diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 4d6dd876abd1..d171e8419188 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -1190,11 +1190,12 @@ following are specific to `buildPythonPackage`:
   variables which will be available when the binary is run. For example,
   `makeWrapperArgs = ["--set FOO BAR" "--set BAZ QUX"]`.
 * `namePrefix`: Prepends text to `${name}` parameter. In case of libraries, this
-  defaults to `"python3.8-"` for Python 3.8, etc., and in case of applications
-  to `""`.
+  defaults to `"python3.8-"` for Python 3.8, etc., and in case of applications to `""`.
 * `pipInstallFlags ? []`: A list of strings. Arguments to be passed to `pip
   install`. To pass options to `python setup.py install`, use
   `--install-option`. E.g., `pipInstallFlags=["--install-option='--cpp_implementation'"]`.
+* `pipBuildFlags ? []`: A list of strings. Arguments to be passed to `pip wheel`.
+* `pypaBuildFlags ? []`: A list of strings. Arguments to be passed to `python -m build --wheel`.
 * `pythonPath ? []`: List of packages to be added into `$PYTHONPATH`. Packages
   in `pythonPath` are not propagated (contrary to `propagatedBuildInputs`).
 * `preShellHook`: Hook to execute commands before `shellHook`.
@@ -1249,6 +1250,27 @@ with import <nixpkgs> {};
 in python.withPackages(ps: [ ps.blaze ])).env
 ```
 
+The next example shows a non trivial overriding of the `blas` implementation to
+be used through out all of the Python package set:
+
+```nix
+python3MyBlas = pkgs.python3.override {
+  packageOverrides = self: super: {
+    # We need toPythonModule for the package set to evaluate this
+    blas = super.toPythonModule(super.pkgs.blas.override {
+      blasProvider = super.pkgs.mkl;
+    });
+    lapack = super.toPythonModule(super.pkgs.lapack.override {
+      lapackProvider = super.pkgs.mkl;
+    });
+  };
+};
+```
+
+This is particularly useful for numpy and scipy users who want to gain speed with other blas implementations.
+Note that using simply `scipy = super.scipy.override { blas = super.pkgs.mkl; };` will likely result in
+compilation issues, because scipy dependencies need to use the same blas implementation as well.
+
 #### Optional extra dependencies {#python-optional-dependencies}
 
 Some packages define optional dependencies for additional features. With
@@ -1468,6 +1490,10 @@ are used in `buildPythonPackage`.
 - `flitBuildHook` to build a wheel using `flit`.
 - `pipBuildHook` to build a wheel using `pip` and PEP 517. Note a build system
   (e.g. `setuptools` or `flit`) should still be added as `nativeBuildInput`.
+- `pypaBuildHook` to build a wheel using
+  [`pypa/build`](https://pypa-build.readthedocs.io/en/latest/index.html) and
+  PEP 517/518. Note a build system (e.g. `setuptools` or `flit`) should still
+  be added as `nativeBuildInput`.
 - `pipInstallHook` to install wheels.
 - `pytestCheckHook` to run tests with `pytest`. See [example usage](#using-pytestcheckhook).
 - `pythonCatchConflictsHook` to check whether a Python package is not already existing.
diff --git a/pkgs/applications/audio/hushboard/default.nix b/pkgs/applications/audio/hushboard/default.nix
index e9d88d1f236f..f0fde190db99 100644
--- a/pkgs/applications/audio/hushboard/default.nix
+++ b/pkgs/applications/audio/hushboard/default.nix
@@ -26,10 +26,10 @@ buildPythonApplication {
 
   nativeBuildInputs = [
     wrapGAppsHook
+    gobject-introspection
   ];
 
   buildInputs = [
-    gobject-introspection
     gtk3
     libappindicator
     libpulseaudio
diff --git a/pkgs/applications/audio/ledfx/default.nix b/pkgs/applications/audio/ledfx/default.nix
index b536de637acf..004823ee52d7 100644
--- a/pkgs/applications/audio/ledfx/default.nix
+++ b/pkgs/applications/audio/ledfx/default.nix
@@ -1,16 +1,16 @@
 { lib
-, python3
 , fetchPypi
+, python3
 }:
 
 python3.pkgs.buildPythonPackage rec {
   pname = "ledfx";
-  version = "2.0.67";
+  version = "2.0.69";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lFxAMjglQZXCySr83PtvStU6hw2ucQu+rSjIHo1yZBk=";
+    hash = "sha256-gkO6XYiPMkU/zRLvc0yd3jJXVcAgAkR1W1ELTSN461o=";
   };
 
   postPatch = ''
@@ -52,7 +52,7 @@ python3.pkgs.buildPythonPackage rec {
   doCheck = false;
 
   meta = with lib; {
-    description = "LedFx is a network based LED effect controller with support for advanced real-time audio effects";
+    description = "Network based LED effect controller with support for advanced real-time audio effects";
     homepage = "https://github.com/LedFx/LedFx";
     changelog = "https://github.com/LedFx/LedFx/blob/${version}/CHANGELOG.rst";
     license = licenses.gpl3Only;
diff --git a/pkgs/applications/audio/lyrebird/default.nix b/pkgs/applications/audio/lyrebird/default.nix
index 055662ce743f..888087afb79f 100644
--- a/pkgs/applications/audio/lyrebird/default.nix
+++ b/pkgs/applications/audio/lyrebird/default.nix
@@ -34,9 +34,9 @@ python3Packages.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3Packages; [ toml pygobject3 ];
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
 
-  buildInputs = [ gtk3 gobject-introspection sox ];
+  buildInputs = [ gtk3 sox ];
 
   dontWrapGApps = true;
   makeWrapperArgs = [
diff --git a/pkgs/applications/audio/rhythmbox/default.nix b/pkgs/applications/audio/rhythmbox/default.nix
index 9cd6b0d9ae05..394ccc3b723d 100644
--- a/pkgs/applications/audio/rhythmbox/default.nix
+++ b/pkgs/applications/audio/rhythmbox/default.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
     itstool
     wrapGAppsHook
     desktop-file-utils
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -72,7 +73,6 @@ stdenv.mkDerivation rec {
     brasero
     grilo
 
-    gobject-introspection
     python3.pkgs.pygobject3
 
     gst_all_1.gstreamer
diff --git a/pkgs/applications/audio/soundconverter/default.nix b/pkgs/applications/audio/soundconverter/default.nix
index 208d50a2773c..bc7a6ea5a1f1 100644
--- a/pkgs/applications/audio/soundconverter/default.nix
+++ b/pkgs/applications/audio/soundconverter/default.nix
@@ -17,7 +17,6 @@ python3Packages.buildPythonApplication rec {
   buildInputs = [
     gtk3
     fdk-aac-encoder
-    gobject-introspection
     gst_all_1.gst-libav
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
@@ -28,6 +27,7 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     intltool
     wrapGAppsHook
+    gobject-introspection
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/audio/tauon/default.nix b/pkgs/applications/audio/tauon/default.nix
index 43724953eea6..18e0cfe257f8 100644
--- a/pkgs/applications/audio/tauon/default.nix
+++ b/pkgs/applications/audio/tauon/default.nix
@@ -70,11 +70,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     pkg-config
     python3Packages.wrapPython
+    gobject-introspection
   ];
 
   buildInputs = [
     flac
-    gobject-introspection
     gtk3
     libappindicator
     libnotify
diff --git a/pkgs/applications/editors/apostrophe/default.nix b/pkgs/applications/editors/apostrophe/default.nix
index 674b27330802..00bb6dea3256 100644
--- a/pkgs/applications/editors/apostrophe/default.nix
+++ b/pkgs/applications/editors/apostrophe/default.nix
@@ -24,9 +24,9 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ meson ninja pkg-config desktop-file-utils
-    appstream-glib wrapGAppsHook sassc ];
+    appstream-glib wrapGAppsHook sassc gobject-introspection ];
 
-  buildInputs = [ glib pythonEnv gobject-introspection gtk3
+  buildInputs = [ glib pythonEnv gtk3
     gnome.adwaita-icon-theme webkitgtk gspell texlive
     glib-networking libhandy ];
 
diff --git a/pkgs/applications/editors/gnome-inform7/default.nix b/pkgs/applications/editors/gnome-inform7/default.nix
index 509eee06e2be..3b73e0843d92 100644
--- a/pkgs/applications/editors/gnome-inform7/default.nix
+++ b/pkgs/applications/editors/gnome-inform7/default.nix
@@ -23,10 +23,10 @@ let
       docbook2x
       docbook-xsl-nons
       wrapGAppsHook
+      gobject-introspection
     ];
     buildInputs = [
       gtk3
-      gobject-introspection
       vala gtk-doc
     ];
   });
@@ -50,10 +50,10 @@ let
       python3
       glib
       wrapGAppsHook
+      gobject-introspection
     ];
     buildInputs = [
       gtk3
-      gobject-introspection
       vala
       gtk-doc
       gst_all_1.gstreamer
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 356b4ed7c9c2..dbf95e35dd35 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1075,9 +1075,8 @@ self: super: {
       svedbackend = stdenv.mkDerivation {
         name = "svedbackend-${super.sved.name}";
         inherit (super.sved) src;
-        nativeBuildInputs = [ wrapGAppsHook ];
+        nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
         buildInputs = [
-          gobject-introspection
           glib
           (python3.withPackages (ps: with ps; [ pygobject3 pynvim dbus-python ]))
         ];
diff --git a/pkgs/applications/file-managers/portfolio-filemanager/default.nix b/pkgs/applications/file-managers/portfolio-filemanager/default.nix
index 0fcfa61907a7..ef28d8cea340 100644
--- a/pkgs/applications/file-managers/portfolio-filemanager/default.nix
+++ b/pkgs/applications/file-managers/portfolio-filemanager/default.nix
@@ -49,7 +49,6 @@ python3.pkgs.buildPythonApplication rec {
   buildInputs = [
     glib
     gtk3
-    gobject-introspection
     libhandy
     librsvg
   ];
diff --git a/pkgs/applications/graphics/imgp/default.nix b/pkgs/applications/graphics/imgp/default.nix
index 1f6e20f465a2..89887c9f4e87 100644
--- a/pkgs/applications/graphics/imgp/default.nix
+++ b/pkgs/applications/graphics/imgp/default.nix
@@ -11,6 +11,11 @@ buildPythonApplication rec {
     sha256 = "1miabaxd5pwxn0va4drzj1d4ppxvyqsrrd4xw1j6qr52yci0lms8";
   };
 
+  postPatch = ''
+    substituteInPlace imgp \
+      --replace "Image.ANTIALIAS" "Image.Resampling.LANCZOS"
+  '';
+
   propagatedBuildInputs = [ pillow ];
 
   installFlags = [
diff --git a/pkgs/applications/graphics/komikku/default.nix b/pkgs/applications/graphics/komikku/default.nix
index b444841f8f72..48ef9fc8c010 100644
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@@ -47,7 +47,6 @@ python3.pkgs.buildPythonApplication rec {
     libadwaita
     libnotify
     webkitgtk_6_0
-    gobject-introspection
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/graphics/ocrfeeder/default.nix b/pkgs/applications/graphics/ocrfeeder/default.nix
index 9e516f211069..1c473d2c41f6 100644
--- a/pkgs/applications/graphics/ocrfeeder/default.nix
+++ b/pkgs/applications/graphics/ocrfeeder/default.nix
@@ -31,11 +31,11 @@ stdenv.mkDerivation rec {
     intltool
     itstool
     libxml2
+    gobject-introspection
   ];
 
   buildInputs = [
     gtk3
-    gobject-introspection
     goocanvas2
     gtkspell3
     isocodes
diff --git a/pkgs/applications/graphics/rapid-photo-downloader/default.nix b/pkgs/applications/graphics/rapid-photo-downloader/default.nix
index b283a6d4083f..490a89b30b86 100644
--- a/pkgs/applications/graphics/rapid-photo-downloader/default.nix
+++ b/pkgs/applications/graphics/rapid-photo-downloader/default.nix
@@ -26,6 +26,7 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     file
     intltool
+    gobject-introspection
   ];
 
   # Package has no generally usable unit tests.
@@ -37,13 +38,9 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     $out/bin/rapid-photo-downloader --detailed-version
   '';
 
-  # NOTE: Without gobject-introspection in buildInputs and strictDeps = false,
-  #       launching fails with:
-  #       "Namespace [Notify / GExiv2 / GUdev] not available"
   buildInputs = [
     gdk-pixbuf
     gexiv2
-    gobject-introspection
     gst_all_1.gst-libav
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
@@ -54,6 +51,10 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     udisks
   ];
 
+  # NOTE: Check if strictDeps can be renabled
+  # at the time of writing this the dependency easygui fails to build
+  #       launching fails with:
+  #       "Namespace [Notify / GExiv2 / GUdev] not available"
   strictDeps = false;
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/misc/auto-multiple-choice/default.nix b/pkgs/applications/misc/auto-multiple-choice/default.nix
index d811540e5894..ef91009391b7 100644
--- a/pkgs/applications/misc/auto-multiple-choice/default.nix
+++ b/pkgs/applications/misc/auto-multiple-choice/default.nix
@@ -99,6 +99,7 @@ stdenv.mkDerivation (finalAttrs: rec {
     pkg-config
     makeWrapper
     wrapGAppsHook
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -106,7 +107,6 @@ stdenv.mkDerivation (finalAttrs: rec {
     cairo.dev
     dblatex
     gnumake
-    gobject-introspection
     graphicsmagick
     gsettings-desktop-schemas
     gtk3
diff --git a/pkgs/applications/misc/caerbannog/default.nix b/pkgs/applications/misc/caerbannog/default.nix
index 833ecd32788d..2825b371e06d 100644
--- a/pkgs/applications/misc/caerbannog/default.nix
+++ b/pkgs/applications/misc/caerbannog/default.nix
@@ -38,7 +38,6 @@ python3.pkgs.buildPythonApplication rec {
   buildInputs = [
     gtk3
     atk
-    gobject-introspection
     libhandy
     libnotify
     pango
diff --git a/pkgs/applications/misc/cobang/default.nix b/pkgs/applications/misc/cobang/default.nix
index a1430a8b5e39..d8f8932fd734 100644
--- a/pkgs/applications/misc/cobang/default.nix
+++ b/pkgs/applications/misc/cobang/default.nix
@@ -59,8 +59,6 @@ buildPythonApplication rec {
   buildInputs = [
     atk
     gdk-pixbuf
-    # Needed to detect namespaces
-    gobject-introspection
     gst-plugins-good
     libhandy
     networkmanager
diff --git a/pkgs/applications/misc/confy/default.nix b/pkgs/applications/misc/confy/default.nix
index 82d7267b047a..b8e57bd84b95 100644
--- a/pkgs/applications/misc/confy/default.nix
+++ b/pkgs/applications/misc/confy/default.nix
@@ -32,10 +32,10 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     wrapGAppsHook
+    gobject-introspection
   ];
 
   buildInputs = [
-    gobject-introspection
     gtk4
     libadwaita
     libnotify
diff --git a/pkgs/applications/misc/dialect/default.nix b/pkgs/applications/misc/dialect/default.nix
index be2fcdbe4a71..519f12490f18 100644
--- a/pkgs/applications/misc/dialect/default.nix
+++ b/pkgs/applications/misc/dialect/default.nix
@@ -45,7 +45,6 @@ python3.pkgs.buildPythonApplication rec {
   buildInputs = [
     gtk4
     glib
-    gobject-introspection
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     libsoup_3
diff --git a/pkgs/applications/misc/digitalbitbox/default.nix b/pkgs/applications/misc/digitalbitbox/default.nix
index 4771cebc3411..8c8f4a1c9467 100644
--- a/pkgs/applications/misc/digitalbitbox/default.nix
+++ b/pkgs/applications/misc/digitalbitbox/default.nix
@@ -103,15 +103,21 @@ in mkDerivation rec {
     cp src/hidapi/libusb/.libs/*.so* $out/lib
     cp src/univalue/.libs/*.so* $out/lib
 
-    # [RPATH][patchelf] Avoid forbidden reference error
-    rm -rf $PWD
-
     # Provide udev rules as documented in https://digitalbitbox.com/start_linux
     mkdir -p "$out/etc/udev/rules.d"
     ${copyUdevRuleToOutput "51-hid-digitalbox.rules" udevRule51}
     ${copyUdevRuleToOutput "52-hid-digitalbox.rules" udevRule52}
   '';
 
+  # remove forbidden references to $TMPDIR
+  preFixup = ''
+    for f in "$out"/{bin,lib}/*; do
+      if [ -f "$f" ] && isELF "$f"; then
+        patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$f"
+      fi
+    done
+  '';
+
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/gramps/default.nix b/pkgs/applications/misc/gramps/default.nix
index 9424ceeee51f..173afec4aa60 100644
--- a/pkgs/applications/misc/gramps/default.nix
+++ b/pkgs/applications/misc/gramps/default.nix
@@ -12,8 +12,8 @@ in buildPythonApplication rec {
   version = "5.1.4";
   pname = "gramps";
 
-  nativeBuildInputs = [ wrapGAppsHook intltool gettext ];
-  buildInputs = [ gtk3 gobject-introspection pango gexiv2 ]
+  nativeBuildInputs = [ wrapGAppsHook intltool gettext gobject-introspection ];
+  buildInputs = [ gtk3 pango gexiv2 ]
     # Map support
     ++ lib.optionals enableOSM [ osm-gps-map glib-networking ]
     # Graphviz support
diff --git a/pkgs/applications/misc/haxor-news/default.nix b/pkgs/applications/misc/haxor-news/default.nix
index bb4c52882761..fb3489893be3 100644
--- a/pkgs/applications/misc/haxor-news/default.nix
+++ b/pkgs/applications/misc/haxor-news/default.nix
@@ -22,6 +22,7 @@ let
           inherit version;
           hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
         };
+        disabledTests = [ "test_bytes_args" ];
       });
     };
   };
diff --git a/pkgs/applications/misc/markets/default.nix b/pkgs/applications/misc/markets/default.nix
index ccf56da05a24..436891482f19 100644
--- a/pkgs/applications/misc/markets/default.nix
+++ b/pkgs/applications/misc/markets/default.nix
@@ -17,10 +17,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     desktop-file-utils glib gtk3 meson ninja pkg-config python3 vala
-    wrapGAppsHook
+    wrapGAppsHook gobject-introspection
   ];
   buildInputs = [
-    glib glib-networking gobject-introspection gtk3 json-glib libgee libhandy
+    glib glib-networking gtk3 json-glib libgee libhandy
     libsoup
   ];
 
diff --git a/pkgs/applications/misc/nwg-drawer/default.nix b/pkgs/applications/misc/nwg-drawer/default.nix
index 23edd6e2742f..ad2850910cb7 100644
--- a/pkgs/applications/misc/nwg-drawer/default.nix
+++ b/pkgs/applications/misc/nwg-drawer/default.nix
@@ -22,8 +22,8 @@ buildGoModule rec {
 
   vendorHash = "sha256-RehZ86XuFs1kbm9V3cgPz1SPG3izK7/6fHQjPTHOYZs=";
 
-  buildInputs = [ cairo gobject-introspection gtk3 gtk-layer-shell ];
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  buildInputs = [ cairo gtk3 gtk-layer-shell ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook gobject-introspection ];
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix
index 74efc4c1db02..3bfe95c09082 100644
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@@ -103,6 +103,7 @@ let
           inherit version;
           hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
         };
+        disabledTests = [ "test_bytes_args" ]; # https://github.com/pallets/click/commit/6e05e1fa1c2804
       });
       # Now requires `lingua` as check input that requires a newer `click`,
       # however `click-7` is needed by the older flask we need here. Since it's just
diff --git a/pkgs/applications/misc/redshift/default.nix b/pkgs/applications/misc/redshift/default.nix
index 10bb6a782707..70d30ea054e6 100644
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@@ -33,6 +33,7 @@ let
         pkg-config
         wrapGAppsHook
         wrapPython
+        gobject-introspection
       ];
 
       configureFlags = [
@@ -47,7 +48,6 @@ let
       ];
 
       buildInputs = [
-        gobject-introspection
         gtk3
         python
       ] ++ lib.optional  withRandr        libxcb
diff --git a/pkgs/applications/misc/shipments/default.nix b/pkgs/applications/misc/shipments/default.nix
index 0f4f39d74c99..dccd5dc89c69 100644
--- a/pkgs/applications/misc/shipments/default.nix
+++ b/pkgs/applications/misc/shipments/default.nix
@@ -29,10 +29,10 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     wrapGAppsHook
+    gobject-introspection
   ];
 
   buildInputs = [
-    gobject-introspection
     gtk3
     libhandy
     (python3.withPackages (ps: with ps; [
diff --git a/pkgs/applications/misc/siglo/default.nix b/pkgs/applications/misc/siglo/default.nix
index 24d0253aaf84..520f4330e503 100644
--- a/pkgs/applications/misc/siglo/default.nix
+++ b/pkgs/applications/misc/siglo/default.nix
@@ -40,12 +40,12 @@ stdenv.mkDerivation rec {
     python3
     desktop-file-utils
     gtk3
+    gobject-introspection
   ];
 
   buildInputs = [
     gtk3
     python3.pkgs.gatt
-    gobject-introspection
   ];
 
   pythonPath = with python3.pkgs; [
diff --git a/pkgs/applications/misc/skytemple/default.nix b/pkgs/applications/misc/skytemple/default.nix
index c1a77d634d35..d347bb3af57f 100644
--- a/pkgs/applications/misc/skytemple/default.nix
+++ b/pkgs/applications/misc/skytemple/default.nix
@@ -20,7 +20,6 @@ python3Packages.buildPythonApplication rec {
   };
 
   buildInputs = [
-    gobject-introspection
     gtk3
     gtksourceview4
     # webkitgkt is used for rendering interactive statistics graph which
diff --git a/pkgs/applications/misc/sticky/default.nix b/pkgs/applications/misc/sticky/default.nix
index 06cb31798215..57dafc0e3ba0 100644
--- a/pkgs/applications/misc/sticky/default.nix
+++ b/pkgs/applications/misc/sticky/default.nix
@@ -33,7 +33,6 @@ python3.pkgs.buildPythonApplication rec {
 
   buildInputs = [
     glib
-    gobject-introspection
     cinnamon.xapp
     gspell
   ];
diff --git a/pkgs/applications/misc/swaysettings/default.nix b/pkgs/applications/misc/swaysettings/default.nix
index ce5672337be0..babd312d3edd 100644
--- a/pkgs/applications/misc/swaysettings/default.nix
+++ b/pkgs/applications/misc/swaysettings/default.nix
@@ -46,13 +46,13 @@ stdenv.mkDerivation rec {
     python3
     vala
     wrapGAppsHook
+    gobject-introspection
   ];
 
   buildInputs = [
     accountsservice
     dbus
     glib
-    gobject-introspection
     gsettings-desktop-schemas
     gtk-layer-shell
     gtk3
diff --git a/pkgs/applications/misc/tuhi/default.nix b/pkgs/applications/misc/tuhi/default.nix
index 641723016a8a..1b26f455649a 100644
--- a/pkgs/applications/misc/tuhi/default.nix
+++ b/pkgs/applications/misc/tuhi/default.nix
@@ -34,9 +34,10 @@ python3Packages.buildPythonApplication rec {
     pkg-config meson ninja
     appstream-glib desktop-file-utils
     wrapGAppsHook
+    gobject-introspection
   ];
   buildInputs = [
-    gtk3 gobject-introspection
+    gtk3
     glib
   ];
   nativeCheckInputs = with python3Packages; [ flake8 pytest ];
diff --git a/pkgs/applications/misc/variety/default.nix b/pkgs/applications/misc/variety/default.nix
index da6d7b48696a..db6ab6d6a90d 100644
--- a/pkgs/applications/misc/variety/default.nix
+++ b/pkgs/applications/misc/variety/default.nix
@@ -38,7 +38,6 @@ python3.pkgs.buildPythonApplication rec {
 
   buildInputs = [
     gexiv2
-    gobject-introspection
     gtk3
     hicolor-icon-theme
     libnotify
diff --git a/pkgs/applications/misc/workrave/default.nix b/pkgs/applications/misc/workrave/default.nix
index 0a6662c39a9f..c9bb4131c5b8 100644
--- a/pkgs/applications/misc/workrave/default.nix
+++ b/pkgs/applications/misc/workrave/default.nix
@@ -55,6 +55,7 @@ stdenv.mkDerivation rec {
     pkg-config
     wrapGAppsHook
     jinja2
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -62,7 +63,6 @@ stdenv.mkDerivation rec {
     libSM
     libXScrnSaver
     libXtst
-    gobject-introspection
     glib
     glibmm
     gtkmm3
diff --git a/pkgs/applications/networking/browsers/elinks/default.nix b/pkgs/applications/networking/browsers/elinks/default.nix
index 7cdd76e52fde..914bfec7fad4 100644
--- a/pkgs/applications/networking/browsers/elinks/default.nix
+++ b/pkgs/applications/networking/browsers/elinks/default.nix
@@ -5,6 +5,7 @@
   enableGuile        ? false,                                         guile ? null
 , enablePython       ? false,                                         python ? null
 , enablePerl         ? (!stdenv.isDarwin) && (stdenv.hostPlatform == stdenv.buildPlatform), perl ? null
+, fetchpatch
 # re-add javascript support when upstream supports modern spidermonkey
 }:
 
@@ -22,6 +23,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-u6QGhfi+uWeIzSUFuYHAH3Xu0Fky0yw2h4NOKgYFLsM=";
   };
 
+  patches = [
+    # Fix build bug with perl 5.38.0. Backport of https://github.com/rkd77/elinks/pull/243 by gentoo:
+    # https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dfefaa456bd69bc14e3a1c2c6c1b0cc19c6b0869
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/elinks/files/elinks-0.16.1.1-perl-5.38.patch?id=dfefaa456bd69bc14e3a1c2c6c1b0cc19c6b0869";
+      hash = "sha256-bHP9bc/l7VEw7oXlkSUQhhuq8rT2QTahh9SM7ZJgK5w=";
+    })
+  ];
+
   buildInputs = [
     ncurses libX11 bzip2 zlib brotli zstd xz
     openssl libidn tre expat libev
diff --git a/pkgs/applications/networking/browsers/eolie/default.nix b/pkgs/applications/networking/browsers/eolie/default.nix
index 89f02114f42d..0508b4a19ef3 100644
--- a/pkgs/applications/networking/browsers/eolie/default.nix
+++ b/pkgs/applications/networking/browsers/eolie/default.nix
@@ -28,7 +28,6 @@ python3.pkgs.buildPythonApplication rec {
 
   buildInputs = with gst_all_1; [
     glib-networking
-    gobject-introspection
     gst-libav
     gst-plugins-base
     gst-plugins-ugly
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 05f936d46f06..dabb9743794f 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -22,8 +22,10 @@ python3.pkgs.buildPythonApplication rec {
     sed 's/[~<>=][^;]*//' -i requirements.txt
   '';
 
-  # ~400 failures
-  doCheck = false;
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+    wheel
+  ];
 
   propagatedBuildInputs = with python3.pkgs; [
     # See https://github.com/Flexget/Flexget/blob/master/requirements.txt
@@ -42,6 +44,7 @@ python3.pkgs.buildPythonApplication rec {
     packaging
     psutil
     pynzb
+    pyrsistent
     pyrss2gen
     python-dateutil
     pyyaml
@@ -73,6 +76,9 @@ python3.pkgs.buildPythonApplication rec {
     "flexget.plugins.clients.transmission"
   ];
 
+  # ~400 failures
+  doCheck = false;
+
   meta = with lib; {
     homepage = "https://flexget.com/";
     changelog = "https://github.com/Flexget/Flexget/releases/tag/v${version}";
diff --git a/pkgs/applications/networking/instant-messengers/dino/default.nix b/pkgs/applications/networking/instant-messengers/dino/default.nix
index f34cca6f9296..83bf99b828d1 100644
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@@ -46,11 +46,11 @@ stdenv.mkDerivation rec {
     pkg-config
     wrapGAppsHook
     gettext
+    gobject-introspection
   ];
 
   buildInputs = [
     qrencode
-    gobject-introspection
     glib
     glib-networking # required for TLS support
     libadwaita
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index 4fc1a9d352e8..3e6fa0d92499 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication rec {
   format = "pyproject";
 
   buildInputs = [
-    gobject-introspection gtk3 gnome.adwaita-icon-theme
+    gtk3 gnome.adwaita-icon-theme
     gtksourceview4
     glib-networking
   ] ++ lib.optionals enableJingle [ farstream gstreamer gst-plugins-base gst-libav gst-plugins-good libnice ]
@@ -41,7 +41,7 @@ python3.pkgs.buildPythonApplication rec {
     ++ lib.optional enableAppIndicator libappindicator-gtk3;
 
   nativeBuildInputs = [
-    gettext wrapGAppsHook
+    gettext wrapGAppsHook gobject-introspection
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/networking/instant-messengers/gotktrix/default.nix b/pkgs/applications/networking/instant-messengers/gotktrix/default.nix
index e71d5c020fe6..df75f7192bf7 100644
--- a/pkgs/applications/networking/instant-messengers/gotktrix/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gotktrix/default.nix
@@ -23,10 +23,9 @@ buildGoModule rec {
   buildInputs = [
     gtk4
     glib
-    gobject-introspection
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config gobject-introspection ];
 
   # Checking requires a working display
   doCheck = false;
diff --git a/pkgs/applications/networking/instant-messengers/mikutter/default.nix b/pkgs/applications/networking/instant-messengers/mikutter/default.nix
index ffc2eea5b868..b34ed84d044d 100644
--- a/pkgs/applications/networking/instant-messengers/mikutter/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mikutter/default.nix
@@ -78,12 +78,11 @@ with mikutterPaths; stdenv.mkDerivation rec {
     sha256 = "05253nz4i1lmnq6czj48qdab2ny4vx2mznj6nsn2l1m2z6zqkwk3";
   };
 
-  nativeBuildInputs = [ copyDesktopItems wrapGAppsHook ]
+  nativeBuildInputs = [ copyDesktopItems wrapGAppsHook gobject-introspection ]
     ++ lib.optionals stdenv.isDarwin [ libicns ];
   buildInputs = [
     atk
     gtk2
-    gobject-introspection
     libnotify
     which # some plugins use it at runtime
     wrappedRuby
diff --git a/pkgs/applications/networking/mailreaders/mailnag/default.nix b/pkgs/applications/networking/mailreaders/mailnag/default.nix
index 47c448c9b323..4f6b3015cf34 100644
--- a/pkgs/applications/networking/mailreaders/mailnag/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailnag/default.nix
@@ -41,13 +41,13 @@ python3Packages.buildPythonApplication rec {
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-bad
-    gobject-introspection
     libsecret
   ] ++ pluginsDeps;
 
   nativeBuildInputs = [
     gettext
     wrapGAppsHook
+    gobject-introspection
     # To later add plugins to
     xorg.lndir
   ];
diff --git a/pkgs/applications/networking/mailreaders/mailnag/goa-plugin.nix b/pkgs/applications/networking/mailreaders/mailnag/goa-plugin.nix
index 1def97bd62d7..bb758565eb8a 100644
--- a/pkgs/applications/networking/mailreaders/mailnag/goa-plugin.nix
+++ b/pkgs/applications/networking/mailreaders/mailnag/goa-plugin.nix
@@ -16,8 +16,11 @@ python3Packages.buildPythonPackage rec {
     sha256 = "0bij6cy96nhq7xzslx0fnhmiac629h0x4wgy67k4i4npwqw10680";
   };
 
-  buildInputs = [
+  nativeBuildInputs = [
     gobject-introspection
+  ];
+
+  buildInputs = [
     gnome-online-accounts
   ];
 
diff --git a/pkgs/applications/networking/newsreaders/liferea/default.nix b/pkgs/applications/networking/newsreaders/liferea/default.nix
index 68e2bec7ccc3..bca6c566b74c 100644
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
     python3Packages.wrapPython
     intltool
     pkg-config
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -49,7 +50,6 @@ stdenv.mkDerivation rec {
     libpeas
     gsettings-desktop-schemas
     json-glib
-    gobject-introspection
     libsecret
     glib-networking
     libnotify
diff --git a/pkgs/applications/office/bookworm/default.nix b/pkgs/applications/office/bookworm/default.nix
index c30b9ede2bba..621fce9e4579 100644
--- a/pkgs/applications/office/bookworm/default.nix
+++ b/pkgs/applications/office/bookworm/default.nix
@@ -44,13 +44,13 @@ stdenv.mkDerivation rec {
     pkg-config
     vala
     wrapGAppsHook
+    gobject-introspection
   ];
 
   buildInputs = [
     appstream
     desktop-file-utils
     glib
-    gobject-introspection
     gtk3
     html2text
     libgee
diff --git a/pkgs/applications/office/foliate/default.nix b/pkgs/applications/office/foliate/default.nix
index a2d0d73f7903..294121b32ecd 100644
--- a/pkgs/applications/office/foliate/default.nix
+++ b/pkgs/applications/office/foliate/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Pr2YA2MHXD4W7lyCxGAVLKyoZarZ8t92RSkWle3LNuc=";
   };
 
-  nativeBuildInputs = [ meson ninja python3 wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja python3 wrapGAppsHook gobject-introspection ];
 
   postPatch = ''
     patchShebangs build-aux/meson/postinstall.py
@@ -32,7 +32,6 @@ stdenv.mkDerivation rec {
     gtk3
     webkitgtk
     desktop-file-utils
-    gobject-introspection
     gsettings-desktop-schemas
   ];
 
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 70df53f1eb6b..bec44b0b7ff3 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchurl
+, fetchpatch
 , lib
 , substituteAll
 , pam
@@ -220,6 +221,12 @@ in
   # for 7.4.
   patches = lib.optionals (lib.versionAtLeast version "7.5") [
     ./0001-Strip-away-BUILDCONFIG.patch
+  ] ++ [
+    (fetchpatch {
+      name = "fix-curl-8.2.patch";
+      url = "https://github.com/LibreOffice/core/commit/2a68dc02bd19a717d3c86873206fabed1098f228.diff";
+      hash = "sha256-C+kts+oaLR3+GbnX/wrFguF7SzgerNataxP0SPxhyY8=";
+    })
   ];
 
   # libreoffice tries to reference the BUILDCONFIG (e.g. PKG_CONFIG_PATH)
diff --git a/pkgs/applications/science/math/polymake/default.nix b/pkgs/applications/science/math/polymake/default.nix
index 18d6912a2b8a..2e79ca03635a 100644
--- a/pkgs/applications/science/math/polymake/default.nix
+++ b/pkgs/applications/science/math/polymake/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, perl
 , gmp
 , mpfr
 , flint
@@ -15,10 +14,14 @@
 , ninja
 , ant
 , openjdk
-, perlPackages
+, perl536Packages
 , makeWrapper
 }:
-
+let
+  # log says: polymake does not work with perl 5.37 or newer;
+  perlPackages = perl536Packages;
+  inherit (perlPackages) perl;
+in
 # polymake compiles its own version of sympol and atint because we
 # don't have those packages. other missing optional dependencies:
 # javaview, libnormaliz, scip, soplex, jreality.
diff --git a/pkgs/applications/science/math/sage/patches/numpy-1.25-deprecation.patch b/pkgs/applications/science/math/sage/patches/numpy-1.25-deprecation.patch
new file mode 100644
index 000000000000..539afc4b3b77
--- /dev/null
+++ b/pkgs/applications/science/math/sage/patches/numpy-1.25-deprecation.patch
@@ -0,0 +1,18 @@
+diff --git a/src/sage/tests/books/computational-mathematics-with-sagemath/graphique_doctest.py b/src/sage/tests/books/computational-mathematics-with-sagemath/graphique_doctest.py
+index aa153fd4cd..eebbe87aff 100644
+--- a/src/sage/tests/books/computational-mathematics-with-sagemath/graphique_doctest.py
++++ b/src/sage/tests/books/computational-mathematics-with-sagemath/graphique_doctest.py
+@@ -134,11 +134,11 @@ Sage example in ./graphique.tex, line 1120::
+   sage: t = srange(0, 5, 0.1); p = Graphics()
+   sage: for k in srange(0, 10, 0.15):
+   ....:       y = integrate.odeint(f, k, t)
+-  ....:       p += line(zip(t, flatten(y)))
++  ....:       p += line(zip(t, y.flatten()))
+   sage: t = srange(0, -5, -0.1); q = Graphics()
+   sage: for k in srange(0, 10, 0.15):
+   ....:       y = integrate.odeint(f, k, t)
+-  ....:       q += line(zip(t, flatten(y)))
++  ....:       q += line(zip(t, y.flatten()))
+   sage: y = var('y')
+   sage: v = plot_vector_field((1, -cos(x*y)), (x,-5,5), (y,-2,11))
+   sage: g = p + q + v; g.show()
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index d890a65230cb..dee6e8eb0d4b 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -80,6 +80,23 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-k8Oam+EiRcfXC7qCdLacCx+7vpUAw2K1wsjKcQbeGb4=";
     })
 
+    # https://github.com/sagemath/sage/pull/35826, landed in 10.1.beta5
+    (fetchpatch {
+      name = "numpy-1.25.0-upgrade.patch";
+      url = "https://github.com/sagemath/sage/commit/ecfe06b8f1fe729b07e885f0de55244467e5c137.diff";
+      sha256 = "sha256-G0xhl+LyNdDYPzRqSHK3fHaepcIzpuwmqRiussraDf0=";
+    })
+
+    # https://github.com/sagemath/sage/pull/35826#issuecomment-1658569891
+    ./patches/numpy-1.25-deprecation.patch
+
+    # https://github.com/sagemath/sage/pull/35842, landed in 10.1.beta5
+    (fetchpatch {
+      name = "scipy-1.11-upgrade.patch";
+      url = "https://github.com/sagemath/sage/commit/90ece168c3c61508baa36659b0027b7dd8b43add.diff";
+      sha256 = "sha256-Y5TmuJcUJR+veb2AuSVODGs+xkVV+pTM8fWTm4q+NDs=";
+    })
+
     # https://github.com/sagemath/sage/pull/35825, landed in 10.1.beta6
     (fetchpatch {
       name = "singular-4.3.2p2-upgrade.patch";
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index f037867aee43..6179c1719d33 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "383";
+  version = "384";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    hash = "sha256-oGYTvNpQjCob/21CMIldp0p5h5mi45ojusggide5qZg=";
+    hash = "sha256-Me+HB0DOrgIMPEtKlgHH9Hv9RmcsGq8tITpWXWTLw3M=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/version-management/gex/default.nix b/pkgs/applications/version-management/gex/default.nix
index 051b7dfdc924..40a7fc6ba79b 100644
--- a/pkgs/applications/version-management/gex/default.nix
+++ b/pkgs/applications/version-management/gex/default.nix
@@ -1,9 +1,8 @@
 { lib
-, stdenv
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, libgit2
+, libgit2_1_6
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,7 +17,10 @@ rustPlatform.buildRustPackage rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libgit2 ];
+
+  buildInputs = [
+    libgit2_1_6
+  ];
 
   cargoHash = "sha256-28sMY47LAdaGmPNmxeu/w1Pn6AV3JlWbxFcit5pLkI0";
 
diff --git a/pkgs/applications/version-management/gql/default.nix b/pkgs/applications/version-management/gql/default.nix
index 80cb28a09e5b..b5682ad4bafa 100644
--- a/pkgs/applications/version-management/gql/default.nix
+++ b/pkgs/applications/version-management/gql/default.nix
@@ -2,7 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
-, libgit2
+, libgit2_1_6
 , zlib
 }:
 
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   buildInputs = [
-    libgit2
+    libgit2_1_6
     zlib
   ];
 
diff --git a/pkgs/applications/video/catt/default.nix b/pkgs/applications/video/catt/default.nix
index cdcb45fa5fd5..1270fbae33d2 100644
--- a/pkgs/applications/video/catt/default.nix
+++ b/pkgs/applications/video/catt/default.nix
@@ -24,6 +24,7 @@ let
           inherit version;
           hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
         };
+        disabledTests = [ "test_bytes_args" ]; # https://github.com/pallets/click/commit/6e05e1fa1c2804
       });
 
       pychromecast = super.pychromecast.overridePythonAttrs (oldAttrs: rec {
diff --git a/pkgs/applications/video/entangle/default.nix b/pkgs/applications/video/entangle/default.nix
index b163fc2aa60b..daf56c174456 100644
--- a/pkgs/applications/video/entangle/default.nix
+++ b/pkgs/applications/video/entangle/default.nix
@@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
     python3 # for build scripts
     pkgconf
     wrapGAppsHook
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -79,7 +80,6 @@ stdenv.mkDerivation rec {
     elfutils
     gexiv2
     glib
-    gobject-introspection
     gst-plugins-base
     gstreamer
     gtk3
diff --git a/pkgs/applications/video/flowblade/default.nix b/pkgs/applications/video/flowblade/default.nix
index 7e85b65de35f..2643a449c60f 100644
--- a/pkgs/applications/video/flowblade/default.nix
+++ b/pkgs/applications/video/flowblade/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    ffmpeg frei0r sox gtk3 gobject-introspection ladspaPlugins
+    ffmpeg frei0r sox gtk3 ladspaPlugins
     (python3.withPackages (ps: with ps; [ mlt pygobject3 dbus-python numpy pillow ]))
   ];
 
diff --git a/pkgs/applications/video/recapp/default.nix b/pkgs/applications/video/recapp/default.nix
index 7ec88af821e5..1e644ff9f417 100644
--- a/pkgs/applications/video/recapp/default.nix
+++ b/pkgs/applications/video/recapp/default.nix
@@ -44,12 +44,12 @@ python3.pkgs.buildPythonApplication rec {
     ninja
     pkg-config
     wrapGAppsHook
+    gobject-introspection
   ];
 
   buildInputs = [
     libnotify
     librsvg
-    gobject-introspection
     gtk3
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
diff --git a/pkgs/applications/video/xplayer/default.nix b/pkgs/applications/video/xplayer/default.nix
index 56ba7957a5a2..20a9772021a9 100644
--- a/pkgs/applications/video/xplayer/default.nix
+++ b/pkgs/applications/video/xplayer/default.nix
@@ -67,13 +67,13 @@ stdenv.mkDerivation rec {
     itstool
     pkg-config
     yelp-tools
+    gobject-introspection
   ];
 
   buildInputs = [
     clutter-gst
     clutter-gtk
     glib
-    gobject-introspection
     gst-plugins-bad
     gst-plugins-base
     gst-plugins-good
diff --git a/pkgs/applications/window-managers/awesome/default.nix b/pkgs/applications/window-managers/awesome/default.nix
index b19f17275ad6..3c377d011bd3 100644
--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/applications/window-managers/awesome/default.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
     xmlto docbook_xml_dtd_45
     docbook_xsl findXMLCatalogs
     asciidoctor
+    gobject-introspection
   ];
 
   outputs = [ "out" "doc" ];
@@ -59,7 +60,7 @@ stdenv.mkDerivation rec {
   FONTCONFIG_FILE = toString fontsConf;
 
   propagatedUserEnvPkgs = [ hicolor-icon-theme ];
-  buildInputs = [ cairo librsvg dbus gdk-pixbuf gobject-introspection
+  buildInputs = [ cairo librsvg dbus gdk-pixbuf
                   git luaEnv libpthreadstubs libstartup_notification
                   libxdg_basedir lua nettools pango xcb-util-cursor
                   xorg.libXau xorg.libXdmcp xorg.libxcb xorg.libxshmfence
diff --git a/pkgs/applications/window-managers/i3/pystatus.nix b/pkgs/applications/window-managers/i3/pystatus.nix
index 3472c760428b..73136980aa93 100644
--- a/pkgs/applications/window-managers/i3/pystatus.nix
+++ b/pkgs/applications/window-managers/i3/pystatus.nix
@@ -19,7 +19,11 @@ python3Packages.buildPythonApplication rec {
     sha256 = "18ygvkl92yr69kxsym57k1mc90asdxpz4b943i61qr0s4fc5n4mq";
   };
 
-  buildInputs = [ libpulseaudio libnotify gobject-introspection ];
+  nativeBuildInputs = [
+    gobject-introspection
+  ];
+
+  buildInputs = [ libpulseaudio libnotify ];
 
   propagatedBuildInputs = with python3Packages; [
     keyring colour netifaces psutil basiciw pygobject3
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 07ac6737f39d..7f5cd4cf4af3 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -81,8 +81,18 @@ for flag in "${!hardeningEnableMap[@]}"; do
       hardeningCFlags+=('-fPIC')
       ;;
     strictoverflow)
-       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
-      hardeningCFlags+=('-fno-strict-overflow')
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
+      if (( @isClang@ )); then
+        # In Clang, -fno-strict-overflow only serves to set -fwrapv and is
+        # reported as an unused CLI argument if -fwrapv or -fno-wrapv is set
+        # explicitly, so we side step that by doing the conversion here.
+        #
+        # See: https://github.com/llvm/llvm-project/blob/llvmorg-16.0.6/clang/lib/Driver/ToolChains/Clang.cpp#L6315
+        #
+        hardeningCFlags+=('-fwrapv')
+      else
+        hardeningCFlags+=('-fno-strict-overflow')
+      fi
       ;;
     format)
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 551074e0a211..53141cac5dfb 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -609,6 +609,8 @@ stdenv.mkDerivation {
 
 
   env = {
+    inherit isClang;
+
     # for substitution in utils.bash
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
     shell = getBin shell + shell.shellPath or "";
diff --git a/pkgs/build-support/libredirect/default.nix b/pkgs/build-support/libredirect/default.nix
index 6e2de7fa11b0..1ab4a0db827a 100644
--- a/pkgs/build-support/libredirect/default.nix
+++ b/pkgs/build-support/libredirect/default.nix
@@ -1,5 +1,12 @@
-{ lib, stdenv, bintools-unwrapped, llvmPackages_13, coreutils }:
+{ lib, stdenv, bintools-unwrapped, llvmPackages, llvmPackages_13, coreutils }:
 
+let
+  # aarch64-darwin needs a clang that can build arm64e binaries, so make sure a version of LLVM
+  # is used that can do that, but prefer the stdenv one if it is new enough.
+  llvmPkgs = if (lib.versionAtLeast (lib.getVersion llvmPackages.clang) "13")
+    then llvmPackages
+    else llvmPackages_13;
+  in
 if stdenv.hostPlatform.isStatic
 then throw ''
   libredirect is not available on static builds.
@@ -39,11 +46,11 @@ else stdenv.mkDerivation rec {
     # and the library search directory for libdl.
     # We can't build this on x86_64, because the libSystem we point to doesn't
     # like arm64(e).
-    PATH=${bintools-unwrapped}/bin:${llvmPackages_13.clang-unwrapped}/bin:$PATH \
+    PATH=${bintools-unwrapped}/bin:${llvmPkgs.clang-unwrapped}/bin:$PATH \
       clang -arch x86_64 -arch arm64 -arch arm64e \
-      -isystem ${llvmPackages_13.clang.libc}/include \
-      -isystem ${llvmPackages_13.libclang.lib}/lib/clang/*/include \
-      -L${llvmPackages_13.clang.libc}/lib \
+      -isystem ${llvmPkgs.clang.libc}/include \
+      -isystem ${llvmPkgs.libclang.lib}/lib/clang/*/include \
+      -L${llvmPkgs.clang.libc}/lib \
       -Wl,-install_name,$libName \
       -Wall -std=c99 -O3 -fPIC libredirect.c \
       -shared -o "$libName"
diff --git a/pkgs/build-support/libredirect/libredirect.c b/pkgs/build-support/libredirect/libredirect.c
index 9ecc16450cc2..19211a813eb8 100644
--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@@ -106,7 +106,7 @@ static int open_needs_mode(int flags)
 
 WRAPPER(int, open)(const char * path, int flags, ...)
 {
-    int (*open_real) (const char *, int, mode_t) = LOOKUP_REAL(open);
+    int (*open_real) (const char *, int, ...) = LOOKUP_REAL(open);
     mode_t mode = 0;
     if (open_needs_mode(flags)) {
         va_list ap;
@@ -139,7 +139,7 @@ WRAPPER_DEF(open64)
 
 WRAPPER(int, openat)(int dirfd, const char * path, int flags, ...)
 {
-    int (*openat_real) (int, const char *, int, mode_t) = LOOKUP_REAL(openat);
+    int (*openat_real) (int, const char *, int, ...) = LOOKUP_REAL(openat);
     mode_t mode = 0;
     if (open_needs_mode(flags)) {
         va_list ap;
diff --git a/pkgs/build-support/rust/default-crate-overrides.nix b/pkgs/build-support/rust/default-crate-overrides.nix
index e4db2c8a0573..f04eeeaa9bf5 100644
--- a/pkgs/build-support/rust/default-crate-overrides.nix
+++ b/pkgs/build-support/rust/default-crate-overrides.nix
@@ -193,8 +193,8 @@ in
   };
 
   graphene-sys = attrs: {
-    nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ graphene gobject-introspection ];
+    nativeBuildInputs = [ pkg-config gobject-introspection ];
+    buildInputs = [ graphene ];
   };
 
   nettle-sys = attrs: {
diff --git a/pkgs/build-support/rust/hooks/maturin-build-hook.sh b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
index 41b313280d70..62d5619660c6 100644
--- a/pkgs/build-support/rust/hooks/maturin-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
@@ -24,8 +24,6 @@ maturinBuildHook() {
         ${maturinBuildFlags-}
     )
 
-    runHook postBuild
-
     if [ ! -z "${buildAndTestSubdir-}" ]; then
         popd
     fi
@@ -34,6 +32,9 @@ maturinBuildHook() {
     mkdir -p dist
     mv target/wheels/*.whl dist/
 
+    # These are python build hooks and may depend on ./dist
+    runHook postBuild
+
     echo "Finished maturinBuildHook"
 }
 
diff --git a/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh b/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh
new file mode 100644
index 000000000000..5f53e7e95b2e
--- /dev/null
+++ b/pkgs/build-support/setup-hooks/strip-tmp-aarch64.sh
@@ -0,0 +1,90 @@
+# This setup hook strips libraries and executables in the fixup phase.
+
+fixupOutputHooks+=(_doStrip)
+
+_doStrip() {
+    # We don't bother to strip build platform code because it shouldn't make it
+    # to $out anyways---if it does, that's a bigger problem that a lack of
+    # stripping will help catch.
+    local -ra flags=(dontStripHost dontStripTarget)
+    local -ra debugDirs=(stripDebugList stripDebugListTarget)
+    local -ra allDirs=(stripAllList stripAllListTarget)
+    local -ra stripCmds=(STRIP STRIP_FOR_TARGET)
+    local -ra ranlibCmds=(RANLIB RANLIB_FOR_TARGET)
+
+    # TODO(structured-attrs): This doesn't work correctly if one of
+    #   the items in strip*List or strip*Flags contains a space,
+    #   even with structured attrs enabled.  This is OK for now
+    #   because very few packages set any of these, and it doesn't
+    #   affect any of them.
+    #
+    #   After __structuredAttrs = true is universal, come back and
+    #   push arrays all the way through this logic.
+
+    # Strip only host paths by default. Leave targets as is.
+    stripDebugList=${stripDebugList[*]:-lib lib32 lib64 libexec bin sbin}
+    stripDebugListTarget=${stripDebugListTarget[*]:-}
+    stripAllList=${stripAllList[*]:-}
+    stripAllListTarget=${stripAllListTarget[*]:-}
+
+    local i
+    for i in ${!stripCmds[@]}; do
+        local -n flag="${flags[$i]}"
+        local -n debugDirList="${debugDirs[$i]}"
+        local -n allDirList="${allDirs[$i]}"
+        local -n stripCmd="${stripCmds[$i]}"
+        local -n ranlibCmd="${ranlibCmds[$i]}"
+
+        # `dontStrip` disables them all
+        if [[ "${dontStrip-}" || "${flag-}" ]] || ! type -f "${stripCmd-}" 2>/dev/null 1>&2
+        then continue; fi
+
+        stripDirs "$stripCmd" "$ranlibCmd" "$debugDirList" "${stripDebugFlags[*]:--S -p}"
+        stripDirs "$stripCmd" "$ranlibCmd" "$allDirList" "${stripAllFlags[*]:--s -p}"
+    done
+}
+
+stripDirs() {
+    local cmd="$1"
+    local ranlibCmd="$2"
+    local paths="$3"
+    local stripFlags="$4"
+    local pathsNew=
+
+    [ -z "$cmd" ] && echo "stripDirs: Strip command is empty" 1>&2 && exit 1
+    [ -z "$ranlibCmd" ] && echo "stripDirs: Ranlib command is empty" 1>&2 && exit 1
+
+    local p
+    for p in ${paths}; do
+        if [ -e "$prefix/$p" ]; then
+            pathsNew="${pathsNew} $prefix/$p"
+        fi
+    done
+    paths=${pathsNew}
+
+    if [ -n "${paths}" ]; then
+        echo "stripping (with command $cmd and flags $stripFlags) in $paths"
+        local striperr
+        striperr="$(mktemp 'striperr.XXXXXX')"
+        # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
+        find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
+            # Make sure we process files under symlinks only once. Otherwise
+            # 'strip` can corrupt files when writes to them in parallel:
+            #   https://github.com/NixOS/nixpkgs/issues/246147#issuecomment-1657072039
+            xargs -r -0 -n1 -- realpath -z | sort -u -z |
+
+            xargs -r -0 -n1 -P "$NIX_BUILD_CORES" -- $cmd $stripFlags 2>"$striperr" || exit_code=$?
+        # xargs exits with status code 123 if some but not all of the
+        # processes fail. We don't care if some of the files couldn't
+        # be stripped, so ignore specifically this code.
+        [[ "$exit_code" = 123 || -z "$exit_code" ]] || (cat "$striperr" 1>&2 && exit 1)
+
+        rm "$striperr"
+        # 'strip' does not normally preserve archive index in .a files.
+        # This usually causes linking failures against static libs like:
+        #   ld: ...-i686-w64-mingw32-stage-final-gcc-13.0.0-lib/i686-w64-mingw32/lib/libstdc++.dll.a:
+        #     error adding symbols: archive has no index; run ranlib to add one
+        # Restore the index by running 'ranlib'.
+        find $paths -name '*.a' -type f -exec $ranlibCmd '{}' \; 2>/dev/null
+    fi
+}
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index 849148e92149..1d65c10c5230 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -51,6 +51,9 @@ stripDirs() {
     local stripFlags="$4"
     local pathsNew=
 
+    [ -z "$cmd" ] && echo "stripDirs: Strip command is empty" 1>&2 && exit 1
+    [ -z "$ranlibCmd" ] && echo "stripDirs: Ranlib command is empty" 1>&2 && exit 1
+
     local p
     for p in ${paths}; do
         if [ -e "$prefix/$p" ]; then
@@ -61,8 +64,17 @@ stripDirs() {
 
     if [ -n "${paths}" ]; then
         echo "stripping (with command $cmd and flags $stripFlags) in $paths"
+        local striperr
+        striperr="$(mktemp 'striperr.XXXXXX')"
         # Do not strip lib/debug. This is a directory used by setup-hooks/separate-debug-info.sh.
-        find $paths -type f -a '!' -wholename "$prefix/lib/debug/*" -exec $cmd $stripFlags '{}' \; 2>/dev/null
+        find $paths -type f -a '!' -path "$prefix/lib/debug/*" -print0 |
+            xargs -r -0 -n1 -P "$NIX_BUILD_CORES" -- $cmd $stripFlags 2>"$striperr" || exit_code=$?
+        # xargs exits with status code 123 if some but not all of the
+        # processes fail. We don't care if some of the files couldn't
+        # be stripped, so ignore specifically this code.
+        [[ "$exit_code" = 123 || -z "$exit_code" ]] || (cat "$striperr" 1>&2 && exit 1)
+
+        rm "$striperr"
         # 'strip' does not normally preserve archive index in .a files.
         # This usually causes linking failures against static libs like:
         #   ld: ...-i686-w64-mingw32-stage-final-gcc-13.0.0-lib/i686-w64-mingw32/lib/libstdc++.dll.a:
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 6fd4a6641cec..d489c23c6b8d 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -30,7 +30,7 @@ let
   ]));
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.90";
+  srcVersion = "3.92";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -45,7 +45,7 @@ let
 
     src = if nssOverride != null then nssOverride.src else fetchurl {
       url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      hash = "sha256-ms1lNMQdjq0Z/Kb8s//+0vnwnEN8PXn+5qTuZoqqk7Y=";
+      hash = "sha256-PbGS1uiCA5rwKufq8yF+0RS7etg0FMZGdyq4Ah4kolQ=";
     };
 
     dontBuild = true;
diff --git a/pkgs/desktops/cinnamon/bulky/default.nix b/pkgs/desktops/cinnamon/bulky/default.nix
index 8077e29316a8..2d7fd0c6c022 100644
--- a/pkgs/desktops/cinnamon/bulky/default.nix
+++ b/pkgs/desktops/cinnamon/bulky/default.nix
@@ -26,11 +26,11 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
     gsettings-desktop-schemas
     gettext
+    gobject-introspection
   ];
 
   buildInputs = [
     (python3.withPackages (p: with p; [ pygobject3 magic setproctitle ]))
-    gobject-introspection
     gsettings-desktop-schemas
     gtk3
     glib
diff --git a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
index 5e736ea1fdc8..e42e5a6069b9 100644
--- a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
@@ -41,7 +41,6 @@ stdenv.mkDerivation rec {
     xorg.libxkbfile
     xorg.libXext
     xorg.libXrandr
-    gobject-introspection
   ];
 
   nativeBuildInputs = [
@@ -51,6 +50,7 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
     intltool
     pkg-config
+    gobject-introspection
   ];
 
   postPatch = ''
diff --git a/pkgs/desktops/cinnamon/cinnamon-menus/default.nix b/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
index 1b5dbeb8d085..444a68778664 100644
--- a/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
@@ -22,7 +22,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib
-    gobject-introspection
   ];
 
   nativeBuildInputs = [
@@ -30,6 +29,7 @@ stdenv.mkDerivation rec {
     ninja
     wrapGAppsHook
     pkg-config
+    gobject-introspection
   ];
 
   meta = with lib; {
diff --git a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
index 6692aac628fd..956a87773d6d 100644
--- a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
@@ -48,11 +48,11 @@ stdenv.mkDerivation rec {
     libtool
     meson
     ninja
+    gobject-introspection
   ];
 
   buildInputs = [
     # from meson.build
-    gobject-introspection
     gtk3
     glib
 
diff --git a/pkgs/desktops/cinnamon/cjs/default.nix b/pkgs/desktops/cinnamon/cjs/default.nix
index 0c07b46822a7..681d6afd4ead 100644
--- a/pkgs/desktops/cinnamon/cjs/default.nix
+++ b/pkgs/desktops/cinnamon/cjs/default.nix
@@ -33,10 +33,10 @@ stdenv.mkDerivation rec {
     pkg-config
     which # for locale detection
     libxml2 # for xml-stripblanks
+    gobject-introspection
   ];
 
   buildInputs = [
-    gobject-introspection
     cairo
     readline
     spidermonkey_102
diff --git a/pkgs/desktops/cinnamon/muffin/default.nix b/pkgs/desktops/cinnamon/muffin/default.nix
index d3046830f012..c2ad10f97ac0 100644
--- a/pkgs/desktops/cinnamon/muffin/default.nix
+++ b/pkgs/desktops/cinnamon/muffin/default.nix
@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
     python3
     wrapGAppsHook
     xorgserver # for cvt command
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -69,7 +70,6 @@ stdenv.mkDerivation rec {
     cinnamon-desktop
     dbus
     glib
-    gobject-introspection
     gtk3
     libcanberra
     libdrm
diff --git a/pkgs/desktops/cinnamon/nemo/default.nix b/pkgs/desktops/cinnamon/nemo/default.nix
index 0b4e3be1a325..f82c00f4a9d1 100644
--- a/pkgs/desktops/cinnamon/nemo/default.nix
+++ b/pkgs/desktops/cinnamon/nemo/default.nix
@@ -49,7 +49,6 @@ stdenv.mkDerivation rec {
     libexif
     exempi
     gvfs
-    gobject-introspection
     libgsf
   ];
 
@@ -60,6 +59,7 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
     intltool
     shared-mime-info
+    gobject-introspection
   ];
 
   mesonFlags = [
diff --git a/pkgs/desktops/cinnamon/xapp/default.nix b/pkgs/desktops/cinnamon/xapp/default.nix
index 7139dce15c79..5b38d0662ea5 100644
--- a/pkgs/desktops/cinnamon/xapp/default.nix
+++ b/pkgs/desktops/cinnamon/xapp/default.nix
@@ -44,10 +44,10 @@ stdenv.mkDerivation rec {
     python3
     vala
     wrapGAppsHook
+    gobject-introspection
   ];
 
   buildInputs = [
-    gobject-introspection
     (python3.withPackages (ps: with ps; [
       pygobject3
       setproctitle # mate applet
diff --git a/pkgs/desktops/deepin/go-package/go-gir-generator/default.nix b/pkgs/desktops/deepin/go-package/go-gir-generator/default.nix
index 7f377d2a6e74..eecdbeb990ba 100644
--- a/pkgs/desktops/deepin/go-package/go-gir-generator/default.nix
+++ b/pkgs/desktops/deepin/go-package/go-gir-generator/default.nix
@@ -21,11 +21,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     go
+    gobject-introspection
   ];
 
   buildInputs = [
     libgudev
-    gobject-introspection
   ];
 
   makeFlags = [
diff --git a/pkgs/desktops/gnome/apps/gnome-music/default.nix b/pkgs/desktops/gnome/apps/gnome-music/default.nix
index d66efad0728d..5c5aba52704d 100644
--- a/pkgs/desktops/gnome/apps/gnome-music/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-music/default.nix
@@ -58,7 +58,6 @@ python3.pkgs.buildPythonApplication rec {
     glib
     libmediaart
     gnome-online-accounts
-    gobject-introspection
     gdk-pixbuf
     python3
     grilo
diff --git a/pkgs/desktops/gnome/core/gnome-shell/default.nix b/pkgs/desktops/gnome/core/gnome-shell/default.nix
index 7528f1bc3a5d..5c49914cdf02 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@@ -120,6 +120,7 @@ stdenv.mkDerivation rec {
     desktop-file-utils
     libxslt.bin
     asciidoc
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -153,7 +154,6 @@ stdenv.mkDerivation rec {
     ibus
     gnome-desktop
     gnome-settings-daemon
-    gobject-introspection
     mesa
 
     # recording
diff --git a/pkgs/desktops/gnome/core/mutter/43/default.nix b/pkgs/desktops/gnome/core/mutter/43/default.nix
index 0f864c6f3497..2202e94881c1 100644
--- a/pkgs/desktops/gnome/core/mutter/43/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/43/default.nix
@@ -102,6 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
     wrapGAppsHook
     gi-docgen
     xorgserver
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -110,7 +111,6 @@ stdenv.mkDerivation (finalAttrs: {
     glib
     gnome-desktop
     gnome-settings-daemon
-    gobject-introspection
     gsettings-desktop-schemas
     gtk3
     libcanberra
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index 360095a8ad1d..4c0960eb25e3 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -108,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
     wrapGAppsHook4
     gi-docgen
     xorgserver
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -116,7 +117,6 @@ stdenv.mkDerivation (finalAttrs: {
     glib
     gnome-desktop
     gnome-settings-daemon
-    gobject-introspection
     gsettings-desktop-schemas
     atk
     fribidi
diff --git a/pkgs/desktops/gnome/extensions/gnome-browser-connector/default.nix b/pkgs/desktops/gnome/extensions/gnome-browser-connector/default.nix
index 835fa31dd29b..1b09d4da0ef1 100644
--- a/pkgs/desktops/gnome/extensions/gnome-browser-connector/default.nix
+++ b/pkgs/desktops/gnome/extensions/gnome-browser-connector/default.nix
@@ -32,7 +32,6 @@ buildPythonApplication rec {
 
   buildInputs = [
     gnome.gnome-shell
-    gobject-introspection # for Gio typelib
   ];
 
   pythonPath = [
diff --git a/pkgs/development/compilers/bigloo/default.nix b/pkgs/development/compilers/bigloo/default.nix
index 759a8aaeaa60..9bf22ba6dcf2 100644
--- a/pkgs/development/compilers/bigloo/default.nix
+++ b/pkgs/development/compilers/bigloo/default.nix
@@ -45,8 +45,14 @@ stdenv.mkDerivation rec {
 
   checkTarget = "test";
 
-  # Hack to avoid TMPDIR in RPATHs.
