diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index f6ffeb9b122a5..d83dc1efe44ff 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -153,3 +153,6 @@ bdfde18037f8d9f9b641a4016c8ada4dc4cbf856
 
 # nixos/ollama: format with nixfmt-rfc-style (#329561)
 246d1ee533810ac1946d863bbd9de9b525818d56
+
+# nixos/nvidia: apply nixfmt-rfc-style (#313440)
+fbdcdde04a7caa007e825a8b822c75fab9adb2d6
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a0f70a36a8f72..0fd6c293a7adb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4693,6 +4693,11 @@
     githubId = 3179832;
     name = "D. Bohdan";
   };
+  d-brasher = {
+    github = "d-brasher";
+    githubId = 175485311;
+    name = "D. Brasher";
+  };
   dbrgn = {
     email = "nix@dbrgn.ch";
     github = "dbrgn";
@@ -14920,6 +14925,12 @@
     githubId = 16027994;
     name = "Nathan Viets";
   };
+  nw = {
+    email = "nixpkgs@nwhirschfeld.de";
+    github = "nwhirschfeld";
+    githubId = 5047052;
+    name = "Niclas Hirschfeld";
+  };
   nyadiia = {
     email = "nyadiia@pm.me";
     github = "nyadiia";
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index 1aa79166dee7e..b4e833186e553 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -472,7 +472,6 @@ in
 
           hardware.graphics = {
             extraPackages = [ pkgs.nvidia-vaapi-driver ];
-            extraPackages32 = [ pkgs.pkgsi686Linux.nvidia-vaapi-driver ];
           };
 
           environment.systemPackages =
diff --git a/nixos/modules/services/backup/mysql-backup.nix b/nixos/modules/services/backup/mysql-backup.nix
index 00381be4b75d3..e3fa7f45844f1 100644
--- a/nixos/modules/services/backup/mysql-backup.nix
+++ b/nixos/modules/services/backup/mysql-backup.nix
@@ -20,7 +20,7 @@ let
   '';
   backupDatabaseScript = db: ''
     dest="${cfg.location}/${db}.gz"
-    if ${mariadb}/bin/mysqldump ${optionalString cfg.singleTransaction "--single-transaction"} ${db} | ${gzip}/bin/gzip -c > $dest.tmp; then
+    if ${mariadb}/bin/mysqldump ${optionalString cfg.singleTransaction "--single-transaction"} ${db} | ${gzip}/bin/gzip -c ${cfg.gzipOptions} > $dest.tmp; then
       mv $dest.tmp $dest
       echo "Backed up to $dest"
     else
@@ -78,6 +78,14 @@ in
           Whether to create database dump in a single transaction
         '';
       };
+
+      gzipOptions = mkOption {
+        default = "--no-name --rsyncable";
+        type = types.str;
+        description = ''
+          Command line options to use when invoking `gzip`.
+        '';
+      };
     };
 
   };
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index adde070d03723..8d20bea3c3d6a 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1099,6 +1099,23 @@ let
         };
       };
 
+      csharpier.csharpier-vscode = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "csharpier-vscode";
+          publisher = "csharpier";
+          version = "1.7.3";
+          hash = "sha256-/ZLjnlLl6xmgEazdCbnuE6UuuV1tDwAjpxz+vmBuYHE=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/csharpier.csharpier-vscode/changelog";
+          description = "CSharpier code formatter for Visual Studio Code";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=csharpier.csharpier-vscode";
+          homepage = "https://github.com/belav/csharpier";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.magnouvean ];
+        };
+      };
+
       cweijan.dbclient-jdbc = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "dbclient-jdbc";
@@ -3109,6 +3126,72 @@ let
       ms-dotnettools.csdevkit = callPackage ./ms-dotnettools.csdevkit { };
       ms-dotnettools.csharp = callPackage ./ms-dotnettools.csharp { };
 
+      ms-dotnettools.vscode-dotnet-runtime = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-dotnet-runtime";
+          publisher = "ms-dotnettools";
+          version = "2.1.1";
+          hash = "sha256-k14bjWITPDduJi79W59SnMV2TFNRCeAymhs6u1Y0vzk=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/ms-dotnettools.vscode-dotnet-runtime/changelog";
+          description = "Provides a way for other Visual Studio Code extensions to install local versions of .NET SDK/Runtime";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-dotnettools.vscode-dotnet-runtime";
+          homepage = "https://github.com/dotnet/vscode-dotnet-runtime";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.magnouvean ];
+        };
+      };
+
+      ms-dotnettools.vscodeintellicode-csharp = buildVscodeMarketplaceExtension {
+        mktplcRef =
+          let
+            sources = {
+              "x86_64-linux" = {
+                arch = "linux-x64";
+                hash = "sha256-oQMwzQuW5vjxtDboRCeiEO5aytsAY6rb14JDTmK3JPg=";
+              };
+              "x86_64-darwin" = {
+                arch = "darwin-x64";
+                hash = "sha256-/9+qtLDNYUFvdoehit3BihA38p6RqJ7na5Q27xxpZk0=";
+              };
+              "aarch64-linux" = {
+                arch = "linux-arm64";
+                hash = "sha256-JqLlYMKyTXaEzuTPPxVaO8WJiuCUN+9xBzyA6+aYdSc=";
+              };
+              "aarch64-darwin" = {
+                arch = "darwin-arm64";
+                hash = "sha256-dhiUePePkO3MxRQ5UP+lOxRax503JlERe/GWJ8pPUIg=";
+              };
+            };
+          in
+          {
+            name = "vscodeintellicode-csharp";
+            publisher = "ms-dotnettools";
+            version = "2.1.11";
+          }
+          // sources.${stdenv.system};
+        nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
+        buildInputs = [
+          stdenv.cc.cc.lib
+          zlib
+        ];
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/ms-dotnettools.vscodeintellicode-csharp/changelog";
+          description = "AI-assisted development features for C# in Visual Studio Code";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-dotnettools.vscodeintellicode-csharp";
+          homepage = "https://github.com/MicrosoftDocs/intellicode";
+          license = lib.licenses.unfree;
+          maintainers = [ lib.maintainers.magnouvean ];
+          platforms = [
+            "x86_64-linux"
+            "x86_64-darwin"
+            "aarch64-darwin"
+            "aarch64-linux"
+          ];
+        };
+      };
+
       ms-kubernetes-tools.vscode-kubernetes-tools = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-kubernetes-tools";
diff --git a/pkgs/applications/misc/junction/default.nix b/pkgs/applications/misc/junction/default.nix
index 66658cfe7402e..cf03a315b2cfa 100644
--- a/pkgs/applications/misc/junction/default.nix
+++ b/pkgs/applications/misc/junction/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "junction";
-  version = "1.7";
+  version = "1.8";
 
   src = fetchFromGitHub {
     owner = "sonnyp";
     repo = "junction";
     rev = "v${version}";
-    hash = "sha256-qPseu2rzK6xp7eb/SrWK6fML/6xh4raP0MEreyZgqVI=";
+    hash = "sha256-0zY6Dp0aKHtBHSTiGbI5o6876BsARbo8/BbArl0RaMY=";
     fetchSubmodules = true;
   };
 
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     mainProgram = "re.sonny.Junction";
     description = "Choose the application to open files and links";
-    homepage = "https://apps.gnome.org/en/app/re.sonny.Junction/";
+    homepage = "https://apps.gnome.org/Junction/";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ hqurve ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/misc/kondo/default.nix b/pkgs/applications/misc/kondo/default.nix
index eba5799a91727..03fc56ceb016e 100644
--- a/pkgs/applications/misc/kondo/default.nix
+++ b/pkgs/applications/misc/kondo/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, installShellFiles }:
 
 rustPlatform.buildRustPackage rec {
   pname = "kondo";
@@ -13,6 +13,15 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-WF4GHj/5VYrTUh1E3t29zbpSLjJ6g7RWVpLYqg9msZg=";
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd kondo \
+      --bash <($out/bin/kondo --completions bash) \
+      --fish <($out/bin/kondo --completions fish) \
+      --zsh <($out/bin/kondo --completions zsh)
+  '';
+
   meta = with lib; {
     description = "Save disk space by cleaning unneeded files from software projects";
     homepage = "https://github.com/tbillington/kondo";
diff --git a/pkgs/applications/misc/lyx/default.nix b/pkgs/applications/misc/lyx/default.nix
index dc79cc5922fb9..bf3c3b06dc836 100644
--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@@ -1,34 +1,48 @@
-{ fetchurl, lib, mkDerivation, pkg-config, python3, file, bc
-, qtbase, qtsvg, hunspell, makeWrapper #, mythes, boost
+{
+  fetchurl,
+  lib,
+  mkDerivation,
+  pkg-config,
+  python3,
+  file,
+  bc,
+  qtbase,
+  qtsvg,
+  hunspell,
+  makeWrapper, # , mythes, boost
 }:
 
 mkDerivation rec {
-  version = "2.3.7-1";
+  version = "2.4.1";
   pname = "lyx";
 
   src = fetchurl {
-    url = "ftp://ftp.lyx.org/pub/lyx/stable/2.3.x/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Ob6IZPuGs06IMQ5w+4Dl6eKWYB8IVs8WGqCUFxcY2O0=";
+    url = "ftp://ftp.lyx.org/pub/lyx/stable/2.4.x/${pname}-${version}.tar.xz";
+    hash = "sha256-dN4ooH7zeqlHG8mWLbGCFSolMQx9H0f2drubxj2XE8U=";
   };
 
-  # Needed with GCC 12
-  postPatch = ''
-    sed '1i#include <iterator>' -i src/lyxfind.cpp
-    sed '1i#include <cstring>'  -i src/insets/InsetListings.cpp
-  '';
-
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs
-  nativeBuildInputs = [ pkg-config makeWrapper python3 qtbase ];
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+    python3
+    qtbase
+  ];
   buildInputs = [
-    qtbase qtsvg file/*for libmagic*/ bc
+    qtbase
+    qtsvg
+    file # for libmagic
+    bc
     hunspell # enchant
   ];
 
   configureFlags = [
     "--enable-qt5"
     #"--without-included-boost"
-    /*  Boost is a huge dependency from which 1.4 MB of libs would be used.
-        Using internal boost stuff only increases executable by around 0.2 MB. */
+    /*
+      Boost is a huge dependency from which 1.4 MB of libs would be used.
+       Using internal boost stuff only increases executable by around 0.2 MB.
+    */
     #"--without-included-mythes" # such a small library isn't worth a separate package
   ];
 
@@ -36,9 +50,7 @@ mkDerivation rec {
   doCheck = true;
 
   # python is run during runtime to do various tasks
-  qtWrapperArgs = [
-    " --prefix PATH : ${python3}/bin"
-  ];
+  qtWrapperArgs = [ " --prefix PATH : ${python3}/bin" ];
 
   meta = with lib; {
     description = "WYSIWYM frontend for LaTeX, DocBook";
@@ -48,4 +60,3 @@ mkDerivation rec {
     platforms = platforms.linux;
   };
 }
-
diff --git a/pkgs/applications/networking/cluster/atmos/default.nix b/pkgs/applications/networking/cluster/atmos/default.nix
index 03d181325ac79..ab481ba74cb3e 100644
--- a/pkgs/applications/networking/cluster/atmos/default.nix
+++ b/pkgs/applications/networking/cluster/atmos/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "atmos";
-  version = "1.83.1";
+  version = "1.85.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-B1s+9oLShbrziYm9P8xE5UPwxTchlGPUmjYSWGhsGjY=";
+    sha256 = "sha256-nIW7Wt4mThxjnHHF+rD6q9vZ7KsB//nSpkWtkiTo16Y=";
   };
 
-  vendorHash = "sha256-dklmWu+PHSEeQM2MWBkYMiyw5rX9S8SI3l86nst6v9E=";
+  vendorHash = "sha256-swQN0WjVfLo/LjZrvjX46CnfBGnrVzLj8Cv4IP0eL7Y=";
 
   ldflags = [ "-s" "-w" "-X github.com/cloudposse/atmos/cmd.Version=v${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/rke2/update-script.sh b/pkgs/applications/networking/cluster/rke2/update-script.sh
index 608f49bb64903..029933b8f8028 100755
--- a/pkgs/applications/networking/cluster/rke2/update-script.sh
+++ b/pkgs/applications/networking/cluster/rke2/update-script.sh
@@ -5,7 +5,9 @@ set -x -eu -o pipefail
 
 CHANNEL_NAME="${1:?Must provide a release channel, like 'stable', as the only argument}"
 
-mkdir --parents --verbose ./${CHANNEL_NAME}
+WORKDIR=$(cd $(dirname ${BASH_SOURCE[0]}) && pwd -P)
+
+mkdir --parents --verbose "${WORKDIR}/${CHANNEL_NAME}"
 
 LATEST_TAG_NAME=$(curl --silent --fail https://update.rke2.io/v1-release/channels | \
     yq eval ".data[] | select(.id == \"${CHANNEL_NAME}\").latest" - | \
@@ -35,9 +37,9 @@ KUBERNETES_EOL=$(curl --silent --fail \
         https://endoflife.date/api/kubernetes/${KUBERNETES_CYCLES}.json | \
     yq eval ".eol" -)
 
-FAKE_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+FAKE_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
 
-cat > ./${CHANNEL_NAME}/versions.nix << EOF
+cat << EOF > "${WORKDIR}/${CHANNEL_NAME}/versions.nix"
 {
   rke2Version = "${RKE2_VERSION}";
   rke2RepoSha256 = "${RKE2_REPO_SHA256}";
@@ -54,15 +56,13 @@ cat > ./${CHANNEL_NAME}/versions.nix << EOF
 }
 EOF
 
-NIXPKGS_ROOT=$(git rev-parse --show-toplevel)
-
 set +e
-RKE2_VENDOR_HASH=$(nix-prefetch -I nixpkgs=${NIXPKGS_ROOT} \
-        "{ sha256 }: (import ${NIXPKGS_ROOT}/. {}).rke2_${CHANNEL_NAME}.goModules.overrideAttrs (_: { vendorHash = sha256; })")
+RKE2_VENDOR_HASH=$(nix-prefetch -I nixpkgs=$(git rev-parse --show-toplevel) \
+        "{ sha256 }: rke2_${CHANNEL_NAME}.goModules.overrideAttrs (_: { vendorHash = sha256; })")
 set -e
 
 if [ -n "${RKE2_VENDOR_HASH:-}" ]; then
-    sed -i "s#${FAKE_HASH}#${RKE2_VENDOR_HASH}#g" ./${CHANNEL_NAME}/versions.nix
+    sed -i "s#${FAKE_HASH}#${RKE2_VENDOR_HASH}#g" ${WORKDIR}/${CHANNEL_NAME}/versions.nix
 else
     echo "Update failed. 'RKE2_VENDOR_HASH' is empty."
     exit 1
@@ -70,17 +70,15 @@ fi
 
 # Implement commit
 # See: https://nixos.org/manual/nixpkgs/stable/#var-passthru-updateScript-commit
-OLD_VERSION=$(nix-instantiate --eval -E \
-        "with import ${NIXPKGS_ROOT}/. {}; rke2.version or (builtins.parseDrvName rke2.name).version" | \
-    tr -d '"')
-
 cat << EOF
-[{
-  "attrPath": "rke2_${CHANNEL_NAME}",
-  "oldVersion": "${OLD_VERSION}",
-  "newVersion": "${RKE2_VERSION}",
-  "files": [
-    "${PWD}/${CHANNEL_NAME}/versions.nix"
-  ]
-}]
+[
+  {
+    "attrPath": "rke2_${CHANNEL_NAME}",
+    "oldVersion": "${UPDATE_NIX_OLD_VERSION}",
+    "newVersion": "${RKE2_VERSION}",
+    "files": [
+      "${WORKDIR}/${CHANNEL_NAME}/versions.nix"
+    ]
+  }
+]
 EOF
diff --git a/pkgs/applications/networking/cluster/terraspace/Gemfile b/pkgs/applications/networking/cluster/terraspace/Gemfile
index 7a6bbf7cc943e..3e9579dd75cf3 100644
--- a/pkgs/applications/networking/cluster/terraspace/Gemfile
+++ b/pkgs/applications/networking/cluster/terraspace/Gemfile
@@ -1,2 +1,2 @@
 source "https://rubygems.org"
-gem "terraspace", '~> 2.2.8'
+gem "terraspace"
diff --git a/pkgs/applications/networking/cluster/terraspace/Gemfile.lock b/pkgs/applications/networking/cluster/terraspace/Gemfile.lock
index 4fce1f819664d..aa9e1600198be 100644
--- a/pkgs/applications/networking/cluster/terraspace/Gemfile.lock
+++ b/pkgs/applications/networking/cluster/terraspace/Gemfile.lock
@@ -1,36 +1,45 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.6)
+    activesupport (7.1.3.4)
+      base64
+      bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
+      connection_pool (>= 2.2.5)
+      drb
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
+      mutex_m
       tzinfo (~> 2.0)
-    aws-eventstream (1.2.0)
-    aws-partitions (1.785.0)
-    aws-sdk-core (3.177.0)
-      aws-eventstream (~> 1, >= 1.0.2)
+    aws-eventstream (1.3.0)
+    aws-partitions (1.956.0)
+    aws-sdk-core (3.201.1)
+      aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.651.0)
-      aws-sigv4 (~> 1.5)
+      aws-sigv4 (~> 1.8)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.70.0)
-      aws-sdk-core (~> 3, >= 3.177.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.128.0)
-      aws-sdk-core (~> 3, >= 3.177.0)
+    aws-sdk-kms (1.88.0)
+      aws-sdk-core (~> 3, >= 3.201.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.156.0)
+      aws-sdk-core (~> 3, >= 3.201.0)
       aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.6)
-    aws-sigv4 (1.6.0)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.8.0)
       aws-eventstream (~> 1, >= 1.0.2)
-    cli-format (0.2.2)
+    base64 (0.2.0)
+    bigdecimal (3.1.8)
+    cli-format (0.6.1)
       activesupport
       text-table
       zeitwerk
-    concurrent-ruby (1.2.2)
+    concurrent-ruby (1.3.3)
+    connection_pool (2.4.1)
     deep_merge (1.2.2)
-    diff-lcs (1.5.0)
-    dotenv (2.8.1)
-    dsl_evaluator (0.3.1)
+    diff-lcs (1.5.1)
+    dotenv (3.1.2)
+    drb (2.2.1)
+    dsl_evaluator (0.3.2)
       activesupport
       memoist
       rainbow
@@ -38,40 +47,42 @@ GEM
     eventmachine (1.2.7)
     eventmachine-tail (0.6.5)
       eventmachine
-    graph (2.11.0)
+    graph (2.11.1)
     hcl_parser (0.2.2)
       rhcl
-    i18n (1.14.1)
+    i18n (1.14.5)
       concurrent-ruby (~> 1.0)
     jmespath (1.6.2)
     memoist (0.16.2)
-    minitest (5.18.1)
-    nokogiri (1.15.3)
-      racc (~> 1.4)
+    mini_portile2 (2.8.7)
+    minitest (5.24.1)
+    mutex_m (0.2.0)
+    nokogiri (1.16.6)
       mini_portile2 (~> 2.8.2)
-    racc (1.7.1)
-    mini_portile2 (2.8.2)
+      racc (~> 1.4)
+    racc (1.8.0)
     rainbow (3.1.1)
     render_me_pretty (0.9.0)
       activesupport
       rainbow
       tilt
-    rexml (3.2.5)
+    rexml (3.3.2)
+      strscan
     rhcl (0.1.0)
       deep_merge
-    rspec (3.12.0)
-      rspec-core (~> 3.12.0)
-      rspec-expectations (~> 3.12.0)
-      rspec-mocks (~> 3.12.0)
-    rspec-core (3.12.2)
-      rspec-support (~> 3.12.0)
-    rspec-expectations (3.12.3)
+    rspec (3.13.0)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.0)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.1)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.12.0)
-    rspec-mocks (3.12.5)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.1)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.12.0)
-    rspec-support (3.12.1)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.1)
     rspec-terraspace (0.3.3)
       activesupport
       memoist
@@ -79,7 +90,8 @@ GEM
       rspec
       zeitwerk
     rubyzip (2.3.2)
-    terraspace (2.2.8)
+    strscan (3.1.0)
+    terraspace (2.2.17)
       activesupport
       bundler
       cli-format
@@ -110,20 +122,20 @@ GEM
       thor
       zeitwerk
     text-table (1.2.4)
-    thor (1.2.2)
-    tilt (2.2.0)
+    thor (1.3.1)
+    tilt (2.4.0)
     tty-tree (0.4.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    zeitwerk (2.6.8)
+    zeitwerk (2.6.16)
     zip_folder (0.1.0)
       rubyzip
 
