diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index 9090eb17a965..7461992ec594 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -31,6 +31,10 @@ jobs:
             into: staging-next-24.11
           - from: staging-next-24.11
             into: staging-24.11
+          - from: master
+            into: staging-next-25.05
+          - from: staging-next-25.05
+            into: staging-25.05
           - from: master staging
             into: haskell-updates
     uses: ./.github/workflows/periodic-merge.yml
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
new file mode 100644
index 000000000000..95a1b1712f6b
--- /dev/null
+++ b/doc/release-notes/rl-2511.section.md
@@ -0,0 +1,37 @@
+# Nixpkgs 25.11 (2025.11/??) {#sec-nixpkgs-release-25.11}
+
+## Highlights {#sec-nixpkgs-release-25.11-highlights}
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Backward Incompatibilities {#sec-nixpkgs-release-25.11-incompatibilities}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Nixpkgs Library {#sec-nixpkgs-release-25.11-lib}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+### Breaking changes {#sec-nixpkgs-release-25.11-lib-breaking}
+
+- Create the first release note entry in this section!
+
+
+### Deprecations {#sec-nixpkgs-release-25.11-lib-deprecations}
+
+- Create the first release note entry in this section!
+
+
+### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}
+
+- Create the first release note entry in this section!
+
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f96cb396fbc3..410c1f61eb06 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -53,8 +53,7 @@
    More fields may be added in the future, however, in order to comply with GDPR this file should stay as minimal as possible.
 
    When editing this file:
-    * keep the list alphabetically sorted, check with:
-        nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix
+    * keep the list alphabetically sorted
     * test the validity of the format with:
         nix-build lib/tests/maintainers.nix
 
@@ -537,6 +536,12 @@
       }
     ];
   };
+  Acconut = {
+    email = "marius@transloadit.com";
+    github = "Acconut";
+    githubId = 1375043;
+    name = "Marius Kleidl";
+  };
   acesyde = {
     name = "Pierre-Emmanuel Mercier";
     email = "acesyde@gmail.com";
@@ -13423,6 +13428,12 @@
     githubId = 58425080;
     name = "Viktor Pocedulić";
   };
+  kvz = {
+    email = "kevin@transloadit.com";
+    github = "kvz";
+    githubId = 26752;
+    name = "Kevin van Zonneveld";
+  };
   kwaa = {
     name = "藍+85CD";
     email = "kwa@kwaa.dev";
@@ -26844,6 +26855,12 @@
     githubId = 15948162;
     name = "Yanni Papandreou";
   };
+  yarekt = {
+    name = "Yarek T";
+    email = "yarekt+nixpkgs@gmail.com";
+    github = "yarektyshchenko";
+    githubId = 185304;
+  };
   yarny = {
     github = "Yarny0";
     githubId = 41838844;
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
new file mode 100644
index 000000000000..1f710ccebb7f
--- /dev/null
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -0,0 +1,25 @@
+# Release 25.11 (2025.11/??) {#sec-release-25.11}
+
+## Highlights {#sec-release-25.11-highlights}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## New Modules {#sec-release-25.11-new-modules}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
+
+## Other Notable Changes {#sec-release-25.11-notable-changes}
+
+<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
+- Create the first release note entry in this section!
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index b0078c57335c..9fb36ff6e10f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -186,7 +186,6 @@
   ./programs/corefreq.nix
   ./programs/cpu-energy-meter.nix
   ./programs/criu.nix
-  ./programs/darling.nix
   ./programs/dconf.nix
   ./programs/digitalbitbox/default.nix
   ./programs/direnv.nix
@@ -1076,6 +1075,7 @@
   ./services/networking/bitlbee.nix
   ./services/networking/blockbook-frontend.nix
   ./services/networking/blocky.nix
+  ./services/networking/cato-client.nix
   ./services/networking/centrifugo.nix
   ./services/networking/cgit.nix
   ./services/networking/charybdis.nix
diff --git a/nixos/modules/programs/darling.nix b/nixos/modules/programs/darling.nix
deleted file mode 100644
index fc9a56e1165b..000000000000
--- a/nixos/modules/programs/darling.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.programs.darling;
-in
-{
-  options = {
-    programs.darling = {
-      enable = lib.mkEnableOption "Darling, a Darwin/macOS compatibility layer for Linux";
-      package = lib.mkPackageOption pkgs "darling" { };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    security.wrappers.darling = {
-      source = lib.getExe cfg.package;
-      owner = "root";
-      group = "root";
-      setuid = true;
-    };
-  };
-}
diff --git a/nixos/modules/services/admin/oxidized.nix b/nixos/modules/services/admin/oxidized.nix
index ad151c57666c..44b28991feab 100644
--- a/nixos/modules/services/admin/oxidized.nix
+++ b/nixos/modules/services/admin/oxidized.nix
@@ -11,6 +11,8 @@ in
   options.services.oxidized = {
     enable = lib.mkEnableOption "the oxidized configuration backup service";
 
+    package = lib.mkPackageOption pkgs "oxidized" { };
+
     user = lib.mkOption {
       type = lib.types.str;
       default = "oxidized";
@@ -70,7 +72,8 @@ in
     };
 
     routerDB = lib.mkOption {
-      type = lib.types.path;
+      type = lib.types.nullOr lib.types.path;
+      default = null;
       example = lib.literalExpression ''
         pkgs.writeText "oxidized-router.db" '''
           hostname-sw1:powerconnect:username1:password2
@@ -94,18 +97,57 @@ in
       isSystemUser = true;
     };
 
+    systemd.tmpfiles.settings."10-oxidized" =
+      {
+        "${cfg.dataDir}" = {
+          d = {
+            mode = "0750";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+
+        "${cfg.dataDir}/.config" = {
+          d = {
+            mode = "0750";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+
+        "${cfg.dataDir}/.config/oxidized" = {
+          d = {
+            mode = "0750";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+
+        "${cfg.dataDir}/.config/oxidized/config" = {
+          L = {
+            argument = "${cfg.configFile}";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+
+      }
+      // lib.optionalAttrs (cfg.routerDB != null) {
+        "${cfg.dataDir}/.config/oxidized/router.db" = {
+          L = {
+            argument = "${cfg.routerDB}";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+      };
+
     systemd.services.oxidized = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
 
-      preStart = ''
-        mkdir -p ${cfg.dataDir}/.config/oxidized
-        ln -f -s ${cfg.routerDB} ${cfg.dataDir}/.config/oxidized/router.db
-        ln -f -s ${cfg.configFile} ${cfg.dataDir}/.config/oxidized/config
-      '';
-
       serviceConfig = {
-        ExecStart = "${pkgs.oxidized}/bin/oxidized";
+        ExecStart = lib.getExe cfg.package;
         User = cfg.user;
         Group = cfg.group;
         UMask = "0077";
diff --git a/nixos/modules/services/networking/cato-client.nix b/nixos/modules/services/networking/cato-client.nix
new file mode 100644
index 000000000000..b9b31e0c5794
--- /dev/null
+++ b/nixos/modules/services/networking/cato-client.nix
@@ -0,0 +1,75 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib) mkIf mkEnableOption mkPackageOption;
+
+  cfg = config.services.cato-client;
+in
+{
+  options.services.cato-client = {
+    enable = mkEnableOption "cato-client service";
+    package = mkPackageOption pkgs "cato-client" { };
+  };
+
+  config = mkIf cfg.enable {
+    users = {
+      groups.cato-client = { };
+    };
+
+    environment.systemPackages = [
+      cfg.package
+    ];
+
+    systemd.services.cato-client = {
+      enable = true;
+      description = "Cato Networks Linux client - connects tunnel to Cato cloud";
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = "root"; # Note: daemon runs as root, tools sticky to group
+        Group = "cato-client";
+        ExecStart = "${cfg.package}/bin/cato-clientd systemd";
+        WorkingDirectory = "${cfg.package}";
+        Restart = "always";
+
+        # Cato client seems to do the following:
+        # - Look in each user's ~/.cato/ for configuration and keys
+        # - Write to /var/log/cato-client.log
+        # - Create and use sockets /var/run/cato-sdp.i, /var/run/cato-sdp.o
+        # - Read and Write to /opt/cato/ for runtime settings
+        # - Read /etc/systemd/resolved.conf (but fine if fails)
+        # - Restart systemd-resolved (also fine if doesn't exist)
+
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectSystem = true;
+      };
+
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    # set up Security wrapper Same as inteded in deb post install
+    security.wrappers.cato-clientd = {
+      source = "${cfg.package}/bin/cato-clientd";
+      owner = "root";
+      group = "cato-client";
+      permissions = "u+rwx,g+rwx"; # 770
+      setgid = true;
+    };
+
+    security.wrappers.cato-sdp = {
+      source = "${cfg.package}/bin/cato-sdp";
+      owner = "root";
+      group = "cato-client";
+      permissions = "u+rwx,g+rx,a+rx"; # 755
+      setgid = true;
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 50fb8a3119be..c2793c276fa4 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -373,7 +373,6 @@ in
   croc = handleTest ./croc.nix { };
   cross-seed = runTest ./cross-seed.nix;
   cyrus-imap = runTest ./cyrus-imap.nix;
-  darling = handleTest ./darling.nix { };
   darling-dmg = runTest ./darling-dmg.nix;
   dae = handleTest ./dae.nix { };
   davis = runTest ./davis.nix;
diff --git a/nixos/tests/darling.nix b/nixos/tests/darling.nix
deleted file mode 100644
index 8514aac918ed..000000000000
--- a/nixos/tests/darling.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-
-  let
-    # Well, we _can_ cross-compile from Linux :)
-    hello =
-      pkgs.runCommand "hello"
-        {
-          sdk = "${pkgs.darling.sdk}/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk";
-          nativeBuildInputs = with pkgs.llvmPackages_14; [
-            clang-unwrapped
-            lld
-          ];
-          src = pkgs.writeText "hello.c" ''
-            #include <stdio.h>
-            int main() {
-              printf("Hello, Darling!\n");
-              return 0;
-            }
-          '';
-        }
-        ''
-          clang \
-            -target x86_64-apple-darwin \
-            -fuse-ld=lld \
-            -nostdinc -nostdlib \
-            -mmacosx-version-min=10.15 \
-            --sysroot $sdk \
-            -isystem $sdk/usr/include \
-            -L $sdk/usr/lib -lSystem \
-            $src -o $out
-        '';
-  in
-  {
-    name = "darling";
-
-    meta.maintainers = with lib.maintainers; [ zhaofengli ];
-
-    nodes.machine = {
-      programs.darling.enable = true;
-    };
-
-    testScript = ''
-      start_all()
-
-      # Darling holds stdout until the server is shutdown
-      machine.succeed("darling ${hello} >hello.out")
-      machine.succeed("grep Hello hello.out")
-      machine.succeed("darling shutdown")
-    '';
-  }
-)
diff --git a/nixos/tests/nvidia-container-toolkit.nix b/nixos/tests/nvidia-container-toolkit.nix
index b22b989c0814..1b894a1cddd9 100644
--- a/nixos/tests/nvidia-container-toolkit.nix
+++ b/nixos/tests/nvidia-container-toolkit.nix
@@ -90,7 +90,10 @@ in
 {
   name = "nvidia-container-toolkit";
   meta = with lib.maintainers; {
-    maintainers = [ ereslibre ];
+    maintainers = [
+      ereslibre
+      christoph-heiss
+    ];
   };
   defaults =
     { config, ... }:
diff --git a/pkgs/README.md b/pkgs/README.md
index d1c5b1ceb525..1861729a1706 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -501,12 +501,12 @@ When using the `patches` parameter to `mkDerivation`, make sure the patch name c
 
 ### Fetching patches
 
-In the interest of keeping our maintenance burden and the size of Nixpkgs to a minimum, patches already merged upstream or published elsewhere _should_ be retrieved using `fetchpatch`:
+In the interest of keeping our maintenance burden and the size of Nixpkgs to a minimum, patches already merged upstream or published elsewhere _should_ be retrieved using `fetchpatch2`:
 
 ```nix
 {
   patches = [
-    (fetchpatch {
+    (fetchpatch2 {
       name = "fix-check-for-using-shared-freetype-lib.patch";
       url = "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/patch/?id=8f5d28536e4518716fdfe974e580194c8f57871d";
       hash = "sha256-uRcxaCjd+WAuGrXOmGfFeu79cUILwkRdBu48mwcBE7g=";
@@ -515,7 +515,7 @@ In the interest of keeping our maintenance burden and the size of Nixpkgs to a m
 }
 ```
 
-If a patch is available online but does not cleanly apply, it can be modified in some fixed ways by using additional optional arguments for `fetchpatch`. Check [the `fetchpatch` reference](https://nixos.org/manual/nixpkgs/unstable/#fetchpatch) for details.
+If a patch is available online but does not cleanly apply, it can be modified in some fixed ways by using additional optional arguments for `fetchpatch2`. Check [the `fetchpatch` reference](https://nixos.org/manual/nixpkgs/unstable/#fetchpatch) for details.
 
 When adding patches in this manner you should be reasonably sure that the used URL is stable. Patches referencing open pull requests will change when the PR is updated and code forges (such as GitHub) usually garbage collect commits that are no longer reachable due to rebases/amends.
 
