diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a93255f08673..761806b1b3d3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21545,6 +21545,16 @@
       fingerprint = "DA03 D6C6 3F58 E796 AD26  E99B 366A 2940 479A 06FC";
     }];
   };
+  willbush = {
+    email = "git@willbush.dev";
+    matrix = "@willbush:matrix.org";
+    github = "willbush";
+    githubId = 2023546;
+    name = "Will Bush";
+    keys = [{
+      fingerprint = "4441 422E 61E4 C8F3 EBFE  5E33 3823 864B 54B1 3BDA";
+    }];
+  };
   willcohen = {
     github = "willcohen";
     githubId = 5185341;
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 32d9508e89b1..a3a9980bc58f 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -573,6 +573,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   and `services.kavita.settings.IpAddresses`. The file at `services.kavita.tokenKeyFile` now needs to contain a secret with
   512+ bits instead of 128+ bits.
 
+- `kavita` has been updated to 0.8.0, requiring a manual forced library scan on all libraries for migration. Refer to upstream's [release notes](https://github.com/Kareadita/Kavita/releases/tag/v0.8.0) for details.
+
 - The `krb5` module has been rewritten and moved to `security.krb5`, moving all options but `security.krb5.enable` and `security.krb5.package` into `security.krb5.settings`.
 
 - `services.soju` now has a wrapper for the `sojuctl` command, pointed at the service config file. It also has the new option `adminSocket.enable`, which creates a unix admin socket at `/run/soju/admin`.
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index d8e8dfe1e554..ac5fe0cc16a1 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -17213,5 +17213,17 @@ final: prev:
     meta.homepage = "https://github.com/jhradilek/vim-snippets/";
   };
 
+  gitignore-nvim = buildVimPlugin {
+    pname = "gitignore-nvim";
+    version = "2024-03-25";
+    src = fetchFromGitHub {
+      owner = "wintermute-cell";
+      repo = "gitignore.nvim";
+      rev = "2455191ec94da8ed222806a4fe3aa358eac1e558";
+      sha256 = "sha256-p6k0NP3Vne6Kl98YodzSruVmJwxyrXziJj8N7u79o1w=";
+    };
+    meta.homepage = "https://github.com/wintermute-cell/gitignore.nvim/";
+  };
+
 
 }
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 66e0351298cd..a9b5e4e9c69c 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -338,6 +338,7 @@ https://github.com/f-person/git-blame.nvim/,,
 https://github.com/akinsho/git-conflict.nvim/,HEAD,
 https://github.com/rhysd/git-messenger.vim/,,
 https://github.com/ThePrimeagen/git-worktree.nvim/,,
+https://github.com/wintermute-cell/gitignore.nvim/,HEAD,
 https://github.com/vim-scripts/gitignore.vim/,,
 https://github.com/ruifm/gitlinker.nvim/,,
 https://github.com/lewis6991/gitsigns.nvim/,,
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
index b06922a90c5b..c5ae57e0f63b 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  nodePackages,
+  pyright,
   vscode-utils,
 }:
 
@@ -12,7 +12,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     hash = "sha256-xJU/j5r/Idp/0VorEfciT4SFKRBpMCv9Z0LKO/++1Gk=";
   };
 
-  buildInputs = [ nodePackages.pyright ];
+  buildInputs = [ pyright ];
 
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/ms-python.vscode-pylance/changelog";
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 54697febefe3..df33a2bbe757 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -102,7 +102,14 @@ let
     "flac"
     "libjpeg"
     "libpng"
+  ] ++ lib.optionals (!chromiumVersionAtLeast "124") [
+    # Use the vendored libwebp for M124+ until we figure out how to solve:
+    # Running phase: configurePhase
+    # ERROR Unresolved dependencies.
+    # //third_party/libavif:libavif_enc(//build/toolchain/linux/unbundle:default)
+    #   needs //third_party/libwebp:libwebp_sharpyuv(//build/toolchain/linux/unbundle:default)
     "libwebp"
+  ] ++ [
     "libxslt"
     # "opus"
   ];
@@ -241,6 +248,15 @@ let
       # Partial revert of https://github.com/chromium/chromium/commit/3687976b0c6d36cf4157419a24a39f6770098d61
       # allowing us to use our rustc and our clang.
       ./patches/chromium-121-rust.patch
+    ] ++ lib.optionals (chromiumVersionAtLeast "124" && !chromiumVersionAtLeast "125") [
+      # M124 shipped with broken --ozone-platform-hint flag handling, which we rely on
+      # for our NIXOS_OZONE_WL (wayland) environment variable.
+      # See <https://issues.chromium.org/issues/329678163>.
+      # This is the commit for the fix that landed in M125, which applies clean on M124.
+      (githubPatch {
+        commit = "c7f4c58f896a651eba80ad805ebdb49d19ebdbd4";
+        hash = "sha256-6nYWT2zN+j73xAIXLdGYT2eC71vGnGfiLCB0OwT0CAI=";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 2597d293ac63..d75b5df53032 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -9,15 +9,15 @@
     };
     deps = {
       gn = {
-        hash = "sha256-JvilCnnb4laqwq69fay+IdAujYC1EHD7uWpkF/C8tBw=";
-        rev = "d4f94f9a6c25497b2ce0356bb99a8d202c8c1d32";
+        hash = "sha256-aEL1kIhgPAFqdb174dG093HoLhCJ07O1Kpqfu7r14wQ=";
+        rev = "22581fb46c0c0c9530caa67149ee4dd8811063cf";
         url = "https://gn.googlesource.com/gn";
-        version = "2024-02-19";
+        version = "2024-03-14";
       };
     };
-    hash = "sha256-7H7h621AHPyhFYbaVFO892TtS+SP3Qu7cYUVk3ICL14=";
-    hash_deb_amd64 = "sha256-tNkO1mPZg1xltBfoWeNhLekITtZV/WNgu//i2DJb17c=";
-    version = "123.0.6312.122";
+    hash = "sha256-apEniFKhIxPo4nhp9gCU+WpiV/EB40qif4RfE7Uniog=";
+    hash_deb_amd64 = "sha256-rSbigG5/xbL32d1ntOn6gnZyxSpgrg1h7lb/RD4YROI=";
+    version = "124.0.6367.60";
   };
   ungoogled-chromium = {
     deps = {
diff --git a/pkgs/applications/networking/twingate/default.nix b/pkgs/applications/networking/twingate/default.nix
index c8e218a3fdff..9537ab4c1784 100644
--- a/pkgs/applications/networking/twingate/default.nix
+++ b/pkgs/applications/networking/twingate/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "twingate";
-  version = "2024.63.115357";
+  version = "2024.98.119300";
 
   src = fetchurl {
     url = "https://binaries.twingate.com/client/linux/DEB/x86_64/${version}/twingate-amd64.deb";
-    hash = "sha256-VSm9gnHfo9LPwUvNwLeX7OjqMYgFUgGYSxx/qDndfwo=";
+    hash = "sha256-N0cabYHaF5H1EeriQRQL7bN5UM85oOGrm9pxGr1AlEk=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/office/super-productivity/default.nix b/pkgs/applications/office/super-productivity/default.nix
index eb97565cb760..5a5ff9fc959e 100644
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "super-productivity";
-  version = "8.0.1";
+  version = "8.0.5";
 
   src = fetchurl {
     url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "sha256-BW/4jP4lh3leAcdy3JHET/PUybN+0Cy9wxMSi57dAcw=";
+    sha256 = "sha256-nH7dCrXBhkAYbvb9CPc4zhslFiYtA1ChuYPoHMdBBwQ=";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/science/biology/iqtree/default.nix b/pkgs/applications/science/biology/iqtree/default.nix
index 1f00876b5848..d8e90789f4d5 100644
--- a/pkgs/applications/science/biology/iqtree/default.nix
+++ b/pkgs/applications/science/biology/iqtree/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iqtree";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "iqtree";
     repo = "iqtree2";
     rev = "v${version}";
-    hash = "sha256-GaNumiTGa6mxvFifv730JFgKrRxG41gJN+ci3imDbzs=";
+    hash = "sha256-hAJs48PhIyZSKSRZjQJKQwoJlt6DPRQwaDsuZ00VZII=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/version-management/forgejo/default.nix b/pkgs/applications/version-management/forgejo/default.nix
index 3357309442e9..85613530ba39 100644
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
   pname = "forgejo";
-  version = "1.21.10-0";
+  version = "1.21.11-0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "forgejo";
     rev = "v${version}";
-    hash = "sha256-uCRAT9RiU9S+tP9alNshSQwbUgLmU9wE5HIQ4FPmXVE=";
+    hash = "sha256-Cp+dN4nTIboin42NJR/YUkVXbBC7uufH8EE7NgIVFzY=";
     # Forgejo has multiple different version strings that need to be provided
     # via ldflags.  main.ForgejoVersion for example is a combination of a
     # hardcoded gitea compatibility version string (in the Makefile) and
@@ -65,7 +65,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-pgUSmM2CxYO8DralWoeR2groQxpxo9WtRcToYeaHXGk=";
+  vendorHash = "sha256-OuWNF+muWM6xqwkFxLIUsn/huqXj2VKg8BN9+JHVw58=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/video/anilibria-winmaclinux/default.nix b/pkgs/applications/video/anilibria-winmaclinux/default.nix
index 522c37f3a625..818e3a8e1505 100644
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@@ -18,13 +18,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "1.2.16.1";
+  version = "1.2.16.2";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-QQliz/tLeYsWgh/ZAO7FfbApAEqWhWoaQe9030QZxA8=";
+    hash = "sha256-IgNYJSadGemjclh7rtY8dHz7uSfBHoWEyLlRoZ+st6k=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 3c553f181f0d..5ca5bc3f5eb3 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -8,7 +8,8 @@
 { name ? ""
 , lib
 , stdenvNoCC
-, bintools ? null, libc ? null, coreutils ? null, shell ? stdenvNoCC.shell, gnugrep ? null
+, runtimeShell
+, bintools ? null, libc ? null, coreutils ? null, gnugrep ? null
 , netbsd ? null, netbsdCross ? null
 , sharedLibraryLoader ?
   if libc == null then
@@ -28,7 +29,7 @@
 , isGNU ? bintools.isGNU or false
 , isLLVM ? bintools.isLLVM or false
 , isCCTools ? bintools.isCCTools or false
-, buildPackages ? {}
+, expand-response-params
 , targetPackages ? {}
 , useMacosReexportHack ? false
 , wrapGas ? false
@@ -131,10 +132,6 @@ let
     else if hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
     else "";
 
-  expand-response-params =
-    optionalString (buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null")
-    (import ../expand-response-params { inherit (buildPackages) stdenv; });
-
 in
 
 stdenvNoCC.mkDerivation {
@@ -418,8 +415,10 @@ stdenvNoCC.mkDerivation {
 
   env = {
     # for substitution in utils.bash
+    # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
-    shell = getBin shell + shell.shellPath or "";
+    # TODO(@sternenseemann): rename env var via stdenv rebuild
+    shell = (getBin runtimeShell + runtimeShell.shellPath or "");
     gnugrep_bin = optionalString (!nativeTools) gnugrep;
     wrapperName = "BINTOOLS_WRAPPER";
     inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 11ae9868ce01..4adc1dcb1f8d 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -8,14 +8,15 @@
 { name ? ""
 , lib
 , stdenvNoCC
-, cc ? null, libc ? null, bintools, coreutils ? null, shell ? stdenvNoCC.shell
+, runtimeShell
+, cc ? null, libc ? null, bintools, coreutils ? null
 , zlib ? null
 , nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
 , propagateDoc ? cc != null && cc ? man
 , extraTools ? [], extraPackages ? [], extraBuildCommands ? ""
 , nixSupport ? {}
 , isGNU ? false, isClang ? cc.isClang or false, isCcache ? cc.isCcache or false, gnugrep ? null
-, buildPackages ? {}
+, expand-response-params
 , libcxx ? null
 
 # Whether or not to add `-B` and `-L` to `nix-support/cc-{c,ld}flags`
@@ -112,9 +113,6 @@ let
   # unstable implementation detail, however.
   suffixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
 
-  expand-response-params =
-    optionalString ((buildPackages.stdenv.hasCC or false) && buildPackages.stdenv.cc != "/dev/null") (import ../expand-response-params { inherit (buildPackages) stdenv; });
-
   useGccForLibs = useCcForLibs
     && libcxx == null
     && !targetPlatform.isDarwin
@@ -297,6 +295,9 @@ stdenvNoCC.mkDerivation {
         '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
 
+    # Expose expand-response-params we are /actually/ using. In stdenv
+    # bootstrapping, expand-response-params usually comes from an earlier stage,
+    # so it is important to expose this for reference checking.
     inherit expand-response-params;
 
     inherit nixSupport;
@@ -738,8 +739,10 @@ stdenvNoCC.mkDerivation {
     inherit isClang;
 
     # for substitution in utils.bash
+    # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
-    shell = getBin shell + shell.shellPath or "";
+    # TODO(@sternenseemann): rename env var via stdenv rebuild
+    shell = getBin runtimeShell + runtimeShell.shellPath or "";
     gnugrep_bin = optionalString (!nativeTools) gnugrep;
     # stdenv.cc.cc should not be null and we have nothing better for now.
     # if the native impure bootstrap is gotten rid of this can become `inherit cc;` again.
diff --git a/pkgs/build-support/expand-response-params/default.nix b/pkgs/build-support/expand-response-params/default.nix
index 7ce15e98c8d9..6868ab97d896 100644
--- a/pkgs/build-support/expand-response-params/default.nix
+++ b/pkgs/build-support/expand-response-params/default.nix
@@ -1,4 +1,4 @@
-{ stdenv }:
+{ stdenv, lib }:
 
 # A "response file" is a sequence of arguments that is passed via a
 # file, rather than via argv[].
@@ -25,4 +25,18 @@ stdenv.mkDerivation {
     mkdir -p $prefix/bin
     mv expand-response-params $prefix/bin/
   '';
+
+  meta = {
+    description = "Internal tool used by the nixpkgs wrapper scripts for processing response files";
+    longDescription = ''
+      expand-response-params is a tool that allows for obtaining a full list of all
+      arguments passed in a given compiler command line including those passed via
+      so-called response files. The nixpkgs wrapper scripts for bintools and C
+      compilers use it for processing compiler flags. As it is developed in
+      conjunction with the nixpkgs wrapper scripts, it should be considered as
+      unstable and subject to change.
+    '';
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
 }
diff --git a/pkgs/by-name/ap/api-linter/package.nix b/pkgs/by-name/ap/api-linter/package.nix
index 554c470fe3e5..c3501889915d 100644
--- a/pkgs/by-name/ap/api-linter/package.nix
+++ b/pkgs/by-name/ap/api-linter/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "1.65.0";
+  version = "1.65.1";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     rev = "v${version}";
-    hash = "sha256-j5xvFg7C74sVjISZMWgURVHnJM6HBZtr90b0UXbGbdg=";
+    hash = "sha256-YGawN0mAJHfWkre+0tunPM/psd9aBWtSVsJoar0WVwY=";
   };
 
-  vendorHash = "sha256-Bz7+4iVR2X36vt6wx3nIgWmVL+i9ncwdzYP9tBEpplk=";
+  vendorHash = "sha256-CsOnHHq3UjNWjfMy1TjXy20B0Bni6Fr3ZMJGvU7QDFA=";
 
   subPackages = [ "cmd/api-linter" ];
 
diff --git a/pkgs/by-name/co/codeium/package.nix b/pkgs/by-name/co/codeium/package.nix
index 437df8439ed3..2c0dd84cbbcd 100644
--- a/pkgs/by-name/co/codeium/package.nix
+++ b/pkgs/by-name/co/codeium/package.nix
@@ -13,10 +13,10 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-AHjR6lHszYqZ2yC/uY2DmB67xMUFZliqI29Ptes2SoY=";
-    aarch64-linux = "sha256-2NYlec6gpVMJwZctEqwn5rQiTrb5PmaxEz3lQxF1qmk=";
-    x86_64-darwin = "sha256-OeMbO2lDK6XUF3ht+09ZWOL7UsEEVTrKyXOfhny8DhM=";
-    aarch64-darwin = "sha256-4CQvJkd3kI7XJz46QsSUBtWLmxDu7AcAJwRS3amv0SM=";
+    x86_64-linux = "sha256-6sIYDI6+1/p54Af+E/GmRAFlfDYJVwxhn0qF47ZH+Zg=";
+    aarch64-linux = "sha256-1ImcjAqCZm5KZZYHWhG1eO7ipAdrP4Qjj2eBxTst++s=";
+    x86_64-darwin = "sha256-yHthItxZYFejJlwJJ7BrM2csnLsZXjy/IbzF1iaCCyI=";
+    aarch64-darwin = "sha256-GIx0yABISj/rH/yVkkx6NBs5qF0P8nhpMyvnzXJ92mA=";
   }.${system} or throwSystem;
 
   bin = "$out/bin/codeium_language_server";
@@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "codeium";
-  version = "1.8.22";
+  version = "1.8.25";
   src = fetchurl {
     name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
     url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
diff --git a/pkgs/by-name/ig/igir/package.nix b/pkgs/by-name/ig/igir/package.nix
index 488febb21a59..820d843dc0ed 100644
--- a/pkgs/by-name/ig/igir/package.nix
+++ b/pkgs/by-name/ig/igir/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "igir";
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchFromGitHub {
     owner = "emmercm";
     repo = "igir";
     rev = "v${version}";
-    hash = "sha256-bJPUGB9fyeOb5W9EzQldh4rRJQBat58MgjjfS1qh66w=";
+    hash = "sha256-0WA+7qw5ZuELHc8P0yizV+kEwSmoUBmgReM8ZosGnqs=";
   };
 
-  npmDepsHash = "sha256-q8gpx5zwiO/7ZBB/YruhCUgukp71sfJju8nmF6SwTrc=";
+  npmDepsHash = "sha256-UfTq7/da1V9ubHh2wGvktP/SiWfyL8yF9iuCOq8Hxwg=";
 
   # I have no clue why I have to do this
   postPatch = ''
diff --git a/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix b/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix
new file mode 100644
index 000000000000..34ec710a9b45
--- /dev/null
+++ b/pkgs/by-name/ka/katawa-shoujo-re-engineered/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitea,
+  makeDesktopItem,
+  copyDesktopItems,
+  makeWrapper,
+  renpy,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "katawa-shoujo-re-engineered";
+  version = "1.4.4";
+
+  src = fetchFromGitea {
+    # GitHub mirror at fleetingheart/ksre
+    domain = "codeberg.org";
+    owner = "fhs";
+    repo = "katawa-shoujo-re-engineered";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-RYJM/wGVWqIRZzHLUtUZ5mKUrUftDVaOwS1f/EpW6Tk=";
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "katawa-shoujo-re-engineered";
+      desktopName = "Katawa Shoujo: Re-Engineered";
+      type = "Application";
+      icon = finalAttrs.meta.mainProgram;
+      categories = [ "Game" ];
+      exec = finalAttrs.meta.mainProgram;
+    })
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    makeWrapper ${lib.getExe' renpy "renpy"} $out/bin/${finalAttrs.meta.mainProgram} \
+      --add-flags ${finalAttrs.src} --add-flags run
+    install -D $src/web-icon.png $out/share/icons/hicolor/512x512/apps/${finalAttrs.meta.mainProgram}.png
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A fan-made modernization of the classic visual novel Katawa Shoujo";
+    homepage = "https://www.fhs.sh/projects";
+    license = with lib.licenses; [
+      # code
+      mpl20
+      # assets from the original game
+      cc-by-nc-nd-30
+    ];
+    mainProgram = "katawa-shoujo-re-engineered";
+    maintainers = with lib.maintainers; [ quantenzitrone ];
+    platforms = renpy.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/li/livekit/package.nix b/pkgs/by-name/li/livekit/package.nix
index 40706a679c2d..b362366e51f6 100644
--- a/pkgs/by-name/li/livekit/package.nix
+++ b/pkgs/by-name/li/livekit/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "livekit";
-  version = "1.5.3";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "livekit";
     rev = "v${version}";
-    hash = "sha256-2MooX+wy7KetxEBgQoVoL4GuVkm+SbTzYgfWyLL7KU8=";
+    hash = "sha256-tgoVHRv8hnDkjFYShZ/3lieknhIobHv27RVvQOCtEWU=";
   };
 
-  vendorHash = "sha256-8YR0Bl+sQsqpFtD+1GeYaydBdHeM0rRL2NbgAh9kCj0=";
+  vendorHash = "sha256-TZ435gu5naFi/JLz6B/1fpvGA3diJp4JIWL1zgNlb4Q=";
 
   subPackages = [ "cmd/server" ];
 
diff --git a/pkgs/by-name/mc/mcap-cli/package.nix b/pkgs/by-name/mc/mcap-cli/package.nix
index 80ddcd574b02..8f4fd9d7406c 100644
--- a/pkgs/by-name/mc/mcap-cli/package.nix
+++ b/pkgs/by-name/mc/mcap-cli/package.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitHub, nix-update-script
 }:
 let
-  version = "0.0.42";
+  version = "0.0.43";
 in
 buildGoModule {
 
@@ -13,10 +13,10 @@ buildGoModule {
     repo = "mcap";
     owner = "foxglove";
     rev = "releases/mcap-cli/v${version}";
-    hash = "sha256-9fjzMUMWn5j8AJJq+tK+Hq0o8d3HpacitJZ5CfLiaLw=";
+    hash = "sha256-AWmPqymnNZxKbhxiQOO9djQXbP56mNh9Ucmty2jd+4Q=";
   };
 
-  vendorHash = "sha256-Gl0zLBTWscKGtVOS6rPRL/r8KHYHpZwoUDbEyCL4Ijk=";
+  vendorHash = "sha256-YFbfrqu2H7yU6vANH56MnxipDxaJLT76qZkvqLCFTTg=";
 
   modRoot = "go/cli/mcap";
 
diff --git a/pkgs/by-name/ne/nezha-agent/package.nix b/pkgs/by-name/ne/nezha-agent/package.nix
index c10feadd32a5..228810059921 100644
--- a/pkgs/by-name/ne/nezha-agent/package.nix
+++ b/pkgs/by-name/ne/nezha-agent/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "nezha-agent";
-  version = "0.16.4";
+  version = "0.16.5";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-xXv2FVPsl8BR51VMrFreaS3UQLEJwfObY4OeMMb8pms=";
+    hash = "sha256-WRHYI3/6qrVZRa4ANA6VBBJCaINP1N8Xjy0GWO4LqgA=";
   };
 
