diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 5b330b245823..c66301bcb1c8 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -261,14 +261,50 @@ For more complex cases, like libraries linked into an executable which is then e
 
 As described in the Nix manual, almost any `*.drv` store path in a derivation’s attribute set will induce a dependency on that derivation. `mkDerivation`, however, takes a few attributes intended to include all the dependencies of a package. This is done both for structure and consistency, but also so that certain other setup can take place. For example, certain dependencies need their bin directories added to the `PATH`. That is built-in, but other setup is done via a pluggable mechanism that works in conjunction with these dependency attributes. See [](#ssec-setup-hooks) for details.
 
-Dependencies can be broken down along three axes: their host and target platforms relative to the new derivation’s, and whether they are propagated. The platform distinctions are motivated by cross compilation; see [](#chap-cross) for exactly what each platform means. [^footnote-stdenv-ignored-build-platform] But even if one is not cross compiling, the platforms imply whether or not the dependency is needed at run-time or build-time, a concept that makes perfect sense outside of cross compilation. By default, the run-time/build-time distinction is just a hint for mental clarity, but with `strictDeps` set it is mostly enforced even in the native case.
+Dependencies can be broken down along these axes: their host and target platforms relative to the new derivation’s. The platform distinctions are motivated by cross compilation; see [](#chap-cross) for exactly what each platform means. [^footnote-stdenv-ignored-build-platform] But even if one is not cross compiling, the platforms imply whether a dependency is needed at run-time or build-time.
 
 The extension of `PATH` with dependencies, alluded to above, proceeds according to the relative platforms alone. The process is carried out only for dependencies whose host platform matches the new derivation’s build platform i.e. dependencies which run on the platform where the new derivation will be built. [^footnote-stdenv-native-dependencies-in-path] For each dependency \<dep\> of those dependencies, `dep/bin`, if present, is added to the `PATH` environment variable.
 
-A dependency is said to be **propagated** when some of its other-transitive (non-immediate) downstream dependencies also need it as an immediate dependency.
-[^footnote-stdenv-propagated-dependencies]
+### Dependency propagation {#ssec-stdenv-dependencies-propagated}
 
-It is important to note that dependencies are not necessarily propagated as the same sort of dependency that they were before, but rather as the corresponding sort so that the platform rules still line up. To determine the exact rules for dependency propagation, we start by assigning to each dependency a couple of ternary numbers (`-1` for `build`, `0` for `host`, and `1` for `target`) representing its [dependency type](#possible-dependency-types), which captures how its host and target platforms are each "offset" from the depending derivation’s host and target platforms. The following table summarize the different combinations that can be obtained:
+Propagated dependencies are made available to all downstream dependencies.
+This is particularly useful for interpreted languages, where all transitive dependencies have to be present in the same environment.
+Therefore it is used for the Python infrastructure in Nixpkgs.
+
+:::{.note}
+Propagated dependencies should be used with care, because they obscure the actual build inputs of dependent derivations and cause side effects through setup hooks.
+This can lead to conflicting dependencies that cannot easily be resolved.
+:::
+
+:::{.example}
+# A propagated dependency
+
+```nix
+with import <nixpkgs> {};
+let
+  bar = stdenv.mkDerivation {
+    name = "bar";
+    dontUnpack = true;
+    # `hello` is also made available to dependents, such as `foo`
+    propagatedBuildInputs = [ hello ];
+    postInstall = "mkdir $out";
+  };
+  foo = stdenv.mkDerivation {
+    name = "foo";
+    dontUnpack = true;
+    # `bar` is a direct dependency, which implicitly includes the propagated `hello`
+    buildInputs = [ bar ];
+    # The `hello` binary is available!
+    postInstall = "hello > $out";
+  };
+in
+foo
+```
+:::
+
+Dependency propagation takes cross compilation into account, meaning that dependencies that cross platform boundaries are properly adjusted.
+
+To determine the exact rules for dependency propagation, we start by assigning to each dependency a couple of ternary numbers (`-1` for `build`, `0` for `host`, and `1` for `target`) representing its [dependency type](#possible-dependency-types), which captures how its host and target platforms are each "offset" from the depending derivation’s host and target platforms. The following table summarize the different combinations that can be obtained:
 
 | `host → target`     | attribute name      | offset   |
 | ------------------- | ------------------- | -------- |
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 46e0fe5fcab0..4e9d1e42104c 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -407,7 +407,7 @@ in {
   incus = pkgs.recurseIntoAttrs (handleTest ./incus { inherit handleTestOn; });
   influxdb = handleTest ./influxdb.nix {};
   influxdb2 = handleTest ./influxdb2.nix {};
-  initrd-network-openvpn = handleTest ./initrd-network-openvpn {};
+  initrd-network-openvpn = handleTestOn [ "x86_64-linux" "i686-linux" ] ./initrd-network-openvpn {};
   initrd-network-ssh = handleTest ./initrd-network-ssh {};
   initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix {};
   initrdNetwork = handleTest ./initrd-network.nix {};
@@ -831,7 +831,7 @@ in {
   systemd-initrd-vconsole = handleTest ./systemd-initrd-vconsole.nix {};
   systemd-initrd-networkd = handleTest ./systemd-initrd-networkd.nix {};
   systemd-initrd-networkd-ssh = handleTest ./systemd-initrd-networkd-ssh.nix {};
-  systemd-initrd-networkd-openvpn = handleTest ./initrd-network-openvpn { systemdStage1 = true; };
+  systemd-initrd-networkd-openvpn = handleTestOn [ "x86_64-linux" "i686-linux" ] ./initrd-network-openvpn { systemdStage1 = true; };
   systemd-initrd-vlan = handleTest ./systemd-initrd-vlan.nix {};
   systemd-journal = handleTest ./systemd-journal.nix {};
   systemd-journal-gateway = handleTest ./systemd-journal-gateway.nix {};
diff --git a/nixos/tests/btrbk-section-order.nix b/nixos/tests/btrbk-section-order.nix
index 20f1afcf80ec..6082de947f66 100644
--- a/nixos/tests/btrbk-section-order.nix
+++ b/nixos/tests/btrbk-section-order.nix
@@ -29,10 +29,12 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
   };
 
   testScript = ''
+    import difflib
     machine.wait_for_unit("basic.target")
-    got = machine.succeed("cat /etc/btrbk/local.conf")
+    got = machine.succeed("cat /etc/btrbk/local.conf").strip()
     expect = """
     backend btrfs-progs-sudo
+    stream_compress no
     timestamp_format long
     target ssh://global-target/
      ssh_user root
@@ -46,6 +48,9 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
        ssh_user root
     """.strip()
     print(got)
+    if got != expect:
+      diff = difflib.unified_diff(expect.splitlines(keepends=True), got.splitlines(keepends=True), fromfile="expected", tofile="got")
+      print("".join(diff))
     assert got == expect
   '';
 })
diff --git a/nixos/tests/initrd-network-openvpn/default.nix b/nixos/tests/initrd-network-openvpn/default.nix
index 769049905eb8..69db7dd1037f 100644
--- a/nixos/tests/initrd-network-openvpn/default.nix
+++ b/nixos/tests/initrd-network-openvpn/default.nix
@@ -59,18 +59,19 @@ import ../make-test-python.nix ({ lib, ...}:
 
             # This command does not fork to keep the VM in the state where
             # only the initramfs is loaded
-            preLVMCommands =
-            ''
-              /bin/nc -p 1234 -lke /bin/echo TESTVALUE
-            '';
+            preLVMCommands = lib.mkIf (!systemdStage1)
+              ''
+                /bin/nc -p 1234 -lke /bin/echo TESTVALUE
+              '';
 
             network = {
               enable = true;
 
               # Work around udhcpc only getting a lease on eth0
-              postCommands = ''
-                /bin/ip addr add 192.168.1.2/24 dev eth1
-              '';
+              postCommands = lib.mkIf (!systemdStage1)
+                ''
+                  /bin/ip addr add 192.168.1.2/24 dev eth1
+                '';
 
               # Example configuration for OpenVPN
               # This is the main reason for this test
diff --git a/nixos/tests/musescore.nix b/nixos/tests/musescore.nix
index 6aeb0558a49d..0720631ed284 100644
--- a/nixos/tests/musescore.nix
+++ b/nixos/tests/musescore.nix
@@ -63,14 +63,11 @@ in
 
     machine.send_key("tab")
     machine.send_key("tab")
-    machine.send_key("tab")
-    machine.send_key("tab")
-    machine.send_key("right")
-    machine.send_key("right")
     machine.send_key("ret")
 
-    machine.sleep(1)
+    machine.sleep(2)
 
+    machine.send_key("tab")
     # Type the beginning of https://de.wikipedia.org/wiki/Alle_meine_Entchen
     machine.send_chars("cdef6gg5aaaa7g")
     machine.sleep(1)
diff --git a/pkgs/applications/audio/aacgain/default.nix b/pkgs/applications/audio/aacgain/default.nix
index 4d45de86f3a1..2bee14797815 100644
--- a/pkgs/applications/audio/aacgain/default.nix
+++ b/pkgs/applications/audio/aacgain/default.nix
@@ -5,27 +5,20 @@
 , autoconf
 , automake
 , libtool
-, faad2
-, mp4v2
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "aacgain";
-  version = "2.0.0";
+  version = "2.0.0-unstable-2022-07-12";
 
   src = fetchFromGitHub {
     owner = "dgilman";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-9Y23Zh7q3oB4ha17Fpm1Hu2+wtQOA1llj6WDUAO2ARU=";
+    repo = "aacgain";
+    rev = "9f9ae95a20197d1072994dbd89672bba2904bdb5";
+    hash = "sha256-WqL9rKY4lQD7wQSZizoM3sHNzLIG0E9xZtjw8y7fgmE=";
+    fetchSubmodules = true;
   };
 
-  postPatch = ''
-    cp -R ${faad2.src}/* 3rdparty/faad2
-    cp -R ${mp4v2.src}/* 3rdparty/mp4v2
-    chmod -R +w 3rdparty
-  '';
-
   nativeBuildInputs = [
     cmake
     autoconf
diff --git a/pkgs/applications/audio/musescore/default.nix b/pkgs/applications/audio/musescore/default.nix
index d42117e1babe..3dbb9c7884f1 100644
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@@ -48,35 +48,14 @@ let
   } else portaudio;
 in stdenv'.mkDerivation (finalAttrs: {
   pname = "musescore";
-  version = "4.1.1";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "musescore";
     repo = "MuseScore";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-jXievVIA0tqLdKLy6oPaOHPIbDoFstveEQBri9M0Aoo=";
+    sha256 = "sha256-vNA1VPCHLt5kuhIix8kgeq1VlbuIX1lOY3nJaufvuyc=";
   };
-  patches = [
-    # Upstream from some reason wants to install qml files from qtbase in
-    # installPhase, this patch removes this behavior. See:
-    # https://github.com/musescore/MuseScore/issues/18665
-    (fetchpatch {
-      url = "https://github.com/doronbehar/MuseScore/commit/f48448a3ede46f5a7ef470940072fbfb6742487c.patch";
-      hash = "sha256-UEc7auscnW0KMfWkLKQtm+UstuTNsuFeoNJYIidIlwM=";
-    })
-    # Upstream removed the option to use system freetype library in v4.1.0,
-    # causing the app to crash on systems when the outdated bundled freetype
-    # tries to load the Noto Sans font. For more info on the crash itself,
-    # see #244409 and https://github.com/musescore/MuseScore/issues/18795.
-    # For now, re-add the option ourselves. The fix has been merged upstream,
-    # so we can remove this patch with the next version. In the future, we
-    # may replace the other bundled thirdparty libs with system libs, see
-    # https://github.com/musescore/MuseScore/issues/11572.
-    (fetchpatch {
-      url = "https://github.com/musescore/MuseScore/commit/9ab6b32b1c3b990cfa7bb172ee8112521dc2269c.patch";
-      hash = "sha256-5GA29Z+o3I/uDTTDbkauZ8/xSdCE6yY93phMSY0ea7s=";
-    })
-  ];
 
   cmakeFlags = [
     "-DMUSESCORE_BUILD_MODE=release"
diff --git a/pkgs/applications/audio/open-stage-control/default.nix b/pkgs/applications/audio/open-stage-control/default.nix
index e0d284bc951e..08b1a106a3d5 100644
--- a/pkgs/applications/audio/open-stage-control/default.nix
+++ b/pkgs/applications/audio/open-stage-control/default.nix
@@ -1,4 +1,14 @@
-{ lib, buildNpmPackage, fetchFromGitHub, makeBinaryWrapper, makeDesktopItem, copyDesktopItems, electron, python3, nix-update-script }:
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, makeBinaryWrapper
+, makeDesktopItem
+, copyDesktopItems
+, nodejs_18
+, electron
+, python3
+, nix-update-script
+}:
 
 buildNpmPackage rec {
   pname = "open-stage-control";
@@ -18,10 +28,11 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-UqjYNXdNoQmirIgU9DRgkp14SIrawfrfi9mD2h6ACyU=";
 
+  nodejs = nodejs_18;
+
   nativeBuildInputs = [
     copyDesktopItems
     makeBinaryWrapper
-    python3
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/blockchains/atomic-swap/default.nix b/pkgs/applications/blockchains/atomic-swap/default.nix
index ed5869f2fc49..a2e2e9efbffb 100644
--- a/pkgs/applications/blockchains/atomic-swap/default.nix
+++ b/pkgs/applications/blockchains/atomic-swap/default.nix
@@ -1,9 +1,8 @@
-{ lib, buildGo120Module, fetchFromGitHub, nix-update-script, makeWrapper, monero-cli }:
+{ lib, buildGoModule, fetchFromGitHub, nix-update-script, makeWrapper, monero-cli }:
 
 let
   pname = "atomic-swap";
-  version = "0.4.2";
-  buildGoModule = buildGo120Module;
+  version = "0.4.3";
 in
 buildGoModule {
   inherit pname version;
@@ -12,10 +11,10 @@ buildGoModule {
     owner = "AthanorLabs";
     repo = "atomic-swap";
     rev = "v${version}";
-    hash = "sha256-JnbKaGmpTDwQMSDR4Y8Q2JTtuQV5GGuovxeIYs0KgQI=";
+    hash = "sha256-MOylUZ6BrvlxUrsZ5gg3JzW9ROG5UXeGhq3YoPZKdHs=";
   };
 
-  vendorHash = "sha256-acBnXGy1kVBwB+j8VqGyinabnI/boTtbFNyjE6EHVes=";
+  vendorHash = "sha256-fGQ6MI+3z7wRL0y7AUERVtN0V2rcRa+vqeB8+3FMzzc=";
 
   subPackages = [
     "cmd/swapcli"
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index f274ef66e795..7680d3cbe841 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -305,12 +305,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "c23407de1f76df30ca197b69d78a11be5ce26009";
-      sha256 = "04v4xzi55fmgbrnvm1s9magb1r0mqsx5w8nck7pn39q7q39wazpa";
+      rev = "5372bf247839b46a121375d3d610ab8409d6100d";
+      sha256 = "0r0lvg59v7if3b4jfi5a6s11njzidhnxw7bz4nmga80bdfvb4syh";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -2444,12 +2444,12 @@ final: prev:
 
   crates-nvim = buildVimPlugin {
     pname = "crates.nvim";
-    version = "2023-12-16";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "saecki";
       repo = "crates.nvim";
-      rev = "8da3bae1f0f8892b42e9596299ec09bc055e5507";
-      sha256 = "1jy6z43n1146wq6bv5qpkb74hs81c3n17r570vjvi3rbc6nq139a";
+      rev = "81c6325b7f8875857ec09e5d24f3b6d7986f29e2";
+      sha256 = "1dlri6p8v8bs3mkssvxixpg8knavr2axwydy5qhywzzjzz236yd5";
     };
     meta.homepage = "https://github.com/saecki/crates.nvim/";
   };
@@ -3143,12 +3143,12 @@ final: prev:
 
   efmls-configs-nvim = buildVimPlugin {
     pname = "efmls-configs-nvim";
-    version = "2023-12-18";
+    version = "2023-12-21";
     src = fetchFromGitHub {
       owner = "creativenull";
       repo = "efmls-configs-nvim";
-      rev = "32575ba992e056dde5a869fc0368a7dd4e3c7afb";
-      sha256 = "01jra3rzmxj2fknp2fihhg56kjazxvp67q0d9n7adph36w9b95h3";
+      rev = "ddc7c542aaad21da594edba233c15ae3fad01ea0";
+      sha256 = "0qhs1dzn0wy6jrqkyn4bz5cmd9xzxp3prka72446b3sj4521bbs7";
     };
     meta.homepage = "https://github.com/creativenull/efmls-configs-nvim/";
   };
@@ -4104,12 +4104,12 @@ final: prev:
 
   haskell-tools-nvim = buildNeovimPlugin {
     pname = "haskell-tools.nvim";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "haskell-tools.nvim";
-      rev = "e9a09be664521134e04336c2503c7f6b058d7785";
-      sha256 = "1lg3wkbg2sjkbp6c3lrkszsbk97ajgs6jnwmv9xgslvaaj40r6r8";
+      rev = "ab80d6218d27c961cfc6c0f31c6a132f80b39cbe";
+      sha256 = "1biadz420rklv7i2z5w3796p46ia0lbn4kcny2c8dzwlrhgjcfim";
     };
     meta.homepage = "https://github.com/MrcJkb/haskell-tools.nvim/";
   };
@@ -4920,12 +4920,12 @@ final: prev:
 
   lexima-vim = buildVimPlugin {
     pname = "lexima.vim";
-    version = "2023-09-04";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "cohama";
       repo = "lexima.vim";
-      rev = "b1e1b1bde07c1efc97288c98c5912eaa644ee6e1";
-      sha256 = "1dk32rjahn6grwq1gdxnxs6pavjzhkml7zb3pg1ky75pivs1rlgr";
+      rev = "5513d686801993b40c55baa65602f79cd3cf3c77";
+      sha256 = "08gmpxxfjsjqvhcicr3rwm97xddsn93afxnqipyz4vjclzmpxgwg";
     };
     meta.homepage = "https://github.com/cohama/lexima.vim/";
   };
@@ -5664,12 +5664,12 @@ final: prev:
 
   molten-nvim = buildVimPlugin {
     pname = "molten-nvim";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "benlubas";
       repo = "molten-nvim";
-      rev = "60930af2df132289d21c6c6f141c0aec8de71089";
-      sha256 = "0063ndbx46q6xf5y1y0zrzqbh8x5qrvmvpyh205ifwwfyls6aqai";
+      rev = "75ce8fe3cc8206f8fd3ecdc315e16c47f0ddb75c";
+      sha256 = "0qg1br622wwkd3dkydvczz6s7ycp8h6b576mx8j3clx0z0yj0m7f";
     };
     meta.homepage = "https://github.com/benlubas/molten-nvim/";
   };
@@ -6024,12 +6024,12 @@ final: prev:
 
