diff --git a/lib/trivial.nix b/lib/trivial.nix
index fd48a0456b66..1fa1974910c8 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -7,14 +7,16 @@ let
     functionArgs
     pathExists
     release
-    setFunctionArgs
     toBaseDigits
     version
     versionSuffix
     warn
     ;
   inherit (lib)
+    foldr
+    fromJSON
     isString
+    readFile
     ;
 in
 {
@@ -789,7 +791,7 @@ in
     importJSON :: Path -> Any
     ```
   */
-  importJSON = path: builtins.fromJSON (builtins.readFile path);
+  importJSON = path: fromJSON (readFile path);
 
   /**
     Reads a TOML file.
@@ -836,7 +838,7 @@ in
     importTOML :: Path -> Any
     ```
   */
-  importTOML = path: fromTOML (builtins.readFile path);
+  importTOML = path: fromTOML (readFile path);
 
   /**
     `warn` *`message`* *`value`*
@@ -1046,7 +1048,7 @@ in
 
   info = msg: builtins.trace "INFO: ${msg}";
 
-  showWarnings = warnings: res: lib.foldr (w: x: warn w x) res warnings;
+  showWarnings = warnings: res: foldr warn res warnings;
 
   ## Function annotations
 
@@ -1177,7 +1179,10 @@ in
     let
       fArgs = functionArgs f;
     in
-    g: setFunctionArgs g fArgs;
+    g: {
+      __functor = self: g;
+      __functionArgs = fArgs;
+    };
 
   /**
     Turns any non-callable values into constant functions.
@@ -1325,11 +1330,11 @@ in
             r = i - ((i / base) * base);
             q = (i - r) / base;
           in
-          [ r ] ++ go q;
+          go q ++ [ r ];
     in
     assert (isInt base);
     assert (isInt i);
     assert (base >= 2);
     assert (i >= 0);
-    lib.reverseList (go i);
+    go i;
 }
diff --git a/nixos/modules/programs/wayland/hyprland.nix b/nixos/modules/programs/wayland/hyprland.nix
index 8e6e7ea3f2f4..c3fba1db7548 100644
--- a/nixos/modules/programs/wayland/hyprland.nix
+++ b/nixos/modules/programs/wayland/hyprland.nix
@@ -81,7 +81,12 @@ in
   config = lib.mkIf cfg.enable (
     lib.mkMerge [
       {
-        environment.systemPackages = [ cfg.package ];
+        environment = {
+          systemPackages = [ cfg.package ];
+
+          # Allows lua stub file to be accessed from /run/current-system/sw/share/hypr
+          pathsToLink = [ "/share/hypr" ];
+        };
 
         # Hyprland needs permissions to give itself SCHED_RR on startup:
         # https://github.com/hyprwm/Hyprland/blob/main/src/init/initHelpers.cpp
diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py
index 4a28b18d8216..f733ad1845c4 100644
--- a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py
+++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py
@@ -169,6 +169,7 @@ def run(
 
     root_dir.mkdir(parents=True, exist_ok=True)
     root_dir.chmod(0o755)
+    (root_dir / "usr/bin").mkdir(parents=True, exist_ok=True)
 
     with (
         mk_netns(f"nixos-nspawn-{container_name}") as netns,
diff --git a/pkgs/build-support/fetchgithub/default.nix b/pkgs/build-support/fetchgithub/default.nix
index 288a10b95a4b..e12052e3d15d 100644
--- a/pkgs/build-support/fetchgithub/default.nix
+++ b/pkgs/build-support/fetchgithub/default.nix
@@ -3,7 +3,7 @@
   repoRevToNameMaybe,
   fetchgit,
   fetchzip,
-}:
+}@args:
 let
   # Here defines fetchFromGitHub arguments that determines useFetchGit,
   # The attribute value is their default values.
@@ -37,6 +37,10 @@ let
   adjustFunctionArgs = f: lib.setFunctionArgs f (faUseFetchGit // lib.functionArgs f);
 
