diff --git a/pkgs/applications/editors/emacs/build-support/wrapper.nix b/pkgs/applications/editors/emacs/build-support/wrapper.nix
index 81329808716b5..72bf7a242d2f9 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper.nix
@@ -75,7 +75,7 @@ runCommand
           # well :D.
           local varSlice="$var[*]"
           # ''${..-} to hack around old bash empty array problem
-          case "''${!varSlice-}" in
+          case " ''${!varSlice-} " in
               *" $pkg "*) return 0 ;;
           esac
           unset -v varSlice
diff --git a/pkgs/applications/editors/neovim/utils.nix b/pkgs/applications/editors/neovim/utils.nix
index 946619698dbc4..40f638076447d 100644
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@@ -90,7 +90,7 @@ let
     /* the function you would have passed to lua.withPackages */
     , extraLuaPackages ? (_: [])
     , withNodeJs ? false
-    , withRuby ? true
+    , withRuby ? false
     , vimAlias ? false
     , viAlias ? false
     , configure ? {}
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index afe60212baf77..67ec028804790 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0787";
+  version = "9.1.0905";
 
   outputs = [ "out" "xxd" ];
 
@@ -8,7 +8,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-kV2SaIOUv+ZcDsqBibZZ38gCevVLhejcYtY0TCQVtig=";
+    hash = "sha256-sFsTONGeSocn1M8NZo5LjIhagmq/nR1zrGRN7p86Q4o=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/gis/grass/default.nix b/pkgs/applications/gis/grass/default.nix
index 68bbcb46b5260..69d6e984869d0 100644
--- a/pkgs/applications/gis/grass/default.nix
+++ b/pkgs/applications/gis/grass/default.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
     libsvm
     libtiff
-    (libxml2.override { enableHttp = true; })
+    libxml2
     netcdf
     pdal
     postgresql
diff --git a/pkgs/by-name/al/alsa-lib/package.nix b/pkgs/by-name/al/alsa-lib/package.nix
index 8647c91f3f033..c186b8eb7f37c 100644
--- a/pkgs/by-name/al/alsa-lib/package.nix
+++ b/pkgs/by-name/al/alsa-lib/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.12";
+  version = "1.2.13";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-SGjNkIYnJ52lpjT0aHAWJb6MwlHYQmLH5baiGDka0NI=";
+    hash = "sha256-jE/zdVPL6JYY4Yfkx3n3GpuyqLJ7kfh+1AmHzJIz2PY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ca/cairo/package.nix b/pkgs/by-name/ca/cairo/package.nix
index 8ed46ae3efb50..8507d9f286670 100644
--- a/pkgs/by-name/ca/cairo/package.nix
+++ b/pkgs/by-name/ca/cairo/package.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gtk-doc, meson, ninja, pkg-config, python3
+{ lib, stdenv, fetchurl, fetchpatch, gtk-doc, meson, ninja, pkg-config, python3
 , docbook_xsl, fontconfig, freetype, libpng, pixman, zlib
 , x11Support? !stdenv.hostPlatform.isDarwin || true, libXext, libXrender
 , gobjectSupport ? true, glib
@@ -41,6 +41,16 @@ in {
     Carbon
   ]);
 
+  patches = [
+    # Pull upstream fix to fix "out of memory" errors:
+    #   https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/595
+    (fetchpatch {
+      name = "fix-oom.patch";
+      url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/b9eed915f9a67380e7ef9d8746656455c43f67e2.patch";
+      hash = "sha256-iWYxMVeNpseClSTf7BfU9GBe+tJWc+DUJWTWE5MnGh4=";
+    })
+  ];
+
   propagatedBuildInputs = [ fontconfig freetype pixman libpng zlib ]
     ++ optionals x11Support [ libXext libXrender ]
     ++ optionals xcbSupport [ libxcb ]
diff --git a/pkgs/by-name/de/desktop-file-utils/package.nix b/pkgs/by-name/de/desktop-file-utils/package.nix
index 3ad645e5068ed..387a43b5ae893 100644
--- a/pkgs/by-name/de/desktop-file-utils/package.nix
+++ b/pkgs/by-name/de/desktop-file-utils/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "desktop-file-utils";
-  version = "0.27";
+  version = "0.28";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/desktop-file-utils/releases/desktop-file-utils-${version}.tar.xz";
-    hash = "sha256-oIF985zjhbZiGIBAfFbx8pgWjAQMIDLO34jVt2r/6DY=";
+    hash = "sha256-RAHU4jHYQsLegkI5WnSjlcpGjNlvX2ENgi3zNZSJinA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix
index c2c1109e2e06f..760ec046a93a6 100644
--- a/pkgs/by-name/el/elfutils/package.nix
+++ b/pkgs/by-name/el/elfutils/package.nix
@@ -1,18 +1,18 @@
 { lib, stdenv, fetchurl, fetchpatch, pkg-config, musl-fts
 , musl-obstack, m4, zlib, zstd, bzip2, bison, flex, gettext, xz, setupDebugInfoDirs
 , argp-standalone
-, enableDebuginfod ? lib.meta.availableOn stdenv.hostPlatform libarchive, sqlite, curl, libmicrohttpd, libarchive
+, enableDebuginfod ? lib.meta.availableOn stdenv.hostPlatform libarchive, sqlite, curl, json_c, libmicrohttpd, libarchive
 , gitUpdater, autoreconfHook
 }:
 
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation rec {
   pname = "elfutils";
-  version = "0.191";
+  version = "0.192";
 
   src = fetchurl {
     url = "https://sourceware.org/elfutils/ftp/${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-33bbcTZtHXCDZfx6bGDKSDmPFDZ+sriVTvyIlxR62HE=";
+    hash = "sha256-YWCZvq4kq6Efm2PYbKbMjVZtlouAI5EzTJHfVOq0FrQ=";
   };
 
   patches = [
@@ -66,6 +66,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals enableDebuginfod [
     sqlite
     curl
+    json_c
     libmicrohttpd
     libarchive
   ];
diff --git a/pkgs/by-name/gh/ghostscript/package.nix b/pkgs/by-name/gh/ghostscript/package.nix
index c9557858a161b..ccf1daa72ffb7 100644
--- a/pkgs/by-name/gh/ghostscript/package.nix
+++ b/pkgs/by-name/gh/ghostscript/package.nix
@@ -2,6 +2,7 @@
 , stdenv
 , lib
 , fetchurl
+, fetchpatch2
 , pkg-config
 , zlib
 , expat
@@ -72,6 +73,12 @@ stdenv.mkDerivation rec {
   patches = [
     ./urw-font-files.patch
     ./doc-no-ref.diff
+
+    # Support SOURCE_DATE_EPOCH for reproducible builds
+    (fetchpatch2 {
+      url = "https://salsa.debian.org/debian/ghostscript/-/raw/01e895fea033cc35054d1b68010de9818fa4a8fc/debian/patches/2010_add_build_timestamp_setting.patch";
+      hash = "sha256-XTKkFKzMR2QpcS1YqoxzJnyuGk/l/Y2jdevsmbMtCXA=";
+    })
   ];
 
   outputs = [ "out" "man" "doc" "fonts" ];
diff --git a/pkgs/by-name/gm/gmt/package.nix b/pkgs/by-name/gm/gmt/package.nix
index 528d21598e21b..4fe72aebc230c 100644
--- a/pkgs/by-name/gm/gmt/package.nix
+++ b/pkgs/by-name/gm/gmt/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ cmake ];
 
   env = {
-    NIX_LDFLAGS = "-lxml2 -L${lib.getLib (libxml2.override { enableHttp = true; })}/lib";
+    NIX_LDFLAGS = "-lxml2 -L${lib.getLib libxml2}/lib";
     NIX_CFLAGS_COMPILE =
       lib.optionalString stdenv.cc.isClang "-Wno-implicit-function-declaration "
       + lib.optionalString (
diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index bfe499f8e2f2b..6f464d1c484e0 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.389";
+  version = "0.390";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-w8rN9T0GwElkLmNLzROQtd7CdY0DcuCRUWxFtA2ekJc=";
+    hash = "sha256-DexmtBKe1rrmvHMVk8P20hBLfdP1x6CWx/F1s4lDnK4=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/by-name/js/json_c/package.nix b/pkgs/by-name/js/json_c/package.nix
index 943712e2b8dba..ca8d7e178336f 100644
--- a/pkgs/by-name/js/json_c/package.nix
+++ b/pkgs/by-name/js/json_c/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "json-c";
-  version = "0.17";
+  version = "0.18";
 
