diff --git a/.github/labeler.yml b/.github/labeler.yml
index 485bcce6a8a4..1d70faf6423b 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -340,6 +340,15 @@
         - pkgs/os-specific/linux/systemd/**/*
         - nixos/modules/system/boot/systemd*/**/*
 
+"6.topic: tcl":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/tcl.section.md
+        - pkgs/development/interpreters/tcl/*
+        - pkgs/development/tcl-modules/**/*
+        - pkgs/top-level/tcl-packages.nix
+
 "6.topic: TeX":
   - any:
     - changed-files:
diff --git a/.github/workflows/codeowners.yml b/.github/workflows/codeowners-v2.yml
similarity index 73%
rename from .github/workflows/codeowners.yml
rename to .github/workflows/codeowners-v2.yml
index 9d781c6ef080..23720e25e526 100644
--- a/.github/workflows/codeowners.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -1,17 +1,32 @@
-name: Codeowners
+name: Codeowners v2
 
-# This workflow depends on a GitHub App with the following permissions:
-# - Repository > Administration: read-only
-# - Organization > Members: read-only
-# - Repository > Pull Requests: read-write
-# The App needs to be installed on this repository
-# the OWNER_APP_ID repository variable needs to be set
-# the OWNER_APP_PRIVATE_KEY repository secret needs to be set
+# This workflow depends on two GitHub Apps with the following permissions:
+# - For checking code owners:
+#   - Permissions:
+#     - Repository > Administration: read-only
+#     - Organization > Members: read-only
+#   - Install App on this repository, setting these variables:
+#     - OWNER_RO_APP_ID (variable)
+#     - OWNER_RO_APP_PRIVATE_KEY (secret)
+# - For requesting code owners:
+#   - Permissions:
+#     - Repository > Administration: read-only
+#     - Organization > Members: read-only
+#     - Repository > Pull Requests: read-write
+#   - Install App on this repository, setting these variables:
+#     - OWNER_APP_ID (variable)
+#     - OWNER_APP_PRIVATE_KEY (secret)
+#
+# This split is done because checking code owners requires handling untrusted PR input,
+# while requesting code owners requires PR write access, and those shouldn't be mixed.
 
 on:
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened, edited]
 
+# We don't need any default GitHub token
+permissions: {}
+
 env:
   OWNERS_FILE: ci/OWNERS
   # Don't do anything on draft PRs
@@ -45,8 +60,8 @@ jobs:
     - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
       id: app-token
       with:
-        app-id: ${{ vars.OWNER_APP_ID }}
-        private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+        app-id: ${{ vars.OWNER_RO_APP_ID }}
+        private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
 
     - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       with:
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig-v2.yml
similarity index 95%
rename from .github/workflows/editorconfig.yml
rename to .github/workflows/editorconfig-v2.yml
index b4ef16a734b7..9bae2c32774d 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig-v2.yml
@@ -1,6 +1,8 @@
-name: "Checking EditorConfig"
+name: "Checking EditorConfig v2"
 
-permissions: read-all
+permissions:
+  pull-requests: read
+  contents: read
 
 on:
   # avoids approving first time contributors
diff --git a/.github/workflows/manual-nixos.yml b/.github/workflows/manual-nixos-v2.yml
similarity index 94%
rename from .github/workflows/manual-nixos.yml
rename to .github/workflows/manual-nixos-v2.yml
index 2ae4d929c12d..26a6279dcf22 100644
--- a/.github/workflows/manual-nixos.yml
+++ b/.github/workflows/manual-nixos-v2.yml
@@ -1,6 +1,7 @@
-name: "Build NixOS manual"
+name: "Build NixOS manual v2"
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target:
diff --git a/.github/workflows/manual-nixpkgs.yml b/.github/workflows/manual-nixpkgs-v2.yml
similarity index 94%
rename from .github/workflows/manual-nixpkgs.yml
rename to .github/workflows/manual-nixpkgs-v2.yml
index 676a554107d5..f51c1c5ef9de 100644
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs-v2.yml
@@ -1,6 +1,7 @@
-name: "Build Nixpkgs manual"
+name: "Build Nixpkgs manual v2"
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target:
diff --git a/.github/workflows/nix-parse.yml b/.github/workflows/nix-parse-v2.yml
similarity index 93%
rename from .github/workflows/nix-parse.yml
rename to .github/workflows/nix-parse-v2.yml
index 352cb81d87ed..03f6af1b876b 100644
--- a/.github/workflows/nix-parse.yml
+++ b/.github/workflows/nix-parse-v2.yml
@@ -1,6 +1,8 @@
-name: "Check whether nix files are parseable"
+name: "Check whether nix files are parseable v2"
 
-permissions: read-all
+permissions:
+  pull-requests: read
+  contents: read
 
 on:
   # avoids approving first time contributors
diff --git a/ci/OWNERS b/ci/OWNERS
index cbc120895312..ec361f3596e7 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -11,13 +11,13 @@
 # - There is no need for user/team listed here to have write access.
 # - No reviews will be requested for PRs that target the wrong base branch.
 #
-# Processing of this file is implemented in workflows/codeowners.yml
+# Processing of this file is implemented in workflows/codeowners-v2.yml
 
 # CI
 /.github/workflows @NixOS/Security @Mic92 @zowoq
 /.github/workflows/check-nix-format.yml @infinisil
 /.github/workflows/nixpkgs-vet.yml @infinisil @philiptaron
-/.github/workflows/codeowners.yml @infinisil
+/.github/workflows/codeowners-v2.yml @infinisil
 /ci/OWNERS @infinisil
 /ci @infinisil @philiptaron @NixOS/Security
 
@@ -177,6 +177,13 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 /pkgs/build-support/rust @zowoq @winterqt @figsoda
 /doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
 
+# Tcl
+/pkgs/development/interpreters/tcl  @fgaz
+/pkgs/development/libraries/tk      @fgaz
+/pkgs/top-level/tcl-packages.nix    @fgaz
+/pkgs/development/tcl-modules       @fgaz
+/doc/languages-frameworks/tcl.section.md @fgaz
+
 # C compilers
 /pkgs/development/compilers/gcc
 /pkgs/development/compilers/llvm @alyssais @RossComputerGuy @NixOS/llvm
diff --git a/doc/languages-frameworks/index.md b/doc/languages-frameworks/index.md
index c21f73e69a25..a8a13ce5b9e2 100644
--- a/doc/languages-frameworks/index.md
+++ b/doc/languages-frameworks/index.md
@@ -93,6 +93,7 @@ ruby.section.md
 rust.section.md
 scheme.section.md
 swift.section.md
+tcl.section.md
 texlive.section.md
 titanium.section.md
 vim.section.md
diff --git a/doc/languages-frameworks/tcl.section.md b/doc/languages-frameworks/tcl.section.md
new file mode 100644
index 000000000000..71ec9d89eb50
--- /dev/null
+++ b/doc/languages-frameworks/tcl.section.md
@@ -0,0 +1,54 @@
+# Tcl {#sec-language-tcl}
+
+## User guide {#sec-language-tcl-user-guide}
+
+Tcl interpreters are available under the `tcl` and `tcl-X_Y` attributes, where `X_Y` is the Tcl version.
+
+Tcl libraries are available in the `tclPackages` attribute set.
+They are only guaranteed to work with the default Tcl version, but will probably also work with others thanks to the [stubs mechanism](https://wiki.tcl-lang.org/page/Stubs).
+
+## Packaging guide {#sec-language-tcl-packaging}
+
+Tcl packages are typically built with `tclPackages.mkTclDerivation`.
+Tcl dependencies go in `buildInputs`/`nativeBuildInputs`/... like other packages.
+For more complex package definitions, such as packages with mixed languages, use `tcl.tclPackageHook`.
+
+Where possible, make sure to enable stubs for maximum compatibility, usually with the `--enable-stubs` configure flag.
+
+Here is a simple package example to be called with `tclPackages.callPackage`.
+
+```
+{ lib, fetchzip, mkTclDerivation, openssl }:
+
+mkTclDerivation rec {
+  pname = "tcltls";
+  version = "1.7.22";
+
+  src = fetchzip {
+    url = "https://core.tcl-lang.org/tcltls/uv/tcltls-${version}.tar.gz";
+    hash = "sha256-TOouWcQc3MNyJtaAGUGbaQoaCWVe6g3BPERct/V65vk=";
+  };
+
+  buildInputs = [ openssl ];
+
+  configureFlags = [
+    "--with-ssl-dir=${openssl.dev}"
+    "--enable-stubs"
+  ];
+
+  meta = {
+    homepage = "https://core.tcl-lang.org/tcltls/index";
+    description = "OpenSSL / RSA-bsafe Tcl extension";
+    maintainers = [ lib.maintainers.agbrooks ];
+    license = lib.licenses.tcltk;
+    platforms = lib.platforms.unix;
+  };
+}
+```
+
+All Tcl libraries are declared in `pkgs/top-level/tcl-packages.nix` and are defined in `pkgs/development/tcl-modules/`.
+If possible, prefer the by-name hierarchy in `pkgs/development/tcl-modules/by-name/`.
+Its use is documented in `pkgs/development/tcl-modules/by-name/README.md`.
+
+All Tcl applications reside elsewhere.
+In case a package is used as both a library and an application (for example `expect`), it should be defined in `tcl-packages.nix`, with an alias elsewhere.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 19ab24360d23..ce3fae74cbc5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19727,6 +19727,12 @@
     github = "shhht";
     githubId = 118352823;
   };
+  shift = {
+    name = "Vincent Palmer";
+    email = "shift@someone.section.me";
+    github = "shift";
+    githubId = 1653;
+  };
   shikanime = {
     name = "William Phetsinorath";
     email = "deva.shikanime@protonmail.com";
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index f275bb08ef3d..3bfcfa17fcfe 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -393,6 +393,8 @@
   `nodePackages.coc-eslint` and `vimPlugins.coc-eslint` packages offer comparable
   features for `eslint`, which replaced `tslint`.
 
+- Tcl packages have been moved into the `tclPackages` scope.
+
 - `teleport` has been upgraded from major version 15 to major version 16.
   Refer to upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/)
   and [release notes for v16](https://goteleport.com/docs/changelog/#1600-061324).
diff --git a/nixos/modules/services/networking/avahi-daemon.nix b/nixos/modules/services/networking/avahi-daemon.nix
index 72ccb910982c..73fc210728d8 100644
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@@ -317,6 +317,47 @@ in
         Type = "dbus";
         ExecStart = "${cfg.package}/sbin/avahi-daemon --syslog -f ${avahiDaemonConf}";
         ConfigurationDirectory = "avahi/services";
+
+        # Hardening
+        CapabilityBoundingSet = [
+          # https://github.com/avahi/avahi/blob/v0.9-rc1/avahi-daemon/caps.c#L38
+          "CAP_SYS_CHROOT"
+          "CAP_SETUID"
+          "CAP_SETGID"
+        ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = false;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "@chown setgroups setresuid"
+        ];
+        UMask = "0077";
       };
     };
 
diff --git a/nixos/modules/services/networking/coturn.nix b/nixos/modules/services/networking/coturn.nix
index 40c157d1006e..ab8806dc03a1 100644
--- a/nixos/modules/services/networking/coturn.nix
+++ b/nixos/modules/services/networking/coturn.nix
@@ -1,41 +1,41 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:
 let
   cfg = config.services.coturn;
   pidfile = "/run/turnserver/turnserver.pid";
   configFile = pkgs.writeText "turnserver.conf" ''
-listening-port=${toString cfg.listening-port}
-tls-listening-port=${toString cfg.tls-listening-port}
-alt-listening-port=${toString cfg.alt-listening-port}
-alt-tls-listening-port=${toString cfg.alt-tls-listening-port}
-${lib.concatStringsSep "\n" (map (x: "listening-ip=${x}") cfg.listening-ips)}
-${lib.concatStringsSep "\n" (map (x: "relay-ip=${x}") cfg.relay-ips)}
-min-port=${toString cfg.min-port}
-max-port=${toString cfg.max-port}
-${lib.optionalString cfg.lt-cred-mech "lt-cred-mech"}
-${lib.optionalString cfg.no-auth "no-auth"}
-${lib.optionalString cfg.use-auth-secret "use-auth-secret"}
-${lib.optionalString (cfg.static-auth-secret != null) ("static-auth-secret=${cfg.static-auth-secret}")}
-${lib.optionalString (cfg.static-auth-secret-file != null) ("static-auth-secret=#static-auth-secret#")}
-realm=${cfg.realm}
-${lib.optionalString cfg.no-udp "no-udp"}
-${lib.optionalString cfg.no-tcp "no-tcp"}
-${lib.optionalString cfg.no-tls "no-tls"}
-${lib.optionalString cfg.no-dtls "no-dtls"}
-${lib.optionalString cfg.no-udp-relay "no-udp-relay"}
-${lib.optionalString cfg.no-tcp-relay "no-tcp-relay"}
-${lib.optionalString (cfg.cert != null) "cert=${cfg.cert}"}
-${lib.optionalString (cfg.pkey != null) "pkey=${cfg.pkey}"}
-${lib.optionalString (cfg.dh-file != null) ("dh-file=${cfg.dh-file}")}
-no-stdout-log
-syslog
-pidfile=${pidfile}
-${lib.optionalString cfg.secure-stun "secure-stun"}
-${lib.optionalString cfg.no-cli "no-cli"}
-cli-ip=${cfg.cli-ip}
-cli-port=${toString cfg.cli-port}
-${lib.optionalString (cfg.cli-password != null) ("cli-password=${cfg.cli-password}")}
-${cfg.extraConfig}
-'';
+    listening-port=${toString cfg.listening-port}
+    tls-listening-port=${toString cfg.tls-listening-port}
+    alt-listening-port=${toString cfg.alt-listening-port}
+    alt-tls-listening-port=${toString cfg.alt-tls-listening-port}
+    ${lib.concatStringsSep "\n" (map (x: "listening-ip=${x}") cfg.listening-ips)}
+    ${lib.concatStringsSep "\n" (map (x: "relay-ip=${x}") cfg.relay-ips)}
+    min-port=${toString cfg.min-port}
+    max-port=${toString cfg.max-port}
+    ${lib.optionalString cfg.lt-cred-mech "lt-cred-mech"}
+    ${lib.optionalString cfg.no-auth "no-auth"}
+    ${lib.optionalString cfg.use-auth-secret "use-auth-secret"}
+    ${lib.optionalString (cfg.static-auth-secret != null) "static-auth-secret=${cfg.static-auth-secret}"}
+    ${lib.optionalString (cfg.static-auth-secret-file != null) "static-auth-secret=#static-auth-secret#"}
+    realm=${cfg.realm}
+    ${lib.optionalString cfg.no-udp "no-udp"}
+    ${lib.optionalString cfg.no-tcp "no-tcp"}
+    ${lib.optionalString cfg.no-tls "no-tls"}
+    ${lib.optionalString cfg.no-dtls "no-dtls"}
+    ${lib.optionalString cfg.no-udp-relay "no-udp-relay"}
+    ${lib.optionalString cfg.no-tcp-relay "no-tcp-relay"}
+    ${lib.optionalString (cfg.cert != null) "cert=${cfg.cert}"}
+    ${lib.optionalString (cfg.pkey != null) "pkey=${cfg.pkey}"}
+    ${lib.optionalString (cfg.dh-file != null) "dh-file=${cfg.dh-file}"}
+    no-stdout-log
+    syslog
+    pidfile=${pidfile}
+    ${lib.optionalString cfg.secure-stun "secure-stun"}
+    ${lib.optionalString cfg.no-cli "no-cli"}
+    cli-ip=${cfg.cli-ip}
+    cli-port=${toString cfg.cli-port}
+    ${lib.optionalString (cfg.cli-password != null) "cli-password=${cfg.cli-password}"}
+    ${cfg.extraConfig}
+  '';
 in {
   options = {
     services.coturn = {
@@ -301,7 +301,7 @@ in {
     };
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge ([
+  config = lib.mkIf cfg.enable (lib.mkMerge [
     { assertions = [
       { assertion = cfg.static-auth-secret != null -> cfg.static-auth-secret-file == null ;
         message = "static-auth-secret and static-auth-secret-file cannot be set at the same time";
@@ -341,25 +341,66 @@ in {
           '' }
           chmod 640 ${runConfig}
         '';
-        serviceConfig = {
+        serviceConfig = rec {
           Type = "simple";
-          ExecStart = "${pkgs.coturn}/bin/turnserver -c ${runConfig}";
-          RuntimeDirectory = "turnserver";
+          ExecStart = utils.escapeSystemdExecArgs [
+            (lib.getExe' pkgs.coturn "turnserver")
+            "-c"
+            runConfig
+          ];
           User = "turnserver";
           Group = "turnserver";
-          AmbientCapabilities =
-            lib.mkIf (
-              cfg.listening-port < 1024 ||
-              cfg.alt-listening-port < 1024 ||
-              cfg.tls-listening-port < 1024 ||
-              cfg.alt-tls-listening-port < 1024 ||
-              cfg.min-port < 1024
-            ) "cap_net_bind_service";
+          RuntimeDirectory = [
+            "coturn"
+            "turnserver"
+          ];
+          RuntimeDirectoryMode = "0700";
           Restart = "on-abort";
+
+          # Hardening
+          AmbientCapabilities = if
+            cfg.listening-port < 1024 ||
+            cfg.alt-listening-port < 1024 ||
+            cfg.tls-listening-port < 1024 ||
+            cfg.alt-tls-listening-port < 1024 ||
+            cfg.min-port < 1024
+            then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
+          CapabilityBoundingSet = AmbientCapabilities;
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ] ++ lib.optionals (cfg.listening-ips == [ ]) [
+            # only used for interface discovery when no listening ips are configured
+            "AF_NETLINK"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged @resources"
+          ];
+          UMask = "0077";
         };
       };
-    systemd.tmpfiles.rules = [
-      "d  /run/coturn 0700 turnserver turnserver - -"
-    ];
-  }]));
+  }]);
 }
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 6c70f50a6073..6173fca20dbb 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -160,6 +160,7 @@ let
 
       # Misc.
       "systemd-sysctl.service"
+      "systemd-machine-id-commit.service"
     ] ++ optionals cfg.package.withTimedated [
       "dbus-org.freedesktop.timedate1.service"
       "systemd-timedated.service"
diff --git a/nixos/tests/avahi.nix b/nixos/tests/avahi.nix
index 4ae2f919f2f7..7a2d4bbd0ffc 100644
--- a/nixos/tests/avahi.nix
+++ b/nixos/tests/avahi.nix
@@ -75,5 +75,7 @@ import ./make-test-python.nix {
     one.succeed("test `wc -l < out` -gt 0")
     two.succeed("avahi-browse -r -t _ssh._tcp | tee out >&2")
     two.succeed("test `wc -l < out` -gt 0")
+
+    one.log(one.execute("systemd-analyze security avahi-daemon.service | grep -v ✓")[1])
   '';
 } args
diff --git a/nixos/tests/coturn.nix b/nixos/tests/coturn.nix
index b44bf8d06e39..b3c96dba35f8 100644
--- a/nixos/tests/coturn.nix
+++ b/nixos/tests/coturn.nix
@@ -30,5 +30,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
           secretsfile.fail("${pkgs.coturn}/bin/turnutils_uclient -W some-very-secret-string 127.0.0.1 -DgX -e 127.0.0.1 -n 1 -c -y")
           # allowed-peer-ip, should succeed:
           secretsfile.succeed("${pkgs.coturn}/bin/turnutils_uclient -W some-very-secret-string 192.168.1.2 -DgX -e 192.168.1.2 -n 1 -c -y")
+
+      default.log(default.execute("systemd-analyze security coturn.service | grep -v '✓'")[1])
     '';
 })
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index 0742af6aa840..63c52227e7fd 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -85,10 +85,17 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     import re
     import subprocess
 
+    machine.start(allow_reboot=True)
+
     # Will not succeed unless ConditionFirstBoot=yes
     machine.wait_for_unit("first-boot-complete.target")
 
+    # Make sure, a subsequent boot isn't a ConditionFirstBoot=yes.
+    machine.reboot()
     machine.wait_for_x()
+    state = machine.get_unit_info("first-boot-complete.target")['ActiveState']
+    assert state == 'inactive', "Detected first boot despite first-boot-completed.target was already reached on a previous boot."
+
     # wait for user services
     machine.wait_for_unit("default.target", "alice")
 
diff --git a/pkgs/applications/misc/therion/default.nix b/pkgs/applications/misc/therion/default.nix
index fbe734ddc1b6..3dd72b9f6829 100644
--- a/pkgs/applications/misc/therion/default.nix
+++ b/pkgs/applications/misc/therion/default.nix
@@ -5,10 +5,9 @@
 , pkg-config
 , perl
 , tcl
-, tcllib
+, tclPackages
 , tk
 , expat
-, bwidget
 , python3
 , texliveTeTeX
 , survex
@@ -25,7 +24,6 @@
 , sqlite
 , libtiff
 , curl
-, tkimg
 }:
 
 stdenv.mkDerivation rec {
@@ -59,7 +57,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     expat
-    tkimg
+    tclPackages.tkimg
     proj
     wxGTK32
     vtk
@@ -74,8 +72,8 @@ stdenv.mkDerivation rec {
     curl
     fmt
     tcl
-    tcllib
-    bwidget
+    tclPackages.tcllib
+    tclPackages.bwidget
   ];
 
   fixupPhase = ''
diff --git a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
index b92770374804..54764ec30572 100644
--- a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
+++ b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "cloudfoundry-cli";
-  version = "8.8.1";
+  version = "8.8.2";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-0SVz97XjFeXaj56ssqFK2jTUQfL0rSc72HAdK9mikUc=";
+    sha256 = "sha256-gDWfzM5CKWIc0gZ5uzJJZY0BySxzN40+sCp0h2Sp7DE=";
   };
-  vendorHash = "sha256-WI4yg+r8zGLZI10/kNFkdbzXk0hZ6CCXvXLOd8l7AWo=";
+  vendorHash = "sha256-Xcoi9MZPrr0DYOcqziF+EFCQdYLWIqXX3IW6D8k6b+E=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix b/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix
index 157ff1358ce0..4356788418d9 100644
--- a/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "kubectl-cnpg";
-  version = "1.24.0";
+  version = "1.24.1";
 
   src = fetchFromGitHub {
     owner = "cloudnative-pg";
     repo = "cloudnative-pg";
     rev = "v${version}";
-    hash = "sha256-/BUrUksNT6KuVLxJxnBfkU9OEeQU3u7WA6pKqcGnuSU=";
+    hash = "sha256-M33ngnpxR3fQNsAkef4Rs4I3wNpOu5wTxbl48gL88F8=";
   };
 