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 28f6f297ade2..f31b0a5f3971 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -44,7 +44,6 @@ in
   lib,
   pkgs,
   stdenv,
-  fetchpatch,
   patchelf,
 
   # build time
@@ -77,6 +76,7 @@ in
   gnum4,
   gtk3,
   icu73,
+  icu77,
   libGL,
   libGLU,
   libevent,
@@ -328,6 +328,10 @@ buildStdenv.mkDerivation {
       rm -rf obj-x86_64-pc-linux-gnu
       patchShebangs mach build
     ''
+    # https://bugzilla.mozilla.org/show_bug.cgi?id=1927380
+    + lib.optionalString (lib.versionAtLeast version "134") ''
+      sed -i "s/icu-i18n/icu-uc &/" js/moz.configure
+    ''
     + extraPostPatch;
 
   # Ignore trivial whitespace changes in patches, this fixes compatibility of
@@ -467,13 +471,12 @@ buildStdenv.mkDerivation {
     ]
     ++ lib.optional (isElfhackPlatform stdenv) (enableFeature elfhackSupport "elf-hack")
     ++ lib.optional (!drmSupport) "--disable-eme"
-    ++ lib.optional (allowAddonSideload) "--allow-addon-sideload"
+    ++ lib.optional allowAddonSideload "--allow-addon-sideload"
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       # MacOS builds use bundled versions of libraries: https://bugzilla.mozilla.org/show_bug.cgi?id=1776255
       "--enable-system-pixman"
       "--with-system-ffi"
-      # Firefox 136 fails to link with our icu76.1
-      (lib.optionalString (lib.versionOlder version "136") "--with-system-icu")
+      "--with-system-icu"
       "--with-system-jpeg"
       "--with-system-libevent"
       "--with-system-libvpx"
@@ -557,7 +560,7 @@ buildStdenv.mkDerivation {
         xorg.xorgproto
         zlib
         (
-          if (lib.versionAtLeast version "116") then nss_latest else nss_esr # 3.90
+          if (lib.versionAtLeast version "129") then nss_latest else nss_esr # 3.90
         )
       ]
       ++ lib.optional alsaSupport alsa-lib
@@ -569,7 +572,7 @@ buildStdenv.mkDerivation {
         libdrm
       ]
     ))
-    ++ lib.optionals (lib.versionOlder version "136") [ icu73 ]
+    ++ [ (if (lib.versionAtLeast version "138") then icu77 else icu73) ]
     ++ lib.optional gssSupport libkrb5
     ++ lib.optional jemallocSupport jemalloc
     ++ extraBuildInputs;
diff --git a/pkgs/by-name/_1/_1password-gui-beta/package.nix b/pkgs/by-name/_1/_1password-gui-beta/package.nix
index 9c95e4f99039..e302dfbeab7b 100644
--- a/pkgs/by-name/_1/_1password-gui-beta/package.nix
+++ b/pkgs/by-name/_1/_1password-gui-beta/package.nix
@@ -1,4 +1,4 @@
-{ _1password-gui }:
+{ _1password-gui, ... }:
 _1password-gui.override {
   channel = "beta";
 }
diff --git a/pkgs/by-name/bs/bs-manager/depotdownloader/default.nix b/pkgs/by-name/bs/bs-manager/depotdownloader/default.nix
new file mode 100644
index 000000000000..da2e6bbea66c
--- /dev/null
+++ b/pkgs/by-name/bs/bs-manager/depotdownloader/default.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildDotnetModule,
+  fetchFromGitHub,
+  dotnetCorePackages,
+}:
+
+buildDotnetModule {
+  pname = "depotdownloader";
+  version = "2.7.4-unstable-2024-12-01";
+
+  src = fetchFromGitHub {
+    owner = "Iluhadesu";
+    repo = "DepotDownloader";
+    rev = "a9f58e5513b72bd00b623a83e1460b3c5db49248";
+    hash = "sha256-+QfwKQJzyXqUvTn8kKP7lYHvbtRtdJ7jc/W7E87tV7w=";
+  };
+
+  projectFile = "DepotDownloader.sln";
+  nugetDeps = ./deps.json;
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+
+  meta = {
+    description = "Fork of DepotDownloader to be used by BSManager";
+    license = lib.licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+    mainProgram = "DepotDownloader";
+  };
+}
diff --git a/pkgs/by-name/bs/bs-manager/depotdownloader/deps.json b/pkgs/by-name/bs/bs-manager/depotdownloader/deps.json
new file mode 100644
index 000000000000..85d09e76a9de
--- /dev/null
+++ b/pkgs/by-name/bs/bs-manager/depotdownloader/deps.json
@@ -0,0 +1,67 @@
+[
+  {
+    "pname": "Microsoft.NETCore.Platforms",
+    "version": "5.0.0",
+    "hash": "sha256-LIcg1StDcQLPOABp4JRXIs837d7z0ia6+++3SF3jl1c="
+  },
+  {
+    "pname": "Microsoft.Win32.Registry",
+    "version": "5.0.0",
+    "hash": "sha256-9kylPGfKZc58yFqNKa77stomcoNnMeERXozWJzDcUIA="
+  },
+  {
+    "pname": "Microsoft.Windows.CsWin32",
+    "version": "0.3.106",
+    "hash": "sha256-S1uQa684taPb6uh69784ebVpXoirMoX+pxBRA+Rrzlg="
+  },
+  {
+    "pname": "Microsoft.Windows.SDK.Win32Docs",
+    "version": "0.1.42-alpha",
+    "hash": "sha256-6DvzmNzrGVfWmNJNqooj+Ya+7bAQlyeg7pmyKaUlIws="
+  },
+  {
+    "pname": "Microsoft.Windows.SDK.Win32Metadata",
+    "version": "60.0.34-preview",
+    "hash": "sha256-KdRe73sXipzMvm2BLmwwBZGh+l9isZDC9l8WFyUR1zM="
+  },
+  {
+    "pname": "Microsoft.Windows.WDK.Win32Metadata",
+    "version": "0.11.4-experimental",
+    "hash": "sha256-b3oKUKbr+3Udfl7RWzUY9BR/XWNsN+VmEkBxk6KiFo0="
+  },
+  {
+    "pname": "protobuf-net",
+    "version": "3.2.30",
+    "hash": "sha256-keRy5OWT+/tlZt3D7x+9PEdjTvEJcZdYsf/i1ZBtciE="
+  },
+  {
+    "pname": "protobuf-net.Core",
+    "version": "3.2.30",
+    "hash": "sha256-GMpJNecoBfrV2VgpYOhcZnKZaLFDObNLcX2LBTThrwY="
+  },
+  {
+    "pname": "SteamKit2",
+    "version": "3.0.0-beta.4",
+    "hash": "sha256-7cXlpCuUD8ZuTMtqsT5MdklkZb+XIGBdoI28anjUXtg="
+  },
+  {
+    "pname": "System.Collections.Immutable",
+    "version": "7.0.0",
+    "hash": "sha256-9an2wbxue2qrtugYES9awshQg+KfJqajhnhs45kQIdk="
+  },
+  {
+    "pname": "System.IO.Hashing",
+    "version": "8.0.0",
+    "hash": "sha256-szOGt0TNBo6dEdC3gf6H+e9YW3Nw0woa6UnCGGGK5cE="
+  },
+  {
+    "pname": "System.Security.AccessControl",
+    "version": "5.0.0",
+    "hash": "sha256-ueSG+Yn82evxyGBnE49N4D+ngODDXgornlBtQ3Omw54="
+  },
+  {
+    "pname": "System.Security.Principal.Windows",
+    "version": "5.0.0",
+    "hash": "sha256-CBOQwl9veFkrKK2oU8JFFEiKIh/p+aJO+q9Tc2Q/89Y="
+  }
+]
diff --git a/pkgs/by-name/bs/bs-manager/package.nix b/pkgs/by-name/bs/bs-manager/package.nix
index 207934fe86c9..1c5974b429f8 100644
--- a/pkgs/by-name/bs/bs-manager/package.nix
+++ b/pkgs/by-name/bs/bs-manager/package.nix
@@ -1,87 +1,143 @@
 {
-  asar,
-  autoPatchelfHook,
-  dpkg,
-  electron,
-  fetchurl,
   lib,
-  makeWrapper,
-  nix-update-script,
-  openssl,
   stdenv,
-  zlib,
+  callPackage,
+  nix-update-script,
+
+  buildNpmPackage,
+  fetchNpmDeps,
+  fetchFromGitHub,
+  makeDesktopItem,
+
+  autoPatchelfHook,
+  copyDesktopItems,
+  makeWrapper,
+
+  electron,
+  steam-run-free,
 }:
-stdenv.mkDerivation (finalAttrs: {
+
+buildNpmPackage (finalAttrs: {
   pname = "bs-manager";
-  version = "1.5.2";
+  version = "1.5.3";
 
-  src =
-    if stdenv.hostPlatform.system == "x86_64-linux" then
-      fetchurl {
-        url = "https://github.com/Zagrios/bs-manager/releases/download/v1.5.2/bs-manager_1.5.2_amd64.deb";
-        hash = "sha256-rNqnEez56t4TPIKhljC0HEams2xhj6nB3CGW0CuQBKQ=";
-      }
-    else
-      throw "BSManager is not available for your platform";
+  src = fetchFromGitHub {
+    owner = "Zagrios";
+    repo = "bs-manager";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-thqz6sFmov5py7mUBYUC6ANBgjnNFC1hfLEsaxJVYu8=";
+  };
 
-  # TODO: Package BSManager's fork of DepotDownloader and replace vendored binary at $out/opt/BSManager/resources/assets/scripts/DepotDownloader
-  # See https://github.com/Iluhadesu/DepotDownloader
+  patches = [
+    # https://github.com/Zagrios/bs-manager/pull/870
+    ./use-steam-run-for-wine.patch
+  ];
+
+  postPatch = ''
+    # don't search for resources in electron's resource directory, but our own
+    substituteInPlace src/main/services/utils.service.ts \
+      --replace-fail "process.resourcesPath" "'$out/share/bs-manager/resources'"
+
+    # replace vendored DepotDownloader with our own
+    rm assets/scripts/DepotDownloader
+    ln -s ${finalAttrs.passthru.depotdownloader}/bin/DepotDownloader assets/scripts/DepotDownloader
+  '';
+
+  npmDepsHash = "sha256-VsCbz7ImDnJ0tonVhA4lOPA0w//tqF4hLhrReLUqYI8=";
+
+  extraNpmDeps = fetchNpmDeps {
+    name = "bs-manager-${finalAttrs.version}-extra-npm-deps";
+    inherit (finalAttrs) src;
+    sourceRoot = "${finalAttrs.src.name}/release/app";
+    hash = "sha256-JqDsv9kvYnbJdNwXN1EbppSrFVqr2cSnVhV2+8uw54g=";
+  };
+
+  makeCacheWritable = true;
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  npmRebuildFlags = [ "--ignore-scripts" ];
 
   nativeBuildInputs = [
-    asar
-    autoPatchelfHook # for vendored DepotDownloader
-    dpkg
+    autoPatchelfHook # for some prebuilt node deps: query-process @resvg/resvg-js
+    copyDesktopItems
     makeWrapper
   ];
 
   buildInputs = [
     stdenv.cc.cc
-    zlib
   ];
 
-  # DepotDownloader dlopen()s libssl
-  runtimeDependencies = [
-    (lib.getLib openssl)
-  ];
+  preBuild = ''
+    pushd release/app
 
-  dontConfigure = true;
-  dontBuild = true;
+    rm -r "$npm_config_cache"
+    npmDeps="$extraNpmDeps" npmConfigHook
+    npm run postinstall
+
+    popd
+  '';
+
+  postBuild = ''
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    npm exec electron-builder -- \
+      --dir \
+      --config=electron-builder.config.js \
+      -c.electronDist=electron-dist \
+      -c.electronVersion=${electron.version}
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/opt/BSManager
-    cp -r opt/BSManager/{locales,resources} $out/opt/BSManager
-    cp -Tr usr/ $out
+    for icon in build/icons/png/*.png; do
+      install -Dm644 $icon $out/share/icons/hicolor/$(basename $icon .png)/apps/bs-manager.png
+    done
 
-    # Some assets aren't included in the asar bundle. BSManager relies on
-    # process.resourcesPath to load some of these assets which we have to patch later
-    asar extract $out/opt/BSManager/resources/app.asar $out/opt/BSManager/resources
-    rm $out/opt/BSManager/resources/app.asar
+    mkdir -p $out/share/bs-manager
+    cp -r release/build/*-unpacked/{locales,resources{,.pak}} $out/share/bs-manager
 
-    # Update desktop Exec entry
-    substituteInPlace $out/share/applications/bs-manager.desktop \
-      --replace-fail Exec=/opt/BSManager/bs-manager Exec=bs-manager
-
-    mkdir -p $out/bin
     makeWrapper ${lib.getExe electron} $out/bin/bs-manager \
       --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
-      --add-flags $out/opt/BSManager/resources \
+      --add-flags $out/share/bs-manager/resources/app.asar \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --prefix PATH : ${lib.makeBinPath [ steam-run-free ]} \
       --inherit-argv0
 
     runHook postInstall
   '';
 
-  preFixup = ''
-    substituteInPlace "$out/opt/BSManager/resources/dist/main/main.js" \
-      --replace-fail "process.resourcesPath" "'$out/opt/BSManager/resources'"
-  '';
+  desktopItems = [
+    (makeDesktopItem {
+      desktopName = "BSManager";
+      name = "BSManager";
+      exec = "bs-manager";
+      terminal = false;
+      type = "Application";
+      icon = "bs-manager";
+      mimeTypes = [
+        "x-scheme-handler/bsmanager"
+        "x-scheme-handler/beatsaver"
+        "x-scheme-handler/bsplaylist"
+        "x-scheme-handler/modelsaber"
+        "x-scheme-handler/web+bsmap"
+      ];
+      categories = [
+        "Utility"
+        "Game"
+      ];
+    })
+  ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    depotdownloader = callPackage ./depotdownloader { };
+  };
 
