diff --git a/nixos/modules/services/misc/ollama.nix b/nixos/modules/services/misc/ollama.nix
index 9794bbbec464..d9359d2b5cd4 100644
--- a/nixos/modules/services/misc/ollama.nix
+++ b/nixos/modules/services/misc/ollama.nix
@@ -9,6 +9,13 @@ in {
       enable = lib.mkEnableOption (
         lib.mdDoc "Server for local large language models"
       );
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
+        default = "127.0.0.1:11434";
+        description = lib.mdDoc ''
+          Specifies the bind address on which the ollama server HTTP interface listens.
+        '';
+      };
       package = lib.mkPackageOption pkgs "ollama" { };
     };
   };
@@ -23,6 +30,7 @@ in {
         environment = {
           HOME = "%S/ollama";
           OLLAMA_MODELS = "%S/ollama/models";
+          OLLAMA_HOST = cfg.listenAddress;
         };
         serviceConfig = {
           ExecStart = "${lib.getExe cfg.package} serve";
diff --git a/nixos/modules/services/misc/taskserver/helper-tool.py b/nixos/modules/services/misc/taskserver/helper-tool.py
index fec05728b2b6..b1eebb07686b 100644
--- a/nixos/modules/services/misc/taskserver/helper-tool.py
+++ b/nixos/modules/services/misc/taskserver/helper-tool.py
@@ -61,6 +61,10 @@ def run_as_taskd_user():
     os.setuid(uid)
 
 
+def run_as_taskd_group():
+    gid = grp.getgrnam(TASKD_GROUP).gr_gid
+    os.setgid(gid)
+
 def taskd_cmd(cmd, *args, **kwargs):
     """
     Invoke taskd with the specified command with the privileges of the 'taskd'
@@ -90,7 +94,7 @@ def certtool_cmd(*args, **kwargs):
     """
     return subprocess.check_output(
         [CERTTOOL_COMMAND] + list(args),
-        preexec_fn=lambda: os.umask(0o077),
+        preexec_fn=run_as_taskd_group,
         stderr=subprocess.STDOUT,
         **kwargs
     )
@@ -156,17 +160,33 @@ def generate_key(org, user):
         sys.stderr.write(msg.format(user))
         return
 
-    basedir = os.path.join(TASKD_DATA_DIR, "keys", org, user)
-    if os.path.exists(basedir):
+    keysdir = os.path.join(TASKD_DATA_DIR, "keys" )
+    orgdir  = os.path.join(keysdir       , org    )
+    userdir = os.path.join(orgdir        , user   )
+    if os.path.exists(userdir):
         raise OSError("Keyfile directory for {} already exists.".format(user))
 
-    privkey = os.path.join(basedir, "private.key")
-    pubcert = os.path.join(basedir, "public.cert")
+    privkey = os.path.join(userdir, "private.key")
+    pubcert = os.path.join(userdir, "public.cert")
 
     try:
-        os.makedirs(basedir, mode=0o700)
+        # We change the permissions and the owner ship of the base directories
+        # so that cfg.group and cfg.user could read the directories' contents.
+        # See also: https://bugs.python.org/issue42367
+        for bd in [keysdir, orgdir, userdir]:
+            # Allow cfg.group, but not others to read the contents of this group
+            os.makedirs(bd, exist_ok=True)
+            # not using mode= argument to makedirs intentionally - forcing the
+            # permissions we want
+            os.chmod(bd, mode=0o750)
+            os.chown(
+                bd,
+                uid=pwd.getpwnam(TASKD_USER).pw_uid,
+                gid=grp.getgrnam(TASKD_GROUP).gr_gid,
+            )
 
         certtool_cmd("-p", "--bits", CERT_BITS, "--outfile", privkey)
+        os.chmod(privkey, 0o640)
 
         template_data = [
             "organization = {0}".format(org),
@@ -187,7 +207,7 @@ def generate_key(org, user):
                 "--outfile", pubcert
             )
     except:
-        rmtree(basedir)
+        rmtree(userdir)
         raise
 
 
diff --git a/pkgs/applications/networking/instant-messengers/baresip/default.nix b/pkgs/applications/networking/instant-messengers/baresip/default.nix
index 592dba0b73a8..5efe54c0d27b 100644
--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@@ -27,13 +27,13 @@
 , dbusSupport ? true
 }:
 stdenv.mkDerivation rec {
-  version = "3.8.0";
+  version = "3.8.1";
   pname = "baresip";
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${version}";
-    hash = "sha256-7QqaKK8zalyopn9+MkKmdt9XaCkDFBNiXwVd2iXmqMA=";
+    hash = "sha256-39HRvRTyA0V8NKFUUpj7UGc01KVXULTE3HUd9Kh06bw=";
   };
   prePatch = lib.optionalString (!dbusSupport) ''
     substituteInPlace cmake/modules.cmake --replace 'list(APPEND MODULES ctrl_dbus)' ""
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 96854c3cdb62..108c6848ed27 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -36,14 +36,14 @@ let
   in
     assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
     stdenv.mkDerivation rec {
-      version = "4.1.2";
+      version = "4.2.0";
       pname = "weechat";
 
       hardeningEnable = [ "pie" ];
 
       src = fetchurl {
         url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-        hash = "sha256-mpuRD752i7nefHrJRPXbjyM4M/NFsuUF4W7G7zXv+7U=";
+        hash = "sha256-Mvam8hP7Y025MeKrjwGtuam1Dnf6ocUsoRbvoyBXWko=";
       };
 
       # Why is this needed? https://github.com/weechat/weechat/issues/2031
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index 162d4e2683db..a61e58a86e4b 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -19,14 +19,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "24.1.2";
+  version = "24.1.4";
 in
 stdenv.mkDerivation {
-  inherit pname appname version;
+  inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-UlHLGO5Rictj0/eZKxyFKxa/2XasQOAixnejOc+dH0M=";
+    hash = "sha256-RWAg89rbmoOSzOu9YjAkDluyPiYjT6f8gmri5AAHyww=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/terraform-plugin-docs/package.nix b/pkgs/by-name/te/terraform-plugin-docs/package.nix
index de64c81093c5..04f67c424ce6 100644
--- a/pkgs/by-name/te/terraform-plugin-docs/package.nix
+++ b/pkgs/by-name/te/terraform-plugin-docs/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "terraform-plugin-docs";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "terraform-plugin-docs";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-5vbi69GMgkzvN3aEQbNTbk99rg+kfvAvUrdDsuyIm9s=";
+    sha256 = "sha256-ID+4Pz6SUPzZTZYX6IHn/U02Ffw95he/gogV0mNA2OA=";
   };
 
