diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 40b7cedf55bc..dd9b75ff8584 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21177,6 +21177,12 @@
     githubId = 16036882;
     name = "Thibault Gagnaux";
   };
+  tri-ler = {
+    github = "tri-ler";
+    githubId = 47867303;
+    email = "tylerh689@gmail.com";
+    name = "Tyler Hong";
+  };
   trino = {
     email = "muehlhans.hubert@ekodia.de";
     github = "hmuehlhans";
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 48a5050e35fa..3030eca8be26 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -98,6 +98,10 @@
 - [chromadb](https://www.trychroma.com/), an open-source AI application
   database. Batteries included. Available as [services.chromadb](options.html#opt-services.chromadb.enable).
 
+- [Wakapi](https://wakapi.dev/), a time tracking software for programmers. Available as [services.wakapi](#opt-services.wakapi.enable).
+
+- [foot](https://codeberg.org/dnkl/foot), a fast, lightweight and minimalistic Wayland terminal emulator. Available as [programs.foot](#opt-programs.foot.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:
@@ -405,10 +409,8 @@
 
 - The hooks `yarnConfigHook` and `yarnBuildHook` were added. These should replace `yarn2nix.mkYarnPackage` and other `yarn2nix` related tools. The motivation to get rid of `yarn2nix` tools is the fact that they are too complex and hard to maintain, and they rely upon too much Nix evaluation which is problematic if import-from-derivation is not allowed (see more details at [#296856](https://github.com/NixOS/nixpkgs/issues/296856). The transition from `mkYarnPackage` to `yarn{Config,Build}Hook` is tracked at [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
 
-- Cinnamon has been updated to 6.2.
-  - Following Mint 22 defaults, the Cinnamon module no longer ships geary and hexchat by default.
-  - Nemo is now built with gtk-layer-shell support, note that for now it will be expected to see nemo-desktop
-    listed as a regular entry in Cinnamon Wayland session's window list applet.
+- Cinnamon has been updated to 6.2, please check [upstream announcement](https://www.linuxmint.com/rel_wilma_whatsnew.php) for more details.
+  Following Mint 22 defaults, the Cinnamon module no longer ships geary and hexchat by default.
 
 - The `shadowstack` hardening flag has been added, though disabled by default.
 
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
index 4a00c52916f6..60df3987b4c0 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
@@ -63,7 +63,7 @@ with lib;
     # Firefox for reading the manual.
     firefox
 
-    glxinfo
+    mesa-demos
   ];
 
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d66a7d6b9737..a34a890c14ae 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -193,6 +193,7 @@
   ./programs/fish.nix
   ./programs/flashrom.nix
   ./programs/flexoptix-app.nix
+  ./programs/foot
   ./programs/freetds.nix
   ./programs/fuse.nix
   ./programs/fzf.nix
@@ -1491,6 +1492,7 @@
   ./services/web-apps/trilium.nix
   ./services/web-apps/tt-rss.nix
   ./services/web-apps/vikunja.nix
+  ./services/web-apps/wakapi.nix
   ./services/web-apps/weblate.nix
   ./services/web-apps/whitebophir.nix
   ./services/web-apps/wiki-js.nix
diff --git a/nixos/modules/profiles/graphical.nix b/nixos/modules/profiles/graphical.nix
index 72b865c584f0..ae8b0895a5ac 100644
--- a/nixos/modules/profiles/graphical.nix
+++ b/nixos/modules/profiles/graphical.nix
@@ -17,5 +17,5 @@
   # Enable sound in virtualbox appliances.
   hardware.pulseaudio.enable = true;
 
-  environment.systemPackages = [ pkgs.glxinfo pkgs.firefox ];
+  environment.systemPackages = [ pkgs.mesa-demos pkgs.firefox ];
 }
diff --git a/nixos/modules/programs/foot/bashrc b/nixos/modules/programs/foot/bashrc
new file mode 100644
index 000000000000..126f54721259
--- /dev/null
+++ b/nixos/modules/programs/foot/bashrc
@@ -0,0 +1,27 @@
+osc7_cwd() {
+    local strlen=${#PWD}
+    local encoded=""
+    local pos c o
+    for (( pos=0; pos<strlen; pos++ )); do
+        c=${PWD:$pos:1}
+        case "$c" in
+            [-/:_.!\'\(\)~[:alnum:]] ) o="${c}" ;;
+            * ) printf -v o '%%%02X' "'${c}" ;;
+        esac
+        encoded+="${o}"
+    done
+    printf '\e]7;file://%s%s\e\\' "${HOSTNAME}" "${encoded}"
+}
+PROMPT_COMMAND=${PROMPT_COMMAND:+$PROMPT_COMMAND; }osc7_cwd
+
+prompt_marker() {
+    printf '\e]133;A\e\\'
+}
+PROMPT_COMMAND=${PROMPT_COMMAND:+$PROMPT_COMMAND; }prompt_marker
+
+PS0+='\e]133;C\e\\'
+
+command_done() {
+    printf '\e]133;D\e\\'
+}
+PROMPT_COMMAND=${PROMPT_COMMAND:+$PROMPT_COMMAND; }command_done
diff --git a/nixos/modules/programs/foot/config.fish b/nixos/modules/programs/foot/config.fish
new file mode 100644
index 000000000000..c7d45211327f
--- /dev/null
+++ b/nixos/modules/programs/foot/config.fish
@@ -0,0 +1,20 @@
+function update_cwd_osc --on-variable PWD --description 'Notify terminals when $PWD changes'
+    if status --is-command-substitution || set -q INSIDE_EMACS
+        return
+    end
+    printf \e\]7\;file://%s%s\e\\ $hostname (string escape --style=url $PWD)
+end
+
+update_cwd_osc # Run once since we might have inherited PWD from a parent shell
+
+function mark_prompt_start --on-event fish_prompt
+    echo -en "\e]133;A\e\\"
+end
+
+function foot_cmd_start --on-event fish_preexec
+  echo -en "\e]133;C\e\\"
+end
+
+function foot_cmd_end --on-event fish_postexec
+  echo -en "\e]133;D\e\\"
+end
diff --git a/nixos/modules/programs/foot/default.nix b/nixos/modules/programs/foot/default.nix
new file mode 100644
index 000000000000..1492d6c1cc53
--- /dev/null
+++ b/nixos/modules/programs/foot/default.nix
@@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.foot;
+
+  settingsFormat = pkgs.formats.ini {
+    listsAsDuplicateKeys = true;
+    mkKeyValue =
+      with lib.generators;
+      mkKeyValueDefault {
+        mkValueString =
+          v:
+          mkValueStringDefault { } (
+            if v == true then
+              "yes"
+            else if v == false then
+              "no"
+            else if v == null then
+              "none"
+            else
+              v
+          );
+      } "=";
+  };
+in
+{
+  options.programs.foot = {
+    enable = lib.mkEnableOption "foot terminal emulator";
+
+    package = lib.mkPackageOption pkgs "foot" { };
+
+    settings = lib.mkOption {
+      inherit (settingsFormat) type;
+      default = { };
+      description = ''
+        Configuration for foot terminal emulator. Further information can be found in {command}`man 5 foot.ini`.
+
+        Global configuration has to be written under the [main] section.
+      '';
+      example = {
+        main.font = "FreeMono:size=12";
+        scrollback.lines = 100000;
+      };
+    };
+
+    theme = lib.mkOption {
+      type = with lib.types; nullOr str;
+      default = null;
+      description = ''
+        Theme name. Check <https://codeberg.org/dnkl/foot/src/branch/master/themes> for available themes.
+      '';
+      example = "aeroroot";
+    };
+
+    enableBashIntegration = lib.mkEnableOption "foot bash integration" // {
+      default = true;
+    };
+
+    enableFishIntegration = lib.mkEnableOption "foot fish integration" // {
+      default = true;
+    };
+
+    enableZshIntegration = lib.mkEnableOption "foot zsh integration" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+      etc."xdg/foot/foot.ini".source = settingsFormat.generate "foot.ini" cfg.settings;
+    };
+    programs = {
+      foot.settings.main.include = lib.optionals (cfg.theme != null) [
+        "${pkgs.foot.themes}/share/foot/themes/${cfg.theme}"
+      ];
+      # https://codeberg.org/dnkl/foot/wiki#user-content-shell-integration
+      bash.interactiveShellInit = lib.mkIf cfg.enableBashIntegration ". ${./bashrc} # enable shell integration for foot terminal";
+      fish.interactiveShellInit = lib.mkIf cfg.enableFishIntegration "source ${./config.fish} # enable shell integration for foot terminal";
+      zsh.interactiveShellInit = lib.mkIf cfg.enableZshIntegration ". ${./zshrc} # enable shell integration for foot terminal";
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ linsui ];
+  };
+}
diff --git a/nixos/modules/programs/foot/zshrc b/nixos/modules/programs/foot/zshrc
new file mode 100644
index 000000000000..a1d652a80ca4
--- /dev/null
+++ b/nixos/modules/programs/foot/zshrc
@@ -0,0 +1,25 @@
+function osc7-pwd() {
+    emulate -L zsh # also sets localoptions for us
+    setopt extendedglob
+    local LC_ALL=C
+    printf '\e]7;file://%s%s\e\' $HOST ${PWD//(#m)([^@-Za-z&-;_~])/%${(l:2::0:)$(([##16]#MATCH))}}
+}
+
+function chpwd-osc7-pwd() {
+    (( ZSH_SUBSHELL )) || osc7-pwd
+}
+add-zsh-hook -Uz chpwd chpwd-osc7-pwd
+
+precmd() {
+    print -Pn "\e]133;A\e\\"
+}
+
+function precmd {
+    if ! builtin zle; then
+        print -n "\e]133;D\e\\"
+    fi
+}
+
+function preexec {
+    print -n "\e]133;C\e\\"
+}
diff --git a/nixos/modules/services/misc/homepage-dashboard.nix b/nixos/modules/services/misc/homepage-dashboard.nix
index 29fda16aa66f..b29a53d2f1cf 100644
--- a/nixos/modules/services/misc/homepage-dashboard.nix
+++ b/nixos/modules/services/misc/homepage-dashboard.nix
@@ -222,6 +222,7 @@ in
 
         environment = {
           HOMEPAGE_CONFIG_DIR = configDir;
+          HOMEPAGE_CACHE_DIR = "/var/cache/homepage-dashboard";
           PORT = toString cfg.listenPort;
           LOG_TARGETS = lib.mkIf managedConfig "stdout";
         };
@@ -231,6 +232,7 @@ in
           DynamicUser = true;
           EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
           StateDirectory = lib.mkIf (!managedConfig) "homepage-dashboard";
+          CacheDirectory = "homepage-dashboard";
           ExecStart = lib.getExe cfg.package;
           Restart = "on-failure";
         };
diff --git a/nixos/modules/services/web-apps/freshrss.nix b/nixos/modules/services/web-apps/freshrss.nix
index 53366e2c891e..9a6556676597 100644
--- a/nixos/modules/services/web-apps/freshrss.nix
+++ b/nixos/modules/services/web-apps/freshrss.nix
@@ -135,6 +135,8 @@ in
       default = "freshrss";
       description = ''
         Name of the nginx virtualhost to use and setup. If null, do not setup any virtualhost.
+        You may need to configure the virtualhost further through services.nginx.virtualHosts.<virtualhost>,
+        for example to enable SSL.
       '';
     };
 
diff --git a/nixos/modules/services/web-apps/wakapi.nix b/nixos/modules/services/web-apps/wakapi.nix
new file mode 100644
index 000000000000..2dbfb6d9b3d5
--- /dev/null
+++ b/nixos/modules/services/web-apps/wakapi.nix
@@ -0,0 +1,164 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.wakapi;
+
+  settingsFormat = pkgs.formats.yaml { };
+  settingsFile = settingsFormat.generate "wakapi-settings" cfg.settings;
+
+  inherit (lib)
+    getExe
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    types
+    mkIf
+    optional
+    mkMerge
+    singleton
+    ;
+in
+{
+  options.services.wakapi = {
+    enable = mkEnableOption "Wakapi";
+    package = mkPackageOption pkgs "wakapi" { };
+
+    settings = mkOption {
+      inherit (settingsFormat) type;
+      default = { };
+      description = ''
+        Settings for Wakapi.
+
+        See [config.default.yml](https://github.com/muety/wakapi/blob/master/config.default.yml) for a list of all possible options.
+      '';
+    };
+
+    passwordSalt = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The password salt to use for Wakapi.
+      '';
+    };
+    passwordSaltFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        The path to a file containing the password salt to use for Wakapi.
+      '';
+    };
+
+    smtpPassword = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The password used for the smtp mailed to used by Wakapi.
+      '';
+    };
+    smtpPasswordFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        The path to a file containing the password for the smtp mailer used by Wakapi.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.wakapi = {
+      description = "Wakapi (self-hosted WakaTime-compatible backend)";
+      wants = [
+        "network-online.target"
+      ] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.service";
+      after = [
+        "network-online.target"
+      ] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.service";
+      wantedBy = [ "multi-user.target" ];
+
+      script = ''
+        exec ${getExe cfg.package} -config ${settingsFile}
+      '';
+
+      serviceConfig = {
+        Environment = mkMerge [
+          (mkIf (cfg.passwordSalt != null) "WAKAPI_PASSWORD_SALT=${cfg.passwordSalt}")
+          (mkIf (cfg.smtpPassword != null) "WAKAPI_MAIL_SMTP_PASS=${cfg.smtpPassword}")
+        ];
+        EnvironmentFile = [
+          (optional (cfg.passwordSaltFile != null) cfg.passwordSaltFile)
+          (optional (cfg.smtpPasswordFile != null) cfg.smtpPasswordFile)
+        ];
+
+        User = config.users.users.wakapi.name;
+        Group = config.users.users.wakapi.group;
+
+        DynamicUser = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        StateDirectoryMode = "0700";
+        Restart = "always";
+      };
+    };
+
+    services.wakapi.settings = {
+      env = lib.mkDefault "production";
+    };
+
+    assertions = [
+      {
+        assertion = cfg.passwordSalt != null || cfg.passwordSaltFile != null;
+        message = "Either `services.wakapi.passwordSalt` or `services.wakapi.passwordSaltFile` must be set.";
+      }
+      {
+        assertion = cfg.passwordSalt != null -> cfg.passwordSaltFile != null;
+        message = "Both `services.wakapi.passwordSalt` `services.wakapi.passwordSaltFile` should not be set at the same time.";
+      }
+      {
+        assertion = cfg.smtpPassword != null -> cfg.smtpPasswordFile != null;
+        message = "Both `services.wakapi.smtpPassword` `services.wakapi.smtpPasswordFile` should not be set at the same time.";
+      }
+    ];
+
+    users = {
+      users.wakapi = {
+        group = "wakapi";
+        createHome = false;
+        isSystemUser = true;
+      };
+      groups.wakapi = { };
+    };
+
+    services.postgresql = mkIf (cfg.settings.db.dialect == "postgres") {
+      enable = true;
+
+      ensureDatabases = singleton cfg.settings.db.name;
+      ensureUsers = singleton {
+        name = cfg.settings.db.user;
+        ensureDBOwnership = true;
+      };
+
+      authentication = ''
+        host ${cfg.settings.db.name} ${cfg.settings.db.user} 127.0.0.1/32 trust
+      '';
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ isabelroses ];
+}
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index 6db0ee7a4e47..d2ba1e54e22e 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -33,6 +33,7 @@ CAN_TOUCH_EFI_VARIABLES = "@canTouchEfiVariables@"
 GRACEFUL = "@graceful@"
 COPY_EXTRA_FILES = "@copyExtraFiles@"
 CHECK_MOUNTPOINTS = "@checkMountpoints@"
+STORE_DIR = "@storeDir@"
 
