getter:
+                     if method.get_property is None:
+                         method.get_property = prop.name
+                     elif method.get_property != prop.name:
+@@ -1654,7 +1657,12 @@ method or constructor of some type."""
+                                           "mismatched '(get-property %s)' annotation" %
+                                           (method.symbol, prop.name, method.get_property))
+                         method.get_property = prop.name
+-                    prop.getter = method.name
++                    # Check the priority of the last matching getter
++                    current_priority = -1
++                    if current_getter := prop.getter:
++                        current_priority = getter.get(current_getter, -1)
++                    if getter[method.name] >= current_priority:
++                        prop.getter = method.name
+                     continue
+ 
+     def _pass_member_numeric_name(self, node):
+-- 
+2.48.1
+
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 38030d5a87d9b..379560c263eaf 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -43,7 +43,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gobject-introspection";
-  version = "1.82.0";
+  version = "1.84.0";
 
   # outputs TODO: share/gobject-introspection-1.0/tests is needed during build
   # by pygobject3 (and maybe others), but it's only searched in $out
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gobject-introspection/${lib.versions.majorMinor finalAttrs.version}/gobject-introspection-${finalAttrs.version}.tar.xz";
-    hash = "sha256-D1pMGQhCS/JrxB6TYRaMNjaFCA+9uHoZbIkchAHKLwk=";
+    hash = "sha256-lFtX2n7CYuXCZrieCR0UvoAMxCQnfYKgKHK315SoR3k=";
   };
 
   patches =
@@ -69,13 +69,9 @@ stdenv.mkDerivation (finalAttrs: {
         inherit nixStoreDir;
       })
 
-      # Add _Complex support for glibc-2.41:
-      #   https://gitlab.gnome.org/GNOME/gobject-introspection/-/issues/519
-      (fetchpatch {
-        name = "complex-clang.patch";
-        url = "https://gitlab.gnome.org/GNOME/gobject-introspection/-/commit/2812471365c75ab51347a9101771128f8ab283ab.patch";
-        hash = "sha256-MR0tCOVfoAAPUIlT/Y8IYWiz48j1EnhNjUBzvsCUsEI=";
-      })
+      # Fix getter heuristics regression
+      # https://gitlab.gnome.org/GNOME/gobject-introspection/-/merge_requests/529
+      ./0001-scanner-Prefer-some-getters-over-others.patch
     ]
     ++ lib.optionals x11Support [
       # Hardcode the cairo shared library path in the Cairo gir shipped with this package.
diff --git a/pkgs/development/libraries/gssdp/1.6.nix b/pkgs/development/libraries/gssdp/1.6.nix
index 004e9c3dfce9f..caab2b7c865d9 100644
--- a/pkgs/development/libraries/gssdp/1.6.nix
+++ b/pkgs/development/libraries/gssdp/1.6.nix
@@ -7,7 +7,8 @@
   pkg-config,
   gobject-introspection,
   vala,
-  pandoc,
+  buildPackages,
+  enableManpages ? buildPackages.pandoc.compiler.bootstrapAvailable,
   gi-docgen,
   python3,
   libsoup_3,
@@ -41,10 +42,9 @@ stdenv.mkDerivation rec {
     pkg-config
     gobject-introspection
     vala
-    pandoc
     gi-docgen
     python3
-  ];
+  ] ++ lib.optionals enableManpages [ buildPackages.pandoc ];
 
   buildInputs = [
     libsoup_3
@@ -57,6 +57,7 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Dgtk_doc=true"
     "-Dsniffer=false"
+    (lib.mesonBool "manpages" enableManpages)
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index eab5dbffd8ca4..6ec90928417da 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -20,6 +20,7 @@
   opencvSupport ? false,
   opencv4,
   faad2,
+  lcevcdecSupport ? lib.meta.availableOn stdenv.hostPlatform lcevcdec,
   lcevcdec,
   ldacbt,
   liblc3,
@@ -174,7 +175,6 @@ stdenv.mkDerivation (finalAttrs: {
       curl.dev
       fdk_aac
       gsm
-      lcevcdec
       libaom
       libdc1394
       libde265
@@ -265,6 +265,9 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals guiSupport [
       gtk3
     ]
+    ++ lib.optionals lcevcdecSupport [
+      lcevcdec
+    ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       apple-sdk_gstreamer
     ];
@@ -321,6 +324,7 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.mesonEnable "openh264" openh264Support)
       (lib.mesonEnable "doc" enableDocumentation)
       (lib.mesonEnable "directfb" false)
+      (lib.mesonEnable "lcevcdecoder" lcevcdecSupport)
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
       "-Ddoc=disabled" # needs gstcuda to be enabled which is Linux-only
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 297dfa0f08842..9204d8dacabc1 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -4,7 +4,6 @@
   buildPackages,
   replaceVars,
   fetchurl,
-  fetchpatch,
   pkg-config,
   docutils,
   gettext,
@@ -69,7 +68,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk4";
-  version = "4.16.12";
+  version = "4.18.5";
 
   outputs = [
     "out"
@@ -83,21 +82,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   src = fetchurl {
-    url =
-      with finalAttrs;
-      "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    hash = "sha256-7zG9vW8ILEQBY0ogyFCwBQyb8lLvHgeXZO6VoqDEyVo=";
+    url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor finalAttrs.version}/gtk-${finalAttrs.version}.tar.xz";
+    hash = "sha256-u1JnoGL1k2lH00yZmTkKZ0sLKw2Ko0cv4NBeIGSVWrw=";
   };
 
-  patches = [
-    # Fix rendering glitches on vulkan drivers which do not support mipmaps for VK_IMAGE_TILING_LINEAR (Asahi Honeykrisp)
-    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/8058
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/c9a3cdd396c5646382612ed25e93bb5f9664d043.patch";
-      hash = "sha256-K774FFu6eyyjnxBTy7oTDygkh8+7qp5/KssHkyEwRR8=";
-    })
-  ];
-
   depsBuildBuild = [
     pkg-config
   ];
@@ -272,7 +260,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Wrap demos
   postFixup =
     lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-      demos=(gtk4-demo gtk4-demo-application gtk4-icon-browser gtk4-widget-factory)
+      demos=(gtk4-demo gtk4-demo-application gtk4-widget-factory)
 
       for program in ''${demos[@]}; do
         wrapProgram $dev/bin/$program \
diff --git a/pkgs/development/libraries/gtkmm/3.x.nix b/pkgs/development/libraries/gtkmm/3.x.nix
index b3dcf101f559e..16f0af7325528 100644
--- a/pkgs/development/libraries/gtkmm/3.x.nix
+++ b/pkgs/development/libraries/gtkmm/3.x.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkmm";
-  version = "3.24.9";
+  version = "3.24.10";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "MNW/5ARXHOVmqOk4yLrBdXZCDrUI8eJXg32mPxStRM4=";
+    sha256 = "erfiJmgIcW4mw5kkrOH7RtqGwX7znZiWJMQjFLMrWnY=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gtkmm/4.x.nix b/pkgs/development/libraries/gtkmm/4.x.nix
index f6e13a8c84a95..3ddf4bc885026 100644
--- a/pkgs/development/libraries/gtkmm/4.x.nix
+++ b/pkgs/development/libraries/gtkmm/4.x.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkmm";
-  version = "4.16.0";
+  version = "4.18.0";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-OyP9Or+PsiOwDpmDtgEK8tuA44yJq2mUuLYjCqhdYPk=";
+    hash = "sha256-LuMcFUefxNjpWLA8i1+7yOF7wSLCovVESXtOBWGeM+w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gtksourceview/5.x.nix b/pkgs/development/libraries/gtksourceview/5.x.nix
index 8633f7f709c1f..433dca535864a 100644
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
-  version = "5.14.2";
+  version = "5.16.0";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtksourceview/${lib.versions.majorMinor finalAttrs.version}/gtksourceview-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Gm04emgHX4rv1OdSz0hxd8SmgjsU/4pDSYaFiurvYmQ=";
+    hash = "sha256-qzXUIBAvPosFXdO4ZC06SCCfiIGJ5iVND/tLan6MNWY=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/jemalloc/default.nix b/pkgs/development/libraries/jemalloc/default.nix
index b6ad34e05f405..7c70a5c69c684 100644
--- a/pkgs/development/libraries/jemalloc/default.nix
+++ b/pkgs/development/libraries/jemalloc/default.nix
@@ -50,8 +50,6 @@ stdenv.mkDerivation rec {
     automake
   ];
 
-  preConfigure = "";
-
   # TODO: switch to autoreconfHook when updating beyond 5.3.0
   # https://github.com/jemalloc/jemalloc/issues/2346
   configureScript = "./autogen.sh";
diff --git a/pkgs/development/libraries/kf5gpgmepp/default.nix b/pkgs/development/libraries/kf5gpgmepp/default.nix
index 5a4a7d70e0229..826a2f25f3c63 100644
--- a/pkgs/development/libraries/kf5gpgmepp/default.nix
+++ b/pkgs/development/libraries/kf5gpgmepp/default.nix
@@ -20,13 +20,15 @@ mkDerivation {
   };
 
   buildInputs = [
-    extra-cmake-modules
     qtbase
     boost
   ];
   propagatedBuildInputs = [ gpgme ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
 
   meta = with lib; {
     license = [ licenses.lgpl2 ];
diff --git a/pkgs/development/libraries/libgnome-games-support/2.0.nix b/pkgs/development/libraries/libgnome-games-support/2.0.nix
index 27f69a5bf1e19..e0fc4f0d6c622 100644
--- a/pkgs/development/libraries/libgnome-games-support/2.0.nix
+++ b/pkgs/development/libraries/libgnome-games-support/2.0.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libgnome-games-support";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "U4Ifb+Mu3cue7zMk9kaqrIPMbT3gk339XyZkcNRT0qQ=";
+    sha256 = "AYbyXEiSyGx+rEOjB/wZ22lt9PGayn9U6DwiHfnZeQo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libpeas/2.x.nix b/pkgs/development/libraries/libpeas/2.x.nix
index 6d892a148734f..5ea842c86ce1f 100644
--- a/pkgs/development/libraries/libpeas/2.x.nix
+++ b/pkgs/development/libraries/libpeas/2.x.nix
@@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libpeas";
-  version = "2.0.5";
+  version = "2.0.7";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-N28vc9cxtU4T3bqx2Rtjgs9qmAUk3vRN9irdFUid5t0=";
+    hash = "sha256-HpqdaXYdIQnv9bfBHYyWtIZ8z6yiuSHt7UlAEZJ2nsk=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index e0f125a2feabf..461b2388b44c7 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libsoup";
-  version = "3.6.4";
+  version = "3.6.5";
 
   outputs = [
     "out"
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-m1THb1J2sFvryvK2wqFBoYj8e7HQYk7aJZ2sE6ZmXIo=";
+    hash = "sha256-aJF2Wqw+lJAXlFw+rr2MyCFt93JFbcn0YJdvvbetojQ=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/mbedtls/generic.nix b/pkgs/development/libraries/mbedtls/generic.nix
index 0b5082fe96f8c..e986ea51ecb6e 100644
--- a/pkgs/development/libraries/mbedtls/generic.nix
+++ b/pkgs/development/libraries/mbedtls/generic.nix
@@ -38,6 +38,9 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
+  # trivialautovarinit on clang causes test failures
+  hardeningDisable = lib.optional stdenv.cc.isClang "trivialautovarinit";
+
   postConfigure = lib.optionalString enableThreading ''
     perl scripts/config.pl set MBEDTLS_THREADING_C    # Threading abstraction layer
     perl scripts/config.pl set MBEDTLS_THREADING_PTHREAD    # POSIX thread wrapper layer for the threading layer.
diff --git a/pkgs/development/libraries/mesa/gbm-header.patch b/pkgs/development/libraries/mesa/gbm-header.patch
deleted file mode 100644
index e7811db3e4fb3..0000000000000
--- a/pkgs/development/libraries/mesa/gbm-header.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/gbm/meson.build b/src/gbm/meson.build
-index eaed028d049..1a826c8792d 100644
---- a/src/gbm/meson.build
-+++ b/src/gbm/meson.build
-@@ -43,7 +43,7 @@ if with_tests
-   test('gbm-abi-check', abi_check, suite : ['gbm'])
- endif
- 
--install_headers('main/gbm.h')
-+install_headers('main/gbm.h', 'main/gbm_backend_abi.h')
- 
- pkg.generate(
-   name : 'gbm',
diff --git a/pkgs/development/libraries/mesa/gbm.nix b/pkgs/development/libraries/mesa/gbm.nix
index 92b26b2a74da2..af461413c200a 100644
--- a/pkgs/development/libraries/mesa/gbm.nix
+++ b/pkgs/development/libraries/mesa/gbm.nix
@@ -20,23 +20,16 @@ stdenv.mkDerivation rec {
 
   # We don't use the versions from common.nix, because libgbm is a world rebuild,
   # so the updates need to happen separately on staging.
-  version = "25.0.1";
+  version = "25.1.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-9D4d7EEdZysvXDRcmpbyt85Lo64sldNRomp6/HUVORo=";
+    hash = "sha256-UlI+6OMUj5F6uVAw+Mg2wOZrjfdRq73d1qufaXVI/go";
   };
 
-  # Install gbm_backend_abi.h header - this is to simplify future iteration
-  # on building Mesa and friends with system libgbm.
-  # See also:
-  # - https://github.com/NixOS/nixpkgs/pull/387292
-  # - https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/33890
-  patches = [ ./gbm-header.patch ];
-
   mesonAutoFeatures = "disabled";
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/mesa/headers.nix b/pkgs/development/libraries/mesa/headers.nix
index e5447aafa3ce9..5c8fd735197ef 100644
--- a/pkgs/development/libraries/mesa/headers.nix
+++ b/pkgs/development/libraries/mesa/headers.nix
@@ -16,14 +16,14 @@ stdenv.mkDerivation rec {
   pname = "mesa-gl-headers";
 