   src = fetchFromGitHub {
     owner = "json-c";
     repo = "json-c";
-    rev = "json-c-0.17-20230812";
-    hash = "sha256-R5KIJ0xVgGqffjzJaZvvvhAneJ+ZBuanyF6KYTTxb58=";
+    rev = "json-c-0.18-20240915";
+    hash = "sha256-UyMXr8Vc6kDOx1/lD2YKPiHdaTotXAF9ak0yQuwrSUA=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/by-name/li/libaom/package.nix b/pkgs/by-name/li/libaom/package.nix
index 8b8362d6c1934..fd57e8f00e28d 100644
--- a/pkgs/by-name/li/libaom/package.nix
+++ b/pkgs/by-name/li/libaom/package.nix
@@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchzip {
     url = "https://aomedia.googlesource.com/aom/+archive/v${version}.tar.gz";
-    hash = "sha256-7xtIT8zalh1XJfVKWeC/+jAkhOuFHw6Q0+c2YMtDark=";
+    hash = "sha256-SqXDeIApj7XEK2cChenN9pun5eNm4Q+Smpp76xHwMMU=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/li/libjxl/package.nix b/pkgs/by-name/li/libjxl/package.nix
index 6211023c59d8c..02f8f5cf288a5 100644
--- a/pkgs/by-name/li/libjxl/package.nix
+++ b/pkgs/by-name/li/libjxl/package.nix
@@ -27,7 +27,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libjxl";
-  version = "0.11.0";
+  version = "0.11.1";
 
   outputs = [ "out" "dev" ];
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     owner = "libjxl";
     repo = "libjxl";
     rev = "v${version}";
-    hash = "sha256-lBc0zP+f44YadwOU9+I+YYWzTrAg7FSfF3IQuh4LjM4=";
+    hash = "sha256-ORwhKOp5Nog366UkLbuWpjz/6sJhxUO6+SkoJGH+3fE=";
     # There are various submodules in `third_party/`.
     fetchSubmodules = true;
   };
diff --git a/pkgs/by-name/li/libmysofa/package.nix b/pkgs/by-name/li/libmysofa/package.nix
index 5125d4c76ebac..1ad03de8ee23a 100644
--- a/pkgs/by-name/li/libmysofa/package.nix
+++ b/pkgs/by-name/li/libmysofa/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmysofa";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "hoene";
     repo = "libmysofa";
     rev = "v${version}";
-    hash = "sha256-eXMGwa6lOtKoUCcHR9BM2S3NWAZkGyZzF3FAjYaWTvg=";
+    hash = "sha256-jvib1hGPJEY2w/KjlD7iTtRy1s8LFG+Qhb2d6xdpUyc=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/by-name/li/librist/darwin.patch b/pkgs/by-name/li/librist/darwin.patch
deleted file mode 100644
index 6a5cc8459a367..0000000000000
--- a/pkgs/by-name/li/librist/darwin.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/tools/srp_shared.c b/tools/srp_shared.c
-index f782126..23e82a5 100644
---- a/tools/srp_shared.c
-+++ b/tools/srp_shared.c
-@@ -173,7 +173,11 @@ void user_verifier_lookup(char * username,
- 	if (stat(srpfile, &buf) != 0)
- 		return;
- 
-+#if defined(__APPLE__)
-+	*generation = ((uint64_t)buf.st_mtimespec.tv_sec << 32) | buf.st_mtimespec.tv_nsec;
-+#else
- 	*generation = ((uint64_t)buf.st_mtim.tv_sec << 32) | buf.st_mtim.tv_nsec;
-+#endif
- #endif
- 
- 	if (!lookup_data || !hashversion)
diff --git a/pkgs/by-name/li/librist/musl.patch b/pkgs/by-name/li/librist/musl.patch
deleted file mode 100644
index 95f432549777c..0000000000000
--- a/pkgs/by-name/li/librist/musl.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/test/rist/unit/srp_examples.c b/test/rist/unit/srp_examples.c
-index 1c5193d..6f835b5 100644
---- a/test/rist/unit/srp_examples.c
-+++ b/test/rist/unit/srp_examples.c
-@@ -16,6 +16,11 @@
- #define DEBUG_USE_EXAMPLE_CONSTANTS 1
- 
- #if HAVE_MBEDTLS
-+// musl's sched.h includes a prototype for calloc, so we need to make
-+// sure it's already been included before we redefine it to something
-+// that won't expand to a valid prototype.
-+#include <sched.h>
-+
- #define malloc(size) _test_malloc(size, __FILE__, __LINE__)
- #define calloc(num, size) _test_calloc(num, size, __FILE__, __LINE__)
- #define free(obj) _test_free(obj, __FILE__, __LINE__)
diff --git a/pkgs/by-name/li/librist/package.nix b/pkgs/by-name/li/librist/package.nix
index a98400a89d356..aeca889715133 100644
--- a/pkgs/by-name/li/librist/package.nix
+++ b/pkgs/by-name/li/librist/package.nix
@@ -11,23 +11,16 @@
 
 stdenv.mkDerivation rec {
   pname = "librist";
-  version = "0.2.10";
+  version = "0.2.11";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "rist";
     repo = "librist";
     rev = "v${version}";
-    hash = "sha256-8N4wQXxjNZuNGx/c7WVAV5QS48Bff5G3t11UkihT+K0=";
+    hash = "sha256-xWqyQl3peB/ENReMcDHzIdKXXCYOJYbhhG8tcSh36dY=";
   };
 
-  patches = [
-    # https://github.com/NixOS/nixpkgs/pull/257020
-    ./darwin.patch
-    # https://code.videolan.org/rist/librist/-/merge_requests/257
-    ./musl.patch
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/by-name/li/libwacom/package.nix b/pkgs/by-name/li/libwacom/package.nix
index 50d2451e94299..a07feef39bb72 100644
--- a/pkgs/by-name/li/libwacom/package.nix
+++ b/pkgs/by-name/li/libwacom/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libwacom";
-  version = "2.13.0";
+  version = "2.14.0";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${finalAttrs.version}";
-    hash = "sha256-OJQe0GdndgpvW4aJdgSKWw+u3ng1pn3FgdcA81jfmkQ=";
+    hash = "sha256-tJwLcHXXg4tFk7qKQyt+6dcDo8Qykqjn13MfXMoGvKc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/li/libzip/package.nix b/pkgs/by-name/li/libzip/package.nix
index 759edc288e473..f27dd8188592d 100644
--- a/pkgs/by-name/li/libzip/package.nix
+++ b/pkgs/by-name/li/libzip/package.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libzip";
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchurl {
     url = "https://libzip.org/download/libzip-${finalAttrs.version}.tar.gz";
-    hash = "sha256-wOb6UqYroR79MCYikNxpcJR67zLgzClO5Q6QBc6sCSo=";
+    hash = "sha256-aypDg3AF4cI/3+5TK3j4BoY+QS0gibnEK0mrCMvNdmU=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/by-name/ma/mapserver/package.nix b/pkgs/by-name/ma/mapserver/package.nix
index 43996b4c92d58..41218308567d4 100644
--- a/pkgs/by-name/ma/mapserver/package.nix
+++ b/pkgs/by-name/ma/mapserver/package.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     libjpeg
     libpng
     librsvg
-    (libxml2.override { enableHttp = true; })
+    libxml2
     postgresql
     proj
     protobufc
diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 482861c75067e..c52bbe75e7fc1 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.7.4";
+  version = "1.7.8";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-Zephf4mB3RI5YIAOIjfqIfgVANefkH63OQoPPMe417E=";
+    hash = "sha256-2uf49Rz6x0+Mb9EKjyAIlfdmfZ3qRVFLUgwW02SDE48=";
   };
 
-  cargoHash = "sha256-yLKt/Xml7ig6QG3T5Qn39tW7U5NIN1hSOaLiSRMiy5I=";
+  cargoHash = "sha256-SXomWGP7xCheIW2n1QNavq28EVWOpwh9AsCYPPUMm14=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/by-name/mu/mupdf/package.nix b/pkgs/by-name/mu/mupdf/package.nix
index 25d8686b50d9d..761ff48b4a77a 100644
--- a/pkgs/by-name/mu/mupdf/package.nix
+++ b/pkgs/by-name/mu/mupdf/package.nix
@@ -61,12 +61,12 @@ let
 in
 
 stdenv.mkDerivation rec {
-  version = "1.24.9";
+  version = "1.24.11";
   pname = "mupdf";
 
   src = fetchurl {
     url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    hash = "sha256-C0RqoO7MEU6ZadzNcMl4k1j8y2WJqB1HDclBoIdNqYo=";
+    hash = "sha256-GRInuWd19nBe99lVEYdRGTK1GSc7NFNaMxSRz32YFj8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/pd/pdal/package.nix b/pkgs/by-name/pd/pdal/package.nix
index c4d3d758cbcea..d76d35d4f3422 100644
--- a/pkgs/by-name/pd/pdal/package.nix
+++ b/pkgs/by-name/pd/pdal/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     laszip
     libgeotiff
     libtiff
-    (libxml2.override { enableHttp = true; })
+    libxml2
     openscenegraph
     postgresql
     proj
diff --git a/pkgs/by-name/pi/pixman/package.nix b/pkgs/by-name/pi/pixman/package.nix
index 0678539b79a3b..a78fafad92756 100644
--- a/pkgs/by-name/pi/pixman/package.nix
+++ b/pkgs/by-name/pi/pixman/package.nix
@@ -1,37 +1,38 @@
-{ lib
-, stdenv
-, fetchurl
-, meson
-, ninja
-, pkg-config
-, libpng
-, glib /*just passthru*/
+{
+  lib,
+  stdenv,
+  fetchurl,
+  meson,
+  ninja,
+  pkg-config,
+  libpng,
+  glib, # just passthru
 