   decorate = f: lib.makeOverridable (adjustFunctionArgs f);
+
+  # fetchzip may not be overridable when using external tools, for example nix-prefetch
+  fetchzip =
+    if args.fetchzip ? override then args.fetchzip.override { withUnzip = false; } else args.fetchzip;
 in
 decorate (
   {
@@ -105,14 +109,7 @@ decorate (
     varBase = "NIX${lib.optionalString (varPrefix != null) "_${varPrefix}"}_GITHUB_PRIVATE_";
     # We prefer fetchzip in cases we don't need submodules as the hash
     # is more stable in that case.
-    fetcher =
-      if useFetchGit then
-        fetchgit
-      # fetchzip may not be overridable when using external tools, for example nix-prefetch
-      else if fetchzip ? override then
-        fetchzip.override { withUnzip = false; }
-      else
-        fetchzip;
+    fetcher = if useFetchGit then fetchgit else fetchzip;
     privateAttrs = lib.optionalAttrs private {
       netrcPhase =
         # When using private repos:
diff --git a/pkgs/by-name/ar/ardour/package.nix b/pkgs/by-name/ar/ardour/package.nix
index 1fffe8b5aa3a..465a96fd882d 100644
--- a/pkgs/by-name/ar/ardour/package.nix
+++ b/pkgs/by-name/ar/ardour/package.nix
@@ -73,14 +73,14 @@ stdenv.mkDerivation (
   in
   {
     pname = "ardour";
-    version = "9.4";
+    version = "9.5";
 
     # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
     # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
     src = fetchgit {
       url = "git://git.ardour.org/ardour/ardour.git";
-      rev = finalAttrs.version;
-      hash = "sha256-/obRWtluM60OWcr93Ci40tjJMbnBvNqF3tWRO7uCrv8=";
+      tag = finalAttrs.version;
+      hash = "sha256-Jaq1jgiGMmLeIw66RIXfZJxc+HCho2eGl5uEqAlNk6w=";
     };
 
     bundledContent = fetchzip {
diff --git a/pkgs/by-name/co/code-cursor/sources.json b/pkgs/by-name/co/code-cursor/sources.json
index 6a8f27340cee..5ce856190a1c 100644
--- a/pkgs/by-name/co/code-cursor/sources.json
+++ b/pkgs/by-name/co/code-cursor/sources.json
@@ -1,22 +1,22 @@
 {
-  "version": "3.4.16",
+  "version": "3.5.17",
   "vscodeVersion": "1.105.1",
   "sources": {
     "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/f736016b0aa20ba1f99b7eec1dda48579fa4c295/linux/x64/Cursor-3.4.16-x86_64.AppImage",
-      "hash": "sha256-KSicp27+WSr1qIRUFflRHbxc/eRzcOnWEVQkLYr0ekU="
+      "url": "https://downloads.cursor.com/production/d5b2fc092e16007956c9e5047f76097b9e626cab/linux/x64/Cursor-3.5.17-x86_64.AppImage",
+      "hash": "sha256-hOo7SIITt8GnzChwPCmAXIyOJBhiSV+fQ3ovLFAT49c="
     },
     "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/f736016b0aa20ba1f99b7eec1dda48579fa4c295/linux/arm64/Cursor-3.4.16-aarch64.AppImage",
-      "hash": "sha256-EHRffgia7L7l/WXtODIaeFUpfS5WD9mvwR7muPcycgY="
+      "url": "https://downloads.cursor.com/production/d5b2fc092e16007956c9e5047f76097b9e626cab/linux/arm64/Cursor-3.5.17-aarch64.AppImage",
+      "hash": "sha256-sutJMIhZw45glApbzOrUXleIGkrYeC8lGarc7pckuTg="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/f736016b0aa20ba1f99b7eec1dda48579fa4c295/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-g2jrQNiYI2ekIOsaTeWfbvn2gLVDeBzRo4/jvNHNlSY="
+      "url": "https://downloads.cursor.com/production/d5b2fc092e16007956c9e5047f76097b9e626cab/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-0sJSQJyhu2RZhHaU/nr7/whKt31vFq6Tmxr9NOWlJ2g="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/f736016b0aa20ba1f99b7eec1dda48579fa4c295/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-PbU8WqoMyG2/9D7/iWWeqAxEgycH1kGUj7pfH5b4GqI="
+      "url": "https://downloads.cursor.com/production/d5b2fc092e16007956c9e5047f76097b9e626cab/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-7POR+9pveTdR9WYx0/OdgOhF8yTkiZwhzg0jKEfWrfs="
     }
   }
 }
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 8453584321c7..1211101245e7 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -25,18 +25,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.131.0";
+  version = "0.133.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-pWQxDJZO+xbY8aax9QRQRtx/BJw+4CZRL65W3Od4Ep8=";
+    hash = "sha256-RTxhhZjZ/64N60pmbNVzLwcSBomn67pPDpOjkL6RPUw=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-CaCYBg8U4pxi3EFBH81k1dWtGY1AL/cZmP9ZtvjDxzw=";
+  cargoHash = "sha256-J4wvPn4lSTSsJrTG56vkhJe2F2b+fUvJLEd+qKQ9LUg=";
 