 @dataclass
 class BootSpec:
@@ -106,7 +107,7 @@ def write_loader_conf(profile: str | None, generation: int, specialisation: str
         if not EDITOR:
             f.write("editor 0\n")
         if REBOOT_FOR_BITLOCKER:
-            f.write("reboot-for-bitlocker yes\n");
+            f.write("reboot-for-bitlocker yes\n")
         f.write(f"console-mode {CONSOLE_MODE}\n")
         f.flush()
         os.fsync(f.fileno())
@@ -150,12 +151,13 @@ def bootspec_from_json(bootspec_json: dict[str, Any]) -> BootSpec:
 def copy_from_file(file: str, dry_run: bool = False) -> str:
     store_file_path = os.path.realpath(file)
     suffix = os.path.basename(store_file_path)
-    store_dir = os.path.basename(os.path.dirname(store_file_path))
-    efi_file_path = f"{NIXOS_DIR}/{store_dir}-{suffix}.efi"
+    store_subdir = os.path.relpath(store_file_path, start=STORE_DIR).split(os.path.sep)[0]
+    efi_file_path = f"{NIXOS_DIR}/{suffix}.efi" if suffix == store_subdir else f"{NIXOS_DIR}/{store_subdir}-{suffix}.efi"
     if not dry_run:
         copy_if_not_exists(store_file_path, f"{BOOT_MOUNT_POINT}{efi_file_path}")
     return efi_file_path
 
+
 def write_entry(profile: str | None, generation: int, specialisation: str | None,
                 machine_id: str, bootspec: BootSpec, current: bool) -> None:
     if specialisation:
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
index bc32b15e52b2..2d5c7cc9caa0 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@@ -28,6 +28,8 @@ let
 
     isExecutable = true;
 
+    inherit (builtins) storeDir;
+
     inherit (pkgs) python3;
 
     systemd = config.systemd.package;
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index ee724a63f67f..17edfb06f670 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -200,7 +200,7 @@ in
       )
     '' + pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isAarch64 ''
       machine.succeed(
-          "grep 'devicetree .*dummy' /boot/loader/entries/nixos-generation-1-specialisation-something.conf"
+          r"grep 'devicetree /EFI/nixos/[a-z0-9]\{32\}.*dummy' /boot/loader/entries/nixos-generation-1-specialisation-something.conf"
       )
     '';
   };
diff --git a/nixos/tests/turbovnc-headless-server.nix b/nixos/tests/turbovnc-headless-server.nix
index e4eff4f07844..c4384a4fc95c 100644
--- a/nixos/tests/turbovnc-headless-server.nix
+++ b/nixos/tests/turbovnc-headless-server.nix
@@ -7,7 +7,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   nodes.machine = { pkgs, ... }: {
 
     environment.systemPackages = with pkgs; [
-      glxinfo
+      mesa-demos
       procps # for `pkill`, `pidof` in the test
       scrot # for screenshotting Xorg
       turbovnc
diff --git a/pkgs/applications/audio/youtube-music/default.nix b/pkgs/applications/audio/youtube-music/default.nix
index 7d639ba3a5cc..59d33a00511b 100644
--- a/pkgs/applications/audio/youtube-music/default.nix
+++ b/pkgs/applications/audio/youtube-music/default.nix
@@ -33,13 +33,13 @@ stdenv.mkDerivation (finalAttrs: {
   ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
 
   postBuild = lib.optionalString stdenv.isDarwin ''
-    cp -R ${electron}/Applications/Electron.app Electron.app
+    cp -R ${electron.dist}/Electron.app Electron.app
     chmod -R u+w Electron.app
   '' + ''
     pnpm build
     ./node_modules/.bin/electron-builder \
       --dir \
-      -c.electronDist=${if stdenv.isDarwin then "." else "${electron}/libexec/electron"} \
+      -c.electronDist=${if stdenv.isDarwin then "." else electron.dist} \
       -c.electronVersion=${electron.version}
   '';
 
diff --git a/pkgs/applications/editors/android-studio/common.nix b/pkgs/applications/editors/android-studio/common.nix
index 09bc0d43212c..758552ce028e 100644
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@@ -13,7 +13,6 @@
 , file
 , fontsConf
 , git
-, glxinfo
 , gnugrep
 , gnused
 , gnutar
@@ -30,6 +29,7 @@
 , libX11
 , libxcb
 , libxkbcommon
+, mesa-demos
 , xcbutilwm
 , xcbutilrenderutil
 , xcbutilkeysyms
@@ -107,7 +107,7 @@ let
 
           # For Android emulator
           file
-          glxinfo
+          mesa-demos
           pciutils
           setxkbmap
 
diff --git a/pkgs/applications/emulators/retroarch/README.md b/pkgs/applications/emulators/retroarch/README.md
new file mode 100644
index 000000000000..74b600e069bd
--- /dev/null
+++ b/pkgs/applications/emulators/retroarch/README.md
@@ -0,0 +1,68 @@
+# RetroArch
+
+This directory includes [RetroArch](https://www.retroarch.com/), [libretro
+cores](https://docs.libretro.com/guides/core-list/) and related packages.
+
+## Adding new cores
+
+The basic steps to add a new core are:
+
+1. Add the core repository to [update_cores.py](./update_cores.py) inside the
+   `CORES` map.
+   - The minimum required parameter is `repo`
+   - If the repository owner is not `libretro`, set `owner` parameter
+   - If the core needs submodules, set `fetch_submodules` parameter to `True`
+   - To pin the core to a specific release, set `rev` parameter
+2. Run `./pkgs/applications/emulators/retroarch/update_cores.py <emulator>` to
+   generate [`hashes.json`](./hashes.json) file
+3. Add your new core to [`cores.nix`](./cores.nix) file, using
+   [`mkLibretroCore`](./mkLibretroCore.nix) function
+   - In general, the attribute name should be the same as the repo name, unless
+   there is a good reason not to
+   - Check the core repo and [Libretro
+   documentation](https://docs.libretro.com/) for the core you're trying to add
+   for instructions on how to build
+   - Also check the examples inside [`cores.nix`](./cores.nix)
+   - If your core is recently released, there is a good chance that you may
+   need to update [`libretro-core-info`](./libretro-core-info.nix) for things
+   to work inside RetroArch
+4. Try to build your core with `nix-build -A libretro.<core>`
+
+## Updating cores
+
+Just run:
+
+```console
+# From the root of your nixpkgs directory
+./pkgs/applications/emulators/retroarch/update_cores.nix
+```
+
+Keep in mind that because of the huge amount of cores that we package here, it
+is recommended to set `GITHUB_TOKEN` to your GitHub's [Personal Access
+Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)
+(PAT), otherwise the update will probably fail due to GitHub's API rate limit.
+
+## Using RetroArch with cores
+
+To create a custom RetroArch derivation with the cores you want (instead of
+using `retroarchFull` that includes all cores), you can use `.override` like
+this:
+
+```nix
+{ pkgs, ... }:
+
+let
+  retroarchWithCores = (pkgs.retroarch.override {
+    cores = with pkgs.libretro; [
+      bsnes
+      mgba
+      quicknes
+    ];
+  });
+in
+{
+  environment.systemPackages = [
+    retroarchWithCores
+  ];
+}
+```
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 4ad76a3d98d9..1442d794e374 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -63,14 +63,14 @@ stdenv.mkDerivation rec {
     runHook preBuild
 
   '' + lib.optionalString stdenv.isDarwin ''
-    cp -R ${electron}/Applications/Electron.app Electron.app
+    cp -R ${electron.dist}/Electron.app Electron.app
     chmod -R u+w Electron.app
     export CSC_IDENTITY_AUTO_DISCOVERY=false
     sed -i "/afterSign/d" electron-builder-linux-mac.json
   '' + ''
     yarn --offline run electron-builder --dir \
-      ${if stdenv.isDarwin then "--config electron-builder-linux-mac.json" else ""} \
-      -c.electronDist=${if stdenv.isDarwin then "." else "${electron}/libexec/electron"} \
+      ${lib.optionalString stdenv.isDarwin "--config electron-builder-linux-mac.json"} \
+      -c.electronDist=${if stdenv.isDarwin then "." else electron.dist} \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
diff --git a/pkgs/applications/misc/corectrl/default.nix b/pkgs/applications/misc/corectrl/default.nix
index efcedf63d2a1..eb0f2359cc29 100644
--- a/pkgs/applications/misc/corectrl/default.nix
+++ b/pkgs/applications/misc/corectrl/default.nix
@@ -6,7 +6,7 @@
 , kauth
 , libdrm
 , hwdata
-, glxinfo
+, mesa-demos
 , polkit
 , procps
 , pugixml
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec{
     karchive
     kauth
     libdrm
-    glxinfo
+    mesa-demos
     polkit
     procps
     pugixml
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec{
     "-DPOLKIT_POLICY_INSTALL_DIR=${placeholder "out"}/share/polkit-1/actions"
   ];
 
-  runtimeDeps = [ hwdata glxinfo vulkan-tools util-linux procps ];
+  runtimeDeps = [ hwdata mesa-demos vulkan-tools util-linux procps ];
   binPath = lib.makeBinPath runtimeDeps;
 
   dontWrapQtApps = true;
diff --git a/pkgs/applications/misc/gpu-viewer/default.nix b/pkgs/applications/misc/gpu-viewer/default.nix
index 71dd7a091e60..24255bccde19 100644
--- a/pkgs/applications/misc/gpu-viewer/default.nix
+++ b/pkgs/applications/misc/gpu-viewer/default.nix
@@ -12,7 +12,7 @@
 , wrapGAppsHook4
 , gdk-pixbuf
 , lsb-release
-, glxinfo
+, mesa-demos
 , vdpauinfo
 , clinfo
 }:
@@ -55,7 +55,7 @@ python3.pkgs.buildPythonApplication rec {
 
   postFixup = ''
     makeWrapper ${python3.interpreter} $out/bin/gpu-viewer \
-      --prefix PATH : "${lib.makeBinPath [ clinfo glxinfo lsb-release vdpauinfo vulkan-tools ]}" \
+      --prefix PATH : "${lib.makeBinPath [ clinfo lsb-release mesa-demos vdpauinfo vulkan-tools ]}" \
       --add-flags "$out/share/gpu-viewer/Files/GPUViewer.py" \
       --prefix PYTHONPATH : "$PYTHONPATH" \
       --chdir "$out/share/gpu-viewer/Files" \
diff --git a/pkgs/applications/misc/kuro/default.nix b/pkgs/applications/misc/kuro/default.nix
index 02911f312122..e0240b38afec 100644
--- a/pkgs/applications/misc/kuro/default.nix
+++ b/pkgs/applications/misc/kuro/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   yarnBuildScript = "electron-builder";
   yarnBuildFlags = [
     "--dir"
-    "-c.electronDist=${electron}/libexec/electron"
+    "-c.electronDist=${electron.dist}"
     "-c.electronVersion=${electron.version}"
   ];
 
diff --git a/pkgs/applications/misc/lutris/default.nix b/pkgs/applications/misc/lutris/default.nix
index 7a85860cac0d..2583663fb6f8 100644
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@@ -39,7 +39,7 @@
 , xrandr
 , pciutils
 , psmisc
-, glxinfo
+, mesa-demos
 , vulkan-tools
 , xboxdrv
 , pulseaudio
@@ -58,7 +58,7 @@ let
     xrandr
     pciutils
     psmisc
-    glxinfo
+    mesa-demos
     vulkan-tools
     xboxdrv
     pulseaudio
diff --git a/pkgs/applications/misc/octoprint/plugins.nix b/pkgs/applications/misc/octoprint/plugins.nix
index 090c4e0e852d..626ed3438a88 100644
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@@ -172,6 +172,46 @@ in
     };
   };
 
+  firmwareupdater = buildPlugin rec {
+    pname = "firmwareupdater";
+    version = "1.14.0";
+
+    src = fetchFromGitHub {
+      owner = "OctoPrint";
+      repo = "OctoPrint-FirmwareUpdater";
+      rev = version;
+      sha256 = "sha256-CUNjM/IJJS/lqccZ2B0mDOzv3k8AgmDreA/X9wNJ7iY=";
+    };
+
+    propagatedBuildInputs = with super; [ pyserial  ];
+
+    meta = with lib; {
+      description = "Printer Firmware Updater";
+      homepage = "https://github.com/OctoPrint/OctoPrint-FirmwareUpdater";
+      license = licenses.agpl3Only;
+      maintainers = with maintainers; [ tri-ler ];
+    };
+  };
+
+  fullscreen = buildPlugin rec {
+    pname = "fullscreen";
+    version = "0.0.6";
+
+    src = fetchFromGitHub {
+      owner = "BillyBlaze";
+      repo = "OctoPrint-FullScreen";
+      rev = version;
+      sha256 = "sha256-Z8twpj+gqgbiWWxNd9I9qflEAln5Obpb3cn34KwSc5A=";
+    };
+
+    meta = with lib; {
+      description = "Open webcam in fullscreen mode";
+      homepage = "https://github.com/BillyBlaze/OctoPrint-FullScreen";
+      license = licenses.agpl3Only;
+      maintainers = with maintainers; [ tri-ler ];
+    };
+  };
+
   gcodeeditor = buildPlugin rec {
     pname = "gcodeeditor";
     version = "0.2.12";
@@ -231,15 +271,102 @@ in
     };
   };
 
