diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a4add8d477b2..885ead4a432b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16957,6 +16957,12 @@
     githubId = 22085373;
     name = "Luis Hebendanz";
   };
+  qubitnano = {
+    name = "qubitnano";
+    email = "qubitnano@protonmail.com";
+    github = "qubitnano";
+    githubId = 146656568;
+  };
   queezle = {
     email = "git@queezle.net";
     github = "queezle42";
@@ -22781,6 +22787,11 @@
     githubId = 40352765;
     name = "Yoctocell";
   };
+  yomaq = {
+    name = "yomaq";
+    github = "yomaq";
+    githubId = 112864332;
+  };
   yorickvp = {
     email = "yorickvanpelt@gmail.com";
     matrix = "@yorickvp:matrix.org";
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index f866bbe17643..71f792a7a4e6 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -206,6 +206,19 @@ in
         option is supported is used
       '';
 
+      prime.reverseSync.setupCommands.enable =
+        (lib.mkEnableOption ''
+          configure the display manager to be able to use the outputs
+          attached to the NVIDIA GPU.
+          Disable in order to configure the NVIDIA GPU outputs manually using xrandr.
+          Note that this configuration will only be successful when a display manager
+          for which the {option}`services.xserver.displayManager.setupCommands`
+          option is supported is used
+        '')
+        // {
+          default = true;
+        };
+
       nvidiaSettings =
         (lib.mkEnableOption ''
           nvidia-settings, NVIDIA's GUI configuration tool
@@ -437,11 +450,13 @@ in
               providerCmdParams =
                 if syncCfg.enable then "\"${gpuProviderName}\" NVIDIA-0" else "NVIDIA-G0 \"${gpuProviderName}\"";
             in
-            lib.optionalString (syncCfg.enable || reverseSyncCfg.enable) ''
-              # Added by nvidia configuration module for Optimus/PRIME.
-              ${lib.getExe pkgs.xorg.xrandr} --setprovideroutputsource ${providerCmdParams}
-              ${lib.getExe pkgs.xorg.xrandr} --auto
-            '';
+            lib.optionalString
+              (syncCfg.enable || (reverseSyncCfg.enable && reverseSyncCfg.setupCommands.enable))
+              ''
+                # Added by nvidia configuration module for Optimus/PRIME.
+                ${lib.getExe pkgs.xorg.xrandr} --setprovideroutputsource ${providerCmdParams}
+                ${lib.getExe pkgs.xorg.xrandr} --auto
+              '';
 
           environment.etc = {
             "nvidia/nvidia-application-profiles-rc" = lib.mkIf nvidia_x11.useProfiles {
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 745dae2ef724..0d4954e7ec05 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -835,6 +835,7 @@
   ./services/misc/zoneminder.nix
   ./services/misc/zookeeper.nix
   ./services/monitoring/alerta.nix
+  ./services/monitoring/alloy.nix
   ./services/monitoring/apcupsd.nix
   ./services/monitoring/arbtt.nix
   ./services/monitoring/below.nix
diff --git a/nixos/modules/services/desktops/espanso.nix b/nixos/modules/services/desktops/espanso.nix
index a9b15b265945..a6b8a078247b 100644
--- a/nixos/modules/services/desktops/espanso.nix
+++ b/nixos/modules/services/desktops/espanso.nix
@@ -15,7 +15,6 @@ in {
   };
 
   config = mkIf cfg.enable {
-    services.espanso.package = mkIf cfg.wayland pkgs.espanso-wayland;
     systemd.user.services.espanso = {
       description = "Espanso daemon";
       serviceConfig = {
diff --git a/nixos/modules/services/logging/journalwatch.nix b/nixos/modules/services/logging/journalwatch.nix
index 71b29d57b7eb..48fd992ffb65 100644
--- a/nixos/modules/services/logging/journalwatch.nix
+++ b/nixos/modules/services/logging/journalwatch.nix
@@ -56,6 +56,8 @@ in {
         '';
       };
 
+      package = mkPackageOption pkgs "journalwatch" { };
+
       priority = mkOption {
         type = types.int;
         default = 6;
@@ -240,7 +242,7 @@ in {
         # requires a relative directory name to create beneath /var/lib
         StateDirectory = user;
         StateDirectoryMode = "0750";
-        ExecStart = "${pkgs.python3Packages.journalwatch}/bin/journalwatch mail";
+        ExecStart = "${getExe cfg.package} mail";
         # lowest CPU and IO priority, but both still in best-effort class to prevent starvation
         Nice=19;
         IOSchedulingPriority=7;
diff --git a/nixos/modules/services/monitoring/alloy.nix b/nixos/modules/services/monitoring/alloy.nix
new file mode 100644
index 000000000000..abe8fcd7e1be
--- /dev/null
+++ b/nixos/modules/services/monitoring/alloy.nix
@@ -0,0 +1,80 @@
+{ lib, pkgs, config, ... }:
+with lib;
+let
+  cfg = config.services.alloy;
+in
+{
+  meta = {
+    maintainers = with maintainers; [ flokli hbjydev ];
+  };
+
+  options.services.alloy = {
+    enable = mkEnableOption "Grafana Alloy";
+
+    package = mkPackageOption pkgs "grafana-alloy" { };
+
+    configPath = mkOption {
+      type = lib.types.path;
+      default = "/etc/alloy";
+      description = ''
+        Alloy configuration file/directory path.
+
+        We default to `/etc/alloy` here, and expect the user to configure a
+        configuration file via `environment.etc."alloy/config.alloy"`.
+
+        This allows config reload, contrary to specifying a store path.
+        A `reloadTrigger` for `config.alloy` is configured.
+
+        Other `*.alloy` files in the same directory (ignoring subdirs) are also
+        honored, but it's necessary to manually extend
+        `systemd.services.alloy.reloadTriggers` to enable config reload
+        during nixos-rebuild switch.
+
+        This can also point to another directory containing `*.alloy` files, or
+        a single Alloy file in the Nix store (at the cost of reload).
+
+        Component names must be unique across all Alloy configuration files, and
+        configuration blocks must not be repeated.
+
+        Alloy will continue to run if subsequent reloads of the configuration
+        file fail, potentially marking components as unhealthy depending on
+        the nature of the failure. When this happens, Alloy will continue
+        functioning in the last valid state.
+      '';
+    };
+
+    extraFlags = mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+      example = [ "--server.http.listen-addr=127.0.0.1:12346" "--disable-reporting" ];
+      description = ''
+        Extra command-line flags passed to {command}`alloy run`.
+
+        See <https://grafana.com/docs/alloy/latest/reference/cli/run/>
+      '';
+    };
+  };
+
+
+  config = mkIf cfg.enable {
+    systemd.services.alloy = {
+      wantedBy = [ "multi-user.target" ];
+      reloadTriggers = [ config.environment.etc."alloy/config.alloy".source or null ];
+      serviceConfig = {
+        Restart = "always";
+        DynamicUser = true;
+        RestartSec = 2;
+        SupplementaryGroups = [
+          # allow to read the systemd journal for loki log forwarding
+          "systemd-journal"
+        ];
+        ExecStart = "${lib.getExe cfg.package} run ${cfg.configPath} ${escapeShellArgs cfg.extraFlags}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
+        ConfigurationDirectory = "alloy";
+        StateDirectory = "alloy";
+        WorkingDirectory = "%S/alloy";
+        Type = "simple";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/tailscale.nix b/nixos/modules/services/networking/tailscale.nix
index a79e47d8491b..a690dc610e82 100644
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@@ -61,12 +61,21 @@ in {
     };
 
     extraUpFlags = mkOption {
-      description = "Extra flags to pass to {command}`tailscale up`.";
+      description = ''
+        Extra flags to pass to {command}`tailscale up`. Only applied if `authKeyFile` is specified.";
+      '';
       type = types.listOf types.str;
       default = [];
       example = ["--ssh"];
     };
 
+    extraSetFlags = mkOption {
+      description = "Extra flags to pass to {command}`tailscale set`.";
+      type = types.listOf types.str;
+      default = [];
+      example = ["--advertise-exit-node"];
+    };
+
     extraDaemonFlags = mkOption {
       description = "Extra flags to pass to {command}`tailscaled`.";
       type = types.listOf types.str;
@@ -120,6 +129,18 @@ in {
       '';
     };
 
+    systemd.services.tailscaled-set = mkIf (cfg.extraSetFlags != []) {
+      after = ["tailscaled.service"];
+      wants = ["tailscaled.service"];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+      };
+      script = ''
+        ${cfg.package}/bin/tailscale set ${escapeShellArgs cfg.extraSetFlags}
+      '';
+    };
+
     boot.kernel.sysctl = mkIf (cfg.useRoutingFeatures == "server" || cfg.useRoutingFeatures == "both") {
       "net.ipv4.conf.all.forwarding" = mkOverride 97 true;
       "net.ipv6.conf.all.forwarding" = mkOverride 97 true;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index ddeeeb298c35..f9e0c6d1fefc 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -115,6 +115,7 @@ in {
   akkoma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix {};
   akkoma-confined = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix { confined = true; };
   alice-lg = handleTest ./alice-lg.nix {};
+  alloy = handleTest ./alloy.nix {};
   allTerminfo = handleTest ./all-terminfo.nix {};
   alps = handleTest ./alps.nix {};
   amazon-init-shell = handleTest ./amazon-init-shell.nix {};
diff --git a/nixos/tests/alloy.nix b/nixos/tests/alloy.nix
new file mode 100644
index 000000000000..d87492127d5b
--- /dev/null
+++ b/nixos/tests/alloy.nix
@@ -0,0 +1,32 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+
+  let
+    nodes = {
+      machine = {
+        services.alloy = {
+          enable = true;
+        };
+        environment.etc."alloy/config.alloy".text = "";
+      };
+    };
+  in
+  {
+    name = "alloy";
+
+    meta = with lib.maintainers; {
+      maintainers = [ flokli hbjydev ];
+    };
+
+    inherit nodes;
+
+    testScript = ''
+      start_all()
+
+      machine.wait_for_unit("alloy.service")
+      machine.wait_for_open_port(12345)
+      machine.succeed(
+          "curl -sSfN http://127.0.0.1:12345/-/healthy"
+      )
+      machine.shutdown()
+    '';
+  })
diff --git a/pkgs/applications/audio/g4music/default.nix b/pkgs/applications/audio/g4music/default.nix
index d304adc19ed7..da7e7777af5f 100644
--- a/pkgs/applications/audio/g4music/default.nix
+++ b/pkgs/applications/audio/g4music/default.nix
@@ -15,14 +15,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "g4music";
-  version = "3.6";
+  version = "3.6.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "neithern";
     repo = "g4music";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RDz3QwjbzYS4JllxpSA59cs2S3dNTmNcOoxu4JFC8oM=";
+    hash = "sha256-yNKDTcLunTLhAtOBrjuycw0rrdCSwmhhVyBg3AfMUCQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
index 95add3849b9d..386076cbd7d7 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
@@ -16,7 +16,7 @@
 }:
 
 let
-  rev = "f48de0896d3af80f5e15aef512b7485eb46df9f6";
+  rev = "e5cf0b704274d3deae8f4a3b6a3d0664a176bc8b";
   python = python3.withPackages (ps: with ps; [
     epc
     orjson
@@ -28,13 +28,13 @@ let
 in
 melpaBuild {
   pname = "lsp-bridge";
-  version = "20240601.1149";
+  version = "20240609.1553";
 
   src = fetchFromGitHub {
     owner = "manateelazycat";
     repo = "lsp-bridge";
     inherit rev;
-    hash = "sha256-ocKNRSt5RVKGnxd0odI43jdr27oYrRLdnABh6x63CfM=";
+    hash = "sha256-96GgMJPLFoabhlvjTMWKtEpGuctjlcRuChvzDziaq8g=";
   };
 
   commit = rev;
diff --git a/pkgs/applications/emulators/retroarch/hashes.json b/pkgs/applications/emulators/retroarch/hashes.json
index 6737bef671a3..6c5269fb53c8 100644
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -85,10 +85,10 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-psx-libretro",
-            "rev": "f7d733b935be185da633be660c73d8f91d6c6883",
-            "hash": "sha256-hX56CqsWkxNlaSzOtaemIWEO0Ov9InmcLmRUJjtn4FQ="
+            "rev": "b8e10a3039391db6e4fbdc96720d3428a2dbd039",
+            "hash": "sha256-F38lUBhe9JR3dPwkLqhAAlvLtAeas8bnPuiK6eOpUuU="
         },
-        "version": "unstable-2024-05-24"
+        "version": "unstable-2024-06-07"
     },
     "beetle-saturn": {
         "fetcher": "fetchFromGitHub",
@@ -115,10 +115,10 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-supergrafx-libretro",
-            "rev": "c96c05c0b6e948df00da7e6253ff3e2874314baa",
-            "hash": "sha256-ruxp66E7D+r/9h7lzggIy9q9DKWKJikVzL5Oqsy9kQM="
+            "rev": "e3f68c1311d4684a5a59d3d1662d5c4f32662c02",
+            "hash": "sha256-jTO2SDOefpB+cfahiPkReYID0pjP437h53hZElSLsdY="
         },
-        "version": "unstable-2024-05-17"
+        "version": "unstable-2024-06-07"
     },
     "beetle-vb": {
         "fetcher": "fetchFromGitHub",
@@ -297,21 +297,21 @@
         "src": {
             "owner": "libretro",
             "repo": "libretro-fceumm",
-            "rev": "c970bcc2b527f2c9d072e3ad2a5e3b4143246e25",
-            "hash": "sha256-EOtUExsYIXyuX2bTzs9Ia0i9aIMdXVByhZ+S0bSPfJw="
+            "rev": "bc9d865f9427384e40084cb090d94d72d4970e78",
+            "hash": "sha256-/g7gRNWDbW5LFZ+uBkIf5DMELas0/ilqbmUbvq8YSsE="
         },
-        "version": "unstable-2024-05-29"
+        "version": "unstable-2024-06-09"
     },
     "flycast": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "flyinghead",
             "repo": "flycast",
-            "rev": "021249c321826ecb6b0a0ed6e5d2af9044e973a3",
-            "hash": "sha256-/S/43/fKZrUjZTSq51NY3OU3oDpyoqNbHB2QGzqBOuk=",
+            "rev": "4cd62781043cd9193c6c5ec04f6a8084375bed0d",
+            "hash": "sha256-EKK9PNFHWm1Jakq0E6fIqmcDiiiOSgHEbixB3X/H77g=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-06-02"
+        "version": "unstable-2024-06-08"
     },
     "fmsx": {
         "fetcher": "fetchFromGitHub",
@@ -348,20 +348,20 @@
         "src": {
             "owner": "libretro",
             "repo": "gambatte-libretro",
-            "rev": "f0d83f0eff4ad91471f90acd098d078eea0a67b3",
-            "hash": "sha256-zcqFVPotOu5gDwzgWzn0lpzhcTwQUm81UpA5FtCrz1M="
+            "rev": "e2031a4010463adcd00ce3f34acbbb6db2ad1266",
+            "hash": "sha256-yFj9ZkvDliaTO43l0fjg8FwD17MxjV4wszY7AVjTiNY="
         },
-        "version": "unstable-2024-06-02"
+        "version": "unstable-2024-06-07"
     },
     "genesis-plus-gx": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "Genesis-Plus-GX",
-            "rev": "d2f1241b8665b525f95506afb5f079167f2b1ab6",
-            "hash": "sha256-DtnPtXYdxQ5XB6Og+XYpN1uRHJR3B1EpVsdCN3V8YZg="
+            "rev": "60955a01f601ef73c02b07581dd7d5aa3b6a4788",
+            "hash": "sha256-h0T6i1kiN58TagFo5XHzXMLaEwkGGTyuZpyS1QGNrb8="
         },
-        "version": "unstable-2024-05-25"
+        "version": "unstable-2024-06-07"
     },
     "gpsp": {
         "fetcher": "fetchFromGitHub",
@@ -429,20 +429,20 @@
         "src": {
             "owner": "libretro",
             "repo": "mame2003-libretro",
-            "rev": "9ed9b3bdf4439d222b2b1a8c89e01fa3a6d2cc51",
-            "hash": "sha256-E6/NYG+Uw+At2iAziEsl95NOwVSOs2otye+MDl+SQA0="
+            "rev": "ce82eaa30932c988e9d9abc0ac5d6d637fb88cc6",
+            "hash": "sha256-vCqv2EhgYtJwNE2sRcs8KTg0cGlRSmhykRLkt8mUKlg="
         },
-        "version": "unstable-2024-06-01"
+        "version": "unstable-2024-06-07"
     },
     "mame2003-plus": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "mame2003-plus-libretro",
-            "rev": "b37ce123034084fa14709fb0f33c505737b3bfda",
-            "hash": "sha256-vrVuUgkwZDLdFLo+bhJwXEuNWcS9ncQbjOspx6LVqhQ="
+            "rev": "ecd00b18187c7fff75b6d9a70ac1b349e79652bb",
+            "hash": "sha256-1dVNNlDKDJwGHou/bY/grj/p9BJmfUwDxEiw2zQ7gSg="
         },
-        "version": "unstable-2024-05-29"
+        "version": "unstable-2024-06-08"
     },
     "mame2010": {
         "fetcher": "fetchFromGitHub",
@@ -489,10 +489,10 @@
         "src": {
             "owner": "libretro",
             "repo": "mesen",
-            "rev": "d6f2f1797694f87e698c737b068f621889e96fa9",
-            "hash": "sha256-iLX9UvrjYjGjyaLD4sC10gntWUvgZrwiUqTS7S7YDdc="
+            "rev": "91db6be681f70b2080525c267af6132555323ea1",
+            "hash": "sha256-rw/bwHaeglO/DPeOCFHAWF5Y5DXVKiteO4bWZjTB4rI="
         },
-        "version": "unstable-2024-01-30"
+        "version": "unstable-2024-06-09"
     },
     "mesen-s": {
         "fetcher": "fetchFromGitHub",
@@ -652,22 +652,22 @@
         "src": {
             "owner": "jpd002",
             "repo": "Play-",
-            "rev": "18c0a6b17d074c662bebea87684d025636862d64",
-            "hash": "sha256-UOH3f3HkN6ak4AMH7C6E5Lqrj/WF8bqSjv0JTj7HqFU=",
+            "rev": "2f3d8252a2ba398078538abfe8a633b667a858a4",
+            "hash": "sha256-Trr+xJWcWfQW5TnSTxqAsUK3HSMsoLaAkz7UIwp6L4c=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-05-28"
+        "version": "unstable-2024-06-04"
     },
     "ppsspp": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "hrydgard",
             "repo": "ppsspp",
-            "rev": "8600e81c62eaf9ea36c06d9e7d4a8b731947e255",
-            "hash": "sha256-qPmJMtaUzr9pepeIl+bOgOUrxSxy4Khiq3jtXwnIZSI=",
+            "rev": "5dec3ca2db10943dcdf5e483cc8c28e0524d1a43",
+            "hash": "sha256-B9/0uGpBrM+qndvO2BC9sQCNkSK3qR2fUtWx5Vx16xU=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-06-03"
+        "version": "unstable-2024-06-09"
     },
     "prboom": {
         "fetcher": "fetchFromGitHub",
@@ -754,10 +754,10 @@
         "src": {
             "owner": "snes9xgit",
             "repo": "snes9x",
-            "rev": "a277d7f9e88fa377f9cc6f26c1f6008d0499d36e",
-            "hash": "sha256-8fdBgQeZAEyKnBInOeqsaIw20ztn5eeU34+CnoM+xng="
+            "rev": "c7b77d4a763e8fa3ee2c4ef63b3974527056b7ad",
+            "hash": "sha256-a9IKbuSrlzrhrRrLRFAnhHWBhaYIf58oRFYjWSqbNTU="
         },
-        "version": "unstable-2024-05-26"
+        "version": "unstable-2024-06-07"
     },
     "snes9x2002": {
         "fetcher": "fetchFromGitHub",
@@ -794,10 +794,10 @@
         "src": {
             "owner": "stella-emu",
             "repo": "stella",
-            "rev": "49166ca9949708c3bddaed5cc549194c4bfcfae5",
-            "hash": "sha256-Oszglo1BQYTkuSZ96RSIBa1A0v/4qLQSBzsSVmOq07I="
+            "rev": "1c2dceab2b74980effb8d6497ea64fc3bd6b0be3",
+            "hash": "sha256-UeuSHHAZV798sSws32PhcBq9q2bGfX758mR+mIEnX+I="
         },
-        "version": "unstable-2024-05-13"
+        "version": "unstable-2024-06-08"
     },
     "stella2014": {
         "fetcher": "fetchFromGitHub",
diff --git a/pkgs/applications/misc/neo4j-desktop/default.nix b/pkgs/applications/misc/neo4j-desktop/default.nix
index bf38fff01af9..e97acc0d2561 100644
--- a/pkgs/applications/misc/neo4j-desktop/default.nix
+++ b/pkgs/applications/misc/neo4j-desktop/default.nix
@@ -1,11 +1,11 @@
 { appimageTools, lib, fetchurl }:
 let
   pname = "neo4j-desktop";
-  version = "1.5.8";
+  version = "1.5.9";
 
