diff --git a/doc/build-helpers/testers.chapter.md b/doc/build-helpers/testers.chapter.md
index 4e5abd546d46..35f9290ecbfb 100644
--- a/doc/build-helpers/testers.chapter.md
+++ b/doc/build-helpers/testers.chapter.md
@@ -1,4 +1,5 @@
 # Testers {#chap-testers}
+
 This chapter describes several testing builders which are available in the `testers` namespace.
 
 ## `hasPkgConfigModules` {#tester-hasPkgConfigModules}
@@ -6,19 +7,11 @@ This chapter describes several testing builders which are available in the `test
 <!-- Old anchor name so links still work -->
 []{#tester-hasPkgConfigModule}
 Checks whether a package exposes a given list of `pkg-config` modules.
-If the `moduleNames` argument is omitted, `hasPkgConfigModules` will
-use `meta.pkgConfigModules`.
+If the `moduleNames` argument is omitted, `hasPkgConfigModules` will use `meta.pkgConfigModules`.
 
-Example:
+:::{.example #ex-haspkgconfigmodules-defaultvalues}
 
-```nix
-passthru.tests.pkg-config = testers.hasPkgConfigModules {
-  package = finalAttrs.finalPackage;
-  moduleNames = [ "libfoo" ];
-};
-```
-
-If the package in question has `meta.pkgConfigModules` set, it is even simpler:
+# Check that `pkg-config` modules are exposed using default values
 
 ```nix
 passthru.tests.pkg-config = testers.hasPkgConfigModules {
@@ -28,6 +21,21 @@ passthru.tests.pkg-config = testers.hasPkgConfigModules {
 meta.pkgConfigModules = [ "libfoo" ];
 ```
 
+:::
+
+:::{.example #ex-haspkgconfigmodules-explicitmodules}
+
+# Check that `pkg-config` modules are exposed using explicit module names
+
+```nix
+passthru.tests.pkg-config = testers.hasPkgConfigModules {
+  package = finalAttrs.finalPackage;
+  moduleNames = [ "libfoo" ];
+};
+```
+
+:::
+
 ## `testVersion` {#tester-testVersion}
 
 Checks that the output from running a command contains the specified version string in it as a whole word.
@@ -83,7 +91,18 @@ This returns a derivation with an override on the builder, with the following ef
  - Move `$out` to `$out/result`, if it exists (assuming `out` is the default output)
  - Save the build log to `$out/testBuildFailure.log` (same)
 
-Example:
+While `testBuildFailure` is designed to keep changes to the original builder's environment to a minimum, some small changes are inevitable:
+
+ - The file `$TMPDIR/testBuildFailure.log` is present. It should not be deleted.
+ - `stdout` and `stderr` are a pipe instead of a tty. This could be improved.
+ - One or two extra processes are present in the sandbox during the original builder's execution.
+ - The derivation and output hashes are different, but not unusual.
+ - The derivation includes a dependency on `buildPackages.bash` and `expect-failure.sh`, which is built to include a transitive dependency on `buildPackages.coreutils` and possibly more.
+   These are not added to `PATH` or any other environment variable, so they should be hard to observe.
+
+:::{.example #ex-testBuildFailure-showingenvironmentchanges}
+
+# Check that a build fails, and verify the changes made during build
 
 ```nix
 runCommand "example" {
@@ -100,24 +119,15 @@ runCommand "example" {
 '';
 ```
 
-While `testBuildFailure` is designed to keep changes to the original builder's
-environment to a minimum, some small changes are inevitable.
-
- - The file `$TMPDIR/testBuildFailure.log` is present. It should not be deleted.
- - `stdout` and `stderr` are a pipe instead of a tty. This could be improved.
- - One or two extra processes are present in the sandbox during the original
-   builder's execution.
- - The derivation and output hashes are different, but not unusual.
- - The derivation includes a dependency on `buildPackages.bash` and
-   `expect-failure.sh`, which is built to include a transitive dependency on
-   `buildPackages.coreutils` and possibly more. These are not added to `PATH`
-   or any other environment variable, so they should be hard to observe.
+:::
 
 ## `testEqualContents` {#tester-equalContents}
 
 Check that two paths have the same contents.
 
-Example:
+:::{.example #ex-testEqualContents-toyexample}
+
+# Check that two paths have the same contents
 
 ```nix
 testers.testEqualContents {
@@ -137,17 +147,20 @@ testers.testEqualContents {
 }
 ```
 
+:::
+
 ## `testEqualDerivation` {#tester-testEqualDerivation}
 
 Checks that two packages produce the exact same build instructions.
 
-This can be used to make sure that a certain difference of configuration,
-such as the presence of an overlay does not cause a cache miss.
+This can be used to make sure that a certain difference of configuration, such as the presence of an overlay does not cause a cache miss.
 
 When the derivations are equal, the return value is an empty file.
 Otherwise, the build log explains the difference via `nix-diff`.
 
-Example:
+:::{.example #ex-testEqualDerivation-hello}
+
+# Check that two packages produce the same derivation
 
 ```nix
 testers.testEqualDerivation
@@ -156,29 +169,28 @@ testers.testEqualDerivation
   (hello.overrideAttrs(o: { doCheck = true; }))
 ```
 
+:::
+
 ## `invalidateFetcherByDrvHash` {#tester-invalidateFetcherByDrvHash}
 
 Use the derivation hash to invalidate the output via name, for testing.
 
 Type: `(a@{ name, ... } -> Derivation) -> a -> Derivation`
 
-Normally, fixed output derivations can and should be cached by their output
-hash only, but for testing we want to re-fetch everytime the fetcher changes.
+Normally, fixed output derivations can and should be cached by their output hash only, but for testing we want to re-fetch everytime the fetcher changes.
 
-Changes to the fetcher become apparent in the drvPath, which is a hash of
-how to fetch, rather than a fixed store path.
-By inserting this hash into the name, we can make sure to re-run the fetcher
-every time the fetcher changes.
+Changes to the fetcher become apparent in the drvPath, which is a hash of how to fetch, rather than a fixed store path.
+By inserting this hash into the name, we can make sure to re-run the fetcher every time the fetcher changes.
 
-This relies on the assumption that Nix isn't clever enough to reuse its
-database of local store contents to optimize fetching.
+This relies on the assumption that Nix isn't clever enough to reuse its database of local store contents to optimize fetching.
 
-You might notice that the "salted" name derives from the normal invocation,
-not the final derivation. `invalidateFetcherByDrvHash` has to invoke the fetcher
-function twice: once to get a derivation hash, and again to produce the final
-fixed output derivation.
+You might notice that the "salted" name derives from the normal invocation, not the final derivation.
+`invalidateFetcherByDrvHash` has to invoke the fetcher function twice:
+once to get a derivation hash, and again to produce the final fixed output derivation.
 
-Example:
+:::{.example #ex-invalidateFetcherByDrvHash-nix}
+
+# Prevent nix from reusing the output of a fetcher
 
 ```nix
 tests.fetchgit = testers.invalidateFetcherByDrvHash fetchgit {
@@ -189,13 +201,17 @@ tests.fetchgit = testers.invalidateFetcherByDrvHash fetchgit {
 };
 ```
 
+:::
+
 ## `runNixOSTest` {#tester-runNixOSTest}
 
 A helper function that behaves exactly like the NixOS `runTest`, except it also assigns this Nixpkgs package set as the `pkgs` of the test and makes the `nixpkgs.*` options read-only.
 
 If your test is part of the Nixpkgs repository, or if you need a more general entrypoint, see ["Calling a test" in the NixOS manual](https://nixos.org/manual/nixos/stable/index.html#sec-calling-nixos-tests).
 
-Example:
+:::{.example #ex-runNixOSTest-hello}
+
+# Run a NixOS test using `runNixOSTest`
 
 ```nix
 pkgs.testers.runNixOSTest ({ lib, ... }: {
@@ -209,19 +225,17 @@ pkgs.testers.runNixOSTest ({ lib, ... }: {
 })
 ```
 
+:::
+
 ## `nixosTest` {#tester-nixosTest}
 
 Run a NixOS VM network test using this evaluation of Nixpkgs.
 
 NOTE: This function is primarily for external use. NixOS itself uses `make-test-python.nix` directly. Packages defined in Nixpkgs [reuse NixOS tests via `nixosTests`, plural](#ssec-nixos-tests-linking).
 
-It is mostly equivalent to the function `import ./make-test-python.nix` from the
-[NixOS manual](https://nixos.org/nixos/manual/index.html#sec-nixos-tests),
-except that the current application of Nixpkgs (`pkgs`) will be used, instead of
-letting NixOS invoke Nixpkgs anew.
+It is mostly equivalent to the function `import ./make-test-python.nix` from the [NixOS manual](https://nixos.org/nixos/manual/index.html#sec-nixos-tests), except that the current application of Nixpkgs (`pkgs`) will be used, instead of letting NixOS invoke Nixpkgs anew.
 
-If a test machine needs to set NixOS options under `nixpkgs`, it must set only the
-`nixpkgs.pkgs` option.
+If a test machine needs to set NixOS options under `nixpkgs`, it must set only the `nixpkgs.pkgs` option.
 
 ### Parameter {#tester-nixosTest-parameter}
 
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 5b330b245823..c66301bcb1c8 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -261,14 +261,50 @@ For more complex cases, like libraries linked into an executable which is then e
 
 As described in the Nix manual, almost any `*.drv` store path in a derivation’s attribute set will induce a dependency on that derivation. `mkDerivation`, however, takes a few attributes intended to include all the dependencies of a package. This is done both for structure and consistency, but also so that certain other setup can take place. For example, certain dependencies need their bin directories added to the `PATH`. That is built-in, but other setup is done via a pluggable mechanism that works in conjunction with these dependency attributes. See [](#ssec-setup-hooks) for details.
 
-Dependencies can be broken down along three axes: their host and target platforms relative to the new derivation’s, and whether they are propagated. The platform distinctions are motivated by cross compilation; see [](#chap-cross) for exactly what each platform means. [^footnote-stdenv-ignored-build-platform] But even if one is not cross compiling, the platforms imply whether or not the dependency is needed at run-time or build-time, a concept that makes perfect sense outside of cross compilation. By default, the run-time/build-time distinction is just a hint for mental clarity, but with `strictDeps` set it is mostly enforced even in the native case.
+Dependencies can be broken down along these axes: their host and target platforms relative to the new derivation’s. The platform distinctions are motivated by cross compilation; see [](#chap-cross) for exactly what each platform means. [^footnote-stdenv-ignored-build-platform] But even if one is not cross compiling, the platforms imply whether a dependency is needed at run-time or build-time.
 
 The extension of `PATH` with dependencies, alluded to above, proceeds according to the relative platforms alone. The process is carried out only for dependencies whose host platform matches the new derivation’s build platform i.e. dependencies which run on the platform where the new derivation will be built. [^footnote-stdenv-native-dependencies-in-path] For each dependency \<dep\> of those dependencies, `dep/bin`, if present, is added to the `PATH` environment variable.
 
-A dependency is said to be **propagated** when some of its other-transitive (non-immediate) downstream dependencies also need it as an immediate dependency.
-[^footnote-stdenv-propagated-dependencies]
+### Dependency propagation {#ssec-stdenv-dependencies-propagated}
 
-It is important to note that dependencies are not necessarily propagated as the same sort of dependency that they were before, but rather as the corresponding sort so that the platform rules still line up. To determine the exact rules for dependency propagation, we start by assigning to each dependency a couple of ternary numbers (`-1` for `build`, `0` for `host`, and `1` for `target`) representing its [dependency type](#possible-dependency-types), which captures how its host and target platforms are each "offset" from the depending derivation’s host and target platforms. The following table summarize the different combinations that can be obtained:
+Propagated dependencies are made available to all downstream dependencies.
+This is particularly useful for interpreted languages, where all transitive dependencies have to be present in the same environment.
+Therefore it is used for the Python infrastructure in Nixpkgs.
+
+:::{.note}
+Propagated dependencies should be used with care, because they obscure the actual build inputs of dependent derivations and cause side effects through setup hooks.
+This can lead to conflicting dependencies that cannot easily be resolved.
+:::
+
+:::{.example}
+# A propagated dependency
+
+```nix
+with import <nixpkgs> {};
+let
+  bar = stdenv.mkDerivation {
+    name = "bar";
+    dontUnpack = true;
+    # `hello` is also made available to dependents, such as `foo`
+    propagatedBuildInputs = [ hello ];
+    postInstall = "mkdir $out";
+  };
+  foo = stdenv.mkDerivation {
+    name = "foo";
+    dontUnpack = true;
+    # `bar` is a direct dependency, which implicitly includes the propagated `hello`
+    buildInputs = [ bar ];
+    # The `hello` binary is available!
+    postInstall = "hello > $out";
+  };
+in
+foo
+```
+:::
+
+Dependency propagation takes cross compilation into account, meaning that dependencies that cross platform boundaries are properly adjusted.
+
+To determine the exact rules for dependency propagation, we start by assigning to each dependency a couple of ternary numbers (`-1` for `build`, `0` for `host`, and `1` for `target`) representing its [dependency type](#possible-dependency-types), which captures how its host and target platforms are each "offset" from the depending derivation’s host and target platforms. The following table summarize the different combinations that can be obtained:
 
 | `host → target`     | attribute name      | offset   |
 | ------------------- | ------------------- | -------- |
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 9ee5525ebe99..fd6ec3c35577 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -41,6 +41,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `k9s` was updated to v0.29. There have been breaking changes in the config file format, check out the [changelog](https://github.com/derailed/k9s/releases/tag/v0.29.0) for details.
 
+- `nitter` requires a `guest_accounts.jsonl` to be provided as a path or loaded into the default location at `/var/lib/nitter/guest_accounts.jsonl`. See [Guest Account Branch Deployment](https://github.com/zedeus/nitter/wiki/Guest-Account-Branch-Deployment) for details.
+
 - Invidious has changed its default database username from `kemal` to `invidious`. Setups involving an externally provisioned database (i.e. `services.invidious.database.createLocally == false`) should adjust their configuration accordingly. The old `kemal` user will not be removed automatically even when the database is provisioned automatically.(https://github.com/NixOS/nixpkgs/pull/265857)
 
 - `mkosi` was updated to v19. Parts of the user interface have changed. Consult the
diff --git a/nixos/modules/programs/direnv.nix b/nixos/modules/programs/direnv.nix
index 1aa62ea54d2c..fdc646eb4b16 100644
--- a/nixos/modules/programs/direnv.nix
+++ b/nixos/modules/programs/direnv.nix
@@ -49,7 +49,14 @@ in {
           default = true;
         };
 
-      package = lib.mkPackageOption pkgs "nix-direnv" {};
+      package = lib.mkOption {
+        default = pkgs.nix-direnv.override { nix = config.nix.package; };
+        defaultText = "pkgs.nix-direnv";
+        type = lib.types.package;
+        description = lib.mdDoc ''
+          The nix-direnv package to use
+        '';
+      };
     };
   };
 
diff --git a/nixos/modules/programs/wayland/sway.nix b/nixos/modules/programs/wayland/sway.nix
index f96c833856db..57ee629b2881 100644
--- a/nixos/modules/programs/wayland/sway.nix
+++ b/nixos/modules/programs/wayland/sway.nix
@@ -26,13 +26,28 @@ let
     };
   };
 
-  defaultSwayPackage = pkgs.sway.override {
-    extraSessionCommands = cfg.extraSessionCommands;
-    extraOptions = cfg.extraOptions;
-    withBaseWrapper = cfg.wrapperFeatures.base;
-    withGtkWrapper = cfg.wrapperFeatures.gtk;
-    isNixOS = true;
-  };
+  genFinalPackage = pkg:
+    let
+      expectedArgs = lib.naturalSort [
+        "extraSessionCommands"
+        "extraOptions"
+        "withBaseWrapper"
+        "withGtkWrapper"
+        "isNixOS"
+      ];
+      existedArgs = with lib;
+        naturalSort
+        (intersectLists expectedArgs (attrNames (functionArgs pkg.override)));
+    in if existedArgs != expectedArgs then
+      pkg
+    else
+      pkg.override {
+        extraSessionCommands = cfg.extraSessionCommands;
+        extraOptions = cfg.extraOptions;
+        withBaseWrapper = cfg.wrapperFeatures.base;
+        withGtkWrapper = cfg.wrapperFeatures.gtk;
+        isNixOS = true;
+      };
 in {
   options.programs.sway = {
     enable = mkEnableOption (lib.mdDoc ''
@@ -44,14 +59,16 @@ in {
 
     package = mkOption {
       type = with types; nullOr package;
-      default = defaultSwayPackage;
+      default = pkgs.sway;
+      apply = p: if p == null then null else genFinalPackage p;
       defaultText = literalExpression "pkgs.sway";
       description = lib.mdDoc ''
-        Sway package to use. Will override the options
-        'wrapperFeatures', 'extraSessionCommands', and 'extraOptions'.
-        Set to `null` to not add any Sway package to your
-        path. This should be done if you want to use the Home Manager Sway
-        module to install Sway.
+        Sway package to use. If the package does not contain the override arguments
+        `extraSessionCommands`, `extraOptions`, `withBaseWrapper`, `withGtkWrapper`,
+        `isNixOS`, then the module options {option}`wrapperFeatures`,
+        {option}`wrapperFeatures` and {option}`wrapperFeatures` will have no effect.
+        Set to `null` to not add any Sway package to your path. This should be done if
+        you want to use the Home Manager Sway module to install Sway.
       '';
     };
 
diff --git a/nixos/modules/services/continuous-integration/buildkite-agents.nix b/nixos/modules/services/continuous-integration/buildkite-agents.nix
index a35ca4168074..2e488f83d4c3 100644
--- a/nixos/modules/services/continuous-integration/buildkite-agents.nix
+++ b/nixos/modules/services/continuous-integration/buildkite-agents.nix
@@ -35,6 +35,12 @@ let
         type = lib.types.str;
       };
 
+      extraGroups = lib.mkOption {
+        default = [ "keys" ];
+        description = lib.mdDoc "Groups the user for this buildkite agent should belong to";
+        type = lib.types.listOf lib.types.str;
+      };
+
       runtimePackages = lib.mkOption {
         default = [ pkgs.bash pkgs.gnutar pkgs.gzip pkgs.git pkgs.nix ];
         defaultText = lib.literalExpression "[ pkgs.bash pkgs.gnutar pkgs.gzip pkgs.git pkgs.nix ]";
@@ -150,7 +156,7 @@ in
       home = cfg.dataDir;
       createHome = true;
       description = "Buildkite agent user";
-      extraGroups = [ "keys" ];
+      extraGroups = cfg.extraGroups;
       isSystemUser = true;
       group = "buildkite-agent-${name}";
     };
diff --git a/nixos/modules/services/misc/nitter.nix b/nixos/modules/services/misc/nitter.nix
index c2c462d46bb5..d2cf7c0de2b7 100644
--- a/nixos/modules/services/misc/nitter.nix
+++ b/nixos/modules/services/misc/nitter.nix
@@ -304,6 +304,23 @@ in
         '';
       };
 
+      guestAccounts = mkOption {
+        type = types.path;
+        default = "/var/lib/nitter/guest_accounts.jsonl";
+        description = lib.mdDoc ''
+          Path to the guest accounts file.
+
+          This file contains a list of guest accounts that can be used to
+          access the instance without logging in. The file is in JSONL format,
+          where each line is a JSON object with the following fields:
+
+          {"oauth_token":"some_token","oauth_token_secret":"some_secret_key"}
+
+          See https://github.com/zedeus/nitter/wiki/Guest-Account-Branch-Deployment
+          for more information on guest accounts and how to generate them.
+        '';
+      };
+
       redisCreateLocally = mkOption {
         type = types.bool;
         default = true;
@@ -333,8 +350,12 @@ in
         after = [ "network-online.target" ];
         serviceConfig = {
           DynamicUser = true;
+          LoadCredential="guestAccountsFile:${cfg.guestAccounts}";
           StateDirectory = "nitter";
-          Environment = [ "NITTER_CONF_FILE=/var/lib/nitter/nitter.conf" ];
+          Environment = [
+            "NITTER_CONF_FILE=/var/lib/nitter/nitter.conf"
+            "NITTER_ACCOUNTS_FILE=%d/guestAccountsFile"
+          ];
           # Some parts of Nitter expect `public` folder in working directory,
           # see https://github.com/zedeus/nitter/issues/414
           WorkingDirectory = "${cfg.package}/share/nitter";
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index 40219edcd447..538e728fcc72 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -136,7 +136,7 @@ let
         # System Call Filtering
         SystemCallFilter = [ ("~" + lib.concatStringsSep " " systemCallsList) "@chown" "pipe" "pipe2" ];
       } // cfgService;
-      path = with pkgs; [ file imagemagick ffmpeg ];
+      path = with pkgs; [ ffmpeg-headless file imagemagick ];
     })
   ) cfg.sidekiqProcesses;
 
@@ -773,7 +773,7 @@ in {
         # System Call Filtering
         SystemCallFilter = [ ("~" + lib.concatStringsSep " " systemCallsList) "@chown" "pipe" "pipe2" ];
       } // cfgService;
-      path = with pkgs; [ file imagemagick ffmpeg ];
+      path = with pkgs; [ ffmpeg-headless file imagemagick ];
     };
 
     systemd.services.mastodon-media-auto-remove = lib.mkIf cfg.mediaAutoRemove.enable {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e108b268e49a..992ca189ef1f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -407,7 +407,7 @@ in {
   incus = pkgs.recurseIntoAttrs (handleTest ./incus { inherit handleTestOn; });
   influxdb = handleTest ./influxdb.nix {};
   influxdb2 = handleTest ./influxdb2.nix {};
-  initrd-network-openvpn = handleTest ./initrd-network-openvpn {};
+  initrd-network-openvpn = handleTestOn [ "x86_64-linux" "i686-linux" ] ./initrd-network-openvpn {};
   initrd-network-ssh = handleTest ./initrd-network-ssh {};
   initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix {};
   initrdNetwork = handleTest ./initrd-network.nix {};
@@ -831,7 +831,7 @@ in {
   systemd-initrd-vconsole = handleTest ./systemd-initrd-vconsole.nix {};
   systemd-initrd-networkd = handleTest ./systemd-initrd-networkd.nix {};
   systemd-initrd-networkd-ssh = handleTest ./systemd-initrd-networkd-ssh.nix {};
-  systemd-initrd-networkd-openvpn = handleTest ./initrd-network-openvpn { systemdStage1 = true; };
+  systemd-initrd-networkd-openvpn = handleTestOn [ "x86_64-linux" "i686-linux" ] ./initrd-network-openvpn { systemdStage1 = true; };
   systemd-initrd-vlan = handleTest ./systemd-initrd-vlan.nix {};
   systemd-journal = handleTest ./systemd-journal.nix {};
   systemd-journal-gateway = handleTest ./systemd-journal-gateway.nix {};
diff --git a/nixos/tests/btrbk-section-order.nix b/nixos/tests/btrbk-section-order.nix
index 20f1afcf80ec..6082de947f66 100644
--- a/nixos/tests/btrbk-section-order.nix
+++ b/nixos/tests/btrbk-section-order.nix
@@ -29,10 +29,12 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
   };
 
   testScript = ''
+    import difflib
     machine.wait_for_unit("basic.target")
-    got = machine.succeed("cat /etc/btrbk/local.conf")
+    got = machine.succeed("cat /etc/btrbk/local.conf").strip()
     expect = """
     backend btrfs-progs-sudo
+    stream_compress no
     timestamp_format long
     target ssh://global-target/
      ssh_user root
@@ -46,6 +48,9 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
        ssh_user root
     """.strip()
     print(got)
+    if got != expect:
+      diff = difflib.unified_diff(expect.splitlines(keepends=True), got.splitlines(keepends=True), fromfile="expected", tofile="got")
+      print("".join(diff))
     assert got == expect
   '';
 })
diff --git a/nixos/tests/initrd-network-openvpn/default.nix b/nixos/tests/initrd-network-openvpn/default.nix
index 769049905eb8..69db7dd1037f 100644
--- a/nixos/tests/initrd-network-openvpn/default.nix
+++ b/nixos/tests/initrd-network-openvpn/default.nix
@@ -59,18 +59,19 @@ import ../make-test-python.nix ({ lib, ...}:
 
             # This command does not fork to keep the VM in the state where
             # only the initramfs is loaded
-            preLVMCommands =
-            ''
-              /bin/nc -p 1234 -lke /bin/echo TESTVALUE
-            '';
+            preLVMCommands = lib.mkIf (!systemdStage1)
+              ''
+                /bin/nc -p 1234 -lke /bin/echo TESTVALUE
+              '';
 
             network = {
               enable = true;
 
               # Work around udhcpc only getting a lease on eth0
-              postCommands = ''
-                /bin/ip addr add 192.168.1.2/24 dev eth1
-              '';
+              postCommands = lib.mkIf (!systemdStage1)
+                ''
+                  /bin/ip addr add 192.168.1.2/24 dev eth1
+                '';
 
               # Example configuration for OpenVPN
               # This is the main reason for this test
diff --git a/nixos/tests/musescore.nix b/nixos/tests/musescore.nix
index 6aeb0558a49d..0720631ed284 100644
--- a/nixos/tests/musescore.nix
+++ b/nixos/tests/musescore.nix
@@ -63,14 +63,11 @@ in
 
     machine.send_key("tab")
     machine.send_key("tab")
-    machine.send_key("tab")
-    machine.send_key("tab")
-    machine.send_key("right")
-    machine.send_key("right")
     machine.send_key("ret")
 
-    machine.sleep(1)
+    machine.sleep(2)
 
+    machine.send_key("tab")
     # Type the beginning of https://de.wikipedia.org/wiki/Alle_meine_Entchen
     machine.send_chars("cdef6gg5aaaa7g")
     machine.sleep(1)
diff --git a/nixos/tests/nitter.nix b/nixos/tests/nitter.nix
index 8bc55ba8c69f..114f1aac7c7a 100644
--- a/nixos/tests/nitter.nix
+++ b/nixos/tests/nitter.nix
@@ -1,13 +1,28 @@
 import ./make-test-python.nix ({ pkgs, ... }:
 
+let
+  # In a real deployment this should naturally not common from the nix store
+  # and be seeded via agenix or as a non-nix managed file.
+  #
+  # These credentials are from the nitter wiki and are expired. We must provide
+  # credentials in the correct format, otherwise nitter fails to start. They
+  # must not be valid, as unauthorized errors are handled gracefully.
+  guestAccountFile = pkgs.writeText "guest_accounts.jsonl" ''
+    {"oauth_token":"1719213587296620928-BsXY2RIJEw7fjxoNwbBemgjJhueK0m","oauth_token_secret":"N0WB0xhL4ng6WTN44aZO82SUJjz7ssI3hHez2CUhTiYqy"}
+  '';
+in
 {
   name = "nitter";
   meta.maintainers = with pkgs.lib.maintainers; [ erdnaxe ];
 
   nodes.machine = {
-    services.nitter.enable = true;
-    # Test CAP_NET_BIND_SERVICE
-    services.nitter.server.port = 80;
+    services.nitter = {
+      enable = true;
+      # Test CAP_NET_BIND_SERVICE
+      server.port = 80;
+      # Provide dummy guest accounts
+      guestAccounts = guestAccountFile;
+    };
   };
 
   testScript = ''
diff --git a/pkgs/applications/audio/aacgain/default.nix b/pkgs/applications/audio/aacgain/default.nix
index 4d45de86f3a1..2bee14797815 100644
--- a/pkgs/applications/audio/aacgain/default.nix
+++ b/pkgs/applications/audio/aacgain/default.nix
@@ -5,27 +5,20 @@
 , autoconf
 , automake
 , libtool
-, faad2
-, mp4v2
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "aacgain";
-  version = "2.0.0";
+  version = "2.0.0-unstable-2022-07-12";
 
   src = fetchFromGitHub {
     owner = "dgilman";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-9Y23Zh7q3oB4ha17Fpm1Hu2+wtQOA1llj6WDUAO2ARU=";
+    repo = "aacgain";
+    rev = "9f9ae95a20197d1072994dbd89672bba2904bdb5";
+    hash = "sha256-WqL9rKY4lQD7wQSZizoM3sHNzLIG0E9xZtjw8y7fgmE=";
+    fetchSubmodules = true;
   };
 