   meta = {
-    changelog = "https://github.com/Zagrios/bs-manager/blob/master/CHANGELOG.md";
+    changelog = "https://github.com/Zagrios/bs-manager/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     description = "Your Beat Saber Assistant";
     homepage = "https://github.com/Zagrios/bs-manager";
     license = lib.licenses.gpl3Only;
@@ -89,8 +145,12 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       mistyttm
       Scrumplex
+      ImSapphire
+      tomasajt
+    ];
+    platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [
+      binaryNativeCode # prebuilt node deps
     ];
-    platforms = [ "x86_64-linux" ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 })
diff --git a/pkgs/by-name/bs/bs-manager/use-steam-run-for-wine.patch b/pkgs/by-name/bs/bs-manager/use-steam-run-for-wine.patch
new file mode 100644
index 000000000000..1335a20877b7
--- /dev/null
+++ b/pkgs/by-name/bs/bs-manager/use-steam-run-for-wine.patch
@@ -0,0 +1,40 @@
+diff --git a/src/main/services/linux.service.ts b/src/main/services/linux.service.ts
+index 7f92bed..5f12896 100644
+--- a/src/main/services/linux.service.ts
++++ b/src/main/services/linux.service.ts
+@@ -129,12 +129,7 @@ export class LinuxService {
+         return fs.pathExistsSync(protonPath) && fs.pathExistsSync(winePath);
+     }
+ 
+-    public async getWinePath(): Promise<string> {
+-        if (await this.isNixOS()) {
+-            // Use system wine for nixos
+-            return "wine";
+-        }
+-
++    public getWinePath(): string {
+         if (!this.staticConfig.has("proton-folder")) {
+             throw new Error("proton-folder variable not set");
+         }
+diff --git a/src/main/services/mods/bs-mods-manager.service.ts b/src/main/services/mods/bs-mods-manager.service.ts
+index c842fda..60cc190 100644
+--- a/src/main/services/mods/bs-mods-manager.service.ts
++++ b/src/main/services/mods/bs-mods-manager.service.ts
+@@ -162,12 +162,15 @@ export class BsModsManagerService {
+         let winePath: string = "";
+         if (process.platform === "linux") {
+             const { error: winePathError, result: winePathResult } =
+-                await tryit(async () => this.linuxService.getWinePath());
++                tryit(() => this.linuxService.getWinePath());
+             if (winePathError) {
+                 log.error(winePathError);
+                 return false;
+             }
+-            winePath = `"${winePathResult}"`;
++
++            winePath = await this.linuxService.isNixOS()
++                ? `steam-run "${winePathResult}"`
++                : `"${winePathResult}"`;
+ 
+             const winePrefix = this.linuxService.getWinePrefixPath();
+             if (!winePrefix) {
diff --git a/pkgs/by-name/ca/cato-client/package.nix b/pkgs/by-name/ca/cato-client/package.nix
new file mode 100644
index 000000000000..74dc3ab7eb8b
--- /dev/null
+++ b/pkgs/by-name/ca/cato-client/package.nix
@@ -0,0 +1,69 @@
+{
+  stdenv,
+  fetchurl,
+  writeScript,
+  autoPatchelfHook,
+  dpkg,
+  libz,
+  lib,
+}:
+stdenv.mkDerivation rec {
+  pname = "cato-client";
+  version = "5.2.1.1";
+
+  src = fetchurl {
+    url = "https://clients.catonetworks.com/linux/${version}/cato-client-install.deb";
+    sha256 = "sha256-0hUchaxaiKJth2ByQMFfjsCLi/4kl+SrNSQ33Y6r3WA=";
+  };
+
+  passthru.updateScript = writeScript "update-cato-client" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl pcre2 common-updater-scripts
+
+    set -eu -o pipefail
+
+    version="$(curl -sI https://clientdownload.catonetworks.com/public/clients/cato-client-install.deb | grep -Fi 'Location:' | pcre2grep -o1 '/(([0-9]\.?)+)/')"
+    update-source-version cato-client "$version"
+  '';
+
+  dontConfigure = true;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+  ];
+
+  buildInputs = [
+    libz
+    stdenv.cc.cc
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+    dpkg -x $src source
+    cd source
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir $out
+
+    mv usr/lib $out/lib
+
+    mkdir -p $out/bin
+    mv usr/sbin/* $out/bin
+    mv usr/bin/* $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Lightweight agent that provides secure zero-trust access to resources everywhere";
+    homepage = "https://www.catonetworks.com/platform/cato-client/";
+    mainProgram = "cato-sdp";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ yarekt ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/by-name/cf/cfripper/package.nix b/pkgs/by-name/cf/cfripper/package.nix
index 0826b2919953..2f9958f05417 100644
--- a/pkgs/by-name/cf/cfripper/package.nix
+++ b/pkgs/by-name/cf/cfripper/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cfripper";
-  version = "1.17.0";
+  version = "1.17.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "cfripper";
     tag = "v${version}";
-    hash = "sha256-xmCI+rM8Ijj66Df6H5WFpxTDkKqW5CPwXh+w/Qaqooc=";
+    hash = "sha256-qAsIm1mcvMQshKActmFZuxgH3Yyzvw6m7e8DklG1AQ4=";
   };
 
   pythonRelaxDeps = [
@@ -62,7 +62,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = with lib; {
     description = "Tool for analysing CloudFormation templates";
     homepage = "https://github.com/Skyscanner/cfripper";
-    changelog = "https://github.com/Skyscanner/cfripper/releases/tag/v${version}";
+    changelog = "https://github.com/Skyscanner/cfripper/releases/tag/${src.tag}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
     mainProgram = "cfripper";
diff --git a/pkgs/by-name/cn/cntb/package.nix b/pkgs/by-name/cn/cntb/package.nix
index 2058ba3fc98f..9532011b9db7 100644
--- a/pkgs/by-name/cn/cntb/package.nix
+++ b/pkgs/by-name/cn/cntb/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "cntb";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "contabo";
     repo = "cntb";
     rev = "v${version}";
-    hash = "sha256-4QS1fkXVcGxhZDPRLDc0xKl4jr8W4og/Qf591i3gzxk=";
+    hash = "sha256-chO59HBpMXXFMIt+7UjUxE3WtzUak8VhD/ahEXT5l/k=";
     # docs contains two files with the same name but different cases,
     # this leads to a different hash on case insensitive filesystems (e.g. darwin)
     # https://github.com/contabo/cntb/issues/34
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-LOGSllVQ28bXaqHXEv1Zd1vcTRZTZ5wy+gSQv1JWKMU=";
+  vendorHash = "sha256-D0B1a2qbTGpAK1PkB+wqsReft14/SoKY3/I6k+pB2D0=";
 
   ldflags = [
     "-X contabo.com/cli/cntb/cmd.version=${src.rev}"
diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index 30777342646c..bc307ee5d9ed 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit";
-  version = "337";
+  version = "338";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     tag = finalAttrs.version;
-    hash = "sha256-49ijtHUP0Z1ZfiydFfDlEv290yBVDo8ZsBktokdDu8I=";
+    hash = "sha256-ZNvMLzkDh1SuyHuChWM0YykSYu152JHvjrKVm+u0Upw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/da/darling/package.nix b/pkgs/by-name/da/darling/package.nix
deleted file mode 100644
index 2a161397bca2..000000000000
--- a/pkgs/by-name/da/darling/package.nix
+++ /dev/null
@@ -1,267 +0,0 @@
-{
-  clangStdenv,
-  lib,
-  runCommandWith,
-  writeShellScript,
-  fetchFromGitHub,
-  fetchpatch,
-  nixosTests,
-
-  freetype,
-  libjpeg,
-  libpng,
-  libtiff,
-  giflib,
-  libX11,
-  libXext,
-  libXrandr,
-  libXcursor,
-  libxkbfile,
-  cairo,
-  libglvnd,
-  fontconfig,
-  dbus,
-  libGLU,
-  fuse,
-  ffmpeg,
-  pulseaudio,
-
-  makeWrapper,
-  python2,
-  python3,
-  cmake,
-  ninja,
-  pkg-config,
-  bison,
-  flex,
-
-  libbsd,
-  openssl,
-
-  xdg-user-dirs,
-
-  addDriverRunpath,
-
-  # Whether to pre-compile Python 2 bytecode for performance.
-  compilePy2Bytecode ? false,
-}:
-let
-  stdenv = clangStdenv;
-
-  # The build system invokes clang to compile Darwin executables.
-  # In this case, our cc-wrapper must not be used.
-  ccWrapperBypass =
-    runCommandWith
-      {
-        inherit stdenv;
-        name = "cc-wrapper-bypass";
-        runLocal = false;
-        derivationArgs = {
-          template = writeShellScript "template" ''
-            for (( i=1; i<=$#; i++)); do
-              j=$((i+1))
-              if [[ "''${!i}" == "-target" && "''${!j}" == *"darwin"* ]]; then
-                # their flags must take precedence
-                exec @unwrapped@ "$@" $NIX_CFLAGS_COMPILE
-              fi
-            done
-            exec @wrapped@ "$@"
-          '';
-        };
-      }
-      ''
-        unwrapped_bin=${stdenv.cc.cc}/bin
-        wrapped_bin=${stdenv.cc}/bin
-
-        mkdir -p $out/bin
-
-        unwrapped=$unwrapped_bin/$CC wrapped=$wrapped_bin/$CC \
-          substituteAll $template $out/bin/$CC
-        unwrapped=$unwrapped_bin/$CXX wrapped=$wrapped_bin/$CXX \
-          substituteAll $template $out/bin/$CXX
-
-        chmod +x $out/bin/$CC $out/bin/$CXX
-      '';
-
-  wrappedLibs = [
-    # To find all of them: rg -w wrap_elf
-
-    # src/native/CMakeLists.txt
-    freetype
-    libjpeg
-    libpng
-    libtiff
-    giflib
-    libX11
-    libXext
-    libXrandr
-    libXcursor
-    libxkbfile
-    cairo
-    libglvnd
-    fontconfig
-    dbus
-    libGLU
-
-    # src/external/darling-dmg/CMakeLists.txt
-    fuse
-
-    # src/CoreAudio/CMakeLists.txt
-    ffmpeg
-    pulseaudio
-  ];
-in
-stdenv.mkDerivation {
-  pname = "darling";
-  version = "unstable-2024-02-03";
-
-  src = fetchFromGitHub {
-    owner = "darlinghq";
-    repo = "darling";
-    rev = "25afbc76428c39c3909e9efcf5caef1140425211";
-    fetchSubmodules = true;
-    hash = "sha256-z9IMgc5hH2Upn8wHl1OgP42q9HTSkeHnxB3N812A+Kc=";
-    # Remove 500MB of dependency test files to get under Hydra output limit
-    postFetch = ''
-      rm -r $out/src/external/openjdk/test
-      rm -r $out/src/external/libmalloc/tests
-      rm -r $out/src/external/libarchive/libarchive/tar/test
-    '';
-  };
-
-  outputs = [
-    "out"
-    "sdk"
-  ];
-
-  patches = [
-    # Fix 'clang: error: no such file or directory: .../signal/mach_excUser.c'
-    # https://github.com/darlinghq/darling/issues/1511
-    # https://github.com/darlinghq/darling/commit/f46eb721c11d32addd807f092f4b3a6ea515bb6d
-    (fetchpatch {
-      url = "https://github.com/darlinghq/darling/commit/f46eb721c11d32addd807f092f4b3a6ea515bb6d.patch?full_index=1";
-      hash = "sha256-FnLcHnK4cNto+E3OQSxE3iK+FHSU8y459FcpMvrzd6o=";
-    })
-
-    # Fix compatibility with ffmpeg_7
-    # https://github.com/darlinghq/darling/pull/1537
-    # https://github.com/darlinghq/darling/commit/9655d5598c87dcb22c54a83cc7741b77cb47a1b0
-    (fetchpatch {
-      url = "https://github.com/darlinghq/darling/commit/9655d5598c87dcb22c54a83cc7741b77cb47a1b0.patch?full_index=1";
-      hash = "sha256-ogMo4SRRwiOhaVJ+OS8BVolGDa7vGKyR9bdGiOiCuRc=";
-    })
-  ];
-
-  postPatch = ''
-    # We have to be careful - Patching everything indiscriminately
-    # would affect Darwin scripts as well
-    chmod +x src/external/bootstrap_cmds/migcom.tproj/mig.sh
-    patchShebangs \
-      src/external/bootstrap_cmds/migcom.tproj/mig.sh \
-      src/external/darlingserver/scripts \
-      src/external/openssl_certificates/scripts
-
-    substituteInPlace src/startup/CMakeLists.txt --replace SETUID ""
-    substituteInPlace src/external/basic_cmds/CMakeLists.txt --replace SETGID ""
-  '';
-
-  nativeBuildInputs = [
-    bison
-    ccWrapperBypass
-    cmake
-    flex
-    makeWrapper
-    ninja
-    pkg-config
-    python3
-  ] ++ lib.optional compilePy2Bytecode python2;
-  buildInputs = wrappedLibs ++ [
-    libbsd
-    openssl
-    stdenv.cc.libc.linuxHeaders
-  ];
-
-  # Breaks valid paths like
-  # Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include
-  dontFixCmake = true;
-
-  # src/external/objc4 forces OBJC_IS_DEBUG_BUILD=1, which conflicts with NDEBUG
-  # TODO: Fix in a better way
-  cmakeBuildType = " ";
-
-  cmakeFlags = [
-    "-DTARGET_i386=OFF"
-    "-DCOMPILE_PY2_BYTECODE=${if compilePy2Bytecode then "ON" else "OFF"}"
-    "-DDARLINGSERVER_XDG_USER_DIR_CMD=${xdg-user-dirs}/bin/xdg-user-dir"
-  ];
-
-  env.NIX_CFLAGS_COMPILE = "-Wno-macro-redefined -Wno-unused-command-line-argument";
-
-  # Linux .so's are dlopen'd by wrapgen during the build
-  env.LD_LIBRARY_PATH = lib.makeLibraryPath wrappedLibs;
-
-  # Breaks shebangs of Darwin scripts
-  dontPatchShebangs = true;
-
-  postInstall = ''
-    # Install the SDK as a separate output
-    mkdir -p $sdk
-
-    sdkDir=$(readlink -f ../Developer)
-
-    while read -r path; do
-      dst="$sdk/Developer/''${path#$sdkDir}"
-
-      if [[ -L "$path" ]]; then
-        target=$(readlink -m "$path")
-        if [[ -e "$target" && "$target" == "$NIX_BUILD_TOP"* && "$target" != "$sdkDir"* ]]; then
-          # dereference
-          cp -r -L "$path" "$dst"
-        elif [[ -e "$target" ]]; then
-          # preserve symlink
-          cp -d "$path" "$dst"
-        else
-          # ignore symlink
-          >&2 echo "Ignoring symlink $path -> $target"
-        fi
-      elif [[ -f $path ]]; then
-        cp "$path" "$dst"
-      elif [[ -d $path ]]; then
-        mkdir -p "$dst"
-      fi
-    done < <(find $sdkDir)
-
-    mkdir -p $sdk/bin
-    cp src/external/cctools-port/cctools/ld64/src/*-ld $sdk/bin
-    cp src/external/cctools-port/cctools/ar/*-{ar,ranlib} $sdk/bin
-  '';
-
-  postFixup = ''
-    echo "Checking for references to $NIX_STORE in Darling root..."
-
-    set +e
-    grep -r --exclude=mldr "$NIX_STORE" $out/libexec/darling
-    ret=$?
-    set -e
-
-    if [[ $ret == 0 ]]; then
-      echo "Found references to $NIX_STORE in Darling root (see above)"
-      exit 1
-    fi
-
-    patchelf --add-rpath "${lib.makeLibraryPath wrappedLibs}:${addDriverRunpath.driverLink}/lib" \
-      $out/libexec/darling/usr/libexec/darling/mldr
-  '';
-
-  passthru.tests.nixos = nixosTests.darling;
-
-  meta = with lib; {
-    description = "Open-source Darwin/macOS emulation layer for Linux";
-    homepage = "https://www.darlinghq.org";
-    changelog = "https://github.com/darlinghq/darling/releases";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ zhaofengli ];
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "darling";
-  };
-}
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
index 7c37f05d299b..63268de79e2b 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "TypeScript/JavaScript code formatter.";
-  hash = "sha256-Nvgd5d4aHJ07OXDlpelymS/f0N1cF8GQH4o4fCilb2g=";
+  hash = "sha256-IHbpEwTATwAmVa/ihGjQzQL/WwWo8owslJtWYUjVF+g=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "typescript";
@@ -16,6 +16,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-typescript";
   updateUrl = "https://plugins.dprint.dev/dprint/typescript/latest.json";
-  url = "https://plugins.dprint.dev/typescript-0.95.0.wasm";
-  version = "0.95.0";
+  url = "https://plugins.dprint.dev/typescript-0.95.1.wasm";
+  version = "0.95.1";
 }
diff --git a/pkgs/by-name/el/elfdeps/package.nix b/pkgs/by-name/el/elfdeps/package.nix
new file mode 100644
index 000000000000..045faa19eb13
--- /dev/null
+++ b/pkgs/by-name/el/elfdeps/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3Packages,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "elfdeps";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "python-wheel-build";
+    repo = "elfdeps";
+    tag = "v${version}";
+    hash = "sha256-5CrxVmtZcBYBMXw7o58CpFopYFgXD4W/S42aow1z1Xw=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [ python3Packages.pyelftools ];
+
+  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
+
+  pythonImportsCheck = [
+    "elfdeps"
+  ];
+
+  preCheck = ''
+    export PATH=$PATH:$out/bin
+  '';
+
+  # tests assume that sys.executable is an ELF object
+  doCheck = stdenv.hostPlatform.isElf;
+
+  disabledTests = [
+    # Attempts to zip sys.executable and fails with:
+    # ValueError: ZIP does not support timestamps before 1980
+    "test_main_zipfile"
+    "test_zipmember_python"
+  ];
+
+  meta = {
+    description = "Python implementation of RPM elfdeps";
+    homepage = "https://pypi.org/project/elfdeps/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ booxter ];
+    mainProgram = "elfdeps";
+  };
+}
diff --git a/pkgs/by-name/fr/freerdp/package.nix b/pkgs/by-name/fr/freerdp/package.nix
index 91b50105ce87..e6bbb2fed073 100644
--- a/pkgs/by-name/fr/freerdp/package.nix
+++ b/pkgs/by-name/fr/freerdp/package.nix
@@ -62,13 +62,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerdp";
-  version = "3.14.1";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = finalAttrs.version;
-    hash = "sha256-3hBssoD6l0d1DC5SRhE7HQlcoxNPjz3G8jbQx2rzp60=";
+    hash = "sha256-xz1vP58hElXe/jLVrJOSpXcbqShBV7LHRpzqPLa2fDU=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/fr/fromager/package.nix b/pkgs/by-name/fr/fromager/package.nix
new file mode 100644
index 000000000000..76ce0dd60272
--- /dev/null
+++ b/pkgs/by-name/fr/fromager/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "fromager";
+  version = "0.46.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "python-wheel-build";
+    repo = "fromager";
+    tag = version;
+    hash = "sha256-SBb5gWV8/t3oRAR2R5T72DW1LKrxXXH6yho9l7agsNI=";
+  };
+
+  build-system = with python3.pkgs; [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = with python3.pkgs; [
+    click
+    elfdeps
+    html5lib
+    packaging
+    pkginfo
+    psutil
+    pydantic
+    pyproject-hooks
+    pyyaml
+    requests
+    resolvelib
+    rich
+    setuptools
+    stevedore
+    tomlkit
+    tqdm
+    virtualenv
+    wheel
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+    requests-mock
+    twine
+  ];
+
+  pythonImportsCheck = [
+    "fromager"
+  ];
+
+  meta = {
+    description = "Wheel maker";
+    homepage = "https://pypi.org/project/fromager/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ booxter ];
+    mainProgram = "fromager";
+  };
+}
diff --git a/pkgs/by-name/fz/fzf-git-sh/package.nix b/pkgs/by-name/fz/fzf-git-sh/package.nix
index ef77e5f3c9de..7b1468af3ba1 100644
--- a/pkgs/by-name/fz/fzf-git-sh/package.nix
+++ b/pkgs/by-name/fz/fzf-git-sh/package.nix
@@ -13,6 +13,7 @@
   gnused,
   util-linux,
   xdg-utils,
+  zsh,
   unstableGitUpdater,
 }:
 