-  vendorHash = "sha256-ZlheRFgl3vsUXVx8PKZQ59kme2NC31OQAL6EaNhbf70=";
+  vendorHash = "sha256-AtcRfvYBgTZJz9dpsMgacnV8RNi2Ph7QgUrcE6zzTo8=";
 
   ldflags = [
     "-s"
@@ -40,6 +40,6 @@ buildGoModule rec {
     description = "Agent of Nezha Monitoring";
     homepage = "https://github.com/nezhahq/agent";
     license = licenses.asl20;
-    maintainers = with maintainers; [moraxyc];
+    maintainers = with maintainers; [ moraxyc ];
   };
 }
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 8d78e22a0c42..2d1c40e09cdf 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.1.6";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     rev = "v${version}";
-    hash = "sha256-NOPzznopH+PeSEMzO1vMHOSbmy9/v2yT4VC4kAsdbGw";
+    hash = "sha256-AAgkxBbGH45n140jm28+J3hqYxzUIL6IVLGWD9oBexo=";
   };
 
   vendorHash = "sha256-fP6yxfIQoVaBC9hYcrCyo3YP3ntEVDbDTwKMO9TdyDI=";
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index efd92a5da7e5..3537d60cbbfe 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton9-2";
+  version = "GE-Proton9-4";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-NqBzKonCYH+hNpVZzDhrVf+r2i6EwLG/IFBXjE2mC7s=";
+    hash = "sha256-OR4SUqm5Xsycv/KVBW2Ug/lz4Xr6IQBp8gXacorRe3U=";
   };
 
   outputs = [ "out" "steamcompattool" ];
diff --git a/pkgs/by-name/py/pyright/package-lock.json b/pkgs/by-name/py/pyright/package-lock.json
new file mode 100644
index 000000000000..dee0ab51a521
--- /dev/null
+++ b/pkgs/by-name/py/pyright/package-lock.json
@@ -0,0 +1,193 @@
+{
+  "name": "pyright-root",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pyright-root",
+      "hasInstallScript": true,
+      "dependencies": {
+        "glob": "^7.2.3",
+        "jsonc-parser": "^3.2.1"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "node_modules/jsonc-parser": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.1.tgz",
+      "integrity": "sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA=="
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  },
+  "dependencies": {
+    "balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "requires": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+    },
+    "fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+    },
+    "glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "requires": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      }
+    },
+    "inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "requires": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "jsonc-parser": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.1.tgz",
+      "integrity": "sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA=="
+    },
+    "minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "requires": {
+        "brace-expansion": "^1.1.7"
+      }
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg=="
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  }
+}
diff --git a/pkgs/by-name/py/pyright/package.nix b/pkgs/by-name/py/pyright/package.nix
new file mode 100644
index 000000000000..3e264bc20e81
--- /dev/null
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -0,0 +1,75 @@
+{ lib, buildNpmPackage, fetchFromGitHub, runCommand, jq }:
+
+let
+  version = "1.1.359";
+
+  src = fetchFromGitHub {
+    owner = "Microsoft";
+    repo = "pyright";
+    rev = "${version}";
+    hash = "sha256-gqMAfmYjYO6D9sRu+uJv4yJ/+csioFAwsUPBDF29VDs=";
+  };
+
+  patchedPackageJSON = runCommand "package.json" { } ''
+    ${jq}/bin/jq '
+      .devDependencies |= with_entries(select(.key == "glob" or .key == "jsonc-parser"))
+      | .scripts =  {  }
+      ' ${src}/package.json > $out
+  '';
+
+  pyright-root = buildNpmPackage {
+    pname = "pyright-root";
+    inherit version src;
+    npmDepsHash = "sha256-63kUhKrxtJhwGCRBnxBfOFXs2ARCNn+OOGu6+fSJey4=";
+    dontNpmBuild = true;
+    postPatch = ''
+      cp ${patchedPackageJSON} ./package.json
+      cp ${./package-lock.json} ./package-lock.json
+    '';
+    installPhase = ''
+      runHook preInstall
+      cp -r . "$out"
+      runHook postInstall
+    '';
+  };
+
+  pyright-internal = buildNpmPackage {
+    pname = "pyright-internal";
+    inherit version src;
+    sourceRoot = "${src.name}/packages/pyright-internal";
+    npmDepsHash = "sha256-p2KamNFJ3sJHmJm0MEPhI8L/8zAVzfc9NYy24rAdFcQ=";
+    dontNpmBuild = true;
+    installPhase = ''
+      runHook preInstall
+      cp -r . "$out"
+      runHook postInstall
+    '';
+  };
+in
+buildNpmPackage rec {
+  pname = "pyright";
+  inherit version src;
+
+  sourceRoot = "${src.name}/packages/pyright";
+  npmDepsHash = "sha256-U7WdMIYg9U4fJ8YtDruMzloRS2BQAa2QWExle9uwPbU=";
+
+  postPatch = ''
+    chmod +w ../../
+    ln -s ${pyright-root}/node_modules ../../node_modules
+    chmod +w ../pyright-internal
+    ln -s ${pyright-internal}/node_modules ../pyright-internal/node_modules
+  '';
+
+  dontNpmBuild = true;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    changelog = "https://github.com/Microsoft/pyright/releases/tag/${version}";
+    description = "Type checker for the Python language";
+    homepage = "https://github.com/Microsoft/pyright";
+    license = lib.licenses.mit;
+    mainProgram = "pyright";
+    maintainers = with lib.maintainers; [ kalekseev ];
+  };
+}
diff --git a/pkgs/by-name/py/pyright/update.sh b/pkgs/by-name/py/pyright/update.sh
new file mode 100755
index 000000000000..b0a2b2a11184
--- /dev/null
+++ b/pkgs/by-name/py/pyright/update.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused common-updater-scripts jq prefetch-npm-deps
+set -euo pipefail
+
+version=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s https://api.github.com/repos/microsoft/pyright/releases/latest | jq -r '.tag_name | sub("^v"; "")')
+
+update-source-version pyright "$version"
+
+root="$(dirname "$(readlink -f "$0")")"
+FILE_PATH="$root/package.nix"
+REPO_URL_PREFIX="https://github.com/microsoft/pyright/raw"
+TEMP_DIR=$(mktemp -d)
+
+trap 'rm -rf "$TEMP_DIR"' EXIT
+
+# Function to download `package-lock.json` for a given source path and update hash
+update_hash() {
+    local source_root_path="$1"
+    local existing_hash="$2"
+
+    # Formulate download URL
+    local download_url="${REPO_URL_PREFIX}/${version}${source_root_path}/package-lock.json"
+
+    # Download package-lock.json to temporary directory
+    curl -fsSL -o "${TEMP_DIR}/package-lock.json" "$download_url"
+
+    # Calculate the new hash
+    local new_hash
+    new_hash=$(prefetch-npm-deps "${TEMP_DIR}/package-lock.json")
+
+    # Update npmDepsHash in the original file
+    sed -i "s|$existing_hash|${new_hash}|" "$FILE_PATH"
+}
+
+while IFS= read -r source_root_line; do
+    [[ "$source_root_line" =~ sourceRoot ]] || continue
+    source_root_path=$(echo "$source_root_line" | sed -e 's/^.*"${src.name}\(.*\)";.*$/\1/')
+
+    # Extract the current npmDepsHash for this sourceRoot
+    existing_hash=$(grep -A1 "$source_root_line" "$FILE_PATH" | grep 'npmDepsHash' | sed -e 's/^.*npmDepsHash = "\(.*\)";$/\1/')
+
+    # Call the function to download and update the hash
+    update_hash "$source_root_path" "$existing_hash"
+done < "$FILE_PATH"
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index 8128b434ddb0..5e6faa4316ba 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.9.3";
+  version = "3.9.4";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-VTgBwpE5b/OgM7kkzZijmj9H4d8jy0HNMGl5tfmBe4E=";
+    hash = "sha256-ez4D+czYDhs/GNrjRF8Bx999JRW0EigMxc39fOH54V8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ri/rippkgs/package.nix b/pkgs/by-name/ri/rippkgs/package.nix
new file mode 100644
index 000000000000..ef985a970d7f
--- /dev/null
+++ b/pkgs/by-name/ri/rippkgs/package.nix
@@ -0,0 +1,36 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, sqlite
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rippkgs";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "replit";
+    repo = "rippkgs";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qQZnD9meczfsQv1R68IiUfPq730I2IyesurrOhtA3es=";
+  };
+
+  cargoHash = "sha256-hGSHgJ2HVCNqTBsTQIZlSE89FKqdMifuJyAGl3utF2I=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    sqlite
+  ];
+
+  meta = {
+    description = "A CLI for indexing and searching packages in Nix expressions";
+    homepage = "https://github.com/replit/rippkgs";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ eclairevoyant ];
+    mainProgram = "rippkgs";
+  };
+}
diff --git a/pkgs/by-name/sn/snapcraft/lxd-socket-path.patch b/pkgs/by-name/sn/snapcraft/lxd-socket-path.patch
new file mode 100644
index 000000000000..4219fcbfa7d4
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/lxd-socket-path.patch
@@ -0,0 +1,13 @@
+diff --git a/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py b/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
+index 5fa4f898..41264ebb 100644
+--- a/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
++++ b/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
+@@ -142,7 +142,7 @@ class LXD(Provider):
+             build_provider_flags=build_provider_flags,
+         )
+         # This endpoint is hardcoded everywhere lxc/lxd-pkg-snap#33
+-        lxd_socket_path = "/var/snap/lxd/common/lxd/unix.socket"
++        lxd_socket_path = "/var/lib/lxd/unix.socket"
+         endpoint = "http+unix://{}".format(urllib.parse.quote(lxd_socket_path, safe=""))
+         try:
+             self._lxd_client: pylxd.Client = pylxd.Client(endpoint=endpoint)
diff --git a/pkgs/by-name/sn/snapcraft/os-platform.patch b/pkgs/by-name/sn/snapcraft/os-platform.patch
new file mode 100644
index 000000000000..0b441ec8d4bc
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/os-platform.patch
@@ -0,0 +1,21 @@
+diff --git a/snapcraft/utils.py b/snapcraft/utils.py
+index 511effe2..4af5a029 100644
+--- a/snapcraft/utils.py
++++ b/snapcraft/utils.py
+@@ -15,6 +15,7 @@
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
+ """Utilities for snapcraft."""
++
+ import multiprocessing
+ import os
+ import pathlib
+@@ -91,7 +92,7 @@ def get_os_platform(
+     release = platform.release()
+     machine = platform.machine()
+ 
+-    if system == "Linux":
++    if system == "Linux" and "NixOS" not in platform.version():
+         try:
+             with filepath.open("rt", encoding="utf-8") as release_file:
+                 lines = release_file.readlines()
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
new file mode 100644
index 000000000000..57e16a1a138c
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -0,0 +1,188 @@
+{
+  fetchFromGitHub,
+  git,
+  glibc,
+  lib,
+  makeWrapper,
+  nix-update-script,
+  python3Packages,
+  squashfsTools,
+  stdenv,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "snapcraft";
+  version = "8.2.0";
+
+  pyproject = true;
+
+  # Somewhere deep in the dependency tree is 'versioningit', which depends
+  # on pydantic 2. Snapcraft will soon migrate to pydantic 2, and disabling
+  # this doesn't seem to affect the functionality of the application.
+  catchConflicts = false;
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "snapcraft";
+    rev = "refs/tags/${version}";
+    hash = "sha256-uRapRL+492FOju83o3OBsYK52hwOOG6b4EbdMVpAlBs=";
+  };
+
+  patches = [
+    # Snapcraft is only officially distributed as a snap, as is LXD. The socket
+    # path for LXD must be adjusted so that it's at the correct location for LXD
+    # on NixOS. This patch will likely never be accepted upstream.
+    ./lxd-socket-path.patch
+    # In certain places, Snapcraft expects an /etc/os-release file to determine
+    # host info which doesn't exist in our test environment. This is a
+    # relatively naive patch which helps the test suite pass - without it *many*
+    # of the tests fail. This patch will likely never be accepted upstream.
+    ./os-platform.patch
+    # Snapcraft will try to inject itself as a snap *from the host system* into
+    # the build system. This patch short-circuits that logic and ensures that
+    # Snapcraft is installed on the build system from the snap store - because
+    # there is no snapd on NixOS hosts that can be used for the injection. This
+    # patch will likely never be accepted upstream.
+    ./set-channel-for-nix.patch
+    # Certain paths (for extensions, schemas) are packaged in the snap by the
+    # upstream, so the paths are well-known, except here where Snapcraft is
+    # *not* in a snap, so this patch changes those paths to point to the correct
+    # place in the Nix store. This patch will likely never be accepted upstream.
+    ./snapcraft-data-dirs.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail 'version=determine_version()' 'version="${version}"' \
+      --replace-fail 'gnupg' 'python-gnupg'
+
+    substituteInPlace requirements.txt \
+      --replace-fail 'gnupg==2.3.1' 'python-gnupg'
+
+    substituteInPlace snapcraft/__init__.py \
+      --replace-fail '__version__ = _get_version()' '__version__ = "${version}"'
+
+    substituteInPlace snapcraft_legacy/__init__.py \
+      --replace-fail '__version__ = _get_version()' '__version__ = "${version}"'
+
+    substituteInPlace snapcraft/elf/elf_utils.py \
+      --replace-fail 'arch_linker_path = Path(arch_config.dynamic_linker)' \
+      'return str(Path("${glibc}/lib/ld-linux-x86-64.so.2"))'
+  '';
+
+  buildInputs = [ makeWrapper ];
+
+  propagatedBuildInputs = with python3Packages; [
+    attrs
+    catkin-pkg
+    click
+    craft-application
+    craft-archives
+    craft-cli
+    craft-grammar
+    craft-parts
+    craft-providers
+    craft-store
+    debian
+    docutils
+    jsonschema
+    launchpadlib
+    lazr-restfulclient
+    lxml
+    macaroonbakery
+    mypy-extensions
+    progressbar
+    pyelftools
+    pygit2
+    pylxd
+    python-apt
+    python-gnupg
+    raven
+    requests-toolbelt
+    simplejson
+    snap-helpers
+    tabulate
+    tinydb
+  ];
+
+  nativeBuildInputs = with python3Packages; [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "docutils"
+    "jsonschema"
+    "pygit2"
+    "urllib3"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/snapcraft --prefix PATH : ${squashfsTools}/bin
+  '';
+
+  nativeCheckInputs = with python3Packages; [
+    pytest-check
+    pytest-cov
+    pytest-mock
+    pytest-subprocess
+    pytestCheckHook
+    responses
+  ] ++ [
+    git
+    squashfsTools
+  ];
+
+  preCheck = ''
+    mkdir -p check-phase
+    export HOME="$(pwd)/check-phase"
+  '';
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  disabledTests = [
+    "test_bin_echo"
+    "test_classic_linter_filter"
+    "test_classic_linter"
+    "test_complex_snap_yaml"
+    "test_get_base_configuration_snap_channel"
+    "test_get_base_configuration_snap_instance_name_default"
+    "test_get_base_configuration_snap_instance_name_not_running_as_snap"
+    "test_get_extensions_data_dir"
+    "test_get_os_platform_alternative_formats"
+    "test_get_os_platform_linux"
+    "test_get_os_platform_windows"
+    "test_lifecycle_pack_components_with_output"
+    "test_lifecycle_pack_components"
+    "test_lifecycle_write_component_metadata"
+    "test_parse_info_integrated"
+    "test_patch_elf"
+    "test_remote_builder_init"
+    "test_setup_assets_remote_icon"
+    "test_snap_command_fallback"
+    "test_validate_architectures_supported"
+    "test_validate_architectures_unsupported"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    "test_load_project"
+  ];
+
+  disabledTestPaths = [
+    "tests/unit/commands/test_remote.py"
+    "tests/unit/elf"
+    "tests/unit/linters/test_classic_linter.py"
+    "tests/unit/linters/test_library_linter.py"
+    "tests/unit/parts/test_parts.py"
+    "tests/unit/services"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    mainProgram = "snapcraft";
+    description = "Build and publish Snap packages";
+    homepage = "https://github.com/canonical/snapcraft";
+    changelog = "https://github.com/canonical/snapcraft/releases/tag/${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch b/pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch
new file mode 100644
index 000000000000..b90f0b4e1df2
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch
@@ -0,0 +1,30 @@
+diff --git a/snapcraft/providers.py b/snapcraft/providers.py
+index a999537a..dcd290a7 100644
+--- a/snapcraft/providers.py
++++ b/snapcraft/providers.py
+@@ -21,6 +21,7 @@ import sys
+ from pathlib import Path
+ from textwrap import dedent
+ from typing import Dict, Optional
++import platform
+ 
+ from craft_cli import emit
+ from craft_providers import Provider, ProviderError, bases, executor
+@@ -178,14 +179,14 @@ def get_base_configuration(
+     # injecting a snap on a non-linux system is not supported, so default to
+     # install snapcraft from the store's stable channel
+     snap_channel = get_managed_environment_snap_channel()
+-    if sys.platform != "linux" and not snap_channel:
++    if snap_channel is None and (sys.platform != "linux" or "NixOS" in platform.version()):
+         emit.progress(
+-            "Using snapcraft from snap store channel 'latest/stable' in instance "
++            "Using snapcraft from snap store channel 'latest/beta' in instance "
+             "because snap injection is only supported on Linux hosts.",
+             permanent=True,
+         )
+         snap_name = "snapcraft"
+-        snap_channel = "stable"
++        snap_channel = "beta"
+     elif is_snapcraft_running_from_snap():
+         # Use SNAP_INSTANCE_NAME for snapcraft's snap name, as it may not be
+         # 'snapcraft' if the '--name' parameter was used to install snapcraft.
diff --git a/pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch b/pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch
new file mode 100644
index 000000000000..1dc4ef6cdcdf
--- /dev/null
+++ b/pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch
@@ -0,0 +1,26 @@
+diff --git a/snapcraft_legacy/internal/common.py b/snapcraft_legacy/internal/common.py
+index 6017b405..aacd99a5 100644
+--- a/snapcraft_legacy/internal/common.py
++++ b/snapcraft_legacy/internal/common.py
+@@ -34,14 +34,17 @@ from snaphelpers import SnapConfigOptions, SnapCtlError
+ 
+ from snapcraft_legacy.internal import errors
+ 
++# Get the path to the Nix store entry for Snapcraft at runtime
++drv = os.path.realpath(__file__).split("/")[3]
++
+ SNAPCRAFT_FILES = ["parts", "stage", "prime"]
+-_DEFAULT_PLUGINDIR = os.path.join(sys.prefix, "share", "snapcraft", "plugins")
++_DEFAULT_PLUGINDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "plugins")
+ _plugindir = _DEFAULT_PLUGINDIR
+-_DEFAULT_SCHEMADIR = os.path.join(sys.prefix, "share", "snapcraft", "schema")
++_DEFAULT_SCHEMADIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "schema")
+ _schemadir = _DEFAULT_SCHEMADIR
+-_DEFAULT_EXTENSIONSDIR = os.path.join(sys.prefix, "share", "snapcraft", "extensions")
++_DEFAULT_EXTENSIONSDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "extensions")
+ _extensionsdir = _DEFAULT_EXTENSIONSDIR
+-_DEFAULT_KEYRINGSDIR = os.path.join(sys.prefix, "share", "snapcraft", "keyrings")
++_DEFAULT_KEYRINGSDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "keyrings")
+ _keyringsdir = _DEFAULT_KEYRINGSDIR
+ 
+ _DOCKERENV_FILE = "/.dockerenv"
diff --git a/pkgs/by-name/ss/ssimulacra2/package.nix b/pkgs/by-name/ss/ssimulacra2/package.nix
new file mode 100644
index 000000000000..9e9992f6d936
--- /dev/null
+++ b/pkgs/by-name/ss/ssimulacra2/package.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, ninja
+, cmake
+, libpng
+, libhwy
+, lcms2
+, giflib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ssimulacra2";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "cloudinary";
+    repo = "ssimulacra2";
+    hash = "sha256-gOo8WCWMdXOSmny0mQSzCvHgURQTCNBFD4G4sxfmXik=";
+    rev = "tags/v${finalAttrs.version}";
+  };
+
+  nativeBuildInputs = [
+    ninja
+    cmake
+  ];
+
+  buildInputs = [
+    libpng
+    libhwy
+    lcms2
+    giflib
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  installPhase = ''
+    runHook preInstall
+    install -m 755 -D ssimulacra2 -t $out/bin/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/cloudinary/ssimulacra2";
+    maintainers = [ maintainers.viraptor ];
+    license = licenses.bsd3;
+    description = "Perceptual image comparison tool";
+  };
+})
diff --git a/pkgs/by-name/sy/symfony-cli/package.nix b/pkgs/by-name/sy/symfony-cli/package.nix
index 470a6eaa6cd6..9931e4f59089 100644
--- a/pkgs/by-name/sy/symfony-cli/package.nix
+++ b/pkgs/by-name/sy/symfony-cli/package.nix
@@ -10,14 +10,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.8.14";
-  vendorHash = "sha256-OBXurPjyB2/JCQBna+tk0p3+n8gPoNLXCppXkII3ZUc=";
+  version = "5.8.15";
+  vendorHash = "sha256-rkvQhZSoKZIl/gFgekLUelem2FGbRL9gp1LEzYN88Dc=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    hash = "sha256-rwcULDbdYHZ1yFrGEGsJOZQG7Z29m0MOd79yalFIdkQ=";
+    hash = "sha256-HbBg2oCsogY3X4jgjknqwNe2bszXjylvE+h5/iyg2pM=";
   };
 
   ldflags = [
diff --git a/pkgs/data/fonts/nasin-nanpa/default.nix b/pkgs/data/fonts/nasin-nanpa/default.nix
index cd05c667a248..339c89dd9b0b 100644
--- a/pkgs/data/fonts/nasin-nanpa/default.nix
+++ b/pkgs/data/fonts/nasin-nanpa/default.nix
@@ -2,29 +2,18 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nasin-nanpa";
-  version = "2.5.1";
+  version = "3.1.0";
 
-  srcs = [
-    (fetchurl {
-      name = "nasin-nanpa.otf";
-      url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}.otf";
-      hash = "sha256-++uOrqFzQ6CB/OPEmBivpjMfAtFk3PSsCNpFBjOtGEg=";
-    })
-    (fetchurl {
-      name = "nasin-nanpa-lasina-kin.otf";
-      url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}-lasina-kin.otf";
-      hash = "sha256-4WIX74y2O4NaKi/JQrgTbOxlKDQKJ/F9wkQuoOdWuTI=";
-    })
-  ];
+  src = fetchurl {
+    url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}.otf";
+    hash = "sha256-remTvvOt7kpvTdq9H8tFI2yU+BtqePXlDDLQv/jtETU=";
+  };
 
   dontUnpack = true;
 
   installPhase = ''
     mkdir -p $out/share/fonts/opentype
-    for src in $srcs; do
-        file=$(stripHash $src)
-        cp $src $out/share/fonts/opentype/$file
-    done
+    cp $src $out/share/fonts/opentype/nasin-nanpa.otf
   '';
 
   meta = with lib; {
diff --git a/pkgs/data/themes/orchis-theme/default.nix b/pkgs/data/themes/orchis-theme/default.nix
index 100599b34c3c..75bdf7b07aa9 100644
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@@ -26,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 stdenvNoCC.mkDerivation
 rec {
   inherit pname;
-  version = "2024-04-01";
+  version = "2024-04-18";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    hash = "sha256-gszyUZGWlgrBTQnaz6Ws7jzfTN5KAfX5SjVwmVrP9QE=";
+    hash = "sha256-Kvafbvw1q8F0+l47WshFHPfZEQhFXPPXuI0RjBJnP4s=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
diff --git a/pkgs/development/cuda-modules/backend-stdenv.nix b/pkgs/development/cuda-modules/backend-stdenv.nix
index 5d1c0c735806..57219ad607c0 100644
--- a/pkgs/development/cuda-modules/backend-stdenv.nix
+++ b/pkgs/development/cuda-modules/backend-stdenv.nix
@@ -1,11 +1,9 @@
 {
+  cudaVersion,
   lib,
   nvccCompatibilities,
-  cudaVersion,
   pkgs,
-  overrideCC,
   stdenv,
-  wrapCCWith,
   stdenvAdapters,
 }:
 
diff --git a/pkgs/development/cuda-modules/cuda-library-samples/extension.nix b/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
index 456ab8168a45..1184547c7f93 100644
--- a/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
+++ b/pkgs/development/cuda-modules/cuda-library-samples/extension.nix
@@ -1,5 +1,7 @@
-{ hostPlatform, lib }:
+{ lib, stdenv }:
 let
+  inherit (stdenv) hostPlatform;
+
   # Samples are built around the CUDA Toolkit, which is not available for
   # aarch64. Check for both CUDA version and platform.
   platformIsSupported = hostPlatform.isx86_64 && hostPlatform.isLinux;
diff --git a/pkgs/development/cuda-modules/cuda-library-samples/generic.nix b/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
index 4797871731b8..64131ab59b82 100644
--- a/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
+++ b/pkgs/development/cuda-modules/cuda-library-samples/generic.nix
@@ -76,7 +76,7 @@ in
       # CUTENSOR_ROOT is double escaped
       postPatch = ''
         substituteInPlace CMakeLists.txt \
-          --replace "\''${CUTENSOR_ROOT}/include" "${cutensor.dev}/include"
+          --replace-fail "\''${CUTENSOR_ROOT}/include" "${cutensor.dev}/include"
       '';
 
       CUTENSOR_ROOT = cutensor;
diff --git a/pkgs/development/cuda-modules/cuda-samples/extension.nix b/pkgs/development/cuda-modules/cuda-samples/extension.nix
index d41da90cd5d0..0a8a3f9ff6ea 100644
--- a/pkgs/development/cuda-modules/cuda-samples/extension.nix
+++ b/pkgs/development/cuda-modules/cuda-samples/extension.nix
@@ -1,7 +1,7 @@
 {
   cudaVersion,
-  hostPlatform,
   lib,
+  stdenv,
 }:
 let
   cudaVersionToHash = {
@@ -23,6 +23,8 @@ let
     "12.3" = "sha256-fjVp0G6uRCWxsfe+gOwWTN+esZfk0O5uxS623u0REAk=";
   };
 
+  inherit (stdenv) hostPlatform;
+
   # Samples are built around the CUDA Toolkit, which is not available for
   # aarch64. Check for both CUDA version and platform.
   cudaVersionIsSupported = cudaVersionToHash ? ${cudaVersion};
diff --git a/pkgs/development/cuda-modules/cuda-samples/generic.nix b/pkgs/development/cuda-modules/cuda-samples/generic.nix
index a6a382c8a219..7b3a46acea92 100644
--- a/pkgs/development/cuda-modules/cuda-samples/generic.nix
+++ b/pkgs/development/cuda-modules/cuda-samples/generic.nix
@@ -11,6 +11,7 @@
   hash,
   lib,
   pkg-config,
+  stdenv,
 }:
 let
   inherit (lib) lists strings;
@@ -63,7 +64,7 @@ backendStdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    install -Dm755 -t $out/bin bin/${backendStdenv.hostPlatform.parsed.cpu.name}/${backendStdenv.hostPlatform.parsed.kernel.name}/release/*
+    install -Dm755 -t $out/bin bin/${stdenv.hostPlatform.parsed.cpu.name}/${stdenv.hostPlatform.parsed.kernel.name}/release/*
 
     runHook postInstall
   '';
diff --git a/pkgs/development/cuda-modules/cuda/overrides.nix b/pkgs/development/cuda-modules/cuda/overrides.nix
index 9a2360d7f7c1..5d23d8f7f2a1 100644
--- a/pkgs/development/cuda-modules/cuda/overrides.nix
+++ b/pkgs/development/cuda-modules/cuda/overrides.nix
@@ -1,122 +1,178 @@
-{
-  cudaVersion,
-  lib,
-  addDriverRunpath,
-}:
 let
-  inherit (lib) attrsets lists strings;
-  # cudaVersionOlder : Version -> Boolean
-  cudaVersionOlder = strings.versionOlder cudaVersion;
-  # cudaVersionAtLeast : Version -> Boolean
-  cudaVersionAtLeast = strings.versionAtLeast cudaVersion;
+  filterAndCreateOverrides =
+    createOverrideAttrs: final: prev:
+    let
+      # It is imperative that we use `final.callPackage` to perform overrides,
+      # so the final package set is available to the override functions.
+      inherit (final) callPackage;
 
