about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/scripts/luarocks-packages.csv7
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md2
-rw-r--r--nixos/lib/make-options-doc/default.nix2
-rw-r--r--nixos/modules/hardware/video/webcam/ipu6.nix16
-rw-r--r--nixos/modules/module-list.nix3
-rw-r--r--nixos/modules/system/boot/systemd/journald-gateway.nix135
-rw-r--r--nixos/modules/system/boot/systemd/journald-remote.nix163
-rw-r--r--nixos/modules/system/boot/systemd/journald-upload.nix111
-rw-r--r--nixos/modules/system/boot/systemd/journald.nix21
-rw-r--r--nixos/modules/system/boot/timesyncd.nix7
-rw-r--r--nixos/tests/all-tests.nix3
-rw-r--r--nixos/tests/installer.nix8
-rw-r--r--nixos/tests/os-prober.nix2
-rw-r--r--nixos/tests/systemd-journal-gateway.nix90
-rw-r--r--nixos/tests/systemd-journal-upload.nix101
-rw-r--r--nixos/tests/systemd-journal.nix8
-rw-r--r--nixos/tests/systemd-timesyncd-nscd-dnssec.nix61
-rw-r--r--pkgs/applications/audio/ardour/7.nix7
-rw-r--r--pkgs/applications/audio/quodlibet/default.nix1
-rw-r--r--pkgs/applications/audio/whipper/default.nix4
-rw-r--r--pkgs/applications/blockchains/polkadot/default.nix6
-rw-r--r--pkgs/applications/editors/scite/default.nix6
-rw-r--r--pkgs/applications/graphics/hdrmerge/default.nix5
-rw-r--r--pkgs/applications/graphics/inkscape/default.nix8
-rw-r--r--pkgs/applications/graphics/krita/generic.nix9
-rw-r--r--pkgs/applications/graphics/meshlab/default.nix5
-rw-r--r--pkgs/applications/graphics/tesseract/tesseract4.nix8
-rw-r--r--pkgs/applications/misc/ablog/default.nix1
-rw-r--r--pkgs/applications/misc/acpic/default.nix12
-rw-r--r--pkgs/applications/misc/audio/sox/default.nix2
-rw-r--r--pkgs/applications/misc/barrier/default.nix5
-rw-r--r--pkgs/applications/misc/buku/default.nix5
-rw-r--r--pkgs/applications/misc/keepmenu/default.nix2
-rw-r--r--pkgs/applications/misc/khal/default.nix2
-rw-r--r--pkgs/applications/misc/khard/default.nix1
-rw-r--r--pkgs/applications/misc/mozphab/default.nix2
-rw-r--r--pkgs/applications/misc/mupdf/default.nix8
-rw-r--r--pkgs/applications/misc/octoprint/default.nix2
-rw-r--r--pkgs/applications/misc/pagefind/default.nix6
-rw-r--r--pkgs/applications/misc/pysentation/default.nix11
-rw-r--r--pkgs/applications/misc/urlscan/default.nix2
-rw-r--r--pkgs/applications/misc/yambar/default.nix1
-rw-r--r--pkgs/applications/networking/cloudflare-dyndns/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix2
-rw-r--r--pkgs/applications/networking/mailreaders/notmuch/default.nix33
-rw-r--r--pkgs/applications/networking/newsreaders/liferea/default.nix11
-rw-r--r--pkgs/applications/office/abiword/default.nix9
-rw-r--r--pkgs/applications/office/libreoffice/default.nix15
-rw-r--r--pkgs/applications/office/paperwork/openpaperwork-core.nix2
-rw-r--r--pkgs/applications/office/paperwork/openpaperwork-gtk.nix2
-rw-r--r--pkgs/applications/office/paperwork/paperwork-backend.nix2
-rw-r--r--pkgs/applications/office/paperwork/paperwork-gtk.nix2
-rw-r--r--pkgs/applications/office/paperwork/paperwork-shell.nix2
-rw-r--r--pkgs/applications/office/todoman/default.nix2
-rw-r--r--pkgs/applications/science/electronics/nanovna-saver/default.nix2
-rw-r--r--pkgs/applications/science/machine-learning/fasttext/default.nix6
-rw-r--r--pkgs/applications/science/math/gmsh/default.nix19
-rw-r--r--pkgs/applications/search/recoll/default.nix5
-rw-r--r--pkgs/applications/terminal-emulators/guake/default.nix2
-rw-r--r--pkgs/applications/version-management/git-cola/default.nix2
-rw-r--r--pkgs/applications/version-management/git/default.nix4
-rw-r--r--pkgs/applications/version-management/gitlint/default.nix2
-rw-r--r--pkgs/applications/version-management/mercurial/default.nix12
-rw-r--r--pkgs/applications/video/deface/default.nix3
-rw-r--r--pkgs/applications/video/frigate/default.nix6
-rw-r--r--pkgs/applications/video/handbrake/default.nix6
-rw-r--r--pkgs/applications/video/obs-studio/default.nix24
-rw-r--r--pkgs/applications/virtualization/kvmtool/default.nix9
-rw-r--r--pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix9
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix25
-rw-r--r--pkgs/build-support/bintools-wrapper/setup-hook.sh2
-rw-r--r--pkgs/build-support/cc-wrapper/add-hardening.sh2
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix5
-rw-r--r--pkgs/build-support/cc-wrapper/fortran-hook.sh3
-rw-r--r--pkgs/build-support/cc-wrapper/setup-hook.sh2
-rw-r--r--pkgs/build-support/emacs/melpa.nix4
-rw-r--r--pkgs/build-support/emacs/melpa2nix.el26
-rw-r--r--pkgs/build-support/emacs/package-build-dont-use-mtime.patch43
-rw-r--r--pkgs/build-support/fetchurl/mirrors.nix1
-rw-r--r--pkgs/build-support/rust/hooks/maturin-build-hook.sh2
-rw-r--r--pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh15
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.sh31
-rw-r--r--pkgs/by-name/ai/airlift/package.nix15
-rw-r--r--pkgs/by-name/bi/bitbake-language-server/package.nix2
-rw-r--r--pkgs/by-name/cm/cmake/package.nix2
-rw-r--r--pkgs/by-name/ho/homeassistant-satellite/package.nix6
-rw-r--r--pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch27
-rw-r--r--pkgs/by-name/me/meson/package.nix21
-rw-r--r--pkgs/by-name/si/sirius/package.nix5
-rw-r--r--pkgs/by-name/uc/ucode/package.nix36
-rw-r--r--pkgs/by-name/ud/udebug/package.nix41
-rw-r--r--pkgs/by-name/we/websecprobe/package.nix5
-rw-r--r--pkgs/data/misc/tzdata/default.nix6
-rw-r--r--pkgs/desktops/gnome/apps/gnome-clocks/default.nix2
-rw-r--r--pkgs/desktops/gnome/apps/seahorse/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/baobab/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/gnome-calculator/default.nix2
-rw-r--r--pkgs/desktops/gnome/games/gnome-mines/default.nix5
-rw-r--r--pkgs/development/compilers/binaryen/default.nix9
-rw-r--r--pkgs/development/compilers/blueprint/default.nix3
-rw-r--r--pkgs/development/compilers/dtc/default.nix7
-rw-r--r--pkgs/development/compilers/gcc/default.nix5
-rw-r--r--pkgs/development/compilers/ghc/8.10.2-binary.nix2
-rw-r--r--pkgs/development/compilers/ghc/8.10.7-binary.nix2
-rw-r--r--pkgs/development/compilers/ghc/8.6.5-binary.nix2
-rw-r--r--pkgs/development/compilers/ghc/9.2.4-binary.nix2
-rw-r--r--pkgs/development/compilers/glslang/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/11/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/12/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/13/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/14/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/15/clang/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/16/clang/default.nix11
-rw-r--r--pkgs/development/compilers/llvm/16/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/17/clang/default.nix11
-rw-r--r--pkgs/development/compilers/llvm/17/llvm/default.nix10
-rw-r--r--pkgs/development/compilers/llvm/clang-11-15-LLVMgold-path.patch (renamed from pkgs/development/compilers/llvm/clang-11-12-LLVMgold-path.patch)0
-rw-r--r--pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch14
-rw-r--r--pkgs/development/compilers/llvm/git/clang/default.nix11
-rw-r--r--pkgs/development/compilers/llvm/git/llvm/default.nix9
-rw-r--r--pkgs/development/compilers/rust/1_74.nix61
-rw-r--r--pkgs/development/compilers/rust/1_75.nix61
-rw-r--r--pkgs/development/compilers/rust/rustc.nix8
-rw-r--r--pkgs/development/compilers/spirv-llvm-translator/default.nix24
-rw-r--r--pkgs/development/compilers/swift/compiler/default.nix7
-rw-r--r--pkgs/development/compilers/vala/setup-hook.sh2
-rw-r--r--pkgs/development/embedded/fpga/tinyprog/default.nix4
-rw-r--r--pkgs/development/interpreters/lua-5/interpreter.nix4
-rw-r--r--pkgs/development/interpreters/python/default.nix4
-rw-r--r--pkgs/development/interpreters/python/hooks/default.nix10
-rw-r--r--pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.py97
-rw-r--r--pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.sh20
-rw-r--r--pkgs/development/interpreters/python/mk-python-derivation.nix8
-rw-r--r--pkgs/development/interpreters/python/pypy/default.nix17
-rw-r--r--pkgs/development/interpreters/ruby/default.nix1
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch12
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch10
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/default.nix4
-rw-r--r--pkgs/development/libraries/aspell/default.nix15
-rw-r--r--pkgs/development/libraries/audio/lilv/default.nix6
-rw-r--r--pkgs/development/libraries/aws-c-auth/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-cal/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-common/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-event-stream/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-http/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-io/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-mqtt/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-s3/default.nix4
-rw-r--r--pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch36
-rw-r--r--pkgs/development/libraries/aws-crt-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch65
-rw-r--r--pkgs/development/libraries/aws-sdk-cpp/default.nix49
-rw-r--r--pkgs/development/libraries/cyrus-sasl/default.nix4
-rw-r--r--pkgs/development/libraries/directx-headers/default.nix4
-rw-r--r--pkgs/development/libraries/draco/default.nix5
-rw-r--r--pkgs/development/libraries/enchant/2.x.nix13
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix2
-rw-r--r--pkgs/development/libraries/ffmpeg/5.nix2
-rw-r--r--pkgs/development/libraries/ffmpeg/6.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix56
-rw-r--r--pkgs/development/libraries/futuresql/default.nix3
-rw-r--r--pkgs/development/libraries/gbenchmark/default.nix7
-rw-r--r--pkgs/development/libraries/gcc/libgcc/default.nix1
-rw-r--r--pkgs/development/libraries/gjs/default.nix4
-rw-r--r--pkgs/development/libraries/glib/default.nix4
-rw-r--r--pkgs/development/libraries/glib/split-dev-programs.patch81
-rw-r--r--pkgs/development/libraries/google-cloud-cpp/default.nix13
-rw-r--r--pkgs/development/libraries/gpgme/default.nix8
-rw-r--r--pkgs/development/libraries/gstreamer/bad/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/base/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/core/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/devtools/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/ges/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/good/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/icamerasrc/default.nix8
-rw-r--r--pkgs/development/libraries/gstreamer/libav/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/rtsp-server/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/ugly/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/vaapi/default.nix4
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix4
-rw-r--r--pkgs/development/libraries/gtk/4.x.nix12
-rw-r--r--pkgs/development/libraries/gumbo/default.nix21
-rw-r--r--pkgs/development/libraries/hfst-ospell/default.nix10
-rw-r--r--pkgs/development/libraries/intel-media-sdk/default.nix11
-rw-r--r--pkgs/development/libraries/ipu6-camera-hal/default.nix41
-rw-r--r--pkgs/development/libraries/jbig2dec/default.nix8
-rw-r--r--pkgs/development/libraries/jellyfin-ffmpeg/default.nix9
-rw-r--r--pkgs/development/libraries/json-c/default.nix29
-rw-r--r--pkgs/development/libraries/kde-frameworks/default.nix3
-rw-r--r--pkgs/development/libraries/kde-frameworks/fetch.sh2
-rw-r--r--pkgs/development/libraries/kde-frameworks/oxygen-icons.nix (renamed from pkgs/development/libraries/kde-frameworks/oxygen-icons5.nix)2
-rw-r--r--pkgs/development/libraries/kde-frameworks/srcs.nix666
-rw-r--r--pkgs/development/libraries/kdsoap/default.nix18
-rw-r--r--pkgs/development/libraries/kquickimageedit/default.nix9
-rw-r--r--pkgs/development/libraries/lcms2/default.nix4
-rw-r--r--pkgs/development/libraries/libao/default.nix12
-rw-r--r--pkgs/development/libraries/libaom/default.nix4
-rw-r--r--pkgs/development/libraries/libaom/outputs.patch2
-rw-r--r--pkgs/development/libraries/libavif/default.nix4
-rw-r--r--pkgs/development/libraries/libde265/default.nix8
-rw-r--r--pkgs/development/libraries/libdrm/default.nix4
-rw-r--r--pkgs/development/libraries/libe57format/default.nix4
-rw-r--r--pkgs/development/libraries/libei/default.nix20
-rw-r--r--pkgs/development/libraries/libelf/default.nix15
-rw-r--r--pkgs/development/libraries/libgcrypt/default.nix3
-rw-r--r--pkgs/development/libraries/libgnome-games-support/default.nix2
-rw-r--r--pkgs/development/libraries/libimobiledevice/default.nix11
-rw-r--r--pkgs/development/libraries/libjodycode/default.nix29
-rw-r--r--pkgs/development/libraries/libjxl/default.nix1
-rw-r--r--pkgs/development/libraries/liblangtag/default.nix16
-rw-r--r--pkgs/development/libraries/libmusicbrainz/5.x.nix14
-rw-r--r--pkgs/development/libraries/libosinfo/default.nix6
-rw-r--r--pkgs/development/libraries/libqaccessibilityclient/default.nix5
-rw-r--r--pkgs/development/libraries/libquotient/default.nix5
-rw-r--r--pkgs/development/libraries/librsvg/default.nix6
-rw-r--r--pkgs/development/libraries/libsass/default.nix24
-rw-r--r--pkgs/development/libraries/libseccomp/default.nix4
-rw-r--r--pkgs/development/libraries/libsecret/default.nix4
-rw-r--r--pkgs/development/libraries/libssh/default.nix6
-rw-r--r--pkgs/development/libraries/libssh2/CVE-2023-48795.patch459
-rw-r--r--pkgs/development/libraries/libssh2/default.nix6
-rw-r--r--pkgs/development/libraries/libtins/default.nix13
-rw-r--r--pkgs/development/libraries/libubox/default.nix6
-rw-r--r--pkgs/development/libraries/libvirt-glib/default.nix16
-rw-r--r--pkgs/development/libraries/libvmaf/default.nix49
-rw-r--r--pkgs/development/libraries/libwacom/default.nix24
-rw-r--r--pkgs/development/libraries/libxml2/default.nix12
-rw-r--r--pkgs/development/libraries/mesa/backports/0001-dri-added-build-dependencies-for-systems-using-non-s.patch56
-rw-r--r--pkgs/development/libraries/mesa/backports/0002-util-Update-util-libdrm.h-stubs-to-allow-loader.c-to.patch103
-rw-r--r--pkgs/development/libraries/mesa/backports/0003-glx-fix-automatic-zink-fallback-loading-between-hw-a.patch53
-rw-r--r--pkgs/development/libraries/mesa/default.nix57
-rw-r--r--pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch27
-rw-r--r--pkgs/development/libraries/mesa/opencl.patch26
-rw-r--r--pkgs/development/libraries/mlt/default.nix18
-rw-r--r--pkgs/development/libraries/nss/esr.nix4
-rw-r--r--pkgs/development/libraries/nv-codec-headers/12_x.nix4
-rw-r--r--pkgs/development/libraries/opencollada/default.nix12
-rw-r--r--pkgs/development/libraries/plasma-wayland-protocols/default.nix4
-rw-r--r--pkgs/development/libraries/polkit/default.nix22
-rw-r--r--pkgs/development/libraries/precice/default.nix6
-rw-r--r--pkgs/development/libraries/proj/7.nix4
-rw-r--r--pkgs/development/libraries/proj/default.nix4
-rw-r--r--pkgs/development/libraries/qca-qt5/default.nix30
-rw-r--r--pkgs/development/libraries/qca/default.nix35
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json160
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs.nix10
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtwebengine.nix4
-rw-r--r--pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch22
-rw-r--r--pkgs/development/libraries/qtforkawesome/default.nix1
-rw-r--r--pkgs/development/libraries/qtutilities/default.nix1
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/srt/default.nix1
-rw-r--r--pkgs/development/libraries/tbb/default.nix10
-rw-r--r--pkgs/development/libraries/termcolor/default.nix4
-rw-r--r--pkgs/development/libraries/ubus/default.nix6
-rw-r--r--pkgs/development/libraries/unittest-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/ustream-ssl/default.nix6
-rw-r--r--pkgs/development/libraries/vtk/generic.nix18
-rw-r--r--pkgs/development/libraries/x264/default.nix4
-rw-r--r--pkgs/development/libraries/xapian/default.nix2
-rw-r--r--pkgs/development/libraries/xmlsec/default.nix8
-rw-r--r--pkgs/development/libraries/xsimd/default.nix4
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix361
-rw-r--r--pkgs/development/lua-modules/overrides.nix31
-rw-r--r--pkgs/development/python-modules/absl-py/default.nix11
-rw-r--r--pkgs/development/python-modules/acquire/default.nix2
-rw-r--r--pkgs/development/python-modules/adafruit-io/default.nix2
-rw-r--r--pkgs/development/python-modules/adafruit-platformdetect/default.nix2
-rw-r--r--pkgs/development/python-modules/adext/default.nix2
-rw-r--r--pkgs/development/python-modules/aenum/default.nix11
-rw-r--r--pkgs/development/python-modules/afdko/default.nix21
-rw-r--r--pkgs/development/python-modules/afsapi/default.nix2
-rw-r--r--pkgs/development/python-modules/aiobotocore/default.nix8
-rw-r--r--pkgs/development/python-modules/aioconsole/default.nix2
-rw-r--r--pkgs/development/python-modules/aiocron/default.nix7
-rw-r--r--pkgs/development/python-modules/aiodns/default.nix25
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix20
-rw-r--r--pkgs/development/python-modules/aiogithubapi/default.nix6
-rw-r--r--pkgs/development/python-modules/aiogram/default.nix31
-rw-r--r--pkgs/development/python-modules/aioguardian/default.nix2
-rw-r--r--pkgs/development/python-modules/aiohappyeyeballs/default.nix34
-rw-r--r--pkgs/development/python-modules/aiohttp-jinja2/default.nix4
-rw-r--r--pkgs/development/python-modules/aiohttp-socks/default.nix37
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix62
-rw-r--r--pkgs/development/python-modules/aiohttp/unvendor-llhttp.patch60
-rw-r--r--pkgs/development/python-modules/aiojobs/default.nix4
-rw-r--r--pkgs/development/python-modules/aionotion/default.nix24
-rw-r--r--pkgs/development/python-modules/aiooss2/default.nix2
-rw-r--r--pkgs/development/python-modules/aiopurpleair/default.nix26
-rw-r--r--pkgs/development/python-modules/aiopurpleair/pydantic_2-compatibility.patch111
-rw-r--r--pkgs/development/python-modules/aiopvapi/default.nix4
-rw-r--r--pkgs/development/python-modules/aioquic/default.nix13
-rw-r--r--pkgs/development/python-modules/aioresponses/default.nix30
-rw-r--r--pkgs/development/python-modules/aioridwell/default.nix2
-rw-r--r--pkgs/development/python-modules/aiormq/default.nix10
-rw-r--r--pkgs/development/python-modules/aioshutil/default.nix2
-rw-r--r--pkgs/development/python-modules/aiounittest/default.nix13
-rw-r--r--pkgs/development/python-modules/aiowatttime/default.nix25
-rw-r--r--pkgs/development/python-modules/alembic/default.nix4
-rw-r--r--pkgs/development/python-modules/amazon-ion/default.nix4
-rw-r--r--pkgs/development/python-modules/amberelectric/default.nix17
-rw-r--r--pkgs/development/python-modules/amqtt/default.nix15
-rw-r--r--pkgs/development/python-modules/ansible-vault-rw/default.nix35
-rw-r--r--pkgs/development/python-modules/ansible/default.nix4
-rw-r--r--pkgs/development/python-modules/ansiwrap/default.nix3
-rw-r--r--pkgs/development/python-modules/antlr4-python3-runtime/default.nix12
-rw-r--r--pkgs/development/python-modules/anyio/default.nix12
-rw-r--r--pkgs/development/python-modules/apache-beam/default.nix8
-rw-r--r--pkgs/development/python-modules/apipkg/default.nix2
-rw-r--r--pkgs/development/python-modules/app-model/default.nix2
-rw-r--r--pkgs/development/python-modules/appthreat-vulnerability-db/default.nix1
-rw-r--r--pkgs/development/python-modules/apricot-select/default.nix6
-rw-r--r--pkgs/development/python-modules/apsw/default.nix4
-rw-r--r--pkgs/development/python-modules/argcomplete/default.nix2
-rw-r--r--pkgs/development/python-modules/argh/default.nix4
-rw-r--r--pkgs/development/python-modules/ariadne/default.nix4
-rw-r--r--pkgs/development/python-modules/array-record/default.nix3
-rw-r--r--pkgs/development/python-modules/arrow/default.nix21
-rw-r--r--pkgs/development/python-modules/asdf/default.nix2
-rw-r--r--pkgs/development/python-modules/asn1crypto/default.nix20
-rw-r--r--pkgs/development/python-modules/aspectlib/default.nix8
-rw-r--r--pkgs/development/python-modules/asteval/default.nix2
-rw-r--r--pkgs/development/python-modules/astroid/default.nix31
-rw-r--r--pkgs/development/python-modules/astropy-extension-helpers/default.nix11
-rw-r--r--pkgs/development/python-modules/astropy-healpix/default.nix8
-rw-r--r--pkgs/development/python-modules/astropy-iers-data/default.nix41
-rw-r--r--pkgs/development/python-modules/astropy/default.nix21
-rw-r--r--pkgs/development/python-modules/asttokens/default.nix4
-rw-r--r--pkgs/development/python-modules/async-generator/default.nix5
-rw-r--r--pkgs/development/python-modules/async-tkinter-loop/default.nix4
-rw-r--r--pkgs/development/python-modules/asyncclick/default.nix2
-rw-r--r--pkgs/development/python-modules/asyncio-mqtt/default.nix5
-rw-r--r--pkgs/development/python-modules/asyncpg/default.nix4
-rw-r--r--pkgs/development/python-modules/atom/default.nix2
-rw-r--r--pkgs/development/python-modules/audible/default.nix47
-rw-r--r--pkgs/development/python-modules/audioread/default.nix11
-rw-r--r--pkgs/development/python-modules/auth0-python/default.nix9
-rw-r--r--pkgs/development/python-modules/autocommand/default.nix12
-rw-r--r--pkgs/development/python-modules/autopage/default.nix4
-rw-r--r--pkgs/development/python-modules/avidtools/default.nix6
-rw-r--r--pkgs/development/python-modules/avro/default.nix4
-rw-r--r--pkgs/development/python-modules/aw-core/default.nix7
-rw-r--r--pkgs/development/python-modules/awesomeversion/default.nix28
-rw-r--r--pkgs/development/python-modules/aws-adfs/default.nix6
-rw-r--r--pkgs/development/python-modules/aws-sam-translator/default.nix2
-rw-r--r--pkgs/development/python-modules/aws-xray-sdk/default.nix7
-rw-r--r--pkgs/development/python-modules/awslambdaric/default.nix10
-rw-r--r--pkgs/development/python-modules/ax/default.nix2
-rw-r--r--pkgs/development/python-modules/azure-storage-blob/default.nix4
-rw-r--r--pkgs/development/python-modules/b2sdk/default.nix5
-rw-r--r--pkgs/development/python-modules/babel/default.nix15
-rw-r--r--pkgs/development/python-modules/backports-cached-property/default.nix2
-rw-r--r--pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix24
-rw-r--r--pkgs/development/python-modules/bacpypes/default.nix4
-rw-r--r--pkgs/development/python-modules/bagit/default.nix2
-rw-r--r--pkgs/development/python-modules/barectf/default.nix21
-rw-r--r--pkgs/development/python-modules/bbox/default.nix19
-rw-r--r--pkgs/development/python-modules/bcrypt/default.nix10
-rw-r--r--pkgs/development/python-modules/beautifulsoup4/default.nix13
-rw-r--r--pkgs/development/python-modules/bentoml/default.nix2
-rw-r--r--pkgs/development/python-modules/bids-validator/default.nix15
-rw-r--r--pkgs/development/python-modules/billiard/default.nix4
-rw-r--r--pkgs/development/python-modules/bimmer-connected/default.nix5
-rw-r--r--pkgs/development/python-modules/bitstring/default.nix4
-rw-r--r--pkgs/development/python-modules/blackjax/default.nix2
-rw-r--r--pkgs/development/python-modules/bleach/default.nix14
-rw-r--r--pkgs/development/python-modules/blinker/default.nix12
-rw-r--r--pkgs/development/python-modules/blinkpy/default.nix3
-rw-r--r--pkgs/development/python-modules/blosc2/default.nix8
-rw-r--r--pkgs/development/python-modules/bokeh/default.nix4
-rw-r--r--pkgs/development/python-modules/bootstrap/packaging/default.nix30
-rw-r--r--pkgs/development/python-modules/bork/default.nix11
-rw-r--r--pkgs/development/python-modules/boto3/default.nix8
-rw-r--r--pkgs/development/python-modules/botocore/default.nix9
-rw-r--r--pkgs/development/python-modules/botorch/default.nix2
-rw-r--r--pkgs/development/python-modules/bottle/default.nix16
-rw-r--r--pkgs/development/python-modules/branca/default.nix2
-rw-r--r--pkgs/development/python-modules/broadbean/default.nix5
-rw-r--r--pkgs/development/python-modules/build/default.nix5
-rw-r--r--pkgs/development/python-modules/buildcatrust/default.nix14
-rw-r--r--pkgs/development/python-modules/bwapy/default.nix7
-rw-r--r--pkgs/development/python-modules/bytecode/default.nix2
-rw-r--r--pkgs/development/python-modules/bytewax/Cargo.lock1470
-rw-r--r--pkgs/development/python-modules/bytewax/default.nix42
-rw-r--r--pkgs/development/python-modules/bytewax/remove-docs-test.patch10
-rw-r--r--pkgs/development/python-modules/cachetools/default.nix17
-rw-r--r--pkgs/development/python-modules/cattrs/default.nix16
-rw-r--r--pkgs/development/python-modules/cbor2/default.nix39
-rw-r--r--pkgs/development/python-modules/certifi/default.nix11
-rw-r--r--pkgs/development/python-modules/cfn-lint/default.nix14
-rw-r--r--pkgs/development/python-modules/cftime/default.nix14
-rw-r--r--pkgs/development/python-modules/charset-normalizer/default.nix4
-rw-r--r--pkgs/development/python-modules/chart-studio/default.nix15
-rw-r--r--pkgs/development/python-modules/cheroot/default.nix13
-rw-r--r--pkgs/development/python-modules/cirq-core/default.nix4
-rw-r--r--pkgs/development/python-modules/click-odoo-contrib/default.nix2
-rw-r--r--pkgs/development/python-modules/click-odoo/default.nix2
-rw-r--r--pkgs/development/python-modules/click-repl/default.nix23
-rw-r--r--pkgs/development/python-modules/click/default.nix5
-rw-r--r--pkgs/development/python-modules/clickgen/default.nix15
-rw-r--r--pkgs/development/python-modules/clickhouse-cli/default.nix11
-rw-r--r--pkgs/development/python-modules/cliff/default.nix4
-rw-r--r--pkgs/development/python-modules/cloudpickle/default.nix33
-rw-r--r--pkgs/development/python-modules/coconut/default.nix27
-rw-r--r--pkgs/development/python-modules/coffea/default.nix2
-rw-r--r--pkgs/development/python-modules/cohere/default.nix4
-rw-r--r--pkgs/development/python-modules/colorlog/default.nix19
-rw-r--r--pkgs/development/python-modules/colout/default.nix2
-rw-r--r--pkgs/development/python-modules/comm/default.nix4
-rw-r--r--pkgs/development/python-modules/confight/default.nix7
-rw-r--r--pkgs/development/python-modules/confluent-kafka/default.nix4
-rw-r--r--pkgs/development/python-modules/connexion/default.nix78
-rw-r--r--pkgs/development/python-modules/constantly/default.nix42
-rw-r--r--pkgs/development/python-modules/construct/default.nix4
-rw-r--r--pkgs/development/python-modules/container-inspector/default.nix2
-rw-r--r--pkgs/development/python-modules/contourpy/default.nix4
-rw-r--r--pkgs/development/python-modules/cookiecutter/default.nix13
-rw-r--r--pkgs/development/python-modules/correctionlib/default.nix3
-rw-r--r--pkgs/development/python-modules/coverage/default.nix12
-rw-r--r--pkgs/development/python-modules/cpyparsing/default.nix4
-rw-r--r--pkgs/development/python-modules/croniter/default.nix13
-rw-r--r--pkgs/development/python-modules/curio/default.nix10
-rw-r--r--pkgs/development/python-modules/curtsies/default.nix5
-rw-r--r--pkgs/development/python-modules/cvelib/default.nix2
-rw-r--r--pkgs/development/python-modules/cwl-upgrader/default.nix4
-rw-r--r--pkgs/development/python-modules/cwl-utils/default.nix4
-rw-r--r--pkgs/development/python-modules/cycler/default.nix42
-rw-r--r--pkgs/development/python-modules/cysignals/default.nix8
-rw-r--r--pkgs/development/python-modules/cython/default.nix (renamed from pkgs/development/python-modules/Cython/default.nix)3
-rw-r--r--pkgs/development/python-modules/cython/setup-hook.sh (renamed from pkgs/development/python-modules/Cython/setup-hook.sh)0
-rw-r--r--pkgs/development/python-modules/cython/trashcan.patch (renamed from pkgs/development/python-modules/Cython/trashcan.patch)0
-rw-r--r--pkgs/development/python-modules/daiquiri/default.nix8
-rw-r--r--pkgs/development/python-modules/dask-awkward/default.nix2
-rw-r--r--pkgs/development/python-modules/dask-histogram/default.nix2
-rw-r--r--pkgs/development/python-modules/databricks-cli/default.nix4
-rw-r--r--pkgs/development/python-modules/databricks-sql-connector/default.nix4
-rw-r--r--pkgs/development/python-modules/datasets/default.nix10
-rw-r--r--pkgs/development/python-modules/dbt-bigquery/default.nix4
-rw-r--r--pkgs/development/python-modules/dbt-semantic-interfaces/default.nix2
-rw-r--r--pkgs/development/python-modules/dbt-snowflake/default.nix4
-rw-r--r--pkgs/development/python-modules/dbus-deviation/default.nix6
-rw-r--r--pkgs/development/python-modules/dbus-python/default.nix (renamed from pkgs/development/python-modules/dbus/default.nix)5
-rw-r--r--pkgs/development/python-modules/dbus-python/fix-includedir.patch (renamed from pkgs/development/python-modules/dbus/fix-includedir.patch)0
-rw-r--r--pkgs/development/python-modules/ddt/default.nix38
-rw-r--r--pkgs/development/python-modules/deal/default.nix4
-rw-r--r--pkgs/development/python-modules/debian-inspector/default.nix2
-rw-r--r--pkgs/development/python-modules/deepdiff/default.nix4
-rw-r--r--pkgs/development/python-modules/deepmerge/default.nix21
-rw-r--r--pkgs/development/python-modules/deltachat/default.nix2
-rw-r--r--pkgs/development/python-modules/demetriek/default.nix13
-rw-r--r--pkgs/development/python-modules/dependency-injector/default.nix2
-rw-r--r--pkgs/development/python-modules/devolo-home-control-api/default.nix2
-rw-r--r--pkgs/development/python-modules/devolo-plc-api/default.nix2
-rw-r--r--pkgs/development/python-modules/dictdiffer/default.nix2
-rw-r--r--pkgs/development/python-modules/diff-cover/default.nix4
-rw-r--r--pkgs/development/python-modules/dirty-equals/default.nix4
-rw-r--r--pkgs/development/python-modules/diskcache/default.nix4
-rw-r--r--pkgs/development/python-modules/dissect-cim/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-clfs/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-cobaltstrike/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-cstruct/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-esedb/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-etl/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-eventlog/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-evidence/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-executable/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-extfs/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-fat/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-ffs/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-hypervisor/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-ntfs/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-ole/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-regf/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-shellitem/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-sql/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-squashfs/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-target/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-thumbcache/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-util/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-vmfs/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-volume/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect-xfs/default.nix2
-rw-r--r--pkgs/development/python-modules/dissect/default.nix2
-rw-r--r--pkgs/development/python-modules/distributed/default.nix6
-rw-r--r--pkgs/development/python-modules/dj-rest-auth/default.nix11
-rw-r--r--pkgs/development/python-modules/django-anymail/default.nix8
-rw-r--r--pkgs/development/python-modules/django-auditlog/default.nix2
-rw-r--r--pkgs/development/python-modules/django-bootstrap3/default.nix14
-rw-r--r--pkgs/development/python-modules/django-bootstrap4/default.nix10
-rw-r--r--pkgs/development/python-modules/django-ckeditor/default.nix2
-rw-r--r--pkgs/development/python-modules/django-hijack/default.nix2
-rw-r--r--pkgs/development/python-modules/django-js-asset/default.nix4
-rw-r--r--pkgs/development/python-modules/django-login-required-middleware/default.nix2
-rw-r--r--pkgs/development/python-modules/django-mailman3/default.nix4
-rw-r--r--pkgs/development/python-modules/django-maintenance-mode/default.nix4
-rw-r--r--pkgs/development/python-modules/django-model-utils/default.nix2
-rw-r--r--pkgs/development/python-modules/django-ninja/default.nix9
-rw-r--r--pkgs/development/python-modules/django-pattern-library/default.nix6
-rw-r--r--pkgs/development/python-modules/django-payments/default.nix2
-rw-r--r--pkgs/development/python-modules/django-phonenumber-field/default.nix2
-rw-r--r--pkgs/development/python-modules/django-simple-history/default.nix2
-rw-r--r--pkgs/development/python-modules/django-tables2/default.nix58
-rw-r--r--pkgs/development/python-modules/django-types/default.nix20
-rw-r--r--pkgs/development/python-modules/django-vite/default.nix4
-rw-r--r--pkgs/development/python-modules/django-widget-tweaks/default.nix2
-rw-r--r--pkgs/development/python-modules/django/4.nix4
-rw-r--r--pkgs/development/python-modules/djangorestframework-stubs/default.nix2
-rw-r--r--pkgs/development/python-modules/docker/default.nix49
-rw-r--r--pkgs/development/python-modules/dockerspawner/default.nix9
-rw-r--r--pkgs/development/python-modules/docstring-to-markdown/default.nix4
-rw-r--r--pkgs/development/python-modules/dominate/default.nix11
-rw-r--r--pkgs/development/python-modules/dtschema/default.nix2
-rw-r--r--pkgs/development/python-modules/duckdb/default.nix1
-rw-r--r--pkgs/development/python-modules/dunamai/default.nix4
-rw-r--r--pkgs/development/python-modules/duo-client/default.nix9
-rw-r--r--pkgs/development/python-modules/dvc-data/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-http/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-objects/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-render/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-studio-client/default.nix2
-rw-r--r--pkgs/development/python-modules/dvc-task/default.nix2
-rw-r--r--pkgs/development/python-modules/dvclive/default.nix2
-rw-r--r--pkgs/development/python-modules/dynalite-devices/default.nix9
-rw-r--r--pkgs/development/python-modules/echo/default.nix2
-rw-r--r--pkgs/development/python-modules/edk2-pytool-library/default.nix2
-rw-r--r--pkgs/development/python-modules/elasticsearch/default.nix46
-rw-r--r--pkgs/development/python-modules/email-validator/default.nix4
-rw-r--r--pkgs/development/python-modules/emcee/default.nix2
-rw-r--r--pkgs/development/python-modules/enaml/default.nix2
-rw-r--r--pkgs/development/python-modules/eventlet/default.nix34
-rw-r--r--pkgs/development/python-modules/eventlet/remove-distutils-usage.patch143
-rw-r--r--pkgs/development/python-modules/exceptiongroup/default.nix6
-rw-r--r--pkgs/development/python-modules/executing/default.nix25
-rw-r--r--pkgs/development/python-modules/expandvars/default.nix23
-rw-r--r--pkgs/development/python-modules/faker/default.nix11
-rw-r--r--pkgs/development/python-modules/farm-haystack/default.nix2
-rw-r--r--pkgs/development/python-modules/fast-histogram/default.nix2
-rw-r--r--pkgs/development/python-modules/fastapi-mail/default.nix12
-rw-r--r--pkgs/development/python-modules/fastapi/default.nix26
-rw-r--r--pkgs/development/python-modules/fastavro/default.nix4
-rw-r--r--pkgs/development/python-modules/fasteners/default.nix4
-rw-r--r--pkgs/development/python-modules/fastjsonschema/default.nix4
-rw-r--r--pkgs/development/python-modules/fastnumbers/default.nix4
-rw-r--r--pkgs/development/python-modules/fastparquet/default.nix2
-rw-r--r--pkgs/development/python-modules/filecheck/default.nix15
-rw-r--r--pkgs/development/python-modules/filelock/default.nix4
-rw-r--r--pkgs/development/python-modules/flasgger/default.nix5
-rw-r--r--pkgs/development/python-modules/flask-appbuilder/default.nix4
-rw-r--r--pkgs/development/python-modules/flask-assets/default.nix27
-rw-r--r--pkgs/development/python-modules/flask-compress/default.nix2
-rw-r--r--pkgs/development/python-modules/flask-security-too/default.nix3
-rw-r--r--pkgs/development/python-modules/flask-sqlalchemy/default.nix6
-rw-r--r--pkgs/development/python-modules/flit-scm/default.nix2
-rw-r--r--pkgs/development/python-modules/flow-record/default.nix2
-rw-r--r--pkgs/development/python-modules/folium/default.nix2
-rw-r--r--pkgs/development/python-modules/fonttools/default.nix4
-rw-r--r--pkgs/development/python-modules/formulaic/default.nix2
-rw-r--r--pkgs/development/python-modules/fpylll/default.nix42
-rw-r--r--pkgs/development/python-modules/freezegun/default.nix20
-rw-r--r--pkgs/development/python-modules/ftfy/default.nix21
-rw-r--r--pkgs/development/python-modules/fugashi/default.nix2
-rw-r--r--pkgs/development/python-modules/future/default.nix22
-rw-r--r--pkgs/development/python-modules/galois/default.nix2
-rw-r--r--pkgs/development/python-modules/geoalchemy2/default.nix4
-rw-r--r--pkgs/development/python-modules/geocachingapi/default.nix2
-rw-r--r--pkgs/development/python-modules/geojson/default.nix12
-rw-r--r--pkgs/development/python-modules/geopy/default.nix7
-rw-r--r--pkgs/development/python-modules/geventhttpclient/default.nix4
-rw-r--r--pkgs/development/python-modules/gitdb/default.nix6
-rw-r--r--pkgs/development/python-modules/gitpython/default.nix4
-rw-r--r--pkgs/development/python-modules/glueviz/default.nix2
-rw-r--r--pkgs/development/python-modules/glyphslib/default.nix2
-rw-r--r--pkgs/development/python-modules/google-api-core/default.nix4
-rw-r--r--pkgs/development/python-modules/google-api-python-client/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-bigquery/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-iam/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-kms/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-storage/default.nix17
-rw-r--r--pkgs/development/python-modules/googleapis-common-protos/default.nix16
-rw-r--r--pkgs/development/python-modules/gpsoauth/default.nix16
-rw-r--r--pkgs/development/python-modules/gpytorch/default.nix2
-rw-r--r--pkgs/development/python-modules/gradio-pdf/default.nix50
-rw-r--r--pkgs/development/python-modules/gradio/client.nix48
-rw-r--r--pkgs/development/python-modules/gradio/conftest-skip-network-errors.py2
-rw-r--r--pkgs/development/python-modules/gradio/default.nix55
-rw-r--r--pkgs/development/python-modules/graphviz/default.nix14
-rw-r--r--pkgs/development/python-modules/graspologic/default.nix11
-rw-r--r--pkgs/development/python-modules/griffe/default.nix2
-rw-r--r--pkgs/development/python-modules/grpc-google-iam-v1/default.nix16
-rw-r--r--pkgs/development/python-modules/grpcio-status/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio-tools/default.nix4
-rw-r--r--pkgs/development/python-modules/grpcio/default.nix4
-rw-r--r--pkgs/development/python-modules/gst-python/default.nix6
-rw-r--r--pkgs/development/python-modules/gunicorn/default.nix46
-rw-r--r--pkgs/development/python-modules/guppy3/default.nix8
-rw-r--r--pkgs/development/python-modules/h5netcdf/default.nix6
-rw-r--r--pkgs/development/python-modules/h5py/default.nix4
-rw-r--r--pkgs/development/python-modules/ha-mqtt-discoverable/default.nix1
-rw-r--r--pkgs/development/python-modules/hass-nabucasa/default.nix6
-rw-r--r--pkgs/development/python-modules/hatch-vcs/default.nix7
-rw-r--r--pkgs/development/python-modules/hatchling/default.nix4
-rw-r--r--pkgs/development/python-modules/help2man/default.nix2
-rw-r--r--pkgs/development/python-modules/histoprint/default.nix2
-rw-r--r--pkgs/development/python-modules/hiyapyco/default.nix15
-rw-r--r--pkgs/development/python-modules/hledger-utils/default.nix2
-rw-r--r--pkgs/development/python-modules/html5tagger/default.nix2
-rw-r--r--pkgs/development/python-modules/http-message-signatures/default.nix2
-rw-r--r--pkgs/development/python-modules/httpbin/default.nix45
-rw-r--r--pkgs/development/python-modules/httpcore/default.nix34
-rw-r--r--pkgs/development/python-modules/httplib2/default.nix4
-rw-r--r--pkgs/development/python-modules/httptools/default.nix4
-rw-r--r--pkgs/development/python-modules/httpx/default.nix19
-rw-r--r--pkgs/development/python-modules/huggingface-hub/default.nix4
-rw-r--r--pkgs/development/python-modules/humanize/default.nix2
-rw-r--r--pkgs/development/python-modules/huum/default.nix2
-rw-r--r--pkgs/development/python-modules/hypothesis/default.nix12
-rw-r--r--pkgs/development/python-modules/hypothesmith/default.nix4
-rw-r--r--pkgs/development/python-modules/iaqualink/default.nix2
-rw-r--r--pkgs/development/python-modules/ibis-framework/default.nix9
-rw-r--r--pkgs/development/python-modules/icecream/default.nix46
-rw-r--r--pkgs/development/python-modules/idna/default.nix4
-rw-r--r--pkgs/development/python-modules/ifcopenshell/default.nix4
-rw-r--r--pkgs/development/python-modules/immutabledict/default.nix4
-rw-r--r--pkgs/development/python-modules/importlib-metadata/default.nix4
-rw-r--r--pkgs/development/python-modules/importlib-resources/default.nix4
-rw-r--r--pkgs/development/python-modules/imread/default.nix4
-rw-r--r--pkgs/development/python-modules/inflect/default.nix5
-rw-r--r--pkgs/development/python-modules/ipadic/default.nix2
-rw-r--r--pkgs/development/python-modules/ipython-genutils/default.nix4
-rw-r--r--pkgs/development/python-modules/ipython/default.nix4
-rw-r--r--pkgs/development/python-modules/islpy/default.nix5
-rw-r--r--pkgs/development/python-modules/iso8601/default.nix5
-rw-r--r--pkgs/development/python-modules/iterative-telemetry/default.nix2
-rw-r--r--pkgs/development/python-modules/itsdangerous/default.nix4
-rw-r--r--pkgs/development/python-modules/jaraco-abode/default.nix7
-rw-r--r--pkgs/development/python-modules/jaraco-classes/default.nix2
-rw-r--r--pkgs/development/python-modules/jaraco-collections/default.nix2
-rw-r--r--pkgs/development/python-modules/jaraco-context/default.nix2
-rw-r--r--pkgs/development/python-modules/jaraco-email/default.nix2
-rw-r--r--pkgs/development/python-modules/jaraco-functools/default.nix4
-rw-r--r--pkgs/development/python-modules/jaraco-net/default.nix2
-rw-r--r--pkgs/development/python-modules/jaraco-text/default.nix4
-rw-r--r--pkgs/development/python-modules/jinja2/default.nix41
-rw-r--r--pkgs/development/python-modules/jira/default.nix41
-rw-r--r--pkgs/development/python-modules/joblib/default.nix14
-rw-r--r--pkgs/development/python-modules/josepy/default.nix31
-rw-r--r--pkgs/development/python-modules/jproperties/default.nix2
-rw-r--r--pkgs/development/python-modules/jq/default.nix22
-rw-r--r--pkgs/development/python-modules/js2py/default.nix12
-rw-r--r--pkgs/development/python-modules/jsonpickle/default.nix37
-rw-r--r--pkgs/development/python-modules/jsonschema-path/default.nix55
-rw-r--r--pkgs/development/python-modules/jsonschema-spec/default.nix6
-rw-r--r--pkgs/development/python-modules/jsonschema-specifications/default.nix4
-rw-r--r--pkgs/development/python-modules/jsonschema/default.nix4
-rw-r--r--pkgs/development/python-modules/jupyter-book/default.nix5
-rw-r--r--pkgs/development/python-modules/jupyter-lsp/default.nix14
-rw-r--r--pkgs/development/python-modules/jupyterlab-lsp/default.nix11
-rw-r--r--pkgs/development/python-modules/jupyterlab-server/default.nix4
-rw-r--r--pkgs/development/python-modules/kanidm/default.nix21
-rw-r--r--pkgs/development/python-modules/kbcstorage/default.nix2
-rw-r--r--pkgs/development/python-modules/keras/default.nix4
-rw-r--r--pkgs/development/python-modules/keystoneauth1/default.nix11
-rw-r--r--pkgs/development/python-modules/kiss-headers/default.nix4
-rw-r--r--pkgs/development/python-modules/kubernetes/default.nix4
-rw-r--r--pkgs/development/python-modules/labelbox/default.nix2
-rw-r--r--pkgs/development/python-modules/labgrid/default.nix4
-rw-r--r--pkgs/development/python-modules/langchain/default.nix4
-rw-r--r--pkgs/development/python-modules/lark/default.nix14
-rw-r--r--pkgs/development/python-modules/leidenalg/default.nix4
-rw-r--r--pkgs/development/python-modules/libcst/default.nix12
-rw-r--r--pkgs/development/python-modules/libretranslate/default.nix4
-rw-r--r--pkgs/development/python-modules/libtmux/default.nix6
-rw-r--r--pkgs/development/python-modules/license-expression/default.nix2
-rw-r--r--pkgs/development/python-modules/limits/default.nix4
-rw-r--r--pkgs/development/python-modules/linear-operator/default.nix2
-rw-r--r--pkgs/development/python-modules/linode-api/default.nix16
-rw-r--r--pkgs/development/python-modules/liquidctl/default.nix2
-rw-r--r--pkgs/development/python-modules/lit/default.nix11
-rw-r--r--pkgs/development/python-modules/lizard/default.nix7
-rw-r--r--pkgs/development/python-modules/llvmlite/default.nix38
-rw-r--r--pkgs/development/python-modules/localstack-ext/default.nix44
-rw-r--r--pkgs/development/python-modules/localstack/default.nix11
-rw-r--r--pkgs/development/python-modules/luddite/default.nix21
-rw-r--r--pkgs/development/python-modules/lxml/default.nix14
-rw-r--r--pkgs/development/python-modules/lxml/libxml-2.12.patch94
-rw-r--r--pkgs/development/python-modules/lz4/default.nix2
-rw-r--r--pkgs/development/python-modules/magic-filter/default.nix5
-rw-r--r--pkgs/development/python-modules/magicgui/default.nix2
-rw-r--r--pkgs/development/python-modules/maison/default.nix1
-rw-r--r--pkgs/development/python-modules/makefun/default.nix12
-rw-r--r--pkgs/development/python-modules/mako/default.nix25
-rw-r--r--pkgs/development/python-modules/manifestoo-core/default.nix2
-rw-r--r--pkgs/development/python-modules/manifestoo/default.nix2
-rw-r--r--pkgs/development/python-modules/markdown-include/default.nix2
-rw-r--r--pkgs/development/python-modules/markdown/default.nix12
-rw-r--r--pkgs/development/python-modules/matplotlib/default.nix4
-rw-r--r--pkgs/development/python-modules/maxminddb/default.nix4
-rw-r--r--pkgs/development/python-modules/mcstatus/default.nix6
-rw-r--r--pkgs/development/python-modules/measurement/default.nix2
-rw-r--r--pkgs/development/python-modules/mesa/default.nix4
-rw-r--r--pkgs/development/python-modules/meson-python/default.nix4
-rw-r--r--pkgs/development/python-modules/miauth/default.nix21
-rw-r--r--pkgs/development/python-modules/minio/default.nix37
-rw-r--r--pkgs/development/python-modules/mitmproxy/default.nix8
-rw-r--r--pkgs/development/python-modules/mkdocs-material/default.nix46
-rw-r--r--pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs-minify-plugin/default.nix (renamed from pkgs/development/python-modules/mkdocs-minify/default.nix)4
-rw-r--r--pkgs/development/python-modules/mkdocs/default.nix28
-rw-r--r--pkgs/development/python-modules/mlflow/default.nix4
-rw-r--r--pkgs/development/python-modules/mlxtend/default.nix30
-rw-r--r--pkgs/development/python-modules/mmengine/default.nix4
-rw-r--r--pkgs/development/python-modules/mne-python/default.nix4
-rw-r--r--pkgs/development/python-modules/mocket/default.nix4
-rw-r--r--pkgs/development/python-modules/mockfs/default.nix9
-rw-r--r--pkgs/development/python-modules/monty/default.nix4
-rw-r--r--pkgs/development/python-modules/moreorless/default.nix2
-rw-r--r--pkgs/development/python-modules/moto/default.nix16
-rw-r--r--pkgs/development/python-modules/motor/default.nix4
-rw-r--r--pkgs/development/python-modules/mpl-scatter-density/default.nix2
-rw-r--r--pkgs/development/python-modules/mpris-server/default.nix4
-rw-r--r--pkgs/development/python-modules/msal/default.nix4
-rw-r--r--pkgs/development/python-modules/msgpack/default.nix4
-rw-r--r--pkgs/development/python-modules/multidict/default.nix6
-rw-r--r--pkgs/development/python-modules/munch/default.nix33
-rw-r--r--pkgs/development/python-modules/mutagen/default.nix4
-rw-r--r--pkgs/development/python-modules/mypy-boto3-builder/default.nix4
-rw-r--r--pkgs/development/python-modules/napari-console/default.nix2
-rw-r--r--pkgs/development/python-modules/napari-npe2/default.nix9
-rw-r--r--pkgs/development/python-modules/napari-plugin-engine/default.nix2
-rw-r--r--pkgs/development/python-modules/napari-svg/default.nix2
-rw-r--r--pkgs/development/python-modules/napari/default.nix2
-rw-r--r--pkgs/development/python-modules/nbclient/default.nix4
-rw-r--r--pkgs/development/python-modules/nbdime/default.nix4
-rw-r--r--pkgs/development/python-modules/ncclient/default.nix4
-rw-r--r--pkgs/development/python-modules/nengo/default.nix17
-rw-r--r--pkgs/development/python-modules/netaddr/default.nix30
-rw-r--r--pkgs/development/python-modules/netmiko/default.nix43
-rw-r--r--pkgs/development/python-modules/networkx/default.nix55
-rw-r--r--pkgs/development/python-modules/nose/default.nix5
-rw-r--r--pkgs/development/python-modules/nose2/default.nix39
-rw-r--r--pkgs/development/python-modules/nosexcover/default.nix4
-rw-r--r--pkgs/development/python-modules/notebook/default.nix4
-rw-r--r--pkgs/development/python-modules/notion-client/default.nix14
-rw-r--r--pkgs/development/python-modules/ntc-templates/default.nix4
-rw-r--r--pkgs/development/python-modules/numcodecs/default.nix30
-rw-r--r--pkgs/development/python-modules/numexpr/default.nix4
-rw-r--r--pkgs/development/python-modules/numpy/0001-BLD-remove-last-usage-of-distutils-in-_core-code_gen.patch71
-rw-r--r--pkgs/development/python-modules/numpy/default.nix7
-rw-r--r--pkgs/development/python-modules/numpydoc/default.nix18
-rw-r--r--pkgs/development/python-modules/nutils/default.nix4
-rw-r--r--pkgs/development/python-modules/oca-port/default.nix2
-rw-r--r--pkgs/development/python-modules/oci/default.nix2
-rw-r--r--pkgs/development/python-modules/ocrmypdf/default.nix8
-rw-r--r--pkgs/development/python-modules/ocrmypdf/paths.patch10
-rw-r--r--pkgs/development/python-modules/oemthermostat/default.nix2
-rw-r--r--pkgs/development/python-modules/oldest-supported-numpy/default.nix4
-rw-r--r--pkgs/development/python-modules/omegaconf/default.nix2
-rw-r--r--pkgs/development/python-modules/onnx/default.nix4
-rw-r--r--pkgs/development/python-modules/openai/default.nix12
-rw-r--r--pkgs/development/python-modules/openapi-core/default.nix8
-rw-r--r--pkgs/development/python-modules/openapi-schema-validator/default.nix13
-rw-r--r--pkgs/development/python-modules/openapi-spec-validator/default.nix12
-rw-r--r--pkgs/development/python-modules/openllm-core/default.nix12
-rw-r--r--pkgs/development/python-modules/openpyxl/default.nix31
-rw-r--r--pkgs/development/python-modules/openstacksdk/default.nix8
-rw-r--r--pkgs/development/python-modules/opentelemetry-api/default.nix4
-rw-r--r--pkgs/development/python-modules/openwebifpy/default.nix13
-rw-r--r--pkgs/development/python-modules/opt-einsum/default.nix17
-rw-r--r--pkgs/development/python-modules/oscrypto/default.nix7
-rw-r--r--pkgs/development/python-modules/oslo-db/default.nix12
-rw-r--r--pkgs/development/python-modules/oslo-i18n/default.nix12
-rw-r--r--pkgs/development/python-modules/oslo-utils/default.nix14
-rw-r--r--pkgs/development/python-modules/osqp/default.nix2
-rw-r--r--pkgs/development/python-modules/ossfs/default.nix2
-rw-r--r--pkgs/development/python-modules/outcome/default.nix16
-rw-r--r--pkgs/development/python-modules/overrides/default.nix6
-rw-r--r--pkgs/development/python-modules/packaging/default.nix29
-rw-r--r--pkgs/development/python-modules/paginate/default.nix50
-rw-r--r--pkgs/development/python-modules/pandas/default.nix30
-rw-r--r--pkgs/development/python-modules/panel/default.nix4
-rw-r--r--pkgs/development/python-modules/papermill/default.nix4
-rw-r--r--pkgs/development/python-modules/param/default.nix31
-rw-r--r--pkgs/development/python-modules/parameter-expansion-patched/default.nix2
-rw-r--r--pkgs/development/python-modules/parameterized/default.nix6
-rw-r--r--pkgs/development/python-modules/parse/default.nix8
-rw-r--r--pkgs/development/python-modules/partd/default.nix12
-rw-r--r--pkgs/development/python-modules/pathvalidate/default.nix4
-rw-r--r--pkgs/development/python-modules/patsy/default.nix11
-rw-r--r--pkgs/development/python-modules/pbr/default.nix11
-rw-r--r--pkgs/development/python-modules/pdm-backend/default.nix4
-rw-r--r--pkgs/development/python-modules/pegen/default.nix2
-rw-r--r--pkgs/development/python-modules/pelican/default.nix85
-rw-r--r--pkgs/development/python-modules/pem/default.nix2
-rw-r--r--pkgs/development/python-modules/pendulum/3.nix99
-rw-r--r--pkgs/development/python-modules/pexpect/default.nix12
-rw-r--r--pkgs/development/python-modules/pg8000/default.nix4
-rw-r--r--pkgs/development/python-modules/phonenumbers/default.nix4
-rw-r--r--pkgs/development/python-modules/picobox/default.nix2
-rw-r--r--pkgs/development/python-modules/pikepdf/default.nix12
-rw-r--r--pkgs/development/python-modules/pikepdf/paths.patch28
-rw-r--r--pkgs/development/python-modules/pillow-heif/default.nix6
-rw-r--r--pkgs/development/python-modules/pillow/default.nix2
-rw-r--r--pkgs/development/python-modules/pillow/generic.nix7
-rw-r--r--pkgs/development/python-modules/pinecone-client/default.nix11
-rw-r--r--pkgs/development/python-modules/pint-pandas/default.nix2
-rw-r--r--pkgs/development/python-modules/pip-requirements-parser/default.nix2
-rw-r--r--pkgs/development/python-modules/pip/default.nix4
-rw-r--r--pkgs/development/python-modules/pipdeptree/default.nix2
-rw-r--r--pkgs/development/python-modules/pipx/default.nix4
-rw-r--r--pkgs/development/python-modules/platformdirs/default.nix6
-rw-r--r--pkgs/development/python-modules/playwright/default.nix20
-rw-r--r--pkgs/development/python-modules/plotly/default.nix5
-rw-r--r--pkgs/development/python-modules/pluggy/default.nix2
-rw-r--r--pkgs/development/python-modules/plumbum/default.nix2
-rw-r--r--pkgs/development/python-modules/plyfile/default.nix37
-rw-r--r--pkgs/development/python-modules/poetry-core/default.nix4
-rw-r--r--pkgs/development/python-modules/poetry-dynamic-versioning/default.nix4
-rw-r--r--pkgs/development/python-modules/polars/default.nix3
-rw-r--r--pkgs/development/python-modules/polyline/default.nix16
-rw-r--r--pkgs/development/python-modules/pomegranate/default.nix35
-rw-r--r--pkgs/development/python-modules/pontos/default.nix15
-rw-r--r--pkgs/development/python-modules/pooch/default.nix4
-rw-r--r--pkgs/development/python-modules/portalocker/default.nix32
-rw-r--r--pkgs/development/python-modules/prance/default.nix2
-rw-r--r--pkgs/development/python-modules/preshed/default.nix4
-rw-r--r--pkgs/development/python-modules/prettytable/default.nix6
-rw-r--r--pkgs/development/python-modules/process-tests/default.nix11
-rw-r--r--pkgs/development/python-modules/prometheus-client/default.nix4
-rw-r--r--pkgs/development/python-modules/prompt-toolkit/default.nix4
-rw-r--r--pkgs/development/python-modules/propka/default.nix4
-rw-r--r--pkgs/development/python-modules/psycopg/default.nix10
-rw-r--r--pkgs/development/python-modules/psycopg2/default.nix4
-rw-r--r--pkgs/development/python-modules/psygnal/default.nix4
-rw-r--r--pkgs/development/python-modules/pulumi-aws/default.nix4
-rw-r--r--pkgs/development/python-modules/pure-eval/default.nix2
-rw-r--r--pkgs/development/python-modules/pure-protobuf/default.nix6
-rw-r--r--pkgs/development/python-modules/pvextractor/default.nix2
-rw-r--r--pkgs/development/python-modules/py-desmume/default.nix6
-rw-r--r--pkgs/development/python-modules/py-tree-sitter/default.nix6
-rw-r--r--pkgs/development/python-modules/py-ubjson/default.nix13
-rw-r--r--pkgs/development/python-modules/pyairnow/default.nix11
-rw-r--r--pkgs/development/python-modules/pyaml/default.nix11
-rw-r--r--pkgs/development/python-modules/pyarrow/default.nix12
-rw-r--r--pkgs/development/python-modules/pyasn1/default.nix11
-rw-r--r--pkgs/development/python-modules/pyatag/default.nix4
-rw-r--r--pkgs/development/python-modules/pyatmo/default.nix2
-rw-r--r--pkgs/development/python-modules/pyaussiebb/default.nix6
-rw-r--r--pkgs/development/python-modules/pyavm/default.nix31
-rw-r--r--pkgs/development/python-modules/pybids/default.nix33
-rw-r--r--pkgs/development/python-modules/pybullet/default.nix12
-rw-r--r--pkgs/development/python-modules/pycairo/default.nix4
-rw-r--r--pkgs/development/python-modules/pycares/default.nix4
-rw-r--r--pkgs/development/python-modules/pycfmodel/default.nix1
-rw-r--r--pkgs/development/python-modules/pyclipper/default.nix2
-rw-r--r--pkgs/development/python-modules/pycodestyle/default.nix4
-rw-r--r--pkgs/development/python-modules/pycryptodome/default.nix4
-rw-r--r--pkgs/development/python-modules/pycyphal/default.nix4
-rw-r--r--pkgs/development/python-modules/pydantic-core/default.nix7
-rw-r--r--pkgs/development/python-modules/pydantic-scim/default.nix2
-rw-r--r--pkgs/development/python-modules/pydantic-settings/default.nix14
-rw-r--r--pkgs/development/python-modules/pydantic/1.nix76
-rw-r--r--pkgs/development/python-modules/pydantic/default.nix117
-rw-r--r--pkgs/development/python-modules/pydevd/default.nix23
-rw-r--r--pkgs/development/python-modules/pydexcom/default.nix2
-rw-r--r--pkgs/development/python-modules/pydrawise/default.nix2
-rw-r--r--pkgs/development/python-modules/pyee/default.nix4
-rw-r--r--pkgs/development/python-modules/pyelftools/default.nix4
-rw-r--r--pkgs/development/python-modules/pyerfa/default.nix13
-rw-r--r--pkgs/development/python-modules/pyfaidx/default.nix2
-rw-r--r--pkgs/development/python-modules/pyfakefs/default.nix35
-rw-r--r--pkgs/development/python-modules/pygal/default.nix26
-rw-r--r--pkgs/development/python-modules/pygame/default.nix52
-rw-r--r--pkgs/development/python-modules/pygit2/default.nix4
-rw-r--r--pkgs/development/python-modules/pygithub/default.nix2
-rw-r--r--pkgs/development/python-modules/pyglm/default.nix4
-rw-r--r--pkgs/development/python-modules/pygmars/default.nix2
-rw-r--r--pkgs/development/python-modules/pygments/default.nix13
-rw-r--r--pkgs/development/python-modules/pygti/default.nix2
-rw-r--r--pkgs/development/python-modules/pyhamcrest/default.nix4
-rw-r--r--pkgs/development/python-modules/pyheos/default.nix5
-rw-r--r--pkgs/development/python-modules/pyhepmc/default.nix1
-rw-r--r--pkgs/development/python-modules/pyicu/default.nix4
-rw-r--r--pkgs/development/python-modules/pyisy/default.nix2
-rw-r--r--pkgs/development/python-modules/pyjwt/default.nix2
-rw-r--r--pkgs/development/python-modules/pykakasi/default.nix2
-rw-r--r--pkgs/development/python-modules/pykdtree/default.nix40
-rw-r--r--pkgs/development/python-modules/pylast/default.nix2
-rw-r--r--pkgs/development/python-modules/pylint-django/default.nix6
-rw-r--r--pkgs/development/python-modules/pylint/default.nix30
-rw-r--r--pkgs/development/python-modules/pylsp-mypy/default.nix15
-rw-r--r--pkgs/development/python-modules/pylsqpack/default.nix11
-rw-r--r--pkgs/development/python-modules/pymatting/default.nix6
-rw-r--r--pkgs/development/python-modules/pymdown-extensions/default.nix4
-rw-r--r--pkgs/development/python-modules/pymilvus/default.nix6
-rw-r--r--pkgs/development/python-modules/pymongo/default.nix4
-rw-r--r--pkgs/development/python-modules/pymupdf/default.nix40
-rw-r--r--pkgs/development/python-modules/pynetbox/default.nix2
-rw-r--r--pkgs/development/python-modules/pyngo/default.nix13
-rw-r--r--pkgs/development/python-modules/pyngrok/default.nix7
-rw-r--r--pkgs/development/python-modules/pynisher/default.nix4
-rw-r--r--pkgs/development/python-modules/pynndescent/default.nix4
-rw-r--r--pkgs/development/python-modules/pyocr/default.nix2
-rw-r--r--pkgs/development/python-modules/pyodbc/default.nix4
-rw-r--r--pkgs/development/python-modules/pyopengl/default.nix4
-rw-r--r--pkgs/development/python-modules/pyopenssl/default.nix4
-rw-r--r--pkgs/development/python-modules/pyopenuv/default.nix2
-rw-r--r--pkgs/development/python-modules/pyosmium/default.nix4
-rw-r--r--pkgs/development/python-modules/pyparsing/default.nix6
-rw-r--r--pkgs/development/python-modules/pypdf/default.nix2
-rw-r--r--pkgs/development/python-modules/pyproject-api/default.nix2
-rw-r--r--pkgs/development/python-modules/pypytools/default.nix10
-rw-r--r--pkgs/development/python-modules/pyqt-builder/default.nix4
-rw-r--r--pkgs/development/python-modules/pyqt/sip.nix4
-rw-r--r--pkgs/development/python-modules/pyquery/default.nix6
-rw-r--r--pkgs/development/python-modules/pyquil/default.nix4
-rw-r--r--pkgs/development/python-modules/pyregion/default.nix4
-rw-r--r--pkgs/development/python-modules/pyrfc3339/default.nix24
-rw-r--r--pkgs/development/python-modules/pyrmvtransport/default.nix5
-rw-r--r--pkgs/development/python-modules/pyroma/default.nix44
-rw-r--r--pkgs/development/python-modules/pyrsistent/default.nix17
-rw-r--r--pkgs/development/python-modules/pysam/default.nix18
-rw-r--r--pkgs/development/python-modules/pyschlage/default.nix2
-rw-r--r--pkgs/development/python-modules/pysmart/default.nix2
-rw-r--r--pkgs/development/python-modules/pysml/default.nix2
-rw-r--r--pkgs/development/python-modules/pysolcast/default.nix2
-rw-r--r--pkgs/development/python-modules/pyspnego/default.nix38
-rw-r--r--pkgs/development/python-modules/pystardict/default.nix2
-rw-r--r--pkgs/development/python-modules/pysuez/default.nix7
-rw-r--r--pkgs/development/python-modules/pytautulli/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-aiohttp/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-ansible/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-arraydiff/default.nix6
-rw-r--r--pkgs/development/python-modules/pytest-astropy/default.nix9
-rw-r--r--pkgs/development/python-modules/pytest-asyncio/default.nix7
-rw-r--r--pkgs/development/python-modules/pytest-cases/default.nix11
-rw-r--r--pkgs/development/python-modules/pytest-console-scripts/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-datadir/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-django/default.nix46
-rw-r--r--pkgs/development/python-modules/pytest-env/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-forked/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-html/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-httpserver/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-httpx/default.nix10
-rw-r--r--pkgs/development/python-modules/pytest-localserver/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-logdog/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-mock/default.nix21
-rw-r--r--pkgs/development/python-modules/pytest-mpl/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-openfiles/default.nix12
-rw-r--r--pkgs/development/python-modules/pytest-playwright/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-pytestrail/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-regressions/default.nix12
-rw-r--r--pkgs/development/python-modules/pytest-remotedata/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-repeat/default.nix15
-rw-r--r--pkgs/development/python-modules/pytest-rerunfailures/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-snapshot/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-subprocess/default.nix11
-rw-r--r--pkgs/development/python-modules/pytest-subtests/default.nix13
-rw-r--r--pkgs/development/python-modules/pytest-test-utils/default.nix2
-rw-r--r--pkgs/development/python-modules/pytest-timeout/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-trio/default.nix3
-rw-r--r--pkgs/development/python-modules/pytest-xdist/default.nix8
-rw-r--r--pkgs/development/python-modules/pytest-xprocess/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest/default.nix32
-rw-r--r--pkgs/development/python-modules/pytest/tests.nix10
-rw-r--r--pkgs/development/python-modules/python-arango/default.nix6
-rw-r--r--pkgs/development/python-modules/python-benedict/default.nix4
-rw-r--r--pkgs/development/python-modules/python-dbusmock/default.nix2
-rw-r--r--pkgs/development/python-modules/python-docx/default.nix48
-rw-r--r--pkgs/development/python-modules/python-engineio/default.nix11
-rw-r--r--pkgs/development/python-modules/python-gitlab/default.nix15
-rw-r--r--pkgs/development/python-modules/python-izone/default.nix2
-rw-r--r--pkgs/development/python-modules/python-json-logger/default.nix8
-rw-r--r--pkgs/development/python-modules/python-linux-procfs/default.nix9
-rw-r--r--pkgs/development/python-modules/python-lsp-jsonrpc/default.nix2
-rw-r--r--pkgs/development/python-modules/python-lsp-server/default.nix2
-rw-r--r--pkgs/development/python-modules/python-manilaclient/default.nix4
-rw-r--r--pkgs/development/python-modules/python-osc/default.nix17
-rw-r--r--pkgs/development/python-modules/python-pkcs11/default.nix2
-rw-r--r--pkgs/development/python-modules/python-socketio/default.nix40
-rw-r--r--pkgs/development/python-modules/python-socks/default.nix4
-rw-r--r--pkgs/development/python-modules/python-trovo/default.nix11
-rw-r--r--pkgs/development/python-modules/python-ulid/default.nix2
-rw-r--r--pkgs/development/python-modules/python-vagrant/default.nix2
-rw-r--r--pkgs/development/python-modules/python-xz/default.nix4
-rw-r--r--pkgs/development/python-modules/python3-saml/default.nix25
-rw-r--r--pkgs/development/python-modules/pythonfinder/default.nix21
-rw-r--r--pkgs/development/python-modules/pythran/default.nix30
-rw-r--r--pkgs/development/python-modules/pytorch-pfn-extras/default.nix13
-rw-r--r--pkgs/development/python-modules/pytradfri/default.nix2
-rw-r--r--pkgs/development/python-modules/pyu2f/default.nix18
-rw-r--r--pkgs/development/python-modules/pyvicare/default.nix2
-rw-r--r--pkgs/development/python-modules/pyvisa-py/default.nix2
-rw-r--r--pkgs/development/python-modules/pyvisa-sim/default.nix4
-rw-r--r--pkgs/development/python-modules/pyvisa/default.nix12
-rw-r--r--pkgs/development/python-modules/pyvo/default.nix2
-rw-r--r--pkgs/development/python-modules/pywebview/default.nix6
-rw-r--r--pkgs/development/python-modules/pyyaml-include/default.nix2
-rw-r--r--pkgs/development/python-modules/pyzmq/default.nix28
-rw-r--r--pkgs/development/python-modules/qasync/default.nix4
-rw-r--r--pkgs/development/python-modules/qbittorrent-api/default.nix4
-rw-r--r--pkgs/development/python-modules/qcodes/default.nix4
-rw-r--r--pkgs/development/python-modules/qiskit-aer/default.nix4
-rw-r--r--pkgs/development/python-modules/qiskit-finance/default.nix14
-rw-r--r--pkgs/development/python-modules/qiskit-machine-learning/default.nix16
-rw-r--r--pkgs/development/python-modules/qiskit-nature/default.nix14
-rw-r--r--pkgs/development/python-modules/qiskit-optimization/default.nix14
-rw-r--r--pkgs/development/python-modules/qiskit/default.nix14
-rw-r--r--pkgs/development/python-modules/qmk-dotty-dict/default.nix21
-rw-r--r--pkgs/development/python-modules/qtconsole/default.nix4
-rw-r--r--pkgs/development/python-modules/qtile-extras/default.nix2
-rw-r--r--pkgs/development/python-modules/qtile/default.nix2
-rw-r--r--pkgs/development/python-modules/quaternion/default.nix4
-rw-r--r--pkgs/development/python-modules/questionary/default.nix6
-rw-r--r--pkgs/development/python-modules/raincloudy/default.nix2
-rw-r--r--pkgs/development/python-modules/rapidfuzz/default.nix5
-rw-r--r--pkgs/development/python-modules/rasterio/default.nix6
-rw-r--r--pkgs/development/python-modules/rdflib/default.nix2
-rw-r--r--pkgs/development/python-modules/readchar/default.nix12
-rw-r--r--pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix25
-rw-r--r--pkgs/development/python-modules/recipe-scrapers/default.nix4
-rw-r--r--pkgs/development/python-modules/redis/default.nix4
-rw-r--r--pkgs/development/python-modules/redshift-connector/default.nix4
-rw-r--r--pkgs/development/python-modules/referencing/default.nix6
-rw-r--r--pkgs/development/python-modules/regenmaschine/default.nix2
-rw-r--r--pkgs/development/python-modules/regex/default.nix4
-rw-r--r--pkgs/development/python-modules/regress/default.nix32
-rw-r--r--pkgs/development/python-modules/reportlab/default.nix4
-rw-r--r--pkgs/development/python-modules/reproject/default.nix4
-rw-r--r--pkgs/development/python-modules/requests-cache/default.nix4
-rw-r--r--pkgs/development/python-modules/requests-http-signature/default.nix2
-rw-r--r--pkgs/development/python-modules/requirements-detector/default.nix4
-rw-r--r--pkgs/development/python-modules/responses/default.nix17
-rw-r--r--pkgs/development/python-modules/rethinkdb/default.nix19
-rw-r--r--pkgs/development/python-modules/rich/default.nix25
-rw-r--r--pkgs/development/python-modules/riscv-config/default.nix4
-rw-r--r--pkgs/development/python-modules/rnginline/default.nix14
-rw-r--r--pkgs/development/python-modules/robotframework-databaselibrary/default.nix18
-rw-r--r--pkgs/development/python-modules/robotframework-requests/default.nix4
-rw-r--r--pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix13
-rw-r--r--pkgs/development/python-modules/rotary-embedding-torch/default.nix4
-rw-r--r--pkgs/development/python-modules/rpds-py/default.nix6
-rw-r--r--pkgs/development/python-modules/rstcheck-core/default.nix34
-rw-r--r--pkgs/development/python-modules/ruamel-yaml/default.nix11
-rw-r--r--pkgs/development/python-modules/ruyaml/default.nix21
-rw-r--r--pkgs/development/python-modules/rxv/default.nix2
-rw-r--r--pkgs/development/python-modules/s3transfer/default.nix8
-rw-r--r--pkgs/development/python-modules/sabctools/default.nix7
-rw-r--r--pkgs/development/python-modules/sagemaker/default.nix4
-rw-r--r--pkgs/development/python-modules/schema-salad/default.nix4
-rw-r--r--pkgs/development/python-modules/schwifty/default.nix38
-rw-r--r--pkgs/development/python-modules/scikit-build/default.nix6
-rw-r--r--pkgs/development/python-modules/scikit-build/python312-compatibility.patch40
-rw-r--r--pkgs/development/python-modules/scikit-hep-testdata/default.nix6
-rw-r--r--pkgs/development/python-modules/scikit-image/default.nix12
-rw-r--r--pkgs/development/python-modules/scikit-image/suppress-deprecation-warning.patch30
-rw-r--r--pkgs/development/python-modules/scikit-learn/default.nix35
-rw-r--r--pkgs/development/python-modules/scikit-posthocs/default.nix6
-rw-r--r--pkgs/development/python-modules/scikit-rf/default.nix4
-rw-r--r--pkgs/development/python-modules/scipy/default.nix9
-rw-r--r--pkgs/development/python-modules/scmrepo/default.nix6
-rw-r--r--pkgs/development/python-modules/scooby/default.nix2
-rw-r--r--pkgs/development/python-modules/screed/default.nix1
-rw-r--r--pkgs/development/python-modules/screenlogicpy/default.nix7
-rw-r--r--pkgs/development/python-modules/seabreeze/default.nix38
-rw-r--r--pkgs/development/python-modules/seatconnect/default.nix2
-rw-r--r--pkgs/development/python-modules/securesystemslib/default.nix5
-rw-r--r--pkgs/development/python-modules/segno/default.nix19
-rw-r--r--pkgs/development/python-modules/segyio/default.nix6
-rw-r--r--pkgs/development/python-modules/selenium/default.nix4
-rw-r--r--pkgs/development/python-modules/semver/default.nix4
-rw-r--r--pkgs/development/python-modules/sentry-sdk/default.nix12
-rw-r--r--pkgs/development/python-modules/setproctitle/default.nix19
-rw-r--r--pkgs/development/python-modules/setuptools-generate/default.nix2
-rw-r--r--pkgs/development/python-modules/setuptools-gettext/default.nix4
-rw-r--r--pkgs/development/python-modules/setuptools-odoo/default.nix2
-rw-r--r--pkgs/development/python-modules/setuptools-rust/default.nix4
-rw-r--r--pkgs/development/python-modules/setuptools-scm-git-archive/default.nix29
-rw-r--r--pkgs/development/python-modules/setuptools-scm/default.nix37
-rw-r--r--pkgs/development/python-modules/setuptools-scm/setup-hook.sh32
-rw-r--r--pkgs/development/python-modules/setuptools/default.nix4
-rw-r--r--pkgs/development/python-modules/shazamio/default.nix1
-rw-r--r--pkgs/development/python-modules/shellingham/default.nix4
-rw-r--r--pkgs/development/python-modules/shtab/default.nix6
-rw-r--r--pkgs/development/python-modules/sigstore/default.nix74
-rw-r--r--pkgs/development/python-modules/simplisafe-python/default.nix2
-rw-r--r--pkgs/development/python-modules/simpy/default.nix15
-rw-r--r--pkgs/development/python-modules/sip/default.nix4
-rw-r--r--pkgs/development/python-modules/smbprotocol/default.nix4
-rw-r--r--pkgs/development/python-modules/smmap/default.nix22
-rw-r--r--pkgs/development/python-modules/snowflake-sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/snscrape/default.nix2
-rw-r--r--pkgs/development/python-modules/snuggs/default.nix24
-rw-r--r--pkgs/development/python-modules/social-auth-core/default.nix11
-rw-r--r--pkgs/development/python-modules/soxr/default.nix2
-rw-r--r--pkgs/development/python-modules/spdx-tools/default.nix2
-rw-r--r--pkgs/development/python-modules/spectral-cube/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx-mdinclude/default.nix27
-rw-r--r--pkgs/development/python-modules/sphinx-prompt/default.nix30
-rw-r--r--pkgs/development/python-modules/sphinx-rtd-theme/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx/default.nix5
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-applehelp/default.nix1
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-devhelp/default.nix1
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix1
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-jquery/default.nix7
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-katex/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-openapi/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-qthelp/default.nix1
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-serializinghtml/default.nix1
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-websupport/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinxext-opengraph/default.nix2
-rw-r--r--pkgs/development/python-modules/spsdk/default.nix8
-rw-r--r--pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix2
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/sqlglot/default.nix2
-rw-r--r--pkgs/development/python-modules/sqltrie/default.nix2
-rw-r--r--pkgs/development/python-modules/ssdp/default.nix2
-rw-r--r--pkgs/development/python-modules/sshfs/default.nix2
-rw-r--r--pkgs/development/python-modules/stack-data/default.nix2
-rw-r--r--pkgs/development/python-modules/stanio/default.nix4
-rw-r--r--pkgs/development/python-modules/starlette/default.nix4
-rw-r--r--pkgs/development/python-modules/starline/default.nix13
-rw-r--r--pkgs/development/python-modules/steamship/default.nix2
-rw-r--r--pkgs/development/python-modules/stestr/default.nix14
-rw-r--r--pkgs/development/python-modules/stm32loader/default.nix45
-rw-r--r--pkgs/development/python-modules/strawberry-graphql/default.nix8
-rw-r--r--pkgs/development/python-modules/streaming-form-data/default.nix13
-rw-r--r--pkgs/development/python-modules/streaming-form-data/drop-smart-open.patch40
-rw-r--r--pkgs/development/python-modules/stringparser/default.nix2
-rw-r--r--pkgs/development/python-modules/structlog/default.nix10
-rw-r--r--pkgs/development/python-modules/subunit/default.nix7
-rw-r--r--pkgs/development/python-modules/sunpy/default.nix4
-rw-r--r--pkgs/development/python-modules/superqt/default.nix2
-rw-r--r--pkgs/development/python-modules/sure/default.nix2
-rw-r--r--pkgs/development/python-modules/swagger-ui-bundle/default.nix33
-rw-r--r--pkgs/development/python-modules/tables/default.nix8
-rw-r--r--pkgs/development/python-modules/tabula-py/default.nix2
-rw-r--r--pkgs/development/python-modules/tabulate/default.nix2
-rw-r--r--pkgs/development/python-modules/tank-utility/default.nix9
-rw-r--r--pkgs/development/python-modules/tatsu/default.nix11
-rw-r--r--pkgs/development/python-modules/tblib/default.nix18
-rw-r--r--pkgs/development/python-modules/tcxreader/default.nix4
-rw-r--r--pkgs/development/python-modules/tensorboard-data-server/default.nix4
-rw-r--r--pkgs/development/python-modules/tensorboard/default.nix4
-rw-r--r--pkgs/development/python-modules/tensorboardx/default.nix2
-rw-r--r--pkgs/development/python-modules/termcolor/default.nix4
-rw-r--r--pkgs/development/python-modules/terminado/default.nix4
-rw-r--r--pkgs/development/python-modules/tesla-powerwall/default.nix11
-rw-r--r--pkgs/development/python-modules/testfixtures/default.nix21
-rw-r--r--pkgs/development/python-modules/testrail-api/default.nix2
-rw-r--r--pkgs/development/python-modules/testresources/default.nix34
-rw-r--r--pkgs/development/python-modules/testscenarios/default.nix31
-rw-r--r--pkgs/development/python-modules/testtools/default.nix38
-rw-r--r--pkgs/development/python-modules/textfsm/default.nix6
-rw-r--r--pkgs/development/python-modules/thelogrus/default.nix6
-rw-r--r--pkgs/development/python-modules/threat9-test-bed/default.nix2
-rw-r--r--pkgs/development/python-modules/tifffile/default.nix4
-rw-r--r--pkgs/development/python-modules/tiledb/default.nix6
-rw-r--r--pkgs/development/python-modules/time-machine/default.nix16
-rw-r--r--pkgs/development/python-modules/timetagger/default.nix4
-rw-r--r--pkgs/development/python-modules/titlecase/default.nix2
-rw-r--r--pkgs/development/python-modules/tldextract/default.nix2
-rw-r--r--pkgs/development/python-modules/toggl-cli/default.nix3
-rw-r--r--pkgs/development/python-modules/tokenize-rt/default.nix16
-rw-r--r--pkgs/development/python-modules/tokenizers/Cargo.lock266
-rw-r--r--pkgs/development/python-modules/tokenizers/default.nix4
-rw-r--r--pkgs/development/python-modules/tololib/default.nix2
-rw-r--r--pkgs/development/python-modules/tomlkit/default.nix4
-rw-r--r--pkgs/development/python-modules/total-connect-client/default.nix4
-rw-r--r--pkgs/development/python-modules/tox/default.nix6
-rw-r--r--pkgs/development/python-modules/tqdm/default.nix4
-rw-r--r--pkgs/development/python-modules/tracerite/default.nix2
-rw-r--r--pkgs/development/python-modules/traitlets/default.nix29
-rw-r--r--pkgs/development/python-modules/transformers/default.nix4
-rw-r--r--pkgs/development/python-modules/treq/default.nix30
-rw-r--r--pkgs/development/python-modules/trio-asyncio/default.nix28
-rw-r--r--pkgs/development/python-modules/trio/default.nix48
-rw-r--r--pkgs/development/python-modules/trove-classifiers/default.nix8
-rw-r--r--pkgs/development/python-modules/trytond/default.nix4
-rw-r--r--pkgs/development/python-modules/twill/default.nix4
-rw-r--r--pkgs/development/python-modules/twisted/default.nix18
-rw-r--r--pkgs/development/python-modules/txi2p-tahoe/default.nix2
-rw-r--r--pkgs/development/python-modules/typed-settings/default.nix4
-rw-r--r--pkgs/development/python-modules/types-psutil/default.nix4
-rw-r--r--pkgs/development/python-modules/types-psycopg2/default.nix33
-rw-r--r--pkgs/development/python-modules/types-pyyaml/default.nix4
-rw-r--r--pkgs/development/python-modules/types-requests/default.nix2
-rw-r--r--pkgs/development/python-modules/types-setuptools/default.nix4
-rw-r--r--pkgs/development/python-modules/typing-extensions/default.nix9
-rw-r--r--pkgs/development/python-modules/uasiren/default.nix2
-rw-r--r--pkgs/development/python-modules/uharfbuzz/default.nix2
-rw-r--r--pkgs/development/python-modules/unidic/default.nix2
-rw-r--r--pkgs/development/python-modules/uqbar/default.nix4
-rw-r--r--pkgs/development/python-modules/uri-template/default.nix2
-rw-r--r--pkgs/development/python-modules/urllib3/default.nix31
-rw-r--r--pkgs/development/python-modules/urwid/default.nix20
-rw-r--r--pkgs/development/python-modules/usort/default.nix2
-rw-r--r--pkgs/development/python-modules/uvicorn/default.nix4
-rw-r--r--pkgs/development/python-modules/vallox-websocket-api/default.nix6
-rw-r--r--pkgs/development/python-modules/venusian/default.nix19
-rw-r--r--pkgs/development/python-modules/versioningit/default.nix11
-rw-r--r--pkgs/development/python-modules/vilfo-api-client/default.nix2
-rw-r--r--pkgs/development/python-modules/virtualenv/default.nix4
-rw-r--r--pkgs/development/python-modules/vispy/default.nix17
-rw-r--r--pkgs/development/python-modules/voluptuous/default.nix20
-rw-r--r--pkgs/development/python-modules/wandb/default.nix4
-rw-r--r--pkgs/development/python-modules/wavedrom/default.nix2
-rw-r--r--pkgs/development/python-modules/wavefile/default.nix8
-rw-r--r--pkgs/development/python-modules/wcwidth/default.nix14
-rw-r--r--pkgs/development/python-modules/weaviate-client/default.nix2
-rw-r--r--pkgs/development/python-modules/webdav4/default.nix2
-rw-r--r--pkgs/development/python-modules/websocket-client/default.nix13
-rw-r--r--pkgs/development/python-modules/websockets/default.nix11
-rw-r--r--pkgs/development/python-modules/webtest/default.nix10
-rw-r--r--pkgs/development/python-modules/werkzeug/default.nix4
-rw-r--r--pkgs/development/python-modules/wheel/default.nix6
-rw-r--r--pkgs/development/python-modules/wikitextparser/default.nix5
-rw-r--r--pkgs/development/python-modules/willow/default.nix4
-rw-r--r--pkgs/development/python-modules/withings-api/default.nix1
-rw-r--r--pkgs/development/python-modules/wrapt/default.nix6
-rw-r--r--pkgs/development/python-modules/wsme/default.nix12
-rw-r--r--pkgs/development/python-modules/wtforms/default.nix40
-rw-r--r--pkgs/development/python-modules/xarray/default.nix6
-rw-r--r--pkgs/development/python-modules/xbox-webapi/default.nix29
-rw-r--r--pkgs/development/python-modules/xformers/default.nix4
-rw-r--r--pkgs/development/python-modules/xxhash/default.nix22
-rw-r--r--pkgs/development/python-modules/xyzservices/default.nix4
-rw-r--r--pkgs/development/python-modules/yapf/default.nix27
-rw-r--r--pkgs/development/python-modules/yarl/default.nix29
-rw-r--r--pkgs/development/python-modules/ytmusicapi/default.nix2
-rw-r--r--pkgs/development/python-modules/zarr/default.nix3
-rw-r--r--pkgs/development/python-modules/zeep/default.nix9
-rw-r--r--pkgs/development/python-modules/zeroc-ice/default.nix24
-rw-r--r--pkgs/development/python-modules/zfec/default.nix11
-rw-r--r--pkgs/development/python-modules/zipp/default.nix4
-rw-r--r--pkgs/development/python-modules/zope-hookable/default.nix15
-rw-r--r--pkgs/development/python-modules/zope-i18nmessageid/default.nix4
-rw-r--r--pkgs/development/python-modules/zstandard/default.nix4
-rw-r--r--pkgs/development/python2-modules/wcwidth/default.nix2
-rw-r--r--pkgs/development/rocm-modules/5/default.nix9
-rw-r--r--pkgs/development/rocm-modules/5/llvm/base.nix8
-rw-r--r--pkgs/development/rocm-modules/5/llvm/default.nix17
-rw-r--r--pkgs/development/rocm-modules/5/llvm/stage-1/clang-unwrapped.nix5
-rw-r--r--pkgs/development/rocm-modules/5/llvm/stage-1/lld.nix5
-rw-r--r--pkgs/development/rocm-modules/5/llvm/stage-1/llvm.nix2
-rw-r--r--pkgs/development/rocm-modules/5/llvm/stage-1/runtimes.nix3
-rw-r--r--pkgs/development/rocm-modules/5/llvm/stage-2/rstdenv.nix1
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/tools/aws-sam-cli/default.nix7
-rw-r--r--pkgs/development/tools/build-managers/gn/generic.nix5
-rw-r--r--pkgs/development/tools/build-managers/scons/3.1.2.nix18
-rw-r--r--pkgs/development/tools/build-managers/scons/4.1.0.nix23
-rw-r--r--pkgs/development/tools/build-managers/scons/4.5.2.nix20
-rw-r--r--pkgs/development/tools/check-jsonschema/default.nix5
-rw-r--r--pkgs/development/tools/circup/default.nix2
-rw-r--r--pkgs/development/tools/codespell/default.nix2
-rw-r--r--pkgs/development/tools/documentation/gi-docgen/default.nix5
-rw-r--r--pkgs/development/tools/hatch/default.nix35
-rw-r--r--pkgs/development/tools/hotdoc/default.nix2
-rw-r--r--pkgs/development/tools/jq/default.nix4
-rw-r--r--pkgs/development/tools/language-servers/fortls/default.nix2
-rw-r--r--pkgs/development/tools/misc/gdb/default.nix8
-rw-r--r--pkgs/development/tools/misc/gpuvis/default.nix5
-rw-r--r--pkgs/development/tools/ofono-phonesim/default.nix7
-rw-r--r--pkgs/development/tools/rust/bindgen/unwrapped.nix6
-rw-r--r--pkgs/games/openmw/tes3mp.nix5
-rw-r--r--pkgs/games/portmod/default.nix2
-rw-r--r--pkgs/games/super-tux-kart/default.nix7
-rw-r--r--pkgs/misc/hdt/default.nix12
-rw-r--r--pkgs/misc/stabber/default.nix5
-rw-r--r--pkgs/os-specific/linux/bcc/default.nix4
-rw-r--r--pkgs/os-specific/linux/criu/default.nix24
-rw-r--r--pkgs/os-specific/linux/error-inject/default.nix12
-rw-r--r--pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix37
-rw-r--r--pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix6
-rw-r--r--pkgs/os-specific/linux/fsverity-utils/default.nix9
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/i2c-tools/default.nix7
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipu6-drivers/default.nix6
-rw-r--r--pkgs/os-specific/linux/iputils/default.nix4
-rw-r--r--pkgs/os-specific/linux/ivsc-driver/default.nix6
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--pkgs/os-specific/linux/libnl/default.nix37
-rw-r--r--pkgs/os-specific/linux/libtracefs/default.nix9
-rw-r--r--pkgs/os-specific/linux/numactl/default.nix2
-rw-r--r--pkgs/os-specific/linux/procps-ng/default.nix4
-rw-r--r--pkgs/os-specific/linux/shadow/default.nix9
-rw-r--r--pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch46
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix10
-rw-r--r--pkgs/os-specific/linux/trace-cmd/default.nix9
-rw-r--r--pkgs/os-specific/linux/trace-cmd/kernelshark.nix7
-rw-r--r--pkgs/os-specific/linux/tuna/default.nix11
-rw-r--r--pkgs/os-specific/linux/usbguard-notifier/default.nix11
-rw-r--r--pkgs/os-specific/linux/usbguard/default.nix11
-rw-r--r--pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch277
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix5
-rw-r--r--pkgs/os-specific/linux/v4l2loopback/default.nix13
-rw-r--r--pkgs/pkgs-lib/formats.nix14
-rw-r--r--pkgs/servers/ebusd/default.nix8
-rw-r--r--pkgs/servers/home-assistant/default.nix158
-rw-r--r--pkgs/servers/http/apache-httpd/2.4.nix6
-rw-r--r--pkgs/servers/ldap/lldap/default.nix3
-rw-r--r--pkgs/servers/pinnwand/default.nix9
-rw-r--r--pkgs/servers/search/khoj/default.nix128
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/3_1.nix2
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/3_2.nix2
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/3_3.nix2
-rw-r--r--pkgs/servers/sql/mariadb/connector-c/default.nix8
-rw-r--r--pkgs/servers/sql/mariadb/default.nix5
-rw-r--r--pkgs/servers/sql/mariadb/patch/0001-Fix-build-with-libxml2-2.12.patch167
-rw-r--r--pkgs/servers/sql/postgresql/default.nix16
-rw-r--r--pkgs/servers/sql/postgresql/patches/libxml2.12-15.patch22
-rw-r--r--pkgs/stdenv/adapters.nix14
-rw-r--r--pkgs/stdenv/generic/make-derivation.nix29
-rw-r--r--pkgs/stdenv/generic/setup.sh6
-rw-r--r--pkgs/test/auto-patchelf-hook/default.nix6
-rw-r--r--pkgs/test/auto-patchelf-hook/package.nix96
-rw-r--r--pkgs/test/default.nix2
-rw-r--r--pkgs/tools/admin/ansible/lint.nix5
-rw-r--r--pkgs/tools/admin/awscli/default.nix5
-rw-r--r--pkgs/tools/archivers/cpio/default.nix13
-rw-r--r--pkgs/tools/archivers/sharutils/default.nix3
-rw-r--r--pkgs/tools/audio/wyoming/piper.nix5
-rw-r--r--pkgs/tools/backup/borgbackup/default.nix23
-rw-r--r--pkgs/tools/backup/duplicity/default.nix2
-rw-r--r--pkgs/tools/backup/gphotos-sync/default.nix2
-rw-r--r--pkgs/tools/compression/efficient-compression-tool/default.nix5
-rw-r--r--pkgs/tools/compression/zstd/default.nix2
-rw-r--r--pkgs/tools/filesystems/f2fs-tools/default.nix7
-rw-r--r--pkgs/tools/filesystems/rdfind/default.nix14
-rw-r--r--pkgs/tools/misc/cc2538-bsl/default.nix6
-rw-r--r--pkgs/tools/misc/crudini/default.nix2
-rw-r--r--pkgs/tools/misc/instaloader/default.nix5
-rw-r--r--pkgs/tools/misc/jdupes/default.nix31
-rw-r--r--pkgs/tools/misc/lektor/default.nix2
-rw-r--r--pkgs/tools/misc/mpremote/default.nix1
-rw-r--r--pkgs/tools/misc/nbqa/default.nix14
-rw-r--r--pkgs/tools/misc/ntfy-sh/default.nix2
-rw-r--r--pkgs/tools/misc/osinfo-db-tools/default.nix13
-rw-r--r--pkgs/tools/misc/remote-exec/default.nix4
-rw-r--r--pkgs/tools/misc/xfstests/default.nix9
-rw-r--r--pkgs/tools/networking/curl/configure-ipv6-autodetect.diff46
-rw-r--r--pkgs/tools/networking/curl/default.nix6
-rw-r--r--pkgs/tools/networking/dhcpcd/default.nix14
-rw-r--r--pkgs/tools/networking/linkchecker/default.nix2
-rw-r--r--pkgs/tools/networking/mmsd/default.nix7
-rw-r--r--pkgs/tools/networking/netifd/default.nix47
-rw-r--r--pkgs/tools/networking/ofono/default.nix7
-rw-r--r--pkgs/tools/networking/uqmi/default.nix7
-rw-r--r--pkgs/tools/networking/urlwatch/default.nix2
-rw-r--r--pkgs/tools/nix/nixos-render-docs/default.nix9
-rw-r--r--pkgs/tools/package-management/nix/common.nix5
-rw-r--r--pkgs/tools/package-management/packagekit/qt.nix8
-rw-r--r--pkgs/tools/package-management/protontricks/default.nix2
-rw-r--r--pkgs/tools/security/coercer/default.nix10
-rw-r--r--pkgs/tools/security/efitools/default.nix7
-rw-r--r--pkgs/tools/security/flare-floss/default.nix2
-rw-r--r--pkgs/tools/security/ibm-sw-tpm2/default.nix15
-rw-r--r--pkgs/tools/security/kube-hunter/default.nix2
-rw-r--r--pkgs/tools/security/mitmproxy2swagger/default.nix5
-rw-r--r--pkgs/tools/security/pcsclite/default.nix54
-rw-r--r--pkgs/tools/security/pcsclite/no-dropdir-literals.patch47
-rw-r--r--pkgs/tools/security/sedutil/default.nix11
-rw-r--r--pkgs/tools/security/stacs/default.nix2
-rw-r--r--pkgs/tools/text/l2md/default.nix7
-rw-r--r--pkgs/tools/text/mdbook/default.nix6
-rw-r--r--pkgs/tools/text/xml/xmlstarlet/default.nix8
-rw-r--r--pkgs/tools/text/xml/xmlstarlet/fix-incompatible-function-pointer.patch11
-rw-r--r--pkgs/tools/typesetting/tex/texlive/bin.nix9
-rw-r--r--pkgs/tools/typesetting/tex/texlive/default.nix6
-rw-r--r--pkgs/tools/video/svt-av1/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix225
-rw-r--r--pkgs/top-level/kodi-packages.nix5
-rw-r--r--pkgs/top-level/php-packages.nix15
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix49
-rw-r--r--pkgs/top-level/qt5-packages.nix9
-rw-r--r--pkgs/top-level/qt6-packages.nix22
-rw-r--r--pkgs/top-level/ruby-packages.nix4
1385 files changed, 12412 insertions, 7121 deletions
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 6a70792bf02c..8e1c5275401d 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -7,7 +7,7 @@ binaryheap,,,,,,vcunat
 busted,,,,,,
 cassowary,,,,,,marsam alerque
 cldr,,,,,,alerque
-compat53,,,,0.7-1,,vcunat
+compat53,,,,,,vcunat
 cosmo,,,,,,marsam
 coxpcall,,,,1.17.0-1,,
 cqueues,,,,,,vcunat
@@ -15,6 +15,7 @@ cyan,,,,,,
 digestif,https://github.com/astoff/digestif.git,,,,5.3,
 dkjson,,,,,,
 fennel,,,,,,misterio77
+fidget.nvim,,,,,,mrcjkb
 fifo,,,,,,
 fluent,,,,,,alerque
 fzy,,,,,,mrcjkb
@@ -55,7 +56,7 @@ lua-subprocess,https://github.com/0x0ade/lua-subprocess,,,,5.1,scoder12
 lua-term,,,,,,
 lua-toml,,,,,,
 lua-zlib,,,,,,koral
-lua_cliargs,https://github.com/amireh/lua_cliargs.git,,,,,
+lua_cliargs,,,,,,
 luabitop,https://github.com/teto/luabitop.git,,,,,
 luacheck,,,,,,
 luacov,,,,,,
@@ -86,7 +87,7 @@ luautf8,,,,,,pstn
 luazip,,,,,,
 lua-yajl,,,,,,pstn
 lua-iconv,,,,7.0.0,,
-luuid,,,,,,
+luuid,,,,20120509-2,,
 luv,,,,1.44.2-1,,
 lush.nvim,https://github.com/rktjmp/lush.nvim,,,,,teto
 lyaml,,,,,,lblasc
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 648064643930..5c05ad780d90 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -26,6 +26,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [maubot](https://github.com/maubot/maubot), a plugin-based Matrix bot framework. Available as [services.maubot](#opt-services.maubot.enable).
 
+- systemd's gateway, upload, and remote services, which provides ways of sending journals across the network. Enable using [services.journald.gateway](#opt-services.journald.gateway.enable), [services.journald.upload](#opt-services.journald.upload.enable), and [services.journald.remote](#opt-services.journald.remote.enable).
+
 - [GNS3](https://www.gns3.com/), a network software emulator. Available as [services.gns3-server](#opt-services.gns3-server.enable).
 
 - [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 99515b5b8276..284934a7608e 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -120,7 +120,7 @@ in rec {
     { meta.description = "List of NixOS options in JSON format";
       nativeBuildInputs = [
         pkgs.brotli
-        pkgs.python3Minimal
+        pkgs.python3
       ];
       options = builtins.toFile "options.json"
         (builtins.unsafeDiscardStringContext (builtins.toJSON optionsNix));
diff --git a/nixos/modules/hardware/video/webcam/ipu6.nix b/nixos/modules/hardware/video/webcam/ipu6.nix
index fce78cda34c7..c2dbdc217bd6 100644
--- a/nixos/modules/hardware/video/webcam/ipu6.nix
+++ b/nixos/modules/hardware/video/webcam/ipu6.nix
@@ -13,11 +13,12 @@ in
     enable = mkEnableOption (lib.mdDoc "support for Intel IPU6/MIPI cameras");
 
     platform = mkOption {
-      type = types.enum [ "ipu6" "ipu6ep" ];
+      type = types.enum [ "ipu6" "ipu6ep" "ipu6epmtl" ];
       description = lib.mdDoc ''
         Choose the version for your hardware platform.
 
-        Use `ipu6` for Tiger Lake and `ipu6ep` for Alder Lake respectively.
+        Use `ipu6` for Tiger Lake, `ipu6ep` for Alder Lake or Raptor Lake,
+        and `ipu6epmtl` for Meteor Lake.
       '';
     };
 
@@ -29,9 +30,7 @@ in
       ipu6-drivers
     ];
 
-    hardware.firmware = with pkgs; [ ]
-      ++ optional (cfg.platform == "ipu6") ipu6-camera-bin
-      ++ optional (cfg.platform == "ipu6ep") ipu6ep-camera-bin;
+    hardware.firmware = [ pkgs.ipu6-camera-bins ];
 
     services.udev.extraRules = ''
       SUBSYSTEM=="intel-ipu6-psys", MODE="0660", GROUP="video"
@@ -44,14 +43,13 @@ in
 
       extraPackages = with pkgs.gst_all_1; [ ]
         ++ optional (cfg.platform == "ipu6") icamerasrc-ipu6
-        ++ optional (cfg.platform == "ipu6ep") icamerasrc-ipu6ep;
+        ++ optional (cfg.platform == "ipu6ep") icamerasrc-ipu6ep
+        ++ optional (cfg.platform == "ipu6epmtl") icamerasrc-ipu6epmtl;
 
       input = {
         pipeline = "icamerasrc";
-        format = mkIf (cfg.platform == "ipu6ep") (mkDefault "NV12");
+        format = mkIf (cfg.platform != "ipu6") (mkDefault "NV12");
       };
     };
-
   };
-
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 02832e656dc9..4e3ce4d08896 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1476,6 +1476,9 @@
   ./system/boot/systemd/initrd-secrets.nix
   ./system/boot/systemd/initrd.nix
   ./system/boot/systemd/journald.nix
+  ./system/boot/systemd/journald-gateway.nix
+  ./system/boot/systemd/journald-remote.nix
+  ./system/boot/systemd/journald-upload.nix
   ./system/boot/systemd/logind.nix
   ./system/boot/systemd/nspawn.nix
   ./system/boot/systemd/oomd.nix
diff --git a/nixos/modules/system/boot/systemd/journald-gateway.nix b/nixos/modules/system/boot/systemd/journald-gateway.nix
new file mode 100644
index 000000000000..854965282344
--- /dev/null
+++ b/nixos/modules/system/boot/systemd/journald-gateway.nix
@@ -0,0 +1,135 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.journald.gateway;
+
+  cliArgs = lib.cli.toGNUCommandLineShell { } {
+    # If either of these are null / false, they are not passed in the command-line
+    inherit (cfg) cert key trust system user merge;
+  };
+in
+{
+  meta.maintainers = [ lib.maintainers.raitobezarius ];
+  options.services.journald.gateway = {
+    enable = lib.mkEnableOption "the HTTP gateway to the journal";
+
+    port = lib.mkOption {
+      default = 19531;
+      type = lib.types.port;
+      description = ''
+        The port to listen to.
+      '';
+    };
+
+    cert = lib.mkOption {
+      default = null;
+      type = with lib.types; nullOr str;
+      description = lib.mdDoc ''
+        The path to a file or `AF_UNIX` stream socket to read the server
+        certificate from.
+
+        The certificate must be in PEM format. This option switches
+        `systemd-journal-gatewayd` into HTTPS mode and must be used together
+        with {option}`services.journald.gateway.key`.
+      '';
+    };
+
+    key = lib.mkOption {
+      default = null;
+      type = with lib.types; nullOr str;
+      description = lib.mdDoc ''
+        Specify the path to a file or `AF_UNIX` stream socket to read the
+        secret server key corresponding to the certificate specified with
+        {option}`services.journald.gateway.cert` from.
+
+        The key must be in PEM format.
+
+        This key should not be world-readable, and must be readably by the
+        `systemd-journal-gateway` user.
+      '';
+    };
+
+    trust = lib.mkOption {
+      default = null;
+      type = with lib.types; nullOr str;
+      description = lib.mdDoc ''
+        Specify the path to a file or `AF_UNIX` stream socket to read a CA
+        certificate from.
+
+        The certificate must be in PEM format.
+
+        Setting this option enforces client certificate checking.
+      '';
+    };
+
+    system = lib.mkOption {
+      default = true;
+      type = lib.types.bool;
+      description = lib.mdDoc ''
+        Serve entries from system services and the kernel.
+
+        This has the same meaning as `--system` for {manpage}`journalctl(1)`.
+      '';
+    };
+
+    user = lib.mkOption {
+      default = true;
+      type = lib.types.bool;
+      description = lib.mdDoc ''
+        Serve entries from services for the current user.
+
+        This has the same meaning as `--user` for {manpage}`journalctl(1)`.
+      '';
+    };
+
+    merge = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      description = lib.mdDoc ''
+        Serve entries interleaved from all available journals, including other
+        machines.
+
+        This has the same meaning as `--merge` option for
+        {manpage}`journalctl(1)`.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        # This prevents the weird case were disabling "system" and "user"
+        # actually enables both because the cli flags are not present.
+        assertion = cfg.system || cfg.user;
+        message = ''
+          systemd-journal-gatewayd cannot serve neither "system" nor "user"
+          journals.
+        '';
+      }
+    ];
+
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-journal-gatewayd.socket"
+      "systemd-journal-gatewayd.service"
+    ];
+
+    users.users.systemd-journal-gateway.uid = config.ids.uids.systemd-journal-gateway;
+    users.users.systemd-journal-gateway.group = "systemd-journal-gateway";
+    users.groups.systemd-journal-gateway.gid = config.ids.gids.systemd-journal-gateway;
+
+    systemd.services.systemd-journal-gatewayd.serviceConfig.ExecStart = [
+        # Clear the default command line
+        ""
+        "${pkgs.systemd}/lib/systemd/systemd-journal-gatewayd ${cliArgs}"
+    ];
+
+    systemd.sockets.systemd-journal-gatewayd = {
+      wantedBy = [ "sockets.target" ];
+      listenStreams = [
+        # Clear the default port
+        ""
+        (toString cfg.port)
+      ];
+    };
+  };
+}
diff --git a/nixos/modules/system/boot/systemd/journald-remote.nix b/nixos/modules/system/boot/systemd/journald-remote.nix
new file mode 100644
index 000000000000..57a0a133e1c6
--- /dev/null
+++ b/nixos/modules/system/boot/systemd/journald-remote.nix
@@ -0,0 +1,163 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.journald.remote;
+  format = pkgs.formats.systemd;
+
+  cliArgs = lib.cli.toGNUCommandLineShell { } {
+    inherit (cfg) output;
+    # "-3" specifies the file descriptor from the .socket unit.
+    "listen-${cfg.listen}" = "-3";
+  };
+in
+{
+  meta.maintainers = [ lib.maintainers.raitobezarius ];
+  options.services.journald.remote = {
+    enable = lib.mkEnableOption "receiving systemd journals from the network";
+
+    listen = lib.mkOption {
+      default = "https";
+      type = lib.types.enum [ "https" "http" ];
+      description = lib.mdDoc ''
+        Which protocol to listen to.
+      '';
+    };
+
+    output = lib.mkOption {
+      default = "/var/log/journal/remote/";
+      type = lib.types.str;
+      description = lib.mdDoc ''
+        The location of the output journal.
+
+        In case the output file is not specified, journal files will be created
+        underneath the selected directory. Files will be called
+        {file}`remote-hostname.journal`, where the `hostname` part is the
+        escaped hostname of the source endpoint of the connection, or the
+        numerical address if the hostname cannot be determined.
+      '';
+    };
+
+    port = lib.mkOption {
+      default = 19532;
+      type = lib.types.port;
+      description = ''
+        The port to listen to.
+
+        Note that this option is used only if
+        {option}`services.journald.upload.listen` is configured to be either
+        "https" or "http".
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = { };
+
+      description = lib.mdDoc ''
+        Configuration in the journal-remote configuration file. See
+        {manpage}`journal-remote.conf(5)` for available options.
+      '';
+
+      type = lib.types.submodule {
+        freeformType = format.type;
+
+        options.Remote = {
+          Seal = lib.mkOption {
+            default = false;
+            example = true;
+            type = lib.types.bool;
+            description = ''
+              Periodically sign the data in the journal using Forward Secure
+              Sealing.
+            '';
+          };
+
+          SplitMode = lib.mkOption {
+            default = "host";
+            example = "none";
+            type = lib.types.enum [ "host" "none" ];
+            description = lib.mdDoc ''
+              With "host", a separate output file is used, based on the
+              hostname of the other endpoint of a connection. With "none", only
+              one output journal file is used.
+            '';
+          };
+
+          ServerKeyFile = lib.mkOption {
+            default = "/etc/ssl/private/journal-remote.pem";
+            type = lib.types.str;
+            description = lib.mdDoc ''
+              A path to a SSL secret key file in PEM format.
+
+              Note that due to security reasons, `systemd-journal-remote` will
+              refuse files from the world-readable `/nix/store`. This file
+              should be readable by the "" user.
+
+              This option can be used with `listen = "https"`. If the path
+              refers to an `AF_UNIX` stream socket in the file system a
+              connection is made to it and the key read from it.
+            '';
+          };
+
+          ServerCertificateFile = lib.mkOption {
+            default = "/etc/ssl/certs/journal-remote.pem";
+            type = lib.types.str;
+            description = lib.mdDoc ''
+              A path to a SSL certificate file in PEM format.
+
+              This option can be used with `listen = "https"`. If the path
+              refers to an `AF_UNIX` stream socket in the file system a
+              connection is made to it and the certificate read from it.
+            '';
+          };
+
+          TrustedCertificateFile = lib.mkOption {
+            default = "/etc/ssl/ca/trusted.pem";
+            type = lib.types.str;
+            description = lib.mdDoc ''
+              A path to a SSL CA certificate file in PEM format, or `all`.
+
+              If `all` is set, then client certificate checking will be
+              disabled.
+
+              This option can be used with `listen = "https"`. If the path
+              refers to an `AF_UNIX` stream socket in the file system a
+              connection is made to it and the certificate read from it.
+            '';
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-journal-remote.service"
+      "systemd-journal-remote.socket"
+    ];
+
+    systemd.services.systemd-journal-remote.serviceConfig.ExecStart = [
+      # Clear the default command line
+      ""
+      "${pkgs.systemd}/lib/systemd/systemd-journal-remote ${cliArgs}"
+    ];
+
+    systemd.sockets.systemd-journal-remote = {
+      wantedBy = [ "sockets.target" ];
+      listenStreams = [
+        # Clear the default port
+        ""
+        (toString cfg.port)
+      ];
+    };
+
+    # User and group used by systemd-journal-remote.service
+    users.groups.systemd-journal-remote = { };
+    users.users.systemd-journal-remote = {
+      isSystemUser = true;
+      group = "systemd-journal-remote";
+    };
+
+    environment.etc."systemd/journal-remote.conf".source =
+      format.generate "journal-remote.conf" cfg.settings;
+  };
+}
diff --git a/nixos/modules/system/boot/systemd/journald-upload.nix b/nixos/modules/system/boot/systemd/journald-upload.nix
new file mode 100644
index 000000000000..6421e5fa486f
--- /dev/null
+++ b/nixos/modules/system/boot/systemd/journald-upload.nix
@@ -0,0 +1,111 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.journald.upload;
+  format = pkgs.formats.systemd;
+in
+{
+  meta.maintainers = [ lib.maintainers.raitobezarius ];
+  options.services.journald.upload = {
+    enable = lib.mkEnableOption "uploading the systemd journal to a remote server";
+
+    settings = lib.mkOption {
+      default = { };
+
+      description = lib.mdDoc ''
+        Configuration for journal-upload. See {manpage}`journal-upload.conf(5)`
+        for available options.
+      '';
+
+      type = lib.types.submodule {
+        freeformType = format.type;
+
+        options.Upload = {
+          URL = lib.mkOption {
+            type = lib.types.str;
+            example = "https://192.168.1.1";
+            description = ''
+              The URL to upload the journal entries to.
+
+              See the description of `--url=` option in
+              {manpage}`systemd-journal-upload(8)` for the description of
+              possible values.
+            '';
+          };
+
+          ServerKeyFile = lib.mkOption {
+            type = with lib.types; nullOr str;
+            example = lib.literalExpression "./server-key.pem";
+            # Since systemd-journal-upload uses a DynamicUser, permissions must
+            # be done using groups
+            description = ''
+              SSL key in PEM format.
+
+              In contrary to what the name suggests, this option configures the
+              client private key sent to the remote journal server.
+
+              This key should not be world-readable, and must be readably by
+              the `systemd-journal` group.
+            '';
+            default = null;
+          };
+
+          ServerCertificateFile = lib.mkOption {
+            type = with lib.types; nullOr str;
+            example = lib.literalExpression "./server-ca.pem";
+            description = ''
+              SSL CA certificate in PEM format.
+
+              In contrary to what the name suggests, this option configures the
+              client certificate sent to the remote journal server.
+            '';
+            default = null;
+          };
+
+          TrustedCertificateFile = lib.mkOption {
+            type = with lib.types; nullOr str;
+            example = lib.literalExpression "./ca";
+            description = ''
+              SSL CA certificate.
+
+              This certificate will be used to check the remote journal HTTPS
+              server certificate.
+            '';
+            default = null;
+          };
+
+          NetworkTimeoutSec = lib.mkOption {
+            type = with lib.types; nullOr str;
+            example = "1s";
+            description = ''
+              When network connectivity to the server is lost, this option
+              configures the time to wait for the connectivity to get restored.
+
+              If the server is not reachable over the network for the
+              configured time, `systemd-journal-upload` exits. Takes a value in
+              seconds (or in other time units if suffixed with "ms", "min",
+              "h", etc). For details, see {manpage}`systemd.time(5)`.
+            '';
+            default = null;
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.additionalUpstreamSystemUnits = [ "systemd-journal-upload.service" ];
+
+    systemd.services."systemd-journal-upload" = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Restart = "always";
+        # To prevent flooding the server in case the server is struggling
+        RestartSec = "3sec";
+      };
+    };
+
+    environment.etc."systemd/journal-upload.conf".source =
+      format.generate "journal-upload.conf" cfg.settings;
+  };
+}
diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix
index 7e62a4c9bfed..9a8e7d592603 100644
--- a/nixos/modules/system/boot/systemd/journald.nix
+++ b/nixos/modules/system/boot/systemd/journald.nix
@@ -5,6 +5,10 @@ with lib;
 let
   cfg = config.services.journald;
 in {
+  imports = [
+    (mkRenamedOptionModule [ "services" "journald" "enableHttpGateway" ] [ "services" "journald" "gateway" "enable" ])
+  ];
+
   options = {
     services.journald.console = mkOption {
       default = "";
@@ -71,14 +75,6 @@ in {
       '';
     };
 
-    services.journald.enableHttpGateway = mkOption {
-      default = false;
-      type = types.bool;
-      description = lib.mdDoc ''
-        Whether to enable the HTTP gateway to the journal.
-      '';
-    };
-
     services.journald.forwardToSyslog = mkOption {
       default = config.services.rsyslogd.enable || config.services.syslog-ng.enable;
       defaultText = literalExpression "services.rsyslogd.enable || services.syslog-ng.enable";
@@ -101,9 +97,6 @@ in {
       ] ++ (optional (!config.boot.isContainer) "systemd-journald-audit.socket") ++ [
       "systemd-journald-dev-log.socket"
       "syslog.socket"
-      ] ++ optionals cfg.enableHttpGateway [
-      "systemd-journal-gatewayd.socket"
-      "systemd-journal-gatewayd.service"
       ];
 
     environment.etc = {
@@ -124,12 +117,6 @@ in {
     };
 
     users.groups.systemd-journal.gid = config.ids.gids.systemd-journal;
-    users.users.systemd-journal-gateway.uid = config.ids.uids.systemd-journal-gateway;
-    users.users.systemd-journal-gateway.group = "systemd-journal-gateway";
-    users.groups.systemd-journal-gateway.gid = config.ids.gids.systemd-journal-gateway;
-
-    systemd.sockets.systemd-journal-gatewayd.wantedBy =
-      optional cfg.enableHttpGateway "sockets.target";
 
     systemd.services.systemd-journal-flush.restartIfChanged = false;
     systemd.services.systemd-journald.restartTriggers = [ config.environment.etc."systemd/journald.conf".source ];
diff --git a/nixos/modules/system/boot/timesyncd.nix b/nixos/modules/system/boot/timesyncd.nix
index 7487cf97fe53..2666e4cd6b28 100644
--- a/nixos/modules/system/boot/timesyncd.nix
+++ b/nixos/modules/system/boot/timesyncd.nix
@@ -46,6 +46,13 @@ with lib;
       wantedBy = [ "sysinit.target" ];
       aliases = [ "dbus-org.freedesktop.timesync1.service" ];
       restartTriggers = [ config.environment.etc."systemd/timesyncd.conf".source ];
+      # systemd-timesyncd disables DNSSEC validation in the nss-resolve module by setting SYSTEMD_NSS_RESOLVE_VALIDATE to 0 in the unit file.
+      # This is required in order to solve the chicken-and-egg problem when DNSSEC validation needs the correct time to work, but to set the
+      # correct time, we need to connect to an NTP server, which usually requires resolving its hostname.
+      # In order for nss-resolve to be able to read this environment variable we patch systemd-timesyncd to disable NSCD and use NSS modules directly.
+      # This means that systemd-timesyncd needs to have NSS modules path in LD_LIBRARY_PATH. When systemd-resolved is disabled we still need to set
+      # NSS module path so that systemd-timesyncd keeps using other NSS modules that are configured in the system.
+      environment.LD_LIBRARY_PATH = config.system.nssModules.path;
 
       preStart = (
         # Ensure that we have some stored time to prevent
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 462df297e70f..be394c19ebef 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -843,6 +843,8 @@ in {
   systemd-initrd-networkd-openvpn = handleTestOn [ "x86_64-linux" "i686-linux" ] ./initrd-network-openvpn { systemdStage1 = true; };
   systemd-initrd-vlan = handleTest ./systemd-initrd-vlan.nix {};
   systemd-journal = handleTest ./systemd-journal.nix {};
+  systemd-journal-gateway = handleTest ./systemd-journal-gateway.nix {};
+  systemd-journal-upload = handleTest ./systemd-journal-upload.nix {};
   systemd-machinectl = handleTest ./systemd-machinectl.nix {};
   systemd-networkd = handleTest ./systemd-networkd.nix {};
   systemd-networkd-dhcpserver = handleTest ./systemd-networkd-dhcpserver.nix {};
@@ -858,6 +860,7 @@ in {
   systemd-shutdown = handleTest ./systemd-shutdown.nix {};
   systemd-sysupdate = runTest ./systemd-sysupdate.nix;
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
+  systemd-timesyncd-nscd-dnssec = handleTest ./systemd-timesyncd-nscd-dnssec.nix {};
   systemd-user-tmpfiles-rules = handleTest ./systemd-user-tmpfiles-rules.nix {};
   systemd-misc = handleTest ./systemd-misc.nix {};
   systemd-userdbd = handleTest ./systemd-userdbd.nix {};
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index eff2ba05d2f1..3a561646ad90 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -510,14 +510,8 @@ let
             ntp
             perlPackages.ListCompare
             perlPackages.XMLLibXML
-            python3Minimal
             # make-options-doc/default.nix
-            (let
-                self = (pkgs.python3Minimal.override {
-                  inherit self;
-                  includeSiteCustomize = true;
-                });
-              in self.withPackages (p: [ p.mistune ]))
+            python3.withPackages (p: [ p.mistune ])
             shared-mime-info
             sudo
             texinfo
diff --git a/nixos/tests/os-prober.nix b/nixos/tests/os-prober.nix
index dae1306bd69d..034de0620d88 100644
--- a/nixos/tests/os-prober.nix
+++ b/nixos/tests/os-prober.nix
@@ -95,7 +95,7 @@ in {
           ntp
           perlPackages.ListCompare
           perlPackages.XMLLibXML
-          python3Minimal
+          python3
           shared-mime-info
           stdenv
           sudo
diff --git a/nixos/tests/systemd-journal-gateway.nix b/nixos/tests/systemd-journal-gateway.nix
new file mode 100644
index 000000000000..1d20943f2388
--- /dev/null
+++ b/nixos/tests/systemd-journal-gateway.nix
@@ -0,0 +1,90 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+{
+  name = "systemd-journal-gateway";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ minijackson raitobezarius ];
+  };
+
+  # Named client for coherence with the systemd-journal-upload test, and for
+  # certificate validation
+  nodes.client = {
+    services.journald.gateway = {
+      enable = true;
+      cert = "/run/secrets/client/cert.pem";
+      key = "/run/secrets/client/key.pem";
+      trust = "/run/secrets/ca.cert.pem";
+    };
+  };
+
+  testScript = ''
+    import json
+    import subprocess
+    import tempfile
+
+    tmpdir_o = tempfile.TemporaryDirectory()
+    tmpdir = tmpdir_o.name
+
+    def generate_pems(domain: str):
+      subprocess.run(
+        [
+          "${pkgs.minica}/bin/minica",
+          "--ca-key=ca.key.pem",
+          "--ca-cert=ca.cert.pem",
+          f"--domains={domain}",
+        ],
+        cwd=str(tmpdir),
+      )
+
+    with subtest("Creating keys and certificates"):
+      generate_pems("server")
+      generate_pems("client")
+
+    client.wait_for_unit("multi-user.target")
+
+    def copy_pem(file: str):
+      machine.copy_from_host(source=f"{tmpdir}/{file}", target=f"/run/secrets/{file}")
+      machine.succeed(f"chmod 644 /run/secrets/{file}")
+
+    with subtest("Copying keys and certificates"):
+      machine.succeed("mkdir -p /run/secrets/{client,server}")
+      copy_pem("server/cert.pem")
+      copy_pem("server/key.pem")
+      copy_pem("client/cert.pem")
+      copy_pem("client/key.pem")
+      copy_pem("ca.cert.pem")
+
+    client.wait_for_unit("multi-user.target")
+
+    curl = '${pkgs.curl}/bin/curl'
+    accept_json = '--header "Accept: application/json"'
+    cacert = '--cacert /run/secrets/ca.cert.pem'
+    cert = '--cert /run/secrets/server/cert.pem'
+    key = '--key /run/secrets/server/key.pem'
+    base_url = 'https://client:19531'
+
+    curl_cli = f"{curl} {accept_json} {cacert} {cert} {key} --fail"
+
+    machine_info = client.succeed(f"{curl_cli} {base_url}/machine")
+    assert json.loads(machine_info)["hostname"] == "client", "wrong machine name"
+
+    # The HTTP request should have started the gateway service, triggered by
+    # the .socket unit
+    client.wait_for_unit("systemd-journal-gatewayd.service")
+
+    identifier = "nixos-test"
+    message = "Hello from NixOS test infrastructure"
+
+    client.succeed(f"systemd-cat --identifier={identifier} <<< '{message}'")
+
+    # max-time is a workaround against a bug in systemd-journal-gatewayd where
+    # if TLS is enabled, the connection is never closed. Since it will timeout,
+    # we ignore the return code.
+    entries = client.succeed(
+        f"{curl_cli} --max-time 5 {base_url}/entries?SYSLOG_IDENTIFIER={identifier} || true"
+    )
+
+    # Number of entries should be only 1
+    added_entry = json.loads(entries)
+    assert added_entry["SYSLOG_IDENTIFIER"] == identifier and added_entry["MESSAGE"] == message, "journal entry does not correspond"
+  '';
+})
diff --git a/nixos/tests/systemd-journal-upload.nix b/nixos/tests/systemd-journal-upload.nix
new file mode 100644
index 000000000000..0cbde379aee9
--- /dev/null
+++ b/nixos/tests/systemd-journal-upload.nix
@@ -0,0 +1,101 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+{
+  name = "systemd-journal-upload";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ minijackson raitobezarius ];
+  };
+
+  nodes.server = { nodes, ... }: {
+    services.journald.remote = {
+      enable = true;
+      listen = "http";
+      settings.Remote = {
+        ServerCertificateFile = "/run/secrets/sever.cert.pem";
+        ServerKeyFile = "/run/secrets/sever.key.pem";
+        TrustedCertificateFile = "/run/secrets/ca.cert.pem";
+        Seal = true;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ nodes.server.services.journald.remote.port ];
+  };
+
+  nodes.client = { lib, nodes, ... }: {
+    services.journald.upload = {
+      enable = true;
+      settings.Upload = {
+        URL = "http://server:${toString nodes.server.services.journald.remote.port}";
+        ServerCertificateFile = "/run/secrets/client.cert.pem";
+        ServerKeyFile = "/run/secrets/client.key.pem";
+        TrustedCertificateFile = "/run/secrets/ca.cert.pem";
+      };
+    };
+
+    # Wait for the PEMs to arrive
+    systemd.services.systemd-journal-upload.wantedBy = lib.mkForce [];
+    systemd.paths.systemd-journal-upload = {
+      wantedBy = [ "default.target" ];
+      # This file must be copied last
+      pathConfig.PathExists = [ "/run/secrets/ca.cert.pem" ];
+    };
+  };
+
+  testScript = ''
+    import subprocess
+    import tempfile
+
+    tmpdir_o = tempfile.TemporaryDirectory()
+    tmpdir = tmpdir_o.name
+
+    def generate_pems(domain: str):
+      subprocess.run(
+        [
+          "${pkgs.minica}/bin/minica",
+          "--ca-key=ca.key.pem",
+          "--ca-cert=ca.cert.pem",
+          f"--domains={domain}",
+        ],
+        cwd=str(tmpdir),
+      )
+
+    with subtest("Creating keys and certificates"):
+      generate_pems("server")
+      generate_pems("client")
+
+    server.wait_for_unit("multi-user.target")
+    client.wait_for_unit("multi-user.target")
+
+    def copy_pems(machine: Machine, domain: str):
+      machine.succeed("mkdir /run/secrets")
+      machine.copy_from_host(
+        source=f"{tmpdir}/{domain}/cert.pem",
+        target=f"/run/secrets/{domain}.cert.pem",
+      )
+      machine.copy_from_host(
+        source=f"{tmpdir}/{domain}/key.pem",
+        target=f"/run/secrets/{domain}.key.pem",
+      )
+      # Should be last
+      machine.copy_from_host(
+        source=f"{tmpdir}/ca.cert.pem",
+        target="/run/secrets/ca.cert.pem",
+      )
+
+    with subtest("Copying keys and certificates"):
+      copy_pems(server, "server")
+      copy_pems(client, "client")
+
+    client.wait_for_unit("systemd-journal-upload.service")
+    # The journal upload should have started the remote service, triggered by
+    # the .socket unit
+    server.wait_for_unit("systemd-journal-remote.service")
+
+    identifier = "nixos-test"
+    message = "Hello from NixOS test infrastructure"
+
+    client.succeed(f"systemd-cat --identifier={identifier} <<< '{message}'")
+    server.wait_until_succeeds(
+      f"journalctl --file /var/log/journal/remote/remote-*.journal --identifier={identifier} | grep -F '{message}'"
+    )
+  '';
+})
diff --git a/nixos/tests/systemd-journal.nix b/nixos/tests/systemd-journal.nix
index d2063a3b9a44..ad60c0f547a4 100644
--- a/nixos/tests/systemd-journal.nix
+++ b/nixos/tests/systemd-journal.nix
@@ -6,17 +6,11 @@ import ./make-test-python.nix ({ pkgs, ... }:
     maintainers = [ lewo ];
   };
 
-  nodes.machine = { pkgs, lib, ... }: {
-    services.journald.enableHttpGateway = true;
-  };
+  nodes.machine = { };
 
   testScript = ''
     machine.wait_for_unit("multi-user.target")
 
     machine.succeed("journalctl --grep=systemd")
-
-    machine.succeed(
-        "${pkgs.curl}/bin/curl -s localhost:19531/machine | ${pkgs.jq}/bin/jq -e '.hostname == \"machine\"'"
-    )
   '';
 })
diff --git a/nixos/tests/systemd-timesyncd-nscd-dnssec.nix b/nixos/tests/systemd-timesyncd-nscd-dnssec.nix
new file mode 100644
index 000000000000..697dd824e345
--- /dev/null
+++ b/nixos/tests/systemd-timesyncd-nscd-dnssec.nix
@@ -0,0 +1,61 @@
+# This test verifies that systemd-timesyncd can resolve the NTP server hostname when DNSSEC validation
+# fails even though it is enforced in the systemd-resolved settings. It is required in order to solve
+# the chicken-and-egg problem when DNSSEC validation needs the correct time to work, but to set the
+# correct time, we need to connect to an NTP server, which usually requires resolving its hostname.
+#
+# This test does the following:
+# - Sets up a DNS server (tinydns) listening on the eth1 ip addess, serving .ntp and fake.ntp records.
+# - Configures that DNS server as a resolver and enables DNSSEC in systemd-resolved settings.
+# - Configures systemd-timesyncd to use fake.ntp hostname as an NTP server.
+# - Performs a regular DNS lookup, to ensure it fails due to broken DNSSEC.
+# - Waits until systemd-timesyncd resolves fake.ntp by checking its debug output.
+#   Here, we don't expect systemd-timesyncd to connect and synchronize time because there is no NTP
+#   server running. For this test to succeed, we only need to ensure that systemd-timesyncd
+#   resolves the IP address of the fake.ntp host.
+
+import ./make-test-python.nix ({ pkgs, ... }:
+
+let
+  ntpHostname = "fake.ntp";
+  ntpIP = "192.0.2.1";
+in
+{
+  name = "systemd-timesyncd";
+  nodes.machine = { pkgs, lib, config, ... }:
+    let
+      eth1IP = (lib.head config.networking.interfaces.eth1.ipv4.addresses).address;
+    in
+    {
+      # Setup a local DNS server for the NTP domain on the eth1 IP address
+      services.tinydns = {
+        enable = true;
+        ip = eth1IP;
+        data = ''
+          .ntp:${eth1IP}
+          +.${ntpHostname}:${ntpIP}
+        '';
+      };
+
+      # Enable systemd-resolved with DNSSEC and use the local DNS as a name server
+      services.resolved.enable = true;
+      services.resolved.dnssec = "true";
+      networking.nameservers = [ eth1IP ];
+
+      # Configure systemd-timesyncd to use our NTP hostname
+      services.timesyncd.enable = lib.mkForce true;
+      services.timesyncd.servers = [ ntpHostname ];
+      services.timesyncd.extraConfig = ''
+        FallbackNTP=${ntpHostname}
+      '';
+
+      # The debug output is necessary to determine whether systemd-timesyncd successfully resolves our NTP hostname or not
+      systemd.services.systemd-timesyncd.environment.SYSTEMD_LOG_LEVEL = "debug";
+    };
+
+  testScript = ''
+    machine.wait_for_unit("tinydns.service")
+    machine.wait_for_unit("systemd-timesyncd.service")
+    machine.fail("resolvectl query ${ntpHostname}")
+    machine.wait_until_succeeds("journalctl -u systemd-timesyncd.service --grep='Resolved address ${ntpIP}:123 for ${ntpHostname}'")
+  '';
+})
diff --git a/pkgs/applications/audio/ardour/7.nix b/pkgs/applications/audio/ardour/7.nix
index ab9b2ebcd961..86a50ef0606e 100644
--- a/pkgs/applications/audio/ardour/7.nix
+++ b/pkgs/applications/audio/ardour/7.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchgit
 , fetchzip
+, fetchpatch
 , alsa-lib
 , aubio
 , boost
@@ -79,6 +80,12 @@ stdenv.mkDerivation rec {
     # AS=as in the environment causes build failure https://tracker.ardour.org/view.php?id=8096
     ./as-flags.patch
     ./default-plugin-search-paths.patch
+
+    # Fix build with libxml2 2.12.
+    (fetchpatch {
+      url = "https://github.com/Ardour/ardour/commit/e995daa37529715214c6c4a2587e4134aaaba02f.patch";
+      hash = "sha256-EpXOIIObOwwcNgNma0E3nvaBad3930sagDjBpa+78WI=";
+    })
   ];
 
   # Ardour's wscript requires git revision and date to be available.
diff --git a/pkgs/applications/audio/quodlibet/default.nix b/pkgs/applications/audio/quodlibet/default.nix
index eacce636df4e..67a597b62388 100644
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@@ -66,6 +66,7 @@ python3.pkgs.buildPythonApplication rec {
   ] ++ (with python3.pkgs; [
     sphinx-rtd-theme
     sphinxHook
+    setuptools
   ]);
 
   buildInputs = [
diff --git a/pkgs/applications/audio/whipper/default.nix b/pkgs/applications/audio/whipper/default.nix
index eb179bfa5496..53d7262d78df 100644
--- a/pkgs/applications/audio/whipper/default.nix
+++ b/pkgs/applications/audio/whipper/default.nix
@@ -64,10 +64,6 @@ in python3.pkgs.buildPythonApplication rec {
     "--prefix" "PATH" ":" (lib.makeBinPath bins)
   ];
 
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
-  '';
-
   outputs = [ "out" "man" ];
   postBuild = ''
     make -C man
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index d46117edc1da..82ff04e4ed4c 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -4,7 +4,7 @@
 , rocksdb
 , rust-jemalloc-sys-unprefixed
 , rustPlatform
-, rustc-wasm32
+, rustc
 , stdenv
 , Security
 , SystemConfiguration
@@ -63,8 +63,8 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
-    rustc-wasm32
-    rustc-wasm32.llvmPackages.lld
+    rustc
+    rustc.llvmPackages.lld
   ];
 
   # NOTE: jemalloc is used by default on Linux with unprefixed enabled
diff --git a/pkgs/applications/editors/scite/default.nix b/pkgs/applications/editors/scite/default.nix
index 67ebd13134b2..9c230a2984eb 100644
--- a/pkgs/applications/editors/scite/default.nix
+++ b/pkgs/applications/editors/scite/default.nix
@@ -13,6 +13,12 @@ stdenv.mkDerivation {
   buildInputs = [ gtk2 ];
   sourceRoot = "scintilla/gtk";
 
+  CXXFLAGS = [
+    # GCC 13: error: 'intptr_t' does not name a type
+    "-include cstdint"
+    "-include system_error"
+  ];
+
   buildPhase = ''
     make
     cd ../../lexilla/src
diff --git a/pkgs/applications/graphics/hdrmerge/default.nix b/pkgs/applications/graphics/hdrmerge/default.nix
index a8db24c35283..827ee15af60a 100644
--- a/pkgs/applications/graphics/hdrmerge/default.nix
+++ b/pkgs/applications/graphics/hdrmerge/default.nix
@@ -37,6 +37,11 @@ mkDerivation rec {
     "-DALGLIB_DIR:PATH=${alglib}"
   ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'uint32_t' does not name a type
+    "-include cstdint"
+  ];
+
   patches = [
     # https://github.com/jcelaya/hdrmerge/pull/222
     (fetchpatch {
diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index 81a34579c5b0..35000a06de02 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -6,6 +6,7 @@
 , cmake
 , desktopToDarwinBundle
 , fetchurl
+, fetchpatch
 , gettext
 , ghostscript
 , glib
@@ -92,6 +93,13 @@ stdenv.mkDerivation rec {
       src = ./fix-ps2pdf-path.patch;
       inherit ghostscript;
     })
+
+    # Fix build with libxml2 2.12
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/6089
+    (fetchpatch {
+      url = "https://gitlab.com/inkscape/inkscape/-/commit/694d8ae43d06efff21adebf377ce614d660b24cd.patch";
+      hash = "sha256-9IXJzpZbNU5fnt7XKgqCzUDrwr08qxGwo8TqnL+xc6E=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/graphics/krita/generic.nix b/pkgs/applications/graphics/krita/generic.nix
index df78c3108fb8..affa411aaa3c 100644
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@@ -21,6 +21,15 @@ mkDerivation rec {
     inherit hash;
   };
 
+  patches = [
+    # Fixes build with SIP 6.8
+    (fetchpatch {
+      name = "bump-SIP-ABI-version-to-12.8.patch";
+      url = "https://invent.kde.org/graphics/krita/-/commit/2d71c47661d43a4e3c1ab0c27803de980bdf2bb2.diff";
+      hash = "sha256-U3E44nj4vra++PJV20h4YHjES78kgrJtr4ktNeQfOdA=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake extra-cmake-modules pkg-config python3Packages.sip makeWrapper ];
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/meshlab/default.nix b/pkgs/applications/graphics/meshlab/default.nix
index 656713fb25e4..bee1e35ec129 100644
--- a/pkgs/applications/graphics/meshlab/default.nix
+++ b/pkgs/applications/graphics/meshlab/default.nix
@@ -75,6 +75,11 @@ mkDerivation rec {
     "-DALLOW_BUNDLED_LEVMAR=ON"
   ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'int16_t' has not been declared in 'std'
+    "-include cstdint"
+  ];
+
   postFixup = ''
     patchelf --add-needed $out/lib/meshlab/libmeshlab-common.so $out/bin/.meshlab-wrapped
   '';
diff --git a/pkgs/applications/graphics/tesseract/tesseract4.nix b/pkgs/applications/graphics/tesseract/tesseract4.nix
index aecdf58186d0..5bd682988526 100644
--- a/pkgs/applications/graphics/tesseract/tesseract4.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract4.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
   # great, but tesseract4's days are numbered anyway
   postPatch = ''
     sed -i '/allheaders.h/a#include "pix_internal.h"' src/textord/devanagari_processing.cpp
+
+    # gcc-13 compat fix, simulate this upstream patch:
+    #   https://github.com/tesseract-ocr/tesseract/commit/17e795aaae7d40dbcb7d3365835c2f55ecc6355d.patch
+    #   https://github.com/tesseract-ocr/tesseract/commit/c0db7b7e930322826e09981360e39fdbd16cc9b0.patch
+
+    sed -i src/ccutil/helpers.h -e '1i #include <climits>'
+    sed -i src/ccutil/helpers.h -e '1i #include <cstdint>'
+    sed -i src/dict/matchdefs.h -e '1i #include <cstdint>'
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/ablog/default.nix b/pkgs/applications/misc/ablog/default.nix
index a57bae8aa9b1..8ad7a6232beb 100644
--- a/pkgs/applications/misc/ablog/default.nix
+++ b/pkgs/applications/misc/ablog/default.nix
@@ -34,6 +34,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   pytestFlagsArray = [
+    "-W" "ignore::sphinx.deprecation.RemovedInSphinx90Warning"
     "--rootdir" "src/ablog"
   ];
 
diff --git a/pkgs/applications/misc/acpic/default.nix b/pkgs/applications/misc/acpic/default.nix
index 6b37ef6b8e65..7d05f0a05702 100644
--- a/pkgs/applications/misc/acpic/default.nix
+++ b/pkgs/applications/misc/acpic/default.nix
@@ -6,15 +6,21 @@
 python3Packages.buildPythonApplication rec {
   pname = "acpic";
   version = "1.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit version pname;
     hash = "sha256-vQ9VxCNbOmqHIY3e1wq1wNJl5ywfU2tm62gDg3vKvcg=";
   };
 
-  nativeBuildInputs = [
-    python3Packages.pbr
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "pbr>=5.8.1,<6" "pbr"
+  '';
+
+  nativeBuildInputs = with python3Packages; [
+    pbr
+    setuptools
   ];
 
   # no tests
diff --git a/pkgs/applications/misc/audio/sox/default.nix b/pkgs/applications/misc/audio/sox/default.nix
index 1b8e0541346a..bb751ae01c9d 100644
--- a/pkgs/applications/misc/audio/sox/default.nix
+++ b/pkgs/applications/misc/audio/sox/default.nix
@@ -79,6 +79,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional enableLibpulseaudio libpulseaudio
     ++ lib.optional stdenv.isDarwin CoreAudio;
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Sample Rate Converter for audio";
     homepage = "https://sox.sourceforge.net/";
diff --git a/pkgs/applications/misc/barrier/default.nix b/pkgs/applications/misc/barrier/default.nix
index f068667948c2..d02712848b72 100644
--- a/pkgs/applications/misc/barrier/default.nix
+++ b/pkgs/applications/misc/barrier/default.nix
@@ -26,6 +26,11 @@ mkDerivation rec {
     })
   ];
 
+  CXXFLAGS = [
+    # error: 'uint8_t' is not a member of 'std'; did you mean 'wint_t'?
+    "-include cstdint"
+  ];
+
   buildInputs = [ curl xorg.libX11 xorg.libXext xorg.libXtst avahiWithLibdnssdCompat qtbase ];
   nativeBuildInputs = [ cmake wrapGAppsHook ];
 
diff --git a/pkgs/applications/misc/buku/default.nix b/pkgs/applications/misc/buku/default.nix
index 2ada67daa1e2..ddf2b9f528da 100644
--- a/pkgs/applications/misc/buku/default.nix
+++ b/pkgs/applications/misc/buku/default.nix
@@ -19,6 +19,7 @@ in
 with python3.pkgs; buildPythonApplication rec {
   version = "4.8";
   pname = "buku";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jarun";
@@ -27,6 +28,10 @@ with python3.pkgs; buildPythonApplication rec {
     sha256 = "sha256-kPVlfTYUusf5CZnKB53WZcCHo3MEnA2bLUHTRPGPn+8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     hypothesis
     pytest
diff --git a/pkgs/applications/misc/keepmenu/default.nix b/pkgs/applications/misc/keepmenu/default.nix
index 1e6735d65616..d10c10c231d6 100644
--- a/pkgs/applications/misc/keepmenu/default.nix
+++ b/pkgs/applications/misc/keepmenu/default.nix
@@ -17,8 +17,6 @@ python3Packages.buildPythonApplication rec {
     hatch-vcs
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = with python3Packages; [
     pykeepass
     pynput
diff --git a/pkgs/applications/misc/khal/default.nix b/pkgs/applications/misc/khal/default.nix
index 27bf5d1db267..c892f046c895 100644
--- a/pkgs/applications/misc/khal/default.nix
+++ b/pkgs/applications/misc/khal/default.nix
@@ -17,8 +17,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-yI33pB/t+UISvSbLUzmsZqBxLF6r8R3j9iPNeosKcYw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     glibcLocales
     installShellFiles
diff --git a/pkgs/applications/misc/khard/default.nix b/pkgs/applications/misc/khard/default.nix
index 0654974eb939..6bd9b2089f18 100644
--- a/pkgs/applications/misc/khard/default.nix
+++ b/pkgs/applications/misc/khard/default.nix
@@ -9,7 +9,6 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "sha256-WfMKDaPD2j6wT02+GO5HY5E7aF2Z7IQY/VdKiMSRxJA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
   nativeBuildInputs = with python3.pkgs; [
     setuptools-scm
     sphinxHook
diff --git a/pkgs/applications/misc/mozphab/default.nix b/pkgs/applications/misc/mozphab/default.nix
index 28f1e4b2d98c..05f04ed0aba0 100644
--- a/pkgs/applications/misc/mozphab/default.nix
+++ b/pkgs/applications/misc/mozphab/default.nix
@@ -30,8 +30,6 @@ python3.pkgs.buildPythonApplication rec {
     setuptools-scm
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = with python3.pkgs; [
     colorama
     distro
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index e4bf829191e3..7e172f279d44 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -165,10 +165,14 @@ stdenv.mkDerivation rec {
     EOF
 
     moveToOutput "bin" "$bin"
-  '' + lib.optionalString (enableX11 || enableGL) ''
+  '' + (lib.optionalString (stdenv.isDarwin) ''
+    for exe in $bin/bin/*; do
+      install_name_tool -change build/shared-release/libmupdf.dylib $out/lib/libmupdf.dylib "$exe"
+    done
+  '') + (lib.optionalString (enableX11 || enableGL) ''
     mkdir -p $bin/share/icons/hicolor/48x48/apps
     cp docs/logo/mupdf.png $bin/share/icons/hicolor/48x48/apps
-  '' + (if enableGL then ''
+  '') + (if enableGL then ''
     ln -s "$bin/bin/mupdf-gl" "$bin/bin/mupdf"
   '' else lib.optionalString (enableX11) ''
     ln -s "$bin/bin/mupdf-x11" "$bin/bin/mupdf"
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index e7daa60198d1..5b42f1d08c3c 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -163,7 +163,7 @@ let
                 zeroconf
                 zipstream-ng
                 class-doc
-                pydantic
+                pydantic_1
               ] ++ lib.optionals stdenv.isDarwin [
                 py.pkgs.appdirs
               ] ++ lib.optionals (!stdenv.isDarwin) [
diff --git a/pkgs/applications/misc/pagefind/default.nix b/pkgs/applications/misc/pagefind/default.nix
index 06f62da1ffb6..1d1a91e9e4b5 100644
--- a/pkgs/applications/misc/pagefind/default.nix
+++ b/pkgs/applications/misc/pagefind/default.nix
@@ -7,7 +7,7 @@
 , binaryen
 , gzip
 , nodejs
-, rustc-wasm32
+, rustc
 , wasm-bindgen-cli
 , wasm-pack
 }:
@@ -66,8 +66,8 @@ rustPlatform.buildRustPackage rec {
     binaryen
     gzip
     nodejs
-    rustc-wasm32
-    rustc-wasm32.llvmPackages.lld
+    rustc
+    rustc.llvmPackages.lld
     wasm-bindgen-84
     wasm-pack
   ];
diff --git a/pkgs/applications/misc/pysentation/default.nix b/pkgs/applications/misc/pysentation/default.nix
index c02fec3c0166..1a84c06c94ff 100644
--- a/pkgs/applications/misc/pysentation/default.nix
+++ b/pkgs/applications/misc/pysentation/default.nix
@@ -15,9 +15,14 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-TwHDXWgGWuQVgatBDc1iympnb6dy4xYThLR5MouEZHA=";
   };
 
-  nativeBuildInputs = [
-    python3.pkgs.setuptools
-    python3.pkgs.wheel
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "click"
+    "rich"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/misc/urlscan/default.nix b/pkgs/applications/misc/urlscan/default.nix
index cd6964325106..3715ef27524e 100644
--- a/pkgs/applications/misc/urlscan/default.nix
+++ b/pkgs/applications/misc/urlscan/default.nix
@@ -15,8 +15,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-OzcoOIgEiadWrsUPIxBJTuZQYjScJBYKyqCu1or6fz8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = with python3.pkgs; [
     hatchling
     hatch-vcs
diff --git a/pkgs/applications/misc/yambar/default.nix b/pkgs/applications/misc/yambar/default.nix
index 7d974bf87fd4..8feb3995070c 100644
--- a/pkgs/applications/misc/yambar/default.nix
+++ b/pkgs/applications/misc/yambar/default.nix
@@ -82,6 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
   mesonBuildType = "release";
 
   mesonFlags = [
+    (lib.mesonBool "werror" false)
     (lib.mesonEnable "backend-x11" x11Support)
     (lib.mesonEnable "backend-wayland" waylandSupport)
   ];
diff --git a/pkgs/applications/networking/cloudflare-dyndns/default.nix b/pkgs/applications/networking/cloudflare-dyndns/default.nix
index 2be03621a016..087b3c66f00d 100644
--- a/pkgs/applications/networking/cloudflare-dyndns/default.nix
+++ b/pkgs/applications/networking/cloudflare-dyndns/default.nix
@@ -24,7 +24,7 @@ python3.pkgs.buildPythonApplication rec {
     attrs
     click
     cloudflare
-    pydantic
+    pydantic_1
     requests
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
index 5343fd1c4dae..8e496c6c1101 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
@@ -23,8 +23,6 @@ python3.pkgs.buildPythonApplication rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = with python3.pkgs; [
     appdirs
     deltachat
diff --git a/pkgs/applications/networking/mailreaders/notmuch/default.nix b/pkgs/applications/networking/mailreaders/notmuch/default.nix
index 37c90f1b2f0f..b2970b02f7db 100644
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@@ -85,19 +85,26 @@ stdenv.mkDerivation rec {
     patchShebangs notmuch-git
   '';
 
-  preCheck = let
-    test-database = fetchurl {
-      url = "https://notmuchmail.org/releases/test-databases/database-v1.tar.xz";
-      sha256 = "1lk91s00y4qy4pjh8638b5lfkgwyl282g1m27srsf7qfn58y16a2";
-    };
-  in ''
-    mkdir -p test/test-databases
-    ln -s ${test-database} test/test-databases/database-v1.tar.xz
-  ''
-  # Issues since gnupg: 2.4.0 -> 2.4.1
-  + ''
-    rm test/{T350-crypto,T357-index-decryption}.sh
-  '';
+  preCheck =
+    let
+      test-database = fetchurl {
+        url = "https://notmuchmail.org/releases/test-databases/database-v1.tar.xz";
+        sha256 = "1lk91s00y4qy4pjh8638b5lfkgwyl282g1m27srsf7qfn58y16a2";
+      };
+    in
+    ''
+      mkdir -p test/test-databases
+      ln -s ${test-database} test/test-databases/database-v1.tar.xz
+    ''
+    + ''
+      # Issues since gnupg: 2.4.0 -> 2.4.1
+      rm test/{T350-crypto,T357-index-decryption}.sh
+      # Issues since pbr 6.0.0 bump (ModuleNotFoundError: No module named 'notmuch2')
+      rm test/T055-path-config.sh
+      # Flaky, seems to get its paths wrong sometimes (?)
+      # *ERROR*: Opening output file: Permission denied, /nix/store/bzy21v2cd5sq1djzwa9b19q08wpp9mm0-emacs-29.1/bin/OUTPUT
+      rm test/T460-emacs-tree.sh
+    '';
 
   doCheck = !stdenv.hostPlatform.isDarwin && (lib.versionAtLeast gmime3.version "3.0.3");
   checkTarget = "test";
diff --git a/pkgs/applications/networking/newsreaders/liferea/default.nix b/pkgs/applications/networking/newsreaders/liferea/default.nix
index de651cab98ad..d7643a6f07e8 100644
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , intltool
 , python3Packages
@@ -31,6 +32,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-7lanrs63N6ZnqxvjcW/+cUZVDqUbML2gftQUc/sLr3Q=";
   };
 
+  patches = [
+    # Pull upstream fix for libxml2-2.12 compatibility:
+    #   https://github.com/lwindolf/liferea/pull/1329
+    (fetchpatch {
+      name = "libxml2-2.12.patch";
+      url = "https://github.com/lwindolf/liferea/commit/be8ef494586d9ef73c04ec4ca058a9a158ae3562.patch";
+      hash = "sha256-K1R7dJMm7ui6QKQqAHCo/ZrLCW3PhPU1EKRPEICtCsQ=";
+    })
+  ];
+
   nativeBuildInputs = [
     wrapGAppsHook
     python3Packages.wrapPython
diff --git a/pkgs/applications/office/abiword/default.nix b/pkgs/applications/office/abiword/default.nix
index b90b23a3905a..8f62a4187611 100644
--- a/pkgs/applications/office/abiword/default.nix
+++ b/pkgs/applications/office/abiword/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , gtk3
 , fribidi
@@ -28,6 +29,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-ElckfplwUI1tFFbT4zDNGQnEtCsl4PChvDJSbW86IbQ=";
   };
 
+  patches = [
+    # Fix build with libxml2 2.12
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/World/AbiWord/-/commit/2a06be6a10a0718f8a3d8e00c317f5042c99a467.patch";
+      hash = "sha256-vfh81tGXe9dgnjcAtoWHOK8CtW7MZ75FFjnfKTkiKkk=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     wrapGAppsHook
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 6be1d11ae3b6..e7fa0c53f730 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -13,6 +13,7 @@
 , IOCompress
 , zlib
 , libjpeg
+, liblangtag
 , expat
 , freetype
 , libwpd
@@ -225,6 +226,17 @@ in stdenv.mkDerivation (finalAttrs: {
       url = "https://cgit.freedesktop.org/libreoffice/core/patch/?id=ececb678b8362e3be8e02768ddd5e4197d87dc2a";
       hash = "sha256-TUfKlwNxUTOJ95VLqwVD+ez1xhu7bW6xZlgIaCyIiNg=";
     })
+
+    # Backport libxml 2.12 build fixes
+    # FIXME: remove in next release
+    (fetchpatch {
+      url = "https://cgit.freedesktop.org/libreoffice/core/patch/?id=c8f7408db73d2f2ccacb25a2b4fef8dfebdfc6cb";
+      hash = "sha256-uEgRx1eyS3Wx2ZDWEsUmpIbuKezVrIbO++qSL2QI8Lk=";
+    })
+    (fetchpatch {
+      url = "https://cgit.freedesktop.org/libreoffice/core/patch/?id=cbb17a548b5cc6a99b6ed7735479bb4f2bc40f26";
+      hash = "sha256-ofhif37uvQI+gidaUpyr6XlyBc3gTJUDBRb3ootrzz0=";
+    })
   ];
 
   # libreoffice tries to reference the BUILDCONFIG (e.g. PKG_CONFIG_PATH)
@@ -436,6 +448,7 @@ in stdenv.mkDerivation (finalAttrs: {
     "--with-system-headers"
     "--with-system-openssl"
     "--with-system-libabw"
+    "--with-system-liblangtag"
     "--without-system-libcmis"
     "--with-system-libwps"
     "--with-system-openldap"
@@ -466,7 +479,6 @@ in stdenv.mkDerivation (finalAttrs: {
     "--without-system-lpsolve"
     "--without-system-libetonyek"
     "--without-system-libfreehand"
-    "--without-system-liblangtag"
     "--without-system-libmspub"
     "--without-system-libnumbertext"
     "--without-system-libpagemaker"
@@ -566,6 +578,7 @@ in stdenv.mkDerivation (finalAttrs: {
     libepoxy
     libexttextcat
     libjpeg
+    liblangtag
     libmspack
     libmwaw
     libmysqlclient
diff --git a/pkgs/applications/office/paperwork/openpaperwork-core.nix b/pkgs/applications/office/paperwork/openpaperwork-core.nix
index d434e000da5e..ed9a7d6ed5ad 100644
--- a/pkgs/applications/office/paperwork/openpaperwork-core.nix
+++ b/pkgs/applications/office/paperwork/openpaperwork-core.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     patchShebangs ../tools
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     distro
     setuptools
diff --git a/pkgs/applications/office/paperwork/openpaperwork-gtk.nix b/pkgs/applications/office/paperwork/openpaperwork-gtk.nix
index cd0290f08746..95d5effa151f 100644
--- a/pkgs/applications/office/paperwork/openpaperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/openpaperwork-gtk.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     patchShebangs ../tools
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     pkgs.gettext
     pkgs.which
diff --git a/pkgs/applications/office/paperwork/paperwork-backend.nix b/pkgs/applications/office/paperwork/paperwork-backend.nix
index 95608b26e2fe..4460e50ab624 100644
--- a/pkgs/applications/office/paperwork/paperwork-backend.nix
+++ b/pkgs/applications/office/paperwork/paperwork-backend.nix
@@ -44,8 +44,6 @@ buildPythonPackage rec {
     patchShebangs ../tools
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     distro
     gtk3
diff --git a/pkgs/applications/office/paperwork/paperwork-gtk.nix b/pkgs/applications/office/paperwork/paperwork-gtk.nix
index 9950075d6b27..e21379678a17 100644
--- a/pkgs/applications/office/paperwork/paperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/paperwork-gtk.nix
@@ -42,8 +42,6 @@ python3Packages.buildPythonApplication rec {
 
   sourceRoot = "${src.name}/paperwork-gtk";
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     chmod a+w -R ..
     patchShebangs ../tools
diff --git a/pkgs/applications/office/paperwork/paperwork-shell.nix b/pkgs/applications/office/paperwork/paperwork-shell.nix
index 7a1d82a5eb31..cbda78976b5b 100644
--- a/pkgs/applications/office/paperwork/paperwork-shell.nix
+++ b/pkgs/applications/office/paperwork/paperwork-shell.nix
@@ -32,8 +32,6 @@ buildPythonPackage rec {
     chmod a+w -R ..
     patchShebangs ../tools
   '';
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     openpaperwork-core
     paperwork-backend
diff --git a/pkgs/applications/office/todoman/default.nix b/pkgs/applications/office/todoman/default.nix
index f2940b1e3fb9..d53306e77904 100644
--- a/pkgs/applications/office/todoman/default.nix
+++ b/pkgs/applications/office/todoman/default.nix
@@ -19,8 +19,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-5tQaNT6QVN9mxa9t6OvMux4ZGy4flUqszTAwet2QL0w=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     installShellFiles
   ] ++ (with python3.pkgs; [
diff --git a/pkgs/applications/science/electronics/nanovna-saver/default.nix b/pkgs/applications/science/electronics/nanovna-saver/default.nix
index f65f5e5149ca..e9e693fcf511 100644
--- a/pkgs/applications/science/electronics/nanovna-saver/default.nix
+++ b/pkgs/applications/science/electronics/nanovna-saver/default.nix
@@ -31,8 +31,6 @@ python3.pkgs.buildPythonApplication rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   doCheck = false;
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/science/machine-learning/fasttext/default.nix b/pkgs/applications/science/machine-learning/fasttext/default.nix
index a04ac5a6945e..301308f90136 100644
--- a/pkgs/applications/science/machine-learning/fasttext/default.nix
+++ b/pkgs/applications/science/machine-learning/fasttext/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fasttext";
-  version = "0.9.2";
+  version = "0.9.2-unstable-2023-11-28";
 
   src = fetchFromGitHub {
     owner = "facebookresearch";
     repo = "fastText";
-    rev = "v${version}";
-    sha256 = "07cz2ghfq6amcljaxpdr5chbd64ph513y8zqmibfx2xwfp74xkhn";
+    rev = "6c2204ba66776b700095ff73e3e599a908ffd9c3";
+    hash = "sha256-lSIah4T+QqZwCRpeI3mxJ7PZT6pSHBO26rcEFfK8DSk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/science/math/gmsh/default.nix b/pkgs/applications/science/math/gmsh/default.nix
index 4d9b3afe31ca..62a0c3c405df 100644
--- a/pkgs/applications/science/math/gmsh/default.nix
+++ b/pkgs/applications/science/math/gmsh/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, blas, lapack, gfortran, gmm, fltk, libjpeg
+{ lib, stdenv, fetchurl, fetchpatch, cmake, blas, lapack, gfortran, gmm, fltk, libjpeg
 , zlib, libGL, libGLU, xorg, opencascade-occt
 , python ? null, enablePython ? false }:
 
@@ -24,7 +24,22 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  patches = [ ./fix-python.patch ];
+  patches = [
+    ./fix-python.patch
+
+    # Pull upstream fix git gcc-13:
+    #   https://gitlab.onelab.info/gmsh/gmsh/-/issues/2416
+    (fetchpatch {
+      name = "gcc-13-p1.patch";
+      url = "https://gitlab.onelab.info/gmsh/gmsh/-/commit/fb81a9c9026700e078de947b4522cb39e543a86b.patch";
+      hash = "sha256-1GInFqQZvOgflC3eQTjmZ9uBGFASRNCpCwDACN3yTQ4=";
+    })
+    (fetchpatch {
+      name = "gcc-13-p2.patch";
+      url = "https://gitlab.onelab.info/gmsh/gmsh/-/commit/aceb09c807b78ea26555f99fcb16c4f87c31fb5a.patch";
+      hash = "sha256-6FI0hIvj8hglCvxoKV0GzT2/F/Wz+ddkxV/TLzzJBLU=";
+    })
+  ];
 
   postPatch = ''
     substituteInPlace api/gmsh.py --subst-var-by LIBPATH ${placeholder "out"}/lib/libgmsh.so
diff --git a/pkgs/applications/search/recoll/default.nix b/pkgs/applications/search/recoll/default.nix
index 0560793132d1..902571dd33f1 100644
--- a/pkgs/applications/search/recoll/default.nix
+++ b/pkgs/applications/search/recoll/default.nix
@@ -97,7 +97,10 @@ mkDerivation rec {
     (lib.withFeature stdenv.isLinux "inotify")
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [ "-DNIXPKGS" ];
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-DNIXPKGS"
+    "-fpermissive" # libxml2-2.12 changed const qualifiers
+  ];
 
   patches = [
     # fix "No/bad main configuration file" error
diff --git a/pkgs/applications/terminal-emulators/guake/default.nix b/pkgs/applications/terminal-emulators/guake/default.nix
index d030c7add966..667da3ec229f 100644
--- a/pkgs/applications/terminal-emulators/guake/default.nix
+++ b/pkgs/applications/terminal-emulators/guake/default.nix
@@ -52,8 +52,6 @@ python3.pkgs.buildPythonApplication rec {
     pyyaml
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   makeFlags = [
     "PREFIX=${placeholder "out"}"
   ];
diff --git a/pkgs/applications/version-management/git-cola/default.nix b/pkgs/applications/version-management/git-cola/default.nix
index 56a89f7eec81..e9db7812cca5 100644
--- a/pkgs/applications/version-management/git-cola/default.nix
+++ b/pkgs/applications/version-management/git-cola/default.nix
@@ -11,8 +11,6 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-PtV2mzxOfZ88THiFD4K+qtOi41GeLF1GcdiFFhUR8Ak=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = lib.optionals stdenv.isLinux [ qt5.qtwayland ];
   propagatedBuildInputs = with python3Packages; [ git pyqt5 qtpy send2trash ];
   nativeBuildInputs = with python3Packages; [ setuptools-scm gettext qt5.wrapQtAppsHook ];
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 1b92778e65cc..24eb5c15f5e6 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -29,7 +29,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.42.0";
+  version = "2.43.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-MnghDp/SmUuEhN1+Pd2eqLlA71IXDNtgbaqU2IfJOw0=";
+    hash = "sha256-VEZgPnPZEXgdJZ5WV1Dc0nekKDbI45LKyRzxN6qbduw=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
diff --git a/pkgs/applications/version-management/gitlint/default.nix b/pkgs/applications/version-management/gitlint/default.nix
index 37783a92ab3e..d29bf08855f0 100644
--- a/pkgs/applications/version-management/gitlint/default.nix
+++ b/pkgs/applications/version-management/gitlint/default.nix
@@ -17,8 +17,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-4SGkkC4LjZXTDXwK6jMOIKXR1qX76CasOwSqv8XUrjs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # Upstream splitted the project into gitlint and gitlint-core to
   # simplify the dependency handling
   sourceRoot = "${src.name}/gitlint-core";
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 82417f59352b..1051dc6da886 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -1,6 +1,8 @@
 { lib, stdenv, fetchurl, fetchpatch, python3Packages, makeWrapper, gettext, installShellFiles
 , re2Support ? true
-, rustSupport ? stdenv.hostPlatform.isLinux, cargo, rustPlatform, rustc
+# depends on rust-cpython which won't support python312
+# https://github.com/dgrunwald/rust-cpython/commit/e815555629e557be084813045ca1ddebc2f76ef9
+, rustSupport ? (stdenv.hostPlatform.isLinux && python3Packages.pythonOlder "3.12"), cargo, rustPlatform, rustc
 , fullBuild ? false
 , gitSupport ? fullBuild
 , guiSupport ? fullBuild, tk
@@ -21,11 +23,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.5.3";
+    version = "6.6.1";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-LNyB+t4SnPVrEoQXUn8ZC6cv13ZWc5TOVO7XZOZn59U=";
+      sha256 = "sha256-opRlo/5Ao+jUm6g0MTSsKrooa2g//rg42gz25FIflpU=";
     };
 
     format = "other";
@@ -35,7 +37,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-ob81zMUY4AVNIbkFKyImnj7QhHTh7LVOCcGeZDtTAXc=";
+      sha256 = "sha256-wLV0qdCfMgGpZRxnZik/lRwZHm/66p0sJn/mYVRvRkQ=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
@@ -43,7 +45,7 @@ let
     propagatedBuildInputs = lib.optional re2Support fb-re2
       ++ lib.optional gitSupport pygit2
       ++ lib.optional highlightSupport pygments;
-    nativeBuildInputs = [ makeWrapper gettext installShellFiles ]
+    nativeBuildInputs = [ makeWrapper gettext installShellFiles python3Packages.setuptools ]
       ++ lib.optionals rustSupport [
            rustPlatform.cargoSetupHook
            cargo
diff --git a/pkgs/applications/video/deface/default.nix b/pkgs/applications/video/deface/default.nix
index 8b9e822070cf..428275535af4 100644
--- a/pkgs/applications/video/deface/default.nix
+++ b/pkgs/applications/video/deface/default.nix
@@ -42,9 +42,6 @@ python3.pkgs.buildPythonApplication rec {
     substituteInPlace pyproject.toml requirements.txt --replace "opencv-python" "opencv"
   '';
 
-  # Let setuptools know deface version
-  SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
-
   pythonImportsCheck = [ "deface" "onnx" "onnxruntime" ];
 
   meta = with lib; {
diff --git a/pkgs/applications/video/frigate/default.nix b/pkgs/applications/video/frigate/default.nix
index 5414193640f0..81798df47f27 100644
--- a/pkgs/applications/video/frigate/default.nix
+++ b/pkgs/applications/video/frigate/default.nix
@@ -25,6 +25,12 @@ let
 
   python = python3.override {
     packageOverrides = self: super: {
+      pydantic = super.pydantic_1;
+
+      versioningit = super.versioningit.overridePythonAttrs {
+        # checkPhase requires pydantic>=2
+        doCheck = false;
+      };
     };
   };
 
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index 483d165f947b..54216cf73ad6 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -10,6 +10,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
   # For tests
 , testers
 , runCommand
@@ -135,6 +136,11 @@ let
       "${src}/contrib/ffmpeg/A28-avcodec-amfenc-HDR-metadata.patch"
       # This patch is not applying since ffmpeg 5.1.1, probably it was backported by upstream
       # "${src}/contrib/ffmpeg/A30-svt-av1-backports.patch"
+      (fetchpatch {
+        name = "vulkan-remove-extensions.patch";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff_plain/eb0455d64690";
+        hash = "sha256-qvLrb7b+9/bel8A2lZuSmBiJtHXsABw0Lvgn1ggnmCU=";
+      })
     ];
   });
 
diff --git a/pkgs/applications/video/obs-studio/default.nix b/pkgs/applications/video/obs-studio/default.nix
index 02875950acb4..55d18bf604a7 100644
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@@ -2,10 +2,11 @@
 , lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , addOpenGLRunpath
 , cmake
 , fdk_aac
-, ffmpeg_4
+, ffmpeg
 , jansson
 , libjack2
 , libxkbcommon
@@ -73,6 +74,25 @@ stdenv.mkDerivation (finalAttrs: {
     # Lets obs-browser build against CEF 90.1.0+
     ./Enable-file-access-and-universal-access-for-file-URL.patch
     ./fix-nix-plugin-path.patch
+
+    # Backport ffmpeg 6.1 / GCC 13 build fixes
+    # FIXME: remove in next release
+    (fetchpatch {
+      url = "https://github.com/obsproject/obs-studio/commit/cd784644f5e82b9988043f229c19603289c6d32c.patch";
+      hash = "sha256-S4JE5kgr4x3uMHY2GRh0GBJpb7o/wYZb/v0CDITFNnQ=";
+    })
+    (fetchpatch {
+      url = "https://github.com/obsproject/obs-studio/commit/758b47d4ed9a25b8d64ad481d8d039990b9e57c9.patch";
+      hash = "sha256-jYpjwhx6e+dhN3kzbd6FcdjQ+WhIX0/BOu9PSkt+2yI=";
+    })
+    (fetchpatch {
+      url = "https://github.com/obsproject/obs-studio/commit/4b5be75c7e4b8cee908ed4a02fe0078285b4e8c9.patch";
+      hash = "sha256-tuOevhyxchwG42ilrplbiWoiDAKaY4HgzShlvp4VSQI=";
+    })
+    (fetchpatch {
+      url = "https://github.com/obsproject/obs-studio/commit/6e080a68067b27fe5463f0f4eee7df690451f3d7.patch";
+      hash = "sha256-nbn/q3uszoHaDvaW8Et1MS1sgQzMsJRmjGSMHzUxV70=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -87,7 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     curl
     fdk_aac
-    ffmpeg_4
+    ffmpeg
     jansson
     libcef
     libjack2
diff --git a/pkgs/applications/virtualization/kvmtool/default.nix b/pkgs/applications/virtualization/kvmtool/default.nix
index 9aeb21e3f06a..f546c32042e3 100644
--- a/pkgs/applications/virtualization/kvmtool/default.nix
+++ b/pkgs/applications/virtualization/kvmtool/default.nix
@@ -1,13 +1,12 @@
-{ stdenv, fetchgit, lib, dtc }:
+{ stdenv, fetchzip, lib, dtc }:
 
 stdenv.mkDerivation {
   pname = "kvmtool";
   version = "unstable-2023-07-12";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git";
-    rev = "106e2ea7756d980454d68631b87d5e25ba4e4881";
-    sha256 = "sha256-wpc5DfHnui0lBVH4uOq6a7pXVUZStjNLRvauu6QpRvE=";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git/snapshot/kvmtool-106e2ea7756d980454d68631b87d5e25ba4e4881.tar.gz";
+    hash = "sha256-wpc5DfHnui0lBVH4uOq6a7pXVUZStjNLRvauu6QpRvE=";
   };
 
   patches = [ ./strlcpy-glibc-2.38-fix.patch ];
diff --git a/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix b/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
index 286a521be054..1a36aa8fd6c0 100644
--- a/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
+++ b/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
@@ -1,8 +1,6 @@
 { lib
 , fetchFromGitHub
 , hostPlatform
-, cargo
-, rustc
 , lld
 }:
 
@@ -24,12 +22,7 @@ let
     };
   };
 
-  # inherit (cross) rustPlatform;
-  # ^ breaks because we are doing a no_std embedded build with a custom sysroot,
-  # but the fast_cross rustc wrapper already passes a sysroot argument
-  rustPlatform = cross.makeRustPlatform {
-    inherit rustc cargo;
-  };
+  inherit (cross) rustPlatform;
 
 in
 
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 525b44fe0480..5b185b09a4c5 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -33,6 +33,28 @@
 , useMacosReexportHack ? false
 , wrapGas ? false
 
+# Note: the hardening flags are part of the bintools-wrapper, rather than
+# the cc-wrapper, because a few of them are handled by the linker.
+, defaultHardeningFlags ? with stdenvNoCC; [
+    "bindnow"
+    "format"
+    "fortify"
+    "fortify3"
+    "pic"
+    "relro"
+    "stackprotector"
+    "strictoverflow"
+  ] ++ lib.optional (
+    # Musl-based platforms will keep "pie", other platforms will not.
+    # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
+    # in the nixpkgs manual to inform users about the defaults.
+    targetPlatform.libc == "musl"
+    # Except when:
+    #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
+    #    - static armv7l, where compilation fails.
+    && !(targetPlatform.isAarch && targetPlatform.isStatic)
+  ) "pie"
+
 # Darwin code signing support utilities
 , postLinkSignHook ? null, signingUtils ? null
 }:
@@ -124,6 +146,8 @@ stdenv.mkDerivation {
             (setenv "NIX_LDFLAGS_${suffixSalt}" (concat (getenv "NIX_LDFLAGS_${suffixSalt}") " -L" arg "/lib64"))))
         '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
+
+    inherit defaultHardeningFlags;
   };
 
   dontBuild = true;
@@ -380,6 +404,7 @@ stdenv.mkDerivation {
     wrapperName = "BINTOOLS_WRAPPER";
     inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;
     inherit bintools_bin libc_bin libc_dev libc_lib;
+    default_hardening_flags_str = builtins.toString defaultHardeningFlags;
   };
 
   meta =
diff --git a/pkgs/build-support/bintools-wrapper/setup-hook.sh b/pkgs/build-support/bintools-wrapper/setup-hook.sh
index 7e9547b96c25..c146cbea80e4 100644
--- a/pkgs/build-support/bintools-wrapper/setup-hook.sh
+++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh
@@ -65,7 +65,7 @@ do
 done
 
 # If unset, assume the default hardening flags.
-: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
+: ${NIX_HARDENING_ENABLE="@default_hardening_flags_str@"}
 export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 8cd63e460951..2eae278da160 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -32,7 +32,7 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
 fi
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify stackprotector pie pic strictoverflow format)
+  declare -a allHardeningFlags=(fortify fortify3 stackprotector pie pic strictoverflow format)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 539c29a0a774..56075a032971 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -218,6 +218,8 @@ let
        then guess
        else null;
 
+  defaultHardeningFlags = bintools.defaultHardeningFlags or [];
+
   darwinPlatformForCC = optionalString stdenv.targetPlatform.isDarwin (
     if (targetPlatform.darwinPlatform == "macos" && isGNU) then "macosx"
     else targetPlatform.darwinPlatform
@@ -271,6 +273,8 @@ stdenv.mkDerivation {
     inherit expand-response-params;
 
     inherit nixSupport;
+
+    inherit defaultHardeningFlags;
   };
 
   dontBuild = true;
@@ -706,6 +710,7 @@ stdenv.mkDerivation {
     inherit suffixSalt coreutils_bin bintools;
     inherit libc_bin libc_dev libc_lib;
     inherit darwinPlatformForCC darwinMinVersion darwinMinVersionVariable;
+    default_hardening_flags_str = builtins.toString defaultHardeningFlags;
   };
 
   meta =
diff --git a/pkgs/build-support/cc-wrapper/fortran-hook.sh b/pkgs/build-support/cc-wrapper/fortran-hook.sh
index d72f314c01ce..02da7fd0dc34 100644
--- a/pkgs/build-support/cc-wrapper/fortran-hook.sh
+++ b/pkgs/build-support/cc-wrapper/fortran-hook.sh
@@ -4,8 +4,7 @@ getTargetRoleWrapper
 export FC${role_post}=@named_fc@
 
 # If unset, assume the default hardening flags.
-# These are different for fortran.
-: ${NIX_HARDENING_ENABLE="stackprotector pic strictoverflow relro bindnow"}
+: ${NIX_HARDENING_ENABLE="@default_hardening_flags_str@"}
 export NIX_HARDENING_ENABLE
 
 unset -v role_post
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 9326d76e2a8f..33a2b62a49b0 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -111,7 +111,7 @@ export CC${role_post}=@named_cc@
 export CXX${role_post}=@named_cxx@
 
 # If unset, assume the default hardening flags.
-: ${NIX_HARDENING_ENABLE="fortify fortify3 stackprotector pic strictoverflow format relro bindnow"}
+: ${NIX_HARDENING_ENABLE="@default_hardening_flags_str@"}
 export NIX_HARDENING_ENABLE
 
 # No local scope in sourced file
diff --git a/pkgs/build-support/emacs/melpa.nix b/pkgs/build-support/emacs/melpa.nix
index 178f532d0871..323c6e65d9d9 100644
--- a/pkgs/build-support/emacs/melpa.nix
+++ b/pkgs/build-support/emacs/melpa.nix
@@ -11,8 +11,8 @@ let
     src = fetchFromGitHub {
       owner = "melpa";
       repo = "package-build";
-      rev = "c3c535e93d9dc92acd21ebc4b15016b5c3b90e7d";
-      sha256 = "17z0wbqdd6fspbj43yq8biff6wfggk74xgnaf1xx6ynsp1i74is5";
+      rev = "c48aa078c01b4f07b804270c4583a0a58ffea1c0";
+      sha256 = "sha256-MzPj375upIiYXdQR+wWXv3A1zMqbSrZlH0taLuxx/1M=";
     };
 
     patches = [ ./package-build-dont-use-mtime.patch ];
diff --git a/pkgs/build-support/emacs/melpa2nix.el b/pkgs/build-support/emacs/melpa2nix.el
index 72667dea652c..3de77dbf5e5c 100644
--- a/pkgs/build-support/emacs/melpa2nix.el
+++ b/pkgs/build-support/emacs/melpa2nix.el
@@ -11,22 +11,22 @@
 ;; Allow installing package tarfiles larger than 10MB
 (setq large-file-warning-threshold nil)
 
-(defun melpa2nix-build-package-1 (rcp version commit)
-  (let ((source-dir (package-recipe--working-tree rcp)))
+(defun melpa2nix-build-package-1 (rcp)
+  (let* ((default-directory (package-recipe--working-tree rcp)))
     (unwind-protect
         (let ((files (package-build-expand-files-spec rcp t)))
-          (cond
-           ((= (length files) 1)
-            (package-build--build-single-file-package
-             rcp version commit files source-dir))
-           ((> (length files) 1)
-            (package-build--build-multi-file-package
-             rcp version commit files source-dir))
-           (t (error "Unable to find files matching recipe patterns")))))))
+          (unless files
+            (error "Unable to find files matching recipe patterns"))
+          (if (> (length files) 1)
+              (package-build--build-multi-file-package rcp files)
+            (package-build--build-single-file-package rcp files))))))
 
 (defun melpa2nix-build-package ()
-  (if (not noninteractive)
-      (error "`melpa2nix-build-package' is to be used only with -batch"))
+  (unless noninteractive
+    (error "`melpa2nix-build-package' is to be used only with -batch"))
   (pcase command-line-args-left
     (`(,package ,version ,commit)
-     (melpa2nix-build-package-1 (package-recipe-lookup package) version commit))))
+     (let ((recipe (package-recipe-lookup package)))
+       (setf (oref recipe commit) commit)
+       (setf (oref recipe version) version)
+       (melpa2nix-build-package-1 recipe)))))
diff --git a/pkgs/build-support/emacs/package-build-dont-use-mtime.patch b/pkgs/build-support/emacs/package-build-dont-use-mtime.patch
index fe94de57a300..1ace7771ea3a 100644
--- a/pkgs/build-support/emacs/package-build-dont-use-mtime.patch
+++ b/pkgs/build-support/emacs/package-build-dont-use-mtime.patch
@@ -1,40 +1,21 @@
 diff --git a/package-build.el b/package-build.el
-index e572045..9eb0f82 100644
+index 29cdb61..c19be1b 100644
 --- a/package-build.el
 +++ b/package-build.el
-@@ -415,7 +415,7 @@ (defun package-build--write-pkg-file (desc dir)
-       (princ ";; Local Variables:\n;; no-byte-compile: t\n;; End:\n"
-              (current-buffer)))))
- 
--(defun package-build--create-tar (name version directory mtime)
-+(defun package-build--create-tar (name version directory)
-   "Create a tar file containing the contents of VERSION of package NAME.
- DIRECTORY is a temporary directory that contains the directory
- that is put in the tarball.  MTIME is used as the modification
-@@ -434,7 +434,7 @@ (defun package-build--create-tar (name version directory mtime)
-        ;; prevent a reproducable tarball as described at
+@@ -923,7 +923,6 @@ DIRECTORY is a temporary directory that contains the directory
+ that is put in the tarball."
+   (let* ((name (oref rcp name))
+          (version (oref rcp version))
+-         (time (oref rcp time))
+          (tar (expand-file-name (concat name "-" version ".tar")
+                                 package-build-archive-dir))
+          (dir (concat name "-" version)))
+@@ -939,7 +938,7 @@ that is put in the tarball."
+        ;; prevent a reproducible tarball as described at
         ;; https://reproducible-builds.org/docs/archives.
         "--sort=name"
--       (format "--mtime=@%d" mtime)
+-       (format "--mtime=@%d" time)
 +       "--mtime=@0"
         "--owner=0" "--group=0" "--numeric-owner"
         "--pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime"))
      (when (and package-build-verbose noninteractive)
-@@ -848,12 +848,11 @@ (defun package-build--build-multi-file-package (rcp version commit files source-
-                            (package-build--desc-from-library
-                             name version commit files 'tar)
-                            (error "%s[-pkg].el matching package name is missing"
--                                  name))))
--               (mtime (package-build--get-commit-time rcp commit)))
-+                                  name)))))
-           (package-build--copy-package-files files source-dir target)
-           (package-build--write-pkg-file desc target)
-           (package-build--generate-info-files files source-dir target)
--          (package-build--create-tar name version tmp-dir mtime)
-+          (package-build--create-tar name version tmp-dir)
-           (package-build--write-pkg-readme name files source-dir)
-           (package-build--write-archive-entry desc))
-       (delete-directory tmp-dir t nil))))
--- 
-2.37.2
-
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index 2546b8e6dc99..af0468b3e494 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -125,6 +125,7 @@
 
   # Mirrors from https://download.kde.org/ls-lR.mirrorlist
   kde = [
+    "https://cdn.download.kde.org/"
     "https://download.kde.org/download.php?url="
     "https://ftp.gwdg.de/pub/linux/kde/"
     "https://mirrors.ocf.berkeley.edu/kde/"
diff --git a/pkgs/build-support/rust/hooks/maturin-build-hook.sh b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
index d5ff069290ba..028441d18160 100644
--- a/pkgs/build-support/rust/hooks/maturin-build-hook.sh
+++ b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
@@ -25,7 +25,7 @@ maturinBuildHook() {
 
     # Move the wheel to dist/ so that regular Python tooling can find it.
     mkdir -p dist
-    mv target/wheels/*.whl dist/
+    mv ${cargoRoot:+$cargoRoot/}target/wheels/*.whl dist/
 
     # These are python build hooks and may depend on ./dist
     runHook postBuild
diff --git a/pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh b/pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh
index a62e35b8736f..2082f3126a53 100644
--- a/pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh
+++ b/pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh
@@ -1,6 +1,19 @@
 #!@shell@
 
-extraBefore=(@sysroot@)
+defaultSysroot=(@sysroot@)
+
+for arg; do
+    case "$arg" in
+        --sysroot)
+            defaultSysroot=()
+            ;;
+        --)
+            break
+            ;;
+    esac
+done
+
+extraBefore=("${defaultSysroot[@]}")
 extraAfter=($NIX_RUSTFLAGS)
 
 # Optionally print debug info.
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 371389df427b..9f6366b3feae 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -53,17 +53,30 @@ autoPatchelf() {
         esac
     done
 
-    readarray -td' ' ignoreMissingDepsArray < <(echo -n "$autoPatchelfIgnoreMissingDeps")
-    if [ "$autoPatchelfIgnoreMissingDeps" == "1" ]; then
-        echo "autoPatchelf: WARNING: setting 'autoPatchelfIgnoreMissingDeps" \
-             "= true;' is deprecated and will be removed in a future release." \
-             "Use 'autoPatchelfIgnoreMissingDeps = [ \"*\" ];' instead." >&2
-        ignoreMissingDepsArray=( "*" )
+    if [ -n "$__structuredAttrs" ]; then
+        local ignoreMissingDepsArray=( "${autoPatchelfIgnoreMissingDeps[@]}" )
+        local appendRunpathsArray=( "${appendRunpaths[@]}" )
+        local runtimeDependenciesArray=( "${runtimeDependencies[@]}" )
+        local patchelfFlagsArray=( "${patchelfFlags[@]}" )
+    else
+        readarray -td' ' ignoreMissingDepsArray < <(echo -n "$autoPatchelfIgnoreMissingDeps")
+        local appendRunpathsArray=($appendRunpaths)
+        local runtimeDependenciesArray=($runtimeDependencies)
+        local patchelfFlagsArray=($patchelfFlags)
     fi
 
-    local appendRunpathsArray=($appendRunpaths)
-    local runtimeDependenciesArray=($runtimeDependencies)
-    local patchelfFlagsArray=($patchelfFlags)
+    # Check if ignoreMissingDepsArray contains "1" and if so, replace it with
+    # "*", printing a deprecation warning.
+    for dep in "${ignoreMissingDepsArray[@]}"; do
+        if [ "$dep" == "1" ]; then
+            echo "autoPatchelf: WARNING: setting 'autoPatchelfIgnoreMissingDeps" \
+                 "= true;' is deprecated and will be removed in a future release." \
+                 "Use 'autoPatchelfIgnoreMissingDeps = [ \"*\" ];' instead." >&2
+            ignoreMissingDepsArray=( "*" )
+            break
+        fi
+    done
+
     @pythonInterpreter@ @autoPatchelfScript@                            \
         ${norecurse:+--no-recurse}                                      \
         --ignore-missing "${ignoreMissingDepsArray[@]}"                 \
diff --git a/pkgs/by-name/ai/airlift/package.nix b/pkgs/by-name/ai/airlift/package.nix
index 81ac5acc2efa..9ab35cc2a462 100644
--- a/pkgs/by-name/ai/airlift/package.nix
+++ b/pkgs/by-name/ai/airlift/package.nix
@@ -1,7 +1,6 @@
 { lib
 , python3
 , fetchPypi
-, argparse
 , kubernetes-helm
 , kind
 , docker
@@ -17,16 +16,22 @@ python3.pkgs.buildPythonApplication rec {
     inherit pname version;
     hash = "sha256-1LE3fpfX4NExJdUdSjt4BXvxQTLJ8zrRkGHkxo/6Pb8=";
   };
+
+  postPatch = ''
+    sed -i '/argparse/d' pyproject.toml
+  '';
+
+   nativeBuildInputs = [
+    python3.pkgs.poetry-core
+  ];
+
   buildInputs = [
     kubernetes-helm
     kind
     docker
   ];
-  nativeBuildInputs = [
-    python3.pkgs.poetry-core
-  ];
+
   propagatedBuildInputs = with python3.pkgs; [
-    argparse
     halo
     pyyaml
     hiyapyco
diff --git a/pkgs/by-name/bi/bitbake-language-server/package.nix b/pkgs/by-name/bi/bitbake-language-server/package.nix
index 4847f3464b0d..97cc8a63fc66 100644
--- a/pkgs/by-name/bi/bitbake-language-server/package.nix
+++ b/pkgs/by-name/bi/bitbake-language-server/package.nix
@@ -26,8 +26,6 @@ python3.pkgs.buildPythonApplication rec {
     pygls
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index cc69b4de4ad2..51db582b68f2 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -138,8 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
     "CFLAGS=-D_FILE_OFFSET_BITS=64"
     "CXXFLAGS=-D_FILE_OFFSET_BITS=64"
   ]
-  # Workaround missing atomic ops with gcc <13
-  ++ lib.optional stdenv.hostPlatform.isRiscV "LDFLAGS=-latomic"
   ++ [
     "--"
     # We should set the proper `CMAKE_SYSTEM_NAME`.
diff --git a/pkgs/by-name/ho/homeassistant-satellite/package.nix b/pkgs/by-name/ho/homeassistant-satellite/package.nix
index 26f90237f521..c5a6026d8ec3 100644
--- a/pkgs/by-name/ho/homeassistant-satellite/package.nix
+++ b/pkgs/by-name/ho/homeassistant-satellite/package.nix
@@ -16,8 +16,12 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = with python3.pkgs; [
+    pythonRelaxDepsHook
     setuptools
-    wheel
+  ];
+
+  pythonRelaxDeps = [
+    "aiohttp"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch b/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch
new file mode 100644
index 000000000000..aea0348f4b63
--- /dev/null
+++ b/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch
@@ -0,0 +1,27 @@
+From a908a574daf8bac10bb2a0ee3771052d2167a85f Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Sun, 3 Dec 2023 15:41:20 -0500
+Subject: [PATCH] Fix test failure on Darwin on a case-sensitive fs
+
+This was encountered while looking into an issue with
+https://github.com/NixOS/nixpkgs/pull/268583.
+
+I run my Nix store on case-sensitive APFS, so the test fails due to
+trying to link `-framework ldap` instead of `-framework LDAP`.
+---
+ test cases/osx/5 extra frameworks/meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/test cases/osx/5 extra frameworks/meson.build b/test cases/osx/5 extra frameworks/meson.build
+index f6c01e63a1bd..96532846c632 100644
+--- a/test cases/osx/5 extra frameworks/meson.build	
++++ b/test cases/osx/5 extra frameworks/meson.build	
+@@ -7,7 +7,7 @@ dep_main = dependency('Foundation')
+ assert(dep_main.type_name() == 'extraframeworks', 'type_name is ' + dep_main.type_name())
+ 
+ # https://github.com/mesonbuild/meson/issues/10002
+-ldap_dep = dependency('ldap', method : 'extraframework')
++ldap_dep = dependency('LDAP', method : 'extraframework')
+ assert(ldap_dep.type_name() == 'extraframeworks', 'type_name is ' + ldap_dep.type_name())
+ 
+ stlib = static_library('stat', 'stat.c', install : true, dependencies: [opengl_dep, ldap_dep])
diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 6239927848aa..86ac76ffafbb 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -1,11 +1,11 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , installShellFiles
 , coreutils
 , darwin
 , libxcrypt
+, openldap
 , ninja
 , pkg-config
 , python3
@@ -14,17 +14,17 @@
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation OpenGL;
+  inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation LDAP OpenGL;
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.2.3";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-dgYYz3tQDG6Z4eE77WO2dXdardxVzzGaFLQ5znPcTlw=";
+    hash = "sha256-Jt3PWnbv/8P6Rvf3E/Yli2vdtfgx3CmsW+jlc9CK5KA=";
   };
 
   patches = [
@@ -66,15 +66,8 @@ python3.pkgs.buildPythonApplication rec {
     # Nixpkgs cctools does not have bitcode support.
     ./006-disable-bitcode.patch
 