   # Match upstream's release build for the codex binary only.
   cargoBuildFlags = [
diff --git a/pkgs/by-name/dm/dmensamenu/package.nix b/pkgs/by-name/dm/dmensamenu/package.nix
index 5c6d7da2451c..f83272c2523d 100644
--- a/pkgs/by-name/dm/dmensamenu/package.nix
+++ b/pkgs/by-name/dm/dmensamenu/package.nix
@@ -9,7 +9,7 @@
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "dmensamenu";
   version = "1.2.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dotlambda";
@@ -24,6 +24,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
     })
   ];
 
+  build-system = with python3Packages; [ setuptools ];
+
   dependencies = with python3Packages; [
     requests
   ];
diff --git a/pkgs/by-name/ev/evince/package.nix b/pkgs/by-name/ev/evince/package.nix
index 3b3bfc32294f..889ec7107238 100644
--- a/pkgs/by-name/ev/evince/package.nix
+++ b/pkgs/by-name/ev/evince/package.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "evince";
-  version = "48.1";
+  version = "48.4";
 
   outputs = [
     "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${lib.versions.major finalAttrs.version}/evince-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fYuab6OgXT9bkEiFkCdojHOniP9ukjvDlFEmiElD+hA=";
+    hash = "sha256-8pbFxmKIZjXUzVl+isCvzeeYK+RIZTPCt/CVsmi+hmg=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/js/json-sort/package.nix b/pkgs/by-name/js/json-sort/package.nix
index 402d8d8a363c..a560337b0be4 100644
--- a/pkgs/by-name/js/json-sort/package.nix
+++ b/pkgs/by-name/js/json-sort/package.nix
@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "json-sort";
-  version = "1.1.0";
+  version = "1.1.5";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "drupol";
     repo = "json-sort";
     tag = finalAttrs.version;
-    hash = "sha256-yojMXJiP87l5B7D74V6z9FNvSYebtn71GnB0d+Q7/UI=";
+    hash = "sha256-Xs1dMtPUmunkExQQ6IRmfFNz/3hVbARdtAL6K2Ur0ZQ=";
   };
 
-  cargoHash = "sha256-LpZIVWWb8HI1HM3m8Vhfk27bWFpU37GYssmsfEJQAVg=";
+  cargoHash = "sha256-RrNgmQ5v5zCKz/XaaLub16URmurQxfYTeNxy6UswFYY=";
 
   dontUseCargoParallelTests = true;
 