-# for passthru.tests
-, cairo
-, qemu
-, scribus
-, tigervnc
-, wlroots_0_17
-, wlroots_0_18
-, xwayland
+  # for passthru.tests
+  cairo,
+  qemu,
+  scribus,
+  tigervnc,
+  wlroots_0_17,
+  wlroots_0_18,
+  xwayland,
 
-, gitUpdater
-, testers
+  gitUpdater,
+  testers,
 
-, __flattenIncludeHackHook
+  __flattenIncludeHackHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pixman";
-  version = "0.43.4";
+  version = "0.44.2";
 
   src = fetchurl {
     urls = with finalAttrs; [
       "mirror://xorg/individual/lib/${pname}-${version}.tar.gz"
       "https://cairographics.org/releases/${pname}-${version}.tar.gz"
     ];
-    hash = "sha256-oGJNuQGAx923n8epFRCT3DfGRtjDjT8jL3Z89kuFoiY=";
+    hash = "sha256-Y0kGHOGjOKtpUrkhlNGwN3RyJEII1H/yW++G/HGXNGY=";
   };
 
   # Raise test timeout, 120s can be slightly exceeded on slower hardware
@@ -42,7 +43,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  nativeBuildInputs = [ meson ninja pkg-config __flattenIncludeHackHook ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    __flattenIncludeHackHook
+  ];
 
   buildInputs = [ libpng ];
 
@@ -50,11 +56,6 @@ stdenv.mkDerivation (finalAttrs: {
   # architectures and requires used to disable them:
   #   https://gitlab.freedesktop.org/pixman/pixman/-/issues/88
   mesonAutoFeatures = "auto";
-  mesonFlags = [
-    "-Diwmmxt=disabled"
-  ]
-  # Disable until https://gitlab.freedesktop.org/pixman/pixman/-/issues/46 is resolved
-  ++ lib.optional (stdenv.hostPlatform.isAarch64 && !stdenv.cc.isGNU) "-Da64-neon=disabled";
 
   preConfigure = ''
     # https://gitlab.freedesktop.org/pixman/pixman/-/issues/62
@@ -67,7 +68,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     tests = {
-      inherit cairo qemu scribus tigervnc wlroots_0_17 wlroots_0_18 xwayland;
+      inherit
+        cairo
+        qemu
+        scribus
+        tigervnc
+        wlroots_0_17
+        wlroots_0_18
+        xwayland
+        ;
       pkg-config = testers.hasPkgConfigModules {
         package = finalAttrs.finalPackage;
       };
diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix
index ef24d57651333..dd88ffdd70ce5 100644
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2024-10-25";
+  version = "0-unstable-2024-12-06";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "435e07efb28973ea116592dc2291b1f8c27080aa";
-    hash = "sha256-nLuZVgPHNnxOT3GcGz6TEbHkiNgVU5f2uWcgCfr7tZ8=";
+    rev = "d94154e5222aa000f70def82b9711df88b4612d9";
+    hash = "sha256-Cdrut2plOpItOdvgdYl7B7f9FqfVRzOmseUs9XAFnfM=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/ra/rav1e/package.nix b/pkgs/by-name/ra/rav1e/package.nix
index dccb2d01a6b9a..523b8e1de6a04 100644
--- a/pkgs/by-name/ra/rav1e/package.nix
+++ b/pkgs/by-name/ra/rav1e/package.nix
@@ -4,11 +4,8 @@
   stdenv,
   rustPlatform,
   fetchCrate,
-  pkg-config,
   cargo-c,
   nasm,
-  libgit2,
-  zlib,
   nix-update-script,
   testers,
   rav1e,
@@ -23,30 +20,26 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-Db7qb7HBAy6lniIiN07iEzURmbfNtuhmgJRv7OUagUM=";
   };
 
-  # update built to be able to use the system libgit2
-  cargoPatches = [ ./update-built.diff ];
-  cargoHash = "sha256-Ud9Vw31y8nLo0aC3j7XY1+mN/pRvH9gJ0uIq73hKy3Y=";
-
-  depsBuildBuild = [
-    pkg-config
-    libgit2
-    zlib
-  ];
+  cargoHash = "sha256-VyQ6n2kIJ7OjK6Xlf0T0GNsBvgESRETzKZDZzAn8ZuY=";
 
   nativeBuildInputs = [
     cargo-c
     nasm
   ];
 
-  env.LIBGIT2_NO_VENDOR = 1;
+  postPatch =
+    ''
+      # remove feature that requires libgit2 and is only used to print a version string
+      substituteInPlace Cargo.toml --replace-fail '"git_version",' ""
+    ''
+    + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) ''
+      # Darwin uses `llvm-strip`, which results in link errors when using `-x` to strip the asm library
+      # and linking it with cctools ld64.
+      substituteInPlace build.rs --replace-fail '.arg("-x")' '.arg("-S")'
 
-  # Darwin uses `llvm-strip`, which results in link errors when using `-x` to strip the asm library
-  # and linking it with cctools ld64.
-  postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) ''
-    substituteInPlace build.rs --replace-fail '.arg("-x")' '.arg("-S")'
-    # Thin LTO doesn’t appear to work with Rust 1.79. rav1e fail to build when building fern.
-    substituteInPlace Cargo.toml --replace-fail 'lto = "thin"' 'lto = "fat"'
-  '';
+      # Thin LTO doesn’t appear to work with Rust 1.79. rav1e fail to build when building fern.
+      substituteInPlace Cargo.toml --replace-fail 'lto = "thin"' 'lto = "fat"'
+    '';
 
   checkType = "debug";
 
diff --git a/pkgs/by-name/ra/rav1e/update-built.diff b/pkgs/by-name/ra/rav1e/update-built.diff
deleted file mode 100644
index 3b2a027545d96..0000000000000
--- a/pkgs/by-name/ra/rav1e/update-built.diff
+++ /dev/null
@@ -1,40 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 6825377..8512eba 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -242,9 +242,9 @@ dependencies = [
- 
- [[package]]
- name = "built"
--version = "0.7.1"
-+version = "0.7.5"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "38d17f4d6e4dc36d1a02fbedc2753a096848e7c1b0772f7654eab8e2c927dd53"
-+checksum = "c360505aed52b7ec96a3636c3f039d99103c37d1d9b4f7a8c743d3ea9ffcd03b"
- dependencies = [
-  "git2",
- ]
-@@ -633,9 +633,9 @@ checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
- 
- [[package]]
- name = "git2"
--version = "0.18.1"
-+version = "0.19.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "fbf97ba92db08df386e10c8ede66a2a0369bd277090afd8710e19e38de9ec0cd"
-+checksum = "b903b73e45dc0c6c596f2d37eccece7c1c8bb6e4407b001096387c63d0d93724"
- dependencies = [
-  "bitflags 2.4.1",
-  "libc",
-@@ -845,9 +845,9 @@ dependencies = [
- 
- [[package]]
- name = "libgit2-sys"
--version = "0.16.1+1.7.1"
-+version = "0.17.0+1.8.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "f2a2bb3680b094add03bb3732ec520ece34da31a8cd2d633d1389d0f0fb60d0c"
-+checksum = "10472326a8a6477c3c20a64547b0059e4b0d086869eee31e6d7da728a8eb7224"
- dependencies = [
-  "cc",
-  "libc",
diff --git a/pkgs/by-name/re/re2c/package.nix b/pkgs/by-name/re/re2c/package.nix
index f06a2b5424ef1..22c1a9c3b286c 100644
--- a/pkgs/by-name/re/re2c/package.nix
+++ b/pkgs/by-name/re/re2c/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re2c";
-  version = "3.1";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner  = "skvadrik";
     repo   = "re2c";
     rev    = version;
-    sha256 = "sha256-7zZdLby7HdNoURgdkg+xnlp6VDCACcyGCTtjM43OLd4=";
+    sha256 = "sha256-fw+Dnq5ir5EAz3/GguIVUxe2K5fjQ9eLhpnlCIcw8js=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sr/srt/package.nix b/pkgs/by-name/sr/srt/package.nix
index be81970413b84..33ee08eeae768 100644
--- a/pkgs/by-name/sr/srt/package.nix
+++ b/pkgs/by-name/sr/srt/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "srt";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${version}";
-    sha256 = "sha256-HmfbBPyR+z5d9/XBvNhosk8pSSPToNtM+V0hEyb2G2w=";
+    sha256 = "sha256-NLy9GuP4OT/kKAIIDXSHtsmaBzXRuFohFM/aM+46cao=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/sw/swtpm/package.nix b/pkgs/by-name/sw/swtpm/package.nix
index 0332de516e8d0..2120889516174 100644
--- a/pkgs/by-name/sw/swtpm/package.nix
+++ b/pkgs/by-name/sw/swtpm/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "swtpm";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "stefanberger";
     repo = "swtpm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-48/BOzGPoKr/BGEXFo3FXWr6ZoPB+ixZIvv78g6L294=";
+    hash = "sha256-IeFrS67qStklaTgM0d3F8Xt8upm2kEawT0ZPFD7JKnk=";
   };
 