   # These are a bigger rebuild and don't change often, so keep them separate.
-  version = "25.0.1";
+  version = "25.1.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-9D4d7EEdZysvXDRcmpbyt85Lo64sldNRomp6/HUVORo=";
+    hash = "sha256-UlI+6OMUj5F6uVAw+Mg2wOZrjfdRq73d1qufaXVI/go";
   };
 
   dontBuild = true;
diff --git a/pkgs/development/libraries/nuspell/default.nix b/pkgs/development/libraries/nuspell/default.nix
index f2e7309b09edf..92a9a6b0e3996 100644
--- a/pkgs/development/libraries/nuspell/default.nix
+++ b/pkgs/development/libraries/nuspell/default.nix
@@ -3,10 +3,11 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  pandoc,
+  buildPackages,
   pkg-config,
   icu,
   catch2_3,
+  enableManpages ? buildPackages.pandoc.compiler.bootstrapAvailable,
 }:
 
 stdenv.mkDerivation rec {
@@ -20,15 +21,27 @@ stdenv.mkDerivation rec {
     hash = "sha256-U/lHSxpKsBnamf4ikE2aIjEPSU5fxjtuSmhZR0jxMAI=";
   };
 
-  nativeBuildInputs = [
-    cmake
-    pandoc
-    pkg-config
-  ];
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+    ]
+    ++ lib.optionals enableManpages [
+      buildPackages.pandoc
+    ];
+
   buildInputs = [ catch2_3 ];
+
   propagatedBuildInputs = [ icu ];
 
-  cmakeFlags = [ "-DBUILD_TESTING=YES" ];
+  cmakeFlags =
+    [
+      "-DBUILD_TESTING=YES"
+    ]
+    ++ lib.optionals (!enableManpages) [
+      "-DBUILD_DOCS=OFF"
+    ];
+
   doCheck = true;
 
   outputs = [
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index 3b2bf4c6191b1..6b59332bb3b45 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pango";
-  version = "1.56.2";
+  version = "1.56.3";
 
   outputs = [
     "bin"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/pango/${lib.versions.majorMinor finalAttrs.version}/pango-${finalAttrs.version}.tar.xz";
-    hash = "sha256-A7ev1+1zC+9lEVXL+1MgVWuO+SsNwEq7uXhNzUBXr+c=";
+    hash = "sha256-JgYlK8Jc2NJOG39+ksOicrN6zWc0NHtztHpIKDS6JJE=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/polkit-qt-1/default.nix b/pkgs/development/libraries/polkit-qt-1/default.nix
index ff18b348a592f..7d1d8a9d9e923 100644
--- a/pkgs/development/libraries/polkit-qt-1/default.nix
+++ b/pkgs/development/libraries/polkit-qt-1/default.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   lib,
   mkDerivation,
   fetchurl,
@@ -7,10 +6,6 @@
   pkg-config,
   polkit,
   glib,
-  pcre,
-  libselinux,
-  libsepol,
-  util-linux,
 }:
 
 mkDerivation rec {
@@ -18,7 +13,7 @@ mkDerivation rec {
   version = "0.114.0";
 
   src = fetchurl {
-    url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
+    url = "mirror://kde/stable/polkit-qt-1/polkit-qt-1-${version}.tar.xz";
     sha256 = "sha256-LrDyJEWIgpX/or+8DDaThHoPlzu2sMPkzOAhi+fjkH4=";
   };
 
@@ -27,21 +22,14 @@ mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      glib
-      pcre
-      polkit
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      libselinux
-      libsepol
-      util-linux
-    ];
+  buildInputs = [
+    glib
+    polkit
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "Qt wrapper around PolKit";
-    maintainers = with maintainers; [ ttuegel ];
-    platforms = platforms.linux;
+    maintainers = with lib.maintainers; [ ttuegel ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/protobuf/25.nix b/pkgs/development/libraries/protobuf/25.nix
index 908252beab261..9dafc4b2a40cc 100644
--- a/pkgs/development/libraries/protobuf/25.nix
+++ b/pkgs/development/libraries/protobuf/25.nix
@@ -2,8 +2,8 @@
 
 callPackage ./generic.nix (
   {
-    version = "25.6";
-    hash = "sha256-pXZGffQXjAUXworfcr75BrkADamC9pKZXNK0l/Bvk9g=";
+    version = "25.7";
+    hash = "sha256-tCl37I/6iXtfGPw/HVZYdudJWYdzPfnN7piLDpR/bgk=";
   }
   // args
 )
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 296a4aa1bb9f0..aede030f58f1c 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -54,6 +54,11 @@ let
       ./qtbase.patch.d/0009-qtbase-qtpluginpath.patch
       ./qtbase.patch.d/0010-qtbase-assert.patch
       ./qtbase.patch.d/0011-fix-header_module.patch
+      (fetchpatch {
+        name = "0012-qtbase-loongarch64.patch";
+        url = "https://gitlab.alpinelinux.org/alpine/aports/-/raw/81b14ae4eed038662b53cd20786fd5e0816279ec/community/qt5-qtbase/loongarch64.patch";
+        hash = "sha256-BnpejF6/L73kVVts0R0/OMbVN8G4DXVFwBMJPLU9QbE=";
+      })
     ];
     qtdeclarative = [
       ./qtdeclarative.patch
@@ -168,7 +173,14 @@ let
         hash = "sha256-6wg/eVu9J83yvIO428U1FX3otz58tAy6pCvp7fqOBKU=";
       })
     ];
-    qtscript = [ ./qtscript.patch ];
+    qtscript = [
+      ./qtscript.patch
+      (fetchpatch {
+        name = "qtscript-loongarch64.patch";
+        url = "https://gitlab.alpinelinux.org/alpine/aports/-/raw/2fa4f3b28affc29835fcca5c75431f19ff3754a3/community/qt5-qtscript/qtscript-loongarch64.patch";
+        hash = "sha256-DUTXX20ClqGRYat8zk3/Facc1IyAw58qCXrbUaDLyiM=";
+      })
+    ];
     qtserialport = [ ./qtserialport.patch ];
     qtsystems = [
       # Fix crash if no X11 display available
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index 578137a3f3ecf..c3f084efbcedb 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -159,7 +159,12 @@ let
       qtsvg = callPackage ./modules/qtsvg.nix { };
       qtscxml = callPackage ./modules/qtscxml.nix { };
       qttools = callPackage ./modules/qttools { };
-      qttranslations = callPackage ./modules/qttranslations.nix { };
+      qttranslations = callPackage ./modules/qttranslations.nix {
+        qttools = self.qttools.override {
+          qtbase = self.qtbase.override { qttranslations = null; };
+          qtdeclarative = null;
+        };
+      };
       qtvirtualkeyboard = callPackage ./modules/qtvirtualkeyboard.nix { };
       qtwayland = callPackage ./modules/qtwayland.nix { };
       qtwebchannel = callPackage ./modules/qtwebchannel.nix { };
@@ -215,18 +220,5 @@ let
     otherSplices = generateSplicesForMkScope "qt6";
     f = addPackages;
   };
-
-  bootstrapScope = baseScope.overrideScope (
-    final: prev: {
-      qtbase = prev.qtbase.override { qttranslations = null; };
-      qtdeclarative = null;
-    }
-  );
-
-  finalScope = baseScope.overrideScope (
-    final: prev: {
-      qttranslations = bootstrapScope.qttranslations;
-    }
-  );
 in
-finalScope
+baseScope
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index 7410132dd38f4..e1c4eab6b8128 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -51,7 +51,6 @@
   libxml2,
   libxslt,
   openssl,
-  pcre,
   pcre2,
   sqlite,
   udev,
@@ -82,7 +81,6 @@
   libinput,
   # options
   qttranslations ? null,
-  fetchpatch,
 }:
 
 let
@@ -110,7 +108,6 @@ stdenv.mkDerivation rec {
       libjpeg
       libpng
       pcre2
-      pcre
       zstd
       libb2
       md4c
diff --git a/pkgs/development/libraries/qt-6/modules/qttools/default.nix b/pkgs/development/libraries/qt-6/modules/qttools/default.nix
index da5c50482588d..a2b9a36da4ee8 100644
--- a/pkgs/development/libraries/qt-6/modules/qttools/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qttools/default.nix
@@ -1,4 +1,5 @@
 {
+  pkgsBuildBuild,
   qtModule,
   stdenv,
   lib,
@@ -20,6 +21,10 @@ qtModule {
     qtbase
     qtdeclarative
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ cups ];
+  cmakeFlags = lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    "-DQt6LinguistTools_DIR=${pkgsBuildBuild.qt6.qttools}/lib/cmake/Qt6LinguistTools"
+    "-DQt6ToolsTools_DIR=${pkgsBuildBuild.qt6.qttools}/lib/cmake/Qt6ToolsTools"
+  ];
   patches = [
     ./paths.patch
   ];
diff --git a/pkgs/development/libraries/qt-6/modules/qtwayland.nix b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
index 791612abe8abe..ad5fdd6dfea93 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@@ -1,4 +1,6 @@
 {
+  pkgsBuildBuild,
+  stdenv,
   lib,
   qtModule,
   qtbase,
@@ -38,6 +40,10 @@ qtModule {
   buildInputs = [ libdrm ];
   nativeBuildInputs = [ pkg-config ];
 
+  cmakeFlags = lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    "-DQt6WaylandScannerTools_DIR=${pkgsBuildBuild.qt6.qtwayland}/lib/cmake/Qt6WaylandScannerTools"
+  ];
+
   meta = {
     platforms = lib.platforms.unix;
     badPlatforms = lib.platforms.darwin;
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index bbfacea2fdd84..e00b80d4b5ece 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wayland-protocols";
-  version = "1.42";
+  version = "1.44";
 
   doCheck =
     stdenv.hostPlatform == stdenv.buildPlatform
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/${finalAttrs.pname}/-/releases/${finalAttrs.version}/downloads/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-I7qA1BDRIAqG/ilZLBl2bq6PHDULZyiZmenn6hLZ96o=";
+    hash = "sha256-PfEQfs+L/W7oeK7KXTt6/YEkikgDHhTK9q4B8U7rtQ4=";
   };
 
   postPatch = lib.optionalString finalAttrs.finalPackage.doCheck ''
diff --git a/pkgs/development/libraries/webrtc-audio-processing/default.nix b/pkgs/development/libraries/webrtc-audio-processing/default.nix
index e2d51a9e66066..ccda7ac4af674 100644
--- a/pkgs/development/libraries/webrtc-audio-processing/default.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/default.nix
@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/community/webrtc-audio-processing-1/0001-rtc_base-Include-stdint.h-to-fix-build-failures.patch?id=625e19c19972e69e034c0870a31b375833d1ab5d";
       hash = "sha256-9nI22SJoU0H3CzsPSAObtCFTadtvkzdnqIh6mxmUuds=";
     })
+    # Add loongarch64 support
+    (fetchurl {
+      url = "https://gitlab.alpinelinux.org/alpine/aports/-/raw/0630fa25465530c0e7358f00016bdc812894f67f/community/webrtc-audio-processing-1/add-loongarch-support.patch";
+      hash = "sha256-Cn3KwKSSV/QJm1JW0pkEWB6OmeA0fRlVkiMU8OzXNzY=";
+    })
   ];
 
   outputs = [
@@ -62,6 +67,7 @@ stdenv.mkDerivation rec {
         (
           platforms.arm
           ++ platforms.aarch64
+          ++ platforms.loongarch64
           ++ platforms.mips
           ++ platforms.power
           ++ platforms.riscv
diff --git a/pkgs/development/lisp-modules/ql.nix b/pkgs/development/lisp-modules/ql.nix
index 566278b9fa077..45ad78c4f236f 100644
--- a/pkgs/development/lisp-modules/ql.nix
+++ b/pkgs/development/lisp-modules/ql.nix
@@ -75,7 +75,7 @@ let
         nativeLibs = [ pkgs.sqlite ];
       });
       cl-webkit2 = super.cl-webkit2.overrideLispAttrs (o: {
-        nativeLibs = [ pkgs.webkitgtk_4_0 ];
+        nativeLibs = [ pkgs.webkitgtk_4_1 ];
       });
       dbd-mysql = super.dbd-mysql.overrideLispAttrs (o: {
         nativeLibs = [ pkgs.mariadb.client ];
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index b6b58f4ee92ac..c24978f6d2e66 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -3491,37 +3491,6 @@ final: prev: {
     }
   ) { };
 