   neodev-nvim = buildVimPlugin {
     pname = "neodev.nvim";
-    version = "2023-12-19";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neodev.nvim";
-      rev = "018e1161ed771ef2b54f346240bcf69931594396";
-      sha256 = "01lddc9i6z56fyc6jfz1rv9cja98jjg4dhzhx67752nmpfzjlicf";
+      rev = "93ab59d5d436b36698c14d0374150a7e5e7bccb6";
+      sha256 = "1kn0c9nb12hhwqpjma8pxkh33salwdrwrgzg8ivljb6sr9mg8ckw";
     };
     meta.homepage = "https://github.com/folke/neodev.nvim/";
   };
@@ -6060,12 +6060,12 @@ final: prev:
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "2023-12-19";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "801143ee4db4121fc11a6468daae6680ba9fab51";
-      sha256 = "01i1spfqx29nzshxdk5c3g9m146kijq0wb37qyk2jfjj9r3jj1xg";
+      rev = "bbb3c19a9f55a36f844b862c3bea21781aef8644";
+      sha256 = "18ywqh7g3q0l8riyv6641sfvkzii3r3c6vc5ss5qp1d4cnmrvssi";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
   };
@@ -6204,12 +6204,12 @@ final: prev:
 
   neotest = buildVimPlugin {
     pname = "neotest";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest";
-      rev = "b8e29c0fba9a58bf6a5c37df77c7a6a31079c8d6";
-      sha256 = "0y9dm6w88prff7vf84jy0ik2f69smhvc8a7gs4cickw56n7srf28";
+      rev = "a2f1cb4072bb29fcc067605fb712bbd83917513e";
+      sha256 = "0f8rn9v26v3a6yq0wngdzrgz5rdwlpmnc74b98l1aqb2ikn6gxvd";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest/";
   };
@@ -6337,12 +6337,12 @@ final: prev:
 
   neotest-python = buildVimPlugin {
     pname = "neotest-python";
-    version = "2023-12-10";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest-python";
-      rev = "48bf141103b94c9384e5542cd185b291909ac305";
-      sha256 = "1apkxpznlwhilzqh3jn54xblcn18wyadymzpwh0v1p19ah46xnzj";
+      rev = "27a2676aa02193d6ba4ad26238c09ededa49a9a7";
+      sha256 = "146ycpc49yq01g0za6r76h0rbc427653z2wy7755czcjisf81i3k";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest-python/";
   };
@@ -6469,12 +6469,12 @@ final: prev:
 
   nerdtree = buildVimPlugin {
     pname = "nerdtree";
-    version = "2023-12-02";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "preservim";
       repo = "nerdtree";
-      rev = "9ec27d45a863aeb82fea56cebcb8a75a4e369fc9";
-      sha256 = "17j2q0vdplxz4qjkx140mgxjcj1dghzkz1ijb3vc3i2hl5qfmba1";
+      rev = "a9546618241e61e785aa4c21b3de0cb657f3b828";
+      sha256 = "0pjc5bpms29ala5wc26hikzj48fvi8rs1xx8d71pk5c4s5y62l2z";
     };
     meta.homepage = "https://github.com/preservim/nerdtree/";
   };
@@ -6637,24 +6637,24 @@ final: prev:
 
   none-ls-nvim = buildVimPlugin {
     pname = "none-ls.nvim";
-    version = "2023-12-15";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "nvimtools";
       repo = "none-ls.nvim";
-      rev = "ef09f14eab78ca6ce3bee1ddc73db5511f5cd953";
-      sha256 = "066wr59s0bqrmnx46f9yfa0yr8mmpghahzn3wc6jaj2l9rc1k7cw";
+      rev = "bbd8c0c2b8a47ff2e0a97868afdf3fc640f1ad1e";
+      sha256 = "0g2x2niigqxzq9k4ysiws6qnd4agcpf7dy7s4g1hdq8cnapgy0vm";
     };
     meta.homepage = "https://github.com/nvimtools/none-ls.nvim/";
   };
 
   nord-nvim = buildVimPlugin {
     pname = "nord.nvim";
-    version = "2023-10-04";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "shaunsingh";
       repo = "nord.nvim";
-      rev = "0a22a387c92bb3b46e3d245522712ae7497bec38";
-      sha256 = "1bmmyf3d4ihiaa0h9q77scif22kykkidks72vmamzh7v34x3c7d8";
+      rev = "80c1e5321505aeb22b7a9f23eb82f1e193c12470";
+      sha256 = "0bv733mf2c7cclqcgr64ngrxzk38pwimvcl0g63c6pj1la8xpqzj";
     };
     meta.homepage = "https://github.com/shaunsingh/nord.nvim/";
   };
@@ -6781,12 +6781,12 @@ final: prev:
 
   nvim-autopairs = buildVimPlugin {
     pname = "nvim-autopairs";
-    version = "2023-10-21";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "windwp";
       repo = "nvim-autopairs";
-      rev = "0f04d78619cce9a5af4f355968040f7d675854a1";
-      sha256 = "0k2pibxx42qsdvxgbrdj7g44y5q6dnaw0g07gq025dpn27jk9ark";
+      rev = "9fd41181693dd4106b3e414a822bb6569924de81";
+      sha256 = "1xwvw5j81rx7q5jmv14fnphxsjk9anzglf10j8ai8217gc9h530z";
     };
     meta.homepage = "https://github.com/windwp/nvim-autopairs/";
   };
@@ -6973,12 +6973,12 @@ final: prev:
 
   nvim-dap = buildVimPlugin {
     pname = "nvim-dap";
-    version = "2023-12-14";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "e64ebf3309154b578a03c76229ebf51c37898118";
-      sha256 = "11j71rdx4mx3g0x8vxp19jqnpihbwdrcr29651cn5q00myzvgzx9";
+      rev = "f0dca670fa059eb89dda8869a6310c804241345c";
+      sha256 = "0zdsr98abzyiw7887dgvjh3i3bf95vw3lg4d384rr6zrxwh03kjh";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
@@ -6997,12 +6997,12 @@ final: prev:
 
   nvim-dap-python = buildVimPlugin {
     pname = "nvim-dap-python";
-    version = "2023-11-15";
+    version = "2023-12-19";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap-python";
-      rev = "e0be843877e7ae756ef1ee7a441ca0b9e1677da9";
-      sha256 = "0xib2xayrnf96r07rd7xdahpza41155npkdjxmr48h52gjj15nbl";
+      rev = "091e4ae00a12085f9ed4200a3cd04af7179b8a23";
+      sha256 = "02ialmgk6i2svjqglj7hmrakfsk5spcxb9idb13vmzlng8s3rzsp";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap-python/";
   };
@@ -7260,12 +7260,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPlugin {
     pname = "nvim-lspconfig";
-    version = "2023-12-19";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "e85816c5803410cacb52e9b4fbdb72a1f1a6bd11";
-      sha256 = "03yvhgm80lzrn7x4j3qvjwcz8yvnc0db926bw3yw7537samqn5g5";
+      rev = "a2e84ddef8d17a71dc8115f72e264c97328f5d33";
+      sha256 = "19cgid5723n4sk6n4nnc67xbkjdrmyq9fyxd62i3alflk3pxiw15";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -7488,12 +7488,12 @@ final: prev:
 
   nvim-scrollview = buildVimPlugin {
     pname = "nvim-scrollview";
-    version = "2023-12-18";
+    version = "2023-12-21";
     src = fetchFromGitHub {
       owner = "dstein64";
       repo = "nvim-scrollview";
-      rev = "e2d1ddae7e1f389e718834c6cb69501704ba30e3";
-      sha256 = "04w919wsr1xlwzdaj1zbwj2jx03lcx9n2zrdkxmwwkmqfs4d1rdw";
+      rev = "a74efa2d63acc966258889885fbf177badf88df3";
+      sha256 = "1gi4fbpcqc81wqm59n6n4x2mn4kjzbhx30d4vwjsrnda5s3nvlv0";
     };
     meta.homepage = "https://github.com/dstein64/nvim-scrollview/";
   };
@@ -7536,24 +7536,24 @@ final: prev:
 
   nvim-spectre = buildVimPlugin {
     pname = "nvim-spectre";
-    version = "2023-11-15";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "nvim-pack";
       repo = "nvim-spectre";
-      rev = "a18a58015b46f02b4fe537ebfffd82e46110ff24";
-      sha256 = "0ry2scnw8hzd3snjhbp71zc6mnna2bwn6icr3frsgdj1p5rfissn";
+      rev = "d8906855f1949ac97b1e77aaf8d3fe12ed158ddc";
+      sha256 = "1kmw61gli562d4r4vsf2fpxa09pi6a0brcdzly02n7xcan4l7bc4";
     };
     meta.homepage = "https://github.com/nvim-pack/nvim-spectre/";
   };
 
   nvim-spider = buildVimPlugin {
     pname = "nvim-spider";
-    version = "2023-12-18";
+    version = "2023-12-21";
     src = fetchFromGitHub {
       owner = "chrisgrieser";
       repo = "nvim-spider";
-      rev = "2cda32bb4bd852662e5c443dd33aa56f32182628";
-      sha256 = "0061mm1d1dslky9p8z084wjrjfqkr4m5sy0g6wd3yy2iam1p2xds";
+      rev = "daa3241d3f94e12199309f93278791e011539662";
+      sha256 = "14cpd2y50qy5m1hmx92p4xdd4grsf4w7fa7325vkd0ry449p69n0";
     };
     meta.homepage = "https://github.com/chrisgrieser/nvim-spider/";
   };
@@ -7620,12 +7620,12 @@ final: prev:
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "2023-12-19";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "0dfbf5e48e8551212c2a9f1c74cb080c8e76b5d1";
-      sha256 = "1vy1xgxi696j4as5l9831jpy1v1x3kfn1mak7gn0fyv97a987b25";
+      rev = "732c8cb0b43b7336525c3cecb2e28db153994e62";
+      sha256 = "02i23ldcl5x93w0mnzji65f4mbjdvn7h8x27r1mvxcmm2n38cxbv";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -8536,11 +8536,11 @@ final: prev:
 
   rainbow-delimiters-nvim = buildVimPlugin {
     pname = "rainbow-delimiters.nvim";
-    version = "2023-12-17";
+    version = "2023-12-20";
     src = fetchgit {
       url = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
-      rev = "b510fd445b6ee0b621e910e4b3e123e48d6bb436";
-      sha256 = "152jan5vpvn5mdv7cfc2gshnsrgq9qw17xqddz6d6n4p7pywfbr6";
+      rev = "a27051f08f6c03928ee9e94339f53da3107857db";
+      sha256 = "0wlm40389768sxvj1xqw2n1ldvhmnfzf0nibrr3mqsvh6abjq1id";
     };
     meta.homepage = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
   };
@@ -8787,12 +8787,12 @@ final: prev:
 
   rustaceanvim = buildNeovimPlugin {
     pname = "rustaceanvim";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "mrcjkb";
       repo = "rustaceanvim";
-      rev = "a13e311d449034b49d0144a411e0c8be3d5354cd";
-      sha256 = "0nlx7w1wi9dsji4d84f7niw74cc5mxar3q95qwydqpha3vz201s5";
+      rev = "fefc2408ba56832f884b1033a1d4eba1830d6aff";
+      sha256 = "1v3zcd149bx3pgjgk3r8yjbsvlrgipn4js02ighdrqjl5z395x6m";
     };
     meta.homepage = "https://github.com/mrcjkb/rustaceanvim/";
   };
@@ -9040,12 +9040,12 @@ final: prev:
 
   smartcolumn-nvim = buildVimPlugin {
     pname = "smartcolumn.nvim";
-    version = "2023-09-12";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "smartcolumn.nvim";
-      rev = "c6abf3917fcec487c7475e208ae37f5788af5b04";
-      sha256 = "1imdzqq997n8jwcxf8dyh0647hx58z9imm95nky23dlmhp3lzn9v";
+      rev = "8cbf75c26e9f9248704a662564f30cc2d7de7f34";
+      sha256 = "1hyfl7g11fx9xbkyaljcwdih1fc4cp777j0rxii5jrr50rvriyik";
     };
     meta.homepage = "https://github.com/m4xshen/smartcolumn.nvim/";
   };
@@ -9353,12 +9353,12 @@ final: prev:
 
   startup-nvim = buildVimPlugin {
     pname = "startup.nvim";
-    version = "2023-11-02";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "startup-nvim";
       repo = "startup.nvim";
-      rev = "088de9f5af8a10dfc39f8e397e3e9646940c7323";
-      sha256 = "09hhl8l2b4q53i2scig6rx3zq7mcsa6f5za0ahmn3s9vh9862iqz";
+      rev = "c6ba324f9eba0c23b675b53af431346aab893268";
+      sha256 = "0vp4vfrlb39z4s4617v1xkzjkx6l5sxfravfj2wkkwzpjrqfs2bl";
     };
     meta.homepage = "https://github.com/startup-nvim/startup.nvim/";
   };
@@ -9994,12 +9994,12 @@ final: prev:
 
   telescope-nvim = buildNeovimPlugin {
     pname = "telescope.nvim";
-    version = "2023-12-06";
+    version = "2023-12-19";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope.nvim";
-      rev = "6213322ab56eb27356fdc09a5078e41e3ea7f3bc";
-      sha256 = "074bq8p1bkyr12z1wy31bipb97vmqia4lsmdp2aj1v1r5x5ph736";
+      rev = "f336f8cfab38a82f9f00df380d28f0c2a572f862";
+      sha256 = "14v1v45p5jpvn9lgbjcfgx8p4b60w0bqk3vv7sdb5nbikkjhy10z";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope.nvim/";
   };
@@ -10102,12 +10102,12 @@ final: prev:
 
   text-case-nvim = buildVimPlugin {
     pname = "text-case.nvim";
-    version = "2023-12-19";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "johmsalas";
       repo = "text-case.nvim";
-      rev = "ada81738da3f1ed08f5e4ac95fa21213a0221b22";
-      sha256 = "1dy6v1d3iv92j88ydcgzjccnv6f213vhpnb27r6rv8hd3z6h4dfv";
+      rev = "f847b283ebbe8b98bc96fa29f1685244c42ce4cf";
+      sha256 = "1fp4lgr6vbacn421k4jy5h5h6yravv95rszrf313jjsjid4n1j3q";
     };
     meta.homepage = "https://github.com/johmsalas/text-case.nvim/";
   };
@@ -10463,12 +10463,12 @@ final: prev:
 
   unison = buildVimPlugin {
     pname = "unison";
-    version = "2023-12-19";
+    version = "2023-12-21";
     src = fetchFromGitHub {
       owner = "unisonweb";
       repo = "unison";
-      rev = "e690c5f57e12f5883ffd44ead57bf2942c1fedd0";
-      sha256 = "09vlww4yxsxal0pnif1an0lqpkvf5zjnkvmz0h7yyfdpmq1prmxq";
+      rev = "5e98e805af75dc15116fc524c911a7c78ede9e03";
+      sha256 = "0yhg40pr1611nplxy5v794b52868ylg4cqm6gqzms1bwz1gzvh7l";
     };
     meta.homepage = "https://github.com/unisonweb/unison/";
   };
@@ -12913,12 +12913,12 @@ final: prev:
 
   vim-just = buildVimPlugin {
     pname = "vim-just";
-    version = "2023-12-17";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "NoahTheDuke";
       repo = "vim-just";
-      rev = "e2e42ae765f53569efb7178a7bbb9a6977d269e2";
-      sha256 = "0a930prjv6b09qkn2zwmn5bxs73sad48v3mr8g9b7f0i4528iklz";
+      rev = "cbba24e544dd32509a6b68271ce3142ab5a180c3";
+      sha256 = "05fp1vqir8w9kl1il76bszsmh6vn6kj8a8g4nssa4pw7bpsflrvs";
     };
     meta.homepage = "https://github.com/NoahTheDuke/vim-just/";
   };
@@ -15616,12 +15616,12 @@ final: prev:
 
   vimtex = buildVimPlugin {
     pname = "vimtex";
-    version = "2023-12-18";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "e7ce03ea517c5b61ec9703a44019481678d60af3";
-      sha256 = "0i8crnv5h9swdi22bxp8sj7s59lnjy2ryqslbxydq2vb8kq4cr4c";
+      rev = "6179414f2eb3db977a513b7b19c23e7e62a0f388";
+      sha256 = "1fynvg4695h990lh1w9mknd7n0mdk2br1j0xdh3sh94w204xyyrh";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -16133,12 +16133,12 @@ final: prev:
 