-  postPatch = ''
-    cp -R ${faad2.src}/* 3rdparty/faad2
-    cp -R ${mp4v2.src}/* 3rdparty/mp4v2
-    chmod -R +w 3rdparty
-  '';
-
   nativeBuildInputs = [
     cmake
     autoconf
diff --git a/pkgs/applications/audio/musescore/default.nix b/pkgs/applications/audio/musescore/default.nix
index d42117e1babe..3dbb9c7884f1 100644
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@@ -48,35 +48,14 @@ let
   } else portaudio;
 in stdenv'.mkDerivation (finalAttrs: {
   pname = "musescore";
-  version = "4.1.1";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "musescore";
     repo = "MuseScore";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-jXievVIA0tqLdKLy6oPaOHPIbDoFstveEQBri9M0Aoo=";
+    sha256 = "sha256-vNA1VPCHLt5kuhIix8kgeq1VlbuIX1lOY3nJaufvuyc=";
   };
-  patches = [
-    # Upstream from some reason wants to install qml files from qtbase in
-    # installPhase, this patch removes this behavior. See:
-    # https://github.com/musescore/MuseScore/issues/18665
-    (fetchpatch {
-      url = "https://github.com/doronbehar/MuseScore/commit/f48448a3ede46f5a7ef470940072fbfb6742487c.patch";
-      hash = "sha256-UEc7auscnW0KMfWkLKQtm+UstuTNsuFeoNJYIidIlwM=";
-    })
-    # Upstream removed the option to use system freetype library in v4.1.0,
-    # causing the app to crash on systems when the outdated bundled freetype
-    # tries to load the Noto Sans font. For more info on the crash itself,
-    # see #244409 and https://github.com/musescore/MuseScore/issues/18795.
-    # For now, re-add the option ourselves. The fix has been merged upstream,
-    # so we can remove this patch with the next version. In the future, we
-    # may replace the other bundled thirdparty libs with system libs, see
-    # https://github.com/musescore/MuseScore/issues/11572.
-    (fetchpatch {
-      url = "https://github.com/musescore/MuseScore/commit/9ab6b32b1c3b990cfa7bb172ee8112521dc2269c.patch";
-      hash = "sha256-5GA29Z+o3I/uDTTDbkauZ8/xSdCE6yY93phMSY0ea7s=";
-    })
-  ];
 
   cmakeFlags = [
     "-DMUSESCORE_BUILD_MODE=release"
diff --git a/pkgs/applications/audio/open-stage-control/default.nix b/pkgs/applications/audio/open-stage-control/default.nix
index e0d284bc951e..08b1a106a3d5 100644
--- a/pkgs/applications/audio/open-stage-control/default.nix
+++ b/pkgs/applications/audio/open-stage-control/default.nix
@@ -1,4 +1,14 @@
-{ lib, buildNpmPackage, fetchFromGitHub, makeBinaryWrapper, makeDesktopItem, copyDesktopItems, electron, python3, nix-update-script }:
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, makeBinaryWrapper
+, makeDesktopItem
+, copyDesktopItems
+, nodejs_18
+, electron
+, python3
+, nix-update-script
+}:
 
 buildNpmPackage rec {
   pname = "open-stage-control";
@@ -18,10 +28,11 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-UqjYNXdNoQmirIgU9DRgkp14SIrawfrfi9mD2h6ACyU=";
 
+  nodejs = nodejs_18;
+
   nativeBuildInputs = [
     copyDesktopItems
     makeBinaryWrapper
-    python3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/blockchains/atomic-swap/default.nix b/pkgs/applications/blockchains/atomic-swap/default.nix
index ed5869f2fc49..a2e2e9efbffb 100644
--- a/pkgs/applications/blockchains/atomic-swap/default.nix
+++ b/pkgs/applications/blockchains/atomic-swap/default.nix
@@ -1,9 +1,8 @@
-{ lib, buildGo120Module, fetchFromGitHub, nix-update-script, makeWrapper, monero-cli }:
+{ lib, buildGoModule, fetchFromGitHub, nix-update-script, makeWrapper, monero-cli }:
 
 let
   pname = "atomic-swap";
-  version = "0.4.2";
-  buildGoModule = buildGo120Module;
+  version = "0.4.3";
 in
 buildGoModule {
   inherit pname version;
@@ -12,10 +11,10 @@ buildGoModule {
     owner = "AthanorLabs";
     repo = "atomic-swap";
     rev = "v${version}";
-    hash = "sha256-JnbKaGmpTDwQMSDR4Y8Q2JTtuQV5GGuovxeIYs0KgQI=";
+    hash = "sha256-MOylUZ6BrvlxUrsZ5gg3JzW9ROG5UXeGhq3YoPZKdHs=";
   };
 
-  vendorHash = "sha256-acBnXGy1kVBwB+j8VqGyinabnI/boTtbFNyjE6EHVes=";
+  vendorHash = "sha256-fGQ6MI+3z7wRL0y7AUERVtN0V2rcRa+vqeB8+3FMzzc=";
 
   subPackages = [
     "cmd/swapcli"
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index f274ef66e795..7680d3cbe841 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -305,12 +305,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "c23407de1f76df30ca197b69d78a11be5ce26009";
-      sha256 = "04v4xzi55fmgbrnvm1s9magb1r0mqsx5w8nck7pn39q7q39wazpa";
+      rev = "5372bf247839b46a121375d3d610ab8409d6100d";
+      sha256 = "0r0lvg59v7if3b4jfi5a6s11njzidhnxw7bz4nmga80bdfvb4syh";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -2444,12 +2444,12 @@ final: prev:
 
   crates-nvim = buildVimPlugin {
     pname = "crates.nvim";
-    version = "2023-12-16";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "saecki";
       repo = "crates.nvim";
-      rev = "8da3bae1f0f8892b42e9596299ec09bc055e5507";
-      sha256 = "1jy6z43n1146wq6bv5qpkb74hs81c3n17r570vjvi3rbc6nq139a";
+      rev = "81c6325b7f8875857ec09e5d24f3b6d7986f29e2";
+      sha256 = "1dlri6p8v8bs3mkssvxixpg8knavr2axwydy5qhywzzjzz236yd5";
     };
     meta.homepage = "https://github.com/saecki/crates.nvim/";
   };
@@ -3143,12 +3143,12 @@ final: prev:
 
   efmls-configs-nvim = buildVimPlugin {
     pname = "efmls-configs-nvim";
-    version = "2023-12-18";
+    version = "2023-12-21";
     src = fetchFromGitHub {
       owner = "creativenull";
       repo = "efmls-configs-nvim";
-      rev = "32575ba992e056dde5a869fc0368a7dd4e3c7afb";
-      sha256 = "01jra3rzmxj2fknp2fihhg56kjazxvp67q0d9n7adph36w9b95h3";
+      rev = "ddc7c542aaad21da594edba233c15ae3fad01ea0";
+      sha256 = "0qhs1dzn0wy6jrqkyn4bz5cmd9xzxp3prka72446b3sj4521bbs7";
     };
     meta.homepage = "https://github.com/creativenull/efmls-configs-nvim/";
   };
@@ -4104,12 +4104,12 @@ final: prev:
 
   haskell-tools-nvim = buildNeovimPlugin {
     pname = "haskell-tools.nvim";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "haskell-tools.nvim";
-      rev = "e9a09be664521134e04336c2503c7f6b058d7785";
-      sha256 = "1lg3wkbg2sjkbp6c3lrkszsbk97ajgs6jnwmv9xgslvaaj40r6r8";
+      rev = "ab80d6218d27c961cfc6c0f31c6a132f80b39cbe";
+      sha256 = "1biadz420rklv7i2z5w3796p46ia0lbn4kcny2c8dzwlrhgjcfim";
     };
     meta.homepage = "https://github.com/MrcJkb/haskell-tools.nvim/";
   };
@@ -4920,12 +4920,12 @@ final: prev:
 
   lexima-vim = buildVimPlugin {
     pname = "lexima.vim";
-    version = "2023-09-04";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "cohama";
       repo = "lexima.vim";
-      rev = "b1e1b1bde07c1efc97288c98c5912eaa644ee6e1";
-      sha256 = "1dk32rjahn6grwq1gdxnxs6pavjzhkml7zb3pg1ky75pivs1rlgr";
+      rev = "5513d686801993b40c55baa65602f79cd3cf3c77";
+      sha256 = "08gmpxxfjsjqvhcicr3rwm97xddsn93afxnqipyz4vjclzmpxgwg";
     };
     meta.homepage = "https://github.com/cohama/lexima.vim/";
   };
@@ -5664,12 +5664,12 @@ final: prev:
 
   molten-nvim = buildVimPlugin {
     pname = "molten-nvim";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "benlubas";
       repo = "molten-nvim";
-      rev = "60930af2df132289d21c6c6f141c0aec8de71089";
-      sha256 = "0063ndbx46q6xf5y1y0zrzqbh8x5qrvmvpyh205ifwwfyls6aqai";
+      rev = "75ce8fe3cc8206f8fd3ecdc315e16c47f0ddb75c";
+      sha256 = "0qg1br622wwkd3dkydvczz6s7ycp8h6b576mx8j3clx0z0yj0m7f";
     };
     meta.homepage = "https://github.com/benlubas/molten-nvim/";
   };
@@ -6024,12 +6024,12 @@ final: prev:
 
   neodev-nvim = buildVimPlugin {
     pname = "neodev.nvim";
-    version = "2023-12-19";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neodev.nvim";
-      rev = "018e1161ed771ef2b54f346240bcf69931594396";
-      sha256 = "01lddc9i6z56fyc6jfz1rv9cja98jjg4dhzhx67752nmpfzjlicf";
+      rev = "93ab59d5d436b36698c14d0374150a7e5e7bccb6";
+      sha256 = "1kn0c9nb12hhwqpjma8pxkh33salwdrwrgzg8ivljb6sr9mg8ckw";
     };
     meta.homepage = "https://github.com/folke/neodev.nvim/";
   };
@@ -6060,12 +6060,12 @@ final: prev:
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "2023-12-19";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "801143ee4db4121fc11a6468daae6680ba9fab51";
-      sha256 = "01i1spfqx29nzshxdk5c3g9m146kijq0wb37qyk2jfjj9r3jj1xg";
+      rev = "bbb3c19a9f55a36f844b862c3bea21781aef8644";
+      sha256 = "18ywqh7g3q0l8riyv6641sfvkzii3r3c6vc5ss5qp1d4cnmrvssi";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
   };
@@ -6204,12 +6204,12 @@ final: prev:
 
   neotest = buildVimPlugin {
     pname = "neotest";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest";
-      rev = "b8e29c0fba9a58bf6a5c37df77c7a6a31079c8d6";
-      sha256 = "0y9dm6w88prff7vf84jy0ik2f69smhvc8a7gs4cickw56n7srf28";
+      rev = "a2f1cb4072bb29fcc067605fb712bbd83917513e";
+      sha256 = "0f8rn9v26v3a6yq0wngdzrgz5rdwlpmnc74b98l1aqb2ikn6gxvd";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest/";
   };
@@ -6337,12 +6337,12 @@ final: prev:
 
   neotest-python = buildVimPlugin {
     pname = "neotest-python";
-    version = "2023-12-10";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest-python";
-      rev = "48bf141103b94c9384e5542cd185b291909ac305";
-      sha256 = "1apkxpznlwhilzqh3jn54xblcn18wyadymzpwh0v1p19ah46xnzj";
+      rev = "27a2676aa02193d6ba4ad26238c09ededa49a9a7";
+      sha256 = "146ycpc49yq01g0za6r76h0rbc427653z2wy7755czcjisf81i3k";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest-python/";
   };
@@ -6469,12 +6469,12 @@ final: prev:
 
   nerdtree = buildVimPlugin {
     pname = "nerdtree";
-    version = "2023-12-02";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "preservim";
       repo = "nerdtree";
-      rev = "9ec27d45a863aeb82fea56cebcb8a75a4e369fc9";
-      sha256 = "17j2q0vdplxz4qjkx140mgxjcj1dghzkz1ijb3vc3i2hl5qfmba1";
+      rev = "a9546618241e61e785aa4c21b3de0cb657f3b828";
+      sha256 = "0pjc5bpms29ala5wc26hikzj48fvi8rs1xx8d71pk5c4s5y62l2z";
     };
     meta.homepage = "https://github.com/preservim/nerdtree/";
   };
@@ -6637,24 +6637,24 @@ final: prev:
 
   none-ls-nvim = buildVimPlugin {
     pname = "none-ls.nvim";
-    version = "2023-12-15";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "nvimtools";
       repo = "none-ls.nvim";
-      rev = "ef09f14eab78ca6ce3bee1ddc73db5511f5cd953";
-      sha256 = "066wr59s0bqrmnx46f9yfa0yr8mmpghahzn3wc6jaj2l9rc1k7cw";
+      rev = "bbd8c0c2b8a47ff2e0a97868afdf3fc640f1ad1e";
+      sha256 = "0g2x2niigqxzq9k4ysiws6qnd4agcpf7dy7s4g1hdq8cnapgy0vm";
     };
     meta.homepage = "https://github.com/nvimtools/none-ls.nvim/";
   };
 
   nord-nvim = buildVimPlugin {
     pname = "nord.nvim";
-    version = "2023-10-04";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "shaunsingh";
       repo = "nord.nvim";
-      rev = "0a22a387c92bb3b46e3d245522712ae7497bec38";
-      sha256 = "1bmmyf3d4ihiaa0h9q77scif22kykkidks72vmamzh7v34x3c7d8";
+      rev = "80c1e5321505aeb22b7a9f23eb82f1e193c12470";
+      sha256 = "0bv733mf2c7cclqcgr64ngrxzk38pwimvcl0g63c6pj1la8xpqzj";
     };
     meta.homepage = "https://github.com/shaunsingh/nord.nvim/";
   };
@@ -6781,12 +6781,12 @@ final: prev:
 
   nvim-autopairs = buildVimPlugin {
     pname = "nvim-autopairs";
-    version = "2023-10-21";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "0f04d78619cce9a5af4f355968040f7d675854a1";
-      sha256 = "0k2pibxx42qsdvxgbrdj7g44y5q6dnaw0g07gq025dpn27jk9ark";
+      rev = "9fd41181693dd4106b3e414a822bb6569924de81";
+      sha256 = "1xwvw5j81rx7q5jmv14fnphxsjk9anzglf10j8ai8217gc9h530z";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
   };
@@ -6973,12 +6973,12 @@ final: prev:
 
   nvim-dap = buildVimPlugin {
     pname = "nvim-dap";
-    version = "2023-12-14";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "e64ebf3309154b578a03c76229ebf51c37898118";
-      sha256 = "11j71rdx4mx3g0x8vxp19jqnpihbwdrcr29651cn5q00myzvgzx9";
+      rev = "f0dca670fa059eb89dda8869a6310c804241345c";
+      sha256 = "0zdsr98abzyiw7887dgvjh3i3bf95vw3lg4d384rr6zrxwh03kjh";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
@@ -6997,12 +6997,12 @@ final: prev:
 
   nvim-dap-python = buildVimPlugin {
     pname = "nvim-dap-python";
-    version = "2023-11-15";
+    version = "2023-12-19";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap-python";
-      rev = "e0be843877e7ae756ef1ee7a441ca0b9e1677da9";
-      sha256 = "0xib2xayrnf96r07rd7xdahpza41155npkdjxmr48h52gjj15nbl";
+      rev = "091e4ae00a12085f9ed4200a3cd04af7179b8a23";
+      sha256 = "02ialmgk6i2svjqglj7hmrakfsk5spcxb9idb13vmzlng8s3rzsp";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap-python/";
   };
@@ -7260,12 +7260,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPlugin {
     pname = "nvim-lspconfig";
-    version = "2023-12-19";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "e85816c5803410cacb52e9b4fbdb72a1f1a6bd11";
-      sha256 = "03yvhgm80lzrn7x4j3qvjwcz8yvnc0db926bw3yw7537samqn5g5";
+      rev = "a2e84ddef8d17a71dc8115f72e264c97328f5d33";
+      sha256 = "19cgid5723n4sk6n4nnc67xbkjdrmyq9fyxd62i3alflk3pxiw15";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -7488,12 +7488,12 @@ final: prev:
 
   nvim-scrollview = buildVimPlugin {
     pname = "nvim-scrollview";
-    version = "2023-12-18";
+    version = "2023-12-21";
     src = fetchFromGitHub {
       owner = "dstein64";
       repo = "nvim-scrollview";
-      rev = "e2d1ddae7e1f389e718834c6cb69501704ba30e3";
-      sha256 = "04w919wsr1xlwzdaj1zbwj2jx03lcx9n2zrdkxmwwkmqfs4d1rdw";
+      rev = "a74efa2d63acc966258889885fbf177badf88df3";
+      sha256 = "1gi4fbpcqc81wqm59n6n4x2mn4kjzbhx30d4vwjsrnda5s3nvlv0";
     };
     meta.homepage = "https://github.com/dstein64/nvim-scrollview/";
   };
@@ -7536,24 +7536,24 @@ final: prev:
 
   nvim-spectre = buildVimPlugin {
     pname = "nvim-spectre";
-    version = "2023-11-15";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "nvim-pack";
       repo = "nvim-spectre";
-      rev = "a18a58015b46f02b4fe537ebfffd82e46110ff24";
-      sha256 = "0ry2scnw8hzd3snjhbp71zc6mnna2bwn6icr3frsgdj1p5rfissn";
+      rev = "d8906855f1949ac97b1e77aaf8d3fe12ed158ddc";
+      sha256 = "1kmw61gli562d4r4vsf2fpxa09pi6a0brcdzly02n7xcan4l7bc4";
     };
     meta.homepage = "https://github.com/nvim-pack/nvim-spectre/";
   };
 
   nvim-spider = buildVimPlugin {
     pname = "nvim-spider";
-    version = "2023-12-18";
+    version = "2023-12-21";
     src = fetchFromGitHub {
       owner = "chrisgrieser";
       repo = "nvim-spider";
-      rev = "2cda32bb4bd852662e5c443dd33aa56f32182628";
-      sha256 = "0061mm1d1dslky9p8z084wjrjfqkr4m5sy0g6wd3yy2iam1p2xds";
+      rev = "daa3241d3f94e12199309f93278791e011539662";
+      sha256 = "14cpd2y50qy5m1hmx92p4xdd4grsf4w7fa7325vkd0ry449p69n0";
     };
     meta.homepage = "https://github.com/chrisgrieser/nvim-spider/";
   };
@@ -7620,12 +7620,12 @@ final: prev:
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "2023-12-19";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "0dfbf5e48e8551212c2a9f1c74cb080c8e76b5d1";
-      sha256 = "1vy1xgxi696j4as5l9831jpy1v1x3kfn1mak7gn0fyv97a987b25";
+      rev = "732c8cb0b43b7336525c3cecb2e28db153994e62";
+      sha256 = "02i23ldcl5x93w0mnzji65f4mbjdvn7h8x27r1mvxcmm2n38cxbv";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -8536,11 +8536,11 @@ final: prev:
 
   rainbow-delimiters-nvim = buildVimPlugin {
     pname = "rainbow-delimiters.nvim";
-    version = "2023-12-17";
+    version = "2023-12-20";
     src = fetchgit {
       url = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
-      rev = "b510fd445b6ee0b621e910e4b3e123e48d6bb436";
-      sha256 = "152jan5vpvn5mdv7cfc2gshnsrgq9qw17xqddz6d6n4p7pywfbr6";
+      rev = "a27051f08f6c03928ee9e94339f53da3107857db";
+      sha256 = "0wlm40389768sxvj1xqw2n1ldvhmnfzf0nibrr3mqsvh6abjq1id";
     };
     meta.homepage = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
   };
@@ -8787,12 +8787,12 @@ final: prev:
 
   rustaceanvim = buildNeovimPlugin {
     pname = "rustaceanvim";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "mrcjkb";
       repo = "rustaceanvim";
-      rev = "a13e311d449034b49d0144a411e0c8be3d5354cd";
-      sha256 = "0nlx7w1wi9dsji4d84f7niw74cc5mxar3q95qwydqpha3vz201s5";
+      rev = "fefc2408ba56832f884b1033a1d4eba1830d6aff";
+      sha256 = "1v3zcd149bx3pgjgk3r8yjbsvlrgipn4js02ighdrqjl5z395x6m";
     };
     meta.homepage = "https://github.com/mrcjkb/rustaceanvim/";
   };
@@ -9040,12 +9040,12 @@ final: prev:
 
   smartcolumn-nvim = buildVimPlugin {
     pname = "smartcolumn.nvim";
-    version = "2023-09-12";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "smartcolumn.nvim";
-      rev = "c6abf3917fcec487c7475e208ae37f5788af5b04";
-      sha256 = "1imdzqq997n8jwcxf8dyh0647hx58z9imm95nky23dlmhp3lzn9v";
+      rev = "8cbf75c26e9f9248704a662564f30cc2d7de7f34";
+      sha256 = "1hyfl7g11fx9xbkyaljcwdih1fc4cp777j0rxii5jrr50rvriyik";
     };
     meta.homepage = "https://github.com/m4xshen/smartcolumn.nvim/";
   };
@@ -9353,12 +9353,12 @@ final: prev:
 
   startup-nvim = buildVimPlugin {
     pname = "startup.nvim";
-    version = "2023-11-02";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "startup-nvim";
       repo = "startup.nvim";
-      rev = "088de9f5af8a10dfc39f8e397e3e9646940c7323";
-      sha256 = "09hhl8l2b4q53i2scig6rx3zq7mcsa6f5za0ahmn3s9vh9862iqz";
+      rev = "c6ba324f9eba0c23b675b53af431346aab893268";
+      sha256 = "0vp4vfrlb39z4s4617v1xkzjkx6l5sxfravfj2wkkwzpjrqfs2bl";
     };
     meta.homepage = "https://github.com/startup-nvim/startup.nvim/";
   };
@@ -9994,12 +9994,12 @@ final: prev:
 
   telescope-nvim = buildNeovimPlugin {
     pname = "telescope.nvim";
-    version = "2023-12-06";
+    version = "2023-12-19";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope.nvim";
-      rev = "6213322ab56eb27356fdc09a5078e41e3ea7f3bc";
-      sha256 = "074bq8p1bkyr12z1wy31bipb97vmqia4lsmdp2aj1v1r5x5ph736";
+      rev = "f336f8cfab38a82f9f00df380d28f0c2a572f862";
+      sha256 = "14v1v45p5jpvn9lgbjcfgx8p4b60w0bqk3vv7sdb5nbikkjhy10z";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope.nvim/";
   };
@@ -10102,12 +10102,12 @@ final: prev:
 
   text-case-nvim = buildVimPlugin {
     pname = "text-case.nvim";
-    version = "2023-12-19";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "johmsalas";
       repo = "text-case.nvim";
-      rev = "ada81738da3f1ed08f5e4ac95fa21213a0221b22";
-      sha256 = "1dy6v1d3iv92j88ydcgzjccnv6f213vhpnb27r6rv8hd3z6h4dfv";
+      rev = "f847b283ebbe8b98bc96fa29f1685244c42ce4cf";
+      sha256 = "1fp4lgr6vbacn421k4jy5h5h6yravv95rszrf313jjsjid4n1j3q";
     };
     meta.homepage = "https://github.com/johmsalas/text-case.nvim/";
   };
@@ -10463,12 +10463,12 @@ final: prev:
 
   unison = buildVimPlugin {
     pname = "unison";
-    version = "2023-12-19";
+    version = "2023-12-21";
     src = fetchFromGitHub {
       owner = "unisonweb";
       repo = "unison";
-      rev = "e690c5f57e12f5883ffd44ead57bf2942c1fedd0";
-      sha256 = "09vlww4yxsxal0pnif1an0lqpkvf5zjnkvmz0h7yyfdpmq1prmxq";
+      rev = "5e98e805af75dc15116fc524c911a7c78ede9e03";
+      sha256 = "0yhg40pr1611nplxy5v794b52868ylg4cqm6gqzms1bwz1gzvh7l";
     };
     meta.homepage = "https://github.com/unisonweb/unison/";
   };
@@ -12913,12 +12913,12 @@ final: prev:
 
   vim-just = buildVimPlugin {
     pname = "vim-just";
-    version = "2023-12-17";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "NoahTheDuke";
       repo = "vim-just";
-      rev = "e2e42ae765f53569efb7178a7bbb9a6977d269e2";
-      sha256 = "0a930prjv6b09qkn2zwmn5bxs73sad48v3mr8g9b7f0i4528iklz";
+      rev = "cbba24e544dd32509a6b68271ce3142ab5a180c3";
+      sha256 = "05fp1vqir8w9kl1il76bszsmh6vn6kj8a8g4nssa4pw7bpsflrvs";
     };
     meta.homepage = "https://github.com/NoahTheDuke/vim-just/";
   };
@@ -15616,12 +15616,12 @@ final: prev:
 
   vimtex = buildVimPlugin {
     pname = "vimtex";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "e7ce03ea517c5b61ec9703a44019481678d60af3";
-      sha256 = "0i8crnv5h9swdi22bxp8sj7s59lnjy2ryqslbxydq2vb8kq4cr4c";
+      rev = "6179414f2eb3db977a513b7b19c23e7e62a0f388";
+      sha256 = "1fynvg4695h990lh1w9mknd7n0mdk2br1j0xdh3sh94w204xyyrh";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -16133,12 +16133,12 @@ final: prev:
 
   embark-vim = buildVimPlugin {
     pname = "embark-vim";
-    version = "2023-11-27";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "embark-theme";
       repo = "vim";
-      rev = "7efd788d2e7b2d0a923cb6dabad7e2c11ab7aa95";
-      sha256 = "0pnqx6jli9pwqs6h2dsvh7q05gchama7zcpr91zp2jabacbanycf";
+      rev = "95f92adee0e5ad36f74fe04266554ac9c03e3fc3";
+      sha256 = "15v8wgbcckdll8j27d2v30rcbgc38hddmnfbk24p3jxx2pxdl529";
     };
     meta.homepage = "https://github.com/embark-theme/vim/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 0b0aa3d6395f..06b2548251d0 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -737,12 +737,12 @@
   };
   gleam = buildGrammar {
     language = "gleam";
-    version = "0.0.0+rev=c9c7f0f";
+    version = "0.0.0+rev=2b49c49";
     src = fetchFromGitHub {
       owner = "gleam-lang";
       repo = "tree-sitter-gleam";
-      rev = "c9c7f0f01749d301b54e96ed8e0c47c7c415a196";
-      hash = "sha256-j7onMy986PeJNy9x8GUkg8Be22bGYoZs53sToLWc/eI=";
+      rev = "2b49c49ef632928b5c52bb0a7269ff797d5d1414";
+      hash = "sha256-zFdyUqbJn7ighjXH+9EO+0Cf2Oj8ON8IYUZCIQUQ5dA=";
     };
     meta.homepage = "https://github.com/gleam-lang/tree-sitter-gleam";
   };
@@ -2243,12 +2243,12 @@
   };
   styled = buildGrammar {
     language = "styled";
-    version = "0.0.0+rev=e51e673";
+    version = "0.0.0+rev=5e52758";
     src = fetchFromGitHub {
       owner = "mskelton";
       repo = "tree-sitter-styled";
-      rev = "e51e673efc860373167680b4bcbf418a11e4ed26";
-      hash = "sha256-s9omwcuIAXgpwWTpyRpessA5fOeWqRqTctBKr3rUeNc=";
+      rev = "5e52758b32e02adca16bb93f95b3f9c050c72b56";
+      hash = "sha256-3x/ZKVYyWuLGkgdm9HutI16m8xpJKSMOZHY48WqH9b0=";
     };
     meta.homepage = "https://github.com/mskelton/tree-sitter-styled";
   };
@@ -2569,12 +2569,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "0.0.0+rev=eced04c";
+    version = "0.0.0+rev=f0336bb";
     src = fetchFromGitHub {
       owner = "v-analyzer";
       repo = "v-analyzer";
-      rev = "eced04c473f3bcb49f9c8ac91744451a9ab40310";
-      hash = "sha256-fT/jqaKwUP7KWT+RT9V23HAL0Ol7mr/8NWNbYtSFhBI=";
+      rev = "f0336bb8847393ba4d5905a94642acf0dc3d5ebd";
+      hash = "sha256-0hC9xb1rOtUb47gzCdzvCxAz54d9RZ4UMfb2PFOM6ZE=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/v-analyzer/v-analyzer";
@@ -2669,12 +2669,12 @@
   };
   wing = buildGrammar {
     language = "wing";
-    version = "0.0.0+rev=b5fa0cb";
+    version = "0.0.0+rev=e6e06a0";
     src = fetchFromGitHub {
       owner = "winglang";
       repo = "wing";
-      rev = "b5fa0cb75ee96d3ff19df59085d508240f5b0fd5";
-      hash = "sha256-SqPw0LxxJiarYR3YIPKxAuFGWJw6dUwSVFbey3z2OAA=";
+      rev = "e6e06a05eeb894001d3c24e1db72f5cd2f35bdae";
+      hash = "sha256-/a1cXTwEyHTv0mzXvZIvD0V9HBL8NyeMMWI1O+Fp5Fs=";
     };
     location = "libs/tree-sitter-wing";
     generate = true;
diff --git a/pkgs/applications/misc/eos-installer/default.nix b/pkgs/applications/misc/eos-installer/default.nix
index 67e6b2bc97ad..5d4ea2e8c60c 100644
--- a/pkgs/applications/misc/eos-installer/default.nix
+++ b/pkgs/applications/misc/eos-installer/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eos-installer";
-  version = "5.0.2";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = "endlessm";
     repo = "eos-installer";
     rev = "Release_${version}";
-    sha256 = "utTTux8o8TN51bvnGldrtMEatiLA1AiHf/9XJZ7k7KM=";
+    sha256 = "BqvZglzFJabGXkI8hnLiw1r+CvM7kSKQPj8IKYBB6S4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/office/planify/default.nix b/pkgs/applications/office/planify/default.nix
index f8b23b533b69..401dc150b27d 100644
--- a/pkgs/applications/office/planify/default.nix
+++ b/pkgs/applications/office/planify/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.3.1";
+  version = "4.3.2";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-YF4un5j7zv0ishcgt00XDGy0AhR/bo6HJj04t0qfxwU=";
+    hash = "sha256-i+Up92Gl3FjgQ4GpcZruvYD//TPNWktSuWXGgDTwbWw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/portfolio/default.nix b/pkgs/applications/office/portfolio/default.nix
index e507692d622e..db85a0f579ac 100644
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.65.6";
+  version = "0.66.2";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-sI2DqhR9LmXxjkkMTDiMG/f/QXcBVPmEjbHFsmEP8qE=";
+    hash = "sha256-jUakjgprf561OVwBW25+/+q+r2CZ6H1iDM3n6w54IfI=";
   };
 