-  vendorHash = "sha256-s1fKwWfOSgRw6eOPc1aZzf1VzaTVHXBjQWd1132vAS0=";
+  vendorHash = "sha256-nFWMw/FpaALp347z5dO8509fJCVISwS6z57JfQ+p3Dg=";
 
   subPackages = [ "cmd/kubectl-cnpg" ];
 
diff --git a/pkgs/applications/networking/cluster/luigi/default.nix b/pkgs/applications/networking/cluster/luigi/default.nix
index 8c145ef6393f..158c8ff8242e 100644
--- a/pkgs/applications/networking/cluster/luigi/default.nix
+++ b/pkgs/applications/networking/cluster/luigi/default.nix
@@ -12,6 +12,8 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = [ python3.pkgs.setuptools ];
 
+  pythonRelaxDeps = [ "tenacity" ];
+
   dependencies = with python3.pkgs; [ python-dateutil tornado python-daemon tenacity ];
 
   pythonImportsCheck = [ "luigi" ];
diff --git a/pkgs/applications/networking/discordo/default.nix b/pkgs/applications/networking/discordo/default.nix
index b7b7f0ad5334..0116680f01eb 100644
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "discordo";
-  version = "0-unstable-2024-07-02";
+  version = "0-unstable-2024-10-13";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = pname;
-    rev = "31905f3e790e63cd0f2366526afe41fb278c226e";
-    hash = "sha256-IhGZGHV/A1m653WlVCwxtb9OZbMolQ3GHOr2fXehjNk=";
+    rev = "26b77d9385daa2dc056930fa302a3c06595680ba";
+    hash = "sha256-zXqYj8IBDVeDKjm0m8CYEX+tmHLpY2u7A4g38IiDNZk=";
   };
 
-  vendorHash = "sha256-5ZsvoIDwxZCGkMRxlCyp2Iv6fcvvpmzG+krz3MZSiTM=";
+  vendorHash = "sha256-68NGcdyKuabSdW6CKAJUaJ0k2dpO0bm3OfNQ7qEVcqk=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index a4d74750fbd2..9c28a80aa497 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20241021-1";
+  version = "20241025";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     rev = version;
-    hash = "sha256-fO/GSnmXsB4YVnfBBh1IXai15JeRLcAiihufIouBpxw=";
+    hash = "sha256-ivk7sqTP5kLXrTn+XDrat0VxiK0atA5xI3TzKXvxaV0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/chemistry/openmolcas/default.nix b/pkgs/applications/science/chemistry/openmolcas/default.nix
index d500e78b2482..76192e4d4de9 100644
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@@ -15,6 +15,7 @@
 , gsl
 , boost180
 , autoPatchelfHook
+, enableQcmaquis ? false
   # Note that the CASPT2 module is broken with MPI
   # See https://gitlab.com/Molcas/OpenMolcas/-/issues/169
 , enableMpi ? false
@@ -24,14 +25,15 @@
 
 assert blas-ilp64.isILP64;
 assert lib.elem blas-ilp64.passthru.implementation [ "openblas" "mkl" ];
+assert enableQcmaquis -> lib.elem blas-ilp64.passthru.implementation "mkl";
 
 let
   python = python3.withPackages (ps: with ps; [ six pyparsing numpy h5py ]);
   qcmaquisSrc = fetchFromGitHub {
     owner = "qcscine";
     repo = "qcmaquis";
-    rev = "release-3.1.1"; # Must match tag in cmake/custom/qcmaquis.cmake
-    hash = "sha256-diLDWj/Om6EHrVp+Hd24jsN6R9vV2vRl0y9gqyRWhkI=";
+    rev = "release-3.1.4"; # Must match tag in cmake/custom/qcmaquis.cmake
+    hash = "sha256-vhC5k+91IPFxdCi5oYt1NtF9W08RxonJjPpA0ls4I+o=";
   };
   nevtp2Src = fetchFromGitHub {
     owner = "qcscine";
@@ -43,13 +45,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openmolcas";
-  version = "24.06";
+  version = "24.10";
 
   src = fetchFromGitLab {
     owner = "Molcas";
     repo = "OpenMolcas";
     rev = "v${version}";
-    hash = "sha256-/y6vEvA1Zf+p7Z0WpcN4P5voLN8MmfbKz1FuthgVQp0=";
+    hash = "sha256-LXxr/xqBHG7a0rOBrb8IMZ4IjZak3NsBw40Qf+z1fic=";
   };
 
   patches = [
@@ -104,8 +106,8 @@ stdenv.mkDerivation rec {
     "-DHDF5=ON"
     "-DFDE=ON"
     "-DEXTERNAL_LIBXC=${lib.getDev libxc}"
-    "-DDMRG=ON"
-    "-DNEVPT2=ON"
+    (lib.strings.cmakeBool "DMRG" enableQcmaquis)
+    (lib.strings.cmakeBool "NEVPT2" enableQcmaquis)
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ] ++ lib.optionals (blas-ilp64.passthru.implementation == "openblas") [
     "-DOPENBLASROOT=${blas-ilp64.passthru.provider.dev}"
diff --git a/pkgs/applications/science/chemistry/openmolcas/qcmaquis.patch b/pkgs/applications/science/chemistry/openmolcas/qcmaquis.patch
index ca276bb3fb58..c388f699a1cc 100644
--- a/pkgs/applications/science/chemistry/openmolcas/qcmaquis.patch
+++ b/pkgs/applications/science/chemistry/openmolcas/qcmaquis.patch
@@ -22,25 +22,26 @@ index 789739ec8..6c86a7b8c 100644
                      INSTALL_DIR "${PROJECT_BINARY_DIR}/qcmaquis"
                     )
 diff --git a/cmake/custom/qcmaquis.cmake b/cmake/custom/qcmaquis.cmake
-index 176d02761..e160b7bc8 100644
+index 5fd1ef207..8d2957c6e 100644
 --- a/cmake/custom/qcmaquis.cmake
 +++ b/cmake/custom/qcmaquis.cmake
-@@ -78,6 +78,7 @@ list(APPEND QCMaquisCMakeArgs
-   -DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}
-   -DCMAKE_CXX_FLAGS=${QCM_CMake_CXX_FLAGS}
-   -DCMAKE_INSTALL_PREFIX:PATH=<INSTALL_DIR>
-+  -DCMAKE_SKIP_BUILD_RPATH=ON
-   )
- if(HDF5_ROOT)
-   list(APPEND QCMaquisCMakeArgs
-@@ -278,9 +279,7 @@ set (CMAKE_DISABLE_SOURCE_CHANGES OFF)
+@@ -77,6 +77,7 @@ list (APPEND QCMaquisCMakeArgs
+       -DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}
+       -DCMAKE_CXX_FLAGS=${QCM_CMake_CXX_FLAGS}
+       -DCMAKE_INSTALL_PREFIX:PATH=<INSTALL_DIR>
++      -DCMAKE_SKIP_BUILD_RPATH=ON
+ )
+ if (HDF5_ROOT)
+   list (APPEND QCMaquisCMakeArgs
+@@ -274,10 +275,7 @@ if (NOT MAQUIS_DMRG_FOUND) # Does the opposite work?
  
-     ExternalProject_Add(${EP_PROJECT}
-         PREFIX ${extprojpath}
--        GIT_REPOSITORY ${reference_git_repo}
--        GIT_TAG ${reference_git_commit}
--        UPDATE_DISCONNECTED ${EP_SkipUpdate}
-+        URL @qcmaquis_src_url@
- 
-         SOURCE_SUBDIR dmrg
-         CMAKE_ARGS ${EP_CMAKE_ARGS}
+   ExternalProject_Add (${EP_PROJECT}
+                        PREFIX ${extprojpath}
+-                       GIT_REPOSITORY ${reference_git_repo}
+-                       GIT_TAG ${reference_git_commit}
+-                       UPDATE_DISCONNECTED ${EP_SkipUpdate}
+-
++                       URL @qcmaquis_src_url@
+                        SOURCE_SUBDIR dmrg
+                        CMAKE_ARGS ${EP_CMAKE_ARGS}
+                        CMAKE_CACHE_ARGS ${EP_CMAKE_CACHE_ARGS}
diff --git a/pkgs/applications/science/electronics/openroad/default.nix b/pkgs/applications/science/electronics/openroad/default.nix
index 65bf094c2a2c..cae21d7bba4b 100644
--- a/pkgs/applications/science/electronics/openroad/default.nix
+++ b/pkgs/applications/science/electronics/openroad/default.nix
@@ -26,7 +26,7 @@
 , readline
 , spdlog
 , tcl
-, tcllib
+, tclPackages
 , xorg
 , yosys
 , zlib
@@ -72,7 +72,7 @@ mkDerivation rec {
     readline
     spdlog
     tcl
-    tcllib
+    tclPackages.tcllib
     yosys
     xorg.libX11
     zlib
diff --git a/pkgs/applications/version-management/fossil/default.nix b/pkgs/applications/version-management/fossil/default.nix
index a00cc8e78cc7..77658b58f260 100644
--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/applications/version-management/fossil/default.nix
@@ -12,7 +12,7 @@
 , sqlite
 , ed
 , which
-, tcllib
+, tclPackages
 , withJson ? true
 }:
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   # required for build time tool `./tools/translate.c`
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  nativeBuildInputs = [ installShellFiles tcl tcllib ];
+  nativeBuildInputs = [ installShellFiles tcl tclPackages.tcllib ];
 
   buildInputs = [ zlib openssl readline which ed ]
     ++ lib.optional stdenv.hostPlatform.isDarwin libiconv
diff --git a/pkgs/applications/version-management/gitoxide/default.nix b/pkgs/applications/version-management/gitoxide/default.nix
index f89e80c2daa6..f78401a5220f 100644
--- a/pkgs/applications/version-management/gitoxide/default.nix
+++ b/pkgs/applications/version-management/gitoxide/default.nix
@@ -19,16 +19,16 @@ let
   ein = "${stdenv.hostPlatform.emulator buildPackages} $out/bin/ein";
 in rustPlatform.buildRustPackage rec {
   pname = "gitoxide";
-  version = "0.37.0";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "gitoxide";
     rev = "v${version}";
-    hash = "sha256-ZnfWIFphIdPHKvpzO0Cn5KCahpvKh56HZun09I1l8Vc=";
+    hash = "sha256-JqWFdZXcmL97w5CochG9kXXH7cN2KMarkNUvfQXbYU0=";
   };
 
-  cargoHash = "sha256-oKcCodoMUaduxXXgUV+z7zlg5mc783PSsgoECdW/Uug=";
+  cargoHash = "sha256-EGPx4NNvgGe+LJ8Gn0ne8O4lCA+9p+E9J7OOhLQDWX0=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles ];
 
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 52d4155f4604..a82728ef1025 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -19,8 +19,7 @@ curl=(
     --user-agent "curl/$curlVersion Nixpkgs/$nixpkgsVersion"
 )
 
-# Default fallback value defined in pkgs/build-support/fetchurl/default.nix
-if [ "$SSL_CERT_FILE" == "/no-cert-file.crt" ]; then
+if ! [ -f "$SSL_CERT_FILE" ]; then
     curl+=(--insecure)
 fi
 
diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix
index ccfc02d47c54..e4a70743334b 100644
--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@@ -220,26 +220,20 @@ stdenvNoCC.mkDerivation (
     # New-style output content requirements.
     inherit (hash_) outputHashAlgo outputHash;
 
+    # Disable TLS verification only when we know the hash and no credentials are
+    # needed to access the resource
     SSL_CERT_FILE =
-      let
-        nixSSLCertFile = builtins.getEnv "NIX_SSL_CERT_FILE";
-      in
-      if nixSSLCertFile != "" then
-        nixSSLCertFile
-      else if
+      if
         (
           hash_.outputHash == ""
           || hash_.outputHash == lib.fakeSha256
           || hash_.outputHash == lib.fakeSha512
           || hash_.outputHash == lib.fakeHash
-          # Make sure we always enforce TLS verification when credentials
-          # are needed to access the resource
           || netrcPhase != null
         )
       then
         "${cacert}/etc/ssl/certs/ca-bundle.crt"
       else
-        # Fallback to stdenv default, see pkgs/stdenv/generic/setup.sh
         "/no-cert-file.crt";
 
     outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/by-name/_1/_1password/package.nix
similarity index 63%
rename from pkgs/applications/misc/1password/default.nix
rename to pkgs/by-name/_1/_1password/package.nix
index 81cb76043f8e..085013667620 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/by-name/_1/_1password/package.nix
@@ -1,8 +1,19 @@
-{ lib, stdenv, fetchurl, fetchzip, autoPatchelfHook, installShellFiles, cpio, xar, _1password, testers }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  fetchzip,
+  autoPatchelfHook,
+  installShellFiles,
+  cpio,
+  xar,
+  versionCheckHook,
+}:
 
 let
   inherit (stdenv.hostPlatform) system;
-  fetch = srcPlatform: hash: extension:
+  fetch =
+    srcPlatform: hash: extension:
     let
       args = {
         url = "https://cache.agilebits.com/dist/1P/op2/pkg/v${version}/op_${srcPlatform}_v${version}.${extension}";
@@ -12,12 +23,14 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.29.0";
+  version = "2.30.0";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-sBbdkoacGI/gawM4YH+BBCLDhC2B+cE4iKVGHBhwkic=" "zip";
-    i686-linux = fetch "linux_386" "sha256-TTd5juT0Aqp1+OfunXcuk0KbL6HIHQV31+1Q1e0GYMY=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-Bb6fNoeNxlbDfwt7Jr8BaKCmFUwSdsLQdVoCmQCNmLA=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-/ryklZnGhrgJggDIa8HmuDsHAXkdrWeXKCQGGVwUAAo=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-KNduqspTzLEHmymSefLnnhIBcIQWx2tshvOc0NwDek0=" "zip";
+    i686-linux = fetch "linux_386" "sha256-StdWtD3tz6bKqSem/GFqeRHzkbv4aP7d7dKKtgNhuY8=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-bzhRkpR3te1bcBEfP2BR6SECTC9sRFDshl7B+/278Kg=" "zip";
+    aarch64-darwin =
+      fetch "apple_universal" "sha256-L1SZWQWjAJDZydlAttbWLS7igZNAvOmIyaUUdVbvEa8="
+        "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
@@ -32,9 +45,15 @@ stdenv.mkDerivation {
     else
       throw "Source for ${pname} is not available for ${system}";
 
-  nativeBuildInputs = [ installShellFiles ] ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
+  nativeBuildInputs = [
+    installShellFiles
+    versionCheckHook
+  ] ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ xar cpio ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    xar
+    cpio
+  ];
 
   unpackPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
     xar -xf $src
@@ -59,14 +78,11 @@ stdenv.mkDerivation {
 
   doInstallCheck = true;
 
-  installCheckPhase = ''
-    $out/bin/${mainProgram} --version
-  '';
+  versionCheckProgram = "${builtins.placeholder "out"}/bin/${mainProgram}";
+  versionCheckProgramArg = [ "--version" ];
 
-  passthru.updateScript = ./update.sh;
-
-  passthru.tests.version = testers.testVersion {
-    package = _1password;
+  passthru = {
+    updateScript = ./update.sh;
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/1password/update.sh b/pkgs/by-name/_1/_1password/update.sh
similarity index 97%
rename from pkgs/applications/misc/1password/update.sh
rename to pkgs/by-name/_1/_1password/update.sh
index 562c1af31a25..4f04279fcea6 100755
--- a/pkgs/applications/misc/1password/update.sh
+++ b/pkgs/by-name/_1/_1password/update.sh
@@ -4,7 +4,7 @@
 set -eu
 
 ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/default.nix"
+NIX_DRV="$ROOT/package.nix"
 if [ ! -f "$NIX_DRV" ]; then
   echo "ERROR: cannot find default.nix in $ROOT"
   exit 1
diff --git a/pkgs/by-name/ad/ad-miner/package.nix b/pkgs/by-name/ad/ad-miner/package.nix
index 3a7b3b685359..b1aaf615c6e5 100644
--- a/pkgs/by-name/ad/ad-miner/package.nix
+++ b/pkgs/by-name/ad/ad-miner/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ad-miner";
-  version = "1.6.0";
+  version = "1.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mazars-Tech";
     repo = "AD_Miner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kWIareupm0r48HGnESk5S/0IEKjDfHtXWi64ehjdAQ4=";
+    hash = "sha256-/TIG1UUfLct9MxCmahWk7F6KlypNan+zk/02zVpPV+w=";
   };
 
   # All requirements are pinned
diff --git a/pkgs/by-name/an/anytype/package.nix b/pkgs/by-name/an/anytype/package.nix
index af5ee3c7277c..cd9f7d15438d 100644
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@@ -2,11 +2,11 @@
 
 let
   pname = "anytype";
-  version = "0.42.8";
+  version = "0.43.1";
   name = "Anytype-${version}";
   src = fetchurl {
     url = "https://github.com/anyproto/anytype-ts/releases/download/v${version}/${name}.AppImage";
-    hash = "sha256-MIPKfwIZQah6K+WOQZsTpVcOrws+f4oVa7BoW29K5BA=";
+    hash = "sha256-9CjzFJcMiEGods2Ulm4Ow3lIBXc7HPcWMUFM4cG7GuM=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in appimageTools.wrapType2 {
diff --git a/pkgs/by-name/cl/clipcat/0001-fix-build.patch b/pkgs/by-name/cl/clipcat/0001-fix-build.patch
deleted file mode 100644
index e92bb6c7a850..000000000000
--- a/pkgs/by-name/cl/clipcat/0001-fix-build.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 9ba11f90c4364529f220c44a3266926bf8f6a4b4 Mon Sep 17 00:00:00 2001
-From: wxt <3264117476@qq.com>
-Date: Tue, 22 Oct 2024 18:43:20 +0800
-Subject: [PATCH] fix build
-
----
- Cargo.toml              | 1 -
- crates/proto/build.rs   | 1 -
- crates/proto/src/lib.rs | 1 -
- 3 files changed, 3 deletions(-)
-
-diff --git a/Cargo.toml b/Cargo.toml
-index 8deae48..214a0e3 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -122,7 +122,6 @@ clipcat-server          = { path = "./crates/server" }
- 
- [workspace.lints.rust]
- async_fn_in_trait = "allow"
--box_pointers      = "allow"
- 
- # TODO: deny `unused_crate_dependencies` after https://github.com/rust-lang/rust/issues/95513 being solved
- unused_crate_dependencies = "allow"
-diff --git a/crates/proto/build.rs b/crates/proto/build.rs
-index 5e38f62..d6ba4be 100644
---- a/crates/proto/build.rs
-+++ b/crates/proto/build.rs
-@@ -6,7 +6,6 @@ fn prost_config() -> Config {
-     config
- }
- 
--#[allow(box_pointers)]
- fn main() -> Result<(), Box<dyn std::error::Error>> {
-     tonic_build::configure().compile_with_config(
-         prost_config(),
-diff --git a/crates/proto/src/lib.rs b/crates/proto/src/lib.rs
-index a7205ab..e4dcd02 100644
---- a/crates/proto/src/lib.rs
-+++ b/crates/proto/src/lib.rs
-@@ -2,7 +2,6 @@ mod utils;
- mod proto {
-     // SAFETY: allow: prost
-     #![allow(
--        box_pointers,
-         unreachable_pub,
-         unused_qualifications,
-         unused_results,
--- 
-2.46.1
-
diff --git a/pkgs/by-name/cl/clipcat/package.nix b/pkgs/by-name/cl/clipcat/package.nix
index f62b214f9de3..1630253966e4 100644
--- a/pkgs/by-name/cl/clipcat/package.nix
+++ b/pkgs/by-name/cl/clipcat/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "clipcat";
-  version = "0.18.3";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "xrelkd";
     repo = "clipcat";
     rev = "refs/tags/v${version}";
-    hash = "sha256-95y/HiLmhqt1DFmAxLg/W7lr/9dfVtce4+tx+vG2Nuw=";
+    hash = "sha256-94xw/E1Jp+bctVNzRZDdVaxxSMF/R87DNlRAzRT3Uvg=";
   };
 
-  cargoHash = "sha256-z2t7kq2ogMHJGF7xQnzc11B42gUZFTVokVkbw35CeY0=";
+  cargoHash = "sha256-qDcUEJSBd8c/ept/Y+GQCrp5b7xkSdX6ktdO9/c3k8o=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.Cocoa
@@ -32,10 +32,6 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  patches = [
-    ./0001-fix-build.patch
-  ];
-
   checkFlags = [
     # Some test cases interact with X11, skip them
     "--skip=test_x11_clipboard"
diff --git a/pkgs/by-name/em/emacspeak/package.nix b/pkgs/by-name/em/emacspeak/package.nix
index 6c18af7807ea..3e9b753be964 100644
--- a/pkgs/by-name/em/emacspeak/package.nix
+++ b/pkgs/by-name/em/emacspeak/package.nix
@@ -5,7 +5,7 @@
 , makeWrapper
 , stdenv
 , tcl
-, tclx
+, tclPackages
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     espeak-ng
     tcl
-    tclx
+    tclPackages.tclx
   ];
 
   strictDeps = true;
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     find "$d" -type f -not -executable -execdir chmod 644 {} +
     makeWrapper ${lib.getExe emacs} $out/bin/emacspeak \
         --set DTK_PROGRAM "${placeholder "out"}/share/emacs/site-lisp/emacspeak/servers/espeak" \
-        --set TCLLIBPATH "${tclx}/lib" \
+        --set TCLLIBPATH "${tclPackages.tclx}/lib" \
         --add-flags '-l "${placeholder "out"}/share/emacs/site-lisp/emacspeak/lisp/emacspeak-setup.elc"'
   '';
 
diff --git a/pkgs/by-name/fl/flarectl/package.nix b/pkgs/by-name/fl/flarectl/package.nix
index 8acf4040b44c..7a9c347c8d45 100644
--- a/pkgs/by-name/fl/flarectl/package.nix
+++ b/pkgs/by-name/fl/flarectl/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "flarectl";
-  version = "0.105.0";
+  version = "0.108.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflare-go";
     rev = "v${version}";
-    hash = "sha256-xUITOBXBy5Jt0DFRNffX7sRhAtgUPMEJOHa2SbjM1n0=";
+    hash = "sha256-9pPDoXYZCcMnusBfQ1PQ8l/ZFvPNTOA8dRJALXY1Kho=";
   };
 