diff --git a/pkgs/by-name/li/libphonenumber/package.nix b/pkgs/by-name/li/libphonenumber/package.nix
index 39ce7cd3338f..7b134e60b0ac 100644
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libphonenumber";
-  version = "9.0.30";
+  version = "9.0.31";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "libphonenumber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+VGANm6L2TZkOW97PDYCH+rELyppyJ/GIiabnZXWNTc=";
+    hash = "sha256-5LJVlcii0uolu4p+z4R9uvYnzLBIdJEQp9AUUnNB5mE=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ma/marisa/package.nix b/pkgs/by-name/ma/marisa/package.nix
index c325fe577d15..175aa1646a7a 100644
--- a/pkgs/by-name/ma/marisa/package.nix
+++ b/pkgs/by-name/ma/marisa/package.nix
@@ -2,20 +2,30 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "marisa";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "s-yata";
     repo = "marisa-trie";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XOXX0NuU+erL/KDAZgBeX+LKO9uSEOyP1/VuMDE5pi0=";
+    hash = "sha256-+rOmbvlcEBBsjUdWRrW9WN0MfhnSe7Gm3DOXfhtcSDc=";
   };
 
+  patches = [
+    # https://github.com/s-yata/marisa-trie/pull/123
+    (fetchpatch {
+      name = "fix-binding-build.patch";
+      url = "https://github.com/s-yata/marisa-trie/commit/cf4602f08df49861d987d122bd85bfdb456fe7a0.patch";
+      hash = "sha256-h6+ixT63cHSpg3fhiLwJlxU296bD5YgfEaGqAHpm6+g=";
+    })
+  ];
+
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ni/niimblue/package.nix b/pkgs/by-name/ni/niimblue/package.nix
new file mode 100644
index 000000000000..1f23d220868e
--- /dev/null
+++ b/pkgs/by-name/ni/niimblue/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  npm-lockfile-fix,
+}:
+
+buildNpmPackage {
+  pname = "niimblue";
+  version = "0-unstable-2026-05-04";
+
+  src = fetchFromGitHub {
+    owner = "MultiMote";
+    repo = "niimblue";
+    rev = "89aed31a5162b282d2100dd2c2e3d90584153e41";
+    hash = "sha256-3Vrph+AVBLDSlP29JfYrPBjmpBCiM+EtApthelEBggc=";
+    postFetch = ''
+      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
+    '';
+  };
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r dist/* $out
+    runHook postInstall
+  '';
+
+  __structuredAttrs = true;
+
+  npmDepsHash = "sha256-+jVD0lfOrQ3hQE15yfcB0dVnPZBFo/naLXhFRiPFUGs=`";
+
+  meta = {
+    description = "Design and print labels with NIIMBOT printers directly from your PC or mobile web browser";
+    homepage = "https://github.com/MultiMote/niimblue";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    mainProgram = "niimblue";
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/pg/pgdog/package.nix b/pkgs/by-name/pg/pgdog/package.nix
index 9bd130f47c38..7aa3f87e9f7d 100644
--- a/pkgs/by-name/pg/pgdog/package.nix
+++ b/pkgs/by-name/pg/pgdog/package.nix
@@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage.override { inherit stdenv; } (finalAttrs: {
   pname = "pgdog";
-  version = "0.1.40";
+  version = "0.1.41";
 
   src = fetchFromGitHub {
     owner = "pgdogdev";
     repo = "pgdog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zs45vhcoiNwR56QqP7I8mhbTohijY5xc0VGLq4ehYdo=";
+    hash = "sha256-SY97Mpzd+tuhNnRdUNk7/J8aZZRSmdvbkRj3OjyMqms=";
   };
 
-  cargoHash = "sha256-4ctREg7x9Oi8KaIqGj+aZZLqM13wsZM0KrnygPUR8UI=";
+  cargoHash = "sha256-8edaOyZ3i7aSpg+6GOCSoQduFMlsuNnjAqa70RQu2Xw=";
 
   # Hardcoded paths for C compiler and linker
   postPatch = ''
diff --git a/pkgs/by-name/su/supabase-cli/package.nix b/pkgs/by-name/su/supabase-cli/package.nix
index 6f78a1ad0df2..4944a52392c1 100644
--- a/pkgs/by-name/su/supabase-cli/package.nix
+++ b/pkgs/by-name/su/supabase-cli/package.nix
@@ -3,36 +3,42 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
-  testers,
-  supabase-cli,
+  versionCheckHook,
   nix-update-script,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "supabase-cli";
-  version = "2.98.2";
+  version = "2.100.1";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "cli";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ZiptplUqebmId7noXuVXu9G5y1SW8+FGV6WqPH8R3Cw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vCaPZXf4I2f9kJDBDsZcl1q8PIM35NxwuLTeq1aastw=";
   };
 
