diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 405c23369992..b0479a90f03d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4988,6 +4988,12 @@
     githubId = 62989;
     name = "Demyan Rogozhin";
   };
+  denperidge = {
+    email = "contact@denperidge.com";
+    github = "denperidge";
+    githubId = 27348469;
+    name = "Cat";
+  };
   derchris = {
     email = "derchris@me.com";
     github = "derchrisuk";
@@ -19386,6 +19392,13 @@
     githubId = 158321;
     name = "Stewart Mackenzie";
   };
+  skeuchel = {
+    name = "Steven Keuchel";
+    email = "steven.keuchel@gmail.com";
+    github = "skeuchel";
+    githubId = 617130;
+    keys = [ { fingerprint = "C4F7 46C7 B560 38D8 210F  0288 5877 DEE9 7428 557F"; } ];
+  };
   skovati = {
     github = "skovati";
     githubId = 49844593;
diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix
index 00b6b28eb653..0f551dcbd63b 100644
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -162,6 +162,7 @@ in
 
     boot.kernelParams = [
       "console=${qemu-common.qemuSerialDevice}"
+      "console=tty0"
       # Panic if an error occurs in stage 1 (rather than waiting for
       # user intervention).
       "panic=1" "boot.panic_on_fail"
@@ -180,6 +181,7 @@ in
     services.journald.extraConfig =
       ''
         ForwardToConsole=yes
+        TTYPath=/dev/${qemu-common.qemuSerialDevice}
         MaxLevelConsole=debug
       '';
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 0ccbaaeb7308..b537674798c6 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -444,7 +444,6 @@ in {
   hibernate-systemd-stage-1 = handleTestOn ["x86_64-linux"] ./hibernate.nix { systemdStage1 = true; };
   hitch = handleTest ./hitch {};
   hledger-web = handleTest ./hledger-web.nix {};
-  hocker-fetchdocker = handleTest ./hocker-fetchdocker {};
   hockeypuck = handleTest ./hockeypuck.nix { };
   home-assistant = handleTest ./home-assistant.nix {};
   hostname = handleTest ./hostname.nix {};
diff --git a/nixos/tests/hocker-fetchdocker/default.nix b/nixos/tests/hocker-fetchdocker/default.nix
deleted file mode 100644
index b5c06126c2e8..000000000000
--- a/nixos/tests/hocker-fetchdocker/default.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-import ../make-test-python.nix ({ pkgs, ...} : {
-  name = "test-hocker-fetchdocker";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ ixmatus ];
-    broken = true; # tries to download from registry-1.docker.io - how did this ever work?
-  };
-
-  nodes.machine = import ./machine.nix;
-
-  testScript = ''
-    start_all()
-
-    machine.wait_for_unit("sockets.target")
-    machine.wait_until_succeeds("docker run registry-1.docker.io/v2/library/hello-world:latest")
-  '';
-})
diff --git a/nixos/tests/hocker-fetchdocker/hello-world-container.nix b/nixos/tests/hocker-fetchdocker/hello-world-container.nix
deleted file mode 100644
index a127875264e9..000000000000
--- a/nixos/tests/hocker-fetchdocker/hello-world-container.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ fetchDockerConfig, fetchDockerLayer, fetchdocker }:
-fetchdocker rec {
-    name = "hello-world";
-    registry = "https://registry-1.docker.io/v2/";
-    repository = "library";
-    imageName = "hello-world";
-    tag = "latest";
-    imageConfig = fetchDockerConfig {
-      inherit tag registry repository imageName;
-      sha256 = "1ivbd23hyindkahzfw4kahgzi6ibzz2ablmgsz6340vc6qr1gagj";
-    };
-    imageLayers = let
-      layer0 = fetchDockerLayer {
-        inherit registry repository imageName;
-        layerDigest = "ca4f61b1923c10e9eb81228bd46bee1dfba02b9c7dac1844527a734752688ede";
-        sha256 = "1plfd194fwvsa921ib3xkhms1yqxxrmx92r2h7myj41wjaqn2kya";
-      };
-      in [ layer0 ];
-  }
diff --git a/nixos/tests/hocker-fetchdocker/machine.nix b/nixos/tests/hocker-fetchdocker/machine.nix
deleted file mode 100644
index 885adebe1498..000000000000
--- a/nixos/tests/hocker-fetchdocker/machine.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ pkgs, ... }:
-{ nixpkgs.config.packageOverrides = pkgs': {
-    hello-world-container = pkgs'.callPackage ./hello-world-container.nix { };
-  };
-
-  virtualisation.docker = {
-    enable  = true;
-    package = pkgs.docker;
-  };
-
-  systemd.services.docker-load-fetchdocker-image = {
-    description = "Docker load hello-world-container";
-    wantedBy    = [ "multi-user.target" ];
-    wants       = [ "docker.service" ];
-    after       = [ "docker.service" ];
-
-    script = ''
-      ${pkgs.hello-world-container}/compositeImage.sh | ${pkgs.docker}/bin/docker load
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-    };
-  };
-}
-
diff --git a/pkgs/applications/blockchains/monero-cli/default.nix b/pkgs/applications/blockchains/monero-cli/default.nix
index 50d5d1b109a3..7a1069357278 100644
--- a/pkgs/applications/blockchains/monero-cli/default.nix
+++ b/pkgs/applications/blockchains/monero-cli/default.nix
@@ -1,9 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch2, cmake, ninja, pkg-config
-, boost, miniupnpc, openssl, unbound
-, zeromq, pcsclite, readline, libsodium, hidapi
-, randomx, rapidjson
-, CoreData, IOKit, PCSC
-, trezorSupport ? true, libusb1, protobuf, python3
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ninja,
+  pkg-config,
+  boost,
+  libsodium,
+  miniupnpc,
+  openssl,
+  python3,
+  randomx,
+  rapidjson,
+  readline,
+  unbound,
+  zeromq,
+
+  # darwin
+  CoreData,
+  IOKit,
+
+  trezorSupport ? true,
+  hidapi,
+  libusb1,
+  protobuf_21,
+  udev,
 }:
 
 let
@@ -25,40 +46,16 @@ in
 
 stdenv.mkDerivation rec {
   pname = "monero-cli";
-  version = "0.18.3.3";
+  version = "0.18.3.4";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero";
     rev = "v${version}";
-    hash = "sha256-1LkKIrud317BEE+713t5wiJV6FcDlJdj4ypXPR0bKTs=";
+    hash = "sha256-nDiFJjhsISYM8kTgJUaPYL44iyccnz5+Pd5beBh+lsM=";
   };
 
-  patches = [
-    # cmake: remove unused/extera cmake/FindMiniupnpc.cmake and only rely on external/miniupnpc
-    # https://github.com/monero-project/monero/pull/9366
-    (fetchpatch2 {
-      url = "https://github.com/monero-project/monero/commit/5074a543a49f7e23fb39b6462fd4c4c9741c3693.patch?full_index=1";
-      hash = "sha256-dS2hhEU6m2of0ULlsf+/tZMHUmq3vGGXJPGHvtnpQnY=";
-    })
-
-    # cmake: add different parameters to add_monero_library.
-    # https://github.com/monero-project/monero/pull/9367
-    (fetchpatch2 {
-      url = "https://github.com/monero-project/monero/commit/b91ead90254ac6d6daf908f689c38e372a44c615.patch?full_index=1";
-      hash = "sha256-DL2YqkvEONbeEDqLOAo2eSF5JF5gOzKcLKeNlUXBY1w=";
-    })
-
-    # external: update miniupnpc to 2.2.8
-    # https://github.com/monero-project/monero/pull/9367
-    (fetchpatch2 {
-      url = "https://github.com/monero-project/monero/commit/d81da086ec5088a04b3f7b34831e72910300e2f7.patch?full_index=1";
-      hash = "sha256-ZJGiDMk5DMmEXwzoUYPC+DIoebluFh54kMQtQU78ckI=";
-      excludes = [ "external/miniupnp" ];
-    })
-
-    ./use-system-libraries.patch
-  ];
+  patches = [ ./use-system-libraries.patch ];
 
   postPatch = ''
     # manually install submodules
@@ -69,31 +66,60 @@ stdenv.mkDerivation rec {
     cp -r . $source
   '';
 
-  nativeBuildInputs = [ cmake ninja pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
 
-  buildInputs = [
-    boost miniupnpc openssl unbound
-    zeromq pcsclite readline
-    libsodium hidapi randomx rapidjson
-    protobuf
-  ] ++ lib.optionals stdenv.isDarwin [ IOKit CoreData PCSC ]
-    ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ];
+  buildInputs =
+    [
+      boost
+      libsodium
+      miniupnpc
+      openssl
+      randomx
+      rapidjson
+      readline
+      unbound
+      zeromq
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      IOKit
+      CoreData
+    ]
+    ++ lib.optionals trezorSupport [
+      python3
+      hidapi
+      libusb1
+      protobuf_21
+    ]
+    ++ lib.optionals (trezorSupport && stdenv.isLinux) [
+      udev
+    ];
 
-  cmakeFlags = [
-    "-DUSE_DEVICE_TREZOR=ON"
-    "-DBUILD_GUI_DEPS=ON"
-    "-DReadline_ROOT_DIR=${readline.dev}"
-    "-DRandomX_ROOT_DIR=${randomx}"
-  ] ++ lib.optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF";
+  cmakeFlags =
+    [
+      # skip submodules init
+      "-DMANUAL_SUBMODULES=ON"
+      # required by monero-gui
+      "-DBUILD_GUI_DEPS=ON"
+      "-DReadline_ROOT_DIR=${readline.dev}"
+    ]
+    ++ lib.optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF"
+    ++ lib.optional trezorSupport [
+      "-DUSE_DEVICE_TREZOR=ON"
+      # fix build on recent gcc versions
+      "-DCMAKE_CXX_FLAGS=-fpermissive"
+    ];
 
   outputs = [ "out" "source" ];
 
-  meta = with lib; {
+  meta = {
     description = "Private, secure, untraceable currency";
-    homepage    = "https://getmonero.org/";
-    license     = licenses.bsd3;
-    platforms   = platforms.all;
-    maintainers = with maintainers; [ rnhmjoj ];
+    homepage = "https://getmonero.org/";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ rnhmjoj ];
     mainProgram = "monero-wallet-cli";
   };
 }
diff --git a/pkgs/applications/blockchains/monero-cli/use-system-libraries.patch b/pkgs/applications/blockchains/monero-cli/use-system-libraries.patch
index f8629d47553c..adb41fb4ac25 100644
--- a/pkgs/applications/blockchains/monero-cli/use-system-libraries.patch
+++ b/pkgs/applications/blockchains/monero-cli/use-system-libraries.patch
@@ -1,14 +1,15 @@
 diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
-index f8b834ac17...520e148428 100644
+index 5b7f69a56..cc4b0a346 100644
 --- a/external/CMakeLists.txt
 +++ b/external/CMakeLists.txt
-@@ -39,23 +39,12 @@
-   add_compile_options(-D_GNU_SOURCE)
- endif()
+@@ -35,25 +35,14 @@
+ # ...except for FreeBSD, because FreeBSD is a special case that doesn't play well with
+ # others.
  