@@ -44,6 +45,7 @@ stdenv.mkDerivation rec {
       -e "s,\bsed\b,${gnused}/bin/sed," \
       -e "s,\bxargs\b,${findutils}/bin/xargs," \
       -e "s,\bxdg-open\b,${xdg-utils}/bin/xdg-open," \
+      -e "s,\bzsh\b,${zsh}/bin/zsh," \
       -e "/display-message\|fzf-git-\$o-widget\|\burl=\|\$remote_url =~ /!s,\bgit\b,${git}/bin/git,g" \
       -e "s,__fzf_git=.*BASH_SOURCE.*,__fzf_git=$out/share/${pname}/fzf-git.sh," \
       -e "/__fzf_git=.*readlink.*/d" \
diff --git a/pkgs/by-name/ga/gale/package.nix b/pkgs/by-name/ga/gale/package.nix
index 9c87c8b7a52d..fed9a69180a8 100644
--- a/pkgs/by-name/ga/gale/package.nix
+++ b/pkgs/by-name/ga/gale/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gale";
-  version = "1.5.6";
+  version = "1.5.12";
 
   src = fetchFromGitHub {
     owner = "Kesomannen";
     repo = "gale";
     tag = finalAttrs.version;
-    hash = "sha256-YNTmREWSsXjQ8S2bM9JTsoTdPCmPnmt/svhTOoUFEs4=";
+    hash = "sha256-5iJ04/q/emPwG0ILurFx2gNlXkZrfP2D6xv25AIlhfc=";
   };
 
   postPatch = ''
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
-    hash = "sha256-EFP2Lwqg2bFaSCXXDPIAF6nfeV7/CH3XgI9fzxE+veA=";
+    hash = "sha256-yaPUNtlb2vMwK42u+3/rViGx6YzhYxRDJylPu++tbNs=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       cargoRoot
       ;
-    hash = "sha256-AsViBPdXNzQBnN3Vv8ojfdG7fvy5DN3FiQHTzdLmxyQ=";
+    hash = "sha256-GGH5kQlnYIlKbTAKbF275mH4J9BcbcBHSdzP7RgfDwk=";
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/gi/git-town/package.nix b/pkgs/by-name/gi/git-town/package.nix
index c6c6798a8cbf..95bcf73dcdd4 100644
--- a/pkgs/by-name/gi/git-town/package.nix
+++ b/pkgs/by-name/gi/git-town/package.nix
@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "git-town";
-  version = "19.0.0";
+  version = "20.1.0";
 
   src = fetchFromGitHub {
     owner = "git-town";
     repo = "git-town";
     tag = "v${version}";
-    hash = "sha256-To+WtPkMbVDuUBaOkemua9i7WOs/X214YunWtbKt02Y=";
+    hash = "sha256-RoSLRGi//vk/jp/6rxI//cKdeoNL8nI73ZdeRKDesfs=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/go/gopher/int_main.patch b/pkgs/by-name/go/gopher/int_main.patch
new file mode 100644
index 000000000000..07024525b309
--- /dev/null
+++ b/pkgs/by-name/go/gopher/int_main.patch
@@ -0,0 +1,13 @@
+diff --git a/configure b/configure
+index 1b20711..79ce215 100644
+--- a/configure
++++ b/configure
+@@ -679,7 +679,7 @@ cat > conftest.$ac_ext << EOF
+ #line 680 "configure"
+ #include "confdefs.h"
+ 
+-main(){return(0);}
++int main(){return(0);}
+ EOF
+ if { (eval echo configure:685: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then
+   ac_cv_prog_cc_works=yes
diff --git a/pkgs/by-name/go/gopher/package.nix b/pkgs/by-name/go/gopher/package.nix
index adf5420fb72f..a2a0c04d82c8 100644
--- a/pkgs/by-name/go/gopher/package.nix
+++ b/pkgs/by-name/go/gopher/package.nix
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
 
+  patches = [
+    ./int_main.patch # https://github.com/jgoerzen/gopher/pull/8
+  ];
+
   preConfigure = "export LIBS=-lncurses";
 
   meta = with lib; {
diff --git a/pkgs/by-name/ho/homebox/package.nix b/pkgs/by-name/ho/homebox/package.nix
index 5df79e2f4928..951a2f8a29d6 100644
--- a/pkgs/by-name/ho/homebox/package.nix
+++ b/pkgs/by-name/ho/homebox/package.nix
@@ -11,18 +11,18 @@
 }:
 let
   pname = "homebox";
-  version = "0.18.0";
+  version = "0.19.0";
   src = fetchFromGitHub {
     owner = "sysadminsmedia";
     repo = "homebox";
     rev = "v${version}";
-    hash = "sha256-6iNlx0lBVU/awUZHqRYFKe84D86EJNFF7Nm1XChs75w=";
+    hash = "sha256-98V2JnxHnMkW8YD8QekNgKeh9aPp0mcosmGh07GAFaU=";
   };
 in
 buildGo123Module {
   inherit pname version src;
 
-  vendorHash = "sha256-TxuydZjlT8Y4BB77Z8Tyn8j0SPTU2O12TNm9PQGZXTw=";
+  vendorHash = "sha256-SkfYNOyRlcUSfga0g8o7yIvxgdL9SMxgVgRjIcPru0A=";
   modRoot = "backend";
   # the goModules derivation inherits our buildInputs and buildPhases
   # Since we do pnpm thing in those it fails if we don't explicitly remove them
@@ -38,7 +38,7 @@ buildGo123Module {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version;
     src = "${src}/frontend";
-    hash = "sha256-NjuthspxojlrCofAj4Egre8s5PG7vvPJW5mzrvAW4TQ=";
+    hash = "sha256-6Q+tIY5dl5jCQyv1F8btLdJg0oEUGs0Wyu/joVdVhf8=";
   };
   pnpmRoot = "../frontend";
 
diff --git a/pkgs/by-name/hw/hwloc/package.nix b/pkgs/by-name/hw/hwloc/package.nix
index d843361fd874..bbf0e11f2b7b 100644
--- a/pkgs/by-name/hw/hwloc/package.nix
+++ b/pkgs/by-name/hw/hwloc/package.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "hwloc";
-  version = "2.12.0";
+  version = "2.12.1";
 
   src = fetchurl {
     url = "https://www.open-mpi.org/software/hwloc/v${lib.versions.majorMinor version}/downloads/hwloc-${version}.tar.bz2";
-    hash = "sha256-BqCivcClcU6DkWRoOEag6TaoliE3WOnTfkniMricWNQ=";
+    hash = "sha256-OKkDKLuGJZ+bsv4dxX/YQeER0eY1gBK+8j39ldIdxms=";
   };
 
   configureFlags = [
diff --git a/pkgs/by-name/ka/kando/package.nix b/pkgs/by-name/ka/kando/package.nix
index 5becb3694d3c..6132c44268cf 100644
--- a/pkgs/by-name/ka/kando/package.nix
+++ b/pkgs/by-name/ka/kando/package.nix
@@ -23,16 +23,16 @@
 
 buildNpmPackage rec {
   pname = "kando";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "kando-menu";
     repo = "kando";
     tag = "v${version}";
-    hash = "sha256-ihWHyafDU/B2Xb3ezNlC7hB8EhBCQOSuW+ki/V2SIPs=";
+    hash = "sha256-4toYogcxvNS+J/OphXM1HtH61FZRmnLsgxOJtJgkVdM=";
   };
 
-  npmDepsHash = "sha256-PnKrTHAo3mKcVBhJQf/273k91UZxlDb3+2iXWGIfPs0=";
+  npmDepsHash = "sha256-lyCIuvyoVhcrNDDg0P3lSY8ru81momG1EKKT5u4yW8Y=";
 
   npmFlags = [ "--ignore-scripts" ];
 
diff --git a/pkgs/by-name/ka/kata-runtime/kata-images.nix b/pkgs/by-name/ka/kata-runtime/kata-images.nix
index b145c9a340d4..e1b15266a99c 100644
--- a/pkgs/by-name/ka/kata-runtime/kata-images.nix
+++ b/pkgs/by-name/ka/kata-runtime/kata-images.nix
@@ -16,8 +16,8 @@ let
 
   imageHash =
     {
-      "x86_64-linux" = "sha256-6ySKAqrbHDRgVlI7wm2p4Uw96ZMzUpP00liujxlruSM=";
-      "aarch64-linux" = "sha256-pEPkDXT4OunfN2sGb8Ru05tFHaBsYUcmG5Iy7yH4kX8=";
+      "x86_64-linux" = "sha256-7xDc5Rr3rP36zS3kpM2QEqOCtmka3EAnts4Z1h8MNWY=";
+      "aarch64-linux" = "sha256-8nLHTPetEfIrdtrpiT9Czcpf0NhL97TZ2DXyeBL04LA=";
     }
     ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
diff --git a/pkgs/by-name/ka/kata-runtime/package.nix b/pkgs/by-name/ka/kata-runtime/package.nix
index fa06ba0ea733..57dbe5608066 100644
--- a/pkgs/by-name/ka/kata-runtime/package.nix
+++ b/pkgs/by-name/ka/kata-runtime/package.nix
@@ -11,7 +11,7 @@
 }:
 
 let
-  version = "3.7.0";
+  version = "3.16.0";
 
   kata-images = callPackage ./kata-images.nix { inherit version; };
 