-    # Fix passing multiple --define-variable arguments to pkg-config.
-    # https://github.com/mesonbuild/meson/pull/10670
-    (fetchpatch {
-      url = "https://github.com/mesonbuild/meson/commit/d5252c5d4cf1c1931fef0c1c98dd66c000891d21.patch";
-      hash = "sha256-GiUNVul1N5Fl8mfqM7vA/r1FdKqImiDYLXMVDt77gvw=";
-      excludes = [
-        "docs/yaml/objects/dep.yaml"
-      ];
-    })
+    # https://github.com/mesonbuild/meson/pull/12587
+    ./007-darwin-case-sensitivity.patch
   ];
 
   buildInputs = lib.optionals (python3.pythonOlder "3.9") [
@@ -95,7 +88,9 @@ python3.pkgs.buildPythonApplication rec {
     AppKit
     Cocoa
     Foundation
+    LDAP
     OpenGL
+    openldap
   ];
 
   checkPhase = lib.concatStringsSep "\n" ([
diff --git a/pkgs/by-name/si/sirius/package.nix b/pkgs/by-name/si/sirius/package.nix
index ee6052cf09c1..c09b9360419e 100644
--- a/pkgs/by-name/si/sirius/package.nix
+++ b/pkgs/by-name/si/sirius/package.nix
@@ -85,6 +85,11 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ mpi ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'uintptr_t' in namespace 'std' does not name a type
+    "-include cstdint"
+  ];
+
   cmakeFlags = [
     "-DUSE_SCALAPACK=ON"
     "-DBUILD_TESTING=ON"
diff --git a/pkgs/by-name/uc/ucode/package.nix b/pkgs/by-name/uc/ucode/package.nix
new file mode 100644
index 000000000000..9998b24df082
--- /dev/null
+++ b/pkgs/by-name/uc/ucode/package.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, json_c
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ucode";
+  version = "0.0.20231102";
+
+  src = fetchFromGitHub {
+    owner = "jow-";
+    repo = "ucode";
+    rev = "v${version}";
+    hash = "sha256-dJjlwuQLS73D6W/bmhWLPPaT7himQyO1RvD+MXVxBMw=";
+  };
+
+  buildInputs = [
+    json_c
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  meta = with lib; {
+    description = "JavaScript-like language with optional templating";
+    homepage = "https://github.com/jow-/ucode";
+    license = licenses.isc;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mkg20001 ];
+  };
+}
diff --git a/pkgs/by-name/ud/udebug/package.nix b/pkgs/by-name/ud/udebug/package.nix
new file mode 100644
index 000000000000..12de722bf68d
--- /dev/null
+++ b/pkgs/by-name/ud/udebug/package.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, cmake
+, fetchgit
+, pkg-config
+, ubus
+, libubox
+, ucode
+, json_c
+}:
+
+stdenv.mkDerivation {
+  pname = "udebug";
+  version = "unstable-2023-11-28";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/udebug.git";
+    rev = "d49aadabb7a147b99a3e6299a77d7fda4e266091";
+    hash = "sha256-5I50q+oUQ5f82ngKl7bX50J+3pBviNk3iVEChNjt5wY=";
+  };
+
+  buildInputs = [
+    ubus
+    libubox
+    ucode
+    json_c
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  meta = with lib; {
+    description = "OpenWrt debugging helper library/service";
+    homepage = "https://git.openwrt.org/?p=project/udebug.git;a=summary";
+    license = licenses.free;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mkg20001 ];
+  };
+}
diff --git a/pkgs/by-name/we/websecprobe/package.nix b/pkgs/by-name/we/websecprobe/package.nix
index fb81063526cf..544d56f0114b 100644
--- a/pkgs/by-name/we/websecprobe/package.nix
+++ b/pkgs/by-name/we/websecprobe/package.nix
@@ -5,18 +5,17 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "websecprobe";
-  version = "0.0.10";
+  version = "0.0.11";
   pyproject = true;
 
   src = fetchPypi {
     pname = "WebSecProbe";
     inherit version;
-    hash = "sha256-QvXOyQUptMyim/bgvhihjgGs7vX0qX8MqK2ol8q9ePc=";
+    hash = "sha256-OKbKz3HSTtwyx/JNUtLJBTaHQcxkUWroMg9/msVWgk4=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
     setuptools
-    wheel
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index f04005af7452..b90a560045bb 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2023c";
+  version = "2023d";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-P1ELXRtK6bs45IWqMCp3azF/s2N722QExK33tsrdllw=";
+      hash = "sha256-28ohlwsKi4wM7O7B17kfqQO+D27KWucytTKWciMqCPM=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-RtF/K7Ga1zKQ8DogMAYVLg+g17EeW3FGfEqCOBGyFOc=";
+      hash = "sha256-6aX54RiIbS3pK2K7BVEKKMxsBY15HJO9a4TTKSw8Fh4=";
     })
   ];
 
diff --git a/pkgs/desktops/gnome/apps/gnome-clocks/default.nix b/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
index ab05d40677ec..be7896f6b11a 100644
--- a/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-clocks/default.nix
@@ -9,7 +9,6 @@
 , itstool
 , desktop-file-utils
 , vala
-, gobject-introspection
 , libxml2
 , gtk4
 , glib
@@ -43,7 +42,6 @@ stdenv.mkDerivation rec {
     wrapGAppsHook4
     desktop-file-utils
     libxml2
-    gobject-introspection # for finding vapi files
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/apps/seahorse/default.nix b/pkgs/desktops/gnome/apps/seahorse/default.nix
index bbab612b9c8d..1207d7969610 100644
--- a/pkgs/desktops/gnome/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome/apps/seahorse/default.nix
@@ -57,10 +57,6 @@ stdenv.mkDerivation rec {
     gnupg
     desktop-file-utils
     gcr
-    # error: Package `...' not found in specified Vala API directories or GObject-Introspection GIR directories
-    # TODO: the vala setuphook should look for vala filess in targetOffset instead of hostOffset
-    libhandy
-    libsecret
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/baobab/default.nix b/pkgs/desktops/gnome/core/baobab/default.nix
index e813f5f591ab..b459677a3e36 100644
--- a/pkgs/desktops/gnome/core/baobab/default.nix
+++ b/pkgs/desktops/gnome/core/baobab/default.nix
@@ -36,10 +36,6 @@ stdenv.mkDerivation rec {
     pkg-config
     vala
     wrapGAppsHook4
-    # Prevents “error: Package `libadwaita-1' not found in specified Vala API
-    # directories or GObject-Introspection GIR directories” with strictDeps,
-    # even though it should only be a runtime dependency.
-    libadwaita
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/gnome-calculator/default.nix b/pkgs/desktops/gnome/core/gnome-calculator/default.nix
index 73863ccfaf33..0ea86b7b4511 100644
--- a/pkgs/desktops/gnome/core/gnome-calculator/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-calculator/default.nix
@@ -12,7 +12,6 @@
 , glib
 , gtksourceview5
 , wrapGAppsHook4
-, gobject-introspection
 , gnome
 , mpfr
 , gmp
@@ -40,7 +39,6 @@ stdenv.mkDerivation rec {
     gettext
     itstool
     wrapGAppsHook4
-    gobject-introspection # for finding vapi files
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/games/gnome-mines/default.nix b/pkgs/desktops/gnome/games/gnome-mines/default.nix
index dd214f38071f..4640c5842493 100644
--- a/pkgs/desktops/gnome/games/gnome-mines/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-mines/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, meson, ninja, vala, gobject-introspection, pkg-config, gnome, gtk3, wrapGAppsHook
+{ lib, stdenv, fetchurl, meson, ninja, vala, pkg-config, gnome, gtk3, wrapGAppsHook
 , librsvg, gettext, itstool, python3, libxml2, libgnome-games-support, libgee, desktop-file-utils }:
 
 stdenv.mkDerivation rec {
@@ -10,9 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "NQLps/ccs7LnEcDmAZGH/rzCvKh349RW3KtwD3vjEnI=";
   };
 
-  # gobject-introspection for finding vapi files
   nativeBuildInputs = [
-    meson ninja vala gobject-introspection pkg-config gettext itstool python3
+    meson ninja vala pkg-config gettext itstool python3
     libxml2 wrapGAppsHook desktop-file-utils
   ];
   buildInputs = [ gtk3 librsvg gnome.adwaita-icon-theme libgnome-games-support libgee ];
diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index bb933eac9af0..bd59b66f51fa 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -13,13 +13,20 @@ stdenv.mkDerivation rec {
     hash = "sha256-gMwbWiP+YDCVafQMBWhTuJGWmkYtnhEdn/oofKaUT08=";
   };
 
-  # Fix build with Node 20
   # FIXME: remove for next release
   patches = [
     (fetchpatch {
+      name = "nodejs-20.patch";
       url = "https://github.com/WebAssembly/binaryen/commit/889422e0c92552ff484659f9b41e777ba7ab35c1.patch";
       hash = "sha256-acM8mytL9nhm4np9tpUbd1X0wJ7y308HV2fvgcAW1lY=";
     })
+
+    # Fix fmin tests on gcc-13: https://github.com/WebAssembly/binaryen/pull/5994
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/WebAssembly/binaryen/commit/1e17dfb695a19d5d41f1f88411fbcbc5f2408c8f.patch";
+      hash = "sha256-5JZh15CXkg5XdTG8eRJXPwO+zmymYeFjKbHutRPTmlU=";
+    })
   ];
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/compilers/blueprint/default.nix b/pkgs/development/compilers/blueprint/default.nix
index 99b275db2aa6..f52b43f49a82 100644
--- a/pkgs/development/compilers/blueprint/default.nix
+++ b/pkgs/development/compilers/blueprint/default.nix
@@ -45,7 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # requires xvfb-run
-  doCheck = !stdenv.isDarwin;
+  doCheck = !stdenv.isDarwin
+  && false;  # tests time out
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/development/compilers/dtc/default.nix b/pkgs/development/compilers/dtc/default.nix
index d9013895becc..adc3ed7aaac8 100644
--- a/pkgs/development/compilers/dtc/default.nix
+++ b/pkgs/development/compilers/dtc/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchgit
+, fetchzip
 , fetchpatch
 , meson
 , ninja
@@ -18,9 +18,8 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "dtc";
   version = "1.7.0";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/utils/dtc/dtc.git";
-    rev = "refs/tags/v${finalAttrs.version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/utils/dtc/dtc.git/snapshot/dtc-v${finalAttrs.version}.tar.gz";
     sha256 = "sha256-FMh3VvlY3fUK8fbd0M+aCmlUrmG9YegiOOQ7MOByffc=";
   };
 
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index eef6faf26424..e0ca04a13878 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -406,8 +406,9 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
   passthru = {
     inherit langC langCC langObjC langObjCpp langAda langFortran langGo langD langJava version;
     isGNU = true;
-  } // lib.optionalAttrs (!atLeast12) {
-    hardeningUnsupportedFlags = lib.optionals is48 [ "stackprotector" ] ++ [ "fortify3" ];
+    hardeningUnsupportedFlags = lib.optional is48 "stackprotector"
+      ++ lib.optional (!atLeast12) "fortify3"
+      ++ lib.optionals (langFortran) [ "fortify" "format" ];
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/compilers/ghc/8.10.2-binary.nix b/pkgs/development/compilers/ghc/8.10.2-binary.nix
index d04e85777775..c8d645cfa361 100644
--- a/pkgs/development/compilers/ghc/8.10.2-binary.nix
+++ b/pkgs/development/compilers/ghc/8.10.2-binary.nix
@@ -252,6 +252,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
     # We have to patch the GMP paths for the integer-gmp package.
     # Note [musl bindists have no .buildinfo]
diff --git a/pkgs/development/compilers/ghc/8.10.7-binary.nix b/pkgs/development/compilers/ghc/8.10.7-binary.nix
index f373d963ed28..3376671d65b4 100644
--- a/pkgs/development/compilers/ghc/8.10.7-binary.nix
+++ b/pkgs/development/compilers/ghc/8.10.7-binary.nix
@@ -250,6 +250,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
     # We have to patch the GMP paths for the integer-gmp package.
     # Note that musl bindists do not contain them,
diff --git a/pkgs/development/compilers/ghc/8.6.5-binary.nix b/pkgs/development/compilers/ghc/8.6.5-binary.nix
index 58e61604cd61..5f9d6c824d42 100644
--- a/pkgs/development/compilers/ghc/8.6.5-binary.nix
+++ b/pkgs/development/compilers/ghc/8.6.5-binary.nix
@@ -102,6 +102,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
 
     # We have to patch the GMP paths for the integer-gmp package.
diff --git a/pkgs/development/compilers/ghc/9.2.4-binary.nix b/pkgs/development/compilers/ghc/9.2.4-binary.nix
index 909d090c1704..77d70d295070 100644
--- a/pkgs/development/compilers/ghc/9.2.4-binary.nix
+++ b/pkgs/development/compilers/ghc/9.2.4-binary.nix
@@ -236,6 +236,8 @@ stdenv.mkDerivation rec {
     ''
       patchShebangs ghc-${version}/utils/
       patchShebangs ghc-${version}/configure
+      test -d ghc-${version}/inplace/bin && \
+        patchShebangs ghc-${version}/inplace/bin
     '' +
     # We have to patch the GMP paths for the integer-gmp package.
     ''
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index 0f75d09098be..ff55201ebd03 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -26,9 +26,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake python3 bison jq ];
 
-  # Workaround missing atomic ops with gcc <13
-  env.LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
-
   postPatch = ''
     cp --no-preserve=mode -r "${spirv-tools.src}" External/spirv-tools
     ln -s "${spirv-headers.src}" External/spirv-tools/external/spirv-headers
diff --git a/pkgs/development/compilers/llvm/11/clang/default.nix b/pkgs/development/compilers/llvm/11/clang/default.nix
index a4fe7199e080..0e61930f1c0e 100644
--- a/pkgs/development/compilers/llvm/11/clang/default.nix
+++ b/pkgs/development/compilers/llvm/11/clang/default.nix
@@ -50,7 +50,7 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/12/clang/default.nix b/pkgs/development/compilers/llvm/12/clang/default.nix
index 7ecd4efc0837..c46776d38ac3 100644
--- a/pkgs/development/compilers/llvm/12/clang/default.nix
+++ b/pkgs/development/compilers/llvm/12/clang/default.nix
@@ -47,7 +47,7 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/13/clang/default.nix b/pkgs/development/compilers/llvm/13/clang/default.nix
index a070e64c7ddd..6604ae0efc3f 100644
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@@ -43,7 +43,7 @@ let
       ./revert-malloc-alignment-assumption.patch
       ../../common/clang/add-nostdlibinc-flag.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/14/clang/default.nix b/pkgs/development/compilers/llvm/14/clang/default.nix
index 976ff7580ac3..9f0da7a9f46c 100644
--- a/pkgs/development/compilers/llvm/14/clang/default.nix
+++ b/pkgs/development/compilers/llvm/14/clang/default.nix
@@ -46,7 +46,7 @@ let
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/15/clang/default.nix b/pkgs/development/compilers/llvm/15/clang/default.nix
index 894db1a4975f..c49d6368cb97 100644
--- a/pkgs/development/compilers/llvm/15/clang/default.nix
+++ b/pkgs/development/compilers/llvm/15/clang/default.nix
@@ -52,7 +52,7 @@ let
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
       (substituteAll {
-        src = ../../clang-11-12-LLVMgold-path.patch;
+        src = ../../clang-11-15-LLVMgold-path.patch;
         libllvmLibdir = "${libllvm.lib}/lib";
       })
     ];
diff --git a/pkgs/development/compilers/llvm/16/clang/default.nix b/pkgs/development/compilers/llvm/16/clang/default.nix
index b801bdda5292..5f28e810f603 100644
--- a/pkgs/development/compilers/llvm/16/clang/default.nix
+++ b/pkgs/development/compilers/llvm/16/clang/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
-, cmake, ninja, libxml2, libllvm, version, python3
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -51,11 +51,10 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
-      # FIMXE: do we need this patch?
-      # (substituteAll {
-      #   src = ../../clang-11-12-LLVMgold-path.patch;
-      #  libllvmLibdir = "${libllvm.lib}/lib";
-      # })
+      (substituteAll {
+        src = ../../clang-at-least-16-LLVMgold-path.patch;
+       libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/16/llvm/default.nix b/pkgs/development/compilers/llvm/16/llvm/default.nix
index 9994076bbdab..a6faf9fd635d 100644
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/16/llvm/default.nix
@@ -325,7 +325,8 @@ in
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (false) [
+  ] ++ optionals enableGoldPlugin [
+    # For LLVMgold plugin
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/17/clang/default.nix b/pkgs/development/compilers/llvm/17/clang/default.nix
index a576c07d3661..3184437830a2 100644
--- a/pkgs/development/compilers/llvm/17/clang/default.nix
+++ b/pkgs/development/compilers/llvm/17/clang/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
-, cmake, ninja, libxml2, libllvm, version, python3
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -52,11 +52,10 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
-      # FIMXE: do we need this patch?
-      # (substituteAll {
-      #   src = ../../clang-11-12-LLVMgold-path.patch;
-      #  libllvmLibdir = "${libllvm.lib}/lib";
-      # })
+      (substituteAll {
+        src = ../../clang-at-least-16-LLVMgold-path.patch;
+       libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/17/llvm/default.nix b/pkgs/development/compilers/llvm/17/llvm/default.nix
index 3d05837d45da..b38fef333135 100644
--- a/pkgs/development/compilers/llvm/17/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/17/llvm/default.nix
@@ -8,8 +8,7 @@
 , python3
 , python3Packages
 , libffi
-# TODO: Gold plugin on LLVM16 has a severe memory corruption bug: https://github.com/llvm/llvm-project/issues/61350.
-, enableGoldPlugin ? false
+, enableGoldPlugin ? true
 , libbfd
 , libpfm
 , libxml2
@@ -66,8 +65,8 @@ let
   else python3;
 
 in
-  assert (lib.assertMsg (!enableGoldPlugin) "Gold plugin cannot be enabled on LLVM16 due to a upstream issue: https://github.com/llvm/llvm-project/issues/61350");
-  stdenv.mkDerivation (rec {
+
+stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -325,7 +324,8 @@ in
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (false) [
+  ] ++ optionals enableGoldPlugin [
+    # For LLVMgold plugin
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/llvm/clang-11-12-LLVMgold-path.patch b/pkgs/development/compilers/llvm/clang-11-15-LLVMgold-path.patch
index 8f8991976f33..8f8991976f33 100644
--- a/pkgs/development/compilers/llvm/clang-11-12-LLVMgold-path.patch
+++ b/pkgs/development/compilers/llvm/clang-11-15-LLVMgold-path.patch
diff --git a/pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch b/pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch
new file mode 100644
index 000000000000..74cdbacc8a71
--- /dev/null
+++ b/pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch
@@ -0,0 +1,14 @@
+diff --git a/lib/Driver/ToolChains/CommonArgs.cpp b/lib/Driver/ToolChains/CommonArgs.cpp
+index 34640b3c450d..93c4a4f4ec5c 100644
+--- a/lib/Driver/ToolChains/CommonArgs.cpp
++++ b/lib/Driver/ToolChains/CommonArgs.cpp
+@@ -589,8 +589,7 @@ void tools::addLTOOptions(const ToolChain &ToolChain, const ArgList &Args,
+ #endif
+ 
+     SmallString<1024> Plugin;
+-    llvm::sys::path::native(Twine(D.Dir) +
+-                                "/../" CLANG_INSTALL_LIBDIR_BASENAME +
++    llvm::sys::path::native(Twine("@libllvmLibdir@") +
+                                 PluginName + Suffix,
+                             Plugin);
+     CmdArgs.push_back(Args.MakeArgString(Twine(PluginPrefix) + Plugin));
diff --git a/pkgs/development/compilers/llvm/git/clang/default.nix b/pkgs/development/compilers/llvm/git/clang/default.nix
index b193ebba3d6d..d8fe08569f3f 100644
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, llvm_meta
 , monorepoSrc, runCommand
-, cmake, ninja, libxml2, libllvm, version, python3
+, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -52,11 +52,10 @@ let
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
       ../../common/clang/add-nostdlibinc-flag.patch
-      # FIMXE: do we need this patch?
-      # (substituteAll {
-      #   src = ../../clang-11-12-LLVMgold-path.patch;
-      #  libllvmLibdir = "${libllvm.lib}/lib";
-      # })
+      (substituteAll {
+        src = ../../clang-at-least-16-LLVMgold-path.patch;
+       libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 3d05837d45da..36edfee8a091 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -8,8 +8,7 @@
 , python3
 , python3Packages
 , libffi
-# TODO: Gold plugin on LLVM16 has a severe memory corruption bug: https://github.com/llvm/llvm-project/issues/61350.
-, enableGoldPlugin ? false
+, enableGoldPlugin ? true
 , libbfd
 , libpfm
 , libxml2
@@ -66,8 +65,8 @@ let
   else python3;
 
 in
-  assert (lib.assertMsg (!enableGoldPlugin) "Gold plugin cannot be enabled on LLVM16 due to a upstream issue: https://github.com/llvm/llvm-project/issues/61350");
-  stdenv.mkDerivation (rec {
+
+stdenv.mkDerivation (rec {
   pname = "llvm";
   inherit version;
 
@@ -325,7 +324,7 @@ in
     "-DSPHINX_OUTPUT_MAN=ON"
     "-DSPHINX_OUTPUT_HTML=OFF"
     "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ optionals (false) [
+  ] ++ optionals enableGoldPlugin [
     "-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
diff --git a/pkgs/development/compilers/rust/1_74.nix b/pkgs/development/compilers/rust/1_74.nix
deleted file mode 100644
index 163c64c249b7..000000000000
--- a/pkgs/development/compilers/rust/1_74.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-# New rust versions should first go to staging.
-# Things to check after updating:
-# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
-#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
-#    This testing can be also done by other volunteers as part of the pull
-#    request review, in case platforms cannot be covered.
-# 2. The LLVM version used for building should match with rust upstream.
-#    Check the version number in the src/llvm-project git submodule in:
-#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
-
-{ stdenv, lib
-, buildPackages
-, targetPackages
-, newScope, callPackage
-, CoreFoundation, Security, SystemConfiguration
-, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
-, makeRustPlatform
-, wrapRustcWith
-, llvmPackages_16, llvm_16
-} @ args:
-
-import ./default.nix {
-  rustcVersion = "1.74.0";
-  rustcSha256 = "sha256-iCtYS8Mhxdz+d82qafJ3kGuTYlXveAj81cdJKSXPEEk=";
-
-  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForHost = pkgsBuildHost.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
-  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
-
-  # For use at runtime
-  llvmShared = llvm_16.override { enableSharedLibraries = true; };
-
-  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-  llvmPackages = llvmPackages_16;
-
-  # Note: the version MUST be one version prior to the version we're
-  # building
-  bootstrapVersion = "1.73.0";
-
-  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
-  bootstrapHashes = {
-    i686-unknown-linux-gnu = "6a088acbbda734d27e8b431499f1d746de7781673b88fead3aeae072be1d1a5a";
-    x86_64-unknown-linux-gnu = "aa4cf0b7e66a9f5b7c623d4b340bb1ac2864a5f2c2b981f39f796245dc84f2cb";
-    x86_64-unknown-linux-musl = "c888457d106ccd40288ca8db1cb966b23d719c9a128daca701ecc574c53773d4";
-    arm-unknown-linux-gnueabihf = "9c29bb42786aedbb16ea71564eb06068a8b01cca6c6b8857f0c37f91dfba7134";
-    armv7-unknown-linux-gnueabihf = "092b32b82c602c18279d76d9a96763e85030aa62cda64c1bc73fc1f6355bb99c";
-    aarch64-unknown-linux-gnu = "e54d7d886ba413ae573151f668e76ea537f9a44406d3d29598269a4a536d12f6";
-    aarch64-unknown-linux-musl = "f4e9ff895aa55558777585ad4debe2ccf3c0298cb5d65db67814f62428de4a5b";
-    x86_64-apple-darwin = "ece9646bb153d4bc0f7f1443989de0cbcd8989a7d0bf3b7fb9956e1223954f0c";
-    aarch64-apple-darwin = "9c96e4c57328fb438ee2d87aa75970ce89b4426b49780ccb3c16af0d7c617cc6";
-    powerpc64le-unknown-linux-gnu = "8fa215ee3e274fb64364e7084613bc570369488fa22cf5bc8e0fe6dc810fe2b9";
-    riscv64gc-unknown-linux-gnu = "381379a2381835428b2e7a396b3046581517356b7cc851e39e385aebd5700623";
-  };
-
-  selectRustPackage = pkgs: pkgs.rust_1_74;
-
-  rustcPatches = [ ];
-}
-
-(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildHost" "llvmPackages_16" "llvm_16"])
diff --git a/pkgs/development/compilers/rust/1_75.nix b/pkgs/development/compilers/rust/1_75.nix
new file mode 100644
index 000000000000..829b26cac367
--- /dev/null
+++ b/pkgs/development/compilers/rust/1_75.nix
@@ -0,0 +1,61 @@
+# New rust versions should first go to staging.
+# Things to check after updating:
+# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
+#    i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
+#    This testing can be also done by other volunteers as part of the pull
+#    request review, in case platforms cannot be covered.
+# 2. The LLVM version used for building should match with rust upstream.
+#    Check the version number in the src/llvm-project git submodule in:
+#    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
+# 3. Firefox and Thunderbird should still build on x86_64-linux.
+
+{ stdenv, lib
+, buildPackages
+, targetPackages
+, newScope, callPackage
+, CoreFoundation, Security, SystemConfiguration
+, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
+, makeRustPlatform
+, wrapRustcWith
+, llvmPackages_17, llvm_17
+} @ args:
+
+import ./default.nix {
+  rustcVersion = "1.75.0";
+  rustcSha256 = "sha256-W3OfRbydNB4tHFcNZdI3VZHiLC0j71uKN3EaA4arwIg=";
+
+  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForHost = pkgsBuildHost.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
+  llvmSharedForTarget = pkgsBuildTarget.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
+
+  # For use at runtime
+  llvmShared = llvm_17.override { enableSharedLibraries = true; };
+
+  # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
+  llvmPackages = llvmPackages_17;
+
+  # Note: the version MUST be one version prior to the version we're
+  # building
+  bootstrapVersion = "1.74.1";
+
+  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
+  bootstrapHashes = {
+    i686-unknown-linux-gnu = "b883b98372c91bc6aa9dc6ebb2b4e02e7dacbbc2ac1ebe55923dc37134df70a4";
+    x86_64-unknown-linux-gnu = "d206888a2a9d55113940151ba16117ce2456d7de021bab18cfcb06dc48d3157c";
+    x86_64-unknown-linux-musl = "5af3115a1f16431630f288821bd7f3be8cf7e08a7611b3c3bce3976774aa6cd2";
+    arm-unknown-linux-gnueabihf = "1dd7d835af4afe9adb7f785046c907090ace66f1c975cfe9e8886847310d8ec9";
+    armv7-unknown-linux-gnueabihf = "a5038ae004bf86eed64ef67329f7ba047bb4d188663bfd260320d53a2fed33c4";
+    aarch64-unknown-linux-gnu = "0dbdfce647f3c7d9ff00a7aa5d6dbbd7010486f803a9749cff46189f5ecb438c";
+    aarch64-unknown-linux-musl = "02674b8e4311780464313c5773d43606fbf6880d5c4512930d59b6d5d369f0de";
+    x86_64-apple-darwin = "54e1ef01d73f6031fbee36bbecd9af4209eb682dea478696e8282ca64d5792e5";
+    aarch64-apple-darwin = "af6a982cbed85807fb8e5c4ba85b8a76162b58945f4787e0a7dec32e901e8b3b";
+    powerpc64le-unknown-linux-gnu = "bb1c9f0ab1016a2817afe8f72c03f8f1787fe44d0f9999669e0c1957a08e6213";
+    riscv64gc-unknown-linux-gnu = "86561a8d630f634fdd7cb5899d40027103c907d9763a32770b7e2fd57dbd8473";
+  };
+
+  selectRustPackage = pkgs: pkgs.rust_1_75;
+
+  rustcPatches = [ ];
+}
+
+(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildHost" "llvmPackages_17" "llvm_17"])
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 7fe33a4011e5..6e0afa1b8f57 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -65,6 +65,8 @@ in stdenv.mkDerivation (finalAttrs: {
   # Increase codegen units to introduce parallelism within the compiler.
   RUSTFLAGS = "-Ccodegen-units=10";
 
+  RUSTDOCFLAGS = "-A rustdoc::broken-intra-doc-links";
+
   # We need rust to build rust. If we don't provide it, configure will try to download it.
   # Reference: https://github.com/rust-lang/rust/blob/master/src/bootstrap/configure.py
   configureFlags = let
@@ -100,6 +102,10 @@ in stdenv.mkDerivation (finalAttrs: {
     "--target=${concatStringsSep "," ([
       stdenv.targetPlatform.rust.rustcTargetSpec
 
+    # Other targets that don't need any extra dependencies to build.
+    ] ++ optionals (!fastCross) [
+      "wasm32-unknown-unknown"
+
     # (build!=target): When cross-building a compiler we need to add
     # the build platform as well so rustc can compile build.rs
     # scripts.
@@ -201,7 +207,7 @@ in stdenv.mkDerivation (finalAttrs: {
     # to do this when rustc's target platform is dynamically linked musl.
     #
     # [1]: https://github.com/rust-lang/compiler-team/issues/422
-    substituteInPlace compiler/rustc_target/src/spec/linux_musl_base.rs \
+    substituteInPlace compiler/rustc_target/src/spec/base/linux_musl.rs \
         --replace "base.crt_static_default = true" "base.crt_static_default = false"
   '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
     # See https://github.com/jemalloc/jemalloc/issues/1997
diff --git a/pkgs/development/compilers/spirv-llvm-translator/default.nix b/pkgs/development/compilers/spirv-llvm-translator/default.nix
index f19501a6d7d8..4db3b93217d7 100644
--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@@ -7,6 +7,7 @@
 , llvm
 , spirv-headers
 , spirv-tools
+, disable-warnings-if-gcc13
 }:
 
 let
@@ -28,16 +29,16 @@ let
       rev = "v${version}";
       hash = "sha256-OsDohXRxovtEXaWiRGp8gJ0dXmoALyO+ZimeSO8aPVI=";
     } else if llvmMajor == "14" then rec{
-      version = "14.0.0";
-      rev = "v${version}";
-      hash = "sha256-BhNAApgZ/w/92XjpoDY6ZEIhSTwgJ4D3/EfNvPmNM2o=";
+      version = "14.0.0+unstable-2023-06-22";
+      rev = "23f398bf369093b1fd67459db8071ffcc6b92658";
+      hash = "sha256-o7cVj5/ZMER2CvfxL4pRb2qCIxC/HFUPiitf2fKtCyk=";
     } else if llvmMajor == "11" then {
-      version = "unstable-2022-05-04";
+      version = "11.0.0+unstable-2022-05-04";
       rev = "4ef524240833abfeee1c5b9fff6b1bd53f4806b3"; # 267 commits ahead of v11.0.0
       hash = "sha256-NoIoa20+2sH41rEnr8lsMhtfesrtdPINiXtUnxYVm8s=";
     } else throw "Incompatible LLVM version.";
 in
-stdenv.mkDerivation {
+disable-warnings-if-gcc13 (stdenv.mkDerivation {
   pname = "SPIRV-LLVM-Translator";
   inherit (branch) version;
 
@@ -47,12 +48,19 @@ stdenv.mkDerivation {
     inherit (branch) rev hash;
   };
 
-  patches = lib.optionals (llvmMajor == "16")[
+  patches = lib.optionals (llvmMajor == "16") [
     # Fixes builds that link against external LLVM dynamic library
     (fetchpatch {
       url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/f3b9b604d7eda18d0d1029d94a6eebd33aa3a3fe.patch";
       hash = "sha256-opDjyZcy7O4wcSfm/A51NCIiDyIvbcmbv9ns1njdJbc=";
     })
+  ] ++ lib.optionals (llvmMajor == "14") [
+    (fetchpatch {
+      # tries to install llvm-spirv into llvm nix store path
+      url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/cce9a2f130070d799000cac42fe24789d2b777ab.patch";
+      revert = true;
+      hash = "sha256-GbFacttZRDCgA0jkUoFA4/B3EDn3etweKvM09OwICJ8=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config cmake ]
@@ -70,7 +78,7 @@ stdenv.mkDerivation {
     "-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
     # RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
-  ] ++ lib.optionals (llvmMajor != "11") [ "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}" ];
+  ] ++ lib.optional (llvmMajor != "11") "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}";
 
   # FIXME: CMake tries to run "/llvm-lit" which of course doesn't exist
   doCheck = false;
@@ -91,4 +99,4 @@ stdenv.mkDerivation {
     platforms   = platforms.unix;
     maintainers = with maintainers; [ gloaming ];
   };
-}
+})
diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
index 30fb18db8fd2..76c2da0a656a 100644
--- a/pkgs/development/compilers/swift/compiler/default.nix
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -311,6 +311,13 @@ in stdenv.mkDerivation {
       sha256 = "1rma1al0rbm3s3ql6bnvbcighp74lri1lcrwbyacgdqp80fgw1b6";
     }}
 
+   # gcc-13 build fixes
+    patch -p2 -d llvm-project/llvm -i ${fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/llvm/llvm-project/commit/ff1681ddb303223973653f7f5f3f3435b48a1983.patch";
+      hash = "sha256-nkRPWx8gNvYr7mlvEUiOAb1rTrf+skCZjAydJVUHrcI=";
+    }}
+
     ${lib.optionalString stdenv.isLinux ''
     substituteInPlace llvm-project/clang/lib/Driver/ToolChains/Linux.cpp \
       --replace 'SysRoot + "/lib' '"${glibc}/lib" "' \
diff --git a/pkgs/development/compilers/vala/setup-hook.sh b/pkgs/development/compilers/vala/setup-hook.sh
index 33acdf1daee0..53976e5cd0db 100644
--- a/pkgs/development/compilers/vala/setup-hook.sh
+++ b/pkgs/development/compilers/vala/setup-hook.sh
@@ -5,7 +5,7 @@ make_vala_find_vapi_files() {
     fi
 }
 
-addEnvHooks "$hostOffset" make_vala_find_vapi_files
+addEnvHooks "$targetOffset" make_vala_find_vapi_files
 
 disable_incompabile_pointer_conversion_warning() {
     # Work around incompatible function pointer conversion errors with clang 16
diff --git a/pkgs/development/embedded/fpga/tinyprog/default.nix b/pkgs/development/embedded/fpga/tinyprog/default.nix
index 4872111b811c..b242d6ebc1b4 100644
--- a/pkgs/development/embedded/fpga/tinyprog/default.nix
+++ b/pkgs/development/embedded/fpga/tinyprog/default.nix
@@ -30,10 +30,6 @@ with python3Packages; buildPythonApplication rec {
 
   nativeBuildInputs = [ setuptools-scm ];
 
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
-  '';
-
   meta = with lib; {
     homepage = "https://github.com/tinyfpga/TinyFPGA-Bootloader/tree/master/programmer";
     description = "Programmer for FPGA boards using the TinyFPGA USB Bootloader";
diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index c26275299142..4091fdd49e0e 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation (finalAttrs:
   {
   pname = "lua";
   inherit version;
+  outputs = [ "out" "doc" ];
 
   src = fetchurl {
     url = "https://www.lua.org/ftp/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
@@ -135,6 +136,9 @@ stdenv.mkDerivation (finalAttrs:
     ln -s "$out/lib/pkgconfig/lua.pc" "$out/lib/pkgconfig/lua-${luaversion}.pc"
     ln -s "$out/lib/pkgconfig/lua.pc" "$out/lib/pkgconfig/lua${luaversion}.pc"
     ln -s "$out/lib/pkgconfig/lua.pc" "$out/lib/pkgconfig/lua${lib.replaceStrings [ "." ] [ "" ] luaversion}.pc"
+
+    # Make documentation outputs of different versions co-installable.
+    mv $out/share/doc/lua $out/share/doc/lua-${version}
   '';
 
   # copied from python
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 6a201b066f8f..2674971670fe 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -30,10 +30,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "6";
+        patch = "7";
         suffix = "";
       };
-      hash = "sha256-D6t4+n8TP084IQxiYNkNfA1ccZhEZBnOBX7HrC5vXzg=";
+      hash = "sha256-GOGqfmb/OlhCPVntIoFaaVTlM0ISLEXfIMlod8Biubc=";
     };
   };
 
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index d06f3db334da..0557c62eeff4 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -173,6 +173,16 @@ in {
       };
     } ./python-remove-tests-dir-hook.sh) {};
 
+  pythonRuntimeDepsCheckHook = callPackage ({ makePythonHook, packaging }:
+    makePythonHook {
+      name = "python-runtime-deps-check-hook.sh";
+      propagatedBuildInputs = [ packaging ];
+      substitutions = {
+        inherit pythonInterpreter pythonSitePackages;
+        hook = ./python-runtime-deps-check-hook.py;
+      };
+    } ./python-runtime-deps-check-hook.sh) {};
+
   setuptoolsBuildHook = callPackage ({ makePythonHook, setuptools, wheel }:
     makePythonHook {
       name = "setuptools-setup-hook";
diff --git a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
index 1ac91fb40e4e..293bd5cebd50 100644
--- a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
@@ -52,7 +52,7 @@ _pythonRelaxDeps() {
     else
         for dep in $pythonRelaxDeps; do
             sed -i "$metadata_file" -r \
-                -e "s/(Requires-Dist: $dep\s*(\[[^]]+\])?)[^;]*(;.*)?/\1\3/"
+                -e "s/(Requires-Dist: $dep\s*(\[[^]]+\])?)[^;]*(;.*)?/\1\3/i"
         done
     fi
 }
diff --git a/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.py b/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.py
new file mode 100644
index 000000000000..5a3a91939175
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.py
@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+"""
+The runtimeDependenciesHook validates, that all dependencies specified
+in wheel metadata are available in the local environment.
+
+In case that does not hold, it will print missing dependencies and
+violated version constraints.
+"""
+
+
+import importlib.metadata
+import re
+import sys
+import tempfile
+from argparse import ArgumentParser
+from zipfile import ZipFile
+
+from packaging.metadata import Metadata, parse_email
+from packaging.requirements import Requirement
+
+argparser = ArgumentParser()
+argparser.add_argument("wheel", help="Path to the .whl file to test")
+
+
+def error(msg: str) -> None:
+    print(f"  - {msg}", file=sys.stderr)
+
+
+def normalize_name(name: str) -> str:
+    """
+    Normalize package names according to PEP503
+    """
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def get_manifest_text_from_wheel(wheel: str) -> str:
+    """
+    Given a path to a wheel, this function will try to extract the
+    METADATA file in the wheels .dist-info directory.
+    """
+    with ZipFile(wheel) as zipfile:
+        for zipinfo in zipfile.infolist():
+            if zipinfo.filename.endswith(".dist-info/METADATA"):
+                with tempfile.TemporaryDirectory() as tmp:
+                    path = zipfile.extract(zipinfo, path=tmp)
+                    with open(path, encoding="utf-8") as fd:
+                        return fd.read()
+
+    raise RuntimeError("No METADATA file found in wheel")
+
+
+def get_metadata(wheel: str) -> Metadata:
+    """
+    Given a path to a wheel, returns a parsed Metadata object.
+    """
+    text = get_manifest_text_from_wheel(wheel)
+    raw, _ = parse_email(text)
+    metadata = Metadata.from_raw(raw)
+
+    return metadata
+
+
+def test_requirement(requirement: Requirement) -> bool:
+    """
+    Given a requirement specification, tests whether the dependency can
+    be resolved in the local environment, and whether it satisfies the
+    specified version constraints.
+    """
+    if requirement.marker and not requirement.marker.evaluate():
+        # ignore requirements with incompatible markers
+        return True
+
+    package_name = normalize_name(requirement.name)
+
+    try:
+        package = importlib.metadata.distribution(requirement.name)
+    except importlib.metadata.PackageNotFoundError:
+        error(f"{package_name} not installed")
+        return False
+
+    if package.version not in requirement.specifier:
+        error(
+            f"{package_name}{requirement.specifier} not satisfied by version {package.version}"
+        )
+        return False
+
+    return True
+
+
+if __name__ == "__main__":
+    args = argparser.parse_args()
+
+    metadata = get_metadata(args.wheel)
+    tests = [test_requirement(requirement) for requirement in metadata.requires_dist]
+
+    if not all(tests):
+        sys.exit(1)
diff --git a/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.sh b/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.sh
new file mode 100644
index 000000000000..43a2f9b88745
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/python-runtime-deps-check-hook.sh
@@ -0,0 +1,20 @@
+# Setup hook for PyPA installer.
+echo "Sourcing python-runtime-deps-check-hook"
+
+pythonRuntimeDepsCheckHook() {
+    echo "Executing pythonRuntimeDepsCheck"
+
+    export PYTHONPATH="$out/@pythonSitePackages@:$PYTHONPATH"
+
+    for wheel in dist/*.whl; do
+        echo "Checking runtime dependencies for $(basename $wheel)"
+        @pythonInterpreter@ @hook@ "$wheel"
+    done
+
+    echo "Finished executing pythonRuntimeDepsCheck"
+}
+
+if [ -z "${dontCheckRuntimeDeps-}" ]; then
+    echo "Using pythonRuntimeDepsCheckHook"
+    preInstallPhases+=" pythonRuntimeDepsCheckHook"
+fi
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index c14c6bc096fd..e6f9087de866 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -19,6 +19,7 @@
 , pythonOutputDistHook
 , pythonRemoveBinBytecodeHook
 , pythonRemoveTestsDirHook
+, pythonRuntimeDepsCheckHook
 , setuptoolsBuildHook
 , setuptoolsCheckHook
 , wheelUnpackHook
@@ -229,6 +230,13 @@ let
         }
       else
         pypaBuildHook
+    ) (
+      if isBootstrapPackage then
+        pythonRuntimeDepsCheckHook.override {
+          inherit (python.pythonOnBuildForHost.pkgs.bootstrap) packaging;
+        }
+      else
+        pythonRuntimeDepsCheckHook
     )] ++ lib.optionals (format' == "wheel") [
       wheelUnpackHook
     ] ++ lib.optionals (format' == "egg") [
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index 84af77bade9e..c64c65df350e 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -1,9 +1,12 @@
 { lib, stdenv, substituteAll, fetchurl
-, zlib ? null, zlibSupport ? true, bzip2, pkg-config, libffi, libunwind, Security
+, zlibSupport ? true, zlib
+, bzip2, pkg-config, libffi, libunwind, Security
 , sqlite, openssl, ncurses, python, expat, tcl, tk, tix, libX11
-, self, gdbm, db, xz
-, python-setup-hook
+, gdbm, db, xz, python-setup-hook
+, optimizationLevel ? "jit", boehmgc
 # For the Python package set
+, hash
+, self
 , packageOverrides ? (self: super: {})
 , pkgsBuildBuild
 , pkgsBuildHost
@@ -12,7 +15,6 @@
 , pkgsTargetTarget
 , sourceVersion
 , pythonVersion
-, hash
 , passthruFun
 , pythonAttr ? "pypy${lib.substring 0 1 pythonVersion}${lib.substring 2 3 pythonVersion}"
 }:
@@ -59,6 +61,8 @@ in with passthru; stdenv.mkDerivation rec {
     stdenv.cc.libc
   ] ++ lib.optionals zlibSupport [
     zlib
+  ] ++ lib.optionals (lib.any (l: l == optimizationLevel) [ "0" "1" "2" "3"]) [
+    boehmgc
   ] ++ lib.optionals stdenv.isDarwin [
     libunwind Security
   ];
@@ -102,7 +106,7 @@ in with passthru; stdenv.mkDerivation rec {
 
     ${pythonForPypy.interpreter} rpython/bin/rpython \
       --make-jobs="$NIX_BUILD_CORES" \
-      -Ojit \
+      -O${optimizationLevel} \
       --batch pypy/goal/targetpypystandalone.py
 
     runHook postBuild
@@ -195,10 +199,11 @@ in with passthru; stdenv.mkDerivation rec {
   enableParallelBuilding = true;  # almost no parallelization without STM
 
   meta = with lib; {
-    homepage = "http://pypy.org/";
+    homepage = "https://www.pypy.org/";
     description = "Fast, compliant alternative implementation of the Python language (${pythonVersion})";
     license = licenses.mit;
     platforms = [ "aarch64-linux" "x86_64-linux" "aarch64-darwin" "x86_64-darwin" ];
+    broken = optimizationLevel == "0"; # generates invalid code
     maintainers = with maintainers; [ andersk ];
   };
 }
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 3c9aba07df20..9fe47eda13b1 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -131,7 +131,6 @@ let
         postUnpack = opString rubygemsSupport ''
           rm -rf $sourceRoot/{lib,test}/rubygems*
           cp -r ${rubygems}/lib/rubygems* $sourceRoot/lib
-          cp -r ${rubygems}/test/rubygems $sourceRoot/test
         '';
 
         postPatch = ''
diff --git a/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch b/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
index 6b7b20934877..fef2c558e246 100644
--- a/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
+++ b/pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
@@ -14,15 +14,15 @@ diff --git a/lib/rubygems/dependency_installer.rb b/lib/rubygems/dependency_inst
 index 34620860..00ab31d9 100644
 --- a/lib/rubygems/dependency_installer.rb
 +++ b/lib/rubygems/dependency_installer.rb
-@@ -18,7 +18,7 @@ class Gem::DependencyInstaller
+@@ -17,7 +17,7 @@ class Gem::DependencyInstaller
    extend Gem::Deprecate
  
    DEFAULT_OPTIONS = { # :nodoc:
--    :env_shebang => false,
-+    :env_shebang => true,
-     :document => %w[ri],
-     :domain => :both, # HACK dup
-     :force => false,
+-    env_shebang: false,
++    env_shebang: true,
+     document: %w[ri],
+     domain: :both, # HACK: dup
+     force: false,
 -- 
 2.21.0
 
diff --git a/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch b/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch
index 138d432c8203..e155ff27b916 100644
--- a/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch
+++ b/pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch
@@ -12,15 +12,15 @@ diff --git a/lib/rubygems/path_support.rb b/lib/rubygems/path_support.rb
 index ed680d65..749b9ea6 100644
 --- a/lib/rubygems/path_support.rb
 +++ b/lib/rubygems/path_support.rb
-@@ -23,7 +23,7 @@ class Gem::PathSupport
+@@ -24,7 +24,7 @@ class Gem::PathSupport
    # hashtable, or defaults to ENV, the system environment.
    #
    def initialize(env)
--    @home = env["GEM_HOME"] || Gem.default_dir
-+    @home = env["GEM_HOME"] || Gem.user_dir
+-    @home = normalize_home_dir(env["GEM_HOME"] || Gem.default_dir)
++    @home = normalize_home_dir(env["GEM_HOME"] || Gem.user_dir || Gem.default_dir)
+     @path = split_gem_path env["GEM_PATH"], @home
  
-     if File::ALT_SEPARATOR
-       @home = @home.gsub(File::ALT_SEPARATOR, File::SEPARATOR)
+     @spec_cache_dir = env["GEM_SPEC_CACHE"] || Gem.default_spec_cache_dir
 -- 
 2.21.0
 
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 8e9e35dae59a..95a6fb077eb1 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.22";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-gD+nd3bRHT0btWOCZhbIERJEJeAzGtH9mDxBRARqYVY=";
+    hash = "sha256-8xFe6AgJkvJXwBYbgR4HsBLyAXXtiTSfsayYl33cXJw=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aspell/default.nix b/pkgs/development/libraries/aspell/default.nix
index b839092228b3..8c152d32ef6c 100644
--- a/pkgs/development/libraries/aspell/default.nix
+++ b/pkgs/development/libraries/aspell/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, fetchzip, perl, ncurses
+{ lib, stdenv, fetchurl, fetchzip, perl, ncurses
 
   # for tests
 , aspell, glibc, runCommand
@@ -20,21 +20,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aspell";
-  version = "0.60.8";
+  version = "0.60.8.1";
 
   src = fetchurl {
     url = "mirror://gnu/aspell/aspell-${version}.tar.gz";
-    sha256 = "1wi60ankalmh8ds7nplz434jd7j94gdvbahdwsr539rlad8pxdzr";
+    hash = "sha256-1toSs01C1Ff6YE5DWtSEp0su/80SD/QKzWuz+yiH0hs=";
   };
 
-  patches = [
-    (fetchpatch {
-      #  objstack: assert that the alloc size will fit within a chunk
-      name = "CVE-2019-25051.patch";
-      url = "https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a.patch";
-      sha256 = "03z259xrk41x3j190gaprf3mqysyfgh3a04rjmch3h625vj95x39";
-    })
-  ] ++ lib.optional searchNixProfiles ./data-dirs-from-nix-profiles.patch;
+  patches = lib.optional searchNixProfiles ./data-dirs-from-nix-profiles.patch;
 
   postPatch = ''
     patch interfaces/cc/aspell.h < ${./clang.patch}
diff --git a/pkgs/development/libraries/audio/lilv/default.nix b/pkgs/development/libraries/audio/lilv/default.nix
index 9827e6f52a77..3c691c245ce5 100644
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@@ -31,7 +31,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ libsndfile serd sord sratom ];
   propagatedBuildInputs = [ lv2 ];
 
-  mesonFlags = [ "-Ddocs=disabled" ];
+  mesonFlags = [
+    "-Ddocs=disabled"
+    # Tests require building a shared library.
+    (lib.mesonEnable "tests" (!stdenv.hostPlatform.isStatic))
+  ];
 
   passthru = {
     tests = {
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index 7a57315a5f4d..284671b43f17 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.7.0";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    sha256 = "sha256-DzUobQ8qZNb83CwVKK9E1V51uHHo22nlBGKdN55W7UY=";
+    sha256 = "sha256-GO3Sfbi1dwsqQM6rlnEHyE7wolQjdVwD5BAu5ychEuY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-cal/default.nix b/pkgs/development/libraries/aws-c-cal/default.nix
index a76ee7ab003c..6340545e3667 100644
--- a/pkgs/development/libraries/aws-c-cal/default.nix
+++ b/pkgs/development/libraries/aws-c-cal/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-cal";
-  version = "0.6.0";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qsYQViMto5j6piCg6gBjzFfPJlLkJt4949o217QsV6Q=";
+    sha256 = "sha256-m/RwGXeSjYOJQwCxfPyL4TdJ3gV66zHgVkWd3bpSaJE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-common/default.nix b/pkgs/development/libraries/aws-c-common/default.nix
index 1df8bef5be12..5c3abbc58087 100644
--- a/pkgs/development/libraries/aws-c-common/default.nix
+++ b/pkgs/development/libraries/aws-c-common/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-common";
-  version = "0.8.23";
+  version = "0.9.10";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HkRaQnlasayg5Nu2KaEA18360rxAH/tdJ1iqzoi6i2E=";
+    sha256 = "sha256-xqNqyVtibR8oSMvl5RTU166FIxcbvGjZJOjJ9j6fU78=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-event-stream/default.nix b/pkgs/development/libraries/aws-c-event-stream/default.nix
index 6b3c8af43f50..7f273ac80fa0 100644
--- a/pkgs/development/libraries/aws-c-event-stream/default.nix
+++ b/pkgs/development/libraries/aws-c-event-stream/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-event-stream";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2MPTr1vSUPuemdlQIalZTp6eGXJl3Xr1eUEnZjikBzg=";
+    sha256 = "sha256-uKprdBJn9yHDm2HCBOiuanizCtLi/VKrvUUScNv6OPY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-http/default.nix b/pkgs/development/libraries/aws-c-http/default.nix
index 045f5f97a806..52d3507b5570 100644
--- a/pkgs/development/libraries/aws-c-http/default.nix
+++ b/pkgs/development/libraries/aws-c-http/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-http";
-  version = "0.7.11";
+  version = "0.7.14";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${version}";
-    sha256 = "sha256-gKuWhXxWHqTS66yANdKLsCZRk7jeDmyYMlme4WXT5Wc=";
+    sha256 = "sha256-HrNdePWNw/5tDBeybnUjK3LgftnGQ4CBXPG0URaxIeU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-io/default.nix b/pkgs/development/libraries/aws-c-io/default.nix
index e1eb1939c212..abb51d0df417 100644
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-io";
-  version = "0.13.29";
+  version = "0.13.36";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZeogbjgpbqdCioLeb34CRol1Fa5BJOloAxxgE50yfQs=";
+    sha256 = "sha256-TwPcsTMBOE1uIInH6/eQdUMV6uD7d60773THzc1/G9Y=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/aws-c-mqtt/default.nix b/pkgs/development/libraries/aws-c-mqtt/default.nix
index 082887ee3a3d..eb20be82f353 100644
--- a/pkgs/development/libraries/aws-c-mqtt/default.nix
+++ b/pkgs/development/libraries/aws-c-mqtt/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-mqtt";
-  version = "0.8.14";
+  version = "0.9.10";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-mqtt";
     rev = "v${version}";
-    sha256 = "sha256-LPhd4ygh/3BtqDZwWtigXWUGZ0fzkcWkFl6dpJIspow=";
+    sha256 = "sha256-hxisqBUARJLtmZniXaZ2th0hqWiKn4XQIy6I0Oz/kUs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-c-s3/default.nix b/pkgs/development/libraries/aws-c-s3/default.nix
index ca07b930109e..b3051916fbb8 100644
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
-  version = "0.3.13";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    sha256 = "sha256-SXMDyzQ8hjPx9q9GhE11lYjj3IZY35mvUWELlYQmgGU=";
+    sha256 = "sha256-tb9h78Gd4N11DPB2ETq241lvDQqHIy2HYBsJrBlLpxA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch b/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch
index 9b61316ffb91..2b06ce0aec63 100644
--- a/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch
+++ b/pkgs/development/libraries/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch
@@ -1,6 +1,6 @@
-From 2370ee92e78cfb0d55e3958b63ac71b16567b5fd Mon Sep 17 00:00:00 2001
+From fd3f3a28e7fce7fe4e10ed2d7edc4bfda8ab27df Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
-Date: Wed, 9 Nov 2022 17:59:17 +0100
+Date: Sun, 9 Jan 2022 01:57:18 +0100
 Subject: [PATCH] build: Make includedir properly overrideable
 
 This is required by some package managers like Nix.
@@ -9,33 +9,33 @@ This is required by some package managers like Nix.
  1 file changed, 13 insertions(+), 9 deletions(-)
 
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 9f13d21..f6e62c7 100644
+index ec6d172..6514c23 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -66,6 +66,10 @@ elseif(NOT DEFINED CMAKE_INSTALL_LIBDIR)
-     set(CMAKE_INSTALL_LIBDIR "lib")
+@@ -49,6 +49,10 @@ if(${CMAKE_INSTALL_LIBDIR} STREQUAL "lib64")
+     set(FIND_LIBRARY_USE_LIB64_PATHS true)
  endif()
-
+ 
 +if(NOT DEFINED CMAKE_INSTALL_INCLUDEDIR)
 +    set(CMAKE_INSTALL_INCLUDEDIR "include")
 +endif()
 +
- if(${CMAKE_INSTALL_LIBDIR} STREQUAL "lib64")
-     set(FIND_LIBRARY_USE_LIB64_PATHS true)
+ if(NOT CMAKE_CXX_STANDARD)
+     set(CMAKE_CXX_STANDARD 11)
  endif()
-@@ -322,7 +326,7 @@ endif()
-
+@@ -307,7 +311,7 @@ endif()
  target_include_directories(${PROJECT_NAME} PUBLIC
      $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
+     $<BUILD_INTERFACE:${GENERATED_INCLUDE_DIR}>
 -    $<INSTALL_INTERFACE:include>)
 +    $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
-
+ 
  aws_use_package(aws-c-http)
  aws_use_package(aws-c-mqtt)
-@@ -336,14 +340,14 @@ aws_use_package(aws-c-s3)
-
- target_link_libraries(${PROJECT_NAME} ${DEP_AWS_LIBS})
-
+@@ -324,14 +328,14 @@ aws_add_sanitizers(${PROJECT_NAME})
+ 
+ target_link_libraries(${PROJECT_NAME} PUBLIC ${DEP_AWS_LIBS})
+ 
 -install(FILES ${AWS_CRT_HEADERS} DESTINATION "include/aws/crt" COMPONENT Development)
 -install(FILES ${AWS_CRT_AUTH_HEADERS} DESTINATION "include/aws/crt/auth" COMPONENT Development)
 -install(FILES ${AWS_CRT_CRYPTO_HEADERS} DESTINATION "include/aws/crt/crypto" COMPONENT Development)
@@ -52,8 +52,8 @@ index 9f13d21..f6e62c7 100644
 +install(FILES ${AWS_CRT_MQTT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/mqtt" COMPONENT Development)
 +install(FILES ${AWS_CRT_HTTP_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/http" COMPONENT Development)
 +install(FILES ${AWS_CRT_ENDPOINT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/endpoints" COMPONENT Development)
-
+ 
  install(
      TARGETS ${PROJECT_NAME}
---
-2.37.3
+-- 
+2.42.0
diff --git a/pkgs/development/libraries/aws-crt-cpp/default.nix b/pkgs/development/libraries/aws-crt-cpp/default.nix
index 0f44dab59db4..0cd6e4940c4d 100644
--- a/pkgs/development/libraries/aws-crt-cpp/default.nix
+++ b/pkgs/development/libraries/aws-crt-cpp/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-crt-cpp";
-  version = "0.20.3";
+  version = "0.24.7";
 
   outputs = [ "out" "dev" ];
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     owner = "awslabs";
     repo = "aws-crt-cpp";
     rev = "v${version}";
-    sha256 = "sha256-70AchkuhuyumwpBYaj9mOVPJ8+6VSLTLtr3ghwqG3wM=";
+    sha256 = "sha256-AYO0ckqEx2jG7HduvaxASQMOsxuHGkRkyVsUP5WOs98=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch b/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch
deleted file mode 100644
index b2f12e77025c..000000000000
--- a/pkgs/development/libraries/aws-sdk-cpp/cmake-dirs.patch
+++ /dev/null
@@ -1,65 +0,0 @@
---- a/cmake/AWSSDKConfig.cmake
-+++ b/cmake/AWSSDKConfig.cmake
-@@ -97,14 +98,18 @@ if (NOT AWSSDK_CORE_HEADER_FILE)
-     message(FATAL_ERROR "AWS SDK for C++ is missing, please install it first")
- endif()
- 
--# based on core header file path, inspects the actual AWSSDK_ROOT_DIR
--get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_CORE_HEADER_FILE}" PATH)
--get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
--get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
--get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
--
--if (NOT AWSSDK_ROOT_DIR)
--    message(FATAL_ERROR "AWSSDK_ROOT_DIR is not set or can't be calculated from the path of core header file")
-+if (IS_ABSOLUTE ${AWSSDK_INSTALL_LIBDIR})
-+    set(AWSSDK_ROOT_DIR "")
-+else()
-+    # based on core header file path, inspects the actual AWSSDK_ROOT_DIR
-+    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_CORE_HEADER_FILE}" PATH)
-+    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
-+    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
-+    get_filename_component(AWSSDK_ROOT_DIR "${AWSSDK_ROOT_DIR}" PATH)
-+
-+    if (NOT AWSSDK_ROOT_DIR)
-+	message(FATAL_ERROR "AWSSDK_ROOT_DIR is not set or can't be calculated from the path of core header file")
-+    endif()
- endif()
- 
- 
-diff --git a/cmake/utilities.cmake b/cmake/utilities.cmake
-index 283a14a138..646aea1da3 100644
---- a/cmake/utilities.cmake
-+++ b/cmake/utilities.cmake
-@@ -43,7 +43,8 @@ macro(setup_install)
-                 EXPORT "${PROJECT_NAME}-targets"
-                 ARCHIVE DESTINATION ${ARCHIVE_DIRECTORY}
-                 LIBRARY DESTINATION ${LIBRARY_DIRECTORY}
--                RUNTIME DESTINATION ${BINARY_DIRECTORY} )
-+                RUNTIME DESTINATION ${BINARY_DIRECTORY}
-+                INCLUDES DESTINATION ${INCLUDE_DIRECTORY} )
- 
-         if (BUILD_SHARED_LIBS)
-             install(
-@@ -57,7 +58,8 @@ macro(setup_install)
-             install (TARGETS ${PROJECT_NAME}
-                      ARCHIVE DESTINATION ${ARCHIVE_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
-                      LIBRARY DESTINATION ${LIBRARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
--                     RUNTIME DESTINATION ${BINARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME})
-+                     RUNTIME DESTINATION ${BINARY_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME}
-+                     INCLUDES DESTINATION ${INCLUDE_DIRECTORY}/${SDK_INSTALL_BINARY_PREFIX}/${PLATFORM_INSTALL_QUALIFIER}/\${CMAKE_INSTALL_CONFIG_NAME})
-         endif()
-     endif()
- endmacro()
-diff --git a/toolchains/pkg-config.pc.in b/toolchains/pkg-config.pc.in
-index 9b519d2772..a61069225c 100644
---- a/toolchains/pkg-config.pc.in
-+++ b/toolchains/pkg-config.pc.in
-@@ -1,5 +1,5 @@
--includedir=@CMAKE_INSTALL_PREFIX@/@INCLUDE_DIRECTORY@
--libdir=@CMAKE_INSTALL_PREFIX@/@LIBRARY_DIRECTORY@
-+includedir=@INCLUDE_DIRECTORY@
-+libdir=@LIBRARY_DIRECTORY@
- 
- Name: @PROJECT_NAME@
- Description: @PROJECT_DESCRIPTION@
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 8fdb63f165e8..448139358e65 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -8,6 +8,9 @@
 , aws-crt-cpp
 , CoreAudio
 , AudioToolbox
+, nix
+, arrow-cpp
+, aws-sdk-cpp
 , # Allow building a limited set of APIs, e.g. ["s3" "ec2"].
   apis ? ["*"]
 , # Whether to enable AWS' custom memory management.
@@ -24,19 +27,15 @@ in
 
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
-  version = "1.11.118";
+  version = "1.11.207";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    sha256 = "sha256-jqGXh8xLD2gIjV9kSvlldrxA5TxTTXQoC/B66FVprvk=";
+    sha256 = "sha256-IsPDQJo+TZ2noLefroiWl/Jx8fXmrmY73WHNRO41sik=";
   };
 
-  patches = [
-    ./cmake-dirs.patch
-  ];
-
   postPatch = ''
     # Append the dev output to path hints in finding Aws.h to avoid
     # having to pass `AWS_CORE_HEADER_FILE` explicitly to cmake configure
@@ -79,8 +78,6 @@ stdenv.mkDerivation rec {
 
   # propagation is needed for Security.framework to be available when linking
   propagatedBuildInputs = [ aws-crt-cpp ];
-  # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
-  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
 
   cmakeFlags = [
     "-DBUILD_DEPS=OFF"
@@ -109,6 +106,42 @@ stdenv.mkDerivation rec {
   # Builds in 2+h with 2 cores, and ~10m with a big-parallel builder.
   requiredSystemFeatures = [ "big-parallel" ];
 
+  passthru = {
+    tests = {
+      inherit nix arrow-cpp;
+      cmake-find-package = stdenv.mkDerivation {
+        pname = "aws-sdk-cpp-cmake-find-package-test";
+        version = "0";
+        dontUnpack = true;
+        nativeBuildInputs = [ cmake ];
+        buildInputs = [ aws-sdk-cpp ];
+        buildCommand = ''
+          cat > CMakeLists.txt <<'EOF'
+          find_package(AWSSDK)
+          EOF
+
+          # Intentionally not using 'cmakeConfigurePhase' to test that find_package works without it.
+          mkdir build && cd build
+          if output=$(cmake -Wno-dev .. 2>&1); then
+            if grep -Fw -- "Found AWS" - <<< "$output"; then
+              touch "$out"
+            else
+              echo "'Found AWS' not found in the cmake output!" >&2
+              echo "The output was:" >&2
+              echo "$output" >&2
+              exit 1
+            fi
+          else
+            echo -n "'cmake -Wno-dev ..'" >&2
+            echo " returned a non-zero exit code." >&2
+            echo "$output" >&2
+            exit 1
+          fi
+        '';
+      };
+    };
+  };
+
   meta = with lib; {
     description = "A C++ interface for Amazon Web Services";
     homepage = "https://github.com/aws/aws-sdk-cpp";
diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index 883b30c6a576..7eb13f7136c7 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     ./cyrus-sasl-ac-try-run-fix.patch
     # make compatible with openssl3. can probably be dropped with any release after 2.1.28
     (fetchpatch {
-      url = "https://github.com/cyrusimap/cyrus-sasl/compare/cb549ef71c5bb646fe583697ebdcaba93267a237...c2bd3afbca57f176d8c650670ce371444bb7fcc0.patch";
-      hash = "sha256-bYeIkvle1Ms7Lnoob4eLd4RbPFHtPkKRZvfHNCBJY/s=";
+      url = "https://github.com/cyrusimap/cyrus-sasl/compare/cb549ef71c5bb646fe583697ebdcaba93267a237...dfaa62392e7caecc6ecf0097b4d73738ec4fc0a8.patch";
+      hash = "sha256-pc0cZqj1QoxDqgd/j/5q3vWONEPrTm4Pr6MzHlfjRCc=";
     })
   ];
 
diff --git a/pkgs/development/libraries/directx-headers/default.nix b/pkgs/development/libraries/directx-headers/default.nix
index 946385ab0917..b15a6baa7cab 100644
--- a/pkgs/development/libraries/directx-headers/default.nix
+++ b/pkgs/development/libraries/directx-headers/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja }:
 stdenv.mkDerivation rec {
   pname = "directx-headers";
-  version = "1.610.2";
+  version = "1.611.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "DirectX-Headers";
     rev = "v${version}";
-    hash = "sha256-se+/TgqKdatTnBlHcBC1K4aOGGfPEW+E1efpP34+xc0=";
+    hash = "sha256-HG2Zj8hvsgv8oeSDp1eK+1A5bvFL6oQIh5mMFWOFsvk=";
   };
 
   nativeBuildInputs = [ meson ninja ];
diff --git a/pkgs/development/libraries/draco/default.nix b/pkgs/development/libraries/draco/default.nix
index 1cc8a843dcd5..ee2c5b8e5b72 100644
--- a/pkgs/development/libraries/draco/default.nix
+++ b/pkgs/development/libraries/draco/default.nix
@@ -49,6 +49,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DDRACO_TINYGLTF_PATH=${tinygltf}"
   ];
 
+  CXXFLAGS = [
+    # error: expected ')' before 'value' in 'explicit GltfValue(uint8_t value)'
+    "-include cstdint"
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index d4ab53f37bcd..43f9093848b8 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , aspell
 , groff
 , pkg-config
@@ -14,23 +13,15 @@
 
 stdenv.mkDerivation rec {
   pname = "enchant";
-  version = "2.6.2";
+  version = "2.6.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://github.com/AbiWord/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-ZoanKOVudg+N7gmiLw+1O0bunb59ZM+eW7NaZYv/fh0=";
+    hash = "sha256-wcVxnypZfOPgbJOM+5n7aX2gk96nuFfMAE3B3PG7oYI=";
   };
 
-  patches = [
-    # fix build with clang 16
-    (fetchpatch {
-      url = "https://github.com/AbiWord/enchant/commit/f71eb22e4af7f9917011807a41cf295d3ce0ccbc.patch";
-      hash = "sha256-9WWvpU3HKzPlxNBYQAKPppW6G3kOIC2A+MqX5eheBDA=";
-    })
-  ];
-
   nativeBuildInputs = [
     groff
     pkg-config
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 8dc42dea247d..e57c0fcff5bc 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
   version = "4.4.4";
-  sha256 = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
+  hash = "sha256-Q8bkuF/1uJfqttJJoObnnLX3BEduv+qxsvOrVhMvRjA=";
   extraPatches = [
     {
       name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
diff --git a/pkgs/development/libraries/ffmpeg/5.nix b/pkgs/development/libraries/ffmpeg/5.nix
index a3ff054f1e60..68edb0fd37e4 100644
--- a/pkgs/development/libraries/ffmpeg/5.nix
+++ b/pkgs/development/libraries/ffmpeg/5.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
   version = "5.1.3";
-  sha256 = "sha256-twfJvANLQGO7TiyHPMPqApfHLFUlOGZTTIIGEnjyvuE=";
+  hash = "sha256-twfJvANLQGO7TiyHPMPqApfHLFUlOGZTTIIGEnjyvuE=";
   extraPatches = [
     {
       name = "libsvtav1-1.5.0-compat-compressed_ten_bit_format.patch";
diff --git a/pkgs/development/libraries/ffmpeg/6.nix b/pkgs/development/libraries/ffmpeg/6.nix
index 37bdf5b060f7..62d3919c0646 100644
--- a/pkgs/development/libraries/ffmpeg/6.nix
+++ b/pkgs/development/libraries/ffmpeg/6.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "6.0";
-  sha256 = "sha256-RVbgsafIbeUUNXmUbDQ03ZN42oaUo0njqROo7KOQgv0=";
+  version = "6.1";
+  hash = "sha256-NzhD2D16bCVCyCXo0TRwZYp3Ta5eFSfoQPa+iRkeNZg=";
 }
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index e713ca1413fb..8b810120b80b 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1,4 +1,4 @@
-{ version, sha256, extraPatches ? [] }:
+{ version, hash, extraPatches ? [] }:
 
 { lib, stdenv, buildPackages, removeReferencesTo, addOpenGLRunpath, pkg-config, perl, texinfo, yasm
 
@@ -27,6 +27,7 @@
   # Feature flags
 , withAlsa ? withHeadlessDeps && stdenv.isLinux # Alsa in/output supporT
 , withAom ? withFullDeps # AV1 reference encoder
+, withAribcaption ? withFullDeps && lib.versionAtLeast version "6.1" # ARIB STD-B24 Caption Decoder/Renderer
 , withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
 , withBluray ? withFullDeps # BluRay reading
 , withBs2b ? withFullDeps # bs2b DSP library
@@ -179,8 +180,8 @@
  */
 , alsa-lib
 , bzip2
-, clang
 , celt
+, clang
 , dav1d
 , fdk_aac
 , fontconfig
@@ -188,27 +189,32 @@
 , frei0r
 , fribidi
 , game-music-emu
+, glslang
 , gnutls
 , gsm
-, libjack2
+, intel-media-sdk
 , ladspaH
 , lame
-, libass
 , libaom
+, libaribcaption
+, libass
 , libbluray
 , libbs2b
 , libcaca
 , libdc1394
-, libraw1394
 , libdrm
+, libGL
+, libGLU
 , libiconv
-, intel-media-sdk
+, libjack2
 , libmodplug
 , libmysofa
 , libogg
 , libopenmpt
 , libopus
 , libplacebo
+, libpulseaudio
+, libraw1394
 , librsvg
 , libssh
 , libtensorflow
@@ -223,41 +229,37 @@
 , libwebp
 , libX11
 , libxcb
-, libXv
 , libXext
 , libxml2
-, xz
+, libXv
 , nv-codec-headers
-, nv-codec-headers-11
-, openal
+, nv-codec-headers-12
 , ocl-icd # OpenCL ICD
+, openal
 , opencl-headers  # OpenCL headers
 , opencore-amr
-, libGL
-, libGLU
 , openh264
 , openjpeg
-, libpulseaudio
 , rav1e
-, svt-av1
 , rtmpdump
 , samba
 , SDL2
 , soxr
 , speex
 , srt
+, svt-av1
 , vid-stab
 , vo-amrwbenc
+, vulkan-headers
+, vulkan-loader
 , x264
 , x265
 , xavs
 , xvidcore
+, xz
 , zeromq4
 , zimg
 , zlib
-, vulkan-headers
-, vulkan-loader
-, glslang
 /*
  *  Darwin frameworks
  */
@@ -334,7 +336,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchgit {
     url = "https://git.ffmpeg.org/ffmpeg.git";
     rev = "n${finalAttrs.version}";
-    inherit sha256;
+    inherit hash;
   };
 
   postPatch = ''
@@ -344,10 +346,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
     substituteInPlace doc/filters.texi \
       --replace /usr/local/lib/frei0r-1 ${frei0r}/lib/frei0r-1
-  '' + lib.optionalString withVulkan ''
-    # FIXME: horrible hack, remove for next release
-    substituteInPlace libavutil/hwcontext_vulkan.c \
-      --replace VK_EXT_VIDEO_DECODE VK_KHR_VIDEO_DECODE
   '';
 
   patches = map (patch: fetchpatch patch) (extraPatches
@@ -357,6 +355,13 @@ stdenv.mkDerivation (finalAttrs: {
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/814178f92647be2411516bbb82f48532373d2554";
         hash = "sha256-FQV9/PiarPXCm45ldtCsxGHjlrriL8DKpn1LaKJ8owI=";
       }
+    )
+    ++ (lib.optional (stdenv.isDarwin && lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2")
+      { # this can be removed post 6.1
+        name = "fix_build_failure_due_to_PropertyKey_EncoderID";
+        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";
+        hash = "sha256-Ittka0mId1N/BwJ0FQ0ygpTSS6Y11u2SjWDpbGN+KXo=";
+      }
     ));
 
   configurePlatforms = [];
@@ -441,6 +446,8 @@ stdenv.mkDerivation (finalAttrs: {
      *  External libraries
      */
     (enableFeature withAlsa "alsa")
+    # FIXME: see if jellyfin-ffmpeg is already on a version >= 6.1 to use enableFeature
+    (optionalString withAribcaption "--enable-libaribcaption")
     (enableFeature withBzlib "bzlib")
     (enableFeature withCelt "libcelt")
     (enableFeature withCuda "cuda")
@@ -553,9 +560,10 @@ stdenv.mkDerivation (finalAttrs: {
   # TODO This was always in buildInputs before, why?
   buildInputs = optionals withFullDeps [ libdc1394 ]
   ++ optionals (withFullDeps && !stdenv.isDarwin) [ libraw1394 ] # TODO where does this belong to
-  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast version "6") then nv-codec-headers-11 else nv-codec-headers) ]
+  ++ optionals (withNvdec || withNvenc) [ (if (lib.versionAtLeast version "6") then nv-codec-headers-12 else nv-codec-headers) ]
   ++ optionals withAlsa [ alsa-lib ]
   ++ optionals withAom [ libaom ]
+  ++ optionals withAribcaption [ libaribcaption ]
   ++ optionals withAss [ libass ]
   ++ optionals withBluray [ libbluray ]
   ++ optionals withBs2b [ libbs2b ]
@@ -698,7 +706,7 @@ stdenv.mkDerivation (finalAttrs: {
       ++ optional withUnfree unfreeRedistributable;
     pkgConfigModules = [ "libavutil" ];
     platforms = platforms.all;
-    maintainers = with maintainers; [ atemu ];
+    maintainers = with maintainers; [ atemu arthsmn ];
     mainProgram = "ffmpeg";
   };
 })
diff --git a/pkgs/development/libraries/futuresql/default.nix b/pkgs/development/libraries/futuresql/default.nix
index fb6e4061e6f6..ed6a7033909a 100644
--- a/pkgs/development/libraries/futuresql/default.nix
+++ b/pkgs/development/libraries/futuresql/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, extra-cmake-modules, qtbase }:
+{ stdenv, lib, fetchurl, cmake, extra-cmake-modules, qtbase }:
 stdenv.mkDerivation rec {
   pname = "futuresql";
   version = "0.1.1";
@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [ qtbase ];
+  cmakeFlags = ["-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}"];
 
   # a library, nothing to wrap
   dontWrapQtApps = true;
diff --git a/pkgs/development/libraries/gbenchmark/default.nix b/pkgs/development/libraries/gbenchmark/default.nix
index f53868a0926f..7292b3452826 100644
--- a/pkgs/development/libraries/gbenchmark/default.nix
+++ b/pkgs/development/libraries/gbenchmark/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gbenchmark";
-  version = "1.8.0";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "benchmark";
     rev = "v${version}";
-    sha256 = "sha256-pUW9YVaujs/y00/SiPqDgK4wvVsaM7QUp/65k0t7Yr0=";
+    sha256 = "sha256-gztnxui9Fe/FTieMjdvfJjWHjkImtlsHn6fM1FruyME=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -29,7 +29,8 @@ stdenv.mkDerivation rec {
       --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
   '';
 
-  doCheck = true;
+  # Tests fail on 32-bit due to not enough precision
+  doCheck = stdenv.is64bit;
 
   passthru.tests = {
     inherit prometheus-cpp;
diff --git a/pkgs/development/libraries/gcc/libgcc/default.nix b/pkgs/development/libraries/gcc/libgcc/default.nix
index c168113fa3c4..600ca69f46d0 100644
--- a/pkgs/development/libraries/gcc/libgcc/default.nix
+++ b/pkgs/development/libraries/gcc/libgcc/default.nix
@@ -10,6 +10,7 @@ let
     "--disable-intl"
     "--enable-threads=posix"
     "--with-glibc-version=${glibc.version}"
+    "--disable-plugin"
 
     # these are required in order to prevent inhibit_libc=true,
     # which will cripple libgcc's unwinder; see:
diff --git a/pkgs/development/libraries/gjs/default.nix b/pkgs/development/libraries/gjs/default.nix
index ae0730873b8e..b7f91afa3710 100644
--- a/pkgs/development/libraries/gjs/default.nix
+++ b/pkgs/development/libraries/gjs/default.nix
@@ -32,13 +32,13 @@ let
   ];
 in stdenv.mkDerivation (finalAttrs: {
   pname = "gjs";
-  version = "1.78.0";
+  version = "1.78.1";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-+6og4JF2aIMIAPkpUWiPn8CPASlq/9XNtLNfdQvifck=";
+    hash = "sha256-fpBRHEKRJ8OerABoxKyaNT335vu8ZG9fGOiWKILBhkE=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index a2e4ad8f47cf..2e9a3702449a 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -50,11 +50,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.78.1";
+  version = "2.78.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "kVvD0PhQfWUOrTgy4vj7Zw/OWarE13VKfatvHm/teLI=";
+    sha256 = "YJgB3Tc3luUVlyv5X8Cy2qRFRUge4vRlxPIE0iSyvCE=";
   };
 
   patches = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/glib/split-dev-programs.patch b/pkgs/development/libraries/glib/split-dev-programs.patch
index f3497e6a7811..0333c5c9ca29 100644
--- a/pkgs/development/libraries/glib/split-dev-programs.patch
+++ b/pkgs/development/libraries/glib/split-dev-programs.patch
@@ -1,5 +1,5 @@
 diff --git a/gio/gdbus-2.0/codegen/meson.build b/gio/gdbus-2.0/codegen/meson.build
-index 65faae9..4297513 100644
+index 65faae9b2..4297513d4 100644
 --- a/gio/gdbus-2.0/codegen/meson.build
 +++ b/gio/gdbus-2.0/codegen/meson.build
 @@ -20,7 +20,7 @@ gdbus_codegen_conf.set('DATADIR', glib_datadir)
@@ -12,12 +12,12 @@ index 65faae9..4297513 100644
    configuration : gdbus_codegen_conf
  )
 diff --git a/gio/meson.build b/gio/meson.build
-index b19c59f..3b20e84 100644
+index 75686bb3e..2f1a73482 100644
 --- a/gio/meson.build
 +++ b/gio/meson.build
-@@ -879,14 +879,15 @@ pkg.generate(libgio,
-     'datadir=' + '${prefix}' / get_option('datadir'),
+@@ -882,14 +882,15 @@ pkg.generate(libgio,
      'schemasdir=' + '${datadir}' / schemas_subdir,
+     'dtdsdir=' + '${datadir}' / dtds_subdir,
      'bindir=' + '${prefix}' / get_option('bindir'),
 +    'devbindir=' + get_option('devbindir'),
      'giomoduledir=' + pkgconfig_giomodulesdir,
@@ -36,7 +36,7 @@ index b19c59f..3b20e84 100644
      'gsettings=' + '${bindir}' / 'gsettings',
    ],
    version : glib_version,
-@@ -989,6 +990,7 @@ executable('gio', gio_tool_sources,
+@@ -992,6 +993,7 @@ executable('gio', gio_tool_sources,
  
  executable('gresource', 'gresource-tool.c',
    install : true,
@@ -44,7 +44,7 @@ index b19c59f..3b20e84 100644
    install_tag : 'bin',
    # intl.lib is not compatible with SAFESEH
    link_args : noseh_link_args,
-@@ -996,7 +998,7 @@ executable('gresource', 'gresource-tool.c',
+@@ -999,7 +1001,7 @@ executable('gresource', 'gresource-tool.c',
  
  gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodule-priv.c',
    install : true,
@@ -53,7 +53,7 @@ index b19c59f..3b20e84 100644
    install_tag : 'bin',
    c_args : gio_c_args,
    # intl.lib is not compatible with SAFESEH
-@@ -1006,7 +1008,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu
+@@ -1009,7 +1011,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu
  glib_compile_schemas = executable('glib-compile-schemas',
    ['glib-compile-schemas.c'],
    install : true,
@@ -62,7 +62,7 @@ index b19c59f..3b20e84 100644
    install_tag : 'bin',
    # intl.lib is not compatible with SAFESEH
    link_args : noseh_link_args,
-@@ -1015,6 +1017,7 @@ glib_compile_schemas = executable('glib-compile-schemas',
+@@ -1018,6 +1020,7 @@ glib_compile_schemas = executable('glib-compile-schemas',
  glib_compile_resources = executable('glib-compile-resources',
    [gconstructor_as_data_h, 'glib-compile-resources.c'],
    install : true,
@@ -70,8 +70,49 @@ index b19c59f..3b20e84 100644
    install_tag : 'bin-devel',
    c_args : gio_c_args,
    # intl.lib is not compatible with SAFESEH
+diff --git a/gio/tests/meson.build b/gio/tests/meson.build
+index 4ef3343ab..2a0a6b56b 100644
+--- a/gio/tests/meson.build
++++ b/gio/tests/meson.build
+@@ -1131,16 +1131,18 @@ if have_bash and have_pkg_config
+ 
+   gio_binaries = [
+     'gio',
+-    'glib-compile-resources',
+     'gdbus',
+-    'gdbus-codegen',
+-    'gresource',
+     'gsettings',
+   ]
+-  gio_multiarch_binaries = [
++  gio_dev_binaries = [
++    'glib-compile-resources',
++    'gdbus-codegen',
++    'gresource',
+     'gio-querymodules',
+     'glib-compile-schemas',
+   ]
++  gio_multiarch_binaries = [
++  ]
+ 
+   foreach binary: gio_binaries
+     pkg_config_tests += [
+@@ -1149,6 +1151,13 @@ if have_bash and have_pkg_config
+         prefix / get_option('bindir') / binary)
+     ]
+   endforeach
++  foreach binary: gio_dev_binaries
++    pkg_config_tests += [
++      'test "$(pkg-config --variable=@0@ gio-2.0)" = "@1@"'.format(
++        binary.underscorify(),
++        prefix / get_option('devbindir') / binary)
++    ]
++  endforeach
+ 
+   foreach binary: gio_multiarch_binaries
+     pkg_config_tests += [
 diff --git a/glib/meson.build b/glib/meson.build
-index c26a35e..38effe1 100644
+index c26a35e42..38effe12a 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -447,9 +447,10 @@ pkg.generate(libglib,
@@ -105,8 +146,24 @@ index c26a35e..38effe1 100644
    install_tag : 'bin-devel',
    configuration: report_conf,
    install_mode: 'rwxr-xr-x'
+diff --git a/glib/tests/meson.build b/glib/tests/meson.build
+index 09ecd5ab3..9748d4122 100644
+--- a/glib/tests/meson.build
++++ b/glib/tests/meson.build
+@@ -508,9 +508,9 @@ if have_bash and have_pkg_config
+         'test "$(pkg-config --variable=datadir glib-2.0)" = "@0@"'.format(
+           prefix / get_option('datadir')),
+         'test "$(pkg-config --variable=gobject_query glib-2.0)" = "@0@"'.format(
+-          prefix / get_option('bindir') / 'gobject-query'),
++          prefix / get_option('devbindir') / 'gobject-query'),
+         'test "$(pkg-config --variable=glib_mkenums glib-2.0)" = "@0@"'.format(
+-          prefix / get_option('bindir') / 'glib-mkenums'),
++          prefix / get_option('devbindir') / 'glib-mkenums'),
+         'test "$(pkg-config --variable=glib_valgrind_suppressions glib-2.0)" = "@0@"'.format(
+           prefix / get_option('datadir') /
+           valgrind_suppression_file_install_subdir / fs.name(valgrind_suppression_file)),
 diff --git a/gobject/meson.build b/gobject/meson.build
-index 2129aaf..da84624 100644
+index 2129aaf8a..da8462428 100644
 --- a/gobject/meson.build
 +++ b/gobject/meson.build
 @@ -94,7 +94,7 @@ foreach tool: python_tools
@@ -127,7 +184,7 @@ index 2129aaf..da84624 100644
    dependencies : [libglib_dep, libgobject_dep])
  
 diff --git a/meson_options.txt b/meson_options.txt
-index 517d575..198cc1b 100644
+index 517d5757c..198cc1b3c 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -4,6 +4,11 @@ option('runtime_libdir',
@@ -143,7 +200,7 @@ index 517d575..198cc1b 100644
         type : 'string',
         value : '',
 diff --git a/tools/meson.build b/tools/meson.build
-index 257312e..f831539 100644
+index 257312ebf..f8315392b 100644
 --- a/tools/meson.build
 +++ b/tools/meson.build
 @@ -8,7 +8,7 @@ if have_sh
diff --git a/pkgs/development/libraries/google-cloud-cpp/default.nix b/pkgs/development/libraries/google-cloud-cpp/default.nix
index 9aa1284bbee9..0a6be882120b 100644
--- a/pkgs/development/libraries/google-cloud-cpp/default.nix
+++ b/pkgs/development/libraries/google-cloud-cpp/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , c-ares
 , cmake
 , crc32c
@@ -18,6 +19,7 @@
 , staticOnly ? stdenv.hostPlatform.isStatic
 }:
 let
+  # defined in cmake/GoogleapisConfig.cmake
   googleapisRev = "85f8c758016c279fb7fa8f0d51ddc7ccc0dd5e05";
   googleapis = fetchFromGitHub {
     name = "googleapis-src";
@@ -39,6 +41,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0SoOaAqvk8cVC5W3ejTfe4O/guhrro3uAzkeIpAkCpg=";
   };
 
+  patches = [
+    # https://github.com/googleapis/google-cloud-cpp/pull/12554, tagged in 2.16.0
+    (fetchpatch {
+      name = "prepare-for-GCC-13.patch";
+      url = "https://github.com/googleapis/google-cloud-cpp/commit/ae30135c86982c36e82bb0f45f99baa48c6a780b.patch";
+      hash = "sha256-L0qZfdhP8Zt/gYBWvJafteVgBHR8Kup49RoOrLDtj3k=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace external/googleapis/CMakeLists.txt \
       --replace "https://github.com/googleapis/googleapis/archive/\''${_GOOGLE_CLOUD_CPP_GOOGLEAPIS_COMMIT_SHA}.tar.gz" "file://${googleapis}"
@@ -69,7 +80,7 @@ stdenv.mkDerivation rec {
   ];
 
   # https://hydra.nixos.org/build/222679737/nixlog/3/tail
-  NIX_CFLAGS_COMPILE = if stdenv.isAarch64 then "-Wno-error=maybe-uninitialized" else null;
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isAarch64 "-Wno-error=maybe-uninitialized";
 
   doInstallCheck = true;
 
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 4dec79e0e2da..ca359fcc912b 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -19,6 +19,7 @@
 , swig2 ? null
 # only for passthru.tests
 , libsForQt5
+, qt6Packages
 , python3
 }:
 let
@@ -26,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.23.0";
+  version = "1.23.2";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/${pname}-${version}.tar.bz2";
-    hash = "sha256-BD4u/hi0rSK5bUNN3nY/vtMs+NbCINxp3w0P+53Gb8Y=";
+    hash = "sha256-lJnosfM8zLaBVSehvBYEnTWmGYpsX64BhfK9VhvOUiQ=";
   };
 
   patches = [
@@ -109,7 +110,8 @@ stdenv.mkDerivation rec {
 
   passthru.tests = {
     python = python3.pkgs.gpgme;
-    qt = libsForQt5.qgpgme;
+    qt5 = libsForQt5.qgpgme;
+    qt6 = qt6Packages.qgpgme;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 2874f0d2fa04..7706975ca056 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -109,13 +109,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-xxb43/qPrD+2RpQa8cbscv/wWgRRMTEb8tBJ/ch7zi4=";
+    hash = "sha256-RYeD+CNgaJkePilu3Wccjt24vm+skzwcLhUDRihk6g8=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index e87555fef57b..c68693681ee1 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -45,7 +45,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [ "out" "dev" ];
 
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-YlGeDY+Wnr9iqaeZby0j792jMCF6Y19KMsC/HHFXdGg=";
+    hash = "sha256-62eS5cc8be+5FZw26m5LeKL4r2USZ4tL07AsjS1JKs8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 6a44f3e01a27..9979184b089a 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [
     "bin"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-AeQsY1Kga9+kRW5ksGq32YxcSHolVXx2FVRjHL2mQhc=";
+    hash = "sha256-rU49sXcRObHbF7Gvp8BdsIOuAQC9TaJEtx8WLczkG/w=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gstreamer/default.nix b/pkgs/development/libraries/gstreamer/default.nix
index 662009005e36..1bfdf5b24de3 100644
--- a/pkgs/development/libraries/gstreamer/default.nix
+++ b/pkgs/development/libraries/gstreamer/default.nix
@@ -14,6 +14,7 @@
 , Security
 , VideoToolbox
 , ipu6ep-camera-hal
+, ipu6epmtl-camera-hal
 }:
 
 {
@@ -47,6 +48,9 @@
   icamerasrc-ipu6ep = callPackage ./icamerasrc {
     ipu6-camera-hal = ipu6ep-camera-hal;
   };
+  icamerasrc-ipu6epmtl = callPackage ./icamerasrc {
+    ipu6-camera-hal = ipu6epmtl-camera-hal;
+  };
 
   # note: gst-python is in ../../python-modules/gst-python - called under python3Packages
 }
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index 87097dddd8d3..6ce4723b5a32 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-devtools";
-  version = "1.22.7";
+  version = "1.22.8";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-FXz5P7J0HPDD3qcxvjry/65wPJ8s08DJGzgPvGheufk=";
+    hash = "sha256-zWNAVvyxbQNbPfWVPsha6L1Wxo8pkgtyDvkgynHqdqc=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 764bd78c083a..317fc4e53728 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-editing-services";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-/sVqLDeiU80EjSiNTH7abv8ZECKwnbl14HosEF0bUh4=";
+    hash = "sha256-0dXnXhkOsL4/1JQJ5Bo6qOaM+03qpzU0iFVGdJVs0d8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 7e4c7d77363d..6bea24314695 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -54,13 +54,13 @@ assert raspiCameraSupport -> (stdenv.isLinux && stdenv.isAarch32);
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-ttsOGOOYtSZlt83OMBw0qHUEg9X0+6we3p+AsDdDzRU=";
+    hash = "sha256-4wW58H9SdDykgdoKTgx2w179YK2vGwaU6zuwIeITfjk=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
index b03dd953e140..4d6c5671f0e2 100644
--- a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
+++ b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
@@ -8,15 +8,15 @@
 , libdrm
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "icamerasrc-${ipu6-camera-hal.ipuVersion}";
-  version = "unstable-2023-03-09";
+  version = "unstable-2023-10-23";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "icamerasrc";
-    rev = "17841ab6249aaa69bd9b3959262bf182dee74111";
-    hash = "sha256-j8ZYe4nyy5yfo10CGeXDwbAaAPvdr0ptMWB8hQDyESQ=";
+    rev = "528a6f177732def4d5ebc17927220d8823bc8fdc";
+    hash = "sha256-Ezcm5OpF/NKvJf5sFeJyvNc2Uq0166GukC9MuNUV2Fs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index c183f8ee48a2..f3dfac82c799 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.22.7";
+  version = "1.22.8";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-FSW5FxQbiV/lz2GP6IZ2IrJSgnigKG6fcntfNzF9rKE=";
+    hash = "sha256-vjk0m8B6tM29ml/W6phIxgHHVguloFd61SALg71CSYE=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 1420a438b6f6..6b0dfcc8598f 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.22.7";
+  version = "1.22.8";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-9/rAAeIK0h420YOXdBxGV8XUNXHrHMO0n5qTrhJ9yI8=";
+    hash = "sha256-cFF3BRwimXbxca3Nerl2Kua8xLt33DCKC9gKY9psM38=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index b92bb9dc0d4c..cc78a6ec0f80 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.22.7";
+  version = "1.22.8";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-UgtGvKY3GJrYaimP8kWy2JN128rIsF102uqRD4Gp6do=";
+    hash = "sha256-B2HZa6UI4BwCcYgbJoKMK//X2K/VCHIhnwiPdVslLKc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index b779d132210d..b3a7142edae9 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.22.7";
+  version = "1.22.8";
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-Dp//douJ3m0xizQUbk54HYK5oPQCXcVBssg0nHvLf2c=";
+    hash = "sha256-Epi6NHpwxCuIzev5G2Wf6gKxu3Jp6r+OKePAvVgniSg=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 27afba7833e8..c244414c5508 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -64,7 +64,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk+3";
-  version = "3.24.38";
+  version = "3.24.39";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
   outputBin = "dev";
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
   in fetchurl {
     url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "sha256-zhHezwGLJb3YUFVEpPhyQoVOyIvgVNmt5fOiBETdjuc=";
+    sha256 = "sha256-HKw+VmubLzZTpFjAjC3N/cqfkIA3rAPJ2FZLQpV3jXk=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 218efb6559fb..2d14823accf4 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -3,7 +3,6 @@
 , buildPackages
 , substituteAll
 , fetchurl
-, fetchpatch
 , pkg-config
 , gettext
 , graphene
@@ -69,7 +68,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk4";
-  version = "4.12.3";
+  version = "4.12.4";
 
   outputs = [ "out" "dev" ] ++ lib.optionals x11Support [ "devdoc" ];
   outputBin = "dev";
@@ -81,19 +80,12 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    sha256 = "FIziYvbIZIdFX7HZeTw/WLw+HaR3opYX+tsEIPWHCok=";
+    sha256 = "umfGSY5Vmfko7a+54IoyCt+qUKsvDab8arIlL8LVdSA=";
   };
 
   patches = [
     # https://github.com/NixOS/nixpkgs/pull/218143#issuecomment-1501059486
     ./patches/4.0-fix-darwin-build.patch
-
-    # gdk: Fix compilation on macos
-    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/6208
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/aa888c0b3f775776fe3b71028396b7a8c6adb1d6.patch";
-      sha256 = "sha256-Jw6BvWDX0wIs4blUiX3qdQCR574yhcaO06Vy/IqfbJo=";
-    })
   ];
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gumbo/default.nix b/pkgs/development/libraries/gumbo/default.nix
index b8cfef1f3247..68416ef2edc0 100644
--- a/pkgs/development/libraries/gumbo/default.nix
+++ b/pkgs/development/libraries/gumbo/default.nix
@@ -1,20 +1,21 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool }:
+{ lib
+, stdenv
+, fetchFromGitea
+, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "gumbo";
-  version = "0.10.1";
+  version = "0.12.1";
 
-  src = fetchFromGitHub {
-    owner = "google";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "grisha";
     repo = "gumbo-parser";
-    rev = "v${version}";
-    sha256 = "0xslckwdh2i0g2qjsb6rnm8mjmbagvziz0hjlf7d1lbljfms1iw1";
+    rev = version;
+    hash = "sha256-d4V4bI08Prmg3U0KGu4yIwpHcvTJT3NAd4lbzdBU/AE=";
   };
 
-  strictDeps = true;
-  nativeBuildInputs = [ autoconf automake libtool ];
-
-  preConfigure = "./autogen.sh";
+  nativeBuildInputs = [ autoreconfHook ];
 
   meta = with lib; {
     description = "C99 HTML parsing algorithm";
diff --git a/pkgs/development/libraries/hfst-ospell/default.nix b/pkgs/development/libraries/hfst-ospell/default.nix
index ad07025cc35d..f0a0bc6bef48 100644
--- a/pkgs/development/libraries/hfst-ospell/default.nix
+++ b/pkgs/development/libraries/hfst-ospell/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , autoreconfHook
 , fetchFromGitHub
+, fetchpatch
 , icu
 , libarchive
 , pkg-config
@@ -18,6 +19,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-16H1nbAIe+G71+TnlLG0WnH9LktZwmc0d0O+oYduH1k=";
   };
 
+  patches = [
+    # Pull upstream fix for gcc-13
+    (fetchpatch {
+      name = "cstdint.patch";
+      url = "https://github.com/hfst/hfst-ospell/commit/7481bffbf622bc9aee3547183fbe8db9cf8b22ce.patch";
+      hash = "sha256-q/B5mLx8Oc0nIRe3n3gl0OTyjIaEMCBsPc1GvpE226c=";
+    })
+  ];
+
   buildInputs = [
     icu
     libarchive
diff --git a/pkgs/development/libraries/intel-media-sdk/default.nix b/pkgs/development/libraries/intel-media-sdk/default.nix
index da8568bc8dc5..b20b6782d9b0 100644
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, gtest, libdrm, libpciaccess, libva, libX11
-, libXau, libXdmcp, libpthreadstubs }:
+, libXau, libXdmcp, libpthreadstubs, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "intel-media-sdk";
@@ -12,6 +12,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-wno3a/ZSKvgHvZiiJ0Gq9GlrEbfHCizkrSiHD6k/Loo=";
   };
 
+  patches = [
+    # https://github.com/Intel-Media-SDK/MediaSDK/pull/3005
+    (fetchpatch {
+      name = "include-cstdint-explicitly.patch";
+      url = "https://github.com/Intel-Media-SDK/MediaSDK/commit/a4f37707c1bfdd5612d3de4623ffb2d21e8c1356.patch";
+      hash = "sha256-OPwGzcMTctJvHcKn5bHqV8Ivj4P7+E4K9WOKgECqf04=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     libdrm libva libpciaccess libX11 libXau libXdmcp libpthreadstubs
diff --git a/pkgs/development/libraries/ipu6-camera-hal/default.nix b/pkgs/development/libraries/ipu6-camera-hal/default.nix
index 7fce11d21a43..3ec63fd0807d 100644
--- a/pkgs/development/libraries/ipu6-camera-hal/default.nix
+++ b/pkgs/development/libraries/ipu6-camera-hal/default.nix
@@ -8,20 +8,32 @@
 
 # runtime
 , expat
-, ipu6-camera-bin
+, ipu6-camera-bins
 , libtool
 , gst_all_1
-}:
 
+# Pick one of
+# - ipu6 (Tiger Lake)
+# - ipu6ep (Alder Lake)
+# - ipu6epmtl (Meteor Lake)
+, ipuVersion ? "ipu6"
+}:
+let
+  ipuTarget = {
+    "ipu6" = "ipu_tgl";
+    "ipu6ep" = "ipu_adl";
+    "ipu6epmtl" = "ipu_mtl";
+  }.${ipuVersion};
+in
 stdenv.mkDerivation {
-  pname = "${ipu6-camera-bin.ipuVersion}-camera-hal";
-  version = "unstable-2023-02-08";
+  pname = "${ipuVersion}-camera-hal";
+  version = "unstable-2023-09-25";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipu6-camera-hal";
-    rev = "884b81aae0ea19a974eb8ccdaeef93038136bdd4";
-    hash = "sha256-AePL7IqoOhlxhfPRLpCman5DNh3wYS4MUcLgmgBUcCM=";
+    rev = "9fa05a90886d399ad3dda4c2ddc990642b3d20c9";
+    hash = "sha256-yS1D7o6dsQ4FQkjfwcisOxcP7Majb+4uQ/iW5anMb5c=";
   };
 
   nativeBuildInputs = [
@@ -29,25 +41,23 @@ stdenv.mkDerivation {
     pkg-config
   ];
 
+  PKG_CONFIG_PATH = "${lib.makeLibraryPath [ ipu6-camera-bins ]}/${ipuTarget}/pkgconfig";
+
   cmakeFlags = [
-    "-DIPU_VER=${ipu6-camera-bin.ipuVersion}"
+    "-DIPU_VER=${ipuVersion}"
     # missing libiacss
     "-DUSE_PG_LITE_PIPE=ON"
-    # missing libipu4
-    "-DENABLE_VIRTUAL_IPU_PIPE=OFF"
   ];
 
   NIX_CFLAGS_COMPILE = [
     "-Wno-error"
-    "-I${lib.getDev ipu6-camera-bin}/include/ia_imaging"
-    "-I${lib.getDev ipu6-camera-bin}/include/ia_camera"
   ];
 
   enableParallelBuilding = true;
 
   buildInputs = [
     expat
-    ipu6-camera-bin
+    ipu6-camera-bins
     libtool
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
@@ -59,12 +69,13 @@ stdenv.mkDerivation {
   '';
 
   postFixup = ''
-    substituteInPlace $out/lib/pkgconfig/libcamhal.pc \
-      --replace 'prefix=/usr' "prefix=$out"
+    for lib in $out/lib/*.so; do
+      patchelf --add-rpath "${lib.makeLibraryPath [ ipu6-camera-bins ]}/${ipuTarget}" $lib
+    done
   '';
 
   passthru = {
-    inherit (ipu6-camera-bin) ipuVersion;
+    inherit ipuVersion;
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index f89152820698..af99944dae72 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -13,12 +13,12 @@ stdenv.mkDerivation rec {
     patchShebangs test_jbig2dec.py
   '';
 
-  preConfigure = ''
-    ./autogen.sh
-  '';
-
   nativeBuildInputs = [ autoconf automake libtool ];
 
+  # `autogen.sh` runs `configure`, and expects that any flags needed
+  # by `configure` (like `--host`) are passed to `autogen.sh`.
+  configureScript = "./autogen.sh";
+
   nativeCheckInputs = [ python3 ];
   doCheck = true;
 
diff --git a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
index a33a55d63e7d..7109a5d6dfd1 100644
--- a/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
+++ b/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
@@ -1,21 +1,18 @@
 { ffmpeg_6-full
-, nv-codec-headers-12
 , chromaprint
 , fetchFromGitHub
 , lib
 }:
 
-(ffmpeg_6-full.override {
-  nv-codec-headers-11 = nv-codec-headers-12;
-}).overrideAttrs (old: rec {
+ffmpeg_6-full.overrideAttrs (old: rec {
   pname = "jellyfin-ffmpeg";
-  version = "6.0-7";
+  version = "6.0.1-1";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     rev = "v${version}";
-    sha256 = "sha256-Z4getn/mVYIRANkIOyt7jMpcqHBvq5GXLK/ST5zV1r4=";
+    hash = "sha256-LMwGxx++z6TpZLnpeRGraid4653Mp8T4pY5EP4Z7GXY=";
   };
 
   buildInputs = old.buildInputs ++ [ chromaprint ];
diff --git a/pkgs/development/libraries/json-c/default.nix b/pkgs/development/libraries/json-c/default.nix
index 785548c211a9..ab3d2be6f010 100644
--- a/pkgs/development/libraries/json-c/default.nix
+++ b/pkgs/development/libraries/json-c/default.nix
@@ -1,24 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "json-c";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchFromGitHub {
     owner = "json-c";
     repo = "json-c";
-    rev = "json-c-0.16-20220414";
-    sha256 = "sha256-KbnUWLgpg6/1wvXhUoYswyqDcgiwEcvgaWCPjNcX20o=";
+    rev = "json-c-0.17-20230812";
+    hash = "sha256-R5KIJ0xVgGqffjzJaZvvvhAneJ+ZBuanyF6KYTTxb58=";
   };
 
-  patches = [
-    # needed for emscripten, which uses LLVM 15+
-    (fetchpatch {
-      url = "https://github.com/json-c/json-c/commit/6eca65617aacd19f4928acd5766b8dd20eda0b34.patch";
-      sha256 = "sha256-fyugX+HgYlt/4AVtfNDaKS+blyUt8JYTNqkmhURb9dk=";
-    })
-  ];
-
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake ];
@@ -31,9 +27,10 @@ stdenv.mkDerivation rec {
       and parse JSON formatted strings back into the C representation of JSON
       objects.
     '';
-    homepage    = "https://github.com/json-c/json-c/wiki";
+    homepage = "https://github.com/json-c/json-c/wiki";
+    changelog = "https://github.com/json-c/json-c/blob/${finalAttrs.src.rev}/ChangeLog";
     maintainers = with maintainers; [ lovek323 ];
-    platforms   = platforms.unix;
+    platforms = platforms.unix;
     license = licenses.mit;
   };
-}
+})
diff --git a/pkgs/development/libraries/kde-frameworks/default.nix b/pkgs/development/libraries/kde-frameworks/default.nix
index 4245aa0ed20e..cc87ec2afa57 100644
--- a/pkgs/development/libraries/kde-frameworks/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/default.nix
@@ -120,7 +120,8 @@ let
       kwindowsystem = callPackage ./kwindowsystem {};
       modemmanager-qt = callPackage ./modemmanager-qt.nix {};
       networkmanager-qt = callPackage ./networkmanager-qt.nix {};
-      oxygen-icons5 = callPackage ./oxygen-icons5.nix {};
+      oxygen-icons = callPackage ./oxygen-icons.nix {};
+      oxygen-icons5 = oxygen-icons;
       prison = callPackage ./prison.nix {};
       qqc2-desktop-style = callPackage ./qqc2-desktop-style.nix {};
       solid = callPackage ./solid {};
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index f53e0d6c16bf..590818546a4b 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.112/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.113/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/kde-frameworks/oxygen-icons5.nix b/pkgs/development/libraries/kde-frameworks/oxygen-icons.nix
index 7121944d5d39..4760c51abe54 100644
--- a/pkgs/development/libraries/kde-frameworks/oxygen-icons5.nix
+++ b/pkgs/development/libraries/kde-frameworks/oxygen-icons.nix
@@ -5,7 +5,7 @@
 }:
 
 mkDerivation {
-  pname = "oxygen-icons5";
+  pname = "oxygen-icons";
   meta.license = lib.licenses.lgpl3Plus;
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index f6909957ba44..06b5e6b04cfa 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/attica-5.112.0.tar.xz";
-      sha256 = "0syg508bjfq5ycr246p3f4q37ihvqk5j7n66vkn7h7dvgwspjff5";
-      name = "attica-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/attica-5.113.0.tar.xz";
+      sha256 = "0p6n2jvky5x9gpwmp31mdxf0bzywaljgnkszgbklyc35xk9i6j14";
+      name = "attica-5.113.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/baloo-5.112.0.tar.xz";
-      sha256 = "17h83s5r70hg8qjv9vli43zv854jll40cmmh2pjcg7nlfi1ypcbz";
-      name = "baloo-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/baloo-5.113.0.tar.xz";
+      sha256 = "1jv7202dj2w0vcv49bgp0iv1sfy3kdqr974rcr77pcfzhhda9bix";
+      name = "baloo-5.113.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/bluez-qt-5.112.0.tar.xz";
-      sha256 = "03kzvklzj9h4sl1850c1lh4b3z9lis7d6l9fb9cfnffh3wjpjagb";
-      name = "bluez-qt-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/bluez-qt-5.113.0.tar.xz";
+      sha256 = "1y6nkl9zc5298jc6klxz88h6srmma085w1q5l4jmjihgys2zkcx7";
+      name = "bluez-qt-5.113.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/breeze-icons-5.112.0.tar.xz";
-      sha256 = "0n3xdja42hzn3hssj0a8d97kkb790kinp2xmslfl7w8izsz53p39";
-      name = "breeze-icons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/breeze-icons-5.113.0.tar.xz";
+      sha256 = "0kb3wchx84dpi77zsi1b9pzlkhg3sjagxcsf1pdappagq3xn1p48";
+      name = "breeze-icons-5.113.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/extra-cmake-modules-5.112.0.tar.xz";
-      sha256 = "1qn2shanzsv06q34zwhkjhb88j7crdp83qp265gpxmc049vq845c";
-      name = "extra-cmake-modules-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/extra-cmake-modules-5.113.0.tar.xz";
+      sha256 = "1i1vpf9860cwrq5b01yrgf94hmzk9dx637j638shgjmyxr058pi6";
+      name = "extra-cmake-modules-5.113.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/frameworkintegration-5.112.0.tar.xz";
-      sha256 = "1kiy4vcr8lj82mhpgn99yw4w6lwr26yjmsfdv3n6ha667gqv2gn6";
-      name = "frameworkintegration-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/frameworkintegration-5.113.0.tar.xz";
+      sha256 = "17i7frachq23kfg78ar33x5acwf7pmwl1a5c02qif44mml8b09hi";
+      name = "frameworkintegration-5.113.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kactivities-5.112.0.tar.xz";
-      sha256 = "0nzbvby11f14h5w2q5wa5kij7bpx01ffqsi8mmjk71imhq5mzkfz";
-      name = "kactivities-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kactivities-5.113.0.tar.xz";
+      sha256 = "1d9lkhp344wdss9vab3gh9h31f1k6fifdhp17fblpkykgyvbb26y";
+      name = "kactivities-5.113.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kactivities-stats-5.112.0.tar.xz";
-      sha256 = "0czic2s147nhjphdkfymnakrw73bzi0pbmb8s3frrxsf4yp7gvzy";
-      name = "kactivities-stats-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kactivities-stats-5.113.0.tar.xz";
+      sha256 = "136z2njw3k2l71xp4vg10sm5q925xh8yfr9a784wnr0kwngdb71i";
+      name = "kactivities-stats-5.113.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kapidox-5.112.0.tar.xz";
-      sha256 = "0fa80ncx4h5izhw6vjjglmxcs9h4rvf2q1bcm0m4zcpky5h8bdqi";
-      name = "kapidox-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kapidox-5.113.0.tar.xz";
+      sha256 = "05407c01wnjyslbbz0w5wipjpx6ng3izya41mg13g700ainj9q1x";
+      name = "kapidox-5.113.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/karchive-5.112.0.tar.xz";
-      sha256 = "0rzxxgp5hcs63yfqisvf1m2m0qyrj2ri9966h5hc25jh5ajrgmi7";
-      name = "karchive-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/karchive-5.113.0.tar.xz";
+      sha256 = "03a3p85hmx4ycfp0y5l9yw4cy3i9jwy7jd27psmckr4q0538k91d";
+      name = "karchive-5.113.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kauth-5.112.0.tar.xz";
-      sha256 = "1xq5jhnp3dyykx84p5ijhi6kj0x2iz8k665bkkz4zcv9l8gf9jv7";
-      name = "kauth-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kauth-5.113.0.tar.xz";
+      sha256 = "0ncpyq2l53p4yhhxkvk23x0ji9amrbnm6kbz8dp573cqww79pih2";
+      name = "kauth-5.113.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kbookmarks-5.112.0.tar.xz";
-      sha256 = "12m8wx8sv12mwj2xprbr3ywr66mq3415byjfsz8f5yx4lhywkcfi";
-      name = "kbookmarks-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kbookmarks-5.113.0.tar.xz";
+      sha256 = "1fgnh8amy2ghn50i59al0iyqvj05pzdxai9qxqzbvi65f1pibi7d";
+      name = "kbookmarks-5.113.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcalendarcore-5.112.0.tar.xz";
-      sha256 = "0najg934lylb5m64lmkpv3v7ri2g3ncsg8ycg7gkm8r93nypa60r";
-      name = "kcalendarcore-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcalendarcore-5.113.0.tar.xz";
+      sha256 = "18psjzqcfzaplcfjpjda983mrpv306il0j49q3rm9hj9ycj54wc2";
+      name = "kcalendarcore-5.113.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcmutils-5.112.0.tar.xz";
-      sha256 = "0b4l5hf90jrbj4bbrkmyz1va6znwd8dpp2w0i5h002xbpf6vwp2y";
-      name = "kcmutils-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcmutils-5.113.0.tar.xz";
+      sha256 = "1xbfzw2zfl966zp70jzfp3hjzn334zf4hnwr82priffafgrin57s";
+      name = "kcmutils-5.113.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcodecs-5.112.0.tar.xz";
-      sha256 = "0pnmqq5asj361x9fk1vapwssafbb2zxjr0nh8lp8666f675wg2yx";
-      name = "kcodecs-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcodecs-5.113.0.tar.xz";
+      sha256 = "1xvaq0yg4n4lwyq3yx2m8jrvfg7f0qrwgxxam4rmp2l245bvn34i";
+      name = "kcodecs-5.113.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcompletion-5.112.0.tar.xz";
-      sha256 = "1k09ahwgz1fipdc1l2k13r97hgyvwjsr5dlvhkbrd384sip84q8j";
-      name = "kcompletion-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcompletion-5.113.0.tar.xz";
+      sha256 = "016280h98j1ssvc3a4b3vyh4s93s9y9hn1jrpbfbkm9xxnvi7k79";
+      name = "kcompletion-5.113.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kconfig-5.112.0.tar.xz";
-      sha256 = "080qv53727ijdz9325kzl81nxchds3cpy6siv1h5s4scbb92dpl6";
-      name = "kconfig-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kconfig-5.113.0.tar.xz";
+      sha256 = "0fwhn3yp4gfwjiy5dx7gs0zd65yjlrrzkqpy7fpg7n97qf99q2a8";
+      name = "kconfig-5.113.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kconfigwidgets-5.112.0.tar.xz";
-      sha256 = "0yk84f9pwb600pligwa2022r9srz4fd7kkf90r7q7vmf5r3hl3r9";
-      name = "kconfigwidgets-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kconfigwidgets-5.113.0.tar.xz";
+      sha256 = "0bmk5qxiss7a71xpfsbqj831wkcf94b7wfbw9xisvnxlfmf60y4v";
+      name = "kconfigwidgets-5.113.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcontacts-5.112.0.tar.xz";
-      sha256 = "0q20xnj43ysq1wdymvl8j8zyvycsqs4hm2x72gz42hd9dlbp77s5";
-      name = "kcontacts-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcontacts-5.113.0.tar.xz";
+      sha256 = "1y9cdv1g2ypwl4b0hk1sxk7lvb5qkbm4n1gh62plqsran62jsimm";
+      name = "kcontacts-5.113.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcoreaddons-5.112.0.tar.xz";
-      sha256 = "032n4fl4d8lhgmd08f7nfa18izrccggxhdbgk33vnf1lw7c6yamp";
-      name = "kcoreaddons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcoreaddons-5.113.0.tar.xz";
+      sha256 = "1bhanzfjw2i49sx2hjnim8k72vvbs7gyig7nkqkgbaxzpa8qgwrf";
+      name = "kcoreaddons-5.113.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kcrash-5.112.0.tar.xz";
-      sha256 = "1sarh8ncibl8bz7pkd5xs4dd5vciyj82pckazxx4f482irdzyxzx";
-      name = "kcrash-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kcrash-5.113.0.tar.xz";
+      sha256 = "1mg90xm6ckcd30s07psn30sgh81lx8kfs0p1h6cblg4q8bkgkndv";
+      name = "kcrash-5.113.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdav-5.112.0.tar.xz";
-      sha256 = "1m6basdd6p0yaij9jdsc35sj198gsackk3dx4kci3a8zlvvag32g";
-      name = "kdav-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdav-5.113.0.tar.xz";
+      sha256 = "1djng9c741xairr84nvjbkq4dk551p7yk91g8d4nndy8s1kiz1dv";
+      name = "kdav-5.113.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdbusaddons-5.112.0.tar.xz";
-      sha256 = "0n04z0srf3xzd0m9sa9f3q7hrzbjrg1hbajzm89p71hfr7dmcgjq";
-      name = "kdbusaddons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdbusaddons-5.113.0.tar.xz";
+      sha256 = "101a406f8i0wgaxd0ilvfcb3plzjgvxw9bhhm5pin6fpr0xkjrnk";
+      name = "kdbusaddons-5.113.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdeclarative-5.112.0.tar.xz";
-      sha256 = "1wzhqp5mzbk9lz7ks4ggzb1k6c3fkxwwyzdapwfgn79k5qrhqvjk";
-      name = "kdeclarative-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdeclarative-5.113.0.tar.xz";
+      sha256 = "1wj9arkmjdrac04cq2w5bw5184jnlq5xn2cw6n7lajc31yrbc0rk";
+      name = "kdeclarative-5.113.0.tar.xz";
     };
   };
   kded = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kded-5.112.0.tar.xz";
-      sha256 = "16qiybj9q1v6j5csyx2f7pdpxih60psszyyvq9yj4ycdzjhjzmmn";
-      name = "kded-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kded-5.113.0.tar.xz";
+      sha256 = "1vb3z7r2l206n7p70a4cbkrm7fvyk7hqqf0bz7514r4g86l4l5n4";
+      name = "kded-5.113.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kdelibs4support-5.112.0.tar.xz";
-      sha256 = "0rrzqyawck0mmh8xfs73jx6jghv5bm1346h3xkhgw6ydfzdv3kcv";
-      name = "kdelibs4support-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kdelibs4support-5.113.0.tar.xz";
+      sha256 = "1z843zq1g5n3b8gb20y8266hyikvbzdsgc77gvcgzvqfdxk19l24";
+      name = "kdelibs4support-5.113.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kdesignerplugin-5.112.0.tar.xz";
-      sha256 = "0rrk7d06m1ywxf6n1crf510imidhfkpfb58qpaby2fzwb1ifmlyj";
-      name = "kdesignerplugin-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kdesignerplugin-5.113.0.tar.xz";
+      sha256 = "05hwq8rpm1f9ad5fyk2gjqxm6gvvx2gx2zdbklww9ghlh8qndl9i";
+      name = "kdesignerplugin-5.113.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdesu-5.112.0.tar.xz";
-      sha256 = "1yn16q3yrycrh6xsfh7faa5n9cr0lafiwh9dwr5p8rm62nmas83g";
-      name = "kdesu-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdesu-5.113.0.tar.xz";
+      sha256 = "085d3d6qpl4m7z8smm0bq9khfjjglpb1gd9n8q0d541127y2cpq4";
+      name = "kdesu-5.113.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kdewebkit-5.112.0.tar.xz";
-      sha256 = "11za35zxaa3mlvmrkp4rx47sl6ihbc1xgcaf18r6a0cyn4zhx2fz";
-      name = "kdewebkit-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kdewebkit-5.113.0.tar.xz";
+      sha256 = "18bmg88xj07h8y5f3f2ckjs9m61mf8jrxrg4vg8hrf4nabxz20xn";
+      name = "kdewebkit-5.113.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdnssd-5.112.0.tar.xz";
-      sha256 = "0cd1dm44f12n29d8idh29djhfd2z6lj4hc4l42hxx2nasi009p2s";
-      name = "kdnssd-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdnssd-5.113.0.tar.xz";
+      sha256 = "1hbb9zy1f13m45b6kzndxw619vnmx0s418brqgkdaxgsh12j5anq";
+      name = "kdnssd-5.113.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kdoctools-5.112.0.tar.xz";
-      sha256 = "1cinjrbg31pilzlir9vmigf86ypgpxr9mmyqpjfvq6yxvxfnq7li";
-      name = "kdoctools-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kdoctools-5.113.0.tar.xz";
+      sha256 = "0cfs4znhp7psrz99j3brp8q39gg0bpzvkrdx90zl6vvrc06d2zaa";
+      name = "kdoctools-5.113.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kemoticons-5.112.0.tar.xz";
-      sha256 = "037xj9i1x81npm7fyqizkyi7k4slakx1c5x9drp0py5133a0k6z8";
-      name = "kemoticons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kemoticons-5.113.0.tar.xz";
+      sha256 = "127frvsp1h9hg755vz2i609wxqqgzgsz15iqr7hcpbmmf6xvm8i2";
+      name = "kemoticons-5.113.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kfilemetadata-5.112.0.tar.xz";
-      sha256 = "1yvz3439jmg8m0ry9z0930ya679fahphb6s7mci23xf5zjpczgy4";
-      name = "kfilemetadata-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kfilemetadata-5.113.0.tar.xz";
+      sha256 = "1ap25y66y1r185fghvkkkkp4f6acnkazny8wxw5hv1gg25ilpsir";
+      name = "kfilemetadata-5.113.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kglobalaccel-5.112.0.tar.xz";
-      sha256 = "0flb0rkw5bh1xb706pgzsjq41slma4xwg3ghmvrdr622qf87w9hh";
-      name = "kglobalaccel-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kglobalaccel-5.113.0.tar.xz";
+      sha256 = "0ibm1wd7fhi3j5za0agyq2zrs9nx5a8b47iijkzgkpz9ylxniwrs";
+      name = "kglobalaccel-5.113.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kguiaddons-5.112.0.tar.xz";
-      sha256 = "0yw4ikb14f2q1z0hr64bxnxvg770jjllqfvhbnl5hn3m7l61psmb";
-      name = "kguiaddons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kguiaddons-5.113.0.tar.xz";
+      sha256 = "1ykhxgx89x1qv916pcz3j0q14ylalg9v23jjw0dbwpg5hlj4qlyc";
+      name = "kguiaddons-5.113.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kholidays-5.112.0.tar.xz";
-      sha256 = "1b5jdss17wvm66gwzh6qb0caz9b3fnr6cd902bvqa7dr1aby4j52";
-      name = "kholidays-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kholidays-5.113.0.tar.xz";
+      sha256 = "1wq397j3m3s9a45k9h5hsdsfansvb3a5q8biag2w3fsb1i84id0i";
+      name = "kholidays-5.113.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/khtml-5.112.0.tar.xz";
-      sha256 = "0rw6286w971q61gahm1qzic0gsfmfz8x449jw6zy38d9k17h7s2n";
-      name = "khtml-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/khtml-5.113.0.tar.xz";
+      sha256 = "0m284rwq8f49j71lcapzr4qi0f72a0adnv67mfg5blar867161mq";
+      name = "khtml-5.113.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/ki18n-5.112.0.tar.xz";
-      sha256 = "06wng9mpr2ln9dd1ayvwglc6071iqg5285jisg95vgf2c3kl5m9k";
-      name = "ki18n-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/ki18n-5.113.0.tar.xz";
+      sha256 = "0hl0qp3653xiwa5ndk82ygy2kgrc0pygqkknb1cx5w54s56bm57w";
+      name = "ki18n-5.113.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kiconthemes-5.112.0.tar.xz";
-      sha256 = "04nqw9a2c7bba5y7y741wqwm95jfpbva71q1fj43grd6hcqlff53";
-      name = "kiconthemes-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kiconthemes-5.113.0.tar.xz";
+      sha256 = "0q2c1s8pwl7dnx9v7q061zn5n1prk0vv0j77kki9wfncjaf15g0g";
+      name = "kiconthemes-5.113.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kidletime-5.112.0.tar.xz";
-      sha256 = "0pch2baf9867w6llk98mxag2y3sjz6irqci88rrsnwn4s1vcs356";
-      name = "kidletime-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kidletime-5.113.0.tar.xz";
+      sha256 = "1cdfhn3mcxvizba1gpf0viba3g0mnva3l226lkca3p9ps8c4z3rm";
+      name = "kidletime-5.113.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kimageformats-5.112.0.tar.xz";
-      sha256 = "1lw9vvmb032ymy0a1443q3p9nwn8shc9kbaz05jw4jwa74wp7i65";
-      name = "kimageformats-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kimageformats-5.113.0.tar.xz";
+      sha256 = "0gys83sazgbj7h3yiaacqr464z951ixygrhzcw16cnqjm8phic44";
+      name = "kimageformats-5.113.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kinit-5.112.0.tar.xz";
-      sha256 = "1mij6nw1w0zyv724096pfbb0r95300yqb884bx3wlm5nibawwpz7";
-      name = "kinit-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kinit-5.113.0.tar.xz";
+      sha256 = "1ydmgxyr5j9zi0a5vlb64kkjxka3rsyvzj10y3dww92qyapnn2bv";
+      name = "kinit-5.113.0.tar.xz";
     };
   };
   kio = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kio-5.112.0.tar.xz";
-      sha256 = "16gv0f8l4jn19mrwc52c6gw2n8hb28n6v7x6kx7qbs3z0wf57f44";
-      name = "kio-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kio-5.113.0.tar.xz";
+      sha256 = "1bjmv3wdpmzqbv1xzzl0ydirccbknnjyqn6wzb057zgy7kpi1cd8";
+      name = "kio-5.113.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kirigami2-5.112.0.tar.xz";
-      sha256 = "048f3sji3dx7q415fkmkj0xmnl0dxacdr9d08d5rqkxz2d94hzk3";
-      name = "kirigami2-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kirigami2-5.113.0.tar.xz";
+      sha256 = "0zy3s841q2xw4d048a3qh4cfh9kb3qaqxml4ny5zi73crm173h8y";
+      name = "kirigami2-5.113.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kitemmodels-5.112.0.tar.xz";
-      sha256 = "130avvp4lq8f8pag39mna0p3rjyvhbq6akng9d4l01nf8287zv2s";
-      name = "kitemmodels-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kitemmodels-5.113.0.tar.xz";
+      sha256 = "01i1s7rw7ndp3gnl3bg0pv8a9qz95rmz0jxkw97p72gcah2q2yvk";
+      name = "kitemmodels-5.113.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kitemviews-5.112.0.tar.xz";
-      sha256 = "1xpk5xfrp38bjgsyvc3wmcq7vj1sa2wxz0wld2bby3nsixbrdq68";
-      name = "kitemviews-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kitemviews-5.113.0.tar.xz";
+      sha256 = "0wnmgm72kv7vxadsrkdbnjknb4lkzrmn6gk7car7jx2i91kz7xdd";
+      name = "kitemviews-5.113.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kjobwidgets-5.112.0.tar.xz";
-      sha256 = "1x1ip1c1v7mydvrz620gaajx6c1p88vlbi3i66fdfnxvhkcrqzqv";
-      name = "kjobwidgets-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kjobwidgets-5.113.0.tar.xz";
+      sha256 = "0f5shrapjvwp8bc34vypzfsfl07pj7nmdflf9lcwc8h3kwf2rxqr";
+      name = "kjobwidgets-5.113.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kjs-5.112.0.tar.xz";
-      sha256 = "00nr7darrijxm7czvjwvs4jrw8yd8ypz49l4xym19fvslcb5d0x9";
-      name = "kjs-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kjs-5.113.0.tar.xz";
+      sha256 = "0h50jyd9mddnavafikn9haqqcq1mql2v8qcc1c233ffplkx1f6hb";
+      name = "kjs-5.113.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kjsembed-5.112.0.tar.xz";
-      sha256 = "0hs6ka5qj1w3kha6rssvvpw6dh4pw001wfpfjzn8klawjwndjv1r";
-      name = "kjsembed-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kjsembed-5.113.0.tar.xz";
+      sha256 = "0bwsj0n3d038vs3n2mw6x8srbg4da40bw59q14cpv70ws1sg2r2n";
+      name = "kjsembed-5.113.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kmediaplayer-5.112.0.tar.xz";
-      sha256 = "1bdanmrbzyh6hbpkflq7gwrjm03647pbbiv670li0cmyfmnz904r";
-      name = "kmediaplayer-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kmediaplayer-5.113.0.tar.xz";
+      sha256 = "1nyn7x28j17yrb7zx31519h2ghp5h3pwk6baxais0q1mv9azyfay";
+      name = "kmediaplayer-5.113.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/knewstuff-5.112.0.tar.xz";
-      sha256 = "1l417xsqpwxv73wm0fdgjpfnvs19casm1x2xsl299pj66kcm1y7l";
-      name = "knewstuff-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/knewstuff-5.113.0.tar.xz";
+      sha256 = "0fj17rxyp9wmmc9jh8zjpgwpia9r4xlvabvkb4ynd1vhy58k8w51";
+      name = "knewstuff-5.113.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/knotifications-5.112.0.tar.xz";
-      sha256 = "1xlx91rn826gw3mqddvfs884mx95rhksf70wc1m5jd49cdcgw1mz";
-      name = "knotifications-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/knotifications-5.113.0.tar.xz";
+      sha256 = "1yzpf12wsi3h3v7z68b42rjdrnfkah6avq4y611b0r004shgkl1x";
+      name = "knotifications-5.113.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/knotifyconfig-5.112.0.tar.xz";
-      sha256 = "18qikgc5lp5xjmar823j0cgwqpgc8b5sr8rq1x2p23pbb9ywfpqj";
-      name = "knotifyconfig-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/knotifyconfig-5.113.0.tar.xz";
+      sha256 = "1gdzyxcc371lmnzc153k8wdyxgsv7r2y44j8d5srld36amssxnc6";
+      name = "knotifyconfig-5.113.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kpackage-5.112.0.tar.xz";
-      sha256 = "0g84q54yhm9a1h48pim371rjbl208ka56a6xx23zqis20wqjs0kp";
-      name = "kpackage-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kpackage-5.113.0.tar.xz";
+      sha256 = "04605kr2w0yhwx64lqq1qc1zmmip7vkxnxv3fs2846864814fkk2";
+      name = "kpackage-5.113.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kparts-5.112.0.tar.xz";
-      sha256 = "0mr45zk4i7jfazkawi7i2ry88y9a17wsny4ck0zln3ggb6wra32c";
-      name = "kparts-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kparts-5.113.0.tar.xz";
+      sha256 = "0mx95xrr6pad4q5p0sn2iqmc59787bpfkvkyiz9li56wynh1jf48";
+      name = "kparts-5.113.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kpeople-5.112.0.tar.xz";
-      sha256 = "0xfczzy2pwdszzzmyj8ldr1178d93za26j0rqbj3wnqsnji9yn6n";
-      name = "kpeople-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kpeople-5.113.0.tar.xz";
+      sha256 = "08g44hq1iywycf44imdqkql4gx2vyg87n1nxxqq6ssva0kybia7n";
+      name = "kpeople-5.113.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kplotting-5.112.0.tar.xz";
-      sha256 = "0a18ly62ilsmaihm398q1jvj10ccw00di3rywq0wq45n0ghnx7zx";
-      name = "kplotting-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kplotting-5.113.0.tar.xz";
+      sha256 = "16pfia711y9iqnl0svyg00g7a2x4ln8yaxmrmy74xj7y0dj5jcyj";
+      name = "kplotting-5.113.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kpty-5.112.0.tar.xz";
-      sha256 = "1p6rm94hvq6w54h84vhcqbbnj2gmypipj05vx7c9bnijy0d4nfxf";
-      name = "kpty-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kpty-5.113.0.tar.xz";
+      sha256 = "0hzn18lidiiaxr08fjhk0r5zh0m01ls46w1fyjnv42bvf7vd7v5y";
+      name = "kpty-5.113.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kquickcharts-5.112.0.tar.xz";
-      sha256 = "1c634jda7lqmv009jg2jdarkd08q1hf4fb3wnj35hilj37c57b5a";
-      name = "kquickcharts-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kquickcharts-5.113.0.tar.xz";
+      sha256 = "0v47c6mdx72rdz441zk4csc6a2bj6wi7772vlpz2yr3ay70l8f5d";
+      name = "kquickcharts-5.113.0.tar.xz";
     };
   };
   kross = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kross-5.112.0.tar.xz";
-      sha256 = "1b887bx4d3nr55305mk91wnm6bfhbgnqjmbc3a9jkv65c78j9hsa";
-      name = "kross-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kross-5.113.0.tar.xz";
+      sha256 = "1cqdcm086a4kjrb9k6cwqn05fg5ij3zppc8bi7dxrgrfxc494c8s";
+      name = "kross-5.113.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/krunner-5.112.0.tar.xz";
-      sha256 = "00bfszbpr2w21nz3vhih8hp0f9gzn1906axvib3jm1w3kjmy2avn";
-      name = "krunner-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/krunner-5.113.0.tar.xz";
+      sha256 = "0z7d6nyvrlgr7aw9ibz1xgp62220iwzvhqpqikwlxhc9hjggmdlh";
+      name = "krunner-5.113.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kservice-5.112.0.tar.xz";
-      sha256 = "01aj0yrlxlwr5sm1z0pq6caa4ijj3nsgqhza1zr4mzrx2ybf753z";
-      name = "kservice-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kservice-5.113.0.tar.xz";
+      sha256 = "09ph72jb40pkw1nzayvzzav4m6240amkj6jvx390dmsvr7jzn0nb";
+      name = "kservice-5.113.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/ktexteditor-5.112.0.tar.xz";
-      sha256 = "0d0cw9qd7mmnhdqayx4lcpd60hp1al5zwy565rsvxmjly564l3i9";
-      name = "ktexteditor-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/ktexteditor-5.113.0.tar.xz";
+      sha256 = "02nclhfgqximsl8w6la5w0fshzcj71nrz5kjb2p1s28xdf1ahvgg";
+      name = "ktexteditor-5.113.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/ktextwidgets-5.112.0.tar.xz";
-      sha256 = "0x83f0ih3c25yggmvyibyfaiikk4zc0k5gf6yr87c62ihgv7gniz";
-      name = "ktextwidgets-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/ktextwidgets-5.113.0.tar.xz";
+      sha256 = "060grfna4kj8nhxgk38yf3csqfgxg0358dkwmg8aw5y5k0jys2az";
+      name = "ktextwidgets-5.113.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kunitconversion-5.112.0.tar.xz";
-      sha256 = "1zi47yd3aydy2mcmgfgwp4g12w7681lyc1niq5p13670mxhlkrwc";
-      name = "kunitconversion-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kunitconversion-5.113.0.tar.xz";
+      sha256 = "1x7gwrz43wvd3r87x545bxxyzhqj87mhhx05dqh0b09vqk6gxzza";
+      name = "kunitconversion-5.113.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kwallet-5.112.0.tar.xz";
-      sha256 = "1v38wyz9hhhvzwrpxsjkd8yqyy4yv9hii1413ffcm9x971nliq2s";
-      name = "kwallet-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kwallet-5.113.0.tar.xz";
+      sha256 = "0aq8d5c5p9j19bzspd205gh297n7fh5f26m49826fx5mp1im4lwn";
+      name = "kwallet-5.113.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kwayland-5.112.0.tar.xz";
-      sha256 = "0nzpg4x9hg9jd1kg6sq0lh658kz3cz25z5kji7hpq2h0svmxx709";
-      name = "kwayland-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kwayland-5.113.0.tar.xz";
+      sha256 = "1anhvz4b1q835py451jznnfj9z2jh1fwnx4lfwhi67viaplpiwqg";
+      name = "kwayland-5.113.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kwidgetsaddons-5.112.0.tar.xz";
-      sha256 = "0x5mz04dwlpl0h75v0c5w04qjpcb3fbpjk7hbslwgfwr7gviqyib";
-      name = "kwidgetsaddons-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kwidgetsaddons-5.113.0.tar.xz";
+      sha256 = "01rabfl2v5l9r3fgwgy75krib1486mdc4k3kfi035s6dvg8iy015";
+      name = "kwidgetsaddons-5.113.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kwindowsystem-5.112.0.tar.xz";
-      sha256 = "08ihg6zq979h4v6c157n80pi3cfsg9w9qiyqaw3h79365zji73j1";
-      name = "kwindowsystem-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kwindowsystem-5.113.0.tar.xz";
+      sha256 = "1hzavawsl14rsl9qb874zahvsvkrbcin7fg1xn1d7ssypphlis51";
+      name = "kwindowsystem-5.113.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/kxmlgui-5.112.0.tar.xz";
-      sha256 = "17jsqzxn5wgwsm3lrfgdygyzvqibzv9vfgg11s2gc5bq9x4s0j8g";
-      name = "kxmlgui-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/kxmlgui-5.113.0.tar.xz";
+      sha256 = "022l557z9jgrz2hj8hh9z7cjkvfhl5rdp81jhk2gd3wzmyf5zzmq";
+      name = "kxmlgui-5.113.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/portingAids/kxmlrpcclient-5.112.0.tar.xz";
-      sha256 = "09zwgrh336bk5cfab2zcdzcfdzjvlqa47ljfrciyh4h8m5f7y12h";
-      name = "kxmlrpcclient-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/portingAids/kxmlrpcclient-5.113.0.tar.xz";
+      sha256 = "141vlxxnyll5q0wg2va5prg0wf0hpymlzfkg37h1ngjwjs2x2yc1";
+      name = "kxmlrpcclient-5.113.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/modemmanager-qt-5.112.0.tar.xz";
-      sha256 = "0323zp03wj4ignfc94qg89h3j4qmh3mkdac5snr1axjaaf6sk6w8";
-      name = "modemmanager-qt-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/modemmanager-qt-5.113.0.tar.xz";
+      sha256 = "069irg7ckws06qzq5mwkxvzx4r2xqwagwif6dq284hjihrz38l8b";
+      name = "modemmanager-qt-5.113.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/networkmanager-qt-5.112.0.tar.xz";
-      sha256 = "1larg78j7rlbbscv04imc1k6f1srapr2yrbyxif38d4iipfg04f9";
-      name = "networkmanager-qt-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/networkmanager-qt-5.113.0.tar.xz";
+      sha256 = "03wdbw6dr9a49qcs1j2lm9q894rvdl8xqjpwm3yrrjb866yyhcg1";
+      name = "networkmanager-qt-5.113.0.tar.xz";
     };
   };
-  oxygen-icons5 = {
-    version = "5.112.0";
+  oxygen-icons = {
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/oxygen-icons5-5.112.0.tar.xz";
-      sha256 = "0yw2mixy5p8pw9866rfr0wcjhvilznakd0h6934svv0dk3lv054a";
-      name = "oxygen-icons5-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/oxygen-icons-5.113.0.tar.xz";
+      sha256 = "0grdn0gz59lfp4n5mmlan71x3iwgm87dnhk8mla02dn7hv0fl0xx";
+      name = "oxygen-icons-5.113.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/plasma-framework-5.112.0.tar.xz";
-      sha256 = "0nq8dzqk1hxzm8yngzgm9zqw8155fy38zq6k3613af5mgj7jmdhj";
-      name = "plasma-framework-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/plasma-framework-5.113.0.tar.xz";
+      sha256 = "0iijawnh9ri1n6qgdrraf3lq5sy7z0jy5ihmfzk22pn10ba992ky";
+      name = "plasma-framework-5.113.0.tar.xz";
     };
   };
   prison = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/prison-5.112.0.tar.xz";
-      sha256 = "1blgs0k4kz3smsf0qb9y6krzbssyv1hbqvjc7qvk4qwk81qhyfvq";
-      name = "prison-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/prison-5.113.0.tar.xz";
+      sha256 = "18y4gxj5zml59a8i7gzr5cbbzi5wyknbva2ihfdpqf85vw3x2wdp";
+      name = "prison-5.113.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/purpose-5.112.0.tar.xz";
-      sha256 = "1cqcmhbb26xypllmk3z4r0z8sw79idzz6nz72ahwa4ha0pqbl8p3";
-      name = "purpose-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/purpose-5.113.0.tar.xz";
+      sha256 = "0p5zcvrkaw71w8795x2a4lx3z977j6jcnwbi9wi1956gcx4avhhf";
+      name = "purpose-5.113.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/qqc2-desktop-style-5.112.0.tar.xz";
-      sha256 = "1k74vwj07xf3fjfj8ff9zx5ndzq5m3bdnj4zgymkxm1gk3r6gl5y";
-      name = "qqc2-desktop-style-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/qqc2-desktop-style-5.113.0.tar.xz";
+      sha256 = "0sk0sk7cq511m0rjmgsg1z8s4sy064qmbql472ljyblafm71wj6p";
+      name = "qqc2-desktop-style-5.113.0.tar.xz";
     };
   };
   solid = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/solid-5.112.0.tar.xz";
-      sha256 = "0hpm5akhk24fzbg27p6ql598s5mxa6n8h359ajf45afabimhjx0y";
-      name = "solid-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/solid-5.113.0.tar.xz";
+      sha256 = "0vhhkn15axfvlwrf9np91hnipw1lb2x9zh0ajpngvxzcnj6kvn7r";
+      name = "solid-5.113.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/sonnet-5.112.0.tar.xz";
-      sha256 = "026iivz27d7v4kpwkl6qwbcqnd71kvg77szy91fch37iki7z6361";
-      name = "sonnet-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/sonnet-5.113.0.tar.xz";
+      sha256 = "17v3a2j0vhx7mzv0wfgqky248m57gasyv1xbjqpzjdr3x2f1zhy6";
+      name = "sonnet-5.113.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/syndication-5.112.0.tar.xz";
-      sha256 = "03if949klq28kaf3xzcva917fqv7cn6pzjwsgymya3nc730kfsc8";
-      name = "syndication-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/syndication-5.113.0.tar.xz";
+      sha256 = "1nzcfk4qsjvrgci3vk78jjpbig61pm0y73h3qs83yld1zw3az3jx";
+      name = "syndication-5.113.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/syntax-highlighting-5.112.0.tar.xz";
-      sha256 = "1m88nfmf4kxliqkgm78f95yvsjv76xm2rmg92v9mg00r9d00y95h";
-      name = "syntax-highlighting-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/syntax-highlighting-5.113.0.tar.xz";
+      sha256 = "1blifnqikvrlkcskwjdk54mvh8yd4r0vzz282mi64w7alimlilgl";
+      name = "syntax-highlighting-5.113.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.112.0";
+    version = "5.113.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.112/threadweaver-5.112.0.tar.xz";
-      sha256 = "1i3qj6qf0sv5pf8d5wx6gy11dqyp4x4b4759gwbhlrizkm4fa7f9";
-      name = "threadweaver-5.112.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.113/threadweaver-5.113.0.tar.xz";
+      sha256 = "1x7i7mdg5v22y04m720k9fqj7xagm8qnlssb1xjs9nj0aqif8jgp";
+      name = "threadweaver-5.113.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/kdsoap/default.nix b/pkgs/development/libraries/kdsoap/default.nix
index 80eb6d683207..c2f94b8e6927 100644
--- a/pkgs/development/libraries/kdsoap/default.nix
+++ b/pkgs/development/libraries/kdsoap/default.nix
@@ -1,11 +1,15 @@
-{ mkDerivation
+{ stdenv
 , lib
 , fetchurl
 , cmake
 , qtbase
+, wrapQtAppsHook
 }:
 
-mkDerivation rec {
+let
+  isQt6 = lib.versions.major qtbase.version == "6";
+  cmakeName = if isQt6 then "KDSoap-qt6" else "KDSoap";
+in stdenv.mkDerivation rec {
   pname = "kdsoap";
   version = "2.1.1";
 
@@ -16,15 +20,17 @@ mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
 
   buildInputs = [ qtbase ];
 
+  cmakeFlags = [ (lib.cmakeBool "KDSoap_QT6" isQt6) ];
+
   postInstall = ''
-    moveToOutput bin/kdwsdl2cpp "$dev"
-    sed -i "$out/lib/cmake/KDSoap/KDSoapTargets.cmake" \
+    moveToOutput bin/kdwsdl2cpp* "$dev"
+    sed -i "$out/lib/cmake/${cmakeName}/KDSoapTargets.cmake" \
         -e "/^  INTERFACE_INCLUDE_DIRECTORIES/ c   INTERFACE_INCLUDE_DIRECTORIES \"$dev/include\""
-    sed -i "$out/lib/cmake/KDSoap/KDSoapTargets-release.cmake" \
+    sed -i "$out/lib/cmake/${cmakeName}/KDSoapTargets-release.cmake" \
         -e "s@$out/bin@$dev/bin@"
   '';
 
diff --git a/pkgs/development/libraries/kquickimageedit/default.nix b/pkgs/development/libraries/kquickimageedit/default.nix
index 7b81d8ca7c63..cd43904a123e 100644
--- a/pkgs/development/libraries/kquickimageedit/default.nix
+++ b/pkgs/development/libraries/kquickimageedit/default.nix
@@ -1,10 +1,12 @@
 { lib
-, mkDerivation
+, stdenv
 , fetchFromGitLab
 , extra-cmake-modules
+, qtbase
+, qtdeclarative
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "kquickimageeditor";
   version = "0.3.0";
 
@@ -17,6 +19,9 @@ mkDerivation rec {
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [ qtbase qtdeclarative ];
+  cmakeFlags = ["-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}"];
+  dontWrapQtApps = true;
 
   meta = with lib; {
     description = "Set of QtQuick components providing basic image editing capabilities";
diff --git a/pkgs/development/libraries/lcms2/default.nix b/pkgs/development/libraries/lcms2/default.nix
index e1f6c3d2212c..ab984884073a 100644
--- a/pkgs/development/libraries/lcms2/default.nix
+++ b/pkgs/development/libraries/lcms2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.15";
+  version = "2.16";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/${pname}-${version}.tar.gz";
-    sha256 = "sha256-sgy8vQ9QNDO+Kk6BRiEG+mEFCjUHTcJKTjVnktlxqzk=";
+    hash = "sha256-2HPTSti5tM6gEGMfGmIo0gh0deTcXnY+uBrMI9nUWlE=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/libao/default.nix b/pkgs/development/libraries/libao/default.nix
index 4a07ba9da7d8..63cb0401aae4 100644
--- a/pkgs/development/libraries/libao/default.nix
+++ b/pkgs/development/libraries/libao/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, autoreconfHook, pkg-config, libpulseaudio, alsa-lib, libcap
+{ stdenv, lib, fetchFromGitHub, fetchpatch
+, autoreconfHook, pkg-config, libpulseaudio, alsa-lib, libcap
 , CoreAudio, CoreServices, AudioUnit
 , usePulseAudio }:
 
@@ -14,6 +15,15 @@ stdenv.mkDerivation rec {
     sha256 = "0svgk4sc9kdhcsfyvbvgm5vpbg3sfr6z5rliflrw49v3x2i4vxq5";
   };
 
+  patches = [
+    # add header time.h for nanosecond
+    (fetchpatch {
+      name = "nanosecond-header.patch";
+      url = "https://github.com/xiph/libao/commit/1f998f5d6d77674dad01b181811638578ad68242.patch";
+      hash = "sha256-cvlyhQq1YS4pVya44LfsKD1R6iSOONsHJGRbP5LlanQ=";
+    })
+  ];
+
   configureFlags = [
     "--disable-broken-oss"
     "--enable-alsa-mmap"
diff --git a/pkgs/development/libraries/libaom/default.nix b/pkgs/development/libraries/libaom/default.nix
index 826dc544a88f..78aac8754787 100644
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -9,11 +9,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.7.1";
+  version = "3.8.0";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    hash = "sha256-v2SBiDE4zZe3LMrlo/tP9GzmG/PJZ42rKi1svKJR6ZA=";
+    hash = "sha256-JxMz+XnjmUvk8TlTqdU2HP1Gq3bXfcLkXp5AEv9+7hM=";
     stripRoot = false;
   };
 
diff --git a/pkgs/development/libraries/libaom/outputs.patch b/pkgs/development/libraries/libaom/outputs.patch
index bbf660aaa5c9..7b34338403f2 100644
--- a/pkgs/development/libraries/libaom/outputs.patch
+++ b/pkgs/development/libraries/libaom/outputs.patch
@@ -43,7 +43,7 @@ index e8fff2e77..b8a73aad4 100644
 -                  "CMAKE_INSTALL_LIBDIR" "CMAKE_PROJECT_NAME"
 +                  "CMAKE_INSTALL_BINDIR" "CMAKE_INSTALL_FULL_INCLUDEDIR"
 +                  "CMAKE_INSTALL_FULL_LIBDIR" "CMAKE_PROJECT_NAME"
-                   "CONFIG_MULTITHREAD" "HAVE_PTHREAD_H")
+                   "CONFIG_MULTITHREAD")
  
  foreach(arg ${REQUIRED_ARGS})
 @@ -35,15 +35,15 @@ else()
diff --git a/pkgs/development/libraries/libavif/default.nix b/pkgs/development/libraries/libavif/default.nix
index 02e069a35290..2cb7920cb5f9 100644
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@@ -19,13 +19,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libavif";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "AOMediaCodec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ku0UgVBba1tHBzHjx5yf9hRAtbmXf2n4gEdAaGr3qTY=";
+    hash = "sha256-0MLr9wdIs3c4pOAF4rlC8QNQXlrK3YGXILS9foVKfVM=";
   };
 
   # reco: encode libaom slowest but best, decode dav1d fastest
diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix
index de366da98b96..6259fa5b4839 100644
--- a/pkgs/development/libraries/libde265/default.nix
+++ b/pkgs/development/libraries/libde265/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, autoreconfHook
+, cmake
 , pkg-config
 
 , callPackage
@@ -14,17 +14,17 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: rec {
-  version = "1.0.14";
+  version = "1.0.15";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aZRtF4wYWxi/6ORNu7yVxFFdkvJTvBwPinL5lC0Mlqg=";
+    hash = "sha256-guiLM4RNe5O0qpeCoQUbs1Z7j0wp8iK9za2+6NIB8yY=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index a7ead8f22747..5cb8f2cbad8e 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.118";
+  version = "2.4.119";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-p3e9hfK1/JxX+IbIIFgwBXgxfK/bx30Kdp1+mpVnq4g=";
+    hash = "sha256-CknxLwm1tuaOqq/z8Cynz/mqkmk5shLTQxYdPorFYpE=";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/libe57format/default.nix b/pkgs/development/libraries/libe57format/default.nix
index fe5558681fff..cbbdd4dcc026 100644
--- a/pkgs/development/libraries/libe57format/default.nix
+++ b/pkgs/development/libraries/libe57format/default.nix
@@ -26,6 +26,10 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-4vVhKrCxnWO106DSAk+xxo4uk6zC89m9VQAPaDJ8Ed4=";
     })
   ];
+  CXXFLAGS = [
+    # GCC 13: error: 'int16_t' has not been declared in 'std'
+    "-include cstdint"
+  ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/libraries/libei/default.nix b/pkgs/development/libraries/libei/default.nix
index b216cd231c22..3b687fcd8edc 100644
--- a/pkgs/development/libraries/libei/default.nix
+++ b/pkgs/development/libraries/libei/default.nix
@@ -11,7 +11,6 @@
 , protobuf
 , protobufc
 , python3
-, python3Packages
 , systemd
 }:
 let
@@ -42,19 +41,18 @@ stdenv.mkDerivation rec {
     systemd
   ];
   nativeBuildInputs = [
-    attr
     meson
     ninja
     pkg-config
-    python3
-  ] ++
-  (with python3Packages; [
-    jinja2
-    pytest
-    python-dbusmock
-    strenum
-    structlog
-  ]);
+    (python3.withPackages(ps: with ps; [
+      attrs
+      jinja2
+      pytest
+      python-dbusmock
+      strenum
+      structlog
+    ]))
+  ];
 
   postPatch = ''
     ln -s "${munit}" ./subprojects/munit
diff --git a/pkgs/development/libraries/libelf/default.nix b/pkgs/development/libraries/libelf/default.nix
index 0a1a7175296e..fdfa4fda0def 100644
--- a/pkgs/development/libraries/libelf/default.nix
+++ b/pkgs/development/libraries/libelf/default.nix
@@ -2,11 +2,6 @@
 , fetchurl, autoreconfHook, gettext, freebsd, netbsd
 }:
 
-# Note: this package is used for bootstrapping fetchurl, and thus
-# cannot use fetchpatch! All mutable patches (generated by GitHub or
-# cgit) that are needed here should be included directly in Nixpkgs as
-# files.
-
 stdenv.mkDerivation rec {
   pname = "libelf";
   version = "0.8.13";
@@ -52,18 +47,10 @@ stdenv.mkDerivation rec {
     (if stdenv.hostPlatform.isFreeBSD then [ freebsd.gencat ]
      else if stdenv.hostPlatform.isNetBSD then [ netbsd.gencat ]
      else [ gettext ])
-       # Need to regenerate configure script with newer version in order to pass
-       # "mr_cv_target_elf=yes" and determine integer sizes correctly when
-       # cross-compiling, but `autoreconfHook` brings in `makeWrapper` which
-       # doesn't work with the bootstrapTools bash, so can only do this for
-       # cross builds when `stdenv.shell` is a newer bash.
-    ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform
        # The provided `configure` script fails on clang 16 because some tests have a `main`
        # returning an implicit `int`, which clang 16 treats as an error. Running `autoreconf` fixes
        # the test and allows `configure` to detect clang properly.
-       # This is done only for clang on Darwin because the Darwin stdenv bootstrap does not use
-       # libelf, so should be safe because it will always be run with a compatible version of bash.
-       || (stdenv.cc.isClang && stdenv.isDarwin)) autoreconfHook;
+    ++ [ autoreconfHook ];
 
   meta = {
     description = "ELF object file access library";
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 28cee5c7dfd6..3605d48a2fd1 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation rec {
         -e 's/NOEXECSTACK_FLAGS=$/NOEXECSTACK_FLAGS="-Wa,--noexecstack"/'
   '';
 
+  enableParallelBuilding = true;
+
   # Make sure libraries are correct for .pc and .la files
   # Also make sure includes are fixed for callers who don't use libgpgcrypt-config
   postFixup = ''
@@ -66,6 +68,7 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = true;
+  enableParallelChecking = true;
 
   passthru.tests = {
     inherit gnupg libotr rsyslog;
diff --git a/pkgs/development/libraries/libgnome-games-support/default.nix b/pkgs/development/libraries/libgnome-games-support/default.nix
index edfd21a46968..e63d7f8fe656 100644
--- a/pkgs/development/libraries/libgnome-games-support/default.nix
+++ b/pkgs/development/libraries/libgnome-games-support/default.nix
@@ -2,7 +2,6 @@
 , fetchurl
 , pkg-config
 , glib
-, gobject-introspection
 , gtk3
 , libgee
 , gettext
@@ -24,7 +23,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     gettext
-    gobject-introspection
     meson
     ninja
     pkg-config
diff --git a/pkgs/development/libraries/libimobiledevice/default.nix b/pkgs/development/libraries/libimobiledevice/default.nix
index 000649100313..a229bb1fef08 100644
--- a/pkgs/development/libraries/libimobiledevice/default.nix
+++ b/pkgs/development/libraries/libimobiledevice/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , openssl
@@ -26,6 +27,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-mIsB+EaGJlGMOpz3OLrs0nAmhOY1BwMs83saFBaejwc=";
   };
 
+  patches = [
+    # Pull upstream fix for clang-16 and upcoming gcc-14 support:
+    #   https://github.com/libimobiledevice/libimobiledevice/pull/1444
+    (fetchpatch {
+      name = "usleep-decl.patch";
+      url = "https://github.com/libimobiledevice/libimobiledevice/commit/db623184c0aa09c27697f5a2e81025db223075d5.patch";
+      hash = "sha256-TgdgBkEDXzQDSgJxcZc+pZncfmBVXarhHOByGFs6p0Q=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/development/libraries/libjodycode/default.nix b/pkgs/development/libraries/libjodycode/default.nix
new file mode 100644
index 000000000000..2a99ed5feca3
--- /dev/null
+++ b/pkgs/development/libraries/libjodycode/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, stdenv
+, fetchFromGitea
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libjodycode";
+  version = "3.1";
+
+  outputs = [ "out" "man" "dev" ];
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "jbruchon";
+    repo = "libjodycode";
+    rev = "v${version}";
+    hash = "sha256-uhWQh5YwLwYRm34nY5HvcEepqlTSDt9s3PSoD403kQM=";
+  };
+
+  env.PREFIX = placeholder "out";
+
+  meta = with lib; {
+    description = "Shared code used by several utilities written by Jody Bruchon";
+    homepage = "https://github.com/jbruchon/libjodycode";
+    changelog = "https://github.com/jbruchon/libjodycode/blob/${src.rev}/CHANGES.txt";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 9be574e9eaa0..820f466d8447 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -117,7 +117,6 @@ stdenv.mkDerivation rec {
     "-DJPEGXL_FORCE_NEON=ON"
   ];
 
-  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
   CXXFLAGS = lib.optionalString stdenv.hostPlatform.isAarch32 "-mfp16-format=ieee";
 
   # FIXME x86_64-darwin:
diff --git a/pkgs/development/libraries/liblangtag/default.nix b/pkgs/development/libraries/liblangtag/default.nix
index efd914ca7b10..0988bb9259d7 100644
--- a/pkgs/development/libraries/liblangtag/default.nix
+++ b/pkgs/development/libraries/liblangtag/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, autoreconfHook, gtk-doc, gettext
+{ lib, stdenv, fetchurl, fetchpatch, autoreconfHook, gtk-doc, gettext
 , pkg-config, glib, libxml2, gobject-introspection, gnome-common, unzip
 }:
 
@@ -23,6 +23,20 @@ stdenv.mkDerivation rec {
     sha256 = "0y9x5gra6jri4sk16f0dp69p06almnsl48rs85605f035kf539qm";
   };
 
+  patches = [
+    # Pull upstream fix for gcc-13 build compatibility
+    (fetchpatch {
+      name = "gcc-13-p1.patch";
+      url = "https://bitbucket.org/tagoh/liblangtag/commits/0b6e9f4616a34146e7443c4e9a7197153645e40b/raw";
+      hash = "sha256-69wJDVwDCP5OPHKoRn9WZNrvfCvmlX3SwtRmcpJHn2o=";
+    })
+    (fetchpatch {
+      name = "gcc-13-p1.patch";
+      url = "https://bitbucket.org/tagoh/liblangtag/commits/1497c4477d0fa0b7df1886951b953dd3cea54427/raw";
+      hash = "sha256-k0Uaeg6YLxVze4fgf0kiyuiZJ5wh2Jq3h7cFPQPtwyo=";
+    })
+  ];
+
   postPatch = ''
     gtkdocize
     cp "${core_zip}" data/core.zip
diff --git a/pkgs/development/libraries/libmusicbrainz/5.x.nix b/pkgs/development/libraries/libmusicbrainz/5.x.nix
index 3e7a2f1a0ba0..14a6cc16c837 100644
--- a/pkgs/development/libraries/libmusicbrainz/5.x.nix
+++ b/pkgs/development/libraries/libmusicbrainz/5.x.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, neon, libdiscid, libxml2, pkg-config }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, neon, libdiscid, libxml2, pkg-config }:
 
 stdenv.mkDerivation rec {
   version = "5.1.0";
@@ -14,6 +14,18 @@ stdenv.mkDerivation rec {
     rev    = "release-${version}";
   };
 
+  patches = [
+    # Fix build with libxml2 2.12
+    (fetchpatch {
+      url = "https://github.com/metabrainz/libmusicbrainz/commit/9ba00067a15479a52262a5126bcb6889da5884b7.patch";
+      hash = "sha256-4VxTohLpjUNnNZGIoRpBjUz71mLP3blg4oFL7itnJnY=";
+    })
+    (fetchpatch {
+      url = "https://github.com/metabrainz/libmusicbrainz/commit/558c9ba0e6d702d5c877f75be98176f57abf1b02.patch";
+      hash = "sha256-hKYY4BJLh/Real3NugLwzc4gPBQ3NB/F63iI/aV8Wh8=";
+    })
+  ];
+
   dontUseCmakeBuildDir=true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libosinfo/default.nix b/pkgs/development/libraries/libosinfo/default.nix
index 3fe89f891f8c..498f26a7caf0 100644
--- a/pkgs/development/libraries/libosinfo/default.nix
+++ b/pkgs/development/libraries/libosinfo/default.nix
@@ -61,6 +61,12 @@ stdenv.mkDerivation rec {
       src = ./osinfo-db-data-dir.patch;
       osinfo_db_data_dir = "${osinfo-db}/share";
     })
+
+    # Fix build with libxml 2.12
+    (fetchpatch {
+      url = "https://gitlab.com/libosinfo/libosinfo/-/commit/5bbdd06503456784c5ffa22409e8bab50470d673.patch";
+      hash = "sha256-KqgHXI+lD5VYp2wtA58Drp15TgNK1O3xCaYBy4/B9wc=";
+    })
   ];
 
   mesonFlags = [
diff --git a/pkgs/development/libraries/libqaccessibilityclient/default.nix b/pkgs/development/libraries/libqaccessibilityclient/default.nix
index 1977a62f5c09..e05400114d06 100644
--- a/pkgs/development/libraries/libqaccessibilityclient/default.nix
+++ b/pkgs/development/libraries/libqaccessibilityclient/default.nix
@@ -2,15 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "libqaccessibilityclient";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/libqaccessibilityclient/libqaccessibilityclient-${version}.tar.xz";
-    sha256 = "sha256-HHaLT0MU/K4qB8t958sq4FIrXwK0Fzrz7ti/sqTYNCk=";
+    hash = "sha256-cEdyVDo7AFuUBhpT6vn51klE5oGLBMWcD7ClA8gaxKA=";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [ qtbase ];
+  cmakeFlags = ["-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}"];
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/libraries/libquotient/default.nix b/pkgs/development/libraries/libquotient/default.nix
index e154ab8eafe2..b461a3c07864 100644
--- a/pkgs/development/libraries/libquotient/default.nix
+++ b/pkgs/development/libraries/libquotient/default.nix
@@ -1,6 +1,8 @@
 { stdenv, lib, fetchFromGitHub, cmake, olm, openssl, qtbase, qtmultimedia, qtkeychain }:
 
-stdenv.mkDerivation rec {
+let
+  isQt6 = lib.versions.major qtbase.version == "6";
+in stdenv.mkDerivation rec {
   pname = "libquotient";
   version = "0.8.1.2";
 
@@ -19,6 +21,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DQuotient_ENABLE_E2EE=ON"
+    (lib.cmakeBool "BUILD_WITH_QT6" isQt6)
   ];
 
   # https://github.com/quotient-im/libQuotient/issues/551
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index e8658558f69a..415f097f3318 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.57.0";
+  version = "2.57.1";
 
   outputs = [ "out" "dev" ] ++ lib.optionals withIntrospection [
     "devdoc"
@@ -50,13 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-M1/i4MLL8be/BmhlEiSiPhNUUfCxeTzYE2Sb4r/6dOg=";
+    hash = "sha256-B0Zxo+1vvNZ8ripA5TkQf08JfKikqxqJTAXiUk/zQO8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-P8W4z/MwSpP0xqrxoVZPAip7ymdIUL2+uP88Q2Y3hVU=";
+    hash = "sha256-zICI7sps5KYe8/yWXbCJv529KxGLjoyDOmpCgVAIsTs=";
     # TODO: move this to fetchCargoTarball
     dontConfigure = true;
   };
diff --git a/pkgs/development/libraries/libsass/default.nix b/pkgs/development/libraries/libsass/default.nix
index 92f3853b5f71..57e58adb8c7e 100644
--- a/pkgs/development/libraries/libsass/default.nix
+++ b/pkgs/development/libraries/libsass/default.nix
@@ -1,5 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoreconfHook
 , testers
+
+# for passthru.tests
+, gtk3
+, gtk4
+, sassc
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -18,13 +27,24 @@ stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-26592.CVE-2022-43357.CVE-2022-43358.patch";
+      url = "https://github.com/sass/libsass/pull/3184/commits/5bb0ea0c4b2ebebe542933f788ffacba459a717a.patch";
+      hash = "sha256-DR6pKFWL70uJt//drzq34LeTzT8rUqgUTpgfUHpD2s4=";
+    })
+  ];
+
   preConfigure = ''
     export LIBSASS_VERSION=${finalAttrs.version}
   '';
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  passthru.tests = {
+    inherit gtk3 gtk4 sassc;
+    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
 
   meta = with lib; {
     description = "A C/C++ implementation of a Sass compiler";
diff --git a/pkgs/development/libraries/libseccomp/default.nix b/pkgs/development/libraries/libseccomp/default.nix
index 954242d81fb4..e5a8f42940e0 100644
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libseccomp";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-    sha256 = "sha256-2CkCQAQFzwBoV07z3B/l9ZJiB1Q7oa5vjnoVdjUdy9s=";
+    hash = "sha256-JIosik2bmFiqa69ScSw0r+/PnJ6Ut23OAsHJqiX7M3U=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
diff --git a/pkgs/development/libraries/libsecret/default.nix b/pkgs/development/libraries/libsecret/default.nix
index 2818e27ae4cf..733fcafaf290 100644
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsecret";
-  version = "0.21.1";
+  version = "0.21.2";
 
   outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Z09RMjpfdOTLfjJ32mi1r93TM+yiW8n9LYIKkpcvkLE=";
+    hash = "sha256-5KNBSWoIFeZMjTuPq6sz17rn796rd7hDZpcx1bGB3O4=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index 00cb7e042c97..15f8fab50889 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh";
-  version = "0.10.5";
+  version = "0.10.6";
 
   src = fetchurl {
-    url = "https://www.libssh.org/files/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-tg4v9/Nnue7itWNNOmMwPd/t4OahjfyojESodw5+QjQ=";
+    url = "https://www.libssh.org/files/${lib.versions.majorMinor version}/libssh-${version}.tar.xz";
+    hash = "sha256-GGHUmPW28XQbarxz5ghHhJHtz5ydS2Yw7vbnRZbencE=";
   };
 
   # Do not split 'dev' output until lib/cmake/libssh/libssh-config.cmake
diff --git a/pkgs/development/libraries/libssh2/CVE-2023-48795.patch b/pkgs/development/libraries/libssh2/CVE-2023-48795.patch
new file mode 100644
index 000000000000..c89e4a137b72
--- /dev/null
+++ b/pkgs/development/libraries/libssh2/CVE-2023-48795.patch
@@ -0,0 +1,459 @@
+From d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a Mon Sep 17 00:00:00 2001
+From: Michael Buckley <michael@buckleyisms.com>
+Date: Thu, 30 Nov 2023 15:08:02 -0800
+Subject: [PATCH] src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack"
+
+Refs:
+https://terrapin-attack.com/
+https://seclists.org/oss-sec/2023/q4/292
+https://osv.dev/list?ecosystem=&q=CVE-2023-48795
+https://github.com/advisories/GHSA-45x7-px36-x8w8
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795
+
+Fixes #1290
+Closes #1291
+---
+ src/kex.c          | 63 +++++++++++++++++++++++------------
+ src/libssh2_priv.h | 18 +++++++---
+ src/packet.c       | 83 +++++++++++++++++++++++++++++++++++++++++++---
+ src/packet.h       |  2 +-
+ src/session.c      |  3 ++
+ src/transport.c    | 12 ++++++-
+ 6 files changed, 149 insertions(+), 32 deletions(-)
+
+diff --git a/src/kex.c b/src/kex.c
+index 8e7b7f0af3..a7b301e157 100644
+--- a/src/kex.c
++++ b/src/kex.c
+@@ -3032,6 +3032,13 @@ kex_method_extension_negotiation = {
+     0,
+ };
+ 
++static const LIBSSH2_KEX_METHOD
++kex_method_strict_client_extension = {
++    "kex-strict-c-v00@openssh.com",
++    NULL,
++    0,
++};
++
+ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = {
+ #if LIBSSH2_ED25519
+     &kex_method_ssh_curve25519_sha256,
+@@ -3050,6 +3057,7 @@ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = {
+     &kex_method_diffie_helman_group1_sha1,
+     &kex_method_diffie_helman_group_exchange_sha1,
+     &kex_method_extension_negotiation,
++    &kex_method_strict_client_extension,
+     NULL
+ };
+ 
+@@ -3302,13 +3310,13 @@ static int kexinit(LIBSSH2_SESSION * session)
+     return 0;
+ }
+ 
+-/* kex_agree_instr
++/* _libssh2_kex_agree_instr
+  * Kex specific variant of strstr()
+  * Needle must be preceded by BOL or ',', and followed by ',' or EOL
+  */
+-static unsigned char *
+-kex_agree_instr(unsigned char *haystack, size_t haystack_len,
+-                const unsigned char *needle, size_t needle_len)
++unsigned char *
++_libssh2_kex_agree_instr(unsigned char *haystack, size_t haystack_len,
++                         const unsigned char *needle, size_t needle_len)
+ {
+     unsigned char *s;
+     unsigned char *end_haystack;
+@@ -3393,7 +3401,7 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session,
+         while(s && *s) {
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+-            if(kex_agree_instr(hostkey, hostkey_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(hostkey, hostkey_len, s, method_len)) {
+                 const LIBSSH2_HOSTKEY_METHOD *method =
+                     (const LIBSSH2_HOSTKEY_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3427,9 +3435,9 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session,
+     }
+ 
+     while(hostkeyp && (*hostkeyp) && (*hostkeyp)->name) {
+-        s = kex_agree_instr(hostkey, hostkey_len,
+-                            (unsigned char *) (*hostkeyp)->name,
+-                            strlen((*hostkeyp)->name));
++        s = _libssh2_kex_agree_instr(hostkey, hostkey_len,
++                                     (unsigned char *) (*hostkeyp)->name,
++                                     strlen((*hostkeyp)->name));
+         if(s) {
+             /* So far so good, but does it suit our purposes? (Encrypting vs
+                Signing) */
+@@ -3463,6 +3471,12 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
+ {
+     const LIBSSH2_KEX_METHOD **kexp = libssh2_kex_methods;
+     unsigned char *s;
++    const unsigned char *strict =
++        (unsigned char *)"kex-strict-s-v00@openssh.com";
++
++    if(_libssh2_kex_agree_instr(kex, kex_len, strict, 28)) {
++        session->kex_strict = 1;
++    }
+ 
+     if(session->kex_prefs) {
+         s = (unsigned char *) session->kex_prefs;
+@@ -3470,7 +3484,7 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
+         while(s && *s) {
+             unsigned char *q, *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+-            q = kex_agree_instr(kex, kex_len, s, method_len);
++            q = _libssh2_kex_agree_instr(kex, kex_len, s, method_len);
+             if(q) {
+                 const LIBSSH2_KEX_METHOD *method = (const LIBSSH2_KEX_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3504,9 +3518,9 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
+     }
+ 
+     while(*kexp && (*kexp)->name) {
+-        s = kex_agree_instr(kex, kex_len,
+-                            (unsigned char *) (*kexp)->name,
+-                            strlen((*kexp)->name));
++        s = _libssh2_kex_agree_instr(kex, kex_len,
++                                     (unsigned char *) (*kexp)->name,
++                                     strlen((*kexp)->name));
+         if(s) {
+             /* We've agreed on a key exchange method,
+              * Can we agree on a hostkey that works with this kex?
+@@ -3550,7 +3564,7 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session,
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+ 
+-            if(kex_agree_instr(crypt, crypt_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(crypt, crypt_len, s, method_len)) {
+                 const LIBSSH2_CRYPT_METHOD *method =
+                     (const LIBSSH2_CRYPT_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3572,9 +3586,9 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session,
+     }
+ 
+     while(*cryptp && (*cryptp)->name) {
+-        s = kex_agree_instr(crypt, crypt_len,
+-                            (unsigned char *) (*cryptp)->name,
+-                            strlen((*cryptp)->name));
++        s = _libssh2_kex_agree_instr(crypt, crypt_len,
++                                     (unsigned char *) (*cryptp)->name,
++                                     strlen((*cryptp)->name));
+         if(s) {
+             endpoint->crypt = *cryptp;
+             return 0;
+@@ -3614,7 +3628,7 @@ static int kex_agree_mac(LIBSSH2_SESSION * session,
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+ 
+-            if(kex_agree_instr(mac, mac_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(mac, mac_len, s, method_len)) {
+                 const LIBSSH2_MAC_METHOD *method = (const LIBSSH2_MAC_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+                                            (const LIBSSH2_COMMON_METHOD **)
+@@ -3635,8 +3649,9 @@ static int kex_agree_mac(LIBSSH2_SESSION * session,
+     }
+ 
+     while(*macp && (*macp)->name) {
+-        s = kex_agree_instr(mac, mac_len, (unsigned char *) (*macp)->name,
+-                            strlen((*macp)->name));
++        s = _libssh2_kex_agree_instr(mac, mac_len,
++                                     (unsigned char *) (*macp)->name,
++                                     strlen((*macp)->name));
+         if(s) {
+             endpoint->mac = *macp;
+             return 0;
+@@ -3667,7 +3682,7 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
+             unsigned char *p = (unsigned char *) strchr((char *) s, ',');
+             size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
+ 
+-            if(kex_agree_instr(comp, comp_len, s, method_len)) {
++            if(_libssh2_kex_agree_instr(comp, comp_len, s, method_len)) {
+                 const LIBSSH2_COMP_METHOD *method =
+                     (const LIBSSH2_COMP_METHOD *)
+                     kex_get_method_by_name((char *) s, method_len,
+@@ -3689,8 +3704,9 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
+     }
+ 
+     while(*compp && (*compp)->name) {
+-        s = kex_agree_instr(comp, comp_len, (unsigned char *) (*compp)->name,
+-                            strlen((*compp)->name));
++        s = _libssh2_kex_agree_instr(comp, comp_len,
++                                     (unsigned char *) (*compp)->name,
++                                     strlen((*compp)->name));
+         if(s) {
+             endpoint->comp = *compp;
+             return 0;
+@@ -3871,6 +3887,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+                 session->local.kexinit = key_state->oldlocal;
+                 session->local.kexinit_len = key_state->oldlocal_len;
+                 key_state->state = libssh2_NB_state_idle;
++                session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+                 session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
+                 session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+                 return -1;
+@@ -3896,6 +3913,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+                 session->local.kexinit = key_state->oldlocal;
+                 session->local.kexinit_len = key_state->oldlocal_len;
+                 key_state->state = libssh2_NB_state_idle;
++                session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+                 session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
+                 session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+                 return -1;
+@@ -3944,6 +3962,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+         session->remote.kexinit = NULL;
+     }
+ 
++    session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+     session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
+     session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+ 
+diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h
+index 7660366954..18d9ab2130 100644
+--- a/src/libssh2_priv.h
++++ b/src/libssh2_priv.h
+@@ -736,6 +736,9 @@ struct _LIBSSH2_SESSION
+     /* key signing algorithm preferences -- NULL yields server order */
+     char *sign_algo_prefs;
+ 
++    /* Whether to use the OpenSSH Strict KEX extension */
++    int kex_strict;
++
+     /* (remote as source of data -- packet_read ) */
+     libssh2_endpoint_data remote;
+ 
+@@ -908,6 +911,7 @@ struct _LIBSSH2_SESSION
+     int fullpacket_macstate;
+     size_t fullpacket_payload_len;
+     int fullpacket_packet_type;
++    uint32_t fullpacket_required_type;
+ 
+     /* State variables used in libssh2_sftp_init() */
+     libssh2_nonblocking_states sftpInit_state;
+@@ -948,10 +952,11 @@ struct _LIBSSH2_SESSION
+ };
+ 
+ /* session.state bits */
+-#define LIBSSH2_STATE_EXCHANGING_KEYS   0x00000001
+-#define LIBSSH2_STATE_NEWKEYS           0x00000002
+-#define LIBSSH2_STATE_AUTHENTICATED     0x00000004
+-#define LIBSSH2_STATE_KEX_ACTIVE        0x00000008
++#define LIBSSH2_STATE_INITIAL_KEX       0x00000001
++#define LIBSSH2_STATE_EXCHANGING_KEYS   0x00000002
++#define LIBSSH2_STATE_NEWKEYS           0x00000004
++#define LIBSSH2_STATE_AUTHENTICATED     0x00000008
++#define LIBSSH2_STATE_KEX_ACTIVE        0x00000010
+ 
+ /* session.flag helpers */
+ #ifdef MSG_NOSIGNAL
+@@ -1182,6 +1187,11 @@ ssize_t _libssh2_send(libssh2_socket_t socket, const void *buffer,
+ int _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
+                           key_exchange_state_t * state);
+ 
++unsigned char *_libssh2_kex_agree_instr(unsigned char *haystack,
++                                        size_t haystack_len,
++                                        const unsigned char *needle,
++                                        size_t needle_len);
++
+ /* Let crypt.c/hostkey.c expose their method structs */
+ const LIBSSH2_CRYPT_METHOD **libssh2_crypt_methods(void);
+ const LIBSSH2_HOSTKEY_METHOD **libssh2_hostkey_methods(void);
+diff --git a/src/packet.c b/src/packet.c
+index eccb8c56a8..6da14e9fa1 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -624,14 +624,13 @@ packet_authagent_open(LIBSSH2_SESSION * session,
+  * layer when it has received a packet.
+  *
+  * The input pointer 'data' is pointing to allocated data that this function
+- * is asked to deal with so on failure OR success, it must be freed fine.
+- * The only exception is when the return code is LIBSSH2_ERROR_EAGAIN.
++ * will be freed unless return the code is LIBSSH2_ERROR_EAGAIN.
+  *
+  * This function will always be called with 'datalen' greater than zero.
+  */
+ int
+ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+-                    size_t datalen, int macstate)
++                    size_t datalen, int macstate, uint32_t seq)
+ {
+     int rc = 0;
+     unsigned char *message = NULL;
+@@ -676,6 +675,70 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+         break;
+     }
+ 
++    if(session->state & LIBSSH2_STATE_INITIAL_KEX) {
++        if(msg == SSH_MSG_KEXINIT) {
++            if(!session->kex_strict) {
++                if(datalen < 17) {
++                    LIBSSH2_FREE(session, data);
++                    session->packAdd_state = libssh2_NB_state_idle;
++                    return _libssh2_error(session,
++                                          LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++                                          "Data too short extracting kex");
++                }
++                else {
++                    const unsigned char *strict =
++                    (unsigned char *)"kex-strict-s-v00@openssh.com";
++                    struct string_buf buf;
++                    unsigned char *algs = NULL;
++                    size_t algs_len = 0;
++
++                    buf.data = (unsigned char *)data;
++                    buf.dataptr = buf.data;
++                    buf.len = datalen;
++                    buf.dataptr += 17; /* advance past type and cookie */
++
++                    if(_libssh2_get_string(&buf, &algs, &algs_len)) {
++                        LIBSSH2_FREE(session, data);
++                        session->packAdd_state = libssh2_NB_state_idle;
++                        return _libssh2_error(session,
++                                              LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++                                              "Algs too short");
++                    }
++
++                    if(algs_len == 0 ||
++                       _libssh2_kex_agree_instr(algs, algs_len, strict, 28)) {
++                        session->kex_strict = 1;
++                    }
++                }
++            }
++
++            if(session->kex_strict && seq) {
++                LIBSSH2_FREE(session, data);
++                session->socket_state = LIBSSH2_SOCKET_DISCONNECTED;
++                session->packAdd_state = libssh2_NB_state_idle;
++                libssh2_session_disconnect(session, "strict KEX violation: "
++                                           "KEXINIT was not the first packet");
++
++                return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
++                                      "strict KEX violation: "
++                                      "KEXINIT was not the first packet");
++            }
++        }
++
++        if(session->kex_strict && session->fullpacket_required_type &&
++            session->fullpacket_required_type != msg) {
++            LIBSSH2_FREE(session, data);
++            session->socket_state = LIBSSH2_SOCKET_DISCONNECTED;
++            session->packAdd_state = libssh2_NB_state_idle;
++            libssh2_session_disconnect(session, "strict KEX violation: "
++                                       "unexpected packet type");
++
++            return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
++                                  "strict KEX violation: "
++                                  "unexpected packet type");
++        }
++    }
++
+     if(session->packAdd_state == libssh2_NB_state_allocated) {
+         /* A couple exceptions to the packet adding rule: */
+         switch(msg) {
+@@ -1364,6 +1427,15 @@ _libssh2_packet_ask(LIBSSH2_SESSION * session, unsigned char packet_type,
+ 
+             return 0;
+         }
++        else if(session->kex_strict &&
++                (session->state & LIBSSH2_STATE_INITIAL_KEX)) {
++            libssh2_session_disconnect(session, "strict KEX violation: "
++                                       "unexpected packet type");
++
++            return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
++                                  "strict KEX violation: "
++                                  "unexpected packet type");
++        }
+         packet = _libssh2_list_next(&packet->node);
+     }
+     return -1;
+@@ -1425,7 +1497,10 @@ _libssh2_packet_require(LIBSSH2_SESSION * session, unsigned char packet_type,
+     }
+ 
+     while(session->socket_state == LIBSSH2_SOCKET_CONNECTED) {
+-        int ret = _libssh2_transport_read(session);
++        int ret;
++        session->fullpacket_required_type = packet_type;
++        ret = _libssh2_transport_read(session);
++        session->fullpacket_required_type = 0;
+         if(ret == LIBSSH2_ERROR_EAGAIN)
+             return ret;
+         else if(ret < 0) {
+diff --git a/src/packet.h b/src/packet.h
+index 1d90b8af12..955351e5f6 100644
+--- a/src/packet.h
++++ b/src/packet.h
+@@ -72,6 +72,6 @@ int _libssh2_packet_burn(LIBSSH2_SESSION * session,
+ int _libssh2_packet_write(LIBSSH2_SESSION * session, unsigned char *data,
+                           unsigned long data_len);
+ int _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+-                        size_t datalen, int macstate);
++                        size_t datalen, int macstate, uint32_t seq);
+ 
+ #endif /* LIBSSH2_PACKET_H */
+diff --git a/src/session.c b/src/session.c
+index 35e7929fe7..9d89ade8ec 100644
+--- a/src/session.c
++++ b/src/session.c
+@@ -469,6 +469,8 @@ libssh2_session_init_ex(LIBSSH2_ALLOC_FUNC((*my_alloc)),
+         session->abstract = abstract;
+         session->api_timeout = 0; /* timeout-free API by default */
+         session->api_block_mode = 1; /* blocking API by default */
++        session->state = LIBSSH2_STATE_INITIAL_KEX;
++        session->fullpacket_required_type = 0;
+         session->packet_read_timeout = LIBSSH2_DEFAULT_READ_TIMEOUT;
+         session->flag.quote_paths = 1; /* default behavior is to quote paths
+                                           for the scp subsystem */
+@@ -1223,6 +1225,7 @@ libssh2_session_disconnect_ex(LIBSSH2_SESSION *session, int reason,
+                               const char *desc, const char *lang)
+ {
+     int rc;
++    session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
+     session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
+     BLOCK_ADJUST(rc, session,
+                  session_disconnect(session, reason, desc, lang));
+diff --git a/src/transport.c b/src/transport.c
+index 21be9d2b80..a8bb588a4b 100644
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -186,6 +186,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+     struct transportpacket *p = &session->packet;
+     int rc;
+     int compressed;
++    uint32_t seq = session->remote.seqno;
+ 
+     if(session->fullpacket_state == libssh2_NB_state_idle) {
+         session->fullpacket_macstate = LIBSSH2_MAC_CONFIRMED;
+@@ -317,7 +318,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+     if(session->fullpacket_state == libssh2_NB_state_created) {
+         rc = _libssh2_packet_add(session, p->payload,
+                                  session->fullpacket_payload_len,
+-                                 session->fullpacket_macstate);
++                                 session->fullpacket_macstate, seq);
+         if(rc == LIBSSH2_ERROR_EAGAIN)
+             return rc;
+         if(rc) {
+@@ -328,6 +329,11 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+ 
+     session->fullpacket_state = libssh2_NB_state_idle;
+ 
++    if(session->kex_strict &&
++        session->fullpacket_packet_type == SSH_MSG_NEWKEYS) {
++        session->remote.seqno = 0;
++    }
++
+     return session->fullpacket_packet_type;
+ }
+ 
+@@ -1093,6 +1099,10 @@ int _libssh2_transport_send(LIBSSH2_SESSION *session,
+ 
+     session->local.seqno++;
+ 
++    if(session->kex_strict && data[0] == SSH_MSG_NEWKEYS) {
++        session->local.seqno = 0;
++    }
++
+     ret = LIBSSH2_SEND(session, p->outbuf, total_length,
+                        LIBSSH2_SOCKET_SEND_FLAGS(session));
+     if(ret < 0)
diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
index 091885a1f084..f7a51da9fa67 100644
--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@@ -9,6 +9,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-NzYWHkHiaTMk3rOMJs/cPv5iCdY0ukJY2xzs/2pa1GE=";
   };
 
+  patches = [
+    # fetchpatch cannot be used due to infinite recursion
+    # https://github.com/libssh2/libssh2/commit/d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a
+    ./CVE-2023-48795.patch
+  ];
+
   outputs = [ "out" "dev" "devdoc" ];
 
   propagatedBuildInputs = [ openssl ]; # see Libs: in libssh2.pc
diff --git a/pkgs/development/libraries/libtins/default.nix b/pkgs/development/libraries/libtins/default.nix
index b96c02a35bfd..b27ad6634797 100644
--- a/pkgs/development/libraries/libtins/default.nix
+++ b/pkgs/development/libraries/libtins/default.nix
@@ -1,4 +1,4 @@
-{ boost, cmake, fetchFromGitHub, gtest, libpcap, openssl, lib, stdenv }:
+{ boost, cmake, fetchFromGitHub, fetchpatch, gtest, libpcap, openssl, lib, stdenv }:
 
 stdenv.mkDerivation rec {
   pname = "libtins";
@@ -11,6 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-mXbinXh/CO0SZZ71+K+FozbHCCoi12+AIa2o+P0QmUw=";
   };
 
+  patches = [
+    # Pull gcc-13 fixes:
+    #   https://github.com/mfontanini/libtins/pull/496
+    # TODO: remove when upgrade to the next version.
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/mfontanini/libtins/commit/812be7966d445ec56e88eab512f8fd2d57152427.patch";
+      hash = "sha256-5RCFPe95r1CBrAocjTPR2SvUlgaGa1aBc8RazyxUj3M=";
+    })
+  ];
+
   postPatch = ''
     rm -rf googletest
     cp -r ${gtest.src} googletest
diff --git a/pkgs/development/libraries/libubox/default.nix b/pkgs/development/libraries/libubox/default.nix
index f54e5c5a5afa..2bcc5d0498c4 100644
--- a/pkgs/development/libraries/libubox/default.nix
+++ b/pkgs/development/libraries/libubox/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "libubox";
-  version = "unstable-2023-11-03";
+  version = "unstable-2023-11-28";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libubox.git";
-    rev = "f7d1569113110ea8df071d2ea64fd17aaf5b42c9";
-    hash = "sha256-W0+QXI0gJ4WwrlRMPAJOChvilZ4zlAf4kXrfgBAkQAE=";
+    rev = "e80dc00ee90c29ef56ae28f414b0e5bb361206e7";
+    hash = "sha256-R4Yz4C63LQTNBKyNyiLMQHfc5KJBPFldP1trmtEBb9U=";
   };
 
   cmakeFlags = [ "-DBUILD_EXAMPLES=OFF" (if with_lua then "-DLUAPATH=${placeholder "out"}/lib/lua" else "-DBUILD_LUA=OFF") ];
diff --git a/pkgs/development/libraries/libvirt-glib/default.nix b/pkgs/development/libraries/libvirt-glib/default.nix
index bb855ac767ee..b01a9a788bad 100644
--- a/pkgs/development/libraries/libvirt-glib/default.nix
+++ b/pkgs/development/libraries/libvirt-glib/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -20,23 +19,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libvirt-glib";
-  version = "4.0.0";
+  version = "5.0.0";
 
   outputs = [ "out" "dev" ] ++ lib.optional withDocs "devdoc";
 
   src = fetchurl {
     url = "https://libvirt.org/sources/glib/${pname}-${version}.tar.xz";
-    sha256 = "hCP3Bp2qR2MHMh0cEeLswoU0DNMsqfwFIHdihD7erL0=";
+    sha256 = "m/7DRjgkFqNXXYcpm8ZBsqRkqlGf2bEofjGKpDovO4s=";
   };
 
-  patches = [
-    # Fix build with GLib 2.70
-    (fetchpatch {
-      url = "https://gitlab.com/libvirt/libvirt-glib/-/commit/9a34c4ea55e0246c34896e48b8ecd637bc559ac7.patch";
-      sha256 = "UU70uTi55EzPMuLYVKRzpVcd3WogeAtWAWEC2hWlR7k=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -69,9 +60,6 @@ stdenv.mkDerivation rec {
     (lib.mesonEnable "introspection" withIntrospection)
   ];
 
-  # https://gitlab.com/libvirt/libvirt-glib/-/issues/4
-  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=pointer-sign" ];
-
   meta = with lib; {
     description = "Library for working with virtual machines";
     longDescription = ''
diff --git a/pkgs/development/libraries/libvmaf/default.nix b/pkgs/development/libraries/libvmaf/default.nix
index 79b2e2ec2951..0c71611e4772 100644
--- a/pkgs/development/libraries/libvmaf/default.nix
+++ b/pkgs/development/libraries/libvmaf/default.nix
@@ -1,26 +1,27 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm, xxd }:
-
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, fetchFromGitHub
+, ffmpeg-full
+, libaom
+, meson
+, nasm
+, ninja
+, testers
+, xxd
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "libvmaf";
-  version = "2.3.1";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "netflix";
     repo = "vmaf";
-    rev = "v${version}";
-    sha256 = "sha256-TkMy2tEdG1FPPWfH/wPnVbs5kocqe4Y0jU4yvbiRZ9k=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-6mwU2so1YM2pyWkJbDHVl443GgWtQazbBv3gTMBq5NA=";
   };
 
-  sourceRoot = "${src.name}/libvmaf";
-
-  patches = [
-    # Backport fix for non-Linux, non-Darwin platforms.
-    (fetchpatch {
-      url = "https://github.com/Netflix/vmaf/commit/f47640f9ffee9494571bd7c9622e353660c93fc4.patch";
-      stripLen = 1;
-      sha256 = "rsTKuqp8VJG5DBDpixPke3LrdfjKzUO945i+iL0n7CY=";
-    })
-  ];
+  sourceRoot = "${finalAttrs.src.name}/libvmaf";
 
   nativeBuildInputs = [ meson ninja nasm xxd ];
 
@@ -29,14 +30,24 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
   doCheck = false;
 
+  passthru.tests = {
+    inherit libaom ffmpeg-full;
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [ "libvmaf" ];
+    };
+  };
+
   meta = with lib; {
     description = "Perceptual video quality assessment based on multi-method fusion (VMAF)";
     homepage = "https://github.com/Netflix/vmaf";
-    changelog = "https://github.com/Netflix/vmaf/raw/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/Netflix/vmaf/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = licenses.bsd2Patent;
     maintainers = [ maintainers.cfsmp3 maintainers.marsam ];
     mainProgram = "vmaf";
     platforms = platforms.unix;
   };
-
-}
+})
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 2fbb29347d42..ed5413464e1d 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -6,14 +6,16 @@
 , glib
 , pkg-config
 , udev
+, libevdev
 , libgudev
+, libxml2
 , python3
 , valgrind
 }:
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "2.8.0";
+  version = "2.9.0";
 
   outputs = [ "out" "dev" ];
 
@@ -21,7 +23,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    hash = "sha256-VjFZBlOIG1L4dXPJ8DWxrbfVqdQC+X7zVXFryo43FFc=";
+    hash = "sha256-oM3dd22hQaAXdNoO2Q2JvO2lJCkmfw8f0NWxYcVT3lA=";
   };
 
   postPatch = ''
@@ -38,6 +40,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib
     udev
+    libevdev
     libgudev
   ];
 
@@ -50,13 +53,18 @@ stdenv.mkDerivation rec {
     "-Dtests=${if doCheck then "enabled" else "disabled"}"
   ];
 