+-find_package(Miniupnpc REQUIRED)
+-
 -message(STATUS "Using in-tree miniupnpc")
 -set(UPNPC_NO_INSTALL TRUE CACHE BOOL "Disable miniupnp installation" FORCE)
--set(UPNPC_BUILD_TESTS FALSE CACHE BOOL "Disable miniupnp internal tests." FORCE)
 -add_subdirectory(miniupnp/miniupnpc)
 -set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
 -set_property(TARGET libminiupnpc-static PROPERTY POSITION_INDEPENDENT_CODE ON)
@@ -20,19 +21,58 @@ index f8b834ac17...520e148428 100644
 -if(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
 -	set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -D_NETBSD_SOURCE")
 -endif()
-+include(FindPkgConfig)
-+pkg_check_modules(MINIUPNPC REQUIRED IMPORTED_TARGET GLOBAL miniupnpc)
-+get_target_property(MINIUPNPC_INCLUDE_DIR PkgConfig::MINIUPNPC INTERFACE_INCLUDE_DIRECTORIES)
-+set_target_properties(PkgConfig::MINIUPNPC PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "${MINIUPNPC_INCLUDE_DIR}/miniupnpc")
-+set(UPNP_LIBRARIES PkgConfig::MINIUPNPC PARENT_SCOPE)
- 
--set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
 -
+-set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
++find_package(PkgConfig REQUIRED)
++pkg_check_modules(MINIUPNPC REQUIRED miniupnpc)
++link_libraries(${MINIUPNPC_LIBRARIES})
++include_directories(${MINIUPNPC_INCLUDE_DIRS})
+ 
++find_package(RapidJSON)
  find_package(Unbound)
++find_library(RANDOMX_LIBRARY randomx)
  
  if(NOT UNBOUND_INCLUDE_DIR)
-@@ -72,4 +61,3 @@
+   die("Could not find libunbound")
+@@ -69,4 +58,3 @@ endif()
  add_subdirectory(db_drivers)
  add_subdirectory(easylogging++)
  add_subdirectory(qrcodegen)
 -add_subdirectory(randomx EXCLUDE_FROM_ALL)
+diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl
+index 71f5393e8..bb48083d0 100644
+--- a/src/p2p/net_node.inl
++++ b/src/p2p/net_node.inl
+@@ -60,9 +60,9 @@
+ #include "cryptonote_core/cryptonote_core.h"
+ #include "net/parse.h"
+ 
+-#include <miniupnp/miniupnpc/miniupnpc.h>
+-#include <miniupnp/miniupnpc/upnpcommands.h>
+-#include <miniupnp/miniupnpc/upnperrors.h>
++#include <miniupnpc/miniupnpc.h>
++#include <miniupnpc/upnpcommands.h>
++#include <miniupnpc/upnperrors.h>
+ 
+ #undef MONERO_DEFAULT_LOG_CATEGORY
+ #define MONERO_DEFAULT_LOG_CATEGORY "net.p2p"
+@@ -2989,7 +2989,8 @@ namespace nodetool
+     UPNPUrls urls;
+     IGDdatas igdData;
+     char lanAddress[64];
+-    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress);
++    char wanAddress[64];
++    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress, wanAddress, sizeof wanAddress);
+     freeUPNPDevlist(deviceList);
+     if (result > 0) {
+       if (result == 1) {
+@@ -3057,7 +3058,8 @@ namespace nodetool
+     UPNPUrls urls;
+     IGDdatas igdData;
+     char lanAddress[64];
+-    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress);
++    char wanAddress[64];
++    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress, wanAddress, sizeof wanAddress);
+     freeUPNPDevlist(deviceList);
+     if (result > 0) {
+       if (result == 1) {
diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/applications/blockchains/monero-gui/default.nix
index d72cad5c5367..7a8f5d4c26cb 100644
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@@ -1,43 +1,88 @@
-{ lib, stdenv, wrapQtAppsHook, makeDesktopItem
-, fetchFromGitHub
-, cmake, qttools, pkg-config
-, qtbase, qtdeclarative, qtgraphicaleffects
-, qtmultimedia, qtxmlpatterns
-, qtquickcontrols, qtquickcontrols2
-, qtmacextras
-, monero-cli, miniupnpc, unbound, readline
-, boost, libunwind, libsodium, pcsclite
-, randomx, zeromq, libgcrypt, libgpg-error
-, hidapi, rapidjson, quirc
-, trezorSupport ? true, libusb1, protobuf, python3
+{
+  lib,
+  fetchFromGitHub,
+  makeDesktopItem,
+  boost,
+  cmake,
+  libgcrypt,
+  libgpg-error,
+  libsodium,
+  miniupnpc,
+  monero-cli,
+  pkg-config,
+  qtbase,
+  qtdeclarative,
+  qtgraphicaleffects,
+  qtmacextras,
+  qtmultimedia,
+  qtquickcontrols,
+  qtquickcontrols2,
+  qttools,
+  qtxmlpatterns,
+  quirc,
+  randomx,
+  rapidjson,
+  stdenv,
+  unbound,
+  wrapQtAppsHook,
+  zeromq,
+
+  trezorSupport ? true,
+  hidapi,
+  libusb1,
+  protobuf_21,
+  python3,
+  udev,
 }:
 
 stdenv.mkDerivation rec {
   pname = "monero-gui";
-  version = "0.18.3.3";
+  version = "0.18.3.4";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero-gui";
     rev = "v${version}";
-    hash = "sha256-6qadBm4bPui11OVY1tLFcHsfswXWBFiJvutIsF6EfX8=";
+    hash = "sha256-wnU24EmZig2W/psy4OhaQVy2WwR0CgljlyYwOg4bzwM=";
   };
 
   nativeBuildInputs = [
-    cmake pkg-config wrapQtAppsHook
+    cmake
+    pkg-config
+    wrapQtAppsHook
     (lib.getDev qttools)
   ];
 
-  buildInputs = [
-    qtbase qtdeclarative qtgraphicaleffects
-    qtmultimedia qtquickcontrols qtquickcontrols2
-    qtxmlpatterns
-    monero-cli miniupnpc unbound readline
-    randomx libgcrypt libgpg-error
-    boost libunwind libsodium pcsclite
-    zeromq hidapi rapidjson quirc
-  ] ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ]
-    ++ lib.optionals stdenv.isDarwin [ qtmacextras ];
+  buildInputs =
+    [
+      boost
+      libgcrypt
+      libgpg-error
+      libsodium
+      miniupnpc
+      qtbase
+      qtdeclarative
+      qtgraphicaleffects
+      qtmultimedia
+      qtquickcontrols
+      qtquickcontrols2
+      qtxmlpatterns
+      quirc
+      randomx
+      rapidjson
+      unbound
+      zeromq
+    ]
+    ++ lib.optionals stdenv.isDarwin [ qtmacextras ]
+    ++ lib.optionals trezorSupport [
+      hidapi
+      libusb1
+      protobuf_21
+      python3
+    ]
+    ++ lib.optionals (trezorSupport && stdenv.isLinux) [
+      udev
+    ];
 
   postUnpack = ''
     # copy monero sources here
@@ -68,7 +113,12 @@ stdenv.mkDerivation rec {
       --replace 'add_subdirectory(external)' ""
   '';
 
-  cmakeFlags = [ "-DARCH=default" ];
+  cmakeFlags =
+    [ "-DARCH=default" ]
+    ++ lib.optional trezorSupport [
+      # fix build on recent gcc versions
+      "-DCMAKE_CXX_FLAGS=-fpermissive"
+    ];
 
   desktopItem = makeDesktopItem {
     name = "monero-wallet-gui";
@@ -76,7 +126,7 @@ stdenv.mkDerivation rec {
     icon = "monero";
     desktopName = "Monero";
     genericName = "Wallet";
-    categories  = [ "Network" "Utility" ];
+    categories = [ "Network" "Utility" ];
   };
 
   postInstall = ''
@@ -93,12 +143,12 @@ stdenv.mkDerivation rec {
     done;
   '';
 
-  meta = with lib; {
-    description  = "Private, secure, untraceable currency";
-    homepage     = "https://getmonero.org/";
-    license      = licenses.bsd3;
-    platforms    = platforms.all;
-    maintainers  = with maintainers; [ rnhmjoj ];
-    mainProgram  = "monero-wallet-gui";
+  meta = {
+    description = "Private, secure, untraceable currency";
+    homepage = "https://getmonero.org/";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ rnhmjoj ];
+    mainProgram = "monero-wallet-gui";
   };
 }
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 329ff8cb31e3..e41e8a61a196 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "9.16";
+    version = "9.17";
     url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
-    hash = "sha256-iQQq6MgLIzP4p9GId/xBecB9Y1erfyjMvabQbzwzDFA=";
+    hash = "sha256-Ptt+tvMbtcP3N43VYj2p2V99TW18g3iv2JyOOjCqCAw=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -117,7 +117,7 @@ in rec {
   staging = fetchFromGitLab rec {
     # https://gitlab.winehq.org/wine/wine-staging
     inherit (unstable) version;
-    hash = "sha256-CUVUatw9SH/LwYwloGHsU8TFjAVQRhd3WBk4AP+2NH4=";
+    hash = "sha256-ez7P9R5Q7t+FpaU5bVer4n2bt+evgXLJb83gP+zxIAw=";
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "wine-staging";
diff --git a/pkgs/applications/file-managers/mc/default.nix b/pkgs/applications/file-managers/mc/default.nix
index 08bfe6205fde..fdc60a309313 100644
--- a/pkgs/applications/file-managers/mc/default.nix
+++ b/pkgs/applications/file-managers/mc/default.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mc";
-  version = "4.8.31";
+  version = "4.8.32";
 
   src = fetchurl {
     url = "https://www.midnight-commander.org/downloads/${pname}-${version}.tar.xz";
-    sha256 = "sha256-JBkc+GZ2dbjjH8Sp0YoKZb3AWYwsXE6gkklM0Tq0qxo=";
+    hash = "sha256-TdyD0e3pryNjs+q5h/VLh89mGTJBEM4tOg5wlE0TWf4=";
   };
 
   nativeBuildInputs = [ pkg-config unzip ]
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 88c4066095b9..df4001e1d0b7 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -6,7 +6,7 @@
 
 buildGoModule rec {
   pname = "rclone";
-  version = "1.67.0";
+  version = "1.68.0";
 
   outputs = [ "out" "man" ];
 