-  luv = callPackage (
-    {
-      buildLuarocksPackage,
-      cmake,
-      fetchurl,
-      luaOlder,
-    }:
-    buildLuarocksPackage {
-      pname = "luv";
-      version = "1.48.0-2";
-      knownRockspec =
-        (fetchurl {
-          url = "mirror://luarocks/luv-1.48.0-2.rockspec";
-          sha256 = "0353bjn9z90a1hd7rksdfrd9fbdd31hbvdaxr1fb0fh0bc1cpy94";
-        }).outPath;
-      src = fetchurl {
-        url = "https://github.com/luvit/luv/releases/download/1.48.0-2/luv-1.48.0-2.tar.gz";
-        sha256 = "0yivq14dw0vjyl8ibrgdgrj9fbhjyy4yf3m4jc15bxmlxggisfic";
-      };
-
-      disabled = luaOlder "5.1";
-      nativeBuildInputs = [ cmake ];
-
-      meta = {
-        homepage = "https://github.com/luvit/luv";
-        description = "Bare libuv bindings for lua";
-        license.fullName = "Apache 2.0";
-      };
-    }
-  ) { };
-
   lyaml = callPackage (
     {
       buildLuarocksPackage,
diff --git a/pkgs/development/lua-modules/luv/default.nix b/pkgs/development/lua-modules/luv/default.nix
new file mode 100644
index 0000000000000..61de3da4c3595
--- /dev/null
+++ b/pkgs/development/lua-modules/luv/default.nix
@@ -0,0 +1,95 @@
+{
+  lib,
+  buildLuarocksPackage,
+  cmake,
+  fetchFromGitHub,
+  libuv,
+  lua,
+  luaOlder,
+  nix-update-script,
+  runCommand,
+}:
+
+buildLuarocksPackage rec {
+  pname = "luv";
+  version = "1.50.0-1";
+
+  src = fetchFromGitHub {
+    owner = "luvit";
+    repo = "luv";
+    rev = version;
+    # Need deps/lua-compat-5.3 only
+    fetchSubmodules = true;
+    hash = "sha256-PS3+qpELpX0tr7UqrlnE4NYScJb50j+9J4fbH9CTr/s=";
+  };
+
+  # to make sure we dont use bundled deps
+  prePatch = ''
+    rm -rf deps/lua deps/luajit deps/libuv
+  '';
+
+  buildInputs = [ libuv ];
+  nativeBuildInputs = [ cmake ];
+
+  # Need to specify WITH_SHARED_LIBUV=ON cmake flag, but
+  # Luarocks doesn't take cmake variables from luarocks config.
+  # Need to specify it in rockspec. See https://github.com/luarocks/luarocks/issues/1160.
+  knownRockspec = runCommand "luv-${version}.rockspec" { } ''
+    patch ${src}/luv-scm-0.rockspec -o - > $out <<'EOF'
+    --- a/luv-scm-0.rockspec
+    +++ b/luv-scm-0.rockspec
+    @@ -1,5 +1,5 @@
+     package = "luv"
+    -version = "scm-0"
+    +version = "${version}"
+     source = {
+       url = 'git://github.com/luvit/luv.git'
+     }
+    @@ -24,6 +24,7 @@
+     build =
+       type = 'cmake',
+       variables = {
+    +     WITH_SHARED_LIBUV="ON",
+          CMAKE_C_FLAGS="$(CFLAGS)",
+          CMAKE_MODULE_LINKER_FLAGS="$(LIBFLAG)",
+          LUA_LIBDIR="$(LUA_LIBDIR)",
+    EOF
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    rm tests/test-{dns,thread,tty}.lua
+    luarocks test
+  '';
+
+  disabled = luaOlder "5.1";
+
+  passthru = {
+    tests.test =
+      runCommand "luv-${version}-test"
+        {
+          nativeBuildInputs = [ (lua.withPackages (ps: [ ps.luv ])) ];
+        }
+        ''
+          lua <<EOF
+          local uv = require("luv")
+          assert(uv.fs_mkdir(assert(uv.os_getenv("out")), 493))
+          print(uv.version_string())
+          EOF
+        '';
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    homepage = "https://github.com/luvit/luv";
+    description = "Bare libuv bindings for lua";
+    longDescription = ''
+      This library makes libuv available to lua scripts. It was made for the luvit
+      project but should usable from nearly any lua project.
+    '';
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ stasjok ];
+    platforms = lua.meta.platforms;
+  };
+}
diff --git a/pkgs/development/lua-modules/luv/lib.nix b/pkgs/development/lua-modules/luv/lib.nix
new file mode 100644
index 0000000000000..f1be88c0d6d46
--- /dev/null
+++ b/pkgs/development/lua-modules/luv/lib.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  cmake,
+  fixDarwinDylibNames,
+  isLuaJIT,
+  libuv,
+  lua,
+  stdenv,
+}:
+
+stdenv.mkDerivation {
+  pname = "libluv";
+  inherit (lua.pkgs.luv) version src meta;
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DBUILD_MODULE=OFF"
+    "-DWITH_SHARED_LIBUV=ON"
+    "-DLUA_BUILD_TYPE=System"
+    "-DWITH_LUA_ENGINE=${if isLuaJIT then "LuaJit" else "Lua"}"
+  ];
+
+  # to make sure we dont use bundled deps
+  prePatch = ''
+    rm -rf deps/lua deps/luajit deps/libuv
+  '';
+
+  buildInputs = [
+    libuv
+    lua
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+}
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index d283015303442..4bad0fb62fc88 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -15,7 +15,6 @@
   fetchFromGitHub,
   fetchpatch,
   fetchurl,
-  fixDarwinDylibNames,
   fzf,
   glib,
   glibc,
@@ -33,7 +32,6 @@
   libpsl,
   libpq,
   libuuid,
-  libuv,
   libxcrypt,
   libyaml,
   lua-language-server,
@@ -841,57 +839,6 @@ in
     '';
   });
 
-  # as advised in https://github.com/luarocks/luarocks/issues/1402#issuecomment-1080616570
-  # we shouldn't use luarocks machinery to build complex cmake components
-  libluv = stdenv.mkDerivation {
-
-    pname = "libluv";
-    inherit (prev.luv) version meta src;
-
-    cmakeFlags = [
-      "-DBUILD_SHARED_LIBS=ON"
-      "-DBUILD_MODULE=OFF"
-      "-DWITH_SHARED_LIBUV=ON"
-      "-DLUA_BUILD_TYPE=System"
-      "-DWITH_LUA_ENGINE=${if isLuaJIT then "LuaJit" else "Lua"}"
-    ];
-
-    # to make sure we dont use bundled deps
-    postUnpack = ''
-      rm -rf deps/lua deps/libuv
-    '';
-
-    buildInputs = [
-      libuv
-      final.lua
-    ];
-
-    nativeBuildInputs = [
-      pkg-config
-      cmake
-    ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
-  };
-
-  luv = prev.luv.overrideAttrs (oa: {
-
-    nativeBuildInputs = oa.nativeBuildInputs ++ [ pkg-config ];
-    buildInputs = [ libuv ];
-
-    # Use system libuv instead of building local and statically linking
-    luarocksConfig = lib.recursiveUpdate oa.luarocksConfig {
-      variables = {
-        WITH_SHARED_LIBUV = "ON";
-      };
-    };
-
-    # we unset the LUA_PATH since the hook erases the interpreter defaults (To fix)
-    # tests is not run since they are not part of the tarball anymore
-    preCheck = ''
-      unset LUA_PATH
-      rm tests/test-{dns,thread}.lua
-    '';
-  });
-
   lyaml = prev.lyaml.overrideAttrs (oa: {
     buildInputs = [
       libyaml
diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 6cf2120f1ae33..9a6fac31c3e84 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -82,6 +82,11 @@ buildPythonPackage rec {
     "'not network'"
   ];
 
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Work around "OSError: AF_UNIX path too long"
+    export TMPDIR="/tmp"
+  '';
+
   disabledTests =
     [
       # TypeError: __subprocess_run() got an unexpected keyword argument 'umask'
@@ -94,6 +99,16 @@ buildPythonPackage rec {
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # PermissionError: [Errno 1] Operation not permitted: '/dev/console'
       "test_is_block_device"
+
+      # These tests become flaky under heavy load
+      "test_asyncio_run_sync_called"
+      "test_handshake_fail"
+      "test_run_in_custom_limiter"
+      "test_cancel_from_shielded_scope"
+      "test_start_task_soon_cancel_later"
+
+      # AssertionError: assert 'wheel' == 'nixbld'
+      "test_group"
     ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/authlib/default.nix b/pkgs/development/python-modules/authlib/default.nix
index e7297058ec048..068008330ed16 100644
--- a/pkgs/development/python-modules/authlib/default.nix
+++ b/pkgs/development/python-modules/authlib/default.nix
@@ -51,11 +51,6 @@ buildPythonPackage rec {
     werkzeug
   ];
 
-  preCheck = ''
-    # httpx 0.28.0+ requires SSL_CERT_FILE or SSL_CERT_DIR
-    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
-  '';
-
   pythonImportsCheck = [ "authlib" ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/confluent-kafka/default.nix b/pkgs/development/python-modules/confluent-kafka/default.nix
index 56c6d545a2e4b..c5ae7416f29db 100644
--- a/pkgs/development/python-modules/confluent-kafka/default.nix
+++ b/pkgs/development/python-modules/confluent-kafka/default.nix
@@ -85,11 +85,6 @@ buildPythonPackage rec {
     respx
   ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
-  preCheck = ''
-    # httpx since 0.28.0+ depends on SSL_CERT_FILE
-    SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
-  '';
-
   pythonImportsCheck = [ "confluent_kafka" ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 7489f40c4ea97..d3fe21dfcd5cb 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -45,7 +45,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "4.2.20";
+  version = "4.2.21";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-RmClB0ntPzcUzsy1lKn3G5IUoNiXiYuM+/LLj0JyFfQ=";
+    hash = "sha256-GiOPIuYJAkMPW8JccJvFEoQi36rCmySHeLB7mAmg6CM=";
   };
 
   patches =
diff --git a/pkgs/development/python-modules/flask-cors/default.nix b/pkgs/development/python-modules/flask-cors/default.nix
index 6598575dc727b..658cc01ed9c96 100644
--- a/pkgs/development/python-modules/flask-cors/default.nix
+++ b/pkgs/development/python-modules/flask-cors/default.nix
@@ -3,7 +3,7 @@
   fetchFromGitHub,
   buildPythonPackage,
   flask,
-  packaging,
+  werkzeug,
   pytestCheckHook,
   setuptools,
 
@@ -14,34 +14,38 @@
 
 buildPythonPackage rec {
   pname = "flask-cors";
-  version = "5.0.0";
+  version = "5.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "corydolphin";
     repo = "flask-cors";
     tag = version;
-    hash = "sha256-DbTeq18CLuwj8lzQnpyPMEfxgR97XlF0s37wkTYd4O4=";
+    hash = "sha256-UVMZGdUpEKx5w85sSe8wSzjNYjsKPdbyBX7/QHJ3cyQ=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = [ flask ];
+  dependencies = [
+    flask
+    werkzeug
+  ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    packaging
   ];
 
   passthru.tests = {
     inherit aiobotocore moto;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Flask extension adding a decorator for CORS support";
     homepage = "https://github.com/corydolphin/flask-cors";
     changelog = "https://github.com/corydolphin/flask-cors/releases/tag/${src.tag}";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ nickcao ];
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ nickcao ];
   };
 }
diff --git a/pkgs/development/python-modules/greenlet/default.nix b/pkgs/development/python-modules/greenlet/default.nix
index 2dd2b9d8fa435..fafa97082a23e 100644
--- a/pkgs/development/python-modules/greenlet/default.nix
+++ b/pkgs/development/python-modules/greenlet/default.nix
@@ -16,12 +16,12 @@
 let
   greenlet = buildPythonPackage rec {
     pname = "greenlet";
-    version = "3.1.1";
+    version = "3.2.1";
     pyproject = true;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-TOOsbNtq33lGR11+8xd3wm2UvMw3fgcKeYa9LVxRVGc=";
+      hash = "sha256-n03UtJRrFLs78Dj4Hh0uU1t9lPGypZ/boSk82cGgpNc=";
     };
 
     build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/grpcio-channelz/default.nix b/pkgs/development/python-modules/grpcio-channelz/default.nix
index 78f834e7bde63..76b272270b616 100644
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-channelz";
-  version = "1.71.0";
+  version = "1.72.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_channelz";
     inherit version;
-    hash = "sha256-L2tmHe5rQ/9284/U+heUnzhH6oLlFdbm8h9Pz+BG7PI=";
+    hash = "sha256-Pcst8cuckF99qvCLzsIU/QgoCaWa3xQFtm1E9W7w+tE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index 5ad872743b109..7d9abbff5db8e 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -11,13 +11,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.71.0";
+  version = "1.72.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_health_checking";
     inherit version;
-    hash = "sha256-/5vVW+uXzjMi/aKuWHgcnWxvzKajXKO3Epddn3XdMK8=";
+    hash = "sha256-ciD1a8uq8IBELr7tSO5eHx0z/IT3rJuRJGiSJKtmzdw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index ed26ba7d35455..211acdcc9a2a8 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.71.0";
+  version = "1.72.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_reflection";
     inherit version;
-    hash = "sha256-UVBOl3BX/6vmbR7VVVexXpacQrs6HyjuRdcw3V+YO7U=";
+    hash = "sha256-dcS8msz4RYxjXr/UCDF7+2E2hCThIZZCogMyrfVXDf8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 2ef40c9bddc67..3ad8cf3ed9535 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -13,7 +13,7 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.71.0";
+  version = "1.72.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "grpcio_status";
     inherit version;
-    hash = "sha256-EUBf7We2j0BrPzx8WuUQSnnS0wlmbRDWGxUukdKPuWg=";
+    hash = "sha256-a2fJfb4rBmhVfX5EODTR40b1J5mdVaSRu33bJBysIcs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index 01e1c58d33de8..cb9167c3ee603 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -13,7 +13,7 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.71.0";
+  version = "1.72.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "grpcio_testing";
     inherit version;
-    hash = "sha256-eiBiYB7fSnOL+oAL+6Dh+kGMI3Kzn3a8YkSxPQLgA60=";
+    hash = "sha256-eWNd0WOrIrJfov70vHzLOm2oDox6hOOyzDynLp2xf0Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 7a09069b8912f..4a1ff2831a6f2 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.71.0";
+  version = "1.72.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_tools";
     inherit version;
-    hash = "sha256-ONuo4NXg+yOgNOCWRP3G7YYr4jcYh+7lSQGZno9nkqg=";
+    hash = "sha256-IxRK3wY/rVZlFgvNw5ciDy3CnhG33eiK5pvZZy/42ds=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index 3f2d0a76a5aa1..0b84dccda6412 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -18,14 +18,14 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.71.0";
+  version = "1.72.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-K4X3ggR1rT7ewgnT2Jp5Ca2hbKqwXT8uCKforjIApVw=";
+    hash = "sha256-Ba7pvpWKWA4WnhqomHOHvNi+btf8XCo6BItqK5EUc80=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/h11/default.nix b/pkgs/development/python-modules/h11/default.nix
index a7e4271006d77..0594cc3537a41 100644
--- a/pkgs/development/python-modules/h11/default.nix
+++ b/pkgs/development/python-modules/h11/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "h11";
-  version = "0.14.0";
+  version = "0.16.0";
   format = "setuptools";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jxn7vpnnJCD/NcALJ6NMuZN+kCqLgQ4siDAMbwo7aZ0=";
+    hash = "sha256-TjW5Vs9FeS5MqliF5p+6AL28b/r7+gIDAOVJsgjuX/E=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/httpcore/default.nix b/pkgs/development/python-modules/httpcore/default.nix
index cb1c31364ca14..8e6a4980d142d 100644
--- a/pkgs/development/python-modules/httpcore/default.nix
+++ b/pkgs/development/python-modules/httpcore/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "httpcore";
-  version = "1.0.7";
+  version = "1.0.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = "httpcore";
     tag = version;
-    hash = "sha256-hEGKYJnsTjygRu++lNrPWfx/xiUR7Cp+DTUVPa0m5fM=";
+    hash = "sha256-YtAbx0iXN7u8pMBXQBUydvAH6ilH+veklvxSh5EVFXo=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/httpx/default.nix b/pkgs/development/python-modules/httpx/default.nix
index 3d0041508d8fc..e63970de31185 100644
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@@ -108,6 +108,10 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
+  # stdenv's fake SSL_CERT_FILE breaks default http transport constructor with:
+  # FileNotFoundError: [Errno 2] No such file or directory
+  setupHook = ./setup-hook.sh;
+
   meta = with lib; {
     changelog = "https://github.com/encode/httpx/blob/${src.rev}/CHANGELOG.md";
     description = "Next generation HTTP client";
diff --git a/pkgs/development/python-modules/httpx/setup-hook.sh b/pkgs/development/python-modules/httpx/setup-hook.sh
new file mode 100644
index 0000000000000..7e9ced07b69c5
--- /dev/null
+++ b/pkgs/development/python-modules/httpx/setup-hook.sh
@@ -0,0 +1,5 @@
+httpxSslCertFileUnset() {
+    unset SSL_CERT_FILE
+}
+
+postHooks+=(httpxSslCertFileUnset)
diff --git a/pkgs/development/python-modules/hypercorn/default.nix b/pkgs/development/python-modules/hypercorn/default.nix
index 30f4d0f0cbabe..a91d4704c1921 100644
--- a/pkgs/development/python-modules/hypercorn/default.nix
+++ b/pkgs/development/python-modules/hypercorn/default.nix
@@ -58,11 +58,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
-  preCheck = ''
-    # httpx since 0.28.0+ depends on SSL_CERT_FILE
-    SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
-  '';
-
   __darwinAllowLocalNetworking = true;
 
   pythonImportsCheck = [ "hypercorn" ];
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 1bf8fa98be5ee..6c97e9b54b549 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   version = "6.130.12";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "HypothesisWorks";
@@ -66,20 +66,40 @@ buildPythonPackage rec {
 
   inherit doCheck;
 