+  checkInputs = [
+    libxml2
+  ];
+
   nativeCheckInputs = [
     valgrind
-  ] ++ (with python3.pkgs; [
-    libevdev
-    pytest
-    pyudev
-  ]);
+    (python3.withPackages (ps: with ps; [
+      ps.libevdev
+      pytest
+      pyudev
+    ]))
+  ];
 
   meta = with lib; {
     platforms = platforms.linux;
@@ -64,6 +72,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/linuxwacom/libwacom/blob/${src.rev}/NEWS";
     description = "Libraries, configuration, and diagnostic tools for Wacom tablets running under Linux";
     maintainers = teams.freedesktop.members;
-    license = licenses.mit;
+    license = licenses.hpnd;
   };
 }
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 3f8e27789b8c..d06c45e81990 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchFromGitLab
 , zlib
 , pkg-config
 , autoreconfHook
@@ -34,16 +35,19 @@ in
 let
 libxml = stdenv.mkDerivation rec {
   pname = "libxml2";
-  version = "2.11.5";
+  version = "2.12.3-unstable-2023-12-14";
 
   outputs = [ "bin" "dev" "out" "doc" ]
     ++ lib.optional pythonSupport "py"
     ++ lib.optional (enableStatic && enableShared) "static";
   outputMan = "bin";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-    sha256 = "NyeweMNg7Gn6hp3hS9b3XX7o02mHsHHmko1HIKKN86Y=";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "libxml2";
+    rev = "f006355eda722cae204606b9f95ba51f5ce9189b";
+    hash = "sha256-3WE90KDZq4Uaawuulc3t2+R8duCqgjEGUDN4HSXxohY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/mesa/backports/0001-dri-added-build-dependencies-for-systems-using-non-s.patch b/pkgs/development/libraries/mesa/backports/0001-dri-added-build-dependencies-for-systems-using-non-s.patch
new file mode 100644
index 000000000000..c0b239c92598
--- /dev/null
+++ b/pkgs/development/libraries/mesa/backports/0001-dri-added-build-dependencies-for-systems-using-non-s.patch
@@ -0,0 +1,56 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "duncan.hopkins" <duncan.hopkins@foundry.com>
+Date: Tue, 17 Oct 2023 09:34:31 +0100
+Subject: [PATCH] dri: added build dependencies for systems using non-standard
+ prefixed X11 libs.
+
+To get MacOS to build, some extra dependencies need to be added to a couple of build targets.
+This mainly shows up when not installing the dependencies in the default prefix locations.
+On MacOS, this happens when using a custom build of brew to install the dependencies to 'odd' locations.
+
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25992>
+---
+ src/gallium/targets/dri/meson.build | 2 +-
+ src/glx/meson.build                 | 2 +-
+ src/loader/meson.build              | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/gallium/targets/dri/meson.build b/src/gallium/targets/dri/meson.build
+index 66619bba0db..6d3ef197e74 100644
+--- a/src/gallium/targets/dri/meson.build
++++ b/src/gallium/targets/dri/meson.build
+@@ -49,7 +49,7 @@ libgallium_dri = shared_library(
+   link_depends : gallium_dri_link_depends,
+   link_with : [
+     libdri, libmesa, libgalliumvl,
+-    libgallium, libglapi, libpipe_loader_static, libws_null, libwsw, libswdri,
++    libgallium, libglapi, libloader, libpipe_loader_static, libws_null, libwsw, libswdri,
+     libswkmsdri,
+   ],
+   dependencies : [
+diff --git a/src/glx/meson.build b/src/glx/meson.build
+index 7ec3e3e0d88..1a5e9833956 100644
+--- a/src/glx/meson.build
++++ b/src/glx/meson.build
+@@ -136,7 +136,7 @@ libglx = static_library(
+   ],
+   dependencies : [
+     idep_mesautil, idep_xmlconfig,
+-    dep_libdrm, dep_dri2proto, dep_glproto, dep_x11, dep_glvnd, dep_xxf86vm, dep_xshmfence
++    dep_libdrm, dep_dri2proto, dep_glproto, dep_x11, dep_xext, dep_glvnd, dep_xxf86vm, dep_xshmfence
+   ],
+ )
+ 
+diff --git a/src/loader/meson.build b/src/loader/meson.build
+index 35f9991ba2f..043cc852112 100644
+--- a/src/loader/meson.build
++++ b/src/loader/meson.build
+@@ -47,6 +47,6 @@ libloader = static_library(
+   c_args : loader_c_args,
+   gnu_symbol_visibility : 'hidden',
+   include_directories : [inc_include, inc_src, inc_util],
+-  dependencies : [dep_libdrm, dep_thread, dep_xcb_xrandr],
++  dependencies : [dep_libdrm, dep_thread, dep_xcb, dep_xcb_xrandr],
+   build_by_default : false,
+ )
diff --git a/pkgs/development/libraries/mesa/backports/0002-util-Update-util-libdrm.h-stubs-to-allow-loader.c-to.patch b/pkgs/development/libraries/mesa/backports/0002-util-Update-util-libdrm.h-stubs-to-allow-loader.c-to.patch
new file mode 100644
index 000000000000..5a48ace8fbbc
--- /dev/null
+++ b/pkgs/development/libraries/mesa/backports/0002-util-Update-util-libdrm.h-stubs-to-allow-loader.c-to.patch
@@ -0,0 +1,103 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "duncan.hopkins" <duncan.hopkins@foundry.com>
+Date: Tue, 17 Oct 2023 14:36:39 +0100
+Subject: [PATCH] util: Update util/libdrm.h stubs to allow loader.c to compile
+ on MacOS.
+
+MacOS does not have the libdrm libraries so is missing xf86drm.h.
+util/libdrm.h already has a collection of stubs for systems that do not support the libraries.
+
+A compile on MacOS will fail with the source that uses newer drm functions and structures.
+Update adds in missing items that MacOS code needs to compile and run.
+New code is copied from the public repository: https://gitlab.freedesktop.org/mesa/drm/-/blob/main/xf86drm.h
+
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25992>
+---
+ src/util/libdrm.h | 57 +++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 57 insertions(+)
+
+diff --git a/src/util/libdrm.h b/src/util/libdrm.h
+index cc153cf88ab..e3af494b8d1 100644
+--- a/src/util/libdrm.h
++++ b/src/util/libdrm.h
+@@ -44,22 +44,79 @@
+ #define DRM_BUS_PLATFORM  2
+ #define DRM_BUS_HOST1X    3
+ 
++typedef struct _drmPciDeviceInfo {
++    uint16_t vendor_id;
++    uint16_t device_id;
++    uint16_t subvendor_id;
++    uint16_t subdevice_id;
++    uint8_t revision_id;
++} drmPciDeviceInfo, *drmPciDeviceInfoPtr;
++
++#define DRM_PLATFORM_DEVICE_NAME_LEN 512
++
++typedef struct _drmPlatformBusInfo {
++    char fullname[DRM_PLATFORM_DEVICE_NAME_LEN];
++} drmPlatformBusInfo, *drmPlatformBusInfoPtr;
++
++typedef struct _drmPlatformDeviceInfo {
++    char **compatible; /* NULL terminated list of compatible strings */
++} drmPlatformDeviceInfo, *drmPlatformDeviceInfoPtr;
++
++#define DRM_HOST1X_DEVICE_NAME_LEN 512
++
++typedef struct _drmHost1xBusInfo {
++    char fullname[DRM_HOST1X_DEVICE_NAME_LEN];
++} drmHost1xBusInfo, *drmHost1xBusInfoPtr;
++
++typedef struct _drmPciBusInfo {
++   uint16_t domain;
++   uint8_t bus;
++   uint8_t dev;
++   uint8_t func;
++} drmPciBusInfo, *drmPciBusInfoPtr;
++
+ typedef struct _drmDevice {
+     char **nodes; /* DRM_NODE_MAX sized array */
+     int available_nodes; /* DRM_NODE_* bitmask */
+     int bustype;
++    union {
++       drmPciBusInfoPtr pci;
++       drmPlatformBusInfoPtr platform;
++       drmHost1xBusInfoPtr host1x;
++    } businfo;
++    union {
++        drmPciDeviceInfoPtr pci;
++    } deviceinfo;
+     /* ... */
+ } drmDevice, *drmDevicePtr;
+ 
++static inline int
++drmGetDevice2(int fd, uint32_t flags, drmDevicePtr *device)
++{
++   return -ENOENT;
++}
++
+ static inline int
+ drmGetDevices2(uint32_t flags, drmDevicePtr devices[], int max_devices)
+ {
+    return -ENOENT;
+ }
+ 
++static inline int
++drmGetDeviceFromDevId(dev_t dev_id, uint32_t flags, drmDevicePtr *device)
++{
++   return -ENOENT;
++}
++
++static inline void
++drmFreeDevice(drmDevicePtr *device) {}
++
+ static inline void
+ drmFreeDevices(drmDevicePtr devices[], int count) {}
+ 
++static inline char*
++drmGetDeviceNameFromFd2(int fd) { return NULL;}
++
+ typedef struct _drmVersion {
+     int     version_major;        /**< Major version */
+     int     version_minor;        /**< Minor version */
diff --git a/pkgs/development/libraries/mesa/backports/0003-glx-fix-automatic-zink-fallback-loading-between-hw-a.patch b/pkgs/development/libraries/mesa/backports/0003-glx-fix-automatic-zink-fallback-loading-between-hw-a.patch
new file mode 100644
index 000000000000..c7bde6411d8e
--- /dev/null
+++ b/pkgs/development/libraries/mesa/backports/0003-glx-fix-automatic-zink-fallback-loading-between-hw-a.patch
@@ -0,0 +1,53 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "duncan.hopkins" <duncan.hopkins@foundry.com>
+Date: Wed, 1 Nov 2023 11:31:13 +0000
+Subject: [PATCH] glx: fix automatic zink fallback loading between hw and sw
+ drivers on MacOS
+
+The combination of defines used when compile the code on MacOS is hiding variables.
+Patch allows basic MacOS build to compile and run.
+
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25992>
+---
+ src/glx/glxext.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/glx/glxext.c b/src/glx/glxext.c
+index 7712e54c1d6..454f2c36a77 100644
+--- a/src/glx/glxext.c
++++ b/src/glx/glxext.c
+@@ -878,12 +878,16 @@ __glXInitialize(Display * dpy)
+ 
+    dpyPriv->glXDrawHash = __glxHashCreate();
+ 
++   Bool zink = False;
++   Bool try_zink = False;
++
+ #if defined(GLX_DIRECT_RENDERING) && !defined(GLX_USE_APPLEGL)
+    Bool glx_direct = !debug_get_bool_option("LIBGL_ALWAYS_INDIRECT", false);
+    Bool glx_accel = !debug_get_bool_option("LIBGL_ALWAYS_SOFTWARE", false);
+    const char *env = getenv("MESA_LOADER_DRIVER_OVERRIDE");
+-   Bool zink = env && !strcmp(env, "zink");
+-   Bool try_zink = False;
++
++   zink = env && !strcmp(env, "zink");
++   try_zink = False;
+ 
+    dpyPriv->drawHash = __glxHashCreate();
+ 
+@@ -928,12 +932,14 @@ __glXInitialize(Display * dpy)
+ 
+    if (!AllocAndFetchScreenConfigs(dpy, dpyPriv, zink | try_zink)) {
+       Bool fail = True;
++#if defined(GLX_DIRECT_RENDERING) && !defined(GLX_USE_APPLEGL)
+       if (try_zink) {
+          free(dpyPriv->screens);
+          dpyPriv->driswDisplay->destroyDisplay(dpyPriv->driswDisplay);
+          dpyPriv->driswDisplay = driswCreateDisplay(dpy, false);
+          fail = !AllocAndFetchScreenConfigs(dpy, dpyPriv, False);
+       }
++#endif
+       if (fail) {
+          free(dpyPriv);
+          return NULL;
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index b4b70fcab4f5..28656a5b78a6 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -2,7 +2,7 @@
 , meson, pkg-config, ninja
 , intltool, bison, flex, file, python3Packages, wayland-scanner
 , expat, libdrm, xorg, wayland, wayland-protocols, openssl
-, llvmPackages_16, libffi, libomxil-bellagio, libva-minimal
+, llvmPackages, libffi, libomxil-bellagio, libva-minimal
 , libelf, libvdpau
 , libglvnd, libunwind, lm_sensors
 , vulkan-loader, glslang
@@ -43,7 +43,7 @@
     ++ lib.optionals (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") [
       # QEMU virtualized GPU (aka VirGL)
       # Requires ATOMIC_INT_LOCK_FREE == 2.
-      "virtio-experimental"
+      "virtio"
     ]
     ++ lib.optionals stdenv.isAarch64 [
       "broadcom" # Broadcom VC5 (Raspberry Pi 4, aka V3D)
@@ -65,6 +65,7 @@
 , enableOpenCL ? stdenv.isLinux && stdenv.isx86_64
 , enablePatentEncumberedCodecs ? true
 , jdupes
+, rust-bindgen
 , rustc
 , spirv-llvm-translator
 , zstd
@@ -84,8 +85,8 @@
 */
 
 let
-  version = "23.1.9";
-  hash = "sha256-KVuifCgUbtCSFOjOea+hZZ7fnRQt7MPJH4BFUtZPdRA=";
+  version = "23.3.2";
+  hash = "sha256-PPy4H6FvicVqvjhV0mN9OW7k4DhJtlkACmuOX1fmmtw=";
 
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
@@ -93,19 +94,6 @@ let
 
   withLibdrm = lib.meta.availableOn stdenv.hostPlatform libdrm;
 
-  llvmPackages = llvmPackages_16;
-  # Align all the Mesa versions used. Required to prevent explosions when
-  # two different LLVMs are loaded in the same process.
-  # FIXME: these should really go into some sort of versioned LLVM package set
-  rust-bindgen' = buildPackages.rust-bindgen.override {
-    rust-bindgen-unwrapped = buildPackages.rust-bindgen.unwrapped.override {
-      clang = buildPackages.llvmPackages_15.clang;
-    };
-  };
-  spirv-llvm-translator' = spirv-llvm-translator.override {
-    inherit (llvmPackages) llvm;
-  };
-
   haveWayland = lib.elem "wayland" eglPlatforms;
   haveZink = lib.elem "zink" galliumDrivers;
   haveDozen = (lib.elem "d3d12" galliumDrivers) || (lib.elem "microsoft-experimental" vulkanDrivers);
@@ -133,29 +121,14 @@ self = stdenv.mkDerivation {
 
     ./opencl.patch
     ./disk_cache-include-dri-driver-path-in-cache-key.patch
-  ] ++ lib.optionals stdenv.isDarwin [
-    # https://gitlab.freedesktop.org/mesa/mesa/-/issues/8634
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/robclark/mesa/-/commit/44734d1fe98ef47019fe2c56d867d1645c526e4e.diff";
-      hash = "sha256-ipaISEY5xcnGvrwFxNY80JVlYWddfiHofkYEBuPkyDY=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/robclark/mesa/-/commit/d2a46afbfc44121aa491a2b4d1a3249d26fc6a11.diff";
-      hash = "sha256-i00s9oUhZXXf/A4cHwWN6uRDP70cHjz+kgVpiDM/eMw=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/robclark/mesa/-/commit/17cde1ee87cc0cbb896ca81949b8f192d5496271.diff";
-      hash = "sha256-ao2pWQwMBskOjWJsjWqwFYAeqpTWAyJbEtSryDO+xyo=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/robclark/mesa/-/commit/4489d737d5c12eb0a3441ed0b303f9f1100a7166.diff";
-      hash = "sha256-WxqwEngd79NHLedQOWMjjroaN0gr6Upd96uteSvr4Yw=";
-    })
-    # fixes a linking error
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/c8b64452c076c1768beb23280de25faf2bcbe2c8.diff";
-      hash = "sha256-mqivdzyoLtkfkAb+r57gjPwg8d7whgFAahiUhGVOOvo=";
-    })
+
+    # Backports to fix build
+    # FIXME: remove when applied upstream
+
+    # Fix build on macOS
+    ./backports/0001-dri-added-build-dependencies-for-systems-using-non-s.patch
+    ./backports/0002-util-Update-util-libdrm.h-stubs-to-allow-loader.c-to.patch
+    ./backports/0003-glx-fix-automatic-zink-fallback-loading-between-hw-a.patch
   ];
 
   postPatch = ''
@@ -257,7 +230,7 @@ self = stdenv.mkDerivation {
     python3Packages.python # for shebang
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
     ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
-    ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped spirv-llvm-translator' ]
+    ++ lib.optionals enableOpenCL [ llvmPackages.libclc llvmPackages.clang llvmPackages.clang-unwrapped spirv-llvm-translator ]
     ++ lib.optional withValgrind valgrind-light
     ++ lib.optional haveZink vulkan-loader
     ++ lib.optional haveDozen directx-headers;
@@ -270,7 +243,7 @@ self = stdenv.mkDerivation {
     intltool bison flex file
     python3Packages.python python3Packages.mako python3Packages.ply
     jdupes glslang
-  ] ++ lib.optionals enableOpenCL [ rust-bindgen' rustc ]
+  ] ++ lib.optionals enableOpenCL [ rust-bindgen rustc ]
     ++ lib.optional haveWayland wayland-scanner;
 
   propagatedBuildInputs = with xorg; [
diff --git a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
index fe51c79d7a06..05f5ec7b6a03 100644
--- a/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
+++ b/pkgs/development/libraries/mesa/disk_cache-include-dri-driver-path-in-cache-key.patch
@@ -1,17 +1,8 @@
-Author: David McFarland <corngood@gmail.com>
-Date:   Mon Aug 6 15:52:11 2018 -0300
-
-    [PATCH] disk_cache: include dri driver path in cache key
-    
-    This fixes invalid cache hits on NixOS where all shared library
-    timestamps in /nix/store are zero.
-
 diff --git a/meson_options.txt b/meson_options.txt
-index b8f753e2e1a..70d9071c8be 100644
+index 591ed957c85..6cb550593e3 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -452,7 +452,14 @@ option(
-   value : true,
+@@ -519,6 +519,13 @@ option(
    description : 'Enable direct rendering in GLX and EGL for DRI',
  )
  
@@ -26,10 +17,10 @@ index b8f753e2e1a..70d9071c8be 100644
    type : 'string',
    value : '',
 diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
-index 8dbe0938d11..498fe42de70 100644
+index 1d23b92af7e..fbb4b04f3cf 100644
 --- a/src/util/disk_cache.c
 +++ b/src/util/disk_cache.c
-@@ -194,8 +194,10 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -218,8 +218,10 @@ disk_cache_type_create(const char *gpu_name,
  
     /* Create driver id keys */
     size_t id_size = strlen(driver_id) + 1;
@@ -40,7 +31,7 @@ index 8dbe0938d11..498fe42de70 100644
     cache->driver_keys_blob_size += gpu_name_size;
  
     /* We sometimes store entire structs that contains a pointers in the cache,
-@@ -216,6 +218,7 @@ disk_cache_create(const char *gpu_name, const char *driver_id,
+@@ -240,6 +242,7 @@ disk_cache_type_create(const char *gpu_name,
     uint8_t *drv_key_blob = cache->driver_keys_blob;
     DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
     DRV_KEY_CPY(drv_key_blob, driver_id, id_size)
@@ -49,13 +40,13 @@ index 8dbe0938d11..498fe42de70 100644
     DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
     DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
 diff --git a/src/util/meson.build b/src/util/meson.build
-index cd44e49bfb4..f17115515a5 100644
+index eb88f235c47..eae5c54cc10 100644
 --- a/src/util/meson.build
 +++ b/src/util/meson.build
-@@ -268,7 +268,12 @@ _libmesa_util = static_library(
-   include_directories : [inc_include, inc_src, inc_mapi, inc_mesa, inc_gallium, inc_gallium_aux],
+@@ -286,7 +286,12 @@ _libmesa_util = static_library(
+   include_directories : [inc_util, include_directories('format')],
    dependencies : deps_for_libmesa_util,
-   link_with: [libmesa_format, libmesa_util_sse41],
+   link_with: [libmesa_util_sse41],
 -  c_args : [c_msvc_compat_args],
 +  c_args : [
 +    c_msvc_compat_args,
diff --git a/pkgs/development/libraries/mesa/opencl.patch b/pkgs/development/libraries/mesa/opencl.patch
index fb4da5cf7a0a..cd27f0a2e86f 100644
--- a/pkgs/development/libraries/mesa/opencl.patch
+++ b/pkgs/development/libraries/mesa/opencl.patch
@@ -1,8 +1,8 @@
 diff --git a/meson.build b/meson.build
-index 172c64a7c70..05961e56926 100644
+index fbb0b29322d..b4825056449 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1900,7 +1900,7 @@ endif
+@@ -1805,7 +1805,7 @@ endif
  
  dep_clang = null_dep
  if with_clc
@@ -12,12 +12,12 @@ index 172c64a7c70..05961e56926 100644
    dep_clang = cpp.find_library('clang-cpp', dirs : llvm_libdir, required : false)
  
 diff --git a/meson_options.txt b/meson_options.txt
-index 6f307018815..ab84eb1006c 100644
+index e885ba61a8a..591ed957c85 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -18,6 +18,12 @@
- # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- # SOFTWARE.
+@@ -23,6 +23,12 @@ option(
+   description : 'the window system EGL assumes for EGL_DEFAULT_DISPLAY',
+ )
  
 +option(
 +  'clang-libdir',
@@ -26,10 +26,10 @@ index 6f307018815..ab84eb1006c 100644
 +  description : 'Locations to search for clang libraries.'
 +)
  option(
-   'platforms',
-   type : 'array',
+   'android-stub',
+   type : 'boolean',
 diff --git a/src/gallium/targets/opencl/meson.build b/src/gallium/targets/opencl/meson.build
-index db3586bd7fb..4d914206d21 100644
+index 7c14135898e..74dc6850603 100644
 --- a/src/gallium/targets/opencl/meson.build
 +++ b/src/gallium/targets/opencl/meson.build
 @@ -39,7 +39,8 @@ if dep_llvm.version().version_compare('>=10.0.0')
@@ -48,19 +48,19 @@ index db3586bd7fb..4d914206d21 100644
      output : 'mesa.icd',
 -    install : true,
 +    install : false,
+     install_tag : 'runtime',
      install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
    )
- 
 diff --git a/src/gallium/targets/rusticl/meson.build b/src/gallium/targets/rusticl/meson.build
-index a968dee52db..69475cf3133 100644
+index b2963fe6dfa..99d6d801b94 100644
 --- a/src/gallium/targets/rusticl/meson.build
 +++ b/src/gallium/targets/rusticl/meson.build
-@@ -58,7 +58,7 @@ configure_file(
+@@ -76,7 +76,7 @@ configure_file(
    configuration : _config,
    input : 'rusticl.icd.in',
    output : 'rusticl.icd',
 -  install : true,
 +  install : false,
+   install_tag : 'runtime',
    install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
  )
- 
diff --git a/pkgs/development/libraries/mlt/default.nix b/pkgs/development/libraries/mlt/default.nix
index 22a38921ec49..abe368f2ea62 100644
--- a/pkgs/development/libraries/mlt/default.nix
+++ b/pkgs/development/libraries/mlt/default.nix
@@ -30,8 +30,7 @@
 , enablePython ? false
 , python3
 , swig
-, enableQt ? false
-, libsForQt5
+, qt ? null
 , enableSDL1 ? stdenv.isLinux
 , SDL
 , enableSDL2 ? true
@@ -60,8 +59,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals enablePython [
     python3
     swig
-  ] ++ lib.optionals enableQt [
-    libsForQt5.wrapQtAppsHook
+  ] ++ lib.optionals (qt != null) [
+    qt.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -87,9 +86,10 @@ stdenv.mkDerivation rec {
     glib
     ladspa-sdk
     ladspaPlugins
-  ] ++ lib.optionals enableQt [
-    libsForQt5.qtbase
-    libsForQt5.qtsvg
+  ] ++ lib.optionals (qt != null) [
+    qt.qtbase
+    qt.qtsvg
+    (qt.qt5compat or null)
   ] ++ lib.optionals enableSDL1 [
     SDL
   ] ++ lib.optionals enableSDL2 [
@@ -104,13 +104,15 @@ stdenv.mkDerivation rec {
     "-DMOD_OPENCV=ON"
   ] ++ lib.optionals enablePython [
     "-DSWIG_PYTHON=ON"
+  ] ++ lib.optionals (qt != null) [
+    "-DMOD_QT${lib.versions.major qt.qtbase.version}=ON"
   ];
 
   preFixup = ''
     wrapProgram $out/bin/melt \
       --prefix FREI0R_PATH : ${frei0r}/lib/frei0r-1 \
       ${lib.optionalString enableJackrack "--prefix LADSPA_PATH : ${ladspaPlugins}/lib/ladspa"} \
-      ${lib.optionalString enableQt "\${qtWrapperArgs[@]}"}
+      ${lib.optionalString (qt != null) "\${qtWrapperArgs[@]}"}
 
   '';
 
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index 55e09511aab1..63308f385036 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.90";
-  hash = "sha256-ZEG6ZcEymQ8Yw02ziT2LFWuvwZ1rRuT93rRHGYM22yQ=";
+  version = "3.90.1";
+  hash = "sha256-5Fx0p2WP/LbGIqfhm6+zEab71UZPWBubCUGBEKQIsX8=";
 }
diff --git a/pkgs/development/libraries/nv-codec-headers/12_x.nix b/pkgs/development/libraries/nv-codec-headers/12_x.nix
index 1ad0076eeb20..dcbb34e33cdb 100644
--- a/pkgs/development/libraries/nv-codec-headers/12_x.nix
+++ b/pkgs/development/libraries/nv-codec-headers/12_x.nix
@@ -5,12 +5,12 @@
 
 stdenv.mkDerivation rec {
   pname = "nv-codec-headers";
-  version = "12.0.16.0";
+  version = "12.1.14.0";
 
   src = fetchgit {
     url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
     rev = "n${version}";
-    sha256 = "sha256-8YZU9pb0kzat0JBVEotaZUkNicQvLNIrIyPU9KTTjwg=";
+    sha256 = "sha256-WJYuFmMGSW+B32LwE7oXv/IeTln6TNEeXSkquHh85Go=";
   };
 
   makeFlags = [
diff --git a/pkgs/development/libraries/opencollada/default.nix b/pkgs/development/libraries/opencollada/default.nix
index d05822174339..340b1299e832 100644
--- a/pkgs/development/libraries/opencollada/default.nix
+++ b/pkgs/development/libraries/opencollada/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libxml2, pcre
+{ lib, stdenv, fetchFromGitHub, fetchurl, cmake, pkg-config, libxml2, pcre
 , darwin}:
 
 stdenv.mkDerivation rec {
@@ -13,12 +13,20 @@ stdenv.mkDerivation rec {
     sha256 = "1ym16fxx9qhf952vva71sdzgbm7ifis0h1n5fj1bfdj8zvvkbw5w";
   };
 
+  patches = [
+    # fix build with gcc 13
+    (fetchurl {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/opencollada/files/opencollada-1.6.68-gcc13.patch?id=b76590f9fb8615da3da9d783ad841c0e3881a27b";
+      hash = "sha256-uimeLGHgXaFi61mmoaloJ5vo83c8EIQmtHEMngC2Nq4=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ AGL ]);
 
   propagatedBuildInputs = [ libxml2 pcre ];
 
-  patchPhase = ''
+  postPatch = ''
     patch -p1 < ${./pcre.patch}
   '' + lib.optionalString stdenv.isDarwin ''
     substituteInPlace GeneratedSaxParser/src/GeneratedSaxParserUtils.cpp \
diff --git a/pkgs/development/libraries/plasma-wayland-protocols/default.nix b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
index d749744d51ed..9f2798ce51b6 100644
--- a/pkgs/development/libraries/plasma-wayland-protocols/default.nix
+++ b/pkgs/development/libraries/plasma-wayland-protocols/default.nix
@@ -7,11 +7,11 @@
 
 mkDerivation rec {
   pname = "plasma-wayland-protocols";
-  version = "1.10.0";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-MZSIZ8mgRhPm3g0jrfy8Ws7N3vCzn5hrNF7GwZcnNv4=";
+    hash = "sha256-FIO/0nnLkTyDV5tdccWPmVh2T5ukMDs2R+EAfLcNT54=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 80badcdd4dbd..dabba056b487 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -9,7 +9,6 @@
 , mesonEmulatorHook
 , ninja
 , perl
-, rsync
 , python3
 , fetchpatch
 , gettext
@@ -72,7 +71,6 @@ stdenv.mkDerivation rec {
     meson
     ninja
     perl
-    rsync
 
     # man pages
     libxslt
@@ -131,7 +129,7 @@ stdenv.mkDerivation rec {
   # at install time but Meson does not support this
   # so we need to convince it to install all files to a temporary
   # location using DESTDIR and then move it to proper one in postInstall.
-  DESTDIR = "${placeholder "out"}/dest";
+  env.DESTDIR = "dest";
 
   inherit doCheck;
 
@@ -165,19 +163,15 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # Move stuff from DESTDIR to proper location.
-    # We use rsync to merge the directories.
-    rsync --archive "${DESTDIR}/etc" "$out"
-    rm --recursive "${DESTDIR}/etc"
-    rsync --archive "${DESTDIR}${system}"/* "$out"
-    rm --recursive "${DESTDIR}${system}"/*
-    rmdir --parents --ignore-fail-on-non-empty "${DESTDIR}${system}"
+    # We need to be careful with the ordering to merge without conflicts.
     for o in $(getAllOutputNames); do
-        rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
-        rm --recursive "${DESTDIR}/''${!o}"
+        mv "$DESTDIR/''${!o}" "''${!o}"
     done
-    # Ensure the DESTDIR is removed.
-    destdirContainer="$(dirname "${DESTDIR}")"
-    pushd "$destdirContainer"; rmdir --parents "''${DESTDIR##$destdirContainer/}${builtins.storeDir}"; popd
+    mv "$DESTDIR/etc" "$out"
+    mv "$DESTDIR${system}/share"/* "$out/share"
+    # Ensure we did not forget to install anything.
+    rmdir --parents --ignore-fail-on-non-empty "$DESTDIR${builtins.storeDir}" "$DESTDIR${system}/share"
+    ! test -e "$DESTDIR"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/precice/default.nix b/pkgs/development/libraries/precice/default.nix
index 28b5c3fa85e1..885945599e93 100644
--- a/pkgs/development/libraries/precice/default.nix
+++ b/pkgs/development/libraries/precice/default.nix
@@ -18,7 +18,11 @@ stdenv.mkDerivation rec {
     "-DPYTHON_INCLUDE_DIR=${python3}/include/${python3.libPrefix}"
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [ "-D_GNU_SOURCE" ]);
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.isDarwin [ "-D_GNU_SOURCE" ]
+    # libxml2-2.12 changed const qualifiers
+    ++ [ "-fpermissive" ]
+  );
 
   nativeBuildInputs = [ cmake gcc ];
   buildInputs = [ boost eigen libxml2 mpi python3 python3.pkgs.numpy ];
diff --git a/pkgs/development/libraries/proj/7.nix b/pkgs/development/libraries/proj/7.nix
index 4e1ade0bd56b..cfd115638802 100644
--- a/pkgs/development/libraries/proj/7.nix
+++ b/pkgs/development/libraries/proj/7.nix
@@ -46,6 +46,10 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DUSE_EXTERNAL_GTEST=ON"
   ];
+  CXXFLAGS = [
+    # GCC 13: error: 'int64_t' in namespace 'std' does not name a type
+    "-include cstdint"
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/proj/default.nix b/pkgs/development/libraries/proj/default.nix
index fedb1b003d96..e07a3cd49ef7 100644
--- a/pkgs/development/libraries/proj/default.nix
+++ b/pkgs/development/libraries/proj/default.nix
@@ -45,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: rec {
     "-DNLOHMANN_JSON_ORIGIN=external"
     "-DEXE_SQLITE3=${buildPackages.sqlite}/bin/sqlite3"
   ];
+  CXXFLAGS = [
+    # GCC 13: error: 'int64_t' in namespace 'std' does not name a type
+    "-include cstdint"
+  ];
 
   preCheck =
     let
diff --git a/pkgs/development/libraries/qca-qt5/default.nix b/pkgs/development/libraries/qca-qt5/default.nix
deleted file mode 100644
index 336a9e63ca63..000000000000
--- a/pkgs/development/libraries/qca-qt5/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib, stdenv, fetchurl, cmake, openssl, pkg-config, qtbase }:
-
-stdenv.mkDerivation rec {
-  pname = "qca-qt5";
-  version = "2.3.6";
-
-  src = fetchurl {
-    url = "http://download.kde.org/stable/qca/${version}/qca-${version}.tar.xz";
-    sha256 = "sha256-7lnVMdS4L7FoX02NdMLKoHd/UBgA90JuqjchCaQwUkk=";
-  };
-
-  buildInputs = [ openssl qtbase ];
-  nativeBuildInputs = [ cmake pkg-config ];
-
-  dontWrapQtApps = true;
-
-  # tells CMake to use this CA bundle file if it is accessible
-  preConfigure = "export QC_CERTSTORE_PATH=/etc/ssl/certs/ca-certificates.crt";
-
-  # tricks CMake into using this CA bundle file if it is not accessible (in a sandbox)
-  cmakeFlags = [ "-Dqca_CERTSTORE=/etc/ssl/certs/ca-certificates.crt" ];
-
-  meta = with lib; {
-    description = "Qt 5 Cryptographic Architecture";
-    homepage = "http://delta.affinix.com/qca";
-    maintainers = with maintainers; [ ttuegel ];
-    license = licenses.lgpl21Plus;
-    platforms = with platforms; unix;
-  };
-}
diff --git a/pkgs/development/libraries/qca/default.nix b/pkgs/development/libraries/qca/default.nix
new file mode 100644
index 000000000000..6e2afe6f0deb
--- /dev/null
+++ b/pkgs/development/libraries/qca/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchurl, cmake, openssl, pkg-config, qtbase, qt5compat ? null }:
+
+let
+  isQt6 = lib.versions.major qtbase.version == "6";
+in stdenv.mkDerivation rec {
+  pname = "qca";
+  version = "2.3.7";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/qca/${version}/qca-${version}.tar.xz";
+    sha256 = "sha256-/uI0O1RofVvj4w+zPOKW7lCseuXiPXq3JfY//fevP0M=";
+  };
+
+  buildInputs = [ openssl qtbase qt5compat ];
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  dontWrapQtApps = true;
+
+  # tells CMake to use this CA bundle file if it is accessible
+  preConfigure = "export QC_CERTSTORE_PATH=/etc/ssl/certs/ca-certificates.crt";
+
+  cmakeFlags = [
+    (lib.cmakeBool "QT6" isQt6)
+    # tricks CMake into using this CA bundle file if it is not accessible (in a sandbox)
+    "-Dqca_CERTSTORE=/etc/ssl/certs/ca-certificates.crt"
+  ];
+
+  meta = with lib; {
+    description = "Qt Cryptographic Architecture";
+    homepage = "https://invent.kde.org/libraries/qca";
+    maintainers = with maintainers; [ ttuegel ];
+    license = licenses.lgpl21Plus;
+    platforms = with platforms; unix;
+  };
+}
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index 817129349718..55ff3497baba 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,202 +1,202 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "c1f8fa2578d99e07f5e581f26bd532695b9534f9",
-    "sha256": "19wsf9capc8i5157hfp8g735scpcms329ylp0fg86j9qalg7ccwg"
+    "rev": "e1b1a0d2970fd384bd52c734a72536d8452ad070",
+    "sha256": "14q7xf6n8giz5v1s23ndibiv4d6g0ds4v88bx5v984319qxyvpqh"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "2ed4be9e852d2533b982493a26bf061b245dc106",
-    "sha256": "0v6fwykibl4d20sdh10inaavpzwp5ijpyw8k31078shw3hsgkqxf"
+    "rev": "4fc1cba4c415d84a5879da29f7c459b70fbc15e9",
+    "sha256": "0mrw7rr6fnjkjxx882ga253kzn4di1agikyq6h9ixwfn2j242qlq"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "3d30862e761afd5fe8451857bb531b6fb8f63dc3",
-    "sha256": "0sq4dgk88n96wja1wp6j5swxhz8wksf1v4sibywvg7v431nfy82p"
+    "rev": "12d064b16117c6f3418b494c927ef72cf1927929",
+    "sha256": "1rcpldpzwbmyww50rh58avmhgj93ks40bwm0bqz7dgwakm4n76lj"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "ea7a183732c17005f08ca14fd70cdd305c90396d",
-    "sha256": "0lblir4zcnxc2ix9frcsygkhfs5qx7xibpflapmi6d978jjfxjmx"
+    "rev": "8907dedc858cc344d770a2e826d6acc516429540",
+    "sha256": "185fmglzb3blfpk6vjd716xr4cx4grxpbqji5idddl4887w18s91"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "e17308d5ce83a8b66aeeaaaf16ce16d4ee6b2826",
-    "sha256": "1igna3qdwpaf67lhj0m743cj127hyg73ynjhadhjk3gz34h12r09"
+    "rev": "393a84ad5b16a9ec93d8a44bebf1ae86e881bc06",
+    "sha256": "1ki307wkm3wxf3jc508zgdr5p7fb297hf0rdg5x1hyv7qb03bvxx"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "e33b82889625b6a72e0be91c5023a30d53136a80",
-    "sha256": "17yxmj1xd2q0a2in6aygp88bsg1vivklmzjwi97llbmvcxxvzhfn"
+    "rev": "70020cb64f71dcf2fd65a8a167cb785d2127e159",
+    "sha256": "10kajc98avdz8a7f5ifrrrzwrkdlbsdmiamh7blsnfcix1063ihq"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "d7af24d26b9fbb83bf57b2b7245d280eb78e8b22",
-    "sha256": "1h85cn4qabva8fcr69b35cmy9c7vbk2fz8licw5ca42bq141k4kw"
+    "rev": "c887477198cae44585fe9db371db0ddf4c3b205e",
+    "sha256": "0fkw096w81lzdj7zgc6xfy719lh10x3f7mqm832mjq86h8f3gyc5"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "1b0e366092bcfae0392592c3b7891f0e47af1018",
-    "sha256": "0fif6gbin3clvy7rfvrs5qdjqvi3ql9yciiwdbm7z0by2kzz1qsg"
+    "rev": "792a55bb701d233116c3731c7a53ffdb8c67e407",
+    "sha256": "1d87mkl3dj3ysham1rrfxw07jvc5jqh8g2w8psv5858i29aclyqn"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "c8af0c56f1765302f8bdf874dfacb11c4e0bf4e3",
-    "sha256": "161wm1pq732nnbx8jbmiv1g1ziqzjwy48dpasy3zgj4i83qyvdas"
+    "rev": "8a3dfe33cb4f1e81b609f41716a3f0610a50db72",
+    "sha256": "18x3gn6wv8vm5wfa6hjfzbkxcpclnwi4s3mbbc3hj9yar53hznqp"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "4b52913503e3713200265cd6bc19b301792dbf96",
-    "sha256": "1n5pafxarhb4rsvr18al4hyc6xmm5nhjkknrnhdldy9vz7w50bgs"
+    "rev": "8ed95136b3c265b01db6cc33869228f41878e173",
+    "sha256": "1m774ah9c1didj60rph6p4gibyqgynmdqngqkq1bv1p7m2jkq1ss"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "cce7d784237cd2dd4af1abe2757d048e34e02685",
-    "sha256": "1yvxpkfxd44z9z44mfv77lfsbgjlmxz1rilblpp8h276zc5w6l5z"
+    "rev": "e33716bd6bb8926688fef20cb568e11618d08a35",
+    "sha256": "1klm5rhx6lpc0knhc15lz6sj07znv2d601gbi360wfqkvbi3g78p"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "b22bf4d0d77c7dafe8b4622f8bb45ac0b9cc9bdd",
-    "sha256": "0gz1par4gkcwwbxh0g1n1lrzyjjmi53gqfmbb222gkf5k8kf0r2i"
+    "rev": "142040e8a652e708ff6e004361f6bcfe85fefdf9",
+    "sha256": "1vc1ahanm40bh8qj3x2x4d4niihsrjai298alxfcxinfrsmw9m32"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "48a17e88fc1df5b6ae82a9787466226c830bcbf2",
-    "sha256": "0gn4zsf01xr0g8divixk2zpq97dnqs1cdc3q577ijczd2rcs6z4f"
+    "rev": "5b27b8921f1f2de93573df903c47aee634209f80",
+    "sha256": "1w8hq3mdlrdkkykhza4dx0f21j6k697xqqvpm2g2xyk2izadq2m0"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "909b79f4810b8ac62baa3544837793cfb132593b",
-    "sha256": "1bh5418nshzlgc3xf8yg1c0n70xcazr3ya9fdfn1xs3yhxdxcd8h"
+    "rev": "db33cc9a4c0bad1006dbc9ed46d71b80ee284df3",
+    "sha256": "1wjzhk6zn0vh9fjldpi5gi7qlpgfc2gcznh3a7icpbx7n9cc9qh5"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "cc717d0093d796e6bafb65892e6825f146c1d3cd",
-    "sha256": "1cdal8yfjwgl30fh2s5s45hy1mw70n8bfdsbx8q6j4g062dr16zd"
+    "rev": "4cb89b861dbdbe8733c62bcdadc0a8d6617528a5",
+    "sha256": "1pygs8l1nk7mgqcgv7ilwx87i9i8jxwxn2h8fcqqvgn96c5sd9kg"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "f587b18db4abd68cb6d4d77fbcec1b94c38d2a51",
-    "sha256": "16b3yaq7i0cs9sw8q5f98g9kzphy3kwy0nw6hzznnzpkmg0pgkv1"
+    "rev": "36603a39aa590c12cbe2b192b56b29edd09a7a6b",
+    "sha256": "1i6hfddkwf0x74kxz5vrjkc3r507m6icr59p8b6n1bms5y5731j6"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "1e3f2196bd45a5ee272b08b1d82cef29aaa89b61",
-    "sha256": "1jshzvsa2nnckakiybh6q7f0wdl5p04b6mymxvjzzphr0q32qn75"
+    "rev": "3fccc9b8fdaff1252fb4a9c516868d0bbbd4384d",
+    "sha256": "0h0i6r5w2vdmm9nxyk8vzdim739fja4ddf42s9pa25r1vs6i9rdw"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "736144c5827385000e391e9a55a0f0162b7e8112",
-    "sha256": "1djvj4glxc360my597g81aqjmrhk46447x5s2jj81yiflppvkbny"
+    "rev": "f563e7f2d1668a3d216e9d396e050df25fd15532",
+    "sha256": "1kbzf8nadia31sfc4r53p3p733i85w23yznwp2fc2117z81vd9p7"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "f3c3c2041f4800a7fc1904771f5c6af036167dc9",
-    "sha256": "1xsxhx20spj50jmsqd5f2qa7kmr9rn08c22zkckhrgic73188dpg"
+    "rev": "d4f5966ba085a1146a04f2ea8449bbf14833a593",
+    "sha256": "05617q59ldzavm79bf3vgz2sc4paa6d4s0q7adqzpnib6pryr2xj"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "dcc90558d9c0cba41eec7df290943994289b0e87",
-    "sha256": "0xccglsr1c519lyfg58hj6aa34zfyxc4zff360kd84yxmp8r4y9i"
+    "rev": "1ca962198a703f591efc7c8f7540fc4120746a00",
+    "sha256": "1r4z0lfcs1mhdmxgd7saw49p5y2009a0vxn043v0z2w47yrqprb6"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "a2d56960dd76c94a5115b5415be5ee174d377718",
-    "sha256": "03wikwwf329wzml59hw0mqqzqjqfp95k8bvifi21zgrnjfl8rsrr"
+    "rev": "134ca5dbef9d137a9c46faa79b0225bc650d9283",
+    "sha256": "09r6a0vdpyxzrhx6h49v9nyky3xzgm0z1wd320qi3zh7baxxrzm4"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "b1b4b882dabaa036c3fb73c4a879ba8efbb02ded",
-    "sha256": "07zaziin88y5cq9xy4dsfw2y7njs92qq00mg42350g1s6zqrlbv2"
+    "rev": "58f4f22662023efe6f223d5ef4a6d0be3708182b",
+    "sha256": "15braxxp4ldvfqxz7a1xywskycmkwv88cypgaxfipkis9jvaykdi"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "bdc316aca82769b43cb7821c10d80a1ca02b846e",
-    "sha256": "136izb42sdy42lr5amh343f97s59fwf3mv44dg5n8jwg0mg7s67b"
+    "rev": "f64e34be9ac4b7e92c63e47235c04471a1d40c93",
+    "sha256": "1hjg1vimipszcdk89ivq1iym05m9yz2li6chyg52n1wqjm628gx1"
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "e8727aabe55526956295407d27317ec15e12b283",
-    "sha256": "1gyas1prkvnmxlvb90s9qzpy1frk8c4b7n0wnjn0vkfp0cmv3w52"
+    "rev": "3f56c6b4bd1e3883581340243b4a7289807fffc9",
+    "sha256": "15yhdp77p4i1as53cssx038hwmqjh2zgh35hrad4mhk4g6za85na"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "a41492b23cde20d1e00427d31e4637d06aea3638",
-    "sha256": "1p9w444bzgixw6a8qarznnr15ayn22k2limsi5mzqanf3j3bd3ml"
+    "rev": "3011b16d63cadbb473b6aa3a535b9f0e33170c09",
+    "sha256": "06d5x03bzbal4npbdl8y74fdizl9phz76q29f798196hjyb0kz05"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "c41785c9f36560722b917d373ee97eed8cc4089a",
-    "sha256": "05nvzh9lbkbsghpdb3q26nbxgdq5007xak8zxwd3cz9mhqy8xnyc"
+    "rev": "c64de6ad9f646aaa66fca0500d21cde802a7bb17",
+    "sha256": "09jp80yrql450bz7c2rfjyyfy0zd59kmrc0lww5ws0lyp95n116y"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "3380465d5d4977326616c5e57789a81681be650e",
-    "sha256": "06dzraplqhidkngl3sjb3sppqpvc8v8ahrjz06dnsh1dwj8hizh7"
+    "rev": "c3a7debff7a4c6ddaedb795290180dd99d7ac4be",
+    "sha256": "1aslr9msddnrkxrlzplbzpfydjkiw1haa67mcsmr2phxkfh05329"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "3b163bfd46d96bc9ee848dcee49e9cabe6699287",
-    "sha256": "03d4qvxfzwcfgbjdrpq0hvnhbz8bj6diphwiywdp16kvfmp13g9f"
+    "rev": "c41437acf07c2c4703351b07925fce3ce0e6b75d",
+    "sha256": "1ihv2k4swbhd4kiaprrjgq8kmx3vrg64y2dqkvg6nd26dfwhxr0f"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "7d6e373c7db9c05ef586db0eb50c87cd894229ad",
-    "sha256": "1aw9xxfjhm14raj7nivrr1ljnqcmibbbjyrx4bawp58mqbq4as4x"
+    "rev": "5b1b4a99d6bc98c42a11b7a3f6c9f0b0f9e56f34",
+    "sha256": "0ji4kaphlqmlpcvcvlqklhzmdlwv712cvsdxnv41fdab6b49yghw"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "38ae810be3fb4984f75b55a16d3413e35d701af1",
-    "sha256": "0hc65pidlp6lnb3srr2hg3dnas3hdj9cxkp7azcndj3wi36mclwf"
+    "rev": "bd0ceb7de5d0c918ae596150e95b069dca8b9150",
+    "sha256": "100qhcdcnnx0l3sl9zl5p3l7707h7vdbjjk7dmy7ap1r0218m5zy"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "56065158ffc4cd0fd78f9edf4b21b77b969f8dbb",
-    "sha256": "1lyh8hryi6hgw50gz9l6qxjfb72k4a7cg10vw18iffi7yv262g0z"
+    "rev": "f7745c117041e7adf9705e1de8d71086c160dd9f",
+    "sha256": "0nx8qdg3m4wf8pynh4pr1j0m0p1y5pws7fnx5mpqccvwgj4bwrdj"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "817378aa10176fd26eed36542bc657e48d9dd42e",
-    "sha256": "0ihgm8y19zlkp3677rp9hnzm56y74djsnpr78yk0mrbcbxv1hpwb"
+    "rev": "8b885af5ad3c2f2ff500c060a41e312ea7276e50",
+    "sha256": "0mh4bva1msczgwl2x3b960rml5rmxnvvzi1wk94cc51888vyajiv"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "4de268cbaf6ff3b633429577f06d3d746a3b202a",
-    "sha256": "1ris6yxd4igrjvjv7bnxkdr402lk1k0djalkbk5s4z8l4qpavn3y"
+    "rev": "c84d171fa84065fb3b4b6b3d33e7707676d87e47",
+    "sha256": "0vxqp5577xig4m0x9pmc04svjy58pi5f0wvc1b4sk61jhj8vib23"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "f84887c1aee4ab04af375e639ae965c9ea2186a5",
-    "sha256": "0pn4ly4lyf0db9pfb80q45zssifjg3466hnw7ryxnm4331izvbja"
+    "rev": "6d2f0c3a36d9b2cdcd759a464c608365a0afda98",
+    "sha256": "1aqhvniysjc14xqcwvqhylcd4lpsl5vsym0spfahxs55s9jsvbyl"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "ddcff45e8f2ca9f229017b3ded62327d2fb50af2",
-    "sha256": "1ybc94jidzqhrkm0v2daqq0nm34ydqpcgd8q4qhz9abi0ccj17s4"
+    "rev": "8f879e6bcf941a612c568fbfe2b49ddb1bb409cd",
+    "sha256": "02glac0m95naxl5c6n22xclxhp7fjl1whf6sf3388h41wwdhv11c"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "d41bb9f4f7ab9d5ff184ef94cf2f6ff7cf01de00",
-    "sha256": "0pc14sd1dzrw599kdjg1309l9hf9ylp0pnyv7i6s2pyfqqq0x85r"
+    "rev": "9a7b9972a54137d5f2e0d49559fe58d07c90662e",
+    "sha256": "1hcf18cls9kmq4xjxzjm2viqs80pxr4ykrzx0vg1bd83bc509vqp"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "f078642eb9a440f6aa88f2beaf10f445de1e29bb",
-    "sha256": "0qak3y3qaxs6lf34y8rcp922sqd08nvag0lvl7znxm8d5b7qmnn6"
+    "rev": "53fa44709992faae54e4f5c8a128cea7b6f0cbd5",
+    "sha256": "12w6znmy2hijcnwqqva8abydcryh6jcp8lhx0kz0m3cvhwpq1fbx"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "1bf19cc6a7972d8543485786418b6631459d3469",
-    "sha256": "09a6xacb0zsp44w5zz15lkh6sypy7y1xg7m1fkxj2n26wbdc2p52"
+    "rev": "ee931eba5d129284d5c33157cd7d0b9232fbee7b",
+    "sha256": "17fyfkm8qfl9jmlq3ppnqwdx47230bk2laikfbq2188vn42yxnqv"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "5fb2e067a38d3583684310130f5d8aad064f512f",
-    "sha256": "1whfsdmyihnzzy3ijh5wcbsw9ppg3s5nx2insw5yrx36iz0y054d"
+    "rev": "aaa54153970d1d63a44b873cad5f62ffa71ef9b8",
+    "sha256": "0q34pi4mqqi4vzk57f59xsk303jgpk1fkxvnvm9r08jkckxxbisw"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "5a1948ddc05bf44017ac12bd5c2b9bc79fbcb9a2",
-    "sha256": "0613zb8lzd1i2g5kbn7h39warx7hn1z5qi28zk8l88ivpn84dx4q"
+    "rev": "6e0917d518e07f737cc663b8d632c8021634fd3b",
+    "sha256": "062riy66z3v1fxrdnbdhafqdv67xqz12pscidj4fhhp9fzi92a45"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 130fcd332ba4..5ac474afeda3 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,7 +1,7 @@
 { lib, fetchgit, fetchFromGitHub }:
 
 let
-  version = "5.15.11";
+  version = "5.15.12";
 
   mk = name: args:
     {
@@ -70,24 +70,24 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
   };
 
   qtscript = rec {
-    version = "5.15.15";
+    version = "5.15.16";
 
     src = fetchFromGitHub {
       owner = "qt";
       repo = "qtscript";
       rev = "v${version}-lts";
-      hash = "sha256-o2YG1m3LuG9Kq9Bqi1wRa6ceHsivK+hJR7w08NE/kBo=";
+      hash = "sha256-4Jqsmk5EBQ2Biv69yYCNx7l7AWFikRMBfl0fbZcsSaA=";
     };
   };
 
   qtwebengine = rec {
-    version = "5.15.15";
+    version = "5.15.16";
 
     src = fetchFromGitHub {
       owner = "qt";
       repo = "qtwebengine";
       rev = "v${version}-lts";
-      hash = "sha256-AmW3u8D9Y8lXZu0aiuxYXNPzZ5GCXeBQGfAcgFuXAh4=";
+      hash = "sha256-Arg/tfJcx9+CSV1VXBieHNoCSwmWNTnyBdgSkthOdfA=";
       fetchSubmodules = true;
     };
   };
diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
index 4adcf8ab0a3b..affb512a22f2 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
@@ -131,6 +131,10 @@ qtModule {
 
     # Override locales install path so they go to QtWebEngine's $out
     ../patches/qtwebengine-locales-path.patch
+
+    # Cherry-pick libxml 2.12 build fix
+    # FIXME: remove for 6.7
+    ../patches/qtwebengine-libxml-2.12.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch b/pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch
new file mode 100644
index 000000000000..1fc7d837f8f3
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/qtwebengine-libxml-2.12.patch
@@ -0,0 +1,22 @@
+--- a/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor.h
++++ b/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor.h
+@@ -77,7 +77,7 @@ class XSLTProcessor final : public ScriptWrappable {
+ 
+   void reset();
+ 
+-  static void ParseErrorFunc(void* user_data, xmlError*);
++  static void ParseErrorFunc(void* user_data, const xmlError*);
+   static void GenericErrorFunc(void* user_data, const char* msg, ...);
+ 
+   // Only for libXSLT callbacks
+--- a/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor_libxslt.cc
++++ b/src/3rdparty/chromium/third_party/blink/renderer/core/xml/xslt_processor_libxslt.cc
+@@ -66,7 +66,7 @@ void XSLTProcessor::GenericErrorFunc(void*, const char*, ...) {
+   // It would be nice to do something with this error message.
+ }
+ 
+-void XSLTProcessor::ParseErrorFunc(void* user_data, xmlError* error) {
++void XSLTProcessor::ParseErrorFunc(void* user_data, const xmlError* error) {
+   FrameConsole* console = static_cast<FrameConsole*>(user_data);
+   if (!console)
+     return;
diff --git a/pkgs/development/libraries/qtforkawesome/default.nix b/pkgs/development/libraries/qtforkawesome/default.nix
index 0841c0d457fd..432023a2ac65 100644
--- a/pkgs/development/libraries/qtforkawesome/default.nix
+++ b/pkgs/development/libraries/qtforkawesome/default.nix
@@ -40,6 +40,7 @@ in stdenv.mkDerivation (finalAttrs: {
     qtutilities
   ];
   cmakeFlags = [
+    "-DQT_PACKAGE_PREFIX=Qt${lib.versions.major qtbase.version}"
     # Current freetype used by NixOS users doesn't support the `.woff2` font
     # format, so we use ttf. See
     # https://github.com/NixOS/nixpkgs/pull/174875#discussion_r883423881
diff --git a/pkgs/development/libraries/qtutilities/default.nix b/pkgs/development/libraries/qtutilities/default.nix
index cbbd79eb504f..797e9fb891b6 100644
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
+    "-DQT_PACKAGE_PREFIX=Qt${lib.versions.major qtbase.version}"
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index 73092a803d66..6c6fa1d6be95 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.56";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VS/85qu0Dc3HSeD0DYm2f4ur+ZRPhb1Srf7BeK7Pdfk=";
+    hash = "sha256-Kq4jl/ss+Xf5/zv18QWuIyXZDyz8mk3av4mdRoQrvJY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index ec4cc458c4b5..eb4d975a6e01 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.43.2";
+  version = "3.44.2";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-bUIrb2LE3iyoDWGGDjo/tpNVTS91uxqsp0PMxNb2CfA=";
+    hash = "sha256-HGcZoUi8Qc8PK7vjkm184/XKCdh48SRvzCB2exdbtAc=";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 6028c638a7ec..dd092dd0f043 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.43.2";
+    version = "3.44.2";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-62ZRUj9XpccPJC/Ba8QWuB7QLVkmOb+34JnyAeL5otM=";
+      hash = "sha256-cxh0c/63RQk1fo+my5/WcVOy0BDQCusv3bbO6xirryc=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/srt/default.nix b/pkgs/development/libraries/srt/default.nix
index d25aab35da22..5ba8039ccff8 100644
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
     # (setting it to an absolute path causes include files to go to $out/$out/include,
     #  because the absolute path is interpreted with root at $out).
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-DENABLE_SHARED=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
     # TODO Remove this when https://github.com/Haivision/srt/issues/538 is fixed and available to nixpkgs
     # Workaround for the fact that srt incorrectly disables GNUInstallDirs when LIBDIR is specified,
     # see https://github.com/NixOS/nixpkgs/pull/54463#discussion_r249878330
diff --git a/pkgs/development/libraries/tbb/default.nix b/pkgs/development/libraries/tbb/default.nix
index b6cc969b9f78..5523ae429c26 100644
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@@ -34,6 +34,16 @@ stdenv.mkDerivation rec {
       url = "https://patch-diff.githubusercontent.com/raw/oneapi-src/oneTBB/pull/866.patch";
       hash = "sha256-e44Yv84Hfl5xoxWWTnLJLSGeNA1RBbah4/L43gPLS+c=";
     })
+
+    # Fix build with GCC 13
+    (fetchpatch {
+      url = "https://github.com/oneapi-src/oneTBB/commit/154cc73ca4d359621202399cc0c3c91058e56e79.patch";
+      hash = "sha256-BVQQXgBg8T19DGw2gmFkm3KKOuzzJJNOTf/iNIcnHag=";
+    })
+    (fetchpatch {
+      url = "https://github.com/oneapi-src/oneTBB/commit/e131071769ee3df51b56b053ba6bfa06ae9eff25.patch";
+      hash = "sha256-IfV/DDb0luxE1l6TofAbQIeJEVxCxZfZqcONGwQEndY=";
+    })
   ];
 
   # Fix build with modern gcc
diff --git a/pkgs/development/libraries/termcolor/default.nix b/pkgs/development/libraries/termcolor/default.nix
index fbae29f4ca58..f29776226dc2 100644
--- a/pkgs/development/libraries/termcolor/default.nix
+++ b/pkgs/development/libraries/termcolor/default.nix
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [ "-DTERMCOLOR_TESTS=ON" ];
+  CXXFLAGS = [
+    # GCC 13: error: 'uint8_t' has not been declared
+    "-include cstdint"
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/ubus/default.nix b/pkgs/development/libraries/ubus/default.nix
index bdfe4aa58552..4419b4e67a66 100644
--- a/pkgs/development/libraries/ubus/default.nix
+++ b/pkgs/development/libraries/ubus/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "ubus";
-  version = "unstable-2023-11-14";
+  version = "unstable-2023-11-28";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/ubus.git";
-    rev = "b3e8c4ef07ebb6f0f34a5c1f0dc1539068363619";
-    hash = "sha256-H/QrLMhdEC1LnSxHpp/90OdKbfHRqLVWUnzyQlsVO8c=";
+    rev = "f84eb5998c6ea2d34989ca2d3254e56c66139313";
+    hash = "sha256-5pIovqIeJczWAA9KQPKFnTnGRrIZVdSNdxBR8AEFtO4=";
   };
 
   cmakeFlags = [ "-DBUILD_LUA=OFF" ];
diff --git a/pkgs/development/libraries/unittest-cpp/default.nix b/pkgs/development/libraries/unittest-cpp/default.nix
index e9f67a74f9a3..6a6407eb32ff 100644
--- a/pkgs/development/libraries/unittest-cpp/default.nix
+++ b/pkgs/development/libraries/unittest-cpp/default.nix
@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  # Fix 'Version:' setting in .pc file. TODO: remove once upstreamed:
+  #     https://github.com/unittest-cpp/unittest-cpp/pull/188
+  cmakeFlags = [ "-DPACKAGE_VERSION=${version}" ];
+
   nativeBuildInputs = [ cmake ];
 
   doCheck = false;
diff --git a/pkgs/development/libraries/ustream-ssl/default.nix b/pkgs/development/libraries/ustream-ssl/default.nix
index 6e9655efe442..638685434463 100644
--- a/pkgs/development/libraries/ustream-ssl/default.nix
+++ b/pkgs/development/libraries/ustream-ssl/default.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation {
   pname = "ustream-ssl";
-  version = "unstable-2023-02-25";
+  version = "unstable-2023-11-11";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/ustream-ssl.git";
-    rev = "498f6e268d4d2b0ad33b430f4ba1abe397d31496";
-    hash = "sha256-qwF3pzJ/nUTaJ8NZtgLyXnSozekY3dovxK3ZWHPGORM=";
+    rev = "263b9a97cf7e1e2467319c23832b705fc01190b5";
+    hash = "sha256-RLHU6swNbS3DL3QbKnwU4BbD0EFGKCrHHp0hbnoSssw=";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/vtk/generic.nix b/pkgs/development/libraries/vtk/generic.nix
index 02309b275bdc..73fc650844db 100644
--- a/pkgs/development/libraries/vtk/generic.nix
+++ b/pkgs/development/libraries/vtk/generic.nix
@@ -55,6 +55,18 @@ in stdenv.mkDerivation {
 
   patches = map fetchpatch patchesToFetch;
 
+  # GCC 13: error: 'int64_t' in namespace 'std' does not name a type
+  postPatch = ''
+    sed '1i#include <cstdint>' \
+      -i ThirdParty/libproj/vtklibproj/src/proj_json_streaming_writer.hpp \
+      -i IO/Image/vtkSEPReader.h
+  ''
+  + optionalString stdenv.isDarwin ''
+    sed -i 's|COMMAND vtkHashSource|COMMAND "DYLD_LIBRARY_PATH=''${VTK_BINARY_DIR}/lib" ''${VTK_BINARY_DIR}/bin/vtkHashSource-${majorVersion}|' ./Parallel/Core/CMakeLists.txt
+    sed -i 's/fprintf(output, shift)/fprintf(output, "%s", shift)/' ./ThirdParty/libxml2/vtklibxml2/xmlschemas.c
+    sed -i 's/fprintf(output, shift)/fprintf(output, "%s", shift)/g' ./ThirdParty/libxml2/vtklibxml2/xpath.c
+  '';
+
   dontWrapQtApps = true;
 
   # Shared libraries don't work, because of rpath troubles with the current
@@ -87,12 +99,6 @@ in stdenv.mkDerivation {
     NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-function-pointer-types";
   };
 
-  postPatch = optionalString stdenv.isDarwin ''
-    sed -i 's|COMMAND vtkHashSource|COMMAND "DYLD_LIBRARY_PATH=''${VTK_BINARY_DIR}/lib" ''${VTK_BINARY_DIR}/bin/vtkHashSource-${majorVersion}|' ./Parallel/Core/CMakeLists.txt
-    sed -i 's/fprintf(output, shift)/fprintf(output, "%s", shift)/' ./ThirdParty/libxml2/vtklibxml2/xmlschemas.c
-    sed -i 's/fprintf(output, shift)/fprintf(output, "%s", shift)/g' ./ThirdParty/libxml2/vtklibxml2/xpath.c
-  '';
-
   postInstall = optionalString enablePython ''
     substitute \
       ${./vtk.egg-info} \
diff --git a/pkgs/development/libraries/x264/default.nix b/pkgs/development/libraries/x264/default.nix
index 90fe559c3cf4..a011cf9c2000 100644
--- a/pkgs/development/libraries/x264/default.nix
+++ b/pkgs/development/libraries/x264/default.nix
@@ -32,6 +32,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs .
+  ''
+  # Darwin uses `llvm-strip`, which results in a crash at runtime in assembly-based routines when `-x` is specified.
+  + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile --replace '$(if $(STRIP), $(STRIP) -x $@)' '$(if $(STRIP), $(STRIP) -S $@)'
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/xapian/default.nix b/pkgs/development/libraries/xapian/default.nix
index 73c3b1b57173..243ec53a3234 100644
--- a/pkgs/development/libraries/xapian/default.nix
+++ b/pkgs/development/libraries/xapian/default.nix
@@ -25,6 +25,8 @@ let
     buildInputs = [ libuuid zlib ];
     nativeBuildInputs = [ autoreconfHook ];
 
+    enableParallelBuilding = true;
+
     doCheck = true;
     env.AUTOMATED_TESTING = true; # https://trac.xapian.org/changeset/8be35f5e1/git
 
diff --git a/pkgs/development/libraries/xmlsec/default.nix b/pkgs/development/libraries/xmlsec/default.nix
index 92b662ac4484..2cf0cc3ef8df 100644
--- a/pkgs/development/libraries/xmlsec/default.nix
+++ b/pkgs/development/libraries/xmlsec/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libxml2, gnutls, libxslt, pkg-config, libgcrypt, libtool
+{ stdenv, fetchurl, fetchpatch, libxml2, gnutls, libxslt, pkg-config, libgcrypt, libtool
 , openssl, nss, lib, runCommandCC, writeText }:
 
 lib.fix (self:
@@ -13,6 +13,12 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./lt_dladdsearchdir.patch
+
+    # Fix build with libxml2 2.12
+    (fetchpatch {
+      url = "https://github.com/lsh123/xmlsec/commit/ffb327376f5bb69e8dfe7f805529e45a40118c2b.patch";
+      hash = "sha256-o8CLemOiGIHJsYfVQtNzJNVyk03fdmCbvgA8c3OYxo4=";
+    })
   ] ++ lib.optionals stdenv.isDarwin [ ./remove_bsd_base64_decode_flag.patch ];
   postPatch = ''
     substituteAllInPlace src/dl.c
diff --git a/pkgs/development/libraries/xsimd/default.nix b/pkgs/development/libraries/xsimd/default.nix
index 3a9a90fbe2bc..87da2c546b86 100644
--- a/pkgs/development/libraries/xsimd/default.nix
+++ b/pkgs/development/libraries/xsimd/default.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xsimd";
-  version = "11.2.0";
+  version = "12.1.1";
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
     rev = finalAttrs.version;
-    sha256 = "sha256-CzgfxXGZXoJ56dX+mDPsHZC31YudrZXpX2tovh/Vjr0=";
+    hash = "sha256-ofUFieeRtpnzNv3Ad5oYwKWb2XcqQHoj601TIhydJyI=";
   };
   patches = [
     # Ideally, Accelerate/Accelerate.h should be used for this implementation,
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 27e3c85695fa..2afd4582c361 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1,11 +1,9 @@
 /* pkgs/development/lua-modules/generated-packages.nix is an auto-generated file -- DO NOT EDIT!
-Regenerate it with:
-nixpkgs$ ./maintainers/scripts/update-luarocks-packages
-
+Regenerate it with: nix run nixpkgs#update-luarocks-packages
 You can customize the generated packages in pkgs/development/lua-modules/overrides.nix
 */
 
-{ stdenv, lib, fetchurl, fetchgit, callPackage, ... }:
+{ stdenv, lib, fetchurl, fetchgit, callPackage, ... } @ args:
 final: prev:
 {
 alt-getopt = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
@@ -144,21 +142,21 @@ buildLuarocksPackage {
   };
 }) {};
 
-busted = callPackage({ buildLuarocksPackage, dkjson, fetchgit, fetchurl, lua, lua-term, luaOlder, lua_cliargs, luafilesystem, luassert, luasystem, mediator_lua, penlight, say }:
+busted = callPackage({ buildLuarocksPackage, dkjson, fetchgit, fetchurl, lua, lua-term, luaOlder, lua_cliargs, luassert, luasystem, mediator_lua, penlight, say }:
 buildLuarocksPackage {
   pname = "busted";
-  version = "2.1.2-3";
+  version = "2.2.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/busted-2.1.2-3.rockspec";
-    sha256 = "0ll8jzbpp6a9zdbbjglmq30jmx2zvr0rs83jgsjxmlfzzylkry8p";
+    url    = "mirror://luarocks/busted-2.2.0-1.rockspec";
+    sha256 = "0h4zk4lcm40wg3l0vgjn6lsyh9yayhljx65a0pz5n99dxal8lgnf";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/busted.git",
-  "rev": "673cb6bad2ee3876d45e004fcac1c2f8a816344f",
-  "date": "2023-03-20T10:00:33+01:00",
-  "path": "/nix/store/k7xnpg0s36gxk5mb59wx1dj8ikiz92ja-busted",
-  "sha256": "1wsiiiw26yqglqkkailksinzcb9gaffcldrcfhga3zawf2518h8y",
-  "hash": "sha256-HkEUinBc/aEedCw3ypxTLy32bdSTRjUnpg97I3iMUfM=",
+  "rev": "02f31a9c103a44e166617cfdb6ba1b8994a9c912",
+  "date": "2023-11-06T14:24:47+03:00",
+  "path": "/nix/store/59a4spix6yw8lvkxq7q1fkdv0gfqd72k-busted",
+  "sha256": "0pwyidy7l223ydsfbf5xsjqgyhm73942ks44d3bivh8ldam4zg74",
+  "hash": "sha256-5LxPqmoUwR3XaIToKUgap0L/sNS9uOV080MIenyLnl8=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -167,7 +165,7 @@ buildLuarocksPackage {
  '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ dkjson lua lua-term lua_cliargs luafilesystem luassert luasystem mediator_lua penlight say ];
+  propagatedBuildInputs = [ dkjson lua lua-term lua_cliargs luassert luasystem mediator_lua penlight say ];
 
   meta = {
     homepage = "https://lunarmodules.github.io/busted/";
@@ -245,21 +243,21 @@ buildLuarocksPackage {
 compat53 = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "compat53";
-  version = "0.7-1";
+  version = "0.12-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/compat53-0.7-1.rockspec";
-    sha256 = "1r7a3q1cjrcmdycrv2ikgl83irjhxs53sa88v2fdpr9aaamlb101";
+    url    = "mirror://luarocks/compat53-0.12-1.rockspec";
+    sha256 = "0ijp8ch3927rnj872l6cq79fd53dyfc2qg82y9b0g6kqs7cdl348";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/keplerproject/lua-compat-5.3/archive/v0.7.zip";
-    sha256 = "02a14nvn7aggg1yikj9h3dcf8aqjbxlws1bfvqbpfxv9d5phnrpz";
+    url    = "https://github.com/lunarmodules/lua-compat-5.3/archive/v0.12.zip";
+    sha256 = "177zk7rww76wqxqsd2kxwfzb0nd7wfacm81vxwqsc84bfccsl3j4";
   };
 
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "https://github.com/keplerproject/lua-compat-5.3";
+    homepage = "https://github.com/lunarmodules/lua-compat-5.3";
     description = "Compatibility module providing Lua-5.3-style APIs for Lua 5.2 and 5.1";
     maintainers = with lib.maintainers; [ vcunat ];
     license.fullName = "MIT";
@@ -331,17 +329,17 @@ buildLuarocksPackage {
 cqueues = callPackage({ buildLuarocksPackage, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "cqueues";
-  version = "20200726.52-0";
+  version = "20200726.51-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/cqueues-20200726.52-0.rockspec";
-    sha256 = "0w2kq9w0wda56k02rjmvmzccz6bc3mn70s9v7npjadh85i5zlhhp";
+    url    = "mirror://luarocks/cqueues-20200726.51-0.rockspec";
+    sha256 = "1y7dqvw75cj9ifn7cyhd98znaga4lksnbddcqmh512crawlf5sxv";
   }).outPath;
   src = fetchurl {
     url    = "https://github.com/wahern/cqueues/archive/rel-20200726.tar.gz";
     sha256 = "0lhd02ag3r1sxr2hx847rdjkddm04l1vf5234v5cz9bd4kfjw4cy";
   };
 
-  disabled = (lua.luaversion != "5.2");
+  disabled = (lua.luaversion != "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
@@ -362,11 +360,11 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/teal-language/cyan",
-  "rev": "31c9eccfc5bf26725e4e8a76ff5d5beaa175da8d",
-  "date": "2023-02-19T18:58:20-06:00",
-  "path": "/nix/store/smpj81z2a2blb3qfpjwx9n52d50rp39w-cyan",
-  "sha256": "0pskargvjn2phgz481b08ndhp3z23s7lqfs8qlwailr7a4f2fc7h",
-  "hash": "sha256-8DAnHFEn06g4xUg7TI8e4o8Lm0VgBUT+g1dYuV9WU18=",
+  "rev": "57650a3a0314a5e894c6ead30a5a52f7825f009c",
+  "date": "2023-12-07T02:47:54-06:00",
+  "path": "/nix/store/g3rqlf5cj06y2qqjlhkms51y4l142waf-cyan",
+  "sha256": "0xww1p3l0rbm7xiyax37524zybgmbrsjkpvgg327w8yndqysidfd",
+  "hash": "sha256-zbWoPW7WI37EeG/fKXVe9S3/iShndOVjP3VlQMcNnHc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -438,14 +436,14 @@ buildLuarocksPackage {
 fennel = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "fennel";
-  version = "1.3.1-1";
+  version = "1.4.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/fennel-1.3.1-1.rockspec";
-    sha256 = "1dsavrsvngwx8vf1l2sj44arvip3bqkhsfh2sdkwa6r9mnw9zx87";
+    url    = "mirror://luarocks/fennel-1.4.0-1.rockspec";
+    sha256 = "1ldbcrzap8ajgwmxf70g0nw7sjdpabba56y2lg3z4hpnxccpb80n";
   }).outPath;
   src = fetchurl {
-    url    = "https://fennel-lang.org/downloads/fennel-1.3.1.tar.gz";
-    sha256 = "1c7iwyc9f3a9k34fjq77zjk0minl3bl3f7wqlj8i1n2x7598nzgx";
+    url    = "https://fennel-lang.org/downloads/fennel-1.4.0.tar.gz";
+    sha256 = "0g1lzkpmzhvhkc08kmn48k3m02pkcwgslz29fb23apbhydkavlx2";
   };
 
   disabled = (luaOlder "5.1");
@@ -459,6 +457,30 @@ buildLuarocksPackage {
   };
 }) {};
 
+fidget-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
+buildLuarocksPackage {
+  pname = "fidget.nvim";
+  version = "1.0.0-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/fidget.nvim-1.0.0-1.rockspec";
+    sha256 = "09hhm95gvdxd6n9mz2y012gmvs05mpfr4w0qgwcr8zb4kz11nqlw";
+  }).outPath;
+  src = fetchzip {
+    url    = "https://github.com/j-hui/fidget.nvim/archive/fa1445fe7230845ea66b2c8bec3398fe5d900307.zip";
+    sha256 = "0krvmyww42dx4q0gxv0qdyv14zxbbl5g4g8pa5dl5qdlznw9vagq";
+  };
+
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github.com/j-hui/fidget.nvim";
+    description = "Extensible UI for Neovim notifications and LSP progress messages.";
+    maintainers = with lib.maintainers; [ mrcjkb ];
+    license.fullName = "MIT";
+  };
+}) {};
+
 fifo = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua }:
 buildLuarocksPackage {
   pname = "fifo";
@@ -554,11 +576,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lewis6991/gitsigns.nvim",
-  "rev": "ff01d34daaed72f271a8ffa088a7e839a60c640f",
-  "date": "2023-10-06T09:04:46+01:00",
-  "path": "/nix/store/2m4fyzkkg6bdbfb4kpjrqgbawvs3khqg-gitsigns.nvim",
-  "sha256": "0clyngmmz0qilnjykqc8n7c5kidspywazwy3axsikgh4x8wzdn17",
-  "hash": "sha256-J9j2OeoEvhl1V8Pzr7i/usVZ2LGI4emlpRGDX+uznjI=",
+  "rev": "6ef8c54fb526bf3a0bc4efb0b2fe8e6d9a7daed2",
+  "date": "2023-11-29T12:07:41+00:00",
+  "path": "/nix/store/2ihnjknz2xdwsijjimqk8i3pi9cbpvhf-gitsigns.nvim",
+  "sha256": "086jmhzgpavwjvp7ssd8ga0wxgnz480zzjiv84h4ivva2nv3lnvi",
+  "hash": "sha256-cVs6thVq70ggQTvK/wEi377OgXqoaX3ulnyr+z6s0iA=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -576,21 +598,21 @@ buildLuarocksPackage {
   };
 }) {};
 
-haskell-tools-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, plenary-nvim }:
+haskell-tools-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "haskell-tools.nvim";
-  version = "2.4.0-1";
+  version = "3.0.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/haskell-tools.nvim-2.4.0-1.rockspec";
-    sha256 = "1sapapkz3ay9yrljmc1lwxjglv27f1zbh6m014r2z59px4ir61dz";
+    url    = "mirror://luarocks/haskell-tools.nvim-3.0.2-1.rockspec";
+    sha256 = "1gls4dc4b8p0827jsvzf1n3gxfmqn1r7n8hi1rnfxwcragjxxn8x";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/2.4.0.zip";
-    sha256 = "054vfqsccq1qmqmglnppi2n7ksckldx8b5p62y35y0cbcdyh7wz3";
+    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/3.0.2.zip";
+    sha256 = "1rv1r0laizq866lj06akhy97zr9wdfczp1caql36k2xk4d8sbzx7";
   };
 
   disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ lua plenary-nvim ];
+  propagatedBuildInputs = [ lua ];
 
   meta = {
     homepage = "https://github.com/mrcjkb/haskell-tools.nvim";
@@ -734,18 +756,21 @@ buildLuarocksPackage {
   };
 }) {};
 
-ldoc = callPackage({ buildLuarocksPackage, fetchgit, markdown, penlight }:
+ldoc = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, markdown, penlight }:
 buildLuarocksPackage {
   pname = "ldoc";
-  version = "dev-1";
-
+  version = "1.5.0-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/ldoc-1.5.0-1.rockspec";
+    sha256 = "1c0yx9j3yqlzxpmspz7n7l1nvh2sww84zhkb1fsbg042sr8h9bxp";
+  }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/ldoc.git",
-  "rev": "e4940daf748affb86489b0782ed8abab2e88bebc",
-  "date": "2023-05-13T08:12:31+03:00",
-  "path": "/nix/store/sqhilwlh0glw1dxcx6w98wjkp65amvil-ldoc",
-  "sha256": "0an92jxvhbw2lvg269x6z3874x3wqmbmx52j4gsgxf9ldpizssgd",
-  "hash": "sha256-7Wn94200uf70I1KUXlfFfHRy0PimJyPepoIvuLsUySo=",
+  "rev": "09f82c959c50d8c3d5a968c379b1c75de66b002d",
+  "date": "2023-05-03T00:05:39+03:00",
+  "path": "/nix/store/7l5xpw1grnwr5m8myll63gyy4311glb1-ldoc",
+  "sha256": "0g65dd51l42693jr3251p6s40950wcwfr1kspjvc2frkwm7qpv9i",
+  "hash": "sha256-Me2LT+UzO8G2vHqG7DjjoCRAtLmhiJHlSEYQGkprxTw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -990,18 +1015,18 @@ buildLuarocksPackage {
 lrexlib-gnu = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-gnu";
-  version = "2.9.1-1";
+  version = "2.9.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lrexlib-gnu-2.9.1-1.rockspec";
-    sha256 = "1jfjxh26iwsavipkwmscwv52l77qxzvibfmlvpskcpawyii7xcw8";
+    url    = "mirror://luarocks/lrexlib-gnu-2.9.2-1.rockspec";
+    sha256 = "14dp5lzpz2prvimpcbqjygbyh9h791h0ywjknj9wgrjjd62qsy6i";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rrthomas/lrexlib.git",
-  "rev": "69d5c442c5a4bdc1271103e88c5c798b605e9ed2",
-  "date": "2020-08-07T12:10:29+03:00",
-  "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
-  "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
-  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
+  "rev": "9aa5e7e9ca47da1bd0e023dfa0b1b2d43aa358f3",
+  "date": "2023-11-05T17:32:50+00:00",
+  "path": "/nix/store/z74bw029468iizgrv19wllpzsvazj3bg-lrexlib",
+  "sha256": "15y9ha28qq08b100a32s72h6rx1bqs7gl5h7j3zacy5ixyyl6cqg",
+  "hash": "sha256-DzNDve+xeKb+kAcW+o7GK/RsoDhaDAVAWAhgjISCyZc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1013,7 +1038,7 @@ buildLuarocksPackage {
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "http://github.com/rrthomas/lrexlib";
+    homepage = "https://github.com/rrthomas/lrexlib";
     description = "Regular expression library binding (GNU flavour).";
     license.fullName = "MIT/X11";
   };
@@ -1022,18 +1047,18 @@ buildLuarocksPackage {
 lrexlib-pcre = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-pcre";
-  version = "2.9.1-1";
+  version = "2.9.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lrexlib-pcre-2.9.1-1.rockspec";
-    sha256 = "036k27xaplxn128b3p67xiqm8k40s7bxvh87wc8v2cx1cc4b9ia4";
+    url    = "mirror://luarocks/lrexlib-pcre-2.9.2-1.rockspec";
+    sha256 = "1214ssm6apgprryqvijjjn82ikb27ylq94yijqf7qjyiy6pz7dc1";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rrthomas/lrexlib.git",
-  "rev": "69d5c442c5a4bdc1271103e88c5c798b605e9ed2",
-  "date": "2020-08-07T12:10:29+03:00",
-  "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
-  "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
-  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
+  "rev": "9aa5e7e9ca47da1bd0e023dfa0b1b2d43aa358f3",
+  "date": "2023-11-05T17:32:50+00:00",
+  "path": "/nix/store/z74bw029468iizgrv19wllpzsvazj3bg-lrexlib",
+  "sha256": "15y9ha28qq08b100a32s72h6rx1bqs7gl5h7j3zacy5ixyyl6cqg",
+  "hash": "sha256-DzNDve+xeKb+kAcW+o7GK/RsoDhaDAVAWAhgjISCyZc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1045,7 +1070,7 @@ buildLuarocksPackage {
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "http://github.com/rrthomas/lrexlib";
+    homepage = "https://github.com/rrthomas/lrexlib";
     description = "Regular expression library binding (PCRE flavour).";
     maintainers = with lib.maintainers; [ vyp ];
     license.fullName = "MIT/X11";
@@ -1055,18 +1080,18 @@ buildLuarocksPackage {
 lrexlib-posix = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-posix";
-  version = "2.9.1-1";
+  version = "2.9.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lrexlib-posix-2.9.1-1.rockspec";
-    sha256 = "1zxrx9yifm9ry4wbjgv86rlvq3ff6qivldvib3ha4767azla0j0r";
+    url    = "mirror://luarocks/lrexlib-posix-2.9.2-1.rockspec";
+    sha256 = "1i11cdvz09a3wjhfjgc88g0mdmdrk13fnhhgskzgm5cmhsdx4s0i";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rrthomas/lrexlib.git",
-  "rev": "69d5c442c5a4bdc1271103e88c5c798b605e9ed2",
-  "date": "2020-08-07T12:10:29+03:00",
-  "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
-  "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
-  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
+  "rev": "9aa5e7e9ca47da1bd0e023dfa0b1b2d43aa358f3",
+  "date": "2023-11-05T17:32:50+00:00",
+  "path": "/nix/store/z74bw029468iizgrv19wllpzsvazj3bg-lrexlib",
+  "sha256": "15y9ha28qq08b100a32s72h6rx1bqs7gl5h7j3zacy5ixyyl6cqg",
+  "hash": "sha256-DzNDve+xeKb+kAcW+o7GK/RsoDhaDAVAWAhgjISCyZc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1078,7 +1103,7 @@ buildLuarocksPackage {
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "http://github.com/rrthomas/lrexlib";
+    homepage = "https://github.com/rrthomas/lrexlib";
     description = "Regular expression library binding (POSIX flavour).";
     license.fullName = "MIT/X11";
   };
@@ -1205,10 +1230,10 @@ buildLuarocksPackage {
 lua-iconv = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-iconv";
-  version = "7.0.0-2";
+  version = "7.0.0-4";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-iconv-7.0.0-2.rockspec";
-    sha256 = "1bj512kqcj2cxna7si4648fci51fs4bqvdn592i9cahscsc0kk9g";
+    url    = "mirror://luarocks/lua-iconv-7.0.0-4.rockspec";
+    sha256 = "0j34zf98wdr6ks6snsrqi00vwm3ngsa5f74kadsn178iw7hd8c3q";
   }).outPath;
   src = fetchurl {
     url    = "https://github.com/lunarmodules/lua-iconv/archive/v7.0.0/lua-iconv-7.0.0.tar.gz";
@@ -1260,14 +1285,14 @@ buildLuarocksPackage {
 lua-messagepack = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-messagepack";
-  version = "0.5.3-1";
+  version = "0.5.4-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-messagepack-0.5.3-1.rockspec";
-    sha256 = "0sc11ckizivijgdnqvb0xnagrak6d2caxc5j8jz8ad1b2plp50pq";
+    url    = "mirror://luarocks/lua-messagepack-0.5.4-1.rockspec";
+    sha256 = "1jygn6f8ab69z0nn1gib45wvjp075gzxp54vdmgxb3qfar0q70kr";
   }).outPath;
   src = fetchurl {
-    url    = "https://framagit.org/fperrad/lua-MessagePack/raw/releases/lua-messagepack-0.5.3.tar.gz";
-    sha256 = "17qdigs2pzi38rfqgs63xh44n1vylb6bcmmbz3sby68f0n9p8kq6";
+    url    = "https://framagit.org/fperrad/lua-MessagePack/raw/releases/lua-messagepack-0.5.4.tar.gz";
+    sha256 = "0kk1n9kf6wip8k2xx4wjlv7647biji2p86v4jf0h6d6wkaypq0kz";
   };
 
   disabled = (luaOlder "5.1");
@@ -1412,18 +1437,18 @@ buildLuarocksPackage {
 lua-resty-openssl = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "lua-resty-openssl";
-  version = "0.8.25-1";
+  version = "1.0.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-resty-openssl-0.8.25-1.rockspec";
-    sha256 = "0wy0fjb50kpcyk6mkjj364p4lrfxl0b34xnv2n0wib1brk536s1l";
+    url    = "mirror://luarocks/lua-resty-openssl-1.0.2-1.rockspec";
+    sha256 = "000ak4rfm56z7g2b7jr7k2m4hp6kcx970cnv29acjazrz6kr60r2";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/fffonion/lua-resty-openssl.git",
-  "rev": "f9a153288238e9b7e3d5d40144610410a06a83cd",
-  "date": "2023-09-05T15:19:20+08:00",
-  "path": "/nix/store/jnvr2pzvxl2psd5w030m4qnv5dsm8spb-lua-resty-openssl",
-  "sha256": "08fqgdfi0dr3n2lqrbgwa94dd2f6crn1kb0cfpccphknaypaw7dp",
-  "hash": "sha256-tx2urld2wsvYdQysGWxmxonWSFL8rYypsCM3EF172CE=",
+  "rev": "5aba923e78ae0f213f3b4719effa879e3971821f",
+  "date": "2023-11-22T15:44:01+08:00",
+  "path": "/nix/store/fww02frnja73z8bhxqz5nyji5nam77ab-lua-resty-openssl",
+  "sha256": "10fxfjafl9wyv2jz7j25xkklx1c2ykvi0yqskyij45d0rzimil5z",
+  "hash": "sha256-v9BY48+gFSKjnxp7EPf0goVO5+xFyPOl2J4n6pR03YE=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -1471,23 +1496,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-rtoml = callPackage({ luaOlder, luarocks-build-rust-mlua, buildLuarocksPackage, lua, fetchgit }:
+lua-rtoml = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder, luarocks-build-rust-mlua }:
 buildLuarocksPackage {
   pname = "lua-rtoml";
   version = "0.2-0";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lblasc/lua-rtoml.git",
-  "rev": "e59ad00f5df8426767ddfb355f4ba6093468a168",
-  "date": "2023-11-02T14:17:41+01:00",
-  "path": "/nix/store/ynn6bvnwyqrackvyxzysxy294gh9prg1-lua-rtoml",
-  "sha256": "1y2ncdl3mpwqc1h5xm0rf9g1ns2vswgqffsj9sqrqidmg984jkr4",
+  "rev": "c83f56b9519d85968d663308e303f384c55c7b18",
+  "date": "2023-11-02T14:28:19+01:00",
+  "path": "/nix/store/x6mm838p27gwk45j23jkd0cpzxncxgci-lua-rtoml",
+  "sha256": "11i2km1k686nbh2ylfrcn3grd816vdhnigjjaiykkgwj0i8il6ix",
+  "hash": "sha256-PRoaUQSSvzl9VFK+aGHbJqCW37AsO+oFXNYgM0OdIoY=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua luarocks-build-rust-mlua ];
@@ -1653,7 +1679,10 @@ lua_cliargs = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua_cliargs";
   version = "3.0-2";
-
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/lua_cliargs-3.0-2.rockspec";
+    sha256 = "0vlmwrldwlxdfkak9kapydfs4ny4pwg3qpkv5agn6lw6gq0aq5za";
+  }).outPath;
   src = fetchurl {
     url    = "https://github.com/amireh/lua_cliargs/archive/v3.0-2.tar.gz";
     sha256 = "0vhpgmy9a8wlxp8a15pnfqfk0aj7pyyb5m41nnfxynx580a6y7cp";
@@ -2046,18 +2075,18 @@ buildLuarocksPackage {
 lualdap = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lualdap";
-  version = "1.3.1-1";
+  version = "1.4.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lualdap-1.3.1-1.rockspec";
-    sha256 = "0c0j9dmrphg0dil4yhahcqzzyxhrv525g65jsz0q6iqwyx10bqbp";
+    url    = "mirror://luarocks/lualdap-1.4.0-1.rockspec";
+    sha256 = "0n924gxm6ccr9hjk4bi5z70vgh7g75dl7293pab41a2qcrlsj9nk";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lualdap/lualdap",
-  "rev": "5c21b3e0d97a07b103f63edc7e649018e0453427",
-  "date": "2023-03-15T09:02:07+01:00",
-  "path": "/nix/store/ah7y5wpp3l0v5bk0gwzdvgzfpczb691k-lualdap",
-  "sha256": "1y3ap9si894xjlbrwx3c6bcfg60y80av802rscldg9scvm984jrg",
-  "hash": "sha256-L0uCUt1Mp9co01kAtBVAHpjn2DJsdJ4XlZ0kFHW6avg=",
+  "rev": "7a73c883012f9d12a05563afbb3481a57055368c",
+  "date": "2023-11-04T09:38:06+01:00",
+  "path": "/nix/store/7j6wl1f9qg4kh9zwm8fnc0ky7zhf7qbf-lualdap",
+  "sha256": "0xq0xi3ymg5lk6dh7782ddjnz5bjycd2xnc5dp1cwssi37nm7pdv",
+  "hash": "sha256-u91T7RlRa87CbYXZLhrzcpVvZWsCnQObmbS86kfsAHc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2493,11 +2522,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rktjmp/lush.nvim",
-  "rev": "966aad1accd47fa11fbe2539234f81f678fef2de",
-  "date": "2023-09-23T12:10:39+10:00",
-  "path": "/nix/store/67046ilc92czfvwc5zdkkxg7iw2xjj45-lush.nvim",
-  "sha256": "0g1xib2k42py9qqccjz11qk52ri0drgdk5rb0ls7wzx4v636k15h",
-  "hash": "sha256-sIRphtmkf340BSuX2V5uIGZRJg7hS8YwTv4KMsWKPTw=",
+  "rev": "f76741886b356586f9dfe8e312fbd1ab0fd1084f",
+  "date": "2023-12-06T09:56:43+11:00",
+  "path": "/nix/store/m0zsbahbzqxfzvbgw93qw78g7r4fjhdb-lush.nvim",
+  "sha256": "1jvfycqg5s72gmib8038kzyy8fyanl06mkz74rjy878zv8r6nf59",
+  "hash": "sha256-qThrMtofHeRlJufPagC1yjvk/Z9oALRifeLo8jDzbss=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2516,7 +2545,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luuid = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
+luuid = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder}:
 buildLuarocksPackage {
   pname = "luuid";
   version = "20120509-2";
@@ -2704,11 +2733,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/leafo/moonscript.git",
-  "rev": "fbd8ad48737651114a3d3a672b9f8f8b3a7022b7",
-  "date": "2023-06-23T09:33:37-07:00",
-  "path": "/nix/store/sy1dkcfp3rg7lvazba36sivpk0bs12r5-moonscript",
-  "sha256": "02w6lp5kid73dcd5x71666my7413l05ak0xvva6hp8ixbn6qraqn",
-  "hash": "sha256-FquMjV09oguN2ruDqQqgI5DjqzEmnF4aa+O0OMulhgs=",
+  "rev": "d5341c9093c49d3724072b209cde28b5cb0f47c9",
+  "date": "2023-11-06T12:54:51-08:00",
+  "path": "/nix/store/djmh6brp03gy8nyzxjfvzkpy440fj05z-moonscript",
+  "sha256": "1h65cxh5rhnxx99asdydkc9yf6gnf61m97jvl03g31f65jl22lxi",
+  "hash": "sha256-sVMhqCzGhfEGoFueVINx9hnnE5vNN61S6t3CXGBnxcA=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2809,11 +2838,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/hrsh7th/nvim-cmp",
-  "rev": "5dce1b778b85c717f6614e3f4da45e9f19f54435",
-  "date": "2023-08-26T15:31:42+00:00",
-  "path": "/nix/store/lvpzc5q7mv66knxh1igvzkrcwkpg8l8q-nvim-cmp",
-  "sha256": "1yl5b680p6vhk1741riiwjnw7a4wn0nimjvcab0ij6mx3kf28rsq",
-  "hash": "sha256-WGck3By9GhnBUmzLGi2wnKjDreQx5kBOmHCbC5BZhfo=",
+  "rev": "0b751f6beef40fd47375eaf53d3057e0bfa317e4",
+  "date": "2023-11-06T17:58:22+09:00",
+  "path": "/nix/store/4z8lkalcj6sk2s5aw2xcalimh3rcgixj-nvim-cmp",
+  "sha256": "1qp7s2iam9zzdlw5sgkk6c623z7vjgga0rcg63ja0f836l90grba",
+  "hash": "sha256-auUHEjUDOaDkMI9loN6T+/whDDNzPl04bf+nqqLQ5+I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2868,11 +2897,11 @@ buildLuarocksPackage {
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-lua/plenary.nvim",
-  "rev": "50012918b2fc8357b87cff2a7f7f0446e47da174",
-  "date": "2023-10-11T15:43:47+02:00",
-  "path": "/nix/store/jsgaq274w8pbl4pnmpii3izxafpl346g-plenary.nvim",
-  "sha256": "1sn7vpsbwpyndsjyxb4af8fvz4sfhlbavvw6jjsv3h18sdvkh7nd",
-  "hash": "sha256-zR44d9MowLG1lIbvrRaFTpO/HXKKrO6lbtZfvvTdx+o=",
+  "rev": "55d9fe89e33efd26f532ef20223e5f9430c8b0c0",
+  "date": "2023-11-30T12:17:20+01:00",
+  "path": "/nix/store/wf35h8i4s3fdskvcy376vvzp5gi6s6mx-plenary.nvim",
+  "sha256": "1f6vqqafk78njpl47xgsf8p199mmvw4h4b9axab9rl86fdlibikz",
+  "hash": "sha256-f8YVaXMG0ZyW6iotAgnftaYULnL69UPolRad6RTG27g=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -2943,17 +2972,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-rustaceanvim = callPackage({ lua, luaOlder, buildLuarocksPackage, fetchzip }:
+rustaceanvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "rustaceanvim";
-  version = "3.0.0-1";
+  version = "3.9.6-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rustaceanvim-3.0.0-1.rockspec";
-    sha256 = "1v1k08spq3zalgya6q3qny6zpwhn0nb5nl5dn0rkcvnc4imvnyfy";
+    url    = "mirror://luarocks/rustaceanvim-3.9.6-1.rockspec";
+    sha256 = "1wlzqm8x2w9clskj2k9n9i4f0pn17dsp99a3gwwrypdlbvm9x77k";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/rustaceanvim/archive/3.0.0.zip";
-    sha256 = "1prpklbijr7p890nflr9jixf955dlp3ph9zl2rq3xxyl20ncyqbk";
+    url    = "https://github.com/mrcjkb/rustaceanvim/archive/3.9.6.zip";
+    sha256 = "0qmifxb0xgyym0zbizqds5scy4qrnp0hr17rg0synp2fk5iv6s5b";
   };
 
   disabled = (luaOlder "5.1");
@@ -3170,14 +3199,14 @@ buildLuarocksPackage {
 telescope-manix = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, telescope-nvim }:
 buildLuarocksPackage {
   pname = "telescope-manix";
-  version = "0.5.0-1";
+  version = "1.0.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/telescope-manix-0.5.0-1.rockspec";
-    sha256 = "0i5q9sr0vn0w6yqg530jx2fx52k9jr7rss4ibl49f1x3wv6sckv1";
+    url    = "mirror://luarocks/telescope-manix-1.0.0-1.rockspec";
+    sha256 = "0fhcglrnsjyhg1g2ldlb24fck9b5fnzy7kc67yjgkw62d557vjgk";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/telescope-manix/archive/0.5.0.zip";
-    sha256 = "093vkh822ycnc1pri3zmzzqnz235xxam3z1l67zyyqlc1apbarax";
+    url    = "https://github.com/mrcjkb/telescope-manix/archive/1.0.0.zip";
+    sha256 = "1svw724jlhchsl191bmgr50zbjl9vghkaxk3j8g0nzvrn9677b22";
   };
 
   disabled = (luaOlder "5.1");
@@ -3200,11 +3229,11 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-telescope/telescope.nvim",
-  "rev": "74ce793a60759e3db0d265174f137fb627430355",
-  "date": "2023-10-11T12:29:23+02:00",
-  "path": "/nix/store/7k50qqgamc2ldxdf54jqs8sy8m8vcfzr-telescope.nvim",
-  "sha256": "1m4v097y8ypjm572k1qqii3z56w4x1dsjxd6gp0z24xqyvd4kpa4",
-  "hash": "sha256-RN1J2va4E/HBfaZ1qVvohJvyR4wYhylOqfJ65E8Cm9Q=",
+  "rev": "6213322ab56eb27356fdc09a5078e41e3ea7f3bc",
+  "date": "2023-12-06T03:50:38+00:00",
+  "path": "/nix/store/h1v5377aylxb6vq8v7m7wrl585vb1dzi-telescope.nvim",
+  "sha256": "074bq8p1bkyr12z1wy31bipb97vmqia4lsmdp2aj1v1r5x5ph736",
+  "hash": "sha256-Zhx4Sy857CCVuK1qSlTEdZ+0blxheB6+CNnPFS7Cixw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3225,18 +3254,18 @@ buildLuarocksPackage {
 tl = callPackage({ argparse, buildLuarocksPackage, compat53, fetchgit, fetchurl, luafilesystem }:
 buildLuarocksPackage {
   pname = "tl";
-  version = "0.15.2-1";
+  version = "0.15.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/tl-0.15.2-1.rockspec";
-    sha256 = "1qisdflgikry0jdqvnzdcqib2svbafp10n0gfwm3fcrzqsdxy0xr";
+    url    = "mirror://luarocks/tl-0.15.3-1.rockspec";
+    sha256 = "15p67r5bjp997pymjq80yn1gyf7r5g2nwkachkwx88100ihblqrc";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/teal-language/tl",
-  "rev": "d2fc36b5ff9a52d7265e63eb74cce70fd1cdbcb2",
-  "date": "2023-04-27T11:28:21-03:00",
-  "path": "/nix/store/ramhj3a29lrn0bblbgyxn4712a7caq8k-tl",
-  "sha256": "1dgldi9pgg23iz3xis4i43bnvkwirh7kkycmr5xp75s2cc85zhg0",
-  "hash": "sha256-4MFfEGNCl3N7yZX5OQ/Mkc9t1yCR6NjHj0O8d1Ns9LU=",
+  "rev": "28f8fd9eb1a756267b8cde25990dfae27f8f5bcc",
+  "date": "2023-11-05T23:31:17-03:00",
+  "path": "/nix/store/8qbkpkni2ci042ryzjh0nfxnrmmckg3l-tl",
+  "sha256": "0spr0zajy8i91n0jqmjpgdcsryrlras6fv60np9ml1rfirh0yk4y",
+  "hash": "sha256-nkwPYI4uB1rTtcBsZ7TKNPusWXtXViyBDSkiL9UH+Wo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
@@ -3351,18 +3380,18 @@ buildLuarocksPackage {
 vusted = callPackage({ buildLuarocksPackage, busted, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "vusted";
-  version = "2.3.1-1";
+  version = "2.3.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/vusted-2.3.1-1.rockspec";
-    sha256 = "03h7l12xk43rql9vxb5nzfimx9srwaazx2r3j2zm1ba2qz06h0qc";
+    url    = "mirror://luarocks/vusted-2.3.3-1.rockspec";
+    sha256 = "0h1v9p327yfqnbwi2rw3k47vwbpqx5rn679rfx5dszn3s6wp5g6p";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/notomo/vusted.git",
-  "rev": "2bc6818a756e47240d9284f1dfac21b011ca84ea",
-  "date": "2023-10-09T11:47:28+09:00",
-  "path": "/nix/store/jq2yl4adpnyilp3yyw161j1a29bwahqi-vusted",
-  "sha256": "04lxc78n3h1qhby6b4k9x8hb1c3sgqdid71fsvyg4y6j7rb55a8z",
-  "hash": "sha256-H6lSVj7SePL81i6cFht+erCwIOppkmX8gjjAYdFhnRI=",
+  "rev": "69a5a5f453cf2fc2984e1ba4eea91384e59f9da1",
+  "date": "2023-11-06T21:06:04+09:00",
+  "path": "/nix/store/85m6md82nl3jj853s9mhsc4dy0isws8b-vusted",
+  "sha256": "012n09hy4q0im2bv0vprkanv6xqdppaz6f7gwp87nxsmk88q8mxv",
+  "hash": "sha256-u1eEEZpVd3vQ5e8489W9DXezrZr5brCXqBFg4mECVgQ=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 9ea1e6f19348..1b8dce7e1fa5 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -2,6 +2,11 @@
 { stdenv
 , cargo
 , cmake
+
+# plenary utilities
+, which
+, findutils
+, coreutils
 , curl
 , cyrus_sasl
 , dbus
@@ -449,6 +454,32 @@ with prev;
   });
 
 
+  plenary-nvim = prev.plenary-nvim.overrideAttrs (oa: {
+    postPatch = ''
+      sed -Ei lua/plenary/curl.lua \
+          -e 's@(command\s*=\s*")curl(")@\1${curl}/bin/curl\2@'
+    '';
+
+    # disabled for now because too flaky
+    doCheck = false;
+    # for env/find/ls
+    checkInputs = [
+      which
+      neovim-unwrapped
+      coreutils
+      findutils
+    ];
+
+    checkPhase = ''
+      runHook preCheck
+      # remove failing tests, need internet access for instance
+      rm tests/plenary/job_spec.lua tests/plenary/scandir_spec.lua tests/plenary/curl_spec.lua
+      export HOME="$TMPDIR"
+      make test
+      runHook postCheck
+    '';
+  });
+
   # as advised in https://github.com/luarocks/luarocks/issues/1402#issuecomment-1080616570
   # we shouldn't use luarocks machinery to build complex cmake components
   libluv = stdenv.mkDerivation {
diff --git a/pkgs/development/python-modules/absl-py/default.nix b/pkgs/development/python-modules/absl-py/default.nix
index a937b016ce89..a2f22062d3bf 100644
--- a/pkgs/development/python-modules/absl-py/default.nix
+++ b/pkgs/development/python-modules/absl-py/default.nix
@@ -2,20 +2,25 @@
 , lib
 , pythonOlder
 , fetchPypi
+, setuptools
 , six
 , enum34
 }:
 
 buildPythonPackage rec {
   pname = "absl-py";
-  version = "1.4.0";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0sJE0BBIukdufAgL0sbfXhQdIR3oAiNGDVs7iipYQz0=";
+    hash = "sha256-2WkCEcX8/vzdGkVHCsK1xazUUkHDr3Hu2WvFRBdGwNU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     six
   ] ++ lib.optionals (pythonOlder "3.4") [
diff --git a/pkgs/development/python-modules/acquire/default.nix b/pkgs/development/python-modules/acquire/default.nix
index 4aacc5c46b21..aabd6216c904 100644
--- a/pkgs/development/python-modules/acquire/default.nix
+++ b/pkgs/development/python-modules/acquire/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     hash = "sha256-0aLPDh9lrKpHo97VFFwCmPXyXXNFGgkdjoppzm3BCTo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/adafruit-io/default.nix b/pkgs/development/python-modules/adafruit-io/default.nix
index 59bdcc46e8bb..3315df4212ce 100644
--- a/pkgs/development/python-modules/adafruit-io/default.nix
+++ b/pkgs/development/python-modules/adafruit-io/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-vfjyU+czLtUA0WDEvc0iYmJ2Tn75o/OsX909clfDsUE=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 672854ce6a98..fcd55c0f7a3b 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-tw95VnxsK57KBMw0fzzgJnFe8O8Ef0rQ9qBMIeYrkHQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/adext/default.nix b/pkgs/development/python-modules/adext/default.nix
index 1aa9368f347b..c5a05d19bee8 100644
--- a/pkgs/development/python-modules/adext/default.nix
+++ b/pkgs/development/python-modules/adext/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     sha256 = "0h5k9kzms2f0r48pdhsgv8pimk0vsxw8vs0k6880mank8ij914wr";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/aenum/default.nix b/pkgs/development/python-modules/aenum/default.nix
index d1ff94519646..c299864830af 100644
--- a/pkgs/development/python-modules/aenum/default.nix
+++ b/pkgs/development/python-modules/aenum/default.nix
@@ -3,13 +3,15 @@
 , fetchPypi
 , pyparsing
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "aenum";
   version = "3.1.15";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -18,6 +20,10 @@ buildPythonPackage rec {
     hash = "sha256-jL12zRjE+HD/ObJChNPqAo++hzGljfOqWB5DTFdblVk=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pyparsing
     pytestCheckHook
@@ -36,6 +42,9 @@ buildPythonPackage rec {
     "test_arduino_headers"
     "test_c_header_scanner"
     "test_extend_flag_backwards_stdlib"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # AttributeError: <enum 'Color'> has no attribute 'value'. Did you mean: 'blue'?
+    "test_extend_enum_shadow_property_stdlib"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index 556261277ea0..1bd2b71d25fb 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -1,8 +1,7 @@
 { lib
 , stdenv
 , buildPythonPackage
-, fetchPypi
-, fetchpatch
+, fetchFromGitHub
 , pythonOlder
 , fonttools
 , defcon
@@ -34,14 +33,16 @@
 
 buildPythonPackage rec {
   pname = "afdko";
-  version = "4.0.0";
+  version = "4.0.0+unstable-2023-11-07";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-66faoWBuCW0lQZP8/mBJLT+ErRGBl396HdG1RfPOYcM=";
+  src = fetchFromGitHub {
+    owner = "adobe-type-tools";
+    repo = pname;
+    rev = "6c832edbd81ecf689dbe66e840bf18ae61cf4bca";
+    hash = "sha256-XXkksHggUIs2O0/OSGsft8ofogcbtAa3w5JdldIAJAI=";
   };
 
   nativeBuildInputs = [
@@ -64,6 +65,11 @@ buildPythonPackage rec {
     ./use-dynamic-system-antlr4-runtime.patch
   ];
 
+  # Happy new year
+  postPatch = ''
+    substituteInPlace tests/tx_data/expected_output/alt-missing-glif.pfb --replace 2023 2024
+  '';
+
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang (toString [
     "-Wno-error=incompatible-function-pointer-types"
     "-Wno-error=int-conversion"
@@ -98,6 +104,9 @@ buildPythonPackage rec {
 
   preCheck = ''
     export PATH=$PATH:$out/bin
+
+    # Remove build artifacts to prevent them from messing with the tests
+    rm -rf _skbuild
   '';
 
   disabledTests = lib.optionals (!runAllTests) [
diff --git a/pkgs/development/python-modules/afsapi/default.nix b/pkgs/development/python-modules/afsapi/default.nix
index 8d40361c6d06..d971bc5b5e03 100644
--- a/pkgs/development/python-modules/afsapi/default.nix
+++ b/pkgs/development/python-modules/afsapi/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-eE5BsXNtSU6YUhRn4/SKpMrqaYf8tyfLKdxxGOmNJ9I=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/aiobotocore/default.nix b/pkgs/development/python-modules/aiobotocore/default.nix
index 5f226d26018e..006bd358d7c2 100644
--- a/pkgs/development/python-modules/aiobotocore/default.nix
+++ b/pkgs/development/python-modules/aiobotocore/default.nix
@@ -16,16 +16,16 @@
 
 buildPythonPackage rec {
   pname = "aiobotocore";
-  version = "2.6.0";
+  version = "2.8.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-e8FBUG08yWNL9B51Uv4ftYx1C0kcdoweOreUtvvvTAk=";
+    hash = "sha256-mVG3dCz9DnExteUFhvTGjZu81E0KbrObP3OX0w/OVzU=";
   };
 
   # Relax version constraints: aiobotocore works with newer botocore versions
@@ -82,6 +82,8 @@ buildPythonPackage rec {
     "test_sso_credential_fetcher_can_fetch_credentials"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Python client for amazon services";
     homepage = "https://github.com/aio-libs/aiobotocore";
diff --git a/pkgs/development/python-modules/aioconsole/default.nix b/pkgs/development/python-modules/aioconsole/default.nix
index 870ae00612d2..aa9e05a982b5 100644
--- a/pkgs/development/python-modules/aioconsole/default.nix
+++ b/pkgs/development/python-modules/aioconsole/default.nix
@@ -56,9 +56,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/vxgmichel/aioconsole/releases/tag/v${version}";
     description = "Asynchronous console and interfaces for asyncio";
     homepage = "https://github.com/vxgmichel/aioconsole";
-    changelog = "https://github.com/vxgmichel/aioconsole/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ catern ];
   };
diff --git a/pkgs/development/python-modules/aiocron/default.nix b/pkgs/development/python-modules/aiocron/default.nix
index acb53f02ecc8..a9a135e28f21 100644
--- a/pkgs/development/python-modules/aiocron/default.nix
+++ b/pkgs/development/python-modules/aiocron/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , python
 , croniter
 , tzlocal
@@ -10,13 +11,17 @@
 buildPythonPackage rec {
   pname = "aiocron";
   version = "1.8";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-SFRlE/ry63kB5lpk66e2U8gBBu0A7ZyjQZw9ELZVWgE=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     croniter
     tzlocal
diff --git a/pkgs/development/python-modules/aiodns/default.nix b/pkgs/development/python-modules/aiodns/default.nix
index 5fc14b4f66bd..1da999978b58 100644
--- a/pkgs/development/python-modules/aiodns/default.nix
+++ b/pkgs/development/python-modules/aiodns/default.nix
@@ -3,36 +3,43 @@
 , fetchFromGitHub
 , pycares
 , pythonOlder
-, typing
+, setuptools
+
 }:
 
 buildPythonPackage rec {
   pname = "aiodns";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.1.1";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "saghul";
-    repo = pname;
-    rev = "aiodns-${version}";
-    sha256 = "1i91a43gsq222r8212jn4m6bxc3fl04z1mf2h7s39nqywxkggvlp";
+    repo = "aiodns";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-JZS53kICsrXDot3CKjG30AOjkYycKpMJvC9yS3c1v5Q=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pycares
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    typing
   ];
 
   # Could not contact DNS servers
   doCheck = false;
 
-  pythonImportsCheck = [ "aiodns" ];
+  pythonImportsCheck = [
+    "aiodns"
+  ];
 
   meta = with lib; {
     description = "Simple DNS resolver for asyncio";
     homepage = "https://github.com/saghul/aiodns";
+    changelog = "https://github.com/saghul/aiodns/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index d700c29071cc..a640c978764a 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -1,18 +1,24 @@
 { lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
+, cython_3
+, setuptools
+
+# dependencies
 , aiohappyeyeballs
 , async-timeout
-, buildPythonPackage
 , chacha20poly1305-reuseable
-, cython_3
-, fetchFromGitHub
-, mock
 , noiseprotocol
 , protobuf
+, zeroconf
+
+# tests
+, mock
 , pytest-asyncio
 , pytestCheckHook
-, pythonOlder
-, setuptools
-, zeroconf
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/aiogithubapi/default.nix b/pkgs/development/python-modules/aiogithubapi/default.nix
index ba943865a444..3eb23c4a6641 100644
--- a/pkgs/development/python-modules/aiogithubapi/default.nix
+++ b/pkgs/development/python-modules/aiogithubapi/default.nix
@@ -9,11 +9,12 @@
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, sigstore
 }:
 
 buildPythonPackage rec {
   pname = "aiogithubapi";
-  version = "23.2.1";
+  version = "23.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +23,7 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-J6kcEVqADmVJZDbU9eqLCL0rohMSA/Ig7FSp/Ye5Sfk=";
+    hash = "sha256-SbpfHKD4QJuCe3QG0GTvsffkuFiGPLEUXOVW9f1gyTI=";
   };
 
   postPatch = ''
@@ -41,6 +42,7 @@ buildPythonPackage rec {
     aiohttp
     async-timeout
     backoff
+    sigstore
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index 7638c4efb48f..0dc72bc2006a 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -6,6 +6,7 @@
 , aiohttp
 , aiohttp-socks
 , aioredis
+, aiofiles
 , aresponses
 , babel
 , certifi
@@ -13,12 +14,16 @@
 , pytest-asyncio
 , pytest-lazy-fixture
 , redis
+, hatchling
+, pydantic
+, pytz
+, gitUpdater
 }:
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -26,21 +31,20 @@ buildPythonPackage rec {
     owner = "aiogram";
     repo = "aiogram";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bWwK761gn7HsR9ObcBDfvQH0fJfTAo0QAcL/HcNdHik=";
+    hash = "sha256-8SYrg+gfNSTR0CTPf4cYDa4bfA0LPBmZtPcATF22fqw=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "aiohttp>=3.8.0,<3.9.0" "aiohttp" \
-      --replace "Babel>=2.9.1,<2.10.0" "Babel" \
-      --replace "magic-filter>=1.0.9" "magic-filter"
-  '';
+  nativeBuildInputs = [
+    hatchling
+  ];
 
   propagatedBuildInputs = [
+    aiofiles
     aiohttp
     babel
     certifi
     magic-filter
+    pydantic
   ];
 
   nativeCheckInputs = [
@@ -50,17 +54,20 @@ buildPythonPackage rec {
     pytest-asyncio
     pytest-lazy-fixture
     pytestCheckHook
+    pytz
     redis
   ];
 
-  # requires network
+  # import failures
   disabledTests = [
-    "test_download_file_404"
-    "test_download_404"
+    "test_aiohtt_server"
+    "test_deep_linking"
   ];
 
   pythonImportsCheck = [ "aiogram" ];
 
+  passthru.updateScript = gitUpdater { };
+
   meta = with lib; {
     description = "Modern and fully asynchronous framework for Telegram Bot API";
     homepage = "https://github.com/aiogram/aiogram";
diff --git a/pkgs/development/python-modules/aioguardian/default.nix b/pkgs/development/python-modules/aioguardian/default.nix
index 4e7ec48ac585..8047a91fb2c4 100644
--- a/pkgs/development/python-modules/aioguardian/default.nix
+++ b/pkgs/development/python-modules/aioguardian/default.nix
@@ -3,6 +3,7 @@
 , async-timeout
 , asyncio-dgram
 , buildPythonPackage
+, certifi
 , docutils
 , fetchFromGitHub
 , poetry-core
@@ -35,6 +36,7 @@ buildPythonPackage rec {
     aiohttp
     async-timeout
     asyncio-dgram
+    certifi
     docutils
     voluptuous
   ];
diff --git a/pkgs/development/python-modules/aiohappyeyeballs/default.nix b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
index 214f12bcd6d0..a2be5384a04c 100644
--- a/pkgs/development/python-modules/aiohappyeyeballs/default.nix
+++ b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
@@ -1,10 +1,20 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+
+# build-system
 , poetry-core
+
+# optional-dependencies
+, furo
+, myst-parser
+, sphinx-autobuild
+, sphinxHook
+
+# tests
 , pytest-asyncio
 , pytestCheckHook
-, pythonOlder
 }:
 
 buildPythonPackage rec {
@@ -21,6 +31,11 @@ buildPythonPackage rec {
     hash = "sha256-3Lj1eUDPoVCElrxowBhhrS0GCjD5qeUCiSB/gHoqC3Q=";
   };
 
+  outputs = [
+    "out"
+    "doc"
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --cov=aiohappyeyeballs --cov-report=term-missing:skip-covered" ""
@@ -28,7 +43,16 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
-  ];
+  ] ++ passthru.optional-dependencies.docs;
+
+  passthru.optional-dependencies = {
+    docs = [
+      furo
+      myst-parser
+      sphinx-autobuild
+      sphinxHook
+    ];
+  };
 
   nativeCheckInputs = [
     pytest-asyncio
@@ -40,15 +64,15 @@ buildPythonPackage rec {
   ];
 
   disabledTestPaths = [
-    # Test has typos
+    # https://github.com/bdraco/aiohappyeyeballs/issues/30
     "tests/test_impl.py"
   ];
 
   meta = with lib; {
-    description = "Modul for connecting with Happy Eyeballs";
+    description = "Happy Eyeballs for pre-resolved hosts";
     homepage = "https://github.com/bdraco/aiohappyeyeballs";
     changelog = "https://github.com/bdraco/aiohappyeyeballs/blob/v${version}/CHANGELOG.md";
     license = licenses.psfl;
-    maintainers = with maintainers; [ fab ];
+    maintainers = with maintainers; [ fab hexa ];
   };
 }
diff --git a/pkgs/development/python-modules/aiohttp-jinja2/default.nix b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
index 6008b94179fb..8e78784457ca 100644
--- a/pkgs/development/python-modules/aiohttp-jinja2/default.nix
+++ b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "aiohttp-jinja2";
-  version = "1.5.1";
+  version = "1.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jRSbKlfZH3lLM6OU6lvGa1Z/OMdKWmqUd6/CRQ8QXAE=";
+    hash = "sha256-o6f/UmTlvKUuiuVHu/0HYbcklSMNQ40FtsCRW+YZsOI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aiohttp-socks/default.nix b/pkgs/development/python-modules/aiohttp-socks/default.nix
index b81ff0065277..6b96d06ea482 100644
--- a/pkgs/development/python-modules/aiohttp-socks/default.nix
+++ b/pkgs/development/python-modules/aiohttp-socks/default.nix
@@ -1,23 +1,46 @@
-{ lib, fetchPypi, buildPythonPackage, pythonOlder, aiohttp, python-socks, attrs }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
+, aiohttp
+, attrs
+, python-socks
+}:
 
 buildPythonPackage rec {
   pname = "aiohttp-socks";
-  version = "0.8.3";
-  format = "setuptools";
+  version = "0.8.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit version;
     pname = "aiohttp_socks";
-    hash = "sha256-aqtSj2aeCHMBj9N3c7gzouK6KEJDvmcoF/pAG8eUHsY=";
+    hash = "sha256-a2EdTOg46c8sL+1eDbpEfMhIJKbLqV3FdHYGIB2kbLQ=";
   };
 
-  propagatedBuildInputs = [ aiohttp attrs python-socks ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    attrs
+    python-socks
+  ];
 
   # Checks needs internet access
   doCheck = false;
-  pythonImportsCheck = [ "aiohttp_socks" ];
 
-  disabled = pythonOlder "3.5.3";
+  pythonImportsCheck = [
+    "aiohttp_socks"
+  ];
 
   meta = {
     description = "SOCKS proxy connector for aiohttp";
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index ebbcf6ea82a4..691345d65a16 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -1,15 +1,15 @@
 { lib
 , stdenv
 , buildPythonPackage
-, fetchPypi
-, fetchpatch
 , pythonOlder
+, fetchFromGitHub
+, substituteAll
+, llhttp
 # build_requires
+, cython
 , setuptools
-, wheel
 # install_requires
 , attrs
-, charset-normalizer
 , multidict
 , async-timeout
 , yarl
@@ -17,70 +17,74 @@
 , aiosignal
 , aiodns
 , brotli
-, faust-cchardet
-, typing-extensions
 # tests_require
-, async-generator
-, freezegun
 , gunicorn
 , pytest-mock
 , pytestCheckHook
+, python-on-whales
 , re-assert
+, time-machine
 , trustme
 }:
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.8.6";
-  format = "pyproject";
+  version = "3.9.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-sM8qRQG/+TMKilJItM6VGFHkFb3M6dwVjnbP1V4VCFw=";
+  src = fetchFromGitHub {
+    owner = "aio-libs";
+    repo = "aiohttp";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uiqBUDbmROrhkanfBz4avvTSrnKxgVqw54k4jKhfRGY=";
   };
 
   patches = [
-    (fetchpatch {
-      # https://github.com/aio-libs/aiohttp/pull/7260
-      # Merged upstream, should be dropped once updated to 3.9.0
-      url = "https://github.com/aio-libs/aiohttp/commit/7dcc235cafe0c4521bbbf92f76aecc82fee33e8b.patch";
-      hash = "sha256-ZzhlE50bmA+e2XX2RH1FuWQHZIAa6Dk/hZjxPoX5t4g=";
+    (substituteAll {
+      src = ./unvendor-llhttp.patch;
+      llhttpDev = lib.getDev llhttp;
+      llhttpLib = lib.getLib llhttp;
     })
   ];
 
   postPatch = ''
     sed -i '/--cov/d' setup.cfg
+
+    rm -r vendor
+    patchShebangs tools
+    touch .git  # tools/gen.py uses .git to find the project root
   '';
 
   nativeBuildInputs = [
+    cython
     setuptools
-    wheel
   ];
 
+  preBuild = ''
+    make cythonize
+  '';
+
   propagatedBuildInputs = [
     attrs
-    charset-normalizer
     multidict
     async-timeout
     yarl
-    typing-extensions
     frozenlist
     aiosignal
     aiodns
     brotli
-    faust-cchardet
   ];
 
   # NOTE: pytest-xdist cannot be added because it is flaky. See https://github.com/NixOS/nixpkgs/issues/230597 for more info.
   nativeCheckInputs = [
-    async-generator
-    freezegun
     gunicorn
     pytest-mock
     pytestCheckHook
+    python-on-whales
     re-assert
+    time-machine
   ] ++ lib.optionals (!(stdenv.isDarwin && stdenv.isAarch64)) [
     # Optional test dependency. Depends indirectly on pyopenssl, which is
     # broken on aarch64-darwin.
@@ -100,6 +104,8 @@ buildPythonPackage rec {
     "test_static_file_if_none_match"
     "test_static_file_if_match"
     "test_static_file_if_modified_since_past_date"
+    # don't run benchmarks
+    "test_import_time"
   ] ++ lib.optionals stdenv.is32bit [
     "test_cookiejar"
   ] ++ lib.optionals stdenv.isDarwin [
@@ -108,15 +114,15 @@ buildPythonPackage rec {
   ];
 
   disabledTestPaths = [
-    "test_proxy_functional.py" # FIXME package proxy.py
+    "tests/test_proxy_functional.py" # FIXME package proxy.py
   ];
 
   __darwinAllowLocalNetworking = true;
 
   # aiohttp in current folder shadows installed version
-  # Probably because we run `python -m pytest` instead of `pytest` in the hook.
   preCheck = ''
-    cd tests
+    rm -r aiohttp
+    touch tests/data.unknown_mime_type # has to be modified after 1 Jan 1990
   '' + lib.optionalString stdenv.isDarwin ''
     # Work around "OSError: AF_UNIX path too long"
     export TMPDIR="/tmp"
diff --git a/pkgs/development/python-modules/aiohttp/unvendor-llhttp.patch b/pkgs/development/python-modules/aiohttp/unvendor-llhttp.patch
new file mode 100644
index 000000000000..49b3e9154ded
--- /dev/null
+++ b/pkgs/development/python-modules/aiohttp/unvendor-llhttp.patch
@@ -0,0 +1,60 @@
+diff --git a/Makefile b/Makefile
+index 5769d2a1..f505dd81 100644
+--- a/Makefile
++++ b/Makefile
+@@ -71,7 +71,7 @@ vendor/llhttp/node_modules: vendor/llhttp/package.json
+ generate-llhttp: .llhttp-gen
+ 
+ .PHONY: cythonize
+-cythonize: .install-cython $(PYXS:.pyx=.c)
++cythonize: $(PYXS:.pyx=.c)
+ 
+ .install-deps: .install-cython $(PYXS:.pyx=.c) $(call to-hash,$(CYS) $(REQS))
+ 	@python -m pip install -r requirements/dev.txt -c requirements/constraints.txt
+diff --git a/aiohttp/_cparser.pxd b/aiohttp/_cparser.pxd
+index 165dd61d..bc6bf86d 100644
+--- a/aiohttp/_cparser.pxd
++++ b/aiohttp/_cparser.pxd
+@@ -10,7 +10,7 @@ from libc.stdint cimport (
+ )
+ 
+ 
+-cdef extern from "../vendor/llhttp/build/llhttp.h":
++cdef extern from "@llhttpDev@/include/llhttp.h":
+ 
+     struct llhttp__internal_s:
+         int32_t _index
+diff --git a/setup.py b/setup.py
+index 4d59a022..d87d5b69 100644
+--- a/setup.py
++++ b/setup.py
+@@ -17,13 +17,6 @@ if sys.implementation.name != "cpython":
+     NO_EXTENSIONS = True
+ 
+ 
+-if IS_GIT_REPO and not (HERE / "vendor/llhttp/README.md").exists():
+-    print("Install submodules when building from git clone", file=sys.stderr)
+-    print("Hint:", file=sys.stderr)
+-    print("  git submodule update --init", file=sys.stderr)
+-    sys.exit(2)
+-
+-
+ # NOTE: makefile cythonizes all Cython modules
+ 
+ extensions = [
+@@ -33,12 +26,11 @@ extensions = [
+         [
+             "aiohttp/_http_parser.c",
+             "aiohttp/_find_header.c",
+-            "vendor/llhttp/build/c/llhttp.c",
+-            "vendor/llhttp/src/native/api.c",
+-            "vendor/llhttp/src/native/http.c",
+         ],
+         define_macros=[("LLHTTP_STRICT_MODE", 0)],
+-        include_dirs=["vendor/llhttp/build"],
++        include_dirs=["@llhttpDev@/include"],
++        library_dirs=["@llhttpLib@/lib"],
++        libraries=["llhttp"],
+     ),
+     Extension("aiohttp._helpers", ["aiohttp/_helpers.c"]),
+     Extension("aiohttp._http_writer", ["aiohttp/_http_writer.c"]),
diff --git a/pkgs/development/python-modules/aiojobs/default.nix b/pkgs/development/python-modules/aiojobs/default.nix
index 1061b4f777a7..b4ccb7b7fb4e 100644
--- a/pkgs/development/python-modules/aiojobs/default.nix
+++ b/pkgs/development/python-modules/aiojobs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "aiojobs";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = "aiojobs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/+PTHLrZyf2UuYkLWkNgzf9amFywDJnP2OKVWvARcAA=";
+    hash = "sha256-LwFXb/SHP6bbqPg1tqYwE03FKHf4Mv1PPOxnPdESH0I=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aionotion/default.nix b/pkgs/development/python-modules/aionotion/default.nix
index c99a317d2ca1..2d8f1835554a 100644
--- a/pkgs/development/python-modules/aionotion/default.nix
+++ b/pkgs/development/python-modules/aionotion/default.nix
@@ -2,8 +2,8 @@
 , aiohttp
 , aresponses
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
-, fetchpatch
 , poetry-core
 , pydantic
 , pytest-aiohttp
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "aionotion";
-  version = "2023.05.5";
+  version = "2023.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,30 +23,17 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
-    rev = version;
-    hash = "sha256-/2sF8m5R8YXkP89bi5zR3h13r5LrFOl1OsixAcX0D4o=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-SxlMsntiG/geDDWDx5dyXkDaOkTEaDJI2zHlv4/+SDQ=";
   };
 
-  patches = [
-    # This patch removes references to setuptools and wheel that are no longer
-    # necessary and changes poetry to poetry-core, so that we don't need to add
-    # unnecessary nativeBuildInputs.
-    #
-    #   https://github.com/bachya/aionotion/pull/269
-    #
-    (fetchpatch {
-      name = "clean-up-build-dependencies.patch";
-      url = "https://github.com/bachya/aionotion/commit/53c7285110d12810f9b43284295f71d052a81b83.patch";
-      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
-    })
-  ];
-
   nativeBuildInputs = [
     poetry-core
   ];
 
   propagatedBuildInputs = [
     aiohttp
+    certifi
     pydantic
   ];
 
@@ -71,6 +58,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for Notion Home Monitoring";
     homepage = "https://github.com/bachya/aionotion";
+    changelog = "https://github.com/bachya/aionotion/releases/tag/${src.rev}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aiooss2/default.nix b/pkgs/development/python-modules/aiooss2/default.nix
index 91c71fb2bcd6..0c0e512dae98 100644
--- a/pkgs/development/python-modules/aiooss2/default.nix
+++ b/pkgs/development/python-modules/aiooss2/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-PwgbUZAuk2woEmLYDdWF5hTs19DASxxUv3Ga844ai7g=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "aiohttp"
     "oss2"
diff --git a/pkgs/development/python-modules/aiopurpleair/default.nix b/pkgs/development/python-modules/aiopurpleair/default.nix
index bdbc83fd2ab3..2fd8515b237a 100644
--- a/pkgs/development/python-modules/aiopurpleair/default.nix
+++ b/pkgs/development/python-modules/aiopurpleair/default.nix
@@ -2,8 +2,8 @@
 , aiohttp
 , aresponses
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
-, fetchpatch
 , poetry-core
 , pydantic
 , pytest-aiohttp
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aiopurpleair";
-  version = "2022.12.1";
+  version = "2023.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,28 +23,9 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-YmJH4brWkTpgzyHwu9UnIWrY5qlDCmMtvF+KxQFXwfk=";
+    hash = "sha256-2Ngo2pvzwcgQvpyW5Q97VQN/tGSVhVJwRj0DMaPn+O4=";
   };
 
-  patches = [
-    # This patch removes references to setuptools and wheel that are no longer
-    # necessary and changes poetry to poetry-core, so that we don't need to add
-    # unnecessary nativeBuildInputs.
-    #
-    #   https://github.com/bachya/aiopurpleair/pull/207
-    #
-    (fetchpatch {
-      name = "clean-up-build-dependencies.patch";
-      url = "https://github.com/bachya/aiopurpleair/commit/8c704c51ea50da266f52a7f53198d29d643b30c5.patch";
-      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'pydantic = "^1.10.2"' 'pydantic = "*"'
-  '';
-
   nativeBuildInputs = [
     poetry-core
   ];
@@ -52,6 +33,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     aiohttp
     pydantic
+    certifi
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/aiopurpleair/pydantic_2-compatibility.patch b/pkgs/development/python-modules/aiopurpleair/pydantic_2-compatibility.patch
new file mode 100644
index 000000000000..090014778fa6
--- /dev/null
+++ b/pkgs/development/python-modules/aiopurpleair/pydantic_2-compatibility.patch
@@ -0,0 +1,111 @@
+diff --git a/aiopurpleair/api.py b/aiopurpleair/api.py
+index d3b276b..c557015 100644
+--- a/aiopurpleair/api.py
++++ b/aiopurpleair/api.py
+@@ -5,7 +5,10 @@ from typing import Any, cast
+ 
+ from aiohttp import ClientSession, ClientTimeout
+ from aiohttp.client_exceptions import ClientError
+-from pydantic import BaseModel, ValidationError
++try:
++    from pydantic.v1 import BaseModel, ValidationError
++except ModuleNotFoundError:
++    from pydantic import BaseModel, ValidationError
+ 
+ from aiopurpleair.const import LOGGER
+ from aiopurpleair.endpoints.sensors import SensorsEndpoints
+diff --git a/aiopurpleair/endpoints/__init__.py b/aiopurpleair/endpoints/__init__.py
+index 4d263e1..6632310 100644
+--- a/aiopurpleair/endpoints/__init__.py
++++ b/aiopurpleair/endpoints/__init__.py
+@@ -4,7 +4,10 @@ from __future__ import annotations
+ from collections.abc import Awaitable, Callable, Iterable
+ from typing import Any
+ 
+-from pydantic import BaseModel, ValidationError
++try:
++    from pydantic.v1 import BaseModel, ValidationError
++except ModuleNotFoundError:
++    from pydantic import BaseModel, ValidationError
+ 
+ from aiopurpleair.errors import InvalidRequestError
+ from aiopurpleair.helpers.typing import ModelT
+diff --git a/aiopurpleair/helpers/typing.py b/aiopurpleair/helpers/typing.py
+index 4ae01e6..49f59e6 100644
+--- a/aiopurpleair/helpers/typing.py
++++ b/aiopurpleair/helpers/typing.py
+@@ -1,6 +1,9 @@
+ """Define typing helpers."""
+ from typing import TypeVar
+ 
+-from pydantic import BaseModel
++try:
++    from pydantic.v1 import BaseModel
++except ModuleNotFoundError:
++    from pydantic import BaseModel
+ 
+ ModelT = TypeVar("ModelT", bound=BaseModel)
+diff --git a/aiopurpleair/models/keys.py b/aiopurpleair/models/keys.py
+index 591ae01..ffadbcc 100644
+--- a/aiopurpleair/models/keys.py
++++ b/aiopurpleair/models/keys.py
+@@ -3,7 +3,10 @@ from __future__ import annotations
+ 
+ from datetime import datetime
+ 
+-from pydantic import BaseModel, validator
++try:
++    from pydantic.v1 import BaseModel, validator
++except ModuleNotFoundError:
++    from pydantic import BaseModel, validator
+ 
+ from aiopurpleair.backports.enum import StrEnum
+ from aiopurpleair.helpers.validators import validate_timestamp
+diff --git a/aiopurpleair/models/sensors.py b/aiopurpleair/models/sensors.py
+index 5b99b51..d435996 100644
+--- a/aiopurpleair/models/sensors.py
++++ b/aiopurpleair/models/sensors.py
+@@ -5,7 +5,10 @@ from __future__ import annotations
+ from datetime import datetime
+ from typing import Any, Optional
+ 
+-from pydantic import BaseModel, root_validator, validator
++try:
++    from pydantic.v1 import BaseModel, root_validator, validator
++except ModuleNotFoundError:
++    from pydantic import BaseModel, root_validator, validator
+ 
+ from aiopurpleair.const import SENSOR_FIELDS, ChannelFlag, ChannelState, LocationType
+ from aiopurpleair.helpers.validators import validate_timestamp
+diff --git a/tests/models/test_keys.py b/tests/models/test_keys.py
+index 0d7d7c8..b2e30c1 100644
+--- a/tests/models/test_keys.py
++++ b/tests/models/test_keys.py
+@@ -5,7 +5,10 @@ from datetime import datetime
+ from typing import Any
+ 
+ import pytest
+-from pydantic import ValidationError
++try:
++    from pydantic.v1 import ValidationError
++except ModuleNotFoundError:
++    from pydantic import ValidationError
+ 
+ from aiopurpleair.models.keys import ApiKeyType, GetKeysResponse
+ 
+diff --git a/tests/models/test_sensors.py b/tests/models/test_sensors.py
+index a984b36..7b2c84f 100644
+--- a/tests/models/test_sensors.py
++++ b/tests/models/test_sensors.py
+@@ -5,7 +5,10 @@ from datetime import datetime
+ from typing import Any
+ 
+ import pytest
+-from pydantic import ValidationError
++try:
++    from pydantic.v1 import ValidationError
++except ModuleNotFoundError:
++    from pydantic import ValidationError
+ 
+ from aiopurpleair.models.sensors import (
+     GetSensorsRequest,
diff --git a/pkgs/development/python-modules/aiopvapi/default.nix b/pkgs/development/python-modules/aiopvapi/default.nix
index 055239052ddb..710421cd366e 100644
--- a/pkgs/development/python-modules/aiopvapi/default.nix
+++ b/pkgs/development/python-modules/aiopvapi/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aiopvapi";
-  version = "2.0.4";
+  version = "3.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "sander76";
     repo = "aio-powerview-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cghfNi5T343/7GxNLDrE0iAewMlRMycQTP7SvDVpU2M=";
+    hash = "sha256-+jhfp8gLEmL8TGPPN7QY8lw1SkV4sMSDb4VSq2OJ6PU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioquic/default.nix b/pkgs/development/python-modules/aioquic/default.nix
index 9aeb06a1382d..fc0fe63de4e5 100644
--- a/pkgs/development/python-modules/aioquic/default.nix
+++ b/pkgs/development/python-modules/aioquic/default.nix
@@ -7,24 +7,31 @@
 , pyopenssl
 , pytestCheckHook
 , pythonOlder
+, setuptools
+, service-identity
 }:
 
 buildPythonPackage rec {
   pname = "aioquic";
-  version = "0.9.21";
-  format = "setuptools";
+  version = "0.9.23";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ecfsBjGOeFYnZlyk6HI63zR7ciW30AbjMtJXWh9RbvU=";
+    hash = "sha256-UsnaYO0IN/6LimoNfc8N++vsjpoCfhDr9yBPBWnFj6g=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     certifi
     pylsqpack
     pyopenssl
+    service-identity
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/aioresponses/default.nix b/pkgs/development/python-modules/aioresponses/default.nix
index 572d88044356..6cbcad24bdc4 100644
--- a/pkgs/development/python-modules/aioresponses/default.nix
+++ b/pkgs/development/python-modules/aioresponses/default.nix
@@ -1,33 +1,43 @@
 { lib
-, aiohttp
 , buildPythonPackage
-, ddt
 , fetchPypi
-, pbr
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, pbr
 , setuptools
+
+# dependencies
+, aiohttp
+
+# tests
+, ddt
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "aioresponses";
-  version = "0.7.4";
-  format = "setuptools";
+  version = "0.7.6";
+  pyproject = true;
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-m4wQizY1TARjO60Op1K1XZVqdgL+PjI0uTn8RK+W8dg=";
+    hash = "sha256-95XZ29otYXdIQOfjL1Nm9FdS0a3Bt0yTYq/QFylsfuE=";
   };
 
   nativeBuildInputs = [
     pbr
+    setuptools
   ];
 
   propagatedBuildInputs = [
     aiohttp
-    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "aioresponses"
   ];
 
   nativeCheckInputs = [
@@ -41,10 +51,6 @@ buildPythonPackage rec {
     "test_pass_through_with_origin_params"
   ];
 
-  pythonImportsCheck = [
-    "aioresponses"
-  ];
-
   meta = {
     description = "A helper to mock/fake web requests in python aiohttp package";
     homepage = "https://github.com/pnuckowski/aioresponses";
diff --git a/pkgs/development/python-modules/aioridwell/default.nix b/pkgs/development/python-modules/aioridwell/default.nix
index d96add82b7d2..63f14b199131 100644
--- a/pkgs/development/python-modules/aioridwell/default.nix
+++ b/pkgs/development/python-modules/aioridwell/default.nix
@@ -2,6 +2,7 @@
 , aiohttp
 , aresponses
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
 , freezegun
 , poetry-core
@@ -35,6 +36,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
+    certifi
     pyjwt
     pytz
     titlecase
diff --git a/pkgs/development/python-modules/aiormq/default.nix b/pkgs/development/python-modules/aiormq/default.nix
index 3a5b809c13fe..14c0d0f7b513 100644
--- a/pkgs/development/python-modules/aiormq/default.nix
+++ b/pkgs/development/python-modules/aiormq/default.nix
@@ -6,9 +6,7 @@
 , pytestCheckHook
 , pamqp
 , yarl
-, setuptools
 , poetry-core
-, aiomisc
 }:
 
 buildPythonPackage rec {
@@ -20,13 +18,13 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "mosquito";
-    repo = pname;
-    rev = "refs/tags/${version}";
-    hash = "sha256-X5Uy1DGxvsyEFR1UgVYqxOX6mESLnNzQl7sVkvzjcw4=";
+    repo = "aiormq";
+    # https://github.com/mosquito/aiormq/issues/189
+    rev = "72c44f55313fc14e2a760a45a09831237b64c48d";
+    hash = "sha256-IIlna8aQY6bIA7OZHthfvMFFWnf3DDRBP1uiFCD7+Do=";
   };
 
   nativeBuildInputs = [
-    setuptools
     poetry-core
   ];
 
diff --git a/pkgs/development/python-modules/aioshutil/default.nix b/pkgs/development/python-modules/aioshutil/default.nix
index 0fc144ac6f2b..84813ff04c97 100644
--- a/pkgs/development/python-modules/aioshutil/default.nix
+++ b/pkgs/development/python-modules/aioshutil/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-XIGjiLjoyS/7vUDIyBPvHNMyHOBa0gsg/c/vGgrhZAg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/aiounittest/default.nix b/pkgs/development/python-modules/aiounittest/default.nix
index 4358c22f8be0..045613837902 100644
--- a/pkgs/development/python-modules/aiounittest/default.nix
+++ b/pkgs/development/python-modules/aiounittest/default.nix
@@ -1,17 +1,20 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
+, setuptools
 , nose
 , coverage
-, isPy27
 , wrapt
 }:
 
 buildPythonPackage rec {
   pname = "aiounittest";
   version = "1.4.2";
-  format = "setuptools";
-  disabled = isPy27;
+  pyproject = true;
+
+  # requires the imp module
+  disabled = pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "kwarunek";
@@ -20,6 +23,10 @@ buildPythonPackage rec {
     hash = "sha256-7lDOI1SHPpRZLTHRTmfbKlZH18T73poJdFyVmb+HKms=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     wrapt
   ];
diff --git a/pkgs/development/python-modules/aiowatttime/default.nix b/pkgs/development/python-modules/aiowatttime/default.nix
index fd5da5c330d5..1b6866b654b4 100644
--- a/pkgs/development/python-modules/aiowatttime/default.nix
+++ b/pkgs/development/python-modules/aiowatttime/default.nix
@@ -2,49 +2,38 @@
 , aiohttp
 , aresponses
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
-, fetchpatch
 , poetry-core
 , pytest-aiohttp
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, yarl
 }:
 
 buildPythonPackage rec {
   pname = "aiowatttime";
-  version = "2023.08.0";
+  version = "2023.10.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-/ulDImbLOTcoA4iH8e65A01aqqnCLn+01DWuM/4H4p4=";
+    hash = "sha256-3cVs/mIMkHx5jyfICL+I9pOr0uCV2uzasrEcAN4UFGg=";
   };
 
-  patches = [
-    # This patch removes references to setuptools and wheel that are no longer
-    # necessary and changes poetry to poetry-core, so that we don't need to add
-    # unnecessary nativeBuildInputs.
-    #
-    #   https://github.com/bachya/aiowatttime/pull/206
-    #
-    (fetchpatch {
-      name = "clean-up-build-dependencies.patch";
-      url = "https://github.com/bachya/aiowatttime/commit/c3cd53f794964c5435148caacd04f4e0ab8f550a.patch";
-      hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
-    })
-  ];
-
   nativeBuildInputs = [
     poetry-core
   ];
 
   propagatedBuildInputs = [
     aiohttp
+    certifi
+    yarl
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/alembic/default.nix b/pkgs/development/python-modules/alembic/default.nix
index 004d025062c9..1b5dc8514414 100644
--- a/pkgs/development/python-modules/alembic/default.nix
+++ b/pkgs/development/python-modules/alembic/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "alembic";
-  version = "1.12.0";
+  version = "1.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jnZFwy5PIAZ15p8HRUFTNetZo2Y/X+tIer+gswxFiIs=";
+    hash = "sha256-q0s7lNLh5fgeNL6Km3t1dfyd1TmPzLC+81HsmxSHJiM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/amazon-ion/default.nix b/pkgs/development/python-modules/amazon-ion/default.nix
index e69de9cfea33..6e28c5da9978 100644
--- a/pkgs/development/python-modules/amazon-ion/default.nix
+++ b/pkgs/development/python-modules/amazon-ion/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "amazon-ion";
-  version = "0.11.2";
+  version = "0.11.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     rev = "refs/tags/v${version}";
     # Test vectors require git submodule
     fetchSubmodules = true;
-    hash = "sha256-0/+bX02qTbOydWDxex4OWL7woP7dW1yJZBmDZAivE7U=";
+    hash = "sha256-wA24ASd6+rTAqHNQ9ZGMnCK9ykJjogCtEWfrXY1B87o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/amberelectric/default.nix b/pkgs/development/python-modules/amberelectric/default.nix
index 1f1422a6b36a..ac32a8cc7824 100644
--- a/pkgs/development/python-modules/amberelectric/default.nix
+++ b/pkgs/development/python-modules/amberelectric/default.nix
@@ -5,21 +5,26 @@
 , pytestCheckHook
 , python-dateutil
 , pythonOlder
+, setuptools
 , urllib3
 }:
 
 buildPythonPackage rec {
   pname = "amberelectric";
-  version = "1.0.4";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5SWJnTxRm6mzP0RxrgA+jnV+Gp23WjqQA57wbT2V9Dk=";
+    hash = "sha256-HujjqJ3nkPIj8P0qAiQnQzLhji5l8qOAO2Gh53OJ7UY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     urllib3
     python-dateutil
@@ -30,7 +35,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "amberelectric" ];
+  pythonImportsCheck = [
+    "amberelectric"
+  ];
 
   meta = with lib; {
     description = "Python Amber Electric API interface";
diff --git a/pkgs/development/python-modules/amqtt/default.nix b/pkgs/development/python-modules/amqtt/default.nix
index b25c1fa46ed2..0daef6d77aa0 100644
--- a/pkgs/development/python-modules/amqtt/default.nix
+++ b/pkgs/development/python-modules/amqtt/default.nix
@@ -2,13 +2,13 @@
 , buildPythonPackage
 , docopt
 , fetchFromGitHub
-, fetchpatch
 , hypothesis
 , passlib
 , poetry-core
 , pytest-logdog
 , pytest-asyncio
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , pyyaml
 , setuptools
@@ -60,6 +60,19 @@ buildPythonPackage rec {
     "--asyncio-mode=auto"
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # stuck in epoll
+    "test_publish_qos0"
+    "test_publish_qos1"
+    "test_publish_qos1_retry"
+    "test_publish_qos2"
+    "test_publish_qos2_retry"
+    "test_receive_qos0"
+    "test_receive_qos1"
+    "test_receive_qos2"
+    "test_start_stop"
+  ];
+
   disabledTestPaths = [
     # Test are not ported from hbmqtt yet
     "tests/test_client.py"
diff --git a/pkgs/development/python-modules/ansible-vault-rw/default.nix b/pkgs/development/python-modules/ansible-vault-rw/default.nix
index 23281c3ed070..9e0005e04e85 100644
--- a/pkgs/development/python-modules/ansible-vault-rw/default.nix
+++ b/pkgs/development/python-modules/ansible-vault-rw/default.nix
@@ -1,15 +1,35 @@
-{ lib, buildPythonPackage, fetchPypi, ansible-core, ... }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, setuptools
+
+# dependencies
+, ansible-core
+
+# tests
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "ansible-vault-rw";
   version = "2.1.0";
-  format = "setuptools";
+  pyproject = true;
+
   src = fetchPypi {
     pname = "ansible-vault";
     inherit version;
-    sha256 = "sha256-XOj9tUcPFEm3a/B64qvFZIDa1INWrkBchbaG77ZNvV4";
+    hash = "sha256-XOj9tUcPFEm3a/B64qvFZIDa1INWrkBchbaG77ZNvV4";
   };
-  propagatedBuildInputs = [ ansible-core ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    ansible-core
+  ];
 
   # Otherwise tests will fail to create directory
   # Permission denied: '/homeless-shelter'
@@ -17,6 +37,13 @@ buildPythonPackage rec {
     export HOME=$(mktemp -d)
   '';
 
+  # no tests in sdist, no 2.1.0 tag on git
+  doCheck = false;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   meta = with lib; {
     description = "This project aim to R/W an ansible-vault yaml file.";
     homepage = "https://github.com/tomoh1r/ansible-vault";
diff --git a/pkgs/development/python-modules/ansible/default.nix b/pkgs/development/python-modules/ansible/default.nix
index 5c08a0f5bf07..42f4d0032cfd 100644
--- a/pkgs/development/python-modules/ansible/default.nix
+++ b/pkgs/development/python-modules/ansible/default.nix
@@ -21,7 +21,7 @@
 
 let
   pname = "ansible";
-  version = "8.6.0";
+  version = "9.0.1";
 in
 buildPythonPackage {
   inherit pname version;
@@ -31,7 +31,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lfTlkydNWdU/NvYiB1NbfScq3CcBrHoO169qbYFjemA=";
+    hash = "sha256-zAbCUfFCg3z1QLeXdyRZapTz0P6dqWGRdeneZTnNBwU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/ansiwrap/default.nix b/pkgs/development/python-modules/ansiwrap/default.nix
index 7e55912bed20..8dbfa99687c8 100644
--- a/pkgs/development/python-modules/ansiwrap/default.nix
+++ b/pkgs/development/python-modules/ansiwrap/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , textwrap3
 }:
@@ -12,7 +13,7 @@ buildPythonPackage rec {
   version = "0.8.4";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.7" || pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/antlr4-python3-runtime/default.nix b/pkgs/development/python-modules/antlr4-python3-runtime/default.nix
index 20daf71c8cda..3b8ed13b1ad8 100644
--- a/pkgs/development/python-modules/antlr4-python3-runtime/default.nix
+++ b/pkgs/development/python-modules/antlr4-python3-runtime/default.nix
@@ -19,12 +19,22 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  postPatch = ''
+    substituteInPlace tests/TestIntervalSet.py \
+      --replace "assertEquals" "assertEqual"
+  '';
+
   # We use an asterisk because this expression is used also for old antlr
   # versions, where there the tests directory is `test` and not `tests`.
   # See e.g in package `baserow`.
   checkPhase = ''
-    cd test*
+    runHook preCheck
+
+    pushd tests
     ${python.interpreter} run.py
+    popd
+
+    runHook postCheck
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 06112cccdc3f..f645a416e834 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -28,20 +28,18 @@
 
 buildPythonPackage rec {
   pname = "anyio";
-  version = "4.0.0";
-  format = "pyproject";
+  version = "4.1.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "agronholm";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-gUFd2gHWIElYfzOvg7Yx7iJyhU6+iAcJpHTVsJtxTsk=";
+    hash = "sha256-PEDPliWJX3QypwsvJTAJhrQnJx8lWXQQSdyjN0I8L+I=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
@@ -64,13 +62,13 @@ buildPythonPackage rec {
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
 
   nativeCheckInputs = [
+    exceptiongroup
     hypothesis
     psutil
     pytest-mock
     pytest-xdist
     pytestCheckHook
     trustme
-  ] ++ lib.optionals (pythonOlder "3.12") [
     uvloop
   ] ++ passthru.optional-dependencies.trio;
 
diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix
index bff63bb84b79..bd53a6f0b48a 100644
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@@ -39,6 +39,7 @@
 , requests
 , requests-mock
 , scikit-learn
+, setuptools
 , sqlalchemy
 , tenacity
 , testcontainers
@@ -48,14 +49,14 @@
 
 buildPythonPackage rec {
   pname = "apache-beam";
-  version = "2.50.0";
-  format = "setuptools";
+  version = "2.52.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "beam";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qaxYWPVdMlegvH/W66UBoQbcQ5Ac/3DNoQs8xo+KfLc=";
+    hash = "sha256-s/DgTMsJc3c3dqR5Ak9p+xmLm72uNL3AofGzR26B3nI=";
   };
 
   patches = [
@@ -95,6 +96,7 @@ buildPythonPackage rec {
     grpcio-tools
     mypy-protobuf
     pythonRelaxDepsHook
+    setuptools
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/apipkg/default.nix b/pkgs/development/python-modules/apipkg/default.nix
index 0edddd68be32..b37c1b11fe6f 100644
--- a/pkgs/development/python-modules/apipkg/default.nix
+++ b/pkgs/development/python-modules/apipkg/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-ANLD7fUMKN3RmAVjVkcpwUH6U9ASalXdwKtPpoC8Urs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/app-model/default.nix b/pkgs/development/python-modules/app-model/default.nix
index c4b0f14dc4c4..014fa13d6e2d 100644
--- a/pkgs/development/python-modules/app-model/default.nix
+++ b/pkgs/development/python-modules/app-model/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-idie99ditHJG/6rv97LDaF71iTjjgJyhLiTrbkQmbts=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index 9d83199ed5cb..336a08e0532f 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   '';
 
   pythonRelaxDeps = [
+    "msgpack"
     "semver"
   ];
 
diff --git a/pkgs/development/python-modules/apricot-select/default.nix b/pkgs/development/python-modules/apricot-select/default.nix
index 105f6a71c915..5680b15530e9 100644
--- a/pkgs/development/python-modules/apricot-select/default.nix
+++ b/pkgs/development/python-modules/apricot-select/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, nose
 , numba
 , numpy
 , pytestCheckHook
@@ -26,6 +27,10 @@ buildPythonPackage rec {
     hash = "sha256-v9BHFxmlbwXVipPze/nV35YijdFBuka3gAl85AlsffQ=";
   };
 
+  postPatch = ''
+    sed -i '/"nose"/d' setup.py
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
@@ -38,6 +43,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    nose
     pytestCheckHook
     torchvision
     scikit-learn
diff --git a/pkgs/development/python-modules/apsw/default.nix b/pkgs/development/python-modules/apsw/default.nix
index 59576a129d68..aafdf6ac72b2 100644
--- a/pkgs/development/python-modules/apsw/default.nix
+++ b/pkgs/development/python-modules/apsw/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "apsw";
-  version = "3.43.1.0";
+  version = "3.44.2.0";
   format = "setuptools";
 
   disabled = isPyPy;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "rogerbinns";
     repo = "apsw";
     rev = "refs/tags/${version}";
-    hash = "sha256-x+bSft37DgF2tXXCL6ac86g1+mj/wJeDLoCSiVSXedA=";
+    hash = "sha256-H7aqZHU4SXNrfbv6iwHckkNm5MeGkro42+njSoFJgS4=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/argcomplete/default.nix b/pkgs/development/python-modules/argcomplete/default.nix
index 765a7848ac56..7c5bf5436996 100644
--- a/pkgs/development/python-modules/argcomplete/default.nix
+++ b/pkgs/development/python-modules/argcomplete/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-Akwa6dsf8w/Sw0ydUrqKEP5+dzHYX4hS8vcl7Gw4ePc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/argh/default.nix b/pkgs/development/python-modules/argh/default.nix
index a03e441c8fda..2a0ba451d28a 100644
--- a/pkgs/development/python-modules/argh/default.nix
+++ b/pkgs/development/python-modules/argh/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "argh";
-  version = "0.29.4";
+  version = "0.30.4";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aVwK5FNCcMriaXhBtKVvQ0qZBpSgAmTqEOu7zcAsE/c=";
+    hash = "sha256-n8qOacTa1PjSp7373YCwdURitTUQoD4bXPK0Oofm6WA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ariadne/default.nix b/pkgs/development/python-modules/ariadne/default.nix
index 0e0bf1140a64..ecfb0c32bc46 100644
--- a/pkgs/development/python-modules/ariadne/default.nix
+++ b/pkgs/development/python-modules/ariadne/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ariadne";
-  version = "0.20.1";
+  version = "0.21.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "mirumee";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-v3CaLMTo/zbNEoE3K+aWnFTCgLetcnN7vOU/sFqLq2k=";
+    hash = "sha256-T5J0xAF33PDkC8sDOzHADpQJxwdXwKary0y/jaUJ9Fk=";
   };
   patches = [
     ./remove-opentracing.patch
diff --git a/pkgs/development/python-modules/array-record/default.nix b/pkgs/development/python-modules/array-record/default.nix
index 3abe60f64d5e..c37eec6baba0 100644
--- a/pkgs/development/python-modules/array-record/default.nix
+++ b/pkgs/development/python-modules/array-record/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , pythonOlder
+, pythonAtLeast
 , python
 , fetchPypi
 , absl-py
@@ -16,7 +17,7 @@ buildPythonPackage rec {
   format = "wheel";
 
   # As of 2023-10-31, PyPI includes wheels for Python 3.9, 3.10, and 3.11.
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.9" || pythonAtLeast "3.12";
 
   src = let
     pyShortVersion = "cp${builtins.replaceStrings ["."] [""] python.pythonVersion}";
diff --git a/pkgs/development/python-modules/arrow/default.nix b/pkgs/development/python-modules/arrow/default.nix
index 1801900dcdef..77aa1f6ca4ac 100644
--- a/pkgs/development/python-modules/arrow/default.nix
+++ b/pkgs/development/python-modules/arrow/default.nix
@@ -2,8 +2,9 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, flit-core
 , python-dateutil
-, typing-extensions
+, types-python-dateutil
 , pytestCheckHook
 , pytest-mock
 , pytz
@@ -12,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "arrow";
-  version = "1.2.3";
-  format = "setuptools";
+  version = "1.3.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OTSzDKG58pI3bZ2xWxlEYIjRLsWGKbw/DaKP1V+2M6E=";
+    hash = "sha256-1FQGF2SMtfiVcw8a2MgqZfLa0BZvV7dfPKVHWcTWeoU=";
   };
 
   postPatch = ''
@@ -27,8 +28,14 @@ buildPythonPackage rec {
     sed -i "/addopts/d" tox.ini
   '';
 
-  propagatedBuildInputs = [ python-dateutil ]
-    ++ lib.optionals (pythonOlder "3.8") [ typing-extensions ];
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    python-dateutil
+    types-python-dateutil
+  ];
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/asdf/default.nix b/pkgs/development/python-modules/asdf/default.nix
index f4a45ecaf9ad..a6508229a3f0 100644
--- a/pkgs/development/python-modules/asdf/default.nix
+++ b/pkgs/development/python-modules/asdf/default.nix
@@ -33,8 +33,6 @@ buildPythonPackage rec {
     hash = "sha256-u8e7ot5NDRqQFH0eLVnGinBQmQD73BlR5K9HVjA7SIg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   patches = [
     # Fix default validation, https://github.com/asdf-format/asdf/pull/1203
     (fetchpatch {
diff --git a/pkgs/development/python-modules/asn1crypto/default.nix b/pkgs/development/python-modules/asn1crypto/default.nix
index 4822c5a16ac8..58bfe11458db 100644
--- a/pkgs/development/python-modules/asn1crypto/default.nix
+++ b/pkgs/development/python-modules/asn1crypto/default.nix
@@ -1,22 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# tests
 , pytestCheckHook
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "asn1crypto";
-  version = "1.5.1";
-  format = "setuptools";
+  version = "1.5.1-unstable-2023-11-03";
+  pyproject = true;
 
   # Pulling from Github to run tests
   src = fetchFromGitHub {
     owner = "wbond";
     repo = "asn1crypto";
-    rev = version;
-    hash = "sha256-M8vASxhaJPgkiTrAckxz7gk/QHkrFlNz7fFbnLEBT+M=";
+    # https://github.com/wbond/asn1crypto/issues/269
+    rev = "b763a757bb2bef2ab63620611ddd8006d5e9e4a2";
+    hash = "sha256-11WajEDtisiJsKQjZMSd5sDog3DuuBzf1PcgSY+uuXY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/aspectlib/default.nix b/pkgs/development/python-modules/aspectlib/default.nix
index 70fd8e8db2e2..3f4a87e0a334 100644
--- a/pkgs/development/python-modules/aspectlib/default.nix
+++ b/pkgs/development/python-modules/aspectlib/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.7";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -47,12 +47,16 @@ buildPythonPackage rec {
     "aspectlib.test"
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     process-tests
     pytestCheckHook
     tornado
   ];
 
+  pytestFlagsArray = [
+    "-W ignore::DeprecationWarning"
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   meta = {
diff --git a/pkgs/development/python-modules/asteval/default.nix b/pkgs/development/python-modules/asteval/default.nix
index 49abd982a0f0..0fc6631dd590 100644
--- a/pkgs/development/python-modules/asteval/default.nix
+++ b/pkgs/development/python-modules/asteval/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-XIRDm/loZOOPQ7UO/XAo86TzhtHHRrnWFU7MNI4f1vM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace " --cov=asteval --cov-report xml" ""
diff --git a/pkgs/development/python-modules/astroid/default.nix b/pkgs/development/python-modules/astroid/default.nix
index 5fd0a5281b2c..6d5c11104315 100644
--- a/pkgs/development/python-modules/astroid/default.nix
+++ b/pkgs/development/python-modules/astroid/default.nix
@@ -2,55 +2,38 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
-, isPyPy
-, lazy-object-proxy
 , setuptools
-, wheel
 , typing-extensions
-, typed-ast
 , pip
 , pylint
 , pytestCheckHook
-, wrapt
 }:
 
 buildPythonPackage rec {
   pname = "astroid";
-  version = "2.15.6"; # Check whether the version is compatible with pylint
-  format = "pyproject";
+  version = "3.0.1"; # Check whether the version is compatible with pylint
+  pyproject = true;
 
-  disabled = pythonOlder "3.7.2";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "PyCQA";
-    repo = pname;
+    repo = "astroid";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0oNNEVD8rYGkM11nGUD+XMwE7xgk7mJIaplrAXaECFg=";
+    hash = "sha256-z6FmB3I3VmiIx0MSsrkvHmDVv2h3CaaeXlDG3DewGXw=";
   };
 
   nativeBuildInputs = [
     setuptools
-    wheel
   ];
 
-  propagatedBuildInputs = [
-    lazy-object-proxy
-    wrapt
-  ] ++ lib.optionals (pythonOlder "3.11") [
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.11") [
     typing-extensions
-  ] ++ lib.optionals (!isPyPy && pythonOlder "3.8") [
-    typed-ast
   ];
 
   nativeCheckInputs = [
     pip
     pytestCheckHook
-    typing-extensions
-  ];
-
-  disabledTests = [
-    # DeprecationWarning: Deprecated call to `pkg_resources.declare_namespace('tests.testdata.python3.data.path_pkg_resources_1.package')`.
-    "test_identify_old_namespace_package_protocol"
   ];
 
   passthru.tests = {
@@ -62,6 +45,6 @@ buildPythonPackage rec {
     description = "An abstract syntax tree for Python with inference support";
     homepage = "https://github.com/PyCQA/astroid";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ GaetanLepage ];
   };
 }
diff --git a/pkgs/development/python-modules/astropy-extension-helpers/default.nix b/pkgs/development/python-modules/astropy-extension-helpers/default.nix
index d02ed1236154..9f7280185aed 100644
--- a/pkgs/development/python-modules/astropy-extension-helpers/default.nix
+++ b/pkgs/development/python-modules/astropy-extension-helpers/default.nix
@@ -6,16 +6,18 @@
 , pytestCheckHook
 , pythonOlder
 , pip
+, setuptools
 , setuptools-scm
+, tomli
 , wheel
 }:
 
 buildPythonPackage rec {
   pname = "extension-helpers";
   version = "1.1.0";
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -33,10 +35,15 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
     wheel
   ];
 
+  propagatedBuildInputs = [
+    tomli
+  ];
+
   nativeCheckInputs = [
     findutils
     pip
diff --git a/pkgs/development/python-modules/astropy-healpix/default.nix b/pkgs/development/python-modules/astropy-healpix/default.nix
index 6944ee4d8683..c08146363217 100644
--- a/pkgs/development/python-modules/astropy-healpix/default.nix
+++ b/pkgs/development/python-modules/astropy-healpix/default.nix
@@ -6,6 +6,7 @@
 , numpy
 , astropy
 , astropy-extension-helpers
+, setuptools
 , setuptools-scm
 , pytestCheckHook
 , pytest-doctestplus
@@ -14,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "astropy-healpix";
-  version = "1.0.0";
-  format = "setuptools";
+  version = "1.0.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = lib.replaceStrings ["-"] ["_"] pname;
-    hash = "sha256-9ILvYqEOaGMD84xm8I3xe53e5a2CIZwjVx7oDXar7qM=";
+    hash = "sha256-74k4vfcpdXw4CowXNHlNc3StAOB2f8Si+mOma+8SYkI=";
   };
 
   patches = [
@@ -35,6 +36,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     astropy-extension-helpers
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/astropy-iers-data/default.nix b/pkgs/development/python-modules/astropy-iers-data/default.nix
new file mode 100644
index 000000000000..4089c6bc6cce
--- /dev/null
+++ b/pkgs/development/python-modules/astropy-iers-data/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, setuptools
+, setuptools-scm
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "astropy-iers-data";
+  version = "0.2023.12.04.00.30.20";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "astropy";
+    repo = "astropy-iers-data";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-r4YCBeAyqzwQghLK56d+nJ/TkoSIHmtiW5Gi5xXM2QM=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  pythonImportsCheck = [ "astropy_iers_data" ];
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "IERS data maintained by @astrofrog and astropy.utils.iers maintainers";
+    homepage = "https://github.com/astropy/astropy-iers-data";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/astropy/default.nix b/pkgs/development/python-modules/astropy/default.nix
index 0a70e40e9e8a..4814e1e70c40 100644
--- a/pkgs/development/python-modules/astropy/default.nix
+++ b/pkgs/development/python-modules/astropy/default.nix
@@ -1,12 +1,11 @@
 { lib
 , fetchPypi
-, fetchpatch
 , buildPythonPackage
 , pythonOlder
 
 # build time
 , astropy-extension-helpers
-, cython
+, cython_3
 , jinja2
 , oldest-supported-numpy
 , setuptools-scm
@@ -15,9 +14,9 @@
 , pytestCheckHook
 , pytest-xdist
 , pytest-astropy
-, python
 
 # runtime
+, astropy-iers-data
 , numpy
 , packaging
 , pyerfa
@@ -26,26 +25,19 @@
 
 buildPythonPackage rec {
   pname = "astropy";
-  version = "5.3.4";
-  format = "pyproject";
+  version = "6.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8"; # according to setup.cfg
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1JD34vqsLMwBySRCAtYpFUJZr4qXkQTO2J3ErOTm8dg=";
+    hash = "sha256-A82AGlUwXaUjzY14DXY1n1clXc3Fn+C91x/VFU/Hd9k=";
   };
-  # Relax cython dependency to allow this to build, upstream only doesn't
-  # support cython 3 as of writing. See:
-  # https://github.com/astropy/astropy/issues/15315
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'cython==' 'cython>='
-  '';
 
   nativeBuildInputs = [
     astropy-extension-helpers
-    cython
+    cython_3
     jinja2
     oldest-supported-numpy
     setuptools-scm
@@ -53,6 +45,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    astropy-iers-data
     numpy
     packaging
     pyerfa
diff --git a/pkgs/development/python-modules/asttokens/default.nix b/pkgs/development/python-modules/asttokens/default.nix
index 452abd626e0b..53fe96ff4d03 100644
--- a/pkgs/development/python-modules/asttokens/default.nix
+++ b/pkgs/development/python-modules/asttokens/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "asttokens";
-  version = "2.4.0";
+  version = "2.4.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LgFxuZGyyVmsxsSTGASSNoRKXaHWW6JnLEiAwciUg04=";
+    hash = "sha256-sDhpcYuppusCfhNL/fafOKI21oHIPBYNUQdorxElS6A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/async-generator/default.nix b/pkgs/development/python-modules/async-generator/default.nix
index 5ddb6df48ee9..92c281580d9e 100644
--- a/pkgs/development/python-modules/async-generator/default.nix
+++ b/pkgs/development/python-modules/async-generator/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , pythonOlder
 , pytestCheckHook
 }:
@@ -22,6 +23,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    "test_aclose_on_unstarted_generator"
+  ];
+
   pythonImportsCheck = [ "async_generator" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/async-tkinter-loop/default.nix b/pkgs/development/python-modules/async-tkinter-loop/default.nix
index d376ec154263..9d469ca43bc0 100644
--- a/pkgs/development/python-modules/async-tkinter-loop/default.nix
+++ b/pkgs/development/python-modules/async-tkinter-loop/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "async-tkinter-loop";
-  version = "0.9.2";
+  version = "0.9.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "async_tkinter_loop";
-    hash = "sha256-YwmW+zXAx9TAxgoRLEr7/3o1rrO4eSNScuoTh3ud2Vo=";
+    hash = "sha256-UJxBgTmEe8suR6WmttJKLi3KKQvEaNrWtrgCnoqGW/0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/asyncclick/default.nix b/pkgs/development/python-modules/asyncclick/default.nix
index 48ba646b7412..2d0066a86e13 100644
--- a/pkgs/development/python-modules/asyncclick/default.nix
+++ b/pkgs/development/python-modules/asyncclick/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-by1clF+WAfN/gjOg/F60O1tCZ3qAhWqiiJJY04iMzQ8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/asyncio-mqtt/default.nix b/pkgs/development/python-modules/asyncio-mqtt/default.nix
index 8274f5493967..309e74ba4cc1 100644
--- a/pkgs/development/python-modules/asyncio-mqtt/default.nix
+++ b/pkgs/development/python-modules/asyncio-mqtt/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-f3JqocjOEwNjo6Uv17ij6oEdrjb6Z2wTzdhdVhx46iM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
@@ -65,6 +63,9 @@ buildPythonPackage rec {
     "test_multiple_messages_generators"
   ];
 
+  # newer version are packaged as aiomqtt
+  passthru.skipBulkUpdate = true;
+
   meta = with lib; {
     description = "Idomatic asyncio wrapper around paho-mqtt";
     homepage = "https://github.com/sbtinstruments/asyncio-mqtt";
diff --git a/pkgs/development/python-modules/asyncpg/default.nix b/pkgs/development/python-modules/asyncpg/default.nix
index 9e43c0494d14..88591af61bbd 100644
--- a/pkgs/development/python-modules/asyncpg/default.nix
+++ b/pkgs/development/python-modules/asyncpg/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "asyncpg";
-  version = "0.28.0";
+  version = "0.29.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-clLNw6yy9S/qo2ZCgNO814pGvWwQv9aBrP/++hEg4ng=";
+    hash = "sha256-0cSeH0T/+v2aVeGpsQFZCFnYgdY56ikiUW9dnFEtNU4=";
   };
 
   # sandboxing issues on aarch64-darwin, see https://github.com/NixOS/nixpkgs/issues/198495
diff --git a/pkgs/development/python-modules/atom/default.nix b/pkgs/development/python-modules/atom/default.nix
index 4232716d4829..b6be40bc6c93 100644
--- a/pkgs/development/python-modules/atom/default.nix
+++ b/pkgs/development/python-modules/atom/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-NXjvRVYcWU9p7b8y2ICOzYe6TeMh1S70Edy/JvTG7a4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/audible/default.nix b/pkgs/development/python-modules/audible/default.nix
index 69da14683a09..bd82dabbc83f 100644
--- a/pkgs/development/python-modules/audible/default.nix
+++ b/pkgs/development/python-modules/audible/default.nix
@@ -1,27 +1,52 @@
-{ lib, fetchFromGitHub, buildPythonPackage, beautifulsoup4, httpx, pbkdf2, pillow, pyaes, rsa }:
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+
+  # build-system
+, poetry-core
+
+  # dependencies
+, beautifulsoup4
+, httpx
+, pbkdf2
+, pillow
+, pyaes
+, rsa
+
+  # test dependencies
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "audible";
-  version = "0.8.2";
-  format = "setuptools";
+  version = "0.9.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkb79";
     repo = "Audible";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SIEDBuMCC/Hap2mGVbKEFic96ClN369SEsV06Sg+poY=";
+    hash = "sha256-qLU8FjJBPKFgjpumPqRiiMBwZi+zW46iEmWM8UerMgs=";
   };
 
-  propagatedBuildInputs = [ beautifulsoup4 httpx pbkdf2 pillow pyaes rsa ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
-  postPatch = ''
-    sed -i "s/httpx.*/httpx',/" setup.py
-  '';
+  propagatedBuildInputs = [
+    pillow
+    beautifulsoup4
+    httpx
+    pbkdf2
+    pyaes
+    rsa
+  ];
 
-  # has no tests
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  pythonImportsCheck = [ "audible"];
+  pythonImportsCheck = [ "audible" ];
 
   meta = with lib; {
     description = "A(Sync) Interface for internal Audible API written in pure Python";
diff --git a/pkgs/development/python-modules/audioread/default.nix b/pkgs/development/python-modules/audioread/default.nix
index f3e74462f42e..851839f0a797 100644
--- a/pkgs/development/python-modules/audioread/default.nix
+++ b/pkgs/development/python-modules/audioread/default.nix
@@ -1,18 +1,23 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, flit-core
 }:
 
 buildPythonPackage rec {
   pname = "audioread";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.0.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EhmVvSB+sf2j1Wa+uFHTU0J1klvDWk+22gyxHeD3JRo=";
+    hash = "sha256-rFRgpUmMSL3y6OdnQCWDpNzRP0QU0ob0LOQ3nos1Bm0=";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   # No tests, need to disable or py3k breaks
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/auth0-python/default.nix b/pkgs/development/python-modules/auth0-python/default.nix
index 03f2cb571b15..7f0540b6d096 100644
--- a/pkgs/development/python-modules/auth0-python/default.nix
+++ b/pkgs/development/python-modules/auth0-python/default.nix
@@ -3,14 +3,17 @@
 , aioresponses
 , buildPythonPackage
 , callee
+, cryptography
 , fetchFromGitHub
 , mock
 , poetry-core
 , poetry-dynamic-versioning
 , pyjwt
+, pyopenssl
 , pytestCheckHook
 , pythonOlder
 , requests
+, urllib3
 }:
 
 buildPythonPackage rec {
@@ -33,8 +36,12 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    requests
+    aiohttp
+    cryptography
     pyjwt
+    pyopenssl
+    requests
+    urllib3
   ] ++ pyjwt.optional-dependencies.crypto;
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/autocommand/default.nix b/pkgs/development/python-modules/autocommand/default.nix
index eeee08ec4927..11ee55d6417d 100644
--- a/pkgs/development/python-modules/autocommand/default.nix
+++ b/pkgs/development/python-modules/autocommand/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 , pythonOlder
 }:
@@ -8,7 +9,7 @@
 buildPythonPackage rec {
   pname = "autocommand";
   version = "2.2.2";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -19,6 +20,15 @@ buildPythonPackage rec {
     hash = "sha256-9bv9Agj4RpeyNJvTLUaMwygQld2iZZkoLb81rkXOd3E=";
   };
 
+  postPatch = ''
+    #  _MissingDynamic: `license` defined outside of `pyproject.toml` is ignored.
+    rm setup.py
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # fails with: SyntaxError: invalid syntax
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/autopage/default.nix b/pkgs/development/python-modules/autopage/default.nix
index 0973220438ae..c8fbd6b9473d 100644
--- a/pkgs/development/python-modules/autopage/default.nix
+++ b/pkgs/development/python-modules/autopage/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "autopage";
-  version = "0.5.1";
+  version = "0.5.2";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ab4+5hu3FOkJD8xcEPTPVGw5YzHGIMauUKIyGyjtMZk=";
+    hash = "sha256-gmmW10xaqfS2kWGVVHMSrGOEusOBC4UXBj8pMkgle3I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/avidtools/default.nix b/pkgs/development/python-modules/avidtools/default.nix
index acb2ea9c9998..c0edd6033de7 100644
--- a/pkgs/development/python-modules/avidtools/default.nix
+++ b/pkgs/development/python-modules/avidtools/default.nix
@@ -6,7 +6,6 @@
 , pydantic
 , pythonOlder
 , setuptools
-, typing
 , typing-extensions
 }:
 
@@ -22,6 +21,10 @@ buildPythonPackage rec {
     hash = "sha256-t+ohPjOBwY8i+g7VC30ehEu6SFIsn1SwGR/ICkV9blg=";
   };
 
+  postPatch = ''
+    sed -i "/'typing'/d" setup.py
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
@@ -30,7 +33,6 @@ buildPythonPackage rec {
     datetime
     nvdlib
     pydantic
-    typing
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/avro/default.nix b/pkgs/development/python-modules/avro/default.nix
index e59a7d475079..4158600e182f 100644
--- a/pkgs/development/python-modules/avro/default.nix
+++ b/pkgs/development/python-modules/avro/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "avro";
-  version = "1.11.2";
+  version = "1.11.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-U9zVv/zLmnITbwjQsYdxeV6vTu+wKLuq7V9OF4fw4mg=";
+    hash = "sha256-M5O7UTn5zweR0gV1bOHjmltYWGr1sVPWo7WhmWEOnRc=";
   };
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
diff --git a/pkgs/development/python-modules/aw-core/default.nix b/pkgs/development/python-modules/aw-core/default.nix
index 9707e7978601..61ea5bbfaf09 100644
--- a/pkgs/development/python-modules/aw-core/default.nix
+++ b/pkgs/development/python-modules/aw-core/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 , poetry-core
 , jsonschema
 , peewee
@@ -34,6 +35,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
@@ -48,6 +50,11 @@ buildPythonPackage rec {
     timeslot
   ];
 
+  pythonRelaxDeps = [
+    "platformdirs"
+    "iso8601"
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/awesomeversion/default.nix b/pkgs/development/python-modules/awesomeversion/default.nix
index 790a9c4bbb1d..164b89ae4cc6 100644
--- a/pkgs/development/python-modules/awesomeversion/default.nix
+++ b/pkgs/development/python-modules/awesomeversion/default.nix
@@ -1,14 +1,19 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+
+# build-system
 , poetry-core
+
+# tests
+, pytest-snapshot
 , pytestCheckHook
-, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "awesomeversion";
-  version = "23.8.0";
+  version = "23.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,27 +22,28 @@ buildPythonPackage rec {
     owner = "ludeeus";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-7JJNO25UfzLs1jEO7XpqFFuEqpY4UecUk25hpONRjrI=";
+    hash = "sha256-glnM32ha5eXVpoaDkEsbwdH1oiG9qMxFwbtqLx+Kl98=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
   postPatch = ''
     # Upstream doesn't set a version
     substituteInPlace pyproject.toml \
       --replace 'version = "0"' 'version = "${version}"'
   '';
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   pythonImportsCheck = [
     "awesomeversion"
   ];
 
+  nativeCheckInputs = [
+    pytest-snapshot
+    pytestCheckHook
+  ];
+
   meta = with lib; {
     description = "Python module to deal with versions";
     homepage = "https://github.com/ludeeus/awesomeversion";
diff --git a/pkgs/development/python-modules/aws-adfs/default.nix b/pkgs/development/python-modules/aws-adfs/default.nix
index 2fe56084de74..d583a97a41a0 100644
--- a/pkgs/development/python-modules/aws-adfs/default.nix
+++ b/pkgs/development/python-modules/aws-adfs/default.nix
@@ -11,6 +11,7 @@
 , pyopenssl
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , requests
 , requests-kerberos
 , toml
@@ -32,6 +33,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "configparser"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 72930b85bb6d..12e0a8803552 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -77,6 +77,8 @@ buildPythonPackage rec {
     "test_unexpected_sar_error_stops_processing"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Python library to transform SAM templates into AWS CloudFormation templates";
     homepage = "https://github.com/aws/serverless-application-model";
diff --git a/pkgs/development/python-modules/aws-xray-sdk/default.nix b/pkgs/development/python-modules/aws-xray-sdk/default.nix
index de02fdf8a88e..53e69baa9182 100644
--- a/pkgs/development/python-modules/aws-xray-sdk/default.nix
+++ b/pkgs/development/python-modules/aws-xray-sdk/default.nix
@@ -14,6 +14,7 @@
 , pytestCheckHook
 , pythonOlder
 , requests
+, setuptools
 , sqlalchemy
 , webtest
 , wrapt
@@ -22,7 +23,7 @@
 buildPythonPackage rec {
   pname = "aws-xray-sdk";
   version = "2.12.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -33,6 +34,10 @@ buildPythonPackage rec {
     hash = "sha256-NLFNst4Yqsz2u5IXwe8OdJPW77irLRO5tWWn1uV3tMg=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     botocore
     jsonpickle
diff --git a/pkgs/development/python-modules/awslambdaric/default.nix b/pkgs/development/python-modules/awslambdaric/default.nix
index f63ed81b76fa..3e20875ac15d 100644
--- a/pkgs/development/python-modules/awslambdaric/default.nix
+++ b/pkgs/development/python-modules/awslambdaric/default.nix
@@ -11,20 +11,22 @@
 , gcc
 , libtool
 , perl
+, setuptools
 , simplejson
 }:
 
 buildPythonPackage rec {
   pname = "awslambdaric";
-  version = "2.0.7";
-  format = "setuptools";
+  version = "2.0.8";
+  pyproject = true;
+
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lambda-python-runtime-interface-client";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-9PgdLzeSafglguXksMetzopbDlBWlGDSSXiZHfuWgE8=";
+    sha256 = "sha256-0ej+Gy9nF96SaGhohHF9EJObSpHdxIe9QXHNHejVwbQ=";
   };
 
   patches = [
@@ -42,7 +44,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ simplejson ];
 
-  nativeBuildInputs = [ autoconf automake cmake libtool perl ];
+  nativeBuildInputs = [ autoconf automake cmake libtool perl setuptools ];
 
   buildInputs = [ gcc ];
 
diff --git a/pkgs/development/python-modules/ax/default.nix b/pkgs/development/python-modules/ax/default.nix
index 2e06b3a0f8b3..a0315a561fba 100644
--- a/pkgs/development/python-modules/ax/default.nix
+++ b/pkgs/development/python-modules/ax/default.nix
@@ -46,8 +46,6 @@ buildPythonPackage rec {
     pyre-extensions
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   checkInputs = [
     hypothesis
     mercurial
diff --git a/pkgs/development/python-modules/azure-storage-blob/default.nix b/pkgs/development/python-modules/azure-storage-blob/default.nix
index e0846bc60514..dfca02bc5b3f 100644
--- a/pkgs/development/python-modules/azure-storage-blob/default.nix
+++ b/pkgs/development/python-modules/azure-storage-blob/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "azure-storage-blob";
-  version = "12.18.2";
+  version = "12.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4Rk1NImB/8AFuEi1XbJcBPLR+Q4e4zAAZZkGt2PPFMg=";
+    hash = "sha256-JsCkMgo0o8Kht0UoumgS68tjKgTNZ7HHN3IyxLAaWJc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/b2sdk/default.nix b/pkgs/development/python-modules/b2sdk/default.nix
index 0664362dd167..2e13666af140 100644
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@@ -11,6 +11,7 @@
 , pytest-mock
 , pythonOlder
 , requests
+, setuptools
 , setuptools-scm
 , tqdm
 , typing-extensions
@@ -19,7 +20,7 @@
 buildPythonPackage rec {
   pname = "b2sdk";
   version = "1.29.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -29,12 +30,14 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
   propagatedBuildInputs = [
     logfury
     requests
+    tqdm
   ] ++ lib.optionals (pythonOlder "3.8") [
     importlib-metadata
   ] ++ lib.optionals (pythonOlder "3.12") [
diff --git a/pkgs/development/python-modules/babel/default.nix b/pkgs/development/python-modules/babel/default.nix
index a97224b5c860..97dfc7a1daf2 100644
--- a/pkgs/development/python-modules/babel/default.nix
+++ b/pkgs/development/python-modules/babel/default.nix
@@ -4,27 +4,34 @@
 , isPyPy
 , pythonAtLeast
 , pythonOlder
-, tzdata
+
+# build-system
+, setuptools
 
 # tests
 , freezegun
 , pytestCheckHook
 , pytz
+, tzdata
 }:
 
 buildPythonPackage rec {
   pname = "babel";
-  version = "2.12.1";
-  format = "setuptools";
+  version = "2.14.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Babel";
     inherit version;
-    hash = "sha256-zC2ZmZzQHURCCuclohyeNxGzqtx5dtYUf2IthYGWNFU=";
+    hash = "sha256-aRmGfbA2OYuiHrXHoPayirjLw656c6ROvjSudKTn02M=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [
     pytz
   ];
diff --git a/pkgs/development/python-modules/backports-cached-property/default.nix b/pkgs/development/python-modules/backports-cached-property/default.nix
index 27ad57237063..dcce9b5fc6f0 100644
--- a/pkgs/development/python-modules/backports-cached-property/default.nix
+++ b/pkgs/development/python-modules/backports-cached-property/default.nix
@@ -17,8 +17,6 @@ buildPythonPackage rec {
     hash = "sha256-rdgKbVQaELilPrN4ve8RbbaLiT14Xex0esy5vUX2ZBc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix b/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix
index 88e140ad82f5..febf3d50bb4f 100644
--- a/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix
+++ b/pkgs/development/python-modules/backports-datetime-fromisoformat/default.nix
@@ -1,25 +1,39 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# tests
 , pytz
-, unittestCheckHook
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "backports-datetime-fromisoformat";
-  version = "2.0.0";
-  format = "setuptools";
+  version = "2.0.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "movermeyer";
     repo = "backports.datetime_fromisoformat";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aHF3E/fLN+j/T4W9lvuVSMy6iRSEn+ARWmL01rY+ixs=";
+    hash = "sha256-c3LCTOKva99+x96iLHNnL1e1Ft1M1CsjQX+nEqAlXUs=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytz
-    unittestCheckHook
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+      # ModuleNotFoundError: No module named 'developmental_release'
+    "release/test_developmental_release.py"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/bacpypes/default.nix b/pkgs/development/python-modules/bacpypes/default.nix
index 9804dd20f576..9a30c1bbd6a9 100644
--- a/pkgs/development/python-modules/bacpypes/default.nix
+++ b/pkgs/development/python-modules/bacpypes/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , wheel
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 }:
 
@@ -11,7 +12,8 @@ buildPythonPackage rec {
   version = "0.18.6";
   format = "setuptools";
 
-  disabled = pythonOlder "3.9";
+  # uses the removed asyncore module
+  disabled = pythonOlder "3.9" || pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "JoelBender";
diff --git a/pkgs/development/python-modules/bagit/default.nix b/pkgs/development/python-modules/bagit/default.nix
index 7f671bb8a470..0a07c39482db 100644
--- a/pkgs/development/python-modules/bagit/default.nix
+++ b/pkgs/development/python-modules/bagit/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ gettext setuptools-scm ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     mock
     pytestCheckHook
diff --git a/pkgs/development/python-modules/barectf/default.nix b/pkgs/development/python-modules/barectf/default.nix
index 429e03fbe940..d2083c08fa60 100644
--- a/pkgs/development/python-modules/barectf/default.nix
+++ b/pkgs/development/python-modules/barectf/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , poetry-core
 , pytestCheckHook
+, pythonRelaxDepsHook
 , setuptools
 , jsonschema
 , pyyaml
@@ -22,8 +23,16 @@ buildPythonPackage rec {
     hash = "sha256-JelFfd3WS012dveNlIljhLdyPmgE9VEOXoZE3MBA/Gw=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "jsonschema"
+    "pyyaml"
+    "termcolor"
+  ];
 
   propagatedBuildInputs = [
     setuptools # needs pkg_resources at runtime
@@ -33,7 +42,13 @@ buildPythonPackage rec {
     termcolor
   ];
 
-  pythonImportsCheck = [ "barectf" ];
+  pythonImportsCheck = [
+    "barectf"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "Generator of ANSI C tracers which output CTF data streams ";
diff --git a/pkgs/development/python-modules/bbox/default.nix b/pkgs/development/python-modules/bbox/default.nix
index df28d568b010..93eb8d272887 100644
--- a/pkgs/development/python-modules/bbox/default.nix
+++ b/pkgs/development/python-modules/bbox/default.nix
@@ -26,8 +26,14 @@ buildPythonPackage rec {
     hash = "sha256-FrJ8FhlqwmnEB/QvPlkDfqZncNGPhwY9aagM9yv1LGs=";
   };
 
-  propagatedBuildInputs = [ pyquaternion numpy ];
-  buildInputs = [ poetry-core ];
+  nativebuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    pyquaternion
+    numpy
+  ];
 
   nativeCheckInputs = [
     matplotlib
@@ -36,7 +42,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "bbox" ];
+  disabledTests = [
+    # performance test, racy on busy machines
+    "test_multi_jaccard_index_2d_performance"
+  ];
+
+  pythonImportsCheck = [
+    "bbox"
+  ];
 
   meta = with lib; {
     description = "Python library for 2D/3D bounding boxes";
diff --git a/pkgs/development/python-modules/bcrypt/default.nix b/pkgs/development/python-modules/bcrypt/default.nix
index f0e23e713c3a..fa440cc7fd2d 100644
--- a/pkgs/development/python-modules/bcrypt/default.nix
+++ b/pkgs/development/python-modules/bcrypt/default.nix
@@ -5,10 +5,8 @@
 , rustc
 , setuptools
 , setuptools-rust
-, isPyPy
 , fetchPypi
 , pythonOlder
-, cffi
 , pytestCheckHook
 , libiconv
 , stdenv
@@ -51,14 +49,6 @@ buildPythonPackage rec {
   # Remove when https://github.com/NixOS/nixpkgs/pull/190093 lands.
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
-  propagatedBuildInputs = [
-    cffi
-  ];
-
-  propagatedNativeBuildInputs = [
-    cffi
-  ];
-
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/beautifulsoup4/default.nix b/pkgs/development/python-modules/beautifulsoup4/default.nix
index e803bcf154e1..9e9d15bec0cb 100644
--- a/pkgs/development/python-modules/beautifulsoup4/default.nix
+++ b/pkgs/development/python-modules/beautifulsoup4/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , chardet
 , hatchling
 , html5lib
@@ -33,6 +34,18 @@ buildPythonPackage rec {
     hash = "sha256-SSu8adyjXRLarHHE2xv/8Mh2wA70ov+sziJtRjjrcto=";
   };
 
+  patches = [
+    # Fix test with libxml 2.12.
+    # https://bugs.launchpad.net/beautifulsoup/+bug/2045481
+    (fetchpatch {
+      url = "https://bugs.launchpad.net/beautifulsoup/+bug/2045481/+attachment/5726132/+files/2045481.diff";
+      hash = "sha256-f/Wkh7El4r1iWM2/CSi5AKE1+NsEP3D5pxWgBcZ//Vs=";
+      excludes = [
+        "CHANGELOG"
+      ];
+    })
+  ];
+
   nativeBuildInputs = [
     hatchling
     sphinxHook
diff --git a/pkgs/development/python-modules/bentoml/default.nix b/pkgs/development/python-modules/bentoml/default.nix
index c5201d3b11b7..8441d25e71c6 100644
--- a/pkgs/development/python-modules/bentoml/default.nix
+++ b/pkgs/development/python-modules/bentoml/default.nix
@@ -204,5 +204,7 @@ buildPythonPackage {
     changelog = "https://github.com/bentoml/BentoML/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ happysalada natsukium ];
+    # https://github.com/bentoml/BentoML/issues/3885
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/bids-validator/default.nix b/pkgs/development/python-modules/bids-validator/default.nix
index 115c80553cc5..c70268dea0b5 100644
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@@ -2,20 +2,29 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+
+# build-system
+, setuptools
+, versioneer
 }:
 
 buildPythonPackage rec {
   pname = "bids-validator";
-  version = "1.13.1";
-  format = "setuptools";
+  version = "1.14.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cgXOTmj7oXIhUzLHhvGsFmUCW3Arbf8rHhWPAKLfmJA=";
+    hash = "sha256-M7D4ZcGqPjn7klGN8WP6a3lHjRqhAq9S/VNwSl7y6kY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    versioneer
+  ];
+
   # needs packages which are not available in nixpkgs
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/billiard/default.nix b/pkgs/development/python-modules/billiard/default.nix
index 6c641a16f9be..15ccd234a7ac 100644
--- a/pkgs/development/python-modules/billiard/default.nix
+++ b/pkgs/development/python-modules/billiard/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "billiard";
-  version = "4.1.0";
+  version = "4.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GtLuro4oBT1ym6M3PTTZ1uIQ9uTYvwqcZPkr0FPx7fU=";
+    hash = "sha256-mjwxhMsnWqF6cy+T9lsgxSXT2fJTci0mqCGUgDreWiw=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/bimmer-connected/default.nix b/pkgs/development/python-modules/bimmer-connected/default.nix
index ade9544f32d0..5fe28afbb574 100644
--- a/pkgs/development/python-modules/bimmer-connected/default.nix
+++ b/pkgs/development/python-modules/bimmer-connected/default.nix
@@ -60,6 +60,11 @@ buildPythonPackage rec {
     time-machine
   ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
+  disabledTests = [
+    # presumably regressed in pytest-asyncio 0.23.0
+    "test_get_remote_position_too_old"
+  ];
+
   preCheck = ''
     export TZDIR=${tzdata}/${python.sitePackages}/tzdata/zoneinfo
   '';
diff --git a/pkgs/development/python-modules/bitstring/default.nix b/pkgs/development/python-modules/bitstring/default.nix
index 537905778ba3..52fdaece66ff 100644
--- a/pkgs/development/python-modules/bitstring/default.nix
+++ b/pkgs/development/python-modules/bitstring/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "bitstring";
-  version = "4.1.3";
+  version = "4.1.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "scott-griffiths";
     repo = pname;
     rev = "refs/tags/bitstring-${version}";
-    hash = "sha256-RbHy36AnDlu/Ym5Ty2O9XfPj5xXd9hTgoClvISPoGBc=";
+    hash = "sha256-CO7R2SCb232OW1DCLo45UIarFG5FhR4WkwuQieXha0Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/blackjax/default.nix b/pkgs/development/python-modules/blackjax/default.nix
index f9521db79cb8..cae11bd30c8d 100644
--- a/pkgs/development/python-modules/blackjax/default.nix
+++ b/pkgs/development/python-modules/blackjax/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools-scm ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     fastprogress
     jax
diff --git a/pkgs/development/python-modules/bleach/default.nix b/pkgs/development/python-modules/bleach/default.nix
index 901eb76417ff..c1fb4d77e806 100644
--- a/pkgs/development/python-modules/bleach/default.nix
+++ b/pkgs/development/python-modules/bleach/default.nix
@@ -13,15 +13,20 @@
 
 buildPythonPackage rec {
   pname = "bleach";
-  version = "6.0.0";
-  format = "setuptools";
-  disabled = pythonOlder "3.7";
+  version = "6.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GhqFwVleB9jbFMXwnwnmQzUCxRxZWXDtwJBVHw25lBQ=";
+    hash = "sha256-CjHxg3ljxB1Gu/EzG4d44TCOoHkdsDzE5zV7l89CqP4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     html5lib
     packaging
@@ -64,6 +69,7 @@ buildPythonPackage rec {
     '';
     homepage = "https://github.com/mozilla/bleach";
     downloadPage = "https://github.com/mozilla/bleach/releases";
+    changelog = "https://github.com/mozilla/bleach/blob/v${version}/CHANGES";
     license = licenses.asl20;
     maintainers = with maintainers; [ prikhi ];
   };
diff --git a/pkgs/development/python-modules/blinker/default.nix b/pkgs/development/python-modules/blinker/default.nix
index 9864bbae3c61..2e5707d15389 100644
--- a/pkgs/development/python-modules/blinker/default.nix
+++ b/pkgs/development/python-modules/blinker/default.nix
@@ -1,23 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+
+# build-system
+, flit-core
+
+# tests
 , pytestCheckHook
 , pytest-asyncio
-, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "blinker";
-  version = "1.6.2";
+  version = "1.7.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Sv095m7zqfgGdVn7ehy+VVwX3L4VlxsF0bYlw+er4hM=";
+    hash = "sha256-5oIP9vpOTR2OJ0fCKDdJw/VH5P7hErmFVc3NrjKZYYI=";
   };
 
   nativeBuildInputs = [
-    setuptools
+    flit-core
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/blinkpy/default.nix b/pkgs/development/python-modules/blinkpy/default.nix
index eaca06056f36..37b01b386055 100644
--- a/pkgs/development/python-modules/blinkpy/default.nix
+++ b/pkgs/development/python-modules/blinkpy/default.nix
@@ -28,7 +28,8 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace ', "wheel~=0.40.0"' ""
+      --replace ', "wheel~=0.40.0"' "" \
+      --replace "setuptools~=68.0" "setuptools"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/blosc2/default.nix b/pkgs/development/python-modules/blosc2/default.nix
index a4c1db3d7b70..1bc55fbdcf0a 100644
--- a/pkgs/development/python-modules/blosc2/default.nix
+++ b/pkgs/development/python-modules/blosc2/default.nix
@@ -4,7 +4,7 @@
 