@@ -14,10 +14,10 @@ buildGoModule rec {
     owner = "rclone";
     repo = "rclone";
     rev = "v${version}";
-    hash = "sha256-rTibyh5z89QuPgZMvv3Y6FCugxMIytAg1gdCxE3+QLE=";
+    hash = "sha256-xLTzfS3/9XBqh0B7/VeRKYEHAgc4rY3QcIUS3f1/e0M=";
   };
 
-  vendorHash = "sha256-Sw9zZf0rup+VyncIpJHp9PKUp60lv+TV4wbWtVTTK3w=";
+  vendorHash = "sha256-vZxdayoKTo/fs5PgEdT4gepNq0kNNmLQhlybWY5kpx0=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index c30bb61a410f..99934a964638 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -13,16 +13,16 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.27.9";
+      version = "1.27.12";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-9PKx5jxntG1QjDA+6XySxGahE1IrKKBl/Xk5ZaCAf5I=";
+        hash = "sha256-/HPq71KkWUE0vG7qUBD3JON4N5KBkuRWc4SvX/JA2nQ=";
       };
 
-      vendorHash = "sha256-Xv5x+/1lx8nyXw72eEHz7+qnkyZfPAnBtDRrOrD2l+g=";
+      vendorHash = "sha256-R5GlsCkfoMc5km+NaV+TNUlM3Ot1ARcXfEFimcZOLI4=";
 
       nativeBuildInputs = lib.optionals stdenv.isDarwin [
         # Recent versions of macOS seem to require binaries to be signed when
@@ -61,14 +61,14 @@ let
         inherit (nixosTests) syncthing syncthing-init syncthing-relay;
       };
 
-      meta = with lib; {
+      meta = {
         homepage = "https://syncthing.net/";
         description = "Open Source Continuous File Synchronization";
         changelog = "https://github.com/syncthing/syncthing/releases/tag/v${version}";
-        license = licenses.mpl20;
-        maintainers = with maintainers; [ joko peterhoeg ];
+        license = lib.licenses.mpl20;
+        maintainers = with lib.maintainers; [ joko peterhoeg ];
         mainProgram = target;
-        platforms = platforms.unix;
+        platforms = lib.platforms.unix;
       };
     };
 
@@ -90,17 +90,13 @@ in
     '' + lib.optionalString (stdenv.isLinux) ''
       mkdir -p $out/lib/systemd/{system,user}
 
-      substitute etc/linux-systemd/system/syncthing-resume.service \
-                 $out/lib/systemd/system/syncthing-resume.service \
-                 --replace /usr/bin/pkill ${procps}/bin/pkill
-
       substitute etc/linux-systemd/system/syncthing@.service \
                  $out/lib/systemd/system/syncthing@.service \
-                 --replace /usr/bin/syncthing $out/bin/syncthing
+                 --replace-fail /usr/bin/syncthing $out/bin/syncthing
 
       substitute etc/linux-systemd/user/syncthing.service \
                  $out/lib/systemd/user/syncthing.service \
-                 --replace /usr/bin/syncthing $out/bin/syncthing
+                 --replace-fail /usr/bin/syncthing $out/bin/syncthing
     '';
   };
 
@@ -118,7 +114,7 @@ in
 
       substitute cmd/strelaysrv/etc/linux-systemd/strelaysrv.service \
                  $out/lib/systemd/system/strelaysrv.service \
-                 --replace /usr/bin/strelaysrv $out/bin/strelaysrv
+                 --replace-fail /usr/bin/strelaysrv $out/bin/strelaysrv
     '';
   };
 }
diff --git a/pkgs/applications/virtualization/xen/README.md b/pkgs/applications/virtualization/xen/README.md
index 0df84ad8e4c2..02d1ab722707 100644
--- a/pkgs/applications/virtualization/xen/README.md
+++ b/pkgs/applications/virtualization/xen/README.md
@@ -26,6 +26,7 @@ Some other notable packages that compose the Xen Ecosystem include:
 - `ocamlPackages.xenstore-tool`: XAPI's `oxenstore` utilities.
 - `xen-guest-agent`: Guest drivers for UNIX domUs.
 - `win-pvdrivers`: Guest drivers for Windows domUs.
+- `xtf`: The Xen Test Framework.
 
 ## Updating
 
@@ -100,6 +101,8 @@ open a PR fixing the script, and update Xen manually:
    ```
 
    Change the value of `xenToEvaluate` to evaluate all relevant Xen packages.
+1. Run `xtf --all --host` as root when booted into the Xen update, and make
+   sure no tests fail.
 1. Clean up your changes and commit them, making sure to follow the
    [Nixpkgs Contribution Guidelines](../../../../CONTRIBUTING.md).
 1. Open a PR and await a review from the current maintainers.
diff --git a/pkgs/by-name/at/athens/package.nix b/pkgs/by-name/at/athens/package.nix
index 53cba1793a3e..547e6f02329b 100644
--- a/pkgs/by-name/at/athens/package.nix
+++ b/pkgs/by-name/at/athens/package.nix
@@ -1,24 +1,29 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
-, testers
-, athens
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  testers,
+  athens,
 }:
+
 buildGoModule rec {
   pname = "athens";
-  version = "0.14.1";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "gomods";
     repo = "athens";
     rev = "v${version}";
-    hash = "sha256-vpg5EcQSxVFjDFKa4oHwF5fNHhLWtj3ZMi2wbMZNn/8=";
+    hash = "sha256-JERyECQ3/pI+ApWyWvUwZqkGBmA+6pP7Uj+RfpUGsOw=";
   };
 
-  vendorHash = "sha256-LajNPzGbWqW+9aqiquk2LvSUjKwi1gbDY4cKXmn3PWk=";
+  vendorHash = "sha256-tCpwiqJHGRo9vqUh00k+tg4X6WNPnnknV7zjPkgs6Zs=";
 
   CGO_ENABLED = "0";
-  ldflags = [ "-s" "-w" "-X github.com/gomods/athens/pkg/build.version=${version}" ];
+  ldflags = [
+    "-s"
+    "-X github.com/gomods/athens/pkg/build.version=${version}"
+  ];
 
   subPackages = [ "cmd/proxy" ];
 
@@ -27,9 +32,7 @@ buildGoModule rec {
   '';
 
   passthru = {
-    tests.version = testers.testVersion {
-      package = athens;
-    };
+    tests.version = testers.testVersion { package = athens; };
   };
 
   meta = with lib; {
@@ -38,7 +41,10 @@ buildGoModule rec {
     changelog = "https://github.com/gomods/athens/releases/tag/v${version}";
     license = licenses.mit;
     mainProgram = "athens";
-    maintainers = with maintainers; [ katexochen malt3 ];
+    maintainers = with maintainers; [
+      katexochen
+      malt3
+    ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/by-name/ca/capslock/package.nix b/pkgs/by-name/ca/capslock/package.nix
index 87da681fe958..b9290fed59f8 100644
--- a/pkgs/by-name/ca/capslock/package.nix
+++ b/pkgs/by-name/ca/capslock/package.nix
@@ -1,37 +1,36 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "capslock";
-  version = "0.1.1";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "capslock";
     rev = "v${version}";
-    hash = "sha256-mGrq43YCjF137c5ynQxL7IXDCUbnbBLv5E0tw/boObE=";
+    hash = "sha256-xeezGU9bI1MwonSGv+XimSfboMQr/1TPMTduDQ+MP1g=";
   };
 
-  vendorHash = "sha256-WTbHcVARbz7cvAY7IZnACTrN5h9NXWXfxxEWq4hssOM=";
+  vendorHash = "sha256-Z4oj+af8jqqhgHQrTb+lkbIMMa/yOnvkMti/s+wiQsI=";
 
-  subPackages = [
-    "cmd/capslock"
-  ];
+  subPackages = [ "cmd/capslock" ];
 
   CGO_ENABLED = "0";
 
-  ldflags = [
-    "-s"
-    "-w"
-  ];
+  ldflags = [ "-s" ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Capability analysis CLI for Go packages that informs users of which privileged operations a given package can access";
     homepage = "https://github.com/google/capslock";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     mainProgram = "capslock";
-    maintainers = with maintainers; [ katexochen ];
+    maintainers = with lib.maintainers; [ katexochen ];
   };
 }
diff --git a/pkgs/by-name/cr/cronutils/package.nix b/pkgs/by-name/cr/cronutils/package.nix
index 40c03a0e55bb..f1060ba2d2cb 100644
--- a/pkgs/by-name/cr/cronutils/package.nix
+++ b/pkgs/by-name/cr/cronutils/package.nix
@@ -1,14 +1,19 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cronutils";
   version = "1.10";
 