   nativeBuildInputs = [
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.portfolio-performance.info/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.epl10;
-    maintainers = with maintainers; [ elohmeier oyren shawn8901 ];
+    maintainers = with maintainers; [ elohmeier kilianar oyren shawn8901 ];
     mainProgram = "portfolio";
     platforms = [ "x86_64-linux" ];
   };
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index 32e42a8b944f..a23d7d3d8849 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -151,7 +151,7 @@ stdenv.mkDerivation rec {
     description = "Collect, organize, cite, and share your research sources";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Only;
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ i077 ];
   };
 }
diff --git a/pkgs/applications/office/zotero/zotero_7.nix b/pkgs/applications/office/zotero/zotero_7.nix
index 2164e44154ae..941581d22df0 100644
--- a/pkgs/applications/office/zotero/zotero_7.nix
+++ b/pkgs/applications/office/zotero/zotero_7.nix
@@ -144,7 +144,7 @@ stdenv.mkDerivation rec {
     description = "Collect, organize, cite, and share your research sources";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Only;
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ atila ];
   };
 }
diff --git a/pkgs/applications/radio/gnuradio/3.9.nix b/pkgs/applications/radio/gnuradio/3.9.nix
index 4d10851b7e13..62ee880ce2be 100644
--- a/pkgs/applications/radio/gnuradio/3.9.nix
+++ b/pkgs/applications/radio/gnuradio/3.9.nix
@@ -276,7 +276,7 @@ stdenv.mkDerivation (finalAttrs: (shared // {
   '';
   patches = [
     # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
-    ./modtool-newmod-permissions.patch
+    ./modtool-newmod-permissions.3_9.patch
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overridden and are used inside GR plugins - the same version must
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index d1f0a3fd6fb6..7765b92c1d26 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -45,11 +45,11 @@
 # If one wishes to use a different src or name for a very custom build
 , overrideSrc ? {}
 , pname ? "gnuradio"
-, version ? "3.10.7.0"
+, version ? "3.10.8.0"
 }:
 
 let
-  sourceSha256 = "sha256-7fIQMcx90wI4mAZmR26/rkBKPKhNxgu3oWpJTV3C+Ek=";
+  sourceSha256 = "sha256-4BoJciL3ffd9Dgk3HxXCOOwnGHqCEVuo+a1AtzJG4IY=";
   featuresInfo = {
     # Needed always
     basic = {
@@ -291,12 +291,6 @@ stdenv.mkDerivation (finalAttrs: (shared // {
   patches = [
     # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
     ./modtool-newmod-permissions.patch
-    # https://github.com/gnuradio/gnuradio/pull/6808
-    (fetchpatch {
-      name = "gnuradio-fmt10.1.patch";
-      url = "https://github.com/gnuradio/gnuradio/commit/9357c17721a27cc0aae3fe809af140c84e492f37.patch";
-      hash = "sha256-w3b22PTqoORyYQ3RKRG+2htQWbITzQiOdSDyuejUtHQ=";
-    })
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overridden and are used inside GR plugins - the same version must
diff --git a/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.3_9.patch b/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.3_9.patch
new file mode 100644
index 000000000000..7cab73fede0c
--- /dev/null
+++ b/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.3_9.patch
@@ -0,0 +1,15 @@
+diff --git c/gr-utils/modtool/core/newmod.py w/gr-utils/modtool/core/newmod.py
+index babebfcde..9a02f663e 100644
+--- c/gr-utils/modtool/core/newmod.py
++++ w/gr-utils/modtool/core/newmod.py
+@@ -62,7 +62,9 @@ class ModToolNewModule(ModTool):
+         self._setup_scm(mode='new')
+         logger.info(f"Creating out-of-tree module in {self.dir}...")
+         try:
+-            shutil.copytree(self.srcdir, self.dir)
++            # https://stackoverflow.com/a/17022146/4935114
++            shutil.copystat = lambda x, y: x
++            shutil.copytree(self.srcdir, self.dir, copy_function=shutil.copyfile)
+             try:
+               shutil.copyfile(os.path.join(gr.prefix(), 'share', 'gnuradio', 'clang-format.conf'),
+                               os.path.join(self.dir, '.clang-format'))
diff --git a/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.patch b/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.patch
index 7cab73fede0c..671a7559f4e4 100644
--- a/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.patch
+++ b/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.patch
@@ -1,8 +1,8 @@
-diff --git c/gr-utils/modtool/core/newmod.py w/gr-utils/modtool/core/newmod.py
-index babebfcde..9a02f663e 100644
---- c/gr-utils/modtool/core/newmod.py
+diff --git i/gr-utils/modtool/core/newmod.py w/gr-utils/modtool/core/newmod.py
+index 8b222473f..c82fcd538 100644
+--- i/gr-utils/modtool/core/newmod.py
 +++ w/gr-utils/modtool/core/newmod.py
-@@ -62,7 +62,9 @@ class ModToolNewModule(ModTool):
+@@ -66,7 +66,9 @@ class ModToolNewModule(ModTool):
          self._setup_scm(mode='new')
          logger.info(f"Creating out-of-tree module in {self.dir}...")
          try:
@@ -10,6 +10,6 @@ index babebfcde..9a02f663e 100644
 +            # https://stackoverflow.com/a/17022146/4935114
 +            shutil.copystat = lambda x, y: x
 +            shutil.copytree(self.srcdir, self.dir, copy_function=shutil.copyfile)
-             try:
-               shutil.copyfile(os.path.join(gr.prefix(), 'share', 'gnuradio', 'clang-format.conf'),
-                               os.path.join(self.dir, '.clang-format'))
+             source_dir = os.path.join(gr.prefix(), "share", "gnuradio")
+             for source_name, target_name in (
+                     ("clang-format.conf", ".clang-format"),
diff --git a/pkgs/applications/system/asusctl/Cargo.lock b/pkgs/applications/system/asusctl/Cargo.lock
index b85fc8b03e61..7629e4050758 100644
--- a/pkgs/applications/system/asusctl/Cargo.lock
+++ b/pkgs/applications/system/asusctl/Cargo.lock
@@ -199,7 +199,7 @@ checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
 
 [[package]]
 name = "asusctl"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "asusd",
  "cargo-husky",
@@ -218,7 +218,7 @@ dependencies = [
 
 [[package]]
 name = "asusd"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "async-trait",
  "cargo-husky",
@@ -237,12 +237,13 @@ dependencies = [
  "serde_derive",
  "systemd-zbus",
  "tokio",
+ "udev",
  "zbus",
 ]
 
 [[package]]
 name = "asusd-user"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "config-traits",
@@ -845,7 +846,7 @@ dependencies = [
 
 [[package]]
 name = "config-traits"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "log",
@@ -898,7 +899,7 @@ dependencies = [
 
 [[package]]
 name = "cpuctl"
-version = "5.0.0"
+version = "5.0.2"
 
 [[package]]
 name = "cpufeatures"
@@ -1025,7 +1026,7 @@ dependencies = [
 
 [[package]]
 name = "dmi_id"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "log",
  "udev",
@@ -2845,7 +2846,7 @@ checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "rog-control-center"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "asusd",
  "cargo-husky",
@@ -2878,7 +2879,7 @@ dependencies = [
 
 [[package]]
 name = "rog_anime"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "dmi_id",
@@ -2895,7 +2896,7 @@ dependencies = [
 
 [[package]]
 name = "rog_aura"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "dmi_id",
@@ -2909,7 +2910,7 @@ dependencies = [
 
 [[package]]
 name = "rog_dbus"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "asusd",
  "cargo-husky",
@@ -2922,7 +2923,7 @@ dependencies = [
 
 [[package]]
 name = "rog_platform"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "concat-idents",
@@ -2939,7 +2940,7 @@ dependencies = [
 
 [[package]]
 name = "rog_profiles"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "log",
@@ -2953,7 +2954,7 @@ dependencies = [
 
 [[package]]
 name = "rog_simulators"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "glam",
  "log",
diff --git a/pkgs/applications/system/asusctl/default.nix b/pkgs/applications/system/asusctl/default.nix
index da7187aa7918..bc4ddfbf596c 100644
--- a/pkgs/applications/system/asusctl/default.nix
+++ b/pkgs/applications/system/asusctl/default.nix
@@ -13,13 +13,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "asusctl";
-  version = "5.0.0";
+  version = "5.0.2";
 
   src = fetchFromGitLab {
     owner = "asus-linux";
     repo = "asusctl";
     rev = version;
-    hash = "sha256-ZdPSUXchQ19awvlNFVih38p6AU7KQ2RttUnm8zQnTWs=";
+    hash = "sha256-0+HCqp/mn+O6Cnbmma7iw5EFBbLozvnkqGA378oj0G8=";
   };
 
   cargoHash = "";
diff --git a/pkgs/applications/video/mkvtoolnix/default.nix b/pkgs/applications/video/mkvtoolnix/default.nix
index a131a5a20980..9e0873b407f9 100644
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@@ -25,6 +25,7 @@
 , pugixml
 , qtbase
 , qtmultimedia
+, utf8cpp
 , xdg-utils
 , zlib
 , withGUI ? true
@@ -32,7 +33,8 @@
 }:
 
 let
-  inherit (lib) enableFeature optional optionals optionalString;
+  inherit (lib)
+    enableFeature getDev getLib optionals optionalString;
 
   phase = name: args:
     ''
@@ -64,10 +66,9 @@ stdenv.mkDerivation rec {
     pkg-config
     rake
   ]
-  ++ optional withGUI wrapQtAppsHook;
+  ++ optionals withGUI [ wrapQtAppsHook ];
 
-  # 1. qtbase and qtmultimedia are needed without the GUI
-  # 2. we have utf8cpp in nixpkgs but it doesn't find it
+  # qtbase and qtmultimedia are needed without the GUI
   buildInputs = [
     boost
     expat
@@ -84,11 +85,12 @@ stdenv.mkDerivation rec {
     pugixml
     qtbase
     qtmultimedia
+    utf8cpp
     xdg-utils
     zlib
   ]
-  ++ optional withGUI cmark
-  ++ optional stdenv.isDarwin libiconv;
+  ++ optionals withGUI [ cmark ]
+  ++ optionals stdenv.isDarwin [ libiconv ];
 
   # autoupdate is not needed but it silences a ton of pointless warnings
   postPatch = ''
@@ -103,9 +105,11 @@ stdenv.mkDerivation rec {
     "--disable-static-qt"
     "--disable-update-check"
     "--enable-optimization"
-    "--with-boost-libdir=${lib.getLib boost}/lib"
+    "--with-boost-libdir=${getLib boost}/lib"
     "--with-docbook-xsl-root=${docbook_xsl}/share/xml/docbook-xsl"
     "--with-gettext"
+    "--with-extra-includes=${getDev utf8cpp}/include/utf8cpp"
+    "--with-extra-libs=${getLib utf8cpp}/lib"
     (enableFeature withGUI "gui")
   ];
 
diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
index 7d0138a4d85a..e13288371b5d 100644
--- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
@@ -187,6 +187,12 @@ let
       x11_args+=(--ro-bind-try "$local_socket" "$local_socket")
     fi
 
+    ${lib.optionalString privateTmp ''
+    # sddm places XAUTHORITY in /tmp
+    if [[ "$XAUTHORITY" == /tmp/* ]]; then
+      x11_args+=(--ro-bind-try "$XAUTHORITY" "$XAUTHORITY")
+    fi''}
+
     cmd=(
       ${bubblewrap}/bin/bwrap
       --dev-bind /dev /dev
diff --git a/pkgs/build-support/dart/build-dart-application/default.nix b/pkgs/build-support/dart/build-dart-application/default.nix
index 1a98f98fb8e6..2cb193ac6f16 100644
--- a/pkgs/build-support/dart/build-dart-application/default.nix
+++ b/pkgs/build-support/dart/build-dart-application/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, callPackage, fetchDartDeps, writeText, symlinkJoin, dartHooks, makeWrapper, dart, cacert, nodejs, darwin, jq }:
+{ lib, stdenv, callPackage, fetchDartDeps, runCommand, symlinkJoin, writeText, dartHooks, makeWrapper, dart, cacert, nodejs, darwin, jq }:
 
 { sdkSetupScript ? ""
 , pubGetScript ? "dart pub get"
@@ -37,13 +37,15 @@
 let
   dartDeps = (fetchDartDeps.override {
     dart = symlinkJoin {
-      name = "dart-fod";
-      paths = [ dart ];
-      nativeBuildInputs = [ makeWrapper ];
-      postBuild = ''
-        wrapProgram "$out/bin/dart" \
-          --add-flags "--root-certs-file=${cacert}/etc/ssl/certs/ca-bundle.crt"
-      '';
+      name = "dart-sdk-fod";
+      paths = [
+        (runCommand "dart-fod" { nativeBuildInputs = [ makeWrapper ]; } ''
+          mkdir -p "$out/bin"
+          makeWrapper "${dart}/bin/dart" "$out/bin/dart" \
+            --add-flags "--root-certs-file=${cacert}/etc/ssl/certs/ca-bundle.crt"
+        '')
+        dart
+      ];
     };
   }) {
     buildDrvArgs = args;
diff --git a/pkgs/build-support/dart/fetch-dart-deps/default.nix b/pkgs/build-support/dart/fetch-dart-deps/default.nix
index 51052cae18f4..e6e5cf76a60f 100644
--- a/pkgs/build-support/dart/fetch-dart-deps/default.nix
+++ b/pkgs/build-support/dart/fetch-dart-deps/default.nix
@@ -154,15 +154,27 @@ let
       outputHash = if vendorHash != "" then vendorHash else lib.fakeSha256;
     } // (removeAttrs drvArgs [ "name" "pname" ]));
 
-  depsListDrv = stdenvNoCC.mkDerivation ({
-    name = "${name}-dart-deps-list.json";
-    nativeBuildInputs = [ hook dart jq ];
+  mkDepsDrv = args: stdenvNoCC.mkDerivation (args // {
+    nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [ hook dart ];
 
-    configurePhase = ''
+    configurePhase = args.configurePhase or ''
       runHook preConfigure
-      doPubGet dart pub get --offline
+
+      ${sdkSetupScript}
+
+      _pub_get() {
+        ${pubGetScript} --offline
+      }
+      doPubGet _pub_get
+
       runHook postConfigure
     '';
+  } // (removeAttrs buildDrvInheritArgs [ "name" "pname" ]));
+
+  depsListDrv = mkDepsDrv {
+    name = "${name}-dart-deps-list.json";
+
+    nativeBuildInputs = [ jq ];
 
     buildPhase = ''
       runHook preBuild
@@ -171,7 +183,34 @@ let
     '';
 
     dontInstall = true;
-  } // (removeAttrs buildDrvInheritArgs [ "name" "pname" ]));
+  };
+
+  packageConfigDrv = mkDepsDrv {
+    name = "${name}-package-config.json";
+
+    nativeBuildInputs = [ jq ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      # Canonicalise the package_config.json, and replace references to the
+      # reconstructed package cache with the original FOD.
+      #
+      # The reconstructed package cache is not reproducible. The intended
+      # use-case of this derivation is for use with tools that use a
+      # package_config.json to load assets from packages, and not for use with
+      # Pub directly, which requires the setup performed by the hook before
+      # usage.
+      jq -S '
+        .packages[] |= . + { rootUri: .rootUri | gsub("'"$PUB_CACHE"'"; "${hook.deps}/cache/.pub-cache") }
+      | .generated |= "1970-01-01T00:00:00.000Z"
+      ' .dart_tool/package_config.json > $out
+
+      runHook postBuild
+    '';
+
+    dontInstall = true;
+  };
 
   # As of Dart 3.0.0, Pub checks the revision of cached Git-sourced packages.
   # Git must be wrapped to return a positive result, as the real .git directory is wiped
@@ -195,8 +234,10 @@ let
     substitutions = { inherit gitSourceWrapper deps; };
     propagatedBuildInputs = [ dart git ];
     passthru = {
+      inherit deps;
       files = deps.outPath;
       depsListFile = depsListDrv.outPath;
+      packageConfig = packageConfigDrv;
     };
   }) ./setup-hook.sh;
 in
diff --git a/pkgs/build-support/flutter/default.nix b/pkgs/build-support/flutter/default.nix
index 3e136211655b..bcee31506df1 100644
--- a/pkgs/build-support/flutter/default.nix
+++ b/pkgs/build-support/flutter/default.nix
@@ -48,6 +48,8 @@
     flutter config --enable-linux-desktop >/dev/null
   '';
 
+  inherit pubGetScript;
+
   nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [ wrapGAppsHook ];
   buildInputs = (args.buildInputs or [ ]) ++ [ glib ];
 
diff --git a/pkgs/by-name/am/amphetype/package.nix b/pkgs/by-name/am/amphetype/package.nix
new file mode 100644
index 000000000000..a59febee6692
--- /dev/null
+++ b/pkgs/by-name/am/amphetype/package.nix
@@ -0,0 +1,32 @@
+{ fetchFromGitLab, lib, python3Packages, qt5 }:
+
+let
+  pname = "amphetype";
+  version = "1.0.0";
+in python3Packages.buildPythonApplication {
+  inherit pname version;
+
+  src = fetchFromGitLab {
+    owner = "franksh";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-pve2f+XMfFokMCtW3KdeOJ9Ey330Gwv/dk1+WBtrBEQ=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    editdistance
+    pyqt5
+    translitcodec
+  ];
+
+  doCheck = false;
+
+  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+
+  meta = with lib; {
+    description = "An advanced typing practice program";
+    homepage = "https://gitlab.com/franksh/amphetype";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ rycee ];
+  };
+}
diff --git a/pkgs/by-name/cl/cloudlogoffline/package.nix b/pkgs/by-name/cl/cloudlogoffline/package.nix
new file mode 100644
index 000000000000..cc945302bf06
--- /dev/null
+++ b/pkgs/by-name/cl/cloudlogoffline/package.nix
@@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, qt5
+, makeDesktopItem
+, copyDesktopItems
+}:
+stdenv.mkDerivation (self: {
+  pname = "cloudlogoffline";
+  version = "1.1.4";
+  rev = "185f294ec36d7ebe40e37d70148b15f58d60bf0d";
+  hash = "sha256-UEi7q3NbTgkg4tSjiksEO05YE4yjRul4qB9hFPswnK0=";
+
+  src = fetchFromGitHub {
+    inherit (self) rev hash;
+    owner = "myzinsky";
+    repo = "cloudLogOffline";
+  };
+
+  nativeBuildInputs = [
+    qt5.qmake
+    qt5.wrapQtAppsHook
+  ]
+  ++ lib.optionals (!stdenv.isDarwin) [
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    qt5.qtbase
+    qt5.qtgraphicaleffects
+    qt5.qtlocation
+    qt5.qtpositioning
+    qt5.qtquickcontrols2
+    qt5.qtsvg
+  ];
+
+  postPatch = let
+    targetDir = if stdenv.isDarwin then "Applications" else "bin";
+  in ''
+    substituteInPlace CloudLogOffline.pro \
+      --replace 'target.path = /opt/$''${TARGET}/bin' "target.path = $out/${targetDir}"
+  '';
+
+  postInstall = lib.optionalString (!stdenv.isDarwin) ''
+    install -d $out/share/pixmaps
+    install -m644 images/logo_circle.svg $out/share/pixmaps/cloudlogoffline.svg
+  '';
+
+  desktopItems = lib.optionals (!stdenv.isDarwin) [
+    (makeDesktopItem {
+      name = "cloudlogoffline";
+      desktopName = "CloudLogOffline";
+      exec = "CloudLogOffline";
+      icon = "cloudlogoffline";
+      comment = self.meta.description;
+      genericName = "Ham radio contact logbook";
+      categories = [ "Network" "Utility" "HamRadio" ];
+    })
+  ];
+
+  meta = {
+    description = "Offline frontend for Cloudlog";
+    homepage = "https://github.com/myzinsky/cloudLogOffline";
+    license = [ lib.licenses.lgpl3 ];
+    mainProgram = "CloudLogOffline";
+    maintainers = [ lib.maintainers.dblsaiko ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/co/composer-require-checker/package.nix b/pkgs/by-name/co/composer-require-checker/package.nix
new file mode 100644
index 000000000000..f32529607c19
--- /dev/null
+++ b/pkgs/by-name/co/composer-require-checker/package.nix
@@ -0,0 +1,28 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, php
+}:
+
+php.buildComposerProject (finalAttrs: {
+  pname = "composer-require-checker";
+  version = "4.8.0";
+
+  src = fetchFromGitHub {
+    owner = "maglnet";
+    repo = "ComposerRequireChecker";
+    rev = finalAttrs.version;
+    hash = "sha256-qCHUNaPunCPuWax/YUbYXaVh1JlJEwYvG/NmaSc1VpA=";
+  };
+
+  vendorHash = "sha256-B5w5n2S/mTF7vpsLuHtf2DGR5aPBfO9QGmodYGXE+Cg=";
+
+  meta = {
+    description = "A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies";
+    homepage = "https://github.com/maglnet/ComposerRequireChecker/";
+    changelog = "https://github.com/maglnet/ComposerRequireChecker/releases/tag/${finalAttrs.version}";
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "composer-require-checker";
+  };
+})
diff --git a/pkgs/tools/graphics/didder/default.nix b/pkgs/by-name/di/didder/package.nix
similarity index 79%
rename from pkgs/tools/graphics/didder/default.nix
rename to pkgs/by-name/di/didder/package.nix
index 10e97e356daf..3862c1599686 100644
--- a/pkgs/tools/graphics/didder/default.nix
+++ b/pkgs/by-name/di/didder/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "didder";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "makew0rld";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-S1j2TdV0XCrSc7Ua+SdY3JJoWgnFuAMGhUinTKO2Xh4=";
+    hash = "sha256-wYAudEyOLxbNfk4M720absGkuWXcaBPyBAcmBNBaaWU=";
   };
 
-  vendorHash = "sha256-TEp1YrQquqdEMVvZaNsEB1H/DZsTYmRL257RjQF2JqM=";
+  vendorHash = "sha256-UD90N3nE3H9GSdVhGt1zfCk8BhPaToKGu4i0zP0Lb3Q=";
 
   nativeBuildInputs = [ pandoc ];
 
diff --git a/pkgs/by-name/ni/nitter/lock.json b/pkgs/by-name/ni/nitter/lock.json
index 5e059f869af0..2a9106dc9ff4 100644
--- a/pkgs/by-name/ni/nitter/lock.json
+++ b/pkgs/by-name/ni/nitter/lock.json
@@ -62,11 +62,11 @@
       "packages": [
         "jsony"
       ],
-      "path": "/nix/store/bzcq8q439rdsqhhihikzv3rsx4l4ybdm-source",
-      "rev": "ea811be",
-      "sha256": "1720iqsxjhqmhw1zhhs7d2ncdz25r8fqadls1p1iry1wfikjlnba",
+      "path": "/nix/store/l84av0wdc0s4r4alsvkaxcxhpd6j4bzg-source",
+      "rev": "1de1f08",
+      "sha256": "0rj205cs3v6g80h8ys9flbdq4wyd1csmkwdxv0lz21972zcsrcfh",
       "srcDir": "src",
-      "url": "https://github.com/treeform/jsony/archive/ea811be.tar.gz"
+      "url": "https://github.com/treeform/jsony/archive/1de1f08.tar.gz"
     },
     {
       "method": "fetchzip",
@@ -95,11 +95,22 @@
       "packages": [
         "nimcrypto"
       ],
-      "path": "/nix/store/dnj20qh97ylf57nka9wbxs735wbw7yxv-source",
-      "rev": "4014ef9",
-      "sha256": "1kgqr2lqaffglc1fgbanwcvhkqcbbd20d5b6w4lf0nksfl9c357a",
+      "path": "/nix/store/zyr8zwh7vaiycn1s4r8cxwc71f2k5l0h-source",
+      "rev": "a079df9",
+      "sha256": "1dmdmgb6b9m5f8dyxk781nnd61dsk3hdxqks7idk9ncnpj9fng65",
       "srcDir": "",
-      "url": "https://github.com/cheatfate/nimcrypto/archive/4014ef9.tar.gz"
+      "url": "https://github.com/cheatfate/nimcrypto/archive/a079df9.tar.gz"
+    },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "oauth"
+      ],
+      "path": "/nix/store/bwmrrzs6xpwizmww35461x3lqpgd0942-source",
+      "rev": "b8c163b",
+      "sha256": "0k5slyzjngbdr6g0b0dykhqmaf8r8n2klbkg2gpid4ckm8hg62v5",
+      "srcDir": "src",
+      "url": "https://github.com/CORDEA/oauth/archive/b8c163b.tar.gz"
     },
     {
       "method": "fetchzip",
@@ -156,6 +167,18 @@
       "srcDir": "src",
       "url": "https://github.com/dom96/sass/archive/7dfdd03.tar.gz"
     },
+    {
+      "method": "fetchzip",
+      "packages": [
+        "sha1"
+      ],
+      "path": "/nix/store/a6a0ycxsaxpqks42aq9wicj8ars7z7ai-source",
+      "ref": "master",
+      "rev": "92ccc5800bb0ac4865b275a2ce3c1544e98b48bc",
+      "sha256": "00zvvd8ssy22srg74xzapknmgmi82v534npjdrk5805shswfhqdm",
+      "srcDir": "",
+      "url": "https://github.com/onionhammer/sha1/archive/92ccc5800bb0ac4865b275a2ce3c1544e98b48bc.tar.gz"
+    },
     {
       "method": "fetchzip",
       "packages": [
diff --git a/pkgs/by-name/ni/nitter/package.nix b/pkgs/by-name/ni/nitter/package.nix
index 6b63037e103d..d3fc03b25ace 100644
--- a/pkgs/by-name/ni/nitter/package.nix
+++ b/pkgs/by-name/ni/nitter/package.nix
@@ -8,13 +8,13 @@
 
 buildNimPackage (finalAttrs: prevAttrs: {
   pname = "nitter";
-  version = "unstable-2023-10-31";
+  version = "unstable-2023-12-03";
 
   src = fetchFromGitHub {
     owner = "zedeus";
     repo = "nitter";
-    rev = "b62d73dbd373f08af07c7a79efcd790d3bc1a49c";
-    hash = "sha256-yCD7FbqWZMY0fyFf9Q3Ka06nw5Ha7jYLpmPONAhEVIM=";
+    rev = "583c858cdf3486451ed6a0627640844f27009dbe";
+    hash = "sha256-3E6nfmOFhQ2bjwGMWdTmZ38Fg/SE36s6fxYDXwSJaTw=";
   };
 
   lockFile = ./lock.json;
diff --git a/pkgs/by-name/te/terrapin-scanner/package.nix b/pkgs/by-name/te/terrapin-scanner/package.nix
index 2ffeec08b280..3b09e5953293 100644
--- a/pkgs/by-name/te/terrapin-scanner/package.nix
+++ b/pkgs/by-name/te/terrapin-scanner/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "terrapin-scanner";
-  version = "1.0.3";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "RUB-NDS";
     repo = "Terrapin-Scanner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-snKEIWhFj+uG/jY1nbq/8T0y2FcAdkIUTf9J2Lz6owo=";
+    hash = "sha256-d0aAs9dT74YQkzDQnmeEo+p/RnPHeG2+SgCCF/t1F+w=";
   };
 