 # build-system
 , cmake
-, cython
+, cython_3
 , ninja
 , oldest-supported-numpy
 , scikit-build
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "blosc2";
-  version = "2.2.7";
+  version = "2.3.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     repo = "python-blosc2";
     rev = "refs/tags/v${version}";
     fetchSubmodules = true;
-    hash = "sha256-5a94Zm6sYl/nSfkcFbKG7PkyXwLB6bAoIvfaq0yVGHo=";
+    hash = "sha256-tRcyntJlmLPbqnX7nzdBQ/50uXy0fVLb2YGVOIwJjxU=";
   };
 
   postPatch = ''
@@ -44,7 +44,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cmake
-    cython
+    cython_3
     ninja
     oldest-supported-numpy
     scikit-build
diff --git a/pkgs/development/python-modules/bokeh/default.nix b/pkgs/development/python-modules/bokeh/default.nix
index adca1fe308b0..a697a15c54b9 100644
--- a/pkgs/development/python-modules/bokeh/default.nix
+++ b/pkgs/development/python-modules/bokeh/default.nix
@@ -48,14 +48,14 @@
 buildPythonPackage rec {
   pname = "bokeh";
   # update together with panel which is not straightforward
-  version = "3.2.2";
+  version = "3.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-spWbhSTWnsTniGvDZAdEXwqS4fGVMNO/xARSNqG3pv8=";
+    hash = "sha256-rhgPhvd2Ul9+uBZzofJ+DrVoh9czdxZixRLsDYKkM/U=";
   };
 
   src_test = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/bootstrap/packaging/default.nix b/pkgs/development/python-modules/bootstrap/packaging/default.nix
new file mode 100644
index 000000000000..f8a10d4ddd12
--- /dev/null
+++ b/pkgs/development/python-modules/bootstrap/packaging/default.nix
@@ -0,0 +1,30 @@
+{ stdenv
+, python
+, flit-core
+, installer
+, packaging
+}:
+
+stdenv.mkDerivation {
+  pname = "${python.libPrefix}-bootstrap-${packaging.pname}";
+  inherit (packaging) version src meta;
+
+  buildPhase = ''
+    runHook preBuild
+
+    PYTHONPATH="${flit-core}/${python.sitePackages}" \
+      ${python.interpreter} -m flit_core.wheel
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    PYTHONPATH="${installer}/${python.sitePackages}" \
+      ${python.interpreter} -m installer \
+        --destdir "$out" --prefix "" dist/*.whl
+
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/development/python-modules/bork/default.nix b/pkgs/development/python-modules/bork/default.nix
index 29357c0cc439..060ac57ae00e 100644
--- a/pkgs/development/python-modules/bork/default.nix
+++ b/pkgs/development/python-modules/bork/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 
 , build
 , coloredlogs
@@ -26,6 +27,16 @@ buildPythonPackage rec {
     hash = "sha256-sHCPT6nTenE6mbTifNPtg0OMNIJCs7LRcF8Xuk+MwLs=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "packaging"
+    "twine"
+    "wheel"
+  ];
+
   propagatedBuildInputs = [
     build
     coloredlogs
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index 779871db10ed..717bb264283f 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "boto3";
-  version = "1.28.57"; # N.B: if you change this, change botocore and awscli to a matching version
+  version = "1.33.6"; # N.B: if you change this, change botocore and awscli to a matching version
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "boto";
     repo = pname;
     rev = version;
-    hash = "sha256-+kuILCUK10tvpfTEAHZGvKKmpw6Pgn+v2kQkwCkPMKg=";
+    hash = "sha256-oOrUVBh1sbaOibU8A+bGZ4z7IEiE4gjHwZ+8889Hv60=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +43,10 @@ buildPythonPackage rec {
     "tests/integration"
   ];
 
+  passthru.optional-dependencies = {
+    crt = [ botocore.optional-dependencies.crt ];
+  };
+
   meta = with lib; {
     homepage = "https://github.com/boto/boto3";
     changelog = "https://github.com/boto/boto3/blob/${version}/CHANGELOG.rst";
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index ddb9d35d05fd..ea7ea23fc40d 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -6,16 +6,17 @@
 , urllib3
 , pytestCheckHook
 , jsonschema
+, awscrt
 }:
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.31.57"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.33.6"; # N.B: if you change this, change boto3 and awscli to a matching version
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MBQ2F0Y1vsc5siW4QPw2XKAOXBpj5bKhnuZ50gTgG3g=";
+    hash = "sha256-k4BWurgxgp+Q4J7NcN1rKVr9UrFIL1WC7noR2CQ9lmE=";
   };
 
   propagatedBuildInputs = [
@@ -41,6 +42,10 @@ buildPythonPackage rec {
     "botocore"
   ];
 
+  passthru.optional-dependencies = {
+    crt = [ awscrt ];
+  };
+
   meta = with lib; {
     homepage = "https://github.com/boto/botocore";
     changelog = "https://github.com/boto/botocore/blob/${version}/CHANGELOG.rst";
diff --git a/pkgs/development/python-modules/botorch/default.nix b/pkgs/development/python-modules/botorch/default.nix
index 7d2170d3355e..c62fef2478ae 100644
--- a/pkgs/development/python-modules/botorch/default.nix
+++ b/pkgs/development/python-modules/botorch/default.nix
@@ -40,8 +40,6 @@ buildPythonPackage rec {
     torch
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   checkInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/bottle/default.nix b/pkgs/development/python-modules/bottle/default.nix
index e64883140316..9e8d84950e5e 100644
--- a/pkgs/development/python-modules/bottle/default.nix
+++ b/pkgs/development/python-modules/bottle/default.nix
@@ -1,20 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pytestCheckHook
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
   pname = "bottle";
   version = "0.12.25";
-
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-4anJSXCubXELP7RSYpTf64byy0qB7/OkuY3ED7Dl4CE=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -29,6 +34,12 @@ buildPythonPackage rec {
     "test_error_in_generator_callback"
     # timing sensitive
     "test_ims"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/bottlepy/bottle/issues/1422
+    # ModuleNotFoundError: No module named 'bottle.ext'
+    "test_data_import"
+    "test_direkt_import"
+    "test_from_import"
   ];
 
   __darwinAllowLocalNetworking = true;
@@ -36,6 +47,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://bottlepy.org/";
     description = "A fast and simple micro-framework for small web-applications";
+    downloadPage = "https://github.com/bottlepy/bottle";
     license = licenses.mit;
     maintainers = with maintainers; [ koral ];
   };
diff --git a/pkgs/development/python-modules/branca/default.nix b/pkgs/development/python-modules/branca/default.nix
index 119e166e3845..3bd46a26b83b 100644
--- a/pkgs/development/python-modules/branca/default.nix
+++ b/pkgs/development/python-modules/branca/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-DH+XBj+VcS56+nAOGjjrKG0dnSKrqiU6N5vkILm+vSE=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     # We don't want flake8
     rm setup.cfg
diff --git a/pkgs/development/python-modules/broadbean/default.nix b/pkgs/development/python-modules/broadbean/default.nix
index cb2dff1b06e9..edf4ca1080ce 100644
--- a/pkgs/development/python-modules/broadbean/default.nix
+++ b/pkgs/development/python-modules/broadbean/default.nix
@@ -57,6 +57,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # on a 200ms deadline
+    "test_points"
+  ];
+
   pythonImportsCheck = [ "broadbean" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index 4b06298f1d26..42c7786d78ae 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -31,6 +31,11 @@ buildPythonPackage rec {
     hash = "sha256-SGWpm+AGIfqKMpDfmz2aMYmcs+XVREbHIXSuU4R7U/k=";
   };
 
+  postPatch = ''
+    # not strictly required, causes circular dependency cycle
+    sed -i '/importlib-metadata >= 4.6/d' pyproject.toml
+  '';
+
   nativeBuildInputs = [
     flit-core
   ];
diff --git a/pkgs/development/python-modules/buildcatrust/default.nix b/pkgs/development/python-modules/buildcatrust/default.nix
index b875185ed2ff..cb997ab80134 100644
--- a/pkgs/development/python-modules/buildcatrust/default.nix
+++ b/pkgs/development/python-modules/buildcatrust/default.nix
@@ -1,27 +1,37 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, flit-core
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "buildcatrust";
   version = "0.1.3";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256:0s0m0fy943dakw9cbd40h46qmrhhgrcp292kppyb34m6y27sbagy";
+    hash = "sha256:0s0m0fy943dakw9cbd40h46qmrhhgrcp292kppyb34m6y27sbagy";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
+
   disabledTestPaths = [
     # Non-hermetic, needs internet access (e.g. attempts to retrieve NSS store).
     "buildcatrust/tests/test_nonhermetic.py"
   ];
 
-  pythonImportsCheck = [ "buildcatrust" "buildcatrust.cli" ];
+  pythonImportsCheck = [
+    "buildcatrust"
+    "buildcatrust.cli"
+  ];
 
   meta = with lib; {
     description = "Build SSL/TLS trust stores";
diff --git a/pkgs/development/python-modules/bwapy/default.nix b/pkgs/development/python-modules/bwapy/default.nix
index d52c2a9e2a92..600fd1467b9c 100644
--- a/pkgs/development/python-modules/bwapy/default.nix
+++ b/pkgs/development/python-modules/bwapy/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, pythonAtLeast
 , pythonOlder
 , fetchPypi
 , bwa
@@ -11,7 +12,9 @@ buildPythonPackage rec {
   pname = "bwapy";
   version = "0.1.4";
   format = "setuptools";
-  disabled = pythonOlder "3.6";
+
+  # uses the removed imp module
+  disabled = pythonOlder "3.6" || pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;
@@ -35,7 +38,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "bwapy" ];
 
   meta = with lib; {
-    homepage = "https://github.com/ACEnglish/acebinf";
+    homepage = "https://github.com/ACEnglish/bwapy";
     description = "Python bindings to bwa mem aligner";
     license = licenses.mpl20;
     maintainers = with maintainers; [ ris ];
diff --git a/pkgs/development/python-modules/bytecode/default.nix b/pkgs/development/python-modules/bytecode/default.nix
index 4df83b9e45df..868279f4422c 100644
--- a/pkgs/development/python-modules/bytecode/default.nix
+++ b/pkgs/development/python-modules/bytecode/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-Jzsh0m00SiJjTP7hXMDmuR4XHmsCYdURuFDkVopGyIE=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/bytewax/Cargo.lock b/pkgs/development/python-modules/bytewax/Cargo.lock
index 2837d3c6ca95..618736f138a5 100644
--- a/pkgs/development/python-modules/bytewax/Cargo.lock
+++ b/pkgs/development/python-modules/bytewax/Cargo.lock
@@ -20,17 +20,21 @@ dependencies = [
 ]
 
 [[package]]
-name = "ahash"
-version = "0.7.6"
+name = "addr2line"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+checksum = "f4fa78e18c64fce05e902adecd7a5eed15a5e0a3439f7b0e169f0252214865e3"
 dependencies = [
- "getrandom",
- "once_cell",
- "version_check",
+ "gimli",
 ]
 
 [[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
 name = "ahash"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -42,6 +46,21 @@ dependencies = [
 ]
 
 [[package]]
+name = "aho-corasick"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43f6cb1bf222025340178f382c426f13757b2960e89779dfcb319c32542a5a41"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56fc6cf8dc8c4158eed8649f9b8b0ea1518eb62b544fe9490d66fa0b349eafe9"
+
+[[package]]
 name = "android-tzdata"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -63,45 +82,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c7d0618f0e0b7e8ff11427422b64564d5fb0be1940354bfe2e0529b18a9d9b8"
 
 [[package]]
-name = "async-stream"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd56dd203fef61ac097dd65721a419ddccb106b2d2b70ba60a6b529f03961a51"
-dependencies = [
- "async-stream-impl",
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-stream-impl"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.18",
-]
-
-[[package]]
 name = "async-trait"
-version = "0.1.68"
+version = "0.1.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9ccdd8f2a161be9bd5c023df56f1b2a0bd1d83872ae53b71a84a12c9bf6e842"
+checksum = "a564d521dd56509c4c47480d00b80ee55f7e385ae48db5744c67ad50c92d2ebf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
-]
-
-[[package]]
-name = "atoi"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c57d12312ff59c811c0643f4d80830505833c9ffaebd193d819392b265be8e"
-dependencies = [
- "num-traits",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -118,7 +106,7 @@ checksum = "acee9fd5073ab6b045a275b3e709c163dd36c90685219cb21804a147b58dba43"
 dependencies = [
  "async-trait",
  "axum-core 0.2.9",
- "bitflags",
+ "bitflags 1.3.2",
  "bytes",
  "futures-util",
  "http",
@@ -149,7 +137,7 @@ checksum = "f8175979259124331c1d7bf6586ee7e0da434155e4b2d48ec2c8386281d8df39"
 dependencies = [
  "async-trait",
  "axum-core 0.3.4",
- "bitflags",
+ "bitflags 1.3.2",
  "bytes",
  "futures-util",
  "http",
@@ -203,10 +191,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "base64"
-version = "0.13.1"
+name = "backtrace"
+version = "0.3.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+checksum = "4319208da049c43661739c5fade2ba182f09d1dc2299b32298d3a31692b17e12"
+dependencies = [
+ "addr2line",
+ "cc",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+]
 
 [[package]]
 name = "base64"
@@ -230,13 +227,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
-name = "block-buffer"
-version = "0.10.4"
+name = "bitflags"
+version = "2.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
+checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42"
 
 [[package]]
 name = "bumpalo"
@@ -258,23 +252,23 @@ checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
 
 [[package]]
 name = "bytewax"
-version = "0.16.2"
+version = "0.17.2"
 dependencies = [
  "axum 0.5.17",
  "bincode",
  "chrono",
- "futures",
+ "fastrand",
  "num",
- "openssl-src",
  "opentelemetry",
  "opentelemetry-jaeger",
  "opentelemetry-otlp",
  "pyo3",
- "rdkafka",
- "sasl2-sys",
+ "rusqlite",
+ "rusqlite_migration",
+ "seahash",
  "serde",
+ "serde_json",
  "serde_test",
- "sqlx",
  "timely",
  "tokio",
  "tracing",
@@ -308,15 +302,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "cmake"
-version = "0.1.50"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31c789563b815f77f4250caee12365734369f942439b7defd71e18a48197130"
-dependencies = [
- "cc",
-]
-
-[[package]]
 name = "columnation"
 version = "0.1.0"
 source = "git+https://github.com/frankmcsherry/columnation#eb8e20c10e748dcbfe6266be8e24e14422d3de0f"
@@ -331,30 +316,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
 
 [[package]]
-name = "cpufeatures"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e4c1eaa2012c47becbbad2ab175484c2a84d1185b566fb2cc5b8707343dfe58"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crc"
-version = "3.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86ec7a15cbe22e59248fc7eadb1907dab5ba09372595da4d73dd805ed4417dfe"
-dependencies = [
- "crc-catalog",
-]
-
-[[package]]
-name = "crc-catalog"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cace84e55f07e7301bae1c519df89cdad8cc3cd868413d3fdbdeca9ff3db484"
-
-[[package]]
 name = "crossbeam-channel"
 version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -365,94 +326,12 @@ dependencies = [
 ]
 
 [[package]]
-name = "crossbeam-queue"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1cfb3ea8a53f37c40dea2c7bedcbd88bdfae54f5e2175d6ecaff1c988353add"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
 name = "crossbeam-utils"
-version = "0.8.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c063cd8cc95f5c377ed0d4b49a4b21f632396ff690e8470c29b3359b346984b"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.1.6"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "dashmap"
-version = "5.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "907076dfda823b0b36d2a1bb5f90c96660a5bbcd7729e10727f07858f22c4edc"
+checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
 dependencies = [
  "cfg-if",
- "hashbrown 0.12.3",
- "lock_api",
- "once_cell",
- "parking_lot_core 0.9.7",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer",
- "crypto-common",
- "subtle",
-]
-
-[[package]]
-name = "dirs"
-version = "4.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3aa72a6f96ea37bbc5aa912f6788242832f75369bdfdadcb0e38423f100059"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b1d1d91c932ef41c0f2663aa8b0ca0342d444d842c06914aa0a7e352d0bada6"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "dotenvy"
-version = "0.15.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
-
-[[package]]
-name = "duct"
-version = "0.13.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37ae3fc31835f74c2a7ceda3aeede378b0ae2e74c8f1c36559fcc9ae2a4e7d3e"
-dependencies = [
- "libc",
- "once_cell",
- "os_pipe",
- "shared_child",
 ]
 
 [[package]]
@@ -471,31 +350,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "errno"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
+name = "fallible-iterator"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
 
 [[package]]
-name = "event-listener"
-version = "2.5.3"
+name = "fallible-streaming-iterator"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
 [[package]]
 name = "fastrand"
@@ -507,24 +371,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "fixedbitset"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
-
-[[package]]
-name = "flume"
-version = "0.10.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1657b4441c3403d9f7b3409e47575237dac27b1b5726df654a6ecbf92f0f7577"
-dependencies = [
- "futures-core",
- "futures-sink",
- "pin-project",
- "spin 0.9.8",
-]
-
-[[package]]
 name = "fnv"
 version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -532,36 +378,20 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
+checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
 dependencies = [
  "percent-encoding",
 ]
 
 [[package]]
-name = "futures"
-version = "0.3.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23342abe12aba583913b2e62f22225ff9c950774065e4bfb61a19cd9770fec40"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-io",
- "futures-sink",
- "futures-task",
- "futures-util",
-]
-
-[[package]]
 name = "futures-channel"
 version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
 dependencies = [
  "futures-core",
- "futures-sink",
 ]
 
 [[package]]
@@ -582,17 +412,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "futures-intrusive"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a604f7a68fbf8103337523b1fadc8ade7361ee3f112f7c680ad179651616aed5"
-dependencies = [
- "futures-core",
- "lock_api",
- "parking_lot 0.11.2",
-]
-
-[[package]]
 name = "futures-io"
 version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -606,7 +425,7 @@ checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -627,7 +446,6 @@ version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533"
 dependencies = [
- "futures-channel",
  "futures-core",
  "futures-io",
  "futures-macro",
@@ -640,16 +458,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
-[[package]]
 name = "getopts"
 version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -660,9 +468,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c85e1d9ab2eadba7e5040d4e09cbd6d072b76a557ad64e797c2cb9d4da21d7e4"
+checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
 dependencies = [
  "cfg-if",
  "libc",
@@ -670,10 +478,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "gimli"
+version = "0.27.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c80984affa11d98d1b88b66ac8853f143217b399d3c74116778ff8fdb4ed2e"
+
+[[package]]
 name = "h2"
-version = "0.3.19"
+version = "0.3.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d357c7ae988e7d2182f7d7871d0b963962420b0678b0997ce7de72001aeab782"
+checksum = "97ec8491ebaf99c8eaa73058b045fe58073cd6be7f596ac993ced0b0a0c01049"
 dependencies = [
  "bytes",
  "fnv",
@@ -696,69 +510,28 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.13.2"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43a3c133739dddd0d2990f9a4bdf8eb4b21ef50e4851ca85ab661199821d510e"
+checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
 dependencies = [
- "ahash 0.8.3",
+ "ahash",
+ "allocator-api2",
 ]
 
 [[package]]
 name = "hashlink"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0761a1b9491c4f2e3d66aa0f62d0fba0af9a0e2852e4d48ea506632a4b56e6aa"
-dependencies = [
- "hashbrown 0.13.2",
-]
-
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.2.6"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+checksum = "312f66718a2d7789ffef4f4b7b213138ed9f1eb3aa1d0d82fc99f88fb3ffd26f"
 dependencies = [
- "libc",
+ "hashbrown 0.14.0",
 ]
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
-
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
-[[package]]
-name = "hkdf"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437"
-dependencies = [
- "hmac",
-]
-
-[[package]]
-name = "hmac"
-version = "0.12.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
-dependencies = [
- "digest",
-]
+checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
 
 [[package]]
 name = "http"
@@ -802,9 +575,9 @@ checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
 
 [[package]]
 name = "hyper"
-version = "0.14.26"
+version = "0.14.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab302d72a6f11a3b910431ff93aae7e773078c769f0a3ef15fb9ec692ed147d4"
+checksum = "ffb1cfd654a8219eaef89881fdb3bb3b1cdc5fa75ded05d6933b2b382e395468"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -838,9 +611,9 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.56"
+version = "0.1.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0722cd7114b7de04316e7ea5456a0bbb20e4adb46fd27a3697adb812cff0f37c"
+checksum = "2fad5b825842d2b38bd206f3e81d6957625fd7f0a361e345c30e01a0ae2dd613"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -861,9 +634,9 @@ dependencies = [
 
 [[package]]
 name = "idna"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
 dependencies = [
  "unicode-bidi",
  "unicode-normalization",
@@ -901,21 +674,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8bb03732005da905c88227371639bf1ad885cc712789c011c31c5fb3ab3ccf02"
 
 [[package]]
-name = "io-lifetimes"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
-dependencies = [
- "hermit-abi 0.3.1",
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
 name = "ipnet"
-version = "2.7.2"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12b6ee2129af8d4fb011108c73d99a1b83a85977f23b82460c0ae2e25bb4b57f"
+checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"
 
 [[package]]
 name = "itertools"
@@ -928,29 +690,20 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.6"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "453ad9f582a441959e5f0d088b02ce04cfe8d51a8eaf077f12ac6d3e94164ca6"
+checksum = "62b02a5381cc465bd3041d84623d0fa3b66738b52b8e2fc3bab8ad63ab032f4a"
 
 [[package]]
 name = "js-sys"
-version = "0.3.63"
+version = "0.3.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f37a4a5928311ac501dee68b3c7613a1037d0edb30c8e5427bd832d55d1b790"
+checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
 dependencies = [
  "wasm-bindgen",
 ]
 
 [[package]]
-name = "krb5-src"
-version = "0.3.2+1.19.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44cd3b7e7735d48bc3793837041294f2eb747bd0f63bbc081e89972abb9e48fb"
-dependencies = [
- "duct",
-]
-
-[[package]]
 name = "lazy_static"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -958,44 +711,25 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.144"
+version = "0.2.147"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b00cc1c228a6782d0f076e7b232802e0c5689d41bb5df366f2a6b6621cfdfe1"
+checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "898745e570c7d0453cc1fbc4a701eb6c662ed54e8fec8b7d14be137ebeeb9d14"
-dependencies = [
- "cc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "libz-sys"
-version = "1.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56ee889ecc9568871456d42f603d6a0ce59ff328d291063a45cbdf0036baf6db"
+version = "0.26.0"
+source = "git+https://github.com/rusqlite/rusqlite.git?rev=7b0393210be4bce17156a08fde732083d6342a75#7b0393210be4bce17156a08fde732083d6342a75"
 dependencies = [
  "cc",
- "libc",
  "pkg-config",
  "vcpkg",
 ]
 
 [[package]]
-name = "linux-raw-sys"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
-
-[[package]]
 name = "lock_api"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df"
+checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1003,9 +737,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.18"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "518ef76f2f87365916b142844c16d8fefd85039bc5699050210a7778ee1cd1de"
+checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
 
 [[package]]
 name = "matchers"
@@ -1013,7 +747,7 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
 dependencies = [
- "regex-automata",
+ "regex-automata 0.1.10",
 ]
 
 [[package]]
@@ -1029,15 +763,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b87248edafb776e59e6ee64a79086f65890d3510f2c656c000bf2a7e8a0aea40"
 
 [[package]]
-name = "md-5"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6365506850d44bff6e2fbcb5176cf63650e48bd45ef2fe2665ae1570e0f4b9ca"
-dependencies = [
- "digest",
-]
-
-[[package]]
 name = "memchr"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1045,9 +770,9 @@ checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
 
 [[package]]
 name = "memoffset"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d61c719bcfbcf5d62b3a09efa6088de8c54bc0bfcd3ea7ae39fcc186108b8de1"
+checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
 dependencies = [
  "autocfg",
 ]
@@ -1059,10 +784,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
-name = "minimal-lexical"
-version = "0.2.1"
+name = "miniz_oxide"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+dependencies = [
+ "adler",
+]
 
 [[package]]
 name = "mio"
@@ -1072,23 +800,7 @@ checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
 dependencies = [
  "libc",
  "wasi",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "multimap"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ce46fe64a9d73be07dcbe690a38ce1b293be448fd8ce1e6c1b8062c9f72c6a"
-
-[[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
+ "windows-sys",
 ]
 
 [[package]]
@@ -1179,68 +891,34 @@ dependencies = [
 
 [[package]]
 name = "num_cpus"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
- "hermit-abi 0.2.6",
+ "hermit-abi",
  "libc",
 ]
 
 [[package]]
-name = "num_enum"
-version = "0.5.11"
+name = "object"
+version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f646caf906c20226733ed5b1374287eb97e3c2a5c227ce668c1f2ce20ae57c9"
+checksum = "8bda667d9f2b5051b8833f59f3bf748b28ef54f850f4fcb389a252aa383866d1"
 dependencies = [
- "num_enum_derive",
-]
-
-[[package]]
-name = "num_enum_derive"
-version = "0.5.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcbff9bc912032c62bf65ef1d5aea88983b420f4f839db1e9b0c281a25c9c799"
-dependencies = [
- "proc-macro-crate",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
+ "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.17.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9670a07f94779e00908f3e686eab508878ebb390ba6e604d3a284c00e8d0487b"
-
-[[package]]
-name = "openssl-src"
-version = "111.26.0+1.1.1u"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efc62c9f12b22b8f5208c23a7200a442b2e5999f8bdf80233852122b5a4f6f37"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "openssl-sys"
-version = "0.9.88"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2ce0f250f34a308dcfdbb351f511359857d4ed2134ba715a4eadd46e1ffd617"
-dependencies = [
- "cc",
- "libc",
- "openssl-src",
- "pkg-config",
- "vcpkg",
-]
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "opentelemetry"
-version = "0.18.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69d6c3d7288a106c0a363e4b0e8d308058d56902adefb16f4936f417ffef086e"
+checksum = "9591d937bc0e6d2feb6f71a559540ab300ea49955229c347a517a28d27784c54"
 dependencies = [
  "opentelemetry_api",
  "opentelemetry_sdk",
@@ -1248,9 +926,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-http"
-version = "0.7.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1edc79add46364183ece1a4542592ca593e6421c60807232f5b8f7a31703825d"
+checksum = "c7594ec0e11d8e33faf03530a4c49af7064ebba81c1480e01be67d90b356508b"
 dependencies = [
  "async-trait",
  "bytes",
@@ -1261,34 +939,33 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-jaeger"
-version = "0.17.0"
+version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e785d273968748578931e4dc3b4f5ec86b26e09d9e0d66b55adda7fce742f7a"
+checksum = "876958ba9084f390f913fcf04ddf7bbbb822898867bb0a51cc28f2b9e5c1b515"
 dependencies = [
  "async-trait",
- "futures",
- "futures-executor",
- "once_cell",
+ "futures-core",
+ "futures-util",
  "opentelemetry",
  "opentelemetry-semantic-conventions",
- "thiserror",
  "thrift",
  "tokio",
 ]
 
 [[package]]
 name = "opentelemetry-otlp"
-version = "0.11.0"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1c928609d087790fc936a1067bdc310ae702bdf3b090c3f281b713622c8bbde"
+checksum = "7e5e5a5c4135864099f3faafbe939eb4d7f9b80ebf68a8448da961b32a7c1275"
 dependencies = [
  "async-trait",
- "futures",
- "futures-util",
+ "futures-core",
  "http",
- "opentelemetry",
  "opentelemetry-http",
  "opentelemetry-proto",
+ "opentelemetry-semantic-conventions",
+ "opentelemetry_api",
+ "opentelemetry_sdk",
  "prost",
  "reqwest",
  "thiserror",
@@ -1298,34 +975,31 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-proto"
-version = "0.1.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d61a2f56df5574508dd86aaca016c917489e589ece4141df1b5e349af8d66c28"
+checksum = "b1e3f814aa9f8c905d0ee4bde026afd3b2577a97c10e1699912e3e44f0c4cbeb"
 dependencies = [
- "futures",
- "futures-util",
- "opentelemetry",
+ "opentelemetry_api",
+ "opentelemetry_sdk",
  "prost",
  "tonic",
- "tonic-build",
 ]
 
 [[package]]
 name = "opentelemetry-semantic-conventions"
-version = "0.10.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b02e0230abb0ab6636d18e2ba8fa02903ea63772281340ccac18e0af3ec9eeb"
+checksum = "73c9f9340ad135068800e7f1b24e9e09ed9e7143f5bf8518ded3d3ec69789269"
 dependencies = [
  "opentelemetry",
 ]
 
 [[package]]
 name = "opentelemetry_api"
-version = "0.18.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c24f96e21e7acc813c7a8394ee94978929db2bcc46cf6b5014fc612bf7760c22"
+checksum = "8a81f725323db1b1206ca3da8bb19874bbd3f57c3bcd59471bfb04525b265b9b"
 dependencies = [
- "fnv",
  "futures-channel",
  "futures-util",
  "indexmap",
@@ -1333,25 +1007,27 @@ dependencies = [
  "once_cell",
  "pin-project-lite",
  "thiserror",
+ "urlencoding",
 ]
 
 [[package]]
 name = "opentelemetry_sdk"
-version = "0.18.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ca41c4933371b61c2a2f214bf16931499af4ec90543604ec828f7a625c09113"
+checksum = "fa8e705a0612d48139799fcbaba0d4a90f06277153e43dd2bdc16c6f0edd8026"
 dependencies = [
  "async-trait",
  "crossbeam-channel",
- "dashmap",
- "fnv",
  "futures-channel",
  "futures-executor",
  "futures-util",
  "once_cell",
  "opentelemetry_api",
+ "ordered-float 3.7.0",
  "percent-encoding",
  "rand",
+ "regex",
+ "serde_json",
  "thiserror",
  "tokio",
  "tokio-stream",
@@ -1359,21 +1035,20 @@ dependencies = [
 
 [[package]]
 name = "ordered-float"
-version = "1.1.1"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3305af35278dd29f46fcdd139e0b1fbfae2153f0e5928b39b035542dd31e37b7"
+checksum = "7940cf2ca942593318d07fcf2596cdca60a85c9e7fab408a5e21a4f9dcd40d87"
 dependencies = [
  "num-traits",
 ]
 
 [[package]]
-name = "os_pipe"
-version = "1.1.4"
+name = "ordered-float"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ae859aa07428ca9a929b936690f8b12dc5f11dd8c6992a18ca93919f28bc177"
+checksum = "2fc2dbde8f8a79f2102cc474ceb0ad68e3b80b85289ea62389b60e66777e4213"
 dependencies = [
- "libc",
- "windows-sys 0.48.0",
+ "num-traits",
 ]
 
 [[package]]
@@ -1384,99 +1059,64 @@ checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
 [[package]]
 name = "parking_lot"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
-dependencies = [
- "instant",
- "lock_api",
- "parking_lot_core 0.8.6",
-]
-
-[[package]]
-name = "parking_lot"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
 dependencies = [
  "lock_api",
- "parking_lot_core 0.9.7",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60a2cfe6f0ad2bfc16aefa463b497d5c7a5ecd44a23efa72aa342d90177356dc"
-dependencies = [
- "cfg-if",
- "instant",
- "libc",
- "redox_syscall 0.2.16",
- "smallvec",
- "winapi",
+ "parking_lot_core",
 ]
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.7"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9069cbb9f99e3a5083476ccb29ceb1de18b9118cafa53e90c9551235de2b9521"
+checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.2.16",
+ "redox_syscall",
  "smallvec",
- "windows-sys 0.45.0",
+ "windows-targets",
 ]
 
 [[package]]
 name = "paste"
-version = "1.0.12"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f746c4065a8fa3fe23974dd82f15431cc8d40779821001404d10d2e79ca7d79"
+checksum = "b4b27ab7be369122c218afc2079489cdcb4b517c0a3fc386ff11e1fedfcc2b35"
 
 [[package]]
 name = "percent-encoding"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
-
-[[package]]
-name = "petgraph"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dd7d28ee937e54fe3080c91faa1c3a46c06de6252988a7f4592ba2310ef22a4"
-dependencies = [
- "fixedbitset",
- "indexmap",
-]
+checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
 
 [[package]]
 name = "pin-project"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c95a7476719eab1e366eaf73d0260af3021184f18177925b07f54b30089ceead"
+checksum = "030ad2bc4db10a8944cb0d837f158bdfec4d4a4873ab701a95046770d11f8842"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39407670928234ebc5e6e580247dd567ad73a3578460c5990f9503df207e8f07"
+checksum = "ec2e072ecce94ec471b13398d5402c188e76ac03cf74dd1a975161b23a3f6d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+checksum = "4c40d25201921e5ff0c862a505c6557ea88568a4e3ace775ab55e93f2f4f9d57"
 
 [[package]]
 name = "pin-utils"
@@ -1497,30 +1137,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
-name = "prettyplease"
-version = "0.1.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8646e95016a7a6c4adea95bafa8a16baab64b583356217f2c85db4a39d9a86"
-dependencies = [
- "proc-macro2",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "proc-macro-crate"
-version = "1.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
-dependencies = [
- "once_cell",
- "toml_edit",
-]
-
-[[package]]
 name = "proc-macro2"
-version = "1.0.59"
+version = "1.0.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aeca18b86b413c660b781aa319e4e2648a3e6f9eadc9b47e9038e6fe9f3451b"
+checksum = "7b368fba921b0dce7e60f5e04ec15e565b3303972b42bcfde1d0713b881959eb"
 dependencies = [
  "unicode-ident",
 ]
@@ -1536,28 +1156,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "prost-build"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "119533552c9a7ffacc21e099c24a0ac8bb19c2a2a3f363de84cd9b844feab270"
-dependencies = [
- "bytes",
- "heck",
- "itertools",
- "lazy_static",
- "log",
- "multimap",
- "petgraph",
- "prettyplease",
- "prost",
- "prost-types",
- "regex",
- "syn 1.0.109",
- "tempfile",
- "which",
-]
-
-[[package]]
 name = "prost-derive"
 version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1571,26 +1169,17 @@ dependencies = [
 ]
 
 [[package]]
-name = "prost-types"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "213622a1460818959ac1181aaeb2dc9c7f63df720db7d788b3e24eacd1983e13"
-dependencies = [
- "prost",
-]
-
-[[package]]
 name = "pyo3"
-version = "0.18.3"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3b1ac5b3731ba34fdaa9785f8d74d17448cd18f30cf19e0c7e7b1fdb5272109"
+checksum = "e681a6cfdc4adcc93b4d3cf993749a4552018ee0a9b65fc0ccfad74352c72a38"
 dependencies = [
  "cfg-if",
  "chrono",
  "indoc",
  "libc",
  "memoffset",
- "parking_lot 0.12.1",
+ "parking_lot",
  "pyo3-build-config",
  "pyo3-ffi",
  "pyo3-macros",
@@ -1599,9 +1188,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.18.3"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cb946f5ac61bb61a5014924910d936ebd2b23b705f7a4a3c40b05c720b079a3"
+checksum = "076c73d0bc438f7a4ef6fdd0c3bb4732149136abd952b110ac93e4edb13a6ba5"
 dependencies = [
  "once_cell",
  "target-lexicon",
@@ -1609,9 +1198,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.18.3"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd4d7c5337821916ea2a1d21d1092e8443cf34879e53a0ac653fbb98f44ff65c"
+checksum = "e53cee42e77ebe256066ba8aa77eff722b3bb91f3419177cf4cd0f304d3284d9"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -1619,9 +1208,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.18.3"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d39c55dab3fc5a4b25bbd1ac10a2da452c4aca13bb450f22818a002e29648d"
+checksum = "dfeb4c99597e136528c6dd7d5e3de5434d1ceaf487436a3f03b2d56b6fc9efd1"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -1631,9 +1220,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.18.3"
+version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97daff08a4c48320587b5224cc98d609e3c27b6d437315bd40b605c98eeb5918"
+checksum = "947dc12175c254889edc0c02e399476c2f652b4b9ebd123aa655c224de259536"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1642,9 +1231,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.28"
+version = "1.0.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ab9c7eadfd8df19006f1cf1a4aed13540ed5cbc047010ece5826e10825488"
+checksum = "573015e8ab27661678357f27dc26460738fd2b6c86e46f386fde94cb5d913105"
 dependencies = [
  "proc-macro2",
 ]
@@ -1680,82 +1269,44 @@ dependencies = [
 ]
 
 [[package]]
-name = "rdkafka"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1de127f294f2dba488ed46760b129d5ecbeabbd337ccbf3739cb29d50db2161c"
-dependencies = [
- "futures",
- "libc",
- "log",
- "rdkafka-sys",
- "serde",
- "serde_derive",
- "serde_json",
- "slab",
- "tokio",
-]
-
-[[package]]
-name = "rdkafka-sys"
-version = "4.4.0+1.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ac9d87c3aba1748e3112318459f2ac8bff80bfff7359e338e0463549590249"
-dependencies = [
- "cmake",
- "libc",
- "libz-sys",
- "num_enum",
- "openssl-sys",
- "pkg-config",
- "sasl2-sys",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
 name = "redox_syscall"
 version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
 ]
 
 [[package]]
-name = "redox_users"
-version = "0.4.3"
+name = "regex"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
+checksum = "89089e897c013b3deb627116ae56a6955a72b8bed395c9526af31c9fe528b484"
 dependencies = [
- "getrandom",
- "redox_syscall 0.2.16",
- "thiserror",
+ "aho-corasick",
+ "memchr",
+ "regex-automata 0.3.0",
+ "regex-syntax 0.7.3",
 ]
 
 [[package]]
-name = "regex"
-version = "1.8.3"
+name = "regex-automata"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81ca098a9821bd52d6b24fd8b10bd081f47d39c22778cafaa75a2857a62c6390"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
 dependencies = [
- "regex-syntax 0.7.2",
+ "regex-syntax 0.6.29",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.1.10"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+checksum = "fa250384981ea14565685dea16a9ccc4d1c541a13f82b9c168572264d1df8c56"
 dependencies = [
- "regex-syntax 0.6.29",
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.7.3",
 ]
 
 [[package]]
@@ -1766,9 +1317,9 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436b050e76ed2903236f032a59761c1eb99e1b0aead2c257922771dab1fc8c78"
+checksum = "2ab07dc67230e4a4718e70fd5c20055a4334b121f1f9db8fe63ef39ce9b8c846"
 
 [[package]]
 name = "reqwest"
@@ -1776,7 +1327,7 @@ version = "0.11.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cde824a14b7c14f85caff81225f411faacc04a2013f41670f41443742b1c1c55"
 dependencies = [
- "base64 0.21.2",
+ "base64",
  "bytes",
  "encoding_rs",
  "futures-core",
@@ -1805,80 +1356,45 @@ dependencies = [
 ]
 
 [[package]]
-name = "ring"
-version = "0.16.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+name = "rusqlite"
+version = "0.29.0"
+source = "git+https://github.com/rusqlite/rusqlite.git?rev=7b0393210be4bce17156a08fde732083d6342a75#7b0393210be4bce17156a08fde732083d6342a75"
 dependencies = [
- "cc",
- "libc",
- "once_cell",
- "spin 0.5.2",
- "untrusted",
- "web-sys",
- "winapi",
-]
-
-[[package]]
-name = "rustix"
-version = "0.37.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acf8729d8542766f1b2cf77eb034d52f40d375bb8b615d0b147089946e16613d"
-dependencies = [
- "bitflags",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.48.0",
+ "bitflags 2.3.3",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
 ]
 
 [[package]]
-name = "rustls"
-version = "0.20.8"
+name = "rusqlite_migration"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fff78fc74d175294f4e83b28343315ffcfb114b156f0185e9741cb5570f50e2f"
+checksum = "ef7dd29a4426624704d5966416682fb7ab3682f724986e9e3893eaca44accabc"
 dependencies = [
  "log",
- "ring",
- "sct",
- "webpki",
+ "rusqlite",
 ]
 
 [[package]]
-name = "rustls-pemfile"
-version = "1.0.2"
+name = "rustc-demangle"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d194b56d58803a43635bdc398cd17e383d6f71f9182b9a192c127ca42494a59b"
-dependencies = [
- "base64 0.21.2",
-]
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
 name = "rustversion"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f3208ce4d8448b3f3e7d168a73f5e0c43a61e32930de3bceeccedb388b6bf06"
-
-[[package]]
-name = "ryu"
 version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"
+checksum = "dc31bd9b61a32c31f9650d18add92aa83a49ba979c143eefd27fe7177b05bd5f"
 
 [[package]]
-name = "sasl2-sys"
-version = "0.1.20+2.1.28"
+name = "ryu"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e645bd98535fc8fd251c43ba7c7c1f9be1e0369c99b6a5ea719052a773e655c"
-dependencies = [
- "cc",
- "duct",
- "krb5-src",
- "libc",
- "openssl-sys",
- "pkg-config",
-]
+checksum = "fe232bdf6be8c8de797b22184ee71118d63780ea42ac85b61d1baa6d3b782ae9"
 
 [[package]]
 name = "scopeguard"
@@ -1887,40 +1403,36 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
 
 [[package]]
-name = "sct"
-version = "0.7.0"
+name = "seahash"
+version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
-dependencies = [
- "ring",
- "untrusted",
-]
+checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
 
 [[package]]
 name = "serde"
-version = "1.0.163"
+version = "1.0.166"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2113ab51b87a539ae008b5c6c02dc020ffa39afd2d83cffcb3f4eb2722cebec2"
+checksum = "d01b7404f9d441d3ad40e6a636a7782c377d2abdbe4fa2440e2edcc2f4f10db8"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.163"
+version = "1.0.166"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c805777e3930c8883389c602315a24224bcc738b63905ef87cd1420353ea93e"
+checksum = "5dd83d6dde2b6b2d466e14d9d1acce8816dedee94f735eac6395808b3483c6d6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.96"
+version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "057d394a50403bcac12672b2b18fb387ab6d289d957dab67dd201875391e52f1"
+checksum = "0f1e14e89be7aa4c4b78bdbdc9eb5bf8517829a600ae8eaa39a6e1d960b5185c"
 dependencies = [
  "itoa",
  "ryu",
@@ -1929,9 +1441,9 @@ dependencies = [
 
 [[package]]
 name = "serde_test"
-version = "1.0.163"
+version = "1.0.166"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "100168a8017b89fd4bcbeb8d857d95a8cfcbde829a7147c09cc82d3ab8d8cb41"
+checksum = "65c75585b65852643a745182a6fa82b0420165a70f67c5d3af80139c74ee12cc"
 dependencies = [
  "serde",
 ]
@@ -1949,28 +1461,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "sha1"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "sha2"
-version = "0.10.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
 name = "sharded-slab"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1980,16 +1470,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "shared_child"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0d94659ad3c2137fef23ae75b03d5241d633f8acded53d672decfa0e6e0caef"
-dependencies = [
- "libc",
- "winapi",
-]
-
-[[package]]
 name = "signal-hook-registry"
 version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2009,9 +1489,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
+checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
 
 [[package]]
 name = "socket2"
@@ -2024,145 +1504,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "spin"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
-
-[[package]]
-name = "spin"
-version = "0.9.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
-dependencies = [
- "lock_api",
-]
-
-[[package]]
-name = "sqlformat"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c12bc9199d1db8234678b7051747c07f517cdcf019262d1847b94ec8b1aee3e"
-dependencies = [
- "itertools",
- "nom",
- "unicode_categories",
-]
-
-[[package]]
-name = "sqlx"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8de3b03a925878ed54a954f621e64bf55a3c1bd29652d0d1a17830405350188"
-dependencies = [
- "sqlx-core",
- "sqlx-macros",
-]
-
-[[package]]
-name = "sqlx-core"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa8241483a83a3f33aa5fff7e7d9def398ff9990b2752b6c6112b83c6d246029"
-dependencies = [
- "ahash 0.7.6",
- "atoi",
- "base64 0.13.1",
- "bitflags",
- "byteorder",
- "bytes",
- "chrono",
- "crc",
- "crossbeam-queue",
- "dirs",
- "dotenvy",
- "either",
- "event-listener",
- "flume",
- "futures-channel",
- "futures-core",
- "futures-executor",
- "futures-intrusive",
- "futures-util",
- "hashlink",
- "hex",
- "hkdf",
- "hmac",
- "indexmap",
- "itoa",
- "libc",
- "libsqlite3-sys",
- "log",
- "md-5",
- "memchr",
- "once_cell",
- "paste",
- "percent-encoding",
- "rand",
- "rustls",
- "rustls-pemfile",
- "serde",
- "serde_json",
- "sha1",
- "sha2",
- "smallvec",
- "sqlformat",
- "sqlx-rt",
- "stringprep",
- "thiserror",
- "tokio-stream",
- "url",
- "webpki-roots",
- "whoami",
-]
-
-[[package]]
-name = "sqlx-macros"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9966e64ae989e7e575b19d7265cb79d7fc3cbbdf179835cb0d716f294c2049c9"
-dependencies = [
- "dotenvy",
- "either",
- "heck",
- "once_cell",
- "proc-macro2",
- "quote",
- "sha2",
- "sqlx-core",
- "sqlx-rt",
- "syn 1.0.109",
- "url",
-]
-
-[[package]]
-name = "sqlx-rt"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "804d3f245f894e61b1e6263c84b23ca675d96753b5abfd5cc8597d86806e8024"
-dependencies = [
- "once_cell",
- "tokio",
- "tokio-rustls",
-]
-
-[[package]]
-name = "stringprep"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ee348cb74b87454fff4b551cbf727025810a004f88aeacae7f85b87f4e9a1c1"
-dependencies = [
- "unicode-bidi",
- "unicode-normalization",
-]
-
-[[package]]
-name = "subtle"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
-
-[[package]]
 name = "syn"
 version = "1.0.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2175,9 +1516,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.18"
+version = "2.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32d41677bcbe24c20c52e7c70b0d8db04134c5d1066bf98662e2871ad200ea3e"
+checksum = "59fb7d6d8281a51045d62b8eb3a7d1ce347b76f312af50cd3dc0af39c87c1737"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2204,41 +1545,28 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.7"
+version = "0.12.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd1ba337640d60c3e96bc6f0638a939b9c9a7f2c316a1598c279828b3d1dc8c5"
-
-[[package]]
-name = "tempfile"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9fbec84f381d5795b08656e4912bec604d162bff9291d6189a78f4c8ab87998"
-dependencies = [
- "cfg-if",
- "fastrand",
- "redox_syscall 0.3.5",
- "rustix",
- "windows-sys 0.45.0",
-]
+checksum = "1b1c7f239eb94671427157bd93b3694320f3668d4e1eff08c7285366fd777fac"
 
 [[package]]
 name = "thiserror"
-version = "1.0.40"
+version = "1.0.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978c9a314bd8dc99be594bc3c175faaa9794be04a5a5e153caba6915336cebac"
+checksum = "c16a64ba9387ef3fdae4f9c1a7f07a0997fce91985c0336f1ddc1822b3b37802"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.40"
+version = "1.0.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
+checksum = "d14928354b01c4d6a4f0e549069adef399a284e7995c7ccca94e8a07a5346c59"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -2262,14 +1590,14 @@ dependencies = [
 
 [[package]]
 name = "thrift"
-version = "0.16.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09678c4cdbb4eed72e18b7c2af1329c69825ed16fcbac62d083fc3e2b0590ff0"
+checksum = "7e54bc85fc7faa8bc175c4bab5b92ba8d9a3ce893d0e9f42cc455c8ab16a9e09"
 dependencies = [
  "byteorder",
  "integer-encoding",
  "log",
- "ordered-float",
+ "ordered-float 2.10.0",
  "threadpool",
 ]
 
@@ -2343,21 +1671,22 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.28.2"
+version = "1.29.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94d7b1cfd2aa4011f2de74c2c4c63665e27a71006b0a192dcd2710272e73dfa2"
+checksum = "532826ff75199d5833b9d2c5fe410f29235e25704ee5f0ef599fb51c21f4a4da"
 dependencies = [
  "autocfg",
+ "backtrace",
  "bytes",
  "libc",
  "mio",
  "num_cpus",
- "parking_lot 0.12.1",
+ "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
  "socket2",
  "tokio-macros",
- "windows-sys 0.48.0",
+ "windows-sys",
 ]
 
 [[package]]
@@ -2378,18 +1707,7 @@ checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
-]
-
-[[package]]
-name = "tokio-rustls"
-version = "0.23.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c43ee83903113e03984cb9e5cebe6c04a5116269e900e3ddba8f068a62adda59"
-dependencies = [
- "rustls",
- "tokio",
- "webpki",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -2418,32 +1736,14 @@ dependencies = [
 ]
 
 [[package]]
-name = "toml_datetime"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a76a9312f5ba4c2dec6b9161fdf25d87ad8a09256ccea5a556fef03c706a10f"
-
-[[package]]
-name = "toml_edit"
-version = "0.19.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2380d56e8670370eee6566b0bfd4265f65b3f432e8c6d85623f728d4fa31f739"
-dependencies = [
- "indexmap",
- "toml_datetime",
- "winnow",
-]
-
-[[package]]
 name = "tonic"
-version = "0.8.3"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f219fad3b929bef19b1f86fbc0358d35daed8f2cac972037ac0dc10bbb8d5fb"
+checksum = "3082666a3a6433f7f511c7192923fa1fe07c69332d3c6a2e6bb040b569199d5a"
 dependencies = [
- "async-stream",
  "async-trait",
  "axum 0.6.18",
- "base64 0.13.1",
+ "base64",
  "bytes",
  "futures-core",
  "futures-util",
@@ -2455,28 +1755,12 @@ dependencies = [
  "percent-encoding",
  "pin-project",
  "prost",
- "prost-derive",
  "tokio",
  "tokio-stream",
- "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
  "tracing",
- "tracing-futures",
-]
-
-[[package]]
-name = "tonic-build"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bf5e9b9c0f7e0a7c027dcfaba7b2c60816c7049171f679d99ee2ff65d0de8c4"
-dependencies = [
- "prettyplease",
- "proc-macro2",
- "prost-build",
- "quote",
- "syn 1.0.109",
 ]
 
 [[package]]
@@ -2505,7 +1789,7 @@ version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f873044bf02dd1e8239e9c1293ea39dad76dc594ec16185d0a1bf31d8dc8d858"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "bytes",
  "futures-core",
  "futures-util",
@@ -2545,13 +1829,13 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.24"
+version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f57e3ca2a01450b1a921183a9c9cbfda207fd822cef4ccb00a65402cbba7a74"
+checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
 ]
 
 [[package]]
@@ -2565,16 +1849,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "tracing-futures"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97d095ae15e245a057c8e8451bab9b3ee1e1f68e9ba2b4fbc18d0ac5237835f2"
-dependencies = [
- "pin-project",
- "tracing",
-]
-
-[[package]]
 name = "tracing-log"
 version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2587,9 +1861,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-opentelemetry"
-version = "0.18.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21ebb87a95ea13271332df069020513ab70bdb5637ca42d6e492dc3bbbad48de"
+checksum = "fc09e402904a5261e42cf27aea09ccb7d5318c6717a9eec3d8e2e65c56b18f19"
 dependencies = [
  "once_cell",
  "opentelemetry",
@@ -2624,12 +1898,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
 
 [[package]]
-name = "typenum"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
-
-[[package]]
 name = "unicode-bidi"
 version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2637,9 +1905,9 @@ checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b15811caf2415fb889178633e7724bad2509101cde276048e013b9def5e51fa0"
+checksum = "22049a19f4a68748a168c0fc439f9516686aa045927ff767eca0a85101fb6e73"
 
 [[package]]
 name = "unicode-normalization"
@@ -2651,12 +1919,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "unicode-segmentation"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
-
-[[package]]
 name = "unicode-width"
 version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2669,28 +1931,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
 
 [[package]]
-name = "unicode_categories"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
-
-[[package]]
 name = "unindent"
 version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1766d682d402817b5ac4490b3c3002d91dfa0d22812f341609f97b08757359c"
 
 [[package]]
-name = "untrusted"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
-
-[[package]]
 name = "url"
-version = "2.3.1"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
+checksum = "50bff7831e19200a85b17131d085c25d7811bc4e186efdaf54bbd132994a88cb"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -2698,6 +1948,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
+[[package]]
 name = "valuable"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2717,11 +1973,10 @@ checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
 name = "want"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ce8a968cb1cd110d136ff8b819a556d6fb6d919363c61534f6860c7eb172ba0"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
 dependencies = [
- "log",
  "try-lock",
 ]
 
@@ -2733,9 +1988,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bba0e8cb82ba49ff4e229459ff22a191bbe9a1cb3a341610c9c33efc27ddf73"
+checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -2743,24 +1998,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b04bc93f9d6bdee709f6bd2118f57dd6679cf1176a1af464fca3ab0d66d8fb"
+checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.36"
+version = "0.4.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d1985d03709c53167ce907ff394f5316aa22cb4e12761295c5dc57dacb6297e"
+checksum = "c02dbc21516f9f1f04f187958890d7e6026df8d16540b7ad9492bc34a67cea03"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -2770,9 +2025,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14d6b024f1a526bb0234f52840389927257beb670610081360e5a03c5df9c258"
+checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2780,74 +2035,34 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e128beba882dd1eb6200e1dc92ae6c5dbaa4311aa7bb211ca035779e5efc39f8"
+checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.18",
+ "syn 2.0.23",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.86"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed9d5b4305409d1fc9482fee2d7f9bcbf24b3972bf59817ef757e23982242a93"
+checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
 
 [[package]]
 name = "web-sys"
-version = "0.3.63"
+version = "0.3.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bdd9ef4e984da1187bf8110c5cf5b845fbc87a23602cdf912386a76fcd3a7c2"
+checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
 ]
 
 [[package]]
-name = "webpki"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
-dependencies = [
- "ring",
- "untrusted",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "0.22.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c71e40d7d2c34a5106301fb632274ca37242cd0c9d3e64dbece371a40a2d87"
-dependencies = [
- "webpki",
-]
-
-[[package]]
-name = "which"
-version = "4.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2441c784c52b289a054b7201fc93253e288f094e2f4be9058343127c4226a269"
-dependencies = [
- "either",
- "libc",
- "once_cell",
-]
-
-[[package]]
-name = "whoami"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c70234412ca409cc04e864e89523cb0fc37f5e1344ebed5a3ebf4192b6b9f68"
-dependencies = [
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
 name = "winapi"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2875,16 +2090,7 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e686886bc078bc1b0b600cac0147aadb815089b6e4da64016cbd754b6342700f"
 dependencies = [
- "windows-targets 0.48.0",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
+ "windows-targets",
 ]
 
 [[package]]
@@ -2893,133 +2099,67 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows-targets 0.48.0",
+ "windows-targets",
 ]
 
 [[package]]
 name = "windows-targets"
-version = "0.42.2"
+version = "0.48.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+checksum = "05d4b17490f70499f20b9e791dcf6a299785ce8af4d709018206dc5b4953e95f"
 dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b1eb6f0cd7c80c79759c929114ef071b87354ce476d9d94271031c0497adfd5"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.0",
- "windows_aarch64_msvc 0.48.0",
- "windows_i686_gnu 0.48.0",
- "windows_i686_msvc 0.48.0",
- "windows_x86_64_gnu 0.48.0",
- "windows_x86_64_gnullvm 0.48.0",
- "windows_x86_64_msvc 0.48.0",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
-[[package]]
-name = "windows_aarch64_msvc"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
-[[package]]
-name = "windows_i686_gnu"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
-[[package]]
-name = "windows_i686_msvc"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
-[[package]]
-name = "windows_x86_64_gnu"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
-[[package]]
-name = "windows_x86_64_msvc"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
 
 [[package]]
-name = "winnow"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61de7bac303dc551fe038e2b3cef0f571087a47571ea6e79a87692ac99b99699"
-dependencies = [
- "memchr",
-]
-
-[[package]]
 name = "winreg"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/pkgs/development/python-modules/bytewax/default.nix b/pkgs/development/python-modules/bytewax/default.nix
index c27d756070de..ea0bfe9e32da 100644
--- a/pkgs/development/python-modules/bytewax/default.nix
+++ b/pkgs/development/python-modules/bytewax/default.nix
@@ -1,22 +1,33 @@
 { lib
 , stdenv
 , buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
 , cmake
-, confluent-kafka
+, pkg-config
+, rustPlatform
+
+# native dependencies
 , cyrus_sasl
-, fetchFromGitHub
 , openssl
-, pkg-config
 , protobuf
+
+# dependencies
+, jsonpickle
+
+# optional dependencies
+, confluent-kafka
+
+# test
+, myst-docutils
 , pytestCheckHook
-, pythonOlder
-, rustPlatform
-, setuptools-rust
 }:
 
 buildPythonPackage rec {
   pname = "bytewax";
-  version = "0.17.1";
+  version = "0.17.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +36,7 @@ buildPythonPackage rec {
     owner = "bytewax";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Cv2bTgs3XfYOcHK628/RgGol7S6E4WfHb7gHXXjBhig=";
+    hash = "sha256-BecZvBJsaTHIhJhWM9GZldSL6Irrc7fiedulTN9e76I=";
   };
 
   env = {
@@ -34,13 +45,16 @@ buildPythonPackage rec {
 
   # Remove docs tests, myst-docutils in nixpkgs is not compatible with package requirements.
   # Package uses old version.
-  patches = [ ./remove-docs-test.patch ];
+  patches = [
+    ./remove-docs-test.patch
+  ];
 
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "columnation-0.1.0" = "sha256-RAyZKR+sRmeWGh7QYPZnJgX9AtWqmca85HcABEFUgX8=";
       "timely-0.12.0" = "sha256-sZuVLBDCXurIe38m4UAjEuFeh73VQ5Jawy+sr3U/HbI=";
+      "libsqlite3-sys-0.26.0" = "sha256-WpJA+Pm5dWKcdUrP0xS5ps/oE/yAXuQvvsdyDfDet1o=";
     };
   };
 
@@ -59,6 +73,10 @@ buildPythonPackage rec {
     protobuf
   ];
 
+  propagatedBuildInputs = [
+    jsonpickle
+  ];
+
   passthru.optional-dependencies = {
     kafka = [
       confluent-kafka
@@ -70,9 +88,15 @@ buildPythonPackage rec {
   '';
 
   checkInputs = [
+    myst-docutils
     pytestCheckHook
   ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
+  disabledTestPaths = [
+    # dependens on an old myst-docutils version
+    "docs"
+  ];
+
   pythonImportsCheck = [
     "bytewax"
   ];
diff --git a/pkgs/development/python-modules/bytewax/remove-docs-test.patch b/pkgs/development/python-modules/bytewax/remove-docs-test.patch
index d5c9269a01b2..93b2adad18dc 100644
--- a/pkgs/development/python-modules/bytewax/remove-docs-test.patch
+++ b/pkgs/development/python-modules/bytewax/remove-docs-test.patch
@@ -1,10 +1,12 @@
 diff --git a/pyproject.toml b/pyproject.toml
-index 41b5c90..e7c7b2d 100644
+index 107cab8..34cc544 100644
 --- a/pyproject.toml
 +++ b/pyproject.toml
-@@ -50,6 +50,5 @@ doctest_optionflags = "NORMALIZE_WHITESPACE"
+@@ -66,7 +66,6 @@ long_description_content_type = "text/markdown"
+ addopts = "-v --doctest-modules"
+ doctest_optionflags = "NORMALIZE_WHITESPACE"
  testpaths = [
-     "pytests",
-     "pysrc",
 -    "docs",
+     "pysrc",
+     "pytests",
  ]
diff --git a/pkgs/development/python-modules/cachetools/default.nix b/pkgs/development/python-modules/cachetools/default.nix
index 14682f23001f..8a2f5397d6e1 100644
--- a/pkgs/development/python-modules/cachetools/default.nix
+++ b/pkgs/development/python-modules/cachetools/default.nix
@@ -1,14 +1,19 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, setuptools
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "cachetools";
-  version = "5.3.0";
-  format = "setuptools";
+  version = "5.3.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -16,9 +21,13 @@ buildPythonPackage rec {
     owner = "tkem";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7MbP3jz17lGwjAeWo8QmS5v1vGqIQmYLbKVcK/q89Z4=";
+    hash = "sha256-CmyAW9uV63OV/zZsWwZkXOWbHfHAJdYFGJsRhpqQ1f4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/cattrs/default.nix b/pkgs/development/python-modules/cattrs/default.nix
index b637f714d26d..304069b660d2 100644
--- a/pkgs/development/python-modules/cattrs/default.nix
+++ b/pkgs/development/python-modules/cattrs/default.nix
@@ -4,12 +4,13 @@
 , cbor2
 , fetchFromGitHub
 , exceptiongroup
+, hatchling
+, hatch-vcs
 , hypothesis
 , immutables
 , motor
 , msgpack
 , orjson
-, poetry-core
 , pytest-xdist
 , pytestCheckHook
 , pythonOlder
@@ -21,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "cattrs";
-  version = "23.1.2";
+  version = "23.2.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -29,12 +30,13 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "python-attrs";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-YO4Clbo5fmXbysxwwM2qCHJwO5KwDC05VctRVFruJcw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-zWM5zmZr2EiJb/4Dc6KjDL89p0C1V0Dsz949byz5OVM=";
   };
 
   nativeBuildInputs = [
-    poetry-core
+    hatchling
+    hatch-vcs
   ];
 
   propagatedBuildInputs = [
@@ -62,9 +64,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "-l --benchmark-sort=fullname --benchmark-warmup=true --benchmark-warmup-iterations=5  --benchmark-group-by=fullname" "" \
-      --replace 'orjson = "^3.5.2"' "" \
-      --replace "[tool.poetry.group.dev.dependencies]" "[tool.poetry.dev-dependencies]"
+      --replace "-l --benchmark-sort=fullname --benchmark-warmup=true --benchmark-warmup-iterations=5  --benchmark-group-by=fullname" ""
     substituteInPlace tests/test_preconf.py \
       --replace "from orjson import dumps as orjson_dumps" "" \
       --replace "from orjson import loads as orjson_loads" ""
diff --git a/pkgs/development/python-modules/cbor2/default.nix b/pkgs/development/python-modules/cbor2/default.nix
index fe320063362c..5523d4f5e0a2 100644
--- a/pkgs/development/python-modules/cbor2/default.nix
+++ b/pkgs/development/python-modules/cbor2/default.nix
@@ -2,50 +2,59 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, setuptools
 , setuptools-scm
+
+# tests
+, hypothesis
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "cbor2";
-  version = "5.4.6";
-  format = "setuptools";
+  version = "5.5.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uJNQDbD+Az5XDDrclWr27vxX4oACa9LYb9U9qfHllNc=";
+    hash = "sha256-+eGS9GGp+PYILfKMA1sAbRU5BCE9yGQL7Ypy1yu8lHU=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov" ""
+  '';
+
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
+  pythonImportsCheck = [
+    "cbor2"
+  ];
+
   nativeCheckInputs = [
+    hypothesis
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov" ""
-  '';
-
   # https://github.com/agronholm/cbor2/issues/99
   disabledTests = lib.optionals stdenv.is32bit [
     "test_huge_truncated_bytes"
     "test_huge_truncated_string"
   ];
 
-  pythonImportsCheck = [
-    "cbor2"
-  ];
-
   meta = with lib; {
+    changelog = "https://github.com/agronholm/cbor2/releases/tag/${version}";
     description = "Python CBOR (de)serializer with extensive tag support";
     homepage = "https://github.com/agronholm/cbor2";
     license = licenses.mit;
-    maintainers = with maintainers; [ taneb ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index b9b703af622e..c6eaa72d2df1 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -3,13 +3,14 @@
 , cacert
 , pythonOlder
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2023.07.22";
-  format = "setuptools";
+  version = "2023.11.17";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -17,7 +18,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-certifi";
     rev = version;
-    hash = "sha256-V3bptJDNMGXlCMg6GHj792IrjfsG9+F/UpQKxeM0QOc=";
+    hash = "sha256-H3zsFJjWt2+tT7yqQOOZZwSL5y0AtfDz6Fqxwpm4Wl8=";
   };
 
   patches = [
@@ -31,6 +32,10 @@ buildPythonPackage rec {
     ln -snvf "${cacert}/etc/ssl/certs/ca-bundle.crt" "certifi/cacert.pem"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedNativeBuildInputs = [
     # propagate cacerts setup-hook to set up `NIX_SSL_CERT_FILE`
     cacert
diff --git a/pkgs/development/python-modules/cfn-lint/default.nix b/pkgs/development/python-modules/cfn-lint/default.nix
index f52bf2f667ae..98f8208335e9 100644
--- a/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/pkgs/development/python-modules/cfn-lint/default.nix
@@ -20,16 +20,16 @@
 
 buildPythonPackage rec {
   pname = "cfn-lint";
-  version = "0.79.11";
+  version = "0.83.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
-    repo = "cfn-python-lint";
+    repo = "cfn-lint";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dVLKMoZzP2q3bejEIslgpQgkPJOJUeEsXyyk8HRP6h0=";
+    hash = "sha256-0NHD8P+lKsrsEX/ypUS5dIwHOLudQcqkH8zG5RxANxE=";
   };
 
   propagatedBuildInputs = [
@@ -57,12 +57,6 @@ buildPythonPackage rec {
   '';
 
   disabledTests = [
-    # These tests depend on the current date, for example because of issues like this.
-    # This makes it possible for them to succeed on hydra and then begin to fail without
-    # any code changes.
-    # https://github.com/aws-cloudformation/cfn-python-lint/issues/1705
-    # See also: https://github.com/NixOS/nixpkgs/issues/108076
-    "TestQuickStartTemplates"
     # Requires git directory
     "test_update_docs"
     # Tests depend on network access (fails in getaddrinfo)
@@ -82,7 +76,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Checks cloudformation for practices and behaviour that could potentially be improved";
-    homepage = "https://github.com/aws-cloudformation/cfn-python-lint";
+    homepage = "https://github.com/aws-cloudformation/cfn-lint";
     changelog = "https://github.com/aws-cloudformation/cfn-lint/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/cftime/default.nix b/pkgs/development/python-modules/cftime/default.nix
index b827c48531aa..4291f805d2c0 100644
--- a/pkgs/development/python-modules/cftime/default.nix
+++ b/pkgs/development/python-modules/cftime/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , cython
 , fetchPypi
-, fetchpatch
 , numpy
 , pytestCheckHook
 , pythonOlder
@@ -10,29 +9,20 @@
 
 buildPythonPackage rec {
   pname = "cftime";
-  version = "1.6.2";
+  version = "1.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hhTAD7ilBG3jBP3Ybb0iT5lAgYXXskWsZijQJ2WW5tI=";
+    hash = "sha256-0Kayn3KhPwjgCLm+z/JHzHXISsshMzLt4Yh5xbaqTf0=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Fix test_num2date_precision by checking per platform precision
-      url = "https://github.com/Unidata/cftime/commit/221ff2195d588a43a7984597033b678f330fbc41.patch";
-      hash = "sha256-3XTJuET20g9QElM/8WGnNzJBFZ0oUN4ikhWKppwcyNM=";
-    })
-  ];
-
   postPatch = ''
     sed -i "/--cov/d" setup.cfg
   '';
 
-
   nativeBuildInputs = [
     cython
     numpy
diff --git a/pkgs/development/python-modules/charset-normalizer/default.nix b/pkgs/development/python-modules/charset-normalizer/default.nix
index c2856a49060f..2f6c3533dd77 100644
--- a/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "charset-normalizer";
-  version = "3.2.0";
+  version = "3.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Ousret";
     repo = "charset_normalizer";
     rev = "refs/tags/${version}";
-    hash = "sha256-CfL5rlrwJs9453z+1xPUzs1B3OyjFBaU6klzY7gJCzA=";
+    hash = "sha256-T9lnlS05Ogb2eLLHYWFnjBtRaB/OBqGWHQ/2WLunrNY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/chart-studio/default.nix b/pkgs/development/python-modules/chart-studio/default.nix
index 0c493e320ed5..fc563153a49c 100644
--- a/pkgs/development/python-modules/chart-studio/default.nix
+++ b/pkgs/development/python-modules/chart-studio/default.nix
@@ -1,28 +1,35 @@
-{ lib, buildPythonPackage, fetchFromGitHub
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
 , mock
 , nose
 , plotly
 , pytest
 , requests
 , retrying
+, setuptools
 , six
 }:
 
 buildPythonPackage rec {
   pname = "chart-studio";
-  version = "5.17.0";
-  format = "setuptools";
+  version = "5.18.0";
+  pyproject = true;
 
   # chart-studio was split from plotly
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "plotly.py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Vaa/MgauSoSpzNtRVXq3fQSVqMYzLTqDtIbiHBgrXQY=";
+    hash = "sha256-hY8R4UjcTI5RBaaRU/oR63taKEgYRI3+oOxNuDWzg20=";
   };
 
   sourceRoot = "${src.name}/packages/python/chart-studio";
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     plotly
     requests
diff --git a/pkgs/development/python-modules/cheroot/default.nix b/pkgs/development/python-modules/cheroot/default.nix
index 839894e1505b..89d4d69b9161 100644
--- a/pkgs/development/python-modules/cheroot/default.nix
+++ b/pkgs/development/python-modules/cheroot/default.nix
@@ -14,7 +14,6 @@
 , requests-toolbelt
 , requests-unixsocket
 , setuptools-scm
-, setuptools-scm-git-archive
 , six
 }:
 
@@ -30,9 +29,19 @@ buildPythonPackage rec {
     hash = "sha256-WcShh3/vmWmzw8CAyqrzd+J4CRlDeFP8DTKp30CzEfA=";
   };
 
+  # remove setuptools-scm-git-archive dependency
+  # https://github.com/cherrypy/cheroot/commit/f0c51af263e20f332c6f675aa90ec6705ae4f5d1
+  # there is a difference between the github source and the pypi tarball source,
+  # and it is not easy to apply patches.
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"setuptools_scm_git_archive>=1.1",' ""
+    substituteInPlace setup.cfg \
+      --replace "setuptools_scm_git_archive>=1.0" ""
+  '';
+
   nativeBuildInputs = [
     setuptools-scm
-    setuptools-scm-git-archive
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cirq-core/default.nix b/pkgs/development/python-modules/cirq-core/default.nix
index 31077bd109e4..0563c2f1a71c 100644
--- a/pkgs/development/python-modules/cirq-core/default.nix
+++ b/pkgs/development/python-modules/cirq-core/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "cirq-core";
-  version = "1.2.0";
+  version = "1.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "quantumlib";
     repo = "cirq";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KEei5PJ0ammsduZVmMh2vaW3f58DYI4BCrFCl/SjUoo=";
+    hash = "sha256-JAJJciFg3BuRha1wTKixtKWcYy3NA2mNpniPyPHTTe8=";
   };
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/python-modules/click-odoo-contrib/default.nix b/pkgs/development/python-modules/click-odoo-contrib/default.nix
index 275f6ccc77dc..a01a3e88b197 100644
--- a/pkgs/development/python-modules/click-odoo-contrib/default.nix
+++ b/pkgs/development/python-modules/click-odoo-contrib/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     manifestoo-core
   ] ++ lib.optionals (pythonOlder "3.9") [ importlib-resources ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   pythonImportsCheck = [ "click_odoo_contrib" ];
diff --git a/pkgs/development/python-modules/click-odoo/default.nix b/pkgs/development/python-modules/click-odoo/default.nix
index a618359735f1..2dd211d24a01 100644
--- a/pkgs/development/python-modules/click-odoo/default.nix
+++ b/pkgs/development/python-modules/click-odoo/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     click
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/click-repl/default.nix b/pkgs/development/python-modules/click-repl/default.nix
index f8a8fc1c49f8..aa375423769b 100644
--- a/pkgs/development/python-modules/click-repl/default.nix
+++ b/pkgs/development/python-modules/click-repl/default.nix
@@ -1,24 +1,39 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# dependencies
 , click
 , prompt-toolkit
 , six
+
+# tests
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "click-repl";
-  version = "0.2.0";
-  format = "setuptools";
+  version = "0.3.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "click-contrib";
     repo = "click-repl";
-    rev = version;
-    hash = "sha256-kaTUKaIomJL0u3NX40bL0I54vkR+Utcdw1QKSbnVy5s=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xCT3w0DDY73dtDL5jbssXM05Zlr44OOcy4vexgHyWiE=";
   };
 
+  postPatch = ''
+    sed -i '/--cov=/d' pyproject.toml
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     click
     prompt-toolkit
diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index 8569eede0bbb..eb32212cde23 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -35,6 +35,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # test fails with filename normalization on zfs
+    "test_file_surrogates"
+  ];
+
   passthru.tests = {
     inherit black flask magic-wormhole mitmproxy typer;
   };
diff --git a/pkgs/development/python-modules/clickgen/default.nix b/pkgs/development/python-modules/clickgen/default.nix
index 864414a0596b..7711d08e69f1 100644
--- a/pkgs/development/python-modules/clickgen/default.nix
+++ b/pkgs/development/python-modules/clickgen/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, attrs
 , pillow
 , toml
 , numpy
@@ -25,9 +26,17 @@ buildPythonPackage rec {
     hash = "sha256-mae/bO6aAMyYw42FYNlLMWm/ZC92LDgWVSSRKGR0tFM=";
   };
 
-  propagatedBuildInputs = [ pillow toml numpy pyyaml ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
+  propagatedBuildInputs = [
+    attrs
+    numpy
+    pillow
+    pyyaml
+    toml
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   postInstall = ''
     # Copying scripts directory needed by clickgen script at $out/bin/
diff --git a/pkgs/development/python-modules/clickhouse-cli/default.nix b/pkgs/development/python-modules/clickhouse-cli/default.nix
index 3c807716e03d..8abe4c1b3aa6 100644
--- a/pkgs/development/python-modules/clickhouse-cli/default.nix
+++ b/pkgs/development/python-modules/clickhouse-cli/default.nix
@@ -1,6 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonRelaxDepsHook
+, setuptools
 , click
 , prompt-toolkit
 , pygments
@@ -18,6 +20,15 @@ buildPythonPackage rec {
     hash = "sha256-gkgLAedUtzGv/4P+D56M2Pb5YecyqyVYp06ST62sjdY=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "sqlparse"
+  ];
+
   propagatedBuildInputs = [
     click
     prompt-toolkit
diff --git a/pkgs/development/python-modules/cliff/default.nix b/pkgs/development/python-modules/cliff/default.nix
index 9c6d88c9dab6..9715a41852b6 100644
--- a/pkgs/development/python-modules/cliff/default.nix
+++ b/pkgs/development/python-modules/cliff/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "cliff";
-  version = "4.3.0";
+  version = "4.4.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/FtuvI+4FTMncLJIXuNsCXU5N8N8zk8yJ83U4Qsz6sw=";
+    hash = "sha256-qo1ASqLWtNhjnGG9bcR6yzZW68P8Alsbe7B68rrveF8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cloudpickle/default.nix b/pkgs/development/python-modules/cloudpickle/default.nix
index 2acfe17327b6..fc8f92f3fa8d 100644
--- a/pkgs/development/python-modules/cloudpickle/default.nix
+++ b/pkgs/development/python-modules/cloudpickle/default.nix
@@ -1,23 +1,34 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
+, flit-core
+
+# tests
 , psutil
 , pytestCheckHook
-, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "cloudpickle";
-  version = "2.2.1";
-  format = "setuptools";
+  version = "3.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-2JaEuN6eNKKkOzRg+8oH0J1uJc6FjfTVpEJAQDthePU=";
+  src = fetchFromGitHub {
+    owner = "cloudpipe";
+    repo = "cloudpickle";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UeKVwzT0m4fhEVnG7TvQsFR99JsmwwoXmr+rWnTCeJU=";
   };
 
+  nativeBuildInputs = [
+    flit-core
+  ];
+
   nativeCheckInputs = [
     psutil
     pytestCheckHook
@@ -28,16 +39,12 @@ buildPythonPackage rec {
   ];
 
   disabledTestPaths = [
-    # ModuleNotFoundError: No module named '_cloudpickle_testpkg'
+    # ModuleNotFoundError: No module named 'psutil'
     "tests/cloudpickle_test.py"
   ];
 
-  disabledTests = [
-    # TypeError: cannot pickle 'EncodedFile' object
-    "test_pickling_special_file_handles"
-  ];
-
   meta = with lib; {
+    changelog = "https://github.com/cloudpipe/cloudpickle/blob/v${version}/CHANGES.md";
     description = "Extended pickling support for Python objects";
     homepage = "https://github.com/cloudpipe/cloudpickle";
     license = with licenses; [ bsd3 ];
diff --git a/pkgs/development/python-modules/coconut/default.nix b/pkgs/development/python-modules/coconut/default.nix
index 1c930529a31e..3a00891e60dd 100644
--- a/pkgs/development/python-modules/coconut/default.nix
+++ b/pkgs/development/python-modules/coconut/default.nix
@@ -8,25 +8,42 @@
 , pygments
 , pytestCheckHook
 , prompt-toolkit
+, setuptools
 , tkinter
 , watchdog
 }:
 
 buildPythonPackage rec {
   pname = "coconut";
-  version = "3.0.3";
-  format = "setuptools";
+  version = "3.0.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "evhub";
     repo = "coconut";
     rev = "refs/tags/v${version}";
-    hash = "sha256-u1tcIu0U1VZrUx2hVdtRDv1N4jVf176kQSw47/7lOXY=";
+    hash = "sha256-TIYep9EuCfcN8bp0vkaoB5W626lrD4PVh+oYKmVrfeY=";
   };
 
-  propagatedBuildInputs = [ cpyparsing ipykernel mypy pygments prompt-toolkit watchdog ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    cpyparsing
+    ipykernel
+    mypy
+    pygments
+    prompt-toolkit
+    setuptools
+    watchdog
+  ];
 
-  nativeCheckInputs = [ pexpect pytestCheckHook tkinter ];
+  nativeCheckInputs = [
+    pexpect
+    pytestCheckHook
+    tkinter
+  ];
 
   # Currently most tests have performance issues
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/coffea/default.nix b/pkgs/development/python-modules/coffea/default.nix
index ab10055187d0..0d4dc1450d9f 100644
--- a/pkgs/development/python-modules/coffea/default.nix
+++ b/pkgs/development/python-modules/coffea/default.nix
@@ -76,8 +76,6 @@ buildPythonPackage rec {
     cachetools
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     distributed
     pyinstrument
diff --git a/pkgs/development/python-modules/cohere/default.nix b/pkgs/development/python-modules/cohere/default.nix
index 36e7a2744685..133721ca4d74 100644
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "cohere";
-  version = "4.32";
+  version = "4.37";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OAd0e+mE8hHc6RHBM1vXE68qwrcPcpZ4OB5v9uRQ5oE=";
+    hash = "sha256-eIAh2dmSxsMdGYXZXMyyd8cmWILErNekmz5H2ne0vsg=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/colorlog/default.nix b/pkgs/development/python-modules/colorlog/default.nix
index 452908a62c69..8a7ff6494e4d 100644
--- a/pkgs/development/python-modules/colorlog/default.nix
+++ b/pkgs/development/python-modules/colorlog/default.nix
@@ -1,22 +1,31 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "colorlog";
-  version = "6.7.0";
-  format = "setuptools";
+  version = "6.8.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vZS9IcHhP6x70xU/S8On3A6wl0uLwv3xqYnkdPblguU=";
+    hash = "sha256-+7b9+dVoXyUX84j7Kbsn1U6GVN0x9YvCo7IX6WepXKY=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  pythonImportsCheck = [ "colorlog" ];
+  pythonImportsCheck = [
+    "colorlog"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "Log formatting with colors";
diff --git a/pkgs/development/python-modules/colout/default.nix b/pkgs/development/python-modules/colout/default.nix
index 0679270200d8..e01193cd36ec 100644
--- a/pkgs/development/python-modules/colout/default.nix
+++ b/pkgs/development/python-modules/colout/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-7Dtf87erBElqVgqRx8BYHYOWv1uI84JJ0LHrcneczCI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/comm/default.nix b/pkgs/development/python-modules/comm/default.nix
index 627c1630489d..e03eae5ffdbb 100644
--- a/pkgs/development/python-modules/comm/default.nix
+++ b/pkgs/development/python-modules/comm/default.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "comm";
-  version = "0.1.4";
+  version = "0.2.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -18,7 +18,7 @@ buildPythonPackage {
     owner = "ipython";
     repo = "comm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6GvAyiTm+zQ5sSynuJhAg50PaMTY9EFqVVsD3K2wTkY=";
+    hash = "sha256-bErZNTm0spO0A/Lc8kq5u7sB0FMXm/WMWtFbCNGJVXE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/confight/default.nix b/pkgs/development/python-modules/confight/default.nix
index 8ee09009fb97..5933ffc5d842 100644
--- a/pkgs/development/python-modules/confight/default.nix
+++ b/pkgs/development/python-modules/confight/default.nix
@@ -1,19 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , toml
 }:
 
 buildPythonPackage rec {
   pname = "confight";
   version = "2.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-iodoexnh9tG4dgkjDXCUzWRFDhRlJ3HRgaNhxG2lwPY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     toml
   ];
diff --git a/pkgs/development/python-modules/confluent-kafka/default.nix b/pkgs/development/python-modules/confluent-kafka/default.nix
index 33e3caf90cae..b610f1d40590 100644
--- a/pkgs/development/python-modules/confluent-kafka/default.nix
+++ b/pkgs/development/python-modules/confluent-kafka/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "confluent-kafka";
-  version = "2.2.0";
+  version = "2.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "confluentinc";
     repo = "confluent-kafka-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6CdalNFKkgF7JUqCGtt4nB1/H3u4SVqt9xCAg5DR3T0=";
+    hash = "sha256-sPlLlp0niR45lQPCvVd6NPtGI1cFbmPeQpIF1RnnY0I=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/connexion/default.nix b/pkgs/development/python-modules/connexion/default.nix
index d4eb668d73ed..40a166c14be4 100644
--- a/pkgs/development/python-modules/connexion/default.nix
+++ b/pkgs/development/python-modules/connexion/default.nix
@@ -1,30 +1,40 @@
 { lib
-, aiohttp
-, aiohttp-jinja2
-, aiohttp-remotes
-, aiohttp-swagger
-, buildPythonPackage
-, clickclick
-, decorator
 , fetchFromGitHub
-, flask
+, buildPythonPackage
+, pythonOlder
+
+# build-system
+, poetry-core
+
+# dependencies
+, asgiref
+, httpx
 , inflection
 , jsonschema
-, openapi-spec-validator
-, packaging
-, pytest-aiohttp
-, pytestCheckHook
-, pythonOlder
+, jinja2
+, python-multipart
 , pyyaml
 , requests
+, starlette
+, typing-extensions
+, werkzeug
+
+# optional-dependencies
+, a2wsgi
+, flask
 , swagger-ui-bundle
+, uvicorn
+
+# tests
+, pytest-aiohttp
+, pytestCheckHook
 , testfixtures
 }:
 
 buildPythonPackage rec {
   pname = "connexion";
-  version = "2.14.2";
-  format = "setuptools";
+  version = "3.0.5";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -32,31 +42,45 @@ buildPythonPackage rec {
     owner = "spec-first";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-1v1xCHY3ZnZG/Vu9wN/it7rLKC/StoDefoMNs+hMjIs=";
+    hash = "sha256-VaHdUxZ72JCm9zFMSEg3EW1uwfn+IIYy3yrtW9qC6rA=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
-    aiohttp
-    aiohttp-jinja2
-    aiohttp-swagger
-    clickclick
-    flask
+    asgiref
+    httpx
     inflection
     jsonschema
-    openapi-spec-validator
-    packaging
+    jinja2
+    python-multipart
     pyyaml
     requests
-    swagger-ui-bundle
+    starlette
+    typing-extensions
+    werkzeug
   ];
 
+  passthru.optional-dependencies = {
+    flask = [
+      a2wsgi
+      flask
+    ];
+    swagger-ui = [
+      swagger-ui-bundle
+    ];
+    uvicorn = [
+      uvicorn
+    ];
+  };
+
   nativeCheckInputs = [
-    aiohttp-remotes
-    decorator
     pytest-aiohttp
     pytestCheckHook
     testfixtures
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "connexion"
diff --git a/pkgs/development/python-modules/constantly/default.nix b/pkgs/development/python-modules/constantly/default.nix
index 4aad363632c2..bee00f7d4fa2 100644
--- a/pkgs/development/python-modules/constantly/default.nix
+++ b/pkgs/development/python-modules/constantly/default.nix
@@ -1,36 +1,60 @@
-{ lib, buildPythonPackage, fetchFromGitHub, twisted }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
+, setuptools
+, versioneer
+
+# tests
+, twisted
+}:
 
 let
   self = buildPythonPackage rec {
     pname = "constantly";
-    version = "15.1.0";
-    format = "setuptools";
+    version = "23.10.4";
+    pyproject = true;
+
+    disabled = pythonOlder "3.8";
 
     src = fetchFromGitHub {
       owner = "twisted";
       repo = "constantly";
-      rev = version;
-      hash = "sha256-0RPK5Vy0b6V4ubvm+vfNOAua7Qpa6j+G+QNExFuHgUU=";
+      rev = "refs/tags/${version}";
+      hash = "sha256-HTj6zbrCrxvh0PeSkeCSOCloTrVGUX6+o57snrKf6PA=";
     };
 
+    nativeBuildInputs = [
+      setuptools
+      versioneer
+    ] ++ versioneer.optional-dependencies.toml;
+
     # would create dependency loop with twisted
     doCheck = false;
 
-    nativeCheckInputs = [ twisted ];
+    nativeCheckInputs = [
+      twisted
+    ];
 
     checkPhase = ''
+      runHook preCheck
       trial constantly
+      runHook postCheck
     '';
 
-    pythonImportsCheck = [ "constantly" ];
+    pythonImportsCheck = [
+      "constantly"
+    ];
 
     passthru.tests.constantly = self.overridePythonAttrs { doCheck = true; };
 
     meta = with lib; {
+      description = "Module for symbolic constant support";
       homepage = "https://github.com/twisted/constantly";
-      description = "symbolic constant support";
       license = licenses.mit;
-      maintainers = [ ];
+      maintainers =  with maintainers; [ ];
     };
   };
 in
diff --git a/pkgs/development/python-modules/construct/default.nix b/pkgs/development/python-modules/construct/default.nix
index f6c5bb50b59d..917a6f4f95db 100644
--- a/pkgs/development/python-modules/construct/default.nix
+++ b/pkgs/development/python-modules/construct/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "construct";
-  version = "2.10.69";
+  version = "2.10.70";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "construct";
     repo = "construct";
     rev = "refs/tags/v${version}";
-    hash = "sha256-v1ieZytX9I2BR6UBD6TztCBT4KWtqfFZVKNtXIRNEB0=";
+    hash = "sha256-5otjjIyje0+z/Y/C2ivmu08PNm0oJcSSvZkQfGxHDuQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/container-inspector/default.nix b/pkgs/development/python-modules/container-inspector/default.nix
index 12375681c58f..4a3f6918b9e8 100644
--- a/pkgs/development/python-modules/container-inspector/default.nix
+++ b/pkgs/development/python-modules/container-inspector/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-J9glnfs6l36/IQoIvE8a+Cw4B8x/6r5UeAU8+T/OiQg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dontConfigure = true;
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/contourpy/default.nix b/pkgs/development/python-modules/contourpy/default.nix
index f5af82e55ff3..5e12a4531b33 100644
--- a/pkgs/development/python-modules/contourpy/default.nix
+++ b/pkgs/development/python-modules/contourpy/default.nix
@@ -25,7 +25,7 @@
 
 let countourpy = buildPythonPackage rec {
   pname = "contourpy";
-  version = "1.1.0";
+  version = "1.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -34,7 +34,7 @@ let countourpy = buildPythonPackage rec {
     owner = "contourpy";
     repo = "contourpy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7M+5HMDqQI4UgVfW/MXsVyz/yM6wjTcJEdw7vPvzuNY=";
+    hash = "sha256-5yZrIwwe9dL5vtdSJnOhY9X4BdK/cdEY4DkVVjCq1uw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cookiecutter/default.nix b/pkgs/development/python-modules/cookiecutter/default.nix
index 8d3374b9c910..35e14b394e2e 100644
--- a/pkgs/development/python-modules/cookiecutter/default.nix
+++ b/pkgs/development/python-modules/cookiecutter/default.nix
@@ -1,6 +1,7 @@
 { lib, buildPythonPackage, fetchPypi, isPyPy
+, setuptools
 , pytest, pytest-cov, pytest-mock, freezegun, safety, pre-commit
-, jinja2, future, binaryornot, click, jinja2-time, requests
+, jinja2, binaryornot, click, jinja2-time, requests
 , python-slugify
 , pyyaml
 , arrow
@@ -9,17 +10,21 @@
 
 buildPythonPackage rec {
   pname = "cookiecutter";
-  version = "2.3.0";
-  format = "setuptools";
+  version = "2.5.0";
+  pyproject = true;
 
   # not sure why this is broken
   disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lCp5SYF0f21/Q51uSdOdyRqaZBKDYUFgyTxHTHLCliE=";
+    hash = "sha256-5h6QNHSOP0G4vSwR8A0DB4S0hxHE1cQjY8UJiaZTMew=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytest
     pytest-cov
diff --git a/pkgs/development/python-modules/correctionlib/default.nix b/pkgs/development/python-modules/correctionlib/default.nix
index 7a79c3855478..15f48da9264f 100644
--- a/pkgs/development/python-modules/correctionlib/default.nix
+++ b/pkgs/development/python-modules/correctionlib/default.nix
@@ -47,8 +47,6 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     awkward
     pytestCheckHook
@@ -64,5 +62,6 @@ buildPythonPackage rec {
     homepage = "https://cms-nanoaod.github.io/correctionlib/";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ veprbl ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index cd761b45e101..eba9e13865d8 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -3,20 +3,26 @@
 , fetchPypi
 , mock
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "7.3.1";
-  format = "setuptools";
+  version = "7.3.2";
+  pyproject = true;
+
   # uses f strings
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bLf+FYHetnt4LBUxNlQeIJAaoxLO7a8UZ9yzUlV4eVI=";
+    hash = "sha256-vjKtKTQbAXDnlcpZDhwH6B/AYctbEMdM5yA0kUhEBO8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # No tests in archive
   doCheck = false;
   nativeCheckInputs = [ mock ];
diff --git a/pkgs/development/python-modules/cpyparsing/default.nix b/pkgs/development/python-modules/cpyparsing/default.nix
index 1ee4fe165878..cd34ebf1da1f 100644
--- a/pkgs/development/python-modules/cpyparsing/default.nix
+++ b/pkgs/development/python-modules/cpyparsing/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "cpyparsing";
-  version = "2.4.7.2.1.2";
+  version = "2.4.7.2.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "evhub";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Y3EyX9Gjssez0DkD6dIaOpazNLy7rDYzjKO1u+lLGFI=";
+    hash = "sha256-vnzZdJ7pZz1QxlTqw5UKjxB4GVcXuCfKWX4lu3ORWas=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/croniter/default.nix b/pkgs/development/python-modules/croniter/default.nix
index 12268dc72aee..6ac6f5db0509 100644
--- a/pkgs/development/python-modules/croniter/default.nix
+++ b/pkgs/development/python-modules/croniter/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pytestCheckHook
 , python-dateutil
 , pythonOlder
@@ -10,23 +11,27 @@
 
 buildPythonPackage rec {
   pname = "croniter";
-  version = "1.4.1";
-  format = "setuptools";
+  version = "2.0.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Gm32DqzsO3oKpSqPLvJRrj3Sp8fIuYdOc+eRY21Vo2E=";
+    hash = "sha256-0Zmy7D6l6CmI0fcgIkM8X5MCs7Pqnmv9ahUY9upecAo=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     python-dateutil
+    pytz
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    pytz
     tzlocal
   ];
 
diff --git a/pkgs/development/python-modules/curio/default.nix b/pkgs/development/python-modules/curio/default.nix
index 501cdd442ab9..0c006b281e2d 100644
--- a/pkgs/development/python-modules/curio/default.nix
+++ b/pkgs/development/python-modules/curio/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , isPy3k
 , pytestCheckHook
 , sphinx
@@ -18,6 +19,15 @@ buildPythonPackage rec {
     hash = "sha256-VipYbbICFrp9K+gmPeuesHnlYEj5uJBtEdX0WqgcUkc=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Add support for Python 3.12
+      # https://github.com/dabeaz/curio/pull/363
+      url = "https://github.com/dabeaz/curio/commit/a5590bb04de3f1f201fd1fd0ce9cfe5825db80ac.patch";
+      hash = "sha256-dwatxLOPAWLQSyNqJvkx6Cbl327tX9OpZXM5aaDX58I=";
+    })
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
     sphinx
diff --git a/pkgs/development/python-modules/curtsies/default.nix b/pkgs/development/python-modules/curtsies/default.nix
index 4a17769e18e8..2dd039f00ee2 100644
--- a/pkgs/development/python-modules/curtsies/default.nix
+++ b/pkgs/development/python-modules/curtsies/default.nix
@@ -8,6 +8,7 @@
 , pyte
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -22,6 +23,10 @@ buildPythonPackage rec {
     hash = "sha256-br4zIVvXyShRpQYEnHIMykz1wZLBZlwdepigTEcCdg4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     blessed
     cwcwidth
diff --git a/pkgs/development/python-modules/cvelib/default.nix b/pkgs/development/python-modules/cvelib/default.nix
index b44c51e4014c..0f9d292a5151 100644
--- a/pkgs/development/python-modules/cvelib/default.nix
+++ b/pkgs/development/python-modules/cvelib/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-hJPcxnc4iQzsYNNVJ9fw6yQl+5K7pdtjHT6oMmBx/Zs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
-
   propagatedBuildInputs = [
     click
     jsonschema
diff --git a/pkgs/development/python-modules/cwl-upgrader/default.nix b/pkgs/development/python-modules/cwl-upgrader/default.nix
index 97f2ff499c3e..cfd1cebd6620 100644
--- a/pkgs/development/python-modules/cwl-upgrader/default.nix
+++ b/pkgs/development/python-modules/cwl-upgrader/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-upgrader";
-  version = "1.2.9";
+  version = "1.2.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-yvgGMGo4QK+PRDzqlOH4rP49fnJUlbYB9B5AnlX+LF8=";
+    hash = "sha256-D/MIvn/jyxK++CMgKM8EYDVo94WFgdlTtMZjsXoQ4W4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/cwl-utils/default.nix b/pkgs/development/python-modules/cwl-utils/default.nix
index 77f81963eefc..aaa57e86ae00 100644
--- a/pkgs/development/python-modules/cwl-utils/default.nix
+++ b/pkgs/development/python-modules/cwl-utils/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-utils";
-  version = "0.29";
+  version = "0.32";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-XxfeBikJcRcUCIVDAmPTtcrrgvZYrRKpjs5bmMokeeI=";
+    hash = "sha256-CM2UlJ86FcjsOm0msBNpY2li8bhm5T/aMD1q292HpLM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cycler/default.nix b/pkgs/development/python-modules/cycler/default.nix
index 07be526f659b..18e9fa7ed598 100644
--- a/pkgs/development/python-modules/cycler/default.nix
+++ b/pkgs/development/python-modules/cycler/default.nix
@@ -1,34 +1,38 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, coverage
-, nose
-, six
-, python
+, fetchFromGitHub
+
+# build-system
+, setuptools
+
+# tests
+, pytest-xdist
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "cycler";
-  version = "0.11.0";
-  format = "setuptools";
+  version = "0.12.1";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "9c87405839a19696e837b3b818fed3f5f69f16f1eec1a1ad77e043dcea9c772f";
+  src = fetchFromGitHub {
+    owner = "matplotlib";
+    repo = "cycler";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5L0APSi/mJ85SuKCVz+c6Fn8zZNpRm6vCeBO0fpGKxg=";
   };
 
-  nativeCheckInputs = [ coverage nose ];
-  propagatedBuildInputs = [ six ];
-
-  checkPhase = ''
-    ${python.interpreter} run_tests.py
-  '';
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  # Tests were not included in release.
-  # https://github.com/matplotlib/cycler/issues/31
-  doCheck = false;
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
 
   meta = {
+    changelog = "https://github.com/matplotlib/cycler/releases/tag/v${version}";
     description = "Composable style cycles";
     homepage = "https://github.com/matplotlib/cycler";
     license = lib.licenses.bsd3;
diff --git a/pkgs/development/python-modules/cysignals/default.nix b/pkgs/development/python-modules/cysignals/default.nix
index dc6d412f2459..fe0ca2e17a09 100644
--- a/pkgs/development/python-modules/cysignals/default.nix
+++ b/pkgs/development/python-modules/cysignals/default.nix
@@ -2,7 +2,7 @@
 , autoreconfHook
 , fetchPypi
 , buildPythonPackage
-, cython
+, cython_3
 , pariSupport ? true, pari # for interfacing with the PARI/GP signal handler
 }:
 
@@ -10,12 +10,12 @@ assert pariSupport -> pari != null;
 
 buildPythonPackage rec {
   pname = "cysignals";
-  version = "1.11.2";
+  version = "1.11.4";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5858b1760fbe21848121b826b2463a67ac5a45caf3d73105497a68618c5a6fa6";
+    hash = "sha256-Dx4yHlWgf5AchqNqHkSX9v+d/nAGgdATCjjDbk6yOMM=";
   };
 
   # explicit check:
@@ -34,7 +34,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    cython
+    cython_3
   ] ++ lib.optionals pariSupport [
     # When cysignals is built with pari, including cysignals into the
     # buildInputs of another python package will cause cython to link against
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/cython/default.nix
index c2bb5811336d..72ba4a68f038 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/cython/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , fetchPypi
 , fetchpatch
+, setuptools
 , python
 , pkg-config
 , gdb
@@ -25,6 +26,7 @@ let
 in buildPythonPackage rec {
   pname = "cython";
   version = "0.29.36";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "Cython";
@@ -34,6 +36,7 @@ in buildPythonPackage rec {
 
   nativeBuildInputs = [
     pkg-config
+    setuptools
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/Cython/setup-hook.sh b/pkgs/development/python-modules/cython/setup-hook.sh
index c26330a53644..c26330a53644 100644
--- a/pkgs/development/python-modules/Cython/setup-hook.sh
+++ b/pkgs/development/python-modules/cython/setup-hook.sh
diff --git a/pkgs/development/python-modules/Cython/trashcan.patch b/pkgs/development/python-modules/cython/trashcan.patch
index 398422e76f39..398422e76f39 100644
--- a/pkgs/development/python-modules/Cython/trashcan.patch
+++ b/pkgs/development/python-modules/cython/trashcan.patch
diff --git a/pkgs/development/python-modules/daiquiri/default.nix b/pkgs/development/python-modules/daiquiri/default.nix
index 9c5a0abdbd1c..c7d6602de5fe 100644
--- a/pkgs/development/python-modules/daiquiri/default.nix
+++ b/pkgs/development/python-modules/daiquiri/default.nix
@@ -3,20 +3,22 @@
 , fetchPypi
 , pytestCheckHook
 , python-json-logger
+, setuptools
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "daiquiri";
-  version = "3.2.1";
-  format = "setuptools";
+  version = "3.2.3";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QIxNKOyPDqI+llN0R5gpvSI2TQwI15HL63u6JFlj4P0=";
+    hash = "sha256-P8rvN2/WgIi5I5E3R6t+4S2Lf7Kvf4xfIOWYCZfp6DU=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/dask-awkward/default.nix b/pkgs/development/python-modules/dask-awkward/default.nix
index e22c973499e7..8b7b772fa903 100644
--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-LxkiEQDHuVCRUoYgRwvMgBff22mzOvPmDoqczRweWB8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "awkward"
   ];
diff --git a/pkgs/development/python-modules/dask-histogram/default.nix b/pkgs/development/python-modules/dask-histogram/default.nix
index 5bdcb2458e45..c465baf23309 100644
--- a/pkgs/development/python-modules/dask-histogram/default.nix
+++ b/pkgs/development/python-modules/dask-histogram/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     dask
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/databricks-cli/default.nix b/pkgs/development/python-modules/databricks-cli/default.nix
index d088850fc58e..92d6adf55a11 100644
--- a/pkgs/development/python-modules/databricks-cli/default.nix
+++ b/pkgs/development/python-modules/databricks-cli/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "databricks-cli";
-  version = "0.17.7";
+  version = "0.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "databricks";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Eg6qpoEvWlbOJbMIkbJiHfHVrglVfVNq/TCOhQxukl0=";
+    hash = "sha256-dH95C2AY/B6F9BROr6rh+gVtKqxsg1gyEU5MzCd5aqs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/databricks-sql-connector/default.nix b/pkgs/development/python-modules/databricks-sql-connector/default.nix
index f47949a6198e..01b565df96e9 100644
--- a/pkgs/development/python-modules/databricks-sql-connector/default.nix
+++ b/pkgs/development/python-modules/databricks-sql-connector/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "databricks-sql-connector";
-  version = "2.9.3";
+  version = "3.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "databricks";
     repo = "databricks-sql-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-y4Pmkgq3hv6mVu0zBsoiqNOcsHM0mxTNiJOCCZ+rwA8=";
+    hash = "sha256-ymR/PL+LC7Bt+thtCJs5kfbJgKDgioUo+T79E7ZUQWY=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/datasets/default.nix b/pkgs/development/python-modules/datasets/default.nix
index 0802ae5cf6f6..0505ea7e13cc 100644
--- a/pkgs/development/python-modules/datasets/default.nix
+++ b/pkgs/development/python-modules/datasets/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "datasets";
-  version = "2.14.5";
+  version = "2.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -30,9 +30,15 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-oLB6laY/Si071mBKoWlZpd1fqr/wNtAnhRvBKLjeEuE=";
+    hash = "sha256-Q8cSgupfj6xKD0bYgL6bvYBwdYDdNaiWEWWUrRvwc4g=";
   };
 
+  # remove pyarrow<14.0.1 vulnerability fix
+  postPatch = ''
+    substituteInPlace src/datasets/features/features.py \
+      --replace "import pyarrow_hotfix" "#import pyarrow_hotfix"
+  '';
+
   propagatedBuildInputs = [
     aiohttp
     dill
diff --git a/pkgs/development/python-modules/dbt-bigquery/default.nix b/pkgs/development/python-modules/dbt-bigquery/default.nix
index 5b1e9aeeb946..9e276cf143f2 100644
--- a/pkgs/development/python-modules/dbt-bigquery/default.nix
+++ b/pkgs/development/python-modules/dbt-bigquery/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-bigquery";
-  version = "1.6.4";
+  version = "1.7.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-m458gg5TQ7jznhA9QNi8KQ+ICxdQn58mS0jvyZ88Fmg=";
+    hash = "sha256-CzRcnS/aECBq/9L8U+mLuHYo00HyBtKK6jmU8S03feM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
index eb6c269dd290..6dc4c6155adf 100644
--- a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
+++ b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
@@ -59,5 +59,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/dbt-labs/dbt-semantic-interfaces";
     license = licenses.asl20;
     maintainers = with maintainers; [ pbsds ];
+    # https://github.com/dbt-labs/dbt-semantic-interfaces/issues/134
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/dbt-snowflake/default.nix b/pkgs/development/python-modules/dbt-snowflake/default.nix
index dccf0ed7f989..028050eea7c1 100644
--- a/pkgs/development/python-modules/dbt-snowflake/default.nix
+++ b/pkgs/development/python-modules/dbt-snowflake/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-snowflake";
-  version = "1.6.2";
+  version = "1.7.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-AOO3VbU1R3/snH7U7K9XXokBGXtf9Udpv7eR5HCBxss=";
+    hash = "sha256-v+9uxHeROZU7vZvvB7UYUFNM6ez97qiZmgDiunUKf04=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dbus-deviation/default.nix b/pkgs/development/python-modules/dbus-deviation/default.nix
index 164c543a5ed7..739c9ba43aca 100644
--- a/pkgs/development/python-modules/dbus-deviation/default.nix
+++ b/pkgs/development/python-modules/dbus-deviation/default.nix
@@ -2,14 +2,14 @@
 , buildPythonPackage
 , fetchPypi
 , lxml
+, setuptools
 , setuptools-git
-, sphinx
 }:
 
 buildPythonPackage rec {
   pname = "dbus-deviation";
   version = "0.6.1";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    setuptools
     setuptools-git
-    sphinx
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dbus/default.nix b/pkgs/development/python-modules/dbus-python/default.nix
index f929f58de1c3..be7504e5dc37 100644
--- a/pkgs/development/python-modules/dbus/default.nix
+++ b/pkgs/development/python-modules/dbus-python/default.nix
@@ -1,11 +1,12 @@
 { lib, stdenv, fetchPypi, buildPythonPackage, python, pkg-config, dbus, dbus-glib, isPyPy
-, ncurses, pygobject3, isPy3k }:
+, ncurses, pygobject3, isPy3k, pythonAtLeast }:
 
 buildPythonPackage rec {
   pname = "dbus-python";
   version = "1.2.18";
 
-  disabled = isPyPy;
+  # ModuleNotFoundError: No module named 'distutils'
+  disabled = isPyPy || pythonAtLeast "3.12";
   format = "other";
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/python-modules/dbus/fix-includedir.patch b/pkgs/development/python-modules/dbus-python/fix-includedir.patch
index e3bb0682b5c4..e3bb0682b5c4 100644
--- a/pkgs/development/python-modules/dbus/fix-includedir.patch
+++ b/pkgs/development/python-modules/dbus-python/fix-includedir.patch
diff --git a/pkgs/development/python-modules/ddt/default.nix b/pkgs/development/python-modules/ddt/default.nix
index 6e1f2b154a53..f0def3a3ad38 100644
--- a/pkgs/development/python-modules/ddt/default.nix
+++ b/pkgs/development/python-modules/ddt/default.nix
@@ -1,34 +1,46 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, six, pyyaml, mock
+, pythonOlder
+
+# build-system
+, setuptools
+
+# tests
+, aiounittest
+, mock
 , pytestCheckHook
-, enum34
-, isPy3k
+, pyyaml
+, six
 }:
 
 buildPythonPackage rec {
   pname = "ddt";
-  version = "1.6.0";
-  format = "setuptools";
+  version = "1.7.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9xs0hzG4x4wxAL/72VGnafvUOQiNH9uzhB7uAZr4Cs0=";
+    hash = "sha256-0XjRFavyWhuDJ+lPhaA+8JsdewyiVvYgMoSwJPL8cN8=";
   };
 
-  propagatedBuildInputs = lib.optionals (!isPy3k) [
-    enum34
+  nativeBuildInputs = [
+    setuptools
   ];
 
-  nativeCheckInputs = [ six pyyaml mock pytestCheckHook ];
+  # aiounittest is not compatible with Python 3.12.
+  doCheck = pythonOlder "3.12";
 
-  preCheck = ''
-    # pytest can't import one file even with PYTHONPATH set
-    rm test/test_named_data.py
-  '';
+  nativeCheckInputs = [
+    aiounittest
+    mock
+    pytestCheckHook
+    pyyaml
+    six
+  ];
 
   meta = with lib; {
+    changelog = "https://github.com/datadriventests/ddt/releases/tag/${version}";
     description = "Data-Driven/Decorated Tests, a library to multiply test cases";
     homepage = "https://github.com/txels/ddt";
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/deal/default.nix b/pkgs/development/python-modules/deal/default.nix
index 13704b20939a..941efb131111 100644
--- a/pkgs/development/python-modules/deal/default.nix
+++ b/pkgs/development/python-modules/deal/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "deal";
-  version = "4.24.2";
+  version = "4.24.3";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "life4";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-bdIoKOOC7qSer9Cp9A55HG960xunKXT2WiXp0UC6tsI=";
+    hash = "sha256-QlM3d/jmg6v3L3D45+cgcCej71U1dl4uZ6sAYGGm3tU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/debian-inspector/default.nix b/pkgs/development/python-modules/debian-inspector/default.nix
index cc6a4fffc422..eb0b89ba9871 100644
--- a/pkgs/development/python-modules/debian-inspector/default.nix
+++ b/pkgs/development/python-modules/debian-inspector/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-RglPlTRksmm7CYVere7jySy2tIegv6JuulN7Usw9a0c=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dontConfigure = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/deepdiff/default.nix b/pkgs/development/python-modules/deepdiff/default.nix
index 93deb8c10b81..64cae1af74c1 100644
--- a/pkgs/development/python-modules/deepdiff/default.nix
+++ b/pkgs/development/python-modules/deepdiff/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "deepdiff";
-  version = "6.4.1";
+  version = "6.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "seperman";
     repo = "deepdiff";
     rev = "refs/tags/${version}";
-    hash = "sha256-oO5+ZCDgqonxaHR95tSrPkZDar/fzr1FXtl6J2W3PeU=";
+    hash = "sha256-YGYprSC5j06Ozg0dUJN5xnba0HUgiXa+d9Ci3czGWoY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/deepmerge/default.nix b/pkgs/development/python-modules/deepmerge/default.nix
index 2ef1e6aa5182..0a22573e2dfa 100644
--- a/pkgs/development/python-modules/deepmerge/default.nix
+++ b/pkgs/development/python-modules/deepmerge/default.nix
@@ -1,24 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy27
+
+# build-system
+, setuptools
 , setuptools-scm
-, vcver
+
+# tests
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "deepmerge";
-  version = "1.1.0";
-  disabled = isPy27;
-  format = "pyproject";
+  version = "1.1.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TCeg213iheGnzqx9vBUx3qpVa2J96kkAyCRFgezf6i0=";
+    hash = "sha256-U6SJ3JRJY25ICnhDWa4qqzGRdIySBklVHI43hiLw7KQ=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
@@ -26,10 +29,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "deepmerge" ];
+  pythonImportsCheck = [
+    "deepmerge"
+  ];
 
   meta = with lib; {
+    changelog = "https://github.com/toumorokoshi/deepmerge/releases/tag/v${version}";
     description = "A toolset to deeply merge python dictionaries.";
+    downloadPage = "https://github.com/toumorokoshi/deepmerge";
     homepage = "http://deepmerge.readthedocs.io/en/latest/";
     license = licenses.mit;
     maintainers = with maintainers; [ hexa ];
diff --git a/pkgs/development/python-modules/deltachat/default.nix b/pkgs/development/python-modules/deltachat/default.nix
index 034be82d7e39..8d3f0cf20e11 100644
--- a/pkgs/development/python-modules/deltachat/default.nix
+++ b/pkgs/development/python-modules/deltachat/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     libdeltachat
   ];
diff --git a/pkgs/development/python-modules/demetriek/default.nix b/pkgs/development/python-modules/demetriek/default.nix
index b553a1b0837a..42205ac652f9 100644
--- a/pkgs/development/python-modules/demetriek/default.nix
+++ b/pkgs/development/python-modules/demetriek/default.nix
@@ -5,6 +5,7 @@
 , buildPythonPackage
 , pydantic
 , fetchFromGitHub
+, fetchpatch
 , poetry-core
 , yarl
 , aresponses
@@ -27,6 +28,16 @@ buildPythonPackage rec {
     hash = "sha256-LCHHBcZgO9gw5jyaJiiS4lKyb0ut+PJvKTylIvIKHhc=";
   };
 
+  patches = [
+    # https://github.com/frenck/python-demetriek/pull/531
+    (fetchpatch {
+      name = "pydantic_2-compatibility.patch";
+      url = "https://github.com/frenck/python-demetriek/commit/e677fe5b735b6b28572e3e5fd6aab56fc056f5e6.patch";
+      excludes = [ "pyproject.toml" "poetry.lock" ];
+      hash = "sha256-oMVR45KHDhcPId/0X9obJXCPE8s1gk5IgsGsgZesdZw=";
+    })
+  ];
+
   postPatch = ''
     # Upstream doesn't set a version for the pyproject.toml
     substituteInPlace pyproject.toml \
@@ -56,6 +67,8 @@ buildPythonPackage rec {
     "demetriek"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Python client for LaMetric TIME devices";
     homepage = "https://github.com/frenck/python-demetriek";
diff --git a/pkgs/development/python-modules/dependency-injector/default.nix b/pkgs/development/python-modules/dependency-injector/default.nix
index ff00a9fd200a..0b575412e854 100644
--- a/pkgs/development/python-modules/dependency-injector/default.nix
+++ b/pkgs/development/python-modules/dependency-injector/default.nix
@@ -78,5 +78,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/ets-labs/python-dependency-injector/blob/${version}/docs/main/changelog.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ gerschtli ];
+    # https://github.com/ets-labs/python-dependency-injector/issues/726
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/devolo-home-control-api/default.nix b/pkgs/development/python-modules/devolo-home-control-api/default.nix
index e614f206f328..8d06b409d578 100644
--- a/pkgs/development/python-modules/devolo-home-control-api/default.nix
+++ b/pkgs/development/python-modules/devolo-home-control-api/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-4AyC1DDYtKl8SwJf75BbzoOAhbZXmBZ05ma9YmLzksM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/devolo-plc-api/default.nix b/pkgs/development/python-modules/devolo-plc-api/default.nix
index 5fac8fd6aa0f..ad34b49280f6 100644
--- a/pkgs/development/python-modules/devolo-plc-api/default.nix
+++ b/pkgs/development/python-modules/devolo-plc-api/default.nix
@@ -33,8 +33,6 @@ buildPythonPackage rec {
       --replace "protobuf>=4.22.0" "protobuf"
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dictdiffer/default.nix b/pkgs/development/python-modules/dictdiffer/default.nix
index 2bb16eb097b9..acbc3996fbc6 100644
--- a/pkgs/development/python-modules/dictdiffer/default.nix
+++ b/pkgs/development/python-modules/dictdiffer/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-lQyPs3lQWtsvNPuvvwJUTDzrFaOX5uwGuRHe3yWUheU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/diff-cover/default.nix b/pkgs/development/python-modules/diff-cover/default.nix
index bab6cd3f6c7b..7a7c28fbe4bc 100644
--- a/pkgs/development/python-modules/diff-cover/default.nix
+++ b/pkgs/development/python-modules/diff-cover/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "diff-cover";
-  version = "7.7.0";
+  version = "8.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "diff_cover";
     inherit version;
-    hash = "sha256-YGFM9+ciz3+xveSXr6wLUUKU4eJlNESWItrE2ilhI/s=";
+    hash = "sha256-zDnRmety/kG83P7hZOtbWRUztMYlWA4/mprMaGkGTXw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dirty-equals/default.nix b/pkgs/development/python-modules/dirty-equals/default.nix
index 9f40226e6bb3..8ef625976167 100644
--- a/pkgs/development/python-modules/dirty-equals/default.nix
+++ b/pkgs/development/python-modules/dirty-equals/default.nix
@@ -12,7 +12,7 @@
 let
   dirty-equals = buildPythonPackage rec {
     pname = "dirty-equals";
-    version = "0.7.0";
+    version = "0.7.1-post0";
     format = "pyproject";
 
     disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ let
       owner = "samuelcolvin";
       repo = pname;
       rev = "refs/tags/v${version}";
-      hash = "sha256-ShbkPGj1whOQ11bFLUSTfvVEVlvc3JUzRDICbBohgMM=";
+      hash = "sha256-U6DNluthDgxzh6IOaKrN/JhX4u+ztY/jVp9IKh0iP34=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/diskcache/default.nix b/pkgs/development/python-modules/diskcache/default.nix
index 6f275a01fa70..328777370782 100644
--- a/pkgs/development/python-modules/diskcache/default.nix
+++ b/pkgs/development/python-modules/diskcache/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "diskcache";
-  version = "5.4.0";
+  version = "5.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "grantjenks";
     repo = "python-diskcache";
     rev = "v${version}";
-    hash = "sha256-c/k8mx/T4RkseDobJ2gtcuom0A6Ewyw4aP2Bk9pxV+o=";
+    hash = "sha256-1cDpdf+rLaG14TDd1wEHAiYXb69NFTFeOHD1Ib1oOVY=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/dissect-cim/default.nix b/pkgs/development/python-modules/dissect-cim/default.nix
index 37de761ca567..acac46050a27 100644
--- a/pkgs/development/python-modules/dissect-cim/default.nix
+++ b/pkgs/development/python-modules/dissect-cim/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-+HHjDUSepAEebMD5ckjXbfgA4AKlNMBYHwxDq+jdhxw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-clfs/default.nix b/pkgs/development/python-modules/dissect-clfs/default.nix
index 8dc3c9e20c12..0f44c587c746 100644
--- a/pkgs/development/python-modules/dissect-clfs/default.nix
+++ b/pkgs/development/python-modules/dissect-clfs/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-JdfO9KVuK1TsDyqEQkuHPJtSHDCym63imvLSHsVwQ3k=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-cobaltstrike/default.nix b/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
index c232bdb0bf4a..7b25a817aa64 100644
--- a/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
+++ b/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     hash = "sha256-CS50c3r7sdxp3CRS6XJ4QUmUFtmhFg6rSdKfYzJSOV4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-cstruct/default.nix b/pkgs/development/python-modules/dissect-cstruct/default.nix
index a40b806ab01d..cecc7dffef3f 100644
--- a/pkgs/development/python-modules/dissect-cstruct/default.nix
+++ b/pkgs/development/python-modules/dissect-cstruct/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-cdBojvFI0cN6mEZ98xLa3XldvIoR+Jv1c0/hvVkKVoQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-esedb/default.nix b/pkgs/development/python-modules/dissect-esedb/default.nix
index 76e9eae46fa4..1253b9ebb9c8 100644
--- a/pkgs/development/python-modules/dissect-esedb/default.nix
+++ b/pkgs/development/python-modules/dissect-esedb/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-RlXnUD+KiBmntM/f7jEzdZ0Tdb8vPGvW0e3XoANaPnk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-etl/default.nix b/pkgs/development/python-modules/dissect-etl/default.nix
index de6a49ba9e26..1e110a915f9a 100644
--- a/pkgs/development/python-modules/dissect-etl/default.nix
+++ b/pkgs/development/python-modules/dissect-etl/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-z6P7XpA+j9JIJJsp/Z4uewFw9OAPSZV+57eJu7rd17I=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-eventlog/default.nix b/pkgs/development/python-modules/dissect-eventlog/default.nix
index 9c11a3ee8778..60f9d52cac74 100644
--- a/pkgs/development/python-modules/dissect-eventlog/default.nix
+++ b/pkgs/development/python-modules/dissect-eventlog/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-h1LrBt8f9YFkc1uAAb4WwY3LjPuvsdVFvxji3QxKF0A=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-evidence/default.nix b/pkgs/development/python-modules/dissect-evidence/default.nix
index b1d8bb2b1b84..e60f81e41962 100644
--- a/pkgs/development/python-modules/dissect-evidence/default.nix
+++ b/pkgs/development/python-modules/dissect-evidence/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-b7Ls3Xfd0scMe/gccjvRfuADITnz5QpJNLUaIgmZtpI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-executable/default.nix b/pkgs/development/python-modules/dissect-executable/default.nix
index d8f3e6cb08c2..7b3757d0f3ad 100644
--- a/pkgs/development/python-modules/dissect-executable/default.nix
+++ b/pkgs/development/python-modules/dissect-executable/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-h9eOTWJR0Bd3DY8WDYWqLCl1jYJcqP6cRTgWubf/rKI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-extfs/default.nix b/pkgs/development/python-modules/dissect-extfs/default.nix
index 1523749bf8bb..86206ee27ac1 100644
--- a/pkgs/development/python-modules/dissect-extfs/default.nix
+++ b/pkgs/development/python-modules/dissect-extfs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-RsAWqtoarn/2sZU5dkQYt794dXGOr5fe68VgMNDBst4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-fat/default.nix b/pkgs/development/python-modules/dissect-fat/default.nix
index 0a22c7b8b7ba..be5043fd27de 100644
--- a/pkgs/development/python-modules/dissect-fat/default.nix
+++ b/pkgs/development/python-modules/dissect-fat/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-YfWshytfj4p2MqLpzE3b1/RtrL1/+Xd/5+RNbrH/Jfc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-ffs/default.nix b/pkgs/development/python-modules/dissect-ffs/default.nix
index 8e5dbaac0445..3d1afcf31ccb 100644
--- a/pkgs/development/python-modules/dissect-ffs/default.nix
+++ b/pkgs/development/python-modules/dissect-ffs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-eyqqsOKcRmzOY+fj1FYudh9FUanD0Z59zZPtsNz6I0s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-hypervisor/default.nix b/pkgs/development/python-modules/dissect-hypervisor/default.nix
index e7f17cb0286c..975526db7158 100644
--- a/pkgs/development/python-modules/dissect-hypervisor/default.nix
+++ b/pkgs/development/python-modules/dissect-hypervisor/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-Ml5U7yc4iqqilL6Y9qF3VU+pa0AXnYVQjVas90TpG30=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-ntfs/default.nix b/pkgs/development/python-modules/dissect-ntfs/default.nix
index 96b3cb3a6745..4d69844c9884 100644
--- a/pkgs/development/python-modules/dissect-ntfs/default.nix
+++ b/pkgs/development/python-modules/dissect-ntfs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-bnFimn5ektIKiX73NZ+1Iz3Uoew138a0nFJgypffC4o=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-ole/default.nix b/pkgs/development/python-modules/dissect-ole/default.nix
index d76e11cb3f53..3d47252b829f 100644
--- a/pkgs/development/python-modules/dissect-ole/default.nix
+++ b/pkgs/development/python-modules/dissect-ole/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-4shxYKR6IrrMj2BIb5yFD7+C0SNyqsGOoBkWpad1EbI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-regf/default.nix b/pkgs/development/python-modules/dissect-regf/default.nix
index 94881ca3ca42..a2050fe6bd3c 100644
--- a/pkgs/development/python-modules/dissect-regf/default.nix
+++ b/pkgs/development/python-modules/dissect-regf/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-4tKu7oPkpNcWr2XJvZg94yZZcbTeeXBphPCLoZYzg6U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-shellitem/default.nix b/pkgs/development/python-modules/dissect-shellitem/default.nix
index ad2fb1ed7a75..77e1e6344fe2 100644
--- a/pkgs/development/python-modules/dissect-shellitem/default.nix
+++ b/pkgs/development/python-modules/dissect-shellitem/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-g8o6W5MZ7E8AKYs5QGQGw3IQhZehrOcY6wJrt9TJf4s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-sql/default.nix b/pkgs/development/python-modules/dissect-sql/default.nix
index 173170396f72..208096a56e52 100644
--- a/pkgs/development/python-modules/dissect-sql/default.nix
+++ b/pkgs/development/python-modules/dissect-sql/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-BHwm88IPtfg/bi5veFGnciQeH4s0asVnxiMVsIi8vV8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-squashfs/default.nix b/pkgs/development/python-modules/dissect-squashfs/default.nix
index cc1f4999d858..d42058f952cc 100644
--- a/pkgs/development/python-modules/dissect-squashfs/default.nix
+++ b/pkgs/development/python-modules/dissect-squashfs/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-MJKC05/8NnJFdyBB5YPbqe8mp1zlIoS2FglKEPSSYd8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-target/default.nix b/pkgs/development/python-modules/dissect-target/default.nix
index 3aa4c39b9f52..62f4a745156c 100644
--- a/pkgs/development/python-modules/dissect-target/default.nix
+++ b/pkgs/development/python-modules/dissect-target/default.nix
@@ -51,8 +51,6 @@ buildPythonPackage rec {
     hash = "sha256-vp1upVwohMXFKxlHy5lWmigdq9MUk1UknSsPpCXt50s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-thumbcache/default.nix b/pkgs/development/python-modules/dissect-thumbcache/default.nix
index e63e7bb4ac91..1e6d36a0cdc6 100644
--- a/pkgs/development/python-modules/dissect-thumbcache/default.nix
+++ b/pkgs/development/python-modules/dissect-thumbcache/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-q35VL3BUZrxNBB5mHegqVObG76BYG4FAk/KIAvdm6B8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-util/default.nix b/pkgs/development/python-modules/dissect-util/default.nix
index 94c193b5b191..495294db9c3f 100644
--- a/pkgs/development/python-modules/dissect-util/default.nix
+++ b/pkgs/development/python-modules/dissect-util/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-GUDYr3lP0BV7zJaaUen78CplRA7jfn1zYes7kczNGEU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-vmfs/default.nix b/pkgs/development/python-modules/dissect-vmfs/default.nix
index d3efbcdf6420..740b9f668f0c 100644
--- a/pkgs/development/python-modules/dissect-vmfs/default.nix
+++ b/pkgs/development/python-modules/dissect-vmfs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-FDxB87TeAMUp0hP9YS/nrqNx71+ZlHf3Bsaqvuwx36U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-volume/default.nix b/pkgs/development/python-modules/dissect-volume/default.nix
index 1ef6ffb44998..1a2ce1e27355 100644
--- a/pkgs/development/python-modules/dissect-volume/default.nix
+++ b/pkgs/development/python-modules/dissect-volume/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-5ZO++l6BWA085U5IkghjCT46YhKc85SB7sNU2h4Fpec=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect-xfs/default.nix b/pkgs/development/python-modules/dissect-xfs/default.nix
index d4f36cbc04d5..1f46b745edc3 100644
--- a/pkgs/development/python-modules/dissect-xfs/default.nix
+++ b/pkgs/development/python-modules/dissect-xfs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-unrkmhLvjWWKHiqJWCEVEVcUjxWXMznjOytRbDwAxKw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/dissect/default.nix b/pkgs/development/python-modules/dissect/default.nix
index 54787ec22182..2d15c4f5a720 100644
--- a/pkgs/development/python-modules/dissect/default.nix
+++ b/pkgs/development/python-modules/dissect/default.nix
@@ -44,8 +44,6 @@ buildPythonPackage rec {
     hash = "sha256-6y+p+Ulc1Viu5s1AL/ecVtO4YRnmem/ZleY8xC4CJrU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index 074a450a39e4..c5be90d0af98 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -10,6 +10,7 @@
 , packaging
 , psutil
 , pythonOlder
+, pythonRelaxDepsHook
 , pyyaml
 , setuptools
 , setuptools-scm
@@ -43,11 +44,16 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     versioneer
   ] ++ versioneer.optional-dependencies.toml;
 
+  pythonRelaxDeps = [
+    "dask"
+  ];
+
   propagatedBuildInputs = [
     click
     cloudpickle
diff --git a/pkgs/development/python-modules/dj-rest-auth/default.nix b/pkgs/development/python-modules/dj-rest-auth/default.nix
index 5e1e1a57928d..bbbb2aeabd03 100644
--- a/pkgs/development/python-modules/dj-rest-auth/default.nix
+++ b/pkgs/development/python-modules/dj-rest-auth/default.nix
@@ -9,18 +9,19 @@
 , responses
 , unittest-xml-reporting
 , python
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "dj-rest-auth";
-  version = "5.0.1";
-  format = "setuptools";
+  version = "5.0.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iMerica";
     repo = "dj-rest-auth";
     rev = "refs/tags/${version}";
-    hash = "sha256-PTFUZ54vKlufKCQyJb+QB/+hI15r+Z0auTjnc38yMLg=";
+    hash = "sha256-TqeNpxXn+v89fEiJ4AVNhp8blCfYQKFQfYmZ6/QlRbQ=";
   };
 
   patches = [
@@ -37,6 +38,10 @@ buildPythonPackage rec {
       --replace "==" ">="
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   buildInputs = [
     django
   ];
diff --git a/pkgs/development/python-modules/django-anymail/default.nix b/pkgs/development/python-modules/django-anymail/default.nix
index 572df3948186..799881ebee35 100644
--- a/pkgs/development/python-modules/django-anymail/default.nix
+++ b/pkgs/development/python-modules/django-anymail/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, six
 , requests
 , django
 , boto3
@@ -13,15 +12,14 @@
 
 buildPythonPackage rec {
   pname = "django-anymail";
-  version = "10.1";
-
+  version = "10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anymail";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-unmbYQFLeqfqE1uFLMPLUad1UqA+sgbTzwRfpRhM3ik=";
+    hash = "sha256-k4C82OYm2SdjxeLScrkkitumjYgWkMNFlNeGW+C1Z8o=";
   };
 
   nativeBuildInputs = [
@@ -44,7 +42,7 @@ buildPythonPackage rec {
 
   checkPhase = ''
     runHook preCheck
-    CONTINUOUS_INTEGRATION=1 python runtests.py
+    CONTINUOUS_INTEGRATION=1 ${python.interpreter} runtests.py
     runHook postCheck
   '';
 
diff --git a/pkgs/development/python-modules/django-auditlog/default.nix b/pkgs/development/python-modules/django-auditlog/default.nix
index fa52f1b3d59c..4a176b0b14ec 100644
--- a/pkgs/development/python-modules/django-auditlog/default.nix
+++ b/pkgs/development/python-modules/django-auditlog/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-QHSGqtpkOgltAg+RlG/Ik3DfEjtSWt45sqlD+Zw4Bh0=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/django-bootstrap3/default.nix b/pkgs/development/python-modules/django-bootstrap3/default.nix
index ccb1ffd3c1a7..6a29fc7630aa 100644
--- a/pkgs/development/python-modules/django-bootstrap3/default.nix
+++ b/pkgs/development/python-modules/django-bootstrap3/default.nix
@@ -3,7 +3,8 @@
 , fetchFromGitHub
 
 # build-system
-, hatchling
+, setuptools
+, setuptools-scm
 
 # non-propagates
 , django
@@ -15,22 +16,19 @@
 
 buildPythonPackage rec {
   pname = "django-bootstrap3";
-  version = "23.4";
+  version = "23.6";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "zostera";
     repo = "django-bootstrap3";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1/JQ17GjBHH0JbY4EnHOS2B3KhEJdG2yL6O2nc1HNNc=";
+    hash = "sha256-qqG9w0bQYoQgWXCks/WwwQVoh2DhIMLaFXDQ4z6D84g=";
   };
 
-  postPatch = ''
-    sed -i '/beautifulsoup4/d' pyproject.toml
-  '';
-
   nativeBuildInputs = [
-    hatchling
+    setuptools
+    setuptools-scm
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/django-bootstrap4/default.nix b/pkgs/development/python-modules/django-bootstrap4/default.nix
index 568ce0df3048..66cff8029757 100644
--- a/pkgs/development/python-modules/django-bootstrap4/default.nix
+++ b/pkgs/development/python-modules/django-bootstrap4/default.nix
@@ -3,7 +3,8 @@
 , fetchFromGitHub
 
 # build-system
-, hatchling
+, setuptools
+, setuptools-scm
 
 # non-propagates
 , django
@@ -17,18 +18,19 @@
 
 buildPythonPackage rec {
   pname = "django-bootstrap4";
-  version = "23.2";
+  version = "23.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "zostera";
     repo = "django-bootstrap4";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RYGwi+hRfTqPAikrv33w27v1/WLwRvXexSusJKdr2o8=";
+    hash = "sha256-ccZ/73u4c6E6pfRv+f3Pu8SorF/d7zQBexGAlFcIwTo=";
   };
 
   nativeBuildInputs = [
-    hatchling
+    setuptools
+    setuptools-scm
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-ckeditor/default.nix b/pkgs/development/python-modules/django-ckeditor/default.nix
index b0df11aefd0c..530efc2a5614 100644
--- a/pkgs/development/python-modules/django-ckeditor/default.nix
+++ b/pkgs/development/python-modules/django-ckeditor/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-mZQ5s3YbumYmT0zRWPFIvzt2TbtDLvVcJjZVAwn31E8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-hijack/default.nix b/pkgs/development/python-modules/django-hijack/default.nix
index 60e04b184e9f..a5c85a485695 100644
--- a/pkgs/development/python-modules/django-hijack/default.nix
+++ b/pkgs/development/python-modules/django-hijack/default.nix
@@ -43,8 +43,6 @@ buildPythonPackage rec {
     hash = "sha256-X3bJ6STFq6zGIzXHSd2C67d4kSOVJJR5aBSM3o5T850=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     gettext
     nodejs
diff --git a/pkgs/development/python-modules/django-js-asset/default.nix b/pkgs/development/python-modules/django-js-asset/default.nix
index f579a31dc3e7..54c4c4b90eb4 100644
--- a/pkgs/development/python-modules/django-js-asset/default.nix
+++ b/pkgs/development/python-modules/django-js-asset/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "django-js-asset";
-  version = "2.1";
+  version = "2.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "matthiask";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-rxJ9TgVBiJByiFSLTg/dtAR31Fs14D4sh2axyBcKGTU=";
+    hash = "sha256-qAkE5ubzfTNO1LuMQXMW2Sot1cn/bhuXlWa/J/wD5SI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-login-required-middleware/default.nix b/pkgs/development/python-modules/django-login-required-middleware/default.nix
index 6c69ef7ef27a..b288e7929059 100644
--- a/pkgs/development/python-modules/django-login-required-middleware/default.nix
+++ b/pkgs/development/python-modules/django-login-required-middleware/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-WFQ/JvKh6gkUxPV27QBd2TzwFS8hfQGmcTInTnmh6iA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-mailman3/default.nix b/pkgs/development/python-modules/django-mailman3/default.nix
index f5942b9b9bf4..74a2dd61f7cd 100644
--- a/pkgs/development/python-modules/django-mailman3/default.nix
+++ b/pkgs/development/python-modules/django-mailman3/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "django-mailman3";
-  version = "1.3.9";
+  version = "1.3.11";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GpI1W0O9aJpLF/mcS23ktJDZsP69S2zQy7drOiWBnTM=";
+    hash = "sha256-uIjJaZHWL2evj+oISLprvKWT5Sm5f2EKgUD1twL1VbQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/django-maintenance-mode/default.nix b/pkgs/development/python-modules/django-maintenance-mode/default.nix
index 8dd2ad71b242..e6940c53b430 100644
--- a/pkgs/development/python-modules/django-maintenance-mode/default.nix
+++ b/pkgs/development/python-modules/django-maintenance-mode/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "django-maintenance-mode";
-  version = "0.18.0";
+  version = "0.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Mcj8O20hCINGf5T3PCG9jq0onSrm4R+Ke5CLMqMDmuU=";
+    hash = "sha256-NAm3xMcHePTYxysihYj48bk7r9ykEtPcxPjSEju/zMM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/django-model-utils/default.nix b/pkgs/development/python-modules/django-model-utils/default.nix
index 648634b0f32c..6c82422cf0e0 100644
--- a/pkgs/development/python-modules/django-model-utils/default.nix
+++ b/pkgs/development/python-modules/django-model-utils/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-p3/JO6wNwZPYX7MIgMj/0caHt5s+uL51Sxa28/VITxo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-ninja/default.nix b/pkgs/development/python-modules/django-ninja/default.nix
index 620960797ea0..2aa349e71bc7 100644
--- a/pkgs/development/python-modules/django-ninja/default.nix
+++ b/pkgs/development/python-modules/django-ninja/default.nix
@@ -13,15 +13,16 @@
 
 buildPythonPackage rec {
   pname = "django-ninja";
-  version = "0.22.2";
-  format = "pyproject";
+  version = "1.0.1";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "vitalik";
     repo = "django-ninja";
     rev = "v${version}";
-    hash = "sha256-oeisurp9seSn3X/5jFF9DMm9nU6uDYIU1b6/J3o2be0=";
+    hash = "sha256-hF6Z8i8M4mQtVPIupTSEIkJh0i/oMFFuE9PpODxq4fw=";
   };
 
   propagatedBuildInputs = [ django pydantic ];
@@ -38,7 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     changelog = "https://github.com/vitalik/django-ninja/releases/tag/v${version}";
     description = "Web framework for building APIs with Django and Python type hints";
-    homepage = "https://django-ninja.rest-framework.com/";
+    homepage = "https://django-ninja.dev";
     license = licenses.mit;
     maintainers = with maintainers; [ elohmeier ];
   };
diff --git a/pkgs/development/python-modules/django-pattern-library/default.nix b/pkgs/development/python-modules/django-pattern-library/default.nix
index 76d376d11c09..89f998c058b9 100644
--- a/pkgs/development/python-modules/django-pattern-library/default.nix
+++ b/pkgs/development/python-modules/django-pattern-library/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "django-pattern-library";
-  version = "1.0.1";
+  version = "1.1.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "torchbox";
     repo = "django-pattern-library";
-    rev = "v${version}";
-    hash = "sha256-Q8rv7RDlstTSlwmbmHV0vrnCV/lwz6VJf27BUllA34Y=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9uuLYwG0/NYGouncuaN8S+3CBABSxSOkcrP59p5v84U=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/django-payments/default.nix b/pkgs/development/python-modules/django-payments/default.nix
index 577a2ca5132e..d470bb57a2e5 100644
--- a/pkgs/development/python-modules/django-payments/default.nix
+++ b/pkgs/development/python-modules/django-payments/default.nix
@@ -33,8 +33,6 @@ buildPythonPackage rec {
       --replace "django-phonenumber-field[phonenumberslite]" "django-phonenumber-field"
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-phonenumber-field/default.nix b/pkgs/development/python-modules/django-phonenumber-field/default.nix
index 41b3dee76f42..759bcdbfccca 100644
--- a/pkgs/development/python-modules/django-phonenumber-field/default.nix
+++ b/pkgs/development/python-modules/django-phonenumber-field/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-QEmwCdSiaae7mhmCPcV5F01f1GRxmIur3tyhv0XK7I4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-simple-history/default.nix b/pkgs/development/python-modules/django-simple-history/default.nix
index 5ed17c5f6425..a38671d97c0f 100644
--- a/pkgs/development/python-modules/django-simple-history/default.nix
+++ b/pkgs/development/python-modules/django-simple-history/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-XY6YNajwX5z3AXkYYGFtrURDqxub9EQwu52jQ7CZwrI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django-tables2/default.nix b/pkgs/development/python-modules/django-tables2/default.nix
index 96811351269d..a6a873bee00e 100644
--- a/pkgs/development/python-modules/django-tables2/default.nix
+++ b/pkgs/development/python-modules/django-tables2/default.nix
@@ -2,41 +2,73 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# dependencies
 , django
 , tablib
-, python
+
+# tests
+, lxml
+, openpyxl
+, psycopg2
+, pytz
+, pyyaml
+, pytest-django
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-tables2";
-  version = "2.6.0";
-  format = "setuptools";
+  version = "2.7.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "jieter";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-n8qvsm/i+2VclFc00jQGO0Z4l6Ke8qZ03EYuEQcPuVQ=";
+    hash = "sha256-VB7xmcBncTUYllzKS4o7G7u+KoivMiiEQGZ4x+Rnces=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     django
-    tablib
   ];
 
-  pythonImportsCheck = [
-    # Requested setting DJANGO_TABLES2_TEMPLATE, but settings are not configured.
-  ];
+  passthru.optional-dependencies = {
+    tablib = [
+      tablib
+    ]
+    ++ tablib.optional-dependencies.xls
+    ++ tablib.optional-dependencies.yaml;
+  };
 
-  doCheck = false; # needs django-boostrap{3,4} packages
+  env.DJANGO_SETTINGS_MODULE = "tests.app.settings";
 
-  # Leave this in! Discovering how to run tests is annoying in Django apps
-  checkPhase = ''
-    ${python.interpreter} example/manage.py test
-  '';
+  nativeCheckInputs = [
+    lxml
+    openpyxl
+    psycopg2
+    pytz
+    pyyaml
+    pytest-django
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+
+  disabledTestPaths = [
+    # requires django-filters
+    "tests/test_views.py"
+  ];
 
   meta = with lib; {
+    changelog = "https://github.com/jieter/django-tables2/blob/v${version}/CHANGELOG.md";
     description = "Django app for creating HTML tables";
     homepage = "https://github.com/jieter/django-tables2";
     license = licenses.bsd2;
diff --git a/pkgs/development/python-modules/django-types/default.nix b/pkgs/development/python-modules/django-types/default.nix
index 5c16312538ac..908fb1bd0ed1 100644
--- a/pkgs/development/python-modules/django-types/default.nix
+++ b/pkgs/development/python-modules/django-types/default.nix
@@ -2,23 +2,31 @@
 , buildPythonPackage
 , fetchPypi
 , poetry-core
+, types-psycopg2
 }:
 
 buildPythonPackage rec {
   pname = "django-types";
-  version = "0.18.0";
-  format = "pyproject";
+  version = "0.19.1";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-uOIzTIEIZNer8RzTzbHaOyAVtn5/EnAAfjN3f/G9hlQ=";
+    pname = "django_types";
+    inherit version;
+    hash = "sha256-WueYhhLPb7w1ewGLvDs6h4tl4EJ1zEbg011mpwja/xI=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    types-psycopg2
+  ];
 
   meta = with lib; {
     description = "Type stubs for Django";
-    homepage = "https://pypi.org/project/django-types";
+    homepage = "https://github.com/sbdchd/django-types";
     license = licenses.mit;
     maintainers = with maintainers; [ thubrecht ];
   };
diff --git a/pkgs/development/python-modules/django-vite/default.nix b/pkgs/development/python-modules/django-vite/default.nix
index 88dc763aa15f..beb49f409270 100644
--- a/pkgs/development/python-modules/django-vite/default.nix
+++ b/pkgs/development/python-modules/django-vite/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "django-vite";
-  version = "2.1.3";
+  version = "3.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "MrBin99";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-HrcQt0Mdko+/XJd0srQTBYMtHaLZyImMuQn39HIwDfY=";
+    hash = "sha256-S7n14nv6DZgusntVXh65PM/oaYZGCxaFylPbVXxmLj4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-widget-tweaks/default.nix b/pkgs/development/python-modules/django-widget-tweaks/default.nix
index b77af5e47491..547df7c7fdfb 100644
--- a/pkgs/development/python-modules/django-widget-tweaks/default.nix
+++ b/pkgs/development/python-modules/django-widget-tweaks/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-/3UIsg75X3R9YGv9cEcoPw3IN2vkhUb+HCy68813d2E=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 69c438739f23..47c079328a17 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.2.7";
+  version = "4.2.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jg8cLCeGtcDjn+GvziTJJgQPrUfI6orTCq8RiN8p/EE=";
+    hash = "sha256-EkmMw8uLyAOFOf756Q6V9QdQJDbB8MOmc0ETJPpnXRQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/djangorestframework-stubs/default.nix b/pkgs/development/python-modules/djangorestframework-stubs/default.nix
index c5e5b0d967f4..6cb2e76e857c 100644
--- a/pkgs/development/python-modules/djangorestframework-stubs/default.nix
+++ b/pkgs/development/python-modules/djangorestframework-stubs/default.nix
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    django-stubs
     requests
     types-pyyaml
     types-requests
@@ -43,7 +44,6 @@ buildPythonPackage rec {
 
   passthru.optional-dependencies = {
     compatible-mypy = [
-      django-stubs
       mypy
     ] ++ django-stubs.optional-dependencies.compatible-mypy;
     coreapi = [
diff --git a/pkgs/development/python-modules/docker/default.nix b/pkgs/development/python-modules/docker/default.nix
index 80c73f2fe0a6..579584c53104 100644
--- a/pkgs/development/python-modules/docker/default.nix
+++ b/pkgs/development/python-modules/docker/default.nix
@@ -3,28 +3,38 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+
+# build-system
+, setuptools
+, setuptools-scm
+
+# dependencies
 , packaging
-, paramiko
-, pytestCheckHook
 , requests
-, setuptools-scm
 , urllib3
+
+# optional-dependenices
+, paramiko
 , websocket-client
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "docker";
-  version = "6.1.3";
+  version = "7.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qm0XgwBFul7wFo1eqjTTe+6xE5SMQTr/4dWZH8EfmiA=";
+    hash = "sha256-Mjc2+5LNlBj8XnEzvJU+EanaBPRIP4KLUn21U/Hn5aM=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
@@ -32,16 +42,24 @@ buildPythonPackage rec {
     packaging
     requests
     urllib3
-    websocket-client
   ];
 
-  passthru.optional-dependencies.ssh = [
-    paramiko
+  passthru.optional-dependencies = {
+    ssh = [
+      paramiko
+    ];
+    websockets = [
+      websocket-client
+    ];
+  };
+
+  pythonImportsCheck = [
+    "docker"
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pytestFlagsArray = [
     "tests/unit"
@@ -49,16 +67,13 @@ buildPythonPackage rec {
 
   # Deselect socket tests on Darwin because it hits the path length limit for a Unix domain socket
   disabledTests = lib.optionals stdenv.isDarwin [
-    "api_test" "stream_response" "socket_file"
-  ];
-
-  dontUseSetuptoolsCheck = true;
-
-  pythonImportsCheck = [
-    "docker"
+    "api_test"
+    "stream_response"
+    "socket_file"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/docker/docker-py/releases/tag/${version}";
     description = "An API client for docker written in Python";
     homepage = "https://github.com/docker/docker-py";
     license = licenses.asl20;
diff --git a/pkgs/development/python-modules/dockerspawner/default.nix b/pkgs/development/python-modules/dockerspawner/default.nix
index b2c5b2790fbe..44f269d50c64 100644
--- a/pkgs/development/python-modules/dockerspawner/default.nix
+++ b/pkgs/development/python-modules/dockerspawner/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , jupyterhub
 , escapism
 , docker
@@ -9,13 +10,17 @@
 buildPythonPackage rec {
   pname = "dockerspawner";
   version = "13.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-POlTZ9luS9wQ/vt9w8VMfTEqGzg/DhfB45ePfvnyito=";
+    hash = "sha256-POlTZ9luS9wQ/vt9w8VMfTEqGzg/DhfB45ePfvnyito=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     jupyterhub
     escapism
diff --git a/pkgs/development/python-modules/docstring-to-markdown/default.nix b/pkgs/development/python-modules/docstring-to-markdown/default.nix
index 2832228394c3..958adb3ffbf1 100644
--- a/pkgs/development/python-modules/docstring-to-markdown/default.nix
+++ b/pkgs/development/python-modules/docstring-to-markdown/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "docstring-to-markdown";
-  version = "0.12";
+  version = "0.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "python-lsp";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-c0gk1s/+25+pWUpi8geDQZ0f9JBeuvvFQ9MFskRnY6U=";
+    hash = "sha256-r+TRYofTRDCBC0s+bJRhagepEQbbj5WeI5FRtaVPt24=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/dominate/default.nix b/pkgs/development/python-modules/dominate/default.nix
index 38aaccf4b15a..24aa9efa2a84 100644
--- a/pkgs/development/python-modules/dominate/default.nix
+++ b/pkgs/development/python-modules/dominate/default.nix
@@ -1,22 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "dominate";
-  version = "2.8.0";
-  format = "setuptools";
+  version = "2.9.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TJDDvvr4jmErcfSzmve8vviXes+oVc7JVyJaj79QQAc=";
+    hash = "sha256-sVeR6+pDIhhUOhcC12rkXS/5X/mU5SAUuGhqadrXcv0=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/dtschema/default.nix b/pkgs/development/python-modules/dtschema/default.nix
index 1e890aba3309..cb4fa7fcdf47 100644
--- a/pkgs/development/python-modules/dtschema/default.nix
+++ b/pkgs/development/python-modules/dtschema/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     ./fix_libfdt_name.patch
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index 5ff995684992..a7cd1aa36dd4 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -32,7 +32,6 @@ buildPythonPackage rec {
   '';
 
   BUILD_HTTPFS = 1;
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     pybind11
diff --git a/pkgs/development/python-modules/dunamai/default.nix b/pkgs/development/python-modules/dunamai/default.nix
index 46e2361d9db9..7cbd3ea50efc 100644
--- a/pkgs/development/python-modules/dunamai/default.nix
+++ b/pkgs/development/python-modules/dunamai/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dunamai";
-  version = "1.18.0";
+  version = "1.19.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mtkennerly";
     repo = "dunamai";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QKXEFwOAa5nIQZA6DHNqnWyshnN+/6qovdqjCd9WF4k=";
+    hash = "sha256-wMIqm1bUub89ExnbvJBzuZ9479el8EgwVcfPpI+SD5Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/duo-client/default.nix b/pkgs/development/python-modules/duo-client/default.nix
index 129ec14cd0a7..4339f6918304 100644
--- a/pkgs/development/python-modules/duo-client/default.nix
+++ b/pkgs/development/python-modules/duo-client/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "duo-client";
-  version = "5.0.1";
+  version = "5.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "duosecurity";
     repo = "duo_client_python";
     rev = "refs/tags/${version}";
-    hash = "sha256-G0XLZZaQTPD64WXN34wq2z+YtzECgtC2nJXzDxAlgyg=";
+    hash = "sha256-MnSAFxKgExq+e8TOwgsPAoO4GEfsc3sjPNGLxzch5f0=";
   };
 
   postPatch = ''
@@ -53,6 +53,11 @@ buildPythonPackage rec {
     # Tests require network access
     "test_server_hostname"
     "test_server_hostname_with_port"
+    "test_get_billing_edition"
+    "test_get_telephony_credits"
+    "test_set_business_billing_edition"
+    "test_set_enterprise_billing_edition"
+    "test_set_telephony_credits"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index 9a5f83102391..c7b41c27823a 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-ycC6NWvU00yUEHu62H5VLKDEZEHyIo4+TBwj5XaswII=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dvc-http/default.nix b/pkgs/development/python-modules/dvc-http/default.nix
index 49737d9b21ce..efe97c502cec 100644
--- a/pkgs/development/python-modules/dvc-http/default.nix
+++ b/pkgs/development/python-modules/dvc-http/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-ru/hOFv/RcS/7SBpTJU8xFxdllmaiH4dV1ouS6GGKkY=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dvc-objects/default.nix b/pkgs/development/python-modules/dvc-objects/default.nix
index b4d197be2dab..cf5894984caa 100644
--- a/pkgs/development/python-modules/dvc-objects/default.nix
+++ b/pkgs/development/python-modules/dvc-objects/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-JQ3UDUOpuxPavXkoJqbS0T7y3kpwuJ8NvqAl3DahoLU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --benchmark-skip" ""
diff --git a/pkgs/development/python-modules/dvc-render/default.nix b/pkgs/development/python-modules/dvc-render/default.nix
index 1d7de80cf661..a4527cd1b6c5 100644
--- a/pkgs/development/python-modules/dvc-render/default.nix
+++ b/pkgs/development/python-modules/dvc-render/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-OrfepQuLBNa5m3Sy4NzFOArtFFvaNtNNVJ8DNN3yT6s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dvc-studio-client/default.nix b/pkgs/development/python-modules/dvc-studio-client/default.nix
index bfc3cc84e67a..cc4b2149b1c3 100644
--- a/pkgs/development/python-modules/dvc-studio-client/default.nix
+++ b/pkgs/development/python-modules/dvc-studio-client/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-ZgjNshF5UFOY5TewNMlJDOajjI1Bfd/a4v7HrAKwaMw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dvc-task/default.nix b/pkgs/development/python-modules/dvc-task/default.nix
index 6cec59e72ac1..9596957b9612 100644
--- a/pkgs/development/python-modules/dvc-task/default.nix
+++ b/pkgs/development/python-modules/dvc-task/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-nrE8PdvzhH7lO0flvNkGC61NOVT4aj2E2gKEDRkp+b4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dvclive/default.nix b/pkgs/development/python-modules/dvclive/default.nix
index ebe26e2b057f..67f70fffb3e0 100644
--- a/pkgs/development/python-modules/dvclive/default.nix
+++ b/pkgs/development/python-modules/dvclive/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-QsA8HZ6wIWKvtQ+f3nyRKKZRNJS56eZ1sKw+KNHxfXc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/dynalite-devices/default.nix b/pkgs/development/python-modules/dynalite-devices/default.nix
index 111e7f69e13c..bd2c964605f4 100644
--- a/pkgs/development/python-modules/dynalite-devices/default.nix
+++ b/pkgs/development/python-modules/dynalite-devices/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -20,6 +21,14 @@ buildPythonPackage rec {
     hash = "sha256-i88aIsRNsToSceQdwfspJg+Y5MO5zC4O6EkyhrYR27g=";
   };
 
+  patches = [
+    (fetchpatch {
+      # remove asynctest from tests
+      url = "https://github.com/ziv1234/python-dynalite-devices/commit/1729035f2b435b345b4e694aeae5d1823d732208.patch";
+      hash = "sha256-LqFXrJrZTPPjPnWT4+blHFYS3W1fD9T+iwaLUauxjNE=";
+    })
+  ];
+
   postPatch = ''
     sed -i '/^addopts/d' setup.cfg
   '';
diff --git a/pkgs/development/python-modules/echo/default.nix b/pkgs/development/python-modules/echo/default.nix
index a025eb387308..abf6c957b047 100644
--- a/pkgs/development/python-modules/echo/default.nix
+++ b/pkgs/development/python-modules/echo/default.nix
@@ -42,8 +42,6 @@ buildPythonPackage rec {
     qtpy
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # collecting ... qt.qpa.xcb: could not connect to display
   # qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
   doCheck = false;
diff --git a/pkgs/development/python-modules/edk2-pytool-library/default.nix b/pkgs/development/python-modules/edk2-pytool-library/default.nix
index c93ddff879be..71e14320cb4e 100644
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@@ -55,8 +55,6 @@ buildPythonPackage rec {
     "test_basic_parse"
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonImportsCheck = [ "edk2toollib" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/elasticsearch/default.nix b/pkgs/development/python-modules/elasticsearch/default.nix
index e93388a1bbcc..f2e5a4b599a6 100644
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@@ -1,25 +1,51 @@
-{ buildPythonPackage
+{ lib
+, aiohttp
+, buildPythonPackage
+, certifi
+, elastic-transport
 , fetchPypi
-, urllib3, requests
-, nosexcover, mock
-, lib
+, pythonOlder
+, requests
+, urllib3
 }:
 
-buildPythonPackage (rec {
+buildPythonPackage rec {
   pname = "elasticsearch";
-  version = "8.9.0";
+  version = "8.11.0";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-0zZ/wBPgT8eq00mm3p+tHuBPttYnsOeJaqUFwS/eXgQ=";
+    sha256 = "sha256-nghBO+r/Oka8EMbFcGmoRwTfaqqTCFxzffB/WKKBG3g=";
+  };
+
+  nativeBuildInputs = [
+    elastic-transport
+  ];
+
+  propagatedBuildInputs = [
+    urllib3
+    certifi
+  ];
+
+  passthru.optional-dependencies = {
+    requests = [
+      requests
+    ];
+    async = [
+      aiohttp
+    ];
   };
 
+  pythonImportsCheck = [
+    "elasticsearch"
+  ];
+
   # Check is disabled because running them destroy the content of the local cluster!
   # https://github.com/elasticsearch/elasticsearch-py/tree/master/test_elasticsearch
   doCheck = false;
-  propagatedBuildInputs = [ urllib3 requests ];
-  buildInputs = [ nosexcover mock ];
 
   meta = with lib; {
     description = "Official low-level client for Elasticsearch";
@@ -28,4 +54,4 @@ buildPythonPackage (rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ desiderius ];
   };
-})
+}
diff --git a/pkgs/development/python-modules/email-validator/default.nix b/pkgs/development/python-modules/email-validator/default.nix
index 99ae071f4ae3..0f176e45fd07 100644
--- a/pkgs/development/python-modules/email-validator/default.nix
+++ b/pkgs/development/python-modules/email-validator/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "email-validator";
-  version = "2.0.0";
+  version = "2.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "JoshData";
     repo = "python-${pname}";
     rev = "refs/tags/v${version}";
-    hash = "sha256-o7UREa+IBiFjmqx0p+4XJCcoHQ/R6r2RtoezEcWvgbg=";
+    hash = "sha256-58DuQslADM7glrnlSSP6TtIDTlwuS0/GK8+izatqDxI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/emcee/default.nix b/pkgs/development/python-modules/emcee/default.nix
index 3dbf9c9b6546..772fb64d1f14 100644
--- a/pkgs/development/python-modules/emcee/default.nix
+++ b/pkgs/development/python-modules/emcee/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-K2cPSbR7jnl9Vzf2sEiPZqk2vTwgChNWAf6CAerhZCg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/enaml/default.nix b/pkgs/development/python-modules/enaml/default.nix
index fb192e100c5a..4479f5065927 100644
--- a/pkgs/development/python-modules/enaml/default.nix
+++ b/pkgs/development/python-modules/enaml/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-DYLDQ9QwdK/a8eY0bFX31UNgxm8FUOaeNAnisFcyFNI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/eventlet/default.nix b/pkgs/development/python-modules/eventlet/default.nix
index 35c702ea06d8..07f19e3493d9 100644
--- a/pkgs/development/python-modules/eventlet/default.nix
+++ b/pkgs/development/python-modules/eventlet/default.nix
@@ -2,12 +2,19 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
+, fetchpatch
+, pythonAtLeast
+
+# build-system
+, setuptools
+
+# dependencies
 , dnspython
 , greenlet
 , isPyPy
-, monotonic
 , six
+
+# tests
 , nose3
 , iana-etc
 , pytestCheckHook
@@ -17,7 +24,7 @@
 buildPythonPackage rec {
   pname = "eventlet";
   version = "0.33.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "eventlet";
@@ -26,12 +33,25 @@ buildPythonPackage rec {
     hash = "sha256-iSSEZgPkK7RrZfU11z7hUk+JbFsCPH/SD16e+/f6TFU=";
   };
 
+  patches = [
+    # Python 3.12 fixes:
+    # - remove usage of distutils
+    # - replace ssl.wrap_socket usage
+    ./remove-distutils-usage.patch
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/python-eventlet/raw/rawhide/f/python3.12.patch";
+      hash = "sha256-MxzprFaVcV1uamjjTeIz+2gPvfPy+Y1QaA20znMdwoA=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     dnspython
     greenlet
     six
-  ] ++ lib.optionals (pythonOlder "3.5") [
-    monotonic
   ];
 
   nativeCheckInputs = [
@@ -41,7 +61,8 @@ buildPythonPackage rec {
 
   # libredirect is not available on darwin
   # tests hang on pypy indefinitely
-  doCheck = !stdenv.isDarwin && !isPyPy;
+  # nose3 is incompatible with Python 3.12.
+  doCheck = !stdenv.isDarwin && !isPyPy && !(pythonAtLeast "3.12");
 
   preCheck = lib.optionalString doCheck ''
     echo "nameserver 127.0.0.1" > resolv.conf
@@ -95,6 +116,7 @@ buildPythonPackage rec {
   # pythonImportsCheck = [ "eventlet" ];
 
   meta = with lib; {
+    changelog = "https://github.com/eventlet/eventlet/blob/v${version}/NEWS";
     description = "A concurrent networking library for Python";
     homepage = "https://github.com/eventlet/eventlet/";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/eventlet/remove-distutils-usage.patch b/pkgs/development/python-modules/eventlet/remove-distutils-usage.patch
new file mode 100644
index 000000000000..614a41f0a978
--- /dev/null
+++ b/pkgs/development/python-modules/eventlet/remove-distutils-usage.patch
@@ -0,0 +1,143 @@
+diff --git a/eventlet/hubs/hub.py b/eventlet/hubs/hub.py
+index db55958..c27b81f 100644
+--- a/eventlet/hubs/hub.py
++++ b/eventlet/hubs/hub.py
+@@ -21,7 +21,7 @@ else:
+ 
+ import eventlet.hubs
+ from eventlet.hubs import timer
+-from eventlet.support import greenlets as greenlet, clear_sys_exc_info
++from eventlet.support import greenlets as greenlet
+ try:
+     from monotonic import monotonic
+ except ImportError:
+@@ -309,7 +309,6 @@ class BaseHub(object):
+                 cur.parent = self.greenlet
+         except ValueError:
+             pass  # gets raised if there is a greenlet parent cycle
+-        clear_sys_exc_info()
+         return self.greenlet.switch()
+ 
+     def squelch_exception(self, fileno, exc_info):
+@@ -397,13 +396,11 @@ class BaseHub(object):
+         if self.debug_exceptions:
+             traceback.print_exception(*exc_info)
+             sys.stderr.flush()
+-            clear_sys_exc_info()
+ 
+     def squelch_timer_exception(self, timer, exc_info):
+         if self.debug_exceptions:
+             traceback.print_exception(*exc_info)
+             sys.stderr.flush()
+-            clear_sys_exc_info()
+ 
+     def add_timer(self, timer):
+         scheduled_time = self.clock() + timer.seconds
+@@ -478,7 +475,6 @@ class BaseHub(object):
+                 raise
+             except:
+                 self.squelch_timer_exception(timer, sys.exc_info())
+-                clear_sys_exc_info()
+ 
+     # for debugging:
+ 
+diff --git a/eventlet/hubs/kqueue.py b/eventlet/hubs/kqueue.py
+index bad4a87..8438805 100644
+--- a/eventlet/hubs/kqueue.py
++++ b/eventlet/hubs/kqueue.py
+@@ -109,4 +109,3 @@ class Hub(hub.BaseHub):
+                 raise
+             except:
+                 self.squelch_exception(fileno, sys.exc_info())
+-                support.clear_sys_exc_info()
+diff --git a/eventlet/hubs/poll.py b/eventlet/hubs/poll.py
+index 1bbd401..d3f9c6a 100644
+--- a/eventlet/hubs/poll.py
++++ b/eventlet/hubs/poll.py
+@@ -113,7 +113,6 @@ class Hub(hub.BaseHub):
+                 raise
+             except:
+                 self.squelch_exception(fileno, sys.exc_info())
+-                support.clear_sys_exc_info()
+ 
+         if self.debug_blocking:
+             self.block_detect_post()
+diff --git a/eventlet/hubs/selects.py b/eventlet/hubs/selects.py
+index 0ead5b8..0386a1e 100644
+--- a/eventlet/hubs/selects.py
++++ b/eventlet/hubs/selects.py
+@@ -61,4 +61,3 @@ class Hub(hub.BaseHub):
+                     raise
+                 except:
+                     self.squelch_exception(fileno, sys.exc_info())
+-                    support.clear_sys_exc_info()
+diff --git a/eventlet/support/__init__.py b/eventlet/support/__init__.py
+index 43bac91..b1c1607 100644
+--- a/eventlet/support/__init__.py
++++ b/eventlet/support/__init__.py
+@@ -30,15 +30,6 @@ def get_errno(exc):
+         return None
+ 
+ 
+-if sys.version_info[0] < 3 and not greenlets.preserves_excinfo:
+-    from sys import exc_clear as clear_sys_exc_info
+-else:
+-    def clear_sys_exc_info():
+-        """No-op In py3k.
+-        Exception information is not visible outside of except statements.
+-        sys.exc_clear became obsolete and removed."""
+-        pass
+-
+ if sys.version_info[0] < 3:
+     def bytes_to_str(b, encoding='ascii'):
+         return b
+diff --git a/eventlet/support/greenlets.py b/eventlet/support/greenlets.py
+index d4e1793..b939328 100644
+--- a/eventlet/support/greenlets.py
++++ b/eventlet/support/greenlets.py
+@@ -1,8 +1,4 @@
+-import distutils.version
+-
+ import greenlet
+ getcurrent = greenlet.greenlet.getcurrent
+ GreenletExit = greenlet.greenlet.GreenletExit
+-preserves_excinfo = (distutils.version.LooseVersion(greenlet.__version__)
+-                     >= distutils.version.LooseVersion('0.3.2'))
+ greenlet = greenlet.greenlet
+diff --git a/setup.py b/setup.py
+index a8f4684..9b927e0 100644
+--- a/setup.py
++++ b/setup.py
+@@ -19,7 +19,7 @@ setuptools.setup(
+     packages=setuptools.find_packages(exclude=['benchmarks', 'tests', 'tests.*']),
+     install_requires=(
+         'dnspython >= 1.15.0',
+-        'greenlet >= 0.3',
++        'greenlet >= 1.0',
+         'monotonic >= 1.4;python_version<"3.5"',
+         'six >= 1.10.0',
+     ),
+diff --git a/tests/hub_test.py b/tests/hub_test.py
+index a531b75..05c0024 100644
+--- a/tests/hub_test.py
++++ b/tests/hub_test.py
+@@ -194,7 +194,6 @@ class TestExceptionInMainloop(tests.LimitedTestCase):
+ 
+ class TestExceptionInGreenthread(tests.LimitedTestCase):
+ 
+-    @skip_unless(greenlets.preserves_excinfo)
+     def test_exceptionpreservation(self):
+         # events for controlling execution order
+         gt1event = eventlet.Event()
+diff --git a/tests/test__refcount.py b/tests/test__refcount.py
+index 1090a1f..5c1c002 100644
+--- a/tests/test__refcount.py
++++ b/tests/test__refcount.py
+@@ -57,7 +57,6 @@ def run_interaction(run_client):
+ 
+ def run_and_check(run_client):
+     w = run_interaction(run_client=run_client)
+-    # clear_sys_exc_info()
+     gc.collect()
+     fd = w()
+     print('run_and_check: weakref fd:', fd)
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index 61eef0a05abe..f19abc446058 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.1.2";
+  version = "1.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,15 +18,13 @@ buildPythonPackage rec {
     owner = "agronholm";
     repo = "exceptiongroup";
     rev = version;
-    hash = "sha256-19taP6adzmO4zH2As1OTXeYNFj6KwjhxBr09X+SrZRk=";
+    hash = "sha256-iGeaRVJeFAWfJpwr7N4kST7d8YxpX3WgDqQemlR0cLU=";
   };
 
   nativeBuildInputs = [
     flit-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   doCheck = pythonAtLeast "3.11"; # infinite recursion with pytest
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/executing/default.nix b/pkgs/development/python-modules/executing/default.nix
index 484f5690054a..aad9455156d1 100644
--- a/pkgs/development/python-modules/executing/default.nix
+++ b/pkgs/development/python-modules/executing/default.nix
@@ -1,18 +1,23 @@
 { lib
-, asttokens
 , buildPythonPackage
 , fetchFromGitHub
-, littleutils
-, pytestCheckHook
 , pythonAtLeast
 , pythonOlder
-, rich
+
+# build-system
+, setuptools
 , setuptools-scm
+
+# tests
+, asttokens
+, littleutils
+, rich
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "executing";
-  version = "1.2.0";
+  version = "2.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,12 +26,11 @@ buildPythonPackage rec {
     owner = "alexmojaki";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3M3uSJ5xQ5Ciy8Lz21u9zjju/7SBSFHobCqSiJ6AP8M=";
+    hash = "sha256-PBvfkv9GQ5Vj5I5SygtmHXtqqHMJ4XgNV1/I+lSU0/U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
@@ -38,6 +42,11 @@ buildPythonPackage rec {
     rich
   ];
 
+  disabledTests = [
+    # requires ipython, which causes a circular dependency
+    "test_two_statement_lookups"
+  ];
+
   pythonImportsCheck = [
     "executing"
   ];
diff --git a/pkgs/development/python-modules/expandvars/default.nix b/pkgs/development/python-modules/expandvars/default.nix
index 60055c6547ba..14d637fa63ce 100644
--- a/pkgs/development/python-modules/expandvars/default.nix
+++ b/pkgs/development/python-modules/expandvars/default.nix
@@ -2,34 +2,39 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, setuptools
-, wheel
+
+# build-system
+, hatchling
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "expandvars";
-  version = "0.11.0";
+  version = "0.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Q7Qn9dMnqzYAY98mFR+Y0qbwj+GPKJWjKn9fDxF7W1I=";
+    hash = "sha256-fRrfpVcoz0tdgS7OPQh3A/rqlT4MChp4QV3p31Ak2EQ=";
   };
 
   nativeBuildInputs = [
-    setuptools
-    wheel
+    hatchling
   ];
 
-  # The PyPi package does not supply any tests
-  doCheck = false;
-
   pythonImportsCheck = [
     "expandvars"
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+
   meta = with lib; {
     description = "Expand system variables Unix style";
     homepage = "https://github.com/sayanarijit/expandvars";
diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
index 7f414741b39e..68e0e4e3b5ea 100644
--- a/pkgs/development/python-modules/faker/default.nix
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -5,6 +5,7 @@
 , pillow
 , pytestCheckHook
 , python-dateutil
+, setuptools
 , text-unidecode
 , ukpostcodeparser
 , validators
@@ -12,15 +13,19 @@
 
 buildPythonPackage rec {
   pname = "faker";
-  version = "19.6.1";
-  format = "setuptools";
+  version = "20.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "Faker";
     inherit version;
-    hash = "sha256-XWt4gLO+pwgHXd+Rk4QkRT8HBTpZ+PoEU8GHDfb/MpI=";
+    hash = "sha256-Vio6CcPtOhp7IOE9efkE39/F50D3KBPs+V5M9x5aL1I=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     python-dateutil
     text-unidecode
diff --git a/pkgs/development/python-modules/farm-haystack/default.nix b/pkgs/development/python-modules/farm-haystack/default.nix
index 43988b76e7d5..efc68f4cb0ad 100644
--- a/pkgs/development/python-modules/farm-haystack/default.nix
+++ b/pkgs/development/python-modules/farm-haystack/default.nix
@@ -286,5 +286,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/deepset-ai/haystack";
     license = licenses.asl20;
     maintainers = with maintainers; [ happysalada ];
+    # https://github.com/deepset-ai/haystack/issues/5304
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/fast-histogram/default.nix b/pkgs/development/python-modules/fast-histogram/default.nix
index 7eb3944d690a..229e448ea704 100644
--- a/pkgs/development/python-modules/fast-histogram/default.nix
+++ b/pkgs/development/python-modules/fast-histogram/default.nix
@@ -42,8 +42,6 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [ "${builtins.placeholder "out"}/${python.sitePackages}" ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonImportsCheck = [ "fast_histogram" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/fastapi-mail/default.nix b/pkgs/development/python-modules/fastapi-mail/default.nix
index 52d3c4435724..258425e35f85 100644
--- a/pkgs/development/python-modules/fastapi-mail/default.nix
+++ b/pkgs/development/python-modules/fastapi-mail/default.nix
@@ -11,6 +11,7 @@
 , jinja2
 , poetry-core
 , pydantic
+, pydantic-settings
 , pytest-asyncio
 , pytestCheckHook
 , python-multipart
@@ -19,23 +20,23 @@
 
 buildPythonPackage rec {
   pname = "fastapi-mail";
-  version = "1.3.1";
-  format = "pyproject";
+  version = "1.4.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "sabuhish";
-    repo = pname;
+    repo = "fastapi-mail";
     rev = "refs/tags/${version}";
-    hash = "sha256-m8d4y75+mSh9A+YVaV/yZhN3ckOe2mV1jdtfeNFtU/w=";
+    hash = "sha256-2iTZqZIxlt1GKhElasTcnys18UbNNDwHoZziHBOIGBo=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace 'version = "1.2.5"' 'version = "${version}"' \
       --replace 'aiosmtplib = "^2.0"' 'aiosmtplib = "*"' \
-      --replace 'pydantic = "^1.8"' 'pydantic = "*"' \
+      --replace 'pydantic = "^2.0"' 'pydantic = "*"' \
   '';
 
   nativeBuildInputs = [
@@ -52,6 +53,7 @@ buildPythonPackage rec {
     httpx
     jinja2
     pydantic
+    pydantic-settings
     python-multipart
   ];
 
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 428cf9f8d91d..89c1c2ffbe40 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 
 # build-system
 , hatchling
@@ -31,11 +32,13 @@
 , orjson
 , email-validator
 , uvicorn
+, pydantic-settings
+, pydantic-extra-types
 }:
 
 buildPythonPackage rec {
   pname = "fastapi";
-  version = "0.103.1";
+  version = "0.104.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -44,11 +47,18 @@ buildPythonPackage rec {
     owner = "tiangolo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-2J8c3S4Ca+c5bI0tyjMJArJKux9qPmu+ohqve5PhSGI=";
+    hash = "sha256-xTTFBc+fswLYUhKRkWP/eiYSbG3j1E7CASkEtHVNTlk=";
   };
 
   nativeBuildInputs = [
     hatchling
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "anyio"
+    # https://github.com/tiangolo/fastapi/pull/9636
+    "starlette"
   ];
 
   propagatedBuildInputs = [
@@ -67,8 +77,9 @@ buildPythonPackage rec {
     orjson
     email-validator
     uvicorn
-    # pydantic-settings
-    # pydantic-extra-types
+  ] ++ lib.optionals (lib.versionAtLeast pydantic.version "2") [
+    pydantic-settings
+    pydantic-extra-types
   ] ++ uvicorn.optional-dependencies.standard;
 
   nativeCheckInputs = [
@@ -87,6 +98,9 @@ buildPythonPackage rec {
     # ignoring deprecation warnings to avoid test failure from
     # tests/test_tutorial/test_testing/test_tutorial001.py
     "-W ignore::DeprecationWarning"
+
+    # http code mismatches
+    "--deselect=tests/test_annotated.py::test_get"
   ];
 
   disabledTestPaths = [
@@ -112,6 +126,10 @@ buildPythonPackage rec {
     "test_warn_duplicate_operation_id"
     # assert state["except"] is True
     "test_dependency_gets_exception"
+    # Fixtures drift
+    "test_openapi_schema_sub"
+    # 200 != 404
+    "test_flask"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/fastavro/default.nix b/pkgs/development/python-modules/fastavro/default.nix
index 54a475c08b01..f685d210b87b 100644
--- a/pkgs/development/python-modules/fastavro/default.nix
+++ b/pkgs/development/python-modules/fastavro/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "fastavro";
-  version = "1.8.3";
+  version = "1.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-W+fFZAQU7W6gDqB6LOrG8se6mBATFZWmepTt1HSphbE=";
+    hash = "sha256-10r12Ya+FKMgdOTmgYH1xb6vOXNLLw073VzCvo2x9kg=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/fasteners/default.nix b/pkgs/development/python-modules/fasteners/default.nix
index 38d09c47705c..3dcdb073aeea 100644
--- a/pkgs/development/python-modules/fasteners/default.nix
+++ b/pkgs/development/python-modules/fasteners/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "fasteners";
-  version = "0.18";
+  version = "0.19";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "harlowja";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-FGcGGRfObOqXuURyEuNt/KDn51POpdNPUJJKtMcLJNI=";
+    hash = "sha256-XFa1ItFqkSYE940p/imWFp5e9gS6n+D1uM6Cj+Vzmmg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fastjsonschema/default.nix b/pkgs/development/python-modules/fastjsonschema/default.nix
index 8c1be492ec15..93edef365178 100644
--- a/pkgs/development/python-modules/fastjsonschema/default.nix
+++ b/pkgs/development/python-modules/fastjsonschema/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "fastjsonschema";
-  version = "2.16.2";
+  version = "2.18.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     repo = "python-fastjsonschema";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-Gojayel/xQ5gRI0nbwsroeSMdRndjb+8EniX1Qs4nbg=";
+    hash = "sha256-t6JnqQgsWAL8oL8+LO0xrXMYsZOlTF3DlXkRiqUzYtU=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/fastnumbers/default.nix b/pkgs/development/python-modules/fastnumbers/default.nix
index 7be3e25698ba..69cdd4c3e378 100644
--- a/pkgs/development/python-modules/fastnumbers/default.nix
+++ b/pkgs/development/python-modules/fastnumbers/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "fastnumbers";
-  version = "5.0.1";
+  version = "5.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "SethMMorton";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-y9QnFh44zHC+CSlYtKPmkhLSFBUquYZv4qP/pQxu9e0=";
+    hash = "sha256-TC9+xOvskABpChlrSJcHy6O7D7EnIKL6Ekt/vaLBX2E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fastparquet/default.nix b/pkgs/development/python-modules/fastparquet/default.nix
index 05cb76f1dd48..9105fbd40612 100644
--- a/pkgs/development/python-modules/fastparquet/default.nix
+++ b/pkgs/development/python-modules/fastparquet/default.nix
@@ -32,8 +32,6 @@ buildPythonPackage rec {
     hash = "sha256-pJ0zK0upEV7TyuNMIcozugkwBlYpK/Dg6BdB0kBpn9k=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     cython
     oldest-supported-numpy
diff --git a/pkgs/development/python-modules/filecheck/default.nix b/pkgs/development/python-modules/filecheck/default.nix
index b7b9c2948ae2..9d8c22756fb9 100644
--- a/pkgs/development/python-modules/filecheck/default.nix
+++ b/pkgs/development/python-modules/filecheck/default.nix
@@ -1,30 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, poetry-core
+, hatchling
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "filecheck";
-  version = "0.0.23";
+  version = "0.0.24";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "mull-project";
     repo = "FileCheck.py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-R+e4Z1EX6Nk7INLar3gtkUpk+30xIJO7yiZbUvrhN74=";
+    hash = "sha256-VbMlCqGd3MVpj0jEKjSGC2L0s/3e/d53b+2eZcXZneo=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "poetry>=0.12" "poetry-core" \
-      --replace "poetry.masonry.api" "poetry.core.masonry.api"
-  '';
-
   nativeBuildInputs = [
-    poetry-core
+    hatchling
   ];
 
   nativeCheckInputs = [
@@ -36,6 +30,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/mull-project/FileCheck.py/releases/tag/v${version}";
     homepage = "https://github.com/mull-project/FileCheck.py";
     license = licenses.asl20;
     description = "Python port of LLVM's FileCheck, flexible pattern matching file verifier";
diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index 74cd6e727dbd..b32335bb2475 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "3.12.4";
+  version = "3.13.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Lm8knx82VCkWBuBGsJ8f1erDmzYGZMJ/Wq0HIBL4vL0=";
+    hash = "sha256-Uh9fVsUPhCb14DrTsoG0kKh+8VvGxSbxaCkPDHFI1E4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flasgger/default.nix b/pkgs/development/python-modules/flasgger/default.nix
index 4bb5e9fe30d9..1be41854b52e 100644
--- a/pkgs/development/python-modules/flasgger/default.nix
+++ b/pkgs/development/python-modules/flasgger/default.nix
@@ -33,6 +33,11 @@ buildPythonPackage rec {
       url = "https://github.com/flasgger/flasgger/commit/ab77be7c6de1d4b361f0eacfa37290239963f890.patch";
       hash = "sha256-ZbE5pPUP23nZAP/qcdeWkwzrZgqJSRES7oFta8U1uVQ=";
     })
+    (fetchpatch {
+      # python 3.12 compat
+      url = "https://github.com/flasgger/flasgger/commit/6f5fcf24c1d816cf7ab529b3a8a764f86df4458d.patch";
+      hash = "sha256-37Es1sgBQ9qX3YHQYub4HJkSNTSt3MbtCfV+XdTQZyY=";
+    })
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-appbuilder/default.nix b/pkgs/development/python-modules/flask-appbuilder/default.nix
index 6309e0ddd2c0..68c9895f2b90 100644
--- a/pkgs/development/python-modules/flask-appbuilder/default.nix
+++ b/pkgs/development/python-modules/flask-appbuilder/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "flask-appbuilder";
-  version = "4.3.6";
+  version = "4.3.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Flask-AppBuilder";
     inherit version;
-    hash = "sha256-jKlxD6fScEdH0ZXhG0h9RaVx9AVZ2DmdnV36QuofPHg=";
+    hash = "sha256-QXPIeOVrgcasrF48gMEz9Bg/Q0Qv2URVK9n0Aj9brOs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-assets/default.nix b/pkgs/development/python-modules/flask-assets/default.nix
index 33caa223ea3b..def8f7b7754f 100644
--- a/pkgs/development/python-modules/flask-assets/default.nix
+++ b/pkgs/development/python-modules/flask-assets/default.nix
@@ -1,14 +1,22 @@
-{ lib, buildPythonPackage, fetchPypi, flask, webassets, flask-script, nose }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, flask
+, webassets
+, flask-script
+, nose
+}:
 
 buildPythonPackage rec {
   pname = "flask-assets";
-  version = "2.0";
-  format = "setuptools";
+  version = "2.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "Flask-Assets";
     inherit version;
-    hash = "sha256-Hf3qNeQHRNRqracoMfdhPWe/OOiyDMqqnpH9w3qjuMI=";
+    hash = "sha256-+E1lMv/lnJ/zUoheh0D/TaJcC8+s2AXwqAaBXkQ1SBM=";
   };
 
   patchPhase = ''
@@ -17,7 +25,16 @@ buildPythonPackage rec {
     substituteInPlace tests/test_integration.py --replace "'/foo'" "'/x/foo'"
   '';
 
-  propagatedBuildInputs = [ flask webassets flask-script nose ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    flask
+    webassets
+    flask-script
+    nose
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/miracle2k/flask-assets";
diff --git a/pkgs/development/python-modules/flask-compress/default.nix b/pkgs/development/python-modules/flask-compress/default.nix
index fe2371149523..2810ab227008 100644
--- a/pkgs/development/python-modules/flask-compress/default.nix
+++ b/pkgs/development/python-modules/flask-compress/default.nix
@@ -43,8 +43,6 @@ buildPythonPackage rec {
     "flask_compress"
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   meta = with lib; {
     description = "Compress responses in your Flask app with gzip, deflate or brotli";
     homepage = "https://github.com/colour-science/flask-compress";
diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security-too/default.nix
index a904f4f2c6bb..b8f375dbcf09 100644
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , pythonOlder
 , setuptools
+, pydantic
 
 # extras: babel
 , babel
@@ -127,5 +128,7 @@ buildPythonPackage rec {
     description = "Simple security for Flask apps (fork)";
     license = licenses.mit;
     maintainers = with maintainers; [ gador ];
+    # https://github.com/Flask-Middleware/flask-security/pull/851
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/flask-sqlalchemy/default.nix b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
index 7146c38e5a30..7f1775418f1c 100644
--- a/pkgs/development/python-modules/flask-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/flask-sqlalchemy/default.nix
@@ -5,6 +5,7 @@
 , mock
 , flit-core
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , sqlalchemy
 }:
@@ -43,6 +44,11 @@ buildPythonPackage rec {
     "test_persist_selectable"
   ];
 
+  pytestFlagsArray = lib.optionals (pythonAtLeast "3.12") [
+    # datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version.
+    "-W" "ignore::DeprecationWarning"
+  ];
+
   pythonImportsCheck = [
     "flask_sqlalchemy"
   ];
diff --git a/pkgs/development/python-modules/flit-scm/default.nix b/pkgs/development/python-modules/flit-scm/default.nix
index 6b7c57100017..24075891c61e 100644
--- a/pkgs/development/python-modules/flit-scm/default.nix
+++ b/pkgs/development/python-modules/flit-scm/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-2nx9kWq/2TzauOW+c67g9a3JZ2dhBM4QzKyK/sqWOPo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     flit-core
     setuptools-scm
diff --git a/pkgs/development/python-modules/flow-record/default.nix b/pkgs/development/python-modules/flow-record/default.nix
index f52dee034d57..4dbce567c700 100644
--- a/pkgs/development/python-modules/flow-record/default.nix
+++ b/pkgs/development/python-modules/flow-record/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-8XQeXfrgTk+jHR1ABlEEIn3E/MkUkGnvkgzePws4qhQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/folium/default.nix b/pkgs/development/python-modules/folium/default.nix
index d5384fc221c6..3efaaa38cbe1 100644
--- a/pkgs/development/python-modules/folium/default.nix
+++ b/pkgs/development/python-modules/folium/default.nix
@@ -32,8 +32,6 @@ buildPythonPackage rec {
     hash = "sha256-CHPHxp8xEZhEEMLvhs/xAiOr2Hw6B+5svFNY+QvQa+U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index 3c167debba37..db66e46f3d9d 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "fonttools";
-  version = "4.42.1";
+  version = "4.46.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner  = pname;
     repo   = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-fcFFJi9Hr0m74LwFIhhhm/bMfxepAvg4/ymU53MmsPg=";
+    hash = "sha256-QpC1OWpqhJpzS59OG8A/nndWDoeYyAFUTIcsppLzM8Y=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/formulaic/default.nix b/pkgs/development/python-modules/formulaic/default.nix
index a90c6b9f8d98..f6aa82c9682c 100644
--- a/pkgs/development/python-modules/formulaic/default.nix
+++ b/pkgs/development/python-modules/formulaic/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-qivWv1LtFkW55tVKD/Zjd8Q5gVbxhDpZ0inkV6NR7bA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/fpylll/default.nix b/pkgs/development/python-modules/fpylll/default.nix
index 8450d4b78c01..2de77cfbd69d 100644
--- a/pkgs/development/python-modules/fpylll/default.nix
+++ b/pkgs/development/python-modules/fpylll/default.nix
@@ -1,30 +1,42 @@
-{ stdenv
-, lib
+{ lib
 , fetchFromGitHub
 , buildPythonPackage
+
+# build-system
+, cysignals
+, cython_3
 , pkgconfig
+, setuptools
+
 , gmp
 , pari
 , mpfr
 , fplll
-, cython
-, cysignals
 , numpy
-, pytest
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "fpylll";
-  version = "0.5.9";
-  format = "setuptools";
+  version = "0.6.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fplll";
     repo = "fpylll";
-    rev = version;
-    hash = "sha256-T6l6hKzRDevlLyLu5H+bnEdl0OhsPer1coCDiftbPAk=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-EyReCkVRb3CgzIRal5H13OX/UdwWi+evDe7PoS1qP4A=";
   };
 
+  nativeBuildInputs = [
+    cython_3
+    cysignals
+    pkgconfig
+    setuptools
+  ];
+
   buildInputs = [
     gmp
     pari
@@ -33,25 +45,19 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    cython
-    cysignals
     numpy
   ];
 
-  nativeBuildInputs = [
-    pkgconfig
-  ];
-
   nativeCheckInputs = [
-    pytest
+    pytestCheckHook
   ];
 
-  checkPhase = ''
+  preCheck = ''
     # Since upstream introduced --doctest-modules in
     # https://github.com/fplll/fpylll/commit/9732fdb40cf1bd43ad1f60762ec0a8401743fc79,
     # it is necessary to ignore import mismatches. Not sure why, but the files
     # should be identical anyway.
-    PY_IGNORE_IMPORTMISMATCH=1 pytest
+    export PY_IGNORE_IMPORTMISMATCH=1
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/freezegun/default.nix b/pkgs/development/python-modules/freezegun/default.nix
index 112b5210173b..e8c564a477ba 100644
--- a/pkgs/development/python-modules/freezegun/default.nix
+++ b/pkgs/development/python-modules/freezegun/default.nix
@@ -1,31 +1,26 @@
 { lib
 , buildPythonPackage
-, fetchpatch
 , fetchPypi
 , pytestCheckHook
 , python-dateutil
-, pythonAtLeast
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "freezegun";
-  version = "1.2.2";
-  format = "setuptools";
+  version = "1.3.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zSLRugaUE4RBDNln2KmdWuJEL1ffr+/y/aXejcXAVEY=";
+    hash = "sha256-SJhDl7O1jvXfxkXWowSwBg9hK87P2q9Fzor/AHemy2o=";
   };
 
-  patches = lib.optionals (pythonAtLeast "3.10") [
-    # Staticmethods in 3.10+ are now callable, prevent freezegun to attempt to decorate them
-    (fetchpatch {
-      url = "https://github.com/spulec/freezegun/pull/397/commits/e63874ce75a74a1159390914045fe8e7955b24c4.patch";
-      hash = "sha256-FNABqVN5DFqVUR88lYzwbfsZj3xcB9/MvQtm+I2VjnI=";
-    })
+  nativeBuildInputs = [
+    setuptools
   ];
 
   propagatedBuildInputs = [
@@ -43,6 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library that allows your Python tests to travel through time";
     homepage = "https://github.com/spulec/freezegun";
+    changelog = "https://github.com/spulec/freezegun/blob/${version}/CHANGELOG";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ftfy/default.nix b/pkgs/development/python-modules/ftfy/default.nix
index 14a356e21e22..f0a096ae87d9 100644
--- a/pkgs/development/python-modules/ftfy/default.nix
+++ b/pkgs/development/python-modules/ftfy/default.nix
@@ -1,23 +1,34 @@
 { lib
 , buildPythonPackage
-, isPy3k
 , fetchPypi
+, pythonOlder
+
+# build-system
+, poetry-core
+
+# dependencies
 , wcwidth
+
+# tests
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "ftfy";
-  version = "6.1.1";
-  format = "setuptools";
+  version = "6.1.3";
+  pyproject = true;
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v8IBn4T82FFBkVIyCmN1YEoPFFnCgbWxmbLNDS5yf48=";
+    hash = "sha256-aTJ0rq2BHP8kweh4QWWqdVzS9uRCpexTXH1pf2QipCI=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
     wcwidth
   ];
diff --git a/pkgs/development/python-modules/fugashi/default.nix b/pkgs/development/python-modules/fugashi/default.nix
index 264771ed5a4b..021ac6dd1d11 100644
--- a/pkgs/development/python-modules/fugashi/default.nix
+++ b/pkgs/development/python-modules/fugashi/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-4i7Q+TtXTQNSJ1EIcS8KHrVPdCJAgZh86Y6lB8772XU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ cython mecab setuptools-scm ];
 
   nativeCheckInputs = [ ipadic pytestCheckHook ]
diff --git a/pkgs/development/python-modules/future/default.nix b/pkgs/development/python-modules/future/default.nix
index 7c4a5507b540..7c6c21d4d356 100644
--- a/pkgs/development/python-modules/future/default.nix
+++ b/pkgs/development/python-modules/future/default.nix
@@ -1,19 +1,37 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
+
+# build-system
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "future";
   version = "0.18.3";
-
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-NKF0Nu0elml6hvnePRWjsL4B2LyN6cHf/Vn7gjTtUwc=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/PythonCharmers/python-future/commit/1901c1c347bcad603e8404b64656994eb2cc0439.patch";
+      hash = "sha256-wUSWVs7+KTsTmEM4OkpViAjDGWqx5h0SLPIacMZCpWU=";
+      excludes = [
+        "build.sh"
+        "docs/whatsnew.rst"
+      ];
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   pythonImportsCheck = [
     "future.builtins"
     "future.moves"
diff --git a/pkgs/development/python-modules/galois/default.nix b/pkgs/development/python-modules/galois/default.nix
index 2273e6bd6eff..cfb4ac57d563 100644
--- a/pkgs/development/python-modules/galois/default.nix
+++ b/pkgs/development/python-modules/galois/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-dWYnD+Byh0orRg20/nhu8ILooFBeHysxQ403boDVqYk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
     pythonRelaxDepsHook
diff --git a/pkgs/development/python-modules/geoalchemy2/default.nix b/pkgs/development/python-modules/geoalchemy2/default.nix
index 62319647e394..39904aec9363 100644
--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@@ -40,10 +40,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ passthru.optional-dependencies.shapely;
 
-  env = {
-    SETUPTOOLS_SCM_PRETEND_VERSION = version;
-  };
-
   disabledTestPaths = [
     # tests require live databases
     "tests/gallery/test_decipher_raster.py"
diff --git a/pkgs/development/python-modules/geocachingapi/default.nix b/pkgs/development/python-modules/geocachingapi/default.nix
index 61e2a1f7a80a..d7ad9cb5fd8a 100644
--- a/pkgs/development/python-modules/geocachingapi/default.nix
+++ b/pkgs/development/python-modules/geocachingapi/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     aiohttp
     backoff
diff --git a/pkgs/development/python-modules/geojson/default.nix b/pkgs/development/python-modules/geojson/default.nix
index 69cd2ed30653..28e05315861d 100644
--- a/pkgs/development/python-modules/geojson/default.nix
+++ b/pkgs/development/python-modules/geojson/default.nix
@@ -1,22 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, glibcLocales
+, setuptools
 , unittestCheckHook
  }:
 
 buildPythonPackage rec {
   pname = "geojson";
-  version = "3.0.1";
-  format = "setuptools";
+  version = "3.1.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "geojson";
     rev = "refs/tags/${version}";
-    hash = "sha256-VlP/odzRH6Eg0BMZPBQkbHL/O2cIwWTKJcL5SfZoUWQ=";
+    hash = "sha256-OL+7ntgzpA63ALQ8whhKRePsKxcp81PLuU1bHJvxN9U=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   pythonImportsCheck = [
     "geojson"
   ];
diff --git a/pkgs/development/python-modules/geopy/default.nix b/pkgs/development/python-modules/geopy/default.nix
index 52adbbe07eed..4616dd3866c8 100644
--- a/pkgs/development/python-modules/geopy/default.nix
+++ b/pkgs/development/python-modules/geopy/default.nix
@@ -1,10 +1,10 @@
 { lib
-, async-generator
 , buildPythonPackage
 , docutils
 , fetchFromGitHub
 , geographiclib
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , pytz
 }:
@@ -27,7 +27,6 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    async-generator
     docutils
     pytestCheckHook
     pytz
@@ -38,6 +37,10 @@ buildPythonPackage rec {
     "test_user_agent_default"
   ];
 