@@ -34,7 +34,7 @@ buildGoModule rec {
     owner = "kata-containers";
     repo = "kata-containers";
     rev = version;
-    hash = "sha256-Ir+/ZZJHm6E+044wczU3UvL+Py9Wprgw2QKJaYyDrKU=";
+    hash = "sha256-+SppAF77NbXlSrBGvIm40AmNC12GrexbX7fAPBoDAcs=";
   };
 
   sourceRoot = "${src.name}/src/runtime";
diff --git a/pkgs/by-name/ma/maa-assistant-arknights/pin.json b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
index ea4a9001efe2..1e2ba69c807e 100644
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@@ -1,10 +1,10 @@
 {
   "stable": {
-    "version": "5.15.1",
-    "hash": "sha256-nN5bOoLtj5zL5dXZkA/P3sDxZwu/LKfXnMnCxtKJbC0="
+    "version": "5.16.4",
+    "hash": "sha256-1ERKook2z8fKHOkAi43fU0amBgQaxYewFYCQGjFcF3o="
   },
   "beta": {
-    "version": "5.15.1",
-    "hash": "sha256-nN5bOoLtj5zL5dXZkA/P3sDxZwu/LKfXnMnCxtKJbC0="
+    "version": "5.16.4",
+    "hash": "sha256-1ERKook2z8fKHOkAi43fU0amBgQaxYewFYCQGjFcF3o="
   }
 }
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index 9798139278b6..aea81d315293 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -19,8 +19,8 @@
     #
     # Ensure you also check ../mattermostLatest/package.nix.
     regex = "^v(10\\.5\\.[0-9]+)$";
-    version = "10.5.4";
-    srcHash = "sha256-qf+OabB+QUaWRQTakuRy2dhUlmBv11Fdd8yh5QolVB0=";
+    version = "10.5.5";
+    srcHash = "sha256-ptyBYZvxCnqD3SX1Cy1uNFjM8wvBHDrroGsu1SnnuJs=";
     vendorHash = "sha256-9Jl+lxvSoxUReziTqkDRyeNrijGWcBDbqoywJRIeD2k=";
     npmDepsHash = "sha256-tIeuDUZbqgqooDm5TRfViiTT5OIyN0BPwvJdI+wf7p0=";
     lockfileOverlay = ''
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 7c9f33511237..59bbc8ed4346 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -21,17 +21,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2025.4.11";
+  version = "2025.5.3";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-qnVLVT+evB/gUxU8HQaOhT3imdtVN2Iwh+7ldx6NR6s=";
+    hash = "sha256-BNGjkWBw2RKHmZH5HYy7AGALaVLStXK91ilw9K8iO0U=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-TBkU10eqNT5825QlDyeBUAw3CZXUGSu4ufoC5XrmJ04=";
+  cargoHash = "sha256-1bbj66+h9gnXqpf55cprqzZ5Ld44dsfET3FldututR4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ni/nightlight/package.nix b/pkgs/by-name/ni/nightlight/package.nix
new file mode 100644
index 000000000000..187d99965d2e
--- /dev/null
+++ b/pkgs/by-name/ni/nightlight/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  makeWrapper,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nightlight";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "smudge";
+    repo = "nightlight";
+    tag = "v${version}";
+    hash = "sha256-NOphjrqsnO5693Zw3NkX3c74I3PdJ8W6sxYwOEJ1yCU=";
+  };
+
+  useFetchCargoVendor = true;
+
+  cargoHash = "sha256-v5Oo1AxwvJs66l9CtVjO+WfwgsM16zSLT1SSnDi1kSo=";
+
+  checkFlags = [
+    "--skip=repl"
+    "--skip=printer::tests"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/smudge/nightlight";
+    description = "CLI tool for configuring Night Shift macOS";
+    maintainers = with lib.maintainers; [ aspauldingcode ];
+    platforms = lib.platforms.darwin;
+    license = lib.licenses.mit;
+    mainProgram = "nightlight";
+  };
+}
diff --git a/pkgs/by-name/ni/nix-forecast/package.nix b/pkgs/by-name/ni/nix-forecast/package.nix
index 14801c299675..2535821ebb0d 100644
--- a/pkgs/by-name/ni/nix-forecast/package.nix
+++ b/pkgs/by-name/ni/nix-forecast/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-forecast";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "getchoo";
     repo = "nix-forecast";
     tag = "v${version}";
-    hash = "sha256-di9RV4xSCqIa+UCdALAEdR0cDq3u799L3YyFyAF+bRg=";
+    hash = "sha256-GTINiV+oHmu1/DmQsE7UjfAFFtH26LK35TveW437lPA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-n5LKfHBmua8iridnHY0C6ayjREwnqQpDI75+Ips4aNc=";
+  cargoHash = "sha256-FQph9QOc0JrVjdilUxjRc77/obICK7fgzcDuqAoE2cs=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/nv/nvidia-container-toolkit/package.nix b/pkgs/by-name/nv/nvidia-container-toolkit/package.nix
index fbe48ffd735d..7543a52d4634 100644
--- a/pkgs/by-name/nv/nvidia-container-toolkit/package.nix
+++ b/pkgs/by-name/nv/nvidia-container-toolkit/package.nix
@@ -52,15 +52,19 @@ buildGoModule rec {
 
   postPatch = ''
     substituteInPlace internal/config/config.go \
-      --replace '/usr/bin/nvidia-container-runtime-hook' "$tools/bin/nvidia-container-runtime-hook" \
-      --replace '/sbin/ldconfig' '${lib.getBin glibc}/sbin/ldconfig'
+      --replace-fail '/usr/bin/nvidia-container-runtime-hook' "$tools/bin/nvidia-container-runtime-hook" \
+      --replace-fail '/sbin/ldconfig' '${lib.getBin glibc}/sbin/ldconfig'
 
     substituteInPlace tools/container/toolkit/toolkit.go \
-      --replace '/sbin/ldconfig' '${lib.getBin glibc}/sbin/ldconfig'
+      --replace-fail '/sbin/ldconfig' '${lib.getBin glibc}/sbin/ldconfig'
+
+    substituteInPlace cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go \
+      --replace-fail '/sbin/ldconfig' '${lib.getBin glibc}/sbin/ldconfig'
   '';
 
   subPackages = [
     "cmd/nvidia-cdi-hook"
+    "cmd/nvidia-container-runtime"
     "cmd/nvidia-container-runtime.cdi"
     "cmd/nvidia-container-runtime-hook"
     "cmd/nvidia-container-runtime.legacy"
@@ -77,6 +81,8 @@ buildGoModule rec {
     # "-X name=value"
     "-X"
     "${cliVersionPackage}.version=${version}"
+    "-X"
+    "github.com/NVIDIA/nvidia-container-toolkit/internal/info.gitCommit=${src.rev}"
   ];
 
   nativeBuildInputs = [
@@ -99,11 +105,13 @@ buildGoModule rec {
 
   postInstall =
     ''
-      wrapProgram $out/bin/nvidia-container-runtime-hook \
-        --prefix PATH : ${libnvidia-container}/bin
-
       mkdir -p $tools/bin
-      mv $out/bin/{nvidia-cdi-hook,nvidia-container-runtime.cdi,nvidia-container-runtime-hook,nvidia-container-runtime.legacy} $tools/bin
+      mv $out/bin/{nvidia-cdi-hook,nvidia-container-runtime,nvidia-container-runtime.cdi,nvidia-container-runtime-hook,nvidia-container-runtime.legacy} $tools/bin
+
+      for bin in nvidia-container-runtime-hook nvidia-container-runtime; do
+        wrapProgram $tools/bin/$bin \
+          --prefix PATH : ${libnvidia-container}/bin:$out/bin
+      done
     ''
     + lib.optionalString (configTemplate != null || configTemplatePath != null) ''
       mkdir -p $out/etc/nvidia-container-runtime
@@ -119,6 +127,9 @@ buildGoModule rec {
     description = "NVIDIA Container Toolkit";
     license = licenses.asl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cpcloud ];
+    maintainers = with maintainers; [
+      cpcloud
+      christoph-heiss
+    ];
   };
 }
diff --git a/pkgs/by-name/op/opensnitch-ui/package.nix b/pkgs/by-name/op/opensnitch-ui/package.nix
index 11ed3b064196..fe9b4584ad78 100644
--- a/pkgs/by-name/op/opensnitch-ui/package.nix
+++ b/pkgs/by-name/op/opensnitch-ui/package.nix
@@ -8,13 +8,13 @@
 
 python311Packages.buildPythonApplication rec {
   pname = "opensnitch-ui";
-  version = "1.6.8";
+  version = "1.6.9";
 
   src = fetchFromGitHub {
     owner = "evilsocket";
     repo = "opensnitch";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zn5kBnINLt/qqAbka9wShFLWJoMJ6SXu2OL6V6uQ2IM=";
+    hash = "sha256-c+VAlm32/NXvUr5i0AY/zuTrFIQLtPxNNeSiQTMoJAY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/opensnitch/package.nix b/pkgs/by-name/op/opensnitch/package.nix
index 39b4e6dfad79..8c0164d25382 100644
--- a/pkgs/by-name/op/opensnitch/package.nix
+++ b/pkgs/by-name/op/opensnitch/package.nix
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "opensnitch";
-  version = "1.6.7";
+  version = "1.6.9";
 
   src = fetchFromGitHub {
     owner = "evilsocket";
     repo = "opensnitch";
     tag = "v${version}";
-    hash = "sha256-2BwFCRbVvs7pAM5SnhynWws2+QthB/F9V6DYPViDICU=";
+    hash = "sha256-c+VAlm32/NXvUr5i0AY/zuTrFIQLtPxNNeSiQTMoJAY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/pa/pass-secret-service/package.nix b/pkgs/by-name/pa/pass-secret-service/package.nix
index 9525232213a0..a722b48c516d 100644
--- a/pkgs/by-name/pa/pass-secret-service/package.nix
+++ b/pkgs/by-name/pa/pass-secret-service/package.nix
@@ -6,6 +6,7 @@
   gnupg,
   coreutils,
   nixosTests,
+  nix-update-script,
 }:
 
 python3.pkgs.buildPythonApplication {
@@ -13,13 +14,13 @@ python3.pkgs.buildPythonApplication {
   # PyPI has old alpha version. Since then the project has switched from using a
   # seemingly abandoned D-Bus package pydbus and started using maintained
   # dbus-next. So let's use latest from GitHub.
-  version = "unstable-2022-07-18";
+  version = "0-unstable-2023-12-16";
 
   src = fetchFromGitHub {
     owner = "mdellweg";
     repo = "pass_secret_service";
-    rev = "fadc09be718ae1e507eeb8719f3a2ea23edb6d7a";
-    hash = "sha256-lrNU5bkG4/fMu5rDywfiI8vNHyBsMf/fiWIeEHug03c=";
+    rev = "6335c85d9a790a6472e3de6eff87a15208caa5dc";
+    hash = "sha256-SSmI3HJCUWuwFXCu3Zg66X18POlzp3ADRj7HeE8GRio=";
   };
 
   # Need to specify session.conf file for tests because it won't be found under
@@ -65,7 +66,12 @@ python3.pkgs.buildPythonApplication {
 
   checkTarget = "test";
 
-  passthru.tests.pass-secret-service = nixosTests.pass-secret-service;
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [ "--version=branch" ];
+    };
+    tests.pass-secret-service = nixosTests.pass-secret-service;
+  };
 
   meta = {
     description = "Libsecret D-Bus API with pass as the backend";
diff --git a/pkgs/by-name/po/polkadot/package.nix b/pkgs/by-name/po/polkadot/package.nix
index 1ae808ec2d50..d81e136d5174 100644
--- a/pkgs/by-name/po/polkadot/package.nix
+++ b/pkgs/by-name/po/polkadot/package.nix
@@ -17,13 +17,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "2503";
+  version = "2503-2";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot-sdk";
     rev = "polkadot-stable${version}";
-    hash = "sha256-nPZFmsf82JpBrOrErH5hrEcmieECfgA7JWzEyEh8AAE=";
+    hash = "sha256-sUBUWFAJ8PwWUVSqPef0SMJcvSt+bGruTW+GmJGTLdE=";
 
     # the build process of polkadot requires a .git folder in order to determine
     # the git commit hash that is being built and add it to the version string.
@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-yOJyvpsEK4Ab/Bh6xmqAEHhj1Rq4u/CevcP7vJi0zxo=";
+  cargoHash = "sha256-U3roe7rQL1BaHr3rKV1Dl7Lhjic3pZlxo2DpD9C2ong=";
 
   buildType = "production";
   buildAndTestSubdir = "polkadot";
diff --git a/pkgs/by-name/po/powerstation/package.nix b/pkgs/by-name/po/powerstation/package.nix
index d7f3dd5f8952..19e559a16662 100644
--- a/pkgs/by-name/po/powerstation/package.nix
+++ b/pkgs/by-name/po/powerstation/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "powerstation";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "PowerStation";
     tag = "v${version}";
-    hash = "sha256-R6p3zuYWggnOy60iGZ6G23ig1gzezweswAxVrCB+zvU=";
+    hash = "sha256-2NCUDR85LAWGYrxruHLSipgX41N/jgy/P34qfm+bOb4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3mOmDDDGW7AClG4tNuXti07lCNbK5bMnpWUnsxcxGPI=";
+  cargoHash = "sha256-4ACSwxGSPEdbGeVL44SN4qCd7ActL1T0xKuebPvTHPk=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/ro/rofi-games/package.nix b/pkgs/by-name/ro/rofi-games/package.nix
index a888de728d42..811a627ec6b0 100644
--- a/pkgs/by-name/ro/rofi-games/package.nix
+++ b/pkgs/by-name/ro/rofi-games/package.nix
@@ -14,18 +14,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rofi-games";
-  version = "1.10.9";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "Rolv-Apneseth";
     repo = "rofi-games";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VkhavN1nte0JYRn8PRER9B6baGiRr4Qr/L/yZ0cXZmc=";
+    hash = "sha256-6sopWMiXA6UmZP2wNbl7RlDDBRz4rNLPrNd6XnaFQko=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Ld6lFljnfNUwhoDOb8XdFka87E0Y+KN1GFnubUza/LY=";
+    hash = "sha256-5ofRwE68SNFYcnBiGORsTjl6jSeDJ+6PJH+/SA1l07g=";
   };
 