-  outputs = [ "out" "man" ];
+  outputs = [
+    "out"
+    "man"
+  ];
 
   src = fetchFromGitHub {
     owner = "google";
@@ -43,12 +48,14 @@ stdenv.mkDerivation (finalAttrs: {
     "-Wno-format-nonliteral"
   ]);
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     changelog = "https://github.com/google/cronutils/releases/tag/version%2F${finalAttrs.version}";
     description = "Utilities to assist running periodic batch processing jobs";
     homepage = "https://github.com/google/cronutils";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ katexochen ];
-    platforms = platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ katexochen ];
+    platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/by-name/fo/formatjson5/package.nix b/pkgs/by-name/fo/formatjson5/package.nix
index 6adfece33862..852b4096254c 100644
--- a/pkgs/by-name/fo/formatjson5/package.nix
+++ b/pkgs/by-name/fo/formatjson5/package.nix
@@ -1,8 +1,10 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, stdenv
-, darwin
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  stdenv,
+  darwin,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,13 +21,9 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-zPgaZPDyNVPmBXz6QwOYnmh/sbJ8aPST8znLMfIWejk=";
 
-  buildInputs = lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
+  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
-  cargoBuildFlags = [
-    "--example formatjson5"
-  ];
+  cargoBuildFlags = [ "--example formatjson5" ];
 
   postInstall =
     let
@@ -35,6 +33,8 @@ rustPlatform.buildRustPackage rec {
       install -D target/${cargoTarget}/release/examples/formatjson5 $out/bin/formatjson5
     '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "JSON5 formatter";
     homepage = "https://github.com/google/json5format";
diff --git a/pkgs/by-name/go/goat/package.nix b/pkgs/by-name/go/goat/package.nix
index 7dfc18719103..77c1e61605f3 100644
--- a/pkgs/by-name/go/goat/package.nix
+++ b/pkgs/by-name/go/goat/package.nix
@@ -1,26 +1,31 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
 }:
+
 buildGoModule {
   pname = "goat";
-  version = "unstable-2022-08-15"; # Upstream currently isn't doing tags/releases.
+  version = "0-unstable-2024-07-31"; # Upstream currently isn't doing tags/releases.
 
   src = fetchFromGitHub {
     owner = "blampe";
     repo = "goat";
-    rev = "07bb911fe3106cc3c1d1097318a9fffe816b59fe";
-    hash = "sha256-gSSDp9Q2hGH85dkE7RoER5ig+Cz1oSOD0FNRBeTZM4U=";
+    rev = "177de93b192b8ffae608e5d9ec421cc99bf68402";
+    hash = "sha256-/DR6RN7dCROp18P7dgm4DMppwdtYl0AOVNMEtXz8ldk=";
   };
 
   vendorHash = "sha256-24YllmSUzRcqWbJ8NLyhsJaoGG2+yE8/eXX6teJ1nV8=";
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
     description = "Go ASCII Tool. Render ASCII art as SVG diagrams";
     homepage = "https://github.com/blampe/goat";
-    license = licenses.mit;
-    maintainers = with maintainers; [ katexochen ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ katexochen ];
     mainProgram = "goat";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/hp/hpp-fcl/package.nix b/pkgs/by-name/hp/hpp-fcl/package.nix
new file mode 100644
index 000000000000..78ce6456c301
--- /dev/null
+++ b/pkgs/by-name/hp/hpp-fcl/package.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  doxygen,
+  boost,
+  eigen,
+  assimp,
+  octomap,
+  qhull,
+  pythonSupport ? false,
+  python3Packages,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hpp-fcl";
+  version = "2.4.5";
+
+  src = fetchFromGitHub {
+    owner = "humanoid-path-planner";
+    repo = "hpp-fcl";
+    rev = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-0OORdtT7vMpvK3BPJvtvuLcz0+bfu1+nVvzs3y+LyQw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    doxygen
+  ] ++ lib.optionals pythonSupport [ python3Packages.numpy ];
+
+  propagatedBuildInputs =
+    [
+      assimp
+      qhull
+      octomap
+      zlib
+    ]
+    ++ lib.optionals (!pythonSupport) [
+      boost
+      eigen
+    ]
+    ++ lib.optionals pythonSupport [
+      python3Packages.boost
+      python3Packages.eigenpy
+    ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "HPP_FCL_HAS_QHULL" true)
+    (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
+    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
+  ];
+
+  doCheck = true;
+  # pythonImportsCheck, but in stdenv.mkDerivation
+  postInstall = lib.optionalString pythonSupport ''
+    PYTHONPATH=$out/${python3Packages.python.sitePackages}:$PYTHONPATH
+    python -c "import hppfcl"
+  '';
+
+  outputs = [
+    "dev"
+    "out"
+    "doc"
+  ];
+  postFixup = ''
+    moveToOutput share/ament_index "$dev"
+    moveToOutput share/${finalAttrs.pname} "$dev"
+  '';
+
+  meta = {
+    description = "Extension of the Flexible Collision Library";
+    homepage = "https://github.com/humanoid-path-planner/hpp-fcl";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+})
diff --git a/pkgs/by-name/ig/igvm-tooling/package.nix b/pkgs/by-name/ig/igvm-tooling/package.nix
index e5cb4a564b79..6cdc3e786a6c 100644
--- a/pkgs/by-name/ig/igvm-tooling/package.nix
+++ b/pkgs/by-name/ig/igvm-tooling/package.nix
@@ -1,9 +1,11 @@
-{ lib
-, python3
-, fetchFromGitHub
-, fetchpatch
-, which
-, acpica-tools
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  fetchpatch,
+  which,
+  acpica-tools,
+  nix-update-script,
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -38,18 +40,20 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [ acpica-tools ];
 
-  propagatedBuildInputs = (with python3.pkgs; [
-    setuptools
-    ecdsa
-    cstruct
-    pyelftools
-    pytest
-    cached-property
-    frozendict
-  ]) ++ [
-    acpica-tools
-    which
-  ];
+  propagatedBuildInputs =
+    (with python3.pkgs; [
+      setuptools
+      ecdsa
+      cstruct
+      pyelftools
+      pytest
+      cached-property
+      frozendict
+    ])
+    ++ [
+      acpica-tools
+      which
+    ];
 
   postInstall = ''
     mkdir -p $out/share/igvm-tooling/acpi/acpi-clh
@@ -58,11 +62,16 @@ python3.pkgs.buildPythonApplication rec {
     find $out/share/igvm-tooling/acpi -name "*.dsl" -exec iasl -f {} \;
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "IGVM Image Generator";
     homepage = "https://github.com/microsoft/igvm-tooling";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ malt3 katexochen ];
+    maintainers = with lib.maintainers; [
+      malt3
+      katexochen
+    ];
     changelog = "https://github.com/microsoft/igvm-tooling/releases/tag/igvm-${version}";
     mainProgram = "igvmgen";
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/in/inv-sig-helper/package.nix b/pkgs/by-name/in/inv-sig-helper/package.nix
new file mode 100644
index 000000000000..5070b60abcdd
--- /dev/null
+++ b/pkgs/by-name/in/inv-sig-helper/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+
+  # nativeBuildInputs
+  pkg-config,
+
+  # buildInputs
+  openssl,
+  darwin,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "inv-sig-helper";
+  version = "0-unstable-2024-08-17";
+
+  src = fetchFromGitHub {
+    owner = "iv-org";
+    repo = "inv_sig_helper";
+    rev = "215d32c76e5e9e598de6e4f8542316f80dd92f57";
+    hash = "sha256-Ge0XoWrscyZSrkmtDPkAnv96IVylKZTcgGgonbFV43I=";
+  };
+
+  cargoHash = "sha256-JVpLUhNJ7/4WZwLn/zOurpP8kF5WblF3nphJh6keHG8=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs =
+    [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Security
+      darwin.apple_sdk.frameworks.SystemConfiguration
+    ];
+
+  meta = {
+    description = "Rust service that decrypts YouTube signatures and manages player information";
+    homepage = "https://github.com/iv-org/inv_sig_helper";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "inv_sig_helper_rust";
+  };
+}
diff --git a/pkgs/by-name/le/leftwm-config/package.nix b/pkgs/by-name/le/leftwm-config/package.nix
new file mode 100644
index 000000000000..90c91a261e0d
--- /dev/null
+++ b/pkgs/by-name/le/leftwm-config/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "leftwm-config";
+  version = "0-unstable-2024-03-13";
+
+  src = fetchFromGitHub {
+    owner = "leftwm";
+    repo = "leftwm-config";
+    rev = "a9f2f21ece3a01d6c36610295ae3163644d3f99e";
+    hash = "sha256-wyb/26EyNyBJeTDUvnMxlMiQjaCGBES8t4VteNY1I/A=";
+  };
+
+  cargoHash = "sha256-U3mgbG9h2cDqr0aqxbI2CJUOweIoDXDxmsWg0zxolSo=";
+
+  meta = {
+    description = "Little satellite utility for LeftWM";
+    homepage = "https://github.com/leftwm/leftwm-config";
+    maintainers = with lib.maintainers; [ denperidge ];
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/le/leftwm-theme/package.nix b/pkgs/by-name/le/leftwm-theme/package.nix
new file mode 100644
index 000000000000..c10601a0f1f9
--- /dev/null
+++ b/pkgs/by-name/le/leftwm-theme/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  openssl,
+  pkg-config,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "leftwm-theme";
+  version = "unstable-2024-03-05";
+
+  src = fetchFromGitHub {
+    owner = "leftwm";
+    repo = "leftwm-theme";
+    rev = "b394824ff874b269a90c29e2d45b0cacc4d209f5";
+    hash = "sha256-cV4tY1qKNluSSGf+WwKFK3iVE7cMevafl6qQvhy1flE=";
+  };
+
+  cargoHash = "sha256-VEQn1LFXiZCVR2WgOFoHo18d3cdIoq9/zNjg8GMs0j8=";
+
+  checkFlags = [
+    # direct writing /tmp
+    "--skip=models::config::test::test_config_new"
+    # with network access when testing
+    "--skip=operations::update::test::test_update_repos"
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  env = {
+    OPENSSL_NO_VENDOR = 1;
+  };
+
+  meta = {
+    description = "Theme manager for LeftWM";
+    homepage = "https://github.com/leftwm/leftwm-theme";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ denperidge ];
+  };
+}
diff --git a/pkgs/by-name/oe/oelint-adv/package.nix b/pkgs/by-name/oe/oelint-adv/package.nix
index af8b81d00eb0..572bca21f63e 100644
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@@ -6,13 +6,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "oelint-adv";
-  version = "5.7.2";
+  version = "6.0.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_adv";
-    hash = "sha256-nHtOSOAKbmbmihaL8qvXBOB76LaC9E95UFQ479X/Rgo=";
+    hash = "sha256-tN+DHLj/sey8CipQT5nnwym0JkiIkR8WJg2jKys+4Yk=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index f1ecbaa46452..eb0ca0e2614f 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2024-08-30";
+  version = "0-unstable-2024-09-05";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "231e1330c3210d31f08bf739ef69f096f0732291";
-    hash = "sha256-oD67tMJ23FBZzELtTdFZ2E7AtKs9m3T6L1rRuibfvY8=";
+    rev = "3444d8aa86bb4ad3907c7d6886feafd65b8c2ff8";
+    hash = "sha256-aHSuu9dYmY4ZKs6bzJostzeO1hFgkt/VBAbs2Ntj6dU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sn/snicat/package.nix b/pkgs/by-name/sn/snicat/package.nix
index d38a45f59389..38316a5dcfc7 100644
--- a/pkgs/by-name/sn/snicat/package.nix
+++ b/pkgs/by-name/sn/snicat/package.nix
@@ -1,31 +1,27 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, fetchpatch
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:
+
 buildGoModule rec {
   pname = "snicat";
-  version = "0.0.1";
+  version = "0.0.1-unstable-2024-09-05";
 