-  vendorHash = "sha256-KMCwbbDpj4QAgvKLlOPDKSlrDyf+K/tGTMM/GBlvyuc=";
+  vendorHash = "sha256-U6ogqAweU2DZb26Ct4K/1TnCGRn//p11nVkFKzC+tj0=";
 
   subPackages = [ "cmd/flarectl" ];
 
diff --git a/pkgs/by-name/go/go-dnscollector/package.nix b/pkgs/by-name/go/go-dnscollector/package.nix
new file mode 100644
index 000000000000..ab1d4a44da5e
--- /dev/null
+++ b/pkgs/by-name/go/go-dnscollector/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "go-dnscollector";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "dmachard";
+    repo = "go-dnscollector";
+    rev = "v${version}";
+    sha256 = "sha256-+EE9miEm1sHxTHcQ+Zmnj5ljSisKtds9L+SLIvgIfb4=";
+  };
+
+  vendorHash = "sha256-Njv8EGPS45NpCs0+poBxVGWLHhH+mSZuI80kIpsijDQ=";
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Ingesting, pipelining, and enhancing your DNS logs with usage indicators, security analysis, and additional metadata.";
+    homepage = "https://github.com/dmachard/go-dnscollector";
+    license = licenses.mit;
+    maintainers = with maintainers; [ shift ];
+  };
+}
diff --git a/pkgs/by-name/gr/grafana-kiosk/package.nix b/pkgs/by-name/gr/grafana-kiosk/package.nix
index 3f81fe7ca501..39a26d95056a 100644
--- a/pkgs/by-name/gr/grafana-kiosk/package.nix
+++ b/pkgs/by-name/gr/grafana-kiosk/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "grafana-kiosk";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana-kiosk";
     rev = "v${version}";
-    hash = "sha256-JTz3EaedJFWE3YqsBLjKH4hWI7+dNeMlp0sZ2kW8IR8=";
+    hash = "sha256-M0Gz0+MQNTIOYBxVRaxk5kYZwoJy1nPckGcYF29EzHA=";
   };
 
-  vendorHash = "sha256-8sxfbSj0Jq5f0oJoe8PtP72PDWvLzgOeRiP7I/Pfam4=";
+  vendorHash = "sha256-dnA5Z6VX7+RLpV7+PPuckH+v407dK8nbe0OVJtfG1YE=";
 
   nativeBuildInputs = [ makeWrapper ];
   postFixup = ''
diff --git a/pkgs/by-name/ho/host-spawn/package.nix b/pkgs/by-name/ho/host-spawn/package.nix
new file mode 100644
index 000000000000..6fd12d0968e6
--- /dev/null
+++ b/pkgs/by-name/ho/host-spawn/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "host-spawn";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "1player";
+    repo = "host-spawn";
+    rev = "v${version}";
+    hash = "sha256-017o50MSSkehn4zMEdCTPW2o2IQaXbI21z8Z+jfRuDs=";
+  };
+
+  vendorHash = "sha256-Agc3hl+VDTNW7cnh/0g4G8BgzNAX11hKASYQKieBN4M=";
+
+  meta = with lib; {
+    homepage = "https://github.com/1player/host-spawn";
+    description = "Run commands on your host machine from inside your flatpak sandbox, toolbox or distrobox containers";
+    license = licenses.mit0;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ garrison ];
+    mainProgram = "host-spawn";
+  };
+}
diff --git a/pkgs/by-name/hw/hwinfo/package.nix b/pkgs/by-name/hw/hwinfo/package.nix
index 14e922df1533..cfb940d66cd1 100644
--- a/pkgs/by-name/hw/hwinfo/package.nix
+++ b/pkgs/by-name/hw/hwinfo/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwinfo";
-  version = "23.2";
+  version = "23.3";
 
   src = fetchFromGitHub {
     owner = "opensuse";
     repo = "hwinfo";
     rev = finalAttrs.version;
-    hash = "sha256-YAhsnE1DJ5UlYAuhDxS/5IpfIJB6DrhCT3E0YiKENjU=";
+    hash = "sha256-TOW6jD7ZTA32H4oByaVkDAjUSwo9JSID7WSBYj7ZzBs=";
   };
 
   nativeBuildInputs = [
@@ -65,6 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "/usr/bin/udevinfo" "${systemdMinimal}/bin/udevinfo" \
       --replace-fail "/usr/bin/udevadm" "${systemdMinimal}/bin/udevadm"
 
+    # Replace /usr/bin/perl
+    patchShebangs src/ids/convert_hd
   '';
 
   # The pci/usb ids in hwinfo are ancient. We can get a more up-to-date list simply by copying from systemd
diff --git a/pkgs/by-name/hy/hyprcursor/package.nix b/pkgs/by-name/hy/hyprcursor/package.nix
index 5b8480dc20cd..9ef6b761f704 100644
--- a/pkgs/by-name/hy/hyprcursor/package.nix
+++ b/pkgs/by-name/hy/hyprcursor/package.nix
@@ -1,31 +1,28 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, pkg-config
-, cairo
-, hyprlang
-, librsvg
-, libzip
-, tomlplusplus
-, nix-update-script
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  cairo,
+  hyprlang,
+  librsvg,
+  libzip,
+  xcur2png,
+  tomlplusplus,
+  nix-update-script,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprcursor";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprcursor";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-FIN1wMoyePBTtibCbaeJaoKNLuAYIGwLCWAYC1DJanw=";
+    hash = "sha256-NqihN/x8T4+wumSP1orwCCdEmD2xWgLR5QzfY+kAtuU=";
   };
 
-  patches = [
-    # fix icon directories system search path
-    "${finalAttrs.src}/nix/dirs.patch"
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -36,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     hyprlang
     librsvg
     libzip
+    xcur2png
     tomlplusplus
   ];
 
diff --git a/pkgs/by-name/ja/jasp-desktop/package.nix b/pkgs/by-name/ja/jasp-desktop/package.nix
index a444b361127f..08fd1425fc39 100644
--- a/pkgs/by-name/ja/jasp-desktop/package.nix
+++ b/pkgs/by-name/ja/jasp-desktop/package.nix
@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "jasp-stats";
     repo = "jasp-desktop";
     rev = "v${version}";
-    hash = "sha256-G84bmR+40W9RV+OIXYuMmwdEFE0iPMp/wEOcRHYUoj8=";
+    hash = "sha256-SACGyNVxa6rFjloRQrEVtUgujEEF7WYL8Qhw6ZqLwdQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ke/keep-sorted/package.nix b/pkgs/by-name/ke/keep-sorted/package.nix
index 6b2f9760e20d..610cd3342948 100644
--- a/pkgs/by-name/ke/keep-sorted/package.nix
+++ b/pkgs/by-name/ke/keep-sorted/package.nix
@@ -7,13 +7,13 @@
 
 buildGo123Module rec {
   pname = "keep-sorted";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "keep-sorted";
     rev = "v${version}";
-    hash = "sha256-jqSb/lcdeQMa1XpzaopDBbkKymp+HubLeAx3d6x5pns=";
+    hash = "sha256-xvSEREEOiwft3fPN+xtdMCh+z3PknjJ962Nb+pw715U=";
   };
 
   vendorHash = "sha256-HTE9vfjRmi5GpMue7lUfd0jmssPgSOljbfPbya4uGsc=";
@@ -22,10 +22,10 @@ buildGo123Module rec {
 
   ldflags = [ "-s" ];
 
-  checkFlags = [
-    # Test tries to find files using git
-    "-skip=^TestGoldens"
-  ];
+  preCheck = ''
+    # Test tries to find files using git in init func.
+    rm goldens/*_test.go
+  '';
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ke/keydb/package.nix b/pkgs/by-name/ke/keydb/package.nix
index 265f8a884fcb..ed6ba8bd518c 100644
--- a/pkgs/by-name/ke/keydb/package.nix
+++ b/pkgs/by-name/ke/keydb/package.nix
@@ -12,7 +12,7 @@
   jemalloc,
   which,
   tcl,
-  tcltls,
+  tclPackages,
   ps,
   getconf,
   nixosTests,
@@ -60,11 +60,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   # darwin currently lacks a pure `pgrep` which is extensively used here
   doCheck = !stdenv.hostPlatform.isDarwin;
-  nativeCheckInputs = [
-    which
-    tcl
-    ps
-  ] ++ lib.optionals stdenv.hostPlatform.isStatic [ getconf ] ++ lib.optionals tlsSupport [ tcltls ];
+  nativeCheckInputs =
+    [
+      which
+      tcl
+      ps
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isStatic [ getconf ]
+    ++ lib.optionals tlsSupport [ tclPackages.tcltls ];
   checkPhase = ''
     runHook preCheck
 
diff --git a/pkgs/by-name/li/livekit/package.nix b/pkgs/by-name/li/livekit/package.nix
index 31b4f2f65601..a477069c6e34 100644
--- a/pkgs/by-name/li/livekit/package.nix
+++ b/pkgs/by-name/li/livekit/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "livekit";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "livekit";
     rev = "v${version}";
-    hash = "sha256-z3xXvs31SMEq0Wfhm/v+7iznCsz/kNqwhQsMueQmEhw=";
+    hash = "sha256-KfUhpA5bhomPU5OC4aCQ5WQIC4ICkaLxQO0tunpkIPI=";
   };
 
-  vendorHash = "sha256-aVKCDDlCkFlFa88H1UAR98Hai5junVWVxVZPK5i+nM8=";
+  vendorHash = "sha256-z5h/r2xC/nEeHk2PLIN+oaGHa8l/xjws79OaDZh9jqE=";
 
   subPackages = [ "cmd/server" ];
 
diff --git a/pkgs/tools/misc/mise/default.nix b/pkgs/by-name/mi/mise/package.nix
similarity index 61%
rename from pkgs/tools/misc/mise/default.nix
rename to pkgs/by-name/mi/mise/package.nix
index 6964083e631c..8adb9516b089 100644
--- a/pkgs/tools/misc/mise/default.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -7,9 +7,10 @@
   stdenv,
   coreutils,
   bash,
+  direnv,
+  git,
   pkg-config,
   openssl,
-  direnv,
   Security,
   SystemConfiguration,
   usage,
@@ -19,22 +20,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2024.9.0";
+  version = "2024.10.8";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-q515JEpws1UnZm1b8zgGxPvudH846XV+Ct4qKN2mNMQ=";
-
-    # registry is not needed for compilation nor for tests.
-    # contains files with the same name but different case, which cause problems with hash on darwin
-    postFetch = ''
-      rm -rf $out/registry
-    '';
+    hash = "sha256-58y7jx7gmWlccezZXP5hSzrvnq8hlZ1QakF+FMgbwcc=";
   };
 
-  cargoHash = "sha256-jGqaGbue+AEK0YjhHMlm84XBgA20p8Um03TjctjXVz0=";
+  cargoHash = "sha256-m2Eiqyh/rGgwRgRArs3fPWoqzi1EidZd5i66yi4SuFo=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -52,27 +47,30 @@ rustPlatform.buildRustPackage rec {
       ./test/data/plugins/**/bin/* \
       ./src/fake_asdf.rs \
       ./src/cli/generate/git_pre_commit.rs \
-      ./src/cli/generate/snapshots/*.snap \
-      ./src/cli/reshim.rs \
-      ./test/cwd/.mise/tasks/filetask
+      ./src/cli/generate/snapshots/*.snap
 
     substituteInPlace ./src/test.rs \
-      --replace-fail '/usr/bin/env bash' '${bash}/bin/bash'
+      --replace-fail '/usr/bin/env bash' '${lib.getExe bash}' \
+      --replace-fail '"git"' '"${lib.getExe git}"'
+
+    substituteInPlace ./src/git.rs \
+      --replace-fail '"git"' '"${lib.getExe git}"'
 
     substituteInPlace ./src/env_diff.rs \
-      --replace-fail '"bash"' '"${bash}/bin/bash"'
+      --replace-fail '"bash"' '"${lib.getExe bash}"'
 
     substituteInPlace ./src/cli/direnv/exec.rs \
-      --replace-fail '"env"' '"${coreutils}/bin/env"' \
-      --replace-fail 'cmd!("direnv"' 'cmd!("${direnv}/bin/direnv"'
+      --replace-fail '"env"' '"${lib.getExe' coreutils "env"}"' \
+      --replace-fail 'cmd!("direnv"' 'cmd!("${lib.getExe direnv}"'
   '';
 
   checkFlags = [
-    # Requires .git directory to be present
-    "--skip=cli::plugins::ls::tests::test_plugin_list_urls"
-    "--skip=cli::generate::git_pre_commit::tests::test_git_pre_commit"
-    "--skip=cli::generate::github_action::tests::test_github_action"
+    # last_modified will always be different in nix
+    "--skip=tera::tests::test_last_modified"
+    # requires https://github.com/rbenv/ruby-build
+    "--skip=plugins::core::ruby::tests::test_list_versions_matching"
   ];
+
   cargoTestFlags = [ "--all-features" ];
   # some tests access the same folders, don't test in parallel to avoid race conditions
   dontUseCargoParallelTests = true;
@@ -81,8 +79,8 @@ rustPlatform.buildRustPackage rec {
     installManPage ./man/man1/mise.1
 
     substituteInPlace ./completions/{mise.bash,mise.fish,_mise}  \
-      --replace-fail '-v usage' '-v ${usage}/bin/usage' \
-      --replace-fail 'usage complete-word' '${usage}/bin/usage complete-word'
+      --replace-fail '-v usage' '-v ${lib.getExe usage}' \
+      --replace-fail 'usage complete-word' '${lib.getExe usage} complete-word'
 
     installShellCompletion \
       --bash ./completions/mise.bash \
diff --git a/pkgs/by-name/of/offat/package.nix b/pkgs/by-name/of/offat/package.nix
index 46bbba00f771..83bb81df0fc8 100644
--- a/pkgs/by-name/of/offat/package.nix
+++ b/pkgs/by-name/of/offat/package.nix
@@ -18,7 +18,10 @@ python3.pkgs.buildPythonApplication rec {
 
   sourceRoot = "${src.name}/src";
 
-  pythonRelaxDeps = [ "setuptools" ];
+  pythonRelaxDeps = [
+    "setuptools"
+    "tenacity"
+  ];
 
   build-system = with python3.pkgs; [ poetry-core ];
 
diff --git a/pkgs/by-name/op/openapi-python-client/package.nix b/pkgs/by-name/op/openapi-python-client/package.nix
index a4445a6a5670..6c7a1f5f413f 100644
--- a/pkgs/by-name/op/openapi-python-client/package.nix
+++ b/pkgs/by-name/op/openapi-python-client/package.nix
@@ -5,7 +5,6 @@
   python3Packages,
   fetchFromGitHub,
   installShellFiles,
-  ruff,
   testers,
   openapi-python-client,
 }:
@@ -35,22 +34,24 @@ python3Packages.buildPythonApplication rec {
     hatchling
   ];
 
-  dependencies =
-    (with python3Packages; [
+  dependencies = (
+    with python3Packages;
+    [
       attrs
       httpx
       jinja2
       pydantic
       python-dateutil
       ruamel-yaml
+      ruff
       shellingham
       typer
       typing-extensions
-    ])
-    ++ [ ruff ];
-
-  # ruff is not packaged as a python module in nixpkgs
-  pythonRemoveDeps = [ "ruff" ];
+    ]
+  );
+  # openapi-python-client defines upper bounds to the dependencies, ruff python library is
+  # just a simple wrapper to locate the binary. We'll remove the upper bound
+  pythonRelaxDeps = [ "ruff" ];
 
   postInstall = ''
     # see: https://github.com/fastapi/typer/blob/5889cf82f4ed925f92e6b0750bf1b1ed9ee672f3/typer/completion.py#L54
diff --git a/pkgs/servers/monitoring/prometheus/default.nix b/pkgs/by-name/pr/prometheus/package.nix
similarity index 95%
rename from pkgs/servers/monitoring/prometheus/default.nix
rename to pkgs/by-name/pr/prometheus/package.nix
index 6d3e32640fe1..d3145ad7075d 100644
--- a/pkgs/servers/monitoring/prometheus/default.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -31,10 +31,10 @@
 }:
 
 let
-  version = "2.54.1";
+  version = "2.55.0";
   webUiStatic = fetchurl {
     url = "https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-web-ui-${version}.tar.gz";
-    hash = "sha256-asum4ND7dHIIP6f1ofIb/xboCPZEIhes7lXqRUhUDJk=";
+    hash = "sha256-iSiK6JKm78AMANfBydfCQu+aUpw6B1sZ5fGPa0KL7Fs=";
   };
 in
 buildGoModule rec {
@@ -47,10 +47,10 @@ buildGoModule rec {
     owner = "prometheus";
     repo = "prometheus";
     rev = "v${version}";
-    hash = "sha256-SF9A/xyjQwwIcMZtuLeJiwkBZvvEyU5EKu0WXTQAT/A=";
+    hash = "sha256-yzAp/YxLCWlpkj5z2aUdsokDaFvRwVnT6ViwL3hivdI=";
   };
 
-  vendorHash = "sha256-y91c5qPND3wbFlX5rV6bcSlXAKn1eomylI6EdZQvkh0=";
+  vendorHash = "sha256-p2PjhFT8KOido+MMmKc7eHPkE175my3VfTp1G8bBZcA=";
 
   excludedPackages = [ "documentation/prometheus-mixin" ];
 
diff --git a/pkgs/by-name/re/remind/package.nix b/pkgs/by-name/re/remind/package.nix
index bbeadc7773cd..eb01ac3c885d 100644
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   tk,
-  tcllib,
+  tclPackages,
   tcl,
   tkremind ? null,
   withGui ?
@@ -23,7 +23,7 @@ tcl.mkTclDerivation rec {
   };
 
   propagatedBuildInputs = lib.optionals withGui [
-    tcllib
+    tclPackages.tcllib
     tk
   ];
 
diff --git a/pkgs/development/tools/misc/slint-lsp/default.nix b/pkgs/by-name/sl/slint-lsp/package.nix
similarity index 83%
rename from pkgs/development/tools/misc/slint-lsp/default.nix
rename to pkgs/by-name/sl/slint-lsp/package.nix
index f51b848a621a..969457481da7 100644
--- a/pkgs/development/tools/misc/slint-lsp/default.nix
+++ b/pkgs/by-name/sl/slint-lsp/package.nix
@@ -25,14 +25,14 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "slint-lsp";
-  version = "1.5.1";
+  version = "1.8.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-wqAcHBHWtYavAakHLhHHCI+Yercgdtzo1EAOilsZOK0=";
+    hash = "sha256-Shgcjr0mlUNAobMAarZ7dFnXgPGzBHXs2KnUDT/8I2A=";
   };
 
-  cargoHash = "sha256-XjVXhXoGEhxWc+LZa0EsPiw3Gq2pg03YjKONTptSQvA=";
+  cargoHash = "sha256-wyzrFg3hwsJ7SV8KGLKo+gNHzLFpnMx9/jgMalGkufY=";
 
   nativeBuildInputs = [ cmake pkg-config fontconfig ];
   buildInputs = rpathLibs ++ [ xorg.libxcb.dev ]
@@ -46,6 +46,9 @@ rustPlatform.buildRustPackage rec {
     OpenGL
   ];
 
+  # Tests requires `i_slint_backend_testing` which is only a dev dependency
+  doCheck = false;
+
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux  ''
     patchelf --set-rpath ${lib.makeLibraryPath rpathLibs} $out/bin/slint-lsp
   '';
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/by-name/st/step-ca/package.nix
similarity index 82%
rename from pkgs/tools/security/step-ca/default.nix
rename to pkgs/by-name/st/step-ca/package.nix
index f37c05f93fbb..911c479c7189 100644
--- a/pkgs/tools/security/step-ca/default.nix
+++ b/pkgs/by-name/st/step-ca/package.nix
@@ -5,24 +5,24 @@
   buildGoModule,
   coreutils,
   pcsclite,
-  PCSC,
   pkg-config,
   hsmSupport ? true,
   nixosTests,
+  darwin,
 }:
 
 buildGoModule rec {
   pname = "step-ca";
-  version = "0.27.2";
+  version = "0.27.5";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "certificates";
     rev = "refs/tags/v${version}";
-    hash = "sha256-byVWNab6Q3yryluhMomzLkRNfXQ/68pAq+YGFjbvX1o=";
+    hash = "sha256-0KIAO9KPP9Lrrw9IIaRdlmmfJ0mwQK0ne//Zofu3TfE=";
   };
 
-  vendorHash = "sha256-gQEGCbVgtKIaUgBkfpVwLXoUg1EUhaQFn9JZvV5Rjhc=";
+  vendorHash = "sha256-yi4mbuCaT6ydnZwhqqhqMI7bF6IwHm0UqfR5JM81/Ik=";
 
   ldflags = [
     "-w"
@@ -33,9 +33,9 @@ buildGoModule rec {
 
   buildInputs =
     lib.optionals (hsmSupport && stdenv.hostPlatform.isLinux) [ pcsclite ]
-    ++ lib.optionals (hsmSupport && stdenv.hostPlatform.isDarwin) [ PCSC ];
-
+    ++ lib.optionals (hsmSupport && stdenv.hostPlatform.isDarwin) [ darwin.apple_sdk.frameworks.PCSC ];
   postPatch = ''
+    substituteInPlace authority/http_client_test.go --replace-fail 't.Run("SystemCertPool", func(t *testing.T) {' 't.Skip("SystemCertPool", func(t *testing.T) {'
     substituteInPlace systemd/step-ca.service --replace "/bin/kill" "${coreutils}/bin/kill"
   '';
 
diff --git a/pkgs/by-name/to/tomlplusplus/package.nix b/pkgs/by-name/to/tomlplusplus/package.nix
new file mode 100644
index 000000000000..7d95a15503b1
--- /dev/null
+++ b/pkgs/by-name/to/tomlplusplus/package.nix
@@ -0,0 +1,68 @@
+{
+  cmake,
+  fetchFromGitHub,
+  fetchpatch2,
+  glibcLocales,
+  lib,
+  meson,
+  ninja,
+  nix-update-script,
+  pkg-config,
+  stdenv,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tomlplusplus";
+  version = "3.4.0";
+
+  src = fetchFromGitHub {
+    owner = "marzer";
+    repo = "tomlplusplus";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-h5tbO0Rv2tZezY58yUbyRVpsfRjY3i+5TPkkxr6La8M=";
+  };
+
+  patches = [
+    # TODO: Remove this patch at the next update
+    # https://github.com/marzer/tomlplusplus/pull/233
+    (fetchpatch2 {
+      name = "tomlplusplus-install-example-programs.patch";
+      url = "https://github.com/marzer/tomlplusplus/commit/8128eb632325d1820f4d17dd8250dcda6ab07743.patch";
+      hash = "sha256-7m2P+e1/OASHrzm9LSy6RnayS/kGxFC82xOyGBGXeG0=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    meson
+    cmake
+    ninja
+    pkg-config
+  ];
+
+  checkInputs = [
+    glibcLocales
+  ];
+
+  doCheck = true;
+  mesonFlags = [
+    "-Dbuild_tests=${lib.boolToString finalAttrs.doCheck}"
+    "-Dbuild_examples=true"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/marzer/tomlplusplus";
+    description = "Header-only TOML config file parser and serializer for C++17";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Scrumplex ];
+    pkgConfigModules = [ "tomlplusplus" ];
+    platforms = platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/wa/waycheck/package.nix b/pkgs/by-name/wa/waycheck/package.nix
index b8dd02dabded..3480c61ad239 100644
--- a/pkgs/by-name/wa/waycheck/package.nix
+++ b/pkgs/by-name/wa/waycheck/package.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waycheck";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "serebit";
     repo = "waycheck";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZNUORCSeU+AGQoiIIfPpgW2o1ElX+j5Pcn2X/8pSpRI=";
+    hash = "sha256-wawz7QCzpeQgdxwFQaZ/yV//AepEE+FLNG7ho/lHtFE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wh/whatsie/package.nix b/pkgs/by-name/wh/whatsie/package.nix
index dde65d9f9fbc..1a54a4f142aa 100644
--- a/pkgs/by-name/wh/whatsie/package.nix
+++ b/pkgs/by-name/wh/whatsie/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "whatsie";
-  version = "4.16.1";
+  version = "4.16.2";
 
   src = fetchFromGitHub {
     owner = "keshavbhatt";
     repo = "whatsie";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-9G+2yYc5Lcmw5NvLnn7jVZ4Fw79L29KbhiE2CYh6SLM=";
+    hash = "sha256-4Ur/FNg4jqtyWGB0lW4Uw2XlfMclz080LDRNO+RnkrM=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
diff --git a/pkgs/by-name/xf/xfs-undelete/package.nix b/pkgs/by-name/xf/xfs-undelete/package.nix
index 390a19d1f06c..030f3324fc59 100644
--- a/pkgs/by-name/xf/xfs-undelete/package.nix
+++ b/pkgs/by-name/xf/xfs-undelete/package.nix
@@ -4,7 +4,7 @@
 , makeWrapper
 , coreutils
 , tcl-8_6
-, tcllib
+, tclPackages
 , installShellFiles
 }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
     hash = "sha256-ENa/r3+o7abW8iun6V/2LhTVmFVSwVM6v46KXBcKJ1g=";
   };
 