-  vendorHash = null;
+  vendorHash = "sha256-skYMlL9SbBoC89tFCTIzyRViEJaviXENASEqr6zSvoo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/desktops/gnome/core/evince/default.nix b/pkgs/desktops/gnome/core/evince/default.nix
index a2959626c837..f02f2e323e25 100644
--- a/pkgs/desktops/gnome/core/evince/default.nix
+++ b/pkgs/desktops/gnome/core/evince/default.nix
@@ -140,6 +140,7 @@ stdenv.mkDerivation rec {
 
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
+    mainProgram = "evince";
     maintainers = teams.gnome.members ++ teams.pantheon.members;
   };
 }
diff --git a/pkgs/development/compilers/flutter/artifacts/fetch-artifacts.nix b/pkgs/development/compilers/flutter/artifacts/fetch-artifacts.nix
new file mode 100644
index 000000000000..e0c1440a604f
--- /dev/null
+++ b/pkgs/development/compilers/flutter/artifacts/fetch-artifacts.nix
@@ -0,0 +1,54 @@
+{ lib
+, runCommand
+, xorg
+, cacert
+, unzip
+
+, platform
+, flutter
+, hash
+}:
+
+let
+  platforms = [
+    "android"
+    "ios"
+    "web"
+    "linux"
+    "windows"
+    "macos"
+    "fuchsia"
+    "universal"
+  ];
+
+  flutter' = flutter.override {
+    # Use a version of Flutter with just enough capabilities to download
+    # artifacts.
+    supportedTargetPlatforms = [ ];
+  };
+in
+runCommand "flutter-artifacts-${platform}"
+{
+  nativeBuildInputs = [ xorg.lndir flutter' unzip ];
+
+  NIX_FLUTTER_TOOLS_VM_OPTIONS = "--root-certs-file=${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+  outputHash = hash;
+  outputHashMode = "recursive";
+  outputHashAlgo = "sha256";
+
+  passthru = {
+    inherit platform;
+  };
+} ''
+  export FLUTTER_ROOT="$NIX_BUILD_TOP"
+  lndir -silent '${flutter'}' "$FLUTTER_ROOT"
+  rm -rf "$FLUTTER_ROOT/bin/cache"
+  mkdir "$FLUTTER_ROOT/bin/cache"
+
+  HOME="$(mktemp -d)" flutter precache -v '--${platform}' ${builtins.concatStringsSep " " (map (p: "'--no-${p}'") (lib.remove platform platforms))}
+  rm -rf "$FLUTTER_ROOT/bin/cache/lockfile"
+  find "$FLUTTER_ROOT" -type l -lname '${flutter'}/*' -delete
+
+  cp -r bin/cache "$out"
+''
diff --git a/pkgs/development/compilers/flutter/artifacts/hashes.nix b/pkgs/development/compilers/flutter/artifacts/hashes.nix
new file mode 100644
index 000000000000..551975acf662
--- /dev/null
+++ b/pkgs/development/compilers/flutter/artifacts/hashes.nix
@@ -0,0 +1,75 @@
+# NOTICE: When updating these hashes, make sure that no additional platforms
+# have been added to the `flutter precache` CLI. If any have, they may be
+# included in every derivation, unless they are also added to the platform list
+# in fetch-artifacts.nix.
+#
+# The known arguments are as follows:
+# $ flutter precache --help --verbose
+# Usage: flutter precache [arguments]
+# -h, --help                              Print this usage information.
+# -a, --all-platforms                     Precache artifacts for all host platforms.
+# -f, --force                             Force re-downloading of artifacts.
+#     --[no-]android                      Precache artifacts for Android development.
+#     --[no-]android_gen_snapshot         Precache gen_snapshot for Android development.
+#     --[no-]android_maven                Precache Gradle dependencies for Android development.
+#     --[no-]android_internal_build       Precache dependencies for internal Android development.
+#     --[no-]ios                          Precache artifacts for iOS development.
+#     --[no-]web                          Precache artifacts for web development.
+#     --[no-]linux                        Precache artifacts for Linux desktop development.
+#     --[no-]windows                      Precache artifacts for Windows desktop development.
+#     --[no-]macos                        Precache artifacts for macOS desktop development.
+#     --[no-]fuchsia                      Precache artifacts for Fuchsia development.
+#     --[no-]universal                    Precache artifacts required for any development platform.
+#                                         (defaults to on)
+#     --[no-]flutter_runner               Precache the flutter runner artifacts.
+#     --[no-]use-unsigned-mac-binaries    Precache the unsigned macOS binaries when available.
+
+# Schema:
+# ${flutterVersion}.${targetPlatform}.${hostPlatform}
+#
+# aarch64-darwin as a host is not yet supported.
+# https://github.com/flutter/flutter/issues/60118
+{
+  "3.13.8" = {
+    android = {
+      x86_64-linux = "sha256-Uc36aBq8wQo2aEvjAPOoixZElWOE/GNRm2GUfhbwT3Y=";
+      aarch64-linux = "sha256-Uc36aBq8wQo2aEvjAPOoixZElWOE/GNRm2GUfhbwT3Y=";
+      x86_64-darwin = "sha256-v/6/GTj7732fEOIgSaoM00yaw2qNwOMuvbuoCvii7vQ=";
+    };
+    fuchsia = {
+      x86_64-linux = "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=";
+      aarch64-linux = "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=";
+      x86_64-darwin = "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=";
+    };
+    ios = {
+      x86_64-linux = "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao=";
+      aarch64-linux = "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao=";
+      x86_64-darwin = "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao=";
+    };
+    linux = {
+      x86_64-linux = "sha256-0gIOwux3YBdmcXgwICr8dpftj1CauaBUX8Rt5GG0WSs=";
+      aarch64-linux = "sha256-drGHsuJoOCLqrhVrXczqJRCOtpeWVlqdWW0OSMS/l5M=";
+      x86_64-darwin = "sha256-0gIOwux3YBdmcXgwICr8dpftj1CauaBUX8Rt5GG0WSs=";
+    };
+    macos = {
+      x86_64-linux = "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc=";
+      aarch64-linux = "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc=";
+      x86_64-darwin = "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc=";
+    };
+    universal = {
+      x86_64-linux = "sha256-wATt1UPjo/fh7RFO1vvcUAdo0dMAaaOUIuzYodsM0v0=";
+      aarch64-linux = "sha256-Z9bszNaIpCccG7OfvE5WFsw36dITiyCQAZ6p29+Yq68=";
+      x86_64-darwin = "sha256-qN5bAXRfQ78TWF3FLBIxWzUB5y5OrZVQTEilY5J/+2k=";
+    };
+    web = {
+      x86_64-linux = "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0=";
+      aarch64-linux = "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0=";
+      x86_64-darwin = "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0=";
+    };
+    windows = {
+      x86_64-linux = "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI=";
+      aarch64-linux = "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI=";
+      x86_64-darwin = "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI=";
+    };
+  };
+}
diff --git a/pkgs/development/compilers/flutter/artifacts/overrides/linux.nix b/pkgs/development/compilers/flutter/artifacts/overrides/linux.nix
new file mode 100644
index 000000000000..bc6114415b90
--- /dev/null
+++ b/pkgs/development/compilers/flutter/artifacts/overrides/linux.nix
@@ -0,0 +1,10 @@
+{ gtk3
+}:
+
+{ buildInputs ? [ ]
+, ...
+}:
+
+{
+  buildInputs = buildInputs ++ [ gtk3 ];
+}
diff --git a/pkgs/development/compilers/flutter/artifacts/prepare-artifacts.nix b/pkgs/development/compilers/flutter/artifacts/prepare-artifacts.nix
new file mode 100644
index 000000000000..9714d25c6f9b
--- /dev/null
+++ b/pkgs/development/compilers/flutter/artifacts/prepare-artifacts.nix
@@ -0,0 +1,26 @@
+{ lib
+, stdenv
+, callPackage
+, autoPatchelfHook
+, src
+}:
+
+(stdenv.mkDerivation {
+  inherit (src) name;
+  inherit src;
+
+  nativeBuildInputs = lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin"
+    cp -r . "$out/bin/cache"
+
+    runHook postInstall
+  '';
+}).overrideAttrs (
+  if builtins.pathExists ./overrides/${src.platform}.nix
+  then callPackage ./overrides/${src.platform}.nix { }
+  else ({ ... }: { })
+)
diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
index ff18036677a1..f9c0320edec8 100644
--- a/pkgs/development/compilers/flutter/default.nix
+++ b/pkgs/development/compilers/flutter/default.nix
@@ -1,14 +1,24 @@
-{ callPackage, fetchzip, dart, lib, stdenv }:
+{ callPackage, fetchzip, fetchFromGitHub, dart, lib, stdenv }:
 let
   mkCustomFlutter = args: callPackage ./flutter.nix args;
   wrapFlutter = flutter: callPackage ./wrapper.nix { inherit flutter; };
   getPatches = dir:
     let files = builtins.attrNames (builtins.readDir dir);
     in map (f: dir + ("/" + f)) files;
-  mkFlutter = { version, engineVersion, dartVersion, flutterHash, dartHash, patches }:
+  mkFlutter =
+    { version
+    , engineVersion
+    , dartVersion
+    , flutterHash
+    , dartHash
+    , patches
+    , pubspecLockFile
+    , vendorHash
+    , depsListFile
+    }:
     let
       args = {
-        inherit version engineVersion patches;
+        inherit version engineVersion patches pubspecLockFile vendorHash depsListFile;
 
         dart = dart.override {
           version = dartVersion;
@@ -31,24 +41,12 @@ let
             };
           };
         };
-        src = {
-          x86_64-linux = fetchzip {
-            url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${version}-stable.tar.xz";
-            sha256 = flutterHash.x86_64-linux;
-          };
-          aarch64-linux = fetchzip {
-            url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${version}-stable.tar.xz";
-            sha256 = flutterHash.aarch64-linux;
-          };
-          x86_64-darwin = fetchzip {
-            url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_${version}-stable.zip";
-            sha256 = flutterHash.x86_64-darwin;
-          };
-          aarch64-darwin = fetchzip {
-            url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_arm64_${version}-stable.zip";
-            sha256 = flutterHash.aarch64-darwin;
-          };
-        }.${stdenv.hostPlatform.system};
+        src = fetchFromGitHub {
+          owner = "flutter";
+          repo = "flutter";
+          rev = version;
+          hash = flutterHash;
+        };
       };
     in
     (mkCustomFlutter args).overrideAttrs (prev: next: {
@@ -57,13 +55,7 @@ let
         buildFlutterApplication = callPackage ../../../build-support/flutter {
           # Package a minimal version of Flutter that only uses Linux desktop release artifacts.
           flutter = (wrapFlutter (mkCustomFlutter args)).override {
-            supportsAndroid = false;
-            includedEngineArtifacts = {
-              common = [ "flutter_patched_sdk_product" ];
-              platform.linux = lib.optionals stdenv.hostPlatform.isLinux
-                (lib.genAttrs ((lib.optional stdenv.hostPlatform.isx86_64 "x64") ++ (lib.optional stdenv.hostPlatform.isAarch64 "arm64"))
-                  (architecture: [ "release" ]));
-            };
+            supportedTargetPlatforms = [ "universal" "linux" ];
           };
         };
       };
@@ -83,12 +75,10 @@ in
       x86_64-darwin = "sha256-BchKowKd6BscVuk/dXibcQzdFkW9//GDfll77mHEI4M=";
       aarch64-darwin = "sha256-9yrx09vYrOTmdqkfJI7mfh7DI1/rg67tPlf82m5+iKI=";
     };
-    flutterHash = rec {
-      x86_64-linux = "sha256-ouI1gjcynSQfPTnfTVXQ4r/NEDdhmzUsKdcALLRiCbg=";
-      aarch64-linux = x86_64-linux;
-      x86_64-darwin = "sha256-k6KNazP/I71zG5mbx3iEtXBJ8EZi9Qq+7PgL/HAJrgE=";
-      aarch64-darwin = "sha256-Duvw8EqrGb3PmBHBH/prZjyij2xJd9sLkNfPRYpC0pQ=";
-    };
+    flutterHash = "sha256-00G030FvZZTsdf9ruFs9jdIHcC5h+xpp4NlmL64qVZA=";
     patches = flutter3Patches;
+    pubspecLockFile = ./lockfiles/stable/pubspec.lock;
+    vendorHash = "sha256-lsFOvvmhszBcFb9XvabpqfL2Ek4wjhmB0OrcWUOURFQ=";
+    depsListFile = ./lockfiles/stable/deps.json;
   };
 }
diff --git a/pkgs/development/compilers/flutter/engine-artifacts/default.nix b/pkgs/development/compilers/flutter/engine-artifacts/default.nix
deleted file mode 100644
index 30c293c8d75d..000000000000
--- a/pkgs/development/compilers/flutter/engine-artifacts/default.nix
+++ /dev/null
@@ -1,243 +0,0 @@
-{ lib
-, stdenv
-, hostPlatform
-, engineVersion
-, fetchurl
-, fetchzip
-, autoPatchelfHook
-, gtk3
-, flutterVersion
-, unzip
-, stdenvNoCC
-}:
-
-let
-  hashes = (import ./hashes.nix).${engineVersion} or
-    (throw "There are no known artifact hashes for Flutter engine version ${engineVersion}.");
-  noticeText = stdenvNoCC.mkDerivation (finalAttrs: {
-    pname = "flutter-notice";
-    version = engineVersion;
-    dontUnpack = true;
-    src = fetchurl {
-      pname = "flutter-sky_engine-LICENSE";
-      version = engineVersion;
-      url = "https://raw.githubusercontent.com/flutter/engine/${engineVersion}/sky/packages/sky_engine/LICENSE";
-      sha256 = hashes.skyNotice;
-    };
-    flutterNotice = fetchurl {
-      pname = "flutter-LICENSE";
-      version = engineVersion;
-      url = "https://raw.githubusercontent.com/flutter/flutter/${flutterVersion}/LICENSE";
-      sha256 = hashes.flutterNotice;
-    };
-    installPhase =
-      ''
-        SRC_TEXT="$(cat $src)"
-        FLUTTER_NOTICE_TEXT="$(cat $flutterNotice)"
-        cat << EOF > $out
-        This artifact is from the Flutter SDK's engine.
-        This file carries third-party notices for its dependencies.
-        See also other files, that have LICENSE in the name, in the artifact directory.
-
-        Appendix 1/2: merged sky_engine LICENSE file (also found at ${finalAttrs.src.url})
-        $SRC_TEXT
-
-        Appendix 2/2: Flutter license (also found at ${finalAttrs.flutterNotice.url})
-        $FLUTTER_NOTICE_TEXT
-        EOF
-      '';
-  });
-  artifacts =
-    {
-      common = {
-        flutter_patched_sdk = { archive = "flutter_patched_sdk.zip"; };
-        flutter_patched_sdk_product = { archive = "flutter_patched_sdk_product.zip"; };
-      };
-      platform = {
-        android =
-          (lib.genAttrs
-            [ "arm" "arm64" "x64" ]
-            (arch:
-              {
-                base = [
-                  { archive = "artifacts.zip"; }
-                ];
-                variants = lib.genAttrs [ "profile" "release" ]
-                  (variant: [
-                    { archive = "artifacts.zip"; }
-                    { subdirectory = true; archive = "${lib.toLower hostPlatform.uname.system}-x64.zip"; }
-                  ]);
-              })) //
-          {
-            "x86" = {
-              base = [
-                { archive = "artifacts.zip"; }
-              ];
-              variants.jit-release = [
-                { archive = "artifacts.zip"; }
-              ];
-            };
-          };
-
-        darwin = {
-          "arm64" = {
-            base = [
-              { archive = "artifacts.zip"; }
-              { archive = "font-subset.zip"; }
-            ];
-            variants = lib.genAttrs [ "profile" "release" ]
-              (variant: [
-                { archive = "artifacts.zip"; }
-              ]);
-          };
-          "x64" = {
-            base = [
-              { archive = "FlutterEmbedder.framework.zip"; }
-              { archive = "FlutterMacOS.framework.zip"; }
-              { archive = "artifacts.zip"; }
-              { archive = "font-subset.zip"; }
-              { archive = "gen_snapshot.zip"; }
-            ];
-            variants.profile = [
-              { archive = "FlutterMacOS.framework.zip"; }
-              { archive = "artifacts.zip"; }
-              { archive = "gen_snapshot.zip"; }
-            ];
-            variants.release = [
-              { archive = "FlutterMacOS.dSYM.zip"; }
-              { archive = "FlutterMacOS.framework.zip"; }
-              { archive = "artifacts.zip"; }
-              { archive = "gen_snapshot.zip"; }
-            ];
-          };
-        };
-
-        ios =
-          (lib.genAttrs
-            [ "" ]
-            (arch:
-              {
-                base = [
-                  { archive = "artifacts.zip"; }
-                ];
-                variants.profile = [
-                  { archive = "artifacts.zip"; }
-                ];
-                variants.release = [
-                  { archive = "artifacts.zip"; }
-                  { archive = "Flutter.dSYM.zip"; }
-                ];
-              }));
-
-        linux = lib.genAttrs
-          [ "arm64" "x64" ]
-          (arch:
-            let
-              linux-flutter-gtk = {
-                archive = "linux-${arch}-flutter-gtk.zip";
-                buildInputs = [ gtk3 ];
-              };
-            in
-            {
-              base = [
-                ({ archive = "artifacts.zip"; } // lib.optionalAttrs (arch == "arm64") {
-                  # For some reason, the arm64 artifacts are missing shader code in Flutter < 3.10.0.
-                  postPatch = ''
-                    if [ ! -d shader_lib ]; then
-                      ln -s ${lib.findSingle
-                        (pkg: lib.getName pkg == "flutter-artifact-linux-x64-artifacts")
-                        (throw "Could not find the x64 artifact archive.")
-                        (throw "Could not find the correct x64 artifact archive.")
-                        artifactDerivations.platform.linux.x64.base
-                      }/shader_lib .
-                    fi
-                  '';
-                })
-                { archive = "font-subset.zip"; }
-                (linux-flutter-gtk // {
-                  # https://github.com/flutter/flutter/commit/9d94a51b607600a39c14470c35c676eb3e30eed6
-                  variant = "debug";
-                })
-              ];
-              variants = lib.genAttrs [ "debug" "profile" "release" ] (variant: [
-                linux-flutter-gtk
-              ]);
-            });
-      };
-    };
-
-  mkArtifactDerivation = { platform ? null, variant ? null, subdirectory ? null, archive, ... }@args:
-    let
-      artifactDirectory = if platform == null then null else "${platform}${lib.optionalString (variant != null) "-${variant}"}";
-      archiveBasename = lib.removeSuffix ".${(lib.last (lib.splitString "." archive))}" archive;
-      overrideUnpackCmd = builtins.elem archive [ "FlutterEmbedder.framework.zip" "FlutterMacOS.framework.zip" ];
-    in
-    stdenv.mkDerivation ({
-      pname = "flutter-artifact${lib.optionalString (platform != null) "-${artifactDirectory}"}-${archiveBasename}";
-      version = engineVersion;
-
-      nativeBuildInputs = [ unzip ]
-        ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
-
-      src =
-        if overrideUnpackCmd then
-          (fetchurl {
-            url = "https://storage.googleapis.com/flutter_infra_release/flutter/${engineVersion}${lib.optionalString (platform != null) "/${artifactDirectory}"}/${archive}";
-            hash = (if artifactDirectory == null then hashes else hashes.${artifactDirectory}).${archive};
-          }) else
-          (fetchzip {
-            url = "https://storage.googleapis.com/flutter_infra_release/flutter/${engineVersion}${lib.optionalString (platform != null) "/${artifactDirectory}"}/${archive}";
-            stripRoot = false;
-            hash = (if artifactDirectory == null then hashes else hashes.${artifactDirectory}).${archive};
-          });
-
-      sourceRoot = if overrideUnpackCmd then "." else null;
-      unpackCmd = if overrideUnpackCmd then "unzip -o $src -d $out" else null;
-
-      installPhase =
-        let
-          destination = "$out/${if subdirectory == true then archiveBasename else if subdirectory != null then subdirectory else "."}";
-        in
-        ''
-          # ship the notice near all artifacts. if the artifact directory is / multiple directories are nested in $src, link it there. If there isn't a directory, link it in root
-          # this *isn't the same as the subdirectory variable above*
-          DIR_CNT="$(echo */ | wc -w)"
-          if [[ "$DIR_CNT" == 0 ]]; then
-            ln -s ${noticeText} LICENSE.README
-          else
-            for dir in */
-            do
-              ln -s ${noticeText} "$dir/LICENSE.README"
-            done
-          fi
-          mkdir -p "${destination}"
-          cp -r . "${destination}"
-        '';
-    } // args);
-
-  artifactDerivations = {
-    common = builtins.mapAttrs (name: mkArtifactDerivation) artifacts.common;
-    platform =
-      builtins.mapAttrs
-        (os: architectures:
-          builtins.mapAttrs
-            (architecture: variants: {
-              base = map
-                (args: mkArtifactDerivation ({
-                  platform = "${os}${lib.optionalString (architecture != "") "-${architecture}"}";
-                } // args))
-                variants.base;
-              variants = builtins.mapAttrs
-                (variant: variantArtifacts: map
-                  (args: mkArtifactDerivation ({
-                    platform = "${os}${lib.optionalString (architecture != "") "-${architecture}"}";
-                    inherit variant;
-                  } // args))
-                  variantArtifacts)
-                variants.variants;
-            })
-            architectures)
-        artifacts.platform;
-  };
-in
-artifactDerivations
diff --git a/pkgs/development/compilers/flutter/engine-artifacts/hashes.nix b/pkgs/development/compilers/flutter/engine-artifacts/hashes.nix
deleted file mode 100644
index 7bfb60d7a9ac..000000000000
--- a/pkgs/development/compilers/flutter/engine-artifacts/hashes.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{
-  "767d8c75e898091b925519803830fc2721658d07" = {
-    skyNotice = "sha256-bJMktK26wC9fVzdhLNcTHqOg5sHRZ535LB5u5dgwjlY=";
-    flutterNotice = "sha256-pZjblLYpD/vhC17PkRBXtqlDNRxyf92p5fKJHWhwCiA=";
-    android-arm = {
-      "artifacts.zip" = "sha256-pnUDY2sUN2r/LrivyNkfTUpQC90GKOI6Ya+0lgIz+c0=";
-    };
-    android-arm-profile = {
-      "artifacts.zip" = "sha256-/kDNI+no4u2Ri/FqqsQEp2iEqifULYGqzz8w0G4pzCM=";
-      "linux-x64.zip" = "sha256-fUfaDJIo1VcdJHcd0jO98Az3OdNQ+JtA5Mp6nQVVU4E=";
-      "darwin-x64.zip" = "sha256-J7vDD5VEsgnWmbI8acM3vQwrnrqcfMaCijiItDfniLY=";
-    };
-    android-arm-release = {
-      "artifacts.zip" = "sha256-tVAFHHG8A8vlgQu6l6ybdfm6OmBf2vrYf3PZByWvs08=";
-      "linux-x64.zip" = "sha256-lrejG7zpUBox9kPvs1uPM/lyR1d/SAc1w+c6kcqghHI=";
-      "darwin-x64.zip" = "sha256-8lKOsqLgbnuoCR87v84dn8V3PRzl1+maWFIHopiGvbc=";
-    };
-    android-arm64 = {
-      "artifacts.zip" = "sha256-rcU2mX0nP1ot+6DU+uxvILUOAuwTPGH23UQ6riBs0d4=";
-    };
-    android-arm64-profile = {
-      "artifacts.zip" = "sha256-x4TEJWi3c6mEPGh+3l4PtRqsg4Tq7mxHtGz+4MqwzPw=";
-      "linux-x64.zip" = "sha256-PsDKOq3DXaNeNtaFtDQJ9JIEESXBHm8XHHpOw2u1cGg=";
-      "darwin-x64.zip" = "sha256-K4W1CEBOlZVsHjuhvKCUZWv45VSohRd23vviaLqMNjQ=";
-    };
-    android-arm64-release = {
-      "artifacts.zip" = "sha256-w+J4sNhYoj44IiHpZ0BkemCYlE9wOTvWL57Y8RCstkI=";
-      "linux-x64.zip" = "sha256-MJsmck27V14/f0IAT6b/R47p8/eCMX9Nn//PEAbEeOY=";
-      "darwin-x64.zip" = "sha256-xXa5GFatJPiwBANqeWUpAdM9gibD4xH85aI6YpJrcpI=";
-    };
-    android-x64 = {
-      "artifacts.zip" = "sha256-doNUwEJkwncHPIf2c8xOZByUU8dmogtWlc6q7n7ElDY=";
-    };
-    android-x64-profile = {
-      "artifacts.zip" = "sha256-N3AjdHdzj4s6v3f3Gf6n/1Xk0W7xFQP70SneCNlj2sk=";
-      "linux-x64.zip" = "sha256-pNn75iZqLwOGO3ZmymmrSasDPMmDWwp9ZWBv9Xti4cU=";
-      "darwin-x64.zip" = "sha256-6O4lA/4wZ91ODUUYHe4HpjvraAEbhHiehBmf3sT37Dc=";
-    };
-    android-x64-release = {
-      "artifacts.zip" = "sha256-odDS/m8fgSA24EYt+W2sEDmOlPO17FZxxomWuYUHmns=";
-      "linux-x64.zip" = "sha256-sVQYmu0KaPADlL59XZc26Ks+TbmaJxRGPiJKlWxUhRA=";
-      "darwin-x64.zip" = "sha256-dep/CmBIDkvqYKQPWMCDTDbFhVvOk6N7JAF8v3dr/P8=";
-    };
-    android-x86 = {
-      "artifacts.zip" = "sha256-MzTFQ0XPtd9OXvKfM98bwpxN/xfEcXox24gn/4aS/Do=";
-    };
-    android-x86-jit-release = {
-      "artifacts.zip" = "sha256-cUsBqJxOOluwnYEFzdtZof8c4Vp1D81HkEEH8aRGLyY=";
-    };
-    darwin-arm64 = {
-      "artifacts.zip" = "sha256-df+rmN0RqLM7MgEKjTcybMY0bFYCB1jsTvaVE1J0BzY=";
-      "font-subset.zip" = "sha256-hJ5fECxN4oZX6E9ivzSDGejNSj56t2SKccbyfozXxps=";
-    };
-    darwin-arm64-profile = {
-      "artifacts.zip" = "sha256-EaXOr998zE4cG5G5FRtsDGt3jjg1GjkRGE/ZDD3Coto=";
-    };
-    darwin-arm64-release = {
-      "artifacts.zip" = "sha256-1XMoM8jDRoUSPMauKD5lsgC25B7Htod8wYouDKSEGJY=";
-    };
-    darwin-x64 = {
-      "FlutterEmbedder.framework.zip" = "sha256-vzvt0pwo1HbIxxym/jn2Y+1+Iqm/Gw2TfymEcuUHIXQ=";
-      "FlutterMacOS.framework.zip" = "sha256-cMTCULaVOKDq8VrqCmZLo0IPBve0GSh0K2yvtdCvX8c=";
-      "artifacts.zip" = "sha256-8BViZUz4b0XurQJM+FCU2toONKmhajabCc66gBUVGgY=";
-      "font-subset.zip" = "sha256-VgqNdUmvTbSedQtJNT+Eq90GWS4hXCDCBDBjno6s1dk=";
-      "gen_snapshot.zip" = "sha256-4O0ZfKt96x8/Jwh8DgBoPFiv84Tqf9tR/f0PVRJlJiQ=";
-    };
-    darwin-x64-profile = {
-      "FlutterMacOS.framework.zip" = "sha256-IrXK0Mjllic3OKaYKKpAE9gPIceTO32hGqgxGR66QmY=";
-      "artifacts.zip" = "sha256-IHllbxwRMrEWA1MI0DRCYYRzYAdQIL8B9b5rZHsOvjc=";
-      "gen_snapshot.zip" = "sha256-bPI6pHrWQR1X7CzytbJA90TYe3cg1yN+9v7JtsCCrbQ=";
-    };
-    darwin-x64-release = {
-      "FlutterMacOS.dSYM.zip" = "sha256-HjU8sLPwvOwO3LP7krpZZW6/t3sN3rX2frFnBp1Kk0I=";
-      "FlutterMacOS.framework.zip" = "sha256-GuTWojZFdSEeOiSYxH8XGSWsxcrkUpnXA61B0NpDa5A=";
-      "artifacts.zip" = "sha256-tQCm1HHrhffNz9a0lNIHXLBqFMbT4QiaibKvRKuuhJ4=";
-      "gen_snapshot.zip" = "sha256-0na+yx0Nxe/FuHVZqhgbRniZLInShoKE3USaJg0829o=";
-    };
-    "flutter_patched_sdk.zip" = "sha256-AVjXLND3nJAaGyBAhytBRUvbkJtwZEcndQSrq+D2c08=";
-    "flutter_patched_sdk_product.zip" = "sha256-31qgieDI897sXtEf8ok2SdFgrlN57bwhT3FUfdofZi0=";
-    ios = {
-      "artifacts.zip" = "sha256-RicBTTBX5aIQwfcolDrKe0MVG9uTp56RYMWgR75AVEw=";
-    };
-    ios-profile = {
-      "artifacts.zip" = "sha256-6EXHvy36K+rRGpjt0GL/DyuOhpAGeaOrZAZvPZuLyys=";
-    };
-    ios-release = {
-      "Flutter.dSYM.zip" = "sha256-zYqlX4QhxnDb9LasMcBcPO/+30LCfVbwC+z+wZiiEqk=";
-      "artifacts.zip" = "sha256-DVpynf2LxU6CPC1BPQbi8OStcIwJKX55rDSWNiJ4KNk=";
-    };
-    linux-arm64 = {
-      "artifacts.zip" = "sha256-djesma+IqQZgGlxQj4Gv6hAkQhQKQp7Gsa1I4hksqNc=";
-      "font-subset.zip" = "sha256-Wo11dks0uhLI2nu+9QJ7aLmvfsPcuqvcmquak4qv5XM=";
-    };
-    linux-arm64-debug = {
-      "linux-arm64-flutter-gtk.zip" = "sha256-6T2Ycxe3GTVnFGfBFfXLZwPklIndQ6hojnCSnMeXJso=";
-    };
-    linux-arm64-profile = {
-      "linux-arm64-flutter-gtk.zip" = "sha256-ycInFHuRu7r+50GsoFR4v/rIRiAQaQ9zFemd2d9AnpQ=";
-    };
-    linux-arm64-release = {
-      "linux-arm64-flutter-gtk.zip" = "sha256-J60MU8pHDVL9DyX5A3YdCRkKXnTgvALhHiEzYiPSSuA=";
-    };
-    linux-x64 = {
-      "artifacts.zip" = "sha256-ZUMRJ0dzaeRQUYy5S7gDLWa3w9CVhNPORN9l+lwxAMs=";
-      "font-subset.zip" = "sha256-pmtHAgIj5tXzUsDrrxB5JwfLDNzMCqouUCOyYN5BOEQ=";
-    };
-    linux-x64-debug = {
-      "linux-x64-flutter-gtk.zip" = "sha256-otmghZAiUlpLYfFaWd18UWlfctKcYsMRBMP78ZyBj/E=";
-    };
-    linux-x64-profile = {
-      "linux-x64-flutter-gtk.zip" = "sha256-bT6xMYlwTB9JOV1790cJqTSEXYstdI4sZCQzFzcpa5s=";
-    };
-    linux-x64-release = {
-      "linux-x64-flutter-gtk.zip" = "sha256-E8Eogr0nD7yaxjuoNhpvF4tTx9N53y3iOkI71Eqx5Ko=";
-    };
-  };
-}
-
diff --git a/pkgs/development/compilers/flutter/flutter-tools.nix b/pkgs/development/compilers/flutter/flutter-tools.nix
new file mode 100644
index 000000000000..0aedd174e2ed
--- /dev/null
+++ b/pkgs/development/compilers/flutter/flutter-tools.nix
@@ -0,0 +1,51 @@
+{ hostPlatform
+, buildDartApplication
+, git
+, which
+, dart
+, version
+, flutterSrc
+, patches ? [ ]
+, pubspecLockFile
+, vendorHash
+, depsListFile
+}:
+
+buildDartApplication.override { inherit dart; } rec {
+  pname = "flutter-tools";
+  inherit version;
+  dartOutputType = "jit-snapshot";
+
+  src = flutterSrc;
+  sourceRoot = "source/packages/flutter_tools";
+  postUnpack = ''chmod -R u+w "$NIX_BUILD_TOP/source"'';
+
+  inherit patches;
+  # The given patches are made for the entire SDK source tree.
+  prePatch = ''pushd "$NIX_BUILD_TOP/source"'';
+  postPatch = ''popd'';
+
+  # When the JIT snapshot is being built, the application needs to run.
+  # It attempts to generate configuration files, and relies on a few external
+  # tools.
+  nativeBuildInputs = [ git which ];
+  preConfigure = ''
+    export HOME=.
+    export FLUTTER_ROOT="$NIX_BUILD_TOP/source"
+    mkdir -p "$FLUTTER_ROOT/bin/cache"
+    ln -s '${dart}' "$FLUTTER_ROOT/bin/cache/dart-sdk"
+  '';
+
+  dartEntryPoints."flutter_tools.snapshot" = "bin/flutter_tools.dart";
+  dartCompileFlags = [ "--define=NIX_FLUTTER_HOST_PLATFORM=${hostPlatform.system}" ];
+
+  # The Dart wrapper launchers are useless for the Flutter tool - it is designed
+  # to be launched from a snapshot by the SDK.
+  postInstall = ''
+    pushd "$out"
+    rm ${builtins.concatStringsSep " " (builtins.attrNames dartEntryPoints)}
+    popd
+  '';
+
+  inherit pubspecLockFile vendorHash depsListFile;
+}
diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
index da45fee420d0..69efe678dc5a 100644
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@@ -3,23 +3,33 @@
 , patches
 , dart
 , src
+, pubspecLockFile
+, vendorHash
+, depsListFile
 , lib
 , stdenv
+, callPackage
+, makeWrapper
 , darwin
 , git
 , which
 }:
 