-  # This file changes how pytest runs and breaks it
+  # tox.ini changes how pytest runs and breaks it.
+  # Activate the CI profile (similar to setupHook below)
+  # by setting HYPOTHESIS_PROFILE [1].
+  #
+  # [1]: https://github.com/HypothesisWorks/hypothesis/blob/hypothesis-python-6.130.9/hypothesis-python/tests/common/setup.py#L78
   preCheck = ''
     rm tox.ini
+    export HYPOTHESIS_PROFILE=ci
   '';
 
   pytestFlagsArray = [ "tests/cover" ];
 
+  # Hypothesis by default activates several "Health Checks", including one that fires if the builder is "too slow".
+  # This check is disabled [1] if Hypothesis detects a CI environment, i.e. either `CI` or `TF_BUILD` is defined [2].
+  # We set `CI=1` here using a setup hook to avoid spurious failures [3].
+  #
+  # Example error message for reference:
+  # hypothesis.errors.FailedHealthCheck: Data generation is extremely slow: Only produced 2 valid examples in 1.28 seconds (1 invalid ones and 0 exceeded maximum size). Try decreasing size of the data you're generating (with e.g. max_size or max_leaves parameters).
+  #
+  # [1]: https://github.com/HypothesisWorks/hypothesis/blob/hypothesis-python-6.130.9/hypothesis-python/src/hypothesis/_settings.py#L816-L828
+  # [2]: https://github.com/HypothesisWorks/hypothesis/blob/hypothesis-python-6.130.9/hypothesis-python/src/hypothesis/_settings.py#L756
+  # [3]: https://github.com/NixOS/nixpkgs/issues/393637
+  setupHook = ./setup-hook.sh;
+
   disabledTests =
     [
       # racy, fails to find a file sometimes
       "test_recreate_charmap"
       "test_uses_cached_charmap"
-      # fails if builder is too slow
-      "test_can_run_with_no_db"
+      # fail when using CI profile
+      "test_given_does_not_pollute_state"
+      "test_find_does_not_pollute_state"
+      "test_does_print_on_reuse_from_database"
+      "test_prints_seed_only_on_healthcheck"
       # calls script with the naked interpreter
       "test_constants_from_running_file"
     ]
@@ -122,14 +142,16 @@ buildPythonPackage rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Library for property based testing";
     mainProgram = "hypothesis";
     homepage = "https://github.com/HypothesisWorks/hypothesis";
     changelog = "https://hypothesis.readthedocs.io/en/latest/changes.html#v${
       lib.replaceStrings [ "." ] [ "-" ] version
     }";
-    license = licenses.mpl20;
-    maintainers = [ ];
+    license = lib.licenses.mpl20;
+    maintainers = [
+      lib.maintainers.fliegendewurst
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/hypothesis/setup-hook.sh b/pkgs/development/python-modules/hypothesis/setup-hook.sh
new file mode 100644
index 0000000000000..90986ac8bff97
--- /dev/null
+++ b/pkgs/development/python-modules/hypothesis/setup-hook.sh
@@ -0,0 +1,5 @@
+hypothesisActivateProfileForCI() {
+    export CI=1
+}
+
+postHooks+=(hypothesisActivateProfileForCI)
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 7f6365975198d..a07ce0269f45c 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -11,7 +11,6 @@
 
   # Runtime dependencies
   decorator,
-  exceptiongroup,
   ipython-pygments-lexers,
   jedi,
   matplotlib-inline,
@@ -23,14 +22,7 @@
   typing-extensions,
 
   # Optional dependencies
-  ipykernel,
-  ipyparallel,
-  ipywidgets,
   matplotlib,
-  nbconvert,
-  nbformat,
-  notebook,
-  qtconsole,
 
   # Reverse dependency
   sage,
@@ -44,42 +36,29 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "9.0.2";
+  version = "9.2.0";
   pyproject = true;
-  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7HtHnj5WVr9PWMZSwSBJTfGCD08o9SL7fKCeITwqq1I=";
+    hash = "sha256-Yqk3PbwS8o+f6vRwDQUhlb+JgGJ5/IyhHz9UAX0EdRs=";
   };
 
   build-system = [ setuptools ];
 
-  dependencies =
-    [
-      decorator
-      ipython-pygments-lexers
-      jedi
-      matplotlib-inline
-      pexpect
-      prompt-toolkit
-      pygments
-      stack-data
-      traitlets
-    ]
-    ++ lib.optionals (pythonOlder "3.11") [ exceptiongroup ]
-    ++ lib.optionals (pythonOlder "3.12") [ typing-extensions ];
+  dependencies = [
+    decorator
+    ipython-pygments-lexers
+    jedi
+    matplotlib-inline
+    pexpect
+    prompt-toolkit
+    pygments
+    stack-data
+    traitlets
+  ] ++ lib.optionals (pythonOlder "3.12") [ typing-extensions ];
 
   optional-dependencies = {
-    kernel = [ ipykernel ];
-    nbconvert = [ nbconvert ];
-    nbformat = [ nbformat ];
-    notebook = [
-      ipywidgets
-      notebook
-    ];
-    parallel = [ ipyparallel ];
-    qtconsole = [ qtconsole ];
     matplotlib = [ matplotlib ];
   };
 
@@ -119,13 +98,13 @@ buildPythonPackage rec {
     inherit sage;
   };
 
-  meta = with lib; {
+  meta = {
     description = "IPython: Productive Interactive Computing";
     downloadPage = "https://github.com/ipython/ipython/";
-    homepage = "https://ipython.org/";
+    homepage = "https://ipython.readthedocs.io/en/stable/";
     changelog = "https://github.com/ipython/ipython/blob/${version}/docs/source/whatsnew/version${lib.versions.major version}.rst";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ bjornfor ];
-    teams = [ teams.jupyter ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ bjornfor ];
+    teams = [ lib.teams.jupyter ];
   };
 }
diff --git a/pkgs/development/python-modules/mutagen/default.nix b/pkgs/development/python-modules/mutagen/default.nix
index c66f33c6d9889..9c9f5c32bb869 100644
--- a/pkgs/development/python-modules/mutagen/default.nix
+++ b/pkgs/development/python-modules/mutagen/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
+  fetchpatch,
 
   # build-system
   setuptools,
@@ -29,6 +30,15 @@ buildPythonPackage rec {
     hash = "sha256-cZ+t7wqXjDG0zzyVYmGzxYtpSLMgIweKIRex3gnw/Jk=";
   };
 
+  patches = [
+    # fix compatibility with hypothesis CI profile
+    # (remove on next release)
+    (fetchpatch {
+      url = "https://github.com/quodlibet/mutagen/commit/967212631719de1aeccbd6855c5b6d03f271fdfe.patch";
+      hash = "sha256-jfCz8qTGZpnP6ICMB9K/Dgyp9TQeMuDq+V6kPFA3Q44=";
+    })
+  ];
+
   outputs = [
     "out"
     "doc"
diff --git a/pkgs/development/python-modules/mypy/extensions.nix b/pkgs/development/python-modules/mypy/extensions.nix
index 3282a6b6e8634..c40ed64417173 100644
--- a/pkgs/development/python-modules/mypy/extensions.nix
+++ b/pkgs/development/python-modules/mypy/extensions.nix
@@ -2,41 +2,41 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
-  typing,
+  flit-core,
   pytestCheckHook,
   pythonAtLeast,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "mypy-extensions";
-  version = "1.0.0";
+  version = "1.1.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python";
     repo = "mypy_extensions";
-    rev = version;
-    hash = "sha256-gOfHC6dUeBE7SsWItpUHHIxW3wzhPM5SuGW1U8P7DD0=";
+    tag = version;
+    hash = "sha256-HNAFsWX4tU9hfZkKxLNJn1J+H3uTesQflbRPlo3GQ4k=";
   };
 
-  propagatedBuildInputs = lib.optional (pythonOlder "3.5") typing;
+  dependencies = [ flit-core ];
 
   # make the testsuite run with pytest, so we can disable individual tests
   nativeCheckInputs = [ pytestCheckHook ];
 
   pytestFlagsArray = [ "tests/testextensions.py" ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.11") [
-    # https://github.com/python/mypy_extensions/issues/24
-    "test_typeddict_errors"
+  disabledTests = lib.optionals (pythonAtLeast "3.14") [
+    # https://github.com/python/mypy_extensions/issues/65
+    "test_py36_class_syntax_usage"
   ];
 
   pythonImportsCheck = [ "mypy_extensions" ];
 
-  meta = with lib; {
+  meta = {
     description = "Experimental type system extensions for programs checked with the mypy typechecker";
     homepage = "https://www.mypy-lang.org";
-    license = licenses.mit;
-    maintainers = with maintainers; [ lnl7 ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ lnl7 ];
   };
 }
diff --git a/pkgs/development/python-modules/pastedeploy/default.nix b/pkgs/development/python-modules/pastedeploy/default.nix
index 4edafccb3cdc7..945a07d525dd2 100644
--- a/pkgs/development/python-modules/pastedeploy/default.nix
+++ b/pkgs/development/python-modules/pastedeploy/default.nix
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Pylons";
     repo = "pastedeploy";
     tag = version;
-    hash = "sha256-8MNeOcYPEYAfghZN/K/1v/tAAdgz/fCvuVnBoru+81Q=";
+    hash = "sha256-yR7UxAeF0fQrbU7tl29GpPeEAc4YcxHdNQWMD67pP3g=";
   };
 
   postPatch = ''
@@ -32,11 +32,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "paste.deploy" ];
 
-  meta = with lib; {
+  meta = {
     description = "Load, configure, and compose WSGI applications and servers";
     homepage = "https://github.com/Pylons/pastedeploy";
-    changelog = "https://github.com/Pylons/pastedeploy/blob/${version}/docs/news.rst";
-    license = licenses.mit;
-    teams = [ teams.openstack ];
+    changelog = "https://github.com/Pylons/pastedeploy/blob/${src.tag}/docs/news.rst";
+    license = lib.licenses.mit;
+    teams = [ lib.teams.openstack ];
   };
 }
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index bf907f6209f5c..bb3b0b7ad4c7f 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "pillow";
-  version = "11.2.0";
+  version = "11.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-pillow";
     repo = "pillow";
     tag = version;
-    hash = "sha256-gr6S0FTM/VMnqj35E9U5G3BJ203f0XQzgzYCQ81WL/Y=";
+    hash = "sha256-eInPpCxHvo9J45t52KXZDG4KH4yf7iNMb+FpH5SEWmE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/plotpy/default.nix b/pkgs/development/python-modules/plotpy/default.nix
index f3cb2f24568ce..923ec62e533a6 100644
--- a/pkgs/development/python-modules/plotpy/default.nix
+++ b/pkgs/development/python-modules/plotpy/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "plotpy";
-  version = "2.7.3";
+  version = "2.7.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PlotPyStack";
     repo = "PlotPy";
     tag = "v${version}";
-    hash = "sha256-Z8aCDTBRdksbjjH5P+OXln3CHciw1MuYQN3K6KOcouk=";
+    hash = "sha256-FmSFcCAJZyzD9qRE+L2oxWtyh2spJSLRq+xtx4e1Rhg=";
   };
 
   build-system = [
@@ -85,27 +85,32 @@ buildPythonPackage rec {
 
   passthru = {
     tests = {
-      # Upstream doesn't officially supports all of them, although they use
-      # qtpy, see: https://github.com/PlotPyStack/PlotPy/issues/20 . When this
-      # package was created, all worked besides withPySide2, with which there
-      # was a peculiar segmentation fault during the tests. In anycase, PySide2
-      # shouldn't be used for modern applications.
       withPyQt6 = plotpy.override {
         pyqt6 = pyqt6;
         qt6 = qt6;
       };
-      withPySide6 = plotpy.override {
-        pyqt6 = pyside6;
-        qt6 = qt6;
-      };
       withPyQt5 = plotpy.override {
         pyqt6 = pyqt5;
         qt6 = qt5;
       };
+    };
+    # Upstream doesn't officially supports all of them, although they use
+    # qtpy, see: https://github.com/PlotPyStack/PlotPy/issues/20
+    knownFailingTests = {
+      # Was failing with a peculiar segmentation fault during the tests, since
+      # this package was added to Nixpkgs. This is not too bad as PySide2
+      # shouldn't be used for modern applications.
       withPySide2 = plotpy.override {
         pyqt6 = pyside2;
         qt6 = qt5;
       };
+      # Has started failing too similarly to pyside2, ever since a certain
+      # version bump. See also:
+      # https://github.com/PlotPyStack/PlotPy/blob/v2.7.4/README.md?plain=1#L62
+      withPySide6 = plotpy.override {
+        pyqt6 = pyside6;
+        qt6 = qt6;
+      };
     };
   };
 
diff --git a/pkgs/development/python-modules/sanic/default.nix b/pkgs/development/python-modules/sanic/default.nix
index e2373ad00b69c..b794cd2831590 100644
--- a/pkgs/development/python-modules/sanic/default.nix
+++ b/pkgs/development/python-modules/sanic/default.nix
@@ -80,9 +80,6 @@ buildPythonPackage rec {
     PATH="$out/bin:$PATH"
     PYTHONPATH=$PWD:$PYTHONPATH
 