-  vendorHash = "sha256-2BIP500MgABRzsG13UaUVv8KKtA0dPM0U10Uk/rfVQY=";
+  # Supabase is in the process of porting the CLI to TS, for now we continue with the Go cli.
+  sourceRoot = "${finalAttrs.src.name}/apps/cli-go";
+
+  vendorHash = "sha256-MebmiEFfWozJV/zEQyRtjmd9eR2nG3ZXcpyY6lEEQgI=";
 
   ldflags = [
     "-s"
-    "-w"
     "-X=github.com/supabase/cli/internal/utils.Version=${finalAttrs.version}"
   ];
 
   subPackages = [ "." ];
 
-  doCheck = false; # tests are trying to connect to localhost
-
   nativeBuildInputs = [ installShellFiles ];
 
+  doCheck = false; # Root Go package does not have any tests.
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   postInstall = ''
     mv $out/bin/{cli,supabase}
 
@@ -42,15 +48,10 @@ buildGoModule (finalAttrs: {
       --zsh <($out/bin/supabase completion zsh)
   '';
 
-  passthru = {
-    tests.version = testers.testVersion {
-      package = supabase-cli;
-    };
-    updateScript = nix-update-script {
-      # Fetch versions from GitHub releases to detect pre-releases and
-      # avoid updating to them.
-      extraArgs = [ "--use-github-releases" ];
-    };
+  passthru.updateScript = nix-update-script {
+    # Fetch versions from GitHub releases to detect pre-releases and
+    # avoid updating to them.
+    extraArgs = [ "--use-github-releases" ];
   };
 
   meta = {
diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index 7a61e2eb3b3f..121f91e360aa 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -8,16 +8,16 @@
 
 buildGo125Module (finalAttrs: {
   pname = "traefik";
-  version = "3.7.0-ea.2";
+  version = "3.7.1";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${finalAttrs.version}/traefik-v${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-GxOqCSLKGOg5gC1vFRP1JHgEOEFAe9aAzi4mqjcuv4E=";
+    hash = "sha256-LP4V70QvPmeafaArt8AWGkOj9dsKkEPE9dCulP+SmFw=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-wsqxM4hJh6iZIkUouWItgQOzk52gglawRnyYO8Y5gZs=";
+  vendorHash = "sha256-UHsgq6B3h6z/TZZpZi6o/KzahBDTiQszFikbpUvH80s=";
 
   proxyVendor = true;
 