 let
+  tools = callPackage ./flutter-tools.nix {
+    inherit dart version;
+    flutterSrc = src;
+    inherit patches;
+    inherit pubspecLockFile vendorHash depsListFile;
+  };
+
   unwrapped =
     stdenv.mkDerivation {
       name = "flutter-${version}-unwrapped";
       inherit src patches version;
 
-      outputs = [ "out" "cache" ];
-
       buildInputs = [ git ];
-      nativeBuildInputs = [ ]
+      nativeBuildInputs = [ makeWrapper ]
         ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ];
 
       preConfigure = ''
@@ -34,46 +44,31 @@ let
       '';
 
       buildPhase = ''
-        export FLUTTER_ROOT="$(pwd)"
-        export FLUTTER_TOOLS_DIR="$FLUTTER_ROOT/packages/flutter_tools"
-        export SCRIPT_PATH="$FLUTTER_TOOLS_DIR/bin/flutter_tools.dart"
+        # The flutter_tools package tries to run many Git commands. In most
+        # cases, unexpected output is handled gracefully, but commands are never
+        # expected to fail completely. A blank repository needs to be created.
+        rm -rf .git # Remove any existing Git directory
+        git init -b nixpkgs
+        GIT_AUTHOR_NAME=Nixpkgs GIT_COMMITTER_NAME=Nixpkgs \
+        GIT_AUTHOR_EMAIL= GIT_COMMITTER_EMAIL= \
+        GIT_AUTHOR_DATE='1/1/1970 00:00:00 +0000' GIT_COMMITTER_DATE='1/1/1970 00:00:00 +0000' \
+          git commit --allow-empty -m "Initial commit"
+        (. '${../../../build-support/fetchgit/deterministic-git}'; make_deterministic_repo .)
 
-        export SNAPSHOT_PATH="$FLUTTER_ROOT/bin/cache/flutter_tools.snapshot"
-        export STAMP_PATH="$FLUTTER_ROOT/bin/cache/flutter_tools.stamp"
+        mkdir -p bin/cache
 
-        export DART_SDK_PATH="${dart}"
+        # Add a flutter_tools artifact stamp, and build a snapshot.
+        # This is the Flutter CLI application.
+        echo "$(git rev-parse HEAD)" > bin/cache/flutter_tools.stamp
+        ln -s '${tools}/share/flutter_tools.snapshot' bin/cache/flutter_tools.snapshot
 
-        # The Flutter tool compilation requires dependencies to be cached, as there is no Internet access.
-        # Dart expects package caches to be mutable, and does not support composing cache directories.
-        # The packages cached during the build therefore cannot be easily used. They are provided through
-        # the derivation's "cache" output, though, in case they are needed.
-        #
-        # Note that non-cached packages will normally be fetched from the Internet when they are needed, so Flutter
-        # will function without an existing package cache as long as it has an Internet connection.
-        export PUB_CACHE="$cache"
+        # Some of flutter_tools's dependencies contain static assets. The
+        # application attempts to read its own package_config.json to find these
+        # assets at runtime.
+        mkdir -p packages/flutter_tools/.dart_tool
+        ln -s '${tools.dartDeps.packageConfig}' packages/flutter_tools/.dart_tool/package_config.json
 
-        if [ -d .pub-preload-cache ]; then
-          ${dart}/bin/dart pub cache preload .pub-preload-cache/*
-        elif [ -d .pub-cache ]; then
-          mv .pub-cache "$PUB_CACHE"
-        else
-          echo 'ERROR: Failed to locate the Dart package cache required to build the Flutter tool.'
-          exit 1
-        fi
-
-        pushd "$FLUTTER_TOOLS_DIR"
-        ${dart}/bin/dart pub get --offline
-        popd
-
-        local revision="$(cd "$FLUTTER_ROOT"; git rev-parse HEAD)"
-        ${dart}/bin/dart --snapshot="$SNAPSHOT_PATH" --packages="$FLUTTER_TOOLS_DIR/.dart_tool/package_config.json" "$SCRIPT_PATH"
-        echo "$revision" > "$STAMP_PATH"
         echo -n "${version}" > version
-
-        # Certain prebuilts should be replaced with Nix-built (or at least Nix-patched) equivalents.
-        rm -r \
-          $FLUTTER_ROOT/bin/cache/dart-sdk \
-          $FLUTTER_ROOT/bin/cache/artifacts/engine
       '';
 
       installPhase = ''
@@ -81,8 +76,19 @@ let
 
         mkdir -p $out
         cp -r . $out
+        rm -rf $out/bin/cache/dart-sdk
         ln -sf ${dart} $out/bin/cache/dart-sdk
 
+        # The regular launchers are designed to download/build/update SDK
+        # components, and are not very useful in Nix.
+        # Replace them with simple links and wrappers.
+        rm "$out/bin"/{dart,flutter}
+        ln -s "$out/bin/cache/dart-sdk/bin/dart" "$out/bin/dart"
+        makeShellWrapper "$out/bin/dart" "$out/bin/flutter" \
+          --set-default FLUTTER_ROOT "$out" \
+          --set FLUTTER_ALREADY_LOCKED true \
+          --add-flags "--disable-dart-dev \$NIX_FLUTTER_TOOLS_VM_OPTIONS $out/bin/cache/flutter_tools.snapshot"
+
         runHook postInstall
       '';
 
@@ -95,13 +101,13 @@ let
         export HOME="$(mktemp -d)"
         $out/bin/flutter config --android-studio-dir $HOME
         $out/bin/flutter config --android-sdk $HOME
-        $out/bin/flutter --version | fgrep -q '${version}'
+        $out/bin/flutter --version | fgrep -q '${builtins.substring 0 10 engineVersion}'
 
         runHook postInstallCheck
       '';
 