   patches = [
diff --git a/pkgs/by-name/rs/rspamd/package.nix b/pkgs/by-name/rs/rspamd/package.nix
index 35b0839ea46f..33d0789eaf21 100644
--- a/pkgs/by-name/rs/rspamd/package.nix
+++ b/pkgs/by-name/rs/rspamd/package.nix
@@ -24,7 +24,9 @@
   xxHash,
   zstd,
   libarchive,
-  withBlas ? true,
+  # Enabling blas support breaks bayes filter training from dovecot in nixos-mailserver tests
+  # https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/issues/321
+  withBlas ? false,
   withLuaJIT ? stdenv.hostPlatform.isx86_64,
   nixosTests,
 }:
diff --git a/pkgs/by-name/st/stevenblack-blocklist/package.nix b/pkgs/by-name/st/stevenblack-blocklist/package.nix
index 19a845a19a8d..f9074dd623e0 100644
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.15.34";
+  version = "3.15.37";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-FSZzTEQrjY4InqHo1wPbnqqwKHpbfV1Y5JJsYR/c6VU=";
+    hash = "sha256-d254AsNQgjExXaGd9EQ5dZ1xy5nP6Zqe2INtR9IKMiQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/su/suyu/fix-debugger.patch b/pkgs/by-name/su/suyu/fix-debugger.patch
deleted file mode 100644
index 87d4e0cc118f..000000000000
--- a/pkgs/by-name/su/suyu/fix-debugger.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff --git a/src/core/debugger/debugger.cpp b/src/core/debugger/debugger.cpp
-index e86aae8460..a4dca23770 100644
---- a/src/core/debugger/debugger.cpp
-+++ b/src/core/debugger/debugger.cpp
-@@ -5,7 +5,13 @@
- #include <mutex>
- #include <thread>
- 
--#include <boost/asio.hpp>
-+// Use basic asio functionality only
-+#define BOOST_ASIO_STANDALONE
-+#include <boost/asio/basic_io_object.hpp>
-+#include <boost/asio/ip/tcp.hpp>
-+#include <boost/asio/write.hpp>
-+#include <boost/asio/read.hpp>
-+
- #include <boost/process/async_pipe.hpp>
- 
- #include "common/logging/log.h"
-@@ -21,17 +27,22 @@
- 
- template <typename Readable, typename Buffer, typename Callback>
- static void AsyncReceiveInto(Readable& r, Buffer& buffer, Callback&& c) {
--    static_assert(std::is_trivial_v<Buffer>);
--    auto boost_buffer{boost::asio::buffer(&buffer, sizeof(Buffer))};
--    r.async_read_some(
--        boost_buffer, [&, c](const boost::system::error_code& error, size_t bytes_read) {
--            if (!error.failed()) {
--                const u8* buffer_start = reinterpret_cast<const u8*>(&buffer);
--                std::span<const u8> received_data{buffer_start, buffer_start + bytes_read};
--                c(received_data);
--                AsyncReceiveInto(r, buffer, c);
--            }
--        });
-+    try {
-+            static_assert(std::is_trivial_v<Buffer>);
-+            auto boost_buffer{boost::asio::buffer(&buffer, sizeof(Buffer))};
-+            r.async_read_some(
-+                boost_buffer,
-+                [&, c](const boost::system::error_code& error, size_t bytes_read) {
-+                    if (!error) {
-+                        const u8* buffer_start = reinterpret_cast<const u8*>(&buffer);
-+                        std::span<const u8> received_data{buffer_start, buffer_start + bytes_read};
-+                        c(received_data);
-+                        AsyncReceiveInto(r, buffer, c);
-+                    }
-+                });
-+        } catch (const std::exception& e) {
-+            LOG_ERROR(Debug_GDBStub, "AsyncReceiveInto error: {}", e.what());
-+        }
- }
- 
- template <typename Callback>
diff --git a/pkgs/by-name/su/suyu/fix-udp-client.patch b/pkgs/by-name/su/suyu/fix-udp-client.patch
deleted file mode 100644
index 103b1001ee2a..000000000000
--- a/pkgs/by-name/su/suyu/fix-udp-client.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/src/input_common/drivers/udp_client.cpp b/src/input_common/drivers/udp_client.cpp
-index 60821b31a6..8f9c047218 100644
---- a/src/input_common/drivers/udp_client.cpp
-+++ b/src/input_common/drivers/udp_client.cpp
-@@ -2,7 +2,15 @@
- // SPDX-License-Identifier: GPL-2.0-or-later
- 
- #include <random>
--#include <boost/asio.hpp>
-+// Include only needed asio components
-+#include <boost/asio/io_context.hpp>
-+#include <boost/asio/ip/udp.hpp>
-+#include <boost/asio/basic_waitable_timer.hpp>
-+#include <boost/asio/write.hpp>
-+#include <boost/asio/buffer.hpp>
-+#include <boost/asio/basic_socket.hpp>
-+#include <boost/asio/ip/address.hpp>
-+#include <boost/asio/ip/address_v4.hpp>
- #include <fmt/format.h>
- 
- #include "common/logging/log.h"
-@@ -113,7 +121,7 @@ private:
-     }
- 
-     SocketCallback callback;
--    boost::asio::io_service io_service;
-+    boost::asio::io_context io_service;
-     boost::asio::basic_waitable_timer<clock> timer;
-     udp::socket socket;
- 
diff --git a/pkgs/by-name/su/suyu/fix-udp-protocol.patch b/pkgs/by-name/su/suyu/fix-udp-protocol.patch
deleted file mode 100644
index 65c4862825fc..000000000000
--- a/pkgs/by-name/su/suyu/fix-udp-protocol.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/input_common/helpers/udp_protocol.h b/src/input_common/helpers/udp_protocol.h
-index db08fc62c5..ea223ea937 100644
---- a/src/input_common/helpers/udp_protocol.h
-+++ b/src/input_common/helpers/udp_protocol.h
-@@ -69,7 +69,7 @@ Message<T> CreateMessage(const u32 magic, const T data, const u32 sender_id) {
-     };
-     Message<T> message{header, data};
-     crc.process_bytes(&message, sizeof(Message<T>));
--    message.header.crc = crc.checksum();
-+    message.header.crc = static_cast<u32_le>(crc.checksum());
-     return message;
- }
- 
diff --git a/pkgs/by-name/su/suyu/package.nix b/pkgs/by-name/su/suyu/package.nix
deleted file mode 100644
index ea19a06ecf2d..000000000000
--- a/pkgs/by-name/su/suyu/package.nix
+++ /dev/null
@@ -1,237 +0,0 @@
-{
-  lib,
-  stdenv,
-  SDL2,
-  autoconf,
-  boost,
-  catch2_3,
-  cmake,
-  fetchFromGitHub,
-  cpp-jwt,
-  cubeb,
-  discord-rpc,
-  enet,
-  fetchgit,
-  fetchurl,
-  ffmpeg-headless,
-  fmt,
-  glslang,
-  libopus,
-  libusb1,
-  libva,
-  lz4,
-  unzip,
-  nix-update-script,
-  nlohmann_json,
-  nv-codec-headers-12,
-  pkg-config,
-  qt6,
-  vulkan-headers,
-  vulkan-loader,
-  yasm,
-  simpleini,
-  zlib,
-  vulkan-memory-allocator,
-  zstd,
-}:
-
-let
-  inherit (qt6)
-    qtbase
-    qtmultimedia
-    qtwayland
-    wrapQtAppsHook
-    qttools
-    qtwebengine
-    ;
-
-  compat-list = stdenv.mkDerivation {
-    pname = "yuzu-compatibility-list";
-    version = "unstable-2024-02-26";
-
-    src = fetchFromGitHub {
-      owner = "flathub";
-      repo = "org.yuzu_emu.yuzu";
-      rev = "9c2032a3c7e64772a8112b77ed8b660242172068";
-      hash = "sha256-ITh/W4vfC9w9t+TJnPeTZwWifnhTNKX54JSSdpgaoBk=";
-    };
-
-    buildCommand = ''
-      cp $src/compatibility_list.json $out
-    '';
-  };
-
-  nx_tzdb = stdenv.mkDerivation rec {
-    pname = "nx_tzdb";
-    version = "221202";
-
-    src = fetchurl {
-      url = "https://github.com/lat9nq/tzdb_to_nx/releases/download/${version}/${version}.zip";
-      hash = "sha256-mRzW+iIwrU1zsxHmf+0RArU8BShAoEMvCz+McXFFK3c=";
-    };
-
-    nativeBuildInputs = [ unzip ];
-
-    buildCommand = ''
-      unzip $src -d $out
-    '';
-
-  };
-
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "suyu";
-  version = "0.0.4";
-
-  src = fetchgit {
-    url = "https://git.suyu.dev/suyu/suyu";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-GgLCbQI7u9neFxQq4borNhlg72FIYn+J5XkaK/7hpnQ=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # Remove coroutines from debugger to fix boost::asio compatibility issues
-    ./fix-debugger.patch
-    # Add explicit cast for CRC checksum value
-    ./fix-udp-protocol.patch
-    # Use specific boost::asio includes and update to modern io_context
-    ./fix-udp-client.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    glslang
-    pkg-config
-    qttools
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    # vulkan-headers must come first, so the older propagated versions
-    # don't get picked up by accident
-    vulkan-headers
-
-    boost
-    catch2_3
-    cpp-jwt
-    cubeb
-    discord-rpc
-    # intentionally omitted: dynarmic - prefer vendored version for compatibility
-    enet
-
-    # ffmpeg deps (also includes vendored)
-    # we do not use internal ffmpeg because cuda errors
-    autoconf
-    yasm
-    libva # for accelerated video decode on non-nvidia
-    nv-codec-headers-12 # for accelerated video decode on nvidia
-    ffmpeg-headless
-    # end ffmpeg deps
-
-    fmt
-    # intentionally omitted: gamemode - loaded dynamically at runtime
-    # intentionally omitted: httplib - upstream requires an older version than what we have
-    libopus
-    libusb1
-    # intentionally omitted: LLVM - heavy, only used for stack traces in the debugger
-    lz4
-    nlohmann_json
-    qtbase
-    qtmultimedia
-    qtwayland
-    qtwebengine
-    # intentionally omitted: renderdoc - heavy, developer only
-    SDL2
-    # intentionally omitted: stb - header only libraries, vendor uses git snapshot
-    vulkan-memory-allocator
-    # intentionally omitted: xbyak - prefer vendored version for compatibility
-    zlib
-    zstd
-  ];
-
-  # This changes `ir/opt` to `ir/var/empty` in `externals/dynarmic/src/dynarmic/CMakeLists.txt`
-  # making the build fail, as that path does not exist
-  dontFixCmake = true;
-
-  cmakeFlags = [
-    # actually has a noticeable performance impact
-    (lib.cmakeBool "SUYU_ENABLE_LTO" true)
-
-    (lib.cmakeBool "ENABLE_QT6" true)
-    (lib.cmakeBool "ENABLE_QT_TRANSLATION" true)
-
-    # use system libraries
-    # NB: "external" here means "from the externals/ directory in the source",
-    # so "off" means "use system"
-    (lib.cmakeBool "SUYU_USE_EXTERNAL_SDL2" false)
-    (lib.cmakeBool "SUYU_USE_EXTERNAL_VULKAN_HEADERS" true)
-    "-DVulkan_INCLUDE_DIRS=${vulkan-headers}/include"
-
-    # # don't use system ffmpeg, suyu uses internal APIs
-    # (lib.cmakeBool "SUYU_USE_BUNDLED_FFMPEG" true)
-
-    # don't check for missing submodules
-    (lib.cmakeBool "SUYU_CHECK_SUBMODULES" false)
-
-    # enable some optional features
-    (lib.cmakeBool "SUYU_USE_QT_WEB_ENGINE" true)
-    (lib.cmakeBool "SUYU_USE_QT_MULTIMEDIA" true)
-    (lib.cmakeBool "USE_DISCORD_PRESENCE" true)
-
-    # We dont want to bother upstream with potentially outdated compat reports
-    (lib.cmakeBool "SUYU_ENABLE_COMPATIBILITY_REPORTING" false)
-    (lib.cmakeBool "ENABLE_COMPATIBILITY_LIST_DOWNLOAD" false) # We provide this deterministically
-  ];
-
-  env = {
-    # Does some handrolled SIMD
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isx86_64 "-msse4.1";
-  };
-
-  qtWrapperArgs = [
-    # Fixes vulkan detection.
-    # FIXME: patchelf --add-rpath corrupts the binary for some reason, investigate
-    "--prefix LD_LIBRARY_PATH : ${vulkan-loader}/lib"
-  ];
-
-  # Setting this through cmakeFlags does not work.
-  # https://github.com/NixOS/nixpkgs/issues/114044
-  preConfigure = lib.concatStringsSep "\n" [
-    ''
-      cmakeFlagsArray+=(
-        "-DTITLE_BAR_FORMAT_IDLE=${finalAttrs.pname} | ${finalAttrs.version} (nixpkgs) {}"
-        "-DTITLE_BAR_FORMAT_RUNNING=${finalAttrs.pname} | ${finalAttrs.version} (nixpkgs) | {}"
-      )
-    ''
-    # provide pre-downloaded tz data
-    ''
-      mkdir -p build/externals/nx_tzdb
-      ln -s ${nx_tzdb} build/externals/nx_tzdb/nx_tzdb
-    ''
-  ];
-
-  postConfigure = ''
-    ln -sf ${compat-list} ./dist/compatibility_list/compatibility_list.json
-  '';
-
-  postInstall = "
-    install -Dm444 $src/dist/72-suyu-input.rules $out/lib/udev/rules.d/72-suyu-input.rules
-  ";
-
-  meta = {
-    description = "Experimental Nintendo Switch emulator written in C++";
-    homepage = "https://suyu.dev";
-    mainProgram = "suyu";
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ liberodark ];
-    license = with lib.licenses; [
-      gpl3Plus
-      # Icons
-      asl20
-      mit
-      cc0
-    ];
-  };
-})
diff --git a/pkgs/by-name/sy/synadm/package.nix b/pkgs/by-name/sy/synadm/package.nix
index da29e374d217..9abb85fb09bd 100644
--- a/pkgs/by-name/sy/synadm/package.nix
+++ b/pkgs/by-name/sy/synadm/package.nix
@@ -1,21 +1,26 @@
 {
   lib,
-  python3,
-  fetchPypi,
+  python3Packages,
+  fetchFromGitea,
   nix-update-script,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "synadm";
-  version = "0.47";
-  format = "setuptools";
+  version = "0.48";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Ts/WPonVa+DUvKKa/XbmDDWx3vW17z0orVaIREJfnO0=";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "synadm";
+    repo = "synadm";
+    tag = "v${version}";
+    hash = "sha256-6t4CXXt22/yR0gIxSsM/r+zJQeoKz5q/Ifg8PLNojLI=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = [ python3Packages.setuptools ];
+
+  dependencies = with python3Packages; [
     click
     click-option-group
     dnspython
@@ -41,8 +46,9 @@ python3.pkgs.buildPythonApplication rec {
       conveniently issue commands available via its admin API's
       (element-hq/synapse@master/docs/admin_api)
     '';
-    changelog = "https://github.com/JOJ0/synadm/releases/tag/v${version}";
-    homepage = "https://github.com/JOJ0/synadm";
+    changelog = "https://codeberg.org/synadm/synadm/releases/tag/${src.tag}";
+    downloadPage = "https://codeberg.org/synadm/synadm";