   patches = [
@@ -97,6 +97,10 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace tests/test_swtpm_setup_create_cert --replace \
         '$CERTTOOL' \
         'LC_ALL=C.UTF-8 $CERTTOOL'
+
+    substituteInPlace tests/test_tpm2_swtpm_cert --replace \
+        'certtool' \
+        'LC_ALL=C.UTF-8 certtool'
   '';
 
   doCheck = true;
diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index 6bb4dbe5f8323..8b52ebd9dfc2b 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -1,9 +1,10 @@
 { stdenv
 , lib
-, fetchurl
+, fetchFromGitHub
 , openssl
 , nettle
 , expat
+, flex
 , libevent
 , libsodium
 , protobufc
@@ -50,11 +51,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.21.1";
+  version = "1.22.0";
 
-  src = fetchurl {
-    url = "https://nlnetlabs.nl/downloads/unbound/unbound-${finalAttrs.version}.tar.gz";
-    hash = "sha256-MDbSPCNiKzbTyH6UMRe97BrI+Bljbrl42AZBaw+p6kY=";
+  src = fetchFromGitHub {
+    owner = "NLnetLabs";
+    repo = "unbound";
+    rev = "refs/tags/release-${finalAttrs.version}";
+    hash = "sha256-CFsd8tdFL+JbxmDZoWdStvWcs9azSaLtMG8Ih5oXE/A=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
@@ -62,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs =
     lib.optionals withMakeWrapper [ makeWrapper ]
     ++ lib.optionals withDNSTAP [ protobufc ]
-    ++ [ pkg-config ]
+    ++ [ pkg-config flex ]
     ++ lib.optionals withPythonModule [ swig ];
 
   buildInputs = [ openssl nettle expat libevent ]
diff --git a/pkgs/by-name/wa/waf/package.nix b/pkgs/by-name/wa/waf/package.nix
index bb3c4df40ef19..77423091ed7a2 100644
--- a/pkgs/by-name/wa/waf/package.nix
+++ b/pkgs/by-name/wa/waf/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waf";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "waf-${finalAttrs.version}";
-    hash = "sha256-7ujlE0brLFmET7tAy0/RTdDORUyr6keZ3OjvxBOC/BI=";
+    hash = "sha256-Dt8eo/rY6JRu6teTQM0y7bjMzQjOv3WSL6bcF9g0B8o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zv/zvbi/package.nix b/pkgs/by-name/zv/zvbi/package.nix
index 97c4c54c7dab7..d645c12600173 100644
--- a/pkgs/by-name/zv/zvbi/package.nix
+++ b/pkgs/by-name/zv/zvbi/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zvbi";
-  version = "0.2.42-unstable-2024-11-29";
+  version = "0.2.43";
 
   src = fetchFromGitHub {
     owner = "zapping-vbi";
     repo = "zvbi";
-    rev = "f3aca6cb9eaf2b4f1fd28e94563db4773b98dfca";
-    hash = "sha256-SG+MXauK4bZ1IMxklVt5R2y864Zs3MjGtpfN4np7xiE=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Pj37lJSa1spjC/xrf+yu/ecFCuajb8ingszp6ib2WC8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/2001-Mark-problematic-tests.patch b/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/2001-Mark-problematic-tests.patch
index dc1d1e2083c00..7f2a4daab5656 100644
--- a/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/2001-Mark-problematic-tests.patch
+++ b/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/2001-Mark-problematic-tests.patch
@@ -108,7 +108,7 @@ index fc498985e..b5d204d0d 100755
      if [ $ERRORS -ne 0 ]; then
 -      FAILURES_FILES="${FAILURES_FILES}  ${_TESTNAME}\n"
 -      ((FAILURES+=$ERRORS))
-+      if [[ $ERROR_EXCEPTIONS == *" $_TESTNAME "* ]]; then
++      if [[ " $ERROR_EXCEPTIONS " == *" $_TESTNAME "* ]]; then
 +        EXCEPTED_FAILURES_FILES="${EXCEPTED_FAILURES_FILES}  ${_TESTNAME}\n"
 +        ((EXCEPTED_FAILURES+=$ERRORS))
 +      else
@@ -117,7 +117,7 @@ index fc498985e..b5d204d0d 100755
 +      fi
      elif [ $WARNINGS -ne 0 ]; then
 -      if [[ $EXCEPTIONS == *$_TESTNAME* ]]; then
-+      if [[ $EXCEPTIONS == *" $_TESTNAME "* ]]; then
++      if [[ " $EXCEPTIONS " == *" $_TESTNAME "* ]]; then
          EXCEPTED_FILES="${EXCEPTED_FILES}  ${_TESTNAME}\n"
          ((EXCEPTED+=$WARNINGS))
        else
@@ -125,7 +125,7 @@ index fc498985e..b5d204d0d 100755
          ((FATAL_WARNINGS+=$WARNINGS))
        fi
 -    elif [[ $EXCEPTIONS == *$_TESTNAME* ]]; then
-+    elif [[ $ERROR_EXCEPTIONS == *" $_TESTNAME "* || $EXCEPTIONS == *" $_TESTNAME "* ]]; then
++    elif [[ " $ERROR_EXCEPTIONS " == *" $_TESTNAME "* || " $EXCEPTIONS " == *" $_TESTNAME "* ]]; then
        WOOT_FILES="${WOOT_FILES}  ${_TESTNAME}\n"
      fi
  done
diff --git a/pkgs/development/compilers/go/1.23.nix b/pkgs/development/compilers/go/1.23.nix
index 14a80eae8046d..89c966ae41d02 100644
--- a/pkgs/development/compilers/go/1.23.nix
+++ b/pkgs/development/compilers/go/1.23.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.23.3";
+  version = "1.23.4";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-jWp3MySHVXxq+iQhExtQ+D20rjxXnDvHLmcO4faWhZk=";
+    hash = "sha256-rTRaxCHpCBQpOpaZzKGd1SOCUcP2h5gLvK4oSVsmNTE=";
   };
 