-    # httpx since 0.28.0+ depends on SSL_CERT_FILE
-    SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
-
     # needed for relative paths for some packages
     cd tests
   '';
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 52ad3e6429f4c..f6eccfe6da32f 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -48,8 +48,8 @@ let
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
   # The update script uses sed regexes to replace them with the updated hashes.
-  version = "1.15.2";
-  srcHash = "sha256-JcCLMWjvlA4KYd42VcEJuXBpxuMKZ4BXC0q5Li/baOA=";
+  version = "1.15.3";
+  srcHash = "sha256-97z5CLRq/2kWjL2+ewHRA71vSfvCLHVJdOUZfDFnyhM=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
diff --git a/pkgs/development/python-modules/speechrecognition/default.nix b/pkgs/development/python-modules/speechrecognition/default.nix
index af0d604763fd3..7b7a89c9518ef 100644
--- a/pkgs/development/python-modules/speechrecognition/default.nix
+++ b/pkgs/development/python-modules/speechrecognition/default.nix
@@ -79,11 +79,6 @@ buildPythonPackage rec {
     respx
   ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
-  preCheck = ''
-    # httpx since 0.28.0+ depends on SSL_CERT_FILE
-    SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
-  '';
-
   pythonImportsCheck = [ "speech_recognition" ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
index a3cb24baa9c58..200af582e86bf 100644
--- a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
+++ b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
@@ -11,7 +11,7 @@
 
 let
   pname = "sphinx-autodoc-typehints";
-  version = "3.1.0";
+  version = "3.2.0";
 in
 
 buildPythonPackage {
@@ -23,7 +23,7 @@ buildPythonPackage {
   src = fetchPypi {
     pname = "sphinx_autodoc_typehints";
     inherit version;
-    hash = "sha256-prewtt8KOAeDzlspFQwtMDUnRvAno+KU03GDmV0/I+0=";
+    hash = "sha256-EHrJi8i0g3ICyIwHNtWdbaRAduZaDX19VDp4Yx9mKps=";
   };
 
   pythonRelaxDeps = [ "sphinx" ];
diff --git a/pkgs/development/python-modules/sphinx-issues/default.nix b/pkgs/development/python-modules/sphinx-issues/default.nix
index ea8f4268fb973..65d224bb9cca2 100644
--- a/pkgs/development/python-modules/sphinx-issues/default.nix
+++ b/pkgs/development/python-modules/sphinx-issues/default.nix
@@ -3,17 +3,11 @@
   buildPythonPackage,
   sphinx,
   fetchFromGitHub,
-  pandoc,
 }:
-
 buildPythonPackage rec {
   pname = "sphinx-issues";
   version = "3.0.1";
   format = "setuptools";
-  outputs = [
-    "out"
-    "doc"
-  ];
 
   src = fetchFromGitHub {
     owner = "sloria";
@@ -26,17 +20,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ sphinx ];
 
-  nativeBuildInputs = [ pandoc ];
-
-  postBuild = ''
-    pandoc -f rst -t html --standalone < README.rst > README.html
-  '';
-
-  postInstall = ''
-    mkdir -p $doc/share/doc/$name/html
-    cp README.html $doc/share/doc/$name/html
-  '';
-
   meta = with lib; {
     homepage = "https://github.com/sloria/sphinx-issues";
     description = "Sphinx extension for linking to your project's issue tracker";
diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index a863e87c0167e..b31e894e59db7 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -1,9 +1,8 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   flit-core,
-  pythonOlder,
 
   # reverse dependencies
   mashumaro,
@@ -12,23 +11,18 @@
 
 buildPythonPackage rec {
   pname = "typing-extensions";
-  version = "4.13.0";
+  version = "4.13.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
-  src = fetchPypi {
-    pname = "typing_extensions";
-    inherit version;
-    hash = "sha256-CkrFWlggeJ2H4pdyfSKYZsllD2UhtkIGQTxPutok2Vs=";
+  src = fetchFromGitHub {
+    owner = "python";
+    repo = "typing_extensions";
+    tag = version;
+    hash = "sha256-6wG+f0+sGI3sWy4EYeWDTffLicMiIkACHwrw0oP4Z1w=";
   };
 
   nativeBuildInputs = [ flit-core ];
 
-  # Tests are not part of PyPI releases. GitHub source can't be used
-  # as it ends with an infinite recursion
-  doCheck = false;
-
   pythonImportsCheck = [ "typing_extensions" ];
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/wxpython/4.2.nix b/pkgs/development/python-modules/wxpython/4.2.nix
index b830a638da9f2..9edee34105d92 100644
--- a/pkgs/development/python-modules/wxpython/4.2.nix
+++ b/pkgs/development/python-modules/wxpython/4.2.nix
@@ -30,7 +30,7 @@
   libglvnd,
   libgbm,
   pango,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   wxGTK,
   xorgproto,
 
@@ -92,7 +92,7 @@ buildPythonPackage rec {
       libXxf86vm
       libglvnd
       libgbm
-      webkitgtk_4_0
+      webkitgtk_4_1
       xorgproto
     ];
 
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index 395fb218f93c1..0282e63f6b18d 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -12,14 +12,14 @@
   sqlite,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "doxygen";
   version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "doxygen";
     repo = "doxygen";
-    tag = "Release_${lib.replaceStrings [ "." ] [ "_" ] version}";
+    tag = "Release_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
     hash = "sha256-tet2Ep2Mvucg2QBJbo9A6531cJhQ9L7+ZMmo07S8cwY=";
   };
 
@@ -53,7 +53,6 @@ stdenv.mkDerivation rec {
     );
 
   cmakeFlags = [
-    "-DICONV_INCLUDE_DIR=${libiconv}/include"
     "-Duse_sys_spdlog=ON"
     "-Duse_sys_sqlite3=ON"
   ] ++ lib.optional (qt5 != null) "-Dbuild_wizard=YES";
@@ -85,4 +84,4 @@ stdenv.mkDerivation rec {
     '';
     platforms = if qt5 != null then lib.platforms.linux else lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/tools/documentation/doxygen/doxmlparser.nix b/pkgs/development/tools/documentation/doxygen/doxmlparser.nix
new file mode 100644
index 0000000000000..e2da763cb2895
--- /dev/null
+++ b/pkgs/development/tools/documentation/doxygen/doxmlparser.nix
@@ -0,0 +1,32 @@
+{
+  buildPythonPackage,
+  doxygen,
+  lxml,
+  setuptools,
+  six,
+}:
+buildPythonPackage rec {
+  inherit (doxygen) version src;
+  pname = "doxmlparser";
+
+  sourceRoot = "${src.name}/addon/doxmlparser";
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    lxml
+    six
+  ];
+
+  pythonImportsCheck = [ "doxmlparser" ];
+
+  meta = {
+    inherit (doxygen.meta)
+      license
+      homepage
+      changelog
+      platforms
+      ;
+    description = "Library to parse the XML output produced by doxygen";
+  };
+}
diff --git a/pkgs/development/tools/haskell/hadrian/make-hadrian.nix b/pkgs/development/tools/haskell/hadrian/make-hadrian.nix
index 6e668e9a69145..d2463865c1992 100644
--- a/pkgs/development/tools/haskell/hadrian/make-hadrian.nix
+++ b/pkgs/development/tools/haskell/hadrian/make-hadrian.nix
@@ -64,6 +64,6 @@ callPackage' ./hadrian.nix (
   }
   // lib.optionalAttrs (lib.versionAtLeast ghcVersion "9.11") {
     # See https://gitlab.haskell.org/ghc/ghc/-/commit/145a6477854d4003a07573d5e7ffa0c9a64ae29c
-    Cabal = bootPkgs.Cabal_3_14_1_1;
+    Cabal = bootPkgs.Cabal_3_14_2_0;
   }
 )
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index 3a6ba56ee3044..b9f89f4460949 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -67,10 +67,30 @@ stdenv.mkDerivation {
       patch -p1 -d gnulib < ${gnulib.passthru.longdouble-redirect-patch}
     '';
 
-  # ncurses is required to build `makedoc'
-  # this feature is introduced by the ./cross-tools-flags.patch
-  NATIVE_TOOLS_CFLAGS = if crossBuildTools then "-I${getDev buildPackages.ncurses}/include" else null;
-  NATIVE_TOOLS_LDFLAGS = if crossBuildTools then "-L${getLib buildPackages.ncurses}/lib" else null;
+  env =
+    {
+      XFAIL_TESTS = toString (
+        optionals stdenv.hostPlatform.isMusl [
+          # musl does not support locales.
+          "different_languages_gen_master_menu.sh"
+          "test_scripts/formatting_documentlanguage_cmdline.sh"
+          "test_scripts/layout_formatting_fr_info.sh"
+          "test_scripts/layout_formatting_fr.sh"
+          "test_scripts/layout_formatting_fr_icons.sh"
+        ]
+        ++ optionals (!stdenv.hostPlatform.isMusl && versionOlder version "7") [
+          # Test is known to fail on various locales on texinfo-6.8:
+          #   https://lists.gnu.org/r/bug-texinfo/2021-07/msg00012.html
+          "test_scripts/layout_formatting_fr_icons.sh"
+        ]
+      );
+    }
+    // lib.optionalAttrs crossBuildTools {
+      # ncurses is required to build `makedoc'
+      # this feature is introduced by the ./cross-tools-flags.patch
+      NATIVE_TOOLS_CFLAGS = "-I${getDev buildPackages.ncurses}/include";
+      NATIVE_TOOLS_LDFLAGS = "-L${getLib buildPackages.ncurses}/lib";
+    };
 
   strictDeps = true;
   enableParallelBuilding = true;
@@ -118,21 +138,6 @@ stdenv.mkDerivation {
 
   doCheck = interactive && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isSunOS; # flaky
 
-  # musl does not support locales.
-  preCheck =
-    if interactive && stdenv.hostPlatform.isMusl then
-      ''
-        checkFlagsArray+=(XFAIL_TESTS="different_languages_gen_master_menu.sh test_scripts/formatting_documentlanguage_cmdline.sh test_scripts/layout_formatting_fr_info.sh test_scripts/layout_formatting_fr.sh test_scripts/layout_formatting_fr_icons.sh")
-      ''
-    else
-      null;
-
-  checkFlags = optionals (!stdenv.hostPlatform.isMusl && versionOlder version "7") [
-    # Test is known to fail on various locales on texinfo-6.8:
-    #   https://lists.gnu.org/r/bug-texinfo/2021-07/msg00012.html
-    "XFAIL_TESTS=test_scripts/layout_formatting_fr_icons.sh"
-  ];
-
   postFixup = optionalString crossBuildTools ''
     for f in "$out"/bin/{pod2texi,texi2any}; do
       substituteInPlace "$f" \
diff --git a/pkgs/development/tools/profiling/sysprof/capture.nix b/pkgs/development/tools/profiling/sysprof/capture.nix
index 6dd050841b0bc..cd2bd19fda392 100644
--- a/pkgs/development/tools/profiling/sysprof/capture.nix
+++ b/pkgs/development/tools/profiling/sysprof/capture.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation {
     "-Dtests=false"
     "-Dexamples=false"
     "-Dpolkit-agent=disabled" # only useful for sysprof-cli
+    "-Ddebuginfod=disabled"
   ];
 
   meta = sysprof.meta // {
diff --git a/pkgs/development/tools/profiling/sysprof/default.nix b/pkgs/development/tools/profiling/sysprof/default.nix
index dcab3c49969fe..1b3d449a3d200 100644
--- a/pkgs/development/tools/profiling/sysprof/default.nix
+++ b/pkgs/development/tools/profiling/sysprof/default.nix
@@ -3,6 +3,7 @@
   lib,
   desktop-file-utils,
   fetchurl,
+  elfutils,
   gettext,
   glib,
   gtk4,
@@ -25,7 +26,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sysprof";
-  version = "47.2";
+  version = "48.0";
 
   outputs = [
     "out"
@@ -35,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/sysprof/${lib.versions.major finalAttrs.version}/sysprof-${finalAttrs.version}.tar.xz";
-    hash = "sha256-5LXt6f2XjsPw1aDUTQQpptIBw2K/bLRScxkDGuRixU8=";
+    hash = "sha256-Gw8DgPLzBwi6h4KTIaBv7h2zbfqHeXu/B/CnrPRJjRg=";
   };
 
   nativeBuildInputs = [
@@ -51,6 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    elfutils
     glib
     gtk4
     json-glib
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index 64e702a527c8a..651de6bd94a83 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -17,8 +17,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.14.0";
-  sha256 = "c609946bf793b55c7954c26582760808d54c16185d79cb2fb88065e52de21914";
+  version = "22.15.0";
+  sha256 = "e7c4226d1d92f33ad854d6da4f7e519e77690b8e73f93496881f8c539174d9df";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index 3e9e4fc5539b1..238fd039d614e 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.31";
-  hash = "sha256-XbKVagD7+H2SJ0zMySQ2OH7Aw/qt7OdBPs4bocEMmP8=";
+  version = "2.03.32";
+  hash = "sha256-KReDLd1ORuWTZR4CK/Ei/SZ6teb3T67ggkhDiMiG0a0=";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 9da06cc092367..16282b3f33f0b 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -141,6 +141,8 @@ stdenv.mkDerivation rec {
       "libdm.device-mapper"
     ];
 