+    mqttchambertemperature = buildPlugin rec {
+    pname = "mqttchambertemperature";
+    version = "0.0.3";
+
+    src = fetchFromGitHub {
+      owner = "synman";
+      repo = "OctoPrint-MqttChamberTemperature";
+      rev = version;
+      sha256 = "sha256-CvNpi8HcBBUfCs3X8yflbhe0YCU0kW3u2ADSro/qnuI=";
+    };
+
+    propagatedBuildInputs = with super; [ jsonpath-ng ];
+
+    meta = with lib; {
+      description = "Enables Chamber temperature reporting via subscribing to an MQTT topic";
+      homepage = "https://github.com/synman/OctoPrint-MqttChamberTemperature";
+      license = licenses.wtfpl;
+      maintainers = with maintainers; [ tri-ler ];
+    };
+  };
+
+  navbartemp = buildPlugin rec {
+    pname = "navbartemp";
+    version = "0.15";
+
+    src = fetchFromGitHub {
+      owner = "imrahil";
+      repo = "OctoPrint-NavbarTemp";
+      rev = version;
+      sha256 = "sha256-ZPpTx+AadRffUb53sZbMUbCZa7xYGQW/5si7UB8mnVI=";
+    };
+
+    meta = with lib; {
+      description = "Displays temperatures on navbar";
+      homepage = "https://github.com/imrahil/OctoPrint-NavbarTemp";
+      license = licenses.agpl3Only;
+      maintainers = with maintainers; [ tri-ler ];
+    };
+  };
+
+  obico = buildPlugin rec {
+    pname = "obico";
+    version = "2.5.0";
+
+    src = fetchFromGitHub {
+      owner = "TheSpaghettiDetective";
+      repo = "OctoPrint-Obico";
+      rev = version;
+      sha256 = "sha256-cAUXe/lRTqYuWnrRiNDuDjcayL5yV9/PtTd9oeSC8KA=";
+    };
+
+    propagatedBuildInputs = with super; [
+      backoff
+      sentry-sdk
+      bson
+      distro
+    ];
+
+    meta = with lib; {
+      description = "Monitor Octoprint-connected printers with Obico";
+      homepage = "https://www.obico.io/";
+      license = licenses.agpl3Only;
+      maintainers = with maintainers; [ tri-ler ];
+    };
+  };
+
+  octopod = buildPlugin rec {
+    pname = "octopod";
+    version = "0.3.16";
+
+    src = fetchFromGitHub {
+      owner = "gdombiak";
+      repo = "OctoPrint-OctoPod";
+      rev = version;
+      sha256 = "sha256-9QKC1MsYO3XihOTAijJUv5i20iMSQHOHPfLiYPV5y8s=";
+    };
+
+    propagatedBuildInputs = with super; [ pillow ];
+
+    meta = with lib; {
+      description = "OctoPod extension for OctoPrint";
+      homepage = "https://github.com/gdombiak/OctoPrint-OctoPod";
+      license = licenses.asl20;
+      maintainers = with maintainers; [ tri-ler ];
+    };
+  };
+
   printtimegenius = buildPlugin rec {
     pname = "printtimegenius";
-    version = "2.3.1";
+    version = "2.3.3";
 
     src = fetchFromGitHub {
       owner = "eyal0";
       repo = "OctoPrint-PrintTimeGenius";
       rev = version;
-      sha256 = "sha256-2lxaTcmPBSdfMmViIfLEbeYWfXZpNVAO4i5Z678gWy0=";
+      sha256 = "sha256-hqm8RShCNpsVbrVXquat5VXqcVc7q5tn5+7Ipqmaw4U=";
     };
 
     propagatedBuildInputs = with super; [
@@ -261,6 +388,27 @@ in
     };
   };
 
+  prusaslicerthumbnails = buildPlugin rec {
+    pname = "prusaslicerthumbnails";
+    version = "1.0.7";
+
+    src = fetchFromGitHub {
+      owner = "jneilliii";
+      repo = "OctoPrint-PrusaSlicerThumbnails";
+      rev = version;
+      sha256 = "sha256-waNCTjAZwdBfhHyJCG2La7KTnJ8MDVuX1JLetFB5bS4=";
+    };
+
+    propagatedBuildInputs = with super; [ psutil  ];
+
+    meta = with lib; {
+      description = "Plugin that extracts thumbnails from uploaded gcode files sliced by PrusaSlicer";
+      homepage = "https://github.com/jneilliii/OctoPrint-PrusaSlicerThumbnails";
+      license = licenses.agpl3Only;
+      maintainers = with maintainers; [ tri-ler ];
+    };
+  };
+
   psucontrol = buildPlugin rec {
     pname = "psucontrol";
     version = "1.0.6";
@@ -289,6 +437,27 @@ in
     };
   };
 
+  resource-monitor = buildPlugin rec {
+    pname = "resource-monitor";
+    version = "0.3.16";
+
+    src = fetchFromGitHub {
+      owner = "Renaud11232";
+      repo = "OctoPrint-Resource-Monitor";
+      rev = version;
+      sha256 = "sha256-w1PBxO+Qf7cSSNocu7BiulZE7kesSa+LGV3uJlmd0ao=";
+    };
+
+    propagatedBuildInputs = with super; [ psutil  ];
+
+    meta = with lib; {
+      description = "Plugin to view the current CPU and RAM usage on your system";
+      homepage = "https://github.com/Renaud11232/OctoPrint-Resource-Monitor";
+      license = licenses.mit;
+      maintainers = with maintainers; [ tri-ler ];
+    };
+  };
+
   simpleemergencystop = buildPlugin rec {
     pname = "simpleemergencystop";
     version = "1.0.5";
@@ -367,6 +536,25 @@ in
     };
   };
 
+  timelapsepurger = buildPlugin rec {
+    pname = "firmwareupdater";
+    version = "0.1.4";
+
+    src = fetchFromGitHub {
+      owner = "jneilliii";
+      repo = "OctoPrint-TimelapsePurger";
+      rev = version;
+      sha256 = "sha256-XS4m4KByScGTPfVE4kuRLw829gNE2CdM0RyhRqGGxyw=";
+    };
+
+    meta = with lib; {
+      description = "Automatically deletes timelapses that are older than configured timeframe";
+      homepage = "https://github.com/jneilliii/OctoPrint-TimelapsePurger";
+      license = licenses.agpl3Only;
+      maintainers = with maintainers; [ tri-ler ];
+    };
+  };
+
   titlestatus = buildPlugin rec {
     pname = "titlestatus";
     version = "0.0.5";
diff --git a/pkgs/applications/misc/pgmodeler/default.nix b/pkgs/applications/misc/pgmodeler/default.nix
index c3b5491387cd..7e3de4a18c12 100644
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgmodeler";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "pgmodeler";
     repo = "pgmodeler";
     rev = "v${version}";
-    sha256 = "sha256-LDgRv7Todyy2pnE21Z0O5JQ6mE4ZO3THv6rfEWU66Cc=";
+    sha256 = "sha256-axw0/QFQfnEc2P8tFRtSY5vVUJTqv+kRn68GXdZ5SeQ=";
   };
 
   nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
diff --git a/pkgs/applications/misc/playonlinux/default.nix b/pkgs/applications/misc/playonlinux/default.nix
index 4f12fb470671..92b29ee71736 100644
--- a/pkgs/applications/misc/playonlinux/default.nix
+++ b/pkgs/applications/misc/playonlinux/default.nix
@@ -3,10 +3,10 @@
 , fetchurl
 , cabextract
 , gettext
-, glxinfo
 , gnupg
 , icoutils
 , imagemagick
+, mesa-demos
 , netcat-gnu
 , p7zip
 , python3
@@ -37,10 +37,10 @@ let
     cabextract
     python
     gettext
-    glxinfo
     gnupg
     icoutils
     imagemagick
+    mesa-demos
     netcat-gnu
     p7zip
     unzip
diff --git a/pkgs/applications/misc/whalebird/default.nix b/pkgs/applications/misc/whalebird/default.nix
index 15bd937506ee..e46a1af85c82 100644
--- a/pkgs/applications/misc/whalebird/default.nix
+++ b/pkgs/applications/misc/whalebird/default.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
     yarn run nextron build --no-pack
     yarn run electron-builder --dir \
       --config electron-builder.yml \
-      -c.electronDist="${electron}/libexec/electron" \
+      -c.electronDist="${electron.dist}" \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
diff --git a/pkgs/applications/misc/xca/default.nix b/pkgs/applications/misc/xca/default.nix
index fb0bf3063bbc..2ddb36a87de8 100644
--- a/pkgs/applications/misc/xca/default.nix
+++ b/pkgs/applications/misc/xca/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xca";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "chris2511";
     repo = "xca";
     rev = "RELEASE.${finalAttrs.version}";
-    hash = "sha256-E0Ap+JDK/oYTG+uaRHsdOxyLIywlYJ01T4ANQhNH220=";
+    hash = "sha256-Ty6j0Fl2smMGxp+1nnD3Fu83bn19gqtRKSA1wDgNZes=";
   };
 
   buildInputs = [ openssl qtbase ];
diff --git a/pkgs/applications/networking/cluster/arkade/default.nix b/pkgs/applications/networking/cluster/arkade/default.nix
index 43e1899fe38a..8e576a422d68 100644
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.11.20";
+  version = "0.11.21";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    hash = "sha256-xjJbO+42PUuRb4vMSKscTf2DEDekSwEF/v2QwKeBtvI=";
+    hash = "sha256-vNJQLrpPJJG5FjQ73203V/Ky93HawRWgMiPYHU+eXPM=";
   };
 
   CGO_ENABLED = 0;
diff --git a/pkgs/applications/networking/cluster/tfswitch/default.nix b/pkgs/applications/networking/cluster/tfswitch/default.nix
index 1350ff921a2c..a9994ef144ec 100644
--- a/pkgs/applications/networking/cluster/tfswitch/default.nix
+++ b/pkgs/applications/networking/cluster/tfswitch/default.nix
@@ -1,16 +1,16 @@
 { buildGoModule, lib, fetchFromGitHub }:
 buildGoModule rec {
   pname = "tfswitch";
-  version = "1.0.2";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "warrensbox";
     repo = "terraform-switcher";
-    rev = version;
-    sha256 = "sha256-Gp7+TEE7rmlabZhley/crpYZiqiKcc6uqSr6leZsmgU=";
+    rev = "v${version}";
+    sha256 = "sha256-Ym0ypMfoceOvje1z1oCxjnFrl1oosMFSplM7bhI0KXU=";
   };
 
-  vendorHash = "sha256-DsC9djgt7Er2m2TacUldpJP43jC0IBklPnu41Saf4DY=";
+  vendorHash = "sha256-44A9fF+HIOJrlxpps6GV3yjPBqfpwOhEZ8Ejnp2o/wk=";
 
   # Disable tests since it requires network access and relies on the
   # presence of release.hashicorp.com
diff --git a/pkgs/applications/networking/instant-messengers/armcord/default.nix b/pkgs/applications/networking/instant-messengers/armcord/default.nix
index 469557d67dd3..4d07c850986e 100644
--- a/pkgs/applications/networking/instant-messengers/armcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/armcord/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
     npm exec electron-builder -- \
       --dir \
-      -c.electronDist="${electron_30}/libexec/electron" \
+      -c.electronDist="${electron_30.dist}" \
       -c.electronVersion="${electron_30.version}"
 
     runHook postBuild
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index 8c9b3ab56d95..313d45a98239 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -68,14 +68,14 @@
 
 stdenv.mkDerivation rec {
   pname = "jami";
-  version = "20240813.0";
+  version = "20240823.0";
 
   src = fetchFromGitLab {
     domain = "git.jami.net";
     owner = "savoirfairelinux";
     repo = "jami-client-qt";
     rev = "stable/${version}";
-    hash = "sha256-XRWbV1s87niwNiWf2KRpV+wUH6ptw3vnVXCEwqh2r7M=";
+    hash = "sha256-7jGH54sFiS6qrdEiKSS64lJyJXL1FOJVbesxo/FFmyA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
index 78c6912b12ba..7d0044c7124c 100644
--- a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
@@ -16,8 +16,6 @@
 
 let
   inherit (darwin.apple_sdk.frameworks) Carbon CoreFoundation ApplicationServices OpenGL;
-
-  electronDist = electron + (if stdenv.isDarwin then "/Applications" else "/libexec/electron");
 in
 buildNpmPackage rec {
   pname = "jitsi-meet-electron";
@@ -70,7 +68,7 @@ buildNpmPackage rec {
   '';
 
   postBuild = ''
-    cp -r ${electronDist} electron-dist
+    cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
 
     # npmRebuild is needed because robotjs won't be built on darwin otherwise
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index b5ac402921d2..f0822605627b 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     yarn --offline electron-builder \
       --dir ${if stdenv.isDarwin then "--macos" else "--linux"} ${if stdenv.hostPlatform.isAarch64 then "--arm64" else "--x64"} \
-      -c.electronDist=${electron}/libexec/electron \
+      -c.electronDist=${electron.dist} \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 11e24de45199..88c4066095b9 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -8,6 +8,8 @@ buildGoModule rec {
   pname = "rclone";
   version = "1.67.0";
 
+  outputs = [ "out" "man" ];
+
   src = fetchFromGitHub {
     owner = "rclone";
     repo = "rclone";
@@ -19,15 +21,19 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  outputs = [ "out" "man" ];
+  nativeBuildInputs = [ installShellFiles makeWrapper ];
 
   buildInputs = lib.optional enableCmount (if stdenv.isDarwin then macfuse-stubs else fuse);
-  nativeBuildInputs = [ installShellFiles makeWrapper ];
 
   tags = lib.optionals enableCmount [ "cmount" ];
 
   ldflags = [ "-s" "-w" "-X github.com/rclone/rclone/fs.Version=${version}" ];
 