 PLATFORMS
-  x86_64-linux
+  ruby
 
 DEPENDENCIES
-  terraspace (~> 2.2.8)
+  terraspace
 
 BUNDLED WITH
-   2.3.26
+   2.5.11
diff --git a/pkgs/applications/networking/cluster/terraspace/gemset.nix b/pkgs/applications/networking/cluster/terraspace/gemset.nix
index a4e082c6d0d85..606e450c42708 100644
--- a/pkgs/applications/networking/cluster/terraspace/gemset.nix
+++ b/pkgs/applications/networking/cluster/terraspace/gemset.nix
@@ -1,34 +1,34 @@
 {
   activesupport = {
-    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
+    dependencies = ["base64" "bigdecimal" "concurrent-ruby" "connection_pool" "drb" "i18n" "minitest" "mutex_m" "tzinfo"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cjsf26656996hv48wgv2mkwxf0fy1qc68ikgzq7mzfq2mmvmayk";
+      sha256 = "0283wk1zxb76lg79dk501kcf5xy9h25qiw15m86s4nrfv11vqns5";
       type = "gem";
     };
-    version = "7.0.6";
+    version = "7.1.3.4";
   };
   aws-eventstream = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pyis1nvnbjxk12a43xvgj2gv0mvp4cnkc1gzw0v1018r61399gz";
+      sha256 = "0gvdg4yx4p9av2glmp7vsxhs0n8fj1ga9kq2xdb8f95j7b04qhzi";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.3.0";
   };
   aws-partitions = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05m0c3h1z0jhaqiciil55fshrjvc725cf1lc0g933pf98vqflb0r";
+      sha256 = "03zb6x4x68y91gywsyi4a6hxy4pdyng8mnxwd858bhjfymml8kkf";
       type = "gem";
     };
-    version = "1.785.0";
+    version = "1.956.0";
   };
   aws-sdk-core = {
     dependencies = ["aws-eventstream" "aws-partitions" "aws-sigv4" "jmespath"];
@@ -36,10 +36,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09firi4bin3ay4pd59qgxspq2f1isfi1li8rabpw6lvvbhnar168";
+      sha256 = "1ihl7iwndl3jjy89sh427wf8mdb7ii76bsjf6fkxq9ha30nz4f3g";
       type = "gem";
     };
-    version = "3.177.0";
+    version = "3.201.1";
   };
   aws-sdk-kms = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
@@ -47,10 +47,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1x73qj2c39ap926by14x56cjmp2cd5jpq5gv33xynypy1idyb0fj";
+      sha256 = "02g3l3lcyddqncrwjxgawxl33p2p715k1gbrdlgyiv0yvy88sn0k";
       type = "gem";
     };
-    version = "1.70.0";
+    version = "1.88.0";
   };
   aws-sdk-s3 = {
     dependencies = ["aws-sdk-core" "aws-sdk-kms" "aws-sigv4"];
@@ -58,10 +58,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11cxk6b3p1bsl1gg3pi93qx2ynbjrrsrsc68nnqsjm4npvaj052v";
+      sha256 = "0ika0xmmrkc7jiwdi5gqia5wywkcbw1nal2dhl436dkh38fxl0lk";
       type = "gem";
     };
-    version = "1.128.0";
+    version = "1.156.0";
   };
   aws-sigv4 = {
     dependencies = ["aws-eventstream"];
@@ -69,10 +69,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0z889c4c1w7wsjm3szg64ay5j51kjl4pdf94nlr1yks2rlanm7na";
+      sha256 = "1g3w27wzjy4si6kp49w10as6ml6g6zl3xrfqs5ikpfciidv9kpc4";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.8.0";
+  };
+  base64 = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  bigdecimal = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1gi7zqgmqwi5lizggs1jhc3zlwaqayy9rx2ah80sxy24bbnng558";
+      type = "gem";
+    };
+    version = "3.1.8";
   };
   cli-format = {
     dependencies = ["activesupport" "text-table" "zeitwerk"];
@@ -80,20 +100,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mr8vkw5zwb3flhhf8s923mi7r85g1ky0lmjz4q5xhwb48ji55qf";
+      sha256 = "0rrjck5r25dlcg1gwz6pb5f4rllx77lg6a514a5l3lajfd95shm3";
       type = "gem";
     };
-    version = "0.2.2";
+    version = "0.6.1";
   };
   concurrent-ruby = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0krcwb6mn0iklajwngwsg850nk8k9b35dhmc2qkbdqvmifdi2y9q";
+      sha256 = "0skwdasxq7mnlcccn6aqabl7n9r3jd7k19ryzlzzip64cn4x572g";
       type = "gem";
     };
-    version = "1.2.2";
+    version = "1.3.3";
+  };
+  connection_pool = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1x32mcpm2cl5492kd6lbjbaf17qsssmpx9kdyr7z1wcif2cwyh0g";
+      type = "gem";
+    };
+    version = "2.4.1";
   };
   deep_merge = {
     groups = ["default"];
@@ -110,20 +140,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rwvjahnp7cpmracd8x732rjgnilqv2sx7d1gfrysslc3h039fa9";
+      sha256 = "1znxccz83m4xgpd239nyqxlifdb7m8rlfayk6s259186nkgj6ci7";
       type = "gem";
     };
-    version = "1.5.0";
+    version = "1.5.1";
   };
   dotenv = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1n0pi8x8ql5h1mijvm8lgn6bhq4xjb5a500p5r1krq4s6j9lg565";
+      sha256 = "0y24jabiz4cf9ni9vi4j8sab8b5phpf2mpw3981r0r94l4m6q0q8";
       type = "gem";
     };
-    version = "2.8.1";
+    version = "3.1.2";
+  };
+  drb = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79";
+      type = "gem";
+    };
+    version = "2.2.1";
   };
   dsl_evaluator = {
     dependencies = ["activesupport" "memoist" "rainbow" "zeitwerk"];
@@ -131,10 +171,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mck2j0gr851kj9l7pix97jmmwwazfjq83ryamx5rpdbgv5mrh51";
+      sha256 = "0hd079baa5pfyyc2wc9p5h82qjp7fnx0s0shn2i19ig186cizh2x";
       type = "gem";
     };
-    version = "0.3.1";
+    version = "0.3.2";
   };
   eventmachine = {
     groups = ["default"];
@@ -162,10 +202,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10l1bdqc9yzdk6kqwh9vw918lyw846gpqw2z8kfcwl53zdjdzcl9";
+      sha256 = "1bwssjgl9nfq9jhn9bfc7pqfl2c2xi0wnpng66l029m03kmdq8k4";
       type = "gem";
     };
-    version = "2.11.0";
+    version = "2.11.1";
   };
   hcl_parser = {
     dependencies = ["rhcl"];
@@ -184,10 +224,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qaamqsh5f3szhcakkak8ikxlzxqnv49n2p7504hcz2l0f4nj0wx";
+      sha256 = "1ffix518y7976qih9k1lgnc17i3v6yrlh0a3mckpxdb4wc2vrp16";
       type = "gem";
     };
-    version = "1.14.1";
+    version = "1.14.5";
   };
   jmespath = {
     groups = ["default"];
@@ -214,20 +254,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0z7f38iq37h376n9xbl4gajdrnwzq284c9v1py4imw3gri2d5cj6";
+      sha256 = "1q1f2sdw3y3y9mnym9dhjgsjr72sq975cfg5c4yx7gwv8nmzbvhk";
       type = "gem";
     };
-    version = "2.8.2";
+    version = "2.8.7";
   };
   minitest = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kg9wh7jlc9zsr3hkhpzkbn0ynf4np5ap9m2d8xdrb8shy0y6pmb";
+      sha256 = "0jj629q3vw5yn90q4di4dyb87pil4a8qfm2srhgy5nc8j2n33v1i";
+      type = "gem";
+    };
+    version = "5.24.1";
+  };
+  mutex_m = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ma093ayps1m92q845hmpk0dmadicvifkbf05rpq9pifhin0rvxn";
       type = "gem";
     };
-    version = "5.18.1";
+    version = "0.2.0";
   };
   nokogiri = {
     dependencies = ["mini_portile2" "racc"];
@@ -235,20 +285,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jw8a20a9k05fpz3q24im19b97idss3179z76yn5scc5b8lk2rl7";
+      sha256 = "1vz1ychq2fhfqjgqdrx8bqkaxg5dzcgwnah00m57ydylczfy8pwk";
       type = "gem";
     };
-    version = "1.15.3";
+    version = "1.16.6";
   };
   racc = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11v3l46mwnlzlc371wr3x6yylpgafgwdf0q7hc7c1lzx6r414r5g";
+      sha256 = "021s7maw0c4d9a6s07vbmllrzqsj2sgmrwimlh8ffkvwqdjrld09";
       type = "gem";
     };
-    version = "1.7.1";
+    version = "1.8.0";
   };
   rainbow = {
     groups = ["default"];
@@ -272,14 +322,15 @@
     version = "0.9.0";
   };
   rexml = {
+    dependencies = ["strscan"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
+      sha256 = "0zr5qpa8lampaqzhdcjcvyqnrqcjl7439mqjlkjz43wdhmpnh4s5";
       type = "gem";
     };
-    version = "3.2.5";
+    version = "3.3.2";
   };
   rhcl = {
     dependencies = ["deep_merge"];
@@ -298,10 +349,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "171rc90vcgjl8p1bdrqa92ymrj8a87qf6w20x05xq29mljcigi6c";
+      sha256 = "14xrp8vq6i9zx37vh0yp4h9m0anx9paw200l1r5ad9fmq559346l";
       type = "gem";
     };
-    version = "3.12.0";
+    version = "3.13.0";
   };
   rspec-core = {
     dependencies = ["rspec-support"];
@@ -309,10 +360,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0l95bnjxdabrn79hwdhn2q1n7mn26pj7y1w5660v5qi81x458nqm";
+      sha256 = "0k252n7s80bvjvpskgfm285a3djjjqyjcarlh3aq7a4dx2s94xsm";
       type = "gem";
     };
-    version = "3.12.2";
+    version = "3.13.0";
   };
   rspec-expectations = {
     dependencies = ["diff-lcs" "rspec-support"];
@@ -320,10 +371,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05j44jfqlv7j2rpxb5vqzf9hfv7w8ba46wwgxwcwd8p0wzi1hg89";
+      sha256 = "0022nxs9gqfhx35n4klibig770n0j31pnkd8anz00yvrvkdghk41";
       type = "gem";
     };
-    version = "3.12.3";
+    version = "3.13.1";
   };
   rspec-mocks = {
     dependencies = ["diff-lcs" "rspec-support"];
@@ -331,20 +382,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hfm17xakfvwya236graj6c2arr4sb9zasp35q5fykhyz8mhs0w2";
+      sha256 = "0f3vgp43hajw716vmgjv6f4ar6f97zf50snny6y3fy9kkj4qjw88";
       type = "gem";
     };
-    version = "3.12.5";
+    version = "3.13.1";
   };
   rspec-support = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ky86j3ksi26ng9ybd7j0qsdf1lpr8mzrmn98yy9gzv801fvhsgr";
+      sha256 = "03z7gpqz5xkw9rf53835pa8a9vgj4lic54rnix9vfwmp2m7pv1s8";
       type = "gem";
     };
-    version = "3.12.1";
+    version = "3.13.1";
   };
   rspec-terraspace = {
     dependencies = ["activesupport" "memoist" "rainbow" "rspec" "zeitwerk"];
@@ -367,16 +418,26 @@
     };
     version = "2.3.2";
   };
+  strscan = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0mamrl7pxacbc79ny5hzmakc9grbjysm3yy6119ppgsg44fsif01";
+      type = "gem";
+    };
+    version = "3.1.0";
+  };
   terraspace = {
     dependencies = ["activesupport" "cli-format" "deep_merge" "dotenv" "dsl_evaluator" "eventmachine-tail" "graph" "hcl_parser" "memoist" "rainbow" "render_me_pretty" "rexml" "rspec-terraspace" "terraspace-bundler" "thor" "tty-tree" "zeitwerk" "zip_folder"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zhcdaiq0sgk2gcy4krkzm4qrvcaibkf5n755qgqgcp1f1b0w6gl";
+      sha256 = "1zmnp71fwcj453cafmb8iicbk93flk98wh0wdk0q9xd3mgm3qh6x";
       type = "gem";
     };
-    version = "2.2.8";
+    version = "2.2.17";
   };
   terraspace-bundler = {
     dependencies = ["activesupport" "aws-sdk-s3" "dsl_evaluator" "memoist" "nokogiri" "rainbow" "rubyzip" "thor" "zeitwerk"];
@@ -404,20 +465,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k7j2wn14h1pl4smibasw0bp66kg626drxb59z7rzflch99cd4rg";
+      sha256 = "1vq1fjp45az9hfp6fxljhdrkv75cvbab1jfrwcw738pnsiqk8zps";
       type = "gem";
     };
-    version = "1.2.2";
+    version = "1.3.1";
   };
   tilt = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bmjgbv8158klwp2r3klxjwaj93nh1sbl4xvj9wsha0ic478avz7";
+      sha256 = "0kds7wkxmb038cwp6ravnwn8k65ixc68wpm8j5jx5bhx8ndg4x6z";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.4.0";
   };
   tty-tree = {
     groups = ["default"];
@@ -445,10 +506,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ck6bj7wa73dkdh13735jl06k6cfny98glxjkas82aivlmyzqqbk";
+      sha256 = "08cfb35232p9s1r4jqv8wacv38vxh699mgbr9y03ga89gx9lipqp";
       type = "gem";
     };
-    version = "2.6.8";
+    version = "2.6.16";
   };
   zip_folder = {
     dependencies = ["rubyzip"];
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
index c251258772bfa..79c501a2e6ce6 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop-beta";
   dir = "Signal Beta";
-  version = "7.17.0-beta.1";
+  version = "7.18.0-beta.1";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-sK42Bqh+j4b8SduZk6eMhgBhRMG0q/ee5lAqFYVc4Tg=";
+  hash = "sha256-ZNFssB0SiNAAW7SupxNqdbEtEpemrv+IoyfdWVKu8CI=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
index 26d43cf11da09..ebe2cbc9d9a2d 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "7.16.0";
+  version = "7.17.0";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-DfPQb3TGhVVZ7webNoMmyhjhRKKO3lWf12ZIpi7D7tc=";
+  hash = "sha256-4Yp81aBY01cVZ/KDSqPO3R3HglLup/+sczQ5XNtQn84=";
 }
diff --git a/pkgs/applications/networking/iroh/default.nix b/pkgs/applications/networking/iroh/default.nix
index b0eb919cb4c2b..c976b7f82628e 100644
--- a/pkgs/applications/networking/iroh/default.nix
+++ b/pkgs/applications/networking/iroh/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "iroh";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "n0-computer";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1ke1S5IBrg8XYO67iUaH0T4dA59TkyqelsghIK+TuyM=";
+    hash = "sha256-g/x5lVVrm1NrJbqmhza/wryEwuXHh1tDBf+x6vL+2n0=";
   };
 
-  cargoHash = "sha256-O6HHZtZes8BO2XuCMdVuuHphzYiqkS5axbYIxsGZw6k=";
+  cargoHash = "sha256-Sp2yMF/M3SuNB1DDQ79Lau5IxtSM1NPLJi9TnHWqnuc=";
 
   buildInputs = lib.optionals stdenv.isDarwin (
     with darwin.apple_sdk.frameworks; [
diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
index ffd19cfd4a8a0..c00aff0b22886 100644
--- a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix
@@ -51,7 +51,7 @@ let
   # list of packages which are for x86 (only multiPkgs, only for x86_64 hosts)
   multiPaths = multiPkgs pkgsi686Linux;
 
-  # base packages of the chroot
+  # base packages of the fhsenv
   # these match the host's architecture, glibc_multi is used for multilib
   # builds. glibcLocales must be before glibc or glibc_multi as otherwiese
   # the wrong LOCALE_ARCHIVE will be used where only C.UTF-8 is available.
@@ -84,7 +84,7 @@ let
   '';
 
   etcProfile = writeText "profile" ''
-    export PS1='${name}-chrootenv:\u@\h:\w\$ '
+    export PS1='${name}-fhsenv:\u@\h:\w\$ '
     export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
     export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH"
@@ -123,8 +123,8 @@ let
     ${profile}
   '';
 
-  # Compose /etc for the chroot environment
-  etcPkg = runCommandLocal "${name}-chrootenv-etc" { } ''
+  # Compose /etc for the fhs environment
+  etcPkg = runCommandLocal "${name}-fhs-etc" { } ''
     mkdir -p $out/etc
     pushd $out/etc
 
@@ -215,7 +215,7 @@ let
                  then setupLibDirsTarget
                  else setupLibDirsMulti;
 
-  # the target profile is the actual profile that will be used for the chroot
+  # the target profile is the actual profile that will be used for the fhs
   setupTargetProfile = ''
     mkdir -m0755 usr
     pushd usr
diff --git a/pkgs/by-name/be/beeper-bridge-manager/package.nix b/pkgs/by-name/be/beeper-bridge-manager/package.nix
new file mode 100644
index 0000000000000..17030eb6ccd98
--- /dev/null
+++ b/pkgs/by-name/be/beeper-bridge-manager/package.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "bbctl";
+  version = "0.12.0";
+
+  src = fetchFromGitHub {
+    owner = "beeper";
+    repo = "bridge-manager";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-xaBLI5Y7PxHbmlwD72AKNrgnz3D+3WVhb2GJr5cmyfs=";
+  };
+
+  vendorHash = "sha256-VnqihTEGfrLxRfuscrWWBbhZ/tr8BhVnCd+FKblW5gI=";
+
+  meta = {
+    description = "Tool for running self-hosted bridges with the Beeper Matrix server. ";
+    homepage = "https://github.com/beeper/bridge-manager";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.heywoodlh ];
+    mainProgram = "bbctl";
+    changelog = "https://github.com/beeper/bridge-manager/releases/tag/v{version}";
+  };
+}
diff --git a/pkgs/by-name/bs/bsc/package.nix b/pkgs/by-name/bs/bsc/package.nix
new file mode 100644
index 0000000000000..48a1c8f994dea
--- /dev/null
+++ b/pkgs/by-name/bs/bsc/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  llvmPackages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bsc";
+  version = "3.3.4";
+
+  src = fetchFromGitHub {
+    owner = "IlyaGrebnov";
+    repo = "libbsc";
+    rev = "refs/tags/v${finalAttrs.version}";
+    sha256 = "sha256-reGg5xvoZBbNFFYPPyT2P1LA7oSCUIm9NIDjXyvkP9Q=";
+  };
+
+  enableParallelBuilding = true;
+
+  buildInputs = lib.optional stdenv.isDarwin llvmPackages.openmp;
+
+  makeFlags = [
+    "CC=$(CXX)"
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  meta = with lib; {
+    description = "High performance block-sorting data compression library";
+    homepage = "http://libbsc.com/";
+    maintainers = with maintainers; [ sigmanificient ];
+    license = lib.licenses.asl20;
+    platforms = platforms.unix;
+    mainProgram = "bsc";
+  };
+})
diff --git a/pkgs/by-name/ca/cartridges/package.nix b/pkgs/by-name/ca/cartridges/package.nix
index eeb20dbfda77a..42575689ea191 100644
--- a/pkgs/by-name/ca/cartridges/package.nix
+++ b/pkgs/by-name/ca/cartridges/package.nix
@@ -15,19 +15,16 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "cartridges";
-  version = "2.8.5";
+  version = "2.9.3";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "kra-mo";
     repo = "cartridges";
-    rev = "v${version}";
-    hash = "sha256-7T+q3T8z8SCpAn3ayodZeETOsTwL+hhVWzY2JyBEoi4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-37i8p6KaS/G7ybw850XYaPiG83/Lffn/+21xVk5xva0=";
   };
 
-  # TODO: remove this when #286814 hits master
-  mesonFlags = [ "-Dtiff_compression=jpeg" ];
-
   nativeBuildInputs = [
     appstream
     blueprint-compiler
@@ -54,6 +51,10 @@ python3Packages.buildPythonApplication rec {
   dontWrapGApps = true;
   makeWrapperArgs = [ ''''${gappsWrapperArgs[@]}'' ];
 
+  postFixup = ''
+    wrapPythonProgramsIn $out/libexec $out $pythonPath
+  '';
+
   meta = {
     description = "GTK4 + Libadwaita game launcher";
     longDescription = ''
diff --git a/pkgs/by-name/ea/ear2ctl/package.nix b/pkgs/by-name/ea/ear2ctl/package.nix
index 4d4e038f85f02..24f7b46496908 100644
--- a/pkgs/by-name/ea/ear2ctl/package.nix
+++ b/pkgs/by-name/ea/ear2ctl/package.nix
@@ -1,4 +1,11 @@
-{ lib, rustPlatform, fetchFromGitLab, pkg-config, dbus }:
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  pkg-config,
+  dbus,
+  nix-update-script,
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "ear2ctl";
@@ -17,6 +24,8 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [ dbus ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Linux controller for the Nothing Ear (2)";
     homepage = "https://gitlab.com/bharadwaj-raju/ear2ctl";
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 87ff8448d6262..7e3749e5db1d9 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -64,11 +64,11 @@ let
 
 in stdenv.mkDerivation (finalAttrs: {
   pname = "google-chrome";
-  version = "126.0.6478.182";
+  version = "127.0.6533.72";
 
   src = fetchurl {
     url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-izz3oEJAScI1MV3pBHLzwxCKs6M+rTORernvLv3sBYA=";
+    hash = "sha256-DpEYK/6SEaNfEa8uzGhXhALSSxt51X9X5ksaia8srJg=";
   };
 
   nativeBuildInputs = [ patchelf makeWrapper ];
@@ -157,6 +157,7 @@ in stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Freeware web browser developed by Google";
     homepage = "https://www.google.com/chrome/browser/";
+    changelog = "https://chromereleases.googleblog.com/";
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [ jnsgruk johnrtitor ];
diff --git a/pkgs/by-name/ha/hare/cross-compilation-tests.nix b/pkgs/by-name/ha/hare/cross-compilation-tests.nix
index 26611fea9d658..c5797a9a15662 100644
--- a/pkgs/by-name/ha/hare/cross-compilation-tests.nix
+++ b/pkgs/by-name/ha/hare/cross-compilation-tests.nix
@@ -1,31 +1,40 @@
-{ lib
-, buildPackages
-, hare
-, runCommandNoCC
-, stdenv
-, writeText
+{
+  lib,
+  file,
+  hare,
+  runCommandNoCC,
+  writeText,
 }:
 let
-  inherit (stdenv.hostPlatform.uname) processor;
-  inherit (stdenv.hostPlatform) emulator;
+  archs = lib.concatStringsSep " " (
+    builtins.map (lib.removeSuffix "-linux") (
+      builtins.filter (lib.hasSuffix "-linux") hare.meta.platforms
+    )
+  );
   mainDotHare = writeText "main.ha" ''
-    use fmt;
-    use os;
-    export fn main() void = {
-        const machine = os::machine();
-        if (machine == "${processor}") {
-            fmt::println("os::machine() matches ${processor}")!;
-        } else {
-            fmt::fatalf("os::machine() does not match ${processor}: {}", machine);
-        };
-    };
+    export fn main() void = void;
   '';
 in
-runCommandNoCC "${hare.pname}-cross-compilation-test" { meta.timeout = 60; } ''
-  HARECACHE="$(mktemp -d --tmpdir harecache.XXXXXXXX)"
-  export HARECACHE
-  outbin="test-${processor}"
-  ${lib.getExe hare} build -q -a "${processor}" -o "$outbin" ${mainDotHare}
-  ${emulator buildPackages} "./$outbin"
-  : 1>$out
-''
+runCommandNoCC "${hare.pname}-cross-compilation-test"
+  {
+    nativeBuildInputs = [
+      hare
+      file
+    ];
+  }
+  ''
+    HARECACHE="$(mktemp -d)"
+    export HARECACHE
+    readonly binprefix="bin"
+    for a in ${archs}; do
+      outbin="$binprefix-$a"
+      set -x
+      hare build -o "$outbin" -q -R -a "$a" ${mainDotHare}
+      set +x
+      printf -- 'Built "%s" target\n' "$a"
+    done
+
+    file -- "$binprefix-"*
+
+    : 1>$out
+  ''
diff --git a/pkgs/by-name/ha/hare/package.nix b/pkgs/by-name/ha/hare/package.nix
index 6090106f7b439..c809d73c3897a 100644
--- a/pkgs/by-name/ha/hare/package.nix
+++ b/pkgs/by-name/ha/hare/package.nix
@@ -161,7 +161,12 @@ stdenv.mkDerivation (finalAttrs: {
       }
       // lib.optionalAttrs (stdenv.buildPlatform.canExecute stdenv.hostPlatform) {
         mimeModule = callPackage ./mime-module-test.nix { hare = finalAttrs.finalPackage; };
-      };
+      }
+      //
+        lib.optionalAttrs (enableCrossCompilation && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+          {
+            crossCompilation = callPackage ./cross-compilation-tests.nix { hare = finalAttrs.finalPackage; };
+          };
     # To be propagated by `hareHook`.
     inherit harec qbe;
   };
diff --git a/pkgs/by-name/ia/ia-writer-quattro/package.nix b/pkgs/by-name/ia/ia-writer-quattro/package.nix
index 2f103f7cdbb7d..2a3cdd5feccdf 100644
--- a/pkgs/by-name/ia/ia-writer-quattro/package.nix
+++ b/pkgs/by-name/ia/ia-writer-quattro/package.nix
@@ -17,6 +17,7 @@ stdenvNoCC.mkDerivation {
 
     mkdir -p $out/share/fonts/truetype
     cp -R $src/iA\ Writer\ Quattro/Static/*.ttf $out/share/fonts/truetype
+    cp -R $src/iA\ Writer\ Quattro/Variable/*.ttf $out/share/fonts/truetype
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ky/kyverno-chainsaw/package.nix b/pkgs/by-name/ky/kyverno-chainsaw/package.nix
index fe83e66e7d42c..f7035840d813b 100644
--- a/pkgs/by-name/ky/kyverno-chainsaw/package.nix
+++ b/pkgs/by-name/ky/kyverno-chainsaw/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "kyverno-chainsaw";
-  version = "0.2.6";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "kyverno";
     repo = "chainsaw";
     rev = "v${version}";
-    hash = "sha256-UnLsy+htNG7DWU1Qw9HJZOPshq4L7YCtXSkh4jZe/XA=";
+    hash = "sha256-Ft3xWXUu57DHKTDyvtIvYExauP/La0xWu2rjbpcvxzM=";
   };
 