-  addBuildInputs =
-    drv: buildInputs:
-    drv.overrideAttrs (prevAttrs: {
-      buildInputs = prevAttrs.buildInputs ++ buildInputs;
-    });
-in
-# NOTE: Filter out attributes that are not present in the previous version of
-# the package set. This is necessary to prevent the appearance of attributes
-# like `cuda_nvcc` in `cudaPackages_10_0, which predates redistributables.
-final: prev:
-attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
-  libcufile = prev.libcufile.overrideAttrs (prevAttrs: {
-    buildInputs = prevAttrs.buildInputs ++ [
-      final.libcublas.lib
-      final.pkgs.numactl
-      final.pkgs.rdma-core
+      # NOTE(@connorbaker): We MUST use `lib` from `prev` because the attribute
+      # names CAN NOT depend on `final`.
+      inherit (prev.lib.attrsets) filterAttrs mapAttrs;
+      inherit (prev.lib.trivial) pipe;
+
+      # NOTE: Filter out attributes that are not present in the previous version of
+      # the package set. This is necessary to prevent the appearance of attributes
+      # like `cuda_nvcc` in `cudaPackages_10_0, which predates redistributables.
+      filterOutNewAttrs = filterAttrs (name: _: prev ? ${name});
+
+      # Apply callPackage to each attribute value, yielding a value to be passed
+      # to overrideAttrs.
+      callPackageThenOverrideAttrs = mapAttrs (
+        name: value: prev.${name}.overrideAttrs (callPackage value { })
+      );
+    in
+    pipe createOverrideAttrs [
+      filterOutNewAttrs
+      callPackageThenOverrideAttrs
     ];
-    # Before 11.7 libcufile depends on itself for some reason.
-    autoPatchelfIgnoreMissingDeps =
-      prevAttrs.autoPatchelfIgnoreMissingDeps
-      ++ lists.optionals (cudaVersionOlder "11.7") [ "libcufile.so.0" ];
-  });
+in
+# Each attribute name is the name of an existing package in the previous version
+# of the package set.
+# The value is a function (to be provided to callPackage), which yields a value
+# to be provided to overrideAttrs. This allows us to override the attributes of
+# a package without losing access to the fixed point of the package set --
+# especially useful given that some packages may depend on each other!
+filterAndCreateOverrides {
+  libcufile =
+    {
+      cudaOlder,
+      lib,
+      libcublas,
+      numactl,
+      rdma-core,
+    }:
+    prevAttrs: {
+      buildInputs = prevAttrs.buildInputs ++ [
+        libcublas.lib
+        numactl
+        rdma-core
+      ];
+      # Before 11.7 libcufile depends on itself for some reason.
+      autoPatchelfIgnoreMissingDeps =
+        prevAttrs.autoPatchelfIgnoreMissingDeps
+        ++ lib.lists.optionals (cudaOlder "11.7") [ "libcufile.so.0" ];
+    };
 
-  libcusolver = addBuildInputs prev.libcusolver (
-    # Always depends on this
-    [ final.libcublas.lib ]
-    # Dependency from 12.0 and on
-    ++ lists.optionals (cudaVersionAtLeast "12.0") [ final.libnvjitlink.lib ]
-    # Dependency from 12.1 and on
-    ++ lists.optionals (cudaVersionAtLeast "12.1") [ final.libcusparse.lib ]
-  );
+  libcusolver =
+    {
+      cudaAtLeast,
+      lib,
+      libcublas,
+      libcusparse ? null,
+      libnvjitlink ? null,
+    }:
+    prevAttrs: {
+      buildInputs =
+        prevAttrs.buildInputs
+        # Always depends on this
+        ++ [ libcublas.lib ]
+        # Dependency from 12.0 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.0") [ libnvjitlink.lib ]
+        # Dependency from 12.1 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.1") [ libcusparse.lib ];
 
-  libcusparse = addBuildInputs prev.libcusparse (
-    lists.optionals (cudaVersionAtLeast "12.0") [ final.libnvjitlink.lib ]
-  );
+      brokenConditions = prevAttrs.brokenConditions // {
+        "libnvjitlink missing (CUDA >= 12.0)" =
+          !(cudaAtLeast "12.0" -> (libnvjitlink != null && libnvjitlink.lib != null));
+        "libcusparse missing (CUDA >= 12.1)" =
+          !(cudaAtLeast "12.1" -> (libcusparse != null && libcusparse.lib != null));
+      };
+    };
 
-  cuda_cudart = prev.cuda_cudart.overrideAttrs (prevAttrs: {
-    # Remove once cuda-find-redist-features has a special case for libcuda
-    outputs =
-      prevAttrs.outputs
-      ++ lists.optionals (!(builtins.elem "stubs" prevAttrs.outputs)) [ "stubs" ];
+  libcusparse =
+    {
+      cudaAtLeast,
+      lib,
+      libnvjitlink ? null,
+    }:
+    prevAttrs: {
+      buildInputs =
+        prevAttrs.buildInputs
+        # Dependency from 12.0 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.0") [ libnvjitlink.lib ];
 
-    allowFHSReferences = false;
+      brokenConditions = prevAttrs.brokenConditions // {
+        "libnvjitlink missing (CUDA >= 12.0)" =
+          !(cudaAtLeast "12.0" -> (libnvjitlink != null && libnvjitlink.lib != null));
+      };
+    };
 
-    # The libcuda stub's pkg-config doesn't follow the general pattern:
-    postPatch =
-      prevAttrs.postPatch or ""
-      + ''
-        while IFS= read -r -d $'\0' path ; do
-          sed -i \
-            -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib/stubs|" \
-            -e "s|^Libs\s*:\(.*\)\$|Libs: \1 -Wl,-rpath,${addDriverRunpath.driverLink}/lib|" \
-            "$path"
-        done < <(find -iname 'cuda-*.pc' -print0)
-      ''
-      + ''
+  # TODO(@connorbaker): cuda_cudart.dev depends on crt/host_config.h, which is from
+  # cuda_nvcc.dev. It would be nice to be able to encode that.
+  cuda_cudart =
+    { addDriverRunpath, lib }:
+    prevAttrs: {
+      # Remove once cuda-find-redist-features has a special case for libcuda
+      outputs =
+        prevAttrs.outputs
+        ++ lib.lists.optionals (!(builtins.elem "stubs" prevAttrs.outputs)) [ "stubs" ];
+
+      allowFHSReferences = false;
+
+      # The libcuda stub's pkg-config doesn't follow the general pattern:
+      postPatch =
+        prevAttrs.postPatch or ""
+        + ''
+          while IFS= read -r -d $'\0' path; do
+            sed -i \
+              -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib/stubs|" \
+              -e "s|^Libs\s*:\(.*\)\$|Libs: \1 -Wl,-rpath,${addDriverRunpath.driverLink}/lib|" \
+              "$path"
+          done < <(find -iname 'cuda-*.pc' -print0)
+        ''
         # Namelink may not be enough, add a soname.
         # Cf. https://gitlab.kitware.com/cmake/cmake/-/issues/25536
-        if [[ -f lib/stubs/libcuda.so && ! -f lib/stubs/libcuda.so.1 ]] ; then
-          ln -s libcuda.so lib/stubs/libcuda.so.1
-        fi
-      '';
+        + ''
+          if [[ -f lib/stubs/libcuda.so && ! -f lib/stubs/libcuda.so.1 ]]; then
+            ln -s libcuda.so lib/stubs/libcuda.so.1
+          fi
+        '';
 
-    postFixup =
-      prevAttrs.postFixup or ""
-      + ''
-        moveToOutput lib/stubs "$stubs"
-        ln -s "$stubs"/lib/stubs/* "$stubs"/lib/
-        ln -s "$stubs"/lib/stubs "''${!outputLib}/lib/stubs"
-      '';
-  });
-
-  cuda_compat = prev.cuda_compat.overrideAttrs (prevAttrs: {
-    autoPatchelfIgnoreMissingDeps = prevAttrs.autoPatchelfIgnoreMissingDeps ++ [
-      "libnvrm_gpu.so"
-      "libnvrm_mem.so"
-      "libnvdla_runtime.so"
-    ];
-    # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
-    badPlatformsConditions = prevAttrs.badPlatformsConditions // {
-      "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" =
-        !final.flags.isJetsonBuild;
+      postFixup =
+        prevAttrs.postFixup or ""
+        + ''
+          moveToOutput lib/stubs "$stubs"
+          ln -s "$stubs"/lib/stubs/* "$stubs"/lib/
+          ln -s "$stubs"/lib/stubs "''${!outputLib}/lib/stubs"
+        '';
     };
-  });
 
-  cuda_gdb = addBuildInputs prev.cuda_gdb (
-    # x86_64 only needs gmp from 12.0 and on
-    lists.optionals (cudaVersionAtLeast "12.0") [ final.pkgs.gmp ]
-  );
-
-  cuda_nvcc = prev.cuda_nvcc.overrideAttrs (
-    oldAttrs:
-    let
-      # This replicates the logic in stdenvAdapters.useLibsFrom, except we use
-      # gcc from pkgsHostTarget and not from buildPackages.
-      ccForLibs-wrapper = final.pkgs.stdenv.cc;
-      gccMajorVersion = final.nvccCompatibilities.${cudaVersion}.gccMaxMajorVersion;
-      cc = final.pkgs.wrapCCWith {
-        cc = final.pkgs."gcc${gccMajorVersion}".cc;
-        useCcForLibs = true;
-        gccForLibs = ccForLibs-wrapper.cc;
+  cuda_compat =
+    { flags, lib }:
+    prevAttrs: {
+      autoPatchelfIgnoreMissingDeps = prevAttrs.autoPatchelfIgnoreMissingDeps ++ [
+        "libnvrm_gpu.so"
+        "libnvrm_mem.so"
+        "libnvdla_runtime.so"
+      ];
+      # `cuda_compat` only works on aarch64-linux, and only when building for Jetson devices.
+      badPlatformsConditions = prevAttrs.badPlatformsConditions // {
+        "Trying to use cuda_compat on aarch64-linux targeting non-Jetson devices" = !flags.isJetsonBuild;
       };
-    in
+    };
+
+  cuda_gdb =
     {
+      cudaAtLeast,
+      gmp,
+      lib,
+    }:
+    prevAttrs: {
+      buildInputs =
+        prevAttrs.buildInputs
+        # x86_64 only needs gmp from 12.0 and on
+        ++ lib.lists.optionals (cudaAtLeast "12.0") [ gmp ];
+    };
 
-      outputs = oldAttrs.outputs ++ lists.optionals (!(builtins.elem "lib" oldAttrs.outputs)) [ "lib" ];
-
+  cuda_nvcc =
+    {
+      backendStdenv,
+      cuda_cudart,
+      lib,
+      setupCudaHook,
+    }:
+    prevAttrs: {
       # Patch the nvcc.profile.
       # Syntax:
       # - `=` for assignment,
@@ -131,38 +187,37 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
       # backend-stdenv.nix
 
       postPatch =
-        (oldAttrs.postPatch or "")
+        (prevAttrs.postPatch or "")
         + ''
           substituteInPlace bin/nvcc.profile \
-            --replace \
-              '$(TOP)/lib' \
-              "''${!outputLib}/lib" \
-            --replace \
+            --replace-fail \
               '$(TOP)/$(_NVVM_BRANCH_)' \
               "''${!outputBin}/nvvm" \
-            --replace \
+            --replace-fail \
               '$(TOP)/$(_TARGET_DIR_)/include' \
               "''${!outputDev}/include"
 
           cat << EOF >> bin/nvcc.profile
 
           # Fix a compatible backend compiler
-          PATH += ${lib.getBin cc}/bin:
+          PATH += "${backendStdenv.cc}/bin":
 
           # Expose the split-out nvvm
-          LIBRARIES =+ -L''${!outputBin}/nvvm/lib
-          INCLUDES =+ -I''${!outputBin}/nvvm/include
-
-          # Expose cudart and the libcuda stubs
-          LIBRARIES =+ -L$static/lib" "-L${final.cuda_cudart.lib}/lib -L${final.cuda_cudart.lib}/lib/stubs
-          INCLUDES =+ -I${final.cuda_cudart.dev}/include
+          LIBRARIES =+ "-L''${!outputBin}/nvvm/lib"
+          INCLUDES =+ "-I''${!outputBin}/nvvm/include"
           EOF
         '';
 
-      propagatedBuildInputs = [ final.setupCudaHook ];
+      # NOTE(@connorbaker):
+      # Though it might seem odd or counter-intuitive to add the setup hook to `propagatedBuildInputs` instead of
+      # `propagatedNativeBuildInputs`, it is necessary! If you move the setup hook from `propagatedBuildInputs` to
+      # `propagatedNativeBuildInputs`, it stops being propagated to downstream packages during their build because
+      # setup hooks in `propagatedNativeBuildInputs` are not designed to affect the runtime or build environment of
+      # dependencies; they are only meant to affect the build environment of the package that directly includes them.
+      propagatedBuildInputs = (prevAttrs.propagatedBuildInputs or [ ]) ++ [ setupCudaHook ];
 
       postInstall =
-        (oldAttrs.postInstall or "")
+        (prevAttrs.postInstall or "")
         + ''
           moveToOutput "nvvm" "''${!outputBin}"
         '';
@@ -170,48 +225,77 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
       # The nvcc and cicc binaries contain hard-coded references to /usr
       allowFHSReferences = true;
 
-      meta = (oldAttrs.meta or { }) // {
+      meta = (prevAttrs.meta or { }) // {
         mainProgram = "nvcc";
       };
-    }
-  );
+    };
 
-  cuda_nvprof = prev.cuda_nvprof.overrideAttrs (prevAttrs: {
-    buildInputs = prevAttrs.buildInputs ++ [ final.cuda_cupti.lib ];
-  });
+  cuda_nvprof =
+    { cuda_cupti }: prevAttrs: { buildInputs = prevAttrs.buildInputs ++ [ cuda_cupti.lib ]; };
 
-  cuda_demo_suite = addBuildInputs prev.cuda_demo_suite [
-    final.pkgs.freeglut
-    final.pkgs.libGLU
-    final.pkgs.libglvnd
-    final.pkgs.mesa
-    final.libcufft.lib
-    final.libcurand.lib
-  ];
+  cuda_demo_suite =
+    {
+      freeglut,
+      libcufft,
+      libcurand,
+      libGLU,
+      libglvnd,
+      mesa,
+    }:
+    prevAttrs: {
+      buildInputs = prevAttrs.buildInputs ++ [
+        freeglut
+        libcufft.lib
+        libcurand.lib
+        libGLU
+        libglvnd
+        mesa
+      ];
+    };
 
-  nsight_compute = prev.nsight_compute.overrideAttrs (prevAttrs: {
-    nativeBuildInputs =
-      prevAttrs.nativeBuildInputs
-      ++ (
-        if (strings.versionOlder prev.nsight_compute.version "2022.2.0") then
-          [ final.pkgs.qt5.wrapQtAppsHook ]
-        else
-          [ final.pkgs.qt6.wrapQtAppsHook ]
-      );
-    buildInputs =
-      prevAttrs.buildInputs
-      ++ (
-        if (strings.versionOlder prev.nsight_compute.version "2022.2.0") then
-          [ final.pkgs.qt5.qtwebview ]
-        else
-          [ final.pkgs.qt6.qtwebview ]
-      );
-  });
-
-  nsight_systems = prev.nsight_systems.overrideAttrs (
+  nsight_compute =
+    {
+      lib,
+      qt5 ? null,
+      qt6 ? null,
+    }:
     prevAttrs:
     let
-      qt = if lib.versionOlder prevAttrs.version "2022.4.2.1" then final.pkgs.qt5 else final.pkgs.qt6;
+      inherit (lib.strings) versionOlder versionAtLeast;
+      inherit (prevAttrs) version;
+      qt = if versionOlder version "2022.2.0" then qt5 else qt6;
+      inherit (qt) wrapQtAppsHook qtwebview;
+    in
+    {
+      nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ wrapQtAppsHook ];
+      buildInputs = prevAttrs.buildInputs ++ [ qtwebview ];
+      brokenConditions = prevAttrs.brokenConditions // {
+        "Qt 5 missing (<2022.2.0)" = !(versionOlder version "2022.2.0" -> qt5 != null);
+        "Qt 6 missing (>=2022.2.0)" = !(versionAtLeast version "2022.2.0" -> qt6 != null);
+      };
+    };
+
+  nsight_systems =
+    {
+      cuda_cudart,
+      cudaOlder,
+      gst_all_1,
+      lib,
+      nss,
+      numactl,
+      pulseaudio,
+      qt5 ? null,
+      qt6 ? null,
+      rdma-core,
+      ucx,
+      wayland,
+      xorg,
+    }:
+    prevAttrs:
+    let
+      inherit (lib.strings) versionOlder versionAtLeast;
+      inherit (prevAttrs) version;
+      qt = if lib.strings.versionOlder prevAttrs.version "2022.4.2.1" then qt5 else qt6;
       qtwayland =
         if lib.versions.major qt.qtbase.version == "5" then
           lib.getBin qt.qtwayland
@@ -223,55 +307,57 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
       # An ad hoc replacement for
       # https://github.com/ConnorBaker/cuda-redist-find-features/issues/11
       env.rmPatterns = toString [
+        "nsight-systems/*/*/lib{arrow,jpeg}*"
+        "nsight-systems/*/*/lib{ssl,ssh,crypto}*"
+        "nsight-systems/*/*/libboost*"
+        "nsight-systems/*/*/libexec"
         "nsight-systems/*/*/libQt*"
         "nsight-systems/*/*/libstdc*"
-        "nsight-systems/*/*/libboost*"
-        "nsight-systems/*/*/lib{ssl,ssh,crypto}*"
-        "nsight-systems/*/*/lib{arrow,jpeg}*"
         "nsight-systems/*/*/Mesa"
-        "nsight-systems/*/*/python/bin/python"
-        "nsight-systems/*/*/libexec"
         "nsight-systems/*/*/Plugins"
+        "nsight-systems/*/*/python/bin/python"
       ];
       postPatch =
         prevAttrs.postPatch or ""
         + ''
-          for path in $rmPatterns ; do
+          for path in $rmPatterns; do
             rm -r "$path"
           done
         '';
       nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ qt.wrapQtAppsHook ];
       buildInputs = prevAttrs.buildInputs ++ [
-        final.cuda_cudart.stubs
-        final.pkgs.alsa-lib
-        final.pkgs.boost178
-        final.pkgs.e2fsprogs
-        final.pkgs.gst_all_1.gst-plugins-base
-        final.pkgs.gst_all_1.gstreamer
-        final.pkgs.nss
-        final.pkgs.numactl
-        final.pkgs.pulseaudio
-        final.pkgs.rdma-core
-        final.pkgs.ucx
-        final.pkgs.wayland
-        final.pkgs.xorg.libXcursor
-        final.pkgs.xorg.libXdamage
-        final.pkgs.xorg.libXrandr
-        final.pkgs.xorg.libXtst
-        qt.qtbase
         (qt.qtdeclarative or qt.full)
         (qt.qtsvg or qt.full)
+        cuda_cudart.stubs
+        gst_all_1.gst-plugins-base
+        gst_all_1.gstreamer
+        nss
+        numactl
+        pulseaudio
+        qt.qtbase
         qtWaylandPlugins
+        rdma-core
+        ucx
+        wayland
+        xorg.libXcursor
+        xorg.libXdamage
+        xorg.libXrandr
+        xorg.libXtst
       ];
 
-      # Older releases require boost 1.70 deprecated in Nixpkgs
-      meta.broken = prevAttrs.meta.broken or false || lib.versionOlder final.cudaVersion "11.8";
-    }
-  );
+      brokenConditions = prevAttrs.brokenConditions // {
+        # Older releases require boost 1.70, which is deprecated in Nixpkgs
+        "CUDA too old (<11.8)" = cudaOlder "11.8";
+        "Qt 5 missing (<2022.4.2.1)" = !(versionOlder version "2022.4.2.1" -> qt5 != null);
+        "Qt 6 missing (>=2022.4.2.1)" = !(versionAtLeast version "2022.4.2.1" -> qt6 != null);
+      };
+    };
 
-  nvidia_driver = prev.nvidia_driver.overrideAttrs {
-    # No need to support this package as we have drivers already
-    # in linuxPackages.
-    meta.broken = true;
-  };
+  nvidia_driver =
+    { }:
+    prevAttrs: {
+      brokenConditions = prevAttrs.brokenConditions // {
+        "Package is not supported; use drivers from linuxPackages" = true;
+      };
+    };
 }
diff --git a/pkgs/development/cuda-modules/cutensor/extension.nix b/pkgs/development/cuda-modules/cutensor/extension.nix
index c41113939ca2..5fdf356df916 100644
--- a/pkgs/development/cuda-modules/cutensor/extension.nix
+++ b/pkgs/development/cuda-modules/cutensor/extension.nix
@@ -15,9 +15,9 @@
 {
   cudaVersion,
   flags,
-  hostPlatform,
   lib,
   mkVersionedPackageName,
+  stdenv,
 }:
 let
   inherit (lib)
@@ -29,6 +29,8 @@ let
     trivial
     ;
 
+  inherit (stdenv) hostPlatform;
+
   redistName = "cutensor";
   pname = "libcutensor";
 
diff --git a/pkgs/development/cuda-modules/flags.nix b/pkgs/development/cuda-modules/flags.nix
index 196b6b9f8f99..93952a66216b 100644
--- a/pkgs/development/cuda-modules/flags.nix
+++ b/pkgs/development/cuda-modules/flags.nix
@@ -7,7 +7,7 @@
   cudaForwardCompat ? (config.cudaForwardCompat or true),
   lib,
   cudaVersion,
-  hostPlatform,
+  stdenv,
   # gpus :: List Gpu
   gpus,
 }:
@@ -20,6 +20,8 @@ let
     trivial
     ;
 
+  inherit (stdenv) hostPlatform;
+
   # Flags are determined based on your CUDA toolkit by default.  You may benefit
   # from improved performance, reduced file size, or greater hardware support by
   # passing a configuration based on your specific GPU environment.
@@ -207,6 +209,11 @@ let
       # E.g. "-gencode=arch=compute_75,code=sm_75 ... -gencode=arch=compute_86,code=compute_86"
       gencodeString = strings.concatStringsSep " " gencode;
 
+      # cmakeCudaArchitecturesString :: String
+      # A semicolon-separated string of CUDA capabilities without dots, suitable for passing to CMake.
+      # E.g. "75;86"
+      cmakeCudaArchitecturesString = strings.concatMapStringsSep ";" dropDot cudaCapabilities;
+
       # Jetson devices cannot be targeted by the same binaries which target non-Jetson devices. While
       # NVIDIA provides both `linux-aarch64` and `linux-sbsa` packages, which both target `aarch64`,
       # they are built with different settings and cannot be mixed.
@@ -270,6 +277,8 @@ assert
       ];
       gencodeString = "-gencode=arch=compute_75,code=sm_75 -gencode=arch=compute_86,code=sm_86 -gencode=arch=compute_86,code=compute_86";
 
+      cmakeCudaArchitecturesString = "75;86";
+
       isJetsonBuild = false;
     };
     actual = formatCapabilities {
@@ -339,6 +348,8 @@ assert
       ];
       gencodeString = "-gencode=arch=compute_62,code=sm_62 -gencode=arch=compute_72,code=sm_72 -gencode=arch=compute_72,code=compute_72";
 
+      cmakeCudaArchitecturesString = "62;72";
+
       isJetsonBuild = true;
     };
     actual = formatCapabilities {
diff --git a/pkgs/development/cuda-modules/generic-builders/manifest.nix b/pkgs/development/cuda-modules/generic-builders/manifest.nix
index 73c34b0c86ee..006abb456cdc 100644
--- a/pkgs/development/cuda-modules/generic-builders/manifest.nix
+++ b/pkgs/development/cuda-modules/generic-builders/manifest.nix
@@ -10,7 +10,6 @@
   markForCudatoolkitRootHook,
   flags,
   stdenv,
-  hostPlatform,
   # Builder-specific arguments
   # Short package name (e.g., "cuda_cccl")
   # pname : String
@@ -40,6 +39,8 @@ let
     sourceTypes
     ;
 
+  inherit (stdenv) hostPlatform;
+
   # Get the redist architectures for which package provides distributables.
   # These are used by meta.platforms.
   supportedRedistArchs = builtins.attrNames featureRelease;
@@ -48,7 +49,7 @@ let
   # It is `"unsupported"` if the redistributable is not supported on the target platform.
   redistArch = flags.getRedistArch hostPlatform.system;
 
-  sourceMatchesHost = flags.getNixSystem redistArch == stdenv.hostPlatform.system;
+  sourceMatchesHost = flags.getNixSystem redistArch == hostPlatform.system;
 in
 backendStdenv.mkDerivation (finalAttrs: {
   # NOTE: Even though there's no actual buildPhase going on here, the derivations of the
@@ -127,7 +128,18 @@ backendStdenv.mkDerivation (finalAttrs: {
   # brokenConditions :: AttrSet Bool
   # Sets `meta.broken = true` if any of the conditions are true.
   # Example: Broken on a specific version of CUDA or when a dependency has a specific version.
-  brokenConditions = { };
+  brokenConditions = {
+    # Unclear how this is handled by Nix internals.
+    "Duplicate entries in outputs" = finalAttrs.outputs != lists.unique finalAttrs.outputs;
+    # Typically this results in the static output being empty, as all libraries are moved
+    # back to the lib output.
+    "lib output follows static output" =
+      let
+        libIndex = lists.findFirstIndex (x: x == "lib") null finalAttrs.outputs;
+        staticIndex = lists.findFirstIndex (x: x == "static") null finalAttrs.outputs;
+      in
+      libIndex != null && staticIndex != null && libIndex > staticIndex;
+  };
 
   # badPlatformsConditions :: AttrSet Bool
   # Sets `meta.badPlatforms = meta.platforms` if any of the conditions are true.
@@ -137,44 +149,43 @@ backendStdenv.mkDerivation (finalAttrs: {
   };
 