   src = fetchFromGitHub {
     owner = "CTFd";
     repo = "snicat";
-    rev = version;
-    hash = "sha256-fFlTBOz127le2Y7F9KKhbcldcyFEpAU5QiJ4VCAPs9Y=";
+    rev = "8c8f06e59d5aedb9a97115a4e0eafa75b17a6cdf";
+    hash = "sha256-71wVth+VzEnGW8ErWmj6XjhNtVpx/q8lViIA71njwqU=";
   };
 
-  patches = [
-    # Migrate to Go modules
-    (fetchpatch {
-      url = "https://github.com/CTFd/snicat/commit/098a5ce3141bae5d2e188338d78517d710d10f70.patch";
-      hash = "sha256-pIdXViUz14nkvL1H3u3oFkm308XA2POtKIGZOKDO6p8=";
-    })
-  ];
-
   vendorHash = "sha256-27ykI9HK1jFanxwa6QrN6ZS548JbFNSZHaXr4ciCVOE=";
   proxyVendor = true;
 
-  ldflags = [ "-s" "-X main.version=v${version}" ];
+  ldflags = [
+    "-s"
+    "-X main.version=v${version}"
+  ];
 
   postInstall = ''
     mv $out/bin/snicat $out/bin/sc
diff --git a/pkgs/by-name/te/templ/package.nix b/pkgs/by-name/te/templ/package.nix
index 985b6036374d..8e90a4823ffc 100644
--- a/pkgs/by-name/te/templ/package.nix
+++ b/pkgs/by-name/te/templ/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "templ";
-  version = "0.2.771";
+  version = "0.2.778";
 
   src = fetchFromGitHub {
     owner = "a-h";
     repo = "templ";
     rev = "v${version}";
-    hash = "sha256-1S8rdq+dRVh5NulXZw70TC5NjaWb6YdIfT6NcZTvx8U=";
+    hash = "sha256-lU8aVTw73HX0lNGPyD8Xnvtnr2VFTXv/S6xCVn6Lg74=";
   };
 
   vendorHash = "sha256-ZWY19f11+UI18jeHYIEZjdb9Ii74mD6w+dYRLPkdfBU=";
diff --git a/pkgs/by-name/up/uplosi/package.nix b/pkgs/by-name/up/uplosi/package.nix
index 0470054f0f22..074bf872f987 100644
--- a/pkgs/by-name/up/uplosi/package.nix
+++ b/pkgs/by-name/up/uplosi/package.nix
@@ -1,8 +1,11 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
-, installShellFiles
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  installShellFiles,
+  nix-update-script,
 }:
+
 buildGoModule rec {
   pname = "uplosi";
   version = "0.3.0";
@@ -17,7 +20,10 @@ buildGoModule rec {
   vendorHash = "sha256-o7PPgW3JL47G6Na5n9h3RasRMfU25FD1U/wCMaydRmc=";
 
   CGO_ENABLED = "0";
-  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
+  ldflags = [
+    "-s"
+    "-X main.version=${version}"
+  ];
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -28,13 +34,18 @@ buildGoModule rec {
       --zsh <($out/bin/uplosi completion zsh)
   '';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Upload OS images to cloud provider";
     homepage = "https://github.com/edgelesssys/uplosi";
     changelog = "https://github.com/edgelesssys/uplosi/releases/tag/v${version}";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
     mainProgram = "uplosi";
-    maintainers = with maintainers; [ katexochen malt3 ];
-    platforms = platforms.unix;
+    maintainers = with lib.maintainers; [
+      katexochen
+      malt3
+    ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/xt/xtf/package.nix b/pkgs/by-name/xt/xtf/package.nix
new file mode 100644
index 000000000000..b30c0a973f9f
--- /dev/null
+++ b/pkgs/by-name/xt/xtf/package.nix
@@ -0,0 +1,78 @@
+{
+  lib,
+  fetchgit,
+  unstableGitUpdater,
+  stdenv,
+  doxygen,
+  graphviz,
+  python3Packages,
+}:
+
+stdenv.mkDerivation {
+  pname = "xtf";
+  version = "0-unstable-2024-07-25";
+
+  outputs = [
+    "out" # xtf-runner and test suite.
+    "doc" # Autogenerated HTML documentation website.
+    "dev" # Development headers.
+  ];
+
+  src = fetchgit {
+    url = "https://xenbits.xenproject.org/git-http/xtf.git";
+    rev = "f37c4574dd79d058c035be989ac6648508556a1a";
+    hash = "sha256-3eOKQXdyFX0iY90UruK8lLfnXQt+cOlvyW/KMj2hczQ=";
+  };
+
+  nativeBuildInputs =
+    (with python3Packages; [
+      python
+      wrapPython
+    ])
+    ++ [
+      doxygen
+      graphviz
+    ];
+
+  buildFlags = [ "doxygen" ];
+
+  installFlags = [
+    "xtfdir=$(out)/share/xtf"
+  ];
+
+  postInstall =
+    # Much like Xen, XTF installs its files to dist/nix/store/*/*,
+    # so we need to copy them to the right place.
+    ''
+      mkdir -p ''${!outputBin}/share
+      cp -prvd dist/nix/store/*/* ''${!outputBin}
+    ''
+    # The documentation and development headers aren't in the dist/
+    # folder, so we copy those too.
+    + ''
+      mkdir -p ''${!outputDoc}/share/doc/xtf
+      cp -prvd docs/autogenerated/html ''${!outputDoc}/share/doc/xtf
+
+      mkdir -p ''${!outputDev}/include
+      cp -prvd include ''${!outputDev}
+    ''
+    # Wrap xtf-runner, and link it to $out/bin.
+    # This is necessary because the real xtf-runner should
+    # be in the same directory as the tests/ directory.
+    + ''
+      wrapPythonProgramsIn "''${!outputBin}/share/xtf" "''${!outputBin} $pythonPath"
+      mkdir -p ''${!outputBin}/bin
+      ln -s ''${!outputBin}/share/xtf/xtf-runner ''${!outputBin}/bin/xtf-runner
+    '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Xen Test Framework and Suite for creating microkernel-based tests";
+    homepage = "https://xenbits.xenproject.org/docs/xtf/index.html";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ sigmasquadron ];
+    mainProgram = "xtf-runner";
+    platforms = lib.lists.intersectLists lib.platforms.linux lib.platforms.x86_64;
+  };
+}
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index 0d9702caffeb..89d33b59dc4b 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "31.5.0";
+  version = "31.6.0";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-kjydpYLOw1uZGmedemZKey0go8DRmgnUq5nrVM0NfxY=";
+    hash = "sha256-5FqfJCquF26Mbpm2pN9P1gg4B2nASZz9utFJWBgScLY=";
   };
 
-  npmDepsHash = "sha256-PpoSzHQMqdlGfcWvIH34ATcf4HZB+VbA6X7zqzV9xZk=";
+  npmDepsHash = "sha256-/qx+pnXbAgdkUCHH2SQSgI0omjrL3PLtni3iLbswd3c=";
 
   nativeBuildInputs = [
     remarshal
diff --git a/pkgs/desktops/deepin/apps/deepin-reader/use-pkg-config.diff b/pkgs/desktops/deepin/apps/deepin-reader/use-pkg-config.diff
deleted file mode 100644
index 7993cecd30ad..000000000000
--- a/pkgs/desktops/deepin/apps/deepin-reader/use-pkg-config.diff
+++ /dev/null
@@ -1,46 +0,0 @@
-diff --git a/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri b/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri
-index 3e04f340..894b0ac7 100755
---- a/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri
-+++ b/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri
-@@ -20,13 +20,8 @@ DEFINES +=  USE_SYSTEM_LIBJPEG \
-             USE_SYSTEM_LIBOPENJPEG2 \
-             USE_SYSTEM_FREETYPE
- 
--INCLUDEPATH += /usr/include/openjpeg-2.3 \
--               /usr/include/openjpeg-2.4 \
--               /usr/include/freetype2 \
--               /usr/include/freetype2/freetype \
--               /usr/include/freetype2/freetype/config
--
--LIBS += -lopenjp2 -llcms2 -lfreetype
-+CONFIG += link_pkgconfig
-+PKGCONFIG += libopenjp2 lcms2 freetype2
- 
- #QMAKE_CXXFLAGS += "-Wc++11-narrowing"  #is_clang
- #QMAKE_CXXFLAGS += "-Wno-inconsistent-missing-override"  #is_clang Suppress no override warning for overridden functions.
-diff --git a/3rdparty/deepin-pdfium/src/src.pro b/3rdparty/deepin-pdfium/src/src.pro
-index 196b91d3..bda71ff4 100755
---- a/3rdparty/deepin-pdfium/src/src.pro
-+++ b/3rdparty/deepin-pdfium/src/src.pro
-@@ -2,7 +2,9 @@ TARGET = $$PWD/../lib/deepin-pdfium
- 
- TEMPLATE = lib
- 
--CONFIG += c++14
-+CONFIG += c++14 link_pkgconfig
-+
-+PKGCONFIG += chardet
- 
- ###安全漏洞检测
- #QMAKE_CXX += -g -fsanitize=undefined,address -O2
-@@ -28,10 +30,6 @@ include($$PWD/3rdparty/pdfium/pdfium.pri)
- 
- INCLUDEPATH += $$PWD/../include
- 
--INCLUDEPATH += /usr/include/chardet
--
--LIBS += -lchardet
--
- public_headers += \
-     $$PWD/../include/dpdfglobal.h \
-     $$PWD/../include/dpdfdoc.h \
diff --git a/pkgs/development/compilers/openjdk/22.nix b/pkgs/development/compilers/openjdk/22.nix
index 18ab52f089d3..b022e492e3f9 100644
--- a/pkgs/development/compilers/openjdk/22.nix
+++ b/pkgs/development/compilers/openjdk/22.nix
@@ -42,6 +42,7 @@
 , gtk3
 , glib
 , writeShellScript
+, versionCheckHook
 }:
 