+    homepage = "https://synadm.readthedocs.io/";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ hexa ];
   };
diff --git a/pkgs/by-name/to/torzu/fix-aarch64-linux-build.patch b/pkgs/by-name/to/torzu/fix-aarch64-linux-build.patch
deleted file mode 100644
index 11d4a0a4ea2d..000000000000
--- a/pkgs/by-name/to/torzu/fix-aarch64-linux-build.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/src/video_core/host1x/vic.cpp b/src/video_core/host1x/vic.cpp
-index 3ad56bb80..57e6adbf8 100644
---- a/src/video_core/host1x/vic.cpp
-+++ b/src/video_core/host1x/vic.cpp
-@@ -13,7 +13,8 @@
- #endif
- #elif defined(ARCHITECTURE_arm64)
- #pragma GCC diagnostic push
--#pragma GCC diagnostic ignored "-Wimplicit-int-conversion"
-+#pragma GCC diagnostic ignored "-Wconversion"
-+#pragma GCC diagnostic ignored "-Wshadow"
- #include <sse2neon.h>
- #pragma GCC diagnostic pop
- #endif
diff --git a/pkgs/by-name/to/torzu/fix-debugger.patch b/pkgs/by-name/to/torzu/fix-debugger.patch
deleted file mode 100644
index 87d4e0cc118f..000000000000
--- a/pkgs/by-name/to/torzu/fix-debugger.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff --git a/src/core/debugger/debugger.cpp b/src/core/debugger/debugger.cpp
-index e86aae8460..a4dca23770 100644
---- a/src/core/debugger/debugger.cpp
-+++ b/src/core/debugger/debugger.cpp
-@@ -5,7 +5,13 @@
- #include <mutex>
- #include <thread>
- 
--#include <boost/asio.hpp>
-+// Use basic asio functionality only
-+#define BOOST_ASIO_STANDALONE
-+#include <boost/asio/basic_io_object.hpp>
-+#include <boost/asio/ip/tcp.hpp>
-+#include <boost/asio/write.hpp>
-+#include <boost/asio/read.hpp>
-+
- #include <boost/process/async_pipe.hpp>
- 
- #include "common/logging/log.h"
-@@ -21,17 +27,22 @@
- 
- template <typename Readable, typename Buffer, typename Callback>
- static void AsyncReceiveInto(Readable& r, Buffer& buffer, Callback&& c) {
--    static_assert(std::is_trivial_v<Buffer>);
--    auto boost_buffer{boost::asio::buffer(&buffer, sizeof(Buffer))};
--    r.async_read_some(
--        boost_buffer, [&, c](const boost::system::error_code& error, size_t bytes_read) {
--            if (!error.failed()) {
--                const u8* buffer_start = reinterpret_cast<const u8*>(&buffer);
--                std::span<const u8> received_data{buffer_start, buffer_start + bytes_read};
--                c(received_data);
--                AsyncReceiveInto(r, buffer, c);
--            }
--        });
-+    try {
-+            static_assert(std::is_trivial_v<Buffer>);
-+            auto boost_buffer{boost::asio::buffer(&buffer, sizeof(Buffer))};
-+            r.async_read_some(
-+                boost_buffer,
-+                [&, c](const boost::system::error_code& error, size_t bytes_read) {
-+                    if (!error) {
-+                        const u8* buffer_start = reinterpret_cast<const u8*>(&buffer);
-+                        std::span<const u8> received_data{buffer_start, buffer_start + bytes_read};
-+                        c(received_data);
-+                        AsyncReceiveInto(r, buffer, c);
-+                    }
-+                });
-+        } catch (const std::exception& e) {
-+            LOG_ERROR(Debug_GDBStub, "AsyncReceiveInto error: {}", e.what());
-+        }
- }
- 
- template <typename Callback>
diff --git a/pkgs/by-name/to/torzu/fix-udp-client.patch b/pkgs/by-name/to/torzu/fix-udp-client.patch
deleted file mode 100644
index 103b1001ee2a..000000000000
--- a/pkgs/by-name/to/torzu/fix-udp-client.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/src/input_common/drivers/udp_client.cpp b/src/input_common/drivers/udp_client.cpp
-index 60821b31a6..8f9c047218 100644
---- a/src/input_common/drivers/udp_client.cpp
-+++ b/src/input_common/drivers/udp_client.cpp
-@@ -2,7 +2,15 @@
- // SPDX-License-Identifier: GPL-2.0-or-later
- 
- #include <random>
--#include <boost/asio.hpp>
-+// Include only needed asio components
-+#include <boost/asio/io_context.hpp>
-+#include <boost/asio/ip/udp.hpp>
-+#include <boost/asio/basic_waitable_timer.hpp>
-+#include <boost/asio/write.hpp>
-+#include <boost/asio/buffer.hpp>
-+#include <boost/asio/basic_socket.hpp>
-+#include <boost/asio/ip/address.hpp>
-+#include <boost/asio/ip/address_v4.hpp>
- #include <fmt/format.h>
- 
- #include "common/logging/log.h"
-@@ -113,7 +121,7 @@ private:
-     }
- 
-     SocketCallback callback;
--    boost::asio::io_service io_service;
-+    boost::asio::io_context io_service;
-     boost::asio::basic_waitable_timer<clock> timer;
-     udp::socket socket;
- 
diff --git a/pkgs/by-name/to/torzu/fix-udp-protocol.patch b/pkgs/by-name/to/torzu/fix-udp-protocol.patch
deleted file mode 100644
index 65c4862825fc..000000000000
--- a/pkgs/by-name/to/torzu/fix-udp-protocol.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/input_common/helpers/udp_protocol.h b/src/input_common/helpers/udp_protocol.h
-index db08fc62c5..ea223ea937 100644
---- a/src/input_common/helpers/udp_protocol.h
-+++ b/src/input_common/helpers/udp_protocol.h
-@@ -69,7 +69,7 @@ Message<T> CreateMessage(const u32 magic, const T data, const u32 sender_id) {
-     };
-     Message<T> message{header, data};
-     crc.process_bytes(&message, sizeof(Message<T>));
--    message.header.crc = crc.checksum();
-+    message.header.crc = static_cast<u32_le>(crc.checksum());
-     return message;
- }
- 
diff --git a/pkgs/by-name/to/torzu/package.nix b/pkgs/by-name/to/torzu/package.nix
deleted file mode 100644
index 8545b55189fe..000000000000
--- a/pkgs/by-name/to/torzu/package.nix
+++ /dev/null
@@ -1,229 +0,0 @@
-{
-  lib,
-  stdenv,
-  SDL2,
-  boost,
-  catch2_3,
-  cmake,
-  fetchFromGitHub,
-  cpp-jwt,
-  cubeb,
-  discord-rpc,
-  enet,
-  fetchgit,
-  fetchurl,
-  ffmpeg-headless,
-  fmt,
-  glslang,
-  libopus,
-  libusb1,
-  lz4,
-  python3,
-  unzip,
-  nix-update-script,
-  nlohmann_json,
-  pkg-config,
-  qt6,
-  spirv-tools,
-  spirv-headers,
-  vulkan-utility-libraries,
-  vulkan-headers,
-  vulkan-loader,
-  simpleini,
-  zlib,
-  vulkan-memory-allocator,
-  zstd,
-}:
-
-let
-  inherit (qt6)
-    qtbase
-    qtmultimedia
-    qtwayland
-    wrapQtAppsHook
-    qttools
-    qtwebengine
-    ;
-
-  compat-list = stdenv.mkDerivation {
-    pname = "yuzu-compatibility-list";
-    version = "unstable-2024-02-26";
-
-    src = fetchFromGitHub {
-      owner = "flathub";
-      repo = "org.yuzu_emu.yuzu";
-      rev = "9c2032a3c7e64772a8112b77ed8b660242172068";
-      hash = "sha256-ITh/W4vfC9w9t+TJnPeTZwWifnhTNKX54JSSdpgaoBk=";
-    };
-
-    buildCommand = ''
-      cp $src/compatibility_list.json $out
-    '';
-  };
-
-  nx_tzdb = stdenv.mkDerivation rec {
-    pname = "nx_tzdb";
-    version = "221202";
-
-    src = fetchurl {
-      url = "https://github.com/lat9nq/tzdb_to_nx/releases/download/${version}/${version}.zip";
-      hash = "sha256-mRzW+iIwrU1zsxHmf+0RArU8BShAoEMvCz+McXFFK3c=";
-    };
-
-    nativeBuildInputs = [ unzip ];
-
-    buildCommand = ''
-      unzip $src -d $out
-    '';
-
-  };
-
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "torzu";
-  version = "unstable-2025-02-22";
-
-  src = fetchgit {
-    url = "https://git.ynh.ovh/liberodark/torzu.git";
-    rev = "eaa9c9e3a46eb5099193b11d620ddfe96b6aec83";
-    hash = "sha256-KxLRXM8Y+sIW5L9oYMSeK95HRb30zGRRSfil9DO+utU=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # Remove coroutines from debugger to fix boost::asio compatibility issues
-    ./fix-debugger.patch
-    # Add explicit cast for CRC checksum value
-    ./fix-udp-protocol.patch
-    # Use specific boost::asio includes and update to modern io_context
-    ./fix-udp-client.patch
-    # Updates suppressed diagnostics
-    ./fix-aarch64-linux-build.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    glslang
-    pkg-config
-    python3
-    qttools
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    # vulkan-headers must come first, so the older propagated versions
-    # don't get picked up by accident
-    vulkan-headers
-
-    boost
-    catch2_3
-    cpp-jwt
-    cubeb
-    discord-rpc
-    # intentionally omitted: dynarmic - prefer vendored version for compatibility
-    enet
-
-    ffmpeg-headless
-    fmt
-    # intentionally omitted: gamemode - loaded dynamically at runtime
-    # intentionally omitted: httplib - upstream requires an older version than what we have
-    libopus
-    libusb1
-    # intentionally omitted: LLVM - heavy, only used for stack traces in the debugger
-    lz4
-    nlohmann_json
-    qtbase
-    qtmultimedia
-    qtwayland
-    qtwebengine
-    # intentionally omitted: renderdoc - heavy, developer only
-    SDL2
-    # intentionally omitted: stb - header only libraries, vendor uses git snapshot
-    simpleini
-    spirv-tools
-    spirv-headers
-    vulkan-memory-allocator
-    vulkan-utility-libraries
-    # intentionally omitted: xbyak - prefer vendored version for compatibility
-    zlib
-    zstd
-  ];
-
-  # This changes `ir/opt` to `ir/var/empty` in `externals/dynarmic/src/dynarmic/CMakeLists.txt`
-  # making the build fail, as that path does not exist
-  dontFixCmake = true;
-
-  __structuredAttrs = true;
-  cmakeFlags = [
-    # actually has a noticeable performance impact
-    (lib.cmakeBool "YUZU_ENABLE_LTO" true)
-    (lib.cmakeBool "YUZU_TESTS" false)
-
-    (lib.cmakeBool "ENABLE_QT6" true)
-    (lib.cmakeBool "ENABLE_QT_TRANSLATION" true)
-
-    # use system libraries
-    # NB: "external" here means "from the externals/ directory in the source",
-    # so "false" means "use system"
-    (lib.cmakeBool "YUZU_USE_EXTERNAL_SDL2" false)
-    (lib.cmakeBool "YUZU_USE_EXTERNAL_VULKAN_HEADERS" false)
-    (lib.cmakeBool "YUZU_USE_EXTERNAL_VULKAN_UTILITY_LIBRARIES" false)
-    (lib.cmakeBool "YUZU_USE_EXTERNAL_VULKAN_SPIRV_TOOLS" false)
-
-    # don't check for missing submodules
-    (lib.cmakeBool "YUZU_CHECK_SUBMODULES" false)
-
-    # enable some optional features
-    (lib.cmakeBool "YUZU_USE_QT_WEB_ENGINE" true)
-    (lib.cmakeBool "YUZU_USE_QT_MULTIMEDIA" true)
-    (lib.cmakeBool "USE_DISCORD_PRESENCE" true)
-
-    # We dont want to bother upstream with potentially outdated compat reports
-    (lib.cmakeBool "YUZU_ENABLE_COMPATIBILITY_REPORTING" false)
-    (lib.cmakeBool "ENABLE_COMPATIBILITY_LIST_DOWNLOAD" false) # We provide this deterministically
-
-    (lib.cmakeFeature "TITLE_BAR_FORMAT_IDLE" "${finalAttrs.pname} | ${finalAttrs.version} (nixpkgs) {}")
-    (lib.cmakeFeature "TITLE_BAR_FORMAT_RUNNING" "${finalAttrs.pname} | ${finalAttrs.version} (nixpkgs) | {}")
-  ];
-
-  env = {
-    # Does some handrolled SIMD
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isx86_64 "-msse4.1";
-  };
-
-  qtWrapperArgs = [
-    # Fixes vulkan detection.
-    # FIXME: patchelf --add-rpath corrupts the binary for some reason, investigate
-    "--prefix LD_LIBRARY_PATH : ${vulkan-loader}/lib"
-  ];
-
-  preConfigure = ''
-    # provide pre-downloaded tz data
-    mkdir -p build/externals/nx_tzdb
-    ln -s ${nx_tzdb} build/externals/nx_tzdb/nx_tzdb
-  '';
-
-  postConfigure = ''
-    ln -sf ${compat-list} ./dist/compatibility_list/compatibility_list.json
-  '';
-
-  postInstall = "
-    install -Dm444 $src/dist/72-yuzu-input.rules $out/lib/udev/rules.d/72-yuzu-input.rules
-  ";
-
-  meta = {
-    description = "Fork of yuzu, an open-source Nintendo Switch emulator";
-    homepage = "https://notabug.org/litucks/torzu";
-    mainProgram = "yuzu";
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ liberodark ];
-    license = with lib.licenses; [
-      gpl3Plus
-      # Icons
-      asl20
-      mit
-      cc0
-    ];
-  };
-})
diff --git a/pkgs/by-name/tr/trdl-client/package.nix b/pkgs/by-name/tr/trdl-client/package.nix
index b02807e16e66..693b47cb2250 100644
--- a/pkgs/by-name/tr/trdl-client/package.nix
+++ b/pkgs/by-name/tr/trdl-client/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "trdl-client";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "trdl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0Q0qs7lzLnJChhT3LGVCHIz1ruci/PGGLJdR9FO1RyE=";
+    hash = "sha256-QqAVcATpxfjKEaluurVN9EylEGKNKWlBkE8KepIpjfo=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/client";
diff --git a/pkgs/by-name/tu/tusd/package.nix b/pkgs/by-name/tu/tusd/package.nix
index 387352e4f553..5cc36513d403 100644
--- a/pkgs/by-name/tu/tusd/package.nix
+++ b/pkgs/by-name/tu/tusd/package.nix
@@ -33,6 +33,8 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [
       nh2
       kalbasit
+      kvz
+      Acconut
     ];
   };
 }
diff --git a/pkgs/by-name/xp/xplr/package.nix b/pkgs/by-name/xp/xplr/package.nix
index 7ea709aadb76..b099994eaae1 100644
--- a/pkgs/by-name/xp/xplr/package.nix
+++ b/pkgs/by-name/xp/xplr/package.nix
@@ -4,20 +4,19 @@
   rustPlatform,
   fetchFromGitHub,
 }:
-
 rustPlatform.buildRustPackage rec {
   pname = "xplr";
-  version = "0.21.9";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "sayanarijit";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0c2QJUEQwKEzzDBDP5XdX7xe1rivazsoZtepB4Dxp/c=";
+    hash = "sha256-QeR7KXwRGfAU31ueI6v26pKnoQdj2C7bXlcMP4qKvZg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-D8BYJtf6joAXyqLDdAeP4GGAA9W5dvA16ia4/ZeZWaE=";
+  cargoHash = "sha256-UkyRl2eY520JPxtcOl7hvkY3MCH2bi2jL9zCJEdkQmU=";
 