diff --git a/pkgs/development/python-modules/fastparquet/default.nix b/pkgs/development/python-modules/fastparquet/default.nix
index 9972e87a5c65..1c8dcd43b6b7 100644
--- a/pkgs/development/python-modules/fastparquet/default.nix
+++ b/pkgs/development/python-modules/fastparquet/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "fastparquet";
-  version = "2026.3.0";
+  version = "2026.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dask";
     repo = "fastparquet";
     tag = version;
-    hash = "sha256-lf3GBfusZ1dhQ6wdHmfegqSlwG4Gm5Bi4+nof9yCg/o=";
+    hash = "sha256-thvoMXXiGtHGcJ0/IrGujjhVAvSmTMGmrlDHjG8R7PQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/jsonargparse/default.nix b/pkgs/development/python-modules/jsonargparse/default.nix
index c656d24a6554..3c4acc76b029 100644
--- a/pkgs/development/python-modules/jsonargparse/default.nix
+++ b/pkgs/development/python-modules/jsonargparse/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jsonargparse";
-  version = "4.47.0";
+  version = "4.49.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "omni-us";
     repo = "jsonargparse";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iZiXIeoxohbiKgE7oMy6q9kc3m0AxPFgoQunXmZDjYA=";
+    hash = "sha256-1uaFarYJcx7J2/acuw/+6BuBUrZkCyBSrreNKV9bR5c=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/marisa-trie/default.nix b/pkgs/development/python-modules/marisa-trie/default.nix
index e47cbef20291..4cce1653ace1 100644
--- a/pkgs/development/python-modules/marisa-trie/default.nix
+++ b/pkgs/development/python-modules/marisa-trie/default.nix
@@ -28,6 +28,12 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    # https://github.com/pytries/marisa-trie/issues/132
+    substituteInPlace tests/test_binary_trie.py tests/test_trie.py \
+      --replace-fail MARISA_FORMAT_ERROR std::runtime_error
+  '';
+
   build-system = [
     cython
     setuptools
diff --git a/pkgs/development/python-modules/marisa/default.nix b/pkgs/development/python-modules/marisa/default.nix
index 79bd8cc061ea..10d7a790ad21 100644
--- a/pkgs/development/python-modules/marisa/default.nix
+++ b/pkgs/development/python-modules/marisa/default.nix
@@ -2,13 +2,18 @@
   lib,
   buildPythonPackage,
   marisa,
+  setuptools,
   swig,
 }:
 
 buildPythonPackage {
   pname = "marisa";
-  format = "setuptools";
   inherit (marisa) src version;
+  pyproject = true;
+
+  patches = marisa.patches or [ ];
+
+  build-system = [ setuptools ];
 
   nativeBuildInputs = [ swig ];
 
diff --git a/pkgs/development/python-modules/modern-colorthief/default.nix b/pkgs/development/python-modules/modern-colorthief/default.nix
index 2f6a20b4374e..fd51e4b873cf 100644
--- a/pkgs/development/python-modules/modern-colorthief/default.nix
+++ b/pkgs/development/python-modules/modern-colorthief/default.nix
@@ -11,19 +11,19 @@
 
 buildPythonPackage rec {
   pname = "modern-colorthief";
-  version = "0.1.12";
+  version = "0.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "baseplate-admin";
     repo = "modern_colorthief";
     tag = version;
-    hash = "sha256-8V4S2VdtKnkH9HcY10KtkZXhjMRjPslETFeveFEDFCM=";
+    hash = "sha256-dXJbVXa/urMUL6YSVhQWcC3UMhv8uouaF8SQ39GdB1E=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-n5qIlkLvRpIeCG2rr1N0s7n3PTUOesg6PHqIppSaqiM=";
+    hash = "sha256-ED8dDz5dHkiqbbzD+Q3Zk71Xck7SAdkt9enPgwzpWuQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyfireservicerota/default.nix b/pkgs/development/python-modules/pyfireservicerota/default.nix
index 98dbc50387df..1cc7afb19d5f 100644
--- a/pkgs/development/python-modules/pyfireservicerota/default.nix
+++ b/pkgs/development/python-modules/pyfireservicerota/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pyfireservicerota";
-  version = "0.0.47";
+  version = "0.0.48";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cyberjunky";
     repo = "python-fireservicerota";
     tag = version;
-    hash = "sha256-2pCv/9VwGUDS5wFdJCxOevl7vWg+iXInI/xY3jPp7BM=";
+    hash = "sha256-wHcIzhSofp8dwlPy35gOJwIM0wtWPqUx7/kg6NjfNhc=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/pyvista/default.nix b/pkgs/development/python-modules/pyvista/default.nix
index 361e70c452f2..7f8617da10e1 100644
--- a/pkgs/development/python-modules/pyvista/default.nix
+++ b/pkgs/development/python-modules/pyvista/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pyvista";
-  version = "0.48.2";
+  version = "0.48.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyvista";
     repo = "pyvista";
     tag = "v${version}";
-    hash = "sha256-tXTDZ1htOGTrdiqbCyMiCQz44lHN5ruqW6bWkc3G2CI=";
+    hash = "sha256-VF84EMS/FnLl0y1LpWaYosyG0qEWI/QghZQq32ktlLg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tpm2-pytss/default.nix b/pkgs/development/python-modules/tpm2-pytss/default.nix
index dbefc00be8c3..9c1fa30570b7 100644
--- a/pkgs/development/python-modules/tpm2-pytss/default.nix
+++ b/pkgs/development/python-modules/tpm2-pytss/default.nix
@@ -45,6 +45,13 @@ buildPythonPackage rec {
       url = "https://github.com/tpm2-software/tpm2-pytss/commit/6ab4c74e6fb3da7cd38e97c1f8e92532312f8439.patch";
       hash = "sha256-01Qe4qpD2IINc5Z120iVdPitiLBwdr8KNBjLFnGgE7E=";
     })
+    # support cryptography >= 47.0.0, which made __deepcopy__ an abstract
+    # method on the private-key base classes
+    # https://github.com/tpm2-software/tpm2-pytss/pull/689
+    (fetchpatch {
+      url = "https://github.com/tpm2-software/tpm2-pytss/commit/5d15cad4bde28902a4becb8e2a8e915aba8abbd0.patch";
+      hash = "sha256-b2zVD7KJGVzJ765HO8LFAe9MyQmjOTpERmEqUrIg3oM=";
+    })
     # Properly restore environment variables upon exit from
     # FAPIConfig context. Accepted into upstream, not yet released.
     (fetchpatch2 {
diff --git a/pkgs/development/tools/continuous-integration/buildbot/master.nix b/pkgs/development/tools/continuous-integration/buildbot/master.nix
index 9d08e76e3768..8be52f704a3c 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/master.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/master.nix
@@ -85,14 +85,13 @@ buildPythonApplication rec {
     hash = "sha256-yUtOJRI04/clCMImh5sokpj6MeBIXjEAdf9xnToqJZs=";
   };
 