 let
@@ -254,6 +255,13 @@ stdenv.mkDerivation (finalAttrs: {
   pos = __curPos;
   meta = import ./meta.nix lib featureVersion;
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/java";
+
+  doInstallCheck = true;
+
   passthru = {
     updateScript =
       let
diff --git a/pkgs/development/libraries/hpp-fcl/default.nix b/pkgs/development/libraries/hpp-fcl/default.nix
deleted file mode 100644
index 0359abec9b08..000000000000
--- a/pkgs/development/libraries/hpp-fcl/default.nix
+++ /dev/null
@@ -1,74 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, doxygen
-, boost
-, eigen
-, assimp
-, octomap
-, qhull
-, pythonSupport ? false
-, python3Packages
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "hpp-fcl";
-  version = "2.4.5";
-
-  src = fetchFromGitHub {
-    owner = "humanoid-path-planner";
-    repo = "hpp-fcl";
-    rev = "v${finalAttrs.version}";
-    fetchSubmodules = true;
-    hash = "sha256-0OORdtT7vMpvK3BPJvtvuLcz0+bfu1+nVvzs3y+LyQw=";
-  };
-
-  strictDeps = true;
-
-  nativeBuildInputs = [
-    cmake
-    doxygen
-  ] ++ lib.optionals pythonSupport [
-    python3Packages.numpy
-  ];
-
-  propagatedBuildInputs = [
-    assimp
-    qhull
-    octomap
-  ] ++ lib.optionals (!pythonSupport) [
-    boost
-    eigen
-  ] ++ lib.optionals pythonSupport [
-    python3Packages.boost
-    python3Packages.eigenpy
-  ];
-
-  cmakeFlags = [
-    "-DHPP_FCL_HAS_QHULL=ON"
-    "-DINSTALL_DOCUMENTATION=ON"
-  ] ++ lib.optionals (!pythonSupport) [
-    "-DBUILD_PYTHON_INTERFACE=OFF"
-  ];
-
-  doCheck = true;
-  pythonImportsCheck = lib.optionals (!pythonSupport) [
-    "hppfcl"
-  ];
-
-  outputs = [ "dev" "out" "doc" ];
-  postFixup = ''
-    moveToOutput share/ament_index "$dev"
-    moveToOutput share/${finalAttrs.pname} "$dev"
-  '';
-
-
-  meta = with lib; {
-    description = "Extension of the Flexible Collision Library";
-    homepage = "https://github.com/humanoid-path-planner/hpp-fcl";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ nim65s ];
-    platforms = platforms.unix;
-  };
-})
diff --git a/pkgs/development/python-modules/cwl-utils/default.nix b/pkgs/development/python-modules/cwl-utils/default.nix
index fe6c94829e0e..8e5eb6dd772d 100644
--- a/pkgs/development/python-modules/cwl-utils/default.nix
+++ b/pkgs/development/python-modules/cwl-utils/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-utils";
-  version = "0.33";
+  version = "0.34";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = "cwl-utils";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+GvG5Uu2nQWYCcuAkBkegsmMCWhf269jH6Zcex99I4M=";
+    hash = "sha256-HzLDUhiFegYPWAKt3YoiWiunNHcDEx9FvRXwxKd7wp0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-auth-oauthlib/default.nix b/pkgs/development/python-modules/google-auth-oauthlib/default.nix
index 863cf6bb6dfc..3f1b3a06d0d4 100644
--- a/pkgs/development/python-modules/google-auth-oauthlib/default.nix
+++ b/pkgs/development/python-modules/google-auth-oauthlib/default.nix
@@ -14,31 +14,32 @@
 
 buildPythonPackage rec {
   pname = "google-auth-oauthlib";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-KS0tN4M0nysHNKCgIHseHjIqwZPCwJ2PfGE/t8xQHqg=";
+    pname = "google_auth_oauthlib";
+    inherit version;
+    hash = "sha256-r9DK0JKi6qU82OgphVfW3hA0xstKdAUAtTV7ZIr5cmM=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     google-auth
     requests-oauthlib
   ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     tool = [ click ];
   };
 
   nativeCheckInputs = [
     mock
     pytestCheckHook
-  ] ++ passthru.optional-dependencies.tool;
+  ] ++ optional-dependencies.tool;
 
   disabledTests =
     [
@@ -53,11 +54,11 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "google_auth_oauthlib" ];
 
   meta = with lib; {
-    changelog = "https://github.com/googleapis/google-auth-library-python-oauthlib/blob/v${version}/CHANGELOG.md";
     description = "Google Authentication Library: oauthlib integration";
     homepage = "https://github.com/GoogleCloudPlatform/google-auth-library-python-oauthlib";
+    changelog = "https://github.com/googleapis/google-auth-library-python-oauthlib/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
-    mainProgram = "google-oauthlib-tool";
     maintainers = with maintainers; [ terlar ];
+    mainProgram = "google-oauthlib-tool";
   };
 }
diff --git a/pkgs/development/python-modules/mkdocstrings/default.nix b/pkgs/development/python-modules/mkdocstrings/default.nix
index 51c8c21ba771..b0bfc0ca1554 100644
--- a/pkgs/development/python-modules/mkdocstrings/default.nix
+++ b/pkgs/development/python-modules/mkdocstrings/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocstrings";
-  version = "0.26.0";
+  version = "0.26.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "mkdocstrings";
     repo = "mkdocstrings";
     rev = "refs/tags/${version}";
-    hash = "sha256-266Kd3jp35RBvN1t11OiWszV5ehsZUXZxXpU+dA9XSg=";
+    hash = "sha256-YV9Cncry+RXXGxRYN4dXp5E2msGA4Kq2QSvcPywWV2c=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index aed5abe15258..d992ac3156f8 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "1.0.2.20240906";
+  version = "1.0.2.20240907";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AHvj0eyJKPGXEIk6Cu/q2cDDiGCDH/QvBPGm9Cfy2w8=";
+    hash = "sha256-+DzSFzdgGyirt8X+vW7fzofyHOLXbuVySxV+8CZ5ZlQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyaussiebb/default.nix b/pkgs/development/python-modules/pyaussiebb/default.nix
index f33fe89fc2ea..57e758d25f9f 100644
--- a/pkgs/development/python-modules/pyaussiebb/default.nix
+++ b/pkgs/development/python-modules/pyaussiebb/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pyaussiebb";
-  version = "0.1.1";
+  version = "0.1.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,23 +21,23 @@ buildPythonPackage rec {
     owner = "yaleman";
     repo = "aussiebb";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XNf9vYMlTLqhYIVNw9GjPcXpOm5EYCcC4aGukR8g3zc=";
+    hash = "sha256-IW2HraJbgvf0G1eRXNpnsPMWlLXi2P9DTyk+tG5Hc2U=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'requests = "^2.27.1"' 'requests = "*"'
+  '';
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  dependencies = [
     aiohttp
     requests
     loguru
     pydantic
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'requests = "^2.27.1"' 'requests = "*"'
-  '';
-
   # Tests require credentials and requests-testing
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix
index b7ce8bd26d17..963e06ea0061 100644
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.33";
+  version = "0.2.34";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyExploitDb";
     inherit version;
-    hash = "sha256-K7IK1Cc8SvEgGvszEnSZepQ+ZvqoVdd+7QdnFk7imTk=";
+    hash = "sha256-5vWR6LNJknxVQ5Mmgw+c4clXhVQsHc68R1MMdzdsMgM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pypoolstation/default.nix b/pkgs/development/python-modules/pypoolstation/default.nix
index f9ddc503ede6..14e2c906f9a5 100644
--- a/pkgs/development/python-modules/pypoolstation/default.nix
+++ b/pkgs/development/python-modules/pypoolstation/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pypoolstation";
-  version = "0.5.4";
+  version = "0.5.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SA5Eqz0WoisVVAjeKQymVh17+fHa7SuiYXgOL2BiJcc=";
+    hash = "sha256-E5/Z7TgIZlbIDB9I+DJI812ce8ctidDAXGCHBFzk7F8=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/python-xz/default.nix b/pkgs/development/python-modules/python-xz/default.nix
index 83fbc0997e57..526c54245104 100644
--- a/pkgs/development/python-modules/python-xz/default.nix
+++ b/pkgs/development/python-modules/python-xz/default.nix
@@ -9,18 +9,18 @@
 buildPythonPackage rec {
   pname = "python-xz";
   version = "0.5.0";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-oYjwQ26BFFXxvaYdzp2+bw/BQwM0v/n1r9DmaLs1R3Q=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];
 