       passthru = {
-        inherit dart engineVersion;
+        inherit dart engineVersion tools;
         # The derivation containing the original Flutter SDK files.
         # When other derivations wrap this one, any unmodified files
         # found here should be included as-is, for tooling compatibility.
@@ -116,7 +122,7 @@ let
         '';
         homepage = "https://flutter.dev";
         license = licenses.bsd3;
-        platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+        platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
         maintainers = with maintainers; [ babariviere ericdallo FlafyDev hacker1024 ];
       };
     };
diff --git a/pkgs/development/compilers/flutter/lockfiles/stable/deps.json b/pkgs/development/compilers/flutter/lockfiles/stable/deps.json
new file mode 100644
index 000000000000..30924f7d513b
--- /dev/null
+++ b/pkgs/development/compilers/flutter/lockfiles/stable/deps.json
@@ -0,0 +1,1020 @@
+[
+  {
+    "name": "flutter_tools",
+    "version": "0.0.0",
+    "kind": "root",
+    "source": "root",
+    "dependencies": [
+      "archive",
+      "args",
+      "browser_launcher",
+      "dds",
+      "dwds",
+      "completion",
+      "coverage",
+      "crypto",
+      "file",
+      "flutter_template_images",
+      "html",
+      "http",
+      "intl",
+      "meta",
+      "multicast_dns",
+      "mustache_template",
+      "package_config",
+      "process",
+      "fake_async",
+      "stack_trace",
+      "usage",
+      "webdriver",
+      "webkit_inspection_protocol",
+      "xml",
+      "yaml",
+      "native_stack_traces",
+      "shelf",
+      "vm_snapshot_analysis",
+      "uuid",
+      "web_socket_channel",
+      "stream_channel",
+      "shelf_web_socket",
+      "shelf_static",
+      "pub_semver",
+      "pool",
+      "path",
+      "mime",
+      "logging",
+      "http_multi_server",
+      "convert",
+      "async",
+      "unified_analytics",
+      "test_api",
+      "test_core",
+      "vm_service",
+      "standard_message_codec",
+      "_fe_analyzer_shared",
+      "analyzer",
+      "boolean_selector",
+      "built_collection",
+      "built_value",
+      "clock",
+      "csslib",
+      "dap",
+      "dds_service_extensions",
+      "devtools_shared",
+      "fixnum",
+      "frontend_server_client",
+      "glob",
+      "http_parser",
+      "io",
+      "js",
+      "json_rpc_2",
+      "matcher",
+      "petitparser",
+      "platform",
+      "shelf_packages_handler",
+      "shelf_proxy",
+      "source_map_stack_trace",
+      "source_maps",
+      "source_span",
+      "sse",
+      "string_scanner",
+      "sync_http",
+      "term_glyph",
+      "typed_data",
+      "watcher",
+      "collection",
+      "file_testing",
+      "pubspec_parse",
+      "checked_yaml",
+      "json_annotation",
+      "node_preamble",
+      "test"
+    ]
+  },
+  {
+    "name": "test",
+    "version": "1.24.3",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "boolean_selector",
+      "collection",
+      "coverage",
+      "http_multi_server",
+      "io",
+      "js",
+      "node_preamble",
+      "package_config",
+      "path",
+      "pool",
+      "shelf",
+      "shelf_packages_handler",
+      "shelf_static",
+      "shelf_web_socket",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "typed_data",
+      "web_socket_channel",
+      "webkit_inspection_protocol",
+      "yaml",
+      "test_api",
+      "test_core",
+      "matcher"
+    ]
+  },
+  {
+    "name": "matcher",
+    "version": "0.12.16",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "meta",
+      "stack_trace",
+      "term_glyph",
+      "test_api"
+    ]
+  },
+  {
+    "name": "test_api",
+    "version": "0.6.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "boolean_selector",
+      "collection",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "term_glyph",
+    "version": "1.2.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "string_scanner",
+    "version": "1.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_span",
+    "version": "1.10.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "path",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "path",
+    "version": "1.8.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "collection",
+    "version": "1.17.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "stream_channel",
+    "version": "2.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "async",
+    "version": "2.11.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "meta",
+    "version": "1.9.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "stack_trace",
+    "version": "1.11.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "boolean_selector",
+    "version": "2.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "test_core",
+    "version": "0.5.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "args",
+      "boolean_selector",
+      "collection",
+      "coverage",
+      "frontend_server_client",
+      "glob",
+      "io",
+      "meta",
+      "package_config",
+      "path",
+      "pool",
+      "source_map_stack_trace",
+      "source_maps",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "vm_service",
+      "yaml",
+      "test_api"
+    ]
+  },
+  {
+    "name": "yaml",
+    "version": "3.1.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "vm_service",
+    "version": "11.7.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "source_maps",
+    "version": "0.10.12",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_map_stack_trace",
+    "version": "2.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "source_maps",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "pool",
+    "version": "1.5.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "package_config",
+    "version": "2.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "io",
+    "version": "1.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "glob",
+    "version": "2.1.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "file",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "file",
+    "version": "6.1.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "frontend_server_client",
+    "version": "3.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "coverage",
+    "version": "1.6.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "logging",
+      "package_config",
+      "path",
+      "source_maps",
+      "stack_trace",
+      "vm_service"
+    ]
+  },
+  {
+    "name": "logging",
+    "version": "1.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "args",
+    "version": "2.4.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "analyzer",
+    "version": "5.13.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "_fe_analyzer_shared",
+      "collection",
+      "convert",
+      "crypto",
+      "glob",
+      "meta",
+      "package_config",
+      "path",
+      "pub_semver",
+      "source_span",
+      "watcher",
+      "yaml"
+    ]
+  },
+  {
+    "name": "watcher",
+    "version": "1.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "pub_semver",
+    "version": "2.1.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "crypto",
+    "version": "3.0.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "typed_data",
+    "version": "1.3.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "convert",
+    "version": "3.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "_fe_analyzer_shared",
+    "version": "61.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "webkit_inspection_protocol",
+    "version": "1.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "logging"
+    ]
+  },
+  {
+    "name": "web_socket_channel",
+    "version": "2.4.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "crypto",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "shelf_web_socket",
+    "version": "1.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "shelf",
+      "stream_channel",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "shelf",
+    "version": "1.4.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "http_parser",
+      "path",
+      "stack_trace",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "http_parser",
+    "version": "4.0.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner",
+      "typed_data"
+    ]
+  },
+  {
+    "name": "shelf_static",
+    "version": "1.1.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "convert",
+      "http_parser",
+      "mime",
+      "path",
+      "shelf"
+    ]
+  },
+  {
+    "name": "mime",
+    "version": "1.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "shelf_packages_handler",
+    "version": "3.0.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "shelf",
+      "shelf_static"
+    ]
+  },
+  {
+    "name": "node_preamble",
+    "version": "2.0.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "js",
+    "version": "0.6.7",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "http_multi_server",
+    "version": "3.2.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "json_annotation",
+    "version": "4.8.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "checked_yaml",
+    "version": "2.0.3",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "json_annotation",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "pubspec_parse",
+    "version": "1.2.3",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "checked_yaml",
+      "collection",
+      "json_annotation",
+      "pub_semver",
+      "yaml"
+    ]
+  },
+  {
+    "name": "file_testing",
+    "version": "3.0.0",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "test"
+    ]
+  },
+  {
+    "name": "sync_http",
+    "version": "0.3.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "sse",
+    "version": "4.1.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "js",
+      "logging",
+      "pool",
+      "shelf",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "shelf_proxy",
+    "version": "1.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "http",
+      "path",
+      "shelf"
+    ]
+  },
+  {
+    "name": "http",
+    "version": "0.13.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "http_parser",
+      "meta"
+    ]
+  },
+  {
+    "name": "platform",
+    "version": "3.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "petitparser",
+    "version": "5.4.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "json_rpc_2",
+    "version": "3.0.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "stack_trace",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "fixnum",
+    "version": "1.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "devtools_shared",
+    "version": "2.24.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "shelf",
+      "usage",
+      "vm_service",
+      "webkit_inspection_protocol"
+    ]
+  },
+  {
+    "name": "usage",
+    "version": "4.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "dds_service_extensions",
+    "version": "1.5.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "dap",
+      "vm_service"
+    ]
+  },
+  {
+    "name": "dap",
+    "version": "1.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "csslib",
+    "version": "1.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "clock",
+    "version": "1.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "built_value",
+    "version": "8.6.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "collection",
+      "fixnum",
+      "meta"
+    ]
+  },
+  {
+    "name": "built_collection",
+    "version": "5.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "standard_message_codec",
+    "version": "0.0.1+3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "unified_analytics",
+    "version": "2.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "file",
+      "http",
+      "intl",
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "intl",
+    "version": "0.18.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "uuid",
+    "version": "3.0.7",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "crypto"
+    ]
+  },
+  {
+    "name": "vm_snapshot_analysis",
+    "version": "0.7.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "collection",
+      "path"
+    ]
+  },
+  {
+    "name": "native_stack_traces",
+    "version": "0.5.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "path"
+    ]
+  },
+  {
+    "name": "xml",
+    "version": "6.3.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta",
+      "petitparser"
+    ]
+  },
+  {
+    "name": "webdriver",
+    "version": "3.0.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "matcher",
+      "path",
+      "stack_trace",
+      "sync_http"
+    ]
+  },
+  {
+    "name": "fake_async",
+    "version": "1.3.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "collection"
+    ]
+  },
+  {
+    "name": "process",
+    "version": "4.2.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "file",
+      "path",
+      "platform"
+    ]
+  },
+  {
+    "name": "mustache_template",
+    "version": "2.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "multicast_dns",
+    "version": "0.3.2+3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "html",
+    "version": "0.15.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "csslib",
+      "source_span"
+    ]
+  },
+  {
+    "name": "flutter_template_images",
+    "version": "4.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "completion",
+    "version": "1.0.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "logging",
+      "path"
+    ]
+  },
+  {
+    "name": "dwds",
+    "version": "19.0.1+1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "built_collection",
+      "built_value",
+      "collection",
+      "crypto",
+      "dds",
+      "file",
+      "http",
+      "http_multi_server",
+      "logging",
+      "meta",
+      "package_config",
+      "path",
+      "pool",
+      "pub_semver",
+      "shelf",
+      "shelf_packages_handler",
+      "shelf_proxy",
+      "shelf_static",
+      "shelf_web_socket",
+      "source_maps",
+      "stack_trace",
+      "sse",
+      "uuid",
+      "vm_service",
+      "web_socket_channel",
+      "webkit_inspection_protocol"
+    ]
+  },
+  {
+    "name": "dds",
+    "version": "2.9.0+hotfix",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "async",
+      "browser_launcher",
+      "collection",
+      "dds_service_extensions",
+      "dap",
+      "devtools_shared",
+      "http_multi_server",
+      "json_rpc_2",
+      "meta",
+      "path",
+      "shelf_proxy",
+      "shelf_static",
+      "shelf_web_socket",
+      "shelf",
+      "sse",
+      "stack_trace",
+      "stream_channel",
+      "vm_service",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "browser_launcher",
+    "version": "1.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "webkit_inspection_protocol"
+    ]
+  },
+  {
+    "name": "archive",
+    "version": "3.3.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "crypto",
+      "path"
+    ]
+  }
+]
diff --git a/pkgs/development/compilers/flutter/lockfiles/stable/pubspec.lock b/pkgs/development/compilers/flutter/lockfiles/stable/pubspec.lock
new file mode 100644
index 000000000000..8b11ae73ee03
--- /dev/null
+++ b/pkgs/development/compilers/flutter/lockfiles/stable/pubspec.lock
@@ -0,0 +1,677 @@
+# Generated by pub
+# See https://dart.dev/tools/pub/glossary#lockfile
+packages:
+  _fe_analyzer_shared:
+    dependency: "direct main"
+    description:
+      name: _fe_analyzer_shared
+      sha256: ae92f5d747aee634b87f89d9946000c2de774be1d6ac3e58268224348cd0101a
+      url: "https://pub.dev"
+    source: hosted
+    version: "61.0.0"
+  analyzer:
+    dependency: "direct main"
+    description:
+      name: analyzer
+      sha256: ea3d8652bda62982addfd92fdc2d0214e5f82e43325104990d4f4c4a2a313562
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.13.0"
+  archive:
+    dependency: "direct main"
+    description:
+      name: archive
+      sha256: "80e5141fafcb3361653ce308776cfd7d45e6e9fbb429e14eec571382c0c5fecb"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.3.2"
+  args:
+    dependency: "direct main"
+    description:
+      name: args
+      sha256: eef6c46b622e0494a36c5a12d10d77fb4e855501a91c1b9ef9339326e58f0596
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.2"
+  async:
+    dependency: "direct main"
+    description:
+      name: async
+      sha256: "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.11.0"
+  boolean_selector:
+    dependency: "direct main"
+    description:
+      name: boolean_selector
+      sha256: "6cfb5af12253eaf2b368f07bacc5a80d1301a071c73360d746b7f2e32d762c66"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  browser_launcher:
+    dependency: "direct main"
+    description:
+      name: browser_launcher
+      sha256: "6ee4c6b1f68a42e769ef6e663c4f56708522f7bce9d2ab6e308a37b612ffa4ec"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
+  built_collection:
+    dependency: "direct main"
+    description:
+      name: built_collection
+      sha256: "376e3dd27b51ea877c28d525560790aee2e6fbb5f20e2f85d5081027d94e2100"
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.1.1"
+  built_value:
+    dependency: "direct main"
+    description:
+      name: built_value
+      sha256: "598a2a682e2a7a90f08ba39c0aaa9374c5112340f0a2e275f61b59389543d166"
+      url: "https://pub.dev"
+    source: hosted
+    version: "8.6.1"
+  checked_yaml:
+    dependency: "direct dev"
+    description:
+      name: checked_yaml
+      sha256: feb6bed21949061731a7a75fc5d2aa727cf160b91af9a3e464c5e3a32e28b5ff
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.3"
+  clock:
+    dependency: "direct main"
+    description:
+      name: clock
+      sha256: cb6d7f03e1de671e34607e909a7213e31d7752be4fb66a86d29fe1eb14bfb5cf
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
+  collection:
+    dependency: "direct dev"
+    description:
+      name: collection
+      sha256: f092b211a4319e98e5ff58223576de6c2803db36221657b46c82574721240687
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.17.2"
+  completion:
+    dependency: "direct main"
+    description:
+      name: completion
+      sha256: f11b7a628e6c42b9edc9b0bc3aa490e2d930397546d2f794e8e1325909d11c60
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.1"
+  convert:
+    dependency: "direct main"
+    description:
+      name: convert
+      sha256: "0f08b14755d163f6e2134cb58222dd25ea2a2ee8a195e53983d57c075324d592"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.1"
+  coverage:
+    dependency: "direct main"
+    description:
+      name: coverage
+      sha256: "2fb815080e44a09b85e0f2ca8a820b15053982b2e714b59267719e8a9ff17097"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.6.3"
+  crypto:
+    dependency: "direct main"
+    description:
+      name: crypto
+      sha256: ff625774173754681d66daaf4a448684fb04b78f902da9cb3d308c19cc5e8bab
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.3"
+  csslib:
+    dependency: "direct main"
+    description:
+      name: csslib
+      sha256: "706b5707578e0c1b4b7550f64078f0a0f19dec3f50a178ffae7006b0a9ca58fb"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
+  dap:
+    dependency: "direct main"
+    description:
+      name: dap
+      sha256: "2120d4a8cbad45e5dbd518b713e8f064274e0a4c0e3edcaef1f4cf9ccbc90cd9"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
+  dds:
+    dependency: "direct main"
+    description:
+      name: dds
+      sha256: "397c3c80919ee187b2efc28205af3c0378b6b757ea6d059083dece145a2e31e9"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.9.0+hotfix"
+  dds_service_extensions:
+    dependency: "direct main"
+    description:
+      name: dds_service_extensions
+      sha256: "9ac669bef49a4c13ed62073685089be121200fb213800ec59c202e90d569ea44"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.5.0"
+  devtools_shared:
+    dependency: "direct main"
+    description:
+      name: devtools_shared
+      sha256: ad58ac3a5df41adf08d0d6f0a4d73349533edcc383ee93a30ac3d0fd0bb6df49
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.24.0"
+  dwds:
+    dependency: "direct main"
+    description:
+      name: dwds
+      sha256: b6dad73ae56f00bff7647f531b9db018005f713328e816e7a277b544184e9170
+      url: "https://pub.dev"
+    source: hosted
+    version: "19.0.1+1"
+  fake_async:
+    dependency: "direct main"
+    description:
+      name: fake_async
+      sha256: "511392330127add0b769b75a987850d136345d9227c6b94c96a04cf4a391bf78"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.1"
+  file:
+    dependency: "direct main"
+    description:
+      name: file
+      sha256: "1b92bec4fc2a72f59a8e15af5f52cd441e4a7860b49499d69dfa817af20e925d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.1.4"
+  file_testing:
+    dependency: "direct dev"
+    description:
+      name: file_testing
+      sha256: "0aaadb4025bd350403f4308ad6c4cea953278d9407814b8342558e4946840fb5"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.0"
+  fixnum:
+    dependency: "direct main"
+    description:
+      name: fixnum
+      sha256: "25517a4deb0c03aa0f32fd12db525856438902d9c16536311e76cdc57b31d7d1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.0"
+  flutter_template_images:
+    dependency: "direct main"
+    description:
+      name: flutter_template_images
+      sha256: fd3e55af73c577b9e3f88d4080d3e366cb5c8ef3fbd50b94dfeca56bb0235df6
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.2.0"
+  frontend_server_client:
+    dependency: "direct main"
+    description:
+      name: frontend_server_client
+      sha256: "408e3ca148b31c20282ad6f37ebfa6f4bdc8fede5b74bc2f08d9d92b55db3612"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.0"
+  glob:
+    dependency: "direct main"
+    description:
+      name: glob
+      sha256: "0e7014b3b7d4dac1ca4d6114f82bf1782ee86745b9b42a92c9289c23d8a0ab63"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.2"
+  html:
+    dependency: "direct main"
+    description:
+      name: html
+      sha256: "3a7812d5bcd2894edf53dfaf8cd640876cf6cef50a8f238745c8b8120ea74d3a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.15.4"
+  http:
+    dependency: "direct main"
+    description:
+      name: http
+      sha256: "5895291c13fa8a3bd82e76d5627f69e0d85ca6a30dcac95c4ea19a5d555879c2"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.13.6"
+  http_multi_server:
+    dependency: "direct main"
+    description:
+      name: http_multi_server
+      sha256: "97486f20f9c2f7be8f514851703d0119c3596d14ea63227af6f7a481ef2b2f8b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.1"
+  http_parser:
+    dependency: "direct main"
+    description:
+      name: http_parser
+      sha256: "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.0.2"
+  intl:
+    dependency: "direct main"
+    description:
+      name: intl
+      sha256: "3bc132a9dbce73a7e4a21a17d06e1878839ffbf975568bc875c60537824b0c4d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.18.1"
+  io:
+    dependency: "direct main"
+    description:
+      name: io
+      sha256: "2ec25704aba361659e10e3e5f5d672068d332fc8ac516421d483a11e5cbd061e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  js:
+    dependency: "direct main"
+    description:
+      name: js
+      sha256: f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.7"
+  json_annotation:
+    dependency: "direct dev"
+    description:
+      name: json_annotation
+      sha256: b10a7b2ff83d83c777edba3c6a0f97045ddadd56c944e1a23a3fdf43a1bf4467
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.8.1"
+  json_rpc_2:
+    dependency: "direct main"
+    description:
+      name: json_rpc_2
+      sha256: "5e469bffa23899edacb7b22787780068d650b106a21c76db3c49218ab7ca447e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.2"
+  logging:
+    dependency: "direct main"
+    description:
+      name: logging
+      sha256: "623a88c9594aa774443aa3eb2d41807a48486b5613e67599fb4c41c0ad47c340"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.0"
+  matcher:
+    dependency: "direct main"
+    description:
+      name: matcher
+      sha256: "1803e76e6653768d64ed8ff2e1e67bea3ad4b923eb5c56a295c3e634bad5960e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.12.16"
+  meta:
+    dependency: "direct main"
+    description:
+      name: meta
+      sha256: "3c74dbf8763d36539f114c799d8a2d87343b5067e9d796ca22b5eb8437090ee3"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.9.1"
+  mime:
+    dependency: "direct main"
+    description:
+      name: mime
+      sha256: e4ff8e8564c03f255408decd16e7899da1733852a9110a58fe6d1b817684a63e
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  multicast_dns:
+    dependency: "direct main"
+    description:
+      name: multicast_dns
+      sha256: "80e54aba906a7cc68fdc6a201e76b135af27155e2f8e958181d85e2b73786591"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.2+3"
+  mustache_template:
+    dependency: "direct main"
+    description:
+      name: mustache_template
+      sha256: a46e26f91445bfb0b60519be280555b06792460b27b19e2b19ad5b9740df5d1c
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.0"
+  native_stack_traces:
+    dependency: "direct main"
+    description:
+      name: native_stack_traces
+      sha256: c797830b9910d13b0f4e70ddef15cde034214fe3bdb8092c4ea5ffad2f74013f
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.5.6"
+  node_preamble:
+    dependency: "direct dev"
+    description:
+      name: node_preamble
+      sha256: "6e7eac89047ab8a8d26cf16127b5ed26de65209847630400f9aefd7cd5c730db"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.2"
+  package_config:
+    dependency: "direct main"
+    description:
+      name: package_config
+      sha256: "1c5b77ccc91e4823a5af61ee74e6b972db1ef98c2ff5a18d3161c982a55448bd"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
+  path:
+    dependency: "direct main"
+    description:
+      name: path
+      sha256: "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.8.3"
+  petitparser:
+    dependency: "direct main"
+    description:
+      name: petitparser
+      sha256: cb3798bef7fc021ac45b308f4b51208a152792445cce0448c9a4ba5879dd8750
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.4.0"
+  platform:
+    dependency: "direct main"
+    description:
+      name: platform
+      sha256: "4a451831508d7d6ca779f7ac6e212b4023dd5a7d08a27a63da33756410e32b76"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.0"
+  pool:
+    dependency: "direct main"
+    description:
+      name: pool
+      sha256: "20fe868b6314b322ea036ba325e6fc0711a22948856475e2c2b6306e8ab39c2a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.5.1"
+  process:
+    dependency: "direct main"
+    description:
+      name: process
+      sha256: "53fd8db9cec1d37b0574e12f07520d582019cb6c44abf5479a01505099a34a09"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.2.4"
+  pub_semver:
+    dependency: "direct main"
+    description:
+      name: pub_semver
+      sha256: "40d3ab1bbd474c4c2328c91e3a7df8c6dd629b79ece4c4bd04bee496a224fb0c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.4"
+  pubspec_parse:
+    dependency: "direct dev"
+    description:
+      name: pubspec_parse
+      sha256: c63b2876e58e194e4b0828fcb080ad0e06d051cb607a6be51a9e084f47cb9367
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.3"
+  shelf:
+    dependency: "direct main"
+    description:
+      name: shelf
+      sha256: ad29c505aee705f41a4d8963641f91ac4cee3c8fad5947e033390a7bd8180fa4
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.4.1"
+  shelf_packages_handler:
+    dependency: "direct main"
+    description:
+      name: shelf_packages_handler
+      sha256: "89f967eca29607c933ba9571d838be31d67f53f6e4ee15147d5dc2934fee1b1e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.2"
+  shelf_proxy:
+    dependency: "direct main"
+    description:
+      name: shelf_proxy
+      sha256: a71d2307f4393211930c590c3d2c00630f6c5a7a77edc1ef6436dfd85a6a7ee3
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  shelf_static:
+    dependency: "direct main"
+    description:
+      name: shelf_static
+      sha256: a41d3f53c4adf0f57480578c1d61d90342cd617de7fc8077b1304643c2d85c1e
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.2"
+  shelf_web_socket:
+    dependency: "direct main"
+    description:
+      name: shelf_web_socket
+      sha256: "9ca081be41c60190ebcb4766b2486a7d50261db7bd0f5d9615f2d653637a84c1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  source_map_stack_trace:
+    dependency: "direct main"
+    description:
+      name: source_map_stack_trace
+      sha256: "84cf769ad83aa6bb61e0aa5a18e53aea683395f196a6f39c4c881fb90ed4f7ae"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  source_maps:
+    dependency: "direct main"
+    description:
+      name: source_maps
+      sha256: "708b3f6b97248e5781f493b765c3337db11c5d2c81c3094f10904bfa8004c703"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.10.12"
+  source_span:
+    dependency: "direct main"
+    description:
+      name: source_span
+      sha256: "53e943d4206a5e30df338fd4c6e7a077e02254531b138a15aec3bd143c1a8b3c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.10.0"
+  sse:
+    dependency: "direct main"
+    description:
+      name: sse
+      sha256: "3ff9088cac3f45aa8b91336f1962e3ea6c81baaba0bbba361c05f8aa7fb59442"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.1.2"
+  stack_trace:
+    dependency: "direct main"
+    description:
+      name: stack_trace
+      sha256: c3c7d8edb15bee7f0f74debd4b9c5f3c2ea86766fe4178eb2a18eb30a0bdaed5
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.11.0"
+  standard_message_codec:
+    dependency: "direct main"
+    description:
+      name: standard_message_codec
+      sha256: "906e66549f0ea90d87c5320e0b0f04738c5d14bc7fb121a15da31b60e84f5b15"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.0.1+3"
+  stream_channel:
+    dependency: "direct main"
+    description:
+      name: stream_channel
+      sha256: "83615bee9045c1d322bbbd1ba209b7a749c2cbcdcb3fdd1df8eb488b3279c1c8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  string_scanner:
+    dependency: "direct main"
+    description:
+      name: string_scanner
+      sha256: "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.0"
+  sync_http:
+    dependency: "direct main"
+    description:
+      name: sync_http
+      sha256: "7f0cd72eca000d2e026bcd6f990b81d0ca06022ef4e32fb257b30d3d1014a961"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.1"
+  term_glyph:
+    dependency: "direct main"
+    description:
+      name: term_glyph
+      sha256: a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.1"
+  test:
+    dependency: "direct dev"
+    description:
+      name: test
+      sha256: "13b41f318e2a5751c3169137103b60c584297353d4b1761b66029bae6411fe46"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.24.3"
+  test_api:
+    dependency: "direct main"
+    description:
+      name: test_api
+      sha256: "75760ffd7786fffdfb9597c35c5b27eaeec82be8edfb6d71d32651128ed7aab8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.0"
+  test_core:
+    dependency: "direct main"
+    description:
+      name: test_core
+      sha256: "99806e9e6d95c7b059b7a0fc08f07fc53fabe54a829497f0d9676299f1e8637e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.5.3"
+  typed_data:
+    dependency: "direct main"
+    description:
+      name: typed_data
+      sha256: facc8d6582f16042dd49f2463ff1bd6e2c9ef9f3d5da3d9b087e244a7b564b3c
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.2"
+  unified_analytics:
+    dependency: "direct main"
+    description:
+      name: unified_analytics
+      sha256: "4f9f29e5fd357d68fce270e37c7ad9bb489ee20098529199d6bc786b2b624298"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.0"
+  usage:
+    dependency: "direct main"
+    description:
+      name: usage
+      sha256: "0bdbde65a6e710343d02a56552eeaefd20b735e04bfb6b3ee025b6b22e8d0e15"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.1.1"
+  uuid:
+    dependency: "direct main"
+    description:
+      name: uuid
+      sha256: "648e103079f7c64a36dc7d39369cabb358d377078a051d6ae2ad3aa539519313"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.7"
+  vm_service:
+    dependency: "direct main"
+    description:
+      name: vm_service
+      sha256: c620a6f783fa22436da68e42db7ebbf18b8c44b9a46ab911f666ff09ffd9153f
+      url: "https://pub.dev"
+    source: hosted
+    version: "11.7.1"
+  vm_snapshot_analysis:
+    dependency: "direct main"
+    description:
+      name: vm_snapshot_analysis
+      sha256: "5a79b9fbb6be2555090f55b03b23907e75d44c3fd7bdd88da09848aa5a1914c8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.7.6"
+  watcher:
+    dependency: "direct main"
+    description:
+      name: watcher
+      sha256: "3d2ad6751b3c16cf07c7fca317a1413b3f26530319181b37e3b9039b84fc01d8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.0"
+  web_socket_channel:
+    dependency: "direct main"
+    description:
+      name: web_socket_channel
+      sha256: d88238e5eac9a42bb43ca4e721edba3c08c6354d4a53063afaa568516217621b
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.0"
+  webdriver:
+    dependency: "direct main"
+    description:
+      name: webdriver
+      sha256: "3c923e918918feeb90c4c9fdf1fe39220fa4c0e8e2c0fffaded174498ef86c49"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.2"
+  webkit_inspection_protocol:
+    dependency: "direct main"
+    description:
+      name: webkit_inspection_protocol
+      sha256: "67d3a8b6c79e1987d19d848b0892e582dbb0c66c57cc1fef58a177dd2aa2823d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.0"
+  xml:
+    dependency: "direct main"
+    description:
+      name: xml
+      sha256: "5bc72e1e45e941d825fd7468b9b4cc3b9327942649aeb6fc5cdbf135f0a86e84"
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.3.0"
+  yaml:
+    dependency: "direct main"
+    description:
+      name: yaml
+      sha256: "75769501ea3489fca56601ff33454fe45507ea3bfb014161abc3b43ae25989d5"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.2"
+sdks:
+  dart: ">=3.0.0 <4.0.0"
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/deregister-pub-dependencies-artifact.patch b/pkgs/development/compilers/flutter/patches/flutter3/deregister-pub-dependencies-artifact.patch
new file mode 100644
index 000000000000..01e34c6d292c
--- /dev/null
+++ b/pkgs/development/compilers/flutter/patches/flutter3/deregister-pub-dependencies-artifact.patch
@@ -0,0 +1,19 @@
+diff --git a/packages/flutter_tools/lib/src/flutter_cache.dart b/packages/flutter_tools/lib/src/flutter_cache.dart
+index 252021cf78..e50ef0885d 100644
+--- a/packages/flutter_tools/lib/src/flutter_cache.dart
++++ b/packages/flutter_tools/lib/src/flutter_cache.dart
+@@ -51,14 +51,6 @@ class FlutterCache extends Cache {
+       registerArtifact(IosUsbArtifacts(artifactName, this, platform: platform));
+     }
+     registerArtifact(FontSubsetArtifacts(this, platform: platform));
+-    registerArtifact(PubDependencies(
+-      logger: logger,
+-      // flutter root and pub must be lazily initialized to avoid accessing
+-      // before the version is determined.
+-      flutterRoot: () => Cache.flutterRoot!,
+-      pub: () => pub,
+-      projectFactory: projectFactory,
+-    ));
+   }
+ }
+ 
\ No newline at end of file
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch b/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
index ceaf59b5f535..23a657e7c6a9 100644
--- a/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
+++ b/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
@@ -11,18 +11,19 @@ index 3532c23114..25dfcae4c7 100644
    BIN_NAME="$(basename "$PROG_NAME")"
    case "$BIN_NAME" in
      flutter*)
-diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
-index 13efbde879..467b3a7cbf 100644
---- a/packages/flutter_tools/lib/src/cache.dart
-+++ b/packages/flutter_tools/lib/src/cache.dart
-@@ -664,6 +664,7 @@ class Cache {
+diff --git a/packages/flutter_tools/lib/src/runner/flutter_command.dart b/packages/flutter_tools/lib/src/runner/flutter_command.dart
+index b7e624b4e2..edfdde118b 100644
+--- a/packages/flutter_tools/lib/src/runner/flutter_command.dart
++++ b/packages/flutter_tools/lib/src/runner/flutter_command.dart
+@@ -1554,7 +1554,7 @@ Run 'flutter -h' (or 'flutter <command> -h') for available flutter commands and
  
-   /// Update the cache to contain all `requiredArtifacts`.
-   Future<void> updateAll(Set<DevelopmentArtifact> requiredArtifacts, {bool offline = false}) async {
-+    return;
-     if (!_lockEnabled) {
-       return;
-     }
+     // Populate the cache. We call this before pub get below so that the
+     // sky_engine package is available in the flutter cache for pub to find.
+-    if (shouldUpdateCache) {
++    if (false) {
+       // First always update universal artifacts, as some of these (e.g.
+       // ios-deploy on macOS) are required to determine `requiredArtifacts`.
+       final bool offline;
 diff --git a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
 index 5d6d78639f..90a4dfa555 100644
 --- a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch b/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
deleted file mode 100644
index cc6e5e8f49e0..000000000000
--- a/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
-index dd80b1e46e..8e54517765 100644
---- a/packages/flutter_tools/lib/src/cache.dart
-+++ b/packages/flutter_tools/lib/src/cache.dart
-@@ -22,6 +22,7 @@ import 'base/user_messages.dart';
- import 'build_info.dart';
- import 'convert.dart';
- import 'features.dart';
-+import 'globals.dart' as globals;
- 
- const String kFlutterRootEnvironmentVariableName = 'FLUTTER_ROOT'; // should point to //flutter/ (root of flutter/flutter repo)
- const String kFlutterEngineEnvironmentVariableName = 'FLUTTER_ENGINE'; // should point to //engine/src/ (root of flutter/engine repo)
-@@ -318,8 +319,13 @@ class Cache {
-       return;
-     }
-     assert(_lock == null);
-+    final Directory dir = _fileSystem.directory(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter'));
-+    if (!dir.existsSync()) {
-+      dir.createSync(recursive: true);
-+      globals.os.chmod(dir, '755');
-+    }
-     final File lockFile =
--      _fileSystem.file(_fileSystem.path.join(flutterRoot!, 'bin', 'cache', 'lockfile'));
-+      _fileSystem.file(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'lockfile'));
-     try {
-       _lock = lockFile.openSync(mode: FileMode.write);
-     } on FileSystemException catch (e) {
-@@ -378,8 +384,7 @@ class Cache {
- 
-   String get devToolsVersion {
-     if (_devToolsVersion == null) {
--      const String devToolsDirPath = 'dart-sdk/bin/resources/devtools';
--      final Directory devToolsDir = getCacheDir(devToolsDirPath, shouldCreate: false);
-+      final Directory devToolsDir = _fileSystem.directory(_fileSystem.path.join(flutterRoot!, 'bin/cache/dart-sdk/bin/resources/devtools'));
-       if (!devToolsDir.existsSync()) {
-         throw Exception('Could not find directory at ${devToolsDir.path}');
-       }
-diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
-index 1c31c1b5db..76c7210d3b 100644
---- a/packages/flutter_tools/lib/src/cache.dart
-+++ b/packages/flutter_tools/lib/src/cache.dart
-@@ -529,6 +529,11 @@ class Cache {
- 
-   /// Return the top-level directory in the cache; this is `bin/cache`.
-   Directory getRoot() {
-+    const Platform platform = LocalPlatform();
-+    if (platform.environment.containsKey('FLUTTER_CACHE_DIR')) {
-+      return _fileSystem.directory(platform.environment['FLUTTER_CACHE_DIR']);
-+    }
-+
-     if (_rootOverride != null) {
-       return _fileSystem.directory(_fileSystem.path.join(_rootOverride!.path, 'bin', 'cache'));
-     } else {
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/override-host-platform.patch b/pkgs/development/compilers/flutter/patches/flutter3/override-host-platform.patch
new file mode 100644
index 000000000000..51dcfdb5cc57
--- /dev/null
+++ b/pkgs/development/compilers/flutter/patches/flutter3/override-host-platform.patch
@@ -0,0 +1,21 @@
+diff --git a/packages/flutter_tools/lib/src/base/os.dart b/packages/flutter_tools/lib/src/base/os.dart
+index 1ce1951cef..1bd7602318 100644
+--- a/packages/flutter_tools/lib/src/base/os.dart
++++ b/packages/flutter_tools/lib/src/base/os.dart
+@@ -260,7 +260,15 @@ class _PosixUtils extends OperatingSystemUtils {
+   @override
+   String get pathVarSeparator => ':';
+ 
+-  HostPlatform? _hostPlatform;
++  // uname outputs build platform characteristics, not host platform characteristics.
++  // _MacOSUtils uses sysctl instead, which is still incorrect.
++  HostPlatform? _hostPlatform = switch (const String.fromEnvironment('NIX_FLUTTER_HOST_PLATFORM')) {
++    'x86_64-linux' => HostPlatform.linux_x64,
++    'aarch64-linux' => HostPlatform.linux_arm64,
++    'x86_64-darwin' => HostPlatform.darwin_x64,
++    'arm64-darwin' => HostPlatform.darwin_arm64,
++    String value => throw ArgumentError.value(value, 'NIX_FLUTTER_HOST_PLATFORM', 'Unknown Nix host platform!'),
++  };
+ 
+   @override
+   HostPlatform get hostPlatform {
diff --git a/pkgs/development/compilers/flutter/sdk-symlink.nix b/pkgs/development/compilers/flutter/sdk-symlink.nix
index 6fb4f5edc0ee..044a508805f5 100644
--- a/pkgs/development/compilers/flutter/sdk-symlink.nix
+++ b/pkgs/development/compilers/flutter/sdk-symlink.nix
@@ -1,10 +1,23 @@
-{ symlinkJoin }: flutter:
+{ symlinkJoin
+, makeWrapper
+}: flutter:
 
 let
   self =
     symlinkJoin {
       name = "${flutter.name}-sdk-links";
-      paths = [ flutter flutter.sdk ];
+      paths = [ flutter flutter.cacheDir flutter.sdk ];
+
+      nativeBuildInputs = [ makeWrapper ];
+      postBuild = ''
+        wrapProgram "$out/bin/flutter" \
+          --set-default FLUTTER_ROOT "$out"
+
+        # symlinkJoin seems to be missing the .git directory for some reason.
+        if [ -d '${flutter.sdk}/.git' ]; then
+          ln -s '${flutter.sdk}/.git' "$out"
+        fi
+      '';
 
       passthru = flutter.passthru // {
         # Update the SDK attribute.
diff --git a/pkgs/development/compilers/flutter/wrapper.nix b/pkgs/development/compilers/flutter/wrapper.nix
index f525bcc7ab31..38c2eb289310 100644
--- a/pkgs/development/compilers/flutter/wrapper.nix
+++ b/pkgs/development/compilers/flutter/wrapper.nix
@@ -3,27 +3,14 @@
 , darwin
 , callPackage
 , flutter
-, supportsLinuxDesktop ? stdenv.hostPlatform.isLinux
-, supportsAndroid ? (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isDarwin)
-, supportsDarwin ? stdenv.hostPlatform.isDarwin
-, supportsIOS ? stdenv.hostPlatform.isDarwin
-, includedEngineArtifacts ? {
-    common = [
-      "flutter_patched_sdk"
-      "flutter_patched_sdk_product"
-    ];
-    platform = {
-      android = lib.optionalAttrs supportsAndroid
-        ((lib.genAttrs [ "arm" "arm64" "x64" ] (architecture: [ "profile" "release" ])) // { x86 = [ "jit-release" ]; });
-      darwin = lib.optionalAttrs supportsDarwin
-        ((lib.genAttrs [ "arm64" "x64" ] (architecture: [ "profile" "release" ])));
-      ios = lib.optionalAttrs supportsIOS
-        ((lib.genAttrs [ "" ] (architecture: [ "profile" "release" ])));
-      linux = lib.optionalAttrs supportsLinuxDesktop
-        (lib.genAttrs ((lib.optional stdenv.hostPlatform.isx86_64 "x64") ++ (lib.optional stdenv.hostPlatform.isAarch64 "arm64"))
-          (architecture: [ "debug" "profile" "release" ]));
-    };
-  }
+, supportedTargetPlatforms ? [
+    "universal"
+    "web"
+  ]
+  ++ lib.optional stdenv.hostPlatform.isLinux "linux"
+  ++ lib.optional (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isDarwin) "android"
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ "macos" "ios" ]
+, artifactHashes ? (import ./artifacts/hashes.nix).${flutter.version}
 , extraPkgConfigPackages ? [ ]
 , extraLibraries ? [ ]
 , extraIncludes ? [ ]
@@ -57,70 +44,31 @@
 }:
 
 let
-  engineArtifacts = callPackage ./engine-artifacts {
-    inherit (flutter) engineVersion;
-    flutterVersion = flutter.version;
-  };
-  mkCommonArtifactLinkCommand = { artifact }:
-    ''
-      mkdir -p $out/artifacts/engine/common
-      lndir -silent ${artifact} $out/artifacts/engine/common
-    '';
-  mkPlatformArtifactLinkCommand = { artifact, os, architecture, variant ? null }:
-    let
-      artifactDirectory = "${os}-${architecture}${lib.optionalString (variant != null) "-${variant}"}";
-    in
-    ''
-      mkdir -p $out/artifacts/engine/${artifactDirectory}
-      lndir -silent ${artifact} $out/artifacts/engine/${artifactDirectory}
-    '';
-  engineArtifactDirectory =
-    runCommandLocal "flutter-engine-artifacts-${flutter.version}" { nativeBuildInputs = [ lndir ]; }
-      (
-        builtins.concatStringsSep "\n"
-          ((map
-            (name: mkCommonArtifactLinkCommand {
-              artifact = engineArtifacts.common.${name};
-            })
-            (includedEngineArtifacts.common or [ ])) ++
-          (builtins.foldl'
-            (commands: os: commands ++
-              (builtins.foldl'
-                (commands: architecture: commands ++
-                  (builtins.foldl'
-                    (commands: variant: commands ++
-                      (map
-                        (artifact: mkPlatformArtifactLinkCommand {
-                          inherit artifact os architecture variant;
-                        })
-                        engineArtifacts.platform.${os}.${architecture}.variants.${variant}))
-                    (map
-                      (artifact: mkPlatformArtifactLinkCommand {
-                        inherit artifact os architecture;
-                      })
-                      engineArtifacts.platform.${os}.${architecture}.base)
-                    includedEngineArtifacts.platform.${os}.${architecture}))
-                [ ]
-                (builtins.attrNames includedEngineArtifacts.platform.${os})))
-            [ ]
-            (builtins.attrNames (includedEngineArtifacts.platform or { }))))
-      );
+  supportsLinuxDesktopTarget = builtins.elem "linux" supportedTargetPlatforms;
 
-  cacheDir = symlinkJoin {
+  platformArtifacts = lib.genAttrs supportedTargetPlatforms (platform:
+    (callPackage ./artifacts/prepare-artifacts.nix {
+      src = callPackage ./artifacts/fetch-artifacts.nix {
+        inherit platform;
+        flutter = callPackage ./wrapper.nix { inherit flutter; };
+        hash = artifactHashes.${platform}.${stdenv.hostPlatform.system} or "";
+      };
+    }));
+
+  cacheDir = symlinkJoin rec {
     name = "flutter-cache-dir";
-    paths = [
-      engineArtifactDirectory
-      "${flutter}/bin/cache"
-    ];
+    paths = builtins.attrValues platformArtifacts;
+    postBuild = ''
+      mkdir -p "$out/bin/cache"
+      ln -s '${flutter}/bin/cache/dart-sdk' "$out/bin/cache"
+    '';
+    passthru.platform = platformArtifacts;
   };
 