   src = fetchurl {
     url = "https://s3-eu-west-1.amazonaws.com/dist.neo4j.org/${pname}/linux-offline/${pname}-${version}-x86_64.AppImage";
-    hash = "sha256-RqzR4TuvDasbkj/wKvOOS7r46sXDxvw3B5ydFGZeHX8=";
+    hash = "sha256-04I1p5wtndIflHqS5qQVf3s8F9ORJ+oy4wi/5PQbnWk=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/applications/misc/obsidian/default.nix b/pkgs/applications/misc/obsidian/default.nix
index 354399a1ac44..ff7c789a6eb5 100644
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@@ -25,7 +25,7 @@ let
   filename = if stdenv.isDarwin then "Obsidian-${version}-universal.dmg" else "obsidian-${version}.tar.gz";
   src = fetchurl {
     url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
-    hash = if stdenv.isDarwin then "sha256-o5ELpG82mJgcd9Pil6A99BPK6Hoa0OKJJkYpyfGJR9I=" else "sha256-Eq2cUXjp0XdVeR4t3oG2DUtsKOp3e3nPMMhznUc4BmE=";
+    hash = if stdenv.isDarwin then "sha256-o5ELpG82mJgcd9Pil6A99BPK6Hoa0OKJJkYpyfGJR9I=" else "sha256-ho8E2Iq+s/w8NjmxzZo/y5aj3MNgbyvIGjk3nSKPLDw=";
   };
 
   icon = fetchurl {
diff --git a/pkgs/applications/misc/qlcplus/default.nix b/pkgs/applications/misc/qlcplus/default.nix
index 1428ca6014da..806a2fed8943 100644
--- a/pkgs/applications/misc/qlcplus/default.nix
+++ b/pkgs/applications/misc/qlcplus/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "qlcplus";
-  version = "4.13.0";
+  version = "4.13.1";
 
   src = fetchFromGitHub {
     owner = "mcallegari";
     repo = "qlcplus";
     rev = "QLC+_${version}";
-    sha256 = "11av9hg6l0pb1lmlw35v1v2q9mmqz65yfaq01454y5qlmsbxpgkp";
+    sha256 = "sha256-AKmPxHOlMtea3q0NDULp3XfJ0JnYeF/iFUJw0dDOiio=";
   };
 
   nativeBuildInputs = [ qmake pkg-config ];
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 45bd8a0efc3b..4534ceb4313b 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,15 +1,15 @@
 {
-  "packageVersion": "126.0-1",
+  "packageVersion": "126.0.1-1",
   "source": {
-    "rev": "126.0-1",
-    "sha256": "1q8fjki6rgzrir84y7j2anra2w213bm0g74nw205gja9qsxlassc"
+    "rev": "126.0.1-1",
+    "sha256": "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km"
   },
   "settings": {
-    "rev": "e439bde05b2980089b9c8a6f990562dcd9e9ca4a",
-    "sha256": "16fzdpjqz5ih2pjkj698hrqlw4wck4adys4cdfc2kflf6aydk39m"
+    "rev": "1debc2d30949baff2d1e7df23e87900f1987a8ae",
+    "sha256": "12xgjv40mihbyfsah26vvdyb4yirydc1a884v2chnca4f5q00lc2"
   },
   "firefox": {
-    "version": "126.0",
-    "sha512": "56025b051d544ca294911a1d6a66f09945f71012131881b64313dafb579730810a4b091950c90a21d4fd3f393ba23670d8409086e1677d80d0bbbe347c303527"
+    "version": "126.0.1",
+    "sha512": "249605c4891ee9271def187d161369bd3ccbd347f5f0e175d0239aced3cb9ae9655d3c134b7705bda80ea1e63c0a2ee8eb4e76db0840019683376c00f20fc7ac"
   }
 }
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index 7c8ebe80a27a..d5bd6a3e34b9 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -51,11 +51,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "opera";
-  version = "110.0.5130.23";
+  version = "110.0.5130.49";
 
   src = fetchurl {
     url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    hash = "sha256-Y1YmTUvXHOXBB5Mei8lX0DCoEkOmgVCPtT1GnTqNTtA=";
+    hash = "sha256-ge2ne11BrODlvbu17G6xaLd4w2mIEsErtIaqlLY4os8=";
   };
 
   unpackPhase = "dpkg-deb -x $src .";
diff --git a/pkgs/applications/networking/cluster/istioctl/default.nix b/pkgs/applications/networking/cluster/istioctl/default.nix
index 8c80896d6251..a4cba0629e6b 100644
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.22.0";
+  version = "1.22.1";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    hash = "sha256-xiIuCwzERvy7HFx9CZHen1tz1nwsTMryq5hB0om2dyo=";
+    hash = "sha256-KU0AvGecEvbkQ6PSjCMxpisx5UsFr1gLYXL4GzJ6zrU=";
   };
-  vendorHash = "sha256-de9cPm2MuflsOhFZfZmvZpLYiwt3UBgW+MO1Z2QB4F4=";
+  vendorHash = "sha256-arY8RLlHCPgRWnk6LLXlORiLr7afJj4OhfPMA+9UQ0M=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/kompose/default.nix b/pkgs/applications/networking/cluster/kompose/default.nix
index 99c85a484be9..ef3e6832d3f2 100644
--- a/pkgs/applications/networking/cluster/kompose/default.nix
+++ b/pkgs/applications/networking/cluster/kompose/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kompose";
-  version = "1.32.0";
+  version = "1.34.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kompose";
     rev = "v${version}";
-    hash = "sha256-W9KAjyMp8fbnZunH5hwj0uctNYxEN/vbEDGaFJpv5hM=";
+    hash = "sha256-lBNf/pNJulex3WNRx8ZQcGag2nUPqjPKU9X/xDNxQjc=";
   };
 
-  vendorHash = "sha256-nY0d3r3faowHa7ylqDkUrX6MrGW3g1jYjm1MLFW/jK8=";
+  vendorHash = "sha256-SakezUp2Gj1PxY1Gwf8tH2yShtB/MPIqGjM/scrGG4I=";
 
   nativeBuildInputs = [ installShellFiles git ];
 
diff --git a/pkgs/applications/networking/cluster/waagent/default.nix b/pkgs/applications/networking/cluster/waagent/default.nix
index f921f6ec2f87..294440d820e1 100644
--- a/pkgs/applications/networking/cluster/waagent/default.nix
+++ b/pkgs/applications/networking/cluster/waagent/default.nix
@@ -14,12 +14,12 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "waagent";
-  version = "2.10.0.8";
+  version = "2.11.1.4";
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "WALinuxAgent";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-Ilm29z+BJToVxdJTUAZO3Lr2DyOIvK6GW79GxAmfeM4=";
+    sha256 = "sha256-5V9js9gGkIsdGYrQQK/V6tPfL9lh2Cht4llOKBVTyOM=";
   };
   patches = [
     # Suppress the following error when waagent tries to configure sshd:
diff --git a/pkgs/applications/networking/instant-messengers/beeper/default.nix b/pkgs/applications/networking/instant-messengers/beeper/default.nix
index 660c92fc4f9c..87d1d53c9dde 100644
--- a/pkgs/applications/networking/instant-messengers/beeper/default.nix
+++ b/pkgs/applications/networking/instant-messengers/beeper/default.nix
@@ -10,11 +10,11 @@
 }:
 let
   pname = "beeper";
-  version = "3.105.2";
+  version = "3.106.2";
   name = "${pname}-${version}";
   src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.105.2-build-240521yxdjizhu0-x86_64.AppImage";
-    hash = "sha256-Ov2Kii4f4zg/9OyUfm/qhyiqK6C6CC3DgETTx1HqIZ4=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.106.2-build-240604xwl5q01pr-x86_64.AppImage";
+    hash = "sha256-WbAWJJzk58UVmRN3RHmU/V6zPiLWAb7m7hns4gmP55M=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;
diff --git a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
index c9bbe06a9ea6..8536cd145f14 100644
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -5,11 +5,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "229.240514.1";
+  version = "229.240517.0";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-wUxg6Gu8jjV+EEvD9nt38BU5J3qoByvj+sUkilk4voc=";
+    hash = "sha256-NVr9OOq5YdqvCkrtjTRIfWWquxJ/sN8MhSlw3RvZVFs=";
   };
 
   extraPkgs = pkgs: [ pkgs.libsecret ];
diff --git a/pkgs/applications/networking/p2p/gnunet/default.nix b/pkgs/applications/networking/p2p/gnunet/default.nix
index 3f5e2f7c58a2..43f0b97c9ff0 100644
--- a/pkgs/applications/networking/p2p/gnunet/default.nix
+++ b/pkgs/applications/networking/p2p/gnunet/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnunet";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchurl {
     url = "mirror://gnu/gnunet/gnunet-${version}.tar.gz";
-    hash = "sha256-k+aLPqynCHJz49doX+auOLLoBV5MnnANNg3UBVJJeFw=";
+    hash = "sha256-jCNRJo6bi6KtKIuLM3zjmfecGOP/2WCAP07V3n3an6E=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/networking/seafile-client/default.nix b/pkgs/applications/networking/seafile-client/default.nix
index 8dbecdd50aa3..0a133bb49e5e 100644
--- a/pkgs/applications/networking/seafile-client/default.nix
+++ b/pkgs/applications/networking/seafile-client/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "seafile-client";
-  version = "9.0.5";
+  version = "9.0.6";
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seafile-client";
     rev = "v${version}";
-    sha256 = "sha256-fAPEtULab3Ug4gRCS+Eigp48JkORi7tvic2vp5jaw44=";
+    sha256 = "sha256-JjicVgDqiuIuVn7swbVekqQ+3Ly64Nd7qKu5UymTEYE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/xpipe/default.nix b/pkgs/applications/networking/xpipe/default.nix
index d819c658aab4..b5d181dc73a4 100644
--- a/pkgs/applications/networking/xpipe/default.nix
+++ b/pkgs/applications/networking/xpipe/default.nix
@@ -33,14 +33,14 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-E28OeidntQV5Zx6BQjlYxgTXSuQM0ZLCLdb+bIYz8fY=";
+    x86_64-linux = "sha256-nZg0Ha457zrBgYpKIHgGkDxTVQSRthQCCxtT2xWtAlQ=";
   }.${system} or throwSystem;
 
   displayname = "XPipe";
 
 in stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "9.4";
+  version = "9.4.1";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";
diff --git a/pkgs/applications/office/super-productivity/default.nix b/pkgs/applications/office/super-productivity/default.nix
index 9b3296715927..1f6c42eabcef 100644
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "super-productivity";
-  version = "8.0.5";
+  version = "8.0.7";
 
   src = fetchurl {
     url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "sha256-nH7dCrXBhkAYbvb9CPc4zhslFiYtA1ChuYPoHMdBBwQ=";
+    sha256 = "sha256-IBx7P7H2wO6VtqupAvwAwvuDzkm+e2DwWD4UjoDz9KQ=";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/science/biology/ants/default.nix b/pkgs/applications/science/biology/ants/default.nix
index c7a1391c3007..c4b932f6dbae 100644
--- a/pkgs/applications/science/biology/ants/default.nix
+++ b/pkgs/applications/science/biology/ants/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ANTs";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "ANTsX";
     repo = "ANTs";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-q252KC6SKUN5JaQWAcsVmDprVkLXDvkYzNhC7yHJNpk=";
+    hash = "sha256-crvLxUP/uM0u1oakxcpsiULAKUo+86hGATs/kHNseaw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/biology/jbrowse/default.nix b/pkgs/applications/science/biology/jbrowse/default.nix
index 46a2d118471b..395e5b5dcd9a 100644
--- a/pkgs/applications/science/biology/jbrowse/default.nix
+++ b/pkgs/applications/science/biology/jbrowse/default.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "jbrowse";
-  version = "2.11.1";
+  version = "2.11.2";
 
   src = fetchurl {
     url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
-    sha256 = "sha256-/1QNpoJy4u2sSw6907UQpdYX9aFWp31BxsYVTQoDpi4=";
+    sha256 = "sha256-7kZsK3vYgxubgtoIG1dByHgEBOlh9GUq+i3u/1eo0/o=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/science/chemistry/gwyddion/default.nix b/pkgs/applications/science/chemistry/gwyddion/default.nix
index a4b1cd943e1b..c379e432bdeb 100644
--- a/pkgs/applications/science/chemistry/gwyddion/default.nix
+++ b/pkgs/applications/science/chemistry/gwyddion/default.nix
@@ -16,10 +16,10 @@
 
 stdenv.mkDerivation rec {
   pname = "gwyddion";
-   version = "2.65";
+   version = "2.66";
   src = fetchurl {
     url = "mirror://sourceforge/gwyddion/gwyddion-${version}.tar.xz";
-    sha256 = "sha256-kRX7CoPJY8YkYNode5g0OCyWmL+5sM8puCmk9ZE2nqM=";
+    sha256 = "sha256-N3vtzSsNjRM6MpaG2p9fkYB/8dR5N/mZEZXx6GN5LVI=";
   };
 
   nativeBuildInputs = [ pkg-config file ];
diff --git a/pkgs/applications/version-management/gitmux/default.nix b/pkgs/applications/version-management/gitmux/default.nix
index 1a5d5c6b3893..cd5a214464ed 100644
--- a/pkgs/applications/version-management/gitmux/default.nix
+++ b/pkgs/applications/version-management/gitmux/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gitmux";
-  version = "0.10.4";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "arl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-toEKWkyCmeoG6eVK19RKipCqHM7OhZrkWRHNAclFgoI=";
+    sha256 = "sha256-0Cw98hTg8qPu7BUTBDEgFBOpoCxstPW9HeNXQUUjgGA=";
   };
 
   vendorHash = "sha256-PHY020MIuLlC1LqNGyBJRNd7J+SzoHbNMPAil7CKP/M=";
diff --git a/pkgs/applications/video/subtitleedit/default.nix b/pkgs/applications/video/subtitleedit/default.nix
index 924f0fc44e0e..b192edbffa0e 100644
--- a/pkgs/applications/video/subtitleedit/default.nix
+++ b/pkgs/applications/video/subtitleedit/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "subtitleedit";
-  version = "4.0.5";
+  version = "4.0.6";
 
   src = fetchzip {
     url = "https://github.com/SubtitleEdit/subtitleedit/releases/download/${version}/SE${lib.replaceStrings [ "." ] [ "" ] version}.zip";
-    hash = "sha256-qYDLUqC5adzpmlQIq/EKmrkN8D8/EHZmP8QUGAaYf+s=";
+    hash = "sha256-ipAqnF7rpSXccWkyTysUBrD0/mnv5AEA5GuxMJjW9Dg=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/_2/_2ship2harkinian/0001-deps.patch b/pkgs/by-name/_2/_2ship2harkinian/0001-deps.patch
new file mode 100644
index 000000000000..eade8db90a7b
--- /dev/null
+++ b/pkgs/by-name/_2/_2ship2harkinian/0001-deps.patch
@@ -0,0 +1,16 @@
+Submodule libultraship contains modified content
+diff --git a/libultraship/cmake/dependencies/common.cmake b/libultraship/cmake/dependencies/common.cmake
+index 596158c..c62d7b2 100644
+--- a/libultraship/cmake/dependencies/common.cmake
++++ b/libultraship/cmake/dependencies/common.cmake
+@@ -47,10 +47,6 @@ set(stormlib_optimizations_patch git apply ${CMAKE_CURRENT_SOURCE_DIR}/cmake/dep
+ endif()
+ 
+ #=================== STB ===================
+-set(STB_DIR ${CMAKE_BINARY_DIR}/_deps/stb)
+-file(DOWNLOAD "https://github.com/nothings/stb/raw/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h" "${STB_DIR}/stb_image.h")
+-file(WRITE "${STB_DIR}/stb_impl.c" "#define STB_IMAGE_IMPLEMENTATION\n#include \"stb_image.h\"")
+-
+ add_library(stb STATIC)
+ 
+ target_sources(stb PRIVATE
diff --git a/pkgs/by-name/_2/_2ship2harkinian/package.nix b/pkgs/by-name/_2/_2ship2harkinian/package.nix
new file mode 100644
index 000000000000..0be042d174f2
--- /dev/null
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -0,0 +1,216 @@
+{
+  stdenv,
+  cmake,
+  lsb-release,
+  ninja,
+  lib,
+  fetchFromGitHub,
+  fetchurl,
+  copyDesktopItems,
+  makeDesktopItem,
+  python3,
+  boost,
+  SDL2,
+  pkg-config,
+  libpulseaudio,
+  libpng,
+  imagemagick,
+  gnome,
+  makeWrapper,
+  imgui,
+  stormlib,
+  libzip,
+  nlohmann_json,
+  tinyxml-2,
+  spdlog,
+  fetchpatch,
+  writeTextFile,
+}:
+
+let
+
+  # 2ship needs a specific imgui version
+  imgui' = imgui.overrideAttrs rec {
+    version = "1.90.6";
+    src = fetchFromGitHub {
+      owner = "ocornut";
+      repo = "imgui";
+      rev = "v${version}-docking";
+      hash = "sha256-Y8lZb1cLJF48sbuxQ3vXq6GLru/WThR78pq7LlORIzc=";
+    };
+  };
+
+  # Apply 2ship's patch for stormlib
+  stormlib' = stormlib.overrideAttrs (prev: rec {
+    version = "9.25";
+    src = fetchFromGitHub {
+      owner = "ladislav-zezula";
+      repo = "StormLib";
+      rev = "v${version}";
+      hash = "sha256-HTi2FKzKCbRaP13XERUmHkJgw8IfKaRJvsK3+YxFFdc=";
+    };
+    buildInputs = prev.buildInputs ++ [ pkg-config ];
+    patches = (prev.patches or [ ]) ++ [
+      (fetchpatch {
+        name = "stormlib-optimizations.patch";
+        url = "https://github.com/briaguya-ai/StormLib/commit/ff338b230544f8b2bb68d2fbe075175ed2fd758c.patch";
+        hash = "sha256-Jbnsu5E6PkBifcx/yULMVC//ab7tszYgktS09Azs5+4=";
+      })
+    ];
+  });
+
+  # This would get fetched at build time otherwise, see:
+  # https://github.com/HarbourMasters/Shipwright/blob/e46c60a7a1396374e23f7a1f7122ddf9efcadff7/soh/CMakeLists.txt#L736
+  gamecontrollerdb = fetchurl {
+    name = "gamecontrollerdb.txt";
+    url = "https://raw.githubusercontent.com/gabomdq/SDL_GameControllerDB/30cb02c07001234f021eadf64035ef07753c1263/gamecontrollerdb.txt";
+    hash = "sha256-Q/OUrvoLY4fF/EJBmQC57y5b3D0Rmlyd9zAmB7U8SUU=";
+  };
+
+  thread_pool = fetchFromGitHub {
+    owner = "bshoshany";
+    repo = "thread-pool";
+    rev = "v4.1.0";
+    hash = "sha256-zhRFEmPYNFLqQCfvdAaG5VBNle9Qm8FepIIIrT9sh88=";
+  };
+
+  libgfxd = fetchFromGitHub {
+    owner = "glankk";
+    repo = "libgfxd";
+    rev = "008f73dca8ebc9151b205959b17773a19c5bd0da";
+    hash = "sha256-AmHAa3/cQdh7KAMFOtz5TQpcM6FqO9SppmDpKPTjTt8=";
+  };
+
+  stb_impl = writeTextFile {
+    name = "stb_impl.c";
+    text = ''
+      #define STB_IMAGE_IMPLEMENTATION
+      #include "stb_image.h"
+    '';
+  };
+
+  stb' = fetchurl {
+    name = "stb_image.h";
+    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
+    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "2ship2harkinian";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "HarbourMasters";
+    repo = "2ship2harkinian";
+    rev = finalAttrs.version;
+    hash = "sha256-czPAmqlXfhOjOYYssDuKt2YDlMlkruNx8EDXo1ksb14=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    lsb-release
+    python3
+    imagemagick
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  buildInputs = [
+    SDL2
+    libpulseaudio
+    libpng
+    gnome.zenity
+    imgui'
+    stormlib'
+    libzip
+    nlohmann_json
+    tinyxml-2
+    spdlog
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/2s2h"
+    "-DFETCHCONTENT_SOURCE_DIR_IMGUI=${imgui'.src}"
+    "-DFETCHCONTENT_SOURCE_DIR_STORMLIB=${stormlib'}"
+    "-DFETCHCONTENT_SOURCE_DIR_LIBGFXD=${libgfxd}"
+    "-DFETCHCONTENT_SOURCE_DIR_THREADPOOL=${thread_pool}"
+    (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
+    (lib.cmakeBool "NON_PORTABLE" true)
+  ];
+
+  dontAddPrefix = true;
+
+  # Linking fails without this
+  hardeningDisable = [ "format" ];
+
+  # Pie needs to be enabled or else it segfaults
+  hardeningEnable = [ "pie" ];
+
+  preConfigure = ''
+    # mirror 2ship's stb
+    mkdir stb
+    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb_impl} ./stb/${stb_impl.name}
+
+    substituteInPlace libultraship/cmake/dependencies/common.cmake \
+      --replace-fail "\''${STB_DIR}" "/build/source/stb"
+  '';
+
+  patches = [
+    # remove fetching stb as we will patch our own
+    ./0001-deps.patch
+  ];
+
+  postBuild = ''
+    cp ${gamecontrollerdb} ${gamecontrollerdb.name}
+    pushd ../OTRExporter
+    python3 ./extract_assets.py -z ../build/ZAPD/ZAPD.out --norom --xml-root ../mm/assets/xml --custom-assets-path ../mm/assets/custom --custom-otr-file 2ship.o2r --port-ver ${finalAttrs.version}
+    popd
+  '';
+
+  preInstall = ''
+    # Cmake likes it here for its install paths
+    cp ../OTRExporter/2ship.o2r mm/
+  '';
+
+  postInstall = ''
+    mkdir -p $out/bin
+    ln -s $out/2s2h/2s2h.elf $out/bin/2s2h
+    install -Dm644 ../mm/linux/2s2hIcon.png $out/share/pixmaps/2s2h.png
+  '';
+
+  fixupPhase = ''
+    wrapProgram $out/2s2h/2s2h.elf --prefix PATH ":" ${lib.makeBinPath [ gnome.zenity ]}
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "2s2h";
+      icon = "2s2h";
+      exec = "2s2h";
+      comment = finalAttrs.meta.description;
+      genericName = "2 Ship 2 Harkinian";
+      desktopName = "2s2h";
+      categories = [ "Game" ];
+    })
+  ];
+
+  meta = {
+    homepage = "https://github.com/HarbourMasters/2ship2harkinian";
+    description = "A PC port of Majora's Mask with modern controls, widescreen, high-resolution, and more";
+    mainProgram = "2s2h";
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ qubitnano ];
+    license = with lib.licenses; [
+      # OTRExporter, OTRGui, ZAPDTR, libultraship
+      mit
+      # 2 Ship 2 Harkinian
+      cc0
+      # Reverse engineering
+      unfree
+    ];
+  };
+})
diff --git a/pkgs/by-name/_6/_64gram/package.nix b/pkgs/by-name/_6/_64gram/package.nix
index 093084754d6c..552ac3669aa1 100644
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@@ -7,7 +7,7 @@
 