   embark-vim = buildVimPlugin {
     pname = "embark-vim";
-    version = "2023-11-27";
+    version = "2023-12-20";
     src = fetchFromGitHub {
       owner = "embark-theme";
       repo = "vim";
-      rev = "7efd788d2e7b2d0a923cb6dabad7e2c11ab7aa95";
-      sha256 = "0pnqx6jli9pwqs6h2dsvh7q05gchama7zcpr91zp2jabacbanycf";
+      rev = "95f92adee0e5ad36f74fe04266554ac9c03e3fc3";
+      sha256 = "15v8wgbcckdll8j27d2v30rcbgc38hddmnfbk24p3jxx2pxdl529";
     };
     meta.homepage = "https://github.com/embark-theme/vim/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 0b0aa3d6395f..06b2548251d0 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -737,12 +737,12 @@
   };
   gleam = buildGrammar {
     language = "gleam";
-    version = "0.0.0+rev=c9c7f0f";
+    version = "0.0.0+rev=2b49c49";
     src = fetchFromGitHub {
       owner = "gleam-lang";
       repo = "tree-sitter-gleam";
-      rev = "c9c7f0f01749d301b54e96ed8e0c47c7c415a196";
-      hash = "sha256-j7onMy986PeJNy9x8GUkg8Be22bGYoZs53sToLWc/eI=";
+      rev = "2b49c49ef632928b5c52bb0a7269ff797d5d1414";
+      hash = "sha256-zFdyUqbJn7ighjXH+9EO+0Cf2Oj8ON8IYUZCIQUQ5dA=";
     };
     meta.homepage = "https://github.com/gleam-lang/tree-sitter-gleam";
   };
@@ -2243,12 +2243,12 @@
   };
   styled = buildGrammar {
     language = "styled";
-    version = "0.0.0+rev=e51e673";
+    version = "0.0.0+rev=5e52758";
     src = fetchFromGitHub {
       owner = "mskelton";
       repo = "tree-sitter-styled";
-      rev = "e51e673efc860373167680b4bcbf418a11e4ed26";
-      hash = "sha256-s9omwcuIAXgpwWTpyRpessA5fOeWqRqTctBKr3rUeNc=";
+      rev = "5e52758b32e02adca16bb93f95b3f9c050c72b56";
+      hash = "sha256-3x/ZKVYyWuLGkgdm9HutI16m8xpJKSMOZHY48WqH9b0=";
     };
     meta.homepage = "https://github.com/mskelton/tree-sitter-styled";
   };
@@ -2569,12 +2569,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "0.0.0+rev=eced04c";
+    version = "0.0.0+rev=f0336bb";
     src = fetchFromGitHub {
       owner = "v-analyzer";
       repo = "v-analyzer";
-      rev = "eced04c473f3bcb49f9c8ac91744451a9ab40310";
-      hash = "sha256-fT/jqaKwUP7KWT+RT9V23HAL0Ol7mr/8NWNbYtSFhBI=";
+      rev = "f0336bb8847393ba4d5905a94642acf0dc3d5ebd";
+      hash = "sha256-0hC9xb1rOtUb47gzCdzvCxAz54d9RZ4UMfb2PFOM6ZE=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/v-analyzer/v-analyzer";
@@ -2669,12 +2669,12 @@
   };
   wing = buildGrammar {
     language = "wing";
-    version = "0.0.0+rev=b5fa0cb";
+    version = "0.0.0+rev=e6e06a0";
     src = fetchFromGitHub {
       owner = "winglang";
       repo = "wing";
-      rev = "b5fa0cb75ee96d3ff19df59085d508240f5b0fd5";
-      hash = "sha256-SqPw0LxxJiarYR3YIPKxAuFGWJw6dUwSVFbey3z2OAA=";
+      rev = "e6e06a05eeb894001d3c24e1db72f5cd2f35bdae";
+      hash = "sha256-/a1cXTwEyHTv0mzXvZIvD0V9HBL8NyeMMWI1O+Fp5Fs=";
     };
     location = "libs/tree-sitter-wing";
     generate = true;
diff --git a/pkgs/applications/misc/eos-installer/default.nix b/pkgs/applications/misc/eos-installer/default.nix
index 67e6b2bc97ad..5d4ea2e8c60c 100644
--- a/pkgs/applications/misc/eos-installer/default.nix
+++ b/pkgs/applications/misc/eos-installer/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eos-installer";
-  version = "5.0.2";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = "endlessm";
     repo = "eos-installer";
     rev = "Release_${version}";
-    sha256 = "utTTux8o8TN51bvnGldrtMEatiLA1AiHf/9XJZ7k7KM=";
+    sha256 = "BqvZglzFJabGXkI8hnLiw1r+CvM7kSKQPj8IKYBB6S4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/office/planify/default.nix b/pkgs/applications/office/planify/default.nix
index f8b23b533b69..401dc150b27d 100644
--- a/pkgs/applications/office/planify/default.nix
+++ b/pkgs/applications/office/planify/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.3.1";
+  version = "4.3.2";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-YF4un5j7zv0ishcgt00XDGy0AhR/bo6HJj04t0qfxwU=";
+    hash = "sha256-i+Up92Gl3FjgQ4GpcZruvYD//TPNWktSuWXGgDTwbWw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index 32e42a8b944f..a23d7d3d8849 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -151,7 +151,7 @@ stdenv.mkDerivation rec {
     description = "Collect, organize, cite, and share your research sources";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Only;
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ i077 ];
   };
 }
diff --git a/pkgs/applications/office/zotero/zotero_7.nix b/pkgs/applications/office/zotero/zotero_7.nix
index 2164e44154ae..941581d22df0 100644
--- a/pkgs/applications/office/zotero/zotero_7.nix
+++ b/pkgs/applications/office/zotero/zotero_7.nix
@@ -144,7 +144,7 @@ stdenv.mkDerivation rec {
     description = "Collect, organize, cite, and share your research sources";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Only;
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ atila ];
   };
 }
diff --git a/pkgs/applications/radio/gnuradio/3.9.nix b/pkgs/applications/radio/gnuradio/3.9.nix
index 4d10851b7e13..62ee880ce2be 100644
--- a/pkgs/applications/radio/gnuradio/3.9.nix
+++ b/pkgs/applications/radio/gnuradio/3.9.nix
@@ -276,7 +276,7 @@ stdenv.mkDerivation (finalAttrs: (shared // {
   '';
   patches = [
     # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
-    ./modtool-newmod-permissions.patch
+    ./modtool-newmod-permissions.3_9.patch
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overridden and are used inside GR plugins - the same version must
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index d1f0a3fd6fb6..7765b92c1d26 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -45,11 +45,11 @@
 # If one wishes to use a different src or name for a very custom build
 , overrideSrc ? {}
 , pname ? "gnuradio"
-, version ? "3.10.7.0"
+, version ? "3.10.8.0"
 }:
 
 let
-  sourceSha256 = "sha256-7fIQMcx90wI4mAZmR26/rkBKPKhNxgu3oWpJTV3C+Ek=";
+  sourceSha256 = "sha256-4BoJciL3ffd9Dgk3HxXCOOwnGHqCEVuo+a1AtzJG4IY=";
   featuresInfo = {
     # Needed always
     basic = {
@@ -291,12 +291,6 @@ stdenv.mkDerivation (finalAttrs: (shared // {
   patches = [
     # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
     ./modtool-newmod-permissions.patch
-    # https://github.com/gnuradio/gnuradio/pull/6808
-    (fetchpatch {
-      name = "gnuradio-fmt10.1.patch";
-      url = "https://github.com/gnuradio/gnuradio/commit/9357c17721a27cc0aae3fe809af140c84e492f37.patch";
-      hash = "sha256-w3b22PTqoORyYQ3RKRG+2htQWbITzQiOdSDyuejUtHQ=";
-    })
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overridden and are used inside GR plugins - the same version must
diff --git a/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.3_9.patch b/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.3_9.patch
new file mode 100644
index 000000000000..7cab73fede0c
--- /dev/null
+++ b/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.3_9.patch
@@ -0,0 +1,15 @@
+diff --git c/gr-utils/modtool/core/newmod.py w/gr-utils/modtool/core/newmod.py
+index babebfcde..9a02f663e 100644
+--- c/gr-utils/modtool/core/newmod.py
++++ w/gr-utils/modtool/core/newmod.py
+@@ -62,7 +62,9 @@ class ModToolNewModule(ModTool):
+         self._setup_scm(mode='new')
+         logger.info(f"Creating out-of-tree module in {self.dir}...")
+         try:
+-            shutil.copytree(self.srcdir, self.dir)
++            # https://stackoverflow.com/a/17022146/4935114
++            shutil.copystat = lambda x, y: x
++            shutil.copytree(self.srcdir, self.dir, copy_function=shutil.copyfile)
+             try:
+               shutil.copyfile(os.path.join(gr.prefix(), 'share', 'gnuradio', 'clang-format.conf'),
+                               os.path.join(self.dir, '.clang-format'))
diff --git a/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.patch b/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.patch
index 7cab73fede0c..671a7559f4e4 100644
--- a/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.patch
+++ b/pkgs/applications/radio/gnuradio/modtool-newmod-permissions.patch
@@ -1,8 +1,8 @@
-diff --git c/gr-utils/modtool/core/newmod.py w/gr-utils/modtool/core/newmod.py
-index babebfcde..9a02f663e 100644
---- c/gr-utils/modtool/core/newmod.py
+diff --git i/gr-utils/modtool/core/newmod.py w/gr-utils/modtool/core/newmod.py
+index 8b222473f..c82fcd538 100644
+--- i/gr-utils/modtool/core/newmod.py
 +++ w/gr-utils/modtool/core/newmod.py
-@@ -62,7 +62,9 @@ class ModToolNewModule(ModTool):
+@@ -66,7 +66,9 @@ class ModToolNewModule(ModTool):
          self._setup_scm(mode='new')
          logger.info(f"Creating out-of-tree module in {self.dir}...")
          try:
@@ -10,6 +10,6 @@ index babebfcde..9a02f663e 100644
 +            # https://stackoverflow.com/a/17022146/4935114
 +            shutil.copystat = lambda x, y: x
 +            shutil.copytree(self.srcdir, self.dir, copy_function=shutil.copyfile)
-             try:
-               shutil.copyfile(os.path.join(gr.prefix(), 'share', 'gnuradio', 'clang-format.conf'),
-                               os.path.join(self.dir, '.clang-format'))
+             source_dir = os.path.join(gr.prefix(), "share", "gnuradio")
+             for source_name, target_name in (
+                     ("clang-format.conf", ".clang-format"),
diff --git a/pkgs/applications/system/asusctl/Cargo.lock b/pkgs/applications/system/asusctl/Cargo.lock
index b85fc8b03e61..7629e4050758 100644
--- a/pkgs/applications/system/asusctl/Cargo.lock
+++ b/pkgs/applications/system/asusctl/Cargo.lock
@@ -199,7 +199,7 @@ checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
 
 [[package]]
 name = "asusctl"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "asusd",
  "cargo-husky",
@@ -218,7 +218,7 @@ dependencies = [
 
 [[package]]
 name = "asusd"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "async-trait",
  "cargo-husky",
@@ -237,12 +237,13 @@ dependencies = [
  "serde_derive",
  "systemd-zbus",
  "tokio",
+ "udev",
  "zbus",
 ]
 
 [[package]]
 name = "asusd-user"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "config-traits",
@@ -845,7 +846,7 @@ dependencies = [
 
 [[package]]
 name = "config-traits"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "log",
@@ -898,7 +899,7 @@ dependencies = [
 
 [[package]]
 name = "cpuctl"
-version = "5.0.0"
+version = "5.0.2"
 
 [[package]]
 name = "cpufeatures"
@@ -1025,7 +1026,7 @@ dependencies = [
 
 [[package]]
 name = "dmi_id"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "log",
  "udev",
@@ -2845,7 +2846,7 @@ checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "rog-control-center"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "asusd",
  "cargo-husky",
@@ -2878,7 +2879,7 @@ dependencies = [
 
 [[package]]
 name = "rog_anime"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "dmi_id",
@@ -2895,7 +2896,7 @@ dependencies = [
 
 [[package]]
 name = "rog_aura"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "dmi_id",
@@ -2909,7 +2910,7 @@ dependencies = [
 
 [[package]]
 name = "rog_dbus"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "asusd",
  "cargo-husky",
@@ -2922,7 +2923,7 @@ dependencies = [
 
 [[package]]
 name = "rog_platform"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "concat-idents",
@@ -2939,7 +2940,7 @@ dependencies = [
 
 [[package]]
 name = "rog_profiles"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "cargo-husky",
  "log",
@@ -2953,7 +2954,7 @@ dependencies = [
 
 [[package]]
 name = "rog_simulators"
-version = "5.0.0"
+version = "5.0.2"
 dependencies = [
  "glam",
  "log",
diff --git a/pkgs/applications/system/asusctl/default.nix b/pkgs/applications/system/asusctl/default.nix
index da7187aa7918..bc4ddfbf596c 100644
--- a/pkgs/applications/system/asusctl/default.nix
+++ b/pkgs/applications/system/asusctl/default.nix
@@ -13,13 +13,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "asusctl";
-  version = "5.0.0";
+  version = "5.0.2";
 
   src = fetchFromGitLab {
     owner = "asus-linux";
     repo = "asusctl";
     rev = version;
-    hash = "sha256-ZdPSUXchQ19awvlNFVih38p6AU7KQ2RttUnm8zQnTWs=";
+    hash = "sha256-0+HCqp/mn+O6Cnbmma7iw5EFBbLozvnkqGA378oj0G8=";
   };
 
   cargoHash = "";
diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
index 7d0138a4d85a..e13288371b5d 100644
--- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
@@ -187,6 +187,12 @@ let
       x11_args+=(--ro-bind-try "$local_socket" "$local_socket")
     fi
 
+    ${lib.optionalString privateTmp ''
+    # sddm places XAUTHORITY in /tmp
+    if [[ "$XAUTHORITY" == /tmp/* ]]; then
+      x11_args+=(--ro-bind-try "$XAUTHORITY" "$XAUTHORITY")
+    fi''}
+
     cmd=(
       ${bubblewrap}/bin/bwrap
       --dev-bind /dev /dev
diff --git a/pkgs/build-support/dart/build-dart-application/default.nix b/pkgs/build-support/dart/build-dart-application/default.nix
index 1a98f98fb8e6..2cb193ac6f16 100644
--- a/pkgs/build-support/dart/build-dart-application/default.nix
+++ b/pkgs/build-support/dart/build-dart-application/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, callPackage, fetchDartDeps, writeText, symlinkJoin, dartHooks, makeWrapper, dart, cacert, nodejs, darwin, jq }:
+{ lib, stdenv, callPackage, fetchDartDeps, runCommand, symlinkJoin, writeText, dartHooks, makeWrapper, dart, cacert, nodejs, darwin, jq }:
 
 { sdkSetupScript ? ""
 , pubGetScript ? "dart pub get"
@@ -37,13 +37,15 @@
 let
   dartDeps = (fetchDartDeps.override {
     dart = symlinkJoin {
-      name = "dart-fod";
-      paths = [ dart ];
-      nativeBuildInputs = [ makeWrapper ];
-      postBuild = ''
-        wrapProgram "$out/bin/dart" \
-          --add-flags "--root-certs-file=${cacert}/etc/ssl/certs/ca-bundle.crt"
-      '';
+      name = "dart-sdk-fod";
+      paths = [
+        (runCommand "dart-fod" { nativeBuildInputs = [ makeWrapper ]; } ''
+          mkdir -p "$out/bin"
+          makeWrapper "${dart}/bin/dart" "$out/bin/dart" \
+            --add-flags "--root-certs-file=${cacert}/etc/ssl/certs/ca-bundle.crt"
+        '')
+        dart
+      ];
     };
   }) {
     buildDrvArgs = args;
diff --git a/pkgs/build-support/dart/fetch-dart-deps/default.nix b/pkgs/build-support/dart/fetch-dart-deps/default.nix
index 51052cae18f4..e6e5cf76a60f 100644
--- a/pkgs/build-support/dart/fetch-dart-deps/default.nix
+++ b/pkgs/build-support/dart/fetch-dart-deps/default.nix
@@ -154,15 +154,27 @@ let
       outputHash = if vendorHash != "" then vendorHash else lib.fakeSha256;
     } // (removeAttrs drvArgs [ "name" "pname" ]));
 
-  depsListDrv = stdenvNoCC.mkDerivation ({
-    name = "${name}-dart-deps-list.json";
-    nativeBuildInputs = [ hook dart jq ];
+  mkDepsDrv = args: stdenvNoCC.mkDerivation (args // {
+    nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [ hook dart ];
 
-    configurePhase = ''
+    configurePhase = args.configurePhase or ''
       runHook preConfigure
-      doPubGet dart pub get --offline
+
+      ${sdkSetupScript}
+
+      _pub_get() {
+        ${pubGetScript} --offline
+      }
+      doPubGet _pub_get
+
       runHook postConfigure
     '';
+  } // (removeAttrs buildDrvInheritArgs [ "name" "pname" ]));
+
+  depsListDrv = mkDepsDrv {
+    name = "${name}-dart-deps-list.json";
+
+    nativeBuildInputs = [ jq ];
 
     buildPhase = ''
       runHook preBuild
@@ -171,7 +183,34 @@ let
     '';
 
     dontInstall = true;
-  } // (removeAttrs buildDrvInheritArgs [ "name" "pname" ]));
+  };
+
+  packageConfigDrv = mkDepsDrv {
+    name = "${name}-package-config.json";
+
+    nativeBuildInputs = [ jq ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      # Canonicalise the package_config.json, and replace references to the
+      # reconstructed package cache with the original FOD.
+      #
+      # The reconstructed package cache is not reproducible. The intended
+      # use-case of this derivation is for use with tools that use a
+      # package_config.json to load assets from packages, and not for use with
+      # Pub directly, which requires the setup performed by the hook before
+      # usage.
+      jq -S '
+        .packages[] |= . + { rootUri: .rootUri | gsub("'"$PUB_CACHE"'"; "${hook.deps}/cache/.pub-cache") }
+      | .generated |= "1970-01-01T00:00:00.000Z"
+      ' .dart_tool/package_config.json > $out
+
+      runHook postBuild
+    '';
+
+    dontInstall = true;
+  };
 
   # As of Dart 3.0.0, Pub checks the revision of cached Git-sourced packages.
   # Git must be wrapped to return a positive result, as the real .git directory is wiped
@@ -195,8 +234,10 @@ let
     substitutions = { inherit gitSourceWrapper deps; };
     propagatedBuildInputs = [ dart git ];
     passthru = {
+      inherit deps;
       files = deps.outPath;
       depsListFile = depsListDrv.outPath;
+      packageConfig = packageConfigDrv;
     };
   }) ./setup-hook.sh;
 in
diff --git a/pkgs/build-support/flutter/default.nix b/pkgs/build-support/flutter/default.nix
index 3e136211655b..bcee31506df1 100644
--- a/pkgs/build-support/flutter/default.nix
+++ b/pkgs/build-support/flutter/default.nix
@@ -48,6 +48,8 @@
     flutter config --enable-linux-desktop >/dev/null
   '';
 
+  inherit pubGetScript;
+
   nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [ wrapGAppsHook ];
   buildInputs = (args.buildInputs or [ ]) ++ [ glib ];
 
diff --git a/pkgs/desktops/gnome/core/evince/default.nix b/pkgs/desktops/gnome/core/evince/default.nix
index a2959626c837..f02f2e323e25 100644
--- a/pkgs/desktops/gnome/core/evince/default.nix
+++ b/pkgs/desktops/gnome/core/evince/default.nix
@@ -140,6 +140,7 @@ stdenv.mkDerivation rec {
 