-  build-system = [
-  ];
+  build-system = [ setuptools ];
 
   pythonRelaxDeps = [
     "twisted"
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     # core
     twisted
     jinja2
@@ -105,7 +104,6 @@ buildPythonApplication rec {
     autobahn
     pyjwt
     pyyaml
-    setuptools
     croniter
     importlib-resources
     packaging
diff --git a/pkgs/development/tools/continuous-integration/buildbot/pkg.nix b/pkgs/development/tools/continuous-integration/buildbot/pkg.nix
index fccabdead3cb..71a79c8132e3 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/pkg.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/pkg.nix
@@ -1,14 +1,15 @@
 {
   lib,
   buildPythonPackage,
+  setuptools,
   isPy3k,
   buildbot,
 }:
 
 buildPythonPackage {
-  format = "setuptools";
   pname = "buildbot_pkg";
   inherit (buildbot) src version;
+  pyproject = true;
 
   postPatch = ''
     cd pkg
@@ -17,6 +18,8 @@ buildPythonPackage {
     substituteInPlace buildbot_pkg.py --replace "os.listdir = listdir" ""
   '';
 
+  build-system = [ setuptools ];
+
   # No tests
   doCheck = false;
 
diff --git a/pkgs/development/tools/continuous-integration/buildbot/plugins.nix b/pkgs/development/tools/continuous-integration/buildbot/plugins.nix
index c9997553f75a..ccc4b9ecfbfc 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/plugins.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/plugins.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchurl,
-  callPackage,
+  setuptools,
   mock,
   cairosvg,
   klein,
@@ -13,9 +13,9 @@
   # this is exposed for potential plugins to use and for nix-update
   inherit buildbot-pkg;
   www = buildPythonPackage rec {
-    format = "setuptools";
     pname = "buildbot_www";
     inherit (buildbot-pkg) version;
+    pyproject = true;
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
@@ -27,7 +27,9 @@
       sed -i "s/'buildbot'//" setup.py
     '';
 