 telegram-desktop.overrideAttrs (old: rec {
   pname = "64gram";
-  version = "1.1.24";
+  version = "1.1.27";
 
   src = fetchFromGitHub {
     owner = "TDesktop-x64";
@@ -15,7 +15,7 @@ telegram-desktop.overrideAttrs (old: rec {
     rev = "v${version}";
 
     fetchSubmodules = true;
-    hash = "sha256-pAtV/uKWCh9sODCYXf6gM8B0i2o5OiVH7z2iLjIZKP0=";
+    hash = "sha256-5Q2VxjiT1IpqCC9oXgHbKxcEfV/gPah0ovOpQ9TZJZs=";
   };
 
   passthru.updateScript = nix-update-script {};
diff --git a/pkgs/by-name/at/attic-server/package.nix b/pkgs/by-name/at/attic-server/package.nix
index de07d6720130..389d8dd4e3d1 100644
--- a/pkgs/by-name/at/attic-server/package.nix
+++ b/pkgs/by-name/at/attic-server/package.nix
@@ -1,7 +1,4 @@
-{ attic-client
-}:
-(attic-client.override {
-  crates = [ "attic-server" ];
-}).overrideAttrs {
-  meta.mainProgram = "atticd";
-}
+{ lib, attic-client }:
+lib.addMetaAttrs { mainProgram = "atticd"; } (
+  attic-client.override { crates = [ "attic-server" ]; }
+)
diff --git a/pkgs/by-name/be/betula/package.nix b/pkgs/by-name/be/betula/package.nix
index c29e6e850e75..7afa85661a1c 100644
--- a/pkgs/by-name/be/betula/package.nix
+++ b/pkgs/by-name/be/betula/package.nix
@@ -3,15 +3,15 @@
 , buildGoModule
 }: buildGoModule rec {
   pname = "betula";
-  version = "1.2.0";
+  version = "1.3.1";
 
   src = fetchFromSourcehut {
     owner = "~bouncepaw";
     repo = "betula";
     rev = "v${version}";
-    hash = "sha256-oxwOGpf305VDlY3Mwl0dRJRRhe0yolaMMlpNspZdKQk=";
+    hash = "sha256-20sA2Hnnppr2RXqu2Qx2bkU/u9FUkH6INUUGx2zKfao=";
   };
-  vendorHash = "sha256-DjL2h6YKCJOWgmR/Gb0Eja38yJ4DymqW/SzmPG3+q9w=";
+  vendorHash = "sha256-SWcQYF8LP6lw5kWlAVFt3qiwDnvpSOXenmdm6TSfJSc=";
 
   CGO_ENABLED = 1;
   # These tests use internet, so are failing in Nix build.
diff --git a/pkgs/by-name/ca/catppuccin-catwalk/package.nix b/pkgs/by-name/ca/catppuccin-catwalk/package.nix
index 8833996a5037..981bc6da239a 100644
--- a/pkgs/by-name/ca/catppuccin-catwalk/package.nix
+++ b/pkgs/by-name/ca/catppuccin-catwalk/package.nix
@@ -8,7 +8,7 @@
   libwebp,
 }:
 let
-  version = "1.3.1";
+  version = "1.3.2";
 in
 rustPlatform.buildRustPackage {
   pname = "catppuccin-catwalk";
@@ -16,13 +16,12 @@ rustPlatform.buildRustPackage {
 
   src = fetchFromGitHub {
     owner = "catppuccin";
-    repo = "toolbox";
-    rev = "refs/tags/catwalk-v${version}";
-    hash = "sha256-Mk4Kv1EfaDiqLUa+aOPeoM4jFlKoUau+VuqmnazRgGI=";
+    repo = "catwalk";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Yj9xTQJ0eu3Ymi2R9fgYwBJO0V+4bN4MOxXCJGQ8NjU=";
   };
 
-  buildAndTestSubdir = "catwalk";
-  cargoHash = "sha256-qxY8CUOl7fF4afJyFjGeOVk7GX/cewC/hAaJf6m5tfA=";
+  cargoHash = "sha256-bx7AvzPoMJqPa+zcn139lH2zyF09EIz7FNHnh1g8wis=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ch/challenger/package.nix b/pkgs/by-name/ch/challenger/package.nix
index ca3a7cf36534..108c7a77eaea 100644
--- a/pkgs/by-name/ch/challenger/package.nix
+++ b/pkgs/by-name/ch/challenger/package.nix
@@ -21,12 +21,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "challenger";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchgit {
     url = "https://git.taler.net/challenger.git";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fjT3igPQ9dQtOezwZVfK5fBaL22FKOCbjUF0U1urK0g=";
+    hash = "sha256-utME8ywCf4hjgOZWp4j2+dNPPLbAqHd80A62waVvONE=";
   };
 
   # https://git.taler.net/challenger.git/tree/bootstrap
diff --git a/pkgs/by-name/cl/clash-verge-rev/package.nix b/pkgs/by-name/cl/clash-verge-rev/package.nix
index 9030bc20d139..b09b83d16961 100644
--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@@ -5,11 +5,11 @@
 
 clash-verge.overrideAttrs (old: rec {
   pname = "clash-verge-rev";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchurl {
     url = "https://github.com/clash-verge-rev/clash-verge-rev/releases/download/v${version}/clash-verge_${version}_amd64.deb";
-    hash = "sha256-OhrC0trcl/zSCZSc4Tx9BDgqBxYiINF69LGVJQ0QGsw=";
+    hash = "sha256-pL6BWfRkyOzi7TnMAEcHyrUDVpK9IOeqcfRKfkHtWmw=";
   };
 
   meta = old.meta // (with lib; {
diff --git a/pkgs/by-name/cm/cmake-lint/package.nix b/pkgs/by-name/cm/cmake-lint/package.nix
new file mode 100644
index 000000000000..b683a0aaa8c5
--- /dev/null
+++ b/pkgs/by-name/cm/cmake-lint/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  testers,
+  cmake-lint,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "cmake-lint";
+  version = "1.4.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cmake-lint";
+    repo = "cmake-lint";
+    rev = "refs/tags/${version}";
+    hash = "sha256-/OuWwerBlJynEibaYo+jkLpHt4x9GZrqMRJNxgrDBlM=";
+  };
+
+  nativeBuildInputs = [ python3Packages.setuptools ];
+
+  pythonImportsCheck = [ "cmakelint" ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
+    nose
+  ];
+
+  checkPhase = ''
+    nosetests
+  '';
+
+  passthru.tests = {
+    version = testers.testVersion { package = cmake-lint; };
+  };
+
+  meta = {
+    description = "Static code checker for CMake files";
+    homepage = "https://github.com/cmake-lint/cmake-lint";
+    changelog = "https://github.com/cmake-lint/cmake-lint/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.luftmensch-luftmensch ];
+    mainProgram = "cmakelint";
+  };
+}
diff --git a/pkgs/by-name/de/decker/package.nix b/pkgs/by-name/de/decker/package.nix
index 4ce73c54b7a5..4469b285e8aa 100644
--- a/pkgs/by-name/de/decker/package.nix
+++ b/pkgs/by-name/de/decker/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "decker";
-  version = "1.41";
+  version = "1.43";
 
   src = fetchFromGitHub {
     owner = "JohnEarnest";
     repo = "Decker";
     rev = "v${version}";
-    hash = "sha256-AnWFAa96/lO5to7mVzHGkyzJ8U+2A9u9N1w91vHDsFo=";
+    hash = "sha256-8P8P5hakIMR+9ug61hkXyt6q1DrcwylKbDCvgFmQPdA=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/de/deltachat-rpc-server/package.nix b/pkgs/by-name/de/deltachat-rpc-server/package.nix
new file mode 100644
index 000000000000..6c57548cf9e8
--- /dev/null
+++ b/pkgs/by-name/de/deltachat-rpc-server/package.nix
@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, libdeltachat
+, perl
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "deltachat-rpc-server";
+
+  inherit (libdeltachat) version src cargoLock buildInputs;
+
+  nativeBuildInputs = [
+    perl
+    pkg-config
+  ];
+
+  cargoBuildFlags = [ "--package" "deltachat-rpc-server" ];
+
+  doCheck = false;
+
+  meta = libdeltachat.meta // {
+    description = "Delta Chat RPC server exposing JSON-RPC core API over standard I/O";
+    mainProgram = "deltachat-rpc-server";
+  };
+}
diff --git a/pkgs/by-name/e1/e1s/package.nix b/pkgs/by-name/e1/e1s/package.nix
index 7b9b3b7272b0..2d80eede0b41 100644
--- a/pkgs/by-name/e1/e1s/package.nix
+++ b/pkgs/by-name/e1/e1s/package.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, buildGoModule, fetchFromGitHub }:
 let
   pname = "e1s";
-  version = "1.0.36";
+  version = "1.0.37";
 in
 buildGoModule {
   inherit pname version;
@@ -10,10 +10,10 @@ buildGoModule {
     owner = "keidarcy";
     repo = "e1s";
     rev = "refs/tags/v${version}";
-    hash = "sha256-i2XCys/fXNS7aXxpAPVqFpuQGempcsBEbVuphXPpBIc=";
+    hash = "sha256-lqaLfGEllyRlVPkUfLUzPO2o+Ruzp1lFD6/RY4o1L14=";
   };
 
-  vendorHash = "sha256-fTrKqhfUg+/4xid9YWkTNkXm3HGaoeeJU0RIMW2mtq8=";
+  vendorHash = "sha256-oQVZ1SNXaXOngZazUVeWLvtZu17XvtIcrx+XC6PvGH0=";
 
   meta = with lib; {
     description = "Easily Manage AWS ECS Resources in Terminal 🐱";
diff --git a/pkgs/by-name/ej/ejsonkms/package.nix b/pkgs/by-name/ej/ejsonkms/package.nix
new file mode 100644
index 000000000000..7c73565e6102
--- /dev/null
+++ b/pkgs/by-name/ej/ejsonkms/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  ejsonkms,
+}:
+
+buildGoModule rec {
+  pname = "ejsonkms";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "envato";
+    repo = "ejsonkms";
+    rev = "v${version}";
+    hash = "sha256-aHnxdEADrzaRld7G2owSHO/0xYXIa8EBBR+phdA4eRM=";
+  };
+
+  vendorHash = "sha256-aLcSCDgd3IGiUg/JAPNIV30tAh6tDYZnFnqzaLELXw0=";
+
+  ldflags = [
+    "-X main.version=v${version}" "-s" "-w"
+  ];
+
+  doCheck = false;
+
+  passthru.tests = {
+    version = testers.testVersion {
+      package = ejsonkms;
+      version = "v${version}";
+    };
+  };
+
+  meta = with lib; {
+    description = "Integrates EJSON with AWS KMS";
+    homepage = "https://github.com/envato/ejsonkms";
+    license = licenses.mit;
+    maintainers = with maintainers; [ viraptor ];
+  };
+}
diff --git a/pkgs/by-name/et/ethercat/package.nix b/pkgs/by-name/et/ethercat/package.nix
index 3e65d5cda9cb..3d7ae6d0854d 100644
--- a/pkgs/by-name/et/ethercat/package.nix
+++ b/pkgs/by-name/et/ethercat/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ethercat";
-  version = "1.6-alpha";
+  version = "1.6.0";
 
   src = fetchFromGitLab {
     owner = "etherlab.org";
     repo = "ethercat";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-kzyA6h0rZFEROLcFZoU+2fIQ/Y0NwtdPuliKDbwkHrE=";
+    hash = "sha256-w1aoznLjCHh+dN2fyfpKpzq68B4D/rert2XFpTxk/F4=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/gm/gmid/package.nix b/pkgs/by-name/gm/gmid/package.nix
index 858019fdce43..6c73773b6e11 100644
--- a/pkgs/by-name/gm/gmid/package.nix
+++ b/pkgs/by-name/gm/gmid/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gmid";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "omar-polo";
     repo = pname;
     rev = version;
-    hash = "sha256-izugxV+fSYBf193ilu70M3OkT6gnkXrTP45gEkEImuA=";
+    hash = "sha256-ioyQS5jjOICAWtZG8no+WUmLybEVLvum6TFFFdnMdfY=";
   };
 
   nativeBuildInputs = [ bison ];
diff --git a/pkgs/by-name/gr/grafana-alloy/package.nix b/pkgs/by-name/gr/grafana-alloy/package.nix
index 63de413775e6..66d6f632bcbe 100644
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -8,6 +8,7 @@
 , fixup-yarn-lock
 , nodejs
 , grafana-alloy
+, nixosTests
 , nix-update-script
 , installShellFiles
 , testers
@@ -103,6 +104,7 @@ buildGoModule rec {
 
   passthru = {
     tests = {
+      inherit (nixosTests) alloy;
       version = testers.testVersion {
         version = "v${version}";
         command = "${lib.getExe grafana-alloy} --version";
@@ -119,7 +121,7 @@ buildGoModule rec {
     mainProgram = "alloy";
     license = licenses.asl20;
     homepage = "https://grafana.com/oss/alloy";
-    maintainers = with maintainers; [ flokli emilylange ];
+    maintainers = with maintainers; [ flokli emilylange hbjydev ];
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/ha/halo/package.nix b/pkgs/by-name/ha/halo/package.nix
index ab9e461cfaea..b7e8f17419fe 100644
--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -7,10 +7,10 @@
 }:
 stdenv.mkDerivation rec {
   pname = "halo";
-  version = "2.16.0";
+  version = "2.16.2";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${version}/${pname}-${version}.jar";
-    hash = "sha256-YjRoq38y4nFmcvEEWyJMociGNzUgQ5FXzTw2R64urcY=";
+    hash = "sha256-bHMcJvM+ZBjiGUAZzjnEupWW9L8viE/Ix8IK2y4KDoA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/je/jetbrains-toolbox/package.nix b/pkgs/by-name/je/jetbrains-toolbox/package.nix
index 653bd8451757..912ec7595ca6 100644
--- a/pkgs/by-name/je/jetbrains-toolbox/package.nix
+++ b/pkgs/by-name/je/jetbrains-toolbox/package.nix
@@ -9,11 +9,11 @@
 }:
 let
   pname = "jetbrains-toolbox";
-  version = "2.3.1.31116";
+  version = "2.3.2.31487";
 
   src = fetchzip {
     url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}.tar.gz";
-    sha256 = "sha256-mrTeUp9DBSO1S6Nxx077lqtY847CiCBCCi/vboZ8ADs=";
+    sha256 = "sha256-5dgtaqi9cMpEoSl3MRaHWzCA8ktU5Mgjvt9CnBzr1ME=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ki/ki/fix-beartype-error.patch b/pkgs/by-name/ki/ki/fix-beartype-error.patch
new file mode 100644
index 000000000000..7f13488e4e0a
--- /dev/null
+++ b/pkgs/by-name/ki/ki/fix-beartype-error.patch
@@ -0,0 +1,38 @@
+From bd765844b40f88547a2afe90d0e09bf74ff0bd61 Mon Sep 17 00:00:00 2001
+From: eljamm <fedi.jamoussi@protonmail.ch>
+Date: Fri, 31 May 2024 16:48:06 +0100
+Subject: [PATCH] Fix beartype Frozenset error
+
+The `copy_note_media` function wrongly returns a `Frozenset` instead of
+a `Set`, which raises an error for the newest beartype version (v0.18.5)
+---
+ ki/__init__.py | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/ki/__init__.py b/ki/__init__.py
+index 3f29c1a..cc65fae 100644
+--- a/ki/__init__.py
++++ b/ki/__init__.py
+@@ -752,9 +752,7 @@ def media_filenames_in_field(col: Collection, s: str) -> Iterable[str]:
+ 
+ @curried
+ @beartype
+-def copy_note_media(
+-    col: Collection, src: Dir, tgt: Dir, row: NoteDBRow
+-) -> FrozenSet[File]:
++def copy_note_media(col: Collection, src: Dir, tgt: Dir, row: NoteDBRow) -> Set[File]:
+     """
+     Copy a single note's media files and return the copies as a set. We do this
+     by first filtering for only 'rootfiles', i.e. excluding media files in
+@@ -769,7 +767,7 @@ def copy_note_media(
+     rootfiles = filter(lambda f: f == os.path.basename(f), files)
+     medias: Iterable[File] = filter(F.isfile, map(lambda f: F.chk(src / f), rootfiles))
+     srcdsts = map(lambda file: (file, F.chk(tgt / file.name)), medias)
+-    return frozenset(starmap(F.copyfile, srcdsts))
++    return set(starmap(F.copyfile, srcdsts))
+ 
+ 
+ @curried
+-- 
+2.44.1
+
diff --git a/pkgs/by-name/ki/ki/package.nix b/pkgs/by-name/ki/ki/package.nix
index 549f60acd8bf..e4d95d64234b 100644
--- a/pkgs/by-name/ki/ki/package.nix
+++ b/pkgs/by-name/ki/ki/package.nix
@@ -1,8 +1,9 @@
-{ lib
-, fetchFromGitHub
-, python3Packages
-, cmake
-, anki
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  cmake,
+  anki,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -21,24 +22,25 @@ python3Packages.buildPythonApplication rec {
   };
 
   patches = [
-    ./update-to-newer-anki-versions.patch
+    ./fix-beartype-error.patch
     ./replace-deprecated-distutils-with-setuptools.patch
+    ./update-to-newer-anki-versions.patch
   ];
 
   nativeBuildInputs = [ cmake ];
 