   # src :: Optional Derivation
-  src = trivial.pipe redistArch [
-    # If redistArch doesn't exist in redistribRelease, return null.
-    (redistArch: redistribRelease.${redistArch} or null)
-    # If the release is non-null, fetch the source; otherwise, return null.
-    (trivial.mapNullable (
-      { relative_path, sha256, ... }:
-      fetchurl {
-        url = "https://developer.download.nvidia.com/compute/${redistName}/redist/${relative_path}";
-        inherit sha256;
-      }
-    ))
-  ];
-
-  # Handle the pkg-config files:
-  # 1. No FHS
-  # 2. Location expected by the pkg-config wrapper
-  # 3. Generate unversioned names too
-  postPatch = ''
-    for path in pkg-config pkgconfig ; do
-      [[ -d "$path" ]] || continue
-      mkdir -p share/pkgconfig
-      mv "$path"/* share/pkgconfig/
-      rmdir "$path"
-    done
-
-    for pc in share/pkgconfig/*.pc ; do
-      sed -i \
-        -e "s|^cudaroot\s*=.*\$|cudaroot=''${!outputDev}|" \
-        -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib|" \
-        -e "s|^includedir\s*=.*/include\$|includedir=''${!outputDev}/include|" \
-        "$pc"
-    done
+  # If redistArch doesn't exist in redistribRelease, return null.
+  src = trivial.mapNullable (
+    { relative_path, sha256, ... }:
+    fetchurl {
+      url = "https://developer.download.nvidia.com/compute/${redistName}/redist/${relative_path}";
+      inherit sha256;
+    }
+  ) (redistribRelease.${redistArch} or null);
 
+  postPatch =
+    # Pkg-config's setup hook expects configuration files in $out/share/pkgconfig
+    ''
+      for path in pkg-config pkgconfig; do
+        [[ -d "$path" ]] || continue
+        mkdir -p share/pkgconfig
+        mv "$path"/* share/pkgconfig/
+        rmdir "$path"
+      done
+    ''
+    # Rewrite FHS paths with store paths
+    # NOTE: output* fall back to out if the corresponding output isn't defined.
+    + ''
+      for pc in share/pkgconfig/*.pc; do
+        sed -i \
+          -e "s|^cudaroot\s*=.*\$|cudaroot=''${!outputDev}|" \
+          -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib|" \
+          -e "s|^includedir\s*=.*/include\$|includedir=''${!outputDev}/include|" \
+          "$pc"
+      done
+    ''
+    # Generate unversioned names.
     # E.g. cuda-11.8.pc -> cuda.pc
-    for pc in share/pkgconfig/*-"$majorMinorVersion.pc" ; do
-      ln -s "$(basename "$pc")" "''${pc%-$majorMinorVersion.pc}".pc
-    done
-  '';
+    + ''
+      for pc in share/pkgconfig/*-"$majorMinorVersion.pc"; do
+        ln -s "$(basename "$pc")" "''${pc%-$majorMinorVersion.pc}".pc
+      done
+    '';
 
   env.majorMinorVersion = cudaMajorMinorVersion;
 
@@ -233,7 +244,7 @@ backendStdenv.mkDerivation (finalAttrs: {
     # Handle the existence of libPath, which requires us to re-arrange the lib directory
     + strings.optionalString (libPath != null) ''
       full_lib_path="lib/${libPath}"
-      if [[ ! -d "$full_lib_path" ]] ; then
+      if [[ ! -d "$full_lib_path" ]]; then
         echo "${finalAttrs.pname}: '$full_lib_path' does not exist, only found:" >&2
         find lib/ -mindepth 1 -maxdepth 1 >&2
         echo "This release might not support your CUDA version" >&2
@@ -264,9 +275,9 @@ backendStdenv.mkDerivation (finalAttrs: {
   postInstallCheck = ''
     echo "Executing postInstallCheck"
 
-    if [[ -z "''${allowFHSReferences-}" ]] ; then
+    if [[ -z "''${allowFHSReferences-}" ]]; then
       mapfile -t outputPaths < <(for o in $(getAllOutputNames); do echo "''${!o}"; done)
-      if grep --max-count=5 --recursive --exclude=LICENSE /usr/ "''${outputPaths[@]}" ; then
+      if grep --max-count=5 --recursive --exclude=LICENSE /usr/ "''${outputPaths[@]}"; then
         echo "Detected references to /usr" >&2
         exit 1
       fi
diff --git a/pkgs/development/cuda-modules/generic-builders/multiplex.nix b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
index 0b523e56b8c4..ce50653bb5d4 100644
--- a/pkgs/development/cuda-modules/generic-builders/multiplex.nix
+++ b/pkgs/development/cuda-modules/generic-builders/multiplex.nix
@@ -3,7 +3,7 @@
   lib,
   cudaVersion,
   flags,
-  hostPlatform,
+  stdenv,
   # Expected to be passed by the caller
   mkVersionedPackageName,
   # pname :: String
@@ -40,6 +40,8 @@ let
     strings
     ;
 
+  inherit (stdenv) hostPlatform;
+
   evaluatedModules = modules.evalModules {
     modules = [
       ../modules
diff --git a/pkgs/development/cuda-modules/nccl/default.nix b/pkgs/development/cuda-modules/nccl/default.nix
index 8043adae4d1e..dd767d2781f0 100644
--- a/pkgs/development/cuda-modules/nccl/default.nix
+++ b/pkgs/development/cuda-modules/nccl/default.nix
@@ -17,9 +17,10 @@ let
     cuda_cccl
     cuda_cudart
     cuda_nvcc
+    cudaAtLeast
     cudaFlags
+    cudaOlder
     cudatoolkit
-    cudaVersion
     ;
 in
 backendStdenv.mkDerivation (finalAttrs: {
@@ -33,6 +34,7 @@ backendStdenv.mkDerivation (finalAttrs: {
     hash = "sha256-IF2tILwW8XnzSmfn7N1CO7jXL95gUp02guIW5n1eaig=";
   };
 
+  __structuredAttrs = true;
   strictDeps = true;
 
   outputs = [
@@ -46,12 +48,12 @@ backendStdenv.mkDerivation (finalAttrs: {
       autoAddDriverRunpath
       python3
     ]
-    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [ cuda_nvcc ];
+    ++ lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [ cuda_nvcc ];
 
   buildInputs =
-    lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+    lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [
       cuda_nvcc.dev # crt/host_config.h
       cuda_cudart
     ]
@@ -59,25 +61,25 @@ backendStdenv.mkDerivation (finalAttrs: {
     # against other version, like below, it's important that we use the same format. Otherwise,
     # we'll get incorrect results.
     # For example, lib.versionAtLeast "12.0" "12.0.0" == false.
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [ cuda_cccl ];
+    ++ lib.optionals (cudaAtLeast "12.0") [ cuda_cccl ];
 
   env.NIX_CFLAGS_COMPILE = toString [ "-Wno-unused-function" ];
 
-  preConfigure = ''
+  postPatch = ''
     patchShebangs ./src/device/generate.py
-    makeFlagsArray+=(
-      "NVCC_GENCODE=${lib.concatStringsSep " " cudaFlags.gencode}"
-    )
   '';
 
-  makeFlags =
-    [ "PREFIX=$(out)" ]
-    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [
+  makeFlagsArray =
+    [
+      "PREFIX=$(out)"
+      "NVCC_GENCODE=${cudaFlags.gencodeString}"
+    ]
+    ++ lib.optionals (cudaOlder "11.4") [
       "CUDA_HOME=${cudatoolkit}"
       "CUDA_LIB=${lib.getLib cudatoolkit}/lib"
       "CUDA_INC=${lib.getDev cudatoolkit}/include"
     ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+    ++ lib.optionals (cudaAtLeast "11.4") [
       "CUDA_HOME=${cuda_nvcc}"
       "CUDA_LIB=${lib.getLib cuda_cudart}/lib"
       "CUDA_INC=${lib.getDev cuda_cudart}/include"
diff --git a/pkgs/development/cuda-modules/saxpy/default.nix b/pkgs/development/cuda-modules/saxpy/default.nix
index 2a2eedbcb1db..a36cec3e692b 100644
--- a/pkgs/development/cuda-modules/saxpy/default.nix
+++ b/pkgs/development/cuda-modules/saxpy/default.nix
@@ -10,8 +10,9 @@ let
     cuda_cccl
     cuda_cudart
     cuda_nvcc
+    cudaAtLeast
+    cudaOlder
     cudatoolkit
-    cudaVersion
     flags
     libcublas
     setupCudaHook
@@ -24,6 +25,7 @@ backendStdenv.mkDerivation {
 
   src = ./.;
 
+  __structuredAttrs = true;
   strictDeps = true;
 
   nativeBuildInputs =
@@ -31,24 +33,22 @@ backendStdenv.mkDerivation {
       cmake
       autoAddDriverRunpath
     ]
-    ++ lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [ cuda_nvcc ];
+    ++ lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [ cuda_nvcc ];
 
   buildInputs =
-    lib.optionals (lib.versionOlder cudaVersion "11.4") [ cudatoolkit ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "11.4") [
+    lib.optionals (cudaOlder "11.4") [ cudatoolkit ]
+    ++ lib.optionals (cudaAtLeast "11.4") [
       (getDev libcublas)
       (getLib libcublas)
       (getOutput "static" libcublas)
       cuda_cudart
     ]
-    ++ lib.optionals (lib.versionAtLeast cudaVersion "12.0") [ cuda_cccl ];
+    ++ lib.optionals (cudaAtLeast "12.0") [ cuda_cccl ];
 
-  cmakeFlags = [
+  cmakeFlagsArray = [
     (lib.cmakeBool "CMAKE_VERBOSE_MAKEFILE" true)
-    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" (
-      with flags; lib.concatStringsSep ";" (lib.lists.map dropDot cudaCapabilities)
-    ))
+    (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" flags.cmakeCudaArchitecturesString)
   ];
 
   meta = rec {
@@ -56,6 +56,6 @@ backendStdenv.mkDerivation {
     license = lib.licenses.mit;
     maintainers = lib.teams.cuda.members;
     platforms = lib.platforms.unix;
-    badPlatforms = lib.optionals flags.isJetsonBuild platforms;
+    badPlatforms = lib.optionals (flags.isJetsonBuild && cudaOlder "11.4") platforms;
   };
 }
diff --git a/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh b/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh
index ba04c2e0806a..0abd651005c6 100644
--- a/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh
+++ b/pkgs/development/cuda-modules/setup-hooks/mark-for-cudatoolkit-root-hook.sh
@@ -1,14 +1,25 @@
 # shellcheck shell=bash
 
-# Should we mimick cc-wrapper's "hygiene"?
-[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0
+(( ${hostOffset:?} == -1 && ${targetOffset:?} == 0)) || return 0
 
 echo "Sourcing mark-for-cudatoolkit-root-hook" >&2
 
 markForCUDAToolkit_ROOT() {
-    mkdir -p "${prefix}/nix-support"
-    [[ -f "${prefix}/nix-support/include-in-cudatoolkit-root" ]] && return
-    echo "$pname-$output" > "${prefix}/nix-support/include-in-cudatoolkit-root"
+    mkdir -p "${prefix:?}/nix-support"
+    local markerPath="$prefix/nix-support/include-in-cudatoolkit-root"
+
+    # Return early if the file already exists.
+    [[ -f "$markerPath" ]] && return 0
+
+    # Always create the file, even if it's empty, since setup-cuda-hook relies on its existence.
+    # However, only populate it if strictDeps is not set.
+    touch "$markerPath"
+
+    # Return early if strictDeps is set.
+    [[ -n "${strictDeps-}" ]] && return 0
+
+    # Populate the file with the package name and output.
+    echo "${pname:?}-${output:?}" > "$markerPath"
 }
 
 fixupOutputHooks+=(markForCUDAToolkit_ROOT)
diff --git a/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh b/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
index a4a444fcd241..6e57c7b1072e 100644
--- a/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
+++ b/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
@@ -9,7 +9,7 @@ reason=
 [[ -n ${cudaSetupHookOnce-} ]] && guard=Skipping && reason=" because the hook has been propagated more than once"
 
 if (( "${NIX_DEBUG:-0}" >= 1 )) ; then
-    echo "$guard hostOffset=$hostOffset targetOffset=$targetOffset setupCudaHook$reason" >&2
+    echo "$guard hostOffset=$hostOffset targetOffset=$targetOffset setup-cuda-hook$reason" >&2
 else
     echo "$guard setup-cuda-hook$reason" >&2
 fi
@@ -24,16 +24,19 @@ extendcudaHostPathsSeen() {
     (( "${NIX_DEBUG:-0}" >= 1 )) && echo "extendcudaHostPathsSeen $1" >&2
 
     local markerPath="$1/nix-support/include-in-cudatoolkit-root"
-    [[ ! -f "${markerPath}" ]] && return
-    [[ -v cudaHostPathsSeen[$1] ]] && return
+    [[ ! -f "${markerPath}" ]] && return 0
+    [[ -v cudaHostPathsSeen[$1] ]] && return 0
 
     cudaHostPathsSeen["$1"]=1
 
     # E.g. cuda_cudart-lib
     local cudaOutputName
-    read -r cudaOutputName < "$markerPath"
+    # Fail gracefully if the file is empty.
+    # One reason the file may be empty: the package was built with strictDeps set, but the current build does not have
+    # strictDeps set.
+    read -r cudaOutputName < "$markerPath" || return 0
 
-    [[ -z "$cudaOutputName" ]] && return
+    [[ -z "$cudaOutputName" ]] && return 0
 
     local oldPath="${cudaOutputToPath[$cudaOutputName]-}"
     [[ -n "$oldPath" ]] && echo "extendcudaHostPathsSeen: warning: overwriting $cudaOutputName from $oldPath to $1" >&2
@@ -59,7 +62,7 @@ setupCUDAToolkitCompilers() {
     echo Executing setupCUDAToolkitCompilers >&2
 
     if [[ -n "${dontSetupCUDAToolkitCompilers-}" ]] ; then
-        return
+        return 0
     fi
 
     # Point NVCC at a compatible compiler
@@ -99,7 +102,7 @@ preConfigureHooks+=(setupCUDAToolkitCompilers)
 propagateCudaLibraries() {
     (( "${NIX_DEBUG:-0}" >= 1 )) && echo "propagateCudaLibraries: cudaPropagateToOutput=$cudaPropagateToOutput cudaHostPathsSeen=${!cudaHostPathsSeen[*]}" >&2
 
-    [[ -z "${cudaPropagateToOutput-}" ]] && return
+    [[ -z "${cudaPropagateToOutput-}" ]] && return 0
 
     mkdir -p "${!cudaPropagateToOutput}/nix-support"
     # One'd expect this should be propagated-bulid-build-deps, but that doesn't seem to work
diff --git a/pkgs/development/cuda-modules/tensorrt/fixup.nix b/pkgs/development/cuda-modules/tensorrt/fixup.nix
index 3615284fb080..42359aedac11 100644
--- a/pkgs/development/cuda-modules/tensorrt/fixup.nix
+++ b/pkgs/development/cuda-modules/tensorrt/fixup.nix
@@ -1,12 +1,12 @@
 {
   cudaVersion,
   final,
-  hostPlatform,
   lib,
   mkVersionedPackageName,
   package,
   patchelf,
   requireFile,
+  stdenv,
   ...
 }:
 let
@@ -17,6 +17,7 @@ let
     strings
     versions
     ;
+  inherit (stdenv) hostPlatform;
   # targetArch :: String
   targetArch = attrsets.attrByPath [ hostPlatform.system ] "unsupported" {
     x86_64-linux = "x86_64-linux-gnu";
diff --git a/pkgs/development/libraries/LAStools/default.nix b/pkgs/development/libraries/LAStools/default.nix
index 2f2b3b23ae31..5dfd6570c080 100644
--- a/pkgs/development/libraries/LAStools/default.nix
+++ b/pkgs/development/libraries/LAStools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "LAStools";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "LAStools";
     repo = "LAStools";
     rev = "v${version}";
-    sha256 = "sha256-HL64koe0GNzJzyA0QP4I0M1y2HSxigsZTqOw67RCwNc=";
+    sha256 = "sha256-IyZjM8YvIVB0VPNuEhmHHw7EuKw5RanB2qhCnBD1fRY=";
   };
 
   patches = [
diff --git a/pkgs/development/node-packages/main-programs.nix b/pkgs/development/node-packages/main-programs.nix
index ebf1f9ca4af6..90093aaafde1 100644
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@@ -51,7 +51,6 @@
   purs-tidy = "purs-tidy";
   purty = "purty";
   pscid = "pscid";
-  pyright = "pyright";
   remod-cli = "remod";
   svelte-language-server = "svelteserver";
   teck-programmer = "teck-firmware-upgrade";
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index f7015177d57b..c0d021e9f472 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -200,7 +200,6 @@
 , "purescript-psa"
 , "purs-tidy"
 , "purty"
-, "pyright"
 , "remod-cli"
 , "reveal.js"
 , "rimraf"
diff --git a/pkgs/development/php-packages/opentelemetry/default.nix b/pkgs/development/php-packages/opentelemetry/default.nix
index 360f4cc43841..6770ecb432a6 100644
--- a/pkgs/development/php-packages/opentelemetry/default.nix
+++ b/pkgs/development/php-packages/opentelemetry/default.nix
@@ -15,6 +15,8 @@ in buildPecl rec {
 
   sourceRoot = "${src.name}/ext";
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-parentheses-equality";
+
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/catkin-pkg/default.nix b/pkgs/development/python-modules/catkin-pkg/default.nix
new file mode 100644
index 000000000000..c9ddf02b05f4
--- /dev/null
+++ b/pkgs/development/python-modules/catkin-pkg/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  docutils,
+  pyparsing,
+  python-dateutil,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "catkin-pkg";
+  version = "0.5.2";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ros-infrastructure";
+    repo = "catkin_pkg";
+    rev = version;
+    hash = "sha256-DjaPpLDsLpYOZukf5tYe6ZetSNTe/DJ2lS9BUsehZ8k=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    docutils
+    pyparsing
+    python-dateutil
+  ];
+
+  pythonImportsCheck = [ "catkin_pkg" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTestPaths = [ "test/test_flake8.py" ];
+
+  meta = {
+    description = "Library for retrieving information about catkin packages.";
+    homepage = "http://wiki.ros.org/catkin_pkg";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+  };
+}
diff --git a/pkgs/development/python-modules/consonance/default.nix b/pkgs/development/python-modules/consonance/default.nix
index b14d965e5629..e13665cd5dc3 100644
--- a/pkgs/development/python-modules/consonance/default.nix
+++ b/pkgs/development/python-modules/consonance/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , dissononce
 , python-axolotl-curve25519
 , transitions
@@ -23,6 +24,15 @@ buildPythonPackage rec {
     hash = "sha256-BhgxLxjKZ4dSL7DqkaoS+wBPCd1SYZomRKrtDLdGmYQ=";
   };
 
+  patches = [
+    # https://github.com/tgalal/consonance/pull/9
+    (fetchpatch {
+      name = "fix-type-error.patch";
+      url = "https://github.com/tgalal/consonance/pull/9/commits/92fb78af98a18f0533ec8a286136968174fb0baf.patch";
+      hash = "sha256-wVUGxZ4W2zPyrcQPQTc85LcRUtsLbTBVzS10NEolpQY=";
+    })
+  ];
+
   propagatedBuildInputs = [
     dissononce
     python-axolotl-curve25519
diff --git a/pkgs/development/python-modules/craft-application/default.nix b/pkgs/development/python-modules/craft-application/default.nix
new file mode 100644
index 000000000000..0b90ccdff058
--- /dev/null
+++ b/pkgs/development/python-modules/craft-application/default.nix
@@ -0,0 +1,114 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  git,
+  craft-archives,
+  craft-cli,
+  craft-grammar,
+  craft-parts,
+  craft-providers,
+  pydantic-yaml-0,
+  pyyaml,
+  setuptools,
+  setuptools-scm,
+  snap-helpers,
+  stdenv,
+  pygit2,
+  pyfakefs,
+  pytestCheckHook,
+  pytest-check,
+  pytest-mock,
+  responses,
+  hypothesis,
+}:
+
+buildPythonPackage rec {
+  pname = "craft-application";
+  version = "2.5.0";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "craft-application";
+    rev = "refs/tags/${version}";
+    hash = "sha256-66Ldo88DJ6v0+ekvDl++eDzhdn95yxq0SMdzQxTGl5k=";
+  };
+
+  postPatch = ''
+    substituteInPlace craft_application/__init__.py \
+      --replace-fail "dev" "${version}"
+
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools==69.4.0" "setuptools"
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    craft-archives
+    craft-cli
+    craft-grammar
+    craft-parts
+    craft-providers
+    pydantic-yaml-0
+    pygit2
+    pyyaml
+    snap-helpers
+  ];
+
+  pythonImportsCheck = [ "craft_application" ];
+
+  nativeCheckInputs = [
+    git
+    hypothesis
+    pyfakefs
+    pytest-check
+    pytest-mock
+    pytestCheckHook
+    responses
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+
+    # Tests require access to /etc/os-release, which isn't accessible in
+    # the test environment, so create a fake file, and modify the code
+    # to look for it.
+    echo 'ID=nixos' > $HOME/os-release
+    echo 'NAME=NixOS' >> $HOME/os-release
+    echo 'VERSION_ID="24.05"' >> $HOME/os-release
+
+    substituteInPlace craft_application/util/platforms.py \
+      --replace-fail "os_utils.OsRelease()" "os_utils.OsRelease(os_release_file='$HOME/os-release')"
+  '';
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  disabledTests = [
+    "test_to_yaml_file"
+    # Tests expecting pytest-time
+    "test_monitor_builds_success"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    # These tests have hardcoded "amd64" strings which fail on aarch64
+    "test_process_grammar_build_for"
+    "test_process_grammar_platform"
+    "test_process_grammar_default"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "The basis for Canonical craft applications";
+    homepage = "https://github.com/canonical/craft-application";
+    changelog = "https://github.com/canonical/craft-application/releases/tag/${version}";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/craft-providers/default.nix b/pkgs/development/python-modules/craft-providers/default.nix
index e3c384f455ba..4f463e628bd6 100644
--- a/pkgs/development/python-modules/craft-providers/default.nix
+++ b/pkgs/development/python-modules/craft-providers/default.nix
@@ -33,6 +33,11 @@ buildPythonPackage rec {
   };
 
   patches = [
+    # This lib will try to inject snaps *from the host system* into the build
+    # system. This patch short-circuits that logic and ensures that snaps are
+    # installed on the build system from the snap store - because there is no
+    # snapd on NixOS hosts that can be used for the injection. This patch will
+    # likely never be accepted upstream.
     ./inject-snaps.patch
   ];
 
diff --git a/pkgs/development/python-modules/craft-providers/inject-snaps.patch b/pkgs/development/python-modules/craft-providers/inject-snaps.patch
index 85dec7f8bd97..37f9f2f82d7e 100644
--- a/pkgs/development/python-modules/craft-providers/inject-snaps.patch
+++ b/pkgs/development/python-modules/craft-providers/inject-snaps.patch
@@ -38,7 +38,7 @@ index 3c914a2..d9c2cf9 100644
 -                        details=error.details,
 -                    ) from error
 +            try:
-+                channel = "latest/edge" if snap.name == "rockcraft" else "latest/stable"
++                channel = "latest/beta"
 +                snap_installer.install_from_store(
 +                    executor=executor,
 +                    snap_name=snap.name,
diff --git a/pkgs/development/python-modules/green/default.nix b/pkgs/development/python-modules/green/default.nix
index 40b4851b0c77..eef23f6ce0df 100644
--- a/pkgs/development/python-modules/green/default.nix
+++ b/pkgs/development/python-modules/green/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "green";
-  version = "4.0.1";
+  version = "4.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-O178HRtyKg/2fYD9jHzfbUfNGPlRpGuEvbx7H7yr0/w=";
+    hash = "sha256-pAZ8P5/CpkTtNfU2ZJUGQzROxGLm0uu1vXS3YpcVprE=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/ipyvue/default.nix b/pkgs/development/python-modules/ipyvue/default.nix
index c2211226f078..2be0ddfe8075 100644
--- a/pkgs/development/python-modules/ipyvue/default.nix
+++ b/pkgs/development/python-modules/ipyvue/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "ipyvue";
-  version = "1.10.2";
+  version = "1.11.0";
   format = "setuptools";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qZc1hvouKWUQ2aJLk1oiokUKzKBXtd6fC6tm7LHDOrQ=";
+    hash = "sha256-ez2ygBvgU12FX/+qDkARlizq50rEgZYp4UH5Sx4E2QA=";
   };
 
   propagatedBuildInputs = [ ipywidgets ];
diff --git a/pkgs/development/python-modules/itemdb/default.nix b/pkgs/development/python-modules/itemdb/default.nix
index 4cc0cf637484..6ac5deae5eaa 100644
--- a/pkgs/development/python-modules/itemdb/default.nix
+++ b/pkgs/development/python-modules/itemdb/default.nix
@@ -5,7 +5,7 @@
 
 buildPythonPackage rec {
   pname = "itemdb";
-  version = "1.1.2";
+  version = "1.2.0";
   format = "setuptools";
 