-  # has no tests
+  # Module has no tests
   doCheck = false;
 
   pythonImportsCheck = [ "xz" ];
@@ -28,6 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Pure Python library for seeking within compressed xz files";
     homepage = "https://github.com/Rogdham/python-xz";
+    changelog = "https://github.com/Rogdham/python-xz/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with lib.maintainers; [ mxmlnkn ];
     platforms = platforms.all;
diff --git a/pkgs/development/python-modules/ratarmount/default.nix b/pkgs/development/python-modules/ratarmount/default.nix
index 8e32579cb737..bdfa8a21c883 100644
--- a/pkgs/development/python-modules/ratarmount/default.nix
+++ b/pkgs/development/python-modules/ratarmount/default.nix
@@ -2,26 +2,43 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonOlder,
   fusepy,
+  indexed-gzip,
+  indexed-zstd,
+  libarchive-c,
+  python-xz,
+  pythonOlder,
+  rapidgzip,
+  rarfile,
   ratarmountcore,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "ratarmount";
-  version = "0.15.1";
-  format = "setuptools";
+  version = "0.15.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hprXZGgE2fpg8Km3gWO60e7teUB4Age5skNPc4p+wIg=";
+    hash = "sha256-1JAj9vA/aZLDvZC7j5PD1OL9n4I0gag4Ezc0i68OQsw=";
   };
 
-  propagatedBuildInputs = [
-    ratarmountcore
+  pythonRelaxDeps = [ "python-xz" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     fusepy
+    indexed-gzip
+    indexed-zstd
+    libarchive-c
+    python-xz
+    rapidgzip
+    rarfile
+    ratarmountcore
   ];
 
   checkPhase = ''
@@ -34,10 +51,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Mounts archives as read-only file systems by way of indexing";
-    mainProgram = "ratarmount";
     homepage = "https://github.com/mxmlnkn/ratarmount";
+    changelog = "https://github.com/mxmlnkn/ratarmount/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with lib.maintainers; [ mxmlnkn ];
-    platforms = platforms.all;
+    mainProgram = "ratarmount";
   };
 }
diff --git a/pkgs/development/python-modules/ratarmountcore/default.nix b/pkgs/development/python-modules/ratarmountcore/default.nix
index eb97b7a4a64e..b966e0a319be 100644
--- a/pkgs/development/python-modules/ratarmountcore/default.nix
+++ b/pkgs/development/python-modules/ratarmountcore/default.nix
@@ -2,53 +2,61 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
-  pytestCheckHook,
-  indexed-bzip2,
   indexed-gzip,
   indexed-zstd,
+  libarchive-c,
+  pytestCheckHook,
   python-xz,
-  setuptools,
+  pythonOlder,
   rapidgzip,
   rarfile,
+  setuptools,
   zstandard, # Python bindings
   zstd, # System tool
 }:
 
 buildPythonPackage rec {
   pname = "ratarmountcore";
-  version = "0.6.3";
+  version = "0.7.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "mxmlnkn";
     repo = "ratarmount";
     rev = "core-v${version}";
-    hash = "sha256-2jG066BUkhyHRqRyFAucQRJrjXQNw2ccCxERKkltO3Y=";
+    hash = "sha256-2LPGKdofx2ID8BU0dZhGiZ3tUkd+niEVGvTSBFX4InU=";
     fetchSubmodules = true;
   };
 
   sourceRoot = "${src.name}/core";
 
-  nativeBuildInputs = [ setuptools ];
-  propagatedBuildInputs = [
-    indexed-gzip
-    indexed-bzip2
-    indexed-zstd
-    python-xz
-    rapidgzip
-    rarfile
-  ];
+  build-system = [ setuptools ];
 
-  pythonImportsCheck = [ "ratarmountcore" ];
+  optional-dependencies = {
+    full = [
+      indexed-gzip
+      indexed-zstd
+      python-xz
+      rapidgzip
+      rarfile
+    ];
+    _7z = [ libarchive-c ];
+    bzip2 = [ rapidgzip ];
+    gzip = [ indexed-gzip ];
+    rar = [ rarfile ];
+    xz = [ python-xz ];
+    zstd = [ indexed-zstd ];
+  };
 
   nativeCheckInputs = [
     pytestCheckHook
     zstandard
     zstd
-  ];
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
+
+  pythonImportsCheck = [ "ratarmountcore" ];
 
   disabledTestPaths = [
     # Disable this test because for arcane reasons running pytest with nix-build uses 10-100x
@@ -60,9 +68,17 @@ buildPythonPackage rec {
     "tests/test_BlockParallelReaders.py"
   ];
 
+  disabledTests = [
+    # Tests with issues
+    "test_file_versions"
+    "test_stream_compressed"
+    "test_chimera_file"
+  ];
+
   meta = with lib; {
     description = "Library for accessing archives by way of indexing";
     homepage = "https://github.com/mxmlnkn/ratarmount/tree/master/core";
+    changelog = "https://github.com/mxmlnkn/ratarmount/blob/core-v${version}/core/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with lib.maintainers; [ mxmlnkn ];
   };
diff --git a/pkgs/development/python-modules/ydata-profiling/default.nix b/pkgs/development/python-modules/ydata-profiling/default.nix
index 8ad3ac196714..2587e485b48b 100644
--- a/pkgs/development/python-modules/ydata-profiling/default.nix
+++ b/pkgs/development/python-modules/ydata-profiling/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "ydata-profiling";
-  version = "4.8.3";
+  version = "4.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -36,14 +36,18 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ydataai";
     repo = pname;
-    rev = "refs/tags/${version}";
-    hash = "sha256-tMwhoVnn65EvZK5NBvh/G36W8tH7I9qaL+NTK3IZVdI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-OZCgtnsLXLJ0m1t/mWqQTbFL8DPKaR9Tr7QCGT2HpvE=";
   };
 
   preBuild = ''
     echo ${version} > VERSION
   '';
 
+  pythonRelaxDeps = [
+    "scipy"
+  ];
+
   propagatedBuildInputs = [
     dacite
     htmlmin
diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 04d1136a9386..0f82433fad6c 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sgt-puzzles";
-  version = "20240827.52afffa";
+  version = "20240909.53ceb98";
 
   src = fetchurl {
     url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    hash = "sha256-G+FZnr7+XvvxDpBWyH4Dv8NEjSWTXDoVNzbzNpMTbLg=";
+    hash = "sha256-BRbTm6dnogzkAVYZjQ8/YTEB4A8edNa2yymR3KlqAE4=";
   };
 
   sgt-puzzles-menu = fetchurl {
diff --git a/pkgs/servers/monitoring/net-snmp/default.nix b/pkgs/servers/monitoring/net-snmp/default.nix
index 3f5c8c84701e..b7db5e56fd77 100644
--- a/pkgs/servers/monitoring/net-snmp/default.nix
+++ b/pkgs/servers/monitoring/net-snmp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv, fetchurl, fetchpatch
 , file, openssl, perl, nettools
 , autoreconfHook
 , withPerlTools ? false
@@ -27,7 +27,11 @@ in stdenv.mkDerivation rec {
   in [
     (fetchAlpinePatch "fix-includes.patch" "0zpkbb6k366qpq4dax5wknwprhwnhighcp402mlm7950d39zfa3m")
     (fetchAlpinePatch "netsnmp-swinst-crash.patch" "0gh164wy6zfiwiszh58fsvr25k0ns14r3099664qykgpmickkqid")
-    (fetchAlpinePatch "fix-fd_mask.patch" "/i9ve61HjDzqZt+u1wajNtSQoizl+KePvhcAt24HKd0=")
+    (fetchpatch {
+      name = "configure-musl.patch";
+      url = "https://github.com/net-snmp/net-snmp/commit/a62169f1fa358be8f330ea8519ade0610fac525b.patch";
+      hash = "sha256-+vWH095fFL3wE6XLsTaPXgMDya0LRWdlL6urD5AIBUs=";
+    })
   ];
 
   outputs = [ "bin" "out" "dev" "lib" ];
diff --git a/pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix b/pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix
new file mode 100644
index 000000000000..0249ad1e3ad9
--- /dev/null
+++ b/pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix
@@ -0,0 +1,38 @@
+{
+  php,
+  fetchFromGitHub,
+  lib,
+}:
+
+php.buildComposerProject (finalAttrs: {
+  pname = "hmr_enabler";
+  # composer doesn't support our unstable version format
+  # version = "0-unstable-2024-08-24";
+  version = "0";
+
+  src = fetchFromGitHub {
+    owner = "nextcloud";
+    repo = "hmr_enabler";
+    rev = "d5d9d330d405ac4aa0de1a87d1133784560462ed";
+    hash = "sha256-uLCpwvMVQ20z9vlO5q/GVPnaaQZ7ZjE8+V/zuqaB9Yo=";
+  };
+
+  composerNoDev = false;
+
+  vendorHash = "sha256-ZuEEcFT+q49CCooEwdiu2Co345s0ZCC7jeEksi6A99A=";
+
+  postInstall = ''
+    chmod -R u+w $out/share
+    mv $out/share/php/hmr_enabler/* $out/
+    rm -r $out/share $out/composer.* $out/Makefile $out/psalm.xml $out/tests
+  '';
+
+  meta = {
+    description = " Development Nextcloud app to enable apps to use hot module reloading";
+    homepage = "https://github.com/nextcloud/hmr_enabler";
+    changelog = "https://github.com/nextcloud/hmr_enabler/blob/master/CHANGELOG.md";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ onny ];
+  };
+
+})
diff --git a/pkgs/servers/nextcloud/packages/default.nix b/pkgs/servers/nextcloud/packages/default.nix
index 8af2e2f5833b..7158bf8a2d0a 100644
--- a/pkgs/servers/nextcloud/packages/default.nix
+++ b/pkgs/servers/nextcloud/packages/default.nix
@@ -2,28 +2,58 @@
 # Licensed under: MIT
 # Slightly modified
 
-{ lib, pkgs, newScope, apps }:
+{
+  lib,
+  pkgs,
+  newScope,
+  apps,
+  callPackage,
+}:
 
-let packages = self:
-  let
-    generatedJson = {
-      inherit apps;
-    };
-    appBaseDefs = builtins.fromJSON (builtins.readFile ./nextcloud-apps.json);
+let
+  packages =
+    self:
+    let
+      generatedJson = {
+        inherit apps;
+      };
+      appBaseDefs = builtins.fromJSON (builtins.readFile ./nextcloud-apps.json);
 