+  enableParallelBuilding = true;
+
   # To prevent make install from failing.
   installFlags = [
     "OWNER="
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 7fbd2b0bc52d1..f0f211755af0d 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -26,12 +26,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.1";
+  version = "1.1.3";
   pname = "nftables";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.xz";
-    hash = "sha256-Y1iDDzpk8x45sK1CHX2tzSQLcjQ97UjY7xO4+vIEhlo=";
+    hash = "sha256-nIpktZyQsIJeVAqbj8udLZQsY2+BulAZnwaP3kTzTtg=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 825ffa4523a9a..c9ebf5a7bd3d4 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -791,7 +791,7 @@ stdenv.mkDerivation (finalAttrs: {
     ]
   );
 
-  doCheck = false; # fails a bunch of tests
+  doCheck = true;
 
   # trigger the test -n "$DESTDIR" || mutate in upstreams build system
   preInstall = ''
diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index 1a971faf91e91..6af21fba86b75 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -31,14 +31,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpq";
-  version = "17.4";
+  version = "17.5";
 
   src = fetchFromGitHub {
     owner = "postgres";
     repo = "postgres";
     # rev, not tag, on purpose: see generic.nix.
-    rev = "refs/tags/REL_17_4";
-    hash = "sha256-TEpvX28chR3CXiOQsNY12t8WfM9ywoZVX1e/6mj9DqE=";
+    rev = "refs/tags/REL_17_5";
+    hash = "sha256-jWV7hglu7IPMZbqHrZVZHLbZYjVuDeut7nH50aSQIBc=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 0bdcf2653c858..452c483c57b88 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -6,8 +6,13 @@
   gccmakedep,
   libpciaccess,
   libpthread-stubs,
+  libxcvt,
   luit,
+  makedepend,
   pixman,
+  util-macros,
+  xbitmaps,
+  xcb-proto,
 }:
 
 self: with self; {
@@ -15,12 +20,17 @@ self: with self; {
   inherit
     gccmakedep
     libpciaccess
+    libxcvt
     luit
+    makedepend
     pixman
+    xbitmaps
     ;
   fontalias = font-alias;
   fontutil = font-util;
   libpthreadstubs = libpthread-stubs;
+  utilmacros = util-macros;
+  xcbproto = xcb-proto;
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   appres = callPackage (
@@ -2464,11 +2474,11 @@ self: with self; {
     }:
     stdenv.mkDerivation (finalAttrs: {
       pname = "libXft";
-      version = "2.3.8";
+      version = "2.3.9";
       builder = ./builder.sh;
       src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXft-2.3.8.tar.xz";
-        sha256 = "0jfxqsqhjl2b2ll6b7x21mj02hxp5znkhjvbxw5a9h6lq95kr32y";
+        url = "mirror://xorg/individual/lib/libXft-2.3.9.tar.xz";
+        sha256 = "1xbn77zqjzx2zdzqcsbf8pvivlqplnciifxk6lk97mjyjiw5p8k0";
       };
       hardeningDisable = [
         "bindnow"
@@ -3277,43 +3287,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libxcvt = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      meson,
-      ninja,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libxcvt";
-      version = "0.1.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libxcvt-0.1.3.tar.xz";
-        sha256 = "009f8kr53cv7lzsg4507cgnk9vxyrm8lgnnn6vx7vpk7hy59jad9";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        meson
-        ninja
-      ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libxkbfile = callPackage (
     {
@@ -3454,37 +3427,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  makedepend = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "makedepend";
-      version = "1.0.9";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/util/makedepend-1.0.9.tar.xz";
-        sha256 = "1m1dg32z22fw9shg0wsxw7dvdcnfm16gq9qxpkfxixpzb6vdxl4j";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   mkfontscale = callPackage (
     {
@@ -3765,37 +3707,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  utilmacros = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "util-macros";
-      version = "1.20.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/util/util-macros-1.20.2.tar.xz";
-        sha256 = "13ifr0dabci130xk04kp9bq16g9kbyzf8x1mgdyjsrsglbmnkhls";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xorg-macros" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   viewres = callPackage (
     {
@@ -3960,37 +3871,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xbitmaps = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xbitmaps";
-      version = "1.1.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/data/xbitmaps-1.1.3.tar.xz";
-        sha256 = "0yhgrllia3lbqx9b21w31w4sppx1a9ggrk62hrys2ckqi1aasv5d";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xbitmaps" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcalc = callPackage (
     {
@@ -4035,41 +3915,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcbproto = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      python3,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcb-proto";
-      version = "1.17.0";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/proto/xcb-proto-1.17.0.tar.xz";
-        sha256 = "130lc8jx43s83496nc8jn47zixjcp4abgsz69pvrjiqg279aq6rc";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        python3
-      ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xcb-proto" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbutil = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 3a58856b599dc..5cf5068021d1f 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -39,6 +39,8 @@
 $pcMap{"fontutil"} = "fontutil";
 $pcMap{"pciaccess"} = "libpciaccess";
 $pcMap{"pthread-stubs"} = "libpthreadstubs";
+$pcMap{"xbitmaps"} = "xbitmaps";
+$pcMap{"xcb-proto"} = "xcbproto";
 $pcMap{"\$PIXMAN"} = "pixman";
 $pcMap{"\$RENDERPROTO"} = "xorgproto";
 $pcMap{"\$DRI3PROTO"} = "xorgproto";
@@ -268,8 +270,13 @@
   gccmakedep,
   libpciaccess,
   libpthread-stubs,
+  libxcvt,
   luit,
+  makedepend,
   pixman,
+  util-macros,
+  xbitmaps,
+  xcb-proto,
 }:
 
 self: with self; {
@@ -277,12 +284,17 @@
   inherit
     gccmakedep
     libpciaccess
+    libxcvt
     luit
+    makedepend
     pixman
+    xbitmaps
     ;
   fontalias = font-alias;
   fontutil = font-util;
   libpthreadstubs = libpthread-stubs;
+  utilmacros = util-macros;
+  xcbproto = xcb-proto;
 
 EOF
 
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 0d621d703d9d3..6239be5aa87c6 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -227,22 +227,6 @@ self: super:
     };
   });
 
-  libxcvt = super.libxcvt.overrideAttrs (
-    {
-      meta ? { },
-      ...
-    }:
-    {
-      meta = meta // {
-        homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcvt";
-        mainProgram = "cvt";
-        badPlatforms = meta.badPlatforms or [ ] ++ [
-          lib.systems.inspect.platformPatterns.isStatic
-        ];
-      };
-    }
-  );
-
   libX11 = super.libX11.overrideAttrs (attrs: {
     outputs = [
       "out"
@@ -629,21 +613,11 @@ self: super:
     };
   });
 
-  makedepend = addMainProgram super.makedepend { };
   mkfontscale = addMainProgram super.mkfontscale { };
   oclock = addMainProgram super.oclock { };
   smproxy = addMainProgram super.smproxy { };
   transset = addMainProgram super.transset { };
 
-  utilmacros = super.utilmacros.overrideAttrs (attrs: {
-    # not needed for releases, we propagate the needed tools
-    propagatedNativeBuildInputs = attrs.propagatedNativeBuildInputs or [ ] ++ [
-      automake
-      autoconf
-      libtool
-    ];
-  });
-
   viewres = addMainProgram super.viewres { };
 
   x11perf = super.x11perf.overrideAttrs (attrs: {
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 47ae0e74d88e1..edf7e236639ae 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -69,7 +69,6 @@ mirror://xorg/individual/app/xvinfo-1.1.5.tar.xz
 mirror://xorg/individual/app/xwd-1.0.9.tar.xz
 mirror://xorg/individual/app/xwininfo-1.1.6.tar.xz
 mirror://xorg/individual/app/xwud-1.0.7.tar.xz
-mirror://xorg/individual/data/xbitmaps-1.1.3.tar.xz
 mirror://xorg/individual/data/xcursor-themes-1.0.7.tar.xz
 mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.44.tar.xz
 mirror://xorg/individual/doc/xorg-docs-1.7.3.tar.xz
@@ -174,14 +173,13 @@ mirror://xorg/individual/lib/libXaw-1.0.16.tar.xz
 mirror://xorg/individual/lib/libxcb-1.17.0.tar.xz
 mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz
 mirror://xorg/individual/lib/libXcursor-1.2.3.tar.xz
-mirror://xorg/individual/lib/libxcvt-0.1.3.tar.xz
 mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz
 mirror://xorg/individual/lib/libXdmcp-1.1.5.tar.xz
 mirror://xorg/individual/lib/libXext-1.3.6.tar.xz
 mirror://xorg/individual/lib/libXfixes-6.0.1.tar.xz
 mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2
 mirror://xorg/individual/lib/libXfont2-2.0.7.tar.xz
-mirror://xorg/individual/lib/libXft-2.3.8.tar.xz
+mirror://xorg/individual/lib/libXft-2.3.9.tar.xz
 mirror://xorg/individual/lib/libXi-1.8.2.tar.xz
 mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
 mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
@@ -204,12 +202,9 @@ mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.6.tar.xz
 mirror://xorg/individual/lib/xcb-util-cursor-0.1.5.tar.xz
 mirror://xorg/individual/lib/xtrans-1.6.0.tar.xz
-mirror://xorg/individual/proto/xcb-proto-1.17.0.tar.xz
 mirror://xorg/individual/proto/xorgproto-2024.1.tar.xz
 mirror://xorg/individual/util/bdftopcf-1.1.2.tar.xz
 mirror://xorg/individual/util/imake-1.0.10.tar.xz
 mirror://xorg/individual/util/lndir-1.0.5.tar.xz
-mirror://xorg/individual/util/makedepend-1.0.9.tar.xz
-mirror://xorg/individual/util/util-macros-1.20.2.tar.xz
 mirror://xorg/individual/util/xorg-cf-files-1.0.8.tar.xz
 mirror://xorg/individual/xserver/xorg-server-21.1.16.tar.xz
diff --git a/pkgs/test/make-binary-wrapper/add-flags/add-flags.c b/pkgs/test/make-binary-wrapper/add-flags/add-flags.c
index d998a5f6f983c..0e84dad5793e2 100644
--- a/pkgs/test/make-binary-wrapper/add-flags/add-flags.c
+++ b/pkgs/test/make-binary-wrapper/add-flags/add-flags.c
@@ -3,21 +3,25 @@
 #include <assert.h>
 
 int main(int argc, char **argv) {
-    char **argv_tmp = calloc(6 + argc + 2 + 1, sizeof(*argv_tmp));
+    char **argv_tmp = calloc(9 + argc + 3 + 1, sizeof(*argv_tmp));
     assert(argv_tmp != NULL);
     argv_tmp[0] = argv[0];
     argv_tmp[1] = "-x";
     argv_tmp[2] = "-y";
     argv_tmp[3] = "-z";
     argv_tmp[4] = "-abc";
-    argv_tmp[5] = "-g";
-    argv_tmp[6] = "*.txt";
+    argv_tmp[5] = "test var here";
+    argv_tmp[6] = "-g";
+    argv_tmp[7] = "*.txt";
+    argv_tmp[8] = "-a";
+    argv_tmp[9] = "*";
     for (int i = 1; i < argc; ++i) {
-        argv_tmp[6 + i] = argv[i];
+        argv_tmp[9 + i] = argv[i];
     }
-    argv_tmp[6 + argc + 0] = "-foo";
-    argv_tmp[6 + argc + 1] = "-bar";
-    argv_tmp[6 + argc + 2] = NULL;
+    argv_tmp[9 + argc + 0] = "-foo";
+    argv_tmp[9 + argc + 1] = "-bar";
+    argv_tmp[9 + argc + 2] = "test var 2 here";
+    argv_tmp[9 + argc + 3] = NULL;
     argv = argv_tmp;
 
     argv[0] = "/send/me/flags";
diff --git a/pkgs/test/make-binary-wrapper/add-flags/add-flags.cmdline b/pkgs/test/make-binary-wrapper/add-flags/add-flags.cmdline
index 1ca964ab4e7a7..60b29b40c2e09 100644
--- a/pkgs/test/make-binary-wrapper/add-flags/add-flags.cmdline
+++ b/pkgs/test/make-binary-wrapper/add-flags/add-flags.cmdline
@@ -1,4 +1,7 @@
     --append-flags "-foo -bar" \
     --add-flags "-x -y -z" \
     --add-flags -abc \
-    --add-flags "-g *.txt"
+    --add-flag 'test var here' \
+    --add-flags "-g *.txt" \
+    --add-flags "-a *" \
+    --append-flag 'test var 2 here'
diff --git a/pkgs/test/make-binary-wrapper/add-flags/add-flags.env b/pkgs/test/make-binary-wrapper/add-flags/add-flags.env
index f0641ef36f7c3..c31d2bd3845c9 100644
--- a/pkgs/test/make-binary-wrapper/add-flags/add-flags.env
+++ b/pkgs/test/make-binary-wrapper/add-flags/add-flags.env
@@ -4,7 +4,11 @@ SUBST_ARGV0
 -y
 -z
 -abc
+test var here
 -g
 *.txt
+-a
+*
 -foo
 -bar
+test var 2 here
diff --git a/pkgs/test/make-wrapper/default.nix b/pkgs/test/make-wrapper/default.nix
index db54a01946a10..cf2bf1aed7e8d 100644
--- a/pkgs/test/make-wrapper/default.nix
+++ b/pkgs/test/make-wrapper/default.nix
@@ -28,7 +28,7 @@ let
     echo "VAR=$VAR"
   '';
   wrappedBinaryArgs = writeShellScript "wrapped-args" ''
-    echo "$@"
+    printf '%s\n' "$@"
   '';
 
   mkWrapperBinary =
@@ -46,10 +46,11 @@ let
         makeWrapper "${wrapped}" "$out/bin/${name}" ${lib.escapeShellArgs args}
       '';
 