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
+    mainProgram = "evince";
     maintainers = teams.gnome.members ++ teams.pantheon.members;
   };
 }
diff --git a/pkgs/development/compilers/flutter/artifacts/fetch-artifacts.nix b/pkgs/development/compilers/flutter/artifacts/fetch-artifacts.nix
new file mode 100644
index 000000000000..e0c1440a604f
--- /dev/null
+++ b/pkgs/development/compilers/flutter/artifacts/fetch-artifacts.nix
@@ -0,0 +1,54 @@
+{ lib
+, runCommand
+, xorg
+, cacert
+, unzip
+
+, platform
+, flutter
+, hash
+}:
+
+let
+  platforms = [
+    "android"
+    "ios"
+    "web"
+    "linux"
+    "windows"
+    "macos"
+    "fuchsia"
+    "universal"
+  ];
+
+  flutter' = flutter.override {
+    # Use a version of Flutter with just enough capabilities to download
+    # artifacts.
+    supportedTargetPlatforms = [ ];
+  };
+in
+runCommand "flutter-artifacts-${platform}"
+{
+  nativeBuildInputs = [ xorg.lndir flutter' unzip ];
+
+  NIX_FLUTTER_TOOLS_VM_OPTIONS = "--root-certs-file=${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+  outputHash = hash;
+  outputHashMode = "recursive";
+  outputHashAlgo = "sha256";
+
+  passthru = {
+    inherit platform;
+  };
+} ''
+  export FLUTTER_ROOT="$NIX_BUILD_TOP"
+  lndir -silent '${flutter'}' "$FLUTTER_ROOT"
+  rm -rf "$FLUTTER_ROOT/bin/cache"
+  mkdir "$FLUTTER_ROOT/bin/cache"
+
+  HOME="$(mktemp -d)" flutter precache -v '--${platform}' ${builtins.concatStringsSep " " (map (p: "'--no-${p}'") (lib.remove platform platforms))}
+  rm -rf "$FLUTTER_ROOT/bin/cache/lockfile"
+  find "$FLUTTER_ROOT" -type l -lname '${flutter'}/*' -delete
+
+  cp -r bin/cache "$out"
+''
diff --git a/pkgs/development/compilers/flutter/artifacts/hashes.nix b/pkgs/development/compilers/flutter/artifacts/hashes.nix
new file mode 100644
index 000000000000..551975acf662
--- /dev/null
+++ b/pkgs/development/compilers/flutter/artifacts/hashes.nix
@@ -0,0 +1,75 @@
+# NOTICE: When updating these hashes, make sure that no additional platforms
+# have been added to the `flutter precache` CLI. If any have, they may be
+# included in every derivation, unless they are also added to the platform list
+# in fetch-artifacts.nix.
+#
+# The known arguments are as follows:
+# $ flutter precache --help --verbose
+# Usage: flutter precache [arguments]
+# -h, --help                              Print this usage information.
+# -a, --all-platforms                     Precache artifacts for all host platforms.
+# -f, --force                             Force re-downloading of artifacts.
+#     --[no-]android                      Precache artifacts for Android development.
+#     --[no-]android_gen_snapshot         Precache gen_snapshot for Android development.
+#     --[no-]android_maven                Precache Gradle dependencies for Android development.
+#     --[no-]android_internal_build       Precache dependencies for internal Android development.
+#     --[no-]ios                          Precache artifacts for iOS development.
+#     --[no-]web                          Precache artifacts for web development.
+#     --[no-]linux                        Precache artifacts for Linux desktop development.
+#     --[no-]windows                      Precache artifacts for Windows desktop development.
+#     --[no-]macos                        Precache artifacts for macOS desktop development.
+#     --[no-]fuchsia                      Precache artifacts for Fuchsia development.
+#     --[no-]universal                    Precache artifacts required for any development platform.
+#                                         (defaults to on)
+#     --[no-]flutter_runner               Precache the flutter runner artifacts.
+#     --[no-]use-unsigned-mac-binaries    Precache the unsigned macOS binaries when available.
+
+# Schema:
+# ${flutterVersion}.${targetPlatform}.${hostPlatform}
+#
+# aarch64-darwin as a host is not yet supported.
+# https://github.com/flutter/flutter/issues/60118
+{
+  "3.13.8" = {
+    android = {
+      x86_64-linux = "sha256-Uc36aBq8wQo2aEvjAPOoixZElWOE/GNRm2GUfhbwT3Y=";
+      aarch64-linux = "sha256-Uc36aBq8wQo2aEvjAPOoixZElWOE/GNRm2GUfhbwT3Y=";
+      x86_64-darwin = "sha256-v/6/GTj7732fEOIgSaoM00yaw2qNwOMuvbuoCvii7vQ=";
+    };
+    fuchsia = {
+      x86_64-linux = "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=";
+      aarch64-linux = "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=";
+      x86_64-darwin = "sha256-eu0BERdz53CkSexbpu3KA7O6Q4g0s9SGD3t1Snsk3Fk=";
+    };
+    ios = {
+      x86_64-linux = "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao=";
+      aarch64-linux = "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao=";
+      x86_64-darwin = "sha256-QwkeGnutTVsm682CqxRtEd9rKUvN7zlAJcqkvAQYwao=";
+    };
+    linux = {
+      x86_64-linux = "sha256-0gIOwux3YBdmcXgwICr8dpftj1CauaBUX8Rt5GG0WSs=";
+      aarch64-linux = "sha256-drGHsuJoOCLqrhVrXczqJRCOtpeWVlqdWW0OSMS/l5M=";
+      x86_64-darwin = "sha256-0gIOwux3YBdmcXgwICr8dpftj1CauaBUX8Rt5GG0WSs=";
+    };
+    macos = {
+      x86_64-linux = "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc=";
+      aarch64-linux = "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc=";
+      x86_64-darwin = "sha256-9WqCJQ37mcGc5tzfqQoY5CqHWHGTizjXf9p73bdnNWc=";
+    };
+    universal = {
+      x86_64-linux = "sha256-wATt1UPjo/fh7RFO1vvcUAdo0dMAaaOUIuzYodsM0v0=";
+      aarch64-linux = "sha256-Z9bszNaIpCccG7OfvE5WFsw36dITiyCQAZ6p29+Yq68=";
+      x86_64-darwin = "sha256-qN5bAXRfQ78TWF3FLBIxWzUB5y5OrZVQTEilY5J/+2k=";
+    };
+    web = {
+      x86_64-linux = "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0=";
+      aarch64-linux = "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0=";
+      x86_64-darwin = "sha256-DVXJOOFxv7tKt3d0NaYMexkphEcr7+gDFV67I6iAYa0=";
+    };
+    windows = {
+      x86_64-linux = "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI=";
+      aarch64-linux = "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI=";
+      x86_64-darwin = "sha256-s8fJtwQkuZaGXr6vrPiKfpwP/NfewbETwyp9ERGqHYI=";
+    };
+  };
+}
diff --git a/pkgs/development/compilers/flutter/artifacts/overrides/linux.nix b/pkgs/development/compilers/flutter/artifacts/overrides/linux.nix
new file mode 100644
index 000000000000..bc6114415b90
--- /dev/null
+++ b/pkgs/development/compilers/flutter/artifacts/overrides/linux.nix
@@ -0,0 +1,10 @@
+{ gtk3
+}:
+
+{ buildInputs ? [ ]
+, ...
+}:
+
+{
+  buildInputs = buildInputs ++ [ gtk3 ];
+}
diff --git a/pkgs/development/compilers/flutter/artifacts/prepare-artifacts.nix b/pkgs/development/compilers/flutter/artifacts/prepare-artifacts.nix
new file mode 100644
index 000000000000..9714d25c6f9b
--- /dev/null
+++ b/pkgs/development/compilers/flutter/artifacts/prepare-artifacts.nix
@@ -0,0 +1,26 @@
+{ lib
+, stdenv
+, callPackage
+, autoPatchelfHook
+, src
+}:
+
+(stdenv.mkDerivation {
+  inherit (src) name;
+  inherit src;
+
+  nativeBuildInputs = lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin"
+    cp -r . "$out/bin/cache"
+
+    runHook postInstall
+  '';
+}).overrideAttrs (
+  if builtins.pathExists ./overrides/${src.platform}.nix
+  then callPackage ./overrides/${src.platform}.nix { }
+  else ({ ... }: { })
+)
diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
index ff18036677a1..f9c0320edec8 100644
--- a/pkgs/development/compilers/flutter/default.nix
+++ b/pkgs/development/compilers/flutter/default.nix
@@ -1,14 +1,24 @@
-{ callPackage, fetchzip, dart, lib, stdenv }:
+{ callPackage, fetchzip, fetchFromGitHub, dart, lib, stdenv }:
 let
   mkCustomFlutter = args: callPackage ./flutter.nix args;
   wrapFlutter = flutter: callPackage ./wrapper.nix { inherit flutter; };
   getPatches = dir:
     let files = builtins.attrNames (builtins.readDir dir);
     in map (f: dir + ("/" + f)) files;
-  mkFlutter = { version, engineVersion, dartVersion, flutterHash, dartHash, patches }:
+  mkFlutter =
+    { version
+    , engineVersion
+    , dartVersion
+    , flutterHash
+    , dartHash
+    , patches
+    , pubspecLockFile
+    , vendorHash
+    , depsListFile
+    }:
     let
       args = {
-        inherit version engineVersion patches;
+        inherit version engineVersion patches pubspecLockFile vendorHash depsListFile;
 
         dart = dart.override {
           version = dartVersion;
@@ -31,24 +41,12 @@ let
             };
           };
         };
-        src = {
-          x86_64-linux = fetchzip {
-            url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${version}-stable.tar.xz";
-            sha256 = flutterHash.x86_64-linux;
-          };
-          aarch64-linux = fetchzip {
-            url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${version}-stable.tar.xz";
-            sha256 = flutterHash.aarch64-linux;
-          };
-          x86_64-darwin = fetchzip {
-            url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_${version}-stable.zip";
-            sha256 = flutterHash.x86_64-darwin;
-          };
-          aarch64-darwin = fetchzip {
-            url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_arm64_${version}-stable.zip";
-            sha256 = flutterHash.aarch64-darwin;
-          };
-        }.${stdenv.hostPlatform.system};
+        src = fetchFromGitHub {
+          owner = "flutter";
+          repo = "flutter";
+          rev = version;
+          hash = flutterHash;
+        };
       };
     in
     (mkCustomFlutter args).overrideAttrs (prev: next: {
@@ -57,13 +55,7 @@ let
         buildFlutterApplication = callPackage ../../../build-support/flutter {
           # Package a minimal version of Flutter that only uses Linux desktop release artifacts.
           flutter = (wrapFlutter (mkCustomFlutter args)).override {
-            supportsAndroid = false;
-            includedEngineArtifacts = {
-              common = [ "flutter_patched_sdk_product" ];
-              platform.linux = lib.optionals stdenv.hostPlatform.isLinux
-                (lib.genAttrs ((lib.optional stdenv.hostPlatform.isx86_64 "x64") ++ (lib.optional stdenv.hostPlatform.isAarch64 "arm64"))
-                  (architecture: [ "release" ]));
-            };
+            supportedTargetPlatforms = [ "universal" "linux" ];
           };
         };
       };
@@ -83,12 +75,10 @@ in
       x86_64-darwin = "sha256-BchKowKd6BscVuk/dXibcQzdFkW9//GDfll77mHEI4M=";
       aarch64-darwin = "sha256-9yrx09vYrOTmdqkfJI7mfh7DI1/rg67tPlf82m5+iKI=";
     };
-    flutterHash = rec {
-      x86_64-linux = "sha256-ouI1gjcynSQfPTnfTVXQ4r/NEDdhmzUsKdcALLRiCbg=";
-      aarch64-linux = x86_64-linux;
-      x86_64-darwin = "sha256-k6KNazP/I71zG5mbx3iEtXBJ8EZi9Qq+7PgL/HAJrgE=";
-      aarch64-darwin = "sha256-Duvw8EqrGb3PmBHBH/prZjyij2xJd9sLkNfPRYpC0pQ=";
-    };
+    flutterHash = "sha256-00G030FvZZTsdf9ruFs9jdIHcC5h+xpp4NlmL64qVZA=";
     patches = flutter3Patches;
+    pubspecLockFile = ./lockfiles/stable/pubspec.lock;
+    vendorHash = "sha256-lsFOvvmhszBcFb9XvabpqfL2Ek4wjhmB0OrcWUOURFQ=";
+    depsListFile = ./lockfiles/stable/deps.json;
   };
 }
diff --git a/pkgs/development/compilers/flutter/engine-artifacts/default.nix b/pkgs/development/compilers/flutter/engine-artifacts/default.nix
deleted file mode 100644
index 30c293c8d75d..000000000000
--- a/pkgs/development/compilers/flutter/engine-artifacts/default.nix
+++ /dev/null
@@ -1,243 +0,0 @@
-{ lib
-, stdenv
-, hostPlatform
-, engineVersion
-, fetchurl
-, fetchzip
-, autoPatchelfHook
-, gtk3
-, flutterVersion
-, unzip
-, stdenvNoCC
-}:
-
-let
-  hashes = (import ./hashes.nix).${engineVersion} or
-    (throw "There are no known artifact hashes for Flutter engine version ${engineVersion}.");
-  noticeText = stdenvNoCC.mkDerivation (finalAttrs: {
-    pname = "flutter-notice";
-    version = engineVersion;
-    dontUnpack = true;
-    src = fetchurl {
-      pname = "flutter-sky_engine-LICENSE";
-      version = engineVersion;
-      url = "https://raw.githubusercontent.com/flutter/engine/${engineVersion}/sky/packages/sky_engine/LICENSE";
-      sha256 = hashes.skyNotice;
-    };
-    flutterNotice = fetchurl {
-      pname = "flutter-LICENSE";
-      version = engineVersion;
-      url = "https://raw.githubusercontent.com/flutter/flutter/${flutterVersion}/LICENSE";
-      sha256 = hashes.flutterNotice;
-    };
-    installPhase =
-      ''
-        SRC_TEXT="$(cat $src)"
-        FLUTTER_NOTICE_TEXT="$(cat $flutterNotice)"
-        cat << EOF > $out
-        This artifact is from the Flutter SDK's engine.
-        This file carries third-party notices for its dependencies.
-        See also other files, that have LICENSE in the name, in the artifact directory.
-
-        Appendix 1/2: merged sky_engine LICENSE file (also found at ${finalAttrs.src.url})
-        $SRC_TEXT
-
-        Appendix 2/2: Flutter license (also found at ${finalAttrs.flutterNotice.url})
-        $FLUTTER_NOTICE_TEXT
-        EOF
-      '';
-  });
-  artifacts =
-    {
-      common = {
-        flutter_patched_sdk = { archive = "flutter_patched_sdk.zip"; };
-        flutter_patched_sdk_product = { archive = "flutter_patched_sdk_product.zip"; };
-      };
-      platform = {
-        android =
-          (lib.genAttrs
-            [ "arm" "arm64" "x64" ]
-            (arch:
-              {
-                base = [
-                  { archive = "artifacts.zip"; }
-                ];
-                variants = lib.genAttrs [ "profile" "release" ]
-                  (variant: [
-                    { archive = "artifacts.zip"; }
-                    { subdirectory = true; archive = "${lib.toLower hostPlatform.uname.system}-x64.zip"; }
-                  ]);
-              })) //
-          {
-            "x86" = {
-              base = [
-                { archive = "artifacts.zip"; }
-              ];
-              variants.jit-release = [
-                { archive = "artifacts.zip"; }
-              ];
-            };
-          };
-
-        darwin = {
-          "arm64" = {
-            base = [
-              { archive = "artifacts.zip"; }
-              { archive = "font-subset.zip"; }
-            ];
-            variants = lib.genAttrs [ "profile" "release" ]
-              (variant: [
-                { archive = "artifacts.zip"; }
-              ]);
-          };
-          "x64" = {
-            base = [
-              { archive = "FlutterEmbedder.framework.zip"; }
-              { archive = "FlutterMacOS.framework.zip"; }
-              { archive = "artifacts.zip"; }
-              { archive = "font-subset.zip"; }
-              { archive = "gen_snapshot.zip"; }
-            ];
-            variants.profile = [
-              { archive = "FlutterMacOS.framework.zip"; }
-              { archive = "artifacts.zip"; }
-              { archive = "gen_snapshot.zip"; }
-            ];
-            variants.release = [
-              { archive = "FlutterMacOS.dSYM.zip"; }
-              { archive = "FlutterMacOS.framework.zip"; }
-              { archive = "artifacts.zip"; }
-              { archive = "gen_snapshot.zip"; }
-            ];
-          };
-        };
-
-        ios =
-          (lib.genAttrs
-            [ "" ]
-            (arch:
-              {
-                base = [
-                  { archive = "artifacts.zip"; }
-                ];
-                variants.profile = [
-                  { archive = "artifacts.zip"; }
-                ];
-                variants.release = [
-                  { archive = "artifacts.zip"; }
-                  { archive = "Flutter.dSYM.zip"; }
-                ];
-              }));
-
-        linux = lib.genAttrs
-          [ "arm64" "x64" ]
-          (arch:
-            let
-              linux-flutter-gtk = {
-                archive = "linux-${arch}-flutter-gtk.zip";
-                buildInputs = [ gtk3 ];
-              };
-            in
-            {
-              base = [
-                ({ archive = "artifacts.zip"; } // lib.optionalAttrs (arch == "arm64") {
-                  # For some reason, the arm64 artifacts are missing shader code in Flutter < 3.10.0.
-                  postPatch = ''
-                    if [ ! -d shader_lib ]; then
-                      ln -s ${lib.findSingle
-                        (pkg: lib.getName pkg == "flutter-artifact-linux-x64-artifacts")
-                        (throw "Could not find the x64 artifact archive.")
-                        (throw "Could not find the correct x64 artifact archive.")
-                        artifactDerivations.platform.linux.x64.base
-                      }/shader_lib .
-                    fi
-                  '';
-                })
-                { archive = "font-subset.zip"; }
-                (linux-flutter-gtk // {
-                  # https://github.com/flutter/flutter/commit/9d94a51b607600a39c14470c35c676eb3e30eed6
-                  variant = "debug";
-                })
-              ];
-              variants = lib.genAttrs [ "debug" "profile" "release" ] (variant: [
-                linux-flutter-gtk
-              ]);
-            });
-      };
-    };
-
-  mkArtifactDerivation = { platform ? null, variant ? null, subdirectory ? null, archive, ... }@args:
-    let
-      artifactDirectory = if platform == null then null else "${platform}${lib.optionalString (variant != null) "-${variant}"}";
-      archiveBasename = lib.removeSuffix ".${(lib.last (lib.splitString "." archive))}" archive;
-      overrideUnpackCmd = builtins.elem archive [ "FlutterEmbedder.framework.zip" "FlutterMacOS.framework.zip" ];
-    in
-    stdenv.mkDerivation ({
-      pname = "flutter-artifact${lib.optionalString (platform != null) "-${artifactDirectory}"}-${archiveBasename}";
-      version = engineVersion;
-
-      nativeBuildInputs = [ unzip ]
-        ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
-
-      src =
-        if overrideUnpackCmd then
-          (fetchurl {
-            url = "https://storage.googleapis.com/flutter_infra_release/flutter/${engineVersion}${lib.optionalString (platform != null) "/${artifactDirectory}"}/${archive}";
-            hash = (if artifactDirectory == null then hashes else hashes.${artifactDirectory}).${archive};
-          }) else
-          (fetchzip {
-            url = "https://storage.googleapis.com/flutter_infra_release/flutter/${engineVersion}${lib.optionalString (platform != null) "/${artifactDirectory}"}/${archive}";
-            stripRoot = false;
-            hash = (if artifactDirectory == null then hashes else hashes.${artifactDirectory}).${archive};
-          });
-
-      sourceRoot = if overrideUnpackCmd then "." else null;
-      unpackCmd = if overrideUnpackCmd then "unzip -o $src -d $out" else null;
-
-      installPhase =
-        let
-          destination = "$out/${if subdirectory == true then archiveBasename else if subdirectory != null then subdirectory else "."}";
-        in
-        ''
-          # ship the notice near all artifacts. if the artifact directory is / multiple directories are nested in $src, link it there. If there isn't a directory, link it in root
-          # this *isn't the same as the subdirectory variable above*
-          DIR_CNT="$(echo */ | wc -w)"
-          if [[ "$DIR_CNT" == 0 ]]; then
-            ln -s ${noticeText} LICENSE.README
-          else
-            for dir in */
-            do
-              ln -s ${noticeText} "$dir/LICENSE.README"
-            done
-          fi
-          mkdir -p "${destination}"
-          cp -r . "${destination}"
-        '';
-    } // args);
-
-  artifactDerivations = {
-    common = builtins.mapAttrs (name: mkArtifactDerivation) artifacts.common;
-    platform =
-      builtins.mapAttrs
-        (os: architectures:
-          builtins.mapAttrs
-            (architecture: variants: {
-              base = map
-                (args: mkArtifactDerivation ({
-                  platform = "${os}${lib.optionalString (architecture != "") "-${architecture}"}";
-                } // args))
-                variants.base;
-              variants = builtins.mapAttrs
-                (variant: variantArtifacts: map
-                  (args: mkArtifactDerivation ({
-                    platform = "${os}${lib.optionalString (architecture != "") "-${architecture}"}";
-                    inherit variant;
-                  } // args))
-                  variantArtifacts)
-                variants.variants;
-            })
-            architectures)
-        artifacts.platform;
-  };
-in
-artifactDerivations
diff --git a/pkgs/development/compilers/flutter/engine-artifacts/hashes.nix b/pkgs/development/compilers/flutter/engine-artifacts/hashes.nix
deleted file mode 100644
index 7bfb60d7a9ac..000000000000
--- a/pkgs/development/compilers/flutter/engine-artifacts/hashes.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{
-  "767d8c75e898091b925519803830fc2721658d07" = {
-    skyNotice = "sha256-bJMktK26wC9fVzdhLNcTHqOg5sHRZ535LB5u5dgwjlY=";
-    flutterNotice = "sha256-pZjblLYpD/vhC17PkRBXtqlDNRxyf92p5fKJHWhwCiA=";
-    android-arm = {
-      "artifacts.zip" = "sha256-pnUDY2sUN2r/LrivyNkfTUpQC90GKOI6Ya+0lgIz+c0=";
-    };
-    android-arm-profile = {
-      "artifacts.zip" = "sha256-/kDNI+no4u2Ri/FqqsQEp2iEqifULYGqzz8w0G4pzCM=";
-      "linux-x64.zip" = "sha256-fUfaDJIo1VcdJHcd0jO98Az3OdNQ+JtA5Mp6nQVVU4E=";
-      "darwin-x64.zip" = "sha256-J7vDD5VEsgnWmbI8acM3vQwrnrqcfMaCijiItDfniLY=";
-    };
-    android-arm-release = {
-      "artifacts.zip" = "sha256-tVAFHHG8A8vlgQu6l6ybdfm6OmBf2vrYf3PZByWvs08=";
-      "linux-x64.zip" = "sha256-lrejG7zpUBox9kPvs1uPM/lyR1d/SAc1w+c6kcqghHI=";
-      "darwin-x64.zip" = "sha256-8lKOsqLgbnuoCR87v84dn8V3PRzl1+maWFIHopiGvbc=";
-    };
-    android-arm64 = {
-      "artifacts.zip" = "sha256-rcU2mX0nP1ot+6DU+uxvILUOAuwTPGH23UQ6riBs0d4=";
-    };
-    android-arm64-profile = {
-      "artifacts.zip" = "sha256-x4TEJWi3c6mEPGh+3l4PtRqsg4Tq7mxHtGz+4MqwzPw=";
-      "linux-x64.zip" = "sha256-PsDKOq3DXaNeNtaFtDQJ9JIEESXBHm8XHHpOw2u1cGg=";
-      "darwin-x64.zip" = "sha256-K4W1CEBOlZVsHjuhvKCUZWv45VSohRd23vviaLqMNjQ=";
-    };
-    android-arm64-release = {
-      "artifacts.zip" = "sha256-w+J4sNhYoj44IiHpZ0BkemCYlE9wOTvWL57Y8RCstkI=";
-      "linux-x64.zip" = "sha256-MJsmck27V14/f0IAT6b/R47p8/eCMX9Nn//PEAbEeOY=";
-      "darwin-x64.zip" = "sha256-xXa5GFatJPiwBANqeWUpAdM9gibD4xH85aI6YpJrcpI=";
-    };
-    android-x64 = {
-      "artifacts.zip" = "sha256-doNUwEJkwncHPIf2c8xOZByUU8dmogtWlc6q7n7ElDY=";
-    };
-    android-x64-profile = {
-      "artifacts.zip" = "sha256-N3AjdHdzj4s6v3f3Gf6n/1Xk0W7xFQP70SneCNlj2sk=";
-      "linux-x64.zip" = "sha256-pNn75iZqLwOGO3ZmymmrSasDPMmDWwp9ZWBv9Xti4cU=";
-      "darwin-x64.zip" = "sha256-6O4lA/4wZ91ODUUYHe4HpjvraAEbhHiehBmf3sT37Dc=";
-    };
-    android-x64-release = {
-      "artifacts.zip" = "sha256-odDS/m8fgSA24EYt+W2sEDmOlPO17FZxxomWuYUHmns=";
-      "linux-x64.zip" = "sha256-sVQYmu0KaPADlL59XZc26Ks+TbmaJxRGPiJKlWxUhRA=";
-      "darwin-x64.zip" = "sha256-dep/CmBIDkvqYKQPWMCDTDbFhVvOk6N7JAF8v3dr/P8=";
-    };
-    android-x86 = {
-      "artifacts.zip" = "sha256-MzTFQ0XPtd9OXvKfM98bwpxN/xfEcXox24gn/4aS/Do=";
-    };
-    android-x86-jit-release = {
-      "artifacts.zip" = "sha256-cUsBqJxOOluwnYEFzdtZof8c4Vp1D81HkEEH8aRGLyY=";
-    };
-    darwin-arm64 = {
-      "artifacts.zip" = "sha256-df+rmN0RqLM7MgEKjTcybMY0bFYCB1jsTvaVE1J0BzY=";
-      "font-subset.zip" = "sha256-hJ5fECxN4oZX6E9ivzSDGejNSj56t2SKccbyfozXxps=";
-    };
-    darwin-arm64-profile = {
-      "artifacts.zip" = "sha256-EaXOr998zE4cG5G5FRtsDGt3jjg1GjkRGE/ZDD3Coto=";
-    };
-    darwin-arm64-release = {
-      "artifacts.zip" = "sha256-1XMoM8jDRoUSPMauKD5lsgC25B7Htod8wYouDKSEGJY=";
-    };
-    darwin-x64 = {
-      "FlutterEmbedder.framework.zip" = "sha256-vzvt0pwo1HbIxxym/jn2Y+1+Iqm/Gw2TfymEcuUHIXQ=";
-      "FlutterMacOS.framework.zip" = "sha256-cMTCULaVOKDq8VrqCmZLo0IPBve0GSh0K2yvtdCvX8c=";
-      "artifacts.zip" = "sha256-8BViZUz4b0XurQJM+FCU2toONKmhajabCc66gBUVGgY=";
-      "font-subset.zip" = "sha256-VgqNdUmvTbSedQtJNT+Eq90GWS4hXCDCBDBjno6s1dk=";
-      "gen_snapshot.zip" = "sha256-4O0ZfKt96x8/Jwh8DgBoPFiv84Tqf9tR/f0PVRJlJiQ=";
-    };
-    darwin-x64-profile = {
-      "FlutterMacOS.framework.zip" = "sha256-IrXK0Mjllic3OKaYKKpAE9gPIceTO32hGqgxGR66QmY=";
-      "artifacts.zip" = "sha256-IHllbxwRMrEWA1MI0DRCYYRzYAdQIL8B9b5rZHsOvjc=";
-      "gen_snapshot.zip" = "sha256-bPI6pHrWQR1X7CzytbJA90TYe3cg1yN+9v7JtsCCrbQ=";
-    };
-    darwin-x64-release = {
-      "FlutterMacOS.dSYM.zip" = "sha256-HjU8sLPwvOwO3LP7krpZZW6/t3sN3rX2frFnBp1Kk0I=";
-      "FlutterMacOS.framework.zip" = "sha256-GuTWojZFdSEeOiSYxH8XGSWsxcrkUpnXA61B0NpDa5A=";
-      "artifacts.zip" = "sha256-tQCm1HHrhffNz9a0lNIHXLBqFMbT4QiaibKvRKuuhJ4=";
-      "gen_snapshot.zip" = "sha256-0na+yx0Nxe/FuHVZqhgbRniZLInShoKE3USaJg0829o=";
-    };
-    "flutter_patched_sdk.zip" = "sha256-AVjXLND3nJAaGyBAhytBRUvbkJtwZEcndQSrq+D2c08=";
-    "flutter_patched_sdk_product.zip" = "sha256-31qgieDI897sXtEf8ok2SdFgrlN57bwhT3FUfdofZi0=";
-    ios = {
-      "artifacts.zip" = "sha256-RicBTTBX5aIQwfcolDrKe0MVG9uTp56RYMWgR75AVEw=";
-    };
-    ios-profile = {
-      "artifacts.zip" = "sha256-6EXHvy36K+rRGpjt0GL/DyuOhpAGeaOrZAZvPZuLyys=";
-    };
-    ios-release = {
-      "Flutter.dSYM.zip" = "sha256-zYqlX4QhxnDb9LasMcBcPO/+30LCfVbwC+z+wZiiEqk=";
-      "artifacts.zip" = "sha256-DVpynf2LxU6CPC1BPQbi8OStcIwJKX55rDSWNiJ4KNk=";
-    };
-    linux-arm64 = {
-      "artifacts.zip" = "sha256-djesma+IqQZgGlxQj4Gv6hAkQhQKQp7Gsa1I4hksqNc=";
-      "font-subset.zip" = "sha256-Wo11dks0uhLI2nu+9QJ7aLmvfsPcuqvcmquak4qv5XM=";
-    };
-    linux-arm64-debug = {
-      "linux-arm64-flutter-gtk.zip" = "sha256-6T2Ycxe3GTVnFGfBFfXLZwPklIndQ6hojnCSnMeXJso=";
-    };
-    linux-arm64-profile = {
-      "linux-arm64-flutter-gtk.zip" = "sha256-ycInFHuRu7r+50GsoFR4v/rIRiAQaQ9zFemd2d9AnpQ=";
-    };
-    linux-arm64-release = {
-      "linux-arm64-flutter-gtk.zip" = "sha256-J60MU8pHDVL9DyX5A3YdCRkKXnTgvALhHiEzYiPSSuA=";
-    };
-    linux-x64 = {
-      "artifacts.zip" = "sha256-ZUMRJ0dzaeRQUYy5S7gDLWa3w9CVhNPORN9l+lwxAMs=";
-      "font-subset.zip" = "sha256-pmtHAgIj5tXzUsDrrxB5JwfLDNzMCqouUCOyYN5BOEQ=";
-    };
-    linux-x64-debug = {
-      "linux-x64-flutter-gtk.zip" = "sha256-otmghZAiUlpLYfFaWd18UWlfctKcYsMRBMP78ZyBj/E=";
-    };
-    linux-x64-profile = {
-      "linux-x64-flutter-gtk.zip" = "sha256-bT6xMYlwTB9JOV1790cJqTSEXYstdI4sZCQzFzcpa5s=";
-    };
-    linux-x64-release = {
-      "linux-x64-flutter-gtk.zip" = "sha256-E8Eogr0nD7yaxjuoNhpvF4tTx9N53y3iOkI71Eqx5Ko=";
-    };
-  };
-}
-
diff --git a/pkgs/development/compilers/flutter/flutter-tools.nix b/pkgs/development/compilers/flutter/flutter-tools.nix
new file mode 100644
index 000000000000..0aedd174e2ed
--- /dev/null
+++ b/pkgs/development/compilers/flutter/flutter-tools.nix
@@ -0,0 +1,51 @@
+{ hostPlatform
+, buildDartApplication
+, git
+, which
+, dart
+, version
+, flutterSrc
+, patches ? [ ]
+, pubspecLockFile
+, vendorHash
+, depsListFile
+}:
+
+buildDartApplication.override { inherit dart; } rec {
+  pname = "flutter-tools";
+  inherit version;
+  dartOutputType = "jit-snapshot";
+
+  src = flutterSrc;
+  sourceRoot = "source/packages/flutter_tools";
+  postUnpack = ''chmod -R u+w "$NIX_BUILD_TOP/source"'';
+
+  inherit patches;
+  # The given patches are made for the entire SDK source tree.
+  prePatch = ''pushd "$NIX_BUILD_TOP/source"'';
+  postPatch = ''popd'';
+
+  # When the JIT snapshot is being built, the application needs to run.
+  # It attempts to generate configuration files, and relies on a few external
+  # tools.
+  nativeBuildInputs = [ git which ];
+  preConfigure = ''
+    export HOME=.
+    export FLUTTER_ROOT="$NIX_BUILD_TOP/source"
+    mkdir -p "$FLUTTER_ROOT/bin/cache"
+    ln -s '${dart}' "$FLUTTER_ROOT/bin/cache/dart-sdk"
+  '';
+
+  dartEntryPoints."flutter_tools.snapshot" = "bin/flutter_tools.dart";
+  dartCompileFlags = [ "--define=NIX_FLUTTER_HOST_PLATFORM=${hostPlatform.system}" ];
+
+  # The Dart wrapper launchers are useless for the Flutter tool - it is designed
+  # to be launched from a snapshot by the SDK.
+  postInstall = ''
+    pushd "$out"
+    rm ${builtins.concatStringsSep " " (builtins.attrNames dartEntryPoints)}
+    popd
+  '';
+
+  inherit pubspecLockFile vendorHash depsListFile;
+}
diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
index da45fee420d0..69efe678dc5a 100644
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@@ -3,23 +3,33 @@
 , patches
 , dart
 , src
+, pubspecLockFile
+, vendorHash
+, depsListFile
 , lib
 , stdenv
+, callPackage
+, makeWrapper
 , darwin
 , git
 , which
 }:
 