-  propagatedBuildInputs = with python3Packages; [
-    beartype
-    click
-    colorama
-    git-filter-repo
-    gitpython
-    lark
-    tqdm
-    whatthepatch
-  ] ++ [
-    anki
-  ];
+  propagatedBuildInputs =
+    [ anki ]
+    ++ (with python3Packages; [
+      beartype
+      click
+      colorama
+      git-filter-repo
+      gitpython
+      lark
+      tqdm
+      whatthepatch
+    ]);
 
   nativeCheckInputs = with python3Packages; [
     bitstring
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 4df9edcfced7..2e5514dd15f2 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -71,13 +71,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "3089";
+  version = "3091";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "llama.cpp";
     rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-bI1qSO0f+Uf7svcxAKt1g8fEXjJlMcJWO6zhMkjDGPA=";
+    hash = "sha256-ppujag6Nrk/M9QMQ4mYe2iADsfKzmfKtOP8Ib7GZBmk=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
diff --git a/pkgs/by-name/nh/nhost-cli/package.nix b/pkgs/by-name/nh/nhost-cli/package.nix
index c0084bb6cc95..bc8a14d9a496 100644
--- a/pkgs/by-name/nh/nhost-cli/package.nix
+++ b/pkgs/by-name/nh/nhost-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "nhost-cli";
-  version = "1.18.1";
+  version = "1.18.2";
 
   src = fetchFromGitHub {
     owner = "nhost";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-B0kkbRwL808+p6WwvitxY+6FvnjkNN7NFSSYpNJNOrk=";
+    hash = "sha256-WIkuYmNXpKLsHY6de6PDa56NFTkgpXt1aGouJrEiyUo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/no/novelwriter/package.nix b/pkgs/by-name/no/novelwriter/package.nix
new file mode 100644
index 000000000000..33b3c76e2535
--- /dev/null
+++ b/pkgs/by-name/no/novelwriter/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenv,
+  python3,
+  fetchFromGitHub,
+  qt5,
+  nix-update-script,
+}:
+let
+  version = "2.4.3";
+in
+python3.pkgs.buildPythonApplication {
+  pname = "novelwriter";
+  inherit version;
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "vkbo";
+    repo = "novelWriter";
+    rev = "v${version}";
+    hash = "sha256-PuoI/2JnbOFuSDTY3uDrySqPl/MGYna+QvSI7WQ8QMk=";
+  };
+
+  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+
+  build-system = with python3.pkgs; [ setuptools ];
+
+  dependencies = with python3.pkgs; [
+    pyqt5
+    pyenchant
+    qt5.qtbase
+    qt5.qtwayland
+  ];
+
+  preBuild = ''
+    export QT_QPA_PLATFORM_PLUGIN_PATH=${qt5.qtbase.bin}/lib/qt-${qt5.qtbase.version}/plugins/platforms
+  '';
+
+  postInstall = lib.optionalString stdenv.isLinux ''
+    mkdir -p $out/share/{icons,applications,pixmaps,mime/packages}
+
+    cp -r setup/data/hicolor $out/share/icons
+    cp setup/data/novelwriter.desktop $out/share/applications
+    cp setup/data/novelwriter.png $out/share/pixmaps
+    cp setup/data/x-novelwriter-project.xml $out/share/mime/packages
+  '';
+
+  dontWrapQtApps = true;
+
+  postFixup = ''
+    wrapQtApp $out/bin/novelwriter
+  '';
+
+  passthru.updateScript = nix-update-script {
+    # Stable releases only
+    extraArgs = [
+      "--version-regex"
+      "^v([0-9.]+)$"
+    ];
+  };
+
+  meta = {
+    description = "Open source plain text editor designed for writing novels";
+    homepage = "https://novelwriter.io";
+    changelog = "https://github.com/vkbo/novelWriter/blob/main/CHANGELOG.md";
+    license = with lib.licenses; [ gpl3 ];
+    maintainers = with lib.maintainers; [ pluiedev ];
+    mainProgram = "novelwriter";
+
+    platforms = with lib.platforms; unix ++ windows;
+    broken = stdenv.isDarwin; # TODO awaiting build instructions for Darwin
+  };
+}
diff --git a/pkgs/by-name/pi/pie-cli/package.nix b/pkgs/by-name/pi/pie-cli/package.nix
new file mode 100644
index 000000000000..98d70a2bf360
--- /dev/null
+++ b/pkgs/by-name/pi/pie-cli/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pie-cli";
+  version = "2.0.1";
+
+  src = fetchFromGitHub {
+    owner = "Falconerd";
+    repo = "pie";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-qJaQyet6pjvPhBg6p0wxSIJtZE+P7A7XVqzAnvGn12E=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+    ${stdenv.cc.targetPrefix}cc -o pie pie_cli/pie.c -lm
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm 755 pie $out/bin/pie
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Simple image format optimised for pixel art";
+    homepage = "https://github.com/Falconerd/pie";
+    maintainers = with lib.maintainers; [ sigmanificient ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/pi/pizauth/package.nix b/pkgs/by-name/pi/pizauth/package.nix
new file mode 100644
index 000000000000..17c201663c02
--- /dev/null
+++ b/pkgs/by-name/pi/pizauth/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  stdenv,
+  darwin,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pizauth";
+  version = "1.0.4";
+
+  src = fetchFromGitHub {
+    owner = "ltratt";
+    repo = "pizauth";
+    rev = "pizauth-${version}";
+    hash = "sha256-Du+MVdYVQgH2V7928kpur+Xp/0y7HXgB8ZC0qciiQvs=";
+  };
+
+  cargoHash = "sha256-DrpYMVGvu7UnzQToVgVptURqp7XyoR1iYUfRSLZaqXw=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+
+  postInstall = ''
+    installShellCompletion --cmd pizauth \
+      --bash share/bash/completion.bash
+  '';
+
+  meta = {
+    description = "Command-line OAuth2 authentication daemon";
+    homepage = "https://github.com/ltratt/pizauth";
+    changelog = "https://github.com/ltratt/pizauth/blob/${src.rev}/CHANGES.md";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ moraxyc ];
+    mainProgram = "pizauth";
+  };
+}
diff --git a/pkgs/by-name/pu/pulumi-esc/package.nix b/pkgs/by-name/pu/pulumi-esc/package.nix
new file mode 100644
index 000000000000..b74282d66de0
--- /dev/null
+++ b/pkgs/by-name/pu/pulumi-esc/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "pulumi-esc";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "pulumi";
+    repo = "esc";
+    rev = "v${version}";
+    hash = "sha256-fpS4bnS51Ch3dUvwqHdD4DBpZFZQCqwDlYWotyEfvlQ=";
+  };
+
+  subPackages = "cmd/esc";
+
+  vendorHash = "sha256-Wcll/UWgCTBd1Bkbdt6kZZ6jgouWkzkFicv3CvX5hw4=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/pulumi/esc/cmd/esc/cli/version.Version=${src.rev}"
+  ];
+
+  meta = with lib; {
+    description = "Pulumi ESC (Environments, Secrets, and Configuration) for cloud applications and infrastructure";
+    homepage = "https://github.com/pulumi/esc/tree/main";
+    changelog = "https://github.com/pulumi/esc/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ yomaq ];
+    mainProgram = "esc";
+  };
+}
diff --git a/pkgs/by-name/py/pyxel/Cargo.lock b/pkgs/by-name/py/pyxel/Cargo.lock
index 48e718510249..5b80d12b5670 100644
--- a/pkgs/by-name/py/pyxel/Cargo.lock
+++ b/pkgs/by-name/py/pyxel/Cargo.lock
@@ -8,17 +8,11 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
-[[package]]
-name = "adler32"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
-
 [[package]]
 name = "aho-corasick"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
 dependencies = [
  "memchr",
 ]
@@ -39,23 +33,33 @@ dependencies = [
 ]
 
 [[package]]
-name = "autocfg"
-version = "1.1.0"
+name = "arbitrary"
+version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "7d5a26814d8dcb93b0e5a0ff3c6d80a8843bafb21b39e8e18a6f05471870e110"
+dependencies = [
+ "derive_arbitrary",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "bindgen"
-version = "0.69.1"
-source = "git+https://github.com/rust-lang/rust-bindgen.git?rev=d77e53ed8398743bf68831d25063719fa0f4f136#d77e53ed8398743bf68831d25063719fa0f4f136"
+version = "0.69.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "cexpr",
  "clang-sys",
+ "itertools",
  "lazy_static",
  "lazycell",
  "log",
- "peeking_take_while",
  "prettyplease",
  "proc-macro2",
  "quote",
@@ -80,21 +84,21 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.2"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
 
 [[package]]
 name = "bumpalo"
-version = "3.15.0"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d32a994c2b3ca201d9b263612a374263f05e7adde37c4707f693dcd375076d1f"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "bytemuck"
-version = "1.14.3"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2ef034f05691a48569bd920a96c81b9d91bbad1ab5ac7c4616c1f6ef36cb79f"
+checksum = "78834c15cb5d5efe3452d58b1e8ba890dd62d21907f867f383358198e56ebca5"
 
 [[package]]
 name = "byteorder"
@@ -104,12 +108,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
-dependencies = [
- "libc",
-]
+checksum = "96c51067fd44124faa7f870b4b1c969379ad32b2ba805aa959430ceaa384f695"
 
 [[package]]
 name = "cexpr"
@@ -128,23 +129,23 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.34"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bc015644b92d5890fab7489e49d21f879d5c990186827d42ec511919404f38b"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
  "js-sys",
  "num-traits",
  "wasm-bindgen",
- "windows-targets 0.52.0",
+ "windows-targets",
 ]
 
 [[package]]
 name = "clang-sys"
-version = "1.7.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67523a3b4be3ce1989d607a828d036249522dd9c1c8de7f4dd2dae43a37369d1"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
 dependencies = [
  "glob",
  "libc",
@@ -174,9 +175,9 @@ checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "crc32fast"
-version = "1.4.0"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3855a8a784b474f333699ef2bbca9db2c4a1f6d9088a90a2d25b1eb53111eaa"
+checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
 dependencies = [
  "cfg-if",
 ]
@@ -202,9 +203,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.19"
+version = "0.8.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
+checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
 
 [[package]]
 name = "crunchy"
@@ -213,13 +214,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
 
 [[package]]
-name = "deflate"
-version = "0.8.6"
+name = "derive_arbitrary"
+version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73770f8e1fe7d64df17ca66ad28994a0a623ea497fa69486e14984e715c5d174"
+checksum = "67e77553c4162a157adbf834ebae5b415acbecbeafc7a74b0e886657506a7611"
 dependencies = [
- "adler32",
- "byteorder",
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -244,10 +246,21 @@ dependencies = [
 ]
 
 [[package]]
-name = "either"
-version = "1.10.0"
+name = "displaydoc"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+checksum = "487585f4d0c6655fe74905e2504d8ad6908e4db67f744eb140876906c2f3175d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "either"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
 
 [[package]]
 name = "equivalent"
@@ -257,12 +270,12 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
+checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys",
 ]
 
 [[package]]
@@ -275,7 +288,7 @@ dependencies = [
  "flume",
  "half",
  "lebe",
- "miniz_oxide 0.7.2",
+ "miniz_oxide",
  "rayon-core",
  "smallvec",
  "zune-inflate",
@@ -298,18 +311,18 @@ checksum = "1ee447700ac8aa0b2f2bd7bc4462ad686ba06baa6727ac149a2d6277f0d240fd"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall",
- "windows-sys 0.52.0",
+ "redox_syscall 0.4.1",
+ "windows-sys",
 ]
 
 [[package]]
 name = "flate2"
-version = "1.0.28"
+version = "1.0.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
+checksum = "5f54427cfd1c7829e2a139fcefea601bf088ebca651d2bf53ebc600eac295dae"
 dependencies = [
  "crc32fast",
- "miniz_oxide 0.7.2",
+ "miniz_oxide",
 ]
 
 [[package]]
@@ -323,44 +336,13 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.1.16"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi 0.9.0+wasi-snapshot-preview1",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
-]
-
-[[package]]
-name = "gif"
-version = "0.11.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3edd93c6756b4dfaf2709eafcc345ba2636565295c198a9cfbf75fa5e3e00b06"
-dependencies = [
- "color_quant",
- "weezl",
-]
-
-[[package]]
-name = "gif"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80792593675e051cf94a4b111980da2ba60d4a83e43e0048c5693baab3977045"
-dependencies = [
- "color_quant",
- "weezl",
+ "wasi",
 ]
 
 [[package]]
@@ -393,9 +375,9 @@ dependencies = [
 
 [[package]]
 name = "half"
-version = "2.3.1"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc52e53916c08643f1b56ec082790d1e86a32e58dc5268f897f313fbae7b4872"
+checksum = "6dd08c532ae367adf81c312a4580bc67f1d0fe8bc9c460520283f4c0ff277888"
 dependencies = [
  "cfg-if",
  "crunchy",
@@ -403,9 +385,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.14.3"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
 [[package]]
 name = "heck"
@@ -419,7 +401,7 @@ version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys",
 ]
 
 [[package]]
@@ -447,46 +429,27 @@ dependencies = [
 
 [[package]]
 name = "image"
-version = "0.23.14"
+version = "0.24.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24ffcb7e7244a9bf19d35bf2883b9c080c4ced3c07a9895572178cdb8f13f6a1"
-dependencies = [
- "bytemuck",
- "byteorder",
- "color_quant",
- "gif 0.11.4",
- "jpeg-decoder 0.1.22",
- "num-iter",
- "num-rational",
- "num-traits",
- "png 0.16.8",
- "scoped_threadpool",
- "tiff 0.6.1",
-]
-
-[[package]]
-name = "image"
-version = "0.24.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "034bbe799d1909622a74d1193aa50147769440040ff36cb2baa947609b0a4e23"
+checksum = "5690139d2f55868e080017335e4b94cb7414274c74f1669c84fb5feba2c9f69d"
 dependencies = [
  "bytemuck",
  "byteorder",
  "color_quant",
  "exr",
- "gif 0.12.0",
- "jpeg-decoder 0.3.1",
+ "gif",
+ "jpeg-decoder",
  "num-traits",
- "png 0.17.12",
+ "png",
  "qoi",
- "tiff 0.9.1",
+ "tiff",
 ]
 
 [[package]]
 name = "indexmap"
-version = "2.2.3"
+version = "2.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233cf39063f058ea2caae4091bf4a3ef70a653afbc026f5c4a4135d114e3c177"
+checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -494,17 +457,17 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "2.0.4"
+version = "2.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e186cfbae8084e513daff4240b4797e342f988cecda4fb6c939150f96315fd8"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
-name = "jpeg-decoder"
-version = "0.1.22"
+name = "itertools"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229d53d58899083193af11e15917b5640cd40b29ff475a1fe4ef725deb02d0f2"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
 dependencies = [
- "rayon",
+ "either",
 ]
 
 [[package]]
@@ -518,9 +481,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "406cda4b368d531c842222cf9d2600a9a4acce8d29423695379c6868a143a9ee"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -545,42 +508,41 @@ checksum = "03087c2bad5e1034e8cace5926dec053fb3790248370865f5117a7d0213354c8"
 
 [[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.155"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
 
 [[package]]
 name = "libloading"
-version = "0.8.1"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c571b676ddfc9a8c12f1f3d3085a7b163966a8fd8098a90640953ce5f6170161"
+checksum = "0c2a198fb6b0eada2a8df47933734e6d35d350665a33a3593d7164fa52c75c19"
 dependencies = [
  "cfg-if",
- "windows-sys 0.48.0",
+ "windows-targets",
 ]
 
 [[package]]
 name = "libredox"
-version = "0.0.1"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85c833ca1e66078851dba29046874e38f08b2c883700aa29a03ddd3b23814ee8"
+checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "libc",
- "redox_syscall",
 ]
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
+checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
 [[package]]
 name = "lock_api"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -588,21 +550,21 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "memchr"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "memoffset"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
 dependencies = [
  "autocfg",
 ]
@@ -615,28 +577,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.3.7"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "791daaae1ed6889560f8c4359194f56648355540573244a5448a83ba1ecc7435"
-dependencies = [
- "adler32",
-]
-
-[[package]]
-name = "miniz_oxide"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a92518e98c078586bc6c934028adcca4c92a53d6a958196de835170a01d84e4b"
-dependencies = [
- "adler",
- "autocfg",
-]
-
-[[package]]
-name = "miniz_oxide"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
+checksum = "87dfd01fe195c66b572b37921ad8803d010623c0aca821bea2302239d155cdae"
 dependencies = [
  "adler",
  "simd-adler32",
@@ -644,12 +587,12 @@ dependencies = [
 
 [[package]]
 name = "noise"
-version = "0.7.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82051dd6745d5184c6efb7bc8be14892a7f6d4f3ad6dbf754d1c7d7d5fe24b43"
+checksum = "6da45c8333f2e152fc665d78a380be060eb84fad8ca4c9f7ac8ca29216cff0cc"
 dependencies = [
- "image 0.23.14",
- "rand 0.7.3",
+ "num-traits",
+ "rand",
  "rand_xorshift",
 ]
 
@@ -672,46 +615,36 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "num-integer"
-version = "0.1.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
-dependencies = [
- "num-traits",
-]
-
-[[package]]
-name = "num-iter"
-version = "0.1.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d869c01cc0c455284163fd0092f1f93835385ccab5a98a0dcc497b2f8bf055a9"
-dependencies = [
- "autocfg",
- "num-integer",
- "num-traits",
-]
-
-[[package]]
-name = "num-rational"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12ac428b1cb17fce6f731001d307d351ec70a6d202fc2e60f7d4c5e42d8f4f07"
-dependencies = [
- "autocfg",
- "num-integer",
- "num-traits",
-]
-
 [[package]]
 name = "num-traits"
-version = "0.2.18"
+version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "num_enum"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02339744ee7253741199f897151b38e72257d13802d4ee837285cc2990a90845"
+dependencies = [
+ "num_enum_derive",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "681030a937600a36906c185595136d26abfebb4aa9c65701cefcaf8578bb982b"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.19.0"
@@ -720,9 +653,9 @@ checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "parking_lot"
-version = "0.12.1"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -730,28 +663,22 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.9"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall",
+ "redox_syscall 0.5.1",
  "smallvec",
- "windows-targets 0.48.5",
+ "windows-targets",
 ]
 
 [[package]]
 name = "paste"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
-
-[[package]]
-name = "peeking_take_while"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
 [[package]]
 name = "platform-dirs"
@@ -764,29 +691,23 @@ dependencies = [
 
 [[package]]
 name = "png"
-version = "0.16.8"
+version = "0.17.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c3287920cb847dee3de33d301c463fba14dda99db24214ddf93f83d3021f4c6"
-dependencies = [
- "bitflags 1.3.2",
- "crc32fast",
- "deflate",
- "miniz_oxide 0.3.7",
-]
-
-[[package]]
-name = "png"
-version = "0.17.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c2378060fb13acff3ba0325b83442c1d2c44fbb76df481160ddc1687cce160"
+checksum = "06e4b0d3d1312775e782c86c91a111aa1f910cbb65e1337f9975b5f9a554b5e1"
 dependencies = [
  "bitflags 1.3.2",
  "crc32fast",
  "fdeflate",
  "flate2",
- "miniz_oxide 0.7.2",
+ "miniz_oxide",
 ]
 
+[[package]]
+name = "portable-atomic"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.17"
@@ -795,34 +716,44 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "prettyplease"
-version = "0.2.16"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a41cf62165e97c7f814d2221421dbb9afcbcdb0a88068e5ea206e19951c2cbb5"
+checksum = "5f12335488a2f3b0a83b14edad48dca9879ce89b2edd10e80237e4e852dd645e"
 dependencies = [
  "proc-macro2",
  "syn",
 ]
 
 [[package]]
-name = "proc-macro2"
-version = "1.0.78"
+name = "proc-macro-crate"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+checksum = "6d37c51ca738a55da99dc0c4a34860fd675453b8b36209178c2249bb13651284"
+dependencies = [
+ "toml_edit 0.21.1",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.85"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22244ce15aa966053a896d1accb3a6e68469b97c7f33f284b99f0d576879fc23"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "pyo3"
-version = "0.20.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a89dc7a5850d0e983be1ec2a463a171d20990487c3cfcd68b5363f1ee3d6fe0"
+checksum = "a5e00b96a521718e08e03b1a622f01c8a8deb50719335de3f60b3b3950f069d8"
 dependencies = [
  "cfg-if",
  "indoc",
  "libc",
  "memoffset",
  "parking_lot",
+ "portable-atomic",
  "pyo3-build-config",
  "pyo3-ffi",
  "pyo3-macros",
@@ -831,9 +762,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.20.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07426f0d8fe5a601f26293f300afd1a7b1ed5e78b2a705870c5f30893c5163be"
+checksum = "7883df5835fafdad87c0d888b266c8ec0f4c9ca48a5bed6bbb592e8dedee1b50"
 dependencies = [
  "once_cell",
  "target-lexicon",
@@ -841,9 +772,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.20.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb7dec17e17766b46bca4f1a4215a85006b4c2ecde122076c562dd058da6cf1"
+checksum = "01be5843dc60b916ab4dad1dca6d20b9b4e6ddc8e15f50c47fe6d85f1fb97403"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -851,9 +782,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.20.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f738b4e40d50b5711957f142878cfa0f28e054aa0ebdfc3fd137a843f74ed3"
+checksum = "77b34069fc0682e11b31dbd10321cbf94808394c56fd996796ce45217dfac53c"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -863,32 +794,33 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.20.2"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fc910d4851847827daf9d6cdd4a823fbdaab5b8818325c5e97a86da79e8881f"
+checksum = "08260721f32db5e1a5beae69a55553f56b99bd0e1c3e6e0a5e8851a9d0f5a85c"
 dependencies = [
  "heck",
  "proc-macro2",
+ "pyo3-build-config",
  "quote",
  "syn",
 ]
 