-  buildInputs = [ tcl-8_6 tcllib coreutils ];
+  buildInputs = [ tcl-8_6 tclPackages.tcllib coreutils ];
   nativeBuildInputs = [ makeWrapper tcl-8_6.tclPackageHook installShellFiles ];
 
   tclWrapperArgs = [ "--prefix" "PATH" ":" (lib.makeBinPath [ tcl-8_6 ]) ];
diff --git a/pkgs/by-name/yo/your_spotify/package.nix b/pkgs/by-name/yo/your_spotify/package.nix
index 77864788fa19..78c1b96700f9 100644
--- a/pkgs/by-name/yo/your_spotify/package.nix
+++ b/pkgs/by-name/yo/your_spotify/package.nix
@@ -9,22 +9,23 @@
   makeWrapper,
   callPackage,
   nixosTests,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "your_spotify_server";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "Yooooomi";
     repo = "your_spotify";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-e82j2blGxQLWAlBNuAnFvlD9vwMk4/mRI0Vf7vuaPA0=";
+    hash = "sha256-BytHkvm0gfMnsKe2gDTARWYIHBpfAfIisf2p4bmrpMA=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-5SgknaRVzgO2Dzc8MhAaM8UERWMv+PrItzevoWHbWnA=";
+    hash = "sha256-D7rL3hxidLaChCwn5umQAnWr4cTVQ1iwDs5+gIDgBGI=";
   };
 
   nativeBuildInputs = [
@@ -62,11 +63,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     client = callPackage ./client.nix {
-      inherit (finalAttrs) src version offlineCache meta;
+      inherit (finalAttrs)
+        src
+        version
+        offlineCache
+        meta
+        ;
     };
     tests = {
       inherit (nixosTests) your_spotify;
     };
+    updateScript = nix-update-script { };
   };
 
   meta = {
diff --git a/pkgs/servers/search/zincsearch/default.nix b/pkgs/by-name/zi/zincsearch/package.nix
similarity index 71%
rename from pkgs/servers/search/zincsearch/default.nix
rename to pkgs/by-name/zi/zincsearch/package.nix
index 2a1d3fc6faba..8a4c4928bdad 100644
--- a/pkgs/servers/search/zincsearch/default.nix
+++ b/pkgs/by-name/zi/zincsearch/package.nix
@@ -1,16 +1,17 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, buildNpmPackage
+{
+  lib,
+  buildGo122Module,
+  fetchFromGitHub,
+  buildNpmPackage,
 }:
 
 let
-  version = "0.4.10";
+  version = "0.4.10-unstable-2024-10-25";
   src = fetchFromGitHub {
     owner = "zinclabs";
     repo = "zincsearch";
-    rev = "v${version}";
-    hash = "sha256-lScwnmu4hM78Va7Yi5HA0E5f2WQXrZaeqjRYJYxnQ5E=";
+    rev = "0652db6d39badc753f28ee1122dcbc0e5da1c35e";
+    hash = "sha256-Py4fiZJ2fMwPe2afd19brR+62PGVoU67nMDMPlUFhKQ=";
   };
 
   webui = buildNpmPackage {
@@ -32,7 +33,7 @@ let
   };
 in
 
-buildGoModule rec {
+buildGo122Module rec {
   pname = "zincsearch";
   inherit src version;
 
@@ -40,7 +41,7 @@ buildGoModule rec {
     cp -r ${webui}/share/zinc-ui web/dist
   '';
 
-  vendorHash = "sha256-SZG5/ISGblpcwwR/HOKxFl9SthXpE+IYS0S+4HYtHos=";
+  vendorHash = "sha256-JB6+sfMB7PgpPg1lmN9/0JFRLi1c7VBUMD/d4XmLIPw=";
   subPackages = [ "cmd/zincsearch" ];
 
   ldflags = [
@@ -55,8 +56,5 @@ buildGoModule rec {
     homepage = "https://zincsearch-docs.zinc.dev/";
     license = licenses.asl20;
     maintainers = with maintainers; [ dit7ya ];
-    # Doesn't build with Go version later v1.21 (which is EOL).
-    # Upstream issue: https://github.com/zincsearch/zincsearch/issues/975
-    broken = true;
   };
 }
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix
index b0ac3670ffc6..b777bb47d9cf 100644
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , meson
 , ninja
@@ -33,6 +34,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Cv1Ldvk0+VzNsKnDFwDtLZ5ixUOGV+PWYAqN9KV9g/s=";
   };
 
+  patches = [
+    # Set preferred color theme for mutter
+    # https://github.com/elementary/switchboard-plug-pantheon-shell/pull/413
+    (fetchpatch {
+      url = "https://github.com/elementary/switchboard-plug-pantheon-shell/commit/bdc8c167fabe5a4642efd37b0289e235e5d0a504.patch";
+      hash = "sha256-ueTAwURd8GM0U/qfPmoVLO7OVI/ppazq+ljnVzk0Npk=";
+    })
+  ];
+
   nativeBuildInputs = [
     gettext
     meson
diff --git a/pkgs/development/embedded/edl/default.nix b/pkgs/development/embedded/edl/default.nix
index 86f27bf6a2b2..87b5fd6149ac 100644
--- a/pkgs/development/embedded/edl/default.nix
+++ b/pkgs/development/embedded/edl/default.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonPackage {
   pname = "edl";
-  version = "3.52.1-unstable-2024-08-27";
+  version = "3.52.1-unstable-2024-10-12";
 
   src = fetchFromGitHub {
     owner = "bkerler";
     repo = "edl";
-    rev = "d2c585e4ccc066895b71ca9014c1ebb5af316e07";
+    rev = "cef0076e1d4d29c1887c51786eb588503657b907";
     fetchSubmodules = true;
-    hash = "sha256-hQturda+iDmH5DVP1CjG526wcggdzTSrW2jqrEzLXtY=";
+    hash = "sha256-FOsgmM+i++t2MZiJTKV0Et8KXKDKQoFop67P6DdW1EY=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/development/interpreters/micropython/default.nix b/pkgs/development/interpreters/micropython/default.nix
index df34036a9423..e557a0614d9f 100644
--- a/pkgs/development/interpreters/micropython/default.nix
+++ b/pkgs/development/interpreters/micropython/default.nix
@@ -9,16 +9,16 @@
 
 stdenv.mkDerivation rec {
   pname = "micropython";
-  version = "1.23.0";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "micropython";
     repo = "micropython";
     rev = "v${version}";
-    hash = "sha256-coUFIepbCRuz+766E7VCTQLm0oWB1CTO20ATriC86dc=";
+    hash = "sha256-cFoUa4ZpPy1MldlTeY9ISXi9ilulmhmaH5mapUDBzE8=";
     fetchSubmodules = true;
 
-    # remove unused libaries from rp2 port's SDK. we leave this and the other
+    # remove unused libraries from rp2 port's SDK. we leave this and the other
     # ports around for users who want to override makeFlags flags to build them.
     # https://github.com/micropython/micropython/blob/a61c446c0b34e82aeb54b9770250d267656f2b7f/ports/rp2/CMakeLists.txt#L17-L22
     #
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index a938918ead3a..0d2ebd009731 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -8,7 +8,7 @@
 , openssl
 , readline
 , sqlite
-, tcl ? null, tk ? null, tix ? null, libX11 ? null, x11Support ? false
+, tcl ? null, tk ? null, tclPackages, libX11 ? null, x11Support ? false
 , zlib
 , self
 , coreutils
@@ -272,8 +272,8 @@ in with passthru; stdenv.mkDerivation ({
 
     setupHook = python-setup-hook sitePackages;
 
-    postPatch = lib.optionalString (x11Support && (tix != null)) ''
-          substituteInPlace "Lib/lib-tk/Tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+    postPatch = lib.optionalString (x11Support && ((tclPackages.tix or null) != null)) ''
+          substituteInPlace "Lib/lib-tk/Tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tclPackages.tix}/lib'"
     '';
 
     postInstall =
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index b381243ff5bb..f9da42de0b1c 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -35,7 +35,7 @@
 , tzdata
 , withGdbm ? !stdenv.hostPlatform.isWindows, gdbm
 , withReadline ? !stdenv.hostPlatform.isWindows, readline
-, x11Support ? false, tcl, tk, tix, libX11, xorgproto
+, x11Support ? false, tcl, tk, tclPackages, libX11, xorgproto
 
 # splicing/cross
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
@@ -324,10 +324,10 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
   '' + optionalString mimetypesSupport ''
     substituteInPlace Lib/mimetypes.py \
       --replace-fail "@mime-types@" "${mailcap}"
-  '' + optionalString (pythonOlder "3.13" && x11Support && (tix != null)) ''
+  '' + optionalString (pythonOlder "3.13" && x11Support && ((tclPackages.tix or null) != null)) ''
     substituteInPlace "Lib/tkinter/tix.py" --replace-fail \
       "os.environ.get('TIX_LIBRARY')" \
-      "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+      "os.environ.get('TIX_LIBRARY') or '${tclPackages.tix}/lib'"
   '';
 
   env = {
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index 3dcbce42cf0a..4e8199af56b3 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, substituteAll, fetchurl
 , zlibSupport ? true, zlib
 , bzip2, pkg-config, libffi, libunwind, Security
-, sqlite, openssl, ncurses, python, expat, tcl, tk, tix, libX11
+, sqlite, openssl, ncurses, python, expat, tcl, tk, tclPackages, libX11
 , gdbm, db, xz, python-setup-hook
 , optimizationLevel ? "jit", boehmgc
 # For the Python package set
@@ -98,7 +98,7 @@ in with passthru; stdenv.mkDerivation rec {
       --replace "multiprocessing.cpu_count()" "$NIX_BUILD_CORES"
 
     substituteInPlace "lib-python/${if isPy3k then "3/tkinter/tix.py" else "2.7/lib-tk/Tix.py"}" \
-      --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+      --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tclPackages.tix}/lib'"
   '';
 
   buildPhase = ''
diff --git a/pkgs/development/libraries/tomlplusplus/default.nix b/pkgs/development/libraries/tomlplusplus/default.nix
deleted file mode 100644
index dda352d0769f..000000000000
--- a/pkgs/development/libraries/tomlplusplus/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ lib
-, stdenv
-, meson
-, cmake
-, ninja
-, fetchFromGitHub
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "tomlplusplus";
-  version = "3.4.0";
-
-  src = fetchFromGitHub {
-    owner = "marzer";
-    repo = "tomlplusplus";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-h5tbO0Rv2tZezY58yUbyRVpsfRjY3i+5TPkkxr6La8M=";
-  };
-
-  nativeBuildInputs = [ meson cmake ninja ];
-
-  meta = with lib; {
-    homepage = "https://github.com/marzer/tomlplusplus";
-    description = "Header-only TOML config file parser and serializer for C++17";
-    license = licenses.mit;
-    maintainers = with maintainers; [ Scrumplex ];
-    platforms = platforms.unix;
-  };
-})
diff --git a/pkgs/development/python-modules/aiooui/default.nix b/pkgs/development/python-modules/aiooui/default.nix
index bc087915bf4f..ec2dfb2f035c 100644
--- a/pkgs/development/python-modules/aiooui/default.nix
+++ b/pkgs/development/python-modules/aiooui/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aiooui";
-  version = "0.1.6";
+  version = "0.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "aiooui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dsMVKfY9o1krzp100/7JtClgPrpsFTVNwMnYMqOVFIU=";
+    hash = "sha256-vnO3Lh+d/8mES2i4jKTH4RviURUFqb3Vj6u5sxUGf1o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/anitopy/default.nix b/pkgs/development/python-modules/anitopy/default.nix
index 95f3af2b7cb5..d7d3f2a0e56b 100644
--- a/pkgs/development/python-modules/anitopy/default.nix
+++ b/pkgs/development/python-modules/anitopy/default.nix
@@ -16,7 +16,6 @@ buildPythonPackage rec {
   };
 
   pythonImportsCheck = [ "anitopy" ];
-  doCheck = true;
 
   meta = with lib; {
     description = "Python library for parsing anime video filenames";
diff --git a/pkgs/development/python-modules/apple-weatherkit/default.nix b/pkgs/development/python-modules/apple-weatherkit/default.nix
index 60cfd6d9e71e..d7d21ad746fc 100644
--- a/pkgs/development/python-modules/apple-weatherkit/default.nix
+++ b/pkgs/development/python-modules/apple-weatherkit/default.nix
@@ -11,8 +11,8 @@
 
 buildPythonPackage rec {
   pname = "apple-weatherkit";
-  version = "1.1.2";
-  format = "pyproject";
+  version = "1.1.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.11";
 
@@ -20,12 +20,12 @@ buildPythonPackage rec {
     owner = "tjhorner";
     repo = "python-weatherkit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-w3KinicaF01I6fIidI7XYHpB8eq52RTUw/BMLrx6Grk=";
+    hash = "sha256-JvN8GmlTxz9VGttIFVG6q//c+BhP2pt1tBOhnJhNwJg=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     aiohttp-retry
     pyjwt
diff --git a/pkgs/development/python-modules/beziers/default.nix b/pkgs/development/python-modules/beziers/default.nix
index 2af89a69c9fd..e0fdaaca9c0a 100644
--- a/pkgs/development/python-modules/beziers/default.nix
+++ b/pkgs/development/python-modules/beziers/default.nix
@@ -24,7 +24,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ pyclipper ];
 
-  doCheck = true;
   nativeCheckInputs = [
     dotmap
     matplotlib
diff --git a/pkgs/development/python-modules/coinmetrics-api-client/default.nix b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
index bf8f0adbb492..cff80702d5fa 100644
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2024.10.4.15";
+  version = "2024.10.15.19";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-4Ru614cCTMrAhelkVjDuHo7VcGYqaVeeAfaQkdBZr7k=";
+    hash = "sha256-TNpF8OihU0Z/mAUF/5hxpZgaqIBRUfX7zhwZAKd7OEo=";
   };
 
   pythonRelaxDeps = [ "typer" ];
diff --git a/pkgs/development/python-modules/collidoscope/default.nix b/pkgs/development/python-modules/collidoscope/default.nix
index a8bec5c5cdcd..2ad63e83c081 100644
--- a/pkgs/development/python-modules/collidoscope/default.nix
+++ b/pkgs/development/python-modules/collidoscope/default.nix
@@ -30,7 +30,6 @@ buildPythonPackage rec {
     uharfbuzz
   ];
 
-  doCheck = true;
   nativeCheckInputs = [ unittestCheckHook ];
   unittestFlagsArray = [
     "-s"
diff --git a/pkgs/development/python-modules/commandlines/default.nix b/pkgs/development/python-modules/commandlines/default.nix
index b216858a584c..aa5da9c0d37f 100644
--- a/pkgs/development/python-modules/commandlines/default.nix
+++ b/pkgs/development/python-modules/commandlines/default.nix
@@ -18,7 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-x3iUeOTAaTKNW5Y5foMPMJcWVxu52uYZoY3Hhe3UvQ4=";
   };
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/commitizen/default.nix b/pkgs/development/python-modules/commitizen/default.nix
index bdcb00d589c1..51b21badf446 100644
--- a/pkgs/development/python-modules/commitizen/default.nix
+++ b/pkgs/development/python-modules/commitizen/default.nix
@@ -77,8 +77,6 @@ buildPythonPackage rec {
     pytest7CheckHook
   ];
 
-  doCheck = true;
-
   pythonImportsCheck = [ "commitizen" ];
 
   # The tests require a functional git installation
diff --git a/pkgs/development/python-modules/dehinter/default.nix b/pkgs/development/python-modules/dehinter/default.nix
index e621b2979bcc..55dc1c503fb4 100644
--- a/pkgs/development/python-modules/dehinter/default.nix
+++ b/pkgs/development/python-modules/dehinter/default.nix
@@ -21,7 +21,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ fonttools ];
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/dissect-jffs/default.nix b/pkgs/development/python-modules/dissect-jffs/default.nix
index a8c9fed87a46..aad42728587a 100644
--- a/pkgs/development/python-modules/dissect-jffs/default.nix
+++ b/pkgs/development/python-modules/dissect-jffs/default.nix
@@ -33,9 +33,6 @@ buildPythonPackage rec {
     dissect-util
   ];
 
-  # Test file handling fails
-  doCheck = true;
-
   pythonImportsCheck = [ "dissect.jffs" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/doorbirdpy/default.nix b/pkgs/development/python-modules/doorbirdpy/default.nix
index acb4fab9c31b..b0ae8cfcea08 100644
--- a/pkgs/development/python-modules/doorbirdpy/default.nix
+++ b/pkgs/development/python-modules/doorbirdpy/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitLab,
   setuptools,
   aiohttp,
+  tenacity,
   aioresponses,
   pytest-asyncio,
   pytestCheckHook,
@@ -11,19 +12,22 @@
 
 buildPythonPackage rec {
   pname = "doorbirdpy";
-  version = "3.0.3";
+  version = "3.0.5";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "klikini";
     repo = "doorbirdpy";
     rev = "refs/tags/${version}";
-    hash = "sha256-0UvzMFYKM/Sb9B2XwZwl+a9v7lTxAc1H59vR88VwDww=";
+    hash = "sha256-SVkprX9fMy1uGixsxsE7gbUJndvl+V/kle3Rq34S6Hs=";
   };
 
   build-system = [ setuptools ];
 
-  dependencies = [ aiohttp ];
+  dependencies = [
+    aiohttp
+    tenacity
+  ];
 
   nativeCheckInputs = [
     aioresponses
@@ -31,6 +35,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # connection error on mock host
+    "test_info_auth_fails"
+  ];
+
   pythonImportsCheck = [ "doorbirdpy" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 73a551a5c278..05ffb2f6c00d 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -52,8 +52,6 @@ buildPythonPackage rec {
       --replace "'pytest-runner==5.2.0'," ""
   '';
 
-  doCheck = true;
-
   pythonImportsCheck = [ "dropbox" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/eigenpy/default.nix b/pkgs/development/python-modules/eigenpy/default.nix
index d1844d34baed..307e5da468a2 100644
--- a/pkgs/development/python-modules/eigenpy/default.nix
+++ b/pkgs/development/python-modules/eigenpy/default.nix
@@ -50,7 +50,6 @@ buildPythonPackage rec {
     numpy
   ];
 
-  doCheck = true;
   pythonImportsCheck = [ "eigenpy" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/font-v/default.nix b/pkgs/development/python-modules/font-v/default.nix
index 4f1a22a640d0..945f77698ef7 100644
--- a/pkgs/development/python-modules/font-v/default.nix
+++ b/pkgs/development/python-modules/font-v/default.nix
@@ -26,7 +26,6 @@ buildPythonPackage rec {
     gitpython
   ];
 
-  doCheck = true;
   nativeCheckInputs = [
     git
     pytestCheckHook
diff --git a/pkgs/development/python-modules/fontfeatures/default.nix b/pkgs/development/python-modules/fontfeatures/default.nix
index b6a4482b4ba4..11943c36e05b 100644
--- a/pkgs/development/python-modules/fontfeatures/default.nix
+++ b/pkgs/development/python-modules/fontfeatures/default.nix
@@ -31,7 +31,6 @@ buildPythonPackage rec {
     youseedee
   ];
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
   disabledTestPaths = [
     # These tests require babelfont but we have to leave it out and skip them
diff --git a/pkgs/development/python-modules/gardena-bluetooth/default.nix b/pkgs/development/python-modules/gardena-bluetooth/default.nix
index 45cbdea0d546..b80c83d774c7 100644
--- a/pkgs/development/python-modules/gardena-bluetooth/default.nix
+++ b/pkgs/development/python-modules/gardena-bluetooth/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "gardena-bluetooth";
-  version = "1.4.3";
+  version = "1.4.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "elupus";
     repo = "gardena-bluetooth";
     rev = "refs/tags/${version}";
-    hash = "sha256-H2v96G/mu17puq8jNyk6L9iuWUvRombPd+s6byNQ4Zw=";
+    hash = "sha256-BV4chGkVp9H7gJQGKQZ0e4IiizMjCbDAU5MMf7hS9mE=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index ab476729c66f..5c0b7f3146e7 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -53,8 +53,6 @@ buildPythonPackage rec {
     "-Dpython=${python.pythonOnBuildForHost.interpreter}"
   ];
 