-  vendorHash = "sha256-UQCn5GKhhfHsHIOqYYVkKP76e2NTRtwjw2VvCwRPUB4=";
+  vendorHash = "sha256-ilQOf1GMVmf9FhwfMuK+eGFOnqmL+kW/ma+/KaTWqc4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ll/lldap-cli/package.nix b/pkgs/by-name/ll/lldap-cli/package.nix
new file mode 100644
index 0000000000000..6bec2c2426627
--- /dev/null
+++ b/pkgs/by-name/ll/lldap-cli/package.nix
@@ -0,0 +1,61 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, bash
+, coreutils
+, gnugrep
+, gnused
+, jq
+, curl
+, makeWrapper
+}:
+stdenv.mkDerivation {
+  pname = "lldap-cli";
+  version = "0-unstable-2024-02-24";
+
+  src = fetchFromGitHub {
+    owner = "Zepmann";
+    repo = "lldap-cli";
+    rev = "d1fe50006c4a3a1796d4fb2d73d8c8dcfc875fd5";
+    hash = "sha256-ZKRTYdgtOfV7TgpaVKLhYrCttYvB/bUexMshmmF8NyY=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  patchPhase = ''
+    runHook prePatch
+
+    # fix .lldap-cli-wrapped showing up in usage
+    substituteInPlace lldap-cli \
+      --replace-fail '$(basename $0)' lldap-cli
+
+    runHook postPatch
+  '';
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    install -Dm555 lldap-cli -t $out/bin
+    wrapProgram $out/bin/lldap-cli \
+      --prefix PATH : ${lib.makeBinPath [ bash coreutils gnugrep gnused jq curl ]}
+  '';
+
+  meta = {
+    description = "Command line tool for managing LLDAP";
+    longDescription = ''
+      LDAP-CLI is a command line interface for LLDAP.
+
+      LLDAP uses GraphQL to offer an HTTP-based API.
+      This API is used by an included web-based user interface.
+      Unfortunately, LLDAP lacks a command-line interface,
+      which is a necessity for any serious administrator.
+      LLDAP-CLI translates CLI commands to GraphQL API calls.
+    '';
+    homepage = "https://github.com/Zepmann/lldap-cli";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.nw ];
+    mainProgram = "lldap-cli";
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/by-name/mi/mihomo/package.nix b/pkgs/by-name/mi/mihomo/package.nix
index 50529dec4b772..dc7c362bc5a38 100644
--- a/pkgs/by-name/mi/mihomo/package.nix
+++ b/pkgs/by-name/mi/mihomo/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "mihomo";
-  version = "1.18.6";
+  version = "1.18.7";
 
   src = fetchFromGitHub {
     owner = "MetaCubeX";
     repo = "mihomo";
     rev = "v${version}";
-    hash = "sha256-h/H5T9UBCp/gXM+c5muRs8luz3LoHofBGwP3jofQ9Qg=";
+    hash = "sha256-+9tVkMOOGwdmOXhoXanOpp8/7TEGGLR2aTeOsw+FzKc=";
   };
 
-  vendorHash = "sha256-lBHL4vD+0JDOlc6SWFsj0cerE/ypImoh8UFbL736SmA=";
+  vendorHash = "sha256-wbJgJY1EH3ajmoWXWRCSpD2C0eknajkwD1DaQz2EsUU=";
 
   excludedPackages = [ "./test" ];
 
diff --git a/pkgs/by-name/ne/nerdfetch/package.nix b/pkgs/by-name/ne/nerdfetch/package.nix
index 35f74f1b52cdd..447e46586eda3 100644
--- a/pkgs/by-name/ne/nerdfetch/package.nix
+++ b/pkgs/by-name/ne/nerdfetch/package.nix
@@ -5,13 +5,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "nerdfetch";
-  version = "8.1.2";
+  version = "8.2.0";
 
   src = fetchFromGitHub {
     owner = "ThatOneCalculator";
     repo = "NerdFetch";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hKs/Of6GIQ9Xtav7VfL+2DzMNpgUoDk5C/2lqldd/So=";
+    hash = "sha256-fSITel2WhlmKx+wMNKfur3zDqKYJs5+AZNJBd2MtGRw=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ob/obj-magic/package.nix b/pkgs/by-name/ob/obj-magic/package.nix
new file mode 100644
index 0000000000000..4f120323d0a32
--- /dev/null
+++ b/pkgs/by-name/ob/obj-magic/package.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation {
+  pname = "obj-magic";
+  version = "0.5-unstable-2020-09-20";
+
+  src = fetchFromGitHub {
+    owner = "tapio";
+    repo = "obj-magic";
+    rev = "f25c9b78cee6529a3295ed314d1c200677dc56c0";
+    hash = "sha256-4A8TasyLOh6oz21/AwBbE5s3055EPftFh8mymrveTvY=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+    ./make.sh
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -D obj-magic $out/bin/obj-magic
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Command line tool for manipulating Wavefront OBJ 3D meshes";
+    homepage = "https://github.com/tapio/obj-magic";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ lorenz ];
+    platforms = lib.platforms.unix;
+    mainProgram = "obj-magic";
+  };
+}
+
diff --git a/pkgs/by-name/op/openvas-scanner/package.nix b/pkgs/by-name/op/openvas-scanner/package.nix
index d3b352eec84e6..a554b6403dff8 100644
--- a/pkgs/by-name/op/openvas-scanner/package.nix
+++ b/pkgs/by-name/op/openvas-scanner/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openvas-scanner";
-  version = "23.5.1";
+  version = "23.6.0";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "openvas-scanner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jIPSQUdW+v0SV6sINkLujqZPysZSdaqHa5+sxTRdpH4=";
+    hash = "sha256-VIjkrlE39eq8a7Kgj4QZSZ5R9bAnw0oodUc8m/4bSCQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pi/picom/package.nix b/pkgs/by-name/pi/picom/package.nix
index 676ac95fb5129..8074e38cf5010 100644
--- a/pkgs/by-name/pi/picom/package.nix
+++ b/pkgs/by-name/pi/picom/package.nix
@@ -43,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     asciidoc
     docbook_xml_dtd_45
@@ -51,7 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    uthash
   ];
 
   buildInputs = [
@@ -69,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt
     pcre2
     pixman
+    uthash
     xcbutil
     xcbutilimage
     xcbutilrenderutil
diff --git a/pkgs/by-name/pi/pixi/Cargo.lock b/pkgs/by-name/pi/pixi/Cargo.lock
index 50e299718e769..caf8c8ea08df8 100644
--- a/pkgs/by-name/pi/pixi/Cargo.lock
+++ b/pkgs/by-name/pi/pixi/Cargo.lock
@@ -83,6 +83,12 @@ dependencies = [
  "alloc-no-stdlib",
 ]
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
+
 [[package]]
 name = "android-tzdata"
 version = "0.1.1"
@@ -153,6 +159,15 @@ version = "1.0.86"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
 
+[[package]]
+name = "arbitrary"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5a26814d8dcb93b0e5a0ff3c6d80a8843bafb21b39e8e18a6f05471870e110"
+dependencies = [
+ "derive_arbitrary",
+]
+
 [[package]]
 name = "archspec"
 version = "0.1.3"
@@ -450,6 +465,14 @@ dependencies = [
  "backtrace",
 ]
 
+[[package]]
+name = "barrier_cell"
+version = "0.1.0"
+dependencies = [
+ "thiserror",
+ "tokio",
+]
+
 [[package]]
 name = "base64"
 version = "0.13.1"
@@ -676,7 +699,7 @@ dependencies = [
 [[package]]
 name = "cache-key"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "hex",
  "seahash",
@@ -780,9 +803,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.4"
+version = "4.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
+checksum = "64acc1846d54c1fe936a78dc189c34e28d3f5afc348403f28ecf53660b9b8462"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -800,9 +823,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.2"
+version = "4.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
+checksum = "6fb8393d67ba2e7bfaf28a23458e4e2b543cc73a99595511eb207fdb8aede942"
 dependencies = [
  "anstream",
  "anstyle",
@@ -820,11 +843,21 @@ dependencies = [
  "clap",
 ]
 
+[[package]]
+name = "clap_complete_nushell"
+version = "4.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1accf1b463dee0d3ab2be72591dccdab8bef314958340447c882c4c72acfe2a3"
+dependencies = [
+ "clap",
+ "clap_complete",
+]
+
 [[package]]
 name = "clap_derive"
-version = "4.5.4"
+version = "4.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
+checksum = "2bac35c6dafb060fd4d275d9a4ffae97917c13a6327903a8be2153cd964f7085"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
@@ -1029,6 +1062,20 @@ dependencies = [
  "parking_lot_core 0.9.10",
 ]
 
+[[package]]
+name = "dashmap"
+version = "6.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "804c8821570c3f8b70230c2ba75ffa5c0f9a4189b9a432b6656c536712acae28"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core 0.9.10",
+]
+
 [[package]]
 name = "data-encoding"
 version = "2.6.0"
@@ -1073,6 +1120,17 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "derive_arbitrary"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67e77553c4162a157adbf834ebae5b415acbecbeafc7a74b0e886657506a7611"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "dialoguer"
 version = "0.11.0"
@@ -1127,10 +1185,21 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "distribution-filename"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "pep440_rs",
  "platform-tags",
@@ -1144,13 +1213,12 @@ dependencies = [
 [[package]]
 name = "distribution-types"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "anyhow",
  "cache-key",
  "distribution-filename",
  "fs-err",
- "indexmap 2.2.6",
  "itertools 0.13.0",
  "once_cell",
  "pep440_rs",
@@ -1359,13 +1427,24 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
 
+[[package]]
+name = "fd-lock"
+version = "4.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e5768da2206272c81ef0b5e951a41862938a6070da63bcea197899942d3b947"
+dependencies = [
+ "cfg-if",
+ "rustix 0.38.34",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "file_url"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1042c5fdc9f2cf548a139ccd0985fa2460d796f99b08574f72f1f53d179e6591"
+checksum = "d0d1df57145d7cda57c95c44a2d64c24f579e2d50b8f4f7a779287293ad3adc0"
 dependencies = [
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "percent-encoding",
  "thiserror",
  "typed-path",
@@ -1400,6 +1479,24 @@ dependencies = [
  "miniz_oxide",
 ]
 
+[[package]]
+name = "float-cmp"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98de4bbd547a563b716d8dfa9aad1cb19bfab00f4fa09a6a4ed21dbcf44ce9c4"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "fluent-uri"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17c704e9dbe1ddd863da1e6ff3567795087b1eb201ce80d8fa81162e1516500d"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -1634,21 +1731,6 @@ version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
-[[package]]
-name = "git2"
-version = "0.18.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "232e6a7bfe35766bf715e55a88b39a700596c0ccfd88cd3680b4cdb40d66ef70"
-dependencies = [
- "bitflags 2.5.0",
- "libc",
- "libgit2-sys",
- "log",
- "openssl-probe",
- "openssl-sys",
- "url",
-]
-
 [[package]]
 name = "glob"
 version = "0.3.1"
@@ -1748,6 +1830,16 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "halfbrown"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8588661a8607108a5ca69cab034063441a0413a0b041c13618a7dd348021ef6f"
+dependencies = [
+ "hashbrown 0.14.5",
+ "serde",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -1762,6 +1854,10 @@ name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash 0.8.11",
+ "allocator-api2",
+]
 
 [[package]]
 name = "heck"
@@ -2215,7 +2311,7 @@ dependencies = [
 [[package]]
 name = "install-wheel-rs"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "configparser",
  "csv",
@@ -2231,7 +2327,7 @@ dependencies = [
  "pypi-types",
  "reflink-copy",
  "regex",
- "rustc-hash",
+ "rustc-hash 2.0.0",
  "serde",
  "serde_json",
  "sha2",
@@ -2241,7 +2337,7 @@ dependencies = [
  "uv-fs",
  "uv-normalize",
  "walkdir",
- "zip",
+ "zip 0.6.6",
 ]
 
 [[package]]
@@ -2338,15 +2434,27 @@ dependencies = [
 
 [[package]]
 name = "json-patch"
-version = "1.4.0"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec9ad60d674508f3ca8f380a928cfe7b096bc729c4e2dbfe3852bc45da3ab30b"
+checksum = "5b1fb8864823fad91877e6caea0baca82e49e8db50f8e5c9f9a453e27d3330fc"
 dependencies = [
+ "jsonptr",
  "serde",
  "serde_json",
  "thiserror",
 ]
 
+[[package]]
+name = "jsonptr"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c6e529149475ca0b2820835d3dce8fcc41c6b943ca608d32f35b449255e4627"
+dependencies = [
+ "fluent-uri",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "jsonwebtoken"
 version = "9.3.0"
@@ -2416,25 +2524,75 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
-name = "libc"
-version = "0.2.155"
+name = "lexical-core"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "2cde5de06e8d4c2faabc400238f9ae1c74d5412d03a7bd067645ccbc47070e46"
+dependencies = [
+ "lexical-parse-float",
+ "lexical-parse-integer",
+ "lexical-util",
+ "lexical-write-float",
+ "lexical-write-integer",
+]
 
 [[package]]
-name = "libgit2-sys"
-version = "0.16.2+1.7.2"
+name = "lexical-parse-float"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee4126d8b4ee5c9d9ea891dd875cfdc1e9d0950437179104b183d7d8a74d24e8"
+checksum = "683b3a5ebd0130b8fb52ba0bdc718cc56815b6a097e28ae5a6997d0ad17dc05f"
 dependencies = [
- "cc",
- "libc",
- "libssh2-sys",
- "libz-sys",
- "openssl-sys",
- "pkg-config",
+ "lexical-parse-integer",
+ "lexical-util",
+ "static_assertions",
+]
+
+[[package]]
+name = "lexical-parse-integer"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d0994485ed0c312f6d965766754ea177d07f9c00c9b82a5ee62ed5b47945ee9"
+dependencies = [
+ "lexical-util",
+ "static_assertions",
 ]
 
+[[package]]
+name = "lexical-util"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5255b9ff16ff898710eb9eb63cb39248ea8a5bb036bea8085b1a767ff6c4e3fc"
+dependencies = [
+ "static_assertions",
+]
+
+[[package]]
+name = "lexical-write-float"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accabaa1c4581f05a3923d1b4cfd124c329352288b7b9da09e766b0668116862"
+dependencies = [
+ "lexical-util",
+ "lexical-write-integer",
+ "static_assertions",
+]
+
+[[package]]
+name = "lexical-write-integer"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1b6f3d1f4422866b68192d62f77bc5c700bee84f3069f2469d7bc8c77852446"
+dependencies = [
+ "lexical-util",
+ "static_assertions",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.155"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+
 [[package]]
 name = "libloading"
 version = "0.8.3"
@@ -2461,32 +2619,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "libssh2-sys"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dc8a030b787e2119a731f1951d6a773e2280c660f8ec4b0f5e1505a386e71ee"
-dependencies = [
- "cc",
- "libc",
- "libz-sys",
- "openssl-sys",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "libz-sys"
-version = "1.1.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c15da26e5af7e25c90b37a2d75cdbf940cf4a55316de9d84c679c9b8bfabf82e"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
 [[package]]
 name = "line-wrap"
 version = "0.2.0"
@@ -2531,6 +2663,12 @@ dependencies = [
  "scopeguard",
 ]
 
+[[package]]
+name = "lockfree-object-pool"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9374ef4228402d4b7e403e5838cb880d9ee663314b0a900d5a6aabf0c213552e"
+
 [[package]]
 name = "log"
 version = "0.4.21"
@@ -2912,9 +3050,9 @@ dependencies = [
 [[package]]
 name = "once-map"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
- "dashmap",
+ "dashmap 5.5.3",
  "futures",
  "tokio",
 ]
@@ -2963,15 +3101,6 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
-[[package]]
-name = "openssl-src"
-version = "300.3.0+3.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eba8804a1c5765b18c4b3f907e6897ebabeedebc9830e1a0046c4a4cf44663e1"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "openssl-sys"
 version = "0.9.102"
@@ -2980,7 +3109,6 @@ checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
 dependencies = [
  "cc",
  "libc",
- "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -3151,7 +3279,7 @@ dependencies = [
 [[package]]
 name = "pep440_rs"
 version = "0.6.0"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "once_cell",
  "rkyv",
@@ -3163,7 +3291,7 @@ dependencies = [
 [[package]]
 name = "pep508_rs"
 version = "0.6.0"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "derivative",
  "once_cell",
@@ -3282,16 +3410,18 @@ dependencies = [
 
 [[package]]
 name = "pixi"
-version = "0.24.2"
+version = "0.26.1"
 dependencies = [
  "ahash 0.8.11",
  "assert_matches",
  "async-once-cell",
+ "barrier_cell",
  "cfg-if",
  "chrono",
  "clap",
  "clap-verbosity-flag",
  "clap_complete",
+ "clap_complete_nushell",
  "concat-idents",
  "console",
  "crossbeam-channel",
@@ -3302,6 +3432,7 @@ dependencies = [
  "distribution-filename",
  "distribution-types",
  "dunce",
+ "fd-lock",
  "flate2",
  "fs_extra",
  "futures",
@@ -3374,13 +3505,13 @@ dependencies = [
  "uv-distribution",
  "uv-git",
  "uv-installer",
- "uv-interpreter",
  "uv-normalize",
  "uv-resolver",
+ "uv-toolchain",
  "uv-types",
  "winapi",
  "xxhash-rust",
- "zip",
+ "zip 0.6.6",
 ]
 
 [[package]]
@@ -3402,9 +3533,9 @@ dependencies = [
 [[package]]
 name = "platform-tags"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
- "rustc-hash",
+ "rustc-hash 2.0.0",
  "serde",
  "thiserror",
 ]
@@ -3538,12 +3669,12 @@ dependencies = [
 [[package]]
 name = "pubgrub"
 version = "0.2.1"
-source = "git+https://github.com/astral-sh/pubgrub?rev=0e684a874c9fb8f74738cd8875524c80e3d4820b#0e684a874c9fb8f74738cd8875524c80e3d4820b"
+source = "git+https://github.com/astral-sh/pubgrub?rev=b4435e2f3af10dab2336a0345b35dcd622699d06#b4435e2f3af10dab2336a0345b35dcd622699d06"
 dependencies = [
  "indexmap 2.2.6",
  "log",
  "priority-queue",
- "rustc-hash",
+ "rustc-hash 1.1.0",
  "thiserror",
 ]
 
@@ -3565,11 +3696,11 @@ dependencies = [
 [[package]]
 name = "pypi-types"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "chrono",
- "git2",
  "indexmap 2.2.6",
+ "itertools 0.13.0",
  "mailparse",
  "once_cell",
  "pep440_rs",
@@ -3660,24 +3791,21 @@ dependencies = [
 
 [[package]]
 name = "rattler"
-version = "0.26.4"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3d5504e8afc260cceebb79886032ac146c9344c55fbaf9034ca45a0c00b7447"
+checksum = "ba9b88912f9f10739d0e75f455d956129402c444b38a8c87538965d4f7495c1c"
 dependencies = [
  "anyhow",
- "bytes",
- "chrono",
  "clap",
  "console",
  "digest",
  "dirs",
  "fs-err",
  "futures",
- "fxhash",
  "humantime",
  "indexmap 2.2.6",
  "indicatif",
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "memchr",
  "memmap2 0.9.4",
  "once_cell",
@@ -3697,7 +3825,6 @@ dependencies = [
  "tempfile",
  "thiserror",
  "tokio",
- "tokio-stream",
  "tracing",
  "url",
  "uuid",
@@ -3705,16 +3832,15 @@ dependencies = [
 
 [[package]]
 name = "rattler_cache"
-version = "0.1.0"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdad5b1a62c97fe6acbad6f1421eed77bf75f736a5af44a18f0e46d6d1cd5c81"
+checksum = "a2b48c3e9525109c28607b33eb47284d93415d443c14c594d868a99fe5612782"
 dependencies = [
  "anyhow",
- "chrono",
  "digest",
  "dirs",
  "fxhash",
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "parking_lot 0.12.3",
  "rattler_conda_types",
  "rattler_digest",
@@ -3730,16 +3856,16 @@ dependencies = [
 
 [[package]]
 name = "rattler_conda_types"
-version = "0.25.2"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65d6d35c484af9b1a3ce13ace90de388c8a21b1f832bf2ee97b5681a94178326"
+checksum = "31342292e067dee0ce26b8c8827908ed24c340b28986a851c7f8a8440a4dfe48"
 dependencies = [
  "chrono",
  "file_url",
  "fxhash",
  "glob",
  "hex",
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "lazy-regex",
  "nom",
  "purl",
@@ -3750,6 +3876,7 @@ dependencies = [
  "serde_json",
  "serde_repr",
  "serde_with",
+ "simd-json",
  "smallvec",
  "strum",
  "thiserror",
@@ -3760,9 +3887,9 @@ dependencies = [
 
 [[package]]
 name = "rattler_digest"
-version = "0.19.4"
+version = "0.19.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf69475918dd44152f7df690b13f2909f34cc762ae18a2e2c55824b546de161"
+checksum = "eeb0228f734983274fb6938844123e88aa55158d53ead37e8ae3deb641fe05aa"
 dependencies = [
  "blake2",
  "digest",
@@ -3777,22 +3904,20 @@ dependencies = [
 
 [[package]]
 name = "rattler_lock"
-version = "0.22.12"
+version = "0.22.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bb54f27b97a03b9b2921bd18967947bc5788a8d653fcd6b6bdd18dad192312f"
+checksum = "785ed485e3dab9b6796d4d92adb8808e9b26e21a5ffa04e39530949ca85c68d9"
 dependencies = [
  "chrono",
  "file_url",
  "fxhash",
  "indexmap 2.2.6",
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "pep440_rs",
  "pep508_rs",
- "purl",
  "rattler_conda_types",
  "rattler_digest",
  "serde",
- "serde_json",
  "serde_repr",
  "serde_with",
  "serde_yaml",
@@ -3802,9 +3927,9 @@ dependencies = [
 