 [[package]]
 name = "pyxel-engine"
-version = "2.0.7"
+version = "2.0.13"
 dependencies = [
  "cfg-if",
  "chrono",
- "gif 0.13.1",
+ "gif",
  "glow",
- "image 0.24.8",
+ "image",
  "indexmap",
  "noise",
  "once_cell",
  "parking_lot",
  "platform-dirs",
  "pyxel-platform",
- "rand 0.8.5",
+ "rand",
  "rand_xoshiro",
  "semver",
  "serde",
@@ -899,7 +831,7 @@ dependencies = [
 
 [[package]]
 name = "pyxel-platform"
-version = "2.0.7"
+version = "2.0.13"
 dependencies = [
  "bindgen",
  "cfg-if",
@@ -914,7 +846,7 @@ dependencies = [
 
 [[package]]
 name = "pyxel-wrapper"
-version = "2.0.7"
+version = "2.0.13"
 dependencies = [
  "pyo3",
  "pyxel-engine",
@@ -932,26 +864,13 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
 
-[[package]]
-name = "rand"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
-dependencies = [
- "getrandom 0.1.16",
- "libc",
- "rand_chacha 0.2.2",
- "rand_core 0.5.1",
- "rand_hc",
-]
-
 [[package]]
 name = "rand"
 version = "0.8.5"
@@ -959,18 +878,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.5.1",
+ "rand_chacha",
+ "rand_core",
 ]
 
 [[package]]
@@ -980,16 +889,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
-dependencies = [
- "getrandom 0.1.16",
+ "rand_core",
 ]
 
 [[package]]
@@ -998,25 +898,16 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.12",
-]
-
-[[package]]
-name = "rand_hc"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
-dependencies = [
- "rand_core 0.5.1",
+ "getrandom",
 ]
 
 [[package]]
 name = "rand_xorshift"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77d416b86801d23dde1aa643023b775c3a462efc0ed96443add11546cdf1dca8"
+checksum = "d25bf25ec5ae4a3f1b92f929810509a2f53d7dca2f50b794ff57e3face536c8f"
 dependencies = [
- "rand_core 0.5.1",
+ "rand_core",
 ]
 
 [[package]]
@@ -1025,14 +916,14 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f97cdb2a36ed4183de61b2f824cc45c9f1037f28afe0a322e9fff4c108b5aaa"
 dependencies = [
- "rand_core 0.6.4",
+ "rand_core",
 ]
 
 [[package]]
 name = "rayon"
-version = "1.8.1"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7237101a77a10773db45d62004a272517633fbcc3df19d96455ede1122e051"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
 dependencies = [
  "either",
  "rayon-core",
@@ -1058,21 +949,30 @@ dependencies = [
 ]
 
 [[package]]
-name = "redox_users"
-version = "0.4.4"
+name = "redox_syscall"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a18479200779601e498ada4e8c1e1f50e3ee19deb0259c25825a98b5603b2cb4"
+checksum = "469052894dcb553421e483e4209ee581a45100d31b4018de03e5a7ad86374a7e"
 dependencies = [
- "getrandom 0.2.12",
+ "bitflags 2.5.0",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd283d9651eeda4b2a83a43c1c91b266c40fd76ecd39a50a8c630ae69dc72891"
+dependencies = [
+ "getrandom",
  "libredox",
  "thiserror",
 ]
 
 [[package]]
 name = "regex"
-version = "1.10.3"
+version = "1.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
+checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1082,9 +982,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bb987efffd3c6d0d8f5f89510bb458559eab11e4f869acb20bf845e016259cd"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1093,9 +993,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "rustc-hash"
@@ -1105,23 +1005,17 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.38.31"
+version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
+checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
- "bitflags 2.4.2",
+ "bitflags 2.5.0",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys",
 ]
 
-[[package]]
-name = "scoped_threadpool"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d51f5df5af43ab3f1360b429fa5e0152ac5ce8c0bd6485cae490332e96846a8"
-
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -1130,15 +1024,15 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "semver"
-version = "1.0.21"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0"
+checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
 
 [[package]]
 name = "serde"
-version = "1.0.196"
+version = "1.0.203"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "870026e60fa08c69f064aa766c10f10b1d62db9ccd4d0abb206472bee0ce3b32"
+checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
 dependencies = [
  "serde_derive",
 ]
@@ -1157,9 +1051,9 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.196"
+version = "1.0.203"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33c85360c95e7d137454dc81d9a4ed2b8efd8fbe19cee57357b32b9771fccb67"
+checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1168,9 +1062,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.5"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
+checksum = "79e674e01f999af37c49f70a6ede167a8a60b2503e56c5599532a65baa5969a0"
 dependencies = [
  "serde",
 ]
@@ -1198,9 +1092,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.1"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "spin"
@@ -1213,9 +1107,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.49"
+version = "2.0.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "915aea9e586f80826ee59f8453c1101f9d1c4b3964cd2460185ee8e299ada496"
+checksum = "c42f3f41a2de00b01c0aaad383c5a45241efc8b2d1eda5661812fda5f3cdcff5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1224,9 +1118,9 @@ dependencies = [
 
 [[package]]
 name = "sysinfo"
-version = "0.30.5"
+version = "0.30.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fb4f3438c8f6389c864e61221cbc97e9bca98b4daf39a5beb7bea660f528bb2"
+checksum = "732ffa00f53e6b2af46208fba5718d9662a421049204e156328b66791ffa15ae"
 dependencies = [
  "cfg-if",
  "core-foundation-sys",
@@ -1239,9 +1133,9 @@ dependencies = [
 
 [[package]]
 name = "tar"
-version = "0.4.40"
+version = "0.4.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b16afcea1f22891c49a00c751c7b63b2233284064f11a200fc624137c51e2ddb"
+checksum = "cb797dad5fb5b76fcf519e702f4a589483b5ef06567f160c392832c1f5e44909"
 dependencies = [
  "filetime",
  "libc",
@@ -1250,41 +1144,30 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.13"
+version = "0.12.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69758bda2e78f098e4ccb393021a0963bb3442eac05f135c30f61b7370bbafae"
+checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
 
 [[package]]
 name = "thiserror"
-version = "1.0.57"
+version = "1.0.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e45bcbe8ed29775f228095caf2cd67af7a4ccf756ebff23a306bf3e8b47b24b"
+checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.57"
+version = "1.0.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a953cb265bef375dae3de6663da4d3804eee9682ea80d8e2542529b73c531c81"
+checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
 
-[[package]]
-name = "tiff"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a53f4706d65497df0c4349241deddf35f84cee19c87ed86ea8ca590f4464437"
-dependencies = [
- "jpeg-decoder 0.1.22",
- "miniz_oxide 0.4.4",
- "weezl",
-]
-
 [[package]]
 name = "tiff"
 version = "0.9.1"
@@ -1292,42 +1175,53 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba1310fcea54c6a9a4fd1aad794ecc02c31682f6bfbecdf460bf19533eed1e3e"
 dependencies = [
  "flate2",
- "jpeg-decoder 0.3.1",
+ "jpeg-decoder",
  "weezl",
 ]
 
 [[package]]
 name = "toml"
-version = "0.8.10"
+version = "0.8.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a9aad4a3066010876e8dcf5a8a06e70a558751117a145c6ce2b82c2e2054290"
+checksum = "6f49eb2ab21d2f26bd6db7bf383edc527a7ebaee412d17af4d40fdccd442f335"
 dependencies = [
  "serde",
  "serde_spanned",
  "toml_datetime",
- "toml_edit",
+ "toml_edit 0.22.14",
 ]
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.5"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
+checksum = "4badfd56924ae69bcc9039335b2e017639ce3f9b001c393c1b2d1ef846ce2cbf"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.22.6"
+version = "0.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c1b5fd4128cc8d3e0cb74d4ed9a9cc7c7284becd4df68f5f940e1ad123606f6"
+checksum = "6a8534fd7f78b5405e860340ad6575217ce99f38d4d5c8f2442cb5ecb50090e1"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f21c7aaf97f1bd9ca9d4f9e73b0a6c74bd5afef56f2bc931943a6e1c37e04e38"
 dependencies = [
  "indexmap",
  "serde",
  "serde_spanned",
  "toml_datetime",
- "winnow",
+ "winnow 0.6.13",
 ]
 
 [[package]]
@@ -1348,12 +1242,6 @@ version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
-[[package]]
-name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
-
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
@@ -1362,9 +1250,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1e124130aee3fb58c5bdd6b639a0509486b0338acaaae0c84a5124b0f588b7f"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -1372,9 +1260,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e7e1900c352b609c8488ad12639a311045f40a35491fb69ba8c12f758af70b"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
 dependencies = [
  "bumpalo",
  "log",
@@ -1387,9 +1275,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b30af9e2d358182b5c7449424f017eba305ed32a7010509ede96cdc4696c46ed"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1397,9 +1285,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "642f325be6301eb8107a83d12a8ac6c1e1c54345a7ef1a9261962dfefda09e66"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1410,15 +1298,15 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.91"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
 
 [[package]]
 name = "web-sys"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96565907687f7aceb35bc5fc03770a8a0471d82e479f25832f54a0e3f4b28446"
+checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -1471,7 +1359,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be"
 dependencies = [
  "windows-core",
- "windows-targets 0.52.0",
+ "windows-targets",
 ]
 
 [[package]]
@@ -1480,16 +1368,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.0",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets 0.48.5",
+ "windows-targets",
 ]
 
 [[package]]
@@ -1498,128 +1377,87 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.0",
+ "windows-targets",
 ]
 
 [[package]]
 name = "windows-targets"
-version = "0.48.5"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
 dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
-dependencies = [
- "windows_aarch64_gnullvm 0.52.0",
- "windows_aarch64_msvc 0.52.0",
- "windows_i686_gnu 0.52.0",
- "windows_i686_msvc 0.52.0",
- "windows_x86_64_gnu 0.52.0",
- "windows_x86_64_gnullvm 0.52.0",
- "windows_x86_64_msvc 0.52.0",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.48.5"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.48.5"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.48.5"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
 
 [[package]]
-name = "windows_i686_gnu"
-version = "0.52.0"
+name = "windows_i686_gnullvm"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.48.5"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.48.5"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.48.5"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.5"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 
 [[package]]
 name = "winnow"
-version = "0.6.1"
+version = "0.5.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d90f4e0f530c4c69f62b80d839e9ef3855edc9cba471a160c4d692deed62b401"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "0.6.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59b5e5f6c299a3c7890b876a2a587f3115162487e704907d9b6cd29473052ba1"
 dependencies = [
  "memchr",
 ]
@@ -1637,20 +1475,24 @@ dependencies = [
 
 [[package]]
 name = "xml-rs"
-version = "0.8.19"
+version = "0.8.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fcb9cbac069e033553e8bb871be2fbdffcab578eb25bd0f7c508cedc6dcd75a"
+checksum = "791978798f0597cfc70478424c2b4fdc2b7a8024aaff78497ef00f24ef674193"
 
 [[package]]
 name = "zip"
-version = "0.6.6"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "760394e246e4c28189f19d488c058bf16f564016aefac5d32bb1f3b51d5e9261"
+checksum = "9cc23c04387f4da0374be4533ad1208cbb091d5c11d070dfef13676ad6497164"
 dependencies = [
- "byteorder",
+ "arbitrary",
  "crc32fast",
  "crossbeam-utils",
+ "displaydoc",
  "flate2",
+ "indexmap",
+ "num_enum",
+ "thiserror",
 ]
 
 [[package]]
diff --git a/pkgs/by-name/py/pyxel/never-bundle-sdl2.patch b/pkgs/by-name/py/pyxel/never-bundle-sdl2.patch
index e3448d4ede63..dc53e63bc6ca 100644
--- a/pkgs/by-name/py/pyxel/never-bundle-sdl2.patch
+++ b/pkgs/by-name/py/pyxel/never-bundle-sdl2.patch
@@ -1,8 +1,8 @@
-diff --git a/crates/pyxel-platform/build.rs b/crates/pyxel-platform/build.rs
-index 35cdeef5..68a93ed9 100644
---- a/crates/pyxel-platform/build.rs
-+++ b/crates/pyxel-platform/build.rs
-@@ -30,7 +30,7 @@ impl SDL2BindingsBuilder {
+diff --git a/rust/pyxel-platform/build.rs b/rust/pyxel-platform/build.rs
+index 45eecae..f385eb9 100644
+--- a/rust/pyxel-platform/build.rs
++++ b/rust/pyxel-platform/build.rs
+@@ -31,7 +31,7 @@ impl SDL2BindingsBuilder {
      }
  
      fn should_bundle_sdl2(&self) -> bool {
diff --git a/pkgs/by-name/py/pyxel/package.nix b/pkgs/by-name/py/pyxel/package.nix
index ec6ebea79931..efdfdcc2c61b 100644
--- a/pkgs/by-name/py/pyxel/package.nix
+++ b/pkgs/by-name/py/pyxel/package.nix
@@ -10,7 +10,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "pyxel";
-  version = "2.0.7";
+  version = "2.0.13";
   pyproject = true;
 
   disabled = python3.pythonOlder "3.7";
@@ -19,29 +19,24 @@ python3.pkgs.buildPythonApplication rec {
     owner = "kitao";
     repo = "pyxel";
     rev = "v${version}";
-    hash = "sha256-5Jrwfi79HbS4hh+eMwI49Rsk4jrAdAuDhNpUT2cEvDo=";
+    hash = "sha256-0pVeIYDt8sz3eIQU/mU443fVWYjhShTpFKoPpM/PFf0=";
   };
 
-  patches = [
-    ./never-bundle-sdl2.patch
-    ./update-bindgen-f16-support.patch # can be removed once rust-bindgen gets a new release
-  ];
-
-  cargoRoot = "crates/pyxel-wrapper";
-
-  # Lockfile is generated by applying patches with `git apply`
-  # and then running `cargo generate-lockfile` in `crates/pyxel-wrapper`
-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "bindgen-0.69.1" = "sha256-1967EmuyWgmrKmhwAcW49dlmuWPNuKjuRr5/u7ZKpXQ=";
-    };
-  };
+  patches = [ ./never-bundle-sdl2.patch ];
 
   postPatch = ''
-    cp ${./Cargo.lock} crates/pyxel-wrapper/Cargo.lock
+    cp ${./Cargo.lock} rust/Cargo.lock
   '';
 
+  cargoRoot = "rust";
+
+  cargoDeps = rustPlatform.importCargoLock {
+    # generated by running `cargo generate-lockfile` in the `rust` directory
+    lockFile = ./Cargo.lock;
+  };
+
+  buildAndTestSubdir = "python";
+
   nativeBuildInputs = with rustPlatform; [
     cargoSetupHook
     maturinBuildHook
@@ -55,7 +50,7 @@ python3.pkgs.buildPythonApplication rec {
 
   env.NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2}/include/SDL2";
 
-  # Tests can't use the display
+  # Tests want to use the display
   doCheck = false;
 
   pythonImportsCheck = [
diff --git a/pkgs/by-name/py/pyxel/update-bindgen-f16-support.patch b/pkgs/by-name/py/pyxel/update-bindgen-f16-support.patch
deleted file mode 100644
index 9b7257c7670c..000000000000
--- a/pkgs/by-name/py/pyxel/update-bindgen-f16-support.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/crates/pyxel-platform/Cargo.toml b/crates/pyxel-platform/Cargo.toml
-index 01a87b68..088ffbdd 100644
---- a/crates/pyxel-platform/Cargo.toml
-+++ b/crates/pyxel-platform/Cargo.toml
-@@ -22,7 +22,7 @@ parking_lot = "0.12"
- paste = "1.0"
- 
- [build-dependencies]
--bindgen = "0.69"
-+bindgen = { git = "https://github.com/rust-lang/rust-bindgen.git", rev = "d77e53ed8398743bf68831d25063719fa0f4f136" }
- cmake = "0.1"
- flate2 = "1.0"
- tar = "0.4"
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 2c193aad4114..9938de1d8d85 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -5,11 +5,11 @@
 
 renode.overrideAttrs (finalAttrs: _: {
   pname = "renode-unstable";
-  version = "1.15.0+20240603gitf830e6345";
+  version = "1.15.0+20240609git09f623310";
 
   src = fetchurl {
     url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-4DV5dYnT7oZl/i7k3g6ydXxIRt4+z/jLZAB7c6JDgO4=";
+    hash = "sha256-jbPvMzGXdBXT92aPXBQzw74hXW9JJeTZQgXKvILMlo0=";
   };
 
   passthru.updateScript =
diff --git a/pkgs/by-name/sa/sarif-fmt/package.nix b/pkgs/by-name/sa/sarif-fmt/package.nix
new file mode 100644
index 000000000000..ad273bca0d64
--- /dev/null
+++ b/pkgs/by-name/sa/sarif-fmt/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  clippy,
+  sarif-fmt,
+  testers,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "sarif-fmt";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "psastras";
+    repo = "sarif-rs";
+    rev = "sarif-fmt-v${version}";
+    hash = "sha256-EzWzDeIeSJ11CVcVyAhMjYQJcKHnieRrFkULc5eXAno=";
+  };
+
+  cargoHash = "sha256-dHOxVLXtnqSHMX5r1wFxqogDf9QdnOZOjTyYFahru34=";
+  cargoBuildFlags = [
+    "--package"
+    "sarif-fmt"
+  ];
+  cargoTestFlags = cargoBuildFlags;
+
+  # `test_clippy` (the only test we enable) is broken on Darwin
+  # because `--enable-profiler` is not enabled in rustc on Darwin
+  # error[E0463]: can't find crate for profiler_builtins
+  doCheck = !stdenv.isDarwin;
+
+  nativeCheckInputs = [
+    # `test_clippy`
+    clippy
+  ];
+
+  checkFlags = [
+    # this test uses nix so...no go
+    "--skip=test_clang_tidy"
+    # ditto
+    "--skip=test_hadolint"
+    # ditto
+    "--skip=test_shellcheck"
+  ];
+
+  passthru = {
+    tests.version = testers.testVersion { package = sarif-fmt; };
+  };
+
+  meta = {
+    description = "A CLI tool to pretty print SARIF diagnostics";
+    homepage = "https://psastras.github.io/sarif-rs";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "sarif-fmt";
+  };
+}
diff --git a/pkgs/by-name/st/strictdoc/package.nix b/pkgs/by-name/st/strictdoc/package.nix
index 3b1e2397407f..95d11ba10aee 100644
--- a/pkgs/by-name/st/strictdoc/package.nix
+++ b/pkgs/by-name/st/strictdoc/package.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "strictdoc";
-  version = "0.0.55";
+  version = "0.0.56";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "strictdoc-project";
     repo = "strictdoc";
     rev = "refs/tags/${version}";
-    hash = "sha256-QIwDtOaqRq59zdF5IZ7xwas5LLYt98Vyv00HkgGgahM=";
+    hash = "sha256-T2xFMExRas7mxfjmAZnv3kiHdc+eEFdCf7TG1ABzgWM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sy/sync/package.nix b/pkgs/by-name/sy/sync/package.nix
index e96aa738d2c1..2ac766a4efbd 100644
--- a/pkgs/by-name/sy/sync/package.nix
+++ b/pkgs/by-name/sy/sync/package.nix
@@ -19,12 +19,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sync";
-  version = "0.10.1";
+  version = "0.11.0";
 
   src = fetchgit {
     url = "https://git.taler.net/sync.git";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7EBm4Zp1sjZw7pXxQySY+1It3C/KLG2SHhqUPhDATbg=";
+    hash = "sha256-IGYc4Olbn9lVnN1THR2BXzllD1li/vhWwHg+1WU84YM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ta/taler-exchange/package.nix b/pkgs/by-name/ta/taler-exchange/package.nix
index d5139dafaa6b..4f3b158522f0 100644
--- a/pkgs/by-name/ta/taler-exchange/package.nix
+++ b/pkgs/by-name/ta/taler-exchange/package.nix
@@ -21,7 +21,7 @@
 }:
 