+  postConfigure = lib.optionalString (!stdenv.isDarwin) ''
+    substituteInPlace vendor/github.com/winfsp/cgofuse/fuse/host_cgo.go \
+        --replace-fail '"libfuse.so.2"' '"${lib.getLib fuse}/lib/libfuse.so.2"'
+  '';
+
   postInstall =
     let
       rcloneBin =
@@ -50,8 +56,7 @@ buildGoModule rec {
       # as the setuid wrapper is required as non-root on NixOS.
       ''
       wrapProgram $out/bin/rclone \
-        --suffix PATH : "${lib.makeBinPath [ fuse3 ] }" \
-        --prefix LD_LIBRARY_PATH : "${fuse3}/lib"
+        --suffix PATH : "${lib.makeBinPath [ fuse3 ] }"
     '';
 
   passthru.tests = {
diff --git a/pkgs/applications/networking/xpipe/default.nix b/pkgs/applications/networking/xpipe/default.nix
index 7a9bc8c6094e..ab7fe6bdb2cf 100644
--- a/pkgs/applications/networking/xpipe/default.nix
+++ b/pkgs/applications/networking/xpipe/default.nix
@@ -33,14 +33,14 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-KLOI0lG0rZbLS2uiONNlgyCkohzQhytRovAfrjnGuDI=";
+    x86_64-linux = "sha256-l67oq9Jj2mmxcLsEMI4t+85cKD65xxMNkTNJrrRrwJQ=";
   }.${system} or throwSystem;
 
   displayname = "XPipe";
 
 in stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "10.2.2";
+  version = "11.0";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";
diff --git a/pkgs/applications/version-management/git-mit/default.nix b/pkgs/applications/version-management/git-mit/default.nix
index 0d6d5a15ef72..9d1ba6f460fa 100644
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.13.22";
+  version = "5.13.28";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-nYKwf0+Ai6GU9CeRKI7NInmkA4yH41tMWoT9S03m0VI=";
+    hash = "sha256-zw1yY/vCrxklmIXGHO5cMOQ9L3xfHD24f2JN7ibF/I8=";
   };
 
-  cargoHash = "sha256-dcTyombQBR0IGkK+2GWedFQf/1a74gVUIqM96xVxlj0=";
+  cargoHash = "sha256-pnSp6XCVSxCY7b1LHeQM9/KsjG6sGQoMCPcL8Bby4A4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/video/davinci-resolve/default.nix b/pkgs/applications/video/davinci-resolve/default.nix
index 574de6f427b1..7bde503bd7ae 100644
--- a/pkgs/applications/video/davinci-resolve/default.nix
+++ b/pkgs/applications/video/davinci-resolve/default.nix
@@ -34,7 +34,7 @@ let
   davinci = (
     stdenv.mkDerivation rec {
       pname = "davinci-resolve${lib.optionalString studioVariant "-studio"}";
-      version = "18.6.6";
+      version = "19.0";
 
       nativeBuildInputs = [
         (appimage-run.override { buildFHSEnv = buildFHSEnvChroot; } )
@@ -55,8 +55,8 @@ let
           outputHashAlgo = "sha256";
           outputHash =
             if studioVariant
-            then "sha256-9iTdIjHH8uoXlVr6miyqmHuzbbpbqdJPEbPGycsccoI="
-            else "sha256-WrIQ1FHm65MOGb5HfFl2WzXYJRlqktuZdrtzcjWp1gI=";
+            then "sha256-KxoUXHMlgWoa00GSq/DLVgyOjuv7k8aUwl20XvDRZvc="
+            else "sha256-XQP5RL/p/voQePLiBr1Hc+dBUZHW39XxDjyxKJyKXxw=";
 
           impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
@@ -94,7 +94,7 @@ let
         } ''
         DOWNLOADID=$(
           curl --silent --compressed "$DOWNLOADSURL" \
-            | jq --raw-output '.downloads[] | select(.name | test("^'"$PRODUCT $VERSION"'( Update)?$")) | .urls.Linux[0].downloadId'
+            | jq --raw-output '.downloads[] | .urls.Linux?[]? | select(.downloadTitle | test("^'"$PRODUCT $VERSION"'( Update)?$")) | .downloadId'
         )
         echo "downloadid is $DOWNLOADID"
         test -n "$DOWNLOADID"
@@ -271,13 +271,13 @@ buildFHSEnv {
         currentVersion=${lib.escapeShellArg davinci.version}
         downloadsJSON="$(curl --fail --silent https://www.blackmagicdesign.com/api/support/us/downloads.json)"
 
-        latestLinuxVersion="$(echo "$downloadsJSON" | jq '[.downloads[] | select(.urls.Linux) | .urls.Linux[] | select(.downloadTitle | test("DaVinci Resolve")) | .downloadTitle]' | grep -oP 'DaVinci Resolve \K\d+\.\d+\.\d+' | sort | tail -n 1)"
+        latestLinuxVersion="$(echo "$downloadsJSON" | jq '[.downloads[] | select(.urls.Linux) | .urls.Linux[] | select(.downloadTitle | test("DaVinci Resolve")) | .downloadTitle]' | grep -oP 'DaVinci Resolve \K\d+\.\d+(\.\d+)?' | sort | tail -n 1)"
         update-source-version davinci-resolve "$latestLinuxVersion" --source-key=davinci.src
 
         # Since the standard and studio both use the same version we need to reset it before updating studio
         sed -i -e "s/""$latestLinuxVersion""/""$currentVersion""/" "$drv"
 
-        latestStudioLinuxVersion="$(echo "$downloadsJSON" | jq '[.downloads[] | select(.urls.Linux) | .urls.Linux[] | select(.downloadTitle | test("DaVinci Resolve")) | .downloadTitle]' | grep -oP 'DaVinci Resolve Studio \K\d+\.\d+\.\d+' | sort | tail -n 1)"
+        latestStudioLinuxVersion="$(echo "$downloadsJSON" | jq '[.downloads[] | select(.urls.Linux) | .urls.Linux[] | select(.downloadTitle | test("DaVinci Resolve")) | .downloadTitle]' | grep -oP 'DaVinci Resolve Studio \K\d+\.\d+(\.\d+)?' | sort | tail -n 1)"
         update-source-version davinci-resolve-studio "$latestStudioLinuxVersion" --source-key=davinci.src
       '';
     });
diff --git a/pkgs/applications/video/kodi/unwrapped.nix b/pkgs/applications/video/kodi/unwrapped.nix
index 661f08c576b6..374837b01b38 100644
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@@ -13,7 +13,7 @@
 , libogg, libvorbis, flac, libxslt
 , lzo, libcdio, libmodplug, libass, libbluray, libudfread
 , sqlite, libmysqlclient, nasm, gnutls, libva, libdrm
-, curl, bzip2, zip, unzip, glxinfo
+, curl, bzip2, zip, unzip, mesa-demos
 , libcec, libcec_platform, dcadec, libuuid
 , libcrossguid, libmicrohttpd
 , bluez, doxygen, giflib, glib, harfbuzz, lcms2, libidn2, libpthreadstubs, libtasn1
@@ -119,7 +119,7 @@ in stdenv.mkDerivation (finalAttrs: {
       libogg libvorbis flac libxslt systemd
       lzo libcdio libmodplug libass libbluray libudfread
       sqlite libmysqlclient avahi lame
-      curl bzip2 zip unzip glxinfo
+      curl bzip2 zip unzip mesa-demos
       libcec libcec_platform dcadec libuuid
       libxcrypt libgcrypt libgpg-error libunistring
       libcrossguid libplist
@@ -229,7 +229,7 @@ in stdenv.mkDerivation (finalAttrs: {
       # TODO: figure out which binaries should be wrapped this way and which shouldn't
       for p in $(ls --ignore=kodi-send $out/bin/) ; do
         wrapProgram $out/bin/$p \
-          --prefix PATH ":" "${lib.makeBinPath ([ python3Packages.python glxinfo ]
+          --prefix PATH ":" "${lib.makeBinPath ([ python3Packages.python mesa-demos ]
             ++ lib.optional x11Support xdpyinfo ++ lib.optional sambaSupport samba)}" \
           --prefix LD_LIBRARY_PATH ":" "${lib.makeLibraryPath
               ([ curl systemd libmad libcec libcec_platform libass ]
diff --git a/pkgs/applications/video/motion/default.nix b/pkgs/applications/video/motion/default.nix
index 95bc37819240..c3082639cae7 100644
--- a/pkgs/applications/video/motion/default.nix
+++ b/pkgs/applications/video/motion/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "motion";
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner  = "Motion-Project";
     repo   = "motion";
     rev    = "release-${version}";
-    sha256 = "sha256-f23glk91HWSEW/Glq/DdEikTQeg1eELEg4XG9zTsU78=";
+    sha256 = "sha256-bGjiO14a7xKRgoeo5JlexXlKggE+agRMmQViBXagmt8=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/applications/virtualization/podman-desktop/default.nix b/pkgs/applications/virtualization/podman-desktop/default.nix
index fdf829401399..015768b4ed7c 100644
--- a/pkgs/applications/virtualization/podman-desktop/default.nix
+++ b/pkgs/applications/virtualization/podman-desktop/default.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     yarn --offline run build
     yarn --offline run electron-builder --dir \
       --config .electron-builder.config.cjs \
-      -c.electronDist=${electron}/libexec/electron \
+      -c.electronDist=${electron.dist} \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index 2ce70a8372cf..c2ce56ae2331 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -120,7 +120,7 @@ in buildNpmPackage rec {
 
     npm exec electron-builder -- \
       --dir \
-      -c.electronDist=${electron}/libexec/electron \
+      -c.electronDist=${electron.dist} \
       -c.electronVersion=${electron.version}
 
     popd
diff --git a/pkgs/by-name/bl/blockbench/package.nix b/pkgs/by-name/bl/blockbench/package.nix
index 2f72c033f10e..a8458255c714 100644
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@@ -10,9 +10,6 @@
   electron,
 }:
 
-let
-  electronDist = "${electron}/${if stdenv.isDarwin then "Applications" else "libexec/electron"}";
-in
 buildNpmPackage rec {
   pname = "blockbench";
   version = "4.10.4";
@@ -45,7 +42,7 @@ buildNpmPackage rec {
 
   postBuild = ''
     # electronDist needs to be modifiable on Darwin
-    cp -r ${electronDist} electron-dist
+    cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
 
     npm exec electron-builder -- \
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 9c2dafc1aeae..e49ed0b4d2c7 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -103,7 +103,7 @@ buildNpmPackage' rec {
     ${
       if stdenv.isDarwin then
         ''
-          cp -r ${electron}/Applications/Electron.app ./
+          cp -r ${electron.dist}/Electron.app ./
           find ./Electron.app -name 'Info.plist' | xargs -d '\n' chmod +rw
 
           substituteInPlace electron-builder-config.js \
@@ -121,7 +121,7 @@ buildNpmPackage' rec {
         ''
           npm exec electron-builder -- \
             --dir \
-            -c.electronDist=${electron}/libexec/electron \
+            -c.electronDist=${electron.dist} \
             -c.electronVersion=${electron.version} \
             -c.npmRebuild=false
         ''
diff --git a/pkgs/by-name/ca/caprine/package.nix b/pkgs/by-name/ca/caprine/package.nix
index 214b304ff577..e6e2106b3809 100644
--- a/pkgs/by-name/ca/caprine/package.nix
+++ b/pkgs/by-name/ca/caprine/package.nix
@@ -8,9 +8,6 @@
   electron,
 }:
 
-let
-  electronDist = electron + (if stdenv.isDarwin then "/Applications" else "/libexec/electron");
-in
 buildNpmPackage rec {
   pname = "caprine";
   version = "2.60.1";
@@ -29,7 +26,7 @@ buildNpmPackage rec {
   nativeBuildInputs = [ copyDesktopItems ];
 
   postBuild = ''
-    cp -r ${electronDist} electron-dist
+    cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
 
     npm exec electron-builder -- \
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index 84007106dcf8..7a784afcd26b 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-FhtgqfPQRUsnyi/qEe0PPtRfJIUa4UaNbvrkPvZpsQk=";
+    hash = "sha256-VV8tqVJq+bsgfdNSxSzo1vqYtYT37D2pBX4HydY6cKs=";
   };
 
-  cargoHash = "sha256-z1jrCUstQk272EEeqcjGhm5b/YaxTFw21F+AbguMdmo=";
+  cargoHash = "sha256-SUvQxW3STsP1VrPJKK2NYbApuoGfbmfUiywZILvcvj4=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index b0c1d682f305..8b4c8d8aac1e 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -79,7 +79,7 @@ buildNpmPackage {
   postBuild =
     lib.optionalString stdenv.isDarwin ''
       # electron-builder appears to build directly on top of Electron.app, by overwriting the files in the bundle.
-      cp -r ${electron}/Applications/Electron.app ./
+      cp -r ${electron.dist}/Electron.app ./
       find ./Electron.app -name 'Info.plist' | xargs -d '\n' chmod +rw
 
       # Disable code signing during build on macOS.
@@ -90,7 +90,7 @@ buildNpmPackage {
     + ''
       npm exec electron-builder -- \
         --dir \
-        -c.electronDist=${if stdenv.isDarwin then "./" else "${electron}/libexec/electron"} \
+        -c.electronDist=${if stdenv.isDarwin then "./" else electron.dist} \
         -c.electronVersion=${electron.version} \
         -c.npmRebuild=false
     '';
diff --git a/pkgs/by-name/fl/flarectl/package.nix b/pkgs/by-name/fl/flarectl/package.nix
index d067f4533cd2..316f24cdf206 100644
--- a/pkgs/by-name/fl/flarectl/package.nix
+++ b/pkgs/by-name/fl/flarectl/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "flarectl";
-  version = "0.102.0";
+  version = "0.103.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflare-go";
     rev = "v${version}";
-    hash = "sha256-i/JWbi8itjcFklknFGB23DtYh4+jd+2YMQysHtS3qf8=";
+    hash = "sha256-mYdZgHJz2Ajrk/JRbaDeghm39PWidnAIZvjJTvl8lpM=";
   };
 
-  vendorHash = "sha256-4tJATAvWpWq1aTtV4ERTHF6S2D0azC3HlrwxkLIGT7s=";
+  vendorHash = "sha256-R3By8/cR4pZQgUSyNGDnnvWwcpZqraqk5GRZ8Om9JOU=";
 
   subPackages = [ "cmd/flarectl" ];
 
diff --git a/pkgs/by-name/go/goofcord/package.nix b/pkgs/by-name/go/goofcord/package.nix
index fe510af719e0..14fe785c499a 100644
--- a/pkgs/by-name/go/goofcord/package.nix
+++ b/pkgs/by-name/go/goofcord/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     npm exec electron-builder -- \
       --dir \
-      -c.electronDist="${electron}/libexec/electron" \
+      -c.electronDist="${electron.dist}" \
       -c.electronVersion="${electron.version}"
 
     runHook postBuild
diff --git a/pkgs/by-name/ko/koodo-reader/package.nix b/pkgs/by-name/ko/koodo-reader/package.nix
index 9fa8ce626b9a..a57c44b0c37f 100644
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@@ -13,9 +13,6 @@
   electron,
 }:
 