   # PyPI tarball doesn't include tests directory
@@ -13,7 +13,7 @@ buildPythonPackage rec {
     owner = "almarklein";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-s7a+MJLTAcGv2rYRMO2SAlsDYen6Si10qUQOVDFuf6c=";
+    sha256 = "sha256-egxQ1tGC6R5p1stYm4r05+b2HkuT+nBySTZPGqeAbSE=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/itemloaders/default.nix b/pkgs/development/python-modules/itemloaders/default.nix
index d0fa322791d1..73957e6b0aea 100644
--- a/pkgs/development/python-modules/itemloaders/default.nix
+++ b/pkgs/development/python-modules/itemloaders/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, setuptools
 , w3lib
 , parsel
 , jmespath
@@ -11,18 +12,22 @@
 
 buildPythonPackage rec {
   pname = "itemloaders";
-  version = "1.1.0";
-  format = "setuptools";
+  version = "1.2.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "scrapy";
-    repo = pname;
+    repo = "itemloaders";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jwxxKfr/SI1yfjSQbYqggWxBwusBZNYySHwZXHftgFs=";
+    hash = "sha256-DatHJnAIomVoN/GrDzM2fNnFHcXqo6zs3ucKCOCf9DU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     w3lib
     parsel
@@ -34,18 +39,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # Test are failing (AssertionError: Lists differ: ...)
-    "test_nested_css"
-    "test_nested_xpath"
-  ];
-
   pythonImportsCheck = [
     "itemloaders"
   ];
 
   meta = with lib; {
-    description = "Base library for scrapy's ItemLoader";
+    description = "Library to populate items using XPath and CSS with a convenient API";
     homepage = "https://github.com/scrapy/itemloaders";
     changelog = "https://github.com/scrapy/itemloaders/raw/v${version}/docs/release-notes.rst";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/jupyter-server-fileid/default.nix b/pkgs/development/python-modules/jupyter-server-fileid/default.nix
index 300f4bb835dd..9fea67c3faa2 100644
--- a/pkgs/development/python-modules/jupyter-server-fileid/default.nix
+++ b/pkgs/development/python-modules/jupyter-server-fileid/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "jupyter-server-fileid";
-  version = "0.9.1";
+  version = "0.9.2";
 
   disables = pythonOlder "3.7";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "jupyter-server";
     repo = "jupyter_server_fileid";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rEjrfioAmqijyObiK7CMLWhLqVpfcmNYhjdjKjkMp6s=";
+    hash = "sha256-ApCDBVjJqpkC5FGEjU/LxwWBunTkL6i5Ki85M6MMLE0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/matchpy/default.nix b/pkgs/development/python-modules/matchpy/default.nix
index 5b880cfb5b09..259038e7774b 100644
--- a/pkgs/development/python-modules/matchpy/default.nix
+++ b/pkgs/development/python-modules/matchpy/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , hopcroftkarp
 , multiset
 , pytestCheckHook
@@ -22,6 +23,15 @@ buildPythonPackage rec {
     hash = "sha256-n5rXIjqVQZzEbfIZVQiGLh2PR1DHAJ9gumcrbvwnasA=";
   };
 
+  patches = [
+    # https://github.com/HPAC/matchpy/pull/77
+    (fetchpatch {
+      name = "fix-versioneer-py312.patch";
+      url = "https://github.com/HPAC/matchpy/commit/965d7c39689b9f2473a78ed06b83f2be701e234d.patch";
+      hash = "sha256-xXADCSIhq1ARny2twzrhR1J8LkMFWFl6tmGxrM8RvkU=";
+    })
+  ];
+
   postPatch = ''
     sed -i '/pytest-runner/d' setup.cfg
 
diff --git a/pkgs/development/python-modules/periodiq/default.nix b/pkgs/development/python-modules/periodiq/default.nix
index 478168de30d0..2d14561d120d 100644
--- a/pkgs/development/python-modules/periodiq/default.nix
+++ b/pkgs/development/python-modules/periodiq/default.nix
@@ -26,6 +26,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
+      --replace 'pendulum = "^2.0"' 'pendulum = "*"' \
       --replace 'poetry>=0.12' 'poetry-core' \
       --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
   '';
diff --git a/pkgs/development/python-modules/python-apt/default.nix b/pkgs/development/python-modules/python-apt/default.nix
new file mode 100644
index 000000000000..5d5a703a1afc
--- /dev/null
+++ b/pkgs/development/python-modules/python-apt/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  apt,
+  buildPythonPackage,
+  fetchgit,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "apt";
+  version = "2.7.6";
+
+  pyproject = true;
+
+  src = fetchgit {
+    url = "https://git.launchpad.net/python-apt";
+    rev = "refs/tags/${version}";
+    hash = "sha256-1jTe8ncMKV78+cfSZ6p6qdjxs0plZLB4VwVtPLtDlAc=";
+  };
+
+  buildInputs = [ apt.dev ];
+
+  nativeBuildInputs = [ setuptools ];
+
+  # Ensure the version is set properly without trying to invoke
+  # dpkg-parsechangelog
+  env.DEBVER = "${version}";
+
+  pythonImportsCheck = [ "apt_pkg" ];
+
+  meta = {
+    description = "Python bindings for APT";
+    homepage = "https://launchpad.net/python-apt";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 3ac3baf1525a..abcc25faafdb 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.3.0";
+  version = "4.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kUXi26NhFGS3liGaGHfm0HTRWXlnaIa80lxgLQ/0FyM=";
+    hash = "sha256-SFD+nZVNb90+UVdWmZwnGEGF21zKhE7mfFPn2HluizE=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/uarray/default.nix b/pkgs/development/python-modules/uarray/default.nix
index ab22d07049c4..b6070cb8d9e1 100644
--- a/pkgs/development/python-modules/uarray/default.nix
+++ b/pkgs/development/python-modules/uarray/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , fetchpatch
 , setuptools
+, setuptools-scm
 , matchpy
 , numpy
 , astunparse
@@ -13,25 +14,17 @@
 
 buildPythonPackage rec {
   pname = "uarray";
-  version = "0.8.2";
+  version = "0.8.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Quansight-Labs";
     repo = pname;
     rev = version;
-    sha256 = "1x2jp7w2wmn2awyv05xs0frpq0fa0rprwcxyg72wgiss0bnzxnhm";
+    hash = "sha256-wTKqOw64b+/kdZpSYLwCJATOuo807BWCtVHB4pH58fY=";
   };
 
-  patches = [(
-    # Fixes a compile error with newer versions of GCC -- should be included
-    # in the next release after 0.8.2
-    fetchpatch {
-      url = "https://github.com/Quansight-Labs/uarray/commit/a2012fc7bb94b3773eb402c6fe1ba1a894ea3d18.patch";
-      sha256 = "1qqh407qg5dz6x766mya2bxrk0ffw5h17k478f5kcs53g4dyfc3s";
-    }
-  )];
-
+  nativeBuildInputs = [ setuptools setuptools-scm ];
   build-system = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix
index 0527e90f2636..25be1098eb9d 100644
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "unearth";
-  version = "0.15.1";
+  version = "0.15.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hj3rMznA1lpb4NCtLGfUbV9XSnmOdO8FUr8R0pijCrs=";
+    hash = "sha256-OB8+aWnbCyjZ/C+/shaGBXm/NBvWlUcvLGLivM6ebT0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/yowsup/default.nix b/pkgs/development/python-modules/yowsup/default.nix
index bc79ff51823f..a88a296944a5 100644
--- a/pkgs/development/python-modules/yowsup/default.nix
+++ b/pkgs/development/python-modules/yowsup/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, pythonOlder
 , isPy3k
 , fetchFromGitHub
 , appdirs
@@ -7,6 +8,7 @@
 , protobuf
 , python-axolotl
 , six
+, pyasyncore
 , pytestCheckHook
 }:
 
@@ -42,6 +44,9 @@ buildPythonPackage rec {
     protobuf
     python-axolotl
     six
+  ]
+  ++ lib.optionals (!pythonOlder "3.12") [
+    pyasyncore
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/r-modules/bioc-packages.nix b/pkgs/development/r-modules/bioc-packages.nix
index 818fa41a432f..982c6b793749 100644
--- a/pkgs/development/r-modules/bioc-packages.nix
+++ b/pkgs/development/r-modules/bioc-packages.nix
@@ -1730,7 +1730,7 @@ in with self; {
   multiHiCcompare = derive2 { name="multiHiCcompare"; version="1.20.0"; sha256="152h62f41r2lay2zpnllsfamy0m63w5bi5gnyy7q32rhmq9z2k3b"; depends=[aggregation BiocParallel data_table dplyr edgeR GenomeInfoDb GenomeInfoDbData GenomicRanges HiCcompare pbapply pheatmap qqman]; };
   multiMiR = derive2 { name="multiMiR"; version="1.24.0"; sha256="0mxih9nfjmgq3zd2c08ahwhnx3ahynj9phyrii6chllm3jcsfx15"; depends=[AnnotationDbi BiocGenerics dplyr purrr RCurl tibble XML]; };
   multiWGCNA = derive2 { name="multiWGCNA"; version="1.0.0"; sha256="1jp8amw31l45b2h9b138rmbzc43xx2swfs5pnlqladnnzwsbxvn3"; depends=[cowplot data_table dcanr dplyr flashClust ggalluvial ggplot2 ggrepel igraph patchwork readr reshape2 scales stringr SummarizedExperiment WGCNA]; };
-  multicrispr = derive2 { name="multicrispr"; version="1.12.3"; sha256="13ahvfxp5jkjrhdp3bz480h2k3m055brni22dbl3144f9lnyrw5b"; depends=[assertive_base assertive_files assertive_numbers assertive_sets BiocGenerics Biostrings BSgenome CRISPRseek data_table GenomeInfoDb GenomicFeatures GenomicRanges ggplot2 karyoploteR magrittr plyranges Rbowtie reticulate rtracklayer stringi tidyr tidyselect]; };
+  multicrispr = derive2 { name="multicrispr"; version="1.12.9"; sha256="1rqd4l7gh48kviy9r5g5v6iq36p1h3gid9f250ps3zygc809garm"; depends=[BiocGenerics Biostrings BSgenome CRISPRseek data_table GenomeInfoDb GenomicFeatures GenomicRanges ggplot2 karyoploteR magrittr plyranges Rbowtie reticulate rtracklayer stringi tidyr tidyselect]; };
   multiscan = derive2 { name="multiscan"; version="1.62.0"; sha256="09shs3hpa285v3hsbrncljxs02dm10qcbnnx9ss6b16gbs6d34wi"; depends=[Biobase]; };
   multtest = derive2 { name="multtest"; version="2.58.0"; sha256="0s8x2rg2xp6awg2cikybgxrxpi9f91jah7dskk5dnfkazd20di4j"; depends=[Biobase BiocGenerics MASS survival]; };
   mumosa = derive2 { name="mumosa"; version="1.10.0"; sha256="1mmhfy8lh1yd02vgw9bg32850sb5l875as8bv3xgq55c78ishlgv"; depends=[batchelor beachmat BiocGenerics BiocNeighbors BiocParallel BiocSingular DelayedArray DelayedMatrixStats igraph IRanges Matrix metapod S4Vectors ScaledMatrix scran scuttle SingleCellExperiment SummarizedExperiment uwot]; };
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index e2b2e7feea00..cf3cd20a5ed9 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -313,9 +313,9 @@ let
 
   packagesWithNativeBuildInputs = {
     adbcpostgresql = [ pkgs.postgresql ];
-    arrow = [ pkgs.pkg-config pkgs.arrow-cpp ];
     adimpro = [ pkgs.imagemagick ];
     animation = [ pkgs.which ];
+    arrow = with pkgs; [ pkg-config cmake ] ++ lib.optionals stdenv.isDarwin [ intltool ];
     audio = [ pkgs.portaudio ];
     BayesSAE = [ pkgs.gsl ];
     BayesVarSel = [ pkgs.gsl ];
@@ -960,6 +960,7 @@ let
     "paxtoolsr"
     "systemPipeShiny"
     "matlab2r"
+    "GNOSIS"
   ];
 
   packagesToSkipCheck = [
@@ -1017,6 +1018,27 @@ let
   ];
 
   otherOverrides = old: new: {
+    # it can happen that the major version of arrow-cpp is ahead of the
+    # rPackages.arrow that would be built from CRAN sources; therefore, to avoid
+    # build failures and manual updates of the hash, we use the R source at
+    # the GitHub release state of libarrow (arrow-cpp) in Nixpkgs. This may
+    # not exactly represent the CRAN sources, but because patching of the
+    # CRAN R package is mostly done to meet special CRAN build requirements,
+    # this is a straightforward approach. Example where patching was necessary
+    # -> arrow 14.0.0.2 on CRAN; was lagging behind libarrow release:
+    #   https://github.com/apache/arrow/issues/39698 )
+    arrow = old.arrow.overrideAttrs (attrs: {
+      src = pkgs.arrow-cpp.src;
+      name = "r-arrow-${pkgs.arrow-cpp.version}";
+      prePatch = "cd r";
+      postPatch = ''
+        patchShebangs configure
+      '';
+      buildInputs = attrs.buildInputs ++ [
+        pkgs.arrow-cpp
+      ];
+    });
+
     gifski = old.gifski.overrideAttrs (attrs: {
       cargoDeps = pkgs.rustPlatform.fetchCargoTarball {
         src = attrs.src;
@@ -1471,15 +1493,10 @@ let
     });
 
     SICtools = old.SICtools.overrideAttrs (attrs: {
-      preConfigure = ''
-        substituteInPlace src/Makefile --replace "-lcurses" "-lncurses"
-      '';
-    });
-
-    arrow = old.arrow.overrideAttrs (attrs: {
-      preConfigure = ''
-        patchShebangs configure
+      postPatch = ''
+        substituteInPlace src/Makefile --replace-fail "-lcurses" "-lncurses"
       '';
+      hardeningDisable = [ "format" ];
     });
 
     ROracle = old.ROracle.overrideAttrs (attrs: {
diff --git a/pkgs/development/tools/castxml/default.nix b/pkgs/development/tools/castxml/default.nix
index 0547df5d4cc5..bceafd504dcc 100644
--- a/pkgs/development/tools/castxml/default.nix
+++ b/pkgs/development/tools/castxml/default.nix
@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "castxml";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "CastXML";
     repo = "CastXML";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6xeMkqsFchZxrAsE2DLaIzGU4VMwyDckm00s69wahOo=";
+    hash = "sha256-r9Emh2KHjANrg+oWeY8Ags3Gd8k3W68J88bAud+AH6I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/electron/binary/default.nix b/pkgs/development/tools/electron/binary/default.nix
index 4386c7fdf5bc..41b3f1022e06 100644
--- a/pkgs/development/tools/electron/binary/default.nix
+++ b/pkgs/development/tools/electron/binary/default.nix
@@ -15,22 +15,22 @@ rec {
     headers = "009p1ffh2cyn98fcmprrjzq79jysp7h565v4f54wvjxjsq2nkr97";
   };
 
-  electron_27-bin = mkElectron "27.3.10" {
-    armv7l-linux = "bb739ce18a9e09225e8e0e1889cf1ab35fefda4ec7c2b60bdda271e58c921271";
-    aarch64-linux = "f1783e222074de33fea2188a86499d6a9d8b1aceec3bbd85a17913817a5bd356";
-    x86_64-linux = "dcfe17763071f1ec694155176f9156d625e6a69ccc32253b6576ca65111783c0";
-    x86_64-darwin = "5f469975f5ed68001dedc0383b94562c0a29e05b885427f20187625251cb83cb";
-    aarch64-darwin = "cb0e524b14f0f882a61cdcc46d7f3563ce115158501caaf2e8642f647c1eed6d";
-    headers = "12in54rg4dr8lh5dm9xx00w6cvbzgnylq7hjp2jwbj339xsgnqjz";
+  electron_27-bin = mkElectron "27.3.11" {
+    armv7l-linux = "012127a3edf79e0e4623a08e853286e1cba512438a0414b1ab19b75d929c1cf2";
+    aarch64-linux = "ddbfcd5e04450178ca4e3113f776893454822af6757761adc792692f7978e0df";
+    x86_64-linux = "e3a6f55e54e7a623bba1a15016541248408eef5a19ab82a59d19c807aab14563";
+    x86_64-darwin = "357e70a1c8848d4ac7655346bec98dd18a7c0cee82452a7edf76142017779049";
+    aarch64-darwin = "a687b199fcb9890f43af90ac8a4d19dc7b15522394de89e42abd5f5c6b735804";
+    headers = "0vrjdvqllfyz09sw2y078mds1di219hnmska8bw8ni7j35wxr2br";
   };
 
-  electron_28-bin = mkElectron "28.3.0" {
-    armv7l-linux = "aa74e7240929ebfa817d03e025e117f7a0600c99e6ad9bc339eaf22b0144a71c";
-    aarch64-linux = "9ec29245bcbbd0007029b4a3f7976b209968dbaa6443406afbf208b1a5abf094";
-    x86_64-linux = "e5003391ffc5161f6d9987ed29fa97532142544326f15fbf90ee43daabeba639";
-    x86_64-darwin = "7d6a0f6a7ec606d1caa0e63a99e4c6103a3fedb6e05735f81a03aa8da099a420";
-    aarch64-darwin = "a0eb07c006b593be8f76f7f6ad7cb8ac619ec173d341ad4c3ca5e52b38dab8b8";
-    headers = "12z94fz4zyypjkjx5l8n0qxd7r5jsny19i4ray60mn5cd7j019z8";
+  electron_28-bin = mkElectron "28.3.1" {
+    armv7l-linux = "2e22fbab2376a9bbeb8cbdd7d9bb3ca69fda6adeafa2b22ffb67157fcfcdb6ff";
+    aarch64-linux = "3e46c3076041386213f7b9ebc12335889fbad5822ffc306cf7514abb88de8512";
+    x86_64-linux = "e3be93e1a15d61f72e074aee021e12f20465b81f51b8c1170bd9072d7d695c3a";
+    x86_64-darwin = "bd8a220fd906625ad4a8edf92e80e8eff89d51f40c22168e05090daa7c12bd66";
+    aarch64-darwin = "53fc040cd09e955e013254f784cf51712029ded4a574559cf5fa19c9a911d75d";
+    headers = "07iv5fh0yxv17c1akb2j4ab5xhv29d9zsgi6dm2r0n4pnf72wxwr";
   };
 
   electron_29-bin = mkElectron "29.3.0" {
diff --git a/pkgs/development/tools/electron/common.nix b/pkgs/development/tools/electron/common.nix
index 19f0dd427023..9aa3b1c932de 100644
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@@ -216,7 +216,7 @@ in (chromium.override { upstream-info = info.chromium; }).mkDerivation (base: {
     homepage = "https://github.com/electron/electron";
     platforms = lib.platforms.linux;
     license = licenses.mit;
-    maintainers = with maintainers; [ yuka ];
+    maintainers = with maintainers; [ yayayayaka yuka ];
     mainProgram = "electron";
     hydraPlatforms = lib.optionals (!(hasInfix "alpha" info.version) && !(hasInfix "beta" info.version)) ["aarch64-linux" "x86_64-linux"];
     timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index 67708aa5d43b..0304f0bbec43 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -3,10 +3,10 @@
         "deps": {
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-AHiOejVRSeJ14Xn+A6yjfICbERDPr/eCbBq+2qPjGDc=",
+                "hash": "sha256-Y0uNoq5LhlFMxQfqrTjzOokbB7Y6UUAlBCj+Nghiz5w=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v28.3.0"
+                "rev": "v28.3.1"
             },
             "src": {
                 "fetcher": "fetchFromGitiles",
@@ -873,7 +873,7 @@
                 "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
             }
         },
-        "version": "28.3.0",
+        "version": "28.3.1",
         "modules": "119",
         "chrome": "120.0.6099.291",
         "node": "18.18.2",
@@ -895,10 +895,10 @@
         "deps": {
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-vCM74wty0JN4PL9snwa4oFbNebA3cMZ8lorXz5DIVcE=",
+                "hash": "sha256-DmDAKUUyiDASGGylDVQe2OkDVfiA1ficDG+oaMbKqdo=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v27.3.10"
+                "rev": "v27.3.11"
             },
             "src": {
                 "fetcher": "fetchFromGitiles",
@@ -1765,7 +1765,7 @@
                 "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
             }
         },
-        "version": "27.3.10",
+        "version": "27.3.11",
         "modules": "118",
         "chrome": "118.0.5993.159",
         "node": "18.17.1",
diff --git a/pkgs/development/tools/infisical/default.nix b/pkgs/development/tools/infisical/default.nix
index f19b021ed3a3..849144616f92 100644
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
@@ -15,7 +15,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # the version of infisical
-  version = "0.20.1";
+  version = "0.21.1";
 
   # the platform-specific, statically linked binary
   src =
diff --git a/pkgs/development/tools/infisical/hashes.json b/pkgs/development/tools/infisical/hashes.json
index 6b23b59dbf97..728568f1ee1a 100644
--- a/pkgs/development/tools/infisical/hashes.json
+++ b/pkgs/development/tools/infisical/hashes.json
@@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-W5k/xGL6R4ox9XQShWl2PqpvbJYIqeM4Qx3bG+5HpAo="
-, "x86_64-darwin": "sha256-sFGKUh4qkj5EZ5NE6wQqO2TAmHuMH4qgcdJlx92ygr8="
-, "aarch64-linux": "sha256-t80Nt1YXwmcjagZRaPgXH4m7D5sKhwLz9YcX6cOArRQ="
-, "aarch64-darwin": "sha256-INNcqrCy5px9vwh6yM03baSgj2uHgPrbKAatGl84R5M="
+, "x86_64-linux": "sha256-HdjqoT+iDYwQQlNZIPcC4j76bCh1k1+Axz46Hq2FNoE="
+, "x86_64-darwin": "sha256-X3QXlW0yqYuc3MLYesxNiWGz79r/fHO0mdwyZ3DyPKU="
+, "aarch64-linux": "sha256-osy/9dhSme4dyVeBWGjwfMt0YJVPLwV7rYu6ePkhFOs="
+, "aarch64-darwin": "sha256-O/F2xErHSFfeK6mamjFDstHW1yBpnfl/slWa1hQ159s="
 }
diff --git a/pkgs/development/tools/parsing/re-flex/default.nix b/pkgs/development/tools/parsing/re-flex/default.nix
index 3a69cb18803c..2f989d9bfb1e 100644
--- a/pkgs/development/tools/parsing/re-flex/default.nix
+++ b/pkgs/development/tools/parsing/re-flex/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re-flex";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = "RE-flex";
     rev = "v${version}";
-    hash = "sha256-+/Q3lcdV4tEArYmuQN5iL6r5TS0J/zoLQ85bNazpSf8=";
+    hash = "sha256-tWV7HnIeTao3IbT2xxsu+//4aLQLKP/+ySqrvzU139c=";
   };
 
   outputs = [ "out" "bin" "dev" ];
diff --git a/pkgs/development/tools/renderdoc/default.nix b/pkgs/development/tools/renderdoc/default.nix
index f98d9ce201c3..a5bc15ef3165 100644
--- a/pkgs/development/tools/renderdoc/default.nix
+++ b/pkgs/development/tools/renderdoc/default.nix
@@ -32,13 +32,13 @@ let
 in
 mkDerivation rec {
   pname = "renderdoc";
-  version = "1.31";
+  version = "1.32";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${version}";
-    sha256 = "sha256-R9TMkq9bFRyA7oaPPp0zcUf+ovveLCcuxrm7EokyTbc=";
+    sha256 = "sha256-8Q2QMANieY/Bvb50NtlZEN/Nmd6xurU6AJU0Uo8qDTs=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/tools/rust/cargo-show-asm/default.nix b/pkgs/development/tools/rust/cargo-show-asm/default.nix
index 1e313595358f..bd08268d5928 100644
--- a/pkgs/development/tools/rust/cargo-show-asm/default.nix
+++ b/pkgs/development/tools/rust/cargo-show-asm/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-show-asm";
-  version = "0.2.31";
+  version = "0.2.32";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-TjkEzqGFqhVKMmZEcwAoDnHOZWi7+wha228loJjLxgQ=";
+    hash = "sha256-4pMIL/wru9uE8Uyp/qvmo6IJxFcB0HLUHRSSV6DoI3g=";
   };
 
-  cargoHash = "sha256-oUfBpx/hElXMw58Dj09JeG2FKy+biFt+4pb4pYNidxc=";
+  cargoHash = "sha256-N1NZONY8y88diAbWn+UaSHGpd4r7naxFWVmCyJkL3tQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/web/function-runner/default.nix b/pkgs/development/web/function-runner/default.nix
index ba1be2863f81..1eb7dff5b2e2 100644
--- a/pkgs/development/web/function-runner/default.nix
+++ b/pkgs/development/web/function-runner/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "function-runner";
-  version = "4.2.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-33UVo7mPD/o3Z/R5PFhosiSLFLLpJ0pHqUbKtX6THJE=";
+    sha256 = "sha256-Li3v3kXze0KgK16XVwdshZWaRF89YSC1Yk9iHXfGWKI=";
   };
 
-  cargoHash = "sha256-TNbGmqITCk1VKVuO46LxO+zjAG7Laguq7EAruuhJIxk=";
+  cargoHash = "sha256-jPiy4ULEfF/aRhWV1j2SOIe2u9uctEsmzWQ6MLXRu7A=";
 
   meta = with lib; {
     description = "A CLI tool which allows you to run Wasm Functions intended for the Shopify Functions infrastructure";
diff --git a/pkgs/misc/screensavers/slock/default.nix b/pkgs/misc/screensavers/slock/default.nix
index 782557625338..e86358d2e4ea 100644
--- a/pkgs/misc/screensavers/slock/default.nix
+++ b/pkgs/misc/screensavers/slock/default.nix
@@ -2,7 +2,10 @@
 , xorgproto, libX11, libXext, libXrandr, libxcrypt
 # default header can be obtained from
 # https://git.suckless.org/slock/tree/config.def.h
-, conf ? null }:
+, conf ? null
+# update script dependencies
+, gitUpdater
+}:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slock";
@@ -25,6 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [ "CC:=$(CC)" ];
 