 let
-  version = "0.10.2";
+  version = "0.11.2";
 in
 stdenv.mkDerivation {
   pname = "taler-exchange";
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
     url = "https://git.taler.net/exchange.git";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-dl8lZ7uKUr+KSUaT4xlkaX3W5UoW2Zfu/0iVXvLejnA=";
+    hash = "sha256-DflUfXAe310LRhZmaHgF1ZpCi+hHF30lpzAIpI1HZvM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/taler-merchant/package.nix b/pkgs/by-name/ta/taler-merchant/package.nix
index 59fb722b72fc..65367499e23c 100644
--- a/pkgs/by-name/ta/taler-merchant/package.nix
+++ b/pkgs/by-name/ta/taler-merchant/package.nix
@@ -12,12 +12,13 @@
 }:
 
 let
-  version = "0.10.2";
+  version = "0.11.3";
 
   taler-wallet-core = fetchgit {
     url = "https://git.taler.net/wallet-core.git";
-    rev = "v${version}";
-    hash = "sha256-jC8XhcHZxv7ww+wspJUqTq6x6FIeEehQmE03ttJZWT4=";
+    # https://taler.net/fr/news/2024-11.html
+    rev = "v0.11.2";
+    hash = "sha256-GtR87XqmunYubh9EiY3bJIqXiXrT+re3KqWypYK3NCo=";
   };
 in
 stdenv.mkDerivation {
@@ -28,7 +29,7 @@ stdenv.mkDerivation {
     url = "https://git.taler.net/merchant.git";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-WY5Fk5HcVjxsnqt69m8E9ikW+nQDkCuKtT1CTsupz5c=";
+    hash = "sha256-Rak6p8cuCHPZxrXqrv3YUU3pFFw4GWf8bcd3Ur+o7Wg=";
   };
 
   postUnpack = ''
diff --git a/pkgs/by-name/ue/ueberzugpp/package.nix b/pkgs/by-name/ue/ueberzugpp/package.nix
index cc0e0cd79535..b41f7693c517 100644
--- a/pkgs/by-name/ue/ueberzugpp/package.nix
+++ b/pkgs/by-name/ue/ueberzugpp/package.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ueberzugpp";
-  version = "2.9.5";
+  version = "2.9.6";
 
   src = fetchFromGitHub {
     owner = "jstkdng";
     repo = "ueberzugpp";
     rev = "v${version}";
-    hash = "sha256-BuVInCYpogkn1CnQ2hqLaTi1KJ0mHEEfRIOrTIg9duY=";
+    hash = "sha256-qo9Rwnx6Oh8DRcCBUMS3JVdNyx1iZSB2Z1qfptUoPFQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/wo/wonderdraft/package.nix b/pkgs/by-name/wo/wonderdraft/package.nix
index c309a1e3b6f3..ee49c10a7007 100644
--- a/pkgs/by-name/wo/wonderdraft/package.nix
+++ b/pkgs/by-name/wo/wonderdraft/package.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "wonderdraft";
-  version = "1.1.7.3";
+  version = "1.1.8.2b";
 
   src = requireFile {
     name = "Wonderdraft-${version}-Linux64.deb";
     url = "https://wonderdraft.net/";
-    hash = "sha256-i8YZF5w1dIWUyk99SUhHU7eJRjPXJDPbYUzGC1uN8JQ=";
+    hash = "sha256-3eYnEH6P94z9axFsrkJA4QMcHyg/gNRczqL3h5Sc2Tg=";
   };
   sourceRoot = ".";
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
diff --git a/pkgs/desktops/plasma-5/default.nix b/pkgs/desktops/plasma-5/default.nix
index 781bf1606709..46b9e0c3a65e 100644
--- a/pkgs/desktops/plasma-5/default.nix
+++ b/pkgs/desktops/plasma-5/default.nix
@@ -151,6 +151,7 @@ let
       plasma-browser-integration = callPackage ./plasma-browser-integration.nix { };
       plasma-desktop = callPackage ./plasma-desktop { };
       plasma-disks = callPackage ./plasma-disks.nix { };
+      plasma-firewall = callPackage ./plasma-firewall.nix { };
       plasma-integration = callPackage ./plasma-integration { };
       plasma-mobile = callPackage ./plasma-mobile { };
       plasma-nano = callPackage ./plasma-nano { };
diff --git a/pkgs/desktops/plasma-5/plasma-firewall.nix b/pkgs/desktops/plasma-5/plasma-firewall.nix
new file mode 100644
index 000000000000..e290b5ed0dc1
--- /dev/null
+++ b/pkgs/desktops/plasma-5/plasma-firewall.nix
@@ -0,0 +1,21 @@
+{ mkDerivation
+, extra-cmake-modules
+, python3
+, plasma-framework
+, kcmutils
+}:
+mkDerivation {
+  pname = "plasma-firewall";
+
+  outputs = [ "out" ];
+
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+
+  buildInputs = [
+    kcmutils
+    plasma-framework
+    python3
+  ];
+}
diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index 7b04a23a98c4..a893166082d5 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -18,12 +18,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.75.0";
+  version = "1.76.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-jacmj383n0crEwkgkr2qN8n0PWfCnDxzaRaMGVuyrMg=";
+    hash = "sha256-L8ELchwUzweS1gzZ8EfnddZu5xMJIVURViwwtPpxylo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/compilers/flutter/versions/3_22/data.json b/pkgs/development/compilers/flutter/versions/3_22/data.json
index 66bc68aaff66..19c1ddd532b8 100644
--- a/pkgs/development/compilers/flutter/versions/3_22/data.json
+++ b/pkgs/development/compilers/flutter/versions/3_22/data.json
@@ -1,20 +1,20 @@
 {
-  "version": "3.22.0",
-  "engineVersion": "f6344b75dcf861d8bf1f1322780b8811f982e31a",
-  "dartVersion": "3.4.0",
+  "version": "3.22.2",
+  "engineVersion": "edd8546116457bdf1c5bdfb13ecb9463d2bb5ed4",
+  "dartVersion": "3.4.3",
   "dartHash": {
-    "x86_64-linux": "sha256-oDqmWPHx7EwP4EOopZ4/pAG4kuW+CUCq1T/bHDrw2Z8=",
-    "aarch64-linux": "sha256-FRhGusQMp2noDnV4iE8t06sayGMInYCj7VxfrQxoV7U=",
-    "x86_64-darwin": "sha256-dJe18+sfgHsE2CQf05vBkynXp4Pf2otoVM/Kf5m11rU=",
-    "aarch64-darwin": "sha256-HC7/m3zYY98TnqIreOHixwJBxXCpFIof03TZ80xblfs="
+    "x86_64-linux": "sha256-wDIdoWoKlutP8kixd12Lppzv2aYeiTJ1A1Sy6lguXgg=",
+    "aarch64-linux": "sha256-sJBsZBA71Sht8wdUbPVzPv3Zf+vDJXY9w0a7ZC8/aF8=",
+    "x86_64-darwin": "sha256-XWDZae1bMeQsIOdv7BiMNneBKt6Xhras/QXtPukGyKA=",
+    "aarch64-darwin": "sha256-4D1e5EmBoA5eDw50EIVNsMjhCP33fNemmUD8/1WvxOM="
   },
-  "flutterHash": "sha256-UcpprC40itt3nbvENJVytD8M1EYSjKMlpAWJ+GmN7Pg=",
+  "flutterHash": "sha256-7ndnIw72YxNB+VeeejEeRD+xxuLXOcWo322s5CMWzBM=",
   "artifactHashes": {
     "android": {
-      "aarch64-darwin": "sha256-kpcfApS/KcyV1XMGw1YSHBSjJxNfl2WT5JVCe6eMcs8=",
-      "aarch64-linux": "sha256-FL7AYU/fULoX8lvllbUGiG5+RroOwf6bolzsvLmLePA=",
-      "x86_64-darwin": "sha256-kpcfApS/KcyV1XMGw1YSHBSjJxNfl2WT5JVCe6eMcs8=",
-      "x86_64-linux": "sha256-FL7AYU/fULoX8lvllbUGiG5+RroOwf6bolzsvLmLePA="
+      "aarch64-darwin": "sha256-loGG9c6F0cnc5ue7cD6Tk8b79LGijd9YSfKWjlXk+TI=",
+      "aarch64-linux": "sha256-lIxH729tt0p+5LkLguf1lBk7YdinXngKPL05W6XdVDg=",
+      "x86_64-darwin": "sha256-loGG9c6F0cnc5ue7cD6Tk8b79LGijd9YSfKWjlXk+TI=",
+      "x86_64-linux": "sha256-lIxH729tt0p+5LkLguf1lBk7YdinXngKPL05W6XdVDg="
     },
     "fuchsia": {
       "aarch64-darwin": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=",
@@ -23,38 +23,38 @@
       "x86_64-linux": "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk="
     },
     "ios": {
-      "aarch64-darwin": "sha256-tulW5ybnOCiIcUSLEXRlIgSmgZGA8NQHgFmLIpEvPUo=",
-      "aarch64-linux": "sha256-tulW5ybnOCiIcUSLEXRlIgSmgZGA8NQHgFmLIpEvPUo=",
-      "x86_64-darwin": "sha256-tulW5ybnOCiIcUSLEXRlIgSmgZGA8NQHgFmLIpEvPUo=",
-      "x86_64-linux": "sha256-tulW5ybnOCiIcUSLEXRlIgSmgZGA8NQHgFmLIpEvPUo="
+      "aarch64-darwin": "sha256-d/1d8/Md2tzf/Mu4d3RKHl5Jd8u5HzZSGfBKomt1mlo=",
+      "aarch64-linux": "sha256-d/1d8/Md2tzf/Mu4d3RKHl5Jd8u5HzZSGfBKomt1mlo=",
+      "x86_64-darwin": "sha256-d/1d8/Md2tzf/Mu4d3RKHl5Jd8u5HzZSGfBKomt1mlo=",
+      "x86_64-linux": "sha256-d/1d8/Md2tzf/Mu4d3RKHl5Jd8u5HzZSGfBKomt1mlo="
     },
     "linux": {
-      "aarch64-darwin": "sha256-eOBMqZkUTeFOfQHtrnx5KlERY2RLtqwDi9WOv0xcmVk=",
-      "aarch64-linux": "sha256-eOBMqZkUTeFOfQHtrnx5KlERY2RLtqwDi9WOv0xcmVk=",
-      "x86_64-darwin": "sha256-r6trOed2FniMMGLqoqiDKeaPUyAY9o2H63Oh4fPlW/c=",
-      "x86_64-linux": "sha256-r6trOed2FniMMGLqoqiDKeaPUyAY9o2H63Oh4fPlW/c="
+      "aarch64-darwin": "sha256-UYb2OOB0riL+Qrhpke0vYpo0U4buKYcbJRgYSpugJQc=",
+      "aarch64-linux": "sha256-UYb2OOB0riL+Qrhpke0vYpo0U4buKYcbJRgYSpugJQc=",
+      "x86_64-darwin": "sha256-ytfyeJeDnAGDsg98POe3fKAxpq8lNVYlV1wY6p2pkbU=",
+      "x86_64-linux": "sha256-ytfyeJeDnAGDsg98POe3fKAxpq8lNVYlV1wY6p2pkbU="
     },
     "macos": {
-      "aarch64-darwin": "sha256-TRwbutJABHyPUxNb2CBijc3sd3RTtnE/CgasVhKNj3g=",
-      "aarch64-linux": "sha256-TRwbutJABHyPUxNb2CBijc3sd3RTtnE/CgasVhKNj3g=",
-      "x86_64-darwin": "sha256-TRwbutJABHyPUxNb2CBijc3sd3RTtnE/CgasVhKNj3g=",
-      "x86_64-linux": "sha256-TRwbutJABHyPUxNb2CBijc3sd3RTtnE/CgasVhKNj3g="
+      "aarch64-darwin": "sha256-0XEdCeY1KTmtLz/cgZLSfDbjucXk0FpwVIDZuEPqngk=",
+      "aarch64-linux": "sha256-0XEdCeY1KTmtLz/cgZLSfDbjucXk0FpwVIDZuEPqngk=",
+      "x86_64-darwin": "sha256-0XEdCeY1KTmtLz/cgZLSfDbjucXk0FpwVIDZuEPqngk=",
+      "x86_64-linux": "sha256-0XEdCeY1KTmtLz/cgZLSfDbjucXk0FpwVIDZuEPqngk="
     },
     "universal": {
-      "aarch64-darwin": "sha256-05p8hCOMaZlrtsBp+t2Iw0DGLeGiD23NhB42LnoEFrs=",
-      "aarch64-linux": "sha256-y4NwCN+W0EjEpEwuU4u2Yg2hJB4GAdLv95nXUGZ1nWo=",
-      "x86_64-darwin": "sha256-l1M9+ODVGdBfJyt9Ew01vKRE/n2CjimwvcBohOAq/ns=",
-      "x86_64-linux": "sha256-SXCT9jDqFwES6wA8VyGzILbHFlDuslQ+ByOFZgRapVs="
+      "aarch64-darwin": "sha256-TLDwggTgVTe0+v5lCutysF4ygKPiA1b48ImyNDyl7oA=",
+      "aarch64-linux": "sha256-rTAX+i+OhyKIevwSFgoWRHw8bHuQCC0Lx/YVlbpwL6c=",
+      "x86_64-darwin": "sha256-1NztXAPG6HWjk7++TLkq791f5t3Va/wP0I2j3ddmURI=",
+      "x86_64-linux": "sha256-qWZQdDB+yd7i/Cx15K7KQmzbgzxWDeOwcsHkNeDwRqw="
     },
     "web": {
-      "aarch64-darwin": "sha256-urzQGJADfBUgYfo0i1WqMMsz75jZPrs1hn9ZMsEK9u0=",
-      "aarch64-linux": "sha256-urzQGJADfBUgYfo0i1WqMMsz75jZPrs1hn9ZMsEK9u0=",
-      "x86_64-darwin": "sha256-urzQGJADfBUgYfo0i1WqMMsz75jZPrs1hn9ZMsEK9u0=",
-      "x86_64-linux": "sha256-urzQGJADfBUgYfo0i1WqMMsz75jZPrs1hn9ZMsEK9u0="
+      "aarch64-darwin": "sha256-IFg4+IOJbb2Zi4axzL9FezCzp3kLr2gHmEWUupBmxlg=",
+      "aarch64-linux": "sha256-IFg4+IOJbb2Zi4axzL9FezCzp3kLr2gHmEWUupBmxlg=",
+      "x86_64-darwin": "sha256-IFg4+IOJbb2Zi4axzL9FezCzp3kLr2gHmEWUupBmxlg=",
+      "x86_64-linux": "sha256-IFg4+IOJbb2Zi4axzL9FezCzp3kLr2gHmEWUupBmxlg="
     },
     "windows": {
-      "x86_64-darwin": "sha256-vIFhEB7bMewDEu90rTVp/rrHtpijc5iKWCmnlKm52sA=",
-      "x86_64-linux": "sha256-vIFhEB7bMewDEu90rTVp/rrHtpijc5iKWCmnlKm52sA="
+      "x86_64-darwin": "sha256-gTnkbp6cJHiW9nFYIfnHYJ+vMG1nGV5nZLY0LgFQPtg=",
+      "x86_64-linux": "sha256-gTnkbp6cJHiW9nFYIfnHYJ+vMG1nGV5nZLY0LgFQPtg="
     }
   },
   "pubspecLock": {
diff --git a/pkgs/development/compilers/mlkit/default.nix b/pkgs/development/compilers/mlkit/default.nix
index cf0daa016bbc..5dbc219303a0 100644
--- a/pkgs/development/compilers/mlkit/default.nix
+++ b/pkgs/development/compilers/mlkit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlkit";
-  version = "4.7.10";
+  version = "4.7.11";
 
   src = fetchFromGitHub {
     owner = "melsman";
     repo = "mlkit";
     rev = "v${version}";
-    sha256 = "sha256-ZHNr920N8pmz6ho5keT8Q/svCj4efEhwYwagpB+pMf8=";
+    sha256 = "sha256-awjinXegc8jLd6OAB8QLDoXnotZhKbyfMWckp2U3MjA=";
   };
 
   nativeBuildInputs = [ autoreconfHook mlton ];
diff --git a/pkgs/development/interpreters/wamr/default.nix b/pkgs/development/interpreters/wamr/default.nix
index 58d9fb2ef592..06fc84eeae7e 100644
--- a/pkgs/development/interpreters/wamr/default.nix
+++ b/pkgs/development/interpreters/wamr/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wamr";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasm-micro-runtime";
     rev = "WAMR-${finalAttrs.version}";
-    hash = "sha256-7k7FRe1mBH/+r9M19pYGAHX5rt54AomeWDBW4lwCfu4=";
+    hash = "sha256-2jZnvfW/f928DxVwd+z/BVPNPWfbyV8Rjek23NQhFz8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 75ba9ab621b2..e11f18907055 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -5,6 +5,7 @@
 , cmake
 , deltachat-desktop
 , deltachat-repl
+, deltachat-rpc-server
 , openssl
 , perl
 , pkg-config
@@ -81,7 +82,7 @@ in stdenv.mkDerivation rec {
   passthru = {
     inherit cargoLock;
     tests = {
-      inherit deltachat-desktop deltachat-repl;
+      inherit deltachat-desktop deltachat-repl deltachat-rpc-server;
       python = python3.pkgs.deltachat;
     };
   };
diff --git a/pkgs/development/libraries/libplctag/default.nix b/pkgs/development/libraries/libplctag/default.nix
index de71d021d015..7a26cfe92705 100644
--- a/pkgs/development/libraries/libplctag/default.nix
+++ b/pkgs/development/libraries/libplctag/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libplctag";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchFromGitHub {
     owner = "libplctag";
     repo = "libplctag";
     rev = "v${version}";
-    sha256 = "sha256-eWtQaYUWZNQYQOUXnbUfjrtpoO6CnNJ8WjlowA49sG0=";
+    sha256 = "sha256-xrXgLdGY7pQ5m+X5kmkL6BRHJCxp7PYJuuowC+i2qxM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix
index 3b3a672e87f7..3f45d2e39c79 100644
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@@ -5,6 +5,6 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.100";
-  hash = "sha256-PlMCvSN4DMKY7u/7cr7kArrRve8YIfdycjgpik72bhA=";
+  version = "3.101";
+  hash = "sha256-lO+81zYBBFwqcjh4cd/fpiznHZ9rTJpfDW/yF8phYts=";
 }
diff --git a/pkgs/development/libraries/pinocchio/default.nix b/pkgs/development/libraries/pinocchio/default.nix
index 7b465c05ce90..9432722647ca 100644
--- a/pkgs/development/libraries/pinocchio/default.nix
+++ b/pkgs/development/libraries/pinocchio/default.nix
@@ -6,6 +6,7 @@
 , eigen
 , example-robot-data
 , collisionSupport ? !stdenv.isDarwin
+, console-bridge
 , jrl-cmakemodules
 , hpp-fcl
 , urdfdom
@@ -44,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   propagatedBuildInputs = [
+    console-bridge
     jrl-cmakemodules
     urdfdom
   ] ++ lib.optionals (!pythonSupport) [
diff --git a/pkgs/development/libraries/science/chemistry/plumed/default.nix b/pkgs/development/libraries/science/chemistry/plumed/default.nix
index b825c8270d62..b70d2146b2da 100644
--- a/pkgs/development/libraries/science/chemistry/plumed/default.nix
+++ b/pkgs/development/libraries/science/chemistry/plumed/default.nix
@@ -8,13 +8,13 @@ assert !blas.isILP64;
 
 stdenv.mkDerivation rec {
   pname = "plumed";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "plumed";
     repo = "plumed2";
     rev = "v${version}";
-    hash = "sha256-yL+59f908IhbxGIylI1ydi1BPZwAapjK/vP4/h5gcHk=";
+    hash = "sha256-68/ajM87ApEXUs4xPIq7Vfmzl7Ms4ck6jnjlIv7woMs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/spdk/default.nix b/pkgs/development/libraries/spdk/default.nix
index 3c3bf275d709..4541042ed5c5 100644
--- a/pkgs/development/libraries/spdk/default.nix
+++ b/pkgs/development/libraries/spdk/default.nix
@@ -23,13 +23,13 @@
 stdenv.mkDerivation rec {
   pname = "spdk";
 