   # fixes `thread 'main' panicked at 'cannot find strip'` on x86_64-darwin
   env = lib.optionalAttrs (stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isDarwin) {
@@ -26,7 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
-    rm .cargo/config
+    rm .cargo/config.toml
   '';
 
   postInstall = ''
diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index a14a2f967a64..379c160f4d0f 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "10.3.3";
+  version = "10.4.2";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-SZIGwv/9aCA5/cZk8n32tkI/vu0oLw/t3dOJgf+km7c=";
+    hash = "sha256-shjjxdjbPdjbLcVyF3CfSKtsB24m+ez5/vehSOWcjls=";
   };
-  npmDepsHash = "sha256-i3ug7syt4ElLiHV/kdwoaNvPYDsTdjlIg4XQbkB+Q4A=";
+  npmDepsHash = "sha256-Wq/R9pvYfnE4RYBX7DB68/lgJ1Tz1nbjFK1SomVwkXA=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 
diff --git a/pkgs/development/libraries/tbb/2020_3.nix b/pkgs/development/libraries/tbb/2020_3.nix
index 0399aa4c165f..82101272c395 100644
--- a/pkgs/development/libraries/tbb/2020_3.nix
+++ b/pkgs/development/libraries/tbb/2020_3.nix
@@ -124,6 +124,7 @@ stdenv.mkDerivation rec {
     '';
     platforms = platforms.unix;
     maintainers = with maintainers; [
+      silvanshade
       thoughtpolice
       tmarkus
     ];
diff --git a/pkgs/development/libraries/tbb/2022_0.nix b/pkgs/development/libraries/tbb/2022_0.nix
index 75348dfa3323..bf7522d5c34d 100644
--- a/pkgs/development/libraries/tbb/2022_0.nix
+++ b/pkgs/development/libraries/tbb/2022_0.nix
@@ -85,6 +85,7 @@ stdenv.mkDerivation rec {
     '';
     platforms = platforms.unix ++ platforms.windows;
     maintainers = with maintainers; [
+      silvanshade
       thoughtpolice
       tmarkus
     ];
diff --git a/pkgs/development/libraries/tbb/default.nix b/pkgs/development/libraries/tbb/default.nix
index 8b677cc4f77e..738f3173c806 100644
--- a/pkgs/development/libraries/tbb/default.nix
+++ b/pkgs/development/libraries/tbb/default.nix
@@ -50,6 +50,9 @@ stdenv.mkDerivation rec {
       url = "https://patch-diff.githubusercontent.com/raw/uxlfoundation/oneTBB/pull/1696.patch";
       hash = "sha256-yjX2FkOK8bz29a/XSA7qXgQw9lxzx8VIgEBREW32NN4=";
     })
+    # Fix Threads::Threads target for static from https://github.com/oneapi-src/oneTBB/pull/1248
+    # This is a conflict-resolved cherry-pick of the above PR to due to formatting differences.
+    ./patches/fix-cmake-threads-threads-target-for-static.patch
   ];
 
   # Fix build with modern gcc
@@ -95,6 +98,7 @@ stdenv.mkDerivation rec {
     '';
     platforms = platforms.unix ++ platforms.windows;
     maintainers = with maintainers; [
+      silvanshade
       thoughtpolice
       tmarkus
     ];
diff --git a/pkgs/development/libraries/tbb/patches/fix-cmake-threads-threads-target-for-static.patch b/pkgs/development/libraries/tbb/patches/fix-cmake-threads-threads-target-for-static.patch
new file mode 100644
index 000000000000..5fdf4434abd2
--- /dev/null
+++ b/pkgs/development/libraries/tbb/patches/fix-cmake-threads-threads-target-for-static.patch
@@ -0,0 +1,34 @@
+From b42f074a724a41d2369a94283a2e94190d0cbb44 Mon Sep 17 00:00:00 2001
+From: Liam Keegan <liam@keegan.ch>
+Date: Fri, 10 Nov 2023 09:08:42 +0100
+Subject: [PATCH] Fix CMake "Threads::Threads target not found" issue for
+ static builds (#1248)
+
+- add `Threads` dependency to installed CMake config for static builds only
+- based on #912 by @p12tic including reviewer comments from @ilya-lavrenov and @isaevil
+- resolves #1145
+
+Signed-off-by: Liam Keegan <liam@keegan.ch>
+(cherry picked from commit 12ceae12138af08845b3e8c369b24527346fe99e)
+---
+ CMakeLists.txt | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 16ee29ed..0bc39a52 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -265,6 +265,10 @@ else()
+             COMPONENT devel)
+     file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}Config.cmake
+                "include(\${CMAKE_CURRENT_LIST_DIR}/${PROJECT_NAME}Targets.cmake)\n")
++        if (NOT BUILD_SHARED_LIBS)
++            file(APPEND ${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}Config.cmake
++                       "include(CMakeFindDependencyMacro)\nfind_dependency(Threads)\n")
++        endif()
+ 
+     write_basic_package_version_file("${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}ConfigVersion.cmake"
+                                      COMPATIBILITY AnyNewerVersion)
+-- 
+2.49.0
+
diff --git a/pkgs/development/python-modules/ruffus/default.nix b/pkgs/development/python-modules/ruffus/default.nix
index f7c96b10d3e1..06147e09686d 100644
--- a/pkgs/development/python-modules/ruffus/default.nix
+++ b/pkgs/development/python-modules/ruffus/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   hostname,
   pytest,
+  pythonAtLeast,
   lib,
   stdenv,
 }:
@@ -29,15 +30,21 @@ buildPythonPackage rec {
 
   # tests very flaky & hang often on darwin
   doCheck = !stdenv.hostPlatform.isDarwin;
-  # test files do indeed need to be executed separately
-  checkPhase = ''
-    pushd ruffus/test
-    rm test_with_logger.py  # spawns 500 processes
-    for f in test_*.py ; do
-      HOME=$TMPDIR pytest -v --disable-warnings $f
-    done
-    popd
-  '';
+  checkPhase =
+    # https://docs.python.org/3/whatsnew/3.13.html#re
+    lib.optionalString (pythonAtLeast "3.13") ''
+      substituteInPlace ruffus/test/test_ruffus_utility.py \
+        --replace-fail re.error re.PatternError
+    ''
+    # test files do indeed need to be executed separately
+    + ''
+      pushd ruffus/test
+      rm test_with_logger.py  # spawns 500 processes
+      for f in test_*.py ; do
+        HOME=$TMPDIR pytest -v --disable-warnings $f
+      done
+      popd
+    '';
   pythonImportsCheck = [ "ruffus" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/skidl/default.nix b/pkgs/development/python-modules/skidl/default.nix
index f7d4a032550b..a13f71228795 100644
--- a/pkgs/development/python-modules/skidl/default.nix
+++ b/pkgs/development/python-modules/skidl/default.nix
@@ -6,15 +6,15 @@
   kinparse,
   pyspice,
   graphviz,
+  sexpdata,
 }:
-
 buildPythonPackage rec {
   pname = "skidl";
   version = "2.0.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
-    owner = "xesscorp";
+    owner = "devbisme";
     repo = "skidl";
     tag = version;
     sha256 = "sha256-EzKtXdQFB6kjaIuCYAsyFPlwmkefb5RJcnpFYCVHHb8=";
@@ -25,6 +25,7 @@ buildPythonPackage rec {
     kinparse
     pyspice
     graphviz
+    sexpdata
   ];
 
   # Checks require availability of the kicad symbol libraries.
@@ -32,9 +33,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "skidl" ];
 
   meta = with lib; {
-    description = "Module that extends Python with the ability to design electronic circuits";
+    description = "SKiDL is a module that extends Python with the ability to design electronic circuits";
     mainProgram = "netlist_to_skidl";
-    homepage = "https://xess.com/skidl/docs/_site/";
+    homepage = "https://devbisme.github.io/skidl/";
     license = licenses.mit;
     maintainers = with maintainers; [ matthuszagh ];
   };
diff --git a/pkgs/os-specific/linux/rtl8192eu/default.nix b/pkgs/os-specific/linux/rtl8192eu/default.nix
index cb6c7fe94cf9..dca9dd5c7c11 100644
--- a/pkgs/os-specific/linux/rtl8192eu/default.nix
+++ b/pkgs/os-specific/linux/rtl8192eu/default.nix
@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "rtl8192eu";
-  version = "${kernel.version}-4.4.1.20240507";
+  version = "${kernel.version}-4.4.1.20250504";
 
   src = fetchFromGitHub {
     owner = "Mange";
     repo = "rtl8192eu-linux-driver";
-    rev = "27410641da6926eb1ac565068ff89d35f7496328";
-    sha256 = "sha256-/BztTE3yKw35Oo7KkzHMtD+8qpJNXWiSwR3YjrotR0I=";
+    rev = "27aa922c298f2be240eec6c2e8636fe865ece195";
+    sha256 = "sha256-1Kz/GgsHsEgrp+1x2rLpJpo98Ur16aWf9CV0gcYmp0Q=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/mail/mailpit/source.nix b/pkgs/servers/mail/mailpit/source.nix
index 639886b6b44b..70d1e838d833 100644
--- a/pkgs/servers/mail/mailpit/source.nix
+++ b/pkgs/servers/mail/mailpit/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "1.24.1";
-  hash = "sha256-qJfqycQKQlkGV4RJ7v97bH1gOaDaLpcaItrTkW1c4Sk=";
-  npmDepsHash = "sha256-tPye9tLz4SnGU+dxAitUehasYXHgy8Gxcc6xzC+8GmU=";
-  vendorHash = "sha256-7zCSQGN4Lz+gV0YQcG2AN9JB5oPLzsuhdX4Rm/4YItE=";
+  version = "1.24.2";
+  hash = "sha256-MRoo06As8gZkpeeRwoLThCrGdwKeS++6u877TDsZFqs=";
+  npmDepsHash = "sha256-502v1nEI6sYMttdpxPtjqOuN34HvI38RRbRLE3a0Dio=";
+  vendorHash = "sha256-UPp5c4KW3HQ0VE9Sk488mUpKzIxdfV4ScTSmdqxc4pU=";
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index b95d6df438e3..71a79d73207d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -425,6 +425,9 @@ mapAliases {
   chromatic = throw "chromatic has been removed due to being unmaintained and failing to build"; # Added 2025-04-18
   chrome-gnome-shell = gnome-browser-connector; # Added 2022-07-27
   cinnamon = throw "The cinnamon scope has been removed and all packages have been moved to the top-level"; # Added 2024-11-25
+  citra = throw "citra has been removed from nixpkgs, as it has been taken down upstream"; # added 2024-03-04
+  citra-nightly = throw "citra-nightly has been removed from nixpkgs, as it has been taken down upstream"; # added 2024-03-04
+  citra-canary = throw "citra-canary has been removed from nixpkgs, as it has been taken down upstream"; # added 2024-03-04
   cloog = throw "cloog has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   cloog_0_18_0 = throw "cloog_0_18_0 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   cloogppl = throw "cloogppl has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
@@ -497,6 +500,7 @@ mapAliases {
   ### D ###
 
   dap = throw "'dap' has been removed because it doesn't compile and has been unmaintained since 2014"; # Added 2025-05-10
+  darling = throw "'darling' has been removed due to vendoring Python2"; # Added 2025-05-10
   dart_stable = throw "'dart_stable' has been renamed to/replaced by 'dart'"; # Converted to throw 2024-10-17
   dart-sass-embedded = throw "dart-sass-embedded has been removed from nixpkgs, as is now included in Dart Sass itself.";
   dat = nodePackages.dat;
@@ -1753,6 +1757,7 @@ mapAliases {
   sumneko-lua-language-server = lua-language-server; # Added 2023-02-07
   sumokoin = throw "sumokoin has been removed as it was abandoned upstream"; # Added 2024-11-23
   supertag = throw "supertag has been removed as it was abandoned upstream and fails to build"; # Added 2025-04-20
+  suyu = throw "suyu has been removed from nixpkgs, as it is subject to a DMCA takedown"; # Added 2025-05-12
   swiProlog = lib.warnOnInstantiate "swiProlog has been renamed to swi-prolog" swi-prolog; # Added 2024-09-07
   swiPrologWithGui = lib.warnOnInstantiate "swiPrologWithGui has been renamed to swi-prolog-gui" swi-prolog-gui; # Added 2024-09-07
   swig1 = throw "swig1 has been removed as it is obsolete"; # Added 2024-08-23
@@ -1829,6 +1834,7 @@ mapAliases {
   tor-browser-bundle-bin = tor-browser; # Added 2023-09-23
   torrenttools = throw "torrenttools has been removed due to lack of maintanance upstream"; # Added 2025-04-06
   torq = throw "torq has been removed because the project went closed source"; # Added 2024-11-24
+  torzu = throw "torzu has been removed from nixpkgs, as it is subject to a DMCA takedown"; # Added 2025-05-12
   transmission = lib.warnOnInstantiate (transmission3Warning { }) transmission_3; # Added 2024-06-10
   transmission-gtk = lib.warnOnInstantiate (transmission3Warning {
     suffix = "-gtk";
@@ -2012,6 +2018,11 @@ mapAliases {
   yandex-browser-corporate = throw "'yandex-browser-corporate' has been removed, as it was broken and unmaintained"; # Added 2025-04-17
   youtrack_2022_3 = throw "'youtrack_2022_3' has been removed as it was deprecated. Please update to the 'youtrack' package."; # Added 2024-10-17
   yrd = throw "'yrd' has been removed, as it was broken and unmaintained"; # added 2024-05-27
+  yuzu-ea = throw "yuzu-ea has been removed from nixpkgs, as it has been taken down upstream"; # Added 2024-03-04
+  yuzu-early-access = throw "yuzu-early-access has been removed from nixpkgs, as it has been taken down upstream"; # Added 2024-03-04
+  yuzu = throw "yuzu has been removed from nixpkgs, as it has been taken down upstream"; # Added 2024-03-04
+  yuzu-mainline = throw "yuzu-mainline has been removed from nixpkgs, as it has been taken down upstream"; # Added 2024-03-04
+  yuzuPackages = throw "yuzuPackages has been removed from nixpkgs, as it has been taken down upstream"; # Added 2024-03-04
 
   ### Z ###
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 45403bd8077d..d259f29c7e74 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4410,6 +4410,8 @@ self: super: with self; {
 
   elevenlabs = callPackage ../development/python-modules/elevenlabs { };
 
+  elfdeps = toPythonModule (pkgs.elfdeps.override { python3Packages = self; });
+
   elgato = callPackage ../development/python-modules/elgato { };
 
   eliot = callPackage ../development/python-modules/eliot { };