+  disabledTestPaths = lib.optionals (pythonAtLeast "3.12") [
+    "test/test_init.py"
+  ];
+
   pytestFlagsArray = [ "--skip-tests-requiring-internet" ];
 
   pythonImportsCheck = [ "geopy" ];
diff --git a/pkgs/development/python-modules/geventhttpclient/default.nix b/pkgs/development/python-modules/geventhttpclient/default.nix
index 906fcdbdb608..ad732575b4e1 100644
--- a/pkgs/development/python-modules/geventhttpclient/default.nix
+++ b/pkgs/development/python-modules/geventhttpclient/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "geventhttpclient";
-  version = "2.0.10";
+  version = "2.0.11";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-t8l7JlEZV6NqiU7FRlHAiJCmnhGLaXVfjnS/w3xjORs=";
+    hash = "sha256-VJ0POvCEILmtK+7aIRFTx2BbW6QJsijbfxuByL++xrQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gitdb/default.nix b/pkgs/development/python-modules/gitdb/default.nix
index dc6be575153c..996387f45135 100644
--- a/pkgs/development/python-modules/gitdb/default.nix
+++ b/pkgs/development/python-modules/gitdb/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , setuptools
 , smmap
 }:
@@ -21,6 +22,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "smmap"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gitpython/default.nix b/pkgs/development/python-modules/gitpython/default.nix
index 43925e357a90..50afd5ea4aa8 100644
--- a/pkgs/development/python-modules/gitpython/default.nix
+++ b/pkgs/development/python-modules/gitpython/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "gitpython";
-  version = "3.1.37";
+  version = "3.1.40";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "gitpython-developers";
     repo = "GitPython";
     rev = "refs/tags/${version}";
-    hash = "sha256-w3aSgIaD6tkxhYctkvvsdKlWXS8xU4+F0cCYeYTNHig=";
+    hash = "sha256-a5Ez6SuSqrJE306FrFjEnSoVhALVvubF1pLW4awK4gM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/glueviz/default.nix b/pkgs/development/python-modules/glueviz/default.nix
index e066240fa6e0..bb25d2edd3a9 100644
--- a/pkgs/development/python-modules/glueviz/default.nix
+++ b/pkgs/development/python-modules/glueviz/default.nix
@@ -65,8 +65,6 @@ buildPythonPackage rec {
 
   dontConfigure = true;
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # collecting ... qt.qpa.xcb: could not connect to display
   # qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
   doCheck = false;
diff --git a/pkgs/development/python-modules/glyphslib/default.nix b/pkgs/development/python-modules/glyphslib/default.nix
index 054f5db667f1..7cf9adbb3bf6 100644
--- a/pkgs/development/python-modules/glyphslib/default.nix
+++ b/pkgs/development/python-modules/glyphslib/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-2Y7JhaZJXKERQXEI9cDCx7m95El6AicU0t+X3Gntbxk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-api-core/default.nix b/pkgs/development/python-modules/google-api-core/default.nix
index 9df9562c3d15..76fbdf7fa425 100644
--- a/pkgs/development/python-modules/google-api-core/default.nix
+++ b/pkgs/development/python-modules/google-api-core/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "google-api-core";
-  version = "2.11.1";
+  version = "2.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JdKeBaAFjtXxnGHAp4sbU63qTZNktGTQFPvalB9tHJo=";
+    hash = "sha256-U2ikUCt5PZu/gSpZEuE+Tmn5vYf277UIRgxD9bvRzkE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-api-python-client/default.nix b/pkgs/development/python-modules/google-api-python-client/default.nix
index ecf2b36ab9db..b6f73cc406eb 100644
--- a/pkgs/development/python-modules/google-api-python-client/default.nix
+++ b/pkgs/development/python-modules/google-api-python-client/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-api-python-client";
-  version = "2.99.0";
+  version = "2.109.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5zP9DyyHk7GgANXmmsgbG57AZltEW37YO9u7ADiXMwY=";
+    hash = "sha256-0GOQwlR3w2HVJjn+AO+RLD+rja/H+/KVgMEUTpJSOnk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index 7edbedb80c6a..5eeb88cd9d0f 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "3.11.4";
+  version = "3.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aX3xFyQaIoO8u5OyHhC63BTlHJqQgA0qfho+HH2EKXQ=";
+    hash = "sha256-eUzPyTzLDgrWiUQviW+cgt5W2g/hihlVMbs3CWwmV9Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-iam/default.nix b/pkgs/development/python-modules/google-cloud-iam/default.nix
index ec412c732ddd..9e1ca821bdae 100644
--- a/pkgs/development/python-modules/google-cloud-iam/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam";
-  version = "2.12.1";
+  version = "2.12.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/lBwhUR+z0Ydr9LNS4AWxYmeWOUgvQS1G7Orb2sI+v8=";
+    hash = "sha256-YDHQwZEfx5zguLuPb+FkUoO5wakYi0g9rmI7U7TYGBw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-kms/default.nix b/pkgs/development/python-modules/google-cloud-kms/default.nix
index 5daa5fe466f6..32949b14c332 100644
--- a/pkgs/development/python-modules/google-cloud-kms/default.nix
+++ b/pkgs/development/python-modules/google-cloud-kms/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-kms";
-  version = "2.19.1";
+  version = "2.19.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ia3XCpLUXJ93AGEHdDaOidQEagUkMVAnb2UYK+ktzKc=";
+    hash = "sha256-F6UDRZLoXvADHSW75YlL2y1xlGCFWYC/62iqTo/8Er0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index ebcb32bf2b45..42ffe46a97b7 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -11,21 +11,32 @@
 , protobuf
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , requests
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "2.10.0";
-  format = "setuptools";
+  version = "2.13.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-k0sx6tXzmU5TYPn/V1CYLFtrEWBNwHK8RSwlll4Hbcc=";
+    hash = "sha256-9i3Ex7bNQ2DQcuPesoA1+9rUkaw9mwsYFaEtrqEPN8c=";
   };
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "google-auth"
+  ];
+
   propagatedBuildInputs = [
     google-auth
     google-cloud-core
diff --git a/pkgs/development/python-modules/googleapis-common-protos/default.nix b/pkgs/development/python-modules/googleapis-common-protos/default.nix
index 60233f91fbbc..e8a469e51b06 100644
--- a/pkgs/development/python-modules/googleapis-common-protos/default.nix
+++ b/pkgs/development/python-modules/googleapis-common-protos/default.nix
@@ -1,21 +1,29 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , grpc
 , protobuf
 }:
 
 buildPythonPackage rec {
   pname = "googleapis-common-protos";
-  version = "1.60.0";
-  format = "setuptools";
+  version = "1.61.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5z67QECY20BbqV0eGuCqkcPhWnHaAxou62suI+e8Nwg=";
+    hash = "sha256-imSGapf2MEpxeYc6Rl1u7pe3ok7Gz9eOD1delrghJAs=";
   };
 
-  propagatedBuildInputs = [ grpc protobuf ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    grpc
+    protobuf
+  ];
 
   # does not contain tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/gpsoauth/default.nix b/pkgs/development/python-modules/gpsoauth/default.nix
index 80b8350410f1..e8b84b492bca 100644
--- a/pkgs/development/python-modules/gpsoauth/default.nix
+++ b/pkgs/development/python-modules/gpsoauth/default.nix
@@ -1,24 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pycryptodomex
 , pythonOlder
 , requests
 }:
 
 buildPythonPackage rec {
-  version = "1.0.2";
-  format = "setuptools";
   pname = "gpsoauth";
+  version = "1.0.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-68rnLrMlp/BsvqlbnV5kvsJTcDEtsV6OLkbE1U5ynno=";
+    hash = "sha256-SWYXNYrnzK8P4oK9f7bmOiVdWUQHp8WvhNzIS7Y0msg=";
   };
 
-  propagatedBuildInputs = [ pycryptodomex requests ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    pycryptodomex
+    requests
+  ];
 
   # upstream tests are not very comprehensive
   doCheck = false;
diff --git a/pkgs/development/python-modules/gpytorch/default.nix b/pkgs/development/python-modules/gpytorch/default.nix
index e4ce55bb2c84..c4664bc04ee7 100644
--- a/pkgs/development/python-modules/gpytorch/default.nix
+++ b/pkgs/development/python-modules/gpytorch/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-cpkfjx5G/4duL1Rr4nkHTHi03TDcYbcx3bKP2Ny7Ijo=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/gradio-pdf/default.nix b/pkgs/development/python-modules/gradio-pdf/default.nix
new file mode 100644
index 000000000000..d2bbfecefdc3
--- /dev/null
+++ b/pkgs/development/python-modules/gradio-pdf/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, hatch-fancy-pypi-readme
+, hatch-requirements-txt
+, hatchling
+, gradio
+, gradio-client
+}:
+
+buildPythonPackage rec {
+  pname = "gradio-pdf";
+  version = "0.0.3";
+  format = "pyproject";
+
+  src = fetchPypi {
+    pname = "gradio_pdf";
+    inherit version;
+    hash = "sha256-l9bcH/6paEdKk9Q7HM3ap9MI1Qi7rPZ/ucAibBUEPKI=";
+  };
+
+  nativeBuildInputs = [
+    hatch-fancy-pypi-readme
+    hatch-requirements-txt
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    gradio-client
+  ];
+
+  buildInputs = [
+    gradio.sans-reverse-dependencies
+  ];
+  disallowedReferences = [
+    gradio.sans-reverse-dependencies
+  ];
+
+  pythonImportsCheck = [ "gradio_pdf" ];
+
+  # tested in `gradio`
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Python library for easily interacting with trained machine learning models";
+    homepage = "https://pypi.org/project/gradio-pdf/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/development/python-modules/gradio/client.nix b/pkgs/development/python-modules/gradio/client.nix
index ce866a67b4cc..e68f793f7301 100644
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -20,28 +20,14 @@
 , pytestCheckHook
 , pytest-asyncio
 , pydub
+, rich
+, tomlkit
 , gradio
 }:
 
-let
-
-  # Cyclic dependencies are fun!
-  # This is gradio without gradio-client, only needed for checkPhase
-  gradio' = (gradio.override (old: {
-    gradio-client = null;
-  })).overridePythonAttrs (old: {
-    nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pythonRelaxDepsHook ];
-    pythonRemoveDeps = (old.pythonRemoveDeps or []) ++ [ "gradio_client" ];
-    doInstallCheck = false;
-    doCheck = false;
-    pythonImportsCheck = null;
-  });
-
-in
-
 buildPythonPackage rec {
-  pname = "gradio_client";
-  version = "0.5.0";
+  pname = "gradio-client";
+  version = "0.7.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -51,18 +37,26 @@ buildPythonPackage rec {
     owner = "gradio-app";
     repo = "gradio";
     #rev = "refs/tags/v${gradio.version}";
-    rev = "ba4c6d9e65138c97062d1757d2a588c4fc449daa"; # v3.43.1 is not tagged...
+    rev = "dc131b64f05062447643217819ca630e483a11df"; # v4.9.1 is not tagged...
     sparseCheckout = [ "client/python" ];
-    hash = "sha256-savka4opyZKSWPeBqc2LZqvwVXLYIZz5dS1OWJSwvHo=";
+    hash = "sha256-Zp1Zl53Va0pyyZEHDUpnldi4dtH2uss7PZQD+Le8+cA=";
   };
   prePatch = ''
     cd client/python
   '';
 
+  # upstream adds upper constraints because they can, not because the need to
+  # https://github.com/gradio-app/gradio/pull/4885
+  pythonRelaxDeps = [
+    # only backward incompat is dropping py3.7 support
+    "websockets"
+  ];
+
   nativeBuildInputs = [
     hatchling
     hatch-requirements-txt
     hatch-fancy-pypi-readme
+    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
@@ -71,20 +65,20 @@ buildPythonPackage rec {
     httpx
     huggingface-hub
     packaging
-    requests
     typing-extensions
     websockets
   ];
 
-  nativeCheckInputs =[
+  nativeCheckInputs = [
     pytestCheckHook
     pytest-asyncio
     pydub
-    gradio'
-  ];
-  disallowedReferences = [
-    gradio' # ensuring we don't propagate this intermediate build
+    rich
+    tomlkit
+    gradio.sans-reverse-dependencies
   ];
+  # ensuring we don't propagate this intermediate build
+  disallowedReferences = [ gradio.sans-reverse-dependencies ];
 
   # Add a pytest hook skipping tests that access network, marking them as "Expected fail" (xfail).
   preCheck = ''
@@ -94,7 +88,7 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [
     "test/"
-    #"-m" "not flaky" # doesn't work, even when advertised
+    "-m 'not flaky'"
     #"-x" "-W" "ignore" # uncomment for debugging help
   ];
 
diff --git a/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py b/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
index 4738de317552..eb2385bca8d6 100644
--- a/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
+++ b/pkgs/development/python-modules/gradio/conftest-skip-network-errors.py
@@ -28,6 +28,8 @@ def pytest_runtest_makereport(item, call):
         for exc in iterate_exc_chain(call.excinfo.value):
             if isinstance(exc, NixNetworkAccessDeniedError):
                 tr.outcome, tr.wasxfail = 'skipped', "reason: Requires network access."
+            if isinstance(exc, httpx.ConnectError):
+                tr.outcome, tr.wasxfail = 'skipped', "reason: Requires network access."
             if isinstance(exc, FileNotFoundError):  # gradio specific
                 tr.outcome, tr.wasxfail = 'skipped', "reason: Pypi dist bad."
     return tr
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 19474d8d9fbf..78e6f99505e3 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -3,6 +3,8 @@
 , fetchPypi
 , pythonOlder
 , pythonRelaxDepsHook
+, writeShellScriptBin
+, gradio
 
 # pyproject
 , hatchling
@@ -31,15 +33,16 @@
 , python-multipart
 , pydub
 , pyyaml
-, requests
 , semantic-version
 , typing-extensions
 , uvicorn
-, websockets
+, typer
+, tomlkit
 
 # check
 , pytestCheckHook
 , boto3
+, gradio-pdf
 , ffmpeg
 , ipython
 , pytest-asyncio
@@ -53,23 +56,30 @@
 
 buildPythonPackage rec {
   pname = "gradio";
-  version = "3.44.3";
+  version = "4.9.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
-  # We use the Pypi release, as it provides prebuilt webui assets,
-  # and has more frequent releases compared to github tags
+  # We use the Pypi release, since it provides prebuilt webui assets,
+  # and upstream has stopped tagging releases since 3.41.0
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3mXs9PwlzUo89VosBWtnsOzDQf/T22Yv7s5j6OLLp3M=";
+    hash = "sha256-KosxlmU5pYvuy5zysscuWM25IGXin7RLGEM9V2xPQrU=";
   };
 
   # fix packaging.ParserSyntaxError, which can't handle comments
   postPatch = ''
     sed -ie "s/ #.*$//g" requirements*.txt
+
+    # they bundle deps?
+    rm -rf venv/
   '';
 
+  pythonRelaxDeps = [
+    "tomlkit"
+  ];
+
   nativeBuildInputs = [
     pythonRelaxDepsHook
     hatchling
@@ -99,16 +109,17 @@ buildPythonPackage rec {
     python-multipart
     pydub
     pyyaml
-    requests
     semantic-version
     typing-extensions
     uvicorn
-    websockets
-  ];
+    typer
+    tomlkit
+  ] ++ typer.passthru.optional-dependencies.all;
 
   nativeCheckInputs = [
     pytestCheckHook
     boto3
+    gradio-pdf
     ffmpeg
     ipython
     pytest-asyncio
@@ -119,7 +130,10 @@ buildPythonPackage rec {
     tqdm
     transformers
     vega-datasets
-  ];
+
+    # mock npm to make `shutil.which("npm")` pass
+    (writeShellScriptBin "npm" "false")
+  ] ++ pydantic.passthru.optional-dependencies.email;
 
   # Add a pytest hook skipping tests that access network, marking them as "Expected fail" (xfail).
   # We additionally xfail FileNotFoundError, since the gradio devs often fail to upload test assets to pypi.
@@ -148,12 +162,14 @@ buildPythonPackage rec {
     "test_shapley_text"
   ];
   disabledTestPaths = [
+    # 100% touches network
+    "test/test_networking.py"
     # makes pytest freeze 50% of the time
     "test/test_interfaces.py"
   ];
   pytestFlagsArray = [
     "-x"  # abort on first failure
-    #"-m" "not flaky" # doesn't work, even when advertised
+    "-m 'not flaky'"
     #"-W" "ignore" # uncomment for debugging help
   ];
 
@@ -165,6 +181,23 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "gradio" ];
 
+  # Cyclic dependencies are fun!
+  # This is gradio without gradio-client and gradio-pdf
+  passthru = {
+    sans-reverse-dependencies = (gradio.override (old: {
+      gradio-client = null;
+      gradio-pdf = null;
+    })).overridePythonAttrs (old: {
+      pname = old.pname + "-sans-client";
+      nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pythonRelaxDepsHook ];
+      pythonRemoveDeps = (old.pythonRemoveDeps or []) ++ [ "gradio-client" ];
+      doInstallCheck = false;
+      doCheck = false;
+      pythonImportsCheck = null;
+      dontCheckRuntimeDeps = true;
+    });
+  };
+
   meta = with lib; {
     homepage = "https://www.gradio.app/";
     description = "Python library for easily interacting with trained machine learning models";
diff --git a/pkgs/development/python-modules/graphviz/default.nix b/pkgs/development/python-modules/graphviz/default.nix
index 6af54cbb6d6d..8f145c13e722 100644
--- a/pkgs/development/python-modules/graphviz/default.nix
+++ b/pkgs/development/python-modules/graphviz/default.nix
@@ -3,11 +3,13 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, fetchpatch
 , substituteAll
 , graphviz
 , xdg-utils
 , makeFontsConf
 , freefont_ttf
+, setuptools
 , mock
 , pytest
 , pytest-mock
@@ -17,7 +19,7 @@
 buildPythonPackage rec {
   pname = "graphviz";
   version = "0.20.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -35,6 +37,12 @@ buildPythonPackage rec {
       inherit graphviz;
       xdgutils = xdg-utils;
     })
+    # https://github.com/xflr6/graphviz/issues/209
+    (fetchpatch {
+      name = "fix-tests-with-python312.patch";
+      url = "https://github.com/xflr6/graphviz/commit/5ce9fc5de4f2284baa27d7a8d68ab0885d032868.patch";
+      hash = "sha256-jREPACSc4aoHY3G+39e8Axqajw4eeKkAeVu2s40v1nI=";
+    })
   ];
 
   postPatch = ''
@@ -46,6 +54,10 @@ buildPythonPackage rec {
     fontDirectories = [ freefont_ttf ];
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     mock
     pytest
diff --git a/pkgs/development/python-modules/graspologic/default.nix b/pkgs/development/python-modules/graspologic/default.nix
index 513a60bd432e..745cf90b4b9e 100644
--- a/pkgs/development/python-modules/graspologic/default.nix
+++ b/pkgs/development/python-modules/graspologic/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , isPy27
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 , pytest-cov
 , hyppo
@@ -15,8 +16,8 @@
 
 buildPythonPackage rec {
   pname = "graspologic";
-  version = "3.2.0";
-  format = "setuptools";
+  version = "3.3.0";
+  pyproject = true;
 
   disabled = isPy27;
 
@@ -24,9 +25,13 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "graspologic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yXhEI/8qm526D+Ehqqfb+j+sbbh83Q4OWC+UM7cgCjU=";
+    hash = "sha256-hd3OyV95N8vhc4s50HbKkrcUOeSegn66Dkw7dixim00=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     hyppo
     matplotlib
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index 98c9b5bf302f..3bbaf7e8ab35 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-j0j13bJtHlPc00pjmfpg/QJKzYQQcyA+jE7q538Uu08=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     pdm-backend
   ];
diff --git a/pkgs/development/python-modules/grpc-google-iam-v1/default.nix b/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
index 96be86458422..e94278fec310 100644
--- a/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
+++ b/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
@@ -1,21 +1,29 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , grpcio
 , googleapis-common-protos
 }:
 
 buildPythonPackage rec {
   pname = "grpc-google-iam-v1";
-  version = "0.12.6";
-  format = "setuptools";
+  version = "0.12.7";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-K8S4/fIhFaZddRyTFzKTImAsObfIaiicm3LSKNlg718=";
+    hash = "sha256-AJGXp/HqqiIUnJbl4FSsWTS6ckGXTpJmPY01KKISA9E=";
   };
 
-  propagatedBuildInputs = [ grpcio googleapis-common-protos ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    grpcio
+    googleapis-common-protos
+  ];
 
   # no tests run
   doCheck = false;
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 0915851d7a70..a6aaa9e28d5f 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.59.3";
+  version = "1.60.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZcOUukM4DWvfjATGHvxJMQS1U1VSrtNYF6G03GZZih8=";
+    hash = "sha256-8Q4LbbOtwP3CRLcZYoFO6YKZbvBhhkRrVpW5+mNaoas=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 9c808eb8d718..2ab692a2c715 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.59.3";
+  version = "1.60.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zRYKxCgc0a53osiAN3p3KDSTQLTJHiQoUDe1fBjp9lE=";
+    hash = "sha256-7TBJk0AijXM/9p/PSmZZDteSH5TrWiv2kiWLEoC52sc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index a003d4659d60..77be060cfd2d 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -18,11 +18,11 @@
 buildPythonPackage rec {
   pname = "grpcio";
   format = "setuptools";
-  version = "1.59.3";
+  version = "1.60.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eAD5lWinSgbr3M1BndG25jm0d9yvbad+pwL4+xTOX4A=";
+    hash = "sha256-IZkWWhr/tmaqJK3wyXQ2aG0KYbxfwRPAN3Aft8f865Y=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 16f99016fed3..03062ea264be 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -14,15 +14,15 @@
 
 buildPythonPackage rec {
   pname = "gst-python";
-  version = "1.22.7";
+  version = "1.22.8";
 
   format = "other";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "${meta.homepage}/src/gst-python/${pname}-${version}.tar.xz";
-    hash = "sha256-HvjfdggBL6RpMpeZyVDsCHc3ptq60wA8IwZYtYxxAXI=";
+    url = "https://gstreamer.freedesktop.org/src/gst-python/${pname}-${version}.tar.xz";
+    hash = "sha256-1cuPFEBUoqEQ5mcr1RLksV1bG42YecGSuXI1Ne+3C48=";
   };
 
   # Python 2.x is not supported.
diff --git a/pkgs/development/python-modules/gunicorn/default.nix b/pkgs/development/python-modules/gunicorn/default.nix
index 9a425be27878..ec2ed2aaf63d 100644
--- a/pkgs/development/python-modules/gunicorn/default.nix
+++ b/pkgs/development/python-modules/gunicorn/default.nix
@@ -1,17 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, packaging
 , pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
+, packaging
+
+# optional-dependencies
 , eventlet
 , gevent
+, tornado
+, setproctitle
+
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "gunicorn";
   version = "21.2.0";
-  format = "setuptools";
+  pyproject = true;
+
   disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
@@ -26,19 +37,40 @@ buildPythonPackage rec {
       --replace "--cov=gunicorn --cov-report=xml" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     packaging
   ];
 
-  nativeCheckInputs = [
-    eventlet
-    gevent
-    pytestCheckHook
+  passthru.optional-dependencies = {
+    gevent = [
+      gevent
+    ];
+    eventlet = [
+      eventlet
+    ];
+    tornado = [
+      tornado
+    ];
+    gthread = [];
+    setproctitle = [
+      setproctitle
+    ];
+  };
+
+  pythonImportsCheck = [
+    "gunicorn"
   ];
 
-  pythonImportsCheck = [ "gunicorn" ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   meta = with lib; {
+    changelog = "https://github.com/benoitc/gunicorn/releases/tag/${version}";
     homepage = "https://github.com/benoitc/gunicorn";
     description = "gunicorn 'Green Unicorn' is a WSGI HTTP Server for UNIX, fast clients and sleepy applications";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/guppy3/default.nix b/pkgs/development/python-modules/guppy3/default.nix
index 5c102f10a551..2c4389549aff 100644
--- a/pkgs/development/python-modules/guppy3/default.nix
+++ b/pkgs/development/python-modules/guppy3/default.nix
@@ -2,13 +2,15 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, setuptools
 , tkinter
 }:
 
 buildPythonPackage rec {
   pname = "guppy3";
   version = "3.1.4.post1";
-  format = "setuptools";
+  pyproject = true;
+
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
@@ -18,6 +20,10 @@ buildPythonPackage rec {
     hash = "sha256-HHy57P6WEHZKygAbdjEh6XAApFlQueiYGr02eSQMWfc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ tkinter ];
 
   # Tests are starting a Tkinter GUI
diff --git a/pkgs/development/python-modules/h5netcdf/default.nix b/pkgs/development/python-modules/h5netcdf/default.nix
index 1c97861f1eee..334289b034e2 100644
--- a/pkgs/development/python-modules/h5netcdf/default.nix
+++ b/pkgs/development/python-modules/h5netcdf/default.nix
@@ -11,18 +11,16 @@
 
 buildPythonPackage rec {
   pname = "h5netcdf";
-  version = "1.2.0";
+  version = "1.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f2snM73gbqJXW3mmRQ2b1cOJGP9MsqNVvyK76Mhsa88=";
+    hash = "sha256-oXHAJ9rrNLJMJKO2MEGVuOq7tvEMdIJW7Tz+GYBjg88=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/h5py/default.nix b/pkgs/development/python-modules/h5py/default.nix
index 3fb20fad4c3b..fc30a7536a33 100644
--- a/pkgs/development/python-modules/h5py/default.nix
+++ b/pkgs/development/python-modules/h5py/default.nix
@@ -21,7 +21,7 @@ let
   mpi = hdf5.mpi;
   mpiSupport = hdf5.mpiSupport;
 in buildPythonPackage rec {
-  version = "3.9.0";
+  version = "3.10.0";
   pname = "h5py";
   format = "pyproject";
 
@@ -29,7 +29,7 @@ in buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5gTbZSHB42fGvX+tI5yEf1PMRmRvLSZRNy0Frl6V+Bc=";
+    hash = "sha256-2TrcSM7rMzR+skpjT7eH78euRkTm6kunM9CZYFBFwEk=";
   };
 
   # avoid strict pinning of numpy
diff --git a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
index 02e876ade864..1420362dc622 100644
--- a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
+++ b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
@@ -49,5 +49,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/unixorn/ha-mqtt-discoverable/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index 06c7504ebdec..61b1fdf58a1a 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -12,6 +12,7 @@
 , pytest-timeout
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , setuptools
 , snitun
 , syrupy
@@ -34,6 +35,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "acme"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hatch-vcs/default.nix b/pkgs/development/python-modules/hatch-vcs/default.nix
index 4fa2c56cabfb..25884829b5d2 100644
--- a/pkgs/development/python-modules/hatch-vcs/default.nix
+++ b/pkgs/development/python-modules/hatch-vcs/default.nix
@@ -10,15 +10,15 @@
 
 buildPythonPackage rec {
   pname = "hatch-vcs";
-  version = "0.3.0";
+  version = "0.4.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "hatch_vcs";
     inherit version;
-    hash = "sha256-zsUQfPzkgsZ/i8lvGLvDIMmqDQaBgOFK0xe77loVP+4=";
+    hash = "sha256-CTgQdI/gHbDUUfq88sGsJojK79Iy1O3pZwkLHBsH2fc=";
   };
 
   nativeBuildInputs = [
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/ofek/hatch-vcs/releases/tag/v${version}";
     description = "A plugin for Hatch that uses your preferred version control system (like Git) to determine project versions";
     homepage = "https://github.com/ofek/hatch-vcs";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 8a886112fed9..221c266287f9 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "hatchling";
-  version = "1.18.0";
+  version = "1.21.0";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UOmcMRDOCvw/e9ut/xxxwXdY5HZzHCdgeUDPpmhkico=";
+    hash = "sha256-XAhncjV6UHI7gl/V2lJ4rH42l833eX0HVBpskLb/dUw=";
   };
 
   # listed in backend/pyproject.toml
diff --git a/pkgs/development/python-modules/help2man/default.nix b/pkgs/development/python-modules/help2man/default.nix
index 38cff88b4a12..edcd479458fe 100644
--- a/pkgs/development/python-modules/help2man/default.nix
+++ b/pkgs/development/python-modules/help2man/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-BIDn+LQzBtDHUtFvIRL3NMXNouO3cMLibuYBoFtCUxI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     jinja2
     setuptools-scm
diff --git a/pkgs/development/python-modules/histoprint/default.nix b/pkgs/development/python-modules/histoprint/default.nix
index 3c65fbf0eb80..66f06feac946 100644
--- a/pkgs/development/python-modules/histoprint/default.nix
+++ b/pkgs/development/python-modules/histoprint/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     uhi
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   checkInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/hiyapyco/default.nix b/pkgs/development/python-modules/hiyapyco/default.nix
index 72b206e297c8..9dc8ae08c724 100644
--- a/pkgs/development/python-modules/hiyapyco/default.nix
+++ b/pkgs/development/python-modules/hiyapyco/default.nix
@@ -1,30 +1,39 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pyyaml
 , jinja2
 }:
 
 buildPythonPackage rec {
   pname = "hiyapyco";
-  version = "0.5.1";
-  format = "setuptools";
+  version = "0.5.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zerwes";
     repo = pname;
     rev = "refs/tags/release-${version}";
-    hash = "sha256-MVJoMnEi+319ZkhffYWYVi/wj0Ihm0nfVeEXvx7Ac/4=";
+    hash = "sha256-hKTqdclWMKTGeRtQuNj0gYdiGFovFh5FQ2rRjCgbvBM=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyyaml
     jinja2
   ];
 
   checkPhase = ''
+    runHook preCheck
+
     set -e
     find test -name 'test_*.py' -exec python {} \;
+
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "hiyapyco" ];
diff --git a/pkgs/development/python-modules/hledger-utils/default.nix b/pkgs/development/python-modules/hledger-utils/default.nix
index cea6592b42b8..c2485c217a4c 100644
--- a/pkgs/development/python-modules/hledger-utils/default.nix
+++ b/pkgs/development/python-modules/hledger-utils/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-Qu4nUcAGTACmLhwc7fkLxITOyFnUHv85qMhtViFumVs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/html5tagger/default.nix b/pkgs/development/python-modules/html5tagger/default.nix
index 42bc3aa18ad6..e9a96b8ddd11 100644
--- a/pkgs/development/python-modules/html5tagger/default.nix
+++ b/pkgs/development/python-modules/html5tagger/default.nix
@@ -16,8 +16,6 @@ buildPythonPackage rec {
     hash = "sha256-Or0EizZC9FMjTcbgecDvgGB09KNGyxHreSDojgB7ysg=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/http-message-signatures/default.nix b/pkgs/development/python-modules/http-message-signatures/default.nix
index d88832f81acd..bc3351feb3d8 100644
--- a/pkgs/development/python-modules/http-message-signatures/default.nix
+++ b/pkgs/development/python-modules/http-message-signatures/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-acTziJM5H5Td+eG/LNrlNwgpVvFDyl/tf6//YuE1XZk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/httpbin/default.nix b/pkgs/development/python-modules/httpbin/default.nix
index cc15e00748c0..48de08ee3b4c 100644
--- a/pkgs/development/python-modules/httpbin/default.nix
+++ b/pkgs/development/python-modules/httpbin/default.nix
@@ -1,18 +1,26 @@
 { lib
-, brotlicffi
 , buildPythonPackage
-, decorator
 , fetchPypi
-, flask
-, flask-limiter
+, pythonRelaxDepsHook
+
+# build-system
+, setuptools
+
+# dependencies
+, brotlicffi
+, decorator
 , flasgger
-, itsdangerous
-, markupsafe
-, raven
+, flask
+, greenlet
 , six
-, pytestCheckHook
-, setuptools
 , werkzeug
+
+# optional-dependencies
+, gunicorn
+, gevent
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -27,20 +35,29 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "greenlet"
   ];
 
   propagatedBuildInputs = [
     brotlicffi
     decorator
     flask
-    flask-limiter
     flasgger
-    itsdangerous
-    markupsafe
-    raven
+    greenlet
     six
     werkzeug
-  ] ++ raven.optional-dependencies.flask;
+  ];
+
+  passthru.optional-dependencies = {
+    mainapp = [
+      gunicorn
+      gevent
+    ];
+  };
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/httpcore/default.nix b/pkgs/development/python-modules/httpcore/default.nix
index 91cd904e3afe..d9fd192b7bd1 100644
--- a/pkgs/development/python-modules/httpcore/default.nix
+++ b/pkgs/development/python-modules/httpcore/default.nix
@@ -13,8 +13,8 @@
 , pytest-trio
 , pytestCheckHook
 , pythonOlder
-, sniffio
 , socksio
+, trio
 # for passthru.tests
 , httpx
 , httpx-socks
@@ -22,16 +22,16 @@
 
 buildPythonPackage rec {
   pname = "httpcore";
-  version = "0.18.0";
+  version = "1.0.2";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "encode";
-    repo = pname;
+    repo = "httpcore";
     rev = "refs/tags/${version}";
-    hash = "sha256-UEpERsB7jZlMqRtyHxLYBisfDbTGaAiTtsgU1WUpvtA=";
+    hash = "sha256-gjAScRBzAuNiTSxspX6vzwTAdBIwVQbaSLEUFV1QP+E=";
   };
 
   nativeBuildInputs = [
@@ -40,19 +40,23 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    anyio
     certifi
     h11
-    sniffio
   ];
 
   passthru.optional-dependencies = {
+    asyncio = [
+      anyio
+    ];
     http2 = [
       h2
     ];
     socks = [
       socksio
     ];
+    trio = [
+      trio
+    ];
   };
 
   nativeCheckInputs = [
@@ -61,19 +65,7 @@ buildPythonPackage rec {
     pytest-httpbin
     pytest-trio
     pytestCheckHook
-  ] ++ passthru.optional-dependencies.http2
-    ++ passthru.optional-dependencies.socks;
-
-  disabledTests = [
-    # https://github.com/encode/httpcore/discussions/813
-    "test_connection_pool_timeout_during_request"
-    "test_connection_pool_timeout_during_response"
-    "test_h11_timeout_during_request"
-    "test_h11_timeout_during_response"
-    "test_h2_timeout_during_handshake"
-    "test_h2_timeout_during_request"
-    "test_h2_timeout_during_response"
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "httpcore"
@@ -86,7 +78,7 @@ buildPythonPackage rec {
   };
 
   meta = with lib; {
-    changelog = "https://github.com/encode/httpcore/releases/tag/${version}";
+    changelog = "https://github.com/encode/httpcore/blob/${version}/CHANGELOG.md";
     description = "A minimal low-level HTTP client";
     homepage = "https://github.com/encode/httpcore";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/httplib2/default.nix b/pkgs/development/python-modules/httplib2/default.nix
index c201bc3126c8..aa4abf313d20 100644
--- a/pkgs/development/python-modules/httplib2/default.nix
+++ b/pkgs/development/python-modules/httplib2/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "httplib2";
-  version = "0.21.0";
+  version = "0.22.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1Pl+l28J7crfO2UY/9/D019IzOHWOwjR+UvVEHICTqU=";
+    hash = "sha256-76gdiRbF535CEaNXwNqsVeVc0dKglovMPQpGsOkbd/4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/httptools/default.nix b/pkgs/development/python-modules/httptools/default.nix
index c516267629cd..116ab28dc989 100644
--- a/pkgs/development/python-modules/httptools/default.nix
+++ b/pkgs/development/python-modules/httptools/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "httptools";
-  version = "0.6.0";
+  version = "0.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-n8bkCa04y9aLF3zVFY/EBCx5a4LKiNmex48HvtbGt5Y=";
+    hash = "sha256-xuJsMEVWALldlLG4NghROOgvF3NRRU7oQcFI+TqbrVo=";
   };
 
   # Tests are not included in pypi tarball
diff --git a/pkgs/development/python-modules/httpx/default.nix b/pkgs/development/python-modules/httpx/default.nix
index 7e451532af04..0bbb64652737 100644
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, anyio
 , brotli
 , brotlicffi
 , buildPythonPackage
@@ -11,12 +12,12 @@
 , hatch-fancy-pypi-readme
 , hatchling
 , httpcore
+, idna
 , isPyPy
 , multipart
 , pygments
 , python
 , pythonOlder
-, rfc3986
 , rich
 , sniffio
 , socksio
@@ -29,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "httpx";
-  version = "0.25.0";
+  version = "0.25.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +39,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-zQVavjU66ksO0FB1h32e0YUhOGiQ4jHPvjgLhtxjU6s=";
+    hash = "sha256-rGtIrs4dffs7Ndtjb400q7JrZh+HG9k0uwHw9pRlC5s=";
   };
 
   nativeBuildInputs = [
@@ -47,9 +48,10 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    anyio
     certifi
     httpcore
-    rfc3986
+    idna
     sniffio
   ];
 
@@ -83,14 +85,7 @@ buildPythonPackage rec {
     pytest-trio
     trustme
     uvicorn
-  ] ++ passthru.optional-dependencies.http2
-    ++ passthru.optional-dependencies.brotli
-    ++ passthru.optional-dependencies.socks;
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "rfc3986[idna2008]>=1.3,<2" "rfc3986>=1.3"
-  '';
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   # testsuite wants to find installed packages for testing entrypoint
   preCheck = ''
diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index aa11d109dbc3..a15a8988a790 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "huggingface-hub";
-  version = "0.18.0";
+  version = "0.19.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "huggingface_hub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/KbD3TNSbQ9ueXYFLoXnIRIoi/y3l0w72GZ1+JC8ULk=";
+    hash = "sha256-bK/Cg+ZFhf9TrTVlDU35cLMDuTmdH4bN/QuPVeUVDsI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/humanize/default.nix b/pkgs/development/python-modules/humanize/default.nix
index ca06ac2abfd7..1ae941be385d 100644
--- a/pkgs/development/python-modules/humanize/default.nix
+++ b/pkgs/development/python-modules/humanize/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-sLlgR6c65RmUNZdH2pHuxzo7dm71uUZXGqzcqyxCrk4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/huum/default.nix b/pkgs/development/python-modules/huum/default.nix
index 9b08af43c54f..72f65940a5e3 100644
--- a/pkgs/development/python-modules/huum/default.nix
+++ b/pkgs/development/python-modules/huum/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , mashumaro
 , poetry-core
+, pydantic
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -47,5 +48,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/frwickst/pyhuum/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 4cc5aab3bffe..c74631817866 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , isPyPy
 , fetchFromGitHub
+, setuptools
 , attrs
 , exceptiongroup
 , pexpect
@@ -21,9 +22,8 @@
 
 buildPythonPackage rec {
   pname = "hypothesis";
-  version = "6.84.3";
-  outputs = [ "out" ];
-  format = "setuptools";
+  version = "6.91.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "HypothesisWorks";
     repo = "hypothesis";
     rev = "hypothesis-python-${version}";
-    hash = "sha256-wymZ/tJBGcP57B3BuDlBT7kbUxNwW4/SSmvwLSa5PvM=";
+    hash = "sha256-2iBeB5pLVOunOJb6aGNQ/ZTj8HyeH+UkqvLPF3YVuLk=";
   };
 
   # I tried to package sphinx-selective-exclude, but it throws
@@ -49,6 +49,10 @@ buildPythonPackage rec {
 
   postUnpack = "sourceRoot=$sourceRoot/hypothesis-python";
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     attrs
     sortedcontainers
diff --git a/pkgs/development/python-modules/hypothesmith/default.nix b/pkgs/development/python-modules/hypothesmith/default.nix
index d6ce47e38050..5754612b1f29 100644
--- a/pkgs/development/python-modules/hypothesmith/default.nix
+++ b/pkgs/development/python-modules/hypothesmith/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "hypothesmith";
-  version = "0.3.0";
+  version = "0.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Uj2gTAY7hzko1sKO8WUGz2S/MXdwOYN+F+a73G4szNs=";
+    hash = "sha256-h5kXemST6DLIF0aEKoaGdSs7G7lTDW6DK64XWEENrzo=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/iaqualink/default.nix b/pkgs/development/python-modules/iaqualink/default.nix
index 6e72b5a8519b..56dde70d3e3b 100644
--- a/pkgs/development/python-modules/iaqualink/default.nix
+++ b/pkgs/development/python-modules/iaqualink/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-ewPP2Xq+ecZGc5kokvLEsRokGqTWlymrzkwk480tapk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/ibis-framework/default.nix b/pkgs/development/python-modules/ibis-framework/default.nix
index 9b77a6be51d0..8c2e49a6e4e5 100644
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@@ -63,14 +63,15 @@ let
     name = "ibis-testing-data";
     owner = "ibis-project";
     repo = "testing-data";
-    rev = "2b3968deaa1a28791b2901dbbcc9bfd3d2f23e9b";
-    hash = "sha256-q1b5IcOl5oIFXP7/P5RufncjHEVrWp4NjoU2uo/BE9U=";
+    # https://github.com/ibis-project/ibis/blob/7.1.0/nix/overlay.nix#L20-L26
+    rev = "2c6a4bb5d5d525058d8d5b2312a9fee5dafc5476";
+    hash = "sha256-Lq503bqh9ESZJSk6yVq/uZwkAubzmSmoTBZSsqMm0DY=";
   };
 in
 
 buildPythonPackage rec {
   pname = "ibis-framework";
-  version = "6.1.0";
+  version = "7.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -80,7 +81,7 @@ buildPythonPackage rec {
     repo = "ibis";
     owner = "ibis-project";
     rev = "refs/tags/${version}";
-    hash = "sha256-+AtXgRNxPryP/fd/GQlLNxWbP6ozikqG2yBCp3dE0tY=";
+    hash = "sha256-E7jryoidw6+CjTIex4wcTXcU+8Kg8LDwg7wJvcwj+7Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/icecream/default.nix b/pkgs/development/python-modules/icecream/default.nix
index 601a55e80f6e..db9e56bb8b6e 100644
--- a/pkgs/development/python-modules/icecream/default.nix
+++ b/pkgs/development/python-modules/icecream/default.nix
@@ -1,18 +1,56 @@
-{ lib, buildPythonPackage, fetchPypi
-, asttokens, colorama, executing, pygments
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, setuptools
+
+# dependencies
+, asttokens
+, colorama
+, executing
+, pygments
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "icecream";
   version = "2.1.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-CqSnwzdOw2FTodCPgeMIDoPYrB7v2X0vT+lUTo+bSd4=";
   };
 
-  propagatedBuildInputs = [ asttokens colorama executing pygments ];
+  postPatch = ''
+    substituteInPlace tests/test_icecream.py \
+      --replace assertRegexpMatches assertRegex
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    asttokens
+    colorama
+    executing
+    pygments
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # icecream.icecream.NoSourceAvailableError
+    "testSingledispatchArgumentToString"
+    # AssertionError: assert [[('REPL (e.g...ion?', None)]] == [[('a', '1')], [('c', '3')]]
+    "testEnableDisable"
+  ];
 
   meta = with lib; {
     description = "A little library for sweet and creamy print debugging";
diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index a21125c2379e..77aeb4483dc3 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "idna";
-  version = "3.4";
+  version = "3.6";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gU9Sjo3q19MpgzuRxfqofWC/cYJM0Sp1MLVSYGPQLLQ=";
+    hash = "sha256-ns270IOwZ5iuHoaty/6KsUec+GTk7jD+TkagA9Ekkco=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ifcopenshell/default.nix b/pkgs/development/python-modules/ifcopenshell/default.nix
index eb1c71601c92..99f2ae1c6276 100644
--- a/pkgs/development/python-modules/ifcopenshell/default.nix
+++ b/pkgs/development/python-modules/ifcopenshell/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "ifcopenshell";
-  version = "230915";
+  version = "231201";
   format = "other";
 
   src = fetchFromGitHub {
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     repo   = "IfcOpenShell";
     rev = "refs/tags/blenderbim-${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-dHw+5AlJbeuUeaxv7eE2XfLjR/K5S00dMSCtoWVcEB8=";
+    sha256 = "sha256-T7XT5gvfzhagecB3jrTyWOawOm4iye7SCsmYhnjtOTE=";
   };
 
   nativeBuildInputs = [ gcc10 cmake ];
diff --git a/pkgs/development/python-modules/immutabledict/default.nix b/pkgs/development/python-modules/immutabledict/default.nix
index 555fa80acd64..5d762be3fb86 100644
--- a/pkgs/development/python-modules/immutabledict/default.nix
+++ b/pkgs/development/python-modules/immutabledict/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "immutabledict";
-  version = "3.0.0";
+  version = "4.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "corenting";
     repo = "immutabledict";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DsvKtiy9sawGKpQu3f5OMUtE2Emq3Br8FupopUcLVew=";
+    hash = "sha256-z03s2mOJiMVnvLmeFJFgCRvkP+9VUcALiIoIPBAHUPw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/importlib-metadata/default.nix b/pkgs/development/python-modules/importlib-metadata/default.nix
index b4c20163cb7a..8e8346fffdd7 100644
--- a/pkgs/development/python-modules/importlib-metadata/default.nix
+++ b/pkgs/development/python-modules/importlib-metadata/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "importlib-metadata";
-  version = "6.8.0";
+  version = "6.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "importlib_metadata";
     inherit version;
-    hash = "sha256-26zniS2MDErBrQlmYiMvgx1OZPTEVFvVMBaj6dRlR0M=";
+    hash = "sha256-6Ky1I8M1qRgiZ04Um0bAOZ7E0yjE0fbknCc9pf8CAbk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index 8b6afb522b6a..80533173c9bb 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "importlib-resources";
-  version = "6.0.1";
+  version = "6.1.1";
   format = "pyproject";
   disabled = isPy27;
 
   src = fetchPypi {
     pname = "importlib_resources";
     inherit version;
-    hash = "sha256-Q1lFfkJwhGK5YmoEZXxiCK15nOtB5cWMV/+g5qCYpdQ=";
+    hash = "sha256-OJOgASLq/eaJTFmRREalEvcooMGkX5u5tjchtrrPC0o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/imread/default.nix b/pkgs/development/python-modules/imread/default.nix
index 9d5ea1bebd20..4e3b4294991c 100644
--- a/pkgs/development/python-modules/imread/default.nix
+++ b/pkgs/development/python-modules/imread/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "python-imread";
-  version = "0.7.4";
+  version = "0.7.5";
 
   src = fetchPypi {
     inherit version;
     pname = "imread";
-    sha256 = "0kvlpy62vc16i0mysv1b2gv746in41q75hb815q6h8d227psv1q4";
+    sha256 = "sha256-GiWpA128GuLlbBW1CQQHHVVeoZfu9Yyh2RFzSdtHDbc=";
   };
 
 
diff --git a/pkgs/development/python-modules/inflect/default.nix b/pkgs/development/python-modules/inflect/default.nix
index 10f5a56763ef..d6317d00841b 100644
--- a/pkgs/development/python-modules/inflect/default.nix
+++ b/pkgs/development/python-modules/inflect/default.nix
@@ -24,6 +24,11 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = [
+    # https://errors.pydantic.dev/2.5/v/string_too_short
+    "inflect.engine.compare"
+  ];
+
   pythonImportsCheck = [ "inflect" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ipadic/default.nix b/pkgs/development/python-modules/ipadic/default.nix
index 841eccc9e157..bb7724a50576 100644
--- a/pkgs/development/python-modules/ipadic/default.nix
+++ b/pkgs/development/python-modules/ipadic/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
   # no tests
   doCheck = false;
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ cython mecab setuptools-scm ];
 
   pythonImportsCheck = [ "ipadic" ];
diff --git a/pkgs/development/python-modules/ipython-genutils/default.nix b/pkgs/development/python-modules/ipython-genutils/default.nix
index e3a7b6c0a444..c11c63797f0a 100644
--- a/pkgs/development/python-modules/ipython-genutils/default.nix
+++ b/pkgs/development/python-modules/ipython-genutils/default.nix
@@ -4,6 +4,7 @@
 , setuptools
 , nose
 , pytestCheckHook
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
@@ -11,6 +12,9 @@ buildPythonPackage rec {
   version = "0.2.0";
   pyproject = true;
 
+  # uses the imp module, upstream says "DO NOT USE"
+  disabled = pythonAtLeast "3.12";
+
   src = fetchPypi {
     pname = "ipython_genutils";
     inherit version;
diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index a730531bf873..09121fb1f24a 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -29,13 +29,13 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "8.15.0";
+  version = "8.18.1";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-K661vmlJ7uv1MhUPgXRvgzPizM4C3hx+7d4/I+1enx4=";
+    sha256 = "sha256-ym8Hm7M0V8ZuIz5FgOv8QSiFW0z2Nw3d1zhCqVY+iic=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/islpy/default.nix b/pkgs/development/python-modules/islpy/default.nix
index c91e44f7825f..ca84beae2eef 100644
--- a/pkgs/development/python-modules/islpy/default.nix
+++ b/pkgs/development/python-modules/islpy/default.nix
@@ -10,13 +10,14 @@
 
 buildPythonPackage rec {
   pname = "islpy";
-  version = "2023.1.2";
+  version = "2023.2.5";
   format = "setuptools";
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-NsNI1N9ZuNYWr1i3dl7hSaTP3jdsTYsIpoF98vrZG9Y=";
+    sha256 = "sha256-3XQ5i682k4q7fCqdmCjMGi5UnGyASFzsiwaymr+q0Y8=";
   };
 
   postConfigure = ''
diff --git a/pkgs/development/python-modules/iso8601/default.nix b/pkgs/development/python-modules/iso8601/default.nix
index ade0c71ee887..a4982c27f852 100644
--- a/pkgs/development/python-modules/iso8601/default.nix
+++ b/pkgs/development/python-modules/iso8601/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "iso8601";
-  version = "2.0.0";
+  version = "2.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-c5lg03x0x3vZvVRqdlYsy1gf49SCD/XDFB60nIOf2o8=";
+    hash = "sha256-ax04Ke6JIcQwGZjJCfeCn6ntPL2sDTsWry10Ou0bqN8=";
   };
 
   nativeBuildInputs = [
@@ -41,6 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Simple module to parse ISO 8601 dates";
     homepage = "https://pyiso8601.readthedocs.io/";
+    changelog = "https://github.com/micktwomey/pyiso8601/blob/${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/iterative-telemetry/default.nix b/pkgs/development/python-modules/iterative-telemetry/default.nix
index c6e211539103..670b473e6195 100644
--- a/pkgs/development/python-modules/iterative-telemetry/default.nix
+++ b/pkgs/development/python-modules/iterative-telemetry/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-n67nc9a/Qrz2v1EYbHZb+pGhuMDqofUMpgfD/0BwqLM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/itsdangerous/default.nix b/pkgs/development/python-modules/itsdangerous/default.nix
index 3810eabf46c7..cfc364a4a399 100644
--- a/pkgs/development/python-modules/itsdangerous/default.nix
+++ b/pkgs/development/python-modules/itsdangerous/default.nix
@@ -22,6 +22,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pytestFlagsArray = [
+    "-W" "ignore::DeprecationWarning"
+  ];
+
   meta = with lib; {
     description = "Safely pass data to untrusted environments and back";
     homepage = "https://itsdangerous.palletsprojects.com";
diff --git a/pkgs/development/python-modules/jaraco-abode/default.nix b/pkgs/development/python-modules/jaraco-abode/default.nix
index cbd739d5a955..821c11b01e27 100644
--- a/pkgs/development/python-modules/jaraco-abode/default.nix
+++ b/pkgs/development/python-modules/jaraco-abode/default.nix
@@ -3,7 +3,6 @@
 , bx-py-utils
 , colorlog
 , fetchFromGitHub
-, fetchPypi
 , importlib-resources
 , jaraco-classes
 , jaraco-collections
@@ -40,6 +39,10 @@ buildPythonPackage rec {
   postPatch = ''
     # https://github.com/jaraco/jaraco.abode/issues/19
     echo "graft jaraco" > MANIFEST.in
+
+    # https://github.com/jaraco/jaraco.abode/commit/9e3e789efc96cddcaa15f920686bbeb79a7469e0
+    substituteInPlace jaraco/abode/helpers/timeline.py \
+      --replace "call_aside" "invoke"
   '';
 
   nativeBuildInputs = [
@@ -47,8 +50,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     requests
     lomond
diff --git a/pkgs/development/python-modules/jaraco-classes/default.nix b/pkgs/development/python-modules/jaraco-classes/default.nix
index 317fc3e3dc1a..6364f89e4cac 100644
--- a/pkgs/development/python-modules/jaraco-classes/default.nix
+++ b/pkgs/development/python-modules/jaraco-classes/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
 
   pythonNamespaces = [ "jaraco" ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
 
   propagatedBuildInputs = [ more-itertools ];
diff --git a/pkgs/development/python-modules/jaraco-collections/default.nix b/pkgs/development/python-modules/jaraco-collections/default.nix
index 1d8f9a8f2241..3c0d0b6a9aa6 100644
--- a/pkgs/development/python-modules/jaraco-collections/default.nix
+++ b/pkgs/development/python-modules/jaraco-collections/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     jaraco-classes
     jaraco-text
diff --git a/pkgs/development/python-modules/jaraco-context/default.nix b/pkgs/development/python-modules/jaraco-context/default.nix
index 7a882c80195c..637e23b2cdd8 100644
--- a/pkgs/development/python-modules/jaraco-context/default.nix
+++ b/pkgs/development/python-modules/jaraco-context/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-YdbkpKv7k62uyhmjKoxeA9uf5BWnRD/rK+z46FJN4xk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonNamespaces = [
     "jaraco"
   ];
diff --git a/pkgs/development/python-modules/jaraco-email/default.nix b/pkgs/development/python-modules/jaraco-email/default.nix
index b23d9504dea1..7e4ca68deb04 100644
--- a/pkgs/development/python-modules/jaraco-email/default.nix
+++ b/pkgs/development/python-modules/jaraco-email/default.nix
@@ -45,8 +45,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     jaraco-text
     jaraco-collections
diff --git a/pkgs/development/python-modules/jaraco-functools/default.nix b/pkgs/development/python-modules/jaraco-functools/default.nix
index 0cc2fa124db5..28a7d64e11f9 100644
--- a/pkgs/development/python-modules/jaraco-functools/default.nix
+++ b/pkgs/development/python-modules/jaraco-functools/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "jaraco-functools";
-  version = "3.9.0";
+  version = "4.0.0";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "jaraco.functools";
     inherit version;
-    hash = "sha256-ixN7D+rMF/70us7gTAEcnobyNBCZyHCh0S0743sypjg=";
+    hash = "sha256-wnnLJMk9aU73Jw+XDUmcq004E/TggnP5U5hlGmNPCSU=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/jaraco-net/default.nix b/pkgs/development/python-modules/jaraco-net/default.nix
index 565395d84023..4765c1dc301c 100644
--- a/pkgs/development/python-modules/jaraco-net/default.nix
+++ b/pkgs/development/python-modules/jaraco-net/default.nix
@@ -49,8 +49,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     more-itertools
     beautifulsoup4
diff --git a/pkgs/development/python-modules/jaraco-text/default.nix b/pkgs/development/python-modules/jaraco-text/default.nix
index eacbf2cbfd96..5f6bc4021c0f 100644
--- a/pkgs/development/python-modules/jaraco-text/default.nix
+++ b/pkgs/development/python-modules/jaraco-text/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "jaraco-text";
-  version = "3.11.1";
+  version = "3.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "jaraco.text";
     inherit version;
-    hash = "sha256-Mzpd8hSPcTlxhgfN81L+HZUWKXGnKZw4Dcwk2rAWiYA=";
+    hash = "sha256-OJ4lyNSzLpcVv1MFlvqw9c06pHKW5DlpOS4YpUGvWSw=";
   };
 
   pythonNamespaces = [
diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index 1fb7b26db5b3..1b154f90d386 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, python
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
@@ -10,13 +11,11 @@
 , pallets-sphinx-themes
 , sphinxcontrib-log-cabinet
 , sphinx-issues
-, enableDocumentation ? false
 }:
 
 buildPythonPackage rec {
   pname = "Jinja2";
   version = "3.1.2";
-  outputs = [ "out" ] ++ lib.optional enableDocumentation "doc";
 
   disabled = pythonOlder "3.7";
 
@@ -25,20 +24,11 @@ buildPythonPackage rec {
     hash = "sha256-MTUacCpAip51laj8YVD8P0O7a/fjGXcMvA2535Q36FI=";
   };
 
-  patches = lib.optionals enableDocumentation [ ./patches/import-order.patch ];
-
   propagatedBuildInputs = [
     babel
     markupsafe
   ];
 
-  nativeBuildInputs = lib.optionals enableDocumentation [
-    sphinxHook
-    sphinxcontrib-log-cabinet
-    pallets-sphinx-themes
-    sphinx-issues
-  ];
-
   # Multiple tests run out of stack space on 32bit systems with python2.
   # See https://github.com/pallets/jinja/issues/1158
   doCheck = !stdenv.is32bit;
@@ -54,6 +44,35 @@ buildPythonPackage rec {
     "-p no:warnings"
   ];
 
+  passthru = {
+    doc = stdenv.mkDerivation {
+      # Forge look and feel of multi-output derivation as best as we can.
+      #
+      # Using 'outputs = [ "doc" ];' breaks a lot of assumptions.
+      name = "${pname}-${version}-doc";
+      inherit src pname version;
+
+      patches = [
+        # Fix import of "sphinxcontrib-log-cabinet"
+        ./patches/import-order.patch
+      ];
+
+      postInstallSphinx = ''
+        mv $out/share/doc/* $out/share/doc/python$pythonVersion-$pname-$version
+      '';
+
+      nativeBuildInputs = [
+        sphinxHook
+        sphinxcontrib-log-cabinet
+        pallets-sphinx-themes
+        sphinx-issues
+      ];
+
+      inherit (python) pythonVersion;
+      inherit meta;
+    };
+  };
+
   meta = with lib; {
     homepage = "https://jinja.palletsprojects.com/";
     description = "Stand-alone template engine";
diff --git a/pkgs/development/python-modules/jira/default.nix b/pkgs/development/python-modules/jira/default.nix
index fa7e2b18e6f4..9b8a808b878f 100644
--- a/pkgs/development/python-modules/jira/default.nix
+++ b/pkgs/development/python-modules/jira/default.nix
@@ -3,22 +3,28 @@
 , fetchFromGitHub
 , defusedxml
 , flaky
+, ipython
 , keyring
+, packaging
+, pyjwt
+, pytestCheckHook
+, pythonOlder
+, requests
+, requests-futures
 , requests-mock
 , requests-oauthlib
 , requests-toolbelt
+, setuptools
 , setuptools-scm
-, setuptools-scm-git-archive
-, pytestCheckHook
-, pythonOlder
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "jira";
   version = "3.5.2";
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pycontribs";
@@ -28,19 +34,35 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
-    setuptools-scm-git-archive
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     defusedxml
-    keyring
+    packaging
+    requests
     requests-oauthlib
     requests-toolbelt
+    typing-extensions
   ];
 
+  passthru.optional-dependencies = {
+    cli = [
+      ipython
+      keyring
+    ];
+    opt = [
+      # filemagic
+      pyjwt
+      # requests-jwt
+      # requests-keyberos
+    ];
+    async = [
+      requests-futures
+    ];
+  };
+
   nativeCheckInputs = [
     flaky
     pytestCheckHook
@@ -65,5 +87,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/pycontribs/jira/releases/tag/${version}";
     license = licenses.bsd2;
     maintainers = with maintainers; [ ];
+    mainProgram = "jirashell";
   };
 }
diff --git a/pkgs/development/python-modules/joblib/default.nix b/pkgs/development/python-modules/joblib/default.nix
index 76eea5097581..298a2ce83adf 100644
--- a/pkgs/development/python-modules/joblib/default.nix
+++ b/pkgs/development/python-modules/joblib/default.nix
@@ -2,6 +2,8 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, fetchpatch
+, pythonAtLeast
 , stdenv
 
 # build-system
@@ -30,6 +32,14 @@ buildPythonPackage rec {
     hash = "sha256-kvhl5iHhd4TnlVCAttBCSJ47jilJScxExurDBPWXcrE=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "suppress-deprecation-warnings-with-python312.patch";
+      url = "https://github.com/joblib/joblib/commit/05caf0772d605799e5d2337018fd32ac829b37aa.patch";
+      hash = "sha256-bfqxCLFkCnuWMIkIbcjh+nCTv38A8jxvyCHeJPxoZwg=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
   ];
@@ -54,6 +64,10 @@ buildPythonPackage rec {
     "test_nested_parallel_warnings" # tests is flaky under load
   ] ++ lib.optionals stdenv.isDarwin [
     "test_dispatch_multiprocessing" # test_dispatch_multiprocessing is broken only on Darwin.
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # deprecation warnings with python3.12 https://github.com/joblib/joblib/issues/1478
+    "test_main_thread_renamed_no_warning"
+    "test_background_thread_parallelism"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/josepy/default.nix b/pkgs/development/python-modules/josepy/default.nix
index f8a76641f537..1206c816b3d8 100644
--- a/pkgs/development/python-modules/josepy/default.nix
+++ b/pkgs/development/python-modules/josepy/default.nix
@@ -1,8 +1,8 @@
 { lib
 , buildPythonPackage
 , cryptography
-, fetchpatch
 , fetchPypi
+, poetry-core
 , pyopenssl
 , pytestCheckHook
 , pythonOlder
@@ -10,24 +10,18 @@
 
 buildPythonPackage rec {
   pname = "josepy";
-  version = "1.13.0";
-  format = "setuptools";
+  version = "1.14.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iTHa84+KTIUnSg6LfLJa3f2NHyj5+4++0FPdUa7HXck=";
+    hash = "sha256-MIs7+c6CWtTUu6djcs8ZtdwcLOlqnSmPlkKXXmS9E90=";
   };
 
-  patches = [
-    # https://github.com/certbot/josepy/pull/158
-    (fetchpatch {
-      name = "fix-setuptools-deprecation.patch";
-      url = "https://github.com/certbot/josepy/commit/8f1b4b57a29a868a87fd6eee19a67a7ebfc07ea1.patch";
-      hash = "sha256-9d+Bk/G4CJXpnjJU0YkXLsg0G3tPxR8YN2niqriQQkI=";
-      includes = [ "tests/test_util.py" ];
-    })
+  nativeBuildInputs = [
+    poetry-core
   ];
 
   propagatedBuildInputs = [
@@ -39,20 +33,15 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pytest.ini \
-      --replace " --flake8 --cov-report xml --cov-report=term-missing --cov=josepy --cov-config .coveragerc" ""
-    sed -i '/flake8-ignore/d' pytest.ini
-  '';
-
   pythonImportsCheck = [
     "josepy"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/certbot/josepy/blob/v${version}/CHANGELOG.rst";
     description = "JOSE protocol implementation in Python";
-    homepage = "https://github.com/jezdez/josepy";
+    homepage = "https://github.com/certbot/josepy";
     license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/jproperties/default.nix b/pkgs/development/python-modules/jproperties/default.nix
index c67fea93b13a..b7c2a1e296ef 100644
--- a/pkgs/development/python-modules/jproperties/default.nix
+++ b/pkgs/development/python-modules/jproperties/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-O+ALeGHMNjW1dc9IRyLzO81k8DW2vbGjuZqXxgrhYjo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/jq/default.nix b/pkgs/development/python-modules/jq/default.nix
index d7dc37b06852..5b369d513cb1 100644
--- a/pkgs/development/python-modules/jq/default.nix
+++ b/pkgs/development/python-modules/jq/default.nix
@@ -2,15 +2,15 @@
 , buildPythonPackage
 , cython
 , fetchFromGitHub
-, fetchpatch
 , jq
+, oniguruma
 , pytestCheckHook
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "jq";
-  version = "1.5.0";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,18 +19,10 @@ buildPythonPackage rec {
     owner = "mwilliamson";
     repo = "jq.py";
     rev = "refs/tags/${version}";
-    hash = "sha256-mITk5y2AdUc9kZ/WrsnHxS1GRRmO4FDbPRgTtV2gIXI=";
+    hash = "sha256-c6tJI/mPlBGIYTk5ObIQ1CUTq73HouQ2quMZVWG8FFg=";
   };
 
-  patches = [
-    # Removes vendoring
-    ./jq-py-setup.patch
-    (fetchpatch {
-      url = "https://github.com/mwilliamson/jq.py/commit/805705dde4beb9db9a1743663d415198fb02eb1a.patch";
-      includes = [ "tests/*" ];
-      hash = "sha256-AgdpwmtOTeJ4nSbM6IknKaIVqqtWkpxTTtblXjlbWeA=";
-    })
-  ];
+  env.JQPY_USE_SYSTEM_LIBS = 1;
 
   nativeBuildInputs = [
     cython
@@ -38,6 +30,7 @@ buildPythonPackage rec {
 
   buildInputs = [
     jq
+    oniguruma
   ];
 
   preBuild = ''
@@ -48,6 +41,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # intentional behavior change in jq 1.7.1 not reflected upstream
+    "test_given_json_text_then_strings_containing_null_characters_are_preserved"
+  ];
+
   pythonImportsCheck = [
     "jq"
   ];
diff --git a/pkgs/development/python-modules/js2py/default.nix b/pkgs/development/python-modules/js2py/default.nix
index e0769f4ffa19..3630c0b38eaf 100644
--- a/pkgs/development/python-modules/js2py/default.nix
+++ b/pkgs/development/python-modules/js2py/default.nix
@@ -1,6 +1,8 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+, pythonAtLeast
+, setuptools
 , tzlocal
 , six
 , pyjsparser
@@ -9,7 +11,11 @@
 buildPythonPackage rec {
   pname = "js2py";
   version = "0.74";
-  format = "setuptools";
+  pyproject = true;
+
+  # broken with Python 3.12
+  # https://github.com/PiotrDabkowski/Js2Py/issues/317
+  disabled = pythonAtLeast "3.12";
 
   src = fetchPypi {
     pname = "Js2Py";
@@ -17,6 +23,10 @@ buildPythonPackage rec {
     hash = "sha256-OfOmqoRpGA77o8hncnHfJ8MTMv0bRx3xryr1i4e4ly8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyjsparser
     six
diff --git a/pkgs/development/python-modules/jsonpickle/default.nix b/pkgs/development/python-modules/jsonpickle/default.nix
index 7b925777b2d7..bff05f256247 100644
--- a/pkgs/development/python-modules/jsonpickle/default.nix
+++ b/pkgs/development/python-modules/jsonpickle/default.nix
@@ -1,42 +1,49 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytest
+, pythonAtLeast
+
+# build-system
+, setuptools
 , setuptools-scm
-, toml
-, importlib-metadata
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "jsonpickle";
   version = "3.0.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-43q7pL+zykpGR9KLufRwZDb3tGyKgzO0pxirr6jkazc=";
   };
 
-  nativeCheckInputs = [ pytest ];
-
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
-    toml
-  ];
-
-  propagatedBuildInputs = [
-    importlib-metadata
   ];
 
-  checkPhase = ''
+  preCheck = ''
     rm pytest.ini
-    pytest tests/jsonpickle_test.py
   '';
 
-  meta = {
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # imports distutils
+    "test_thing_with_submodule"
+  ];
+
+  meta = with lib; {
     description = "Python library for serializing any arbitrary object graph into JSON";
+    downloadPage = "https://github.com/jsonpickle/jsonpickle";
     homepage = "http://jsonpickle.github.io/";
-    license = lib.licenses.bsd3;
+    license = licenses.bsd3;
   };
 
 }
diff --git a/pkgs/development/python-modules/jsonschema-path/default.nix b/pkgs/development/python-modules/jsonschema-path/default.nix
new file mode 100644
index 000000000000..598b0fdf3e83
--- /dev/null
+++ b/pkgs/development/python-modules/jsonschema-path/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, poetry-core
+, pathable
+, pyyaml
+, referencing
+, pytestCheckHook
+, responses
+}:
+
+buildPythonPackage rec {
+  pname = "jsonschema-path";
+  version = "0.3.2";
+
+  disabled = pythonOlder "3.8";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "p1c2u";
+    repo = "jsonschema-path";
+    rev = version;
+    hash = "sha256-HC0yfACKFIQEQoIa8/FUKyV8YS8TQ0BY7i3n9xCdKz8=";
+  };
+
+  postPatch = ''
+    sed -i '/--cov/d' pyproject.toml
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    pathable
+    pyyaml
+    referencing
+  ];
+
+  pythonImportsCheck = [ "jsonschema_path" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    responses
+  ];
+
+  meta = {
+    description = "JSONSchema Spec with object-oriented paths";
+    homepage = "https://github.com/p1c2u/jsonschema-path";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/jsonschema-spec/default.nix b/pkgs/development/python-modules/jsonschema-spec/default.nix
index 0da22f2cf98f..7e8c668a0791 100644
--- a/pkgs/development/python-modules/jsonschema-spec/default.nix
+++ b/pkgs/development/python-modules/jsonschema-spec/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 
 # build
 , poetry-core
@@ -40,6 +41,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "referencing"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jsonschema-specifications/default.nix b/pkgs/development/python-modules/jsonschema-specifications/default.nix
index 54b8d6df6ea1..07fd3dcd5895 100644
--- a/pkgs/development/python-modules/jsonschema-specifications/default.nix
+++ b/pkgs/development/python-modules/jsonschema-specifications/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "jsonschema-specifications";
-  version = "2023.7.1";
+  version = "2023.11.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "jsonschema_specifications";
     inherit version;
-    hash = "sha256-yRpQQE6Iofa6QGNneOLuCPbiTFYT/kxTrCRXilp/crs=";
+    hash = "sha256-lHL8T+pHTNdL6korGQ2uzLWp5NsuqA7896G1gvyagbg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jsonschema/default.nix b/pkgs/development/python-modules/jsonschema/default.nix
index d8c235efed23..10074463f80a 100644
--- a/pkgs/development/python-modules/jsonschema/default.nix
+++ b/pkgs/development/python-modules/jsonschema/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "jsonschema";
-  version = "4.19.0";
+  version = "4.20.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bh51aawTvoE5st0sIaVdNQBm7j+A3wbGCLOYzcbzDo8=";
+    hash = "sha256-T2FP1G2NYSWGEJmJl3Q+xUkqZIszz0eMHdwj7UWYpfo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jupyter-book/default.nix b/pkgs/development/python-modules/jupyter-book/default.nix
index 631a853833d4..69d0734bfa00 100644
--- a/pkgs/development/python-modules/jupyter-book/default.nix
+++ b/pkgs/development/python-modules/jupyter-book/default.nix
@@ -65,7 +65,10 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "docutils"
-    "sphinx-design"
+    "myst-nb"
+    "sphinx"
+    "sphinx-thebe"
+    "sphinxcontrib-bibtex"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/jupyter-lsp/default.nix b/pkgs/development/python-modules/jupyter-lsp/default.nix
index fd8820bcb1d4..1cc43ebc6001 100644
--- a/pkgs/development/python-modules/jupyter-lsp/default.nix
+++ b/pkgs/development/python-modules/jupyter-lsp/default.nix
@@ -1,20 +1,24 @@
-{ stdenv
-, lib
+{ lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , jupyter-server
 }:
 
 buildPythonPackage rec {
   pname = "jupyter-lsp";
-  version = "2.2.0";
-  format = "setuptools";
+  version = "2.2.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jrvLUzrbQeXWNeuP6ClWsKr78P1EO2xL+pBu3uuGNaE=";
+    hash = "sha256-sX+rbXD+g8iJawz/WSN2QAOCR8GWBWtDaEoJArap4Ps=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     jupyter-server
   ];
diff --git a/pkgs/development/python-modules/jupyterlab-lsp/default.nix b/pkgs/development/python-modules/jupyterlab-lsp/default.nix
index 82d912923895..004bddfbe8ac 100644
--- a/pkgs/development/python-modules/jupyterlab-lsp/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-lsp/default.nix
@@ -1,20 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , jupyterlab
 , jupyter-lsp
 }:
 
 buildPythonPackage rec {
   pname = "jupyterlab-lsp";
-  version = "5.0.0";
-  format = "setuptools";
+  version = "5.0.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-D4jiaAPQ8+TIyL7wip+GHycGp3ym1NkvZQJsCelYFks=";
+    hash = "sha256-jQ8mhTfZ+6F9EgDfBWVI6I/I3n2lIlJs+mM0OJ0MKTQ=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     jupyterlab
     jupyter-lsp
diff --git a/pkgs/development/python-modules/jupyterlab-server/default.nix b/pkgs/development/python-modules/jupyterlab-server/default.nix
index a408137650ac..4eed7af804c0 100644
--- a/pkgs/development/python-modules/jupyterlab-server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-server/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab-server";
-  version = "2.25.1";
+  version = "2.25.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "jupyterlab_server";
     inherit version;
-    hash = "sha256-ZJEoOwAAaY6uGjjEhQeTBWDfz3RhrqABU2hpiqs03Zw=";
+    hash = "sha256-vQ7HqZ687ci8/5Oe+G5Sw3jkTCcH4FP82B0EbOl57mM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/kanidm/default.nix b/pkgs/development/python-modules/kanidm/default.nix
index eb60f61d5f3c..fc53fc81ed70 100644
--- a/pkgs/development/python-modules/kanidm/default.nix
+++ b/pkgs/development/python-modules/kanidm/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, fetchpatch
+, fetchFromGitHub
 , pythonOlder
 
 # build
@@ -9,6 +8,7 @@
 
 # propagates
 , aiohttp
+, authlib
 , pydantic
 , toml
 
@@ -20,25 +20,30 @@
 
 let
   pname = "kanidm";
-  version = "0.0.3";
+  version = "0.0.3-unstable-2023-08-23";
 in
 buildPythonPackage {
   inherit pname version;
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-sTkAKxtJa7CVYKuXC//eMmf3l8ABsrEr2mdf1r2Gf9A=";
+  src = fetchFromGitHub {
+    owner = "kanidm";
+    repo = "kanidm";
+    rev = "def4420c4c5c3ec4f9b02776e1d5fdb07aa3a729";
+    hash = "sha256-5qQb+Itguw2v1Wdvc2vp00zglfvNd3LFEDvaweRJcOc=";
   };
 
+  sourceRoot = "source/pykanidm";
+
   nativeBuildInputs = [
     poetry-core
   ];
 
   propagatedBuildInputs = [
     aiohttp
+    authlib
     pydantic
     toml
   ];
diff --git a/pkgs/development/python-modules/kbcstorage/default.nix b/pkgs/development/python-modules/kbcstorage/default.nix
index 04d5b17c55e9..ec41ce9f27f9 100644
--- a/pkgs/development/python-modules/kbcstorage/default.nix
+++ b/pkgs/development/python-modules/kbcstorage/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     hash = "sha256-74sChw6eMkBtfHV6hiaaLNOr/J0Sa73LB93Z8muLaiI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-git-versioning
diff --git a/pkgs/development/python-modules/keras/default.nix b/pkgs/development/python-modules/keras/default.nix
index f5275ea1a2a6..b91925b574e6 100644
--- a/pkgs/development/python-modules/keras/default.nix
+++ b/pkgs/development/python-modules/keras/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "keras";
-  version = "2.14.0";
+  version = "3.0.0";
   format = "wheel";
 
   src = fetchPypi {
     inherit format pname version;
-    hash = "sha256-10KdHSExzH6x8uouwzAifH2dONqz398ueN7+5OzEP80=";
+    hash = "sha256-/z8++iqlzBNLHYuFaTqrMlWLHZyGBjChP1iTTm0ckI0=";
     python = "py3";
     dist = "py3";
   };
diff --git a/pkgs/development/python-modules/keystoneauth1/default.nix b/pkgs/development/python-modules/keystoneauth1/default.nix
index 815ef3aa3104..c3e13d8b0fc4 100644
--- a/pkgs/development/python-modules/keystoneauth1/default.nix
+++ b/pkgs/development/python-modules/keystoneauth1/default.nix
@@ -15,6 +15,7 @@
 , requests
 , requests-kerberos
 , requests-mock
+, setuptools
 , six
 , stestr
 , stevedore
@@ -24,12 +25,12 @@
 
 buildPythonPackage rec {
   pname = "keystoneauth1";
-  version = "5.3.0";
-  format = "setuptools";
+  version = "5.4.0";
+  pyproject= true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AXwrm1mUU8kpQHUO27IPF2hxIbKJARS/nTbfFKBicRc=";
+    hash = "sha256-GsE0FRzrAuULaK143smCG/if5TvTb8hlhQHEewfL31M=";
   };
 
   postPatch = ''
@@ -38,6 +39,10 @@ buildPythonPackage rec {
     rm test-requirements.txt
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     betamax
     iso8601
diff --git a/pkgs/development/python-modules/kiss-headers/default.nix b/pkgs/development/python-modules/kiss-headers/default.nix
index 5f2906cc8cca..84eb2697eaac 100644
--- a/pkgs/development/python-modules/kiss-headers/default.nix
+++ b/pkgs/development/python-modules/kiss-headers/default.nix
@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "kiss-headers";
-  version = "2.3.1";
+  version = "2.4.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Ousret";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-xPjw/uJTmvmQZDrI3i1KTUeAZuDF1mc13hvFBl8Erh0=";
+    hash = "sha256-WeAzlC1yT+0nPSuB278z8T0XvPjbre051f/Rva5ujAk=";
   };
 
   propagatedBuildInputs = [ requests ];
diff --git a/pkgs/development/python-modules/kubernetes/default.nix b/pkgs/development/python-modules/kubernetes/default.nix
index 2b28f76d051a..bb3bd33e469e 100644
--- a/pkgs/development/python-modules/kubernetes/default.nix
+++ b/pkgs/development/python-modules/kubernetes/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "kubernetes";
-  version = "27.2.0";
+  version = "28.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "kubernetes-client";
     repo = "python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KqQ7wUu5Se4WYOdtk9vMU3M5oyz0WgIltSEliCD7s10=";
+    hash = "sha256-NKrxv5a5gkgpNG7yViTKYBYnU249taWl6fkPJa7/Rzo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/labelbox/default.nix b/pkgs/development/python-modules/labelbox/default.nix
index d79aba465eee..76c51b77a92d 100644
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@@ -99,5 +99,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/Labelbox/labelbox-python/blob/v.${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ rakesh4g ];
+    # https://github.com/Labelbox/labelbox-python/issues/1246
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/labgrid/default.nix b/pkgs/development/python-modules/labgrid/default.nix
index 4a66ff5a364a..15474fa5b659 100644
--- a/pkgs/development/python-modules/labgrid/default.nix
+++ b/pkgs/development/python-modules/labgrid/default.nix
@@ -57,10 +57,6 @@ buildPythonPackage rec {
     xmodem
   ];
 
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
-  '';
-
   nativeCheckInputs = [
     mock
     psutil
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index c2fabc40c03a..429689452a83 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -84,7 +84,7 @@
 
 buildPythonPackage rec {
   pname = "langchain";
-  version = "0.0.334";
+  version = "0.0.344";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -93,7 +93,7 @@ buildPythonPackage rec {
     owner = "hwchase17";
     repo = "langchain";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mXPqc8wF9DhEtITm8h5R9kHBcMJ7AEK4kL5Z7V2p8NE=";
+    hash = "sha256-pvoY2QuGTZhqeCi9oLOH1XrxfT4FMfHwNkIGIaYTEo8=";
   };
 
   sourceRoot = "${src.name}/libs/langchain";
diff --git a/pkgs/development/python-modules/lark/default.nix b/pkgs/development/python-modules/lark/default.nix
index 3158b626c2a6..5366311fed3c 100644
--- a/pkgs/development/python-modules/lark/default.nix
+++ b/pkgs/development/python-modules/lark/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , regex
 , pytestCheckHook
 , js2py
@@ -10,25 +9,16 @@
 
 buildPythonPackage rec {
   pname = "lark";
-  version = "1.1.7";
+  version = "1.1.8";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "lark-parser";
     repo = "lark";
     rev = "refs/tags/${version}";
-    hash = "sha256-k74tozIgJuwtUqKKmYHlfLpCWyT2hdoygRJiIpw+GDE=";
+    hash = "sha256-bGNoQeiAC2JIFOhgYUnc+nApa2ovFzXnpl9JQAE11hM=";
   };
 
-  patches = [
-    # include .lark files in package data
-    # https://github.com/lark-parser/lark/pull/1308
-    (fetchpatch {
-      url = "https://github.com/lark-parser/lark/commit/656334cb8793fd4e08a12843eaced5a7bb518be3.patch";
-      hash = "sha256-pYeNnFfXJ8xkR0KsU/KMWJ8nF+BhP9PXEANiVhT254s=";
-    })
-  ];
-
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/leidenalg/default.nix b/pkgs/development/python-modules/leidenalg/default.nix
index f1b55e0ae817..336fb029c476 100644
--- a/pkgs/development/python-modules/leidenalg/default.nix
+++ b/pkgs/development/python-modules/leidenalg/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "leidenalg";
-  version = "0.9.1";
+  version = "0.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-flz+O2+A8yuQ9V81xo1KmQsEibEoLPP6usjNpJiJdfM=";
+    hash = "sha256-RXrZaYKoC9XGVxifQt/rd+6807dEoRDlosFhjS64C0c=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/libcst/default.nix b/pkgs/development/python-modules/libcst/default.nix
index abad21fe6760..d1fc8ec75e33 100644
--- a/pkgs/development/python-modules/libcst/default.nix
+++ b/pkgs/development/python-modules/libcst/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , cargo
 , hypothesis
 , libiconv
@@ -40,14 +41,21 @@ buildPythonPackage rec {
 
   cargoRoot = "native";
 
+  patches = [
+    # https://github.com/Instagram/LibCST/pull/1042
+    (fetchpatch {
+      name = "remove-distutils.patch";
+      url = "https://github.com/Instagram/LibCST/commit/a6834aa0e6eb78e41549fd1087d7ba60ca4dd237.patch";
+      hash = "sha256-lyIXJhm4UMwdCOso6McDslIvtK7Ar8sF5Zy7qo1nicQ=";
+    })
+  ];
+
   postPatch = ''
     # avoid infinite recursion by not formatting the release files
     substituteInPlace libcst/codegen/generate.py \
       --replace '"ufmt"' '"true"'
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-rust
     setuptools-scm
diff --git a/pkgs/development/python-modules/libretranslate/default.nix b/pkgs/development/python-modules/libretranslate/default.nix
index 12e33f45895f..9dab13428a95 100644
--- a/pkgs/development/python-modules/libretranslate/default.nix
+++ b/pkgs/development/python-modules/libretranslate/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "libretranslate";
-  version = "1.3.11";
+  version = "1.5.2";
 
   format = "setuptools";
 
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "LibreTranslate";
     repo = "LibreTranslate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-S2J7kcoZFHOjVm2mb3TblWf9/FzkxZEB3h27BCaPYgY=";
+    hash = "sha256-8bbVpC53wH9GvwwHHlPEYQd/zqMXIqrwixwn4HY6FMg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/libtmux/default.nix b/pkgs/development/python-modules/libtmux/default.nix
index f94608c1b452..c0df7019ed96 100644
--- a/pkgs/development/python-modules/libtmux/default.nix
+++ b/pkgs/development/python-modules/libtmux/default.nix
@@ -12,18 +12,18 @@
 
 buildPythonPackage rec {
   pname = "libtmux";
-  version = "0.23.2";
+  version = "0.25.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "tmux-python";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-W1gBhukBooPo8uej6i8i3UxLuDeBBeSX5xU50SyjjlA=";
+    hash = "sha256-cAogRdhJdXC0lMQRlWwSHQj205mG9uwd1XkFJYsAetA=";
   };
 
   postPatch = ''
-    sed -i '/addopts/d' setup.cfg
+    sed -i '/addopts/d' pyproject.toml
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/license-expression/default.nix b/pkgs/development/python-modules/license-expression/default.nix
index 71443bb0144a..4988a3d25674 100644
--- a/pkgs/development/python-modules/license-expression/default.nix
+++ b/pkgs/development/python-modules/license-expression/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-vsQsHi2jdB0OiV6stm1APjQvr+238UoKgaaeXVx/isI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dontConfigure = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/limits/default.nix b/pkgs/development/python-modules/limits/default.nix
index 2146f1b9a0bc..f55fd087cad9 100644
--- a/pkgs/development/python-modules/limits/default.nix
+++ b/pkgs/development/python-modules/limits/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "limits";
-  version = "3.6.0";
+  version = "3.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/limits/_version.py"
     '';
-    hash = "sha256-VLfFWFcwLgEEvPUKQ00QjEq1HN28OpE6Eu1eyF+TwXU=";
+    hash = "sha256-0h3ofungHkjycUvNJ3jf+VB/GSrshgUDECN2YoPGzzg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/linear-operator/default.nix b/pkgs/development/python-modules/linear-operator/default.nix
index 7bd1f6245343..907cb9c44d73 100644
--- a/pkgs/development/python-modules/linear-operator/default.nix
+++ b/pkgs/development/python-modules/linear-operator/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-OuE6jx9Q4IU+b2a+mrglRdBOReN1tt/thetNXxwk1GI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/linode-api/default.nix b/pkgs/development/python-modules/linode-api/default.nix
index 0f210be88119..c0c54862c6e8 100644
--- a/pkgs/development/python-modules/linode-api/default.nix
+++ b/pkgs/development/python-modules/linode-api/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, setuptools
 , requests
 , pytestCheckHook
 , mock
@@ -9,8 +10,9 @@
 
 buildPythonPackage rec {
   pname = "linode-api";
-  version = "5.7.2";
-  format = "setuptools";
+  version = "5.10.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   # Sources from Pypi exclude test fixtures
@@ -18,10 +20,16 @@ buildPythonPackage rec {
     owner = "linode";
     repo = "python-linode-api";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-RU/GyNYV05iYVNanMqKMmoksXWrxTQ2H2XvaIwSSslA=";
+    hash = "sha256-LQW1AKgCbsE2OxZHtuU6zSHv7/Ak2S07O8YuoC9mS+U=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    requests
+  ];
 
   nativeCheckInputs = [
     mock
diff --git a/pkgs/development/python-modules/liquidctl/default.nix b/pkgs/development/python-modules/liquidctl/default.nix
index f6e5379fb271..70d4fc1862f0 100644
--- a/pkgs/development/python-modules/liquidctl/default.nix
+++ b/pkgs/development/python-modules/liquidctl/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     hash = "sha256-LU8rQmXrEIoOBTTFotGvMeHqksYGrtNo2YSl2l2e/UI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     installShellFiles
     setuptools
diff --git a/pkgs/development/python-modules/lit/default.nix b/pkgs/development/python-modules/lit/default.nix
index 695a23d90ac5..d7dd857c360b 100644
--- a/pkgs/development/python-modules/lit/default.nix
+++ b/pkgs/development/python-modules/lit/default.nix
@@ -1,19 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , python
 }:
 
 buildPythonPackage rec {
   pname = "lit";
-  version = "17.0.1";
-  format = "setuptools";
+  version = "17.0.6";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RIZ65Xa1eQVnsSC8Pw2fAh2slCTRsIQMdazYX0YQrAQ=";
+    hash = "sha256-36mvm1X8RQmla+e/I0bwedf0okLVg7ny4LB4/Qq64xs=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   passthru = {
     inherit python;
   };
diff --git a/pkgs/development/python-modules/lizard/default.nix b/pkgs/development/python-modules/lizard/default.nix
index 39b35e3306a9..fa3140a9f661 100644
--- a/pkgs/development/python-modules/lizard/default.nix
+++ b/pkgs/development/python-modules/lizard/default.nix
@@ -27,12 +27,19 @@ buildPythonPackage rec {
     mock
   ];
 
+  disabledTestPaths = [
+    # re.error: global flags not at the start of the expression at position 14
+    "test/test_languages/testFortran.py"
+  ];
+
   pythonImportsCheck = [
     "lizard"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/terryyin/lizard/blob/${version}/CHANGELOG.md";
     description = "Code analyzer without caring the C/C++ header files";
+    downloadPage = "https://github.com/terryyin/lizard";
     homepage = "http://www.lizard.ws";
     license = licenses.mit;
     maintainers = with maintainers; [ jpetrucciani ];
diff --git a/pkgs/development/python-modules/llvmlite/default.nix b/pkgs/development/python-modules/llvmlite/default.nix
index 925c449ae998..ac74a6e3403b 100644
--- a/pkgs/development/python-modules/llvmlite/default.nix
+++ b/pkgs/development/python-modules/llvmlite/default.nix
@@ -2,34 +2,36 @@
 , stdenv
 , fetchFromGitHub
 , buildPythonPackage
-, python
-, llvm
-, pythonOlder
 , isPyPy
-, enum34
-, isPy3k
+, pythonAtLeast
+
+# build-system
+, llvm
+, setuptools
+
+# tests
+, python
 }:
 
 buildPythonPackage rec {
   pname = "llvmlite";
-  # The main dependency of llvmlite is numba, which we currently package an
-  # untagged version of it (for numpy>1.25 support). That numba version
-  # requires at least this version of llvmlite (also not yet officially
-  # released, but at least tagged).
-  version = "0.41.0dev0";
-  format = "setuptools";
+  version = "0.41.1";
+  pyproject = true;
 
-  disabled = isPyPy || !isPy3k;
+  # uses distutils in setup.py
+  disabled = isPyPy || pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "numba";
     repo = "llvmlite";
-    rev = "v${version}";
-    hash = "sha256-fsH+rqouweNENU+YlWr7m0bC0YdreQLNp1n2rwrOiFw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RBgs8L5kOJ8BhEDLB8r8/iVhwuVIPT/rUSmwmBWm4D0=";
   };
 
-  nativeBuildInputs = [ llvm ];
-  propagatedBuildInputs = lib.optional (pythonOlder "3.4") enum34;
+  nativeBuildInputs = [
+    llvm
+    setuptools
+  ];
 
   # Disable static linking
   # https://github.com/numba/llvmlite/issues/93
@@ -45,7 +47,9 @@ buildPythonPackage rec {
   '';
 
   checkPhase = ''
+    runHook preCheck
     ${python.executable} runtests.py
+    runHook postCheck
   '';
 
   __impureHostDeps = lib.optionals stdenv.isDarwin [ "/usr/lib/libm.dylib" ];
@@ -53,7 +57,9 @@ buildPythonPackage rec {
   passthru.llvm = llvm;
 
   meta = with lib; {
+    changelog = "https://github.com/numba/llvmlite/blob/v${version}/CHANGE_LOG";
     description = "A lightweight LLVM python binding for writing JIT compilers";
+    downloadPage = "https://github.com/numba/llvmlite";
     homepage = "http://llvmlite.pydata.org/";
     license = licenses.bsd2;
     maintainers = with maintainers; [ fridh ];
diff --git a/pkgs/development/python-modules/localstack-ext/default.nix b/pkgs/development/python-modules/localstack-ext/default.nix
index 90e743f839e7..1386ce2cb712 100644
--- a/pkgs/development/python-modules/localstack-ext/default.nix
+++ b/pkgs/development/python-modules/localstack-ext/default.nix
@@ -1,14 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+
+# build-system
+, setuptools
+, plux
+
+# dependencies
+, cachetools
+, click
+, cryptography
 , dill
 , dnslib
 , dnspython
-, plux
-, pyaes
-, python-jose
+, psutil
+, python-dotenv
+, pyyaml
 , requests
-, tabulate
+, rich
+, semver
+, stevedore
+, tailer
 
 # Sensitive downstream dependencies
 , localstack
@@ -16,12 +28,12 @@
 
 buildPythonPackage rec {
   pname = "localstack-ext";
-  version = "2.3.2";
-  format = "setuptools";
+  version = "3.0.2";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ex5ZPlteDaiyex90QumucVdTTbpp9uWiBrvw1kMr++8=";
+    hash = "sha256-KNM/HjSWVwenLqtXbaRP70k7b7YXk//aKGEkBxPp1fA=";
   };
 
   postPatch = ''
@@ -38,15 +50,27 @@ buildPythonPackage rec {
       --replace "requests>=2.20.0,<2.26" "requests~=2.20"
   '';
 
+  nativeBuildInputs = [
+    plux
+    setuptools
+  ];
+
   propagatedBuildInputs = [
+    cachetools
+    click
+    cryptography
     dill
     dnslib
     dnspython
     plux
-    pyaes
-    python-jose
+    psutil
+    python-dotenv
+    pyyaml
+    rich
     requests
-    tabulate
+    semver
+    stevedore
+    tailer
   ];
 
   pythonImportsCheck = [ "localstack_ext" ];
diff --git a/pkgs/development/python-modules/localstack/default.nix b/pkgs/development/python-modules/localstack/default.nix
index 6a408c935920..39b27be9f93f 100644
--- a/pkgs/development/python-modules/localstack/default.nix
+++ b/pkgs/development/python-modules/localstack/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , apispec
 , boto3
 , cachetools
@@ -20,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "localstack";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.0.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "localstack";
     repo = "localstack";
     rev = "refs/tags/v${version}";
-    hash = "sha256-N/Mc1bubCcq38VxUqkO9LGG25pEetEyJ+VJMdg/7hrU=";
+    hash = "sha256-HncD/lhYfBrqtXF8F1Gz7JqwrASoHbsXvp1HXM5rldw=";
   };
 
   postPatch = ''
@@ -37,6 +38,10 @@ buildPythonPackage rec {
       --replace "boto3>=1.20,<1.25.0" "boto3~=1.20"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     apispec
     boto3
diff --git a/pkgs/development/python-modules/luddite/default.nix b/pkgs/development/python-modules/luddite/default.nix
index 9996e3574ce3..d6ff66594f47 100644
--- a/pkgs/development/python-modules/luddite/default.nix
+++ b/pkgs/development/python-modules/luddite/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , packaging
 , pytestCheckHook
 , pytest-mock
@@ -14,7 +15,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jumptrading";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-JXIM7/5LO95oabM16GwAt3v3a8uldGpGXDWmVic8Ins=";
   };
 
@@ -24,10 +25,22 @@ buildPythonPackage rec {
       --replace "--disable-socket" ""
   '';
 
-  propagatedBuildInputs = [ packaging ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook pytest-mock ];
-  pythonImportsCheck = [ "luddite" ];
+  propagatedBuildInputs = [
+    packaging
+  ];
+
+  pythonImportsCheck = [
+    "luddite"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-mock
+  ];
 
   meta = with lib; {
     description = "Checks for out-of-date package versions";
diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index f6016ae3a9ed..7cfef1d56cfd 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -8,20 +8,30 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.9.3-3";
+  version = "4.9.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/lxml-${version}";
-    hash = "sha256-Vrizi+6jUUEx7qODU4PAH5ZmvBIyT9H18+QpYB0m1f4=";
+    hash = "sha256-qS20wb83eFapiPZe25BViHpYkjgvnCIZpiYkPNIPHZg=";
   };
 
+  patches = [
+    # fix compile error with libxml 2.12
+    # backport of: https://github.com/lxml/lxml/commit/b0861bea17769584a85f57eb00235ce0ca9811af
+    ./libxml-2.12.patch
+  ];
+
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs
   nativeBuildInputs = [ libxml2.dev libxslt.dev cython ] ++ lib.optionals stdenv.isDarwin [ xcodebuild ];
   buildInputs = [ libxml2 libxslt zlib ];
 
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-function-pointer-types";
+  };
+
   # tests are meant to be ran "in-place" in the same directory as src
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/lxml/libxml-2.12.patch b/pkgs/development/python-modules/lxml/libxml-2.12.patch
new file mode 100644
index 000000000000..d0d211c9fe38
--- /dev/null
+++ b/pkgs/development/python-modules/lxml/libxml-2.12.patch
@@ -0,0 +1,94 @@
+From 3b8807306d79d2ae2e9fa28c5ecd3b40b32ee65b Mon Sep 17 00:00:00 2001
+From: Stefan Behnel <stefan_ml@behnel.de>
+Date: Wed, 29 Nov 2023 10:28:47 +0100
+Subject: [PATCH] Follow changes in libxml2 2.12 and make xmlError usages
+ 'const'. This mostly impacts the error callback functions.
+
+---
+ src/lxml/extensions.pxi | 4 ++--
+ src/lxml/parser.pxi     | 4 ++--
+ src/lxml/xmlerror.pxi   | 8 ++++----
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/src/lxml/extensions.pxi b/src/lxml/extensions.pxi
+index 35a321b7..42b4c4f6 100644
+--- a/src/lxml/extensions.pxi
++++ b/src/lxml/extensions.pxi
+@@ -393,7 +393,7 @@ cdef tuple LIBXML2_XPATH_ERROR_MESSAGES = (
+     b"?? Unknown error ??\n",
+ )
+ 
+-cdef void _forwardXPathError(void* c_ctxt, xmlerror.xmlError* c_error) with gil:
++cdef void _forwardXPathError(void* c_ctxt, const xmlerror.xmlError* c_error) with gil:
+     cdef xmlerror.xmlError error
+     cdef int xpath_code
+     if c_error.message is not NULL:
+@@ -414,7 +414,7 @@ cdef void _forwardXPathError(void* c_ctxt, xmlerror.xmlError* c_error) with gil:
+ 
+     (<_BaseContext>c_ctxt)._error_log._receive(&error)
+ 
+-cdef void _receiveXPathError(void* c_context, xmlerror.xmlError* error) nogil:
++cdef void _receiveXPathError(void* c_context, const xmlerror.xmlError* error) nogil:
+     if not __DEBUG:
+         return
+     if c_context is NULL:
+diff --git a/src/lxml/parser.pxi b/src/lxml/parser.pxi
+index 22463c7d..1566b6df 100644
+--- a/src/lxml/parser.pxi
++++ b/src/lxml/parser.pxi
+@@ -626,10 +626,10 @@ cdef _initParserContext(_ParserContext context,
+     if c_ctxt is not NULL:
+         context._initParserContext(c_ctxt)
+ 
+-cdef void _forwardParserError(xmlparser.xmlParserCtxt* _parser_context, xmlerror.xmlError* error) with gil:
++cdef void _forwardParserError(xmlparser.xmlParserCtxt* _parser_context, const xmlerror.xmlError* error) with gil:
+     (<_ParserContext>_parser_context._private)._error_log._receive(error)
+ 
+-cdef void _receiveParserError(void* c_context, xmlerror.xmlError* error) nogil:
++cdef void _receiveParserError(void* c_context, const xmlerror.xmlError* error) nogil:
+     if __DEBUG:
+         if c_context is NULL or (<xmlparser.xmlParserCtxt*>c_context)._private is NULL:
+             _forwardError(NULL, error)
+diff --git a/src/lxml/xmlerror.pxi b/src/lxml/xmlerror.pxi
+index 1b50444f..4cd745f9 100644
+--- a/src/lxml/xmlerror.pxi
++++ b/src/lxml/xmlerror.pxi
+@@ -66,7 +66,7 @@ cdef class _LogEntry:
+         tree.xmlFree(self._c_path)
+ 
+     @cython.final
+-    cdef _setError(self, xmlerror.xmlError* error):
++    cdef _setError(self, const xmlerror.xmlError* error):
+         self.domain   = error.domain
+         self.type     = error.code
+         self.level    = <int>error.level
+@@ -198,7 +198,7 @@ cdef class _BaseErrorLog:
+         pass
+ 
+     @cython.final
+-    cdef void _receive(self, xmlerror.xmlError* error):
++    cdef void _receive(self, const xmlerror.xmlError* error):
+         cdef bint is_error
+         cdef _LogEntry entry
+         cdef _BaseErrorLog global_log
+@@ -634,7 +634,7 @@ def use_global_python_log(PyErrorLog log not None):
+ 
+ 
+ # local log functions: forward error to logger object
+-cdef void _forwardError(void* c_log_handler, xmlerror.xmlError* error) with gil:
++cdef void _forwardError(void* c_log_handler, const xmlerror.xmlError* error) with gil:
+     cdef _BaseErrorLog log_handler
+     if c_log_handler is not NULL:
+         log_handler = <_BaseErrorLog>c_log_handler
+@@ -645,7 +645,7 @@ cdef void _forwardError(void* c_log_handler, xmlerror.xmlError* error) with gil:
+     log_handler._receive(error)
+ 
+ 
+-cdef void _receiveError(void* c_log_handler, xmlerror.xmlError* error) nogil:
++cdef void _receiveError(void* c_log_handler, const xmlerror.xmlError* error) nogil:
+     # no Python objects here, may be called without thread context !
+     if __DEBUG:
+         _forwardError(c_log_handler, error)
+-- 
+2.42.0
+
diff --git a/pkgs/development/python-modules/lz4/default.nix b/pkgs/development/python-modules/lz4/default.nix
index ed06dca7c4c5..8bc09d315a3a 100644
--- a/pkgs/development/python-modules/lz4/default.nix
+++ b/pkgs/development/python-modules/lz4/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-aVnXCrTh+0Ip+FgYWN7hLw8N3iQCmXSywhReD5RTUfI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     sed -i '/pytest-cov/d' setup.py
   '';
diff --git a/pkgs/development/python-modules/magic-filter/default.nix b/pkgs/development/python-modules/magic-filter/default.nix
index e9d2fb8b8696..8b4cc8068965 100644
--- a/pkgs/development/python-modules/magic-filter/default.nix
+++ b/pkgs/development/python-modules/magic-filter/default.nix
@@ -20,6 +20,11 @@ buildPythonPackage rec {
     hash = "sha256-MSYIZ/bzngRu6mG3EGblUotSCA+6bi+l3EymFA8NRZA=";
   };
 
+  postPatch = ''
+    substituteInPlace magic_filter/__init__.py \
+      --replace '"1"' '"${version}"'
+  '';
+
   nativeBuildInputs = [
     hatchling
   ];
diff --git a/pkgs/development/python-modules/magicgui/default.nix b/pkgs/development/python-modules/magicgui/default.nix
index ef327dd0f08b..2e8f1b529a14 100644
--- a/pkgs/development/python-modules/magicgui/default.nix
+++ b/pkgs/development/python-modules/magicgui/default.nix
@@ -22,8 +22,6 @@
     hash = "sha256-fVfBQaaT8/lUGqZRXjOPgvkC01Izb8Sxqn7RCqnW9bo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
   propagatedBuildInputs = [ typing-extensions qtpy pyside2 psygnal docstring-parser ];
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/maison/default.nix b/pkgs/development/python-modules/maison/default.nix
index fc868ffefd2c..79be6d7b5bc7 100644
--- a/pkgs/development/python-modules/maison/default.nix
+++ b/pkgs/development/python-modules/maison/default.nix
@@ -47,5 +47,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/dbatten5/maison/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/makefun/default.nix b/pkgs/development/python-modules/makefun/default.nix
index 03d6e587eafe..bc26604826ac 100644
--- a/pkgs/development/python-modules/makefun/default.nix
+++ b/pkgs/development/python-modules/makefun/default.nix
@@ -1,18 +1,23 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+
+# build-system
+, setuptools
 , setuptools-scm
+
+# tests
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "makefun";
-  version = "1.15.1";
-  format = "setuptools";
+  version = "1.15.2";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QLDxGLbe0NjXjHjx62ebi2skYuPBs+BfsbLajNRrSKU=";
+    hash = "sha256-FvKis02e4MK1eMlgoYCMl04oIs959um5xFWqzhCILUU=";
   };
 
   postPatch = ''
@@ -21,6 +26,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/mako/default.nix b/pkgs/development/python-modules/mako/default.nix
index d9b3ecefc9ed..0a84359b27b6 100644
--- a/pkgs/development/python-modules/mako/default.nix
+++ b/pkgs/development/python-modules/mako/default.nix
@@ -4,32 +4,39 @@
 , fetchPypi
 , isPyPy
 
+# build-system
+, setuptools
+
 # propagates
 , markupsafe
 
-# extras: Babel
+# optional-dependencies
 , babel
+, lingua
 
 # tests
+, chameleon
 , mock
 , pytestCheckHook
-, lingua
-, chameleon
 }:
 
 buildPythonPackage rec {
   pname = "mako";
-  version = "1.2.4";
-  format = "setuptools";
+  version = "1.3.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Mako";
     inherit version;
-    hash = "sha256-1go5A9w7sBoYrWqJzb4uTq3GnAvI7x43c7pT1Ew/ejQ=";
+    hash = "sha256-46nTiP0A6HBD7b6HkvRYgKwBFOnErcafbpv7LFXjsRs=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     markupsafe
   ];
@@ -38,14 +45,16 @@ buildPythonPackage rec {
     babel = [
       babel
     ];
+    lingua = [
+      lingua
+    ];
   };
 
   nativeCheckInputs = [
     chameleon
-    lingua
     mock
     pytestCheckHook
-  ] ++ passthru.optional-dependencies.babel;
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   disabledTests = lib.optionals isPyPy [
     # https://github.com/sqlalchemy/mako/issues/315
diff --git a/pkgs/development/python-modules/manifestoo-core/default.nix b/pkgs/development/python-modules/manifestoo-core/default.nix
index a7b2c624b0e0..fae1981b1a86 100644
--- a/pkgs/development/python-modules/manifestoo-core/default.nix
+++ b/pkgs/development/python-modules/manifestoo-core/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     lib.optionals (pythonOlder "3.7") [ importlib-resources ]
     ++ lib.optionals (pythonOlder "3.8") [ typing-extensions ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/manifestoo/default.nix b/pkgs/development/python-modules/manifestoo/default.nix
index c9499eb11310..63383eb76ee0 100644
--- a/pkgs/development/python-modules/manifestoo/default.nix
+++ b/pkgs/development/python-modules/manifestoo/default.nix
@@ -38,8 +38,6 @@ buildPythonPackage rec {
   ++ typer.passthru.optional-dependencies.all
   ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/markdown-include/default.nix b/pkgs/development/python-modules/markdown-include/default.nix
index 20bc7c4b971f..96c4599d8252 100644
--- a/pkgs/development/python-modules/markdown-include/default.nix
+++ b/pkgs/development/python-modules/markdown-include/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-1MEk0U00a5cpVhqnDZkwBIk4NYgsRXTVsI/ANNQ/OH0=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/markdown/default.nix b/pkgs/development/python-modules/markdown/default.nix
index 7de193bbbbd7..4041a1aa3035 100644
--- a/pkgs/development/python-modules/markdown/default.nix
+++ b/pkgs/development/python-modules/markdown/default.nix
@@ -6,27 +6,25 @@
 , pyyaml
 , setuptools
 , unittestCheckHook
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "markdown";
-  version = "3.4.4";
+  version = "3.5.1";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Python-Markdown";
     repo = "markdown";
     rev = "refs/tags/${version}";
-    hash = "sha256-5PIIhbJVsotGwZ3BQ4x0I7WjgnGF3opNrn8J+xZCflg=";
+    hash = "sha256-OeCr72N3ygYYJnI+bIXCt63tSLDFLKznYekTk1sYHZI=";
   };
 
   nativeBuildInputs = [
     setuptools
-    wheel
   ];
 
   propagatedBuildInputs = lib.optionals (pythonOlder "3.10") [
@@ -38,7 +36,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "markdown" ];
 
   meta = with lib; {
-    changelog = "https://github.com/Python-Markdown/markdown/blob/${src.rev}/docs/change_log/index.md";
+    changelog = "https://github.com/Python-Markdown/markdown/blob/${src.rev}/docs/changelog.md";
     description = "Python implementation of John Gruber's Markdown";
     homepage = "https://github.com/Python-Markdown/markdown";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 4ac081e26a20..1100d1bdbc99 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -79,7 +79,7 @@ let
 in
 
 buildPythonPackage rec {
-  version = "3.8.0";
+  version = "3.8.2";
   pname = "matplotlib";
   format = "pyproject";
 
@@ -87,7 +87,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-34UF4cGdXCwmr/NJeny9PM/C6XBD0eTbPnavo5kWS2k=";
+    hash = "sha256-Aal4uHG4ge52AXFS8fGgy/a9X3uP+Mlt8N8b1X2HVaE=";
   };
 
   env.XDG_RUNTIME_DIR = "/tmp";
diff --git a/pkgs/development/python-modules/maxminddb/default.nix b/pkgs/development/python-modules/maxminddb/default.nix
index b5f7fb9d5db0..1bd579afe70c 100644
--- a/pkgs/development/python-modules/maxminddb/default.nix
+++ b/pkgs/development/python-modules/maxminddb/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "maxminddb";
-  version = "2.4.0";
+  version = "2.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-geVOU0CL1QJlDllpzLoWeAr2WewdscRLLJl+QzCl7ZY=";
+    hash = "sha256-SAfTdOZFvWgzTk9Ie6haJxidvBJnqY5kSqaGp5J+BVk=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/mcstatus/default.nix b/pkgs/development/python-modules/mcstatus/default.nix
index cff34c84442d..865e2a6ee774 100644
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "mcstatus";
-  version = "11.0.1";
+  version = "11.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "py-mine";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-1jPIsFEJ17kjtCBiX4IvSf2FxYw9DkH3MrrJ85N71tc=";
+    hash = "sha256-LYhd35FsredNaMgMfkj7LntNK3NRoVpniEUT6WHoXx8=";
   };
 
   postPatch = ''
@@ -56,6 +56,8 @@ buildPythonPackage rec {
     # DNS features are limited in the sandbox
     "test_query"
     "test_query_retry"
+    "test_resolve_localhost"
+    "test_async_resolve_localhost"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/measurement/default.nix b/pkgs/development/python-modules/measurement/default.nix
index 3323e8c198ff..c16b03d8e829 100644
--- a/pkgs/development/python-modules/measurement/default.nix
+++ b/pkgs/development/python-modules/measurement/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     sphinx
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace "--cov=measurement" ""
diff --git a/pkgs/development/python-modules/mesa/default.nix b/pkgs/development/python-modules/mesa/default.nix
index fe4e8dd598d5..4a9001ff1b9c 100644
--- a/pkgs/development/python-modules/mesa/default.nix
+++ b/pkgs/development/python-modules/mesa/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "mesa";
-  version = "2.1.1";
+  version = "2.1.5";
   format = "setuptools";
 
   # According to their docs, this library is for Python 3+.
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Mesa";
     inherit version;
-    hash = "sha256-1wyXndB7xQy1jnfHsIqMQgsvmGYUhjDuSBB2M0GcXC4=";
+    hash = "sha256-UMf3z1bEElygfqwgY65qhOEK4i9K9gH42muId3mZUjY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 84031db71b80..9d34cb27c8cd 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "meson-python";
-  version = "0.14.0";
+  version = "0.15.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "meson_python";
-    hash = "sha256-uWhmaQMmVE3+RSWDdTrD9DMTIn6f2UFnAajfkK8hIjQ=";
+    hash = "sha256-/dtz7s1J6JwcQch5N82JwtC2WhxjuigjhoHUvZSE0m8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/miauth/default.nix b/pkgs/development/python-modules/miauth/default.nix
index 380fe8e23e1f..a48690ab0b07 100644
--- a/pkgs/development/python-modules/miauth/default.nix
+++ b/pkgs/development/python-modules/miauth/default.nix
@@ -1,14 +1,21 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+, pythonRelaxDepsHook
+
+# build-system
 , setuptools
-, wheel
+
+# dependencies
 , bluepy
-, pythonOlder
 , cryptography
+
+# tests
+, pytestCheckHook
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "miauth";
   version = "0.9.1";
   pyproject = true;
@@ -26,7 +33,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
-    wheel
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "cryptography"
   ];
 
   propagatedBuildInputs = [
@@ -38,6 +49,8 @@ buildPythonPackage rec {
     "miauth"
   ];
 
+  doCheck = false; # no tests
+
   meta = with lib; {
     description = "Authenticate and interact with Xiaomi devices over BLE";
     homepage = "https://github.com/dnandha/miauth";
diff --git a/pkgs/development/python-modules/minio/default.nix b/pkgs/development/python-modules/minio/default.nix
index 5181d8bef54e..ddb2905bc1d9 100644
--- a/pkgs/development/python-modules/minio/default.nix
+++ b/pkgs/development/python-modules/minio/default.nix
@@ -1,23 +1,27 @@
 { lib
 , buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
+, argon2-cffi
 , certifi
-, configparser
+, urllib3
+, pycryptodome
+
+# test
 , faker
-, fetchFromGitHub
-, future
 , mock
-, nose
 , pytestCheckHook
-, python-dateutil
-, pythonOlder
-, pytz
-, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "minio";
-  version = "7.1.17";
-  format = "setuptools";
+  version = "7.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -25,22 +29,23 @@ buildPythonPackage rec {
     owner = "minio";
     repo = "minio-py";
     rev = "refs/tags/${version}";
-    hash = "sha256-I0Q1SkZ1zQ9s2HbMTc2EzUnnOti14zQBxHVJasaukug=";
+    hash = "sha256-hZn1T75JbnJ5lIyWnX3f8r6OET/d6ZltuRr6jjYOp2o=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
+    argon2-cffi
     certifi
-    configparser
-    future
-    python-dateutil
-    pytz
     urllib3
+    pycryptodome
   ];
 
   nativeCheckInputs = [
     faker
     mock
-    nose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index d64fbf32614a..f5d2735bf54b 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -4,7 +4,7 @@
 , buildPythonPackage
 , pythonOlder
   # Mitmproxy requirements
-, aioquic
+, aioquic-mitmproxy
 , asgiref
 , blinker
 , brotli
@@ -29,7 +29,7 @@
 , setuptools
 , sortedcontainers
 , tornado
-, urwid
+, urwid-mitmproxy
 , wsproto
 , zstandard
   # Additional check requirements
@@ -57,7 +57,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    aioquic
+    aioquic-mitmproxy
     asgiref
     blinker
     brotli
@@ -81,7 +81,7 @@ buildPythonPackage rec {
     setuptools
     sortedcontainers
     tornado
-    urwid
+    urwid-mitmproxy
     wsproto
     zstandard
   ] ++ lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/mkdocs-material/default.nix b/pkgs/development/python-modules/mkdocs-material/default.nix
index 59c433145b02..e8df6bbc8253 100644
--- a/pkgs/development/python-modules/mkdocs-material/default.nix
+++ b/pkgs/development/python-modules/mkdocs-material/default.nix
@@ -1,54 +1,86 @@
 { lib
-, callPackage
 , buildPythonPackage
 , fetchFromGitHub
-, colorama
+
+# build-system
 , hatch-requirements-txt
 , hatch-nodejs-version
 , hatchling
+, trove-classifiers
+
+# dependencies
+, babel
+, colorama
 , jinja2
 , markdown
 , mkdocs
 , mkdocs-material-extensions
+, paginate
 , pygments
 , pymdown-extensions
 , pythonOlder
 , regex
 , requests
+
+# optional-dependencies
+, mkdocs-minify-plugin
+, mkdocs-redirects
+, mkdocs-git-revision-date-localized-plugin
+, pillow
+, cairosvg
 }:
 
 buildPythonPackage rec {
   pname = "mkdocs-material";
-  version = "9.3.1";
-  format = "pyproject";
+  version = "9.4.14";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "squidfunk";
-    repo = pname;
+    repo = "mkdocs-material";
     rev = "refs/tags/${version}";
-    hash = "sha256-2Z1U71agXxkYp1OFYd/xInAfN5SVI9FQf39b8DkX10o=";
+    hash = "sha256-oP0DeSRgoLx6boEOa3if5BitGXmJ11DoUVZK16Sjlwg=";
   };
 
   nativeBuildInputs = [
     hatch-requirements-txt
     hatch-nodejs-version
     hatchling
+    trove-classifiers
   ];
 
   propagatedBuildInputs = [
+    babel
     colorama
     jinja2
     markdown
     mkdocs
     mkdocs-material-extensions
+    paginate
     pygments
     pymdown-extensions
     regex
     requests
   ];
 
+  passthru.optional-dependencies = {
+    recommended = [
+      mkdocs-minify-plugin
+      mkdocs-redirects
+      # TODO: mkdocs-rss-plugin
+    ];
+    git = [
+      # TODO: gmkdocs-git-committers-plugin
+      mkdocs-git-revision-date-localized-plugin
+    ];
+    imaging = [
+      cairosvg
+      pillow
+    ];
+  };
+
   # No tests for python
   doCheck = false;
 
@@ -57,7 +89,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/squidfunk/mkdocs-material/blob/${src.rev}/CHANGELOG";
     description = "Material for mkdocs";
+    downloadPage = "https://github.com/squidfunk/mkdocs-material";
     homepage = "https://squidfunk.github.io/mkdocs-material/";
     license = licenses.mit;
     maintainers = with maintainers; [ dandellion ];
diff --git a/pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix b/pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix
index 4e1c47a8c49d..239d3507d59b 100644
--- a/pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix
+++ b/pkgs/development/python-modules/mkdocs-material/mkdocs-material-extensions.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-material-extensions";
-  version = "1.1.1";
+  version = "1.3.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "facelessuser";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-FHI6WEQRd/Ff6pmU13f8f0zPSeFhhbmDdk4/0rdIl4I=";
+    hash = "sha256-/jU30Ol10/4haR3ZPJWZ3iWRfXG/RUOU1oclOYGjjAY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs-minify/default.nix b/pkgs/development/python-modules/mkdocs-minify-plugin/default.nix
index fcab8677cffa..dbb09cc5795b 100644
--- a/pkgs/development/python-modules/mkdocs-minify/default.nix
+++ b/pkgs/development/python-modules/mkdocs-minify-plugin/default.nix
@@ -9,13 +9,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "mkdocs-minify";
+  pname = "mkdocs-minify-plugin";
   version = "0.7.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "byrnereese";
-    repo = "${pname}-plugin";
+    repo = "mkdocs-minify-plugin";
     rev = "refs/tags/${version}";
     hash = "sha256-LDCAWKVbFsa6Y/tmY2Zne4nOtxe4KvNplZuWxg4e4L8=";
   };
diff --git a/pkgs/development/python-modules/mkdocs/default.nix b/pkgs/development/python-modules/mkdocs/default.nix
index 61c8bdcd13c1..8a402510ec18 100644
--- a/pkgs/development/python-modules/mkdocs/default.nix
+++ b/pkgs/development/python-modules/mkdocs/default.nix
@@ -3,6 +3,7 @@
   lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pythonOlder
 
 # buildtime
@@ -23,23 +24,27 @@
 , pyyaml-env-tag
 , watchdog
 
-# testing deps
+# optional-dependencies
 , babel
+, setuptools
+
+# testing deps
 , mock
 , unittestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "mkdocs";
-  version = "1.5.2";
-  format = "pyproject";
-  disabled = pythonOlder "3.6";
+  version = "1.5.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-9sV1bewsHVJEc2kTyGxDM6SjDTEKEc/HSY6gWBC5tvE=";
+    hash = "sha256-axH4AeL+osxoUIVJbW6YjiTfUr6TAXMB4raZ3oO0fyw=";
   };
 
   nativeBuildInputs = [
@@ -63,18 +68,27 @@ buildPythonPackage rec {
     importlib-metadata
   ];
 
+  passthru.optional-dependencies = {
+    i18n = [
+      babel
+    ] ++ lib.optionals (pythonAtLeast "3.12") [
+      setuptools
+    ];
+  };
+
   nativeCheckInputs = [
     unittestCheckHook
-    babel
     mock
-  ];
+  ] ++ passthru.optional-dependencies.i18n;
 
   unittestFlagsArray = [ "-v" "-p" "'*tests.py'" "mkdocs" ];
 
   pythonImportsCheck = [ "mkdocs" ];
 
   meta = with lib; {
+    changelog = "https://github.com/mkdocs/mkdocs/releases/tag/${version}";
     description = "Project documentation with Markdown / static website generator";
+    downloadPage = "https://github.com/mkdocs/mkdocs";
     longDescription = ''
       MkDocs is a fast, simple and downright gorgeous static site generator that's
       geared towards building project documentation. Documentation source files
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index 41ebc9545cef..2c8978156401 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -38,14 +38,14 @@
 
 buildPythonPackage rec {
   pname = "mlflow";
-  version = "2.7.0";
+  version = "2.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3q8PXydgjpUm1p//zKcMgirJDqKQpvPkuz36GyCbARE=";
+    hash = "sha256-5OW90tnvsLOG7Lzi335D8ExGoyCAIIQU3FO1/XFVlng=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mlxtend/default.nix b/pkgs/development/python-modules/mlxtend/default.nix
index 7a17e9a81925..7f84aaac49ba 100644
--- a/pkgs/development/python-modules/mlxtend/default.nix
+++ b/pkgs/development/python-modules/mlxtend/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , isPy27
+, setuptools
 , pytestCheckHook
 , scipy
 , numpy
@@ -13,23 +14,21 @@
 
 buildPythonPackage rec {
   pname = "mlxtend";
-  version = "0.22.0";
-  format = "setuptools";
+  version = "0.23.0";
+  pyproject = true;
+
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "rasbt";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-YLCNLpg2qrdFon0/gdggJd9XovHwRHAdleBFQc18qzE=";
+    hash = "sha256-TUZ8SdQAOV1CaIlDl4uXYVHvdlEkOz6E48S3pUS6UE0=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  # image tests download files over the network
-  pytestFlagsArray = [ "-sv" "--ignore=mlxtend/image" ];
-  # Fixed in master, but failing in release version
-  # see: https://github.com/rasbt/mlxtend/pull/721
-  disabledTests = [ "test_variance_explained_ratio" ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     scipy
@@ -40,6 +39,19 @@ buildPythonPackage rec {
     joblib
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "-sv"
+  ];
+
+  disabledTestPaths = [
+    # image tests download files over the network
+    "mlxtend/image"
+  ];
+
   meta = with lib; {
     description = "A library of Python tools and extensions for data science";
     homepage = "https://github.com/rasbt/mlxtend";
diff --git a/pkgs/development/python-modules/mmengine/default.nix b/pkgs/development/python-modules/mmengine/default.nix
index ff071c066954..a73d1fff7d35 100644
--- a/pkgs/development/python-modules/mmengine/default.nix
+++ b/pkgs/development/python-modules/mmengine/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "mmengine";
-  version = "0.8.4";
+  version = "0.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "open-mmlab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kJhcw6Hpzx3s5WHeLTF8pydbAKXwfVgvxo7SsSN5gls=";
+    hash = "sha256-PG6KSoM5VUyU84z66eZknQfMhS4YWAmyWCIIpRwUOpU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mne-python/default.nix b/pkgs/development/python-modules/mne-python/default.nix
index 940c633d4115..8a85f487d2d2 100644
--- a/pkgs/development/python-modules/mne-python/default.nix
+++ b/pkgs/development/python-modules/mne-python/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "mne-python";
-  version = "1.5.1";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "mne-tools";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-djVQkj8ktIOxe1xmi+XuIvdS1WdDzozgTJNJhWAhuBo=";
+    hash = "sha256-OoaXNHGL2svOpNL5GHcVRfQc9GxIRpZRhpZ5Hi1JTzM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mocket/default.nix b/pkgs/development/python-modules/mocket/default.nix
index 37a8c8d9cc74..fe7ca40ccf05 100644
--- a/pkgs/development/python-modules/mocket/default.nix
+++ b/pkgs/development/python-modules/mocket/default.nix
@@ -34,12 +34,12 @@
 
 buildPythonPackage rec {
   pname = "mocket";
-  version = "3.12.0";
+  version = "3.12.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-brvBWwTWT2F/usVBRr7wz9L0kct4X1Fddl4mu5LUENA=";
+    hash = "sha256-BN9S5/mku+HT1vglyobgHZPWsY0yvbfQfpMRUKrnJQQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mockfs/default.nix b/pkgs/development/python-modules/mockfs/default.nix
index 234a3d14d696..680a6c9fc795 100644
--- a/pkgs/development/python-modules/mockfs/default.nix
+++ b/pkgs/development/python-modules/mockfs/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , setuptools
 , setuptools-scm
-, wheel
+, importlib-metadata
 , pytestCheckHook
 }:
 
@@ -23,12 +23,13 @@ buildPythonPackage rec {
     sed -i '/addopts/d' pytest.ini
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
-    wheel
+  ];
+
+  propagatedBuildInputs = [
+    importlib-metadata
   ];
 
   pythonImportsCheck = [ "mockfs" ];
diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index cebb9c382c7c..8e9ac1b408d2 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "monty";
-  version = "2023.9.5";
+  version = "2023.11.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "materialsvirtuallab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-VzOu0gLQcobWQs8uMFzI4CyN+1OVx94VqhJYB+rMpMI=";
+    hash = "sha256-SENrAHCCWYEMWqPQSy61E8bMYkCBJepK5otb7B7UGXA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/moreorless/default.nix b/pkgs/development/python-modules/moreorless/default.nix
index 8f849b42f137..39e467a59963 100644
--- a/pkgs/development/python-modules/moreorless/default.nix
+++ b/pkgs/development/python-modules/moreorless/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-N11iqsxMGgzwW2QYeOoHQaR/aDEuoUnnd/2Mc5culN0=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index a76f39fc2a52..7f5b42e4d2f0 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "moto";
-  version = "4.2.10";
+  version = "4.2.11";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kllf4odHSjGsPvhHlB67CX6P+ww9bBBuR89XPbBpM7I=";
+    hash = "sha256-LaYtUuqnZd/idiySDwqIpY86CeBFgckduWfZL67ISPE=";
   };
 
   nativeBuildInputs = [
@@ -113,6 +113,9 @@ buildPythonPackage rec {
     # Fails at local name resolution
     "--deselect=tests/test_s3/test_multiple_accounts_server.py::TestAccountIdResolution::test_with_custom_request_header"
     "--deselect=tests/test_s3/test_server.py::test_s3_server_post_cors_multiple_origins"
+    "--deselect=tests/test_s3/test_s3_file_handles.py::TestS3FileHandleClosuresUsingMocks::test_create_multipart"
+    "--deselect=tests/test_core/test_responses_module.py::TestResponsesMockWithPassThru::test_aws_and_http_requests"
+    "--deselect=tests/test_core/test_responses_module.py::TestResponsesMockWithPassThru::test_http_requests"
 
     # Fails at resolving google.com
     "--deselect=tests/test_firehose/test_firehose_put.py::test_put_record_http_destination"
@@ -125,13 +128,12 @@ buildPythonPackage rec {
     # Connection Reset by Peer, when connecting to localhost:5678
     "--deselect=tests/test_moto_api/recorder/test_recorder.py::TestRecorder::test_replay"
 
-    # Requires docker, but isn't marked
-    # https://github.com/getmoto/moto/pull/6938
-    "--deselect=tests/test_awslambda/test_lambda_layers_invoked.py::test_invoke_local_lambda_layers"
-
     # Flaky under parallel execution
     "--deselect=tests/test_cloudformation/test_server.py::test_cloudformation_server_get"
     "--deselect=tests/test_core/test_moto_api.py::TestModelDataResetForClassDecorator::test_should_find_bucket"
+
+    # AssertionError: assert ResourceWarning not in [<class 'ResourceWarning'>, <class 'ResourceWarning'>]
+    "--deselect=ests/test_s3/test_s3_file_handles.py::TestS3FileHandleClosuresUsingMocks::test_delete_object_with_version"
   ];
 
   disabledTestPaths = [
@@ -151,7 +153,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Allows your tests to easily mock out AWS Services";
-    homepage = "https://github.com/spulec/moto";
+    homepage = "https://github.com/getmoto/moto";
     changelog = "https://github.com/getmoto/moto/blob/${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = [ ];
diff --git a/pkgs/development/python-modules/motor/default.nix b/pkgs/development/python-modules/motor/default.nix
index 3e4cf4d574ad..1725547b1d7b 100644
--- a/pkgs/development/python-modules/motor/default.nix
+++ b/pkgs/development/python-modules/motor/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "motor";
-  version = "3.3.1";
+  version = "3.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "mongodb";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-iJz3JiW9cVT3G1rLQwWQXcPfPBRGsIwVLs4gauM+pYo=";
+    hash = "sha256-ajlZleaaq0LIEW5PdTRQWL312guYA+7+x1xtPNKZQC0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mpl-scatter-density/default.nix b/pkgs/development/python-modules/mpl-scatter-density/default.nix
index 48d05b1e6ca5..152c07f10a7e 100644
--- a/pkgs/development/python-modules/mpl-scatter-density/default.nix
+++ b/pkgs/development/python-modules/mpl-scatter-density/default.nix
@@ -44,8 +44,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ matplotlib numpy fast-histogram ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeCheckInputs = [
     pytestCheckHook
     pytest-mpl
diff --git a/pkgs/development/python-modules/mpris-server/default.nix b/pkgs/development/python-modules/mpris-server/default.nix
index 783fc6aab959..e792426491f1 100644
--- a/pkgs/development/python-modules/mpris-server/default.nix
+++ b/pkgs/development/python-modules/mpris-server/default.nix
@@ -9,13 +9,13 @@
 }:
 buildPythonPackage rec {
   pname = "mpris-server";
-  version = "0.4.2";
+  version = "0.8.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "mpris_server";
     inherit version;
-    hash = "sha256-p3nM80fOMtRmeKvOXuX40Fu9xH8gPgYyneXbUS678fE=";
+    hash = "sha256-dfnFX+u7PhQb4ScHIkRHnGVpCABZhhlw/R+ks63zcec=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/msal/default.nix b/pkgs/development/python-modules/msal/default.nix
index ab54e9e5adea..c489f5b75b2d 100644
--- a/pkgs/development/python-modules/msal/default.nix
+++ b/pkgs/development/python-modules/msal/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "msal";
-  version = "1.24.1";
+  version = "1.25.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qglyiEs8b97FPZoL0VwS5b17cawbZtdG9U0Shwnz+Pg=";
+    hash = "sha256-9EMp/bWfTwRMd5Fko0R0uKRK2eSUCvvEw6Oiu+kDJNk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/msgpack/default.nix b/pkgs/development/python-modules/msgpack/default.nix
index d44166b82f7d..7bcdb42095b3 100644
--- a/pkgs/development/python-modules/msgpack/default.nix
+++ b/pkgs/development/python-modules/msgpack/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "msgpack";
-  version = "1.0.5";
+  version = "1.0.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wHVUQoTq3Fzdxw9HVzMdmdy8FrK71ISdFfiq5M820xw=";
+    hash = "sha256-Vy78k9t6TSfkBFAZdcptLZd1cFwtkiOQ2Hj892jZLIc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index 863e005d4a4b..79646183fa18 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , fetchPypi
 , buildPythonPackage
 , pytestCheckHook
@@ -22,6 +23,11 @@ buildPythonPackage rec {
     sed -i '/^addopts/d' setup.cfg
   '';
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isClang [
+    # error: incompatible pointer to integer conversion initializing 'int' with an expression of type 'void *'
+    "-Wno-error=int-conversion"
+  ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "multidict" ];
diff --git a/pkgs/development/python-modules/munch/default.nix b/pkgs/development/python-modules/munch/default.nix
index b754514649a2..368cc0eff5ad 100644
--- a/pkgs/development/python-modules/munch/default.nix
+++ b/pkgs/development/python-modules/munch/default.nix
@@ -1,24 +1,39 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, six
+, fetchFromGitHub
+
+# build-system
 , pbr
+, setuptools
+
+# tests
+, pytestCheckHook
+, pyyaml
 }:
 
 buildPythonPackage rec {
   pname = "munch";
   version = "4.0.0";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-VCyxUUYSYyFqTjfD/Zr8Ql/urziqowJc0qmB+ttCIjU=";
+  src = fetchFromGitHub {
+    owner = "Infinidat";
+    repo = "munch";
+    rev = "refs/tags/${version}";
+    hash = "sha256-p7DvOGRhkCmtJ32EfttyKXGGmO5kfb2bQGqok/RJtU8=";
   };
 
-  propagatedBuildInputs = [ six pbr ];
+  env.PBR_VERSION = version;
+
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
 
-  # No tests in archive
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+    pyyaml
+  ];
 
   meta = with lib; {
     description = "A dot-accessible dictionary (a la JavaScript objects)";
diff --git a/pkgs/development/python-modules/mutagen/default.nix b/pkgs/development/python-modules/mutagen/default.nix
index 236af1eb5d1f..2ffaadaffeaa 100644
--- a/pkgs/development/python-modules/mutagen/default.nix
+++ b/pkgs/development/python-modules/mutagen/default.nix
@@ -3,6 +3,9 @@
 , pythonOlder
 , fetchPypi
 
+# build-system
+, setuptools
+
 # docs
 , python
 , sphinx
@@ -31,6 +34,7 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
+    setuptools
     sphinx
     sphinx-rtd-theme
   ];
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index f3c06701eb65..d63e6f9791e5 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.19.1";
+  version = "7.21.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     rev = "refs/tags/${version}";
-    hash = "sha256-Gz6OJ2ER60R14aTmhPfodX22FlbicUClBtlqNglTjC4=";
+    hash = "sha256-lj9Jkp1AGWIAdGzakpt0BMnmdwe1Uf04PI9sMfEBTbw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/napari-console/default.nix b/pkgs/development/python-modules/napari-console/default.nix
index acefdcc14bca..9072ada93f42 100644
--- a/pkgs/development/python-modules/napari-console/default.nix
+++ b/pkgs/development/python-modules/napari-console/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-vHLCVMgrcs54pGb48wQpc0h7QBIfE6r7hCSoDNI3QvA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/napari-npe2/default.nix b/pkgs/development/python-modules/napari-npe2/default.nix
index 53fffeaadcba..64659858258b 100644
--- a/pkgs/development/python-modules/napari-npe2/default.nix
+++ b/pkgs/development/python-modules/napari-npe2/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "napari-npe2";
-  version = "0.7.2";
+  version = "0.7.2-unstable-2023-10-20";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,11 +25,12 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "napari";
     repo = "npe2";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-PjoLocNTkcAnBNRbPi+MZqZtQ2bjWPIUVz0+k8nIn2A=";
+    rev = "9d29e4d6dbbec75c2d36273647efd9ddfb59ded0";
+    hash = "sha256-JLu/5pXijPdpKY2z2rREtSKPiP33Yy4viegbxUiQg7Y=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  # fix this in the next release
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = "0.7.2";
 
   nativeBuildInputs = [
     hatchling
diff --git a/pkgs/development/python-modules/napari-plugin-engine/default.nix b/pkgs/development/python-modules/napari-plugin-engine/default.nix
index 8b9a015e0065..499f87ecf716 100644
--- a/pkgs/development/python-modules/napari-plugin-engine/default.nix
+++ b/pkgs/development/python-modules/napari-plugin-engine/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-cKpCAEYYRq3UPje7REjzhEe1J9mmrtXs8TBnxWukcNE=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/napari-svg/default.nix b/pkgs/development/python-modules/napari-svg/default.nix
index b07ca1e2cf18..9150abfb252b 100644
--- a/pkgs/development/python-modules/napari-svg/default.nix
+++ b/pkgs/development/python-modules/napari-svg/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-lvI6RWT9oUE95vL6WO75CASc/Z+1G5UMm2p8vhqIjA0=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/napari/default.nix b/pkgs/development/python-modules/napari/default.nix
index 9df87e357dd3..9997d58eb50b 100644
--- a/pkgs/development/python-modules/napari/default.nix
+++ b/pkgs/development/python-modules/napari/default.nix
@@ -50,8 +50,6 @@ mkDerivationWith buildPythonPackage rec {
     hash = "sha256-xF0DYK+226MZpB050IukNvTg2iHMQAIZW0serKRJd/0=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace "scikit-image>=0.19.1" "scikit-image" \
diff --git a/pkgs/development/python-modules/nbclient/default.nix b/pkgs/development/python-modules/nbclient/default.nix
index 745de65f4b2e..e2d4fc2810c5 100644
--- a/pkgs/development/python-modules/nbclient/default.nix
+++ b/pkgs/development/python-modules/nbclient/default.nix
@@ -19,7 +19,7 @@
 
 let nbclient = buildPythonPackage rec {
   pname = "nbclient";
-  version = "0.8.0";
+  version = "0.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ let nbclient = buildPythonPackage rec {
     owner = "jupyter";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-uBCYmrl/Zfw58hd12z20jLVwGSPv+M3fMo1mfV2GO/M=";
+    hash = "sha256-m0Tke/JlTeKE3PJZ1rBejra/HPEXCSS0ur/cPiSBJZw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/nbdime/default.nix b/pkgs/development/python-modules/nbdime/default.nix
index e1bb3e84079b..582d46b52108 100644
--- a/pkgs/development/python-modules/nbdime/default.nix
+++ b/pkgs/development/python-modules/nbdime/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "nbdime";
-  version = "3.2.1";
+  version = "4.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MUCaMPhI/8azJUBpfoLVoKG4TcwycWynTni8xLRXxFM=";
+    hash = "sha256-8adgwLAMG6m0lFwWzpJXfzk/tR0YTzUbdoW6boUCCY4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ncclient/default.nix b/pkgs/development/python-modules/ncclient/default.nix
index 4b656fd72fd0..c3040475cf2e 100644
--- a/pkgs/development/python-modules/ncclient/default.nix
+++ b/pkgs/development/python-modules/ncclient/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "ncclient";
-  version = "0.6.13";
+  version = "0.6.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-NrilXB1NFcqNCGrwshhuLdhQoeHJ12PSp4MBScT9kYc=";
+    hash = "sha256-mdFoSTUS4QhY05rY0fqKTpRQTR9oLvOMTVr4kWJbiUQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nengo/default.nix b/pkgs/development/python-modules/nengo/default.nix
index da5d79e31e65..86231c3f0401 100644
--- a/pkgs/development/python-modules/nengo/default.nix
+++ b/pkgs/development/python-modules/nengo/default.nix
@@ -1,4 +1,7 @@
-{ lib, fetchFromGitHub, buildPythonPackage
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, setuptools
 , numpy
 , scipySupport ? false, scipy
 , scikitSupport ? false, scikit-learn
@@ -6,16 +9,20 @@
 
 buildPythonPackage rec {
   pname = "nengo";
-  version = "3.2.0";
-  format = "setuptools";
+  version = "4.0.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nengo";
     repo = "nengo";
-    rev = "v${version}";
-    sha256 = "12lz8lzirxvwnpa74k9k48c64gs6gi092928rh97siya3i6gjs6i";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-b9mPjKdewIqIeRrddV1/M3bghSyox7Lz6VbfSLCHZjA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ numpy ]
     ++ lib.optionals scipySupport [ scipy ]
     ++ lib.optionals scikitSupport [ scikit-learn ];
diff --git a/pkgs/development/python-modules/netaddr/default.nix b/pkgs/development/python-modules/netaddr/default.nix
index 98c886d2825e..65f4fcd61421 100644
--- a/pkgs/development/python-modules/netaddr/default.nix
+++ b/pkgs/development/python-modules/netaddr/default.nix
@@ -2,32 +2,40 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, glibcLocales
-, importlib-resources
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "netaddr";
-  version = "0.8.0";
-  format = "setuptools";
+  version = "0.9.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0hx2npi0wnhwlcybilgwlddw6qffx1mb7a3sj4p9s7bvl33mgk6n";
+    sha256 = "sha256-e0b6mxotcf1d6eSjeE7zOXAKU6CMgEDwi69fEZTaASg=";
   };
 
-  LC_ALL = "en_US.UTF-8";
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.7") [ importlib-resources ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  nativeCheckInputs = [ glibcLocales pytestCheckHook ];
+  pythonImportsCheck = [
+    "netaddr"
+  ];
 
   meta = with lib; {
-    homepage = "https://netaddr.readthedocs.io/en/latest/";
-    downloadPage = "https://github.com/netaddr/netaddr/releases";
-    changelog = "https://netaddr.readthedocs.io/en/latest/changes.html";
     description = "A network address manipulation library for Python";
+    homepage = "https://netaddr.readthedocs.io/";
+    downloadPage = "https://github.com/netaddr/netaddr/releases";
+    changelog = "https://github.com/netaddr/netaddr/blob/${version}/CHANGELOG";
     license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/netmiko/default.nix b/pkgs/development/python-modules/netmiko/default.nix
index 7c2fbda27ced..f893ce204455 100644
--- a/pkgs/development/python-modules/netmiko/default.nix
+++ b/pkgs/development/python-modules/netmiko/default.nix
@@ -1,18 +1,47 @@
-{ lib, buildPythonPackage, fetchPypi, setuptools, paramiko, scp, tenacity
-, textfsm, ntc-templates, pyserial, pytestCheckHook, pyyaml }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, poetry-core
+
+# dependencies
+, ntc-templates
+, paramiko
+, pyserial
+, pyyaml
+, scp
+, textfsm
+}:
 
 buildPythonPackage rec {
   pname = "netmiko";
-  version = "4.2.0";
-  format = "setuptools";
+  version = "4.3.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-et3m/j6mMzYij0moY2UMLYP7DmgODw0Vi1sPsExBAOE=";
+    hash = "sha256-2pD2798ztBQOts1/InJ3PCzhRPp0rDTV7KwbTUYH8fs=";
   };
 
-  buildInputs = [ setuptools ];
-  propagatedBuildInputs = [ paramiko scp tenacity pyyaml textfsm ntc-templates pyserial ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "poetry==1.3.2" "poetry-core" \
+      --replace "poetry.masonry.api" "poetry.core.masonry.api"
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    ntc-templates
+    paramiko
+    pyserial
+    pyyaml
+    scp
+    textfsm
+  ];
 
   # tests require closed-source pyats and genie packages
   doCheck = false;
diff --git a/pkgs/development/python-modules/networkx/default.nix b/pkgs/development/python-modules/networkx/default.nix
index 20c73fb6adf8..51e580af4eb2 100644
--- a/pkgs/development/python-modules/networkx/default.nix
+++ b/pkgs/development/python-modules/networkx/default.nix
@@ -1,30 +1,67 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, nose
-, pytestCheckHook
-, decorator
-, setuptools
 , pythonOlder
+
+# build-system
+, setuptools
+
+# optional-dependencies
+, lxml
+, matplotlib
+, numpy
+, pandas
+, pydot
+, pygraphviz
+, scipy
+, sympy
+
+# tests
+, pytest-xdist
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "networkx";
   # upgrade may break sage, please test the sage build or ping @timokau on upgrade
-  version = "3.1";
-  format = "setuptools";
+  version = "3.2.1";
+  pyproject = true;
+
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3jRjNUCPhN4Orab/n6+v/5vNoR8KDfqpMRM967FGq2E=";
+    hash = "sha256-nxu1zzQJvzJOCnIsIL20wg7jm/HDDOiuSZyFArC14MY=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  passthru.optional-dependencies = {
+    default = [
+      numpy
+      scipy
+      matplotlib
+      pandas
+    ];
+    extra = [
+      lxml
+      pygraphviz
+      pydot
+      sympy
+    ];
   };
 
-  propagatedBuildInputs = [ decorator setuptools ];
-  nativeCheckInputs = [ nose pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
 
   meta = {
+    changelog = "https://github.com/networkx/networkx/blob/networkx-${version}/doc/release/release_${version}.rst";
     homepage = "https://networkx.github.io/";
+    downloadPage = "https://github.com/networkx/networkx";
     description = "Library for the creation, manipulation, and study of the structure, dynamics, and functions of complex networks";
     license = lib.licenses.bsd3;
   };
diff --git a/pkgs/development/python-modules/nose/default.nix b/pkgs/development/python-modules/nose/default.nix
index 376e56041b61..dc9dc51da5b8 100644
--- a/pkgs/development/python-modules/nose/default.nix
+++ b/pkgs/development/python-modules/nose/default.nix
@@ -4,8 +4,8 @@
 , isPy3k
 , isPyPy
 , python
+ ,pythonAtLeast
 , coverage
-, buildPackages
 }:
 
 buildPythonPackage rec {
@@ -13,6 +13,9 @@ buildPythonPackage rec {
   format = "setuptools";
   pname = "nose";
 
+  # unmaintained, relies on the imp module
+  disabled = pythonAtLeast "3.12";
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "f1bffef9cbc82628f6e7d7b40d7e255aefaa1adb6a1b1d26c69a8b79e6208a98";
diff --git a/pkgs/development/python-modules/nose2/default.nix b/pkgs/development/python-modules/nose2/default.nix
index b49900e1576f..28dd8df3e263 100644
--- a/pkgs/development/python-modules/nose2/default.nix
+++ b/pkgs/development/python-modules/nose2/default.nix
@@ -1,16 +1,22 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, python
-, six
 , pythonOlder
+
+# build-system
+, setuptools
+
+# optional-dependencies
 , coverage
+
+# tests
+, unittestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "nose2";
   version = "0.14.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -19,21 +25,32 @@ buildPythonPackage rec {
     hash = "sha256-XCjXcKC5pwKGK9bDdVuizS95lN1RjJguXOKY1/N0ZqQ=";
   };
 
-  propagatedBuildInputs = [
-    coverage
-    six
+  nativeBuildInputs = [
+    setuptools
   ];
 
-  __darwinAllowLocalNetworking = true;
-
-  checkPhase = ''
-    ${python.interpreter} -m unittest
-  '';
+  passthru.optional-dependencies = {
+    coverage = [
+      coverage
+    ];
+  };
 
   pythonImportsCheck = [
     "nose2"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
+  nativeCheckInputs = [
+    unittestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+
+  preCheck = ''
+    # https://github.com/nose-devs/nose2/issues/588
+    substituteInPlace nose2/tests/functional/test_junitxml_plugin.py \
+      --replace "test_skip_reason_in_message" "dont_test_skip_reason_in_message"
+  '';
+
   meta = with lib; {
     description = "Test runner for Python";
     homepage = "https://github.com/nose-devs/nose2";
diff --git a/pkgs/development/python-modules/nosexcover/default.nix b/pkgs/development/python-modules/nosexcover/default.nix
index 21d11f0d6d90..19d34904739b 100644
--- a/pkgs/development/python-modules/nosexcover/default.nix
+++ b/pkgs/development/python-modules/nosexcover/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , coverage
 , nose
 }:
@@ -10,6 +11,9 @@ buildPythonPackage rec {
   version = "1.0.11";
   format = "setuptools";
 
+  # requires the imp module
+  disabled = pythonAtLeast "3.12";
+
   src = fetchPypi {
     inherit pname version;
     sha256 = "298c3c655da587f6cab8a666e9f4b150320032431062dea91353988d45c8b883";
diff --git a/pkgs/development/python-modules/notebook/default.nix b/pkgs/development/python-modules/notebook/default.nix
index 88f4c975a858..e26ec900682a 100644
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "notebook";
-  version = "7.0.3";
+  version = "7.0.6";
   disabled = pythonOlder "3.8";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B/PFBi/Q5uaYZEN6A0erxIXZkaroepLEfWWWmfVxtyk=";
+    hash = "sha256-7GETsGUpAZ9/KHgZrwbJeiuvepWsIaj24yGSiY6fmlg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/notion-client/default.nix b/pkgs/development/python-modules/notion-client/default.nix
index 9848868f0062..0e24bb60ad48 100644
--- a/pkgs/development/python-modules/notion-client/default.nix
+++ b/pkgs/development/python-modules/notion-client/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pythonOlder
 , pytestCheckHook
+, setuptools
 , anyio
 , httpx
 , pytest-asyncio
@@ -11,17 +12,22 @@
 
 buildPythonPackage rec {
   pname = "notion-client";
-  version = "2.0.0";
-  format = "setuptools";
+  version = "2.1.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ramnes";
     repo = "notion-sdk-py";
-    rev = version;
-    hash = "sha256-zfG1OgH/2ytDUC+ogIY9/nP+xkgjiMt9+HVcWEMXoj8=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-u10iPSbFPv9RewEYru3V6MpwhhySzmnymmv4CsefGC8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     httpx
   ];
diff --git a/pkgs/development/python-modules/ntc-templates/default.nix b/pkgs/development/python-modules/ntc-templates/default.nix
index c7cf3b23ae61..38927877146a 100644
--- a/pkgs/development/python-modules/ntc-templates/default.nix
+++ b/pkgs/development/python-modules/ntc-templates/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "ntc-templates";
-  version = "3.5.0";
+  version = "4.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "networktocode";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FhKMDSAW+MifAy2EnHePbSfY56rdK1SfOe85bFte6ps=";
+    hash = "sha256-tenztWqSjVVDJygBvJpdLFbKmz+TPKYu0UhscqJBhLc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/numcodecs/default.nix b/pkgs/development/python-modules/numcodecs/default.nix
index d5722053c6e1..a0a452a0ecc2 100644
--- a/pkgs/development/python-modules/numcodecs/default.nix
+++ b/pkgs/development/python-modules/numcodecs/default.nix
@@ -1,30 +1,40 @@
 { lib
 , stdenv
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
-, isPy27
 , setuptools
 , setuptools-scm
 , cython
-, entrypoints
 , numpy
 , msgpack
 , py-cpuinfo
 , pytestCheckHook
 , python
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "numcodecs";
-  version = "0.11.0";
-  format ="pyproject";
-  disabled = isPy27;
+  version = "0.12.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bAWLMh3oShcpKZsOrk1lKy5I6hyn+d8NplyxNHDmNes=";
+    hash = "sha256-BdkaQzcz5+7yaNfoDsImoCMtokQolhSo84JpAa7BCY4=";
   };
 
+  patches = [
+    # https://github.com/zarr-developers/numcodecs/pull/487
+    (fetchpatch {
+      name = "fix-tests.patch";
+      url = "https://github.com/zarr-developers/numcodecs/commit/4896680087d3ff1f959401c51cf5aea0fd56554e.patch";
+      hash = "sha256-+lMWK5IsNzJ7H2SmLckgxbSSRIIcC7FtGYSBKQtuo+Y=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools
     setuptools-scm
@@ -33,17 +43,21 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    entrypoints
     numpy
-    msgpack
   ];
 
+  passthru.optional-dependencies = {
+    msgpack = [ msgpack ];
+    # zfpy = [ zfpy ];
+  };
+
   preBuild = if (stdenv.hostPlatform.isx86 && !stdenv.hostPlatform.avx2Support) then ''
     export DISABLE_NUMCODECS_AVX2=
   '' else null;
 
   nativeCheckInputs = [
     pytestCheckHook
+    msgpack
   ];
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/numexpr/default.nix b/pkgs/development/python-modules/numexpr/default.nix
index 6acc3e53f4e4..6316ba29356c 100644
--- a/pkgs/development/python-modules/numexpr/default.nix
+++ b/pkgs/development/python-modules/numexpr/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "numexpr";
-  version = "2.8.6";
+  version = "2.8.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Yzb426P0VuQaT/w8l+tj2JxzWJ/24XBxQSJLkwJjJg0=";
+    hash = "sha256-WW7rO7/ryRL0tuqvhCthunIs69uLxC3++mV9OnSVOEk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/numpy/0001-BLD-remove-last-usage-of-distutils-in-_core-code_gen.patch b/pkgs/development/python-modules/numpy/0001-BLD-remove-last-usage-of-distutils-in-_core-code_gen.patch
new file mode 100644
index 000000000000..b9bc53e0b84d
--- /dev/null
+++ b/pkgs/development/python-modules/numpy/0001-BLD-remove-last-usage-of-distutils-in-_core-code_gen.patch
@@ -0,0 +1,71 @@
+From 0d0476328a1a2e3dd3e96340bd4ddd04d98c067b Mon Sep 17 00:00:00 2001
+From: Ralf Gommers <ralf.gommers@gmail.com>
+Date: Thu, 26 Oct 2023 16:57:03 +0200
+Subject: [PATCH] BLD: remove last usage of `distutils` in
+ `_core/code_generators/`
+
+---
+ numpy/core/code_generators/genapi.py             | 9 ---------
+ numpy/core/code_generators/generate_numpy_api.py | 7 +------
+ numpy/core/code_generators/generate_ufunc_api.py | 7 +------
+ 3 files changed, 2 insertions(+), 21 deletions(-)
+
+diff --git a/numpy/core/code_generators/genapi.py b/numpy/core/code_generators/genapi.py
+index 2cdaba52d..d9d7862b2 100644
+--- a/numpy/core/code_generators/genapi.py
++++ b/numpy/core/code_generators/genapi.py
+@@ -304,15 +304,6 @@ def find_functions(filename, tag='API'):
+     fo.close()
+     return functions
+ 
+-def should_rebuild(targets, source_files):
+-    from distutils.dep_util import newer_group
+-    for t in targets:
+-        if not os.path.exists(t):
+-            return True
+-    sources = API_FILES + list(source_files) + [__file__]
+-    if newer_group(sources, targets[0], missing='newer'):
+-        return True
+-    return False
+ 
+ def write_file(filename, data):
+     """
+diff --git a/numpy/core/code_generators/generate_numpy_api.py b/numpy/core/code_generators/generate_numpy_api.py
+index ae38c4efc..640bae9e5 100644
+--- a/numpy/core/code_generators/generate_numpy_api.py
++++ b/numpy/core/code_generators/generate_numpy_api.py
+@@ -148,12 +148,7 @@ def generate_api(output_dir, force=False):
+     targets = (h_file, c_file)
+ 
+     sources = numpy_api.multiarray_api
+-
+-    if (not force and not genapi.should_rebuild(targets, [numpy_api.__file__, __file__])):
+-        return targets
+-    else:
+-        do_generate_api(targets, sources)
+-
++    do_generate_api(targets, sources)
+     return targets
+ 
+ def do_generate_api(targets, sources):
+diff --git a/numpy/core/code_generators/generate_ufunc_api.py b/numpy/core/code_generators/generate_ufunc_api.py
+index e03299a52..3734cbd6a 100644
+--- a/numpy/core/code_generators/generate_ufunc_api.py
++++ b/numpy/core/code_generators/generate_ufunc_api.py
+@@ -125,12 +125,7 @@ def generate_api(output_dir, force=False):
+     targets = (h_file, c_file)
+ 
+     sources = ['ufunc_api_order.txt']
+-
+-    if (not force and not genapi.should_rebuild(targets, sources + [__file__])):
+-        return targets
+-    else:
+-        do_generate_api(targets, sources)
+-
++    do_generate_api(targets, sources)
+     return targets
+ 
+ def do_generate_api(targets, sources):
+-- 
+2.42.0
+
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index 62ffc91e8767..ff50cf872f9c 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -53,17 +53,20 @@ let
   };
 in buildPythonPackage rec {
   pname = "numpy";
-  version = "1.26.1";
+  version = "1.26.2";
   pyproject = true;
   disabled = pythonOlder "3.9" || pythonAtLeast "3.13";
 
   src = fetchPypi {
     inherit pname version;
     extension = "tar.gz";
-    hash = "sha256-yMbHLUqfgx8yjvsTEmQqHK+vqoiYHZq3Y2jVDQfZPL4=";
+    hash = "sha256-9lc4RHZ2q1d38R5ru9uM4Rt4XhBfaQvEWWZXSBa20+o=";
   };
 
   patches = [
+    # Remove last usage of distutils to enable numpy on Python 3.12
+    ./0001-BLD-remove-last-usage-of-distutils-in-_core-code_gen.patch
+
     # Disable `numpy/core/tests/test_umath.py::TestComplexFunctions::test_loss_of_precision[complex256]`
     # on x86_64-darwin because it fails under Rosetta 2 due to issues with trig functions and
     # 80-bit long double complex numbers.
diff --git a/pkgs/development/python-modules/numpydoc/default.nix b/pkgs/development/python-modules/numpydoc/default.nix
index f189c16eafb2..428ea03ed287 100644
--- a/pkgs/development/python-modules/numpydoc/default.nix
+++ b/pkgs/development/python-modules/numpydoc/default.nix
@@ -2,36 +2,41 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
+, setuptools
 , jinja2
 , sphinx
+, tabulate
 , pytestCheckHook
 , matplotlib
 }:
 
 buildPythonPackage rec {
   pname = "numpydoc";
-  version = "1.5.0";
-  format = "setuptools";
+  version = "1.6.0";
+  pyproject = true;
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname;
     inherit version;
-    hash = "sha256-sNt7daMjZ6DiXCOzl4QsZeNEoSBlJNFsgGnwockbX0w=";
+    hash = "sha256-rnpTgPCgY3PDr+FszRW9ebxrB/JwTLxvHn7MlLT1/A0=";
   };
 
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace "Jinja2>=2.10,<3.1" "Jinja2>=2.10,<3.2"
-    substituteInPlace setup.cfg \
+    substituteInPlace pyproject.toml \
       --replace "--cov-report=" "" \
       --replace "--cov=numpydoc" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     jinja2
     sphinx
+    tabulate
   ];
 
   nativeCheckInputs = [
@@ -51,6 +56,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
+    changelog = "https://github.com/numpy/numpydoc/releases/tag/v${version}";
     description = "Sphinx extension to support docstrings in Numpy format";
     homepage = "https://github.com/numpy/numpydoc";
     license = lib.licenses.free;
diff --git a/pkgs/development/python-modules/nutils/default.nix b/pkgs/development/python-modules/nutils/default.nix
index 421131e7f8e2..803a4f1c04fd 100644
--- a/pkgs/development/python-modules/nutils/default.nix
+++ b/pkgs/development/python-modules/nutils/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "nutils";
-  version = "8.3";
+  version = "8.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "evalf";
     repo = "nutils";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6VvzUKKUB5SkmvC7PFPqGayc51t3PTMPwrxgZI5+jHA=";
+    hash = "sha256-cwMo3ixTK7UO9sxhcQBN4/gNZNAoBH/xL2tZ1Orh8LE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oca-port/default.nix b/pkgs/development/python-modules/oca-port/default.nix
index 7b948c4ffdf3..13a146b1dce6 100644
--- a/pkgs/development/python-modules/oca-port/default.nix
+++ b/pkgs/development/python-modules/oca-port/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     requests
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   passthru.updateScript = nix-update-script { };
 
   pythonImportsCheck = [ "oca_port" ];
diff --git a/pkgs/development/python-modules/oci/default.nix b/pkgs/development/python-modules/oci/default.nix
index f75cd25f21ec..8ead56fdae90 100644
--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@@ -9,6 +9,7 @@
 , pythonOlder
 , pythonRelaxDepsHook
 , pytz
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -32,6 +33,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     pythonRelaxDepsHook
+    setuptools
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 93e3b0bf22f9..1104bcc02f82 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -31,11 +31,11 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "15.4.0";
+  version = "15.4.4";
 
   disabled = pythonOlder "3.9";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ocrmypdf";
@@ -47,11 +47,9 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-cbKqisaRAeT8ljANbYiUDrptAoQmmIkMu1ya8O6nXvQ=";
+    hash = "sha256-Ff0OrSJFglVPpSNB0KvDMnatj+P57zWdcVAFaM+Sg0s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   patches = [
     (substituteAll {
       src = ./paths.patch;
diff --git a/pkgs/development/python-modules/ocrmypdf/paths.patch b/pkgs/development/python-modules/ocrmypdf/paths.patch
index a1db7c690bcf..1701a73215d0 100644
--- a/pkgs/development/python-modules/ocrmypdf/paths.patch
+++ b/pkgs/development/python-modules/ocrmypdf/paths.patch
@@ -1,16 +1,16 @@
 diff --git a/src/ocrmypdf/_exec/ghostscript.py b/src/ocrmypdf/_exec/ghostscript.py
-index 92b73a0a..9f04555c 100644
+index 94eec244..4bb15db9 100644
 --- a/src/ocrmypdf/_exec/ghostscript.py
 +++ b/src/ocrmypdf/_exec/ghostscript.py
-@@ -58,7 +58,7 @@ log.addFilter(DuplicateFilter(log))
- 
- 
+@@ -31,7 +31,7 @@ COLOR_CONVERSION_STRATEGIES = frozenset(
+     ]
+ )
  # Ghostscript executable - gswin32c is not supported
 -GS = 'gswin64c' if os.name == 'nt' else 'gs'
 +GS = '@gs@'
  
  
- def version() -> Version:
+ log = logging.getLogger(__name__)
 diff --git a/src/ocrmypdf/_exec/jbig2enc.py b/src/ocrmypdf/_exec/jbig2enc.py
 index 5a34a95a..5ee1b333 100644
 --- a/src/ocrmypdf/_exec/jbig2enc.py
diff --git a/pkgs/development/python-modules/oemthermostat/default.nix b/pkgs/development/python-modules/oemthermostat/default.nix
index b97ddf64eb5b..f40e39f10bf6 100644
--- a/pkgs/development/python-modules/oemthermostat/default.nix
+++ b/pkgs/development/python-modules/oemthermostat/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     sha256 = "vrMw3/X8MtejO1WyUA1DOlfVCPTCPgcK5p3+OlTWcM4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/oldest-supported-numpy/default.nix b/pkgs/development/python-modules/oldest-supported-numpy/default.nix
index 5d6e11c34daf..7349a63a2c2a 100644
--- a/pkgs/development/python-modules/oldest-supported-numpy/default.nix
+++ b/pkgs/development/python-modules/oldest-supported-numpy/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "oldest-supported-numpy";
-  version = "2023.8.3";
+  version = "2023.10.25";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yJp+wzsihagnI3crGPDBo+CqbVO4Xhxulj/o/NitxU0=";
+    hash = "sha256-dBqJrxLoyCMl9zEmtTORXc4QYNoPnk7GQtpGZoBoYpY=";
   };
 
   # The purpose of oldest-supported-numpy is to build a project against the
diff --git a/pkgs/development/python-modules/omegaconf/default.nix b/pkgs/development/python-modules/omegaconf/default.nix
index c6dfada82bd2..8ee54d3c6925 100644
--- a/pkgs/development/python-modules/omegaconf/default.nix
+++ b/pkgs/development/python-modules/omegaconf/default.nix
@@ -1,6 +1,7 @@
 { lib
 , antlr4
 , antlr4-python3-runtime
+, attrs
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
@@ -55,6 +56,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    attrs
     pydevd
     pytest-mock
     pytestCheckHook
diff --git a/pkgs/development/python-modules/onnx/default.nix b/pkgs/development/python-modules/onnx/default.nix
index d0866f6c0a83..810ddbf62cf2 100644
--- a/pkgs/development/python-modules/onnx/default.nix
+++ b/pkgs/development/python-modules/onnx/default.nix
@@ -20,7 +20,7 @@ let
   gtestStatic = gtest.override { static = true; };
 in buildPythonPackage rec {
   pname = "onnx";
-  version = "1.14.1";
+  version = "1.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ in buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZVSdk6LeAiZpQrrzLxphMbc1b3rNUMpcxcXPP8s/5tE=";
+    hash = "sha256-Jzga1IiUO5LN5imSUmnbsjYtapRatTihx38EOUjm9Os=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index 2bab76a391d1..1488eed8440c 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 , hatchling
 # propagated
 , httpx
@@ -28,6 +29,7 @@ buildPythonPackage rec {
   version = "1.6.1";
   pyproject = true;
 
+
   disabled = pythonOlder "3.7.1";
 
   src = fetchFromGitHub {
@@ -39,6 +41,12 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    # https://github.com/openai/openai-python/issues/921
+    "anyio"
   ];
 
   propagatedBuildInputs = [
@@ -72,6 +80,10 @@ buildPythonPackage rec {
     dirty-equals
   ];
 
+  pytestFlagsArray = [
+    "-W" "ignore::DeprecationWarning"
+  ];
+
   OPENAI_API_KEY = "sk-foo";
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/openapi-core/default.nix b/pkgs/development/python-modules/openapi-core/default.nix
index 282c659291a4..a6ddc2f5a61c 100644
--- a/pkgs/development/python-modules/openapi-core/default.nix
+++ b/pkgs/development/python-modules/openapi-core/default.nix
@@ -28,8 +28,8 @@
 
 buildPythonPackage rec {
   pname = "openapi-core";
-  version = "0.18.1";
-  format = "pyproject";
+  version = "0.18.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "p1c2u";
     repo = "openapi-core";
     rev = "refs/tags/${version}";
-    hash = "sha256-8zD4SDGH7Pcu54CcBTJ9Q2sbYfWP4OyNh5STatZ7pAk=";
+    hash = "sha256-5sNI6ujqDQ5L4afVHYZkm2pKa8yATtHFo7MF3eFF8Ig=";
   };
 
   postPatch = ''
@@ -104,7 +104,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Client-side and server-side support for the OpenAPI Specification v3";
-    homepage = "https://github.com/p1c2u/openapi-core";
+    homepage = "https://github.com/python-openapi/openapi-core";
     license = licenses.bsd3;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/openapi-schema-validator/default.nix b/pkgs/development/python-modules/openapi-schema-validator/default.nix
index 39074543b42f..4b0608c7572e 100644
--- a/pkgs/development/python-modules/openapi-schema-validator/default.nix
+++ b/pkgs/development/python-modules/openapi-schema-validator/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "openapi-schema-validator";
-  version = "0.6.0";
+  version = "0.6.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "p1c2u";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-859v6KqIRfUq4d/KbkvGnGqlxz6BXTl+tKQHPhtkTH0=";
+    hash = "sha256-CfSlF6DWkYxxVNTNBkr0+KVeKpqxEEqkz4VBenqo+l0=";
   };
 
   postPatch = ''
@@ -47,12 +47,19 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # https://github.com/python-openapi/openapi-schema-validator/issues/153
+    "test_array_prefixitems_invalid"
+  ];
+
+  pytestFlagsArray = [ "-vvv" ];
+
   pythonImportsCheck = [ "openapi_schema_validator" ];
 
   meta = with lib; {
     changelog = "https://github.com/python-openapi/openapi-schema-validator/releases/tag/${version}";
     description = "Validates OpenAPI schema against the OpenAPI Schema Specification v3.0";
-    homepage = "https://github.com/p1c2u/openapi-schema-validator";
+    homepage = "https://github.com/python-openapi/openapi-schema-validator";
     license = licenses.bsd3;
     maintainers = with maintainers; [ AluisioASG ];
   };
diff --git a/pkgs/development/python-modules/openapi-spec-validator/default.nix b/pkgs/development/python-modules/openapi-spec-validator/default.nix
index 9312f4b1b2b9..4c89b6999907 100644
--- a/pkgs/development/python-modules/openapi-spec-validator/default.nix
+++ b/pkgs/development/python-modules/openapi-spec-validator/default.nix
@@ -9,7 +9,7 @@
 # propagates
 , importlib-resources
 , jsonschema
-, jsonschema-spec
+, jsonschema-path
 , lazy-object-proxy
 , openapi-schema-validator
 
@@ -19,17 +19,17 @@
 
 buildPythonPackage rec {
   pname = "openapi-spec-validator";
-  version = "0.6.0";
-  format = "pyproject";
+  version = "0.7.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   # no tests via pypi sdist
   src = fetchFromGitHub {
-    owner = "p1c2u";
+    owner = "python-openapi";
     repo = "openapi-spec-validator";
     rev = "refs/tags/${version}";
-    hash = "sha256-sGr4dH6Twyi4OeCAXZiboN75dYZ6wJ0pWMzV9zOfee0=";
+    hash = "sha256-X0ePdHQeBSWjsCFQgCoNloQZRhKbvPBE43aavBppvmg=";
   };
 
   postPatch = ''
@@ -42,7 +42,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     jsonschema
-    jsonschema-spec
+    jsonschema-path
     lazy-object-proxy
     openapi-schema-validator
   ] ++ lib.optionals (pythonOlder "3.9") [
diff --git a/pkgs/development/python-modules/openllm-core/default.nix b/pkgs/development/python-modules/openllm-core/default.nix
index ccf6aceef8bf..c807f668b271 100644
--- a/pkgs/development/python-modules/openllm-core/default.nix
+++ b/pkgs/development/python-modules/openllm-core/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 , accelerate
 , attrs
 , bitsandbytes
@@ -41,6 +42,17 @@ buildPythonPackage rec {
     hatch-fancy-pypi-readme
     hatch-vcs
     hatchling
+    pythonRelaxDepsHook
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "hatch-vcs==0.3.0" "hatch-vcs" \
+      --replace "hatchling==1.18.0" "hatchling"
+  '';
+
+  pythonRelaxDeps = [
+    "cattrs"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openpyxl/default.nix b/pkgs/development/python-modules/openpyxl/default.nix
index 799c991e40fe..82af53c55119 100644
--- a/pkgs/development/python-modules/openpyxl/default.nix
+++ b/pkgs/development/python-modules/openpyxl/default.nix
@@ -1,12 +1,16 @@
 { lib
 , buildPythonPackage
-, et-xmlfile
 , fetchFromGitLab
-, jdcal
+, pythonOlder
+
+# dependencies
+, et-xmlfile
+
+# tests
 , lxml
+, pandas
 , pillow
 , pytestCheckHook
-, pythonOlder
 }:
 
 buildPythonPackage rec {
@@ -25,16 +29,33 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    jdcal
     et-xmlfile
-    lxml
   ];
 
   nativeCheckInputs = [
+    lxml
+    pandas
     pillow
     pytestCheckHook
   ];
 
+  pytestFlagsArray = [
+    # broken since lxml 2.12; https://foss.heptapod.net/openpyxl/openpyxl/-/issues/2116
+    "--deselect=openpyxl/chart/tests/test_reader.py::test_read"
+    "--deselect=openpyxl/comments/tests/test_comment_reader.py::test_read_comments"
+    "--deselect=openpyxl/drawing/tests/test_spreadsheet_drawing.py::TestSpreadsheetDrawing::test_ignore_external_blip"
+    "--deselect=openpyxl/packaging/tests/test_manifest.py::TestManifest::test_from_xml"
+    "--deselect=openpyxl/packaging/tests/test_manifest.py::TestManifest::test_filenames"
+    "--deselect=openpyxl/packaging/tests/test_manifest.py::TestManifest::test_exts"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_from_complex"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_merge_named_styles"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_unprotected_cell"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_none_values"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_rgb_colors"
+    "--deselect=openpyxl/styles/tests/test_stylesheet.py::TestStylesheet::test_named_styles"
+    "--deselect=openpyxl/workbook/external_link/tests/test_external.py::test_read_ole_link"
+  ];
+
   pythonImportsCheck = [
     "openpyxl"
   ];
diff --git a/pkgs/development/python-modules/openstacksdk/default.nix b/pkgs/development/python-modules/openstacksdk/default.nix
index 748149ae1f44..6ad0aeca07d9 100644
--- a/pkgs/development/python-modules/openstacksdk/default.nix
+++ b/pkgs/development/python-modules/openstacksdk/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , callPackage
 , fetchPypi
-, appdirs
+, platformdirs
 , cryptography
 , dogpile-cache
 , jmespath
@@ -19,18 +19,18 @@
 
 buildPythonPackage rec {
   pname = "openstacksdk";
-  version = "1.5.0";
+  version = "2.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FBtR+ijGsc3rmOvcOMHO5qTnVL1ryEq3qqDQwrzlRD4=";
+    hash = "sha256-aXy2JRXFSNO3/Fyz+GXiebkw05433OsR2HH4H5+lkeg=";
   };
 
   propagatedBuildInputs = [
-    appdirs
+    platformdirs
     cryptography
     dogpile-cache
     jmespath
diff --git a/pkgs/development/python-modules/opentelemetry-api/default.nix b/pkgs/development/python-modules/opentelemetry-api/default.nix
index 289784d4ac41..72957901af41 100644
--- a/pkgs/development/python-modules/opentelemetry-api/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-api/default.nix
@@ -14,7 +14,7 @@
 let
   self = buildPythonPackage rec {
     pname = "opentelemetry-api";
-    version = "1.20.0";
+    version = "1.21.0";
     disabled = pythonOlder "3.7";
 
     # to avoid breakage, every package in opentelemetry-python must inherit this version, src, and meta
@@ -22,7 +22,7 @@ let
       owner = "open-telemetry";
       repo = "opentelemetry-python";
       rev = "refs/tags/v${version}";
-      hash = "sha256-tOg3G6BjHInY5TFYyS7/JA4mQajeP0b1QjrZBGqiqnM=";
+      hash = "sha256-igG0oHRa6M4d7pMp7fgBo13x5XADZeYgFAL8WzDXsyw=";
     };
 
     sourceRoot = "${src.name}/opentelemetry-api";
diff --git a/pkgs/development/python-modules/openwebifpy/default.nix b/pkgs/development/python-modules/openwebifpy/default.nix
index 8672e8a7695f..48d5ba86ff75 100644
--- a/pkgs/development/python-modules/openwebifpy/default.nix
+++ b/pkgs/development/python-modules/openwebifpy/default.nix
@@ -1,11 +1,17 @@
 { lib
-, aiohttp
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
 , setuptools
+
+# dependencies
+, aiohttp
 , yarl
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -44,7 +50,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Provides a python interface to interact with a device running OpenWebIf";
-    homepage = "https://github.com/autinerd/openwebifpy";
+    downloadPage = "https://github.com/autinerd/openwebifpy";
+    homepage = "https://openwebifpy.readthedocs.io/";
     changelog = "https://github.com/autinerd/openwebifpy/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ hexa ];
diff --git a/pkgs/development/python-modules/opt-einsum/default.nix b/pkgs/development/python-modules/opt-einsum/default.nix
index fd51ead5a0e3..e943d67c7baa 100644
--- a/pkgs/development/python-modules/opt-einsum/default.nix
+++ b/pkgs/development/python-modules/opt-einsum/default.nix
@@ -1,6 +1,8 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
+, setuptools
 , numpy
 , pytestCheckHook
 , pythonOlder
@@ -9,7 +11,7 @@
 buildPythonPackage rec {
   version = "3.3.0";
   pname = "opt-einsum";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -19,6 +21,19 @@ buildPythonPackage rec {
     hash = "sha256-WfZHX3e7w33PfNdIUZwOxgci6R5jyhFOaIIcDFSkZUk=";
   };
 
+  patches = [
+    # https://github.com/dgasmith/opt_einsum/pull/208
+    (fetchpatch {
+      name = "python312-compatibility.patch";
+      url = "https://github.com/dgasmith/opt_einsum/commit/0beacf96923bbb2dd1939a9c59398a38ce7a11b1.patch";
+      hash = "sha256-dmmEzhy17huclo1wOubpBUDc2L7vqEU5b/6a5loM47A=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     numpy
   ];
diff --git a/pkgs/development/python-modules/oscrypto/default.nix b/pkgs/development/python-modules/oscrypto/default.nix
index 92edbdf84eb9..c3cea1d5bcde 100644
--- a/pkgs/development/python-modules/oscrypto/default.nix
+++ b/pkgs/development/python-modules/oscrypto/default.nix
@@ -3,6 +3,7 @@
 , asn1crypto
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , openssl
 , pytestCheckHook
 , pythonOlder
@@ -24,6 +25,12 @@ buildPythonPackage rec {
 
   patches = [
     ./support-openssl-3.0.10.patch
+
+    (fetchpatch {
+      # backport removal of imp module usage
+      url = "https://github.com/wbond/oscrypto/commit/3865f5d528740aa1205d16ddbee84c5b48aeb078.patch";
+      hash = "sha256-lQGoPM7EicwCPWapEDkqWEqMqXk4tijiImxndcDFqY4=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/oslo-db/default.nix b/pkgs/development/python-modules/oslo-db/default.nix
index 351c213faffd..708bbd62c36f 100644
--- a/pkgs/development/python-modules/oslo-db/default.nix
+++ b/pkgs/development/python-modules/oslo-db/default.nix
@@ -7,6 +7,7 @@
 , oslo-utils
 , oslotest
 , pbr
+, setuptools
 , sqlalchemy
 , sqlalchemy-migrate
 , stestr
@@ -16,16 +17,19 @@
 
 buildPythonPackage rec {
   pname = "oslo-db";
-  version = "14.0.0";
-  format = "setuptools";
+  version = "14.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "oslo.db";
     inherit version;
-    hash = "sha256-nAipzYOOv/rSHrMBL64AKg93v5Vpb6RNBbG2OiJ+n8E=";
+    hash = "sha256-UFilywqwhXaGnle8K5VNdZqMvhklkTMdHPMDMvz62h8=";
   };
 
-  nativeBuildInputs = [ pbr ];
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     alembic
diff --git a/pkgs/development/python-modules/oslo-i18n/default.nix b/pkgs/development/python-modules/oslo-i18n/default.nix
index 6c7f2065a836..99e22ea54993 100644
--- a/pkgs/development/python-modules/oslo-i18n/default.nix
+++ b/pkgs/development/python-modules/oslo-i18n/default.nix
@@ -3,19 +3,20 @@
 , fetchPypi
 , oslotest
 , pbr
+, setuptools
 , testscenarios
 , stestr
 }:
 
 buildPythonPackage rec {
   pname = "oslo-i18n";
-  version = "6.1.0";
-  format = "setuptools";
+  version = "6.2.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "oslo.i18n";
     inherit version;
-    hash = "sha256-4rgp8gW/HrYgR1bMNAJ9EZSUti0nH+7oYL+BbKegfq0=";
+    hash = "sha256-cPikzphxKRvGCdB+MeblAyZmVWmS/xrlPnjy7SpavoI=";
   };
 
   postPatch = ''
@@ -24,7 +25,10 @@ buildPythonPackage rec {
     rm test-requirements.txt
   '';
 
-  nativeBuildInputs = [ pbr ];
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
 
   nativeCheckInputs = [
     oslotest
diff --git a/pkgs/development/python-modules/oslo-utils/default.nix b/pkgs/development/python-modules/oslo-utils/default.nix
index 688402199bfc..196228ce37ce 100644
--- a/pkgs/development/python-modules/oslo-utils/default.nix
+++ b/pkgs/development/python-modules/oslo-utils/default.nix
@@ -14,8 +14,10 @@
 , pbr
 , pyparsing
 , pytz
+, setuptools
 , stestr
 , testscenarios
+, tzdata
 , pyyaml
 , iana-etc
 , libredirect
@@ -23,13 +25,13 @@
 
 buildPythonPackage rec {
   pname = "oslo-utils";
-  version = "6.2.1";
-  format = "setuptools";
+  version = "6.3.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "oslo.utils";
     inherit version;
-    hash = "sha256-EyK6BfoP88Gor8cn/PlF31qoLWWEcn0uBK8Di1roQkQ=";
+    hash = "sha256-dY2UWyutW+qBq+2ArTP/6h0deTNIrF61s4Zrp0WxHVU=";
   };
 
   postPatch = ''
@@ -38,7 +40,10 @@ buildPythonPackage rec {
     rm test-requirements.txt
   '';
 
-  nativeBuildInputs = [ pbr ];
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     debtcollector
@@ -49,6 +54,7 @@ buildPythonPackage rec {
     packaging
     pyparsing
     pytz
+    tzdata
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/osqp/default.nix b/pkgs/development/python-modules/osqp/default.nix
index ac933f65e1c2..13797c4d17f8 100644
--- a/pkgs/development/python-modules/osqp/default.nix
+++ b/pkgs/development/python-modules/osqp/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-A+Rg5oPsLOD4OTU936PEyP+lCauM9qKyr7tYb6RT4YA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dontUseCmakeConfigure = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ossfs/default.nix b/pkgs/development/python-modules/ossfs/default.nix
index 17b3ad2c8b05..97f61f62199b 100644
--- a/pkgs/development/python-modules/ossfs/default.nix
+++ b/pkgs/development/python-modules/ossfs/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-N1NkpI8inGJCf0xuc+FFmVX85CS7vqzoNddxZ9kqEk0=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "aiooss2"
     "fsspec"
diff --git a/pkgs/development/python-modules/outcome/default.nix b/pkgs/development/python-modules/outcome/default.nix
index f081bbed2bcb..0fa4ba74deab 100644
--- a/pkgs/development/python-modules/outcome/default.nix
+++ b/pkgs/development/python-modules/outcome/default.nix
@@ -1,19 +1,27 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools
 , attrs
 , pytest
 }:
 
 buildPythonPackage rec {
   pname = "outcome";
-  version = "1.2.0";
-  format = "setuptools";
+  version = "1.3.0.post0";
+
   disabled = pythonOlder "3.4";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-b4K9PeRdowPPH3ceyvoWM3UKNYQ2qLtg4Goc63RdJnI=";
+    hash = "sha256-nc8C5l8pcbgAR7N3Ro5yomjhXArzzxI45v8U9/kRQ7g=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [ pytest ];
   propagatedBuildInputs = [ attrs ];
   # Has a test dependency on trio, which depends on outcome.
diff --git a/pkgs/development/python-modules/overrides/default.nix b/pkgs/development/python-modules/overrides/default.nix
index 7fc464143081..8109a428140d 100644
--- a/pkgs/development/python-modules/overrides/default.nix
+++ b/pkgs/development/python-modules/overrides/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pythonOlder
 , pytestCheckHook
 }:
@@ -23,6 +24,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # KeyError: 'assertRaises'
+    "test_enforcing_when_incompatible"
+  ];
+
   pythonImportsCheck = [
     "overrides"
   ];
diff --git a/pkgs/development/python-modules/packaging/default.nix b/pkgs/development/python-modules/packaging/default.nix
index 0c4678a460ac..123c1230fc87 100644
--- a/pkgs/development/python-modules/packaging/default.nix
+++ b/pkgs/development/python-modules/packaging/default.nix
@@ -1,23 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
+
+# build-system
 , flit-core
+
+# tests
 , pretend
 , pytestCheckHook
-, pythonOlder
 }:
 
 let
   packaging = buildPythonPackage rec {
     pname = "packaging";
-    version = "23.1";
-    format = "pyproject";
+    version = "23.2";
+    pyproject = true;
 
     disabled = pythonOlder "3.7";
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-o5KYDSts/6ZEQxiYvlSwBFFRMZ0efsNPDP7Uh2fdM08=";
+      hash = "sha256-BI+w6UBQNlGOqvSKVZU8dQwR4aG2jg3RqdYu0MCSz8U=";
     };
 
     nativeBuildInputs = [
@@ -29,18 +33,27 @@ let
       pretend
     ];
 
+    pythonImportsCheck = [
+      "packaging"
+      "packaging.metadata"
+      "packaging.requirements"
+      "packaging.specifiers"
+      "packaging.tags"
+      "packaging.version"
+    ];
+
     # Prevent circular dependency with pytest
     doCheck = false;
 
-    pythonImportsCheck = [ "packaging" ];
-
     passthru.tests = packaging.overridePythonAttrs (_: { doCheck = true; });
 
     meta = with lib; {
+      changelog = "https://github.com/pypa/packaging/blob/${version}/CHANGELOG.rst";
       description = "Core utilities for Python packages";
-      homepage = "https://github.com/pypa/packaging";
+      downloadPage = "https://github.com/pypa/packaging";
+      homepage = "https://packaging.pypa.io/";
       license = with licenses; [ bsd2 asl20 ];
-      maintainers = with maintainers; [ bennofs ];
+      maintainers = teams.python.members ++ (with maintainers; [ bennofs ]);
     };
   };
 in
diff --git a/pkgs/development/python-modules/paginate/default.nix b/pkgs/development/python-modules/paginate/default.nix
new file mode 100644
index 000000000000..ad22a818aee3
--- /dev/null
+++ b/pkgs/development/python-modules/paginate/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonAtLeast
+
+# build-system
+, setuptools
+
+# tests
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "paginate";
+  version = "0.5.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Pylons";
+    repo = "paginate";
+    rev = version;
+    hash = "sha256-HZWwOYOCk4mAmz8OnM9hhlf8HA+jC75dYVeo0l4a09o=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "paginate"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/Pylons/paginate/issues/19
+    "test_wrong_collection"
+    "test_unsliceable_sequence3"
+  ];
+
+  meta = with lib; {
+    description = "Python pagination module";
+    homepage = "https://github.com/Pylons/paginate";
+    changelog = "https://github.com/Pylons/paginate/blob/${src.rev}/CHANGELOG.txt";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 588dae7b7840..7351e6536416 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -2,10 +2,12 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pythonOlder
 
 # build-system
 , cython
+, cython_3
 , meson-python
 , meson
 , oldest-supported-numpy
@@ -23,7 +25,6 @@
 , beautifulsoup4
 , bottleneck
 , blosc2
-, brotlipy
 , fsspec
 , gcsfs
 , html5lib
@@ -39,7 +40,6 @@
 , pymysql
 , pyqt5
 , pyreadstat
-, python-snappy
 , qtpy
 , s3fs
 , scipy
@@ -63,9 +63,9 @@
 , runtimeShell
 }:
 
-buildPythonPackage rec {
+let pandas = buildPythonPackage rec {
   pname = "pandas";
-  version = "2.1.1";
+  version = "2.1.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -74,17 +74,19 @@ buildPythonPackage rec {
     owner = "pandas-dev";
     repo = "pandas";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6SgW4BtO7EFnS8P8LL4AGk5EdPwOQ0+is0wXgqsm9w0=";
+    hash = "sha256-okGYzPJC3mpG+Sq4atjWwLlocUDnpjgGRPmQ+4ehQX0=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
+      --replace "Cython>=0.29.33,<3" "Cython" \
       --replace "meson-python==0.13.1" "meson-python>=0.13.1" \
       --replace "meson==1.2.1" "meson>=1.2.1"
   '';
 
   nativeBuildInputs = [
-    cython
+    # TODO: hack to support pandas on python3.12, remove with pandas 2.2.0
+    (if pythonAtLeast "3.12" then cython_3 else cython)
     meson-python
     meson
     numpy
@@ -116,8 +118,6 @@ buildPythonPackage rec {
         qtpy
       ];
       compression = [
-        brotlipy
-        python-snappy
         zstandard
       ];
       computation = [
@@ -187,16 +187,23 @@ buildPythonPackage rec {
     all = lib.concatLists (lib.attrValues extras);
   };
 
+  doCheck = false; # various infinite recursions
+
+  passthru.tests.pytest = pandas.overridePythonAttrs (_: { doCheck = true; });
+
   nativeCheckInputs = [
     glibcLocales
     hypothesis
     pytest-asyncio
     pytest-xdist
     pytestCheckHook
-  ] ++ lib.optionals (stdenv.isLinux) [
+  ]
+  ++ lib.flatten (lib.attrValues passthru.optional-dependencies)
+  ++ lib.optionals (stdenv.isLinux) [
     # for locale executable
     glibc
-  ] ++ lib.optionals (stdenv.isDarwin) [
+  ]
+  ++ lib.optionals (stdenv.isDarwin) [
     # for locale executable
     adv_cmds
   ];
@@ -263,4 +270,5 @@ buildPythonPackage rec {
     '';
     maintainers = with maintainers; [ raskin fridh knedlsepp ];
   };
-}
+};
+in pandas
diff --git a/pkgs/development/python-modules/panel/default.nix b/pkgs/development/python-modules/panel/default.nix
index 7fe1be6f7458..c47cea4567a8 100644
--- a/pkgs/development/python-modules/panel/default.nix
+++ b/pkgs/development/python-modules/panel/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "panel";
-  version = "1.2.3";
+  version = "1.3.4";
 
   format = "wheel";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   # tries to fetch even more artifacts
   src = fetchPypi {
     inherit pname version format;
-    hash = "sha256-CAW6z0phPohpFjv4D1DlmomDiv52vb5qBatWN/Mmg/c=";
+    hash = "sha256-FK/ekqXCtTHyzLeFs0tHEeH0VXk0yFcns1lOLa5z0KU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/papermill/default.nix b/pkgs/development/python-modules/papermill/default.nix
index d5c2f3018d30..65b5f7c0035d 100644
--- a/pkgs/development/python-modules/papermill/default.nix
+++ b/pkgs/development/python-modules/papermill/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "papermill";
-  version = "2.4.0";
+  version = "2.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-b4+KmwazlnfyB8CRAMjThrz1kvDLvdqfD1DoFEVpdic=";
+    hash = "sha256-6ntwwFU/Vv6RsPqcxeFwEs1pkyCosBU3PnhwxeYIbHI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/param/default.nix b/pkgs/development/python-modules/param/default.nix
index a37cf7c7f03d..c05f906d5b10 100644
--- a/pkgs/development/python-modules/param/default.nix
+++ b/pkgs/development/python-modules/param/default.nix
@@ -1,14 +1,23 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, hatchling
+, hatch-vcs
+
+# tests
+, numpy
+, pandas
+, pytest-asyncio
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "param";
-  version = "1.13.0";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -16,19 +25,21 @@ buildPythonPackage rec {
     owner = "holoviz";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-5b3UTzb7OXBwcyYyDVCGLUpWxNOYZ3cv8Gfw+x7jsBI=";
+    hash = "sha256-8R1+utY3e3py4iJTgOVfzt5Y7bp2Rn6OfoITGuOsb5c=";
   };
 
+  nativeBuildInputs = [
+    hatchling
+    hatch-vcs
+  ];
+
   nativeCheckInputs = [
+    numpy
+    pandas
+    pytest-asyncio
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # Version is not set properly
-    substituteInPlace setup.py \
-      --replace 'version=get_setup_version("param"),' 'version="${version}",'
-  '';
-
   pythonImportsCheck = [
     "param"
   ];
diff --git a/pkgs/development/python-modules/parameter-expansion-patched/default.nix b/pkgs/development/python-modules/parameter-expansion-patched/default.nix
index 19149d8db241..8e73457557f7 100644
--- a/pkgs/development/python-modules/parameter-expansion-patched/default.nix
+++ b/pkgs/development/python-modules/parameter-expansion-patched/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-/128ifveWC8zNlYtGWtxB3HpK6p7bVk1ahSwhaC2dAs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/parameterized/default.nix b/pkgs/development/python-modules/parameterized/default.nix
index fb08e07ec04b..9f8fa4ad1e9f 100644
--- a/pkgs/development/python-modules/parameterized/default.nix
+++ b/pkgs/development/python-modules/parameterized/default.nix
@@ -20,10 +20,12 @@ buildPythonPackage rec {
   };
 
   postPatch = ''
-    # broken with pytest 7
+    # broken with pytest 7 and python 3.12
     # https://github.com/wolever/parameterized/issues/167
+    # https://github.com/wolever/parameterized/pull/162
     substituteInPlace parameterized/test.py \
-      --replace 'assert_equal(missing, [])' ""
+      --replace 'assert_equal(missing, [])' "" \
+      --replace "assertRaisesRegexp" "assertRaisesRegex"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/parse/default.nix b/pkgs/development/python-modules/parse/default.nix
index 7956a2971b51..9c6272e94a5c 100644
--- a/pkgs/development/python-modules/parse/default.nix
+++ b/pkgs/development/python-modules/parse/default.nix
@@ -5,16 +5,20 @@
 }:
 buildPythonPackage rec {
   pname = "parse";
-  version = "1.19.1";
+  version = "1.20.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "r1chardj0n3s";
     repo = "parse";
     rev = "refs/tags/${version}";
-    hash = "sha256-f08SlkGnwhSh0ajTKFqBAGGFvLj8nWBZVb6uClbRaP4=";
+    hash = "sha256-InYOgqTvMvQ/HWIa0WrJ4M2LL4LL87KwBst8yYnt3dk=";
   };
 
+  postPatch = ''
+    rm .pytest.ini
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/partd/default.nix b/pkgs/development/python-modules/partd/default.nix
index db823218a61b..728ed09b735c 100644
--- a/pkgs/development/python-modules/partd/default.nix
+++ b/pkgs/development/python-modules/partd/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
+, setuptools
 , pytest
 , locket
 , numpy
@@ -12,15 +13,20 @@
 
 buildPythonPackage rec {
   pname = "partd";
-  version = "1.4.0";
-  format = "setuptools";
+  version = "1.4.1";
+  pyproject = true;
+
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qg/zXbvMgHrjdNtWMy9MGzm0b2e/KXX1FR4LQYau0NU=";
+    hash = "sha256-VsJd1J5v6lcn5zEgPEZsbgkvMI2PACThmdAvaqIWf2c=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [ pytest ];
 
   propagatedBuildInputs = [ locket numpy pandas pyzmq toolz ];
diff --git a/pkgs/development/python-modules/pathvalidate/default.nix b/pkgs/development/python-modules/pathvalidate/default.nix
index 31ec1f003144..c3098c24b56d 100644
--- a/pkgs/development/python-modules/pathvalidate/default.nix
+++ b/pkgs/development/python-modules/pathvalidate/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pathvalidate";
-  version = "3.1.0";
+  version = "3.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QmlwIm4kGZ/ZDZOZXSI8Hii9qWfN9DcHVaFM33KiqO4=";
+    hash = "sha256-XoN4z2cSv/Z/vnqDB9mfqMGgyyiqR3BW+Pw3Tw3/JK0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/patsy/default.nix b/pkgs/development/python-modules/patsy/default.nix
index a1ed788dda12..ae4022f86002 100644
--- a/pkgs/development/python-modules/patsy/default.nix
+++ b/pkgs/development/python-modules/patsy/default.nix
@@ -1,6 +1,7 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+, setuptools
 , six
 , numpy
 , scipy # optional, allows spline-related features (see patsy's docs)
@@ -9,14 +10,18 @@
 
 buildPythonPackage rec {
   pname = "patsy";
-  version = "0.5.3";
-  format = "setuptools";
+  version = "0.5.4";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vcGAAYdeMZvJHIEsHrahC+S7E8uB63Y/RmF53KO2cnc=";
+    hash = "sha256-favFJ1lzCN4OjxiPqiCvfgaom9qjBnVt/HeDaT6havQ=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     six
     numpy
diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index bda6c9080f0c..dbf6afe6f330 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -7,16 +7,17 @@
 
 buildPythonPackage rec {
   pname = "pbr";
-  version = "5.11.1";
-  format = "setuptools";
+  version = "6.0.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rvxRZ1sLUz1Wu1/RyMbAUi/jGJZnmILhxMY9XkoPzLM=";
+    hash = "sha256-0TdxIqWgDi+UDuSCmZUY7+FtdF1COmcMJ3c9+8PJp9k=";
   };
 