-  doCheck = true;
-
   # TODO: Meson setup hook does not like buildPythonPackage
   # https://github.com/NixOS/nixpkgs/issues/47390
   installCheckPhase = "meson test --print-errorlogs";
diff --git a/pkgs/development/python-modules/iwlib/default.nix b/pkgs/development/python-modules/iwlib/default.nix
index 01f83b80a003..08348a6de3ab 100644
--- a/pkgs/development/python-modules/iwlib/default.nix
+++ b/pkgs/development/python-modules/iwlib/default.nix
@@ -23,7 +23,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [ pytest ];
   pythonImportsCheck = [ "iwlib" ];
 
-  doCheck = true;
   checkInputs = [ pytest ];
   checkPhase = "python iwlib/_iwlib_build.py; pytest -v";
 
diff --git a/pkgs/development/python-modules/kinparse/default.nix b/pkgs/development/python-modules/kinparse/default.nix
index a925347da318..8ddde08f68d8 100644
--- a/pkgs/development/python-modules/kinparse/default.nix
+++ b/pkgs/development/python-modules/kinparse/default.nix
@@ -19,7 +19,6 @@ buildPythonPackage {
     sha256 = "1nrjnybwzy93c79yylcwmb4lvkx7hixavnjwffslz0zwn32l0kx3";
   };
 
-  doCheck = true;
   pythonImportsCheck = [ "kinparse" ];
 
   nativeCheckInputs = [ pytest ];
diff --git a/pkgs/development/python-modules/kurbopy/default.nix b/pkgs/development/python-modules/kurbopy/default.nix
index 3542fb60b281..3ced53fcde02 100644
--- a/pkgs/development/python-modules/kurbopy/default.nix
+++ b/pkgs/development/python-modules/kurbopy/default.nix
@@ -29,7 +29,6 @@ buildPythonPackage rec {
     hash = "sha256-W0BebCXC1wqwtQP+zHjISxSJjXHD9U6p9eNS12Nfb2Y=";
   };
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
   preCheck = ''
     # pytestCheckHook puts . at the front of Python's sys.path, due to:
diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index 3ba1fcb50f95..78a0cf0f026f 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -48,6 +48,8 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [ "tenacity" ];
+
   dependencies = [
     jsonpatch
     langsmith
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index 49b268e97acc..e96e44365e04 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -58,6 +58,8 @@ buildPythonPackage rec {
 
   buildInputs = [ bash ];
 
+  pythonRelaxDeps = [ "tenacity" ];
+
   dependencies = [
     aiohttp
     langchain-core
diff --git a/pkgs/development/python-modules/lcov-cobertura/default.nix b/pkgs/development/python-modules/lcov-cobertura/default.nix
index f17dfec5900a..d04302c6a18e 100644
--- a/pkgs/development/python-modules/lcov-cobertura/default.nix
+++ b/pkgs/development/python-modules/lcov-cobertura/default.nix
@@ -22,7 +22,6 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
   dependencies = [ distutils ];
 
-  doCheck = true;
   pythonImportsCheck = [ "lcov_cobertura" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/linear-garage-door/default.nix b/pkgs/development/python-modules/linear-garage-door/default.nix
index 1a8bfb796410..f3ea213b038b 100644
--- a/pkgs/development/python-modules/linear-garage-door/default.nix
+++ b/pkgs/development/python-modules/linear-garage-door/default.nix
@@ -23,14 +23,10 @@ buildPythonPackage rec {
     hash = "sha256-ibOCqy7krIVC7N75SwEyUII3Tknb60nwA+zGbjOENv4=";
   };
 
-  postPatch = ''
-    sed -i pyproject.toml \
-      -e "/--cov/d" \
-      -e "/--no-cov/d"
-  '';
-
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [ "tenacity" ];
+
   dependencies = [
     aiohttp
     dnspython
diff --git a/pkgs/development/python-modules/meep/default.nix b/pkgs/development/python-modules/meep/default.nix
index d034595d03e4..1608a5e67ec9 100644
--- a/pkgs/development/python-modules/meep/default.nix
+++ b/pkgs/development/python-modules/meep/default.nix
@@ -122,7 +122,6 @@ buildPythonPackage rec {
     (calls `sim.run()`), as only then MPI will be initialised and MPI linking
     errors can be caught.
   */
-  doCheck = true;
   nativeCheckInputs = [
     mpiCheckPhaseHook
     openssh
diff --git a/pkgs/development/python-modules/mpi4py/default.nix b/pkgs/development/python-modules/mpi4py/default.nix
index 1aba82440888..dd6781fbfa2c 100644
--- a/pkgs/development/python-modules/mpi4py/default.nix
+++ b/pkgs/development/python-modules/mpi4py/default.nix
@@ -12,16 +12,14 @@
 
 buildPythonPackage rec {
   pname = "mpi4py";
-  # See https://github.com/mpi4py/mpi4py/issues/386 . Part of the changes since
-  # the last release include Python 3.12 fixes.
-  version = "3.1.6-unstable-2024-07-08";
+  version = "4.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     repo = "mpi4py";
     owner = "mpi4py";
-    rev = "e9a59719bbce1b9c351e1e30ecd3be3b459e97cd";
-    hash = "sha256-C/nidWGr8xsLV73u7HRtnXoQgYmoRJkD45DFrdXXTPI=";
+    rev = version;
+    hash = "sha256-pH4z+hyoFOSAUlXv9EKO54/SM5HyLxv7B+18xBidH2Q=";
   };
 
   build-system = [
@@ -40,10 +38,7 @@ buildPythonPackage rec {
     openssh
     mpiCheckPhaseHook
   ];
-  # Most tests pass, (besides `test_spawn.py`), but when reaching ~80% tests
-  # progress, an orted process hangs and the tests don't finish. This issue is
-  # probably due to the sandbox.
-  doCheck = false;
+  doCheck = true;
   disabledTestPaths = [
     # Almost all tests in this file fail (TODO: Report about this upstream..)
     "test/test_spawn.py"
diff --git a/pkgs/development/python-modules/nitrokey/default.nix b/pkgs/development/python-modules/nitrokey/default.nix
index 7be8de78302f..b39d6d344061 100644
--- a/pkgs/development/python-modules/nitrokey/default.nix
+++ b/pkgs/development/python-modules/nitrokey/default.nix
@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "nitrokey";
-  version = "0.2.1";
+  version = "0.2.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Hn/CYvuPRkT9NYzfB8skN3Z732xfmHu6xDTVI/nDbqU=";
+    hash = "sha256-tG6+diyrauJEzpPG33+S5o1ik3n44/443szR7vXH4gE=";
   };
 
   disabled = pythonOlder "3.9";
diff --git a/pkgs/development/python-modules/opentypespec/default.nix b/pkgs/development/python-modules/opentypespec/default.nix
index ea4f2ca3530d..81fc60e5dc55 100644
--- a/pkgs/development/python-modules/opentypespec/default.nix
+++ b/pkgs/development/python-modules/opentypespec/default.nix
@@ -15,7 +15,6 @@ buildPythonPackage rec {
     hash = "sha256-fOEHmtlCkFhn1jyIA+CsHIfud7x3PPb7UWQsnrVyDqY=";
   };
 
-  doCheck = true;
   nativeCheckInputs = [ unittestCheckHook ];
   unittestFlagsArray = [
     "-s"
diff --git a/pkgs/development/python-modules/osxphotos/default.nix b/pkgs/development/python-modules/osxphotos/default.nix
index 0af996f622a8..f22e7e34d9aa 100644
--- a/pkgs/development/python-modules/osxphotos/default.nix
+++ b/pkgs/development/python-modules/osxphotos/default.nix
@@ -77,6 +77,7 @@ buildPythonPackage rec {
     "more-itertools"
     "objexplore"
     "textx"
+    "tenacity"
   ];
 
   pythonImportsCheck = [ "osxphotos" ];
diff --git a/pkgs/development/python-modules/ots-python/default.nix b/pkgs/development/python-modules/ots-python/default.nix
index 7aba8368fd8b..9c0ae3625c21 100644
--- a/pkgs/development/python-modules/ots-python/default.nix
+++ b/pkgs/development/python-modules/ots-python/default.nix
@@ -32,7 +32,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ opentype-sanitizer ];
   nativeBuildInputs = [ setuptools-scm ];
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pid/default.nix b/pkgs/development/python-modules/pid/default.nix
index b0bb834a302f..0add8799be8b 100644
--- a/pkgs/development/python-modules/pid/default.nix
+++ b/pkgs/development/python-modules/pid/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  doCheck = true;
-
   meta = with lib; {
     description = "Pidfile featuring stale detection and file-locking";
     homepage = "https://github.com/trbs/pid/";
diff --git a/pkgs/development/python-modules/py-aosmith/default.nix b/pkgs/development/python-modules/py-aosmith/default.nix
index 5b504e647ea6..199011b934b1 100644
--- a/pkgs/development/python-modules/py-aosmith/default.nix
+++ b/pkgs/development/python-modules/py-aosmith/default.nix
@@ -22,9 +22,11 @@ buildPythonPackage rec {
     hash = "sha256-TjBjyWxBPrZEY/o1DZ+GiFTHTW37WwFN0oyJSyGru28=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [ "tenacity" ];
+
+  dependencies = [
     aiohttp
     tenacity
   ];
diff --git a/pkgs/development/python-modules/py3dns/default.nix b/pkgs/development/python-modules/py3dns/default.nix
index 14ad16771655..a036ba2707cf 100644
--- a/pkgs/development/python-modules/py3dns/default.nix
+++ b/pkgs/development/python-modules/py3dns/default.nix
@@ -2,24 +2,20 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  flit-core,
 }:
 
 buildPythonPackage rec {
   pname = "py3dns";
-  version = "3.2.1";
-  format = "setuptools";
+  version = "4.0.2";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1r25f0ys5p37bhld7m7n4gb0lrysaym3w318w2f8bncq7r3d81qz";
+    hash = "sha256-mGUugOzsFDxg948OazQWMcqadWDt2N3fyGTAKQJhijk=";
   };
 
-  preConfigure = ''
-    sed -i \
-      -e '/import DNS/d' \
-      -e 's/DNS.__version__/"${version}"/g' \
-      setup.py
-  '';
+  build-system = [ flit-core ];
 
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index e22429f0716f..ba171e372c8b 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -80,7 +80,6 @@ buildPythonPackage rec {
   PARQUET_HOME = arrow-cpp;
 
   ARROW_TEST_DATA = lib.optionalString doCheck arrow-cpp.ARROW_TEST_DATA;
-
   doCheck = true;
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/pycangjie/default.nix b/pkgs/development/python-modules/pycangjie/default.nix
index caca2f9f3d0a..65768bdc806f 100644
--- a/pkgs/development/python-modules/pycangjie/default.nix
+++ b/pkgs/development/python-modules/pycangjie/default.nix
@@ -43,8 +43,6 @@ buildPythonPackage {
 
   configureScript = "./autogen.sh";
 
-  doCheck = true;
-
   meta = with lib; {
     description = "Python wrapper to libcangjie";
     homepage = "http://cangjians.github.io/projects/pycangjie/";
diff --git a/pkgs/development/python-modules/pychromecast/default.nix b/pkgs/development/python-modules/pychromecast/default.nix
index 7b499f82d061..c23e5ced0b69 100644
--- a/pkgs/development/python-modules/pychromecast/default.nix
+++ b/pkgs/development/python-modules/pychromecast/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pychromecast";
-  version = "14.0.3";
+  version = "14.0.4";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyChromecast";
     inherit version;
-    hash = "sha256-SwNXwJywl0r5trcQNH73Iu9ZZijlMj4slyeBint/x5c=";
+    hash = "sha256-H8BdY9sVL+b3Hv3ud9FCKNxMVemdc03kdXRVgAsfO6Q=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pycrdt/Cargo.lock b/pkgs/development/python-modules/pycrdt/Cargo.lock
index 8acdc7ca2112..efdd3eec91de 100644
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@@ -223,9 +223,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.14"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
+checksum = "915a1e146535de9163f3987b8944ed8cf49a18bb0056bcebcdcece385cece4ff"
 
 [[package]]
 name = "portable-atomic"
@@ -235,16 +235,16 @@ checksum = "cc9c68a3f6da06753e9335d63e27f6b9754dd1920d941135b7ea8224f141adb2"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.88"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c3a7fc5db1e57d5a779a352c8cdb57b29aa4c40cc69c3a68a7fedc815fbf2f9"
+checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "pycrdt"
-version = "0.10.4"
+version = "0.10.6"
 dependencies = [
  "pyo3",
  "yrs",
@@ -345,18 +345,18 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "serde"
-version = "1.0.210"
+version = "1.0.213"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
+checksum = "3ea7893ff5e2466df8d720bb615088341b295f849602c6956047f8f80f0e9bc1"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.210"
+version = "1.0.213"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
+checksum = "7e85ad2009c50b58e87caa8cd6dac16bdf511bbfb7af6c33df902396aa480fa5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -392,9 +392,9 @@ checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "syn"
-version = "2.0.82"
+version = "2.0.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83540f837a8afc019423a8edb95b52a8effe46957ee402287f4292fae35be021"
+checksum = "5023162dfcd14ef8f32034d8bcd4cc5ddc61ef7a247c024a33e24e1f24d21b56"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -409,18 +409,18 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
 
 [[package]]
 name = "thiserror"
-version = "1.0.64"
+version = "1.0.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84"
+checksum = "5d11abd9594d9b38965ef50805c5e469ca9cc6f197f883f717e0269a3057b3d5"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.64"
+version = "1.0.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08904e7672f5eb876eaaf87e0ce17857500934f4981c4a0ab2b4aa98baac7fc3"
+checksum = "ae71770322cbd277e69d762a16c444af02aa0575ac0d174f0b9562d3b37f8602"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -566,9 +566,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "yrs"
-version = "0.21.2"
+version = "0.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7744baf8d4f74beba8f47ca3a611c512766c82023f271167b14d21216559b014"
+checksum = "81de5913bca29f43a1d12ca92a7b39a2945e9420e01602a7563917c7bfc60f70"
 dependencies = [
  "arc-swap",
  "async-lock",
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index 37730c78fb84..a7704735a3cb 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "pycrdt";
-  version = "0.10.4";
+  version = "0.10.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-server";
     repo = "pycrdt";
     rev = "refs/tags/${version}";
-    hash = "sha256-nKjXEXvEIGtwbSoabz7UBsx4nfsCgUXm+JdSL5Z/b38=";
+    hash = "sha256-TKSBTpOvAr1/HBn3HnwNdEwM1hgbvPdice8bcVhVmH0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pymilter/default.nix b/pkgs/development/python-modules/pymilter/default.nix
index 6f0c4291d4d5..634f437b810f 100644
--- a/pkgs/development/python-modules/pymilter/default.nix
+++ b/pkgs/development/python-modules/pymilter/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   libmilter,
   berkeleydb,
-  pydns,
+  py3dns,
   iana-etc,
   libredirect,
   pyasyncore,
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [ pyasyncore ];
   dependencies = [
     berkeleydb
-    pydns
+    py3dns
   ];
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/pymoo/default.nix b/pkgs/development/python-modules/pymoo/default.nix
index 3121f48b1ab3..86eb3e81b294 100644
--- a/pkgs/development/python-modules/pymoo/default.nix
+++ b/pkgs/development/python-modules/pymoo/default.nix
@@ -70,7 +70,6 @@ buildPythonPackage rec {
     scipy
   ];
 
-  doCheck = true;
   preCheck = ''
     substituteInPlace pymoo/config.py \
       --replace-fail "https://raw.githubusercontent.com/anyoptimization/pymoo-data/main/" \
diff --git a/pkgs/development/python-modules/pymumble/default.nix b/pkgs/development/python-modules/pymumble/default.nix
index bc15652d7027..e6214b6a9023 100644
--- a/pkgs/development/python-modules/pymumble/default.nix
+++ b/pkgs/development/python-modules/pymumble/default.nix
@@ -7,29 +7,28 @@
   pytestCheckHook,
   pycrypto,
   pythonOlder,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "pymumble";
-  version = "1.6.1"; # Don't upgrade to 1.7, version was yanked
-  format = "setuptools";
+  version = "unstable-2024-10-20";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
-    owner = "azlux";
+    owner = "tjni";
     repo = "pymumble";
-    rev = "refs/tags/${version}";
-    hash = "sha256-+sT5pqdm4A2rrUcUUmvsH+iazg80+/go0zM1vr9oeuE=";
+    rev = "3241e84e5ce162a20597e4df6a9c443122357fec";
+    hash = "sha256-9lfWvfrS+vUFTf9jo4T+VHkm9u/hVjsDszLBQIEZVcQ=";
   };
 
-  postPatch = ''
-    # Changes all `library==x.y.z` statements to just `library`
-    # So that we aren't constrained to a specific version
-    sed -i 's/\(.*\)==.*/\1/' requirements.txt
-  '';
+  build-system = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     opuslib
     protobuf
   ];
@@ -46,9 +45,11 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Library to create mumble bots";
-    homepage = "https://github.com/azlux/pymumble";
-    changelog = "https://github.com/azlux/pymumble/releases/tag/${version}";
+    homepage = "https://github.com/tjni/pymumble";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ thelegy ];
+    maintainers = with maintainers; [
+      thelegy
+      tjni
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/pynetbox/default.nix b/pkgs/development/python-modules/pynetbox/default.nix
index 14ce4a0de929..e7ff03c15a49 100644
--- a/pkgs/development/python-modules/pynetbox/default.nix
+++ b/pkgs/development/python-modules/pynetbox/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pynetbox";
-  version = "7.4.0";
+  version = "7.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "netbox-community";
     repo = "pynetbox";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JOUgQvOtvXRDM79Sp472OHPh1YEoA82T3R9aZFes8SI=";
+    hash = "sha256-pP4DEHf4Dj3sQ7qx7tU0B0PaMCuzUM9R2pIYRI1Fpso=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyqt/6.x.nix b/pkgs/development/python-modules/pyqt/6.x.nix
index 6356eeb9637f..b1bf34abd489 100644
--- a/pkgs/development/python-modules/pyqt/6.x.nix
+++ b/pkgs/development/python-modules/pyqt/6.x.nix
@@ -130,7 +130,6 @@ buildPythonPackage rec {
   dontConfigure = true;
 
   # Checked using pythonImportsCheck, has no tests
-  doCheck = true;
 
   pythonImportsCheck =
     [
diff --git a/pkgs/development/python-modules/pyqt6-webengine/default.nix b/pkgs/development/python-modules/pyqt6-webengine/default.nix
index 5ea0b8b1941d..59a2a1eeab86 100644
--- a/pkgs/development/python-modules/pyqt6-webengine/default.nix
+++ b/pkgs/development/python-modules/pyqt6-webengine/default.nix
@@ -73,7 +73,6 @@ buildPythonPackage rec {
   dontConfigure = true;
 
   # Checked using pythonImportsCheck, has no tests
-  doCheck = true;
 
   pythonImportsCheck = [
     "PyQt6.QtWebEngineCore"
diff --git a/pkgs/development/python-modules/pyspf/default.nix b/pkgs/development/python-modules/pyspf/default.nix
index 8e69a942665f..cdedf35b93a5 100644
--- a/pkgs/development/python-modules/pyspf/default.nix
+++ b/pkgs/development/python-modules/pyspf/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pydns,
+  py3dns,
 }:
 
 buildPythonPackage rec {
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     sha256 = "0bmimlmwrq9glnjc4i6pwch30n3y5wyqmkjfyayxqxkfrixqwydi";
   };
 
-  propagatedBuildInputs = [ pydns ];
+  propagatedBuildInputs = [ py3dns ];
 
   # requires /etc/resolv.conf to exist
   doCheck = false;
diff --git a/pkgs/development/python-modules/python-barbicanclient/default.nix b/pkgs/development/python-modules/python-barbicanclient/default.nix
index 7188c8381605..9c65649a2336 100644
--- a/pkgs/development/python-modules/python-barbicanclient/default.nix
+++ b/pkgs/development/python-modules/python-barbicanclient/default.nix
@@ -60,8 +60,6 @@ buildPythonPackage rec {
     requests
   ];
 
-  doCheck = true;
-
   nativeCheckInputs = [
     requests-mock
     stestr
diff --git a/pkgs/development/python-modules/python-musicpd/default.nix b/pkgs/development/python-modules/python-musicpd/default.nix
index 0d75cc30454f..e5ed4cd9b2b3 100644
--- a/pkgs/development/python-modules/python-musicpd/default.nix
+++ b/pkgs/development/python-modules/python-musicpd/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  doCheck = true;
-
   meta = with lib; {
     description = "MPD (Music Player Daemon) client library written in pure Python";
     homepage = "https://gitlab.com/kaliko/python-musicpd";
diff --git a/pkgs/development/python-modules/pytibber/default.nix b/pkgs/development/python-modules/pytibber/default.nix
index 94810bfac05d..1b7af821ade9 100644
--- a/pkgs/development/python-modules/pytibber/default.nix
+++ b/pkgs/development/python-modules/pytibber/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pytibber";
-  version = "0.30.2";
+  version = "0.30.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pyTibber";
     rev = "refs/tags/${version}";
-    hash = "sha256-9Tnn68RxKwEruYEGo2pZQTQTlYnVMfa3MRzA55HlBRc=";
+    hash = "sha256-4MkREdeYqAA+MpM9JQyiVVDPpefVTNT0x0ptR33K6yU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyytlounge/default.nix b/pkgs/development/python-modules/pyytlounge/default.nix
index 2ec7c3255562..bbb3ba23163f 100644
--- a/pkgs/development/python-modules/pyytlounge/default.nix
+++ b/pkgs/development/python-modules/pyytlounge/default.nix
@@ -13,6 +13,7 @@
 buildPythonPackage rec {
   pname = "pyytlounge";
   version = "2.1.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "FabioGNR";
@@ -21,10 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-0QPa3EzOBv5fuw3FGgmoN4KiC4KHo1Z+Svjcneoe0pc=";
   };
 
-  pyproject = true;
-
-  doCheck = true;
-
   build-system = [ hatchling ];
 
   dependencies = [ aiohttp ];
diff --git a/pkgs/development/python-modules/qcs-api-client/default.nix b/pkgs/development/python-modules/qcs-api-client/default.nix
index 34984ec5755e..9d903f4fe064 100644
--- a/pkgs/development/python-modules/qcs-api-client/default.nix
+++ b/pkgs/development/python-modules/qcs-api-client/default.nix
@@ -50,6 +50,7 @@ buildPythonPackage rec {
     "httpx"
     "iso8601"
     "pydantic"
+    "tenacity"
   ];
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/quart/default.nix b/pkgs/development/python-modules/quart/default.nix
index 0388b58a34c9..17c7a65ec387 100644
--- a/pkgs/development/python-modules/quart/default.nix
+++ b/pkgs/development/python-modules/quart/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "quart";
-  version = "0.19.6";
+  version = "0.19.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pallets";
     repo = "quart";
     rev = "refs/tags/${version}";
-    hash = "sha256-oR03Qu93F+pcWywbdYgMKIAdohBNezlGz04ws3yGAxs=";
+    hash = "sha256-A23+25bDzK2GlGNTCul6HbsjNujrnhpzTxdnV3Ig028=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/rasterio/default.nix b/pkgs/development/python-modules/rasterio/default.nix
index abbd2eef7ef5..30dd05cffbdd 100644
--- a/pkgs/development/python-modules/rasterio/default.nix
+++ b/pkgs/development/python-modules/rasterio/default.nix
@@ -86,8 +86,6 @@ buildPythonPackage rec {
     shapely
   ];
 