   strictDeps = true;
@@ -177,7 +177,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = with lib; {
-    changelog = "https://go.dev/doc/devel/release#go${lib.versions.majorMinor finalAttrs.version}";
+    changelog = "https://go.dev/doc/devel/release#go${finalAttrs.version}";
     description = "Go Programming language";
     homepage = "https://go.dev/";
     license = licenses.bsd3;
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 5971dd73b4d32..2da2b6d877945 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -29,7 +29,7 @@ let
     "16.0.6".officialRelease.sha256 = "sha256-fspqSReX+VD+Nl/Cfq+tDcdPtnQPV1IRopNDfd5VtUs=";
     "17.0.6".officialRelease.sha256 = "sha256-8MEDLLhocshmxoEBRSKlJ/GzJ8nfuzQ8qn0X/vLA+ag=";
     "18.1.8".officialRelease.sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE=";
-    "19.1.4".officialRelease.sha256 = "sha256-qi1a/AWxF5j+4O38VQ2R/tvnToVAlMjgv9SP0PNWs3g=";
+    "19.1.5".officialRelease.sha256 = "sha256-QxQL4QwUH6e5HWpBvI8yIbZYBNwqqRsZqPH0w/JSiHQ=";
     "20.0.0-git".gitRelease = {
       rev = "0e8555d4dbfdfeddc01dc2ecf9a9b6e804f7b645";
       rev-version = "20.0.0-unstable-2024-10-07";
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index df3b8f729f7f9..0a6343e9bd943 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -124,7 +124,10 @@ rec {
       patchShebangs ./install.sh
       ./install.sh --prefix=$out \
         --components=cargo
-
+    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      install_name_tool -change "/usr/lib/libcurl.4.dylib" \
+        "${curl.out}/lib/libcurl.4.dylib" "$out/bin/cargo"
+    '' + ''
       wrapProgram "$out/bin/cargo" \
         --suffix PATH : "${rustc}/bin"
     '';
diff --git a/pkgs/development/interpreters/python/cpython/3.12/CVE-2024-12254.patch b/pkgs/development/interpreters/python/cpython/3.12/CVE-2024-12254.patch
new file mode 100644
index 0000000000000..1a19a41d8d4ab
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.12/CVE-2024-12254.patch
@@ -0,0 +1,45 @@
+From e991ac8f2037d78140e417cc9a9486223eb3e786 Mon Sep 17 00:00:00 2001
+From: "J. Nick Koston" <nick@koston.org>
+Date: Thu, 5 Dec 2024 22:33:03 -0600
+Subject: [PATCH] gh-127655: Ensure `_SelectorSocketTransport.writelines`
+ pauses the protocol if needed (#127656)
+
+Ensure `_SelectorSocketTransport.writelines` pauses the protocol if it reaches the high water mark as needed.
+
+Co-authored-by: Kumar Aditya <kumaraditya@python.org>
+
+diff --git a/Lib/asyncio/selector_events.py b/Lib/asyncio/selector_events.py
+index f94bf10b4225e7..f1ab9b12d69a5d 100644
+--- a/Lib/asyncio/selector_events.py
++++ b/Lib/asyncio/selector_events.py
+@@ -1175,6 +1175,7 @@ def writelines(self, list_of_data):
+         # If the entire buffer couldn't be written, register a write handler
+         if self._buffer:
+             self._loop._add_writer(self._sock_fd, self._write_ready)
++            self._maybe_pause_protocol()
+ 
+     def can_write_eof(self):
+         return True
+diff --git a/Lib/test/test_asyncio/test_selector_events.py b/Lib/test/test_asyncio/test_selector_events.py
+index aaeda33dd0c677..efca30f37414f9 100644
+--- a/Lib/test/test_asyncio/test_selector_events.py
++++ b/Lib/test/test_asyncio/test_selector_events.py
+@@ -805,6 +805,18 @@ def test_writelines_send_partial(self):
+         self.assertTrue(self.sock.send.called)
+         self.assertTrue(self.loop.writers)
+ 
++    def test_writelines_pauses_protocol(self):
++        data = memoryview(b'data')
++        self.sock.send.return_value = 2
++        self.sock.send.fileno.return_value = 7
++
++        transport = self.socket_transport()
++        transport._high_water = 1
++        transport.writelines([data])
++        self.assertTrue(self.protocol.pause_writing.called)
++        self.assertTrue(self.sock.send.called)
++        self.assertTrue(self.loop.writers)
++
+     @unittest.skipUnless(selector_events._HAS_SENDMSG, 'no sendmsg')
+     def test_write_sendmsg_full(self):
+         data = memoryview(b'data')
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 47f5048d655bf..4027cc03da1bd 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -294,6 +294,8 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
   ] ++ optionals (pythonOlder "3.12") [
     # https://github.com/python/cpython/issues/90656
     ./loongarch-support.patch
+  ] ++ optionals (pythonAtLeast "3.12") [
+    ./3.12/CVE-2024-12254.patch
   ] ++ optionals (pythonAtLeast "3.11" && pythonOlder "3.13") [
     # backport fix for https://github.com/python/cpython/issues/95855
     ./platform-triplet-detection.patch
diff --git a/pkgs/development/interpreters/spidermonkey/128.nix b/pkgs/development/interpreters/spidermonkey/128.nix
index 7a46aafdcd961..bbf122857d13a 100644
--- a/pkgs/development/interpreters/spidermonkey/128.nix
+++ b/pkgs/development/interpreters/spidermonkey/128.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "128.1.0";
-  hash = "sha512-gFWn+DrPDKthJLpYCa/xwILoGg0w/zGOxxn4/T9K+apg4glMGr1smBGT11EHWpVpNwF24g5Q88GVn+J6FVETiA==";
+  version = "128.5.0";
+  hash = "sha512-/yDxj5LF6c0dnq98OM7GG8qy3KjdKBdRm3ErwfdgtcbikCEqzzKJFSdk5RMOAWJpULfs2TJ7LFh7JKJGWRr9Zw==";
 }
diff --git a/pkgs/development/interpreters/tcl/tcl-package-hook.sh b/pkgs/development/interpreters/tcl/tcl-package-hook.sh
index 8548ac66402f0..b1c89f8dacf2e 100644
--- a/pkgs/development/interpreters/tcl/tcl-package-hook.sh
+++ b/pkgs/development/interpreters/tcl/tcl-package-hook.sh
@@ -23,7 +23,7 @@ _addToTclLibPath() {
     if [[ -z "${TCLLIBPATH-}" ]]; then
         export TCLLIBPATH="$tclPkg"
     else
-        if [[ "$TCLLIBPATH" != *"$tclPkg "* && "$TCLLIBPATH" != *"$tclPkg" ]]; then
+        if [[ "$TCLLIBPATH " != *"$tclPkg "* ]]; then
             export TCLLIBPATH="${TCLLIBPATH} $tclPkg"
         fi
     fi
diff --git a/pkgs/development/libraries/gdal/default.nix b/pkgs/development/libraries/gdal/default.nix
index dd589ddd7eaa3..d88527b138c2a 100644
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@@ -189,7 +189,7 @@ stdenv.mkDerivation (finalAttrs: {
       json_c
       lerc
       xz
-      (libxml2.override { enableHttp = true; })
+      libxml2
       lz4
       openjpeg
       openssl
diff --git a/pkgs/development/libraries/glibc/nix-locale-archive.patch b/pkgs/development/libraries/glibc/nix-locale-archive.patch
index 2fedf2a7a7dbd..9519b5f5fdf53 100644
--- a/pkgs/development/libraries/glibc/nix-locale-archive.patch
+++ b/pkgs/development/libraries/glibc/nix-locale-archive.patch
@@ -17,9 +17,9 @@ index 512769eaec..171dbb4ad9 100644
 +  if (path && fd < 0)
 +    fd = __open_nocancel (path, O_RDONLY|O_LARGEFILE|O_CLOEXEC);
 +  if (fd < 0)
-+    fd = __open_nocancel (archfname, O_RDONLY|O_LARGEFILE|O_CLOEXEC);
-+  if (fd < 0)
 +    fd = __open_nocancel ("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE|O_CLOEXEC);
++  if (fd < 0)
++    fd = __open_nocancel (archfname, O_RDONLY|O_LARGEFILE|O_CLOEXEC);
 +  return fd;
 +}
 +
@@ -64,9 +64,9 @@ index ca0a95be99..e484783402 100644
 +  if (path && fd < 0)
 +    fd = open64 (path, O_RDONLY);
 +  if (fd < 0)
-+    fd = open64 (ARCHIVE_NAME, O_RDONLY);
-+  if (fd < 0)
 +    fd = open64 ("/usr/lib/locale/locale-archive", O_RDONLY);
++  if (fd < 0)
++    fd = open64 (ARCHIVE_NAME, O_RDONLY);
 +  return fd;
 +}
 +
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 58dccbfa23754..8e58fa128aeec 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gpgme";
-  version = "1.24.0";
+  version = "1.24.1";
   pyproject = true;
 
   outputs = [
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/gpgme-${version}.tar.bz2";
-    hash = "sha256-YeOmrYkyP+z6/xdrwXKPuMMxLy+qg0JNnVB3uiD199o=";
+    hash = "sha256-6gXQJY5xBh1hcWWE7DTO9ZMwqRNAVx7cRreDdJc7qF8=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
index ee467e8ad18af..74fe412380b28 100644
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@@ -24,7 +24,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.67.0"; # N.B: if you change this, please update:
+  version = "1.68.1"; # N.B: if you change this, please update:
     # pythonPackages.grpcio
     # pythonPackages.grpcio-channelz
     # pythonPackages.grpcio-health-checking
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-NjoSm3ZiHqe0QeVRFWO2FheoOzKjSX2oyiCM3qNUxhM=";
+    hash = "sha256-Rp+vg90biF6XXa4rVaLPWMjmWYut9XmBPgxQDTnltzk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/librasterlite2/default.nix b/pkgs/development/libraries/librasterlite2/default.nix
index d933baafdfff0..a1655dc6a13d1 100644
--- a/pkgs/development/libraries/librasterlite2/default.nix
+++ b/pkgs/development/libraries/librasterlite2/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
     libspatialite
     libtiff
     libwebp
-    (libxml2.override { enableHttp = true; })
+    libxml2
     lz4
     minizip
     openjpeg
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index abf5f0df25589..b06b94d7d9b88 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libunistring";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchurl {
     url = "mirror://gnu/libunistring/libunistring-${finalAttrs.version}.tar.gz";
-    hash = "sha256-/W1WYvpwZIfEg0mnWLV7wUnOlOxsMGJOyf3Ec86rvI4=";
+    hash = "sha256-jqjM+GwJ3YAcjKwZh46ATlT3B89piENxEw0gveaDhrc=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 6924c71fab662..9ae31c2ade829 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxml2";
-  version = "2.13.4";
+  version = "2.13.5";
 
   outputs = [ "bin" "dev" "out" "devdoc" ]
     ++ lib.optional pythonSupport "py"
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor finalAttrs.version}/libxml2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ZdBC4cgBAkPmF++wKv2iC4XCFgrNv7y1smuAzsZRVlA=";
+    hash = "sha256-dPwWMhejlkJX0745r5Q+CIYSY8QjH571tJa29tTHsrY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/mapnik/default.nix b/pkgs/development/libraries/mapnik/default.nix
index f096a4a3067dc..8662434554ea9 100644
--- a/pkgs/development/libraries/mapnik/default.nix
+++ b/pkgs/development/libraries/mapnik/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
     python3
     sqlite
     zlib
-    (libxml2.override { enableHttp = true; })
+    libxml2
     postgresql
     protozero
     sparsehash
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 8ddb73bb956ca..c97cdea14143a 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -57,6 +57,14 @@
 , libselinux
 }:
 