+  mkArgTest = cmd: toExpect: mkTest cmd (builtins.concatStringsSep "\n" toExpect);
   mkTest = cmd: toExpect: ''
     output="$(${cmd})"
-    if [[ "$output" != '${toExpect}' ]]; then
-      echo "test failed: the output of ${cmd} was '$output', expected '${toExpect}'"
+    if [[ "$output" != ${lib.escapeShellArg toExpect} ]]; then
+      echo "test failed: the output of ${cmd} was '$output', expected ${lib.escapeShellArg toExpect}"
       echo "the wrapper contents:"
       for i in ${cmd}; do
         if [[ $i =~ ^test- ]]; then
@@ -122,6 +123,16 @@ runCommand "make-wrapper-test"
         ];
         wrapped = wrappedBinaryArgs;
       })
+      (mkWrapperBinary {
+        name = "test-arg";
+        args = [
+          "--add-flag"
+          "abc 'aaaaa' jkhhjk"
+          "--append-flag"
+          "xyz ggg"
+        ];
+        wrapped = wrappedBinaryArgs;
+      })
       (mkWrapperBinary {
         name = "test-prefix";
         args = [
@@ -225,9 +236,21 @@ runCommand "make-wrapper-test"
     + mkTest "VAR=foo test-unset" "VAR="
 
     # --add-flags and --append-flags work
-    + mkTest "test-args" "abc xyz"
+    + mkArgTest "test-args" [
+      "abc"
+      "xyz"
+    ]
+    # --add-flag and --append-flag work
+    + mkArgTest "test-arg" [
+      "abc 'aaaaa' jkhhjk"
+      "xyz ggg"
+    ]
     # given flags are kept
-    + mkTest "test-args foo" "abc foo xyz"
+    + mkArgTest "test-args foo" [
+      "abc"
+      "foo"
+      "xyz"
+    ]
 
     # --run works
     + mkTest "test-run" "bar\nVAR="
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 750626191970b..a0ff569b4179c 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -4,7 +4,6 @@
   config,
   fetchFromGitHub,
   python3Packages,
-  fetchpatch,
 }:
 /*
   ** To customize the enabled beets plugins, use the pluginOverrides input to the
@@ -21,24 +20,8 @@
 */
 let
   extraPatches = [
-    (fetchpatch {
-      # Already on master. TODO: remove when updating to the next release
-      # Issue: https://github.com/beetbox/beets/issues/5527
-      # PR: https://github.com/beetbox/beets/pull/5650
-      name = "fix-im-backend";
-      url = "https://github.com/beetbox/beets/commit/1f938674015ee71431fe9bd97c2214f58473efd2.patch";
-      hash = "sha256-koCYeiUhk1ifo6CptOSu3p7Nz0FFUeiuArTknM/tpVQ=";
-      excludes = [
-        "docs/changelog.rst"
-      ];
-    })
     # Bash completion fix for Nix
     ./patches/bash-completion-always-print.patch
-    # Remove after next release.
-    (fetchpatch {
-      url = "https://github.com/beetbox/beets/commit/bcc79a5b09225050ce7c88f63dfa56f49f8782a8.patch?full_index=1";
-      hash = "sha256-Y2Q5Co3UlDGKuzfxUvdUY3rSMNpsBoDW03ZWZOfzp3Y=";
-    })
   ];
 in
 lib.makeExtensible (
@@ -48,12 +31,12 @@ lib.makeExtensible (
 
     beets-stable = callPackage ./common.nix rec {
       inherit python3Packages extraPatches;
-      version = "2.2.0";
+      version = "2.3.0";
       src = fetchFromGitHub {
         owner = "beetbox";
         repo = "beets";
         tag = "v${version}";
-        hash = "sha256-jhwXRgUUQJgQ/PLwvY1UfHCJ9UC8DcdBpE/janao0RM=";
+        hash = "sha256-mH3m2O+q5Ys9DJD3ulmhViyf/VPEpHevjmNerVe327s=";
       };
     };
 
@@ -61,18 +44,19 @@ lib.makeExtensible (
 
     beets-unstable = callPackage ./common.nix {
       inherit python3Packages;
-      version = "2.2.0-unstable-2025-03-12";
+      version = "2.3.0";
       src = fetchFromGitHub {
         owner = "beetbox";
         repo = "beets";
-        rev = "670a3bcd17a46883c71cf07dd313fcd0dff4be9d";
-        hash = "sha256-hSY7FhpPL4poOY1/gqk7oLNgQ7KA/MJqx50xOLIP0QA=";
+        rev = "250b0da900c095a09bedc1a0717381010c01a3c6";
+        hash = "sha256-mH3m2O+q5Ys9DJD3ulmhViyf/VPEpHevjmNerVe327s=";
       };
     };
 
     alternatives = callPackage ./plugins/alternatives.nix { beets = self.beets-minimal; };
     audible = callPackage ./plugins/audible.nix { beets = self.beets-minimal; };
     copyartifacts = callPackage ./plugins/copyartifacts.nix { beets = self.beets-minimal; };
+    filetote = callPackage ./plugins/filetote.nix { beets = self.beets-minimal; };
   }
   // lib.optionalAttrs config.allowAliases {
     extrafiles = throw "extrafiles is unmaintained since 2020 and broken since beets 2.0.0";
diff --git a/pkgs/tools/audio/beets/plugins/alternatives.nix b/pkgs/tools/audio/beets/plugins/alternatives.nix
index 27b7011c3109a..15599ce56c7ab 100644
--- a/pkgs/tools/audio/beets/plugins/alternatives.nix
+++ b/pkgs/tools/audio/beets/plugins/alternatives.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "beets-alternatives";
-  version = "0.13.2";
+  version = "0.13.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     repo = "beets-alternatives";
     owner = "geigerzaehler";
     tag = "v${version}";
-    hash = "sha256-OoQsP+QVIOnSA4oy1a8JJ3VeCUS+GR8sPPOysvmRMqI=";
+    hash = "sha256-j56AzbpZFACXy5KqafE8PCC+zM6pXrxr/rWy9UjZPQg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/audio/beets/plugins/audible.nix b/pkgs/tools/audio/beets/plugins/audible.nix
index f1aee4179ea92..7e090bf2358fe 100644
--- a/pkgs/tools/audio/beets/plugins/audible.nix
+++ b/pkgs/tools/audio/beets/plugins/audible.nix
@@ -17,19 +17,21 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-Sds16h+W9t7N755ADPXXDi+SxwouBMxP9ApUqaXedqY=";
   };
 
+  nativeBuildInputs = [
+    beets
+  ];
+
   pythonRelaxDeps = true;
 
   build-system = with python3Packages; [
     hatchling
   ];
 
-  dependencies =
-    [ beets ]
-    ++ (with python3Packages; [
-      markdownify
-      natsort
-      tldextract
-    ]);
+  dependencies = with python3Packages; [
+    markdownify
+    natsort
+    tldextract
+  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/tools/audio/beets/plugins/copyartifacts.nix b/pkgs/tools/audio/beets/plugins/copyartifacts.nix
index 46bef54e213ef..449e8e05c0ea9 100644
--- a/pkgs/tools/audio/beets/plugins/copyartifacts.nix
+++ b/pkgs/tools/audio/beets/plugins/copyartifacts.nix
@@ -19,7 +19,6 @@ python3Packages.buildPythonApplication rec {
   };
 
   postPatch = ''
-    sed -i -e '/install_requires/,/\]/{/beets/d}' setup.py
     sed -i -e '/namespace_packages/d' setup.py
     printf 'from pkgutil import extend_path\n__path__ = extend_path(__path__, __name__)\n' >beetsplug/__init__.py
 
@@ -28,13 +27,20 @@ python3Packages.buildPythonApplication rec {
     sed -i -e 's/util\.py3_path/os.fsdecode/g' tests/_common.py
   '';
 
-  build-system = with python3Packages; [ setuptools ];
+  nativeBuildInputs = [
+    beets
+  ];
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
 
-  dependencies = with python3Packages; [ six ];
+  dependencies = with python3Packages; [
+    six
+  ];
 
   nativeCheckInputs = [
     python3Packages.pytestCheckHook
-    beets
     writableTmpDirAsHomeHook
   ];
 