-  vendorHash = "sha256-AjW6BokLVDkIWXToJ7wNq/g19xKTAfpQ/gVlKCV5qw0=";
+  vendorHash = "sha256-HseQBCvflmnlKX4PygWejPbyXRJmNUyl2K2//b4/tik=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/libraries/allegro/5.nix b/pkgs/development/libraries/allegro/5.nix
index 3b9bbfeb244a..eaf227fa60d1 100644
--- a/pkgs/development/libraries/allegro/5.nix
+++ b/pkgs/development/libraries/allegro/5.nix
@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "allegro";
-  version = "5.2.9.0";
+  version = "5.2.9.1";
 
   src = fetchFromGitHub {
     owner = "liballeg";
     repo = "allegro5";
     rev = version;
-    sha256 = "sha256-lGaHhFlc9zcalRFx0Xcyd0pZdC9lln0ez5hdfRz6Kt8=";
+    sha256 = "sha256-n2OCmZmAqeXjtnCTqJgQ5q4j8/lnPfH+5tpWKIFKle0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libnbd/default.nix b/pkgs/development/libraries/libnbd/default.nix
index ff90c9b116ad..5889c8ef12d5 100644
--- a/pkgs/development/libraries/libnbd/default.nix
+++ b/pkgs/development/libraries/libnbd/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , bash-completion
 , pkg-config
 , perl
@@ -13,21 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnbd";
-  version = "1.18.1";
+  version = "1.18.2";
 
   src = fetchurl {
     url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-stable/${pname}-${version}.tar.gz";
-    hash = "sha256-UNHRphDw1ycRnp0KClzHlSuLIxs5Mc4gcjB+EF/smbY=";
+    hash = "sha256-OYtNHAIGgwJuapoJNEMVkurUK9bQ7KO+V223bGC0TFI=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2023-5871.patch";
-      url = "https://gitlab.com/nbdkit/libnbd/-/commit/4451e5b61ca07771ceef3e012223779e7a0c7701.patch";
-      hash = "sha256-zmg/kxSJtjp2w9917Sp33ezt7Ccj/inngzCUVesF1Tc=";
-    })
-  ];
-
   nativeBuildInputs = [
     bash-completion
     pkg-config
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index 2610c8463b2e..a1d597adcd1d 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -164,7 +164,7 @@ let
       qtwayland = callPackage ./modules/qtwayland.nix { };
       qtwebchannel = callPackage ./modules/qtwebchannel.nix { };
       qtwebengine = callPackage ./modules/qtwebengine.nix {
-        inherit (darwin) bootstrap_cmds cctools xnu;
+        inherit (darwin) autoSignDarwinBinariesHook bootstrap_cmds cctools xnu;
         inherit (darwin.apple_sdk_11_0) libpm libunwind;
         inherit (darwin.apple_sdk_11_0.libs) sandbox;
         inherit (darwin.apple_sdk_11_0.frameworks)
diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
index affb512a22f2..8b9542511b72 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
@@ -60,6 +60,7 @@
 , mesa
 , enableProprietaryCodecs ? true
   # darwin
+, autoSignDarwinBinariesHook
 , bootstrap_cmds
 , cctools
 , xcbuild
@@ -105,6 +106,7 @@ qtModule {
     gn
     nodejs
   ] ++ lib.optionals stdenv.isDarwin [
+    autoSignDarwinBinariesHook
     bootstrap_cmds
     cctools
     xcbuild
@@ -185,16 +187,19 @@ qtModule {
     "-DQT_FEATURE_pdf_xfa_gif=ON"
     "-DQT_FEATURE_pdf_xfa_png=ON"
     "-DQT_FEATURE_pdf_xfa_tiff=ON"
-    "-DQT_FEATURE_webengine_system_icu=ON"
     "-DQT_FEATURE_webengine_system_libevent=ON"
-    "-DQT_FEATURE_webengine_system_libxml=ON"
     "-DQT_FEATURE_webengine_system_ffmpeg=ON"
     # android only. https://bugreports.qt.io/browse/QTBUG-100293
     # "-DQT_FEATURE_webengine_native_spellchecker=ON"
     "-DQT_FEATURE_webengine_sanitizer=ON"
     "-DQT_FEATURE_webengine_kerberos=ON"
   ] ++ lib.optionals stdenv.isLinux [
+    "-DQT_FEATURE_webengine_system_libxml=ON"
     "-DQT_FEATURE_webengine_webrtc_pipewire=ON"
+
+    # Appears not to work on some platforms
+    # https://github.com/Homebrew/homebrew-core/issues/104008
+    "-DQT_FEATURE_webengine_system_icu=ON"
   ] ++ lib.optionals enableProprietaryCodecs [
     "-DQT_FEATURE_webengine_proprietary_codecs=ON"
   ] ++ lib.optionals stdenv.isDarwin [
@@ -222,11 +227,9 @@ qtModule {
 
     # Text rendering
     harfbuzz
-    icu
 
     openssl
     glib
-    libxml2
     libxslt
     lcms2
 
@@ -241,6 +244,9 @@ qtModule {
     protobuf
     jsoncpp
 
+    icu
+    libxml2
+
     # Audio formats
     alsa-lib
     pulseaudio
diff --git a/pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch b/pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch
index 1fc7d837f8f3..3c3d59b488da 100644
--- a/pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch
+++ b/pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch
@@ -1,22 +1,29 @@
 --- a/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor.h
 +++ b/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor.h
-@@ -77,7 +77,7 @@ class XSLTProcessor final : public ScriptWrappable {
+@@ -77,7 +77,12 @@ class XSLTProcessor final : public ScriptWrappable {
  
    void reset();
  