-  preFixup = ''rm -rf "$(pwd)" '';
+  # remove forbidden references to $TMPDIR
+  preFixup = lib.optionalString stdenv.isLinux ''
+    for f in "$out"/bin/*; do
+      if isELF "$f"; then
+        patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$f"
+      fi
+    done
+  '';
 
   meta = {
     description = "Efficient Scheme compiler";
diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix
index c61093c67c03..ff473019de77 100644
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@@ -144,12 +144,10 @@ let majorVersion = "10";
 
 in
 
-lib.pipe (stdenv.mkDerivation ({
+lib.pipe ((callFile ../common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
-  builder = ../builder.sh;
-
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
     sha256 = "1wg4xdizkksmwi66mvv2v4pk3ja8x64m7v9gzhykzd3wrmdpsaf9";
diff --git a/pkgs/development/compilers/gcc/11/default.nix b/pkgs/development/compilers/gcc/11/default.nix
index 92abdebe49b3..b00997230774 100644
--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@@ -157,12 +157,10 @@ let majorVersion = "11";
 
 in
 
-lib.pipe (stdenv.mkDerivation ({
+lib.pipe ((callFile ../common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
-  builder = ../builder.sh;
-
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
     hash = "sha256-Py2yIrAH6KSiPNW6VnJu8I6LHx6yBV7nLBQCzqc6jdk=";
diff --git a/pkgs/development/compilers/gcc/12/default.nix b/pkgs/development/compilers/gcc/12/default.nix
index 9665c2a9fe85..da9ebb0a63c1 100644
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@@ -201,12 +201,10 @@ let majorVersion = "12";
 
 in
 
-lib.pipe (stdenv.mkDerivation ({
+lib.pipe ((callFile ../common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
-  builder = ../builder.sh;
-
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
     sha256 = "sha256-lJpdT5nnhkIak7Uysi/6tVeN5zITaZdbka7Jet/ajDs=";
diff --git a/pkgs/development/compilers/gcc/13/default.nix b/pkgs/development/compilers/gcc/13/default.nix
index 1b73c251ce6f..82b30a0e5102 100644
--- a/pkgs/development/compilers/gcc/13/default.nix
+++ b/pkgs/development/compilers/gcc/13/default.nix
@@ -195,12 +195,10 @@ let majorVersion = "13";
 
 in
 
-lib.pipe (stdenv.mkDerivation ({
+lib.pipe ((callFile ../common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
-  builder = ../builder.sh;
-
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
     sha256 = "sha256-YdaE8Kpedqxlha2ImKJCeq3ol57V5/hUkihsTfwT7oY=";
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index fa856eff96e5..acc8ba41a00b 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -193,12 +193,10 @@ in
 # We need all these X libraries when building AWT with GTK.
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
 
-lib.pipe (stdenv.mkDerivation ({
+lib.pipe ((callFile ../common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
-  builder = ../builder.sh;
-
   src = fetchurl {
     url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
     sha256 = "08yggr18v373a1ihj0rg2vd6psnic42b518xcgp3r9k81xz1xyr2";
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index bab79f968db3..fadc9b72c45f 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -210,12 +210,10 @@ in
 # We need all these X libraries when building AWT with GTK.
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
 
-lib.pipe (stdenv.mkDerivation ({
+lib.pipe ((callFile ../common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
-  builder = ../builder.sh;
-
   src = fetchurl {
     url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
     sha256 = "14l06m7nvcvb0igkbip58x59w3nq6315k6jcz3wr9ch1rn9d44bc";
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index f443babb4b70..f19c2b4f46c8 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -199,12 +199,10 @@ in
 # We need all these X libraries when building AWT with GTK.
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
 
-lib.pipe (stdenv.mkDerivation ({
+lib.pipe ((callFile ../common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
-  builder = ../builder.sh;
-
   src = if stdenv.targetPlatform.isVc4 then fetchFromGitHub {
     owner = "itszor";
     repo = "gcc-vc4";
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 5b6ea7ead50a..72e241214fe4 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -149,12 +149,10 @@ let majorVersion = "7";
 
 in
 
-lib.pipe (stdenv.mkDerivation ({
+lib.pipe ((callFile ../common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
-  builder = ../builder.sh;
-
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
     sha256 = "0qg6kqc5l72hpnj4vr6l0p69qav0rh4anlkk3y55540zy3klc6dq";
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index f903e264b0af..274373a4fc8f 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -130,12 +130,10 @@ let majorVersion = "8";
 
 in
 
-lib.pipe (stdenv.mkDerivation ({
+lib.pipe ((callFile ../common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
-  builder = ../builder.sh;
-
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
     sha256 = "0l7d4m9jx124xsk6xardchgy2k5j5l2b15q322k31f0va4d8826k";
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index 289212a13635..d08de2a5b79c 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -144,12 +144,10 @@ let majorVersion = "9";
 
 in
 
-lib.pipe (stdenv.mkDerivation ({
+lib.pipe ((callFile ../common/builder.nix {}) ({
   pname = "${crossNameAddon}${name}";
   inherit version;
 
-  builder = ../builder.sh;
-
   src = fetchurl {
     url = "mirror://gcc/releases/gcc-${version}/gcc-${version}.tar.xz";
     sha256 = "13ygjmd938m0wmy946pxdhz9i1wq7z4w10l6pvidak0xxxj9yxi7";
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
deleted file mode 100644
index d9016c45e579..000000000000
--- a/pkgs/development/compilers/gcc/builder.sh
+++ /dev/null
@@ -1,290 +0,0 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
-source $stdenv/setup
-
-
-oldOpts="$(shopt -po nounset)" || true
-set -euo pipefail
-
-
-export NIX_FIXINC_DUMMY="$NIX_BUILD_TOP/dummy"
-mkdir "$NIX_FIXINC_DUMMY"
-
-
-if test "$staticCompiler" = "1"; then
-    EXTRA_LDFLAGS="-static"
-else
-    EXTRA_LDFLAGS="-Wl,-rpath,${!outputLib}/lib"
-fi
-
-
-# GCC interprets empty paths as ".", which we don't want.
-if test -z "${CPATH-}"; then unset CPATH; fi
-if test -z "${LIBRARY_PATH-}"; then unset LIBRARY_PATH; fi
-echo "\$CPATH is \`${CPATH-}'"
-echo "\$LIBRARY_PATH is \`${LIBRARY_PATH-}'"
-
-if test "$noSysDirs" = "1"; then
-
-    declare \
-        EXTRA_FLAGS_FOR_BUILD EXTRA_FLAGS EXTRA_FLAGS_FOR_TARGET \
-        EXTRA_LDFLAGS_FOR_BUILD EXTRA_LDFLAGS_FOR_TARGET
-
-    # Extract flags from Bintools Wrappers
-    for post in '_FOR_BUILD' ''; do
-        curBintools="NIX_BINTOOLS${post}"
-
-        declare -a extraLDFlags=()
-        if [[ -e "${!curBintools}/nix-support/orig-libc" ]]; then
-            # Figure out what extra flags when linking to pass to the gcc
-            # compilers being generated to make sure that they use our libc.
-            extraLDFlags=($(< "${!curBintools}/nix-support/libc-ldflags") $(< "${!curBintools}/nix-support/libc-ldflags-before" || true))
-            if [ -e ${!curBintools}/nix-support/ld-set-dynamic-linker ]; then
-                extraLDFlags=-dynamic-linker=$(< ${!curBintools}/nix-support/dynamic-linker)
-            fi
-
-            # The path to the Libc binaries such as `crti.o'.
-            libc_libdir="$(< "${!curBintools}/nix-support/orig-libc")/lib"
-        else
-            # Hack: support impure environments.
-            extraLDFlags=("-L/usr/lib64" "-L/usr/lib")
-            libc_libdir="/usr/lib"
-        fi
-        extraLDFlags=("-L$libc_libdir" "-rpath" "$libc_libdir"
-                      "${extraLDFlags[@]}")
-        for i in "${extraLDFlags[@]}"; do
-            declare EXTRA_LDFLAGS${post}+=" -Wl,$i"
-        done
-    done
-
-    # Extract flags from CC Wrappers
-    for post in '_FOR_BUILD' ''; do
-        curCC="NIX_CC${post}"
-        curFIXINC="NIX_FIXINC_DUMMY${post}"
-
-        declare -a extraFlags=()
-        if [[ -e "${!curCC}/nix-support/orig-libc" ]]; then
-            # Figure out what extra compiling flags to pass to the gcc compilers
-            # being generated to make sure that they use our libc.
-            extraFlags=($(< "${!curCC}/nix-support/libc-crt1-cflags") $(< "${!curCC}/nix-support/libc-cflags"))
-
-            # The path to the Libc headers
-            libc_devdir="$(< "${!curCC}/nix-support/orig-libc-dev")"
-
-            # Use *real* header files, otherwise a limits.h is generated that
-            # does not include Libc's limits.h (notably missing SSIZE_MAX,
-            # which breaks the build).
-            declare NIX_FIXINC_DUMMY${post}="$libc_devdir/include"
-        else
-            # Hack: support impure environments.
-            extraFlags=("-isystem" "/usr/include")
-            declare NIX_FIXINC_DUMMY${post}=/usr/include
-        fi
-
-        extraFlags=("-I${!curFIXINC}" "${extraFlags[@]}")
-
-        # BOOT_CFLAGS defaults to `-g -O2'; since we override it below, make
-        # sure to explictly add them so that files compiled with the bootstrap
-        # compiler are optimized and (optionally) contain debugging information
-        # (info "(gccinstall) Building").
-        if test -n "${dontStrip-}"; then
-            extraFlags=("-O2" "-g" "${extraFlags[@]}")
-        else
-            # Don't pass `-g' at all; this saves space while building.
-            extraFlags=("-O2" "${extraFlags[@]}")
-        fi
-
-        declare EXTRA_FLAGS${post}="${extraFlags[*]}"
-    done
-
-    if test -z "${targetConfig-}"; then
-        # host = target, so the flags are the same
-        EXTRA_FLAGS_FOR_TARGET="$EXTRA_FLAGS"
-        EXTRA_LDFLAGS_FOR_TARGET="$EXTRA_LDFLAGS"
-    fi
-
-    # CFLAGS_FOR_TARGET are needed for the libstdc++ configure script to find
-    # the startfiles.
-    # FLAGS_FOR_TARGET are needed for the target libraries to receive the -Bxxx
-    # for the startfiles.
-    makeFlagsArray+=(
-        "BUILD_SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY_FOR_BUILD"
-        "SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY_FOR_BUILD"
-        "NATIVE_SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY"
-
-        "LDFLAGS_FOR_BUILD=$EXTRA_LDFLAGS_FOR_BUILD"
-        #"LDFLAGS=$EXTRA_LDFLAGS"
-        "LDFLAGS_FOR_TARGET=$EXTRA_LDFLAGS_FOR_TARGET"
-
-        "CFLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
-        "CXXFLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
-        "FLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
-
-        # It seems there is a bug in GCC 5
-        #"CFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
-        #"CXXFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
-
-        "CFLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
-        "CXXFLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
-        "FLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
-    )
-
-    if test -z "${targetConfig-}"; then
-        makeFlagsArray+=(
-            "BOOT_CFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
-            "BOOT_LDFLAGS=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
-        )
-    fi
-
-    if test "$withoutTargetLibc" == 1; then
-        # We don't want the gcc build to assume there will be a libc providing
-        # limits.h in this stage
-        makeFlagsArray+=(
-            'LIMITS_H_TEST=false'
-        )
-    else
-        makeFlagsArray+=(
-            'LIMITS_H_TEST=true'
-        )
-    fi
-fi
-
-eval "$oldOpts"
-
-providedPreConfigure="$preConfigure";
-preConfigure() {
-    if test -n "$newlibSrc"; then
-        tar xvf "$newlibSrc" -C ..
-        ln -s ../newlib-*/newlib newlib
-        # Patch to get armvt5el working:
-        sed -i -e 's/ arm)/ arm*)/' newlib/configure.host
-    fi
-
-    # Bug - they packaged zlib
-    if test -d "zlib"; then
-        # This breaks the build without-headers, which should build only
-        # the target libgcc as target libraries.
-        # See 'configure:5370'
-        rm -Rf zlib
-    fi
-
-    if test -n "$crossMingw" -a -n "$withoutTargetLibc"; then
-        mkdir -p ../mingw
-        # --with-build-sysroot expects that:
-        cp -R $libcCross/include ../mingw
-        configureFlags="$configureFlags --with-build-sysroot=`pwd`/.."
-    fi
-
-    # Eval the preConfigure script from nix expression.
-    eval "$providedPreConfigure"
-
-    # Perform the build in a different directory.
-    mkdir ../build
-    cd ../build
-    configureScript=../$sourceRoot/configure
-}
-
-
-postConfigure() {
-    # Avoid store paths when embedding ./configure flags into gcc.
-    # Mangled arguments are still useful when reporting bugs upstream.
-    sed -e "/TOPLEVEL_CONFIGURE_ARGUMENTS=/ s|$NIX_STORE/[a-z0-9]\{32\}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" -i Makefile
-}
-
-
-preInstall() {
-    mkdir -p "$out/${targetConfig}/lib"
-    mkdir -p "${!outputLib}/${targetConfig}/lib"
-    # Make ‘lib64’ symlinks to ‘lib’.
-    if [ -n "$linkLib64toLib" ]; then
-        ln -s lib "$out/${targetConfig}/lib64"
-        ln -s lib "${!outputLib}/${targetConfig}/lib64"
-    fi
-    # Make ‘lib32’ symlinks to ‘lib’.
-    if [ -n "$linkLib32toLib" ]; then
-        ln -s lib "$out/${targetConfig}/lib32"
-        ln -s lib "${!outputLib}/${targetConfig}/lib32"
-    fi
-}
-
-
-postInstall() {
-    # Move runtime libraries to lib output.
-    moveToOutput "${targetConfig+$targetConfig/}lib/lib*.so*" "${!outputLib}"
-    moveToOutput "${targetConfig+$targetConfig/}lib/lib*.la"  "${!outputLib}"
-    moveToOutput "${targetConfig+$targetConfig/}lib/lib*.dylib" "${!outputLib}"
-    moveToOutput "${targetConfig+$targetConfig/}lib/lib*.dll.a" "${!outputLib}"
-    moveToOutput "share/gcc-*/python" "${!outputLib}"
-
-    if [ -z "$enableShared" ]; then
-        moveToOutput "${targetConfig+$targetConfig/}lib/lib*.a" "${!outputLib}"
-    fi
-
-    for i in "${!outputLib}/${targetConfig}"/lib/*.{la,py}; do
-        substituteInPlace "$i" --replace "$out" "${!outputLib}"
-    done
-
-    if [ -n "$enableMultilib" ]; then
-        moveToOutput "${targetConfig+$targetConfig/}lib64/lib*.so*" "${!outputLib}"
-        moveToOutput "${targetConfig+$targetConfig/}lib64/lib*.la"  "${!outputLib}"
-        moveToOutput "${targetConfig+$targetConfig/}lib64/lib*.dylib" "${!outputLib}"
-
-        for i in "${!outputLib}/${targetConfig}"/lib64/*.{la,py}; do
-            substituteInPlace "$i" --replace "$out" "${!outputLib}"
-        done
-    fi
-
-    # Remove `fixincl' to prevent a retained dependency on the
-    # previous gcc.
-    rm -rf $out/libexec/gcc/*/*/install-tools
-    rm -rf $out/lib/gcc/*/*/install-tools
-
-    # More dependencies with the previous gcc or some libs (gccbug stores the build command line)
-    rm -rf $out/bin/gccbug
-
-    if type "install_name_tool"; then
-        for i in "${!outputLib}"/lib/*.*.dylib "${!outputLib}"/lib/*.so.[0-9]; do
-            install_name_tool -id "$i" "$i" || true
-            for old_path in $(otool -L "$i" | grep "$out" | awk '{print $1}'); do
-              new_path=`echo "$old_path" | sed "s,$out,${!outputLib},"`
-              install_name_tool -change "$old_path" "$new_path" "$i" || true
-            done
-        done
-    fi
-
-    # Cross-compiler specific:
-    # --with-headers=$dir option triggers gcc to make a private copy
-    # of $dir headers and use it later as `-isysroot`. This prevents
-    # cc-wrapper from overriding libc headers with `-idirafter`.
-    # It should be safe to drop it and rely solely on the cc-wrapper.
-    local sysinc_dir=$out/${targetConfig+$targetConfig/}sys-include
-    if [ -d "$sysinc_dir" ]; then
-        chmod -R u+w "$out/${targetConfig+$targetConfig/}sys-include"
-        rm -rfv "$out/${targetConfig+$targetConfig/}sys-include"
-    fi
-
-    # Get rid of some "fixed" header files
-    rm -rfv $out/lib/gcc/*/*/include-fixed/{root,linux,sys/mount.h,bits/statx.h}
-
-    # Replace hard links for i686-pc-linux-gnu-gcc etc. with symlinks.
-    for i in $out/bin/*-gcc*; do
-        if cmp -s $out/bin/gcc $i; then
-            ln -sfn gcc $i
-        fi
-    done
-
-    for i in $out/bin/c++ $out/bin/*-c++* $out/bin/*-g++*; do
-        if cmp -s $out/bin/g++ $i; then
-            ln -sfn g++ $i
-        fi
-    done
-
-    # Two identical man pages are shipped (moving and compressing is done later)
-    for i in "$out"/share/man/man1/*g++.1; do
-        if test -e "$i"; then
-            man_prefix=`echo "$i" | sed "s,.*/\(.*\)g++.1,\1,"`
-            ln -sf "$man_prefix"gcc.1 "$i"
-        fi
-    done
-}
-
-genericBuild
diff --git a/pkgs/development/compilers/gcc/common/builder.nix b/pkgs/development/compilers/gcc/common/builder.nix
new file mode 100644
index 000000000000..cd8d4572a158
--- /dev/null
+++ b/pkgs/development/compilers/gcc/common/builder.nix
@@ -0,0 +1,278 @@
+{ lib
+, stdenv
+, enableMultilib
+}:
+
+originalAttrs: (stdenv.mkDerivation (finalAttrs: originalAttrs // {
+  preUnpack = ''
+    oldOpts="$(shopt -po nounset)" || true
+    set -euo pipefail
+
+    export NIX_FIXINC_DUMMY="$NIX_BUILD_TOP/dummy"
+    mkdir "$NIX_FIXINC_DUMMY"
+
+    if test "$staticCompiler" = "1"; then
+        EXTRA_LDFLAGS="-static"
+    else
+        EXTRA_LDFLAGS="-Wl,-rpath,''${!outputLib}/lib"
+    fi
+
+    # GCC interprets empty paths as ".", which we don't want.
+    if test -z "''${CPATH-}"; then unset CPATH; fi
+    if test -z "''${LIBRARY_PATH-}"; then unset LIBRARY_PATH; fi
+    echo "\$CPATH is \`''${CPATH-}'"
+    echo "\$LIBRARY_PATH is \`''${LIBRARY_PATH-}'"
+
+    if test "$noSysDirs" = "1"; then
+
+        declare -g \
+            EXTRA_FLAGS_FOR_BUILD EXTRA_FLAGS EXTRA_FLAGS_FOR_TARGET \
+            EXTRA_LDFLAGS_FOR_BUILD EXTRA_LDFLAGS_FOR_TARGET
+
+        # Extract flags from Bintools Wrappers
+        for post in '_FOR_BUILD' ""; do
+            curBintools="NIX_BINTOOLS''${post}"
+
+            declare -a extraLDFlags=()
+            if [[ -e "''${!curBintools}/nix-support/orig-libc" ]]; then
+                # Figure out what extra flags when linking to pass to the gcc
+                # compilers being generated to make sure that they use our libc.
+                extraLDFlags=($(< "''${!curBintools}/nix-support/libc-ldflags") $(< "''${!curBintools}/nix-support/libc-ldflags-before" || true))
+                if [ -e ''${!curBintools}/nix-support/ld-set-dynamic-linker ]; then
+                    extraLDFlags=-dynamic-linker=$(< ''${!curBintools}/nix-support/dynamic-linker)
+                fi
+
+                # The path to the Libc binaries such as `crti.o'.
+                libc_libdir="$(< "''${!curBintools}/nix-support/orig-libc")/lib"
+            else
+                # Hack: support impure environments.
+                extraLDFlags=("-L/usr/lib64" "-L/usr/lib")
+                libc_libdir="/usr/lib"
+            fi
+            extraLDFlags=("-L$libc_libdir" "-rpath" "$libc_libdir"
+                          "''${extraLDFlags[@]}")
+            for i in "''${extraLDFlags[@]}"; do
+                declare -g EXTRA_LDFLAGS''${post}+=" -Wl,$i"
+            done
+        done
+
+        # Extract flags from CC Wrappers
+        for post in '_FOR_BUILD' ""; do
+            curCC="NIX_CC''${post}"
+            curFIXINC="NIX_FIXINC_DUMMY''${post}"
+
+            declare -a extraFlags=()
+            if [[ -e "''${!curCC}/nix-support/orig-libc" ]]; then
+                # Figure out what extra compiling flags to pass to the gcc compilers
+                # being generated to make sure that they use our libc.
+                extraFlags=($(< "''${!curCC}/nix-support/libc-crt1-cflags") $(< "''${!curCC}/nix-support/libc-cflags"))
+
+                # The path to the Libc headers
+                libc_devdir="$(< "''${!curCC}/nix-support/orig-libc-dev")"
+
+                # Use *real* header files, otherwise a limits.h is generated that
+                # does not include Libc's limits.h (notably missing SSIZE_MAX,
+                # which breaks the build).
+                declare -g NIX_FIXINC_DUMMY''${post}="$libc_devdir/include"
+            else
+                # Hack: support impure environments.
+                extraFlags=("-isystem" "/usr/include")
+                declare -g NIX_FIXINC_DUMMY''${post}=/usr/include
+            fi
+
+            extraFlags=("-I''${!curFIXINC}" "''${extraFlags[@]}")
+
+            # BOOT_CFLAGS defaults to `-g -O2'; since we override it below, make
+            # sure to explictly add them so that files compiled with the bootstrap
+            # compiler are optimized and (optionally) contain debugging information
+            # (info "(gccinstall) Building").
+            if test -n "''${dontStrip-}"; then
+                extraFlags=("-O2" "-g" "''${extraFlags[@]}")
+            else
+                # Don't pass `-g' at all; this saves space while building.
+                extraFlags=("-O2" "''${extraFlags[@]}")
+            fi
+
+            declare -g EXTRA_FLAGS''${post}="''${extraFlags[*]}"
+        done
+
+        if test -z "''${targetConfig-}"; then
+            # host = target, so the flags are the same
+            EXTRA_FLAGS_FOR_TARGET="$EXTRA_FLAGS"
+            EXTRA_LDFLAGS_FOR_TARGET="$EXTRA_LDFLAGS"
+        fi
+
+        # CFLAGS_FOR_TARGET are needed for the libstdc++ configure script to find
+        # the startfiles.
+        # FLAGS_FOR_TARGET are needed for the target libraries to receive the -Bxxx
+        # for the startfiles.
+        makeFlagsArray+=(
+            "BUILD_SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY_FOR_BUILD"
+            "SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY_FOR_BUILD"
+            "NATIVE_SYSTEM_HEADER_DIR=$NIX_FIXINC_DUMMY"
+
+            "LDFLAGS_FOR_BUILD=$EXTRA_LDFLAGS_FOR_BUILD"
+            #"LDFLAGS=$EXTRA_LDFLAGS"
+            "LDFLAGS_FOR_TARGET=$EXTRA_LDFLAGS_FOR_TARGET"
+
+            "CFLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
+            "CXXFLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
+            "FLAGS_FOR_BUILD=$EXTRA_FLAGS_FOR_BUILD $EXTRA_LDFLAGS_FOR_BUILD"
+
+            # It seems there is a bug in GCC 5
+            #"CFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
+            #"CXXFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
+
+            "CFLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
+            "CXXFLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
+            "FLAGS_FOR_TARGET=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
+        )
+
+        if test -z "''${targetConfig-}"; then
+            makeFlagsArray+=(
+                "BOOT_CFLAGS=$EXTRA_FLAGS $EXTRA_LDFLAGS"
+                "BOOT_LDFLAGS=$EXTRA_FLAGS_FOR_TARGET $EXTRA_LDFLAGS_FOR_TARGET"
+            )
+        fi
+
+        if test "$withoutTargetLibc" == 1; then
+            # We don't want the gcc build to assume there will be a libc providing
+            # limits.h in this stage
+            makeFlagsArray+=(
+                'LIMITS_H_TEST=false'
+            )
+        else
+            makeFlagsArray+=(
+                'LIMITS_H_TEST=true'
+            )
+        fi
+    fi
+
+    eval "$oldOpts"
+  '';
+
+  preConfigure = (originalAttrs.preConfigure or "") + ''
+    if test -n "$newlibSrc"; then
+        tar xvf "$newlibSrc" -C ..
+        ln -s ../newlib-*/newlib newlib
+        # Patch to get armvt5el working:
+        sed -i -e 's/ arm)/ arm*)/' newlib/configure.host
+    fi
+
+    # Bug - they packaged zlib
+    if test -d "zlib"; then
+        # This breaks the build without-headers, which should build only
+        # the target libgcc as target libraries.
+        # See 'configure:5370'
+        rm -Rf zlib
+    fi
+
+    if test -n "$crossMingw" -a -n "$withoutTargetLibc"; then
+        mkdir -p ../mingw
+        # --with-build-sysroot expects that:
+        cp -R $libcCross/include ../mingw
+        configureFlags="$configureFlags --with-build-sysroot=`pwd`/.."
+    fi
+
+    # Perform the build in a different directory.
+    mkdir ../build
+    cd ../build
+    configureScript=../$sourceRoot/configure
+  '';
+
+  postConfigure = ''
+    # Avoid store paths when embedding ./configure flags into gcc.
+    # Mangled arguments are still useful when reporting bugs upstream.
+    sed -e "/TOPLEVEL_CONFIGURE_ARGUMENTS=/ s|$NIX_STORE/[a-z0-9]\{32\}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" -i Makefile
+  '';
+
+  preInstall = ''
+    mkdir -p "$out/''${targetConfig}/lib"
+    mkdir -p "''${!outputLib}/''${targetConfig}/lib"
+  '' +
+  # Make `lib64` symlinks to `lib`.
+  lib.optionalString (!enableMultilib && stdenv.hostPlatform.is64bit && !stdenv.hostPlatform.isMips64n32) ''
+    ln -s lib "$out/''${targetConfig}/lib64"
+    ln -s lib "''${!outputLib}/''${targetConfig}/lib64"
+  '' +
+  # On mips platforms, gcc follows the IRIX naming convention:
+  #
+  #  $PREFIX/lib   = mips32
+  #  $PREFIX/lib32 = mips64n32
+  #  $PREFIX/lib64 = mips64
+  #
+  # Make `lib32` symlinks to `lib`.
+  lib.optionalString (!enableMultilib && stdenv.targetPlatform.isMips64n32) ''
+    ln -s lib "$out/''${targetConfig}/lib32"
+    ln -s lib "''${!outputLib}/''${targetConfig}/lib32"
+  '';
+
+  postInstall = ''
+    # Move runtime libraries to lib output.
+    moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.so*" "''${!outputLib}"
+    moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.la"  "''${!outputLib}"
+    moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dylib" "''${!outputLib}"
+    moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.dll.a" "''${!outputLib}"
+    moveToOutput "share/gcc-*/python" "''${!outputLib}"
+
+    if [ -z "$enableShared" ]; then
+        moveToOutput "''${targetConfig+$targetConfig/}lib/lib*.a" "''${!outputLib}"
+    fi
+
+    for i in "''${!outputLib}/''${targetConfig}"/lib/*.{la,py}; do
+        substituteInPlace "$i" --replace "$out" "''${!outputLib}"
+    done
+
+    if [ -n "$enableMultilib" ]; then
+        moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.so*" "''${!outputLib}"
+        moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.la"  "''${!outputLib}"
+        moveToOutput "''${targetConfig+$targetConfig/}lib64/lib*.dylib" "''${!outputLib}"
+
+        for i in "''${!outputLib}/''${targetConfig}"/lib64/*.{la,py}; do
+            substituteInPlace "$i" --replace "$out" "''${!outputLib}"
+        done
+    fi
+
+    # Remove `fixincl' to prevent a retained dependency on the
+    # previous gcc.
+    rm -rf $out/libexec/gcc/*/*/install-tools
+    rm -rf $out/lib/gcc/*/*/install-tools
+
+    # More dependencies with the previous gcc or some libs (gccbug stores the build command line)
+    rm -rf $out/bin/gccbug
+
+    if type "install_name_tool"; then
+        for i in "''${!outputLib}"/lib/*.*.dylib "''${!outputLib}"/lib/*.so.[0-9]; do
+            install_name_tool -id "$i" "$i" || true
+            for old_path in $(otool -L "$i" | grep "$out" | awk '{print $1}'); do
+              new_path=`echo "$old_path" | sed "s,$out,''${!outputLib},"`
+              install_name_tool -change "$old_path" "$new_path" "$i" || true
+            done
+        done
+    fi
+
+    # Get rid of some "fixed" header files
+    rm -rfv $out/lib/gcc/*/*/include-fixed/{root,linux,sys/mount.h,bits/statx.h}
+
+    # Replace hard links for i686-pc-linux-gnu-gcc etc. with symlinks.
+    for i in $out/bin/*-gcc*; do
+        if cmp -s $out/bin/gcc $i; then
+            ln -sfn gcc $i
+        fi
+    done
+
+    for i in $out/bin/c++ $out/bin/*-c++* $out/bin/*-g++*; do
+        if cmp -s $out/bin/g++ $i; then
+            ln -sfn g++ $i
+        fi
+    done
+
+    # Two identical man pages are shipped (moving and compressing is done later)
+    for i in "$out"/share/man/man1/*g++.1; do
+        if test -e "$i"; then
+            man_prefix=`echo "$i" | sed "s,.*/\(.*\)g++.1,\1,"`
+            ln -sf "$man_prefix"gcc.1 "$i"
+        fi
+    done
+  '';
+}))
diff --git a/pkgs/development/compilers/gcc/common/pre-configure.nix b/pkgs/development/compilers/gcc/common/pre-configure.nix
index e386693b22c7..933a132ce4d1 100644
--- a/pkgs/development/compilers/gcc/common/pre-configure.nix
+++ b/pkgs/development/compilers/gcc/common/pre-configure.nix
@@ -148,16 +148,3 @@ in lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
     echo 'SHLIB_LC=${SHLIB_LC}' >> libgcc/Makefile.in
   '')
 
-+ lib.optionalString (!enableMultilib && hostPlatform.is64bit && !hostPlatform.isMips64n32) ''
-  export linkLib64toLib=1
-''
-
-# On mips platforms, gcc follows the IRIX naming convention:
-#
-#  $PREFIX/lib   = mips32
-#  $PREFIX/lib32 = mips64n32
-#  $PREFIX/lib64 = mips64
-#
-+ lib.optionalString (!enableMultilib && targetPlatform.isMips64n32) ''
-  export linkLib32toLib=1
-''
diff --git a/pkgs/development/compilers/llvm/10/clang/default.nix b/pkgs/development/compilers/llvm/10/clang/default.nix
index 3d503c9b9139..ad4e91304158 100644
--- a/pkgs/development/compilers/llvm/10/clang/default.nix
+++ b/pkgs/development/compilers/llvm/10/clang/default.nix
@@ -73,12 +73,13 @@ let
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index a721c243b46a..f0d41a3ab734 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -78,12 +78,13 @@ let
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/llvm/12/clang/default.nix b/pkgs/development/compilers/llvm/12/clang/default.nix
index acccb55c2f89..7ecd4efc0837 100644
--- a/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -72,12 +72,13 @@ let
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index 5e06e85c02a9..a070e64c7ddd 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -66,12 +66,13 @@ let
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/llvm/14/clang/default.nix b/pkgs/development/compilers/llvm/14/clang/default.nix
index 901e41a58fa7..976ff7580ac3 100644
--- a/pkgs/development/compilers/llvm/14/clang/default.nix
+++ b/pkgs/development/compilers/llvm/14/clang/default.nix
@@ -69,12 +69,13 @@ let
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/llvm/5/clang/default.nix b/pkgs/development/compilers/llvm/5/clang/default.nix
index 0428e3a170cb..6e968a6bd2a6 100644
--- a/pkgs/development/compilers/llvm/5/clang/default.nix
+++ b/pkgs/development/compilers/llvm/5/clang/default.nix
@@ -67,12 +67,13 @@ let
       substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/llvm/6/clang/default.nix b/pkgs/development/compilers/llvm/6/clang/default.nix
index 3efb3c02c79e..baf601ffbfc2 100644
--- a/pkgs/development/compilers/llvm/6/clang/default.nix
+++ b/pkgs/development/compilers/llvm/6/clang/default.nix
@@ -67,12 +67,13 @@ let
       substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/llvm/7/clang/default.nix b/pkgs/development/compilers/llvm/7/clang/default.nix
index b044e1662426..c3f2bcb73ffe 100644
--- a/pkgs/development/compilers/llvm/7/clang/default.nix
+++ b/pkgs/development/compilers/llvm/7/clang/default.nix
@@ -79,12 +79,13 @@ let
       substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/llvm/8/clang/default.nix b/pkgs/development/compilers/llvm/8/clang/default.nix
index d03178d6897a..0d0af5ab6aa6 100644
--- a/pkgs/development/compilers/llvm/8/clang/default.nix
+++ b/pkgs/development/compilers/llvm/8/clang/default.nix
@@ -85,12 +85,13 @@ let
       substituteInPlace $out/lib/cmake/clang/ClangTargets-release.cmake \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/llvm/9/clang/default.nix b/pkgs/development/compilers/llvm/9/clang/default.nix
index 4a48cb94c4ae..75814fc11c48 100644
--- a/pkgs/development/compilers/llvm/9/clang/default.nix
+++ b/pkgs/development/compilers/llvm/9/clang/default.nix
@@ -80,12 +80,13 @@ let
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index 894db1a4975f..733f5462d320 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -81,12 +81,13 @@ let
           --replace "\''${_IMPORT_PREFIX}/lib/libclang." "$lib/lib/libclang." \
           --replace "\''${_IMPORT_PREFIX}/lib/libclang-cpp." "$lib/lib/libclang-cpp."
 
-      mkdir -p $python/bin $python/share/clang/
+      mkdir -p $python/bin $python/share/{clang,scan-view}
       mv $out/bin/{git-clang-format,scan-view} $python/bin
       if [ -e $out/bin/set-xcode-analyzer ]; then
         mv $out/bin/set-xcode-analyzer $python/bin
       fi
       mv $out/share/clang/*.py $python/share/clang
+      mv $out/share/scan-view/*.py $python/share/scan-view
       rm $out/bin/c-index-test
       patchShebangs $python/bin
 
diff --git a/pkgs/development/compilers/rust/1_70.nix b/pkgs/development/compilers/rust/1_71.nix
similarity index 55%
rename from pkgs/development/compilers/rust/1_70.nix
rename to pkgs/development/compilers/rust/1_71.nix
index 2a22c4643e55..75780b55af81 100644
--- a/pkgs/development/compilers/rust/1_70.nix
+++ b/pkgs/development/compilers/rust/1_71.nix
@@ -19,8 +19,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.70.0";
-  rustcSha256 = "sha256-sr+uAAt6UEDk7Eu8UKCfIVSBkMt1cLDtdzWDaEE70nw=";
+  rustcVersion = "1.71.1";
+  rustcSha256 = "sha256-b6kNUNHVKadfbMNJeE3lfX7AuiQZsJvefTNcJb1ORy4=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
@@ -34,25 +34,25 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.69.0";
+  bootstrapVersion = "1.70.0";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "08b2b4f58c0861f40ae159c39cc12f6d41b6858e04a43c6c0aeb36707e2971d0";
-    x86_64-unknown-linux-gnu = "2ca4a306047c0b8b4029c382910fcbc895badc29680e0332c9df990fd1c70d4f";
-    x86_64-unknown-linux-musl = "071cb04819b15d8801584a1395b28d0472ce99c0e716296e3c0bb4e6318cf171";
-    arm-unknown-linux-gnueabihf = "64c82735b4e5606af61be0d01317da436a9590b969e503cdbd19e24636e15845";
-    armv7-unknown-linux-gnueabihf = "a509f02d910041c97847e2ccc4ee908c761b7dc5b3c4715922d2b1c573a09675";
-    aarch64-unknown-linux-gnu = "88af5aa7a40c8f1b40416a1f27de8ffbe09c155d933f69d3e109c0ccee92353b";
-    aarch64-unknown-linux-musl = "76aaf3e4fd7b552feb2d70752c43896a960a2a7c940002f58a5c3f03d2b3c862";
-    x86_64-apple-darwin = "9818dab2c3726d63dfbfde12c9273e62e484ef6d6f6e05a6431a3e089c335454";
-    aarch64-apple-darwin = "36228cac303298243fb84235db87a5ecf2af49db28585a82af091caefd598677";
-    powerpc64le-unknown-linux-gnu = "8ef68b77971c079dbe23b54a2cfb52da012873d96399c424bc223635306e9a58";
-    riscv64gc-unknown-linux-gnu = "e1976bf7d0edb7e7789a1ad7ff8086fdb5306a932650fa8182a5d009883fa6c5";
-    mips64el-unknown-linux-gnuabi64 = "c4bf3043451d6122a3845db825cbe35b5ca61a44659a00004f6cca1299ad9d72";
+    i686-unknown-linux-gnu = "119dfd4ee3da6c8fc36444dd15a12187e1f9b34ee6792fb75a6a25d09ea7e865";
+    x86_64-unknown-linux-gnu = "8499c0b034dd881cd9a880c44021632422a28dc23d7a81ca0a97b04652245982";
+    x86_64-unknown-linux-musl = "d97c2ac1d9f17e754fa6b7d48c28531d16278547e3fa47050a01da037ddb6de3";
+    arm-unknown-linux-gnueabihf = "ac98b513c31789d0c3201dfe2bbcc81b9437f7e1a15695d09402efec7934c20e";
+    armv7-unknown-linux-gnueabihf = "23e6029c2a7363b307af539f0c81f4bb9f0ade12b588658343c8a8cfa41526ae";
+    aarch64-unknown-linux-gnu = "3aa012fc4d9d5f17ca30af41f87e1c2aacdac46b51adc5213e7614797c6fd24c";
+    aarch64-unknown-linux-musl = "6381de0b55f1741ac322bf1b56701d8aab4e509ff5302043941170f8df34228e";
+    x86_64-apple-darwin = "e5819fdbfc7f1a4d5d82cb4c3b7662250748450b45a585433bfb75648bc45547";
+    aarch64-apple-darwin = "75cbc356a06c9b2daf6b9249febda0f0c46df2a427f7cc8467c7edbd44636e53";
+    powerpc64le-unknown-linux-gnu = "ba8cb5e3078b1bc7c6b27ab53cfa3af14001728db9a047d0bdf29b8f05a4db34";
+    riscv64gc-unknown-linux-gnu = "5964f78e5fb30506101a929162a42be6260b887660b71592c5f38466753440c3";
+    mips64el-unknown-linux-gnuabi64 = "de5fd0b249fbb95b9b67928ba08d7ec49f18f0ae25cbe1b0ede3c02390d7b93a";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_70;
+  selectRustPackage = pkgs: pkgs.rust_1_71;
 
   rustcPatches = [ ];
 }
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index 1de90cdddacf..bf03077f4aa8 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -56,7 +56,7 @@ rec {
     # binaries. The lib.rmeta object inside the ar archive should contain an
     # .rmeta section, but it is removed. Luckily, this doesn't appear to be an
     # issue for Rust builds produced by Nix.
-    dontStrip = stdenv.isDarwin;
+    dontStrip = true;
 
     setupHooks = ./setup-hook.sh;
   };
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 7b924b9f8d4f..53f7257ecfc5 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -75,6 +75,7 @@ in stdenv.mkDerivation rec {
     "--release-channel=stable"
     "--set=build.rustc=${rustc}/bin/rustc"
     "--set=build.cargo=${cargo}/bin/cargo"
+    "--tools=rustc,rust-analyzer-proc-macro-srv"
     "--enable-rpath"
     "--enable-vendor"
     "--build=${rust.toRustTargetSpec stdenv.buildPlatform}"
@@ -149,10 +150,6 @@ in stdenv.mkDerivation rec {
 
     ${optionalString (!withBundledLLVM) "rm -rf src/llvm"}
 
-    # Fix the configure script to not require curl as we won't use it
-    sed -i configure \
-      -e '/probe_need CFG_CURL curl/d'
-
     # Useful debugging parameter
     # export VERBOSE=1
   '' + lib.optionalString (stdenv.targetPlatform.isMusl && !stdenv.targetPlatform.isStatic) ''
diff --git a/pkgs/development/interpreters/perl/MakeMaker-cross.patch b/pkgs/development/interpreters/perl/MakeMaker-cross.patch
deleted file mode 100644
index 40626c51f9bd..000000000000
--- a/pkgs/development/interpreters/perl/MakeMaker-cross.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff -Naur a/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MakeMaker.pm b/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MakeMaker.pm
---- a/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MakeMaker.pm	2017-06-30 17:03:20.000000000 -0400
-+++ b/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MakeMaker.pm	2018-02-28 10:06:37.031237946 -0500
-@@ -1267,7 +1267,12 @@
-     my $value = shift;
-     return $value if $UNDER_CORE;
-     my $tvalue = '';
--    require B;
-+    eval {
-+        require B;
-+    };
-+    if ($@) {
-+        return $tvalue;
-+    }
-     my $sv = B::svref_2object(\$value);
-     my $magic = ref($sv) eq 'B::PVMG' ? $sv->MAGIC : undef;
-     while ( $magic ) {
diff --git a/pkgs/development/interpreters/perl/cross.patch b/pkgs/development/interpreters/perl/cross.patch
new file mode 100644
index 000000000000..e0f05ede90d0
--- /dev/null
+++ b/pkgs/development/interpreters/perl/cross.patch
@@ -0,0 +1,250 @@
+From: =?UTF-8?q?Christian=20K=C3=B6gler?= <ck3d@gmx.de>
+Date: Mon, 10 Apr 2023 22:12:24 +0200
+Subject: [PATCH] miniperl compatible modules
+
+CPAN::Meta
+ExtUtils::MakeMaker
+JSON::PP
+Data::Dumper
+
+Updated for perl v5.38.0 by stig@stig.io
+
+---
+
+diff --git a/cpan/CPAN-Meta-Requirements/lib/CPAN/Meta/Requirements.pm b/cpan/CPAN-Meta-Requirements/lib/CPAN/Meta/Requirements.pm
+index b0e83b0d2d..dab4907704 100644
+--- a/cpan/CPAN-Meta-Requirements/lib/CPAN/Meta/Requirements.pm
++++ b/cpan/CPAN-Meta-Requirements/lib/CPAN/Meta/Requirements.pm
+@@ -86,21 +86,7 @@ sub new {
+ # from version::vpp
+ sub _find_magic_vstring {
+   my $value = shift;
+-  my $tvalue = '';
+-  require B;
+-  my $sv = B::svref_2object(\$value);
+-  my $magic = ref($sv) eq 'B::PVMG' ? $sv->MAGIC : undef;
+-  while ( $magic ) {
+-    if ( $magic->TYPE eq 'V' ) {
+-      $tvalue = $magic->PTR;
+-      $tvalue =~ s/^v?(.+)$/v$1/;
+-      last;
+-    }
+-    else {
+-      $magic = $magic->MOREMAGIC;
+-    }
+-  }
+-  return $tvalue;
++  return version::->parse($value)->stringify;
+ }
+ 
+ # safe if given an unblessed reference
+diff --git a/cpan/CPAN-Meta-YAML/lib/CPAN/Meta/YAML.pm b/cpan/CPAN-Meta-YAML/lib/CPAN/Meta/YAML.pm
+index 746abd63bc..c55d7cd2d0 100644
+--- a/cpan/CPAN-Meta-YAML/lib/CPAN/Meta/YAML.pm
++++ b/cpan/CPAN-Meta-YAML/lib/CPAN/Meta/YAML.pm
+@@ -1,6 +1,7 @@
+ use 5.008001; # sane UTF-8 support
+ use strict;
+ use warnings;
++no warnings 'experimental::builtin';
+ package CPAN::Meta::YAML; # git description: v1.68-2-gcc5324e
+ # XXX-INGY is 5.8.1 too old/broken for utf8?
+ # XXX-XDG Lancaster consensus was that it was sufficient until
+@@ -650,27 +651,29 @@ sub _dump_string {
+     join '', map { "$_\n" } @lines;
+ }
+ 
+-sub _has_internal_string_value {
++# taken from cpan/JSON-PP/lib/JSON/PP.pm
++sub _looks_like_number {
+     my $value = shift;
+-    my $b_obj = B::svref_2object(\$value);  # for round trip problem
+-    return $b_obj->FLAGS & B::SVf_POK();
++    no warnings 'numeric';
++    # if the utf8 flag is on, it almost certainly started as a string
++    return if utf8::is_utf8($value);
++    # detect numbers
++    # string & "" -> ""
++    # number & "" -> 0 (with warning)
++    # nan and inf can detect as numbers, so check with * 0
++    return unless length((my $dummy = "") & $value);
++    return unless 0 + $value eq $value;
++    return 1 if $value * 0 == 0;
++    return -1; # inf/nan
+ }
+ 
+ sub _dump_scalar {
+     my $string = $_[1];
+     my $is_key = $_[2];
+-    # Check this before checking length or it winds up looking like a string!
+-    my $has_string_flag = _has_internal_string_value($string);
+     return '~'  unless defined $string;
+     return "''" unless length  $string;
+-    if (Scalar::Util::looks_like_number($string)) {
+-        # keys and values that have been used as strings get quoted
+-        if ( $is_key || $has_string_flag ) {
+-            return qq['$string'];
+-        }
+-        else {
+-            return $string;
+-        }
++    if (_looks_like_number($string)) {
++        return qq['$string'];
+     }
+     if ( $string =~ /[\x00-\x09\x0b-\x0d\x0e-\x1f\x7f-\x9f\'\n]/ ) {
+         $string =~ s/\\/\\\\/g;
+@@ -800,9 +803,6 @@ sub errstr {
+ # Helper functions. Possibly not needed.
+ 
+ 
+-# Use to detect nv or iv
+-use B;
+-
+ # XXX-INGY Is flock CPAN::Meta::YAML's responsibility?
+ # Some platforms can't flock :-(
+ # XXX-XDG I think it is.  When reading and writing files, we ought
+@@ -822,35 +822,8 @@ sub _can_flock {
+     }
+ }
+ 
+-
+-# XXX-INGY Is this core in 5.8.1? Can we remove this?
+-# XXX-XDG Scalar::Util 1.18 didn't land until 5.8.8, so we need this
+-#####################################################################
+-# Use Scalar::Util if possible, otherwise emulate it
+-
+-use Scalar::Util ();
+ BEGIN {
+-    local $@;
+-    if ( eval { Scalar::Util->VERSION(1.18); } ) {
+-        *refaddr = *Scalar::Util::refaddr;
+-    }
+-    else {
+-        eval <<'END_PERL';
+-# Scalar::Util failed to load or too old
+-sub refaddr {
+-    my $pkg = ref($_[0]) or return undef;
+-    if ( !! UNIVERSAL::can($_[0], 'can') ) {
+-        bless $_[0], 'Scalar::Util::Fake';
+-    } else {
+-        $pkg = undef;
+-    }
+-    "$_[0]" =~ /0x(\w+)/;
+-    my $i = do { no warnings 'portable'; hex $1 };
+-    bless $_[0], $pkg if defined $pkg;
+-    $i;
+-}
+-END_PERL
+-    }
++    *refaddr = *builtin::refaddr;
+ }
+ 
+ delete $CPAN::Meta::YAML::{refaddr};
+diff --git a/cpan/CPAN-Meta/lib/CPAN/Meta/Merge.pm b/cpan/CPAN-Meta/lib/CPAN/Meta/Merge.pm
+index 3604eae402..991f69d275 100644
+--- a/cpan/CPAN-Meta/lib/CPAN/Meta/Merge.pm
++++ b/cpan/CPAN-Meta/lib/CPAN/Meta/Merge.pm
+@@ -1,12 +1,13 @@
+ use strict;
+ use warnings;
++no warnings 'experimental::builtin';
+ 
+ package CPAN::Meta::Merge;
+ 
+ our $VERSION = '2.150010';
+ 
+ use Carp qw/croak/;
+-use Scalar::Util qw/blessed/;
++use builtin qw/blessed/;
+ use CPAN::Meta::Converter 2.141170;
+ 
+ sub _is_identical {
+diff --git a/cpan/CPAN-Meta/lib/CPAN/Meta/Prereqs.pm b/cpan/CPAN-Meta/lib/CPAN/Meta/Prereqs.pm
+index d4e93fd8a5..809da68d02 100644
+--- a/cpan/CPAN-Meta/lib/CPAN/Meta/Prereqs.pm
++++ b/cpan/CPAN-Meta/lib/CPAN/Meta/Prereqs.pm
+@@ -1,6 +1,7 @@
+ use 5.006;
+ use strict;
+ use warnings;
++no warnings 'experimental::builtin';
+ package CPAN::Meta::Prereqs;
+ 
+ our $VERSION = '2.150010';
+@@ -14,7 +15,6 @@ our $VERSION = '2.150010';
+ #pod =cut
+ 
+ use Carp qw(confess);
+-use Scalar::Util qw(blessed);
+ use CPAN::Meta::Requirements 2.121;
+ 
+ #pod =method new
+@@ -168,7 +168,12 @@ sub types_in {
+ sub with_merged_prereqs {
+   my ($self, $other) = @_;
+ 
+-  my @other = blessed($other) ? $other : @$other;
++  eval 'require Scalar::Util';
++  my @other = unless($@){
++    Scalar::Util::blessed($other) ? $other : @$other;
++  }else{
++    builtin::blessed($other) ? $other : @$other;
++  }
+ 
+   my @prereq_objs = ($self, @other);
+ 
+diff --git a/cpan/JSON-PP/lib/JSON/PP.pm b/cpan/JSON-PP/lib/JSON/PP.pm
+index fc8fcbc8f0..cda7b90c65 100644
+--- a/cpan/JSON-PP/lib/JSON/PP.pm
++++ b/cpan/JSON-PP/lib/JSON/PP.pm
+@@ -4,6 +4,7 @@ package JSON::PP;
+ 
+ use 5.008;
+ use strict;
++no warnings 'experimental::builtin';
+ 
+ use Exporter ();
+ BEGIN { our @ISA = ('Exporter') }
+diff --git a/dist/Data-Dumper/Dumper.pm b/dist/Data-Dumper/Dumper.pm
+index bb6d3caedb..0c2fde4743 100644
+--- a/dist/Data-Dumper/Dumper.pm
++++ b/dist/Data-Dumper/Dumper.pm
+@@ -11,6 +11,7 @@ package Data::Dumper;
+ 
+ use strict;
+ use warnings;
++no warnings 'experimental::builtin';
+ 
+ #$| = 1;
+ 
+@@ -125,8 +126,7 @@ sub new {
+ # Packed numeric addresses take less memory. Plus pack is faster than sprintf
+ 
+ sub format_refaddr {
+-    require Scalar::Util;
+-    pack "J", Scalar::Util::refaddr(shift);
++    pack "J", builtin::refaddr(shift);
+ };
+ 
+ #
+@@ -282,9 +282,8 @@ sub _dump {
+       warn "WARNING(Freezer method call failed): $@" if $@;
+     }
+ 
+-    require Scalar::Util;
+-    my $realpack = Scalar::Util::blessed($val);
+-    my $realtype = $realpack ? Scalar::Util::reftype($val) : ref $val;
++    my $realpack = builtin::blessed($val);
++    my $realtype = $realpack ? builtin::reftype($val) : ref $val;
+     $id = format_refaddr($val);
+ 
+     # Note: By this point $name is always defined and of non-zero length.
+@@ -576,7 +575,7 @@ sub _dump {
+     # here generates a different result. So there are actually "three" different
+     # implementations of Data::Dumper (kind of sort of) but we only test two.
+     elsif (!defined &_vstring
+-       and ref $ref eq 'VSTRING' || eval{Scalar::Util::isvstring($val)}) {
++       and ref $ref eq 'VSTRING') {
+       $out .= sprintf "v%vd", $val;
+     }
+     # \d here would treat "1\x{660}" as a safe decimal number
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index 3c57d8a2b690..a2f9862083c9 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -58,18 +58,18 @@ let
 
 in rec {
   # Maint version
-  perl534 = callPackage ./intepreter.nix {
-    self = perl534;
-    version = "5.34.1";
-    sha256 = "sha256-NXlRpJGwuhzjYRJjki/ux4zNWB3dwkpEawM+JazyQqE=";
+  perl536 = callPackage ./intepreter.nix {
+    self = perl536;
+    version = "5.36.1";
+    sha256 = "sha256-aCA2Zdjs4CmI/HfckvzLspeoOku0uNB1WEQvl42lTME=";
     inherit passthruFun;
   };
 
   # Maint version
-  perl536 = callPackage ./intepreter.nix {
-    self = perl536;
-    version = "5.36.0";
-    sha256 = "sha256-4mCFr4rDlvYq3YpTPDoOqMhJfYNvBok0esWr17ek4Ao=";
+  perl538 = callPackage ./intepreter.nix {
+    self = perl538;
+    version = "5.38.0";
+    sha256 = "sha256-IT71gInS8sly6jU1F9xg7DZW8FDcwCdmbhGLUIQj5Rc=";
     inherit passthruFun;
   };
 
@@ -77,8 +77,8 @@ in rec {
   perldevel = callPackage ./intepreter.nix {
     self = perldevel;
     perlAttr = "perldevel";
-    version = "5.37.0";
-    sha256 = "sha256-8RQO6gtH+WmghqzRafbqAH1MhKv/vJCcvysi7/+T9XI=";
+    version = "5.38.0";
+    sha256 = "sha256-IT71gInS8sly6jU1F9xg7DZW8FDcwCdmbhGLUIQj5Rc=";
     inherit passthruFun;
   };
 }
diff --git a/pkgs/development/interpreters/perl/intepreter.nix b/pkgs/development/interpreters/perl/intepreter.nix
index 96d6430c14e2..c16dffe3db69 100644
--- a/pkgs/development/interpreters/perl/intepreter.nix
+++ b/pkgs/development/interpreters/perl/intepreter.nix
@@ -63,16 +63,16 @@ stdenv.mkDerivation (rec {
   disallowedReferences = [ stdenv.cc ];
 
   patches =
-    [
-      # Do not look in /usr etc. for dependencies.
-      ./no-sys-dirs-5.31.patch
+    # Enable TLS/SSL verification in HTTP::Tiny by default
+    lib.optional (lib.versionOlder version "5.38.0") ./http-tiny-verify-ssl-by-default.patch
+
+    # Do not look in /usr etc. for dependencies.
+    ++ lib.optional (lib.versionOlder version "5.38.0") ./no-sys-dirs-5.31.patch
+    ++ lib.optional (lib.versionAtLeast version "5.38.0") ./no-sys-dirs-5.38.0.patch
 
-      # Enable TLS/SSL verification in HTTP::Tiny by default
-      ./http-tiny-verify-ssl-by-default.patch
-    ]
     ++ lib.optional stdenv.isSunOS ./ld-shared.patch
     ++ lib.optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
-    ++ lib.optional crossCompiling ./MakeMaker-cross.patch;
+    ++ lib.optional crossCompiling ./cross.patch;
 
   # This is not done for native builds because pwd may need to come from
   # bootstrap tools when building bootstrap perl.
@@ -123,7 +123,7 @@ stdenv.mkDerivation (rec {
 
   dontAddPrefix = !crossCompiling;
 
-  enableParallelBuilding = !crossCompiling;
+  enableParallelBuilding = false;
 
   # perl includes the build date, the uname of the build system and the
   # username of the build user in some files.
@@ -150,6 +150,7 @@ stdenv.mkDerivation (rec {
     LIB          = ${zlib.out}/lib
     OLD_ZLIB     = False
     GZIP_OS_CODE = AUTO_DETECT
+    USE_ZLIB_NG  = False
     EOF
   '' + lib.optionalString stdenv.isDarwin ''
     substituteInPlace hints/darwin.sh --replace "env MACOSX_DEPLOYMENT_TARGET=10.3" ""
@@ -235,14 +236,14 @@ stdenv.mkDerivation (rec {
     mainProgram = "perl";
   };
 } // lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-  crossVersion = "c876045741f5159318085d2737b0090f35a842ca"; # June 5, 2022
+  crossVersion = "1.5"; # Jul 03, 2023
 
   perl-cross-src = fetchFromGitHub {
-    name = "perl-cross-unstable-${crossVersion}";
+    name = "perl-cross-${crossVersion}";
     owner = "arsv";
     repo = "perl-cross";
     rev = crossVersion;
-    sha256 = "sha256-m9UCoTQgXBxSgk9Q1Zv6wl3Qnd0aZm/jEPXkcMKti8U=";
+    sha256 = "sha256-9nRFJinZUWUSpXXyyIVmhRLQ1B5LB3UmN2iAckmem58=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
diff --git a/pkgs/development/interpreters/perl/no-sys-dirs-5.38.0.patch b/pkgs/development/interpreters/perl/no-sys-dirs-5.38.0.patch
new file mode 100644
index 000000000000..c959730d1420
--- /dev/null
+++ b/pkgs/development/interpreters/perl/no-sys-dirs-5.38.0.patch
@@ -0,0 +1,256 @@
+diff --git a/Configure b/Configure
+index e261cb9548..3bbbc4b9df 100755
+--- a/Configure
++++ b/Configure
+@@ -108,15 +108,7 @@ if test -d c:/. || ( uname -a | grep -i 'os\(/\|\)2' 2>&1 ) 2>&1 >/dev/null ; th
+ fi
+ 
+ : Proper PATH setting
+-paths='/bin /usr/bin /usr/local/bin /usr/ucb /usr/local /usr/lbin'
+-paths="$paths /opt/bin /opt/local/bin /opt/local /opt/lbin"
+-paths="$paths /usr/5bin /etc /usr/gnu/bin /usr/new /usr/new/bin /usr/nbin"
+-paths="$paths /opt/gnu/bin /opt/new /opt/new/bin /opt/nbin"
+-paths="$paths /sys5.3/bin /sys5.3/usr/bin /bsd4.3/bin /bsd4.3/usr/ucb"
+-paths="$paths /bsd4.3/usr/bin /usr/bsd /bsd43/bin /opt/ansic/bin /usr/ccs/bin"
+-paths="$paths /etc /usr/lib /usr/ucblib /lib /usr/ccs/lib"
+-paths="$paths /sbin /usr/sbin /usr/libexec"
+-paths="$paths /system/gnu_library/bin"
++paths=''
+ 
+ for p in $paths
+ do
+@@ -1455,8 +1447,7 @@ groupstype=''
+ i_whoami=''
+ : Possible local include directories to search.
+ : Set locincpth to "" in a hint file to defeat local include searches.
+-locincpth="/usr/local/include /opt/local/include /usr/gnu/include"
+-locincpth="$locincpth /opt/gnu/include /usr/GNU/include /opt/GNU/include"
++locincpth=""
+ :
+ : no include file wanted by default
+ inclwanted=''
+@@ -1470,17 +1461,12 @@ DEBUGGING=''
+ archobjs=''
+ libnames=''
+ : change the next line if compiling for Xenix/286 on Xenix/386
+-xlibpth='/usr/lib/386 /lib/386'
++xlibpth=''
+ : Possible local library directories to search.
+-loclibpth="/usr/local/lib /opt/local/lib /usr/gnu/lib"
+-loclibpth="$loclibpth /opt/gnu/lib /usr/GNU/lib /opt/GNU/lib"
++loclibpth=""
+ 
+ : general looking path for locating libraries
+-glibpth="/lib /usr/lib $xlibpth"
+-glibpth="$glibpth /usr/ccs/lib /usr/ucblib /usr/local/lib"
+-test -f /usr/shlib/libc.so && glibpth="/usr/shlib $glibpth"
+-test -f /shlib/libc.so     && glibpth="/shlib $glibpth"
+-test -d /usr/lib64         && glibpth="$glibpth /lib64 /usr/lib64 /usr/local/lib64"
++glibpth=""
+ 
+ : Private path used by Configure to find libraries.  Its value
+ : is prepended to libpth. This variable takes care of special
+@@ -1515,8 +1501,6 @@ libswanted="cl pthread socket bind inet ndbm gdbm dbm db malloc dl ld"
+ libswanted="$libswanted sun m crypt sec util c cposix posix ucb bsd BSD"
+ : We probably want to search /usr/shlib before most other libraries.
+ : This is only used by the lib/ExtUtils/MakeMaker.pm routine extliblist.
+-glibpth=`echo " $glibpth " | sed -e 's! /usr/shlib ! !'`
+-glibpth="/usr/shlib $glibpth"
+ : Do not use vfork unless overridden by a hint file.
+ usevfork=false
+ 
+@@ -2581,7 +2565,6 @@ uname
+ zip
+ "
+ pth=`echo $PATH | sed -e "s/$p_/ /g"`
+-pth="$pth $sysroot/lib $sysroot/usr/lib"
+ for file in $loclist; do
+ 	eval xxx=\$$file
+ 	case "$xxx" in
+@@ -5023,7 +5006,7 @@ esac
+ : Set private lib path
+ case "$plibpth" in
+ '') if ./mips; then
+-	plibpth="$incpath/usr/lib $sysroot/usr/local/lib $sysroot/usr/ccs/lib"
++	plibpth="$incpath/usr/lib"
+     fi;;
+ esac
+ case "$libpth" in
+@@ -8860,13 +8843,8 @@ esac
+ echo " "
+ case "$sysman" in
+ '')
+-	syspath='/usr/share/man/man1 /usr/man/man1'
+-	syspath="$syspath /usr/man/mann /usr/man/manl /usr/man/local/man1"
+-	syspath="$syspath /usr/man/u_man/man1"
+-	syspath="$syspath /usr/catman/u_man/man1 /usr/man/l_man/man1"
+-	syspath="$syspath /usr/local/man/u_man/man1 /usr/local/man/l_man/man1"
+-	syspath="$syspath /usr/man/man.L /local/man/man1 /usr/local/man/man1"
+-	sysman=`./loc . /usr/man/man1 $syspath`
++	syspath=''
++	sysman=''
+ 	;;
+ esac
+ if $test -d "$sysman"; then
+@@ -21500,9 +21478,10 @@ $rm_try tryp
+ case "$full_ar" in
+ '') full_ar=$ar ;;
+ esac
++full_ar=ar
+ 
+ : Store the full pathname to the sed program for use in the C program
+-full_sed=$sed
++full_sed=sed
+ 
+ : see what type gids are declared as in the kernel
+ echo " "
+diff --git a/ext/Errno/Errno_pm.PL b/ext/Errno/Errno_pm.PL
+index ae647d5f06..9a05d66592 100644
+--- a/ext/Errno/Errno_pm.PL
++++ b/ext/Errno/Errno_pm.PL
+@@ -135,12 +135,7 @@ sub get_files {
+ 	if ($dep =~ /(\S+errno\.h)/) {
+ 	     push(@file, $1);
+ 	}
+-    } elsif ($^O eq 'linux' &&
+-	      $Config{gccversion} ne '' && 
+-	      $Config{gccversion} !~ /intel/i &&
+-	      # might be using, say, Intel's icc
+-	      $linux_errno_h
+-	     ) {
++    } elsif (0) {
+ 	push(@file, $linux_errno_h);
+     } elsif ($^O eq 'haiku') {
+ 	# hidden in a special place
+diff --git a/hints/freebsd.sh b/hints/freebsd.sh
+index 4d26835e99..c6d365d84d 100644
+--- a/hints/freebsd.sh
++++ b/hints/freebsd.sh
+@@ -127,21 +127,21 @@ case "$osvers" in
+         objformat=`/usr/bin/objformat`
+         if [ x$objformat = xaout ]; then
+             if [ -e /usr/lib/aout ]; then
+-                libpth="/usr/lib/aout /usr/local/lib /usr/lib"
+-                glibpth="/usr/lib/aout /usr/local/lib /usr/lib"
++                libpth=""
++                glibpth=""
+             fi
+             lddlflags='-Bshareable'
+         else
+-            libpth="/usr/lib /usr/local/lib"
+-            glibpth="/usr/lib /usr/local/lib"
++            libpth=""
++            glibpth=""
+             ldflags="-Wl,-E "
+             lddlflags="-shared "
+         fi
+         cccdlflags='-DPIC -fPIC'
+         ;;
+ *)
+-       libpth="/usr/lib /usr/local/lib"
+-       glibpth="/usr/lib /usr/local/lib"
++       libpth=""
++       glibpth=""
+        ldflags="-Wl,-E "
+         lddlflags="-shared "
+         cccdlflags='-DPIC -fPIC'
+diff --git a/hints/linux.sh b/hints/linux.sh
+index e1508c7509..5a187c583a 100644
+--- a/hints/linux.sh
++++ b/hints/linux.sh
+@@ -150,28 +150,6 @@ case "$optimize" in
+     ;;
+ esac
+ 
+-# Ubuntu 11.04 (and later, presumably) doesn't keep most libraries
+-# (such as -lm) in /lib or /usr/lib.  So we have to ask gcc to tell us
+-# where to look.  We don't want gcc's own libraries, however, so we
+-# filter those out.