-  version = "24.01";
+  version = "24.05";
 
   src = fetchFromGitHub {
     owner = "spdk";
     repo = "spdk";
     rev = "v${version}";
-    sha256 = "sha256-5znYELR6WvVXbfFKAcRtJnSwAE5WHmA8v1rvZUtszS4=";
+    sha256 = "sha256-kjZWaarvNSYXseJ/uH7Ak7DbWEgrLnAwXcL8byJ9fjU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/urdfdom-headers/default.nix b/pkgs/development/libraries/urdfdom-headers/default.nix
index 138597ad89a6..7809355cb301 100644
--- a/pkgs/development/libraries/urdfdom-headers/default.nix
+++ b/pkgs/development/libraries/urdfdom-headers/default.nix
@@ -2,20 +2,20 @@
 
 stdenv.mkDerivation rec {
   pname = "urdfdom-headers";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "ros";
     repo = "urdfdom_headers";
     rev = version;
-    hash = "sha256-ry5wDMRxR7TtupUghe9t1XP0XMvWKiOesO5RFHPrSdI=";
+    hash = "sha256-FQSnYuTc40MOxyFsMPfoCIonP+4AUQxdq74eoQ9tOoo=";
   };
 
   patches = [
     # Fix CMake relative install dir assumptions (https://github.com/ros/urdfdom_headers/pull/66)
     (fetchpatch {
-      url = "https://github.com/ros/urdfdom_headers/commit/c9c993147bbf18d5ec83bae684c5780281e529b4.patch";
-      hash = "sha256-BnYPdcetYSim2O1R38N0d1tY0Id++AgKNic8+dlM6Vg=";
+      url = "https://github.com/ros/urdfdom_headers/commit/6e0cea148c3a7123f8367cd48d5709a4490c32f1.patch";
+      hash = "sha256-LC2TACGma/k6+WE9fTkzY98SgJYKsVuj5O9v84Q5mQ4=";
     })
   ];
 
diff --git a/pkgs/development/libraries/urdfdom/default.nix b/pkgs/development/libraries/urdfdom/default.nix
index 6e59914044fc..f26162ac8c83 100644
--- a/pkgs/development/libraries/urdfdom/default.nix
+++ b/pkgs/development/libraries/urdfdom/default.nix
@@ -1,27 +1,28 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config, validatePkgConfig
-, urdfdom-headers, console-bridge, tinyxml }:
+, tinyxml-2, console-bridge, urdfdom-headers }:
 
 stdenv.mkDerivation rec {
   pname = "urdfdom";
-  version = "3.1.1";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "ros";
     repo = pname;
     rev = version;
-    hash = "sha256-UdkGJAXK3Q8QJaqMZBA5/FKUgWq9EVeqkqwVewTlTD8=";
+    hash = "sha256-t1ff5aRHE7LuQdCXuooWPDUgPWjyYyQmQUB1RJmte1w=";
   };
 
   patches = [
     # Fix CMake relative install dir assumptions (https://github.com/ros/urdfdom/pull/142)
     (fetchpatch {
-      url = "https://github.com/ros/urdfdom/commit/cbe6884d267779463bb444be851f6404e692cc0a.patch";
-      hash = "sha256-1gTRKIGqiSRion76bGecSfFJSBskYUJguUIa6ePIiX4=";
+      url = "https://github.com/ros/urdfdom/commit/61a7e35cd5abece97259e76aed8504052b2f5b53.patch";
+      hash = "sha256-b3bEbbaSUDkwTEHJ8gVPEb+AR/zuWwLqiAW5g1T1dPU=";
     })
   ];
 
   nativeBuildInputs = [ cmake pkg-config validatePkgConfig ];
-  propagatedBuildInputs = [ urdfdom-headers console-bridge tinyxml ];
+  buildInputs = [ tinyxml-2 console-bridge ];
+  propagatedBuildInputs = [ urdfdom-headers ];
 
   meta = with lib; {
     description = "Provides core data structures and a simple XML parser for populating the class data structures from an URDF file";
diff --git a/pkgs/development/mobile/genymotion/default.nix b/pkgs/development/mobile/genymotion/default.nix
index 80e82ec0208b..63000e5a1ce4 100644
--- a/pkgs/development/mobile/genymotion/default.nix
+++ b/pkgs/development/mobile/genymotion/default.nix
@@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "genymotion";
-  version = "3.7.0";
+  version = "3.7.1";
   src = fetchurl {
     url = "https://dl.genymotion.com/releases/genymotion-${version}/genymotion-${version}-linux_x64.bin";
     name = "genymotion-${version}-linux_x64.bin";
-    sha256 = "sha256-JBz6rfKm4hX+Mr+xU3VgzxbFKj+SDr9/ulJ6KrmzAnM=";
+    sha256 = "sha256-nWQZcYN2rxmN7J1OYkM+Oa2UIHztdAJ/eGY5MxNDX90=";
   };
 
   nativeBuildInputs = [ makeWrapper which xdg-utils ];
diff --git a/pkgs/development/ocaml-modules/magic-trace/default.nix b/pkgs/development/ocaml-modules/magic-trace/default.nix
index 8fdd92f81329..b4e1c557e812 100644
--- a/pkgs/development/ocaml-modules/magic-trace/default.nix
+++ b/pkgs/development/ocaml-modules/magic-trace/default.nix
@@ -17,7 +17,7 @@
 
 buildDunePackage rec {
   pname = "magic-trace";
-  version = "1.2.1";
+  version = "1.2.3";
 
   minimalOCamlVersion = "4.12";
 
@@ -25,7 +25,7 @@ buildDunePackage rec {
     owner = "janestreet";
     repo = "magic-trace";
     rev = "v${version}";
-    hash = "sha256-/9TDjCG/06mhGyqbjAdUmk6fcaq9fNDqVSw51w5EEy4=";
+    hash = "sha256-cAoaAXZOeWNQh6emm17a9oCis8s4jJxPQMI/NfiUa7g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/configparser/default.nix b/pkgs/development/python-modules/configparser/default.nix
index a8b4e2002a74..efe6362da480 100644
--- a/pkgs/development/python-modules/configparser/default.nix
+++ b/pkgs/development/python-modules/configparser/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "configparser";
-  version = "6.0.1";
+  version = "7.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jaraco";
     repo = "configparser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-r+poK+knBQi48Z1VrNFqUt9Qm9iGERAOTFa4bKfXi0g=";
+    hash = "sha256-OqlmAmBt4x+cJtK89dxsU7+Vn9wmGR9Djc59/ewHSxs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index e72e987779fb..18d2efa4bd06 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "huggingface-hub";
-  version = "0.23.2";
+  version = "0.23.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "huggingface_hub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-BXuFX4Y7t3Y3I/W3MIlUJ1zwTZ1CHpJ1aoHNHhnuz0M=";
+    hash = "sha256-878ijhVxvVvytYZTpCBbmo3GsU1bvOl2HXlPu0E/xtQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/itemadapter/default.nix b/pkgs/development/python-modules/itemadapter/default.nix
index f47d229c2a32..ac9250637a3a 100644
--- a/pkgs/development/python-modules/itemadapter/default.nix
+++ b/pkgs/development/python-modules/itemadapter/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "itemadapter";
-  version = "0.8.0";
+  version = "0.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d3WEhfsKwQcw1LExNj431ly42yRQv+x6V8PzJx9KSKk=";
+    hash = "sha256-5PlYpra29YMfogc3MBADGgvX7QQp3dCbUZecARR1yv0=";
   };
 
   # Infinite recursion with Scrapy
diff --git a/pkgs/development/python-modules/pydal/default.nix b/pkgs/development/python-modules/pydal/default.nix
index 58c47c79f5b2..e425d21f52e0 100644
--- a/pkgs/development/python-modules/pydal/default.nix
+++ b/pkgs/development/python-modules/pydal/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pydal";
-  version = "20240428.2";
+  version = "20240601.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Iz4PXbNKqwud9TYBFGlZYMYtq/QG9rzKn80gVWi8we8=";
+    hash = "sha256-t7Sl81YpdQZk4Q2ERz6jiJsD3ERmC8QVlr0d/RrNmhU=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/ratarmount/default.nix b/pkgs/development/python-modules/ratarmount/default.nix
index b5ef1f623db9..8e32579cb737 100644
--- a/pkgs/development/python-modules/ratarmount/default.nix
+++ b/pkgs/development/python-modules/ratarmount/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "ratarmount";
-  version = "0.15.0";
+  version = "0.15.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2slLshH07O+4PIU3dF9vX2ZcXjaUVyTFYc59LL2J5iY=";
+    hash = "sha256-hprXZGgE2fpg8Km3gWO60e7teUB4Age5skNPc4p+wIg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinx-design/default.nix b/pkgs/development/python-modules/sphinx-design/default.nix
index a159b4b1daf8..2b6fbde61ad3 100644
--- a/pkgs/development/python-modules/sphinx-design/default.nix
+++ b/pkgs/development/python-modules/sphinx-design/default.nix
@@ -9,16 +9,16 @@
 
 buildPythonPackage rec {
   pname = "sphinx-design";
-  version = "0.5.0";
+  version = "0.6.0";
 
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit version;
     pname = "sphinx_design";
-    hash = "sha256-6OUTrOpvktFcbeOzTpVEWPJFuOdhtFtjlQ9lNzNSqwA=";
+    hash = "sha256-7I48XFn+1ASbOlouIJNg/qsxgpNGtfagx8NCuJQIIZI=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index beff3c5aeb41..2bbd0135d615 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.17.3";
+  version = "2.17.4";
 
   dontConfigure = true;
   dontBuild = true;
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-g/+Hf+4cOkud+Gfj/2rqlZ6duzn3A3fkF6mXjXjTypA=";
+    hash = "sha256-4BfIu81e/XR23Kp8+b6/KRbuji2Od53a1urcyjXX1q8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/database/prqlc/default.nix b/pkgs/development/tools/database/prqlc/default.nix
index b62d357d9c7a..28664a88ae2f 100644
--- a/pkgs/development/tools/database/prqlc/default.nix
+++ b/pkgs/development/tools/database/prqlc/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "prqlc";
-  version = "0.11.4";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "prql";
     repo = "prql";
     rev = version;
-    hash = "sha256-YQqGy6BadoTjlCrF7N2PhxmXyuNa6V4sFHRphxQfF4o=";
+    hash = "sha256-FUF0O1Z5v9FRLfb1Ms6r2FM/Omc1AO+S7MxvmZ9SHSk=";
   };
 
-  cargoHash = "sha256-0UEbg6f+9eew5RxmuPsOrtiSBsP9mPMO8h5mJEeTFFU=";
+  cargoHash = "sha256-A3tFoRNmRDMYJyHYdgXHrlszW0D30EMk7hSo/8Z5gvk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/devpod/default.nix b/pkgs/development/tools/devpod/default.nix
index ce84ab242f44..2a1133bce774 100644
--- a/pkgs/development/tools/devpod/default.nix
+++ b/pkgs/development/tools/devpod/default.nix
@@ -23,13 +23,13 @@
 
 let
   pname = "devpod";
-  version = "0.5.8";
+  version = "0.5.12";
 
   src = fetchFromGitHub {
     owner = "loft-sh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fIksTguHaWlbwUWnANyb/ftx3Fhhiz8k5n7N/7lhspc=";
+    sha256 = "sha256-5JdA5isU4TNqOX8b2mLHLfVBkLNkh6SdaRUXdZHjEM0=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index 62f1230af5c7..b405a22d8a64 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.21.4";
+  version = "0.21.5";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-T/qbf6nMORVWD2G/hJtAlUlg7xep7Bw5zZnBvYoL5cQ=";
+    hash = "sha256-FpvXWIlt67G8w3pBKZo/mcp57LunxDmRUaCU/Ne89B8=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/goda/default.nix b/pkgs/development/tools/goda/default.nix
index df8de49277cf..ff8b0cecbc90 100644
--- a/pkgs/development/tools/goda/default.nix
+++ b/pkgs/development/tools/goda/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "goda";
-  version = "0.5.8";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "loov";
     repo = "goda";
     rev = "v${version}";
-    hash = "sha256-WmOe3MfFWUnFSuwntHUjN+NeeT7TdxfBOgciviYZC0Y=";
+    hash = "sha256-tkGIo4FWIFFMtp4rP0GJaF7B6lrmtjaAVx45G4wAPQg=";
   };
 
   vendorHash = "sha256-FYjlOYB0L4l6gF8hYtJroV1qMQD0ZmKWXBarjyConRs=";
diff --git a/pkgs/development/tools/minizinc/default.nix b/pkgs/development/tools/minizinc/default.nix
index 92a2177b666f..0a054fe43a1c 100644
--- a/pkgs/development/tools/minizinc/default.nix
+++ b/pkgs/development/tools/minizinc/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "minizinc";
-  version = "2.8.4";
+  version = "2.8.5";
 
   src = fetchFromGitHub {
     owner = "MiniZinc";
     repo = "libminizinc";
     rev = finalAttrs.version;
-    sha256 = "sha256-RpqjhjdG8u+gqO5SmKep5JpFhXh5GGX65qA15X+MNA4=";
+    sha256 = "sha256-AD5hbHnu5/gmhvk4Hzeqzvq3E/7w54ijxl9US5eATRY=";
   };
 
   nativeBuildInputs = [ bison cmake flex jq ];
diff --git a/pkgs/development/tools/misc/rsass/default.nix b/pkgs/development/tools/misc/rsass/default.nix
index 0e2e4d57823a..b71dca0b3953 100644
--- a/pkgs/development/tools/misc/rsass/default.nix
+++ b/pkgs/development/tools/misc/rsass/default.nix
@@ -2,15 +2,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rsass";
-  version = "0.28.8";
+  version = "0.28.10";
 
   src = fetchCrate {
     pname = "rsass-cli";
     inherit version;
-    hash = "sha256-eloTe7UHcPPmHEsGnfj3nIbZbBxSMFZdaSm5LpOh1S4=";
+    hash = "sha256-/2U1+kCRpM36r2fHB6Hditnm2dSVHh08M0RIi3AIe44=";
   };
 
-  cargoHash = "sha256-57vqVKqwQOEB33cSzGiZwadTDi7EyBBRAS4X9Euwp5Q=";
+  cargoHash = "sha256-pCQOFBs+lNdjcyOqZ/GjJyOthepnaWAM1feEpegdrDo=";
 
   meta = with lib; {
     description = "Sass reimplemented in rust with nom";
diff --git a/pkgs/development/tools/rust/cargo-binstall/default.nix b/pkgs/development/tools/rust/cargo-binstall/default.nix
index 737f8c3a2edc..ed32060f7f21 100644
--- a/pkgs/development/tools/rust/cargo-binstall/default.nix
+++ b/pkgs/development/tools/rust/cargo-binstall/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.6.8";
+  version = "1.6.9";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-VCAoY5bn5hsO+hkPtphDB0keFVsrowtFHivrpnTIcNo=";
+    hash = "sha256-gByMCbh/RswZFrGY176PcZbBeHRsD0mv8Om4xQ/1wTo=";
   };
 
-  cargoHash = "sha256-OQ7l7lqDISH21eZ5JGLdE8+cysptVTv5+EZ3PkMs9vg=";
+  cargoHash = "sha256-GPDDKFM2dxsjQcrNK7y2lydnqGnFBUMcDJZ420jmzlo=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/turso-cli/default.nix b/pkgs/development/tools/turso-cli/default.nix
index 4d2ed81a2f0f..7fe099fd69c4 100644
--- a/pkgs/development/tools/turso-cli/default.nix
+++ b/pkgs/development/tools/turso-cli/default.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "turso-cli";
-  version = "0.93.8";
+  version = "0.95.0";
 
   src = fetchFromGitHub {
     owner = "tursodatabase";
     repo = "turso-cli";
     rev = "v${version}";
-    hash = "sha256-glY1xWu38wZLo9eyPAR4NtGDfLl1BkaN+WICIACHECo=";
+    hash = "sha256-9QrDtqF9A3UhStKtwkq/FCULoJQz+RjS7yEolZbBLCw=";
   };
 
   vendorHash = "sha256-2NjdjB09WYzHjQEl2hMUWN1/xsj/Hlr8lVYU/pkxTqQ=";
diff --git a/pkgs/development/tools/web-ext/default.nix b/pkgs/development/tools/web-ext/default.nix
index e2feadf2f8ff..2c1688e38c02 100644
--- a/pkgs/development/tools/web-ext/default.nix
+++ b/pkgs/development/tools/web-ext/default.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "web-ext";
-  version = "7.11.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "web-ext";
     rev = version;
-    hash = "sha256-tXYqAAzxAFQGREkNGgBrHLp7ukRDMtr0bPYW7hOEniY=";
+    hash = "sha256-lMfvD5EVWpDcX54nJI3eReF/EMMuZYxtKdHKwk4Lrxk=";
   };
 
-  npmDepsHash = "sha256-uKAEWe28zUgE7Fv00sGXD5dKje/pHh22yJlYtk+7tN8=";
+  npmDepsHash = "sha256-RVyIpzVom48/avot9bbjXYg2E5+b3GlCHaKNfMEk968=";
 
   npmBuildFlags = [ "--production" ];
 
diff --git a/pkgs/games/chiaki4deck/default.nix b/pkgs/games/chiaki4deck/default.nix
index 54e3c978c4da..79757acef9cc 100644
--- a/pkgs/games/chiaki4deck/default.nix
+++ b/pkgs/games/chiaki4deck/default.nix
@@ -35,13 +35,13 @@
 
 stdenv.mkDerivation rec {
   pname = "chiaki4deck";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "streetpea";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dSipQH04NSB6t9ZmDq9cjFTmtabnzPRwL9ssmEEmEws=";
+    hash = "sha256-gh+ZOsAOi5mKZjs7B1xh07vatoD8F2j2HVxOT/fKDEo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/misc/fastly/default.nix b/pkgs/misc/fastly/default.nix
index fecc10a6d1ce..a0c71c2f1919 100644
--- a/pkgs/misc/fastly/default.nix
+++ b/pkgs/misc/fastly/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "fastly";
-  version = "10.11.0";
+  version = "10.12.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2RK+OTMlMGA0Y/LDifJjGZOzgv6/QoNSB2NXUEO5ry8=";
+    hash = "sha256-XH3EpVmaSfEJOt4rEhy0h+d1tMr8kayfSLLjf8VVbjc=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,
diff --git a/pkgs/servers/bazarr/default.nix b/pkgs/servers/bazarr/default.nix
index 04c5954e1863..e30beee899ef 100644
--- a/pkgs/servers/bazarr/default.nix
+++ b/pkgs/servers/bazarr/default.nix
@@ -8,13 +8,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bazarr";
-  version = "1.4.2";
+  version = "1.4.3";
 
   sourceRoot = ".";
 
   src = fetchurl {
     url = "https://github.com/morpheus65535/bazarr/releases/download/v${version}/bazarr.zip";
-    sha256 = "sha256-1OqbCyQmA33ZvyCE11ZSyVwEgyym0Y0EX6qx3g71lnQ=";
+    sha256 = "sha256-tmTdmUfRBRlB14juNxUo65Re+9agUBX0BBSuNu3pSC0=";
   };
 
   nativeBuildInputs = [ unzip makeWrapper ];
diff --git a/pkgs/servers/freeradius/default.nix b/pkgs/servers/freeradius/default.nix
index f82d766c7657..78912dc115c3 100644
--- a/pkgs/servers/freeradius/default.nix
+++ b/pkgs/servers/freeradius/default.nix
@@ -23,11 +23,11 @@ assert withRest -> withJson;
 
 stdenv.mkDerivation rec {
   pname = "freeradius";
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchurl {
     url = "ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-${version}.tar.gz";
-    hash = "sha256-S94EcSLliMY/4tWZpz96uahjgG+ecW6Io9dwgLSCxXc=";
+    hash = "sha256-/dR2lJ88mRwZ8U73GZtSLlIEiW0TnGmUY4Hc6biSKUE=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/servers/metabase/default.nix b/pkgs/servers/metabase/default.nix
index 9da492fb20fa..0b7822a3c548 100644
--- a/pkgs/servers/metabase/default.nix
+++ b/pkgs/servers/metabase/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "metabase";
-  version = "0.49.11";
+  version = "0.49.12";
 
   src = fetchurl {
     url = "https://downloads.metabase.com/v${version}/metabase.jar";
-    hash = "sha256-sLQdIjj2bB4Kebwn2fi6mwz2zym/Sv5l42dWAz5DrAg=";
+    hash = "sha256-+THQ4i7wMO/76MNjdvDoqstFcXknZ5/F82TNXn07gnQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index 0dae325ae5d0..946c485f6efc 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.60.0";
+  version = "1.61.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-eqS/qlrktlKiM1GAYI0CoJxjxc4a1ODyosEFITnmKTE=";
+    sha256 = "sha256-ZfjOsPUr72Ex+5SR2oVMybbR20hwqlto3teTJcdtALA=";
   };
 
   vendorHash = "sha256-nrEglhb22LANgm6hiZToPVPfGpkpxpJ7TQlLW0Z7+/4=";
diff --git a/pkgs/servers/nosql/mongodb/5.0.nix b/pkgs/servers/nosql/mongodb/5.0.nix
index e6738239358d..d74bf1e2f3d4 100644
--- a/pkgs/servers/nosql/mongodb/5.0.nix
+++ b/pkgs/servers/nosql/mongodb/5.0.nix
@@ -1,4 +1,7 @@
-{ stdenv, callPackage, lib, sasl, boost, Security, CoreFoundation, cctools }:
+{ stdenv, callPackage, lib, sasl, boost
+, Security, CoreFoundation, cctools
+, avxSupport ? stdenv.hostPlatform.avxSupport
+}:
 
 let
   buildMongoDB = callPackage ./mongodb.nix {
@@ -6,8 +9,8 @@ let
   };
   variants = if stdenv.isLinux then
     {
-      version = "5.0.26";
-      sha256 = "sha256-lVRTrEnwuyKETFL1C8bVqBfrDaYrbQIdmHN42CF8ZIw=";
+      version = "5.0.27";
+      sha256 = "sha256-++Qv3H6iVN8p0Jq3vx44DZCNh90vY5fAWKgP402bLlw=";
       patches = [ ./fix-build-with-boost-1.79-5_0-linux.patch ];
     }
   else lib.optionalAttrs stdenv.isDarwin
@@ -18,6 +21,7 @@ let
     };
 in
 buildMongoDB {
+  inherit avxSupport;
   version = variants.version;
   sha256 = variants.sha256;
   patches = [
diff --git a/pkgs/servers/nosql/mongodb/6.0.nix b/pkgs/servers/nosql/mongodb/6.0.nix
index 77d825d185f3..64be3b1f5f90 100644
--- a/pkgs/servers/nosql/mongodb/6.0.nix
+++ b/pkgs/servers/nosql/mongodb/6.0.nix
@@ -1,4 +1,7 @@
-{ stdenv, callPackage, lib, fetchpatch, sasl, boost, Security, CoreFoundation, cctools }:
+{ stdenv, callPackage, lib, fetchpatch
+, sasl, boost, Security, CoreFoundation, cctools
+, avxSupport ? stdenv.hostPlatform.avxSupport
+}:
 
 let
   buildMongoDB = callPackage ./mongodb.nix {
@@ -6,6 +9,7 @@ let
   };
 in
 buildMongoDB {
+  inherit avxSupport;
   version = "6.0.15";
   sha256 = "sha256-DX1wbrDx1/JrEHbzNaXC4Hqq7MrLqz+JZgG98beyVds=";
   patches = [
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index 59b20f49321a..2b304aa212ee 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -29,6 +29,7 @@ with lib;
 