-  # importlib-metadata could be added here if it wouldn't cause an infinite recursion
-  propagatedBuildInputs = [ setuptools ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   # check in passthru.tests.pytest to escape infinite recursion with fixtures
   doCheck = false;
diff --git a/pkgs/development/python-modules/pdm-backend/default.nix b/pkgs/development/python-modules/pdm-backend/default.nix
index 0572a1e633b8..3d32a02768b4 100644
--- a/pkgs/development/python-modules/pdm-backend/default.nix
+++ b/pkgs/development/python-modules/pdm-backend/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pdm-backend";
-  version = "2.1.6";
+  version = "2.1.7";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pdm-project";
     repo = "pdm-backend";
     rev = "refs/tags/${version}";
-    hash = "sha256-ZEci8VeKYuORs9iAzaEqrtVBh9fMWHlLsFH1e5PRLwA=";
+    hash = "sha256-1YM/vba+8+2wKcWzPKzkpaWVmHqbFsYdhQSY/VBBAfo=";
   };
 
   env.PDM_BUILD_SCM_VERSION = version;
diff --git a/pkgs/development/python-modules/pegen/default.nix b/pkgs/development/python-modules/pegen/default.nix
index 2a7a3062741f..9ac25c2880b6 100644
--- a/pkgs/development/python-modules/pegen/default.nix
+++ b/pkgs/development/python-modules/pegen/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-P4zX8za9lBlXhNPkQe9p136ggZEJh6fHfBr+DQKvtTg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pelican/default.nix b/pkgs/development/python-modules/pelican/default.nix
index a2aac534366e..71682cd62c41 100644
--- a/pkgs/development/python-modules/pelican/default.nix
+++ b/pkgs/development/python-modules/pelican/default.nix
@@ -1,42 +1,51 @@
 { lib
-, beautifulsoup4
-, blinker
 , buildPythonPackage
-, docutils
-, feedgenerator
 , fetchFromGitHub
-, git
+, pythonOlder
+, pythonRelaxDepsHook
+
+# build-system
+, pdm-backend
+
+# native dependencies
 , glibcLocales
+, git
+, pandoc
+, typogrify
+
+# dependencies
+, backports-zoneinfo
+, blinker
+, docutils
+, feedgenerator
 , jinja2
-, lxml
 , markdown
-, markupsafe
-, mock
-, pytestCheckHook
-, pandoc
-, pillow
+, ordered-set
 , pygments
 , python-dateutil
-, pythonOlder
-, pytz
 , rich
-, pytest-xdist
-, six
-, typogrify
+, tzdata
 , unidecode
+, watchfiles
+
+# tests
+, mock
+, pytestCheckHook
+, pytest-xdist
 }:
 
 buildPythonPackage rec {
   pname = "pelican";
-  version = "4.8.0";
-  format = "setuptools";
-  disabled = pythonOlder "3.6";
+  version = "4.9.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "getpelican";
-    repo = pname;
+    repo = "pelican";
     rev = "refs/tags/${version}";
-    hash = "sha256-T+XBRBfroG1gh9ZHU7V5wsgnI1xuNTXYAe6g5Xk8Qyg=";
+    hash = "sha256-nz2OnxJ4mGgnafz4Xp8K/BTyVgXNpNYqteNL1owP8Hk=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -44,43 +53,51 @@ buildPythonPackage rec {
     '';
   };
 
+  postPatch = ''
+    substituteInPlace pelican/tests/test_pelican.py \
+      --replace "'git'" "'${git}/bin/git'"
+  '';
+
+  nativeBuildInputs = [
+    pdm-backend
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "unidecode"
+  ];
+
   buildInputs = [
     glibcLocales
     pandoc
     git
-    mock
     markdown
     typogrify
   ];
 
   propagatedBuildInputs = [
-    beautifulsoup4
     blinker
     docutils
     feedgenerator
     jinja2
-    lxml
-    markupsafe
-    pillow
+    ordered-set
     pygments
     python-dateutil
-    pytz
     rich
-    six
+    tzdata
     unidecode
+    watchfiles
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    backports-zoneinfo
   ];
 
   nativeCheckInputs = [
+    mock
     pytest-xdist
     pytestCheckHook
     pandoc
   ];
 
-  postPatch = ''
-    substituteInPlace pelican/tests/test_pelican.py \
-      --replace "'git'" "'${git}/bin/git'"
-  '';
-
   pytestFlagsArray = [
     # DeprecationWarning: 'jinja2.Markup' is deprecated and...
     "-W ignore::DeprecationWarning"
@@ -93,7 +110,7 @@ buildPythonPackage rec {
     "test_custom_locale_generation_works"
   ];
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   # We only want to patch shebangs in /bin, and not those
   # of the project scripts that are created by Pelican.
diff --git a/pkgs/development/python-modules/pem/default.nix b/pkgs/development/python-modules/pem/default.nix
index f4608995dd73..84500acaccb0 100644
--- a/pkgs/development/python-modules/pem/default.nix
+++ b/pkgs/development/python-modules/pem/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-rVYlnvISGugh9qvf3mdrIyELmeOUU4g6291HeoMkoQc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-fancy-pypi-readme
diff --git a/pkgs/development/python-modules/pendulum/3.nix b/pkgs/development/python-modules/pendulum/3.nix
new file mode 100644
index 000000000000..78e9c675ea8d
--- /dev/null
+++ b/pkgs/development/python-modules/pendulum/3.nix
@@ -0,0 +1,99 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, isPyPy
+
+# build-system
+, poetry-core
+, rustPlatform
+
+# native dependencies
+, iconv
+
+# dependencies
+, backports-zoneinfo
+, importlib-resources
+, python-dateutil
+, time-machine
+, tzdata
+
+# tests
+, pytestCheckHook
+, pytz
+}:
+
+buildPythonPackage rec {
+  pname = "pendulum";
+  version = "3.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "sdispater";
+    repo = "pendulum";
+    rev = "refs/tags/${version}";
+    hash = "sha256-v0kp8dklvDeC7zdTDOpIbpuj13aGub+oCaYz2ytkEpI=";
+  };
+
+  postPatch = ''
+    substituteInPlace rust/Cargo.lock \
+      --replace "3.0.0-beta-1" "3.0.0"
+  '';
+
+  cargoRoot = "rust";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    sourceRoot = "source/rust";
+    name = "${pname}-${version}";
+    hash = "sha256-6fw0KgnPIMfdseWcunsGjvjVB+lJNoG3pLDqkORPJ0I=";
+    postPatch = ''
+      substituteInPlace Cargo.lock \
+        --replace "3.0.0-beta-1" "3.0.0"
+    '';
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+    rustPlatform.maturinBuildHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    iconv
+  ];
+
+  propagatedBuildInputs = [
+    python-dateutil
+    tzdata
+  ] ++ lib.optional (!isPyPy) [
+    time-machine
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    backports-zoneinfo
+    importlib-resources
+  ];
+
+  pythonImportsCheck = [
+    "pendulum"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytz
+  ];
+
+  disabledTestPaths = [
+    "tests/benchmarks"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # PermissionError: [Errno 1] Operation not permitted: '/etc/localtime'
+    "tests/testing/test_time_travel.py"
+  ];
+
+  meta = with lib; {
+    description = "Python datetimes made easy";
+    homepage = "https://github.com/sdispater/pendulum";
+    changelog = "https://github.com/sdispater/pendulum/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/pexpect/default.nix b/pkgs/development/python-modules/pexpect/default.nix
index ebe63b4a4170..e8c5efc3cba3 100644
--- a/pkgs/development/python-modules/pexpect/default.nix
+++ b/pkgs/development/python-modules/pexpect/default.nix
@@ -1,19 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , ptyprocess
 }:
 
 buildPythonPackage (rec {
   pname = "pexpect";
-  version = "4.8.0";
-  format = "setuptools";
+  version = "4.9.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fc65a43959d153d0114afe13997d439c22823a27cefceb5ff35c2178c6784c0c";
+    hash = "sha256-7n1BEj88mREFDqLC2sEHVo3EOy07DHVXozISw5jq0w8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # Wants to run pythonin a subprocess
   doCheck = false;
 
@@ -22,6 +27,7 @@ buildPythonPackage (rec {
   meta = with lib; {
     homepage = "http://www.noah.org/wiki/Pexpect";
     description = "Automate interactive console applications such as ssh, ftp, etc";
+    downloadPage = "https://github.com/pexpect/pexpect";
     license = licenses.mit;
     maintainers = with maintainers; [ zimbatm ];
 
diff --git a/pkgs/development/python-modules/pg8000/default.nix b/pkgs/development/python-modules/pg8000/default.nix
index ee580829bbe0..12144a0bb8d2 100644
--- a/pkgs/development/python-modules/pg8000/default.nix
+++ b/pkgs/development/python-modules/pg8000/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pg8000";
-  version = "1.30.1";
+  version = "1.30.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wEKA5mocz7UWbbXBZBZMLhuPYq+u3/0hFFGlMproSik=";
+    hash = "sha256-Tnx1dHpDpJwVYj+SWDu24dAj6ubq8sLh5t5Nf7f6QE8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
index 0942dd0662c8..6370a8fa72cc 100644
--- a/pkgs/development/python-modules/phonenumbers/default.nix
+++ b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.13.20";
+  version = "8.13.26";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vys1qAbTeXnlNhEJQp2kbZoEflnZr5hjnXM8g059qyI=";
+    hash = "sha256-k31wrs6zF/WDHf7CjehVpgJg70qdVRlkvsjnp9DPgc0=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/picobox/default.nix b/pkgs/development/python-modules/picobox/default.nix
index a70fc8eecbe1..221493eb2194 100644
--- a/pkgs/development/python-modules/picobox/default.nix
+++ b/pkgs/development/python-modules/picobox/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-JtrwUVo3b4G34OUShX4eJS2IVubl4vBmEtB/Jhk4eJI=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 0891ad28ec3f..4ba20f5aef31 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -5,9 +5,10 @@
 , hypothesis
 , pythonOlder
 , jbig2dec
-, deprecation
+, deprecated
 , lxml
 , mupdf
+, numpy
 , packaging
 , pillow
 , psutil
@@ -24,8 +25,8 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "8.4.0";
-  format = "pyproject";
+  version = "8.9.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -39,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-48tb5bhmBdKVjMld07303qIi5C16yaf+5TpRPVC6EQk=";
+    hash = "sha256-ia+D0OeB/MQWRniYkBEWZsDCwEApYGgu0++I/HupK6w=";
   };
 
   patches = [
@@ -68,6 +69,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     attrs
     hypothesis
+    numpy
     pytest-xdist
     psutil
     pytestCheckHook
@@ -76,7 +78,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    deprecation
+    deprecated
     lxml
     packaging
     pillow
diff --git a/pkgs/development/python-modules/pikepdf/paths.patch b/pkgs/development/python-modules/pikepdf/paths.patch
index 43e472f5598a..c9c61176aa6f 100644
--- a/pkgs/development/python-modules/pikepdf/paths.patch
+++ b/pkgs/development/python-modules/pikepdf/paths.patch
@@ -1,8 +1,8 @@
 diff --git a/src/pikepdf/_methods.py b/src/pikepdf/_methods.py
-index 2a170c6..5ee3ba1 100644
+index d27c660..6796984 100644
 --- a/src/pikepdf/_methods.py
 +++ b/src/pikepdf/_methods.py
-@@ -80,7 +80,7 @@ def _mudraw(buffer, fmt) -> bytes:
+@@ -72,7 +72,7 @@ def _mudraw(buffer, fmt) -> bytes:
          tmp_in.flush()
  
          proc = run(
@@ -12,22 +12,22 @@ index 2a170c6..5ee3ba1 100644
              check=True,
          )
 diff --git a/src/pikepdf/jbig2.py b/src/pikepdf/jbig2.py
-index 28c596b..aff3565 100644
+index f89b4f9..f187ebd 100644
 --- a/src/pikepdf/jbig2.py
 +++ b/src/pikepdf/jbig2.py
-@@ -28,7 +28,7 @@ def _extract_jbig2_bytes(jbig2: bytes, jbig2_globals: bytes) -> bytes:
-         output_path = Path(tmpdir) / "outfile"
-
-         args = [
--            "jbig2dec",
-+            "@jbig2dec@",
-             "--embedded",
-             "--format",
-             "png",
-@@ -88,7 +88,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
+@@ -63,7 +63,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
+             output_path = Path(tmpdir) / "outfile"
+ 
+             args = [
+-                "jbig2dec",
++                "@jbig2dec@",
+                 "--embedded",
+                 "--format",
+                 "png",
+@@ -90,7 +90,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
      def _version(self) -> Version:
          try:
-             proc = run(
+             proc = self._run(
 -                ['jbig2dec', '--version'], stdout=PIPE, check=True, encoding='ascii'
 +                ['@jbig2dec@', '--version'], stdout=PIPE, check=True, encoding='ascii'
              )
diff --git a/pkgs/development/python-modules/pillow-heif/default.nix b/pkgs/development/python-modules/pillow-heif/default.nix
index 1d0505e22ed5..2496bd1b3609 100644
--- a/pkgs/development/python-modules/pillow-heif/default.nix
+++ b/pkgs/development/python-modules/pillow-heif/default.nix
@@ -6,6 +6,7 @@
 # build-system
 , cmake
 , nasm
+, pkg-config
 
 # native dependencies
 , libheif
@@ -25,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "pillow-heif";
-  version = "0.13.0";
+  version = "0.14.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bigcat88";
     repo = "pillow_heif";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GbOW29rGpLMS7AfShuO6UCzcspdHtFS7hyNKori0otI=";
+    hash = "sha256-HFcywrH687CBGTbZQ2rQrr/AdJ2+pFoI+NvYhUCanic=";
   };
 
   postPatch = ''
@@ -42,6 +43,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     cmake
     nasm
+    pkg-config
   ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 3b5dffb42cf0..7cf0bb9420fe 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -5,7 +5,7 @@
 , fetchPypi
 , isPyPy
 , defusedxml, olefile, freetype, libjpeg, zlib, libtiff, libwebp, libxcrypt, tcl, lcms2, tk, libX11
-, libxcb, openjpeg, libimagequant, pyroma, numpy, pytestCheckHook, setuptools
+, libxcb, openjpeg, libimagequant, numpy, pytestCheckHook, setuptools
 # for passthru.tests
 , imageio, matplotlib, pilkit, pydicom, reportlab
 }@args:
diff --git a/pkgs/development/python-modules/pillow/generic.nix b/pkgs/development/python-modules/pillow/generic.nix
index 5186e8a476bb..33276d3abd08 100644
--- a/pkgs/development/python-modules/pillow/generic.nix
+++ b/pkgs/development/python-modules/pillow/generic.nix
@@ -37,7 +37,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ olefile ]
     ++ lib.optionals (lib.versionAtLeast version "8.2.0") [ defusedxml ];
 
-  nativeCheckInputs = [ pytestCheckHook pyroma numpy ];
+  nativeCheckInputs = [ pytestCheckHook numpy ];
 
   nativeBuildInputs = [ setuptools ];
 
@@ -73,10 +73,5 @@ buildPythonPackage rec {
   '' + lib.optionalString (lib.versionAtLeast version "7.1.0") ''
     export LDFLAGS="$LDFLAGS -L${libxcb}/lib"
     export CFLAGS="$CFLAGS -I${libxcb.dev}/include"
-  '' + lib.optionalString stdenv.isDarwin ''
-    # Remove impurities
-    substituteInPlace setup.py \
-      --replace '"/Library/Frameworks",' "" \
-      --replace '"/System/Library/Frameworks"' ""
   '';
 }
diff --git a/pkgs/development/python-modules/pinecone-client/default.nix b/pkgs/development/python-modules/pinecone-client/default.nix
index 91ca5ca0e75f..2b7597499632 100644
--- a/pkgs/development/python-modules/pinecone-client/default.nix
+++ b/pkgs/development/python-modules/pinecone-client/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , numpy
 , pyyaml
 , python-dateutil
@@ -13,14 +14,18 @@
 }:
 buildPythonPackage rec {
   pname = "pinecone-client";
-  version = "2.2.4";
-  format = "setuptools";
+  version = "2.2.5";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LBzB1mSLK+ZulE2y/6WRZqN7kWTRE1rVJdnNix4pgWg=";
+    hash = "sha256-F2mWUpFMn2ipopa3UjvzrmNZsHtdRrUwfkuHbDYBElo=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     numpy
     pyyaml
diff --git a/pkgs/development/python-modules/pint-pandas/default.nix b/pkgs/development/python-modules/pint-pandas/default.nix
index 6cc7cd22a97d..d44648350223 100644
--- a/pkgs/development/python-modules/pint-pandas/default.nix
+++ b/pkgs/development/python-modules/pint-pandas/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-FuH6wksSCkkL2AyQN46hwTnfeAZFwkWRl6KEEhsxmUY=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pip-requirements-parser/default.nix b/pkgs/development/python-modules/pip-requirements-parser/default.nix
index 21d0679ce8ef..84cc2ed513a1 100644
--- a/pkgs/development/python-modules/pip-requirements-parser/default.nix
+++ b/pkgs/development/python-modules/pip-requirements-parser/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-UMrwDXxk+sD3P2jk7s95y4OX6DRBjWWZZ8IhkR6tnZ4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   dontConfigure = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pip/default.nix b/pkgs/development/python-modules/pip/default.nix
index 484a15e85876..f597887ddd2c 100644
--- a/pkgs/development/python-modules/pip/default.nix
+++ b/pkgs/development/python-modules/pip/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "pip";
-  version = "23.2.1";
+  version = "23.3.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-mUlzfYmq1FE3X1/2o7sYJzMgwHRI4ib4EMhpg83VvrI=";
+    hash = "sha256-mJesZxFyZkGTR1s8/C88eWprW6WVGlwORXoKXc6NnoM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pipdeptree/default.nix b/pkgs/development/python-modules/pipdeptree/default.nix
index 7e15814fa684..c1131e6592d2 100644
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-rlnJmGe9LYwIJxV02IjiKtT1iS1O9ik8dAfjsPHsa8U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/pipx/default.nix b/pkgs/development/python-modules/pipx/default.nix
index ef4e789249ce..ae575ec0a263 100644
--- a/pkgs/development/python-modules/pipx/default.nix
+++ b/pkgs/development/python-modules/pipx/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pipx";
-  version = "1.2.1";
+  version = "1.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pipxproject";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-eNZJXznKgamGR9yrswrrLEqUTxFhLGxWTkYbi13bebY=";
+    hash = "sha256-JZt4I0zw/Kmdgpd5tw6c+fHrHuxkN6jvN3fDmk0//vc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index 777ba72bcc2c..6cf9822c5e41 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "3.10.0";
+  version = "4.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,11 +20,9 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Ytilbs29oxuwLfoKTXNQxlh8qBF39F2ZRK8imd57A1w=";
+    hash = "sha256-27Cy8VEmbrO96G2mVStxkoWSRXlwZLWirI3tH6kBsus=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index 555f7aa30197..31ded41872f1 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -11,6 +11,7 @@
 , setuptools
 , setuptools-scm
 , playwright-driver
+, pythonRelaxDepsHook
 }:
 
 let
@@ -54,10 +55,7 @@ buildPythonPackage rec {
 
     substituteInPlace pyproject.toml \
       --replace 'requires = ["setuptools==68.2.2", "setuptools-scm==8.0.4", "wheel==0.41.2", "auditwheel==5.4.0"]' \
-                'requires = ["setuptools", "setuptools-scm", "wheel"]' \
-      --replace 'version_file = "playwright/_repo_version.py"' ""
-    # FIXME version_file is available in setuptools-scm>=8.0.0
-    echo "__version__ = version = '${version}'" > playwright/_repo_version.py
+                'requires = ["setuptools", "setuptools-scm", "wheel"]'
 
     # Skip trying to download and extract the driver.
     # This is done manually in postInstall instead.
@@ -70,8 +68,16 @@ buildPythonPackage rec {
   '';
 
 
-  nativeBuildInputs = [ git setuptools-scm setuptools ]
-    ++ lib.optionals stdenv.isLinux [ auditwheel ];
+  nativeBuildInputs = [
+    git
+    setuptools-scm
+    setuptools
+    pythonRelaxDepsHook
+  ] ++ lib.optionals stdenv.isLinux [ auditwheel ];
+
+  pythonRelaxDeps = [
+    "pyee"
+  ];
 
   propagatedBuildInputs = [
     greenlet
@@ -82,8 +88,6 @@ buildPythonPackage rec {
     ln -s ${driver} $out/${python.sitePackages}/playwright/driver
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # Skip tests because they require network access.
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/plotly/default.nix b/pkgs/development/python-modules/plotly/default.nix
index fc2c8b49069d..13d9334fd950 100644
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "5.16.1";
+  version = "5.18.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KVrCXt6xjIk6u3Hcrc6gdbeP1v3wfO5CF6ThAJZnkls=";
+    hash = "sha256-Ngox5vu0nRKwBwNutpKVITQ9a+4iNvhFmRWCG676LLs=";
   };
 
   propagatedBuildInputs = [
@@ -29,6 +29,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python plotting library for collaborative, interactive, publication-quality graphs";
+    downloadPage = "https://github.com/plotly/plotly.py";
     homepage = "https://plot.ly/python/";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/pluggy/default.nix b/pkgs/development/python-modules/pluggy/default.nix
index 1128d1c69eaf..6b1c8e67f1eb 100644
--- a/pkgs/development/python-modules/pluggy/default.nix
+++ b/pkgs/development/python-modules/pluggy/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ setuptools-scm ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # To prevent infinite recursion with pytest
   doCheck = false;
   passthru.tests = {
diff --git a/pkgs/development/python-modules/plumbum/default.nix b/pkgs/development/python-modules/plumbum/default.nix
index e6ffa43b3293..7fb6a0ec8240 100644
--- a/pkgs/development/python-modules/plumbum/default.nix
+++ b/pkgs/development/python-modules/plumbum/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
       --replace '"--cov-config=setup.cfg", ' ""
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/plyfile/default.nix b/pkgs/development/python-modules/plyfile/default.nix
index 050d6ef56f6b..2eff69c4ad8d 100644
--- a/pkgs/development/python-modules/plyfile/default.nix
+++ b/pkgs/development/python-modules/plyfile/default.nix
@@ -1,17 +1,40 @@
-{ lib, fetchPypi, buildPythonPackage, numpy
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+
+# build-system
+, pdm-pep517
+
+# dependencies
+, numpy
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "plyfile";
-  version = "1.0.1";
-  format = "setuptools";
+  version = "1.0.2";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-TOrt8e2Ss6Jrdm/IxWzaG5sjkOwpmxbe3i5f1FCXJho=";
+  src = fetchFromGitHub {
+    owner = "dranjan";
+    repo = "python-plyfile";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-HlyqljfjuaZoG5f2cfDQj+7KS0en7pW2PPEnpvH8U+E=";
   };
 
-  propagatedBuildInputs = [ numpy ];
+  nativeBuildInputs = [
+    pdm-pep517
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "NumPy-based text/binary PLY file reader/writer for Python";
diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index fc8da7447ffb..9b3174a3b3bd 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "1.7.0";
+  version = "1.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    hash = "sha256-OfY2zc+5CgOrgbiPVnvMdT4h1S7Aek8S7iThl6azmsk=";
+    hash = "sha256-RnCJ67jaL2knwv+Uo7p0zOejHAT73f40weaJnfqOYoM=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix b/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
index 9c6440cd4c32..052cb9c4d7d6 100644
--- a/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
+++ b/pkgs/development/python-modules/poetry-dynamic-versioning/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "poetry-dynamic-versioning";
-  version = "1.0.1";
+  version = "1.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "mtkennerly";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-BGAo3c0TzyhIiDtZjoEP+Eeu51WJB3Wg71poFMWJ+VM=";
+    hash = "sha256-qkRnlLLzbYf7C2VjPDjYfllej8an4WftNahPLz/Wkxw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/polars/default.nix b/pkgs/development/python-modules/polars/default.nix
index d967ca27c8ff..5d1406fe3926 100644
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@@ -38,7 +38,6 @@ buildPythonPackage {
   # thus the `sed` command
   # Make sure to check that the right substitutions are made when updating the package
   preBuild = ''
-    cd py-polars
     #sed -i 's/version = "0.18.0"/version = "${version}"/g' Cargo.lock
   '';
 
@@ -49,7 +48,7 @@ buildPythonPackage {
     };
   };
 
-  cargoRoot = "py-polars";
+  sourceRoot = "source/py-polars";
 
   # Revisit this whenever package or Rust is upgraded
   RUSTC_BOOTSTRAP = 1;
diff --git a/pkgs/development/python-modules/polyline/default.nix b/pkgs/development/python-modules/polyline/default.nix
index 5ab360ae7e37..6ed2daae7e88 100644
--- a/pkgs/development/python-modules/polyline/default.nix
+++ b/pkgs/development/python-modules/polyline/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pytestCheckHook
 , pythonOlder
 , setuptools
@@ -10,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "polyline";
-  version = "2.0.0";
+  version = "2.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,19 +17,10 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "frederickjansen";
     repo = pname;
-    rev = "refs/tags/${version}";
-    hash = "sha256-e9ZDqcS3MaMlXi2a2JHI6NtRPqIV7rjsucGXEH6V8LA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fbGGfZdme4OiIGNlXG1uVl1xP+rPVI9l5hjHM0gwAsE=";
   };
 
-  patches = [
-    # https://github.com/frederickjansen/polyline/pull/15
-    (fetchpatch {
-      name = "relax-build-dependencies.patch";
-      url = "https://github.com/frederickjansen/polyline/commit/cb9fc80606c33dbbcaa0d94de25ae952358443b6.patch";
-      hash = "sha256-epg2pZAG+9QuICa1ms+/EO2DDmYEz+KEtxxnvG7rsWY=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --cov=polyline --cov-report term-missing" ""
diff --git a/pkgs/development/python-modules/pomegranate/default.nix b/pkgs/development/python-modules/pomegranate/default.nix
index 57d6dd0b9ab6..93c42374876c 100644
--- a/pkgs/development/python-modules/pomegranate/default.nix
+++ b/pkgs/development/python-modules/pomegranate/default.nix
@@ -2,14 +2,20 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# dependencies
+, apricot-select
+, networkx
 , numpy
+, scikit-learn
 , scipy
-, cython
-, networkx
-, joblib
-, pandas
-, nose
-, pyyaml
+, torch
+
+# tests
+, pytestCheckHook
 }:
 
 
@@ -26,9 +32,22 @@ buildPythonPackage rec {
     sha256 = "sha256-EnxKlRRfsOIDLAhYOq7bUSbI/NvPoSyYCZ9D5VCXFGQ=";
   };
 
-  propagatedBuildInputs = [ numpy scipy cython networkx joblib pyyaml ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    apricot-select
+    networkx
+    numpy
+    scikit-learn
+    scipy
+    torch
+  ];
 
-  nativeCheckInputs = [ pandas nose ];  # as of 0.13.5, it depends explicitly on nose, rather than pytest.
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     broken = stdenv.isDarwin;
diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index 70cf9bc721dd..7166577d8c74 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -13,21 +13,20 @@
 , semver
 , rich
 , tomlkit
-, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "23.9.1";
-  format = "pyproject";
+  version = "23.12.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "greenbone";
-    repo = pname;
+    repo = "pontos";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HRIGS2B6tc4qaOMTud5/uhEr1k7puqJUugDj1WuacqU=";
+    hash = "sha256-N10Jn5jq/PktpmeRNlqZyN/rUyAeW+ghY3/RK9Aas7I=";
   };
 
   nativeBuildInputs = [
@@ -42,10 +41,7 @@ buildPythonPackage rec {
     python-dateutil
     semver
     rich
-    typing-extensions
     tomlkit
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
   ] ++ httpx.optional-dependencies.http2;
 
   nativeCheckInputs = [
@@ -70,6 +66,9 @@ buildPythonPackage rec {
     # Tests require git executable
     "test_github_action_output"
     "test_initial_release"
+    # Tests are out-dated
+    "test_getting_version_without_version_config"
+    "test_verify_version_does_not_match"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pooch/default.nix b/pkgs/development/python-modules/pooch/default.nix
index b8ba613ba350..6c3e28cd9b4c 100644
--- a/pkgs/development/python-modules/pooch/default.nix
+++ b/pkgs/development/python-modules/pooch/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pooch";
-  version = "1.7.0";
+  version = "1.8.0";
   format = "pyproject";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8XShBBtkR/Du+IYPdtF/YO0vhX3A76OHp/CCKK8F2Zg=";
+    hash = "sha256-9ZmB/VubXQMtzej0oR6qSSwqxjQ/rjWWov2uNfxUsKA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/portalocker/default.nix b/pkgs/development/python-modules/portalocker/default.nix
index 34845722ce4f..cd66b0950eef 100644
--- a/pkgs/development/python-modules/portalocker/default.nix
+++ b/pkgs/development/python-modules/portalocker/default.nix
@@ -1,40 +1,56 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, setuptools
+, setuptools-scm
+
+# dependencies
 , redis
+
+# tests
+, pygments
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "portalocker";
-  version = "2.7.0";
-  format = "setuptools";
+  version = "2.8.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ay6B1TSojsFzbQP3gLoHPwR6BsR4sG4pN0hvM06VXFE=";
+    hash = "sha256-KwNap4KORsWOmzE5DuHxabmOEGarELmmqGH+fiXuTzM=";
   };
 
+  postPatch = ''
+    sed -i "/--cov/d" pytest.ini
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
   propagatedBuildInputs = [
     redis
   ];
 
   nativeCheckInputs = [
+    pygments
     pytestCheckHook
   ];
 
-  disabledTests = [
-    "test_combined" # no longer compatible with setuptools>=58
-  ];
-
   pythonImportsCheck = [
     "portalocker"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/wolph/portalocker/releases/tag/v${version}";
     description = "A library to provide an easy API to file locking";
     homepage = "https://github.com/WoLpH/portalocker";
     license = licenses.psfl;
diff --git a/pkgs/development/python-modules/prance/default.nix b/pkgs/development/python-modules/prance/default.nix
index 1fffa8cde714..33ad076f9338 100644
--- a/pkgs/development/python-modules/prance/default.nix
+++ b/pkgs/development/python-modules/prance/default.nix
@@ -36,8 +36,6 @@ buildPythonPackage rec {
       --replace "--cov=prance --cov-report=term-missing --cov-fail-under=90" ""
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/preshed/default.nix b/pkgs/development/python-modules/preshed/default.nix
index e0d37c51a2b1..557045649425 100644
--- a/pkgs/development/python-modules/preshed/default.nix
+++ b/pkgs/development/python-modules/preshed/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "preshed";
-  version = "3.0.9";
+  version = "4.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-chhjxSRP/NJlGtCSiVGix8d7EC9OEaJRrYXTfudiFmA=";
+    hash = "sha256-XisLKgfdGo3uqtZhIBmEXGAu4kkH9pNuqvF6q9VuVEw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/prettytable/default.nix b/pkgs/development/python-modules/prettytable/default.nix
index b0efbcb373d4..91d2d5a427a7 100644
--- a/pkgs/development/python-modules/prettytable/default.nix
+++ b/pkgs/development/python-modules/prettytable/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "prettytable";
-  version = "3.8.0";
+  version = "3.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,11 +20,9 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = "prettytable";
     rev = "refs/tags/${version}";
-    hash= "sha256-JnxUjUosQJgprIbA9szSfw1Fi21Qc4WljoRAQv4x5YM=";
+    hash= "sha256-yIO4eO2VdOnUt9qoNQOeq/c0os2LQ3mqAkCOIuoGpyg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/process-tests/default.nix b/pkgs/development/python-modules/process-tests/default.nix
index 436ca0026758..acffc0dca510 100644
--- a/pkgs/development/python-modules/process-tests/default.nix
+++ b/pkgs/development/python-modules/process-tests/default.nix
@@ -1,18 +1,23 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "process-tests";
-  version = "2.1.2";
-  format = "setuptools";
+  version = "3.0.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a3747ad947bdfc93e5c986bdb17a6d718f3f26e8577a0807a00962f29e26deba";
+    hash = "sha256-5dV96nFhJR6RytuEvz7MhSdfsSH9R45Xn4AHd7HUJL0=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # No tests
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/prometheus-client/default.nix b/pkgs/development/python-modules/prometheus-client/default.nix
index b3e1e12400c2..4c4c2338445a 100644
--- a/pkgs/development/python-modules/prometheus-client/default.nix
+++ b/pkgs/development/python-modules/prometheus-client/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "prometheus-client";
-  version = "0.17.1";
+  version = "0.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "prometheus";
     repo = "client_python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ag9gun47Ar0Sw3ZGIXAHjtv4GdhX8x51UVkgwdQ8A+s=";
+    hash = "sha256-7mVqfzK0E8RQAlQyQD8/DIcPJZ52V13JqU22tsQJp+Q=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/prompt-toolkit/default.nix b/pkgs/development/python-modules/prompt-toolkit/default.nix
index 2869c042d2d0..034203068baa 100644
--- a/pkgs/development/python-modules/prompt-toolkit/default.nix
+++ b/pkgs/development/python-modules/prompt-toolkit/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "prompt-toolkit";
-  version = "3.0.39";
+  version = "3.0.41";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "prompt_toolkit";
     inherit version;
-    hash = "sha256-BFBa3mh9wm3EKEsa0ZqDvi8q/oPnqCis4McvOh33Kqw=";
+    hash = "sha256-lBNn2X/IFVSIIqomwqJp/cTrIensBfxdRHzwm61ddfA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/propka/default.nix b/pkgs/development/python-modules/propka/default.nix
index 21488f696f47..08a85586411c 100644
--- a/pkgs/development/python-modules/propka/default.nix
+++ b/pkgs/development/python-modules/propka/default.nix
@@ -9,7 +9,7 @@
 buildPythonPackage rec {
   pname = "propka";
   version = "3.5.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     hash = "sha256-EJQqCe4WPOpqsSxxfbTjF0qETpSPYqpixpylweTCjko=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/psycopg/default.nix b/pkgs/development/python-modules/psycopg/default.nix
index d66f21ca2679..b651412571e6 100644
--- a/pkgs/development/python-modules/psycopg/default.nix
+++ b/pkgs/development/python-modules/psycopg/default.nix
@@ -35,13 +35,13 @@
 
 let
   pname = "psycopg";
-  version = "3.1.14";
+  version = "3.1.15";
 
   src = fetchFromGitHub {
     owner = "psycopg";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-zocRBnrQoJDWI4qhxDnxxIeiLdaWolvsujqfHBYQc/A=";
+    hash = "sha256-8M2Rm9AtOvZwZhKGuR96XiOOmllqcWAZJuEmUXxzsRw=";
   };
 
   patches = [
@@ -50,12 +50,6 @@ let
       libpq = "${postgresql.lib}/lib/libpq${stdenv.hostPlatform.extensions.sharedLibrary}";
       libc = "${stdenv.cc.libc}/lib/libc.so.6";
     })
-
-    (fetchpatch {
-      # add fixture to mark flaky ref count tests
-      url = "https://github.com/psycopg/psycopg/commit/70ef364324ba3448ef9ac0e29329c9d802380e4b.patch";
-      hash = "sha256-8PlrBcIumlxFjNXCAfm4NpSIxAnvLR8TopHzneJyzf0=";
-    })
   ];
 
   baseMeta = {
diff --git a/pkgs/development/python-modules/psycopg2/default.nix b/pkgs/development/python-modules/psycopg2/default.nix
index 43a06e5a9e4d..88f3a8b24483 100644
--- a/pkgs/development/python-modules/psycopg2/default.nix
+++ b/pkgs/development/python-modules/psycopg2/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "psycopg2";
-  version = "2.9.7";
+  version = "2.9.9";
   format = "setuptools";
 
   # Extension modules don't work well with PyPy. Use psycopg2cffi instead.
@@ -24,7 +24,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8AzDW9cRnx/tF7hb0QB4VRlN3iy9jeAauOuxdIdECtg=";
+    hash = "sha256-0UVL3pP7HiJBZoEWlNYA50ZDDABvuwMeoG7MLqQb8VY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/psygnal/default.nix b/pkgs/development/python-modules/psygnal/default.nix
index 36ae22a67b68..890d397c532f 100644
--- a/pkgs/development/python-modules/psygnal/default.nix
+++ b/pkgs/development/python-modules/psygnal/default.nix
@@ -11,6 +11,7 @@
 , toolz
 , typing-extensions
 , wrapt
+, attrs
 }:
 
 buildPythonPackage rec {
@@ -27,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-eDfGWmTKJrkkzRy1I3wl3WYPCxtPHSRzqAoOiO7QQ9Y=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     hatch-vcs
     hatchling
@@ -45,6 +44,7 @@ buildPythonPackage rec {
     pytestCheckHook
     toolz
     wrapt
+    attrs
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pulumi-aws/default.nix b/pkgs/development/python-modules/pulumi-aws/default.nix
index dd053d439070..a0c0e144c3ba 100644
--- a/pkgs/development/python-modules/pulumi-aws/default.nix
+++ b/pkgs/development/python-modules/pulumi-aws/default.nix
@@ -12,7 +12,7 @@
 buildPythonPackage rec {
   pname = "pulumi-aws";
   # Version is independant of pulumi's.
-  version = "6.1.0";
+  version = "6.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pulumi";
     repo = "pulumi-aws";
     rev = "refs/tags/v${version}";
-    hash = "sha256-W3gfHCbScAZ/j6gNzrPwhcmrYoTXi+0BuSEzjOKSo4M=";
+    hash = "sha256-K1Ov8yp6cD7h2kAXNRfcoJp24WA9VpO/y0Aga+9BHz4=";
   };
 
   sourceRoot = "${src.name}/sdk/python";
diff --git a/pkgs/development/python-modules/pure-eval/default.nix b/pkgs/development/python-modules/pure-eval/default.nix
index f21f4d7fe4cc..60615c0a0640 100644
--- a/pkgs/development/python-modules/pure-eval/default.nix
+++ b/pkgs/development/python-modules/pure-eval/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-9N+UcgAv30s4ctgsBrOHiix4BoXhKPgxH/GOz/NIFdU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pure-protobuf/default.nix b/pkgs/development/python-modules/pure-protobuf/default.nix
index c2d7f7e3d8ad..ba8b1836ba62 100644
--- a/pkgs/development/python-modules/pure-protobuf/default.nix
+++ b/pkgs/development/python-modules/pure-protobuf/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pure-protobuf";
-  version = "2.3.0";
+  version = "3.0.0";
 
   format = "pyproject";
   disabled = pythonOlder "3.7";
@@ -21,11 +21,9 @@ buildPythonPackage rec {
     owner = "eigenein";
     repo = "protobuf";
     rev = "refs/tags/${version}";
-    hash = "sha256-nJ3F8dUrqMeWqTV9ErGqrMvofJwBKwNUDfxWIqFh4nY=";
+    hash = "sha256-MjxJTX672LSEqZkH39vTD/+IhCTp6FL2z15S7Lxj6Dc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/pvextractor/default.nix b/pkgs/development/python-modules/pvextractor/default.nix
index 592a5c107dad..4d39db14d714 100644
--- a/pkgs/development/python-modules/pvextractor/default.nix
+++ b/pkgs/development/python-modules/pvextractor/default.nix
@@ -40,8 +40,6 @@ buildPythonPackage rec {
     spectral-cube
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # collecting ... qt.qpa.xcb: could not connect to display
   # qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
   doCheck = false;
diff --git a/pkgs/development/python-modules/py-desmume/default.nix b/pkgs/development/python-modules/py-desmume/default.nix
index 1ed79995b4ee..6d63a7db9c8f 100644
--- a/pkgs/development/python-modules/py-desmume/default.nix
+++ b/pkgs/development/python-modules/py-desmume/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "py-desmume";
-  version = "0.0.5.post0";
+  version = "0.0.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,8 +25,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "SkyTemple";
     repo = pname;
-    rev = version;
-    hash = "sha256-q6E7J7e0yXt+jo1KNqqAw2cG/Us+Tw0dLfTqAKWfAlc=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-AgUdILCqpmuVI3uMSdGl+lIfUVXnIo/egm/48FMRF3M=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/py-tree-sitter/default.nix b/pkgs/development/python-modules/py-tree-sitter/default.nix
index f8c1997220a7..9358a0fbca88 100644
--- a/pkgs/development/python-modules/py-tree-sitter/default.nix
+++ b/pkgs/development/python-modules/py-tree-sitter/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "py-tree-sitter";
-  version = "0.20.1";
+  version = "0.20.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "py-tree-sitter";
-    rev = "v${version}";
-    hash = "sha256-mdV5zGvVI1MltmOD1BtXxsKB/yigk8d56WwLlX6Uizg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-R97WcsHQMcuEOCg/QQ9YbGTRD30G9PRv0xAbxuoFyC4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/py-ubjson/default.nix b/pkgs/development/python-modules/py-ubjson/default.nix
index 175b63525761..f9518fdead93 100644
--- a/pkgs/development/python-modules/py-ubjson/default.nix
+++ b/pkgs/development/python-modules/py-ubjson/default.nix
@@ -20,9 +20,18 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [ "test/test.py" ];
+  disabledTests = [
+    # https://github.com/Iotic-Labs/py-ubjson/issues/18
+    "test_recursion"
+  ];
+
+  pytestFlagsArray = [
+    "test/test.py"
+  ];
 
-  pythonImportsCheck = [ "ubjson" ];
+  pythonImportsCheck = [
+    "ubjson"
+  ];
 
   meta = with lib; {
     description = "Universal Binary JSON draft-12 serializer for Python";
diff --git a/pkgs/development/python-modules/pyairnow/default.nix b/pkgs/development/python-modules/pyairnow/default.nix
index f425eaeaa17c..c4a549847a26 100644
--- a/pkgs/development/python-modules/pyairnow/default.nix
+++ b/pkgs/development/python-modules/pyairnow/default.nix
@@ -3,6 +3,7 @@
 , aioresponses
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytest-aiohttp
 , poetry-core
 , pytest-asyncio
@@ -22,6 +23,16 @@ buildPythonPackage rec {
     hash = "sha256-aab+3xrEiCjysa+DzXWelQwz8V2tr74y8v0NpDZiuTk=";
   };
 
+  patches = [
+    (fetchpatch {
+      # remove setuptools, wheel from build-system requirements
+      # https://github.com/asymworks/pyairnow/pull/7
+      name = "pyairnow-build-system.patch";
+      url = "https://github.com/asymworks/pyairnow/commit/e3cc892ffce855d8213264248b6b4ed78ee791bd.patch";
+      hash = "sha256-L0MV2okkf6Nf1S4zS7lb4lt5eSfTF10yDJLzpyDrSl8=";
+    })
+  ];
+
   nativeBuildInputs = [ poetry-core ];
 
   propagatedBuildInputs = [ aiohttp ];
diff --git a/pkgs/development/python-modules/pyaml/default.nix b/pkgs/development/python-modules/pyaml/default.nix
index 3fcf2468aea3..70c660e0daad 100644
--- a/pkgs/development/python-modules/pyaml/default.nix
+++ b/pkgs/development/python-modules/pyaml/default.nix
@@ -1,20 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pyyaml
 , unidecode
 }:
 
 buildPythonPackage rec {
   pname = "pyaml";
-  version = "23.9.6";
-  format = "setuptools";
+  version = "23.9.7";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Kyw5AXtxihJ775+WvFX4lBTZYIdmaNaYgKrmb0upiVc=";
+    hash = "sha256-WB6k6Z8OMIhkQH4EwDxgkkGu+joV37qJZNp2RLrzshc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyyaml
   ];
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index 39c042054207..fc424376477e 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -17,8 +17,9 @@
 , pytest-lazy-fixture
 , pkg-config
 , scipy
-, fetchpatch
+, setuptools
 , setuptools-scm
+, oldest-supported-numpy
 }:
 
 let
@@ -27,18 +28,25 @@ in
 
 buildPythonPackage rec {
   pname = "pyarrow";
-  format = "setuptools";
   inherit (arrow-cpp) version src;
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   sourceRoot = "apache-arrow-${version}/python";
 
+  postPatch = ''
+    substituteInPlace pyproject.toml setup.py \
+      --replace "setuptools_scm < 8.0.0" "setuptools_scm"
+  '';
+
   nativeBuildInputs = [
     cmake
     cython
     pkg-config
+    setuptools
     setuptools-scm
+    oldest-supported-numpy
   ];
 
   buildInputs = [ arrow-cpp ];
diff --git a/pkgs/development/python-modules/pyasn1/default.nix b/pkgs/development/python-modules/pyasn1/default.nix
index 3888f66d776a..d4fb73d50998 100644
--- a/pkgs/development/python-modules/pyasn1/default.nix
+++ b/pkgs/development/python-modules/pyasn1/default.nix
@@ -2,20 +2,25 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pyasn1";
-  version = "0.5.0";
-  format = "setuptools";
+  version = "0.5.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-l7cpDKaOYqgyVY7Dl28Vy/kRv118cDnYuGHCoOzmn94=";
+    hash = "sha256-bTkaluWbIxMKXPp01v1/OI274mzI8e3zn93fCNnWZ2w=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   pythonImportsCheck = [
     "pyasn1"
   ];
diff --git a/pkgs/development/python-modules/pyatag/default.nix b/pkgs/development/python-modules/pyatag/default.nix
index 47cbf5b6c797..1920466295e6 100644
--- a/pkgs/development/python-modules/pyatag/default.nix
+++ b/pkgs/development/python-modules/pyatag/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyatag";
-  version = "0.3.7.1";
+  version = "3.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "MatsNl";
     repo = "pyatag";
     rev = "refs/tags/${version}";
-    hash = "sha256-3h9mpopTbEULCx7rcEt/I/ZnUA0L/fJ7Y3L5h/6EuC4=";
+    hash = "sha256-hyGos0LFVKv63jf1ODPFfk+R47oyHea+8MGvxeKpop8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index 74098c5ba877..eabe5a872f4f 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-AKpDXfNF2t/3F4SmMWIgfkxHgcJobYs225gIeJ31l6k=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace "oauthlib~=3.1" "oauthlib" \
diff --git a/pkgs/development/python-modules/pyaussiebb/default.nix b/pkgs/development/python-modules/pyaussiebb/default.nix
index 1fcb88c0c77e..4443dfee6252 100644
--- a/pkgs/development/python-modules/pyaussiebb/default.nix
+++ b/pkgs/development/python-modules/pyaussiebb/default.nix
@@ -11,8 +11,8 @@
 
 buildPythonPackage rec {
   pname = "pyaussiebb";
-  version = "0.0.18";
-  format = "pyproject";
+  version = "0.1.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "yaleman";
     repo = "aussiebb";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tEdddVsLFCHRvyLCctDakioiop2xWaJlfGE16P1ukHc=";
+    hash = "sha256-XNf9vYMlTLqhYIVNw9GjPcXpOm5EYCcC4aGukR8g3zc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyavm/default.nix b/pkgs/development/python-modules/pyavm/default.nix
index ef8a82a1cd42..45cf827a82a8 100644
--- a/pkgs/development/python-modules/pyavm/default.nix
+++ b/pkgs/development/python-modules/pyavm/default.nix
@@ -1,39 +1,44 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
+
+# build-system
+, setuptools
+, setuptools-scm
+
+# tests
 , astropy
-, astropy-helpers
+, numpy
 , pillow
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pyavm";
-  version = "0.9.5";
-  format = "setuptools";
+  version = "0.9.6";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "PyAVM";
     inherit version;
-    hash = "sha256-gV78ypvYwohHmdjP3lN5F97PfmxuV91tvw5gsYeZ7i8=";
+    hash = "sha256-s7eLPoAHDbY9tPt3RA5zJg+NuTtVV/SqpUUR3NrG8m0=";
   };
 
-  propagatedBuildInputs = [
-    astropy-helpers
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
   ];
 
   nativeCheckInputs = [
     astropy
+    numpy
     pillow
     pytestCheckHook
   ];
 
-  # Disable automatic update of the astropy-helper module
-  postPatch = ''
-    substituteInPlace setup.cfg --replace "auto_use = True" "auto_use = False"
-  '';
-
-  pythonImportsCheck = [ "pyavm" ];
+  pythonImportsCheck = [
+    "pyavm"
+  ];
 
   meta = with lib; {
     description = "Simple pure-python AVM meta-data handling";
diff --git a/pkgs/development/python-modules/pybids/default.nix b/pkgs/development/python-modules/pybids/default.nix
index e60079ed2417..9519ca65e246 100644
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@@ -1,7 +1,7 @@
 { buildPythonPackage
 , lib
 , fetchPypi
-, fetchpatch
+, setuptools
 , formulaic
 , click
 , num2words
@@ -9,7 +9,6 @@
 , scipy
 , pandas
 , nibabel
-, patsy
 , bids-validator
 , sqlalchemy
 , pytestCheckHook
@@ -18,35 +17,43 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.16.3";
-  format = "setuptools";
   pname = "pybids";
+  version = "0.16.4";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-EOJ5NQyNFMpgLA1EaaXkv3/zk+hkPIMaVGrnNba4LMM=";
+    hash = "sha256-pahl8wi6Sf8AuVqkvi7H90ViHr+9utb14ZVmKK3rFm4=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+    versioneer
+  ] ++ versioneer.optional-dependencies.toml;
 
   pythonRelaxDeps = [ "sqlalchemy" ];
 
   propagatedBuildInputs = [
+    bids-validator
     click
     formulaic
+    nibabel
     num2words
     numpy
-    scipy
     pandas
-    nibabel
-    patsy
-    bids-validator
+    scipy
     sqlalchemy
-    versioneer
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  pythonImportsCheck = [ "bids" ];
+  pythonImportsCheck = [
+    "bids"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   disabledTests = [
     # looks for missing data:
     "test_config_filename"
diff --git a/pkgs/development/python-modules/pybullet/default.nix b/pkgs/development/python-modules/pybullet/default.nix
index 197d07907128..3c11dd822c21 100644
--- a/pkgs/development/python-modules/pybullet/default.nix
+++ b/pkgs/development/python-modules/pybullet/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , libGLU, libGL
 , xorg
 , numpy
@@ -8,14 +9,18 @@
 
 buildPythonPackage rec {
   pname = "pybullet";
-  version = "3.2.5";
-  format = "setuptools";
+  version = "3.2.6";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-G8ua+4eghr4bLeGPCE0f2rgZTaG/cfJkdDyia6o5w1E=";
+    hash = "sha256-2idSVDPIhpjcn9i8IPpK5NB3OLRlZjNlnr2CwtKITgg=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   buildInputs = [
     libGLU libGL
     xorg.libX11
@@ -30,6 +35,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Open-source software for robot simulation, integrated with OpenAI Gym";
+    downloadPage = "https://github.com/bulletphysics/bullet3";
     homepage = "https://pybullet.org/";
     license = licenses.zlib;
     maintainers = with maintainers; [ timokau ];
diff --git a/pkgs/development/python-modules/pycairo/default.nix b/pkgs/development/python-modules/pycairo/default.nix
index 6aa58056cad9..628853a89ce0 100644
--- a/pkgs/development/python-modules/pycairo/default.nix
+++ b/pkgs/development/python-modules/pycairo/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pycairo";
-  version = "1.24.0";
+  version = "1.25.1";
 
   disabled = pythonOlder "3.6";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pygobject";
     repo = "pycairo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eAE0YPZAV90MP6g1V1T80suaRV15ts38kYt6Djb78Xk=";
+    hash = "sha256-HH4BjdSkdL8lI8L/Z2ltuuWWOkfetfgv4WQm6PIoEa0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pycares/default.nix b/pkgs/development/python-modules/pycares/default.nix
index 84a7cbe1ba42..fcd6327bd222 100644
--- a/pkgs/development/python-modules/pycares/default.nix
+++ b/pkgs/development/python-modules/pycares/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pycares";
-  version = "4.3.0";
+  version = "4.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xUJpb22sl46dmRkjhHRaZfgKfZRQUBFR5KdWPgYBDUU=";
+    hash = "sha256-9HV51Qjy9W7d0WznIEV4KtOxs7Z4CYaZ4rahswcz4cI=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index 5482375dabb2..f169f91b1a47 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -54,5 +54,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/Skyscanner/pycfmodel/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/pyclipper/default.nix b/pkgs/development/python-modules/pyclipper/default.nix
index 45e5ff27ee55..b7b15c260fdb 100644
--- a/pkgs/development/python-modules/pyclipper/default.nix
+++ b/pkgs/development/python-modules/pyclipper/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-FKpP+tgJFzhij3wDQsAgwrTNnny7lgmN+tlSQ9JgG+Q=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
     cython
diff --git a/pkgs/development/python-modules/pycodestyle/default.nix b/pkgs/development/python-modules/pycodestyle/default.nix
index 250537774c2a..761e9c0562a4 100644
--- a/pkgs/development/python-modules/pycodestyle/default.nix
+++ b/pkgs/development/python-modules/pycodestyle/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pycodestyle";
-  version = "2.11.0";
+  version = "2.11.1";
 
   disabled = pythonOlder "3.6";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JZvMF4V9ios7SiMnMkt55fAgoTwWB0Zw+cjI+HLqdtA=";
+    hash = "sha256-QboOevyXUt+1PO1UieifgYa+AOWZ5xJmBpW3p1/yZj8=";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 47e90eb8726a..4b37a0765f0e 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -10,14 +10,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pycryptodome";
-  version = "3.18.0";
+  version = "3.19.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Legrandin";
     repo = "pycryptodome";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6oXXy18KlSjfyZhfMnIgnu34u/9sG0TPYvPJ8ovTqMA=";
+    hash = "sha256-WD+OEjePVtqlmn7h1CIfraLuEQlodkvjmYQ8q7nNoGU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pycyphal/default.nix b/pkgs/development/python-modules/pycyphal/default.nix
index c84b22b7b54d..fa95336d3b3f 100644
--- a/pkgs/development/python-modules/pycyphal/default.nix
+++ b/pkgs/development/python-modules/pycyphal/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pycyphal";
-  version = "1.15.2";
+  version = "1.15.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KVX+DwcJp1sjpcG1Utl9me1LwWDZPof+O6hoUt1xlXA=";
+    hash = "sha256-0Mp8d/rNOOPLg0gUPWdOgp/d5n148dxcLceW1VtjrkQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pydantic-core/default.nix b/pkgs/development/python-modules/pydantic-core/default.nix
index 6e273aaef4c9..4569ea3286b8 100644
--- a/pkgs/development/python-modules/pydantic-core/default.nix
+++ b/pkgs/development/python-modules/pydantic-core/default.nix
@@ -17,14 +17,14 @@
 let
   pydantic-core = buildPythonPackage rec {
     pname = "pydantic-core";
-    version = "2.6.3";
+    version = "2.14.5";
     format = "pyproject";
 
     src = fetchFromGitHub {
       owner = "pydantic";
       repo = "pydantic-core";
       rev = "refs/tags/v${version}";
-      hash = "sha256-bEVACTlzELXPoCtEHMR1s87KJn/qnE0lO1O4RmdjmPM=";
+      hash = "sha256-UguZpA3KEutOgIavjx8Ie//0qJq+4FTZNQTwb/ZIgb8=";
     };
 
     patches = [
@@ -34,7 +34,7 @@ let
     cargoDeps = rustPlatform.fetchCargoTarball {
       inherit src;
       name = "${pname}-${version}";
-      hash = "sha256-h9SmMLg/W11h/SQz8Te5OoCKdyG6Fctc5ftqbVQFSwU=";
+      hash = "sha256-mMgw922QjHmk0yimXfolLNiYZntTsGydQywe7PTNnwc=";
     };
 
     nativeBuildInputs = [
@@ -78,6 +78,7 @@ let
     ];
 
     meta = with lib; {
+      changelog = "https://github.com/pydantic/pydantic-core/releases/tag/v${version}";
       description = "Core validation logic for pydantic written in rust";
       homepage = "https://github.com/pydantic/pydantic-core";
       license = licenses.mit;
diff --git a/pkgs/development/python-modules/pydantic-scim/default.nix b/pkgs/development/python-modules/pydantic-scim/default.nix
index 9441bcc0eb84..b8ac4c729a69 100644
--- a/pkgs/development/python-modules/pydantic-scim/default.nix
+++ b/pkgs/development/python-modules/pydantic-scim/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.py \
       --replace 'version=get_version(),' 'version="${version}",'
diff --git a/pkgs/development/python-modules/pydantic-settings/default.nix b/pkgs/development/python-modules/pydantic-settings/default.nix
index c27bb5f27576..3034b2f92711 100644
--- a/pkgs/development/python-modules/pydantic-settings/default.nix
+++ b/pkgs/development/python-modules/pydantic-settings/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 , hatchling
 , pydantic
 , python-dotenv
@@ -11,14 +12,16 @@
 
 buildPythonPackage rec {
   pname = "pydantic-settings";
-  version = "2.0.3";
-  format = "pyproject";
+  version = "2.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-settings";
     rev = "v${version}";
-    hash = "sha256-3V6daCibvVr8RKo2o+vHC++QgIYKAOyRg11ATrCzM5Y=";
+    hash = "sha256-hU7u/AzaqCHKSUDHybsgXTW8IWi9hzBttPYDmMqdZbI=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +41,11 @@ buildPythonPackage rec {
     pytest-mock
   ];
 
+  disabledTests = [
+    # expected to fail
+    "test_docs_examples[docs/index.md:212-246]"
+  ];
+
   preCheck = ''
     export HOME=$TMPDIR
   '';
diff --git a/pkgs/development/python-modules/pydantic/1.nix b/pkgs/development/python-modules/pydantic/1.nix
new file mode 100644
index 000000000000..e1fc840f0ee1
--- /dev/null
+++ b/pkgs/development/python-modules/pydantic/1.nix
@@ -0,0 +1,76 @@
+{ lib
+, buildPythonPackage
+, cython
+, email-validator
+, fetchFromGitHub
+, pytest-mock
+, pytestCheckHook
+, python-dotenv
+, pythonOlder
+, setuptools
+, typing-extensions
+, libxcrypt
+}:
+
+buildPythonPackage rec {
+  pname = "pydantic";
+  version = "1.10.13";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pydantic";
+    repo = "pydantic";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ruDVcCLPVuwIkHOjYVuKOoP3hHHr7ItIY55Y6hUgR74=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    cython
+  ];
+
+  buildInputs = lib.optionals (pythonOlder "3.9") [
+    libxcrypt
+  ];
+
+  propagatedBuildInputs = [
+    typing-extensions
+  ];
+
+  passthru.optional-dependencies = {
+    dotenv = [
+      python-dotenv
+    ];
+    email = [
+      email-validator
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytest-mock
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+
+  pytestFlagsArray = [
+    # https://github.com/pydantic/pydantic/issues/4817
+    "-W" "ignore::pytest.PytestReturnNotNoneWarning"
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  enableParallelBuilding = true;
+
+  pythonImportsCheck = [ "pydantic" ];
+
+  meta = with lib; {
+    description = "Data validation and settings management using Python type hinting";
+    homepage = "https://github.com/pydantic/pydantic";
+    changelog = "https://github.com/pydantic/pydantic/blob/v${version}/HISTORY.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wd15 ];
+  };
+}
diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index 4384e51db22b..d58ec6e53f5f 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -1,124 +1,87 @@
 { lib
-, stdenv
 , buildPythonPackage
-, autoflake
-, cython
-, devtools
-, email-validator
 , fetchFromGitHub
-, fetchpatch
-, pytest-mock
-, pytestCheckHook
-, python-dotenv
-, pythonAtLeast
 , pythonOlder
-, pyupgrade
-, typing-extensions
-# dependencies for building documentation.
-# docs fail to build in Darwin sandbox: https://github.com/samuelcolvin/pydantic/issues/4245
-, withDocs ? (stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.isDarwin && pythonAtLeast "3.10")
-, ansi2html
-, markdown-include
-, mike
-, mkdocs
-, mkdocs-exclude
-, mkdocs-material
-, mdx-truly-sane-lists
-, sqlalchemy
-, ujson
-, orjson
-, hypothesis
+
+# build-system
+, hatchling
+, hatch-fancy-pypi-readme
+
+# native dependencies
 , libxcrypt
+
+# dependencies
+, annotated-types
+, pydantic-core
+, typing-extensions
+
+# tests
+, cloudpickle
+, email-validator
+, dirty-equals
+, faker
+, pytestCheckHook
+, pytest-mock
 }:
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "1.10.12";
-  format = "setuptools";
-
-  outputs = [
-    "out"
-  ] ++ lib.optionals withDocs [
-    "doc"
-  ];
+  version = "2.5.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pydantic";
-    repo = pname;
+    repo = "pydantic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3XnbPGU90wLCPEryFAOky6Iy73Dvgzzh+GbOKW8hZ4U=";
+    hash = "sha256-D0gYcyrKVVDhBgV9sCVTkGq/kFmIoT9l0i5bRM1qxzM=";
   };
 
-  postPatch = ''
-    sed -i '/flake8/ d' Makefile
-  '';
-
   buildInputs = lib.optionals (pythonOlder "3.9") [
     libxcrypt
   ];
 
   nativeBuildInputs = [
-    cython
-  ] ++ lib.optionals withDocs [
-    # dependencies for building documentation
-    autoflake
-    ansi2html
-    markdown-include
-    mdx-truly-sane-lists
-    mike
-    mkdocs
-    mkdocs-exclude
-    mkdocs-material
-    sqlalchemy
-    ujson
-    orjson
-    hypothesis
+    hatch-fancy-pypi-readme
+    hatchling
   ];
 
   propagatedBuildInputs = [
-    devtools
-    pyupgrade
+    annotated-types
+    pydantic-core
     typing-extensions
   ];
 
   passthru.optional-dependencies = {
-    dotenv = [
-      python-dotenv
-    ];
     email = [
       email-validator
     ];
   };
 
   nativeCheckInputs = [
+    cloudpickle
+    dirty-equals
+    faker
     pytest-mock
     pytestCheckHook
   ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
-  pytestFlagsArray = [
-    # https://github.com/pydantic/pydantic/issues/4817
-    "-W" "ignore::pytest.PytestReturnNotNoneWarning"
-  ];
-
   preCheck = ''
     export HOME=$(mktemp -d)
+    substituteInPlace pyproject.toml \
+      --replace "'--benchmark-columns', 'min,mean,stddev,outliers,rounds,iterations'," "" \
+      --replace "'--benchmark-group-by', 'group'," "" \
+      --replace "'--benchmark-warmup', 'on'," "" \
+      --replace "'--benchmark-disable'," ""
   '';
 
-  # Must include current directory into PYTHONPATH, since documentation
-  # building process expects "import pydantic" to work.
-  preBuild = lib.optionalString withDocs ''
-    PYTHONPATH=$PWD:$PYTHONPATH make docs
-  '';
+  disabledTestPaths = [
+    "tests/benchmarks"
 
-  # Layout documentation in same way as "sphinxHook" does.
-  postInstall = lib.optionalString withDocs ''
-    mkdir -p $out/share/doc/$name
-    mv ./site $out/share/doc/$name/html
-  '';
-
-  enableParallelBuilding = true;
+    # avoid cyclic dependency
+    "tests/test_docs.py"
+  ];
 
   pythonImportsCheck = [ "pydantic" ];
 
diff --git a/pkgs/development/python-modules/pydevd/default.nix b/pkgs/development/python-modules/pydevd/default.nix
index 8ee2f8d98acf..df840a24db8f 100644
--- a/pkgs/development/python-modules/pydevd/default.nix
+++ b/pkgs/development/python-modules/pydevd/default.nix
@@ -2,10 +2,11 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
+, setuptools
 , numpy
 , psutil
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , trio
 , untangle
@@ -13,8 +14,8 @@
 
 buildPythonPackage rec {
   pname = "pydevd";
-  version = "2.9.6";
-  format = "setuptools";
+  version = "2.10.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -22,16 +23,11 @@ buildPythonPackage rec {
     owner = "fabioz";
     repo = "PyDev.Debugger";
     rev = "pydev_debugger_${lib.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-TDU/V7kY7zVxiP4OVjGqpsRVYplpkgCly2qAOqhZONo=";
+    hash = "sha256-1tWiPj30x/ZXIBu2qzUCpyF1bLsJ0wW1QaxklD3h3A8=";
   };
 
-  patches = [
-    # https://github.com/fabioz/PyDev.Debugger/pull/258
-    (fetchpatch {
-      name = "numpy-1.25-test-compatibility.patch";
-      url = "https://github.com/fabioz/PyDev.Debugger/commit/6f637d951cda62dc2202a2c7b6af526c4d1e8a00.patch";
-      hash = "sha256-DLzZZwQHtqGZGA8nsBLNQqamuI4xUfQ89Gd21sJa9/s=";
-    })
+  nativeBuildInputs = [
+    setuptools
   ];
 
   __darwinAllowLocalNetworking = true;
@@ -61,6 +57,11 @@ buildPythonPackage rec {
     # AssertionError pydevd_tracing.set_trace_to_threads(tracing_func) == 0
     "test_tracing_other_threads"
     "test_tracing_basic"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    "test_case_handled_and_unhandled_exception_generator"
+    "test_case_stop_async_iteration_exception"
+    "test_case_unhandled_exception_generator"
+    "test_function_breakpoints_async"
   ] ++ lib.optionals stdenv.isDarwin [
     "test_multiprocessing_simple"
     "test_evaluate_exception_trace"
diff --git a/pkgs/development/python-modules/pydexcom/default.nix b/pkgs/development/python-modules/pydexcom/default.nix
index 3a2243541291..bd639205c111 100644
--- a/pkgs/development/python-modules/pydexcom/default.nix
+++ b/pkgs/development/python-modules/pydexcom/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-46+Ml73F6EUbMwRJB93FD+No/g65RJwnCnFzH4Pb5ek=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pydrawise/default.nix b/pkgs/development/python-modules/pydrawise/default.nix
index f3a4563eeef7..c7fedf9080b1 100644
--- a/pkgs/development/python-modules/pydrawise/default.nix
+++ b/pkgs/development/python-modules/pydrawise/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     hash = "sha256-FbnCo0kdAkm//OHINeEL8ibEH0BxVb9cOypyo54kXY4=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pyee/default.nix b/pkgs/development/python-modules/pyee/default.nix
index 0efcb94259fe..281611c31bdd 100644
--- a/pkgs/development/python-modules/pyee/default.nix
+++ b/pkgs/development/python-modules/pyee/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pyee";
-  version = "11.0.0";
+  version = "11.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J8aCvOYL2txdPiPqzUEB3zKMAoCISj2cB/Ok4+WV3ic=";
+    hash = "sha256-tTr5j2mQyBDt2bVrh3kQIaj1T9E9tO3RFCQ41EuiJj8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyelftools/default.nix b/pkgs/development/python-modules/pyelftools/default.nix
index 817a39cedf9e..206062b5316f 100644
--- a/pkgs/development/python-modules/pyelftools/default.nix
+++ b/pkgs/development/python-modules/pyelftools/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyelftools";
-  version = "0.29";
+  version = "0.30";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "eliben";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tPY0C5CoA9hGHeEA/KWQ1RAVT5kqMlAwuWpOSH+KJ9Y=";
+    hash = "sha256-A9etnN7G24/Gu8YlV/YDpxZV+TG2eVXGx2ZjVnA9ZD4=";
   };
 
   doCheck = stdenv.hostPlatform.system == "x86_64-linux" && stdenv.hostPlatform.isGnu;
diff --git a/pkgs/development/python-modules/pyerfa/default.nix b/pkgs/development/python-modules/pyerfa/default.nix
index fda4be537d92..8561738f8428 100644
--- a/pkgs/development/python-modules/pyerfa/default.nix
+++ b/pkgs/development/python-modules/pyerfa/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , jinja2
 , oldest-supported-numpy
 , setuptools-scm
@@ -16,21 +15,13 @@
 buildPythonPackage rec {
   pname = "pyerfa";
   format = "pyproject";
-  version = "2.0.0.3";
+  version = "2.0.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-13+7+lg1DBlMy5nl2TqgXTwrFNWq2LZi2Txq2f/0Hzk=";
+    hash = "sha256-26x07409Ow8i7wrTu72zCyqeEFcLH6Wpi+NMe+Nsmms=";
   };
 
-  patches = [
-    # Sort of helps maybe for https://github.com/liberfa/pyerfa/issues/112
-    (fetchpatch {
-      url = "https://github.com/liberfa/pyerfa/commit/4866342b94c5e7344711146f1186a4c3e7534da8.patch";
-      hash = "sha256-uPFFdLYfRweQdeEApBAw6Ulqh31NTQwwmnaU+x/M+C0=";
-    })
-  ];
-
   nativeBuildInputs = [
     jinja2
     oldest-supported-numpy
diff --git a/pkgs/development/python-modules/pyfaidx/default.nix b/pkgs/development/python-modules/pyfaidx/default.nix
index c1d081baaadb..d16b02d1c3a4 100644
--- a/pkgs/development/python-modules/pyfaidx/default.nix
+++ b/pkgs/development/python-modules/pyfaidx/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, importlib-metadata
 , nose
 , numpy
 , setuptools
@@ -26,6 +27,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    importlib-metadata
     six
   ];
 
diff --git a/pkgs/development/python-modules/pyfakefs/default.nix b/pkgs/development/python-modules/pyfakefs/default.nix
index f1c07d89d2dc..fdd7982a7898 100644
--- a/pkgs/development/python-modules/pyfakefs/default.nix
+++ b/pkgs/development/python-modules/pyfakefs/default.nix
@@ -2,19 +2,25 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
+, setuptools
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
-  version = "5.2.4";
-  format = "setuptools";
   pname = "pyfakefs";
+  version = "5.3.2";
+  pyproject = true;
+
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PgQPN5IIYIag3CGRsF/nCUOOFoqv4ulPzb7444WSCNg=";
+    hash = "sha256-qDd2o8EEbU0QPy9TACmqbN/18Dht/9WcFe4WkmE1STw=";
   };
 
   postPatch = ''
@@ -30,21 +36,26 @@ buildPythonPackage rec {
       --replace "test_rename_dir_to_existing_dir" "notest_rename_dir_to_existing_dir"
   '');
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  # https://github.com/jmcgeheeiv/pyfakefs/issues/581 (OSError: [Errno 9] Bad file descriptor)
-  disabledTests = [ "test_open_existing_pipe" ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "pyfakefs"
+  ];
 
-  disabledTestPaths = [
-    # try to import opentimelineio but nixpkgs doesn't have it as of 2023-09-16
-    "pyfakefs/pytest_tests/segfault_test.py"
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "pyfakefs" ];
+  # https://github.com/jmcgeheeiv/pyfakefs/issues/581 (OSError: [Errno 9] Bad file descriptor)
+  #disabledTests = [ "test_open_existing_pipe" ];
+
 
   meta = with lib; {
     description = "Fake file system that mocks the Python file system modules";
     homepage = "http://pyfakefs.org/";
-    changelog = "https://github.com/jmcgeheeiv/pyfakefs/blob/master/CHANGES.md";
+    changelog = "https://github.com/jmcgeheeiv/pyfakefs/blob/v${version}/CHANGES.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ gebner ];
   };
diff --git a/pkgs/development/python-modules/pygal/default.nix b/pkgs/development/python-modules/pygal/default.nix
index 4470ac383042..4b6de769859b 100644
--- a/pkgs/development/python-modules/pygal/default.nix
+++ b/pkgs/development/python-modules/pygal/default.nix
@@ -1,20 +1,30 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+
+# build-system
+, setuptools
+
+# dependencies
+, importlib-metadata
+
+# optional-dependencies
 , lxml
 , cairosvg
+
+# tests
 , pyquery
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pygal";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.0.4";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KSP5XS5RWTCqWplyGdzO+/PZK36vX8HJ/ruVsJk1/bI=";
+    hash = "sha256-bF2jPxBB6LMMvJgPijSRDZ7cWEuDMkApj2ol32VCUok=";
   };
 
   postPatch = ''
@@ -22,6 +32,14 @@ buildPythonPackage rec {
       --replace pytest-runner ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    importlib-metadata
+  ];
+
   passthru.optional-dependencies = {
     lxml = [ lxml ];
     png = [ cairosvg ];
@@ -38,6 +56,8 @@ buildPythonPackage rec {
   '';
 
   meta = with lib; {
+    changelog = "https://github.com/Kozea/pygal/blob/${version}/docs/changelog.rst";
+    downloadPage = "https://github.com/Kozea/pygal";
     description = "Sexy and simple python charting";
     homepage = "http://www.pygal.org";
     license = licenses.lgpl3Plus;
diff --git a/pkgs/development/python-modules/pygame/default.nix b/pkgs/development/python-modules/pygame/default.nix
index ad506999d595..ab5727b33add 100644
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@@ -1,17 +1,39 @@
-{ stdenv, lib, substituteAll, fetchFromGitHub, buildPythonPackage, python, pkg-config, libX11
-, SDL2, SDL2_image, SDL2_mixer, SDL2_ttf, libpng, libjpeg, portmidi, freetype, fontconfig
-, AppKit
+{ stdenv
+, lib
+, substituteAll
+, fetchFromGitHub
+, buildPythonPackage
 , pythonOlder
+
+# build-system
+, cython_3
+, setuptools
+, pkg-config
+
+# native dependencies
+, AppKit
+, fontconfig
+, freetype
+, libjpeg
+, libpng
+, libX11
+, portmidi
+, SDL2
+, SDL2_image
+, SDL2_mixer
+, SDL2_ttf
+
+# tests
+, python
 }:
 
 buildPythonPackage rec {
   pname = "pygame";
-  version = "2.5.1";
+  version = "2.5.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
-  format = "setuptools";
-
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
@@ -19,7 +41,7 @@ buildPythonPackage rec {
     # Unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation. The documentation
     # has such files and will be removed.
-    hash = "sha256-0mVbjfNYTfuo8uyd7NFKlneUZMt78mcitQ5nCgPxmFs=";
+    hash = "sha256-+gRv3Rim+2aL2uhPPGfVD0QDgB013lTf6wPx8rOwgXg=";
     postFetch = "rm -rf $out/docs/reST";
   };
 
@@ -46,12 +68,22 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [
-    pkg-config SDL2
+    cython_3
+    pkg-config
+    SDL2
+    setuptools
   ];
 
   buildInputs = [
-    SDL2 SDL2_image SDL2_mixer SDL2_ttf libpng libjpeg
-    portmidi libX11 freetype
+    freetype
+    libjpeg
+    libpng
+    libX11
+    portmidi
+    SDL2
+    SDL2_image
+    SDL2_mixer
+    SDL2_ttf
   ] ++ lib.optionals stdenv.isDarwin [
     AppKit
   ];
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index 5505b1c3a83f..50211bda6400 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "pygit2";
-  version = "1.13.0";
+  version = "1.13.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bd43Q2+rFCZK09bLxarj/VVeualoCnv91uVkzXe14rg=";
+    hash = "sha256-AlfGJgEeSvuZvbIIdUQ/cG+EIB1MkmN/AiFbmOrBPe0=";
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/pygithub/default.nix b/pkgs/development/python-modules/pygithub/default.nix
index cbfacc2c4f36..1efcb940f1a4 100644
--- a/pkgs/development/python-modules/pygithub/default.nix
+++ b/pkgs/development/python-modules/pygithub/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-ysa1RAWuFFQCF6bYwAUVFou7nxCKHLZbUtrUtXiSpPk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pyglm/default.nix b/pkgs/development/python-modules/pyglm/default.nix
index f5d0d0aa2162..17fe906a47c5 100644
--- a/pkgs/development/python-modules/pyglm/default.nix
+++ b/pkgs/development/python-modules/pyglm/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyglm";
-  version = "2.7.1";
+  version = "2.7.1-rev1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Zuzu-Typ";
     repo = "PyGLM";
     rev = "refs/tags/${version}";
-    hash = "sha256-nCkwYZLibQcmlF1Nvv2I6qi+97ue7Q1HVxpw32G5qpo=";
+    hash = "sha256-MA/NoeKv6yxXL9A36SBqU7GNuPbCKDvxpOkWP8OmED4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/pygmars/default.nix b/pkgs/development/python-modules/pygmars/default.nix
index e186cd99d98d..1cfa0838dac8 100644
--- a/pkgs/development/python-modules/pygmars/default.nix
+++ b/pkgs/development/python-modules/pygmars/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-PiH1lV1Vt9VTSOB+jep8FHIdk8qnauxj4nP3CIi/m7o=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     # https://github.com/nexB/pygmars/pull/9
     substituteInPlace setup.cfg \
diff --git a/pkgs/development/python-modules/pygments/default.nix b/pkgs/development/python-modules/pygments/default.nix
index f2b89cbcefd5..4be48e1c9330 100644
--- a/pkgs/development/python-modules/pygments/default.nix
+++ b/pkgs/development/python-modules/pygments/default.nix
@@ -3,7 +3,7 @@
 , fetchPypi
 
 # build-system
-, setuptools
+, hatchling
 
 # tests
 , pytestCheckHook
@@ -13,17 +13,16 @@
 let pygments = buildPythonPackage
   rec {
     pname = "pygments";
-    version = "2.16.1";
-    format = "pyproject";
+    version = "2.17.2";
+    pyproject = true;
 
     src = fetchPypi {
-      pname = "Pygments";
-      inherit version;
-      hash = "sha256-Ha/wSUggxpvIlB5AeqIPV3N07og2TuEKmP2+Cuzpbik=";
+      inherit pname version;
+      hash = "sha256-2kbOyf0t5b46inhPQ05MSrZwtP9U1gXEwnF+nUnEw2c=";
     };
 
     nativeBuildInputs = [
-      setuptools
+      hatchling
     ];
 
     # circular dependencies if enabled by default
diff --git a/pkgs/development/python-modules/pygti/default.nix b/pkgs/development/python-modules/pygti/default.nix
index 6db8efa7aa31..5c7631a31c3e 100644
--- a/pkgs/development/python-modules/pygti/default.nix
+++ b/pkgs/development/python-modules/pygti/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     aiohttp
     pytz
diff --git a/pkgs/development/python-modules/pyhamcrest/default.nix b/pkgs/development/python-modules/pyhamcrest/default.nix
index f9111d7f7408..951bd81e02e8 100644
--- a/pkgs/development/python-modules/pyhamcrest/default.nix
+++ b/pkgs/development/python-modules/pyhamcrest/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyhamcrest";
-  version = "2.0.4";
+  version = "2.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "hamcrest";
     repo = "PyHamcrest";
     rev = "refs/tags/V${version}";
-    hash = "sha256-CIkttiijbJCR0zdmwM5JvFogQKYuHUXHJhdyWonHcGk=";
+    hash = "sha256-VkfHRo4k8g9/QYG4r79fXf1NXorVdpUKUgVrbV2ELMU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyheos/default.nix b/pkgs/development/python-modules/pyheos/default.nix
index a5b58dc5cdae..1600baba392d 100644
--- a/pkgs/development/python-modules/pyheos/default.nix
+++ b/pkgs/development/python-modules/pyheos/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pytest-asyncio
 , pytestCheckHook
 }:
@@ -25,6 +26,10 @@ buildPythonPackage rec {
   disabledTests = [
     # accesses network
     "test_connect_timeout"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # stuck in epoll
+    "test_disconnect"
+    "test_commands_fail_when_disconnected"
   ];
 
   pythonImportsCheck = [ "pyheos" ];
diff --git a/pkgs/development/python-modules/pyhepmc/default.nix b/pkgs/development/python-modules/pyhepmc/default.nix
index 76197c47c2fd..1019d573a46e 100644
--- a/pkgs/development/python-modules/pyhepmc/default.nix
+++ b/pkgs/development/python-modules/pyhepmc/default.nix
@@ -44,7 +44,6 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
   CMAKE_ARGS = [ "-DEXTERNAL_PYBIND11=ON" ];
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/pyicu/default.nix b/pkgs/development/python-modules/pyicu/default.nix
index 901bec161445..c44bfcd29974 100644
--- a/pkgs/development/python-modules/pyicu/default.nix
+++ b/pkgs/development/python-modules/pyicu/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "pyicu";
-  version = "2.11";
+  version = "2.12";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "PyICU";
     inherit version;
-    hash = "sha256-OrUxJkz+kTKz0qxdcI2ppGSdJfbmgTcwrIjPBAoIqEQ=";
+    hash = "sha256-vXq176k61pLm2qKc0kk2TlISGDKSIXJqETyjyygchhE=";
   };
 
   nativeBuildInputs = [ icu ]; # for icu-config, but should be replaced with pkg-config
diff --git a/pkgs/development/python-modules/pyisy/default.nix b/pkgs/development/python-modules/pyisy/default.nix
index 084155976921..13a5a9e8f9d8 100644
--- a/pkgs/development/python-modules/pyisy/default.nix
+++ b/pkgs/development/python-modules/pyisy/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-OvWdKr8RlXRnAUMHSPhJDacvKeRa8QGPmGPQWLG2ouk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.py \
       --replace 'version_format="{tag}"' 'version="${version}"'
diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 836f3449754a..f970605eb412 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , cryptography
 , pytestCheckHook
 , pythonOlder
@@ -32,6 +33,7 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
+    setuptools
     sphinxHook
     sphinx-rtd-theme
     zope-interface
diff --git a/pkgs/development/python-modules/pykakasi/default.nix b/pkgs/development/python-modules/pykakasi/default.nix
index 385239b5ad52..76e2711ee18c 100644
--- a/pkgs/development/python-modules/pykakasi/default.nix
+++ b/pkgs/development/python-modules/pykakasi/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-ivlenHPD00bxc0c9G368tfTEckOC3vqDB5kMQzHXbVM==";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pykdtree/default.nix b/pkgs/development/python-modules/pykdtree/default.nix
index 0ba615277e36..46e4b24ceef6 100644
--- a/pkgs/development/python-modules/pykdtree/default.nix
+++ b/pkgs/development/python-modules/pykdtree/default.nix
@@ -1,25 +1,51 @@
-{ lib, buildPythonPackage, fetchPypi, numpy, pytestCheckHook, openmp }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, cython_3
+, numpy
+, setuptools
+
+# native dependencies
+, openmp
+
+# tests
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "pykdtree";
-  version = "1.3.7.post0";
-  format = "setuptools";
+  version = "1.3.10";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7KHWHTPbYh74An62ka6I25xl0ZarpLLMkMGQy5C7UI4=";
+    hash = "sha256-QefF1mnK3CGIrMS7tLC03K9JLYRRLx5lF6erLRIskR0=";
   };
 
-  buildInputs = [ openmp ];
+  nativeBuildInputs = [
+    cython_3
+    numpy
+    setuptools
+  ];
+
+  buildInputs = [
+    openmp
+  ];
 
-  propagatedBuildInputs = [ numpy ];
+  propagatedBuildInputs = [
+    numpy
+  ];
 
   preCheck = ''
     # make sure we don't import pykdtree from the source tree
     mv pykdtree tests
   '';
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "kd-tree implementation for fast nearest neighbour search in Python";
diff --git a/pkgs/development/python-modules/pylast/default.nix b/pkgs/development/python-modules/pylast/default.nix
index 54fabf00b0b8..9d4ef111f7e1 100644
--- a/pkgs/development/python-modules/pylast/default.nix
+++ b/pkgs/development/python-modules/pylast/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-6yxsqruosSOJ5LeIBbvuEko4s9qU/ObNZiJD5YH/hvY=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/pylint-django/default.nix b/pkgs/development/python-modules/pylint-django/default.nix
index 978394e60e27..d12e7268a24f 100644
--- a/pkgs/development/python-modules/pylint-django/default.nix
+++ b/pkgs/development/python-modules/pylint-django/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pylint-django";
-  version = "2.5.3";
+  version = "2.5.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-5xEXjNMkOetRM9NDz0S4DsC6v39YQi34s2s+Fs56hYU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-MNgu3LvFoohXA+JzUiHIaYFw0ssEe+H5T8Ea56LcGuI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index d4a89aa000bf..948b2afc5a15 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -2,7 +2,6 @@
 , lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pythonOlder
 , astroid
 , dill
@@ -19,40 +18,24 @@
 , pytest-timeout
 , pytest-xdist
 , pytestCheckHook
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "pylint";
-  version = "2.17.5";
-  format = "pyproject";
+  version = "3.0.3";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7.2";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pylint-dev";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-cmH6Q6/XJXx8EXDIsik1Aheu9hYGvvlNvWBUCdmC3P8=";
+    repo = "pylint";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-JwSzit4oDxAqrQFlvTNF7lrirhaHbJ15MRKbl7c7bEg=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "update-setuptools.patch";
-      url = "https://github.com/pylint-dev/pylint/commit/1d029b594aa258fa01570632d001e801f9257d60.patch";
-      hash = "sha256-brQwelZVkSX9h0POH8OJeapZuWZ8p7BY/ZzhYzGbiHY=";
-    })
-    # https://github.com/pylint-dev/pylint/pull/8961
-    (fetchpatch {
-      name = "unpin-setuptools.patch";
-      url = "https://github.com/pylint-dev/pylint/commit/a0ac282d6f8df381cc04adc0a753bec66fc4db63.patch";
-      hash = "sha256-15O72LE2WQK590htNc3jghdbVoGLHUIngERDpqT8pK8=";
-    })
-  ];
-
   nativeBuildInputs = [
     setuptools
-    wheel
   ];
 
   propagatedBuildInputs = [
@@ -123,6 +106,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://pylint.readthedocs.io/en/stable/";
     description = "A bug and style checker for Python";
+    changelog = "https://github.com/pylint-dev/pylint/releases/tag/v${version}";
     longDescription = ''
       Pylint is a Python static code analysis tool which looks for programming errors,
       helps enforcing a coding standard, sniffs for code smells and offers simple
diff --git a/pkgs/development/python-modules/pylsp-mypy/default.nix b/pkgs/development/python-modules/pylsp-mypy/default.nix
index 3a5879633114..e93e24406341 100644
--- a/pkgs/development/python-modules/pylsp-mypy/default.nix
+++ b/pkgs/development/python-modules/pylsp-mypy/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , setuptools
 , mypy
 , pytestCheckHook
@@ -12,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pylsp-mypy";
-  version = "0.6.7";
+  version = "0.6.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,18 +20,9 @@ buildPythonPackage rec {
     owner = "python-lsp";
     repo = "pylsp-mypy";
     rev = "refs/tags/${version}";
-    hash = "sha256-ZsNIw0xjxnU9Ue0C7TlhzVOCOCKEbCa2CsiiqeMb14I=";
+    hash = "sha256-oEWUXkE8U7/ye6puJZRSkQFi10BPGuc8XZQbHwqOPEI=";
   };
 
-  patches = [
-    # https://github.com/python-lsp/pylsp-mypy/pull/64
-    (fetchpatch {
-      name = "fix-hanging-test.patch";
-      url = "https://github.com/python-lsp/pylsp-mypy/commit/90d28edb474135007804f1e041f88713a95736f9.patch";
-      hash = "sha256-3DVyUXVImRemXCuyoXlYbPJm6p8OnhBdEKmwjx88ets=";
-    })
-  ];
-
   nativeBuildInputs = [
     setuptools
   ];
@@ -40,7 +30,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     mypy
     python-lsp-server
-  ] ++ lib.optionals (pythonOlder "3.11") [
     tomli
   ];
 
diff --git a/pkgs/development/python-modules/pylsqpack/default.nix b/pkgs/development/python-modules/pylsqpack/default.nix
index 54123b656e1b..f1e595f88b47 100644
--- a/pkgs/development/python-modules/pylsqpack/default.nix
+++ b/pkgs/development/python-modules/pylsqpack/default.nix
@@ -1,19 +1,24 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pylsqpack";
-  version = "0.3.17";
-  format = "setuptools";
+  version = "0.3.18";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LyB3jblW3H5LGop5ci1XpGUMRZl/tlwTUsv4XreqPOI=";
+    hash = "sha256-Ra5V5yGHdQX01czUlZHWk1PypUioZz36+yUdOFs8CX8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "pylsqpack" ];
diff --git a/pkgs/development/python-modules/pymatting/default.nix b/pkgs/development/python-modules/pymatting/default.nix
index 0d10efd616a4..5e3b39dd523a 100644
--- a/pkgs/development/python-modules/pymatting/default.nix
+++ b/pkgs/development/python-modules/pymatting/default.nix
@@ -10,14 +10,14 @@
 }:
 buildPythonPackage rec {
   pname = "pymatting";
-  version = "1.1.2";
+  version = "1.1.10";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "pymatting";
     repo = "pymatting";
-    rev = "v${version}";
-    hash = "sha256-9eRpsWwXAkp6aw1ZWJsUFf0BMIN0UBFc2rW1lltL2cw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-wHCTqcBvVN/pTXH3iW57DPpMEsnehutRQB5NaugS6Zs=";
   };
 
   patches = [ ./01-kdtree-signature.patch ];
diff --git a/pkgs/development/python-modules/pymdown-extensions/default.nix b/pkgs/development/python-modules/pymdown-extensions/default.nix
index f6fea35270e5..3a06e511a344 100644
--- a/pkgs/development/python-modules/pymdown-extensions/default.nix
+++ b/pkgs/development/python-modules/pymdown-extensions/default.nix
@@ -44,14 +44,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pymdown-extensions";
-  version = "10.3";
+  version = "10.5";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "facelessuser";
     repo = "pymdown-extensions";
     rev = "refs/tags/${version}";
-    hash = "sha256-R35R2dHfjcVQbEa2319FEMjPGl1Y5/u2KEHeR0wTYEo=";
+    hash = "sha256-S9xnGzX9VHRWDfrlIVcywiyuyyxIFYitwTMdGZ2NEqo=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/pymilvus/default.nix b/pkgs/development/python-modules/pymilvus/default.nix
index b1605fac01b5..f62b039bbb45 100644
--- a/pkgs/development/python-modules/pymilvus/default.nix
+++ b/pkgs/development/python-modules/pymilvus/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "pymilvus";
-  version = "2.3.0";
+  version = "2.3.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,11 +28,9 @@ buildPythonPackage rec {
     owner = "milvus-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-hp00iUT1atyTQk532z7VAajpfvtnKE8W2la9MW7NxoE=";
+    hash = "sha256-qnm6JaeF2Li2NgVGZ6yJ2yz1n3pVZqkF4Ee+q4v/kdA=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "grpcio"
   ];
diff --git a/pkgs/development/python-modules/pymongo/default.nix b/pkgs/development/python-modules/pymongo/default.nix
index bb6196f775a2..6d69cc3556c4 100644
--- a/pkgs/development/python-modules/pymongo/default.nix
+++ b/pkgs/development/python-modules/pymongo/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pymongo";
-  version = "4.5.0";
+  version = "4.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aB8lLkOz7wVMqRYWNfgbcw9NjK3Siz8rIAT1py+FOYI=";
+    hash = "sha256-Mdqx8+HQzdV+jfAbZF9S1DzBtlPtOv1TXSiR9PxPlxI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index 1c21e6b90c1a..fb9603c18d5f 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -3,10 +3,15 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, pytestCheckHook
 , python
+
+# build-system
+, libclang
+, psutil
+, setuptools
 , swig
-, mupdf
+
+# native dependencies
 , freetype
 , harfbuzz
 , openjpeg
@@ -14,7 +19,13 @@
 , libjpeg_turbo
 , gumbo
 , memstreamHook
+
+# dependencies
+, mupdf
+
+# tests
 , fonttools
+, pytestCheckHook
 }:
 
 let
@@ -22,21 +33,31 @@ let
   mupdf-cxx = mupdf.override { enableOcr = true; enableCxx = true; enablePython = true; python3 = python; };
 in buildPythonPackage rec {
   pname = "pymupdf";
-  version = "1.23.6";
-  format = "setuptools";
+  version = "1.23.7";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pymupdf";
     repo = "PyMuPDF";
-    rev = version;
-    hash = "sha256-60KT5+EGP+s7HD4UIeaf9x2QVNU9IUbC5WKEJbrIBCI=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-XVf9nKbcTS/rxRCD2u5u8ecCf0bWZ3FXXN/YulI9etU=";
   };
 
+  # swig is not wrapped as python package
+  # libclang calls itself just clang in wheel metadata
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"swig",' "" \
+      --replace "libclang" "clang"
+  '';
+
   nativeBuildInputs = [
-    pytestCheckHook
+    libclang
     swig
+    psutil
+    setuptools
   ];
 
   buildInputs = [
@@ -69,13 +90,16 @@ in buildPythonPackage rec {
     done
   '';
 
-  checkInputs = [
+  nativeCheckInputs = [
+    pytestCheckHook
     fonttools
   ];
 
   disabledTests = [
     # fails for indeterminate reasons
     "test_color_count"
+    "test_2753"
+    "test_2548"
   ] ++ lib.optionals stdenv.isDarwin [
     # darwin does not support OCR right now
     "test_tesseract"
diff --git a/pkgs/development/python-modules/pynetbox/default.nix b/pkgs/development/python-modules/pynetbox/default.nix
index 2759ff506643..0a08f4affa59 100644
--- a/pkgs/development/python-modules/pynetbox/default.nix
+++ b/pkgs/development/python-modules/pynetbox/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-QIvh24ZqnF8uF9HOuY0yt3QT/jHgJ2C916d+rBqezWQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pyngo/default.nix b/pkgs/development/python-modules/pyngo/default.nix
index 81bddae490d3..3616d5eaec6b 100644
--- a/pkgs/development/python-modules/pyngo/default.nix
+++ b/pkgs/development/python-modules/pyngo/default.nix
@@ -1,6 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+, pythonRelaxDepsHook
 
 # build-system
 , hatchling
@@ -18,18 +20,25 @@
 
 buildPythonPackage rec {
   pname = "pyngo";
-  version = "1.7.0";
+  version = "2.0.0";
   pyproject = true;
 
+  disabled = pythonOlder "3.10";
+
   src = fetchFromGitHub {
     owner = "yezz123";
     repo = "pyngo";
     rev = "refs/tags/${version}";
-    hash = "sha256-cMWYmCbkhJmz+RMCh3NIhOkC5bX46nwz09WhTV+Mz6w=";
+    hash = "sha256-jHPZjS/J1VLpsLN2wg5UJCgavoSEs4Uogo4GI6bZMuY=";
   };
 
   nativeBuildInputs = [
     hatchling
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "pydantic"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyngrok/default.nix b/pkgs/development/python-modules/pyngrok/default.nix
index 5763fa91f24a..04f474a8aed5 100644
--- a/pkgs/development/python-modules/pyngrok/default.nix
+++ b/pkgs/development/python-modules/pyngrok/default.nix
@@ -2,13 +2,14 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, setuptools
 , pyyaml
 }:
 
 buildPythonPackage rec {
   pname = "pyngrok";
   version = "7.0.5";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -17,6 +18,10 @@ buildPythonPackage rec {
     hash = "sha256-YTe9n5cZLYQ9ghTOF8MHg/1d8iRElPHNnAQj0pnEjR4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyyaml
   ];
diff --git a/pkgs/development/python-modules/pynisher/default.nix b/pkgs/development/python-modules/pynisher/default.nix
index 6c7f1c0f59a2..34a6f158f121 100644
--- a/pkgs/development/python-modules/pynisher/default.nix
+++ b/pkgs/development/python-modules/pynisher/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pynisher";
-  version = "1.0.9";
+  version = "1.0.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hlN5uUlgmcipQqmr22rB245oEXOUe5WB9jWo7MXXViE=";
+    hash = "sha256-JyK3ldIhKd3VJHA4u6cnrgbs2zpZQgcIF758jUpoDjE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pynndescent/default.nix b/pkgs/development/python-modules/pynndescent/default.nix
index fb796ab6c331..9817ba9935d9 100644
--- a/pkgs/development/python-modules/pynndescent/default.nix
+++ b/pkgs/development/python-modules/pynndescent/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "pynndescent";
-  version = "0.5.10";
+  version = "0.5.11";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XV3Gg8A+9V/j3faThZcgyhj4XG5uW7C08UhwJ41SiK0=";
+    hash = "sha256-b0TO2dWp2iyH2bL/8wu1MIVAwGV2BeTVzeftMnW7rVA=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pyocr/default.nix b/pkgs/development/python-modules/pyocr/default.nix
index 8dc1ee0f8780..407166e98c90 100644
--- a/pkgs/development/python-modules/pyocr/default.nix
+++ b/pkgs/development/python-modules/pyocr/default.nix
@@ -34,8 +34,6 @@ buildPythonPackage rec {
     })
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [ pillow ];
 
   nativeBuildInputs = [ setuptools setuptools-scm ];
diff --git a/pkgs/development/python-modules/pyodbc/default.nix b/pkgs/development/python-modules/pyodbc/default.nix
index d8cf1f260da2..b20d4618167d 100644
--- a/pkgs/development/python-modules/pyodbc/default.nix
+++ b/pkgs/development/python-modules/pyodbc/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyodbc";
-  version = "4.0.39";
+  version = "5.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7" || isPyPy; # use pypypdbc instead
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5Si7cN1tYpnuQphokl3whm4+kZx3K57/ecjheSDY8RY=";
+    hash = "sha256-A9fQsE1akVYJnOjQPpLzlWeDdG+pI0629bXPwStkUBE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyopengl/default.nix b/pkgs/development/python-modules/pyopengl/default.nix
index 428bd4084ae0..10333862bb8d 100644
--- a/pkgs/development/python-modules/pyopengl/default.nix
+++ b/pkgs/development/python-modules/pyopengl/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "pyopengl";
-  version = "3.1.6";
+  version = "3.1.7";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "PyOpenGL";
     inherit version;
-    hash = "sha256-jqbIdzkn7adAW//G9buTvoFWmnsFyMrFDNlOlp3OXic=";
+    hash = "sha256-7vMaOIjmmE/U2ObJlhsYTJgTyoJgTTf+PagOsACnbIY=";
   };
 
   propagatedBuildInputs = [ pillow ];
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index bc841cc2fd4e..611666e851d3 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "pyopenssl";
-  version = "23.2.0";
+  version = "23.3.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "pyOpenSSL";
     inherit version;
-    hash = "sha256-J2+TH1WkUufeppxxc+mE6ypEB85BPJGKo0tV+C+bi6w=";
+    hash = "sha256-ayy6XMRugidQ7D5age4SgZhQsRMDYw1XXpgQigecKxI=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/pyopenuv/default.nix b/pkgs/development/python-modules/pyopenuv/default.nix
index 37ec8b60f0f3..db03bb04b422 100644
--- a/pkgs/development/python-modules/pyopenuv/default.nix
+++ b/pkgs/development/python-modules/pyopenuv/default.nix
@@ -3,6 +3,7 @@
 , aresponses
 , backoff
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
 , poetry-core
 , pytest-aiohttp
@@ -32,6 +33,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     aiohttp
     backoff
+    certifi
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/pyosmium/default.nix b/pkgs/development/python-modules/pyosmium/default.nix
index 40090532fea1..d35b5d7241b6 100644
--- a/pkgs/development/python-modules/pyosmium/default.nix
+++ b/pkgs/development/python-modules/pyosmium/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "pyosmium";
-  version = "3.6.0";
+  version = "3.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6" || isPyPy;
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "osmcode";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+YJQGPQm2FGOPhNzlXX2GM+ad4QdipJhwViOKGHtqBk=";
+    hash = "sha256-DBFDAKNrD93MRXjoM8dIJQ/HJ9Aj8oMJuPVQxTrKYfI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pyparsing/default.nix b/pkgs/development/python-modules/pyparsing/default.nix
index e621a80d7acd..9fbf388e7d2d 100644
--- a/pkgs/development/python-modules/pyparsing/default.nix
+++ b/pkgs/development/python-modules/pyparsing/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pyparsing";
-  version = "3.0.9";
+  version = "3.1.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pyparsing";
     repo = pname;
-    rev = "pyparsing_${version}";
-    hash = "sha256-aCRyJQyLf8qQ6NO41q+HC856TjIHzIt0vyVBLV+3teE=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-54XMw5ahMZH4cevTFg2GXhgSu0QX1mfITWFezWirt1E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix
index 0cfb41097c4f..5ff98d82eb3c 100644
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@@ -89,6 +89,8 @@ buildPythonPackage rec {
   disabledTests = [
     # requires fpdf2 which we don't package yet
     "test_compression"
+    # infinite recursion when including fpdf2
+    "test_merging_many_temporary_files"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pyproject-api/default.nix b/pkgs/development/python-modules/pyproject-api/default.nix
index 4ba62fc1e310..efcc35632015 100644
--- a/pkgs/development/python-modules/pyproject-api/default.nix
+++ b/pkgs/development/python-modules/pyproject-api/default.nix
@@ -44,8 +44,6 @@ buildPythonPackage rec {
     "doc"
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/pypytools/default.nix b/pkgs/development/python-modules/pypytools/default.nix
index ecc86e4fe2f8..870768dc8112 100644
--- a/pkgs/development/python-modules/pypytools/default.nix
+++ b/pkgs/development/python-modules/pypytools/default.nix
@@ -2,18 +2,20 @@
 , buildPythonPackage
 , fetchpatch
 , fetchPypi
+, attrs
 , freezegun
 , numpy
 , py
 , pytestCheckHook
 , pythonAtLeast
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pypytools";
   version = "0.6.2";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -22,7 +24,13 @@ buildPythonPackage rec {
     hash = "sha256-oUDAU+TRwLroNfQGYusAQKdRkHcazysqiDLfp77v5Sk=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
+    # attrs is an implicit dependency
+    attrs
     py
   ];
 
diff --git a/pkgs/development/python-modules/pyqt-builder/default.nix b/pkgs/development/python-modules/pyqt-builder/default.nix
index ad1ed8e17038..1bf96713a4fe 100644
--- a/pkgs/development/python-modules/pyqt-builder/default.nix
+++ b/pkgs/development/python-modules/pyqt-builder/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "pyqt-builder";
-  version = "1.15.3";
+  version = "1.15.4";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "PyQt-builder";
     inherit version;
-    hash = "sha256-WzPpnty3fUpjo4YF9EV6BM/04lTHce1SnryViZBszbE=";
+    hash = "sha256-OfjHXbF9nOF8trvz3xZQtc68HqTlvXOEPSHMlmErKuE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyqt/sip.nix b/pkgs/development/python-modules/pyqt/sip.nix
index ea8a518afd0d..3702bad5cac7 100644
--- a/pkgs/development/python-modules/pyqt/sip.nix
+++ b/pkgs/development/python-modules/pyqt/sip.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "pyqt5-sip";
-  version = "12.11.0";
+  version = "12.13.0";
 
   src = fetchPypi {
     pname = "PyQt5_sip";
     inherit version;
-    hash = "sha256-tHEP2FtX7e9xbMVfrkW/1b+sb8e6kQNvHcw/Mxyg6zk=";
+    hash = "sha256-fzIdr4S5ydvKYbgOHvN72v/A6TMS7a4s19oluVOXHZE=";
   };
 
   # There is no test code and the check phase fails with:
diff --git a/pkgs/development/python-modules/pyquery/default.nix b/pkgs/development/python-modules/pyquery/default.nix
index 699bcd0fbc59..f1de975c418b 100644
--- a/pkgs/development/python-modules/pyquery/default.nix
+++ b/pkgs/development/python-modules/pyquery/default.nix
@@ -4,6 +4,7 @@
 , fetchPypi
 , lxml
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 , requests
 , webob
@@ -52,6 +53,11 @@ buildPythonPackage rec {
     "--deselect=tests/test_pyquery.py::TestWebScrappingEncoding::test_get"
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/gawel/pyquery/issues/249
+    "pyquery.pyquery.PyQuery.serialize_dict"
+  ];
+
   meta = with lib; {
     description = "A jquery-like library for Python";
     homepage = "https://github.com/gawel/pyquery";
diff --git a/pkgs/development/python-modules/pyquil/default.nix b/pkgs/development/python-modules/pyquil/default.nix
index c822014dd843..f980365202dd 100644
--- a/pkgs/development/python-modules/pyquil/default.nix
+++ b/pkgs/development/python-modules/pyquil/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "pyquil";
-  version = "3.5.4";
+  version = "4.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "rigetti";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-GQ7vzuUu0PCeLkqKWUSNJyJ01wseOwNL2jJaVTNGF9s=";
+    hash = "sha256-LLhTK/wE42mBTrqjBbnkPvqSG8gP7Vx/3ip66hKHxXc=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pyregion/default.nix b/pkgs/development/python-modules/pyregion/default.nix
index 6f1affd9063e..4d875032ef94 100644
--- a/pkgs/development/python-modules/pyregion/default.nix
+++ b/pkgs/development/python-modules/pyregion/default.nix
@@ -32,9 +32,7 @@ buildPythonPackage rec {
     hash = "sha256-r2STKnZwNvonXATrQ5q9NVD9QftlWI1RWl4F+GZSxVg=";
   };
 
-  env = {
-    SETUPTOOLS_SCM_PRETEND_VERSION = version;
-  } // lib.optionalAttrs stdenv.cc.isClang {
+  env = lib.optionalAttrs stdenv.cc.isClang {
     # Try to remove on next update.  generated code returns a NULL in a
     # function where an int is expected.
     NIX_CFLAGS_COMPILE = "-Wno-error=int-conversion";
diff --git a/pkgs/development/python-modules/pyrfc3339/default.nix b/pkgs/development/python-modules/pyrfc3339/default.nix
index 9885d4f5443f..9345b819f75c 100644
--- a/pkgs/development/python-modules/pyrfc3339/default.nix
+++ b/pkgs/development/python-modules/pyrfc3339/default.nix
@@ -1,21 +1,41 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
 , pytz
+
+# tests
 , nose
 }:
 
 buildPythonPackage rec {
   pname = "pyRFC3339";
   version = "1.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "06jv7ar7lpvvk0dixzwdr3wgm0g1lipxs429s2z7knwwa7hwpf41";
   };
 
-  propagatedBuildInputs = [ pytz ];
-  buildInputs = [ nose ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    pytz
+  ];
+
+  doCheck = pythonOlder "3.12";
+
+  nativeCheckInputs = [
+    nose
+  ];
 
   meta = with lib; {
     description = "Generate and parse RFC 3339 timestamps";
diff --git a/pkgs/development/python-modules/pyrmvtransport/default.nix b/pkgs/development/python-modules/pyrmvtransport/default.nix
index 888ad2f43ceb..60415585b1cd 100644
--- a/pkgs/development/python-modules/pyrmvtransport/default.nix
+++ b/pkgs/development/python-modules/pyrmvtransport/default.nix
@@ -42,6 +42,11 @@ buildPythonPackage rec {
     pytest-httpx
   ];
 
+  disabledTests = [
+    # should fail, but times out
+    "test__query_rmv_api_fail"
+  ];
+
   patches = [
     # Can be removed with next release, https://github.com/cgtobi/PyRMVtransport/pull/55
     (fetchpatch {
diff --git a/pkgs/development/python-modules/pyroma/default.nix b/pkgs/development/python-modules/pyroma/default.nix
index b9669e41d3b2..99fb8bec5f09 100644
--- a/pkgs/development/python-modules/pyroma/default.nix
+++ b/pkgs/development/python-modules/pyroma/default.nix
@@ -1,37 +1,59 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
+
+# build-system
+, setuptools
+
+# dependencies
+, build
 , docutils
-, python
+, flit-core
+, packaging
 , pygments
-, setuptools
 , requests
+, trove-classifiers
+
+# test
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pyroma";
-  version = "3.2";
-  format = "setuptools";
+  version = "4.2";
+  pyproject = true;
+
+  # https://github.com/regebro/pyroma/issues/104
+  disabled = pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "regebro";
-    repo = pname;
+    repo = "pyroma";
     rev = version;
-    sha256 = "0ln9w984n48nyxwzd1y48l6b18lnv52radcyizaw56lapcgxrzdr";
+    sha256 = "sha256-ElSw+bY6fbHJPTX7O/9JZ4drttfbUQsU/fv3Cqqb/J4=";
   };
 
   propagatedBuildInputs = [
+    build
     docutils
+    flit-core
+    packaging
     pygments
     setuptools
     requests
+    trove-classifiers
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
-  # https://github.com/regebro/pyroma/blob/3.2/Makefile#L23
-  # PyPITest requires network access
-  checkPhase = ''
-    ${python.interpreter} -m unittest -k 'not PyPITest' pyroma.tests
-  '';
+  disabledTests = [
+    # tries to reach pypi
+    "test_complete"
+    "test_distribute"
+  ];
 
   pythonImportsCheck = [ "pyroma" ];
 
diff --git a/pkgs/development/python-modules/pyrsistent/default.nix b/pkgs/development/python-modules/pyrsistent/default.nix
index 2f21caa001d3..fae4bba430d3 100644
--- a/pkgs/development/python-modules/pyrsistent/default.nix
+++ b/pkgs/development/python-modules/pyrsistent/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
+, setuptools
 , six
 , pytestCheckHook
 , hypothesis
@@ -9,26 +10,24 @@
 
 buildPythonPackage rec {
   pname = "pyrsistent";
-  version = "0.19.3";
-  format = "setuptools";
+  version = "0.20.0";
+  pyproject = true;
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GimUdzcGu7SZXDGpe8lPFBgxSSO9EEjG2WSDcEA3ZEA=";
+    hash = "sha256-TEj3j2KrWWxnkIYITQ3RMlSuTz1scqg//fXr3vjyZaQ=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ six ];
 
   nativeCheckInputs = [ pytestCheckHook hypothesis ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace 'pytest<5' 'pytest' \
-      --replace 'hypothesis<5' 'hypothesis'
-  '';
-
   pythonImportsCheck = [ "pyrsistent" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pysam/default.nix b/pkgs/development/python-modules/pysam/default.nix
index 50661d924691..d2887eda5847 100644
--- a/pkgs/development/python-modules/pysam/default.nix
+++ b/pkgs/development/python-modules/pysam/default.nix
@@ -4,19 +4,20 @@
 , bzip2
 , bcftools
 , curl
-, cython
+, cython_3
 , htslib
 , libdeflate
 , xz
 , pytestCheckHook
+, setuptools
 , samtools
 , zlib
 }:
 
 buildPythonPackage rec {
   pname   = "pysam";
-  version = "0.21.0";
-  format = "setuptools";
+  version = "0.22.0";
+  pyproject = true;
 
   # Fetching from GitHub instead of PyPi cause the 0.13 src release on PyPi is
   # missing some files which cause test failures.
@@ -25,10 +26,14 @@ buildPythonPackage rec {
     owner = "pysam-developers";
     repo = "pysam";
     rev = "refs/tags/v${version}";
-    hash = "sha256-C4/AJwcUyLoUEUEnsATLHJb5F8mltP8X2XfktYu0OTo=";
+    hash = "sha256-TLqZF5NS9ROH8z7c2ZxfOYNRIe5pabMNBuhQ4azFmDU=";
   };
 
-  nativeBuildInputs = [ samtools ];
+  nativeBuildInputs = [
+    cython_3
+    samtools
+    setuptools
+  ];
 
   buildInputs = [
     bzip2
@@ -38,8 +43,6 @@ buildPythonPackage rec {
     zlib
   ];
 
-  propagatedBuildInputs = [ cython ];
-
   # Use nixpkgs' htslib instead of the bundled one
   # See https://pysam.readthedocs.io/en/latest/installation.html#external
   # NOTE that htslib should be version compatible with pysam
@@ -73,6 +76,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "A python module for reading, manipulating and writing genome data sets";
+    downloadPage = "https://github.com/pysam-developers/pysam";
     homepage = "https://pysam.readthedocs.io/";
     maintainers = with maintainers; [ unode ];
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/pyschlage/default.nix b/pkgs/development/python-modules/pyschlage/default.nix
index 500742697163..5344a06bdb8e 100644
--- a/pkgs/development/python-modules/pyschlage/default.nix
+++ b/pkgs/development/python-modules/pyschlage/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-RWM/76uqljWgKBWsMvGTggJllX0Qa9QaMM0hJbCvZgQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pysmart/default.nix b/pkgs/development/python-modules/pysmart/default.nix
index 3edc3b57cc4d..42854750bbbb 100644
--- a/pkgs/development/python-modules/pysmart/default.nix
+++ b/pkgs/development/python-modules/pysmart/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-1k+5XnIT/AfZmzKUxkyU/uc0eW05CvugpY6OdJCoALc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pySMART/utils.py \
       --replace "which('smartctl')" '"${smartmontools}/bin/smartctl"'
diff --git a/pkgs/development/python-modules/pysml/default.nix b/pkgs/development/python-modules/pysml/default.nix
index 58381f99db3e..cfdfc1b47629 100644
--- a/pkgs/development/python-modules/pysml/default.nix
+++ b/pkgs/development/python-modules/pysml/default.nix
@@ -1,4 +1,5 @@
 { lib
+, aiohttp
 , async-timeout
 , bitstring
 , buildPythonPackage
@@ -27,6 +28,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    aiohttp
     async-timeout
     bitstring
     pyserial-asyncio
diff --git a/pkgs/development/python-modules/pysolcast/default.nix b/pkgs/development/python-modules/pysolcast/default.nix
index f4121a53e794..5e740e78e6a8 100644
--- a/pkgs/development/python-modules/pysolcast/default.nix
+++ b/pkgs/development/python-modules/pysolcast/default.nix
@@ -1,4 +1,5 @@
 { lib
+, anyconfig
 , buildPythonPackage
 , fetchFromGitHub
 , isodate
@@ -29,6 +30,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    anyconfig
     isodate
     pyyaml
     requests
diff --git a/pkgs/development/python-modules/pyspnego/default.nix b/pkgs/development/python-modules/pyspnego/default.nix
index 650af9af50a6..ae1d4f2d1beb 100644
--- a/pkgs/development/python-modules/pyspnego/default.nix
+++ b/pkgs/development/python-modules/pyspnego/default.nix
@@ -8,13 +8,14 @@
 , pytest-mock
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , glibcLocales
 }:
 
 buildPythonPackage rec {
   pname = "pyspnego";
-  version = "0.9.2";
-  format = "setuptools";
+  version = "0.10.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -22,14 +23,29 @@ buildPythonPackage rec {
     owner = "jborean93";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-A0vVpEI8TKelZ96dIqSc01SX1gU3pDUVSOV6jap2WtU=";
+    hash = "sha256-60aIRrhRynbuuFZzzBhJTlmU74CWuao8jWhr126cPrc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     cryptography
-    gssapi
-    krb5
-    ruamel-yaml
+  ];
+
+  passthru.optional-dependencies = {
+    kerberos = [
+      gssapi
+      krb5
+    ];
+    yaml = [
+      ruamel-yaml
+    ];
+  };
+
+  pythonImportsCheck = [
+    "spnego"
   ];
 
   nativeCheckInputs = [
@@ -38,16 +54,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # struct.error: unpack requires a buffer of 1 bytes
-    "test_credssp_invalid_client_authentication"
-  ];
-
-  LC_ALL = "en_US.UTF-8";
-
-  pythonImportsCheck = [ "spnego" ];
+  env.LC_ALL = "en_US.UTF-8";
 
   meta = with lib; {
+    changelog = "https://github.com/jborean93/pyspnego/blob/v${version}/CHANGELOG.md";
     description = "Python SPNEGO authentication library";
     homepage = "https://github.com/jborean93/pyspnego";
     license = with licenses; [ mit ];
diff --git a/pkgs/development/python-modules/pystardict/default.nix b/pkgs/development/python-modules/pystardict/default.nix
index 4e5cbd64e4b6..c36dac0e7ae2 100644
--- a/pkgs/development/python-modules/pystardict/default.nix
+++ b/pkgs/development/python-modules/pystardict/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     hash = "sha256-YrZpIhyxfA3G7rP0SJ+EvzGwAXlne80AYilkj6cIDnA=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [ six ];
 
   nativeBuildInputs = [ setuptools setuptools-scm ];
diff --git a/pkgs/development/python-modules/pysuez/default.nix b/pkgs/development/python-modules/pysuez/default.nix
index 34f6de519266..a8f8774256b7 100644
--- a/pkgs/development/python-modules/pysuez/default.nix
+++ b/pkgs/development/python-modules/pysuez/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , setuptools
+, regex
 , requests
 , pythonOlder
 }:
@@ -20,11 +21,17 @@ buildPythonPackage rec {
     hash = "sha256-Xgd0E/oFO2yyytBjuwr1vDJfKWC0Iw8P6GStCuCni/g=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace ", 'datetime'" ""
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];
 
   propagatedBuildInputs = [
+    regex
     requests
   ];
 
diff --git a/pkgs/development/python-modules/pytautulli/default.nix b/pkgs/development/python-modules/pytautulli/default.nix
index 5d2c51675c43..ae39788541e2 100644
--- a/pkgs/development/python-modules/pytautulli/default.nix
+++ b/pkgs/development/python-modules/pytautulli/default.nix
@@ -27,6 +27,10 @@ buildPythonPackage rec {
     # are not in their focus
     substituteInPlace setup.py \
       --replace 'version="main",' 'version="${version}",'
+
+    # yarl 1.9.4 requires ports to be ints
+    substituteInPlace pytautulli/models/host_configuration.py \
+      --replace "str(self.port)" "int(self.port)"
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-aiohttp/default.nix b/pkgs/development/python-modules/pytest-aiohttp/default.nix
index 9cd6ec0491a9..85dd9b7bf537 100644
--- a/pkgs/development/python-modules/pytest-aiohttp/default.nix
+++ b/pkgs/development/python-modules/pytest-aiohttp/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     pytest
   ];
diff --git a/pkgs/development/python-modules/pytest-ansible/default.nix b/pkgs/development/python-modules/pytest-ansible/default.nix
index 3b1def125e0f..1a83d0ed064f 100644
--- a/pkgs/development/python-modules/pytest-ansible/default.nix
+++ b/pkgs/development/python-modules/pytest-ansible/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
       --replace '/usr/bin/env' '${coreutils}/bin/env'
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pytest-arraydiff/default.nix b/pkgs/development/python-modules/pytest-arraydiff/default.nix
index 7984a390a688..2fc73552d549 100644
--- a/pkgs/development/python-modules/pytest-arraydiff/default.nix
+++ b/pkgs/development/python-modules/pytest-arraydiff/default.nix
@@ -9,18 +9,16 @@
 
 buildPythonPackage rec {
   pname = "pytest-arraydiff";
-  version = "0.5.0";
+  version = "0.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "714149beffd0dfa085477c65791c1139b619602b049536353ce1a91397fb3bd2";
+    sha256 = "sha256-KTexRQ/JNWIPJHCdh9QMZ+BVoEPXuFQaJf36mU3aZ94=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-astropy/default.nix b/pkgs/development/python-modules/pytest-astropy/default.nix
index 40fb270b199a..33ffb661d73e 100644
--- a/pkgs/development/python-modules/pytest-astropy/default.nix
+++ b/pkgs/development/python-modules/pytest-astropy/default.nix
@@ -12,22 +12,25 @@
 , pytest-mock
 , pytest-openfiles
 , pytest-remotedata
+, setuptools
 , setuptools-scm
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pytest-astropy";
-  version = "0.10.0";
-  format = "setuptools";
+  version = "0.11.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hePGbO7eTOZo9HOzzzd/yyqjxI4k8oqqN3roYATM4hE=";
+    hash = "sha256-Tq6qme2RFj7Y+arBMscKgfJbxMEvPNVNujKfwmxnObU=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
diff --git a/pkgs/development/python-modules/pytest-asyncio/default.nix b/pkgs/development/python-modules/pytest-asyncio/default.nix
index 96179595a9ae..e373e5b1f654 100644
--- a/pkgs/development/python-modules/pytest-asyncio/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio/default.nix
@@ -2,17 +2,14 @@
 , buildPythonPackage
 , callPackage
 , fetchFromGitHub
-, flaky
-, hypothesis
 , pytest
-, pytestCheckHook
 , pythonOlder
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "pytest-asyncio";
-  version = "0.21.1";
+  version = "0.21.1"; # N.B.: when updating, tests bleak and aioesphomeapi tests
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -29,8 +26,6 @@ buildPythonPackage rec {
     "testout"
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-cases/default.nix b/pkgs/development/python-modules/pytest-cases/default.nix
index c1813c6994c4..bbc67a278855 100644
--- a/pkgs/development/python-modules/pytest-cases/default.nix
+++ b/pkgs/development/python-modules/pytest-cases/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-cases";
-  version = "3.6.14";
-  format = "setuptools";
+  version = "3.8.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dFXmylelRMG/3YtWrOCMHBzkxlcqiquPG9NR3CWhC2s=";
+    hash = "sha256-Sdf2+K1TTlpuc/uPX9OJhmBvF7Ru5V9+vuB6VcZ3ygE=";
   };
 
   nativeBuildInputs = [
@@ -33,11 +33,6 @@ buildPythonPackage rec {
     makefun
   ];
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "pytest-runner" ""
-  '';
-
   # Tests have dependencies (pytest-harvest, pytest-steps) which
   # are not available in Nixpkgs. Most of the packages (decopatch,
   # makefun, pytest-*) have circular dependencies.
diff --git a/pkgs/development/python-modules/pytest-console-scripts/default.nix b/pkgs/development/python-modules/pytest-console-scripts/default.nix
index 5170a7a902ac..81b31c256cfd 100644
--- a/pkgs/development/python-modules/pytest-console-scripts/default.nix
+++ b/pkgs/development/python-modules/pytest-console-scripts/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-WoJu2EzAr6IC655EOB19di973ajgwj+feafx9Ez0qJU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-datadir/default.nix b/pkgs/development/python-modules/pytest-datadir/default.nix
index 90b7e6f55e2b..4adaee73ceae 100644
--- a/pkgs/development/python-modules/pytest-datadir/default.nix
+++ b/pkgs/development/python-modules/pytest-datadir/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-sRLqL+8Jf5Kz+qscuG3hClUuPA+33PQa+ob1ht/7CJE=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pytest-django/default.nix b/pkgs/development/python-modules/pytest-django/default.nix
index 048bd9d48338..a9c8743badf8 100644
--- a/pkgs/development/python-modules/pytest-django/default.nix
+++ b/pkgs/development/python-modules/pytest-django/default.nix
@@ -1,29 +1,55 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytest
 , django
+, setuptools
 , setuptools-scm
 , django-configurations
+, pytest
+, pytestCheckHook
 , pytest-xdist
-, six
 }:
 buildPythonPackage rec {
   pname = "pytest-django";
-  version = "4.5.2";
-  format = "setuptools";
+  version = "4.7.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d9076f759bb7c36939dbdd5ae6633c18edfc2902d1a69fdbefd2426b970ce6c2";
+    hash = "sha256-ktb9RrHXm1T7awYLuzlCgHM5bOxxfV8uEiqZDUtqpeg=";
   };
 
-  nativeBuildInputs = [ pytest setuptools-scm ];
-  nativeCheckInputs = [ pytest django-configurations pytest-xdist six ];
-  propagatedBuildInputs = [ django ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  buildInputs = [
+    pytest
+  ];
+
+  propagatedBuildInputs = [
+    django
+  ];
+
+  nativeCheckInputs = [
+    django-configurations
+    pytestCheckHook
+    pytest-xdist
+  ];
+
+  preCheck = ''
+    # bring pytest_django_test module into PYTHONPATH
+    export PYTHONPATH="$(pwd):$PYTHONPATH"
+
+    # test the lightweight sqlite flavor
+    export DJANGO_SETTINGS_MODULE="pytest_django_test.settings_sqlite"
+  '';
 
-  # Complicated. Requires Django setup.
-  doCheck = false;
+  disabledTests = [
+    # AttributeError: type object 'TestLiveServer' has no attribute '_test_settings_before_run'
+    "test_settings_restored"
+  ];
 
   meta = with lib; {
     description = "py.test plugin for testing of Django applications";
diff --git a/pkgs/development/python-modules/pytest-env/default.nix b/pkgs/development/python-modules/pytest-env/default.nix
index 92ed531c6fbf..c5589f1cccd4 100644
--- a/pkgs/development/python-modules/pytest-env/default.nix
+++ b/pkgs/development/python-modules/pytest-env/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "pytest-env";
-  version = "1.0.1";
+  version = "1.1.3";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "pytest_env";
     inherit version;
-    hash = "sha256-YD/iFujgOl0TSYnLQTF8Waq+8BPSJQxxuGSrB5j75vY=";
+    hash = "sha256-/NfcI7tx79PTVjK94bvl7oyNxEidZhf7AQZ0iA2WIWs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-forked/default.nix b/pkgs/development/python-modules/pytest-forked/default.nix
index e4727abadb7c..2aa92cc3e21f 100644
--- a/pkgs/development/python-modules/pytest-forked/default.nix
+++ b/pkgs/development/python-modules/pytest-forked/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   buildInputs = [
     pytest
   ];
diff --git a/pkgs/development/python-modules/pytest-html/default.nix b/pkgs/development/python-modules/pytest-html/default.nix
index 3375a7a0a0bd..6d4233e043b1 100644
--- a/pkgs/development/python-modules/pytest-html/default.nix
+++ b/pkgs/development/python-modules/pytest-html/default.nix
@@ -11,12 +11,12 @@
 }:
 let
   pname = "pytest-html";
-  version = "4.0.2";
+  version = "4.1.1";
 
   src = fetchPypi {
     pname = "pytest_html";
     inherit version;
-    hash = "sha256-iGgrno5ROSRyVGpwohObJ9a8GDSkr9PkHaM8nZ+R5KQ=";
+    hash = "sha256-cKAeiuWAD0oHS1akyxAlyPT5sDi7pf4x48mOuZZobwc=";
   };
 
   web-assets = buildNpmPackage {
diff --git a/pkgs/development/python-modules/pytest-httpserver/default.nix b/pkgs/development/python-modules/pytest-httpserver/default.nix
index 01ef1025904e..2c825897edb1 100644
--- a/pkgs/development/python-modules/pytest-httpserver/default.nix
+++ b/pkgs/development/python-modules/pytest-httpserver/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-httpserver";
-  version = "1.0.7";
+  version = "1.0.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "csernazs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-bjysG+7niSUBl8YMWR8pr7oOz9GDbSfq3PeloYBkq3s=";
+    hash = "sha256-hbhS1kL5VNiGjvnYkDI1LwgkqqfBMqgcao3zy716q+A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-httpx/default.nix b/pkgs/development/python-modules/pytest-httpx/default.nix
index dbcfafc0a5fe..186c81a93c60 100644
--- a/pkgs/development/python-modules/pytest-httpx/default.nix
+++ b/pkgs/development/python-modules/pytest-httpx/default.nix
@@ -7,24 +7,26 @@
 , pytestCheckHook
 , pythonOlder
 , pythonRelaxDepsHook
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pytest-httpx";
-  version = "0.25.0";
-  format = "setuptools";
+  version = "0.27.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Colin-b";
     repo = "pytest_httpx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8cuXsHyS9OaYXzKXgwan+mBFocyr39B9G8wr8I1pmg4=";
+    hash = "sha256-5CDmIjehW9/aBxoFVbo8W2fAwgIrPPxEqHQjxsTPlpY=";
   };
 
   nativeBuildInputs = [
     pythonRelaxDepsHook
+    setuptools
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pytest-localserver/default.nix b/pkgs/development/python-modules/pytest-localserver/default.nix
index 4ab9c74be35e..d550b4b27469 100644
--- a/pkgs/development/python-modules/pytest-localserver/default.nix
+++ b/pkgs/development/python-modules/pytest-localserver/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-localserver";
-  version = "0.8.0";
+  version = "0.8.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XZDOfQhddB51n6hU29LnxbVXMh1pUXmJTrQOIQ6i/zA=";
+    hash = "sha256-ZlacNP7zGldQsW7/0c0SiKepC1kVXQBef5FqzNPe5PE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-logdog/default.nix b/pkgs/development/python-modules/pytest-logdog/default.nix
index f9bd63d8ee66..176bde51525b 100644
--- a/pkgs/development/python-modules/pytest-logdog/default.nix
+++ b/pkgs/development/python-modules/pytest-logdog/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-Tmoq+KAGzn0MMj29rukDfAc4LSIwC8DoMTuBAppV32I=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-mock/default.nix b/pkgs/development/python-modules/pytest-mock/default.nix
index 260c71ac71ff..f956a62e1a5a 100644
--- a/pkgs/development/python-modules/pytest-mock/default.nix
+++ b/pkgs/development/python-modules/pytest-mock/default.nix
@@ -1,28 +1,31 @@
 { lib
 , buildPythonPackage
+, pythonAtLeast
 , pythonOlder
 , fetchPypi
-, fetchpatch
 , pytest
 , pytest-asyncio
 , pytestCheckHook
+, setuptools
 , setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "pytest-mock";
-  version = "3.11.1";
+  version = "3.12.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  format = "setuptools";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f2sSVgKsbXQ+Ujrgv6ceGml6L1U0BkUoxv+EwvfC/H8=";
+    hash = "sha256-MaQPA4wiytMih7tDkyBURR/1WD/wlLym9nXfL4vBpuk=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
 
   buildInputs = [
     pytest
@@ -33,6 +36,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.11") [
+    # Regression in 3.11.7 and 3.12.1; https://github.com/pytest-dev/pytest-mock/issues/401
+    "test_failure_message_with_name"
+    "test_failure_message_with_no_name"
+  ];
+
   pythonImportsCheck = [ "pytest_mock" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pytest-mpl/default.nix b/pkgs/development/python-modules/pytest-mpl/default.nix
index 9e90f9533d85..f0ea49d1b767 100644
--- a/pkgs/development/python-modules/pytest-mpl/default.nix
+++ b/pkgs/development/python-modules/pytest-mpl/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     pytest
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION=version;
-
   propagatedBuildInputs = [
     jinja2
     matplotlib
diff --git a/pkgs/development/python-modules/pytest-openfiles/default.nix b/pkgs/development/python-modules/pytest-openfiles/default.nix
index 29ea593acc37..da894eff91e3 100644
--- a/pkgs/development/python-modules/pytest-openfiles/default.nix
+++ b/pkgs/development/python-modules/pytest-openfiles/default.nix
@@ -1,7 +1,9 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , isPy27
+, packaging
 , pytest
 , pytestCheckHook
 , psutil
@@ -19,11 +21,21 @@ buildPythonPackage rec {
     sha256 = "179c2911d8aee3441fee051aba08e0d9b4dab61b829ae4811906d5c49a3b0a58";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "replace-distutils-with-packaging.patch";
+      url = "https://github.com/astropy/pytest-openfiles/commit/e17e8123936689b0b0ecfb713976588d6793d8bb.patch";
+      includes = [ "pytest_openfiles/plugin.py" ];
+      hash = "sha256-+6xqOwnBO+jxenXxPdDhLqqm3w+ZRjWeVqqgz8j22bU=";
+    })
+  ];
+
   nativeBuildInputs = [ setuptools-scm ];
 
   buildInputs = [ pytest ];
 
   propagatedBuildInputs = [
+    packaging
     psutil
   ];
 
diff --git a/pkgs/development/python-modules/pytest-playwright/default.nix b/pkgs/development/python-modules/pytest-playwright/default.nix
index 3e27b075efa7..ff4cde9c73e5 100644
--- a/pkgs/development/python-modules/pytest-playwright/default.nix
+++ b/pkgs/development/python-modules/pytest-playwright/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-5qjfZGDM1OqXXNyj81O49ClKKGiAPdgyZZu6TgpskGs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-pytestrail/default.nix b/pkgs/development/python-modules/pytest-pytestrail/default.nix
index 228e952436da..618bccfa3bc5 100644
--- a/pkgs/development/python-modules/pytest-pytestrail/default.nix
+++ b/pkgs/development/python-modules/pytest-pytestrail/default.nix
@@ -11,8 +11,6 @@ buildPythonPackage rec {
   version = "0.10.5";
   format = "setuptools";
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   src = fetchFromGitHub {
     owner = "tolstislon";
     repo = "pytest-pytestrail";
diff --git a/pkgs/development/python-modules/pytest-regressions/default.nix b/pkgs/development/python-modules/pytest-regressions/default.nix
index c306f8ef8f6d..e9950b01fdf1 100644
--- a/pkgs/development/python-modules/pytest-regressions/default.nix
+++ b/pkgs/development/python-modules/pytest-regressions/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , pythonOlder
 , matplotlib
 , numpy
@@ -25,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-gYx4hMHP87q/ie67AsvCezB4VrGYVCfCTVLLgSoQb9k=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
@@ -47,6 +46,15 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pytestFlagsArray = [
+    "-W" "ignore::DeprecationWarning"
+  ];
+
+  disabledTestPathss = lib.optionals (pythonAtLeast "3.12") [
+    # AttributeError: partially initialized module 'pandas' has no attribute '_pandas_datetime_CAPI' (most likely due to a circular import)
+    "tests/test_num_regression.py"
+  ];
+
   pythonImportsCheck = [
     "pytest_regressions"
     "pytest_regressions.plugin"
diff --git a/pkgs/development/python-modules/pytest-remotedata/default.nix b/pkgs/development/python-modules/pytest-remotedata/default.nix
index bc8c89caacc1..581145212f90 100644
--- a/pkgs/development/python-modules/pytest-remotedata/default.nix
+++ b/pkgs/development/python-modules/pytest-remotedata/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-remotedata";
-  version = "0.4.0";
+  version = "0.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-viHFWONNfBGw9q61CVbAlSC//NArf86cb46FMaQBocg=";
+    hash = "sha256-BcCL9jjN0e1m6wFzihZHw8cUc3w+w6vgCdLB95O0u1k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-repeat/default.nix b/pkgs/development/python-modules/pytest-repeat/default.nix
index 7db1992d5f85..1c020428c4b8 100644
--- a/pkgs/development/python-modules/pytest-repeat/default.nix
+++ b/pkgs/development/python-modules/pytest-repeat/default.nix
@@ -1,26 +1,29 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, hatchling
+, hatch-vcs
 , pytest
 , pytestCheckHook
 , pythonOlder
-, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "pytest-repeat";
-  version = "0.9.2";
-  format = "setuptools";
+  version = "0.9.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-eWc0Ra6ZruMzuBHH0AN660CPkzuImDdf8vT/8eO6aGs=";
+    pname = "pytest_repeat";
+    inherit version;
+    hash = "sha256-/9ODbfzWe7JwvsZIszDiC+N9KWZEjEFIxAktHoq6gYU=";
   };
 
   nativeBuildInputs = [
-    setuptools-scm
+    hatchling
+    hatch-vcs
   ];
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index f030960df655..59d459adb6c9 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "12.0";
+  version = "13.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eE9GL6h/6b33gdACfYVrR6S/5sEq8Qj2vYhwV6kXtI4=";
+    hash = "sha256-4TLb5CC8R29US5bnA27dCmlwdXQgm2Z3JjyVDRmwkZk=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pytest-snapshot/default.nix b/pkgs/development/python-modules/pytest-snapshot/default.nix
index 7047eef03eef..f8f207c64b6a 100644
--- a/pkgs/development/python-modules/pytest-snapshot/default.nix
+++ b/pkgs/development/python-modules/pytest-snapshot/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-0PZu9wL29iEppLxxbl4D0E4WfOHe61KUUld003cRBRU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pytest-subprocess/default.nix b/pkgs/development/python-modules/pytest-subprocess/default.nix
index 6a1d75be5315..966ca16dd0ba 100644
--- a/pkgs/development/python-modules/pytest-subprocess/default.nix
+++ b/pkgs/development/python-modules/pytest-subprocess/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, setuptools
 , pytest
 , pytestCheckHook
 , docutils
@@ -14,7 +15,7 @@
 buildPythonPackage rec {
   pname = "pytest-subprocess";
   version = "1.5.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -25,6 +26,10 @@ buildPythonPackage rec {
     hash = "sha256-u9d9RhbikOyknMWs18j2efYJb9YdHsQrp31LfcbudoA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   buildInputs = [
     pytest
   ];
@@ -38,6 +43,10 @@ buildPythonPackage rec {
     anyio
   ];
 
+  pytestFlagsArray = [
+    "-W ignore::DeprecationWarning"
+  ];
+
   meta = with lib; {
     description = "A plugin to fake subprocess for pytest";
     homepage = "https://github.com/aklajnert/pytest-subprocess";
diff --git a/pkgs/development/python-modules/pytest-subtests/default.nix b/pkgs/development/python-modules/pytest-subtests/default.nix
index b391ece3556a..eb292e61537d 100644
--- a/pkgs/development/python-modules/pytest-subtests/default.nix
+++ b/pkgs/development/python-modules/pytest-subtests/default.nix
@@ -1,10 +1,17 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
 , setuptools
 , setuptools-scm
+
+# dependencies
+, attrs
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -24,6 +31,10 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  propagatedBuildInputs = [
+    attrs
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pytest-test-utils/default.nix b/pkgs/development/python-modules/pytest-test-utils/default.nix
index cf2322d39a8c..127b0c163356 100644
--- a/pkgs/development/python-modules/pytest-test-utils/default.nix
+++ b/pkgs/development/python-modules/pytest-test-utils/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-5gB+hnJR2+NQd/n7RGrX1bzfKt8Np7IbWw61SZgNVJY=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pytest-timeout/default.nix b/pkgs/development/python-modules/pytest-timeout/default.nix
index 9064b4283ba8..c0a97dd414ac 100644
--- a/pkgs/development/python-modules/pytest-timeout/default.nix
+++ b/pkgs/development/python-modules/pytest-timeout/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-timeout";
-  version = "2.1.0";
+  version = "2.2.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wHygdATGEvirviIpSyPDaOLlEEtSHBeQGVVh834aw9k=";
+    hash = "sha256-OwuV2r88tQusnvXKkS+gz8KGUmrxevyAaCTfIML3LJA=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pytest-trio/default.nix b/pkgs/development/python-modules/pytest-trio/default.nix
index 243ea9781f3e..291b10f9b1b8 100644
--- a/pkgs/development/python-modules/pytest-trio/default.nix
+++ b/pkgs/development/python-modules/pytest-trio/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchFromGitHub, pythonOlder
-, trio, async-generator, hypothesis, outcome, pytest }:
+, trio, hypothesis, outcome, pytest }:
 
 buildPythonPackage rec {
   pname = "pytest-trio";
@@ -18,7 +18,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     trio
-    async-generator
     outcome
   ];
 
diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index 5c260f432161..947040fbf5fd 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-xdist";
-  version = "3.3.1";
+  version = "3.5.0";
   disabled = pythonOlder "3.7";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1e4FIOsbe8ylCmClGKt6dweZKBLFeBmPi0T9+seOjJM=";
+    hash = "sha256-y7NvPWfgxHi6pX+k7ciEOIfg9s/ELWd1MKNtdHKzLYo=";
   };
 
   nativeBuildInputs = [
@@ -60,6 +60,8 @@ buildPythonPackage rec {
     "test_rsyncignore"
     # flakey
     "test_internal_errors_propagate_to_controller"
+    # https://github.com/pytest-dev/pytest-xdist/issues/985
+    "test_workqueue_ordered_by_size"
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/python-modules/pytest-xprocess/default.nix b/pkgs/development/python-modules/pytest-xprocess/default.nix
index 734acd5f8f4e..601eaecd3e05 100644
--- a/pkgs/development/python-modules/pytest-xprocess/default.nix
+++ b/pkgs/development/python-modules/pytest-xprocess/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-xprocess";
-  version = "0.22.2";
+  version = "0.23.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-WZ7iW5OOjyWeGNnFtNY4SIT4pqKMpR7tMtDZUmvc93w=";
+    hash = "sha256-+NQEGiChwe8ZQwVOSj33rHtD5/KR9kD0PDTp3MSzTfo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index a00b59c425b7..67fb6989df01 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -5,18 +5,26 @@
 , fetchPypi
 , writeText
 
-# build
+# build-system
 , setuptools
 , setuptools-scm
 
-# propagates
+# dependencies
 , attrs
 , exceptiongroup
 , iniconfig
 , packaging
 , pluggy
-, py
 , tomli
+
+# optional-dependencies
+, argcomplete
+, hypothesis
+, mock
+, nose
+, pygments
+, requests
+, xmlschema
 }:
 
 buildPythonPackage rec {
@@ -40,16 +48,28 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    attrs
     iniconfig
     packaging
     pluggy
-    py
-    tomli
   ] ++ lib.optionals (pythonOlder "3.11") [
     exceptiongroup
+    tomli
   ];
 
+  passthru.optional-dependencies = {
+    testing = [
+      argcomplete
+      attrs
+      hypothesis
+      mock
+      nose
+      pygments
+      requests
+      setuptools
+      xmlschema
+    ];
+  };
+
   postInstall = ''
     mkdir $testout
     cp -R testing $testout/testing
diff --git a/pkgs/development/python-modules/pytest/tests.nix b/pkgs/development/python-modules/pytest/tests.nix
index 3fc078148b20..8bf8dafdf927 100644
--- a/pkgs/development/python-modules/pytest/tests.nix
+++ b/pkgs/development/python-modules/pytest/tests.nix
@@ -1,23 +1,19 @@
 { buildPythonPackage
 , isPyPy
 , pytest
-, hypothesis
-, pygments
 }:
 
 buildPythonPackage rec {
   pname = "pytest-tests";
   inherit (pytest) version;
+  format = "other";
 
   src = pytest.testout;
 
   dontBuild = true;
   dontInstall = true;
 
-  nativeCheckInputs = [
-    hypothesis
-    pygments
-  ];
+  nativeCheckInputs = pytest.optional-dependencies.testing;
 
   doCheck = !isPyPy; # https://github.com/pytest-dev/pytest/issues/3460
 
@@ -25,7 +21,7 @@ buildPythonPackage rec {
   # test_missing_required_plugins will emit deprecation warning which is treated as error
   checkPhase = ''
     runHook preCheck
-    ${pytest.out}/bin/py.test -x testing/ \
+    ${pytest.out}/bin/pytest -x testing/ \
       --ignore=testing/test_junitxml.py \
       --ignore=testing/test_argcomplete.py \
       -k "not test_collect_pyargs_with_testpaths and not test_missing_required_plugins"
diff --git a/pkgs/development/python-modules/python-arango/default.nix b/pkgs/development/python-modules/python-arango/default.nix
index 2949b8b7ea9d..d21408c2c678 100644
--- a/pkgs/development/python-modules/python-arango/default.nix
+++ b/pkgs/development/python-modules/python-arango/default.nix
@@ -32,7 +32,7 @@ in
 
 buildPythonPackage rec {
   pname = "python-arango";
-  version = "7.8.0";
+  version = "7.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -41,11 +41,9 @@ buildPythonPackage rec {
     owner = "ArangoDB-Community";
     repo = "python-arango";
     rev = "refs/tags/${version}";
-    hash = "sha256-lZ+9l1kPE/Piw1QLYW+qjFQmTtZd4m/kDOTOxkTsla0=";
+    hash = "sha256-R/59SMEVPZow9aG32gqQApuvB2zQLmPCxf/Mz70ubUU=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index b100ba2292c9..65a27c9b53cf 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "python-benedict";
-  version = "0.32.1";
+  version = "0.33.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "fabiocaccamo";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-q9EIOMmUcttL1ohxQD+SkZTxKv8PwdN29+ez2xB7rvM=";
+    hash = "sha256-SJBU7jMnyLBdWQPQ/UGbVklKUOrCM3fMnOkXKHQnyPI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-dbusmock/default.nix b/pkgs/development/python-modules/python-dbusmock/default.nix
index a987dc12e6bb..7d296d4be06d 100644
--- a/pkgs/development/python-modules/python-dbusmock/default.nix
+++ b/pkgs/development/python-modules/python-dbusmock/default.nix
@@ -30,8 +30,6 @@ in buildPythonPackage rec {
     hash = "sha256-sfvVLPTSTXjwyB0a2NyDIONv01FXZ40nHZwwo3oqI90=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/python-docx/default.nix b/pkgs/development/python-modules/python-docx/default.nix
index 79ba5c871a5f..37a10bdd542c 100644
--- a/pkgs/development/python-modules/python-docx/default.nix
+++ b/pkgs/development/python-modules/python-docx/default.nix
@@ -3,33 +3,55 @@
 , buildPythonPackage
 , fetchPypi
 , lxml
-, pytest
-, pyparsing
 , mock
+, pyparsing
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "python-docx";
-  version = "0.8.11";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1105d233a0956dd8dd1e710d20b159e2d72ac3c301041b95f4d4ceb3e0ebebc4";
+    hash = "sha256-WCm3IhQc8at5rt8MNNn+mSSyl2RYTA8hZOsrAtzfF8k=";
   };
 
-  nativeCheckInputs = [ behave mock pyparsing pytest ];
-  propagatedBuildInputs = [ lxml ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  checkPhase = ''
-    py.test tests
+  propagatedBuildInputs = [
+    lxml
+    typing-extensions
+  ];
+
+  nativeCheckInputs = [
+    behave
+    mock
+    pyparsing
+    pytestCheckHook
+  ];
+
+  postCheck = ''
     behave --format progress --stop --tags=-wip
   '';
 
-  meta = {
+  pythonImportsCheck = [
+    "docx"
+  ];
+
+  meta = with lib; {
     description = "Create and update Microsoft Word .docx files";
-    homepage = "https://python-docx.readthedocs.io/en/latest/";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.alexchapman ];
+    homepage = "https://python-docx.readthedocs.io/";
+    changelog = "https://github.com/python-openxml/python-docx/blob/v${version}/HISTORY.rst";
+    license = licenses.mit;
+    maintainers = with maintainers; [ alexchapman ];
   };
 }
diff --git a/pkgs/development/python-modules/python-engineio/default.nix b/pkgs/development/python-modules/python-engineio/default.nix
index 990cbd1be317..59cd210a0a04 100644
--- a/pkgs/development/python-modules/python-engineio/default.nix
+++ b/pkgs/development/python-modules/python-engineio/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , aiohttp
 , buildPythonPackage
+, setuptools
 , eventlet
 , fetchFromGitHub
 , iana-etc
@@ -17,8 +18,8 @@
 
 buildPythonPackage rec {
   pname = "python-engineio";
-  version = "4.7.1";
-  format = "setuptools";
+  version = "4.8.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -26,9 +27,13 @@ buildPythonPackage rec {
     owner = "miguelgrinberg";
     repo = "python-engineio";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jHXpPnrQlIpmQ2sY4y6AUx/6W8Pf+683s4NmmlwZO58=";
+    hash = "sha256-btXwx9GRLBcjtcGdgckb2Y/MxC0E/rKTWKgkP8olezo=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     simple-websocket
   ];
diff --git a/pkgs/development/python-modules/python-gitlab/default.nix b/pkgs/development/python-modules/python-gitlab/default.nix
index 0c0ded8af09f..9c708b735ce2 100644
--- a/pkgs/development/python-modules/python-gitlab/default.nix
+++ b/pkgs/development/python-modules/python-gitlab/default.nix
@@ -2,6 +2,11 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+
+# build-system
+, setuptools
+
+# dependencies
 , argcomplete
 , requests
 , requests-toolbelt
@@ -10,16 +15,20 @@
 
 buildPythonPackage rec {
   pname = "python-gitlab";
-  version = "3.15.0";
-  format = "setuptools";
+  version = "4.2.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yeZet2Eqn7uKvwM5ly7Kf9enPU2mbJtEb/5SiTCv9TQ=";
+    hash = "sha256-+HDXb5jJXQXEM5nXOx6qtZxnGzJ5ODDNL53fMsyTVB4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
     requests-toolbelt
diff --git a/pkgs/development/python-modules/python-izone/default.nix b/pkgs/development/python-modules/python-izone/default.nix
index 19dbbf733dc6..0173c277a526 100644
--- a/pkgs/development/python-modules/python-izone/default.nix
+++ b/pkgs/development/python-modules/python-izone/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     aiohttp
     netifaces
diff --git a/pkgs/development/python-modules/python-json-logger/default.nix b/pkgs/development/python-modules/python-json-logger/default.nix
index b9400a2239ae..0a02ccb688ad 100644
--- a/pkgs/development/python-modules/python-json-logger/default.nix
+++ b/pkgs/development/python-modules/python-json-logger/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
@@ -16,6 +17,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = lib.optionals (pythonAtLeast "3.12") [
+    # https://github.com/madzak/python-json-logger/issues/185
+    "test_custom_object_serialization"
+    "test_percentage_format"
+    "test_rename_reserved_attrs"
+  ];
+
   meta = with lib; {
     description = "Json Formatter for the standard python logger";
     homepage = "https://github.com/madzak/python-json-logger";
diff --git a/pkgs/development/python-modules/python-linux-procfs/default.nix b/pkgs/development/python-modules/python-linux-procfs/default.nix
index 2eacf7a0d69d..f6593574a7f2 100644
--- a/pkgs/development/python-modules/python-linux-procfs/default.nix
+++ b/pkgs/development/python-modules/python-linux-procfs/default.nix
@@ -1,14 +1,13 @@
-{ lib, buildPythonPackage, fetchgit, six }:
+{ lib, buildPythonPackage, fetchzip, six }:
 
 buildPythonPackage rec {
   pname = "python-linux-procfs";
   version = "0.6.3";
   format = "setuptools";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/libs/python/${pname}/${pname}.git";
-    rev = "v${version}";
-    hash = "sha256-PPgMlL9oj4HYUsr444ZrGo1LSZBl9hL5SE98IASUpbc=";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/libs/python/python-linux-procfs/python-linux-procfs.git/snapshot/python-linux-procfs-v${version}.tar.gz";
+    hash = "sha256-iaKL7CWJbIvvcUCah7bKdwKZoZJehbQpZ7n0liO8N64=";
   };
 
   propagatedBuildInputs = [ six ];
diff --git a/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix b/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix
index 27057d92ea12..040d901a7e73 100644
--- a/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix
+++ b/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-5WN/31e6WCgXVzevMuQbNjyo/2jjWDF+m48nrLKS+64=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace "--cov-report html --cov-report term --junitxml=pytest.xml --cov pylsp_jsonrpc --cov test" ""
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index 763154732943..96ba4c367033 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -53,8 +53,6 @@ buildPythonPackage rec {
       --replace "--cov pylsp --cov test" ""
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "autopep8"
     "flake8"
diff --git a/pkgs/development/python-modules/python-manilaclient/default.nix b/pkgs/development/python-modules/python-manilaclient/default.nix
index 60be5e80c8c7..3a6648373fb1 100644
--- a/pkgs/development/python-modules/python-manilaclient/default.nix
+++ b/pkgs/development/python-modules/python-manilaclient/default.nix
@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "python-manilaclient";
-  version = "4.6.0";
+  version = "4.7.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JFdpPX2lVSGN/jVsKMOOKrPm51fwpD476TnQo/0AYWQ=";
+    hash = "sha256-blkE+pLzZQ8BCHAmk6yNjzqbBAlK2ab1FySGFB/kN2c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-osc/default.nix b/pkgs/development/python-modules/python-osc/default.nix
index 86c5894d8178..b82549955bda 100644
--- a/pkgs/development/python-modules/python-osc/default.nix
+++ b/pkgs/development/python-modules/python-osc/default.nix
@@ -1,9 +1,12 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
-, pythonOlder
+
+# build-system
 , setuptools
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -11,8 +14,6 @@ buildPythonPackage rec {
   version = "1.8.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-pc4bpWyNgt9Ryz8pRrXdM6cFInkazEuFZOYtKyCtnKo=";
@@ -22,14 +23,14 @@ buildPythonPackage rec {
     setuptools
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
   pythonImportsCheck = [
     "pythonosc"
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   meta = with lib; {
     description = "Open Sound Control server and client in pure python";
     homepage = "https://github.com/attwad/python-osc";
diff --git a/pkgs/development/python-modules/python-pkcs11/default.nix b/pkgs/development/python-modules/python-pkcs11/default.nix
index 788ab4a35f91..260b26730728 100644
--- a/pkgs/development/python-modules/python-pkcs11/default.nix
+++ b/pkgs/development/python-modules/python-pkcs11/default.nix
@@ -19,8 +19,6 @@ buildPythonPackage rec {
     sha256 = "0kncbipfpsb7m7mhv5s5b9wk604h1j08i2j26fn90pklgqll0xhv";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     cython
     setuptools-scm
diff --git a/pkgs/development/python-modules/python-socketio/default.nix b/pkgs/development/python-modules/python-socketio/default.nix
index f046f7c81189..f8e189f4bd8c 100644
--- a/pkgs/development/python-modules/python-socketio/default.nix
+++ b/pkgs/development/python-modules/python-socketio/default.nix
@@ -1,31 +1,46 @@
 { lib
-, aiohttp
-, bidict
 , buildPythonPackage
 , fetchFromGitHub
-, mock
-, msgpack
-, pytestCheckHook
-, python-engineio
 , pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
+, bidict
+, python-engineio
+
+# optional-dependencies
+, aiohttp
 , requests
 , websocket-client
+
+# tests
+, msgpack
+, pytestCheckHook
+, simple-websocket
+, uvicorn
+
 }:
 
 buildPythonPackage rec {
   pname = "python-socketio";
-  version = "5.9.0";
-  format = "setuptools";
+  version = "5.10.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "miguelgrinberg";
     repo = "python-socketio";
-    rev = "v${version}";
-    hash = "sha256-1lyTZwkRpGRbeBqt6Thv5o+bUzkD1sC3T9T1GbWMEkI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-nlzTzIswMRjvJ9l9TOtVvRvbKlQPvNH0/P1NIbQCmy8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     bidict
     python-engineio
@@ -42,10 +57,11 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    mock
     msgpack
     pytestCheckHook
-  ];
+    uvicorn
+    simple-websocket
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "socketio"
diff --git a/pkgs/development/python-modules/python-socks/default.nix b/pkgs/development/python-modules/python-socks/default.nix
index c6b59b0ac985..77f694dbb249 100644
--- a/pkgs/development/python-modules/python-socks/default.nix
+++ b/pkgs/development/python-modules/python-socks/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "python-socks";
-  version = "2.4.2";
+  version = "2.4.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6.2";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "romis2012";
     repo = "python-socks";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HnZrnsxPmRJzrvJbKS5r+di+msykDwWS7TB5CitIve8=";
+    hash = "sha256-go8MH/ZW+W4aBOqscvcGim8KOW249sSCrmvCMLrQ5HU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-trovo/default.nix b/pkgs/development/python-modules/python-trovo/default.nix
index ae2b610ca3c7..b4e7194b842c 100644
--- a/pkgs/development/python-modules/python-trovo/default.nix
+++ b/pkgs/development/python-modules/python-trovo/default.nix
@@ -2,21 +2,26 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, poetry-core
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "python-trovo";
-  version = "0.1.6";
-  format = "setuptools";
+  version = "0.1.7";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-g1RDHSNGbGT1G2ej7A8WzyR17FaNPySfsAuKbHddmtQ=";
+    hash = "sha256-3EVSF4+nLvvM2RocNM2xz9Us5VrRRTCu/MWCcqwwikw=";
   };
 
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [ requests ];
 
   # No tests found
diff --git a/pkgs/development/python-modules/python-ulid/default.nix b/pkgs/development/python-modules/python-ulid/default.nix
index db1456dc3186..e70c1004ecf7 100644
--- a/pkgs/development/python-modules/python-ulid/default.nix
+++ b/pkgs/development/python-modules/python-ulid/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-d5jCPxWUOfw/OCtbA9Db9+s1D5DAdL+vbPR8zavgbbo=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-fancy-pypi-readme
     hatch-vcs
diff --git a/pkgs/development/python-modules/python-vagrant/default.nix b/pkgs/development/python-modules/python-vagrant/default.nix
index 61d780809db5..dcf29a4662d9 100644
--- a/pkgs/development/python-modules/python-vagrant/default.nix
+++ b/pkgs/development/python-modules/python-vagrant/default.nix
@@ -18,8 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-apvYzH0IY6ZyUP/FiOVbGN3dXejgN7gn7Mq2tlEaTww=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/python-xz/default.nix b/pkgs/development/python-modules/python-xz/default.nix
index b5a2ed4e21f9..a66ddd6ea857 100644
--- a/pkgs/development/python-modules/python-xz/default.nix
+++ b/pkgs/development/python-modules/python-xz/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "python-xz";
-  version = "0.4.0";
+  version = "0.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OYdGWTtwb6n6xZuMmI6rhgPh/iupGVERwLRSJ6OnfbM=";
+    hash = "sha256-oYjwQ26BFFXxvaYdzp2+bw/BQwM0v/n1r9DmaLs1R3Q=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/python3-saml/default.nix b/pkgs/development/python-modules/python3-saml/default.nix
index 7a5d8bccaa31..cca583157ef8 100644
--- a/pkgs/development/python-modules/python3-saml/default.nix
+++ b/pkgs/development/python-modules/python3-saml/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , freezegun
 , isodate
 , lxml
@@ -11,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "python3-saml";
-  version = "1.15.0";
+  version = "1.16.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,29 +19,9 @@ buildPythonPackage rec {
     owner = "onelogin";
     repo = "python3-saml";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xPPR2z3h8RpoAROpKpu9ZoDxGq5Stm9wQVt4Stj/6fg=";
+    hash = "sha256-KyDGmqhg/c29FaXPKK8rWKSBP6BOCpKKpOujCavXUcc=";
   };
 
-  patches = [
-    # skip tests with expired test data
-    # upstream issue: https://github.com/SAML-Toolkits/python3-saml/issues/373
-    (fetchpatch {
-      name = "test-expired.patch";
-      url = "https://github.com/SAML-Toolkits/python3-saml/commit/bd65578e5a21494c89320094c61c1c77250bea33.diff";
-      hash = "sha256-9Trew6R5JDjtc0NRGoklqMVDEI4IEqFOdK3ezyBU6gI=";
-    })
-    (fetchpatch {
-      name = "test-expired.patch";
-      url = "https://github.com/SAML-Toolkits/python3-saml/commit/ea3a6d4ee6ea0c5cfb0f698d8c0ed25638150f47.patch";
-      hash = "sha256-Q9+GM+mCEZK0QVp7ulH2hORVig2411OvkC4+o36DeXg=";
-    })
-    (fetchpatch {
-      name = "test-expired.patch";
-      url = "https://github.com/SAML-Toolkits/python3-saml/commit/feb0d1d954ee4d0ad1ad1d7d536bf9e83fa9431b.patch";
-      hash = "sha256-NURGI4FUnFlWRZfkioU9IYmZ+Zk9FKfZchjdn7N9abU=";
-    })
-  ];
-
   propagatedBuildInputs = [
     isodate
     lxml
diff --git a/pkgs/development/python-modules/pythonfinder/default.nix b/pkgs/development/python-modules/pythonfinder/default.nix
index 25e0484041a7..c9e0ca669c9a 100644
--- a/pkgs/development/python-modules/pythonfinder/default.nix
+++ b/pkgs/development/python-modules/pythonfinder/default.nix
@@ -3,6 +3,7 @@
 , cached-property
 , click
 , fetchFromGitHub
+, fetchpatch
 , packaging
 , pydantic
 , pytest-timeout
@@ -13,8 +14,8 @@
 
 buildPythonPackage rec {
   pname = "pythonfinder";
-  version = "2.0.5";
-  format = "pyproject";
+  version = "2.0.6";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -22,11 +23,20 @@ buildPythonPackage rec {
     owner = "sarugaku";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-L/+6w5lLqHO5c9CThoUPOHXRPVxBlOWFDAmfoYxRw5g=";
+    hash = "sha256-C/Em8Vmv7q030hmH3jU/apBRSSC9QFK9mbBWjBjJHXg=";
   };
 
+  patches = [
+    # https://github.com/sarugaku/pythonfinder/issues/142
+    (fetchpatch {
+      name = "pydantic_2-compatibility.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/python-pythonfinder/-/raw/2.0.6-1/python-pythonfinder-2.0.6-pydantic2.patch";
+      hash = "sha256-mON1MeA+pj6VTB3zpBjF3LfB30wG0QH9nU4bD1djWwg=";
+    })
+  ];
+
   postPatch = ''
-    substituteInPlace setup.cfg \
+    substituteInPlace pyproject.toml \
       --replace " --cov" ""
   '';
 
@@ -35,9 +45,10 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    cached-property
     packaging
     pydantic
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    cached-property
   ];
 
   passthru.optional-dependencies = {
diff --git a/pkgs/development/python-modules/pythran/default.nix b/pkgs/development/python-modules/pythran/default.nix
index 2c4095b532f5..047a4ea1af07 100644
--- a/pkgs/development/python-modules/pythran/default.nix
+++ b/pkgs/development/python-modules/pythran/default.nix
@@ -2,14 +2,22 @@
 , python
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
+, isPy3k
+, substituteAll
+
+# build-system
+, setuptools
+
+# native dependencies
 , openmp
+, xsimd
+
+# dependencies
 , ply
 , gast
 , numpy
 , beniget
-, xsimd
-, isPy3k
-, substituteAll
 }:
 
 let
@@ -17,14 +25,14 @@ let
 
 in buildPythonPackage rec {
   pname = "pythran";
-  version = "0.13.1";
-  format = "setuptools";
+  version = "0.14.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "serge-sans-paille";
     repo = "pythran";
     rev = version;
-    hash = "sha256-baDrReJgQXbaKA8KNhHiFjr0X34yb8WK/nUJmiM9EZs=";
+    hash = "sha256-in0ty0aBAIx7Is13hjiHZGS8eKbhxb6TL3bENzfx5vQ=";
   };
 
   patches = [
@@ -33,6 +41,11 @@ in buildPythonPackage rec {
       src = ./0001-hardcode-path-to-libgomp.patch;
       gomp = "${if stdenv.cc.isClang then openmp else stdenv.cc.cc.lib}/lib/libgomp${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
+    (fetchpatch {
+      # Python 3.12 support
+      url = "https://github.com/serge-sans-paille/pythran/commit/258ab9aaf26172f669eab1bf2a346b5f65db3ac0.patch";
+      hash = "sha256-T+FLptDYIgzHBSXShULqHr/G8ttBFamq1M5JlB2HxDM=";
+    })
   ];
 
   # xsimd: unvendor this header-only C++ lib
@@ -41,11 +54,16 @@ in buildPythonPackage rec {
     ln -s '${lib.getDev xsimd}'/include/xsimd third_party/
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     ply
     gast
     numpy
     beniget
+    setuptools
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
index 69f33db742a6..fad1ff1d13fd 100644
--- a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
+++ b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
@@ -1,6 +1,7 @@
 { buildPythonPackage
 , fetchFromGitHub
 , lib
+, setuptools
 , numpy
 , onnx
 , packaging
@@ -13,16 +14,20 @@
 
 buildPythonPackage rec {
   pname = "pytorch-pfn-extras";
-  version = "0.7.2";
-  format = "setuptools";
+  version = "0.7.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pfnet";
-    repo = pname;
+    repo = "pytorch-pfn-extras";
     rev = "refs/tags/v${version}";
-    hash = "sha256-juoLw/qfq4YF7opyR7cTYCVzUa9pXVvQnvGntcQhBr4=";
+    hash = "sha256-X7N2RQS8he9FJPfEjPJH6GdxkAPV6uxOIfRVOnJId0U=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ numpy packaging torch typing-extensions ];
 
   nativeCheckInputs = [ onnx pytestCheckHook torchvision ];
diff --git a/pkgs/development/python-modules/pytradfri/default.nix b/pkgs/development/python-modules/pytradfri/default.nix
index 83ab0a9879f3..b4de887f5455 100644
--- a/pkgs/development/python-modules/pytradfri/default.nix
+++ b/pkgs/development/python-modules/pytradfri/default.nix
@@ -48,5 +48,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/home-assistant-libs/pytradfri/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
+    # https://github.com/home-assistant-libs/pytradfri/issues/720
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/pyu2f/default.nix b/pkgs/development/python-modules/pyu2f/default.nix
index 609d8bfcebae..ef09f1285183 100644
--- a/pkgs/development/python-modules/pyu2f/default.nix
+++ b/pkgs/development/python-modules/pyu2f/default.nix
@@ -24,6 +24,24 @@ buildPythonPackage rec {
     six
   ];
 
+  postPatch = ''
+    for path in \
+      customauthenticator_test.py \
+      hardware_test.py \
+      hidtransport_test.py \
+      localauthenticator_test.py \
+      model_test.py \
+      u2f_test.py \
+      util_test.py \
+      hid/macos_test.py; \
+    do
+      # https://docs.python.org/3/whatsnew/3.12.html#id3
+      substituteInPlace pyu2f/tests/$path \
+        --replace "assertEquals" "assertEqual" \
+        --replace "assertRaisesRegexp" "assertRaisesRegex"
+    done
+  '';
+
   nativeCheckInputs = [
     mock
     pyfakefs
diff --git a/pkgs/development/python-modules/pyvicare/default.nix b/pkgs/development/python-modules/pyvicare/default.nix
index 0fa3895caa58..56f74a93b21e 100644
--- a/pkgs/development/python-modules/pyvicare/default.nix
+++ b/pkgs/development/python-modules/pyvicare/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-qK5JCaCL+gbgNcBo5IjhlRrXD1IhA1B56hmcjvPie6Y=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.py \
       --replace "version_config=True," 'version="${version}",' \
diff --git a/pkgs/development/python-modules/pyvisa-py/default.nix b/pkgs/development/python-modules/pyvisa-py/default.nix
index 626d87b796ae..58d538ec98ad 100644
--- a/pkgs/development/python-modules/pyvisa-py/default.nix
+++ b/pkgs/development/python-modules/pyvisa-py/default.nix
@@ -51,8 +51,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   meta = with lib; {
     description = "Module that implements the Virtual Instrument Software Architecture";
     homepage = "https://github.com/pyvisa/pyvisa-py";
diff --git a/pkgs/development/python-modules/pyvisa-sim/default.nix b/pkgs/development/python-modules/pyvisa-sim/default.nix
index 55d6ff6b5db6..9fcce19d6a20 100644
--- a/pkgs/development/python-modules/pyvisa-sim/default.nix
+++ b/pkgs/development/python-modules/pyvisa-sim/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pyvisa-sim";
-  version = "0.5.1";
+  version = "0.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyVISA-sim";
     inherit version;
-    hash = "sha256-vWxW941/1e58pqL/Rzq+eoZJpwsvLphgIe48SuJtohY=";
+    hash = "sha256-kHahaRKoEUtDxEsdMolPwfEy1DidiytxmvYiQeQhYcE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvisa/default.nix b/pkgs/development/python-modules/pyvisa/default.nix
index a104726ac803..3d017f8ad2e5 100644
--- a/pkgs/development/python-modules/pyvisa/default.nix
+++ b/pkgs/development/python-modules/pyvisa/default.nix
@@ -10,8 +10,8 @@
 
 buildPythonPackage rec {
   pname = "pyvisa";
-  version = "1.13.0";
-  format = "setuptools";
+  version = "1.14.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -19,16 +19,16 @@ buildPythonPackage rec {
     owner = "pyvisa";
     repo = "pyvisa";
     rev = "refs/tags/${version}";
-    hash = "sha256-TBu3Xko0IxFBT2vzrsOxqEG3y4XfPzISEtbkWkIaCvM=";
+    hash = "sha256-GKrgUK2nSZi+8oJoS45MjpU9+INEgcla9Kaw6ceNVp0=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
   propagatedBuildInputs = [
     typing-extensions
-    setuptools
   ];
 
   nativeCheckInputs = [
@@ -40,10 +40,6 @@ buildPythonPackage rec {
     "test_visa_info"
   ];
 
-  postConfigure = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="v${version}"
-  '';
-
   meta = with lib; {
     description = "Python package for support of the Virtual Instrument Software Architecture (VISA)";
     homepage = "https://github.com/pyvisa/pyvisa";
diff --git a/pkgs/development/python-modules/pyvo/default.nix b/pkgs/development/python-modules/pyvo/default.nix
index e16505006c47..c2058a374a31 100644
--- a/pkgs/development/python-modules/pyvo/default.nix
+++ b/pkgs/development/python-modules/pyvo/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-heTWWyxmRaDlI9NHzZab5OLOBIbVdb45v67Rq5ckzc8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/pywebview/default.nix b/pkgs/development/python-modules/pywebview/default.nix
index 9db835f1d547..93b881435cb5 100644
--- a/pkgs/development/python-modules/pywebview/default.nix
+++ b/pkgs/development/python-modules/pywebview/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pywebview";
-  version = "4.3.3";
+  version = "4.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.5";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "r0x0r";
     repo = "pywebview";
     rev = "refs/tags/${version}";
-    hash = "sha256-8BkbO7C8cYDIQWWCKaXFjfD45L5KVG1tDZJl+uW5g9g=";
+    hash = "sha256-uanv6v/xwi4COY0WjoyxG4khK1kAucBmpr/plCKYxkQ=";
   };
 
   nativeBuildInputs = [
@@ -50,8 +50,6 @@ buildPythonPackage rec {
     xvfb-run
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   checkPhase = ''
     # Cannot create directory /homeless-shelter/.... Error: FILE_ERROR_ACCESS_DENIED
     export HOME=$TMPDIR
diff --git a/pkgs/development/python-modules/pyyaml-include/default.nix b/pkgs/development/python-modules/pyyaml-include/default.nix
index 176d402e99c1..3b5b9faeec9e 100644
--- a/pkgs/development/python-modules/pyyaml-include/default.nix
+++ b/pkgs/development/python-modules/pyyaml-include/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-xsNMIEBYqMVQp+H8R7XpFCwROXA8I6bFvAuHrRvC+DI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/pyzmq/default.nix b/pkgs/development/python-modules/pyzmq/default.nix
index 88fbf7d63c05..442577fcc5e3 100644
--- a/pkgs/development/python-modules/pyzmq/default.nix
+++ b/pkgs/development/python-modules/pyzmq/default.nix
@@ -1,6 +1,17 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, isPyPy
+
+# build-system
+, cython_3
+, setuptools
+, setuptools-scm
+, packaging
+, cffi
+
+# dependencies
+
 , py
 , pytestCheckHook
 , python
@@ -13,7 +24,7 @@
 buildPythonPackage rec {
   pname = "pyzmq";
   version = "25.1.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -22,12 +33,22 @@ buildPythonPackage rec {
     hash = "sha256-JZwiSFtxq6zfqL95cgzXvPS50SizDqVU8BrnH9v9qiM=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    packaging
+  ] ++ (if isPyPy then [
+    cffi
+  ] else [
+    cython_3
+  ]);
+
   buildInputs = [
     zeromq
   ];
 
-  propagatedBuildInputs = [
-    py
+  propagatedBuildInputs = lib.optionals isPyPy [
+    cffi
   ];
 
   nativeCheckInputs = [
@@ -45,6 +66,7 @@ buildPythonPackage rec {
     # pytest.ini is missing in pypi's sdist
     # https://github.com/zeromq/pyzmq/issues/1853#issuecomment-1592731986
     "--asyncio-mode auto"
+    "--ignore=$out/lib/python3.12/site-packages/zmq/tests/test_mypy.py"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/qasync/default.nix b/pkgs/development/python-modules/qasync/default.nix
index 182e1b209df4..d8eb5b4c7c69 100644
--- a/pkgs/development/python-modules/qasync/default.nix
+++ b/pkgs/development/python-modules/qasync/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "qasync";
-  version = "0.27.0";
+  version = "0.27.1";
 
   format = "pyproject";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "CabbageDevelopment";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kU8QgcBZSzQQO3V4zKaIBuodUCQS4CLHOH7qHYU8ja0=";
+    hash = "sha256-oXzwilhJ1PhodQpOZjnV9gFuoDy/zXWva9LhhK3T00g=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/qbittorrent-api/default.nix b/pkgs/development/python-modules/qbittorrent-api/default.nix
index 16ad74dd2469..d7b733f83322 100644
--- a/pkgs/development/python-modules/qbittorrent-api/default.nix
+++ b/pkgs/development/python-modules/qbittorrent-api/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "qbittorrent-api";
-  version = "2023.10.54";
+  version = "2023.11.57";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xCHB/pPURc1+vje6IhBHZ6HogUsmYfBE9977Qtwoc2w=";
+    hash = "sha256-fmFJW4PDQc7szu0ymE+fV9k6wUDLRHkOriEHDnzDSQg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qcodes/default.nix b/pkgs/development/python-modules/qcodes/default.nix
index 7db5c72f80c5..779e7b390b21 100644
--- a/pkgs/development/python-modules/qcodes/default.nix
+++ b/pkgs/development/python-modules/qcodes/default.nix
@@ -48,7 +48,7 @@
 
 buildPythonPackage rec {
   pname = "qcodes";
-  version = "0.42.0";
+  version = "0.42.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -57,7 +57,7 @@ buildPythonPackage rec {
     owner = "QCoDeS";
     repo = "Qcodes";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+NtPE9mQKWftk3vR5WFZgM+7jl8HWr9MxVA+VpbuHvE=";
+    hash = "sha256-oNQLIL5L3gtFS6yxqgLDI1s4s9UYqxGc8ASqHuZv6Rk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/qiskit-aer/default.nix b/pkgs/development/python-modules/qiskit-aer/default.nix
index ecd8905583e2..c8c6883342f6 100644
--- a/pkgs/development/python-modules/qiskit-aer/default.nix
+++ b/pkgs/development/python-modules/qiskit-aer/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "qiskit-aer";
-  version = "0.12.2";
+  version = "0.13.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit-aer";
     rev = "refs/tags/${version}";
-    hash = "sha256-K8Avh1j9j5CGdEYIeJJRF+PjUFXvVILkZLqX1QClInE=";
+    hash = "sha256-GxQgqCUDwalgM9m+XeRiZCRL93KrCSUPoLvDgHJJGCQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/qiskit-finance/default.nix b/pkgs/development/python-modules/qiskit-finance/default.nix
index 559ed8f69bbe..115a3dd9e5fc 100644
--- a/pkgs/development/python-modules/qiskit-finance/default.nix
+++ b/pkgs/development/python-modules/qiskit-finance/default.nix
@@ -2,6 +2,10 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
   # Python Inputs
 , fastdtw
 , numpy
@@ -22,8 +26,8 @@
 
 buildPythonPackage rec {
   pname = "qiskit-finance";
-  version = "0.3.4";
-  format = "setuptools";
+  version = "0.4.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -31,13 +35,17 @@ buildPythonPackage rec {
     owner = "qiskit";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Ijoqn6nANLsEVKA5nycd1xbW5htJ+TQm6LkiMUWTsSs=";
+    hash = "sha256-V0o3U2Tn8OXTe2n84tqAhQql4sQ3UBZ8bLNt8S9Iz9w=";
   };
 
   postPatch = ''
     substituteInPlace requirements.txt --replace "pandas<1.4.0" "pandas"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     fastdtw
     numpy
diff --git a/pkgs/development/python-modules/qiskit-machine-learning/default.nix b/pkgs/development/python-modules/qiskit-machine-learning/default.nix
index da26fa3a2731..16ed373894e9 100644
--- a/pkgs/development/python-modules/qiskit-machine-learning/default.nix
+++ b/pkgs/development/python-modules/qiskit-machine-learning/default.nix
@@ -1,9 +1,11 @@
 { lib
 , pythonOlder
-, pythonAtLeast
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
+
+# build-system
+, setuptools
+
   # Python Inputs
 , fastdtw
 , numpy
@@ -21,8 +23,8 @@
 
 buildPythonPackage rec {
   pname = "qiskit-machine-learning";
-  version = "0.6.1";
-  format = "setuptools";
+  version = "0.7.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -30,9 +32,13 @@ buildPythonPackage rec {
     owner = "qiskit";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-oSLQvZGEq/nBj7ktDEq3BMk7xyYiLGpBDmKxuXtMTfs=";
+    hash = "sha256-qTHacEUTp0RY2piplE6XoYKpJyeFswTPBvjfQ9Gvwt0=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     fastdtw
     numpy
diff --git a/pkgs/development/python-modules/qiskit-nature/default.nix b/pkgs/development/python-modules/qiskit-nature/default.nix
index b9083bdcd51f..660762f2d2fd 100644
--- a/pkgs/development/python-modules/qiskit-nature/default.nix
+++ b/pkgs/development/python-modules/qiskit-nature/default.nix
@@ -2,6 +2,10 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
   # Python Inputs
 , h5py
 , numpy
@@ -21,8 +25,8 @@
 
 buildPythonPackage rec {
   pname = "qiskit-nature";
-  version = "0.6.2";
-  format = "setuptools";
+  version = "0.7.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -30,9 +34,13 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-X/4jA/e2nmmaVEiCgd/4KJc/sAdcYDkyKzvyVztovXM=";
+    hash = "sha256-RspjHEFYdu1k6azmifbpd57tH+SxPeepw5EQzWP/Yc8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     h5py
     numpy
diff --git a/pkgs/development/python-modules/qiskit-optimization/default.nix b/pkgs/development/python-modules/qiskit-optimization/default.nix
index bd3d8251f10a..f377a2b9caba 100644
--- a/pkgs/development/python-modules/qiskit-optimization/default.nix
+++ b/pkgs/development/python-modules/qiskit-optimization/default.nix
@@ -2,6 +2,10 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
   # Python Inputs
 , decorator
 , docplex
@@ -18,8 +22,8 @@
 
 buildPythonPackage rec {
   pname = "qiskit-optimization";
-  version = "0.5.0";
-  format = "setuptools";
+  version = "0.6.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -27,13 +31,17 @@ buildPythonPackage rec {
     owner = "qiskit";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-N4mf5ins0x+yUAIq+yyjSnUrHcaEhH/Jpid/QMhIjE0=";
+    hash = "sha256-vVSFvLVjptSgGocGR6i1Fp0BSRaT3uBBxf0OrFaF9EQ=";
   };
 
   postPatch = ''
     substituteInPlace requirements.txt --replace "networkx>=2.2,<2.6" "networkx"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     docplex
     decorator
diff --git a/pkgs/development/python-modules/qiskit/default.nix b/pkgs/development/python-modules/qiskit/default.nix
index 13d70a2d472a..b7c0a2677bf6 100644
--- a/pkgs/development/python-modules/qiskit/default.nix
+++ b/pkgs/development/python-modules/qiskit/default.nix
@@ -2,6 +2,10 @@
 , pythonOlder
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
   # Python Inputs
 , qiskit-aer
 , qiskit-ibmq-provider
@@ -28,8 +32,8 @@ in
 buildPythonPackage rec {
   pname = "qiskit";
   # NOTE: This version denotes a specific set of subpackages. See https://qiskit.org/documentation/release_notes.html#version-history
-  version = "0.41.1";
-  format = "setuptools";
+  version = "0.45.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -37,9 +41,13 @@ buildPythonPackage rec {
     owner = "Qiskit";
     repo = "qiskit";
     rev = "refs/tags/${version}";
-    hash = "sha256-ICJJvbekvpaBMnSf+NHbTiarb+Ye3NtktcRYAq8KaCs=";
+    hash = "sha256-XAAQc6oX9zy9MFze1UQbalUBfhbkY5u/0xOmc5J66kM=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     qiskit-aer
     qiskit-ibmq-provider
diff --git a/pkgs/development/python-modules/qmk-dotty-dict/default.nix b/pkgs/development/python-modules/qmk-dotty-dict/default.nix
index 8b7a7b553699..39b7fe21b88c 100644
--- a/pkgs/development/python-modules/qmk-dotty-dict/default.nix
+++ b/pkgs/development/python-modules/qmk-dotty-dict/default.nix
@@ -1,15 +1,24 @@
-{ buildPythonPackage, fetchPypi, lib, setuptools-scm }:
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, poetry-core
+}:
 
 buildPythonPackage rec {
   pname = "qmk_dotty_dict";
-  version = "1.3.0.post1";
+  version = "1.3.1";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-O2EeOTZgv6poNcaOlHhLroD+B7hJCXi17KsDoNL8fqI=";
+  src = fetchFromGitHub  {
+    owner = "pawelzny";
+    repo = "dotty_dict";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kY7o9wgfsV7oc5twOeuhG47C0Js6JzCt02S9Sd8dSGc=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/qtconsole/default.nix b/pkgs/development/python-modules/qtconsole/default.nix
index a49b63eaeb15..101239257853 100644
--- a/pkgs/development/python-modules/qtconsole/default.nix
+++ b/pkgs/development/python-modules/qtconsole/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "qtconsole";
-  version = "5.4.4";
+  version = "5.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-t/+1PXTyPO4p9M21Xdb6vI7DEtlPPEa6OOHd5FhpPfs=";
+    hash = "sha256-oOgGxpUduUkGKOTfgMrslmm2UUnHukD5vwM8AlpbVrw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qtile-extras/default.nix b/pkgs/development/python-modules/qtile-extras/default.nix
index 9555ef07c36a..aa6eed8ec573 100644
--- a/pkgs/development/python-modules/qtile-extras/default.nix
+++ b/pkgs/development/python-modules/qtile-extras/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-WI1z8vrbZiJw6fDHK27mKA+1FyZEQTMttIDNzSIX+PU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/qtile/default.nix b/pkgs/development/python-modules/qtile/default.nix
index 15806119cb78..ef1df14b2184 100644
--- a/pkgs/development/python-modules/qtile/default.nix
+++ b/pkgs/development/python-modules/qtile/default.nix
@@ -58,8 +58,6 @@ buildPythonPackage rec {
         --replace /usr/include/libdrm ${lib.getDev libdrm}/include/libdrm
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     pkg-config
     setuptools
diff --git a/pkgs/development/python-modules/quaternion/default.nix b/pkgs/development/python-modules/quaternion/default.nix
index ad53a085d327..4b7eef5c5ab2 100644
--- a/pkgs/development/python-modules/quaternion/default.nix
+++ b/pkgs/development/python-modules/quaternion/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "quaternion";
-  version = "2022.4.3";
+  version = "2022.4.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "moble";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-iLjVQ6eGwpLQXi8Sr5ShJdXMqYNclGEuq/oxR4ExDLA=";
+    hash = "sha256-fgyi50purfqUIe7zuz/52K6Sw3TjuvAX0EnzkXD//B4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/questionary/default.nix b/pkgs/development/python-modules/questionary/default.nix
index 6f9b0488c5d2..98a50c6079ca 100644
--- a/pkgs/development/python-modules/questionary/default.nix
+++ b/pkgs/development/python-modules/questionary/default.nix
@@ -6,6 +6,7 @@
 , prompt-toolkit
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -24,6 +25,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "prompt_toolkit"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/raincloudy/default.nix b/pkgs/development/python-modules/raincloudy/default.nix
index 6a223bb4fb76..3a247bc6a81e 100644
--- a/pkgs/development/python-modules/raincloudy/default.nix
+++ b/pkgs/development/python-modules/raincloudy/default.nix
@@ -35,8 +35,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     # https://github.com/vanstinator/raincloudy/pull/60
     substituteInPlace setup.py \
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 6bde7864d2af..97f2a09e55e2 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -30,6 +30,11 @@ buildPythonPackage rec {
     hash = "sha256-D7Z0xKqAJAPKSAEK+3Mpz/LaEKqKYczp+m6SqfzufwA=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "Cython==3.0.3" "Cython"
+  '';
+
   nativeBuildInputs = [
     cmake
     cython_3
diff --git a/pkgs/development/python-modules/rasterio/default.nix b/pkgs/development/python-modules/rasterio/default.nix
index 0e216ce18508..e9e611cb19bc 100644
--- a/pkgs/development/python-modules/rasterio/default.nix
+++ b/pkgs/development/python-modules/rasterio/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "rasterio";
-  version = "1.3.9";
+  version = "4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -38,8 +38,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "rasterio";
     repo = "rasterio";
-    rev = "refs/tags/${version}";
-    hash = "sha256-Tp6BSU33FaszrIXQgU0Asb7IMue0C939o/atAKz+3Q4=";
+    rev = "refs/tags/release-test-${version}";
+    hash = "sha256-YO0FnmIEt+88f6k2mdXDSQg7UKq1Swr8wqVUGdRyQR4=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/rdflib/default.nix b/pkgs/development/python-modules/rdflib/default.nix
index 471439b28e5c..04f5206b96a5 100644
--- a/pkgs/development/python-modules/rdflib/default.nix
+++ b/pkgs/development/python-modules/rdflib/default.nix
@@ -24,6 +24,7 @@
 , pip
 , pytest-cov
 , pytestCheckHook
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -67,6 +68,7 @@ buildPythonPackage rec {
     pip
     pytest-cov
     pytestCheckHook
+    setuptools
   ]
   ++ passthru.optional-dependencies.networkx
   ++ passthru.optional-dependencies.html;
diff --git a/pkgs/development/python-modules/readchar/default.nix b/pkgs/development/python-modules/readchar/default.nix
index 8517bb34654f..aab318a38178 100644
--- a/pkgs/development/python-modules/readchar/default.nix
+++ b/pkgs/development/python-modules/readchar/default.nix
@@ -2,6 +2,9 @@
 , buildPythonPackage
 , fetchFromGitHub
 
+# build-system
+, setuptools
+
 # tests
 , pytestCheckHook
 , pexpect
@@ -10,7 +13,7 @@
 buildPythonPackage rec {
   pname = "readchar";
   version = "4.0.5";
-  format = "setuptools";
+  pyproject = true;
 
   # Don't use wheels on PyPI
   src = fetchFromGitHub {
@@ -22,13 +25,18 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "--cov=readchar" ""
+      --replace "--cov=readchar" "" \
+      --replace "attr: readchar.__version__" "${version}"
     # run Linux tests on Darwin as well
     # see https://github.com/magmax/python-readchar/pull/99 for why this is not upstreamed
     substituteInPlace tests/linux/conftest.py \
       --replace 'sys.platform.startswith("linux")' 'sys.platform.startswith(("darwin", "linux"))'
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   pythonImportsCheck = [ "readchar" ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix b/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
index 0ce923663f88..3490b6a914b9 100644
--- a/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
+++ b/pkgs/development/python-modules/readthedocs-sphinx-ext/default.nix
@@ -1,29 +1,36 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , requests
-, pytest
+, pytestCheckHook
 , mock
 , sphinx
 }:
 
 buildPythonPackage rec {
   pname = "readthedocs-sphinx-ext";
-  version = "2.2.2";
-  format = "setuptools";
+  version = "2.2.3";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kiF77xTZE3e88nvffaNj5XSzseQYC2Xu9ufPpV8P0Lg=";
+    hash = "sha256-ZYPCZ5GlhT7p5Xzp24ZOL7BoCLpHD4BddNU/xQgR4BI=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  nativeCheckInputs = [ pytest mock sphinx ];
+  propagatedBuildInputs = [
+    requests
+  ];
 
-  checkPhase = ''
-    py.test
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+    mock
+    sphinx
+  ];
 
   meta = with lib; {
     description = "Sphinx extension for Read the Docs overrides";
diff --git a/pkgs/development/python-modules/recipe-scrapers/default.nix b/pkgs/development/python-modules/recipe-scrapers/default.nix
index c5b7fcb88b76..b9f29be757fe 100644
--- a/pkgs/development/python-modules/recipe-scrapers/default.nix
+++ b/pkgs/development/python-modules/recipe-scrapers/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "recipe-scrapers";
-  version = "14.46.0";
+  version = "14.52.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "hhursev";
     repo = "recipe-scrapers";
     rev = "refs/tags/${version}";
-    hash = "sha256-XCcunwqmcvPC5AVxR9mit06BRDTYfu/CeTXg3IH7Dy0=";
+    hash = "sha256-VdJZnwo+DwVDZuuuqk0X26CXs7ZrUFXqC8qEYaX74Zc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 2616e1da9f4d..d987092e48f0 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "redis";
-  version = "5.0.0";
+  version = "5.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XOpsDTNcmnMypGDthynOq7TQxInHKFsKhtu/igF70SA=";
+    hash = "sha256-DatJXNV1MGnTvGUKDd6Kj57d4W/FaRtomlZu2lgQDQ8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/redshift-connector/default.nix b/pkgs/development/python-modules/redshift-connector/default.nix
index 4bd4b3c14619..f0845e50d519 100644
--- a/pkgs/development/python-modules/redshift-connector/default.nix
+++ b/pkgs/development/python-modules/redshift-connector/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "redshift-connector";
-  version = "2.0.914";
+  version = "2.0.917";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "amazon-redshift-python-driver";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fGOo9FgVMI6ayyB3EMN6RGThwWciShcBZzWTZWtOt8E=";
+    hash = "sha256-Qrh6ruB/e7ZeZ33fD9VmtAX+I6OUL5I/zjRv9oh1bO0=";
   };
 
   # remove addops as they add test directory and coverage parameters to pytest
diff --git a/pkgs/development/python-modules/referencing/default.nix b/pkgs/development/python-modules/referencing/default.nix
index dc09aa3594a4..8de065b054f2 100644
--- a/pkgs/development/python-modules/referencing/default.nix
+++ b/pkgs/development/python-modules/referencing/default.nix
@@ -15,7 +15,7 @@
 let
   self = buildPythonPackage rec {
     pname = "referencing";
-    version = "0.30.2";
+    version = "0.31.1";
     format = "pyproject";
 
     disabled = pythonOlder "3.7";
@@ -25,11 +25,9 @@ let
       repo = "referencing";
       rev = "refs/tags/v${version}";
       fetchSubmodules = true;
-      hash = "sha256-C2gKjoaMcUWz/QOsqpv4TkozQyI+zEIQf3GMf5w40aw=";
+      hash = "sha256-6Kol8TdOxImRq0aff+aAR/jbDrkHX/EPrIv1ZEMRWZU=";
     };
 
-    SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
     nativeBuildInputs = [
       hatch-vcs
       hatchling
diff --git a/pkgs/development/python-modules/regenmaschine/default.nix b/pkgs/development/python-modules/regenmaschine/default.nix
index 2b702284be7d..e3fb2889470e 100644
--- a/pkgs/development/python-modules/regenmaschine/default.nix
+++ b/pkgs/development/python-modules/regenmaschine/default.nix
@@ -2,6 +2,7 @@
 , aiohttp
 , aresponses
 , buildPythonPackage
+, certifi
 , fetchFromGitHub
 , poetry-core
 , pytest-aiohttp
@@ -32,6 +33,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
+    certifi
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix
index 2df8bf922ea7..66bb26fb6007 100644
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "regex";
-  version = "2023.8.8";
+  version = "2023.10.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/L3F8rDxzQ9qVs20b+QdLM4eZE47aIMvPu68X7D3cS4=";
+    hash = "sha256-P+9PhE0ikO4LpXrdzsF+7J499z8QonSEhd/Wo6GIzA8=";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/regress/default.nix b/pkgs/development/python-modules/regress/default.nix
new file mode 100644
index 000000000000..4526c735a189
--- /dev/null
+++ b/pkgs/development/python-modules/regress/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, rustPlatform
+}:
+
+buildPythonPackage rec {
+  pname = "regress";
+  version = "0.4.5";
+
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-tCrFBjkK6obzaYkYiJ3WQ5yi3KkC86/cbXCSnRRGZu8=";
+  };
+
+  nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-wHObfXWgcbSYxk5d17s44+1qIGYD/Ygefxp+el0fsEc=";
+  };
+
+  meta = with lib; {
+    description = "Python bindings to the Rust regress crate, exposing ECMA regular expressions.";
+    homepage = "https://github.com/Julian/regress";
+    license = licenses.mit;
+    maintainers = [ maintainers.matthiasbeyer ];
+  };
+}
diff --git a/pkgs/development/python-modules/reportlab/default.nix b/pkgs/development/python-modules/reportlab/default.nix
index 664d87040c45..af73624d1ae6 100644
--- a/pkgs/development/python-modules/reportlab/default.nix
+++ b/pkgs/development/python-modules/reportlab/default.nix
@@ -13,7 +13,7 @@ let
   ft = freetype.overrideAttrs (oldArgs: { dontDisableStatic = true; });
 in buildPythonPackage rec {
   pname = "reportlab";
-  version = "4.0.4";
+  version = "4.0.7";
   format = "pyproject";
 
   # See https://bitbucket.org/pypy/compatibility/wiki/reportlab%20toolkit
@@ -21,7 +21,7 @@ in buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f3CztWr/XxHLQTbFGg9aVv5uTI+7rHuQMHbbmajvMcE=";
+    hash = "sha256-lnx38A79kYzCMc+LbY9OR33Jc7XBZVfjvRjfrrWnAjQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/reproject/default.nix b/pkgs/development/python-modules/reproject/default.nix
index 81ab320c77f9..488a045211a1 100644
--- a/pkgs/development/python-modules/reproject/default.nix
+++ b/pkgs/development/python-modules/reproject/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "reproject";
-  version = "0.12.0";
+  version = "0.13.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jb4efKT5jMY0ECV+ab5rpUHEk+tT4T2MioCRxs92TbI=";
+    hash = "sha256-lL6MkKVSWmV6KPkG/9fjc2c2dFQ14i9fiJAr3VFfcuI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/requests-cache/default.nix b/pkgs/development/python-modules/requests-cache/default.nix
index d04f25ae0e01..f3ec2c4123a8 100644
--- a/pkgs/development/python-modules/requests-cache/default.nix
+++ b/pkgs/development/python-modules/requests-cache/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "requests-cache";
-  version = "1.1.0";
+  version = "1.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "requests-cache";
     repo = "requests-cache";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kJqy7aK67JFtmsrwMtze/wTM9qch9YYj2eUzGJRJreQ=";
+    hash = "sha256-0KBx6nplD/l8GZfMbyUtgHj2e4/vH9EAgdyNFm+kPyM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/requests-http-signature/default.nix b/pkgs/development/python-modules/requests-http-signature/default.nix
index 36b993d79553..d0eda6329cda 100644
--- a/pkgs/development/python-modules/requests-http-signature/default.nix
+++ b/pkgs/development/python-modules/requests-http-signature/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-sW2vYqT/nY27DvEKHdptc3dUpuqKmD7PLMs+Xp+cpeU=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/requirements-detector/default.nix b/pkgs/development/python-modules/requirements-detector/default.nix
index 5acc7ae6ae26..bc6054ffad1b 100644
--- a/pkgs/development/python-modules/requirements-detector/default.nix
+++ b/pkgs/development/python-modules/requirements-detector/default.nix
@@ -4,7 +4,7 @@
 , fetchFromGitHub
 , packaging
 , poetry-core
-, poetry-semver
+, semver
 , pytestCheckHook
 , pythonOlder
 , toml
@@ -31,8 +31,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     astroid
     packaging
-    poetry-semver
     toml
+    semver
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/responses/default.nix b/pkgs/development/python-modules/responses/default.nix
index a35b03680a44..37294dba1e21 100644
--- a/pkgs/development/python-modules/responses/default.nix
+++ b/pkgs/development/python-modules/responses/default.nix
@@ -7,20 +7,20 @@
 , pythonOlder
 , pyyaml
 , requests
+, setuptools
 , tomli
 , tomli-w
 , types-pyyaml
 , types-toml
-, typing-extensions
 , urllib3
 }:
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.23.3";
-  format = "setuptools";
+  version = "0.24.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   __darwinAllowLocalNetworking = true;
 
@@ -28,20 +28,21 @@ buildPythonPackage rec {
     owner = "getsentry";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-VJmcRMn0O+3mDwzkCwxIX7RU3/I9T9p9N8t6USWDZJQ=";
+    hash = "sha256-fvfEHJioyjQoEvIgZZKt9/AKtzTgo0APGUK7lDrbahs=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyyaml
     requests
     types-pyyaml
     types-toml
     urllib3
-  ]  ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
   ];
 
-
   nativeCheckInputs = [
     pytest-asyncio
     pytest-httpserver
diff --git a/pkgs/development/python-modules/rethinkdb/default.nix b/pkgs/development/python-modules/rethinkdb/default.nix
index 889c729950e0..f419a3afbaa3 100644
--- a/pkgs/development/python-modules/rethinkdb/default.nix
+++ b/pkgs/development/python-modules/rethinkdb/default.nix
@@ -1,28 +1,37 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, looseversion
 , six
 , setuptools
 }:
 
 buildPythonPackage rec {
   pname = "rethinkdb";
-  version = "2.4.9";
-  format = "setuptools";
+  version = "2.4.10";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dV8I9xdTWlXAUSj2vmwoJI+pr/JningWqrh+H59YFcE=";
+    hash = "sha256-Vez3RH3BH+wOLOmqxLpMC1f9xcnFfXfuZz1Z0kXHRmY=";
   };
 
-  propagatedBuildInputs = [ six setuptools ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    looseversion
+    six
+  ];
 
   doCheck = false;
+
   pythonImportsCheck = [ "rethinkdb" ];
 
   meta = with lib; {
     description = "Python driver library for the RethinkDB database server";
-    homepage = "https://pypi.python.org/pypi/rethinkdb";
+    homepage = "https://github.com/RethinkDB/rethinkdb-python";
     license = licenses.asl20;
   };
 
diff --git a/pkgs/development/python-modules/rich/default.nix b/pkgs/development/python-modules/rich/default.nix
index 86c3ac1ffeeb..0fb67ed8a805 100644
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@@ -2,10 +2,20 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
-, markdown-it-py
+
+# build-system
 , poetry-core
+
+# dependencies
+, markdown-it-py
 , pygments
 , typing-extensions
+
+# optional-dependencies
+, ipywidgets
+
+# tests
+, attrs
 , pytestCheckHook
 , setuptools
 
@@ -18,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "rich";
-  version = "13.5.2";
+  version = "13.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +37,7 @@ buildPythonPackage rec {
     owner = "Textualize";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ycDmFJa68OOrNqIy/hGKxbjoaIbiniiO4UAPNSyZvDk=";
+    hash = "sha256-L72an7vHC+aBj8NlLOjofDrQGvmFxJpdbfiEubfg0GM=";
   };
 
   nativeBuildInputs = [
@@ -37,13 +47,20 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     markdown-it-py
     pygments
-    setuptools
   ] ++ lib.optionals (pythonOlder "3.9") [
     typing-extensions
   ];
 
+  passthru.optional-dependencies = {
+    jupyter = [
+      ipywidgets
+    ];
+  };
+
   nativeCheckInputs = [
+    attrs
     pytestCheckHook
+    setuptools
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/riscv-config/default.nix b/pkgs/development/python-modules/riscv-config/default.nix
index 397259d30fe3..f2ddbff5d43f 100644
--- a/pkgs/development/python-modules/riscv-config/default.nix
+++ b/pkgs/development/python-modules/riscv-config/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "riscv-config";
-  version = "3.13.3";
+  version = "3.14.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "riscv-software-src";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-tMV5mRqOLURkr8HQN1yvq5Cf3yz2NRBY6uaaxNKCy2c=";
+    hash = "sha256-a6rTKCLAHrdfP/M8Q8YYSck4q+7tmospMFcCdIdNyy0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rnginline/default.nix b/pkgs/development/python-modules/rnginline/default.nix
index d006fc950d80..acea2482f32c 100644
--- a/pkgs/development/python-modules/rnginline/default.nix
+++ b/pkgs/development/python-modules/rnginline/default.nix
@@ -2,6 +2,7 @@
 , fetchPypi
 , buildPythonPackage
 , poetry-core
+, pythonRelaxDepsHook
 , lxml
 , docopt-ng
 , typing-extensions
@@ -14,21 +15,20 @@
 buildPythonPackage rec {
   pname = "rnginline";
   version = "1.0.0";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-JWqzs+OqOynIAWYVgGrZiuiCqObAgGe6rBt0DcP3U6E=";
   };
 
-  format = "pyproject";
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'importlib-metadata = "^6.6.0"' 'importlib-metadata = "^6.0.0"'
-  '';
-
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "docopt-ng"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/robotframework-databaselibrary/default.nix b/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
index 0586fccd8853..d24bcf5bfc7a 100644
--- a/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
+++ b/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
@@ -1,24 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , robotframework
 }:
 
 buildPythonPackage rec {
-  version = "1.3.1";
-  format = "setuptools";
   pname = "robotframework-databaselibrary";
+  version = "1.4.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-C+shwpGbiA+YS8t9ApJEv6mYQVd3fVvY3qWzDF6vYqU=";
+    sha256 = "sha256-/n4+xA/eLrcVEwlWyLQLrkX5waYaJKRkphwT22b7hTU=";
   };
 
+  nativeBuildInputs = [
+    robotframework
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    robotframework
+  ];
+
   # unit tests are impure
   doCheck = false;
 
-  propagatedBuildInputs = [ robotframework ];
-
   meta = with lib; {
     description = "Database Library contains utilities meant for Robot Framework";
     homepage = "https://github.com/franz-see/Robotframework-Database-Library";
diff --git a/pkgs/development/python-modules/robotframework-requests/default.nix b/pkgs/development/python-modules/robotframework-requests/default.nix
index e1c43eb66b87..6d009c61a80c 100644
--- a/pkgs/development/python-modules/robotframework-requests/default.nix
+++ b/pkgs/development/python-modules/robotframework-requests/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "robotframework-requests";
-  version = "0.9.5";
+  version = "0.9.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "MarketSquare";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-PvhMo1r/4962nntPQb4fQxcMMXIvKjp0FdNyOA43Euc=";
+    hash = "sha256-TuKfR+pUcQ4kf9HsX6s9WYukhwLBbJkwModoreAgo60=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix b/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
index 1412fbe22a7f..d014d0441975 100644
--- a/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
+++ b/pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix
@@ -1,8 +1,7 @@
 { lib
-, stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, python
+, setuptools
 , robotframework
 , robotframework-pythonlibcore
 , selenium
@@ -13,18 +12,22 @@
 }:
 
 buildPythonPackage rec {
-  version = "6.1.2";
-  format = "setuptools";
   pname = "robotframework-seleniumlibrary";
+  version = "6.2.0";
+  pyproject = true;
 
   # no tests included in PyPI tarball
   src = fetchFromGitHub {
     owner = "robotframework";
     repo = "SeleniumLibrary";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-QbAwPm1Y76KPIcHkopiyISULQSwUet021erFa/zi8Zw=";
+    sha256 = "sha256-lvtu6z/PD2Ckj70SgDF69BwrhaoA36SDrAvj0XJsmCc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     robotframework
     robotframework-pythonlibcore
diff --git a/pkgs/development/python-modules/rotary-embedding-torch/default.nix b/pkgs/development/python-modules/rotary-embedding-torch/default.nix
index 814f178c81f3..91bb5a00231c 100644
--- a/pkgs/development/python-modules/rotary-embedding-torch/default.nix
+++ b/pkgs/development/python-modules/rotary-embedding-torch/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "rotary-embedding-torch";
-  version = "0.3.6";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lucidrains";
     repo = "rotary-embedding-torch";
     rev = "refs/tags/${version}";
-    hash = "sha256-sbkUHFUv/+nY6AT3wu/ipuDF45VUjQalsYcIvUFR9PE=";
+    hash = "sha256-bwRfu3SM/+Y9B06vjwqOjd9YmmO+EwBVvhWSdHTaRAk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rpds-py/default.nix b/pkgs/development/python-modules/rpds-py/default.nix
index 6cd3f5dea28e..b86ed00e3594 100644
--- a/pkgs/development/python-modules/rpds-py/default.nix
+++ b/pkgs/development/python-modules/rpds-py/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "rpds-py";
-  version = "0.10.3";
+  version = "0.10.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,13 +20,13 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "rpds_py";
     inherit version;
-    hash = "sha256-/MHrt1YaPiSmWI98be0V2ArsIsZqBwx1dVm1exf/0cs=";
+    hash = "sha256-TOWnCNZajb83SNJHS1gNYGsbn5G1xqsqMW4LDPekulA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-iWy6BHVsKsZB0SVrh3CVhryaavk4gAQVvRdu9xBiDRg=";
+    hash = "sha256-8bXCTrZErdE7JhuoudU/4dDndCMwvjy2a+2IY0DWDzg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rstcheck-core/default.nix b/pkgs/development/python-modules/rstcheck-core/default.nix
index 0a250a83fa5b..74a1dd2dbff2 100644
--- a/pkgs/development/python-modules/rstcheck-core/default.nix
+++ b/pkgs/development/python-modules/rstcheck-core/default.nix
@@ -5,38 +5,45 @@
 , fetchFromGitHub
 , importlib-metadata
 , mock
-, poetry-core
 , pydantic
 , pytest-mock
 , pytestCheckHook
 , pythonOlder
-, types-docutils
+, setuptools
+, setuptools-scm
 , typing-extensions
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "rstcheck-core";
-  version = "1.0.3";
-  format = "pyproject";
+  version = "1.2.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "rstcheck";
-    repo = pname;
+    repo = "rstcheck-core";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9U+GhkwBr+f3yEe7McOxqPRUuTp9vP+3WT5wZ92n32w=";
+    hash = "sha256-cKJNktIB4vXt1MPRgYrJQ0aksmrVu7Y2uTyUjdx5YdA=";
   };
 
   nativeBuildInputs = [
-    poetry-core
+    setuptools
+    setuptools-scm
+    wheel
   ];
 
+  env = {
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-strict-prototypes";
+  };
+
   propagatedBuildInputs = [
     docutils
-    importlib-metadata
     pydantic
-    types-docutils
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    importlib-metadata
     typing-extensions
   ];
 
@@ -46,10 +53,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals stdenv.isDarwin [
-    # Disabled until https://github.com/rstcheck/rstcheck-core/issues/19 is resolved.
-    "test_error_without_config_file_macos"
-    "test_file_1_is_bad_without_config_macos"
+  disabledTests = [
+    # https://github.com/rstcheck/rstcheck-core/issues/84
+    "test_check_yaml_returns_error_on_bad_code_block"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/ruamel-yaml/default.nix b/pkgs/development/python-modules/ruamel-yaml/default.nix
index 56df9d20c591..e06aaff73dc8 100644
--- a/pkgs/development/python-modules/ruamel-yaml/default.nix
+++ b/pkgs/development/python-modules/ruamel-yaml/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , ruamel-base
 , ruamel-yaml-clib
 , isPyPy
@@ -8,15 +9,19 @@
 
 buildPythonPackage rec {
   pname = "ruamel-yaml";
-  version = "0.17.32";
-  format = "setuptools";
+  version = "0.18.5";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "ruamel.yaml";
     inherit version;
-    hash = "sha256-7JOQY3YZFOFFQpcqXLptM8I7CFmrY0L2HPBwz8YA78I=";
+    hash = "sha256-YZF+OjWlacETOo93LhImlhv1oRmL6n4j8GoIQd6hqw4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # Tests use relative paths
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/ruyaml/default.nix b/pkgs/development/python-modules/ruyaml/default.nix
index 8779325d9b23..e5b2108831df 100644
--- a/pkgs/development/python-modules/ruyaml/default.nix
+++ b/pkgs/development/python-modules/ruyaml/default.nix
@@ -2,10 +2,10 @@
 , buildPythonPackage
 , distro
 , fetchFromGitHub
+, fetchpatch
 , pytestCheckHook
 , pythonOlder
 , setuptools-scm
-, setuptools-scm-git-archive
 }:
 
 buildPythonPackage rec {
@@ -22,13 +22,26 @@ buildPythonPackage rec {
     sha256 = "0gxvwry7n1gczxkjzyfrr3fammllkvnnamja4yln8xrg3n1h89al";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "remove-setuptools-scm-git-archive-from-setupcfg.patch";
+      url = "https://github.com/pycontribs/ruyaml/commit/8922dd826cbb97b29e9826b00fb28a65d584e985.patch";
+      includes = [ "setup.cfg" ];
+      hash = "sha256-XAsORoPvYRElHswlZ4S377UwuJNCU1JuCz5iyFXoXOQ=";
+    })
+
+    # https://github.com/pycontribs/ruyaml/pull/107
+    (fetchpatch {
+      name = "remove-setuptools-scm-git-archive-from-pyproject.patch";
+      url = "https://github.com/pycontribs/ruyaml/commit/4d605bf63f799696c8ba3c1f0a0f505db0ca33ce.patch";
+      hash = "sha256-X6HWXBot5ZIo+odoSHhXMb03tgpQfRw/Ze8nFgH43ZI=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools-scm
-    setuptools-scm-git-archive
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     distro
   ];
diff --git a/pkgs/development/python-modules/rxv/default.nix b/pkgs/development/python-modules/rxv/default.nix
index 50e5f1482cec..9f947a78ad2a 100644
--- a/pkgs/development/python-modules/rxv/default.nix
+++ b/pkgs/development/python-modules/rxv/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     sha256 = "0jldnlzbfg5jm1nbgv91mlvcqkswd9f2n3qj9aqlbmj1cxq19yz8";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/s3transfer/default.nix b/pkgs/development/python-modules/s3transfer/default.nix
index 748b6abecf45..0400ab4b8cd8 100644
--- a/pkgs/development/python-modules/s3transfer/default.nix
+++ b/pkgs/development/python-modules/s3transfer/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "s3transfer";
-  version = "0.7.0";
+  version = "0.8.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "boto";
     repo = pname;
     rev = version;
-    hash = "sha256-EvLqRvm9E1Taf+JvbhQbfJqIlbu2a+rB2MX0IO90x98=";
+    hash = "sha256-sdoPjkZHN5wVCK9V6V+fkGvQvEQo2ABy2lqefEKfg6o=";
   };
 
   propagatedBuildInputs = [ botocore ];
@@ -36,6 +36,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "s3transfer" ];
 
+  passthru.optional-dependencies = {
+    crt = [ botocore.optional-dependencies.crt ];
+  };
+
   meta = with lib; {
     description = "Library for managing Amazon S3 transfers";
     homepage = "https://github.com/boto/s3transfer";
diff --git a/pkgs/development/python-modules/sabctools/default.nix b/pkgs/development/python-modules/sabctools/default.nix
index 9dad229707b5..d5e684bbbb46 100644
--- a/pkgs/development/python-modules/sabctools/default.nix
+++ b/pkgs/development/python-modules/sabctools/default.nix
@@ -2,18 +2,23 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   sabnzbd,
 }:
 buildPythonPackage rec {
   pname = "sabctools";
   version = "8.1.0"; # needs to match version sabnzbd expects, e.g. https://github.com/sabnzbd/sabnzbd/blob/4.0.x/requirements.txt#L3
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-PYfbmR9wT3SHT+oFyQF2F13g7FgdvY/l9p0D65c/+RU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   pythonImportsCheck = ["sabctools"];
 
   passthru.tests = {inherit sabnzbd;};
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index 0f6dd6469046..db1d0b3f0abd 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.198.0";
+  version = "2.199.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "sagemaker-python-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-iaO+wbMs2FsnPB3Y4zwC49fWqP/zHQGzGisxNtPxOUA=";
+    hash = "sha256-zAYO8zf3FpEI1sr6Iv9WP56NFmwYGH2dtRTSJhsSYC8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/schema-salad/default.nix b/pkgs/development/python-modules/schema-salad/default.nix
index 39a35038fb0a..2e617fa8c3fc 100644
--- a/pkgs/development/python-modules/schema-salad/default.nix
+++ b/pkgs/development/python-modules/schema-salad/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "schema-salad";
-  version = "8.4.20230808163024";
+  version = "8.5.20231201181309";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ai4vv6EFX4yTR8sgRspiG+M8a8oa83LIlJPGX7q+Kd0=";
+    hash = "sha256-q4djcBt+8PEUekWNKlivKnDXrJBAUKGZ1252ym/E4bI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/schwifty/default.nix b/pkgs/development/python-modules/schwifty/default.nix
index 5344c1de3b4c..9f07bb88d58e 100644
--- a/pkgs/development/python-modules/schwifty/default.nix
+++ b/pkgs/development/python-modules/schwifty/default.nix
@@ -1,55 +1,63 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, importlib-resources
-, importlib-metadata
+
+# build-system
+, hatchling
+, hatch-vcs
+
+# dependencies
 , iso3166
 , pycountry
+
+# optional-dependencies
+, pydantic
+
+# tests
 , pytestCheckHook
 , pytest-cov
 , pythonOlder
-, setuptools
-, setuptools-scm
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "schwifty";
-  version = "2023.6.0";
+  version = "2023.11.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hDNAoITt2Ak5aVWmMgqg2oA9rDFsiuum5JXc7v7sspU=";
+    hash = "sha256-lyyAx8VDIRO72xW64gjcsZw2C31hV3YCLIGSmdlIJeI=";
   };
 
   nativeBuildInputs = [
-    setuptools
-    setuptools-scm
-    wheel
+    hatchling
+    hatch-vcs
   ];
 
   propagatedBuildInputs = [
     iso3166
     pycountry
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    importlib-resources
-  ] ++ lib.optionals (pythonOlder "3.7") [
-    importlib-metadata
   ];
 
+  passthru.optional-dependencies = {
+    pydantic = [
+      pydantic
+    ];
+  };
+
   nativeCheckInputs = [
     pytest-cov
     pytestCheckHook
-  ];
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "schwifty"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/mdomke/schwifty/blob/${version}/CHANGELOG.rst";
     description = "Validate/generate IBANs and BICs";
     homepage = "https://github.com/mdomke/schwifty";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/scikit-build/default.nix b/pkgs/development/python-modules/scikit-build/default.nix
index 5b868bb42a6f..7ced95754fe5 100644
--- a/pkgs/development/python-modules/scikit-build/default.nix
+++ b/pkgs/development/python-modules/scikit-build/default.nix
@@ -34,6 +34,12 @@ buildPythonPackage rec {
     hash = "sha256-tRpRo2s3xCZQmUtQR5EvWbIuMhCyPjIfKHYR+e9uXJ0=";
   };
 
+  patches = [
+    # https://github.com/scikit-build/scikit-build/pull/1032
+    # https://github.com/scikit-build/scikit-build/issues/1047
+    ./python312-compatibility.patch
+  ];
+
   # This line in the filterwarnings section of the pytest configuration leads to this error:
   #  E   UserWarning: Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.
   postPatch = ''
diff --git a/pkgs/development/python-modules/scikit-build/python312-compatibility.patch b/pkgs/development/python-modules/scikit-build/python312-compatibility.patch
new file mode 100644
index 000000000000..8e86eccf010b
--- /dev/null
+++ b/pkgs/development/python-modules/scikit-build/python312-compatibility.patch
@@ -0,0 +1,40 @@
+diff --git a/skbuild/resources/cmake/FindPythonExtensions.cmake b/skbuild/resources/cmake/FindPythonExtensions.cmake
+index 59b30c2..62298d5 100644
+--- a/skbuild/resources/cmake/FindPythonExtensions.cmake
++++ b/skbuild/resources/cmake/FindPythonExtensions.cmake
+@@ -254,19 +254,23 @@ endif()
+ include(targetLinkLibrariesWithDynamicLookup)
+ 
+ set(_command "
+-import distutils.sysconfig
++import sys
++
++if sys.version_info >= (3,10):
++  import sysconfig
++else:
++  from distutils import sysconfig
+ import itertools
+ import os
+ import os.path
+ import site
+-import sys
+ 
+ result = None
+ rel_result = None
+ candidate_lists = []
+ 
+ try:
+-    candidate_lists.append((distutils.sysconfig.get_python_lib(),))
++    candidate_lists.append((sysconfig.get_python_lib(),))
+ except AttributeError: pass
+ 
+ try:
+@@ -293,7 +297,7 @@ sys.stdout.write(\";\".join((
+     sys.prefix,
+     result,
+     rel_result,
+-    distutils.sysconfig.get_config_var('EXT_SUFFIX')
++    sysconfig.get_config_var('EXT_SUFFIX')
+ )))
+ ")
+ 
diff --git a/pkgs/development/python-modules/scikit-hep-testdata/default.nix b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
index 520c83575005..de78e1dc9360 100644
--- a/pkgs/development/python-modules/scikit-hep-testdata/default.nix
+++ b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "scikit-hep-testdata";
-  version = "0.4.34";
+  version = "0.4.35";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -20,11 +20,9 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-kHpJXqFQI3vtDJIcH2ebzbaReHecwItDh73/NcoPk9A=";
+    hash = "sha256-1SROsrl7zBaZRDju1M6wlKLZypk9OswA8kromiJGeqw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/scikit-image/default.nix b/pkgs/development/python-modules/scikit-image/default.nix
index 7987f3bba1cb..58b85429efb6 100644
--- a/pkgs/development/python-modules/scikit-image/default.nix
+++ b/pkgs/development/python-modules/scikit-image/default.nix
@@ -34,7 +34,7 @@ let
   installedPackageRoot = "${builtins.placeholder "out"}/${python.sitePackages}";
   self = buildPythonPackage rec {
     pname = "scikit-image";
-    version = "0.21.0";
+    version = "0.22.0";
     format = "pyproject";
 
     disabled = pythonOlder "3.8";
@@ -42,16 +42,10 @@ let
     src = fetchFromGitHub {
       owner = "scikit-image";
       repo = "scikit-image";
-      rev = "v${version}";
-      hash = "sha256-WJ2WNlcFCEtPr+bV/af6MoBBhbXDpOBEsJu4FmudoIo=";
+      rev = "refs/tags/v${version}";
+      hash = "sha256-M18y5JBPf3DR7SlJcCf82nG2MzwILg2w1AhJMzZXslg=";
     };
 
-    patches = [
-      # https://github.com/scikit-image/scikit-image/pull/7052
-      # prepare a patch file because the commit contains additional changes
-      ./suppress-deprecation-warning.patch
-    ];
-
     postPatch = ''
       patchShebangs skimage/_build_utils/{version,cythoner}.py
 
diff --git a/pkgs/development/python-modules/scikit-image/suppress-deprecation-warning.patch b/pkgs/development/python-modules/scikit-image/suppress-deprecation-warning.patch
deleted file mode 100644
index f51f1d9860a4..000000000000
--- a/pkgs/development/python-modules/scikit-image/suppress-deprecation-warning.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/skimage/exposure/tests/test_exposure.py b/skimage/exposure/tests/test_exposure.py
-index ed8dd6bc8..8ec7d13bf 100644
---- a/skimage/exposure/tests/test_exposure.py
-+++ b/skimage/exposure/tests/test_exposure.py
-@@ -368,19 +368,16 @@ def test_rescale_nan_warning(in_range, out_range):
-     )
- 
-     # 2019/11/10 Passing NaN to np.clip raises a DeprecationWarning for
--    # versions above 1.17
--    # TODO: Remove once NumPy removes this DeprecationWarning
-+    # versions above 1.17, "|\A\Z" marks as optional warning
-+    # TODO: Remove once NumPy 1.25.0 is minimal dependency
-     numpy_warning_1_17_plus = (
--        "Passing `np.nan` to mean no clipping in np.clip"
-+        "|\\A\\ZPassing `np.nan` to mean no clipping in np.clip"
-     )
- 
--    if in_range == "image":
--        exp_warn = [msg, numpy_warning_1_17_plus]
--    else:
--        exp_warn = [msg]
-+    with expected_warnings([msg, numpy_warning_1_17_plus]):
-+        result = exposure.rescale_intensity(image, in_range, out_range)
- 
--    with expected_warnings(exp_warn):
--        exposure.rescale_intensity(image, in_range, out_range)
-+    assert np.all(np.isnan(result))
- 
- 
- @pytest.mark.parametrize(
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index 6a7c5fa70573..cd66ed54be76 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -2,30 +2,36 @@
 , lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
+
+# build-system
+, cython
 , gfortran
-, glibcLocales
 , numpy
+, oldest-supported-numpy
 , scipy
+, setuptools
+
+# native dependencies
+, glibcLocales
+, llvmPackages
 , pytestCheckHook
 , pytest-xdist
 , pillow
-, cython
 , joblib
-, llvmPackages
 , threadpoolctl
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "scikit-learn";
-  version = "1.3.0";
-  format = "setuptools";
+  version = "1.3.2";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-i+VJiG9e2kZDa25VWw5Ic7TxCqIcB99FxLwXNa+8zXo=";
+    hash = "sha256-ovVMdqzMFaNL+5Bm5selbB5yNd2ldiuZB5IzC1LM+wU=";
   };
 
   buildInputs = [
@@ -38,19 +44,26 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     cython
     gfortran
+    numpy
+    oldest-supported-numpy
+    scipy
+    setuptools
   ];
 
   propagatedBuildInputs = [
+    joblib
     numpy
-    scipy
     numpy.blas
-    joblib
+    scipy
     threadpoolctl
   ];
 
-  nativeCheckInputs = [ pytestCheckHook pytest-xdist ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-xdist
+  ];
 
-  LC_ALL="en_US.UTF-8";
+  env.LC_ALL="en_US.UTF-8";
 
   preBuild = ''
     export SKLEARN_BUILD_PARALLEL=$NIX_BUILD_CORES
diff --git a/pkgs/development/python-modules/scikit-posthocs/default.nix b/pkgs/development/python-modules/scikit-posthocs/default.nix
index d7df6518903e..17f0c2a1764e 100644
--- a/pkgs/development/python-modules/scikit-posthocs/default.nix
+++ b/pkgs/development/python-modules/scikit-posthocs/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-posthocs";
-  version = "0.7.0";
+  version = "0.8.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "maximtrp";
     repo = "scikit-posthocs";
-    rev = "v${version}";
-    hash = "sha256-IkvAc684AWEK427OGAa4qVy6leWmd3b8Dnhd5bYAt5I=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ojXVrsZsvX7UytldcWkhOndix4by1uBeVpG7nQrcvmA=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/scikit-rf/default.nix b/pkgs/development/python-modules/scikit-rf/default.nix
index a2cf6d82a35b..6ab88fea48b8 100644
--- a/pkgs/development/python-modules/scikit-rf/default.nix
+++ b/pkgs/development/python-modules/scikit-rf/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "scikit-rf";
-  version = "0.29.1";
+  version = "0.30.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "scikit-rf";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-sLE6rcBGUKmk5y7oO06rHON3GVIjcvnKlr6Tgddj64Y=";
+    hash = "sha256-rJjuraiTvCmZgz8ysFBbYPowkLIuwt8RaFNl+gDSfLk=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 2c5ecd42585c..caca48153b72 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -13,7 +13,6 @@
 , pkg-config
 , pythran
 , wheel
-, nose
 , pytestCheckHook
 , pytest-xdist
 , numpy
@@ -32,8 +31,8 @@ let
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
   # The update script uses sed regexes to replace them with the updated hashes.
-  version = "1.11.3";
-  srcHash = "sha256-swxRfFjTcKjKQv6GFdWNR6IKhdJQYhZSR7UWLtcnrXw=";
+  version = "1.11.4";
+  srcHash = "sha256-hNAZOMDFYqZpb67Pzg/WALWagFYvqYO1jOmcipDDRbE=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
@@ -79,7 +78,7 @@ in buildPythonPackage {
   # Relax deps a bit
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'meson-python>=0.12.1,<0.14.0' 'meson-python' \
+      --replace 'meson-python>=0.12.1,<0.15.0' 'meson-python' \
       --replace 'numpy==' 'numpy>=' \
       --replace "pybind11>=2.10.4,<2.11.1" "pybind11>=2.10.4,<2.12.0" \
       --replace 'wheel<0.41.0' 'wheel'
@@ -109,7 +108,6 @@ in buildPythonPackage {
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
-    nose
     pytestCheckHook
     pytest-xdist
   ];
@@ -214,6 +212,7 @@ in buildPythonPackage {
   SCIPY_USE_G77_ABI_WRAPPER = 1;
 
   meta = with lib; {
+    changelog = "https://github.com/scipy/scipy/releases/tag/v${version}";
     description = "SciPy (pronounced 'Sigh Pie') is open-source software for mathematics, science, and engineering";
     downloadPage = "https://github.com/scipy/scipy";
     homepage = "https://www.scipy.org/";
diff --git a/pkgs/development/python-modules/scmrepo/default.nix b/pkgs/development/python-modules/scmrepo/default.nix
index 6e10bb5a1882..e4776cb387bc 100644
--- a/pkgs/development/python-modules/scmrepo/default.nix
+++ b/pkgs/development/python-modules/scmrepo/default.nix
@@ -2,6 +2,8 @@
 , asyncssh
 , buildPythonPackage
 , dulwich
+, dvc-http
+, dvc-objects
 , fetchFromGitHub
 , fsspec
 , funcy
@@ -29,8 +31,6 @@ buildPythonPackage rec {
     hash = "sha256-qY8puMt6ogMjx2QmAhPjCkimKp4Zfghur//MXRhsfFg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
@@ -39,6 +39,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     asyncssh
     dulwich
+    dvc-http
+    dvc-objects
     fsspec
     funcy
     gitpython
diff --git a/pkgs/development/python-modules/scooby/default.nix b/pkgs/development/python-modules/scooby/default.nix
index f1f6716c917f..6140fd13323c 100644
--- a/pkgs/development/python-modules/scooby/default.nix
+++ b/pkgs/development/python-modules/scooby/default.nix
@@ -38,8 +38,6 @@ buildPythonPackage rec {
     scipy
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   preCheck = ''
     export PATH="$PATH:$out/bin";
   '';
diff --git a/pkgs/development/python-modules/screed/default.nix b/pkgs/development/python-modules/screed/default.nix
index 307844854d87..cc1b80153d3a 100644
--- a/pkgs/development/python-modules/screed/default.nix
+++ b/pkgs/development/python-modules/screed/default.nix
@@ -18,7 +18,6 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [ setuptools-scm ];
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   pythonImportsCheck = [ "screed" ];
   checkInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/screenlogicpy/default.nix b/pkgs/development/python-modules/screenlogicpy/default.nix
index 020e6a43cb7d..ad36d8d3347c 100644
--- a/pkgs/development/python-modules/screenlogicpy/default.nix
+++ b/pkgs/development/python-modules/screenlogicpy/default.nix
@@ -2,6 +2,7 @@
 , async-timeout
 , buildPythonPackage
 , fetchFromGitHub
+, pythonAtLeast
 , pythonOlder
 , pytest-asyncio
 , setuptools
@@ -43,6 +44,12 @@ buildPythonPackage rec {
     "test_discovery_async_discover"
     "test_gateway_discovery"
     "test_gateway"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # Tests block on Python 3.12
+    "test_sub_unsub"
+    "test_attach_existing"
+    "test_login_async_connect_to_gateway"
+    "test_login_async_gateway_connect"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/seabreeze/default.nix b/pkgs/development/python-modules/seabreeze/default.nix
index 9101c654b9c6..78750d84b24f 100644
--- a/pkgs/development/python-modules/seabreeze/default.nix
+++ b/pkgs/development/python-modules/seabreeze/default.nix
@@ -1,13 +1,21 @@
 { lib
 , fetchFromGitHub
 , buildPythonPackage
-, cython
+
+# build-system
+, cython_3
 , git
 , pkgconfig
+, setuptools
 , setuptools-scm
-, future
+
+# dependneices
 , numpy
+
+# optional-dependenices
 , pyusb
+
+# tests
 , mock
 , pytestCheckHook
 , zipp
@@ -20,35 +28,35 @@
 
 buildPythonPackage rec {
   pname = "seabreeze";
-  version = "1.3.0";
-  format = "setuptools";
+  version = "2.5.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ap--";
     repo = "python-seabreeze";
-    rev = "v${version}";
-    sha256 = "1hm9aalpb9sdp8s7ckn75xvyiacp5678pv9maybm5nz0z2h29ibq";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-25rFGpfwJKj9lLDO/ZsqJ2NfCsgSSJghLZxffjX/+7w=";
     leaveDotGit = true;
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace '"pytest-runner",' ""
-  '';
-
   nativeBuildInputs = [
-    cython
+    cython_3
     git
     pkgconfig
+    setuptools
     setuptools-scm
   ];
 
   propagatedBuildInputs = [
-    future
     numpy
-    pyusb
   ];
 
+  passthru.optional-dependencies = {
+    pyseabreeze = [
+      pyusb
+    ];
+  };
+
   postInstall = ''
     mkdir -p $out/etc/udev/rules.d
     cp os_support/10-oceanoptics.rules $out/etc/udev/rules.d/10-oceanoptics.rules
@@ -59,7 +67,7 @@ buildPythonPackage rec {
     pytestCheckHook
     mock
     zipp
-  ];
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   setupPyBuildFlags = [ "--without-cseabreeze" ];
 
diff --git a/pkgs/development/python-modules/seatconnect/default.nix b/pkgs/development/python-modules/seatconnect/default.nix
index 981b2d7da869..0acce07138e6 100644
--- a/pkgs/development/python-modules/seatconnect/default.nix
+++ b/pkgs/development/python-modules/seatconnect/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-HITVrI0o94a61gy/TYSGFtLBYX4Rw/dK1o2/KsvHLTQ=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/securesystemslib/default.nix b/pkgs/development/python-modules/securesystemslib/default.nix
index 17689019a406..ccc89a290035 100644
--- a/pkgs/development/python-modules/securesystemslib/default.nix
+++ b/pkgs/development/python-modules/securesystemslib/default.nix
@@ -30,6 +30,11 @@ buildPythonPackage rec {
     hash = "sha256-REi38rIVZmWawFGcrPl9QzSthW4jHZDr/0ug7kJRz3Y=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "hatchling==1.18.0" "hatchling"
+  '';
+
   nativeBuildInputs = [
     hatchling
   ];
diff --git a/pkgs/development/python-modules/segno/default.nix b/pkgs/development/python-modules/segno/default.nix
index 3e7bb0816448..98c332af7389 100644
--- a/pkgs/development/python-modules/segno/default.nix
+++ b/pkgs/development/python-modules/segno/default.nix
@@ -1,10 +1,14 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 
 # build-system
 , setuptools
 
+# dependencies
+, importlib-metadata
+
 # tests
 , pytestCheckHook
 , pypng
@@ -13,26 +17,35 @@
 
 buildPythonPackage rec {
   pname = "segno";
-  version = "1.5.3";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "heuer";
     repo = "segno";
-    rev = version;
-    hash = "sha256-j7DUCeMoYziu19WfJu/9YiIMa2ysOPYfqW8AMcE5LaU=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-lgitNnVHvvPLKtDqJvc/zsVlFu9Gw0D3S4lt/20TlhE=";
   };
 
   nativeBuildInputs = [
     setuptools
   ];
 
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.10") [
+    importlib-metadata
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
     pypng
     pyzbar
   ];
 
+  disabledTests = [
+    # https://github.com/heuer/segno/issues/132
+    "test_plugin"
+  ];
+
   pythonImportsCheck = [
     "segno"
   ];
diff --git a/pkgs/development/python-modules/segyio/default.nix b/pkgs/development/python-modules/segyio/default.nix
index 8f73ebd5e5ae..fb1f4d28e616 100644
--- a/pkgs/development/python-modules/segyio/default.nix
+++ b/pkgs/development/python-modules/segyio/default.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "segyio";
-  version = "1.9.11";
+  version = "1.9.12";
 
   postPatch = ''
     # Removing unecessary build dependency
@@ -26,8 +26,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "equinor";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-4izeMRgg5nJ9pRfSEMDlKSYYNWkhbKEzIz7czea6Vrc=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-+N2JvHBxpdbysn4noY/9LZ4npoQ9143iFEzaxoafnms=";
   };
 
   nativeBuildInputs = [ cmake ninja python scikit-build ];
diff --git a/pkgs/development/python-modules/selenium/default.nix b/pkgs/development/python-modules/selenium/default.nix
index 086c53108976..5a5c4304c636 100644
--- a/pkgs/development/python-modules/selenium/default.nix
+++ b/pkgs/development/python-modules/selenium/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "selenium";
-  version = "4.14.0";
+  version = "4.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     repo = "selenium";
     # check if there is a newer tag with or without -python suffix
     rev = "refs/tags/selenium-${version}";
-    hash = "sha256-cTMCKfFLUlJDbTUQA3Z/pKCE1RQQRMb4K8hKKn9HqvU=";
+    hash = "sha256-AacpHZw6N6RruuBO+bZ3/cxOODe9VPGblKmIm1ffqrc=";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/semver/default.nix b/pkgs/development/python-modules/semver/default.nix
index c33db77b72d2..3c752df0a62a 100644
--- a/pkgs/development/python-modules/semver/default.nix
+++ b/pkgs/development/python-modules/semver/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "semver";
-  version = "3.0.1";
+  version = "3.0.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "python-semver";
     repo = "python-semver";
     rev = "refs/tags/${version}";
-    hash = "sha256-vVi0+Pq8VpYMy73JSrvi9ranOzvFaHpcPZRt8gMkkFs=";
+    hash = "sha256-772PSUq1dqtn9aOol+Bo0S0OItBmoiCNP8q/YCBvKU4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index 90fd136996b3..a4027953796b 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -4,7 +4,6 @@
 , apache-beam
 , asttokens
 , blinker
-, botocore
 , bottle
 , buildPythonPackage
 , celery
@@ -15,13 +14,11 @@
 , falcon
 , fetchFromGitHub
 , flask
-, flask-login
 , gevent
 , httpx
 , jsonschema
 , mock
 , pure-eval
-, pyramid
 , pyrsistent
 , pyspark
 , pysocks
@@ -32,17 +29,16 @@
 , pythonOlder
 , rq
 , sanic
+, setuptools
 , sqlalchemy
 , tornado
-, trytond
 , urllib3
-, werkzeug
 }:
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
   version = "1.39.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -53,6 +49,10 @@ buildPythonPackage rec {
     hash = "sha256-tYfnQ6L91KrRCR32dgzcDtA7eO+LHRAHBklxU8cXkK8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     certifi
     urllib3
diff --git a/pkgs/development/python-modules/setproctitle/default.nix b/pkgs/development/python-modules/setproctitle/default.nix
index 09d29ad34533..dfbee6e92469 100644
--- a/pkgs/development/python-modules/setproctitle/default.nix
+++ b/pkgs/development/python-modules/setproctitle/default.nix
@@ -2,25 +2,34 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "setproctitle";
-  version = "1.3.2";
-  format = "setuptools";
+  version = "1.3.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ufuXkHyDDSYPoGWO1Yr9SKhrK4iqxSETXDUv9/00d/0=";
+    hash = "sha256-yRPhUefqAVZ4N/8DeiPKh0AZKIAZi3+7kLFtGBYHyq4=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   # tries to compile programs with dependencies that aren't available
-  pytestFlagsArray = [ "--ignore=tests/setproctitle_test.py" ];
+  disabledTestPaths = [
+    "tests/setproctitle_test.py"
+  ];
 
   meta = with lib; {
     description = "Allows a process to change its title (as displayed by system tools such as ps and top)";
diff --git a/pkgs/development/python-modules/setuptools-generate/default.nix b/pkgs/development/python-modules/setuptools-generate/default.nix
index e4293bd118cd..9f2b71697e9b 100644
--- a/pkgs/development/python-modules/setuptools-generate/default.nix
+++ b/pkgs/development/python-modules/setuptools-generate/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-xDjxkWy/n0jStI9eLcM6WduyU9vGjtBOmJ86dpXjceQ=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/setuptools-gettext/default.nix b/pkgs/development/python-modules/setuptools-gettext/default.nix
index 725c71eeafdc..aff7572d3f62 100644
--- a/pkgs/development/python-modules/setuptools-gettext/default.nix
+++ b/pkgs/development/python-modules/setuptools-gettext/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "setuptools-gettext";
-  version = "0.1.5";
+  version = "0.1.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "breezy-team";
     repo = "setuptools-gettext";
     rev = "refs/tags/v${version}";
-    hash = "sha256-16kzKB0xq3ApQlGQYp12oB7K99QCQMUwqpP54QiI3gg=";
+    hash = "sha256-R1zgE1Ai2r23bve+sKo27XkUcIAmlWSreHZNt5yh2DY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/setuptools-odoo/default.nix b/pkgs/development/python-modules/setuptools-odoo/default.nix
index 5e262daa580e..5a6a9ac88819 100644
--- a/pkgs/development/python-modules/setuptools-odoo/default.nix
+++ b/pkgs/development/python-modules/setuptools-odoo/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
   ];
 
   # HACK https://github.com/NixOS/nixpkgs/pull/229460
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   patchPhase = ''
     runHook prePatch
 
diff --git a/pkgs/development/python-modules/setuptools-rust/default.nix b/pkgs/development/python-modules/setuptools-rust/default.nix
index e1c04780b8e8..ddfcdcb4f67b 100644
--- a/pkgs/development/python-modules/setuptools-rust/default.nix
+++ b/pkgs/development/python-modules/setuptools-rust/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "setuptools-rust";
-  version = "1.7.0";
+  version = "1.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xxAJmZSCNaOK5+VV/hmapmwlPcOEsSX12FRzv4Hq46M=";
+    hash = "sha256-lLHdXVMIsxONW5M8OitV5taSfRoiYy5Qn86p3dD35IY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/setuptools-scm-git-archive/default.nix b/pkgs/development/python-modules/setuptools-scm-git-archive/default.nix
index 7e555298907a..c5b9808440c8 100644
--- a/pkgs/development/python-modules/setuptools-scm-git-archive/default.nix
+++ b/pkgs/development/python-modules/setuptools-scm-git-archive/default.nix
@@ -1,30 +1,45 @@
-{ lib, buildPythonPackage, fetchPypi, setuptools-scm, pytestCheckHook }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "setuptools-scm-git-archive";
-  version = "1.4";
-  format = "setuptools";
+  version = "1.4.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "setuptools_scm_git_archive";
-    sha256 = "b048b27b32e1e76ec865b0caa4bb85df6ddbf4697d6909f567ac36709f6ef2f0";
+    hash = "sha256-xBi8d7OXTTrGXyaPBY8j4B3F+ZHyIzEosOFqad4iewk=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   pytestFlagsArray = [
     "tests.py"
   ];
 
-  pythonImportsCheck = [ "setuptools_scm_git_archive" ];
+  pythonImportsCheck = [
+    "setuptools_scm_git_archive"
+  ];
 
   meta = with lib; {
     description = "setuptools_scm plugin for git archives";
     homepage = "https://github.com/Changaco/setuptools_scm_git_archive";
     license = licenses.mit;
     maintainers = [ maintainers.marsam ];
+    # https://github.com/Changaco/setuptools_scm_git_archive/pull/22
+    broken = versionAtLeast setuptools-scm.version "8";
   };
 }
diff --git a/pkgs/development/python-modules/setuptools-scm/default.nix b/pkgs/development/python-modules/setuptools-scm/default.nix
index 36373efda530..01a1f0ff0d4b 100644
--- a/pkgs/development/python-modules/setuptools-scm/default.nix
+++ b/pkgs/development/python-modules/setuptools-scm/default.nix
@@ -1,29 +1,35 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , callPackage
 , fetchPypi
+, pythonOlder
+
+# build-system
+, setuptools
+
+# dependencies
 , packaging
 , typing-extensions
 , tomli
-, setuptools
-, pythonOlder
-, lib
+
+# optional-dependencies
+, rich
 }:
 
 buildPythonPackage rec {
   pname = "setuptools-scm";
-  version = "7.1.0";
-  format = "pyproject";
+  version = "8.0.4";
+  pyproject = true;
 
   src = fetchPypi {
-    pname = "setuptools_scm";
-    inherit version;
-    hash = "sha256-bFCDRadxqtfVbr/w5wYovysOx1c3Yr6ZYCFHMN4njyc=";
+    inherit pname version;
+    hash = "sha256-tfQ/9oAGaVlRk/0JiRVk7p0dfcsZbKtLJQbVOi4clcc=";
   };
 
   nativeBuildInputs = [
-    packaging
     setuptools
-    typing-extensions
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    tomli
   ];
 
   propagatedBuildInputs = [
@@ -34,6 +40,12 @@ buildPythonPackage rec {
     tomli
   ];
 
+  passthru.optional-dependencies = {
+    rich = [
+      rich
+    ];
+  };
+
   pythonImportsCheck = [
     "setuptools_scm"
   ];
@@ -45,7 +57,10 @@ buildPythonPackage rec {
     pytest = callPackage ./tests.nix { };
   };
 
+  setupHook = ./setup-hook.sh;
+
   meta = with lib; {
+    changelog = "https://github.com/pypa/setuptools_scm/blob/${version}/CHANGELOG.md";
     homepage = "https://github.com/pypa/setuptools_scm/";
     description = "Handles managing your python package versions in scm metadata";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/setuptools-scm/setup-hook.sh b/pkgs/development/python-modules/setuptools-scm/setup-hook.sh
new file mode 100644
index 000000000000..f8c30f91ca07
--- /dev/null
+++ b/pkgs/development/python-modules/setuptools-scm/setup-hook.sh
@@ -0,0 +1,32 @@
+# Let built package know its version.
+# Usually, when a package uses setuptools-scm as a build-time dependency, it
+# expects to get the package version from SCM data. However, while doing a nix
+# build, the source tree doesn't contain SCM data, so we should almost always
+# get the version from the derivation attribute.
+version-pretend-hook() {
+    if [ -z "$dontPretendSetuptoolsSCMVersion" -a -z "$SETUPTOOLS_SCM_PRETEND_VERSION" ]; then
+        echo Setting SETUPTOOLS_SCM_PRETEND_VERSION to $version
+        export SETUPTOOLS_SCM_PRETEND_VERSION="$version"
+    fi
+}
+
+# Include all tracked files.
+# When a package uses setuptools-scm as a build-time dependency, it usually
+# expects it to include all scm-tracked files in the built package, by default.
+# This is the official setuptools-scm behavior, documented in
+# https://setuptools-scm.readthedocs.io/en/latest/usage/#file-finders-hook-makes-most-of-manifestin-unnecessary
+# and https://setuptools.pypa.io/en/latest/userguide/datafiles.html.
+# However, while doing a nix build, the source tree doesn't contain SCM data,
+# so it would include only `.py` files by default.
+# We generate a MANIFEST.in automatically that includes all tracked files to
+# emulate this behavior of setuptools-scm.
+include-tracked-files-hook() {
+    if [ -z "$dontIncludeSetuptoolsSCMTrackedFiles" ]; then
+        echo Including all tracked files automatically
+        old_manifest="$(if [ -f MANIFEST.in ]; then cat MANIFEST.in; fi)"
+        echo 'global-include **' > MANIFEST.in
+        echo "$old_manifest" >> MANIFEST.in
+    fi
+}
+
+preBuildHooks+=(version-pretend-hook include-tracked-files-hook)
diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 93912d4b4ad3..231580cf9675 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "setuptools";
-  version = "68.2.2";
+  version = "69.0.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "setuptools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PpZbITlYp/cA+8jmObw8g69TK+oE9YEXD3NNJixExB4=";
+    hash = "sha256-7xOZC85glpXPKdPTYOpwjQHRpkKL1hgbMFgJF3q5EW0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/shazamio/default.nix b/pkgs/development/python-modules/shazamio/default.nix
index ee1616f7b775..05c9784b367f 100644
--- a/pkgs/development/python-modules/shazamio/default.nix
+++ b/pkgs/development/python-modules/shazamio/default.nix
@@ -72,5 +72,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/dotX12/ShazamIO/releases/tag/${src.rev}";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/shellingham/default.nix b/pkgs/development/python-modules/shellingham/default.nix
index ee368852422a..71b5d5e438bf 100644
--- a/pkgs/development/python-modules/shellingham/default.nix
+++ b/pkgs/development/python-modules/shellingham/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "shellingham";
-  version = "1.5.1";
+  version = "1.5.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "sarugaku";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-7hMlKw9oSGp57FQmbxdAgUsm5cFRr1oTW1ymJyYsgOg=";
+    hash = "sha256-xeBo3Ok+XPrHN4nQd7M8/11leSV/8z1f7Sj33+HFVtQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/shtab/default.nix b/pkgs/development/python-modules/shtab/default.nix
index e50717d5a807..ebfbd86aeb03 100644
--- a/pkgs/development/python-modules/shtab/default.nix
+++ b/pkgs/development/python-modules/shtab/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "shtab";
-  version = "1.6.4";
+  version = "1.6.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,11 +20,9 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-BMwi3a7CPq58G30XlkJdSfSP6oc6u2AuSPAwEExI9zM=";
+    hash = "sha256-jplcKVXWogSrYRGch0qypWGNzO9HErR5B9S1iT4eFcM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --cov=shtab --cov-report=term-missing --cov-report=xml" ""
diff --git a/pkgs/development/python-modules/sigstore/default.nix b/pkgs/development/python-modules/sigstore/default.nix
new file mode 100644
index 000000000000..ae64e1eb057b
--- /dev/null
+++ b/pkgs/development/python-modules/sigstore/default.nix
@@ -0,0 +1,74 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# build-system
+, flit-core
+
+# dependencies
+, appdirs
+, cryptography
+, id
+, importlib-resources
+, pydantic
+, pyjwt
+, pyopenssl
+, requests
+, rich
+, securesystemslib
+, sigstore-protobuf-specs
+, sigstore-rekor-types
+, tuf
+
+# tests
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "sigstore-python";
+  version = "2.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "sigstore";
+    repo = "sigstore-python";
+    rev = "v${version}";
+    hash = "sha256-WH6Pme8ZbfW5xqBT056eVJ3HZP1D/lAULtyN6k0uMaA=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    appdirs
+    cryptography
+    id
+    importlib-resources
+    pydantic
+    pyjwt
+    pyopenssl
+    requests
+    rich
+    securesystemslib
+    sigstore-protobuf-specs
+    sigstore-rekor-types
+    tuf
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "sigstore"
+  ];
+
+  meta = with lib; {
+    description = "A codesigning tool for Python packages";
+    homepage = "https://github.com/sigstore/sigstore-python";
+    changelog = "https://github.com/sigstore/sigstore-python/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/simplisafe-python/default.nix b/pkgs/development/python-modules/simplisafe-python/default.nix
index 03acfc90c5d8..59a24e96feb0 100644
--- a/pkgs/development/python-modules/simplisafe-python/default.nix
+++ b/pkgs/development/python-modules/simplisafe-python/default.nix
@@ -4,6 +4,7 @@
 , backoff
 , beautifulsoup4
 , buildPythonPackage
+, certifi
 , docutils
 , fetchFromGitHub
 , poetry-core
@@ -40,6 +41,7 @@ buildPythonPackage rec {
     aiohttp
     backoff
     beautifulsoup4
+    certifi
     docutils
     pytz
     voluptuous
diff --git a/pkgs/development/python-modules/simpy/default.nix b/pkgs/development/python-modules/simpy/default.nix
index e1544a0b89a6..91b1b6c7002e 100644
--- a/pkgs/development/python-modules/simpy/default.nix
+++ b/pkgs/development/python-modules/simpy/default.nix
@@ -5,26 +5,24 @@
 , setuptools
 , setuptools-scm
 , py
-, pytestCheckHook }:
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "simpy";
-  version = "4.0.2";
-  format = "setuptools";
+  version = "4.1.1";
+  pyproject = true;
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-bYrcAinfawL7fibc0TOHA7T09j8WelrCpyE8uAq6RIQ=";
+    hash = "sha256-BtB1CniEsR4OjiDOC8fG1O1fF0PUVmlTQNE/3/lQAaY=";
   };
 
   nativeBuildInputs = [
-    setuptools-scm
-  ];
-
-  propagatedBuildInputs = [
     setuptools
+    setuptools-scm
   ];
 
   nativeCheckInputs = [
@@ -33,6 +31,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    downloadPage = "https://github.com/simpx/simpy";
     homepage = "https://simpy.readthedocs.io/en/${version}/";
     description = "Process-based discrete-event simulation framework based on standard Python";
     license = [ licenses.mit ];
diff --git a/pkgs/development/python-modules/sip/default.nix b/pkgs/development/python-modules/sip/default.nix
index ec9c843dc885..4053e20a08d0 100644
--- a/pkgs/development/python-modules/sip/default.nix
+++ b/pkgs/development/python-modules/sip/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "sip";
-  version = "6.7.12";
+  version = "6.8.0";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-COZvdCWS64GKyP2kFz4u1kyfLUC3C+4R2xxJkSfZhFA=";
+    hash = "sha256-LtGQSCDLZhtyB+sdzPrr7BpUY9ytkDukSK0ZRVAtCJw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/smbprotocol/default.nix b/pkgs/development/python-modules/smbprotocol/default.nix
index 471f02e50bd8..f72eef539134 100644
--- a/pkgs/development/python-modules/smbprotocol/default.nix
+++ b/pkgs/development/python-modules/smbprotocol/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "smbprotocol";
-  version = "1.11.0";
+  version = "1.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "jborean93";
     repo = "smbprotocol";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MhkeizBorDAlTLrvbsuzvrwrbBZv/dYA7Khvg/FrKoI=";
+    hash = "sha256-1huM+/WDrVJsB4ARh6fB6rLFOe9IqSQWr/A78FAk/Ag=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/smmap/default.nix b/pkgs/development/python-modules/smmap/default.nix
index 5cfc8917a8c1..70b538e43fa0 100644
--- a/pkgs/development/python-modules/smmap/default.nix
+++ b/pkgs/development/python-modules/smmap/default.nix
@@ -1,15 +1,27 @@
-{ lib, fetchPypi, buildPythonPackage, nosexcover }:
+{ lib
+, fetchPypi
+, buildPythonPackage
+, setuptools
+, nosexcover
+}:
 
 buildPythonPackage rec {
   pname = "smmap";
-  version = "5.0.0";
-  format = "setuptools";
+  version = "6.0.0";
+  pyproject = true;
+
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c840e62059cd3be204b0c9c9f74be2c09d5648eddd4580d9314c3ecde0b30936";
+    hash = "sha256-jXkCjqbMEx2l6rCZpdlamY1DxneZVv/+O0VQQJEQdto=";
   };
 
-  nativeCheckInputs = [ nosexcover ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    nosexcover
+  ];
 
   meta = {
     description = "A pure python implementation of a sliding window memory map manager";
diff --git a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
index 41f7c2e10c3d..d8857b971a31 100644
--- a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "snowflake-sqlalchemy";
-  version = "1.5.0";
+  version = "1.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PtD3fQnIqd79NcYFdDMlpNwhCY6PHGL/wDR/QnKdsFo=";
+    hash = "sha256-TxODQC/8iTEZdL2BDe4iADrvSvDzEqD9tVd4MzrRq/c=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/snscrape/default.nix b/pkgs/development/python-modules/snscrape/default.nix
index cb07518e95d7..cb39e27373a7 100644
--- a/pkgs/development/python-modules/snscrape/default.nix
+++ b/pkgs/development/python-modules/snscrape/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-9xAUMr1SWFePEvIz6DFEexk9Txex3u8wPNfMAdxEUCA=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/snuggs/default.nix b/pkgs/development/python-modules/snuggs/default.nix
index 17b2c4bd8f3c..8824645973ed 100644
--- a/pkgs/development/python-modules/snuggs/default.nix
+++ b/pkgs/development/python-modules/snuggs/default.nix
@@ -1,6 +1,12 @@
-{ buildPythonPackage, lib, fetchFromGitHub
-, click, numpy, pyparsing
-, pytest, hypothesis
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, click
+, numpy
+, pyparsing
+, pytestCheckHook
+, hypothesis
 }:
 
 buildPythonPackage rec {
@@ -16,10 +22,18 @@ buildPythonPackage rec {
     sha256 = "1p3lh9s2ylsnrzbs931y2vn7mp2y2xskgqmh767c9l1a33shfgwf";
   };
 
+  patches = [
+    # Use non-strict xfail for failing tests
+    # https://github.com/mapbox/snuggs/pull/28
+    (fetchpatch {
+      url = "https://github.com/sebastic/snuggs/commit/3b8e04a35ed33a7dd89f0194542b22c7bde867f4.patch";
+      hash = "sha256-SfW4l4BH94rPdskRVHEsZM0twmlV9IPftRU/BBZsjBU=";
+    })
+  ];
+
   propagatedBuildInputs = [ click numpy pyparsing ];
 
-  nativeCheckInputs = [ pytest hypothesis ];
-  checkPhase = "pytest test_snuggs.py";
+  nativeCheckInputs = [ pytestCheckHook hypothesis ];
 
   meta = with lib; {
     description = "S-expressions for Numpy";
diff --git a/pkgs/development/python-modules/social-auth-core/default.nix b/pkgs/development/python-modules/social-auth-core/default.nix
index d81101ac9a9d..e92218f0dfea 100644
--- a/pkgs/development/python-modules/social-auth-core/default.nix
+++ b/pkgs/development/python-modules/social-auth-core/default.nix
@@ -14,12 +14,13 @@
 , pythonOlder
 , requests
 , requests-oauthlib
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "social-auth-core";
-  version = "4.5.0";
-  format = "setuptools";
+  version = "4.5.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -27,9 +28,13 @@ buildPythonPackage rec {
     owner = "python-social-auth";
     repo = "social-core";
     rev = "refs/tags/${version}";
-    hash = "sha256-5WEXXLl0IUPMbji8bWjTbAjY8VSLOTQvrfSCE9+ui5Y=";
+    hash = "sha256-yji10s3oHwUcKUs1njctkkmODyQRgiQDSRqolJFTifw=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     cryptography
     defusedxml
diff --git a/pkgs/development/python-modules/soxr/default.nix b/pkgs/development/python-modules/soxr/default.nix
index 941b6e596a2f..b5d01a5ddbb2 100644
--- a/pkgs/development/python-modules/soxr/default.nix
+++ b/pkgs/development/python-modules/soxr/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     hash = "sha256-H2sueQq32o/9EHENANKVoiWlFoSF88P0LZ7DfEh/Esg=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     cython_3
     gnutar
diff --git a/pkgs/development/python-modules/spdx-tools/default.nix b/pkgs/development/python-modules/spdx-tools/default.nix
index 06faf6ca261f..415534bff531 100644
--- a/pkgs/development/python-modules/spdx-tools/default.nix
+++ b/pkgs/development/python-modules/spdx-tools/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     hash = "sha256-KB+tfuz0ZnoQcMX3H+IZXjcmPZ4x2ecl8ofz1/3r0/8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/spectral-cube/default.nix b/pkgs/development/python-modules/spectral-cube/default.nix
index f0eda6956e2c..007528e22865 100644
--- a/pkgs/development/python-modules/spectral-cube/default.nix
+++ b/pkgs/development/python-modules/spectral-cube/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-gJzrr3+/FsQN/HHDERxf/NECArwOaTqFwmI/Q2Z9HTM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
index 59f832b999d6..7fff4b80debd 100644
--- a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
+++ b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "sphinx-autodoc-typehints";
-  version = "1.24.1";
+  version = "1.25.2";
 in
 
 buildPythonPackage {
@@ -22,7 +22,7 @@ buildPythonPackage {
   src = fetchPypi {
     pname = "sphinx_autodoc_typehints";
     inherit version;
-    hash = "sha256-Bmg6K3bDx7GTG3XkDgIRhm+7ULpMToAtCQHZtOhJrdI=";
+    hash = "sha256-PKvCU34XmJsvkuZKOZQlxMi/Vh7XPwh7x0FKUANhalA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinx-mdinclude/default.nix b/pkgs/development/python-modules/sphinx-mdinclude/default.nix
index d20446e91bb0..64928f437908 100644
--- a/pkgs/development/python-modules/sphinx-mdinclude/default.nix
+++ b/pkgs/development/python-modules/sphinx-mdinclude/default.nix
@@ -1,11 +1,17 @@
 { lib
 , buildPythonPackage
-, fetchpatch
 , fetchPypi
+
+# build-system
 , flit-core
+
+# dependencies
 , docutils
 , mistune
 , pygments
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -19,13 +25,24 @@ buildPythonPackage rec {
     hash = "sha256-KZjj0YswIsmYPRtyGR/jfiX/zNVBZcvjrLIszu3ZGvQ=";
   };
 
-  nativeBuildInputs = [ flit-core ];
-  propagatedBuildInputs = [ mistune docutils ];
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    docutils
+    mistune
+    pygments
+  ];
 
-  nativeCheckInputs = [ pygments ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/miyakogi/m2r";
+    broken = true; # https://github.com/omnilib/sphinx-mdinclude/issues/22
+    homepage = "https://github.com/omnilib/sphinx-mdinclude";
+    changelog = "https://github.com/omnilib/sphinx-mdinclude/blob/v${version}/CHANGELOG.md";
     description = "Sphinx extension for including or writing pages in Markdown format.";
     longDescription = ''
       A simple Sphinx extension that enables including Markdown documents from within
diff --git a/pkgs/development/python-modules/sphinx-prompt/default.nix b/pkgs/development/python-modules/sphinx-prompt/default.nix
index 776752d74c45..4d96a831d626 100644
--- a/pkgs/development/python-modules/sphinx-prompt/default.nix
+++ b/pkgs/development/python-modules/sphinx-prompt/default.nix
@@ -1,9 +1,19 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonRelaxDepsHook
+
+# build-system
 , poetry-core
 , poetry-dynamic-versioning
+
+# dependencies
+, docutils
+, pygments
 , sphinx
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -26,9 +36,27 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     poetry-core
     poetry-dynamic-versioning
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "docutils"
+    "pygments"
+    "Sphinx"
+  ];
+
+  propagatedBuildInputs = [
+    docutils
+    pygments
+    sphinx
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
   ];
 
-  propagatedBuildInputs = [ sphinx ];
+  # versions >=1.8.0 cannot be build from source
+  passthru.skipBulkUpdate = true;
 
   meta = with lib; {
     description = "A sphinx extension for creating unselectable prompt";
diff --git a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
index fe056b3e70bc..1e8e0cd4b1e7 100644
--- a/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
+++ b/pkgs/development/python-modules/sphinx-rtd-theme/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "sphinx-rtd-theme";
-  version = "1.3.0";
+  version = "2.0.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "sphinx_rtd_theme";
     inherit version;
-    hash = "sha256-WQsDDHq7nPA47AU7leU4C1xw1hWR6wtVIGP758QfCTE=";
+    hash = "sha256-vV17gGIkBnYgc6BO+PrcX5FRJhVj1HAn3gmRDOA6/ms=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 6dac59106f5f..90dfcb1e6ef6 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -100,6 +100,11 @@ buildPythonPackage rec {
   disabledTests = [
     # requires network access
     "test_latex_images"
+    # racy
+    "test_defaults"
+    "test_check_link_response_only"
+    "test_anchors_ignored_for_url"
+    "test_autodoc_default_options"
   ] ++ lib.optionals isPyPy [
     # PyPy has not __builtins__ which get asserted
     # https://doc.pypy.org/en/latest/cpython_differences.html#miscellaneous
diff --git a/pkgs/development/python-modules/sphinxcontrib-applehelp/default.nix b/pkgs/development/python-modules/sphinxcontrib-applehelp/default.nix
index 3e8fe11d192f..8a47fc39c5d7 100644
--- a/pkgs/development/python-modules/sphinxcontrib-applehelp/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-applehelp/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
   ];
 
   # Check is disabled due to circular dependency of sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-devhelp/default.nix b/pkgs/development/python-modules/sphinxcontrib-devhelp/default.nix
index b254d4b64327..8d326fe1e0f9 100644
--- a/pkgs/development/python-modules/sphinxcontrib-devhelp/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-devhelp/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
   ];
 
   # Check is disabled due to circular dependency of sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix b/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix
index 56fae964eca0..5a6b90fd3454 100644
--- a/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-htmlhelp/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
   ];
 
   # Check is disabled due to circular dependency of sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix b/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix
index 16c57f5886b7..fef662c85dae 100644
--- a/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-jquery/default.nix
@@ -26,9 +26,10 @@ buildPythonPackage rec {
       hash = "sha256-dc9bhr/af3NmrIfoVabM1lNpXbGVsJoj7jq0E1BAtHw=";
     })
     (fetchpatch {
-      name = "fix-tests-with-sphinx7.2.patch";
-      url = "https://github.com/sphinx-contrib/jquery/commit/03f1595b3793e087a407933fbcb757bdd3f558fc.patch";
-      hash = "sha256-4gNG1DL/63N2FwXDy5fMApZpf/AGOGBruwPuVqgnVkc=";
+      # https://github.com/sphinx-contrib/jquery/pull/28
+      name = "fix-tests-with-sphinx7.2-and-python312.patch";
+      url = "https://github.com/sphinx-contrib/jquery/commit/3318a82854fccec528cd73e12ab2ab96d8e71064.patch";
+      hash = "sha256-pNeKE50sm4b/KhNDAEQ3oJYGV4I8CVHnbR76z0obT3E=";
     })
   ];
 
diff --git a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
index 30c94a088fbf..9420c9882cbd 100644
--- a/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-katex/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-katex";
-  version = "0.9.7";
+  version = "0.9.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OmdUsc/JDhQeP3Pgg16vyCYtpfr+ekxnT6cI+rec69c=";
+    hash = "sha256-1ZTILfVLBI1Z1I5GsQn2IhezEaublSCMq5bZAvmj/ik=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix b/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
index 7fd16c67bdd4..3cba5c5011da 100644
--- a/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-openapi/default.nix
@@ -33,8 +33,6 @@ buildPythonPackage rec {
     sphinxcontrib-httpdomain
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-qthelp/default.nix b/pkgs/development/python-modules/sphinxcontrib-qthelp/default.nix
index d526f8aad8ee..e098f7c919bd 100644
--- a/pkgs/development/python-modules/sphinxcontrib-qthelp/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-qthelp/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
   ];
 
   # Check is disabled due to circular dependency of sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-serializinghtml/default.nix b/pkgs/development/python-modules/sphinxcontrib-serializinghtml/default.nix
index 4604eec5f184..0f06dce774c5 100644
--- a/pkgs/development/python-modules/sphinxcontrib-serializinghtml/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-serializinghtml/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
   ];
 
   # Check is disabled due to circular dependency of sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxcontrib-websupport/default.nix b/pkgs/development/python-modules/sphinxcontrib-websupport/default.nix
index bd9ae779c081..fec28e068154 100644
--- a/pkgs/development/python-modules/sphinxcontrib-websupport/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-websupport/default.nix
@@ -26,6 +26,8 @@ buildPythonPackage rec {
     sphinxcontrib-serializinghtml
   ];
 
+  # circular dependency on sphinx
+  dontCheckRuntimeDeps = true;
   doCheck = false;
 
   pythonNamespaces = [ "sphinxcontrib" ];
diff --git a/pkgs/development/python-modules/sphinxext-opengraph/default.nix b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
index 58312bdce739..570cf5b95b59 100644
--- a/pkgs/development/python-modules/sphinxext-opengraph/default.nix
+++ b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-B+bJ1tKqTTlbNeJLxk56o2a21n3Yg6OHwJiFfCx46aw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index a05a02966e07..5015535680fb 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -27,6 +27,7 @@
 , pypemicro
 , pyserial
 , ruamel-yaml
+, setuptools
 , sly
 , spsdk
 , testers
@@ -37,18 +38,19 @@
 
 buildPythonPackage rec {
   pname = "spsdk";
-  version = "1.11.0";
-  format = "setuptools";
+  version = "2.0.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nxp-mcuxpresso";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-B3qedAXSG3A8rcWu1O2GnZ1ZqHN+7fQK43qXzGnDEY0=";
+    hash = "sha256-1aW5ivdpnSscTaMIRn4tlsBG6StN95gHAyRIzmAO9Uo=";
   };
 
   nativeBuildInputs = [
     pythonRelaxDepsHook
+    setuptools
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix b/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix
index 1821ed3ef8df..54422df03e5a 100644
--- a/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-jsonfield/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-4zLXB3UQh6pgQ80KrxkLeC5yiv1R8t2+JmSukmGXr7I=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = "v${version}";
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index ffa9c12755b0..9ea29db26c8d 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -52,6 +52,10 @@ buildPythonPackage rec {
     hash = "sha256-ldBn+pdZfqnBKdYkOcG47ScH/hBgeJBeIvn1hCIBw/A=";
   };
 
+  postPatch = ''
+    sed -i '/tag_build = dev/d' setup.cfg
+  '';
+
   nativeBuildInputs =[
     setuptools
   ] ++ lib.optionals (!isPyPy) [
diff --git a/pkgs/development/python-modules/sqlglot/default.nix b/pkgs/development/python-modules/sqlglot/default.nix
index b0bb24399122..76c6027fca4b 100644
--- a/pkgs/development/python-modules/sqlglot/default.nix
+++ b/pkgs/development/python-modules/sqlglot/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-aImshQ5jf0k62ucpK4X8G7uHGAFQkhGgjMYo4mvSvew=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
 
   # optional dependency used in the sqlglot optimizer
diff --git a/pkgs/development/python-modules/sqltrie/default.nix b/pkgs/development/python-modules/sqltrie/default.nix
index 65470114c14f..6c8ee069a8cf 100644
--- a/pkgs/development/python-modules/sqltrie/default.nix
+++ b/pkgs/development/python-modules/sqltrie/default.nix
@@ -23,8 +23,6 @@ buildPythonPackage rec {
     hash = "sha256-QR5IlMHrDNsauKW3VQG0ibMUwetATuwX4fszGPzKuxg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/ssdp/default.nix b/pkgs/development/python-modules/ssdp/default.nix
index 295ebc98a941..cc7c4e5667df 100644
--- a/pkgs/development/python-modules/ssdp/default.nix
+++ b/pkgs/development/python-modules/ssdp/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-mORjMEg7Q/2CKZBLICSGF8dcdl98S6mBgJ4jujPGs6M=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace "--cov" ""
diff --git a/pkgs/development/python-modules/sshfs/default.nix b/pkgs/development/python-modules/sshfs/default.nix
index 07c8f6a6c584..c9550c57715b 100644
--- a/pkgs/development/python-modules/sshfs/default.nix
+++ b/pkgs/development/python-modules/sshfs/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-6MueDHR+jZFDZg4zufEVhBtSwcgDd7KnW9gJp2hDu0A=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/stack-data/default.nix b/pkgs/development/python-modules/stack-data/default.nix
index 370aaf8746f9..d6cbacf3abd0 100644
--- a/pkgs/development/python-modules/stack-data/default.nix
+++ b/pkgs/development/python-modules/stack-data/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-brXFrk1UU5hxCVeRvGK7wzRA0Hoj9fgqoxTIwInPrEc=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     git
     setuptools-scm
diff --git a/pkgs/development/python-modules/stanio/default.nix b/pkgs/development/python-modules/stanio/default.nix
index 83fcc7903107..daf889dba688 100644
--- a/pkgs/development/python-modules/stanio/default.nix
+++ b/pkgs/development/python-modules/stanio/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "stanio";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DFBK5nG41Sah2nEYWsAqJ3VQj/5tPbkfJC6shbz2BG8=";
+    hash = "sha256-i1hqwUs1zeGq0Yjb+FgkUVxoQtyVGitBHdE4+1w1/J8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index acac9c99f13a..137bd59c703c 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "starlette";
-  version = "0.31.1";
+  version = "0.32.0.post1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Tq414cEpXX8MQDR0KYyB+J7lFqorbiwP/sGnUFvs7wA=";
+    hash = "sha256-1twyN3fSlxwfDtyqaFFuCAVehLZ8vCV4voCT7CVSEbk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/starline/default.nix b/pkgs/development/python-modules/starline/default.nix
index cdaca053ee1d..3ec25b5061e8 100644
--- a/pkgs/development/python-modules/starline/default.nix
+++ b/pkgs/development/python-modules/starline/default.nix
@@ -2,14 +2,13 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
-, fetchpatch
 , setuptools
 , requests
 }:
 
 buildPythonPackage rec {
   pname = "starline";
-  version = "0.1.5";
+  version = "0.2.0";
 
   disabled = pythonOlder "3.5";
 
@@ -17,17 +16,9 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-F1P1/NKml2rtd1r7A/g5IVnwQMZzkXzAxjRRDZXBPLk=";
+    hash = "sha256-VQsAq5XPWdkz93CKurQKTkHleQ5itlNHGv6Go68zIOY=";
   };
 
-  patches = [
-    # https://github.com/Anonym-tsk/starline/pull/5
-    (fetchpatch {
-      url = "https://github.com/Anonym-tsk/starline/commit/4e6cdf8e05c5fb8509ee384e77b39a2495587160.patch";
-      hash = "sha256-y9b6ePH3IEgmt3ALHQGwH102rlm4KfmH4oIoIC93cWU=";
-    })
-  ];
-
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/steamship/default.nix b/pkgs/development/python-modules/steamship/default.nix
index bd430bedd3e9..3501f9f4d85e 100644
--- a/pkgs/development/python-modules/steamship/default.nix
+++ b/pkgs/development/python-modules/steamship/default.nix
@@ -58,5 +58,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/steamship-core/python-client/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ natsukium ];
+    # https://github.com/steamship-core/python-client/issues/503
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/stestr/default.nix b/pkgs/development/python-modules/stestr/default.nix
index 160b3d15b113..8f23b1006051 100644
--- a/pkgs/development/python-modules/stestr/default.nix
+++ b/pkgs/development/python-modules/stestr/default.nix
@@ -5,20 +5,22 @@
 , fixtures
 , future
 , pbr
+, setuptools
 , subunit
 , testtools
+, tomlkit
 , voluptuous
 , callPackage
 }:
 
 buildPythonPackage rec {
   pname = "stestr";
-  version = "4.0.1";
-  format = "setuptools";
+  version = "4.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wsHHO/x8/KORJxWeP7x0GTrr8s0C2KBCfy5YZI42zyY=";
+    hash = "sha256-X2HDae7OY8KS0TWZ4SqhWK92hZkGQ/JN1vp/q/406Yo=";
   };
 
   postPatch = ''
@@ -27,6 +29,11 @@ buildPythonPackage rec {
     rm test-requirements.txt
   '';
 
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     cliff
     fixtures
@@ -34,6 +41,7 @@ buildPythonPackage rec {
     pbr
     subunit
     testtools
+    tomlkit
     voluptuous
   ];
 
diff --git a/pkgs/development/python-modules/stm32loader/default.nix b/pkgs/development/python-modules/stm32loader/default.nix
index 55a86231aa70..00de51ea66f5 100644
--- a/pkgs/development/python-modules/stm32loader/default.nix
+++ b/pkgs/development/python-modules/stm32loader/default.nix
@@ -1,30 +1,53 @@
 { lib
 , buildPythonPackage
-, isPy27
 , fetchPypi
+
+# build-system
+, flit-core
+
+# dependenices
 , progress
 , pyserial
-, pytest
-, mock
+
+# optional-dependencies
+, intelhex
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "stm32loader";
-  version = "0.5.1";
-  format = "setuptools";
+  version = "0.7.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0135qzxlrivvkq6wgkw7shfz94n755qs2c1754p1hc2jk0nqayrg";
+    hash = "sha256-QTLSEjdJtDH4GCamnKHN5pEjW41rRtAMXxyZZMM5K3w=";
   };
 
-  propagatedBuildInputs = [ progress pyserial ];
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    progress
+    pyserial
+  ];
+
+  passthru.optional-dependencies = {
+    hex = [
+      intelhex
+    ];
+  };
 
-  nativeCheckInputs = [ pytest ] ++ lib.optional isPy27 mock;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
-  checkPhase = ''
-    pytest --strict tests/unit
-  '';
+  pytestFlagsArray = [
+    "tests/unit"
+  ];
 
   meta = with lib; {
     description = "Flash firmware to STM32 microcontrollers in Python";
diff --git a/pkgs/development/python-modules/strawberry-graphql/default.nix b/pkgs/development/python-modules/strawberry-graphql/default.nix
index 895471333802..194d942669ad 100644
--- a/pkgs/development/python-modules/strawberry-graphql/default.nix
+++ b/pkgs/development/python-modules/strawberry-graphql/default.nix
@@ -61,6 +61,12 @@ buildPythonPackage rec {
       url = "https://github.com/strawberry-graphql/strawberry/commit/710bb96f47c244e78fc54c921802bcdb48f5f421.patch";
       hash = "sha256-ekUZ2hDPCqwXp9n0YjBikwSkhCmVKUzQk7LrPECcD7Y=";
     })
+    (fetchpatch {
+      # https://github.com/strawberry-graphql/strawberry/pull/3255
+      name = "fix-tests-with-pydantic_2.patch";
+      url = "https://github.com/strawberry-graphql/strawberry/commit/0a0dc284ee6d31d4e82ac7ff1ed9fea4dff39fa6.patch";
+      hash = "sha256-LACWD7XA6YL/apJwhpx3LPCKxKUfa+XWyTLK+Zkxlaw=";
+    })
   ];
 
   postPatch = ''
@@ -176,6 +182,8 @@ buildPythonPackage rec {
     "tests/websockets/test_graphql_transport_ws.py"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "A GraphQL library for Python that leverages type annotations";
     homepage = "https://strawberry.rocks";
diff --git a/pkgs/development/python-modules/streaming-form-data/default.nix b/pkgs/development/python-modules/streaming-form-data/default.nix
index 8c631510ec43..18df3a778da2 100644
--- a/pkgs/development/python-modules/streaming-form-data/default.nix
+++ b/pkgs/development/python-modules/streaming-form-data/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchFromGitHub, buildPythonPackage, pythonOlder,
-cython, smart-open, pytestCheckHook, moto, requests-toolbelt }:
+cython, pytestCheckHook, requests-toolbelt }:
 
 buildPythonPackage rec {
   pname = "streaming-form-data";
@@ -14,11 +14,16 @@ buildPythonPackage rec {
     hash = "sha256-Ntiad5GZtfRd+2uDPgbDzLBzErGFroffK6ZAmMcsfXA=";
   };
 
-  nativeBuildInputs = [ cython ];
+  # streaming-form-data has a small bit of code that uses smart_open, which has a massive closure.
+  # The only consumer of streaming-form-data is Moonraker, which doesn't use that code.
+  # So, just drop the dependency to not have to deal with it.
+  patches = [
+    ./drop-smart-open.patch
+  ];
 
-  propagatedBuildInputs = [ smart-open ];
+  nativeBuildInputs = [ cython ];
 
-  nativeCheckInputs = [ pytestCheckHook moto requests-toolbelt ];
+  nativeCheckInputs = [ pytestCheckHook requests-toolbelt ];
 
   pytestFlagsArray = [ "tests" ];
 
diff --git a/pkgs/development/python-modules/streaming-form-data/drop-smart-open.patch b/pkgs/development/python-modules/streaming-form-data/drop-smart-open.patch
new file mode 100644
index 000000000000..6c0946c926ec
--- /dev/null
+++ b/pkgs/development/python-modules/streaming-form-data/drop-smart-open.patch
@@ -0,0 +1,40 @@
+diff --git a/streaming_form_data/targets.py b/streaming_form_data/targets.py
+index a399f3a..b816714 100644
+--- a/streaming_form_data/targets.py
++++ b/streaming_form_data/targets.py
+@@ -1,6 +1,5 @@
+ import hashlib
+ from pathlib import Path
+-import smart_open  # type: ignore
+ from typing import Callable, List, Optional
+ 
+ 
+@@ -164,6 +163,7 @@ class S3Target(BaseTarget):
+     S3Target enables chunked uploads to S3 buckets (using smart_open)"""
+ 
+     def __init__(self, file_path, mode, transport_params=None, **kwargs):
++        raise Exception("Nixpkgs: disabled")
+         super().__init__(**kwargs)
+ 
+         self._file_path = file_path
+diff --git a/tests/test_targets.py b/tests/test_targets.py
+index 0cc79ab..78ab40b 100644
+--- a/tests/test_targets.py
++++ b/tests/test_targets.py
+@@ -2,8 +2,6 @@ import os.path
+ import tempfile
+ 
+ import pytest
+-from moto import mock_s3
+-import boto3
+ 
+ from streaming_form_data.targets import (
+     BaseTarget,
+@@ -271,6 +269,7 @@ def mock_client():
+         yield client
+ 
+ 
++@pytest.mark.skip
+ def test_s3_upload(mock_client):
+     test_key = "test.txt"
+     path = f"s3://{BUCKET_NAME}/{test_key}"
diff --git a/pkgs/development/python-modules/stringparser/default.nix b/pkgs/development/python-modules/stringparser/default.nix
index 44e6d6baa52f..900f10208806 100644
--- a/pkgs/development/python-modules/stringparser/default.nix
+++ b/pkgs/development/python-modules/stringparser/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-gj0ooeb869JhlB9Mf5nBydiV2thTes8ys+BLJ516iSA=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/structlog/default.nix b/pkgs/development/python-modules/structlog/default.nix
index 20d1ba2c0a56..f53e3c90945d 100644
--- a/pkgs/development/python-modules/structlog/default.nix
+++ b/pkgs/development/python-modules/structlog/default.nix
@@ -8,9 +8,9 @@
 , pretend
 , pytest-asyncio
 , pytestCheckHook
-, pythonAtLeast
 , pythonOlder
 , simplejson
+, twisted
 , typing-extensions
 }:
 
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-KSHKgkv+kObKCdWZDg5o6QYe0AMND9VLdEuseY/GyDY=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-fancy-pypi-readme
     hatch-vcs
@@ -46,6 +44,12 @@ buildPythonPackage rec {
     pytest-asyncio
     pytestCheckHook
     simplejson
+    twisted
+  ];
+
+  disabledTests = [
+    # _pickle.PicklingError: Only BytesLoggers to sys.stdout and sys.stderr can be pickled.
+    "test_pickle"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/subunit/default.nix b/pkgs/development/python-modules/subunit/default.nix
index eb27ffdfb982..299d7a2ecd29 100644
--- a/pkgs/development/python-modules/subunit/default.nix
+++ b/pkgs/development/python-modules/subunit/default.nix
@@ -7,6 +7,7 @@
 , pythonOlder
 
 # python dependencies
+, extras
 , fixtures
 , hypothesis
 , pytestCheckHook
@@ -32,7 +33,11 @@ buildPythonPackage {
   ];
 
   buildInputs = [ check cppunit ];
-  propagatedBuildInputs = [ testtools ];
+
+  propagatedBuildInputs = [
+    extras
+    testtools
+  ];
 
   nativeCheckInputs = [
     testscenarios
diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index a676f28d2758..732828e908ac 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "sunpy";
-  version = "5.0.1";
+  version = "5.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7tmyywyfQw1T9qr5UbPH/KR+AmmhSaHunkeUGRKDl+Q=";
+    hash = "sha256-C5UnKp0EqzxSHTokdSJmfIOMBI6yXpWSazTxcSLOIvI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/superqt/default.nix b/pkgs/development/python-modules/superqt/default.nix
index f0d65a96ddc5..e7c3aaa04589 100644
--- a/pkgs/development/python-modules/superqt/default.nix
+++ b/pkgs/development/python-modules/superqt/default.nix
@@ -36,8 +36,6 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "superqt" ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   meta = with lib; {
     description = "Missing widgets and components for Qt-python (napari/superqt)";
     homepage = "https://github.com/napari/superqt";
diff --git a/pkgs/development/python-modules/sure/default.nix b/pkgs/development/python-modules/sure/default.nix
index 55638abad003..aaa7cba6494e 100644
--- a/pkgs/development/python-modules/sure/default.nix
+++ b/pkgs/development/python-modules/sure/default.nix
@@ -30,6 +30,8 @@ buildPythonPackage rec {
     six
   ];
 
+  doCheck = pythonOlder "3.12"; # nose requires imp module
+
   nativeCheckInputs = [
     nose
   ];
diff --git a/pkgs/development/python-modules/swagger-ui-bundle/default.nix b/pkgs/development/python-modules/swagger-ui-bundle/default.nix
index 6f3cd92d90ed..13ebaed72c6d 100644
--- a/pkgs/development/python-modules/swagger-ui-bundle/default.nix
+++ b/pkgs/development/python-modules/swagger-ui-bundle/default.nix
@@ -1,22 +1,37 @@
-{ lib, buildPythonPackage, fetchPypi, jinja2, flake8 }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+
+# build-system
+, poetry-core
+
+# dependencies
+, importlib-resources
+, jinja2
+
+ }:
 
 buildPythonPackage rec {
   pname = "swagger-ui-bundle";
-  version = "0.0.9";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "swagger_ui_bundle";
     inherit version;
-    sha256 = "b462aa1460261796ab78fd4663961a7f6f347ce01760f1303bbbdf630f11f516";
+    hash = "sha256-IGc8NDHIcz1dFhXs952azzDP91ICrK8hp9nH9IlxRSk=";
   };
 
-  # patch away unused test requirements since package contains no tests
-  postPatch = ''
-    substituteInPlace setup.py --replace "setup_requires=['pytest-runner', 'flake8']" "setup_requires=[]"
-  '';
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
-  propagatedBuildInputs = [ jinja2 ];
+  propagatedBuildInputs = [
+    jinja2
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    importlib-resources
+  ];
 
   # package contains no tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/tables/default.nix b/pkgs/development/python-modules/tables/default.nix
index 3879520b2510..56cb2898bf1f 100644
--- a/pkgs/development/python-modules/tables/default.nix
+++ b/pkgs/development/python-modules/tables/default.nix
@@ -12,6 +12,7 @@
 , numpy
 , numexpr
 , packaging
+, setuptools
 , sphinx
   # Test inputs
 , python
@@ -21,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "tables";
-  version = "3.8.0";
-  format = "setuptools";
+  version = "3.9.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NPP6I2bOILGPHfVzp3wdJzBs4fKkHZ+e/2IbUZLqh4g=";
+    hash = "sha256-1HAmPC5QxLfIY1oNmawf8vnnBMJNceX6M8RSnn0K2cM=";
   };
 
   patches = [
@@ -48,6 +49,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     blosc2
     cython
+    setuptools
     sphinx
   ];
 
diff --git a/pkgs/development/python-modules/tabula-py/default.nix b/pkgs/development/python-modules/tabula-py/default.nix
index 3ce734237ce4..bdc31012cf2d 100644
--- a/pkgs/development/python-modules/tabula-py/default.nix
+++ b/pkgs/development/python-modules/tabula-py/default.nix
@@ -31,8 +31,6 @@ buildPythonPackage rec {
       --replace '"java"' '"${lib.getExe jre}"'
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/tabulate/default.nix b/pkgs/development/python-modules/tabulate/default.nix
index 99420e9e32fe..f857585c9b23 100644
--- a/pkgs/development/python-modules/tabulate/default.nix
+++ b/pkgs/development/python-modules/tabulate/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-AJWxK/WWbeUpwP6x+ghnFnGzNo7sd9fverEUviwGizw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/tank-utility/default.nix b/pkgs/development/python-modules/tank-utility/default.nix
index 03d9c6c77d73..358ebbb0d82c 100644
--- a/pkgs/development/python-modules/tank-utility/default.nix
+++ b/pkgs/development/python-modules/tank-utility/default.nix
@@ -13,7 +13,7 @@
 buildPythonPackage rec {
   pname = "tank-utility";
   version = "1.5.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -24,11 +24,14 @@ buildPythonPackage rec {
     hash = "sha256-h9y3X+FSzSFt+bd/chz+x0nocHaKZ8DvreMxAYMs8/E=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
     urllib3
-    setuptools
-  ] ++ urllib3.optional-dependencies.secure;
+  ];
 
   nativeCheckInputs = [
     mock
diff --git a/pkgs/development/python-modules/tatsu/default.nix b/pkgs/development/python-modules/tatsu/default.nix
index 4d376dc6d2ca..635f9f34fcf9 100644
--- a/pkgs/development/python-modules/tatsu/default.nix
+++ b/pkgs/development/python-modules/tatsu/default.nix
@@ -5,12 +5,13 @@
 , pytestCheckHook
 , pythonOlder
 , regex
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "tatsu";
-  version = "5.8.3";
-  format = "setuptools";
+  version = "5.10.6";
+  pyproject = true;
 
   disabled = pythonOlder "3.10";
 
@@ -18,9 +19,13 @@ buildPythonPackage rec {
     owner = "neogeny";
     repo = "TatSu";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cKEMRbH/xNtYM0lmNVazv3i0Q1tmVrVPrB6F2s02Sro=";
+    hash = "sha256-oCYvDP8TbafyJAgl3k7fZ8MKk9prPytvl971s2BCyWA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     colorama
     regex
diff --git a/pkgs/development/python-modules/tblib/default.nix b/pkgs/development/python-modules/tblib/default.nix
index e735f6aae217..283bfcd83e40 100644
--- a/pkgs/development/python-modules/tblib/default.nix
+++ b/pkgs/development/python-modules/tblib/default.nix
@@ -1,15 +1,25 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build-system
+, setuptools
+}:
 
 buildPythonPackage rec {
   pname = "tblib";
-  version = "2.0.0";
-  format = "setuptools";
+  version = "3.0.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-pt8w8nLAi/i+ZuB3X62GIAXZUKa4RJuU98eIcx1w7Nc=";
+    hash = "sha256-k2InkKCingTwNGRY+s4eFE3E0y9JNxTGw9/4Kkrbd+Y=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   meta = with lib; {
     description = "Traceback fiddling library. Allows you to pickle tracebacks.";
     homepage = "https://github.com/ionelmc/python-tblib";
diff --git a/pkgs/development/python-modules/tcxreader/default.nix b/pkgs/development/python-modules/tcxreader/default.nix
index 9442567eec08..1334708fc7f7 100644
--- a/pkgs/development/python-modules/tcxreader/default.nix
+++ b/pkgs/development/python-modules/tcxreader/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "tcxreader";
-  version = "0.4.5";
+  version = "0.4.6";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "alenrajsp";
     repo = "tcxreader";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CiOLcev9fo2BPgnPZZ2borU25f/gKISqRAapAHgLN3w=";
+    hash = "sha256-J7yzJfJr2EK/0hZLVgk+Poqr/vY/9bsgA6cePTQ45U0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tensorboard-data-server/default.nix b/pkgs/development/python-modules/tensorboard-data-server/default.nix
index 5ff48c7cc3d1..6277049f92a0 100644
--- a/pkgs/development/python-modules/tensorboard-data-server/default.nix
+++ b/pkgs/development/python-modules/tensorboard-data-server/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "tensorboard-data-server";
-  version = "0.7.1";
+  version = "0.7.2";
   format = "wheel";
   disabled = pythonOlder "3.6";
 
@@ -11,7 +11,7 @@ buildPythonPackage rec {
     inherit version format;
     dist = "py3";
     python = "py3";
-    hash = "sha256-mTi9OfUEF5ezOSEGb7oOqwOg3RDRiHoF5irliEGtTD8=";
+    hash = "sha256-fgYQ0gWIlYiYODbsBdwJjoD5e357v/fplOu3j1eNDds=";
   };
 
   pythonImportsCheck = [ "tensorboard_data_server" ];
diff --git a/pkgs/development/python-modules/tensorboard/default.nix b/pkgs/development/python-modules/tensorboard/default.nix
index 73c76d74771c..d06c9e6d7d8e 100644
--- a/pkgs/development/python-modules/tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorboard/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "tensorboard";
-  version = "2.14.0";
+  version = "2.15.1";
   format = "wheel";
   disabled = pythonOlder "3.6";
 
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     inherit pname version format;
     dist = "py3";
     python = "py3";
-    hash = "sha256-Nmf5dF2ZKAg2rWcwIjYshA9g7Y/v1aPjC/Bx9aj9ABc=";
+    hash = "sha256-xGwdHPE6RYxCmGiniyUx2P9faCBY1p7AhAsLx6OPHA8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tensorboardx/default.nix b/pkgs/development/python-modules/tensorboardx/default.nix
index 6097d2ecfd81..e0a72af7a135 100644
--- a/pkgs/development/python-modules/tensorboardx/default.nix
+++ b/pkgs/development/python-modules/tensorboardx/default.nix
@@ -36,8 +36,6 @@ buildPythonPackage rec {
   # required to make tests deterministic
   env.PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION = "python";
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     crc32c
     numpy
diff --git a/pkgs/development/python-modules/termcolor/default.nix b/pkgs/development/python-modules/termcolor/default.nix
index 0d40a1b44f96..9a0af4e558e2 100644
--- a/pkgs/development/python-modules/termcolor/default.nix
+++ b/pkgs/development/python-modules/termcolor/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "termcolor";
-  version = "2.3.0";
+  version = "2.4.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tbCPaJN/E4/pL2wIm5nx4toK5WxSt4v3B1/ZVCD9mlo=";
+    hash = "sha256-qrnlYEfIrEHteY+jbYkqN6yms+kVnz4MJLxkqbOse3o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/terminado/default.nix b/pkgs/development/python-modules/terminado/default.nix
index 3c75305e9078..3de51ffcad2c 100644
--- a/pkgs/development/python-modules/terminado/default.nix
+++ b/pkgs/development/python-modules/terminado/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "terminado";
-  version = "0.17.1";
+  version = "0.18.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bMu806T4olpewEmR85oLjbUt/NSH6g5XjZd+Z1I4AzM=";
+    hash = "sha256-HqCKibg13RuMDJANkoSBR87yU3JDNhsuP03BXfm2/e0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tesla-powerwall/default.nix b/pkgs/development/python-modules/tesla-powerwall/default.nix
index 50fc9b2be6bb..1feefef49b6f 100644
--- a/pkgs/development/python-modules/tesla-powerwall/default.nix
+++ b/pkgs/development/python-modules/tesla-powerwall/default.nix
@@ -5,12 +5,13 @@
 , pythonOlder
 , requests
 , responses
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "tesla-powerwall";
-  version = "0.3.19";
-  format = "setuptools";
+  version = "0.4.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -18,9 +19,13 @@ buildPythonPackage rec {
     owner = "jrester";
     repo = "tesla_powerwall";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ClrMgPAMBtDMfD6hCJIN1u4mp75QW+c3re28v3FreQg=";
+    hash = "sha256-IqUxWwEvrSEbLAEnHG84oCV75qO0L5LmgpHOfaM6G8o=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
   ];
diff --git a/pkgs/development/python-modules/testfixtures/default.nix b/pkgs/development/python-modules/testfixtures/default.nix
index 64b49efbd1de..911d1496165f 100644
--- a/pkgs/development/python-modules/testfixtures/default.nix
+++ b/pkgs/development/python-modules/testfixtures/default.nix
@@ -1,10 +1,12 @@
 { lib
 , buildPythonPackage
+, fetchpatch
 , fetchPypi
 , mock
 , pytestCheckHook
 , pythonAtLeast
 , pythonOlder
+, setuptools
 , sybil
 , twisted
 , zope-component
@@ -12,8 +14,8 @@
 
 buildPythonPackage rec {
   pname = "testfixtures";
-  version = "7.2.0";
-  format = "setuptools";
+  version = "7.2.2";
+  pyproject = true;
   # DO NOT CONTACT upstream.
   # https://github.com/simplistix/ is only concerned with internal CI process.
   # Any attempt by non-standard pip workflows to comment on issues will
@@ -25,9 +27,22 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jIwg3TDqETVIUHWEodqud5JI26pXEmcseruXCfD7+LI=";
+    hash = "sha256-gHdK7LAklFgnWreD9TCT++dXlf8rMhjSLOP/8KEsTaY=";
   };
 
+  patches = [
+    # https://github.com/simplistix/testfixtures/pull/188
+    (fetchpatch {
+      name = "python3.12-compatibility.patch";
+      url = "https://github.com/simplistix/testfixtures/commit/2b80b195e30e12c739dc4f98e9de17dec8f3558a.patch";
+      hash = "sha256-LrC0uI4k3F6ZGTqbKi319tRbVk5557xbyzQN36Y1160=";
+     })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     mock
     pytestCheckHook
diff --git a/pkgs/development/python-modules/testrail-api/default.nix b/pkgs/development/python-modules/testrail-api/default.nix
index b6bb8a1b2256..e23563de6ec8 100644
--- a/pkgs/development/python-modules/testrail-api/default.nix
+++ b/pkgs/development/python-modules/testrail-api/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-lIlTrAdNtBJdwiSFwpcHA2e+fRC+MbHS0PX7prAN+RY=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/testresources/default.nix b/pkgs/development/python-modules/testresources/default.nix
index 4a9d43d6246d..724a6c364358 100644
--- a/pkgs/development/python-modules/testresources/default.nix
+++ b/pkgs/development/python-modules/testresources/default.nix
@@ -1,23 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, python
-, pbr, fixtures, testtools }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, pbr
+, fixtures
+, testtools
+, unittestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "testresources";
   version = "2.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "ee9d1982154a1e212d4e4bac6b610800bfb558e4fb853572a827bc14a96e4417";
   };
 
-  propagatedBuildInputs = [ pbr ];
+  postPatch = ''
+    substituteInPlace testresources/tests/test_resourced_test_case.py \
+      --replace "failIf" "assertFalse"
+  '';
 
-  nativeCheckInputs = [ fixtures testtools ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  checkPhase = ''
-    ${python.interpreter} -m testtools.run discover
-  '';
+  propagatedBuildInputs = [
+    pbr
+  ];
+
+  nativeCheckInputs = [
+    fixtures
+    testtools
+    unittestCheckHook
+  ];
 
   meta = with lib; {
     description = "Pyunit extension for managing expensive test resources";
diff --git a/pkgs/development/python-modules/testscenarios/default.nix b/pkgs/development/python-modules/testscenarios/default.nix
index 4e7dcef3e90d..8218947d6868 100644
--- a/pkgs/development/python-modules/testscenarios/default.nix
+++ b/pkgs/development/python-modules/testscenarios/default.nix
@@ -1,13 +1,22 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+
+# build-system
+, pbr
+, setuptools
+
+# dependencies
 , testtools
+
+# tests
+, python
 }:
 
 buildPythonPackage rec {
   pname = "testscenarios";
   version = "0.5.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -20,11 +29,27 @@ buildPythonPackage rec {
       --replace "catch = 1" ""
   '';
 
-  propagatedBuildInputs = [ testtools ];
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    pbr
+    testtools
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    ${python.interpreter} -m testtools.run testscenarios.tests.test_suite
+
+    runHook postCheck
+  '';
 
   meta = with lib; {
     description = "A pyunit extension for dependency injection";
-    homepage = "https://pypi.python.org/pypi/testscenarios";
+    homepage = "https://github.com/testing-cabal/testscenarios";
     license = licenses.asl20;
   };
 
diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix
index 24fa17a44623..ffc007af7acf 100644
--- a/pkgs/development/python-modules/testtools/default.nix
+++ b/pkgs/development/python-modules/testtools/default.nix
@@ -1,33 +1,43 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , pythonRelaxDepsHook
-, pbr
-, python-mimeparse
-, extras
-, traceback2
-, testscenarios
+
+# build-system
+, hatchling
+, hatch-vcs
+
+# dependencies
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "testtools";
-  version = "2.6.0";
-  format = "setuptools";
+  version = "2.7.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KLZeFMDy0+y7+19VydzeXk+qgKwWo3qCOQmh/jy8swo=";
+    sha256 = "sha256-323pYBDinuIfY3oUfqvzDVCyXjhB3R1o+T7onOd+Nmw=";
   };
 
-  propagatedBuildInputs = [ pbr python-mimeparse extras ];
-  buildInputs = [ traceback2 ];
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    hatchling
+    hatch-vcs
+    pythonRelaxDepsHook
+  ];
+
+  pythonRemoveDeps = [
+    "fixtures"
+  ];
+
+  propagatedBuildInputs = lib.optionals (pythonAtLeast "3.12") [
+    setuptools
+  ];
 
   # testscenarios has a circular dependency on testtools
   doCheck = false;
-  nativeCheckInputs = [ testscenarios ];
-
-  pythonRemoveDeps = [ "fixtures" ];
 
   meta = {
     description = "A set of extensions to the Python standard library's unit testing framework";
diff --git a/pkgs/development/python-modules/textfsm/default.nix b/pkgs/development/python-modules/textfsm/default.nix
index 953eb31ddc67..d5bd84a8c634 100644
--- a/pkgs/development/python-modules/textfsm/default.nix
+++ b/pkgs/development/python-modules/textfsm/default.nix
@@ -19,6 +19,12 @@ buildPythonPackage rec {
     hash = "sha256-IHgKG8v0X+LSK6purWBdwDnI/BCs5XA12ZJixuqqXWg=";
   };
 
+  # upstream forgot to update the release version
+  postPatch = ''
+    substituteInPlace textfsm/__init__.py \
+      --replace "1.1.2" "1.1.3"
+  '';
+
   propagatedBuildInputs = [
     six
     future
diff --git a/pkgs/development/python-modules/thelogrus/default.nix b/pkgs/development/python-modules/thelogrus/default.nix
index 1dc3f301dfea..5fe496bda795 100644
--- a/pkgs/development/python-modules/thelogrus/default.nix
+++ b/pkgs/development/python-modules/thelogrus/default.nix
@@ -5,6 +5,7 @@
 , poetry-core
 , pyaml
 , pythonOlder
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -23,6 +24,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "pyaml"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/threat9-test-bed/default.nix b/pkgs/development/python-modules/threat9-test-bed/default.nix
index 4eab16c304e3..b7d523b37684 100644
--- a/pkgs/development/python-modules/threat9-test-bed/default.nix
+++ b/pkgs/development/python-modules/threat9-test-bed/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-0YSjMf2gDdrvkDaT77iwfCkiDDXKHnZyI8d7JmBSuCg=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/tifffile/default.nix b/pkgs/development/python-modules/tifffile/default.nix
index 1b9582a71c8b..20858e870c73 100644
--- a/pkgs/development/python-modules/tifffile/default.nix
+++ b/pkgs/development/python-modules/tifffile/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "tifffile";
-  version = "2023.8.30";
+  version = "2023.9.26";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aoxTsBKihrddCaFJirMvIC8kzGJwoQW11ZEdxEJvFio=";
+    hash = "sha256-Z+NV5Flaqzl/hAXQSv4bSufG9ipE4i2TP+4aVxpIx64=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tiledb/default.nix b/pkgs/development/python-modules/tiledb/default.nix
index 516a22f44cce..d7c724ab25d2 100644
--- a/pkgs/development/python-modules/tiledb/default.nix
+++ b/pkgs/development/python-modules/tiledb/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "tiledb";
-  version = "0.23.0";
+  version = "0.24.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "TileDB-Inc";
     repo = "TileDB-Py";
     rev = "refs/tags/${version}";
-    hash = "sha256-QxqUYu8y+k5SLRFtxpcs57gnAHgXIre0smURlqUzC1s=";
+    hash = "sha256-EcWqh/xFyFvTuyzsPuAkT67O0y8TPWt2MvXVPnaQzrg=";
   };
 
   nativeBuildInputs = [
@@ -48,8 +48,6 @@ buildPythonPackage rec {
 
   TILEDB_PATH = tiledb;
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   disabled = !isPy3k; # Not bothering with python2 anymore
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/time-machine/default.nix b/pkgs/development/python-modules/time-machine/default.nix
index 799570ada1b8..6ce2e7194c8c 100644
--- a/pkgs/development/python-modules/time-machine/default.nix
+++ b/pkgs/development/python-modules/time-machine/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , pythonAtLeast
 , pythonOlder
+, setuptools
 , backports-zoneinfo
 , python-dateutil
 , pytestCheckHook
@@ -10,18 +11,22 @@
 
 buildPythonPackage rec {
   pname = "time-machine";
-  version = "2.12.0";
-  format = "setuptools";
+  version = "2.13.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "adamchainz";
     repo = pname;
     rev = version;
-    hash = "sha256-vBww78/3vC3IA4Nh9Ne+rBo/CO9FggjP+TUUV2/ih9c=";
+    hash = "sha256-SjenPLLr4JoWK5HAokwgW+bw3mfAZiuDb1N7Za5wtrw=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     python-dateutil
   ] ++ lib.optionals (pythonOlder "3.9") [
@@ -33,6 +38,8 @@ buildPythonPackage rec {
   ];
 
   disabledTests = lib.optionals (pythonAtLeast "3.9") [
+    # https://github.com/adamchainz/time-machine/issues/405
+    "test_destination_string_naive"
     # Assertion Errors related to Africa/Addis_Ababa
     "test_destination_datetime_tzinfo_zoneinfo_nested"
     "test_destination_datetime_tzinfo_zoneinfo_no_orig_tz"
@@ -45,6 +52,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/adamchainz/time-machine/blob/${src.rev}/CHANGELOG.rst";
     description = "Travel through time in your tests";
     homepage = "https://github.com/adamchainz/time-machine";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/timetagger/default.nix b/pkgs/development/python-modules/timetagger/default.nix
index 04c14fe5f068..d51cb5b35eee 100644
--- a/pkgs/development/python-modules/timetagger/default.nix
+++ b/pkgs/development/python-modules/timetagger/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "timetagger";
-  version = "23.11.2";
+  version = "23.11.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "almarklein";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-PPB/BTZLuHmbKmUIe5gZMAwV+TUDqXBYg6fKsokTotg=";
+    hash = "sha256-YzS69Sapwbg29usIz93hSEPiDjulFdCTeXbX4I8ZW+Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/titlecase/default.nix b/pkgs/development/python-modules/titlecase/default.nix
index 6cd8e7faa1e1..026a033357fd 100644
--- a/pkgs/development/python-modules/titlecase/default.nix
+++ b/pkgs/development/python-modules/titlecase/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-aJbbfNnQvmmYPXVOO+xx7ADetsxE+jnVQOVDzV5jUp8=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/tldextract/default.nix b/pkgs/development/python-modules/tldextract/default.nix
index 58dffe94a66b..12b6c51a7679 100644
--- a/pkgs/development/python-modules/tldextract/default.nix
+++ b/pkgs/development/python-modules/tldextract/default.nix
@@ -27,8 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-/VBbU8FuB8MEuX6MgGO44+gfqVjl1aHHDHncHY2Jo38=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/toggl-cli/default.nix b/pkgs/development/python-modules/toggl-cli/default.nix
index c3b08bad24e0..ee0dfefab645 100644
--- a/pkgs/development/python-modules/toggl-cli/default.nix
+++ b/pkgs/development/python-modules/toggl-cli/default.nix
@@ -83,6 +83,9 @@ buildPythonPackage rec {
     "toggl"
   ];
 
+  # updates to a bogus tag
+  passthru.skipBulkUpdate = true;
+
   meta = with lib; {
     description = "Command line tool and set of Python wrapper classes for interacting with toggl's API";
     homepage = "https://toggl.uhlir.dev/";
diff --git a/pkgs/development/python-modules/tokenize-rt/default.nix b/pkgs/development/python-modules/tokenize-rt/default.nix
index 46af9553fcd1..695ce44c20a8 100644
--- a/pkgs/development/python-modules/tokenize-rt/default.nix
+++ b/pkgs/development/python-modules/tokenize-rt/default.nix
@@ -2,23 +2,31 @@
 , lib
 , fetchFromGitHub
 , isPy27
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "tokenize-rt";
-  version = "4.2.1";
-  format = "setuptools";
+  version = "5.2.0";
+  pyproject = true;
+
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "asottile";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YNt4YwkuA3DVq4EjJaIES9V3A6ENa3k6/qVKisjA5Pc=";
+    hash = "sha256-G4Dn6iZLVOovzfEt9eMzp93mTX+bo0tHI5cCbaJLxBQ=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   meta = with lib; {
     description = "A wrapper around the stdlib `tokenize` which roundtrips";
diff --git a/pkgs/development/python-modules/tokenizers/Cargo.lock b/pkgs/development/python-modules/tokenizers/Cargo.lock
index ced7f1538734..295d232e6b38 100644
--- a/pkgs/development/python-modules/tokenizers/Cargo.lock
+++ b/pkgs/development/python-modules/tokenizers/Cargo.lock
@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5d730647d4fadd988536d06fecce94b7b4f2a7efdae548f1cf4b63205518ab"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
@@ -79,15 +79,18 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
 
 [[package]]
 name = "cc"
-version = "1.0.79"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "cfg-if"
@@ -97,9 +100,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "clap"
-version = "4.4.6"
+version = "4.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d04704f56c2cde07f43e8e2c154b43f216dc5c92fc98ada720177362f953b956"
+checksum = "2275f18819641850fa26c89acc84d465c1bf91ce57bc2748b28c420473352f64"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -107,9 +110,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.6"
+version = "4.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e231faeaca65ebd1ea3c737966bf858971cd38c3849107aa3ea7de90a804e45"
+checksum = "07cdf1b148b25c1e1f7a42225e30a0d99a615cd4637eae7365548dd4529b95bc"
 dependencies = [
  "anstream",
  "anstyle",
@@ -119,21 +122,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.4.2"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0862016ff20d69b84ef8247369fabf5c008a7417002411897d40ee1f4532b873"
+checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.25",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd7cc57abe963c6d3b9d8be5b06ba7c8957a930305ca90304f24ef040aa6f961"
+checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
 
 [[package]]
 name = "colorchoice"
@@ -255,9 +258,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "encode_unicode"
@@ -267,9 +270,9 @@ checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
 
 [[package]]
 name = "env_logger"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85cdab6a89accf66733ad5a1693a4dcced6aeff64602b634530dd73c1f3ee9f0"
+checksum = "95b3f3e67048839cb0d0781f445682a35113da7121f7c949db0e2be96a4fbece"
 dependencies = [
  "humantime",
  "is-terminal",
@@ -280,26 +283,15 @@ dependencies = [
 
 [[package]]
 name = "errno"
-version = "0.3.1"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
+checksum = "7c18ee0ed65a5f1f81cac6b1d213b69c35fa47d4252ad41f1486dbd8226fe36e"
 dependencies = [
- "errno-dragonfly",
  "libc",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
-[[package]]
 name = "esaxx-rs"
 version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -322,9 +314,9 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
 dependencies = [
  "cfg-if",
  "libc",
@@ -339,9 +331,9 @@ checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
+checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
 
 [[package]]
 name = "humantime"
@@ -405,9 +397,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.8"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b02a5381cc465bd3041d84623d0fa3b66738b52b8e2fc3bab8ad63ab032f4a"
+checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
 
 [[package]]
 name = "lazy_static"
@@ -417,21 +409,21 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.8"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3852614a3bd9ca9804678ba6be5e3b8ce76dfc902cae004e3e0c44051b6e88db"
+checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
 
 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -439,9 +431,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
 name = "macro_rules_attribute"
@@ -461,9 +453,9 @@ checksum = "b8dd856d451cc0da70e2ef2ce95a18e39a93b7558bedf10201ad28503f918568"
 
 [[package]]
 name = "matrixmultiply"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "090126dc04f95dc0d1c1c91f61bdd474b3930ca064c1edc8a849da2c6cbe1e77"
+checksum = "7574c1cf36da4798ab73da5b215bbf444f50718207754cb522201d78d1cd0ff2"
 dependencies = [
  "autocfg",
  "rawpointer",
@@ -471,9 +463,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
 
 [[package]]
 name = "memoffset"
@@ -508,7 +500,7 @@ checksum = "371717c0a5543d6a800cac822eac735aa7d2d2fbb41002e9856a4089532dbdce"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.25",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -536,9 +528,9 @@ dependencies = [
 
 [[package]]
 name = "num-complex"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02e0d21255c828d6f128a1e41534206671e8c3ea0c62f32291e808dc82cff17d"
+checksum = "1ba157ca0885411de85d6ca030ba7e2a83a28636056c7c699b07c8b6f7383214"
 dependencies = [
  "num-traits",
 ]
@@ -555,9 +547,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.15"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
 dependencies = [
  "autocfg",
 ]
@@ -623,15 +615,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
  "cfg-if",
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-targets 0.48.1",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -648,9 +640,9 @@ checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
 
 [[package]]
 name = "portable-atomic"
-version = "1.4.3"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31114a898e107c51bb1609ffaf55a0e011cf6a4d7f1170d0015a165082c0338b"
+checksum = "3bccab0e7fd7cc19f820a1c8c91720af652d0c88dc9664dd72aef2614f04af3b"
 
 [[package]]
 name = "ppv-lite86"
@@ -660,9 +652,9 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.64"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78803b62cbf1f46fde80d7c0e803111524b9877184cfe7c3033659490ac7a7da"
+checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
 dependencies = [
  "unicode-ident",
 ]
@@ -729,9 +721,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.29"
+version = "1.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "573015e8ab27661678357f27dc26460738fd2b6c86e46f386fde94cb5d913105"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
  "proc-macro2",
 ]
@@ -805,41 +797,47 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.3.5"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
  "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "regex"
-version = "1.9.1"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2eae68fc220f7cf2532e4494aded17545fce192d59cd996e0fe7887f4ceb575"
+checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
 dependencies = [
  "aho-corasick",
  "memchr",
  "regex-automata",
- "regex-syntax",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.3.3"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39354c10dd07468c2e73926b23bb9c2caca74c5501e38a35da70406f1d923310"
+checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "rustc-hash"
@@ -849,11 +847,11 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.38.13"
+version = "0.38.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7db8590df6dfcd144d22afd1b83b36c21a18d7cbc1dc4bb5295a8712e9eb662"
+checksum = "ffb93593068e9babdad10e4fce47dc9b3ac25315a72a59766ffd9e9a71996a04"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -862,41 +860,41 @@ dependencies = [
 
 [[package]]
 name = "ryu"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe232bdf6be8c8de797b22184ee71118d63780ea42ac85b61d1baa6d3b782ae9"
+checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
 
 [[package]]
 name = "scopeguard"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "serde"
-version = "1.0.171"
+version = "1.0.192"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30e27d1e4fd7659406c492fd6cfaf2066ba8773de45ca75e855590f856dc34a9"
+checksum = "bca2a08484b285dcb282d0f67b26cadc0df8b19f8c12502c13d966bf9482f001"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.171"
+version = "1.0.192"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389894603bd18c46fa56231694f8d827779c0951a667087194cf9de94ed24682"
+checksum = "d6c7207fbec9faa48073f3e3074cbe553af6ea512d7c21ba46e434e70ea9fbc1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.25",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.102"
+version = "1.0.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5062a995d481b2308b6064e9af76011f2921c35f97b0468811ed9f6cd91dfed"
+checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
 dependencies = [
  "itoa",
  "ryu",
@@ -905,9 +903,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.0"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
+checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970"
 
 [[package]]
 name = "spm_precompiled"
@@ -940,9 +938,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.25"
+version = "2.0.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15e3fc8c0c74267e2df136e5e5fb656a464158aa57624053375eb9c8c6e25ae2"
+checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -951,15 +949,15 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.9"
+version = "0.12.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df8e77cb757a61f51b947ec4a7e3646efd825b73561db1c232a8ccb639e611a0"
+checksum = "14c39fd04924ca3a864207c66fc2cd7d22d7c016007f9ce846cbb9326331930a"
 
 [[package]]
 name = "tempfile"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
 dependencies = [
  "cfg-if",
  "fastrand",
@@ -970,36 +968,36 @@ dependencies = [
 
 [[package]]
 name = "termcolor"
-version = "1.2.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+checksum = "ff1bc3d3f05aff0403e8ac0d92ced918ec05b666a43f83297ccef5bea8a3d449"
 dependencies = [
  "winapi-util",
 ]
 
 [[package]]
 name = "thiserror"
-version = "1.0.49"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4"
+checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.49"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc"
+checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.25",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "tokenizers"
-version = "0.14.1"
+version = "0.15.0"
 dependencies = [
  "aho-corasick",
  "clap",
@@ -1018,7 +1016,7 @@ dependencies = [
  "rayon",
  "rayon-cond",
  "regex",
- "regex-syntax",
+ "regex-syntax 0.7.5",
  "serde",
  "serde_json",
  "spm_precompiled",
@@ -1030,7 +1028,7 @@ dependencies = [
 
 [[package]]
 name = "tokenizers-python"
-version = "0.14.1"
+version = "0.15.0"
 dependencies = [
  "env_logger",
  "itertools",
@@ -1048,9 +1046,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.10"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22049a19f4a68748a168c0fc439f9516686aa045927ff767eca0a85101fb6e73"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization-alignments"
@@ -1115,9 +1113,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
 dependencies = [
  "winapi",
 ]
@@ -1143,7 +1141,7 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows-targets 0.48.1",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -1163,17 +1161,17 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.48.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05d4b17490f70499f20b9e791dcf6a299785ce8af4d709018206dc5b4953e95f"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
- "windows_aarch64_gnullvm 0.48.0",
- "windows_aarch64_msvc 0.48.0",
- "windows_i686_gnu 0.48.0",
- "windows_i686_msvc 0.48.0",
- "windows_x86_64_gnu 0.48.0",
- "windows_x86_64_gnullvm 0.48.0",
- "windows_x86_64_msvc 0.48.0",
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
 ]
 
 [[package]]
@@ -1184,9 +1182,9 @@ checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -1196,9 +1194,9 @@ checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -1208,9 +1206,9 @@ checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -1220,9 +1218,9 @@ checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -1232,9 +1230,9 @@ checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -1244,9 +1242,9 @@ checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -1256,6 +1254,6 @@ checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
diff --git a/pkgs/development/python-modules/tokenizers/default.nix b/pkgs/development/python-modules/tokenizers/default.nix
index 4711cfe00dd0..a008e15b3704 100644
--- a/pkgs/development/python-modules/tokenizers/default.nix
+++ b/pkgs/development/python-modules/tokenizers/default.nix
@@ -63,7 +63,7 @@ let
 in
 buildPythonPackage rec {
   pname = "tokenizers";
-  version = "0.14.1";
+  version = "0.15.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -72,7 +72,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cq7dQLttNkV5UUhXujxKKMuzhD7hz+zTTKxUKlvz1s0=";
+    hash = "sha256-+yfX12eKtgZV1OQvPOlMVTONbpFuigHcl4SjoCIZkSk=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
diff --git a/pkgs/development/python-modules/tololib/default.nix b/pkgs/development/python-modules/tololib/default.nix
index 6d2ad4815b5a..040dc6c1ed29 100644
--- a/pkgs/development/python-modules/tololib/default.nix
+++ b/pkgs/development/python-modules/tololib/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-2OQaJR70bx8qWs1IPErF+B3X1iRvHW74axTqtdvum3U=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/tomlkit/default.nix b/pkgs/development/python-modules/tomlkit/default.nix
index 605291edda0b..fa978be73bbd 100644
--- a/pkgs/development/python-modules/tomlkit/default.nix
+++ b/pkgs/development/python-modules/tomlkit/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "tomlkit";
-  version = "0.12.1";
+  version = "0.12.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OOH/jtuZEnPsn2GBJEpqORrDDp9QmOdTVkDqa+l6fIY=";
+    hash = "sha256-dbr1AS0GUB8HvuW/joAbnzQ+eqxaklgfIPgM5jLmtaQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/total-connect-client/default.nix b/pkgs/development/python-modules/total-connect-client/default.nix
index f9635d5617d4..f6f3baaefe25 100644
--- a/pkgs/development/python-modules/total-connect-client/default.nix
+++ b/pkgs/development/python-modules/total-connect-client/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "total-connect-client";
-  version = "2023.11.1";
+  version = "2023.12.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "craigjmidwinter";
     repo = "total-connect-client";
     rev = "refs/tags/${version}";
-    hash = "sha256-XyoyPMhp7KZrizAehuFnBAWYliv9A7D2JjGA+lO3p7Y=";
+    hash = "sha256-iEQC02KuBWtk8yQwM/fU28ilbmCWeAjilvR6fHVexuI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tox/default.nix b/pkgs/development/python-modules/tox/default.nix
index 1b0bf1755ab7..8d227bb5df85 100644
--- a/pkgs/development/python-modules/tox/default.nix
+++ b/pkgs/development/python-modules/tox/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "tox";
-  version = "4.11.3";
+  version = "4.11.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "tox-dev";
     repo = "tox";
     rev = "refs/tags/${version}";
-    hash = "sha256-VLoWRAiQ1TP9S0f8TKwQ0H2Lgemd+dTzSM+TjhioDMk=";
+    hash = "sha256-pZmT8392YuHzCrAquPpveByYw3x6bkMGCUToCAqAGc8=";
   };
 
   postPatch = ''
@@ -39,8 +39,6 @@ buildPythonPackage rec {
       --replace "packaging>=22" "packaging"
   '';
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatchling
     hatch-vcs
diff --git a/pkgs/development/python-modules/tqdm/default.nix b/pkgs/development/python-modules/tqdm/default.nix
index 640e62212081..6cf4c9713f9e 100644
--- a/pkgs/development/python-modules/tqdm/default.nix
+++ b/pkgs/development/python-modules/tqdm/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
+, pythonAtLeast
 , setuptools
 , setuptools-scm
 , wheel
@@ -19,6 +20,9 @@ buildPythonPackage rec {
   version = "4.66.1";
   format = "pyproject";
 
+  # https://github.com/tqdm/tqdm/issues/1537
+  disabled = pythonAtLeast "3.12";
+
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-2I5lH5242FUaYlVtPP+eMDQnTKXWbpMZfPJJDi3Lacc=";
diff --git a/pkgs/development/python-modules/tracerite/default.nix b/pkgs/development/python-modules/tracerite/default.nix
index 981cd2087456..9b98e986bb36 100644
--- a/pkgs/development/python-modules/tracerite/default.nix
+++ b/pkgs/development/python-modules/tracerite/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-rI1MNdYl/P64tUHyB3qV9gfLbGbCVOXnEFoqFTkaqgg=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/traitlets/default.nix b/pkgs/development/python-modules/traitlets/default.nix
index 6df71a041b25..f138489cf2bf 100644
--- a/pkgs/development/python-modules/traitlets/default.nix
+++ b/pkgs/development/python-modules/traitlets/default.nix
@@ -1,27 +1,46 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
 , pythonOlder
+
+# build-system
 , hatchling
+
+# tests
+, argcomplete
+, pytest-mock
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "traitlets";
-  version = "5.10.0";
+  version = "5.14.0";
   format = "pyproject";
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9YTqIJJARm5m6R88gap9AEukz3lJkLDHdZOKFUQhfNE=";
+    hash = "sha256-/NqorEnATfoO0+4zhO9t/bXW83QVAr4kcnlAdnkpZ3I=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  nativeCheckInputs = [
+    argcomplete
+    pytest-mock
+    pytestCheckHook
+  ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  disabledTestPaths = [
+    # requires mypy-testing
+    "tests/test_typing.py"
+  ];
 
   meta = {
+    changelog = "https://github.com/ipython/traitlets/blob/v${version}/CHANGELOG.md";
     description = "Traitlets Python config system";
     homepage = "https://github.com/ipython/traitlets";
     license = lib.licenses.bsd3;
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index efee6e3d1fa4..c6d8e538e6a6 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -51,7 +51,7 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.35.2";
+  version = "4.36.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-h1RMSEcuali05AWeTm1wyZQJz6XrHamCF1eHrSnFnfM=";
+    hash = "sha256-sVWDpChLjiSZQXyXsZtTUZMF/CckTaJzitk3hpagM64=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/treq/default.nix b/pkgs/development/python-modules/treq/default.nix
index 69e0c2c9d40d..b2f020a8e379 100644
--- a/pkgs/development/python-modules/treq/default.nix
+++ b/pkgs/development/python-modules/treq/default.nix
@@ -1,25 +1,41 @@
 { lib
 , fetchPypi
 , buildPythonPackage
+
+# build-system
+, incremental
+, setuptools
+
+# dependenices
+, attrs
+, hyperlink
 , requests
 , twisted
-, incremental
+
+# tests
 , httpbin
 }:
 
 buildPythonPackage rec {
   pname = "treq";
-  version = "22.2.0";
-  format = "setuptools";
+  version = "23.11.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-33V+PxQfx4Lt4HamBFIRlP/LQPomRc9I5aNwYDB/Uuw=";
+    hash = "sha256-CRT/kp/RYyzhZ5cjUmD4vBnSD/fEWcHeq9ZbjGjL6sU=";
   };
 
+  nativeBuildInputs = [
+    incremental
+    setuptools
+  ];
+
   propagatedBuildInputs = [
-    requests
+    attrs
+    hyperlink
     incremental
+    requests
     twisted
   ] ++ twisted.optional-dependencies.tls;
 
@@ -29,7 +45,11 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
+    runHook preCheck
+
     trial treq
+
+    runHook postCheck
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/trio-asyncio/default.nix b/pkgs/development/python-modules/trio-asyncio/default.nix
index 3585e2519918..de238ddc7c23 100644
--- a/pkgs/development/python-modules/trio-asyncio/default.nix
+++ b/pkgs/development/python-modules/trio-asyncio/default.nix
@@ -1,9 +1,11 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , trio
 , outcome
 , sniffio
+, exceptiongroup
 , pytest-trio
 , pytestCheckHook
 , pythonAtLeast
@@ -12,15 +14,15 @@
 
 buildPythonPackage rec {
   pname = "trio-asyncio";
-  version = "0.12.0";
-  format = "setuptools";
+  version = "0.13.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "trio_asyncio";
     inherit version;
-    sha256 = "824be23b0c678c0df942816cdb57b92a8b94f264fffa89f04626b0ba2d009768";
+    hash = "sha256-fKJLIaGxes3mV1LWkziGuiQoTlL0srDe/k6o7YpjSmI=";
   };
 
   postPatch = ''
@@ -28,10 +30,16 @@ buildPythonPackage rec {
       --replace "'pytest-runner'" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     trio
     outcome
     sniffio
+  ] ++ lib.optionals (pythonOlder "3.11") [
+    exceptiongroup
   ];
 
   nativeCheckInputs = [
@@ -39,26 +47,16 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
-    # https://github.com/python-trio/trio-asyncio/issues/112
-    "-W" "ignore::DeprecationWarning"
-    # trio.MultiError is deprecated since Trio 0.22.0; use BaseExceptionGroup (on Python 3.11 and later) or exceptiongroup.BaseExceptionGroup (earlier versions) instead (https://github.com/python-trio/trio/issues/2211)
-    "-W" "ignore::trio.TrioDeprecationWarning"
-  ];
-
   disabledTestPaths = [
     "tests/python" # tries to import internal API test.test_asyncio
   ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.11") [
-    "test_run_task"
-  ];
-
   pythonImportsCheck = [
     "trio_asyncio"
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/python-trio/trio-asyncio/blob/v${version}/docs/source/history.rst";
     description = "Re-implementation of the asyncio mainloop on top of Trio";
     homepage = "https://github.com/python-trio/trio-asyncio";
     license = with licenses; [ asl20 /* or */ mit ];
diff --git a/pkgs/development/python-modules/trio/default.nix b/pkgs/development/python-modules/trio/default.nix
index c01db3259a7d..648f91f07b9b 100644
--- a/pkgs/development/python-modules/trio/default.nix
+++ b/pkgs/development/python-modules/trio/default.nix
@@ -1,20 +1,29 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, stdenv
+
+# build-system
+, setuptools
+
+# dependencies
 , attrs
-, sortedcontainers
-, async-generator
 , exceptiongroup
 , idna
 , outcome
+, sniffio
+, sortedcontainers
+
+# tests
+, astor
+, coreutils
+, jedi
+, pyopenssl
 , pytestCheckHook
 , pytest-trio
-, pyopenssl
 , trustme
-, sniffio
-, stdenv
-, jedi
-, astor
 , yapf
-, coreutils
 }:
 
 let
@@ -28,22 +37,26 @@ let
 in
 buildPythonPackage rec {
   pname = "trio";
-  version = "0.22.2";
-  format = "setuptools";
-  disabled = pythonOlder "3.7";
+  version = "0.23.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OIfPGMi8yJRDNCAwVGg4jax2ky6WaK+hxJqjgGtqzLM=";
+    hash = "sha256-FviffcyPe53N7B/Nhj4MA5r20PmiL439Vvdddexz/Ug=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     attrs
-    sortedcontainers
-    async-generator
     idna
     outcome
     sniffio
+    sortedcontainers
   ] ++ lib.optionals (pythonOlder "3.11") [
     exceptiongroup
   ];
@@ -81,6 +94,11 @@ buildPythonPackage rec {
     "test_static_tool_sees_class_members"
   ];
 
+  disabledTestPaths = [
+    # linters
+    "trio/_tests/tools/test_gen_exports.py"
+  ];
+
   pytestFlagsArray = [
     "-W" "ignore::DeprecationWarning"
   ];
diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 041f3db4c803..3485c0f1fd2c 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -4,19 +4,20 @@
 , calver
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2023.11.22";
-    format = "setuptools";
+    version = "2023.11.29";
+    pyproject = true;
 
     disabled = pythonOlder "3.7";
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-wxp+kvll8GCiRLV9jtXub1P8tBPuF855DgBXfLNprZk=";
+      hash = "sha256-/49/2Cx5MhE7RufvZ0LHAJHMY2QMjGXbANkfLpQLlRQ=";
     };
 
     postPatch = ''
@@ -26,6 +27,7 @@ let
 
     nativeBuildInputs = [
       calver
+      setuptools
     ];
 
     doCheck = false; # avoid infinite recursion with hatchling
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index 790a9e4f1a07..bb1835ff7b9b 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "trytond";
-  version = "6.8.5";
+  version = "7.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-o/U8bmCAotgDYY81eX+vXOxJC3f4aQvOF6ohMOHLuLY=";
+    hash = "sha256-/Xb6YOQ8nV+bXTdt/iAgYkBkmV6fRVFjR+86SfKU+aw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/twill/default.nix b/pkgs/development/python-modules/twill/default.nix
index fdc750fa8962..f15a45509e58 100644
--- a/pkgs/development/python-modules/twill/default.nix
+++ b/pkgs/development/python-modules/twill/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "twill";
-  version = "3.1";
+  version = "3.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tWcZRvBvkRyQ7gD5zjocBzFVlzQ0Mhf1unF3gUkhB94=";
+    hash = "sha256-JJheUl/Ar8BWNpzJzMvVgk4KeitoQZ8GjbFPN9dEd+g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index a8047e62c25d..f641afea9b66 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -54,7 +54,7 @@
 
 buildPythonPackage rec {
   pname = "twisted";
-  version = "23.8.0";
+  version = "23.10.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -62,16 +62,11 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "tar.gz";
-    hash = "sha256-PHM2Ct0XM2piLA2BHCos4phmtuWbESX9ZQmxclIJiiQ=";
+    hash = "sha256-mHhHoHkKLFlxl2E2huJ4T9VBZ986VdD7F8hBIwXXbOU=";
   };
 
   patches = [
     (fetchpatch {
-      name = "11787.diff";
-      url = "https://github.com/twisted/twisted/commit/da3bf3dc29f067e7019b2a1c205834ab64b2139a.diff";
-      hash = "sha256-bQgUmbvDa61Vg8p/o/ivfkOAHyj1lTgHkrRVEGLM9aU=";
-    })
-    (fetchpatch {
       # Conditionally skip tests that require METHOD_CRYPT
       # https://github.com/twisted/twisted/pull/11827
       url = "https://github.com/mweinelt/twisted/commit/e69e652de671aac0abf5c7e6c662fc5172758c5a.patch";
@@ -112,6 +107,8 @@ buildPythonPackage rec {
     echo 'FileObserverTests.test_getTimezoneOffsetWestOfUTC.skip = "mktime argument out of range"'>> src/twisted/test/test_log.py
     echo 'FileObserverTests.test_getTimezoneOffsetWithoutDaylightSavingTime.skip = "tuple differs, values not"'>> src/twisted/test/test_log.py
 
+    echo 'FileDescriptorTests.test_expectedFDs.skip = "Expected duplicate file descriptor to be greater than original"' >> src/twisted/internet/test/test_posixprocess.py
+
     echo 'MulticastTests.test_joinLeave.skip = "No such device"'>> src/twisted/test/test_udp.py
     echo 'MulticastTests.test_loopback.skip = "No such device"'>> src/twisted/test/test_udp.py
     echo 'MulticastTests.test_multicast.skip = "Reactor was unclean"'>> src/twisted/test/test_udp.py
@@ -127,6 +124,10 @@ buildPythonPackage rec {
     # tests for missing https support in usage
     echo 'ServiceTests.test_HTTPSFailureOnMissingSSL.skip = "Expectation Mismatch"' >> src/twisted/web/test/test_tap.py
 
+    # fail on Python 3.12
+    echo 'WorkerReporterTests.test_addSkipPyunit.skip = "'WorkerReporter' object has no attribute '_testStarted'"' >> src/twisted/trial/_dist/test/test_workerreporter.py
+    echo 'LocalWorkerAMPTests.test_runSkip.skip = "twisted.protocols.amp.UnknownRemoteError: Code<UNKNOWN>: Unknown Error"' >> src/twisted/trial/_dist/test/test_worker.py
+
     # not packaged
     substituteInPlace src/twisted/test/test_failure.py \
       --replace "from cython_test_exception_raiser import raiser  # type: ignore[import]" "raiser = None"
@@ -143,6 +144,8 @@ buildPythonPackage rec {
   '' + lib.optionalString stdenv.isDarwin ''
     echo 'ProcessTestsBuilder_AsyncioSelectorReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
     echo 'ProcessTestsBuilder_SelectReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
+    echo 'ProcessTestsBuilder_AsyncioSelectorReactorTests.test_processEnded.skip = "exit code 120"' >> src/twisted/internet/test/test_process.py
+    echo 'ProcessTestsBuilder_SelectReactorTests.test_processEnded.skip = "exit code 120"' >> src/twisted/internet/test/test_process.py
   '';
 
   # Generate Twisted's plug-in cache. Twisted users must do it as well. See
@@ -197,6 +200,7 @@ buildPythonPackage rec {
   };
 
   meta = with lib; {
+    changelog = "https://github.com/twisted/twisted/blob/twisted-${version}/NEWS.rst";
     homepage = "https://github.com/twisted/twisted";
     description = "Asynchronous networking framework written in Python";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/txi2p-tahoe/default.nix b/pkgs/development/python-modules/txi2p-tahoe/default.nix
index 3d891c6eeed1..9ddc10885788 100644
--- a/pkgs/development/python-modules/txi2p-tahoe/default.nix
+++ b/pkgs/development/python-modules/txi2p-tahoe/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     parsley
     twisted
diff --git a/pkgs/development/python-modules/typed-settings/default.nix b/pkgs/development/python-modules/typed-settings/default.nix
index 3511a87127ba..6415e590af06 100644
--- a/pkgs/development/python-modules/typed-settings/default.nix
+++ b/pkgs/development/python-modules/typed-settings/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "typed-settings";
-  version = "23.0.1";
+  version = "23.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "typed_settings";
     inherit version;
-    hash = "sha256-gnwiSCVWU0mpUDiHt9GE2DtfFd2xpOsDL5r/fFctkg4=";
+    hash = "sha256-0esWiZ0dVnIJ+TDSD+0+zq63I1JcKH3iVe34pFRQX9U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-psutil/default.nix b/pkgs/development/python-modules/types-psutil/default.nix
index 8e01ec2c3ff3..fcfd7f5d0a65 100644
--- a/pkgs/development/python-modules/types-psutil/default.nix
+++ b/pkgs/development/python-modules/types-psutil/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-psutil";
-  version = "5.9.5.16";
+  version = "5.9.5.17";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TpshnvtiXT0E9r8QaTT4fKtJqkGpSwo7MIlAP0enkig=";
+    hash = "sha256-99h2mBLXKktRPX7J61WA/i9gE/wnA5SmA8tlNIEfPk0=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/types-psycopg2/default.nix b/pkgs/development/python-modules/types-psycopg2/default.nix
new file mode 100644
index 000000000000..4050efead48d
--- /dev/null
+++ b/pkgs/development/python-modules/types-psycopg2/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "types-psycopg2";
+  version = "2.9.21.20";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-c7rqaJV1v1uxuRW3g/sFJARMYkKSiu7xrlqeMvB4DT0=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "psycopg2-stubs"
+  ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Typing stubs for psycopg2";
+    homepage = "https://github.com/python/typeshed";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/types-pyyaml/default.nix b/pkgs/development/python-modules/types-pyyaml/default.nix
index 58a66197d00b..c8735dbfe6de 100644
--- a/pkgs/development/python-modules/types-pyyaml/default.nix
+++ b/pkgs/development/python-modules/types-pyyaml/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "types-pyyaml";
-  version = "6.0.12.11";
+  version = "6.0.12.12";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "types-PyYAML";
     inherit version;
-    hash = "sha256-fTQLGcoozd/bpDjuY4zUCEveIT5QGjl4c4VD4nCUd1s=";
+    hash = "sha256-M0Nz05L94P35WvXD8WYYhfoQxSFnsUWT64ViieGFUGI=";
   };
 
   # Module doesn't have tests
diff --git a/pkgs/development/python-modules/types-requests/default.nix b/pkgs/development/python-modules/types-requests/default.nix
index 42e1bcb61d24..74ebca264a61 100644
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, urllib3
 , types-urllib3
 }:
 
@@ -17,6 +18,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    urllib3
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-setuptools/default.nix b/pkgs/development/python-modules/types-setuptools/default.nix
index 2d7dbc81c5c1..d98aea408b94 100644
--- a/pkgs/development/python-modules/types-setuptools/default.nix
+++ b/pkgs/development/python-modules/types-setuptools/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-setuptools";
-  version = "69.0.0.20240106";
+  version = "68.2.0.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4Hf5CJV43zyZOPbkqhYz8YK6Z0Cm/bEzPxYrrl38utw=";
+    hash = "sha256-Ce/DgK1cf3jjC8oVRvcGRpVozyYITPq3Ps+D3qHShEY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index 72302723c855..6a908dfd8e54 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -2,21 +2,20 @@
 , buildPythonPackage
 , fetchPypi
 , flit-core
-, python
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "typing-extensions";
-  version = "4.7.1";
-  format = "pyproject";
+  version = "4.8.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "typing_extensions";
     inherit version;
-    hash = "sha256-t13cJk8LpWFdt7ohfa65lwGtKVNTxF+elZYzN87u/7I=";
+    hash = "sha256-345DOenLdzV1WMvbzsozwwNxTPhh0e7xXhBwBVrot+8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/uasiren/default.nix b/pkgs/development/python-modules/uasiren/default.nix
index b6771266f2ab..25f28f3d15d3 100644
--- a/pkgs/development/python-modules/uasiren/default.nix
+++ b/pkgs/development/python-modules/uasiren/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage {
     hash = "sha256-NHrnG5Vhz+JZgcTJyfIgGz0Ye+3dFVv2zLCCqw2++oM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/uharfbuzz/default.nix b/pkgs/development/python-modules/uharfbuzz/default.nix
index 34bb5fef6df4..c7e823b74a2d 100644
--- a/pkgs/development/python-modules/uharfbuzz/default.nix
+++ b/pkgs/development/python-modules/uharfbuzz/default.nix
@@ -24,8 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-876gFYyMqeGYoXMdBguV6bi7DJKHJs9HNLw9xRu+Mxk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     cython
     setuptools-scm
diff --git a/pkgs/development/python-modules/unidic/default.nix b/pkgs/development/python-modules/unidic/default.nix
index c138ea8e8d0c..cd8363d6fc97 100644
--- a/pkgs/development/python-modules/unidic/default.nix
+++ b/pkgs/development/python-modules/unidic/default.nix
@@ -35,8 +35,6 @@ buildPythonPackage rec {
   # no tests
   doCheck = false;
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [ requests tqdm wasabi plac platformdirs ];
 
   nativeBuildInputs = [ cython mecab setuptools-scm ];
diff --git a/pkgs/development/python-modules/uqbar/default.nix b/pkgs/development/python-modules/uqbar/default.nix
index e6633ab2e676..3af7ba636e9e 100644
--- a/pkgs/development/python-modules/uqbar/default.nix
+++ b/pkgs/development/python-modules/uqbar/default.nix
@@ -21,6 +21,10 @@ buildPythonPackage rec {
     hash = "sha256-cEhWXGtMSXVjT5QigDedjT/lwYQnVqPCE5vbctXWznk=";
   };
 
+  postPatch = ''
+    sed -i '/"black"/d' pyproject.toml
+  '';
+
   propagatedBuildInputs = [
     unidecode
     sphinx
diff --git a/pkgs/development/python-modules/uri-template/default.nix b/pkgs/development/python-modules/uri-template/default.nix
index 7bebffce194a..a403417b1093 100644
--- a/pkgs/development/python-modules/uri-template/default.nix
+++ b/pkgs/development/python-modules/uri-template/default.nix
@@ -21,8 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-38HFFqM6yfpsPrhIpE639ePy/NbLqKw7gbnE3y8sL3w=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 7a374f7c0c2c..3c7da587cdde 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -1,18 +1,20 @@
 { lib
-, backports-zoneinfo
-, brotli
-, brotlicffi
 , buildPythonPackage
-, certifi
-, cryptography
 , fetchPypi
-, hatchling
-, idna
 , isPyPy
-, pyopenssl
+
+# build-system
+, hatchling
+
+# optional-dependencies
+, brotli
+, brotlicffi
 , pysocks
-, pytest-timeout
+
+# tests
+, backports-zoneinfo
 , pytestCheckHook
+, pytest-timeout
 , pythonOlder
 , tornado
 , trustme
@@ -20,12 +22,12 @@
 
 let self = buildPythonPackage rec {
   pname = "urllib3";
-  version = "2.0.7";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yX394fe9Q6ccjSpY42npsr9pLRM06p+crlWt19DdD4Q=";
+    hash = "sha256-33qor7AUj6eEiOeJmyxZtfT/z6gubFTMud03wde1LVQ=";
   };
 
   nativeBuildInputs = [
@@ -38,13 +40,6 @@ let self = buildPythonPackage rec {
     ] else [
       brotli
     ];
-    # Use carefully since pyopenssl is not supported aarch64-darwin
-    secure = [
-      certifi
-      cryptography
-      idna
-      pyopenssl
-    ];
     socks = [
       pysocks
     ];
diff --git a/pkgs/development/python-modules/urwid/default.nix b/pkgs/development/python-modules/urwid/default.nix
index 7f9512be2cb1..66a8d830cc2d 100644
--- a/pkgs/development/python-modules/urwid/default.nix
+++ b/pkgs/development/python-modules/urwid/default.nix
@@ -1,11 +1,10 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 
 # build-system
 , setuptools
 , setuptools-scm
-, wheel
 
 # tests
 , glibcLocales
@@ -14,12 +13,14 @@
 
 buildPythonPackage rec {
   pname = "urwid";
-  version = "2.2.1";
+  version = "2.2.3";
   format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-4zkRqxjyxz/dvpvyFtAh504gstWqm+MEA8WPVRMbuKE=";
+  src = fetchFromGitHub {
+    owner = "urwid";
+    repo = "urwid";
+    rev = "refs/tags/${version}";
+    hash = "sha256-oPb2h/+gaqkZTXIiESjExMfBNnOzDvoMkXvkZ/+KVwo=";
   };
 
   postPatch = ''
@@ -29,7 +30,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     setuptools
     setuptools-scm
-    wheel
   ];
 
   nativeCheckInputs = [
@@ -39,9 +39,13 @@ buildPythonPackage rec {
 
   env.LC_ALL = "en_US.UTF8";
 
+  pytestFlagsArray = [
+    "tests"
+  ];
+
   disabledTestPaths = [
     # expect call hangs
-    "urwid/tests/test_vterm.py"
+    "tests/test_vterm.py"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/usort/default.nix b/pkgs/development/python-modules/usort/default.nix
index d8369260587e..2bea93e08275 100644
--- a/pkgs/development/python-modules/usort/default.nix
+++ b/pkgs/development/python-modules/usort/default.nix
@@ -29,8 +29,6 @@ buildPythonPackage rec {
     hash = "sha256-emnrghdsUs+VfvYiJExG13SKQNrXAEtGNAJQLScADnw=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     hatch-vcs
     hatchling
diff --git a/pkgs/development/python-modules/uvicorn/default.nix b/pkgs/development/python-modules/uvicorn/default.nix
index bbec8df096fa..11df7fd78c6e 100644
--- a/pkgs/development/python-modules/uvicorn/default.nix
+++ b/pkgs/development/python-modules/uvicorn/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "uvicorn";
-  version = "0.23.2";
+  version = "0.24.0.post1";
   disabled = pythonOlder "3.8";
 
   format = "pyproject";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "encode";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-98Ahb6syD/J9StwaOqVj/MCdzbHOgey0sixp7SJnROE=";
+    hash = "sha256-WMXOmQOTj/yPazPEAuteho4UH9enXcIa1mMDDl2eaIk=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/vallox-websocket-api/default.nix b/pkgs/development/python-modules/vallox-websocket-api/default.nix
index 21e99902929f..fb3197b6b9e5 100644
--- a/pkgs/development/python-modules/vallox-websocket-api/default.nix
+++ b/pkgs/development/python-modules/vallox-websocket-api/default.nix
@@ -2,6 +2,7 @@
 , aiohttp
 , buildPythonPackage
 , pythonOlder
+, pythonRelaxDepsHook
 , fetchFromGitHub
 , setuptools
 , construct
@@ -26,6 +27,11 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "websockets"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/venusian/default.nix b/pkgs/development/python-modules/venusian/default.nix
index 5b48ee52fadc..b992f518c5fb 100644
--- a/pkgs/development/python-modules/venusian/default.nix
+++ b/pkgs/development/python-modules/venusian/default.nix
@@ -2,22 +2,31 @@
 , buildPythonPackage
 , fetchPypi
 , isPy27
-, pytest
+, pytestCheckHook
 , pytest-cov
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "venusian";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.1.0";
+  pyproject = true;
+
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f6842b7242b1039c0c28f6feef29016e7e7dd3caaeb476a193acf737db31ee38";
+    hash = "sha256-63LNym8xOaFdyA+cldPBD4pUoLqIHu744uxbQtPuOpU=";
   };
 
-  nativeCheckInputs = [ pytest pytest-cov ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov
+  ];
 
   checkPhase = ''
     pytest
diff --git a/pkgs/development/python-modules/versioningit/default.nix b/pkgs/development/python-modules/versioningit/default.nix
index 74a29ae175e9..b87ec1e1a9aa 100644
--- a/pkgs/development/python-modules/versioningit/default.nix
+++ b/pkgs/development/python-modules/versioningit/default.nix
@@ -8,6 +8,7 @@
 , tomli
 , pytestCheckHook
 , build
+, hatchling
 , pydantic
 , pytest-mock
 , git
@@ -16,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "versioningit";
-  version = "2.2.0";
+  version = "2.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6xjnunJoqIC/HM/pLlNOlqs04Dl/KNy8s/wNpPaltr0=";
+    hash = "sha256-HQ1xz6PCvE+N+z1KFcFE64qmoJ2dqYkj1BCZSi74Juo=";
   };
 
   postPatch = ''
@@ -33,9 +34,12 @@ buildPythonPackage rec {
       --replace "--no-cov-on-fail" ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     packaging
-    setuptools
   ] ++ lib.optionals (pythonOlder "3.10") [
     importlib-metadata
   ] ++ lib.optionals (pythonOlder "3.11") [
@@ -45,6 +49,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     build
+    hatchling
     pydantic
     pytest-mock
     git
diff --git a/pkgs/development/python-modules/vilfo-api-client/default.nix b/pkgs/development/python-modules/vilfo-api-client/default.nix
index 5c0d66e7c0cf..99a10fd320d3 100644
--- a/pkgs/development/python-modules/vilfo-api-client/default.nix
+++ b/pkgs/development/python-modules/vilfo-api-client/default.nix
@@ -30,8 +30,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     getmac
     requests
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index 18db218039d3..a79b5bcd6cc1 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.24.5";
+  version = "20.25.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6DYZZ/bab73xQmSDv+n8qCh8JCrAvDBCmQVyHO+/91I=";
+    hash = "sha256-v1HA2cfdY+qORAhvoeT7EJOjHpY7hpWSVzeK7wIOHxs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/vispy/default.nix b/pkgs/development/python-modules/vispy/default.nix
index ae52494d78cd..ad8d696f91d9 100644
--- a/pkgs/development/python-modules/vispy/default.nix
+++ b/pkgs/development/python-modules/vispy/default.nix
@@ -3,22 +3,25 @@
 , buildPythonPackage
 , substituteAll
 , fetchPypi
-, cython
+, cython_3
 , fontconfig
 , freetype-py
 , hsluv
 , kiwisolver
 , libGL
 , numpy
+, oldest-supported-numpy
+, packaging
 , pythonOlder
+, setuptools
 , setuptools-scm
-, setuptools-scm-git-archive
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "vispy";
   version = "0.14.1";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -36,9 +39,11 @@ buildPythonPackage rec {
   ];
 
   nativeBuildInputs = [
-    cython
+    cython_3
+    oldest-supported-numpy
+    setuptools
     setuptools-scm
-    setuptools-scm-git-archive
+    wheel
   ];
 
   buildInputs = [
@@ -46,11 +51,11 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
-    fontconfig
     freetype-py
     hsluv
     kiwisolver
     numpy
+    packaging
   ];
 
   doCheck = false;  # otherwise runs OSX code on linux.
diff --git a/pkgs/development/python-modules/voluptuous/default.nix b/pkgs/development/python-modules/voluptuous/default.nix
index 452d95eede33..47e3d029106b 100644
--- a/pkgs/development/python-modules/voluptuous/default.nix
+++ b/pkgs/development/python-modules/voluptuous/default.nix
@@ -1,21 +1,29 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "voluptuous";
-  version = "0.13.1";
-  format = "setuptools";
+  version = "0.14.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "alecthomas";
-    repo = pname;
-    rev = version;
-    hash = "sha256-cz3Bd+/yPh+VOHxzi/W+gbDh/H5Nl/n4jvxDOirmAVk=";
+    repo = "voluptuous";
+    rev = "refs/tags/${version}";
+    hash = "sha256-7KXuypcKoqZboHTzoNKK5sYUR57wWGJu6y9zkLecep0=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -30,7 +38,9 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python data validation library";
+    downloadPage = "https://github.com/alecthomas/voluptuous";
     homepage = "http://alecthomas.github.io/voluptuous/";
+    changelog = "https://github.com/alecthomas/voluptuous/blob/${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index 935c79b1f233..c0720c4757a5 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -52,7 +52,7 @@
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.15.11";
+  version = "0.16.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -61,7 +61,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-WaVgyF+pQgFCqIsi5Tcu+btyUKU2e3/qJi4Ma8dnx8M=";
+    hash = "sha256-XXs9KjiAPzZ932r4UJ87RpM+qhg/bNDWEYsq2Ua6SRw=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/wavedrom/default.nix b/pkgs/development/python-modules/wavedrom/default.nix
index 25e7222608b0..32fa68a9dabd 100644
--- a/pkgs/development/python-modules/wavedrom/default.nix
+++ b/pkgs/development/python-modules/wavedrom/default.nix
@@ -22,8 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-MntNXcpZPIElfCAv6lFvepCHR/sRUnw1nwNPW3r39Hs=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/wavefile/default.nix b/pkgs/development/python-modules/wavefile/default.nix
index 4ced79638a82..4a8272e2f668 100644
--- a/pkgs/development/python-modules/wavefile/default.nix
+++ b/pkgs/development/python-modules/wavefile/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "wavefile";
-  version = "1.5";
-  format = "setuptools";
+  version = "1.6.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "vokimon";
     repo = "python-wavefile";
-    rev = "python-wavefile-${version}";
-    sha256 = "9sHj1gb93mCVpejRGSdLJzeFDCeTflZctE7kMWfqFrE=";
+    rev = "refs/tags/python-wavefile-${version}";
+    hash = "sha256-TLSWhLARY+3sHkl2p3d3LDGzLu6DggjTJWFpyrwRXSI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wcwidth/default.nix b/pkgs/development/python-modules/wcwidth/default.nix
index badb09bbef11..ee12162a0632 100644
--- a/pkgs/development/python-modules/wcwidth/default.nix
+++ b/pkgs/development/python-modules/wcwidth/default.nix
@@ -4,17 +4,21 @@
 
 buildPythonPackage rec {
   pname = "wcwidth";
-  version = "0.2.6";
-  format = "setuptools";
+  version = "0.2.12";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pSIHgKQE2+M1N4mHCXjkcs/kd3YfBu5VB3JW5QmxVtA=";
+    hash = "sha256-8BwQTv31eXG8t1bwVN1Y3exSBN0V+jHWUD6leUfZfAI=";
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = [ setuptools ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   # To prevent infinite recursion with pytest
   doCheck = false;
diff --git a/pkgs/development/python-modules/weaviate-client/default.nix b/pkgs/development/python-modules/weaviate-client/default.nix
index 28c3a7547e08..e87694dfe50e 100644
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -20,8 +20,6 @@ buildPythonPackage rec {
     hash = "sha256-7oCb8tH1pQDJpoxe3C6xdKtRQqNoAuJ0qySv5nX/sos=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace "validators>=0.18.2,<=0.21.0" "validators>=0.18.2" \
diff --git a/pkgs/development/python-modules/webdav4/default.nix b/pkgs/development/python-modules/webdav4/default.nix
index 22c1ea8a964e..cc353777f632 100644
--- a/pkgs/development/python-modules/webdav4/default.nix
+++ b/pkgs/development/python-modules/webdav4/default.nix
@@ -28,8 +28,6 @@ buildPythonPackage rec {
     hash = "sha256-Le/gABaUxMmSW2SjgucsBKqjxOq1h9UCAWl5YyUsCPk=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace " --cov" ""
diff --git a/pkgs/development/python-modules/websocket-client/default.nix b/pkgs/development/python-modules/websocket-client/default.nix
index 26c27825f7bd..f4d33df53144 100644
--- a/pkgs/development/python-modules/websocket-client/default.nix
+++ b/pkgs/development/python-modules/websocket-client/default.nix
@@ -1,23 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, pythonOlder
 , pytestCheckHook
 , python-socks
+, pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "websocket-client";
-  version = "1.6.3";
-  format = "setuptools";
+  version = "1.6.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Oq0l0xKEJmvPz9H9inQ/YygjBaNkuNCUikO9YGrMZS8=";
+    hash = "sha256-szJAGbPChXIIbEoxn5HR3NRObhHNNAIyl4xoSnZQ0N8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     python-socks
    ];
diff --git a/pkgs/development/python-modules/websockets/default.nix b/pkgs/development/python-modules/websockets/default.nix
index ec6e429f5945..770e6e654caf 100644
--- a/pkgs/development/python-modules/websockets/default.nix
+++ b/pkgs/development/python-modules/websockets/default.nix
@@ -4,12 +4,13 @@
 , fetchFromGitHub
 , unittestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "websockets";
-  version = "11.0.3";
-  format = "setuptools";
+  version = "12.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -17,9 +18,13 @@ buildPythonPackage rec {
     owner = "aaugustin";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-RdkbIiZI/UYsWdnnl5gJPsnJ/6adfFtkiXC7MO/HwcI=";
+    hash = "sha256-sOL3VI9Ib/PncZs5KN4dAIHOrBc7LfXqT15LO4M6qKg=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   patchPhase = ''
     # Disable all tests that need to terminate within a predetermined amount of
     # time. This is nondeterministic.
diff --git a/pkgs/development/python-modules/webtest/default.nix b/pkgs/development/python-modules/webtest/default.nix
index ce34b045fd67..52d48505df47 100644
--- a/pkgs/development/python-modules/webtest/default.nix
+++ b/pkgs/development/python-modules/webtest/default.nix
@@ -2,6 +2,7 @@
 , beautifulsoup4
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , pastedeploy
 , pyquery
 , pytestCheckHook
@@ -25,6 +26,15 @@ buildPythonPackage rec {
     hash = "sha256-VL2WlyWDjZhhqfon+Nlx950nXZSuJV9cUB9Tu22ZKes=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Replace deprecated unittest aliases for Python 3.12
+      name = "webtest-python312-compat.patch";
+      url = "https://github.com/Pylons/webtest/commit/d82ec5bd2cf3c7109a1d49ad9fa802ae1eae1763.patch";
+      hash = "sha256-hSwxAxAI3Eo28I8S+r2k/hFG8TlzrVYup3MuTsE+xXk=";
+    })
+  ];
+
   propagatedBuildInputs = [
     beautifulsoup4
     six
diff --git a/pkgs/development/python-modules/werkzeug/default.nix b/pkgs/development/python-modules/werkzeug/default.nix
index db045e77c52f..35c5f943cb19 100644
--- a/pkgs/development/python-modules/werkzeug/default.nix
+++ b/pkgs/development/python-modules/werkzeug/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "werkzeug";
-  version = "2.3.7";
+  version = "2.3.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-K4wORHtLnbzIXdl7butNy69si2w74L1lTiVVPgohV9g=";
+    hash = "sha256-VUslfHS763oNJUFgpPj/4YUkP1KlIDUGC3Ycpi2XfwM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wheel/default.nix b/pkgs/development/python-modules/wheel/default.nix
index 16c6c2dc087d..2b9626190500 100644
--- a/pkgs/development/python-modules/wheel/default.nix
+++ b/pkgs/development/python-modules/wheel/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "wheel";
-  version = "0.41.1";
+  version = "0.42.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = pname;
-    rev = version;
-    hash = "sha256-/EaDJ2zI/ly2BrrGhiZGwiBYDVPYWTki+87UqtCS3bw=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-WML3/gAK1R9DEeRVZWeO0VRFuNVKP52i5I5mYV6vQcI=";
     postFetch = ''
       cd $out
       mv tests/testdata/unicode.dist/unicodedist/åäö_日本語.py \
diff --git a/pkgs/development/python-modules/wikitextparser/default.nix b/pkgs/development/python-modules/wikitextparser/default.nix
index b7af5aeeb652..5f4435c91694 100644
--- a/pkgs/development/python-modules/wikitextparser/default.nix
+++ b/pkgs/development/python-modules/wikitextparser/default.nix
@@ -1,6 +1,7 @@
 { buildPythonPackage
 , fetchFromGitHub
 , lib
+, setuptools
 , pytestCheckHook
 , regex
 , wcwidth
@@ -18,6 +19,10 @@ buildPythonPackage rec {
     hash = "sha256-cmzyRbq4tCbuyrNnT0UYxoxuwXrFkIcWdrogSTfxSys=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     wcwidth
     regex
diff --git a/pkgs/development/python-modules/willow/default.nix b/pkgs/development/python-modules/willow/default.nix
index 1787faa38905..7f5b06223ee6 100644
--- a/pkgs/development/python-modules/willow/default.nix
+++ b/pkgs/development/python-modules/willow/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "willow";
-  version = "1.6.2";
+  version = "1.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "2.7";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "wagtail";
     repo = "Willow";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dW2FVN3/mBAhVQ094uBsnXzdyTRKgHUDx0SWLm3g374=";
+    hash = "sha256-+ubylc/Zuw3DSSgtTg2dO3Zj0gpTJcLbb1J++caxS7w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/withings-api/default.nix b/pkgs/development/python-modules/withings-api/default.nix
index 5be701fa298f..226907f9e95d 100644
--- a/pkgs/development/python-modules/withings-api/default.nix
+++ b/pkgs/development/python-modules/withings-api/default.nix
@@ -52,5 +52,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/vangorra/python_withings_api";
     license = licenses.mit;
     maintainers = with maintainers; [ kittywitch ];
+    broken = versionAtLeast pydantic.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/wrapt/default.nix b/pkgs/development/python-modules/wrapt/default.nix
index 268f2775d5cf..3995e291bc3a 100644
--- a/pkgs/development/python-modules/wrapt/default.nix
+++ b/pkgs/development/python-modules/wrapt/default.nix
@@ -8,15 +8,15 @@
 
 buildPythonPackage rec {
   pname = "wrapt";
-  version = "1.14.1";
+  version = "1.16.0";
   outputs = [ "out" "doc" ];
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "GrahamDumpleton";
     repo = pname;
-    rev = version;
-    hash = "sha256-nXwDuNo4yZxgjnkus9bVwIZltPaSH93D+PcZMGT2nGM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-lVpSriXSvRwAKX4iPOIBvJwhqhKjdrUdGaEG4QoTQyo=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/wsme/default.nix b/pkgs/development/python-modules/wsme/default.nix
index 764977051635..7af0f410969b 100644
--- a/pkgs/development/python-modules/wsme/default.nix
+++ b/pkgs/development/python-modules/wsme/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , pythonAtLeast
 , pbr
+, setuptools
 , six
 , simplegeneric
 , netaddr
@@ -22,18 +23,21 @@
 
 buildPythonPackage rec {
   pname = "wsme";
-  version = "0.11.0";
-  format = "setuptools";
+  version = "0.12.1";
+  pyproject = true;
 
   disabled = pythonAtLeast "3.9";
 
   src = fetchPypi {
     pname = "WSME";
     inherit version;
-    sha256 = "bd2dfc715bedcc8f4649611bc0c8a238f483dc01cff7102bc1efa6bea207b64b";
+    hash = "sha256-m36yJErzxwSskUte0iGVS7aK3QqLKy84okSwZ7M3mS0=";
   };
 
-  nativeBuildInputs = [ pbr ];
+  nativeBuildInputs = [
+    pbr
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     netaddr
diff --git a/pkgs/development/python-modules/wtforms/default.nix b/pkgs/development/python-modules/wtforms/default.nix
index deffda6ef5fe..4b724ce6acbd 100644
--- a/pkgs/development/python-modules/wtforms/default.nix
+++ b/pkgs/development/python-modules/wtforms/default.nix
@@ -1,29 +1,45 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, markupsafe
+, fetchFromGitHub
+, pythonOlder
+
+# build-system
 , babel
-, pytestCheckHook
+, hatchling
+, setuptools
+
+# dependencies
+, markupsafe
+
+# optional-dependencies
 , email-validator
-, pythonOlder
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "wtforms";
-  version = "3.0.1";
-  format = "setuptools";
+  version = "3.1.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    pname = "WTForms";
-    inherit version;
-    hash = "sha256-azUbuxLdWK9X/+8FvHhCXQjRkU4P1o7hQUO3reAjxbw=";
+  src = fetchFromGitHub {
+    owner = "wtforms";
+    repo = "wtforms";
+    rev = "refs/tags/${version}";
+    hash = "sha256-9EryEXGlGCtDH/XPM4Oihla42HnY0nho9DaauHfYnNQ=";
   };
 
+  nativeBuildInputs = [
+    babel
+    hatchling
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     markupsafe
-    babel
   ];
 
   passthru.optional-dependencies = {
@@ -34,7 +50,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+  ] ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "wtforms"
diff --git a/pkgs/development/python-modules/xarray/default.nix b/pkgs/development/python-modules/xarray/default.nix
index 12cefa0332aa..70b99d5091f6 100644
--- a/pkgs/development/python-modules/xarray/default.nix
+++ b/pkgs/development/python-modules/xarray/default.nix
@@ -13,18 +13,16 @@
 
 buildPythonPackage rec {
   pname = "xarray";
-  version = "2023.8.0";
+  version = "2023.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-glxtZCAqcxpOSTIe3R6d+r9L4GgC8bjIo8AKPr/Izt8=";
+    hash = "sha256-mkXhB0GES1+UjY4edotGDffpBpbRji7/LB1H9dnVAlI=";
   };
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/xbox-webapi/default.nix b/pkgs/development/python-modules/xbox-webapi/default.nix
index c2caa4fb3778..c5180c1f15c0 100644
--- a/pkgs/development/python-modules/xbox-webapi/default.nix
+++ b/pkgs/development/python-modules/xbox-webapi/default.nix
@@ -2,54 +2,51 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, aiohttp
+, setuptools
 , appdirs
 , ecdsa
+, httpx
 , ms-cv
 , pydantic
-, aresponses
 , pytest-asyncio
 , pytestCheckHook
+, respx
 }:
 
 buildPythonPackage rec {
   pname = "xbox-webapi";
-  version = "2.0.11";
-  format = "setuptools";
+  version = "2.1.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "OpenXbox";
     repo = "xbox-webapi-python";
     rev = "v${version}";
-    sha256 = "0li0bq914xizx9fj49s1iwfrv4bpzvl74bwsi5a34r9yizw02cvz";
+    hash = "sha256-9A3gdSlRjBCx5fBW+jkaSWsFuGieXQKvbEbZzGzLf94=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "pytest-runner" ""
-  '';
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
-    aiohttp
     appdirs
     ecdsa
+    httpx
     ms-cv
     pydantic
   ];
 
   nativeCheckInputs = [
-    aresponses
     pytest-asyncio
     pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    "--asyncio-mode=auto"
+    respx
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/OpenXbox/xbox-webapi-python/blob/${src.rev}/CHANGELOG.md";
     description = "Library to authenticate with Windows Live/Xbox Live and use their API";
     homepage = "https://github.com/OpenXbox/xbox-webapi-python";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/xformers/default.nix b/pkgs/development/python-modules/xformers/default.nix
index bf2d415b3e7d..164513da94c8 100644
--- a/pkgs/development/python-modules/xformers/default.nix
+++ b/pkgs/development/python-modules/xformers/default.nix
@@ -25,7 +25,7 @@
 #, flash-attn
 }:
 let
-  version = "0.0.22.post7";
+  version = "0.03";
 in
 buildPythonPackage {
   pname = "xformers";
@@ -38,7 +38,7 @@ buildPythonPackage {
     owner = "facebookresearch";
     repo = "xformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7lZi3+2dVDZJFYCUlxsyDU8t9qdnl+b2ERRXKA6Zp7U=";
+    hash = "sha256-G8f7tny5B8SAQ6+2uOjhY7nD0uOT4sskIwtTdwivQXo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/xxhash/default.nix b/pkgs/development/python-modules/xxhash/default.nix
index 4f226e731295..6eb774677bfc 100644
--- a/pkgs/development/python-modules/xxhash/default.nix
+++ b/pkgs/development/python-modules/xxhash/default.nix
@@ -1,27 +1,35 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, setuptools-scm
+, pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
-  version = "3.3.0";
-  format = "setuptools";
   pname = "xxhash";
+  version = "3.4.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-w/njIrHr7r1E49nS2bEk4MVQwe9BvVUq/c3XGVFu5Bo=";
+    hash = "sha256-A3nWzx/5h81CFgmiZM4CXnTzRuPhRd0QbAzC4+w/mak=";
   };
 
   nativeBuildInputs = [
-    setuptools-scm
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "xxhash"
   ];
 
   meta = with lib; {
+    description = "Python Binding for xxHash";
     homepage = "https://github.com/ifduyue/python-xxhash";
-    description = "Python Binding for xxHash https://pypi.org/project/xxhash/";
+    changelog = "https://github.com/ifduyue/python-xxhash/blob/v${version}/CHANGELOG.rst";
     license = licenses.bsd2;
-    maintainers = [ maintainers.teh ];
+    maintainers = with maintainers; [ teh ];
   };
 }
diff --git a/pkgs/development/python-modules/xyzservices/default.nix b/pkgs/development/python-modules/xyzservices/default.nix
index 797242993f92..8836d5195fc2 100644
--- a/pkgs/development/python-modules/xyzservices/default.nix
+++ b/pkgs/development/python-modules/xyzservices/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "xyzservices";
-  version = "2023.7.0";
+  version = "2023.10.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DskodCIn1vXUNn6ntFf8/tlDQp9N4pSbWwKoLN9VadY=";
+    hash = "sha256-CRIpJpBDvIJYBC7b7a1Py0RoSwRz7eAntWcq1A3J+gI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yapf/default.nix b/pkgs/development/python-modules/yapf/default.nix
index 0084082c1687..70f31fe5308b 100644
--- a/pkgs/development/python-modules/yapf/default.nix
+++ b/pkgs/development/python-modules/yapf/default.nix
@@ -1,25 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPyPy
-, nose
+
+# build-system
+, setuptools
+
+# dependencies
 , importlib-metadata
 , platformdirs
 , tomli
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "yapf";
-  version = "0.40.1";
-  format = "setuptools";
+  version = "0.40.2";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lYWH61yOxshgEZqcJdAq3fMKRPdaoVKkIg0w5WqYA3w=";
+    hash = "sha256-TauKXtcTTibVfBZHx0g6+z8TaHi1eQYreGyboWuUY3s=";
   };
 
-  # nose is unavailable on pypy
-  doCheck = !isPyPy;
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     importlib-metadata
@@ -27,11 +34,15 @@ buildPythonPackage rec {
     tomli
   ];
 
+  # nose is unavailable on pypy
+  #doCheck = !isPyPy;
+
   nativeCheckInputs = [
-    nose
+    pytestCheckHook
   ];
 
   meta = {
+    changelog = "https://github.com/google/yapf/blob/v${version}/CHANGELOG.md";
     homepage = "https://github.com/google/yapf";
     description = "Yet Another Python Formatter";
     longDescription = ''
diff --git a/pkgs/development/python-modules/yarl/default.nix b/pkgs/development/python-modules/yarl/default.nix
index c4d8dac9995c..6b8e17d2ed19 100644
--- a/pkgs/development/python-modules/yarl/default.nix
+++ b/pkgs/development/python-modules/yarl/default.nix
@@ -1,40 +1,40 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
-, pythonAtLeast
 , pythonOlder
+, cython_3
+, expandvars
+, setuptools
 , idna
 , multidict
 , typing-extensions
+, pytest-xdist
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "yarl";
-  version = "1.9.2";
+  version = "1.9.4";
 
   disabled = pythonOlder "3.7";
 
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BKudS59YfAbYAcKr/pMXt3zfmWxlqQ1ehOzEUBCCNXE=";
+    hash = "sha256-Vm24ZxfPgIC5m1iwg7dzqQiuQPBmgeh+WJqXb6+CRr8=";
   };
 
-  patches = [
-    # https://github.com/aio-libs/yarl/issues/876
-    (fetchpatch {
-      url = "https://github.com/aio-libs/yarl/commit/0a94c6e4948e00fff072c0cf367afbf4ac36f906.patch";
-      hash = "sha256-bqT46OLZLkBef8FQ1L95ITD70mC3+WIkr3+h2ekKrvE=";
-    })
-  ];
-
   postPatch = ''
-    sed -i '/^addopts/d' setup.cfg
+    sed -i '/cov/d' pytest.ini
   '';
 
+  nativeBuildInputs = [
+    cython_3
+    expandvars
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     idna
     multidict
@@ -48,6 +48,7 @@ buildPythonPackage rec {
   '';
 
   nativeCheckInputs = [
+    pytest-xdist
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/ytmusicapi/default.nix b/pkgs/development/python-modules/ytmusicapi/default.nix
index 0ba3d4fd7f89..d0aebbc5138c 100644
--- a/pkgs/development/python-modules/ytmusicapi/default.nix
+++ b/pkgs/development/python-modules/ytmusicapi/default.nix
@@ -26,8 +26,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = [
     requests
   ];
diff --git a/pkgs/development/python-modules/zarr/default.nix b/pkgs/development/python-modules/zarr/default.nix
index 78610073af01..8be14e23e7d0 100644
--- a/pkgs/development/python-modules/zarr/default.nix
+++ b/pkgs/development/python-modules/zarr/default.nix
@@ -4,6 +4,7 @@
 , fasteners
 , fetchPypi
 , numcodecs
+, msgpack
 , numpy
 , pytestCheckHook
 , pythonOlder
@@ -31,7 +32,7 @@ buildPythonPackage rec {
     numpy
     fasteners
     numcodecs
-  ];
+  ] ++ numcodecs.optional-dependencies.msgpack;
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/zeep/default.nix b/pkgs/development/python-modules/zeep/default.nix
index e94f5f23834b..75e23838c0a4 100644
--- a/pkgs/development/python-modules/zeep/default.nix
+++ b/pkgs/development/python-modules/zeep/default.nix
@@ -76,6 +76,15 @@ buildPythonPackage rec {
   ]
   ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
+  disabledTests = [
+    # Failed: External connections not allowed during tests.
+    "test_has_expired"
+    "test_has_not_expired"
+    "test_memory_cache_timeout"
+    "test_bytes_like_password_digest"
+    "test_password_digest"
+  ];
+
   preCheck = ''
     export HOME=$TMPDIR
   '';
diff --git a/pkgs/development/python-modules/zeroc-ice/default.nix b/pkgs/development/python-modules/zeroc-ice/default.nix
index b830634eb52a..39ee5b6cba7d 100644
--- a/pkgs/development/python-modules/zeroc-ice/default.nix
+++ b/pkgs/development/python-modules/zeroc-ice/default.nix
@@ -1,16 +1,30 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, openssl, bzip2 }:
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, bzip2
+, openssl
+}:
 
 buildPythonPackage rec {
   pname = "zeroc-ice";
-  version = "3.7.9.1";
-  format = "setuptools";
+  version = "3.7.10";
+  pyproject = true;
 
   src = fetchPypi {
     inherit version pname;
-    hash = "sha256-MOVsYfUq3n62hPEUIOGA75RviGofHcXaJKMnYERxg74=";
+    hash = "sha256-Bwn2Y/Bbu6O89iaSNWvMpXBhyJRmj6eL8j6HiPpbQbM=";
   };
 
-  buildInputs = [ openssl bzip2 ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  buildInputs = [
+    bzip2
+    openssl
+  ];
 
   pythonImportsCheck = [ "Ice" ];
 
diff --git a/pkgs/development/python-modules/zfec/default.nix b/pkgs/development/python-modules/zfec/default.nix
index 12253f43d868..fc3b710919bc 100644
--- a/pkgs/development/python-modules/zfec/default.nix
+++ b/pkgs/development/python-modules/zfec/default.nix
@@ -1,20 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , pyutil
 , twisted
 }:
 
 buildPythonPackage rec {
   pname = "zfec";
-  version = "1.5.7.2";
-  format = "setuptools";
+  version = "1.5.7.4";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TuUZvg3MfaLohIK8/Av5d6Ql4dfoJ4z1u7uNAPiir7Y=";
+    hash = "sha256-EGmFchj4ur5AhEOXEnIIA6Ef6RsU8gvHepak5vThER8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [ pyutil ];
 
   nativeCheckInputs = [ twisted ];
diff --git a/pkgs/development/python-modules/zipp/default.nix b/pkgs/development/python-modules/zipp/default.nix
index 1b033810b5b4..6555d172ce2e 100644
--- a/pkgs/development/python-modules/zipp/default.nix
+++ b/pkgs/development/python-modules/zipp/default.nix
@@ -9,14 +9,14 @@
 
 let zipp = buildPythonPackage rec {
   pname = "zipp";
-  version = "3.16.2";
+  version = "3.17.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-68FZRqp4vWNFiZL8gew7b3sektUcNebeHDgE5zt5kUc=";
+    hash = "sha256-hOZKHCjPfpHtIHi7jMjCWcsZt2lCCWyNe4SUdpDKuvA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/zope-hookable/default.nix b/pkgs/development/python-modules/zope-hookable/default.nix
index 0d1e5a7ddb42..8ee46c58943f 100644
--- a/pkgs/development/python-modules/zope-hookable/default.nix
+++ b/pkgs/development/python-modules/zope-hookable/default.nix
@@ -1,21 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , zope-testing
 }:
 
 buildPythonPackage rec {
   pname = "zope-hookable";
-  version = "5.4";
-  format = "setuptools";
+  version = "6.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "zope.hookable";
     inherit version;
-    hash = "sha256-+2AfAKyH5apYKoExXtlnaM41EygHKdP1H3kxLiuLlKw=";
+    hash = "sha256-FmiZPUCnz9yGeEPdVyWSnn+DpbDBlccJrx2u+CdPQ8s=";
   };
 
-  nativeCheckInputs = [ zope-testing ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    zope-testing
+  ];
 
   meta = with lib; {
     description = "Supports the efficient creation of “hookable” objects";
diff --git a/pkgs/development/python-modules/zope-i18nmessageid/default.nix b/pkgs/development/python-modules/zope-i18nmessageid/default.nix
index 3331be330db3..0b0ef641d329 100644
--- a/pkgs/development/python-modules/zope-i18nmessageid/default.nix
+++ b/pkgs/development/python-modules/zope-i18nmessageid/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "zope-i18nmessageid";
-  version = "6.0.1";
+  version = "6.1.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "zope.i18nmessageid";
     inherit version;
-    hash = "sha256-LVvOb7MfHOoO+iZEZJvIZ9KXIwPx272f/vzlsuueAXY=";
+    hash = "sha256-Rawm/chvq997ePHBvM/B1DctGlSDi7rt2p26dEStiUE=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/zstandard/default.nix b/pkgs/development/python-modules/zstandard/default.nix
index 2bc20be4d4ed..ae75db9f7b13 100644
--- a/pkgs/development/python-modules/zstandard/default.nix
+++ b/pkgs/development/python-modules/zstandard/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "zstandard";
-  version = "0.21.0";
+  version = "0.22.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8I46ENAaJHh35MthqCoxnqdGw1ajeGVYvtJIHmxAVUY=";
+    hash = "sha256-giajPFQry1TNa9CjZgZ7YQtBcTtkyavsG8RTPWn1HnA=";
   };
 
   propagatedNativeBuildInputs = [
diff --git a/pkgs/development/python2-modules/wcwidth/default.nix b/pkgs/development/python2-modules/wcwidth/default.nix
index 8424fa462503..023b92a86907 100644
--- a/pkgs/development/python2-modules/wcwidth/default.nix
+++ b/pkgs/development/python2-modules/wcwidth/default.nix
@@ -3,7 +3,7 @@
 }:
 
 wcwidth.overridePythonAttrs(oldAttrs: {
-  propagatedBuildInputs = oldAttrs.propagatedBuildInputs ++ [
+  propagatedBuildInputs = oldAttrs.propagatedBuildInputs or [] ++ [
     backports-functools-lru-cache
   ];
 })
diff --git a/pkgs/development/rocm-modules/5/default.nix b/pkgs/development/rocm-modules/5/default.nix
index 204e0ee2abbe..aaf000b79f13 100644
--- a/pkgs/development/rocm-modules/5/default.nix
+++ b/pkgs/development/rocm-modules/5/default.nix
@@ -1,4 +1,5 @@
-{ callPackage
+{ gcc12Stdenv # FIXME: Try removing this with a new ROCm release https://github.com/NixOS/nixpkgs/issues/271943
+, callPackage
 , recurseIntoAttrs
 , symlinkJoin
 , fetchFromGitHub
@@ -73,10 +74,11 @@ in rec {
   # Broken, too many errors
   rdc = callPackage ./rdc {
     inherit rocmUpdateScript rocm-smi rocm-runtime;
+    stdenv = gcc12Stdenv;
     # stdenv = llvm.rocmClangStdenv;
   };
 
-  rocm-docs-core = python3Packages.callPackage ./rocm-docs-core { };
+  rocm-docs-core = python3Packages.callPackage ./rocm-docs-core { stdenv = gcc12Stdenv; };
 
   hip-common = callPackage ./hip-common {
     inherit rocmUpdateScript;
@@ -106,17 +108,20 @@ in rec {
   rocprofiler = callPackage ./rocprofiler {
     inherit rocmUpdateScript clr rocm-core rocm-thunk rocm-device-libs roctracer rocdbgapi rocm-smi hsa-amd-aqlprofile-bin;
     inherit (llvm) clang;
+    stdenv = gcc12Stdenv;
   };
 
   # Needs GCC
   roctracer = callPackage ./roctracer {
     inherit rocmUpdateScript rocm-device-libs rocm-runtime clr;
+    stdenv = gcc12Stdenv;
   };
 
   # Needs GCC
   rocgdb = callPackage ./rocgdb {
     inherit rocmUpdateScript;
     elfutils = elfutils.override { enableDebuginfod = true; };
+    stdenv = gcc12Stdenv;
   };
 
   rocdbgapi = callPackage ./rocdbgapi {
diff --git a/pkgs/development/rocm-modules/5/llvm/base.nix b/pkgs/development/rocm-modules/5/llvm/base.nix
index 6174963fd998..796a73e1d2c3 100644
--- a/pkgs/development/rocm-modules/5/llvm/base.nix
+++ b/pkgs/development/rocm-modules/5/llvm/base.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, gcc12Stdenv
 , fetchFromGitHub
 , rocmUpdateScript
 , pkg-config
@@ -44,6 +45,13 @@
 , isBroken ? false
 }:
 
+let stdenv' = stdenv; in
+let stdenv =
+      if stdenv'.cc.cc.isGNU or false && lib.versionAtLeast stdenv'.cc.cc.version "13.0"
+      then gcc12Stdenv
+      else stdenv';
+in
+
 let
   llvmNativeTarget =
     if stdenv.isx86_64 then "X86"
diff --git a/pkgs/development/rocm-modules/5/llvm/default.nix b/pkgs/development/rocm-modules/5/llvm/default.nix
index 9226fb87802c..9c8919165a51 100644
--- a/pkgs/development/rocm-modules/5/llvm/default.nix
+++ b/pkgs/development/rocm-modules/5/llvm/default.nix
@@ -1,4 +1,5 @@
-{ stdenv
+{ # stdenv FIXME: Try changing back to this with a new ROCm release https://github.com/NixOS/nixpkgs/issues/271943
+  gcc12Stdenv
 , callPackage
 , rocmUpdateScript
 , wrapBintoolsWith
@@ -12,18 +13,18 @@
 let
   ## Stage 1 ##
   # Projects
-  llvm = callPackage ./stage-1/llvm.nix { inherit rocmUpdateScript; };
-  clang-unwrapped = callPackage ./stage-1/clang-unwrapped.nix { inherit rocmUpdateScript llvm; };
-  lld = callPackage ./stage-1/lld.nix { inherit rocmUpdateScript llvm; };
+  llvm = callPackage ./stage-1/llvm.nix { inherit rocmUpdateScript; stdenv = gcc12Stdenv; };
+  clang-unwrapped = callPackage ./stage-1/clang-unwrapped.nix { inherit rocmUpdateScript llvm; stdenv = gcc12Stdenv; };
+  lld = callPackage ./stage-1/lld.nix { inherit rocmUpdateScript llvm; stdenv = gcc12Stdenv; };
 
   # Runtimes
-  runtimes = callPackage ./stage-1/runtimes.nix { inherit rocmUpdateScript llvm; };
+  runtimes = callPackage ./stage-1/runtimes.nix { inherit rocmUpdateScript llvm; stdenv = gcc12Stdenv; };
 
   ## Stage 2 ##
   # Helpers
   bintools-unwrapped = callPackage ./stage-2/bintools-unwrapped.nix { inherit llvm lld; };
   bintools = wrapBintoolsWith { bintools = bintools-unwrapped; };
-  rStdenv = callPackage ./stage-2/rstdenv.nix { inherit llvm clang-unwrapped lld runtimes bintools; };
+  rStdenv = callPackage ./stage-2/rstdenv.nix { inherit llvm clang-unwrapped lld runtimes bintools; stdenv = gcc12Stdenv; };
 in rec {
   inherit
   llvm
@@ -40,8 +41,8 @@ in rec {
 
   ## Stage 3 ##
   # Helpers
-  clang = callPackage ./stage-3/clang.nix { inherit llvm lld clang-unwrapped bintools libc libunwind libcxxabi libcxx compiler-rt; };
-  rocmClangStdenv = overrideCC stdenv clang;
+  clang = callPackage ./stage-3/clang.nix { inherit llvm lld clang-unwrapped bintools libc libunwind libcxxabi libcxx compiler-rt; stdenv = gcc12Stdenv; };
+  rocmClangStdenv = overrideCC gcc12Stdenv clang;
 
   # Projects
   clang-tools-extra = callPackage ./stage-3/clang-tools-extra.nix { inherit rocmUpdateScript llvm clang-unwrapped; stdenv = rocmClangStdenv; };
diff --git a/pkgs/development/rocm-modules/5/llvm/stage-1/clang-unwrapped.nix b/pkgs/development/rocm-modules/5/llvm/stage-1/clang-unwrapped.nix
index 113313f4e066..5a61732ffd2d 100644
--- a/pkgs/development/rocm-modules/5/llvm/stage-1/clang-unwrapped.nix
+++ b/pkgs/development/rocm-modules/5/llvm/stage-1/clang-unwrapped.nix
@@ -1,10 +1,11 @@
-{ callPackage
+{ stdenv
+, callPackage
 , rocmUpdateScript
 , llvm
 }:
 
 callPackage ../base.nix rec {
-  inherit rocmUpdateScript;
+  inherit stdenv rocmUpdateScript;
   targetName = "clang-unwrapped";
   targetDir = "clang";
   extraBuildInputs = [ llvm ];
diff --git a/pkgs/development/rocm-modules/5/llvm/stage-1/lld.nix b/pkgs/development/rocm-modules/5/llvm/stage-1/lld.nix
index a7b042eabfe6..5ca8bca25a33 100644
--- a/pkgs/development/rocm-modules/5/llvm/stage-1/lld.nix
+++ b/pkgs/development/rocm-modules/5/llvm/stage-1/lld.nix
@@ -1,10 +1,11 @@
-{ callPackage
+{ stdenv
+, callPackage
 , rocmUpdateScript
 , llvm
 }:
 
 callPackage ../base.nix rec {
-  inherit rocmUpdateScript;
+  inherit stdenv rocmUpdateScript;
   buildMan = false; # No man pages to build
   targetName = "lld";
   targetDir = targetName;
diff --git a/pkgs/development/rocm-modules/5/llvm/stage-1/llvm.nix b/pkgs/development/rocm-modules/5/llvm/stage-1/llvm.nix
index 6160e34c1b51..f601e96f0a35 100644
--- a/pkgs/development/rocm-modules/5/llvm/stage-1/llvm.nix
+++ b/pkgs/development/rocm-modules/5/llvm/stage-1/llvm.nix
@@ -4,7 +4,7 @@
 }:
 
 callPackage ../base.nix {
-  inherit rocmUpdateScript;
+  inherit stdenv rocmUpdateScript;
   requiredSystemFeatures = [ "big-parallel" ];
   isBroken = stdenv.isAarch64; # https://github.com/ROCm/ROCm/issues/1831#issuecomment-1278205344
 }
diff --git a/pkgs/development/rocm-modules/5/llvm/stage-1/runtimes.nix b/pkgs/development/rocm-modules/5/llvm/stage-1/runtimes.nix
index 5f6f278ab10e..0364a02e6e59 100644
--- a/pkgs/development/rocm-modules/5/llvm/stage-1/runtimes.nix
+++ b/pkgs/development/rocm-modules/5/llvm/stage-1/runtimes.nix
@@ -1,11 +1,12 @@
 { lib
+, stdenv
 , callPackage
 , rocmUpdateScript
 , llvm
 }:
 
 callPackage ../base.nix rec {
-  inherit rocmUpdateScript;
+  inherit stdenv rocmUpdateScript;
   buildDocs = false;
   buildMan = false;
   buildTests = false;
diff --git a/pkgs/development/rocm-modules/5/llvm/stage-2/rstdenv.nix b/pkgs/development/rocm-modules/5/llvm/stage-2/rstdenv.nix
index 45d369a6541c..3820d45a2b81 100644
--- a/pkgs/development/rocm-modules/5/llvm/stage-2/rstdenv.nix
+++ b/pkgs/development/rocm-modules/5/llvm/stage-2/rstdenv.nix
@@ -12,6 +12,7 @@ overrideCC stdenv (wrapCCWith rec {
   inherit bintools;
   libcxx = runtimes;
   cc = clang-unwrapped;
+  gccForLibs = stdenv.cc.cc;
 
   extraPackages = [
     llvm
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index c4c3cd8b8d23..05d1bfbf64e6 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.22";
-  source.sha256 = "sha256-dHulCw5n3yXL07SPlYMad6TVOlgdVfBjly/LFG0ULF8=";
+  version = "2.5.3";
+  source.sha256 = "sha256-JJzQdaxPM1rnD3iMm+D0wYgJOk2n0FvVO+K67z8l58s=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/tools/aws-sam-cli/default.nix b/pkgs/development/tools/aws-sam-cli/default.nix
index 9d2e2e0bb821..093c5a1ab9e0 100644
--- a/pkgs/development/tools/aws-sam-cli/default.nix
+++ b/pkgs/development/tools/aws-sam-cli/default.nix
@@ -24,12 +24,19 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     pythonRelaxDepsHook
+    setuptools
   ];
 
   pythonRelaxDeps = [
     "aws-sam-translator"
     "boto3-stubs"
     "tzlocal"
+    "cookiecutter"
+    "docker"
+    "aws-lambda-builders"
+    "tomlkit"
+    "rich"
+    "jsonschema"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/build-managers/gn/generic.nix b/pkgs/development/tools/build-managers/gn/generic.nix
index 4214bb822b99..bb72e4bb20b4 100644
--- a/pkgs/development/tools/build-managers/gn/generic.nix
+++ b/pkgs/development/tools/build-managers/gn/generic.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, fetchgit, darwin, writeText
 , ninja, python3
+, disable-warnings-if-gcc13
 , ...
 }:
 
@@ -17,7 +18,7 @@ let
     #endif  // OUT_LAST_COMMIT_POSITION_H_
   '';
 
-in stdenv.mkDerivation {
+in disable-warnings-if-gcc13 (stdenv.mkDerivation {
   pname = "gn-unstable";
   inherit version;
 
@@ -57,4 +58,4 @@ in stdenv.mkDerivation {
     platforms = platforms.unix;
     maintainers = with maintainers; [ stesie matthewbauer primeos ];
   };
-}
+})
diff --git a/pkgs/development/tools/build-managers/scons/3.1.2.nix b/pkgs/development/tools/build-managers/scons/3.1.2.nix
index 097a8ffd519e..0bac0685b0d1 100644
--- a/pkgs/development/tools/build-managers/scons/3.1.2.nix
+++ b/pkgs/development/tools/build-managers/scons/3.1.2.nix
@@ -1,16 +1,25 @@
-{ lib, fetchurl, python3 }:
+{ lib, fetchFromGitHub, python3 }:
 
 let
   pname = "scons";
   version = "3.1.2";
-  src = fetchurl {
-    url = "mirror://sourceforge/scons/scons-${version}.tar.gz";
-    hash = "sha256-eAHz9i9lRSjict94C+EMDpM36JdlC2Ldzunzn94T+Ps=";
+  src = fetchFromGitHub {
+    owner = "Scons";
+    repo = "scons";
+    rev = version;
+    hash = "sha256-C3U4N7+9vplzoJoevQe5Zeuz0TDmB6/miMwBJLzA3WA=";
   };
 in
 python3.pkgs.buildPythonApplication {
   inherit pname version src;
 
+  outputs = [ "out" "man" ];
+
+  preConfigure = ''
+    python bootstrap.py
+    cd build/scons
+  '';
+
   setupHook = ./setup-hook.sh;
 
   doCheck = true;
@@ -36,3 +45,4 @@ python3.pkgs.buildPythonApplication {
     maintainers = with lib.maintainers; [ AndersonTorres ];
   };
 }
+# TODO: patch to get rid of distutils and other deprecations
diff --git a/pkgs/development/tools/build-managers/scons/4.1.0.nix b/pkgs/development/tools/build-managers/scons/4.1.0.nix
index 65499280c2c4..f2edf5161aaf 100644
--- a/pkgs/development/tools/build-managers/scons/4.1.0.nix
+++ b/pkgs/development/tools/build-managers/scons/4.1.0.nix
@@ -1,25 +1,32 @@
-{ lib, fetchurl, python3 }:
+{ lib, fetchFromGitHub, python3 }:
 
 let
   pname = "scons";
   version = "4.1.0";
-  src = fetchurl {
-    url = "mirror://sourceforge/scons/scons-${version}.tar.gz";
-    hash = "sha256-ctKNdi4hJnh/Fz49WeCJI5+LL06e8xFNV/ELEgaYXYU=";
+  src = fetchFromGitHub {
+    owner = "Scons";
+    repo = "scons";
+    rev = version;
+    hash = "sha256-ldus/9ghqAMB7A+NrHiCQm7saCdIpqzufGCLxWRhYKU=";
   };
 in
 python3.pkgs.buildPythonApplication {
   inherit pname version src;
 