 let
+  tools = callPackage ./flutter-tools.nix {
+    inherit dart version;
+    flutterSrc = src;
+    inherit patches;
+    inherit pubspecLockFile vendorHash depsListFile;
+  };
+
   unwrapped =
     stdenv.mkDerivation {
       name = "flutter-${version}-unwrapped";
       inherit src patches version;
 
-      outputs = [ "out" "cache" ];
-
       buildInputs = [ git ];
-      nativeBuildInputs = [ ]
+      nativeBuildInputs = [ makeWrapper ]
         ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ];
 
       preConfigure = ''
@@ -34,46 +44,31 @@ let
       '';
 
       buildPhase = ''
-        export FLUTTER_ROOT="$(pwd)"
-        export FLUTTER_TOOLS_DIR="$FLUTTER_ROOT/packages/flutter_tools"
-        export SCRIPT_PATH="$FLUTTER_TOOLS_DIR/bin/flutter_tools.dart"
+        # The flutter_tools package tries to run many Git commands. In most
+        # cases, unexpected output is handled gracefully, but commands are never
+        # expected to fail completely. A blank repository needs to be created.
+        rm -rf .git # Remove any existing Git directory
+        git init -b nixpkgs
+        GIT_AUTHOR_NAME=Nixpkgs GIT_COMMITTER_NAME=Nixpkgs \
+        GIT_AUTHOR_EMAIL= GIT_COMMITTER_EMAIL= \
+        GIT_AUTHOR_DATE='1/1/1970 00:00:00 +0000' GIT_COMMITTER_DATE='1/1/1970 00:00:00 +0000' \
+          git commit --allow-empty -m "Initial commit"
+        (. '${../../../build-support/fetchgit/deterministic-git}'; make_deterministic_repo .)
 
-        export SNAPSHOT_PATH="$FLUTTER_ROOT/bin/cache/flutter_tools.snapshot"
-        export STAMP_PATH="$FLUTTER_ROOT/bin/cache/flutter_tools.stamp"
+        mkdir -p bin/cache
 
-        export DART_SDK_PATH="${dart}"
+        # Add a flutter_tools artifact stamp, and build a snapshot.
+        # This is the Flutter CLI application.
+        echo "$(git rev-parse HEAD)" > bin/cache/flutter_tools.stamp
+        ln -s '${tools}/share/flutter_tools.snapshot' bin/cache/flutter_tools.snapshot
 
-        # The Flutter tool compilation requires dependencies to be cached, as there is no Internet access.
-        # Dart expects package caches to be mutable, and does not support composing cache directories.
-        # The packages cached during the build therefore cannot be easily used. They are provided through
-        # the derivation's "cache" output, though, in case they are needed.
-        #
-        # Note that non-cached packages will normally be fetched from the Internet when they are needed, so Flutter
-        # will function without an existing package cache as long as it has an Internet connection.
-        export PUB_CACHE="$cache"
+        # Some of flutter_tools's dependencies contain static assets. The
+        # application attempts to read its own package_config.json to find these
+        # assets at runtime.
+        mkdir -p packages/flutter_tools/.dart_tool
+        ln -s '${tools.dartDeps.packageConfig}' packages/flutter_tools/.dart_tool/package_config.json
 
-        if [ -d .pub-preload-cache ]; then
-          ${dart}/bin/dart pub cache preload .pub-preload-cache/*
-        elif [ -d .pub-cache ]; then
-          mv .pub-cache "$PUB_CACHE"
-        else
-          echo 'ERROR: Failed to locate the Dart package cache required to build the Flutter tool.'
-          exit 1
-        fi
-
-        pushd "$FLUTTER_TOOLS_DIR"
-        ${dart}/bin/dart pub get --offline
-        popd
-
-        local revision="$(cd "$FLUTTER_ROOT"; git rev-parse HEAD)"
-        ${dart}/bin/dart --snapshot="$SNAPSHOT_PATH" --packages="$FLUTTER_TOOLS_DIR/.dart_tool/package_config.json" "$SCRIPT_PATH"
-        echo "$revision" > "$STAMP_PATH"
         echo -n "${version}" > version
-
-        # Certain prebuilts should be replaced with Nix-built (or at least Nix-patched) equivalents.
-        rm -r \
-          $FLUTTER_ROOT/bin/cache/dart-sdk \
-          $FLUTTER_ROOT/bin/cache/artifacts/engine
       '';
 
       installPhase = ''
@@ -81,8 +76,19 @@ let
 
         mkdir -p $out
         cp -r . $out
+        rm -rf $out/bin/cache/dart-sdk
         ln -sf ${dart} $out/bin/cache/dart-sdk
 
+        # The regular launchers are designed to download/build/update SDK
+        # components, and are not very useful in Nix.
+        # Replace them with simple links and wrappers.
+        rm "$out/bin"/{dart,flutter}
+        ln -s "$out/bin/cache/dart-sdk/bin/dart" "$out/bin/dart"
+        makeShellWrapper "$out/bin/dart" "$out/bin/flutter" \
+          --set-default FLUTTER_ROOT "$out" \
+          --set FLUTTER_ALREADY_LOCKED true \
+          --add-flags "--disable-dart-dev \$NIX_FLUTTER_TOOLS_VM_OPTIONS $out/bin/cache/flutter_tools.snapshot"
+
         runHook postInstall
       '';
 