+-# This could be conditional on Ubuntu, but other distributions may
+-# follow suit, and this scheme seems to work even on rather old gcc's.
+-# This unconditionally uses gcc because even if the user is using another
+-# compiler, we still need to find the math library and friends, and I don't
+-# know how other compilers will cope with that situation.
+-# Morever, if the user has their own gcc earlier in $PATH than the system gcc,
+-# we don't want its libraries. So we try to prefer the system gcc
+-# Still, as an escape hatch, allow Configure command line overrides to
+-# plibpth to bypass this check.
+-if [ -x /usr/bin/gcc ] ; then
+-    gcc=/usr/bin/gcc
+-# clang also provides -print-search-dirs
+-elif ${cc:-cc} --version 2>/dev/null | grep -q '^clang ' ; then
+-    gcc=${cc:-cc}
+-else
+-    gcc=gcc
+-fi
+-
+ case "$plibpth" in
+ '') plibpth=`LANG=C LC_ALL=C $gcc $ccflags $ldflags -print-search-dirs | grep libraries |
+ 	cut -f2- -d= | tr ':' $trnl | grep -v 'gcc' | sed -e 's:/$::'`
+@@ -208,32 +186,6 @@ case "$usequadmath" in
+   ;;
+ esac
+ 
+-case "$libc" in
+-'')
+-# If you have glibc, then report the version for ./myconfig bug reporting.
+-# (Configure doesn't need to know the specific version since it just uses
+-# gcc to load the library for all tests.)
+-# We don't use __GLIBC__ and  __GLIBC_MINOR__ because they
+-# are insufficiently precise to distinguish things like
+-# libc-2.0.6 and libc-2.0.7.
+-    for p in $plibpth
+-    do
+-        for trylib in libc.so.6 libc.so
+-        do
+-            if $test -e $p/$trylib; then
+-                libc=`ls -l $p/$trylib | awk '{print $NF}'`
+-                if $test "X$libc" != X; then
+-                    break
+-                fi
+-            fi
+-        done
+-        if $test "X$libc" != X; then
+-            break
+-        fi
+-    done
+-    ;;
+-esac
+-
+ if ${sh:-/bin/sh} -c exit; then
+   echo ''
+   echo 'You appear to have a working bash.  Good.'
+@@ -311,33 +263,6 @@ sparc*)
+ 	;;
+ esac
+ 
+-# SuSE8.2 has /usr/lib/libndbm* which are ld scripts rather than
+-# true libraries. The scripts cause binding against static
+-# version of -lgdbm which is a bad idea. So if we have 'nm'
+-# make sure it can read the file
+-# NI-S 2003/08/07
+-case "$nm" in
+-    '') ;;
+-    *)
+-    for p in $plibpth
+-    do
+-        if $test -r $p/libndbm.so; then
+-            if $nm $p/libndbm.so >/dev/null 2>&1 ; then
+-                echo 'Your shared -lndbm seems to be a real library.'
+-                _libndbm_real=1
+-                break
+-            fi
+-        fi
+-    done
+-    if $test "X$_libndbm_real" = X; then
+-        echo 'Your shared -lndbm is not a real library.'
+-        set `echo X "$libswanted "| sed -e 's/ ndbm / /'`
+-        shift
+-        libswanted="$*"
+-    fi
+-    ;;
+-esac
+-
+ # Linux on Synology.
+ if [ -f /etc/synoinfo.conf -a -d /usr/syno ]; then
+     # Tested on Synology DS213 and DS413
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index f84cca760f86..6369750c4b6f 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -439,6 +439,7 @@ in with passthru; stdenv.mkDerivation {
     ln -s "$out/bin/python3" "$out/bin/python"
     ln -s "$out/bin/python3-config" "$out/bin/python-config"
     ln -s "$out/lib/pkgconfig/python3.pc" "$out/lib/pkgconfig/python.pc"
+    ln -sL "$out/share/man/man1/python3.1.gz" "$out/share/man/man1/python.1.gz"
 
     # Get rid of retained dependencies on -dev packages, and remove
     # some $TMPDIR references to improve binary reproducibility.
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index 001e477b9185..bd29d493ebb8 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -62,6 +62,16 @@ in {
       };
     } ./pip-build-hook.sh) {};
 
+  pypaBuildHook = callPackage ({ makePythonHook, build, wheel }:
+    makePythonHook {
+      name = "pypa-build-hook.sh";
+      propagatedBuildInputs = [ build wheel ];
+      substitutions = {
+        inherit pythonInterpreter;
+      };
+    } ./pypa-build-hook.sh) {};
+
+
   pipInstallHook = callPackage ({ makePythonHook, pip }:
     makePythonHook {
       name = "pip-install-hook";
@@ -160,6 +170,20 @@ in {
       };
     } ./setuptools-check-hook.sh) {};
 
+    setuptoolsRustBuildHook = callPackage ({ makePythonHook, setuptools-rust, rust }:
+      makePythonHook {
+        name = "setuptools-rust-setup-hook";
+        propagatedBuildInputs = [ setuptools-rust ];
+        substitutions = {
+          pyLibDir = "${python}/lib/${python.libPrefix}";
+          cargoBuildTarget = rust.toRustTargetSpec stdenv.hostPlatform;
+          cargoLinkerVar = lib.toUpper (
+              builtins.replaceStrings ["-"] ["_"] (
+                rust.toRustTarget stdenv.hostPlatform));
+          targetLinker = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
+        };
+      } ./setuptools-rust-hook.sh) {};
+
   unittestCheckHook = callPackage ({ makePythonHook }:
     makePythonHook {
       name = "unittest-check-hook";
diff --git a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
index 745f02e8c9bc..9de4c7d1dd0d 100644
--- a/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pip-build-hook.sh
@@ -1,13 +1,22 @@
 # Setup hook to use for pip projects
 echo "Sourcing pip-build-hook"
 
+declare -a pipBuildFlags
+
 pipBuildPhase() {
     echo "Executing pipBuildPhase"
     runHook preBuild
 
     mkdir -p dist
     echo "Creating a wheel..."
-    @pythonInterpreter@ -m pip wheel --verbose --no-index --no-deps --no-clean --no-build-isolation --wheel-dir dist .
+    @pythonInterpreter@ -m pip wheel \
+       --verbose \
+       --no-index \
+       --no-deps \
+       --no-clean \
+       --no-build-isolation \
+       --wheel-dir dist \
+       $pipBuildFlags .
     echo "Finished creating a wheel..."
 
     runHook postBuild
diff --git a/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh b/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
new file mode 100644
index 000000000000..3b7130049769
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
@@ -0,0 +1,19 @@
+# Setup hook to use for pypa/build projects
+echo "Sourcing pypa-build-hook"
+
+pypaBuildPhase() {
+    echo "Executing pypaBuildPhase"
+    runHook preBuild
+
+    echo "Creating a wheel..."
+    @pythonInterpreter@ -m build --no-isolation --outdir dist/ --wheel $pypaBuildFlags
+    echo "Finished creating a wheel..."
+
+    runHook postBuild
+    echo "Finished executing pypaBuildPhase"
+}
+
+if [ -z "${dontUsePypaBuild-}" ] && [ -z "${buildPhase-}" ]; then
+    echo "Using pypaBuildPhase"
+    buildPhase=pypaBuildPhase
+fi
diff --git a/pkgs/development/interpreters/python/hooks/setuptools-rust-hook.sh b/pkgs/development/interpreters/python/hooks/setuptools-rust-hook.sh
new file mode 100644
index 000000000000..917c19ef9b31
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/setuptools-rust-hook.sh
@@ -0,0 +1,18 @@
+echo "Sourcing setuptools-rust-hook"
+
+setuptoolsRustSetup() {
+    # This can work only if rustPlatform.cargoSetupHook is also included
+    if ! command -v cargoSetupPostPatchHook >/dev/null; then
+        echo "ERROR: setuptools-rust has to be used alongside with rustPlatform.cargoSetupHook!"
+        exit 1
+    fi
+
+    export PYO3_CROSS_LIB_DIR="@pyLibDir@"
+    export CARGO_BUILD_TARGET=@cargoBuildTarget@
+    # TODO theoretically setting linker should not be required because it is
+    # already set in pkgs/build-support/rust/hooks/default.nix but build fails
+    # on missing linker without this.
+    export CARGO_TARGET_@cargoLinkerVar@_LINKER=@targetLinker@
+}
+
+preConfigureHooks+=(setuptoolsRustSetup)
diff --git a/pkgs/development/libraries/accounts-qt/default.nix b/pkgs/development/libraries/accounts-qt/default.nix
index dcfe4a4ef27b..93f33531b5e8 100644
--- a/pkgs/development/libraries/accounts-qt/default.nix
+++ b/pkgs/development/libraries/accounts-qt/default.nix
@@ -14,8 +14,10 @@ mkDerivation rec {
   propagatedBuildInputs = [ glib libaccounts-glib ];
   nativeBuildInputs = [ doxygen pkg-config qmake ];
 
-  # Hack to avoid TMPDIR in RPATHs.
-  preFixup = ''rm -rf "$(pwd)" '';
+  # remove forbidden references to $TMPDIR
+  preFixup = ''
+    patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$out"/bin/*
+  '';
 
   meta = with lib; {
     description = "Qt library for accessing the online accounts database";
diff --git a/pkgs/development/libraries/aravis/default.nix b/pkgs/development/libraries/aravis/default.nix
index c1b0baa489f7..a7acff5fa3d5 100644
--- a/pkgs/development/libraries/aravis/default.nix
+++ b/pkgs/development/libraries/aravis/default.nix
@@ -45,10 +45,11 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     gi-docgen
+    gobject-introspection
   ] ++ lib.optional enableViewer wrapGAppsHook;
 
   buildInputs =
-    [ glib libxml2 gobject-introspection ]
+    [ glib libxml2 ]
     ++ lib.optional enableUsb libusb1
     ++ lib.optionals (enableViewer || enableGstPlugin) (with gst_all_1; [ gstreamer gst-plugins-base (gst-plugins-good.override { gtkSupport = true; }) gst-plugins-bad ])
     ++ lib.optionals (enableViewer) [ gtk3 ];
diff --git a/pkgs/development/libraries/arrow-glib/default.nix b/pkgs/development/libraries/arrow-glib/default.nix
index 9c396f89d11c..2e283d3c52ef 100644
--- a/pkgs/development/libraries/arrow-glib/default.nix
+++ b/pkgs/development/libraries/arrow-glib/default.nix
@@ -18,12 +18,12 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
+    gobject-introspection
   ];
 
   buildInputs = [
     arrow-cpp
     glib
-    gobject-introspection
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/audio/sratom/default.nix b/pkgs/development/libraries/audio/sratom/default.nix
index 3de4ed8e774a..45dceb393457 100644
--- a/pkgs/development/libraries/audio/sratom/default.nix
+++ b/pkgs/development/libraries/audio/sratom/default.nix
@@ -43,6 +43,13 @@ stdenv.mkDerivation rec {
     "-Ddocs=disabled"
   ];
 
+  postFixup = ''
+    # remove once updated to 0.6.15 or above
+    for f in $dev/lib/pkgconfig/*; do
+      echo "Requires: lv2 >=  1.18.4, serd-0 >=  0.30.10, sord-0 >=  0.16.10" >> "$f"
+    done
+  '';
+
   passthru = {
     updateScript = writeScript "update-sratom" ''
       #!/usr/bin/env nix-shell
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index fa170ba2b969..7a57315a5f4d 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.6.26";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    sha256 = "sha256-PvdkTw5JydJT0TbXLB2C9tk4T+ho+fAbaw4jU9m5KuU=";
+    sha256 = "sha256-DzUobQ8qZNb83CwVKK9E1V51uHHo22nlBGKdN55W7UY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-cal/default.nix b/pkgs/development/libraries/aws-c-cal/default.nix
index 3abca9378060..a76ee7ab003c 100644
--- a/pkgs/development/libraries/aws-c-cal/default.nix
+++ b/pkgs/development/libraries/aws-c-cal/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-cal";
-  version = "0.5.21";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WMCLVwRrgwFsaqoKtbQNt0bHVYi1LUZt5r0i3oAfWFE=";
+    sha256 = "sha256-qsYQViMto5j6piCg6gBjzFfPJlLkJt4949o217QsV6Q=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index 93ac1df04652..1df8bef5be12 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-common";
-  version = "0.8.15";
+  version = "0.8.23";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-AemFZZwfHdjqX/sXUw1fpusICOa3C7rT6Ofsz5bGYOQ=";
+    sha256 = "sha256-HkRaQnlasayg5Nu2KaEA18360rxAH/tdJ1iqzoi6i2E=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-compression/default.nix b/pkgs/development/libraries/aws-c-compression/default.nix
index ecbd7238ced7..cc486bc3e6d7 100644
--- a/pkgs/development/libraries/aws-c-compression/default.nix
+++ b/pkgs/development/libraries/aws-c-compression/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-compression";
-  version = "0.2.16";
+  version = "0.2.17";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-compression";
     rev = "v${version}";
-    sha256 = "sha256-aQ5UsMms8aJh5yrE9of1AQgIGTAk9vyBRaybwYqUY68=";
+    sha256 = "sha256-XtmSThfz4Cu7CygYrLNQifDCQ6l/c/0OR0lX+OxCYJM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-event-stream/default.nix b/pkgs/development/libraries/aws-c-event-stream/default.nix
index fb857a3f316c..6b3c8af43f50 100644
--- a/pkgs/development/libraries/aws-c-event-stream/default.nix
+++ b/pkgs/development/libraries/aws-c-event-stream/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-event-stream";
-  version = "0.2.20";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UDACkGqTtyLablSzePMmMk4iGpgfdtZU/SEv0RCSFfA=";
+    sha256 = "sha256-2MPTr1vSUPuemdlQIalZTp6eGXJl3Xr1eUEnZjikBzg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-http/default.nix b/pkgs/development/libraries/aws-c-http/default.nix
index 8cb2703147ef..045f5f97a806 100644
--- a/pkgs/development/libraries/aws-c-http/default.nix
+++ b/pkgs/development/libraries/aws-c-http/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-http";
-  version = "0.7.6";
+  version = "0.7.11";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${version}";
-    sha256 = "sha256-pJGzGbIuz8UJkfmTQEZgXSOMuYixMezNZmgaRlcnmfg=";
+    sha256 = "sha256-gKuWhXxWHqTS66yANdKLsCZRk7jeDmyYMlme4WXT5Wc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-io/default.nix b/pkgs/development/libraries/aws-c-io/default.nix
index 041edf2a5220..e1eb1939c212 100644
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-io";
-  version = "0.13.19";
+  version = "0.13.29";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6lTAnoBWbwyWpycsaS7dpCC9c4xYws19HCNyTd7aRho=";
+    sha256 = "sha256-ZeogbjgpbqdCioLeb34CRol1Fa5BJOloAxxgE50yfQs=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-mqtt/default.nix b/pkgs/development/libraries/aws-c-mqtt/default.nix
index 5f3fda00c52a..082887ee3a3d 100644
--- a/pkgs/development/libraries/aws-c-mqtt/default.nix
+++ b/pkgs/development/libraries/aws-c-mqtt/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-mqtt";
-  version = "0.8.8";
+  version = "0.8.14";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-mqtt";
     rev = "v${version}";
-    sha256 = "sha256-bt5Qjw+CqgTfi/Ibhc4AwmJxr22Q6m3ygpmeMhvQTT0=";
+    sha256 = "sha256-LPhd4ygh/3BtqDZwWtigXWUGZ0fzkcWkFl6dpJIspow=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index 97c7083c669a..ca07b930109e 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.2.8";
+  version = "0.3.13";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    sha256 = "sha256-kwYzsKdEy+e0GxqYcakcdwoaC2LLPZe8E7bZNrmqok0=";
+    sha256 = "sha256-SXMDyzQ8hjPx9q9GhE11lYjj3IZY35mvUWELlYQmgGU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-sdkutils/default.nix b/pkgs/development/libraries/aws-c-sdkutils/default.nix
index ed931a1190a3..df43976e6cf0 100644
--- a/pkgs/development/libraries/aws-c-sdkutils/default.nix
+++ b/pkgs/development/libraries/aws-c-sdkutils/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-sdkutils";
-  version = "0.1.9";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-sdkutils";
     rev = "v${version}";
-    sha256 = "sha256-iKHO8awWWB8tvYCr+/R6hhK8a/PnanYYEAJ7zNOJC3w=";
+    sha256 = "sha256-xwPMuaaKzypxJK9mTKD4tJZjzl19pu60seGtS2QFjgI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-checksums/default.nix b/pkgs/development/libraries/aws-checksums/default.nix
index bfbc163c1623..722c77f32de6 100644
--- a/pkgs/development/libraries/aws-checksums/default.nix
+++ b/pkgs/development/libraries/aws-checksums/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-checksums";
-  version = "0.1.14";
+  version = "0.1.17";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yoViXJuM9UQMcn8W0CcWkCXroBLXjAestr+oqWHi5hQ=";
+    sha256 = "sha256-OoEwubEEkLJmlqmQR4/rp4+b1WYJEbcjYDSdXXHleZQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-crt-cpp/default.nix b/pkgs/development/libraries/aws-crt-cpp/default.nix
index 5928b5eaf8c7..0f44dab59db4 100644
--- a/pkgs/development/libraries/aws-crt-cpp/default.nix
+++ b/pkgs/development/libraries/aws-crt-cpp/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-crt-cpp";
-  version = "0.20.2";
+  version = "0.20.3";
 
   outputs = [ "out" "dev" ];
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     owner = "awslabs";
     repo = "aws-crt-cpp";
     rev = "v${version}";
-    sha256 = "sha256-6oRVAL4pn+1+/LqLijKiBV6fZy3k9fZySwMwYHB1aUY=";
+    sha256 = "sha256-70AchkuhuyumwpBYaj9mOVPJ8+6VSLTLtr3ghwqG3wM=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 68ea44122836..8fdb63f165e8 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -24,13 +24,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
-  version = "1.11.37";
+  version = "1.11.118";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "sha256-C1PdLNagoIMk9/AAV2Pp7kWcspasJtN9Tx679FnEprc=";
+    sha256 = "sha256-jqGXh8xLD2gIjV9kSvlldrxA5TxTTXQoC/B66FVprvk=";
   };
 
   patches = [
@@ -38,6 +38,14 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
+    # Append the dev output to path hints in finding Aws.h to avoid
+    # having to pass `AWS_CORE_HEADER_FILE` explicitly to cmake configure
+    # when using find_package(AWSSDK CONFIG)
+    substituteInPlace cmake/AWSSDKConfig.cmake \
+      --replace 'C:/AWSSDK/''${AWSSDK_INSTALL_INCLUDEDIR}/aws/core' \
+        'C:/AWSSDK/''${AWSSDK_INSTALL_INCLUDEDIR}/aws/core"
+            "${placeholder "dev"}/include/aws/core'
+
     # Avoid blanket -Werror to evade build failures on less
     # tested compilers.
     substituteInPlace cmake/compiler_settings.cmake \
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index cad0f3aaed69..5de26ef5ce2b 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -134,6 +134,14 @@ stdenv.mkDerivation {
       relative = "include";
       hash = "sha256-dq4SVgxkPJSC7Fvr59VGnXkM4Lb09kYDaBksCHo9C0s=";
     })
+    # This fixes an issue in Python 3.11 about Py_TPFLAGS_HAVE_GC
+    (fetchpatch {
+      name = "python311-compatibility.patch";
+      url = "https://github.com/boostorg/python/commit/a218babc8daee904a83f550fb66e5cb3f1cb3013.patch";
+      hash = "sha256-IHxLtJBx0xSy7QEr8FbCPofsjcPuSYzgtPwDlx1JM+4=";
+      stripLen = 1;
+      extraPrefix = "libs/python/";
+    })
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/crocoddyl/default.nix b/pkgs/development/libraries/crocoddyl/default.nix
index 877296334fe4..a25ca5b97dff 100644
--- a/pkgs/development/libraries/crocoddyl/default.nix
+++ b/pkgs/development/libraries/crocoddyl/default.nix
@@ -9,26 +9,18 @@
 , python3Packages
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "crocoddyl";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "loco-3d";
-    repo = pname;
-    rev = "v${version}";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-wDHCHTJXmJjU7mhQ2huUVdEc9ap7PMeqlHPrKm//jBQ=";
+    hash = "sha256-h7rzLSvmWOZCP8rvmUEhFeMEiPhojfbvkt+fNKpgoXo=";
   };
 
-  patches = [
-    # error: no matching function for call to 'max(double&, int)'
-    (fetchpatch {
-      url = "https://github.com/loco-3d/crocoddyl/commit/d2e4116257595317740975e745739bb76b92e5c0.patch";
-      hash = "sha256-M79jNdIxzx9PfW3TStRny76dVo/HDf/Rp08ZPx+ymBg";
-    })
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -48,11 +40,26 @@ stdenv.mkDerivation rec {
     "-DBUILD_PYTHON_INTERFACE=OFF"
   ];
 
+  prePatch = ''
+    substituteInPlace \
+      examples/CMakeLists.txt \
+      examples/log/check_logfiles.sh \
+      --replace /bin/bash ${stdenv.shell}
+  '';
+
+  doCheck = true;
+  pythonImportsCheck = [
+    "crocoddyl"
+  ];
+  checkInputs = lib.optionals (pythonSupport) [
+    python3Packages.scipy
+  ];
+
   meta = with lib; {
     description = "Crocoddyl optimal control library";
     homepage = "https://github.com/loco-3d/crocoddyl";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ wegank ];
+    maintainers = with maintainers; [ nim65s wegank ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/example-robot-data/default.nix b/pkgs/development/libraries/example-robot-data/default.nix
index b8ec7227c612..201275fb02ef 100644
--- a/pkgs/development/libraries/example-robot-data/default.nix
+++ b/pkgs/development/libraries/example-robot-data/default.nix
@@ -6,16 +6,16 @@
 , python3Packages
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "example-robot-data";
-  version = "4.0.7";
+  version = "4.0.8";
 
   src = fetchFromGitHub {
     owner = "Gepetto";
-    repo = pname;
-    rev = "v${version}";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-dN23ukKPkTohqD1J/0EneLyG6Cg0zriMr1l6WLFemd8=";
+    hash = "sha256-xeNbx1f9QCAOJrXfkk3jo9XH2/4HNtnRA1OSnqA2cLs=";
   };
 
   strictDeps = true;
@@ -32,11 +32,16 @@ stdenv.mkDerivation rec {
     "-DBUILD_PYTHON_INTERFACE=OFF"
   ];
 
+  doCheck = true;
+  pythonImportsCheck = [
+    "example_robot_data"
+  ];
+
   meta = with lib; {
     description = "Set of robot URDFs for benchmarking and developed examples.";
     homepage = "https://github.com/Gepetto/example-robot-data";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ wegank ];
+    maintainers = with maintainers; [ nim65s wegank ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/flite/default.nix b/pkgs/development/libraries/flite/default.nix
index f4eac39919f2..59ab572762ee 100644
--- a/pkgs/development/libraries/flite/default.nix
+++ b/pkgs/development/libraries/flite/default.nix
@@ -1,4 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, alsa-lib, fetchpatch }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, alsa-lib
+, fetchpatch
+, libpulseaudio
+, audioBackend ? "pulseaudio"
+}:
+
+assert lib.assertOneOf "audioBackend" audioBackend [ "alsa" "pulseaudio" ];
 
 stdenv.mkDerivation rec {
   pname = "flite";
@@ -11,7 +20,8 @@ stdenv.mkDerivation rec {
     sha256 = "1n0p81jzndzc1rzgm66kw9ls189ricy5v1ps11y0p2fk1p56kbjf";
   };
 
-  buildInputs = lib.optionals stdenv.isLinux [ alsa-lib ];
+  buildInputs = lib.optional (stdenv.isLinux && audioBackend == "alsa") alsa-lib
+    ++ lib.optional (stdenv.isLinux && audioBackend == "pulseaudio") libpulseaudio;
 
   # https://github.com/festvox/flite/pull/60.
   # Replaces `ar` with `$(AR)` in config/common_make_rules.
@@ -25,7 +35,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-shared"
-  ] ++ lib.optionals stdenv.isLinux [ "--with-audio=alsa" ];
+  ] ++ lib.optionals stdenv.isLinux [ "--with-audio=${audioBackend}" ];
 
   # main/Makefile creates and removes 'flite_voice_list.c' from multiple targets:
   # make[1]: *** No rule to make target 'flite_voice_list.c', needed by 'all'.  Stop
@@ -35,6 +45,7 @@ stdenv.mkDerivation rec {
     description = "A small, fast run-time speech synthesis engine";
     homepage = "http://www.festvox.org/flite/";
     license = licenses.bsdOriginal;
+    maintainers = with maintainers; [ getchoo ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index d96b0e14013c..f4a81633f54b 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freetype";
-  version = "2.13.0";
+  version = "2.13.1";
 
   src = let inherit (finalAttrs) pname version; in fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-XuI6vQR2NsJLLUPGYl3K/GZmHRrKZN7J4NBd8pWSYkw=";
+    sha256 = "sha256-6mfjsBmxEE0WZ6onT13DB9jL1gazmbwy3zCKd/GlZL8=";
   };
 
   propagatedBuildInputs = [ zlib bzip2 brotli libpng ]; # needed when linking against freetype
diff --git a/pkgs/development/libraries/geis/default.nix b/pkgs/development/libraries/geis/default.nix
index fad65d7dd4ce..17ef806ec9ad 100644
--- a/pkgs/development/libraries/geis/default.nix
+++ b/pkgs/development/libraries/geis/default.nix
@@ -32,8 +32,8 @@ stdenv.mkDerivation rec {
   pythonPath = with python3Packages;
     [ pygobject3  ];
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook python3Packages.wrapPython];
-  buildInputs = [ atk dbus evemu frame gdk-pixbuf gobject-introspection grail
+  nativeBuildInputs = [ pkg-config wrapGAppsHook python3Packages.wrapPython gobject-introspection ];
+  buildInputs = [ atk dbus evemu frame gdk-pixbuf grail
     gtk3 xorg.libX11 xorg.libXext xorg.libXi xorg.libXtst pango python3Packages.python xorgserver
   ];
 
diff --git a/pkgs/development/libraries/geoclue/default.nix b/pkgs/development/libraries/geoclue/default.nix
index 4bad33000c06..c2bf28d71045 100644
--- a/pkgs/development/libraries/geoclue/default.nix
+++ b/pkgs/development/libraries/geoclue/default.nix
@@ -65,7 +65,6 @@ stdenv.mkDerivation rec {
     json-glib
     libsoup_3
     avahi
-    gobject-introspection
   ] ++ lib.optionals withDemoAgent [
     libnotify gdk-pixbuf
   ] ++ lib.optionals (!stdenv.isDarwin) [
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index a8e8fde96f63..ec929272dea0 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -54,9 +54,13 @@ stdenv.mkDerivation rec {
     xz
     xz.bin
   ];
-  buildInputs = [ bash ]
-  # HACK, see #10874 (and 14664)
-    ++ lib.optionals (!stdenv.isLinux && !stdenv.hostPlatform.isCygwin) [ libiconv ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isMinGW) [
+    bash
+  ]
+  ++ lib.optionals (!stdenv.isLinux && !stdenv.hostPlatform.isCygwin) [
+    # HACK, see #10874 (and 14664)
+    libiconv
+  ];
 
   setupHooks = [
     ../../../build-support/setup-hooks/role.bash
diff --git a/pkgs/development/libraries/giflib/default.nix b/pkgs/development/libraries/giflib/default.nix
index 5202dc0edabc..8c8a587ed548 100644
--- a/pkgs/development/libraries/giflib/default.nix
+++ b/pkgs/development/libraries/giflib/default.nix
@@ -1,8 +1,15 @@
-{ lib, stdenv, fetchurl, fetchpatch, xmlto, docbook_xml_dtd_412, docbook_xsl, libxml2, fixDarwinDylibNames, pkgsStatic }:
+{ stdenv
+, lib
+, fetchurl
+, fetchpatch
+, fixDarwinDylibNames
+, pkgsStatic
+}:
 
 stdenv.mkDerivation rec {
   pname = "giflib";
   version = "5.2.1";
+
   src = fetchurl {
     url = "mirror://sourceforge/giflib/giflib-${version}.tar.gz";
     sha256 = "1gbrg03z1b6rlrvjyc6d41bc8j1bsr7rm8206gb1apscyii5bnii";
@@ -14,33 +21,48 @@ stdenv.mkDerivation rec {
       url = "https://src.fedoraproject.org/rpms/giflib/raw/2e9917bf13df114354163f0c0211eccc00943596/f/CVE-2022-28506.patch";
       sha256 = "sha256-TBemEXkuox8FdS9RvjnWcTWPaHRo4crcwSR9czrUwBY=";
     })
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # https://sourceforge.net/p/giflib/bugs/133/
     (fetchpatch {
-      # https://sourceforge.net/p/giflib/bugs/133/
       name = "darwin-soname.patch";
       url = "https://sourceforge.net/p/giflib/bugs/_discuss/thread/4e811ad29b/c323/attachment/Makefile.patch";
       sha256 = "12afkqnlkl3n1hywwgx8sqnhp3bz0c5qrwcv8j9hifw1lmfhv67r";
       extraPrefix = "./";
-    });
+    })
+  ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
+    # Build dll libraries.
+    (fetchurl {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/001-mingw-build.patch?h=mingw-w64-giflib&id=4cf1e519bcf51338dc607d23388fca47d71790c0";
+      sha256 = "KyJi3eqH/Ae+guEK6znraZI5+IPImaoYoW5NTkCvjsg=";
+    })
 
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace 'PREFIX = /usr/local' 'PREFIX = ${builtins.placeholder "out"}'
-  ''
-  # Upstream build system does not support NOT building shared libraries.
-  + lib.optionalString stdenv.hostPlatform.isStatic ''
+    # Install executables.
+    ./mingw-install-exes.patch
+  ];
+
+  nativeBuildInputs = lib.optionals stdenv.isDarwin [
+    fixDarwinDylibNames
+  ];
+
+  makeFlags = [
+    "PREFIX=${builtins.placeholder "out"}"
+  ];
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
+    # Upstream build system does not support NOT building shared libraries.
     sed -i '/all:/ s/libgif.so//' Makefile
     sed -i '/all:/ s/libutil.so//' Makefile
     sed -i '/-m 755 libgif.so/ d' Makefile
     sed -i '/ln -sf libgif.so/ d' Makefile
   '';
 
-  nativeBuildInputs = lib.optionals stdenv.isDarwin [ fixDarwinDylibNames ];
-
-  passthru.tests.static = pkgsStatic.giflib;
+  passthru.tests = {
+    static = pkgsStatic.giflib;
+  };
 
   meta = {
     description = "A library for reading and writing gif images";
+    homepage = "https://giflib.sourceforge.net/";
     platforms = lib.platforms.unix;
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ];
diff --git a/pkgs/development/libraries/giflib/mingw-install-exes.patch b/pkgs/development/libraries/giflib/mingw-install-exes.patch
new file mode 100644
index 000000000000..5ec3fdad7e65
--- /dev/null
+++ b/pkgs/development/libraries/giflib/mingw-install-exes.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -92,7 +92,7 @@
+ install: all install-bin install-include install-lib install-man
+ install-bin: $(INSTALLABLE)
+ 	$(INSTALL) -d "$(DESTDIR)$(BINDIR)"
+-	$(INSTALL) $^ "$(DESTDIR)$(BINDIR)"
++	$(INSTALL) $(^:=.exe) "$(DESTDIR)$(BINDIR)"
+ install-include:
+ 	$(INSTALL) -d "$(DESTDIR)$(INCDIR)"
+ 	$(INSTALL) -m 644 gif_lib.h "$(DESTDIR)$(INCDIR)"
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index bab58c887e5e..6af608995c2f 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -26,11 +26,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    hash = "sha256-JaV4Wl2jVmiQAUQJJrlOln0C4TxJ63dD417wzyLkJ1A=";
+    hash = "sha256-QW4XThZXNNhIBiU/jJa9opk/0H8ljDqtXwU6bv1GPog=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index f10d90a0454b..276f2d192ef7 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -109,13 +109,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.22.4";
+  version = "1.22.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-6q9TIkVl6qvVBco5xtV2lxm0V5XPUyzhzrYOGy6+maw=";
+    hash = "sha256-5k51za/X/y/H/DToVbBrHj7SJ8wG+jeNF7vNdngMM4w=";
   };
 
   patches = [
@@ -142,7 +142,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     gst-plugins-base
     orc
     json-glib
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 1b8d569f56ac..449873bc7c58 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -45,7 +45,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.22.4";
+  version = "1.22.5";
 
   outputs = [ "out" "dev" ];
 
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-KSQk6C3qFwUoxCtFb2KolTK8q8BQjxkuNGcvuG9o5bg=";
+    hash = "sha256-7dQzi0XCapryjA01qrlkoCTDiEum9SDYQo3wQhLIyTo=";
   };
 
   strictDeps = true;
@@ -77,7 +77,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    gobject-introspection
     graphene
     orc
     libtheora
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 1478e96120fc..ed7396f291cc 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.22.4";
+  version = "1.22.5";
 
   outputs = [
     "bin"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-EcsEmLwWuT2LmdIvdfgpuNCr/YJUhAshIGGNtVMtxlU=";
+    hash = "sha256-RAjXkw84GAnoWReswZcS8XMmG6hb3yDFVnsqIbEZO2E=";
   };
 
   depsBuildBuild = [
@@ -64,7 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     bash-completion
-    gobject-introspection
   ] ++ lib.optionals stdenv.isLinux [
     libcap
     libunwind
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index b194d6e82753..5b1396f35d51 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.22.4";
+  version = "1.22.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-TFIFPOjB33L9gXIen1PeOxRu3PLeKPYHvnBbzkz5CdE=";
+    hash = "sha256-Kt0VGapu6wHVRMuUKTaI7jvCB59rymB1v1wj0AoJIb4=";
   };
 
   outputs = [
@@ -46,7 +46,6 @@ stdenv.mkDerivation rec {
     cairo
     python3
     json-glib
-    gobject-introspection
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index cc1244b1ecae..a8bbb6320555 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.22.4";
+  version = "1.22.5";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-RThGz6RxoMHIAUVRvUhPvPM08ORDBZIxevuyN3Xmm9I=";
+    hash = "sha256-vM3TvWHYaCmxbODiBtthsz95SsF5JCP558xl110aMbU=";
   };
 
   nativeBuildInputs = [
@@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     bash-completion
     libxml2
-    gobject-introspection
     gst-devtools
     python3
   ];
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index bf847987a029..f967e2e0ce1b 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 , meson
 , nasm
 , ninja
@@ -51,15 +52,26 @@ assert raspiCameraSupport -> (stdenv.isLinux && stdenv.isAarch32);
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.22.4";
+  version = "1.22.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-1xIMEUap1yPVPVv+gHTaJXWoHwWYQ4dSk385u3yDO2o=";
+    hash = "sha256-tnsxMTpUxpKbgpadQdPP3y9Y21c/tfSR5rul2ErqB3g=";
   };
 
+  # TODO: Patch is conditional to spare rebuilds during the current staging-next cycle and should be removed during the next bump
+  patches = lib.optionals qt5Support [
+    # Needed until https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5083 is merged and released
+    (fetchpatch {
+      name = "gst-plugins-good-fix-qt5-without-viv-fb.patch";
+      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/03d8ef0b7c6e70eb936de0514831c1aafc763dcf.diff";
+      hash = "sha256-17XU/W/TMPg5669O1EBXByAN/VwFu/0idTg5ze3M/D4=";
+      stripLen = 2;
+    })
+  ];
+
   strictDeps = true;
 
   depsBuildBuild = [ pkg-config ];
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index c2fee6d1ea6b..2309e8717e2b 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.22.4";
+  version = "1.22.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-mnUbx0Dedo55HDepXwqSTGpB0S/X839UzmpOg0vhItM=";
+    hash = "sha256-hYPwwfT8sB7tEfoePCESZUOovXOe1Pwdsx91alqwHZo=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 6cafa2b6daeb..885726ee2ac7 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.22.4";
+  version = "1.22.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-RmZhLXqZxg3NbwvbobenTSVioFAbKj4FdvCRa/HYgRs=";
+    hash = "sha256-80PrVJZOvU2MBxvl7srVhvKP6wFW4DbgaxSNDn/rscA=";
   };
 
   outputs = [
@@ -41,7 +41,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gst-plugins-base
     gst-plugins-bad
-    gobject-introspection
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index e4fa679d9d24..2392d7f341d7 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.22.4";
+  version = "1.22.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-/7Rh/abAbTFsS+VoJjLMiQFFTtcrEJix4CIbxV5nPNc=";
+    hash = "sha256-JoBHOyGBWPGEZ8rD4cUCkbf/TgcQ3TUKWeqsvCnAmlQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index a8f4cb166cf3..c5d400048dfc 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.22.4";
+  version = "1.22.5";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-lnuONT2C0AgaaNxTY5sl2ftMqJv6HgYUA+DNfSNYW6Y=";
+    hash = "sha256-qaVQJnyVhN8OjHBDTTBHbo/QAYtzPBwe4z3q9CK9sks=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/keybinder/default.nix b/pkgs/development/libraries/keybinder/default.nix
index e4318ebe6193..2efbf85d47c7 100644
--- a/pkgs/development/libraries/keybinder/default.nix
+++ b/pkgs/development/libraries/keybinder/default.nix
@@ -13,11 +13,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-elL6DZtzCwAtoyGZYP0jAma6tHPks2KAtrziWtBENGU=";
   };
 
-  nativeBuildInputs = [ pkg-config autoconf automake ];
+  nativeBuildInputs = [ pkg-config autoconf automake gobject-introspection ];
 
   buildInputs = [
     libtool gnome.gnome-common gtk-doc gtk2
-    lua gobject-introspection
+    lua
   ];
 
   configureFlags = [ "--disable-python" ];
diff --git a/pkgs/development/libraries/lasso/default.nix b/pkgs/development/libraries/lasso/default.nix
index 70bd3d384deb..e3f91c3d827c 100644
--- a/pkgs/development/libraries/lasso/default.nix
+++ b/pkgs/development/libraries/lasso/default.nix
@@ -27,11 +27,11 @@ stdenv.mkDerivation rec {
     autoreconfHook
     pkg-config
     python3
+    gobject-introspection
   ];
 
   buildInputs = [
     glib
-    gobject-introspection
     gtk-doc
     libtool
     libxml2
diff --git a/pkgs/development/libraries/libdwg/default.nix b/pkgs/development/libraries/libdwg/default.nix
index 37eeb73f91cd..969b5d9636f2 100644
--- a/pkgs/development/libraries/libdwg/default.nix
+++ b/pkgs/development/libraries/libdwg/default.nix
@@ -13,8 +13,14 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  # Hack to avoid TMPDIR in RPATHs.
-  preFixup = ''rm -rf "$(pwd)" '';
+  # remove forbidden references to $TMPDIR
+  preFixup = lib.optionalString stdenv.isLinux ''
+    for f in "$out"/bin/*; do
+      if isELF "$f"; then
+        patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$f"
+      fi
+    done
+  '';
 
   meta = {
     description = "Library reading dwg files";
diff --git a/pkgs/development/libraries/libftdi/default.nix b/pkgs/development/libraries/libftdi/default.nix
index d177f7369a04..ffc33d0247d1 100644
--- a/pkgs/development/libraries/libftdi/default.nix
+++ b/pkgs/development/libraries/libftdi/default.nix
@@ -20,8 +20,6 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ libusb-compat-0_1 ];
 
-  # Hack to avoid TMPDIR in RPATHs.
-  preFixup = ''rm -rf "$(pwd)" '';
   configureFlags = lib.optional (!stdenv.isDarwin) "--with-async-mode";
 
   # allow async mode. from ubuntu. see:
@@ -31,6 +29,15 @@ stdenv.mkDerivation rec {
       --replace "ifdef USB_CLASS_PTP" "if 0"
   '';
 
+  # remove forbidden references to $TMPDIR
+  preFixup = lib.optionalString stdenv.isLinux ''
+    for f in "$out"/bin/*; do
+      if isELF "$f"; then
+        patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$f"
+      fi
+    done
+  '';
+
   meta = {
     description = "A library to talk to FTDI chips using libusb";
     homepage = "https://www.intra2net.com/en/developer/libftdi/";
diff --git a/pkgs/development/libraries/libgit2/default.nix b/pkgs/development/libraries/libgit2/default.nix
index 3d7b6ff9e012..9c04e9b4058f 100644
--- a/pkgs/development/libraries/libgit2/default.nix
+++ b/pkgs/development/libraries/libgit2/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkg-config
 , python3
@@ -19,16 +20,29 @@
 
 stdenv.mkDerivation rec {
   pname = "libgit2";
-  version = "1.6.4";
+  version = "1.7.0";
   # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    hash = "sha256-lW3mokVKsbknVj2xsxEbeZH4IdKZ0aIgGutzenS0Eh0=";
+    hash = "sha256-3ZVBGd2T5DQKsDEc5a7pS0yz01+rDCszU9ZK0zxvfyQ=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "darwin-errSSLNetworkTimeout.patch";
+      url = "https://github.com/libgit2/libgit2/commit/3e15292d8863da316a57be23fede04f443460686.patch";
+      hash = "sha256-N314YK7osO9L3hCXb+FcMoDM8iBW9Bt8D5O2Szdz7YA=";
+    })
+    (fetchpatch {
+      name = "missing-git_oidarray.patch";
+      url = "https://github.com/libgit2/libgit2/commit/085a169c1d73e02888708652d7772b3bc1f1b28b.diff";
+      hash = "sha256-l6q1TLuOloyk0Jqvo5Npv4grU/oxlg+RFLa43qENaLI=";
+    })
+  ];
+
   cmakeFlags = [
     "-DUSE_HTTP_PARSER=system"
     "-DUSE_SSH=ON"
diff --git a/pkgs/development/libraries/libhwy/default.nix b/pkgs/development/libraries/libhwy/default.nix
index 371708d81fa2..afbbf69966bd 100644
--- a/pkgs/development/libraries/libhwy/default.nix
+++ b/pkgs/development/libraries/libhwy/default.nix
@@ -1,15 +1,23 @@
-{ lib, stdenv, cmake, ninja, gtest, fetchFromGitHub }:
+{ lib, stdenv, cmake, ninja, gtest, fetchFromGitHub, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "libhwy";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "highway";
     rev = version;
-    hash = "sha256-bQtfye+gn7GOyzCtji4st5hsV40rPzuaYDP7N1tZ8wg=";
+    hash = "sha256-Gym2iHq5ws9kuG4HWSQndD8hVugV4USZt6dUFnEkLwY=";
   };
+  patches = lib.optionals (with stdenv; isAarch64 && isLinux) [ # conditional, temporarily
+    # backport for compilation issue on aarch64
+    # https://github.com/google/highway/issues/1613
+    (fetchpatch {
+      url = "https://github.com/google/highway/commit/7ad89efa911cb906ccf3f78fe510db415e921801.diff";
+      hash = "sha256-hTSkeCh2QLMqeIKG/CAqJXaPqD/66Z02gjGXk591f+U=";
+    })
+  ];
 
   nativeBuildInputs = [ cmake ninja ];
 
@@ -29,6 +37,14 @@ stdenv.mkDerivation rec {
     "-DGTEST_MAIN_LIBRARY=${lib.getLib gtest}/lib/libgtest_main${libExt}"
   ] ++ lib.optionals stdenv.hostPlatform.isAarch32 [
     "-DHWY_CMAKE_ARM7=ON"
+  ] ++ lib.optionals stdenv.hostPlatform.isx86_32 [
+    # Quoting CMakelists.txt:
+    #   This must be set on 32-bit x86 with GCC < 13.1, otherwise math_test will be
+    #   skipped. For GCC 13.1+, you can also build with -fexcess-precision=standard.
+    # Fixes tests:
+    #   HwyMathTestGroup/HwyMathTest.TestAllAtanh/EMU128
+    #   HwyMathTestGroup/HwyMathTest.TestAllLog1p/EMU128
+    "-DHWY_CMAKE_SSE2=ON"
   ];
 
   # hydra's darwin machines run into https://github.com/libjxl/libjxl/issues/408
diff --git a/pkgs/development/libraries/libipt/default.nix b/pkgs/development/libraries/libipt/default.nix
index 2cef20fdcbd4..9b3de39e5d91 100644
--- a/pkgs/development/libraries/libipt/default.nix
+++ b/pkgs/development/libraries/libipt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libipt";
-  version = "2.0.5";
+  version = "2.0.6";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "libipt";
     rev = "v${version}";
-    sha256 = "sha256-W7Hvc2zkmR6FdPGsymWXtm66BiHLcW9r7mywHjabeLc=";
+    sha256 = "sha256-RuahOkDLbac9bhXn8QSf7lMRw11PIpXQo3eaQ9N4Rtc=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/liblangtag/default.nix b/pkgs/development/libraries/liblangtag/default.nix
index 5ba2ecc5d6bc..efd914ca7b10 100644
--- a/pkgs/development/libraries/liblangtag/default.nix
+++ b/pkgs/development/libraries/liblangtag/default.nix
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
       (stdenv.hostPlatform.libc == "glibc")
       "--with-locale-alias=${stdenv.cc.libc}/share/locale/locale.alias";
 
-  buildInputs = [ gettext glib libxml2 gobject-introspection gnome-common ];
-  nativeBuildInputs = [ autoreconfHook gtk-doc gettext pkg-config unzip ];
+  buildInputs = [ gettext glib libxml2 gnome-common ];
+  nativeBuildInputs = [ autoreconfHook gtk-doc gettext pkg-config unzip gobject-introspection ];
 
   meta = with lib; {
     description = "An interface library to access tags for identifying languages";
diff --git a/pkgs/development/libraries/libmx/default.nix b/pkgs/development/libraries/libmx/default.nix
index 6cff9e3f03aa..23cb00618055 100644
--- a/pkgs/development/libraries/libmx/default.nix
+++ b/pkgs/development/libraries/libmx/default.nix
@@ -33,10 +33,9 @@ stdenv.mkDerivation rec {
 
   configureScript = "sh autogen.sh";
 
-  nativeBuildInputs = [ pkg-config automake autoconf intltool ];
+  nativeBuildInputs = [ pkg-config automake autoconf intltool gobject-introspection ];
   buildInputs = [
     libtool
-    gobject-introspection glib
     gtk2 gtk-doc clutter clutter-gtk
   ];
 
diff --git a/pkgs/development/libraries/libpfm/default.nix b/pkgs/development/libraries/libpfm/default.nix
index 281aff548c8b..8618986195e8 100644
--- a/pkgs/development/libraries/libpfm/default.nix
+++ b/pkgs/development/libraries/libpfm/default.nix
@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation (rec {
-  version = "4.12.0";
+  version = "4.13.0";
   pname = "libpfm";
 
   src = fetchurl {
     url = "mirror://sourceforge/perfmon2/libpfm4/${pname}-${version}.tar.gz";
-    sha256 = "sha256-SwwfU/OaYVJbab6/UyxoBAwbmE11RKiuCESxPNkeHuQ=";
+    sha256 = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E=";
   };
 
   makeFlags = [
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 9974826573a7..6419f5a59578 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -32,7 +32,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.56.2";
+  version = "2.56.3";
 
   outputs = [ "out" "dev" ] ++ lib.optionals withIntrospection [
     "devdoc"
@@ -40,13 +40,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    sha256 = "PsPE2Pc+C6S5EwAmlp6DccCStzQpjTbi/bPrSvzsEgA=";
+    hash = "sha256-WjKASKAtAUZFzSf2EUD04LESgPssfyohhk/gxZrBzog=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-GIEpZ5YMvmYQLcaLXseXQ6gIF7ICtUKq28JCVJ3PEYk=";
+    hash = "sha256-s7eNMSdajr2VhB/BPVUFftHhHKCqpR9sTfxfWwag1mI=";
     # TODO: move this to fetchCargoTarball
     dontConfigure = true;
   };
@@ -141,18 +141,19 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # Not generated when cross compiling.
-  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) ''
-    # Merge gdkpixbuf and librsvg loaders
-    cat ${lib.getLib gdk-pixbuf}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache > $GDK_PIXBUF/loaders.cache.tmp
-    mv $GDK_PIXBUF/loaders.cache.tmp $GDK_PIXBUF/loaders.cache
+  postInstall = let emulator = stdenv.hostPlatform.emulator buildPackages; in
+    lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) ''
+      # Merge gdkpixbuf and librsvg loaders
+      cat ${lib.getLib gdk-pixbuf}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache $GDK_PIXBUF/loaders.cache > $GDK_PIXBUF/loaders.cache.tmp
+      mv $GDK_PIXBUF/loaders.cache.tmp $GDK_PIXBUF/loaders.cache
 
-    mkdir -p "$out/share/bash-completion/completions/"
-    $out/bin/rsvg-convert --completion bash > "$out/share/bash-completion/completions/rsvg-convert"
-    mkdir -p "$out/share/zsh/site-functions/"
-    $out/bin/rsvg-convert --completion zsh > "$out/share/zsh/site-functions/_rsvg-convert"
-    mkdir -p "$out/share/fish/vendor_completions.d/"
-    $out/bin/rsvg-convert --completion fish > "$out/share/fish/vendor_completions.d/rsvg-convert.fish"
-  '';
+      mkdir -p "$out/share/bash-completion/completions/"
+      ${emulator} $out/bin/rsvg-convert --completion bash > "$out/share/bash-completion/completions/rsvg-convert"
+      mkdir -p "$out/share/zsh/site-functions/"
+      ${emulator} $out/bin/rsvg-convert --completion zsh > "$out/share/zsh/site-functions/_rsvg-convert"
+      mkdir -p "$out/share/fish/vendor_completions.d/"
+      ${emulator} $out/bin/rsvg-convert --completion fish > "$out/share/fish/vendor_completions.d/rsvg-convert.fish"
+    '';
 
   postFixup = lib.optionalString withIntrospection ''
     # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
diff --git a/pkgs/development/libraries/libunique/3.x.nix b/pkgs/development/libraries/libunique/3.x.nix
index 086ca28676b3..780ae7418dde 100644
--- a/pkgs/development/libraries/libunique/3.x.nix
+++ b/pkgs/development/libraries/libunique/3.x.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
     sha256 = "0f70lkw66v9cj72q0iw1s2546r6bwwcd8idcm3621fg2fgh2rw58";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ dbus dbus-glib gtk3 gobject-introspection gtk-doc docbook_xml_dtd_45 docbook_xsl libxslt libxml2 ];
+  nativeBuildInputs = [ pkg-config gobject-introspection ];
+  buildInputs = [ dbus dbus-glib gtk3 gtk-doc docbook_xml_dtd_45 docbook_xsl libxslt libxml2 ];
 
   meta = {
     homepage = "https://wiki.gnome.org/Attic/LibUnique";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 75649eabaede..392786524a87 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -86,8 +86,8 @@
 */
 
 let
-  version = "23.1.3";
-  hash = "sha256-L21zgbwQ+9LWJjrRAieFuLURBGwakEFi+PfaGO6ortk=";
+  version = "23.1.4";
+  hash = "sha256-cmGhf7lIZ+PcWpDYofEA+gSwy73lHSUwLAhytemhCVk=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
diff --git a/pkgs/development/libraries/nghttp2/default.nix b/pkgs/development/libraries/nghttp2/default.nix
index 2fae8135124e..e26fe4fa0034 100644
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -7,11 +7,11 @@
 # Optional dependencies
 , enableApp ? with stdenv.hostPlatform; !isWindows && !isStatic
 , c-aresMinimal, libev, openssl, zlib
-, enableAsioLib ? false, boost
 , enableGetAssets ? false, libxml2
 , enableHpack ? false, jansson
+, enableHttp3 ? false, ngtcp2, nghttp3, quictls
 , enableJemalloc ? false, jemalloc
-, enablePython ? false, python3Packages, ncurses
+, enablePython ? false, python3, ncurses
 
 # Unit tests ; we have to set TZDIR, which is a GNUism.
 , enableTests ? stdenv.hostPlatform.isGnu, cunit, tzdata
@@ -27,41 +27,38 @@
 
 assert enableGetAssets -> enableApp;
 assert enableHpack -> enableApp;
+assert enableHttp3 -> enableApp;
 assert enableJemalloc -> enableApp;
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.51.0";
+  version = "1.54.0";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-6z6m9bYMbT7b8GXgT0NOjtYpGlyxoHkZxBcwqx/MAOA=";
+    sha256 = "sha256-nZ0esJm0kvr6Gtn31pZZU3WP3vmtDPZaTQvcI3OAPa0=";
   };
 
-  outputs = [ "bin" "out" "dev" "lib" ]
-    ++ lib.optionals (enablePython) [ "python" ];
+  outputs = [ "out" "dev" "lib" "doc" "man" ];
 
   nativeBuildInputs = [ pkg-config ]
-    ++ lib.optionals (enableApp) [ installShellFiles ]
-    ++ lib.optionals (enablePython) [ python3Packages.cython ];
+    ++ lib.optionals (enableApp) [ installShellFiles ];
 
-  buildInputs = lib.optionals enableApp [ c-aresMinimal libev openssl zlib ]
-    ++ lib.optionals (enableAsioLib) [ boost ]
+  buildInputs = lib.optionals enableApp [ c-aresMinimal libev zlib ]
+    ++ lib.optionals (enableApp && !enableHttp3) [ openssl ]
     ++ lib.optionals (enableGetAssets) [ libxml2 ]
     ++ lib.optionals (enableHpack) [ jansson ]
     ++ lib.optionals (enableJemalloc) [ jemalloc ]
-    ++ lib.optionals (enablePython) [ python3Packages.python ncurses python3Packages.setuptools ];
+    ++ lib.optionals (enableHttp3) [ ngtcp2 nghttp3 quictls ]
+    ++ lib.optionals (enablePython) [ python3 ];
 
   enableParallelBuilding = true;
 
   configureFlags = [
     "--disable-examples"
     (lib.enableFeature enableApp "app")
-  ] ++ lib.optionals (enableAsioLib) [ "--enable-asio-lib" "--with-boost-libdir=${boost}/lib" ]
-    ++ lib.optionals (enablePython) [
-      "--enable-python-bindings"
-      "--with-cython=${python3Packages.cython}/bin/cython"
-    ];
+    (lib.enableFeature enableHttp3 "http3")
+  ];
 
   # Unit tests require CUnit and setting TZDIR environment variable
   doCheck = enableTests;
@@ -70,22 +67,18 @@ stdenv.mkDerivation rec {
     export TZDIR=${tzdata}/share/zoneinfo
   '';
 
-  preInstall = lib.optionalString (enablePython) ''
-    mkdir -p $out/${python3Packages.python.sitePackages}
-    # convince installer it's ok to install here
-    export PYTHONPATH="$PYTHONPATH:$out/${python3Packages.python.sitePackages}"
-  '';
-  postInstall = lib.optionalString (enablePython) ''
-    mkdir -p $python/${python3Packages.python.sitePackages}
-    mv $out/${python3Packages.python.sitePackages}/* $python/${python3Packages.python.sitePackages}
-    rm -r $out/lib
-  '' + lib.optionalString (enableApp) ''
+  postInstall = lib.optionalString (enableApp) ''
     installShellCompletion --bash doc/bash_completion/{h2load,nghttp,nghttpd,nghttpx}
+  '' + lib.optionalString (!enableApp) ''
+    rm -r $out/bin
+  '' + lib.optionalString (enablePython) ''
+    patchShebangs $out/share/nghttp2
+  '' + lib.optionalString (!enablePython) ''
+    rm -r $out/share
   '';
 
   passthru.tests = {
     inherit curl libsoup;
-    python-nghttp2 = python3Packages.nghttp2;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index e85a7674a263..9bfd3324242a 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.15.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FWNWpRuCUyqTIyLZkBFKrd2urjSCqHp20mBAXOcJm14=";
+    hash = "sha256-vY3RooC8ttezru6vAqbG1MU5uZhD8fLnlEYVYS3pFRk=";
   };
 
   outputs = [ "out" "dev" "doc" ];
@@ -27,6 +27,13 @@ stdenv.mkDerivation rec {
     "-DENABLE_STATIC_LIB=OFF"
   ];
 
+  preConfigure = ''
+    # https://github.com/ngtcp2/ngtcp2/issues/858
+    # Fix ngtcp2_crypto_openssl remnants.
+    substituteInPlace crypto/includes/CMakeLists.txt \
+      --replace 'ngtcp2/ngtcp2_crypto_openssl.h' 'ngtcp2/ngtcp2_crypto_quictls.h'
+  '';
+
   doCheck = true;
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index eded5f1b5b96..11121059500e 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -96,6 +96,9 @@ stdenv.mkDerivation rec {
   preCheck = ''
     substituteInPlace tests/scripts/all \
       --replace "/bin/rm" "rm"
+
+    # skip flaky tests
+    rm -f tests/scripts/test063-delta-multiprovider
   '';
 
   doCheck = true;
diff --git a/pkgs/development/libraries/osm-gps-map/default.nix b/pkgs/development/libraries/osm-gps-map/default.nix
index 79bc2421dc99..9fa4bf10f47f 100644
--- a/pkgs/development/libraries/osm-gps-map/default.nix
+++ b/pkgs/development/libraries/osm-gps-map/default.nix
@@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "doc" ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config gobject-introspection ];
 
   buildInputs = [
-    cairo glib gobject-introspection
+    cairo glib
     gnome.gnome-common gtk3 gnome.libsoup
   ];
 
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 7f545958e71b..1d089774cc67 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -1,17 +1,17 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, autoreconfHook
-, docbook-xsl-nons
-, gtk-doc
-, installShellFiles
-, libxslt # for xsltproc
+, meson
+, ninja
 , pkg-config
-, which
-, libffi
-, libiconv
-, libintl
 , libtasn1
+, libxslt
+, docbook-xsl-nons
+, docbook_xml_dtd_43
+, gettext
+, mesonEmulatorHook
+, libffi
+, libintl
 }:
 
 stdenv.mkDerivation rec {
@@ -25,65 +25,49 @@ stdenv.mkDerivation rec {
     hash = "sha256-paLiRYgYshuedgDgW2nEsv4/Loq6qFyQMjfBJwqtHzw=";
   };
 
-  outputs = [ "out" "bin" "dev"];
+  outputs = [ "out" "bin" "dev" ];
+
+  strictDeps = true;
 
-  # For cross platform builds of p11-kit, libtasn1 in nativeBuildInputs
-  # provides the asn1Parser binary on the hostPlatform needed for building.
-  # at the same time, libtasn1 in buildInputs provides the libasn1 library
-  # to link against for the target platform.
-  # Hence, libtasn1 is required in both native and build inputs.
   nativeBuildInputs = [
-    autoreconfHook
-    docbook-xsl-nons
-    gtk-doc
-    installShellFiles
-    libtasn1
-    libxslt.bin
+    meson
+    ninja
     pkg-config
-    which
+    libtasn1 # asn1Parser
+    libxslt # xsltproc
+    docbook-xsl-nons
+    docbook_xml_dtd_43
+    gettext
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   buildInputs = [
     libffi
-    libiconv
-    libintl
     libtasn1
+    libintl
   ];
 
-  autoreconfPhase = ''
-    NOCONFIGURE=1 ./autogen.sh
-  '';
-
-  configureFlags = [
-    "--enable-doc"
+  mesonFlags = [
     "--sysconfdir=/etc"
-    "--localstatedir=/var"
-    "--with-trust-paths=${lib.concatStringsSep ":" [
-      "/etc/ssl/trust-source"                  # p11-kit trust source
-      "/etc/ssl/certs/ca-certificates.crt"     # NixOS + Debian/Ubuntu/Arch/Gentoo...
-      "/etc/pki/tls/certs/ca-bundle.crt"       # Fedora/CentOS
+    (lib.mesonBool "man" true)
+    (lib.mesonEnable "systemd" false)
+    (lib.mesonOption "bashcompdir" "${placeholder "bin"}/share/bash-completion/completions")
+    (lib.mesonOption "trust_paths" (lib.concatStringsSep ":" [
+      "/etc/ssl/trust-source" # p11-kit trust source
+      "/etc/ssl/certs/ca-certificates.crt" # NixOS + Debian/Ubuntu/Arch/Gentoo...
+      "/etc/pki/tls/certs/ca-bundle.crt" # Fedora/CentOS
       "/var/lib/ca-certificates/ca-bundle.pem" # openSUSE
-      "/etc/ssl/cert.pem"                      # Darwin/macOS
-    ]}"
+      "/etc/ssl/cert.pem" # Darwin/macOS
+    ]))
   ];
 
-  enableParallelBuilding = true;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
-  # Tests run in fakeroot for non-root users
-  preCheck = ''
-    if [ "$(id -u)" != "0" ]; then
-      export FAKED_MODE=1
-    fi
-  '';
-
-  doCheck = !stdenv.isDarwin;
-
-  installFlags = [
-    "exampledir=${placeholder "out"}/etc/pkcs11"
-  ];
-
-  postInstall = ''
-    installShellCompletion --bash bash-completion/{p11-kit,trust}
+  postPatch = ''
+    # Install sample config files to $out/etc even though they will be loaded from /etc.
+    substituteInPlace p11-kit/meson.build \
+      --replace 'install_dir: prefix / p11_system_config' "install_dir: '$out/etc/pkcs11'"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 3f58975cf3b4..08b92288e544 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -75,7 +75,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.74";
+    version = "0.3.77";
 
     outputs = [
       "out"
@@ -93,7 +93,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-ZV66niKeR4PDaqUuVqiosY7LSDLmIjrDsmCZyQkR72Y=";
+      sha256 = "sha256-dRAo/GzWvXKVCGLM12YyTQmgXHEYn3QbOyaZKmlqTYY=";
     };
 
     patches = [
diff --git a/pkgs/development/libraries/popt/default.nix b/pkgs/development/libraries/popt/default.nix
index 37d83ff5b2b2..fdccb4d09336 100644
--- a/pkgs/development/libraries/popt/default.nix
+++ b/pkgs/development/libraries/popt/default.nix
@@ -1,4 +1,8 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch2
+}:
 
 stdenv.mkDerivation rec {
   pname = "popt";
@@ -12,6 +16,23 @@ stdenv.mkDerivation rec {
   patches = lib.optionals stdenv.isCygwin [
     ./1.16-cygwin.patch
     ./1.16-vpath.patch
+  ] ++ lib.optionals stdenv.hostPlatform.isMinGW [
+    # Do not require <sys/ioctl.h>
+    (fetchpatch2 {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/get-w32-console-maxcols.mingw32.patch?h=mingw-w64-popt&id=63f2cdb0de116362c49681cef20f7a8b4355e85a";
+      sha256 = "zv43l1RBqNzT/JG+jQaMVFaFv+ZYPuIiAtKUDzJJBbc=";
+      stripLen = 1;
+      extraPrefix = "src/";
+    })
+
+    # Do not try to detect setuid, it is not a thing.