 [[package]]
 name = "rattler_macros"
-version = "0.19.3"
+version = "0.19.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10cef20e8356ea6840294e5754c6a8663b0eb1b97f29d517642f0f99215a2483"
+checksum = "b4961d74ca0a15a62c83e439dfd9f440f35f8c31dfb71afe990b2d8fbf916f7a"
 dependencies = [
  "quote",
  "syn 2.0.66",
@@ -3812,28 +3937,25 @@ dependencies = [
 
 [[package]]
 name = "rattler_networking"
-version = "0.20.8"
+version = "0.20.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c582ad6d82b397d1e1522910b34dc052bbed4dedc0eed7fb640024de0dc6f5f6"
+checksum = "0fec041e559f2b4cb21556816f10b3da174932f49280f335b21563d06d2a4737"
 dependencies = [
  "anyhow",
  "async-trait",
  "base64 0.22.1",
- "bytes",
  "chrono",
  "dirs",
  "fslock",
- "futures",
  "getrandom",
  "google-cloud-auth",
  "http 1.1.0",
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "keyring",
  "netrc-rs",
- "pin-project-lite",
  "reqwest 0.12.4",
  "reqwest-middleware",
- "retry-policies",
+ "retry-policies 0.4.0",
  "serde",
  "serde_json",
  "thiserror",
@@ -3843,9 +3965,9 @@ dependencies = [
 
 [[package]]
 name = "rattler_package_streaming"
-version = "0.21.3"
+version = "0.21.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "390c453b80d7904362e121c89f29aee796fb4d38cc7b24fe7ba9e583ef77a27b"
+checksum = "1f6953df9956ee53d1569787742d26db5559f64bbaa06363260acc484bf00751"
 dependencies = [
  "bzip2",
  "chrono",
@@ -3863,15 +3985,15 @@ dependencies = [
  "tokio",
  "tokio-util",
  "url",
- "zip",
+ "zip 2.1.3",
  "zstd",
 ]
 
 [[package]]
 name = "rattler_repodata_gateway"
-version = "0.20.5"
+version = "0.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "810de4b4ef0c75087b77b6425caf869ee435ee392950f71800ec21ac512e576b"
+checksum = "d4ff7c7c1093f9268a98788e5dc54f278266c8c1422aaceb5fa92abbd5fb568d"
 dependencies = [
  "anyhow",
  "async-compression",
@@ -3880,7 +4002,7 @@ dependencies = [
  "bytes",
  "cache_control",
  "chrono",
- "dashmap",
+ "dashmap 6.0.1",
  "dirs",
  "file_url",
  "futures",
@@ -3889,15 +4011,15 @@ dependencies = [
  "http-cache-semantics",
  "humansize",
  "humantime",
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "json-patch",
  "libc",
  "md-5",
  "memmap2 0.9.4",
  "ouroboros",
  "parking_lot 0.12.3",
- "percent-encoding",
  "pin-project-lite",
+ "rattler_cache",
  "rattler_conda_types",
  "rattler_digest",
  "rattler_networking",
@@ -3921,13 +4043,13 @@ dependencies = [
 
 [[package]]
 name = "rattler_shell"
-version = "0.20.9"
+version = "0.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e17c8a64079dc3a7b8b0070e0d7c4bee4008bf16d799b8b621a9aa88968650c6"
+checksum = "ee99375f452b121ed0612da5ff8a4f56cc3706e0548dc36315d109b5d31d4a37"
 dependencies = [
  "enum_dispatch",
  "indexmap 2.2.6",
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "rattler_conda_types",
  "serde_json",
  "shlex",
@@ -3939,16 +4061,17 @@ dependencies = [
 
 [[package]]
 name = "rattler_solve"
-version = "0.24.2"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d62f673fe9f9198b4d3235da314d727eff59515cc4db9b0e2452e9bbe959433d"
+checksum = "46253b2995c30aa7ca38ae495a3cec45eb2d164697661f69687ae76dadd47cdd"
 dependencies = [
  "chrono",
  "futures",
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "rattler_conda_types",
  "rattler_digest",
  "resolvo",
+ "serde",
  "tempfile",
  "thiserror",
  "tracing",
@@ -3957,9 +4080,9 @@ dependencies = [
 
 [[package]]
 name = "rattler_virtual_packages"
-version = "0.19.15"
+version = "0.19.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ae1f4c940a73181b636a2957e665f1c7caeed443ef468ca31d380417f4b52bd"
+checksum = "81e0d3f960081736895ec2ab3819dc4336e9160973ed47ce4a5ac1a3759422de"
 dependencies = [
  "archspec",
  "libloading",
@@ -4040,6 +4163,26 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "ref-cast"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf0a6f84d5f1d581da8b41b47ec8600871962f2a528115b542b362d4b744931"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcc303e793d3734489387d205e9b186fac9c6cfacedd98cbb2e8a5943595f3e6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "reflink-copy"
 version = "0.1.17"
@@ -4113,13 +4256,14 @@ dependencies = [
 [[package]]
 name = "requirements-txt"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "distribution-types",
  "fs-err",
  "pep508_rs",
  "pypi-types",
  "regex",
+ "thiserror",
  "tracing",
  "unscanny",
  "url",
@@ -4256,7 +4400,7 @@ dependencies = [
  "parking_lot 0.11.2",
  "reqwest 0.12.4",
  "reqwest-middleware",
- "retry-policies",
+ "retry-policies 0.3.0",
  "tokio",
  "tracing",
  "wasm-timer",
@@ -4264,9 +4408,9 @@ dependencies = [
 
 [[package]]
 name = "resolvo"
-version = "0.5.0"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7b73dc355efbb88c372550b92bf17d36bf555ecf319a4783a5b8b7c34488bc5"
+checksum = "09f13bb82d6362074f2b2d858bb316dfb2a9940c7e33a9ccd0168ba4f6a247b2"
 dependencies = [
  "ahash 0.8.11",
  "bitvec",
@@ -4289,6 +4433,15 @@ dependencies = [
  "rand",
 ]
 
+[[package]]
+name = "retry-policies"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5875471e6cab2871bc150ecb8c727db5113c9338cc3354dc5ee3425b6aa40a1c"
+dependencies = [
+ "rand",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.8"
@@ -4405,6 +4558,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
+[[package]]
+name = "rustc-hash"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "583034fd73374156e66797ed8e5b0d5690409c9226b22d87cb7f19821c05d152"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.0"
@@ -4883,6 +5042,28 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "simd-adler32"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+
+[[package]]
+name = "simd-json"
+version = "0.13.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "570c430b3d902ea083097e853263ae782dfe40857d93db019a12356c8e8143fa"
+dependencies = [
+ "getrandom",
+ "halfbrown",
+ "lexical-core",
+ "ref-cast",
+ "serde",
+ "serde_json",
+ "simdutf8",
+ "value-trait",
+]
+
 [[package]]
 name = "simdutf8"
 version = "0.1.4"
@@ -5029,20 +5210,20 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "strum"
-version = "0.26.2"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d8cec3501a5194c432b2b7976db6b7d10ec95c253208b45f83f7136aa985e29"
+checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
 dependencies = [
  "strum_macros",
 ]
 
 [[package]]
 name = "strum_macros"
-version = "0.26.2"
+version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6cf59daf282c0a494ba14fd21610a0325f9f90ec9d1231dea26bcb1d696c946"
+checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
 dependencies = [
- "heck 0.4.1",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
  "rustversion",
@@ -5196,6 +5377,12 @@ dependencies = [
  "xattr",
 ]
 
+[[package]]
+name = "target-lexicon"
+version = "0.12.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4873307b7c257eddcb50c9bedf158eb669578359fb28428bef438fec8e6ba7c2"
+
 [[package]]
 name = "tempfile"
 version = "3.10.1"
@@ -5313,9 +5500,9 @@ checksum = "b130bd8a58c163224b44e217b4239ca7b927d82bf6cc2fea1fc561d15056e3f7"
 
 [[package]]
 name = "tokio"
-version = "1.37.0"
+version = "1.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
+checksum = "ba4f4a02a7a80d6f274636f0aa95c7e383b912d41fe721a31f29e29698585a4a"
 dependencies = [
  "backtrace",
  "bytes",
@@ -5332,9 +5519,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
+checksum = "5f5ae998a069d4b5aba8ee9dad856af7d520c3699e6159b185c2acd48155d39a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5554,9 +5741,9 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typed-path"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6069e2cc1d241fd4ff5fa067e8882996fcfce20986d078696e05abccbcf27b43"
+checksum = "e8a3023f4683cd1a846dbd2666e8c34f54338ee5cebae578cda981a87cecd7aa"
 
 [[package]]
 name = "typeid"
@@ -5684,7 +5871,7 @@ dependencies = [
 [[package]]
 name = "uv-auth"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5705,7 +5892,7 @@ dependencies = [
 [[package]]
 name = "uv-build"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "anyhow",
  "distribution-types",
@@ -5717,7 +5904,7 @@ dependencies = [
  "pep508_rs",
  "pypi-types",
  "regex",
- "rustc-hash",
+ "rustc-hash 2.0.0",
  "serde",
  "serde_json",
  "tempfile",
@@ -5727,7 +5914,7 @@ dependencies = [
  "tracing",
  "uv-configuration",
  "uv-fs",
- "uv-interpreter",
+ "uv-toolchain",
  "uv-types",
  "uv-virtualenv",
 ]
@@ -5735,7 +5922,7 @@ dependencies = [
 [[package]]
 name = "uv-cache"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "cache-key",
  "directories",
@@ -5744,7 +5931,7 @@ dependencies = [
  "nanoid",
  "pypi-types",
  "rmp-serde",
- "rustc-hash",
+ "rustc-hash 2.0.0",
  "serde",
  "tempfile",
  "tracing",
@@ -5757,7 +5944,7 @@ dependencies = [
 [[package]]
 name = "uv-client"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5772,6 +5959,7 @@ dependencies = [
  "html-escape",
  "http 1.1.0",
  "install-wheel-rs",
+ "itertools 0.13.0",
  "pep440_rs",
  "pep508_rs",
  "platform-tags",
@@ -5784,7 +5972,6 @@ dependencies = [
  "serde",
  "serde_json",
  "sys-info",
- "tempfile",
  "thiserror",
  "tl",
  "tokio",
@@ -5804,13 +5991,13 @@ dependencies = [
 [[package]]
 name = "uv-configuration"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
- "distribution-types",
  "either",
  "pep508_rs",
  "platform-tags",
- "rustc-hash",
+ "pypi-types",
+ "rustc-hash 2.0.0",
  "serde",
  "serde_json",
  "tracing",
@@ -5821,40 +6008,44 @@ dependencies = [
 [[package]]
 name = "uv-dispatch"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "anyhow",
  "distribution-types",
  "futures",
  "install-wheel-rs",
  "itertools 0.13.0",
- "rustc-hash",
+ "pypi-types",
+ "rustc-hash 2.0.0",
  "tracing",
  "uv-build",
  "uv-cache",
  "uv-client",
  "uv-configuration",
  "uv-distribution",
+ "uv-git",
  "uv-installer",
- "uv-interpreter",
  "uv-resolver",
+ "uv-toolchain",
  "uv-types",
 ]
 
 [[package]]
 name = "uv-distribution"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "anyhow",
- "cache-key",
  "distribution-filename",
  "distribution-types",
+ "either",
  "fs-err",
  "futures",
+ "glob",
  "install-wheel-rs",
  "nanoid",
  "once_cell",
+ "path-absolutize",
  "pep440_rs",
  "pep508_rs",
  "platform-tags",
@@ -5862,12 +6053,14 @@ dependencies = [
  "reqwest 0.12.4",
  "reqwest-middleware",
  "rmp-serde",
- "rustc-hash",
+ "rustc-hash 2.0.0",
  "serde",
  "tempfile",
  "thiserror",
  "tokio",
  "tokio-util",
+ "toml",
+ "toml_edit 0.22.13",
  "tracing",
  "url",
  "uv-cache",
@@ -5878,13 +6071,14 @@ dependencies = [
  "uv-git",
  "uv-normalize",
  "uv-types",
- "zip",
+ "uv-warnings",
+ "zip 0.6.6",
 ]
 
 [[package]]
 name = "uv-extract"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "async-compression",
  "async_zip",
@@ -5893,20 +6087,20 @@ dependencies = [
  "md-5",
  "pypi-types",
  "rayon",
- "rustc-hash",
+ "rustc-hash 2.0.0",
  "sha2",
  "thiserror",
  "tokio",
  "tokio-tar",
  "tokio-util",
  "tracing",
- "zip",
+ "zip 0.6.6",
 ]
 
 [[package]]
 name = "uv-fs"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "backoff",
  "cachedir",
@@ -5928,20 +6122,16 @@ dependencies = [
 [[package]]
 name = "uv-git"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "anyhow",
- "base64 0.22.1",
  "cache-key",
  "cargo-util",
+ "dashmap 5.5.3",
  "fs-err",
- "git2",
- "glob",
- "hmac",
- "home",
- "rand",
  "reqwest 0.12.4",
- "sha1",
+ "reqwest-middleware",
+ "thiserror",
  "tokio",
  "tracing",
  "url",
@@ -5951,7 +6141,7 @@ dependencies = [
 [[package]]
 name = "uv-installer"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -5966,8 +6156,8 @@ dependencies = [
  "platform-tags",
  "pypi-types",
  "rayon",
- "requirements-txt",
- "rustc-hash",
+ "rustc-hash 2.0.0",
+ "same-file",
  "serde",
  "tempfile",
  "thiserror",
@@ -5981,57 +6171,17 @@ dependencies = [
  "uv-extract",
  "uv-fs",
  "uv-git",
- "uv-interpreter",
  "uv-normalize",
+ "uv-toolchain",
  "uv-types",
  "uv-warnings",
  "walkdir",
 ]
 
-[[package]]
-name = "uv-interpreter"
-version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
-dependencies = [
- "anyhow",
- "cache-key",
- "configparser",
- "fs-err",
- "futures",
- "install-wheel-rs",
- "itertools 0.13.0",
- "once_cell",
- "pep440_rs",
- "pep508_rs",
- "platform-tags",
- "pypi-types",
- "regex",
- "reqwest 0.12.4",
- "reqwest-middleware",
- "rmp-serde",
- "same-file",
- "serde",
- "serde_json",
- "tempfile",
- "thiserror",
- "tokio-util",
- "tracing",
- "url",
- "uv-cache",
- "uv-client",
- "uv-configuration",
- "uv-extract",
- "uv-fs",
- "uv-state",
- "uv-warnings",
- "which",
- "winapi",
-]
-
 [[package]]
 name = "uv-normalize"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "rkyv",
  "serde",
@@ -6040,13 +6190,12 @@ dependencies = [
 [[package]]
 name = "uv-resolver"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
- "anstream",
  "anyhow",
  "cache-key",
  "chrono",
- "dashmap",
+ "dashmap 5.5.3",
  "derivative",
  "distribution-filename",
  "distribution-types",
@@ -6056,8 +6205,8 @@ dependencies = [
  "install-wheel-rs",
  "itertools 0.13.0",
  "once-map",
- "once_cell",
  "owo-colors",
+ "path-slash",
  "pep440_rs",
  "pep508_rs",
  "petgraph",
@@ -6066,21 +6215,22 @@ dependencies = [
  "pypi-types",
  "requirements-txt",
  "rkyv",
- "rustc-hash",
+ "rustc-hash 2.0.0",
+ "same-file",
  "serde",
  "textwrap",
  "thiserror",
  "tokio",
  "tokio-stream",
+ "toml_edit 0.22.13",
  "tracing",
  "url",
- "uv-cache",
  "uv-client",
  "uv-configuration",
  "uv-distribution",
  "uv-git",
- "uv-interpreter",
  "uv-normalize",
+ "uv-toolchain",
  "uv-types",
  "uv-warnings",
 ]
@@ -6088,17 +6238,58 @@ dependencies = [
 [[package]]
 name = "uv-state"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "directories",
  "fs-err",
  "tempfile",
 ]
 
+[[package]]
+name = "uv-toolchain"
+version = "0.0.1"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
+dependencies = [
+ "anyhow",
+ "cache-key",
+ "configparser",
+ "fs-err",
+ "futures",
+ "install-wheel-rs",
+ "itertools 0.13.0",
+ "once_cell",
+ "pep440_rs",
+ "pep508_rs",
+ "platform-tags",
+ "pypi-types",
+ "regex",
+ "reqwest 0.12.4",
+ "reqwest-middleware",
+ "rmp-serde",
+ "same-file",
+ "serde",
+ "serde_json",
+ "target-lexicon",
+ "tempfile",
+ "thiserror",
+ "tokio-util",
+ "tracing",
+ "url",
+ "uv-cache",
+ "uv-client",
+ "uv-configuration",
+ "uv-extract",
+ "uv-fs",
+ "uv-state",
+ "uv-warnings",
+ "which",
+ "winapi",
+]
+
 [[package]]
 name = "uv-types"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "anyhow",
  "distribution-types",
@@ -6106,24 +6297,25 @@ dependencies = [
  "pep440_rs",
  "pep508_rs",
  "pypi-types",
- "rustc-hash",
+ "rustc-hash 2.0.0",
  "thiserror",
  "url",
  "uv-cache",
  "uv-configuration",
- "uv-interpreter",
+ "uv-git",
  "uv-normalize",
+ "uv-toolchain",
 ]
 
 [[package]]
 name = "uv-version"
-version = "0.2.4"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+version = "0.2.18"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 
 [[package]]
 name = "uv-virtualenv"
 version = "0.0.4"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "fs-err",
  "itertools 0.13.0",
@@ -6133,19 +6325,19 @@ dependencies = [
  "thiserror",
  "tracing",
  "uv-fs",
- "uv-interpreter",
+ "uv-toolchain",
  "uv-version",
 ]
 
 [[package]]
 name = "uv-warnings"
 version = "0.0.1"
-source = "git+https://github.com/astral-sh/uv?rev=65b17f6e81125064ea04c5cfef685516ab660cf5#65b17f6e81125064ea04c5cfef685516ab660cf5"
+source = "git+https://github.com/astral-sh/uv?tag=0.2.18#13b0beb56fdc607c1f38d820dbf8c95c8fd0ce84"
 dependencies = [
  "anstream",
  "once_cell",
  "owo-colors",
- "rustc-hash",
+ "rustc-hash 2.0.0",
 ]
 
 [[package]]
@@ -6154,6 +6346,18 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
 
+[[package]]
+name = "value-trait"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dad8db98c1e677797df21ba03fca7d3bf9bec3ca38db930954e4fe6e1ea27eb4"
+dependencies = [
+ "float-cmp",
+ "halfbrown",
+ "itoa",
+ "ryu",
+]
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -6761,6 +6965,38 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "zip"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "775a2b471036342aa69bc5a602bc889cb0a06cda00477d0c69566757d5553d39"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "crossbeam-utils",
+ "displaydoc",
+ "flate2",
+ "indexmap 2.2.6",
+ "memchr",
+ "thiserror",
+ "time",
+ "zopfli",
+]
+
+[[package]]
+name = "zopfli"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5019f391bac5cf252e93bbcc53d039ffd62c7bfb7c150414d61369afe57e946"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "lockfree-object-pool",
+ "log",
+ "once_cell",
+ "simd-adler32",
+]
+
 [[package]]
 name = "zstd"
 version = "0.13.1"
diff --git a/pkgs/by-name/pi/pixi/package.nix b/pkgs/by-name/pi/pixi/package.nix
index 19206ad0146b1..e6b4c55783929 100644
--- a/pkgs/by-name/pi/pixi/package.nix
+++ b/pkgs/by-name/pi/pixi/package.nix
@@ -13,21 +13,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pixi";
-  version = "0.24.2";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "pixi";
     rev = "v${version}";
-    hash = "sha256-Qlr4CcrCq29ig3FPFWCR5oOtFrbREm/7zyGXUB3XL98=";
+    hash = "sha256-N8nNB+FOD8n+W7jFYhq9JoEnLOq6xLMLBC77DiK3RLU=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "async_zip-0.0.17" = "sha256-Q5fMDJrQtob54CTII3+SXHeozy5S5s3iLOzntevdGOs=";
-      "cache-key-0.0.1" = "sha256-lJJqjxyAzGQKZi6RtzZ7A9pCAOyIJnstHoS8jlUWeGA=";
-      "pubgrub-0.2.1" = "sha256-mAPyo2R996ymzCt6TAX2G7xU1C3vDGjYF0z7R8lI1yg=";
+      "cache-key-0.0.1" = "sha256-tg3zRakZsnf7xBjs5tSlkmhkhHp5HGs6dwrTmdZBTl4=";
+      "pubgrub-0.2.1" = "sha256-6tr+HATYSn1A1uVJwmz40S4yLDOJlX8vEokOOtdFG0M=";
     };
   };
 