   # By default, Flutter stores downloaded files (such as the Pub cache) in the SDK directory.
   # Wrap it to ensure that it does not do that, preferring home directories instead.
-  # The sh file `$out/bin/internal/shared.sh` runs when launching Flutter and calls `"$FLUTTER_ROOT/bin/cache/` instead of our environment variable `FLUTTER_CACHE_DIR`.
-  # We do not patch it since the script doesn't require engine artifacts(which are the only thing not added by the unwrapped derivation), so it shouldn't fail, and patching it will just be harder to maintain.
   immutableFlutter = writeShellScript "flutter_immutable" ''
     export PUB_CACHE=''${PUB_CACHE:-"$HOME/.pub-cache"}
-    export FLUTTER_CACHE_DIR=${cacheDir}
     ${flutter}/bin/flutter "$@"
   '';
 
@@ -128,7 +76,7 @@ let
   tools = [ git which ];
 
   # Libraries that Flutter apps depend on at runtime.
-  appRuntimeDeps = lib.optionals supportsLinuxDesktop [
+  appRuntimeDeps = lib.optionals supportsLinuxDesktopTarget [
     atk
     cairo
     gdk-pixbuf
@@ -152,10 +100,10 @@ let
 
   # Some header files and libraries are not properly located by the Flutter SDK.
   # They must be manually included.
-  appStaticBuildDeps = (lib.optionals supportsLinuxDesktop [ libX11 xorgproto zlib ]) ++ extraLibraries;
+  appStaticBuildDeps = (lib.optionals supportsLinuxDesktopTarget [ libX11 xorgproto zlib ]) ++ extraLibraries;
 
   # Tools used by the Flutter SDK to compile applications.
-  buildTools = lib.optionals supportsLinuxDesktop [
+  buildTools = lib.optionals supportsLinuxDesktopTarget [
     pkg-config
     cmake
     ninja
@@ -174,12 +122,12 @@ in
 
   nativeBuildInputs = [ makeWrapper ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ]
-    ++ lib.optionals supportsLinuxDesktop [ glib wrapGAppsHook ];
+    ++ lib.optionals supportsLinuxDesktopTarget [ glib wrapGAppsHook ];
 
   passthru = flutter.passthru // {
     inherit (flutter) version;
     unwrapped = flutter;
-    inherit engineArtifacts;
+    inherit cacheDir;
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/libraries/gdal/default.nix b/pkgs/development/libraries/gdal/default.nix
index 5b30c5e1bf8d..9c321bb1231a 100644
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@@ -76,13 +76,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdal";
-  version = "3.8.1";
+  version = "3.8.2";
 
   src = fetchFromGitHub {
     owner = "OSGeo";
     repo = "gdal";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-EQWAJZgufUC0FADuIotrGhP0Nf5qlgOwmiSlqLSv00A=";
+    hash = "sha256-R21zRjEvJO+97yXJDvzDJryQ7ps9uEN62DZ0GCxdoFk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/tty/default.nix b/pkgs/development/ocaml-modules/tty/default.nix
new file mode 100644
index 000000000000..8c5c1b47524a
--- /dev/null
+++ b/pkgs/development/ocaml-modules/tty/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, uutf
+}:
+
+buildDunePackage rec {
+  pname = "tty";
+  version = "0.0.2";
+
+  minimalOCamlVersion = "5.1";
+
+  src = fetchurl {
+    url = "https://github.com/leostera/tty/releases/download/${version}/tty-${version}.tbz";
+    hash = "sha256-eeD5Y+/QXZzFoEHvOSZj2Q74V8BK5j3Lu3Zsrj2YUUs=";
+  };
+
+  propagatedBuildInputs = [
+    uutf
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "A library for interacting with teletype and terminal emulators";
+    homepage = "https://github.com/leostera/tty";
+    changelog = "https://github.com/leostera/tty/blob/${version}/CHANGES.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sixstring982 ];
+  };
+}
diff --git a/pkgs/development/python-modules/aioconsole/default.nix b/pkgs/development/python-modules/aioconsole/default.nix
index ab2d20155a92..aa9e05a982b5 100644
--- a/pkgs/development/python-modules/aioconsole/default.nix
+++ b/pkgs/development/python-modules/aioconsole/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, setuptools
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -60,7 +59,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/vxgmichel/aioconsole/releases/tag/v${version}";
     description = "Asynchronous console and interfaces for asyncio";
     homepage = "https://github.com/vxgmichel/aioconsole";
-    changelog = "https://github.com/vxgmichel/aioconsole/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ catern ];
   };
diff --git a/pkgs/development/python-modules/django-anymail/default.nix b/pkgs/development/python-modules/django-anymail/default.nix
index 7ff0038eb33e..799881ebee35 100644
--- a/pkgs/development/python-modules/django-anymail/default.nix
+++ b/pkgs/development/python-modules/django-anymail/default.nix
@@ -1,14 +1,13 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, six
 , requests
 , django
 , boto3
+, hatchling
+, python
 , mock
-, pytestCheckHook
-, pytest-django
-, setuptools
+, responses
 }:
 
 buildPythonPackage rec {
@@ -24,32 +23,31 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    setuptools
+    hatchling
   ];
 
   propagatedBuildInputs = [
-    six
     requests
     django
-    boto3
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
-    pytest-django
     mock
-  ];
+    responses
+  ] ++ passthru.optional-dependencies.amazon-ses;
 
-  disabledTests = [
-    # Require networking
-    "test_debug_logging"
-    "test_no_debug_logging"
-  ];
+  passthru.optional-dependencies = {
+    amazon-ses = [ boto3 ];
+  };
+
+  checkPhase = ''
+    runHook preCheck
+    CONTINUOUS_INTEGRATION=1 ${python.interpreter} runtests.py
+    runHook postCheck
+  '';
 
   pythonImportsCheck = [ "anymail" ];
 
-  DJANGO_SETTINGS_MODULE = "tests.test_settings.settings_3_2";
-
   meta = with lib; {
     description = "Django email backends and webhooks for Mailgun";
     homepage = "https://github.com/anymail/django-anymail";
diff --git a/pkgs/development/python-modules/dockerspawner/default.nix b/pkgs/development/python-modules/dockerspawner/default.nix
index d0b9180570fa..44f269d50c64 100644
--- a/pkgs/development/python-modules/dockerspawner/default.nix
+++ b/pkgs/development/python-modules/dockerspawner/default.nix
@@ -30,12 +30,15 @@ buildPythonPackage rec {
   # tests require docker
   doCheck = false;
 
-  pythonImportsCheck = [ "dockerspawner" ];
+  pythonImportsCheck = [
+    "dockerspawner"
+  ];
 
   meta = with lib; {
-    description = "Dockerspawner: A custom spawner for Jupyterhub";
-    homepage = "https://jupyter.org";
+    description = "A custom spawner for Jupyterhub";
+    homepage = "https://github.com/jupyterhub/dockerspawner";
+    changelog = "https://github.com/jupyterhub/dockerspawner/blob/${version}/docs/source/changelog.md";
     license = licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/etils/default.nix b/pkgs/development/python-modules/etils/default.nix
index 4eb12d98386e..36c5ebb71c52 100644
--- a/pkgs/development/python-modules/etils/default.nix
+++ b/pkgs/development/python-modules/etils/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "etils";
-  version = "1.5.2";
-  format = "pyproject";
+  version = "1.6.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-umo+Gv+Vx2kTB3aqF2wRVAY39d2IHzt5FypRSbaxxEY=";
+    hash = "sha256-xjX70Cp5/tStdoJdMTBrWB0itAZxch2qi8J5z2Mz5Io=";
   };
 
   nativeBuildInputs = [
@@ -81,7 +81,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     changelog = "https://github.com/google/etils/blob/v${version}/CHANGELOG.md";
-    description = "Collection of eclectic utils for python";
+    description = "Collection of eclectic utils";
     homepage = "https://github.com/google/etils";
     license = licenses.asl20;
     maintainers = with maintainers; [ mcwitt ];
diff --git a/pkgs/development/python-modules/faraday-plugins/default.nix b/pkgs/development/python-modules/faraday-plugins/default.nix
index fb2bcf88fa7f..2e4d62ebb9c2 100644
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "faraday-plugins";
-  version = "1.14.0";
+  version = "1.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "infobyte";
     repo = "faraday_plugins";
     rev = "refs/tags/${version}";
-    hash = "sha256-qFA0AVebHd/Ny8x+rUkueLZhYB/PwL7o/qpUnZCRsEA=";
+    hash = "sha256-2Z3S5zojaRVaeeujFor/g3x+rxKppw/jSyq0GRJ49OY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/feedparser/default.nix b/pkgs/development/python-modules/feedparser/default.nix
index 7eaf65b371df..0367e1e8a106 100644
--- a/pkgs/development/python-modules/feedparser/default.nix
+++ b/pkgs/development/python-modules/feedparser/default.nix
@@ -1,23 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pythonOlder
-, sgmllib3k
 , python
+, pythonOlder
+, setuptools
+, sgmllib3k
 }:
 
 buildPythonPackage rec {
   pname = "feedparser";
-  version = "6.0.10";
-  format = "setuptools";
+  version = "6.0.11";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J9pIX0Y3znFjzeqxOoAxK5O30MG3db70pHYpoxELylE=";
+    hash = "sha256-ydBAe2TG8qBl0OuyksKzXAEFDMDcM3V0Yaqr3ExBhNU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     sgmllib3k
   ];
@@ -36,8 +41,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    homepage = "https://github.com/kurtmckee/feedparser";
     description = "Universal feed parser";
+    homepage = "https://github.com/kurtmckee/feedparser";
+    changelog = "https://feedparser.readthedocs.io/en/latest/changelog.html";
     license = licenses.bsd2;
     maintainers = with maintainers; [ domenkozar ];
   };
diff --git a/pkgs/development/python-modules/gehomesdk/default.nix b/pkgs/development/python-modules/gehomesdk/default.nix
index 93ef73227310..9b66fc47bd64 100644
--- a/pkgs/development/python-modules/gehomesdk/default.nix
+++ b/pkgs/development/python-modules/gehomesdk/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "gehomesdk";
-  version = "0.5.25";
+  version = "0.5.26";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VQSefwzw4zA9ycO8723kBlMbtrOJxmKgZ8tfXZmtyQc=";
+    hash = "sha256-eIpBVfkUIQBriZ4wxp8ii5YmuuKF8r0lNauBEEqoNV8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gflanguages/default.nix b/pkgs/development/python-modules/gflanguages/default.nix
index 5a4f3d447290..626495ed6f77 100644
--- a/pkgs/development/python-modules/gflanguages/default.nix
+++ b/pkgs/development/python-modules/gflanguages/default.nix
@@ -2,31 +2,42 @@
 , buildPythonPackage
 , fetchPypi
 , protobuf
-, setuptools-scm
-, pythonRelaxDepsHook
 , pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+, setuptools-scm
 , uharfbuzz
 , youseedee
 }:
 
 buildPythonPackage rec {
   pname = "gflanguages";
-  version = "0.5.10";
+  version = "0.5.13";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JVeI7TlJjbKCa+gGmjylbNiEhX3qmpbLXiH3VpFqgXc=";
+    hash = "sha256-LoppJHzX0dOpHnwMCyS1ACdIO4cqwb370ksvsXDFHzQ=";
   };
 
-  propagatedBuildInputs = [
-    protobuf
+  # Relax the dependency on protobuf 3. Other packages in the Google Fonts
+  # ecosystem have begun upgrading from protobuf 3 to protobuf 4,
+  # so we need to use protobuf 4 here as well to avoid a conflict
+  # in the closure of fontbakery. It seems to be compatible enough.
+  pythonRelaxDeps = [
+    "protobuf"
   ];
+
   nativeBuildInputs = [
     setuptools-scm
   ];
 
-  doCheck = true;
+  propagatedBuildInputs = [
+    protobuf
+  ];
+
   nativeCheckInputs = [
     pythonRelaxDepsHook
     pytestCheckHook
@@ -34,15 +45,10 @@ buildPythonPackage rec {
     youseedee
   ];
 
-  # Relax the dependency on protobuf 3. Other packages in the Google Fonts
-  # ecosystem have begun upgrading from protobuf 3 to protobuf 4,
-  # so we need to use protobuf 4 here as well to avoid a conflict
-  # in the closure of fontbakery. It seems to be compatible enough.
-  pythonRelaxDeps = [ "protobuf" ];
-
   meta = with lib; {
     description = "Python library for Google Fonts language metadata";
     homepage = "https://github.com/googlefonts/lang";
+    changelog = "https://github.com/googlefonts/lang/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ danc86 ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
index d64bd1bf7340..bf293c41541d 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-datatransfer";
-  version = "3.12.1";
+  version = "3.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uEWnQIGs4yybuukzgrAqaduFYKNW9h/WouX2MzSVgUg=";
+    hash = "sha256-J6hFyyJgWlEsBc4owokNLvl61O38mBevVVpz2AJOw7o=";
   };
 
   propagatedBuildInputs = [
@@ -50,8 +50,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "BigQuery Data Transfer API client library";
-    homepage = "https://github.com/googleapis/python-bigquery-datatransfer";
-    changelog = "https://github.com/googleapis/python-bigquery-datatransfer/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-bigquery-datatransfer";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-bigquery-datatransfer-v${version}/packages/google-cloud-bigquery-datatransfer/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-datastore/default.nix b/pkgs/development/python-modules/google-cloud-datastore/default.nix
index b6148c30746c..00e07713a635 100644
--- a/pkgs/development/python-modules/google-cloud-datastore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datastore/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datastore";
-  version = "2.18.0";
+  version = "2.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Y7MbZ23LJ4amUNI9Mk2PiGxOFFhq/dDP5uJgpz8SRI4=";
+    hash = "sha256-B/xYcKAmHyVGbFV8E035Wpbf0lN6vQiLnVN/ur6ZuXQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-dns/default.nix b/pkgs/development/python-modules/google-cloud-dns/default.nix
index 0f9b9eca022f..f076591c02de 100644
--- a/pkgs/development/python-modules/google-cloud-dns/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dns/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dns";
-  version = "0.34.2";
+  version = "0.35.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/GG9jPBw6Hqstidi6ypa8VUHBsmIgdeurrru0RKAr9M=";
+    hash = "sha256-CsRNqesPoLEilRPNiIB0q9AhGZLEBCMAr9HBbUFHRVM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
index f7c690c56f67..aac30f35757d 100644
--- a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam-logging";
-  version = "1.2.2";
+  version = "1.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6IBjA2WwP11d/vQJSIY3WhbqYvAgFRtZFFSffUqKM38=";
+    hash = "sha256-oLqRmxNPbb+nUMN70kGlAtBCji4wXrbRv2DhNMcZV5c=";
   };
 
   propagatedBuildInputs = [
@@ -43,8 +43,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "IAM Service Logging client library";
-    homepage = "https://github.com/googleapis/python-iam-logging";
-    changelog = "https://github.com/googleapis/python-iam-logging/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-iam-logging";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-iam-logging-v${version}/packages/google-cloud-iam-logging/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-language/default.nix b/pkgs/development/python-modules/google-cloud-language/default.nix
index 54397f68cd8f..e04591791d3c 100644
--- a/pkgs/development/python-modules/google-cloud-language/default.nix
+++ b/pkgs/development/python-modules/google-cloud-language/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-language";
-  version = "2.11.1";
+  version = "2.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XxhECfBAwMcwV8JhbmvS6G5FrrZGGA0ZwYnfSqPQLbo=";
+    hash = "sha256-efuO/hWDM+aMBXR+nqhrWYsvQpoS83FJ2DrG+hhFlio=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-org-policy/default.nix b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
index 2e91f2704c77..314dc51060da 100644
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-org-policy";
-  version = "1.8.3";
+  version = "1.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VU+vB+x2DElwzl1cO7qTdV91Mn1i2Dsq2safnMrwuqI=";
+    hash = "sha256-3Db3R3PnzYMiMNrbP1BiU7TfKIxR11v491i+JH10Q/0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 943d55dab406..f2288f8638c1 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.18.4";
+  version = "2.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Muth/UwdxshC9ZTWnZr6gFROOzJ6pkChZOtvsCAery0=";
+    hash = "sha256-apjDP361994q5S76BZsrX3WyzNnw8R8u3O/dqNFOQlw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-tasks/default.nix b/pkgs/development/python-modules/google-cloud-tasks/default.nix
index 4354e9047444..c5762819af6a 100644
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "2.14.2";
+  version = "2.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PvsoDnpjX1eGCgajRhMcEXBC6CCtSDr9JWgA+uG01wE=";
+    hash = "sha256-SpmTjbARHVU3hkG1I1uY5r12S8jip+JN9wb4uGO98nw=";
   };
 
   propagatedBuildInputs = [
@@ -50,8 +50,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Cloud Tasks API API client library";
-    homepage = "https://github.com/googleapis/python-tasks";
-    changelog = "https://github.com/googleapis/python-tasks/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-tasks";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-tasks-v${version}/packages/google-cloud-tasks/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-texttospeech/default.nix b/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
index 6872b953efca..f039e5870be3 100644
--- a/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-texttospeech";
-  version = "2.14.2";
+  version = "2.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ojc4NmmI+vTSZSAPV8XeQxLvo9FLtDS5Km5UFxP12QY=";
+    hash = "sha256-d4Y+1U94/NLhlMoRPJzF5+QLhzBszsG6MH5G3PgfBzc=";
   };
 
   propagatedBuildInputs = [
@@ -48,8 +48,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Google Cloud Text-to-Speech API client library";
-    homepage = "https://github.com/googleapis/python-texttospeech";
-    changelog = "https://github.com/googleapis/python-texttospeech/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-texttospeech";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-texttospeech-v${version}/packages/google-cloud-texttospeech/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-trace/default.nix b/pkgs/development/python-modules/google-cloud-trace/default.nix
index ac134f2472ca..98a62651013c 100644
--- a/pkgs/development/python-modules/google-cloud-trace/default.nix
+++ b/pkgs/development/python-modules/google-cloud-trace/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-trace";
-  version = "1.11.3";
+  version = "1.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ud0MLfv5Oy3AV6RdAkyMbCxM2+55txtfoekTB1eznFE=";
+    hash = "sha256-IvbMxHbOMQHUH7q86sP+/N/gV9KWez6OIMAmcTY6Uko=";
   };
 
   propagatedBuildInputs = [
@@ -50,8 +50,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Cloud Trace API client library";
-    homepage = "https://github.com/googleapis/python-trace";
-    changelog = "https://github.com/googleapis/python-trace/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-trace";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-trace-v${version}/packages/google-cloud-trace/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
index 3ff18366e426..ef0a5971ebbb 100644
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-videointelligence";
-  version = "2.11.4";
+  version = "2.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B6zimaY/Wz1EQTdWNIU7Vc6PkMYsaiT4pH6wVBSfb5k=";
+    hash = "sha256-SwGUkyzSYEGZuIBbwQhpLmoqJZ9Hd1FrnLyXi4hx4pU=";
   };
 
   propagatedBuildInputs = [
@@ -52,8 +52,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Google Cloud Video Intelligence API client library";
-    homepage = "https://github.com/googleapis/python-videointelligence";
-    changelog = "https://github.com/googleapis/python-videointelligence/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-videointelligence";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-videointelligence-v${version}/packages/google-cloud-videointelligence/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
index 8804ad810aaa..d4c285c3f34e 100644
--- a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-websecurityscanner";
-  version = "1.12.3";
+  version = "1.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zu4e4MTpc24p5ZWeRfVQwX0brciaz80FDGbxy6UppEA=";
+    hash = "sha256-vktbTjzNYMa8otEGGq36fYOKcNuNasWql4SBWbk84Iw=";
   };
 
   propagatedBuildInputs = [
@@ -41,8 +41,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Google Cloud Web Security Scanner API client library";
-    homepage = "https://github.com/googleapis/python-websecurityscanner";
-    changelog = "https://github.com/googleapis/python-websecurityscanner/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-websecurityscanner";
+    changelog = "https://github.com/googleapis/google-cloud-python/tree/google-cloud-websecurityscanner-v${version}/packages/google-cloud-websecurityscanner";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/gotailwind/default.nix b/pkgs/development/python-modules/gotailwind/default.nix
new file mode 100644
index 000000000000..8c86b44df353
--- /dev/null
+++ b/pkgs/development/python-modules/gotailwind/default.nix
@@ -0,0 +1,79 @@
+{ lib
+, aiohttp
+, aresponses
+, awesomeversion
+, backoff
+, buildPythonPackage
+, fetchFromGitHub
+, mashumaro
+, orjson
+, poetry-core
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, syrupy
+, typer
+, yarl
+, zeroconf
+}:
+
+buildPythonPackage rec {
+  pname = "gotailwind";
+  version = "0.2.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.11";
+
+  src = fetchFromGitHub {
+    owner = "frenck";
+    repo = "python-gotailwind";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-JtMBud3iON4xLc9dQdXniv51EBqs7zkat8cYm3q0uEE=";
+  };
+
+  postPatch = ''
+    # Upstream doesn't set a version for the pyproject.toml
+    substituteInPlace pyproject.toml \
+      --replace "0.0.0" "${version}" \
+      --replace "--cov" ""
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    awesomeversion
+    backoff
+    mashumaro
+    orjson
+    yarl
+    zeroconf
+  ];
+
+  passthru.optional-dependencies = {
+    cli = [
+      typer
+    ];
+  };
+
+  nativeCheckInputs = [
+    aresponses
+    pytest-asyncio
+    pytestCheckHook
+    syrupy
+  ];
+
+  pythonImportsCheck = [
+    "gotailwind"
+  ];
+
+  meta = with lib; {
+    description = "Modul to communicate with Tailwind garage door openers";
+    homepage = "https://github.com/frenck/python-gotailwind";
+    changelog = "https://github.com/frenck/python-gotailwind/releases/tag/v$version";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/grad-cam/default.nix b/pkgs/development/python-modules/grad-cam/default.nix
index 8636a71ecdce..42d65ae433b7 100644
--- a/pkgs/development/python-modules/grad-cam/default.nix
+++ b/pkgs/development/python-modules/grad-cam/default.nix
@@ -7,6 +7,7 @@
 , opencv4
 , pillow
 , scikit-learn
+, setuptools
 , torch
 , torchvision
 , ttach
@@ -15,19 +16,25 @@
 
 buildPythonPackage rec {
   pname = "grad-cam";
-  version = "1.4.8";
-  disabled = pythonOlder "3.6";
-  format = "pyproject";
+  version = "1.5.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BNcwDaEEmRsEoJ4nvvGfjZ9LdG0eRqZCFuY5/Gmp5N4=";
+    hash = "sha256-aw7Z/6/AMKH2PVBcOr8HxsmRDa6c3v8Xd4xa8HTiFGA=";
   };
 
   postPatch = ''
-    substituteInPlace requirements.txt --replace "opencv-python" "opencv"
+    substituteInPlace requirements.txt\
+      --replace "opencv-python" "opencv"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     matplotlib
     numpy
diff --git a/pkgs/development/python-modules/gspread/default.nix b/pkgs/development/python-modules/gspread/default.nix
index 0e56dd26cb8d..fa68122dcb13 100644
--- a/pkgs/development/python-modules/gspread/default.nix
+++ b/pkgs/development/python-modules/gspread/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "gspread";
-  version = "5.12.1";
+  version = "5.12.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "burnash";
     repo = "gspread";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cuSR5QWURHSL1o2R4rc/m3KETz3X+78TC8LuuzZghbs=";
+    hash = "sha256-NmIWGHS40VOUL3IGSR/SW9inbSQFv+2UDgo1FZWROHI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/habluetooth/default.nix b/pkgs/development/python-modules/habluetooth/default.nix
index 237379c600fb..997a7c899822 100644
--- a/pkgs/development/python-modules/habluetooth/default.nix
+++ b/pkgs/development/python-modules/habluetooth/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "habluetooth";
-  version = "0.9.0";
+  version = "1.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "habluetooth";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jAv3ygKsd2leHTR6FAIxaq+PtQbjauzyA+wvxTfTe2g=";
+    hash = "sha256-bk6UU+QGrkHio5j0/rOup7EQV12F/lb4m4b7JiJ7LFw=";
   };
 
   postPatch = ''
@@ -61,7 +61,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for high availability Bluetooth";
     homepage = "https://github.com/Bluetooth-Devices/habluetooth";
-    changelog = "https://github.com/Bluetooth-Devices/habluetooth/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/Bluetooth-Devices/habluetooth/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
index 9aac09e8bff3..efa362c6fdd0 100644
--- a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
+++ b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "ibm-cloud-sdk-core";
-  version = "3.18.0";
+  version = "3.18.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vytpQHYZcMFLU/yPwTWvVnxYuXCdsyFL5AOjg91Ryrs=";
+    hash = "sha256-0gjISrKELopSMEuZHL8fy8q7rMuMqzATkP+c4Y8I+9A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/id/default.nix b/pkgs/development/python-modules/id/default.nix
index c4b59268b4bc..f2e6bbf7579b 100644
--- a/pkgs/development/python-modules/id/default.nix
+++ b/pkgs/development/python-modules/id/default.nix
@@ -11,16 +11,16 @@
 
 buildPythonPackage rec {
   pname = "id";
-  version = "1.1.0";
+  version = "1.2.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "di";
     repo = "id";
     rev = "refs/tags/v${version}";
-    hash = "sha256-T3p13EnXU1Efysnu1RQw5st1BgHyZNdrKtkzQSguRtM=";
+    hash = "sha256-njX4kL8pCv6+SyYUtmzUh/BWWsaueKO+IiJ96sAXMVo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/justnimbus/default.nix b/pkgs/development/python-modules/justnimbus/default.nix
index ecea9ef4a549..013e4670aa8f 100644
--- a/pkgs/development/python-modules/justnimbus/default.nix
+++ b/pkgs/development/python-modules/justnimbus/default.nix
@@ -8,16 +8,16 @@
 
 buildPythonPackage rec {
   pname = "justnimbus";
-  version = "0.7.2";
-  format = "pyproject";
+  version = "0.7.3";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "kvanzuijlen";
-    repo = pname;
+    repo = "justnimbus";
     rev = "refs/tags/${version}";
-    hash = "sha256-arUdjZiEJx0L1YcCNxqlE4ItoTEzd/TYVgqDPIqomMg=";
+    hash = "sha256-JO8T0JItkkNHxlnDKOO8kM9KSzT7QML4sszPymgXSBA=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for the JustNimbus API";
     homepage = "https://github.com/kvanzuijlen/justnimbus";
+    changelog = "https://github.com/kvanzuijlen/justnimbus/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/life360/default.nix b/pkgs/development/python-modules/life360/default.nix
index e3fd2a8ecbae..a2d958bc1083 100644
--- a/pkgs/development/python-modules/life360/default.nix
+++ b/pkgs/development/python-modules/life360/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "life360";
-  version = "6.0.0";
+  version = "6.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "pnbruckner";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-GRQPH7fp8YkkCEpXtvgFxJO6VLFQK/PBaRe0Tfg3KdU=";
+    hash = "sha256-USqSkjOHlH0K/RlRYpn/gz6dHW8/uEVpsc4HeUZ3Emg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mediapy/default.nix b/pkgs/development/python-modules/mediapy/default.nix
index 2c58382a4779..bd8ccc0e78fc 100644
--- a/pkgs/development/python-modules/mediapy/default.nix
+++ b/pkgs/development/python-modules/mediapy/default.nix
@@ -11,26 +11,35 @@
 
 buildPythonPackage rec {
   pname = "mediapy";
-  version = "1.1.9";
-  format = "pyproject";
+  version = "1.2.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WUOxtE0NfXi0fpdasZTqixPhVV2+Refatvf6dgCb0Z8=";
+    hash = "sha256-enxOx0hZ+fksk8ibsDWg0Bl/cJeSBHE37bN/D1ucECg=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  nativeBuildInputs = [
+    flit-core
+  ];
 
-  propagatedBuildInputs = [ ipython matplotlib numpy pillow ];
+  propagatedBuildInputs = [
+    ipython
+    matplotlib
+    numpy
+    pillow
+  ];
 