-  in {
-    # Create a derivation from the official Nextcloud apps.
-    # This takes the data generated from the go tool.
-    mkNextcloudDerivation = self.callPackage ({ }: { pname, data }:
-      pkgs.fetchNextcloudApp {
-        appName = pname;
-        appVersion = data.version;
-        license = appBaseDefs.${pname};
-        inherit (data) url hash description homepage;
-      }) {};
+    in
+    {
+      # Create a derivation from the official Nextcloud apps.
+      # This takes the data generated from the go tool.
+      mkNextcloudDerivation = self.callPackage (
+        { }:
+        { pname, data }:
+        pkgs.fetchNextcloudApp {
+          appName = pname;
+          appVersion = data.version;
+          license = appBaseDefs.${pname};
+          inherit (data)
+            url
+            hash
+            description
+            homepage
+            ;
+        }
+      ) { };
 
-  } // lib.mapAttrs (type: pkgs:
-    lib.makeExtensible (_: lib.mapAttrs (pname: data: self.mkNextcloudDerivation { inherit pname; inherit data; }) pkgs))
-    generatedJson;
+    }
+    // lib.mapAttrs (
+      type: pkgs:
+      lib.makeExtensible (
+        _:
+        lib.mapAttrs (
+          pname: data:
+          self.mkNextcloudDerivation {
+            inherit pname data;
+          }
+        ) pkgs
+      )
+    ) generatedJson;
 
-in (lib.makeExtensible (_: (lib.makeScope newScope packages))).extend (selfNC: superNC: {})
+in
+(lib.makeExtensible (_: (lib.makeScope newScope packages))).extend (
+  import ./thirdparty.nix
+)
diff --git a/pkgs/servers/nextcloud/packages/thirdparty.nix b/pkgs/servers/nextcloud/packages/thirdparty.nix
new file mode 100644
index 000000000000..bcf151bc93f0
--- /dev/null
+++ b/pkgs/servers/nextcloud/packages/thirdparty.nix
@@ -0,0 +1,12 @@
+_:
+{ apps, callPackage, ... }:
+{
+
+  apps = apps.extend (
+    self: super: {
+
+      hmr_enabler = callPackage ./apps/hmr_enabler.nix { };
+
+    }
+  );
+}
diff --git a/pkgs/servers/sqlpage/default.nix b/pkgs/servers/sqlpage/default.nix
index f0372b926fc8..c7c06a6d50c4 100644
--- a/pkgs/servers/sqlpage/default.nix
+++ b/pkgs/servers/sqlpage/default.nix
@@ -11,8 +11,8 @@
 
 let
   apexcharts = fetchurl {
-    url = "https://cdn.jsdelivr.net/npm/apexcharts@3.50.0/dist/apexcharts.min.js";
-    hash = "sha256-pLaS+eABqnCs0TLhRUEBQVLeF7RSlW5LjsmS7eV4iKI=";
+    url = "https://cdn.jsdelivr.net/npm/apexcharts@3.52.0/dist/apexcharts.min.js";
+    hash = "sha256-2sxp9+shRA5LMxzhgx+fpeQPIY2ZWgBdt4mp5V2Yn+E=";
   };
   tablerCss = fetchurl {
     url = "https://cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta20/dist/css/tabler.min.css";
@@ -42,18 +42,18 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "sqlpage";
-  version = "0.25.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "lovasoa";
     repo = "SQLpage";
     rev = "v${version}";
-    hash = "sha256-ixxTaJ72EqGqvopcIr/7kRfFyK9p5laAmu7+jR5Tp1I=";
+    hash = "sha256-veqkHjIbR4qENarmXHakDDG4Rxq9mUD/io+dfwaWAqg=";
   };
 
   postPatch = ''
     substituteInPlace sqlpage/apexcharts.js \
-      --replace-fail '/* !include https://cdn.jsdelivr.net/npm/apexcharts@3.50.0/dist/apexcharts.min.js */' \
+      --replace-fail '/* !include https://cdn.jsdelivr.net/npm/apexcharts@3.52.0/dist/apexcharts.min.js */' \
       "$(cat ${apexcharts})"
     substituteInPlace sqlpage/sqlpage.css \
       --replace-fail '/* !include https://cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta20/dist/css/tabler.min.css */' \
@@ -75,7 +75,7 @@ rustPlatform.buildRustPackage rec {
       "$(cat ${tomselect})"
     '';
 
-  cargoHash = "sha256-yD82/h5dgcvp8OBfAoRfkq+YsauPncaRjfGM7dRQq5E=";
+  cargoHash = "sha256-idX3uU1nSI2a93srlJ1HvKcwVD0C4FmkQKTEYod5qgg=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/stdenv/freebsd/bootstrap-tools-spurious.txt b/pkgs/stdenv/freebsd/bootstrap-tools-spurious.txt
index 074e1f15ed5f..b7d20c45ae43 100644
--- a/pkgs/stdenv/freebsd/bootstrap-tools-spurious.txt
+++ b/pkgs/stdenv/freebsd/bootstrap-tools-spurious.txt
@@ -149,7 +149,6 @@ lib/engines-3/capi.so
 lib/engines-3/devcrypto.so
 lib/engines-3/loader_attic.so
 lib/engines-3/padlock.so
-lib/freebsd/libclang_rt.builtins-x86_64.a
 lib/gawk/filefuncs.so
 lib/gawk/fnmatch.so
 lib/gawk/fork.so
diff --git a/pkgs/tools/filesystems/mtdutils/default.nix b/pkgs/tools/filesystems/mtdutils/default.nix
index 80ce88836e34..3214694e5290 100644
--- a/pkgs/tools/filesystems/mtdutils/default.nix
+++ b/pkgs/tools/filesystems/mtdutils/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     downloadPage = "https://git.infradead.org/mtd-utils.git";
     license = licenses.gpl2Plus;
     homepage = "http://www.linux-mtd.infradead.org/";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ skeuchel ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/tools/graphics/exiftags/default.nix b/pkgs/tools/graphics/exiftags/default.nix
index 971722ea9f3f..5bd736911c73 100644
--- a/pkgs/tools/graphics/exiftags/default.nix
+++ b/pkgs/tools/graphics/exiftags/default.nix
@@ -23,5 +23,9 @@ stdenv.mkDerivation rec {
     license = lib.licenses.free;
     maintainers = [ ];
     platforms = with lib.platforms; unix;
+    knownVulnerabilities = [
+      "CVE-2023-50671"
+      "CVE-2024-42851"
+    ];
   };
 }
diff --git a/pkgs/tools/networking/mosh/default.nix b/pkgs/tools/networking/mosh/default.nix
index 92894e5ddf3d..908307a3b6a8 100644
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
       especially over Wi-Fi, cellular, and long-distance links.
     '';
     license = licenses.gpl3Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ skeuchel ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/security/passage/default.nix b/pkgs/tools/security/passage/default.nix
index 1d6bdfa225aa..5cd5b481c413 100644
--- a/pkgs/tools/security/passage/default.nix
+++ b/pkgs/tools/security/passage/default.nix
@@ -18,15 +18,15 @@
 , tree ? null
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "passage";
-  version = "unstable-2022-05-01";
+  version = "1.7.4a2";
 
   src = fetchFromGitHub {
     owner = "FiloSottile";
     repo = "passage";
-    rev = "1262d308f09db9b243513a428ab4b8fb1c30d31d";
-    sha256 = "1val8wl9kzlxj4i1rrh2iiyf97w9akffvr0idvbkdb09hfzz4lz8";
+    rev = "${finalAttrs.version}";
+    hash = "sha256-tGHJFzDc2K117r5EMFdKsfw/+EpdZ0qzaExt+RGI4qo=";
   };
 
   patches = [
@@ -77,4 +77,4 @@ stdenv.mkDerivation {
       passwords.
     '';
   };
-}
+})
diff --git a/pkgs/tools/text/igrep/default.nix b/pkgs/tools/text/igrep/default.nix
index db947ca2cc38..e2751197c717 100644
--- a/pkgs/tools/text/igrep/default.nix
+++ b/pkgs/tools/text/igrep/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "igrep";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "konradsz";
     repo = "igrep";
     rev = "v${version}";
-    hash = "sha256-L5mHuglU0CvTi02pbR8xfezBoH8L/DS+7jgvYvb4yro=";
+    hash = "sha256-ZZhzBGLpzd9+rok+S/ypKpWXVzXaA1CnviC7LfgP/CU=";
   };
 
-  cargoHash = "sha256-k63tu5Ffus4z0yd8vQ79q4+tokWAXD05Pvv9JByfnDg=";
+  cargoHash = "sha256-raSz/+u7P04qHmvdfYoWKOKtNtaFlgmT8Nw0ImhCMkU=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f1745437b2b0..3acc576726d3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5543,11 +5543,6 @@ with pkgs;
 
   loccount = callPackage ../development/tools/misc/loccount { };
 
-  logseq = callPackage ../by-name/lo/logseq/package.nix {
-    # electron version from: https://github.com/logseq/logseq/blob/0.10.9/package.json#L116
-    electron = electron_27;
-  };
-
   long-shebang = callPackage ../misc/long-shebang { };
 
   lssecret = callPackage ../misc/lssecret {};
@@ -20682,8 +20677,6 @@ with pkgs;
 
   hound = callPackage ../development/tools/misc/hound { };
 
-  hpp-fcl = callPackage ../development/libraries/hpp-fcl { };
-
   hpx = callPackage ../development/libraries/hpx {
     boost = boost179;
     asio = asio.override { boost = boost179; };
@@ -34929,7 +34922,7 @@ with pkgs;
   lndmanage = callPackage ../applications/blockchains/lndmanage { };
 
   monero-cli = callPackage ../applications/blockchains/monero-cli {
-    inherit (darwin.apple_sdk.frameworks) CoreData IOKit PCSC;
+    inherit (darwin.apple_sdk.frameworks) CoreData IOKit;
   };
 
   haven-cli = callPackage ../applications/blockchains/haven-cli {
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 22f907f80b92..52bf1b19da26 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -841,7 +841,7 @@ with self; {
       url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/App-cpanminus-1.7047.tar.gz";
       hash = "sha256-lj5jxuGocl/y9iTpCGOWrhUNtR3QozfDeB0JqZSvBaU=";
     };
-    # Use TLS endpoints for downloads and metadata by default
+    # CVE-2024-45321: Use TLS endpoints for downloads and metadata
     preConfigure = ''
       substituteInPlace bin/cpanm \
         --replace-fail http://www.cpan.org https://www.cpan.org \