diff --git a/pkgs/by-name/pr/protoc-gen-elixir/package.nix b/pkgs/by-name/pr/protoc-gen-elixir/package.nix
new file mode 100644
index 0000000000000..8e38f3317646d
--- /dev/null
+++ b/pkgs/by-name/pr/protoc-gen-elixir/package.nix
@@ -0,0 +1,44 @@
+{
+  beamPackages,
+  fetchFromGitHub,
+  lib,
+}:
+beamPackages.mixRelease rec {
+  pname = "protoc-gen-elixir";
+  version = "0.12.0";
+
+  src = fetchFromGitHub {
+    owner = "elixir-protobuf";
+    repo = "protobuf";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-wLU3iM9jI/Zc96/HfPUjNvjteGryWos6IobIb/4zqpw=";
+  };
+
+  mixFodDeps = beamPackages.fetchMixDeps {
+    inherit version src;
+    pname = "protoc-gen-elixir-deps";
+
+    hash = "sha256-H7yiBHoxuiqWcNbWwPU5X0Nnv8f6nM8z/ZAfZAGPZjE=";
+  };
+
+  postBuild = ''
+    mix do escript.build
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp protoc-gen-elixir $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A protoc plugin to generate Elixir code";
+    mainProgram = "protoc-gen-elixir";
+    homepage = "https://github.com/elixir-protobuf/protobuf";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mattpolzin ];
+  };
+}
diff --git a/pkgs/by-name/re/revolver/no-external-call.patch b/pkgs/by-name/re/revolver/no-external-call.patch
new file mode 100644
index 0000000000000..9142edd79b193
--- /dev/null
+++ b/pkgs/by-name/re/revolver/no-external-call.patch
@@ -0,0 +1,16 @@
+Replace call to "revolver" with call to internal function.
+Useful when "revolver" is not defined in PATH.
+--- a/revolver
++++ b/revolver
+@@ -255,9 +255,9 @@
+ ###
+ function _revolver_demo() {
+   for style in "${(@k)_revolver_spinners[@]}"; do
+-    revolver --style $style start $style
++    _revolver --style $style start $style
+     sleep 2
+-    revolver stop
++    _revolver stop
+   done
+ }
+ 
diff --git a/pkgs/by-name/re/revolver/package.nix b/pkgs/by-name/re/revolver/package.nix
new file mode 100644
index 0000000000000..37eac352fd825
--- /dev/null
+++ b/pkgs/by-name/re/revolver/package.nix
@@ -0,0 +1,94 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  zsh,
+  installShellFiles,
+  ncurses,
+  nix-update-script,
+  testers,
+  runCommand,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "revolver";
+  version = "0.2.4-unstable-2020-09-30";
+
+  src = fetchFromGitHub {
+    owner = "molovo";
+    repo = "revolver";
+    rev = "6424e6cb14da38dc5d7760573eb6ecb2438e9661";
+    hash = "sha256-2onqjtPIsgiEJj00oP5xXGkPZGQpGPVwcBOhmicqKcs=";
+  };
+
+  strictDeps = true;
+  doInstallCheck = true;
+
+  nativeBuildInputs = [ installShellFiles ];
+  buildInputs = [
+    zsh
+    ncurses
+  ];
+  nativeInstallCheckInputs = [ zsh ];
+
+  patches = [ ./no-external-call.patch ];
+
+  postPatch = ''
+    substituteInPlace revolver \
+      --replace-fail "tput cols" "${ncurses}/bin/tput cols"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D revolver $out/bin/revolver
+
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd revolver --zsh revolver.zsh-completion
+  '';
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    PATH=$PATH:$out/bin revolver --help
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    tests = {
+      demo = runCommand "revolver-demo" { nativeBuildInputs = [ finalAttrs.finalPackage ]; } ''
+        export HOME="$TEMPDIR"
+
+        # Drop stdout, redirect stderr to stdout and check if it's not empty
+        exec 9>&1
+        echo "Running revolver demo..."
+        if [[ $(revolver demo 2>&1 1>/dev/null | tee >(cat - >&9)) ]]; then
+          exit 1
+        fi
+        echo "Demo done!"
+
+        mkdir $out
+      '';
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        # Wrong '0.2.0' version in the code
+        version = "0.2.0";
+      };
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Progress spinner for ZSH scripts";
+    homepage = "https://github.com/molovo/revolver";
+    downloadPage = "https://github.com/molovo/revolver/releases";
+    license = lib.licenses.mit;
+    mainProgram = "revolver";
+    inherit (zsh.meta) platforms;
+    maintainers = with lib.maintainers; [ d-brasher ];
+  };
+})
diff --git a/pkgs/by-name/ta/tailscale-gitops-pusher/package.nix b/pkgs/by-name/ta/tailscale-gitops-pusher/package.nix
new file mode 100644
index 0000000000000..f0ddde526f0bc
--- /dev/null
+++ b/pkgs/by-name/ta/tailscale-gitops-pusher/package.nix
@@ -0,0 +1,28 @@
+{ lib
+, tailscale
+, buildGoModule
+}:
+
+buildGoModule {
+  inherit (tailscale) version src vendorHash CGO_ENABLED;
+  pname = "tailscale-gitops-pusher";
+
+  subPackages = [
+    "cmd/gitops-pusher"
+  ];
+
+  ldflags = [
+    "-w"
+    "-s"
+    "-X tailscale.com/version.longStamp=${tailscale.version}"
+    "-X tailscale.com/version.shortStamp=${tailscale.version}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://tailscale.com";
+    description = "Allows users to use a GitOps flow for managing Tailscale ACLs";
+    license = licenses.bsd3;
+    mainProgram = "gitops-pusher";
+    maintainers = with maintainers; [ xanderio ];
+  };
+}
diff --git a/pkgs/by-name/vc/vcpkg/package.nix b/pkgs/by-name/vc/vcpkg/package.nix
index 74e16ebf8465c..f92719cb0cc71 100644
--- a/pkgs/by-name/vc/vcpkg/package.nix
+++ b/pkgs/by-name/vc/vcpkg/package.nix
@@ -27,6 +27,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       --replace-fail "arm-linux-gnueabihf-as"  "armv7l-unknown-linux-gnueabihf-as" \
       --replace-fail "arm-linux-gnueabihf-gcc" "armv7l-unknown-linux-gnueabihf-gcc" \
       --replace-fail "arm-linux-gnueabihf-g++" "armv7l-unknown-linux-gnueabihf-g++"
+    # If we don’t turn this off, then you won’t be able to run binaries that
+    # are installed by vcpkg.
+    find triplets -name '*linux*.cmake' -exec bash -c 'echo "set(X_VCPKG_RPATH_KEEP_SYSTEM_PATHS ON)" >> "$1"' -- {} \;
   '';
 
   installPhase = ''
diff --git a/pkgs/by-name/wh/where-is-my-sddm-theme/package.nix b/pkgs/by-name/wh/where-is-my-sddm-theme/package.nix
index 02b5f797cc4dd..9862909bf5757 100644
--- a/pkgs/by-name/wh/where-is-my-sddm-theme/package.nix
+++ b/pkgs/by-name/wh/where-is-my-sddm-theme/package.nix
@@ -34,13 +34,13 @@ lib.checkListOfEnum "where-is-my-sddm-theme: variant" validVariants variants
   stdenvNoCC.mkDerivation
   (finalAttrs: {
     pname = "where-is-my-sddm-theme";
-    version = "1.10.0";
+    version = "1.11.0";
 
     src = fetchFromGitHub {
       owner = "stepanzubkov";
       repo = "where-is-my-sddm-theme";
       rev = "refs/tags/v${finalAttrs.version}";
-      hash = "sha256-hv0s2ZnfLE3DJ60G6ZL/Z+sXth9plzjlUNwII8TMuOo=";
+      hash = "sha256-EzO+MTz1PMmgeKyw65aasetmjUCpvilcvePt6HJZrpo=";
     };
 
     propagatedUserEnvPkgs =
diff --git a/pkgs/by-name/ze/zed-editor/Cargo.lock b/pkgs/by-name/ze/zed-editor/Cargo.lock
index 35a55b81023db..738ab3da1c3ae 100644
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@@ -378,6 +378,7 @@ dependencies = [
  "cargo_toml",
  "chrono",
  "client",
+ "clock",
  "collections",
  "command_palette_hooks",
  "ctor",
@@ -420,6 +421,7 @@ dependencies = [
  "telemetry_events",
  "terminal",
  "terminal_view",
+ "text",
  "theme",
  "tiktoken-rs",
  "toml 0.8.10",
@@ -2405,22 +2407,13 @@ dependencies = [
  "worktree",
 ]
 
-[[package]]
-name = "clipboard-win"
-version = "3.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fdf5e01086b6be750428ba4a40619f847eb2e95756eee84b18e06e5f0b50342"
-dependencies = [
- "lazy-bytes-cast",
- "winapi",
-]
-
 [[package]]
 name = "clock"
 version = "0.1.0"
 dependencies = [
  "chrono",
  "parking_lot",
+ "serde",
  "smallvec",
 ]
 
@@ -2479,6 +2472,7 @@ version = "0.44.0"
 dependencies = [
  "anthropic",
  "anyhow",
+ "assistant",
  "async-trait",
  "async-tungstenite",
  "audio",
@@ -3408,11 +3402,13 @@ dependencies = [
  "ctor",
  "editor",
  "env_logger",
+ "feature_flags",
  "futures 0.3.28",
  "gpui",
  "language",
  "log",
  "lsp",
+ "multi_buffer",
  "pretty_assertions",
  "project",
  "rand 0.8.5",
@@ -3617,6 +3613,7 @@ dependencies = [
  "linkify",
  "log",
  "lsp",
+ "markdown",
  "multi_buffer",
  "ordered-float 2.10.0",
  "parking_lot",
@@ -3990,6 +3987,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "client",
+ "collections",
  "db",
  "editor",
  "extension",
@@ -4009,6 +4007,7 @@ dependencies = [
  "theme_selector",
  "ui",
  "util",
+ "vim",
  "workspace",
 ]
 
@@ -4879,7 +4878,6 @@ dependencies = [
  "calloop",
  "calloop-wayland-source",
  "cbindgen",
- "clipboard-win",
  "cocoa",
  "collections",
  "core-foundation",
@@ -5071,6 +5069,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "client",
+ "extension",
  "fs",
  "futures 0.3.28",
  "gpui",
@@ -6084,12 +6083,6 @@ dependencies = [
  "workspace",
 ]
 
-[[package]]
-name = "lazy-bytes-cast"
-version = "5.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10257499f089cd156ad82d0a9cd57d9501fa2c989068992a97eb3c27836f206b"
-
 [[package]]
 name = "lazy_static"
 version = "1.4.0"
@@ -8085,6 +8078,7 @@ dependencies = [
  "serde_json",
  "settings",
  "sha2 0.10.7",
+ "shellexpand 2.1.2",
  "shlex",
  "similar",
  "smol",
@@ -8226,6 +8220,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "collections",
+ "futures 0.3.28",
  "prost",
  "prost-build",
  "serde",
@@ -8317,10 +8312,13 @@ dependencies = [
  "assistant",
  "editor",
  "gpui",
+ "repl",
  "search",
  "settings",
  "ui",
+ "util",
  "workspace",
+ "zed_actions",
 ]
 
 [[package]]
@@ -8527,7 +8525,6 @@ dependencies = [
  "client",
  "dev_server_projects",
  "editor",
- "feature_flags",
  "fuzzy",
  "gpui",
  "language",
@@ -8705,6 +8702,7 @@ dependencies = [
  "image",
  "language",
  "log",
+ "multi_buffer",
  "project",
  "runtimelib",
  "schemars",
@@ -10777,6 +10775,7 @@ dependencies = [
  "gpui",
  "libc",
  "rand 0.8.5",
+ "release_channel",
  "schemars",
  "serde",
  "serde_derive",
@@ -13337,6 +13336,7 @@ dependencies = [
  "derive_more",
  "dev_server_projects",
  "env_logger",
+ "file_icons",
  "fs",
  "futures 0.3.28",
  "gpui",
@@ -13628,7 +13628,7 @@ dependencies = [
 
 [[package]]
 name = "zed"
-version = "0.144.4"
+version = "0.145.1"
 dependencies = [
  "activity_indicator",
  "anyhow",
@@ -13756,7 +13756,7 @@ dependencies = [
 
 [[package]]
 name = "zed_dart"
-version = "0.0.2"
+version = "0.0.3"
 dependencies = [
  "zed_extension_api 0.0.6",
 ]
@@ -13770,7 +13770,7 @@ dependencies = [
 
 [[package]]
 name = "zed_elixir"
-version = "0.0.5"
+version = "0.0.6"
 dependencies = [
  "zed_extension_api 0.0.6",
 ]
@@ -13870,9 +13870,9 @@ dependencies = [
 
 [[package]]
 name = "zed_php"
-version = "0.0.6"
+version = "0.1.1"
 dependencies = [
- "zed_extension_api 0.0.4",
+ "zed_extension_api 0.0.6",
 ]
 
 [[package]]
@@ -13906,7 +13906,7 @@ dependencies = [
 
 [[package]]
 name = "zed_svelte"
-version = "0.0.1"
+version = "0.0.3"
 dependencies = [
  "zed_extension_api 0.0.6",
 ]
@@ -13948,9 +13948,9 @@ dependencies = [
 
 [[package]]
 name = "zed_zig"
-version = "0.1.3"
+version = "0.1.4"
 dependencies = [
- "zed_extension_api 0.0.7",
+ "zed_extension_api 0.0.6",
 ]
 
 [[package]]
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index b85496958f302..b6d8cd3ec00b7 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -35,13 +35,13 @@ assert withGLES -> stdenv.isLinux;
 
 rustPlatform.buildRustPackage rec {
   pname = "zed";
-  version = "0.144.4";
+  version = "0.145.1";
 
   src = fetchFromGitHub {
     owner = "zed-industries";
     repo = "zed";
     rev = "refs/tags/v${version}";
-    hash = "sha256-F/44NjoBCH2und9VVayE0wxrrOtcFoP5yuvxgxCkxuM=";
+    hash = "sha256-fO1VT2LiZa9XkQxP7QcEG9uCTtEm3soces7FCFwosbU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/changefinder/default.nix b/pkgs/development/python-modules/changefinder/default.nix
index fc34238f00ecc..4405fa8a8525b 100644
--- a/pkgs/development/python-modules/changefinder/default.nix
+++ b/pkgs/development/python-modules/changefinder/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
-, nose
+, pytestCheckHook
 , numpy
 , scipy
 , statsmodels
@@ -20,17 +20,21 @@ buildPythonPackage {
     hash = "sha256-1If0gIsMU8673fKSSHVMvDgR1UnYgM/4HiyvZJ9T6VM=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  patches = [ ./fix_test_invocation.patch ];
+
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
-    nose # not actually required during runtime, but specified as required in `setup.py`
+  pythonRemoveDeps = [ "nose" ];
+
+  dependencies = [
     numpy
     scipy
     statsmodels
   ];
 
+  nativeCheckInputs = [ pytestCheckHook ];
+  pytestFlagsArray = [ "test/test.py" ];
+
   pythonImportsCheck = [ "changefinder" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/changefinder/fix_test_invocation.patch b/pkgs/development/python-modules/changefinder/fix_test_invocation.patch
new file mode 100644
index 0000000000000..f02e2e36d4b54
--- /dev/null
+++ b/pkgs/development/python-modules/changefinder/fix_test_invocation.patch
@@ -0,0 +1,13 @@
+diff --git a/test/test.py b/test/test.py
+index 85a9f4e..a5f44fd 100644
+--- a/test/test.py
++++ b/test/test.py
+@@ -4,7 +4,7 @@ import numpy as np
+ 
+ 
+ class TestChangeFinder():
+-    def setup(self):
++    def setup_method(self):
+         self._term = 30
+         self._smooth = 7
+         self._order = 1
diff --git a/pkgs/development/python-modules/cliff/default.nix b/pkgs/development/python-modules/cliff/default.nix
index cca72fa51ef0d..416a34be304d8 100644
--- a/pkgs/development/python-modules/cliff/default.nix
+++ b/pkgs/development/python-modules/cliff/default.nix
@@ -5,21 +5,21 @@
   autopage,
   cmd2,
   importlib-metadata,
-  installShellFiles,
   openstackdocstheme,
   pbr,
   prettytable,
   pyparsing,
   pyyaml,
+  setuptools,
   stevedore,
-  sphinx,
+  sphinxHook,
   callPackage,
 }:
 
 buildPythonPackage rec {
   pname = "cliff";
   version = "4.7.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -32,13 +32,15 @@ buildPythonPackage rec {
     rm test-requirements.txt
   '';
 
-  nativeBuildInputs = [
-    installShellFiles
+  build-system = [
     openstackdocstheme
-    sphinx
+    setuptools
+    sphinxHook
   ];
 
-  propagatedBuildInputs = [
+  sphinxBuilders = [ "man" ];
+
+  dependencies = [
     autopage
     cmd2
     importlib-metadata
@@ -49,11 +51,6 @@ buildPythonPackage rec {
     stevedore
   ];
 
-  postInstall = ''
-    sphinx-build -a -E -d doc/build/doctrees -b man doc/source doc/build/man
-    installManPage doc/build/man/cliff.1
-  '';
-
   # check in passthru.tests.pytest to escape infinite recursion with stestr
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/cmsis-svd/default.nix b/pkgs/development/python-modules/cmsis-svd/default.nix
index 030b6d2822764..b3197b6f89ef5 100644
--- a/pkgs/development/python-modules/cmsis-svd/default.nix
+++ b/pkgs/development/python-modules/cmsis-svd/default.nix
@@ -2,33 +2,43 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   six,
+  lxml,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "cmsis-svd";
-  version = "0.4";
-  format = "setuptools";
+  version = "0.4-unstable-2024-01-25";
+  pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "posborne";
-    repo = pname;
-    rev = "python-${version}";
-    sha256 = "01f2z01gqgx0risqnbrlaqj49fmly30zbwsf7rr465ggnl2c04r0";
+    owner = "cmsis-svd";
+    repo = "cmsis-svd";
+    rev = "38d21d30abd0d4c2f34fd79d83b34392ed4bb7a3";
+    hash = "sha256-lFA0sNHVj4a4+EwOTmFUbM/nhmzJ4mx4GvT6Ykutakk=";
   };
 
-  preConfigure = ''
+  preBuild = ''
     cd python
   '';
 
-  propagatedBuildInputs = [ six ];
+  build-system = [ setuptools ];
 
-  pythonImportsCheck = [ "cmsis_svd" ];
+  dependencies = [
+    six
+    lxml
+  ];
 
-  meta = with lib; {
+  pythonImportsCheck = [
+    "cmsis_svd"
+    "cmsis_svd.parser"
+  ];
+
+  meta = {
     description = "CMSIS SVD parser";
-    homepage = "https://github.com/posborne/cmsis-svd";
-    maintainers = with maintainers; [ dump_stack ];
-    license = licenses.asl20;
+    homepage = "https://github.com/cmsis-svd/cmsis-svd";
+    maintainers = [ lib.maintainers.dump_stack ];
+    license = lib.licenses.asl20;
   };
 }
diff --git a/pkgs/development/python-modules/debtcollector/default.nix b/pkgs/development/python-modules/debtcollector/default.nix
index 5174c46c444a8..d9b2011b17f2f 100644
--- a/pkgs/development/python-modules/debtcollector/default.nix
+++ b/pkgs/development/python-modules/debtcollector/default.nix
@@ -2,8 +2,11 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  openstackdocstheme,
   pbr,
   six,
+  setuptools,
+  sphinxHook,
   wrapt,
   callPackage,
 }:
@@ -11,16 +14,23 @@
 buildPythonPackage rec {
   pname = "debtcollector";
   version = "3.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-KokX0lsOHx0NNl08HG7Px6UiselxbooaSpFRJvfM6m8=";
   };
 
-  nativeBuildInputs = [ pbr ];
+  build-system = [
+    openstackdocstheme
+    pbr
+    setuptools
+    sphinxHook
+  ];
+
+  sphinxBuilders = [ "man" ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     six
     wrapt
   ];
diff --git a/pkgs/development/python-modules/etebase/default.nix b/pkgs/development/python-modules/etebase/default.nix
index bb23e85534b8a..ffdad63476285 100644
--- a/pkgs/development/python-modules/etebase/default.nix
+++ b/pkgs/development/python-modules/etebase/default.nix
@@ -12,23 +12,39 @@
   openssl,
   Security,
   msgpack,
+  fetchpatch,
 }:
 
 buildPythonPackage rec {
   pname = "etebase";
-  version = "0.31.6";
+  version = "0.31.7";
 
   src = fetchFromGitHub {
     owner = "etesync";
     repo = "etebase-py";
     rev = "v${version}";
-    hash = "sha256-T61nPW3wjBRjmJ81w59T1b/Kxrwwqvyj3gILE9OF/5Q=";
+    hash = "sha256-ZNUUp/0fGJxL/Rt8sAZ864rg8uCcNybIYSk4POt0vqg=";
   };
 
+  # https://github.com/etesync/etebase-py/pull/54
+  patches = [
+    # fix python 3.12 build
+    (fetchpatch {
+      url = "https://github.com/etesync/etebase-py/commit/898eb3aca1d4eb30d4aeae15e35d0bc45dd7b3c8.patch";
+      hash = "sha256-0BDUTztiC4MiwwNEDFtfc5ruc69Qk+svepQZRixNJgA=";
+    })
+    # replace flapigen git dependency in Cargo.lock
+    (fetchpatch {
+      url = "https://github.com/etesync/etebase-py/commit/7e9e4244a144dd46383d8be950d3df79e28eb069.patch";
+      hash = "sha256-8EH8Sc3UnmuCrSwDf3+as218HiG2Ed3r+FCMrUi5YrI=";
+    })
+  ];
+
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-wrMNtcaLAsWBVeJbYbYo+Xmobl01lnUbR9NUqqUzUgU=";
+    hash = "sha256-We19laZd6b2fLSPNLegyNp0eQSeCvUJeTIXqvG7o08c=";
+    inherit patches;
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python-modules/kserve/default.nix b/pkgs/development/python-modules/kserve/default.nix
index 962ba7d8375c7..bb071fc3f0aaa 100644
--- a/pkgs/development/python-modules/kserve/default.nix
+++ b/pkgs/development/python-modules/kserve/default.nix
@@ -3,8 +3,12 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
+
+  # build-system
   deprecation,
   poetry-core,
+
+  # dependencies
   async-timeout,
   cloudevents,
   fastapi,
@@ -17,12 +21,16 @@
   prometheus-client,
   protobuf,
   psutil,
+  pydantic,
   python-dateutil,
+  pyyaml,
   ray,
   six,
   tabulate,
   timing-asgi,
   uvicorn,
+
+  # checks
   avro,
   azure-storage-blob,
   azure-storage-file-share,
@@ -30,13 +38,14 @@
   botocore,
   google-cloud-storage,
   grpcio-testing,
+  pytest-asyncio,
   pytestCheckHook,
   tomlkit,
 }:
 
 buildPythonPackage rec {
   pname = "kserve";
-  version = "0.13.0";
+  version = "0.13.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -45,7 +54,7 @@ buildPythonPackage rec {
     owner = "kserve";
     repo = "kserve";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Fu+1AR7FU4EQ+PhMneHFr3at3N9cN7V24wm/VOfY8GA=";
+    hash = "sha256-wGS001PK+k21oCOaQCiAtytTDjfe0aiTVJ9spyOucYA=";
   };
 
   sourceRoot = "${src.name}/python/kserve";
@@ -68,7 +77,9 @@ buildPythonPackage rec {
     prometheus-client
     protobuf
     psutil
+    pydantic
     python-dateutil
+    pyyaml
     ray
     six
     tabulate
@@ -96,6 +107,7 @@ buildPythonPackage rec {
     botocore
     google-cloud-storage
     grpcio-testing
+    pytest-asyncio
     pytestCheckHook
     tomlkit
   ];
diff --git a/pkgs/development/python-modules/lottie/default.nix b/pkgs/development/python-modules/lottie/default.nix
new file mode 100644
index 0000000000000..a1ced236e8c8f
--- /dev/null
+++ b/pkgs/development/python-modules/lottie/default.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  buildPythonPackage,
+  distutils,
+  fetchPypi,
+  setuptools,
+}:
+buildPythonPackage rec {
+  pname = "lottie";
+  version = "0.7.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-oyQvi6NwUfvddQPs0WggOgjkrybxe+LsygimSvHn08E=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ distutils ];
+
+  pythonImportsCheck = [ "lottie" ];
+
+  meta = with lib; {
+    description = "Framework to work with lottie files and telegram animated stickers (tgs)";
+    homepage = "https://gitlab.com/mattbas/python-lottie/";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ Scrumplex ];
+  };
+}
diff --git a/pkgs/development/python-modules/nuclear/default.nix b/pkgs/development/python-modules/nuclear/default.nix
new file mode 100644
index 0000000000000..ac7d35419835e
--- /dev/null
+++ b/pkgs/development/python-modules/nuclear/default.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  colorama,
+  mock,
+  pyyaml,
+  pydantic,
+  backoff,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "nuclear";
+  version = "2.2.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "igrek51";
+    repo = "nuclear";
+    rev = version;
+    hash = "sha256-JuO7BKmlQE6bWKqy1QvX5U4A9YkKu/4ouTSJh9R7JGo=";
+  };
+
+  build-system = [ setuptools ];
+  dependencies = [
+    colorama
+    pyyaml
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    mock
+    pydantic
+    backoff
+  ];
+  disabledTestPaths = [
+    # Disabled because test tries to install bash in a non-NixOS way
+    "tests/autocomplete/test_bash_install.py"
+  ];
+  disabledTests = [
+    # Setting the time zone in nix sandbox does not work - to be investigated
+    "test_context_logger"
+  ];
+  pythonImportsCheck = [ "nuclear" ];
+
+  meta = with lib; {
+    homepage = "https://igrek51.github.io/nuclear/";
+    description = "Binding glue for CLI Python applications";
+    license = licenses.mit;
+    maintainers = with maintainers; [ parras ];
+  };
+}
diff --git a/pkgs/development/python-modules/openstacksdk/default.nix b/pkgs/development/python-modules/openstacksdk/default.nix
index afd98f1f61ede..5bf0f23accba2 100644
--- a/pkgs/development/python-modules/openstacksdk/default.nix
+++ b/pkgs/development/python-modules/openstacksdk/default.nix
@@ -11,12 +11,14 @@
   keystoneauth1,
   munch,
   netifaces,
+  openstackdocstheme,
   os-service-types,
   pbr,
   pythonOlder,
   pyyaml,
   requestsexceptions,
   setuptools,
+  sphinxHook,
 }:
 
 buildPythonPackage rec {
@@ -26,12 +28,29 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.7";
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-BghpDKN8pzMnsPo3YdF+ZTlb43/yALhzXY8kJ3tPSYA=";
   };
 