+    (fetchpatch2 {
+      url = "https://github.com/rpm-software-management/popt/commit/905544c5d9767894edaf71a1e3ce5126944c5695.patch";
+      sha256 = "3PmcxeiEZ/Hof0zoVFSytEXvQ8gE8Sp5UdagExPVICU=";
+      stripLen = 1;
+      extraPrefix = "src/";
+      revert = true;
+    })
   ];
 
   doCheck = false; # fails
diff --git a/pkgs/development/libraries/qpdf/default.nix b/pkgs/development/libraries/qpdf/default.nix
index b1b78bb25704..838657f48bbe 100644
--- a/pkgs/development/libraries/qpdf/default.nix
+++ b/pkgs/development/libraries/qpdf/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qpdf";
-  version = "11.4.0";
+  version = "11.5.0";
 
   src = fetchFromGitHub {
     owner = "qpdf";
     repo = "qpdf";
     rev = "v${version}";
-    hash = "sha256-cG8TxgWXZGol7X2eRQNeknMo4L8PoWSMvxOsDVO/Rx4=";
+    hash = "sha256-lojvsCgBsT7wVRLWfkeOduEYUG7ztI/uryM0WueWiL0=";
   };
 
   nativeBuildInputs = [ cmake perl ];
diff --git a/pkgs/development/libraries/rapidfuzz-cpp/default.nix b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
index 2333b63057e2..ec9669f3c7d9 100644
--- a/pkgs/development/libraries/rapidfuzz-cpp/default.nix
+++ b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rapidfuzz-cpp";
-  version = "1.11.3";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "maxbachmann";
     repo = "rapidfuzz-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Qqdw5dy+JUBSDpbWEh3Ap3+3h+CcNdfBL+rloRzWGEQ=";
+    hash = "sha256-gLiITRCxX3nkzrlvU1/ZPxEo2v7q79/MwrnURUjrY28=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index 7655c4db254c..dd68fef04e6b 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.46";
+  version = "1.3.47";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-X+ZwM53ensCeUoxNa8cBO4KcWxWbb7iKxIRysImvKxw=";
+    sha256 = "sha256-wFn7vJA6FCfgFCjjDdyOtBv209yeJNFlG1fKMQ84Bj0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/science/astronomy/cfitsio/default.nix b/pkgs/development/libraries/science/astronomy/cfitsio/default.nix
index f35ff4c5ce58..426cbd3ff4ea 100644
--- a/pkgs/development/libraries/science/astronomy/cfitsio/default.nix
+++ b/pkgs/development/libraries/science/astronomy/cfitsio/default.nix
@@ -15,31 +15,42 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-/a3AHQnPn1QlOALF7IfrEN5RzkEwQRQVrojDCUBiG4s=";
   };
 
-  buildInputs = [ bzip2 curl zlib ];
+  patches = [
+    ./darwin-rpath-universal.patch
+  ];
 
-  patches = [ ./darwin-rpath-universal.patch ];
+  buildInputs = [
+    bzip2
+    curl
+    zlib
+  ];
 
-  configureFlags = [ "--with-bzip2=${bzip2.out}" "--enable-reentrant" ];
+  configureFlags = [
+    "--with-bzip2=${bzip2.out}"
+    "--enable-reentrant"
+  ];
 
   hardeningDisable = [ "format" ];
 
   # Shared-only build
   buildFlags = [ "shared" ];
-  postPatch = '' sed -e '/^install:/s/libcfitsio.a //' -e 's@/bin/@@g' -i Makefile.in
-   '';
+
+  postPatch = ''
+    sed -e '/^install:/s/libcfitsio.a //' -e 's@/bin/@@g' -i Makefile.in
+  '';
 
   meta = {
     homepage = "https://heasarc.gsfc.nasa.gov/fitsio/";
     description = "Library for reading and writing FITS data files";
-    longDescription =
-      '' CFITSIO is a library of C and Fortran subroutines for reading and
-         writing data files in FITS (Flexible Image Transport System) data
-         format.  CFITSIO provides simple high-level routines for reading and
-         writing FITS files that insulate the programmer from the internal
-         complexities of the FITS format.  CFITSIO also provides many
-         advanced features for manipulating and filtering the information in
-         FITS files.
-      '';
+    longDescription = ''
+      CFITSIO is a library of C and Fortran subroutines for reading and
+      writing data files in FITS (Flexible Image Transport System) data
+      format.  CFITSIO provides simple high-level routines for reading and
+      writing FITS files that insulate the programmer from the internal
+      complexities of the FITS format.  CFITSIO also provides many
+      advanced features for manipulating and filtering the information in
+      FITS files.
+    '';
     changelog = "https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/docs/changes.txt";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ xbreak hjones2199 ];
diff --git a/pkgs/development/libraries/taskflow/default.nix b/pkgs/development/libraries/taskflow/default.nix
index cde327c550eb..3c31d152fc70 100644
--- a/pkgs/development/libraries/taskflow/default.nix
+++ b/pkgs/development/libraries/taskflow/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "taskflow";
-  version = "3.5.0";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "taskflow";
     repo = "taskflow";
     rev = "v${version}";
-    hash = "sha256-UUWJENGn60YQdUSQ55uL+/3xt/JUsVuKnqm/ef7wPVM=";
+    hash = "sha256-Iy9BhkyJa2nFxwVXb4LAlgVAHnu+58Ago2eEgAIlZ7M=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/xsimd/default.nix b/pkgs/development/libraries/xsimd/default.nix
index ec2d166ef580..a481a12932f9 100644
--- a/pkgs/development/libraries/xsimd/default.nix
+++ b/pkgs/development/libraries/xsimd/default.nix
@@ -1,35 +1,54 @@
-{ lib, stdenv, fetchFromGitHub, cmake, gtest }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, doctest
+}:
+
 stdenv.mkDerivation rec {
   pname = "xsimd";
-  version = "9.0.1";
+  version = "11.1.0";
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
     rev = version;
-    sha256 = "sha256-onALN6agtrHWigtFlCeefD9CiRZI4Y690XTzy2UDnrk=";
+    sha256 = "sha256-l6IRzndjb95hIcFCCm8zmlNHWtKduqy2t/oml/9Xp+w=";
   };
+  patches = [
+    # Ideally, Accelerate/Accelerate.h should be used for this implementation,
+    # but it doesn't work... Needs a Darwin user to debug this. We apply this
+    # patch unconditionally, because the #if macros make sure it doesn't
+    # interfer with the Linux implementations.
+    ./fix-darwin-exp10-implementation.patch
+  ] ++ lib.optionals stdenv.isDarwin [
+    # https://github.com/xtensor-stack/xsimd/issues/807
+    ./disable-test_error_gamma-test.patch
+  ] ++ lib.optionals (stdenv.isDarwin || stdenv.hostPlatform.isMusl) [
+    # - Darwin report: https://github.com/xtensor-stack/xsimd/issues/917
+    # - Musl   report: https://github.com/xtensor-stack/xsimd/issues/798
+    ./disable-exp10-test.patch
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+    # https://github.com/xtensor-stack/xsimd/issues/798
+    ./disable-polar-test.patch
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    # Fix suggested here: https://github.com/xtensor-stack/xsimd/issues/798#issuecomment-1356884601
+    # Upstream didn't merge that from some reason.
+    ./fix-atan-test.patch
+  ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+  ];
 
-  cmakeFlags = [ "-DBUILD_TESTS=ON" ];
+  cmakeFlags = [
+    "-DBUILD_TESTS=${if (doCheck && stdenv.hostPlatform == stdenv.buildPlatform) then "ON" else "OFF"}"
+  ];
 
   doCheck = true;
-  nativeCheckInputs = [ gtest ];
+  nativeCheckInputs = [
+    doctest
+  ];
   checkTarget = "xtest";
-  GTEST_FILTER =
-    let
-      # Upstream Issue: https://github.com/xtensor-stack/xsimd/issues/456
-      filteredTests = lib.optionals stdenv.hostPlatform.isDarwin [
-        "error_gamma_test/*"
-      ];
-    in
-    "-${builtins.concatStringsSep ":" filteredTests}";
-
-  # https://github.com/xtensor-stack/xsimd/issues/748
-  postPatch = ''
-    substituteInPlace xsimd.pc.in \
-      --replace '$'{prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@
-  '';
 
   meta = with lib; {
     description = "C++ wrappers for SIMD intrinsics";
diff --git a/pkgs/development/libraries/xsimd/disable-exp10-test.patch b/pkgs/development/libraries/xsimd/disable-exp10-test.patch
new file mode 100644
index 000000000000..62e24e18c6b7
--- /dev/null
+++ b/pkgs/development/libraries/xsimd/disable-exp10-test.patch
@@ -0,0 +1,34 @@
+commit 87433035c70578507e08565723c99158290f2488
+Author: Doron Behar <doron.behar@gmail.com>
+Date:   Tue Aug 1 13:26:04 2023 +0300
+
+    Darwin & Musl: Disable failing exp10 test
+
+diff --git a/test/test_xsimd_api.cpp b/test/test_xsimd_api.cpp
+index 84b4b0b..1b29742 100644
+--- a/test/test_xsimd_api.cpp
++++ b/test/test_xsimd_api.cpp
+@@ -515,11 +515,6 @@ struct xsimd_api_float_types_functions
+         value_type val(2);
+         CHECK_EQ(extract(xsimd::exp(T(val))), std::exp(val));
+     }
+-    void test_exp10()
+-    {
+-        value_type val(2);
+-        CHECK_EQ(extract(xsimd::exp10(T(val))), std::pow(value_type(10), val));
+-    }
+     void test_exp2()
+     {
+         value_type val(2);
+@@ -804,11 +799,6 @@ TEST_CASE_TEMPLATE("[xsimd api | float types functions]", B, FLOAT_TYPES)
+         Test.test_exp();
+     }
+ 
+-    SUBCASE("exp10")
+-    {
+-        Test.test_exp10();
+-    }
+-
+     SUBCASE("exp2")
+     {
+         Test.test_exp2();
diff --git a/pkgs/development/libraries/xsimd/disable-polar-test.patch b/pkgs/development/libraries/xsimd/disable-polar-test.patch
new file mode 100644
index 000000000000..cbb7c0313c6d
--- /dev/null
+++ b/pkgs/development/libraries/xsimd/disable-polar-test.patch
@@ -0,0 +1,35 @@
+commit 9374b88b97911d9c6e19d5e764e25183cd45d534
+Author: Doron Behar <doron.behar@gmail.com>
+Date:   Tue Aug 1 13:29:16 2023 +0300
+
+    aarch64-Darwin: Disable failing polar test
+
+diff --git a/test/test_xsimd_api.cpp b/test/test_xsimd_api.cpp
+index 1b29742..03c6b4b 100644
+--- a/test/test_xsimd_api.cpp
++++ b/test/test_xsimd_api.cpp
+@@ -652,12 +652,6 @@ struct xsimd_api_float_types_functions
+         value_type val1(4);
+         CHECK_EQ(extract(xsimd::nextafter(T(val0), T(val1))), std::nextafter(val0, val1));
+     }
+-    void test_polar()
+-    {
+-        value_type val0(3);
+-        value_type val1(4);
+-        CHECK_EQ(extract(xsimd::polar(T(val0), T(val1))), std::polar(val0, val1));
+-    }
+     void test_pow()
+     {
+         value_type val0(2);
+@@ -912,11 +906,6 @@ TEST_CASE_TEMPLATE("[xsimd api | float types functions]", B, FLOAT_TYPES)
+         Test.test_nextafter();
+     }
+ 
+-    SUBCASE("polar")
+-    {
+-        Test.test_polar();
+-    }
+-
+     SUBCASE("pow")
+     {
+         Test.test_pow();
diff --git a/pkgs/development/libraries/xsimd/disable-test_error_gamma-test.patch b/pkgs/development/libraries/xsimd/disable-test_error_gamma-test.patch
new file mode 100644
index 000000000000..a7344d231b8d
--- /dev/null
+++ b/pkgs/development/libraries/xsimd/disable-test_error_gamma-test.patch
@@ -0,0 +1,36 @@
+commit 3f751cef6b27ec13418a92c5b5f36b22bb5ffd55
+Author: Doron Behar <doron.behar@gmail.com>
+Date:   Tue Aug 1 13:24:34 2023 +0300
+
+    Darwin: Disable failing test from test_error_gamma.cpp
+
+diff --git a/test/test_error_gamma.cpp b/test/test_error_gamma.cpp
+index 214cbb5..299e5b8 100644
+--- a/test/test_error_gamma.cpp
++++ b/test/test_error_gamma.cpp
+@@ -131,25 +131,6 @@ struct error_gamma_test
+             INFO("lgamma");
+             CHECK_EQ(diff, 0);
+         }
+-#if !(XSIMD_WITH_AVX && !XSIMD_WITH_AVX2)
+-
+-        // tgamma (negative input)
+-        {
+-            std::transform(gamma_neg_input.cbegin(), gamma_neg_input.cend(), expected.begin(),
+-                           [](const value_type& v)
+-                           { return std::lgamma(v); });
+-            batch_type in, out;
+-            for (size_t i = 0; i < nb_input; i += size)
+-            {
+-                detail::load_batch(in, gamma_neg_input, i);
+-                out = lgamma(in);
+-                detail::store_batch(out, res, i);
+-            }
+-            size_t diff = detail::get_nb_diff(res, expected);
+-            INFO("lgamma (negative input)");
+-            CHECK_EQ(diff, 0);
+-        }
+-#endif
+     }
+ };
+ 
diff --git a/pkgs/development/libraries/xsimd/fix-atan-test.patch b/pkgs/development/libraries/xsimd/fix-atan-test.patch
new file mode 100644
index 000000000000..3d1517610aae
--- /dev/null
+++ b/pkgs/development/libraries/xsimd/fix-atan-test.patch
@@ -0,0 +1,19 @@
+commit f60dad2c1d8ad47fbff761ce1cb027fc7c3a40e8
+Author: Doron Behar <doron.behar@gmail.com>
+Date:   Tue Aug 1 13:47:37 2023 +0300
+
+    Musl: Fix atan test from test_complex_trigonometric.cpp
+
+diff --git a/test/test_complex_trigonometric.cpp b/test/test_complex_trigonometric.cpp
+index a486110..691db77 100644
+--- a/test/test_complex_trigonometric.cpp
++++ b/test/test_complex_trigonometric.cpp
+@@ -155,7 +155,7 @@ struct complex_trigonometric_test
+             out = atan(in);
+             detail::store_batch(out, res, i);
+         }
+-        size_t diff = detail::get_nb_diff(res, expected);
++        size_t diff = detail::get_nb_diff_near(res, expected, 1e-12);
+         CHECK_EQ(diff, 0);
+     }
+ 
diff --git a/pkgs/development/libraries/xsimd/fix-darwin-exp10-implementation.patch b/pkgs/development/libraries/xsimd/fix-darwin-exp10-implementation.patch
new file mode 100644
index 000000000000..caa7db0bcc13
--- /dev/null
+++ b/pkgs/development/libraries/xsimd/fix-darwin-exp10-implementation.patch
@@ -0,0 +1,22 @@
+diff --git i/include/xsimd/arch/xsimd_scalar.hpp w/include/xsimd/arch/xsimd_scalar.hpp
+index 9066da6..7aa3b6b 100644
+--- i/include/xsimd/arch/xsimd_scalar.hpp
++++ w/include/xsimd/arch/xsimd_scalar.hpp
+@@ -502,16 +502,7 @@ namespace xsimd
+         return !(x0 == x1);
+     }
+ 
+-#if defined(__APPLE__)
+-    inline float exp10(const float& x) noexcept
+-    {
+-        return __exp10f(x);
+-    }
+-    inline double exp10(const double& x) noexcept
+-    {
+-        return __exp10(x);
+-    }
+-#elif defined(__GLIBC__)
++#if defined(__GLIBC__)
+     inline float exp10(const float& x) noexcept
+     {
+         return ::exp10f(x);
diff --git a/pkgs/development/libraries/xxHash/default.nix b/pkgs/development/libraries/xxHash/default.nix
index d5a8df6f437e..f7631de1bf29 100644
--- a/pkgs/development/libraries/xxHash/default.nix
+++ b/pkgs/development/libraries/xxHash/default.nix
@@ -2,39 +2,19 @@
 , stdenv
 , fetchFromGitHub
 , cmake
-, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
   pname = "xxHash";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "Cyan4973";
     repo = "xxHash";
     rev = "v${version}";
-    sha256 = "sha256-2WoYCO6QRHWrbGP2mK04/sLNTyQLOuL3urVktilAwMA=";
+    hash = "sha256-kofPs01jb189LUjYHHt+KxDifZQWl0Hm779711mvWtI=";
   };
 
-  # CMake build fixes
-  patches = [
-    # Merged in https://github.com/Cyan4973/xxHash/pull/649
-    # Should be present in next release
-    (fetchpatch {
-      name = "cmake-install-fix";
-      url = "https://github.com/Cyan4973/xxHash/commit/636f966ecc713c84ddd3b7ccfde2bfb2cc7492a0.patch";
-      sha256 = "sha256-B1PZ/0BXlOrSiPvgCPLvI/sjQvnR0n5PQHOO38LOij0=";
-    })
-
-    # Submitted at https://github.com/Cyan4973/xxHash/pull/723
-    (fetchpatch {
-      name = "cmake-pkgconfig-fix";
-      url = "https://github.com/Cyan4973/xxHash/commit/5db353bbd05ee5eb1f90afc08d10da9416154e55.patch";
-      sha256 = "sha256-dElgSu9DVo2hY6TTVHLTtt0zkXmQV3nc9i/KbrDkK8s=";
-    })
-  ];
-
-
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/development/perl-modules/Data-Clone-fix-apostrophe-package-separator.patch b/pkgs/development/perl-modules/Data-Clone-fix-apostrophe-package-separator.patch
new file mode 100644
index 000000000000..4d2bef16c9c4
--- /dev/null
+++ b/pkgs/development/perl-modules/Data-Clone-fix-apostrophe-package-separator.patch
@@ -0,0 +1,26 @@
+https://github.com/gfx/p5-Data-Clone/pull/3
+
+From 43102a83d15aedc61e5904eb5a6dab33c3c02b40 Mon Sep 17 00:00:00 2001
+From: Yves Orton <demerphq@gmail.com>
+Date: Thu, 9 Feb 2023 16:24:45 +0100
+Subject: [PATCH] t/07_stack.t - isn't is deprecated, use isnt instead
+
+As of 5.37.8 use of apostrophe for a package separator is deprecated,
+and in 5.40 it will be removed entirely. Switch to isnt() instead
+of isn't().
+---
+ t/07_stack.t | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/t/07_stack.t b/t/07_stack.t
+index 165e6a5..a750366 100644
+--- a/t/07_stack.t
++++ b/t/07_stack.t
+@@ -17,6 +17,6 @@ use Data::Clone;
+ 
+ my $before = bless [], Bar::;
+ my $after  = clone($before);
+-isn't $after, $before, 'stack reallocation during callback';
++isnt $after, $before, 'stack reallocation during callback';
+ 
+ done_testing;
\ No newline at end of file
diff --git a/pkgs/development/perl-modules/Exception-Base-remove-smartmatch-when-5.38.0.patch b/pkgs/development/perl-modules/Exception-Base-remove-smartmatch-when-5.38.0.patch
new file mode 100644
index 000000000000..00fd4b7e0c69
--- /dev/null
+++ b/pkgs/development/perl-modules/Exception-Base-remove-smartmatch-when-5.38.0.patch
@@ -0,0 +1,20 @@
+smartmatch deprecated in perl-5.37.10
+
+Patch by @pghmcfc from
+https://github.com/dex4er/perl-Exception-Base/issues/5#issuecomment-1637075218
+
+diff --git a/t/tlib/Exception/BaseTest.pm b/t/tlib/Exception/BaseTest.pm
+index d590d12..e531ed7 100644
+--- a/t/tlib/Exception/BaseTest.pm
++++ b/t/tlib/Exception/BaseTest.pm
+@@ -569,8 +569,9 @@ sub test_overload {
+     $self->assert_matches(qr/String at /, $obj);
+ 
+     # smart matching for Perl 5.10
+-    if ($] >= 5.010) {
++    # Deprecation warning added in 5.37.10
++    if ($] >= 5.010 && $] < 5.037010) {
+         no if $] >= 5.018, warnings => 'experimental::smartmatch';
+         eval q{
+             $self->assert_num_equals(1, 'String' ~~ $obj);
+
diff --git a/pkgs/development/perl-modules/ExtUtils-Constant-fix-indirect-method-call-in-test.patch b/pkgs/development/perl-modules/ExtUtils-Constant-fix-indirect-method-call-in-test.patch
new file mode 100644
index 000000000000..dbca37a75f76
--- /dev/null
+++ b/pkgs/development/perl-modules/ExtUtils-Constant-fix-indirect-method-call-in-test.patch
@@ -0,0 +1,31 @@
+https://rt.cpan.org/Public/Bug/Display.html?id=132995
+
+From 94b5fc74c3d7ed835e83bac40632962af32f5b30 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Dagfinn=20Ilmari=20Manns=C3=A5ker?= <ilmari@ilmari.org>
+Date: Mon, 13 Jul 2020 22:08:45 +0100
+Subject: [PATCH] Fix indirect method call in ExtUtils::Constant test
+
+It puts both "use $];" and "bootstrap $package \$VERSION;" in the
+generated test module, which is going to break if we ever remove
+`indirect` from the current feature bundle.
+
+Fix by making the method call direct instead.
+---
+ t/Constant.t | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/t/Constant.t b/t/Constant.t
+index d6b45668da..526a32c779 100644
+--- a/t/Constant.t
++++ b/t/Constant.t
+@@ -435,7 +435,7 @@ EOT
+   print FH ");\n";
+   # Print the AUTOLOAD subroutine ExtUtils::Constant generated for us
+   print FH autoload ($package, $]);
+-  print FH "bootstrap $package \$VERSION;\n1;\n__END__\n";
++  print FH "$package->bootstrap(\$VERSION);\n1;\n__END__\n";
+   close FH or die "close $pm: $!\n";
+ 
+   ################ test.pl
+-- 
+2.26.2
\ No newline at end of file
diff --git a/pkgs/development/python-modules/a2wsgi/default.nix b/pkgs/development/python-modules/a2wsgi/default.nix
new file mode 100644
index 000000000000..9a81321898cc
--- /dev/null
+++ b/pkgs/development/python-modules/a2wsgi/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, asgiref
+, httpx
+, pdm-backend
+, pdm-pep517
+, pytest-asyncio
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "a2wsgi";
+  version = "1.7.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-qQb2LAJQ6wIBEguTQX3QsSsQW12zWvQxv+hu8NxburI=";
+  };
+
+  nativeBuildInputs = [
+    pdm-backend
+    pdm-pep517
+  ];
+
+  nativeCheckInputs = [
+    asgiref
+    httpx
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Convert WSGI app to ASGI app or ASGI app to WSGI app";
+    homepage = "https://github.com/abersheeran/a2wsgi";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 92f1fbd53828..bfe6bc06199b 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -32,25 +32,20 @@
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.8.4";
+  version = "3.8.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vy4akWLB5EG/gFof0WbiSdV0ygTgOzT5fikodp6Rq1w=";
+    hash = "sha256-uVUuxSzBR9vxlErHrJivdgLlHqLc0HbtGUyjwNHH0Lw=";
   };
 
   patches = [
-    (fetchpatch {
-      # https://github.com/aio-libs/aiohttp/pull/7178
-      url = "https://github.com/aio-libs/aiohttp/commit/5718879cdb6a98bf48810a994b78bc02abaf3e07.patch";
-      hash = "sha256-4UynkTZOzWzusQ2+MPZszhFA8I/PJNLeT/hHF/fASy8=";
-    })
     (fetchpatch {
       # https://github.com/aio-libs/aiohttp/pull/7260
-      # Merged upstream, should likely be dropped post-3.8.4
+      # Merged upstream, should likely be dropped post-3.8.5
       url = "https://github.com/aio-libs/aiohttp/commit/7dcc235cafe0c4521bbbf92f76aecc82fee33e8b.patch";
       hash = "sha256-ZzhlE50bmA+e2XX2RH1FuWQHZIAa6Dk/hZjxPoX5t4g=";
     })
@@ -58,9 +53,6 @@ buildPythonPackage rec {
 
   postPatch = ''
     sed -i '/--cov/d' setup.cfg
-
-    substituteInPlace setup.cfg \
-      --replace "charset-normalizer >=2.0, < 3.0" "charset-normalizer >=2.0, < 4.0"
   '';
 
   nativeBuildInputs = [
@@ -109,6 +101,10 @@ buildPythonPackage rec {
     "test_async_with_session"
     "test_session_close_awaitable"
     "test_close_run_until_complete_not_deprecated"
+    # https://github.com/aio-libs/aiohttp/issues/7130
+    "test_static_file_if_none_match"
+    "test_static_file_if_match"
+    "test_static_file_if_modified_since_past_date"
   ] ++ lib.optionals stdenv.is32bit [
     "test_cookiejar"
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/aioimaplib/default.nix b/pkgs/development/python-modules/aioimaplib/default.nix
index b577abf37c8d..84020ba7ac54 100644
--- a/pkgs/development/python-modules/aioimaplib/default.nix
+++ b/pkgs/development/python-modules/aioimaplib/default.nix
@@ -28,6 +28,9 @@ buildPythonPackage rec {
     hash = "sha256-7Ta0BhtQSm228vvUa5z+pzM3UC7+BskgBNjxsbEb9P0=";
   };
 
+  # https://github.com/bamthomas/aioimaplib/issues/54
+  doCheck = pythonOlder "3.11";
+
   nativeCheckInputs = [
     asynctest
     docutils
diff --git a/pkgs/development/python-modules/astroid/default.nix b/pkgs/development/python-modules/astroid/default.nix
index fa78f2f5faaa..5e5f9e22fb40 100644
--- a/pkgs/development/python-modules/astroid/default.nix
+++ b/pkgs/development/python-modules/astroid/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "astroid";
-  version = "2.14.2"; # Check whether the version is compatible with pylint
+  version = "2.15.6"; # Check whether the version is compatible with pylint
   format = "pyproject";
 
   disabled = pythonOlder "3.7.2";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-SIBzn57UNn/sLuDWt391M/kcCyjCocHmL5qi2cSX2iA=";
+    hash = "sha256-0oNNEVD8rYGkM11nGUD+XMwE7xgk7mJIaplrAXaECFg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/atomman/default.nix b/pkgs/development/python-modules/atomman/default.nix
index 7b32dc9b9ec6..a245c93e3618 100644
--- a/pkgs/development/python-modules/atomman/default.nix
+++ b/pkgs/development/python-modules/atomman/default.nix
@@ -11,20 +11,19 @@
 , phonopy
 , potentials
 , pymatgen
-, pytest
 , pytestCheckHook
 , pythonOlder
-, pythonAtLeast
 , requests
 , scipy
 , setuptools
 , toolz
+, wheel
 , xmltodict
 , pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
-  version = "1.4.6";
+  version = "unstable-2023-07-28";
   pname = "atomman";
   format = "pyproject";
 
@@ -33,12 +32,13 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "usnistgov";
     repo = "atomman";
-    rev = "v${version}";
-    hash = "sha256-tcsxtFbBdMC6+ixzqhnR+5UNwcQmnPQSvuyNA2IYelI=";
+    rev = "b8af21a9285959d38ee26173081db1b4488401bc";
+    hash = "sha256-WfB+OY61IPprT6OCVHl8VA60p7lLVkRGuyYX+nm7bbA=";
   };
 
   nativeBuildInputs = [
     setuptools
+    wheel
     pythonRelaxDepsHook
   ];
 
@@ -70,7 +70,6 @@ buildPythonPackage rec {
     ase
     phonopy
     pymatgen
-    pytest
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/av/default.nix b/pkgs/development/python-modules/av/default.nix
index 91b50e798c5b..64f12ed24a1a 100644
--- a/pkgs/development/python-modules/av/default.nix
+++ b/pkgs/development/python-modules/av/default.nix
@@ -9,7 +9,7 @@
 , setuptools
 
 # runtime
-, ffmpeg
+, ffmpeg-headless
 
 # tests
 , numpy
@@ -38,7 +38,7 @@ buildPythonPackage rec {
   ];
 
   buildInputs = [
-    ffmpeg
+    ffmpeg-headless
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/blockdiag/default.nix b/pkgs/development/python-modules/blockdiag/default.nix
index ce100622b585..b2d341b67c1e 100644
--- a/pkgs/development/python-modules/blockdiag/default.nix
+++ b/pkgs/development/python-modules/blockdiag/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , docutils
 , fetchFromGitHub
+, fetchpatch
 , funcparserlib
 , nose
 , pillow
@@ -28,6 +29,15 @@ buildPythonPackage rec {
     hash = "sha256-j8FoNUIJJOaahaol1MRPyY2jcPCEIlaAD4bmM2QKFFI=";
   };
 
+  patches = [
+    # https://github.com/blockdiag/blockdiag/pull/179
+    (fetchpatch {
+      name = "pillow-10-compatibility.patch";
+      url = "https://github.com/blockdiag/blockdiag/commit/20d780cad84e7b010066cb55f848477957870165.patch";
+      hash = "sha256-t1zWFzAsLL2EUa0nD4Eui4Y5AhAZLRmp/yC9QpzzeUA=";
+    })
+  ];
+
   propagatedBuildInputs = [
     setuptools
     funcparserlib
diff --git a/pkgs/development/python-modules/bootstrapped-pip/default.nix b/pkgs/development/python-modules/bootstrapped-pip/default.nix
index a83cfc02849d..2c24fe51debf 100644
--- a/pkgs/development/python-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python-modules/bootstrapped-pip/default.nix
@@ -38,9 +38,10 @@ stdenv.mkDerivation rec {
     mv pip* pip
     mv setuptools* setuptools
     mv wheel* wheel
-    # Set up PYTHONPATH. The above folders need to be on PYTHONPATH
-    # $out is where we are installing to and takes precedence
-    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel:$PYTHONPATH"
+    # Set up PYTHONPATH:
+    # - pip and setuptools need to be in PYTHONPATH to install setuptools, wheel, and pip.
+    # - $out is where we are installing to and takes precedence, and is where wheel will end so we can install pip.
+    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$PYTHONPATH"
 
     echo "Building setuptools wheel..."
     pushd setuptools
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 09f0938782a5..e6ac07612c40 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -10,25 +10,26 @@
 
 buildPythonPackage rec {
   pname = "boto3";
-  version = "1.26.79"; # N.B: if you change this, change botocore and awscli to a matching version
+  version = "1.28.9"; # N.B: if you change this, change botocore and awscli to a matching version
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "boto";
     repo = pname;
     rev = version;
-    hash = "sha256-9Xsng4xZ+IGNZ3ViYVrOyKZdRH6QPSjZALj9Q3HECBU=";
+    hash = "sha256-NkNHA20yn1Q7uoq/EL1Wn8F1fpi1waQujutGIKsnxlI=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     botocore
     jmespath
     s3transfer
-    setuptools
   ];
 
-  doCheck = true;
-
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index f6d62659cdda..1693f2258bcc 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -3,7 +3,6 @@
 , fetchPypi
 , python-dateutil
 , jmespath
-, docutils
 , urllib3
 , pytestCheckHook
 , jsonschema
@@ -11,17 +10,17 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.29.79"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.31.9"; # N.B: if you change this, change boto3 and awscli to a matching version
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-x97UQGK+07kolEz7CeFXjtP+0OTJjeTyM/PCBWqNSR4=";
+    hash = "sha256-vYSdOslfF4E4Xtgx11OgSj7IcKWdZZgXWq7dcdwrr18=";
   };
 
   propagatedBuildInputs = [
     python-dateutil
     jmespath
-    docutils
     urllib3
   ];
 
@@ -30,8 +29,6 @@ buildPythonPackage rec {
     jsonschema
   ];
 
-  doCheck = true;
-
   disabledTestPaths = [
     # Integration tests require networking
     "tests/integration"
diff --git a/pkgs/development/python-modules/cairocffi/default.nix b/pkgs/development/python-modules/cairocffi/default.nix
index 1eaed132fc6d..ff79eacf99b8 100644
--- a/pkgs/development/python-modules/cairocffi/default.nix
+++ b/pkgs/development/python-modules/cairocffi/default.nix
@@ -8,27 +8,28 @@
 , makeFontsConf
 , freefont_ttf
 , pikepdf
-, pytest
-, glibcLocales
+, pytestCheckHook
 , cairo
 , cffi
 , numpy
 , withXcffib ? false
 , xcffib
-, python
 , glib
 , gdk-pixbuf
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "cairocffi";
-  version = "1.4.0";
+  version = "1.5.1";
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
+
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UJM5syzNjXsAwiBMMnNs3njbU6MuahYtMSR40lYmzZo=";
+    hash = "sha256-Bxq3ty41MzALC/1VpSBWtP/cHtbmVneeKs7Ztwm4opU=";
   };
 
   patches = [
@@ -43,36 +44,23 @@ buildPythonPackage rec {
     ./fix_test_scaled_font.patch
   ];
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "pytest-runner" "" \
-      --replace "pytest-cov" "" \
-      --replace "pytest-flake8" "" \
-      --replace "pytest-isort" "" \
-      --replace "--flake8 --isort" ""
-  '';
-
-  LC_ALL = "en_US.UTF-8";
-
-  # checkPhase require at least one 'normal' font and one 'monospace',
-  # otherwise glyph tests fails
-  FONTCONFIG_FILE = makeFontsConf {
-    fontDirectories = [ freefont_ttf ];
-  };
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedNativeBuildInputs = [ cffi ];
 
   propagatedBuildInputs = [ cairo cffi ]
     ++ lib.optional withXcffib xcffib;
 
-  # pytestCheckHook does not work
-  nativeCheckInputs = [ numpy pikepdf pytest glibcLocales ];
-
-  checkPhase = ''
-    py.test $out/${python.sitePackages}
-  '';
+  nativeCheckInputs = [
+    numpy
+    pikepdf
+    pytestCheckHook
+  ];
 
   meta = with lib; {
+    changelog = "https://github.com/Kozea/cairocffi/blob/v${version}/NEWS.rst";
     homepage = "https://github.com/SimonSapin/cairocffi";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/calver/default.nix b/pkgs/development/python-modules/calver/default.nix
index 398e07b39df8..4b400f218739 100644
--- a/pkgs/development/python-modules/calver/default.nix
+++ b/pkgs/development/python-modules/calver/default.nix
@@ -6,37 +6,43 @@
 , pytestCheckHook
 }:
 
-buildPythonPackage rec {
-  pname = "calver";
-  version = "2022.06.26";
+let
+  self = buildPythonPackage rec {
+    pname = "calver";
+    version = "2022.06.26";
+    format = "setuptools";
 
-  disabled = pythonOlder "3.5";
+    disabled = pythonOlder "3.5";
 
-  format = "setuptools";
+    src = fetchFromGitHub {
+      owner = "di";
+      repo = "calver";
+      rev = version;
+      hash = "sha256-YaXTkeUazwzghCX96Wfx39hGvukWKtHMLLeyF9OeiZI=";
+    };
 
-  src = fetchFromGitHub {
-    owner = "di";
-    repo = "calver";
-    rev = version;
-    hash = "sha256-YaXTkeUazwzghCX96Wfx39hGvukWKtHMLLeyF9OeiZI=";
+    postPatch = ''
+      substituteInPlace setup.py \
+        --replace "version=calver_version(True)" 'version="${version}"'
+    '';
+
+    doCheck = false; # avoid infinite recursion with hatchling
+
+    nativeCheckInputs = [
+      pretend
+      pytestCheckHook
+    ];
+
+    pythonImportsCheck = [ "calver" ];
+
+    passthru.tests.calver = self.overridePythonAttrs { doCheck = true; };
+
+    meta = {
+      description = "Setuptools extension for CalVer package versions";
+      homepage = "https://github.com/di/calver";
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [ dotlambda ];
+    };
   };
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "version=calver_version(True)" 'version="${version}"'
-  '';
-
-  nativeCheckInputs = [
-    pretend
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [ "calver" ];
-
-  meta = {
-    description = "Setuptools extension for CalVer package versions";
-    homepage = "https://github.com/di/calver";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ dotlambda ];
-  };
-}
+in
+  self
diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index 836c270a4c03..1864b58d92d3 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "celery";
-  version = "5.3.0";
+  version = "5.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Hqul7hTYyMC+2PYGPl4Q2r288jUDqGHPDhC3Ih2Zyw0=";
+    hash = "sha256-+E0cIaFSDBFsK30mWTkmWBGRQ1oDqnS3fJQbk8ocYhA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix b/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
index 766857a66a85..63304bc82114 100644
--- a/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
+++ b/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
@@ -17,7 +17,7 @@
 
 let
   pname = "chacha20poly1305-reuseable";
-  version = "0.2.5";
+  version = "0.3.0";
 in
 
 buildPythonPackage {
@@ -30,7 +30,7 @@ buildPythonPackage {
     owner = "bdraco";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-T5mmHUMNbdvexeSaIDZIm/3yQcDKnWdor9IK63FE0no=";
+    hash = "sha256-/bXpwSBFr1IM04GNEczzsnsjdFV4miUAzJkvrQjfIq4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cherrypy/default.nix b/pkgs/development/python-modules/cherrypy/default.nix
index 48b040565f79..8a61e6606611 100644
--- a/pkgs/development/python-modules/cherrypy/default.nix
+++ b/pkgs/development/python-modules/cherrypy/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   version = "18.8.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7" || pythonAtLeast "3.11";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "CherryPy";
@@ -86,6 +86,20 @@ buildPythonPackage rec {
     "test_basic_request"
     "test_3_Redirect"
     "test_4_File_deletion"
+  ] ++ lib.optionals (pythonAtLeast "3.11") [
+    "testErrorHandling"
+    "testHookErrors"
+    "test_HTTP10_KeepAlive"
+    "test_No_Message_Body"
+    "test_HTTP11_Timeout"
+    "testGzip"
+    "test_malformed_header"
+    "test_no_content_length"
+    "test_post_filename_with_special_characters"
+    "test_post_multipart"
+    "test_iterator"
+    "test_1_Ram_Concurrency"
+    "test_2_File_Concurrency"
   ] ++ lib.optionals stdenv.isDarwin [
     "test_block"
   ];
diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index 6844cfb649a0..6d748af8b5a2 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "click";
-  version = "8.1.3";
+  version = "8.1.6";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-doLcivswKXABZ0V16gDRgU2AjWo2r0Fagr1IHTe6e44=";
+    hash = "sha256-SO6EmVGRlSegRb/jv3uqipWcQjE04aW5jAXCC6daHL0=";
   };
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
diff --git a/pkgs/development/python-modules/constantly/default.nix b/pkgs/development/python-modules/constantly/default.nix
index b88163506476..92183fc1622c 100644
--- a/pkgs/development/python-modules/constantly/default.nix
+++ b/pkgs/development/python-modules/constantly/default.nix
@@ -23,7 +23,7 @@ let
 
     pythonImportsCheck = [ "constantly" ];
 
-    passthru.tests.constantly = self.overrideAttrs (_: { doInstallCheck = true; });
+    passthru.tests.constantly = self.overridePythonAttrs { doCheck = true; };
 
     meta = with lib; {
       homepage = "https://github.com/twisted/constantly";
diff --git a/pkgs/development/python-modules/crownstone-cloud/default.nix b/pkgs/development/python-modules/crownstone-cloud/default.nix
index 86b77b994ea7..d8ee18a090d4 100644
--- a/pkgs/development/python-modules/crownstone-cloud/default.nix
+++ b/pkgs/development/python-modules/crownstone-cloud/default.nix
@@ -1,6 +1,5 @@
 { lib
 , aiohttp
-, asynctest
 , buildPythonPackage
 , fetchFromGitHub
 , fetchpatch
@@ -34,7 +33,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
-    asynctest
     certifi
   ];
 
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 2ebcb9efffe2..076e045d7272 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -3,25 +3,25 @@
 , callPackage
 , buildPythonPackage
 , fetchPypi
-, rustPlatform
 , cargo
-, rustc
-, setuptools-rust
-, openssl
-, Security
-, isPyPy
 , cffi
+, hypothesis
+, iso8601
+, isPyPy
+, libiconv
+, libxcrypt
+, openssl
 , pkg-config
+, pretend
+, py
 , pytestCheckHook
 , pytest-subtests
 , pythonOlder
-, pretend
-, libiconv
-, libxcrypt
-, iso8601
-, py
 , pytz
-, hypothesis
+, rustc
+, rustPlatform
+, Security
+, setuptoolsRustBuildHook
 }:
 
 let
@@ -29,20 +29,20 @@ let
 in
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "40.0.1"; # Also update the hash in vectors.nix
-  format = "setuptools";
-  disabled = pythonOlder "3.6";
+  version = "41.0.2"; # Also update the hash in vectors.nix
+  format = "pyproject";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KAPy+LHpX2FEGZJsfm9V2CivxhTKXtYVQ4d65mjMNHI=";
+    hash = "sha256-fSML+FYWTeFk7LYVzMFMf8beaQbd1bSR86+Q01FMklw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-gFfDTc2QWBWHBCycVH1dYlCsWQMVcRZfOBIau+njtDU=";
+    hash = "sha256-hkuoICa/suMXlr4u95JbMlFzi27lJqJRmWnX3nZfzKU=";
   };
 
   postPatch = ''
@@ -54,7 +54,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
-    setuptools-rust
+    setuptoolsRustBuildHook
     cargo
     rustc
     pkg-config
@@ -100,8 +100,6 @@ buildPythonPackage rec {
       Cryptography includes both high level recipes and low level interfaces to
       common cryptographic algorithms such as symmetric ciphers, message
       digests, and key derivation functions.
-      Our goal is for it to be your "cryptographic standard library". It
-      supports Python 2.7, Python 3.5+, and PyPy 5.4+.
     '';
     homepage = "https://github.com/pyca/cryptography";
     changelog = "https://cryptography.io/en/latest/changelog/#v"
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 71bd22bf738f..554873de89e1 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -1,17 +1,19 @@
-{ buildPythonPackage, fetchPypi, lib, cryptography }:
+{ buildPythonPackage, fetchPypi, lib, cryptography, setuptools }:
 
 buildPythonPackage rec {
   pname = "cryptography-vectors";
   # The test vectors must have the same version as the cryptography package
   inherit (cryptography) version;
-  format = "setuptools";
+  format = "pyproject";
 
   src = fetchPypi {
     pname = "cryptography_vectors";
     inherit version;
-    hash = "sha256-hGBwa1tdDOSoVXHKM4nPiPcAu2oMYTPcn+D1ovW9oEE=";
+    hash = "sha256-Ao3/lKhSLKgYsRKV/xLfVfNI8zoZPAWX3f6COeU9FYI=";
   };
 
+  nativeBuildInputs = [ setuptools ];
+
   # No tests included
   doCheck = false;
 
@@ -20,7 +22,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Test vectors for the cryptography package";
     homepage = "https://cryptography.io/en/latest/development/test-vectors/";
-    # Source: https://github.com/pyca/cryptography/tree/master/vectors;
+    downloadPage = "https://github.com/pyca/cryptography/tree/master/vectors";
     license = with licenses; [ asl20 bsd3 ];
     maintainers = with maintainers; [ SuperSandro2000 ];
   };
diff --git a/pkgs/development/python-modules/cvxpy/default.nix b/pkgs/development/python-modules/cvxpy/default.nix
index 393418555305..5820914737ca 100644
--- a/pkgs/development/python-modules/cvxpy/default.nix
+++ b/pkgs/development/python-modules/cvxpy/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "cvxpy";
-  version = "1.3.1";
+  version = "1.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8Hv+k2d6dVqFVMT9piLvAeIkes6Zs6eBB6qQcODQo8s=";
+    hash = "sha256-C2heUEDxmfPXA/MPXSLR+GVZdiNFUVPR3ddwJFrvCXU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dashing/default.nix b/pkgs/development/python-modules/dashing/default.nix
index d49fd667cdbe..9caa56a87649 100644
--- a/pkgs/development/python-modules/dashing/default.nix
+++ b/pkgs/development/python-modules/dashing/default.nix
@@ -1,21 +1,23 @@
 { lib
-, python3
+, buildPythonPackage
 , fetchPypi
+, pythonOlder
+, blessed
 }:
 
-python3.pkgs.buildPythonPackage rec {
+buildPythonPackage rec {
   pname = "dashing";
   version = "0.1.0";
   format = "setuptools";
 
-  disabled = python3.pythonOlder "3.7";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-JRRgjg8pp3Xb0bERFWEhnOg9U8+kuqL+QQH6uE/Vbxs=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = [
     blessed
   ];
 
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index b0e10f29a6ed..aaa5a5ae6b6d 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -1,46 +1,53 @@
 { lib
 , stdenv
-, arrow-cpp
-, bokeh
 , buildPythonPackage
+, fetchFromGitHub
+
+# build-syste
+, setuptools
+, versioneer
+
+# dependencies
 , click
 , cloudpickle
-, distributed
-, fastparquet
-, fetchFromGitHub
-, fetchpatch
 , fsspec
 , importlib-metadata
-, jinja2
-, numpy
 , packaging
-, pandas
 , partd
+, pyyaml
+, toolz
+
+# optional-dependencies
+, numpy
 , pyarrow
+, lz4
+, pandas
+, distributed
+, bokeh
+, jinja2
+
+# tests
+, arrow-cpp
+, hypothesis
+, pytest-asyncio
 , pytest-rerunfailures
 , pytest-xdist
 , pytestCheckHook
 , pythonOlder
-, pyyaml
-, scipy
-, setuptools
-, toolz
-, versioneer
-, zarr
 }:
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2023.4.1";
-  format = "setuptools";
+  version = "2023.7.1";
+  format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "dask";
-    repo = pname;
+    repo = "dask";
     rev = "refs/tags/${version}";
-    hash = "sha256-PkEFXF6OFZU+EMFBUopv84WniQghr5Q6757Qx6D5MyE=";
+    hash = "sha256-1KnvIMEWT1MwlvkdgH10xk+lGSsGWJMLBonTtWwKjog=";
   };
 
   nativeBuildInputs = [
@@ -59,13 +66,18 @@ buildPythonPackage rec {
     toolz
   ];
 
-  passthru.optional-dependencies = {
+  passthru.optional-dependencies = lib.fix (self: {
     array = [
       numpy
     ];
     complete = [
-      distributed
-    ];
+      pyarrow
+      lz4
+    ]
+    ++ self.array
+    ++ self.dataframe
+    ++ self.distributed
+    ++ self.diagnostics;
     dataframe = [
       numpy
       pandas
@@ -77,16 +89,16 @@ buildPythonPackage rec {
       bokeh
       jinja2
     ];
-  };
+  });
 
   nativeCheckInputs = [
     pytestCheckHook
     pytest-rerunfailures
     pytest-xdist
-    scipy
-    zarr
+    # from panda[test]
+    hypothesis
+    pytest-asyncio
   ] ++ lib.optionals (!arrow-cpp.meta.broken) [ # support is sparse on aarch64
-    fastparquet
     pyarrow
   ];
 
@@ -103,7 +115,7 @@ buildPythonPackage rec {
     substituteInPlace pyproject.toml \
       --replace " --durations=10" "" \
       --replace " --cov-config=pyproject.toml" "" \
-      --replace " -v" ""
+      --replace "\"-v" "\" "
   '';
 
   pytestFlagsArray = [
@@ -120,12 +132,10 @@ buildPythonPackage rec {
     # AttributeError: 'str' object has no attribute 'decode'
     "test_read_dir_nometa"
   ] ++ [
-    "test_chunksize_files"
-    # TypeError: 'ArrowStringArray' with dtype string does not support reduction 'min'
-    "test_set_index_string"
-    # numpy 1.24
-    # RuntimeWarning: invalid value encountered in cast
-    "test_setitem_extended_API_2d_mask"
+    # AttributeError: 'ArrowStringArray' object has no attribute 'tobytes'. Did you mean: 'nbytes'?
+    "test_dot"
+    "test_dot_nan"
+    "test_merge_column_with_nulls"
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/devtools/default.nix b/pkgs/development/python-modules/devtools/default.nix
index 79f8d3d5cbb9..ec386f8e0b29 100644
--- a/pkgs/development/python-modules/devtools/default.nix
+++ b/pkgs/development/python-modules/devtools/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "devtools";
-  version = "0.10.0";
+  version = "0.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "samuelcolvin";
     repo = "python-${pname}";
-    rev = "v${version}";
-    hash = "sha256-x9dL/FE94OixMAmjnmfzZUcYJBqE5P2AAIFsNJF0Fxo=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ogogXZnuSFkWktCin+cyefjqIbGFRBVIeOrZJAa3hOE=";
   };
 
   nativeBuildInputs = [
@@ -47,10 +47,15 @@ buildPythonPackage rec {
   disabledTests = [
     # Test for Windows32
     "test_print_subprocess"
-    # sensitive to timing
+    # Sensitive to timing
     "test_multiple_not_verbose"
-    # sensitive to interpreter output
-    "test_simple_vars"
+    # Sensitive to interpreter output
+    "test_simple"
+  ];
+
+  disabledTestPaths = [
+    # pytester_pretty is not available in Nixpkgs
+    "tests/test_insert_assert.py"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/dj-rest-auth/default.nix b/pkgs/development/python-modules/dj-rest-auth/default.nix
index 2abee722b97e..a2219ae22cc5 100644
--- a/pkgs/development/python-modules/dj-rest-auth/default.nix
+++ b/pkgs/development/python-modules/dj-rest-auth/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "dj-rest-auth";
-  version = "3.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "iMerica";
     repo = "dj-rest-auth";
     rev = "refs/tags/${version}";
-    hash = "sha256-wkbFUrvKhdp2Hd4QkXAvhMiaqSXFD/fgIw03nLPaO5I=";
+    hash = "sha256-+ladx0b/bvvUW8zLjtG8IiWWdfPTqqm/KYbEK9uiFaU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-bootstrap3/default.nix b/pkgs/development/python-modules/django-bootstrap3/default.nix
index 950cf9ef812c..ccb1ffd3c1a7 100644
--- a/pkgs/development/python-modules/django-bootstrap3/default.nix
+++ b/pkgs/development/python-modules/django-bootstrap3/default.nix
@@ -1,24 +1,36 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, setuptools
+, fetchFromGitHub
+
+# build-system
+, hatchling
+
+# non-propagates
 , django
+
+# tests
 , pytest-django
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-bootstrap3";
-  version = "23.1";
+  version = "23.4";
   format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-cJW3xmqJ87rreOoCh5nr15XSlzn8hgJGBCLnwqGUrTA=";
+  src = fetchFromGitHub {
+    owner = "zostera";
+    repo = "django-bootstrap3";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-1/JQ17GjBHH0JbY4EnHOS2B3KhEJdG2yL6O2nc1HNNc=";
   };
 
+  postPatch = ''
+    sed -i '/beautifulsoup4/d' pyproject.toml
+  '';
+
   nativeBuildInputs = [
-    setuptools
+    hatchling
   ];
 
   buildInputs = [
@@ -39,7 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Bootstrap 3 integration for Django";
     homepage = "https://github.com/zostera/django-bootstrap3";
-    changelog = "https://github.com/zostera/django-bootstrap3/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/zostera/django-bootstrap3/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ hexa ];
   };
diff --git a/pkgs/development/python-modules/django-bootstrap4/default.nix b/pkgs/development/python-modules/django-bootstrap4/default.nix
index 480c7891539f..568ce0df3048 100644
--- a/pkgs/development/python-modules/django-bootstrap4/default.nix
+++ b/pkgs/development/python-modules/django-bootstrap4/default.nix
@@ -3,30 +3,32 @@
 , fetchFromGitHub
 
 # build-system
-, setuptools
+, hatchling
+
+# non-propagates
+, django
 
 # dependencies
 , beautifulsoup4
 
 # tests
-, django
 , python
 }:
 
 buildPythonPackage rec {
   pname = "django-bootstrap4";
-  version = "23.1";
+  version = "23.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "zostera";
     repo = "django-bootstrap4";
-    rev = "v${version}";
-    hash = "sha256-55pfUPwxDzpDn4stMEPvrQAexs+goN5SKFvwSR3J4aM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RYGwi+hRfTqPAikrv33w27v1/WLwRvXexSusJKdr2o8=";
   };
 
   nativeBuildInputs = [
-    setuptools
+    hatchling
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-js-asset/default.nix b/pkgs/development/python-modules/django-js-asset/default.nix
index f921077934fd..f579a31dc3e7 100644
--- a/pkgs/development/python-modules/django-js-asset/default.nix
+++ b/pkgs/development/python-modules/django-js-asset/default.nix
@@ -1,22 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, hatchling
 , django
 , python
 }:
 
 buildPythonPackage rec {
   pname = "django-js-asset";
-  version = "2.0";
-  format = "setuptools";
+  version = "2.1";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "matthiask";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-YDOmbqB0xDBAlOSO1UBYJ8VfRjJ8Z6Hw1i24DNSrnjw=";
+    hash = "sha256-rxJ9TgVBiJByiFSLTg/dtAR31Fs14D4sh2axyBcKGTU=";
   };
 
+  nativeBuildInputs = [
+    hatchling
+  ];
+
   propagatedBuildInputs = [
     django
   ];
diff --git a/pkgs/development/python-modules/django-oauth-toolkit/default.nix b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
index 5a2a8e5786d6..ce03a1330f5f 100644
--- a/pkgs/development/python-modules/django-oauth-toolkit/default.nix
+++ b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
@@ -47,10 +47,12 @@ buildPythonPackage rec {
 
   DJANGO_SETTINGS_MODULE = "tests.settings";
 
+  # xdist is disabled right now because it can cause race conditions on high core machines
+  # https://github.com/jazzband/django-oauth-toolkit/issues/1300
   nativeCheckInputs = [
     djangorestframework
     pytest-django
-    pytest-xdist
+    # pytest-xdist
     pytest-mock
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/dnspython/default.nix b/pkgs/development/python-modules/dnspython/default.nix
index 01e3dd2cb55e..402272fb54b8 100644
--- a/pkgs/development/python-modules/dnspython/default.nix
+++ b/pkgs/development/python-modules/dnspython/default.nix
@@ -9,29 +9,29 @@
 , h2
 , httpx
 , idna
+, poetry-core
 , pytestCheckHook
 , pythonOlder
 , requests
 , requests-toolbelt
-, setuptools-scm
 , sniffio
 , trio
 }:
 
 buildPythonPackage rec {
   pname = "dnspython";
-  version = "2.3.0";
-  format = "setuptools";
+  version = "2.4.1";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ik4ysD60a+cOEu9tZOC+Ejpk5iGrTAgi/21FDVKlQLk=";
+    hash = "sha256-wzlxx5r1vpaLuJfpXCRI4RpkXuhNk7Jlzgt6q+Xf3Kg=";
   };
 
   nativeBuildInputs = [
-    setuptools-scm
+    poetry-core
   ];
 
   passthru.optional-dependencies = {
diff --git a/pkgs/development/python-modules/drf-spectacular/default.nix b/pkgs/development/python-modules/drf-spectacular/default.nix
index e9c3a752b0dc..aeb90488dfd1 100644
--- a/pkgs/development/python-modules/drf-spectacular/default.nix
+++ b/pkgs/development/python-modules/drf-spectacular/default.nix
@@ -28,13 +28,13 @@
 
 buildPythonPackage rec {
   pname = "drf-spectacular";
-  version = "0.26.2";
+  version = "0.26.3";
 
   src = fetchFromGitHub {
     owner = "tfranzel";
     repo = "drf-spectacular";
     rev = "refs/tags/${version}";
-    hash = "sha256-wwR7ZdbWFNRgxQubdgriDke5W6u7VNsNZV9xqQypSrY=";
+    hash = "sha256-O47676BOuCx3wMpeuRATQOAWZQev+R+OxZi4boQABmc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dtschema/default.nix b/pkgs/development/python-modules/dtschema/default.nix
index 5944a7760841..1e890aba3309 100644
--- a/pkgs/development/python-modules/dtschema/default.nix
+++ b/pkgs/development/python-modules/dtschema/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , fetchFromGitHub
 , jsonschema
@@ -54,6 +55,14 @@ buildPythonPackage rec {
     changelog = "https://github.com/devicetree-org/dt-schema/releases/tag/v${version}";
     license = with licenses; [ bsd2 /* or */ gpl2Only ];
     maintainers = with maintainers; [ sorki ];
+
+    broken = (
+      # Library not loaded: @rpath/libfdt.1.dylib
+      stdenv.isDarwin ||
+
+      # see https://github.com/devicetree-org/dt-schema/issues/108
+      versionAtLeast jsonschema.version "4.18"
+    );
   };
 }
 
diff --git a/pkgs/development/python-modules/eigenpy/default.nix b/pkgs/development/python-modules/eigenpy/default.nix
index e20cb4c4f636..24abaebf7bb5 100644
--- a/pkgs/development/python-modules/eigenpy/default.nix
+++ b/pkgs/development/python-modules/eigenpy/default.nix
@@ -7,16 +7,16 @@
 , numpy
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "eigenpy";
-  version = "3.0.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "stack-of-tasks";
-    repo = pname;
-    rev = "v${version}";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-xaeMsn3G4x5DS6gXc6mbZvi96K1Yu8CuzjcGnYJYrvs=";
+    hash = "sha256-mUwckBelFVRCXp3hspB8WRFFaLVyRsfp6XbqU8HeHvw=";
   };
 
   strictDeps = true;
@@ -34,12 +34,17 @@ stdenv.mkDerivation rec {
     numpy
   ];
 
+  doCheck = true;
+  pythonImportsCheck = [
+    "eigenpy"
+  ];
+
   meta = with lib; {
     description = "Bindings between Numpy and Eigen using Boost.Python";
     homepage = "https://github.com/stack-of-tasks/eigenpy";
     changelog = "https://github.com/stack-of-tasks/eigenpy/releases/tag/v${version}";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ wegank ];
+    maintainers = with maintainers; [ nim65s wegank ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/python-modules/eventlet/default.nix b/pkgs/development/python-modules/eventlet/default.nix
index 2f358ba98325..35c702ea06d8 100644
--- a/pkgs/development/python-modules/eventlet/default.nix
+++ b/pkgs/development/python-modules/eventlet/default.nix
@@ -5,9 +5,10 @@
 , pythonOlder
 , dnspython
 , greenlet
+, isPyPy
 , monotonic
 , six
-, nose
+, nose3
 , iana-etc
 , pytestCheckHook
 , libredirect
@@ -35,10 +36,12 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    nose
+    nose3
   ];
 
-  doCheck = !stdenv.isDarwin;
+  # libredirect is not available on darwin
+  # tests hang on pypy indefinitely
+  doCheck = !stdenv.isDarwin && !isPyPy;
 
   preCheck = lib.optionalString doCheck ''
     echo "nameserver 127.0.0.1" > resolv.conf
diff --git a/pkgs/development/python-modules/factory_boy/default.nix b/pkgs/development/python-modules/factory_boy/default.nix
index 0e4d38c290c1..2269445282bd 100644
--- a/pkgs/development/python-modules/factory_boy/default.nix
+++ b/pkgs/development/python-modules/factory_boy/default.nix
@@ -7,20 +7,29 @@
 , flask-sqlalchemy
 , mongoengine
 , pytestCheckHook
+, pythonOlder
 , sqlalchemy
+, sqlalchemy-utils
 }:
 
 buildPythonPackage rec {
   pname = "factory-boy";
-  version = "3.2.1";
+  version = "3.3.0";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchPypi {
     pname = "factory_boy";
     inherit version;
-    hash = "sha256-qY0newwEfHXrbkq4UIp/gfsD0sshmG9ieRNUbveipV4=";
+    hash = "sha256-vHbZfRplu9mEKm1yKIIJjrVJ7I7hCB+fsuj/KfDDAPE=";
   };
 
+  postPatch = ''
+    substituteInPlace tests/test_version.py \
+      --replace '"3.2.1.dev0")' '"${version}")'
+  '';
+
   propagatedBuildInputs = [
     faker
   ];
@@ -32,6 +41,7 @@ buildPythonPackage rec {
     mongoengine
     pytestCheckHook
     sqlalchemy
+    sqlalchemy-utils
   ];
 
   # Checks for MongoDB requires an a running DB
@@ -51,6 +61,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python package to create factories for complex objects";
     homepage = "https://github.com/rbarrois/factory_boy";
+    changelog = "https://github.com/FactoryBoy/factory_boy/blob/${version}/docs/changelog.rst";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index 62a65cfbdf63..3215a9010882 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "3.12.0";
+  version = "3.12.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/AOuQyiMAT0uqDyFlwAbESnbNRqtnFf+JAkyeRa45xg=";
+    hash = "sha256-ACdAUY2KpZomsMduEPuMbhXq6CXTS2/fZwMz/XuTjYE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fixtures/default.nix b/pkgs/development/python-modules/fixtures/default.nix
index ff246c4a0e98..2570b1a274b6 100644
--- a/pkgs/development/python-modules/fixtures/default.nix
+++ b/pkgs/development/python-modules/fixtures/default.nix
@@ -1,53 +1,47 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
-, pythonAtLeast
 , pbr
+, setuptools
 , testtools
 , mock
-, python
-, six
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "fixtures";
-  version = "3.0.0";
+  version = "4.1.0";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fcf0d60234f1544da717a9738325812de1f42c2fa085e2d9252d8fff5712b2ef";
+    hash = "sha256-grHF5p9hVSbvbAZxiKHmxgZ99/iDMlCcmfi4/buXdvM=";
   };
 
-  patches = lib.optionals (pythonAtLeast "3.9") [
-    # drop tests that try to monkeypatch a classmethod, which fails on python3.9
-    # https://github.com/testing-cabal/fixtures/issues/44
-    (fetchpatch {
-       url = "https://salsa.debian.org/openstack-team/python/python-fixtures/-/raw/debian/victoria/debian/patches/remove-broken-monkey-patch-test.patch";
-       sha256 = "1s3hg2zmqc4shmnf90kscphzj5qlqpxghzw2a59p8f88zrbsj97r";
-    })
-  ];
-
   nativeBuildInputs = [
     pbr
+    setuptools
   ];
 
   propagatedBuildInputs = [
-    testtools
-    six # not in install_requires, but used in fixture.py
+    pbr
   ];
 
+  passthru.optional-dependencies = {
+    streams = [
+      testtools
+    ];
+  };
+
   nativeCheckInputs = [
     mock
-  ];
-
-  checkPhase = ''
-    ${python.interpreter} -m testtools.run fixtures.test_suite
-  '';
+    pytestCheckHook
+  ] ++ passthru.optional-dependencies.streams;
 
   meta = {
     description = "Reusable state for writing clean tests and more";
-    homepage = "https://pypi.python.org/pypi/fixtures";
+    homepage = "https://pypi.org/project/fixtures/";
+    changelog = "https://github.com/testing-cabal/fixtures/blob/${version}/NEWS";
     license = lib.licenses.asl20;
   };
 }
diff --git a/pkgs/development/python-modules/flask-limiter/default.nix b/pkgs/development/python-modules/flask-limiter/default.nix
index f30598797a75..b32fc7b25afc 100644
--- a/pkgs/development/python-modules/flask-limiter/default.nix
+++ b/pkgs/development/python-modules/flask-limiter/default.nix
@@ -1,38 +1,36 @@
 { lib
+, asgiref
 , buildPythonPackage
 , fetchFromGitHub
-
 , flask
+, hiro
 , limits
 , ordered-set
-, rich
-, typing-extensions
-
-, asgiref
-, hiro
 , pymemcache
+, pymongo
 , pytest-mock
 , pytestCheckHook
+, pythonOlder
 , redis
-, pymongo
+, rich
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "flask-limiter";
-  version = "3.1.0";
+  version = "3.3.1";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "alisaifee";
     repo = "flask-limiter";
     rev = "refs/tags/${version}";
-    hash = "sha256-eAJRqyAH1j1NHYfagRZM2fPE6hm9+tJHD8FMqvgvMBI=";
+    hash = "sha256-YDVZ/dD+TRJEnJRTRmGEB6EIkK5eQ5MdXh8FideoVDQ=";
   };
 
   postPatch = ''
-    substituteInPlace requirements/main.txt \
-      --replace "rich>=12,<13" "rich"
-
     sed -i "/--cov/d" pytest.ini
 
     # flask-restful is unmaintained and breaks regularly, don't depend on it
@@ -82,11 +80,14 @@ buildPythonPackage rec {
     "tests/test_storage.py"
   ];
 
-  pythonImportsCheck = [ "flask_limiter" ];
+  pythonImportsCheck = [
+    "flask_limiter"
+  ];
 
   meta = with lib; {
     description = "Rate limiting for flask applications";
     homepage = "https://flask-limiter.readthedocs.org/";
+    changelog = "https://github.com/alisaifee/flask-limiter/blob/${version}/HISTORY.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/flet-core/default.nix b/pkgs/development/python-modules/flet-core/default.nix
index fae29247deab..ed55629dca03 100644
--- a/pkgs/development/python-modules/flet-core/default.nix
+++ b/pkgs/development/python-modules/flet-core/default.nix
@@ -1,7 +1,13 @@
 { lib
-, python3
 , buildPythonPackage
 , fetchPypi
+
+# build-system
+, poetry-core
+
+# propagates
+, typing-extensions
+, repath
 }:
 
 buildPythonPackage rec {
@@ -15,13 +21,13 @@ buildPythonPackage rec {
     hash = "sha256-8WG7odYiGrew4GwD+MUuzQPmDn7V/GmocBproqsbCNw=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
+  nativeBuildInputs = [
     poetry-core
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
-    typing-extensions
+  propagatedBuildInputs = [
     repath
+    typing-extensions
   ];
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/flet/default.nix b/pkgs/development/python-modules/flet/default.nix
index 95382a88c95c..4c41e5972600 100644
--- a/pkgs/development/python-modules/flet/default.nix
+++ b/pkgs/development/python-modules/flet/default.nix
@@ -1,7 +1,20 @@
 { lib
-, python3
 , buildPythonPackage
 , fetchPypi
+
+# build-system
+, poetry-core
+
+# propagates
+, flet-core
+, httpx
+, oauthlib
+, packaging
+, typing-extensions
+, watchdog
+, websocket-client
+, websockets
+
 }:
 
 buildPythonPackage rec {
@@ -20,11 +33,11 @@ buildPythonPackage rec {
       --replace 'watchdog = "^2' 'watchdog = ">=2'
   '';
 
-  nativeBuildInputs = with python3.pkgs; [
+  nativeBuildInputs = [
     poetry-core
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = [
     flet-core
     typing-extensions
     websocket-client
diff --git a/pkgs/development/python-modules/flit/default.nix b/pkgs/development/python-modules/flit/default.nix
index 43d8d8e90efc..a1be6821b2f7 100644
--- a/pkgs/development/python-modules/flit/default.nix
+++ b/pkgs/development/python-modules/flit/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "flit";
-  version = "3.8.0";
+  version = "3.9.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "takluyver";
     repo = "flit";
     rev = version;
-    hash = "sha256-iXf9K/xI4u+dDV0Zf6S08nbws4NqycrTEW0B8/qCjQc=";
+    hash = "sha256-yl2+PcKr7xRW4oIBWl+gzh/nKhSNu5GH9fWKRGgaNHU=";
   };
 
   nativeBuildInputs = [
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/pypa/flit/blob/${version}/doc/history.rst";
     description = "A simple packaging tool for simple packages";
     homepage = "https://github.com/pypa/flit";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/gaphas/default.nix b/pkgs/development/python-modules/gaphas/default.nix
index ec57bfd114df..52428bc3c4eb 100644
--- a/pkgs/development/python-modules/gaphas/default.nix
+++ b/pkgs/development/python-modules/gaphas/default.nix
@@ -24,10 +24,10 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    gobject-introspection
   ];
 
   buildInputs = [
-    gobject-introspection
     gtk3
   ];
 
diff --git a/pkgs/development/python-modules/glad2/default.nix b/pkgs/development/python-modules/glad2/default.nix
index 47728d793b05..57ee88c4997a 100644
--- a/pkgs/development/python-modules/glad2/default.nix
+++ b/pkgs/development/python-modules/glad2/default.nix
@@ -1,9 +1,10 @@
 { lib
-, python3
+, buildPythonPackage
 , fetchPypi
+, jinja2
 }:
 
-python3.pkgs.buildPythonPackage rec {
+buildPythonPackage rec {
   pname = "glad2";
   version = "2.0.4";
   format = "setuptools";
@@ -13,15 +14,18 @@ python3.pkgs.buildPythonPackage rec {
     hash = "sha256-7eFjn2nyugjx9JikCnB/NKYJ0k6y6g1sk2RomnmM99A=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = [
     jinja2
   ];
 
+  # no python tests
+  doCheck = false;
+
   pythonImportsCheck = [ "glad" ];
 
   meta = with lib; {
     description = "Multi-Language GL/GLES/EGL/GLX/WGL Loader-Generator based on the official specifications";
-    homepage = "https://pypi.org/project/glad2";
+    homepage = "https://github.com/Dav1dde/glad";
     license = licenses.mit;
     maintainers = with maintainers; [ kranzes ];
   };
diff --git a/pkgs/development/python-modules/graphene-django/default.nix b/pkgs/development/python-modules/graphene-django/default.nix
index 68dc792aecfb..0e85af5045b2 100644
--- a/pkgs/development/python-modules/graphene-django/default.nix
+++ b/pkgs/development/python-modules/graphene-django/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "graphene-django";
-  version = "3.1.2";
+  version = "3.1.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "graphql-python";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-VQwDK9FRbHy/AFbdZKmvl5e52smSCyWTrs00DvJqVmo=";
+    hash = "sha256-33Z6W2dAsj5VXt3E7XJtUFiq7yFlCixnFnhbAUv+xgU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 9814e11ff7e5..efa4fba8513a 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "gst-python";
-  version = "1.22.4";
+  version = "1.22.5";
 
   format = "other";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "${meta.homepage}/src/gst-python/${pname}-${version}.tar.xz";
-    hash = "sha256-4TAtzA8kUbZDgNzA3TuCc1eV6JUdyBLZONi6kfOIFj4=";
+    hash = "sha256-vwUjJBXPYBgUKuUd07iXu3NDJoe1zheGv0btximM5bA=";
   };
 