 { version, sha256, patches ? []
 , license ? lib.licenses.sspl
+, avxSupport ? stdenv.hostPlatform.avxSupport
 }:
 
 let
@@ -114,6 +115,9 @@ in stdenv.mkDerivation rec {
     # don't fail by default on i686
     substituteInPlace src/mongo/db/storage/storage_options.h \
       --replace 'engine("wiredTiger")' 'engine("mmapv1")'
+  '' + lib.optionalString (!avxSupport) ''
+    substituteInPlace SConstruct \
+      --replace-fail "default=['+sandybridge']," 'default=[],'
   '';
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
diff --git a/pkgs/servers/nosql/questdb/default.nix b/pkgs/servers/nosql/questdb/default.nix
index 835a02efe60e..0cfe31bc8ed9 100644
--- a/pkgs/servers/nosql/questdb/default.nix
+++ b/pkgs/servers/nosql/questdb/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "questdb";
-  version = "7.4.2";
+  version = "8.0.0";
 
   src = fetchurl {
     url = "https://github.com/questdb/questdb/releases/download/${finalAttrs.version}/questdb-${finalAttrs.version}-no-jre-bin.tar.gz";
-    hash = "sha256-NrtxAqXs0tEsWeixaRWvWYFA6RJ0Z0m5kCZjgn3JpVU=";
+    hash = "sha256-cvfacdMPb/w/muaKXm6SQMAJLSjxP+D9/YmpgsYAYEw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/search/groonga/default.nix b/pkgs/servers/search/groonga/default.nix
index f23f3e11e810..36192f2fc5ff 100644
--- a/pkgs/servers/search/groonga/default.nix
+++ b/pkgs/servers/search/groonga/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "groonga";
-  version = "14.0.2";
+  version = "14.0.4";
 
   src = fetchurl {
     url = "https://packages.groonga.org/source/groonga/groonga-${finalAttrs.version}.tar.gz";
-    hash = "sha256-o9C6lPOPkb2KCbF4CqLyKtXHfOdB3jAIv5P6SjTJAJc=";
+    hash = "sha256-8ppuiEAc25BDcWSiL28ehGfdarnBc4vnGTO+nLl6RsY=";
   };
 
   patches = [
diff --git a/pkgs/servers/snac2/default.nix b/pkgs/servers/snac2/default.nix
index 88b809f791fe..fd35bb64452d 100644
--- a/pkgs/servers/snac2/default.nix
+++ b/pkgs/servers/snac2/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "snac2";
-  version = "2.53";
+  version = "2.55";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = pname;
     rev = version;
-    hash = "sha256-YSopopSJIcONw4utEBWhrfVglD5rTdf/rGNICFBHTvo=";
+    hash = "sha256-mhypzpdIr4XxsVsUhx2SGi3RiKpWiiIRNZm44Dl4FRs=";
   };
 
   buildInputs = [ curl openssl ];
diff --git a/pkgs/servers/sonarr/default.nix b/pkgs/servers/sonarr/default.nix
index 9b2b11ddf1c0..b2ea1080c30b 100644
--- a/pkgs/servers/sonarr/default.nix
+++ b/pkgs/servers/sonarr/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, dotnet-runtime, icu, ffmpeg, openssl, sqlite, curl, makeWrapper, nixosTests }:
+{ lib, stdenv, fetchurl, dotnet-runtime, icu, ffmpeg, openssl, sqlite, curl, makeWrapper, nixosTests, zlib }:
 
 let
   os = if stdenv.isDarwin then "osx" else "linux";
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     makeWrapper "${dotnet-runtime}/bin/dotnet" $out/bin/NzbDrone \
       --add-flags "$out/share/sonarr-${version}/Sonarr.dll" \
       --prefix PATH : ${lib.makeBinPath [ ffmpeg ]} \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ curl sqlite openssl icu ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ curl sqlite openssl icu zlib ]}
 
     runHook postInstall
   '';
diff --git a/pkgs/servers/sql/dolt/default.nix b/pkgs/servers/sql/dolt/default.nix
index 46d7a1b693b6..7f411241e780 100644
--- a/pkgs/servers/sql/dolt/default.nix
+++ b/pkgs/servers/sql/dolt/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "dolt";
-  version = "1.39.1";
+  version = "1.39.4";
 
   src = fetchFromGitHub {
     owner = "dolthub";
     repo = "dolt";
     rev = "v${version}";
-    sha256 = "sha256-kyydEH+9e3ubNtJExrPBcYH78F+9/64cjdT6s6WxXgM=";
+    sha256 = "sha256-8xds2FpNUfCfpekSuGKqY2Q6ULvpcfbuMC2/1QU5VEQ=";
   };
 
   modRoot = "./go";
   subPackages = [ "cmd/dolt" ];
-  vendorHash = "sha256-u+WiLgX4hzxam/1RFV8qjTr42yenz74x6O0ZQR+jdW0=";
+  vendorHash = "sha256-0vAoACwwBhbK/GvxKE+1aZGPM0DsHyrhDOSzAgHlWAI=";
   proxyVendor = true;
   doCheck = false;
 
diff --git a/pkgs/servers/tracing/tempo/default.nix b/pkgs/servers/tracing/tempo/default.nix
index c3adde573273..fbd633b43cff 100644
--- a/pkgs/servers/tracing/tempo/default.nix
+++ b/pkgs/servers/tracing/tempo/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "tempo";
-  version = "2.4.2";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "tempo";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-n7jv9Ki3cLlPDzm9IT0XLTT8t1nlifI0+SRAV6XDJlA=";
+    hash = "sha256-SSAeJOOd282Mnmaj/W5sM8J64qvD9/0SvlbHUtXYYF8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/X11/ckbcomp/default.nix b/pkgs/tools/X11/ckbcomp/default.nix
index 3a49053efcf4..bbc619bf8297 100644
--- a/pkgs/tools/X11/ckbcomp/default.nix
+++ b/pkgs/tools/X11/ckbcomp/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ckbcomp";
-  version = "1.226";
+  version = "1.227";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "console-setup";
     rev = version;
-    sha256 = "sha256-gipUL+EqBeFK0/3Ds5Xi67Kl/XEJkUe02lPhf7OifXY=";
+    sha256 = "sha256-95En8WDGad6s6PkUbDOs/I+DJ7A7tRyIq+Ets1kDPKM=";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/tools/X11/xpra/libfakeXinerama.nix b/pkgs/tools/X11/xpra/libfakeXinerama.nix
index ca665259c8f3..4ec1f7f4370d 100644
--- a/pkgs/tools/X11/xpra/libfakeXinerama.nix
+++ b/pkgs/tools/X11/xpra/libfakeXinerama.nix
@@ -12,22 +12,29 @@ stdenv.mkDerivation  rec {
   buildInputs = [ libX11 libXinerama ];
 
   buildPhase = ''
-    gcc -O2 -Wall fakeXinerama.c -fPIC -o libfakeXinerama.so.1.0 -shared
+    runHook preBuild
+
+    $CC -O2 -Wall fakeXinerama.c -fPIC -o libfakeXinerama.so.1.0 -shared
+
+    runHook postBuild
   '';
 
   installPhase = ''
-    mkdir -p $out/lib
-    cp libfakeXinerama.so.1.0 $out/lib
-    ln -s libfakeXinerama.so.1.0 $out/lib/libXinerama.so.1.0
-    ln -s libXinerama.so.1.0 $out/lib/libXinerama.so.1
-    ln -s libXinerama.so.1 $out/lib/libXinerama.so
+    runHook preInstall
+
+    install -Dm555 libfakeXinerama.so.1.0 -t "$out/lib"
+    ln -s libfakeXinerama.so.1.0 "$out/lib/libXinerama.so.1.0"
+    ln -s libXinerama.so.1.0 "$out/lib/libXinerama.so.1"
+    ln -s libXinerama.so.1 "$out/lib/libXinerama.so"
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "http://xpra.org/";
     description = "fakeXinerama for Xpra";
-    platforms = platforms.linux;
-    maintainers = [ ];
-    license = licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.nickcao ];
+    license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/tools/admin/granted/default.nix b/pkgs/tools/admin/granted/default.nix
index d48d5136258a..2886a08d84b8 100644
--- a/pkgs/tools/admin/granted/default.nix
+++ b/pkgs/tools/admin/granted/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "granted";
-  version = "0.27.2";
+  version = "0.27.4";
 
   src = fetchFromGitHub {
     owner = "common-fate";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VsE6CozVl+g+tAGQnf2q1lzKuxIMwbziQ2S76dY542A=";
+    sha256 = "sha256-JVeOWAuFxMLDhpFreN4YAXoDytNf/t1yQwNXKRd8ml8=";
   };
 
-  vendorHash = "sha256-ScWYqbhWwhrTh+k4LNkapiJbrRRSwxnxPT44lt048vw=";
+  vendorHash = "sha256-/X7kHaBZyDV4IqvKqyR7pAQLgYqIvcvSSh0NdrA5d3I=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/admin/simp_le/default.nix b/pkgs/tools/admin/simp_le/default.nix
index cf908ba33550..9b6cd8fe5c9c 100644
--- a/pkgs/tools/admin/simp_le/default.nix
+++ b/pkgs/tools/admin/simp_le/default.nix
@@ -1,12 +1,18 @@
-{ lib, python3Packages, fetchPypi, bash }:
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+  bash,
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "simp_le-client";
-  version = "0.17.0";
+  version = "0.20.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0m1jynar4calaffp2zdxr5yy9vnhw2qf2hsfxwzfwf8fqb5h7bjb";
+    hash = "sha256-p6+OF8MuAzcdTV4/CvZpjGaOrg7xcNuEddk7yC2sXIE=";
   };
 
   postPatch = ''
@@ -16,19 +22,33 @@ python3Packages.buildPythonApplication rec {
       --replace "/bin/sh" "${bash}/bin/sh"
   '';
 
+  # both setuptools-scm and mock are runtime dependencies
+  dependencies = with python3Packages; [
+    acme
+    cryptography
+    setuptools-scm
+    josepy
+    idna
+    mock
+    pyopenssl
+    pytz
+    six
+  ];
+
   checkPhase = ''
+    runHook preCheck
     $out/bin/simp_le --test
+    runHook postCheck
   '';
 
-  propagatedBuildInputs = with python3Packages; [ acme setuptools-scm josepy idna ];
-
-  nativeCheckInputs = with python3Packages; [ mock ];
-
   meta = with lib; {
     homepage = "https://github.com/zenhack/simp_le";
     description = "Simple Let's Encrypt client";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ gebner makefu ];
+    maintainers = with maintainers; [
+      gebner
+      makefu
+    ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/bluetooth/blueman/default.nix b/pkgs/tools/bluetooth/blueman/default.nix
index 0266198b1deb..1f66be687bc9 100644
--- a/pkgs/tools/bluetooth/blueman/default.nix
+++ b/pkgs/tools/bluetooth/blueman/default.nix
@@ -8,11 +8,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "blueman";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchurl {
     url = "https://github.com/blueman-project/blueman/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-B9jePkpBLFkOoPqTlQ32suSHsDF6QI7Cnh1qwiutYNs=";
+    sha256 = "sha256-B6COCPNtzXxAT9Ve70N5WvWR2VFLKviWPfIg76BLIa0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/games/steam-rom-manager/default.nix b/pkgs/tools/games/steam-rom-manager/default.nix
index 382c4c56b12a..6f4e7e0de333 100644
--- a/pkgs/tools/games/steam-rom-manager/default.nix
+++ b/pkgs/tools/games/steam-rom-manager/default.nix
@@ -2,11 +2,11 @@
 
 appimageTools.wrapType2 rec {
   name = "steam-rom-manager";
-  version = "2.5.8";
+  version = "2.5.9";
 
   src = fetchurl {
     url = "https://github.com/SteamGridDB/steam-rom-manager/releases/download/v${version}/Steam-ROM-Manager-${version}.AppImage";
-    sha256 = "sha256-o1aovkRynJNst3os1YuSo3H94sesSgN7bPloLPyuOnE=";
+    sha256 = "sha256-jBRDlCOPamTwjE4x6J6MoN1EQBmILJ+yPMez/0f6F9c=";
   };
 
   extraInstallCommands = let
diff --git a/pkgs/tools/misc/staruml/default.nix b/pkgs/tools/misc/staruml/default.nix
index 598627071e32..d98225ac365f 100644
--- a/pkgs/tools/misc/staruml/default.nix
+++ b/pkgs/tools/misc/staruml/default.nix
@@ -24,12 +24,12 @@ let
   ];
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "6.1.0";
+  version = "6.1.1";
   pname = "staruml";
 
   src = fetchurl {
       url = "https://files.staruml.io/releases-v6/StarUML_${finalAttrs.version}_amd64.deb";
-      sha256 = "sha256-ULdrAQCiQlTN+aRhETj+ASMKkKctFgC2AfvUHGc6stU=";
+      sha256 = "sha256-AtWzGEegKUDeNLhklm74JNQQqBzdOE4MUYBFp9ubd2A=";
     };
 
   nativeBuildInputs = [ wrapGAppsHook3 dpkg ];
diff --git a/pkgs/tools/networking/hysteria/default.nix b/pkgs/tools/networking/hysteria/default.nix
index f51d3e3b41d6..0d3dcb3cabcd 100644
--- a/pkgs/tools/networking/hysteria/default.nix
+++ b/pkgs/tools/networking/hysteria/default.nix
@@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
   pname = "hysteria";
-  version = "2.4.4";
+  version = "2.4.5";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = pname;
     rev = "app/v${version}";
-    hash = "sha256-p6h9cZYSxyMgLaVASnbHk6Bjdt6tTqj/9vhTS/CaiWA=";
+    hash = "sha256-dRVTlH+g/pwwacrdof3n8OeLMsgZswpOwvtAx13bZGo=";
   };
 
-  vendorHash = "sha256-DiwF8QuEs5JaSL+G6aycW01bXnQtL/GTd5kYsYeJUD4=";
+  vendorHash = "sha256-nrcREOp92jIB8CzdOevYufpIN6l9Tcg/B4tT15d5TOE=";
   proxyVendor = true;
 
   ldflags =
diff --git a/pkgs/tools/security/crowdsec/default.nix b/pkgs/tools/security/crowdsec/default.nix
index eb3c3cd229e5..d53fbce80800 100644
--- a/pkgs/tools/security/crowdsec/default.nix
+++ b/pkgs/tools/security/crowdsec/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "crowdsec";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "crowdsecurity";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-CCQDMIBpKmaUSRwyjryTO3YWVIrr6FwW64K+alTrcdw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3GpSpADtCNvekR7gjbIlqzog7PMog6Sra5tpcnUf/gk=";
   };
 
-  vendorHash = "sha256-K38hxWcrYOznXr8eST0xQBL0nNxHMAiGji5rFwAK0Qw=";
+  vendorHash = "sha256-kkQYKiOSmFHjhOrYV40YRZX9w6rUue0NSKfw+Bqxb9s=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/system/consul-template/default.nix b/pkgs/tools/system/consul-template/default.nix
index d9571cfcaa8d..ae095eabd423 100644
--- a/pkgs/tools/system/consul-template/default.nix
+++ b/pkgs/tools/system/consul-template/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "consul-template";
-  version = "0.37.6";
+  version = "0.38.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "consul-template";
     rev = "v${version}";
-    hash = "sha256-YkhU8BFSQpYUfgB5CxtaRJOghfH1uu1gpvArIeWHXEI=";
+    hash = "sha256-zpoYketdEiiF25K0juIP8Y+yjBsc9Jfx0W17QN/vEyo=";
   };
 
-  vendorHash = "sha256-3Z8EiO48+OAg/TnoKUuokLBSXnUUrxe8ZgE1nrILFSg=";
+  vendorHash = "sha256-CjDVVgJq9LaVDxWRy2RN/ItaBmmulfBQ4ms0he51lqA=";
 
   # consul-template tests depend on vault and consul services running to
   # execute tests so we skip them here
diff --git a/pkgs/tools/system/openipmi/default.nix b/pkgs/tools/system/openipmi/default.nix
index 739c10ad7934..2102f9e52b7b 100644
--- a/pkgs/tools/system/openipmi/default.nix
+++ b/pkgs/tools/system/openipmi/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, popt, ncurses, python3, readline, lib }:
+{ stdenv, fetchurl, popt, ncurses, python3, readline, lib, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "OpenIPMI";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-sFkRT2KZ1z8E/252oIV6Crgao2Le6ZZE0layI4ckN60=";
   };
 
-  buildInputs = [ ncurses popt python3 readline ];
+  buildInputs = [ ncurses popt python3 readline openssl ];
 
   outputs = [ "out" "lib" "dev" "man" ];
 
diff --git a/pkgs/tools/text/fanficfare/default.nix b/pkgs/tools/text/fanficfare/default.nix
index df0c9d2ca6f7..9aee49e391d9 100644
--- a/pkgs/tools/text/fanficfare/default.nix
+++ b/pkgs/tools/text/fanficfare/default.nix
@@ -2,12 +2,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "fanficfare";
-  version = "4.34.0";
+  version = "4.35.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aYXTu/sYBqI45BcCIsC4Fdi+nnvK3eqDqvpsV1wNdXc=";
+    hash = "sha256-hPBURlsrr/7c26YFZo5UT7PTs8s+D8BXxjU/uposHjQ=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6e8b51fbc804..04c2c05dadbb 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12848,6 +12848,7 @@ with self; {
       url = "mirror://cpan/authors/id/L/LD/LDS/IO-Interface-1.09.tar.gz";
       hash = "sha256-5j6BxS6x4OYOwtmD9VUtJJPhFxeZJclnV/I8S9n6cTo=";
     };
+    nativeBuildInputs = lib.optionals stdenv.isDarwin [ pkgs.ld-is-cc-hook ];
     meta = {
       description = "Access and modify network interface card configuration";
       license = with lib.licenses; [ artistic1 gpl1Plus ];