-  build-system = [ setuptools ];
+  postPatch = ''
+    # Disable rsvgconverter not needed to build manpage
+    substituteInPlace doc/source/conf.py \
+      --replace-fail "'sphinxcontrib.rsvgconverter'," "#'sphinxcontrib.rsvgconverter',"
+  '';
+
+  build-system = [
+    openstackdocstheme
+    setuptools
+    sphinxHook
+  ];
+
+  sphinxBuilders = [ "man" ];
 
   dependencies = [
     platformdirs
diff --git a/pkgs/development/python-modules/prison/default.nix b/pkgs/development/python-modules/prison/default.nix
index 32d7a9ead8c6b..5abb41f269103 100644
--- a/pkgs/development/python-modules/prison/default.nix
+++ b/pkgs/development/python-modules/prison/default.nix
@@ -2,14 +2,15 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   six,
-  nose,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "prison";
   version = "0.1.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "betodealmeida";
@@ -18,9 +19,11 @@ buildPythonPackage rec {
     hash = "sha256-qor40vUQeTdlO3vwug3GGNX5vkNaF0H7EWlRdsY4bvc=";
   };
 
-  propagatedBuildInputs = [ six ];
+  build-system = [ setuptools ];
 
-  nativeCheckInputs = [ nose ];
+  dependencies = [ six ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Rison encoder/decoder";
diff --git a/pkgs/development/python-modules/python-barbicanclient/default.nix b/pkgs/development/python-modules/python-barbicanclient/default.nix
index cefe9412e86e9..7188c83816053 100644
--- a/pkgs/development/python-modules/python-barbicanclient/default.nix
+++ b/pkgs/development/python-modules/python-barbicanclient/default.nix
@@ -4,6 +4,7 @@
   cliff,
   fetchFromGitea,
   keystoneauth1,
+  openstackdocstheme,
   oslo-i18n,
   oslo-serialization,
   oslo-utils,
@@ -12,6 +13,8 @@
   requests-mock,
   requests,
   setuptools,
+  sphinxcontrib-apidoc,
+  sphinxHook,
   stestr,
 }:
 
@@ -32,11 +35,22 @@ buildPythonPackage rec {
 
   env.PBR_VERSION = version;
 
+  postPatch = ''
+    # Disable rsvgconverter not needed to build manpage
+    substituteInPlace doc/source/conf.py \
+      --replace-fail "'sphinxcontrib.rsvgconverter'," "#'sphinxcontrib.rsvgconverter',"
+  '';
+
   build-system = [
+    openstackdocstheme
     pbr
     setuptools
+    sphinxHook
+    sphinxcontrib-apidoc
   ];
 
+  sphinxBuilders = [ "man" ];
+
   dependencies = [
     cliff
     keystoneauth1
@@ -65,6 +79,7 @@ buildPythonPackage rec {
     homepage = "https://opendev.org/openstack/python-barbicanclient";
     description = "Client library for OpenStack Barbican API";
     license = lib.licenses.asl20;
+    mainProgram = "barbican";
     maintainers = lib.teams.openstack.members;
   };
 }
diff --git a/pkgs/development/python-modules/python-designateclient/default.nix b/pkgs/development/python-modules/python-designateclient/default.nix
index 20cbf04e6ba2e..fa2a61d85aa43 100644
--- a/pkgs/development/python-modules/python-designateclient/default.nix
+++ b/pkgs/development/python-modules/python-designateclient/default.nix
@@ -5,6 +5,7 @@
   fetchFromGitea,
   jsonschema,
   keystoneauth1,
+  openstackdocstheme,
   osc-lib,
   oslo-serialization,
   oslo-utils,
@@ -14,6 +15,8 @@
   requests-mock,
   requests,
   setuptools,
+  sphinxHook,
+  sphinxcontrib-apidoc,
   stestr,
 }:
 
@@ -35,10 +38,15 @@ buildPythonPackage rec {
   env.PBR_VERSION = version;
 
   build-system = [
+    openstackdocstheme
     pbr
     setuptools
+    sphinxHook
+    sphinxcontrib-apidoc
   ];
 
+  sphinxBuilders = [ "man" ];
+
   dependencies = [
     debtcollector
     jsonschema
diff --git a/pkgs/development/python-modules/python-heatclient/default.nix b/pkgs/development/python-modules/python-heatclient/default.nix
index d2cefc90b58da..b8d4563a4d333 100644
--- a/pkgs/development/python-modules/python-heatclient/default.nix
+++ b/pkgs/development/python-modules/python-heatclient/default.nix
@@ -5,6 +5,7 @@
   fetchPypi,
   iso8601,
   keystoneauth1,
+  openstackdocstheme,
   osc-lib,
   oslo-i18n,
   oslo-serialization,
@@ -16,6 +17,8 @@
   pyyaml,
   requests,
   requests-mock,
+  setuptools,
+  sphinxHook,
   stestr,
   testscenarios,
 }:
@@ -23,7 +26,7 @@
 buildPythonPackage rec {
   pname = "python-heatclient";
   version = "3.5.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -32,7 +35,15 @@ buildPythonPackage rec {
     hash = "sha256-B1F40HYHFF91mkxwySR/kqCvlwLLtBgqwUvw2byOc9g=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    openstackdocstheme
+    setuptools
+    sphinxHook
+  ];
+
+  sphinxBuilders = [ "man" ];
+
+  dependencies = [
     cliff
     iso8601
     keystoneauth1
@@ -54,10 +65,14 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
+    runHook preCheck
+
     stestr run -e <(echo "
       heatclient.tests.unit.test_common_http.HttpClientTest.test_get_system_ca_file
       heatclient.tests.unit.test_deployment_utils.TempURLSignalTest.test_create_temp_url
     ")
+
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "heatclient" ];
diff --git a/pkgs/development/python-modules/python-ironicclient/default.nix b/pkgs/development/python-modules/python-ironicclient/default.nix
index 13cd6f4749ee2..2936c3ec2f4cf 100644
--- a/pkgs/development/python-modules/python-ironicclient/default.nix
+++ b/pkgs/development/python-modules/python-ironicclient/default.nix
@@ -6,6 +6,7 @@
   dogpile-cache,
   jsonschema,
   keystoneauth1,
+  openstackdocstheme,
   openstacksdk,
   osc-lib,
   oslo-utils,
@@ -15,6 +16,9 @@
   pyyaml,
   requests,
   requests-mock,
+  setuptools,
+  sphinxcontrib-apidoc,
+  sphinxHook,
   stestr,
   stevedore,
 }:
@@ -22,14 +26,23 @@
 buildPythonPackage rec {
   pname = "python-ironicclient";
   version = "5.7.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-Blx0pr73uZA8eHd2iZ9WY+aozBFWsQhWpxoQKtjtJSk=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    openstackdocstheme
+    setuptools
+    sphinxcontrib-apidoc
+    sphinxHook
+  ];
+
+  sphinxBuilders = [ "man" ];
+
+  dependencies = [
     cliff
     dogpile-cache
     jsonschema
@@ -51,7 +64,9 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
+    runHook preCheck
     stestr run
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "ironicclient" ];
diff --git a/pkgs/development/python-modules/python-manilaclient/default.nix b/pkgs/development/python-modules/python-manilaclient/default.nix
index c3256d0d5447a..bb444dd15ab27 100644
--- a/pkgs/development/python-modules/python-manilaclient/default.nix
+++ b/pkgs/development/python-modules/python-manilaclient/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  installShellFiles,
   pbr,
   openstackdocstheme,
   oslo-config,
@@ -12,7 +11,8 @@
   prettytable,
   requests,
   simplejson,
-  sphinx,
+  setuptools,
+  sphinxHook,
   sphinxcontrib-programoutput,
   babel,
   osc-lib,
@@ -24,21 +24,23 @@
 buildPythonPackage rec {
   pname = "python-manilaclient";
   version = "4.9.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-TebykdG0fkeC+5Vs9eiwuJpXam41gg8gR4F2poYKDhI=";
   };
 
-  nativeBuildInputs = [
-    installShellFiles
+  build-system = [
     openstackdocstheme
-    sphinx
+    setuptools
+    sphinxHook
     sphinxcontrib-programoutput
   ];
 
-  propagatedBuildInputs = [
+  sphinxBuilders = [ "man" ];
+
+  dependencies = [
     pbr
     oslo-config
     oslo-log
@@ -53,12 +55,6 @@ buildPythonPackage rec {
     debtcollector
   ];
 
-  postInstall = ''
-    export PATH=$out/bin:$PATH
-    sphinx-build -a -E -d doc/build/doctrees -b man doc/source doc/build/man
-    installManPage doc/build/man/python-manilaclient.1
-  '';
-
   # Checks moved to 'passthru.tests' to workaround infinite recursion
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/python-openstackclient/default.nix b/pkgs/development/python-modules/python-openstackclient/default.nix
index fc48197864abd..50aa590d6b6a8 100644
--- a/pkgs/development/python-modules/python-openstackclient/default.nix
+++ b/pkgs/development/python-modules/python-openstackclient/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   ddt,
-  installShellFiles,
   openstackdocstheme,
   osc-lib,
   pbr,
@@ -11,7 +10,8 @@
   python-keystoneclient,
   python-novaclient,
   requests-mock,
-  sphinx,
+  setuptools,
+  sphinxHook,
   sphinxcontrib-apidoc,
   stestr,
 }:
@@ -19,21 +19,23 @@
 buildPythonPackage rec {
   pname = "python-openstackclient";
   version = "6.6.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-u+8e00gpxBBSsuyiZIDinKH3K+BY0UMNpTQexExPKVw=";
   };
 
-  nativeBuildInputs = [
-    installShellFiles
+  build-system = [
     openstackdocstheme
-    sphinx
+    setuptools
+    sphinxHook
     sphinxcontrib-apidoc
   ];
 
-  propagatedBuildInputs = [
+  sphinxBuilders = [ "man" ];
+
+  dependencies = [
     osc-lib
     pbr
     python-cinderclient
@@ -41,11 +43,6 @@ buildPythonPackage rec {
     python-novaclient
   ];
 
-  postInstall = ''
-    sphinx-build -a -E -d doc/build/doctrees -b man doc/source doc/build/man
-    installManPage doc/build/man/openstack.1
-  '';
-
   nativeCheckInputs = [
     ddt
     stestr
@@ -53,7 +50,9 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
+    runHook preCheck
     stestr run
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "openstackclient" ];
diff --git a/pkgs/development/python-modules/ray/binary-hashes.nix b/pkgs/development/python-modules/ray/binary-hashes.nix
index 98c442139dca7..609e6c12288d1 100644
--- a/pkgs/development/python-modules/ray/binary-hashes.nix
+++ b/pkgs/development/python-modules/ray/binary-hashes.nix
@@ -1,11 +1,11 @@
 {
   cp310 = {
-    hash = "sha256-YlQ2hoW5MjQkOJ4L2/GsomlyX3rkNDjdC82hZ0RwzGw=";
+    hash = "sha256-cHxgTJS5t5nQXi//EWtyUHhGelZbbd5mOs9cegeaj58=";
   };
   cp311 = {
-    hash = "sha256-VhbwU8sSccbuybGCPGeEF+lXv9fGGtVs1+e4S5vOURI=";
+    hash = "sha256-+rj/xdcVHe23UOzZ6YbTq7ULMgYTyjeN5peNoa3NMVc=";
   };
   cp312 = {
-    hash = "sha256-EYug39E5RXG8W8x7aQTajcbFmvq8FZiXxdiSKV3htBE=";
+    hash = "sha256-4GWQJp0OUjt2X+Hw+E0HpWv04TN8HlSkIoEHsHIrfe0=";
   };
 }
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index 69fbb8cae968b..9430001fff90f 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -1,58 +1,62 @@
 {
+  lib,
+  buildPythonPackage,
+  pythonOlder,
+  pythonAtLeast,
+  python,
+  fetchPypi,
+  autoPatchelfHook,
+
+  # dependencies
   aiohttp,
   aiohttp-cors,
-  aiorwlock,
   aiosignal,
   attrs,
-  autoPatchelfHook,
-  buildPythonPackage,
-  fetchPypi,
   click,
   cloudpickle,
   colorama,
   colorful,
   cython,
-  dm-tree,
-  fastapi,
   filelock,
   frozenlist,
-  fsspec,
   gpustat,
   grpcio,
-  gym,
   jsonschema,
-  lib,
-  lz4,
-  matplotlib,
   msgpack,
   numpy,
   opencensus,
   packaging,
-  pandas,
-  py-spy,
   prometheus-client,
   psutil,
-  pyarrow,
   pydantic,
-  python,
-  pythonAtLeast,
-  pythonOlder,
+  py-spy,
   pyyaml,
   requests,
-  scikit-image,
-  scipy,
   setproctitle,
   smart-open,
+  virtualenv,
+
+  # optional-dependencies
+  fsspec,
+  pandas,
+  pyarrow,
+  dm-tree,
+  gym,
+  lz4,
+  matplotlib,
+  scikit-image,
+  scipy,
+  aiorwlock,
+  fastapi,
   starlette,
+  uvicorn,
   tabulate,
   tensorboardx,
-  uvicorn,
-  virtualenv,
 }:
 
 let
   pname = "ray";
-  version = "2.32.0";
+  version = "2.33.0";
 in
 buildPythonPackage rec {
   inherit pname version;
@@ -76,39 +80,6 @@ buildPythonPackage rec {
       // binary-hash
     );
 
-  passthru.optional-dependencies = rec {
-    data-deps = [
-      pandas
-      pyarrow
-      fsspec
-    ];
-
-    serve-deps = [
-      aiorwlock
-      fastapi
-      pandas
-      starlette
-      uvicorn
-    ];
-
-    tune-deps = [
-      tabulate
-      tensorboardx
-    ];
-
-    rllib-deps = tune-deps ++ [
-      dm-tree
-      gym
-      lz4
-      matplotlib
-      scikit-image
-      pyyaml
-      scipy
-    ];
-
-    air-deps = data-deps ++ serve-deps ++ tune-deps ++ rllib-deps;
-  };
-
   nativeBuildInputs = [
     autoPatchelfHook
   ];
@@ -121,10 +92,10 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    attrs
     aiohttp
     aiohttp-cors
     aiosignal
+    attrs
     click
     cloudpickle
     colorama
@@ -139,10 +110,10 @@ buildPythonPackage rec {
     numpy
     opencensus
     packaging
-    py-spy
     prometheus-client
     psutil
     pydantic
+    py-spy
     pyyaml
     requests
     setproctitle
@@ -150,6 +121,35 @@ buildPythonPackage rec {
     virtualenv
   ];
 
+  optional-dependencies = rec {
+    air-deps = data-deps ++ serve-deps ++ tune-deps ++ rllib-deps;
+    data-deps = [
+      fsspec
+      pandas
+      pyarrow
+    ];
+    rllib-deps = tune-deps ++ [
+      dm-tree
+      gym
+      lz4
+      matplotlib
+      pyyaml
+      scikit-image
+      scipy
+    ];
+    serve-deps = [
+      aiorwlock
+      fastapi
+      pandas
+      starlette
+      uvicorn
+    ];
+    tune-deps = [
+      tabulate
+      tensorboardx
+    ];
+  };
+
   postInstall = ''
     chmod +x $out/${python.sitePackages}/ray/core/src/ray/{gcs/gcs_server,raylet/raylet}
   '';
diff --git a/pkgs/development/python-modules/svgutils/default.nix b/pkgs/development/python-modules/svgutils/default.nix
index 307b6f689a740..40e50d9b9a0f7 100644
--- a/pkgs/development/python-modules/svgutils/default.nix
+++ b/pkgs/development/python-modules/svgutils/default.nix
@@ -2,11 +2,10 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
+  fetchpatch2,
   setuptools,
   lxml,
   pytestCheckHook,
-  nose,
 }:
 
 buildPythonPackage rec {
@@ -25,13 +24,24 @@ buildPythonPackage rec {
 
   dependencies = [ lxml ];
 
-  doCheck = pythonOlder "3.12";
+  patches = [
+    # Remove nose dependency, see: https://github.com/btel/svg_utils/pull/131
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    nose
+    # this first commit is required, as isort moved nose imports
+    (fetchpatch2 {
+      url = "https://github.com/btel/svg_utils/commit/48b078a729aeb6b1160142ab65157474c95a61b6.patch?full_index=1";
+      hash = "sha256-9toOFfNkgGF3TvM340vYOTkuSEHBeiyBRSGqqobfiqI=";
+    })
+
+    # migrate to pytest
+    (fetchpatch2 {
+      url = "https://github.com/btel/svg_utils/commit/931a80220be7c0efa2fc6e1d47858d69a08df85e.patch?full_index=1";
+      hash = "sha256-SMv0i8p3s57TDn6NM17RrHF9kVgsy2YJJ0KEBQKn2J0=";
+    })
   ];
 
+  nativeCheckInputs = [ pytestCheckHook ];
+
   pythonImportsCheck = [ "svgutils" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index 66b7e1aee3db9..77326c7152c18 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage rec {
     hash = "sha256-l4qKbTfQRWiRsoHN9fiAAiGMGP+q3gwRH1pMSXV/eSU=";
   };
 
+  pythonRelaxDeps = [ "defusedxml" ];
+
   nativeBuildInputs = [ setuptools ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/wat/default.nix b/pkgs/development/python-modules/wat/default.nix
new file mode 100644
index 0000000000000..7ea81661648f6
--- /dev/null
+++ b/pkgs/development/python-modules/wat/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  nuclear,
+  pydantic,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "wat";
+  version = "0.1.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "igrek51";
+    repo = "wat";
+    rev = version;
+    hash = "sha256-ibbWM2L/GoJVg8RxtsBSBn/qA+KIkC5+wq5YH6mtiUs=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    nuclear
+    pydantic
+  ];
+  pythonImportsCheck = [ "wat" ];
+
+  meta = with lib; {
+    homepage = "https://igrek51.github.io/wat/";
+    description = "Deep inspection of python objects";
+    license = licenses.mit;
+    maintainers = with maintainers; [ parras ];
+  };
+}
diff --git a/pkgs/development/python-modules/zha/default.nix b/pkgs/development/python-modules/zha/default.nix
index 358a475f6fcf7..01101670ef548 100644
--- a/pkgs/development/python-modules/zha/default.nix
+++ b/pkgs/development/python-modules/zha/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "zha";
-  version = "0.0.20";
+  version = "0.0.23";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha";
     rev = "refs/tags/${version}";
-    hash = "sha256-kmTOWHREdzXfgDPPs91GfQCgpmkUshwGtscOTT1WGns=";
+    hash = "sha256-a0rr8pJCoVtDR3iNCDpLZnapetzNHMj8uCu667lNcGE=";
   };
 
   postPatch = ''
@@ -102,6 +102,12 @@ buildPythonPackage rec {
     "test_sinope_time"
     "test_siren_timed_off"
     "test_zha_group_light_entity"
+    # flaky, either due to race conditions or timeouts
+    "test_zha_group_switch_entity"
+    "test_zha_group_fan_entity"
+    "test_startup_concurrency_limit"
+    "test_fan_ikea"
+    "test_background"
   ];
 
   disabledTestPaths = [ "tests/test_cluster_handlers.py" ];
diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index 8143a6bfd58e4..27c11ffb2eaa9 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.18.0";
+  version = "2.18.1";
 
   dontConfigure = true;
   dontBuild = true;
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-wmBsPSwuFUnipLodxtr9xGhWKjBrn3NQ/X1QpxvlRf4=";
+    hash = "sha256-X/Sg5+UGl0DJ5LL42tlQt3NIfTJc4nH1AySeLJQsZkk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 7567b3e3dba10..1522411656cd4 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -211,6 +211,7 @@ rec {
       passthru = {
         fetchDeps = callPackage ./fetch-deps.nix { inherit mitm-cache; };
         inherit (gradle) jdk;
+        unwrapped = gradle;
       };
 
       meta = gradle.meta // {
diff --git a/pkgs/development/tools/language-servers/zls/default.nix b/pkgs/development/tools/language-servers/zls/default.nix
index 1642d495b1d88..408bb69f64b6e 100644
--- a/pkgs/development/tools/language-servers/zls/default.nix
+++ b/pkgs/development/tools/language-servers/zls/default.nix
@@ -1,28 +1,28 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, zig_0_12
+, zig_0_13
 , callPackage
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zls";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "zigtools";
     repo = "zls";
     rev = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-2iVDPUj9ExgTooDQmCCtZs3wxBe2be9xjzAk9HedPNY=";
+    hash = "sha256-vkFGoKCYUk6B40XW2T/pdhir2wzN1kpFmlLcoLwJx1U=";
   };
 
   zigBuildFlags = [
-    "-Dversion_data_path=${zig_0_12.src}/doc/langref.html.in"
+    "-Dversion_data_path=${zig_0_13.src}/doc/langref.html.in"
   ];
 
   nativeBuildInputs = [
-    zig_0_12.hook
+    zig_0_13.hook
   ];
 