--  static void ParseErrorFunc(void* user_data, xmlError*);
++#if LIBXML_VERSION >= 21200
 +  static void ParseErrorFunc(void* user_data, const xmlError*);
++#else
+   static void ParseErrorFunc(void* user_data, xmlError*);
++#endif
++
    static void GenericErrorFunc(void* user_data, const char* msg, ...);
  
    // Only for libXSLT callbacks
 --- a/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor_libxslt.cc
 +++ b/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor_libxslt.cc
-@@ -66,7 +66,7 @@ void XSLTProcessor::GenericErrorFunc(void*, const char*, ...) {
+@@ -66,7 +66,11 @@ void XSLTProcessor::GenericErrorFunc(void*, const char*, ...) {
    // It would be nice to do something with this error message.
  }
  
--void XSLTProcessor::ParseErrorFunc(void* user_data, xmlError* error) {
++#if LIBXML_VERSION >= 21200
 +void XSLTProcessor::ParseErrorFunc(void* user_data, const xmlError* error) {
++#else
+ void XSLTProcessor::ParseErrorFunc(void* user_data, xmlError* error) {
++#endif
    FrameConsole* console = static_cast<FrameConsole*>(user_data);
    if (!console)
      return;
diff --git a/pkgs/development/mobile/genymotion/default.nix b/pkgs/development/mobile/genymotion/default.nix
index b3ebaf713058..a70000ca56a5 100644
--- a/pkgs/development/mobile/genymotion/default.nix
+++ b/pkgs/development/mobile/genymotion/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, fetchurl, makeWrapper, which, zlib, libGL, glib, xorg, libxkbcommon
 , xdg-utils, libXrender, fontconfig, freetype, systemd, libpulseaudio
+, cairo, gdk-pixbuf, gtk3, pixman
 # For glewinfo
 , libXmu, libXi, libXext }:
 
@@ -19,6 +20,10 @@ let
     freetype
     systemd
     libpulseaudio
+    cairo
+    gdk-pixbuf
+    gtk3
+    pixman
   ];
   libPath = lib.makeLibraryPath packages;
 in
@@ -31,8 +36,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-CS1A9udt47bhgnYJqqkCG3z4XaPVHmz417VTsY2ccOA=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ which xdg-utils ];
+  nativeBuildInputs = [ makeWrapper which xdg-utils ];
 
   unpackPhase = ''
     mkdir -p phony-home $out/share/applications
@@ -73,6 +77,8 @@ stdenv.mkDerivation rec {
 
     patchExecutable genymotion
     patchExecutable player
+    patchExecutable qemu/x86_64/bin/qemu-img
+    patchExecutable qemu/x86_64/bin/qemu-system-x86_64
 
     patchTool adb
     patchTool aapt
diff --git a/pkgs/development/php-packages/php-cs-fixer/default.nix b/pkgs/development/php-packages/php-cs-fixer/default.nix
index f7cfd3967771..dadc4dfafa19 100644
--- a/pkgs/development/php-packages/php-cs-fixer/default.nix
+++ b/pkgs/development/php-packages/php-cs-fixer/default.nix
@@ -2,14 +2,14 @@
 
 let
   pname = "php-cs-fixer";
-  version = "3.45.0";
+  version = "3.48.0";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v${version}/php-cs-fixer.phar";
-    sha256 = "sha256-0i5ES1BfekNAOJuGQ4q9lqle/RS3YxgLt+CJa/Ow5/k=";
+    sha256 = "sha256-JPFZ297l83PqJv+yyzTN6DIKsk82MJuo9IEdMPPAPGM=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix b/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
index 2a753b425103..afad8539e7cc 100644
--- a/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
+++ b/pkgs/development/python-modules/aliyun-python-sdk-iot/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "aliyun-python-sdk-iot";
-  version = "8.57.0";
+  version = "8.58.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ea0IUn2mlu0c7QYJZkUrBUrtjUuTHoTeuvZHw/il+4A=";
+    hash = "sha256-Aafqju0EcaXv9RYkNSlcc1JnffluXXSl3KR1OcIX+OI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/demetriek/default.nix b/pkgs/development/python-modules/demetriek/default.nix
index 42205ac652f9..68f2660f6bb7 100644
--- a/pkgs/development/python-modules/demetriek/default.nix
+++ b/pkgs/development/python-modules/demetriek/default.nix
@@ -1,23 +1,24 @@
 { lib
 , aiohttp
+, aresponses
 , awesomeversion
 , backoff
 , buildPythonPackage
-, pydantic
 , fetchFromGitHub
 , fetchpatch
 , poetry-core
-, yarl
-, aresponses
+, pydantic
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
+, yarl
 }:
 
 buildPythonPackage rec {
   pname = "demetriek";
   version = "0.4.0";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
@@ -45,8 +46,13 @@ buildPythonPackage rec {
       --replace "--cov" ""
   '';
 
+  pythonRelaxDeps = [
+    "pydantic"
+  ];
+
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
@@ -72,6 +78,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python client for LaMetric TIME devices";
     homepage = "https://github.com/frenck/python-demetriek";
+    changelog = "https://github.com/frenck/python-demetriek/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/extruct/default.nix b/pkgs/development/python-modules/extruct/default.nix
index c2156965d08b..64873c94d324 100644
--- a/pkgs/development/python-modules/extruct/default.nix
+++ b/pkgs/development/python-modules/extruct/default.nix
@@ -1,38 +1,37 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pythonRelaxDepsHook
 , html-text
 , jstyleson
 , lxml
 , mf2py
+, mock
 , pyrdfa3
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
 , rdflib
+, setuptools
 , six
 , w3lib
-, pytestCheckHook
-, mock
 }:
 
 buildPythonPackage rec {
   pname = "extruct";
-  version = "0.13.0";
-  format = "setuptools";
+  version = "0.16.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "scrapinghub";
     repo = "extruct";
-    rev = "v${version}";
-    hash = "sha256-hf6b/tZLggHzgFmZ6aldZIBd17Ni7vCTIIzhNlyjvxw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-6lAb17EoR0FKyIOb9hk1jcpmPtZ7vClfuCrDZ83XBeg=";
   };
 
   nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
-
-  # rdflib-jsonld functionality is part of rdblib from version 6 onwards
-  pythonRemoveDeps = [
-    "rdflib-jsonld"
+    setuptools
   ];
 
   propagatedBuildInputs = [
@@ -51,11 +50,20 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "extruct" ];
+  pythonImportsCheck = [
+    "extruct"
+  ];
+
+  disabledTests = [
+    # AssertionError: Lists differ
+    "test_microformat"
+    "test_umicroformat"
+  ];
 
   meta = with lib; {
     description = "Extract embedded metadata from HTML markup";
     homepage = "https://github.com/scrapinghub/extruct";
+    changelog = "https://github.com/scrapinghub/extruct/blob/v${version}/HISTORY.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ambroisie ];
   };
diff --git a/pkgs/development/python-modules/flet-core/default.nix b/pkgs/development/python-modules/flet-core/default.nix
index 8c5bde07e016..2b84348f36f5 100644
--- a/pkgs/development/python-modules/flet-core/default.nix
+++ b/pkgs/development/python-modules/flet-core/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "flet-core";
-  version = "0.18.0";
-  format = "pyproject";
+  version = "0.19.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "flet_core";
     inherit version;
-    hash = "sha256-PbAzbDK9DkQBdrym9H3uBvPeeK8Qocq+t8veF+7izOQ=";
+    hash = "sha256-JRV56SwIhrsJHX/fzQKI0R2o/I+H5xXCXVu7uBiyIP8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flet-runtime/default.nix b/pkgs/development/python-modules/flet-runtime/default.nix
index 9ede80742df1..9f2a9a68de3d 100644
--- a/pkgs/development/python-modules/flet-runtime/default.nix
+++ b/pkgs/development/python-modules/flet-runtime/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "flet-runtime";
-  version = "0.18.0";
+  version = "0.19.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "flet_runtime";
     inherit version;
-    hash = "sha256-VfPTfCJXpRZsKM4ToFyl7zxbk58HT6eOYthfzAM4f88=";
+    hash = "sha256-no2oDGZG1svrOZLNAao279qeHwyk5SGibDG4UqpriiU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flet/default.nix b/pkgs/development/python-modules/flet/default.nix
index aafc2f957ec0..1730e0515ce2 100644
--- a/pkgs/development/python-modules/flet/default.nix
+++ b/pkgs/development/python-modules/flet/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "flet";
-  version = "0.18.0";
+  version = "0.19.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ix9O4wBq7/gwkV+23B+dnxTYv/VL6w8RmnvbYWcWqmc=";
+    hash = "sha256-YpML/NIUiL1WYg6zR6l60nJ6KRBfjMOjRbPDdjhR3/Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mf2py/default.nix b/pkgs/development/python-modules/mf2py/default.nix
index cd72dc7d40b9..ce50d3662f46 100644
--- a/pkgs/development/python-modules/mf2py/default.nix
+++ b/pkgs/development/python-modules/mf2py/default.nix
@@ -1,26 +1,34 @@
 { lib
+, beautifulsoup4
 , buildPythonPackage
 , fetchFromGitHub
-, beautifulsoup4
 , html5lib
-, requests
 , lxml
 , mock
-, nose
+, poetry-core
+, pytestCheckHook
+, pythonOlder
+, requests
 }:
 
 buildPythonPackage rec {
   pname = "mf2py";
-  version = "1.1.3";
-  format = "setuptools";
+  version = "2.0.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "microformats";
     repo = "mf2py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ya8DND1Dqbygbf1hjIGMlPwyc/MYIWIj+KnWB6Bqu1k=";
+    hash = "sha256-mhJ+s1rtXEJ6DqVmiyWNEK+3cdDLpR63Q4QGmD9wVio=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
     beautifulsoup4
     html5lib
@@ -30,14 +38,17 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     lxml
     mock
-    nose
+    pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "mf2py" ];
+  pythonImportsCheck = [
+    "mf2py"
+  ];
 
   meta = with lib; {
     description = "Microformats2 parser written in Python";
     homepage = "https://microformats.org/wiki/mf2py";
+    changelog = "https://github.com/microformats/mf2py/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ ambroisie ];
   };
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index d63e6f9791e5..273da11049ad 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -9,17 +9,19 @@
 , md-toc
 , mdformat
 , newversion
+, pip
 , poetry-core
 , pyparsing
 , pytestCheckHook
 , pythonOlder
 , setuptools
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
   version = "7.21.0";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.10";
 
@@ -43,8 +45,10 @@ buildPythonPackage rec {
     md-toc
     mdformat
     newversion
+    pip
     pyparsing
     setuptools
+    typing-extensions
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 5707f88cf69d..636976f3dbf5 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.36.2";
+  version = "0.36.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "plugwise";
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3TTrfvhTQIhig0QUP56+IkciiboXZD4025FvotAZgzo=";
+    hash = "sha256-LhwrrGle9B2zGhlgPLH+uB6ZiWbNPm1GbPXuUh8RLyo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pylint-django/default.nix b/pkgs/development/python-modules/pylint-django/default.nix
index d12e7268a24f..d3f22e8532ef 100644
--- a/pkgs/development/python-modules/pylint-django/default.nix
+++ b/pkgs/development/python-modules/pylint-django/default.nix
@@ -1,8 +1,11 @@
 { lib
 , buildPythonPackage
 , django
+, django-tables2
+, django-tastypie
 , factory-boy
 , fetchFromGitHub
+, poetry-core
 , pylint-plugin-utils
 , pytestCheckHook
 , pythonOlder
@@ -11,33 +14,43 @@
 buildPythonPackage rec {
   pname = "pylint-django";
   version = "2.5.4";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "PyCQA";
-    repo = pname;
+    repo = "pylint-django";
     rev = "refs/tags/v${version}";
     hash = "sha256-MNgu3LvFoohXA+JzUiHIaYFw0ssEe+H5T8Ea56LcGuI=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
-    django
     pylint-plugin-utils
   ];
 