   # Python 2.x is not supported.
diff --git a/pkgs/development/python-modules/gtimelog/default.nix b/pkgs/development/python-modules/gtimelog/default.nix
index 532481fbeeba..0d00eaa22dd2 100644
--- a/pkgs/development/python-modules/gtimelog/default.nix
+++ b/pkgs/development/python-modules/gtimelog/default.nix
@@ -15,9 +15,9 @@ buildPythonPackage rec {
     sha256 = "0qv2kv7vc3qqlzxsisgg31cmrkkqgnmxspbj10c5fhdmwzzwi0i9";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper gobject-introspection ];
   buildInputs = [
-    glibcLocales gobject-introspection gtk3 libsoup libsecret
+    glibcLocales gtk3 libsoup libsecret
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gunicorn/default.nix b/pkgs/development/python-modules/gunicorn/default.nix
index 8c543bce8571..c334a58ad567 100644
--- a/pkgs/development/python-modules/gunicorn/default.nix
+++ b/pkgs/development/python-modules/gunicorn/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
+, packaging
 , pythonOlder
 , eventlet
 , gevent
@@ -11,24 +11,17 @@
 
 buildPythonPackage rec {
   pname = "gunicorn";
-  version = "20.1.0";
+  version = "21.2.0";
+  format = "setuptools";
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "benoitc";
     repo = "gunicorn";
     rev = version;
-    hash = "sha256-xdNHm8NQWlAlflxof4cz37EoM74xbWrNaf6jlwwzHv4=";
+    hash = "sha256-xP7NNKtz3KNrhcAc00ovLZRx2h6ZqHbwiFOpCiuwf98=";
   };
 
-  patches = [
-    (fetchpatch {
-      # fix eventlet 0.30.3+ compability
-      url = "https://github.com/benoitc/gunicorn/commit/6a8ebb4844b2f28596ffe7421eb9f7d08c8dc4d8.patch";
-      hash = "sha256-+iApgohzPZ/cHTGBNb7XkqLaHOVVPF26BnPUsvISoZw=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace "--cov=gunicorn --cov-report=xml" ""
@@ -36,6 +29,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     setuptools
+    packaging
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 35187aff512d..8a886112fed9 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -5,11 +5,11 @@
 
 # runtime
 , editables
-, importlib-metadata # < 3.8
 , packaging
 , pathspec
 , pluggy
 , tomli
+, trove-classifiers
 
 # tests
 , build
@@ -18,27 +18,24 @@
 , virtualenv
 }:
 
-let
+buildPythonPackage rec {
   pname = "hatchling";
-  version = "1.13.0";
-in
-buildPythonPackage {
-  inherit pname version;
+  version = "1.18.0";
   format = "pyproject";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+NJ1osxyBzUoa3wuK8NdoFdh5tNpXC+kFlUDlfEMU8c=";
+    hash = "sha256-UOmcMRDOCvw/e9ut/xxxwXdY5HZzHCdgeUDPpmhkico=";
   };
 
-  # listed in backend/src/hatchling/ouroboros.py
+  # listed in backend/pyproject.toml
   propagatedBuildInputs = [
     editables
     packaging
     pathspec
     pluggy
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
+    trove-classifiers
   ] ++ lib.optionals (pythonOlder "3.11") [
     tomli
   ];
@@ -54,7 +51,6 @@ buildPythonPackage {
   # listed in /backend/tests/downstream/requirements.txt
   nativeCheckInputs = [
     build
-    packaging
     requests
     virtualenv
   ];
diff --git a/pkgs/development/python-modules/hologram/default.nix b/pkgs/development/python-modules/hologram/default.nix
index 0964bbf89ca4..aeec391e1cb3 100644
--- a/pkgs/development/python-modules/hologram/default.nix
+++ b/pkgs/development/python-modules/hologram/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , jsonschema
 , pytestCheckHook
 , python-dateutil
@@ -12,6 +13,9 @@ buildPythonPackage rec {
   version = "0.0.16";
   format = "pyproject";
 
+  # ValueError: mutable default <class 'tests.conftest.Point'> for field a is not allowed: use default_factory
+  disabled = pythonAtLeast "3.11";
+
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = pname;
diff --git a/pkgs/development/python-modules/html5tagger/default.nix b/pkgs/development/python-modules/html5tagger/default.nix
new file mode 100644
index 000000000000..42bc3aa18ad6
--- /dev/null
+++ b/pkgs/development/python-modules/html5tagger/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "html5tagger";
+  version = "1.3.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "sanic-org";
+    repo = "html5tagger";
+    rev = "v${version}";
+    hash = "sha256-Or0EizZC9FMjTcbgecDvgGB09KNGyxHreSDojgB7ysg=";
+  };
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "html5tagger"
+  ];
+
+  meta = with lib; {
+    description = "Create HTML documents from Python";
+    homepage = "https://github.com/sanic-org/html5tagger";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/httpcore/default.nix b/pkgs/development/python-modules/httpcore/default.nix
index 863a56317055..9f3905f55182 100644
--- a/pkgs/development/python-modules/httpcore/default.nix
+++ b/pkgs/development/python-modules/httpcore/default.nix
@@ -13,11 +13,14 @@
 , pythonOlder
 , sniffio
 , socksio
+# for passthru.tests
+, httpx
+, httpx-socks
 }:
 
 buildPythonPackage rec {
   pname = "httpcore";
-  version = "0.16.3";
+  version = "0.17.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +29,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-3bC97CTZi6An+owjoJF7Irtr7ONbP8RtNdTIGJRy0Ng=";
+    hash = "sha256-qAoORhzBbjXxgtzTqbAxWBxrohzfwDWm5mxxrgeXt48=";
   };
 
   propagatedBuildInputs = [
@@ -70,7 +73,12 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
+  passthru.tests = {
+    inherit httpx httpx-socks;
+  };
+
   meta = with lib; {
+    changelog = "https://github.com/encode/httpcore/releases/tag/${version}";
     description = "A minimal low-level HTTP client";
     homepage = "https://github.com/encode/httpcore";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/httpx/default.nix b/pkgs/development/python-modules/httpx/default.nix
index ffbea1b67c8e..11204ec8b9b4 100644
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "httpx";
-  version = "0.23.3";
+  version = "0.24.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-ZLRzkyoFbAY2Xs1ORWBqvc2gpKovg9wRs/RtAryOcVg=";
+    hash = "sha256-qG6fgijNgQKjpSG6sg0+0yqeAU6qV7czR8NgWe63LIg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/joblib/default.nix b/pkgs/development/python-modules/joblib/default.nix
index 7317ee8fc144..84e693bb7223 100644
--- a/pkgs/development/python-modules/joblib/default.nix
+++ b/pkgs/development/python-modules/joblib/default.nix
@@ -1,32 +1,53 @@
 { lib
-, pythonAtLeast
-, pythonOlder
 , buildPythonPackage
+, pythonOlder
 , fetchPypi
 , stdenv
-, numpydoc
-, pytestCheckHook
-, lz4
+
+# build-system
 , setuptools
-, sphinx
+
+# propagates (optional, but unspecified)
+# https://github.com/joblib/joblib#dependencies
+, lz4
 , psutil
+
+# tests
+, pytestCheckHook
+, threadpoolctl
 }:
 
 
 buildPythonPackage rec {
   pname = "joblib";
-  version = "1.2.0";
+  version = "1.3.1";
+  format = "pyproject";
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4c7kp55K8iiBFk8hjUMR9gB0GX+3B+CC6AO2H20TcBg=";
+    hash = "sha256-H5N5Bt9lMpupgBPclpL+IqTF5KZIES3lAFCLGKIbQeM=";
   };
 
-  nativeCheckInputs = [ sphinx numpydoc pytestCheckHook psutil ];
-  propagatedBuildInputs = [ lz4 setuptools ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    lz4
+    psutil
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    threadpoolctl
+  ];
+
+  pytestFlagsArray = [
+    "joblib/test"
+  ];
 
-  pytestFlagsArray = [ "joblib/test" ];
   disabledTests = [
     "test_disk_used" # test_disk_used is broken: https://github.com/joblib/joblib/issues/57
     "test_parallel_call_cached_function_defined_in_jupyter" # jupyter not available during tests
@@ -36,6 +57,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/joblib/joblib/releases/tag/${version}";
     description = "Lightweight pipelining: using Python functions as pipeline jobs";
     homepage = "https://joblib.readthedocs.io/";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/jsonschema-spec/default.nix b/pkgs/development/python-modules/jsonschema-spec/default.nix
index 2d7d82fd6e46..3353e5ec4380 100644
--- a/pkgs/development/python-modules/jsonschema-spec/default.nix
+++ b/pkgs/development/python-modules/jsonschema-spec/default.nix
@@ -2,29 +2,40 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+
+# build
 , poetry-core
-, jsonschema
+
+# propagates
 , pathable
 , pyyaml
-, typing-extensions
+, referencing
+, requests
+
+# tests
 , pytestCheckHook
+, responses
 }:
 
 buildPythonPackage rec {
   pname = "jsonschema-spec";
-  version = "0.1.4";
+  version = "0.2.3";
   format = "pyproject";
-  disabled = pythonOlder "3.7";
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "p1c2u";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-kLCV9WPWGrVgpbueafMVqtGmj3ifrBzTChE2kyxpyZk=";
+    hash = "sha256-Sa97DwPnGMLmT00hVdkoGO7C0vrvtwxvUvv9lq4nCY4=";
   };
 
   postPatch = ''
-    sed -i "/--cov/d" pyproject.toml
+    sed -i "/^--cov/d" pyproject.toml
+
+    substituteInPlace pyproject.toml \
+      --replace 'referencing = ">=0.28.0,<0.30.0"' 'referencing = ">=0.28.0"'
   '';
 
   nativeBuildInputs = [
@@ -32,14 +43,15 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    jsonschema
     pathable
     pyyaml
-    typing-extensions
+    referencing
+    requests
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
+    responses
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/jsonschema-specifications/default.nix b/pkgs/development/python-modules/jsonschema-specifications/default.nix
new file mode 100644
index 000000000000..54b8d6df6ea1
--- /dev/null
+++ b/pkgs/development/python-modules/jsonschema-specifications/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, hatch-vcs
+, hatchling
+, importlib-resources
+, pytestCheckHook
+, pythonOlder
+, referencing
+}:
+
+buildPythonPackage rec {
+  pname = "jsonschema-specifications";
+  version = "2023.7.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    pname = "jsonschema_specifications";
+    inherit version;
+    hash = "sha256-yRpQQE6Iofa6QGNneOLuCPbiTFYT/kxTrCRXilp/crs=";
+  };
+
+  nativeBuildInputs = [
+    hatch-vcs
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    referencing
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    importlib-resources
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "jsonschema_specifications"
+  ];
+
+  meta = with lib; {
+    description = "Support files exposing JSON from the JSON Schema specifications";
+    homepage = "https://github.com/python-jsonschema/jsonschema-specifications";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
index 52bc89511d23..a23e3a5b931c 100644
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -5,13 +5,13 @@
 , hatch-fancy-pypi-readme
 , hatch-vcs
 , hatchling
-, importlib-metadata
 , importlib-resources
+, jsonschema-specifications
 , pkgutil-resolve-name
-, pyrsistent
+, pytestCheckHook
 , pythonOlder
-, twisted
-, typing-extensions
+, referencing
+, rpds-py
 
 # optionals
 , fqdn
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "jsonschema";
-  version = "4.17.3";
+  version = "4.18.4";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-D4ZEN6uLYHa6ZwdFPvj5imoNUSqA6T+KvbZ29zfstg0=";
+    hash = "sha256-+zZCc1OZ+pWMDSqtcFeQFVRZbGM0n09rKDxJPPaSol0=";
   };
 
   postPatch = ''
@@ -49,10 +49,9 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     attrs
-    pyrsistent
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
-    typing-extensions
+    jsonschema-specifications
+    referencing
+    rpds-py
   ] ++ lib.optionals (pythonOlder "3.9") [
     importlib-resources
     pkgutil-resolve-name
@@ -82,20 +81,15 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    twisted
+    pytestCheckHook
   ];
 
-  checkPhase = ''
-    export JSON_SCHEMA_TEST_SUITE=json
-    trial jsonschema
-  '';
-
   pythonImportsCheck = [
     "jsonschema"
   ];
 
   meta = with lib; {
-    description = "An implementation of JSON Schema validation for Python";
+    description = "An implementation of JSON Schema validation";
     homepage = "https://github.com/python-jsonschema/jsonschema";
     license = licenses.mit;
     maintainers = with maintainers; [ domenkozar ];
diff --git a/pkgs/development/python-modules/jupyter-collaboration/default.nix b/pkgs/development/python-modules/jupyter-collaboration/default.nix
index 9f17874dfc32..17ec03145137 100644
--- a/pkgs/development/python-modules/jupyter-collaboration/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration/default.nix
@@ -61,6 +61,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pytestFlagsArray = [
+    "-W" "ignore::DeprecationWarning"
+  ];
+
   preCheck = ''
     export HOME=$TEMP
   '';
diff --git a/pkgs/development/python-modules/jupyter-contrib-nbextensions/default.nix b/pkgs/development/python-modules/jupyter-contrib-nbextensions/default.nix
index f95493513e67..bf9bc2bd7cd0 100644
--- a/pkgs/development/python-modules/jupyter-contrib-nbextensions/default.nix
+++ b/pkgs/development/python-modules/jupyter-contrib-nbextensions/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, ipython_genutils
 , jupyter-contrib-core
 , jupyter-highlight-selected-word
 , jupyter-nbextensions-configurator
@@ -19,6 +20,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
+    ipython_genutils
     jupyter-contrib-core
     jupyter-highlight-selected-word
     jupyter-nbextensions-configurator
diff --git a/pkgs/development/python-modules/jupyter-server/default.nix b/pkgs/development/python-modules/jupyter-server/default.nix
index 9532e5ca68a9..b8a9a97e230a 100644
--- a/pkgs/development/python-modules/jupyter-server/default.nix
+++ b/pkgs/development/python-modules/jupyter-server/default.nix
@@ -82,12 +82,17 @@ buildPythonPackage rec {
     flaky
   ];
 
+  pytestFlagsArray = [
+    "-W" "ignore::DeprecationWarning"
+  ];
+
   preCheck = ''
     export HOME=$(mktemp -d)
     export PATH=$out/bin:$PATH
   '';
 
   disabledTests = [
+    "test_server_extension_list"
     "test_cull_idle"
     "test_server_extension_list"
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/keyring/default.nix b/pkgs/development/python-modules/keyring/default.nix
index c729e1da5362..1905434759a2 100644
--- a/pkgs/development/python-modules/keyring/default.nix
+++ b/pkgs/development/python-modules/keyring/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "keyring";
-  version = "23.13.1";
+  version = "24.2.0";
   format = "pyproject";
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ui4VqbNeIZCNCq9OCkesxS1q4zRE3w2itJ1BpG721ng=";
+    hash = "sha256-ygdGoZ7EISGfTXE/hI+il6ZhqKjBUEhn5Vv7XgkJFQk=";
   };
 
   nativeBuildInputs = [
@@ -54,7 +54,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Store and access your passwords safely";
     homepage    = "https://github.com/jaraco/keyring";
-    changelog   = "https://github.com/jaraco/keyring/blob/v${version}/CHANGES.rst";
+    changelog   = "https://github.com/jaraco/keyring/blob/v${version}/NEWS.rst";
     license     = licenses.mit;
     maintainers = with maintainers; [ lovek323 dotlambda ];
     platforms   = platforms.unix;
diff --git a/pkgs/development/python-modules/kombu/default.nix b/pkgs/development/python-modules/kombu/default.nix
index 9ba249f52816..f7c9ce32bb8d 100644
--- a/pkgs/development/python-modules/kombu/default.nix
+++ b/pkgs/development/python-modules/kombu/default.nix
@@ -4,43 +4,36 @@
 , azure-servicebus
 , backports-zoneinfo
 , buildPythonPackage
-, cached-property
 , case
 , fetchPypi
 , hypothesis
-, importlib-metadata
 , pyro4
 , pytestCheckHook
 , pythonOlder
 , pytz
 , vine
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "kombu";
-  version = "5.3.0";
+  version = "5.3.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0ITsH5b3p8N7qegWgjvbwI8Px92zpb5VWAXmkhAil9g=";
+    hash = "sha256-+9dXLZLAv3HBEqa0UWMVPepae2pwHsFrVown0P0jcPI=";
   };
 
-  postPatch = ''
-    substituteInPlace requirements/test.txt \
-      --replace "pytz>dev" "pytz"
-  '';
-
   propagatedBuildInputs = [
     amqp
     vine
+  ] ++ lib.optionals (pythonOlder "3.10") [
+    typing-extensions
   ] ++ lib.optionals (pythonOlder "3.9") [
     backports-zoneinfo
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    cached-property
-    importlib-metadata
   ];
 
   nativeCheckInputs = [
@@ -58,6 +51,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/celery/kombu/releases/tag/v${version}";
     description = "Messaging library for Python";
     homepage = "https://github.com/celery/kombu";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/ldappool/default.nix b/pkgs/development/python-modules/ldappool/default.nix
index 14d23a96d262..a95db8650980 100644
--- a/pkgs/development/python-modules/ldappool/default.nix
+++ b/pkgs/development/python-modules/ldappool/default.nix
@@ -1,5 +1,14 @@
-{ lib, buildPythonPackage, fetchPypi
-, pbr, python-ldap, prettytable, fixtures, testresources, testtools }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pbr
+, python-ldap
+, prettytable
+, six
+, fixtures
+, testresources
+, testtools
+}:
 
 buildPythonPackage rec {
   pname = "ldappool";
@@ -20,7 +29,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ pbr ];
 
-  propagatedBuildInputs = [ python-ldap prettytable ];
+  propagatedBuildInputs = [ python-ldap prettytable six ];
 
   nativeCheckInputs = [ fixtures testresources testtools ];
 
diff --git a/pkgs/development/python-modules/levenshtein/default.nix b/pkgs/development/python-modules/levenshtein/default.nix
index 61da9ab75910..a8d3a6399e65 100644
--- a/pkgs/development/python-modules/levenshtein/default.nix
+++ b/pkgs/development/python-modules/levenshtein/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "levenshtein";
-  version = "0.21.0";
+  version = "0.21.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "Levenshtein";
     rev = "refs/tags/v${version}";
-    hash = "sha256-j28OQkJymkh6tIGYLoZLad7OUUImjZqXdqM2zU3haac=";
+    hash = "sha256-I1kVGbZI1hQRNv0e44giWiMqmeqaqFZks20IyFQ9VIU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/llvmlite/default.nix b/pkgs/development/python-modules/llvmlite/default.nix
index dfdbbe755dd9..e3afe80624fb 100644
--- a/pkgs/development/python-modules/llvmlite/default.nix
+++ b/pkgs/development/python-modules/llvmlite/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchPypi
+, fetchFromGitHub
 , buildPythonPackage
 , python
 , llvm
@@ -12,13 +12,19 @@
 
 buildPythonPackage rec {
   pname = "llvmlite";
-  version = "0.39.1";
+  # The main dependency of llvmlite is numba, which we currently package an
+  # untagged version of it (for numpy>1.25 support). That numba version
+  # requires at least this version of llvmlite (also not yet officially
+  # released, but at least tagged).
+  version = "0.41.0dev0";
 
   disabled = isPyPy || !isPy3k;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-tDq9fILoBSYcQl1QM1vppsT4QmTjTW1uR1IHMAAF1XI=";
+  src = fetchFromGitHub {
+    owner = "numba";
+    repo = "llvmlite";
+    rev = "v${version}";
+    hash = "sha256-fsH+rqouweNENU+YlWr7m0bC0YdreQLNp1n2rwrOiFw=";
   };
 
   nativeBuildInputs = [ llvm ];
diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index cf43f6861c55..db531a65778f 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.9.2";
+  version = "4.9.3-3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/lxml-${version}";
-    hash = "sha256-IHuTlcDbrZHvS6Gtx48IkznVU+9WxZT9XHUZf8M1WOE=";
+    hash = "sha256-Vrizi+6jUUEx7qODU4PAH5ZmvBIyT9H18+QpYB0m1f4=";
   };
 
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs
diff --git a/pkgs/development/python-modules/markdown/default.nix b/pkgs/development/python-modules/markdown/default.nix
index 9ad29d3a2c21..7de193bbbbd7 100644
--- a/pkgs/development/python-modules/markdown/default.nix
+++ b/pkgs/development/python-modules/markdown/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "markdown";
-  version = "3.4.3";
+  version = "3.4.4";
 
   disabled = pythonOlder "3.7";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Python-Markdown";
     repo = "markdown";
     rev = "refs/tags/${version}";
-    hash = "sha256-o2MDsrSkR0fMA5I8AoQcJrpwNGO5lXJn8O47tQN7U6o=";
+    hash = "sha256-5PIIhbJVsotGwZ3BQ4x0I7WjgnGF3opNrn8J+xZCflg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/material-color-utilities/default.nix b/pkgs/development/python-modules/material-color-utilities/default.nix
index ed224b244f4b..8c92723e4a06 100644
--- a/pkgs/development/python-modules/material-color-utilities/default.nix
+++ b/pkgs/development/python-modules/material-color-utilities/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, pillow, regex }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, pythonRelaxDepsHook, pillow, regex }:
 
 buildPythonPackage rec {
   pname = "material-color-utilities-python";
@@ -9,6 +9,13 @@ buildPythonPackage rec {
     sha256 = "sha256-PG8C585wWViFRHve83z3b9NijHyV+iGY2BdMJpyVH64=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+  pythonRelaxDeps = [
+    "Pillow"
+  ];
+
   propagatedBuildInputs = [
     pillow
     regex
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index dbc8c1da31d4..2cfd5d21db19 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -76,7 +76,7 @@ let
 in
 
 buildPythonPackage rec {
-  version = "3.7.1";
+  version = "3.7.2";
   pname = "matplotlib";
   format = "pyproject";
 
@@ -84,7 +84,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e3MwXyXqtFQb1+4Llth+U66cnxgjvlZZuAbNhXhv6II=";
+    hash = "sha256-qM25Hd2wRDa9LwmLj99LgTUuaM9NLGdW/MQUeRB2Vps=";
   };
 
   env.XDG_RUNTIME_DIR = "/tmp";
@@ -121,6 +121,8 @@ buildPythonPackage rec {
     setuptools
     setuptools-scm
     numpy
+  ] ++ lib.optionals enableGtk3 [
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -131,7 +133,6 @@ buildPythonPackage rec {
     ghostscript
   ] ++ lib.optionals enableGtk3 [
     cairo
-    gobject-introspection
     gtk3
   ] ++ lib.optionals enableTk [
     libX11
diff --git a/pkgs/development/python-modules/meson-python/add-build-flags.sh b/pkgs/development/python-modules/meson-python/add-build-flags.sh
new file mode 100644
index 000000000000..d2535d1fd59a
--- /dev/null
+++ b/pkgs/development/python-modules/meson-python/add-build-flags.sh
@@ -0,0 +1,6 @@
+# Add all of mesonFlags to -Csetup-args for pypa builds
+for f in $mesonFlags; do
+  pypaBuildFlags+=" -Csetup-args=$f"
+  # This requires pip>23.0.1, see: https://meson-python.readthedocs.io/en/latest/how-to-guides/config-settings.html
+  pipBuildFlags+=" --config-settings=setup-args=$f"
+done
diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 20008b2b5341..866512a4cfdd 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "meson-python";
-  version = "0.12.1";
+  version = "0.13.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "meson_python";
-    hash = "sha256-PVs+WB1wpYqXucEWp16Xp2zEtMfnX6Blj8g5I3Hi8sI=";
+    hash = "sha256-Y7MXAAFCXEL6TP7a25BRy9KJJf+O7XxA02ugCZ48dhg=";
   };
 
   nativeBuildInputs = [
@@ -39,6 +39,9 @@ buildPythonPackage rec {
   ] ++ lib.optionals (pythonOlder "3.10") [
     typing-extensions
   ];
+  setupHooks = [
+    ./add-build-flags.sh
+  ];
 
   # Ugly work-around. Drop ninja dependency.
   # We already have ninja, but it comes without METADATA.
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index 152c36848a9e..14f4b76b48cf 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -38,16 +38,21 @@
 
 buildPythonPackage rec {
   pname = "mlflow";
-  version = "2.4.2";
+  version = "2.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CxpxsP9Gedzo/yrpcz6ZbsC2wQbbk0EuDfhgb3kYZ8g=";
+    hash = "sha256-+ZKujqnHNQI0S69IxOxEeqnvv6iWW8CQho5hYyNPTrA=";
   };
 
+  postPatch = ''
+    substituteInPlace requirements/core-requirements.txt \
+      --replace "gunicorn<21" "gunicorn"
+  '';
+
   # Remove currently broken dependency `shap`, a model explainability package.
   # This seems quite unprincipled especially with tests not being enabled,
   # but not mlflow has a 'skinny' install option which does not require `shap`.
diff --git a/pkgs/development/python-modules/msgspec/default.nix b/pkgs/development/python-modules/msgspec/default.nix
index b83a6b8a068b..c385661738b1 100644
--- a/pkgs/development/python-modules/msgspec/default.nix
+++ b/pkgs/development/python-modules/msgspec/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "jcrist";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-hxXywlDZoQ1DUL/03UngIdlHke8Ey4rDbEV4JKxiGps=";
+    hash = "sha256-IDu+Yu9BKk4/ITkNY6YLVmJ5zNR6F4LF1vj8QIEW108=";
   };
 
   # Requires libasan to be accessible
diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index 141caaad1928..2623f5c376a6 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pythonOlder
 
 # build-system
@@ -31,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "mypy";
-  version = "1.3.0";
+  version = "1.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -40,9 +41,17 @@ buildPythonPackage rec {
     owner = "python";
     repo = "mypy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dfKuIyzgZo5hAZHighpXH78dHJ1PMbyCakyxF34CnMQ=";
+    hash = "sha256-2PeE/L9J6J0IuUpHZasemM8xxefNJrdzYnutgJjevWQ=";
   };
 
+  patches = [
+    (fetchpatch {
+      # pytest 7.4 compat
+      url = "https://github.com/python/mypy/commit/0a020fa73cf5339a80d81c5b44e17116a5c5307e.patch";
+      hash = "sha256-3HQPo+V7T8Gr92clXAt5QJUJPmhjnGjQgFq0qR0whfw=";
+    })
+  ];
+
   nativeBuildInputs = [
     mypy-extensions
     setuptools
@@ -108,6 +117,8 @@ buildPythonPackage rec {
     "mypy/test/testdaemon.py"
     # fails to find setuptools
     "mypyc/test/test_commandline.py"
+    # fails to find hatchling
+    "mypy/test/testpep561.py"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/nbformat/default.nix b/pkgs/development/python-modules/nbformat/default.nix
index 85489d4566ed..354a937a6105 100644
--- a/pkgs/development/python-modules/nbformat/default.nix
+++ b/pkgs/development/python-modules/nbformat/default.nix
@@ -15,15 +15,13 @@
 
 buildPythonPackage rec {
   pname = "nbformat";
-  version = "5.7.3";
-
-  disabled = pythonOlder "3.7";
-
+  version = "5.9.1";
   format = "pyproject";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SwIfyiTTp0e/TmJmlAM9eS1ZRwWCnl41sU7jNp+fZHc=";
+    hash = "sha256-On9S0EBjnL2KOJAhjIsP+5MhFYjFdEbJAJXjK6WIG10=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index 628742c72f30..957752040e43 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -50,6 +50,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pytestFlagsArray = [
+    "-W" "ignore::DeprecationWarning"
+  ];
+
   env = {
     JUPYTER_PLATFORM_DIRS = 1;
   };
diff --git a/pkgs/development/python-modules/notus-scanner/default.nix b/pkgs/development/python-modules/notus-scanner/default.nix
index ff64840fee7c..ce438528bc28 100644
--- a/pkgs/development/python-modules/notus-scanner/default.nix
+++ b/pkgs/development/python-modules/notus-scanner/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , paho-mqtt
 , poetry-core
 , psutil
@@ -26,6 +27,14 @@ buildPythonPackage rec {
     hash = "sha256-h+jZWjDvTfW9XjoGhWYX08hgJ/Qp64MEaqHHwnahnC4=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "update-packaging-dependency.patch";
+      url = "https://github.com/greenbone/notus-scanner/commit/bfa7d3d2e63e250ff25a66c60b782eb9da0e89e7.patch";
+      hash = "sha256-hzS8TYBXDEq+cgWlp6fSOtSbyeX9EX2rURmnFMF5jN0=";
+    })
+  ];
+
   pythonRelaxDeps = [
     "python-gnupg"
   ];
diff --git a/pkgs/development/python-modules/numba-scipy/default.nix b/pkgs/development/python-modules/numba-scipy/default.nix
index 07e82c0ca6d7..c4c37b7ad333 100644
--- a/pkgs/development/python-modules/numba-scipy/default.nix
+++ b/pkgs/development/python-modules/numba-scipy/default.nix
@@ -6,6 +6,7 @@
 , numba
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -25,14 +26,13 @@ buildPythonPackage rec {
     numba
   ];
 
-  postPatch = ''
-    # https://github.com/numba/numba-scipy/pull/76
-    substituteInPlace setup.py \
-      --replace "scipy>=0.16,<=1.7.3" "scipy>=0.16"
-  '';
-
   nativeCheckInputs = [
     pytestCheckHook
+    pythonRelaxDepsHook
+  ];
+  pythonRelaxDeps = [
+    "scipy"
+    "numba"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index d503307ce67a..da0f72a43375 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -2,7 +2,7 @@
 , stdenv
 , pythonAtLeast
 , pythonOlder
-, fetchPypi
+, fetchFromGitHub
 , python
 , buildPythonPackage
 , setuptools
@@ -27,23 +27,30 @@
 let
   inherit (cudaPackages) cudatoolkit;
 in buildPythonPackage rec {
-  version = "0.56.4";
+  # Using an untagged version, with numpy 1.25 support
+  version = "unstable-2023-08-02";
   pname = "numba";
   format = "setuptools";
   disabled = pythonOlder "3.6" || pythonAtLeast "3.11";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Mtn+9BLIFIPX7+DOts9NMxD96LYkqc7MoA95BXOslu4=";
+  src = fetchFromGitHub {
+    owner = "numba";
+    repo = "numba";
+    rev = "fcf94205335dcc6135d2e19c07bbef968d13610d";
+    # Upstream uses .gitattributes to inject information about the revision
+    # hash and the refname into `numba/_version.py`, see:
+    #
+    # - https://git-scm.com/docs/gitattributes#_export_subst and
+    # - https://github.com/numba/numba/blame/5ef7c86f76a6e8cc90e9486487294e0c34024797/numba/_version.py#L25-L31
+    #
+    # Hence this hash may change if GitHub / Git will change it's behavior.
+    # Hopefully this will not happen until the next release. We are fairly sure
+    # that upstream relies on those strings to be valid, that's why we don't
+    # use `forceFetchGit = true;`.` If in the future we'll observe the hash
+    # changes too often, we can always use forceFetchGit, and inject the
+    # relevant strings ourselves, using `sed` commands, in extraPostFetch.
+    hash = "sha256-Wm1sV4uS/Xkz1BkT2xNmwgBZS0X8YziC6jlbfolXGB8=";
   };
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace 'max_numpy_run_version = "1.24"' 'max_numpy_run_version = "1.25"'
-    substituteInPlace numba/__init__.py \
-      --replace "elif numpy_version > (1, 23):" "elif numpy_version > (1, 24):"
-  '';
-
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-I${lib.getDev libcxx}/include/c++/v1";
 
   nativeBuildInputs = [
@@ -63,17 +70,7 @@ in buildPythonPackage rec {
     cudatoolkit.lib
   ];
 
-  patches = [
-    # fix failure in test_cache_invalidate (numba.tests.test_caching.TestCache)
-    # remove when upgrading past version 0.56
-    (fetchpatch {
-      name = "fix-test-cache-invalidate-readonly.patch";
-      url = "https://github.com/numba/numba/commit/993e8c424055a7677b2755b184fc9e07549713b9.patch";
-      hash = "sha256-IhIqRLmP8gazx+KWIyCxZrNLMT4jZT8CWD3KcH4KjOo=";
-    })
-    # Backport numpy 1.24 support from https://github.com/numba/numba/pull/8691
-    ./numpy-1.24.patch
-  ] ++ lib.optionals cudaSupport [
+  patches = lib.optionals cudaSupport [
     (substituteAll {
       src = ./cuda_path.patch;
       cuda_toolkit_path = cudatoolkit;
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 65a077392ff9..20019633d8ca 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -39,45 +39,36 @@ let
       };
     };
   };
-in buildPythonPackage (rec {
+in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.24.2";
+  version = "1.25.1";
   format = "setuptools";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     extension = "tar.gz";
-    hash = "sha256-ADqfUw6IDLLNF3y6GvciC5qkLe+cSvwqL8Pua+frKyI=";
+    hash = "sha256-mjqfOmFIDMCGEXtCaovYaGnCE/xAcuYG8BxOS2brkr8=";
   };
 
-  patches = lib.optionals python.hasDistutilsCxxPatch [
-    # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
-    # Patching of numpy.distutils is needed to prevent it from undoing the
-    # patch to distutils.
-    ./numpy-distutils-C++.patch
-  ]
-  ++ lib.optionals stdenv.cc.isClang [
+  patches = [
     # f2py.f90mod_rules generates code with invalid function pointer conversions, which are
     # clang 16 makes an error by default.
     (fetchpatch {
       url = "https://github.com/numpy/numpy/commit/609fee4324f3521d81a3454f5fcc33abb0d3761e.patch";
       hash = "sha256-6Dbmf/RWvQJPTIjvchVaywHGcKCsgap/0wAp5WswuCo=";
     })
-  ]
-  ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
-    # Backport from 1.25. `platform.machine` returns `arm64` on aarch64-darwin, which causes
-    # differing results between `_selected_real_kind_func` and Fortran’s `selected_real_kind`.
-    (fetchpatch {
-      url = "https://github.com/numpy/numpy/commit/afcedf4b63f4a94187e6995c2adea0da3bb18e83.patch";
-      hash = "sha256-cxBoimX5a9wC2qUIGAo5o/M2E9+eV63bV2/wLmfDYKg=";
-    })
-  ]
-  ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+
     # Disable `numpy/core/tests/test_umath.py::TestComplexFunctions::test_loss_of_precision[complex256]`
     # on x86_64-darwin because it fails under Rosetta 2 due to issues with trig functions and
     # 80-bit long double complex numbers.
     ./disable-failing-long-double-test-Rosetta-2.patch
+  ]
+  # We patch cpython/distutils to fix https://bugs.python.org/issue1222585
+  # Patching of numpy.distutils is needed to prevent it from undoing the
+  # patch to distutils.
+  ++ lib.optionals python.hasDistutilsCxxPatch [
+    ./numpy-distutils-C++.patch
   ];
 
   postPatch = ''
@@ -91,6 +82,9 @@ in buildPythonPackage (rec {
   nativeBuildInputs = [ gfortran cython ];
   buildInputs = [ blas lapack ];
 
+  # Causes `error: argument unused during compilation: '-fno-strict-overflow'` due to `-Werror`.
+  hardeningDisable = lib.optionals stdenv.cc.isClang [ "strictoverflow" ];
+
   # we default openblas to build with 64 threads
   # if a machine has more than 64 threads, it will segfault
   # see https://github.com/xianyi/OpenBLAS/issues/2993
@@ -137,7 +131,4 @@ in buildPythonPackage (rec {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fridh ];
   };
-} // lib.optionalAttrs stdenv.cc.isClang {
-  # Causes `error: argument unused during compilation: '-fno-strict-overflow'` due to `-Werror`.
-  hardeningDisable = [ "strictoverflow" ];
-})
+}
diff --git a/pkgs/development/python-modules/objgraph/default.nix b/pkgs/development/python-modules/objgraph/default.nix
index 445cc705fac9..bd0aa88262df 100644
--- a/pkgs/development/python-modules/objgraph/default.nix
+++ b/pkgs/development/python-modules/objgraph/default.nix
@@ -4,7 +4,7 @@
 , graphviz
 , graphvizPkgs
 , isPyPy
-, pytestCheckHook
+, python
 , pythonOlder
 , substituteAll
 }:
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   version = "3.6.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.5" || isPyPy;
+  disabled = pythonOlder "3.7" || isPyPy;
 
   src = fetchPypi {
     inherit pname version;
@@ -28,27 +28,27 @@ buildPythonPackage rec {
     })
   ];
 
-  propagatedBuildInputs = [
-    graphviz
-  ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  passthru.optional-dependencies = {
+    ipython = [
+      graphviz
+    ];
+  };
 
   pythonImportsCheck = [
     "objgraph"
   ];
 
-  pytestFlagsArray = [
-    "tests.py"
-  ];
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} tests.py
+    runHook postCheck
+  '';
 
   meta = with lib; {
     description = "Draws Python object reference graphs with graphviz";
     homepage = "https://mg.pov.lt/objgraph/";
     changelog = "https://github.com/mgedmin/objgraph/blob/${version}/CHANGES.rst";
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/openapi-core/default.nix b/pkgs/development/python-modules/openapi-core/default.nix
index b5b2df878623..e0e92178e4bd 100644
--- a/pkgs/development/python-modules/openapi-core/default.nix
+++ b/pkgs/development/python-modules/openapi-core/default.nix
@@ -1,4 +1,6 @@
 { lib
+, aiohttp
+, asgiref
 , buildPythonPackage
 , django
 , djangorestframework
@@ -7,36 +9,35 @@
 , flask
 , httpx
 , isodate
+, jsonschema
 , jsonschema-spec
-, mock
 , more-itertools
 , openapi-schema-validator
 , openapi-spec-validator
 , parse
-, pathable
 , poetry-core
+, pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
 , responses
 , requests
 , starlette
-, typing-extensions
 , webob
 , werkzeug
 }:
 
 buildPythonPackage rec {
   pname = "openapi-core";
-  version = "0.17.1";
+  version = "0.18.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "p1c2u";
     repo = "openapi-core";
     rev = "refs/tags/${version}";
-    hash = "sha256-xlrG2FF55qDsrkdSqCBLu3/QLtZs48ZUB90B2CemY64=";
+    hash = "sha256-2OcGaZQwzgxcwrXinmJjFc91620Ri0O79c8WZWfDdlQ=";
   };
 
   postPatch = ''
@@ -50,17 +51,19 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     isodate
     more-itertools
-    pathable
-    more-itertools
-    openapi-schema-validator
-    jsonschema-spec
-    openapi-spec-validator
-    typing-extensions
     parse
+    openapi-schema-validator
+    openapi-spec-validator
     werkzeug
+    jsonschema-spec
+    asgiref
+    jsonschema
   ];
 
   passthru.optional-dependencies = {
+    aiohttp = [
+      aiohttp
+    ];
     django = [
       django
     ];
@@ -80,7 +83,7 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    mock
+    pytest-aiohttp
     pytestCheckHook
     responses
     webob
diff --git a/pkgs/development/python-modules/openapi-schema-validator/default.nix b/pkgs/development/python-modules/openapi-schema-validator/default.nix
index 19b3e9cc3e74..39074543b42f 100644
--- a/pkgs/development/python-modules/openapi-schema-validator/default.nix
+++ b/pkgs/development/python-modules/openapi-schema-validator/default.nix
@@ -1,23 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+
+# build-system
 , poetry-core
-, pytestCheckHook
-, isodate
+
+# propagates
 , jsonschema
+, jsonschema-specifications
 , rfc3339-validator
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "openapi-schema-validator";
-  version = "0.4.4";
+  version = "0.6.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.8";
+
   src = fetchFromGitHub {
     owner = "p1c2u";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-2XTCdp9dfzhNKCpq71pt7yEZm9abiEmFHD/114W+jOQ=";
+    hash = "sha256-859v6KqIRfUq4d/KbkvGnGqlxz6BXTl+tKQHPhtkTH0=";
   };
 
   postPatch = ''
@@ -30,6 +39,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     jsonschema
+    jsonschema-specifications
     rfc3339-validator
   ];
 
@@ -40,6 +50,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "openapi_schema_validator" ];
 
   meta = with lib; {
+    changelog = "https://github.com/python-openapi/openapi-schema-validator/releases/tag/${version}";
     description = "Validates OpenAPI schema against the OpenAPI Schema Specification v3.0";
     homepage = "https://github.com/p1c2u/openapi-schema-validator";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/openapi-spec-validator/default.nix b/pkgs/development/python-modules/openapi-spec-validator/default.nix
index 5bcbca949fd1..847a9fdcbddf 100644
--- a/pkgs/development/python-modules/openapi-spec-validator/default.nix
+++ b/pkgs/development/python-modules/openapi-spec-validator/default.nix
@@ -2,6 +2,8 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+
+# build-system
 , poetry-core
 
 # propagates
@@ -10,31 +12,30 @@
 , jsonschema-spec
 , lazy-object-proxy
 , openapi-schema-validator
-, pyyaml
-
-# optional
-, requests
 
 # tests
-, mock
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "openapi-spec-validator";
-  version = "0.5.6";
+  version = "0.6.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   # no tests via pypi sdist
   src = fetchFromGitHub {
     owner = "p1c2u";
-    repo = pname;
+    repo = "openapi-spec-validator";
     rev = "refs/tags/${version}";
-    hash = "sha256-BIGHaZhrEc7wcIesBIXdVRzozllCNOz67V+LmQfZ8oY=";
+    hash = "sha256-sGr4dH6Twyi4OeCAXZiboN75dYZ6wJ0pWMzV9zOfee0=";
   };
 
+  postPatch = ''
+    sed -i '/--cov/d' pyproject.toml
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -48,14 +49,6 @@ buildPythonPackage rec {
     importlib-resources
   ];
 
-  passthru.optional-dependencies.requests = [
-    requests
-  ];
-
-  preCheck = ''
-    sed -i '/--cov/d' pyproject.toml
-  '';
-
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/oslotest/default.nix b/pkgs/development/python-modules/oslotest/default.nix
index aa646a08ee90..7d89f5778c73 100644
--- a/pkgs/development/python-modules/oslotest/default.nix
+++ b/pkgs/development/python-modules/oslotest/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , fixtures
 , pbr
+, six
 , subunit
 , callPackage
 }:
@@ -10,6 +11,7 @@
 buildPythonPackage rec {
   pname = "oslotest";
   version = "4.5.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
@@ -20,6 +22,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     fixtures
+    six
     subunit
   ];
 
diff --git a/pkgs/development/python-modules/packaging/default.nix b/pkgs/development/python-modules/packaging/default.nix
index e77c715e45ab..0c4678a460ac 100644
--- a/pkgs/development/python-modules/packaging/default.nix
+++ b/pkgs/development/python-modules/packaging/default.nix
@@ -10,14 +10,14 @@
 let
   packaging = buildPythonPackage rec {
     pname = "packaging";
-    version = "23.0";
+    version = "23.1";
     format = "pyproject";
 
     disabled = pythonOlder "3.7";
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-tq0pf4kH3g+i/hzL0m/a84f19Hxydf7fjM6J+ZRGz5c=";
+      hash = "sha256-o5KYDSts/6ZEQxiYvlSwBFFRMZ0efsNPDP7Uh2fdM08=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index d74c63b1030b..0c3b28d1d215 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -2,114 +2,218 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, python
 , pythonOlder
+
+# build-system
 , cython
+, setuptools
+, versioneer
+
+# propagates
 , numpy
 , python-dateutil
 , pytz
-# Test inputs
+, tzdata
+
+# optionals
+, beautifulsoup4
+, bottleneck
+, blosc2
+, brotlipy
+, fsspec
+, gcsfs
+, html5lib
+, jinja2
+, lxml
+, matplotlib
+, numba
+, numexpr
+, odfpy
+, openpyxl
+, psycopg2
+, pyarrow
+, pymysql
+, pyqt5
+, pyreadstat
+, python-snappy
+, qtpy
+, s3fs
+, scipy
+, sqlalchemy
+, tables
+, tabulate
+, xarray
+, xlrd
+, xlsxwriter
+, zstandard
+
+# tests
+, adv_cmds
+, glibc
 , glibcLocales
 , hypothesis
-, jinja2
 , pytestCheckHook
 , pytest-xdist
 , pytest-asyncio
-, xlsxwriter
-# Darwin inputs
+, python
 , runtimeShell
-, libcxx
 }:
 
 buildPythonPackage rec {
   pname = "pandas";
-  version = "1.5.3";
-  format = "setuptools";
+  version = "2.0.3";
+  format = "pyproject";
+
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dKP9flp+wFLxgyc9x7Cs06hj7fdSD106F2XAT/2zsLE=";
+    hash = "sha256-wC83Kojg0X820wk6ZExzz8F4jodqfEvLQCCndRLiBDw=";
   };
 
-  nativeBuildInputs = [ cython ];
+  nativeBuildInputs = [
+    setuptools
+    cython
+    numpy
+    versioneer
+  ] ++ versioneer.optional-dependencies.toml;
 
-  buildInputs = lib.optional stdenv.isDarwin libcxx;
+  enableParallelBuilding = true;
 
   propagatedBuildInputs = [
     numpy
     python-dateutil
     pytz
+    tzdata
   ];
 
-  nativeCheckInputs = [
-    glibcLocales
-    hypothesis
-    jinja2
-    pytest-asyncio
-    pytest-xdist
-    pytestCheckHook
-    xlsxwriter
-  ];
+  passthru.optional-dependencies = let
+    extras = {
+      aws = [
+        s3fs
+      ];
+      clipboard = [
+        pyqt5
+        qtpy
+      ];
+      compression = [
+        brotlipy
+        python-snappy
+        zstandard
+      ];
+      computation = [
+        scipy
+        xarray
+      ];
+      excel = [
+        odfpy
+        openpyxl
+        # TODO: pyxlsb
+        xlrd
+        xlsxwriter
+      ];
+      feather = [
+        pyarrow
+      ];
+      fss = [
+        fsspec
+      ];
+      gcp = [
+        gcsfs
+        # TODO: pandas-gqb
+      ];
+      hdf5 = [
+        blosc2
+        tables
+      ];
+      html = [
+        beautifulsoup4
+        html5lib
+        lxml
+      ];
+      mysql = [
+        sqlalchemy
+        pymysql
+      ];
+      output_formatting = [
+        jinja2
+        tabulate
+      ];
+      parquet = [
+        pyarrow
+      ];
+      performance = [
+        bottleneck
+        numba
+        numexpr
+      ];
+      plot = [
+        matplotlib
+      ];
+      postgresql = [
+        sqlalchemy
+        psycopg2
+      ];
+      spss = [
+        pyreadstat
+      ];
+      sql-other = [
+        sqlalchemy
+      ];
+      xml = [
+        lxml
+      ];
+    };
+  in extras // {
+    all = lib.concatLists (lib.attrValues extras);
+  };
 
   # Doesn't work with -Werror,-Wunused-command-line-argument
   # https://github.com/NixOS/nixpkgs/issues/39687
   hardeningDisable = lib.optional stdenv.cc.isClang "strictoverflow";
 
-  doCheck = !stdenv.isAarch32 && !stdenv.isAarch64; # upstream doesn't test this architecture
+  nativeCheckInputs = [
+    glibcLocales
+    hypothesis
+    pytest-asyncio
+    pytest-xdist
+    pytestCheckHook
+  ] ++ lib.optionals (stdenv.isLinux) [
+    # for locale executable
+    glibc
+  ] ++ lib.optionals (stdenv.isDarwin) [
+    # for locale executable
+    adv_cmds
+  ];
 
   # don't max out build cores, it breaks tests
   dontUsePytestXdist = true;
 
+  __darwinAllowLocalNetworking = true;
+
   pytestFlagsArray = [
     # https://github.com/pandas-dev/pandas/blob/main/test_fast.sh
     "--skip-db"
     "--skip-slow"
     "--skip-network"
-    "-m" "'not single_cpu'"
+    "-m" "'not single_cpu and not slow_arm'"
     "--numprocesses" "4"
   ];
 
   disabledTests = [
-    # Locale-related
-    "test_names"
-    "test_dt_accessor_datetime_name_accessors"
-    "test_datetime_name_accessors"
-    # Disable IO related tests because IO data is no longer distributed
-    "io"
-    # Tries to import from pandas.tests post install
-    "util_in_top_level"
-    # Tries to import compiled C extension locally
-    "test_missing_required_dependency"
-    # AssertionError with 1.2.3
-    "test_from_coo"
-    # AssertionError: No common DType exists for the given inputs
-    "test_comparison_invalid"
-    # AssertionError: Regex pattern '"quotechar" must be string, not int'
-    "python-kwargs2"
-    # Tests for rounding errors and fails if we have better precision
-    # than expected, e.g. on amd64 with FMA or on arm64
-    # https://github.com/pandas-dev/pandas/issues/38921
-    "test_rolling_var_numerical_issues"
-    # Requires mathplotlib
-    "test_subset_for_boolean_cols"
-    # DeprecationWarning from numpy
-    "test_sort_values_sparse_no_warning"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "test_locale"
-    "test_clipboard"
-    # ValueError: cannot reindex on an axis with duplicate labels
-    #
-    # Attempts to reproduce this problem outside of Hydra failed.
-    "test_reindex_timestamp_with_fold"
+    # AssertionError: Did not see expected warning of class 'FutureWarning'
+    "test_parsing_tzlocal_deprecated"
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+    # tests/generic/test_finalize.py::test_binops[and_-args4-right] - AssertionError: assert {} == {'a': 1}
+    "test_binops"
   ];
 
   # Tests have relative paths, and need to reference compiled C extensions
   # so change directory where `import .test` is able to be resolved
   preCheck = ''
-    cd $out/${python.sitePackages}/pandas
+    export HOME=$TMPDIR
     export LC_ALL="en_US.UTF-8"
-    PYTHONPATH=$out/${python.sitePackages}:$PYTHONPATH
+    cd $out/${python.sitePackages}/pandas
   ''
   # TODO: Get locale and clipboard support working on darwin.
   #       Until then we disable the tests.
@@ -121,19 +225,24 @@ buildPythonPackage rec {
     export PATH=$(pwd):$PATH
   '';
 
-  enableParallelBuilding = true;
-
-  pythonImportsCheck = [ "pandas" ];
+  pythonImportsCheck = [
+    "pandas"
+  ];
 
   meta = with lib; {
     # https://github.com/pandas-dev/pandas/issues/14866
     # pandas devs are no longer testing i686 so safer to assume it's broken
     broken = stdenv.isi686;
-    homepage = "https://pandas.pydata.org/";
     changelog = "https://pandas.pydata.org/docs/whatsnew/index.html";
-    description = "Python Data Analysis Library";
+    description = "Powerful data structures for data analysis, time series, and statistics";
+    downloadPage = "https://github.com/pandas-dev/pandas";
+    homepage = "https://pandas.pydata.org";
     license = licenses.bsd3;
+    longDescription = ''
+      Flexible and powerful data analysis / manipulation library for
+      Python, providing labeled data structures similar to R data.frame
+      objects, statistical functions, and much more.