@@ -95,13 +101,13 @@ let
         export HOME="$(mktemp -d)"
         $out/bin/flutter config --android-studio-dir $HOME
         $out/bin/flutter config --android-sdk $HOME
-        $out/bin/flutter --version | fgrep -q '${version}'
+        $out/bin/flutter --version | fgrep -q '${builtins.substring 0 10 engineVersion}'
 
         runHook postInstallCheck
       '';
 
       passthru = {
-        inherit dart engineVersion;
+        inherit dart engineVersion tools;
         # The derivation containing the original Flutter SDK files.
         # When other derivations wrap this one, any unmodified files
         # found here should be included as-is, for tooling compatibility.
@@ -116,7 +122,7 @@ let
         '';
         homepage = "https://flutter.dev";
         license = licenses.bsd3;
-        platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+        platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
         maintainers = with maintainers; [ babariviere ericdallo FlafyDev hacker1024 ];
       };
     };
diff --git a/pkgs/development/compilers/flutter/lockfiles/stable/deps.json b/pkgs/development/compilers/flutter/lockfiles/stable/deps.json
new file mode 100644
index 000000000000..30924f7d513b
--- /dev/null
+++ b/pkgs/development/compilers/flutter/lockfiles/stable/deps.json
@@ -0,0 +1,1020 @@
+[
+  {
+    "name": "flutter_tools",
+    "version": "0.0.0",
+    "kind": "root",
+    "source": "root",
+    "dependencies": [
+      "archive",
+      "args",
+      "browser_launcher",
+      "dds",
+      "dwds",
+      "completion",
+      "coverage",
+      "crypto",
+      "file",
+      "flutter_template_images",
+      "html",
+      "http",
+      "intl",
+      "meta",
+      "multicast_dns",
+      "mustache_template",
+      "package_config",
+      "process",
+      "fake_async",
+      "stack_trace",
+      "usage",
+      "webdriver",
+      "webkit_inspection_protocol",
+      "xml",
+      "yaml",
+      "native_stack_traces",
+      "shelf",
+      "vm_snapshot_analysis",
+      "uuid",
+      "web_socket_channel",
+      "stream_channel",
+      "shelf_web_socket",
+      "shelf_static",
+      "pub_semver",
+      "pool",
+      "path",
+      "mime",
+      "logging",
+      "http_multi_server",
+      "convert",
+      "async",
+      "unified_analytics",
+      "test_api",
+      "test_core",
+      "vm_service",
+      "standard_message_codec",
+      "_fe_analyzer_shared",
+      "analyzer",
+      "boolean_selector",
+      "built_collection",
+      "built_value",
+      "clock",
+      "csslib",
+      "dap",
+      "dds_service_extensions",
+      "devtools_shared",
+      "fixnum",
+      "frontend_server_client",
+      "glob",
+      "http_parser",
+      "io",
+      "js",
+      "json_rpc_2",
+      "matcher",
+      "petitparser",
+      "platform",
+      "shelf_packages_handler",
+      "shelf_proxy",
+      "source_map_stack_trace",
+      "source_maps",
+      "source_span",
+      "sse",
+      "string_scanner",
+      "sync_http",
+      "term_glyph",
+      "typed_data",
+      "watcher",
+      "collection",
+      "file_testing",
+      "pubspec_parse",
+      "checked_yaml",
+      "json_annotation",
+      "node_preamble",
+      "test"
+    ]
+  },
+  {
+    "name": "test",
+    "version": "1.24.3",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "boolean_selector",
+      "collection",
+      "coverage",
+      "http_multi_server",
+      "io",
+      "js",
+      "node_preamble",
+      "package_config",
+      "path",
+      "pool",
+      "shelf",
+      "shelf_packages_handler",
+      "shelf_static",
+      "shelf_web_socket",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "typed_data",
+      "web_socket_channel",
+      "webkit_inspection_protocol",
+      "yaml",
+      "test_api",
+      "test_core",
+      "matcher"
+    ]
+  },
+  {
+    "name": "matcher",
+    "version": "0.12.16",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "meta",
+      "stack_trace",
+      "term_glyph",
+      "test_api"
+    ]
+  },
+  {
+    "name": "test_api",
+    "version": "0.6.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "boolean_selector",
+      "collection",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "term_glyph",
+    "version": "1.2.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "string_scanner",
+    "version": "1.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_span",
+    "version": "1.10.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "path",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "path",
+    "version": "1.8.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "collection",
+    "version": "1.17.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "stream_channel",
+    "version": "2.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "async",
+    "version": "2.11.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "meta",
+    "version": "1.9.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "stack_trace",
+    "version": "1.11.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "boolean_selector",
+    "version": "2.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "test_core",
+    "version": "0.5.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "args",
+      "boolean_selector",
+      "collection",
+      "coverage",
+      "frontend_server_client",
+      "glob",
+      "io",
+      "meta",
+      "package_config",
+      "path",
+      "pool",
+      "source_map_stack_trace",
+      "source_maps",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "vm_service",
+      "yaml",
+      "test_api"
+    ]
+  },
+  {
+    "name": "yaml",
+    "version": "3.1.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "vm_service",
+    "version": "11.7.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "source_maps",
+    "version": "0.10.12",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_map_stack_trace",
+    "version": "2.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "source_maps",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "pool",
+    "version": "1.5.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "package_config",
+    "version": "2.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "io",
+    "version": "1.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "glob",
+    "version": "2.1.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "file",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "file",
+    "version": "6.1.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "frontend_server_client",
+    "version": "3.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "coverage",
+    "version": "1.6.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "logging",
+      "package_config",
+      "path",
+      "source_maps",
+      "stack_trace",
+      "vm_service"
+    ]
+  },
+  {
+    "name": "logging",
+    "version": "1.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "args",
+    "version": "2.4.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "analyzer",
+    "version": "5.13.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "_fe_analyzer_shared",
+      "collection",
+      "convert",
+      "crypto",
+      "glob",
+      "meta",
+      "package_config",
+      "path",
+      "pub_semver",
+      "source_span",
+      "watcher",
+      "yaml"
+    ]
+  },
+  {
+    "name": "watcher",
+    "version": "1.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "pub_semver",
+    "version": "2.1.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "crypto",
+    "version": "3.0.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "typed_data",
+    "version": "1.3.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "convert",
+    "version": "3.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "_fe_analyzer_shared",
+    "version": "61.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "webkit_inspection_protocol",
+    "version": "1.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "logging"
+    ]
+  },
+  {
+    "name": "web_socket_channel",
+    "version": "2.4.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "crypto",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "shelf_web_socket",
+    "version": "1.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "shelf",
+      "stream_channel",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "shelf",
+    "version": "1.4.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "http_parser",
+      "path",
+      "stack_trace",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "http_parser",
+    "version": "4.0.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner",
+      "typed_data"
+    ]
+  },
+  {
+    "name": "shelf_static",
+    "version": "1.1.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "convert",
+      "http_parser",
+      "mime",
+      "path",
+      "shelf"
+    ]
+  },
+  {
+    "name": "mime",
+    "version": "1.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "shelf_packages_handler",
+    "version": "3.0.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "shelf",
+      "shelf_static"
+    ]
+  },
+  {
+    "name": "node_preamble",
+    "version": "2.0.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "js",
+    "version": "0.6.7",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "http_multi_server",
+    "version": "3.2.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "json_annotation",
+    "version": "4.8.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "checked_yaml",
+    "version": "2.0.3",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "json_annotation",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "pubspec_parse",
+    "version": "1.2.3",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "checked_yaml",
+      "collection",
+      "json_annotation",
+      "pub_semver",
+      "yaml"
+    ]
+  },
+  {
+    "name": "file_testing",
+    "version": "3.0.0",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "test"
+    ]
+  },
+  {
+    "name": "sync_http",
+    "version": "0.3.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "sse",
+    "version": "4.1.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "js",
+      "logging",
+      "pool",
+      "shelf",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "shelf_proxy",
+    "version": "1.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "http",
+      "path",
+      "shelf"
+    ]
+  },
+  {
+    "name": "http",
+    "version": "0.13.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "http_parser",
+      "meta"
+    ]
+  },
+  {
+    "name": "platform",
+    "version": "3.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "petitparser",
+    "version": "5.4.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "json_rpc_2",
+    "version": "3.0.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "stack_trace",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "fixnum",
+    "version": "1.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "devtools_shared",
+    "version": "2.24.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "shelf",
+      "usage",
+      "vm_service",
+      "webkit_inspection_protocol"
+    ]
+  },
+  {
+    "name": "usage",
+    "version": "4.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "dds_service_extensions",
+    "version": "1.5.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "dap",
+      "vm_service"
+    ]
+  },
+  {
+    "name": "dap",
+    "version": "1.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "csslib",
+    "version": "1.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "clock",
+    "version": "1.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "built_value",
+    "version": "8.6.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "collection",
+      "fixnum",
+      "meta"
+    ]
+  },
+  {
+    "name": "built_collection",
+    "version": "5.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "standard_message_codec",
+    "version": "0.0.1+3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "unified_analytics",
+    "version": "2.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "file",
+      "http",
+      "intl",
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "intl",
+    "version": "0.18.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "uuid",
+    "version": "3.0.7",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "crypto"
+    ]
+  },
+  {
+    "name": "vm_snapshot_analysis",
+    "version": "0.7.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "collection",
+      "path"
+    ]
+  },
+  {
+    "name": "native_stack_traces",
+    "version": "0.5.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "path"
+    ]
+  },
+  {
+    "name": "xml",
+    "version": "6.3.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta",
+      "petitparser"
+    ]
+  },
+  {
+    "name": "webdriver",
+    "version": "3.0.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "matcher",
+      "path",
+      "stack_trace",
+      "sync_http"
+    ]
+  },
+  {
+    "name": "fake_async",
+    "version": "1.3.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "collection"
+    ]
+  },
+  {
+    "name": "process",
+    "version": "4.2.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "file",
+      "path",
+      "platform"
+    ]
+  },
+  {
+    "name": "mustache_template",
+    "version": "2.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "multicast_dns",
+    "version": "0.3.2+3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "html",
+    "version": "0.15.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "csslib",
+      "source_span"
+    ]
+  },
+  {
+    "name": "flutter_template_images",
+    "version": "4.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "completion",
+    "version": "1.0.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "logging",
+      "path"
+    ]
+  },
+  {
+    "name": "dwds",
+    "version": "19.0.1+1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "built_collection",
+      "built_value",
+      "collection",
+      "crypto",
+      "dds",
+      "file",
+      "http",
+      "http_multi_server",
+      "logging",
+      "meta",
+      "package_config",
+      "path",
+      "pool",
+      "pub_semver",
+      "shelf",
+      "shelf_packages_handler",
+      "shelf_proxy",
+      "shelf_static",
+      "shelf_web_socket",
+      "source_maps",
+      "stack_trace",
+      "sse",
+      "uuid",
+      "vm_service",
+      "web_socket_channel",
+      "webkit_inspection_protocol"
+    ]
+  },
+  {
+    "name": "dds",
+    "version": "2.9.0+hotfix",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "async",
+      "browser_launcher",
+      "collection",
+      "dds_service_extensions",
+      "dap",
+      "devtools_shared",
+      "http_multi_server",
+      "json_rpc_2",
+      "meta",
+      "path",
+      "shelf_proxy",
+      "shelf_static",
+      "shelf_web_socket",
+      "shelf",
+      "sse",
+      "stack_trace",
+      "stream_channel",
+      "vm_service",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "browser_launcher",
+    "version": "1.1.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "webkit_inspection_protocol"
+    ]
+  },
+  {
+    "name": "archive",
+    "version": "3.3.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "crypto",
+      "path"
+    ]
+  }
+]
diff --git a/pkgs/development/compilers/flutter/lockfiles/stable/pubspec.lock b/pkgs/development/compilers/flutter/lockfiles/stable/pubspec.lock
new file mode 100644
index 000000000000..8b11ae73ee03
--- /dev/null
+++ b/pkgs/development/compilers/flutter/lockfiles/stable/pubspec.lock
@@ -0,0 +1,677 @@
+# Generated by pub
+# See https://dart.dev/tools/pub/glossary#lockfile
+packages:
+  _fe_analyzer_shared:
+    dependency: "direct main"
+    description:
+      name: _fe_analyzer_shared
+      sha256: ae92f5d747aee634b87f89d9946000c2de774be1d6ac3e58268224348cd0101a
+      url: "https://pub.dev"
+    source: hosted
+    version: "61.0.0"
+  analyzer:
+    dependency: "direct main"
+    description:
+      name: analyzer
+      sha256: ea3d8652bda62982addfd92fdc2d0214e5f82e43325104990d4f4c4a2a313562
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.13.0"
+  archive:
+    dependency: "direct main"
+    description:
+      name: archive
+      sha256: "80e5141fafcb3361653ce308776cfd7d45e6e9fbb429e14eec571382c0c5fecb"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.3.2"
+  args:
+    dependency: "direct main"
+    description:
+      name: args
+      sha256: eef6c46b622e0494a36c5a12d10d77fb4e855501a91c1b9ef9339326e58f0596
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.2"
+  async:
+    dependency: "direct main"
+    description:
+      name: async
+      sha256: "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.11.0"
+  boolean_selector:
+    dependency: "direct main"
+    description:
+      name: boolean_selector
+      sha256: "6cfb5af12253eaf2b368f07bacc5a80d1301a071c73360d746b7f2e32d762c66"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  browser_launcher:
+    dependency: "direct main"
+    description:
+      name: browser_launcher
+      sha256: "6ee4c6b1f68a42e769ef6e663c4f56708522f7bce9d2ab6e308a37b612ffa4ec"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
+  built_collection:
+    dependency: "direct main"
+    description:
+      name: built_collection
+      sha256: "376e3dd27b51ea877c28d525560790aee2e6fbb5f20e2f85d5081027d94e2100"
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.1.1"
+  built_value:
+    dependency: "direct main"
+    description:
+      name: built_value
+      sha256: "598a2a682e2a7a90f08ba39c0aaa9374c5112340f0a2e275f61b59389543d166"
+      url: "https://pub.dev"
+    source: hosted
+    version: "8.6.1"
+  checked_yaml:
+    dependency: "direct dev"
+    description:
+      name: checked_yaml
+      sha256: feb6bed21949061731a7a75fc5d2aa727cf160b91af9a3e464c5e3a32e28b5ff
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.3"
+  clock:
+    dependency: "direct main"
+    description:
+      name: clock
+      sha256: cb6d7f03e1de671e34607e909a7213e31d7752be4fb66a86d29fe1eb14bfb5cf
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
+  collection:
+    dependency: "direct dev"
+    description:
+      name: collection
+      sha256: f092b211a4319e98e5ff58223576de6c2803db36221657b46c82574721240687
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.17.2"
+  completion:
+    dependency: "direct main"
+    description:
+      name: completion
+      sha256: f11b7a628e6c42b9edc9b0bc3aa490e2d930397546d2f794e8e1325909d11c60
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.1"
+  convert:
+    dependency: "direct main"
+    description:
+      name: convert
+      sha256: "0f08b14755d163f6e2134cb58222dd25ea2a2ee8a195e53983d57c075324d592"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.1"
+  coverage:
+    dependency: "direct main"
+    description:
+      name: coverage
+      sha256: "2fb815080e44a09b85e0f2ca8a820b15053982b2e714b59267719e8a9ff17097"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.6.3"
+  crypto:
+    dependency: "direct main"
+    description:
+      name: crypto
+      sha256: ff625774173754681d66daaf4a448684fb04b78f902da9cb3d308c19cc5e8bab
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.3"
+  csslib:
+    dependency: "direct main"
+    description:
+      name: csslib
+      sha256: "706b5707578e0c1b4b7550f64078f0a0f19dec3f50a178ffae7006b0a9ca58fb"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
+  dap:
+    dependency: "direct main"
+    description:
+      name: dap
+      sha256: "2120d4a8cbad45e5dbd518b713e8f064274e0a4c0e3edcaef1f4cf9ccbc90cd9"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
+  dds:
+    dependency: "direct main"
+    description:
+      name: dds
+      sha256: "397c3c80919ee187b2efc28205af3c0378b6b757ea6d059083dece145a2e31e9"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.9.0+hotfix"
+  dds_service_extensions:
+    dependency: "direct main"
+    description:
+      name: dds_service_extensions
+      sha256: "9ac669bef49a4c13ed62073685089be121200fb213800ec59c202e90d569ea44"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.5.0"
+  devtools_shared:
+    dependency: "direct main"
+    description:
+      name: devtools_shared
+      sha256: ad58ac3a5df41adf08d0d6f0a4d73349533edcc383ee93a30ac3d0fd0bb6df49
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.24.0"
+  dwds:
+    dependency: "direct main"
+    description:
+      name: dwds
+      sha256: b6dad73ae56f00bff7647f531b9db018005f713328e816e7a277b544184e9170
+      url: "https://pub.dev"
+    source: hosted
+    version: "19.0.1+1"
+  fake_async:
+    dependency: "direct main"
+    description:
+      name: fake_async
+      sha256: "511392330127add0b769b75a987850d136345d9227c6b94c96a04cf4a391bf78"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.1"
+  file:
+    dependency: "direct main"
+    description:
+      name: file
+      sha256: "1b92bec4fc2a72f59a8e15af5f52cd441e4a7860b49499d69dfa817af20e925d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.1.4"
+  file_testing:
+    dependency: "direct dev"
+    description:
+      name: file_testing
+      sha256: "0aaadb4025bd350403f4308ad6c4cea953278d9407814b8342558e4946840fb5"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.0"
+  fixnum:
+    dependency: "direct main"
+    description:
+      name: fixnum
+      sha256: "25517a4deb0c03aa0f32fd12db525856438902d9c16536311e76cdc57b31d7d1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.0"
+  flutter_template_images:
+    dependency: "direct main"
+    description:
+      name: flutter_template_images
+      sha256: fd3e55af73c577b9e3f88d4080d3e366cb5c8ef3fbd50b94dfeca56bb0235df6
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.2.0"
+  frontend_server_client:
+    dependency: "direct main"
+    description:
+      name: frontend_server_client
+      sha256: "408e3ca148b31c20282ad6f37ebfa6f4bdc8fede5b74bc2f08d9d92b55db3612"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.0"
+  glob:
+    dependency: "direct main"
+    description:
+      name: glob
+      sha256: "0e7014b3b7d4dac1ca4d6114f82bf1782ee86745b9b42a92c9289c23d8a0ab63"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.2"
+  html:
+    dependency: "direct main"
+    description:
+      name: html
+      sha256: "3a7812d5bcd2894edf53dfaf8cd640876cf6cef50a8f238745c8b8120ea74d3a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.15.4"
+  http:
+    dependency: "direct main"
+    description:
+      name: http
+      sha256: "5895291c13fa8a3bd82e76d5627f69e0d85ca6a30dcac95c4ea19a5d555879c2"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.13.6"
+  http_multi_server:
+    dependency: "direct main"
+    description:
+      name: http_multi_server
+      sha256: "97486f20f9c2f7be8f514851703d0119c3596d14ea63227af6f7a481ef2b2f8b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.1"
+  http_parser:
+    dependency: "direct main"
+    description:
+      name: http_parser
+      sha256: "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.0.2"
+  intl:
+    dependency: "direct main"
+    description:
+      name: intl
+      sha256: "3bc132a9dbce73a7e4a21a17d06e1878839ffbf975568bc875c60537824b0c4d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.18.1"
+  io:
+    dependency: "direct main"
+    description:
+      name: io
+      sha256: "2ec25704aba361659e10e3e5f5d672068d332fc8ac516421d483a11e5cbd061e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  js:
+    dependency: "direct main"
+    description:
+      name: js
+      sha256: f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.7"
+  json_annotation:
+    dependency: "direct dev"
+    description:
+      name: json_annotation
+      sha256: b10a7b2ff83d83c777edba3c6a0f97045ddadd56c944e1a23a3fdf43a1bf4467
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.8.1"
+  json_rpc_2:
+    dependency: "direct main"
+    description:
+      name: json_rpc_2
+      sha256: "5e469bffa23899edacb7b22787780068d650b106a21c76db3c49218ab7ca447e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.2"
+  logging:
+    dependency: "direct main"
+    description:
+      name: logging
+      sha256: "623a88c9594aa774443aa3eb2d41807a48486b5613e67599fb4c41c0ad47c340"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.0"
+  matcher:
+    dependency: "direct main"
+    description:
+      name: matcher
+      sha256: "1803e76e6653768d64ed8ff2e1e67bea3ad4b923eb5c56a295c3e634bad5960e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.12.16"
+  meta:
+    dependency: "direct main"
+    description:
+      name: meta
+      sha256: "3c74dbf8763d36539f114c799d8a2d87343b5067e9d796ca22b5eb8437090ee3"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.9.1"
+  mime:
+    dependency: "direct main"
+    description:
+      name: mime
+      sha256: e4ff8e8564c03f255408decd16e7899da1733852a9110a58fe6d1b817684a63e
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  multicast_dns:
+    dependency: "direct main"
+    description:
+      name: multicast_dns
+      sha256: "80e54aba906a7cc68fdc6a201e76b135af27155e2f8e958181d85e2b73786591"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.2+3"
+  mustache_template:
+    dependency: "direct main"
+    description:
+      name: mustache_template
+      sha256: a46e26f91445bfb0b60519be280555b06792460b27b19e2b19ad5b9740df5d1c
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.0"
+  native_stack_traces:
+    dependency: "direct main"
+    description:
+      name: native_stack_traces
+      sha256: c797830b9910d13b0f4e70ddef15cde034214fe3bdb8092c4ea5ffad2f74013f
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.5.6"
+  node_preamble:
+    dependency: "direct dev"
+    description:
+      name: node_preamble
+      sha256: "6e7eac89047ab8a8d26cf16127b5ed26de65209847630400f9aefd7cd5c730db"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.2"
+  package_config:
+    dependency: "direct main"
+    description:
+      name: package_config
+      sha256: "1c5b77ccc91e4823a5af61ee74e6b972db1ef98c2ff5a18d3161c982a55448bd"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
+  path:
+    dependency: "direct main"
+    description:
+      name: path
+      sha256: "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.8.3"
+  petitparser:
+    dependency: "direct main"
+    description:
+      name: petitparser
+      sha256: cb3798bef7fc021ac45b308f4b51208a152792445cce0448c9a4ba5879dd8750
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.4.0"
+  platform:
+    dependency: "direct main"
+    description:
+      name: platform
+      sha256: "4a451831508d7d6ca779f7ac6e212b4023dd5a7d08a27a63da33756410e32b76"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.0"
+  pool:
+    dependency: "direct main"
+    description:
+      name: pool
+      sha256: "20fe868b6314b322ea036ba325e6fc0711a22948856475e2c2b6306e8ab39c2a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.5.1"
+  process:
+    dependency: "direct main"
+    description:
+      name: process
+      sha256: "53fd8db9cec1d37b0574e12f07520d582019cb6c44abf5479a01505099a34a09"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.2.4"
+  pub_semver:
+    dependency: "direct main"
+    description:
+      name: pub_semver
+      sha256: "40d3ab1bbd474c4c2328c91e3a7df8c6dd629b79ece4c4bd04bee496a224fb0c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.4"
+  pubspec_parse:
+    dependency: "direct dev"
+    description:
+      name: pubspec_parse
+      sha256: c63b2876e58e194e4b0828fcb080ad0e06d051cb607a6be51a9e084f47cb9367
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.3"
+  shelf:
+    dependency: "direct main"
+    description:
+      name: shelf
+      sha256: ad29c505aee705f41a4d8963641f91ac4cee3c8fad5947e033390a7bd8180fa4
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.4.1"
+  shelf_packages_handler:
+    dependency: "direct main"
+    description:
+      name: shelf_packages_handler
+      sha256: "89f967eca29607c933ba9571d838be31d67f53f6e4ee15147d5dc2934fee1b1e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.2"
+  shelf_proxy:
+    dependency: "direct main"
+    description:
+      name: shelf_proxy
+      sha256: a71d2307f4393211930c590c3d2c00630f6c5a7a77edc1ef6436dfd85a6a7ee3
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  shelf_static:
+    dependency: "direct main"
+    description:
+      name: shelf_static
+      sha256: a41d3f53c4adf0f57480578c1d61d90342cd617de7fc8077b1304643c2d85c1e
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.2"
+  shelf_web_socket:
+    dependency: "direct main"
+    description:
+      name: shelf_web_socket
+      sha256: "9ca081be41c60190ebcb4766b2486a7d50261db7bd0f5d9615f2d653637a84c1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  source_map_stack_trace:
+    dependency: "direct main"
+    description:
+      name: source_map_stack_trace
+      sha256: "84cf769ad83aa6bb61e0aa5a18e53aea683395f196a6f39c4c881fb90ed4f7ae"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  source_maps:
+    dependency: "direct main"
+    description:
+      name: source_maps
+      sha256: "708b3f6b97248e5781f493b765c3337db11c5d2c81c3094f10904bfa8004c703"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.10.12"
+  source_span:
+    dependency: "direct main"
+    description:
+      name: source_span
+      sha256: "53e943d4206a5e30df338fd4c6e7a077e02254531b138a15aec3bd143c1a8b3c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.10.0"
+  sse:
+    dependency: "direct main"
+    description:
+      name: sse
+      sha256: "3ff9088cac3f45aa8b91336f1962e3ea6c81baaba0bbba361c05f8aa7fb59442"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.1.2"
+  stack_trace:
+    dependency: "direct main"
+    description:
+      name: stack_trace
+      sha256: c3c7d8edb15bee7f0f74debd4b9c5f3c2ea86766fe4178eb2a18eb30a0bdaed5
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.11.0"
+  standard_message_codec:
+    dependency: "direct main"
+    description:
+      name: standard_message_codec
+      sha256: "906e66549f0ea90d87c5320e0b0f04738c5d14bc7fb121a15da31b60e84f5b15"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.0.1+3"
+  stream_channel:
+    dependency: "direct main"
+    description:
+      name: stream_channel
+      sha256: "83615bee9045c1d322bbbd1ba209b7a749c2cbcdcb3fdd1df8eb488b3279c1c8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  string_scanner:
+    dependency: "direct main"
+    description:
+      name: string_scanner
+      sha256: "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.0"
+  sync_http:
+    dependency: "direct main"
+    description:
+      name: sync_http
+      sha256: "7f0cd72eca000d2e026bcd6f990b81d0ca06022ef4e32fb257b30d3d1014a961"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.1"
+  term_glyph:
+    dependency: "direct main"
+    description:
+      name: term_glyph
+      sha256: a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.1"
+  test:
+    dependency: "direct dev"
+    description:
+      name: test
+      sha256: "13b41f318e2a5751c3169137103b60c584297353d4b1761b66029bae6411fe46"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.24.3"
+  test_api:
+    dependency: "direct main"
+    description:
+      name: test_api
+      sha256: "75760ffd7786fffdfb9597c35c5b27eaeec82be8edfb6d71d32651128ed7aab8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.0"
+  test_core:
+    dependency: "direct main"
+    description:
+      name: test_core
+      sha256: "99806e9e6d95c7b059b7a0fc08f07fc53fabe54a829497f0d9676299f1e8637e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.5.3"
+  typed_data:
+    dependency: "direct main"
+    description:
+      name: typed_data
+      sha256: facc8d6582f16042dd49f2463ff1bd6e2c9ef9f3d5da3d9b087e244a7b564b3c
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.2"
+  unified_analytics:
+    dependency: "direct main"
+    description:
+      name: unified_analytics
+      sha256: "4f9f29e5fd357d68fce270e37c7ad9bb489ee20098529199d6bc786b2b624298"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.0"
+  usage:
+    dependency: "direct main"
+    description:
+      name: usage
+      sha256: "0bdbde65a6e710343d02a56552eeaefd20b735e04bfb6b3ee025b6b22e8d0e15"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.1.1"
+  uuid:
+    dependency: "direct main"
+    description:
+      name: uuid
+      sha256: "648e103079f7c64a36dc7d39369cabb358d377078a051d6ae2ad3aa539519313"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.7"
+  vm_service:
+    dependency: "direct main"
+    description:
+      name: vm_service
+      sha256: c620a6f783fa22436da68e42db7ebbf18b8c44b9a46ab911f666ff09ffd9153f
+      url: "https://pub.dev"
+    source: hosted
+    version: "11.7.1"
+  vm_snapshot_analysis:
+    dependency: "direct main"
+    description:
+      name: vm_snapshot_analysis
+      sha256: "5a79b9fbb6be2555090f55b03b23907e75d44c3fd7bdd88da09848aa5a1914c8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.7.6"
+  watcher:
+    dependency: "direct main"
+    description:
+      name: watcher
+      sha256: "3d2ad6751b3c16cf07c7fca317a1413b3f26530319181b37e3b9039b84fc01d8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.0"
+  web_socket_channel:
+    dependency: "direct main"
+    description:
+      name: web_socket_channel
+      sha256: d88238e5eac9a42bb43ca4e721edba3c08c6354d4a53063afaa568516217621b
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.0"
+  webdriver:
+    dependency: "direct main"
+    description:
+      name: webdriver
+      sha256: "3c923e918918feeb90c4c9fdf1fe39220fa4c0e8e2c0fffaded174498ef86c49"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.2"
+  webkit_inspection_protocol:
+    dependency: "direct main"
+    description:
+      name: webkit_inspection_protocol
+      sha256: "67d3a8b6c79e1987d19d848b0892e582dbb0c66c57cc1fef58a177dd2aa2823d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.0"
+  xml:
+    dependency: "direct main"
+    description:
+      name: xml
+      sha256: "5bc72e1e45e941d825fd7468b9b4cc3b9327942649aeb6fc5cdbf135f0a86e84"
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.3.0"
+  yaml:
+    dependency: "direct main"
+    description:
+      name: yaml
+      sha256: "75769501ea3489fca56601ff33454fe45507ea3bfb014161abc3b43ae25989d5"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.2"
+sdks:
+  dart: ">=3.0.0 <4.0.0"
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/deregister-pub-dependencies-artifact.patch b/pkgs/development/compilers/flutter/patches/flutter3/deregister-pub-dependencies-artifact.patch
new file mode 100644
index 000000000000..01e34c6d292c
--- /dev/null
+++ b/pkgs/development/compilers/flutter/patches/flutter3/deregister-pub-dependencies-artifact.patch
@@ -0,0 +1,19 @@
+diff --git a/packages/flutter_tools/lib/src/flutter_cache.dart b/packages/flutter_tools/lib/src/flutter_cache.dart
+index 252021cf78..e50ef0885d 100644
+--- a/packages/flutter_tools/lib/src/flutter_cache.dart
++++ b/packages/flutter_tools/lib/src/flutter_cache.dart
+@@ -51,14 +51,6 @@ class FlutterCache extends Cache {
+       registerArtifact(IosUsbArtifacts(artifactName, this, platform: platform));
+     }
+     registerArtifact(FontSubsetArtifacts(this, platform: platform));
+-    registerArtifact(PubDependencies(
+-      logger: logger,
+-      // flutter root and pub must be lazily initialized to avoid accessing
+-      // before the version is determined.
+-      flutterRoot: () => Cache.flutterRoot!,
+-      pub: () => pub,
+-      projectFactory: projectFactory,
+-    ));
+   }
+ }
+ 
\ No newline at end of file
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch b/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
index ceaf59b5f535..23a657e7c6a9 100644
--- a/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
+++ b/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
@@ -11,18 +11,19 @@ index 3532c23114..25dfcae4c7 100644
    BIN_NAME="$(basename "$PROG_NAME")"
    case "$BIN_NAME" in
      flutter*)
-diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
-index 13efbde879..467b3a7cbf 100644
---- a/packages/flutter_tools/lib/src/cache.dart
-+++ b/packages/flutter_tools/lib/src/cache.dart
-@@ -664,6 +664,7 @@ class Cache {
+diff --git a/packages/flutter_tools/lib/src/runner/flutter_command.dart b/packages/flutter_tools/lib/src/runner/flutter_command.dart
+index b7e624b4e2..edfdde118b 100644
+--- a/packages/flutter_tools/lib/src/runner/flutter_command.dart
++++ b/packages/flutter_tools/lib/src/runner/flutter_command.dart
+@@ -1554,7 +1554,7 @@ Run 'flutter -h' (or 'flutter <command> -h') for available flutter commands and
  