-  doCheck = true;
-
   preCheck = ''
     rm -r rasterio # prevent importing local rasterio
   '';
diff --git a/pkgs/development/python-modules/retry2/default.nix b/pkgs/development/python-modules/retry2/default.nix
new file mode 100644
index 000000000000..f0724f472a3c
--- /dev/null
+++ b/pkgs/development/python-modules/retry2/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  decorator,
+  fetchFromGitHub,
+  pbr,
+  pytestCheckHook,
+  pythonOlder,
+}:
+
+buildPythonPackage rec {
+  pname = "retry2";
+  version = "0.9.5";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "eSAMTrade";
+    repo = "retry";
+    rev = "refs/tags/${version}";
+    hash = "sha256-RxOEekkmMRl2OQW2scFWbMQiFXcH0sbd+k9R8uul0uY=";
+  };
+
+  env.PBR_VERSION = version;
+
+  build-system = [ pbr ];
+
+  dependencies = [ decorator ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "retry" ];
+
+  meta = {
+    description = "Retry decorator";
+    homepage = "https://github.com/eSAMTrade/retry";
+    changelog = "https://github.com/eSAMTrade/retry/blob/${src.rev}/ChangeLog";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/rouge-score/default.nix b/pkgs/development/python-modules/rouge-score/default.nix
index adc543b1d907..59d05016720c 100644
--- a/pkgs/development/python-modules/rouge-score/default.nix
+++ b/pkgs/development/python-modules/rouge-score/default.nix
@@ -52,8 +52,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  doCheck = true;
-
   disabledTests = [
     # https://github.com/google-research/google-research/issues/1203
     "testRougeLSumSentenceSplitting"
diff --git a/pkgs/development/python-modules/rstr/default.nix b/pkgs/development/python-modules/rstr/default.nix
index 7bf0eb244fb9..cf2a5ef42212 100644
--- a/pkgs/development/python-modules/rstr/default.nix
+++ b/pkgs/development/python-modules/rstr/default.nix
@@ -23,7 +23,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  doCheck = true;
   nativeCheckInputs = [ unittestCheckHook ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/scikits-odes/default.nix b/pkgs/development/python-modules/scikits-odes/default.nix
index f5ddb753ffaf..f9695701602c 100644
--- a/pkgs/development/python-modules/scikits-odes/default.nix
+++ b/pkgs/development/python-modules/scikits-odes/default.nix
@@ -38,7 +38,6 @@ buildPythonPackage rec {
     scipy
   ] ++ lib.optionals (!isPy3k) [ enum34 ];
 
-  doCheck = true;
   nativeCheckInputs = [ pytest ];
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/segyio/default.nix b/pkgs/development/python-modules/segyio/default.nix
index 9e221db8cfe7..574354ea44a0 100644
--- a/pkgs/development/python-modules/segyio/default.nix
+++ b/pkgs/development/python-modules/segyio/default.nix
@@ -42,7 +42,6 @@ buildPythonPackage rec {
     scikit-build
   ];
 
-  doCheck = true;
   # I'm not modifying the checkPhase nor adding a pytestCheckHook because the pytest is called
   # within the cmake test phase
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/sip/4.x.nix b/pkgs/development/python-modules/sip/4.x.nix
index e9305188ca6b..8dc26ddfdc0d 100644
--- a/pkgs/development/python-modules/sip/4.x.nix
+++ b/pkgs/development/python-modules/sip/4.x.nix
@@ -57,8 +57,6 @@ buildPythonPackage rec {
     "sipconfig"
   ];
 
-  doCheck = true;
-
   meta = with lib; {
     description = "Creates C++ bindings for Python modules";
     mainProgram = "sip";
diff --git a/pkgs/development/python-modules/skyfield/default.nix b/pkgs/development/python-modules/skyfield/default.nix
index 8fe675eb5bed..b917cf214890 100644
--- a/pkgs/development/python-modules/skyfield/default.nix
+++ b/pkgs/development/python-modules/skyfield/default.nix
@@ -49,8 +49,6 @@ buildPythonPackage rec {
     assay
   ];
 
-  doCheck = true;
-
   checkPhase = ''
     runHook preCheck
 
diff --git a/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix b/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix
index d6d1094447d2..3205238b742b 100644
--- a/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix
+++ b/pkgs/development/python-modules/spacy-transformers/annotation-test/default.nix
@@ -17,7 +17,6 @@ stdenv.mkDerivation {
 
   dontConfigure = true;
   dontBuild = true;
-  doCheck = true;
 
   nativeCheckInputs = [
     pytest
diff --git a/pkgs/development/python-modules/spacy/annotation-test/default.nix b/pkgs/development/python-modules/spacy/annotation-test/default.nix
index cb8a97aa568f..5f5f8f3ca0a7 100644
--- a/pkgs/development/python-modules/spacy/annotation-test/default.nix
+++ b/pkgs/development/python-modules/spacy/annotation-test/default.nix
@@ -17,7 +17,6 @@ stdenv.mkDerivation {
 
   dontConfigure = true;
   dontBuild = true;
-  doCheck = true;
 
   nativeCheckInputs = [
     pytest
diff --git a/pkgs/development/python-modules/sre-yield/default.nix b/pkgs/development/python-modules/sre-yield/default.nix
index 04cc12184090..fdd8cc8b4b05 100644
--- a/pkgs/development/python-modules/sre-yield/default.nix
+++ b/pkgs/development/python-modules/sre-yield/default.nix
@@ -19,7 +19,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools ];
 
-  doCheck = true;
   nativeCheckInputs = [ unittestCheckHook ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/telegraph/default.nix b/pkgs/development/python-modules/telegraph/default.nix
index 80a4d12c7b16..3dd1ce594efb 100644
--- a/pkgs/development/python-modules/telegraph/default.nix
+++ b/pkgs/development/python-modules/telegraph/default.nix
@@ -34,8 +34,6 @@ buildPythonPackage rec {
 
   disabledTests = [ "test_get_page" ];
 
-  doCheck = true;
-
   pythonImportsCheck = [ "telegraph" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/tenacity/default.nix b/pkgs/development/python-modules/tenacity/default.nix
index dbdf78f12524..0def5a032243 100644
--- a/pkgs/development/python-modules/tenacity/default.nix
+++ b/pkgs/development/python-modules/tenacity/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pbr,
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
@@ -13,20 +12,17 @@
 
 buildPythonPackage rec {
   pname = "tenacity";
-  version = "8.5.0";
-  format = "pyproject";
+  version = "9.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-i8bAyKCbMebK0TxHr77RpWdRglCpoXFBhYLtjZwgyng=";
+    hash = "sha256-gH83ypfWKqNhJk1Jew4x6SuAJwRJQr+nVhYNkIMg1zs=";
   };
 
-  nativeBuildInputs = [
-    pbr
-    setuptools-scm
-  ];
+  build-system = [ setuptools-scm ];
 
   nativeCheckInputs = [
     pytest-asyncio
@@ -39,6 +35,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     homepage = "https://github.com/jd/tenacity";
+    changelog = "https://github.com/jd/tenacity/releases/tag/${version}";
     description = "Retrying library for Python";
     license = licenses.asl20;
     maintainers = with maintainers; [ jakewaksbaum ];
diff --git a/pkgs/development/python-modules/tpm2-pytss/default.nix b/pkgs/development/python-modules/tpm2-pytss/default.nix
index 1176b90d9653..6dcba1ef9535 100644
--- a/pkgs/development/python-modules/tpm2-pytss/default.nix
+++ b/pkgs/development/python-modules/tpm2-pytss/default.nix
@@ -81,8 +81,6 @@ buildPythonPackage rec {
     pyyaml
   ];
 
-  doCheck = true;
-
   nativeCheckInputs = [
     pytestCheckHook
     tpm2-tools
diff --git a/pkgs/development/python-modules/turnt/default.nix b/pkgs/development/python-modules/turnt/default.nix
index abed46cc766e..8d9af7740283 100644
--- a/pkgs/development/python-modules/turnt/default.nix
+++ b/pkgs/development/python-modules/turnt/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     tomli
   ];
 
-  doCheck = true;
-
   checkPhase = ''
     runHook preCheck
     $out/bin/turnt test/*/*.t
diff --git a/pkgs/development/python-modules/ufolint/default.nix b/pkgs/development/python-modules/ufolint/default.nix
index 95db33a7bfc1..714a5cac45f3 100644
--- a/pkgs/development/python-modules/ufolint/default.nix
+++ b/pkgs/development/python-modules/ufolint/default.nix
@@ -27,7 +27,6 @@ buildPythonPackage rec {
     fonttools
   ];
 
-  doCheck = true;
   nativeBuildInputs = [ pytestCheckHook ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/xapian/default.nix b/pkgs/development/python-modules/xapian/default.nix
index 382b67293272..fea907243d70 100644
--- a/pkgs/development/python-modules/xapian/default.nix
+++ b/pkgs/development/python-modules/xapian/default.nix
@@ -34,8 +34,6 @@ buildPythonPackage rec {
     xapian
   ];
 
-  doCheck = true;
-
   checkPhase = ''
     ${python.interpreter} python${pythonSuffix}/pythontest.py
   '';
diff --git a/pkgs/development/python-modules/xdot/default.nix b/pkgs/development/python-modules/xdot/default.nix
index 8cd817ea1c90..944b9f4619e9 100644
--- a/pkgs/development/python-modules/xdot/default.nix
+++ b/pkgs/development/python-modules/xdot/default.nix
@@ -60,8 +60,6 @@ buildPythonPackage rec {
     runHook postCheck
   '';
 
-  doCheck = true;
-
   meta = with lib; {
     description = "Interactive viewer for graphs written in Graphviz's dot";
     mainProgram = "xdot";
diff --git a/pkgs/development/python-modules/zeversolar/default.nix b/pkgs/development/python-modules/zeversolar/default.nix
new file mode 100644
index 000000000000..5a28927a3ec3
--- /dev/null
+++ b/pkgs/development/python-modules/zeversolar/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytest-mock,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  retry2,
+}:
+
+buildPythonPackage rec {
+  pname = "zeversolar";
+  version = "0.3.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "kvanzuijlen";
+    repo = "zeversolar";
+    rev = "refs/tags/${version}";
+    hash = "sha256-HnF21B7k2MmugMjGIF2EKwwXJWD/WdDvPdz1oaPSS5Y=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    requests
+    retry2
+  ];
+
+  nativeCheckInputs = [
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "zeversolar" ];
+
+  meta = {
+    description = "Module to interact with the local CGI provided by ZeverSolar";
+    homepage = "https://github.com/kvanzuijlen/zeversolar";
+    changelog = "https://github.com/kvanzuijlen/zeversolar/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index 99aa58e5040f..e17ddc72c9ba 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -474,7 +474,7 @@ let
     RMySQL = with pkgs; [ zlib libmysqlclient openssl.dev ];
     RNetCDF = with pkgs; [ netcdf udunits ];
     RODBC = [ pkgs.libiodbc ];
-    rpanel = [ pkgs.bwidget ];
+    rpanel = [ pkgs.tclPackages.bwidget ];
     Rpoppler = [ pkgs.poppler ];
     RPostgres = with pkgs; [ postgresql ];
     RPostgreSQL = with pkgs; [ postgresql postgresql ];
@@ -1460,9 +1460,9 @@ let
 
     rpanel = old.rpanel.overrideAttrs (attrs: {
       preConfigure = ''
-        export TCLLIBPATH="${pkgs.bwidget}/lib/bwidget${pkgs.bwidget.version}"
+        export TCLLIBPATH="${pkgs.tclPackages.bwidget}/lib/bwidget${pkgs.tclPackages.bwidget.version}"
       '';
-      TCLLIBPATH = "${pkgs.bwidget}/lib/bwidget${pkgs.bwidget.version}";
+      TCLLIBPATH = "${pkgs.tclPackages.bwidget}/lib/bwidget${pkgs.tclPackages.bwidget.version}";
     });
 
     networkscaleup = old.networkscaleup.overrideAttrs (attrs: {
diff --git a/pkgs/development/tcl-modules/by-name/README.md b/pkgs/development/tcl-modules/by-name/README.md
new file mode 100644
index 000000000000..c65310524c1c
--- /dev/null
+++ b/pkgs/development/tcl-modules/by-name/README.md
@@ -0,0 +1,17 @@
+# Name-based Tcl package directories
+
+The structure of this directory is identical to the one described in
+[/pkgs/by-name/README.md](../../../by-name/README.md).
+The only difference is the scope:
+
+```nix
+{ lib
+# You can get tclPackages attributes directly
+, mkTclDerivation
+, tcllib
+}:
+
+mkTclDerivation {
+  # ...
+}
+```
diff --git a/pkgs/development/libraries/bwidget/default.nix b/pkgs/development/tcl-modules/by-name/bw/bwidget/package.nix
similarity index 91%
rename from pkgs/development/libraries/bwidget/default.nix
rename to pkgs/development/tcl-modules/by-name/bw/bwidget/package.nix
index 8a408864c582..161324f9e6e0 100644
--- a/pkgs/development/libraries/bwidget/default.nix
+++ b/pkgs/development/tcl-modules/by-name/bw/bwidget/package.nix
@@ -1,6 +1,6 @@
-{ lib, fetchurl, tcl, tk }:
+{ lib, fetchurl, mkTclDerivation, tk }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "bwidget";
   version = "1.10.0";
 
diff --git a/pkgs/tools/misc/expect/0004-enable-cross-compilation.patch b/pkgs/development/tcl-modules/by-name/ex/expect/0004-enable-cross-compilation.patch
similarity index 100%
rename from pkgs/tools/misc/expect/0004-enable-cross-compilation.patch
rename to pkgs/development/tcl-modules/by-name/ex/expect/0004-enable-cross-compilation.patch
diff --git a/pkgs/tools/misc/expect/fix-build-time-run-tcl.patch b/pkgs/development/tcl-modules/by-name/ex/expect/fix-build-time-run-tcl.patch
similarity index 100%
rename from pkgs/tools/misc/expect/fix-build-time-run-tcl.patch
rename to pkgs/development/tcl-modules/by-name/ex/expect/fix-build-time-run-tcl.patch
diff --git a/pkgs/tools/misc/expect/fix-darwin-bsd-clang16.patch b/pkgs/development/tcl-modules/by-name/ex/expect/fix-darwin-bsd-clang16.patch
similarity index 100%
rename from pkgs/tools/misc/expect/fix-darwin-bsd-clang16.patch
rename to pkgs/development/tcl-modules/by-name/ex/expect/fix-darwin-bsd-clang16.patch
diff --git a/pkgs/tools/misc/expect/freebsd-unversioned.patch b/pkgs/development/tcl-modules/by-name/ex/expect/freebsd-unversioned.patch
similarity index 100%
rename from pkgs/tools/misc/expect/freebsd-unversioned.patch
rename to pkgs/development/tcl-modules/by-name/ex/expect/freebsd-unversioned.patch
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/development/tcl-modules/by-name/ex/expect/package.nix
similarity index 100%
rename from pkgs/tools/misc/expect/default.nix
rename to pkgs/development/tcl-modules/by-name/ex/expect/package.nix
diff --git a/pkgs/development/libraries/incrtcl/default.nix b/pkgs/development/tcl-modules/by-name/in/incrtcl/package.nix
similarity index 92%
rename from pkgs/development/libraries/incrtcl/default.nix
rename to pkgs/development/tcl-modules/by-name/in/incrtcl/package.nix
index 4558ebbd0dcf..7b1397ac1bb8 100644
--- a/pkgs/development/libraries/incrtcl/default.nix
+++ b/pkgs/development/tcl-modules/by-name/in/incrtcl/package.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchurl, writeText, tcl }:
+{ lib, stdenv, mkTclDerivation, fetchurl, writeText, tcl }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "incrtcl";
   version = "4.2.3";
 
diff --git a/pkgs/development/libraries/itktcl/default.nix b/pkgs/development/tcl-modules/by-name/it/itktcl/package.nix
similarity index 92%
rename from pkgs/development/libraries/itktcl/default.nix
rename to pkgs/development/tcl-modules/by-name/it/itktcl/package.nix
index b6a4788075f7..aefefa8c3ceb 100644
--- a/pkgs/development/libraries/itktcl/default.nix
+++ b/pkgs/development/tcl-modules/by-name/it/itktcl/package.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchurl, tcl, tk, incrtcl }:
+{ lib, stdenv, fetchurl, mkTclDerivation, tk, incrtcl }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "itk-tcl";
   version = "4.1.0";
 
diff --git a/pkgs/development/libraries/mustache-tcl/default.nix b/pkgs/development/tcl-modules/by-name/mu/mustache-tcl/package.nix
similarity index 90%
rename from pkgs/development/libraries/mustache-tcl/default.nix
rename to pkgs/development/tcl-modules/by-name/mu/mustache-tcl/package.nix
index 063c8ea36f71..5281f40a78e8 100644
--- a/pkgs/development/libraries/mustache-tcl/default.nix
+++ b/pkgs/development/tcl-modules/by-name/mu/mustache-tcl/package.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, tcl, tcllib }:
+{ lib, fetchFromGitHub, mkTclDerivation, tcllib }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "mustache-tcl";
   version = "1.1.3.4";
 
diff --git a/pkgs/by-name/pd/pdf4tcl/package.nix b/pkgs/development/tcl-modules/by-name/pd/pdf4tcl/package.nix
similarity index 93%
rename from pkgs/by-name/pd/pdf4tcl/package.nix
rename to pkgs/development/tcl-modules/by-name/pd/pdf4tcl/package.nix
index 94ba20ebd742..07d059c042d3 100644
--- a/pkgs/by-name/pd/pdf4tcl/package.nix
+++ b/pkgs/development/tcl-modules/by-name/pd/pdf4tcl/package.nix
@@ -1,10 +1,10 @@
 {
   lib,
-  tcl,
+  mkTclDerivation,
   fetchzip,
 }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "pdf4tcl";
   version = "0.9.4";
 
diff --git a/pkgs/development/libraries/tcl-fcgi/default.nix b/pkgs/development/tcl-modules/by-name/tc/tcl-fcgi/package.nix
similarity index 90%
rename from pkgs/development/libraries/tcl-fcgi/default.nix
rename to pkgs/development/tcl-modules/by-name/tc/tcl-fcgi/package.nix
index 5451c5186a4e..49d23ddd9a72 100644
--- a/pkgs/development/libraries/tcl-fcgi/default.nix
+++ b/pkgs/development/tcl-modules/by-name/tc/tcl-fcgi/package.nix
@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, tcl, tclx }:
+{ lib, fetchFromGitHub, mkTclDerivation, tclx }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "tcl-fcgi";
   version = "0.5.0";
 
diff --git a/pkgs/by-name/tc/tclcurl/package.nix b/pkgs/development/tcl-modules/by-name/tc/tclcurl/package.nix
similarity index 94%
rename from pkgs/by-name/tc/tclcurl/package.nix
rename to pkgs/development/tcl-modules/by-name/tc/tclcurl/package.nix
index 2bcfef25a3bd..9e967de825bc 100644
--- a/pkgs/by-name/tc/tclcurl/package.nix
+++ b/pkgs/development/tcl-modules/by-name/tc/tclcurl/package.nix
@@ -1,11 +1,11 @@
 {
   lib,
-  tcl,
+  mkTclDerivation,
   fetchFromGitHub,
   curl,
 }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "tclcurl";
   version = "7.22.1";
 
diff --git a/pkgs/development/libraries/tcllib/default.nix b/pkgs/development/tcl-modules/by-name/tc/tcllib/package.nix
similarity index 93%
rename from pkgs/development/libraries/tcllib/default.nix
rename to pkgs/development/tcl-modules/by-name/tc/tcllib/package.nix
index a5bfba8b0559..8ec83df8b6ed 100644
--- a/pkgs/development/libraries/tcllib/default.nix
+++ b/pkgs/development/tcl-modules/by-name/tc/tcllib/package.nix
@@ -1,11 +1,11 @@
 { lib
 , fetchzip
-, tcl
+, mkTclDerivation
 , critcl
 , withCritcl ? true
 }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "tcllib";
   version = "1.21";
 
diff --git a/pkgs/by-name/tc/tclmagick/package.nix b/pkgs/development/tcl-modules/by-name/tc/tclmagick/package.nix
similarity index 94%
rename from pkgs/by-name/tc/tclmagick/package.nix
rename to pkgs/development/tcl-modules/by-name/tc/tclmagick/package.nix
index f5d0bc4b152f..ad688ec56de4 100644
--- a/pkgs/by-name/tc/tclmagick/package.nix
+++ b/pkgs/development/tcl-modules/by-name/tc/tclmagick/package.nix
@@ -1,12 +1,12 @@
 {
   lib,
-  tcl,
+  mkTclDerivation,
   fetchzip,
   graphicsmagick,
   tk,
 }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "tclmagick";
   version = "1.3.43";
 
diff --git a/pkgs/development/interpreters/tclreadline/default.nix b/pkgs/development/tcl-modules/by-name/tc/tclreadline/package.nix
similarity index 97%
rename from pkgs/development/interpreters/tclreadline/default.nix
rename to pkgs/development/tcl-modules/by-name/tc/tclreadline/package.nix
index 57f7f9a7b194..62880ee5323a 100644
--- a/pkgs/development/interpreters/tclreadline/default.nix
+++ b/pkgs/development/tcl-modules/by-name/tc/tclreadline/package.nix
@@ -4,11 +4,11 @@
 , autoconf
 , libtool
 , readline
-, tcl
+, mkTclDerivation
 , tk
 }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "tclreadline";
   version = "2.4.0";
 
diff --git a/pkgs/development/libraries/tcltls/default.nix b/pkgs/development/tcl-modules/by-name/tc/tcltls/package.nix
similarity index 89%
rename from pkgs/development/libraries/tcltls/default.nix
rename to pkgs/development/tcl-modules/by-name/tc/tcltls/package.nix
index dbc095b64e0b..cb32bf4a7ba8 100644
--- a/pkgs/development/libraries/tcltls/default.nix
+++ b/pkgs/development/tcl-modules/by-name/tc/tcltls/package.nix
@@ -1,6 +1,6 @@
-{ lib, fetchurl, tcl, openssl }:
+{ lib, fetchurl, mkTclDerivation, openssl }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "tcltls";
   version = "1.7.22";
 
diff --git a/pkgs/by-name/tc/tcludp/package.nix b/pkgs/development/tcl-modules/by-name/tc/tcludp/package.nix
similarity index 95%
rename from pkgs/by-name/tc/tcludp/package.nix
rename to pkgs/development/tcl-modules/by-name/tc/tcludp/package.nix
index 890b0d4366fc..073a93432fda 100644
--- a/pkgs/by-name/tc/tcludp/package.nix
+++ b/pkgs/development/tcl-modules/by-name/tc/tcludp/package.nix
@@ -1,10 +1,10 @@
 {
   lib,
-  tcl,
+  mkTclDerivation,
   fetchfossil,
 }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "tcludp";
   version = "1.0.11";
 
diff --git a/pkgs/by-name/tc/tclvfs/package.nix b/pkgs/development/tcl-modules/by-name/tc/tclvfs/package.nix
similarity index 95%
rename from pkgs/by-name/tc/tclvfs/package.nix
rename to pkgs/development/tcl-modules/by-name/tc/tclvfs/package.nix
index 9ac69b5bb153..0fde102cc2a7 100644
--- a/pkgs/by-name/tc/tclvfs/package.nix
+++ b/pkgs/development/tcl-modules/by-name/tc/tclvfs/package.nix
@@ -1,10 +1,10 @@
 {
   lib,
-  tcl,
+  mkTclDerivation,
   fetchzip,
 }:
 