+  passthru.updateScript = gitUpdater {
+    url = "git://git.suckless.org/slock";
+  };
+
   meta = with lib; {
     homepage = "https://tools.suckless.org/slock";
     description = "Simple X display locker";
@@ -33,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       Simple X display locker. This is the simplest X screen locker.
     '';
     license = licenses.mit;
-    maintainers = with maintainers; [ astsmtl ];
+    maintainers = with maintainers; [ astsmtl qusic ];
     platforms = platforms.linux;
   };
 })
diff --git a/pkgs/servers/home-assistant/parse-requirements.py b/pkgs/servers/home-assistant/parse-requirements.py
index 4a54f351ac49..404120d062ac 100755
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ packaging rich ])" -p nodePackages.pyright ruff isort
+#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ packaging rich ])" -p pyright ruff isort
 #
 # This script downloads Home Assistant's source tarball.
 # Inside the homeassistant/components directory, each integration has an associated manifest.json,
diff --git a/pkgs/servers/home-assistant/update.py b/pkgs/servers/home-assistant/update.py
index c0c3cfdef993..c9b9eb183890 100755
--- a/pkgs/servers/home-assistant/update.py
+++ b/pkgs/servers/home-assistant/update.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=channel:nixpkgs-unstable -i python3 -p "python3.withPackages (ps: with ps; [ aiohttp packaging ])" -p git nurl nodePackages.pyright ruff isort
+#!nix-shell -I nixpkgs=channel:nixpkgs-unstable -i python3 -p "python3.withPackages (ps: with ps; [ aiohttp packaging ])" -p git nurl pyright ruff isort
 
 import asyncio
 import json
diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index ea840413f5ef..b1b228a37ec9 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -10,15 +10,15 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-oZI2nvxvxOiv9F9c2AaP9hEBVd3kV4tjuEmvaR5V0Lc=";
-    arm64-linux_hash = "sha256-Pquc/b/VXJEi4N8uOfvg4X1083JaOdCXg2IPAGZAMV0=";
-    x64-osx_hash = "sha256-HHmx8bI4d+xmL63v/qmUIJDt+laoSs5Iqp+I7OzoU/k=";
-    arm64-osx_hash = "sha256-Us/ZEDlZ96/ybs8lxnl4bSFICwc9xJtXScA+hGEwfWk=";
+    x64-linux_hash = "sha256-eFJ31tZPxzK1Vx2EOZ1AMrzCUL7pXJIb5J1joL/ZIgs=";
+    arm64-linux_hash = "sha256-BtxHBHc2dYYdqZxwga7K49aGfSq5a8Z1TLjMPH4ldlw=";
+    x64-osx_hash = "sha256-GQ8wHU4wWu6fpjiLI9yQyMvhP1DS5FE+YQu2uLFdto4=";
+    arm64-osx_hash = "sha256-AnZ+mGeafJsRb6Koj0+oaER8d6vuDQ0x+Wc1eflzupo=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "radarr";
-  version = "5.3.6.8612";
+  version = "5.4.6.8723";
 
   src = fetchurl {
     url = "https://github.com/Radarr/Radarr/releases/download/v${version}/Radarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/web-apps/kavita/change-webroot.diff b/pkgs/servers/web-apps/kavita/change-webroot.diff
index 30e91134bd56..7c31e6844c63 100644
--- a/pkgs/servers/web-apps/kavita/change-webroot.diff
+++ b/pkgs/servers/web-apps/kavita/change-webroot.diff
@@ -1,5 +1,5 @@
 diff --git a/API/Controllers/FallbackController.cs b/API/Controllers/FallbackController.cs
-index 0c925476..c7b30f39 100644
+index 0c92547..d54abb9 100644
 --- a/API/Controllers/FallbackController.cs
 +++ b/API/Controllers/FallbackController.cs
 @@ -22,7 +22,7 @@ public class FallbackController : Controller
@@ -12,20 +12,20 @@ index 0c925476..c7b30f39 100644
  }
  
 diff --git a/API/Services/DirectoryService.cs b/API/Services/DirectoryService.cs
-index 15afddf9..aff1f230 100644
+index e3dede8..8ec6358 100644
 --- a/API/Services/DirectoryService.cs
 +++ b/API/Services/DirectoryService.cs
-@@ -113,7 +113,7 @@ public class DirectoryService : IDirectoryService
+@@ -117,7 +117,7 @@ public class DirectoryService : IDirectoryService
          ExistOrCreate(SiteThemeDirectory);
          FaviconDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "config", "favicons");
          ExistOrCreate(FaviconDirectory);
 -        LocalizationDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "I18N");
 +        LocalizationDirectory = FileSystem.Path.Join("@out@/lib/kavita-backend", "I18N");
-     }
- 
-     /// <summary>
+         CustomizedTemplateDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "config", "templates");
+         ExistOrCreate(CustomizedTemplateDirectory);
+         TemplateDirectory = FileSystem.Path.Join(FileSystem.Directory.GetCurrentDirectory(), "EmailTemplates");
 diff --git a/API/Services/LocalizationService.cs b/API/Services/LocalizationService.cs
-index ab3ad3d8..ac813a69 100644
+index ab3ad3d..f1a068b 100644
 --- a/API/Services/LocalizationService.cs
 +++ b/API/Services/LocalizationService.cs
 @@ -52,8 +52,7 @@ public class LocalizationService : ILocalizationService
@@ -39,7 +39,7 @@ index ab3ad3d8..ac813a69 100644
  
          _cacheOptions = new MemoryCacheEntryOptions()
 diff --git a/API/Startup.cs b/API/Startup.cs
-index 939bfb58..1adb9373 100644
+index 3b872f3..424984c 100644
 --- a/API/Startup.cs
 +++ b/API/Startup.cs
 @@ -36,6 +36,7 @@ using Microsoft.AspNetCore.StaticFiles;
@@ -50,7 +50,7 @@ index 939bfb58..1adb9373 100644
  using Microsoft.Extensions.Hosting;
  using Microsoft.Extensions.Logging;
  using Microsoft.Net.Http.Headers;
-@@ -298,9 +299,6 @@ public class Startup
+@@ -295,9 +296,6 @@ public class Startup
          app.UsePathBase(basePath);
          if (!env.IsDevelopment())
          {
@@ -60,7 +60,7 @@ index 939bfb58..1adb9373 100644
              // Update DB with what's in config
              var dataContext = serviceProvider.GetRequiredService<DataContext>();
              var setting = dataContext.ServerSetting.SingleOrDefault(x => x.Key == ServerSettingKey.BaseUrl);
-@@ -333,6 +334,7 @@ public class Startup
+@@ -341,6 +339,7 @@ public class Startup
  
          app.UseStaticFiles(new StaticFileOptions
          {
@@ -68,7 +68,7 @@ index 939bfb58..1adb9373 100644
              ContentTypeProvider = new FileExtensionContentTypeProvider(),
              HttpsCompression = HttpsCompressionMode.Compress,
              OnPrepareResponse = ctx =>
-@@ -394,7 +396,7 @@ public class Startup
+@@ -410,7 +409,7 @@ public class Startup
          try
          {
              var htmlDoc = new HtmlDocument();
diff --git a/pkgs/servers/web-apps/kavita/default.nix b/pkgs/servers/web-apps/kavita/default.nix
index cf9e80c89d3e..2213b2560ede 100644
--- a/pkgs/servers/web-apps/kavita/default.nix
+++ b/pkgs/servers/web-apps/kavita/default.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kavita";
-  version = "0.7.13";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "kareadita";
     repo = "kavita";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-S4lJTLxNjGmgBJt89i3whBglMU2EQ0VelLG6iP6bY8g=";
+    hash = "sha256-0pVQ/gezi8Hzxrn/1QVFTOXeHRCayYkA3Kh5b81oW34=";
   };
 
   backend = buildDotnetModule {
@@ -51,7 +51,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     npmBuildScript = "prod";
     npmFlags = [ "--legacy-peer-deps" ];
     npmRebuildFlags = [ "--ignore-scripts" ]; # Prevent playwright from trying to install browsers
-    npmDepsHash = "sha256-jseoczC2Ay3D1wDUZbWXTYQJGSWdgobJ3+Z1bp+PQG4=";
+    npmDepsHash = "sha256-yy4vEI+aDgAcCyXyzfPm31oGiTl+Gsycyh69D3yex2I=";
   };
 