-   /// Update the cache to contain all `requiredArtifacts`.
-   Future<void> updateAll(Set<DevelopmentArtifact> requiredArtifacts, {bool offline = false}) async {
-+    return;
-     if (!_lockEnabled) {
-       return;
-     }
+     // Populate the cache. We call this before pub get below so that the
+     // sky_engine package is available in the flutter cache for pub to find.
+-    if (shouldUpdateCache) {
++    if (false) {
+       // First always update universal artifacts, as some of these (e.g.
+       // ios-deploy on macOS) are required to determine `requiredArtifacts`.
+       final bool offline;
 diff --git a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
 index 5d6d78639f..90a4dfa555 100644
 --- a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch b/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
deleted file mode 100644
index cc6e5e8f49e0..000000000000
--- a/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
-index dd80b1e46e..8e54517765 100644
---- a/packages/flutter_tools/lib/src/cache.dart
-+++ b/packages/flutter_tools/lib/src/cache.dart
-@@ -22,6 +22,7 @@ import 'base/user_messages.dart';
- import 'build_info.dart';
- import 'convert.dart';
- import 'features.dart';
-+import 'globals.dart' as globals;
- 
- const String kFlutterRootEnvironmentVariableName = 'FLUTTER_ROOT'; // should point to //flutter/ (root of flutter/flutter repo)
- const String kFlutterEngineEnvironmentVariableName = 'FLUTTER_ENGINE'; // should point to //engine/src/ (root of flutter/engine repo)
-@@ -318,8 +319,13 @@ class Cache {
-       return;
-     }
-     assert(_lock == null);
-+    final Directory dir = _fileSystem.directory(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter'));
-+    if (!dir.existsSync()) {
-+      dir.createSync(recursive: true);
-+      globals.os.chmod(dir, '755');
-+    }
-     final File lockFile =
--      _fileSystem.file(_fileSystem.path.join(flutterRoot!, 'bin', 'cache', 'lockfile'));
-+      _fileSystem.file(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'lockfile'));
-     try {
-       _lock = lockFile.openSync(mode: FileMode.write);
-     } on FileSystemException catch (e) {
-@@ -378,8 +384,7 @@ class Cache {
- 
-   String get devToolsVersion {
-     if (_devToolsVersion == null) {
--      const String devToolsDirPath = 'dart-sdk/bin/resources/devtools';
--      final Directory devToolsDir = getCacheDir(devToolsDirPath, shouldCreate: false);
-+      final Directory devToolsDir = _fileSystem.directory(_fileSystem.path.join(flutterRoot!, 'bin/cache/dart-sdk/bin/resources/devtools'));
-       if (!devToolsDir.existsSync()) {
-         throw Exception('Could not find directory at ${devToolsDir.path}');
-       }
-diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
-index 1c31c1b5db..76c7210d3b 100644
---- a/packages/flutter_tools/lib/src/cache.dart
-+++ b/packages/flutter_tools/lib/src/cache.dart
-@@ -529,6 +529,11 @@ class Cache {
- 
-   /// Return the top-level directory in the cache; this is `bin/cache`.
-   Directory getRoot() {
-+    const Platform platform = LocalPlatform();
-+    if (platform.environment.containsKey('FLUTTER_CACHE_DIR')) {
-+      return _fileSystem.directory(platform.environment['FLUTTER_CACHE_DIR']);
-+    }
-+
-     if (_rootOverride != null) {
-       return _fileSystem.directory(_fileSystem.path.join(_rootOverride!.path, 'bin', 'cache'));
-     } else {
diff --git a/pkgs/development/compilers/flutter/patches/flutter3/override-host-platform.patch b/pkgs/development/compilers/flutter/patches/flutter3/override-host-platform.patch
new file mode 100644
index 000000000000..51dcfdb5cc57
--- /dev/null
+++ b/pkgs/development/compilers/flutter/patches/flutter3/override-host-platform.patch
@@ -0,0 +1,21 @@
+diff --git a/packages/flutter_tools/lib/src/base/os.dart b/packages/flutter_tools/lib/src/base/os.dart
+index 1ce1951cef..1bd7602318 100644
+--- a/packages/flutter_tools/lib/src/base/os.dart
++++ b/packages/flutter_tools/lib/src/base/os.dart
+@@ -260,7 +260,15 @@ class _PosixUtils extends OperatingSystemUtils {
+   @override
+   String get pathVarSeparator => ':';
+ 
+-  HostPlatform? _hostPlatform;
++  // uname outputs build platform characteristics, not host platform characteristics.
++  // _MacOSUtils uses sysctl instead, which is still incorrect.
++  HostPlatform? _hostPlatform = switch (const String.fromEnvironment('NIX_FLUTTER_HOST_PLATFORM')) {
++    'x86_64-linux' => HostPlatform.linux_x64,
++    'aarch64-linux' => HostPlatform.linux_arm64,
++    'x86_64-darwin' => HostPlatform.darwin_x64,
++    'arm64-darwin' => HostPlatform.darwin_arm64,
++    String value => throw ArgumentError.value(value, 'NIX_FLUTTER_HOST_PLATFORM', 'Unknown Nix host platform!'),
++  };
+ 
+   @override
+   HostPlatform get hostPlatform {
diff --git a/pkgs/development/compilers/flutter/sdk-symlink.nix b/pkgs/development/compilers/flutter/sdk-symlink.nix
index 6fb4f5edc0ee..044a508805f5 100644
--- a/pkgs/development/compilers/flutter/sdk-symlink.nix
+++ b/pkgs/development/compilers/flutter/sdk-symlink.nix
@@ -1,10 +1,23 @@
-{ symlinkJoin }: flutter:
+{ symlinkJoin
+, makeWrapper
+}: flutter:
 
 let
   self =
     symlinkJoin {
       name = "${flutter.name}-sdk-links";
-      paths = [ flutter flutter.sdk ];
+      paths = [ flutter flutter.cacheDir flutter.sdk ];
+
+      nativeBuildInputs = [ makeWrapper ];
+      postBuild = ''
+        wrapProgram "$out/bin/flutter" \
+          --set-default FLUTTER_ROOT "$out"
+
+        # symlinkJoin seems to be missing the .git directory for some reason.
+        if [ -d '${flutter.sdk}/.git' ]; then
+          ln -s '${flutter.sdk}/.git' "$out"
+        fi
+      '';
 
       passthru = flutter.passthru // {
         # Update the SDK attribute.
diff --git a/pkgs/development/compilers/flutter/wrapper.nix b/pkgs/development/compilers/flutter/wrapper.nix
index f525bcc7ab31..38c2eb289310 100644
--- a/pkgs/development/compilers/flutter/wrapper.nix
+++ b/pkgs/development/compilers/flutter/wrapper.nix
@@ -3,27 +3,14 @@
 , darwin
 , callPackage
 , flutter
-, supportsLinuxDesktop ? stdenv.hostPlatform.isLinux
-, supportsAndroid ? (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isDarwin)
-, supportsDarwin ? stdenv.hostPlatform.isDarwin
-, supportsIOS ? stdenv.hostPlatform.isDarwin
-, includedEngineArtifacts ? {
-    common = [
-      "flutter_patched_sdk"
-      "flutter_patched_sdk_product"
-    ];
-    platform = {
-      android = lib.optionalAttrs supportsAndroid
-        ((lib.genAttrs [ "arm" "arm64" "x64" ] (architecture: [ "profile" "release" ])) // { x86 = [ "jit-release" ]; });
-      darwin = lib.optionalAttrs supportsDarwin
-        ((lib.genAttrs [ "arm64" "x64" ] (architecture: [ "profile" "release" ])));
-      ios = lib.optionalAttrs supportsIOS
-        ((lib.genAttrs [ "" ] (architecture: [ "profile" "release" ])));
-      linux = lib.optionalAttrs supportsLinuxDesktop
-        (lib.genAttrs ((lib.optional stdenv.hostPlatform.isx86_64 "x64") ++ (lib.optional stdenv.hostPlatform.isAarch64 "arm64"))
-          (architecture: [ "debug" "profile" "release" ]));
-    };
-  }
+, supportedTargetPlatforms ? [
+    "universal"
+    "web"
+  ]
+  ++ lib.optional stdenv.hostPlatform.isLinux "linux"
+  ++ lib.optional (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isDarwin) "android"
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ "macos" "ios" ]
+, artifactHashes ? (import ./artifacts/hashes.nix).${flutter.version}
 , extraPkgConfigPackages ? [ ]
 , extraLibraries ? [ ]
 , extraIncludes ? [ ]
@@ -57,70 +44,31 @@
 }:
 
 let
-  engineArtifacts = callPackage ./engine-artifacts {
-    inherit (flutter) engineVersion;
-    flutterVersion = flutter.version;
-  };
-  mkCommonArtifactLinkCommand = { artifact }:
-    ''
-      mkdir -p $out/artifacts/engine/common
-      lndir -silent ${artifact} $out/artifacts/engine/common
-    '';
-  mkPlatformArtifactLinkCommand = { artifact, os, architecture, variant ? null }:
-    let
-      artifactDirectory = "${os}-${architecture}${lib.optionalString (variant != null) "-${variant}"}";
-    in
-    ''
-      mkdir -p $out/artifacts/engine/${artifactDirectory}
-      lndir -silent ${artifact} $out/artifacts/engine/${artifactDirectory}
-    '';
-  engineArtifactDirectory =
-    runCommandLocal "flutter-engine-artifacts-${flutter.version}" { nativeBuildInputs = [ lndir ]; }
-      (
-        builtins.concatStringsSep "\n"
-          ((map
-            (name: mkCommonArtifactLinkCommand {
-              artifact = engineArtifacts.common.${name};
-            })
-            (includedEngineArtifacts.common or [ ])) ++
-          (builtins.foldl'
-            (commands: os: commands ++
-              (builtins.foldl'
-                (commands: architecture: commands ++
-                  (builtins.foldl'
-                    (commands: variant: commands ++
-                      (map
-                        (artifact: mkPlatformArtifactLinkCommand {
-                          inherit artifact os architecture variant;
-                        })
-                        engineArtifacts.platform.${os}.${architecture}.variants.${variant}))
-                    (map
-                      (artifact: mkPlatformArtifactLinkCommand {
-                        inherit artifact os architecture;
-                      })
-                      engineArtifacts.platform.${os}.${architecture}.base)
-                    includedEngineArtifacts.platform.${os}.${architecture}))
-                [ ]
-                (builtins.attrNames includedEngineArtifacts.platform.${os})))
-            [ ]
-            (builtins.attrNames (includedEngineArtifacts.platform or { }))))
-      );
+  supportsLinuxDesktopTarget = builtins.elem "linux" supportedTargetPlatforms;
 