-let
-  electronDist = electron + (if stdenv.isDarwin then "/Applications" else "/libexec/electron");
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "koodo-reader";
   version = "1.6.7";
@@ -52,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
 
   postBuild = ''
-    cp -r ${electronDist} electron-dist
+    cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
     yarn --offline run electron-builder --dir \
       -c.electronDist=electron-dist \
@@ -117,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     changelog = "https://github.com/troyeguo/koodo-reader/releases/tag/v${finalAttrs.version}";
-    description = "A cross-platform ebook reader";
+    description = "Cross-platform ebook reader";
     longDescription = ''
       A modern ebook manager and reader with sync and backup capacities
       for Windows, macOS, Linux and Web
diff --git a/pkgs/by-name/lx/lxgw-neoxihei/package.nix b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
index a96569c04bd0..36a502d9855a 100644
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.200";
+  version = "1.201";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-8m+19lJNdg+mBvvHAig8NyZ4AOC2NE3k7rll7u32cuw=";
+    hash = "sha256-2w25Jvbx7u9O0azsvLSX1TxfXANVNdfzjfNALhsxUZI=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/mq/mqtt-explorer/package.nix b/pkgs/by-name/mq/mqtt-explorer/package.nix
index 2b15225fb037..dec432204622 100644
--- a/pkgs/by-name/mq/mqtt-explorer/package.nix
+++ b/pkgs/by-name/mq/mqtt-explorer/package.nix
@@ -12,9 +12,6 @@
   makeDesktopItem,
   copyDesktopItems,
 }:
-let
-  electronDist = electron + (if stdenv.isDarwin then "/Applications" else "/libexec/electron");
-in
 # NOTE mqtt-explorer has 3 yarn subpackages and uses relative links
 # between them, which makes it hard to package them via 3 `mkYarnPackage`
 # since the resulting `node_modules` directories don't have the same structure
@@ -88,7 +85,7 @@ stdenv.mkDerivation rec {
 
     patchShebangs {node_modules,app/node_modules,backend/node_modules}
 
-    cp -r ${electronDist} electron-dist
+    cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
 
     runHook postConfigure
diff --git a/pkgs/by-name/ne/nexusmods-app/package.nix b/pkgs/by-name/ne/nexusmods-app/package.nix
index 875f17e876bb..9d4c3947d97a 100644
--- a/pkgs/by-name/ne/nexusmods-app/package.nix
+++ b/pkgs/by-name/ne/nexusmods-app/package.nix
@@ -10,18 +10,17 @@
   libICE,
   libSM,
   libX11,
-  nexusmods-app,
   runCommand,
   pname ? "nexusmods-app",
 }:
-buildDotnetModule rec {
+buildDotnetModule (finalAttrs: {
   inherit pname;
   version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "Nexus-Mods";
     repo = "NexusMods.App";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-FzQphMhiC1g+6qmk/R1v4rq2ldy35NcaWm0RR1UlwLA=";
   };
@@ -54,10 +53,13 @@ buildDotnetModule rec {
   '';
 
   makeWrapperArgs = [
-    "--prefix PATH : ${lib.makeBinPath [ desktop-file-utils ]}"
-    "--set APPIMAGE ${placeholder "out"}/bin/${meta.mainProgram}" # Make associating with nxm links work on Linux
+    "--prefix PATH : ${lib.makeBinPath finalAttrs.runtimeInputs}"
+    # Make associating with nxm links work on Linux
+    "--set APPIMAGE ${placeholder "out"}/bin/NexusMods.App"
   ];
 
+  runtimeInputs = [ desktop-file-utils ];
+
   runtimeDeps = [
     fontconfig
     libICE
@@ -65,7 +67,7 @@ buildDotnetModule rec {
     libX11
   ];
 
-  executables = [ meta.mainProgram ];
+  executables = [ "NexusMods.App" ];
 
   doCheck = true;
 
@@ -93,15 +95,10 @@ buildDotnetModule rec {
       let
         runTest =
           name: script:
-          runCommand "${pname}-test-${name}"
-            {
-              # TODO: use finalAttrs when buildDotnetModule has support
-              nativeBuildInputs = [ nexusmods-app ];
-            }
-            ''
-              ${script}
-              touch $out
-            '';
+          runCommand "${pname}-test-${name}" { nativeBuildInputs = [ finalAttrs.finalPackage ]; } ''
+            ${script}
+            touch $out
+          '';
       in
       {
         serve = runTest "serve" ''
@@ -123,7 +120,7 @@ buildDotnetModule rec {
   meta = {
     mainProgram = "NexusMods.App";
     homepage = "https://github.com/Nexus-Mods/NexusMods.App";
-    changelog = "https://github.com/Nexus-Mods/NexusMods.App/releases/tag/${src.rev}";
+    changelog = "https://github.com/Nexus-Mods/NexusMods.App/releases/tag/${finalAttrs.src.rev}";
     license = [ lib.licenses.gpl3Plus ];
     maintainers = with lib.maintainers; [
       l0b0
@@ -158,4 +155,4 @@ buildDotnetModule rec {
       }
     '';
   };
-}
+})
diff --git a/pkgs/by-name/no/novops/package.nix b/pkgs/by-name/no/novops/package.nix
index 02f11dc208dd..326b9c3be266 100644
--- a/pkgs/by-name/no/novops/package.nix
+++ b/pkgs/by-name/no/novops/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "novops";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "PierreBeucher";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-b6CM7dDjEzFuL6SZQsFMBOq8p66Jnd7BdXFspWYlTps=";
+    hash = "sha256-Hqm3bKMRUyIZ/wD+kjAhUuKcJdaA8LT7bnourda6nuw=";
   };
 
-  cargoHash = "sha256-mhNEeczbqXVsHoErwEIPUuJqNcyR6dTKBDeHCVH+KsE=";
+  cargoHash = "sha256-ObbCJQw4DgUH1/XuI7ZgqFY9O9OH1uGUkfaQRjcGkAY=";
 
   buildInputs = [
     openssl # required for openssl-sys
diff --git a/pkgs/by-name/pr/prismlauncher/package.nix b/pkgs/by-name/pr/prismlauncher/package.nix
index bb08a19de370..c1425a3099bd 100644
--- a/pkgs/by-name/pr/prismlauncher/package.nix
+++ b/pkgs/by-name/pr/prismlauncher/package.nix
@@ -9,7 +9,7 @@
   gamemode,
   glfw,
   glfw-wayland-minecraft,
-  glxinfo,
+  mesa-demos,
   jdk8,
   jdk17,
   jdk21,
@@ -134,7 +134,7 @@ symlinkJoin {
         ++ additionalLibs;
 
       runtimePrograms = [
-        glxinfo
+        mesa-demos
         pciutils # need lspci
         xorg.xrandr # needed for LWJGL [2.9.2, 3) https://github.com/LWJGL/lwjgl/issues/128
       ] ++ additionalPrograms;
diff --git a/pkgs/by-name/qu/quickemu/package.nix b/pkgs/by-name/qu/quickemu/package.nix
index a97fcb46727d..35ffc1694fef 100644
--- a/pkgs/by-name/qu/quickemu/package.nix
+++ b/pkgs/by-name/qu/quickemu/package.nix
@@ -6,7 +6,7 @@
   cdrtools,
   curl,
   gawk,
-  glxinfo,
+  mesa-demos,
   gnugrep,
   gnused,
   jq,
@@ -49,7 +49,7 @@ let
       zsync
     ]
     ++ lib.optionals stdenv.isLinux [
-      glxinfo
+      mesa-demos
       usbutils
       xdg-user-dirs
     ];
diff --git a/pkgs/by-name/rc/rclip/package.nix b/pkgs/by-name/rc/rclip/package.nix
index 901090d2e6fc..2f9aad6497a0 100644
--- a/pkgs/by-name/rc/rclip/package.nix
+++ b/pkgs/by-name/rc/rclip/package.nix
@@ -4,14 +4,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "rclip";
-  version = "1.10.2";
+  version = "1.10.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yurijmikhalevich";
     repo = "rclip";
     rev = "refs/tags/v${version}";
-    hash = "sha256-z+zwhd3JH40Vg9yHt9ektvm2jWFOvj1DaCSI9GwXLT8=";
+    hash = "sha256-MdqO6X1dbIzmDuDSjrbmKbQfPIPcyhVIbodERYu9PZU=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/ri/ride/package.nix b/pkgs/by-name/ri/ride/package.nix
index 0cce0041710a..9706b388dbf7 100644
--- a/pkgs/by-name/ri/ride/package.nix
+++ b/pkgs/by-name/ri/ride/package.nix
@@ -32,8 +32,6 @@ let
   };
 
   platformInfo = platformInfos.${stdenv.system};
-
-  electronDist = electron + (if stdenv.isDarwin then "/Applications" else "/libexec/electron");
 in
 buildNpmPackage rec {
   pname = "ride";
@@ -109,7 +107,7 @@ buildNpmPackage rec {
     mkdir local-cache
 
     # electron files need to be writable on Darwin
-    cp -r ${electronDist} electron-dist
+    cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
 
     pushd electron-dist
diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index 1059a5726439..52b3c68ffc73 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -101,7 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
     npm exec electron-builder -- \
         --dir \
         --config electron-builder-${platformId}.yml \
-        -c.electronDist=${electron}/libexec/electron \
+        -c.electronDist=${electron.dist} \
         -c.electronVersion=${electron.version}
 
     runHook postBuild
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index f1a310c3a833..6d65fe99d89a 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # electron builds must be writable on darwin
   preBuild = lib.optionalString stdenv.isDarwin ''
-    cp -r ${electron}/Applications/Electron.app .
+    cp -r ${electron.dist}/Electron.app .
     chmod -R u+w Electron.app
   '';
 
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
     pnpm exec electron-builder \
       --dir \
       -c.asarUnpack="**/*.node" \
-      -c.electronDist=${if stdenv.isDarwin then "." else "${electron}/libexec/electron"} \
+      -c.electronDist=${if stdenv.isDarwin then "." else electron.dist} \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index 090d027e57b1..1fba6d9ddcc9 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -11,20 +11,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yazi";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "sxyazi";
     repo = "yazi";
     rev = "v${version}";
-    hash = "sha256-tK2dm+WIEJGSq/PbRyagt7x43nd/o1HxP8HMj23HfnQ=";
+    hash = "sha256-skJK0iAqQ4uyEx/SeF/97YHWKYBNHmdYpltx3h6JvNc=";
   };
 
-  cargoHash = "sha256-Lb9gu4/i+vPH3dhdzIn9V2s6fKooxEefcN2T/oDqVmg=";
+  cargoHash = "sha256-w7eFeKmYFDmSpG/p4r2w6qw8uUm4q+VUbAI+TnKhp5s=";
 
   env.YAZI_GEN_COMPLETIONS = true;
   env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2024-08-15";
+  env.VERGEN_BUILD_DATE = "2024-08-28";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ] ++ lib.optionals stdenv.isDarwin [ Foundation ];
diff --git a/pkgs/data/icons/volantes-cursors/default.nix b/pkgs/data/icons/volantes-cursors/default.nix
index b7ef49135e93..0e0871a00038 100644
--- a/pkgs/data/icons/volantes-cursors/default.nix
+++ b/pkgs/data/icons/volantes-cursors/default.nix
@@ -28,5 +28,6 @@ stdenv.mkDerivation {
     license = licenses.gpl2;
     maintainers = with maintainers; [ jordanisaacs ];
     platforms = platforms.unix;
+    broken = stdenv.isDarwin && stdenv.isAarch64; # build timeout
   };
 }
diff --git a/pkgs/development/coq-modules/rewriter/default.nix b/pkgs/development/coq-modules/rewriter/default.nix
new file mode 100644
index 000000000000..f5b425cd4811
--- /dev/null
+++ b/pkgs/development/coq-modules/rewriter/default.nix
@@ -0,0 +1,22 @@
+{ lib, mkCoqDerivation, coq, version ? null }:
+
+mkCoqDerivation {
+  pname = "rewriter";
+  owner = "mit-plv";
+  inherit version;
+  defaultVersion = let inherit (lib.versions) range; in
+    lib.switch coq.coq-version [
+      { case = range "8.17" "8.19"; out = "0.0.11"; }
+    ] null;
+  release = {
+    "0.0.11".sha256  = "sha256-aYoO08nwItlOoE5BnKRGib2Zk4Fz4Ni/L4QaqkObPow=";
+  };
+  releaseRev = v: "v${v}";
+
+  mlPlugin = true;
+
+  meta = {
+    description = "Reflective PHOAS rewriting/pattern-matching-compilation framework for simply-typed equalities and let-lifting, experimental and tailored for use in Fiat Cryptography";
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/embedded/edl/default.nix b/pkgs/development/embedded/edl/default.nix
index 0dfde4a117cb..570fda02d8e5 100644
--- a/pkgs/development/embedded/edl/default.nix
+++ b/pkgs/development/embedded/edl/default.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonPackage {
   pname = "edl";
-  version = "3.52.1-unstable-2024-07-05";
+  version = "3.52.1-unstable-2024-08-27";
 
   src = fetchFromGitHub {
     owner = "bkerler";
     repo = "edl";
-    rev = "53671740213046bcf875acd2feb1c1d07fb1605c";
+    rev = "d2c585e4ccc066895b71ca9014c1ebb5af316e07";
     fetchSubmodules = true;
-    hash = "sha256-jm5BSnjAuqOa5oHhboruqQJ9BdsyjQic4vbwSNgIneQ=";
+    hash = "sha256-hQturda+iDmH5DVP1CjG526wcggdzTSrW2jqrEzLXtY=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/development/libraries/gsoap/default.nix b/pkgs/development/libraries/gsoap/default.nix
index 08b8146ac0a8..1a40b87c01aa 100644
--- a/pkgs/development/libraries/gsoap/default.nix
+++ b/pkgs/development/libraries/gsoap/default.nix
@@ -1,7 +1,8 @@
-{ lib, stdenv, fetchurl, autoreconfHook, unzip, m4, bison, flex, openssl, zlib }:
+{ lib, stdenv, fetchurl, autoreconfHook, unzip, m4, bison, flex, openssl, zlib, buildPackages }:
 
 let
   majorVersion = "2.8";
+  isCross = stdenv.hostPlatform != stdenv.buildPlatform;
 
 in stdenv.mkDerivation rec {
   pname = "gsoap";
@@ -22,6 +23,10 @@ in stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace configure.ac \
       --replace 'AM_INIT_AUTOMAKE([foreign])' 'AM_INIT_AUTOMAKE([foreign subdir-objects])'
+    ${lib.optionalString isCross ''
+      substituteInPlace gsoap/wsdl/Makefile.am \
+        --replace-fail 'SOAP=$(top_builddir)/gsoap/src/soapcpp2$(EXEEXT)' 'SOAP=${lib.getExe' buildPackages.gsoap "soapcpp2"}'
+    ''}
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/pdfhummus/default.nix b/pkgs/development/libraries/pdfhummus/default.nix
index 3eef51bbbd8a..96d2887452d6 100644
--- a/pkgs/development/libraries/pdfhummus/default.nix
+++ b/pkgs/development/libraries/pdfhummus/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pdfhummus";
-  version = "4.6.6";
+  version = "4.6.7";
 
   src = fetchFromGitHub {
     owner = "galkahana";
     repo = "PDF-Writer";
     rev = "v${version}";
-    hash = "sha256-JPL5+GoL4zvHgStgTV9pJBPsQtAeE2DJe02YrZEtdJ8=";
+    hash = "sha256-XOoMh1YL4wJQ6Uliy0sdcrlqJbbbnZ0gmjuaXS1h+qQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioambient/default.nix b/pkgs/development/python-modules/aioambient/default.nix
index c5573e88f7d9..a41e251ac99f 100644
--- a/pkgs/development/python-modules/aioambient/default.nix
+++ b/pkgs/development/python-modules/aioambient/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "aioambient";
-  version = "2024.01.0";
+  version = "2024.08.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = "aioambient";
     rev = "refs/tags/${version}";
-    hash = "sha256-eqZVY0L+2BWF7cCXW/VLQYYXNPtUF6tJHQmeZNW1W5o=";
+    hash = "sha256-GedGwG4Lm28BvfSBOGcspUQ3LCmdb2IC2rLifuKGOes=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security/default.nix
similarity index 59%
rename from pkgs/development/python-modules/flask-security-too/default.nix
rename to pkgs/development/python-modules/flask-security/default.nix
index 98eb55379493..e202a68ab480 100644
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security/default.nix
@@ -1,15 +1,16 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   pythonOlder,
-  setuptools,
+  flit-core,
 