-tcl.mkTclDerivation {
+mkTclDerivation {
   pname = "tclvfs";
   version = "1.4-unstable-2023-11-23";
 
diff --git a/pkgs/development/libraries/tclx/default.nix b/pkgs/development/tcl-modules/by-name/tc/tclx/package.nix
similarity index 94%
rename from pkgs/development/libraries/tclx/default.nix
rename to pkgs/development/tcl-modules/by-name/tc/tclx/package.nix
index 5e3a73febe9b..8ed3bb6f5931 100644
--- a/pkgs/development/libraries/tclx/default.nix
+++ b/pkgs/development/tcl-modules/by-name/tc/tclx/package.nix
@@ -1,9 +1,9 @@
 { lib
 , fetchFromGitHub
-, tcl
+, mkTclDerivation
 }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "tclx";
   version = "8.6.3";
 
diff --git a/pkgs/by-name/td/tdom/package.nix b/pkgs/development/tcl-modules/by-name/td/tdom/package.nix
similarity index 94%
rename from pkgs/by-name/td/tdom/package.nix
rename to pkgs/development/tcl-modules/by-name/td/tdom/package.nix
index a9b96c8d940a..38ac7acfbcf0 100644
--- a/pkgs/by-name/td/tdom/package.nix
+++ b/pkgs/development/tcl-modules/by-name/td/tdom/package.nix
@@ -1,13 +1,13 @@
 {
   lib,
-  tcl,
+  mkTclDerivation,
   fetchzip,
   expat,
   gumbo,
   pkg-config,
 }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "tdom";
   version = "0.9.5";
 
diff --git a/pkgs/development/libraries/tix/duplicated-xlowerwindow.patch b/pkgs/development/tcl-modules/by-name/ti/tix/duplicated-xlowerwindow.patch
similarity index 100%
rename from pkgs/development/libraries/tix/duplicated-xlowerwindow.patch
rename to pkgs/development/tcl-modules/by-name/ti/tix/duplicated-xlowerwindow.patch
diff --git a/pkgs/development/libraries/tix/fix-clang16.patch b/pkgs/development/tcl-modules/by-name/ti/tix/fix-clang16.patch
similarity index 100%
rename from pkgs/development/libraries/tix/fix-clang16.patch
rename to pkgs/development/tcl-modules/by-name/ti/tix/fix-clang16.patch
diff --git a/pkgs/development/libraries/tix/default.nix b/pkgs/development/tcl-modules/by-name/ti/tix/package.nix
similarity index 100%
rename from pkgs/development/libraries/tix/default.nix
rename to pkgs/development/tcl-modules/by-name/ti/tix/package.nix
diff --git a/pkgs/development/libraries/tkimg/default.nix b/pkgs/development/tcl-modules/by-name/tk/tkimg/package.nix
similarity index 100%
rename from pkgs/development/libraries/tkimg/default.nix
rename to pkgs/development/tcl-modules/by-name/tk/tkimg/package.nix
diff --git a/pkgs/development/libraries/wapp/default.nix b/pkgs/development/tcl-modules/by-name/wa/wapp/package.nix
similarity index 93%
rename from pkgs/development/libraries/wapp/default.nix
rename to pkgs/development/tcl-modules/by-name/wa/wapp/package.nix
index 9543b49af3b9..fc7e14205f9f 100644
--- a/pkgs/development/libraries/wapp/default.nix
+++ b/pkgs/development/tcl-modules/by-name/wa/wapp/package.nix
@@ -1,6 +1,6 @@
-{ lib, fetchurl, tcl }:
+{ lib, fetchurl, mkTclDerivation }:
 
-tcl.mkTclDerivation {
+mkTclDerivation {
   pname = "wapp";
   version = "0-unstable-2024-05-23";
 
diff --git a/pkgs/development/compilers/critcl/default.nix b/pkgs/development/tcl-modules/critcl/default.nix
similarity index 95%
rename from pkgs/development/compilers/critcl/default.nix
rename to pkgs/development/tcl-modules/critcl/default.nix
index 5caf63d9dba6..4dda4292eb64 100644
--- a/pkgs/development/compilers/critcl/default.nix
+++ b/pkgs/development/tcl-modules/critcl/default.nix
@@ -1,10 +1,11 @@
 { lib
 , fetchFromGitHub
+, mkTclDerivation
 , tcl
 , tcllib
 }:
 
-tcl.mkTclDerivation rec {
+mkTclDerivation rec {
   pname = "critcl";
   version = "3.2";
 
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 61510384e31e..351c3804bba2 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -198,9 +198,10 @@ rec {
   };
 
   wrapGradle = {
-      lib, callPackage, mitm-cache, substituteAll, symlinkJoin, concatTextFile, makeSetupHook
+      lib, callPackage, mitm-cache, substituteAll, symlinkJoin, concatTextFile, makeSetupHook, nix-update-script
     }:
     gradle-unwrapped:
+    updateAttrPath:
     lib.makeOverridable (args:
     let
       gradle = gradle-unwrapped.override args;
@@ -226,8 +227,13 @@ rec {
 
       passthru = {
         fetchDeps = callPackage ./fetch-deps.nix { inherit mitm-cache; };
-        inherit (gradle) jdk;
+        inherit (gradle) jdk tests;
         unwrapped = gradle;
+      } // lib.optionalAttrs (updateAttrPath != null) {
+        updateScript = nix-update-script {
+          attrPath = updateAttrPath;
+          extraArgs = [ "--url=https://github.com/gradle/gradle" ];
+        };
       };
 
       meta = gradle.meta // {
diff --git a/pkgs/development/tools/gqlgenc/default.nix b/pkgs/development/tools/gqlgenc/default.nix
index ef0fd7c3c8ab..e737adb02656 100644
--- a/pkgs/development/tools/gqlgenc/default.nix
+++ b/pkgs/development/tools/gqlgenc/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gqlgenc";
-  version = "0.25.2";
+  version = "0.25.3";
 
   src = fetchFromGitHub {
     owner = "yamashou";
     repo = "gqlgenc";
     rev = "v${version}";
-    sha256 = "sha256-g+l493Nt0SuW4gwJh0s9Zeejpyx2oLxVDykIvBup638=";
+    sha256 = "sha256-sIXPd/+BVaywAAt2myNOBaAjy/eTY6C8TdSuOoikr0E=";
   };
 
   excludedPackages = [ "example" ];
diff --git a/pkgs/development/tools/hcloud/default.nix b/pkgs/development/tools/hcloud/default.nix
index d2d74ab52edf..75baa0d446e1 100644
--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "hcloud";
-  version = "1.47.0";
+  version = "1.48.0";
 
   src = fetchFromGitHub {
     owner = "hetznercloud";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bIrkX/udxkHA+DWQ1t7QkHOmEhqacdtVR9wBWaS820M=";
+    hash = "sha256-fD+aEt3jakfdrh68Ok0SiehOy3Sg+B+3HUGO8gSSxTQ=";
   };
 
-  vendorHash = "sha256-fNcyIP6q54A+TlsN0xliQGONx7H20KNY+d0NxOUSxQc=";
+  vendorHash = "sha256-QO7K7nwFIYyJ5wGwuACWxzVf8mSX7JMsrbWqm6g5RCs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/nagelfar/default.nix b/pkgs/development/tools/nagelfar/default.nix
index a40861e0988d..3e379875c4c5 100644
--- a/pkgs/development/tools/nagelfar/default.nix
+++ b/pkgs/development/tools/nagelfar/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchzip, tcl, tcllib, tk, }:
+{ lib, fetchzip, tcl, tclPackages, tk, }:
 
 tcl.mkTclDerivation {
   pname = "nagelfar";
@@ -11,7 +11,7 @@ tcl.mkTclDerivation {
 
   buildInputs = [
     tcl
-    tcllib
+    tclPackages.tcllib
     tk
   ];
 
diff --git a/pkgs/games/tcl2048/default.nix b/pkgs/games/tcl2048/default.nix
index c28c25958038..1435e1ed76e4 100644
--- a/pkgs/games/tcl2048/default.nix
+++ b/pkgs/games/tcl2048/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, tcl, tcllib, runtimeShell }:
+{ lib, fetchurl, tcl, tclPackages, runtimeShell }:
 
 tcl.mkTclDerivation rec {
   pname = "tcl2048";
@@ -9,7 +9,7 @@ tcl.mkTclDerivation rec {
     sha256 = "53f5503efd7f029b2614b0f9b1e3aac6c0342735a3c9b811d74a5135fee3e89e";
   };
 
-  buildInputs = [ tcllib ];
+  buildInputs = [ tclPackages.tcllib ];
   dontUnpack = true;
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index a3144cf6bc39..56adc98c928b 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -69,11 +69,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "550.40.76";
+    version = "550.40.79";
     persistencedVersion = "550.54.14";
     settingsVersion = "550.54.14";
-    sha256_64bit = "sha256-dgeK0gIOrCvt7Au8sihBVjNwqAIhBjLK/X1q5hG5F8k=";
-    openSha256 = "sha256-VU0awnFnFbM7MUcKiHCQ+fHhnrL/kZom4ymRX3qeuKk=";
+    sha256_64bit = "sha256-t/i/MeAkw03evuil0lbQnDiOVQmc8xAZqGo5P+BnUt8=";
+    openSha256 = "sha256-mWoI6j/OqAPrGrw6QwdOT9kFPzg3PSNSZW5JDlRTB+s=";
     settingsSha256 = "sha256-m2rNASJp0i0Ez2OuqL+JpgEF0Yd8sYVCyrOoo/ln2a4=";
     persistencedSha256 = "sha256-XaPN8jVTjdag9frLPgBtqvO/goB5zxeGzaTU0CdL6C4=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
diff --git a/pkgs/servers/coturn/default.nix b/pkgs/servers/coturn/default.nix
index 061ea520731b..4014d566068e 100644
--- a/pkgs/servers/coturn/default.nix
+++ b/pkgs/servers/coturn/default.nix
@@ -37,6 +37,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./pure-configure.patch
+
+    # Don't call setgroups unconditionally in mainrelay
+    # https://github.com/coturn/coturn/pull/1508
+    ./dont-call-setgroups-unconditionally.patch
   ];
 
   # Workaround build failure on -fno-common toolchains like upstream
diff --git a/pkgs/servers/coturn/dont-call-setgroups-unconditionally.patch b/pkgs/servers/coturn/dont-call-setgroups-unconditionally.patch
new file mode 100644
index 000000000000..6b7780cbee84
--- /dev/null
+++ b/pkgs/servers/coturn/dont-call-setgroups-unconditionally.patch
@@ -0,0 +1,46 @@
+From 1b5da9c7c5423eed7a567a02e66c244705116724 Mon Sep 17 00:00:00 2001
+From: networkException <git@nwex.de>
+Date: Thu, 30 May 2024 02:07:04 +0200
+Subject: [PATCH] Don't call `setgroups` unconditionally in mainrelay
+
+This patch moves the call to `setgroups` from the beginning of the
+`drop_priviliges` function to branch in which `setuid` is actually
+called. This still fulfills the intention of
+acbf7e15c9290e0891a6b6b5ce6e81bbaa77ce5a, initially introducting
+the call to `setgroups`:
+
+> Fix related to POS36-C and rpmlint error
+> "missing-call-to-setgroups-before-setuid".
+
+As per this intention is is not required to call `setgroups`
+otherwise, reducing the more exotic (as in not part of POSIX and
+considered priviliged by systemd) system calls coturn needs to make
+at startup.
+---
+ src/apps/relay/mainrelay.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/apps/relay/mainrelay.c b/src/apps/relay/mainrelay.c
+index cf370ec8a..56eaf82d0 100644
+--- a/src/apps/relay/mainrelay.c
++++ b/src/apps/relay/mainrelay.c
+@@ -2913,7 +2913,6 @@ static void drop_privileges(void) {
+ #if defined(WINDOWS)
+   // TODO: implement it!!!
+ #else
+-  setgroups(0, NULL);
+   if (procgroupid_set) {
+     if (getgid() != procgroupid) {
+       if (setgid(procgroupid) != 0) {
+@@ -2929,6 +2928,11 @@ static void drop_privileges(void) {
+ 
+   if (procuserid_set) {
+     if (procuserid != getuid()) {
++      if (setgroups(0, NULL) != 0) {
++        perror("setgroups: Unable drop supplementary groups");
++        exit(-1);
++      }
++
+       if (setuid(procuserid) != 0) {
+         perror("setuid: Unable to change user privileges");
+         exit(-1);
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 8fe00f2433a4..c6a244127429 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2024.10.3";
+  version = "2024.10.4";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
@@ -4958,7 +4958,8 @@
       xmltodict
     ];
     "zeversolar" = ps: with ps; [
-    ]; # missing inputs: zeversolar
+      zeversolar
+    ];
     "zha" = ps: with ps; [
       aiohasupervisor
       pillow
@@ -5878,6 +5879,7 @@
     "zamg"
     "zeroconf"
     "zerproc"
+    "zeversolar"
     "zha"
     "zodiac"
     "zone"
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index d0bc0fbc8b08..feed5887e4be 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -100,16 +100,6 @@ let
         ];
       });
 
-      geojson = super.geojson.overridePythonAttrs (oldAttrs: rec {
-        version = "2.5.0";
-        src = fetchFromGitHub {
-          inherit (oldAttrs.src) owner repo;
-          rev = "refs/tags/${version}";
-          hash = "sha256-AcImffYki1gnIaZp/1eacNjdDgjn6qinPJXq9jYtoRg=";
-        };
-        doCheck = false;
-      });
-
       gspread = super.gspread.overridePythonAttrs (oldAttrs: rec {
         version = "5.12.4";
         src = fetchFromGitHub {
@@ -181,15 +171,6 @@ let
         };
       });
 
-      pyasn1 = super.pyasn1.overridePythonAttrs (oldAttrs: rec {
-        version = "0.4.8";
-        src = fetchPypi {
-          inherit (oldAttrs) pname;
-          inherit version;
-          hash = "sha256-rvd8n7lKOsWI6HhBIIvexGRHHZhxvVBQoofMmkdc0Lo=";
-        };
-      });
-
       # Pinned due to API changes >0.3.5.3
       pyatag = super.pyatag.overridePythonAttrs (oldAttrs: rec {
         version = "0.3.5.3";
@@ -340,6 +321,7 @@ let
         doCheck = false; # Tests changed a lot for > 3
       });
 
+      # pinned for sigstore
       tuf = super.tuf.overridePythonAttrs rec {
         version = "2.1.0";
         src = fetchFromGitHub {
@@ -425,7 +407,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2024.10.3";
+  hassVersion = "2024.10.4";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -443,13 +425,13 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-kxxa7FI2wIpE3bEifNyjtEHj7rsuImQvxGd6I46ySqM=";
+    hash = "sha256-uaGGt5qCdyFXuEtg20MzmFd4PXkdPP8h4HJBvRV6sz8=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-DhDdCvov5/Yf2MnY2veV8W/lYk3LTDzxYpbAsbjxWcg=";
+    hash = "sha256-al45WS8SIgOM2TqGPIptZU7iNMapYUg+fK2MLh68lxs=";
   };
 
   build-system = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 70c92b8bcec7..bb9cc204bf59 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20241002.3";
+  version = "20241002.4";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-O1Yb5bCaKoS/Owwb0I0bF2neN2YTOnu28ruVA1cnFzk=";
+    hash = "sha256-b1/VrN0r/7rvSCjSn9HugKLaA40yl4AsFugzmCZKzd8=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index 25f33e9fb321..efd82a902f22 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2024.10.2";
+  version = "2024.10.4";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-6aFZiJKPuUdnC3YzSHyJgn2iTHfP8MCwx17I7uxVTNg=";
+    hash = "sha256-MjHqX1OP1mEEypAxZ8Xc+ZWBsfj4yiFG9oItFnf/svk=";
   };
 
   build-system = [
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index 07fc9a00b999..4f1ae7204fad 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -3,27 +3,21 @@
 }:
 
 let
+  getComponentDeps = component: home-assistant.getPackages component home-assistant.python.pkgs;
+
   # some components' tests have additional dependencies
   extraCheckInputs = with home-assistant.python.pkgs; {
-    airzone_cloud = [
-      aioairzone
-    ];
-    androidtv = home-assistant.getPackages "asuswrt" home-assistant.python.pkgs;
-    bluetooth = [
-      pyswitchbot
-    ];
+    axis = getComponentDeps "deconz";
     govee_ble = [
       ibeacon-ble
     ];
+    hassio = getComponentDeps "homeassistant_yellow";
     lovelace = [
       pychromecast
     ];
     matrix = [
       pydantic
     ];
-    mopeka = [
-      pyswitchbot
-    ];
     onboarding = [
       pymetno
       radios
@@ -41,9 +35,6 @@ let
     system_log = [
       isal
     ];
-    tilt_ble = [
-      ibeacon-ble
-    ];
     xiaomi_miio = [
       arrow
     ];
@@ -59,22 +50,6 @@ let
   };
 
   extraDisabledTests = {
-    advantage_air = [
-      # AssertionError: assert 2 == 1 (Expected two calls, got one)
-      "test_binary_sensor_async_setup_entry"
-    ];
-    hassio = [
-      # fails to load the hardware component
-      "test_device_registry_calls"
-    ];
-    husqvarna_automower = [
-      # snapshot mismatch
-      "test_device_diagnostics"
-    ];
-    recorder = [
-      # call not happening, likely due to timezone issues
-      "test_auto_purge"
-    ];
     shell_command = [
       # tries to retrieve file from github
       "test_non_text_stdout_capture"
@@ -84,16 +59,12 @@ let
       "test_sensor_entities"
     ];
     websocket_api = [
-      # racy
+      # AssertionError: assert 'unknown_error' == 'template_error'
       "test_render_template_with_timeout"
     ];
   };
 
   extraPytestFlagsArray = {
-    cloud = [
-      # Tries to connect to alexa-api.nabucasa.com:443
-      "--deselect tests/components/cloud/test_http_api.py::test_websocket_update_preferences_alexa_report_state"
-    ];
     dnsip = [
       # Tries to resolve DNS entries
       "--deselect tests/components/dnsip/test_config_flow.py::test_options_flow"
@@ -109,10 +80,13 @@ let
       # aioserial mock produces wrong state
       "--deselect tests/components/modem_callerid/test_init.py::test_setup_entry"
     ];
-    velux = [
-      # uses unmocked sockets
-      "--deselect tests/components/velux/test_config_flow.py::test_user_success"
-      "--deselect tests/components/velux/test_config_flow.py::test_import_valid_config"
+    sql = [
+      "-W"
+      "ignore::sqlalchemy.exc.SAWarning"
+    ];
+    vicare = [
+      # Snapshot 'test_all_entities[sensor.model0_electricity_consumption_today-entry]' does not exist!
+      "--deselect=tests/components/vicare/test_sensor.py::test_all_entities"
     ];
   };
 in lib.listToAttrs (map (component: lib.nameValuePair component (
diff --git a/pkgs/servers/http/router/default.nix b/pkgs/servers/http/router/default.nix
index c5a2f7d33c14..40eac67fdb64 100644
--- a/pkgs/servers/http/router/default.nix
+++ b/pkgs/servers/http/router/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "router";
-  version = "1.55.0";
+  version = "1.56.0";
 
   src = fetchFromGitHub {
     owner = "apollographql";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-qnjerjU940Tl/2kmvIMU5K40Qtv3Ukrou6uTuBcwfbQ=";
+    hash = "sha256-4l9nTbtF8hy2x1fdRhmMKcYxTD6wWKXIfihLTWdtm7U=";
   };
 
-  cargoHash = "sha256-gl2UTAljMsjm+TrSjHGEXqJGHdx5PB1Jobm7aNX2nFY=";
+  cargoHash = "sha256-zeMUw/OLPXM1uARrUeva90DLgpD5qFDhVKWgP/c3w7g=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/servers/monitoring/prometheus/nginx-exporter.nix b/pkgs/servers/monitoring/prometheus/nginx-exporter.nix
index 474067622453..6a5c9e0ae8cc 100644
--- a/pkgs/servers/monitoring/prometheus/nginx-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/nginx-exporter.nix
@@ -13,7 +13,14 @@ buildGoModule rec {
 
   vendorHash = "sha256-qmyqAbwQYgUFFQwCLakQGta2XMGCbCOvCB93S8/TWIs=";
 
-  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
+  ldflags = let t = "github.com/prometheus/common/version"; in [
+    "-s"
+    "-w"
+    "-X ${t}.Version=${version}"
+    "-X ${t}.Branch=unknown"
+    "-X ${t}.BuildUser=nix@nixpkgs"
+    "-X ${t}.BuildDate=unknown"
+  ];
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) nginx; };
 
diff --git a/pkgs/tools/admin/procs/default.nix b/pkgs/tools/admin/procs/default.nix
index 4e574e407e2e..f2e543302262 100644
--- a/pkgs/tools/admin/procs/default.nix
+++ b/pkgs/tools/admin/procs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "procs";
-  version = "0.14.6";
+  version = "0.14.7";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = "procs";
     rev = "v${version}";
-    hash = "sha256-Dp0XdARZrDrZ9QOv+V2ZKYV7J89t135ie5LSWz/KKHY=";
+    hash = "sha256-KYKHH41lGKm+En4vUDi6KG6J/zJtYxeJr8vY3WOgkl0=";
   };
 