-
-  pythonImportsCheck = [ "mediapy" ];
+  pythonImportsCheck = [
+    "mediapy"
+  ];
 
   meta = with lib; {
     description = "Read/write/show images and videos in an IPython notebook";
     homepage = "https://github.com/google/mediapy";
+    changelog = "https://github.com/google/mediapy/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ mcwitt ];
   };
diff --git a/pkgs/development/python-modules/meraki/default.nix b/pkgs/development/python-modules/meraki/default.nix
index 0720a290cb9c..c29543a21dac 100644
--- a/pkgs/development/python-modules/meraki/default.nix
+++ b/pkgs/development/python-modules/meraki/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "meraki";
-  version = "1.39.0";
+  version = "1.41.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B3+2KnRXWkB83Sy/NH9kJwgSha9L17tx37fFwBjT3Mw=";
+    hash = "sha256-aXcGMRqkiVPnLEYrzIMLDiFXWurBRNlMg4OnRd5jlrY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/meshtastic/default.nix b/pkgs/development/python-modules/meshtastic/default.nix
index 8bfb65056f16..c8ec19468bc3 100644
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "2.2.12";
+  version = "2.2.16";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-W//mDKtTWjcKT43n82OU3h4yKrNZMAVzLzQCjsmkJP0=";
+    hash = "sha256-5JEMiSLLVv7p8H5R8BDE5IKGmBb2bSht+s4sCsxWyzU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mido/default.nix b/pkgs/development/python-modules/mido/default.nix
index 84fe78a59475..90b5128e4747 100644
--- a/pkgs/development/python-modules/mido/default.nix
+++ b/pkgs/development/python-modules/mido/default.nix
@@ -6,18 +6,21 @@
 , portmidi
 , python-rtmidi
 , pytestCheckHook
+, pythonOlder
 , setuptools
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "mido";
-  version = "1.3.0";
-  format = "pyproject";
+  version = "1.3.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-hCguOs40vKP5hCINstvLmCRc/q+4VCYMAuAAdQ3Khqo=";
+    sha256 = "sha256-Ouootu1zD3N9WxLaNXjevp3FAFj6Nw/pzt7ZGJtnw0g=";
   };
 
   patches = [
@@ -47,6 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "MIDI Objects for Python";
     homepage = "https://mido.readthedocs.io";
+    changelog = "https://github.com/mido/mido/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix b/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix
index 986f0d1d2ce6..d386b1cb05da 100644
--- a/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix
+++ b/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-git-revision-date-localized-plugin";
-  version = "1.2.1";
+  version = "1.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "timvink";
     repo = "mkdocs-git-revision-date-localized-plugin";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UIbW64ac9kXptJjn86V6vPArnICANiT3QGi5JH45KLY=";
+    hash = "sha256-6qLVmmJzMTrvuoeSVUjWqmI6f5MbAFWAj36v2l3ZeD8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ms-active-directory/default.nix b/pkgs/development/python-modules/ms-active-directory/default.nix
index b8459dc6d6a0..ff908beaa7f2 100644
--- a/pkgs/development/python-modules/ms-active-directory/default.nix
+++ b/pkgs/development/python-modules/ms-active-directory/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "ms-active-directory";
-  version = "1.12.1";
+  version = "1.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "zorn96";
     repo = "ms_active_directory";
-    rev = "v${version}";
-    hash = "sha256-mErQib8xTgo29iPAtiLnhxLXyFboAzyEW9A/QMseM6k=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-+wfhtEGuC1R5jbEnWm4mDHIR096KKEcG/K8SuItwjGk=";
   };
 
   propagatedBuildInputs = [
@@ -43,6 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for integrating with Microsoft Active Directory domains";
     homepage = "https://github.com/zorn96/ms_active_directory/";
+    changelog = "https://github.com/zorn96/ms_active_directory/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/msgspec/default.nix b/pkgs/development/python-modules/msgspec/default.nix
index b2039e23c6ed..5af0adeb0300 100644
--- a/pkgs/development/python-modules/msgspec/default.nix
+++ b/pkgs/development/python-modules/msgspec/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "msgspec";
-  version = "0.18.4";
+  version = "0.18.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "jcrist";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-u1mrj/pHvlbSwh6QtRdJKuVGN1zQ6mRITi/qzrCHnhk=";
+    hash = "sha256-BcENL1vPCspzYdAHicC5AHs/7xZPWf+Yys37vKgbris=";
   };
 
   # Requires libasan to be accessible
diff --git a/pkgs/development/python-modules/nibe/default.nix b/pkgs/development/python-modules/nibe/default.nix
index a437ec2547ce..7994543ac4bd 100644
--- a/pkgs/development/python-modules/nibe/default.nix
+++ b/pkgs/development/python-modules/nibe/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "nibe";
-  version = "2.5.2";
+  version = "2.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "yozik04";
     repo = "nibe";
     rev = "refs/tags/${version}";
-    hash = "sha256-qlGQtjRG92AhFY+sF3mB4ghIn4kydkbDOolLu9Qh0JM=";
+    hash = "sha256-VDK6ZCyW8fmp9Ap/AwgLbU5vlyhYXIGYD6eZ3esSCiU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index d36bc9004e33..42bcc9e660f1 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "2.12.0";
+  version = "2.12.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_parser";
-    hash = "sha256-0Ic7WKQbwA7TnFvXRZz+mFehjWP6n+Pyp0IySMy8sdw=";
+    hash = "sha256-So9Kyj4jMRiaBRQGXE88DSWgLEPqQkv8R/Sd8tyRvE0=";
   };
 
   buildInputs = [ pip ];
diff --git a/pkgs/development/python-modules/okta/default.nix b/pkgs/development/python-modules/okta/default.nix
index d6068b59e043..13218b0d8f08 100644
--- a/pkgs/development/python-modules/okta/default.nix
+++ b/pkgs/development/python-modules/okta/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "okta";
-  version = "2.9.3";
+  version = "2.9.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mOKVCRp8cLY7p0AVbvphWdB3II6eB6HlN8i1HrVUH+o=";
+    hash = "sha256-qMcO0TTbMPjc+r2IOlwJqbaSOztat9MmYWH4kgy9vwA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/onnxmltools/default.nix b/pkgs/development/python-modules/onnxmltools/default.nix
index 97eaf68254b6..b24537ddcdf3 100644
--- a/pkgs/development/python-modules/onnxmltools/default.nix
+++ b/pkgs/development/python-modules/onnxmltools/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "onnxmltools";
-  version = "1.11.2";
+  version = "1.12.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "onnx";
     repo = "onnxmltools";
-    rev = "v${version}";
-    hash = "sha256-uLFAGtCDLdMd0SMoonMXFE0kGHuDpwp6IrIbD0t8l4M=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-/UKGo56riLnATcn7kA++QoFkkILVGYBwqRZZ+PYB1/0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ossfs/default.nix b/pkgs/development/python-modules/ossfs/default.nix
index baa808a7062c..97f61f62199b 100644
--- a/pkgs/development/python-modules/ossfs/default.nix
+++ b/pkgs/development/python-modules/ossfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "ossfs";
-  version = "2023.8.0";
+  version = "2023.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fsspec";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-v6QZgv1QwBrQpCwP/1z6704UNvQyoCrpQGkhTmncbjQ=";
+    hash = "sha256-N1NkpI8inGJCf0xuc+FFmVX85CS7vqzoNddxZ9kqEk0=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/packageurl-python/default.nix b/pkgs/development/python-modules/packageurl-python/default.nix
index dcc49b99af29..f51d7e4518cc 100644
--- a/pkgs/development/python-modules/packageurl-python/default.nix
+++ b/pkgs/development/python-modules/packageurl-python/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "packageurl-python";
-  version = "0.11.2";
+  version = "0.13.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Afv3SkHvhc9BPx7eUpoUEfZYvaZu0i1F0nKArZzrpHE=";
+    hash = "sha256-hPgFP0uFKUuYs7eHFUdYR/tI9FJewwLQbcNbJqmzB4o=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/parametrize-from-file/default.nix b/pkgs/development/python-modules/parametrize-from-file/default.nix
index 79a073af9955..b6ee36c3dce2 100644
--- a/pkgs/development/python-modules/parametrize-from-file/default.nix
+++ b/pkgs/development/python-modules/parametrize-from-file/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "parametrize-from-file";
-  version = "0.18.0";
+  version = "0.19.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "parametrize_from_file";
-    hash = "sha256-mYE8J7XWlvCS2H3kt0bB8dyPHFDqmW8NiH9UCrNccAU=";
+    hash = "sha256-FPTO2hYZT7bsQyPNcjBEk8SZKp51o/eMV5/U58W5SPI=";
   };
 
   # patch out coveralls since it doesn't provide us value
diff --git a/pkgs/development/python-modules/pyenphase/default.nix b/pkgs/development/python-modules/pyenphase/default.nix
index ce1e74e3ffcc..39916f060caa 100644
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pyenphase";
-  version = "1.14.3";
+  version = "1.15.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "pyenphase";
     repo = "pyenphase";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cjkmRGieSKynL8cZORp11/ViK8oCBAZXrgbFKumWKaM=";
+    hash = "sha256-XhcCNp7iA7wTd5ldoCO9QC7o3kmL3jIlumjg8Y5mkVQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sunweg/default.nix b/pkgs/development/python-modules/sunweg/default.nix
index b33220898cd3..80b8b08251c7 100644
--- a/pkgs/development/python-modules/sunweg/default.nix
+++ b/pkgs/development/python-modules/sunweg/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "sunweg";
-  version = "2.0.0";
+  version = "2.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "rokam";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-S92PybN+pReI9WtJr9as95uceicsSMadMQfh9JxsE8U=";
+    hash = "sha256-rqxpHnKHS5rgQ6iH5NSL2F71EnpOBxpICUk74YwtEDc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/translitcodec/default.nix b/pkgs/development/python-modules/translitcodec/default.nix
new file mode 100644
index 000000000000..20da4d3431c4
--- /dev/null
+++ b/pkgs/development/python-modules/translitcodec/default.nix
@@ -0,0 +1,30 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pytestCheckHook, pythonOlder }:
+
+let
+  pname = "translitcodec";
+  version = "0.7.0";
+in buildPythonPackage {
+  inherit pname version;
+
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "claudep";
+    repo = pname;
+    rev = "version-${version}";
+    hash = "sha256-/EKquTchx9i3fZqJ6AMzHYP9yCORvwbuUQ95WJQOQbI=";
+  };
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ pname ];
+
+  meta = with lib; {
+    description = "Unicode to 8-bit charset transliteration codec";
+    homepage = "https://github.com/claudep/translitcodec";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ rycee ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index cddd059fdd61..bc04b05bd7af 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.1.40";
+  version = "3.1.41";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-KnkaE40NVcZAM9U/WmifM9D7xOTRV1Mi7lFIh/r4WJQ=";
+    hash = "sha256-weW4nCBnuMPq888lUG4V/luUi+z4kZ52jUnv6yks45Y=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/rust/crate2nix/default.nix b/pkgs/development/tools/rust/crate2nix/default.nix
index 5f8b3d2cdc6e..62084be4b5a8 100644
--- a/pkgs/development/tools/rust/crate2nix/default.nix
+++ b/pkgs/development/tools/rust/crate2nix/default.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "crate2nix";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nyX1lfaA0eBSB/BaxPzCsyD8p/hxCwNIvr4Ru3i/YX0=";
+    sha256 = "sha256-A9AowkHIjsy1a4LuiPiVP88FMxyCWK41flZEZOUuwQM=";
   };
 
   sourceRoot = "${src.name}/crate2nix";
 
-  cargoSha256 = "sha256-3+emOr3hh+DDkboJbYyJFZgkzmcdA9jdronz7wM4x28=";
+  cargoHash = "sha256-85OIOhRdVDu5hZuBzanyqkH1gOuF5IQGubVrLAqt1ak=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/games/osu-lazer/bin.nix b/pkgs/games/osu-lazer/bin.nix
index 8176e778f417..e3a85c088fdb 100644
--- a/pkgs/games/osu-lazer/bin.nix
+++ b/pkgs/games/osu-lazer/bin.nix
@@ -7,22 +7,22 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2023.1218.1";
+  version = "2023.1221.0";
 
   src = {
     aarch64-darwin = fetchzip {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-      hash = "sha256-FSxXPvbHjLVKU2rlTY2iqIUZSjOPoTES8Bl8j/Ln+6w=";
+      hash = "sha256-viurUlCdPU2Jo5IzEfq+As1mW6GI6LZsKocnkgMvsGU=";
       stripRoot = false;
     };
     x86_64-darwin = fetchzip {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-      hash = "sha256-d6jumDva2LAmiixxD9RFiKdiuSv1yPVeX8OgNB7DYpM=";
+      hash = "sha256-fbOqySfBomVoWZvMFWhPAi/cWaH5akRdeMIxBJcFXdg=";
       stripRoot = false;
     };
     x86_64-linux = fetchurl {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-      hash = "sha256-xxWNLP5m/nxGutt/ogcDYcVaiFaesEvZpDdU/ndVRMs=";
+      hash = "sha256-Flxwh4Jlb60joJ/VYVevw4So612Cnyy1gPnJ7tTKxV0=";
     };
   }.${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported.");
 
diff --git a/pkgs/games/osu-lazer/default.nix b/pkgs/games/osu-lazer/default.nix
index a12a57fa90b6..ffdd5bbcf779 100644
--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@@ -16,13 +16,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2023.1218.1";
+  version = "2023.1221.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     rev = version;
-    sha256 = "sha256-VUnILNH5Ng1mx/UmlBGu6/yYXUOf1t3ofl0AiRHNsRc=";
+    sha256 = "sha256-iIyJQCi16Gf4knej+tZq5f92G9NX0ZLC6q/llAYwlLU=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index 7bcc7976f1f9..d5b266cece37 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -7,6 +7,11 @@
 , extraBwrapArgs ? [ ] # extra arguments to pass to bubblewrap (real default is at usage site)
 , extraArgs ? "" # arguments to always pass to steam
 , extraEnv ? { } # Environment variables to pass to Steam
+
+# steamwebhelper deletes unrelated electron programs' singleton cookies from /tmp on startup:
+# https://github.com/ValveSoftware/steam-for-linux/issues/9121
+, privateTmp ? true # Whether to separate steam's /tmp from the host system
+
 , withGameSpecificLibraries ? true # include game specific libraries
 }@args:
 
@@ -285,9 +290,7 @@ in buildFHSEnv rec {
     exec steam ${extraArgs} "$@"
   '';
 
-  # steamwebhelper deletes unrelated electron programs' singleton cookies from /tmp on startup:
-  # https://github.com/ValveSoftware/steam-for-linux/issues/9121
-  privateTmp = true;
+  inherit privateTmp;
 
   extraPreBwrapCmds = ''
     install -m 1777 -d /tmp/dumps
diff --git a/pkgs/games/tetrio-desktop/default.nix b/pkgs/games/tetrio-desktop/default.nix
index a48f2b22138a..e31491e94c90 100644
--- a/pkgs/games/tetrio-desktop/default.nix
+++ b/pkgs/games/tetrio-desktop/default.nix
@@ -6,6 +6,7 @@
 , wrapGAppsHook
 , alsa-lib
 , cups
+, libGL
 , libX11
 , libXScrnSaver
 , libXtst
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
   ];
 
   libPath = lib.makeLibraryPath [
+    libGL
     libpulseaudio
     systemd
   ];
diff --git a/pkgs/misc/drivers/epson-escpr2/default.nix b/pkgs/misc/drivers/epson-escpr2/default.nix
index cb4ad52a9c25..4c3b969b425f 100644
--- a/pkgs/misc/drivers/epson-escpr2/default.nix
+++ b/pkgs/misc/drivers/epson-escpr2/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
       Refer to the description of epson-escpr for usage.
     '';
     license = licenses.gpl2;
-    maintainers = with maintainers; [ ma9e ma27 ];
+    maintainers = with maintainers; [ ma9e ma27 shawn8901 ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/hdparm/default.nix b/pkgs/os-specific/linux/hdparm/default.nix
index 12938dbac89a..eacce23bc424 100644
--- a/pkgs/os-specific/linux/hdparm/default.nix
+++ b/pkgs/os-specific/linux/hdparm/default.nix
@@ -11,13 +11,14 @@ stdenv.mkDerivation rec {
 
   preBuild = ''
     makeFlagsArray=(sbindir=$out/sbin manprefix=$out)
-    '';
+  '';
 
   meta = with lib; {
     description = "A tool to get/set ATA/SATA drive parameters under Linux";
     homepage = "https://sourceforge.net/projects/hdparm/";
     platforms = platforms.linux;
     license = licenses.bsd2;
+    mainProgram = "hdparm";
     maintainers = [ ];
   };
 
diff --git a/pkgs/servers/mastodon/default.nix b/pkgs/servers/mastodon/default.nix
index ac4083fd9be7..25b6fc41a07b 100644
--- a/pkgs/servers/mastodon/default.nix
+++ b/pkgs/servers/mastodon/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, nodejs-slim, bundlerEnv, nixosTests
-, yarn, callPackage, imagemagick, ffmpeg, file, ruby, writeShellScript
+, yarn, callPackage, ruby, writeShellScript
 , fetchYarnDeps, prefetch-yarn-deps
 , brotli
 
@@ -96,7 +96,8 @@ stdenv.mkDerivation rec {
     '';
   };
 
-  propagatedBuildInputs = [ imagemagick ffmpeg file mastodonGems.wrappedRuby ];
+  propagatedBuildInputs = [ mastodonGems.wrappedRuby ];
+  nativeBuildInputs = [ brotli ];
   buildInputs = [ mastodonGems nodejs-slim ];
 
   buildPhase = ''
diff --git a/pkgs/tools/misc/pubs/default.nix b/pkgs/tools/misc/pubs/default.nix
index 4c52b9b239b4..b02aeb8aefb6 100644
--- a/pkgs/tools/misc/pubs/default.nix
+++ b/pkgs/tools/misc/pubs/default.nix
@@ -7,11 +7,12 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "pubs";
   version = "0.9.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pubs";
     repo = "pubs";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-U/9MLqfXrzYVGttFSafw4pYDy26WgdsJMCxciZzO1pw=";
   };
 
@@ -28,22 +29,26 @@ python3.pkgs.buildPythonApplication rec {
     })
   ];
 
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
-    pyyaml
-    bibtexparser
-    python-dateutil
-    six
-    requests
-    configobj
-    beautifulsoup4
-    feedparser
     argcomplete
+    beautifulsoup4
+    bibtexparser
+    configobj
+    feedparser
+    python-dateutil
+    pyyaml
+    requests
+    six
   ];
 
   nativeCheckInputs = with python3.pkgs; [
-    pyfakefs
-    mock
     ddt
+    mock
+    pyfakefs
     pytestCheckHook
   ];
 
@@ -57,11 +62,18 @@ python3.pkgs.buildPythonApplication rec {
   disabledTests = [
     # https://github.com/pubs/pubs/issues/276
     "test_readme"
+    # AssertionError: Lists differ: ['Ini[112 chars]d to...
+    "test_add_non_standard"
+  ];
+
+  pythonImportsCheck = [
+    "pubs"
   ];
 
   meta = with lib; {
     description = "Command-line bibliography manager";
     homepage = "https://github.com/pubs/pubs";
+    changelog = "https://github.com/pubs/pubs/blob/v${version}/changelog.md";
     license = licenses.lgpl3Only;
     maintainers = with maintainers; [ gebner dotlambda ];
   };
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index 87cbd6881e27..6aedcbbcbb3e 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -3,6 +3,9 @@
 , fetchurl
 , pkg-config
 , iproute2
+, libcap_ng
+, libnl
+, lz4
 , lzo
 , openssl
 , pam
@@ -11,12 +14,13 @@
 , update-systemd-resolved
 , pkcs11Support ? false
 , pkcs11helper
+, nixosTests
 }:
 
 let
   inherit (lib) versionOlder optional optionals optionalString;
 
-  generic = { version, sha256, extraBuildInputs ? [] }:
+  generic = { version, sha256, extraBuildInputs ? [ ] }:
     let
       withIpRoute = stdenv.isLinux && (versionOlder version "2.5.4");
     in
@@ -32,8 +36,8 @@ let
 
         nativeBuildInputs = [ pkg-config ];
 
-        buildInputs = [ lzo ]
-          ++ optional stdenv.isLinux pam
+        buildInputs = [ lz4 lzo ]
+          ++ optionals stdenv.isLinux [ libcap_ng libnl pam ]
           ++ optional withIpRoute iproute2
           ++ optional useSystemd systemd
           ++ optional pkcs11Support pkcs11helper
@@ -72,9 +76,14 @@ let
 
 in
 {
-  openvpn = generic {
-    version = "2.5.8";
-    sha256 = "1cixqm4gn2d1v8qkbww75j30fzvxz13gc7whcmz54i0x4fvibwx6";
+  openvpn = (generic {
+    version = "2.6.8";
+    sha256 = "sha256-Xt4VZcim2IAQD38jUxen7p7qg9UFLbVUfxOp52r3gF0=";
     extraBuildInputs = [ openssl ];
-  };
+  }).overrideAttrs
+    (_: {
+      passthru.tests = {
+        inherit (nixosTests) initrd-network-openvpn systemd-initrd-networkd-openvpn;
+      };
+    });
 }
diff --git a/pkgs/tools/package-management/harmonia/default.nix b/pkgs/tools/package-management/harmonia/default.nix
index fd1ce1063245..9c472f080b15 100644
--- a/pkgs/tools/package-management/harmonia/default.nix
+++ b/pkgs/tools/package-management/harmonia/default.nix
@@ -2,7 +2,7 @@
 , boost
 , fetchFromGitHub
 , libsodium
-, nix
+, nixVersions
 , pkg-config
 , rustPlatform
 , nix-update-script
@@ -11,25 +11,25 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harmonia";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = pname;
     rev = "refs/tags/${pname}-v${version}";
-    hash = "sha256-XtnK54HvZMKZGSCrVD0FO5PQLMo3Vkj8ezUlsfqStq0=";
+    hash = "sha256-72JMrXmxw/FuGjqXXxMIGiAbUUOqXEERdQwch+s3iwU=";
   };
 
-  cargoHash = "sha256-oQVHrfNPhslYk6APB/bhW+h+vk/gNTW/ZypoGGb5zPk=";
+  cargoHash = "sha256-Q5Y5v7mmJpfZFGRgurTcRBRtbApFRrwqOBHdZTJbyzc=";
 
   nativeBuildInputs = [
-    pkg-config nix
+    pkg-config nixVersions.nix_2_19
   ];
 
   buildInputs = [
     boost
     libsodium
-    nix
+    nixVersions.nix_2_19
   ];
 
   passthru = {
diff --git a/pkgs/tools/security/cloudfox/default.nix b/pkgs/tools/security/cloudfox/default.nix
index df34f3e18bf7..e5e47ce56f4e 100644
--- a/pkgs/tools/security/cloudfox/default.nix
+++ b/pkgs/tools/security/cloudfox/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cloudfox";
-  version = "1.12.2";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "BishopFox";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-r9YIJ+PRUA1stKTL39+/T+m1WMkocpjfzG8Y9knnFU4=";
+    hash = "sha256-V6zYEH2LACBcMY0ox8ZgqJGFLWFgCNR4l9Uo+hMgseE=";
   };
 
-  vendorHash = "sha256-nSisRurpareGI4EHENayMhsYOKL1hE1wVw2Ueiqii4U=";
+  vendorHash = "sha256-PZW1rNX8TLW0SZ9A2eF5N12J9BPWgRZJeGIb042Tinc=";
 
   # Some tests are failing because of wrong filename/path
   doCheck = false;
diff --git a/pkgs/tools/security/cnquery/default.nix b/pkgs/tools/security/cnquery/default.nix
index 12a0ed8fb09a..b9e6769ea5ad 100644
--- a/pkgs/tools/security/cnquery/default.nix
+++ b/pkgs/tools/security/cnquery/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "9.11.0";
+  version = "9.12.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     rev = "v${version}";
-    hash = "sha256-3fyX6vz3lqnV07gu/H7qeIrLyNSbqhLpICJWqPTv7T0=";
+    hash = "sha256-d2S9qEm0jvXvpU7IHpurDJ7A21bvjuM3HrdRPaujzTU=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-7zZRX0LWDmO7LA0fIjAh8+5kK2dcAV/4HQmKdn9I3Mg=";
+  vendorHash = "sha256-vEJcdGgev9C/3vGx+SMmD9dLMau5Jyx2TjHiiQQ+16A=";
 
   meta = with lib; {
     description = "cloud-native, graph-based asset inventory";
diff --git a/pkgs/tools/security/kube-bench/default.nix b/pkgs/tools/security/kube-bench/default.nix
index e9094ce7103c..f4cb389eb16e 100644
--- a/pkgs/tools/security/kube-bench/default.nix
+++ b/pkgs/tools/security/kube-bench/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-bench";
-  version = "0.6.19";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-owpmQ/APTUu1V8au2UE48SIIZnVI93tlv5bhkS/2kgQ=";
+    hash = "sha256-yJJEWxz8EWdLi2rhw42QVdG9AcGO0OWnihg153hALNE=";
   };
 
-  vendorHash = "sha256-dBN6Yi8HtS9LzXr08jhw1hqDwS8a4UqrYaRpM+RzvVM=";
+  vendorHash = "sha256-zKw6d3UWs2kb+DCXmLZ09Lw3m8wMhm9QJYkeXJYcFA8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/theharvester/default.nix b/pkgs/tools/security/theharvester/default.nix
index 528003664697..7628e14e3d0f 100644
--- a/pkgs/tools/security/theharvester/default.nix
+++ b/pkgs/tools/security/theharvester/default.nix
@@ -5,16 +5,20 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "theharvester";
-  version = "4.4.4";
-  format = "setuptools";
+  version = "4.5.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "laramies";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-L0WbPZE2alregOvWc+0nuMvsD17ayCw3JtahGhf4B1o=";
+    hash = "sha256-tnCiI4bte2RSWSkEL2rwFz6WFjfRMMFiEBOvv3QMyos=";
   };
 
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     aiodns
     aiofiles
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 48e68c27d62a..e290aca765df 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5099,8 +5099,6 @@ with pkgs;
 
   dibbler = callPackage ../tools/networking/dibbler { };
 
-  didder = callPackage ../tools/graphics/didder { };
-
   dieharder = callPackage ../tools/security/dieharder { };
 
   diesel-cli = callPackage ../development/tools/diesel-cli {
@@ -11592,9 +11590,7 @@ with pkgs;
 
   onlykey = callPackage ../tools/security/onlykey { node_webkit = nwjs; };
 
-  ooniprobe-cli = callPackage ../tools/networking/ooniprobe-cli {
-    buildGoModule = buildGo120Module;
-  };
+  ooniprobe-cli = callPackage ../tools/networking/ooniprobe-cli { };
 
   openapi-generator-cli = callPackage ../tools/networking/openapi-generator-cli { jre = pkgs.jre_headless; };
   openapi-generator-cli-unstable = callPackage ../tools/networking/openapi-generator-cli/unstable.nix { jre = pkgs.jre_headless; };
@@ -24051,7 +24047,7 @@ with pkgs;
 
   minizip-ng = callPackage ../development/libraries/minizip-ng { };
 
-  mkvtoolnix = libsForQt5.callPackage ../applications/video/mkvtoolnix {
+  mkvtoolnix = qt6Packages.callPackage ../applications/video/mkvtoolnix {
     stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
   };
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index f04dc00d0971..08c2592a221e 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1783,6 +1783,8 @@ let
 
     tsort = callPackage ../development/ocaml-modules/tsort { };
 
+    tty = callPackage ../development/ocaml-modules/tty { };
+
     tuntap = callPackage ../development/ocaml-modules/tuntap { };
 
     twt = callPackage ../development/ocaml-modules/twt { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2db81bbe95d8..61307a2df21e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4762,6 +4762,8 @@ self: super: with self; {
 
   googletrans = callPackage ../development/python-modules/googletrans { };
 
+  gotailwind = callPackage ../development/python-modules/gotailwind { };
+
   gotenberg-client = callPackage ../development/python-modules/gotenberg-client { };
 
   gorilla = callPackage ../development/python-modules/gorilla { };
@@ -14475,6 +14477,8 @@ self: super: with self; {
 
   translationstring = callPackage ../development/python-modules/translationstring { };
 
+  translitcodec = callPackage ../development/python-modules/translitcodec { };
+
   transmission-rpc = callPackage ../development/python-modules/transmission-rpc { };
 
   transmissionrpc = callPackage ../development/python-modules/transmissionrpc { };