   # extras: babel
   babel,
   flask-babel,
 
   # extras: common
+  argon2-cffi,
   bcrypt,
   bleach,
   flask-mailman,
@@ -31,12 +32,14 @@
   flask-login,
   flask-principal,
   flask-wtf,
+  markupsafe,
   passlib,
   importlib-resources,
   wtforms,
 
   # tests
-  argon2-cffi,
+  authlib,
+  flask-sqlalchemy-lite,
   freezegun,
   mongoengine,
   mongomock,
@@ -47,19 +50,25 @@
 }:
 
 buildPythonPackage rec {
-  pname = "flask-security-too";
-  version = "5.5.0";
+  pname = "flask-security";
+  version = "5.5.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
-  src = fetchPypi {
-    pname = "flask_security_too";
-    inherit version;
-    hash = "sha256-nuYOqKgH3Wfk2IFEDUhWUB6aP1xZ+c4DK7n0zB01TSk=";
+  src = fetchFromGitHub {
+    owner = "pallets-eco";
+    repo = "flask-security";
+    rev = "refs/tags/${version}";
+    hash = "sha256-RGRwgrDFe+0v8NYyajMikdoi1DQf1I+B5y8KJyF+cZs=";
   };
 
-  build-system = [ setuptools ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail phonenumberslite phonenumbers
+  '';
+
+  build-system = [ flit-core ];
 
   # flask-login>=0.6.2 not satisfied by version 0.7.0.dev0
   pythonRelaxDeps = [ "flask-login" ];
@@ -70,17 +79,19 @@ buildPythonPackage rec {
     flask-login
     flask-principal
     flask-wtf
+    markupsafe
     passlib
     importlib-resources
     wtforms
   ];
 
-  passthru.optional-dependencies = {
+  optional-dependencies = {
     babel = [
       babel
       flask-babel
     ];
     common = [
+      argon2-cffi
       bcrypt
       bleach
       flask-mailman
@@ -100,7 +111,8 @@ buildPythonPackage rec {
 
   nativeCheckInputs =
     [
-      argon2-cffi
+      authlib
+      flask-sqlalchemy-lite
       freezegun
       mongoengine
       mongomock
@@ -108,12 +120,15 @@ buildPythonPackage rec {
       pony
       pytestCheckHook
       zxcvbn
-      freezegun
     ]
-    ++ passthru.optional-dependencies.babel
-    ++ passthru.optional-dependencies.common
-    ++ passthru.optional-dependencies.fsqla
-    ++ passthru.optional-dependencies.mfa;
+    ++ optional-dependencies.babel
+    ++ optional-dependencies.common
+    ++ optional-dependencies.fsqla
+    ++ optional-dependencies.mfa;
+
+  preCheck = ''
+    pybabel compile --domain flask_security -d flask_security/translations
+  '';
 
   disabledTests = [
     # needs /etc/resolv.conf
@@ -123,9 +138,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "flask_security" ];
 
   meta = with lib; {
-    changelog = "https://github.com/Flask-Middleware/flask-security/blob/${version}/CHANGES.rst";
-    homepage = "https://github.com/Flask-Middleware/flask-security";
-    description = "Simple security for Flask apps (fork)";
+    changelog = "https://github.com/pallets-eco/flask-security/blob/${version}/CHANGES.rst";
+    homepage = "https://github.com/pallets-eco/flask-security";
+    description = "Quickly add security features to your Flask application";
     license = licenses.mit;
     maintainers = with maintainers; [ gador ];
   };
diff --git a/pkgs/development/python-modules/flask-sqlalchemy-lite/default.nix b/pkgs/development/python-modules/flask-sqlalchemy-lite/default.nix
new file mode 100644
index 000000000000..a6afc09f4edf
--- /dev/null
+++ b/pkgs/development/python-modules/flask-sqlalchemy-lite/default.nix
@@ -0,0 +1,45 @@
+{
+  aiosqlite,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flask,
+  flit-core,
+  lib,
+  pytestCheckHook,
+  sqlalchemy,
+}:
+
+buildPythonPackage rec {
+  pname = "flask-sqlalchemy-lite";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pallets-eco";
+    repo = "flask-sqlalchemy-lite";
+    rev = "refs/tags/${version}";
+    hash = "sha256-LpdPp5Gp74DSJqD1DJqwNeaMKdN5pEAUkxnKGYZcVis=";
+  };
+
+  build-system = [ flit-core ];
+
+  dependencies = [
+    flask
+    sqlalchemy
+  ] ++ flask.optional-dependencies.async ++ sqlalchemy.optional-dependencies.asyncio;
+
+  pythonImportsCheck = [ "flask_sqlalchemy_lite" ];
+
+  nativeCheckInputs = [
+    aiosqlite
+    pytestCheckHook
+  ];
+
+  meta = {
+    changelog = "https://github.com/pallets-eco/flask-sqlalchemy-lite/blob/${src.rev}/CHANGES.md";
+    description = "Integrate SQLAlchemy with Flask";
+    homepage = "https://github.com/pallets-eco/flask-sqlalchemy-lite";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/pony/default.nix b/pkgs/development/python-modules/pony/default.nix
index 734da54c2545..92aa40650ebc 100644
--- a/pkgs/development/python-modules/pony/default.nix
+++ b/pkgs/development/python-modules/pony/default.nix
@@ -3,35 +3,26 @@
   buildPythonPackage,
   fetchFromGitHub,
   pytestCheckHook,
+  pythonAtLeast,
   pythonOlder,
   setuptools,
-  fetchpatch,
 }:
 
 buildPythonPackage rec {
   pname = "pony";
-  version = "0.7.17";
+  version = "0.7.18";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.8" || pythonAtLeast "3.13";
 
   src = fetchFromGitHub {
     owner = "ponyorm";
     repo = "pony";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wBqw+YHKlxYplgsYL1pbkusHyPfCaVPcH/Yku6WDYbE=";
+    hash = "sha256-2qGkHPBbfFrjJatKVa44bDbn/i3/YH/8LWd8CXyFRqo=";
   };
 
-  patches = [
-    # https://github.com/ponyorm/pony/pull/713
-    (fetchpatch {
-      name = "py312-compat.patch";
-      url = "https://github.com/ponyorm/pony/commit/5a37f6d59b6433d17d6d56b54f3726190e98c98f.patch";
-      hash = "sha256-niOoANOYHqrcmEXRZEDew2BM8P/s7UFnn0qpgB8V0Mk=";
-    })
-  ];
-
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index 0f9e4808cb97..5c16b8a5960e 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -1,54 +1,52 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
+  darwin,
+  ocl-icd,
   buildPythonPackage,
+  fetchFromGitHub,
 
   # build-system
   cmake,
-  scikit-build-core,
-  pathspec,
-  ninja,
   nanobind,
+  ninja,
+  numpy,
+  pathspec,
+  scikit-build-core,
+
+  # buildInputs
+  opencl-headers,
+  pybind11,
 
   # dependencies
-  appdirs,
-  cffi,
-  darwin,
-  decorator,
-  mako,
-  numpy,
-  ocl-icd,
-  oldest-supported-numpy,
-  opencl-headers,
   platformdirs,
-  pybind11,
-  pytestCheckHook,
   pytools,
-  six,
+
+  # checks
+  pytestCheckHook,
 }:
 
 let
-  os-specific-buildInputs = if stdenv.isDarwin then [ darwin.apple_sdk.frameworks.OpenCL ] else [ ocl-icd ];
+  os-specific-buildInputs =
+    if stdenv.isDarwin then [ darwin.apple_sdk.frameworks.OpenCL ] else [ ocl-icd ];
 in
 buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2024.2.6";
-  format = "pyproject";
+  version = "2024.2.7";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "inducer";
     repo = "pyopencl";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nP7ZAGeRXrjqDRWlc2SDP1hk1fseGeu9Zx0lOp9Pchs=";
+    hash = "sha256-DfZCtTeN1a1KS2qUU6iztba4opAVC/RUCe/hnkqTbII=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     cmake
     nanobind
     ninja
     numpy
-    oldest-supported-numpy
     pathspec
     scikit-build-core
   ];
@@ -60,15 +58,10 @@ buildPythonPackage rec {
     pybind11
   ] ++ os-specific-buildInputs;
 
-  propagatedBuildInputs = [
-    appdirs
-    cffi
-    decorator
-    mako
+  dependencies = [
     numpy
     platformdirs
     pytools
-    six
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
@@ -83,9 +76,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pyopencl" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python wrapper for OpenCL";
     homepage = "https://github.com/pyopencl/pyopencl";
-    license = licenses.mit;
+    changelog = "https://github.com/inducer/pyopencl/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    # ld: symbol(s) not found for architecture arm64
+    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/development/python-modules/rangehttpserver/default.nix b/pkgs/development/python-modules/rangehttpserver/default.nix
index a357f2138052..9317045da4de 100644
--- a/pkgs/development/python-modules/rangehttpserver/default.nix
+++ b/pkgs/development/python-modules/rangehttpserver/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "rangehttpserver";
-  version = "1.3.3";
+  version = "1.4.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "danvk";
     repo = "RangeHTTPServer";
     rev = "refs/tags/${version}";
-    hash = "sha256-ZXEbis37QO8t05JQ2qQQf5rkUSxq3DwzR3khAJkZ5W0=";
+    hash = "sha256-wvGJ5wHYLb7wJUGgurkdRTABV6kTH7/GXzXgpd0Ypbc=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/renault-api/default.nix b/pkgs/development/python-modules/renault-api/default.nix
index 2613136ddde5..ec46ea720f4d 100644
--- a/pkgs/development/python-modules/renault-api/default.nix
+++ b/pkgs/development/python-modules/renault-api/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "renault-api";
-  version = "0.2.5";
+  version = "0.2.6";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "hacf-fr";
     repo = "renault-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PBNiYfWcPx3AorpYmNiPGC8MAE8efQOwdtaY8dH1wTs=";
+    hash = "sha256-opxEQIpZkaSWglPh4gwLJIi89B/ooHlwc9nKZRIS/j8=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/reolink-aio/default.nix b/pkgs/development/python-modules/reolink-aio/default.nix
index b5e378366bb6..4b63eb5dd759 100644
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.9.7";
+  version = "0.9.8";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "reolink_aio";
     rev = "refs/tags/${version}";
-    hash = "sha256-EWNnaLXgJ4ieLFVBT651d50eZ/s/NfdRwRAVQy49kpc=";
+    hash = "sha256-3rwL47mXVzWBL4REE1Dchg8GQLWJn+bzoZnmXHgKX40=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index bb67bacff234..2cc852ee4010 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1219";
+  version = "3.0.1221";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-EgWa4YmMLcA0z7M88vWMaNDLi5pZ+qNYvALi/MSS45s=";
+    hash = "sha256-wrz0Q/sNy6FBEcIu/eD7yV2HGOgV9sdzw+Q2Pxkh9eI=";
   };
 
   build-system = [ setuptools ];
@@ -30,12 +30,7 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "tencentcloud" ];
 