-  cargoHash = "sha256-EifER0wt2Nw7WrlVwc49tZHH/av4OkzTPYSzl9mVJI8=";
+  cargoHash = "sha256-mGjxXetGgYBBXuaQ3ARS/6wWG5+YdBTmXcy22npPeBY=";
 
   nativeBuildInputs = [ installShellFiles ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ rustPlatform.bindgenHook ];
diff --git a/pkgs/tools/misc/tailspin/default.nix b/pkgs/tools/misc/tailspin/default.nix
index 25aba0ebb95d..51e0c19590c8 100644
--- a/pkgs/tools/misc/tailspin/default.nix
+++ b/pkgs/tools/misc/tailspin/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tailspin";
-  version = "3.0.2";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "bensadeh";
     repo = "tailspin";
     rev = version;
-    hash = "sha256-STQtWLrRS76sowGOBLZqeE8bYcDUjI5ErQD3D7z98M8=";
+    hash = "sha256-5VbxQDK69If5N8EiS8sIKNqHkCAfquOz8nUS7ynp+nA=";
   };
 
-  cargoHash = "sha256-gNyegmr7Iv7dRe/bCwxLbhVkhex0D9ylF5Eulix26tg=";
+  cargoHash = "sha256-ohfza2ti7Ar/9TV/WoTL5g6CPaONrxtr7nW0qmLdB/8=";
 
   meta = with lib; {
     description = "Log file highlighter";
diff --git a/pkgs/tools/misc/watchexec/default.nix b/pkgs/tools/misc/watchexec/default.nix
index 0d04a21219bc..a073ef9473fe 100644
--- a/pkgs/tools/misc/watchexec/default.nix
+++ b/pkgs/tools/misc/watchexec/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "watchexec";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-mH670pBxSQQ4mTtX6O71aRRxRVyz0J7r4227UsUJ5LE=";
+    hash = "sha256-kbcSm1plh5QS87hGQj9OL1rq2eK6jbGn/kfjPF6kNzo=";
   };
 
-  cargoHash = "sha256-cBxFaERUDaOxAYfpvBdJa9LxvrG2niJqVovcZDucbUA=";
+  cargoHash = "sha256-xLUI7B7clpdJQOMDd32ag87yQ99XgbLgPqahPwUHMZQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/networking/subfinder/default.nix b/pkgs/tools/networking/subfinder/default.nix
index 1b4bb71f4ab5..f973d7fae5c5 100644
--- a/pkgs/tools/networking/subfinder/default.nix
+++ b/pkgs/tools/networking/subfinder/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "subfinder";
-  version = "2.6.6";
+  version = "2.6.7";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "subfinder";
     rev = "refs/tags/v${version}";
-    hash = "sha256-A9qSrgQB7AE+9S3SW1eXRGA65RfEzrjYR2XgU8e+zMk=";
+    hash = "sha256-2IO7TyMcKUB2B9agCoIdjybEjr0RLCv+vhXn9e5eL28=";
   };
 
-  vendorHash = "sha256-j2WO+LLvioBB2EU/6ahyTn9H614Dmiskm0p7GOgqYNY=";
+  vendorHash = "sha256-+JOrephdT0k3onbgA3CKLeF8iLWycybwtJxalC0n0Ys=";
 
   modRoot = "./v2";
 
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index 164526a8e133..62cd7cfa7f26 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -30,11 +30,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "tor";
-  version = "0.4.8.12";
+  version = "0.4.8.13";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ynzHNdmON0e1jy88wU+ATdeJ+g+zM6hNy2vXCtu4yHQ=";
+    sha256 = "sha256-m68mw4eiggs5QtpXIUbm63fCvGaGKvYpfNAqB05vuig=";
   };
 
   outputs = [ "out" "geoip" ];
diff --git a/pkgs/tools/security/trustymail/default.nix b/pkgs/tools/security/trustymail/default.nix
index 8c54cbf05047..f032691e3455 100644
--- a/pkgs/tools/security/trustymail/default.nix
+++ b/pkgs/tools/security/trustymail/default.nix
@@ -24,7 +24,7 @@ python3.pkgs.buildPythonApplication rec {
       dnspython
       docopt
       publicsuffixlist
-      pydns
+      py3dns
       pyspf
       requests
     ]
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 77621302690d..fc4495d6d733 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -152,6 +152,7 @@ mapAliases {
 
   inherit (libsForQt5.mauiPackages) buho; # added 2022-05-17
   butler = throw "butler was removed because it was broken and abandoned upstream"; # added 2024-06-18
+  bwidget = tclPackages.bwidget; # Added 2024-10-02
   # Shorter names; keep the longer name for back-compat. Added 2023-04-11
   buildFHSUserEnv = buildFHSEnv;
   buildFHSUserEnvChroot = buildFHSEnvChroot;
@@ -221,6 +222,7 @@ mapAliases {
   concurrencykit = throw "'concurrencykit' has been renamed to/replaced by 'libck'"; # Converted to throw 2024-10-17
   containerpilot = throw "'containerpilot' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2024-06-09
   crackmapexec = throw "'crackmapexec' has been removed as it was unmaintained. Use 'netexec' instead"; # 2024-08-11
+  critcl = tclPackages.critcl; # Added 2024-10-02
   cups-kyodialog3 = cups-kyodialog; # Added 2022-11-12
   cvs_fast_export = throw "'cvs_fast_export' has been renamed to/replaced by 'cvs-fast-export'"; # Converted to throw 2024-10-17
 
@@ -503,6 +505,7 @@ mapAliases {
   imagemagick7 = throw "'imagemagick7' has been renamed to/replaced by 'imagemagick'"; # Converted to throw 2024-10-17
   imagemagick7_light = throw "'imagemagick7_light' has been renamed to/replaced by 'imagemagick_light'"; # Converted to throw 2024-10-17
   immersed-vr = lib.warn "'immersed-vr' has been renamed to 'immersed'" immersed; # Added 2024-08-11
+  incrtcl = tclPackages.incrtcl; # Added 2024-10-02
   input-utils = throw "The input-utils package was dropped since it was unmaintained."; # Added 2024-06-21
   index-fm = libsForQt5.mauiPackages.index; # added 2022-05-17
   inotifyTools = inotify-tools;
@@ -516,6 +519,7 @@ mapAliases {
   isl_0_11 = throw "isl_0_11 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   isl_0_14 = throw "isl_0_14 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   iso-flags-png-320x420 = lib.warn "iso-flags-png-320x420 has been renamed to iso-flags-png-320x240" iso-flags-png-320x240; # Added 2024-07-17
+  itktcl = tclPackages.itktcl; # Added 2024-10-02
 
   ### J ###
 
@@ -768,6 +772,7 @@ mapAliases {
   mpg321 = throw "'mpg321' has been removed due to it being unmaintained by upstream. Consider using mpg123 instead."; # Added 2024-05-10
   msp430NewlibCross = msp430Newlib; # Added 2024-09-06
   mupdf_1_17 = throw "'mupdf_1_17' has been removed due to being outdated and insecure. Consider using 'mupdf' instead."; # Added 2024-08-22
+  mustache-tcl = tclPackages.mustache-tcl; # Added 2024-10-02
   mutt-with-sidebar = mutt; # Added 2022-09-17
   mysql-client = hiPrio mariadb.client;
   mysql = throw "'mysql' has been renamed to/replaced by 'mariadb'"; # Converted to throw 2024-10-17
@@ -893,6 +898,7 @@ mapAliases {
   patchelfStable = patchelf; # Added 2024-01-25
   pcsctools = pcsc-tools; # Added 2023-12-07
   pcsxr = throw "pcsxr was removed as it has been abandoned for over a decade; please use DuckStation, Mednafen, or the RetroArch PCSX ReARMed core"; # Added 2024-08-20
+  pdf4tcl = tclPackages.pdf4tcl; # Added 2024-10-02
   peach = asouldocs; # Added 2022-08-28
   percona-server_innovation = lib.warn "Percona upstream has decided to skip all Innovation releases of MySQL and only release LTS versions." percona-server; # Added 2024-10-13
   percona-server_lts = percona-server; # Added 2024-10-13
@@ -1131,7 +1137,16 @@ mapAliases {
   taplo-cli = taplo; # Added 2022-07-30
   taplo-lsp = taplo; # Added 2022-07-30
   taro = taproot-assets; # Added 2023-07-04
+  tcl-fcgi = tclPackages.tcl-fcgi; # Added 2024-10-02
+  tclcurl = tclPackages.tclcurl; # Added 2024-10-02
+  tcllib = tclPackages.tcllib; # Added 2024-10-02
+  tclmagick = tclPackages.tclmagick; # Added 2024-10-02
+  tcltls = tclPackages.tcltls; # Added 2024-10-02
+  tcludp = tclPackages.tcludp; # Added 2024-10-02
+  tclvfs = tclPackages.tclvfs; # Added 2024-10-02
+  tclx = tclPackages.tclx; # Added 2024-10-02
   tdesktop = telegram-desktop; # Added 2023-04-07
+  tdom = tclPackages.tdom; # Added 2024-10-02
   teck-programmer = throw "teck-programmer was removed because it was broken and unmaintained"; # added 2024-08-23
   teleport_13 = throw "teleport 13 has been removed as it is EOL. Please upgrade to Teleport 14 or later"; # Added 2024-05-26
   teleport_14 = throw "teleport 14 has been removed as it is EOL. Please upgrade to Teleport 15 or later"; # Added 2024-10-18
@@ -1150,7 +1165,9 @@ mapAliases {
   invalidateFetcherByDrvHash = testers.invalidateFetcherByDrvHash; # Added 2022-05-05
   timescale-prometheus = throw "'timescale-prometheus' has been renamed to/replaced by 'promscale'"; # Converted to throw 2024-10-17
   tightvnc = throw "'tightvnc' has been removed as the version 1.3 is not maintained upstream anymore and is insecure"; # Added 2024-08-22
+  tix = tclPackages.tix; # Added 2024-10-02
   tkcvs = tkrev; # Added 2022-03-07
+  tkimg = tclPackages.tkimg; # Added 2024-10-02
   toil = throw "toil was removed as it was broken and requires obsolete versions of libraries"; # Added 2024-09-22
   tokodon = plasma5Packages.tokodon;
   tokyo-night-gtk = tokyonight-gtk-theme; # Added 2024-01-28
@@ -1230,6 +1247,7 @@ mapAliases {
   ### W ###
   wakatime = wakatime-cli; # 2024-05-30
   wal_e = throw "wal_e was removed as it is unmaintained upstream and depends on the removed boto package; upstream recommends using wal-g or pgbackrest"; # Added 2024-09-22
+  wapp = tclPackages.wapp; # Added 2024-10-02
   wayfireApplications-unwrapped = throw ''
     'wayfireApplications-unwrapped.wayfire' has been renamed to/replaced by 'wayfire'
     'wayfireApplications-unwrapped.wayfirePlugins' has been renamed to/replaced by 'wayfirePlugins'
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b7129339017d..d7c329e4a5f1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1430,8 +1430,6 @@ with pkgs;
 
   _3mux = callPackage ../tools/misc/3mux { };
 
-  _1password = callPackage ../applications/misc/1password { };
-
   _1password-gui = callPackage ../applications/misc/1password-gui { };
 
   _1password-gui-beta = callPackage ../applications/misc/1password-gui { channel = "beta"; };
@@ -5872,10 +5870,6 @@ with pkgs;
     callPackage ../tools/misc/steampipe-packages { }
   );
 
-  step-ca = callPackage ../tools/security/step-ca {
-    inherit (darwin.apple_sdk.frameworks) PCSC;
-  };
-
   step-kms-plugin = callPackage ../tools/security/step-kms-plugin { };
 
   string-machine = callPackage ../applications/audio/string-machine { };
@@ -7393,7 +7387,7 @@ with pkgs;
 
   extundelete = callPackage ../tools/filesystems/extundelete { };
 
-  expect = callPackage ../tools/misc/expect { };
+  expect = tclPackages.expect;
 
   expected-lite = callPackage ../development/libraries/expected-lite { };
 
@@ -14047,10 +14041,6 @@ with pkgs;
 
   zip = callPackage ../tools/archivers/zip { };
 
-  zincsearch = callPackage ../servers/search/zincsearch {
-    buildGoModule = buildGo122Module;
-  };
-
   zkfuse = callPackage ../tools/filesystems/zkfuse { };
 
   zpaq = callPackage ../tools/archivers/zpaq { };
@@ -14431,10 +14421,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
 
-  critcl = callPackage ../development/compilers/critcl {
-    tcllib = tcllib.override { withCritcl = false; };
-  };
-
   inherit (darwin.apple_sdk_11_0.callPackage ../development/compilers/crystal { })
     crystal_1_2
     crystal_1_7
@@ -16618,7 +16604,10 @@ with pkgs;
   tcl-8_6 = callPackage ../development/interpreters/tcl/8.6.nix { };
   tcl-9_0 = callPackage ../development/interpreters/tcl/9.0.nix { };
 
-  tclreadline = callPackage ../development/interpreters/tclreadline { };
+  # We don't need versioned package sets thanks to the tcl stubs mechanism
+  tclPackages = recurseIntoAttrs (callPackage ./tcl-packages.nix {});
+
+  tclreadline = tclPackages.tclreadline;
 
   eltclsh = callPackage ../development/tools/eltclsh { };
 
@@ -16706,7 +16695,7 @@ with pkgs;
 
   asdf-vm = callPackage ../tools/misc/asdf-vm { };
 
-  mise = callPackage ../tools/misc/mise {
+  mise = callPackage ../by-name/mi/mise/package.nix {
     inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
@@ -17676,10 +17665,10 @@ with pkgs;
   gradle_8-unwrapped = callPackage gradle-packages.gradle_8 { };
   gradle-unwrapped = gradle_8-unwrapped;
 
-  gradle_6 = wrapGradle gradle_6-unwrapped;
-  gradle_7 = wrapGradle gradle_7-unwrapped;
-  gradle_8 = wrapGradle gradle_8-unwrapped;
-  gradle = wrapGradle gradle-unwrapped;
+  gradle_6 = wrapGradle gradle_6-unwrapped null;
+  gradle_7 = wrapGradle gradle_7-unwrapped null;
+  gradle_8 = wrapGradle gradle_8-unwrapped null;
+  gradle = wrapGradle gradle-unwrapped "gradle-unwrapped";
 
   gperf = callPackage ../development/tools/misc/gperf { };
   # 3.1 changed some parameters from int to size_t, leading to mismatches.
@@ -18370,7 +18359,7 @@ with pkgs;
 
   slimerjs = callPackage ../development/tools/slimerjs { };
 
-  slint-lsp = callPackage ../development/tools/misc/slint-lsp {
+  slint-lsp = callPackage ../by-name/sl/slint-lsp/package.nix {
     inherit (darwin.apple_sdk_11_0.frameworks) AppKit CoreGraphics CoreServices CoreText Foundation OpenGL;
   };
 
@@ -18992,8 +18981,6 @@ with pkgs;
 
   bulletml = callPackage ../development/libraries/bulletml { };
 
-  bwidget = callPackage ../development/libraries/bwidget { };
-
   bzrtp = callPackage ../development/libraries/bzrtp { };
 
   c-ares = callPackage ../development/libraries/c-ares { };
@@ -20266,9 +20253,6 @@ with pkgs;
 
   ijs = callPackage ../development/libraries/ijs { };
 
-  itktcl  = callPackage ../development/libraries/itktcl { };
-  incrtcl = callPackage ../development/libraries/incrtcl { };
-
   indicator-application-gtk2 = callPackage ../development/libraries/indicator-application/gtk2.nix { };
   indicator-application-gtk3 = callPackage ../development/libraries/indicator-application/gtk3.nix { };
 
@@ -23233,14 +23217,6 @@ with pkgs;
 
   tclap_1_4 = callPackage ../development/libraries/tclap/1.4.nix { };
 
-  tcllib = callPackage ../development/libraries/tcllib { };
-
-  tcltls = callPackage ../development/libraries/tcltls { };
-
-  tclx = callPackage ../development/libraries/tclx { };
-
-  tcl-fcgi = callPackage ../development/libraries/tcl-fcgi { };
-
   tdb = callPackage ../development/libraries/tdb { };
 
   tdlib = callPackage ../development/libraries/tdlib { };
@@ -23289,16 +23265,12 @@ with pkgs;
 
   tivodecode = callPackage ../applications/video/tivodecode { };
 
-  tix = callPackage ../development/libraries/tix { };
-
   tk = tk-8_6;
 
   tk-9_0 = callPackage ../development/libraries/tk/9.0.nix { tcl = tcl-9_0; };
   tk-8_6 = callPackage ../development/libraries/tk/8.6.nix { };
   tk-8_5 = callPackage ../development/libraries/tk/8.5.nix { tcl = tcl-8_5; };
 
-  tkimg = callPackage ../development/libraries/tkimg { };
-
   tkrzw = callPackage ../development/libraries/tkrzw { };
 
   tl-expected = callPackage ../development/libraries/tl-expected { };
@@ -23311,8 +23283,6 @@ with pkgs;
 
   kyotocabinet = callPackage ../development/libraries/kyotocabinet { };
 
-  tomlplusplus = callPackage ../development/libraries/tomlplusplus { };
-
   tokyocabinet = callPackage ../development/libraries/tokyo-cabinet { };
 
   tokyotyrant = callPackage ../development/libraries/tokyo-tyrant { };
@@ -23467,8 +23437,6 @@ with pkgs;
 
   wangle = darwin.apple_sdk_11_0.callPackage ../development/libraries/wangle { };
 
-  wapp = callPackage ../development/libraries/wapp { };
-
   wavpack = callPackage ../development/libraries/wavpack { };
 
   wayland = darwin.apple_sdk_11_0.callPackage ../development/libraries/wayland { };
@@ -24954,7 +24922,6 @@ with pkgs;
   liquibase_redshift_extension = callPackage ../development/java-modules/liquibase_redshift_extension { };
 
   prom2json = callPackage ../servers/monitoring/prometheus/prom2json.nix { };
-  prometheus = callPackage ../servers/monitoring/prometheus { };
   prometheus-alertmanager = callPackage ../servers/monitoring/prometheus/alertmanager.nix { };
   prometheus-apcupsd-exporter = callPackage ../servers/monitoring/prometheus/apcupsd-exporter.nix { };
   prometheus-artifactory-exporter = callPackage ../servers/monitoring/prometheus/artifactory-exporter.nix { };
@@ -27363,8 +27330,6 @@ with pkgs;
 
   mustache-spec = callPackage ../data/documentation/mustache-spec { };
 
-  mustache-tcl = callPackage ../development/libraries/mustache-tcl { };
-
   mustache-go = callPackage ../development/tools/mustache-go { };
 
   mustache-hpp = callPackage ../development/libraries/mustache-hpp { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 281c9b2b526f..b981f3b9b497 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -24097,9 +24097,9 @@ with self; {
       hash = "sha256-+DhYd6Sp7Z89OQPS0PfNcPrDzmgyxg9gCmghzuP7WHI=";
     };
     propagatedBuildInputs = [
-      pkgs.bwidget
+      pkgs.tclPackages.bwidget
       pkgs.tcl
-      pkgs.tix
+      pkgs.tclPackages.tix
       pkgs.tk
     ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
       darwin.apple_sdk.frameworks.CoreServices ];
diff --git a/pkgs/top-level/pkg-config/pkg-config-data.json b/pkgs/top-level/pkg-config/pkg-config-data.json
index 96561fc7b7da..4c2286a47e90 100644
--- a/pkgs/top-level/pkg-config/pkg-config-data.json
+++ b/pkgs/top-level/pkg-config/pkg-config-data.json
@@ -824,7 +824,7 @@
     },
     "wayland-scanner": {
       "attrPath": [
-        "wayland"
+        "wayland-scanner"
       ]
     },
     "wayland-server": {
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index b391e52210d2..6255cdb9559e 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -440,6 +440,7 @@ mapAliases ({
   pyblake2 = throw "pyblake2 is deprecated in favor of hashlib"; # added 2023-04-23
   pyblock = throw "pyblock has been removed, since it is abandoned and broken"; # added 2023-06-20
   pycontracts = throw "pycontracts has been removed, since upstream is no longer active and it is broken on modern Python versions."; # added 2024-08-09
+  pydns = py3dns; # added 2024-10-25
   pydrive = throw "pydrive is broken and deprecated and has been replaced with pydrive2."; # added 2022-06-01
   pyjet = throw "pyjet is deprecated, use fastjet instead"; # added 2023-05-10
   pygame_sdl2 = pygame-sdl2; # added 2024-01-07
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 03fdaf30fed7..2f111436d65d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11236,7 +11236,7 @@ self: super: with self; {
 
   pydmd = callPackage ../development/python-modules/pydmd { };
 
-  pydns = callPackage ../development/python-modules/py3dns { };
+  py3dns = callPackage ../development/python-modules/py3dns { };
 
   pydocstyle = callPackage ../development/python-modules/pydocstyle { };
 
@@ -13685,6 +13685,8 @@ self: super: with self; {
 
   retry-decorator = callPackage ../development/python-modules/retry-decorator { };
 
+  retry2 = callPackage ../development/python-modules/retry2 { };
+
   retrying = callPackage ../development/python-modules/retrying { };
 
   returns = callPackage ../development/python-modules/returns { };
@@ -17947,6 +17949,8 @@ self: super: with self; {
 
   zetup = callPackage ../development/python-modules/zetup { };
 
+  zeversolar = callPackage ../development/python-modules/zeversolar { };
+
   zeversolarlocal = callPackage ../development/python-modules/zeversolarlocal { };
 
   zfec = callPackage ../development/python-modules/zfec { };
diff --git a/pkgs/top-level/tcl-packages.nix b/pkgs/top-level/tcl-packages.nix
new file mode 100644
index 000000000000..6be1844b4c36
--- /dev/null
+++ b/pkgs/top-level/tcl-packages.nix
@@ -0,0 +1,21 @@
+let
+  autoCalledPackages = import ./by-name-overlay.nix ../development/tcl-modules/by-name;
+in
+
+{
+  lib,
+  newScope,
+  tcl,
+  tk,
+}:
+
+lib.makeScope newScope (
+  lib.extends autoCalledPackages (self: {
+    inherit tcl tk;
+    inherit (tcl) mkTclDerivation tclPackageHook;
+
+    critcl = self.callPackage ../development/tcl-modules/critcl {
+      tcllib = self.tcllib.override { withCritcl = false; };
+    };
+  })
+)