+  outputs = [ "out" "man" ];
+
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "build/dist" "dist" \
-      --replace "build/doc/man/" ""
+      --replace "build/dist" "dist"
+  '';
+
+  preConfigure = ''
+    python scripts/scons.py
   '';
 
   postInstall = ''
-    mkdir -p "$out/share/man/man1"
-    mv "$out/"*.1 "$out/share/man/man1/"
+    mkdir -pv "$man/share/man/man1"
+    mv -v "$out/"*.1 "$man/share/man/man1/"
   '';
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/build-managers/scons/4.5.2.nix b/pkgs/development/tools/build-managers/scons/4.5.2.nix
index 61d1719642e0..f63702cb7ef4 100644
--- a/pkgs/development/tools/build-managers/scons/4.5.2.nix
+++ b/pkgs/development/tools/build-managers/scons/4.5.2.nix
@@ -1,16 +1,20 @@
-{ lib, fetchurl, python3 }:
+{ lib, fetchFromGitHub, python3 }:
 
 let
   pname = "scons";
   version = "4.5.2";
-  src = fetchurl {
-    url = "mirror://sourceforge/project/scons/scons/${version}/SCons-${version}.tar.gz";
-    hash = "sha256-ziaqyV01CnmkGSGWsL6sPLJPTMq84BI+so0zcPV28HI=";
+  src = fetchFromGitHub {
+    owner = "Scons";
+    repo = "scons";
+    rev = version;
+    hash = "sha256-vxJsz24jDsPcttwPXq9+ztc/N7W4Gkydgykk/FLgZLo=";
   };
 in
 python3.pkgs.buildPythonApplication {
   inherit pname version src;
 
+  outputs = [ "out" "man" ];
+
   patches = [
     ./env.patch
   ];
@@ -21,9 +25,13 @@ python3.pkgs.buildPythonApplication {
       --replace "build/doc/man/" ""
   '';
 
+  preConfigure = ''
+    python scripts/scons.py
+  '';
+
   postInstall = ''
-    mkdir -p "$out/share/man/man1"
-    mv "$out/"*.1 "$out/share/man/man1/"
+    mkdir -p "$man/share/man/man1"
+    mv "$out/"*.1 "$man/share/man/man1/"
   '';
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/check-jsonschema/default.nix b/pkgs/development/tools/check-jsonschema/default.nix
index 01b31266d0a3..3731e3e7e5f3 100644
--- a/pkgs/development/tools/check-jsonschema/default.nix
+++ b/pkgs/development/tools/check-jsonschema/default.nix
@@ -4,7 +4,7 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "check-jsonschema";
-  version = "0.25.0";
+  version = "0.27.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -13,7 +13,7 @@ buildPythonApplication rec {
     owner = "python-jsonschema";
     repo = "check-jsonschema";
     rev = version;
-    hash = "sha256-Hss4MgE09v2KvL8OIapFgocO+5EWE2WEr5xBAjhwNeE=";
+    hash = "sha256-WXvhlkU1dRNKhW3sMakd644W56xv8keMjSZL4MrQEc8=";
   };
 
   propagatedBuildInputs = [
@@ -21,6 +21,7 @@ buildPythonApplication rec {
     jsonschema
     requests
     click
+    regress
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/tools/circup/default.nix b/pkgs/development/tools/circup/default.nix
index f96010662914..08ea01ca240b 100644
--- a/pkgs/development/tools/circup/default.nix
+++ b/pkgs/development/tools/circup/default.nix
@@ -15,8 +15,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-kax4gnvRkHSqj0Y6Rk8eyPpT7Wia2QngCQtxpqWSl9s=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   pythonRelaxDeps = [
     "semver"
   ];
diff --git a/pkgs/development/tools/codespell/default.nix b/pkgs/development/tools/codespell/default.nix
index aff3646340ed..158e0971e633 100644
--- a/pkgs/development/tools/codespell/default.nix
+++ b/pkgs/development/tools/codespell/default.nix
@@ -33,8 +33,6 @@ python3.pkgs.buildPythonApplication rec {
     pytest-dependency
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   preCheck = ''
     export ASPELL_CONF="dict-dir ${aspellDicts.en}/lib/aspell"
   '';
diff --git a/pkgs/development/tools/documentation/gi-docgen/default.nix b/pkgs/development/tools/documentation/gi-docgen/default.nix
index 05da1f3aa0c1..bed660615179 100644
--- a/pkgs/development/tools/documentation/gi-docgen/default.nix
+++ b/pkgs/development/tools/documentation/gi-docgen/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gi-docgen";
-  version = "2023.1";
+  version = "2023.3";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gi-docgen/${lib.versions.major version}/gi-docgen-${version}.tar.xz";
-    sha256 = "qaaHwbfEpBOaIUvUUeAcqGExoxYfaKo+BzJbBgArv7Y=";
+    hash = "sha256-TesfCXc/cGJZrGUgUNp7PuWYcbw/1c+3foEdt0mNyOc=";
   };
 
   depsBuildBuild = [
@@ -30,6 +30,7 @@ python3.pkgs.buildPythonApplication rec {
     jinja2
     markdown
     markupsafe
+    packaging
     pygments
     toml # remove once python311 is the default
     typogrify
diff --git a/pkgs/development/tools/hatch/default.nix b/pkgs/development/tools/hatch/default.nix
index c145504015c2..2e967097d065 100644
--- a/pkgs/development/tools/hatch/default.nix
+++ b/pkgs/development/tools/hatch/default.nix
@@ -2,19 +2,25 @@
 , stdenv
 , fetchPypi
 , python3
+, cargo
 , git
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "hatch";
-  version = "1.7.0";
+  version = "1.9.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-evxwH9WzNoSmZQ4eyriVfhloX4JCQLp0WNys1m+Q+0Y=";
+    hash = "sha256-4ealEeFS7HzU26vE9Pahh0hwvUnJfRfTkLkjLdpoXOM=";
   };
 
+  nativeBuildInputs = with python3.pkgs; [
+    hatchling
+    hatch-vcs
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     click
     hatchling
@@ -24,21 +30,25 @@ python3.pkgs.buildPythonApplication rec {
     packaging
     pexpect
     platformdirs
-    pyperclip
     rich
     shellingham
     tomli-w
     tomlkit
     userpath
     virtualenv
+    zstandard
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = [
+    cargo
+  ] ++ (with python3.pkgs; [
+    binary
     git
     pytestCheckHook
     pytest-mock
     pytest-xdist
-  ];
+    setuptools
+  ]);
 
   preCheck = ''
     export HOME=$(mktemp -d);
@@ -61,10 +71,17 @@ python3.pkgs.buildPythonApplication rec {
     "test_editable_pth"
     # AssertionError: assert len(extract_installed_requirements(output.splitlines())) > 0
     "test_creation_allow_system_packages"
-    # tomlkit 0.12 changes
-    "test_no_strict_naming"
-    "test_project_location_basic_set_first_project"
-    "test_project_location_complex_set_first_project"
+    # cli table output mismatch
+    "test_context_formatting"
+    # expects sh, finds bash
+    "test_all"
+    "test_already_installed_update_flag"
+    "test_already_installed_update_prompt"
+    # unmet expectations about the binary module we provide
+    "test_dependency_not_found"
+    "test_marker_unmet"
+    # output capturing mismatch, likely stdout/stderr mixup
+    "test_no_compatibility_check_if_exists"
   ] ++ lib.optionals stdenv.isDarwin [
     # https://github.com/NixOS/nixpkgs/issues/209358
     "test_scripts_no_environment"
diff --git a/pkgs/development/tools/hotdoc/default.nix b/pkgs/development/tools/hotdoc/default.nix
index 6758f1b44e9b..4f58f961b9f8 100644
--- a/pkgs/development/tools/hotdoc/default.nix
+++ b/pkgs/development/tools/hotdoc/default.nix
@@ -100,7 +100,7 @@ buildPythonApplication rec {
   postPatch = ''
     substituteInPlace hotdoc/extensions/c/c_extension.py \
       --replace "shutil.which('llvm-config')" 'True' \
-      --replace "subprocess.check_output(['llvm-config', '--version']).strip().decode()" '"${llvmPackages.libclang.version}"' \
+      --replace "subprocess.check_output(['llvm-config', '--version']).strip().decode()" '"${lib.versions.major llvmPackages.libclang.version}"' \
       --replace "subprocess.check_output(['llvm-config', '--prefix']).strip().decode()" '"${llvmPackages.libclang.lib}"' \
       --replace "subprocess.check_output(['llvm-config', '--libdir']).strip().decode()" '"${llvmPackages.libclang.lib}/lib"'
   '';
diff --git a/pkgs/development/tools/jq/default.nix b/pkgs/development/tools/jq/default.nix
index 4a57c0f5a0c3..432fe6826bd7 100644
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "jq";
-  version = "1.7";
+  version = "1.7.1";
 
   # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
   src = fetchurl {
     url = "https://github.com/jqlang/jq/releases/download/jq-${version}/jq-${version}.tar.gz";
-    hash = "sha256-QCoNaXXZRub05ITRqEMgQUoP+Ots9J0sEdFE1NNE22I=";
+    hash = "sha256-R4ycoSn9LjRD/icxS0VeIR4NjGC8j/ffcDhz3u7lgMI=";
   };
 
   outputs = [ "bin" "doc" "man" "dev" "lib" "out" ];
diff --git a/pkgs/development/tools/language-servers/fortls/default.nix b/pkgs/development/tools/language-servers/fortls/default.nix
index 9aed276a63fa..74f07f84ffc1 100644
--- a/pkgs/development/tools/language-servers/fortls/default.nix
+++ b/pkgs/development/tools/language-servers/fortls/default.nix
@@ -21,8 +21,6 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [ json5 packaging ];
 
-  preBuild = "export SETUPTOOLS_SCM_PRETEND_VERSION=${version}";
-
   doCheck = true;
   checkPhase = "$out/bin/fortls --help 1>/dev/null";
 
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 93d61b638bea..849f44ea9bc0 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -4,7 +4,7 @@
 , fetchurl, fetchpatch, pkg-config, perl, texinfo, setupDebugInfoDirs, buildPackages
 
 # Run time
-, ncurses, readline, gmp, mpfr, expat, libipt, zlib, zstd, dejagnu, sourceHighlight, libiconv
+, ncurses, readline, gmp, mpfr, expat, libipt, zlib, zstd, xz, dejagnu, sourceHighlight, libiconv
 
 , pythonSupport ? stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isCygwin, python3 ? null
 , enableDebuginfod ? lib.meta.availableOn stdenv.hostPlatform elfutils, elfutils
@@ -30,11 +30,11 @@ assert pythonSupport -> python3 != null;
 
 stdenv.mkDerivation rec {
   pname = targetPrefix + basename + lib.optionalString hostCpuOnly "-host-cpu-only";
-  version = "13.2";
+  version = "14.1";
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}-${version}.tar.xz";
-    hash = "sha256-/Vvrt74YM6vbbgI8L0mKNUSYKB350FUj2JFbq+uJPwo=";
+    hash = "sha256-1m31EnYUNFH8v/RkzIcj1o8enfRaai1WNaVOcWQ+24A=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config texinfo perl setupDebugInfoDirs ];
 
-  buildInputs = [ ncurses readline gmp mpfr expat libipt zlib zstd guile sourceHighlight ]
+  buildInputs = [ ncurses readline gmp mpfr expat libipt zlib zstd xz guile sourceHighlight ]
     ++ lib.optional pythonSupport python3
     ++ lib.optional doCheck dejagnu
     ++ lib.optional enableDebuginfod (elfutils.override { enableDebuginfod = true; })
diff --git a/pkgs/development/tools/misc/gpuvis/default.nix b/pkgs/development/tools/misc/gpuvis/default.nix
index d4476a963525..c0a10a09b02b 100644
--- a/pkgs/development/tools/misc/gpuvis/default.nix
+++ b/pkgs/development/tools/misc/gpuvis/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ SDL2 gtk3 freetype ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'uint32_t' has not been declared
+    "-include cstdint"
+  ];
+
   meta = with lib; {
     description = "GPU Trace Visualizer";
     homepage = "https://github.com/mikesart/gpuvis";
diff --git a/pkgs/development/tools/ofono-phonesim/default.nix b/pkgs/development/tools/ofono-phonesim/default.nix
index 62d8667ffbda..395211cd13c1 100644
--- a/pkgs/development/tools/ofono-phonesim/default.nix
+++ b/pkgs/development/tools/ofono-phonesim/default.nix
@@ -1,6 +1,6 @@
 { lib
 , mkDerivation
-, fetchgit
+, fetchzip
 , autoreconfHook
 , pkg-config
 , qtbase
@@ -10,9 +10,8 @@ mkDerivation {
   pname = "ofono-phonesim";
   version = "unstable-2019-11-18";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/network/ofono/phonesim.git";
-    rev = "adf231a84cd3708b825dc82c56e841dd7e3b4541";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/network/ofono/phonesim.git/snapshot/phonesim-adf231a84cd3708b825dc82c56e841dd7e3b4541.tar.gz";
     sha256 = "1840914sz46l8h2jwa0lymw6dvgj72wq9bhp3k4v4rk6masbf6hp";
   };
 
diff --git a/pkgs/development/tools/rust/bindgen/unwrapped.nix b/pkgs/development/tools/rust/bindgen/unwrapped.nix
index a6aeb9854697..c2ea437148c6 100644
--- a/pkgs/development/tools/rust/bindgen/unwrapped.nix
+++ b/pkgs/development/tools/rust/bindgen/unwrapped.nix
@@ -7,15 +7,15 @@ let
   rustfmt-nightly = rustfmt.override { asNightly = true; };
 in rustPlatform.buildRustPackage rec {
   pname = "rust-bindgen-unwrapped";
-  version = "0.66.1";
+  version = "0.69.1";
 
   src = fetchCrate {
     pname = "bindgen-cli";
     inherit version;
-    sha256 = "sha256-xVTVC3dNGIJeFm/v3swekzuJ2RQOe+wSh05vuWYTDRs=";
+    sha256 = "sha256-zqyIc07RLti2xb23bWzL7zFjreEZuUstnYSp+jUX8Lw=";
   };
 
-  cargoHash = "sha256-eIvl0RSKErNPip0r6iz7JVHm5YvuY3ke/6aMgkryRcI=";
+  cargoHash = "sha256-o1B8jq7Ze97pBLE9gvNsmCaD/tsW4f6DL0upzQkxbA4=";
 
   buildInputs = [ clang.cc.lib ];
 
diff --git a/pkgs/games/openmw/tes3mp.nix b/pkgs/games/openmw/tes3mp.nix
index 48454b42df29..5662f2356833 100644
--- a/pkgs/games/openmw/tes3mp.nix
+++ b/pkgs/games/openmw/tes3mp.nix
@@ -7,13 +7,14 @@
 , luajit
 , makeWrapper
 , symlinkJoin
+, disable-warnings-if-gcc13
 }:
 
 # revisions are taken from https://github.com/GrimKriegor/TES3MP-deploy
 
 let
   # raknet could also be split into dev and lib outputs
-  raknet = stdenv.mkDerivation {
+  raknet = disable-warnings-if-gcc13 (stdenv.mkDerivation {
     pname = "raknet";
     version = "unstable-2020-01-19";
 
@@ -35,7 +36,7 @@ let
     installPhase = ''
       install -Dm555 lib/libRakNetLibStatic.a $out/lib/libRakNetLibStatic.a
     '';
-  };
+  });
 
   coreScripts = stdenv.mkDerivation {
     pname = "corescripts";
diff --git a/pkgs/games/portmod/default.nix b/pkgs/games/portmod/default.nix
index f9631c6d764f..a0e7d38d178c 100644
--- a/pkgs/games/portmod/default.nix
+++ b/pkgs/games/portmod/default.nix
@@ -51,8 +51,6 @@ python3Packages.buildPythonApplication rec {
   pname = "portmod";
   format = "pyproject";
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   # build the rust library independantly
   prePatch = ''
     substituteInPlace setup.py \
diff --git a/pkgs/games/super-tux-kart/default.nix b/pkgs/games/super-tux-kart/default.nix
index d92f01cad37a..3077d5b9443c 100644
--- a/pkgs/games/super-tux-kart/default.nix
+++ b/pkgs/games/super-tux-kart/default.nix
@@ -122,6 +122,13 @@ stdenv.mkDerivation rec {
     "-DOpenGL_GL_PREFERENCE=GLVND"
   ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'snprintf' was not declared in this scope
+    "-include cstdio"
+    # GCC 13: error: 'runtime_error' is not a member of 'std'
+    "-include stdexcept"
+  ];
+
   # Extract binary from built app bundle
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir $out/bin
diff --git a/pkgs/misc/hdt/default.nix b/pkgs/misc/hdt/default.nix
index 9e1efd5f836d..e7c46d78588d 100644
--- a/pkgs/misc/hdt/default.nix
+++ b/pkgs/misc/hdt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, libtool, pkg-config, zlib, serd }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, libtool, pkg-config, zlib, serd }:
 
 stdenv.mkDerivation rec {
   pname = "hdt";
@@ -11,6 +11,16 @@ stdenv.mkDerivation rec {
     sha256 = "1vsq80jnix6cy78ayag7v8ajyw7h8dqyad1q6xkf2hzz3skvr34z";
   };
 
+  patches = [
+    # Pull fix for gcc-13 compatibility pending upstream inclusion:
+    #   https://github.com/rdfhdt/hdt-cpp/pull/276
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/rdfhdt/hdt-cpp/commit/1b775835c6661c67cb18f5d6f65638ba7d4ecf3c.patch";
+      hash = "sha256-2ppcA+Ztw5G/buW2cwCNbuGeUuvgvSruW3OarWNCIHI=";
+    })
+  ];
+
   buildInputs = [ zlib serd ];
 
   nativeBuildInputs = [ autoreconfHook libtool pkg-config ];
diff --git a/pkgs/misc/stabber/default.nix b/pkgs/misc/stabber/default.nix
index ff89241a2469..7ec9a8985e1d 100644
--- a/pkgs/misc/stabber/default.nix
+++ b/pkgs/misc/stabber/default.nix
@@ -15,6 +15,11 @@ stdenv.mkDerivation {
     sha256 = "0042nbgagl4gcxa5fj7bikjdi1gbk0jwyqnzc5lswpb0l5y0i1ql";
   };
 
+  postPatch = ''
+    # New toolchainsd like gcc-13 trigger warnings and fail the build.
+    substituteInPlace configure.ac --replace "-Werror" ""
+  '';
+
   preAutoreconf = ''
     mkdir m4
   '';
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index acdaa6796d65..a0b91f6d778b 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -20,7 +20,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.28.0";
+  version = "0.29.1";
 
   disabled = !stdenv.isLinux;
 
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "iovisor";
     repo = "bcc";
     rev = "v${version}";
-    sha256 = "sha256-+ecSaVroDC2bWbio4JsuwEvHQdCMpxLt7hIkeREMJs8=";
+    hash = "sha256-+HYCweAI5axx0ZNFd/jLRXkUinRLDmKWMpLTk7FrEe0=";
   };
   format = "other";
 
diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index 00d46591c136..66e3303890b0 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, protobuf, protobufc, asciidoc, iptables
+{ stdenv, lib, fetchFromGitHub, protobuf, protobufc, asciidoc, iptables
 , xmlto, docbook_xsl, libpaper, libnl, libcap, libnet, pkg-config, iproute2, gzip
 , which, python3, makeWrapper, docbook_xml_dtd_45, perl, nftables, libbsd, gnutar
 , buildPackages
@@ -6,33 +6,15 @@
 
 stdenv.mkDerivation rec {
   pname = "criu";
-  version = "3.17.1";
+  version = "3.19";
 
   src = fetchFromGitHub {
     owner = "checkpoint-restore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0B0cdX5bemy4glF9iWjrQIXIqilyYcCcAN9x4Jjrwzk=";
+    hash = "sha256-S0nxBHfm7tWmW5PhSDhSAgy1uDa0RD5GTNpMDUHKqwY=";
   };
 
-  patches = [
-    # Fixes redefinition of rseq headers
-    (fetchpatch {
-      url = "https://github.com/checkpoint-restore/criu/commit/1e6e826ffb7ac05f33fa123051c2fc2ddf0f68ea.patch";
-      hash = "sha256-LJjk0jQ5v5wqeprvBMpxhjLXn7v+lSPldEGgazGUM44=";
-    })
-
-    # compat fixes for glibc-2.36
-    (fetchpatch {
-      url = "https://github.com/checkpoint-restore/criu/commit/8cd5fccd6cf3d03afb5abe463134d31f54d42258.patch";
-      sha256 = "sha256-b65DdLmyIuZik0dNRuWJKUPcDFA6CKq0bi4Vd26zgS4=";
-    })
-    (fetchpatch {
-      url = "https://github.com/checkpoint-restore/criu/commit/517c0947050e63aac72f63a3bf373d76264723b9.patch";
-      sha256 = "sha256-MPZ6oILVoZ7BQEZFjUlp3RuMC7iKTKXAtrUDFqbN4T8=";
-    })
-  ];
-
   enableParallelBuilding = true;
   depsBuildBuild = [ protobufc buildPackages.stdenv.cc ];
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/error-inject/default.nix b/pkgs/os-specific/linux/error-inject/default.nix
index f4a544172176..69b90169bda0 100644
--- a/pkgs/os-specific/linux/error-inject/default.nix
+++ b/pkgs/os-specific/linux/error-inject/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit
+{ lib, stdenv, fetchzip
 , bison, flex, rasdaemon
 }:
 
@@ -9,9 +9,8 @@
     pname = "mce-inject";
     version = "4cbe46321b4a81365ff3aafafe63967264dbfec5";
 
-    src = fetchgit {
-      url = "https://git.kernel.org/pub/scm/utils/cpu/mce/mce-inject.git";
-      rev = version;
+    src = fetchzip {
+      url = "https://git.kernel.org/pub/scm/utils/cpu/mce/mce-inject.git/snapshot/mce-inject-${version}.tar.gz";
       sha256 = "0gjapg2hrlxp8ssrnhvc19i3r1xpcnql7xv0zjgbv09zyha08g6z";
     };
 
@@ -39,9 +38,8 @@
     pname = "aer-inject";
     version = "9bd5e2c7886fca72f139cd8402488a2235957d41";
 
-    src = fetchgit {
-      url = "https://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git";
-      rev = version;
+    src = fetchzip {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git/snapshot/aer-inject-${version}.tar.gz";
       sha256 = "0bh6mzpk2mr4xidkammmkfk21b4dbq793qjg25ryyxd1qv0c6cg4";
     };
 
diff --git a/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix b/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
index a4bbd6d2bb6b..71a7cd9e947b 100644
--- a/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
+++ b/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
@@ -4,26 +4,19 @@
 , autoPatchelfHook
 , expat
 , zlib
-
-# Pick one of
-# - ipu6 (Tiger Lake)
-# - ipu6ep (Alder Lake)
-, ipuVersion ? "ipu6"
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "${ipuVersion}-camera-bin";
-  version = "unstable-2023-02-08";
+  pname = "ipu6-camera-bins";
+  version = "unstable-2023-10-26";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipu6-camera-bins";
-    rev = "276859fc6de83918a32727d676985ec40f31af2b";
-    hash = "sha256-QnedM2UBbGyd2wIF762Mi+VkDZYtC6MifK4XGGxlUzw=";
+    rev = "af5ba0cb4a763569ac7514635013e9d870040bcf";
+    hash = "sha256-y0pT5M7AKACbquQWLZPYpTPXRC5hipLNL61nhs+cst4=";
   };
 
-  sourceRoot = "${finalAttrs.src.name}/${ipuVersion}";
-
   nativeBuildInputs = [
     autoPatchelfHook
     stdenv.cc.cc.lib
@@ -40,32 +33,20 @@ stdenv.mkDerivation (finalAttrs: {
       include \
       $out/
 
-    install -m 0644 -D ../LICENSE $out/share/doc/LICENSE
+    install -m 0644 -D LICENSE $out/share/doc/LICENSE
 
     runHook postInstall
   '';
 
   postFixup = ''
-    for pcfile in $out/lib/pkgconfig/*.pc; do
+    for pcfile in $out/lib/*/pkgconfig/*.pc; do
       substituteInPlace $pcfile \
-        --replace 'exec_prefix=/usr' 'exec_prefix=''${prefix}' \
-        --replace 'prefix=/usr' "prefix=$out" \
-        --replace 'libdir=/usr/lib' 'libdir=''${prefix}/lib' \
-        --replace 'includedir=/usr/include' 'includedir=''${prefix}/include'
+        --replace 'prefix=/usr' "prefix=$out"
     done
   '';
 
-  passthru = {
-    inherit ipuVersion;
-  };
-
-  meta = let
-    generation = {
-      ipu6 = "Tiger Lake";
-      ipu6ep = "Alder Lake";
-    }.${ipuVersion};
-  in with lib; {
-    description = "${generation} IPU firmware and proprietary image processing libraries";
+  meta = with lib; {
+    description = "IPU firmware and proprietary image processing libraries";
     homepage = "https://github.com/intel/ipu6-camera-bins";
     license = licenses.issl;
     sourceProvenance = with sourceTypes; [
diff --git a/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix b/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
index fb2f940ddce6..1a90380838a9 100644
--- a/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation {
   pname = "ivsc-firmware";
-  version = "unstable-2022-11-02";
+  version = "unstable-2023-08-11";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ivsc-firmware";
-    rev = "29c5eff4cdaf83e90ef2dcd2035a9cdff6343430";
-    hash = "sha256-GuD1oTnDEs0HslJjXx26DkVQIe0eS+js4UoaTDa77ME=";
+    rev = "10c214fea5560060d387fbd2fb8a1af329cb6232";
+    hash = "sha256-kEoA0yeGXuuB+jlMIhNm+SBljH+Ru7zt3PzGb+EPBPw=";
   };
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/fsverity-utils/default.nix b/pkgs/os-specific/linux/fsverity-utils/default.nix
index c5bed075338f..b0b6286c8cfa 100644
--- a/pkgs/os-specific/linux/fsverity-utils/default.nix
+++ b/pkgs/os-specific/linux/fsverity-utils/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchgit
+, fetchzip
 , openssl
 , enableShared ? !stdenv.hostPlatform.isStatic
 , enableManpages ? false
@@ -13,9 +13,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" "dev" ] ++ lib.optional enableManpages "man";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/fsverity-utils.git";
-    rev = "v${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/fs/fsverity/fsverity-utils.git/snapshot/fsverity-utils-v${version}.tar.gz";
     sha256 = "sha256-ygBOkp2PBe8Z2ak6SXEJ6HHuT4NRKmIsbJDHcY+h8PQ=";
   };
 
@@ -42,7 +41,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://www.kernel.org/doc/html/latest/filesystems/fsverity.html#userspace-utility";
-    changelog = "https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/fsverity-utils.git/tree/NEWS.md";
+    changelog = "https://git.kernel.org/pub/scm/fs/fsverity/fsverity-utils.git/tree/NEWS.md";
     description = "A set of userspace utilities for fs-verity";
     license = licenses.mit;
     maintainers = with maintainers; [ jk ];
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 3332699886c9..83dd82e6ab26 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.376";
+  version = "0.377-2";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-M1uBamN09XepOembDAcHXO/UvnM9s/OiN+eNzChF5Tw=";
+    hash = "sha256-Nh+EIsJ/98NnflndQeSgiV2iOC0icTEfgwAySPbG6Lo=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/i2c-tools/default.nix b/pkgs/os-specific/linux/i2c-tools/default.nix
index 556bc2d89787..e682bb398f91 100644
--- a/pkgs/os-specific/linux/i2c-tools/default.nix
+++ b/pkgs/os-specific/linux/i2c-tools/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchgit
+, fetchzip
 , perl
 , read-edid
 }:
@@ -9,9 +9,8 @@ stdenv.mkDerivation rec {
   pname = "i2c-tools";
   version = "4.3";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/utils/i2c-tools/i2c-tools.git";
-    rev = "v${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/utils/i2c-tools/i2c-tools.git/snapshot/i2c-tools-v${version}.tar.gz";
     sha256 = "sha256-HlmIocum+HZEKNiS5BUwEIswRfTMUhD1vCPibAuAK0Q=";
   };
 
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index a86af7e6db26..1fae93c53251 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.5.0";
+  version = "6.6.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-pwF5CF+huW08M7BAyAm3XitXVjrcUFpK0F4mCd83NGM=";
+    hash = "sha256-hzjIBK/Qnwv3VpN/DD3iMReDKpjYy79QOGz1AFzWE84=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/ipu6-drivers/default.nix b/pkgs/os-specific/linux/ipu6-drivers/default.nix
index bc85ffd9aa32..fe9cb1da018c 100644
--- a/pkgs/os-specific/linux/ipu6-drivers/default.nix
+++ b/pkgs/os-specific/linux/ipu6-drivers/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation {
   pname = "ipu6-drivers";
-  version = "unstable-2023-08-28";
+  version = "unstable-2023-11-24";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipu6-drivers";
-    rev = "7c3d6ab1e9e234563a0af51286b0a8d60445f2a3";
-    hash = "sha256-D782v6hIqAl2EO1+zKeakURD3UGVP3c7p3ba/61yfW4=";
+    rev = "07f0612eabfdc31df36f5e316a9eae115807804f";
+    hash = "sha256-8JRZG6IKJT0qtoqJHm8641kSQMLc4Z+DRzK6FpL9Euk=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index 8396fd5e3d33..56ac85fa0b7a 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iputils";
-  version = "20221126";
+  version = "20231222";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-XVoQhdjBmEK8TbCpaKLjebPw7ZT8iEvyLJDTCkzezeE=";
+    hash = "sha256-/blxT6k79fgbxX8qCQuJMf7zDPwMjJUt7FCscaMXx6U=";
   };
 
   outputs = [ "out" "apparmor" ];
diff --git a/pkgs/os-specific/linux/ivsc-driver/default.nix b/pkgs/os-specific/linux/ivsc-driver/default.nix
index 0491b1d548b4..72173de49baa 100644
--- a/pkgs/os-specific/linux/ivsc-driver/default.nix
+++ b/pkgs/os-specific/linux/ivsc-driver/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation {
   pname = "ivsc-driver";
-  version = "unstable-2023-03-10";
+  version = "unstable-2023-11-09";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ivsc-driver";
-    rev = "c8db12b907e2e455d4d5586e5812d1ae0eebd571";
-    hash = "sha256-OM9PljvaMKrk72BFeSCqaABFeAws+tOdd3oC2jyNreE=";
+    rev = "73a044d9633212fac54ea96cdd882ff5ab40573e";
+    hash = "sha256-vE5pOtVqjiWovlUMSEoBKTk/qvs8K8T5oY2r7njh0wQ=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 51f6ea471a6a..995bfba34a7f 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-SDDdz2HKEfzHloLkb0sv5ldTo+1yJDVc9O7nj4Cjznk=";
+    sha256 = "sha256-wVCBLJK9nlS1N9/DrQtogoZmgWW4ECqInSeQTjUFhcY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix
index 5248c263b3b2..68f4ee20df88 100644
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@@ -1,23 +1,48 @@
-{ stdenv, file, lib, fetchFromGitHub, autoreconfHook, bison, flex, pkg-config
-, pythonSupport ? false, swig ? null, python ? null}:
+{ stdenv
+, file
+, lib
+, fetchFromGitHub
+, autoreconfHook
+, bison
+, flex
+, pkg-config
+, doxygen
+, graphviz
+, mscgen
+, asciidoc
+, sourceHighlight
+, pythonSupport ? false
+, swig ? null
+, python ? null
+}:
 
 stdenv.mkDerivation rec {
   pname = "libnl";
-  version = "3.7.0";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     repo = "libnl";
     owner = "thom311";
     rev = "libnl${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "sha256-Ty9NdWKWB29MTRfG5OJlSE0mSTN3Wy+sR4KtuExXcB4=";
+    hash = "sha256-zVpoRlB5xDfo6wJkCJGGptuCXkNkriudtZF2Job9YD4=";
   };
 
   outputs = [ "bin" "dev" "out" "man" ] ++ lib.optional pythonSupport "py";
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ autoreconfHook bison flex pkg-config file ]
-    ++ lib.optional pythonSupport swig;
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+    pkg-config
+    file
+    doxygen
+    graphviz
+    mscgen
+    asciidoc
+    sourceHighlight
+  ] ++ lib.optional pythonSupport swig;
 
   postBuild = lib.optionalString (pythonSupport) ''
       cd python
diff --git a/pkgs/os-specific/linux/libtracefs/default.nix b/pkgs/os-specific/linux/libtracefs/default.nix
index 3e9c9115645d..2432a28e0c7b 100644
--- a/pkgs/os-specific/linux/libtracefs/default.nix
+++ b/pkgs/os-specific/linux/libtracefs/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchgit
+, fetchzip
 , pkg-config
 , libtraceevent
 , asciidoc
@@ -21,10 +21,9 @@ stdenv.mkDerivation rec {
   pname = "libtracefs";
   version = "1.7.0";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git";
-    rev = "libtracefs-${version}";
-    sha256 = "sha256-64eXFFdnZHHf4C3vbADtPuIMsfJ85VZ6t8A1gIc1CW0=";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/snapshot/libtracefs-libtracefs-${version}.tar.gz";
+    hash = "sha256-64eXFFdnZHHf4C3vbADtPuIMsfJ85VZ6t8A1gIc1CW0=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/numactl/default.nix b/pkgs/os-specific/linux/numactl/default.nix
index 998b7d052b35..a65d4ed041b4 100644
--- a/pkgs/os-specific/linux/numactl/default.nix
+++ b/pkgs/os-specific/linux/numactl/default.nix
@@ -19,8 +19,6 @@ stdenv.mkDerivation rec {
     patchShebangs test
   '';
 
-  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
-
   # You probably shouldn't ever run these! They will reconfigure Linux
   # NUMA settings, which on my build machine makes the rest of package
   # building ~5% slower until reboot. Ugh!
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index 56a92ffa44ef..e4d245fdc7ce 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -48,8 +48,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Too red
-  configureFlags = [ "--disable-modern-top" ]
+  # Too red; 8bit support for fixing https://github.com/NixOS/nixpkgs/issues/275220
+  configureFlags = [ "--disable-modern-top" "--enable-watch8bit" ]
     ++ lib.optional withSystemd "--with-systemd"
     ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_func_malloc_0_nonnull=yes"
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index f52342f5af36..d6319fd0dcf3 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, fetchpatch
 , runtimeShell, nixosTests
 , autoreconfHook, bison, flex
 , docbook_xml_dtd_45, docbook_xsl
@@ -47,6 +47,13 @@ stdenv.mkDerivation rec {
     ./respect-xml-catalog-files-var.patch
     ./runtime-shell.patch
     ./fix-install-with-tcb.patch
+    # Fix build against `clang-16` and upcoming `gcc-14`:
+    #   https://github.com/shadow-maint/shadow/pull/857
+    (fetchpatch {
+      name = "fix-implicit-getdef_bool.patch";
+      url = "https://github.com/shadow-maint/shadow/commit/5abe0811b880208600f646356549b7e5cad89060.patch";
+      hash = "sha256-XqvVv8mYY58uXJBKRwncHQRSI45PUkp3dQNn44gzezU=";
+    })
   ];
 
   # The nix daemon often forbids even creating set[ug]id files.
diff --git a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
new file mode 100644
index 000000000000..68ae22644835
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -0,0 +1,46 @@
+From 7a27556920fe1feefd17096841c8f3ca1294a1b3 Mon Sep 17 00:00:00 2001
+From: Yuri Nesterov <yuriy.nesterov@unikie.com>
+Date: Wed, 21 Jun 2023 17:17:38 +0300
+Subject: [PATCH] timesyncd: disable NSCD when DNSSEC validation is disabled
+
+Systemd-timesyncd sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 in the unit file
+to disable DNSSEC validation but it doesn't work when NSCD is used in
+the system. This patch disabes NSCD in systemd-timesyncd when
+SYSTEMD_NSS_RESOLVE_VALIDATE is set to 0 so that it uses NSS libraries
+directly.
+---
+ src/timesync/timesyncd.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
+index 1d8ebecc91..2b0ae361ff 100644
+--- a/src/timesync/timesyncd.c
++++ b/src/timesync/timesyncd.c
+@@ -21,6 +21,11 @@
+ #include "timesyncd-conf.h"
+ #include "timesyncd-manager.h"
+ #include "user-util.h"
++#include "env-util.h"
++
++struct traced_file;
++extern void __nss_disable_nscd(void (*)(size_t, struct traced_file *));
++static void register_traced_file(size_t dbidx, struct traced_file *finfo) {}
+ 
+ static int advance_tstamp(int fd, const struct stat *st) {
+         assert_se(fd >= 0);
+@@ -198,6 +203,12 @@ static int run(int argc, char *argv[]) {
+         if (r < 0)
+                 return log_error_errno(r, "Failed to parse fallback server strings: %m");
+ 
++        r = getenv_bool_secure("SYSTEMD_NSS_RESOLVE_VALIDATE");
++        if (r == 0) {
++                log_info("Disabling NSCD because DNSSEC validation is turned off");
++                __nss_disable_nscd(register_traced_file);
++        }
++
+         log_debug("systemd-timesyncd running as pid " PID_FMT, getpid_cached());
+ 
+         notify_message = notify_start("READY=1\n"
+-- 
+2.34.1
+
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index f57e4039d203..4a8053707f24 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -55,6 +55,7 @@
 , e2fsprogs
 , elfutils
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
+, gnutls
 , iptables
 , withSelinux ? false
 , libselinux
@@ -207,6 +208,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./0017-core-don-t-taint-on-unmerged-usr.patch
     ./0018-tpm2_context_init-fix-driver-name-checking.patch
     ./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+    ./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
@@ -436,7 +438,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withPam pam
     ++ lib.optional withPCRE2 pcre2
     ++ lib.optional withSelinux libselinux
-    ++ lib.optional withRemote libmicrohttpd
+    ++ lib.optionals withRemote [ libmicrohttpd gnutls ]
     ++ lib.optionals (withHomed || withCryptsetup) [ p11-kit ]
     ++ lib.optionals (withHomed || withCryptsetup) [ libfido2 ]
     ++ lib.optionals withLibBPF [ libbpf ]
@@ -773,7 +775,11 @@ stdenv.mkDerivation (finalAttrs: {
     inherit withCryptsetup withHostnamed withImportd withKmod withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
 
     tests = {
-      inherit (nixosTests) switchTest;
+      inherit (nixosTests)
+        switchTest
+        systemd-journal
+        systemd-journal-gateway
+        systemd-journal-upload;
       cross = pkgsCross.${if stdenv.buildPlatform.isAarch64 then "gnu64" else "aarch64-multiplatform"}.systemd;
     };
   };
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index 371f66856de5..7bdadc2cea15 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -1,12 +1,11 @@
-{ lib, stdenv, fetchgit, pkg-config, asciidoc, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt, libtraceevent, libtracefs, zstd, sourceHighlight }:
+{ lib, stdenv, fetchzip, pkg-config, asciidoc, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt, libtraceevent, libtracefs, zstd, sourceHighlight }:
 stdenv.mkDerivation rec {
   pname = "trace-cmd";
   version = "3.2";
 
-  src = fetchgit {
-    url    = "https://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/";
-    rev    = "trace-cmd-v${version}";
-    sha256 = "sha256-KlykIYF4uy1phgWRG5j76FJqgO7XhNnyrTDVTs8YOXY=";
+  src = fetchzip {
+    url    = "https://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/snapshot/trace-cmd-v${version}.tar.gz";
+    hash   = "sha256-rTcaaEQ3Y4cneNnZSGiMZNp+Z7dyAa3oNTNMAEXr28g=";
   };
 
   # Don't build and install html documentation
diff --git a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index 23ebbae8d1cb..1eda219013da 100644
--- a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchgit, qtbase, cmake, asciidoc
+{ lib, mkDerivation, fetchzip, qtbase, cmake, asciidoc
 , docbook_xsl, json_c, mesa_glu, freeglut, trace-cmd, pkg-config
 , libtraceevent, libtracefs, freefont_ttf
 }:
@@ -7,9 +7,8 @@ mkDerivation rec {
   pname = "kernelshark";
   version = "2.2.1";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/";
-    rev = "kernelshark-v${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/snapshot/kernelshark-v${version}.tar.gz";
     hash = "sha256-V25IzPDOt6V03wgIa/AJ0T8mRaGmXYuMCcvbSOKleY0=";
   };
 
diff --git a/pkgs/os-specific/linux/tuna/default.nix b/pkgs/os-specific/linux/tuna/default.nix
index 0e621a24f081..e3101cded09f 100644
--- a/pkgs/os-specific/linux/tuna/default.nix
+++ b/pkgs/os-specific/linux/tuna/default.nix
@@ -1,6 +1,6 @@
 { lib
 , buildPythonApplication
-, fetchgit
+, fetchzip
 , pygobject3
 , pytestCheckHook
 , gdk-pixbuf
@@ -16,13 +16,12 @@ buildPythonApplication rec {
   pname = "tuna";
   version = "0.15";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/utils/${pname}/${pname}.git";
-    rev = "v${version}";
-    sha256 = "sha256-lRHlbdCQ0NcjcWgLvCze67kN8NsK0f5RmKfPbkHhk78=";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/utils/tuna/tuna.git/snapshot/tuna-v${version}.tar.gz";
+    sha256 = "MwyLBwKz5ur1sBXHiCLq/Nq2u5aaiC+KzXqvGBmQii8=";
   };
 
-  patchPhase = ''
+  postPatch = ''
     mv tuna-cmd.py tuna/cmd.py
 
     substituteInPlace setup.py \
diff --git a/pkgs/os-specific/linux/usbguard-notifier/default.nix b/pkgs/os-specific/linux/usbguard-notifier/default.nix
index c5b296809da1..a9eaa6651f99 100644
--- a/pkgs/os-specific/linux/usbguard-notifier/default.nix
+++ b/pkgs/os-specific/linux/usbguard-notifier/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   pkg-config,
   libqb,
@@ -23,6 +24,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-gWvCGSbOuey2ELAPD2WCG4q77IClL0S7rE2RaUJDc1I=";
   };
 
+  patches = [
+    # gcc-13 compatibility upstream fix:
+    #   https://github.com/Cropi/usbguard-notifier/pull/74
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/Cropi/usbguard-notifier/commit/f4586b732c8a7379aacbc9899173beeacfd54793.patch";
+      hash = "sha256-2q/qD6yEQUPxA/UutGIZKFJ3hHJ8ZlGMZI1wJyMRbmo=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config asciidoc ];
   buildInputs = [ libqb usbguard librsvg libnotify ];
 
diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix
index 46e9ee3d0a55..e43ee0b421dc 100644
--- a/pkgs/os-specific/linux/usbguard/default.nix
+++ b/pkgs/os-specific/linux/usbguard/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 , installShellFiles
 , nixosTests
@@ -32,6 +33,16 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Pull upstream fix for gcc-13:
+    #   https://github.com/USBGuard/usbguard/pull/586
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/USBGuard/usbguard/commit/22b1e0897af977cc96af926c730ff948bd120bb5.patch";
+      hash = "sha256-yw0ZHcn6naHcsfsqdBB/aTgCwvEHecew/6HDmjyY2ZA=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     installShellFiles
diff --git a/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch b/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
deleted file mode 100644
index 068744d4f32d..000000000000
--- a/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
+++ /dev/null
@@ -1,277 +0,0 @@
-commit 68564ebb50f8afab5a9527c534417e247cca0b27
-Author: Filipe Manana <fdmanana@kernel.org>
-Date:   Thu Aug 17 10:20:13 2023 +0100
-
-    libmount: Fix regression when mounting with atime
-    
-    A regression was introduced in v2.39 that causes mounting with the atime
-    option to fail:
-    
-      $ mkfs.ext4 -F /dev/sdi
-      $ mount -o atime /dev/sdi /mnt/sdi
-      mount: /mnt/sdi: not mount point or bad option.
-             dmesg(1) may have more information after failed mount system call.
-    
-    The failure comes from the mount_setattr(2) call returning -EINVAL. This
-    is because we pass an invalid value for the attr_clr argument. From a
-    strace capture we have:
-    
-      mount_setattr(4, "", AT_EMPTY_PATH, {attr_set=0, attr_clr=MOUNT_ATTR_NOATIME, propagation=0 /* MS_??? */, userns_fd=0}, 32) = -1 EINVAL (Invalid argument)
-    
-    We can't pass MOUNT_ATTR_NOATIME to mount_setattr(2) through the attr_clr
-    argument because all atime options are exclusive, so in order to set atime
-    one has to pass MOUNT_ATTR__ATIME to attr_clr and leave attr_set as
-    MOUNT_ATTR_RELATIME (which is defined as a value of 0).
-    
-    This can be read from the man page for mount_setattr(2) and also from the
-    kernel source:
-    
-      $ cat fs/namespace.c
-      static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
-                                   struct mount_kattr *kattr, unsigned int flags)
-      {
-          (...)
-          /*
-           * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
-           * users wanting to transition to a different atime setting cannot
-           * simply specify the atime setting in @attr_set, but must also
-           * specify MOUNT_ATTR__ATIME in the @attr_clr field.
-           * So ensure that MOUNT_ATTR__ATIME can't be partially set in
-           * @attr_clr and that @attr_set can't have any atime bits set if
-           * MOUNT_ATTR__ATIME isn't set in @attr_clr.
-           */
-          if (attr->attr_clr & MOUNT_ATTR__ATIME) {
-              if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
-                  return -EINVAL;
-    
-                  /*
-                   * Clear all previous time settings as they are mutually
-                   * exclusive.
-                   */
-                  kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
-                  switch (attr->attr_set & MOUNT_ATTR__ATIME) {
-                  case MOUNT_ATTR_RELATIME:
-                      kattr->attr_set |= MNT_RELATIME;
-                      break;
-                  case MOUNT_ATTR_NOATIME:
-                      kattr->attr_set |= MNT_NOATIME;
-                      break;
-                  case MOUNT_ATTR_STRICTATIME:
-                      break;
-                  default:
-                      return -EINVAL;
-                  }
-        (...)
-    
-    So fix this by setting attr_clr MOUNT_ATTR__ATIME if we want to clear any
-    atime related option.
-    
-    Signed-off-by: Filipe Manana <fdmanana@kernel.org>
-
-diff --git a/libmount/src/optlist.c b/libmount/src/optlist.c
-index 1e962ec6d..0702adae7 100644
---- a/libmount/src/optlist.c
-+++ b/libmount/src/optlist.c
-@@ -875,7 +875,18 @@ int mnt_optlist_get_attrs(struct libmnt_optlist *ls, uint64_t *set, uint64_t *cl
- 
- 		if (opt->ent->mask & MNT_INVERT) {
- 			DBG(OPTLIST, ul_debugobj(ls, " clr: %s", opt->ent->name));
--			*clr |= x;
-+			/*
-+			 * All atime settings are mutually exclusive so *clr must
-+			 * have MOUNT_ATTR__ATIME set.
-+			 *
-+			 * See the function fs/namespace.c:build_mount_kattr()
-+			 * in the linux kernel source.
-+			 */
-+			if (x == MOUNT_ATTR_RELATIME || x == MOUNT_ATTR_NOATIME ||
-+			    x == MOUNT_ATTR_STRICTATIME)
-+				*clr |= MOUNT_ATTR__ATIME;
-+			else
-+				*clr |= x;
- 		} else {
- 			DBG(OPTLIST, ul_debugobj(ls, " set: %s", opt->ent->name));
- 			*set |= x;
-diff --git a/tests/expected/libmount/context-mount-flags b/tests/expected/libmount/context-mount-flags
-index 960641863..eb71323dd 100644
---- a/tests/expected/libmount/context-mount-flags
-+++ b/tests/expected/libmount/context-mount-flags
-@@ -3,3 +3,6 @@ ro,nosuid,noexec
- successfully mounted
- rw,nosuid,noexec
- successfully umounted
-+successfully mounted
-+rw,relatime
-+successfully umounted
-diff --git a/tests/ts/libmount/context b/tests/ts/libmount/context
-index f5b47185e..a5d2e81a3 100755
---- a/tests/ts/libmount/context
-+++ b/tests/ts/libmount/context
-@@ -116,8 +116,15 @@ $TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPU
- 
- ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
- is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
--ts_finalize_subtest
- 
-+# Test that the atime option works after the migration to use the new kernel mount APIs.
-+ts_run $TESTPROG --mount -o atime $DEVICE $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
-+$TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPUT 2>> $TS_ERRLOG
-+is_mounted $DEVICE || echo "$DEVICE not mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
-+ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
-+is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
-+
-+ts_finalize_subtest
- 
- ts_init_subtest "mount-loopdev"
- mkdir -p $MOUNTPOINT &> /dev/null
-
-commit 1ec71634aa4ef5ddca23d65c8a296f3614231e8a
-Author: Colin Gillespie <colin@cgillespie.xyz>
-Date:   Wed Aug 9 18:28:07 2023 +1000
-
-    libblkid: (bcachefs) fix not detecting large superblocks
-    
-    Probing does not detect bcachefs filesystems with a superblock larger
-    than 4KiB. Bcachefs superblocks grow in size and can become much larger
-    than this.
-    
-    Increase the superblock maximum size limit to 1MiB.
-    
-    Validate the superblock isn't larger than the maximum size defined in
-    the superblocks layout section.
-    
-    (cherry picked from commit 48d573797797650d96456979797c0155d58f61cb)
-
-diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
-index 40e702d75..236877042 100644
---- a/libblkid/src/superblocks/bcache.c
-+++ b/libblkid/src/superblocks/bcache.c
-@@ -102,6 +102,15 @@ union bcachefs_sb_csum {
- 	uint8_t raw[16];
- } __attribute__((packed));
- 
-+struct bcachefs_sb_layout {
-+	uint8_t		magic[16];
-+	uint8_t		layout_type;
-+	uint8_t		sb_max_size_bits;
-+	uint8_t		nr_superblocks;
-+	uint8_t		pad[5];
-+	uint64_t	sb_offset[61];
-+} __attribute__((packed));
-+
- struct bcachefs_super_block {
- 	union bcachefs_sb_csum	csum;
- 	uint16_t	version;
-@@ -123,7 +132,7 @@ struct bcachefs_super_block {
- 	uint64_t	flags[8];
- 	uint64_t	features[2];
- 	uint64_t	compat[2];
--	uint8_t		layout[512];
-+	struct bcachefs_sb_layout layout;
- 	struct bcachefs_sb_field _start[];
- }  __attribute__((packed));
- 
-@@ -143,7 +152,7 @@ struct bcachefs_super_block {
- /* granularity of offset and length fields within superblock */
- #define BCACHEFS_SECTOR_SIZE   512
- /* maximum superblock size */
--#define BCACHEFS_SB_MAX_SIZE   4096
-+#define BCACHEFS_SB_MAX_SIZE   0x100000
- /* fields offset within super block */
- #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
- /* tag value for members field */
-@@ -302,6 +311,9 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
- 		return BLKID_PROBE_NONE;
- 
- 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
-+	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
-+		return BLKID_PROBE_NONE;
-+
- 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
- 		return BLKID_PROBE_NONE;
- 
-
-commit acbf17ae8f8ee0f941fe98ed12f115f2b349bba8
-Author: Karel Zak <kzak@redhat.com>
-Date:   Wed Aug 23 11:53:45 2023 +0200
-
-    libblkid: (bcachefs) fix compiler warning [-Werror=sign-compare]
-    
-    Addresses: https://github.com/util-linux/util-linux/pull/2427
-    Signed-off-by: Karel Zak <kzak@redhat.com>
-    (cherry picked from commit 17873d38fc97913c0a31d4bd08cfbfe45c4de5be)
-
-diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
-index 236877042..6ab3fe9d4 100644
---- a/libblkid/src/superblocks/bcache.c
-+++ b/libblkid/src/superblocks/bcache.c
-@@ -311,7 +311,7 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
- 		return BLKID_PROBE_NONE;
- 
- 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
--	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
-+	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
- 		return BLKID_PROBE_NONE;
- 
- 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
-
-commit 6b9fda87c4e5d0c6f945d7565197f157b9fa3d5f
-Author: Thomas Weißschuh <thomas@t-8ch.de>
-Date:   Wed Aug 23 11:58:33 2023 +0200
-
-    libblkid: (bcachefs) fix size validation
-    
-    Avoid signed shift out-of-bounds.
-    
-    Also mark the constants explitly as unsigned instead of casting.
-    
-    Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
-    (cherry picked from commit befe455f59de8c7bc66b85ed52aae8cbc95325fa)
-
-diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
-index 6ab3fe9d4..28ac4b52b 100644
---- a/libblkid/src/superblocks/bcache.c
-+++ b/libblkid/src/superblocks/bcache.c
-@@ -142,17 +142,19 @@ struct bcachefs_super_block {
- /* magic string len */
- #define BCACHE_SB_MAGIC_LEN (sizeof(BCACHE_SB_MAGIC) - 1)
- /* super block offset */
--#define BCACHE_SB_OFF       0x1000
-+#define BCACHE_SB_OFF       0x1000U
- /* supper block offset in kB */
- #define BCACHE_SB_KBOFF     (BCACHE_SB_OFF >> 10)
- /* magic string offset within super block */
- #define BCACHE_SB_MAGIC_OFF offsetof(struct bcache_super_block, magic)
- /* start of checksummed data within superblock */
--#define BCACHE_SB_CSUMMED_START 8
-+#define BCACHE_SB_CSUMMED_START 8U
- /* granularity of offset and length fields within superblock */
--#define BCACHEFS_SECTOR_SIZE   512
-+#define BCACHEFS_SECTOR_SIZE   512U
-+/* maximum superblock size shift */
-+#define BCACHEFS_SB_MAX_SIZE_SHIFT   0x10U
- /* maximum superblock size */
--#define BCACHEFS_SB_MAX_SIZE   0x100000
-+#define BCACHEFS_SB_MAX_SIZE   (1U << BCACHEFS_SB_MAX_SIZE_SHIFT)
- /* fields offset within super block */
- #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
- /* tag value for members field */
-@@ -311,12 +313,16 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
- 		return BLKID_PROBE_NONE;
- 
- 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
--	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
--		return BLKID_PROBE_NONE;
- 
- 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
- 		return BLKID_PROBE_NONE;
- 
-+	if (bcs->layout.sb_max_size_bits > BCACHEFS_SB_MAX_SIZE_SHIFT)
-+		return BLKID_PROBE_NONE;
-+
-+	if (sb_size > (BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
-+		return BLKID_PROBE_NONE;
-+
- 	sb = blkid_probe_get_sb_buffer(pr, mag, sb_size);
- 	if (!sb)
- 		return BLKID_PROBE_NONE;
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index d710fabb7ace..ba989b41a6ca 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -20,16 +20,15 @@
 
 stdenv.mkDerivation rec {
   pname = "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
-  version = "2.39.2";
+  version = "2.39.3";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/util-linux-${version}.tar.xz";
-    hash = "sha256-h6vfqo5JD4vm3el298gLm1/58wHhtn44meHwWlmhUx8=";
+    hash = "sha256-e2YF5I0aSfQ8xLTPxZ8xPQ3VQC+kC5aBC9Vy4Wff7Q8=";
   };
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
-    ./bcachefs-patch-set.patch
   ];
 
   # We separate some of the utilities into their own outputs. This
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index e17fda67218e..3d16748f05a2 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -1,21 +1,16 @@
 { lib, stdenv, fetchFromGitHub, kernel, kmod }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "v4l2loopback";
-  version = "unstable-2023-02-19-${kernel.version}";
+  version = "unstable-2023-11-23-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "umlaeute";
     repo = "v4l2loopback";
-    rev = "fb410fc7af40e972058809a191fae9517b9313af";
-    hash = "sha256-gLFtR7s+3LUQ0BZxHbmaArHbufuphbtAX99nxJU3c84=";
+    rev = "850a2e36849f6ad3c9bf74f2ae3f603452bd8a71";
+    hash = "sha256-LqP5R3oKbjUQUfDZUWpkrmyopWhOt4wlgSgGywTPJXM=";
   };
 
-  patches = [
-    # fix bug https://github.com/umlaeute/v4l2loopback/issues/535
-    ./revert-pr518.patch
-  ];
-
   hardeningDisable = [ "format" "pic" ];
 
   preBuild = ''
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 3cbda3a7ebdd..950547c4f001 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -142,6 +142,20 @@ rec {
 
   };
 
+  # As defined by systemd.syntax(7)
+  #
+  # null does not set any value, which allows for RFC42 modules to specify
+  # optional config options.
+  systemd = let
+    mkValueString = lib.generators.mkValueStringDefault {};
+    mkKeyValue = k: v:
+      if v == null then "# ${k} is unset"
+      else "${k} = ${mkValueString v}";
+  in ini {
+    listsAsDuplicateKeys = true;
+    inherit mkKeyValue;
+  };
+
   keyValue = {
     # Represents lists as duplicate keys
     listsAsDuplicateKeys ? false,
diff --git a/pkgs/servers/ebusd/default.nix b/pkgs/servers/ebusd/default.nix
index 3e0b24c42c86..bc20b930aef0 100644
--- a/pkgs/servers/ebusd/default.nix
+++ b/pkgs/servers/ebusd/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, pkgs, fetchFromGitHub, argparse, mosquitto, cmake, autoconf, automake, libtool, pkg-config, openssl }:
+{ lib, stdenv, pkgs, fetchFromGitHub, fetchpatch, argparse, mosquitto, cmake, autoconf, automake, libtool, pkg-config, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "ebusd";
@@ -27,6 +27,12 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./patches/ebusd-cmake.patch
+    # Upstream patch for gcc-13 copmpatibility:
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/john30/ebusd/commit/3384f3780087bd6b94d46bf18cdad18201ad516c.patch";
+      hash = "sha256-+wZDHjGaIhBCqhy2zmIE8Ko3uAiw8kfKx64etCqRQjM=";
+    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 62abc5de309a..72f9fd11c796 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -3,6 +3,7 @@
 , callPackage
 , fetchFromGitHub
 , fetchPypi
+, fetchpatch
 , python311
 , substituteAll
 , ffmpeg-headless
@@ -30,16 +31,46 @@ let
     # Override the version of some packages pinned in Home Assistant's setup.py and requirements_all.txt
 
     (self: super: {
-      # https://github.com/home-assistant/core/pull/101913
-      aiohttp = super.aiohttp.overridePythonAttrs (old: rec {
-        version = "3.9.1";
-        src = fetchPypi {
-          inherit (old) pname;
-          inherit version;
-          hash = "sha256-j8Sah6wmnUUp2kWHHi/7aHTod3nD0OLM2BPAiZIhI50=";
+      aiogithubapi = super.aiogithubapi.overridePythonAttrs (oldAttrs: rec {
+        version = "22.10.1";
+        src = fetchFromGitHub {
+          owner = "ludeeus";
+          repo = "aiogithubapi";
+          rev = "refs/tags/${version}";
+          hash = "sha256-ceBuqaMqqL6qwN52765MG4sLt+08hx2G9rUVNC7x6ik=";
+        };
+        propagatedBuildInputs = with self; [
+          aiohttp
+          async-timeout
+          backoff
+        ];
+      });
+
+      aionotion = super.aionotion.overridePythonAttrs (oldAttrs: rec {
+        version = "2023.05.5";
+        src = fetchFromGitHub {
+          owner = "bachya";
+          repo = "aionotion";
+          rev = "refs/tags/${version}";
+          hash = "sha256-/2sF8m5R8YXkP89bi5zR3h13r5LrFOl1OsixAcX0D4o=";
+        };
+        patches = [
+          (fetchpatch {
+            # clean up build dependencies; https://github.com/bachya/aionotion/commit/53c7285110d12810f9b43284295f71d052a81b83
+            url = "https://github.com/bachya/aionotion/commit/53c7285110d12810f9b43284295f71d052a81b83.patch";
+            hash = "sha256-RLRbHmaR2A8MNc96WHx0L8ccyygoBUaOulAuRJkFuUM=";
+          })
+        ];
+      });
+
+      aiopvapi = super.aiopvapi.overridePythonAttrs (oldAttrs: rec {
+        version = "2.0.4";
+        src = fetchFromGitHub {
+          owner = "sander76";
+          repo = "aio-powerview-api";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-cghfNi5T343/7GxNLDrE0iAewMlRMycQTP7SvDVpU2M=";
         };
-        patches = [];
-        doCheck = false;
       });
 
       aioskybell = super.aioskybell.overridePythonAttrs (oldAttrs: rec {
@@ -60,14 +91,19 @@ let
           rev = "refs/tags/${version}";
           hash = "sha256-tWnxGLJT+CRFvkhxFamHxnLXBvoR8tfOvzH1o1i5JJg=";
         };
+        postPatch = ''
+          substituteInPlace pyproject.toml --replace \
+            '"setuptools >= 35.0.2", "wheel >= 0.29.0", "poetry>=0.12"' \
+            '"poetry-core"'
+        '';
       });
 
-      aioresponses = super.aioresponses.overridePythonAttrs (oldAttrs: rec {
-        pname = "aioresponses";
-        version = "0.7.6";
+      amberelectric = super.amberelectric.overridePythonAttrs (oldAttrs: rec {
+        version = "1.0.4";
         src = fetchPypi {
-          inherit pname version;
-          hash = "sha256-95XZ29otYXdIQOfjL1Nm9FdS0a3Bt0yTYq/QFylsfuE=";
+          inherit (oldAttrs) pname;
+          inherit version;
+          hash = "sha256-5SWJnTxRm6mzP0RxrgA+jnV+Gp23WjqQA57wbT2V9Dk=";
         };
       });
 
@@ -123,6 +159,7 @@ let
           aenum
           aiohttp
           pydantic
+          requests
         ];
         doCheck = false; # requires asynctest, which does not work on python 3.11
       });
@@ -146,6 +183,16 @@ let
         };
       });
 
+      mcstatus = super.mcstatus.overridePythonAttrs (oldAttrs: rec {
+        version = "11.0.0";
+        src = fetchFromGitHub {
+          owner = "py-mine";
+          repo = "mcstatus";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-1jPIsFEJ17kjtCBiX4IvSf2FxYw9DkH3MrrJ85N71tc=";
+        };
+      });
+
       notifications-android-tv = super.notifications-android-tv.overridePythonAttrs (oldAttrs: rec {
         version = "0.1.5";
         format = "setuptools";
@@ -219,6 +266,18 @@ let
         };
       });
 
+      pyaussiebb = super.pyaussiebb.overridePythonAttrs (oldAttrs: rec {
+        version = "0.0.18";
+        src = fetchFromGitHub {
+          owner = "yaleman";
+          repo = "aussiebb";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-tEdddVsLFCHRvyLCctDakioiop2xWaJlfGE16P1ukHc=";
+        };
+      });
+
+      pydantic = super.pydantic_1;
+
       pydexcom = super.pydexcom.overridePythonAttrs (oldAttrs: rec {
         version = "0.2.3";
         src = fetchFromGitHub {
@@ -287,6 +346,35 @@ let
         };
       });
 
+      tesla-powerwall = super.tesla-powerwall.overridePythonAttrs (oldAttrs: rec {
+        version = "0.3.19";
+        src = fetchFromGitHub {
+          owner = "jrester";
+          repo = "tesla_powerwall";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-ClrMgPAMBtDMfD6hCJIN1u4mp75QW+c3re28v3FreQg=";
+        };
+      });
+
+      versioningit = super.versioningit.overridePythonAttrs (oldAttrs: rec {
+        version = "2.2.0";
+        src = fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          hash = "sha256-6xjnunJoqIC/HM/pLlNOlqs04Dl/KNy8s/wNpPaltr0=";
+        };
+      });
+
+      voluptuous = super.voluptuous.overridePythonAttrs (oldAttrs: rec {
+        version = "0.13.1";
+        src = fetchFromGitHub {
+          owner = "alecthomas";
+          repo = "voluptuous";
+          rev = "refs/tags/${version}";
+          hash = "sha256-cz3Bd+/yPh+VOHxzi/W+gbDh/H5Nl/n4jvxDOirmAVk=";
+        };
+      });
+
       # Pinned due to API changes ~1.0
       vultr = super.vultr.overridePythonAttrs (oldAttrs: rec {
         version = "0.1.2";
@@ -298,6 +386,29 @@ let
         };
       });
 
+      xbox-webapi = super.xbox-webapi.overridePythonAttrs (oldAttrs: rec {
+        version = "2.0.11";
+        src = fetchFromGitHub {
+          owner = "OpenXbox";
+          repo = "xbox-webapi-python";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-fzMB+I8+ZTJUiZovcuj+d5GdHY9BJyJd6j92EhJeIFI=";
+        };
+        postPatch = ''
+          sed -i '/pytest-runner/d' setup.py
+        '';
+        propagatedBuildInputs = with self; [
+          aiohttp
+          appdirs
+          ms-cv
+          pydantic
+          ecdsa
+        ];
+        nativeCheckInputs = with self; [
+          aresponses
+        ];
+      });
+
       # internal python packages only consumed by home-assistant itself
       home-assistant-frontend = self.callPackage ./frontend.nix { };
       home-assistant-intents = self.callPackage ./intents.nix { };
@@ -352,27 +463,19 @@ in python.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python.pkgs; [
     pythonRelaxDepsHook
     setuptools
-    wheel
   ];
 
   pythonRelaxDeps = [
-    "aiohttp"
-    "attrs"
     "awesomeversion"
-    "bcrypt"
     "ciso8601"
     "cryptography"
-    "home-assistant-bluetooth"
     "httpx"
-    "ifaddr"
+    "lru-dict"
     "orjson"
-    "pip"
-    "PyJWT"
-    "pyOpenSSL"
-    "PyYAML"
-    "requests"
+    "pyopenssl"
     "typing-extensions"
-    "voluptuous-serialize"
+    "urllib3"
+    "voluptuous"
     "yarl"
   ];
 
@@ -403,6 +506,9 @@ in python.pkgs.buildPythonApplication rec {
   propagatedBuildInputs = with python.pkgs; [
     # Only packages required in pyproject.toml
     aiohttp
+    aiohttp-cors
+    aiohttp-fast-url-dispatcher
+    aiohttp-zlib-ng
     astral
     async-timeout
     atomicwrites-homeassistant
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index c6e7ad1f5661..27cfd755bcdd 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -42,6 +42,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/apache/httpd/commit/918620a183d843fb393ed939423a25d42c1044ec.patch";
       hash = "sha256-YZi3t++hjM0skisax2xuh9DifZVZjCjVn6XQr6QKGEs=";
     })
+  ] ++ lib.optionals libxml2Support [
+    (fetchpatch {
+      name = "compat-with-libxml2-2.12.patch";
+      url = "https://github.com/apache/httpd/commit/27a68e54b7c6d2ae80dca396fd2727852897dab1.patch";
+      hash = "sha256-k2EqCaDkckrXLsHnjP4h+b1brTnde4pUyrbOiPFB6qk=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/servers/ldap/lldap/default.nix b/pkgs/servers/ldap/lldap/default.nix
index ac55ac025d13..892fa3a10c36 100644
--- a/pkgs/servers/ldap/lldap/default.nix
+++ b/pkgs/servers/ldap/lldap/default.nix
@@ -7,7 +7,6 @@
 , nixosTests
 , rustPlatform
 , rustc
-, rustc-wasm32
 , stdenv
 , wasm-bindgen-cli
 , wasm-pack
@@ -48,7 +47,7 @@ let
     pname = commonDerivationAttrs.pname + "-frontend";
 
     nativeBuildInputs = [
-      wasm-pack wasm-bindgen-84 binaryen which rustc-wasm32 rustc-wasm32.llvmPackages.lld
+      wasm-pack wasm-bindgen-84 binaryen which rustc rustc.llvmPackages.lld
     ];
 
     buildPhase = ''
diff --git a/pkgs/servers/pinnwand/default.nix b/pkgs/servers/pinnwand/default.nix
index 86e05cfed45a..fac861d56b02 100644
--- a/pkgs/servers/pinnwand/default.nix
+++ b/pkgs/servers/pinnwand/default.nix
@@ -18,12 +18,13 @@ with python3.pkgs; buildPythonApplication rec {
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'sqlalchemy = "^1.4"' 'sqlalchemy = "*"'
-  '';
+  pythonRelaxDeps = [
+    "docutils"
+    "sqlalchemy"
+  ];
 
   propagatedBuildInputs = [
     click
diff --git a/pkgs/servers/search/khoj/default.nix b/pkgs/servers/search/khoj/default.nix
index 058fe91ab765..b09864492d7f 100644
--- a/pkgs/servers/search/khoj/default.nix
+++ b/pkgs/servers/search/khoj/default.nix
@@ -2,74 +2,83 @@
 , stdenv
 , fetchFromGitHub
 , python3
-, qt6
+, postgresql
+, postgresqlTestHook
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "khoj";
-  version = "0.3.0";
-  format = "pyproject";
+  version = "1.0.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "debanjum";
     repo = "khoj";
     rev = "refs/tags/${version}";
-    hash = "sha256-9kKK0DXpLfPB2LMnYcC6BKgZaoRsNHBZVe4thI7b9tk=";
+    hash = "sha256-lvOeYTrvW5MfhuJ3lj9n9TRlvpRwVP2vFeaEeJdqIec=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "dateparser == 1.1.1" "dateparser" \
-      --replace "defusedxml == 0.7.1" ""defusedxml"" \
-      --replace "fastapi == 0.77.1" "fastapi" \
-      --replace "jinja2 == 3.1.2" "jinja2" \
-      --replace "openai == 0.20.0" "openai" \
-      --replace "pillow == 9.3.0" "pillow" \
-      --replace "pydantic == 1.9.1" "pydantic" \
-      --replace "pyyaml == 6.0" "pyyaml" \
-      --replace "pyqt6 == 6.3.1" "pyqt6" \
-      --replace "rich >= 13.3.1" "rich" \
-      --replace "schedule == 1.1.0" "schedule" \
-      --replace "sentence-transformers == 2.2.2" "sentence-transformers" \
-      --replace "torch == 1.13.1" "torch" \
-      --replace "uvicorn == 0.17.6" "uvicorn"
-  '';
+  env = {
+    DJANGO_SETTINGS_MODULE = "khoj.app.settings";
+    postgresqlEnableTCP = 1;
+  };
 
   nativeBuildInputs = with python3.pkgs; [
     hatch-vcs
     hatchling
-  ] ++ (with qt6; [
-    wrapQtAppsHook
-  ]);
-
-  buildInputs = lib.optionals stdenv.isLinux [
-    qt6.qtwayland
-  ] ++ lib.optionals stdenv.isDarwin [
-    qt6.qtbase
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
+    aiohttp
+    anyio
+    authlib
+    beautifulsoup4
     dateparser
     defusedxml
+    django
     fastapi
+    google-auth
+    # gpt4all
+    gunicorn
+    httpx
+    itsdangerous
     jinja2
-    numpy
+    langchain
+    lxml
     openai
+    openai-whisper
+    pgvector
     pillow
+    psycopg2
     pydantic
-    pyqt6
+    pymupdf
+    python-multipart
     pyyaml
+    # rapidocr-onnxruntime
+    requests
     rich
     schedule
     sentence-transformers
+    stripe
+    tenacity
+    tiktoken
     torch
+    transformers
+    tzdata
     uvicorn
   ];
 
   nativeCheckInputs = with python3.pkgs; [
+    freezegun
+    factory-boy
+    pytest-xdist
+    trio
+    psutil
+    pytest-django
     pytestCheckHook
+  ] ++ [
+    (postgresql.withPackages (p: with p; [ pgvector ]))
+    postgresqlTestHook
   ];
 
   preCheck = ''
@@ -82,32 +91,51 @@ python3.pkgs.buildPythonApplication rec {
 
   disabledTests = [
     # Tests require network access
-    "test_search_with_valid_content_type"
-    "test_update_with_valid_content_type"
-    "test_regenerate_with_valid_content_type"
-    "test_image_search"
-    "test_notes_search"
-    "test_notes_search_with_only_filters"
-    "test_notes_search_with_include_filter"
-    "test_notes_search_with_exclude_filter"
+    "test_different_user_data_not_accessed"
+    "test_get_api_config_types"
+    "test_get_configured_types_via_api"
     "test_image_metadata"
     "test_image_search"
-    "test_image_search_query_truncated"
     "test_image_search_by_filepath"
-    "test_asymmetric_setup_with_missing_file_raises_error"
-    "test_asymmetric_setup_with_empty_file_raises_error"
-    "test_asymmetric_reload"
-    "test_asymmetric_setup"
-    "test_asymmetric_search"
-    "test_entry_chunking_by_max_tokens"
-    "test_incremental_update"
+    "test_image_search_query_truncated"
+    "test_index_update"
+    "test_index_update_with_no_auth_key"
+    "test_notes_search"
+    "test_notes_search_with_exclude_filter"
+    "test_notes_search_with_include_filter"
+    "test_parse_html_plaintext_file"
+    "test_regenerate_index_with_new_entry"
+    "test_regenerate_with_github_fails_without_pat"
+    "test_regenerate_with_invalid_content_type"
+    "test_regenerate_with_valid_content_type"
+    "test_search_for_user2_returns_empty"
+    "test_search_with_invalid_auth_key"
+    "test_search_with_invalid_content_type"
+    "test_search_with_no_auth_key"
+    "test_search_with_valid_content_type"
+    "test_text_index_same_if_content_unchanged"
+    "test_text_indexer_deletes_embedding_before_regenerate"
+    "test_text_search"
+    "test_text_search_setup_batch_processes"
+    "test_update_with_invalid_content_type"
+    "test_user_no_data_returns_empty"
+
+    # Tests require rapidocr-onnxruntime
+    "test_multi_page_pdf_to_jsonl"
+    "test_single_page_pdf_to_jsonl"
+    "test_ocr_page_pdf_to_jsonl"
+  ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "tests/test_conversation_utils.py"
   ];
 
   meta = with lib; {
     description = "Natural Language Search Assistant for your Org-Mode and Markdown notes, Beancount transactions and Photos";
     homepage = "https://github.com/debanjum/khoj";
     changelog = "https://github.com/debanjum/khoj/releases/tag/${version}";
-    license = licenses.gpl3Only;
+    license = licenses.agpl3Plus;
     maintainers = with maintainers; [ dit7ya ];
     # src/tcmalloc.cc:333] Attempt to free invalid pointer
     broken = stdenv.isDarwin;
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_1.nix b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
index f5de11c7cc11..a51fc1d104b1 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_1.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_1.nix
@@ -2,5 +2,5 @@
 
 callPackage ./. (args // {
   version = "3.1.21";
-  hash = "sha256-PovyQvomT8+vGWS39/QjLauiGkSiuqKQpTrSXdyVyow=";
+  hash = "sha256-guN3Rcsb/EV4rxPE3yhJRSsT1+z44zUetg7ZBA4WjIc=";
 })
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_2.nix b/pkgs/servers/sql/mariadb/connector-c/3_2.nix
index d9ef5d8966fe..6619e261650c 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_2.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_2.nix
@@ -2,5 +2,5 @@
 
 callPackage ./. (args // {
   version = "3.2.7";
-  hash = "sha256-nXGWJI5ml8Ccc+Fz/psoIEX1XsnXrnQ8HrrQi56lbdo=";
+  hash = "sha256-F7s9fcbJiz6lsWrvlTpY+ZET8MPwlyWPKJZOvHEwBvo=";
 })
diff --git a/pkgs/servers/sql/mariadb/connector-c/3_3.nix b/pkgs/servers/sql/mariadb/connector-c/3_3.nix
index ec70d9998283..9f750fe8108b 100644
--- a/pkgs/servers/sql/mariadb/connector-c/3_3.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/3_3.nix
@@ -2,5 +2,5 @@
 
 callPackage ./. (args // {
   version = "3.3.5";
-  hash = "sha256-ynLrJvbbK++nfkj/lm9xvNPLRLM72Lu4ELZebQEcHlw=";
+  hash = "sha256-RLHx8PyfbfIDr6X6ky5/w0XsGMFd+v5PgmQHvYOaf+k=";
 })
diff --git a/pkgs/servers/sql/mariadb/connector-c/default.nix b/pkgs/servers/sql/mariadb/connector-c/default.nix
index 7a175620c7cb..be4af113c1d9 100644
--- a/pkgs/servers/sql/mariadb/connector-c/default.nix
+++ b/pkgs/servers/sql/mariadb/connector-c/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake
+{ lib, stdenv, fetchFromGitHub, cmake
 , curl, openssl, zlib, zstd
 , libiconv
 , version, hash, ...
@@ -13,8 +13,10 @@ in stdenv.mkDerivation {
   pname = "mariadb-connector-c";
   inherit version;
 
-  src = fetchurl {
-    url = "https://downloads.mariadb.com/Connectors/c/connector-c-${version}/mariadb-connector-c-${version}-src.tar.gz";
+  src = fetchFromGitHub {
+    owner = "mariadb-corporation";
+    repo = "mariadb-connector-c";
+    rev = "v${version}";
     inherit hash;
   };
 
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 6cd3e2c7a014..3ff31ba1d3ab 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -58,6 +58,10 @@ let
 
       patches = [
         ./patch/cmake-includedir.patch
+
+        # Fix build with libxml 2.12 and Clang 16.
+        # https://github.com/MariaDB/server/pull/2983
+        ./patch/0001-Fix-build-with-libxml2-2.12.patch
       ]
         # Fixes a build issue as documented on
         # https://jira.mariadb.org/browse/MDEV-26769?focusedCommentId=206073&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-206073
@@ -234,7 +238,6 @@ let
       '';
 
       CXXFLAGS = lib.optionalString stdenv.hostPlatform.isi686 "-fpermissive";
-      NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
     });
   in
     server // {
diff --git a/pkgs/servers/sql/mariadb/patch/0001-Fix-build-with-libxml2-2.12.patch b/pkgs/servers/sql/mariadb/patch/0001-Fix-build-with-libxml2-2.12.patch
new file mode 100644
index 000000000000..a12dfb73d09d
--- /dev/null
+++ b/pkgs/servers/sql/mariadb/patch/0001-Fix-build-with-libxml2-2.12.patch
@@ -0,0 +1,167 @@
+From 1f1ee5d3776af7ef56ffa3f4dcd22532c2c86c74 Mon Sep 17 00:00:00 2001
+From: Jan Tojnar <jtojnar@gmail.com>
+Date: Sun, 7 Jan 2024 10:19:54 +0100
+Subject: [PATCH] Fix build with libxml2 2.12
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+libxml2 2.12.0 made `xmlGetLastError()` return `const` pointer:
+
+https://gitlab.gnome.org/GNOME/libxml2/-/commit/61034116d0a3c8b295c6137956adc3ae55720711
+
+Clang 16 does not like this:
+
+    error: assigning to 'xmlErrorPtr' (aka '_xmlError *') from 'const xmlError *' (aka 'const _xmlError *') discards qualifiers
+    error: cannot initialize a variable of type 'xmlErrorPtr' (aka '_xmlError *') with an rvalue of type 'const xmlError *' (aka 'const _xmlError *')
+
+Let’s update the variables to `const`.
+For older versions, it will be automatically converted.
+
+But then `xmlResetError(xmlError*)` will not like the `const` pointer:
+
+    error: no matching function for call to 'xmlResetError'
+    note: candidate function not viable: 1st argument ('const xmlError *' (aka 'const _xmlError *')) would lose const qualifier
+
+Let’s replace it with `xmlResetLastError()`.
+
+ALso remove `LIBXMLDOC::Xerr` protected member property.
+It was introduced in 65b0e5455b547a3d574fa77b34cce23ae3bea0a0
+along with the `xmlResetError` calls.
+It does not appear to be used for anything.
+---
+ storage/connect/libdoc.cpp | 39 +++++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/storage/connect/libdoc.cpp b/storage/connect/libdoc.cpp
+index e414aa88355..10edcbc3ffa 100644
+--- a/storage/connect/libdoc.cpp
++++ b/storage/connect/libdoc.cpp
+@@ -93,7 +93,6 @@ class LIBXMLDOC : public XMLDOCUMENT {
+   xmlXPathContextPtr Ctxp;
+   xmlXPathObjectPtr  Xop;
+   xmlXPathObjectPtr  NlXop;
+-  xmlErrorPtr        Xerr;
+   char              *Buf;                  // Temporary
+   bool               Nofreelist;
+ }; // end of class LIBXMLDOC
+@@ -327,7 +326,6 @@ LIBXMLDOC::LIBXMLDOC(char *nsl, char *nsdf, char *enc, PFBLOCK fp)
+   Ctxp = NULL;
+   Xop = NULL;
+   NlXop = NULL;
+-  Xerr = NULL;
+   Buf = NULL;
+   Nofreelist = false;
+   } // end of LIBXMLDOC constructor
+@@ -365,8 +363,8 @@ bool LIBXMLDOC::ParseFile(PGLOBAL g, char *fn)
+       Encoding = (char*)Docp->encoding;
+ 
+     return false;
+-  } else if ((Xerr = xmlGetLastError()))
+-    xmlResetError(Xerr);
++  } else if (xmlGetLastError())
++    xmlResetLastError();
+ 
+   return true;
+   } // end of ParseFile
+@@ -505,9 +503,9 @@ int LIBXMLDOC::DumpDoc(PGLOBAL g, char *ofn)
+ #if 1
+   // This function does not crash (
+   if (xmlSaveFormatFileEnc((const char *)ofn, Docp, Encoding, 0) < 0) {
+-    xmlErrorPtr err = xmlGetLastError();
++    const xmlError *err = xmlGetLastError();
+     strcpy(g->Message, (err) ? err->message : "Error saving XML doc");
+-    xmlResetError(Xerr);
++    xmlResetLastError();
+     rc = -1;
+     } // endif Save
+ //  rc = xmlDocDump(of, Docp);
+@@ -546,8 +544,8 @@ void LIBXMLDOC::CloseDoc(PGLOBAL g, PFBLOCK xp)
+     if (Nlist) {
+       xmlXPathFreeNodeSet(Nlist);
+ 
+-      if ((Xerr = xmlGetLastError()))
+-        xmlResetError(Xerr);
++      if (xmlGetLastError())
++        xmlResetLastError();
+ 
+       Nlist = NULL;
+       } // endif Nlist
+@@ -555,8 +553,8 @@ void LIBXMLDOC::CloseDoc(PGLOBAL g, PFBLOCK xp)
+     if (Xop) {
+       xmlXPathFreeObject(Xop);
+ 
+-      if ((Xerr = xmlGetLastError()))
+-        xmlResetError(Xerr);
++      if (xmlGetLastError())
++        xmlResetLastError();
+ 
+       Xop = NULL;
+       } // endif Xop
+@@ -564,8 +562,8 @@ void LIBXMLDOC::CloseDoc(PGLOBAL g, PFBLOCK xp)
+     if (NlXop) {
+       xmlXPathFreeObject(NlXop);
+ 
+-      if ((Xerr = xmlGetLastError()))
+-        xmlResetError(Xerr);
++      if (xmlGetLastError())
++        xmlResetLastError();
+ 
+       NlXop = NULL;
+       } // endif NlXop
+@@ -573,8 +571,8 @@ void LIBXMLDOC::CloseDoc(PGLOBAL g, PFBLOCK xp)
+     if (Ctxp) {
+       xmlXPathFreeContext(Ctxp);
+ 
+-      if ((Xerr = xmlGetLastError()))
+-        xmlResetError(Xerr);
++      if (xmlGetLastError())
++        xmlResetLastError();
+ 
+       Ctxp = NULL;
+       } // endif Ctxp
+@@ -590,6 +588,7 @@ void LIBXMLDOC::CloseDoc(PGLOBAL g, PFBLOCK xp)
+ /******************************************************************/
+ xmlNodeSetPtr LIBXMLDOC::GetNodeList(PGLOBAL g, xmlNodePtr np, char *xp)
+   {
++  const xmlError *xerr;
+   xmlNodeSetPtr nl;
+ 
+   if (trace(1))
+@@ -649,11 +648,11 @@ xmlNodeSetPtr LIBXMLDOC::GetNodeList(PGLOBAL g, xmlNodePtr np, char *xp)
+     } else
+       xmlXPathFreeObject(Xop);            // Caused node not found
+ 
+-    if ((Xerr = xmlGetLastError())) {
+-      strcpy(g->Message, Xerr->message);
+-      xmlResetError(Xerr);
++    if ((xerr = xmlGetLastError())) {
++      strcpy(g->Message, xerr->message);
++      xmlResetLastError();
+       return NULL;
+-      } // endif Xerr
++      } // endif xerr
+ 
+     } // endif Xop
+ 
+@@ -1079,7 +1078,7 @@ void XML2NODE::AddText(PGLOBAL g, PCSZ txtp)
+ /******************************************************************/
+ void XML2NODE::DeleteChild(PGLOBAL g, PXNODE dnp)
+   {
+-  xmlErrorPtr xerr;
++  const xmlError *xerr;
+ 
+   if (trace(1))
+     htrc("DeleteChild: node=%p\n", dnp);
+@@ -1122,7 +1121,7 @@ void XML2NODE::DeleteChild(PGLOBAL g, PXNODE dnp)
+   if (trace(1))
+     htrc("DeleteChild: errmsg=%-.256s\n", xerr->message);
+ 
+-  xmlResetError(xerr);
++  xmlResetLastError();
+   } // end of DeleteChild
+ 
+ /* -------------------- class XML2NODELIST ---------------------- */
+-- 
+2.42.0
+
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index ec2f95f5bd55..69acb0cd1a85 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -5,6 +5,7 @@ let
       { stdenv, lib, fetchurl, makeWrapper, fetchpatch
       , glibc, zlib, readline, openssl, icu, lz4, zstd, systemd, libossp_uuid
       , pkg-config, libxml2, tzdata, libkrb5, substituteAll, darwin
+      , linux-pam
 
       # This is important to obtain a version of `libpq` that does not depend on systemd.
       , enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd && !stdenv.hostPlatform.isStatic
@@ -63,6 +64,7 @@ let
       ++ lib.optionals zstdEnabled [ zstd ]
       ++ lib.optionals enableSystemd [ systemd ]
       ++ lib.optionals gssSupport [ libkrb5 ]
+      ++ lib.optionals stdenv'.isLinux [ linux-pam ]
       ++ lib.optionals (!stdenv'.isDarwin) [ libossp_uuid ];
 
     nativeBuildInputs = [
@@ -96,7 +98,8 @@ let
       ++ lib.optionals zstdEnabled [ "--with-zstd" ]
       ++ lib.optionals gssSupport [ "--with-gssapi" ]
       ++ lib.optionals stdenv'.hostPlatform.isRiscV [ "--disable-spinlocks" ]
-      ++ lib.optionals jitSupport [ "--with-llvm" ];
+      ++ lib.optionals jitSupport [ "--with-llvm" ]
+      ++ lib.optionals stdenv'.isLinux [ "--with-pam" ];
 
     patches = [
       (if atLeast "16" then ./patches/disable-normalize_exec_path.patch
@@ -106,6 +109,17 @@ let
       ./patches/specify_pkglibdir_at_runtime.patch
       ./patches/findstring.patch
 
+      # Fix build with libxml2 2.12.0 and -Wincompatible-function-pointer-types
+      (if atLeast "16" then
+        # https://www.postgresql.org/message-id/CACpMh%2BDMZVHM%2BiDSyqdcpK8sr7jd_HxxLJRNvGTzcLBE0W07QA%40mail.gmail.com
+        fetchurl {
+          url = "https://www.postgresql.org/message-id/attachment/152769/v1-0001-Make-PostgreSQL-work-with-newer-version-of-libxml.patch";
+          hash = "sha256-1j5mtG++hFmYwfS98PdN1SmNI4T86q4FXvKLz2VeJyg=";
+        }
+      else
+        ./patches/libxml2.12-15.patch
+      )
+
       (substituteAll {
         src = ./locale-binary-path.patch;
         locale = "${if stdenv.isDarwin then darwin.adv_cmds else lib.getBin stdenv.cc.libc}/bin/locale";
diff --git a/pkgs/servers/sql/postgresql/patches/libxml2.12-15.patch b/pkgs/servers/sql/postgresql/patches/libxml2.12-15.patch
new file mode 100644
index 000000000000..13438c7d4bb7
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/patches/libxml2.12-15.patch
@@ -0,0 +1,22 @@
+diff --git a/src/backend/utils/adt/xml.c b/src/backend/utils/adt/xml.c
+index 6411f56b998..0eb39fcfc26 100644
+--- a/src/backend/utils/adt/xml.c
++++ b/src/backend/utils/adt/xml.c
+@@ -119,7 +119,7 @@ struct PgXmlErrorContext
+ 
+ static xmlParserInputPtr xmlPgEntityLoader(const char *URL, const char *ID,
+ 										   xmlParserCtxtPtr ctxt);
+-static void xml_errorHandler(void *data, xmlErrorPtr error);
++static void xml_errorHandler(void *data, const xmlError *error);
+ static void xml_ereport_by_code(int level, int sqlcode,
+ 								const char *msg, int errcode);
+ static void chopStringInfoNewlines(StringInfo str);
+@@ -1749,7 +1749,7 @@ xml_ereport(PgXmlErrorContext *errcxt, int level, int sqlcode, const char *msg)
+  * Error handler for libxml errors and warnings
+  */
+ static void
+-xml_errorHandler(void *data, xmlErrorPtr error)
++xml_errorHandler(void *data, const xmlError *error)
+ {
+ 	PgXmlErrorContext *xmlerrcxt = (PgXmlErrorContext *) data;
+ 	xmlParserCtxtPtr ctxt = (xmlParserCtxtPtr) error->ctxt;
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index cde718df1aba..463fd7e4847d 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -420,4 +420,18 @@ rec {
         "propagatedBuildInputs"
       ]);
     });
+
+  withDefaultHardeningFlags = defaultHardeningFlags: stdenv: let
+    bintools = let
+      bintools' = stdenv.cc.bintools;
+    in if bintools' ? override then (bintools'.override {
+      inherit defaultHardeningFlags;
+    }) else bintools';
+  in
+    stdenv.override (old: {
+      cc = if stdenv.cc == null then null else stdenv.cc.override {
+        inherit bintools;
+      };
+      allowedRequisites = lib.mapNullable (rs: rs ++ [ bintools ]) (stdenv.allowedRequisites or null);
+    });
 }
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index faa83507893f..78e3f87daabe 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -239,23 +239,26 @@ let
     # disabling fortify implies fortify3 should also be disabled
     then unique (hardeningDisable ++ [ "fortify3" ])
     else hardeningDisable;
-  supportedHardeningFlags = [ "fortify" "fortify3" "stackprotector" "pie" "pic" "strictoverflow" "format" "relro" "bindnow" ];
-  # Musl-based platforms will keep "pie", other platforms will not.
-  # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
-  # in the nixpkgs manual to inform users about the defaults.
-  defaultHardeningFlags = if stdenv.hostPlatform.isMusl &&
-      # Except when:
-      #    - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
-      #    - static armv7l, where compilation fails.
-      !(stdenv.hostPlatform.isAarch && stdenv.hostPlatform.isStatic)
-    then supportedHardeningFlags
-    else remove "pie" supportedHardeningFlags;
+  knownHardeningFlags = [
+    "bindnow"
+    "format"
+    "fortify"
+    "fortify3"
+    "pic"
+    "pie"
+    "relro"
+    "stackprotector"
+    "strictoverflow"
+  ];
+  defaultHardeningFlags = stdenv.cc.defaultHardeningFlags or
+    # fallback safe-ish set of flags
+    (remove "pie" knownHardeningFlags);
   enabledHardeningOptions =
     if builtins.elem "all" hardeningDisable'
     then []
     else subtractLists hardeningDisable' (defaultHardeningFlags ++ hardeningEnable);
   # hardeningDisable additionally supports "all".
-  erroneousHardeningFlags = subtractLists supportedHardeningFlags (hardeningEnable ++ remove "all" hardeningDisable);
+  erroneousHardeningFlags = subtractLists knownHardeningFlags (hardeningEnable ++ remove "all" hardeningDisable);
 
   checkDependencyList = checkDependencyList' [];
   checkDependencyList' = positions: name: deps: flip imap1 deps (index: dep:
@@ -264,7 +267,7 @@ let
     else throw "Dependency is not of a valid type: ${concatMapStrings (ix: "element ${toString ix} of ") ([index] ++ positions)}${name} for ${attrs.name or attrs.pname}");
 in if builtins.length erroneousHardeningFlags != 0
 then abort ("mkDerivation was called with unsupported hardening flags: " + lib.generators.toPretty {} {
-  inherit erroneousHardeningFlags hardeningDisable hardeningEnable supportedHardeningFlags;
+  inherit erroneousHardeningFlags hardeningDisable hardeningEnable knownHardeningFlags;
 })
 else let
   doCheck = doCheck';
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 081024781eef..ec8df76f2c79 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -1044,7 +1044,11 @@ _defaultUnpack() {
         case "$fn" in
             *.tar.xz | *.tar.lzma | *.txz)
                 # Don't rely on tar knowing about .xz.
-                xz -d < "$fn" | tar xf - --warning=no-timestamp
+                # Additionally, we have multiple different xz binaries with different feature sets in different
+                # stages. The XZ_OPT env var is only used by the full "XZ utils" implementation, which supports
+                # the --threads (-T) flag. This allows us to enable multithreaded decompression exclusively on
+                # that implementation, without the use of complex bash conditionals and checks.
+                XZ_OPT="--threads=$NIX_BUILD_CORES" xz -d < "$fn" | tar xf - --warning=no-timestamp
                 ;;
             *.tar | *.tar.* | *.tgz | *.tbz2 | *.tbz)
                 # GNU tar can automatically select the decompression method
diff --git a/pkgs/test/auto-patchelf-hook/default.nix b/pkgs/test/auto-patchelf-hook/default.nix
new file mode 100644
index 000000000000..6e05e729fba8
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook/default.nix
@@ -0,0 +1,6 @@
+{ lib, callPackage }:
+
+lib.recurseIntoAttrs {
+  withStructuredAttrs = callPackage ./package.nix { __structuredAttrs = true; };
+  withoutStructuredAttrs = callPackage ./package.nix { __structuredAttrs = false; };
+}
diff --git a/pkgs/test/auto-patchelf-hook/package.nix b/pkgs/test/auto-patchelf-hook/package.nix
new file mode 100644
index 000000000000..be03ee68c039
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook/package.nix
@@ -0,0 +1,96 @@
+# This is a test for autoPatchelfHook. To test it, we just need a simple binary
+# which uses the hook. We took the derivation from tonelib-jam, which sounds
+# like a good candidate with a small closure, and trimmed it down.
+
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, freetype
+, curl
+# This test checks that the behavior of autoPatchelfHook is correct whether
+# __structuredAttrs
+# (https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-structuredAttrs)
+# is set or not. Hence __structuredAttrs is provided as a parameter.
+, __structuredAttrs
+}:
+
+let runtimeDependencies = [
+  (lib.getLib curl)
+  "/some/dep"
+  "/some/other/dep"
+]
+# A dependency with space only works with __structuredAttrs set to true.
+++ lib.lists.optional __structuredAttrs "/some/dep with space";
+in
+
+stdenv.mkDerivation {
+  name = "auto-patchelf-test";
+
+  src = fetchurl {
+    url = "https://tonelib.net/download/221222/ToneLib-Jam-amd64.deb";
+    sha256 = "sha256-c6At2lRPngQPpE7O+VY/Hsfw+QfIb3COIuHfbqqIEuM=";
+  };
+
+  unpackCmd = ''
+    dpkg -x $curSrc source
+  '';
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+  ];
+
+  installPhase = ''
+    mv usr $out
+  '';
+
+  buildInputs = [
+    freetype
+  ];
+
+  autoPatchelfIgnoreMissingDeps = [
+    "libGL.so.1"
+    "libasound.so.2"
+  ];
+
+  inherit runtimeDependencies;
+
+  # Additional phase performing the actual test.
+  installCheckPhase =
+    let allDeps = runtimeDependencies ++ [ (lib.getLib freetype) ];
+    in
+    ''
+      local binary="$out/bin/ToneLib-Jam"
+      local interpreter=$(patchelf --print-interpreter $binary)
+      local runpath=$(patchelf --print-rpath $binary)
+      local glibcStorePath="${stdenv.cc.libc}"
+
+      # Check that the glibc path is a prefix of the interpreter. If
+      # autoPatchelfHook ran correctly, the binary should have set the interpreter
+      # to point to the store.
+      echo "[auto-patchelf-hook-test]: Check that the interpreter is in the store"
+      test "''${interpreter#$glibcStorePath}" != "$interpreter"
+
+      readarray -td':' runpathArray < <(echo -n "$runpath")
+
+      echo "[auto-patchelf-hook-test]: Check that the runpath has the right number of entries"
+      test "''${#runpathArray[@]}" -eq ${builtins.toString (builtins.length allDeps)}
+
+      echo "[auto-patchelf-hook-test]: Check that the runpath contains the expected runtime deps"
+    ''
+    + lib.strings.concatStringsSep "\n"
+      (lib.lists.imap0
+        (i: path:
+          let iAsStr = builtins.toString i; in
+          ''
+            echo "[auto-patchelf-hook-test]: Check that entry ${iAsStr} is ${path}"
+            test "''${paths[${iAsStr}]}" = "$path"
+          '')
+        allDeps
+      );
+
+  doInstallCheck = true;
+  inherit __structuredAttrs;
+}
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 65305bf165d3..363b0a2e1519 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -168,4 +168,6 @@ with pkgs;
   pkgs-lib = recurseIntoAttrs (import ../pkgs-lib/tests { inherit pkgs; });
 
   nixpkgs-check-by-name = callPackage ./nixpkgs-check-by-name { };
+
+  auto-patchelf-hook = callPackage ./auto-patchelf-hook { };
 }
diff --git a/pkgs/tools/admin/ansible/lint.nix b/pkgs/tools/admin/ansible/lint.nix
index fbac95d019ba..e1c168f8bf53 100644
--- a/pkgs/tools/admin/ansible/lint.nix
+++ b/pkgs/tools/admin/ansible/lint.nix
@@ -23,6 +23,11 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     setuptools
     setuptools-scm
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "ruamel.yaml"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index 7bbc1e14efbe..73c86278df70 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -10,14 +10,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "awscli";
-  version = "1.30.2"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.31.6"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XbYsPbYUIJPCS+nhcE3A5K7yxHcGUkulT5vHPT5T9kM=";
+    hash = "sha256-PINiNkP2vopPgc9bH0x7mifeUt7gdXi3/i2Ye96RANg=";
   };
 
-
   propagatedBuildInputs = with python3.pkgs; [
     botocore
     bcdoc
diff --git a/pkgs/tools/archivers/cpio/default.nix b/pkgs/tools/archivers/cpio/default.nix
index 1b766fed1492..4116a0b3e4ca 100644
--- a/pkgs/tools/archivers/cpio/default.nix
+++ b/pkgs/tools/archivers/cpio/default.nix
@@ -1,6 +1,8 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
+, autoreconfHook
 
 # for passthru.tests
 , git
@@ -18,6 +20,17 @@ stdenv.mkDerivation rec {
     sha256 = "/NwV1g9yZ6b8fvzWudt7bIlmxPL7u5ZMJNQTNv0/LBI=";
   };
 
+  patches = [
+    # Pull upstream fix for clang-16 and gcc-14.
+    (fetchpatch {
+      name = "major-decl.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=8179be21e664cedb2e9d238cc2f6d04965e97275";
+      hash = "sha256-k5Xiv3xuPU8kPT6D9B6p+V8SK55ybFgrIIPDgHuorpM=";
+    })
+  ];
+
+  nativeBuildInputs = [ autoreconfHook ];
+
   separateDebugInfo = true;
 
   preConfigure = lib.optionalString stdenv.isCygwin ''
diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
index c504ed8f16e1..002854e045d2 100644
--- a/pkgs/tools/archivers/sharutils/default.nix
+++ b/pkgs/tools/archivers/sharutils/default.nix
@@ -58,6 +58,9 @@ stdenv.mkDerivation rec {
       substituteInPlace intl/Makefile.in --replace "AR = ar" ""
     '';
 
+  # Workaround to fix the static build on macOS.
+  NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/tools/audio/wyoming/piper.nix b/pkgs/tools/audio/wyoming/piper.nix
index f53f684f6fac..32d21bfa4eaf 100644
--- a/pkgs/tools/audio/wyoming/piper.nix
+++ b/pkgs/tools/audio/wyoming/piper.nix
@@ -27,6 +27,11 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = with python3Packages; [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "wyoming"
   ];
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/backup/borgbackup/default.nix b/pkgs/tools/backup/borgbackup/default.nix
index 33c5aa527218..d7853d0506f6 100644
--- a/pkgs/tools/backup/borgbackup/default.nix
+++ b/pkgs/tools/backup/borgbackup/default.nix
@@ -14,7 +14,22 @@
 , fetchPypi
 }:
 
-python3Packages.buildPythonApplication rec {
+let
+  python = python3Packages.python.override {
+    packageOverrides = self: super: {
+      msgpack = super.msgpack.overrideAttrs (oldAttrs: rec {
+        version ="1.0.4";
+
+        src = fetchPypi {
+          pname = "msgpack";
+          inherit version;
+          hash = "sha256-9dhpwY8DAgLrQS8Iso0q/upVPWYTruieIA16yn7wH18=";
+        };
+      });
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
   pname = "borgbackup";
   version = "1.2.7";
   format = "pyproject";
@@ -30,7 +45,7 @@ python3Packages.buildPythonApplication rec {
       --replace "0o4755" "0o0755"
   '';
 
-  nativeBuildInputs = with python3Packages; [
+  nativeBuildInputs = with python.pkgs; [
     cython
     setuptools-scm
     pkgconfig
@@ -55,7 +70,7 @@ python3Packages.buildPythonApplication rec {
     acl
   ];
 
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python.pkgs; [
     msgpack
     packaging
     (if stdenv.isLinux then pyfuse3 else llfuse)
@@ -72,7 +87,7 @@ python3Packages.buildPythonApplication rec {
       --zsh scripts/shell_completions/zsh/_borg
   '';
 
-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs = with python.pkgs; [
     e2fsprogs
     py
     python-dateutil
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index 15b8a33de675..452fab128e14 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -36,8 +36,6 @@ python3.pkgs.buildPythonApplication rec {
     ./linux-disable-timezone-test.patch
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   preConfigure = ''
     # fix version displayed by duplicity --version
     # see SourceCopy in setup.py
diff --git a/pkgs/tools/backup/gphotos-sync/default.nix b/pkgs/tools/backup/gphotos-sync/default.nix
index 53db44bb2e11..74c442c09583 100644
--- a/pkgs/tools/backup/gphotos-sync/default.nix
+++ b/pkgs/tools/backup/gphotos-sync/default.nix
@@ -8,8 +8,6 @@ python3.pkgs.buildPythonApplication rec {
   version = "3.1.2";
   format = "pyproject";
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   src = fetchFromGitHub {
     owner = "gilesknap";
     repo = "gphotos-sync";
diff --git a/pkgs/tools/compression/efficient-compression-tool/default.nix b/pkgs/tools/compression/efficient-compression-tool/default.nix
index 17c1bfcbcf2b..a4f4b9fd40da 100644
--- a/pkgs/tools/compression/efficient-compression-tool/default.nix
+++ b/pkgs/tools/compression/efficient-compression-tool/default.nix
@@ -29,6 +29,11 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DECT_FOLDER_SUPPORT=ON" ];
 
+  CXXFLAGS = [
+    # GCC 13: error: 'uint32_t' does not name a type
+    "-include cstdint"
+  ];
+
   meta = with lib; {
     description = "Fast and effective C++ file optimizer";
     homepage = "https://github.com/fhanau/Efficient-Compression-Tool";
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 75b306b368aa..4ba37c1502f6 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -50,8 +50,6 @@ stdenv.mkDerivation rec {
       tests/playTests.sh
   '';
 
-  LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
-
   cmakeFlags = lib.attrsets.mapAttrsToList
     (name: value: "-DZSTD_${name}:BOOL=${if value then "ON" else "OFF"}") {
       BUILD_SHARED = !static;
diff --git a/pkgs/tools/filesystems/f2fs-tools/default.nix b/pkgs/tools/filesystems/f2fs-tools/default.nix
index c2af09857728..811adfadb55b 100644
--- a/pkgs/tools/filesystems/f2fs-tools/default.nix
+++ b/pkgs/tools/filesystems/f2fs-tools/default.nix
@@ -1,12 +1,11 @@
-{ lib, stdenv, fetchgit, autoreconfHook, libselinux, libuuid, pkg-config }:
+{ lib, stdenv, fetchzip, autoreconfHook, libselinux, libuuid, pkg-config }:
 
 stdenv.mkDerivation rec {
   pname = "f2fs-tools";
   version = "1.16.0";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs-tools.git";
-    rev = "refs/tags/v${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs-tools.git/snapshot/f2fs-tools-v${version}.tar.gz";
     sha256 = "sha256-zNG1F//+BTBzlEc6qNVixyuCB6PMZD5Kf8pVK0ePYiA=";
   };
 
diff --git a/pkgs/tools/filesystems/rdfind/default.nix b/pkgs/tools/filesystems/rdfind/default.nix
index 59724c0c7c52..0e7c8fd42d63 100644
--- a/pkgs/tools/filesystems/rdfind/default.nix
+++ b/pkgs/tools/filesystems/rdfind/default.nix
@@ -1,22 +1,14 @@
-{ lib, stdenv, fetchpatch, fetchurl, nettle }:
+{ lib, stdenv, fetchurl, nettle }:
 
 stdenv.mkDerivation rec {
   pname = "rdfind";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://rdfind.pauldreik.se/${pname}-${version}.tar.gz";
-    sha256 = "103hfqzgr6izmj57fcy4jsa2nmb1ax43q4b5ij92pcgpaq9fsl21";
+    sha256 = "sha256-ekBujvGIalhpZVYEYY3Zj2cvEsamvkkm0FO+ZQcPMnk=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "include-limits.patch";
-      url = "https://github.com/pauldreik/rdfind/commit/61877de88d782b63b17458a61fcc078391499b29.patch";
-      sha256 = "0igzm4833cn905pj84lgr88nd5gx35dnjl8kl8vrwk7bpyii6a8l";
-    })
-  ];
-
   buildInputs = [ nettle ];
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/cc2538-bsl/default.nix b/pkgs/tools/misc/cc2538-bsl/default.nix
index 602327ab79b1..a4b3c992544a 100644
--- a/pkgs/tools/misc/cc2538-bsl/default.nix
+++ b/pkgs/tools/misc/cc2538-bsl/default.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "cc2538-bsl";
-  version = "unstable-2023-08-14";
+  version = "2.1-unstable-2023-10-03";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "JelmerT";
     repo = "cc2538-bsl";
-    rev = "641305fb5cae98415a28cbfab6e63436c1753abf";
-    hash = "sha256-fPY12kValxbJORi9xNyxzwkGpD9F9u3M1+aa9IlSiaE=";
+    rev = "4d64ac633dbaf29d098842c5937ed6eea2fd7c45";
+    hash = "sha256-NX2jPYAz15bSucj/YR5E/0eJy/cbszSrNxyJHRsbXxo=";
   };
 
   patches = [
diff --git a/pkgs/tools/misc/crudini/default.nix b/pkgs/tools/misc/crudini/default.nix
index fa4e7cc34a48..ea77f4db163e 100644
--- a/pkgs/tools/misc/crudini/default.nix
+++ b/pkgs/tools/misc/crudini/default.nix
@@ -22,8 +22,6 @@ python3Packages.buildPythonApplication rec {
     patchShebangs crudini.py crudini-help tests/test.sh
   '';
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     help2man
     installShellFiles
diff --git a/pkgs/tools/misc/instaloader/default.nix b/pkgs/tools/misc/instaloader/default.nix
index 634693f6144b..57601ae97550 100644
--- a/pkgs/tools/misc/instaloader/default.nix
+++ b/pkgs/tools/misc/instaloader/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, setuptools
 , sphinx
 , requests
 }:
@@ -20,6 +21,10 @@ buildPythonPackage rec {
     sha256 = "sha256-ZxvJPDj+r7KSyXpYNQIgnda5OS77GOFM901ZHgR6c4k=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
     sphinx
diff --git a/pkgs/tools/misc/jdupes/default.nix b/pkgs/tools/misc/jdupes/default.nix
index cb81ef9a9983..8e29307ad24a 100644
--- a/pkgs/tools/misc/jdupes/default.nix
+++ b/pkgs/tools/misc/jdupes/default.nix
@@ -1,37 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch }:
+{ lib, stdenv, fetchFromGitea, libjodycode }:
 
 stdenv.mkDerivation rec {
   pname = "jdupes";
-  version = "1.21.0";
+  version = "1.27.3";
 
-  src = fetchFromGitHub {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
     owner = "jbruchon";
     repo  = "jdupes";
     rev   = "v${version}";
-    sha256 = "sha256-nDyRaV49bLVHlyqKJ7hf6OBWOLCfmHrTeHryK091c3w=";
+    hash = "sha256-hR5nl8G7TYVm4ol/jgo7iOb4dLr2MovgjKSXCD2UwMg=";
     # Unicode file names lead to different checksums on HFS+ vs. other
     # filesystems because of unicode normalisation. The testdir
     # directories have such files and will be removed.
     postFetch = "rm -r $out/testdir";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "darwin-stack-size.patch";
-      url = "https://github.com/jbruchon/jdupes/commit/8f5b06109b44a9e4316f9445da3044590a6c63e2.patch";
-      sha256 = "0saq92v0mm5g979chr062psvwp3i3z23mgqrcliq4m07lvwc7i3s";
-    })
-    (fetchpatch {
-      name = "linux-header-ioctl.patch";
-      url = "https://github.com/jbruchon/jdupes/commit/0d4d98f51c99999d2c6dbbb89d554af551b5b69b.patch";
-      sha256 = "sha256-lyuZeRp0Laa8I9nDl1HGdlKa59OvGRQJnRg2fTWv7mQ=";
-    })
-    (fetchpatch {
-      name = "darwin-apfs-comp.patch";
-      url = "https://github.com/jbruchon/jdupes/commit/517b7035945eacd82323392b13bc17b044bcc89d.patch";
-      sha256 = "sha256-lvOab6tyEyKUtik3JBdIs5SHpVjcQEDfN7n2bfUszBw=";
-    })
-  ];
+  buildInputs = [ libjodycode ];
 
   dontConfigure = true;
 
@@ -49,7 +34,7 @@ stdenv.mkDerivation rec {
   doCheck = false; # broken Makefile, the above also removes tests
 
   postInstall = ''
-    install -Dm444 -t $out/share/doc/jdupes CHANGES LICENSE README.md
+    install -Dm444 -t $out/share/doc/jdupes CHANGES.txt LICENSE.txt README.md
   '';
 
   meta = with lib; {
@@ -61,7 +46,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/jbruchon/jdupes";
     license = licenses.mit;
-    maintainers = with maintainers; [ romildo ];
+    maintainers = with maintainers; [ ];
     mainProgram = "jdupes";
   };
 }
diff --git a/pkgs/tools/misc/lektor/default.nix b/pkgs/tools/misc/lektor/default.nix
index 638ce2ee3ce7..1b20b4355d8e 100644
--- a/pkgs/tools/misc/lektor/default.nix
+++ b/pkgs/tools/misc/lektor/default.nix
@@ -46,8 +46,6 @@ in python.pkgs.buildPythonApplication rec {
     npmHooks.npmConfigHook
   ];
 
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   propagatedBuildInputs = with python.pkgs; [
     babel
     click
diff --git a/pkgs/tools/misc/mpremote/default.nix b/pkgs/tools/misc/mpremote/default.nix
index 04b7abb353a2..c260b1e52893 100644
--- a/pkgs/tools/misc/mpremote/default.nix
+++ b/pkgs/tools/misc/mpremote/default.nix
@@ -19,7 +19,6 @@ buildPythonApplication rec {
   };
   sourceRoot = "source/tools/mpremote";
   format = "pyproject";
-  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
     hatchling
diff --git a/pkgs/tools/misc/nbqa/default.nix b/pkgs/tools/misc/nbqa/default.nix
index dec7eb1aa113..0c55c78f7b49 100644
--- a/pkgs/tools/misc/nbqa/default.nix
+++ b/pkgs/tools/misc/nbqa/default.nix
@@ -7,15 +7,20 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "nbqa";
-  version = "1.7.0";
+  version = "1.7.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nbQA-dev";
     repo = "nbQA";
-    rev = version;
-    hash = "sha256-CTF5HisBS44Ta18cVT04UrMIF30WmEBwZBGW7fkKXwk=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-a/FuhJyf8BmZekUibzEiGgkHL51A+75R4a6S+h5i28s=";
   };
 
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
   passthru.optional-dependencies = {
     black = [ black ];
     blacken-docs = [ blacken-docs ];
@@ -76,9 +81,6 @@ python3.pkgs.buildPythonApplication rec {
     "test_running_in_different_dir_works"
     "test_unable_to_reconstruct_message_pythonpath"
     "test_with_subcommand"
-    # Broken since ruff was updated to 0.1.2
-    # A PR was opened upstream: https://github.com/nbQA-dev/nbQA/issues/834
-    "test_ruff_works"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/tools/misc/ntfy-sh/default.nix b/pkgs/tools/misc/ntfy-sh/default.nix
index 2ee18cb3da1c..1bfde93c39e5 100644
--- a/pkgs/tools/misc/ntfy-sh/default.nix
+++ b/pkgs/tools/misc/ntfy-sh/default.nix
@@ -42,7 +42,7 @@ buildGoModule rec {
     mkdocs
     python3
     python3Packages.mkdocs-material
-    python3Packages.mkdocs-minify
+    python3Packages.mkdocs-minify-plugin
     python3Packages.mkdocs-simple-hooks
   ];
 
diff --git a/pkgs/tools/misc/osinfo-db-tools/default.nix b/pkgs/tools/misc/osinfo-db-tools/default.nix
index be78d6c02600..774ccd946aa7 100644
--- a/pkgs/tools/misc/osinfo-db-tools/default.nix
+++ b/pkgs/tools/misc/osinfo-db-tools/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , meson
 , ninja
@@ -26,6 +27,18 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-i6bTG7XvBwVuOIeeBwZxr7z+wOtBqH+ZUEULu4MbCh0=";
   };
 
+  patches = [
+    # Fix build with libxml 2.12
+    (fetchpatch {
+      url = "https://gitlab.com/libosinfo/osinfo-db-tools/-/commit/019487cbc79925e49988789bf533c78dab7e1842.patch";
+      hash = "sha256-skuspjHDRilwym+hFInrSvIZ+rrzBOoI7WeFj2SrGkc=";
+    })
+    (fetchpatch {
+      url = "https://gitlab.com/libosinfo/osinfo-db-tools/-/commit/34378a4ac257f2f5fcf364786d1634a8c36b304f.patch";
+      hash = "sha256-I9vRRbnotqRi8+7q1eZLJwQLaT9J4G3h+3rKxlaCME4=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/tools/misc/remote-exec/default.nix b/pkgs/tools/misc/remote-exec/default.nix
index afedab81cbd6..557bde26c465 100644
--- a/pkgs/tools/misc/remote-exec/default.nix
+++ b/pkgs/tools/misc/remote-exec/default.nix
@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , buildPythonApplication
 , click
-, pydantic
+, pydantic_1
 , toml
 , watchdog
 , pytestCheckHook
@@ -29,7 +29,7 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [
     click
-    pydantic
+    pydantic_1
     toml
     watchdog
   ];
diff --git a/pkgs/tools/misc/xfstests/default.nix b/pkgs/tools/misc/xfstests/default.nix
index c894f3b9f32e..5080c8592492 100644
--- a/pkgs/tools/misc/xfstests/default.nix
+++ b/pkgs/tools/misc/xfstests/default.nix
@@ -1,5 +1,5 @@
 { stdenv, acl, attr, autoconf, automake, bash, bc, coreutils, e2fsprogs
-, fetchgit, fio, gawk, keyutils, killall, lib, libaio, libcap, libtool
+, fetchzip, fio, gawk, keyutils, killall, lib, libaio, libcap, libtool
 , libuuid, libxfs, lvm2, openssl, perl, procps, quota
 , time, util-linux, which, writeScript, xfsprogs, runtimeShell }:
 
@@ -7,10 +7,9 @@ stdenv.mkDerivation rec {
   pname = "xfstests";
   version = "2023.05.14";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git";
-    rev = "v${version}";
-    sha256 = "sha256-yyjY9Q3eUH+q+o15zFUjOcNz1HpXPCwdcxWXoycOx98=";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git/snapshot/xfstests-dev-v${version}.tar.gz";
+    hash = "sha256-yyjY9Q3eUH+q+o15zFUjOcNz1HpXPCwdcxWXoycOx98=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/curl/configure-ipv6-autodetect.diff b/pkgs/tools/networking/curl/configure-ipv6-autodetect.diff
new file mode 100644
index 000000000000..9797d2c16d11
--- /dev/null
+++ b/pkgs/tools/networking/curl/configure-ipv6-autodetect.diff
@@ -0,0 +1,46 @@
+diff --git a/configure b/configure
+index 04d1de1..5de1b41 100755
+--- a/configure
++++ b/configure
+@@ -24949,15 +24949,12 @@ else $as_nop
+ # include <netinet/in6.h>
+ #endif
+ #endif
+-#include <stdlib.h> /* for exit() */
+-main()
++
++int main(void)
+ {
+  struct sockaddr_in6 s;
+  (void)s;
+- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
+-   exit(1);
+- else
+-   exit(0);
++ return socket(AF_INET6, SOCK_STREAM, 0) < 0;
+ }
+ 
+ 
+diff --git a/configure.ac b/configure.ac
+index 2d71c83..bd38dd9 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1679,15 +1679,12 @@ AS_HELP_STRING([--disable-ipv6],[Disable IPv6 support]),
+ # include <netinet/in6.h>
+ #endif
+ #endif
+-#include <stdlib.h> /* for exit() */
+-main()
++
++int main(void)
+ {
+  struct sockaddr_in6 s;
+  (void)s;
+- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
+-   exit(1);
+- else
+-   exit(0);
++ return socket(AF_INET6, SOCK_STREAM, 0) < 0;
+ }
+ ]])
+ ],
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 48bf59e25266..01208f0a121c 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -57,6 +57,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-FsYqnErw9wPSi9pte783ukcFWtNBTXDexj4uYzbyqC0=";
   };
 
+  patches = [
+    # fix ipv6 autodetect compile error in configure script
+    # remove once https://github.com/curl/curl/pull/12607 released (8.6.0)
+    ./configure-ipv6-autodetect.diff
+  ];
+
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index 2d7a646299ad..0350a4989262 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , pkg-config
 , udev
 , runtimeShellPackage
@@ -12,24 +11,15 @@
 
 stdenv.mkDerivation rec {
   pname = "dhcpcd";
-  version = "9.4.1";
+  version = "10.0.3";
 
   src = fetchFromGitHub {
     owner = "NetworkConfiguration";
     repo = "dhcpcd";
     rev = "v${version}";
-    sha256 = "sha256-qyxON+TsAKMwAI19b5P+dT/sgxpW6m1giGcf/boFpHc=";
+    sha256 = "sha256-NXLOfSPGHiRDSagaT+37TAn9XtdcG4+wP9AvyGJi4Dc=";
   };
 
-  patches = [
-    # dhcpcd with privsep SIGSYS's on dhcpcd -U
-    # https://github.com/NetworkConfiguration/dhcpcd/issues/147
-    (fetchpatch {
-      url = "https://github.com/NetworkConfiguration/dhcpcd/commit/38befd4e867583002b96ec39df733585d74c4ff5.patch";
-      hash = "sha256-nS2zmLuQBYhLfoPp0DOwxF803Hh32EE4OUKGBTTukE0=";
-    })
-  ];
-
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     udev
diff --git a/pkgs/tools/networking/linkchecker/default.nix b/pkgs/tools/networking/linkchecker/default.nix
index c78c12c8fa77..018da51f7701 100644
--- a/pkgs/tools/networking/linkchecker/default.nix
+++ b/pkgs/tools/networking/linkchecker/default.nix
@@ -17,8 +17,6 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-z7Qp74cai8GfsxB4n9dSCWQepp0/4PimFiRJQBaVSoo=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [
     gettext
   ];
diff --git a/pkgs/tools/networking/mmsd/default.nix b/pkgs/tools/networking/mmsd/default.nix
index 43891d612bb1..f7ea7be22c08 100644
--- a/pkgs/tools/networking/mmsd/default.nix
+++ b/pkgs/tools/networking/mmsd/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv
-, fetchgit
+, fetchzip
 , autoreconfHook
 , pkg-config
 , glib
@@ -10,9 +10,8 @@ stdenv.mkDerivation rec {
   pname = "mmsd";
   version = "unstable-2019-07-15";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/network/ofono/mmsd.git";
-    rev = "f4b8b32477a411180be1823fdc460b4f7e1e3c9c";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/network/ofono/mmsd.git/snapshot/mmsd-f4b8b32477a411180be1823fdc460b4f7e1e3c9c.tar.gz";
     sha256 = "0hcnpyhsi7b5m825dhnwbp65yi0961wi8mipzdvaw5nc693xv15b";
   };
 
diff --git a/pkgs/tools/networking/netifd/default.nix b/pkgs/tools/networking/netifd/default.nix
index 25aada6e3c44..59b2e4732980 100644
--- a/pkgs/tools/networking/netifd/default.nix
+++ b/pkgs/tools/networking/netifd/default.nix
@@ -1,17 +1,52 @@
-{ lib, stdenv, cmake, fetchgit, libnl, libubox, uci, ubus, json_c, pkg-config }:
+{ lib
+, stdenv
+, cmake
+, fetchgit
+, libnl
+, libubox
+, uci
+, ubus
+, json_c
+, pkg-config
+, udebug
+}:
 
 stdenv.mkDerivation {
   pname = "netifd";
-  version = "unstable-2021-04-03";
+  version = "unstable-2023-11-27";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/netifd.git";
-    rev = "327da9895327bc56b23413ee91a6e6b6e0e4329d";
-    sha256 = "0jvk2hx8kbkc6d72gh9rwap8ds6qgnmny6306vvzxy68v03xikwv";
+    rev = "02bc2e14d1d37500e888c0c53ac41398a56b5579";
+    hash = "sha256-aMs/Y50+1Yk/j5jGubjBCRcPGw03oIitvEygaxRlr90=";
   };
 
-  buildInputs = [ libnl libubox uci ubus json_c ];
-  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [
+    libnl.dev
+    libubox
+    uci
+    ubus
+    json_c
+    udebug
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  postPatch = ''
+    # by default this assumes the build directory is the source directory
+    # since we let cmake build in it's own build directory, we need to use
+    # $PWD (which at the time of this script being run is the directory with the source code)
+    # to adjust the paths
+    sed "s|./make_ethtool_modes_h.sh|$PWD/make_ethtool_modes_h.sh|g" -i CMakeLists.txt
+    sed "s|./ethtool-modes.h|$PWD/ethtool-modes.h|g" -i CMakeLists.txt
+  '';
+
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+    "-Wno-error=maybe-uninitialized"
+  ]);
 
   meta = with lib; {
     description = "OpenWrt Network interface configuration daemon";
diff --git a/pkgs/tools/networking/ofono/default.nix b/pkgs/tools/networking/ofono/default.nix
index b52912d5e9a0..f4631f06dc79 100644
--- a/pkgs/tools/networking/ofono/default.nix
+++ b/pkgs/tools/networking/ofono/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv
-, fetchgit
+, fetchzip
 , autoreconfHook
 , pkg-config
 , glib
@@ -16,9 +16,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/network/ofono/ofono.git";
-    rev = version;
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/network/ofono/ofono.git/snapshot/ofono-${version}.tar.gz";
     sha256 = "sha256-mnh0qzmgPDfimN/M33HntYj90Xcgc/uF8tKbzeQV1Yg=";
   };
 
diff --git a/pkgs/tools/networking/uqmi/default.nix b/pkgs/tools/networking/uqmi/default.nix
index 8050909487da..bdbb85f30e89 100644
--- a/pkgs/tools/networking/uqmi/default.nix
+++ b/pkgs/tools/networking/uqmi/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "uqmi";
-  version = "unstable-2019-06-27";
+  version = "unstable-2023-10-30";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/uqmi.git";
-    rev = "1965c713937495a5cb029165c16acdb6572c3f87";
-    sha256 = "1gn8sdcl4lwfs3lwabmnjbvdhhk1l42bwbajwds7j4936fpbklx0";
+    rev = "eea292401c388a4eb59c0caf5d00aa046c6059f4";
+    hash = "sha256-Uz5GjGcSKatbii09CsvzsYMz8Vm+Am4RUeCZuFIK1Ag=";
   };
 
   postPatch = ''
@@ -21,6 +21,7 @@ stdenv.mkDerivation {
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
     # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
     "-Wno-error=dangling-pointer"
+    "-Wno-error=maybe-uninitialized"
   ]);
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/urlwatch/default.nix b/pkgs/tools/networking/urlwatch/default.nix
index 885304d9fdb1..a17b4b88da3d 100644
--- a/pkgs/tools/networking/urlwatch/default.nix
+++ b/pkgs/tools/networking/urlwatch/default.nix
@@ -23,9 +23,9 @@ python3Packages.buildPythonApplication rec {
     markdown2
     matrix-client
     minidb
+    playwright
     pushbullet-py
     pycodestyle
-    pyppeteer
     pyyaml
     requests
   ];
diff --git a/pkgs/tools/nix/nixos-render-docs/default.nix b/pkgs/tools/nix/nixos-render-docs/default.nix
index d2b8f1a0614b..b08abfe069f7 100644
--- a/pkgs/tools/nix/nixos-render-docs/default.nix
+++ b/pkgs/tools/nix/nixos-render-docs/default.nix
@@ -1,18 +1,11 @@
 { lib
 , stdenv
 , python3
-, python3Minimal
 , runCommand
 }:
 
 let
-  # python3Minimal can't be overridden with packages on Darwin, due to a missing framework.
-  # Instead of modifying stdenv, we take the easy way out, since most people on Darwin will
-  # just be hacking on the Nixpkgs manual (which also uses make-options-doc).
-  python = ((if stdenv.isDarwin then python3 else python3Minimal).override {
-    self = python;
-    includeSiteCustomize = true;
-  }).override {
+  python = python3.override {
     packageOverrides = final: prev: {
       markdown-it-py = prev.markdown-it-py.overridePythonAttrs (_: {
         doCheck = false;
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index 0ea47dd7e17c..7aa7b1cc1a1d 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -213,6 +213,11 @@ self = stdenv.mkDerivation {
   preInstallCheck = lib.optionalString stdenv.isDarwin ''
     export TMPDIR=$NIX_BUILD_TOP
   ''
+  # Prevent crashes in libcurl due to invoking Objective-C `+initialize` methods after `fork`.
+  # See http://sealiesoftware.com/blog/archive/2017/6/5/Objective-C_and_fork_in_macOS_1013.html.
+  + lib.optionalString stdenv.isDarwin ''
+    export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=yes
+  ''
   # See https://github.com/NixOS/nix/issues/5687
   + lib.optionalString (atLeast25 && stdenv.isDarwin) ''
     echo "exit 99" > tests/gc-non-blocking.sh
diff --git a/pkgs/tools/package-management/packagekit/qt.nix b/pkgs/tools/package-management/packagekit/qt.nix
index 72045735cba3..897f8d9e7b4a 100644
--- a/pkgs/tools/package-management/packagekit/qt.nix
+++ b/pkgs/tools/package-management/packagekit/qt.nix
@@ -1,7 +1,9 @@
-{ stdenv, fetchFromGitHub, cmake, pkg-config
+{ stdenv, lib, fetchFromGitHub, cmake, pkg-config
 , qttools, packagekit }:
 
-stdenv.mkDerivation rec {
+let
+  isQt6 = lib.versions.major qttools.version == "6";
+in stdenv.mkDerivation rec {
   pname = "packagekit-qt";
   version = "1.1.1";
 
@@ -16,6 +18,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config qttools ];
 
+  cmakeFlags = [ (lib.cmakeBool "BUILD_WITH_QT6" isQt6) ];
+
   dontWrapQtApps = true;
 
   meta = packagekit.meta // {
diff --git a/pkgs/tools/package-management/protontricks/default.nix b/pkgs/tools/package-management/protontricks/default.nix
index 55392eaad833..462a2546ff5d 100644
--- a/pkgs/tools/package-management/protontricks/default.nix
+++ b/pkgs/tools/package-management/protontricks/default.nix
@@ -36,8 +36,6 @@ buildPythonApplication rec {
     })
   ];
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = [ setuptools-scm ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/security/coercer/default.nix b/pkgs/tools/security/coercer/default.nix
index 3d1e6cb46963..f380d130bb07 100644
--- a/pkgs/tools/security/coercer/default.nix
+++ b/pkgs/tools/security/coercer/default.nix
@@ -5,22 +5,28 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "coercer";
-  version = "1.6";
+  version = "2.4.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "p0dalirius";
     repo = "Coercer";
     rev = "refs/tags/${version}";
-    hash = "sha256-xftYnwu6uUTvJTZU9E7wvdgBxqa8xy83K5GOlgNSCvc=";
+    hash = "sha256-WeaKToKYIB+jjTNIQvAUQQNb25TsNWALYZwIZuBjkPE=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "impacket"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
     impacket
+    xlsxwriter
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/tools/security/efitools/default.nix b/pkgs/tools/security/efitools/default.nix
index 59cb794d718e..70032504f475 100644
--- a/pkgs/tools/security/efitools/default.nix
+++ b/pkgs/tools/security/efitools/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, gnu-efi, openssl, sbsigntool, perl, perlPackages,
-help2man, fetchgit }:
+help2man, fetchzip }:
 stdenv.mkDerivation rec {
   pname = "efitools";
   version = "1.9.2";
@@ -16,9 +16,8 @@ stdenv.mkDerivation rec {
     help2man
   ];
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git";
-    rev = "v${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git/snapshot/efitools-v${version}.tar.gz";
     sha256 = "0jabgl2pxvfl780yvghq131ylpf82k7banjz0ksjhlm66ik8gb1i";
   };
 
diff --git a/pkgs/tools/security/flare-floss/default.nix b/pkgs/tools/security/flare-floss/default.nix
index 212d0a74ebb1..c9a9c8cd1380 100644
--- a/pkgs/tools/security/flare-floss/default.nix
+++ b/pkgs/tools/security/flare-floss/default.nix
@@ -33,7 +33,7 @@ python3.pkgs.buildPythonPackage rec {
     halo
     networkx
     pefile
-    pydantic
+    pydantic_1
     rich
     tabulate
     tqdm
diff --git a/pkgs/tools/security/ibm-sw-tpm2/default.nix b/pkgs/tools/security/ibm-sw-tpm2/default.nix
index de260e068249..9a13c2103016 100644
--- a/pkgs/tools/security/ibm-sw-tpm2/default.nix
+++ b/pkgs/tools/security/ibm-sw-tpm2/default.nix
@@ -4,7 +4,12 @@
 , fetchpatch
 , openssl
 }:
-
+let
+  makefile =
+    if stdenv.isDarwin
+    then "makefile.mac"
+    else "makefile";
+in
 stdenv.mkDerivation rec {
   pname = "ibm-sw-tpm2";
   version = "1682";
@@ -30,12 +35,14 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "src";
 
+  inherit makefile;
+
   prePatch = ''
     # Fix hardcoded path to GCC.
-    substituteInPlace makefile --replace /usr/bin/gcc "${stdenv.cc}/bin/cc"
+    substituteInPlace ${makefile} --replace /usr/bin/gcc "${stdenv.cc}/bin/cc"
 
     # Remove problematic default CFLAGS.
-    substituteInPlace makefile \
+    substituteInPlace ${makefile} \
       --replace -Werror "" \
       --replace -O0 "" \
       --replace -ggdb ""
@@ -49,7 +56,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "IBM's Software TPM 2.0, an implementation of the TCG TPM 2.0 specification";
     homepage = "https://sourceforge.net/projects/ibmswtpm2/";
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ delroth ];
     license = licenses.bsd3;
   };
diff --git a/pkgs/tools/security/kube-hunter/default.nix b/pkgs/tools/security/kube-hunter/default.nix
index f80f5c70c98c..bc23c3845b89 100644
--- a/pkgs/tools/security/kube-hunter/default.nix
+++ b/pkgs/tools/security/kube-hunter/default.nix
@@ -14,8 +14,6 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "sha256-+M8P/VSF9SKPvq+yNPjokyhggY7hzQ9qLLhkiTNbJls=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
-
   nativeBuildInputs = with python3.pkgs; [
     setuptools-scm
   ];
diff --git a/pkgs/tools/security/mitmproxy2swagger/default.nix b/pkgs/tools/security/mitmproxy2swagger/default.nix
index bbdc56e1d199..56d47973b7e3 100644
--- a/pkgs/tools/security/mitmproxy2swagger/default.nix
+++ b/pkgs/tools/security/mitmproxy2swagger/default.nix
@@ -17,6 +17,11 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "ruamel.yaml"
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index a4ae25715c3f..08a4b5b08d02 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -1,8 +1,9 @@
 { stdenv
 , lib
-, fetchurl
+, fetchFromGitLab
 , autoreconfHook
 , autoconf-archive
+, flex
 , pkg-config
 , perl
 , python3
@@ -10,28 +11,26 @@
 , polkit
 , systemdLibs
 , IOKit
+, testers
+, nix-update-script
 , pname ? "pcsclite"
 , polkitSupport ? false
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "1.9.5";
+  version = "2.0.1";
 
   outputs = [ "bin" "out" "dev" "doc" "man" ];
 
-  src = fetchurl {
-    url = "https://pcsclite.apdu.fr/files/pcsc-lite-${version}.tar.bz2";
-    hash = "sha256-nuP5szNTdWIXeJNVmtT3uNXCPr6Cju9TBWwC2xQEnQg=";
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "rousseau";
+    repo = "PCSC";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-7NGlU4byGxtGBticewg8K4FUiDSQZAiB7Q/y+LaqKPo=";
   };
 
-  patches = [ ./no-dropdir-literals.patch ];
-
-  postPatch = ''
-    sed -i configure.ac \
-      -e "s@polkit_policy_dir=.*@polkit_policy_dir=$bin/share/polkit-1/actions@"
-  '';
-
   configureFlags = [
     "--enable-confdir=/etc"
     # The OS should care on preparing the drivers into this location
@@ -43,11 +42,9 @@ stdenv.mkDerivation rec {
     "--with-systemdsystemunitdir=${placeholder "bin"}/lib/systemd/system"
   ];
 
-  postConfigure = ''
-    sed -i -re '/^#define *PCSCLITE_HP_DROPDIR */ {
-      s/(DROPDIR *)(.*)/\1(getenv("PCSCLITE_HP_DROPDIR") ? : \2)/
-    }' config.h
-  '';
+  makeFlags = [
+    "POLICY_DIR=$(out)/share/polkit-1/actions"
+  ];
 
   postInstall = ''
     # pcsc-spy is a debugging utility and it drags python into the closure
@@ -56,17 +53,34 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config perl ];
+  nativeBuildInputs = [
+    autoreconfHook
+    autoconf-archive
+    flex
+    pkg-config
+    perl
+  ];
 
   buildInputs = [ python3 ]
     ++ lib.optionals stdenv.isLinux [ systemdLibs ]
     ++ lib.optionals stdenv.isDarwin [ IOKit ]
     ++ lib.optionals polkitSupport [ dbus polkit ];
 
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "pcscd --version";
+    };
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     description = "Middleware to access a smart card using SCard API (PC/SC)";
     homepage = "https://pcsclite.apdu.fr/";
+    changelog = "https://salsa.debian.org/rousseau/PCSC/-/blob/${finalAttrs.version}/ChangeLog";
     license = licenses.bsd3;
+    mainProgram = "pcscd";
+    maintainers = [ maintainers.anthonyroussel ];
     platforms = with platforms; unix;
   };
-}
+})
diff --git a/pkgs/tools/security/pcsclite/no-dropdir-literals.patch b/pkgs/tools/security/pcsclite/no-dropdir-literals.patch
deleted file mode 100644
index 4c6d5554d77a..000000000000
--- a/pkgs/tools/security/pcsclite/no-dropdir-literals.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-diff --git a/src/hotplug_libudev.c b/src/hotplug_libudev.c
-index 51bd95f..84f959b 100644
---- a/src/hotplug_libudev.c
-+++ b/src/hotplug_libudev.c
-@@ -120,7 +120,8 @@ static LONG HPReadBundleValues(void)
- 
- 	if (NULL == hpDir)
- 	{
--		Log1(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: " PCSCLITE_HP_DROPDIR);
-+		Log2(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: %s",
-+			PCSCLITE_HP_DROPDIR);
- 		Log1(PCSC_LOG_ERROR, "Disabling USB support for pcscd.");
- 		return -1;
- 	}
-@@ -741,7 +742,7 @@ ULONG HPRegisterForHotplugEvents(void)
- 
- 	if (driverSize <= 0)
- 	{
--		Log1(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: "
-+		Log2(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: %s",
- 			PCSCLITE_HP_DROPDIR);
- 		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd");
- 		return 0;
-diff --git a/src/hotplug_libusb.c b/src/hotplug_libusb.c
-index 0ada9f5..d49a407 100644
---- a/src/hotplug_libusb.c
-+++ b/src/hotplug_libusb.c
-@@ -142,7 +142,8 @@ static LONG HPReadBundleValues(void)
- 
- 	if (hpDir == NULL)
- 	{
--		Log1(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: " PCSCLITE_HP_DROPDIR);
-+		Log2(PCSC_LOG_ERROR, "Cannot open PC/SC drivers directory: %s",
-+			PCSCLITE_HP_DROPDIR);
- 		Log1(PCSC_LOG_ERROR, "Disabling USB support for pcscd.");
- 		return -1;
- 	}
-@@ -282,7 +283,8 @@ static LONG HPReadBundleValues(void)
- 
- 	if (driverSize == 0)
- 	{
--		Log1(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: " PCSCLITE_HP_DROPDIR);
-+		Log2(PCSC_LOG_INFO, "No bundle files in pcsc drivers directory: %s",
-+			PCSCLITE_HP_DROPDIR);
- 		Log1(PCSC_LOG_INFO, "Disabling USB support for pcscd");
- 	}
- #ifdef DEBUG_HOTPLUG
diff --git a/pkgs/tools/security/sedutil/default.nix b/pkgs/tools/security/sedutil/default.nix
index cb0e367fa2cc..0e83472da0e7 100644
--- a/pkgs/tools/security/sedutil/default.nix
+++ b/pkgs/tools/security/sedutil/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , autoreconfHook
 }:
 
@@ -15,6 +16,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-NG/7aqe48ShHWW5hW8axYWV4+zX0dBE7Wy9q58l0S3E=";
   };
 
+  patches = [
+    # Fix for gcc-13 pending upstream inclusion:
+    #   https://github.com/Drive-Trust-Alliance/sedutil/pull/425
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/Drive-Trust-Alliance/sedutil/commit/927cd88cad7bea94c2eebecc18f7881f0defaccb.patch";
+      hash = "sha256-/Lvn3CQd7pzNhLa7sQY8VwbyJK/jEM5FzLijTQnzXx8=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs .
   '';
diff --git a/pkgs/tools/security/stacs/default.nix b/pkgs/tools/security/stacs/default.nix
index 672cd082849c..205d85f0622e 100644
--- a/pkgs/tools/security/stacs/default.nix
+++ b/pkgs/tools/security/stacs/default.nix
@@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     click
-    pydantic
+    pydantic_1
     typing-extensions
     yara-python
   ];
diff --git a/pkgs/tools/text/l2md/default.nix b/pkgs/tools/text/l2md/default.nix
index 758130e9f0aa..08ec219690f6 100644
--- a/pkgs/tools/text/l2md/default.nix
+++ b/pkgs/tools/text/l2md/default.nix
@@ -1,12 +1,11 @@
-{ lib, stdenv, fetchgit, libgit2 }:
+{ lib, stdenv, fetchzip, libgit2 }:
 
 stdenv.mkDerivation rec {
   pname = "l2md";
   version = "unstable-2021-10-27";
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/dborkman/l2md.git";
-    rev = "9db252bc1716ebaf0abd3a47a59ea78e4e6253d6";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/dborkman/l2md.git/snapshot/l2md-9db252bc1716ebaf0abd3a47a59ea78e4e6253d6.tar.gz";
     sha256 = "sha256-H/leDUwQM55akyXsmTnI2YsnG4i1KQtf4bBt1fizy8E=";
   };
 
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 95483b8465ed..aacdf243f997 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook";
-  version = "0.4.35";
+  version = "0.4.36";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "mdBook";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-oplR34M2PbcIwrfIkA4Ttk2zt3ve883TfXGIDnfJt/4=";
+    sha256 = "sha256-QQSGnOWRx5KK9eJP759E1V9zFVzvRol5bdJfD9mDr5g=";
   };
 
-  cargoHash = "sha256-D0XhrweO0A1+81Je4JZ0lmnbIHstNvefpmogCyB4FEE=";
+  cargoHash = "sha256-IlD4YI7jsWZw0Dn1PoljmhuIOqejva8HMhU4ULy32yE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/text/xml/xmlstarlet/default.nix b/pkgs/tools/text/xml/xmlstarlet/default.nix
index 111e95c9508d..b5eb08199fc6 100644
--- a/pkgs/tools/text/xml/xmlstarlet/default.nix
+++ b/pkgs/tools/text/xml/xmlstarlet/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , autoreconfHook
 , pkg-config
 , libxml2
@@ -20,8 +21,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ libxml2 libxslt ];
 
   patches = [
-    # Fixes an incompatible function pointer error with clang 16.
-    ./fix-incompatible-function-pointer.patch
+    (fetchpatch {
+      name = "0001-Fix-build-with-libxml2-2.12.patch";
+      url = "https://sourceforge.net/p/xmlstar/patches/_discuss/thread/890e29655a/66ca/attachment/0001-Fix-build-with-libxml2-2.12.patch";
+      hash = "sha256-XEk7aFOdrzdec1j2ffERJQbLH0AUNJA52QwA9jf4XWA=";
+    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/tools/text/xml/xmlstarlet/fix-incompatible-function-pointer.patch b/pkgs/tools/text/xml/xmlstarlet/fix-incompatible-function-pointer.patch
deleted file mode 100644
index a0818731c217..000000000000
--- a/pkgs/tools/text/xml/xmlstarlet/fix-incompatible-function-pointer.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/xml_elem.c	2012-08-12 09:18:59.000000000 -0600
-+++ b/src/xml_elem.c	2023-07-11 13:17:14.220809280 -0600
-@@ -186,7 +186,7 @@
-  * put @name into @data->array[@data->offset]
-  */
- static void
--hash_key_put(void *payload, void *data, xmlChar *name)
-+hash_key_put(void *payload, void *data, const xmlChar *name)
- {
-     ArrayDest *dest = data;
-     dest->array[dest->offset++] = name;
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index 2d7f859c809c..f1816efb0cf9 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -323,6 +323,15 @@ dvisvgm = stdenv.mkDerivation {
       extraPrefix = "texk/dvisvgm/dvisvgm-src/";
       hash = "sha256-CBCbc/woaFeLw7aBG/kSVYc3a5Q56zbAB64kK6mRy4g=";
     })
+
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/mgieseki/dvisvgm/commit/d5df85b403602c927fe56a1f692af91182a1facd.patch";
+      stripLen = 1;
+      extraPrefix = "texk/dvisvgm/dvisvgm-src/";
+      hash = "sha256-U5m9jPmfAXOQKaU+aO/h6hEAzHRPqKcdj5k8f5gU9JQ=";
+      excludes = [ "texk/dvisvgm/dvisvgm-src/src/ttf/TTFTable.hpp" ];
+    })
   ];
 
   preConfigure = "cd texk/dvisvgm";
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 1a497c6affaa..a9d6e717318f 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -2,7 +2,10 @@
   - source: ../../../../../doc/languages-frameworks/texlive.xml
   - current html: https://nixos.org/nixpkgs/manual/#sec-language-texlive
 */
-{ stdenv, lib, fetchurl, runCommand, writeShellScript, writeText, buildEnv
+{ lib
+#, stdenv
+, gcc12Stdenv
+, fetchurl, runCommand, writeShellScript, writeText, buildEnv
 , callPackage, ghostscript_headless, harfbuzz
 , makeWrapper, installShellFiles
 , python3, ruby, perl, tk, jdk, bash, snobol4
@@ -11,6 +14,7 @@
 , useFixedHashes ? true
 , recurseIntoAttrs
 }:
+let stdenv = gcc12Stdenv; in
 let
   # various binaries (compiled)
   bin = callPackage ./bin.nix {
diff --git a/pkgs/tools/video/svt-av1/default.nix b/pkgs/tools/video/svt-av1/default.nix
index 40869c0f8f4e..d40047510f40 100644
--- a/pkgs/tools/video/svt-av1/default.nix
+++ b/pkgs/tools/video/svt-av1/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "svt-av1";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitLab {
     owner = "AOMediaCodec";
     repo = "SVT-AV1";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-WKc0DNwpA9smMS3e/GDkk77FUkohwaPMgcXgji14CIw=";
+    hash = "sha256-JV65VuEPJBrADsGviBnE6EgZmbqJ4Z4qli6cAfUMmkw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1a92aeb66049..1dab4e0de15a 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -290,6 +290,7 @@ mapAliases ({
   framework-system-tools = framework-tool; # added 2023-12-09
   fritzprofiles = throw "fritzprofiles was removed from nixpkgs, because it was removed as dependency of home-assistant for which it was pacakged."; # added 2024-01-05
   fuse2fs = if stdenv.isLinux then e2fsprogs.fuse2fs else null; # Added 2022-03-27 preserve, reason: convenience, arch has a package named fuse2fs too.
+  futuresql = libsForQt5.futuresql; # added 2023-11-11
   fx_cast_bridge = fx-cast-bridge; # added 2023-07-26
 
   fcitx = throw "fcitx is deprecated, please use fcitx5 instead."; # Added 2023-03-13
@@ -500,6 +501,7 @@ mapAliases ({
   liblastfm = libsForQt5.liblastfm; # Added 2020-06-14
   libmongo-client = throw "'libmongo-client' has been removed, upstream gone"; # Added 2023-06-22
   libpulseaudio-vanilla = libpulseaudio; # Added 2022-04-20
+  libquotient = libsForQt5.libquotient; # Added 2023-11-11
   libraw_unstable = throw "'libraw_unstable' has been removed, please use libraw"; # Added 2023-01-30
   librdf = lrdf; # Added 2020-03-22
   libressl_3_5 = throw "'libressl_3_5' has reached end-of-life "; # Added 2023-05-07
@@ -905,6 +907,7 @@ mapAliases ({
   rtsp-simple-server = throw "rtsp-simple-server is rebranded as mediamtx, including default config path update"; # Added 2023-04-11
   runCommandNoCC = runCommand;
   runCommandNoCCLocal = runCommandLocal;
+  rustc-wasm32 = rustc; # Added 2023-12-01
   rxvt_unicode = rxvt-unicode-unwrapped; # Added 2020-02-02
   rxvt_unicode-with-plugins = rxvt-unicode; # Added 2020-02-02
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f5060dac5c43..e072234355bd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2792,7 +2792,7 @@ with pkgs;
 
   pcem = callPackage ../applications/emulators/pcem { };
 
-  pcsx2 = qt6Packages.callPackage ../applications/emulators/pcsx2 { };
+  pcsx2 = disable-warnings-if-gcc13 (qt6Packages.callPackage ../applications/emulators/pcsx2 { });
 
   pcsxr = callPackage ../applications/emulators/pcsxr { };
 
@@ -4404,8 +4404,6 @@ with pkgs;
     charles4
   ;
 
-  libquotient = libsForQt5.callPackage ../development/libraries/libquotient { };
-
   quaternion = libsForQt5.callPackage ../applications/networking/instant-messengers/quaternion { };
 
   tensor = libsForQt5.callPackage ../applications/networking/instant-messengers/tensor { };
@@ -4850,7 +4848,9 @@ with pkgs;
 
   wl-mirror = callPackage ../tools/wayland/wl-mirror { };
 
-  wl-screenrec = callPackage ../tools/wayland/wl-screenrec { };
+  wl-screenrec = callPackage ../tools/wayland/wl-screenrec {
+    ffmpeg = ffmpeg_5;
+  };
 
   wleave = callPackage ../tools/wayland/wleave { };
 
@@ -7358,8 +7358,11 @@ with pkgs;
 
   curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };
 
-  curl-impersonate = darwin.apple_sdk_11_0.callPackage ../tools/networking/curl-impersonate { };
-  inherit (curl-impersonate) curl-impersonate-ff curl-impersonate-chrome;
+  curl-impersonate =
+    builtins.mapAttrs (_: pin-to-gcc12-if-gcc13)
+      (darwin.apple_sdk_11_0.callPackage ../tools/networking/curl-impersonate { });
+  curl-impersonate-ff = pin-to-gcc12-if-gcc13 curl-impersonate.curl-impersonate-ff;
+  curl-impersonate-chrom = pin-to-gcc12-if-gcc13 curl-impersonate.curl-impersonate-chrome;
 
   curlie = callPackage ../tools/networking/curlie { };
 
@@ -7942,7 +7945,7 @@ with pkgs;
 
   efibootmgr = callPackage ../tools/system/efibootmgr { };
 
-  efivar = callPackage ../tools/system/efivar { };
+  efivar = disable-warnings-if-gcc13 (callPackage ../tools/system/efivar { });
 
   eget = callPackage ../tools/misc/eget { };
 
@@ -8559,7 +8562,9 @@ with pkgs;
 
   gifsicle = callPackage ../tools/graphics/gifsicle { };
 
-  gifski = callPackage ../tools/graphics/gifski { };
+  gifski = callPackage ../tools/graphics/gifski {
+    ffmpeg = ffmpeg_5;
+  };
 
   github-backup = callPackage ../tools/misc/github-backup { };
 
@@ -8787,7 +8792,7 @@ with pkgs;
 
   google-guest-oslogin = callPackage ../tools/virtualization/google-guest-oslogin { };
 
-  google-cloud-cpp = callPackage ../development/libraries/google-cloud-cpp { };
+  google-cloud-cpp = disable-warnings-if-gcc13 (callPackage ../development/libraries/google-cloud-cpp { });
 
   google-java-format = callPackage ../development/tools/google-java-format { };
 
@@ -9435,7 +9440,7 @@ with pkgs;
 
   inql = callPackage ../tools/security/inql { };
 
-  intel-media-sdk = callPackage ../development/libraries/intel-media-sdk { };
+  intel-media-sdk = disable-warnings-if-gcc13 (callPackage ../development/libraries/intel-media-sdk { });
 
   intermodal = callPackage ../tools/misc/intermodal { };
 
@@ -12499,9 +12504,9 @@ with pkgs;
 
   qdigidoc = libsForQt5.callPackage ../tools/security/qdigidoc { } ;
 
-  qgrep = callPackage ../tools/text/qgrep {
+  qgrep = pin-to-gcc12-if-gcc13 (callPackage ../tools/text/qgrep {
     inherit (darwin.apple_sdk.frameworks) CoreServices CoreFoundation;
-  };
+  });
 
   qhull = callPackage ../development/libraries/qhull { };
 
@@ -15818,11 +15823,30 @@ with pkgs;
 
   default-gcc-version =
     if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
-    else 12;
+    else if stdenv.buildPlatform.isDarwin  then 12  # unable to test
+    else if stdenv.buildPlatform.isAarch64 then 12  # unable to test
+    else 13;
   gcc = pkgs.${"gcc${toString default-gcc-version}"};
   gccFun = callPackage ../development/compilers/gcc;
   gcc-unwrapped = gcc.cc;
 
+  disable-warnings-if-gcc13 = pkg:
+    if (pkg.stdenv.cc.cc.isGNU or false && lib.versionAtLeast pkg.stdenv.cc.cc.version "13.0")
+    then pkg.overrideAttrs(previousAttrs: previousAttrs // {
+      env = previousAttrs.env or {} // {
+        NIX_CFLAGS_COMPILE = (previousAttrs.env.NIX_CFLAGS_COMPILE or "") + " -Wno-error";
+      };
+    })
+    else pkg;
+
+  pin-to-gcc12-if-gcc13 = pkg:
+    if !(lib.isDerivation pkg) || !(pkg?override) then pkg else
+    pkg.override (previousArgs:
+      lib.optionalAttrs (previousArgs.stdenv.cc.cc.isGNU or false &&
+                         lib.versionAtLeast previousArgs.stdenv.cc.cc.version "13.0") {
+                           stdenv = gcc12Stdenv;
+                         });
+
   wrapNonDeterministicGcc = stdenv: ccWrapper:
     if ccWrapper.isGNU then ccWrapper.overrideAttrs(old: {
       env = old.env // {
@@ -16389,7 +16413,7 @@ with pkgs;
   hugs = callPackage ../development/interpreters/hugs { };
 
   inherit (javaPackages) openjfx11 openjfx15 openjfx17 openjfx19 openjfx20 openjfx21;
-  openjfx = openjfx17;
+  openjfx = pin-to-gcc12-if-gcc13 (openjfx17.override { });
 
   openjdk8-bootstrap = javaPackages.compiler.openjdk8-bootstrap;
   openjdk8 = javaPackages.compiler.openjdk8;
@@ -16623,6 +16647,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_8.tools;
     targetLlvm = targetPackages.llvmPackages_8.llvm or llvmPackages_8.llvm;
     targetLlvmLibraries = targetPackages.llvmPackages_8.libraries or llvmPackages_8.libraries;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   });
 
   llvmPackages_9 = recurseIntoAttrs (callPackage ../development/compilers/llvm/9 {
@@ -16630,6 +16655,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_9.tools;
     targetLlvm = targetPackages.llvmPackages_9.llvm or llvmPackages_9.llvm;
     targetLlvmLibraries = targetPackages.llvmPackages_9.libraries or llvmPackages_9.libraries;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   });
 
   llvmPackages_10 = recurseIntoAttrs (callPackage ../development/compilers/llvm/10 {
@@ -16637,6 +16663,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_10.tools;
     targetLlvm = targetPackages.llvmPackages_10.llvm or llvmPackages_10.llvm;
     targetLlvmLibraries = targetPackages.llvmPackages_10.libraries or llvmPackages_10.libraries;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   });
 
   llvmPackages_11 = recurseIntoAttrs (callPackage ../development/compilers/llvm/11 ({
@@ -16658,6 +16685,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_13.tools;
     targetLlvmLibraries = targetPackages.llvmPackages_13.libraries or llvmPackages_13.libraries;
     targetLlvm = targetPackages.llvmPackages_13.llvm or llvmPackages_13.llvm;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   }));
 
   llvmPackages_14 = recurseIntoAttrs (callPackage ../development/compilers/llvm/14 ({
@@ -16665,6 +16693,7 @@ with pkgs;
     buildLlvmTools = buildPackages.llvmPackages_14.tools;
     targetLlvmLibraries = targetPackages.llvmPackages_14.libraries or llvmPackages_14.libraries;
     targetLlvm = targetPackages.llvmPackages_14.llvm or llvmPackages_14.llvm;
+    stdenv = if stdenv.cc.cc.isGNU or false then gcc12Stdenv else stdenv; # does not build with gcc13
   }));
 
   llvmPackages_15 = recurseIntoAttrs (callPackage ../development/compilers/llvm/15 ({
@@ -16877,11 +16906,11 @@ with pkgs;
   wrapRustcWith = { rustc-unwrapped, ... } @ args: callPackage ../build-support/rust/rustc-wrapper args;
   wrapRustc = rustc-unwrapped: wrapRustcWith { inherit rustc-unwrapped; };
 
-  rust_1_74 = callPackage ../development/compilers/rust/1_74.nix {
+  rust_1_75 = callPackage ../development/compilers/rust/1_75.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
-    llvm_16 = llvmPackages_16.libllvm;
+    llvm_17 = llvmPackages_17.libllvm;
   };
-  rust = rust_1_74;
+  rust = rust_1_75;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -16889,24 +16918,11 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_74 = rust_1_74.packages.stable;
-  rustPackages = rustPackages_1_74;
+  rustPackages_1_75 = rust_1_75.packages.stable;
+  rustPackages = rustPackages_1_75;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
-  # https://github.com/NixOS/nixpkgs/issues/89426
-  rustc-wasm32 = wrapRustc ((rustc.unwrapped.override {
-    stdenv = stdenv.override {
-      targetPlatform = lib.systems.elaborate {
-        # lib.systems.elaborate won't recognize "unknown" as the last component.
-        config = "wasm32-unknown-wasi";
-        rust.rustcTarget = "wasm32-unknown-unknown";
-      };
-    };
-  }).overrideAttrs (old: {
-    configureFlags = old.configureFlags ++ ["--set=build.docs=false"];
-  }));
-
   makeRustPlatform = callPackage ../development/compilers/rust/make-rust-platform.nix { };
 
   buildRustCrate = callPackage ../build-support/rust/build-rust-crate { };
@@ -17865,9 +17881,9 @@ with pkgs;
   python27Packages = python27.pkgs // { __attrsFailEvaluation = true; };
   python38Packages = python38.pkgs // { __attrsFailEvaluation = true; };
   python39Packages = python39.pkgs // { __attrsFailEvaluation = true; };
-  python310Packages = recurseIntoAttrs python310.pkgs // { pythonPackages = python310.pkgs // { __attrsFailEvaluation = true; }; };
+  python310Packages = python310.pkgs // { __attrsFailEvaluation = true; };
   python311Packages = recurseIntoAttrs python311.pkgs // { pythonPackages = python311.pkgs // { __attrsFailEvaluation = true; }; };
-  python312Packages = python312.pkgs // { __attrsFailEvaluation = true; };
+  python312Packages = recurseIntoAttrs python312.pkgs // { pythonPackages = python312.pkgs // { __attrsFailEvaluation = true; }; };
   python313Packages = python313.pkgs // { __attrsFailEvaluation = true; };
   pypyPackages = pypy.pkgs // { __attrsFailEvaluation = true; };
   pypy2Packages = pypy2.pkgs // { __attrsFailEvaluation = true; };
@@ -18502,16 +18518,16 @@ with pkgs;
     bazel_self = bazel_4;
   };
 
-  bazel_5 = callPackage ../development/tools/build-managers/bazel/bazel_5 {
+  bazel_5 = pin-to-gcc12-if-gcc13 (callPackage ../development/tools/build-managers/bazel/bazel_5 {
     inherit (darwin) cctools sigtool;
     inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Foundation;
     buildJdk = jdk11_headless;
     runJdk = jdk11_headless;
     stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
     bazel_self = bazel_5;
-  };
+  });
 
-  bazel_6 = darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/bazel/bazel_6 {
+  bazel_6 = pin-to-gcc12-if-gcc13 (darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/bazel/bazel_6 {
     inherit (darwin) cctools;
     inherit (darwin.apple_sdk_11_0.frameworks) CoreFoundation CoreServices Foundation;
     buildJdk = jdk11_headless;
@@ -18520,7 +18536,7 @@ with pkgs;
       darwin.apple_sdk_11_0.stdenv else
       if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
     bazel_self = bazel_6;
-  };
+  });
 
   bazel_7 = darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/bazel/bazel_7 {
     inherit (darwin) cctools sigtool;
@@ -19174,8 +19190,6 @@ with pkgs;
 
   funzzy = callPackage ../development/tools/misc/funzzy { };
 
-  futuresql = libsForQt5.callPackage ../development/libraries/futuresql { };
-
   fzf-make = callPackage ../development/tools/misc/fzf-make { };
 
   gede = libsForQt5.callPackage ../development/tools/misc/gede { };
@@ -20638,7 +20652,7 @@ with pkgs;
     else callPackage ../os-specific/linux/bionic-prebuilt { };
 
 
-  bobcat = callPackage ../development/libraries/bobcat { };
+  bobcat = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/bobcat { });
 
   boehmgc = callPackage ../development/libraries/boehm-gc { };
 
@@ -20922,7 +20936,7 @@ with pkgs;
 
   crocoddyl = callPackage ../development/libraries/crocoddyl { };
 
-  crossguid = callPackage ../development/libraries/crossguid { };
+  crossguid = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/crossguid { });
 
   cryptopp = callPackage ../development/libraries/crypto++ { };
 
@@ -22248,6 +22262,11 @@ with pkgs;
 
   libjson = callPackage ../development/libraries/libjson { };
 
+  libjodycode = callPackage ../development/libraries/libjodycode {
+    # missing aligned_alloc()
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
+  };
+
   libb64 = callPackage ../development/libraries/libb64 { };
 
   judy = callPackage ../development/libraries/judy { };
@@ -22666,7 +22685,7 @@ with pkgs;
   dwarfdump = libdwarf.bin;
   libdwarf_20210528 = callPackage ../development/libraries/libdwarf/20210528.nix { };
 
-  libe57format = callPackage ../development/libraries/libe57format { };
+  libe57format = disable-warnings-if-gcc13 (callPackage ../development/libraries/libe57format { });
 
   libeatmydata = callPackage ../development/libraries/libeatmydata { };
 
@@ -22694,9 +22713,11 @@ with pkgs;
 
   libfido2 = callPackage ../development/libraries/libfido2 {};
 
-  libfilezilla = darwin.apple_sdk_11_0.callPackage ../development/libraries/libfilezilla {
-    inherit (darwin.apple_sdk_11_0.frameworks) ApplicationServices;
-  };
+  libfilezilla =
+    pin-to-gcc12-if-gcc13
+      (darwin.apple_sdk_11_0.callPackage ../development/libraries/libfilezilla {
+        inherit (darwin.apple_sdk_11_0.frameworks) ApplicationServices;
+      });
 
   libfishsound = callPackage ../development/libraries/libfishsound { };
 
@@ -23869,7 +23890,7 @@ with pkgs;
 
   mediastreamer-openh264 = callPackage ../development/libraries/mediastreamer/msopenh264.nix { };
 
-  memorymapping = callPackage ../development/libraries/memorymapping { };
+  memorymapping = disable-warnings-if-gcc13 (callPackage ../development/libraries/memorymapping { });
   memorymappingHook = makeSetupHook {
     name = "memorymapping-hook";
     propagatedBuildInputs = [ memorymapping ];
@@ -24256,7 +24277,7 @@ with pkgs;
 
   opencl-clhpp = callPackage ../development/libraries/opencl-clhpp { };
 
-  opencollada = callPackage ../development/libraries/opencollada { };
+  opencollada = disable-warnings-if-gcc13 (callPackage ../development/libraries/opencollada { });
 
   opencore-amr = callPackage ../development/libraries/opencore-amr { };
 
@@ -24352,7 +24373,7 @@ with pkgs;
 
   libressl = libressl_3_8;
 
-  boringssl = callPackage ../development/libraries/boringssl { };
+  boringssl = disable-warnings-if-gcc13 (callPackage ../development/libraries/boringssl { });
 
   wolfssl = darwin.apple_sdk_11_0.callPackage ../development/libraries/wolfssl {
     inherit (darwin.apple_sdk_11_0.frameworks) Security;
@@ -24510,9 +24531,9 @@ with pkgs;
 
   primesieve = callPackage ../applications/science/math/primesieve { };
 
-  proj = callPackage ../development/libraries/proj {
+  proj = disable-warnings-if-gcc13 (callPackage ../development/libraries/proj {
     stdenv = if stdenv.cc.isClang then overrideLibcxx llvmPackages_13.stdenv else stdenv;
-  };
+  });
 
   proj_7 = callPackage ../development/libraries/proj/7.nix { };
 
@@ -24564,10 +24585,16 @@ with pkgs;
 
   pylode = callPackage ../misc/pylode { };
 
-  python-qt = callPackage ../development/libraries/python-qt {
+  python-qt = (callPackage ../development/libraries/python-qt {
     python = python3;
-    inherit (qt5) qmake qttools qtwebengine qtxmlpatterns;
-  };
+    inherit (builtins.mapAttrs (_: pkg: pkg.override (previousArgs: lib.optionalAttrs (previousArgs ? stdenv) { stdenv = gcc12Stdenv; })) qt5)
+      qmake qttools qtwebengine qtxmlpatterns;
+    stdenv = gcc12Stdenv;
+  })
+  .overrideAttrs(previousAttrs: {
+    NIX_CFLAGS_COMPILE = "-w";
+    meta = previousAttrs.meta // { broken = true; };
+  });
 
   pyotherside = libsForQt5.callPackage ../development/libraries/pyotherside { };
 
@@ -24752,7 +24779,7 @@ with pkgs;
 
   rlottie = callPackage ../development/libraries/rlottie { };
 
-  rocksdb = callPackage ../development/libraries/rocksdb { };
+  rocksdb = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/rocksdb { });
 
   rocksdb_7_10 = rocksdb.overrideAttrs rec {
     pname = "rocksdb";
@@ -24886,9 +24913,9 @@ with pkgs;
 
   sdrplay = callPackage ../applications/radio/sdrplay { };
 
-  sdrpp = callPackage ../applications/radio/sdrpp {
+  sdrpp = pin-to-gcc12-if-gcc13 (callPackage ../applications/radio/sdrpp {
     inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  });
 
   sigdigger = libsForQt5.callPackage ../applications/radio/sigdigger { };
 
@@ -25387,7 +25414,7 @@ with pkgs;
 
   ucommon = callPackage ../development/libraries/ucommon { };
 
-  v8 = callPackage ../development/libraries/v8 (
+  v8 = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/v8 (
     let
       stdenv' = if stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion stdenv.cc.cc) "16"
         then overrideLibcxx llvmPackages_15.stdenv
@@ -25396,7 +25423,7 @@ with pkgs;
     {
       stdenv = if stdenv'.isDarwin then overrideSDK stdenv' "11.0" else stdenv';
     }
-  );
+  ));
 
   intel-vaapi-driver = callPackage ../development/libraries/intel-vaapi-driver { };
 
@@ -25513,9 +25540,9 @@ with pkgs;
 
   wayland-protocols = callPackage ../development/libraries/wayland/protocols.nix { };
 
-  waylandpp = callPackage ../development/libraries/waylandpp {
+  waylandpp = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/waylandpp {
     graphviz = graphviz-nox;
-  };
+  });
 
   wcslib = callPackage ../development/libraries/science/astronomy/wcslib { };
 
@@ -25575,6 +25602,7 @@ with pkgs;
 
   wxSVG = callPackage ../development/libraries/wxSVG {
     wxGTK = wxGTK32;
+    stdenv = gcc12Stdenv;
   };
 
   wtk = callPackage ../development/libraries/wtk { };
@@ -26295,11 +26323,11 @@ with pkgs;
 
   engelsystem = callPackage ../servers/web-apps/engelsystem { php = php81; };
 
-  envoy = callPackage ../servers/http/envoy {
+  envoy = pin-to-gcc12-if-gcc13 (callPackage ../servers/http/envoy {
     go = go_1_20;
     jdk = openjdk11_headless;
     gn = gn1924;
-  };
+  });
 
   ergochat = callPackage ../servers/irc/ergochat { };
 
@@ -26755,7 +26783,7 @@ with pkgs;
 
   openxr-loader = callPackage ../development/libraries/openxr-loader { };
 
-  osrm-backend = callPackage ../servers/osrm-backend { };
+  osrm-backend = disable-warnings-if-gcc13 (callPackage ../servers/osrm-backend { });
 
   oven-media-engine = callPackage ../servers/misc/oven-media-engine { };
 
@@ -27212,9 +27240,9 @@ with pkgs;
     protobuf = protobuf_21;
   };
 
-  rippled = callPackage ../servers/rippled {
+  rippled = disable-warnings-if-gcc13 (callPackage ../servers/rippled {
     boost = boost177;
-  };
+  });
 
   rippled-validator-keys-tool = callPackage ../servers/rippled/validator-keys-tool.nix { };
 
@@ -27852,9 +27880,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) AppKit;
   };
 
-  btop = darwin.apple_sdk_11_0.callPackage ../tools/system/btop {
-    stdenv = gcc12Stdenv;
-  };
+  btop = disable-warnings-if-gcc13 (darwin.apple_sdk_11_0.callPackage ../tools/system/btop { });
 
   nmon = callPackage ../os-specific/linux/nmon { };
 
@@ -27885,16 +27911,16 @@ with pkgs;
 
   iproute2 = callPackage ../os-specific/linux/iproute { };
 
-  ipu6-camera-bin = callPackage ../os-specific/linux/firmware/ipu6-camera-bins {};
+  ipu6-camera-bins = callPackage ../os-specific/linux/firmware/ipu6-camera-bins {};
 
   ipu6-camera-hal = callPackage ../development/libraries/ipu6-camera-hal {};
 
-  ipu6ep-camera-bin = callPackage ../os-specific/linux/firmware/ipu6-camera-bins {
+  ipu6ep-camera-hal = callPackage ../development/libraries/ipu6-camera-hal {
     ipuVersion = "ipu6ep";
   };
 
-  ipu6ep-camera-hal = callPackage ../development/libraries/ipu6-camera-hal {
-    ipu6-camera-bin = ipu6ep-camera-bin;
+  ipu6epmtl-camera-hal = callPackage ../development/libraries/ipu6-camera-hal {
+    ipuVersion = "ipu6epmtl";
   };
 
   ivsc-firmware = callPackage ../os-specific/linux/firmware/ivsc-firmware { };
@@ -30818,7 +30844,7 @@ with pkgs;
 
   clapper = callPackage ../applications/video/clapper { };
 
-  claws-mail = callPackage ../applications/networking/mailreaders/claws-mail { };
+  claws-mail = disable-warnings-if-gcc13 (callPackage ../applications/networking/mailreaders/claws-mail { });
 
   cligh = python3Packages.callPackage ../development/tools/github/cligh { };
 
@@ -31634,12 +31660,12 @@ with pkgs;
       };
     };
   };
-  gnuradio3_8 = callPackage ../applications/radio/gnuradio/wrapper.nix {
+  gnuradio3_8 = disable-warnings-if-gcc13 (callPackage ../applications/radio/gnuradio/wrapper.nix {
     unwrapped = callPackage ../applications/radio/gnuradio/3.8.nix {
       inherit (darwin.apple_sdk.frameworks) CoreAudio;
       python = python3;
     };
-  };
+  });
   gnuradio3_8Packages = lib.recurseIntoAttrs gnuradio3_8.pkgs;
   # A build without gui components and other utilites not needed if gnuradio is
   # used as a c++ library.
@@ -34148,7 +34174,7 @@ with pkgs;
 
   rep-gtk = callPackage ../development/libraries/rep-gtk { };
 
-  reproc = callPackage ../development/libraries/reproc { };
+  reproc = disable-warnings-if-gcc13 (callPackage ../development/libraries/reproc { });
 
   sawfish = callPackage ../applications/window-managers/sawfish { };
 
@@ -34299,7 +34325,7 @@ with pkgs;
   obs-cli = callPackage ../applications/misc/obs-cli { };
 
   obs-studio = qt6Packages.callPackage ../applications/video/obs-studio {
-    ffmpeg_4 = ffmpeg-full;
+    ffmpeg = ffmpeg-full;
   };
 
   obs-studio-plugins = recurseIntoAttrs (callPackage ../applications/video/obs-studio/plugins {});
@@ -35196,7 +35222,7 @@ with pkgs;
 
   spice-vdagent = callPackage ../applications/virtualization/spice-vdagent { };
 
-  spike = callPackage ../applications/virtualization/spike { };
+  spike = pin-to-gcc12-if-gcc13 (callPackage ../applications/virtualization/spike { });
 
   tensorman = callPackage ../tools/misc/tensorman { };
 
@@ -35308,12 +35334,12 @@ with pkgs;
 
   slic3r = callPackage ../applications/misc/slic3r { };
 
-  curaengine_stable = callPackage ../applications/misc/curaengine/stable.nix { };
+  curaengine_stable = disable-warnings-if-gcc13 (callPackage ../applications/misc/curaengine/stable.nix { });
 
-  curaengine = callPackage ../applications/misc/curaengine {
+  curaengine = disable-warnings-if-gcc13 (callPackage ../applications/misc/curaengine {
     inherit (python3.pkgs) libarcus;
     protobuf = protobuf_21;
-  };
+  });
 
   cura = libsForQt5.callPackage ../applications/misc/cura { };
 
@@ -36113,10 +36139,10 @@ with pkgs;
 
   virtual-ans = callPackage ../applications/audio/virtual-ans { };
 
-  virtualbox = libsForQt5.callPackage ../applications/virtualization/virtualbox {
+  virtualbox = disable-warnings-if-gcc13 (libsForQt5.callPackage ../applications/virtualization/virtualbox {
     stdenv = stdenv_32bit;
     inherit (gnome2) libIDL;
-  };
+  });
 
   virtualboxHardened = lowPrio (virtualbox.override {
     enableHardening = true;
@@ -36809,7 +36835,7 @@ with pkgs;
 
   zerobin = callPackage ../applications/networking/zerobin { };
 
-  zeroc-ice = callPackage ../development/libraries/zeroc-ice { };
+  zeroc-ice = disable-warnings-if-gcc13 (callPackage ../development/libraries/zeroc-ice { });
 
   zeroc-ice-cpp11 = zeroc-ice.override { cpp11 = true; };
 
@@ -37016,11 +37042,11 @@ with pkgs;
 
   lightning-pool = callPackage ../applications/blockchains/lightning-pool { };
 
-  litecoin  = libsForQt5.callPackage ../applications/blockchains/litecoin {
+  litecoin  = disable-warnings-if-gcc13 (libsForQt5.callPackage ../applications/blockchains/litecoin {
     inherit (darwin.apple_sdk.frameworks) AppKit;
     boost = pkgs.boost177;
-  };
-  litecoind = litecoin.override { withGui = false; };
+  });
+  litecoind = disable-warnings-if-gcc13 (litecoin.override { withGui = false; });
 
   livedl = callPackage ../tools/misc/livedl { };
 
@@ -37096,15 +37122,15 @@ with pkgs;
   vertcoin  = libsForQt5.callPackage ../applications/blockchains/vertcoin {
     withGui = true;
   };
-  vertcoind = callPackage ../applications/blockchains/vertcoin {
+  vertcoind = disable-warnings-if-gcc13 (callPackage ../applications/blockchains/vertcoin {
     withGui = false;
-  };
+  });
 
   wasabiwallet = callPackage ../applications/blockchains/wasabiwallet { };
 
   wasabibackend = callPackage ../applications/blockchains/wasabibackend { };
 
-  wownero = callPackage ../applications/blockchains/wownero { };
+  wownero = disable-warnings-if-gcc13 (callPackage ../applications/blockchains/wownero { });
 
   zcash = callPackage ../applications/blockchains/zcash {
     inherit (darwin.apple_sdk.frameworks) Security;
@@ -39248,7 +39274,7 @@ with pkgs;
 
   ipopt = callPackage ../development/libraries/science/math/ipopt { };
 
-  gmsh = callPackage ../applications/science/math/gmsh { };
+  gmsh = disable-warnings-if-gcc13 (callPackage ../applications/science/math/gmsh { });
 
   wcpg = callPackage ../development/libraries/science/math/wcpg { };
 
@@ -39591,7 +39617,7 @@ with pkgs;
 
   avy = callPackage ../applications/science/logic/avy { };
 
-  btor2tools = callPackage ../applications/science/logic/btor2tools { };
+  btor2tools = pin-to-gcc12-if-gcc13 (callPackage ../applications/science/logic/btor2tools { });
 
   boolector = callPackage ../applications/science/logic/boolector {
     stdenv = if stdenv.cc.isClang then overrideLibcxx llvmPackages_14.stdenv else stdenv;
@@ -40026,7 +40052,7 @@ with pkgs;
 
   beep = callPackage ../misc/beep { };
 
-  bees = callPackage ../tools/filesystems/bees { };
+  bees = pin-to-gcc12-if-gcc13 (callPackage ../tools/filesystems/bees { });
 
   blahaj = callPackage ../tools/misc/blahaj { };
 
@@ -40466,11 +40492,12 @@ with pkgs;
 
   networkd-dispatcher = callPackage ../tools/networking/networkd-dispatcher { };
 
-  nixVersions = recurseIntoAttrs (callPackage ../tools/package-management/nix {
-    storeDir = config.nix.storeDir or "/nix/store";
-    stateDir = config.nix.stateDir or "/nix/var";
-    inherit (darwin.apple_sdk.frameworks) Security;
-  });
+  nixVersions = builtins.mapAttrs (_: disable-warnings-if-gcc13)
+    (recurseIntoAttrs (callPackage ../tools/package-management/nix {
+      storeDir = config.nix.storeDir or "/nix/store";
+      stateDir = config.nix.stateDir or "/nix/var";
+      inherit (darwin.apple_sdk.frameworks) Security;
+    }));
 
   nix = nixVersions.stable;
 
diff --git a/pkgs/top-level/kodi-packages.nix b/pkgs/top-level/kodi-packages.nix
index 80c080eff7ba..d0a494786561 100644
--- a/pkgs/top-level/kodi-packages.nix
+++ b/pkgs/top-level/kodi-packages.nix
@@ -1,4 +1,5 @@
-{ config, lib, newScope, kodi, libretro }:
+{ config, lib, newScope, kodi, libretro
+, disable-warnings-if-gcc13 }:
 
 with lib;
 
@@ -156,7 +157,7 @@ let self = rec {
 
   inputstream-adaptive = callPackage ../applications/video/kodi/addons/inputstream-adaptive { };
 
-  inputstream-ffmpegdirect = callPackage ../applications/video/kodi/addons/inputstream-ffmpegdirect { };
+  inputstream-ffmpegdirect = disable-warnings-if-gcc13 (callPackage ../applications/video/kodi/addons/inputstream-ffmpegdirect { });
 
   inputstream-rtmp = callPackage ../applications/video/kodi/addons/inputstream-rtmp { };
 
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index c424226f76b9..751a13b34ce7 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -370,6 +370,17 @@ lib.makeScope pkgs.newScope (self: with self; {
           configureFlags = [
             "--enable-dom"
           ];
+          patches = lib.optionals (lib.versionOlder php.version "8.2.14") [
+            # Fix tests with libxml 2.12
+            # Part of 8.3.1RC1+, 8.2.14RC1+
+            (fetchpatch {
+              url = "https://github.com/php/php-src/commit/061058a9b1bbd90d27d97d79aebcf2b5029767b0.patch";
+              hash = "sha256-0hOlAG+pOYp/gUU0MUMZvzWpgr0ncJi5GB8IeNxxyEU=";
+              excludes = [
+                "NEWS"
+              ];
+            })
+          ];
         }
         {
           name = "enchant";
@@ -610,7 +621,9 @@ lib.makeScope pkgs.newScope (self: with self; {
           # The `sqlite3_bind_bug68849.phpt` test is currently broken for i686 Linux systems since sqlite 3.43, cf.:
           # - https://github.com/php/php-src/issues/12076
           # - https://www.sqlite.org/forum/forumpost/abbb95376ec6cd5f
-          patches = lib.optional (stdenv.isi686 && stdenv.isLinux) ../development/interpreters/php/skip-sqlite3_bind_bug68849.phpt.patch;
+          patches = lib.optionals (stdenv.isi686 && stdenv.isLinux) [
+            ../development/interpreters/php/skip-sqlite3_bind_bug68849.phpt.patch
+          ];
         }
         { name = "sysvmsg"; }
         { name = "sysvsem"; }
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index fcc3497480b0..3899bbcbb7dd 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -270,6 +270,7 @@ mapAliases ({
   mir_eval = mir-eval; # added 2024-01-07
   mistune_0_8 = throw "mistune_0_8 was removed because it was outdated and insecure"; # added 2022-08-12
   mistune_2_0 = mistune; # added 2022-08-12
+  mkdocs-minify = mkdocs-minify-plugin; # added 2023-11-28
   mox = throw "mox was removed because it is unmaintained"; # added 2023-02-21
   mrkd = throw "mrkd has been promoted to a top-level attribute"; # added 2023-08-01
   multi_key_dict = multi-key-dict; # added 2023-11-05
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 35c07c5c5a50..455ea39e92b7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16,6 +16,9 @@ self: super: with self; {
     build = toPythonModule (callPackage ../development/python-modules/bootstrap/build {
       inherit (bootstrap) flit-core installer;
     });
+    packaging = toPythonModule (callPackage ../development/python-modules/bootstrap/packaging {
+      inherit (bootstrap) flit-core installer;
+    });
   };
 
   setuptools = callPackage ../development/python-modules/setuptools { };
@@ -802,6 +805,8 @@ self: super: with self; {
 
   astropy-helpers = callPackage ../development/python-modules/astropy-helpers { };
 
+  astropy-iers-data = callPackage ../development/python-modules/astropy-iers-data { };
+
   astropy-extension-helpers = callPackage ../development/python-modules/astropy-extension-helpers { };
 
   astroquery = callPackage ../development/python-modules/astroquery { };
@@ -2544,13 +2549,13 @@ self: super: with self; {
 
   cysignals = callPackage ../development/python-modules/cysignals { };
 
-  cython = callPackage ../development/python-modules/Cython { };
+  cython = callPackage ../development/python-modules/cython { };
 
   cython_3 = self.cython.overridePythonAttrs (old: rec {
-    version = "3.0.3";
+    version = "3.0.6";
     src = old.src.override {
       inherit version;
-      hash = "sha256-MnMJMBsB9ynxc6lFEcsigMh7oDyJ7UKOiPkT93gkUDA=";
+      hash = "sha256-OZ0YVnLGZ7Juq73KQgyYVkWDeYrzvEdnCooJ6fGd1mA=";
     };
     patches = [ ];
   });
@@ -2699,7 +2704,7 @@ self: super: with self; {
 
   dbus-next = callPackage ../development/python-modules/dbus-next { };
 
-  dbus-python = callPackage ../development/python-modules/dbus {
+  dbus-python = callPackage ../development/python-modules/dbus-python {
     inherit (pkgs) dbus;
   };
 
@@ -3528,7 +3533,7 @@ self: super: with self; {
 
   ecoaliface = callPackage ../development/python-modules/ecoaliface { };
 
-  ecos = callPackage ../development/python-modules/ecos { };
+  ecos = pkgs.disable-warnings-if-gcc13 (callPackage ../development/python-modules/ecos { });
 
   ecpy = callPackage ../development/python-modules/ecpy { };
 
@@ -3948,7 +3953,7 @@ self: super: with self; {
 
   fastrlock = callPackage ../development/python-modules/fastrlock { };
 
-  fasttext = callPackage ../development/python-modules/fasttext { };
+  fasttext = pkgs.disable-warnings-if-gcc13 (callPackage ../development/python-modules/fasttext { });
 
   fasttext-predict = callPackage ../development/python-modules/fasttext-predict { };
 
@@ -4635,9 +4640,9 @@ self: super: with self; {
 
   gmpy = callPackage ../development/python-modules/gmpy { };
 
-  gmsh = toPythonModule (callPackage ../applications/science/math/gmsh {
+  gmsh = pkgs.disable-warnings-if-gcc13 (toPythonModule (callPackage ../applications/science/math/gmsh {
     enablePython = true;
-  });
+  }));
 
   gntp = callPackage ../development/python-modules/gntp { };
 
@@ -4852,6 +4857,8 @@ self: super: with self; {
 
   gradio-client = callPackage ../development/python-modules/gradio/client.nix { };
 
+  gradio-pdf = callPackage ../development/python-modules/gradio-pdf { };
+
   grafanalib = callPackage ../development/python-modules/grafanalib/default.nix { };
 
   grammalecte = callPackage ../development/python-modules/grammalecte { };
@@ -5904,6 +5911,8 @@ self: super: with self; {
 
   jsonschema = callPackage ../development/python-modules/jsonschema { };
 
+  jsonschema-path = callPackage ../development/python-modules/jsonschema-path { };
+
   jsonschema-spec = callPackage ../development/python-modules/jsonschema-spec { };
 
   jsonschema-specifications = callPackage ../development/python-modules/jsonschema-specifications { };
@@ -6716,6 +6725,8 @@ self: super: with self; {
 
   rtmixer = callPackage ../development/python-modules/rtmixer { };
 
+  regress = callPackage ../development/python-modules/regress { };
+
   mail-parser = callPackage ../development/python-modules/mail-parser { };
 
   makefun = callPackage ../development/python-modules/makefun { };
@@ -7084,7 +7095,7 @@ self: super: with self; {
   mkdocs-macros = callPackage ../development/python-modules/mkdocs-macros { };
   mkdocs-material = callPackage ../development/python-modules/mkdocs-material { };
   mkdocs-material-extensions = callPackage ../development/python-modules/mkdocs-material/mkdocs-material-extensions.nix { };
-  mkdocs-minify = callPackage ../development/python-modules/mkdocs-minify { };
+  mkdocs-minify-plugin = callPackage ../development/python-modules/mkdocs-minify-plugin { };
   mkdocs-redirects = callPackage ../development/python-modules/mkdocs-redirects { };
   mkdocs-simple-hooks = callPackage ../development/python-modules/mkdocs-simple-hooks { };
   mkdocs-swagger-ui-tag = callPackage ../development/python-modules/mkdocs-swagger-ui-tag { };
@@ -8884,6 +8895,8 @@ self: super: with self; {
 
   pagelabels = callPackage ../development/python-modules/pagelabels { };
 
+  paginate = callPackage ../development/python-modules/paginate { };
+
   paho-mqtt = callPackage ../development/python-modules/paho-mqtt { };
 
   palace = callPackage ../development/python-modules/palace { };
@@ -9096,7 +9109,12 @@ self: super: with self; {
 
   pem = callPackage ../development/python-modules/pem { };
 
-  pendulum = callPackage ../development/python-modules/pendulum { };
+  pendulum = if pythonAtLeast "3.12" then
+    pendulum_3
+  else
+    callPackage ../development/python-modules/pendulum { };
+
+  pendulum_3 = callPackage ../development/python-modules/pendulum/3.nix { };
 
   pep440 = callPackage ../development/python-modules/pep440 { };
 
@@ -10056,7 +10074,7 @@ self: super: with self; {
 
   pybigwig = callPackage ../development/python-modules/pybigwig { };
 
-  pybind11 = callPackage ../development/python-modules/pybind11 { };
+  pybind11 = pkgs.disable-warnings-if-gcc13 (callPackage ../development/python-modules/pybind11 { });
 
   pybindgen = callPackage ../development/python-modules/pybindgen { };
 
@@ -10172,7 +10190,7 @@ self: super: with self; {
 
   pycron = callPackage ../development/python-modules/pycron { };
 
-  pycrypto = callPackage ../development/python-modules/pycrypto { };
+  pycrypto = pkgs.disable-warnings-if-gcc13 (callPackage ../development/python-modules/pycrypto { });
 
   pycryptodome = callPackage ../development/python-modules/pycryptodome { };
 
@@ -10214,6 +10232,8 @@ self: super: with self; {
 
   pydantic = callPackage ../development/python-modules/pydantic { };
 
+  pydantic_1 = callPackage ../development/python-modules/pydantic/1.nix { };
+
   pydantic-compat = callPackage ../development/python-modules/pydantic-compat { };
 
   pydantic-core = callPackage ../development/python-modules/pydantic-core { };
@@ -13138,6 +13158,8 @@ self: super: with self; {
 
   sigrok = callPackage ../development/python-modules/sigrok { };
 
+  sigstore = callPackage ../development/python-modules/sigstore { };
+
   sigstore-protobuf-specs = callPackage ../development/python-modules/sigstore-protobuf-specs { };
 
   sigstore-rekor-types = callPackage ../development/python-modules/sigstore-rekor-types { };
@@ -15441,6 +15463,8 @@ self: super: with self; {
 
   types-psutil = callPackage ../development/python-modules/types-psutil { };
 
+  types-psycopg2 = callPackage ../development/python-modules/types-psycopg2 { };
+
   types-pyopenssl = callPackage ../development/python-modules/types-pyopenssl { };
 
   types-python-dateutil = callPackage ../development/python-modules/types-python-dateutil { };
@@ -16121,6 +16145,7 @@ self: super: with self; {
     wxGTK = pkgs.wxGTK32.override {
       withWebKit = true;
     };
+    inherit (pkgs) mesa;
   };
 
   wyoming = callPackage ../development/python-modules/wyoming { };
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index 365f89dc990f..decb95383438 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -100,6 +100,8 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
 
   fcitx5-qt = callPackage ../tools/inputmethods/fcitx5/fcitx5-qt.nix { };
 
+  futuresql = callPackage ../development/libraries/futuresql { };
+
   qgpgme = callPackage ../development/libraries/gpgme { };
 
   grantlee = callPackage ../development/libraries/grantlee/5 { };
@@ -162,6 +164,8 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
 
   libqtav = callPackage ../development/libraries/libqtav { };
 
+  libquotient = callPackage ../development/libraries/libquotient { };
+
   libqaccessibilityclient = callPackage ../development/libraries/libqaccessibilityclient { };
 
   mapbox-gl-native = libsForQt5.callPackage ../development/libraries/mapbox-gl-native { };
@@ -173,7 +177,7 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
   maui-core = libsForQt5.callPackage ../development/libraries/maui-core { };
 
   mlt = pkgs.mlt.override {
-    enableQt = true;
+    qt = qt5;
   };
 
   phonon = callPackage ../development/libraries/phonon { };
@@ -194,10 +198,11 @@ in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdP
 
   pulseaudio-qt = callPackage ../development/libraries/pulseaudio-qt { };
 
-  qca-qt5 = callPackage ../development/libraries/qca-qt5 {
+  qca = callPackage ../development/libraries/qca {
     stdenv = if pkgs.stdenv.isDarwin then pkgs.overrideSDK pkgs.stdenv "11.0" else pkgs.stdenv;
     inherit (libsForQt5) qtbase;
   };
+  qca-qt5 = self.qca;
 
   qcoro = callPackage ../development/libraries/qcoro { };
 
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index b9f3fdd35eef..940a5e154562 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -29,11 +29,31 @@ makeScopeWithSplicing' {
   inherit stdenv;
 
   # LIBRARIES
+  appstream-qt = callPackage ../development/libraries/appstream/qt.nix { };
+
+  kdsoap = callPackage ../development/libraries/kdsoap { };
+
+  futuresql = callPackage ../development/libraries/futuresql { };
+  kquickimageedit = callPackage ../development/libraries/kquickimageedit { };
+  libqaccessibilityclient = callPackage ../development/libraries/libqaccessibilityclient { };
+  libquotient = callPackage ../development/libraries/libquotient { };
+  mlt = pkgs.mlt.override {
+    qt = qt6;
+  };
+
+  qca = pkgs.darwin.apple_sdk_11_0.callPackage ../development/libraries/qca {
+    inherit (qt6) qtbase qt5compat;
+  };
+  qcoro = callPackage ../development/libraries/qcoro { };
+  qgpgme = callPackage ../development/libraries/gpgme { };
+  packagekit-qt = callPackage ../tools/package-management/packagekit/qt.nix { };
 
   qt6ct = callPackage ../tools/misc/qt6ct { };
 
   qt6gtk2 = callPackage ../tools/misc/qt6gtk2 { };
 
+  qtforkawesome = callPackage ../development/libraries/qtforkawesome { };
+
   qtkeychain = callPackage ../development/libraries/qtkeychain {
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
@@ -44,6 +64,8 @@ makeScopeWithSplicing' {
     qt5Kvantum = pkgs.libsForQt5.qtstyleplugin-kvantum;
   };
 
+  qtutilities = callPackage ../development/libraries/qtutilities { };
+
   quazip = callPackage ../development/libraries/quazip { };
 
   qscintilla = callPackage ../development/libraries/qscintilla { };
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 7d4d220e23a8..7fdea87f3d60 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -2520,10 +2520,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "004ip9x9281fxhpipwi8di1sb1dnabscq9dy1p3cxgdwbniqqi12";
+      sha256 = "NBOIGE6XXQkebjjOPzsziL+35Kw9eQ79jjkSSEQEC9E=";
       type = "gem";
     };
-    version = "1.15.5";
+    version = "1.16.0";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];