+  passthru.optional-dependencies = {
+    with_django = [
+      django
+    ];
+  };
+
   nativeCheckInputs = [
+    django-tables2
+    django-tastypie
     factory-boy
     pytestCheckHook
   ];
 
   disabledTests = [
-    # AttributeError, AssertionError
-    "external_django_tables2_noerror_meta_class"
-    "external_tastypie_noerror_foreign_key"
+    # AttributeError: module 'pylint.interfaces' has no attribute 'IAstroidChecker'
+    "test_migrations_plugin"
     "func_noerror_model_unicode_lambda"
-    "0001_noerror_initial"
+    "test_linter_should_be_pickleable_with_pylint_django_plugin_installed"
   ];
 
   pythonImportsCheck = [
@@ -47,6 +60,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Pylint plugin to analyze Django applications";
     homepage = "https://github.com/PyCQA/pylint-django";
+    changelog = "https://github.com/pylint-dev/pylint-django/releases/tag/v${version}";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ kamadorueda ];
   };
diff --git a/pkgs/development/python-modules/pylint-plugin-utils/default.nix b/pkgs/development/python-modules/pylint-plugin-utils/default.nix
index a8cff3800960..cdc29eb19621 100644
--- a/pkgs/development/python-modules/pylint-plugin-utils/default.nix
+++ b/pkgs/development/python-modules/pylint-plugin-utils/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, poetry-core
 , pylint
 , pytestCheckHook
 , pythonOlder
@@ -9,18 +10,22 @@
 
 buildPythonPackage rec {
   pname = "pylint-plugin-utils";
-  version = "0.7";
-  format = "setuptools";
+  version = "0.8.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "PyCQA";
-    repo = pname;
-    rev = version;
-    hash = "sha256-uDsSSUWdlzuQz6umoYLbIotOYNEnLQu041ZZVMRd2ww=";
+    repo = "pylint-plugin-utils";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xuPU1txfB+6+zJjtlfvNA950S5n7/PWPPFn1F3RtvCc=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
     pylint
     toml
diff --git a/pkgs/development/python-modules/pyrdfa3/default.nix b/pkgs/development/python-modules/pyrdfa3/default.nix
index ef6d33cb8e80..51f6411cb4fb 100644
--- a/pkgs/development/python-modules/pyrdfa3/default.nix
+++ b/pkgs/development/python-modules/pyrdfa3/default.nix
@@ -1,17 +1,19 @@
 { lib
 , buildPythonPackage
-, fetchPypi
 , fetchpatch
-, isPy27
-, rdflib
+, fetchPypi
 , html5lib
+, pythonOlder
+, rdflib
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pyrdfa3";
   version = "3.5.3";
-  format = "setuptools";
-  disabled = isPy27;
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit version;
@@ -21,6 +23,7 @@ buildPythonPackage rec {
 
   patches = [
     (fetchpatch {
+      # https://github.com/RDFLib/pyrdfa3/pull/40
       name = "CVE-2022-4396.patch";
       url = "https://github.com/RDFLib/pyrdfa3/commit/ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e.patch";
       hash = "sha256-prRrOwylYcEqKLr/8LIpyJ5Yyt+6+HTUqH5sQXU8tqc=";
@@ -31,21 +34,28 @@ buildPythonPackage rec {
     substituteInPlace setup.py \
       --replace "'html = pyRdfa.rdflibparsers:StructuredDataParser'" "'html = pyRdfa.rdflibparsers:StructuredDataParser'," \
       --replace "'hturtle = pyRdfa.rdflibparsers:HTurtleParser'" "'hturtle = pyRdfa.rdflibparsers:HTurtleParser',"
+    # https://github.com/RDFLib/pyrdfa3/issues/31
+    substituteInPlace pyRdfa/utils.py \
+      --replace "imp," ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     rdflib
     html5lib
   ];
 
-  # Does not work with python3
-  doCheck = false;
-
-  pythonImportsCheck = [ "pyRdfa" ];
+  pythonImportsCheck = [
+    "pyRdfa"
+  ];
 
   meta = with lib; {
     description = "RDFa 1.1 distiller/parser library";
-    homepage = "https://www.w3.org/2012/pyRdfa/";
+    homepage = "https://github.com/prrvchr/pyrdfa3/";
+    changelog = "https://github.com/prrvchr/pyrdfa3/releases/tag/v${version}";
     license = licenses.w3c;
     maintainers = with maintainers; [ ambroisie ];
   };
diff --git a/pkgs/development/python-modules/pysolcast/default.nix b/pkgs/development/python-modules/pysolcast/default.nix
index 5e740e78e6a8..1eab58761440 100644
--- a/pkgs/development/python-modules/pysolcast/default.nix
+++ b/pkgs/development/python-modules/pysolcast/default.nix
@@ -9,6 +9,7 @@
 , requests
 , responses
 , poetry-core
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -25,8 +26,13 @@ buildPythonPackage rec {
     hash = "sha256-jLhM47o6LvkPux0kusOrRk4TDS6VLWE0QMEiQxlBCwo=";
   };
 
+  pythonRelaxDeps = [
+    "responses"
+  ];
+
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-check/default.nix b/pkgs/development/python-modules/pytest-check/default.nix
index ed62f69d4818..efa2cc4049bc 100644
--- a/pkgs/development/python-modules/pytest-check/default.nix
+++ b/pkgs/development/python-modules/pytest-check/default.nix
@@ -8,20 +8,20 @@
 
 buildPythonPackage rec {
   pname = "pytest-check";
-  version = "2.2.4";
-  format = "pyproject";
+  version = "2.3.1";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "pytest_check";
     inherit version;
-    hash = "sha256-0uaWYDFB9bLekFuTWD5FmE7DxhzscCZJ3rEL2XSFYLs=";
+    hash = "sha256-UbjxiozKpCbF2RPE4ORvAUqqdXlIHqA9Itfh9Jj2ibI=";
   };
 
   nativeBuildInputs = [
     flit-core
   ];
 
-  propagatedBuildInputs = [
+  buildInputs = [
     pytest
   ];
 