-  pytestFlagsArray = [
-    # Other tests require credentials
-    "tests/unit/test_deserialize_warning.py"
-    "tests/unit/test_import.py"
-    "tests/unit/test_serialization.py"
-  ];
+  pytestFlagsArray = [ "tests/unit/" ];
 
   meta = with lib; {
     description = "Tencent Cloud API 3.0 SDK for Python";
diff --git a/pkgs/development/python-modules/ttn-client/default.nix b/pkgs/development/python-modules/ttn-client/default.nix
index d639876bdb61..bba8ef790e7c 100644
--- a/pkgs/development/python-modules/ttn-client/default.nix
+++ b/pkgs/development/python-modules/ttn-client/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "ttn-client";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "angelnu";
     repo = "thethingsnetwork_python_client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CAodXoc2T/vyAQKWYCm3te3urbSpGMZ7gmYlvDmTEQY=";
+    hash = "sha256-dWEXoqW4JyYeLFLS3J4CaRJ45wjdVf8wrtMGCKgBds8=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index e08491788c9a..3268f737c602 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "xiaomi-ble";
-  version = "0.30.2";
+  version = "0.31.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "xiaomi-ble";
     rev = "refs/tags/v${version}";
-    hash = "sha256-x+i5zC0WTWO+F1uIliAzyc+48X3njwTNz5ss5KK6xuQ=";
+    hash = "sha256-JmJfLRszP0uKsQ6HjTUbh9YeEGa06qBuJwbmu1lzZCw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index e0c247e38f29..06a08979f493 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.236";
+  version = "3.2.238";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-w5ac8yerkGEOFOKNgeFtIOIjzekOd7G4Hn3J3kEzjMM=";
+    hash = "sha256-L5HGX7cT5pxd4dFjrppSg70XyqCDg1EXodsBRWFZ9o8=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];
diff --git a/pkgs/development/tools/build-managers/scala-cli/sources.json b/pkgs/development/tools/build-managers/scala-cli/sources.json
index 8956544340cd..de1dd7c0f4d0 100644
--- a/pkgs/development/tools/build-managers/scala-cli/sources.json
+++ b/pkgs/development/tools/build-managers/scala-cli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "1.4.3",
+  "version": "1.5.0",
   "assets": {
     "aarch64-darwin": {
       "asset": "scala-cli-aarch64-apple-darwin.gz",
-      "sha256": "1hb0n97z5f1h2fcxiygi72ljc20lmlymhm6kcff2azfnjr2sdc48"
+      "sha256": "1samfkiw4rgfw36sqd85nrn0v050jy9mca3qvn46wfxczrf3sjvj"
     },
     "aarch64-linux": {
       "asset": "scala-cli-aarch64-pc-linux.gz",
-      "sha256": "1267cvhfmkxhxhq4ypqx4v24w19i1p8bx36hm2mbwi7aqz1m32ms"
+      "sha256": "02zpqffprf1hf68jhr9h7panqr110ip0fyv42lgqpj6rbhlxi371"
     },
     "x86_64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "190kwxr93m2i8azrlahq41xhkpx0pkadiak1wbdzalgfxd7q36n6"
+      "sha256": "1lfrcz2khabyww52ji03p034k3h6zrmgzxgy1zw78r5z2s984w4f"
     },
     "x86_64-linux": {
       "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "0fhydw1axm2xj8qwsl43y3bbbhm95h4yag055py1mxkqsq6f4vw4"
+      "sha256": "15rlzgg2innaifixwqy4w2lxg2ab9pi11s2fx1c053ylhbbbz3v1"
     }
   }
 }
diff --git a/pkgs/development/tools/electron-fiddle/default.nix b/pkgs/development/tools/electron-fiddle/default.nix
index 4add8cadb7d3..cde2dcae311c 100644
--- a/pkgs/development/tools/electron-fiddle/default.nix
+++ b/pkgs/development/tools/electron-fiddle/default.nix
@@ -61,7 +61,7 @@ let
       patchShebangs node_modules
 
       mkdir -p ~/.cache/electron/${electronDummyHash}
-      cp -ra '${electron}/libexec/electron' "$TMPDIR/electron"
+      cp -ra '${electron.dist}' "$TMPDIR/electron"
       chmod -R u+w "$TMPDIR/electron"
       (cd "$TMPDIR/electron" && zip -0Xr ~/.cache/electron/${electronDummyHash}/${electronDummyFilename} .)
 
diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index 6b0d3d12e5e3..60255d21bcb1 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -107,7 +107,7 @@ let
     ++ lib.optionals (lib.versionAtLeast version "17.0.0") [ libGL vulkan-loader ]
   );
 
-  linux = {
+  linux = finalAttrs: {
     buildInputs = [ glib gtk3 ];
 
     nativeBuildInputs = [
@@ -142,9 +142,11 @@ let
       rm "$out/libexec/electron/libvulkan.so.1"
       ln -s -t "$out/libexec/electron" "${lib.getLib vulkan-loader}/lib/libvulkan.so.1"
     '';
+
+    passthru.dist = finalAttrs.finalPackage + "/libexec/electron";
   };
 
-  darwin = {
+  darwin = finalAttrs: {
     nativeBuildInputs = [
       makeWrapper
       unzip
@@ -157,9 +159,12 @@ let
       mkdir -p $out/bin
       makeWrapper $out/Applications/Electron.app/Contents/MacOS/Electron $out/bin/electron
     '';
+
+    passthru.dist = finalAttrs.finalPackage + "/Applications";
   };
 in
-  stdenv.mkDerivation (
-    (common stdenv.hostPlatform) //
-    (if stdenv.isDarwin then darwin else linux)
+  stdenv.mkDerivation (finalAttrs:
+    lib.recursiveUpdate
+      (common stdenv.hostPlatform)
+      ((if stdenv.isDarwin then darwin else linux) finalAttrs)
   )
diff --git a/pkgs/development/tools/electron/common.nix b/pkgs/development/tools/electron/common.nix
index 1e863827710d..e98e93a0a17d 100644
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@@ -27,7 +27,7 @@ let
 
   fetchedDeps = lib.mapAttrs (name: fetchdep) info.deps;
 
-in (chromium.override { upstream-info = info.chromium; }).mkDerivation (base: {
+in ((chromium.override { upstream-info = info.chromium; }).mkDerivation (base: {
   packageName = "electron";
   inherit (info) version;
   buildTargets = [ "electron:electron_dist_zip" ];
@@ -244,4 +244,9 @@ in (chromium.override { upstream-info = info.chromium; }).mkDerivation (base: {
     hydraPlatforms = lib.optionals (!(hasInfix "alpha" info.version) && !(hasInfix "beta" info.version)) ["aarch64-linux" "x86_64-linux"];
     timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
   };
+})).overrideAttrs (finalAttrs: prevAttrs: {
+  # this was the only way I could get the package to properly reference itself
+  passthru = prevAttrs.passthru // {
+    dist = finalAttrs.finalPackage + "/libexec/electron";
+  };
 })
diff --git a/pkgs/development/tools/electron/wrapper.nix b/pkgs/development/tools/electron/wrapper.nix
index c912c059e255..8c48e8f695fc 100644
--- a/pkgs/development/tools/electron/wrapper.nix
+++ b/pkgs/development/tools/electron/wrapper.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
 
   passthru = {
     unwrapped = electron-unwrapped;
-    inherit (electron-unwrapped) headers;
+    inherit (electron-unwrapped) headers dist;
   };
   inherit (electron-unwrapped) meta;
 }
diff --git a/pkgs/development/tools/infisical/default.nix b/pkgs/development/tools/infisical/default.nix
index 9fe6f31d3218..fcc616f7642c 100644
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
@@ -15,7 +15,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # the version of infisical
-  version = "0.28.5";
+  version = "0.28.6";
 
   # the platform-specific, statically linked binary
   src =
diff --git a/pkgs/development/tools/infisical/hashes.json b/pkgs/development/tools/infisical/hashes.json
index 054c645c459a..46faf5f344eb 100644
--- a/pkgs/development/tools/infisical/hashes.json
+++ b/pkgs/development/tools/infisical/hashes.json
@@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-hYDBZ6cTUCJTd5Zv/jCXVLpSGSeXbtC0uxAjh4NIjV8="
-, "x86_64-darwin": "sha256-IjxGVl1TrQFN3ic0dAinfzziJeR1fiSeW8jE+aXD6cA="
-, "aarch64-linux": "sha256-6KFwHFS8dZfG8rrK+85BUwjD+sNTqY/5WVhu0yEtJ70="
-, "aarch64-darwin": "sha256-nkv9r5CzzjI7CKfQ/tD+UJGoDR6Os7W6bc0dcoAiGhE="
+, "x86_64-linux": "sha256-izVUw/RcH+U6i5kCdPGojsBF+Ont40QBYk4sJW/BLOA="
+, "x86_64-darwin": "sha256-j0f4NhLivG+MmzitOSnAcc/EQAiFVEn44w3UMnLCkVY="
+, "aarch64-linux": "sha256-hunRA42xIMcu5JBtTnibWXKEECIeBIHyeBwVnOGR25U="
+, "aarch64-darwin": "sha256-s6bmANYuuAOq959R+lipThc39qyqww20ISZ965hWkWc="
 }
diff --git a/pkgs/development/tools/redisinsight/default.nix b/pkgs/development/tools/redisinsight/default.nix
index 1ea9f69241a6..3889022daf97 100644
--- a/pkgs/development/tools/redisinsight/default.nix
+++ b/pkgs/development/tools/redisinsight/default.nix
@@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     yarn --offline electron-builder \
       --dir \
-      -c.electronDist=${electron}/libexec/electron \
+      -c.electronDist=${electron.dist} \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
diff --git a/pkgs/games/steam/default.nix b/pkgs/games/steam/default.nix
index 651c20491844..4d3f2ba7140c 100644
--- a/pkgs/games/steam/default.nix
+++ b/pkgs/games/steam/default.nix
@@ -1,5 +1,5 @@
 { makeScopeWithSplicing', generateSplicesForMkScope
-, stdenv, buildFHSEnv, pkgsi686Linux, glxinfo
+, stdenv, buildFHSEnv, pkgsi686Linux, mesa-demos
 }:
 
 let
@@ -14,10 +14,10 @@ let
     steam-runtime-wrapped = callPackage ./runtime-wrapped.nix { };
     steam = callPackage ./steam.nix { };
     steam-fhsenv = callPackage ./fhsenv.nix {
-      glxinfo-i686 =
+      mesa-demos-i686 =
         if self.steamArch == "amd64"
-        then pkgsi686Linux.glxinfo
-        else glxinfo;
+        then pkgsi686Linux.mesa-demos
+        else mesa-demos;
       steam-runtime-wrapped-i686 =
         if self.steamArch == "amd64"
         then pkgsi686Linux.steamPackages.steam-runtime-wrapped
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index f59a38649671..b7489c236353 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, writeShellScript, buildFHSEnv, steam, glxinfo-i686
+{ lib, stdenv, writeShellScript, buildFHSEnv, steam, mesa-demos-i686
 , steam-runtime-wrapped, steam-runtime-wrapped-i686 ? null
 , extraPkgs ? pkgs: [ ] # extra packages to add to targetPkgs
 , extraLibraries ? pkgs: [ ] # extra packages to add to multiPkgs
@@ -269,7 +269,7 @@ in buildFHSEnv rec {
 
   runScript = writeShellScript "steam-wrapper.sh" ''
     if [ -f /etc/NIXOS ]; then   # Check only useful on NixOS
-      ${glxinfo-i686}/bin/glxinfo 2>&1 | grep -q Error
+      ${mesa-demos-i686}/bin/glxinfo 2>&1 | grep -q Error
       # If there was an error running glxinfo, we know something is wrong with the configuration
       if [ $? -eq 0 ]; then
         cat <<EOF > /dev/stderr
diff --git a/pkgs/servers/homepage-dashboard/default.nix b/pkgs/servers/homepage-dashboard/default.nix
index 03fd2a3efe3a..788cd01d067a 100644
--- a/pkgs/servers/homepage-dashboard/default.nix
+++ b/pkgs/servers/homepage-dashboard/default.nix
@@ -10,6 +10,7 @@
   nixosTests,
   enableLocalIcons ? false,
   nix-update-script,
+  git,
 }:
 let
   dashboardIcons = fetchFromGitHub {
@@ -49,7 +50,7 @@ buildNpmPackage rec {
     patchShebangs .next/standalone/server.js
   '';
 
-  nativeBuildInputs = lib.optionals stdenv.isDarwin [ cctools ];
+  nativeBuildInputs = [ git ] ++ lib.optionals stdenv.isDarwin [ cctools ];
 
   buildInputs = [ nodePackages.node-gyp-build ] ++ lib.optionals stdenv.isDarwin [ IOKit ];
 
@@ -68,9 +69,21 @@ buildNpmPackage rec {
 
     chmod +x $out/share/homepage/server.js
 
+    # This patch must be applied here, as it's patching the `dist` directory
+    # of NextJS. Without this, homepage-dashboard errors when trying to
+    # write its prerender cache.
+    #
+    # This patch ensures that the cache implementation respects the env
+    # variable `HOMEPAGE_CACHE_DIR`, which is set by default in the
+    # wrapper below.
+    pushd $out
+    git apply ${./prerender_cache_path.patch}
+    popd
+
     makeWrapper $out/share/homepage/server.js $out/bin/homepage \
       --set-default PORT 3000 \
-      --set-default HOMEPAGE_CONFIG_DIR /var/lib/homepage-dashboard
+      --set-default HOMEPAGE_CONFIG_DIR /var/lib/homepage-dashboard \
+      --set-default HOMEPAGE_CACHE_DIR /var/cache/homepage-dashboard
 
     ${if enableLocalIcons then installLocalIcons else ""}
 
diff --git a/pkgs/servers/homepage-dashboard/prerender_cache_path.patch b/pkgs/servers/homepage-dashboard/prerender_cache_path.patch
new file mode 100644
index 000000000000..05746b5601c4
--- /dev/null
+++ b/pkgs/servers/homepage-dashboard/prerender_cache_path.patch
@@ -0,0 +1,18 @@
+diff --git a/share/homepage/node_modules/next/dist/server/lib/incremental-cache/file-system-cache.js b/share/homepage/node_modules/next/dist/server/lib/incremental-cache/file-system-cache.js
+index b1b74d8..a46c80b 100644
+--- a/share/homepage/node_modules/next/dist/server/lib/incremental-cache/file-system-cache.js
++++ b/share/homepage/node_modules/next/dist/server/lib/incremental-cache/file-system-cache.js
+@@ -5,11 +5,12 @@ Object.defineProperty(exports, "__esModule", {
+ exports.default = void 0;
+ var _lruCache = _interopRequireDefault(require("next/dist/compiled/lru-cache"));
+ var _path = _interopRequireDefault(require("../../../shared/lib/isomorphic/path"));
++var path = require('node:path');
+ class FileSystemCache {
+     constructor(ctx){
+         this.fs = ctx.fs;
+         this.flushToDisk = ctx.flushToDisk;
+-        this.serverDistDir = ctx.serverDistDir;
++        this.serverDistDir = path.join(process.env.HOMEPAGE_CACHE_DIR, "homepage");
+         this.appDir = !!ctx._appDir;
+         if (ctx.maxMemoryCacheSize) {
+             this.memoryCache = new _lruCache.default({
diff --git a/pkgs/servers/nats-server/default.nix b/pkgs/servers/nats-server/default.nix
index 700a0aa66381..e727bb1e482a 100644
--- a/pkgs/servers/nats-server/default.nix
+++ b/pkgs/servers/nats-server/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "nats-server";
-  version = "2.10.18";
+  version = "2.10.19";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-xoCeP/6qKNeqsqVPKfybdwVs50QPBS82zBGxwOXrVGU=";
+    hash = "sha256-zgLo6j6CC/AHQKCnpXJIczneT4RbU6WneUSoL2vTthw=";
   };
 