+    '';
     maintainers = with maintainers; [ raskin fridh knedlsepp ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/pdm-backend/default.nix b/pkgs/development/python-modules/pdm-backend/default.nix
index eb1d1f3df3a1..96f626b24b61 100644
--- a/pkgs/development/python-modules/pdm-backend/default.nix
+++ b/pkgs/development/python-modules/pdm-backend/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pdm-backend";
-  version = "2.1.1";
+  version = "2.1.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pdm-project";
     repo = "pdm-backend";
     rev = "refs/tags/${version}";
-    hash = "sha256-g8VL5nO180XplMgbbeeJIp6lmbWcMKdY/IftlkL6e5U=";
+    hash = "sha256-46HTamiy+8fiGVeviYqXsjwu+PEBE38y19cBVRc+zm0=";
   };
 
   env.PDM_BUILD_SCM_VERSION = version;
diff --git a/pkgs/development/python-modules/pdm-pep517/default.nix b/pkgs/development/python-modules/pdm-pep517/default.nix
index f07e3ca82faa..be5573a0055c 100644
--- a/pkgs/development/python-modules/pdm-pep517/default.nix
+++ b/pkgs/development/python-modules/pdm-pep517/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pdm-pep517";
-  version = "1.1.2";
+  version = "1.1.4";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1PpzWmRffpWmvrNKK19+jgDZPdBDnXPzHMguQLW4/c4=";
+    hash = "sha256-f0kSHnC0Lcopb6yWIhDdLaB6OVdfxWcxN61mFjOyzz8=";
   };
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 5c2fd2314659..66d7cf680bfd 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -4,7 +4,6 @@
 , fetchFromGitHub
 , hypothesis
 , pythonOlder
-, importlib-metadata
 , jbig2dec
 , deprecation
 , lxml
@@ -19,14 +18,13 @@
 , python-xmp-toolkit
 , qpdf
 , setuptools
-, setuptools-scm
 , substituteAll
 , wheel
 }:
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "7.2.0";
+  version = "8.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -41,7 +39,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-acGIhIWC1nUQiN0iwb1kLKxz+ytIqYIW4VXF45Tx50g=";
+    hash = "sha256-8uPPEoLxoMRq/tkpThatwjPHZIMYQ8lNL6fLcG+nsnw=";
   };
 
   patches = [
@@ -57,8 +55,6 @@ buildPythonPackage rec {
       --replace "shims_enabled = not cflags_defined" "shims_enabled = False"
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     qpdf
   ];
@@ -66,7 +62,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     pybind11
     setuptools
-    setuptools-scm
     wheel
   ];
 
@@ -85,8 +80,6 @@ buildPythonPackage rec {
     lxml
     packaging
     pillow
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-metadata
   ];
 
   pythonImportsCheck = [ "pikepdf" ];
diff --git a/pkgs/development/python-modules/pilkit/default.nix b/pkgs/development/python-modules/pilkit/default.nix
index 843f9dfdf241..1b17e2411536 100644
--- a/pkgs/development/python-modules/pilkit/default.nix
+++ b/pkgs/development/python-modules/pilkit/default.nix
@@ -33,6 +33,8 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace tox.ini \
       --replace " --cov --cov-report term-missing:skip-covered" ""
+    substituteInPlace pilkit/processors/resize.py \
+      --replace "Image.ANTIALIAS" "Image.Resampling.LANCZOS"
   '';
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index b3ff63b1fb93..f1489e1f458d 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -13,25 +13,17 @@
 
 import ./generic.nix (rec {
   pname = "pillow";
-  version = "9.5.0";
-  format = "setuptools";
+  version = "10.0.0";
+  format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "Pillow";
     inherit version;
-    hash = "sha256-v1SEedM2cm16Ds6252fhefveN4M65CeUYCYxoHDWMPE=";
+    hash = "sha256-nIK1s+BDx68NlXktDSDM9o9hof7Gs1MOcYtohCJyc5Y=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Fixed type handling for include and lib directories; Remove with 10.0.0
-      url = "https://github.com/python-pillow/Pillow/commit/0ec0a89ead648793812e11739e2a5d70738c6be5.patch";
-      hash = "sha256-m5R5fLflnbJXbRxFlTjT2X3nKdC05tippMoJUDsJmy0=";
-    })
-  ];
-
   passthru.tests = {
     inherit imageio matplotlib pilkit pydicom reportlab;
   };
diff --git a/pkgs/development/python-modules/pint/default.nix b/pkgs/development/python-modules/pint/default.nix
index 2259ecf655d7..9252a2a5fbe1 100644
--- a/pkgs/development/python-modules/pint/default.nix
+++ b/pkgs/development/python-modules/pint/default.nix
@@ -2,10 +2,15 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+
+# build-system
+, setuptools
 , setuptools-scm
-, importlib-metadata
-, packaging
-# Check Inputs
+
+# propagates
+, typing-extensions
+
+# tests
 , pytestCheckHook
 , pytest-subtests
 , numpy
@@ -15,20 +20,25 @@
 
 buildPythonPackage rec {
   pname = "pint";
-  version = "0.20.1";
+  version = "0.22";
+  format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit version;
     pname = "Pint";
-    hash = "sha256-OHzwQHjcff5KcIAzuq1Uq2HYKrBsTuPUkiseRdViYGc=";
+    hash = "sha256-LROfarvPMBbK19POwFcH/pCKxPmc9Zrt/W7mZ7emRDM=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [ packaging ]
-    ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+  propagatedBuildInputs = [
+    typing-extensions
+  ];
 
   nativeCheckInputs = [
     pytestCheckHook
@@ -38,13 +48,17 @@ buildPythonPackage rec {
     uncertainties
   ];
 
-  dontUseSetuptoolsCheck = true;
-
   preCheck = ''
     export HOME=$(mktemp -d)
   '';
 
+  disabledTests = [
+    # https://github.com/hgrecco/pint/issues/1825
+    "test_equal_zero_nan_NP"
+  ];
+
   meta = with lib; {
+    changelog = "https://github.com/hgrecco/pint/blob/${version}/CHANGES";
     description = "Physical quantities module";
     license = licenses.bsd3;
     homepage = "https://github.com/hgrecco/pint/";
diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index 9d2deb68d442..f64a76d3e625 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "3.5.1";
+  version = "3.9.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-/qi22jiF+P7XcG/D+dxoOrHk89amdBoGewrTqZZOsoM=";
+    hash = "sha256-gBiXdnBWp0SlpE6TQPONTXEsQ2XFGCANGdNM/gv7V5s=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pluggy/default.nix b/pkgs/development/python-modules/pluggy/default.nix
index 46aebb519500..e6473e98a282 100644
--- a/pkgs/development/python-modules/pluggy/default.nix
+++ b/pkgs/development/python-modules/pluggy/default.nix
@@ -1,31 +1,40 @@
 { buildPythonPackage
 , lib
-, fetchPypi
+, fetchFromGitHub
 , setuptools-scm
 , pythonOlder
 , importlib-metadata
+, callPackage
 }:
 
 buildPythonPackage rec {
   pname = "pluggy";
-  version = "1.0.0";
+  version = "1.2.0";
   format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "4224373bacce55f955a878bf9cfa763c1e360858e330072059e10bad68531159";
+  src = fetchFromGitHub {
+    owner = "pytest-dev";
+    repo = "pluggy";
+    rev = "refs/tags/${version}";
+    hash = "sha256-SzJu7ITdmUgusn8sz6fRBpxTMQncWIViP5NCAj4q4GM=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
 
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
     importlib-metadata
   ];
 
   # To prevent infinite recursion with pytest
   doCheck = false;
+  passthru.tests = {
+    pytest = callPackage ./tests.nix { };
+  };
 
   meta = {
+    changelog = "https://github.com/pytest-dev/pluggy/blob/${src.rev}/CHANGELOG.rst";
     description = "Plugin and hook calling mechanisms for Python";
     homepage = "https://github.com/pytest-dev/pluggy";
     license = lib.licenses.mit;
diff --git a/pkgs/development/python-modules/pluggy/tests.nix b/pkgs/development/python-modules/pluggy/tests.nix
new file mode 100644
index 000000000000..dc6e16e7b2d7
--- /dev/null
+++ b/pkgs/development/python-modules/pluggy/tests.nix
@@ -0,0 +1,20 @@
+{ buildPythonPackage
+, pluggy
+, pytestCheckHook
+}:
+
+buildPythonPackage {
+  pname = "pluggy-tests";
+  inherit (pluggy) version;
+  format = "other";
+
+  inherit (pluggy) src;
+
+  dontBuild = true;
+  dontInstall = true;
+
+  nativeCheckInputs = [
+    pluggy
+    pytestCheckHook
+  ];
+}
diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index daf45528202f..270c78a69826 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -11,7 +11,6 @@
 , pytest-mock
 , pytestCheckHook
 , setuptools
-, tomlkit
 , virtualenv
 }:
 
@@ -54,7 +53,6 @@ buildPythonPackage rec {
     pytest-mock
     pytestCheckHook
     setuptools
-    tomlkit
     virtualenv
   ];
 
diff --git a/pkgs/development/python-modules/prance/default.nix b/pkgs/development/python-modules/prance/default.nix
index 572e1efceb67..1fffa8cde714 100644
--- a/pkgs/development/python-modules/prance/default.nix
+++ b/pkgs/development/python-modules/prance/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "prance";
-  version = "0.22.02.22.0";
+  version = "23.06.21.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-NtIbZp34IcMYJzaNQVL9GLdNS3NYOCRoWS1wGg/gLVA=";
+    hash = "sha256-p+LZbQal4DPeMp+eJ2O83rCaL+QIUDcU34pZhYdN4bE=";
   };
 
   postPatch = ''
@@ -70,6 +70,7 @@ buildPythonPackage rec {
     "test_convert_defaults"
     "test_convert_output"
     "test_fetch_url_http"
+    "test_openapi_spec_validator_validate_failure"
   ];
   pythonImportsCheck = [ "prance" ];
 
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index ef112d3bb617..7ba24e4bd526 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -24,13 +24,13 @@
   } ./setup-hook.sh;
 in buildPythonPackage rec {
   pname = "pybind11";
-  version = "2.10.4";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "pybind";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-n7nLEG2+sSR9wnxM+C8FWc2B+Mx74Pan1+IQf+h2bGU=";
+    hash = "sha256-sO/Fa+QrAKyq2EYyYMcjPrYI+bdJIrDoj6L3JHoDo3E=";
   };
 
   postPatch = ''
@@ -87,7 +87,7 @@ in buildPythonPackage rec {
     "tests/extra_setuptools/test_setuphelper.py"
   ];
 
-  disabledTests = lib.optionals (stdenv.isDarwin) [
+  disabledTests = lib.optionals stdenv.isDarwin [
     # expects KeyError, gets RuntimeError
     # https://github.com/pybind/pybind11/issues/4243
     "test_cross_module_exception_translator"
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index f07c8062c108..47e90eb8726a 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -10,14 +10,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pycryptodome";
-  version = "3.17.0";
+  version = "3.18.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Legrandin";
     repo = "pycryptodome";
-    rev = "v${version}";
-    hash = "sha256-xsfd+dbaNOPuD0ulvpLPBPtcFgmJqX1VuunwNMcqh+Q=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6oXXy18KlSjfyZhfMnIgnu34u/9sG0TPYvPJ8ovTqMA=";
   };
 
   postPatch = ''
@@ -36,6 +36,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Self-contained cryptographic library";
     homepage = "https://github.com/Legrandin/pycryptodome";
+    changelog = "https://github.com/Legrandin/pycryptodome/blob/v${version}/Changelog.rst";
     license = with licenses; [ bsd2 /* and */ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pydantic-core/01-remove-benchmark-flags.patch b/pkgs/development/python-modules/pydantic-core/01-remove-benchmark-flags.patch
new file mode 100644
index 000000000000..a5c27e469a92
--- /dev/null
+++ b/pkgs/development/python-modules/pydantic-core/01-remove-benchmark-flags.patch
@@ -0,0 +1,18 @@
+diff --git a/pyproject.toml b/pyproject.toml
+index 1602e32..507048d 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -72,13 +72,6 @@ filterwarnings = [
+ ]
+ timeout = 30
+ xfail_strict = true
+-# min, max, mean, stddev, median, iqr, outliers, ops, rounds, iterations
+-addopts = [
+-    '--benchmark-columns', 'min,mean,stddev,outliers,rounds,iterations',
+-    '--benchmark-group-by', 'group',
+-    '--benchmark-warmup', 'on',
+-    '--benchmark-disable',  # this is enable by `make benchmark` when you actually want to run benchmarks
+-]
+ 
+ [tool.coverage.run]
+ source = ['pydantic_core']
diff --git a/pkgs/development/python-modules/pydantic-core/Cargo.lock b/pkgs/development/python-modules/pydantic-core/Cargo.lock
new file mode 100644
index 000000000000..05a29d770d83
--- /dev/null
+++ b/pkgs/development/python-modules/pydantic-core/Cargo.lock
@@ -0,0 +1,662 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ahash"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
+dependencies = [
+ "cfg-if",
+ "getrandom",
+ "once_cell",
+ "version_check",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43f6cb1bf222025340178f382c426f13757b2960e89779dfcb319c32542a5a41"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "base64"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cc"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "enum_dispatch"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f33313078bb8d4d05a2733a94ac4c2d8a0df9a2b84424ebf4f33bfc224a890e"
+dependencies = [
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.25",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "idna"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "idna"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5477fe2230a79769d8dc68e0eabf5437907c0457a5614a9e8dddb67f65eb65d"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "indoc"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa799dd5ed20a7e349f3b4639aa80d74549c81716d9ec4f994c9b5815598306"
+
+[[package]]
+name = "itoa"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b02a5381cc465bd3041d84623d0fa3b66738b52b8e2fc3bab8ad63ab032f4a"
+
+[[package]]
+name = "libc"
+version = "0.2.147"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+
+[[package]]
+name = "libmimalloc-sys"
+version = "0.1.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4ac0e912c8ef1b735e92369695618dc5b1819f5a7bf3f167301a3ba1cea515e"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "memoffset"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mimalloc"
+version = "0.1.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e2894987a3459f3ffb755608bd82188f8ed00d0ae077f1edea29c068d639d98"
+dependencies = [
+ "libmimalloc-sys",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f93ab6289c7b344a8a9f60f88d80aa20032336fe78da341afc91c8a2341fc75f"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-targets",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78803b62cbf1f46fde80d7c0e803111524b9877184cfe7c3033659490ac7a7da"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pydantic-core"
+version = "2.3.0"
+dependencies = [
+ "ahash",
+ "base64",
+ "enum_dispatch",
+ "idna 0.3.0",
+ "mimalloc",
+ "num-bigint",
+ "pyo3",
+ "pyo3-build-config",
+ "python3-dll-a",
+ "regex",
+ "serde",
+ "serde_json",
+ "speedate",
+ "strum",
+ "strum_macros 0.24.3",
+ "url",
+ "version_check",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffb88ae05f306b4bfcde40ac4a51dc0b05936a9207a4b75b798c7729c4258a59"
+dependencies = [
+ "cfg-if",
+ "indoc",
+ "libc",
+ "memoffset",
+ "num-bigint",
+ "parking_lot",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+ "unindent",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "554db24f0b3c180a9c0b1268f91287ab3f17c162e15b54caaae5a6b3773396b0"
+dependencies = [
+ "once_cell",
+ "python3-dll-a",
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "922ede8759e8600ad4da3195ae41259654b9c55da4f7eec84a0ccc7d067a70a4"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a5caec6a1dd355964a841fcbeeb1b89fe4146c87295573f94228911af3cc5a2"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0b78ccbb160db1556cdb6fd96c50334c5d4ec44dc5e0a968d0a1208fa0efa8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "python3-dll-a"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5f07cd4412be8fa09a721d40007c483981bbe072cd6a21f2e83e04ec8f8343f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "573015e8ab27661678357f27dc26460738fd2b6c86e46f386fde94cb5d913105"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2eae68fc220f7cf2532e4494aded17545fce192d59cd996e0fe7887f4ceb575"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83d3daa6976cffb758ec878f108ba0e062a45b2d6ca3a2cca965338855476caf"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"
+
+[[package]]
+name = "rustversion"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc31bd9b61a32c31f9650d18add92aa83a49ba979c143eefd27fe7177b05bd5f"
+
+[[package]]
+name = "ryu"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe232bdf6be8c8de797b22184ee71118d63780ea42ac85b61d1baa6d3b782ae9"
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.171"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30e27d1e4fd7659406c492fd6cfaf2066ba8773de45ca75e855590f856dc34a9"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.171"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389894603bd18c46fa56231694f8d827779c0951a667087194cf9de94ed24682"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.25",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f1e14e89be7aa4c4b78bdbdc9eb5bf8517829a600ae8eaa39a6e1d960b5185c"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
+
+[[package]]
+name = "speedate"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e54e4ea42510cf6cb46223f6974670faf58ef49e82040e924a295aa3f0c8eaa2"
+dependencies = [
+ "strum",
+ "strum_macros 0.25.1",
+]
+
+[[package]]
+name = "strum"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290d54ea6f91c969195bdbcd7442c8c2a2ba87da8bf60a7ee86a235d4bc1e125"
+dependencies = [
+ "strum_macros 0.25.1",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.24.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e385be0d24f186b4ce2f9982191e7101bb737312ad61c1f2f984f34bcf85d59"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6069ca09d878a33f883cc06aaa9718ede171841d3832450354410b718b097232"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 2.0.25",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15e3fc8c0c74267e2df136e5e5fb656a464158aa57624053375eb9c8c6e25ae2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df8e77cb757a61f51b947ec4a7e3646efd825b73561db1c232a8ccb639e611a0"
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22049a19f4a68748a168c0fc439f9516686aa045927ff767eca0a85101fb6e73"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unindent"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1766d682d402817b5ac4490b3c3002d91dfa0d22812f341609f97b08757359c"
+
+[[package]]
+name = "url"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50bff7831e19200a85b17131d085c25d7811bc4e186efdaf54bbd132994a88cb"
+dependencies = [
+ "form_urlencoded",
+ "idna 0.4.0",
+ "percent-encoding",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "windows-targets"
+version = "0.48.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05d4b17490f70499f20b9e791dcf6a299785ce8af4d709018206dc5b4953e95f"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
diff --git a/pkgs/development/python-modules/pydantic-core/default.nix b/pkgs/development/python-modules/pydantic-core/default.nix
new file mode 100644
index 000000000000..c61a060fd432
--- /dev/null
+++ b/pkgs/development/python-modules/pydantic-core/default.nix
@@ -0,0 +1,71 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, cargo
+, rustPlatform
+, rustc
+, typing-extensions
+, pytestCheckHook
+, hypothesis
+, pytest-timeout
+, pytest-mock
+, dirty-equals
+}:
+
+buildPythonPackage rec {
+  pname = "pydantic-core";
+  version = "2.3.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "pydantic";
+    repo = "pydantic-core";
+    rev = "v${version}";
+    hash = "sha256-Wi+b+xiJtVi3KIy6bzT29kyHFSI7mbMNrLa/Iu3cTEY=";
+  };
+
+  patches = [
+    ./01-remove-benchmark-flags.patch
+  ];
+
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+  };
+
+  nativeBuildInputs = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+    typing-extensions
+  ];
+
+  propagatedBuildInputs = [
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "pydantic_core" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    hypothesis
+    pytest-timeout
+    dirty-equals
+    pytest-mock
+  ];
+  disabledTests = [
+    # RecursionError: maximum recursion depth exceeded while calling a Python object
+    "test_recursive"
+  ];
+  disabledTestPaths = [
+    # no point in benchmarking in nixpkgs build farm
+    "tests/benchmarks"
+  ];
+
+  meta = with lib; {
+    description = "Core validation logic for pydantic written in rust";
+    homepage = "https://github.com/pydantic/pydantic-core";
+    license = licenses.mit;
+    maintainers = with maintainers; [ blaggacao ];
+  };
+}
diff --git a/pkgs/development/python-modules/pydevd/default.nix b/pkgs/development/python-modules/pydevd/default.nix
index cc79c43febd7..8ee2f8d98acf 100644
--- a/pkgs/development/python-modules/pydevd/default.nix
+++ b/pkgs/development/python-modules/pydevd/default.nix
@@ -2,6 +2,7 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , numpy
 , psutil
 , pytestCheckHook
@@ -24,6 +25,17 @@ buildPythonPackage rec {
     hash = "sha256-TDU/V7kY7zVxiP4OVjGqpsRVYplpkgCly2qAOqhZONo=";
   };
 
+  patches = [
+    # https://github.com/fabioz/PyDev.Debugger/pull/258
+    (fetchpatch {
+      name = "numpy-1.25-test-compatibility.patch";
+      url = "https://github.com/fabioz/PyDev.Debugger/commit/6f637d951cda62dc2202a2c7b6af526c4d1e8a00.patch";
+      hash = "sha256-DLzZZwQHtqGZGA8nsBLNQqamuI4xUfQ89Gd21sJa9/s=";
+    })
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     numpy
     psutil
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index 0ce6dc642448..c7e4979d1372 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -6,7 +6,7 @@
 , cffi
 , fetchPypi
 , isPyPy
-, libgit2
+, libgit2_1_6
 , pycparser
 , pytestCheckHook
 , pythonOlder
@@ -25,11 +25,11 @@ buildPythonPackage rec {
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
-    export DYLD_LIBRARY_PATH="${libgit2}/lib"
+    export DYLD_LIBRARY_PATH="${libgit2_1_6}/lib"
   '';
 
   buildInputs = [
-    libgit2
+    libgit2_1_6
   ];
 
   propagatedBuildInputs = [
@@ -58,14 +58,6 @@ buildPythonPackage rec {
   # https://github.com/NixOS/nixpkgs/pull/72544#issuecomment-582674047
   SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
-  # setup.py check is broken
-  # https://github.com/libgit2/pygit2/issues/868
-  dontUseSetuptoolsCheck = true;
-
-  # TODO: Test collection is failing
-  # https://github.com/NixOS/nixpkgs/pull/72544#issuecomment-582681068
-  doCheck = false;
-
   pythonImportsCheck = [
     "pygit2"
   ];
diff --git a/pkgs/development/python-modules/pygments-better-html/default.nix b/pkgs/development/python-modules/pygments-better-html/default.nix
index 152e9463b0e2..635707160305 100644
--- a/pkgs/development/python-modules/pygments-better-html/default.nix
+++ b/pkgs/development/python-modules/pygments-better-html/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pygments_better_html";
-  version = "0.1.4";
+  version = "0.1.5";
   disabled = ! isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "028szd3k295yhz943bj19i4kx6f0pfh1fd2q14id0g84dl4i49dm";
+    sha256 = "sha256-SLAe5ubIGEchUNoHCct6CWisBja3WNEfpE48v9CTzPQ=";
   };
 
   propagatedBuildInputs = [ pygments ];
diff --git a/pkgs/development/python-modules/pygments/default.nix b/pkgs/development/python-modules/pygments/default.nix
index a7b2acd55ca9..8f32d26ebc24 100644
--- a/pkgs/development/python-modules/pygments/default.nix
+++ b/pkgs/development/python-modules/pygments/default.nix
@@ -1,8 +1,11 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, docutils
-, lxml
+
+# build-system
+, setuptools
+
+# tests
 , pytestCheckHook
 , wcag-contrast-ratio
 }:
@@ -10,22 +13,23 @@
 let pygments = buildPythonPackage
   rec {
     pname = "pygments";
-    version = "2.14.0";
+    version = "2.15.1";
+    format = "pyproject";
 
     src = fetchPypi {
       pname = "Pygments";
       inherit version;
-      hash = "sha256-s+0GqeismpquWm9dvniopYZV0XtDuTwHjwlN3Edq4pc=";
+      hash = "sha256-is5NPB3UgYlLIAX1YOrQ+fGe5k/pgzZr4aIeFx0Sd1w=";
     };
 
-    propagatedBuildInputs = [
-      docutils
+    nativeBuildInputs = [
+      setuptools
     ];
 
     # circular dependencies if enabled by default
     doCheck = false;
+
     nativeCheckInputs = [
-      lxml
       pytestCheckHook
       wcag-contrast-ratio
     ];
@@ -35,13 +39,16 @@ let pygments = buildPythonPackage
       "tests/examplefiles/bash/ltmain.sh"
     ];
 
-    pythonImportsCheck = [ "pygments" ];
+    pythonImportsCheck = [
+      "pygments"
+    ];
 
     passthru.tests = {
       check = pygments.overridePythonAttrs (_: { doCheck = true; });
     };
 
     meta = with lib; {
+      changelog = "https://github.com/pygments/pygments/releases/tag/${version}";
       homepage = "https://pygments.org/";
       description = "A generic syntax highlighter";
       mainProgram = "pygmentize";
diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 55e682e07414..cef52b754ad6 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyjwt";
-  version = "2.7.0";
+  version = "2.8.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyJWT";
     inherit version;
-    hash = "sha256-vWyko8QoXBotQ0nloDX9+PuU4EzND8vmuiidrpzD4HQ=";
+    hash = "sha256-V+KNFW49XBAIjgxoq7kL+sPfgrQKcb0NqiDGXM1cI94=";
   };
 
   postPatch = ''
@@ -45,6 +45,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ (lib.flatten (lib.attrValues passthru.optional-dependencies));
 
+  disabledTests = [
+    # requires internet connection
+    "test_get_jwt_set_sslcontext_default"
+  ];
+
   pythonImportsCheck = [ "jwt" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 7ce16743125a..a3e7184f715e 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "pylint";
-  version = "2.16.2";
+  version = "2.17.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7.2";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-xNCGf4CsxEKScIn6dl2Ka31P6bhMo5fTs9TIQz+vPiM=";
+    hash = "sha256-cmH6Q6/XJXx8EXDIsik1Aheu9hYGvvlNvWBUCdmC3P8=";
   };
 
   nativeBuildInputs = [
@@ -68,6 +68,7 @@ buildPythonPackage rec {
     # implementation relies on the '__implements__'  attribute proposed
     # in PEP 245, which was rejected in 2006.
     "-W" "ignore::DeprecationWarning"
+    "-v"
   ];
 
   dontUseSetuptoolsCheck = true;
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index db77f854dbb3..4e67fd0783d5 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pyopenssl";
-  version = "23.1.1";
+  version = "23.2.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "pyOpenSSL";
     inherit version;
-    hash = "sha256-hBSYub7GFiOxtsR+u8AjZ8B9YODhlfGXkIF/EMyNsLc=";
+    hash = "sha256-J2+TH1WkUufeppxxc+mE6ypEB85BPJGKo0tV+C+bi6w=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/pyopnsense/default.nix b/pkgs/development/python-modules/pyopnsense/default.nix
index c7abf88c3da7..a1df192ac223 100644
--- a/pkgs/development/python-modules/pyopnsense/default.nix
+++ b/pkgs/development/python-modules/pyopnsense/default.nix
@@ -4,10 +4,10 @@
 , fixtures
 , mock
 , pbr
-, pytest-cov
 , pytestCheckHook
 , pythonOlder
 , requests
+, testtools
 }:
 
 buildPythonPackage rec {
@@ -29,8 +29,8 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     fixtures
     mock
-    pytest-cov
     pytestCheckHook
+    testtools
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pytest-asyncio/default.nix b/pkgs/development/python-modules/pytest-asyncio/default.nix
index e13f67ec83b5..96179595a9ae 100644
--- a/pkgs/development/python-modules/pytest-asyncio/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-asyncio";
-  version = "0.20.3";
+  version = "0.21.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pytest-dev";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-oq28wJ/Tq4yuQ/98tdzYKDyatpliS0Xcbc6T46ZTP7I=";
+    hash = "sha256-Wpo8MpCPGiXrckT2x5/yBYtGlzso/L2urG7yGc7SPkA=";
   };
 
   outputs = [
@@ -54,7 +54,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for testing asyncio code with pytest";
     homepage = "https://github.com/pytest-dev/pytest-asyncio";
-    changelog = "https://github.com/pytest-dev/pytest-asyncio/blob/v${version}/CHANGELOG.rst";
+    changelog = "https://github.com/pytest-dev/pytest-asyncio/blob/v${version}/docs/source/reference/changelog.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/pytest-asyncio/tests.nix b/pkgs/development/python-modules/pytest-asyncio/tests.nix
index 94e6e1855afb..7fd26c85488d 100644
--- a/pkgs/development/python-modules/pytest-asyncio/tests.nix
+++ b/pkgs/development/python-modules/pytest-asyncio/tests.nix
@@ -10,6 +10,8 @@ buildPythonPackage {
   pname = "pytest-asyncio-tests";
   inherit (pytest-asyncio) version;
 
+  format = "other";
+
   src = pytest-asyncio.testout;
 
   dontBuild = true;
diff --git a/pkgs/development/python-modules/pytest-cov/default.nix b/pkgs/development/python-modules/pytest-cov/default.nix
index dd93d6bac25b..7df529a83738 100644
--- a/pkgs/development/python-modules/pytest-cov/default.nix
+++ b/pkgs/development/python-modules/pytest-cov/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pytest-cov";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mWt5795kM829AIiHLbxfs+1/4VeLaM27pjTxS7jdBHA=";
+    hash = "sha256-OQSxPfv+xH8AO453/VtYnNEZBKId3xqzimTyBNahDvY=";
   };
 
   buildInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/pytest-env/default.nix b/pkgs/development/python-modules/pytest-env/default.nix
index 3d68c2dccc46..1d03413290a7 100644
--- a/pkgs/development/python-modules/pytest-env/default.nix
+++ b/pkgs/development/python-modules/pytest-env/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "pytest-env";
-  version = "0.8.1";
+  version = "0.8.2";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "pytest_env";
     inherit version;
-    hash = "sha256-17L1Jz7G0eIhdXmYvC9Q0kdO19C5MxuSVWAR+txOmr8=";
+    hash = "sha256-uu2bO2uud711uSOODtHuaQOkKAaunWrv+4dUzVWE1P8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-factoryboy/default.nix b/pkgs/development/python-modules/pytest-factoryboy/default.nix
index 77290573dc16..efde539cb23f 100644
--- a/pkgs/development/python-modules/pytest-factoryboy/default.nix
+++ b/pkgs/development/python-modules/pytest-factoryboy/default.nix
@@ -1,42 +1,59 @@
 { lib
 , buildPythonPackage
-, factory_boy
 , fetchFromGitHub
-, inflection
-, mock
+
+# build-system
+, poetry-core
+
+# unpropagated
 , pytest
-, pytestcache
+
+# propagated
+, inflection
+, factory_boy
+, typing-extensions
+
+# tests
 , pytestCheckHook
-, pytest-cov
 }:
 
 buildPythonPackage rec {
   pname = "pytest-factoryboy";
-  version = "2.1.0";
+  version = "2.5.1";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = "pytest-factoryboy";
     rev = version;
-    sha256 = "0v6b4ly0p8nknpnp3f4dbslfsifzzjx2vv27rfylx04kzdhg4m9p";
+    sha256 = "sha256-zxgezo2PRBKs0mps0qdKWtBygunzlaxg8s9BoBaU1Ig=";
   };
 
-  buildInputs = [ pytest ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  buildInputs = [
+    pytest
+  ];
 
   propagatedBuildInputs = [
     factory_boy
     inflection
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [
+    "pytest_factoryboy"
   ];
 
   nativeCheckInputs = [
-    mock
     pytestCheckHook
-    pytestcache
-    pytest-cov
   ];
 
-  pytestFlagsArray = [ "--ignore=docs" ];
-  pythonImportsCheck = [ "pytest_factoryboy" ];
+  pytestFlagsArray = [
+    "--ignore=docs"
+  ];
 
   meta = with lib; {
     description = "Integration of factory_boy into the pytest runner";
diff --git a/pkgs/development/python-modules/pytest-httpserver/default.nix b/pkgs/development/python-modules/pytest-httpserver/default.nix
index feae84901304..01ef1025904e 100644
--- a/pkgs/development/python-modules/pytest-httpserver/default.nix
+++ b/pkgs/development/python-modules/pytest-httpserver/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-httpserver";
-  version = "1.0.6";
+  version = "1.0.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "csernazs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-LY5Ur0cIcsNrgvyQlY2E479ZzRcuwqTuiT2MtRupVcs=";
+    hash = "sha256-bjysG+7niSUBl8YMWR8pr7oOz9GDbSfq3PeloYBkq3s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-metadata/default.nix b/pkgs/development/python-modules/pytest-metadata/default.nix
index 7d1ec8696c21..7b4a285e3552 100644
--- a/pkgs/development/python-modules/pytest-metadata/default.nix
+++ b/pkgs/development/python-modules/pytest-metadata/default.nix
@@ -1,16 +1,16 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, poetry-core
+, hatch-vcs
+, hatchling
 , pytest
 , pytestCheckHook
 , pythonOlder
-, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "pytest-metadata";
-  version = "2.0.4";
+  version = "3.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,12 +18,12 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pytest_metadata";
     inherit version;
-    hash = "sha256-/MZT9l/jA1tHiCC1KE+/D1KANiLuP2Ci+u16fTuh9B4=";
+    hash = "sha256-dpqcZdKIS9WDvGJrCs53rRXb4C3ZGpEG1H/UbZwlaco=";
   };
 
   nativeBuildInputs = [
-    poetry-core
-    setuptools-scm
+    hatchling
+    hatch-vcs
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pytest-mock/default.nix b/pkgs/development/python-modules/pytest-mock/default.nix
index 7dc15e3cd276..260c71ac71ff 100644
--- a/pkgs/development/python-modules/pytest-mock/default.nix
+++ b/pkgs/development/python-modules/pytest-mock/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-mock";
-  version = "3.10.0";
+  version = "3.11.1";
 
   disabled = pythonOlder "3.7";
 
@@ -19,17 +19,9 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+72whe98JSoyb9jNysCqOxMz2IEfExvcxwEALhvn7U8=";
+    hash = "sha256-f2sSVgKsbXQ+Ujrgv6ceGml6L1U0BkUoxv+EwvfC/H8=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Remove unnecessary py.code import
-      url = "https://github.com/pytest-dev/pytest-mock/pull/328/commits/e2016928db1147a2a46de6ee9fa878ca0e9d8fc8.patch";
-      hash = "sha256-5Gpzi7h7Io1CMykmBCZR/upM8E9isc3jEItYgwjEOWA=";
-    })
-  ];
-
   nativeBuildInputs = [ setuptools-scm ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pytest-randomly/default.nix b/pkgs/development/python-modules/pytest-randomly/default.nix
index 7e05104ff637..7c723e4cdc25 100644
--- a/pkgs/development/python-modules/pytest-randomly/default.nix
+++ b/pkgs/development/python-modules/pytest-randomly/default.nix
@@ -8,22 +8,27 @@
 , pytest-xdist
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pytest-randomly";
-  version = "3.12.0";
-  format = "setuptools";
+  version = "3.13.0";
+  format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     repo = pname;
     owner = "pytest-dev";
     rev = version;
-    hash = "sha256-n/Xp/HghqcQUreez+QbR3Mi5hE1U4zoOJCdFqD+pVBk=";
+    hash = "sha256-bxbW22Nf/0hfJYSiz3xdrNCzrb7vZwuVvSIrWl0Bkv4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ];
@@ -47,6 +52,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/pytest-dev/pytest-randomly/blob/${version}/CHANGELOG.rst";
     description = "Pytest plugin to randomly order tests and control random.seed";
     homepage = "https://github.com/pytest-dev/pytest-randomly";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index a0aac8a9d08a..f030960df655 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "11.1.2";
+  version = "12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VWEWYehz8cr6OEyC8I0HiDlU9LdkNfS4pbRwwZVFc94=";
+    hash = "sha256-eE9GL6h/6b33gdACfYVrR6S/5sEq8Qj2vYhwV6kXtI4=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pytest-subtests/default.nix b/pkgs/development/python-modules/pytest-subtests/default.nix
index 0da33a770068..b391ece3556a 100644
--- a/pkgs/development/python-modules/pytest-subtests/default.nix
+++ b/pkgs/development/python-modules/pytest-subtests/default.nix
@@ -3,22 +3,24 @@
 , fetchPypi
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "pytest-subtests";
-  version = "0.10.0";
-  format = "setuptools";
+  version = "0.11.0";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2ZYaZ8F5HoweMtznpw7R5U87HmQQh/IJTy03CHq3+xc=";
+    hash = "sha256-UYZciEV1RfUftyARlC8KPGkB7p4ky/ttG53BNIuvvjc=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index 61f12a792d98..5c260f432161 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-xdist";
-  version = "3.2.1";
+  version = "3.3.1";
   disabled = pythonOlder "3.7";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GEm9mNiyQrlI5HLbdHjgkL8zYZEqj+2HmS7ZQIX1Ryc=";
+    hash = "sha256-1e4FIOsbe8ylCmClGKt6dweZKBLFeBmPi0T9+seOjJM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 80ea02356cdb..5fde855e58e3 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -21,12 +21,12 @@
 
 buildPythonPackage rec {
   pname = "pytest";
-  version = "7.2.1";
+  version = "7.4.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1F4JUvNyckGRi4/Q83b1/2swHMB3fG+aVWk1yS2KfUI=";
+    hash = "sha256-tL+MRb1Zk07YQAGtUeEbTuQNQKEinSx5+cWSsKP2vYo=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/python-rtmidi/default.nix b/pkgs/development/python-modules/python-rtmidi/default.nix
index 8c51d9942f6b..1d79ad756eab 100644
--- a/pkgs/development/python-modules/python-rtmidi/default.nix
+++ b/pkgs/development/python-modules/python-rtmidi/default.nix
@@ -1,33 +1,40 @@
 { lib
 , stdenv
-, buildPythonPackage
-, fetchPypi
-, pythonOlder
-, pythonAtLeast
-, pkg-config
-, alsa-lib
-, libjack2
-, tox
-, flake8
 , alabaster
+, alsa-lib
+, buildPythonPackage
 , CoreAudio
 , CoreMIDI
 , CoreServices
+, fetchPypi
+, flake8
+, libjack2
+, meson-python
+, pkg-config
+, pythonOlder
+, setuptools
+, tox
 }:
 
 buildPythonPackage rec {
   pname = "python-rtmidi";
-  version = "1.4.9";
+  version = "1.5.4";
+  format = "pyproject";
 
-  # https://github.com/SpotlightKid/python-rtmidi/issues/115
-  disabled = pythonOlder "3.6" || pythonAtLeast "3.11";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "bfeb4ed99d0cccf6fa2837566907652ded7adc1c03b69f2160c9de4082301302";
+    pname = "python_rtmidi";
+    inherit version;
+    hash = "sha256-sLUGQoDba3iiYvqUFwMbIktSdZBb0OLhccfQ++FFRP0=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    meson-python
+    pkg-config
+    setuptools
+  ];
+
   buildInputs = [
     libjack2
   ] ++ lib.optionals stdenv.isLinux [
@@ -37,15 +44,21 @@ buildPythonPackage rec {
     CoreMIDI
     CoreServices
   ];
+
   nativeCheckInputs = [
     tox
     flake8
     alabaster
   ];
 
+  pythonImportsCheck = [
+    "rtmidi"
+  ];
+
   meta = with lib; {
     description = "A Python binding for the RtMidi C++ library implemented using Cython";
     homepage = "https://github.com/SpotlightKid/python-rtmidi";
+    changelog = "https://github.com/SpotlightKid/python-rtmidi/blob/${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ hexa ];
   };
diff --git a/pkgs/development/python-modules/pythran/default.nix b/pkgs/development/python-modules/pythran/default.nix
index ef03e7694763..dcb03ad0c517 100644
--- a/pkgs/development/python-modules/pythran/default.nix
+++ b/pkgs/development/python-modules/pythran/default.nix
@@ -4,12 +4,10 @@
 , fetchFromGitHub
 , openmp
 , ply
-, networkx
-, decorator
 , gast
-, six
 , numpy
 , beniget
+, xsimd
 , isPy3k
 , substituteAll
 }:
@@ -19,13 +17,13 @@ let
 
 in buildPythonPackage rec {
   pname = "pythran";
-  version = "0.11.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "serge-sans-paille";
     repo = "pythran";
     rev = version;
-    hash = "sha256-F9gUZOTSuiqvfGoN4yQqwUg9mnCeBntw5eHO7ZnjpzI=";
+    hash = "sha256-baDrReJgQXbaKA8KNhHiFjr0X34yb8WK/nUJmiM9EZs=";
   };
 
   patches = [
@@ -36,12 +34,15 @@ in buildPythonPackage rec {
     })
   ];
 
+  # xsimd: unvendor this header-only C++ lib
+  postPatch = ''
+    rm -r third_party/xsimd
+    ln -s '${lib.getDev xsimd}'/include/xsimd third_party/
+  '';
+
   propagatedBuildInputs = [
     ply
-    networkx
-    decorator
     gast
-    six
     numpy
     beniget
   ];
diff --git a/pkgs/development/python-modules/pyyaml/default.nix b/pkgs/development/python-modules/pyyaml/default.nix
index 7c19e55a7f74..a7270958387d 100644
--- a/pkgs/development/python-modules/pyyaml/default.nix
+++ b/pkgs/development/python-modules/pyyaml/default.nix
@@ -3,24 +3,30 @@
 , pythonOlder
 , fetchFromGitHub
 , cython
+, setuptools
 , libyaml
 , python
 }:
 
 buildPythonPackage rec {
   pname = "pyyaml";
-  version = "6.0";
+  version = "6.0.1";
 
   disabled = pythonOlder "3.6";
 
+  format = "pyproject";
+
   src = fetchFromGitHub {
     owner = "yaml";
     repo = "pyyaml";
     rev = version;
-    hash = "sha256-wcII32mRgRRmAgojntyxBMQkjvxU2jylCgVzlHAj2Xc=";
+    hash = "sha256-YjWMyMVDByLsN5vEecaYjHpR1sbBey1L/khn4oH9SPA=";
   };
 
-  nativeBuildInputs = [ cython ];
+  nativeBuildInputs = [
+    cython
+    setuptools
+  ];
 
   buildInputs = [ libyaml ];
 
diff --git a/pkgs/development/python-modules/qtconsole/default.nix b/pkgs/development/python-modules/qtconsole/default.nix
index 519eb31a5b1e..57b16e254fcf 100644
--- a/pkgs/development/python-modules/qtconsole/default.nix
+++ b/pkgs/development/python-modules/qtconsole/default.nix
@@ -4,6 +4,7 @@
 , ipykernel
 , jupyter-core
 , jupyter-client
+, ipython_genutils
 , pygments
 , pyqt5
 , pytestCheckHook
@@ -27,6 +28,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     ipykernel
+    ipython_genutils
     jupyter-core
     jupyter-client
     pygments
diff --git a/pkgs/development/python-modules/quantulum3/default.nix b/pkgs/development/python-modules/quantulum3/default.nix
index 364a5e6098a1..259871b4ef0c 100644
--- a/pkgs/development/python-modules/quantulum3/default.nix
+++ b/pkgs/development/python-modules/quantulum3/default.nix
@@ -12,6 +12,7 @@
 , joblib
 , wikipedia
 , stemming
+, setuptools
 }:
 let
   pname = "quantulum3";
@@ -40,6 +41,7 @@ buildPythonPackage {
     joblib
     wikipedia
     stemming
+    setuptools
   ];
 
   pythonImportsCheck = [ "quantulum3" ];
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index aaf6e77c0305..287104e5b78b 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.0.0";
+  version = "3.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rpUrMHIBr7sb0Cib6WYdLJ3KOPEgRnB0DCV/df1uE1A=";
+    hash = "sha256-nmPOYiozt5mDvFmEkRTIblECcGjV5650wZGGq+iSMPQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/referencing/default.nix b/pkgs/development/python-modules/referencing/default.nix
index f6ccd201df97..37e418f3ea44 100644
--- a/pkgs/development/python-modules/referencing/default.nix
+++ b/pkgs/development/python-modules/referencing/default.nix
@@ -9,56 +9,59 @@
 , pytestCheckHook
 , pythonOlder
 , rpds-py
-, setuptools-scm
 }:
 
-buildPythonPackage rec {
-  pname = "referencing";
-  version = "0.30.0";
-  format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+let
+  self = buildPythonPackage rec {
+    pname = "referencing";
+    version = "0.30.0";
+    format = "pyproject";
 
-  src = fetchFromGitHub {
-    owner = "python-jsonschema";
-    repo = "referencing";
-    rev = "refs/tags/v${version}";
-    fetchSubmodules = true;
-    hash = "sha256-nJSnZM3gg2+yfFAnOJzzXsmIEQdNf5ypt5R0O60NphA=";
+    disabled = pythonOlder "3.7";
+
+    src = fetchFromGitHub {
+      owner = "python-jsonschema";
+      repo = "referencing";
+      rev = "refs/tags/v${version}";
+      fetchSubmodules = true;
+      hash = "sha256-nJSnZM3gg2+yfFAnOJzzXsmIEQdNf5ypt5R0O60NphA=";
+    };
+
+    SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+    nativeBuildInputs = [
+      hatch-vcs
+      hatchling
+    ];
+
+    propagatedBuildInputs = [
+      attrs
+      rpds-py
+    ];
+
+    nativeCheckInputs = [
+      jsonschema
+      pytest-subtests
+      pytestCheckHook
+    ];
+
+    # avoid infinite recursion with jsonschema
+    doCheck = false;
+
+    passthru.tests.referencing = self.overridePythonAttrs { doCheck = true; };
+
+    pythonImportsCheck = [
+      "referencing"
+    ];
+
+    meta = with lib; {
+      description = "Cross-specification JSON referencing";
+      homepage = "https://github.com/python-jsonschema/referencing";
+      changelog = "https://github.com/python-jsonschema/referencing/blob/${version}/CHANGELOG.rst";
+      license = licenses.mit;
+      maintainers = with maintainers; [ fab ];
+    };
   };
-
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
-  postPatch = ''
-    sed -i "/Topic/d" pyproject.toml
-  '';
-
-  nativeBuildInputs = [
-    hatch-vcs
-    hatchling
-    setuptools-scm
-  ];
-
-  propagatedBuildInputs = [
-    attrs
-    rpds-py
-  ];
-
-  nativeCheckInputs = [
-    jsonschema
-    pytest-subtests
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [
-    "referencing"
-  ];
-
-  meta = with lib; {
-    description = "Cross-specification JSON referencing";
-    homepage = "https://github.com/python-jsonschema/referencing";
-    changelog = "https://github.com/python-jsonschema/referencing/blob/${version}/CHANGELOG.rst";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
-  };
-}
+in
+  self
diff --git a/pkgs/development/python-modules/repath/default.nix b/pkgs/development/python-modules/repath/default.nix
index 619036f4b75e..f66a42155da0 100644
--- a/pkgs/development/python-modules/repath/default.nix
+++ b/pkgs/development/python-modules/repath/default.nix
@@ -1,7 +1,7 @@
 { lib
-, python3
 , buildPythonPackage
 , fetchPypi
+, six
 }:
 
 buildPythonPackage rec {
@@ -13,7 +13,7 @@ buildPythonPackage rec {
     hash = "sha256-gpITm6xqDkP9nXBgXU6NrrJdRmcuSE7TGiTHzgrvD7c=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = [
     six
   ];
 
diff --git a/pkgs/development/python-modules/requests-toolbelt/default.nix b/pkgs/development/python-modules/requests-toolbelt/default.nix
index cfb58b4faef4..d7b6f01d16c2 100644
--- a/pkgs/development/python-modules/requests-toolbelt/default.nix
+++ b/pkgs/development/python-modules/requests-toolbelt/default.nix
@@ -1,22 +1,21 @@
 { lib
 , betamax
 , buildPythonPackage
-, fetchpatch
 , fetchPypi
-, mock
 , pyopenssl
 , pytestCheckHook
 , requests
+, trustme
 }:
 
 buildPythonPackage rec {
   pname = "requests-toolbelt";
-  version = "0.10.1";
+  version = "1.0.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YuCff/XMvakncqKfOUpJw61ssYHVaLEzdiayq7Yopj0=";
+    hash = "sha256-doGgo9BHAStb3A7jfX+PB+vnarCMrsz8OSHOI8iNW8Y=";
   };
 
   propagatedBuildInputs = [
@@ -25,17 +24,9 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     betamax
-    mock
+    pyopenssl
     pytestCheckHook
-  ];
-
-  disabledTests = [
-    # https://github.com/requests/toolbelt/issues/306
-    "test_no_content_length_header"
-    "test_read_file"
-    "test_reads_file_from_url_wrapper"
-    "test_x509_der"
-    "test_x509_pem"
+    trustme
   ];
 
   pythonImportsCheck = [
@@ -45,6 +36,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Toolbelt of useful classes and functions to be used with requests";
     homepage = "http://toolbelt.rtfd.org";
+    changelog = "https://github.com/requests/toolbelt/blob/${version}/HISTORY.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ matthiasbeyer ];
   };
diff --git a/pkgs/development/python-modules/ruamel-yaml/default.nix b/pkgs/development/python-modules/ruamel-yaml/default.nix
index d938fb1f219c..0c34a24d0864 100644
--- a/pkgs/development/python-modules/ruamel-yaml/default.nix
+++ b/pkgs/development/python-modules/ruamel-yaml/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "ruamel-yaml";
-  version = "0.17.21";
+  version = "0.17.32";
 
   src = fetchPypi {
     pname = "ruamel.yaml";
     inherit version;
-    hash = "sha256-i3zml6LyEnUqNcGsQURx3BbEJMlXO+SSa1b/P10jt68=";
+    hash = "sha256-7JOQY3YZFOFFQpcqXLptM8I7CFmrY0L2HPBwz8YA78I=";
   };
 
   # Tests use relative paths
@@ -27,6 +27,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order";
     homepage = "https://sourceforge.net/projects/ruamel-yaml/";
+    changelog = "https://sourceforge.net/p/ruamel-yaml/code/ci/default/tree/CHANGES";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/rustworkx/default.nix b/pkgs/development/python-modules/rustworkx/default.nix
index 9054cb14d278..055d5ff85728 100644
--- a/pkgs/development/python-modules/rustworkx/default.nix
+++ b/pkgs/development/python-modules/rustworkx/default.nix
@@ -7,6 +7,7 @@
 , numpy
 , fixtures
 , networkx
+, testtools
 , libiconv
 , stdenv
 , lib
@@ -37,12 +38,12 @@ buildPythonPackage rec {
 
   buildInputs = [ numpy ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
-  checkInputs = [ fixtures networkx ];
+  checkInputs = [ fixtures networkx testtools ];
 
   pythonImportsCheck = [ "rustworkx" ];
 
   meta = with lib; {
-    description = "A high performance Python graph library implemented in Rust.";
+    description = "A high performance Python graph library implemented in Rust";
     homepage = "https://github.com/Qiskit/rustworkx";
     license = licenses.asl20;
     maintainers = with maintainers; [ raitobezarius ];
diff --git a/pkgs/development/python-modules/sanic-routing/default.nix b/pkgs/development/python-modules/sanic-routing/default.nix
index 197f50800228..c9402b30b125 100644
--- a/pkgs/development/python-modules/sanic-routing/default.nix
+++ b/pkgs/development/python-modules/sanic-routing/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "sanic-routing";
-  version = "22.8.0";
+  version = "23.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "sanic-org";
     repo = "sanic-routing";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2T6WY0nzvr8Q9lBoStzmX7m7Ct35lcG53OSLcqxkEcY=";
+    hash = "sha256-ual/vjL3M/nqlaRttJPoBcOYE3L/OAahbBLceUEVLXc=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/sanic-testing/default.nix b/pkgs/development/python-modules/sanic-testing/default.nix
index acb174c86997..8ebdeef2c86f 100644
--- a/pkgs/development/python-modules/sanic-testing/default.nix
+++ b/pkgs/development/python-modules/sanic-testing/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "sanic-testing";
-  version = "22.12.0";
+  version = "23.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "sanic-org";
     repo = "sanic-testing";
     rev = "refs/tags/v${version}";
-    hash = "sha256-pFTF2SQ9giRzPhG24FLqLPJRXaFdQ7Xi5EeltS7J3DI=";
+    hash = "sha256-WDiEuve9P9fLHxpK0UjxhbZUmWXtP+DV7e6OT19TASs=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/sanic/default.nix b/pkgs/development/python-modules/sanic/default.nix
index eaa14240191b..0ca77392079e 100644
--- a/pkgs/development/python-modules/sanic/default.nix
+++ b/pkgs/development/python-modules/sanic/default.nix
@@ -1,30 +1,41 @@
 { lib
 , stdenv
-, aiofiles
-, beautifulsoup4
 , buildPythonPackage
-, doCheck ? !stdenv.isDarwin # on Darwin, tests fail but pkg still works
 , fetchFromGitHub
-, gunicorn
+
+# build-system
+, setuptools
+
+# propagates
+, aiofiles
+, html5tagger
 , httptools
 , multidict
+, sanic-routing
+, tracerite
+, typing-extensions
+, ujson
+, uvloop
+, websockets
+
+# optionals
+, aioquic
+
+# tests
+, doCheck ? !stdenv.isDarwin # on Darwin, tests fail but pkg still works
+
+, beautifulsoup4
+, gunicorn
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
-, pythonAtLeast
-, sanic-routing
 , sanic-testing
-, setuptools
-, ujson
 , uvicorn
-, uvloop
-, websockets
-, aioquic
 }:
 
 buildPythonPackage rec {
   pname = "sanic";
-  version = "22.12.0";
+  version = "23.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +44,7 @@ buildPythonPackage rec {
     owner = "sanic-org";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Vj780rP5rJ+YsMWlb3BR9LTKT/nTt0C2H3J0X9sysj8=";
+    hash = "sha256-Ffw92mlYNV+ikb6299uw24EI1XPpl3Ju2st1Yt/YHKw=";
   };
 
   nativeBuildInputs = [
@@ -42,15 +53,26 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiofiles
-    aioquic
     httptools
+    html5tagger
     multidict
     sanic-routing
+    tracerite
+    typing-extensions
     ujson
     uvloop
     websockets
   ];
 
+  passthru.optional-dependencies = {
+    ext = [
+      # TODO: sanic-ext
+    ];
+    http3 = [
+      aioquic
+    ];
+  };
+
   nativeCheckInputs = [
     beautifulsoup4
     gunicorn
@@ -58,7 +80,7 @@ buildPythonPackage rec {
     pytestCheckHook
     sanic-testing
     uvicorn
-  ];
+  ] ++ passthru.optional-dependencies.http3;
 
   inherit doCheck;
 
@@ -112,6 +134,8 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # We are not interested in benchmarks
     "benchmark/"
+    # We are also not interested in typing
+    "typing/test_typing.py"
     # unable to create async loop
     "test_app.py"
     "test_asgi.py"
diff --git a/pkgs/development/python-modules/scikit-build/default.nix b/pkgs/development/python-modules/scikit-build/default.nix
index f7a2c7e1b547..5b868bb42a6f 100644
--- a/pkgs/development/python-modules/scikit-build/default.nix
+++ b/pkgs/development/python-modules/scikit-build/default.nix
@@ -1,34 +1,37 @@
 { lib
 , buildPythonPackage
+, pythonOlder
 , fetchPypi
+, hatch-fancy-pypi-readme
+, hatch-vcs
+, hatchling
 , distro
 , packaging
-, python
 , setuptools
-, setuptools-scm
 , wheel
+, tomli
   # Test Inputs
 , cmake
 , cython
-, flake8
-, ninja
+, git
 , path
 , pytestCheckHook
 , pytest-mock
-, pytest-virtualenv
 , requests
-, six
 , virtualenv
 }:
 
 buildPythonPackage rec {
   pname = "scikit-build";
-  version = "0.16.7";
+  version = "0.17.6";
   format = "pyproject";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-qbnMdHm3HmyNQ0WW363gJSU6riOtsiqaLYWFD9Uc7P0=";
+    pname = "scikit_build";
+    inherit version;
+    hash = "sha256-tRpRo2s3xCZQmUtQR5EvWbIuMhCyPjIfKHYR+e9uXJ0=";
   };
 
   # This line in the filterwarnings section of the pytest configuration leads to this error:
@@ -37,24 +40,28 @@ buildPythonPackage rec {
     sed -i "/'error',/d" pyproject.toml
   '';
 
+  nativeBuildInputs = [
+    hatch-fancy-pypi-readme
+    hatch-vcs
+    hatchling
+  ];
+
   propagatedBuildInputs = [
     distro
     packaging
     setuptools
-    setuptools-scm
     wheel
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    tomli
   ];
 
   nativeCheckInputs = [
     cmake
     cython
-    ninja
-    path
+    git
     pytestCheckHook
     pytest-mock
-    pytest-virtualenv
     requests
-    six
     virtualenv
   ];
 
@@ -76,13 +83,10 @@ buildPythonPackage rec {
     "test_hello_sdist"
     "test_manifest_in_sdist"
     "test_sdist_with_symlinks"
-    # distutils.errors.DistutilsArgError: no commands supplied
-    "test_invalid_command"
-    "test_manifest_in_sdist"
-    "test_no_command"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/scikit-build/scikit-build/blob/${version}/CHANGES.rst";
     description = "Improved build system generator for CPython C/C++/Fortran/Cython extensions";
     homepage = "https://github.com/scikit-build/scikit-build";
     license = with licenses; [ mit bsd2 ]; # BSD due to reuses of PyNE code
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index bd2a9be69b67..fa2510b0a441 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "scikit-learn";
-  version = "1.2.1";
+  version = "1.3.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+/ilyJPJtLmbzH7Y+z6FAJV6ET9BAYYDhtBmNVIPfPs=";
+    hash = "sha256-i+VJiG9e2kZDa25VWw5Ic7TxCqIcB99FxLwXNa+8zXo=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 1090e724a7fd..d51c049589ee 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -1,9 +1,14 @@
 { lib
 , stdenv
-, fetchPypi
+, fetchFromGitHub
+, fetchpatch
+, fetchurl
+, writeText
 , python
 , pythonOlder
 , buildPythonPackage
+, pypaBuildHook
+, pipInstallHook
 , cython
 , gfortran
 , meson-python
@@ -17,31 +22,77 @@
 , pybind11
 , pooch
 , libxcrypt
+, xsimd
+, blas
+, lapack
 }:
 
-buildPythonPackage rec {
+let
   pname = "scipy";
-  version = "1.10.1";
-  format = "pyproject";
+  # DON'T UPDATE THESE ATTRIBUTES MANUALLY - USE:
+  #
+  #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
+  #
+  # Even if you do update these hashes manually, don't change their base
+  # (base16 or base64), because the update script uses sed regexes to replace
+  # them with the updated hashes.