@@ -29,10 +29,15 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [
+    "pytest_check"
+  ];
+
   meta = with lib; {
     description = "pytest plugin allowing multiple failures per test";
     homepage = "https://github.com/okken/pytest-check";
+    changelog = "https://github.com/okken/pytest-check/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = [ maintainers.flokli ];
+    maintainers = with maintainers; [ flokli ];
   };
 }
diff --git a/pkgs/development/python-modules/pyvista/default.nix b/pkgs/development/python-modules/pyvista/default.nix
index 0493509e976b..f791db0dbd83 100644
--- a/pkgs/development/python-modules/pyvista/default.nix
+++ b/pkgs/development/python-modules/pyvista/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pyvista";
-  version = "0.43.1";
+  version = "0.43.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-H7WkRK9lP92L47nFNDT1WusWfU0bLgXBA+KQqTyedL4=";
+    hash = "sha256-2gh5qpiHda611bWWZzRXu+tkiRk9x4qNehFP8MARtk0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/recipe-scrapers/default.nix b/pkgs/development/python-modules/recipe-scrapers/default.nix
index b9f29be757fe..9ff74c48044b 100644
--- a/pkgs/development/python-modules/recipe-scrapers/default.nix
+++ b/pkgs/development/python-modules/recipe-scrapers/default.nix
@@ -9,18 +9,21 @@
 , pytestCheckHook
 , responses
 , setuptools
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "recipe-scrapers";
-  version = "14.52.0";
-  format = "pyproject";
+  version = "14.53.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "hhursev";
     repo = "recipe-scrapers";
     rev = "refs/tags/${version}";
-    hash = "sha256-VdJZnwo+DwVDZuuuqk0X26CXs7ZrUFXqC8qEYaX74Zc=";
+    hash = "sha256-uYUzn3JlsZmzzbk740aD3PW3OuGqdsAfU7HlYX5kPrY=";
   };
 
   nativeBuildInputs = [
@@ -40,16 +43,19 @@ buildPythonPackage rec {
     responses
   ];
 
-  disabledTestPaths = [
-    # This is not actual code, just some pre-written boiler-plate template
-    "templates/test_scraper.py"
+  disabledTests = [
+    # Fixture is broken
+    "test_instructions"
   ];
 
-  pythonImportsCheck = [ "recipe_scrapers" ];
+  pythonImportsCheck = [
+    "recipe_scrapers"
+  ];
 
   meta = with lib; {
-    description = "Python package for scraping recipes data ";
+    description = "Python package for scraping recipes data";
     homepage = "https://github.com/hhursev/recipe-scrapers";
+    changelog = "https://github.com/hhursev/recipe-scrapers/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ ambroisie ];
   };
diff --git a/pkgs/development/python-modules/rki-covid-parser/default.nix b/pkgs/development/python-modules/rki-covid-parser/default.nix
index d7e12ba2293f..4a9263f389c2 100644
--- a/pkgs/development/python-modules/rki-covid-parser/default.nix
+++ b/pkgs/development/python-modules/rki-covid-parser/default.nix
@@ -6,22 +6,27 @@
 , pytest-aiohttp
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "rki-covid-parser";
   version = "1.3.3";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "thebino";
-    repo = pname;
-    rev = "v${version}";
+    repo = "rki-covid-parser";
+    rev = "refs/tags/v${version}";
     hash = "sha256-e0MJjE4zgBPL+vt9EkgsdGrgqUyKK/1S9ZFxy56PUjc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     aiohttp
   ];
@@ -45,6 +50,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for working with data from the Robert-Koch Institut";
     homepage = "https://github.com/thebino/rki-covid-parser";
+    changelog = "https://github.com/thebino/rki-covid-parser/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/simplisafe-python/default.nix b/pkgs/development/python-modules/simplisafe-python/default.nix
index 59a24e96feb0..f417a5f6368d 100644
--- a/pkgs/development/python-modules/simplisafe-python/default.nix
+++ b/pkgs/development/python-modules/simplisafe-python/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "simplisafe-python";
-  version = "2023.12.0";
+  version = "2024.01.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = "simplisafe-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-Nr4HvjIOLk/WMKCjj/ZX67OBSImRhs9SfZtLjFs81Sk=";
+    hash = "sha256-ewbR2FI0t2F8HF0ZL5omsclB9OPAjHygGLPtSkVlvgM=";
   };
 
 
diff --git a/pkgs/development/python-modules/types-awscrt/default.nix b/pkgs/development/python-modules/types-awscrt/default.nix
index d35cfcc2afe9..63fc7400878f 100644
--- a/pkgs/development/python-modules/types-awscrt/default.nix
+++ b/pkgs/development/python-modules/types-awscrt/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "types-awscrt";
-  version = "0.20.0";
+  version = "0.20.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "types_awscrt";
     inherit version;
-    hash = "sha256-mXeMlS4erhDMelNGhBMAEXcCbJQ0NFvwASC7LqW3kQk=";
+    hash = "sha256-XimYakrTlorD2CyqhdZo08ZiJMnueL4/5kvOMNrnt5g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index 5a1a1508b42e..530c2609c135 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,20 +10,21 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.27.0";
+  version = "1.28.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-QBU04/w7Z8yaTzDqhiVcxC8xEuDpDJs7rNRpOtwodGg=";
+    hash = "sha256-wFUSf3+EZa1pzpKci4dPa9MVfNk5XQHraUFcoiTd/0Q=";
   };
 