+let
+  webrtc-audio-processings =
+    lib.filter (lib.meta.availableOn stdenv.hostPlatform) [
+      webrtc-audio-processing_1
+      webrtc-audio-processing
+    ];
+in
+
 stdenv.mkDerivation(finalAttrs: {
   pname = "pipewire";
   version = "1.2.7";
@@ -122,7 +130,7 @@ stdenv.mkDerivation(finalAttrs: {
     readline
     sbc
   ] ++ (if enableSystemd then [ systemd ] else [ elogind udev ])
-  ++ (if lib.meta.availableOn stdenv.hostPlatform webrtc-audio-processing_1 then [ webrtc-audio-processing_1 ] else [ webrtc-audio-processing ])
+  ++ lib.take 1 webrtc-audio-processings
   ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform ldacbt) ldacbt
   ++ lib.optional zeroconfSupport avahi
   ++ lib.optional raopSupport openssl
@@ -140,6 +148,7 @@ stdenv.mkDerivation(finalAttrs: {
     (lib.mesonEnable "installed_tests" true)
     (lib.mesonOption "installed_test_prefix" (placeholder "installedTests"))
     (lib.mesonOption "libjack-path" "${placeholder "jack"}/lib")
+    (lib.mesonEnable "echo-cancel-webrtc" (webrtc-audio-processings != []))
     (lib.mesonEnable "libcamera" true)
     (lib.mesonEnable "libffado" ffadoSupport)
     (lib.mesonEnable "roc" rocSupport)
diff --git a/pkgs/development/python-modules/fs/default.nix b/pkgs/development/python-modules/fs/default.nix
index 9d1fded19c1b6..e36d8412ee204 100644
--- a/pkgs/development/python-modules/fs/default.nix
+++ b/pkgs/development/python-modules/fs/default.nix
@@ -4,7 +4,6 @@
   appdirs,
   buildPythonPackage,
   fetchPypi,
-  glibcLocales,
   mock,
   psutil,
   pyftpdlib,
@@ -30,13 +29,10 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  buildInputs = [ glibcLocales ];
-
   dependencies = [
     six
     appdirs
     pytz
-    setuptools
   ];
 
   nativeCheckInputs = [
@@ -52,23 +48,28 @@ buildPythonPackage rec {
     HOME=$(mktemp -d)
   '';
 
-  # strong cycle with parameterized
-  doCheck = false;
-
-  pytestFlagsArray = [ "--ignore=tests/test_opener.py" ];
+  disabledTestPaths = [
+    # Circular dependency with parameterized
+    "tests/test_move.py"
+    "tests/test_mirror.py"
+    "tests/test_copy.py"
+  ];
 
   disabledTests =
-    [ "user_data_repr" ]
+    [
+      "user_data_repr"
+      # https://github.com/PyFilesystem/pyfilesystem2/issues/568
+      "test_remove"
+      # Tests require network access
+      "TestFTPFS"
+    ]
     ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
       # remove if https://github.com/PyFilesystem/pyfilesystem2/issues/430#issue-707878112 resolved
       "test_ftpfs"
-    ]
-    ++ lib.optionals (pythonAtLeast "3.9") [
-      # update friend version of this commit: https://github.com/PyFilesystem/pyfilesystem2/commit/3e02968ce7da7099dd19167815c5628293e00040
-      # merged into master, able to be removed after >2.4.1
-      "test_copy_sendfile"
     ];
 
+  pythonImportsCheck = [ "fs" ];
+
   __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/grpcio-channelz/default.nix b/pkgs/development/python-modules/grpcio-channelz/default.nix
index c1e6a20f17bfa..8a1517b6b9795 100644
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-channelz";
-  version = "1.67.0";
+  version = "1.68.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_channelz";
     inherit version;
-    hash = "sha256-F2Jfq6lOYn4RsjP9Ay21G67F6HkGeY3SIEk26Z0BWnE=";
+    hash = "sha256-6+mxJ3RTBtsXB7y46w3Fa5R8O2FnKbWde0UeJjnsttI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index ff73160db9a85..75249187dab7e 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -11,13 +11,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.67.0";
+  version = "1.68.1";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_health_checking";
     inherit version;
-    hash = "sha256-PepxXVboJQ/wW6Se9RF/g2skD/N5vkY2DCbO/ZydsRo=";
+    hash = "sha256-6pNs+gxkokr9gAWHPqYbGsyDqUHAC1amM5ybIlyAoag=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index b00a0bb51b739..eb6ba8dcbd475 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.67.0";
+  version = "1.68.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_reflection";
     inherit version;
-    hash = "sha256-xHFDc4sYl7bOSvXg4zjIXJruX9y7M1XTaKjcrkbYkzw=";
+    hash = "sha256-z/yzPEy93ncaBv1Vym/hScb4nsMwyaQBBzC7KZhZeYI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 27de864281cb3..2dec36e979fa7 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -13,7 +13,7 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.67.0";
+  version = "1.68.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "grpcio_status";
     inherit version;
-    hash = "sha256-w+Wob6AH6eJjzV+YioqQdITaTKq1godOoqSmCSc0BGs=";
+    hash = "sha256-4TeNA2yBoWENe0x6FGzWY90T/MkVz019BTkp26W7tuE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index 1a174b5ba5872..cf121cce3e6c6 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -13,7 +13,7 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.67.0";
+  version = "1.68.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "grpcio_testing";
     inherit version;
-    hash = "sha256-YVRnu0aObDSfYCIKlrvMKin70hmwDdip96I+Qyi7+Dw=";
+    hash = "sha256-tK6vhvVlqPiCMxfwUVLABuVZDnfPafmCDtmzdb/WHrM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 51b1012a972e7..29e206098294f 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.67.0";
+  version = "1.68.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_tools";
     inherit version;
-    hash = "sha256-GBs9TmG4MULBguw2bzB5sAI1CXQ5huVMlGXKOMrCVfg=";
+    hash = "sha256-JBOhetFsnIIbNuSmf8ZMN7nkY2qxw6B3eAGIATeHObo=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index c8c98cd8a0315..002d5dde36d64 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -18,14 +18,14 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.67.0";
+  version = "1.68.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4JCyVT4Noch1RJyOdQc91EFd1xyb3mpAYkD99MDuRnw=";
+    hash = "sha256-RKhQLdXeZTrmpz4t5QpAHYQYTwMx0Kw9rrBE5m1cUFQ=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index db4d1fcc63ee1..eb672a053f257 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -59,7 +59,7 @@ let
 in
 buildPythonPackage rec {
   pname = "numpy";
-  version = "2.1.3";
+  version = "2.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -67,7 +67,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "tar.gz";
-    hash = "sha256-qgjgTgiq+XTURY3vU53s4NKBRthmo52lY5WW9JIf12E=";
+    hash = "sha256-FA3YD/iYGlg6YJgL4aZVBo+K3r96RaBqaFjIc/zc1KA=";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [
diff --git a/pkgs/development/python-modules/openstackdocstheme/default.nix b/pkgs/development/python-modules/openstackdocstheme/default.nix
index 7391fb37ba7a8..c0e75fcab9b93 100644
--- a/pkgs/development/python-modules/openstackdocstheme/default.nix
+++ b/pkgs/development/python-modules/openstackdocstheme/default.nix
@@ -14,8 +14,7 @@ buildPythonPackage rec {
   version = "3.4.0";
   pyproject = true;
 
-  # breaks on import due to distutils import through pbr.packaging
-  disabled = pythonAtLeast "3.12";
+  disabled = pythonAtLeast "3.13";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index bd45d03af8928..d500a215be114 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   callPackage,
+  distutils,
   fetchPypi,
   setuptools,
   six,
@@ -20,6 +21,7 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
 
   dependencies = [
+    distutils # for distutils.command in pbr/packaging.py
     setuptools # for pkg_resources
     six
   ];
diff --git a/pkgs/development/tools/reno/default.nix b/pkgs/development/python-modules/reno/default.nix
similarity index 66%
rename from pkgs/development/tools/reno/default.nix
rename to pkgs/development/python-modules/reno/default.nix
index c5d79f3badf68..556374be32516 100644
--- a/pkgs/development/tools/reno/default.nix
+++ b/pkgs/development/python-modules/reno/default.nix
@@ -1,42 +1,48 @@
 {
+  buildPythonApplication,
+  dulwich,
+  docutils,
   lib,
-  fetchPypi,
+  fetchFromGitHub,
   git,
-  gnupg1,
-  python3Packages,
+  gnupg,
+  pbr,
+  pyyaml,
+  setuptools,
+  sphinx,
+  stestr,
+  testtools,
+  testscenarios,
 }:
 