+  version = "1.11.1";
+  srcHash = "sha256-bgnYXe3EhzL7+Gfriz1cXCl2eYQJ8zF+rcIwHyZR8bQ=";
+  datasetsHashes = {
+    ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
+    ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
+    face = "11i8x29h80y7hhyqhil1fg8mxag5f827g33lhnsf44qk116hp2wx";
+  };
+  datasets = lib.mapAttrs (
+    d: hash: fetchurl {
+      url = "https://raw.githubusercontent.com/scipy/dataset-${d}/main/${d}.dat";
+      sha256 = hash;
+    }
+  ) datasetsHashes;
+  # Additional cross compilation related properties that scipy reads in scipy/meson.build
+  crossFileScipy = writeText "cross-file-scipy.conf" ''
+    [properties]
+    numpy-include-dir = '${numpy}/${python.sitePackages}/numpy/core/include'
+    pythran-include-dir = '${pythran}/${python.sitePackages}/pythran'
+    host-python-path = '${python.interpreter}'
+    host-python-version = '${python.pythonVersion}'
+  '';
+in buildPythonPackage {
+  inherit pname version;
+  format = "other";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-LPnfuAp7RYm6TEDOdYiYbW1c68VFfK0sKID2vC1C86U=";
+  src = fetchFromGitHub {
+    owner = "scipy";
+    repo = pname;
+    rev = "v${version}";
+    hash = srcHash;
+    fetchSubmodules = true;
   };
 
   patches = [
-    # These tests require internet connection, currently impossible to disable
-    # them otherwise, see:
-    # https://github.com/scipy/scipy/pull/17965
-    ./disable-datasets-tests.patch
+    # Helps with cross compilation, see https://github.com/scipy/scipy/pull/18167
+    (fetchpatch {
+      url = "https://github.com/scipy/scipy/commit/dd50ac9d98dbb70625333a23e3a90e493228e3be.patch";
+      hash = "sha256-Vf6/hhwu6X5s8KWhq8bUZKtSkdVu/GtEpGtj8Olxe7s=";
+      excludes = [
+        "doc/source/dev/contributor/meson_advanced.rst"
+      ];
+    })
   ];
 
-  nativeBuildInputs = [ cython gfortran meson-python pythran pkg-config wheel ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "pybind11>=2.10.4,<2.11.0" "pybind11>=2.10.4,<2.12.0"
+  '';
+
+  nativeBuildInputs = [ pypaBuildHook pipInstallHook cython gfortran meson-python pythran pkg-config wheel ];
 
   buildInputs = [
-    numpy.blas
+    blas
+    lapack
     pybind11
     pooch
+    xsimd
   ] ++ lib.optionals (pythonOlder "3.9") [
     libxcrypt
   ];
@@ -53,9 +104,29 @@ buildPythonPackage rec {
   doCheck = !(stdenv.isx86_64 && stdenv.isDarwin);
 
   preConfigure = ''
-    sed -i '0,/from numpy.distutils.core/s//import setuptools;from numpy.distutils.core/' setup.py
+    # Relax deps a bit
+    substituteInPlace pyproject.toml \
+      --replace 'numpy==' 'numpy>='
+    # Helps parallelization a bit
     export NPY_NUM_BUILD_JOBS=$NIX_BUILD_CORES
-  '';
+    # We download manually the datasets and this variable tells the pooch
+    # library where these files are cached. See also:
+    # https://github.com/scipy/scipy/pull/18518#issuecomment-1562350648 And at:
+    # https://github.com/scipy/scipy/pull/17965#issuecomment-1560759962
+    export XDG_CACHE_HOME=$PWD; export HOME=$(mktemp -d); mkdir scipy-data
+  '' + (lib.concatStringsSep "\n" (lib.mapAttrsToList (d: dpath:
+    # Actually copy the datasets
+    "cp ${dpath} scipy-data/${d}.dat"
+  ) datasets));
+
+  mesonFlags = [
+    "-Dblas=${blas.pname}"
+    "-Dlapack=${lapack.pname}"
+    # We always run what's necessary for cross compilation, which is passing to
+    # meson the proper cross compilation related arguments. See also:
+    # https://docs.scipy.org/doc/scipy/building/cross_compilation.html
+    "--cross-file=${crossFileScipy}"
+  ];
 
   # disable stackprotector on aarch64-darwin for now
   #
@@ -71,7 +142,7 @@ buildPythonPackage rec {
     runHook preCheck
     pushd "$out"
     export OMP_NUM_THREADS=$(( $NIX_BUILD_CORES / 4 ))
-    ${python.interpreter} -c "import scipy; scipy.test('fast', verbose=10, parallel=$NIX_BUILD_CORES)"
+    ${python.interpreter} -c "import scipy, sys; sys.exit(scipy.test('fast', verbose=10, parallel=$NIX_BUILD_CORES) != True)"
     popd
     runHook postCheck
   '';
@@ -79,17 +150,23 @@ buildPythonPackage rec {
   requiredSystemFeatures = [ "big-parallel" ]; # the tests need lots of CPU time
 
   passthru = {
-    blas = numpy.blas;
+    inherit blas;
+    updateScript = [
+      ./update.sh
+      # Pass it this file name as argument
+      (builtins.unsafeGetAttrPos "pname" python.pkgs.scipy).file
+    ]
+    # Pass it the names of the datasets to update their hashes
+    ++ (builtins.attrNames datasetsHashes)
+    ;
   };
 
-  setupPyBuildFlags = [ "--fcompiler='gnu95'" ];
-
   SCIPY_USE_G77_ABI_WRAPPER = 1;
 
   meta = with lib; {
     description = "SciPy (pronounced 'Sigh Pie') is open-source software for mathematics, science, and engineering";
     homepage = "https://www.scipy.org/";
     license = licenses.bsd3;
-    maintainers = [ maintainers.fridh ];
+    maintainers = with maintainers; [ fridh doronbehar ];
   };
 }
diff --git a/pkgs/development/python-modules/scipy/disable-datasets-tests.patch b/pkgs/development/python-modules/scipy/disable-datasets-tests.patch
deleted file mode 100644
index a06d0d50ddf4..000000000000
--- a/pkgs/development/python-modules/scipy/disable-datasets-tests.patch
+++ /dev/null
@@ -1,9 +0,0 @@
-diff --git i/scipy/datasets/meson.build w/scipy/datasets/meson.build
-index 101377253..eec2feea4 100644
---- i/scipy/datasets/meson.build
-+++ w/scipy/datasets/meson.build
-@@ -11,4 +11,3 @@ py3.install_sources(
-   subdir: 'scipy/datasets'
- )
- 
--subdir('tests')
diff --git a/pkgs/development/python-modules/scipy/update.sh b/pkgs/development/python-modules/scipy/update.sh
new file mode 100755
index 000000000000..b0d6e2da4f41
--- /dev/null
+++ b/pkgs/development/python-modules/scipy/update.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p jq nix-prefetch-github
+
+set -euo pipefail
+echoerr() { echo "$@" 1>&2; }
+
+fname="$1"
+echoerr got fname $fname
+shift
+datasets="$@"
+echoerr datasets are: "$@"
+latest_release=$(curl --silent https://api.github.com/repos/scipy/scipy/releases/latest)
+version=$(jq -r '.tag_name' <<<"$latest_release" | cut -c2-)
+# Update version, if needed
+if grep -q 'version = "'$version $fname; then
+    echo "Current version $version is the latest available, will update only datasets' hashes (don't take long)"
+else
+    echoerr got version $version
+    sed -i -E 's/(version = ).*=/\1'$version'/g' $fname
+    # Update srcHash
+    srcHash='"sha256-'$(nix-prefetch-github scipy scipy --rev v${version} --fetch-submodules | jq --raw-output .sha256)'"'
+    sed -i 's/srcHash = .*=";/srcHash = '$srcHash';/g' $fname
+fi
+
+for d in $datasets; do
+    datasetHash=$(nix-prefetch-url "https://raw.githubusercontent.com/scipy/dataset-${d}/main/${d}.dat")
+    sed -i 's/'$d' = "[0-9a-z]\+/'$d' = "'$datasetHash'/g' $fname
+    echoerr updated hash for dataset "'$d'"
+done
diff --git a/pkgs/development/python-modules/service-identity/default.nix b/pkgs/development/python-modules/service-identity/default.nix
index 63c077939313..53fa54a5aff0 100644
--- a/pkgs/development/python-modules/service-identity/default.nix
+++ b/pkgs/development/python-modules/service-identity/default.nix
@@ -3,42 +3,56 @@
 , buildPythonPackage
 , cryptography
 , fetchFromGitHub
+, hatch-fancy-pypi-readme
+, hatch-vcs
+, hatchling
 , idna
 , pyasn1
 , pyasn1-modules
-, six
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "service-identity";
-  version = "21.1.0";
+  version = "23.1.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pyca";
     repo = pname;
-    rev = version;
-    hash = "sha256-pWc2rU3ULqEukMhd1ySY58lTm3s8f/ayQ7CY4nG24AQ=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-PGDtsDgRwh7GuuM4OuExiy8L4i3Foo+OD0wMrndPkvo=";
   };
 
+  nativeBuildInputs = [
+    hatch-fancy-pypi-readme
+    hatch-vcs
+    hatchling
+  ];
+
   propagatedBuildInputs = [
     attrs
     cryptography
     idna
     pyasn1
     pyasn1-modules
-    six
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "service_identity" ];
+  pythonImportsCheck = [
+    "service_identity"
+  ];
 
   meta = with lib; {
     description = "Service identity verification for pyOpenSSL";
     homepage = "https://service-identity.readthedocs.io";
+    changelog = "https://github.com/pyca/service-identity/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index 906d6355e9b8..e71d8bc78dc0 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "1.5.2";
+  version = "1.6.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2NrMsU3A6uG2tus+zveWdb03tAZTafecNTk91cVWUsc=";
+    hash = "sha256-yG5zTerDMFl5mL+8CNpFGH5rJ4N+I72R6tsyBzI5ImI=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix b/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix
index 26479aacdad9..6f05b7324c82 100644
--- a/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix
+++ b/pkgs/development/python-modules/skytemple-ssb-debugger/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     hash = "sha256-/LBz0PCQI3QOAmOZk6Jynqi/+NN0w8gbY/S3YckRZ68=";
   };
 
-  buildInputs = [ gobject-introspection gtk3 gtksourceview4 ];
+  buildInputs = [ gtk3 gtksourceview4 ];
   nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
   propagatedBuildInputs = [
     nest-asyncio
diff --git a/pkgs/development/python-modules/snitun/default.nix b/pkgs/development/python-modules/snitun/default.nix
index f02f82adf1ab..42b225aa3819 100644
--- a/pkgs/development/python-modules/snitun/default.nix
+++ b/pkgs/development/python-modules/snitun/default.nix
@@ -36,7 +36,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals stdenv.isDarwin [
+  disabledTests = [
+    # broke after aiohttp 3.8.5 upgrade
+    "test_client_stop_no_wait"
+  ] ++ lib.optionals stdenv.isDarwin [
     "test_multiplexer_data_channel_abort_full" # https://github.com/NabuCasa/snitun/issues/61
     # port binding conflicts
     "test_snitun_single_runner_timeout"
diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index fbf000d21e1e..3e1c35292d22 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -1,6 +1,7 @@
 { lib
 , asn1crypto
 , buildPythonPackage
+, pythonRelaxDepsHook
 , certifi
 , cffi
 , charset-normalizer
@@ -31,11 +32,14 @@ buildPythonPackage rec {
     hash = "sha256-F0EbgRSS/kYKUDPhf6euM0eLqIqVjQsHC6C9ZZSRCIE=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "charset_normalizer>=2,<3" "charset_normalizer" \
-      --replace "pyOpenSSL>=16.2.0,<23.0.0" "pyOpenSSL"
-  '';
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+  pythonRelaxDeps = [
+    "pyOpenSSL"
+    "charset-normalizer"
+    "cryptography"
+  ];
 
   propagatedBuildInputs = [
     asn1crypto
diff --git a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
index 88d8d66cda5f..aca87f3c893c 100644
--- a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
+++ b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "sphinx-autodoc-typehints";
-  version = "1.22";
+  version = "1.23.0";
 in
 
 buildPythonPackage {
@@ -22,7 +22,7 @@ buildPythonPackage {
   src = fetchPypi {
     pname = "sphinx_autodoc_typehints";
     inherit version;
-    hash = "sha256-cfyi1e7psDQgTkxoarILTY9euUCTliFryubIfDjhjqY=";
+    hash = "sha256-XUTimWYzza2kmbbSeklt3528ld0fDwn3s3lAJJ5h9uk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 5ef275606185..2f5f5d1a8e2c 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -40,7 +40,7 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "2.0.18";
+  version = "2.0.19";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     rev = "refs/tags/rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-juZIFlmgwGFFhv+3DsMx6k1QRcGLQyTOwR5Hii8A68c=";
+    hash = "sha256-97q04wQVtlV2b6VJHxvnQ9ep76T5umn1KI3hXh6a8kU=";
   };
 
   nativeBuildInputs =[
diff --git a/pkgs/development/python-modules/sympy/default.nix b/pkgs/development/python-modules/sympy/default.nix
index a135f31578c1..a88e21021e41 100644
--- a/pkgs/development/python-modules/sympy/default.nix
+++ b/pkgs/development/python-modules/sympy/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sympy";
-  version = "1.11.1";
+  version = "1.12";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4yOA3OY8t8AQjtUlVwCS/UUWi9ri+qF+UoIh73Lohlg=";
+    hash = "sha256-6/WVyNrD4P3EFSxRh4tJg5bsfzDnqRTWBx5nTUlCD7g=";
   };
 
   nativeCheckInputs = [ glibcLocales ];
diff --git a/pkgs/development/python-modules/tables/default.nix b/pkgs/development/python-modules/tables/default.nix
index 8e119142bb8b..8705f64817e8 100644
--- a/pkgs/development/python-modules/tables/default.nix
+++ b/pkgs/development/python-modules/tables/default.nix
@@ -30,6 +30,14 @@ buildPythonPackage rec {
     hash = "sha256-NPP6I2bOILGPHfVzp3wdJzBs4fKkHZ+e/2IbUZLqh4g=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "numpy-1.25-compatibility.patch";
+      url = "https://github.com/PyTables/PyTables/commit/337792561e5924124efd20d6fea6bbbd2428b2aa.patch";
+      hash = "sha256-pz3A/jTPWXXlzr+Yl5PRUvdSAinebFsoExfek4RUHkc=";
+    })
+  ];
+
   nativeBuildInputs = [
     blosc2
     cython
diff --git a/pkgs/development/python-modules/tifffile/default.nix b/pkgs/development/python-modules/tifffile/default.nix
index c3a56f5c64ca..655f6b8eb107 100644
--- a/pkgs/development/python-modules/tifffile/default.nix
+++ b/pkgs/development/python-modules/tifffile/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "tifffile";
-  version = "2023.4.12";
+  version = "2023.7.18";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-L6mfmJDKq5GdkyoKyqnQ9YQ9wu81lOISljky4gcTut0=";
+    hash = "sha256-WlpiSy96t/N+nsQXSuLfGAW5ZY+JAT+bS1VQZy9l8qE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tomlkit/default.nix b/pkgs/development/python-modules/tomlkit/default.nix
index 861560c2aee0..605291edda0b 100644
--- a/pkgs/development/python-modules/tomlkit/default.nix
+++ b/pkgs/development/python-modules/tomlkit/default.nix
@@ -1,28 +1,31 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy27
-, enum34
-, functools32, typing ? null
+
+# build-system
+, poetry-core
+
+# tests
 , pytestCheckHook
-, pyaml
+, pyyaml
 }:
 
 buildPythonPackage rec {
   pname = "tomlkit";
-  version = "0.11.6";
+  version = "0.12.1";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cblS5XIWiJN/sCz501TbzweFBmFJ0oVeRFMevdK2XXM=";
+    hash = "sha256-OOH/jtuZEnPsn2GBJEpqORrDDp9QmOdTVkDqa+l6fIY=";
   };
 
-  propagatedBuildInputs =
-    lib.optionals isPy27 [ enum34 functools32 ]
-    ++ lib.optional isPy27 typing;
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
   nativeCheckInputs = [
-    pyaml
+    pyyaml
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/tpm2-pytss/default.nix b/pkgs/development/python-modules/tpm2-pytss/default.nix
index b732988db39d..b468e499f52a 100644
--- a/pkgs/development/python-modules/tpm2-pytss/default.nix
+++ b/pkgs/development/python-modules/tpm2-pytss/default.nix
@@ -49,6 +49,12 @@ buildPythonPackage rec {
       sha256 = "sha256-VFq3Hv4I8U8ifP/aSjyu0BiW/4jfPlRDKqRcqUGw6UQ=";
     })
 
+    (fetchpatch {
+      name = "test-new-cryptography.patch";
+      url = "https://github.com/tpm2-software/tpm2-pytss/commit/e4006e6066c015d9ed55befa9b98247fbdcafd7d.diff";
+      sha256 = "sha256-Wxe9u7Cvv2vKMGTcK3X8W1Mq/nCt70zrzWUKA+83Sas=";
+    })
+
     # Fix hardcoded `fapi-config.json` configuration path
     ./fapi-config.patch
   ];
diff --git a/pkgs/development/python-modules/tracerite/default.nix b/pkgs/development/python-modules/tracerite/default.nix
new file mode 100644
index 000000000000..e94e8a8d1d95
--- /dev/null
+++ b/pkgs/development/python-modules/tracerite/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+, html5tagger
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "tracerite";
+  version = "1.1.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "sanic-org";
+    repo = "tracerite";
+    rev = "v${version}";
+    hash = "sha256-At8wVR3EcHEi051BBfjb+sOhs93GyzWlEAjtehTMeNU=";
+  };
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    html5tagger
+  ];
+
+  postInstall = ''
+    cp tracerite/style.css $out/${python.sitePackages}/tracerite
+  '';
+
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "tracerite"
+  ];
+
+  meta = with lib; {
+    description = "Tracebacks for Humans (in Jupyter notebooks";
+    homepage = "https://github.com/sanic-org/tracerite";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/traitlets/default.nix b/pkgs/development/python-modules/traitlets/default.nix
index e3f6f5e7bfb0..aa37946026f9 100644
--- a/pkgs/development/python-modules/traitlets/default.nix
+++ b/pkgs/development/python-modules/traitlets/default.nix
@@ -1,13 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, glibcLocales
-, pytest
-, mock
-, ipython_genutils
-, decorator
+, pytestCheckHook
 , pythonOlder
-, six
 , hatchling
 }:
 
@@ -23,16 +18,12 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [ hatchling ];
-  nativeCheckInputs = [ glibcLocales pytest mock ];
-  propagatedBuildInputs = [ ipython_genutils decorator six ];
 
-  checkPhase = ''
-    LC_ALL="en_US.UTF-8" py.test
-  '';
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = {
     description = "Traitlets Python config system";
-    homepage = "https://ipython.org/";
+    homepage = "https://github.com/ipython/traitlets";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fridh ];
   };
diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 911ab5a777b7..7cd0dd7ca8a5 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -6,33 +6,45 @@
 , pythonOlder
 }:
 
-buildPythonPackage rec {
-  pname = "trove-classifiers";
-  version = "2023.7.6";
-  format = "setuptools";
+let
+  self = buildPythonPackage rec {
+    pname = "trove-classifiers";
+    version = "2023.7.6";
+    format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+    disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-io4Wi1HSD+1gcEODHTdjK7UJGdHICmTg8Tk3RGkaiyI=";
+    src = fetchPypi {
+      inherit pname version;
+      hash = "sha256-io4Wi1HSD+1gcEODHTdjK7UJGdHICmTg8Tk3RGkaiyI=";
+    };
+
+    postPatch = ''
+      substituteInPlace setup.py \
+        --replace '"calver"' ""
+    '';
+
+    nativeBuildInputs = [
+      calver
+    ];
+
+    doCheck = false; # avoid infinite recursion with hatchling
+
+    nativeCheckInputs = [
+      pytestCheckHook
+    ];
+
+    pythonImportsCheck = [ "trove_classifiers" ];
+
+    passthru.tests.trove-classifiers = self.overridePythonAttrs { doCheck = true; };
+
+    meta = {
+      description = "Canonical source for classifiers on PyPI";
+      homepage = "https://github.com/pypa/trove-classifiers";
+      changelog = "https://github.com/pypa/trove-classifiers/releases/tag/${version}";
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [ dotlambda ];
+    };
   };
-
-  nativeBuildInputs = [
-    calver
-  ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [ "trove_classifiers" ];
-
-  meta = {
-    description = "Canonical source for classifiers on PyPI";
-    homepage = "https://github.com/pypa/trove-classifiers";
-    changelog = "https://github.com/pypa/trove-classifiers/releases/tag/${version}";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ dotlambda ];
-  };
-}
+in
+  self
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index 7b12ef05facc..582a9e0f5636 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -111,6 +111,7 @@ buildPythonPackage rec {
     echo 'ListingTests.test_oldFile.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
     echo 'ListingTests.test_oldSingleDigitDayOfMonth.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
 
+    echo 'WrapClientTLSParserTests.test_tls.skip = "pyopenssl update"' >> src/twisted/internet/test/test_endpoints.py
     echo 'UNIXTestsBuilder_AsyncioSelectorReactorTests.test_sendFileDescriptorTriggersPauseProducing.skip = "sendFileDescriptor producer was not paused"'>> src/twisted/internet/test/test_unix.py
     echo 'UNIXTestsBuilder_SelectReactorTests.test_sendFileDescriptorTriggersPauseProducing.skip = "sendFileDescriptor producer was not paused"'>> src/twisted/internet/test/test_unix.py
 
diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index de6512b3e41b..72302723c855 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -8,15 +8,15 @@
 
 buildPythonPackage rec {
   pname = "typing-extensions";
-  version = "4.5.0";
+  version = "4.7.1";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "typing_extensions";
     inherit version;
-    hash = "sha256-XLX0p5E51plgez72IqHe2vqE4RWrACTg2cBEqUecp8s=";
+    hash = "sha256-t13cJk8LpWFdt7ohfa65lwGtKVNTxF+elZYzN87u/7I=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,8 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Backported and Experimental Type Hints for Python 3.5+";
+    description = "Backported and Experimental Type Hints for Python";
+    changelog = "https://github.com/python/typing_extensions/blob/${version}/CHANGELOG.md";
     homepage = "https://github.com/python/typing";
     license = licenses.psfl;
     maintainers = with maintainers; [ pmiddend ];
diff --git a/pkgs/development/python-modules/typing-inspect/default.nix b/pkgs/development/python-modules/typing-inspect/default.nix
index a5d27c1f71bb..59eb74554788 100644
--- a/pkgs/development/python-modules/typing-inspect/default.nix
+++ b/pkgs/development/python-modules/typing-inspect/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "typing-inspect";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchPypi {
     inherit version;
     pname = "typing_inspect";
-    hash = "sha256-ix/wxACUO2FF34EZxBwkTKggfx8QycBXru0VYOSAbj0=";
+    hash = "sha256-sj/EL/b272lU5IUsH7USzdGNvqAxNPkfhWqVzMlGH3g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tzlocal/default.nix b/pkgs/development/python-modules/tzlocal/default.nix
index 392e8e899240..5b32b4343a05 100644
--- a/pkgs/development/python-modules/tzlocal/default.nix
+++ b/pkgs/development/python-modules/tzlocal/default.nix
@@ -3,6 +3,8 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, setuptools
+, wheel
 , pytz-deprecation-shim
 , pytest-mock
 , pytestCheckHook
@@ -10,15 +12,22 @@
 
 buildPythonPackage rec {
   pname = "tzlocal";
-  version = "4.2"; # version needs to be compatible with APScheduler
+  version = "4.3"; # version needs to be compatible with APScheduler
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
+
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ee5842fa3a795f023514ac2d801c4a81d1743bbe642e3940143326b3a00addd7";
+    hash = "sha256-PyHQnhsqqfLazKEtokDKN947pSN6k63f1tWTr+kHM1U=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
   propagatedBuildInputs = [
     pytz-deprecation-shim
   ];
diff --git a/pkgs/development/python-modules/uharfbuzz/default.nix b/pkgs/development/python-modules/uharfbuzz/default.nix
index 2573bdc51ece..b93552c4e07f 100644
--- a/pkgs/development/python-modules/uharfbuzz/default.nix
+++ b/pkgs/development/python-modules/uharfbuzz/default.nix
@@ -11,18 +11,17 @@
 
 buildPythonPackage rec {
   pname = "uharfbuzz";
-  version = "0.24.1";
+  version = "0.37.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
 
-  # Fetching from GitHub as Pypi contains different versions
   src = fetchFromGitHub {
     owner = "harfbuzz";
     repo = "uharfbuzz";
     rev = "v${version}";
-    hash = "sha256-DyFXbwB28JH2lvmWDezRh49tjCvleviUNSE5LHG3kUg=";
     fetchSubmodules = true;
+    hash = "sha256-CZp+/5fG5IBawnIZLeO9lXke8rodqRcSf+ofyF584mc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -44,6 +43,6 @@ buildPythonPackage rec {
     description = "Streamlined Cython bindings for the harfbuzz shaping engine";
     homepage = "https://github.com/harfbuzz/uharfbuzz";
     license = licenses.asl20;
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index cd7496d636d0..13ef39be76db 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -20,12 +20,12 @@
 
 buildPythonPackage rec {
   pname = "urllib3";
-  version = "1.26.14";
+  version = "1.26.16";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B2kHv4/TVc3ndyhHExZiWk0vfnE8El9RlTu1s+7PT3I=";
+    hash = "sha256-jxNfZQJ1a95rKpsomJ31++h8mXDOyqaQQe3M5/BYmxQ=";
   };
 
   # FIXME: remove backwards compatbility hack
diff --git a/pkgs/development/python-modules/usort/default.nix b/pkgs/development/python-modules/usort/default.nix
index 2f61e8847ac6..d8369260587e 100644
--- a/pkgs/development/python-modules/usort/default.nix
+++ b/pkgs/development/python-modules/usort/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "usort";
-  version = "1.1.0b2";
+  version = "1.0.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "facebook";
     repo = "usort";
     rev = "refs/tags/v${version}";
-    hash = "sha256-c3gQ+f/BRgM+Nwc+mEP7dcmig7ws7FqL5zwQhNJJlsI=";
+    hash = "sha256-emnrghdsUs+VfvYiJExG13SKQNrXAEtGNAJQLScADnw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/uvicorn/default.nix b/pkgs/development/python-modules/uvicorn/default.nix
index e48536e66359..9baa150afb71 100644
--- a/pkgs/development/python-modules/uvicorn/default.nix
+++ b/pkgs/development/python-modules/uvicorn/default.nix
@@ -17,8 +17,8 @@
 
 buildPythonPackage rec {
   pname = "uvicorn";
-  version = "0.20.0";
-  disabled = pythonOlder "3.7";
+  version = "0.23.1";
+  disabled = pythonOlder "3.8";
 
   format = "pyproject";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = version;
-    hash = "sha256-yca6JI3/aqdZF7SxFeYr84GOeQnLBmbm1dIXjngX9Ng=";
+    hash = "sha256-X/G6K0X4G1EsMIBpvqy62zZ++8paTHNqgYLi+B7YK+0=";
   };
 
   outputs = [
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     click
     h11
-  ] ++ lib.optionals (pythonOlder "3.8") [
+  ] ++ lib.optionals (pythonOlder "3.11") [
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/uvicorn/tests.nix b/pkgs/development/python-modules/uvicorn/tests.nix
index 4ada58e1d992..805e8df1c710 100644
--- a/pkgs/development/python-modules/uvicorn/tests.nix
+++ b/pkgs/development/python-modules/uvicorn/tests.nix
@@ -1,12 +1,10 @@
 { stdenv
 , buildPythonPackage
-, asgiref
+, a2wsgi
 , uvicorn
 , httpx
-, pytest-asyncio
 , pytestCheckHook
 , pytest-mock
-, requests
 , trustme
 , watchgod
 , wsproto
@@ -23,16 +21,14 @@ buildPythonPackage {
   dontInstall = true;
 
   nativeCheckInputs = [
-    asgiref
     uvicorn
     httpx
     pytestCheckHook
-    pytest-asyncio
     pytest-mock
-    requests
     trustme
 
     # strictly optional dependencies
+    a2wsgi
     watchgod
     wsproto
   ]
diff --git a/pkgs/development/python-modules/validators/default.nix b/pkgs/development/python-modules/validators/default.nix
index 2f562a02ffdd..40c4b0b1fc98 100644
--- a/pkgs/development/python-modules/validators/default.nix
+++ b/pkgs/development/python-modules/validators/default.nix
@@ -1,34 +1,41 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, isPy27
-, decorator
-, six
+, fetchFromGitHub
+, poetry-core
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "validators";
-  version = "0.20.0";
-  disabled = isPy27;
+  version = "0.21.1";
+  format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-JBSM5OZBAKLV4mcjPiPnr+tVMWtH0w+q5+tucpK8Imo=";
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "python-validators";
+    repo = "validators";
+    rev = "refs/tags/${version}";
+    hash = "sha256-b5K1WP+cEAjPBXu9sAZQf1J5H7PLnn94400Zd/0Y9ew=";
   };
 
-  propagatedBuildInputs = [
-    decorator
-    six
+  nativeBuildInputs = [
+    poetry-core
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [
+    "validators"
+  ];
+
   meta = with lib; {
-    description = "Python Data Validation for Humans™";
+    description = "Python Data Validation for Humans";
     homepage = "https://github.com/kvesteri/validators";
+    changelog = "https://github.com/python-validators/validators/blob/${version}/CHANGES.md";
     license = licenses.bsd3;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/virtualenv/0001-Check-base_prefix-and-base_exec_prefix-for-Python-2.patch b/pkgs/development/python-modules/virtualenv/0001-Check-base_prefix-and-base_exec_prefix-for-Python-2.patch
deleted file mode 100644
index 2b34da289e2d..000000000000
--- a/pkgs/development/python-modules/virtualenv/0001-Check-base_prefix-and-base_exec_prefix-for-Python-2.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 21563405d6e2348ee457187f7fb61beb102bb367 Mon Sep 17 00:00:00 2001
-From: Frederik Rietdijk <fridh@fridh.nl>
-Date: Sun, 24 May 2020 09:33:13 +0200
-Subject: [PATCH] Check base_prefix and base_exec_prefix for Python 2
-
-This is a Nixpkgs-specific change so it can support virtualenvs from Nix envs.
----
- src/virtualenv/discovery/py_info.py | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/src/virtualenv/discovery/py_info.py b/src/virtualenv/discovery/py_info.py
-index 6f12128..74e9218 100644
---- a/src/virtualenv/discovery/py_info.py
-+++ b/src/virtualenv/discovery/py_info.py
-@@ -51,13 +51,17 @@ class PythonInfo(object):
-         self.version = u(sys.version)
-         self.os = u(os.name)
- 
-+        config_vars = {} if sys.version_info.major is not 2 else sysconfig._CONFIG_VARS
-+        base_prefix = config_vars.get("prefix")
-+        base_exec_prefix = config_vars.get("exec_prefix")
-+
-         # information about the prefix - determines python home
-         self.prefix = u(abs_path(getattr(sys, "prefix", None)))  # prefix we think
--        self.base_prefix = u(abs_path(getattr(sys, "base_prefix", None)))  # venv
-+        self.base_prefix = u(abs_path(getattr(sys, "base_prefix", base_prefix)))  # venv
-         self.real_prefix = u(abs_path(getattr(sys, "real_prefix", None)))  # old virtualenv
- 
-         # information about the exec prefix - dynamic stdlib modules
--        self.base_exec_prefix = u(abs_path(getattr(sys, "base_exec_prefix", None)))
-+        self.base_exec_prefix = u(abs_path(getattr(sys, "base_exec_prefix", base_exec_prefix)))
-         self.exec_prefix = u(abs_path(getattr(sys, "exec_prefix", None)))
- 
-         self.executable = u(abs_path(sys.executable))  # the executable we were invoked via
--- 
-2.25.1
-
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index 28100b8c55e7..10602bfd4f3a 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -11,24 +11,24 @@
 , hatch-vcs
 , hatchling
 , importlib-metadata
-, importlib-resources
 , platformdirs
 , pytest-freezegun
 , pytest-mock
 , pytest-timeout
 , pytestCheckHook
+, time-machine
 }:
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.19.0";
+  version = "20.24.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-N6ZAuoLtQLImWZxSLUEeS+XtszmgwN4DDA3HtkbWFZA=";
+    hash = "sha256-4qfO+dqIDWk7kz23ZUNndU8U4gZQ3GDo7nOFVx+Fk6M=";
   };
 
   nativeBuildInputs = [
@@ -40,16 +40,10 @@ buildPythonPackage rec {
     distlib
     filelock
     platformdirs
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    importlib-resources
   ] ++ lib.optionals (pythonOlder "3.8") [
     importlib-metadata
   ];
 
-  patches = lib.optionals (isPy27) [
-    ./0001-Check-base_prefix-and-base_exec_prefix-for-Python-2.patch
-  ];
-
   nativeCheckInputs = [
     cython
     flaky
@@ -57,6 +51,8 @@ buildPythonPackage rec {
     pytest-mock
     pytest-timeout
     pytestCheckHook
+  ] ++ lib.optionals (!isPyPy) [
+    time-machine
   ];
 
   preCheck = ''
@@ -91,7 +87,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A tool to create isolated Python environments";
     homepage = "http://www.virtualenv.org";
-    changelog = "https://github.com/pypa/virtualenv/releases/tag/${version}";
+    changelog = "https://github.com/pypa/virtualenv/blob/${version}/docs/changelog.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ goibhniu ];
   };
diff --git a/pkgs/development/python-modules/wagtail/default.nix b/pkgs/development/python-modules/wagtail/default.nix
index c01464f27ceb..54c30dabc781 100644
--- a/pkgs/development/python-modules/wagtail/default.nix
+++ b/pkgs/development/python-modules/wagtail/default.nix
@@ -24,19 +24,20 @@
 
 buildPythonPackage rec {
   pname = "wagtail";
-  version = "4.2.2";
+  version = "5.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-s89gs3H//Dc3k6BLZUC4APyDgiWY9LetWAkI+kXQTf8=";
+    hash = "sha256-3r0h34el2zRF1l/94S7xTjBqJPWtSQFQvtVW8Mjq0rs=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "beautifulsoup4>=4.8,<4.12" "beautifulsoup4>=4.8"
+      --replace "beautifulsoup4>=4.8,<4.12" "beautifulsoup4>=4.8" \
+      --replace "Pillow>=4.0.0,<10.0.0" "Pillow>=9.1.0,<11.0.0"
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/weaviate-client/default.nix b/pkgs/development/python-modules/weaviate-client/default.nix
index 8fc5fe72aca7..3e56109bcbe3 100644
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -10,21 +10,21 @@
 
 buildPythonPackage rec {
   pname = "weaviate-client";
-  version = "3.21.0";
+  version = "3.22.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7JSsVUiDx2XpTaiylHxPD6SgN47Tu+nzZT3zpbF0Wm0=";
+    hash = "sha256-r/Yb0/XXTfIKYjKEQ+OqnIYNUzD9+xnE2N3ETLYEAy8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "validators>=0.18.2,<0.20.0" "validators>=0.18.2" \
+      --replace "validators>=0.18.2,<=0.21.0" "validators>=0.18.2" \
       --replace "requests>=2.28.0,<2.29.0" "requests>=2.28.0"
   '';
 
diff --git a/pkgs/development/python-modules/willow/default.nix b/pkgs/development/python-modules/willow/default.nix
index d4d297d68d4d..f7030f7c874e 100644
--- a/pkgs/development/python-modules/willow/default.nix
+++ b/pkgs/development/python-modules/willow/default.nix
@@ -2,22 +2,29 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, six
-, pillow
+
+# dependencies
+, filetype
+, defusedxml,
 }:
 
 buildPythonPackage rec {
   pname = "willow";
-  version = "1.4.1";
+  version = "1.5.1";
+  format = "setuptools";
+
   disabled = pythonOlder "2.7";
 
   src = fetchPypi {
     pname = "Willow";
     inherit version;
-    hash = "sha256-Dfj/UoUx4AtI1Av3Ltgb6sHcgvLULlu+1K/wIYvvjA0=";
+    hash = "sha256-t6SQkRATP9seIodZLgZzzCVeAobhzVNCfuaN8ckiDEw=";
   };
 
-  propagatedBuildInputs = [ six pillow ];
+  propagatedBuildInputs = [
+    filetype
+    defusedxml
+  ];
 
   # Test data is not included
   # https://github.com/torchbox/Willow/issues/34
diff --git a/pkgs/development/python-modules/xarray/default.nix b/pkgs/development/python-modules/xarray/default.nix
index e700f630b665..bf8b03aa0969 100644
--- a/pkgs/development/python-modules/xarray/default.nix
+++ b/pkgs/development/python-modules/xarray/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "xarray";
-  version = "2023.2.0";
+  version = "2023.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qnYFAKLY+L6O/Y87J6lLKvOwqMLANzR9WV6vb/Cdinc=";
+    hash = "sha256-2s4v2/G3/xhdnBImokv4PCrlLzJT2/6A4X0RYmANBVw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/zarr/default.nix b/pkgs/development/python-modules/zarr/default.nix
index 552a1333e8fb..0f27248c688c 100644
--- a/pkgs/development/python-modules/zarr/default.nix
+++ b/pkgs/development/python-modules/zarr/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "zarr";
-  version = "2.14.2";
+  version = "2.16.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aOxZuOvfxP7l4yvWwM4nP3L31O0BdFS0UyfGc8YJB7w=";
+    hash = "sha256-hONraVvaDs6lKvmGEnGYTLIqXIZGeZB7e5uj95toT34=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zipp/default.nix b/pkgs/development/python-modules/zipp/default.nix
index b16248fb9fc0..1b033810b5b4 100644
--- a/pkgs/development/python-modules/zipp/default.nix
+++ b/pkgs/development/python-modules/zipp/default.nix
@@ -9,14 +9,14 @@
 
 let zipp = buildPythonPackage rec {
   pname = "zipp";
-  version = "3.15.0";
+  version = "3.16.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ESkprWSdqUHCPeUPNWorVXDJVLZRUGQrzN1mvxlNIks=";
+    hash = "sha256-68FZRqp4vWNFiZL8gew7b3sektUcNebeHDgE5zt5kUc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python2-modules/bootstrapped-pip/default.nix b/pkgs/development/python2-modules/bootstrapped-pip/default.nix
index 2fc8b8b8d4b7..314bf0048c8a 100644
--- a/pkgs/development/python2-modules/bootstrapped-pip/default.nix
+++ b/pkgs/development/python2-modules/bootstrapped-pip/default.nix
@@ -38,9 +38,10 @@ stdenv.mkDerivation rec {
     mv pip* pip
     mv setuptools* setuptools
     mv wheel* wheel
-    # Set up PYTHONPATH. The above folders need to be on PYTHONPATH
-    # $out is where we are installing to and takes precedence
-    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$(pwd)/wheel:$PYTHONPATH"
+    # Set up PYTHONPATH:
+    # - pip and setuptools need to be in PYTHONPATH to install setuptools, wheel, and pip.
+    # - $out is where we are installing to and takes precedence, and is where wheel will end so we can install pip.
+    export PYTHONPATH="$out/${python.sitePackages}:$(pwd)/pip/src:$(pwd)/setuptools:$(pwd)/setuptools/pkg_resources:$PYTHONPATH"
 
     echo "Building setuptools wheel..."
     pushd setuptools
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index ce50ab2882e3..029329723fc0 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -239,9 +239,9 @@ in
   };
 
   gio2 = attrs: {
-    nativeBuildInputs = [ pkg-config ]
+    nativeBuildInputs = [ pkg-config gobject-introspection ]
       ++ lib.optionals stdenv.isDarwin [ DarwinTools ];
-    buildInputs = [ gtk2 pcre pcre2 gobject-introspection ] ++ lib.optionals stdenv.isLinux [ util-linux libselinux libsepol ];
+    buildInputs = [ gtk2 pcre pcre2 ] ++ lib.optionals stdenv.isLinux [ util-linux libselinux libsepol ];
   };
 
   gitlab-markup = attrs: { meta.priority = 1; };
diff --git a/pkgs/development/tools/aws-sam-cli/default.nix b/pkgs/development/tools/aws-sam-cli/default.nix
index a91500e14948..32b7ba5a1784 100644
--- a/pkgs/development/tools/aws-sam-cli/default.nix
+++ b/pkgs/development/tools/aws-sam-cli/default.nix
@@ -46,9 +46,8 @@ python3.pkgs.buildPythonApplication rec {
       --replace 'boto3>=' 'boto3>=1.26.79 #' \
       --replace 'cfn-lint~=0.77.9' 'cfn-lint~=0.73.2' \
       --replace 'docker~=6.1.0' 'docker~=6.0.1' \
-      --replace 'pyopenssl~=23.2.0' 'pyopenssl~=23.1.0' \
       --replace 'ruamel_yaml~=0.17.32' 'ruamel_yaml~=0.17.21' \
-      --replace 'tomlkit==0.11.8' 'tomlkit~=0.11.6' \
+      --replace 'tomlkit==0.11.8' 'tomlkit>=0.11.8' \
       --replace 'typing_extensions~=4.4.0' 'typing_extensions~=4.4' \
       --replace 'tzlocal==3.0' 'tzlocal>=3.0' \
       --replace 'watchdog==' 'watchdog>=2.1.2 #'
diff --git a/pkgs/development/tools/bashate/default.nix b/pkgs/development/tools/bashate/default.nix
index 31714db5c893..f46e9667cbef 100644
--- a/pkgs/development/tools/bashate/default.nix
+++ b/pkgs/development/tools/bashate/default.nix
@@ -8,6 +8,7 @@
 , pytestCheckHook
 , pythonOlder
 , setuptools
+, testtools
 }:
 
 buildPythonApplication rec {
@@ -30,6 +31,7 @@ buildPythonApplication rec {
     fixtures
     mock
     pytestCheckHook
+    testtools
   ];
 
   pythonImportsCheck = [ "bashate" ];
diff --git a/pkgs/development/tools/build-managers/conan/default.nix b/pkgs/development/tools/build-managers/conan/default.nix
index 7370aee6f575..9ea57a27f027 100644
--- a/pkgs/development/tools/build-managers/conan/default.nix
+++ b/pkgs/development/tools/build-managers/conan/default.nix
@@ -19,6 +19,10 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-+ohUOQ9WBER/X0TDklf/qZCm9LhM1I1QRmED4FnkweM=";
   };
 
+  nativeBuildInputs = with python3.pkgs; [
+    pythonRelaxDepsHook
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     bottle
     colorama
@@ -41,6 +45,11 @@ python3.pkgs.buildPythonApplication rec {
     pyopenssl
   ];
 
+  pythonRelaxDeps = [
+    # This can be removed once conan is updated to 2.0.7+
+    "PyYAML"
+  ];
+
   nativeCheckInputs = [
     git
     pkg-config
diff --git a/pkgs/development/tools/check-jsonschema/default.nix b/pkgs/development/tools/check-jsonschema/default.nix
index 868889648486..3082ec2bd798 100644
--- a/pkgs/development/tools/check-jsonschema/default.nix
+++ b/pkgs/development/tools/check-jsonschema/default.nix
@@ -4,7 +4,7 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "check-jsonschema";
-  version = "0.21.0";
+  version = "0.23.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -13,7 +13,7 @@ buildPythonApplication rec {
     owner = "python-jsonschema";
     repo = "check-jsonschema";
     rev = version;
-    hash = "sha256-7cXnV27LCG1MXDH28UBmUC4sLooH2gKvGYF3YijLB38=";
+    hash = "sha256-gPFG1AgInakF8leMM0c1zZt2OdZdIKcUmItwICV8p1I=";
   };
 
   propagatedBuildInputs = [
@@ -29,16 +29,6 @@ buildPythonApplication rec {
     responses
   ];
 
-  pytestFlagsArray = [
-    # DeprecationWarning: Accessing jsonschema.draft3_format_checker is deprecated and will be removed in a future release. Instead, use the FORMAT_CHECKER attribute on the corresponding Validator.
-    "-W" "ignore::DeprecationWarning"
-  ];
-
-  preCheck = lib.optionalString (stdenv.isDarwin && stdenv.isAarch64) ''
-    # https://github.com/python/cpython/issues/74570#issuecomment-1093748531
-    export no_proxy='*';
-  '';
-
   pythonImportsCheck = [
     "check_jsonschema"
     "check_jsonschema.cli"
diff --git a/pkgs/development/tools/dt-schema/default.nix b/pkgs/development/tools/dt-schema/default.nix
new file mode 100644
index 000000000000..5736d301b32d
--- /dev/null
+++ b/pkgs/development/tools/dt-schema/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, python3
+}:
+
+let python = python3.override {
+  packageOverrides = self: super: {
+    # see https://github.com/devicetree-org/dt-schema/issues/108
+    jsonschema = super.jsonschema.overridePythonAttrs (old: rec {
+      version = "4.17.3";
+      disabled = self.pythonOlder "3.7";
+
+      src = old.src.override {
+        inherit version;
+        hash = "sha256-D4ZEN6uLYHa6ZwdFPvj5imoNUSqA6T+KvbZ29zfstg0=";
+      };
+
+      propagatedBuildInputs = with self; ([
+        attrs
+        pyrsistent
+      ] ++ lib.optionals (pythonOlder "3.8") [
+        importlib-metadata
+        typing-extensions
+      ] ++ lib.optionals (pythonOlder "3.9") [
+        importlib-resources
+        pkgutil-resolve-name
+      ]);
+    });
+  };
+}; in python.pkgs.toPythonApplication python.pkgs.dtschema
+
diff --git a/pkgs/development/tools/hatch/default.nix b/pkgs/development/tools/hatch/default.nix
index f6760d5938a6..c145504015c2 100644
--- a/pkgs/development/tools/hatch/default.nix
+++ b/pkgs/development/tools/hatch/default.nix
@@ -7,12 +7,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "hatch";
-  version = "1.6.3";
+  version = "1.7.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZQ5nG6MAMY5Jjvk7vjuZsyzhSSB2T7h1P4mZP2Pu15o=";
+    hash = "sha256-evxwH9WzNoSmZQ4eyriVfhloX4JCQLp0WNys1m+Q+0Y=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -61,17 +61,24 @@ python3.pkgs.buildPythonApplication rec {
     "test_editable_pth"
     # AssertionError: assert len(extract_installed_requirements(output.splitlines())) > 0
     "test_creation_allow_system_packages"
-    # Formatting changes with pygments 2.14.0
-    "test_create_necessary_directories"
+    # tomlkit 0.12 changes
+    "test_no_strict_naming"
+    "test_project_location_basic_set_first_project"
+    "test_project_location_complex_set_first_project"
   ] ++ lib.optionals stdenv.isDarwin [
     # https://github.com/NixOS/nixpkgs/issues/209358
     "test_scripts_no_environment"
+
+    # This test assumes it is running on macOS with a system shell on the PATH.
+    # It is not possible to run it in a nix build using a /nix/store shell.
+    # See https://github.com/pypa/hatch/pull/709 for the relevant code.
+    "test_populate_default_popen_kwargs_executable"
   ];
 
   meta = with lib; {
     description = "Modern, extensible Python project manager";
     homepage = "https://hatch.pypa.io/latest/";
-    changelog = "https://github.com/pypa/hatch/blob/hatch-v${version}/docs/history.md#hatch";
+    changelog = "https://github.com/pypa/hatch/blob/hatch-v${version}/docs/history/hatch.md";
     license = licenses.mit;
     maintainers = with maintainers; [ onny ];
   };
diff --git a/pkgs/development/tools/misc/catppuccin-catwalk/default.nix b/pkgs/development/tools/misc/catppuccin-catwalk/default.nix
index f0ba4aae74d5..fc48fc83374b 100644
--- a/pkgs/development/tools/misc/catppuccin-catwalk/default.nix
+++ b/pkgs/development/tools/misc/catppuccin-catwalk/default.nix
@@ -15,6 +15,11 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-5TAw5H3soxe9vLhfj1qs8uMr4ybrHlCj4zdsMzvPo6s=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'Pillow = "^' 'Pillow = ">='
+  '';
+
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
   ];
diff --git a/pkgs/development/tools/parsing/re2c/default.nix b/pkgs/development/tools/parsing/re2c/default.nix
index 09a955f965d9..311be4ccdc29 100644
--- a/pkgs/development/tools/parsing/re2c/default.nix
+++ b/pkgs/development/tools/parsing/re2c/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re2c";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner  = "skvadrik";
     repo   = "re2c";
     rev    = version;
-    sha256 = "sha256-ovwmltu97fzNQT0oZHefrAo4yV9HV1NwcY4PTSM5Bro=";
+    sha256 = "sha256-7zZdLby7HdNoURgdkg+xnlp6VDCACcyGCTtjM43OLd4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/pifpaf/default.nix b/pkgs/development/tools/pifpaf/default.nix
index fbf281634609..e11baa783ba6 100644
--- a/pkgs/development/tools/pifpaf/default.nix
+++ b/pkgs/development/tools/pifpaf/default.nix
@@ -29,6 +29,7 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeCheckInputs = with python3.pkgs; [
     requests
+    testtools
   ];
 
   pythonImportsCheck = [ "pifpaf" ];
diff --git a/pkgs/development/tools/rust/cargo-c/default.nix b/pkgs/development/tools/rust/cargo-c/default.nix
index a3fb8ea57c67..4f5418ea4fac 100644
--- a/pkgs/development/tools/rust/cargo-c/default.nix
+++ b/pkgs/development/tools/rust/cargo-c/default.nix
@@ -8,20 +8,21 @@
 , CoreFoundation
 , libiconv
 , Security
+, rav1e
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-c";
-  version = "0.9.20";
+  version = "0.9.22";
 
   src = fetchCrate {
     inherit pname;
     # this version may need to be updated along with package version
-    version = "${version}+cargo-0.71";
-    hash = "sha256-T0/gqzeJxDSZDoi8tl4vgYEAFbJDlCoxuqoi6rnf5U4=";
+    version = "${version}+cargo-0.72";
+    hash = "sha256-B9y8/8qms+t6LnUFes4/MGcEp8P8C2hunCouiTMt0LY=";
   };
 
-  cargoHash = "sha256-tArfCEGFRgJPERZW1HzfdDedc+FD8bpc+LX4wNwdv6Q=";
+  cargoHash = "sha256-7amH8qPmi531sDy3aZsZ5J/oSCnbHY47YzsFODDPcBU=";
 
   nativeBuildInputs = [ pkg-config (lib.getDev curl) ];
   buildInputs = [ openssl curl ] ++ lib.optionals stdenv.isDarwin [
@@ -40,6 +41,10 @@ rustPlatform.buildRustPackage rec {
     runHook postInstallCheck
   '';
 
+  passthru.tests = {
+    inherit rav1e;
+  };
+
   meta = with lib; {
     description = "A cargo subcommand to build and install C-ABI compatible dynamic and static libraries";
     longDescription = ''
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index eb2bf54f299b..6542dacbe9e7 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -3,8 +3,6 @@
 , stdenv
 , fetchFromGitHub
 , rustPlatform
-, pkg-config
-, dbus
 , libiconv
 , Security
 }:
@@ -22,10 +20,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-EGgVPRaofia+AwXSr6X4Aa8jbk5qDkXg1XvMoEp0qMQ=";
 
-  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
-
-  buildInputs = lib.optionals stdenv.isLinux [ dbus ]
-    ++ lib.optionals stdenv.isDarwin [ Security libiconv ];
+  buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 
   # Requires network access, fails in sandbox.
   doCheck = false;
diff --git a/pkgs/development/web/boa/default.nix b/pkgs/development/web/boa/default.nix
index de7b41ad4a28..dffc94934868 100644
--- a/pkgs/development/web/boa/default.nix
+++ b/pkgs/development/web/boa/default.nix
@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, fetchpatch
 , pkg-config
 , bzip2
 , openssl
@@ -21,6 +22,14 @@ rustPlatform.buildRustPackage rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-rust-1.71-lints.patch";
+      url = "https://github.com/boa-dev/boa/commit/93d05bda6864aa6ee67682d84bd4fc2108093ef5.patch";
+      hash = "sha256-hMp4/UBN5moGBSqf8BJV2nBwgV3cry9uC2fJmdT5hkQ=";
+    })
+  ];
+
   cargoHash = "sha256-2ZzTvVoA4oxy26rL0tvdvXm2oVWpHP+gooyjB4vIP3M=";
 
   cargoBuildFlags = [ "--package" "boa_cli" ];
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index 130545b8d973..572f00a49a08 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -9,8 +9,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "18.16.1";
-  sha256 = "sha256-6EBPjI2J/f336Vu7xgZr0OVxrLpY9USSWZthX77v4nI=";
+  version = "18.17.0";
+  sha256 = "01h4fzr0dpnhmd96hxhbb8dhyylp68j5ramrrh9w4fgaynnzmh40";
   patches = [
     ./disable-darwin-v8-system-instrumentation.patch
     ./bypass-darwin-xcrun-node16.patch
diff --git a/pkgs/games/gscrabble/default.nix b/pkgs/games/gscrabble/default.nix
index b21cdadac1e0..28e2a58b0d00 100644
--- a/pkgs/games/gscrabble/default.nix
+++ b/pkgs/games/gscrabble/default.nix
@@ -15,11 +15,11 @@ buildPythonApplication {
 
   doCheck = false;
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
 
   buildInputs = with gst_all_1; [
     gst-plugins-base gst-plugins-good gst-plugins-ugly gst-plugins-bad
-    gnome.adwaita-icon-theme gtk3 gobject-introspection
+    gnome.adwaita-icon-theme gtk3
   ];
 
   propagatedBuildInputs = with python3Packages; [ gst-python pygobject3 ];
diff --git a/pkgs/games/gshogi/default.nix b/pkgs/games/gshogi/default.nix
index 4b674ac129df..77eab7918b91 100644
--- a/pkgs/games/gshogi/default.nix
+++ b/pkgs/games/gshogi/default.nix
@@ -21,10 +21,9 @@ python3.pkgs.buildPythonApplication rec {
 
   buildInputs = [
     gtk3
-    gobject-introspection
   ];
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
 
   propagatedBuildInputs = with python3.pkgs; [
     pygobject3
diff --git a/pkgs/games/jumpnbump/default.nix b/pkgs/games/jumpnbump/default.nix
index b502b4f1396d..193d4dc0b585 100644
--- a/pkgs/games/jumpnbump/default.nix
+++ b/pkgs/games/jumpnbump/default.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  nativeBuildInputs = [ python3Packages.wrapPython wrapGAppsHook ];
-  buildInputs = [ SDL2 SDL2_mixer SDL2_net gtk3 gobject-introspection ];
+  nativeBuildInputs = [ python3Packages.wrapPython wrapGAppsHook gobject-introspection ];
+  buildInputs = [ SDL2 SDL2_mixer SDL2_net gtk3 ];
 
   postInstall = ''
     make -C menu PREFIX=$out all install
diff --git a/pkgs/games/klavaro/default.nix b/pkgs/games/klavaro/default.nix
index 6ea029176482..79585e74a095 100644
--- a/pkgs/games/klavaro/default.nix
+++ b/pkgs/games/klavaro/default.nix
@@ -39,8 +39,14 @@ stdenv.mkDerivation rec {
       --replace "/usr/bin/file" "${file}/bin/file"
   '';
 
-  # Hack to avoid TMPDIR in RPATHs.
-  preFixup = ''rm -rf "$(pwd)" '';
+  # remove forbidden references to $TMPDIR
+  preFixup = lib.optionalString stdenv.isLinux ''
+    for f in "$out"/bin/*; do
+      if isELF "$f"; then
+        patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$f"
+      fi
+    done
+  '';
 
   meta = with lib; {
     description = "Free touch typing tutor program";
diff --git a/pkgs/games/minecraft/default.nix b/pkgs/games/minecraft/default.nix
index a8e883acae37..3009eb0b9a08 100644
--- a/pkgs/games/minecraft/default.nix
+++ b/pkgs/games/minecraft/default.nix
@@ -100,8 +100,7 @@ stdenv.mkDerivation rec {
     sha256 = "0w8z21ml79kblv20wh5lz037g130pxkgs8ll9s3bi94zn2pbrhim";
   };
 
-  nativeBuildInputs = [ makeWrapper wrapGAppsHook copyDesktopItems ];
-  buildInputs = [ gobject-introspection ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook copyDesktopItems gobject-introspection ];
 
   sourceRoot = ".";
 
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index 7c85da21f7f3..7d5b622eaa81 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, python3Packages, makeWrapper
-, bash, libsamplerate, libsndfile, readline, eigen, celt
+, libsamplerate, libsndfile, readline, eigen, celt
 , wafHook
 # Darwin Dependencies
 , aften, AudioUnit, CoreAudio, libobjc, Accelerate
@@ -46,9 +46,8 @@ stdenv.mkDerivation (finalAttrs: {
     aften AudioUnit CoreAudio Accelerate libobjc
   ];
 
-  prePatch = ''
-    substituteInPlace svnversion_regenerate.sh \
-        --replace /bin/bash ${bash}/bin/bash
+  postPatch = ''
+    patchShebangs --build svnversion_regenerate.sh
   '';
 
   dontAddWafCrossFlags = true;
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index b05d973bb3d3..7650dcdc8c70 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -63,6 +63,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
   MIG = "mig";
   MIGCOM = "migcom";
   STRIP = "${stdenv.cc.bintools.targetPrefix or ""}strip";
+  RANLIB = "${stdenv.cc.bintools.targetPrefix or ""}ranlib";
   NM = "${stdenv.cc.bintools.targetPrefix or ""}nm";
   UNIFDEF = "unifdef";
   DSYMUTIL = "dsymutil";
diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
index fc7da8fe9baa..c19646ac529a 100644
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kbd";
-  version = "2.5.1";
+  version = "2.6.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/kbd/${pname}-${version}.tar.xz";
-    sha256 = "sha256-zN9FI4emOAlz0pJzY+nLuTn6IGiRWm+Tf/nSRSICRoM=";
+    sha256 = "sha256-LrbGyXK+lYm6tzMnW/AgvrX2RNX5Q5c3kg5wGvbPNIU=";
   };
 
   # vlock is moved into its own output, since it depends on pam. This
diff --git a/pkgs/os-specific/linux/libsmbios/default.nix b/pkgs/os-specific/linux/libsmbios/default.nix
index 2049b7cf0e70..144533621b75 100644
--- a/pkgs/os-specific/linux/libsmbios/default.nix
+++ b/pkgs/os-specific/linux/libsmbios/default.nix
@@ -35,7 +35,10 @@ stdenv.mkDerivation rec {
     cp -a out/public-include/smbios_c $out/include/
   '';
 
-  preFixup = ''rm -rf "$(pwd)" ''; # Hack to avoid TMPDIR in RPATHs
+  # remove forbidden reference to $TMPDIR
+  preFixup = ''
+    patchelf --shrink-rpath --allowed-rpath-prefixes "/nix/store" "$out/sbin/smbios-sys-info-lite"
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/dell/libsmbios";
diff --git a/pkgs/os-specific/linux/lm-sensors/default.nix b/pkgs/os-specific/linux/lm-sensors/default.nix
index 895e84f827b4..9b37b7c7e63e 100644
--- a/pkgs/os-specific/linux/lm-sensors/default.nix
+++ b/pkgs/os-specific/linux/lm-sensors/default.nix
@@ -48,7 +48,10 @@ stdenv.mkDerivation rec {
 
   # Making regexp to patch-out installing of .so symlinks from Makefile is
   # complicated, it is easier to remove them post-install.
-  postInstall = lib.optionalString stdenv.hostPlatform.isStatic ''
+  postInstall = ''
+    mkdir -p $out/share/doc/${pname}
+    cp -r configs doc/* $out/share/doc/${pname}
+  '' + lib.optionalString stdenv.hostPlatform.isStatic ''
     rm $out/lib/*.so*
   '';
 
diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix
index 5ef0b0b0ea7f..ce59cea368b1 100644
--- a/pkgs/os-specific/linux/tiscamera/default.nix
+++ b/pkgs/os-specific/linux/tiscamera/default.nix
@@ -60,6 +60,7 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
     wrapGAppsHook
+    gobject-introspection
   ] ++ lib.optionals withDoc [
     sphinx
     graphviz
@@ -81,7 +82,6 @@ stdenv.mkDerivation rec {
     pcre
     zstd
     glib
-    gobject-introspection
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 8772c081e037..a002e1af8899 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , makeWrapper
 , pkg-config
 , rsync
@@ -18,15 +17,20 @@
 , libgudev
 , libusb1
 , glib
-, gobject-introspection
 , gettext
 , systemd
+, nixosTests
 , useIMobileDevice ? true
 , libimobiledevice
-, withDocs ? (stdenv.buildPlatform == stdenv.hostPlatform)
-, nixosTests
+, withDocs ? withIntrospection
+, mesonEmulatorHook
+, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, buildPackages
+, gobject-introspection
 }:
 
+assert withDocs -> withIntrospection;
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "upower";
   version = "1.90.2";
@@ -60,14 +64,19 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     python3
-    gtk-doc
     docbook-xsl-nons
     gettext
-    gobject-introspection
     libxslt
     makeWrapper
     pkg-config
     rsync
+    glib
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+  ] ++ lib.optionals withDocs [
+    gtk-doc
+  ] ++ lib.optionals (withDocs && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   buildInputs = [
@@ -110,8 +119,8 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dsystemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
     "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
     "-Dudevhwdbdir=${placeholder "out"}/lib/udev/hwdb.d"
-    "-Dintrospection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "auto" else "disabled"}"
-    "-Dgtk-doc=${lib.boolToString withDocs}"
+    (lib.mesonEnable "introspection" withIntrospection)
+    (lib.mesonBool "gtk-doc" withDocs)
     "-Dinstalled_test_prefix=${placeholder "installedTests"}"
   ];
 
diff --git a/pkgs/servers/baserow/default.nix b/pkgs/servers/baserow/default.nix
index 702676dfc942..09a1b5e83da2 100644
--- a/pkgs/servers/baserow/default.nix
+++ b/pkgs/servers/baserow/default.nix
@@ -48,10 +48,15 @@ with python.pkgs; buildPythonApplication rec {
   sourceRoot = "${src.name}/backend";
 
   postPatch = ''
+    # use input files to not depend on outdated peer dependencies
+    mv requirements/base.{in,txt}
+    mv requirements/dev.{in,txt}
+
     # remove dependency constraints
-    sed 's/[~<>=].*//' -i requirements/base.in requirements/base.txt
-    sed 's/zope-interface/zope.interface/' -i requirements/base.in requirements/base.txt
-    sed 's/\[standard\]//' -i requirements/base.in requirements/base.txt
+    sed -i requirements/base.txt \
+      -e 's/[~<>=].*//' -i requirements/base.txt \
+      -e 's/zope-interface/zope.interface/' \
+      -e 's/\[standard\]//'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 9c074cf090cc..ad390836d707 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -449,6 +449,10 @@ in python.pkgs.buildPythonApplication rec {
     "--deselect tests/test_config.py::test_merge"
     # AssertionError: assert 2 == 1
     "--deselect=tests/helpers/test_translation.py::test_caching"
+    # AssertionError: assert None == RegistryEntry
+    "--deselect=tests/helpers/test_entity_registry.py::test_get_or_create_updates_data"
+    # AssertionError: assert 2 == 1
+    "--deselect=tests/helpers/test_entity_values.py::test_override_single_value"
     # tests are located in tests/
     "tests"
   ];
diff --git a/pkgs/servers/http/unit/default.nix b/pkgs/servers/http/unit/default.nix
index e1f41f2f6b6b..3eecd652ada3 100644
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@@ -3,8 +3,8 @@
 , withPython3 ? true, python3, ncurses
 , withPHP81 ? true, php81
 , withPHP82 ? false, php82
-, withPerl534 ? false, perl534
-, withPerl536 ? true, perl536
+, withPerl536 ? false, perl536
+, withPerl538 ? true, perl538
 , withPerldevel ? false, perldevel
 , withRuby_3_0 ? false, ruby_3_0
 , withRuby_3_1 ? true, ruby_3_1
@@ -46,8 +46,8 @@ in stdenv.mkDerivation rec {
     ++ optionals withPython3 [ python3 ncurses ]
     ++ optional withPHP81 php81-unit
     ++ optional withPHP82 php82-unit
-    ++ optional withPerl534 perl534
     ++ optional withPerl536 perl536
+    ++ optional withPerl538 perl538
     ++ optional withPerldevel perldevel
     ++ optional withRuby_3_0 ruby_3_0
     ++ optional withRuby_3_1 ruby_3_1
@@ -70,8 +70,8 @@ in stdenv.mkDerivation rec {
     ${optionalString withPython3    "./configure python --module=python3  --config=python3-config  --lib-path=${python3}/lib"}
     ${optionalString withPHP81      "./configure php    --module=php81    --config=${php81-unit.unwrapped.dev}/bin/php-config --lib-path=${php81-unit}/lib"}
     ${optionalString withPHP82      "./configure php    --module=php81    --config=${php82-unit.unwrapped.dev}/bin/php-config --lib-path=${php82-unit}/lib"}
-    ${optionalString withPerl534    "./configure perl   --module=perl534  --perl=${perl534}/bin/perl"}
     ${optionalString withPerl536    "./configure perl   --module=perl536  --perl=${perl536}/bin/perl"}
+    ${optionalString withPerl538    "./configure perl   --module=perl538  --perl=${perl538}/bin/perl"}
     ${optionalString withPerldevel  "./configure perl   --module=perldev  --perl=${perldevel}/bin/perl"}
     ${optionalString withRuby_3_0   "./configure ruby   --module=ruby30   --ruby=${ruby_3_0}/bin/ruby"}
     ${optionalString withRuby_3_1   "./configure ruby   --module=ruby31   --ruby=${ruby_3_1}/bin/ruby"}
diff --git a/pkgs/servers/imgproxy/default.nix b/pkgs/servers/imgproxy/default.nix
index 88dacb73986d..10cafd2019c7 100644
--- a/pkgs/servers/imgproxy/default.nix
+++ b/pkgs/servers/imgproxy/default.nix
@@ -14,9 +14,9 @@ buildGoModule rec {
 
   vendorHash = "sha256-5o1i88v+1UGYXP2SzyM6seyidrj1Z3Q64w/gi07xf4w=";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config gobject-introspection ];
 
-  buildInputs = [ gobject-introspection vips ]
+  buildInputs = [ vips ]
     ++ lib.optionals stdenv.isDarwin [ libunwind ];
 
   preBuild = ''
diff --git a/pkgs/servers/matrix-synapse/plugins/rendezvous.nix b/pkgs/servers/matrix-synapse/plugins/rendezvous.nix
index fe1f2469ef2d..c15c24681a2c 100644
--- a/pkgs/servers/matrix-synapse/plugins/rendezvous.nix
+++ b/pkgs/servers/matrix-synapse/plugins/rendezvous.nix
@@ -29,13 +29,8 @@ buildPythonPackage rec {
     maturinBuildHook
   ]);
 
-  preBuild = ''
-    cd synapse
-  '';
+  buildAndTestSubdir = "synapse";
 
-  postBuild = ''
-    cd ..
-  '';
 
   pythonImportsCheck = [ "matrix_http_rendezvous_synapse" ];
 
diff --git a/pkgs/servers/mlflow-server/default.nix b/pkgs/servers/mlflow-server/default.nix
index e140eac00748..a043d22aa978 100644
--- a/pkgs/servers/mlflow-server/default.nix
+++ b/pkgs/servers/mlflow-server/default.nix
@@ -11,7 +11,7 @@ py.toPythonApplication
       py.mysqlclient
     ];
 
-    postPatch = ''
+    postPatch = (old.postPatch or "") + ''
       substituteInPlace mlflow/utils/process.py --replace \
         "child = subprocess.Popen(cmd, env=cmd_env, cwd=cwd, universal_newlines=True," \
         "cmd[0]='$out/bin/gunicornMlflow'; child = subprocess.Popen(cmd, env=cmd_env, cwd=cwd, universal_newlines=True,"
diff --git a/pkgs/servers/nosql/janusgraph/default.nix b/pkgs/servers/nosql/janusgraph/default.nix
index ea9654a878dc..16b2ca404246 100644
--- a/pkgs/servers/nosql/janusgraph/default.nix
+++ b/pkgs/servers/nosql/janusgraph/default.nix
@@ -30,6 +30,10 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${jdk11}/bin/java $out/bin/janusgraph-server \
       --add-flags "-classpath $classpath org.janusgraph.graphdb.server.JanusGraphServer"
+
+    # temporary workaround for
+    # https://github.com/NixOS/nixpkgs/pull/244400#issuecomment-1667330430
+    cd "$TMPDIR"
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/openafs/1.8/default.nix b/pkgs/servers/openafs/1.8/default.nix
index bc164c9b963a..4ae1b0d13b6f 100644
--- a/pkgs/servers/openafs/1.8/default.nix
+++ b/pkgs/servers/openafs/1.8/default.nix
@@ -117,10 +117,13 @@ stdenv.mkDerivation {
     cp -r doc/doxygen/output/html $devdoc/share/devhelp/openafs/doxygen
   '';
 
-  # Avoid references to $TMPDIR by removing it and let patchelf cleanup the
-  # binaries.