-    buildInputs = [
+    build-system = [ setuptools ];
+
+    dependencies = [
       buildbot-pkg
       mock
     ];
@@ -46,14 +48,16 @@
   console-view = buildPythonPackage rec {
     pname = "buildbot_console_view";
     inherit (buildbot-pkg) version;
-    format = "setuptools";
+    pyproject = true;
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
       hash = "sha256-VA6xqJBjD4XmQabTN8M+PLvfrG7Hq2ooxChtz2jAT8A=";
     };
 
-    buildInputs = [ buildbot-pkg ];
+    build-system = [ setuptools ];
+
+    dependencies = [ buildbot-pkg ];
 
     # No tests
     doCheck = false;
@@ -69,14 +73,16 @@
   waterfall-view = buildPythonPackage rec {
     pname = "buildbot_waterfall_view";
     inherit (buildbot-pkg) version;
-    format = "setuptools";
+    pyproject = true;
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
       hash = "sha256-c/Nmr0Uscalnndq72Y6jPM1JDs5OyOCERtuX/GXkxp8=";
     };
 
-    buildInputs = [ buildbot-pkg ];
+    build-system = [ setuptools ];
+
+    dependencies = [ buildbot-pkg ];
 
     # No tests
     doCheck = false;
@@ -92,14 +98,16 @@
   grid-view = buildPythonPackage rec {
     pname = "buildbot_grid_view";
     inherit (buildbot-pkg) version;
-    format = "setuptools";
+    pyproject = true;
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
       hash = "sha256-AmY8RkFX0POmVpW71nNz4+dFbr0FHGhNR3RJymDNoaw=";
     };
 
-    buildInputs = [ buildbot-pkg ];
+    build-system = [ setuptools ];
+
+    dependencies = [ buildbot-pkg ];
 
     # No tests
     doCheck = false;
@@ -115,14 +123,16 @@
   wsgi-dashboards = buildPythonPackage rec {
     pname = "buildbot_wsgi_dashboards";
     inherit (buildbot-pkg) version;
-    format = "setuptools";
+    pyproject = true;
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
       hash = "sha256-vofKxpIfbAs7HR43Y7ojHLQEn6/WIdjZPgZieBMsz74=";
     };
 
-    buildInputs = [ buildbot-pkg ];
+    build-system = [ setuptools ];
+
+    dependencies = [ buildbot-pkg ];
 
     # No tests
     doCheck = false;
@@ -138,15 +148,17 @@
   badges = buildPythonPackage rec {
     pname = "buildbot_badges";
     inherit (buildbot-pkg) version;
-    format = "setuptools";
+    pyproject = true;
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
       hash = "sha256-u7HF6X+ClT4rT3LJcTHXWi5oSxCKPXoUDH+QFRI2S0w=";
     };
 
-    buildInputs = [ buildbot-pkg ];
-    propagatedBuildInputs = [
+    build-system = [ setuptools ];
+
+    dependencies = [
+      buildbot-pkg
       cairosvg
       klein
       jinja2
@@ -163,5 +175,4 @@
       license = lib.licenses.gpl2;
     };
   };
-
 }
diff --git a/pkgs/development/tools/continuous-integration/buildbot/worker.nix b/pkgs/development/tools/continuous-integration/buildbot/worker.nix
index 10eaa8933986..ad464fc47ebb 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/worker.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/worker.nix
@@ -7,6 +7,9 @@
   # patch
   coreutils,
 
+  # build system
+  setuptools,
+
   # propagates
   autobahn,
   msgpack,
@@ -15,7 +18,6 @@
   # tests
   parameterized,
   psutil,
-  setuptools-trial,
 
   # passthru
   nixosTests,
@@ -24,7 +26,7 @@
 buildPythonPackage {
   pname = "buildbot_worker";
   inherit (buildbot) src version;
-  format = "setuptools";
+  pyproject = true;
 
   postPatch = ''
     cd worker
@@ -33,11 +35,9 @@ buildPythonPackage {
       --replace /usr/bin/tail "${coreutils}/bin/tail"
   '';
 
-  nativeBuildInputs = [
-    setuptools-trial
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     autobahn
     msgpack
     twisted