-python3Packages.buildPythonApplication rec {
+buildPythonApplication rec {
   pname = "reno";
   version = "4.1.0";
   pyproject = true;
 
-  # Must be built from python sdist because of versioning quirks
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-+ZLx/b0WIV7J3kevCBMdU6KDDJ54Q561Y86Nan9iU3A=";
+  src = fetchFromGitHub {
+    owner = "openstack";
+    repo = "reno";
+    rev = "refs/tags/${version}";
+    hash = "sha256-le9JtE0XODlYhTFsrjxFXG/Weshr+FyN4M4S3BMBLUE=";
   };
 
-  # remove b/c doesn't list all dependencies, and requires a few packages not in nixpkgs
-  postPatch = ''
-    rm test-requirements.txt
-  '';
+  env.PBR_VERSION = version;
 
-  build-system = with python3Packages; [
+  build-system = [
     setuptools
   ];
 
-  dependencies = with python3Packages; [
+  dependencies = [
     dulwich
     pbr
     pyyaml
-    setuptools  # required for finding pkg_resources at runtime
+    setuptools
   ];
 
-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs = [
     # Python packages
     docutils
-    fixtures
     sphinx
     stestr
     testtools
@@ -44,12 +50,12 @@ python3Packages.buildPythonApplication rec {
 
     # Required programs to run all tests
     git
-    gnupg1
+    gnupg
   ];
 
   checkPhase = ''
     runHook preCheck
-    export HOME=$TMPDIR
+    export HOME=$(mktemp -d)
     stestr run -e <(echo "
       # Expects to be run from a git repository
       reno.tests.test_cache.TestCache.test_build_cache_db
@@ -79,6 +85,6 @@ python3Packages.buildPythonApplication rec {
     mainProgram = "reno";
     homepage = "https://docs.openstack.org/reno/latest";
     license = licenses.asl20;
-    maintainers = teams.openstack.members ++ (with maintainers; [ drewrisinger guillaumekoenig ]);
+    maintainers = teams.openstack.members;
   };
 }
diff --git a/pkgs/development/python-modules/six/default.nix b/pkgs/development/python-modules/six/default.nix
index 89e77586339b7..4eeb2129738e6 100644
--- a/pkgs/development/python-modules/six/default.nix
+++ b/pkgs/development/python-modules/six/default.nix
@@ -1,22 +1,26 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   isPyPy,
   pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "six";
-  version = "1.16.0";
+  version = "1.17.0";
+  pyproject = true;
 
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926";
+  src = fetchFromGitHub {
+    owner = "benjaminp";
+    repo = "six";
+    rev = "refs/tags/${version}";
+    hash = "sha256-tz99C+dz5xJhunoC45bl0NdSdV9NXWya9ti48Z/KaHY=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pytestFlagsArray =
diff --git a/pkgs/development/python-modules/waitress/default.nix b/pkgs/development/python-modules/waitress/default.nix
index 933823a748c5c..79e9b73780bb2 100644
--- a/pkgs/development/python-modules/waitress/default.nix
+++ b/pkgs/development/python-modules/waitress/default.nix
@@ -2,25 +2,40 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
+  pytestCheckHook,
+  pytest-cov-stub,
 }:
 
 buildPythonPackage rec {
   pname = "waitress";
-  version = "3.0.0";
-  format = "setuptools";
+  version = "3.0.2";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AF2kebBBNM3Z3WAtHufEnXneBTdhDWU2dMxsveIiuKE=";
+    hash = "sha256-aCqq8q8MRK2kq/tw3tNjk/DjB/SrlFaiFc4AILrvwx8=";
   };
 
-  doCheck = false;
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "waitress" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+  ];
+
+  disabledTests = [
+    # access to socket
+    "test_service_port"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/Pylons/waitress";
     description = "Waitress WSGI server";
     mainProgram = "waitress-serve";
-    license = licenses.zpl20;
+    license = licenses.zpl21;
     maintainers = with maintainers; [ domenkozar ];
   };
 }
diff --git a/pkgs/development/python-modules/wheel/default.nix b/pkgs/development/python-modules/wheel/default.nix
index 4c7a5b3dc2887..34dc951531702 100644
--- a/pkgs/development/python-modules/wheel/default.nix
+++ b/pkgs/development/python-modules/wheel/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "wheel";
-  version = "0.44.0";
-  format = "pyproject";
+  version = "0.45.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "wheel";
     rev = "refs/tags/${version}";
-    hash = "sha256-IFJ411H5nItR8gA5R0AYXFs3n6e1SLo2VoMOqgvDnnk=";
+    hash = "sha256-tgueGEWByS5owdA5rhXGn3qh1Vtf0HGYC6+BHfrnGAs=";
     postFetch = ''
       cd $out
       mv tests/testdata/unicode.dist/unicodedist/åäö_日本語.py \
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index db85fdef01c4d..d22665a95d0d2 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -87,12 +87,12 @@ stdenv.mkDerivation (finalAttrs: {
               --suffix LUA_PATH ";" "$(echo "$out"/share/lua/*/)?/init.lua" \
               --suffix LUA_CPATH ";" "$(echo "$out"/lib/lua/*/)?.so" \
               --suffix LUA_CPATH ";" "$(echo "$out"/share/lua/*/)?/init.lua" \
-              --suffix PATH : ${lib.makeBinPath finalAttrs.propagatedBuildInputs}
+              --suffix PATH : ${lib.makeBinPath finalAttrs.propagatedNativeBuildInputs}
         }
     done
   '';
 
-  propagatedBuildInputs = [ zip unzip cmake ];
+  propagatedNativeBuildInputs = [ zip unzip cmake ];
 
   # unpack hook for src.rock and rockspec files
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
index 1a0466596fdc3..9441c40616a9d 100644
--- a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
+++ b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
@@ -16,7 +16,7 @@ luarocks_bootstrap.overrideAttrs (old: {
     hash = "sha256-hsjv+jlLsoIDM4gB/0mFeoVu1YZ1I9ELDALLTEnlCF0=";
   };
 
-  propagatedBuildInputs = old.propagatedBuildInputs ++ [
+  propagatedNativeBuildInputs = old.propagatedNativeBuildInputs ++ [
     file
     nurl
   ];
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index 2196a5730aa26..a73f8209cf2e2 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -49,13 +49,25 @@ stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace ./support/tools/ffado-diag.in \
       --replace /lib/modules/ "/run/booted-system/kernel-modules/lib/modules/"
+
+    # prevent build tools from leaking into closure
+    substituteInPlace support/tools/SConscript --replace-fail \
+      'support/tools/ffado-diag --static' \
+      "echo '"'See `nix-store --query --tree ${placeholder "out"}`.'"'"
+  '' + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    # skip the CC sanity check, since that requires invoking cross-compiled binaries during build
+    substituteInPlace SConstruct \
+      --replace-fail 'conf.CompilerCheck()' 'True' \
+      --replace-fail "pkg-config" "$PKG_CONFIG"
+    substituteInPlace admin/pkgconfig.py \
+      --replace-fail "pkg-config" "$PKG_CONFIG"
   '';
 
   nativeBuildInputs =
     [
       (scons.override {
         # SConstruct script depends on distutils removed in Python 3.12
-        python3Packages = python311.pkgs;
+        python3Packages = python311.pythonOnBuildForHost.pkgs;
       })
       pkg-config
       which
@@ -68,6 +80,8 @@ stdenv.mkDerivation rec {
 
   prefixKey = "PREFIX=";
   sconsFlags = [
+    "CUSTOM_ENV=True"  # tell SConstruct to use nixpkgs' CC/CXX/CFLAGS
+    "DETECT_USERSPACE_ENV=False"
     "DEBUG=False"
     "ENABLE_ALL=True"
     "BUILD_TESTS=True"
@@ -97,11 +111,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
   dontWrapQtApps = true;
-
-  postInstall = ''
-    # prevent build tools from leaking into closure
-    echo 'See `nix-store --query --tree ${placeholder "out"}`.' > $out/lib/libffado/static_info.txt
-  '';
+  strictDeps = true;
 
   preFixup = lib.optionalString withMixer ''
     wrapQtApp "$bin/bin/ffado-mixer"
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index 560980f6002f2..aa02aeb104577 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.27";
-  hash = "sha256-MTNBWQW5tG0VLQZIZdUvMu7k/L6w6KaeNRDK6q4MVqk=";
+  version = "2.03.28";
+  hash = "sha256-uCK6/2ti3zY4LHF866mKJojrsxvyt2jz/6K21eJVckI=";
 }
diff --git a/pkgs/servers/osrm-backend/default.nix b/pkgs/servers/osrm-backend/default.nix
index 9adbf38811ef9..96f7141f953be 100644
--- a/pkgs/servers/osrm-backend/default.nix
+++ b/pkgs/servers/osrm-backend/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osrm-backend";
-  version = "5.27.1";
+  version = "5.27.1-unstable-2024-11-03";
 
   src = fetchFromGitHub {
     owner = "Project-OSRM";
     repo = "osrm-backend";
-    rev = "v${version}";
-    sha256 = "sha256-3oA/U5O4GLfwMF7x99JQuFK7ewDrLJLh6BBLYfnyNaM=";
+    rev = "3614af7f6429ee35c3f2e836513b784a74664ab6";
+    hash = "sha256-iix++G49cC13wZGZIpXu1SWGtVAcqpuX3GhsIaETzUU=";
   };
 
   nativeBuildInputs = [
@@ -43,37 +43,8 @@ stdenv.mkDerivation rec {
     expat
   ];
 