-  vendorHash = "sha256-4JSmn/TUojZjCQMZCgJic0y84VMP26J7uBybB5/BCoE=";
+  vendorHash = "sha256-REAU2FoEYWRYlPQel6oDLLdhbJOiGRaWZO6inefSd3M=";
 
   patches = [
-    # Skip a test that requires networking to be available to work.
-    ./skip_test_requiring_network.patch
+    # Skip a test that requires networking to be available to work,
+    # and a test which requires the source checkout to be part of a git repository
+    ./skip_broken_tests.patch
   ];
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/buf/skip_broken_tests.patch b/pkgs/development/tools/buf/skip_broken_tests.patch
new file mode 100644
index 000000000000..c25f8c8c9304
--- /dev/null
+++ b/pkgs/development/tools/buf/skip_broken_tests.patch
@@ -0,0 +1,28 @@
+diff --git a/private/buf/cmd/buf/workspace_unix_test.go b/private/buf/cmd/buf/workspace_unix_test.go
+index 22c84385..22548555 100644
+--- a/private/buf/cmd/buf/workspace_unix_test.go
++++ b/private/buf/cmd/buf/workspace_unix_test.go
+@@ -93,6 +93,8 @@ func TestWorkspaceAbsoluteFail(t *testing.T) {
+ // Workflow run: https://github.com/bufbuild/buf/actions/runs/6510804063/job/17685247791.
+ // Potential fix: https://stackoverflow.com/questions/22575662/filename-too-long-in-git-for-windows.
+ func TestWorkspaceGit(t *testing.T) {
++	// Fails because the source checkout is not part of a git repository while building with nix
++	t.Skip()
+ 	// Directory paths specified as a git reference within a workspace.
+ 	t.Parallel()
+ 	testRunStdout(
+diff --git a/private/bufpkg/buftesting/buftesting.go b/private/bufpkg/buftesting/buftesting.go
+index d9e1fdc6..6e08c439 100644
+--- a/private/bufpkg/buftesting/buftesting.go
++++ b/private/bufpkg/buftesting/buftesting.go
+@@ -104,6 +104,10 @@ func RunActualProtoc(
+ 
+ // GetGoogleapisDirPath gets the path to a clone of googleapis.
+ func GetGoogleapisDirPath(t *testing.T, buftestingDirPath string) string {
++	// Requires network access, which is not available during
++	// the nixpkgs sandboxed build
++	t.Skip()
++
+ 	googleapisDirPath := filepath.Join(buftestingDirPath, testGoogleapisDirPath)
+ 	require.NoError(
+ 		t,
diff --git a/pkgs/development/tools/buf/skip_test_requiring_network.patch b/pkgs/development/tools/buf/skip_test_requiring_network.patch
deleted file mode 100644
index 1b0cdfb12c03..000000000000
--- a/pkgs/development/tools/buf/skip_test_requiring_network.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/private/bufpkg/buftesting/buftesting.go b/private/bufpkg/buftesting/buftesting.go
-index 82b3ec4..ef8263a 100644
---- a/private/bufpkg/buftesting/buftesting.go
-+++ b/private/bufpkg/buftesting/buftesting.go
-@@ -99,6 +99,10 @@ func RunActualProtoc(
- 
- // GetGoogleapisDirPath gets the path to a clone of googleapis.
- func GetGoogleapisDirPath(t *testing.T, buftestingDirPath string) string {
-+	// Requires network access, which is not available during
-+	// the nixpkgs sandboxed build
-+	t.Skip()
-+
- 	googleapisDirPath := filepath.Join(buftestingDirPath, testGoogleapisDirPath)
- 	require.NoError(
- 		t,
diff --git a/pkgs/development/tools/misc/texlab/default.nix b/pkgs/development/tools/misc/texlab/default.nix
index 9e6b2bb850f7..1eccff2694cb 100644
--- a/pkgs/development/tools/misc/texlab/default.nix
+++ b/pkgs/development/tools/misc/texlab/default.nix
@@ -15,16 +15,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "texlab";
-  version = "5.12.1";
+  version = "5.12.2";
 
   src = fetchFromGitHub {
     owner = "latex-lsp";
     repo = "texlab";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/M6j33KNX4leLPJg6qLubejhjacXsd7NZ77wuGtdbw8=";
+    hash = "sha256-NEiUWMmJjhhK9XYbW1dla7iZJG4bdttbuSJmtO4f1UE=";
   };
 
-  cargoHash = "sha256-xslsj5mE7NOZYVwuxJ06hZAUWS3mhgzrl73P47mjkTY=";
+  cargoHash = "sha256-OFgBBO4RZ7oS2da9cGIePnLhfFdHfW3FdOT0B8bNC3g=";
 
   outputs = [ "out" ] ++ lib.optional (!isCross) "man";
 
diff --git a/pkgs/development/tools/pur/default.nix b/pkgs/development/tools/pur/default.nix
index 710dc9e71413..9f8527b34765 100644
--- a/pkgs/development/tools/pur/default.nix
+++ b/pkgs/development/tools/pur/default.nix
@@ -5,28 +5,32 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "pur";
-  version = "7.0.0";
+  version = "7.3.1";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "alanhamlett";
     repo = "pip-update-requirements";
     rev = "refs/tags/${version}";
-    hash = "sha256-JAjz9A9r1H6MJX7MSq7UvQKfULhB9UuPP3tI6Cggx9I=";
+    hash = "sha256-W6otdj1C3Nn3DUvwp9MPqMo2y4ITqgYrqlW/uxIj2YA=";
   };
 
-  propagatedBuildInputs = [
-    python3.pkgs.click
+  propagatedBuildInputs = with python3.pkgs; [
+    click
   ];
 
-  nativeCheckInputs = [
-    python3.pkgs.pytestCheckHook
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "pur" ];
+  pythonImportsCheck = [
+    "pur"
+  ];
 
   meta = with lib; {
     description = "Python library for update and track the requirements";
     homepage = "https://github.com/alanhamlett/pip-update-requirements";
+    changelog = "https://github.com/alanhamlett/pip-update-requirements/blob/${version}/HISTORY.rst";
     license = with licenses; [ bsd2 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/servers/roundcube/default.nix b/pkgs/servers/roundcube/default.nix
index 959c9bf4633e..8e037e13497a 100644
--- a/pkgs/servers/roundcube/default.nix
+++ b/pkgs/servers/roundcube/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "roundcube";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchurl {
     url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz";
-    sha256 = "sha256-Fktyy3jeidEEdB7pCQ9AJOY7+tpDlJA0hENl8/pwtf0=";
+    sha256 = "sha256-wbk6Ptvil0VzlrCgMdixPIpdwwyTcHBN+5ssEiUBfVI=";
   };
 
   patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ];
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index 5154fccc81c0..f4d51e481583 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2023.12.28";
+  version = "2024.01.04";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    hash = "sha256-HOwHmn67ZT2h0MKV1wxv1pINUv/5S4AgafGBM1PEBzY=";
+    hash = "sha256-IsQ+lAmQQGitKRlQUc7PgRKgwlEgYsR5q2XHp9k7tEM=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index a180784b498a..d7562da9cd42 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -32,13 +32,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-cjNVN/2N/CiItsysZFJNL0mqXL6B86BihjDJ7IwD1a4=";
+    hash = "sha256-XxQtAEGQEnwX3ks1ukAfDrGvgFfFjwe2XdF6uQViRjc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/fast-ssh/default.nix b/pkgs/tools/networking/fast-ssh/default.nix
index 912cac758650..5d899fa54184 100644
--- a/pkgs/tools/networking/fast-ssh/default.nix
+++ b/pkgs/tools/networking/fast-ssh/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , rustPlatform
 , Security
 }:
@@ -18,6 +19,15 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-sIQNoH3UWX3SwCFCPZEREIFR7C28ml4oGsrq6wuOAT0=";
 
+  patches = [
+    # Can be removed as soon as this is is merged: https://github.com/Julien-R44/fast-ssh/pull/22
+    (fetchpatch {
+      name = "fix-ambiguous-as_ref.patch";
+      url = "https://github.com/Julien-R44/fast-ssh/commit/c082a64a4b412380b2ab145c24161fdaa26175db.patch";
+      hash = "sha256-egkoJF+rQiuClNL8ltzmB7oHngbpOxO29rlwZ3nELOE=";
+    })
+  ];
+
   buildInputs = lib.optional stdenv.isDarwin Security;
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/lldpd/default.nix b/pkgs/tools/networking/lldpd/default.nix
index d480b3e01c72..d9f9ae45ad13 100644
--- a/pkgs/tools/networking/lldpd/default.nix
+++ b/pkgs/tools/networking/lldpd/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lldpd";
-  version = "1.0.17";
+  version = "1.0.18";
 
   src = fetchurl {
     url = "https://media.luffy.cx/files/lldpd/${pname}-${version}.tar.gz";
-    sha256 = "sha256-k0MXfxRdK8pm7wPVlSgHnT8WY8YkseK50IJo79xhJ84=";
+    hash = "sha256-SzIGddYIkBpKDU/v+PlruEbUkT2RSwz3W30K6ASQ8vc=";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/security/cloudhunter/default.nix b/pkgs/tools/security/cloudhunter/default.nix
index 109bd5a9df7a..206879d53759 100644
--- a/pkgs/tools/security/cloudhunter/default.nix
+++ b/pkgs/tools/security/cloudhunter/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cloudhunter";
-  version = "0.7.0";
+  version = "0.7.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "belane";
     repo = "CloudHunter";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yRl3x1dboOcoPeKxpUEhDk8OJx1hynEJRHL9/Su8OyA=";
+    hash = "sha256-7iT4vr0kcNXEyJJdBbJsllIcbZRGY3T5t/FjEONkuq0=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/security/keepwn/default.nix b/pkgs/tools/security/keepwn/default.nix
index 9720e14d7a50..bb856c80710b 100644
--- a/pkgs/tools/security/keepwn/default.nix
+++ b/pkgs/tools/security/keepwn/default.nix
@@ -6,20 +6,27 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "keepwn";
-  version = "0.1";
-  format = "setuptools";
+  version = "0.3";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Orange-Cyberdefense";
     repo = "KeePwn";
     rev = "refs/tags/${version}";
-    hash = "sha256-s+r6QEUzkzCbs5j1G+PVgDx8cvnmQzEQ1MHAakG+skA=";
+    hash = "sha256-haKWuoTtyC9vIise+gznruHEwMIDz1W6euihLLKnSdc=";
   };
 
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     chardet
     impacket
     lxml
+    pefile
+    pykeepass
+    python-magic
     termcolor
   ];
 
diff --git a/pkgs/tools/security/naabu/default.nix b/pkgs/tools/security/naabu/default.nix
index 8569b957db2d..7d3981222f91 100644
--- a/pkgs/tools/security/naabu/default.nix
+++ b/pkgs/tools/security/naabu/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "naabu";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "naabu";
     rev = "refs/tags/v${version}";
-    hash = "sha256-he9SJ4lCFNV3DvwqYR7lcWPIPwLIpJDWWnnei069k1k=";
+    hash = "sha256-z81LL+tx15Zo6OWj4gRSodo7Dk763M+QQ5kYgjrWO3Q=";
   };
 
-  vendorHash = "sha256-fVqPRDycT9ImBkHakNrby0uXPWrXXatTk8QQSi2OnV0=";
+  vendorHash = "sha256-nwrqxlbvr9FZXJpzmcn0IBEtlJfeYCy8DJsBvxEgj6k=";
 
   buildInputs = [
     libpcap
@@ -27,6 +27,11 @@ buildGoModule rec {
     "cmd/naabu/"
   ];
 
+  ldflags = [
+    "-w"
+    "-s"
+  ];
+
   meta = with lib; {
     description = "Fast SYN/CONNECT port scanner";
     longDescription = ''
diff --git a/pkgs/tools/text/ov/default.nix b/pkgs/tools/text/ov/default.nix
index c68d51b1e21c..c801bca711dd 100644
--- a/pkgs/tools/text/ov/default.nix
+++ b/pkgs/tools/text/ov/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "ov";
-  version = "0.33.0";
+  version = "0.33.1";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "ov";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UD8YKhdoMAtKTC2KEMEamjgOZb3rv1SU9eXZg/zjYTY=";
+    hash = "sha256-ub6BPasgJcEeYsmlYKCToEQ70RV17Uq8OSM0XB1e1yg=";
   };
 
-  vendorHash = "sha256-T40hnlYhJ3lhrQW7iFBQCGUNblSSYtL8jNw0rPRy/Aw=";
+  vendorHash = "sha256-/S7YKIwuZyQBGIbcPt/ffv8Vx6vzXsk/fDRCIXANPTE=";
 
   ldflags = [
     "-s"