-  vendorHash = "sha256-6Dgk/F0gZlULpEZpWvJndHdp7AyggClOb3FrwotSjRs=";
+  vendorHash = "sha256-D/3c8Sov8LJzeWN2tu6iqwnwfb3EXXnJpgONo96pmYI=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/sql/cockroachdb/cockroachdb-bin.nix b/pkgs/servers/sql/cockroachdb/default.nix
similarity index 95%
rename from pkgs/servers/sql/cockroachdb/cockroachdb-bin.nix
rename to pkgs/servers/sql/cockroachdb/default.nix
index ef7eaaa080f9..c155e0aa076e 100644
--- a/pkgs/servers/sql/cockroachdb/cockroachdb-bin.nix
+++ b/pkgs/servers/sql/cockroachdb/default.nix
@@ -44,6 +44,7 @@ buildFHSEnv {
       mit
       cockroachdb-community-license
     ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = [ "aarch64-linux" "x86_64-linux" ];
     maintainers = with maintainers; [ rushmorem thoughtpolice ];
   };
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 0094d317fa7b..f7e3982815d3 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -5,14 +5,14 @@
 , git, nix, nixfmt-classic, jq, coreutils, gnused, curl, cacert, bash }:
 
 stdenv.mkDerivation rec {
-  version = "2024-08-21";
+  version = "2024-08-27";
   pname = "oh-my-zsh";
 
   src = fetchFromGitHub {
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    rev = "ebb479e5e2395d26fc368c9b9d534e935a292740";
-    sha256 = "sha256-+uACSlon6xraKqwZhL8xFU40b0SvkEE2GAzvm/ROun0=";
+    rev = "efe21261d031b4836f64112a899706322acd26b0";
+    sha256 = "sha256-ICHdwxySSzX64q+mfPKOQqOrLrc/RKiyvPioseNt4hE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix
index 6e45cafdc340..4325040dd683 100644
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@@ -173,7 +173,7 @@ pythonPackages.buildPythonApplication rec {
     python-dateutil
     sqlalchemy
     itsdangerous
-    flask-security-too
+    flask-security
     bcrypt
     cryptography
     sshtunnel
diff --git a/pkgs/tools/audio/spotdl/default.nix b/pkgs/tools/audio/spotdl/default.nix
index 31c825c56cd3..ab5cdd8ca399 100644
--- a/pkgs/tools/audio/spotdl/default.nix
+++ b/pkgs/tools/audio/spotdl/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "spotdl";
-  version = "4.2.6";
+  version = "4.2.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "spotDL";
     repo = "spotify-downloader";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OhZXxGkcO/dlYth9xUnpd/IbyvsbjMzwqQ9lPSvnFSs=";
+    hash = "sha256-AZpTxfnUyOLcPJQJyk77eqw1EbN3s7/8QQMxcxyJVKE=";
   };
 
   build-system = with python3.pkgs; [ poetry-core ];
diff --git a/pkgs/tools/graphics/glxinfo/default.nix b/pkgs/tools/graphics/glxinfo/default.nix
deleted file mode 100644
index 0dcf30fda156..000000000000
--- a/pkgs/tools/graphics/glxinfo/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, stdenv, fetchurl, libGL, libX11 }:
-
-stdenv.mkDerivation rec {
-  pname = "glxinfo";
-  version = "8.4.0";
-
-  src = fetchurl {
-    url = "ftp://ftp.freedesktop.org/pub/mesa/demos/mesa-demos-${version}.tar.bz2";
-    sha256 = "0zgzbz55a14hz83gbmm0n9gpjnf5zadzi2kjjvkn6khql2a9rs81";
-  };
-
-  buildInputs = [ libX11 libGL ];
-
-  dontConfigure = true;
-
-  buildPhase = "
-    $CC src/xdemos/{glxinfo.c,glinfo_common.c} -o glxinfo -lGL -lX11
-    $CC src/xdemos/glxgears.c -o glxgears -lGL -lX11 -lm
-    $CC src/egl/opengles2/es2_info.c -o es2_info -lEGL -lGLESv2 -lX11
-    $CC src/egl/opengles2/es2gears.c src/egl/eglut/{eglut.c,eglut_x11.c} -o es2gears -Isrc/egl/eglut -lEGL -lGLESv2 -lX11 -lm
-    $CC src/egl/opengl/eglinfo.c -o eglinfo -lEGL -lGLESv2 -lX11
-  ";
-
-  installPhase = "
-    install -Dm 555 -t $out/bin glx{info,gears} es2{_info,gears} eglinfo
-  ";
-
-  meta = with lib; {
-    description = "Test utilities for OpenGL";
-    homepage = "https://www.mesa3d.org/";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ abbradar ];
-  };
-}
diff --git a/pkgs/tools/graphics/mangohud/default.nix b/pkgs/tools/graphics/mangohud/default.nix
index 3e0837323a34..483be779202c 100644
--- a/pkgs/tools/graphics/mangohud/default.nix
+++ b/pkgs/tools/graphics/mangohud/default.nix
@@ -6,7 +6,6 @@
 , substituteAll
 , coreutils
 , curl
-, glxinfo
 , gnugrep
 , gnused
 , xdg-utils
@@ -18,6 +17,7 @@
 , git
 , glslang
 , mako
+, mesa-demos
 , meson
 , ninja
 , pkg-config
@@ -131,9 +131,9 @@ stdenv.mkDerivation (finalAttrs: {
       path = lib.makeBinPath [
         coreutils
         curl
-        glxinfo
         gnugrep
         gnused
+        mesa-demos
         xdg-utils
       ];
 
diff --git a/pkgs/tools/misc/sheldon/default.nix b/pkgs/tools/misc/sheldon/default.nix
index 3c0618f3de6f..a11692f5d935 100644
--- a/pkgs/tools/misc/sheldon/default.nix
+++ b/pkgs/tools/misc/sheldon/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sheldon";
-  version = "0.7.3";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "rossmacarthur";
     repo = pname;
     rev = version;
-    hash = "sha256-vGFR8NL3bOCUuNr0KQuAbjQMxvFbN/T9aVmf7Wxt9JU=";
+    hash = "sha256-eyfIPO1yXvb+0SeAx+F6/z5iDUA2GfWOiElfjn6abJM=";
   };
 
-  cargoHash = "sha256-wVB+yL+h90f7NnASDaX5gxT5z45M8I1rxIJwY8uyB4k=";
+  cargoHash = "sha256-+yTX1wUfVVjsM42X0QliL+0xbzTPheADZibPh/5Czh8=";
 
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security curl ];
   nativeBuildInputs = [ installShellFiles pkg-config ];
diff --git a/pkgs/tools/networking/flannel/default.nix b/pkgs/tools/networking/flannel/default.nix
index 4f80fa5a374f..83ac450dda0c 100644
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flannel";
-  version = "0.25.5";
+  version = "0.25.6";
   rev = "v${version}";
 
-  vendorHash = "sha256-i8uwHOPRVOCSPnFNr7IFZHkboV+iXrA23pkOmRAix54=";
+  vendorHash = "sha256-telkdlxNUoaZJ8mzKbcBq2sruI0reT9wp+yOLa8RBOs=";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "flannel-io";
     repo = "flannel";
-    sha256 = "sha256-SMOS0ndBV8KySh9E2/vTAznKLZY2LAM7zSNQAiFBiGU=";
+    sha256 = "sha256-72eoAr3Vnvwqcrq1qFqEJY/J3yodICv+uWM484d99b4=";
   };
 
   ldflags = [ "-X github.com/flannel-io/flannel/pkg/version.Version=${rev}" ];
diff --git a/pkgs/tools/security/bitwarden-directory-connector/default.nix b/pkgs/tools/security/bitwarden-directory-connector/default.nix
index 1774598ec44a..7546f4262697 100644
--- a/pkgs/tools/security/bitwarden-directory-connector/default.nix
+++ b/pkgs/tools/security/bitwarden-directory-connector/default.nix
@@ -66,7 +66,7 @@ in {
 
       npm exec electron-builder -- \
         --dir \
-        -c.electronDist=${electron}/libexec/electron \
+        -c.electronDist=${electron.dist} \
         -c.electronVersion=${electron.version} \
         -c.npmRebuild=false
 
diff --git a/pkgs/tools/system/inxi/default.nix b/pkgs/tools/system/inxi/default.nix
index d32f7304ff08..563ff69b4929 100644
--- a/pkgs/tools/system/inxi/default.nix
+++ b/pkgs/tools/system/inxi/default.nix
@@ -4,7 +4,7 @@
 , withRecommendedSystemPrograms ? withRecommends, util-linuxMinimal, dmidecode
 , file, hddtemp, iproute2, ipmitool, usbutils, kmod, lm_sensors, smartmontools
 , binutils, tree, upower, pciutils
-, withRecommendedDisplayInformationPrograms ? withRecommends, glxinfo, xorg
+, withRecommendedDisplayInformationPrograms ? withRecommends, mesa-demos, xorg
 }:
 
 let
@@ -16,7 +16,7 @@ let
   ];
   recommendedDisplayInformationPrograms = lib.optionals
     withRecommendedDisplayInformationPrograms
-    ([ glxinfo ] ++ (with xorg; [ xdpyinfo xprop xrandr ]));
+    ([ mesa-demos ] ++ (with xorg; [ xdpyinfo xprop xrandr ]));
   programs = [ ps dnsutils ] # Core programs
     ++ recommendedSystemPrograms
     ++ recommendedDisplayInformationPrograms;
diff --git a/pkgs/tools/wayland/hyprland-per-window-layout/default.nix b/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
index d1f90a85e5da..a8ad214bc087 100644
--- a/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
+++ b/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprland-per-window-layout";
-  version = "2.12";
+  version = "2.13";
 
   src = fetchFromGitHub {
     owner = "coffebar";
     repo = pname;
     rev = version;
-    hash = "sha256-iDRNlE+NFu8doFDTXxyFhMCm5IUVt1zdfHFqG1WeXHc=";
+    hash = "sha256-Bwdh+Cy5LTRSBDfk4r28FmPRUEHYI++nKRhS9eSSbyg=";
   };
 
-  cargoHash = "sha256-k5GKi9LIHiqJGmoj8M52+Seww7cNirp49VKI4Y2SMqw=";
+  cargoHash = "sha256-GX8Xo/1TwP/y+T1ErIjk+SriXyLpb1JDddYwod8DoxM=";
 
   meta = with lib; {
     description = "Per window keyboard layout (language) for Hyprland wayland compositor";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index fc7af2f90a54..a39866d7d56d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -258,7 +258,7 @@ mapAliases ({
   claws-mail-gtk3 = claws-mail; # Added 2021-07-10
   clucene_core_1 = throw "'clucene_core_1' has been renamed to/replaced by 'clucene_core'"; # Added 2023-12-09
   cntk = throw "'cntk' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2023-10-09
-  cockroachdb = throw "'cockroachdb' has been removed as it was outdated and unmaintained. Use 'cockroachdb-bin' instead"; # 2024-03-15
+  cockroachdb-bin = cockroachdb; # 2024-03-15
   codimd = hedgedoc; # Added 2020-11-29
   inherit (libsForQt5.mauiPackages) communicator; # added 2022-05-17
   compton = throw "'compton' has been renamed to/replaced by 'picom'"; # Converted to throw 2023-09-10
@@ -524,6 +524,7 @@ mapAliases ({
   glew-egl = lib.warn "'glew-egl' is now provided by 'glew' directly" glew; # Added 2024-08-11
   glide = throw "'glide' has been removed as it is unmaintained, please use Go modules instead"; # Added 2023-12-26
   glfw-wayland = glfw; # Added 2024-04-19
+  glxinfo = mesa-demos; # Added 2024-07-04
   gmailieer = lieer; # Added 2020-04-19
   gmic-qt-krita = throw "gmic-qt-krita was removed as it's no longer supported upstream."; # Converted to throw 2023-02-02
   gnatboot11 = gnat-bootstrap11;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9e1bdb50d3fd..2146551a2541 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8128,8 +8128,6 @@ with pkgs;
 
   glogg = libsForQt5.callPackage ../tools/text/glogg { };
 
-  glxinfo = callPackage ../tools/graphics/glxinfo { };
-
   gmrender-resurrect = callPackage ../tools/networking/gmrender-resurrect {
     inherit (gst_all_1) gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav;
   };
@@ -19870,9 +19868,9 @@ with pkgs;
       intel-media-driver
       intel-vaapi-driver
       mesa
+      mesa-demos
       libva-vdpau-driver
       libvdpau-va-gl
-      glxinfo
       vdpauinfo;
   };
 
@@ -26130,7 +26128,7 @@ with pkgs;
 
   cpustat = callPackage ../os-specific/linux/cpustat { };
 
-  cockroachdb-bin = callPackage ../servers/sql/cockroachdb/cockroachdb-bin.nix { };
+  cockroachdb = callPackage ../servers/sql/cockroachdb { };
 
   coconutbattery = callPackage ../os-specific/darwin/coconutbattery { };
 
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index c6a6ce952f71..5a862d26d68b 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -123,6 +123,7 @@ let
       QuickChick = callPackage ../development/coq-modules/QuickChick {};
       reglang = callPackage ../development/coq-modules/reglang {};
       relation-algebra = callPackage ../development/coq-modules/relation-algebra {};
+      rewriter = callPackage ../development/coq-modules/rewriter {};
       semantics = callPackage ../development/coq-modules/semantics {};
       serapi = callPackage ../development/coq-modules/serapi {};
       simple-io = callPackage ../development/coq-modules/simple-io { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index a978222a5fd7..8002965b8f1d 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -196,6 +196,7 @@ mapAliases ({
   flask_principal = flask-principal; # added 2023-08-23
   flask-restplus = throw "flask-restplus is no longer maintained, use flask-restx instead"; # added 2023-02-21
   flask_script = flask-script; # added 2023-08-23
+  flask-security-too = flask-security; # added 2024-08-26
   flask_sqlalchemy = flask-sqlalchemy; # added 2022-07-20
   flask_testing = flask-testing; # added 2022-04-25
   flask_wtf = flask-wtf; # added 2022-05-24
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f44c9acb97a3..3bacc89ac10c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4510,7 +4510,7 @@ self: super: with self; {
 
   flask-session-captcha = callPackage ../development/python-modules/flask-session-captcha { };
 
-  flask-security-too = callPackage ../development/python-modules/flask-security-too { };
+  flask-security = callPackage ../development/python-modules/flask-security { };
 
   flask-silk = callPackage ../development/python-modules/flask-silk { };
 
@@ -4522,6 +4522,8 @@ self: super: with self; {
 
   flask-sqlalchemy = callPackage ../development/python-modules/flask-sqlalchemy { };
 
+  flask-sqlalchemy-lite = callPackage ../development/python-modules/flask-sqlalchemy-lite { };
+
   flask-sslify = callPackage ../development/python-modules/flask-sslify { };
 
   flask-swagger = callPackage ../development/python-modules/flask-swagger { };