   postPatch = ''
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/zigtools/zls/releases/tag/${finalAttrs.version}";
     homepage = "https://github.com/zigtools/zls";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ figsoda moni ];
+    maintainers = with lib.maintainers; [ figsoda moni _0x5a4 ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/development/tools/language-servers/zls/deps.nix b/pkgs/development/tools/language-servers/zls/deps.nix
index 4de50620ef9c7..1c6b2cd25f8c7 100644
--- a/pkgs/development/tools/language-servers/zls/deps.nix
+++ b/pkgs/development/tools/language-servers/zls/deps.nix
@@ -4,17 +4,17 @@
 
 linkFarm "zig-packages" [
   {
-    name = "12201314cffeb40c5e4e3da166217d2c74628c74486414aaf97422bcd2279915b9fd";
+    name = "12209cde192558f8b3dc098ac2330fc2a14fdd211c5433afd33085af75caa9183147";
     path = fetchzip {
-      url = "https://github.com/ziglibs/known-folders/archive/bf79988adcfce166f848e4b11e718c1966365329.tar.gz";
-      hash = "sha256-Q7eMdyScqj8qEiAHg1BnGRTsWSQOKWWTc6hUYHNlgGg=";
+      url = "https://github.com/ziglibs/known-folders/archive/0ad514dcfb7525e32ae349b9acc0a53976f3a9fa.tar.gz";
+      hash = "sha256-X+XkFj56MkYxxN9LUisjnkfCxUfnbkzBWHy9pwg5M+g=";
     };
   }
   {
-    name = "12200d71e4b7029ea56a429e24260c6c0e85a3069b0d4ba85eace21a0fd75910aa64";
+    name = "1220102cb2c669d82184fb1dc5380193d37d68b54e8d75b76b2d155b9af7d7e2e76d";
     path = fetchzip {
-      url = "https://github.com/ziglibs/diffz/archive/e10bf15962e45affb3fcd7d9a950977a69c901b3.tar.gz";
-      hash = "sha256-yVFPVn4jGfcoE2V4xdTqdThYPutshL6U4feDzetWgFw=";
+      url = "https://github.com/ziglibs/diffz/archive/ef45c00d655e5e40faf35afbbde81a1fa5ed7ffb.tar.gz";
+      hash = "sha256-5/3W0Xt9RjsvCb8Q4cdaM8dkJP7CdFro14JJLCuqASo=";
     };
   }
 ]
diff --git a/pkgs/development/tools/skaffold/default.nix b/pkgs/development/tools/skaffold/default.nix
index da1a2db8c86c7..4bf5f21ce1048 100644
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "skaffold";
-  version = "2.12.0";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    hash = "sha256-q57n5Jo682u/YK+5bgYqMufjPuPOPsBgJzxSl1fdqxA=";
+    hash = "sha256-zcGMKxC2BIg2KPxmGG9UUJzpMdAQbZ8zDGtYyF1T7ZQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/skopeo/default.nix b/pkgs/development/tools/skopeo/default.nix
index fa9dbcb7666f6..6e78caf84ff0d 100644
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@@ -18,13 +18,13 @@
 
 buildGoModule rec {
   pname = "skopeo";
-  version = "1.15.2";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "containers";
     repo = "skopeo";
-    hash = "sha256-qE6c7+NMGmz1zDqtEfAQQp/gQ0FP034q8wVCdHZ1wY8=";
+    hash = "sha256-M9BRsW3mNIRAr+yXSmoPNNoEY/XrCFNt+m2PtTuJUO4=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/development/tools/vsce/default.nix b/pkgs/development/tools/vsce/default.nix
index a5002fdabc372..3ad734efdce9c 100644
--- a/pkgs/development/tools/vsce/default.nix
+++ b/pkgs/development/tools/vsce/default.nix
@@ -12,16 +12,16 @@
 
 buildNpmPackage rec {
   pname = "vsce";
-  version = "2.28.0";
+  version = "2.31.1";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vscode-vsce";
     rev = "v${version}";
-    hash = "sha256-LMePEsNU62oSp/aaeUZY7A+0rTHiYOBqWBiqSpXUJOY=";
+    hash = "sha256-VXZBuaJn0VGpq1sIwsp+OcYErYShTCcU/FnTgDHmf7g=";
   };
 
-  npmDepsHash = "sha256-Ml65YY4vqzntgCP9FoEGpR5rMkYL+alN9pSpbvR28E0=";
+  npmDepsHash = "sha256-Ftf6m5gRcYnkYfRx9vUys9uax8pwyyjUbfw3am8WriA=";
 
   postPatch = ''
     substituteInPlace package.json --replace '"version": "0.0.0"' '"version": "${version}"'
diff --git a/pkgs/games/chiaki4deck/default.nix b/pkgs/games/chiaki4deck/default.nix
index cd0a8f07d812f..509fa9eccb22d 100644
--- a/pkgs/games/chiaki4deck/default.nix
+++ b/pkgs/games/chiaki4deck/default.nix
@@ -85,11 +85,8 @@ stdenv.mkDerivation rec {
     xxHash
   ];
 
-  # handle cmake not being able to identify if curl is built with websocket support, and library name discrepancy when curl not built with cmake
+  # handle library name discrepancy when curl not built with cmake
   postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail ' WS WSS' ""
-
     substituteInPlace lib/CMakeLists.txt \
       --replace-fail 'libcurl_shared' 'libcurl'
   '';
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index d05d6831febd8..6343c5b1b9dd9 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -736,6 +736,26 @@ in rec {
     };
   };
 
+  tmux-floax = mkTmuxPlugin {
+    pluginName = "tmux-floax";
+    rtpFilePath = "floax.tmux";
+    version = "0-unstable-2024-07-24";
+    src = fetchFromGitHub {
+      owner = "omerxx";
+      repo = "tmux-floax";
+      rev = "46c0a6a8c3cf79b83d1b338f547acbbd1d306301";
+      hash = "sha256-bALZfVWcoAzcTeWwkBHhi7TzUQJicOBTNdeJh3O/Bj8=";
+    };
+    meta = {
+      description = "Floating pane for Tmux";
+      homepage = "https://github.com/omerxx/tmux-floax";
+      license = lib.licenses.gpl3Only;
+      maintainers = with lib.maintainers; [ redyf ];
+      mainProgram = "tmux-floax";
+      platforms = lib.platforms.all;
+    };
+  };
+
   tmux-fzf = mkTmuxPlugin {
     pluginName = "tmux-fzf";
     rtpFilePath = "main.tmux";
diff --git a/pkgs/os-specific/linux/hostapd/0007-RADIUS-Require-Message-Authenticator-attribute-in-MA.patch b/pkgs/os-specific/linux/hostapd/0007-RADIUS-Require-Message-Authenticator-attribute-in-MA.patch
deleted file mode 100644
index e895e47925679..0000000000000
--- a/pkgs/os-specific/linux/hostapd/0007-RADIUS-Require-Message-Authenticator-attribute-in-MA.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From 58097123ec5ea6f8276b38cb9b07669ec368a6c1 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Sun, 17 Mar 2024 10:42:56 +0200
-Subject: [PATCH 7/8] RADIUS: Require Message-Authenticator attribute in MAC
- ACL cases
-
-hostapd required Message-Authenticator attribute to be included in EAP
-authentication cases, but that requirement was not in place for MAC ACL
-cases. Start requiring Message-Authenticator attribute for MAC ACL by
-default. Unlike the EAP case, this can still be disabled with
-radius_require_message_authenticator=1 to maintain compatibility with
-some RADIUS servers when used in a network where the connection to such
-a server is secure.
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
----
- hostapd/config_file.c    |  3 +++
- hostapd/hostapd.conf     | 11 +++++++++++
- src/ap/ap_config.c       |  1 +
- src/ap/ap_config.h       |  1 +
- src/ap/ieee802_11_auth.c |  4 +++-
- 5 files changed, 19 insertions(+), 1 deletion(-)
-
-diff --git a/hostapd/config_file.c b/hostapd/config_file.c
-index 96c28aea2..3fb059770 100644
---- a/hostapd/config_file.c
-+++ b/hostapd/config_file.c
-@@ -2988,6 +2988,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
- #endif /* CONFIG_RADIUS_TLS */
- 	} else if (os_strcmp(buf, "radius_retry_primary_interval") == 0) {
- 		bss->radius->retry_primary_interval = atoi(pos);
-+	} else if (os_strcmp(buf,
-+			     "radius_require_message_authenticator") == 0) {
-+		bss->radius_require_message_authenticator = atoi(pos);
- 	} else if (os_strcmp(buf, "radius_acct_interim_interval") == 0) {
- 		bss->acct_interim_interval = atoi(pos);
- 	} else if (os_strcmp(buf, "radius_request_cui") == 0) {
-diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
-index e3367b708..3f0e66beb 100644
---- a/hostapd/hostapd.conf
-+++ b/hostapd/hostapd.conf
-@@ -1620,6 +1620,17 @@ own_ip_addr=127.0.0.1
- # currently used secondary server is still working.
- #radius_retry_primary_interval=600
- 
-+# Message-Authenticator attribute requirement for non-EAP cases
-+# hostapd requires Message-Authenticator attribute to be included in all cases
-+# where RADIUS is used for EAP authentication. This is also required for cases
-+# where RADIUS is used for MAC ACL (macaddr_acl=2) by default, but that case
-+# can be configured to not require this for compatibility with RADIUS servers
-+# that do not include the attribute. This is not recommended due to potential
-+# security concerns, but can be used as a temporary workaround in networks where
-+# the connection to the RADIUS server is secure.
-+# 0 = Do not require Message-Authenticator in MAC ACL response
-+# 1 = Require Message-Authenticator in all authentication cases (default)
-+#radius_require_message_authenticator=1
- 
- # Interim accounting update interval
- # If this is set (larger than 0) and acct_server is configured, hostapd will
-diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
-index 32b04ab35..0b5a16ef9 100644
---- a/src/ap/ap_config.c
-+++ b/src/ap/ap_config.c
-@@ -122,6 +122,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
- #endif /* CONFIG_IEEE80211R_AP */
- 
- 	bss->radius_das_time_window = 300;
-+	bss->radius_require_message_authenticator = 1;
- 
- 	bss->anti_clogging_threshold = 5;
- 	bss->sae_sync = 5;
-diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
-index fda937ecf..ced2181ab 100644
---- a/src/ap/ap_config.h
-+++ b/src/ap/ap_config.h
-@@ -309,6 +309,7 @@ struct hostapd_bss_config {
- 	struct hostapd_ip_addr own_ip_addr;
- 	char *nas_identifier;
- 	struct hostapd_radius_servers *radius;
-+	int radius_require_message_authenticator;
- 	int acct_interim_interval;
- 	int radius_request_cui;
- 	struct hostapd_radius_attr *radius_auth_req_attr;
-diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c
-index cc38044d8..913a99597 100644
---- a/src/ap/ieee802_11_auth.c
-+++ b/src/ap/ieee802_11_auth.c
-@@ -508,7 +508,9 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req,
- 	wpa_printf(MSG_DEBUG, "Found matching Access-Request for RADIUS "
- 		   "message (id=%d)", query->radius_id);
- 
--	if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) {
-+	if (radius_msg_verify(
-+		    msg, shared_secret, shared_secret_len, req,
-+		    hapd->conf->radius_require_message_authenticator)) {
- 		wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have "
- 			   "correct authenticator - dropped\n");
- 		return RADIUS_RX_INVALID_AUTHENTICATOR;
--- 
-2.45.1
-
diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
index 5988dc0436dcb..10abb04f776fc 100644
--- a/pkgs/os-specific/linux/hostapd/default.nix
+++ b/pkgs/os-specific/linux/hostapd/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   pkg-config,
   libnl,
   openssl,
@@ -12,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "hostapd";
-  version = "2.10";
+  version = "2.11";
 
   src = fetchurl {
     url = "https://w1.fi/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-IG58eZtnhXLC49EgMCOHhLxKn4IyOwFWtMlGbxSYkV0=";
+    sha256 = "sha256-Kz+stjL9T2XjL0v4Kna0tyxQH5laT2LjMCGf567RdHo=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -29,53 +28,6 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/openwrt/openwrt/eefed841b05c3cd4c65a78b50ce0934d879e6acf/package/network/services/hostapd/patches/300-noscan.patch";
       sha256 = "08p5frxhpq1rp2nczkscapwwl8g9nc4fazhjpxic5bcbssc3sb00";
     })
-
-    # Backported security patches for CVE-2024-3596 (https://blastradius.fail),
-    # these can be removed when updating to 2.11.
-
-    # RADIUS: Allow Message-Authenticator attribute as the first attribute
-    (fetchpatch {
-      url = "https://w1.fi/cgit/hostap/patch/?id=adac846bd0e258a0aa50750bbd2b411fa0085c46";
-      hash = "sha256-1jfSeVGL5tyZn8F2wpQ7KwaQaEKWsCOW/bavovMcdz4=";
-    })
-
-    # RADIUS server: Place Message-Authenticator attribute as the first one
-    (fetchpatch {
-      url = "https://w1.fi/cgit/hostap/patch/?id=54abb0d3cf35894e7d86e3f7555e95b106306803";
-      hash = "sha256-fVhQlOVETttVf1M9iKrXJrv7mxpxSjCt3w8kndRal08=";
-    })
-
-    # hostapd: Move Message-Authenticator attribute to be the first one in req
-    (fetchpatch {
-      url = "https://w1.fi/cgit/hostap/patch/?id=37fe8e48ab44d44fe3cf5dd8f52cb0a10be0cd17";
-      hash = "sha256-3eoAkXhieO3f0R5PTlH6g5wcgo/aLQN6XcPSITGgciE=";
-    })
-
-    # RADIUS DAS: Move Message-Authenticator attribute to be the first one
-    (fetchpatch {
-      url = "https://w1.fi/cgit/hostap/patch/?id=f54157077f799d84ce26bed6ad6b01c4a16e31cf";
-      hash = "sha256-dcaghKbKNFVSN6ONNaFt1s0S35mkqox2aykiExEXyPQ=";
-    })
-
-    # Require Message-Authenticator in Access-Reject even without EAP-Message
-    (fetchpatch {
-      url = "https://w1.fi/cgit/hostap/patch/?id=934b0c3a45ce0726560ccefbd992a9d385c36385";
-      hash = "sha256-9GquP/+lsghF81nMhOuRwlSz/pEnmk+mSex8aM3/qdA=";
-    })
-
-    # RADIUS: Require Message-Authenticator attribute in MAC ACL cases
-    #(fetchpatch {
-    #  url = "https://w1.fi/cgit/hostap/patch/?id=58097123ec5ea6f8276b38cb9b07669ec368a6c1";
-    #  hash = "sha256-mW+PAeAkNcrlFPsjxLvZ/1Smq6H6KXq5Le3HuLA2KKw=";
-    #})
-    # Needed to be fixed to apply correctly:
-    ./0007-RADIUS-Require-Message-Authenticator-attribute-in-MA.patch
-
-    # RADIUS: Check Message-Authenticator if it is present even if not required
-    (fetchpatch {
-      url = "https://w1.fi/cgit/hostap/patch/?id=f302d9f9646704cce745734af21d540baa0da65f";
-      hash = "sha256-6i0cq5YBm2w03yMrdYGaEqe1dTsmokZWOs4WPFX36qo=";
-    })
   ];
 
   outputs = [ "out" "man" ];
@@ -137,6 +89,7 @@ stdenv.mkDerivation rec {
     CONFIG_IEEE80211N=y
     CONFIG_IEEE80211AC=y
     CONFIG_IEEE80211AX=y
+    CONFIG_IEEE80211BE=y
   '' + lib.optionalString (sqlite != null) ''
     CONFIG_SQLITE=y
   '';
diff --git a/pkgs/os-specific/linux/wpa_supplicant/0001-Implement-read-only-mode-for-ssids.patch b/pkgs/os-specific/linux/wpa_supplicant/0001-Implement-read-only-mode-for-ssids.patch
deleted file mode 100644
index d459de8a7f39e..0000000000000
--- a/pkgs/os-specific/linux/wpa_supplicant/0001-Implement-read-only-mode-for-ssids.patch
+++ /dev/null
@@ -1,130 +0,0 @@
-From 99ae610f0ae3608a12c864caedf396f14e68327d Mon Sep 17 00:00:00 2001
-From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Fri, 19 Feb 2021 19:44:21 +0100
-Subject: [PATCH] Implement read-only mode for ssids
-
-With this change it's possible to define `network=`-sections in a second
-config file specified via `-I` without having changes written to
-`/etc/wpa_supplicant.conf`.
-
-This is helpful on e.g. NixOS to allow both declarative (i.e. read-only)
-and imperative (i.e. mutable) networks.
----
- wpa_supplicant/config.h         | 2 +-
- wpa_supplicant/config_file.c    | 5 +++--
- wpa_supplicant/config_none.c    | 2 +-
- wpa_supplicant/config_ssid.h    | 2 ++
- wpa_supplicant/wpa_supplicant.c | 8 ++++----
- 5 files changed, 11 insertions(+), 8 deletions(-)
-
-diff --git a/wpa_supplicant/config.h b/wpa_supplicant/config.h
-index 6a297ecfe..adaf4d398 100644
---- a/wpa_supplicant/config.h
-+++ b/wpa_supplicant/config.h
-@@ -1614,7 +1614,7 @@ const char * wpa_config_get_global_field_name(unsigned int i, int *no_var);
-  *
-  * Each configuration backend needs to implement this function.
-  */
--struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp);
-+struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp, int ro);
- 
- /**
-  * wpa_config_write - Write or update configuration data
-diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
-index 77c326df5..d5ed051b9 100644
---- a/wpa_supplicant/config_file.c
-+++ b/wpa_supplicant/config_file.c
-@@ -373,7 +373,7 @@ static int wpa_config_process_blob(struct wpa_config *config, FILE *f,
- #endif /* CONFIG_NO_CONFIG_BLOBS */
- 
- 
--struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp)
-+struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp, int ro)
- {
- 	FILE *f;
- 	char buf[512], *pos;
-@@ -415,6 +415,7 @@ struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp)
- 	while (wpa_config_get_line(buf, sizeof(buf), f, &line, &pos)) {
- 		if (os_strcmp(pos, "network={") == 0) {
- 			ssid = wpa_config_read_network(f, &line, id++);
-+			ssid->ro = ro;
- 			if (ssid == NULL) {
- 				wpa_printf(MSG_ERROR, "Line %d: failed to "
- 					   "parse network block.", line);
-@@ -1591,7 +1592,7 @@ int wpa_config_write(const char *name, struct wpa_config *config)
- 	}
- 
- 	for (ssid = config->ssid; ssid; ssid = ssid->next) {
--		if (ssid->key_mgmt == WPA_KEY_MGMT_WPS || ssid->temporary)
-+		if (ssid->key_mgmt == WPA_KEY_MGMT_WPS || ssid->temporary || ssid->ro)
- 			continue; /* do not save temporary networks */
- 		if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
- 		    !ssid->passphrase)
-diff --git a/wpa_supplicant/config_none.c b/wpa_supplicant/config_none.c
-index 2aac28fa3..02191b425 100644
---- a/wpa_supplicant/config_none.c
-+++ b/wpa_supplicant/config_none.c
-@@ -17,7 +17,7 @@
- #include "base64.h"
- 
- 
--struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp)
-+struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp, int ro)
- {
- 	struct wpa_config *config;
- 
-diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h
-index d5c5c00a9..fd80c079c 100644
---- a/wpa_supplicant/config_ssid.h
-+++ b/wpa_supplicant/config_ssid.h
-@@ -93,6 +93,8 @@ struct wpa_ssid {
- 	 */
- 	int id;
- 
-+	int ro;
-+
- 	/**
- 	 * priority - Priority group
- 	 *
-diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
-index 911d79d17..cb0cb99b1 100644
---- a/wpa_supplicant/wpa_supplicant.c
-+++ b/wpa_supplicant/wpa_supplicant.c
-@@ -1052,14 +1052,14 @@ int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
- 
- 	if (wpa_s->confname == NULL)
- 		return -1;
--	conf = wpa_config_read(wpa_s->confname, NULL);
-+	conf = wpa_config_read(wpa_s->confname, NULL, 0);
- 	if (conf == NULL) {
- 		wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
- 			"file '%s' - exiting", wpa_s->confname);
- 		return -1;
- 	}
- 	if (wpa_s->confanother &&
--	    !wpa_config_read(wpa_s->confanother, conf)) {
-+	    !wpa_config_read(wpa_s->confanother, conf, 1)) {
- 		wpa_msg(wpa_s, MSG_ERROR,
- 			"Failed to parse the configuration file '%s' - exiting",
- 			wpa_s->confanother);
-@@ -5638,7 +5638,7 @@ static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
- #else /* CONFIG_BACKEND_FILE */
- 		wpa_s->confname = os_strdup(iface->confname);
- #endif /* CONFIG_BACKEND_FILE */
--		wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
-+		wpa_s->conf = wpa_config_read(wpa_s->confname, NULL, 0);
- 		if (wpa_s->conf == NULL) {
- 			wpa_printf(MSG_ERROR, "Failed to read or parse "
- 				   "configuration '%s'.", wpa_s->confname);
-@@ -5646,7 +5646,7 @@ static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
- 		}
- 		wpa_s->confanother = os_rel2abs_path(iface->confanother);
- 		if (wpa_s->confanother &&
--		    !wpa_config_read(wpa_s->confanother, wpa_s->conf)) {
-+		    !wpa_config_read(wpa_s->confanother, wpa_s->conf, 1)) {
- 			wpa_printf(MSG_ERROR,
- 				   "Failed to read or parse configuration '%s'.",
- 				   wpa_s->confanother);
--- 
-2.29.2
-
diff --git a/pkgs/os-specific/linux/wpa_supplicant/Use-unique-IDs-for-networks-and-credentials.patch b/pkgs/os-specific/linux/wpa_supplicant/Use-unique-IDs-for-networks-and-credentials.patch
deleted file mode 100644
index 09e5b3673ac48..0000000000000
--- a/pkgs/os-specific/linux/wpa_supplicant/Use-unique-IDs-for-networks-and-credentials.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-The id and cred_id variables are reset to 0 every time the
-wpa_config_read function is called, which is fine as long as it is only
-called once. However, this is not the case when using both the -c and -I
-options to specify two config files.
-
-This is a problem because the GUI, since eadfeb0e93748eb396ae62012b92d21a7f533646,
-relies on the network IDs being unique (and increasing), and might get
-into an infinite loop otherwise.
-
-This is solved by simply making the variables static.
----
- wpa_supplicant/config_file.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
-index 6db5010db..c996e3916 100644
---- a/wpa_supplicant/config_file.c
-+++ b/wpa_supplicant/config_file.c
-@@ -297,8 +297,8 @@ struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp)
- 	struct wpa_ssid *ssid, *tail, *head;
- 	struct wpa_cred *cred, *cred_tail, *cred_head;
- 	struct wpa_config *config;
--	int id = 0;
--	int cred_id = 0;
-+	static int id = 0;
-+	static int cred_id = 0;
-
- 	if (name == NULL)
- 		return NULL;
---
-2.34.1
-
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index e63bbd7a3fc0c..f163978b95122 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -3,28 +3,19 @@
 , dbusSupport ? !stdenv.hostPlatform.isStatic, dbus
 , withReadline ? true, readline
 , withPcsclite ? !stdenv.hostPlatform.isStatic, pcsclite
-, readOnlyModeSSIDs ? false
 }:
 
 with lib;
 stdenv.mkDerivation rec {
-  version = "2.10";
+  version = "2.11";
 
   pname = "wpa_supplicant";
 
   src = fetchurl {
     url = "https://w1.fi/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-IN965RVLODA1X4q0JpEjqHr/3qWf50/pKSqR0Nfhey8=";
+    sha256 = "sha256-kS6gb3TjCo42+7aAZNbN/yGNjVkdsPxddd7myBrH/Ao=";
   };
 