diff --git a/pkgs/tools/audio/beets/plugins/filetote.nix b/pkgs/tools/audio/beets/plugins/filetote.nix
new file mode 100644
index 0000000000000..34a6af769431d
--- /dev/null
+++ b/pkgs/tools/audio/beets/plugins/filetote.nix
@@ -0,0 +1,83 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  beets,
+  beetsPackages,
+  writableTmpDirAsHomeHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "beets-filetote";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "gtronset";
+    repo = "beets-filetote";
+    tag = "v${version}";
+    hash = "sha256-LTJwZI/kQc+Iv0y8jAi5Xdh4wLEwbTA9hV76ndQsQzU=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace-fail "poetry-core<2.0.0" "poetry-core"
+  '';
+
+  nativeBuildInputs = [
+    beets
+  ];
+
+  build-system = [ python3Packages.poetry-core ];
+
+  dependencies = with python3Packages; [
+    mediafile
+    reflink
+    toml
+    typeguard
+  ];
+
+  optional-dependencies = {
+    lint = with python3Packages; [
+      black
+      check-manifest
+      flake8
+      flake8-bugbear
+      flake8-bugbear-pyi
+      isort
+      mypy
+      pylint
+      typing_extensions
+    ];
+    test = with python3Packages; [
+      beetsPackages.audible
+      mediafile
+      pytest
+      reflink
+      toml
+      typeguard
+    ];
+    dev = optional-dependencies.lint ++ optional-dependencies.test ++ [ python3Packages.tox ];
+  };
+
+  pytestFlagsArray = [ "-r fEs" ];
+
+  disabledTestPaths = [
+    "tests/test_cli_operation.py"
+    "tests/test_pruning.py"
+    "tests/test_version.py"
+  ];
+
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
+    writableTmpDirAsHomeHook
+  ] ++ optional-dependencies.test;
+
+  meta = with lib; {
+    description = "Beets plugin to move non-music files during the import process";
+    homepage = "https://github.com/gtronset/beets-filetote";
+    changelog = "https://github.com/gtronset/beets-filetote/blob/${src.rev}/CHANGELOG.md";
+    maintainers = with maintainers; [ dansbandit ];
+    license = licenses.mit;
+    inherit (beets.meta) platforms;
+  };
+}
diff --git a/pkgs/tools/filesystems/ceph/arrow-cpp-19.nix b/pkgs/tools/filesystems/ceph/arrow-cpp-19.nix
new file mode 100644
index 0000000000000..1750d98bb0fff
--- /dev/null
+++ b/pkgs/tools/filesystems/ceph/arrow-cpp-19.nix
@@ -0,0 +1,335 @@
+# This is is arrow-cpp < 20 used as a workaround for
+# Ceph not supporting >= yet, taken from nixpkgs commit
+#     97ae53798f6a7c7c3c259ad8c2cbcede6ca34b2a~
+# This should be entirely removed when upstream bug
+#     https://tracker.ceph.com/issues/71269
+# is fixed.
+{
+  stdenv,
+  lib,
+  fetchurl,
+  fetchFromGitHub,
+  fixDarwinDylibNames,
+  autoconf,
+  aws-sdk-cpp,
+  aws-sdk-cpp-arrow ? aws-sdk-cpp.override {
+    apis = [
+      "cognito-identity"
+      "config"
+      "identity-management"
+      "s3"
+      "sts"
+      "transfer"
+    ];
+  },
+  boost,
+  brotli,
+  bzip2,
+  cmake,
+  crc32c,
+  curl,
+  flatbuffers,
+  gflags,
+  glog,
+  google-cloud-cpp,
+  grpc,
+  gtest,
+  libbacktrace,
+  lz4,
+  minio,
+  ninja,
+  nlohmann_json,
+  openssl,
+  perl,
+  pkg-config,
+  protobuf_29,
+  python3,
+  rapidjson,
+  re2,
+  snappy,
+  sqlite,
+  thrift,
+  tzdata,
+  utf8proc,
+  which,
+  zlib,
+  zstd,
+  testers,
+  enableShared ? !stdenv.hostPlatform.isStatic,
+  enableFlight ? stdenv.buildPlatform == stdenv.hostPlatform,
+  # Disable also on RiscV
+  # configure: error: cannot determine number of significant virtual address bits
+  enableJemalloc ?
+    !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isAarch64 && !stdenv.hostPlatform.isRiscV64,
+  enableS3 ? true,
+  # google-cloud-cpp fails to build on RiscV
+  enableGcs ? !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isRiscV64,
+}:
+
+let
+  # https://github.com/apache/arrow/issues/45807
+  protobuf = protobuf_29;
+
+  arrow-testing = fetchFromGitHub {
+    name = "arrow-testing";
+    owner = "apache";
+    repo = "arrow-testing";
+    rev = "4d209492d514c2d3cb2d392681b9aa00e6d8da1c";
+    hash = "sha256-IkiCbuy0bWyClPZ4ZEdkEP7jFYLhM7RCuNLd6Lazd4o=";
+  };
+
+  parquet-testing = fetchFromGitHub {
+    name = "parquet-testing";
+    owner = "apache";
+    repo = "parquet-testing";
+    rev = "c7cf1374cf284c0c73024cd1437becea75558bf8";
+    hash = "sha256-DThjyZ34LajHwXZy1IhYKUGUG/ejQ9WvBNuI8eUKmSs=";
+  };
+
+  version = "19.0.1";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "arrow-cpp";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "arrow";
+    rev = "apache-arrow-${version}";
+    hash = "sha256-toHwUIOZRpgR0K7pQtT5nqWpO9G7AuHYTcvA6UVg9lA=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/cpp";
+
+  # versions are all taken from
+  # https://github.com/apache/arrow/blob/apache-arrow-${version}/cpp/thirdparty/versions.txt
+
+  # jemalloc: arrow uses a custom prefix to prevent default allocator symbol
+  # collisions as well as custom build flags
+  ${if enableJemalloc then "ARROW_JEMALLOC_URL" else null} = fetchurl {
+    url = "https://github.com/jemalloc/jemalloc/releases/download/5.3.0/jemalloc-5.3.0.tar.bz2";
+    hash = "sha256-LbgtHnEZ3z5xt2QCGbbf6EeJvAU3mDw7esT3GJrs/qo=";
+  };
+
+  # mimalloc: arrow uses custom build flags for mimalloc
+  ARROW_MIMALLOC_URL = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "mimalloc";
+    rev = "v2.0.6";
+    hash = "sha256-u2ITXABBN/dwU+mCIbL3tN1f4c17aBuSdNTV+Adtohc=";
+  };
+
+  ARROW_XSIMD_URL = fetchFromGitHub {
+    owner = "xtensor-stack";
+    repo = "xsimd";
+    rev = "13.0.0";
+    hash = "sha256-qElJYW5QDj3s59L3NgZj5zkhnUMzIP2mBa1sPks3/CE=";
+  };
+
+  ARROW_SUBSTRAIT_URL = fetchFromGitHub {
+    owner = "substrait-io";
+    repo = "substrait";
+    rev = "v0.44.0";
+    hash = "sha256-V739IFTGPtbGPlxcOi8sAaYSDhNUEpITvN9IqdPReug=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    ninja
+    autoconf # for vendored jemalloc
+    flatbuffers
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
+  buildInputs =
+    [
+      boost
+      brotli
+      bzip2
+      flatbuffers
+      gflags
+      glog
+      gtest
+      libbacktrace
+      lz4
+      nlohmann_json # alternative JSON parser to rapidjson
+      protobuf # substrait requires protobuf
+      rapidjson
+      re2
+      snappy
+      thrift
+      utf8proc
+      zlib
+      zstd
+    ]
+    ++ lib.optionals enableFlight [
+      grpc
+      openssl
+      protobuf
+      sqlite
+    ]
+    ++ lib.optionals enableS3 [
+      aws-sdk-cpp-arrow
+      openssl
+    ]
+    ++ lib.optionals enableGcs [
+      crc32c
+      curl
+      google-cloud-cpp
+      grpc
+      nlohmann_json
+    ];
+
+  preConfigure = ''
+    patchShebangs build-support/
+    substituteInPlace "src/arrow/vendored/datetime/tz.cpp" \
+      --replace-fail 'discover_tz_dir();' '"${tzdata}/share/zoneinfo";'
+  '';
+
+  cmakeFlags =
+    [
+      "-DCMAKE_FIND_PACKAGE_PREFER_CONFIG=ON"
+      "-DARROW_BUILD_SHARED=${if enableShared then "ON" else "OFF"}"
+      "-DARROW_BUILD_STATIC=${if enableShared then "OFF" else "ON"}"
+      "-DARROW_BUILD_TESTS=${if enableShared then "ON" else "OFF"}"
+      "-DARROW_BUILD_INTEGRATION=ON"
+      "-DARROW_BUILD_UTILITIES=ON"
+      "-DARROW_EXTRA_ERROR_CONTEXT=ON"
+      "-DARROW_VERBOSE_THIRDPARTY_BUILD=ON"
+      "-DARROW_DEPENDENCY_SOURCE=SYSTEM"
+      "-Dxsimd_SOURCE=AUTO"
+      "-DARROW_DEPENDENCY_USE_SHARED=${if enableShared then "ON" else "OFF"}"
+      "-DARROW_COMPUTE=ON"
+      "-DARROW_CSV=ON"
+      "-DARROW_DATASET=ON"
+      "-DARROW_FILESYSTEM=ON"
+      "-DARROW_FLIGHT_SQL=${if enableFlight then "ON" else "OFF"}"
+      "-DARROW_HDFS=ON"
+      "-DARROW_IPC=ON"
+      "-DARROW_JEMALLOC=${if enableJemalloc then "ON" else "OFF"}"
+      "-DARROW_JSON=ON"
+      "-DARROW_USE_GLOG=ON"
+      "-DARROW_WITH_BACKTRACE=ON"
+      "-DARROW_WITH_BROTLI=ON"
+      "-DARROW_WITH_BZ2=ON"
+      "-DARROW_WITH_LZ4=ON"
+      "-DARROW_WITH_NLOHMANN_JSON=ON"
+      "-DARROW_WITH_SNAPPY=ON"
+      "-DARROW_WITH_UTF8PROC=ON"
+      "-DARROW_WITH_ZLIB=ON"
+      "-DARROW_WITH_ZSTD=ON"
+      "-DARROW_MIMALLOC=ON"
+      "-DARROW_SUBSTRAIT=ON"
+      "-DARROW_FLIGHT=${if enableFlight then "ON" else "OFF"}"
+      "-DARROW_FLIGHT_TESTING=${if enableFlight then "ON" else "OFF"}"
+      "-DARROW_S3=${if enableS3 then "ON" else "OFF"}"
+      "-DARROW_GCS=${if enableGcs then "ON" else "OFF"}"
+      # Parquet options:
+      "-DARROW_PARQUET=ON"
+      "-DPARQUET_BUILD_EXECUTABLES=ON"
+      "-DPARQUET_REQUIRE_ENCRYPTION=ON"
+    ]
+    ++ lib.optionals (!enableShared) [ "-DARROW_TEST_LINKAGE=static" ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "-DCMAKE_INSTALL_RPATH=@loader_path/../lib" # needed for tools executables
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [ "-DARROW_USE_SIMD=OFF" ]
+    ++ lib.optionals enableS3 [
+      "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h"
+    ];
+
+  doInstallCheck = true;
+  ARROW_TEST_DATA = lib.optionalString finalAttrs.doInstallCheck "${arrow-testing}/data";
+  PARQUET_TEST_DATA = lib.optionalString finalAttrs.doInstallCheck "${parquet-testing}/data";
+  GTEST_FILTER =
+    let
+      # Upstream Issue: https://issues.apache.org/jira/browse/ARROW-11398
+      filteredTests =
+        lib.optionals stdenv.hostPlatform.isAarch64 [
+          "TestFilterKernelWithNumeric/3.CompareArrayAndFilterRandomNumeric"
+          "TestFilterKernelWithNumeric/7.CompareArrayAndFilterRandomNumeric"
+          "TestCompareKernel.PrimitiveRandomTests"
+        ]
+        ++ lib.optionals enableS3 [
+          "S3OptionsTest.FromUri"
+          "S3RegionResolutionTest.NonExistentBucket"
+          "S3RegionResolutionTest.PublicBucket"
+          "S3RegionResolutionTest.RestrictedBucket"
+          "TestMinioServer.Connect"
+          "TestS3FS.*"
+          "TestS3FSGeneric.*"
+        ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          # TODO: revisit at 12.0.0 or when
+          # https://github.com/apache/arrow/commit/295c6644ca6b67c95a662410b2c7faea0920c989
+          # is available, see
+          # https://github.com/apache/arrow/pull/15288#discussion_r1071244661
+          "ExecPlanExecution.StressSourceSinkStopped"
+        ];
+    in
+    lib.optionalString finalAttrs.doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
+
+  __darwinAllowLocalNetworking = true;
+
+  nativeInstallCheckInputs =
+    [
+      perl
+      which
+      sqlite
+    ]
+    ++ lib.optionals enableS3 [ minio ]
+    ++ lib.optionals enableFlight [ python3 ];
+
+  installCheckPhase =
+    let
+      disabledTests = [
+        # flaky
+        "arrow-flight-test"
+        # requires networking
+        "arrow-gcsfs-test"
+        "arrow-flight-integration-test"
+      ];
+    in
+    ''
+      runHook preInstallCheck
+
+      ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'
+
+      runHook postInstallCheck
+    '';
+
+  meta = with lib; {
+    description = "Cross-language development platform for in-memory data";
+    homepage = "https://arrow.apache.org/docs/cpp/";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      tobim
+      veprbl
+      cpcloud
+    ];
+    pkgConfigModules = [
+      "arrow"
+      "arrow-acero"
+      "arrow-compute"
+      "arrow-csv"
+      "arrow-dataset"
+      "arrow-filesystem"
+      "arrow-flight"
+      "arrow-flight-sql"
+      "arrow-flight-testing"
+      "arrow-json"
+      "arrow-substrait"
+      "arrow-testing"
+      "parquet"
+    ];
+  };
+  passthru = {
+    inherit
+      enableFlight
+      enableJemalloc
+      enableS3
+      enableGcs
+      ;
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+})
diff --git a/pkgs/tools/filesystems/kdiskmark/default.nix b/pkgs/tools/filesystems/kdiskmark/default.nix
index e094f6ce5ee8a..2f9f09fdc9d37 100644
--- a/pkgs/tools/filesystems/kdiskmark/default.nix
+++ b/pkgs/tools/filesystems/kdiskmark/default.nix
@@ -24,13 +24,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     wrapQtAppsHook
   ];
 
   buildInputs = [
     qtbase
     qttools
-    extra-cmake-modules
     polkit-qt
   ];
 
diff --git a/pkgs/tools/inputmethods/fcitx5/default.nix b/pkgs/tools/inputmethods/fcitx5/default.nix
index 325c1a7e6b3b9..aa1d4beea88d8 100644
--- a/pkgs/tools/inputmethods/fcitx5/default.nix
+++ b/pkgs/tools/inputmethods/fcitx5/default.nix
@@ -4,6 +4,7 @@
   fetchurl,
   fetchFromGitHub,
   pkg-config,
+  buildPackages,
   cmake,
   extra-cmake-modules,
   wayland-scanner,
@@ -29,7 +30,6 @@
   libthai,
   libdatrie,
   xcbutilkeysyms,
-  pcre,
   xcbutil,
   xcbutilwm,
   xcb-imdkit,
@@ -68,7 +68,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    extra-cmake-modules # required to please CMake
     expat
     fmt
     isocodes
@@ -89,7 +88,6 @@ stdenv.mkDerivation rec {
     libsepol
     libXdmcp
     libxkbcommon
-    pcre
     xcbutil
     xcbutilwm
     xcbutilkeysyms
@@ -98,6 +96,10 @@ stdenv.mkDerivation rec {
     libxkbfile
   ];
 
+  cmakeFlags = lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    (lib.cmakeFeature "CMAKE_CROSSCOMPILING_EMULATOR" (stdenv.hostPlatform.emulator buildPackages))
+  ];
+
   strictDeps = true;
 
   passthru = {
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-bamboo.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-bamboo.nix
index ce6815843a39b..4ae81bfb001df 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-bamboo.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-bamboo.nix
@@ -25,13 +25,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     gettext
     go
   ];
 
   buildInputs = [
     fcitx5
-    extra-cmake-modules
   ];
 
   preConfigure = ''
diff --git a/pkgs/tools/networking/gp-saml-gui/default.nix b/pkgs/tools/networking/gp-saml-gui/default.nix
index d0347a62e785f..90a4fc36e7d55 100644
--- a/pkgs/tools/networking/gp-saml-gui/default.nix
+++ b/pkgs/tools/networking/gp-saml-gui/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   buildPythonPackage,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   wrapGAppsHook3,
   glib-networking,
   gobject-introspection,
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     requests
     pygobject3
     openconnect
-  ] ++ lib.optional stdenv.hostPlatform.isLinux webkitgtk_4_0;
+  ] ++ lib.optional stdenv.hostPlatform.isLinux webkitgtk_4_1;
 
   preFixup = ''
     gappsWrapperArgs+=(
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fd0d5c8acd75b..b8d0c8c71d3dd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2538,6 +2538,11 @@ with pkgs;
       # If we want to switch for that before upstream fixes it, use this patch:
       # https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899648638
       fmt = fmt_9;
+
+      # Remove once Ceph supports arrow-cpp >= 20, see:
+      # * https://tracker.ceph.com/issues/71269
+      # * https://github.com/NixOS/nixpkgs/issues/406306
+      arrow-cpp = callPackage ../tools/filesystems/ceph/arrow-cpp-19.nix { };
     })
     ceph
     ceph-client
@@ -10064,23 +10069,23 @@ with pkgs;
       "3000"
     ];
   };
-  sbcl_2_5_1 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.5.1"; };
+  sbcl_2_5_2 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.5.2"; };
     faslExt = "fasl";
     flags = [
       "--dynamic-space-size"
       "3000"
     ];
   };
-  sbcl_2_5_2 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.5.2"; };
+  sbcl_2_5_4 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.5.4"; };
     faslExt = "fasl";
     flags = [
       "--dynamic-space-size"
       "3000"
     ];
   };
-  sbcl = sbcl_2_5_2;
+  sbcl = sbcl_2_5_4;
 
   sbclPackages = recurseIntoAttrs sbcl.pkgs;
 
@@ -10909,6 +10914,10 @@ with pkgs;
 
   stalwart-mail-webadmin = stalwart-mail.webadmin;
 
+  stalwart-mail-enterprise = stalwart-mail.override {
+    stalwartEnterprise = true;
+  };
+
   ruby-zoom = callPackage ../tools/text/ruby-zoom { };
 
   inherit (callPackages ../servers/monitoring/sensu-go { })
diff --git a/pkgs/top-level/lua-packages.nix b/pkgs/top-level/lua-packages.nix
index e5272950b292d..1cd461efa91fe 100644
--- a/pkgs/top-level/lua-packages.nix
+++ b/pkgs/top-level/lua-packages.nix
@@ -205,6 +205,9 @@ rec {
     }
   ) { };
 
+  luv = callPackage ../development/lua-modules/luv { };
+  libluv = callPackage ../development/lua-modules/luv/lib.nix { };
+
   luxio = callPackage (
     {
       fetchurl,
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b57b65b78a531..45403bd8077d0 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4133,6 +4133,8 @@ self: super: with self; {
 
   downloader-cli = callPackage ../development/python-modules/downloader-cli { };
 
+  doxmlparser = callPackage ../development/tools/documentation/doxygen/doxmlparser.nix { };
+
   dparse = callPackage ../development/python-modules/dparse { };
 
   dparse2 = callPackage ../development/python-modules/dparse2 { };
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 59ee41b013eab..3ad70a5dc1776 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -575,7 +575,7 @@ let
         compilerNames.ghc9122
       ] released;
       Cabal_3_12_1_0 = released;
-      Cabal_3_14_1_1 = released;
+      Cabal_3_14_2_0 = released;
       cabal2nix = released;
       cabal2nix-unstable = released;
       funcmp = released;