-  cacheDir = symlinkJoin {
+  platformArtifacts = lib.genAttrs supportedTargetPlatforms (platform:
+    (callPackage ./artifacts/prepare-artifacts.nix {
+      src = callPackage ./artifacts/fetch-artifacts.nix {
+        inherit platform;
+        flutter = callPackage ./wrapper.nix { inherit flutter; };
+        hash = artifactHashes.${platform}.${stdenv.hostPlatform.system} or "";
+      };
+    }));
+
+  cacheDir = symlinkJoin rec {
     name = "flutter-cache-dir";
-    paths = [
-      engineArtifactDirectory
-      "${flutter}/bin/cache"
-    ];
+    paths = builtins.attrValues platformArtifacts;
+    postBuild = ''
+      mkdir -p "$out/bin/cache"
+      ln -s '${flutter}/bin/cache/dart-sdk' "$out/bin/cache"
+    '';
+    passthru.platform = platformArtifacts;
   };
 
   # By default, Flutter stores downloaded files (such as the Pub cache) in the SDK directory.
   # Wrap it to ensure that it does not do that, preferring home directories instead.
-  # The sh file `$out/bin/internal/shared.sh` runs when launching Flutter and calls `"$FLUTTER_ROOT/bin/cache/` instead of our environment variable `FLUTTER_CACHE_DIR`.
-  # We do not patch it since the script doesn't require engine artifacts(which are the only thing not added by the unwrapped derivation), so it shouldn't fail, and patching it will just be harder to maintain.
   immutableFlutter = writeShellScript "flutter_immutable" ''
     export PUB_CACHE=''${PUB_CACHE:-"$HOME/.pub-cache"}
-    export FLUTTER_CACHE_DIR=${cacheDir}
     ${flutter}/bin/flutter "$@"
   '';
 
@@ -128,7 +76,7 @@ let
   tools = [ git which ];
 
   # Libraries that Flutter apps depend on at runtime.
-  appRuntimeDeps = lib.optionals supportsLinuxDesktop [
+  appRuntimeDeps = lib.optionals supportsLinuxDesktopTarget [
     atk
     cairo
     gdk-pixbuf
@@ -152,10 +100,10 @@ let
 
   # Some header files and libraries are not properly located by the Flutter SDK.
   # They must be manually included.
-  appStaticBuildDeps = (lib.optionals supportsLinuxDesktop [ libX11 xorgproto zlib ]) ++ extraLibraries;
+  appStaticBuildDeps = (lib.optionals supportsLinuxDesktopTarget [ libX11 xorgproto zlib ]) ++ extraLibraries;
 
   # Tools used by the Flutter SDK to compile applications.
-  buildTools = lib.optionals supportsLinuxDesktop [
+  buildTools = lib.optionals supportsLinuxDesktopTarget [
     pkg-config
     cmake
     ninja
@@ -174,12 +122,12 @@ in
 
   nativeBuildInputs = [ makeWrapper ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ]
-    ++ lib.optionals supportsLinuxDesktop [ glib wrapGAppsHook ];
+    ++ lib.optionals supportsLinuxDesktopTarget [ glib wrapGAppsHook ];
 
   passthru = flutter.passthru // {
     inherit (flutter) version;
     unwrapped = flutter;
-    inherit engineArtifacts;
+    inherit cacheDir;
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/ocaml-modules/tty/default.nix b/pkgs/development/ocaml-modules/tty/default.nix
new file mode 100644
index 000000000000..8c5c1b47524a
--- /dev/null
+++ b/pkgs/development/ocaml-modules/tty/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, uutf
+}:
+
+buildDunePackage rec {
+  pname = "tty";
+  version = "0.0.2";
+
+  minimalOCamlVersion = "5.1";
+
+  src = fetchurl {
+    url = "https://github.com/leostera/tty/releases/download/${version}/tty-${version}.tbz";
+    hash = "sha256-eeD5Y+/QXZzFoEHvOSZj2Q74V8BK5j3Lu3Zsrj2YUUs=";
+  };
+
+  propagatedBuildInputs = [
+    uutf
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "A library for interacting with teletype and terminal emulators";
+    homepage = "https://github.com/leostera/tty";
+    changelog = "https://github.com/leostera/tty/blob/${version}/CHANGES.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sixstring982 ];
+  };
+}
diff --git a/pkgs/development/python-modules/google-cloud-datastore/default.nix b/pkgs/development/python-modules/google-cloud-datastore/default.nix
index b6148c30746c..00e07713a635 100644
--- a/pkgs/development/python-modules/google-cloud-datastore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datastore/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datastore";
-  version = "2.18.0";
+  version = "2.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Y7MbZ23LJ4amUNI9Mk2PiGxOFFhq/dDP5uJgpz8SRI4=";
+    hash = "sha256-B/xYcKAmHyVGbFV8E035Wpbf0lN6vQiLnVN/ur6ZuXQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-dns/default.nix b/pkgs/development/python-modules/google-cloud-dns/default.nix
index 0f9b9eca022f..f076591c02de 100644
--- a/pkgs/development/python-modules/google-cloud-dns/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dns/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dns";
-  version = "0.34.2";
+  version = "0.35.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/GG9jPBw6Hqstidi6ypa8VUHBsmIgdeurrru0RKAr9M=";
+    hash = "sha256-CsRNqesPoLEilRPNiIB0q9AhGZLEBCMAr9HBbUFHRVM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-language/default.nix b/pkgs/development/python-modules/google-cloud-language/default.nix
index 54397f68cd8f..e04591791d3c 100644
--- a/pkgs/development/python-modules/google-cloud-language/default.nix
+++ b/pkgs/development/python-modules/google-cloud-language/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-language";
-  version = "2.11.1";
+  version = "2.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XxhECfBAwMcwV8JhbmvS6G5FrrZGGA0ZwYnfSqPQLbo=";
+    hash = "sha256-efuO/hWDM+aMBXR+nqhrWYsvQpoS83FJ2DrG+hhFlio=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-org-policy/default.nix b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
index 2e91f2704c77..314dc51060da 100644
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-org-policy";
-  version = "1.8.3";
+  version = "1.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VU+vB+x2DElwzl1cO7qTdV91Mn1i2Dsq2safnMrwuqI=";
+    hash = "sha256-3Db3R3PnzYMiMNrbP1BiU7TfKIxR11v491i+JH10Q/0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 943d55dab406..f2288f8638c1 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.18.4";
+  version = "2.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Muth/UwdxshC9ZTWnZr6gFROOzJ6pkChZOtvsCAery0=";
+    hash = "sha256-apjDP361994q5S76BZsrX3WyzNnw8R8u3O/dqNFOQlw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/justnimbus/default.nix b/pkgs/development/python-modules/justnimbus/default.nix
index ecea9ef4a549..013e4670aa8f 100644
--- a/pkgs/development/python-modules/justnimbus/default.nix
+++ b/pkgs/development/python-modules/justnimbus/default.nix
@@ -8,16 +8,16 @@
 
 buildPythonPackage rec {
   pname = "justnimbus";
-  version = "0.7.2";
-  format = "pyproject";
+  version = "0.7.3";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "kvanzuijlen";
-    repo = pname;
+    repo = "justnimbus";
     rev = "refs/tags/${version}";
-    hash = "sha256-arUdjZiEJx0L1YcCNxqlE4ItoTEzd/TYVgqDPIqomMg=";
+    hash = "sha256-JO8T0JItkkNHxlnDKOO8kM9KSzT7QML4sszPymgXSBA=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for the JustNimbus API";
     homepage = "https://github.com/kvanzuijlen/justnimbus";
+    changelog = "https://github.com/kvanzuijlen/justnimbus/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index d36bc9004e33..42bcc9e660f1 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "2.12.0";
+  version = "2.12.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_parser";
-    hash = "sha256-0Ic7WKQbwA7TnFvXRZz+mFehjWP6n+Pyp0IySMy8sdw=";
+    hash = "sha256-So9Kyj4jMRiaBRQGXE88DSWgLEPqQkv8R/Sd8tyRvE0=";
   };
 
   buildInputs = [ pip ];
diff --git a/pkgs/development/python-modules/okta/default.nix b/pkgs/development/python-modules/okta/default.nix
index d6068b59e043..13218b0d8f08 100644
--- a/pkgs/development/python-modules/okta/default.nix
+++ b/pkgs/development/python-modules/okta/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "okta";
-  version = "2.9.3";
+  version = "2.9.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mOKVCRp8cLY7p0AVbvphWdB3II6eB6HlN8i1HrVUH+o=";
+    hash = "sha256-qMcO0TTbMPjc+r2IOlwJqbaSOztat9MmYWH4kgy9vwA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ossfs/default.nix b/pkgs/development/python-modules/ossfs/default.nix
index baa808a7062c..97f61f62199b 100644
--- a/pkgs/development/python-modules/ossfs/default.nix
+++ b/pkgs/development/python-modules/ossfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "ossfs";
-  version = "2023.8.0";
+  version = "2023.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fsspec";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-v6QZgv1QwBrQpCwP/1z6704UNvQyoCrpQGkhTmncbjQ=";
+    hash = "sha256-N1NkpI8inGJCf0xuc+FFmVX85CS7vqzoNddxZ9kqEk0=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/packageurl-python/default.nix b/pkgs/development/python-modules/packageurl-python/default.nix
index dcc49b99af29..f51d7e4518cc 100644
--- a/pkgs/development/python-modules/packageurl-python/default.nix
+++ b/pkgs/development/python-modules/packageurl-python/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "packageurl-python";
-  version = "0.11.2";
+  version = "0.13.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Afv3SkHvhc9BPx7eUpoUEfZYvaZu0i1F0nKArZzrpHE=";
+    hash = "sha256-hPgFP0uFKUuYs7eHFUdYR/tI9FJewwLQbcNbJqmzB4o=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/parametrize-from-file/default.nix b/pkgs/development/python-modules/parametrize-from-file/default.nix
index 79a073af9955..b6ee36c3dce2 100644
--- a/pkgs/development/python-modules/parametrize-from-file/default.nix
+++ b/pkgs/development/python-modules/parametrize-from-file/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "parametrize-from-file";
-  version = "0.18.0";
+  version = "0.19.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "parametrize_from_file";
-    hash = "sha256-mYE8J7XWlvCS2H3kt0bB8dyPHFDqmW8NiH9UCrNccAU=";
+    hash = "sha256-FPTO2hYZT7bsQyPNcjBEk8SZKp51o/eMV5/U58W5SPI=";
   };
 
   # patch out coveralls since it doesn't provide us value
diff --git a/pkgs/development/python-modules/sunweg/default.nix b/pkgs/development/python-modules/sunweg/default.nix
index b33220898cd3..80b8b08251c7 100644
--- a/pkgs/development/python-modules/sunweg/default.nix
+++ b/pkgs/development/python-modules/sunweg/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "sunweg";
-  version = "2.0.0";
+  version = "2.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "rokam";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-S92PybN+pReI9WtJr9as95uceicsSMadMQfh9JxsE8U=";
+    hash = "sha256-rqxpHnKHS5rgQ6iH5NSL2F71EnpOBxpICUk74YwtEDc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index cddd059fdd61..bc04b05bd7af 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.1.40";
+  version = "3.1.41";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-KnkaE40NVcZAM9U/WmifM9D7xOTRV1Mi7lFIh/r4WJQ=";
+    hash = "sha256-weW4nCBnuMPq888lUG4V/luUi+z4kZ52jUnv6yks45Y=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/rust/crate2nix/default.nix b/pkgs/development/tools/rust/crate2nix/default.nix
index 5f8b3d2cdc6e..62084be4b5a8 100644
--- a/pkgs/development/tools/rust/crate2nix/default.nix
+++ b/pkgs/development/tools/rust/crate2nix/default.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "crate2nix";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = pname;
     rev = version;
-    sha256 = "sha256-nyX1lfaA0eBSB/BaxPzCsyD8p/hxCwNIvr4Ru3i/YX0=";
+    sha256 = "sha256-A9AowkHIjsy1a4LuiPiVP88FMxyCWK41flZEZOUuwQM=";
   };
 
   sourceRoot = "${src.name}/crate2nix";
 
-  cargoSha256 = "sha256-3+emOr3hh+DDkboJbYyJFZgkzmcdA9jdronz7wM4x28=";
+  cargoHash = "sha256-85OIOhRdVDu5hZuBzanyqkH1gOuF5IQGubVrLAqt1ak=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index 7bcc7976f1f9..d5b266cece37 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -7,6 +7,11 @@
 , extraBwrapArgs ? [ ] # extra arguments to pass to bubblewrap (real default is at usage site)
 , extraArgs ? "" # arguments to always pass to steam
 , extraEnv ? { } # Environment variables to pass to Steam
+
+# steamwebhelper deletes unrelated electron programs' singleton cookies from /tmp on startup:
+# https://github.com/ValveSoftware/steam-for-linux/issues/9121
+, privateTmp ? true # Whether to separate steam's /tmp from the host system
+
 , withGameSpecificLibraries ? true # include game specific libraries
 }@args:
 
@@ -285,9 +290,7 @@ in buildFHSEnv rec {
     exec steam ${extraArgs} "$@"
   '';
 
-  # steamwebhelper deletes unrelated electron programs' singleton cookies from /tmp on startup:
-  # https://github.com/ValveSoftware/steam-for-linux/issues/9121
-  privateTmp = true;
+  inherit privateTmp;
 
   extraPreBwrapCmds = ''
     install -m 1777 -d /tmp/dumps
diff --git a/pkgs/games/tetrio-desktop/default.nix b/pkgs/games/tetrio-desktop/default.nix
index a48f2b22138a..e31491e94c90 100644
--- a/pkgs/games/tetrio-desktop/default.nix
+++ b/pkgs/games/tetrio-desktop/default.nix
@@ -6,6 +6,7 @@
 , wrapGAppsHook
 , alsa-lib
 , cups
+, libGL
 , libX11
 , libXScrnSaver
 , libXtst
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
   ];
 
   libPath = lib.makeLibraryPath [
+    libGL
     libpulseaudio
     systemd
   ];
diff --git a/pkgs/tools/networking/openvpn/default.nix b/pkgs/tools/networking/openvpn/default.nix
index 87cbd6881e27..6aedcbbcbb3e 100644
--- a/pkgs/tools/networking/openvpn/default.nix
+++ b/pkgs/tools/networking/openvpn/default.nix
@@ -3,6 +3,9 @@
 , fetchurl
 , pkg-config
 , iproute2
+, libcap_ng
+, libnl
+, lz4
 , lzo
 , openssl
 , pam
@@ -11,12 +14,13 @@
 , update-systemd-resolved
 , pkcs11Support ? false
 , pkcs11helper
+, nixosTests
 }:
 
 let
   inherit (lib) versionOlder optional optionals optionalString;
 
-  generic = { version, sha256, extraBuildInputs ? [] }:
+  generic = { version, sha256, extraBuildInputs ? [ ] }:
     let
       withIpRoute = stdenv.isLinux && (versionOlder version "2.5.4");
     in
@@ -32,8 +36,8 @@ let
 
         nativeBuildInputs = [ pkg-config ];
 
-        buildInputs = [ lzo ]
-          ++ optional stdenv.isLinux pam
+        buildInputs = [ lz4 lzo ]
+          ++ optionals stdenv.isLinux [ libcap_ng libnl pam ]
           ++ optional withIpRoute iproute2
           ++ optional useSystemd systemd
           ++ optional pkcs11Support pkcs11helper
@@ -72,9 +76,14 @@ let
 
 in
 {
-  openvpn = generic {
-    version = "2.5.8";
-    sha256 = "1cixqm4gn2d1v8qkbww75j30fzvxz13gc7whcmz54i0x4fvibwx6";
+  openvpn = (generic {
+    version = "2.6.8";
+    sha256 = "sha256-Xt4VZcim2IAQD38jUxen7p7qg9UFLbVUfxOp52r3gF0=";
     extraBuildInputs = [ openssl ];
-  };
+  }).overrideAttrs
+    (_: {
+      passthru.tests = {
+        inherit (nixosTests) initrd-network-openvpn systemd-initrd-networkd-openvpn;
+      };
+    });
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c9fbb003f297..e290aca765df 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11590,9 +11590,7 @@ with pkgs;
 
   onlykey = callPackage ../tools/security/onlykey { node_webkit = nwjs; };
 
-  ooniprobe-cli = callPackage ../tools/networking/ooniprobe-cli {
-    buildGoModule = buildGo120Module;
-  };
+  ooniprobe-cli = callPackage ../tools/networking/ooniprobe-cli { };
 
   openapi-generator-cli = callPackage ../tools/networking/openapi-generator-cli { jre = pkgs.jre_headless; };
   openapi-generator-cli-unstable = callPackage ../tools/networking/openapi-generator-cli/unstable.nix { jre = pkgs.jre_headless; };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index f04dc00d0971..08c2592a221e 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1783,6 +1783,8 @@ let
 
     tsort = callPackage ../development/ocaml-modules/tsort { };
 
+    tty = callPackage ../development/ocaml-modules/tty { };
+
     tuntap = callPackage ../development/ocaml-modules/tuntap { };
 
     twt = callPackage ../development/ocaml-modules/twt { };