+  # remove forbidden references to $TMPDIR
   preFixup = ''
-    rm -rf "$(pwd)" && mkdir "$(pwd)"
+    for f in "$out"/bin/*; do
+      if isELF "$f"; then
+        patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$f"
+      fi
+    done
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/slimserver/default.nix b/pkgs/servers/slimserver/default.nix
index 4a98e2a436e1..f561eec0bac8 100644
--- a/pkgs/servers/slimserver/default.nix
+++ b/pkgs/servers/slimserver/default.nix
@@ -5,14 +5,14 @@
 , lib
 , makeWrapper
 , monkeysAudio
-, perl534Packages
+, perlPackages
 , sox
 , stdenv
 , wavpack
 , zlib
 }:
 
-perl534Packages.buildPerlPackage rec {
+perlPackages.buildPerlPackage rec {
   pname = "slimserver";
   version = "8.3.1";
 
@@ -25,7 +25,7 @@ perl534Packages.buildPerlPackage rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs = [ perl534Packages.CryptOpenSSLRSA perl534Packages.IOSocketSSL ];
+  buildInputs = [ perlPackages.CryptOpenSSLRSA perlPackages.IOSocketSSL ];
 
   prePatch = ''
     rm -rf Bin
diff --git a/pkgs/servers/web-apps/nifi/default.nix b/pkgs/servers/web-apps/nifi/default.nix
index 734ced245056..4b66484f7b27 100644
--- a/pkgs/servers/web-apps/nifi/default.nix
+++ b/pkgs/servers/web-apps/nifi/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ jdk11 ];
 
   installPhase = ''
-    mv ../$sourceRoot $out
+    cp -r ../$sourceRoot $out
     rm -f $out/bin/*bat
     rm -rf $out/extensions
     mkdir -p $out/share/nifi
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index cf194be92bd7..0d9ae8d3c4fb 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -70,7 +70,10 @@ let
       ../../build-support/setup-hooks/prune-libtool-files.sh
       ../../build-support/setup-hooks/reproducible-builds.sh
       ../../build-support/setup-hooks/set-source-date-epoch-to-latest.sh
-      ../../build-support/setup-hooks/strip.sh
+      (with buildPlatform; if isAarch64 && isLinux
+        then ../../build-support/setup-hooks/strip-tmp-aarch64.sh
+        else ../../build-support/setup-hooks/strip.sh
+      )
     ] ++ lib.optionals hasCC [ cc ];
 
   defaultBuildInputs = extraBuildInputs;
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 1f596ada5a0b..7fe5f67b14de 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1594,7 +1594,7 @@ genericBuild() {
 
         if [ "$curPhase" = unpackPhase ]; then
             # make sure we can cd into the directory
-            [ -z "${sourceRoot}" ] || chmod +x "${sourceRoot}"
+            [ -n "${sourceRoot:-}" ] && chmod +x "${sourceRoot}"
 
             cd "${sourceRoot:-.}"
         fi
diff --git a/pkgs/tools/X11/caffeine-ng/default.nix b/pkgs/tools/X11/caffeine-ng/default.nix
index 344e3a892450..66103ba6f8dc 100644
--- a/pkgs/tools/X11/caffeine-ng/default.nix
+++ b/pkgs/tools/X11/caffeine-ng/default.nix
@@ -30,6 +30,7 @@ let
       inherit version;
       hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
     };
+    disabledTests = [ "test_bytes_args" ]; # https://github.com/pallets/click/commit/6e05e1fa1c2804
   });
 in buildPythonApplication rec {
   pname = "caffeine-ng";
diff --git a/pkgs/tools/admin/ansible/later.nix b/pkgs/tools/admin/ansible/later.nix
index 9cc7ffb38eb5..db1c7beb2a58 100644
--- a/pkgs/tools/admin/ansible/later.nix
+++ b/pkgs/tools/admin/ansible/later.nix
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     "jsonschema"
     "pathspec"
     "python-json-logger"
-    "pyyaml"
+    "PyYAML"
     "toolz"
     "unidiff"
     "yamllint"
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index dc5b34184ad0..e65cac675dbd 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -1,39 +1,17 @@
 { lib
 , python3
-, fetchFromGitHub
 , fetchPypi
 , groff
 , less
 }:
-let
-  py = python3.override {
-    packageOverrides = self: super: {
-      pyyaml = super.pyyaml.overridePythonAttrs rec {
-        version = "5.4.1";
-        src = fetchFromGitHub {
-          owner = "yaml";
-          repo = "pyyaml";
-          rev = version;
-          hash = "sha256-VUqnlOF/8zSOqh6JoEYOsfQ0P4g+eYqxyFTywgCS7gM=";
-        };
-        checkPhase = ''
-          runHook preCheck
-          PYTHONPATH="tests/lib3:$PYTHONPATH" ${self.python.interpreter} -m test_all
-          runHook postCheck
-        '';
-      };
-    };
-    self = py;
-  };
 
-in
-with py.pkgs; buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "awscli";
-  version = "1.27.79"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.29.9"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-A3MVM5MV+PTwR4W2ALrqEtMaFtVAEt8yqkd4ZLsvHGE=";
+    hash = "sha256-8SmOu79FZESL1Hd15wdd1m1Uewswqaum2y8LOZAl9P8=";
   };
 
   # https://github.com/aws/aws-cli/issues/4837
@@ -44,11 +22,10 @@ with py.pkgs; buildPythonApplication rec {
       --replace "rsa>=3.1.2,<4.8" "rsa<5,>=3.1.2"
   '';
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3.pkgs; [
     botocore
     bcdoc
     s3transfer
-    six
     colorama
     docutils
     rsa
@@ -68,14 +45,15 @@ with py.pkgs; buildPythonApplication rec {
   '';
 
   passthru = {
-    python = py; # for aws_shell
+    python = python3; # for aws_shell
   };
 
   doInstallCheck = true;
+
   installCheckPhase = ''
     runHook preInstallCheck
 
-    $out/bin/aws --version | grep "${py.pkgs.botocore.version}"
+    $out/bin/aws --version | grep "${python3.pkgs.botocore.version}"
     $out/bin/aws --version | grep "${version}"
 
     runHook postInstallCheck
diff --git a/pkgs/tools/admin/awscli2/default.nix b/pkgs/tools/admin/awscli2/default.nix
index be8db6101d74..fa18015c8ff5 100644
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@@ -3,6 +3,7 @@
 , groff
 , less
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , testers
 , awscli2
@@ -10,8 +11,13 @@
 
 let
   py = python3 // {
-    pkgs = python3.pkgs.overrideScope (self: super: {
-      # nothing right now
+    pkgs = python3.pkgs.overrideScope (final: prev: {
+      ruamel-yaml = prev.ruamel-yaml.overridePythonAttrs (prev: {
+        src = prev.src.override {
+          version = "0.17.21";
+          hash = "sha256-i3zml6LyEnUqNcGsQURx3BbEJMlXO+SSa1b/P10jt68=";
+        };
+      });
     });
   };
 
@@ -28,9 +34,19 @@ with py.pkgs; buildPythonApplication rec {
     hash = "sha256-gtzRHNEReCKzGDdiwS5kngcJYp5oAHmhnOPl/uTyxvU=";
   };
 
+  patches = [
+    # https://github.com/aws/aws-cli/pull/7912
+    (fetchpatch {
+      name = "update-flit-core.patch";
+      url = "https://github.com/aws/aws-cli/commit/83412a4b2ec750bada640a34a87bfe07ce41fb50.patch";
+      hash = "sha256-uhO6aOSptsARYWuXXEFhx+6rCW5/uGn2KQ15BnhzH68=";
+    })
+  ];
+
   postPatch = ''
-    substituteInPlace requirements/bootstrap.txt \
-      --replace "pip>=22.0.0,<23.0.0" "pip>=22.0.0,<24.0.0"
+    substituteInPlace pyproject.toml \
+      --replace 'cryptography>=3.3.2,<40.0.2' 'cryptography>=3.3.2' \
+      --replace 'flit_core>=3.7.1,<3.8.1' 'flit_core>=3.7.1'
   '';
 
   nativeBuildInputs = [
@@ -74,8 +90,6 @@ with py.pkgs; buildPythonApplication rec {
     rm $out/bin/aws.cmd
   '';
 
-  doCheck = true;
-
   preCheck = ''
     export PATH=$PATH:$out/bin
     export HOME=$(mktemp -d)
@@ -107,7 +121,7 @@ with py.pkgs; buildPythonApplication rec {
     tests.version = testers.testVersion {
       package = awscli2;
       command = "aws --version";
-      version = version;
+      inherit version;
     };
   };
 
diff --git a/pkgs/tools/admin/oci-cli/default.nix b/pkgs/tools/admin/oci-cli/default.nix
index 2772bc49a457..43e5ad9d650b 100644
--- a/pkgs/tools/admin/oci-cli/default.nix
+++ b/pkgs/tools/admin/oci-cli/default.nix
@@ -15,6 +15,7 @@ let
           hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
           sha256 = "";
         };
+        disabledTests = [ "test_bytes_args" ]; # https://github.com/pallets/click/commit/6e05e1fa1c2804
       });
 
       jmespath = super.jmespath.overridePythonAttrs (oldAttrs: rec {
diff --git a/pkgs/tools/archivers/gnutar/default.nix b/pkgs/tools/archivers/gnutar/default.nix
index 9be1ea7f4d44..331d977147b2 100644
--- a/pkgs/tools/archivers/gnutar/default.nix
+++ b/pkgs/tools/archivers/gnutar/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, acl }:
+{ lib, stdenv, fetchurl, autoreconfHook, acl, libintl }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnutar";
-  version = "1.34";
+  version = "1.35";
 
   src = fetchurl {
     url = "mirror://gnu/tar/tar-${version}.tar.xz";
-    sha256 = "sha256-Y769JoecXh7qQ1Lw0DyZH5Zq6z3es8dEXJAlaNVBHSg=";
+    sha256 = "sha256-TWL/NzQux67XSFNTI5MMfPlKz3HDWRiCsmp+pQ8+3BY=";
   };
 
   # avoid retaining reference to CF during stdenv bootstrap
@@ -31,7 +31,12 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "info" ];
 
   nativeBuildInputs = lib.optional stdenv.isDarwin autoreconfHook;
-  buildInputs = lib.optional stdenv.isLinux acl;
+  # Add libintl on Darwin specifically as it fails to link (or skip)
+  # NLS on it's own:
+  #  "_libintl_textdomain", referenced from:
+  #    _main in tar.o
+  #  ld: symbol(s) not found for architecture x86_64
+  buildInputs = lib.optional stdenv.isLinux acl ++ lib.optional stdenv.isDarwin libintl;
 
   # May have some issues with root compilation because the bootstrap tool
   # cannot be used as a login shell for now.
diff --git a/pkgs/tools/audio/beets/common.nix b/pkgs/tools/audio/beets/common.nix
index 801637320839..4c8f5ae80895 100644
--- a/pkgs/tools/audio/beets/common.nix
+++ b/pkgs/tools/audio/beets/common.nix
@@ -52,6 +52,12 @@ python3Packages.buildPythonApplication {
 
   patches = extraPatches;
 
+  postPatch = ''
+    # https://github.com/beetbox/beets/pull/4868
+    substituteInPlace beets/util/artresizer.py \
+      --replace "Image.ANTIALIAS" "Image.Resampling.LANCZOS"
+  '';
+
   propagatedBuildInputs = with python3Packages; [
     confuse
     gst-python
diff --git a/pkgs/tools/audio/headset-charge-indicator/default.nix b/pkgs/tools/audio/headset-charge-indicator/default.nix
index f771fd47a758..bed9c415c83b 100644
--- a/pkgs/tools/audio/headset-charge-indicator/default.nix
+++ b/pkgs/tools/audio/headset-charge-indicator/default.nix
@@ -14,13 +14,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-eaAbqeFY+B3CcKJywC3vaRsWZNQENTbALc7L7uW0W6U=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
 
   buildInputs = [
     (python3.withPackages (ps: with ps; [ pygobject3 ]))
     headsetcontrol
     gtk3
-    gobject-introspection
     libayatana-appindicator
   ];
 
diff --git a/pkgs/tools/backup/gphotos-sync/default.nix b/pkgs/tools/backup/gphotos-sync/default.nix
index 5315ee572353..707828fae713 100644
--- a/pkgs/tools/backup/gphotos-sync/default.nix
+++ b/pkgs/tools/backup/gphotos-sync/default.nix
@@ -8,7 +8,7 @@ python3.pkgs.buildPythonApplication rec {
   version = "3.1.2";
   format = "pyproject";
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   src = fetchFromGitHub {
     owner = "gilesknap";
@@ -22,9 +22,11 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
+
   pythonRelaxDeps = [
     "psutil"
     "exif"
+    "pyyaml"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
index 09a5362ae400..299dd0e1385d 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-gtk.nix
@@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
     gtk3
     gtk4
     fmt
-    gobject-introspection
     fcitx5
     pcre
     libuuid
@@ -64,6 +63,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     extra-cmake-modules
+    gobject-introspection
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index f902be816ba2..848758b54146 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -131,6 +131,7 @@ stdenv.mkDerivation rec {
     vala
     wrapGAppsHook
     dbus-launch
+    gobject-introspection
   ];
 
   propagatedBuildInputs = [
@@ -142,7 +143,6 @@ stdenv.mkDerivation rec {
     systemd
     dconf
     gdk-pixbuf
-    gobject-introspection
     python3.pkgs.pygobject3 # for pygobject overrides
     gtk2
     gtk3
diff --git a/pkgs/tools/misc/clipster/default.nix b/pkgs/tools/misc/clipster/default.nix
index e8bbb9540a11..e6efabb5b33a 100644
--- a/pkgs/tools/misc/clipster/default.nix
+++ b/pkgs/tools/misc/clipster/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation  rec {
 
   pythonEnv = python3.withPackages(ps: with ps; [ pygobject3 ]);
 
-  buildInputs =  [ pythonEnv gtk3 libwnck gobject-introspection wrapGAppsHook ];
+  nativeBuildInputs = [ gobject-introspection ];
+  buildInputs =  [ pythonEnv gtk3 libwnck wrapGAppsHook ];
 
   installPhase = ''
     sed -i 's/python/python3/g' clipster
diff --git a/pkgs/tools/misc/csvs-to-sqlite/default.nix b/pkgs/tools/misc/csvs-to-sqlite/default.nix
index 60168b2e44f5..dc140c1c0c01 100644
--- a/pkgs/tools/misc/csvs-to-sqlite/default.nix
+++ b/pkgs/tools/misc/csvs-to-sqlite/default.nix
@@ -1,36 +1,35 @@
-{ lib, python3, fetchFromGitHub }:
+{ lib, python3, fetchFromGitHub, fetchpatch }:
 
-let
-  # csvs-to-sqlite is currently not compatible with Click 8. See the following
-  # https://github.com/simonw/csvs-to-sqlite/issues/80
-  #
-  # Workaround the issue by providing click 7 explicitly.
-  python = python3.override {
-    packageOverrides = self: super: {
-      # Use click 7
-      click = super.click.overridePythonAttrs (old: rec {
-        version = "7.1.2";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
-        };
-      });
-    };
-  };
-in with python.pkgs; buildPythonApplication rec {
+with python3.pkgs; buildPythonApplication rec {
   pname = "csvs-to-sqlite";
-  version = "1.2";
+  version = "1.3";
   format = "setuptools";
 
-  disabled = !isPy3k;
-
   src = fetchFromGitHub {
     owner = "simonw";
     repo = pname;
     rev = version;
-    hash = "sha256-ZG7Yto8q9QNNJPB/LMwzucLfCGiqwBd3l0ePZs5jKV0";
+    hash = "sha256-wV6htULG3lg2IhG2bXmc/9vjcK8/+WA7jm3iJu4ZoOE=";
   };
 
+  patches = [
+    # https://github.com/simonw/csvs-to-sqlite/pull/92
+    (fetchpatch {
+      name = "pandas2-compatibility-1.patch";
+      url = "https://github.com/simonw/csvs-to-sqlite/commit/fcd5b9c7485bc7b95bf2ed9507f18a60728e0bcb.patch";
+      hash = "sha256-ZmaNWxsqeNw5H5gAih66DLMmzmePD4no1B5mTf8aFvI=";
+    })
+    (fetchpatch {
+      name = "pandas2-compatibility-2.patch";
+      url = "https://github.com/simonw/csvs-to-sqlite/commit/3d190aa44e8d3a66a9a3ca5dc11c6fe46da024df.patch";
+      hash = "sha256-uYUH0Mhn6LIf+AHcn6WuCo5zFuSNWOZBM+AoqkmMnSI=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
   propagatedBuildInputs = [
     click
     dateparser
@@ -39,15 +38,24 @@ in with python.pkgs; buildPythonApplication rec {
     six
   ];
 
+  pythonRelaxDeps = [
+    "click"
+  ];
+
   nativeCheckInputs = [
+    cogapp
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # Test needs to be adjusted for click >= 8.
+    "test_if_cog_needs_to_be_run"
+  ];
+
   meta = with lib; {
     description = "Convert CSV files into a SQLite database";
     homepage = "https://github.com/simonw/csvs-to-sqlite";
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
   };
-
 }
diff --git a/pkgs/tools/misc/gif-for-cli/default.nix b/pkgs/tools/misc/gif-for-cli/default.nix
index 73a81acd65e4..61690b5f41a9 100644
--- a/pkgs/tools/misc/gif-for-cli/default.nix
+++ b/pkgs/tools/misc/gif-for-cli/default.nix
@@ -1,19 +1,49 @@
-{ lib, fetchFromGitHub, python3Packages, ffmpeg, zlib, libjpeg }:
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, python3Packages
+, ffmpeg
+, zlib
+, libjpeg
+}:
 
 python3Packages.buildPythonApplication {
   pname = "gif-for-cli";
   version = "1.1.2";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "gif-for-cli";
     rev = "31f8aa2d617d6d6e941154f60e287c38dd9a74d5";
-    sha256 = "Bl5o492BUAn1KsscnlMIXCzJuy7xWUsdnxIKZKaRM3M=";
+    hash = "sha256-Bl5o492BUAn1KsscnlMIXCzJuy7xWUsdnxIKZKaRM3M=";
   };
 
-  nativeCheckInputs = [ python3Packages.coverage ];
-  buildInputs = [ zlib libjpeg ];
-  propagatedBuildInputs = with python3Packages; [ ffmpeg pillow requests x256 ];
+  patches = [
+    # https://github.com/google/gif-for-cli/pull/36
+    (fetchpatch {
+      name = "pillow-10-compatibility.patch";
+      url = "https://github.com/google/gif-for-cli/commit/49b13ec981e197cbc10f920b7b25a97c4cc6a61c.patch";
+      hash = "sha256-B8wfkdhSUY++St6DzgaJ1xF1mZKvi8oxLXbo63yemDM=";
+    })
+  ];
+
+  # coverage is not needed to build and test this package
+  postPatch = ''
+    sed -i '/coverage>=/d' setup.py
+  '';
+
+  buildInputs = [
+    zlib
+    libjpeg
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    ffmpeg
+    pillow
+    requests
+    x256
+  ];
 
   meta = with lib; {
     description = "Render gifs as ASCII art in your cli";
@@ -22,5 +52,4 @@ python3Packages.buildPythonApplication {
     license = licenses.asl20;
     maintainers = with maintainers; [ Scriptkiddi ];
   };
-
 }
diff --git a/pkgs/tools/misc/ldmtool/default.nix b/pkgs/tools/misc/ldmtool/default.nix
index 45cd96382381..51e3a77d8d68 100644
--- a/pkgs/tools/misc/ldmtool/default.nix
+++ b/pkgs/tools/misc/ldmtool/default.nix
@@ -31,9 +31,9 @@ stdenv.mkDerivation rec {
 
   configureScript = "sh autogen.sh";
 
-  nativeBuildInputs = [ pkg-config autoconf automake ];
+  nativeBuildInputs = [ pkg-config autoconf automake gobject-introspection ];
   buildInputs = [ gtk-doc lvm2 libxslt.bin
-    libtool readline gobject-introspection json-glib libuuid
+    libtool readline json-glib libuuid
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/man-db/default.nix b/pkgs/tools/misc/man-db/default.nix
index 398984b8c534..b52628373594 100644
--- a/pkgs/tools/misc/man-db/default.nix
+++ b/pkgs/tools/misc/man-db/default.nix
@@ -1,6 +1,7 @@
 { buildPackages
 , db
 , fetchurl
+, fetchpatch
 , groff
 , gzip
 , lib
@@ -20,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://savannah/man-db/man-db-${version}.tar.xz";
-    sha256 = "sha256-z/oe5Ol0vnhkbEZQjm3S8358WJqqspOMwQZPBY/vn40=";
+    hash = "sha256-z/oe5Ol0vnhkbEZQjm3S8358WJqqspOMwQZPBY/vn40=";
   };
 
   outputs = [ "out" "doc" ];
@@ -31,7 +32,35 @@ stdenv.mkDerivation rec {
   buildInputs = [ libpipeline db groff ]; # (Yes, 'groff' is both native and build input)
   nativeCheckInputs = [ libiconv /* for 'iconv' binary */ ];
 
-  patches = [ ./systemwide-man-db-conf.patch ];
+  patches = [
+    ./systemwide-man-db-conf.patch
+    # Remove the patches below when updating to the next man-db release.
+    # Patches addressing https://gitlab.com/man-db/man-db/-/issues/25 ...
+    (fetchpatch {
+      name = "update-warning-regex";
+      url = "https://gitlab.com/man-db/man-db/-/commit/b12ffb9df7.patch";
+      hash = "sha256-F+whRppaMZwgmGPKTXu2j1vZMNAm3vGNzNZcz9pg8Jc=";
+    })
+    (fetchpatch {
+      name = "fix-test-failures-when-iconv-not-available";
+      url = "https://gitlab.com/man-db/man-db/-/commit/26f46a60e5.patch";
+      hash = "sha256-W1a6GkYn4J3py7GLZc37xmQBQR18Xvcvj4fJoZ21+0k=";
+      # The following files are excluded from the patch as they fail to apply
+      # cleanly on the 2.11.2 sources and are deemed irrelevant for building man-db.
+      excludes = [ "NEWS.md" ];
+    })
+    # ... and https://gitlab.com/man-db/man-db/-/issues/26.
+    (fetchpatch {
+      name = "improve-lexgrog-portability";
+      url = "https://gitlab.com/man-db/man-db/-/commit/bbf7701c4f.patch";
+      hash = "sha256-QLOVgV0S2NxxTBObD8bJFR1QDH0p2RGMJXLVNagfddc=";
+    })
+    (fetchpatch {
+      name = "avoid-translation-fallout-from-lexgrog-fix";
+      url = "https://gitlab.com/man-db/man-db/-/commit/043c3cb83c.patch";
+      hash = "sha256-w12/LOGN9gO85zmqX7zookA55w3WUxBMJgWInpH5wms=";
+    })
+  ];
 
   postPatch = ''
     # Remove all mandatory manpaths. Nixpkgs makes no requirements on
@@ -79,7 +108,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  doCheck = !stdenv.hostPlatform.isMusl /* iconv binary */ && !stdenv.hostPlatform.isDarwin;
+  doCheck = !stdenv.hostPlatform.isMusl /* iconv binary */;
 
   passthru.tests = {
     nixos = nixosTests.man;
diff --git a/pkgs/tools/misc/rmlint/default.nix b/pkgs/tools/misc/rmlint/default.nix
index 121e574358e6..464b868b35d9 100644
--- a/pkgs/tools/misc/rmlint/default.nix
+++ b/pkgs/tools/misc/rmlint/default.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals withGui [
     makeWrapper
     wrapGAppsHook
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -51,7 +52,6 @@ stdenv.mkDerivation rec {
     util-linux
   ] ++ lib.optionals withGui [
     cairo
-    gobject-introspection
     gtksourceview3
     pango
     polkit
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/tools/misc/system-config-printer/default.nix
index c8d3df4e2b27..8b5d8d9e14f7 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/tools/misc/system-config-printer/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib udev libusb1 cups
     python3Packages.python
-    libnotify gobject-introspection gdk-pixbuf pango atk packagekit
+    libnotify gdk-pixbuf pango atk packagekit
     libsecret
   ];
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     intltool pkg-config
     xmlto libxml2 docbook_xml_dtd_412 docbook_xsl desktop-file-utils
     python3Packages.wrapPython
-    wrapGAppsHook autoreconfHook
+    wrapGAppsHook autoreconfHook gobject-introspection
   ];
 
   pythonPath = with python3Packages; requiredPythonModules [ pycups pycurl dbus-python pygobject3 requests pycairo pysmbc ];
diff --git a/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch b/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
index 3be4c273b3b3..2c732621d925 100644
--- a/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
+++ b/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
@@ -27,10 +27,10 @@ autoconf in the bootstrap loop just to regenerate a patched configure.ac.
  
  curl_includes_winsock2="\
 diff --git a/lib/curl_setup.h b/lib/curl_setup.h
-index 99048c489..19abfbbac 100644
+index 727d123e5..f78d8be4a 100644
 --- a/lib/curl_setup.h
 +++ b/lib/curl_setup.h
-@@ -247,19 +247,6 @@
+@@ -250,19 +250,6 @@
 
  #include <curl/system.h>
 
@@ -42,7 +42,7 @@ index 99048c489..19abfbbac 100644
 -#if defined(__APPLE__) && !defined(USE_ARES)
 -#include <TargetConditionals.h>
 -#define USE_RESOLVE_ON_IPS 1
--#  if defined(TARGET_OS_OSX) && TARGET_OS_OSX
+-#  if !defined(TARGET_OS_OSX) || TARGET_OS_OSX
 -#    define CURL_OSX_CALL_COPYPROXIES 1
 -#  endif
 -#endif
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 30f00df912c4..c15325a49e4d 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -47,14 +47,14 @@ assert !((lib.count (x: x) [ gnutlsSupport opensslSupport wolfsslSupport rustlsS
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.1.2";
+  version = "8.2.1";
 
   src = fetchurl {
     urls = [
-      "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.bz2"
-      "https://github.com/curl/curl/releases/download/curl-${finalAttrs.version}/curl-${finalAttrs.version}.tar.bz2"
+      "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
+      "https://github.com/curl/curl/releases/download/curl-${finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-tUl00y/WEKys6S498fZDFEAVrGWEfwoEH9wX229D8kM=";
+    hash = "sha256-3TIva9CiDmzr39OI9p6Yw9GDvteSz0cTyKfvSYy6SJQ=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index ab747df01f86..4983c30ab00b 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -128,7 +128,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     systemd
     libselinux
     audit
diff --git a/pkgs/tools/networking/networkmanager/dmenu/default.nix b/pkgs/tools/networking/networkmanager/dmenu/default.nix
index 7af0be418352..2d4656e69b70 100644
--- a/pkgs/tools/networking/networkmanager/dmenu/default.nix
+++ b/pkgs/tools/networking/networkmanager/dmenu/default.nix
@@ -13,7 +13,8 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-cJeDYk2BQv2ZWGC96I7lXFFYgseWj68ZfvE7ATW46U0=";
   };
 
-  buildInputs = [ glib python pygobject3 gobject-introspection networkmanager python3Packages.wrapPython ];
+  nativeBuildInputs = [ gobject-introspection ];
+  buildInputs = [ glib python pygobject3 networkmanager python3Packages.wrapPython ];
 
   dontBuild = true;
 
diff --git a/pkgs/tools/networking/whatip/default.nix b/pkgs/tools/networking/whatip/default.nix
index 735936a4da41..08979e71e35e 100644
--- a/pkgs/tools/networking/whatip/default.nix
+++ b/pkgs/tools/networking/whatip/default.nix
@@ -37,6 +37,7 @@ python3.pkgs.buildPythonApplication rec {
     wrapGAppsHook4
     appstream-glib
     desktop-file-utils
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -44,7 +45,6 @@ python3.pkgs.buildPythonApplication rec {
     gtk4
     librsvg
     libadwaita
-    gobject-introspection
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/nix/nix-init/default.nix b/pkgs/tools/nix/nix-init/default.nix
index d6a5df6272f4..1e24de6d1961 100644
--- a/pkgs/tools/nix/nix-init/default.nix
+++ b/pkgs/tools/nix/nix-init/default.nix
@@ -6,7 +6,7 @@
 , installShellFiles
 , pkg-config
 , bzip2
-, libgit2
+, libgit2_1_6
 , openssl
 , zlib
 , zstd
@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     bzip2
     curl
-    libgit2
+    libgit2_1_6
     openssl
     zlib
     zstd
diff --git a/pkgs/tools/package-management/poetry/default.nix b/pkgs/tools/package-management/poetry/default.nix
index 69eab159c797..62c4ac599697 100644
--- a/pkgs/tools/package-management/poetry/default.nix
+++ b/pkgs/tools/package-management/poetry/default.nix
@@ -23,6 +23,14 @@ let
           self.lockfile
         ];
       });
+      keyring = super.keyring.overridePythonAttrs (old: rec {
+        version = "23.13.1";
+        src = fetchPypi {
+          inherit (old) pname;
+          inherit version;
+          hash = "sha256-ui4VqbNeIZCNCq9OCkesxS1q4zRE3w2itJ1BpG721ng=";
+        };
+      });
       poetry-core = super.poetry-core.overridePythonAttrs (old: rec {
         version = "1.6.1";
         src = fetchFromGitHub {
@@ -36,17 +44,6 @@ let
           self.tomli-w
         ];
       });
-      virtualenv = super.virtualenv.overridePythonAttrs (old: rec {
-        version = "20.23.1";
-        src = fetchPypi {
-          inherit (old) pname;
-          inherit version;
-          hash = "sha256-j/GaOMECHHQhSO3E+By0PX+MaBbS7eKrcq9bhMdJreE=";
-        };
-        nativeCheckInputs = old.nativeCheckInputs ++ [
-          self.time-machine
-        ];
-      });
     } // (plugins self);
   };
 
diff --git a/pkgs/tools/security/das/default.nix b/pkgs/tools/security/das/default.nix
index f8ccf8cb4ac7..2f7cd2fa98f7 100644
--- a/pkgs/tools/security/das/default.nix
+++ b/pkgs/tools/security/das/default.nix
@@ -5,19 +5,20 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "das";
-  version = "0.3.6";
+  version = "0.3.8";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "snovvcrash";
     repo = "DivideAndScan";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UFuIy19OUiS8VmmfGm0F4hI4s4BU5b4ZVh40bFGiLfk=";
+    hash = "sha256-a9gnEBTvZshw42M/GrpCgjZh6FOzL45aZqGRyeHO0ec=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'networkx = "^2.8.4"' 'networkx = "*"'
+      --replace 'networkx = "^2.8.4"' 'networkx = "*"' \
+      --replace 'pandas = "^1.4.2"' 'pandas = "*"'
   '';
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/gencfsm/default.nix b/pkgs/tools/security/gencfsm/default.nix
index 4cf5338ca2e4..33f6297905ea 100644
--- a/pkgs/tools/security/gencfsm/default.nix
+++ b/pkgs/tools/security/gencfsm/default.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation rec {
     pkg-config
     vala
     wrapGAppsHook
+    gobject-introspection
   ];
   buildInputs = [
     glib
@@ -29,7 +30,6 @@ stdenv.mkDerivation rec {
     libgee
     xorg.libSM
     xorg.libICE
-    gobject-introspection
     libsecret
   ];
 
diff --git a/pkgs/tools/security/maigret/default.nix b/pkgs/tools/security/maigret/default.nix
index a8d7f4c6b532..f2d706bfe510 100644
--- a/pkgs/tools/security/maigret/default.nix
+++ b/pkgs/tools/security/maigret/default.nix
@@ -1,12 +1,14 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , python3
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "maigret";
   version = "0.4.4";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "soxoj";
@@ -15,7 +17,17 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-Z8SnA7Z5+oKW0AOaNf+c/zR30lrPFmXaxxKkbnDXNNs=";
   };
 
+  patches = [
+    # https://github.com/soxoj/maigret/pull/1117
+    (fetchpatch {
+      name = "pytest-7.3-compatibility.patch";
+      url = "https://github.com/soxoj/maigret/commit/ecb33de9e6eec12b6b45a1152199177f32c85be2.patch";
+      hash = "sha256-nFx3j1Q37YLtYhb0QS34UgZFgAc5Z/RVgbO9o1n1ONE=";
+    })
+  ];
+
   nativeBuildInputs = [ python3.pkgs.pythonRelaxDepsHook ];
+
   propagatedBuildInputs = with python3.pkgs; [
     aiodns
     aiohttp
@@ -57,6 +69,8 @@ python3.pkgs.buildPythonApplication rec {
     yarl
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = with python3.pkgs; [
     pytest-httpserver
     pytest-asyncio
diff --git a/pkgs/tools/security/rhash/default.nix b/pkgs/tools/security/rhash/default.nix
index 6e73375be208..e789eeba0539 100644
--- a/pkgs/tools/security/rhash/default.nix
+++ b/pkgs/tools/security/rhash/default.nix
@@ -6,14 +6,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.3";
+  version = "1.4.4";
   pname = "rhash";
 
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
     rev = "v${version}";
-    sha256 = "sha256-R+dHYG0DBI1uo+yF/pxoTv/V9WSfph043bH6erZjeCE=";
+    sha256 = "sha256-3CW41ULdXoID4cOgrcG2j85tgIJ/sz5hU7A83qpuxf4=";
   };
 
   nativeBuildInputs = [ which ];
diff --git a/pkgs/tools/security/ssdeep/default.nix b/pkgs/tools/security/ssdeep/default.nix
index acc617103d71..7647246369ff 100644
--- a/pkgs/tools/security/ssdeep/default.nix
+++ b/pkgs/tools/security/ssdeep/default.nix
@@ -13,8 +13,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  # Hack to avoid TMPDIR in RPATHs.
-  preFixup = ''rm -rf "$(pwd)" '';
+  # remove forbidden references to $TMPDIR
+  preFixup = lib.optionalString stdenv.isLinux ''
+    patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$out"/bin/*
+  '';
 
   meta = {
     description = "A program for calculating fuzzy hashes";
diff --git a/pkgs/tools/system/gkraken/default.nix b/pkgs/tools/system/gkraken/default.nix
index b5bb7fd03c1b..f37a21db79f4 100644
--- a/pkgs/tools/system/gkraken/default.nix
+++ b/pkgs/tools/system/gkraken/default.nix
@@ -42,7 +42,6 @@ python3Packages.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    gobject-introspection
     glib
     gtk3
     libnotify
diff --git a/pkgs/tools/text/groff/0001-Fix-cross-compilation-by-looking-for-ar.patch b/pkgs/tools/text/groff/0001-Fix-cross-compilation-by-looking-for-ar.patch
deleted file mode 100644
index 671293cda5b1..000000000000
--- a/pkgs/tools/text/groff/0001-Fix-cross-compilation-by-looking-for-ar.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 1454525f70b43a6957b7c9e1870e997368787da3 Mon Sep 17 00:00:00 2001
-From: Samuel Dionne-Riel <samuel@dionne-riel.com>
-Date: Fri, 8 Nov 2019 21:59:21 -0500
-Subject: [PATCH] Fix cross-compilation by looking for `ar`.
-
----
- Makefile.am  | 2 +-
- configure.ac | 2 ++
- 2 files changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index d18c49b8..b1b53338 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -494,7 +494,7 @@ CCC=@CXX@
- # INSTALL_INFO
- # LN_S
- 
--AR=ar
-+AR=@AR@
- ETAGS=etags
- ETAGSFLAGS=
- # Flag that tells etags to assume C++.
-diff --git a/configure.ac b/configure.ac
-index 28e75f17..2449b9f5 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -37,6 +37,7 @@ AC_CONFIG_AUX_DIR([build-aux])
- 
- AC_CONFIG_HEADERS([src/include/config.h:src/include/config.hin])
- AC_CONFIG_SRCDIR([src/roff/groff/groff.cpp])
-+AC_CONFIG_MACRO_DIR([m4])
- 
- AC_USE_SYSTEM_EXTENSIONS
- 
-@@ -72,6 +73,7 @@ GROFF_DOC_CHECK
- GROFF_MAKEINFO
- GROFF_TEXI2DVI
- AC_PROG_RANLIB
-+AC_CHECK_TOOL([AR], [ar], [ar])
- GROFF_INSTALL_SH
- GROFF_INSTALL_INFO
- AC_PROG_INSTALL
--- 
-2.23.0
-
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index ae250f2efeea..df06292c4f3e 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -14,30 +14,16 @@
 
 stdenv.mkDerivation rec {
   pname = "groff";
-  version = "1.22.4";
+  version = "1.23.0";
 
   src = fetchurl {
     url = "mirror://gnu/groff/${pname}-${version}.tar.gz";
-    sha256 = "14q2mldnr1vx0l9lqp9v2f6iww24gj28iyh4j2211hyynx67p3p7";
+    hash = "sha256-a5dX9ZK3UYtJAutq9+VFcL3Mujeocf3bLTCuOGNRHBM=";
   };
 
   outputs = [ "out" "man" "doc" "info" "perl" ];
 
-  # Parallel build is failing for missing depends. Known upstream as:
-  #   https://savannah.gnu.org/bugs/?62084
-  #   fixed, planned release: 1.23.0
-  enableParallelBuilding = false;
-
-  patches = [
-    ./0001-Fix-cross-compilation-by-looking-for-ar.patch
-  ]
-  ++ lib.optionals (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.version "9") [
-    # https://trac.macports.org/ticket/59783
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/openembedded/openembedded-core/ce265cf467f1c3e5ba2edbfbef2170df1a727a52/meta/recipes-extended/groff/files/0001-Include-config.h.patch";
-      sha256 = "1b0mg31xkpxkzlx696nr08rcc7ndpaxdplvysy0hw5099c4n1wyf";
-    })
-  ];
+  enableParallelBuilding = true;
 
   postPatch = ''
     # BASH_PROG gets replaced with a path to the build bash which doesn't get automatically patched by patchShebangs
@@ -53,8 +39,7 @@ stdenv.mkDerivation rec {
       --replace "pnmcrop" "${lib.getBin netpbm}/bin/pnmcrop" \
       --replace "pngtopnm" "${lib.getBin netpbm}/bin/pngtopnm" \
       --replace "@PNMTOPS_NOSETPAGE@" "${lib.getBin netpbm}/bin/pnmtops -nosetpage"
-    substituteInPlace contrib/groffer/roff2.pl \
-      --replace "'gs'" "'${lib.getBin ghostscript}/bin/gs'"
+  '' + lib.optionalString (enableGhostscript || enableHtml) ''
     substituteInPlace contrib/pdfmark/pdfroff.sh \
       --replace '$GROFF_GHOSTSCRIPT_INTERPRETER' "${lib.getBin ghostscript}/bin/gs" \
       --replace '$GROFF_AWK_INTERPRETER' "${lib.getBin gawk}/bin/gawk"
@@ -119,11 +104,6 @@ stdenv.mkDerivation rec {
     substituteInPlace $perl/bin/gpinyin \
       --replace $out/lib/groff/gpinyin $perl/lib/groff/gpinyin
 
-    moveToOutput bin/groffer $perl
-    moveToOutput lib/groff/groffer $perl
-    substituteInPlace $perl/bin/groffer \
-      --replace $out/lib/groff/groffer $perl/lib/groff/groffer
-
     moveToOutput bin/grog $perl
     moveToOutput lib/groff/grog $perl
     substituteInPlace $perl/bin/grog \
diff --git a/pkgs/tools/text/groff/site.tmac b/pkgs/tools/text/groff/site.tmac
index 776a7abb1da7..07923f120009 100644
--- a/pkgs/tools/text/groff/site.tmac
+++ b/pkgs/tools/text/groff/site.tmac
@@ -9,11 +9,5 @@
 .    char \' \N'39'
 .  \}
 .
-.  \" Shut off SGR by default (groff colors)
-.  \" Require GROFF_SGR envvar defined to turn it on
-.  if '\V[GROFF_SGR]'' \
-.    output x X tty: sgr 0
-.\}
-.
 .ds doc-default-operating-system Nixpkgs
 .ds doc-volume-operating-system Nixpkgs
diff --git a/pkgs/tools/text/textpieces/default.nix b/pkgs/tools/text/textpieces/default.nix
index d9bd7a07b828..9cea993710a8 100644
--- a/pkgs/tools/text/textpieces/default.nix
+++ b/pkgs/tools/text/textpieces/default.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     wrapGAppsHook4
     appstream-glib
     desktop-file-utils
+    gobject-introspection
   ];
 
   buildInputs = [
@@ -54,7 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
     libgee
     json-glib
     gtksourceview5
-    gobject-introspection
   ];
 
   runtimeDependencies = [
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 8cf45ea584c0..122f4304838b 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -108,8 +108,14 @@ stdenv.mkDerivation rec {
       --replace "ASSERT(ht && ht->table && iter);" "ASSERT(ht && iter);"
   '';
 
-  # Hack to avoid TMPDIR in RPATHs.
-  preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" '';
+  # remove forbidden references to $TMPDIR
+  preFixup = lib.optionalString stdenv.isLinux ''
+    for f in "$out"/bin/*; do
+      if isELF "$f"; then
+        patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$f"
+      fi
+    done
+  '';
 
   outputs = [ "out" "doc" "man" "dev" ];
 
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index 696b0b822e51..01b05b5481f5 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -1,4 +1,4 @@
-{ lib, python3, fetchPypi, glibcLocales, docker-compose_1 }:
+{ lib, python3, fetchFromGitHub, glibcLocales, docker-compose_1, git }:
 let
   docker_compose = changeVersion (with localPython.pkgs; docker-compose_1.override {
     inherit colorama pyyaml six dockerpty docker jsonschema requests websocket-client paramiko;
@@ -18,56 +18,29 @@ let
         cement = changeVersion super.cement.overridePythonAttrs "2.8.2" "sha256-h2XtBSwGHXTk0Bia3cM9Jo3lRMohmyWdeXdB9yXkItI=";
         wcwidth = changeVersion super.wcwidth.overridePythonAttrs "0.1.9" "sha256-7nOGKGKhVr93/5KwkDT8SCXdOvnPgbxbNgZo1CXzxfE=";
         semantic-version = changeVersion super.semantic-version.overridePythonAttrs "2.8.5" "sha256-0sst4FWHYpNGebmhBOguynr0SMn0l00fPuzP9lHfilQ=";
-        pyyaml = super.pyyaml.overridePythonAttrs rec {
-          version = "5.4.1";
-          checkPhase = ''
-            runHook preCheck
-            PYTHONPATH="tests/lib3:$PYTHONPATH" ${localPython.interpreter} -m test_all
-            runHook postCheck
-          '';
-          src = fetchPypi {
-            pname = "PyYAML";
-            inherit version;
-            hash = "sha256-YHd0y7oocyv6gCtUuqdIQhX1MJkQVbtWLvvtWy8gpF4=";
-          };
-        };
       };
     };
 in
 with localPython.pkgs; buildPythonApplication rec {
   pname = "awsebcli";
   version = "3.20.7";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-hnLWqc4UzUnvz4wmKZ8JcEWUMPmh2BdQS1IAyxC+yb4=";
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "aws-elastic-beanstalk-cli";
+    rev = "refs/tags/${version}";
+    hash = "sha256-DxjoEkFnY4aSfxVKPpnJLmnjLtZnlM74XXd0K8mcdoY=";
   };
 
-
-  preConfigure = ''
-    substituteInPlace requirements.txt \
-      --replace "six>=1.11.0,<1.15.0" "six==1.16.0" \
-      --replace "pathspec==0.10.1" "pathspec>=0.10.0,<1" \
-      --replace "colorama>=0.2.5,<0.4.4" "colorama>=0.2.5,<=0.4.6" \
-      --replace "termcolor == 1.1.0" "termcolor>=2.0.0,<3"
-  '';
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
 
   buildInputs = [
     glibcLocales
   ];
 
-  nativeCheckInputs = [
-    pytest
-    mock
-    nose
-    pathspec
-    colorama
-    requests
-    docutils
-  ];
-
-  doCheck = true;
-
   propagatedBuildInputs = [
     blessed
     botocore
@@ -85,6 +58,38 @@ with localPython.pkgs; buildPythonApplication rec {
     docker_compose
   ];
 
+  pythonRelaxDeps = [
+    "botocore"
+    "colorama"
+    "pathspec"
+    "PyYAML"
+    "six"
+    "termcolor"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-socket
+    mock
+    git
+  ];
+
+  pytestFlagsArray = [
+    "tests/unit"
+  ];
+
+  disabledTests = [
+    # Needs docker installed to run.
+    "test_local_run"
+    "test_local_run__with_arguments"
+
+    # Needs access to the user's ~/.ssh directory.
+    "test_generate_and_upload_keypair__exit_code_0"
+    "test_generate_and_upload_keypair__exit_code_1"
+    "test_generate_and_upload_keypair__exit_code_is_other_than_1_and_0"
+    "test_generate_and_upload_keypair__ssh_keygen_not_present"
+  ];
+
   meta = with lib; {
     homepage = "https://aws.amazon.com/elasticbeanstalk/";
     description = "A command line interface for Elastic Beanstalk";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 54d13ee7087a..ad1c47795abb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7411,7 +7411,7 @@ with pkgs;
 
   dtc = callPackage ../development/compilers/dtc { };
 
-  dt-schema = with python3Packages; toPythonApplication dtschema;
+  dt-schema = callPackage ../development/tools/dt-schema { };
 
   dub = callPackage ../development/tools/build-managers/dub { };
 
@@ -16855,11 +16855,11 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_70 = callPackage ../development/compilers/rust/1_70.nix {
+  rust_1_71 = callPackage ../development/compilers/rust/1_71.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_16 = llvmPackages_16.libllvm;
   };
-  rust = rust_1_70;
+  rust = rust_1_71;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -16867,8 +16867,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_70 = rust_1_70.packages.stable;
-  rustPackages = rustPackages_1_70;
+  rustPackages_1_71 = rust_1_71.packages.stable;
+  rustPackages = rustPackages_1_71;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
@@ -17922,9 +17922,9 @@ with pkgs;
     inherit (darwin) libobjc;
   };
 
-  inherit (callPackage ../development/interpreters/ruby {
+  inherit (darwin.apple_sdk_11_0.callPackage ../development/interpreters/ruby {
     inherit (darwin) libobjc libunwind;
-    inherit (darwin.apple_sdk.frameworks) Foundation;
+    inherit (darwin.apple_sdk_11_0.frameworks) Foundation;
   })
     mkRubyVersion
     mkRuby
@@ -21297,6 +21297,18 @@ with pkgs;
       rev = "v${version}";
       hash = "sha256-KzBMwpqn6wUFhgB3KDclBS0BvZSVcasM5AG/y+L91xM=";
     };
+    patches = [];
+  };
+
+  libgit2_1_6 = libgit2.overrideAttrs rec {
+    version = "1.6.4";
+    src = fetchFromGitHub {
+      owner = "libgit2";
+      repo = "libgit2";
+      rev = "v${version}";
+      hash = "sha256-lW3mokVKsbknVj2xsxEbeZH4IdKZ0aIgGutzenS0Eh0=";
+    };
+    patches = [ ];
   };
 
   libgit2-glib = callPackage ../development/libraries/libgit2-glib { };
@@ -25808,14 +25820,14 @@ with pkgs;
   ### DEVELOPMENT / PERL MODULES
 
   perlInterpreters = import ../development/interpreters/perl { inherit callPackage; };
-  inherit (perlInterpreters) perl534 perl536 perldevel;
+  inherit (perlInterpreters) perl536 perl538 perldevel;
 
-  perl534Packages = recurseIntoAttrs perl534.pkgs;
   perl536Packages = recurseIntoAttrs perl536.pkgs;
+  perl538Packages = recurseIntoAttrs perl538.pkgs;
   perldevelPackages = perldevel.pkgs;
 
-  perl = perl536;
-  perlPackages = perl536Packages;
+  perl = perl538;
+  perlPackages = perl538Packages;
 
   ack = perlPackages.ack;
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index bf31201fda7e..62a3e6e586af 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1565,11 +1565,11 @@ with self; {
 
   BerkeleyDB = buildPerlPackage {
     pname = "BerkeleyDB";
-    version = "0.64";
+    version = "0.65";
 
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PM/PMQS/BerkeleyDB-0.64.tar.gz";
-      hash = "sha256-U1yF6FScGsQ6IBYP3ALwpABhQVb9dhV//yiqM/2jdEs=";
+      url = "mirror://cpan/authors/id/P/PM/PMQS/BerkeleyDB-0.65.tar.gz";
+      hash = "sha256-QQqonnIylB1JEGyeBI1jN0dVQ+wdIz6nzbcly1uWNQQ=i";
     };
 
     preConfigure = ''
@@ -1705,10 +1705,10 @@ with self; {
 
   BKeywords = buildPerlPackage rec {
     pname = "B-Keywords";
-    version = "1.24";
+    version = "1.26";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/B-Keywords-1.24.tar.gz";
-      hash = "sha256-pc9rsoXQbRfO4id4O3I7snQhP9QVOl3uMR0kDhFpYG4=";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/B-Keywords-1.26.tar.gz";
+      hash = "sha256-LaoVXS8mf7De3Yf4pMT7VmOHn8EGUXse4lg1Pvh67TQ=";
     };
     meta = {
       description = "Lists of reserved barewords and symbol names";
@@ -5515,10 +5515,10 @@ with self; {
 
   CryptX = buildPerlPackage {
     pname = "CryptX";
-    version = "0.076";
+    version = "0.078";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIK/CryptX-0.076.tar.gz";
-      hash = "sha256-u4SsASQ4x87NtRpab/+08f7jsOrgAi6WzrwuFnUiYhw=";
+      url = "mirror://cpan/authors/id/M/MI/MIK/CryptX-0.078.tar.gz";
+      hash = "sha256-kxYLEkL31XQ8s8kxuO/HyzmCHQ4y+U+Wkz8eiOYYvL0=";
     };
     meta = {
       description = "Cryptographic toolkit";
@@ -5562,6 +5562,9 @@ with self; {
       hash = "sha256-L+XheYgqa5Jt/vChCLSiyHof+waJK88vuI5Mj0uEODw=";
     };
     buildInputs = [ TestRequires ];
+    patches = [
+      ../development/perl-modules/Data-Clone-fix-apostrophe-package-separator.patch
+    ];
     meta = {
       description = "Polymorphic data cloning";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -6604,10 +6607,10 @@ with self; {
 
   DevelCaller = buildPerlPackage {
     pname = "Devel-Caller";
-    version = "2.06";
+    version = "2.07";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RC/RCLAMP/Devel-Caller-2.06.tar.gz";
-      hash = "sha256-anOuaikoNCVbkNqUCSBUJTBfz+mUsUjcttLW72KNt98=";
+      url = "mirror://cpan/authors/id/R/RC/RCLAMP/Devel-Caller-2.07.tar.gz";
+      hash = "sha256-tnmisYA0sLcg3oLDcIckw2SxCmyhZMvGfNw68oPzUD8=";
     };
     propagatedBuildInputs = [ PadWalker ];
     meta = {
@@ -7349,10 +7352,10 @@ with self; {
 
   DevelFindPerl = buildPerlPackage {
     pname = "Devel-FindPerl";
-    version = "0.015";
+    version = "0.016";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/Devel-FindPerl-0.015.tar.gz";
-      hash = "sha256-UnW33CJv5/Fstp/G+Z9eKahSxqTTt4arGIajE4Z0Pfw=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Devel-FindPerl-0.016.tar.gz";
+      hash = "sha256-Q6K/L3h6PxuIEXkGMWKyqj58sET25eduxkZq6QqGETg=";
     };
     meta = {
       description = "Find the path to your perl";
@@ -7403,10 +7406,10 @@ with self; {
 
   DevelNYTProf = buildPerlPackage {
     pname = "Devel-NYTProf";
-    version = "6.10";
+    version = "6.12";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JK/JKEENAN/Devel-NYTProf-6.10.tar.gz";
-      hash = "sha256-JKxBdPHwEyIGP6ThGbJH03HTJg3cpud4xsGg4/kF9Y4=";
+      url = "mirror://cpan/authors/id/J/JK/JKEENAN/Devel-NYTProf-6.12.tar.gz";
+      hash = "sha256-qDtZheTalr24X1McFqtvPUkHGnM80JSqMPqF+2pLAsQ=";
     };
     propagatedBuildInputs = [ FileWhich JSONMaybeXS ];
     buildInputs = [ CaptureTiny TestDifferences ];
@@ -8668,6 +8671,9 @@ with self; {
       hash = "sha256-VyPdePSsC00mKgXqRq9mPqANgJay6cCkNRXCEHYOHnU=";
     };
     buildInputs = [ TestUnitLite ];
+    patches = [
+      ../development/perl-modules/Exception-Base-remove-smartmatch-when-5.38.0.patch
+    ];
     meta = {
       description = "Lightweight exceptions";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -8823,6 +8829,9 @@ with self; {
       url = "mirror://cpan/authors/id/N/NW/NWCLARK/ExtUtils-Constant-0.25.tar.gz";
       hash = "sha256-aTPQ6WO2IoHvdWEGjmrsrIxKwrR2srugmrC5D7rJ11c=";
     };
+    patches = [
+      ../development/perl-modules/ExtUtils-Constant-fix-indirect-method-call-in-test.patch
+    ];
     meta = {
       description = "Generate XS code to import C header constants";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -11276,10 +11285,10 @@ with self; {
 
   HTMLMason = buildPerlPackage {
     pname = "HTML-Mason";
-    version = "1.59";
+    version = "1.60";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/D/DR/DROLSKY/HTML-Mason-1.59.tar.gz";
-      hash = "sha256-lb7SpsSINwBGqjFL5LWSvWWmUi+IRdqLNqav+ai0OdA=";
+      url = "mirror://cpan/authors/id/D/DR/DROLSKY/HTML-Mason-1.60.tar.gz";
+      hash = "sha256-qgu9WmtjxiyJVfjFXsCF43DXktZSZrbDtcXweIu8d+Y=";
     };
     buildInputs = [ TestDeep ];
     propagatedBuildInputs = [ CGI CacheCache ClassContainer ExceptionClass LogAny ];
@@ -13865,10 +13874,10 @@ with self; {
 
   locallib = buildPerlPackage {
     pname = "local-lib";
-    version = "2.000024";
+    version = "2.000029";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/H/HA/HAARG/local-lib-2.000024.tar.gz";
-      hash = "sha256-LpuRe9SKBhXkJjOyoydJTgRhDY9xB2W5ST0wbOrZigU=";
+      url = "mirror://cpan/authors/id/H/HA/HAARG/local-lib-2.000029.tar.gz";
+      hash = "sha256-jfh6EMFMjpCcW0fFcB5LgYfVGeUlHofIBwmwK7M+/dc=";
     };
     propagatedBuildInputs = [ ModuleBuild ];
     meta = {
@@ -14069,10 +14078,10 @@ with self; {
 
   LogLog4perl = buildPerlPackage {
     pname = "Log-Log4perl";
-    version = "1.53";
+    version = "1.57";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/E/ET/ETJ/Log-Log4perl-1.53.tar.gz";
-      hash = "sha256-j7+0jQFu7HNEpTnzrXCHC0rEY45JZmv6cNEPb/1Kw44=";
+      url = "mirror://cpan/authors/id/E/ET/ETJ/Log-Log4perl-1.57.tar.gz";
+      hash = "sha256-D4/Ldjio89tMeX35T9vFYBN0kULy+Uy8lbQ8n8oJahM=";
     };
     meta = {
       description = "Log4j implementation for Perl";
@@ -15220,10 +15229,10 @@ with self; {
 
   MIMECharset = buildPerlPackage {
     pname = "MIME-Charset";
-    version = "1.012.2";
+    version = "1.013.1";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/N/NE/NEZUMI/MIME-Charset-1.012.2.tar.gz";
-      hash = "sha256-h4x3nAJWxZFma9BsDN5MDXgg7uuY/RGDCCrumh57HRM=";
+      url = "mirror://cpan/authors/id/N/NE/NEZUMI/MIME-Charset-1.013.1.tar.gz";
+      hash = "sha256-G7em4MDSUfI9bmC/hMmt78W3TuxYR1v+5NORB+YIcPA=";
     };
     meta = {
       description = "Charset Information for MIME";
@@ -15467,6 +15476,20 @@ with self; {
       url = "mirror://cpan/authors/id/L/LE/LEONT/Module-Build-0.4231.tar.gz";
       hash = "sha256-fg9MaSwXQMGshOoU1+o9i8eYsvsmwJh3Ip4E9DCytxc=";
     };
+    postConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+      # for unknown reason, the first run of Build fails
+      ./Build || true
+    '';
+    postPatch = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+      # remove version check since miniperl uses a stub of File::Temp, which do not provide a version:
+      # https://github.com/arsv/perl-cross/blob/master/cnf/stub/File/Temp.pm
+      sed -i '/File::Temp/d' \
+        Build.PL
+
+      # fix discover perl function, it can not handle a wrapped perl
+      sed -i "s,\$self->_discover_perl_interpreter,'$(type -p perl)',g" \
+        lib/Module/Build/Base.pm
+    '';
     meta = {
       description = "Build and install Perl modules";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -18613,10 +18636,10 @@ with self; {
 
   NumberFormat = buildPerlPackage {
     pname = "Number-Format";
-    version = "1.75";
+    version = "1.76";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/W/WR/WRW/Number-Format-1.75.tar.gz";
-      hash = "sha256-gtZZyxZGF2T9RNEanOnmpPXodn3BBp6wNGfG5V3iV/M=";
+      url = "mirror://cpan/authors/id/R/RJ/RJBS/Number-Format-1.76.tar.gz";
+      hash = "sha256-DgBg6zY2NaiFcGxqJvX8qv6udZ97Ksrkndpw4ZXdRNY=";
     };
     meta = {
       description = "Perl extension for formatting numbers";
@@ -18740,12 +18763,12 @@ with self; {
 
   ObjectPad = buildPerlModule {
     pname = "Object-Pad";
-    version = "0.68";
+    version = "0.79";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PE/PEVANS/Object-Pad-0.68.tar.gz";
-      hash = "sha256-xN5jBIQxMJZNrskozF99HphTnu/X7azHvn4Yg0XhnXE=";
+      url = "mirror://cpan/authors/id/P/PE/PEVANS/Object-Pad-0.79.tar.gz";
+      hash = "sha256-+wsQ+J5i1UFlvWqyHbVfYLVT+gCPyOddNJhwwafiKtY=";
     };
-    buildInputs = [ TestFatal TestRefcount ];
+    buildInputs = [ Test2Suite TestFatal TestRefcount ];
     perlPreHook = lib.optionalString stdenv.isDarwin "export LD=$CC";
     propagatedBuildInputs = [ XSParseKeyword XSParseSublike ];
     meta = {
@@ -19195,10 +19218,10 @@ with self; {
 
   Parent = buildPerlPackage {
     pname = "parent";
-    version = "0.238";
+    version = "0.241";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/C/CO/CORION/parent-0.238.tar.gz";
-      hash = "sha256-OPWP3vPiihlMnI0NxdAmcvr5PAafQMW8sfq+rbvE0tE=";
+      url = "mirror://cpan/authors/id/C/CO/CORION/parent-0.241.tar.gz";
+      hash = "sha256-sQs5YKs5l9q3Vx/+l1ukYtl50IZFB0Ch4Is5WedRKP4=";
     };
     meta = {
       description = "Establish an ISA relationship with base classes at compile time";
@@ -20236,10 +20259,10 @@ with self; {
 
   PPR = buildPerlPackage {
     pname = "PPR";
-    version = "0.000028";
+    version = "0.001008";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/D/DC/DCONWAY/PPR-0.000028.tar.gz";
-      hash = "sha256-032ndHxDN+TH11jHuO1dEsuXN2Q2krCfC9TZnFBouak=";
+      url = "mirror://cpan/authors/id/D/DC/DCONWAY/PPR-0.001008.tar.gz";
+      hash = "sha256-EQ5xwF8uLJDrAfCgaU5VqdvpHIV+SBJeF0LRflzbHkk=";
     };
     meta = {
       description = "Pattern-based Perl Recognizer";
@@ -21426,10 +21449,10 @@ with self; {
 
   ScopeUpper = buildPerlPackage {
     pname = "Scope-Upper";
-    version = "0.33";
+    version = "0.34";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/V/VP/VPIT/Scope-Upper-0.33.tar.gz";
-      hash = "sha256-XzO+Aa1o/L7G74HusDs1EaL18HUq1RPZk6TBOl+xpkg=";
+      url = "mirror://cpan/authors/id/V/VP/VPIT/Scope-Upper-0.34.tar.gz";
+      hash = "sha256-WB2LxRDevQxFal/HlSy3E4rmZ78486d+ltdz3DGWpB4=";
     };
     meta = {
       description = "Act on upper scopes";
@@ -23591,10 +23614,10 @@ with self; {
 
   Test2Harness = buildPerlPackage {
     pname = "Test2-Harness";
-    version = "1.000042";
+    version = "1.000152";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/E/EX/EXODIST/Test2-Harness-1.000042.tar.gz";
-      hash = "sha256-qvIxporxpv/WoRGIh1/PVy43PkPIKFlFInudaHtD2y0=";
+      url = "mirror://cpan/authors/id/E/EX/EXODIST/Test2-Harness-1.000152.tar.gz";
+      hash = "sha256-iIqWAdvTPuuaSTcdZmK7JE8Ad/QJlM4gvJClvlSRqls=";
     };
 
     checkPhase = ''
@@ -23602,7 +23625,7 @@ with self; {
       ./scripts/yath test -j $NIX_BUILD_CORES
     '';
 
-    propagatedBuildInputs = [ DataUUID Importer LongJump ScopeGuard TermTable Test2PluginMemUsage Test2PluginUUID Test2Suite gotofile ];
+    propagatedBuildInputs = [ DataUUID Importer LongJump ScopeGuard TermTable Test2PluginMemUsage Test2PluginUUID Test2Suite YAMLTiny gotofile ];
     meta = {
       description = "A new and improved test harness with better Test2 integration";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -23658,10 +23681,10 @@ with self; {
 
   Test2Suite = buildPerlPackage {
     pname = "Test2-Suite";
-    version = "0.000138";
+    version = "0.000155";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/E/EX/EXODIST/Test2-Suite-0.000138.tar.gz";
-      hash = "sha256-DPct8s7RFkhTW/2I6lSjxwBnhqfFlSkOOPMU41E7CHU=";
+      url = "mirror://cpan/authors/id/E/EX/EXODIST/Test2-Suite-0.000155.tar.gz";
+      hash = "sha256-x45rxNabwJeDaXaGM4K1K54MMe4YUGbOYMVL10uq1T0=";
     };
     propagatedBuildInputs = [ ModulePluggable ScopeGuard SubInfo TermTable TestSimple13 ];
     meta = {
@@ -25000,10 +25023,10 @@ with self; {
 
   TestSimple13 = buildPerlPackage {
     pname = "Test-Simple";
-    version = "1.302183";
+    version = "1.302195";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/E/EX/EXODIST/Test-Simple-1.302183.tar.gz";
-      hash = "sha256-mgO9pexCCuqWkrZQQ39NW1dPpQX91/9gzbXz7ANBBv8=";
+      url = "mirror://cpan/authors/id/E/EX/EXODIST/Test-Simple-1.302195.tar.gz";
+      hash = "sha256-s5C7I1kuC5Rsla27PDCxG8Y0ooayhHvmEa2SnFfjmmw=";
     };
     meta = {
       description = "Basic utilities for writing tests";
@@ -25227,10 +25250,10 @@ with self; {
 
   TestWithoutModule = buildPerlPackage {
     pname = "Test-Without-Module";
-    version = "0.20";
+    version = "0.21";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/C/CO/CORION/Test-Without-Module-0.20.tar.gz";
-      hash = "sha256-jprrfDKmxtC4qTEU2yqMBychJzqdmi3U+cqGz9KKpSQ=";
+      url = "mirror://cpan/authors/id/C/CO/CORION/Test-Without-Module-0.21.tar.gz";
+      hash = "sha256-PN6vraxIU+vq/miTRtVV2l36PPqdTITj5ee/7lC+7EY=";
     };
     meta = {
       description = "Test fallback behaviour in absence of modules";
@@ -25987,10 +26010,10 @@ with self; {
 
   TestTrap = buildPerlModule {
     pname = "Test-Trap";
-    version = "0.3.4";
+    version = "0.3.5";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/E/EB/EBHANSSEN/Test-Trap-v0.3.4.tar.gz";
-      hash = "sha256-CwRlbzO2yW2o7sTP/lKGFQtOS14pkdOINoaxCRAQWuI=";
+      url = "mirror://cpan/authors/id/E/EB/EBHANSSEN/Test-Trap-v0.3.5.tar.gz";
+      hash = "sha256-VPmQFlYrWx1yEQEA8fK+Q3F4zfhDdvSV/9A3bx1+y5o=";
     };
     propagatedBuildInputs = [ DataDump ];
     meta = {
@@ -27084,10 +27107,10 @@ with self; {
 
   VariableMagic = buildPerlPackage {
     pname = "Variable-Magic";
-    version = "0.62";
+    version = "0.63";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/V/VP/VPIT/Variable-Magic-0.62.tar.gz";
-      hash = "sha256-P5oYUX4z8AapwvxPQ/AbVKv+b/Lq5zIkJPMQaSlrYVw=";
+      url = "mirror://cpan/authors/id/V/VP/VPIT/Variable-Magic-0.63.tar.gz";
+      hash = "sha256-ukCDssMf8mlPI3EzPVVMgmqvJLTZjQPki1tKQ6Kg5nk=";
     };
     meta = {
       description = "Associate user-defined magic to variables from Perl";
@@ -27995,12 +28018,12 @@ with self; {
 
   XSParseKeyword = buildPerlModule {
     pname = "XS-Parse-Keyword";
-    version = "0.25";
+    version = "0.34";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PE/PEVANS/XS-Parse-Keyword-0.25.tar.gz";
-      hash = "sha256-9e2zDPfH8iDQxsMdwetVQDKECpnHwpgxT1zD/vZscsc=";
+      url = "mirror://cpan/authors/id/P/PE/PEVANS/XS-Parse-Keyword-0.34.tar.gz";
+      hash = "sha256-EDPdtAmSTZ1Cs4MEodeXRaBDSrxrBJHrErbIu5bx1sE=";
     };
-    buildInputs = [ ExtUtilsCChecker ];
+    buildInputs = [ ExtUtilsCChecker Test2Suite ];
     perlPreHook = lib.optionalString stdenv.isDarwin "export LD=$CC";
     meta = {
       description = "XS functions to assist in parsing keyword syntax";
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 39fda772e6a7..19e06c64e8f5 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -210,6 +210,7 @@ mapAliases ({
   mrkd = throw "mrkd has been promoted to a top-level attribute"; # added 2023-08-01
   mutmut = throw "mutmut has been promoted to a top-level attribute"; # added 2022-10-02
   net2grid = gridnet; # add 2022-04-22
+  nghttp2 = throw "in 1.52.0 removed deprecated python bindings."; # added 2023-06-08
   nose-cover3 = throw "nose-cover3 has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2022-02-16
   nose_progressive = throw "nose_progressive has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; #added 2023-02-21
   notifymuch = throw "notifymuch has been promoted to a top-level attribute"; # added 2022-10-02
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 59b81af35ea2..ca9ab2d49599 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12,6 +12,8 @@ self: super: with self; {
 
   setuptools = callPackage ../development/python-modules/setuptools { };
 
+  a2wsgi = callPackage ../development/python-modules/a2wsgi { };
+
   aadict = callPackage ../development/python-modules/aadict { };
 
   aafigure = callPackage ../development/python-modules/aafigure { };
@@ -2349,10 +2351,10 @@ self: super: with self; {
   cython = callPackage ../development/python-modules/Cython { };
 
   cython_3 = self.cython.overridePythonAttrs (old: rec {
-    version = "3.0.0b2";
+    version = "3.0.0";
     src = old.src.override {
       inherit version;
-      hash = "sha256-bEKAZWV56STBGURyR2ZLsi+v7cfezKWTqOogvdV9Z1U=";
+      hash = "sha256-NQsY+Wc+YxAdu/z3dO4vV8IKxGNtJVdB12ynkBaxvYI=";
     };
     patches = [ ];
   });
@@ -4835,6 +4837,8 @@ self: super: with self; {
 
   html5lib = callPackage ../development/python-modules/html5lib { };
 
+  html5tagger = callPackage ../development/python-modules/html5tagger { };
+
   html5-parser = callPackage ../development/python-modules/html5-parser { };
 
   htmllaundry = callPackage ../development/python-modules/htmllaundry { };
@@ -5467,6 +5471,8 @@ self: super: with self; {
 
   jsonschema-spec = callPackage ../development/python-modules/jsonschema-spec { };
 
+  jsonschema-specifications = callPackage ../development/python-modules/jsonschema-specifications { };
+
   jsonstreams = callPackage ../development/python-modules/jsonstreams { };
 
   json-tricks = callPackage ../development/python-modules/json-tricks { };
@@ -6065,7 +6071,7 @@ self: super: with self; {
 
   llvmlite = callPackage ../development/python-modules/llvmlite {
     # llvmlite always requires a specific version of llvm.
-    llvm = pkgs.llvm_11;
+    llvm = pkgs.llvm_14;
   };
 
   lmdb = callPackage ../development/python-modules/lmdb {
@@ -7004,13 +7010,6 @@ self: super: with self; {
     withPython = true;
   });
 
-  nghttp2 = (toPythonModule (pkgs.nghttp2.override {
-    python3Packages = self;
-    inherit (pkgs) ncurses;
-    enableApp = false; # build only libnghttp2 ...
-    enablePython = true; # ... and its Python bindings
-  })).python;
-
   nh3 = callPackage ../development/python-modules/nh3 { };
 
   niaaml = callPackage ../development/python-modules/niaaml { };
@@ -7597,7 +7596,9 @@ self: super: with self; {
 
   panasonic-viera = callPackage ../development/python-modules/panasonic-viera { };
 
-  pandas = callPackage ../development/python-modules/pandas { };
+  pandas = callPackage ../development/python-modules/pandas {
+    inherit (pkgs.darwin) adv_cmds;
+  };
 
   pandas-datareader = callPackage ../development/python-modules/pandas-datareader { };
 
@@ -8781,6 +8782,8 @@ self: super: with self; {
 
   pydantic = callPackage ../development/python-modules/pydantic { };
 
+  pydantic-core = callPackage ../development/python-modules/pydantic-core { };
+
   pydantic-scim = callPackage ../development/python-modules/pydantic-scim { };
 
   pydash = callPackage ../development/python-modules/pydash { };
@@ -12785,6 +12788,8 @@ self: super: with self; {
 
   traceback2 = callPackage ../development/python-modules/traceback2 { };
 
+  tracerite = callPackage ../development/python-modules/tracerite { };
+
   tracing = callPackage ../development/python-modules/tracing { };
 
   trackpy = callPackage ../development/python-modules/trackpy { };