   dontBuild = true;
diff --git a/pkgs/servers/web-apps/kavita/nuget-deps.nix b/pkgs/servers/web-apps/kavita/nuget-deps.nix
index b8c8edf8bee3..9a85ef26b24f 100644
--- a/pkgs/servers/web-apps/kavita/nuget-deps.nix
+++ b/pkgs/servers/web-apps/kavita/nuget-deps.nix
@@ -4,37 +4,39 @@
 { fetchNuGet }: [
   (fetchNuGet { pname = "AutoMapper"; version = "12.0.1"; sha256 = "0s0wjl4ck3sal8a50x786wxs9mbca7bxaqk3558yx5wpld4h4z3b"; })
   (fetchNuGet { pname = "AutoMapper.Extensions.Microsoft.DependencyInjection"; version = "12.0.1"; sha256 = "0gjsjgfmfa3xx773idh7nxly4mz9ragiy0dqsc9xfzy7b5mlzw91"; })
+  (fetchNuGet { pname = "BouncyCastle.Cryptography"; version = "2.3.0"; sha256 = "1zdik0ifv2ir958ks7hgm9p11axwlkvbhw7vr98z24a009x4x02c"; })
+  (fetchNuGet { pname = "Cronos"; version = "0.8.4"; sha256 = "0gy75x1jb3ks2i9czb0sl5zdgf7mg14fn8174klb7jfhm5rcpnig"; })
+  (fetchNuGet { pname = "CsvHelper"; version = "31.0.3"; sha256 = "0ldq5715gj1j2w5qr2x28i6kfqfqk1zllhwcy2w1km2d8pvsdf1f"; })
   (fetchNuGet { pname = "Docnet.Core"; version = "2.6.0"; sha256 = "1b1nj984ly4zgj28fri1a6ych9sdiacxkms8pvzsclvyxkf0ri8m"; })
   (fetchNuGet { pname = "DotNet.Glob"; version = "3.1.3"; sha256 = "1klgj9m7i3g8x1yj96wnikvf0hlvr6rhqhl4mgis08imcrl95qg6"; })
   (fetchNuGet { pname = "EasyCaching.Core"; version = "1.9.2"; sha256 = "0qkzaxmn899hhfh32s8mhg3zcqqy2p05kaaldz246nram5gvf7qp"; })
   (fetchNuGet { pname = "EasyCaching.InMemory"; version = "1.9.2"; sha256 = "0ifcnmd3hqy44jvfwy3zzjccsxqalfv6clmj0clp9yln3js51awq"; })
-  (fetchNuGet { pname = "ExCSS"; version = "4.2.4"; sha256 = "04x3kaiywnjih8vrg5qafwvzgcsvshay8v3i2lv2ddkl6lnawh5n"; })
+  (fetchNuGet { pname = "ExCSS"; version = "4.2.5"; sha256 = "0p4456qkkxx9448y16xisj43a7syrq79wii2jnyqp2jm64wz5yb0"; })
   (fetchNuGet { pname = "Flurl"; version = "3.0.6"; sha256 = "1y82lbag0gkfpj361psk5761hn7k0zmrp9cpdvnjyp75bdimiaiy"; })
   (fetchNuGet { pname = "Flurl"; version = "3.0.7"; sha256 = "1i56774jsy2qlk573vzvcpjh5hf22yrhxs694j1c4gwggarnqz16"; })
   (fetchNuGet { pname = "Flurl.Http"; version = "3.2.4"; sha256 = "0vp5a1rrfi28in775d7fac96rcrikzjd2gbz0k3p925y1f2wlw5k"; })
-  (fetchNuGet { pname = "Hangfire"; version = "1.8.7"; sha256 = "11ygahx9bjd1y33cmihk5h7aggwcm7hvnzkg11cq066mrcrlzqr9"; })
-  (fetchNuGet { pname = "Hangfire.AspNetCore"; version = "1.8.7"; sha256 = "0lwvvk3d0rbghdk3k7r1z9a7hi6yagxynmzlp5bmb8raw5qx7q13"; })
-  (fetchNuGet { pname = "Hangfire.Core"; version = "1.6.1"; sha256 = "0rg4lzzckscck9gvjqhcn1yq9qymfs4dfkv6fwgnklyfpvxmsqbq"; })
+  (fetchNuGet { pname = "Hangfire"; version = "1.8.12"; sha256 = "0hbd21smpsb4vzi1y21zx4b51nd5z8isni0s0s2s78msgfh81a9b"; })
+  (fetchNuGet { pname = "Hangfire.AspNetCore"; version = "1.8.12"; sha256 = "1jaiz0nfmfjp9vr3x62qjgkwb2rk0jlzgl74ja089yaq6n3jwrqc"; })
   (fetchNuGet { pname = "Hangfire.Core"; version = "1.6.17"; sha256 = "0kr2hjnl9c4dpk4kf95jxcgsxalvixfm6xis37qn5ja9n9ygqans"; })
   (fetchNuGet { pname = "Hangfire.Core"; version = "1.8.0"; sha256 = "047g50s2nz32dnpqm9lnsvpgz8g3azip2mpc6s15wb78b8c9s48n"; })
-  (fetchNuGet { pname = "Hangfire.Core"; version = "1.8.7"; sha256 = "0f5l55sbw0shp0l9zv2h98l8ghvvhgdgqqwcq3rdlpapcv0w3z5j"; })
-  (fetchNuGet { pname = "Hangfire.InMemory"; version = "0.7.0"; sha256 = "0c6icc14kw5lybk2fqprks37vs3sv4j1acn8z12p3b62cxc2a3bb"; })
+  (fetchNuGet { pname = "Hangfire.Core"; version = "1.8.12"; sha256 = "19bbk3cqd1vw2x94gilvgwfjgl9yr5nvy8y4hjngx93jg563i17y"; })
+  (fetchNuGet { pname = "Hangfire.InMemory"; version = "0.8.1"; sha256 = "1i1j4mysk636dmf0p41w5bvi1i2nmr39svwj8svyqhij4yhih019"; })
   (fetchNuGet { pname = "Hangfire.MaximumConcurrentExecutions"; version = "1.1.0"; sha256 = "181147h5dsbml58ffq1jc7k6012fahi0n20wply9gmn6v1dh8h66"; })
-  (fetchNuGet { pname = "Hangfire.MemoryStorage.Core"; version = "1.4.0"; sha256 = "1hw8dlclxgg21ay1pqj9mxxm3alm03k9wxaz055lb14w3nzyma3c"; })
-  (fetchNuGet { pname = "Hangfire.NetCore"; version = "1.8.7"; sha256 = "09p53pm7z3v549w7bb85qf66wg62nx0gxy6rgkgk2lbyabacyi1a"; })
-  (fetchNuGet { pname = "Hangfire.SqlServer"; version = "1.8.7"; sha256 = "0kzddl3r5rxx1m95skj7hkimzkz9x57b51bhkq1yhvchjd9j5wzj"; })
-  (fetchNuGet { pname = "Hangfire.Storage.SQLite"; version = "0.4.0"; sha256 = "0kyyisvvx8m40wmfay1kcrzqwr3hhdlkppadkwsgk0r892d5drqw"; })
-  (fetchNuGet { pname = "HtmlAgilityPack"; version = "1.11.57"; sha256 = "0brswm659d2vb11021z7xylljlnaf344yf5q093bqxyhbxva8ijq"; })
+  (fetchNuGet { pname = "Hangfire.NetCore"; version = "1.8.12"; sha256 = "19987w1nng7mr5r66y5523q67ig2xb98im4b1ahqsc5s9mwkm0qh"; })
+  (fetchNuGet { pname = "Hangfire.SqlServer"; version = "1.8.12"; sha256 = "0h68hz7bzbypff1sg5hq1b0pfg7ckz506rfsiphqninrpczc9zsa"; })
+  (fetchNuGet { pname = "Hangfire.Storage.SQLite"; version = "0.4.1"; sha256 = "029prxla8mpck49rxk2rygns958xpss5lg1lizws2nm8q547kwil"; })
+  (fetchNuGet { pname = "HtmlAgilityPack"; version = "1.11.60"; sha256 = "0jpv1vry0mfwbswxn70knbkzsrwwz2ijsm5d4rj9jf2kk37m0xga"; })
   (fetchNuGet { pname = "Humanizer.Core"; version = "2.14.1"; sha256 = "1ai7hgr0qwd7xlqfd92immddyi41j3ag91h3594yzfsgsy6yhyqi"; })
+  (fetchNuGet { pname = "MailKit"; version = "4.4.0"; sha256 = "0v0hzvzxw960j7j5y4sns4v9zawhcbs558drrihmhp1a8al0cjk4"; })
   (fetchNuGet { pname = "MarkdownDeep.NET.Core"; version = "1.5.0.4"; sha256 = "0cpshs1lwmyyg40lvnf4b9s1z7yaw6s4a0341qr4ww40791gzvrl"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.Abstractions"; version = "2.2.0"; sha256 = "0vj7fhpk0d95nkkxz4q0rma6pb4ym96mx6nms4603y0l19h0k5yh"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.JwtBearer"; version = "8.0.1"; sha256 = "0519873g49gdbhnqizgxlikifcgswr09ybrh0wcwhbwiqnx49dg9"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.OpenIdConnect"; version = "8.0.1"; sha256 = "0n9x563ihvkp7cncwzlnyzm6zwxm6nsm8hv0j6f66jv7vzmcsq0q"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.JwtBearer"; version = "8.0.4"; sha256 = "1q2ai2jqc4zc2bdrbjng9fb7n0pch4f8bap3drd1v2vrha0d2r3q"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Authentication.OpenIdConnect"; version = "8.0.4"; sha256 = "1gscq70xqnv2sv5ka8m754mzq875qp3r45bfl36jfa6ag0ivjxsb"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Authorization"; version = "2.2.0"; sha256 = "1mpq8pmxlxfa625k2ghv6xcyy2wdpwv56xzya9mvmlnh50h1i8rx"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Authorization.Policy"; version = "2.2.0"; sha256 = "1d1zh65kfjf81j21ssmhr465vx08bra8424vgnrb22gdx03mhwd2"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Connections.Abstractions"; version = "2.2.0"; sha256 = "1rl94r8b0zq14f3dhfnvfjj1ivr81iw9zh5kdgs3zkdv0xc9x21j"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.Internal"; version = "8.0.1"; sha256 = "1gc2y4v1cvayy2fai02gsv1z6fr58kxb5jnmbjqxnd0zf49m88j7"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.KeyDerivation"; version = "8.0.1"; sha256 = "0fnvim0rmiw9jm8xvajb5b9w4wawp95szy2dfh2aw1n8jgzs207x"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.Internal"; version = "8.0.4"; sha256 = "0nb87rimc7brciav6ngfcx3g2k0g903fmax3w408m5dm8fan2ysp"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Cryptography.KeyDerivation"; version = "8.0.4"; sha256 = "1l9lvyw81f6ckby1q3wy1677jdcp46i25m58qpkma7wd1gmg36pg"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Hosting.Abstractions"; version = "2.2.0"; sha256 = "043k651vbfshh3s997x42ymj8nb32419m7q3sjw5q2c27anrhfhv"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Hosting.Server.Abstractions"; version = "2.2.0"; sha256 = "0nz73bwrvhc1n7gd7xxm3p5ww2wx9qr9m9i43y20gh0c54adkygh"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http"; version = "2.2.0"; sha256 = "1fcrafpa57sab3as18idqknzlxkx49n4sxzlzik3sj6pcji5j17q"; })
@@ -43,7 +45,7 @@
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Connections.Common"; version = "1.1.0"; sha256 = "0x3hq0d3bs6n46nfvbd5n4cgi6m4yjfsf3k25xjcc8gcj66072iy"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Extensions"; version = "2.2.0"; sha256 = "118gp1mfb8ymcvw87fzgjqwlc1d1b0l0sbfki291ydg414cz3dfn"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Http.Features"; version = "2.2.0"; sha256 = "0xrlq8i61vzhzzy25n80m7wh2kn593rfaii3aqnxdsxsg6sfgnx1"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.Identity.EntityFrameworkCore"; version = "8.0.1"; sha256 = "08pnswpz17pfr923p9iv6imgzb8yfhsi4g31lxrhzglagahv4hiy"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.Identity.EntityFrameworkCore"; version = "8.0.4"; sha256 = "17hmg59zk537vvp7vl59xrzjwbnlp6lb42sil7xszw7assb51795"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Routing"; version = "2.2.0"; sha256 = "12kv602j2rxp43l1v3618yz3pdd7hqc3r98ya0bqz6y2ppvhbyws"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Routing.Abstractions"; version = "2.2.0"; sha256 = "0d9wwz1rsh1fslbv1y72jpkvqv2v9n28rl3vslcg0x74lp2678ly"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.SignalR"; version = "1.1.0"; sha256 = "16p01hxcrpj7iiwcqmwjfmciyisxp1mr0qa1wcx1ja4i0m0g292l"; })
@@ -60,14 +62,14 @@
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Workspaces.Common"; version = "4.5.0"; sha256 = "1wjwsrnn5frahqciwaxsgalv80fs6xhqy6kcqy7hcsh7jrfc1kjq"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; sha256 = "0zxc0apx1gcx361jlq8smc9pfdgmyjh6hpka8dypc9w23nlsh6yj"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; sha256 = "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"; })
-  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.1"; sha256 = "1ippysjxq97vz4kd0jxiqbcamgd9xxb6n23ias5d4c7gbiwayz0z"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.1"; sha256 = "1k1c63vkzr020q0pb6xxf29xlgxldnzhlqpmpq9fig85y73s84ds"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.1"; sha256 = "1p8c2xfz8kgzswh9kq38mmy8qxfynnkywj9vwx15azbi8wcmh24x"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.1"; sha256 = "0l0fi9kiinj021sfk85qds1rdzavpkl24sjyzfyb8q8jmj5l2i0n"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.1"; sha256 = "1y21lmbnq271q7q1vsq1z5gnz4fy89zca8qzm6bg2qfv8bgqqrny"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.1"; sha256 = "12zmg196mpd0wacwyrckv6l5rl76dzmvr588i437xiwp0iyjcsh9"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.1"; sha256 = "1igwxjmzgzkzyhmg5jbis6hynnzf5vfzl00h053si89h5m6vvhmb"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.1"; sha256 = "0zg7whf02jlpcs72ngiydwd2xwwlvz3nja0xnyxv4k4w56qs8qcj"; })
+  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.4"; sha256 = "03i9b45n2vnsv4wdsk6qvjzj1ga2hcli168liyrqfa87l54skckd"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.4"; sha256 = "14a74ssvklpv9v1x023mfv3a5dncwfpw399larfp9qx7l6ifsjly"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.4"; sha256 = "1xs1cs29csnbahxgikc094xr878i8wp4h4n84xffaxms6wx5c1fb"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.4"; sha256 = "1h2bdh7cyw2z71brwjfirayd56rp3d2dx4qrhmsw573mb5jgvara"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.4"; sha256 = "1ni5qkjgarcjbqvw9cx0481fc99nna7rnp7170wq650jwm0f8c2f"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.4"; sha256 = "17v2wm6wwsl169sq6lawxhn9wvd299n1hdrxih8c3lzvi8igy4sd"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.4"; sha256 = "0h9ib00k54jmsrbhipr33q3sqd3mdiw31qi4g8vak1slal9b70zw"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.4"; sha256 = "0pa0xz96g2f99yj3x3hfj362br3zjcx3qd89ckqmymqpvnhk4bw0"; })
   (fetchNuGet { pname = "Microsoft.Extensions.ApiDescription.Server"; version = "6.0.5"; sha256 = "1pi2bm3cm0a7jzqzmfc2r7bpcdkmk3hhjfvb2c81j7wl7xdw3624"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Caching.Abstractions"; version = "8.0.0"; sha256 = "04m6ywsf9731z24nfd14z0ah8xl06619ba7mkdb4vg8h5jpllsn4"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Caching.Memory"; version = "8.0.0"; sha256 = "0bv8ihd5i2gwr97qljwf56h8mdwspmlw0zs64qyk608fb3ciwi25"; })
@@ -103,8 +105,8 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "2.2.0"; sha256 = "1xc7xr1nq7akfahyl5in9iyxrygap2xi9nxh39rfm37sf8lk55v1"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "3.0.0"; sha256 = "13ijaki0nzlvbwxjxb1hjhzj86jgn23nw34gdwp2l7bf3x2h4hw9"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Hosting.Abstractions"; version = "8.0.0"; sha256 = "00d5dwmzw76iy8z40ly01hy9gly49a7rpf7k7m99vrid1kxp346h"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Core"; version = "8.0.1"; sha256 = "0gf68x3zxbn3gxzdjmbfcqhm58ybxvpanl4pq8vs5g492qw7h24b"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Stores"; version = "8.0.1"; sha256 = "19c0by2r85jqz6pj8mnr047aasasr7fbzi3ih04gchj8la69ka5h"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Core"; version = "8.0.4"; sha256 = "1k9x667wi3izxjjiprqkdgajfn1slb0w8lyjdp2x441hp4wyzf6c"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Identity.Stores"; version = "8.0.4"; sha256 = "0dajblmwx1z7jk08ycsfabv30b28mvazgv3wq6m7pnlrpijkvcp4"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "2.0.0"; sha256 = "1jkwjcq1ld9znz1haazk8ili2g4pzfdp6i7r7rki4hg3jcadn386"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "6.0.0"; sha256 = "0fd9jii3y3irfcwlsiww1y9npjgabzarh33rn566wpcz24lijszi"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "8.0.0"; sha256 = "0nppj34nmq25gnrg0wh1q22y4wdqbih4ax493f226azv8mkp9s1i"; })
@@ -123,7 +125,7 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "2.2.0"; sha256 = "1b20yh03fg4nmmi3vlf6gf13vrdkmklshfzl3ijygcs4c2hly6v0"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "6.0.0"; sha256 = "008pnk2p50i594ahz308v81a41mbjz9mwcarqhmrjpl2d20c868g"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.0"; sha256 = "0p50qn6zhinzyhq9sy5svnmqqwhw2jajs2pbjh9sah504wjvhscz"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.1"; sha256 = "01jsya858i861x6d7qbl3wlr0gp2y7x2m4q6f1r743w360z8zgpn"; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.2"; sha256 = "0as39ml1idgp42yvh725ddqp4illq87adzd1ymzx6xjxsxsjadq2"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "6.0.0"; sha256 = "1k6q91vrhq1r74l4skibn7wzxzww9l74ibxb2i8gg4q6fzbiivba"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "8.0.0"; sha256 = "04nm8v5a3zp0ill7hjnwnja3s2676b4wffdri8hdk2341p7mp403"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "2.0.0"; sha256 = "1xppr5jbny04slyjgngxjdm0maxdh47vq481ps944d7jrfs0p3mb"; })
@@ -132,14 +134,14 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; sha256 = "1kjiw6s4yfz9gm7mx3wkhp06ghnbs95icj9hi505shz9rjrg42q2"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "8.0.0"; sha256 = "0aldaz5aapngchgdr7dax9jw5wy7k7hmjgjpfgfv1wfif27jlkqm"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.1.2"; sha256 = "01jdg8b1hi4nx5h1cn9baalfkp4y70kc2wf4lz77kw8w1fvrppa0"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.2.0"; sha256 = "06r0hv7n4v1s751k2032frfh9hkfkxpi42rdz10llcay7lcqjjh6"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.2.0"; sha256 = "17xbqb351xfnniwj2322xyaiajbdilihdp9j9knbr80d8rm62sv2"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.5.1"; sha256 = "0kdxb47rafvk6mx0xkf2pik7b638b2d847jlhzi3fvj6swg3v15b"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.5.1"; sha256 = "1ny97mhld7vzn5xwxvcy1jhfq4mw15wrk9c77z6cg2fydkgawyzx"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.1.2"; sha256 = "1yi7s2pm4f8vl6b0qck0nrfsrf1h4jwamznkzl75n1cwxpbdikp8"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.2.0"; sha256 = "01zfbgg1vcqq36cg5sdrq0fy78fywm7m2v4a79011k5ng9g0ck7z"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.5.1"; sha256 = "1zharnx3vhrfdn761w16ygxyj9ig5zn71346aqkk0nmzlll3gfjf"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols"; version = "7.1.2"; sha256 = "0ql5b7472g7359b1pqh2lfm8s3lym9vyzj1xpvbhsv9syk9czrg8"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols.OpenIdConnect"; version = "7.1.2"; sha256 = "06r9i1m6zhfbbx18p0drpcbswirlq7xg0wm3iqfjgzxyv053033h"; })
   (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.1.2"; sha256 = "1q70c1ax9f5nggqp4g8nyfaz0481grsaxhp85cmjpmx8l3q35zx9"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.2.0"; sha256 = "17xi2sb041dkigkkvnbg0lb5r1i9gjxv2irncqycg60hl1fcp27l"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.5.1"; sha256 = "14fjr679hwal35mdwdv4w40mnxzfnnx65yc16807zzkyri011zc1"; })
   (fetchNuGet { pname = "Microsoft.IO.RecyclableMemoryStream"; version = "3.0.0"; sha256 = "1zl39k27r4zq75r1x1zr1yl4nzxpkxdnnv6dwd4qp0xr22my85aq"; })
   (fetchNuGet { pname = "Microsoft.Net.Http.Headers"; version = "2.2.0"; sha256 = "0w6lrk9z67bcirq2cj2ldfhnizc6id77ba6i30hjzgqjlyhh1gx5"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Jit"; version = "1.0.2"; sha256 = "0jaan2wmg80lr0mhgfy70kb5cqjwv1a2ikmxgd0glpcxp7wr7pag"; })
@@ -154,26 +156,25 @@
   (fetchNuGet { pname = "Microsoft.NETCore.Windows.ApiSets"; version = "1.0.1"; sha256 = "16k8chghkr25jf49banhzl839vs8n3vbfpg4wn4idi0hzjipix78"; })
   (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.2.3"; sha256 = "07b19k89whj69j87afkz86gp9b3iybw8jqwvlgcn43m7fb2y99rr"; })
   (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.3.1"; sha256 = "0icds4jxz90v156vkbza1s1rqdf737glfddbllkp6y2zcnin99yv"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1"; sha256 = "1n8ap0cmljbqskxpf8fjzn7kh1vvlndsa75k01qig26mbw97k2q7"; })
   (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
   (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "8.0.0"; sha256 = "05392f41ijgn17y8pbjcx535l1k09krnq3xdp60kyq568sn6xk2i"; })
+  (fetchNuGet { pname = "MimeKit"; version = "4.4.0"; sha256 = "107225n55ib9y0y7azarjq3xcf8shsn329fbh5rmpcj5rhcv47kx"; })
   (fetchNuGet { pname = "MimeTypeMapOfficial"; version = "1.0.17"; sha256 = "1l5d42pgfz4cpvgdyxf2crzyv7jycky5mhmrrl5501p3806i3r0y"; })
   (fetchNuGet { pname = "Mono.TextTemplating"; version = "2.2.1"; sha256 = "1ih6399x4bxzchw7pq5195imir9viy2r1w702vy87vrarxyjqdp1"; })
   (fetchNuGet { pname = "Nager.ArticleNumber"; version = "1.0.7"; sha256 = "1lfhr20527xhzql5nsn5c1s5as79haz9xcqan8pqsfk200hc27af"; })
-  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.0"; sha256 = "0nmmv4yw7gw04ik8ialj3ak0j6pxa9spih67hnn1h2c38ba8h58k"; })
   (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; sha256 = "1z70wvsx2d847a2cjfii7b83pjfs34q05gb037fdjikv5kbagml8"; })
-  (fetchNuGet { pname = "NetVips"; version = "2.4.0"; sha256 = "0q4ghm4d19hl6ilxvvmlgdffp3gjnkrirc5665lc85rvziw6xcx9"; })
-  (fetchNuGet { pname = "NetVips.Native"; version = "8.15.1"; sha256 = "1ah8frrady684nxf3w4iq6gjcmsrmhndhy6mcyrlsw2i4l4wf1lw"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-arm"; version = "8.15.1"; sha256 = "0c4q5wwb7zmz8skzyyg6iag7qlxbc9pklzvi3qlml6c3qwv4b0mi"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-arm64"; version = "8.15.1"; sha256 = "1dwjd780l1b1831x1ksiha0ds6414inwjxcl6mb5k3imzfzfck3a"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-musl-arm64"; version = "8.15.1"; sha256 = "1md5dk905s28n8q2j6c5wp7zglzmcaqy4dim1qgillkk1651pqnl"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-musl-x64"; version = "8.15.1"; sha256 = "1xwlwfidhwdnnw9c9dxag3y90h3l4n408jgq9v25ad8m441134zj"; })
-  (fetchNuGet { pname = "NetVips.Native.linux-x64"; version = "8.15.1"; sha256 = "1905sd6zf8qbsfdbh16i6c5f9dznqdgzhz1fywvjfspsbdj3hilp"; })
-  (fetchNuGet { pname = "NetVips.Native.osx-arm64"; version = "8.15.1"; sha256 = "03gj78ibggm32nr6qpiykq0h463y81rzsawfdp091ikbxmnm98c7"; })
-  (fetchNuGet { pname = "NetVips.Native.osx-x64"; version = "8.15.1"; sha256 = "0r0mqfk9i59nvj15wgzh2rymv6fl0liw5bdcgmk80bfsfjqsrv4d"; })
-  (fetchNuGet { pname = "NetVips.Native.win-arm64"; version = "8.15.1"; sha256 = "1l8qwdw03vbc4dkmvw2iyw7b8w0cm20mydgv6diby48q46g5xgcy"; })
-  (fetchNuGet { pname = "NetVips.Native.win-x64"; version = "8.15.1"; sha256 = "1vriqri1ppk8glmsyxb7cfcsi42kz6skpx5ggqkrxsfp9yz22x46"; })
-  (fetchNuGet { pname = "NetVips.Native.win-x86"; version = "8.15.1"; sha256 = "0p8166fsqmyzy5xvfy2raxp9h38m702mbqf9ab88vxig3i4rsxk8"; })
+  (fetchNuGet { pname = "NetVips"; version = "2.4.1"; sha256 = "1jf0carq4aqw12shl91dbxmc65djhqlm5rlca1dag3aj5h05jzaj"; })
+  (fetchNuGet { pname = "NetVips.Native"; version = "8.15.2"; sha256 = "0jngfr5p37x5mjrrq7rq62nzq2fi9fsvls25i48ra62fscj1skva"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-arm"; version = "8.15.2"; sha256 = "1pcc2vkgjbcx1a88bnwn2vv71k7vv1q3hzcnpwbyaq8drh2q9zsy"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-arm64"; version = "8.15.2"; sha256 = "11wd1fxmipcd897rab9rdvb06ax71qg2zd4vsbdf0bqjq7ja741x"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-musl-arm64"; version = "8.15.2"; sha256 = "16fc3bf5n13yhd03wfdi3g8d9n2qgmbwiwil1vh3vxwb3qrdii03"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-musl-x64"; version = "8.15.2"; sha256 = "0iznsfxg0f3xw36j9rxa37zr7vryvxaj3a303mrsvj47qgxjd1fs"; })
+  (fetchNuGet { pname = "NetVips.Native.linux-x64"; version = "8.15.2"; sha256 = "09zcfx71107wifj2qhvqbjcjsjs7v790mpplq7aczfvj8kccnfdx"; })
+  (fetchNuGet { pname = "NetVips.Native.osx-arm64"; version = "8.15.2"; sha256 = "04ak05razgqcizpbxwfcmb2cgzbq7yw2jgb74p354nkmrs7knwbr"; })
+  (fetchNuGet { pname = "NetVips.Native.osx-x64"; version = "8.15.2"; sha256 = "1028p1iyvp7rhmssr6hk1f5n2z2y7cvslf11kzb826gxd2yvn52m"; })
+  (fetchNuGet { pname = "NetVips.Native.win-arm64"; version = "8.15.2"; sha256 = "0yggh8mqvqidrlhc3756rxsaarhmvvp4yhwj0ffgyzzclcbff4nf"; })
+  (fetchNuGet { pname = "NetVips.Native.win-x64"; version = "8.15.2"; sha256 = "0y8x5w70c7y7xmc8g1b200d2yhkg8nx41k337c2416zfbm268wzg"; })
+  (fetchNuGet { pname = "NetVips.Native.win-x86"; version = "8.15.2"; sha256 = "08p2wbdv1j50s1yllycc1c5cglaimssmn3p1v1qybxmaasj2ff3x"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "11.0.1"; sha256 = "1z68j07if1xf71lbsrgbia52r812i2dv541sy44ph4dzjjp7pd4m"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "11.0.2"; sha256 = "1784xi44f4k8v1fr696hsccmwpy94bz7kixxqlri98zhcxn406b2"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "12.0.2"; sha256 = "0w2fbji1smd2y7x25qqibf1qrznmv4s6s0jvrbvr6alb7mfyqvh5"; })
@@ -199,13 +200,9 @@
   (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
   (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
   (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.0.0"; sha256 = "1ppk69xk59ggacj9n7g6fyxvzmk1g5p4fkijm0d7xqfkig98qrkf"; })
   (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
-  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.1.0"; sha256 = "0d720z4lzyfcabmmnvh0bnj76ll7djhji2hmfh3h44sdkjnlkknk"; })
   (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.3.0"; sha256 = "1vvivbqsk6y4hzcid27pqpm5bsi6sc50hvqwbcx8aap5ifrxfs8d"; })
-  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.0.1"; sha256 = "1hgv2bmbaskx77v8glh7waxws973jn4ah35zysnkxmf0196sfxg6"; })
   (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; sha256 = "1n6rgz5132lcibbch1qlf0g9jk60r0kqv087hxc0lisy50zpm7kk"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography"; version = "4.0.0"; sha256 = "0k57aa2c3b10wl3hfqbgrl7xq7g8hh3a3ir44b31dn5p61iiw3z9"; })
   (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; sha256 = "1b61p6gw1m02cc1ry996fl49liiwky6181dzr873g9ds92zl326q"; })
   (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
   (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
@@ -226,7 +223,7 @@
   (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
   (fetchNuGet { pname = "Scrutor"; version = "3.3.0"; sha256 = "0qdfbp73hbsiqbv0rg6f91hnp1j535iqk8bmp3ickwd7w337m1vi"; })
   (fetchNuGet { pname = "Serilog"; version = "3.1.1"; sha256 = "0ck51ndmaqflsri7yyw5792z42wsp91038rx2i6vg7z4r35vfvig"; })
-  (fetchNuGet { pname = "Serilog.AspNetCore"; version = "8.0.0"; sha256 = "0g1scn1a5paiydxk1nnrwzzqny2vabc3hniy6jwjqycag6ch2pni"; })
+  (fetchNuGet { pname = "Serilog.AspNetCore"; version = "8.0.1"; sha256 = "0vmrbhj9vb00fhvxrw3w5j1gvdx4xzxz8d2cp65hps988zxwykkb"; })
   (fetchNuGet { pname = "Serilog.Enrichers.Thread"; version = "3.2.0-dev-00752"; sha256 = "0d0phxzdpc8xkbyd18s1dcv9xa22gqs2i2x5cpa9qzj0g8zwp641"; })
   (fetchNuGet { pname = "Serilog.Extensions.Hosting"; version = "8.0.0"; sha256 = "10cgp4nsrzkld5yxnvkfkwd0wkc1m8m7p5z42w4sqd8f188n8i9q"; })
   (fetchNuGet { pname = "Serilog.Extensions.Logging"; version = "3.0.1"; sha256 = "069qy7dm5nxb372ij112ppa6m99b4iaimj3sji74m659fwrcrl9a"; })
@@ -239,8 +236,8 @@
   (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.0"; sha256 = "097rngmgcrdfy7jy8j7dq3xaq2qky8ijwg0ws6bfv5lx0f3vvb0q"; })
   (fetchNuGet { pname = "Serilog.Sinks.SignalR.Core"; version = "0.1.2"; sha256 = "16f86661vr7gw8xay1735y551p0z39mks7xagwxb8lxqxwmm4gzf"; })
   (fetchNuGet { pname = "SharpCompress"; version = "0.36.0"; sha256 = "164ikphk4glldr73l247cjb65v064md0ccccm06rh0zvjq5iqlph"; })
-  (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "3.1.2"; sha256 = "0bc0753aczgw9mi9bcgly2x71w4adlr35krgf023vppc36809yhg"; })
-  (fetchNuGet { pname = "SonarAnalyzer.CSharp"; version = "9.17.0.82934"; sha256 = "1hk1fh8zp0ng6q29i2y17jdvbxxl3zgbzzag0dvap4wadqdpad1z"; })
+  (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "3.1.3"; sha256 = "0f36my2lzkgc5fvk6s0lh4gn15vxhbl2zg71rdql7vrzh8b77c6q"; })
+  (fetchNuGet { pname = "SonarAnalyzer.CSharp"; version = "9.23.1.88495"; sha256 = "1mj18mc8k9nq074jksnh71r5cnlr45730n3ww5gi6c17xnar0m6p"; })
   (fetchNuGet { pname = "sqlite-net-pcl"; version = "1.8.116"; sha256 = "0h3s43pfjqgy9amrdj4d7p65hmys895hlkczj62wg974qb4z8l2y"; })
   (fetchNuGet { pname = "SQLitePCLRaw.bundle_e_sqlite3"; version = "2.1.6"; sha256 = "0pzgdfl707pd9fz108xaff22w7c2y27yaix6wfp36phqkdnzz43m"; })
   (fetchNuGet { pname = "SQLitePCLRaw.bundle_green"; version = "2.0.4"; sha256 = "1197ynpm4fl6il9vi0mi1s1pmw3rk3j0a05kwrxpqlfgp7iwhc22"; })
@@ -251,23 +248,20 @@
   (fetchNuGet { pname = "SQLitePCLRaw.provider.dynamic_cdecl"; version = "2.0.4"; sha256 = "084r98kilpm0q1aw41idq8slncpd7cz65g0m1wr0p8d12x8z5g6j"; })
   (fetchNuGet { pname = "SQLitePCLRaw.provider.e_sqlite3"; version = "2.1.6"; sha256 = "1vs1c7yhi0mdqrd35ji289cxkhg7dxdnn6wgjjbngvqxkdhkyxyc"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore"; version = "6.5.0"; sha256 = "0k61chpz5j59s1yax28vx0mppx20ff8vg8grwja112hfrzj1f45n"; })
-  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters"; version = "8.0.0"; sha256 = "13jiyn00cxslrgagkw69h6nxjxrrbyg3pwy8gj5iagk5x5gi6b6f"; })
-  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters.Abstractions"; version = "8.0.0"; sha256 = "1sz2r45z2prglw3svrqy7xzl0z958yip71x6s97xrxsj776sqcf9"; })
+  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters"; version = "8.0.1"; sha256 = "1qs9awkh9jijmrdb0w0j669sn1i5wrl3bk5phpq1kscfa6ywkp5g"; })
+  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Filters.Abstractions"; version = "8.0.1"; sha256 = "1739p184hihfl6p42bcn66d2wflilhrbsyq0ddbbqxgxi3kdcxn6"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.Swagger"; version = "5.0.0"; sha256 = "1341nv8nmh6avs3y7w2szzir5qd0bndxwrkdmvvj3hcxj1126w2f"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.Swagger"; version = "6.5.0"; sha256 = "1s6axf6fin8sss3bvzp0s039rxrx71vx4rl559miw12bz3lld8kc"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.SwaggerGen"; version = "5.0.0"; sha256 = "00swg2avqnb38q2bsxljd34n8rpknp74h9vbn0fdnfds3a32cqr4"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.SwaggerGen"; version = "6.5.0"; sha256 = "0hq93gy5vyrigpdk9lhqwxglxwkbxa8ydllwcqs4bwfcsspzrs83"; })
   (fetchNuGet { pname = "Swashbuckle.AspNetCore.SwaggerUI"; version = "6.5.0"; sha256 = "17hx7kc187higm0gk67dndng3n7932sn3fwyj48l45cvyr3025h7"; })
-  (fetchNuGet { pname = "System.AppContext"; version = "4.1.0"; sha256 = "0fv3cma1jp4vgj7a8hqc9n7hr1f1kjp541s6z0q1r6nazb4iz9mz"; })
   (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; sha256 = "1649qvy3dar900z3g817h17nl8jp4ka5vcfmsr05kh0fshn7j3ya"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.0.0"; sha256 = "13s659bcmg9nwb6z78971z1lr6bmh2wghxi1ayqyzl4jijd351gr"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.5.0"; sha256 = "1ywfqn4md6g3iilpxjn5dsr0f5lx6z0yvhqp4pgjcamygg73cz2c"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.5.1"; sha256 = "04kb1mdrlcixj9zh1xdi5as0k0qi8byr5mi3p3jcxx72qz93s2y3"; })
   (fetchNuGet { pname = "System.CodeDom"; version = "4.4.0"; sha256 = "1zgbafm5p380r50ap5iddp11kzhr9khrf2pnai6k593wjar74p1g"; })
   (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; sha256 = "1ga40f5lrwldiyw6vy67d0sg7jd7ww6kgwbksm19wrvq9hr0bsm6"; })
   (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
-  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.0.12"; sha256 = "07y08kvrzpak873pmyxs129g1ch8l27zmg51pcyj2jvq03n0r0fc"; })
   (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "6.0.0"; sha256 = "1js98kmjn47ivcvkjqdmyipzknb9xbndssczm8gq224pbaj1p88c"; })
   (fetchNuGet { pname = "System.ComponentModel.Annotations"; version = "4.5.0"; sha256 = "1jj6f6g87k0iwsgmg3xmnn67a14mq88np0l1ys5zkxhkvbc8976p"; })
@@ -277,34 +271,28 @@
   (fetchNuGet { pname = "System.Composition.Hosting"; version = "6.0.0"; sha256 = "0big5nk8c44rxp6cfykhk7rxvn2cgwa99w6c3v2a36adc3lj36ky"; })
   (fetchNuGet { pname = "System.Composition.Runtime"; version = "6.0.0"; sha256 = "0vq5ik63yii1784gsa2f2kx9w6xllmm8b8rk0arid1jqdj1nyrlw"; })
   (fetchNuGet { pname = "System.Composition.TypedParts"; version = "6.0.0"; sha256 = "0y9pq3y60nyrpfy51f576a0qjjdh61mcv8vnik32pm4bz56h9q72"; })
-  (fetchNuGet { pname = "System.Console"; version = "4.0.0"; sha256 = "0ynxqbc3z1nwbrc11hkkpw9skw116z4y9wjzn7id49p9yi7mzmlf"; })
   (fetchNuGet { pname = "System.Console"; version = "4.3.0"; sha256 = "1flr7a9x920mr5cjsqmsy9wgnv3lvd0h1g521pdr1lkb2qycy7ay"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "0gmjghrqmlgzxivd2xl50ncbglb7ljzb66rlx8ws6dv8jm0d5siz"; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
-  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.0.0"; sha256 = "1n6c3fbz7v8d3pn77h4v5wvsfrfg7v1c57lg3nff3cjyh597v23m"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.3.0"; sha256 = "0z6m3pbiy0qw6rn3n209rrzf9x1k4002zh90vwcrsym09ipm2liq"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "6.0.0"; sha256 = "0rrihs9lnb1h6x4h0hn6kgfnh58qq7hx8qq99gh6fayx4dcnx3s5"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "8.0.0"; sha256 = "0nzra1i0mljvmnj1qqqg37xs7bl71fnpl68nwmdajchh65l878zr"; })
   (fetchNuGet { pname = "System.Diagnostics.EventLog"; version = "8.0.0"; sha256 = "1xnvcidh2qf6k7w8ij1rvj0viqkq84cq47biw0c98xhxg5rk3pxf"; })
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1"; sha256 = "19cknvg07yhakcvpxg3cxa0bwadplin6kyxd8mpjjpwnp56nl85x"; })
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "0in3pic3s2ddyibi8cvgl102zmvp9r9mchh82ns9f0ms4basylw1"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; sha256 = "1d2r76v1x610x61ahfpigda89gd13qydz6vbwzhpqlyvq8jj6394"; })
   (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
-  (fetchNuGet { pname = "System.Drawing.Common"; version = "8.0.1"; sha256 = "02l7y2j6f2qykl90iac28nvw1cnhic8vzixlq5fznw0zj72knz25"; })
+  (fetchNuGet { pname = "System.Drawing.Common"; version = "8.0.4"; sha256 = "17i50sbv5v9c138gjammn9nf1p0qa0lpmvmw26ffdhmlshjla6fi"; })
   (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.0.11"; sha256 = "1pla2dx8gkidf7xkciig6nifdsb494axjvzvann8g2lp3dbqasm9"; })
+  (fetchNuGet { pname = "System.Formats.Asn1"; version = "8.0.0"; sha256 = "04h75wflmzl0qh125p0209wx006rkyxic1y404m606yjvpl2alq1"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
-  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.0.1"; sha256 = "0bv0alrm2ck2zk3rz25lfyk9h42f3ywq77mx1syl6vvyncnpg4qh"; })
   (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1xwl230bkakzzkrggy1l1lxmm3xlhk4bq2pkv790j5lm8g887lxq"; })
-  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.0.1"; sha256 = "0hjhdb5ri8z9l93bw04s7ynwrjrhx2n0p34sf33a9hl9phz69fyc"; })
   (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; sha256 = "02a5zfxavhv3jd437bsncbhd2fp1zv4gxzakp1an9l6kdq1mcqls"; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.2.0"; sha256 = "000sfpv1bjwkwwb65fl85f3ifwvdadzkx93gwsb56vrsh00kd026"; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.5.1"; sha256 = "0priwzi8w2rnspppldl2mhi4fh835dpyyy8f7ri6qbqs7n8l746n"; })
   (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
   (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
-  (fetchNuGet { pname = "System.IO.Abstractions"; version = "20.0.4"; sha256 = "0qdp4522v0k219iixg4zk7vmpyx149rsnqhq3ykzkpd2mdg0f4nx"; })
-  (fetchNuGet { pname = "System.IO.Compression"; version = "4.1.0"; sha256 = "0iym7s3jkl8n0vzm3jd6xqg9zjjjqni05x45dwxyjr2dy88hlgji"; })
+  (fetchNuGet { pname = "System.IO.Abstractions"; version = "21.0.2"; sha256 = "1mp73hkrxb83bs16458qgf7l3n20ddnfkij1pd603dr8w22j7279"; })
   (fetchNuGet { pname = "System.IO.Compression"; version = "4.3.0"; sha256 = "084zc82yi6yllgda0zkgl2ys48sypiswbiwrv7irb3r0ai1fp4vz"; })
-  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.0.1"; sha256 = "0h72znbagmgvswzr46mihn7xm7chfk2fhrp5krzkjf29pz0i6z82"; })
   (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.3.0"; sha256 = "1yxy5pq4dnsm9hlkg9ysh5f6bf3fahqqb6p8668ndy5c0lk7w2ar"; })
   (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; sha256 = "0kgfpw6w4djqra3w5crrg8xivbanh1w9dh3qapb28q060wb9flp1"; })
   (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; sha256 = "0z2dfrbra9i6y16mm9v1v6k47f0fm617vlb7s5iybjjsz6g1ilmw"; })
@@ -318,12 +306,9 @@
   (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
   (fetchNuGet { pname = "System.Memory"; version = "4.5.1"; sha256 = "0f07d7hny38lq9w69wx4lxkn4wszrqf9m9js6fh9is645csm167c"; })
   (fetchNuGet { pname = "System.Memory"; version = "4.5.3"; sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a"; })
-  (fetchNuGet { pname = "System.Net.Http"; version = "4.1.0"; sha256 = "1i5rqij1icg05j8rrkw4gd4pgia1978mqhjzhsjg69lvwcdfg8yb"; })
   (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; sha256 = "1i4gc757xqrzflbk7kc5ksn20kwwfjhw9w7pgdkn19y3cgnl302j"; })
   (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; sha256 = "15r75pwc0rm3vvwsn8rvm2krf929mjfwliv0mpicjnii24470rkq"; })
-  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.0.11"; sha256 = "10xzzaynkzkakp7jai1ik3r805zrqjxiz7vcagchyxs2v26a516r"; })
   (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; sha256 = "0c87k50rmdgmxx7df2khd9qj7q35j9rzdmm2572cc55dygmdk3ii"; })
-  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.1.0"; sha256 = "1385fvh8h29da5hh58jm1v78fzi9fi5vj93vhlm2kvqpfahvpqls"; })
   (fetchNuGet { pname = "System.Net.Sockets"; version = "4.3.0"; sha256 = "1ssa65k6chcgi6mfmzrznvqaxk8jp0gvl77xhf1hbzakjnpxspla"; })
   (fetchNuGet { pname = "System.Net.WebSockets.WebSocketProtocol"; version = "4.5.1"; sha256 = "1n0ag9ws6fgyqcz39xyk5dnchskfji8bcgqw90i2ai7lyvd843p6"; })
   (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12"; sha256 = "1sybkfi60a4588xn34nd9a58png36i0xr4y4v4kqpg8wlvy5krrj"; })
@@ -358,25 +343,17 @@
   (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; sha256 = "01kxqppx3dr3b6b286xafqilv4s2n0gqvfgzfd4z943ga9i81is1"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.0.0"; sha256 = "0glmvarf3jz5xh22iy3w9v3wyragcm4hfdr17v90vs7vcrm7fgp6"; })
   (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; sha256 = "0q18r1sh4vn7bvqgd6dmqlw5v28flbpj349mkdish2vjyvmnb2ii"; })
-  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.0.1"; sha256 = "1y308zfvy0l5nrn46mqqr4wb4z1xk758pkk8svbz8b5ij7jnv4nn"; })
   (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
   (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.1.1"; sha256 = "042rfjixknlr6r10vx2pgf56yming8lkjikamg3g4v29ikk78h7k"; })
   (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; sha256 = "0jvfn7j22l3mm28qjy3rcw287y9h65ha4m940waaxah07jnbzrhn"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.2.0"; sha256 = "148s9g5dgm33ri7dnh19s4lgnlxbpwvrw2jnzllq2kijj4i4vs85"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; sha256 = "03sq183pfl5kp7gkvq77myv7kbpdnq3y0xj7vi4q1kaw54sny0ml"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.2.0"; sha256 = "118jijz446kix20blxip0f0q8mhsh9bz118mwc2ch1p6g7facpzc"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.0.0"; sha256 = "1cwv8lqj8r15q81d2pz2jwzzbaji0l28xfrpw29kdpsaypm92z2q"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; sha256 = "1x5wcrddf2s3hb8j78cry7yalca4lb5vfnkrysagbn6r9x6xvrx1"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.0.0"; sha256 = "0a8y1a5wkmpawc787gfmnrnbzdgxmx1a14ax43jf3rj9gxmy3vk4"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; sha256 = "1jr6w70igqn07k5zs1ph6xja97hxnb3mqbspdrff6cvssgrixs32"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.0.0"; sha256 = "16sx3cig3d0ilvzl8xxgffmxbiqx87zdi8fc73i3i7zjih1a7f4q"; })
   (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0givpvvj8yc7gv4lhb6s1prq6p2c4147204a0wib89inqzd87gqc"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.0.0"; sha256 = "0i7cfnwph9a10bm26m538h5xcr8b36jscp9sy1zhgifksxz4yixh"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "8.0.0"; sha256 = "04kqf1lhsq3fngiljanmrz2774x5h2fc8p57v04c51jwwqhwi9ya"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.1.0"; sha256 = "0clg1bv55mfv5dq00m19cp634zx6inm31kf8ppbq1jgyjf2185dh"; })
   (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; sha256 = "0valjcz5wksbvijylxijjxb1mp38mdhv03r533vnx1q3ikzdav9h"; })
   (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
   (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
@@ -385,6 +362,7 @@
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "6.0.0"; sha256 = "0gm2kiz2ndm9xyzxgi0jhazgwslcs427waxgfa30m7yqll1kcrww"; })
+  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "8.0.0"; sha256 = "1lgdd78cik4qyvp2fggaa0kzxasw6kc9a6cjqw46siagrm0qnc3y"; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; sha256 = "08nsfrpiwsg9x5ml4xyl3zyvjfdi4mvbqf93kjdh11j4fwkznizs"; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
   (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "4.5.0"; sha256 = "0srd5bva52n92i90wd88pzrqjsxnfgka3ilybwh7s6sf469y5s53"; })
@@ -403,14 +381,14 @@
   (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; sha256 = "1xxcx2xh8jin360yjwm4x4cf5y3a2bwpn2ygkfkwkicz7zk50s2z"; })
   (fetchNuGet { pname = "System.Threading.Thread"; version = "4.0.0"; sha256 = "1gxxm5fl36pjjpnx1k688dcw8m9l7nmf802nxis6swdaw8k54jzc"; })
   (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; sha256 = "027s1f4sbx0y1xqw2irqn6x161lzj8qwvnh2gn78ciiczdv10vf1"; })
-  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.0.1"; sha256 = "15n54f1f8nn3mjcjrlzdg6q3520571y012mx7v991x2fvp73lmg6"; })
   (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; sha256 = "1nx773nsx6z5whv8kaa1wjh037id2f1cxhb69pvgv12hd2b6qs56"; })
   (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11"; sha256 = "0c6ky1jk5ada9m94wcadih98l6k1fvf6vi7vhn1msjixaha419l5"; })
   (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; sha256 = "0c47yllxifzmh8gq6rq6l36zzvw4kjvlszkqa9wq3fr59n0hl3s1"; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11"; sha256 = "0n4lvpqzy9kc7qy1a4acwwd7b7pnvygv895az5640idl2y9zbz18"; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; sha256 = "08h8fm4l77n0nd4i4fk2386y809bfbwqb7ih9d7564ifcxr5ssxd"; })
-  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions"; version = "20.0.4"; sha256 = "16jw4zw8pvck754r6744d11460w1fih8c77r8yzzw2w58iv2mns6"; })
-  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions.Wrappers"; version = "20.0.4"; sha256 = "1c5sf8dva9vswl2qqkc6xcmznia8d5nqw46yvk4b1f9idv53j5nz"; })
+  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions"; version = "21.0.2"; sha256 = "1mc358wlq9y21gzj44af8hxlyjm0ws0i9f5vmsn31dn5wbfh4dy5"; })
+  (fetchNuGet { pname = "TestableIO.System.IO.Abstractions.Wrappers"; version = "21.0.2"; sha256 = "0q3vghssyh6rd7w7n4rjv5ngh5byf1y80i22yw9fx10f4hcsw1az"; })
   (fetchNuGet { pname = "VersOne.Epub"; version = "3.3.1"; sha256 = "1v7ms857yhm38syi4l63g9hzn0y08n8csr4z4i56xmzpj1big2s6"; })
+  (fetchNuGet { pname = "xunit.assert"; version = "2.7.0"; sha256 = "14g5pvv709ykkz3lgqbdisksqfll72792fkrg4qr0s8jcp38kpyc"; })
   (fetchNuGet { pname = "ZstdSharp.Port"; version = "0.7.4"; sha256 = "0087rymvclj96pscd8lbjidsdg1g4p83m6y20bcicz8sx7jnnzyg"; })
 ]
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 1786fce83a1f..3ab2382d0198 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -83,9 +83,9 @@ let
         nativeTools = false;
         nativeLibc = false;
 