-  patches = [
-    # Fix a bug when using two config files
-    ./Use-unique-IDs-for-networks-and-credentials.patch
-  ] ++ lib.optionals readOnlyModeSSIDs [
-    # Allow read-only networks
-    ./0001-Implement-read-only-mode-for-ssids.patch
-  ];
-
   # TODO: Patch epoll so that the dbus actually responds
   # TODO: Figure out how to get privsep working, currently getting SIGBUS
   extraConfig = ''
@@ -49,6 +40,7 @@ stdenv.mkDerivation rec {
     CONFIG_HT_OVERRIDES=y
     CONFIG_IEEE80211AC=y
     CONFIG_IEEE80211AX=y
+    CONFIG_IEEE80211BE=y
     CONFIG_IEEE80211N=y
     CONFIG_IEEE80211R=y
     CONFIG_IEEE80211W=y
diff --git a/pkgs/servers/redpanda/default.nix b/pkgs/servers/redpanda/default.nix
index 307e762881a44..09b8828069c83 100644
--- a/pkgs/servers/redpanda/default.nix
+++ b/pkgs/servers/redpanda/default.nix
@@ -6,12 +6,12 @@
 , stdenv
 }:
 let
-  version = "24.1.10";
+  version = "24.1.13";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-HouhxCy0eQx4A4TF1id8XA7JEzDwzLfYre6MxufCeBM=";
+    sha256 = "sha256-7XDtQYuAVo3WvL59KHrROYlRH68/tAAU/7IGwtTS/+Q=";
   };
 in
 buildGoModule rec {
diff --git a/pkgs/test/cc-wrapper/hardening.nix b/pkgs/test/cc-wrapper/hardening.nix
index 41ddaefdfea8d..270e9a2e87616 100644
--- a/pkgs/test/cc-wrapper/hardening.nix
+++ b/pkgs/test/cc-wrapper/hardening.nix
@@ -3,6 +3,7 @@
 , runCommand
 , runCommandWith
 , runCommandCC
+, hello
 , debian-devscripts
 }:
 
@@ -18,6 +19,7 @@ let
       allowSubstitutes = false;
     } // env;
   } ''
+    [ -n "$postConfigure" ] && eval "$postConfigure"
     [ -n "$preBuild" ] && eval "$preBuild"
     n=$out/bin/test-bin
     mkdir -p "$(dirname "$n")"
@@ -29,10 +31,32 @@ let
   f2exampleWithStdEnv = writeCBinWithStdenv ./fortify2-example.c;
   f3exampleWithStdEnv = writeCBinWithStdenv ./fortify3-example.c;
 
+  # for when we need a slightly more complicated program
+  helloWithStdEnv = stdenv': env: (hello.override { stdenv = stdenv'; }).overrideAttrs ({
+    preBuild = ''
+      export CFLAGS="$TEST_EXTRA_FLAGS"
+    '';
+    NIX_DEBUG = "1";
+    postFixup = ''
+      cp $out/bin/hello $out/bin/test-bin
+    '';
+  } // env);
+
   stdenvUnsupport = additionalUnsupported: stdenv.override {
     cc = stdenv.cc.override {
-      cc = (lib.extendDerivation true {
-        hardeningUnsupportedFlags = (stdenv.cc.cc.hardeningUnsupportedFlags or []) ++ additionalUnsupported;
+      cc = (lib.extendDerivation true rec {
+        # this is ugly - have to cross-reference from
+        # hardeningUnsupportedFlagsByTargetPlatform to hardeningUnsupportedFlags
+        # because the finalAttrs mechanism that hardeningUnsupportedFlagsByTargetPlatform
+        # implementations use to do this won't work with lib.extendDerivation.
+        # but it's simplified by the fact that targetPlatform is already fixed
+        # at this point.
+        hardeningUnsupportedFlagsByTargetPlatform = _: hardeningUnsupportedFlags;
+        hardeningUnsupportedFlags = (
+          if stdenv.cc.cc ? hardeningUnsupportedFlagsByTargetPlatform
+          then stdenv.cc.cc.hardeningUnsupportedFlagsByTargetPlatform stdenv.targetPlatform
+          else (stdenv.cc.cc.hardeningUnsupportedFlags or [])
+        ) ++ additionalUnsupported;
       } stdenv.cc.cc);
     };
     allowedRequisites = null;
@@ -45,24 +69,39 @@ let
     ignorePie ? true,
     ignoreRelRO ? true,
     ignoreStackProtector ? true,
+    ignoreStackClashProtection ? true,
     expectFailure ? false,
   }: let
+    stackClashStr = "Stack clash protection: yes";
     expectFailureClause = lib.optionalString expectFailure
-      " && echo 'ERROR: Expected hardening-check to fail, but it passed!' >&2 && exit 1";
+      " && echo 'ERROR: Expected hardening-check to fail, but it passed!' >&2 && false";
   in runCommandCC "check-test-bin" {
     nativeBuildInputs = [ debian-devscripts ];
     buildInputs = [ testBin ];
-    meta.platforms = lib.platforms.linux;  # ELF-reliant
-  } ''
-    hardening-check --nocfprotection \
-      ${lib.optionalString ignoreBindNow "--nobindnow"} \
-      ${lib.optionalString ignoreFortify "--nofortify"} \
-      ${lib.optionalString ignorePie "--nopie"} \
-      ${lib.optionalString ignoreRelRO "--norelro"} \
-      ${lib.optionalString ignoreStackProtector "--nostackprotector"} \
-      $(PATH=$HOST_PATH type -P test-bin) ${expectFailureClause}
-    touch $out
-  '';
+    meta.platforms = if ignoreStackClashProtection
+      then lib.platforms.linux  # ELF-reliant
+      else [ "x86_64-linux" ];  # stackclashprotection test looks for x86-specific instructions
+  } (''
+    if ${lib.optionalString (!expectFailure) "!"} {
+      hardening-check --nocfprotection \
+        ${lib.optionalString ignoreBindNow "--nobindnow"} \
+        ${lib.optionalString ignoreFortify "--nofortify"} \
+        ${lib.optionalString ignorePie "--nopie"} \
+        ${lib.optionalString ignoreRelRO "--norelro"} \
+        ${lib.optionalString ignoreStackProtector "--nostackprotector"} \
+        $(PATH=$HOST_PATH type -P test-bin) | tee $out
+  '' + lib.optionalString (!ignoreStackClashProtection) ''
+      # stack clash protection doesn't actually affect the exit code of
+      # hardening-check (likely authors think false negatives too common)
+      { grep -F '${stackClashStr}' $out || { echo "Didn't find '${stackClashStr}' in output" && false ;} ;}
+  '' + ''
+    } ; then
+  '' + lib.optionalString expectFailure ''
+      echo 'ERROR: Expected hardening-check to fail, but it passed!' >&2
+  '' + ''
+      exit 2
+    fi
+  '');
 
   nameDrvAfterAttrName = builtins.mapAttrs (name: drv:
     drv.overrideAttrs (_: { name = "test-${name}"; })
@@ -151,6 +190,13 @@ in nameDrvAfterAttrName ({
     ignoreStackProtector = false;
   });
 
+  # protection patterns generated by clang not detectable?
+  stackClashProtectionExplicitEnabled = brokenIf stdenv.cc.isClang (checkTestBin (helloWithStdEnv stdenv {
+    hardeningEnable = [ "stackclashprotection" ];
+  }) {
+    ignoreStackClashProtection = false;
+  });
+
   bindNowExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv {
     hardeningDisable = [ "bindnow" ];
   }) {
@@ -211,12 +257,19 @@ in nameDrvAfterAttrName ({
     expectFailure = true;
   };
 
+  stackClashProtectionExplicitDisabled = checkTestBin (helloWithStdEnv stdenv {
+    hardeningDisable = [ "stackclashprotection" ];
+  }) {
+    ignoreStackClashProtection = false;
+    expectFailure = true;
+  };
+
   # most flags can't be "unsupported" by compiler alone and
   # binutils doesn't have an accessible hardeningUnsupportedFlags
   # mechanism, so can only test a couple of flags through altered
   # stdenv trickery
 
-  fortifyStdenvUnsupp = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["fortify"]) {
+  fortifyStdenvUnsupp = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["fortify" "fortify3"]) {
     hardeningEnable = [ "fortify" ];
   }) {
     ignoreFortify = false;
@@ -237,13 +290,14 @@ in nameDrvAfterAttrName ({
     expectFailure = true;
   };
 
-  fortify3StdenvUnsuppDoesntUnsuppFortify = brokenIf stdenv.hostPlatform.isMusl (checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["fortify3"]) {
+  # musl implementation undetectable by this means even if present
+  fortify3StdenvUnsuppDoesntUnsuppFortify1 = brokenIf stdenv.hostPlatform.isMusl (checkTestBin (f1exampleWithStdEnv (stdenvUnsupport ["fortify3"]) {
     hardeningEnable = [ "fortify" ];
   }) {
     ignoreFortify = false;
   });
 
-  fortify3StdenvUnsuppDoesntUnsuppFortifyExecTest = fortifyExecTest (f2exampleWithStdEnv (stdenvUnsupport ["fortify3"]) {
+  fortify3StdenvUnsuppDoesntUnsuppFortify1ExecTest = fortifyExecTest (f1exampleWithStdEnv (stdenvUnsupport ["fortify3"]) {
     hardeningEnable = [ "fortify" ];
   });
 
@@ -254,12 +308,19 @@ in nameDrvAfterAttrName ({
     expectFailure = true;
   };
 
+  stackClashProtectionStdenvUnsupp = checkTestBin (helloWithStdEnv (stdenvUnsupport ["stackclashprotection"]) {
+    hardeningEnable = [ "stackclashprotection" ];
+  }) {
+    ignoreStackClashProtection = false;
+    expectFailure = true;
+  };
+
   # NIX_HARDENING_ENABLE set in the shell overrides hardeningDisable
   # and hardeningEnable
 
   stackProtectorReenabledEnv = checkTestBin (f2exampleWithStdEnv stdenv {
     hardeningDisable = [ "stackprotector" ];
-    preBuild = ''
+    postConfigure = ''
       export NIX_HARDENING_ENABLE="stackprotector"
     '';
   }) {
@@ -268,7 +329,7 @@ in nameDrvAfterAttrName ({
 
   stackProtectorReenabledFromAllEnv = checkTestBin (f2exampleWithStdEnv stdenv {
     hardeningDisable = [ "all" ];
-    preBuild = ''
+    postConfigure = ''
       export NIX_HARDENING_ENABLE="stackprotector"
     '';
   }) {
@@ -277,7 +338,7 @@ in nameDrvAfterAttrName ({
 
   stackProtectorRedisabledEnv = checkTestBin (f2exampleWithStdEnv stdenv {
     hardeningEnable = [ "stackprotector" ];
-    preBuild = ''
+    postConfigure = ''
       export NIX_HARDENING_ENABLE=""
     '';
   }) {
@@ -285,25 +346,26 @@ in nameDrvAfterAttrName ({
     expectFailure = true;
   };
 
-  fortify3EnabledEnvEnablesFortify = brokenIf stdenv.hostPlatform.isMusl (checkTestBin (f2exampleWithStdEnv stdenv {
+  # musl implementation undetectable by this means even if present
+  fortify3EnabledEnvEnablesFortify1 = brokenIf stdenv.hostPlatform.isMusl (checkTestBin (f1exampleWithStdEnv stdenv {
     hardeningDisable = [ "fortify" "fortify3" ];
-    preBuild = ''
+    postConfigure = ''
       export NIX_HARDENING_ENABLE="fortify3"
     '';
   }) {
     ignoreFortify = false;
   });
 
-  fortify3EnabledEnvEnablesFortifyExecTest = fortifyExecTest (f2exampleWithStdEnv stdenv {
+  fortify3EnabledEnvEnablesFortify1ExecTest = fortifyExecTest (f1exampleWithStdEnv stdenv {
     hardeningDisable = [ "fortify" "fortify3" ];
-    preBuild = ''
+    postConfigure = ''
       export NIX_HARDENING_ENABLE="fortify3"
     '';
   });
 
   fortifyEnabledEnvDoesntEnableFortify3 = checkTestBin (f3exampleWithStdEnv stdenv {
     hardeningDisable = [ "fortify" "fortify3" ];
-    preBuild = ''
+    postConfigure = ''
       export NIX_HARDENING_ENABLE="fortify"
     '';
   }) {
@@ -312,9 +374,8 @@ in nameDrvAfterAttrName ({
   };
 
   # NIX_HARDENING_ENABLE can't enable an unsupported feature
-
   stackProtectorUnsupportedEnabledEnv = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["stackprotector"]) {
-    preBuild = ''
+    postConfigure = ''
       export NIX_HARDENING_ENABLE="stackprotector"
     '';
   }) {
@@ -322,23 +383,29 @@ in nameDrvAfterAttrName ({
     expectFailure = true;
   };
 
+  # current implementation prevents the command-line from disabling
+  # fortify if cc-wrapper is enabling it.
+
   # undetectable by this means on static even if present
   fortify1ExplicitEnabledCmdlineDisabled = brokenIf stdenv.hostPlatform.isStatic (checkTestBin (f1exampleWithStdEnv stdenv {
     hardeningEnable = [ "fortify" ];
-    preBuild = ''
+    postConfigure = ''
       export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=0'
     '';
   }) {
     ignoreFortify = false;
-    expectFailure = true;
+    expectFailure = false;
   });
 
+  # current implementation doesn't force-disable fortify if
+  # command-line enables it even if we use hardeningDisable.
+
   # musl implementation undetectable by this means even if present
   fortify1ExplicitDisabledCmdlineEnabled = brokenIf (
     stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isStatic
   ) (checkTestBin (f1exampleWithStdEnv stdenv {
     hardeningDisable = [ "fortify" ];
-    preBuild = ''
+    postConfigure = ''
       export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=1'
     '';
   }) {
@@ -347,14 +414,14 @@ in nameDrvAfterAttrName ({
 
   fortify1ExplicitDisabledCmdlineEnabledExecTest = fortifyExecTest (f1exampleWithStdEnv stdenv {
     hardeningDisable = [ "fortify" ];
-    preBuild = ''
+    postConfigure = ''
       export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=1'
     '';
   });
 
   fortify1ExplicitEnabledCmdlineDisabledNoWarn = f1exampleWithStdEnv stdenv {
     hardeningEnable = [ "fortify" ];
-    preBuild = ''
+    postConfigure = ''
       export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=0 -Werror'
     '';
   };
@@ -393,4 +460,9 @@ in {
     ignoreStackProtector = false;
     expectFailure = true;
   };
+
+  allExplicitDisabledStackClashProtection = checkTestBin tb {
+    ignoreStackClashProtection = false;
+    expectFailure = true;
+  };
 }))
diff --git a/pkgs/tools/backup/restic/default.nix b/pkgs/tools/backup/restic/default.nix
index 198a5dda05932..5f802f4879036 100644
--- a/pkgs/tools/backup/restic/default.nix
+++ b/pkgs/tools/backup/restic/default.nix
@@ -1,15 +1,15 @@
 { stdenv, lib, buildGoModule, fetchFromGitHub, installShellFiles, makeWrapper
-, nixosTests, rclone }:
+, nixosTests, rclone, python3 }:
 
 buildGoModule rec {
   pname = "restic";
-  version = "0.16.5";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "restic";
     repo = "restic";
     rev = "v${version}";
-    hash = "sha256-WwySXQU8eoyQRcI+zF+pIIKLEFheTnqkPTw0IZeUrhA=";
+    hash = "sha256-fd67ZehmgHHd+R/V4hJCREWoY3lFKSTfvbLRgJ0PSAM=";
   };
 
   patches = [
@@ -17,12 +17,14 @@ buildGoModule rec {
     ./0001-Skip-testing-restore-with-permission-failure.patch
   ];
 
-  vendorHash = "sha256-VZTX0LPZkqN4+OaaIkwepbGwPtud8Cu7Uq7t1bAUC8M=";
+  vendorHash = "sha256-tU2msDHktlU0SvvxLQCU64p8DpL8B0QiliVCuHlLTHQ=";
 
   subPackages = [ "cmd/restic" ];
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
+  nativeCheckInputs = [ python3 ];
+
   passthru.tests.restic = nixosTests.restic;
 
   postPatch = ''
diff --git a/pkgs/tools/compression/bsc/default.nix b/pkgs/tools/compression/bsc/default.nix
deleted file mode 100644
index 7d2af1c4898fe..0000000000000
--- a/pkgs/tools/compression/bsc/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, openmp }:
-
-stdenv.mkDerivation rec {
-  pname = "bsc";
-  version = "3.1.0";
-
-  src = fetchFromGitHub {
-    owner = "IlyaGrebnov";
-    repo = "libbsc";
-    rev = version;
-    sha256 = "0c0jmirh9y23kyi1jnrm13sa3xsjn54jazfr84ag45pai279fciz";
-  };
-
-  enableParallelBuilding = true;
-
-  buildInputs = lib.optional stdenv.isDarwin openmp;
-
-  postPatch = ''
-    substituteInPlace makefile \
-        --replace 'g++' '$(CXX)'
-  '';
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  meta = with lib; {
-    description = "High performance block-sorting data compression library";
-    homepage = "http://libbsc.com/";
-    maintainers = with maintainers; [ ];
-    # Later commits changed the licence to Apache2 (no release yet, though)
-    license = with licenses; [ lgpl3Plus ];
-    platforms = platforms.unix;
-    mainProgram = "bsc";
-  };
-}
diff --git a/pkgs/tools/nix/nix-output-monitor/generated-package.nix b/pkgs/tools/nix/nix-output-monitor/generated-package.nix
index 35b1f473cb2d9..4e76a5194107d 100644
--- a/pkgs/tools/nix/nix-output-monitor/generated-package.nix
+++ b/pkgs/tools/nix/nix-output-monitor/generated-package.nix
@@ -9,10 +9,10 @@
 }:
 mkDerivation {
   pname = "nix-output-monitor";
-  version = "2.1.2";
+  version = "2.1.3";
   src = fetchzip {
-    url = "https://code.maralorn.de/maralorn/nix-output-monitor/archive/v2.1.2.tar.gz";
-    sha256 = "192h67myibpc2bw5ng60qi4m9jyjd9cf14aba4ps44ayjw95wkc0";
+    url = "https://code.maralorn.de/maralorn/nix-output-monitor/archive/v2.1.3.tar.gz";
+    sha256 = "1xm40pp9lqj2hlwk3ds9zyjd4yqsis2a2ac5kn19z60glxvaijvx";
   };
   isLibrary = true;
   isExecutable = true;
diff --git a/pkgs/tools/text/markdownlint-cli2/default.nix b/pkgs/tools/text/markdownlint-cli2/default.nix
index 90a4b871cbc19..d98d3a9f29c6d 100644
--- a/pkgs/tools/text/markdownlint-cli2/default.nix
+++ b/pkgs/tools/text/markdownlint-cli2/default.nix
@@ -52,5 +52,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://github.com/DavidAnson/markdownlint-cli2";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ natsukium ];
+    mainProgram = "markdownlint-cli2";
   };
 })
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c10305494b1d5..35d8138fdfa41 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1520,6 +1520,7 @@ mapAliases ({
   wordpress6_1 = throw "'wordpress6_1' has been removed in favor of the latest version"; # Added 2023-10-10
   wordpress6_2 = throw "'wordpress6_2' has been removed in favor of the latest version"; # Added 2023-10-10
   wormhole-rs = magic-wormhole-rs; # Added 2022-05-30. preserve, reason: Arch package name, main binary name
+  wpa_supplicant_ro_ssids = lib.trivial.warn "Deprecated package: Please use wpa_supplicant instead. Read-only SSID patches are now upstream!" wpa_supplicant;
   wrapLisp_old = throw "Lisp packages have been redesigned. See 'lisp-modules' in the nixpkgs manual."; # Added 2024-05-07
   wmii_hg = wmii;
   wrapGAppsHook = wrapGAppsHook3; # Added 2024-03-26
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9f489cfc5aae6..894e0644189e2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6413,10 +6413,6 @@ with pkgs;
 
   boltbrowser = callPackage ../tools/misc/boltbrowser { };
 
-  bsc = callPackage ../tools/compression/bsc {
-    inherit (llvmPackages) openmp;
-  };
-
   bzip2 = callPackage ../tools/compression/bzip2 { };
 
   bzip2_1_1 = callPackage ../tools/compression/bzip2/1_1.nix { };
@@ -27726,10 +27722,6 @@ with pkgs;
 
   wpa_supplicant = callPackage ../os-specific/linux/wpa_supplicant { };
 
-  wpa_supplicant_ro_ssids = wpa_supplicant.override {
-    readOnlyModeSSIDs = true;
-  };
-
   wpa_supplicant_gui = libsForQt5.callPackage ../os-specific/linux/wpa_supplicant/gui.nix { };
 
   xf86_input_cmt = callPackage ../os-specific/linux/xf86-input-cmt { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 27e6ce4063ce3..43d0cf17b055f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7242,6 +7242,8 @@ self: super: with self; {
 
   losant-rest = callPackage ../development/python-modules/losant-rest { };
 
+  lottie = callPackage ../development/python-modules/lottie { };
+
   lpc-checksum = callPackage ../development/python-modules/lpc-checksum { };
 
   lrcalc-python = callPackage ../development/python-modules/lrcalc-python { };
@@ -9164,6 +9166,8 @@ self: super: with self; {
 
   ntplib = callPackage ../development/python-modules/ntplib { };
 
+  nuclear = callPackage ../development/python-modules/nuclear { };
+
   nuitka = callPackage ../development/python-modules/nuitka { };
 
   nuheat = callPackage ../development/python-modules/nuheat { };
@@ -17192,6 +17196,8 @@ self: super: with self; {
   wasmerPackages = pkgs.recurseIntoAttrs (callPackage ../development/python-modules/wasmer { });
   inherit (self.wasmerPackages) wasmer wasmer-compiler-cranelift wasmer-compiler-llvm wasmer-compiler-singlepass;
 
+  wat = callPackage ../development/python-modules/wat { };
+
   watchdog = callPackage ../development/python-modules/watchdog {
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };