diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 39c7ff2d4ae4..823f040c7131 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2447,6 +2447,13 @@
     github = "beezow";
     githubId = 42082156;
   };
+  benaryorg = {
+    name = "benaryorg";
+    email = "binary@benary.org";
+    github = "benaryorg";
+    githubId = 6145260;
+    keys = [ { fingerprint = "804B 6CB8 AED5 61D9 3DAD  4DC5 E2F2 2C5E DF20 119D"; } ];
+  };
   bendlas = {
     email = "herwig@bendlas.net";
     matrix = "@bendlas:matrix.org";
@@ -15631,6 +15638,12 @@
     githubId = 5948762;
     name = "Berk Özkütük";
   };
+  ozwaldorf = {
+    email = "self@ossian.dev";
+    github = "ozwaldorf";
+    githubId = 8976745;
+    name = "Ossian Mapes";
+  };
   p3psi = {
     name = "Elliot Boo";
     email = "p3psi.boo@gmail.com";
diff --git a/nixos/modules/services/databases/neo4j.nix b/nixos/modules/services/databases/neo4j.nix
index c3f1872e0822..ff4d47c3cf7f 100644
--- a/nixos/modules/services/databases/neo4j.nix
+++ b/nixos/modules/services/databases/neo4j.nix
@@ -1,34 +1,31 @@
 { config, options, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.neo4j;
   opt = options.services.neo4j;
   certDirOpt = options.services.neo4j.directories.certificates;
-  isDefaultPathOption = opt: isOption opt && opt.type == types.path && opt.highestPrio >= 1500;
+  isDefaultPathOption = opt: lib.isOption opt && opt.type == lib.types.path && opt.highestPrio >= 1500;
 
-  sslPolicies = mapAttrsToList (
+  sslPolicies = lib.mapAttrsToList (
     name: conf: ''
-      dbms.ssl.policy.${name}.allow_key_generation=${boolToString conf.allowKeyGeneration}
+      dbms.ssl.policy.${name}.allow_key_generation=${lib.boolToString conf.allowKeyGeneration}
       dbms.ssl.policy.${name}.base_directory=${conf.baseDirectory}
-      ${optionalString (conf.ciphers != null) ''
-        dbms.ssl.policy.${name}.ciphers=${concatStringsSep "," conf.ciphers}
+      ${lib.optionalString (conf.ciphers != null) ''
+        dbms.ssl.policy.${name}.ciphers=${lib.concatStringsSep "," conf.ciphers}
       ''}
       dbms.ssl.policy.${name}.client_auth=${conf.clientAuth}
-      ${if length (splitString "/" conf.privateKey) > 1 then
+      ${if lib.length (lib.splitString "/" conf.privateKey) > 1 then
         "dbms.ssl.policy.${name}.private_key=${conf.privateKey}"
       else
         "dbms.ssl.policy.${name}.private_key=${conf.baseDirectory}/${conf.privateKey}"
       }
-      ${if length (splitString "/" conf.privateKey) > 1 then
+      ${if lib.length (lib.splitString "/" conf.privateKey) > 1 then
         "dbms.ssl.policy.${name}.public_certificate=${conf.publicCertificate}"
       else
         "dbms.ssl.policy.${name}.public_certificate=${conf.baseDirectory}/${conf.publicCertificate}"
       }
       dbms.ssl.policy.${name}.revoked_dir=${conf.revokedDir}
-      dbms.ssl.policy.${name}.tls_versions=${concatStringsSep "," conf.tlsVersions}
-      dbms.ssl.policy.${name}.trust_all=${boolToString conf.trustAll}
+      dbms.ssl.policy.${name}.tls_versions=${lib.concatStringsSep "," conf.tlsVersions}
+      dbms.ssl.policy.${name}.trust_all=${lib.boolToString conf.trustAll}
       dbms.ssl.policy.${name}.trusted_dir=${conf.trustedDir}
     ''
   ) cfg.ssl.policies;
@@ -36,8 +33,8 @@ let
   serverConfig = pkgs.writeText "neo4j.conf" ''
     # General
     server.default_listen_address=${cfg.defaultListenAddress}
-    server.databases.default_to_read_only=${boolToString cfg.readOnly}
-    ${optionalString (cfg.workerCount > 0) ''
+    server.databases.default_to_read_only=${lib.boolToString cfg.readOnly}
+    ${lib.optionalString (cfg.workerCount > 0) ''
       dbms.threads.worker_count=${toString cfg.workerCount}
     ''}
 
@@ -45,7 +42,7 @@ let
     # dbms.directories.certificates=${cfg.directories.certificates}
     server.directories.plugins=${cfg.directories.plugins}
     server.directories.lib=${cfg.package}/share/neo4j/lib
-    ${optionalString (cfg.constrainLoadCsv) ''
+    ${lib.optionalString (cfg.constrainLoadCsv) ''
       server.directories.import=${cfg.directories.imports}
    ''}
 
@@ -55,25 +52,25 @@ let
     server.directories.run=${cfg.directories.home}/run
 
     # HTTP Connector
-    ${optionalString (cfg.http.enable) ''
-      server.http.enabled=${boolToString cfg.http.enable}
+    ${lib.optionalString (cfg.http.enable) ''
+      server.http.enabled=${lib.boolToString cfg.http.enable}
       server.http.listen_address=${cfg.http.listenAddress}
       server.http.advertised_address=${cfg.http.listenAddress}
     ''}
 
     # HTTPS Connector
-    server.https.enabled=${boolToString cfg.https.enable}
+    server.https.enabled=${lib.boolToString cfg.https.enable}
     server.https.listen_address=${cfg.https.listenAddress}
     server.https.advertised_address=${cfg.https.listenAddress}
 
     # BOLT Connector
-    server.bolt.enabled=${boolToString cfg.bolt.enable}
+    server.bolt.enabled=${lib.boolToString cfg.bolt.enable}
     server.bolt.listen_address=${cfg.bolt.listenAddress}
     server.bolt.advertised_address=${cfg.bolt.listenAddress}
     server.bolt.tls_level=${cfg.bolt.tlsLevel}
 
     # SSL Policies
-    ${concatStringsSep "\n" sslPolicies}
+    ${lib.concatStringsSep "\n" sslPolicies}
 
     # Default retention policy from neo4j.conf
     db.tx_log.rotation.retention_policy=1 days
@@ -101,33 +98,33 @@ let
 in {
 
   imports = [
-    (mkRenamedOptionModule [ "services" "neo4j" "host" ] [ "services" "neo4j" "defaultListenAddress" ])
-    (mkRenamedOptionModule [ "services" "neo4j" "listenAddress" ] [ "services" "neo4j" "defaultListenAddress" ])
-    (mkRenamedOptionModule [ "services" "neo4j" "enableBolt" ] [ "services" "neo4j" "bolt" "enable" ])
-    (mkRenamedOptionModule [ "services" "neo4j" "enableHttps" ] [ "services" "neo4j" "https" "enable" ])
-    (mkRenamedOptionModule [ "services" "neo4j" "certDir" ] [ "services" "neo4j" "directories" "certificates" ])
-    (mkRenamedOptionModule [ "services" "neo4j" "dataDir" ] [ "services" "neo4j" "directories" "home" ])
-    (mkRemovedOptionModule [ "services" "neo4j" "port" ] "Use services.neo4j.http.listenAddress instead.")
-    (mkRemovedOptionModule [ "services" "neo4j" "boltPort" ] "Use services.neo4j.bolt.listenAddress instead.")
-    (mkRemovedOptionModule [ "services" "neo4j" "httpsPort" ] "Use services.neo4j.https.listenAddress instead.")
-    (mkRemovedOptionModule [ "services" "neo4j" "shell" "enabled" ] "shell.enabled was removed upstream")
-    (mkRemovedOptionModule [ "services" "neo4j" "udc" "enabled" ] "udc.enabled was removed upstream")
+    (lib.mkRenamedOptionModule [ "services" "neo4j" "host" ] [ "services" "neo4j" "defaultListenAddress" ])
+    (lib.mkRenamedOptionModule [ "services" "neo4j" "listenAddress" ] [ "services" "neo4j" "defaultListenAddress" ])
+    (lib.mkRenamedOptionModule [ "services" "neo4j" "enableBolt" ] [ "services" "neo4j" "bolt" "enable" ])
+    (lib.mkRenamedOptionModule [ "services" "neo4j" "enableHttps" ] [ "services" "neo4j" "https" "enable" ])
+    (lib.mkRenamedOptionModule [ "services" "neo4j" "certDir" ] [ "services" "neo4j" "directories" "certificates" ])
+    (lib.mkRenamedOptionModule [ "services" "neo4j" "dataDir" ] [ "services" "neo4j" "directories" "home" ])
+    (lib.mkRemovedOptionModule [ "services" "neo4j" "port" ] "Use services.neo4j.http.listenAddress instead.")
+    (lib.mkRemovedOptionModule [ "services" "neo4j" "boltPort" ] "Use services.neo4j.bolt.listenAddress instead.")
+    (lib.mkRemovedOptionModule [ "services" "neo4j" "httpsPort" ] "Use services.neo4j.https.listenAddress instead.")
+    (lib.mkRemovedOptionModule [ "services" "neo4j" "shell" "enabled" ] "shell.enabled was removed upstream")
+    (lib.mkRemovedOptionModule [ "services" "neo4j" "udc" "enabled" ] "udc.enabled was removed upstream")
   ];
 
   ###### interface
 
   options.services.neo4j = {
 
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to enable Neo4j Community Edition.
       '';
     };
 
-    constrainLoadCsv = mkOption {
-      type = types.bool;
+    constrainLoadCsv = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = ''
         Sets the root directory for file URLs used with the Cypher
@@ -141,8 +138,8 @@ in {
       '';
     };
 
-    defaultListenAddress = mkOption {
-      type = types.str;
+    defaultListenAddress = lib.mkOption {
+      type = lib.types.str;
       default = "127.0.0.1";
       description = ''
         Default network interface to listen for incoming connections. To
@@ -155,8 +152,8 @@ in {
       '';
     };
 
-    extraServerConfig = mkOption {
-      type = types.lines;
+    extraServerConfig = lib.mkOption {
+      type = lib.types.lines;
       default = "";
       description = ''
         Extra configuration for Neo4j Community server. Refer to the
@@ -165,18 +162,18 @@ in {
       '';
     };
 
-    package = mkPackageOption pkgs "neo4j" { };
+    package = lib.mkPackageOption pkgs "neo4j" { };
 
-    readOnly = mkOption {
-      type = types.bool;
+    readOnly = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Only allow read operations from this Neo4j instance.
       '';
     };
 
-    workerCount = mkOption {
-      type = types.ints.between 0 44738;
+    workerCount = lib.mkOption {
+      type = lib.types.ints.between 0 44738;
       default = 0;
       description = ''
         Number of Neo4j worker threads, where the default of
@@ -186,8 +183,8 @@ in {
     };
 
     bolt = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Enable the BOLT connector for Neo4j. Setting this option to
@@ -196,8 +193,8 @@ in {
         '';
       };
 
-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
         default = ":7687";
         description = ''
           Neo4j listen address for BOLT traffic. The listen address is
@@ -205,8 +202,8 @@ in {
         '';
       };
 
-      sslPolicy = mkOption {
-        type = types.str;
+      sslPolicy = lib.mkOption {
+        type = lib.types.str;
         default = "legacy";
         description = ''
           Neo4j SSL policy for BOLT traffic.
@@ -223,8 +220,8 @@ in {
         '';
       };
 
-      tlsLevel = mkOption {
-        type = types.enum [ "REQUIRED" "OPTIONAL" "DISABLED" ];
+      tlsLevel = lib.mkOption {
+        type = lib.types.enum [ "REQUIRED" "OPTIONAL" "DISABLED" ];
         default = "OPTIONAL";
         description = ''
           SSL/TSL requirement level for BOLT traffic.
@@ -233,10 +230,10 @@ in {
     };
 
     directories = {
-      certificates = mkOption {
-        type = types.path;
+      certificates = lib.mkOption {
+        type = lib.types.path;
         default = "${cfg.directories.home}/certificates";
-        defaultText = literalExpression ''"''${config.${opt.directories.home}}/certificates"'';
+        defaultText = lib.literalExpression ''"''${config.${opt.directories.home}}/certificates"'';
         description = ''
           Directory for storing certificates to be used by Neo4j for
           TLS connections.
@@ -256,10 +253,10 @@ in {
         '';
       };
 
-      data = mkOption {
-        type = types.path;
+      data = lib.mkOption {
+        type = lib.types.path;
         default = "${cfg.directories.home}/data";
-        defaultText = literalExpression ''"''${config.${opt.directories.home}}/data"'';
+        defaultText = lib.literalExpression ''"''${config.${opt.directories.home}}/data"'';
         description = ''
           Path of the data directory. You must not configure more than one
           Neo4j installation to use the same data directory.
@@ -270,8 +267,8 @@ in {
         '';
       };
 
-      home = mkOption {
-        type = types.path;
+      home = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/neo4j";
         description = ''
           Path of the Neo4j home directory. Other default directories are
@@ -281,10 +278,10 @@ in {
         '';
       };
 
-      imports = mkOption {
-        type = types.path;
+      imports = lib.mkOption {
+        type = lib.types.path;
         default = "${cfg.directories.home}/import";
-        defaultText = literalExpression ''"''${config.${opt.directories.home}}/import"'';
+        defaultText = lib.literalExpression ''"''${config.${opt.directories.home}}/import"'';
         description = ''
           The root directory for file URLs used with the Cypher
           `LOAD CSV` clause. Only meaningful when
@@ -297,10 +294,10 @@ in {
         '';
       };
 
-      plugins = mkOption {
-        type = types.path;
+      plugins = lib.mkOption {
+        type = lib.types.path;
         default = "${cfg.directories.home}/plugins";
-        defaultText = literalExpression ''"''${config.${opt.directories.home}}/plugins"'';
+        defaultText = lib.literalExpression ''"''${config.${opt.directories.home}}/plugins"'';
         description = ''
           Path of the database plugin directory. Compiled Java JAR files that
           contain database procedures will be loaded if they are placed in
@@ -314,8 +311,8 @@ in {
     };
 
     http = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Enable the HTTP connector for Neo4j. Setting this option to
@@ -324,8 +321,8 @@ in {
         '';
       };
 
-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
         default = ":7474";
         description = ''
           Neo4j listen address for HTTP traffic. The listen address is
@@ -335,8 +332,8 @@ in {
     };
 
     https = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Enable the HTTPS connector for Neo4j. Setting this option to
@@ -345,8 +342,8 @@ in {
         '';
       };
 
-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
         default = ":7473";
         description = ''
           Neo4j listen address for HTTPS traffic. The listen address is
@@ -354,8 +351,8 @@ in {
         '';
       };
 
-      sslPolicy = mkOption {
-        type = types.str;
+      sslPolicy = lib.mkOption {
+        type = lib.types.str;
         default = "legacy";
         description = ''
           Neo4j SSL policy for HTTPS traffic.
@@ -370,8 +367,8 @@ in {
     };
 
     shell = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable a remote shell server which Neo4j Shell clients can log in to.
@@ -380,12 +377,12 @@ in {
       };
     };
 
-    ssl.policies = mkOption {
-      type = with types; attrsOf (submodule ({ name, config, options, ... }: {
+    ssl.policies = lib.mkOption {
+      type = with lib.types; attrsOf (submodule ({ name, config, options, ... }: {
         options = {
 
-          allowKeyGeneration = mkOption {
-            type = types.bool;
+          allowKeyGeneration = lib.mkOption {
+            type = lib.types.bool;
             default = false;
             description = ''
               Allows the generation of a private key and associated self-signed
@@ -402,10 +399,10 @@ in {
             '';
           };
 
-          baseDirectory = mkOption {
-            type = types.path;
+          baseDirectory = lib.mkOption {
+            type = lib.types.path;
             default = "${cfg.directories.certificates}/${name}";
-            defaultText = literalExpression ''"''${config.${opt.directories.certificates}}/''${name}"'';
+            defaultText = lib.literalExpression ''"''${config.${opt.directories.certificates}}/''${name}"'';
             description = ''
               The mandatory base directory for cryptographic objects of this
               policy. This path is only automatically generated when this
@@ -420,8 +417,8 @@ in {
             '';
           };
 
-          ciphers = mkOption {
-            type = types.nullOr (types.listOf types.str);
+          ciphers = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.str);
             default = null;
             description = ''
               Restrict the allowed ciphers of this policy to those defined
@@ -429,16 +426,16 @@ in {
             '';
           };
 
-          clientAuth = mkOption {
-            type = types.enum [ "NONE" "OPTIONAL" "REQUIRE" ];
+          clientAuth = lib.mkOption {
+            type = lib.types.enum [ "NONE" "OPTIONAL" "REQUIRE" ];
             default = "REQUIRE";
             description = ''
               The client authentication stance for this policy.
             '';
           };
 
-          privateKey = mkOption {
-            type = types.str;
+          privateKey = lib.mkOption {
+            type = lib.types.str;
             default = "private.key";
             description = ''
               The name of private PKCS #8 key file for this policy to be found
@@ -447,8 +444,8 @@ in {
             '';
           };
 
-          publicCertificate = mkOption {
-            type = types.str;
+          publicCertificate = lib.mkOption {
+            type = lib.types.str;
             default = "public.crt";
             description = ''
               The name of public X.509 certificate (chain) file in PEM format
@@ -462,10 +459,10 @@ in {
             '';
           };
 
-          revokedDir = mkOption {
-            type = types.path;
+          revokedDir = lib.mkOption {
+            type = lib.types.path;
             default = "${config.baseDirectory}/revoked";
-            defaultText = literalExpression ''"''${config.${options.baseDirectory}}/revoked"'';
+            defaultText = lib.literalExpression ''"''${config.${options.baseDirectory}}/revoked"'';
             description = ''
               Path to directory of CRLs (Certificate Revocation Lists) in
               PEM format. Must be an absolute path. The existence of this
@@ -478,8 +475,8 @@ in {
             '';
           };
 
-          tlsVersions = mkOption {
-            type = types.listOf types.str;
+          tlsVersions = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
             default = [ "TLSv1.2" ];
             description = ''
               Restrict the TLS protocol versions of this policy to those
@@ -487,8 +484,8 @@ in {
             '';
           };
 
-          trustAll = mkOption {
-            type = types.bool;
+          trustAll = lib.mkOption {
+            type = lib.types.bool;
             default = false;
             description = ''
               Makes this policy trust all remote parties. Enabling this is not
@@ -498,10 +495,10 @@ in {
             '';
           };
 
-          trustedDir = mkOption {
-            type = types.path;
+          trustedDir = lib.mkOption {
+            type = lib.types.path;
             default = "${config.baseDirectory}/trusted";
-            defaultText = literalExpression ''"''${config.${options.baseDirectory}}/trusted"'';
+            defaultText = lib.literalExpression ''"''${config.${options.baseDirectory}}/trusted"'';
             description = ''
               Path to directory of X.509 certificates in PEM format for
               trusted parties. Must be an absolute path. The existence of this
@@ -518,8 +515,8 @@ in {
             '';
           };
 
-          directoriesToCreate = mkOption {
-            type = types.listOf types.path;
+          directoriesToCreate = lib.mkOption {
+            type = lib.types.listOf lib.types.path;
             internal = true;
             readOnly = true;
             description = ''
@@ -532,9 +529,9 @@ in {
 
         };
 
-        config.directoriesToCreate = optionals
+        config.directoriesToCreate = lib.optionals
           (certDirOpt.highestPrio >= 1500 && options.baseDirectory.highestPrio >= 1500)
-          (map (opt: opt.value) (filter isDefaultPathOption (attrValues options)));
+          (map (opt: opt.value) (lib.filter isDefaultPathOption (lib.attrValues options)));
 
       }));
       default = {};
@@ -555,22 +552,22 @@ in {
   config =
     let
       # Assertion helpers
-      policyNameList = attrNames cfg.ssl.policies;
+      policyNameList = lib.attrNames cfg.ssl.policies;
       validPolicyNameList = [ "legacy" ] ++ policyNameList;
-      validPolicyNameString = concatStringsSep ", " validPolicyNameList;
+      validPolicyNameString = lib.concatStringsSep ", " validPolicyNameList;
 
       # Capture various directories left at their default so they can be created.
-      defaultDirectoriesToCreate = map (opt: opt.value) (filter isDefaultPathOption (attrValues options.services.neo4j.directories));
-      policyDirectoriesToCreate = concatMap (pol: pol.directoriesToCreate) (attrValues cfg.ssl.policies);
+      defaultDirectoriesToCreate = map (opt: opt.value) (lib.filter isDefaultPathOption (lib.attrValues options.services.neo4j.directories));
+      policyDirectoriesToCreate = lib.concatMap (pol: pol.directoriesToCreate) (lib.attrValues cfg.ssl.policies);
     in
 
-    mkIf cfg.enable {
+    lib.mkIf cfg.enable {
       assertions = [
-        { assertion = !elem "legacy" policyNameList;
+        { assertion = !lib.elem "legacy" policyNameList;
           message = "The policy 'legacy' is special to Neo4j, and its name is reserved."; }
-        { assertion = elem cfg.bolt.sslPolicy validPolicyNameList;
+        { assertion = lib.elem cfg.bolt.sslPolicy validPolicyNameList;
           message = "Invalid policy assigned: `services.neo4j.bolt.sslPolicy = \"${cfg.bolt.sslPolicy}\"`, defined policies are: ${validPolicyNameString}"; }
-        { assertion = elem cfg.https.sslPolicy validPolicyNameList;
+        { assertion = lib.elem cfg.https.sslPolicy validPolicyNameList;
           message = "Invalid policy assigned: `services.neo4j.https.sslPolicy = \"${cfg.https.sslPolicy}\"`, defined policies are: ${validPolicyNameString}"; }
       ];
 
@@ -595,7 +592,7 @@ in {
           mkdir -m 0700 -p ${cfg.directories.home}/{conf,logs}
 
           #   Create other sub-directories and policy directories that have been left at their default.
-          ${concatMapStringsSep "\n" (
+          ${lib.concatMapStringsSep "\n" (
             dir: ''
               mkdir -m 0700 -p ${dir}
           '') (defaultDirectoriesToCreate ++ policyDirectoriesToCreate)}
diff --git a/nixos/modules/services/hardware/kanata.nix b/nixos/modules/services/hardware/kanata.nix
index 67bcac6fe443..7557b1ae55f9 100644
--- a/nixos/modules/services/hardware/kanata.nix
+++ b/nixos/modules/services/hardware/kanata.nix
@@ -115,7 +115,7 @@ let
           --cfg ${keyboard.configFile} \
           --symlink-path ''${RUNTIME_DIRECTORY}/${name} \
           ${lib.optionalString (keyboard.port != null) "--port ${toString keyboard.port}"} \
-          ${utils.lib.escapeSystemdExecArgs keyboard.extraArgs}
+          ${utils.escapeSystemdExecArgs keyboard.extraArgs}
       '';
 
       DynamicUser = true;
diff --git a/nixos/tests/ceph-single-node-bluestore-dmcrypt.nix b/nixos/tests/ceph-single-node-bluestore-dmcrypt.nix
index 3c6f0e59fe41..13407f054931 100644
--- a/nixos/tests/ceph-single-node-bluestore-dmcrypt.nix
+++ b/nixos/tests/ceph-single-node-bluestore-dmcrypt.nix
@@ -16,8 +16,11 @@ import ./make-test-python.nix (
   in
   {
     name = "basic-single-node-ceph-cluster-bluestore-dmcrypt";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ nh2 ];
+    meta = {
+      maintainers = with lib.maintainers; [
+        benaryorg
+        nh2
+      ];
     };
 
     nodes = {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 0b1dd812c29a..3ed6cd5f64f0 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2675,6 +2675,22 @@ let
         };
       };
 
+      jgclark.vscode-todo-highlight = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-todo-highlight";
+          publisher = "jgclark";
+          version = "2.0.8";
+          hash = "sha256-/CctaLcG+dA2Cf69/ACeDKdRLsu/VUGbAxUbyhI0VyA=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/wayou.vscode-todo-highlight/changelog";
+          description = "highlight TODOs, FIXMEs, and any keywords, annotations...";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jgclark.vscode-todo-highlight";
+          homepage = "https://github.com/jgclark/vscode-todo-highlight";
+          license = lib.licenses.mit;
+        };
+      };
+
       julialang.language-julia = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "language-julia";
diff --git a/pkgs/applications/networking/remote/freerdp/3.nix b/pkgs/applications/networking/remote/freerdp/3.nix
index 202893ced50c..31d5b2beee44 100644
--- a/pkgs/applications/networking/remote/freerdp/3.nix
+++ b/pkgs/applications/networking/remote/freerdp/3.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , docbook-xsl-nons
 , libxslt
@@ -70,15 +71,24 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerdp";
-  version = "3.7.0";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = finalAttrs.version;
-    hash = "sha256-o/Sp9mMEIxtXa0oIpxYG9Fm8YejStUYcW/jkdPwyE5I=";
+    hash = "sha256-zqqPfAXHjY4IV18mgbNxWDw7ZP/7SvoYn1u0FahpcNk=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "clang-fix-unwind-getlanguagespecificdata.patch";
+      url = "https://github.com/FreeRDP/FreeRDP/commit/6fb7bfd043d159d3819486fb601b598102cca823.patch";
+      hash = "sha256-U2Oz+IVvlIdg7kJ4rgAWhJVdzthY50YaCYKMMc2he7Y=";
+    })
+  ];
+
+
   postPatch = ''
     export HOME=$TMP
 
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index 1a71c08c1f87..7b9a22ff0721 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zotero";
-  version = "7.0";
+  version = "7.0.3";
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    hash = "sha256-0CAiK8HY/udup51zB6I2o4jvOHvSJGm+5JehHk8F/Io=";
+    hash = "sha256-W5/j5ohrx/X0qlOiWWtB/FEF9aZCnbbAA3pcL8R6yy0=";
   };
 
   dontPatchELF = true;
diff --git a/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix b/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
index 8553f292dcec..e0b1b0e20723 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , cairo
 , expat
@@ -22,6 +23,7 @@
 , util-linux
 , wayland
 , wayland-protocols
+, wayland-scanner
 , hyprwayland-scanner
 , hyprutils
 }:
@@ -37,10 +39,19 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-HIK7XJWQCM0BAnwW5uC7P0e7DAkVTy5jlxQ0NwoSy4M=";
   };
 
+  patches = [
+    # CMakeLists: look for wayland.xml protocol in wayland-scanner pkgdata
+    (fetchpatch {
+      url = "https://github.com/hyprwm/hyprpaper/commit/6c6e54faa84d2de94d2321eda43a8a669ebf3312.patch";
+      hash = "sha256-Ns7HlUPVgBDIocZRGR6kIW58Mt92kJPQRMSKTvp6Vik=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
     hyprwayland-scanner
+    wayland-scanner
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ad/adrs/package.nix b/pkgs/by-name/ad/adrs/package.nix
index ed12b527ae38..6cd099498947 100644
--- a/pkgs/by-name/ad/adrs/package.nix
+++ b/pkgs/by-name/ad/adrs/package.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "adrs";
-  version = "0.2.8";
+  version = "0.2.9";
 
   src = fetchFromGitHub {
     owner = "joshrotenberg";
     repo = "adrs";
     rev = "v${version}";
-    hash = "sha256-5rvdW2UntseSsKFndrDj9ogH/qYN+KymuOsuqS0/C3M=";
+    hash = "sha256-a1vxo2Zw2fvCJeGaatNqf2h74t7pvWppYS2l2gbCF5k=";
   };
 
-  cargoHash = "sha256-WqsZ+ICfKrackQ5dMs/WvF3inJX+k9LhxAJkXmaVAtY=";
+  cargoHash = "sha256-eVADcCXf6hl9o9pApp3inU7kZAKA3k5mM3+vy7cq5u8=";
 
   meta = {
     description = "Command-line tool for managing Architectural Decision Records";
diff --git a/pkgs/by-name/an/ansel/package.nix b/pkgs/by-name/an/ansel/package.nix
index 73c15042d5ef..1ada6857ea90 100644
--- a/pkgs/by-name/an/ansel/package.nix
+++ b/pkgs/by-name/an/ansel/package.nix
@@ -170,6 +170,11 @@ stdenv.mkDerivation {
     hardcodeZeroVersion = true;
   };
 
+  # cmake can't find the binary itself
+  cmakeFlags = [
+    (lib.cmakeFeature "Xsltproc_BIN" (lib.getExe' libxslt "xsltproc"))
+  ];
+
   meta = {
     description = "Darktable fork minus the bloat plus some design vision";
     homepage = "https://ansel.photos/";
diff --git a/pkgs/by-name/sc/scenefx/package.nix b/pkgs/by-name/sc/scenefx/package.nix
index 6514cec7fc1a..3d688dfeece4 100644
--- a/pkgs/by-name/sc/scenefx/package.nix
+++ b/pkgs/by-name/sc/scenefx/package.nix
@@ -16,6 +16,7 @@
   mesa,
   validatePkgConfig,
   testers,
+  wayland-scanner,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -31,12 +32,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  depsBuildBuild = [ pkg-config ];
+
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     scdoc
     validatePkgConfig
+    wayland-scanner
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/sw/swayidle/package.nix b/pkgs/by-name/sw/swayidle/package.nix
index 0ee08dc7ca1d..35e66bd961a2 100644
--- a/pkgs/by-name/sw/swayidle/package.nix
+++ b/pkgs/by-name/sw/swayidle/package.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   };
 
   strictDeps = true;
+  depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner ];
   buildInputs = [ wayland wayland-protocols ]
                 ++ lib.optionals systemdSupport [ systemd ];
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index f7547715abc9..0d9702caffeb 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "31.4.0";
+  version = "31.5.0";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-qcxsuDk7hcVFsHB/Uj013gTOp9IGfp5cF1BLVbmH9AA=";
+    hash = "sha256-kjydpYLOw1uZGmedemZKey0go8DRmgnUq5nrVM0NfxY=";
   };
 
-  npmDepsHash = "sha256-bhj5q3HEtSdB5LA6IhBCo4XJwc6a3CUrHaV+d1vcj+I=";
+  npmDepsHash = "sha256-PpoSzHQMqdlGfcWvIH34ATcf4HZB+VbA6X7zqzV9xZk=";
 
   nativeBuildInputs = [
     remarshal
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 5ddb26798af5..160b740a72ed 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -102,6 +102,7 @@ let
                                      (toString stdenv.hostPlatform.parsed.cpu.bits)}"
         else if stdenv.hostPlatform.isLinux
           then if stdenv.hostPlatform.isx86_64 then "./Configure linux-x86_64"
+          else if stdenv.hostPlatform.isMicroBlaze then "./Configure linux-latomic"
           else if stdenv.hostPlatform.isMips32 then "./Configure linux-mips32"
           else if stdenv.hostPlatform.isMips64n32 then "./Configure linux-mips64"
           else if stdenv.hostPlatform.isMips64n64 then "./Configure linux64-mips64"
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index a341fed9e6be..1be88f3a6d02 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -2,9 +2,10 @@
 , pkg-config
 , meson, ninja, wayland-scanner
 , python3, wayland
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "wayland-protocols";
   version = "1.36";
 
@@ -13,11 +14,11 @@ stdenv.mkDerivation rec {
   stdenv.hostPlatform.linker == "bfd" && lib.meta.availableOn stdenv.hostPlatform wayland;
 
   src = fetchurl {
-    url = "https://gitlab.freedesktop.org/wayland/${pname}/-/releases/${version}/downloads/${pname}-${version}.tar.xz";
+    url = "https://gitlab.freedesktop.org/wayland/${finalAttrs.pname}/-/releases/${finalAttrs.version}/downloads/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
     hash = "sha256-cf1N4F55+aHKVZ+sMMH4Nl+hA0ZCL5/nlfdNd7nvfpI=";
   };
 
-  postPatch = lib.optionalString doCheck ''
+  postPatch = lib.optionalString finalAttrs.doCheck ''
     patchShebangs tests/
   '';
 
@@ -26,7 +27,7 @@ stdenv.mkDerivation rec {
   nativeCheckInputs = [ python3 ];
   checkInputs = [ wayland ];
 
-  mesonFlags = [ "-Dtests=${lib.boolToString doCheck}" ];
+  mesonFlags = [ "-Dtests=${lib.boolToString finalAttrs.doCheck}" ];
 
   meta = {
     description = "Wayland protocol extensions";
@@ -41,7 +42,11 @@ stdenv.mkDerivation rec {
     license     = lib.licenses.mit; # Expat version
     platforms   = lib.platforms.all;
     maintainers = with lib.maintainers; [ primeos ];
+    pkgConfigModules = [ "wayland-protocols" ];
   };
 
-  passthru.version = version;
-}
+  passthru.version = finalAttrs.version;
+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
+    package = finalAttrs.finalPackage;
+  };
+})
diff --git a/pkgs/development/libraries/wlroots/default.nix b/pkgs/development/libraries/wlroots/default.nix
index 236865bae163..9a8d0b299f19 100644
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@@ -24,6 +24,7 @@
 , libdisplay-info
 , lcms2
 , nixosTests
+, testers
 
 , enableXWayland ? true
 , xwayland ? null
@@ -94,7 +95,12 @@ let
       '';
 
       # Test via TinyWL (the "minimum viable product" Wayland compositor based on wlroots):
-      passthru.tests.tinywl = nixosTests.tinywl;
+      passthru.tests = {
+        tinywl = nixosTests.tinywl;
+        pkg-config = testers.hasPkgConfigModules {
+          package = finalAttrs.finalPackage;
+        };
+      };
 
       meta = {
         description = "Modular Wayland compositor library";
@@ -107,6 +113,11 @@ let
         license = lib.licenses.mit;
         platforms = lib.platforms.linux;
         maintainers = with lib.maintainers; [ primeos synthetica rewine ];
+        pkgConfigModules = [
+          (if lib.versionOlder finalAttrs.version "0.18"
+           then "wlroots"
+           else "wlroots-${lib.versions.majorMinor finalAttrs.version}")
+        ];
       };
     });
 
diff --git a/pkgs/development/python-modules/authlib/default.nix b/pkgs/development/python-modules/authlib/default.nix
index 10596261a5f6..d4c9a525d87f 100644
--- a/pkgs/development/python-modules/authlib/default.nix
+++ b/pkgs/development/python-modules/authlib/default.nix
@@ -12,27 +12,29 @@
   pytestCheckHook,
   pythonOlder,
   requests,
+  setuptools,
   starlette,
   werkzeug,
 }:
 
 buildPythonPackage rec {
   pname = "authlib";
-  version = "1.3.1";
-  format = "setuptools";
+  version = "1.3.2";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "lepture";
     repo = "authlib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5AZca4APi2gLwj/AHtXOPzIFnJkCmK9mDV0bAAvIx8A=";
+    hash = "sha256-gaFnai5QzHhnyn73JB+QzybaolLWC9barBFdnlEMyMU=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     cryptography
-    requests
   ];
 
   nativeCheckInputs = [
@@ -43,6 +45,7 @@ buildPythonPackage rec {
     mock
     pytest-asyncio
     pytestCheckHook
+    requests
     starlette
     werkzeug
   ];
diff --git a/pkgs/development/python-modules/coconut/default.nix b/pkgs/development/python-modules/coconut/default.nix
index e7c8e7072538..5a245fc58f21 100644
--- a/pkgs/development/python-modules/coconut/default.nix
+++ b/pkgs/development/python-modules/coconut/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "coconut";
-  version = "3.1.1";
+  version = "3.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "evhub";
     repo = "coconut";
     rev = "refs/tags/v${version}";
-    hash = "sha256-AqKLSghuyha4wSaC/91bfNna7v8xyw8NLRWBjwu5Rjo=";
+    hash = "sha256-Vd6ZY3PlbPOy63/0/0YJ1U2PpsVdctOoInyKftj//cM=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/flask-security/default.nix b/pkgs/development/python-modules/flask-security/default.nix
index 8cfc0f5996b9..558880850878 100644
--- a/pkgs/development/python-modules/flask-security/default.nix
+++ b/pkgs/development/python-modules/flask-security/default.nix
@@ -46,6 +46,7 @@
   peewee,
   pony,
   pytestCheckHook,
+  requests,
   zxcvbn,
 }:
 
@@ -114,6 +115,7 @@ buildPythonPackage rec {
       peewee
       pony
       pytestCheckHook
+      requests
       zxcvbn
     ]
     ++ optional-dependencies.babel
diff --git a/pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix b/pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix
index 8dbb0ed2a725..24c1fe66d5eb 100644
--- a/pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix
+++ b/pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix
@@ -18,6 +18,7 @@
   responses,
   syrupy,
   toml,
+  nix-update-script,
 }:
 
 buildPythonPackage rec {
@@ -62,6 +63,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "langchain_azure_dynamic_sessions" ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "langchain-azure-dynamic-sessions==(.*)"
+    ];
+  };
+
   meta = {
     description = "Integration package connecting Azure Container Apps dynamic sessions and LangChain";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/partners/azure-dynamic-sessions";
diff --git a/pkgs/development/python-modules/langchain-community/default.nix b/pkgs/development/python-modules/langchain-community/default.nix
index aa6e68471fa5..6bbcd117e480 100644
--- a/pkgs/development/python-modules/langchain-community/default.nix
+++ b/pkgs/development/python-modules/langchain-community/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "langchain-community";
-  version = "0.2.12";
+  version = "0.2.15";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langchain";
     rev = "refs/tags/langchain-community==${version}";
-    hash = "sha256-HsKWGiWA6uKmRQOMw3efXkjwbBuvDHhf5waNvnvBdG4=";
+    hash = "sha256-R1C+tEXCLqYHzQ2zrYaYa6cqJn/UWZEHBMC+WjbdQaQ=";
   };
 
   sourceRoot = "${src.name}/libs/community";
@@ -90,6 +90,7 @@ buildPythonPackage rec {
   disabledTests = [
     # Test require network access
     "test_ovhcloud_embed_documents"
+    "test_yandex"
     # duckdb-engine needs python-wasmer which is not yet available in Python 3.12
     # See https://github.com/NixOS/nixpkgs/pull/326337 and https://github.com/wasmerio/wasmer-python/issues/778
     "test_table_info"
diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index 3012cda9b4fc..2ade17e754a7 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "langchain-core";
-  version = "0.2.33";
+  version = "0.2.37";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langchain";
     rev = "refs/tags/langchain-core==${version}";
-    hash = "sha256-vM3FY9E8PeC8LHP4QCTM1ggFynI+PscF7pv7CMaSZlU=";
+    hash = "sha256-An2ApN0pgCrQjqu9XPFfPyPvWx0+6JnUkGPrcD0/3kg=";
   };
 
   sourceRoot = "${src.name}/libs/core";
@@ -80,7 +80,7 @@ buildPythonPackage rec {
       #!/usr/bin/env nix-shell
       #!nix-shell -i bash -p nix-update
 
-      set -eu -o pipefail
+      set -u -o pipefail +e
       nix-update --commit --version-regex 'langchain-core==(.*)' python3Packages.langchain-core
       nix-update --commit --version-regex 'langchain-text-splitters==(.*)' python3Packages.langchain-text-splitters
       nix-update --commit --version-regex 'langchain==(.*)' python3Packages.langchain
diff --git a/pkgs/development/python-modules/langchain-huggingface/default.nix b/pkgs/development/python-modules/langchain-huggingface/default.nix
index 9c035c50a1d7..774482e5bbcd 100644
--- a/pkgs/development/python-modules/langchain-huggingface/default.nix
+++ b/pkgs/development/python-modules/langchain-huggingface/default.nix
@@ -20,6 +20,7 @@
   responses,
   syrupy,
   toml,
+  nix-update-script,
 }:
 
 buildPythonPackage rec {
@@ -66,6 +67,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "langchain_huggingface" ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "langchain-huggingface==(.*)"
+    ];
+  };
+
   meta = {
     changelog = "https://github.com/langchain-ai/langchain/releases/tag/langchain-huggingface==${version}";
     description = "An integration package connecting Huggingface related classes and LangChain";
diff --git a/pkgs/development/python-modules/langchain-mongodb/default.nix b/pkgs/development/python-modules/langchain-mongodb/default.nix
index e14fe4fb0e47..0b0a6b22fd63 100644
--- a/pkgs/development/python-modules/langchain-mongodb/default.nix
+++ b/pkgs/development/python-modules/langchain-mongodb/default.nix
@@ -18,6 +18,7 @@
   responses,
   syrupy,
   toml,
+  nix-update-script,
 }:
 
 buildPythonPackage rec {
@@ -62,6 +63,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "langchain_mongodb" ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "langchain-mongodb==(.*)"
+    ];
+  };
+
   meta = {
     changelog = "https://github.com/langchain-ai/langchain/releases/tag/langchain-mongodb==${version}";
     description = "Integration package connecting MongoDB and LangChain";
diff --git a/pkgs/development/python-modules/langchain-openai/default.nix b/pkgs/development/python-modules/langchain-openai/default.nix
index c2376cf89d88..e2c61ee82352 100644
--- a/pkgs/development/python-modules/langchain-openai/default.nix
+++ b/pkgs/development/python-modules/langchain-openai/default.nix
@@ -19,6 +19,7 @@
   responses,
   syrupy,
   toml,
+  nix-update-script,
 }:
 
 buildPythonPackage rec {
@@ -84,6 +85,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "langchain_openai" ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "langchain-openai==(.*)"
+    ];
+  };
+
   meta = {
     changelog = "https://github.com/langchain-ai/langchain/releases/tag/langchain-openai==${version}";
     description = "Integration package connecting OpenAI and LangChain";
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index 249e1d74fdd7..4add263f110f 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "langchain";
-  version = "0.2.14";
+  version = "0.2.15";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langchain";
     rev = "refs/tags/langchain==${version}";
-    hash = "sha256-dgXcZu7dtmwlXp8dzHSNfbBnK7RWvrSwqYELm1fczzc=";
+    hash = "sha256-8F6ntFstCTQjQNbE9oiYbpZ7kZ1grcnV3FHAfhFnAzA=";
   };
 
   sourceRoot = "${src.name}/libs/langchain";
diff --git a/pkgs/development/python-modules/mkdocs-material/default.nix b/pkgs/development/python-modules/mkdocs-material/default.nix
index c3d9dd850563..cbf15d0754a3 100644
--- a/pkgs/development/python-modules/mkdocs-material/default.nix
+++ b/pkgs/development/python-modules/mkdocs-material/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-material";
-  version = "9.5.33";
+  version = "9.5.34";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "squidfunk";
     repo = "mkdocs-material";
     rev = "refs/tags/${version}";
-    hash = "sha256-WKZHI4f4l3OKrqNuH+7jiUV6F7impcW2trGgGMQ1I+8=";
+    hash = "sha256-Gozh4/c9IvhgTU87RWSshlXOWQ3sdtxLA8SQuD/JSEg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index 7a0e475a0058..6ec97843fa8f 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -6,17 +6,19 @@
 
   # build-system
   cmake,
-  scikit-build-core,
-  ninja,
   nanobind,
+  ninja,
+  numpy,
+  scikit-build-core,
+
+  # buildInputs
+  opencl-headers,
+  pybind11,
+  darwin,
+  ocl-icd,
 
   # dependencies
-  darwin,
-  numpy,
-  ocl-icd,
-  opencl-headers,
   platformdirs,
-  pybind11,
   pytools,
 
   # tests
@@ -24,7 +26,8 @@
 }:
 
 let
-  os-specific-buildInputs = if stdenv.isDarwin then [ darwin.apple_sdk.frameworks.OpenCL ] else [ ocl-icd ];
+  os-specific-buildInputs =
+    if stdenv.isDarwin then [ darwin.apple_sdk.frameworks.OpenCL ] else [ ocl-icd ];
 in
 buildPythonPackage rec {
   pname = "pyopencl";
@@ -65,25 +68,30 @@ buildPythonPackage rec {
   preCheck = ''
     export HOME=$(mktemp -d)
 
-    # import from $out
-    rm -r pyopencl
+    # https://github.com/NixOS/nixpkgs/issues/255262
+    cd $out
   '';
 
-  # pyopencl._cl.LogicError: clGetPlatformIDs failed: PLATFORM_NOT_FOUND_KHR
+  # https://github.com/inducer/pyopencl/issues/784 Note that these failing
+  # tests are all the tests that are available.
   doCheck = false;
 
   pythonImportsCheck = [
     "pyopencl"
     "pyopencl.array"
     "pyopencl.cltypes"
+    "pyopencl.compyte"
     "pyopencl.elementwise"
     "pyopencl.tools"
   ];
 
-  meta = with lib; {
-    changelog = "https://github.com/inducer/pyopencl/releases/tag/v${version}";
+  meta = {
     description = "Python wrapper for OpenCL";
-    homepage = "https://github.com/inducer/pyopencl";
-    license = licenses.mit;
+    homepage = "https://github.com/pyopencl/pyopencl";
+    changelog = "https://github.com/inducer/pyopencl/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    # ld: symbol(s) not found for architecture arm64
+    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/development/python-modules/python-mistralclient/default.nix b/pkgs/development/python-modules/python-mistralclient/default.nix
new file mode 100644
index 000000000000..6452fe3063e2
--- /dev/null
+++ b/pkgs/development/python-modules/python-mistralclient/default.nix
@@ -0,0 +1,95 @@
+{
+  lib,
+  buildPythonPackage,
+  cliff,
+  fetchFromGitea,
+  keystoneauth1,
+  openstackdocstheme,
+  os-client-config,
+  osc-lib,
+  oslo-i18n,
+  oslo-serialization,
+  oslo-utils,
+  oslotest,
+  osprofiler,
+  pbr,
+  pythonOlder,
+  pyyaml,
+  requests-mock,
+  requests,
+  setuptools,
+  sphinxcontrib-apidoc,
+  sphinxHook,
+  stestr,
+  stevedore,
+  tempest,
+}:
+
+buildPythonPackage rec {
+  pname = "python-mistralclient";
+  version = "5.3.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitea {
+    domain = "opendev.org";
+    owner = "openstack";
+    repo = "python-mistralclient";
+    rev = version;
+    hash = "sha256-Vi56+OlFU2Aj7yJ/cH5y0ZbzPhglTciJcTnkbA0S7Qo=";
+  };
+
+  env.PBR_VERSION = version;
+
+  nativeBuildInputs = [
+    openstackdocstheme
+    sphinxHook
+    sphinxcontrib-apidoc
+  ];
+
+  sphinxBuilders = [ "man" ];
+
+  build-system = [
+    setuptools
+    pbr
+  ];
+
+  dependencies = [
+    cliff
+    keystoneauth1
+    osc-lib
+    oslo-i18n
+    oslo-serialization
+    oslo-utils
+    pbr
+    pyyaml
+    requests
+    stevedore
+  ];
+
+  nativeCheckInputs = [
+    os-client-config
+    oslotest
+    osprofiler
+    requests-mock
+    stestr
+    tempest
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    stestr run
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "mistralclient" ];
+
+  meta = with lib; {
+    description = "OpenStack Mistral Command-line Client";
+    homepage = "https://opendev.org/openstack/python-mistralclient/";
+    license = licenses.asl20;
+    mainProgram = "mistral";
+    maintainers = teams.openstack.members;
+  };
+}
diff --git a/pkgs/development/python-modules/python-openstackclient/default.nix b/pkgs/development/python-modules/python-openstackclient/default.nix
index f78874f9124b..3f3989283f74 100644
--- a/pkgs/development/python-modules/python-openstackclient/default.nix
+++ b/pkgs/development/python-modules/python-openstackclient/default.nix
@@ -13,6 +13,7 @@
   python-ironicclient,
   python-keystoneclient,
   python-manilaclient,
+  python-mistralclient,
   python-neutronclient,
   python-openstackclient,
   requests-mock,
@@ -74,6 +75,7 @@ buildPythonPackage rec {
         python-heatclient
         python-ironicclient
         python-manilaclient
+        python-mistralclient
         python-neutronclient
       ];
     };
diff --git a/pkgs/development/python-modules/weaviate-client/default.nix b/pkgs/development/python-modules/weaviate-client/default.nix
index 0ccf377ad50d..c5af533ab504 100644
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -9,8 +9,8 @@
   httpx,
   pydantic,
   pythonOlder,
+  requests,
   setuptools-scm,
-  tqdm,
   validators,
 }:
 
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     grpcio-tools
     httpx
     pydantic
-    tqdm
+    requests
     validators
   ];
 
diff --git a/pkgs/development/tools/build-managers/rebar3/default.nix b/pkgs/development/tools/build-managers/rebar3/default.nix
index ca64753cedbf..651bc16be06b 100644
--- a/pkgs/development/tools/build-managers/rebar3/default.nix
+++ b/pkgs/development/tools/build-managers/rebar3/default.nix
@@ -3,7 +3,7 @@
   writeScript, common-updater-scripts, coreutils, git, gnused, nix, rebar3-nix }:
 
 let
-  version = "3.23.0";
+  version = "3.24.0";
   owner = "erlang";
   deps = import ./rebar-deps.nix { inherit fetchFromGitHub fetchgit fetchHex; };
   rebar3 = stdenv.mkDerivation rec {
@@ -16,7 +16,7 @@ let
       inherit owner;
       repo = pname;
       rev = version;
-      sha256 = "dLJ1ca7Tlx6Cfk/AyJ0HmAgH9+qRrto/m0GWWUeXNko=";
+      sha256 = "OhzgDipFhscHtRGlfc33ZewBgHgQLa9Zhjby/r1m49A=";
     };
 
     buildInputs = [ erlang ];
diff --git a/pkgs/development/tools/build-managers/rebar3/rebar-deps.nix b/pkgs/development/tools/build-managers/rebar3/rebar-deps.nix
index 21bb25c2e308..7f6be584098d 100644
--- a/pkgs/development/tools/build-managers/rebar3/rebar-deps.nix
+++ b/pkgs/development/tools/build-managers/rebar3/rebar-deps.nix
@@ -1,6 +1,6 @@
 # Generated by rebar3_nix
 let fetchOnly = { src, ... }: src;
-in { builder ? fetchOnly, fetchHex, fetchgit, overrides ? (x: y: { }), ... }:
+in { builder ? fetchOnly, fetchHex, fetchgit, fetchFromGitHub, overrides ? (x: y: { }) }:
 let
   self = packages // (overrides self packages);
   packages = with self; {
diff --git a/pkgs/development/tools/heroku/default.nix b/pkgs/development/tools/heroku/default.nix
index 5535b49a383c..81101b23f54a 100644
--- a/pkgs/development/tools/heroku/default.nix
+++ b/pkgs/development/tools/heroku/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation {
   pname = "heroku";
-  version = "9.1.0";
+  version = "9.2.0";
 
   src = fetchzip {
-    url = "https://cli-assets.heroku.com/versions/9.1.0/e1e5252/heroku-v9.1.0-e1e5252-linux-x64.tar.xz";
-    hash = "sha256-r3X1DN9s1cgFlyivVaMLDgFrMdIJmn4Y+UG1+o4T8t4=";
+    url = "https://cli-assets.heroku.com/versions/9.2.0/2aa043a/heroku-v9.2.0-2aa043a-linux-x64.tar.xz";
+    hash = "sha256-WQM9+yftFSPVTSHX7M05ZQNsk75dIIjZFmq50ZaIDpU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/games/quakespasm/vulkan.nix b/pkgs/games/quakespasm/vulkan.nix
index 458927bfcc88..32428107d850 100644
--- a/pkgs/games/quakespasm/vulkan.nix
+++ b/pkgs/games/quakespasm/vulkan.nix
@@ -14,6 +14,7 @@
   gzip,
   libvorbis,
   libmad,
+  vulkan-headers,
   vulkan-loader,
   moltenvk,
 }:
@@ -46,12 +47,18 @@ stdenv.mkDerivation rec {
     libvorbis
     opusfile
     vulkan-loader
-  ] ++ lib.optional stdenv.isDarwin moltenvk;
+  ] ++ lib.optionals stdenv.isDarwin [
+    moltenvk
+    vulkan-headers
+  ];
 
   buildFlags = [ "DO_USERDIRS=1" ];
 
   env = lib.optionalAttrs stdenv.isDarwin {
-    NIX_CFLAGS_COMPILE = "-Wno-error=unused-but-set-variable";
+    NIX_CFLAGS_COMPILE = lib.concatStringsSep " " [
+      "-Wno-error=unused-but-set-variable"
+      "-Wno-error=implicit-const-int-float-conversion"
+    ];
   };
 
   installPhase = ''
@@ -59,7 +66,7 @@ stdenv.mkDerivation rec {
     cp vkquake "$out/bin"
   '';
 
-  postFixup = ''
+  postFixup = lib.optionalString (!stdenv.isDarwin) ''
     patchelf $out/bin/vkquake \
       --add-rpath ${lib.makeLibraryPath [ vulkan-loader ]}
   '';
diff --git a/pkgs/os-specific/linux/zenmonitor/default.nix b/pkgs/os-specific/linux/zenmonitor/default.nix
index 8101f47c6a24..bf9ddbc5fec5 100644
--- a/pkgs/os-specific/linux/zenmonitor/default.nix
+++ b/pkgs/os-specific/linux/zenmonitor/default.nix
@@ -1,14 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, gtk3, wrapGAppsHook3 }:
+{ lib, stdenv, fetchFromGitea, pkg-config, gtk3, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "zenmonitor";
-  version = "2.0.0";
+  version = "unstable-2024-05-21";
 
-  src = fetchFromGitHub {
-    owner = "Ta180m";
+  src = fetchFromGitea {
+    domain = "git.exozy.me";
+    owner = "a";
     repo = "zenmonitor3";
-    rev = "v${version}";
-    sha256 = "sha256-2EsuSMXnnMg0e0JD1TXJplsi7sOg9em0qqge2WlC6ro=";
+    rev = "a09f0b25d33967fd32f3831304be049b008cdabf";
+    sha256 = "sha256-5N1Hhv2s0cv4Rujw4wFGHyIy7NyKAFThVvAo+xXqSyk=";
   };
 
   buildInputs = [ gtk3 ];
diff --git a/pkgs/servers/geospatial/fit-trackee/default.nix b/pkgs/servers/geospatial/fit-trackee/default.nix
index a668268b2dce..72ddd146a88c 100644
--- a/pkgs/servers/geospatial/fit-trackee/default.nix
+++ b/pkgs/servers/geospatial/fit-trackee/default.nix
@@ -46,6 +46,7 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   pythonRelaxDeps = [
+    "authlib"
     "flask-limiter"
     "gunicorn"
     "pyjwt"
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 811c6b813361..acb3f145c857 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -21,13 +21,13 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2024-08-26T15-33-07Z";
+  version = "2024-08-29T01-40-52Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    hash = "sha256-ZQzHKosJfjtr++jrRvbY9w3x5uXXjw/eNrgcf3+6/2c=";
+    hash = "sha256-J+SwtW5HEUQD7YgHgXpOS4EXFLL2iaiBrIfjS+Q1hrM=";
   };
 
   vendorHash = "sha256-L4mmQyXd/NQkKBHMKCLWs4A9XFKdrpcy+SYx2ExvqQE=";
diff --git a/pkgs/servers/sql/patroni/default.nix b/pkgs/servers/sql/patroni/default.nix
index 619e269f15ff..ad76b6b7e134 100644
--- a/pkgs/servers/sql/patroni/default.nix
+++ b/pkgs/servers/sql/patroni/default.nix
@@ -6,13 +6,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "patroni";
-  version = "3.3.2";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "zalando";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-7Tq7i6AH6tt9Uyx276rVBwvbxxETRyVKnhhTijW02sU=";
+    sha256 = "sha256-C0YjLak/m8ZMCzR5x22zjCATvzs72l56GRccN0Gur+4=";
   };
 
   propagatedBuildInputs = with pythonPackages; [
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 293893dddd56..f76b7a766e77 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -102,11 +102,11 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "276";
+  version = "277";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-Tfl8WZRcarcf59fhUclM6NF6NWO7SgzdLrWEBhk88+Y=";
+    hash = "sha256-ZDW9EzoQG5b0dmydKi850rdf0a8UWKFjrk+toxgBicY=";
   };
 
   outputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ce1cdfdeff14..7a02aa9603db 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22967,6 +22967,7 @@ with pkgs;
   heatclient = with python311Packages; toPythonApplication python-heatclient;
   ironicclient = with python311Packages; toPythonApplication python-ironicclient;
   manilaclient = with python311Packages; toPythonApplication python-manilaclient;
+  mistralclient = with python311Packages; toPythonApplication python-mistralclient;
   swiftclient = with python311Packages; toPythonApplication python-swiftclient;
 
   openvdb = callPackage ../development/libraries/openvdb { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 079d58d61c12..9d0c8f1966ac 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -13008,6 +13008,8 @@ self: super: with self; {
 
   python-mimeparse = callPackage ../development/python-modules/python-mimeparse { };
 
+  python-mistralclient = callPackage ../development/python-modules/python-mistralclient { };
+
   python-mnist = callPackage ../development/python-modules/python-mnist { };
 
   python-mpv-jsonipc = callPackage ../development/python-modules/python-mpv-jsonipc { };