-  patches = [
-    # gcc-13 build fix:
-    #   https://github.com/Project-OSRM/osrm-backend/pull/6632
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/Project-OSRM/osrm-backend/commit/af59a9cfaee4d601b5c88391624a05f2a38da17b.patch";
-      hash = "sha256-dB9JP/DrJXpFGLD/paein2z64UtHIYZ17ycb91XWpEI=";
-    })
-  ];
-
-  env.NIX_CFLAGS_COMPILE = toString (
-    [
-      # Needed with GCC 12
-      "-Wno-error=stringop-overflow"
-      "-Wno-error=uninitialized"
-      # Needed for GCC 13
-      "-Wno-error=array-bounds"
-    ]
-    ++
-      # error: aligned deallocation function of type 'void (void *, std::align_val_t) noexcept' is only available on macOS 10.13 or newer
-      (lib.optionals
-        (
-          stdenv.hostPlatform.isDarwin
-          && stdenv.hostPlatform.isx86_64
-          && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13"
-        )
-        [
-          "-faligned-allocation"
-        ]
-      )
-  );
+  # Needed with GCC 12
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=uninitialized";
 
   postInstall = ''
     mkdir -p $out/share/osrm-backend
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 1cf030c649513..6d13cde821f0c 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -161,7 +161,7 @@ let
       zlib
       readline
       openssl
-      (libxml2.override {enableHttp = true;})
+      libxml2
       libuuid
     ]
       ++ lib.optionals icuSupport [ icu ]
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index cccb5723f5cc4..dbf5fef775767 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1578,11 +1578,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXt = callPackage ({ stdenv, pkg-config, fetchurl, libICE, xorgproto, libSM, libX11, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libXt";
-    version = "1.3.0";
+    version = "1.3.1";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXt-1.3.0.tar.xz";
-      sha256 = "14dz66rp66ar2a5q0fbsnlcqkbd34801pzdxj3f0hzc2vcy0p0jj";
+      url = "mirror://xorg/individual/lib/libXt-1.3.1.tar.xz";
+      sha256 = "120jjd6l7fjdxy5myrc1dmc0cwpqa18a97hrbg0d9x146frp99z0";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -2098,11 +2098,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   utilmacros = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "util-macros";
-    version = "1.20.1";
+    version = "1.20.2";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/util/util-macros-1.20.1.tar.xz";
-      sha256 = "1xffkcqv96vpk5pckisanrvg4w7i9ciqhs6yv7sc12p7vii8yc0b";
+      url = "mirror://xorg/individual/util/util-macros-1.20.2.tar.xz";
+      sha256 = "13ifr0dabci130xk04kp9bq16g9kbyzf8x1mgdyjsrsglbmnkhls";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 71b5b18de3f24..dde0a9c92dbcb 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -200,7 +200,7 @@ mirror://xorg/individual/lib/libXres-1.2.2.tar.xz
 mirror://xorg/individual/lib/libXScrnSaver-1.2.4.tar.xz
 mirror://xorg/individual/lib/libxshmfence-1.3.2.tar.xz
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXt-1.3.0.tar.xz
+mirror://xorg/individual/lib/libXt-1.3.1.tar.xz
 mirror://xorg/individual/lib/libXtst-1.2.5.tar.xz
 mirror://xorg/individual/lib/libXv-1.0.12.tar.xz
 mirror://xorg/individual/lib/libXvMC-1.0.14.tar.xz
@@ -216,6 +216,6 @@ mirror://xorg/individual/util/gccmakedep-1.0.4.tar.xz
 mirror://xorg/individual/util/imake-1.0.10.tar.xz
 mirror://xorg/individual/util/lndir-1.0.5.tar.xz
 mirror://xorg/individual/util/makedepend-1.0.9.tar.xz
-mirror://xorg/individual/util/util-macros-1.20.1.tar.xz
+mirror://xorg/individual/util/util-macros-1.20.2.tar.xz
 mirror://xorg/individual/util/xorg-cf-files-1.0.8.tar.xz
 mirror://xorg/individual/xserver/xorg-server-21.1.14.tar.xz
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index c5815d483bde1..46bb76fc9d6ed 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -130,7 +130,10 @@ rec {
           "--disable-shared"
         ];
         cmakeFlags = (args.cmakeFlags or []) ++ [ "-DBUILD_SHARED_LIBS:BOOL=OFF" ];
-        mesonFlags = (args.mesonFlags or []) ++ [ "-Ddefault_library=static" ];
+        mesonFlags = (args.mesonFlags or []) ++ [
+          "-Ddefault_library=static"
+          "-Ddefault_both_libraries=static"
+        ];
       });
     });
 
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 8e85deb720462..087787055c1e1 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -37,6 +37,7 @@ let
     splitString
     subtractLists
     unique
+    zipAttrsWith
   ;
 
   inherit (import ../../build-support/lib/cmake.nix { inherit lib stdenv; }) makeCMakeFlags;
@@ -493,17 +494,15 @@ else let
         "/bin/sh"
       ];
       __propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;
-    }) // lib.optionalAttrs (!__structuredAttrs) (
-      makeOutputChecks attrs
-    ) // lib.optionalAttrs (__structuredAttrs) {
+    }) // (if !__structuredAttrs then makeOutputChecks attrs else {
       outputChecks = builtins.listToAttrs (map (name: {
         inherit name;
-        value = lib.zipAttrsWith (_: builtins.concatLists) [
+        value = zipAttrsWith (_: builtins.concatLists) [
           (makeOutputChecks attrs)
           (makeOutputChecks attrs.outputChecks.${name} or {})
         ];
       }) outputs);
-    };
+    });
 
 in
   derivationArg;
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 79997237482fa..541689287970b 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -450,7 +450,9 @@ concatStringsSep() {
             -a*)
                 # \036 is the "record separator" character. We assume that this will never need to be part of
                 # an argument string we create here. If anyone ever hits this limitation: Feel free to refactor.
-                local IFS=$'\036' ;;
+                # To avoid leaking an unescaped rs character when dumping the environment with nix, we use printf
+                # in a subshell.
+                local IFS="$(printf '\036')" ;;
             *)
                 local IFS=" " ;;
 
@@ -683,7 +685,7 @@ findInputs() {
     # shellcheck disable=SC1087
     local varSlice="$var[*]"
     # ${..-} to hack around old bash empty array problem
-    case "${!varSlice-}" in
+    case " ${!varSlice-} " in
         *" $pkg "*) return 0 ;;
     esac
     unset -v varSlice
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0ae81631d2b72..a270cc024f325 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8426,9 +8426,7 @@ with pkgs;
 
   inherit (regclient) regbot regctl regsync;
 
-  reno = callPackage ../development/tools/reno {
-    python3Packages = python311Packages;
-  };
+  reno = with python311Packages; toPythonApplication reno;
 
   replace-secret = callPackage ../build-support/replace-secret/replace-secret.nix { };
 
@@ -11751,8 +11749,6 @@ with pkgs;
   opensmtpd-filter-rspamd = callPackage ../servers/mail/opensmtpd/filter-rspamd.nix { };
   osrm-backend = callPackage ../servers/osrm-backend {
     tbb = tbb_2021_11;
-    # https://github.com/Project-OSRM/osrm-backend/issues/6503
-    boost = boost179;
   };
 
   postfix = callPackage ../servers/mail/postfix { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c4b2061c568ab..0148e53ecf78c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -13855,6 +13855,8 @@ self: super: with self; {
 
   rencode = callPackage ../development/python-modules/rencode { };
 
+  reno = callPackage ../development/python-modules/reno { };
+
   renson-endura-delta = callPackage ../development/python-modules/renson-endura-delta { };
 
   reorder-python-imports = callPackage ../development/python-modules/reorder-python-imports { };