-        buildPackages = lib.optionalAttrs (prevStage ? stdenv) {
-          inherit (prevStage) stdenv;
-        };
+        expand-response-params = lib.optionalString
+          (prevStage.stdenv.hasCC or false && prevStage.stdenv.cc != "/dev/null")
+          prevStage.expand-response-params;
 
         extraPackages = [
           prevStage.llvmPackages.compiler-rt
@@ -124,6 +124,7 @@ let
         inherit (prevStage) coreutils gnugrep;
 
         stdenvNoCC = prevStage.ccWrapperStdenv;
+        runtimeShell = prevStage.ccWrapperStdenv.shell;
       };
 
       bash = prevStage.bash or bootstrapTools;
@@ -253,11 +254,12 @@ in
           nativeTools = false;
           nativeLibc = false;
 
-          buildPackages = { };
+          expand-response-params = "";
           libc = selfDarwin.Libsystem;
 
           inherit lib;
           inherit (self) stdenvNoCC coreutils gnugrep;
+          runtimeShell = self.stdenvNoCC.shell;
 
           bintools = selfDarwin.binutils-unwrapped;
 
@@ -461,6 +463,8 @@ in
 
           bintools = selfDarwin.binutils-unwrapped;
           libc = selfDarwin.Libsystem;
+          # TODO(@sternenseemann): can this be removed?
+          runtimeShell = "${bootstrapTools}/bin/bash";
         };
 
         binutils-unwrapped = superDarwin.binutils-unwrapped.override {
@@ -853,9 +857,7 @@ in
 
         # Rewrap binutils so it uses the rebuilt Libsystem.
         binutils = superDarwin.binutils.override {
-          buildPackages = {
-            inherit (prevStage) stdenv;
-          };
+          inherit (prevStage) expand-response-params;
           libc = selfDarwin.Libsystem;
         } // {
           passthru = { inherit (prevStage.bintools.passthru) isFromBootstrapFiles; };
@@ -1068,11 +1070,7 @@ in
         };
 
         binutils = superDarwin.binutils.override {
-          shell = self.bash + "/bin/bash";
-
-          buildPackages = {
-            inherit (prevStage) stdenv;
-          };
+          inherit (prevStage) expand-response-params;
 
           bintools = selfDarwin.binutils-unwrapped;
           libc = selfDarwin.Libsystem;
@@ -1109,9 +1107,7 @@ in
               nativeTools = false;
               nativeLibc = false;
 
-              buildPackages = {
-                inherit (prevStage) stdenv;
-              };
+              inherit (prevStage) expand-response-params;
 
               extraPackages = [
                 self.llvmPackages.compiler-rt
@@ -1148,9 +1144,7 @@ in
               inherit (self.llvmPackages) libcxx;
 
               inherit lib;
-              inherit (self) stdenvNoCC coreutils gnugrep;
-
-              shell = self.bash + "/bin/bash";
+              inherit (self) stdenvNoCC coreutils gnugrep runtimeShell;
             };
           });
           libraries = super.llvmPackages.libraries.extend (_: _:{
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 0e1852805cfd..e1801abcb485 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -185,9 +185,9 @@ let
           name = "${name}-gcc-wrapper";
           nativeTools = false;
           nativeLibc = false;
-          buildPackages = lib.optionalAttrs (prevStage ? stdenv) {
-            inherit (prevStage) stdenv;
-          };
+          expand-response-params = lib.optionalString
+            (prevStage.stdenv.hasCC or false && prevStage.stdenv.cc != "/dev/null")
+            prevStage.expand-response-params;
           cc = prevStage.gcc-unwrapped;
           bintools = prevStage.binutils;
           isGNU = true;
@@ -196,6 +196,7 @@ let
           inherit (prevStage) coreutils gnugrep;
           stdenvNoCC = prevStage.ccWrapperStdenv;
           fortify-headers = prevStage.fortify-headers;
+          runtimeShell = prevStage.ccWrapperStdenv.shell;
         }).overrideAttrs(a: lib.optionalAttrs (prevStage.gcc-unwrapped.passthru.isXgcc or false) {
           # This affects only `xgcc` (the compiler which compiles the final compiler).
           postFixup = (a.postFixup or "") + ''
@@ -260,11 +261,12 @@ in
         name = "bootstrap-stage0-binutils-wrapper";
         nativeTools = false;
         nativeLibc = false;
-        buildPackages = { };
+        expand-response-params = "";
         libc = getLibc self;
         inherit lib;
         inherit (self) stdenvNoCC coreutils gnugrep;
         bintools = bootstrapTools;
+        runtimeShell = "${bootstrapTools}/bin/bash";
       };
       coreutils = bootstrapTools;
       gnugrep = bootstrapTools;
@@ -332,6 +334,14 @@ in
         inherit (prevStage) ccWrapperStdenv coreutils gnugrep gettext bison texinfo zlib gnum4 perl patchelf;
         ${localSystem.libc} = getLibc prevStage;
         gmp = super.gmp.override { cxx = false; };
+        # This stage also rebuilds binutils which will of course be used only in the next stage.
+        # We inherit this until stage3, in stage4 it will be rebuilt using the adjacent bash/runtimeShell pkg.
+        # TODO(@sternenseemann): Can we already build the wrapper with the actual runtimeShell here?
+        # Historically, the wrapper didn't use runtimeShell, so the used shell had to be changed explicitly
+        # (or stdenvNoCC.shell would be used) which happened in stage4.
+        binutils = super.binutils.override {
+          runtimeShell = "${bootstrapTools}/bin/bash";
+        };
         gcc-unwrapped =
           (super.gcc-unwrapped.override (commonGccOverrides // {
             # The most logical name for this package would be something like
@@ -544,13 +554,10 @@ in
       # other purposes (binutils and top-level pkgs) too.
       inherit (prevStage) gettext gnum4 bison perl texinfo zlib linuxHeaders libidn2 libunistring;
       ${localSystem.libc} = getLibc prevStage;
+      # Since this is the first fresh build of binutils since stage2, our own runtimeShell will be used.
       binutils = super.binutils.override {
-        # Don't use stdenv's shell but our own
-        shell = self.bash + "/bin/bash";
         # Build expand-response-params with last stage like below
-        buildPackages = {
-          inherit (prevStage) stdenv;
-        };
+        inherit (prevStage) expand-response-params;
       };
 
       # To allow users' overrides inhibit dependencies too heavy for
@@ -561,15 +568,12 @@ in
         nativeTools = false;
         nativeLibc = false;
         isGNU = true;
-        buildPackages = {
-          inherit (prevStage) stdenv;
-        };
+        inherit (prevStage) expand-response-params;
         cc = prevStage.gcc-unwrapped;
         bintools = self.binutils;
         libc = getLibc self;
         inherit lib;
-        inherit (self) stdenvNoCC coreutils gnugrep;
-        shell = self.bash + "/bin/bash";
+        inherit (self) stdenvNoCC coreutils gnugrep runtimeShell;
         fortify-headers = self.fortify-headers;
       };
     };
@@ -646,7 +650,9 @@ in
         # More complicated cases
         ++ (map (x: getOutput x (getLibc prevStage)) [ "out" "dev" "bin" ] )
         ++  [ linuxHeaders # propagated from .dev
-            binutils gcc gcc.cc gcc.cc.lib gcc.expand-response-params gcc.cc.libgcc glibc.passthru.libgcc
+              binutils gcc gcc.cc gcc.cc.lib
+              gcc.expand-response-params # != (prevStage.)expand-response-params
+              gcc.cc.libgcc glibc.passthru.libgcc
           ]
         ++ lib.optionals (localSystem.libc == "musl") [ fortify-headers ]
         ++ [ prevStage.updateAutotoolsGnuConfigScriptsHook prevStage.gnu-config ]
diff --git a/pkgs/tools/audio/headsetcontrol/default.nix b/pkgs/tools/audio/headsetcontrol/default.nix
index 68a799a55c76..d1d7a7541690 100644
--- a/pkgs/tools/audio/headsetcontrol/default.nix
+++ b/pkgs/tools/audio/headsetcontrol/default.nix
@@ -1,21 +1,29 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , hidapi
 }:
 
 stdenv.mkDerivation rec {
   pname = "headsetcontrol";
-  version = "2.7.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "Sapd";
     repo = "HeadsetControl";
     rev = version;
-    sha256 = "sha256-tAndkfLEgj81JWzXtDBNspRxzKAL6XaRw0aDI1XbC1E=";
+    sha256 = "sha256-N1c94iAJgCPhGNDCGjMINg0AL2wPX5gVIsJ+pzn/l9Y=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/Sapd/HeadsetControl/pull/337.patch";
+      hash = "sha256-18w9BQsMljEA/eY3rnosHvKwhiaF79TrWH/ayuyZMrM=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
   ];
@@ -24,11 +32,6 @@ stdenv.mkDerivation rec {
     hidapi
   ];
 
-  /*
-  Tests depend on having the appropriate headsets connected.
-  */
-  doCheck = false;
-
   meta = with lib; {
     description = "Sidetone and Battery status for Logitech G930, G533, G633, G933 SteelSeries Arctis 7/PRO 2019 and Corsair VOID (Pro)";
     longDescription = ''
diff --git a/pkgs/tools/inputmethods/keymapper/default.nix b/pkgs/tools/inputmethods/keymapper/default.nix
index 5cedfce20198..8886f5b691a6 100644
--- a/pkgs/tools/inputmethods/keymapper/default.nix
+++ b/pkgs/tools/inputmethods/keymapper/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "keymapper";
-  version = "3.5.3";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "houmain";
     repo = "keymapper";
     rev = finalAttrs.version;
-    hash = "sha256-CfZdLeWgeNwy9tEJ3UDRplV0sRcKE4J6d3CxC9gqdmE=";
+    hash = "sha256-a9CuLchSSfS4w3pZylzdiUr/llMsuU2qDR3mJrAupZk=";
   };
 
   # all the following must be in nativeBuildInputs
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index fc9493be5521..27da89ceb31a 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-FTZXfZhLplpjB6QQssz/5hXckNaR9KTdw8NRDLYOvaM=";
+    hash = "sha256-SEt/qw8ixlgRY2+fqyCmhqzLVoAw/BMl//JqQxbuB0s=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index cd18dbf5ee0e..a8adbf7a7d0e 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.56.0";
+  version = "0.57.0";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FQtbR4tiFRtMwawf9rdsK/U0bwJFvfXmzqM/ZU+Yhi0=";
+    hash = "sha256-TE00xGHe8Dhm9rxD3zlB4Cf8OasPsZQhxoqXFSsSDL8=";
   };
 
-  vendorHash = "sha256-W+H7PxpG3MuioN+nEeX4tArVSDuhQ2LD+927mhPaLas=";
+  vendorHash = "sha256-WtpsgN3zf2fELJ1yXWYSEkqXe1Fx+j3uwoJx6Q17OU8=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/security/pomerium-cli/default.nix b/pkgs/tools/security/pomerium-cli/default.nix
index cff903021591..328717aca581 100644
--- a/pkgs/tools/security/pomerium-cli/default.nix
+++ b/pkgs/tools/security/pomerium-cli/default.nix
@@ -8,16 +8,16 @@ let
 in
 buildGoModule rec {
   pname = "pomerium-cli";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-0vRLjmzW/U/Kssu4VQO6mFqVH4UovmTGEEfxeWI8Nqo=";
+    sha256 = "sha256-2upvdL8kk0Kbll8UbviyzIX2jdK+tqcHvVlkpz5JjrA=";
   };
 
-  vendorHash = "sha256-dnfJnndYXR6LQKDruLSsDav4DtyaGu5/rNnk69oMhPU=";
+  vendorHash = "sha256-aQo58i+XuCkdjIg/IPf7kNLXXA0NwZbQMhgWyMb45B4=";
 
   subPackages = [
     "cmd/pomerium-cli"
diff --git a/pkgs/tools/security/semgrep/common.nix b/pkgs/tools/security/semgrep/common.nix
index cfc4045457be..9fb3ae427a2e 100644
--- a/pkgs/tools/security/semgrep/common.nix
+++ b/pkgs/tools/security/semgrep/common.nix
@@ -1,9 +1,9 @@
 { lib }:
 
 rec {
-  version = "1.67.0";
+  version = "1.69.0";
 
-  srcHash = "sha256-B+2DgwU+yhU337yZh518Z2Tq0Wbun8WEXX9IpC0Ut/c=";
+  srcHash = "sha256-LA0mRuYJg97tMbmlmJpZ8wQc83S/jXNWBUjcoXSqoVo=";
 
   # submodule dependencies
   # these are fetched so we:
@@ -13,8 +13,8 @@ rec {
     "cli/src/semgrep/semgrep_interfaces" = {
       owner = "semgrep";
       repo = "semgrep-interfaces";
-      rev = "3ee41bc436308a7c12b66247cfcb60df0aeff8ea";
-      hash = "sha256-rlhArVSNJr4AgZw/TOOMPgpBOfHWsAm77YgrRdCjIzI=";
+      rev = "d5b91fa4f6a03240db31e9bbbc5376a99bc8eeea";
+      hash = "sha256-IQ22HvO0gHAfbZrt+bz1yMb/XRZOU+z03X+SOK9iDQs=";
     };
   };
 
@@ -25,19 +25,19 @@ rec {
   core = {
     x86_64-linux = {
       platform = "any";
-      hash = "sha256-iv02L/dvcfI/9XubC+EOeqMaVwdXh0sqLv02j1fn1aM=";
+      hash = "sha256-QFE8NzGW2kkP5xtmbXgxE1OAxz6z7MT8wW/EmIVMgHE=";
     };
     aarch64-linux = {
       platform = "musllinux_1_0_aarch64.manylinux2014_aarch64";
-      hash = "sha256-wFuEcgCuciAOR8MNCxHW8TCoji97g7dXUf06M0T9MWg=";
+      hash = "sha256-E1fGT5TO2DbP4oYtkRs794jXGOp75q3o+xlOao8E7Lk=";
     };
     x86_64-darwin = {
       platform = "macosx_10_14_x86_64";
-      hash = "sha256-wMkOZFvR6HBBTvu8mXRDF2s0Mqp/LkhVH2I+2sIIa94=";
+      hash = "sha256-oWY57rQvxjMIhzjR62cpIVmKynmdF3zQOLMHBjbf1ig=";
     };
     aarch64-darwin = {
       platform = "macosx_11_0_arm64";
-      hash = "sha256-AKNc9SxXbKb6WdFlE6aqzFDdtMGzl+3LhXTbNvFSHYQ=";
+      hash = "sha256-L2eFkahzwfBzPcx7Zq+NhtgJvBq5W1vZ4m1YNQ3dWAo=";
     };
   };
 
diff --git a/pkgs/tools/security/step-kms-plugin/default.nix b/pkgs/tools/security/step-kms-plugin/default.nix
index fd3faedf6128..95a3b85fca63 100644
--- a/pkgs/tools/security/step-kms-plugin/default.nix
+++ b/pkgs/tools/security/step-kms-plugin/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "step-kms-plugin";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FQ9UW1zz+8HMFETZVef7oyh2+Nm5z3ksvmOv/MTiKAU=";
+    hash = "sha256-EkLLhHXvh10tfEY6AY6o3n3JcmCXwauHsQ8VJRBpnnY=";
   };
 
-  vendorHash = "sha256-bpQHe7B7dG1oeGP/V3su0Zc6in7tive7lmh18KqxGfo=";
+  vendorHash = "sha256-kwM5eNeAVtA6DaoFtBhxc7Jnfb7vVkdIGpUxVGjWwC8=";
 
   proxyVendor = true;
 
diff --git a/pkgs/tools/text/d2/default.nix b/pkgs/tools/text/d2/default.nix
index e82ef305a522..d5cef467f507 100644
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-lOZ2JFQG4x4xv/fdTlpOEp9lpdjR0ACyAIUWEZUm6L8=";
+    hash = "sha256-yEYdFpIIY+nAaeMPEwgz0th2rf67LeYK19Ov9QB/7J0=";
   };
 
   vendorHash = "sha256-aoc8KSznkWJpn0Ye7FUOH5sNQ4fslIGJhIaQdGrwcqQ=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3f0a0b7f1143..c66d1b62b36a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -656,6 +656,8 @@ with pkgs;
 
   evhz = callPackage ../tools/misc/evhz { };
 
+  expand-response-params = callPackage ../build-support/expand-response-params { };
+
   expressvpn = callPackage ../applications/networking/expressvpn { };
 
   faq = callPackage ../development/tools/faq { };
@@ -33446,8 +33448,6 @@ with pkgs;
 
   ptex = callPackage ../development/libraries/ptex { };
 
-  pyright = nodePackages.pyright;
-
   qbec = callPackage ../applications/networking/cluster/qbec { };
 
   qemacs = callPackage ../applications/editors/qemacs { };
diff --git a/pkgs/top-level/cuda-packages.nix b/pkgs/top-level/cuda-packages.nix
index 92960422af44..d34a37294ae0 100644
--- a/pkgs/top-level/cuda-packages.nix
+++ b/pkgs/top-level/cuda-packages.nix
@@ -90,7 +90,7 @@ let
     [
       (import ../development/cuda-modules/setup-hooks/extension.nix)
       (callPackage ../development/cuda-modules/cuda/extension.nix { inherit cudaVersion; })
-      (callPackage ../development/cuda-modules/cuda/overrides.nix { inherit cudaVersion; })
+      (import ../development/cuda-modules/cuda/overrides.nix)
       (callPackage ../development/cuda-modules/generic-builders/multiplex.nix {
         inherit cudaVersion flags mkVersionedPackageName;
         pname = "cudnn";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f70995470ccd..8947bfb4f7eb 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1932,6 +1932,8 @@ self: super: with self; {
     };
   };
 
+  catkin-pkg = callPackage ../development/python-modules/catkin-pkg { };
+
   catppuccin = callPackage ../development/python-modules/catppuccin { };
 
   cattrs = callPackage ../development/python-modules/cattrs { };
@@ -2484,6 +2486,8 @@ self: super: with self; {
 
   craft-application-1 = callPackage ../development/python-modules/craft-application-1 { };
 
+  craft-application = callPackage ../development/python-modules/craft-application { };
+
   craft-archives = callPackage ../development/python-modules/craft-archives { };
 
   craft-cli = callPackage ../development/python-modules/craft-cli { };
@@ -12181,6 +12185,8 @@ self: super: with self; {
 
   python3-openid = callPackage ../development/python-modules/python3-openid { };
 
+  python-apt = callPackage ../development/python-modules/python-apt { };
+
   python-arango = callPackage ../development/python-modules/python-arango { };
 
   python-awair = callPackage ../development/python-modules/python-awair { };